Fix vlock doesn't perform PAM account management or credential reinitialization

kbd-1.15.5-vlock-more-pam.patch

@@ -0,0 +1,61 @@
+--- a/src/vlock/auth.c
++++ b/src/vlock/auth.c
+@@ -4,7 +4,7 @@
+   PAM authentication routine for vlock, the VT locking program for linux.
+ 
+   Copyright (C) 1994-1998 Michael K. Johnson <johnsonm@redhat.com>
+-  Copyright (C) 2002, 2005 Dmitry V. Levin <ldv@altlinux.org>
++  Copyright (C) 2002, 2005, 2013 Dmitry V. Levin <ldv@altlinux.org>
+ 
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+@@ -36,6 +36,25 @@
+ /* Unrecognized PAM error timeout. */
+ #define	ERROR_TIMEOUT	10
+ 
++static int
++do_account_password_management (pam_handle_t *pamh)
++{
++	int rc;
++
++	/* Whether the authenticated user is allowed to log in? */
++	rc = pam_acct_mgmt (pamh, 0);
++
++	/* Do we need to prompt the user for a new password? */
++	if (rc == PAM_NEW_AUTHTOK_REQD)
++		rc = pam_chauthtok (pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
++
++	/* Extend the lifetime of the existing credentials. */
++	if (rc == PAM_SUCCESS)
++		rc = pam_setcred (pamh, PAM_REFRESH_CRED);
++
++	return rc;
++}
++
+ int
+ get_password (pam_handle_t * pamh, const char *username, const char *tty)
+ {
+@@ -84,6 +103,23 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
+ 		switch (rc)
+ 		{
+ 			case PAM_SUCCESS:
++				rc = do_account_password_management (pamh);
++
++				if (rc != PAM_SUCCESS)
++				{
++					/*
++					 * The user was authenticated but
++					 * either account or password management
++					 * returned an error.
++					 */
++					printf ("%s.\n\n\n",
++						pam_strerror (pamh, rc));
++					fflush (stdout);
++					pam_end (pamh, rc);
++					pamh = 0;
++					break;
++				}
++
+ 				pam_end (pamh, rc);
+ 				/* Log the fact of console unlocking. */
+ 				syslog (LOG_NOTICE,

kbd.spec

@@ -1,6 +1,6 @@
 Name:           kbd
 Version:        1.15.5
-Release:        5%{?dist}
+Release:        9%{?dist}
 Summary:        Tools for configuring the console (keyboard, virtual terminals, etc.)
 
 Group:          System Environment/Base
@@ -12,6 +12,7 @@ Source3:        kbd-latarcyrheb-16-fixed.tar.bz2
 Source4:        fr-dvorak.tar.bz2
 Source5:        kbd-latarcyrheb-32.tar.bz2
 Source6:        xml2lst.pl
+Source7:        vlock.pamd
 # Patch0: puts additional information into man pages
 Patch0:         kbd-1.15-keycodes-man.patch
 # Patch1: sparc modifications
@@ -24,6 +25,8 @@ Patch3:         kbd-1.15.3-dumpkeys-man.patch
 Patch4:         kbd-1.15.5-loadkeys-regression.patch
 # Patch5: fixes decimal separator in Swiss German keyboard layout, bz 882529
 Patch5:         kbd-1.15.5-sg-decimal-separator.patch
+# Patch6: implement PAM account and password management, backported from upstream
+Patch6:         kbd-1.15.5-vlock-more-pam.patch
 
 BuildRequires:  bison, flex, gettext, pam-devel
 BuildRequires:  console-setup, xkeyboard-config
@@ -31,6 +34,7 @@ Requires:       initscripts >= 5.86-1
 Requires:       %{name}-misc = %{version}-%{release}
 Provides:       vlock = %{version}
 Conflicts:      vlock <= 1.3
+Obsoletes:      vlock
 
 %description
 The %{name} package contains tools for managing a Linux
@@ -54,6 +58,7 @@ cp -fp %{SOURCE6} .
 %patch3 -p1 -b .dumpkeys-man
 %patch4 -p1 -b .loadkeys-regression
 %patch5 -p1 -b .sg-decimal-separator
+%patch6 -p1 -b .vlock-more-pam
 
 # 7-bit maps are obsolete; so are non-euro maps
 pushd data/keymaps/i386
@@ -118,15 +123,26 @@ ln -s openvt $RPM_BUILD_ROOT%{_bindir}/open
 cp -r $RPM_BUILD_ROOT/lib/kbd/locale/ $RPM_BUILD_ROOT%{_datadir}/locale
 rm -rf $RPM_BUILD_ROOT/lib/kbd/locale
 
+# Install PAM configuration for vlock
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
+install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/vlock
+
 # Convert X keyboard layouts to console keymaps
 mkdir -p $RPM_BUILD_ROOT/lib/kbd/keymaps/xkb
 perl xml2lst.pl < /usr/share/X11/xkb/rules/base.xml > layouts-variants.lst
 while read line; do
   XKBLAYOUT=`echo "$line" | cut -d " " -f 1`
+  echo "$XKBLAYOUT" >> layouts-list.lst
   XKBVARIANT=`echo "$line" | cut -d " " -f 2`
   ckbcomp "$XKBLAYOUT" "$XKBVARIANT" | gzip > $RPM_BUILD_ROOT/lib/kbd/keymaps/xkb/"$XKBLAYOUT"-"$XKBVARIANT".map.gz
 done < layouts-variants.lst
 
+# Convert X keyboard layouts (plain, no variant)
+cat layouts-list.lst | sort -u >> layouts-list-uniq.lst
+while read line; do
+  ckbcomp "$line" | gzip > $RPM_BUILD_ROOT/lib/kbd/keymaps/xkb/"$line".map.gz
+done < layouts-list-uniq.lst
+
 %find_lang %{name}
 
 %files -f %{name}.lang
@@ -134,11 +150,27 @@ done < layouts-variants.lst
 /bin/*
 %{_bindir}/*
 %{_mandir}/*/*
+%config(noreplace) %{_sysconfdir}/pam.d/vlock
 
 %files misc
 /lib/kbd
 
 %changelog
+* Wed Nov 27 2013 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-9
+- Fix vlock doesn't perform PAM account management or credential reinitialization
+  (patch by  Dmitry V. Levin)
+  Resolves: #913311
+
+* Wed Nov 06 2013 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
+- Add PAM config for vlock
+  Resolves: #913309
+
+* Wed Aug 28 2013 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-7
+- Convert also plain layouts (no variant)
+
+* Thu May 23 2013 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-6
+- Add vlock to obsoletes
+
 * Thu Feb 21 2013 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-5
 - Fix decimal separator in Swiss German keyboard layout
   Resolves: #882529

vlock.pamd

@@ -0,0 +1,3 @@
+#%PAM-1.0
+auth       include      system-auth
+account    required     pam_permit.so