diff --git a/kbd-1.15.5-vlock-more-pam.patch b/kbd-1.15.5-vlock-more-pam.patch new file mode 100644 index 0000000..ba34255 --- /dev/null +++ b/kbd-1.15.5-vlock-more-pam.patch @@ -0,0 +1,61 @@ +--- a/src/vlock/auth.c ++++ b/src/vlock/auth.c +@@ -4,7 +4,7 @@ + PAM authentication routine for vlock, the VT locking program for linux. + + Copyright (C) 1994-1998 Michael K. Johnson +- Copyright (C) 2002, 2005 Dmitry V. Levin ++ Copyright (C) 2002, 2005, 2013 Dmitry V. Levin + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by +@@ -36,6 +36,25 @@ + /* Unrecognized PAM error timeout. */ + #define ERROR_TIMEOUT 10 + ++static int ++do_account_password_management (pam_handle_t *pamh) ++{ ++ int rc; ++ ++ /* Whether the authenticated user is allowed to log in? */ ++ rc = pam_acct_mgmt (pamh, 0); ++ ++ /* Do we need to prompt the user for a new password? */ ++ if (rc == PAM_NEW_AUTHTOK_REQD) ++ rc = pam_chauthtok (pamh, PAM_CHANGE_EXPIRED_AUTHTOK); ++ ++ /* Extend the lifetime of the existing credentials. */ ++ if (rc == PAM_SUCCESS) ++ rc = pam_setcred (pamh, PAM_REFRESH_CRED); ++ ++ return rc; ++} ++ + int + get_password (pam_handle_t * pamh, const char *username, const char *tty) + { +@@ -84,6 +103,23 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty) + switch (rc) + { + case PAM_SUCCESS: ++ rc = do_account_password_management (pamh); ++ ++ if (rc != PAM_SUCCESS) ++ { ++ /* ++ * The user was authenticated but ++ * either account or password management ++ * returned an error. ++ */ ++ printf ("%s.\n\n\n", ++ pam_strerror (pamh, rc)); ++ fflush (stdout); ++ pam_end (pamh, rc); ++ pamh = 0; ++ break; ++ } ++ + pam_end (pamh, rc); + /* Log the fact of console unlocking. */ + syslog (LOG_NOTICE, diff --git a/kbd.spec b/kbd.spec index 802ae94..1b4267c 100644 --- a/kbd.spec +++ b/kbd.spec @@ -1,6 +1,6 @@ Name: kbd Version: 1.15.5 -Release: 5%{?dist} +Release: 9%{?dist} Summary: Tools for configuring the console (keyboard, virtual terminals, etc.) Group: System Environment/Base @@ -12,6 +12,7 @@ Source3: kbd-latarcyrheb-16-fixed.tar.bz2 Source4: fr-dvorak.tar.bz2 Source5: kbd-latarcyrheb-32.tar.bz2 Source6: xml2lst.pl +Source7: vlock.pamd # Patch0: puts additional information into man pages Patch0: kbd-1.15-keycodes-man.patch # Patch1: sparc modifications @@ -24,6 +25,8 @@ Patch3: kbd-1.15.3-dumpkeys-man.patch Patch4: kbd-1.15.5-loadkeys-regression.patch # Patch5: fixes decimal separator in Swiss German keyboard layout, bz 882529 Patch5: kbd-1.15.5-sg-decimal-separator.patch +# Patch6: implement PAM account and password management, backported from upstream +Patch6: kbd-1.15.5-vlock-more-pam.patch BuildRequires: bison, flex, gettext, pam-devel BuildRequires: console-setup, xkeyboard-config @@ -31,6 +34,7 @@ Requires: initscripts >= 5.86-1 Requires: %{name}-misc = %{version}-%{release} Provides: vlock = %{version} Conflicts: vlock <= 1.3 +Obsoletes: vlock %description The %{name} package contains tools for managing a Linux @@ -54,6 +58,7 @@ cp -fp %{SOURCE6} . %patch3 -p1 -b .dumpkeys-man %patch4 -p1 -b .loadkeys-regression %patch5 -p1 -b .sg-decimal-separator +%patch6 -p1 -b .vlock-more-pam # 7-bit maps are obsolete; so are non-euro maps pushd data/keymaps/i386 @@ -118,15 +123,26 @@ ln -s openvt $RPM_BUILD_ROOT%{_bindir}/open cp -r $RPM_BUILD_ROOT/lib/kbd/locale/ $RPM_BUILD_ROOT%{_datadir}/locale rm -rf $RPM_BUILD_ROOT/lib/kbd/locale +# Install PAM configuration for vlock +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d +install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/vlock + # Convert X keyboard layouts to console keymaps mkdir -p $RPM_BUILD_ROOT/lib/kbd/keymaps/xkb perl xml2lst.pl < /usr/share/X11/xkb/rules/base.xml > layouts-variants.lst while read line; do XKBLAYOUT=`echo "$line" | cut -d " " -f 1` + echo "$XKBLAYOUT" >> layouts-list.lst XKBVARIANT=`echo "$line" | cut -d " " -f 2` ckbcomp "$XKBLAYOUT" "$XKBVARIANT" | gzip > $RPM_BUILD_ROOT/lib/kbd/keymaps/xkb/"$XKBLAYOUT"-"$XKBVARIANT".map.gz done < layouts-variants.lst +# Convert X keyboard layouts (plain, no variant) +cat layouts-list.lst | sort -u >> layouts-list-uniq.lst +while read line; do + ckbcomp "$line" | gzip > $RPM_BUILD_ROOT/lib/kbd/keymaps/xkb/"$line".map.gz +done < layouts-list-uniq.lst + %find_lang %{name} %files -f %{name}.lang @@ -134,11 +150,27 @@ done < layouts-variants.lst /bin/* %{_bindir}/* %{_mandir}/*/* +%config(noreplace) %{_sysconfdir}/pam.d/vlock %files misc /lib/kbd %changelog +* Wed Nov 27 2013 Vitezslav Crhonek - 1.15.5-9 +- Fix vlock doesn't perform PAM account management or credential reinitialization + (patch by Dmitry V. Levin) + Resolves: #913311 + +* Wed Nov 06 2013 Vitezslav Crhonek - 1.15.5-8 +- Add PAM config for vlock + Resolves: #913309 + +* Wed Aug 28 2013 Vitezslav Crhonek - 1.15.5-7 +- Convert also plain layouts (no variant) + +* Thu May 23 2013 Vitezslav Crhonek - 1.15.5-6 +- Add vlock to obsoletes + * Thu Feb 21 2013 Vitezslav Crhonek - 1.15.5-5 - Fix decimal separator in Swiss German keyboard layout Resolves: #882529 diff --git a/vlock.pamd b/vlock.pamd new file mode 100644 index 0000000..d2d47e5 --- /dev/null +++ b/vlock.pamd @@ -0,0 +1,3 @@ +#%PAM-1.0 +auth include system-auth +account required pam_permit.so