2018-05-18  Thorsten Kukuk  <kukuk@thkukuk.de>

	Release version 1.3.1.

	Add xz compression.

2018-05-16  Allison Karlitskaya  <allison.karlitskaya@redhat.com>

	pam_motd: add support for a motd.d directory (#48)

	Add a new feature to pam_motd to allow packages to install their own

	message files in a "motd.d" directory, to be displayed after the primary

	motd.

	Add an option motd_d= to specify the location of this directory.

	Modify the defaults, in the case where no options are given, to display

	both /etc/motd and /etc/motd.d.

	Fixes #47

	 * modules/pam_motd/pam_motd.c: add support for motd.d

	 * modules/pam_motd/pam_motd.8.xml: update the manpage

2018-05-02  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_umask: Fix documentation to align with order of loading umask.

	* modules/pam_umask/pam_umask.8.xml: Document the real order of loading

	umask.

2018-04-10  Joey Chagnon  <joeychagnon@users.noreply.github.com>

	Fix missing word in documentation.

	*  doc/man/pam_get_user.3.xml: Fix it.

2017-11-10  Dmitry V. Levin  <ldv@altlinux.org>

	pam_tally2 --reset: avoid creating a missing tallylog file.

	There is no need for pam_tally2 in --reset=0 mode to create a missing

	tallylog file because its absence has the same meaning as its existence

	with the appropriate entry reset.

	This was not a big deal until useradd(8) from shadow suite release 4.5

	started to invoke /sbin/pam_tally2 --reset routinely regardless of PAM

	configuration.

	The positive effect of this change is noticeable when using tools like

	cpio(1) that cannot archive huge sparse files efficiently.

	* modules/pam_tally2/pam_tally2.c [MAIN] (main) <cline_user>: Stat

	cline_filename when cline_reset == 0, exit early if the file is missing.

2017-11-10  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_mkhomedir: Allow creating parent of homedir under /

	* modules/pam_mkhomedir/mkhomedir_helper.c (make_parent_dirs): Do not

	skip creating the directory if we are under /.

2017-10-09  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_tty_audit: Fix regression introduced by adding the uid range support.

	* modules/pam_tty_audit/pam_tty_audit.c (parse_uid_range): Fix constification and

	remove unneeded code carried from pam_limits.

	(pam_sm_open_session): When multiple enable/disable options are present do not

	stop after first match.

2017-09-06  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_access: Add note about spaces around ':' in access.conf(5)

	* modules/pam_access/access.conf.5.xml: Add note about spaces around ':'

	Workaround formatting problem in pam(8)

	* doc/man/pam.8.xml: Workaround formatting problem.

2017-07-12  Peter Urbanec  <peterurbanec@users.noreply.github.com>

	pam_unix: Check return value of malloc used for setcred data (#24)

	Check the return value of malloc and if it failed print debug info, send

	a syslog message and return an error code.

	The test in AUTH_RETURN for ret_data not being NULL becomes redundant.

2017-07-10  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_cracklib: Drop unused prompt macros.

	* modules/pam_cracklib/pam_cracklib.c: Drop the unused macros.

2017-06-28  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_tty_audit: Support matching users by uid range.

	* modules/pam_tty_audit/pam_tty_audit.c (parse_uid_range): New function to

	parse the uid range.

	(pam_sm_open_session): Call parse_uid_range() and behave according to its result.

	* modules/pam_tty_audit/pam_tty_audit.8.xml: Document the uid range matching.

2017-05-31  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_access: support parsing files in /etc/security/access.d/*.conf.

	* modules/pam_access/pam_access.c (login_access): Return NOMATCH if

	there was no match in the parsed file.

	(pam_sm_authenticate): Add glob() call to go through the ACCESS_CONF_GLOB

	subdirectory and call login_access() on the individual files matched.

	* modules/pam_access/pam_access.8.xml: Document the addition.

	* modules/pam_access/Makefile.am: Add ACCESS_CONF_GLOB definition.

2017-04-11  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_localuser: Correct the example in documentation.

	* modules/pam_localuser/pam_localuser.8.xml: The example configuration

	  does something different.

	pam_localuser: Correct documentation of return value.

	* modules/pam_localuser/pam_localuser.8.xml: The module returns

	  PAM_PERM_DENIED when the user is not listed.

2017-03-10  Saul Johnson  <saul.a.johnson@gmail.com>

	Make maxclassrepeat=1 behavior consistent with docs (#9)

	* modules/pam_cracklib/pam_cracklib.c (simple): Apply the maxclassrepeat when greater than 0.

2017-02-09  Josef Moellers  <jmoellers@suse.de>

	Properly test for strtol() failure to find any digits.

	* modules/pam_access/pam_access.c (network_netmask_match): Test for endptr set

	to beginning and not NULL.

2017-01-19  Daniel Abrecht  <daniel.abrecht@hotmail.com>

	pam_exec: fix a potential null pointer dereference.

	Fix a null pointer dereference when pam_prompt returns PAM_SUCCESS

	but the response is set to NULL.

	* modules/pam_exec/pam_exec.c (call_exec): Do not invoke strndupa

	with a null pointer.

	Closes: https://github.com/linux-pam/linux-pam/pull/2

2016-12-07  Antonio Ospite  <ao2@ao2.it>

	Add missing comma in the limits.conf.5 manpage.

	* modules/pam_limits/limits.conf.5.xml: add a missing comma

2016-11-14  Tomas Mraz  <tmraz@fedoraproject.org>

	Regular links doesn't work with -no-numbering -no-references.

	* configure.ac: Use elinks instead of links.

2016-11-01  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_access: First check for the (group) match.

	The (group) match is performed first to allow for groups

	containing '@'.

	* modules/pam_access/pam_access.c (user_match): First check for the (group) match.

2016-10-17  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_ftp: Properly use the first name from the supplied list.

	* modules/pam_ftp/pam_ftp.c (lookup): Return first user from the list

	of anonymous users if user name matches.

	(pam_sm_authenticate): Free the returned value allocated in lookup().

2016-09-12  Bartos-Elekes Zsolt  <muszi@kite.hu>

	pam_issue: Fix no prompting in parse escape codes mode.

	* modules/pam_issue/pam_issue.c (read_issue_quoted): Fix misplaced strcat().

2016-06-30  Maxin B. John  <maxin.john@intel.com>

	xtests: remove bash dependency.

	There are no bash specific syntax in the xtest scripts. So, remove

	the bash dependency.

2016-06-30  Tomas Mraz  <tmraz@fedoraproject.org>

	Unification and cleanup of syslog log levels.

	* libpam/pam_handlers.c: Make memory allocation failures LOG_CRIT.

	* libpam/pam_modutil_priv.c: Make memory allocation failures LOG_CRIT.

	* modules/pam_echo/pam_echo.c: Make memory allocation failures LOG_CRIT.

	* modules/pam_env/pam_env.c: Make memory allocation failures LOG_CRIT.

	* modules/pam_exec/pam_exec.c: Make memory allocation failures LOG_CRIT.

	* modules/pam_filter/pam_filter.c: Make all non-memory call errors LOG_ERR.

	* modules/pam_group/pam_group.c: Make memory allocation failures LOG_CRIT.

	* modules/pam_issue/pam_issue.c: Make memory allocation failures LOG_CRIT.

	* modules/pam_lastlog/pam_lastlog.c: The lastlog file creation is syslogged

	  with LOG_NOTICE, memory allocation errors with LOG_CRIT, other errors

	  with LOG_ERR.

	* modules/pam_limits/pam_limits.c: User login limit messages are syslogged

	  with LOG_NOTICE, stale utmp entry with LOG_INFO, non-memory errors with

	  LOG_ERR.

	* modules/pam_listfile/pam_listfile.c: Rejection of user is syslogged

	  with LOG_NOTICE.

	* modules/pam_namespace/pam_namespace.c: Make memory allocation failures

	  LOG_CRIT.

	* modules/pam_nologin/pam_nologin.c: Make memory allocation failures

	  LOG_CRIT, other errors LOG_ERR.

	* modules/pam_securetty/pam_securetty.c: Rejection of access is syslogged

	  with LOG_NOTICE, non-memory errors with LOG_ERR.

	* modules/pam_selinux/pam_selinux.c: Make memory allocation failures LOG_CRIT.

	* modules/pam_succeed_if/pam_succeed_if.c: Make all non-memory call errors

	  LOG_ERR.

	* modules/pam_time/pam_time.c: Make memory allocation failures LOG_CRIT.

	* modules/pam_timestamp/pam_timestamp.c: Make memory allocation failures

	  LOG_CRIT.

	* modules/pam_unix/pam_unix_acct.c: Make all non-memory call errors LOG_ERR.

	* modules/pam_unix/pam_unix_passwd.c: Make memory allocation failures LOG_CRIT,

	  other errors LOG_ERR.

	* modules/pam_unix/pam_unix_sess.c: Make all non-memory call errors LOG_ERR.

	* modules/pam_unix/passverify.c: Unknown user is syslogged with LOG_NOTICE.

	* modules/pam_unix/support.c: Unknown user is syslogged with LOG_NOTICE and

	  max retries ignorance by application likewise.

	* modules/pam_unix/unix_chkpwd.c: Make all non-memory call errors LOG_ERR.

	* modules/pam_userdb/pam_userdb.c: Password authentication error is syslogged

	  with LOG_NOTICE.

	* modules/pam_xauth/pam_xauth.c: Make memory allocation failures LOG_CRIT.

2016-06-15  Dmitry V. Levin  <ldv@altlinux.org>

	pam_timestamp: fix typo in strncmp usage.

	Before this fix, a typo in check_login_time resulted to ruser and

	struct utmp.ut_user being compared by the first character only,

	which in turn could lead to a too low timestamp value being assigned

	to oldest_login, effectively causing bypass of check_login_time.

	* modules/pam_timestamp/pam_timestamp.c (check_login_time): Fix typo

	in strncmp usage.

	Patch-by: Anton V. Boyarshinov <boyarsh@altlinux.org>

2016-05-30  Tomas Mraz  <tmraz@fedoraproject.org>

	Correct the examples in pam_fail_delay(3) man page.

	doc/man/pam_fail_delay.3.xml: Correct the examples.

2016-05-11  Tomas Mraz  <tmraz@fedoraproject.org>

	Remove spaces in examples for access.conf.

	The spaces are ignored only with the default listsep. To remove confusion

	if non-default listsep is used they are removed from the examples.

	* modules/pam_access/access.conf: Remove all spaces around ':' in examples.

	* modules/pam_access/access.conf.5.xml: Likewise.

2016-05-05  Mike Frysinger  <vapier@gentoo.org>

	build: avoid non-portable == with "test" (ticket #60)

	POSIX says test only accepts =. Some shells (including bash) accept ==,

	but we should still stick to = for portability.

	* configure.ac: Replace == with = in "test" invocations.

2016-04-28  Thorsten Kukuk  <kukuk@thkukuk.de>

	Release version 1.3.0.

	* NEWS: add changes for 1.3.0.

	* configure.ac: bump version number.

	* libpam/Makefile.am: bump revision of libpam.so version.

2016-04-28  Tomas Mraz  <tmraz@fedoraproject.org>

	Updated translations from Zanata.

	* po/*.po: Updated translations from Zanata.

2016-04-19  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_wheel: Correct the documentation of the root_only option.

	* modules/pam_wheel/pam_wheel.8.xml: Correct the documentation of the

	root_only option.

	pam_unix: Document that MD5 password hash is used to store old passwords.

	modules/pam_unix/pam_unix.8.xml: Document that the MD5 password hash is used

	to store the old passwords when remember option is set.

2016-04-14  Tomas Mraz  <tmraz@fedoraproject.org>

	Project registered at Zanata (fedora.zanata.org) for translations.

	* zanata.xml: Configuration file for zanata client.

	* po/LINGUAS: Update languages as supported by Zanata.

	* po/Linux-PAM.pot: Updated from sources.

	* po/*.po: Updated from sources.

2016-04-06  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_unix: Use pam_get_authtok() instead of direct pam_prompt() calls.

	We have to drop support for not_set_pass option which is not much useful

	anyway. Instead we get proper support for authtok_type option.

	* modules/pam_unix/pam_unix.8.xml: Removed not_set_pass option, added authtok_ty

	pe

	option.

	* modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Replace _unix_read_pas

	sword()

	call with equivalent pam_get_authtok() call.

	* modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Likewise and also drop

	support for not_set_pass.

	* modules/pam_unix/support.c (_unix_read_password): Remove.

	* modules/pam_unix/support.h: Remove UNIX_NOT_SET_PASS add UNIX_AUTHTOK_TYPE.

	pam_get_authtok(): Add authtok_type support to current password prompt.

	* libpam/pam_get_authtok.c (pam_get_authtok_internal): When changing password,

	use different prompt for current password allowing for authtok_type to be

	displayed to the user.

2016-04-04  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_unix: Make password expiration messages more user-friendly.

	* modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Make password

	expiration messages more user-friendly.

2016-04-04  Thorsten Kukuk  <kukuk@thkukuk.de>

	innetgr may not be there so make sure that when innetgr is not present then we inform about it and not use it. [ticket#46]

	* modules/pam_group/pam_group.c: ditto

	* modules/pam_succeed_if/pam_succeed_if.c: ditto

	* modules/pam_time/pam_time.c: ditto

	build: fix build when crypt() is not part of crypt_libs [ticket#46]

	* configure.ac: Don't set empty -l option in crypt check

	build: use $host_cpu for lib64 directory handling [ticket#46]

	* configure.ac: use $host_cpu for lib64 directory handling.

2016-04-01  Dmitry V. Levin  <ldv@altlinux.org>

	Fix whitespace issues.

	Remove blank lines at EOF introduced by commit

	a684595c0bbd88df71285f43fb27630e3829121e,

	making the project free of warnings reported by

	git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD

	* libpam/pam_dynamic.c: Remove blank line at EOF.

	* modules/pam_echo/pam_echo.c: Likewise.

	* modules/pam_keyinit/pam_keyinit.c: Likewise.

	* modules/pam_mkhomedir/pam_mkhomedir.c: Likewise.

	* modules/pam_pwhistory/pam_pwhistory.c: Likewise.

	* modules/pam_rhosts/pam_rhosts.c: Likewise.

	* modules/pam_sepermit/pam_sepermit.c: Likewise.

	* modules/pam_stress/pam_stress.c: Likewise.

2016-04-01  Thorsten Kukuk  <kukuk@thkukuk.de>

	Use TI-RPC functions if we compile and link against libtirpc. The old SunRPC functions don't work with IPv6.

	* configure.ac: Set and restore CPPFLAGS

	* modules/pam_unix/pam_unix_passwd.c: Replace getrpcport with

	  rpcb_getaddr if available.

2016-03-29  Thorsten Kukuk  <kukuk@thkukuk.de>

	PAM_EXTERN isn't needed anymore, but don't remove it to not break lot of external code using it.

	* libpam/include/security/pam_modules.h: Readd PAM_EXTERN for compatibility

	Remove "--enable-static-modules" option and support from  Linux-PAM. It was never official supported and was broken since years.

	* configure.ac: Remove --enable-static-modules option.

	* doc/man/pam_sm_acct_mgmt.3.xml: Remove PAM_EXTERN.

	* doc/man/pam_sm_authenticate.3.xml: Likewise.

	* doc/man/pam_sm_chauthtok.3.xml: Likewise.

	* doc/man/pam_sm_close_session.3.xml: Likewise.

	* doc/man/pam_sm_open_session.3.xml: Likewise.

	* doc/man/pam_sm_setcred.3.xml: Likewise.

	* libpam/Makefile.am: Remove STATIC_MODULES cases.

	* libpam/include/security/pam_modules.h: Remove PAM_STATIC parts.

	* libpam/pam_dynamic.c: Likewise.

	* libpam/pam_handlers.c: Likewise.

	* libpam/pam_private.h: Likewise.

	* libpam/pam_static.c: Remove file.

	* libpam/pam_static_modules.h: Remove header file.

	* modules/pam_access/pam_access.c: Remove PAM_EXTERN and PAM_STATIC parts.

	* modules/pam_cracklib/pam_cracklib.c: Likewise.

	* modules/pam_debug/pam_debug.c: Likewise.

	* modules/pam_deny/pam_deny.c: Likewise.

	* modules/pam_echo/pam_echo.c: Likewise.

	* modules/pam_env/pam_env.c: Likewise.

	* modules/pam_exec/pam_exec.c: Likewise.

	* modules/pam_faildelay/pam_faildelay.c: Likewise.

	* modules/pam_filter/pam_filter.c: Likewise.

	* modules/pam_ftp/pam_ftp.c: Likewise.

	* modules/pam_group/pam_group.c: Likewise.

	* modules/pam_issue/pam_issue.c: Likewise.

	* modules/pam_keyinit/pam_keyinit.c: Likewise.

	* modules/pam_lastlog/pam_lastlog.c: Likewise.

	* modules/pam_limits/pam_limits.c: Likewise.

	* modules/pam_listfile/pam_listfile.c: Likewise.

	* modules/pam_localuser/pam_localuser.c: Likewise.

	* modules/pam_loginuid/pam_loginuid.c: Likewise.

	* modules/pam_mail/pam_mail.c: Likewise.

	* modules/pam_mkhomedir/pam_mkhomedir.c: Likewise.

	* modules/pam_motd/pam_motd.c: Likewise.

	* modules/pam_namespace/pam_namespace.c: Likewise.

	* modules/pam_nologin/pam_nologin.c: Likewise.

	* modules/pam_permit/pam_permit.c: Likewise.

	* modules/pam_pwhistory/pam_pwhistory.c: Likewise.

	* modules/pam_rhosts/pam_rhosts.c: Likewise.

	* modules/pam_rootok/pam_rootok.c: Likewise.

	* modules/pam_securetty/pam_securetty.c: Likewise.

	* modules/pam_selinux/pam_selinux.c: Likewise.

	* modules/pam_sepermit/pam_sepermit.c: Likewise.

	* modules/pam_shells/pam_shells.c: Likewise.

	* modules/pam_stress/pam_stress.c: Likewise.

	* modules/pam_succeed_if/pam_succeed_if.c: Likewise.

	* modules/pam_tally/pam_tally.c: Likewise.

	* modules/pam_tally2/pam_tally2.c: Likewise.

	* modules/pam_time/pam_time.c: Likewise.

	* modules/pam_timestamp/pam_timestamp.c: Likewise.

	* modules/pam_tty_audit/pam_tty_audit.c: Likewise.

	* modules/pam_umask/pam_umask.c: Likewise.

	* modules/pam_userdb/pam_userdb.c: Likewise.

	* modules/pam_warn/pam_warn.c: Likewise.

	* modules/pam_wheel/pam_wheel.c: Likewise.

	* modules/pam_xauth/pam_xauth.c: Likewise.

	* modules/pam_unix/Makefile.am: Remove STATIC_MODULES part.

	* modules/pam_unix/pam_unix_acct.c: Remove PAM_STATIC part.

	* modules/pam_unix/pam_unix_auth.c: Likewise.

	* modules/pam_unix/pam_unix_passwd.c: Likewise.

	* modules/pam_unix/pam_unix_sess.c: Likewise.

	* modules/pam_unix/pam_unix_static.c: Removed.

	* modules/pam_unix/pam_unix_static.h: Removed.

	* po/POTFILES.in: Remove removed files.

	* tests/tst-dlopen.c: Remove PAM_STATIC part.

2016-03-24  Thorsten Kukuk  <kukuk@thkukuk.de>

	Fix check for libtirpc and enhance check for libnsl to include new libnsl.

	* configure.ac: fix setting of CFLAGS/LIBS, enhance libnsl check

	* modules/pam_unix/Makefile.am: replace NIS_* with TIRPC_* and NSL_*

2016-03-23  Thorsten Kukuk  <kukuk@thkukuk.de>

	Remove YP dependencies from pam_access, they were never used and such not needed.

	* modules/pam_access/Makefile.am: Remove NIS_CFLAGS and NIS_LIBS

	* modules/pam_access/pam_access.c: Remove yp_get_default_domain case,

	  it will never be used.

2016-03-04  Tomas Mraz  <tmraz@fedoraproject.org>

	Add checks for localtime() returning NULL.

	* modules/pam_lastlog/pam_lastlog.c (last_login_read): Check for localtime_r

	returning NULL.

	* modules/pam_tally2/pam_tally2.c (print_one): Check for localtime returning

	NULL.

	pam_unix: Silence warnings and fix a minor bug.

	Fixes a minor bug in behavior when is_selinux_enabled()

	returned negative value.

	* modules/pam_unix/passverify.c: Add parentheses to SELINUX_ENABLED macro.

	(unix_update_shadow): Safe cast forwho to non-const char *.

	* modules/pam_unix/support.c: Remove unused SELINUX_ENABLED macro.

2016-02-17  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_env: Document the /etc/environment file.

	* modules/pam_env/Makefile.am: Add the environment.5 soelim stub.

	* modules/pam_env/pam_env.8.xml: Add environ(7) reference.

	* modules/pam_env/pam_env.conf.5.xml: Add environment alias name.

	Add a paragraph about /etc/environment. Add environ(7) reference.

	pam_unix: Add no_pass_expiry option to ignore password expiration.

	* modules/pam_unix/pam_unix.8.xml: Document the no_pass_expiry option.

	* modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): If no_pass_expiry

	is on and return value data is not set to PAM_SUCCESS then ignore

	PAM_NEW_AUTHTOK_REQD and PAM_AUTHTOK_EXPIRED returns.

	* modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Always set the

	return value data.

	(pam_sm_setcred): Test for likeauth option and use the return value data

	only if set.

	* modules/pam_unix/support.h: Add the no_pass_expiry option.

2016-01-25  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_unix: Change the salt length for new hashes to 16 characters.

	* modules/pam_unix/passverify.c (create_password_hash): Change the

	salt length for new hashes to 16 characters.

2015-12-17  Tomas Mraz  <tmraz@fedoraproject.org>

	Relax the conditions for fatal failure on auditing.

	The PAM library calls will not fail anymore for any uid if the return

	value from the libaudit call is -EPERM.

	* libpam/pam_audit.c (_pam_audit_writelog): Remove check for uid != 0.

2015-12-16  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_tally2: Optionally log the tally count when checking.

	* modules/pam_tally2/pam_tally2.c (tally_parse_args): Add debug option.

	(tally_check): Always log the tally count with debug option.

2015-10-02  Jakub Hrozek  <jakub.hrozek@posteo.se>

	Docfix: pam handle is const in pam_syslog() and pam_vsyslog()

	* doc/man/pam_syslog.3.xml: Add const to pam handle in pam_syslog() and pam_vsyslog().

2015-09-24  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_loginuid: Add syslog message if required auditd is not detected.

	* modules/pam_loginuid/pam_loginuid.c (_pam_loginuid): Add syslog message

	if required auditd is not detected.

2015-09-04  Tomas Mraz  <tmraz@fedoraproject.org>

	Allow links to be used instead of w3m for documentation regeneration.

	* configure.ac: If w3m is not found check for links.

	Add missing space in pam_misc_setenv man page.

	* doc/man/pam_misc_setenv.3.xml: Add a missing space.

2015-08-12  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_rootok: use rootok permission instead of passwd permission in SELinux check.

	* modules/pam_rootok/pam_rootok.c (selinux_check_root): Use rootok instead of

	passwd permission.

2015-08-05  Amarnath Valluri  <amarnath.valluri@intel.com>

	pam_timestamp: Avoid leaking file descriptor.

	* modules/pam_timestamp/hmacsha1.c(hmac_key_create):

	    close 'keyfd' when failed to own it.

2015-06-22  Thorsten Kukuk  <kukuk@thkukuk.de>

	Release version 1.2.1.

	Security fix: CVE-2015-3238

	If the process executing pam_sm_authenticate or pam_sm_chauthtok method

	of pam_unix is not privileged enough to check the password, e.g.

	if selinux is enabled, the _unix_run_helper_binary function is called.

	When a long enough password is supplied (16 pages or more, i.e. 65536+

	bytes on a system with 4K pages), this helper function hangs

	indefinitely, blocked in the write(2) call while writing to a blocking

	pipe that has a limited capacity.

	With this fix, the verifiable password length will be limited to

	PAM_MAX_RESP_SIZE bytes (i.e. 512 bytes) for pam_exec and pam_unix.

	* NEWS: Update

	* configure.ac: Bump version

	* modules/pam_exec/pam_exec.8.xml: document limitation of password length

	* modules/pam_exec/pam_exec.c: limit password length to PAM_MAX_RESP_SIZE

	* modules/pam_unix/pam_unix.8.xml: document limitation of password length

	* modules/pam_unix/pam_unix_passwd.c: limit password length

	* modules/pam_unix/passverify.c: Likewise

	* modules/pam_unix/passverify.h: Likewise

	* modules/pam_unix/support.c: Likewise

2015-04-27  Thorsten Kukuk  <kukuk@thkukuk.de>

	Update NEWS file.

	Release version 1.2.0.

	* NEWS: Update

	* configure.ac: Bump version

	* libpam/Makefile.am: Bump version of libpam

	* libpam_misc/Makefile.am: Bump version of libpam_misc

	* po/*: Regenerate po files

	Fix some grammatical errors in documentation. Patch by Louis Sautier.

	* doc/adg/Linux-PAM_ADG.xml: Fix gramatical errors.

	* doc/man/pam.3.xml: Likewise.

	* doc/man/pam_acct_mgmt.3.xml: Likewise.

	* doc/man/pam_chauthtok.3.xml: Likewise.

	* doc/man/pam_sm_chauthtok.3.xml: Likewise.

	* modules/pam_limits/limits.conf.5.xml: Likewise.

	* modules/pam_mail/pam_mail.8.xml: Likewise.

	* modules/pam_rhosts/pam_rhosts.c: Likewise.

	* modules/pam_shells/pam_shells.8.xml: Likewise.

	* modules/pam_tally/pam_tally.8.xml: Likewise.

	* modules/pam_tally2/pam_tally2.8.xml: Likewise.

	* modules/pam_unix/pam_unix.8.xml: Likewise.

2015-04-23  Thorsten Kukuk  <kukuk@thkukuk.de>

	Add "quiet" option to pam_unix to suppress informential info messages from session.

	* modules/pam_unix/pam_unix.8.xml: Document new option.

	* modules/pam_unix/support.h: Add quiet option.

	* modules/pam_unix/pam_unix_sess.c: Don't print LOG_INFO messages if

	 'quiet' option is set.

2015-04-07  Tomas Mraz  <tmraz@fedoraproject.org>

	Use crypt_r if available in pam_userdb and in pam_unix.

	* modules/pam_unix/passverify.c (create_password_hash): Call crypt_r()

	instead of crypt() if available.

	* modules/pam_userdb/pam_userdb.c (user_lookup): Call crypt_r()

	instead of crypt() if available.

2015-03-25  Thorsten Kukuk  <kukuk@thkukuk.de>

	Support alternative "vendor configuration" files as fallback to /etc (Ticket#34, patch from ay Sievers <kay@vrfy.org>)

	* doc/man/pam.8.xml: document additonal config directory

	* libpam/pam_handlers.c: add /usr/lib/pam.d as config file fallback directory

	* libpam/pam_private.h: adjust defines

	pam_env: expand @{HOME} and @{SHELL} and enhance documentation (Ticket#24 and #29)

	* modules/pam_env/pam_env.c: Replace @{HOME} and @{SHELL} with passwd entries

	* modules/pam_env/pam_env.conf.5.xml: Document @{HOME} and @{SHELL}

	* modules/pam_env/pam_env.8.xml: Enhance documentation

2015-03-24  Thorsten Kukuk  <kukuk@thkukuk.de>

	Clarify pam_access docs re PAM service names and X $DISPLAY value testing. (Ticket #39)

	* modules/pam_access/access.conf.5.xml

	* modules/pam_access/pam_access.8.xml

	Don't use sudo directory, the timestamp format is different (Ticket#32)

	* modules/pam_timestamp/pam_timestamp.c: Change default timestamp directory.

	Enhance group.conf examples (Ticket#35)

	* modules/pam_group/group.conf.5.xml: Enhance example by logic group entry.

	Document timestampdir option (Ticket#33)

	* modules/pam_timestamp/pam_timestamp.8.xml: Add timestampdir option.

	Adjust documentation (Ticket#36)

	* libpam/pam_delay.c: Change 25% in comment to 50% as used in code.

	* doc/man/pam_fail_delay.3.xml: Change 25% to 50%

2015-02-18  Tomas Mraz  <tmraz@fedoraproject.org>

	Updated translations from Transifex.

	* po/*.po: Updated translations from Transifex.

2015-01-07  Dmitry V. Levin  <ldv@altlinux.org>

	build: raise gettext version requirement.

	Raise gettext requirement to the latest oldstable version 0.18.3.

	This fixes the following automake warning:

	configure.ac:581: warning: The 'AM_PROG_MKDIR_P' macro is deprecated, and its use is discouraged.

	configure.ac:581: You should use the Autoconf-provided 'AC_PROG_MKDIR_P' macro instead,

	configure.ac:581: and use '$(MKDIR_P)' instead of '$(mkdir_p)'in your Makefile.am files.

	* configure.ac (AM_GNU_GETTEXT_VERSION): Raise from 0.15 to 0.18.3.

	* po/Makevars: Update from gettext-0.18.3.

2015-01-07  Ronny Chevalier  <chevalier.ronny@gmail.com>

	build: adjust automake warning flags.

	Enable all automake warning flags except for the portability issues,

	since non portable features are used among the makefiles.

	* configure.ac (AM_INIT_AUTOMAKE): Add -Wall -Wno-portability.

2015-01-07  Dmitry V. Levin  <ldv@altlinux.org>

	build: rename configure.in to configure.ac.

	This fixes the following automake warning:

	aclocal: warning: autoconf input should be named 'configure.ac', not 'configure.in'

	* configure.in: Rename to configure.ac.

	Remove unmodified GNU gettext files installed by autopoint.

	These files are part of GNU gettext; we have not modified them, they are

	installed by autopoint which is called by autoreconf, so they had to be

	removed from this repository along with ABOUT-NLS, config.rpath, and

	mkinstalldirs files that were removed by commit

	Linux-PAM-1_1_5-7-g542ec8b.

	* po/Makefile.in.in: Remove.

	* po/Rules-quot: Likewise.

	* po/boldquot.sed: Likewise.

	* po/en@boldquot.header: Likewise.

	* po/en@quot.header: Likewise.

	* po/insert-header.sin: Likewise.

	* po/quot.sed: Likewise.

	* po/remove-potcdate.sin: Likewise.

	* po/.gitignore: Ignore these files.

2015-01-06  Ronny Chevalier  <chevalier.ronny@gmail.com>

	Update .gitignore.

	* .gitignore: Ignore *.log and *.trs files.

2015-01-02  Luke Shumaker  <lukeshu@sbcglobal.net>

	libpam: Only print "Password change aborted" when it's true.

	pam_get_authtok() may be used any time that a password needs to be entered,

	unlike pam_get_authtok_{no,}verify(), which may only be used when

	changing a password; yet when the user aborts, it prints "Password change

	aborted." whether or not that was the operation being performed.

	This bug was non-obvious because none of the modules distributed with

	Linux-PAM use it for anything but changing passwords; pam_unix has its

	own utility function that it uses instead.  As an example, the

	nss-pam-ldapd package uses it in pam_sm_authenticate().

	libpam/pam_get_authtok.c (pam_get_authtok_internal): check that the

	password is trying to be changed before printing a message about the

	password change being aborted.

2014-12-10  Dmitry V. Levin  <ldv@altlinux.org>

	build: extend cross compiling check to cover CPPFLAGS (ticket #21)

	Use BUILD_CPPFLAGS variable to override CPPFLAGS where necessary in

	case of cross compiling, in addition to CC_FOR_BUILD, BUILD_CFLAGS,

	and BUILD_LDFLAGS variables introduced earlier to override CC,

	CFLAGS, and LDFLAGS, respectively.

	* configure.in (BUILD_CPPFLAGS): Define.

	* doc/specs/Makefile.am (CPPFLAGS): Define to @BUILD_CPPFLAGS@.

2014-12-09  Dmitry V. Levin  <ldv@altlinux.org>

	Do not use yywrap (ticket #42)

	Our scanners do not really use yywrap.  Explicitly disable yywrap

	so that no references to yywrap will be generated and no LEXLIB

	would be needed.

	* conf/pam_conv1/Makefile.am (pam_conv1_LDADD): Remove.

	* conf/pam_conv1/pam_conv_l.l: Enable noyywrap option.

	* doc/specs/Makefile.am (padout_LDADD): Remove.

	* doc/specs/parse_l.l: Enable noyywrap option.

2014-12-09  Kyle Manna  <kyle@kylemanna.com>

	doc: fix a trivial typo in pam_authenticate return values (ticket #38)

	* doc/man/pam_authenticate.3.xml: Fix a typo in PAM_AUTHINFO_UNAVAIL.

2014-12-09  Ronny Chevalier  <chevalier.ronny@gmail.com>

	doc: fix typo in pam_authenticate.3.xml.

	* doc/man/pam_authenticate.3.xml: Fix typo.

2014-10-17  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_succeed_if: Fix copy&paste error in rhost and tty values.

	modules/pam_succeed_if/pam_succeed_if.c (evaluate): Use PAM_RHOST

	and PAM_TTY properly for the rhost and tty values.

	pam_succeed_if: Use long long type for numeric values.

	The currently used long with additional conversion to int is

	too small for uids and gids.

	modules/pam_succeed_if/pam_succeed_if.c (evaluate_num): Replace

	strtol() with strtoll() and int with long long in the parameters

	of comparison functions.

2014-09-05  Tomas Mraz  <tmraz@fedoraproject.org>

	Add grantor field to audit records of libpam.

	The grantor field gives audit trail of PAM modules which granted access

	for successful return from libpam calls. In case of failed return

	the grantor field is set to '?'.

	libpam/pam_account.c (pam_acct_mgmt): Remove _pam_auditlog() call.

	libpam/pam_auth.c (pam_authenticate, pam_setcred): Likewise.

	libpam/pam_password.c (pam_chauthtok): Likewise.

	libpam/pam_session.c (pam_open_session, pam_close_session): Likewise.

	libpam/pam_audit.c (_pam_audit_writelog): Add grantors parameter,

	add grantor= field to the message if grantors is set.

	(_pam_list_grantors): New function creating the string with grantors list.

	(_pam_auditlog): Add struct handler pointer parameter, call _pam_list_grantors()

	to list the grantors from the handler list.

	(_pam_audit_end): Add NULL handler parameter to _pam_auditlog() call.

	(pam_modutil_audit_write): Add NULL grantors parameter to _pam_audit_writelog().

	libpam/pam_dispatch.c (_pam_dispatch_aux): Set h->grantor where appropriate.

	(_pam_clear_grantors): New function to clear grantor field of handler.

	(_pam_dispatch): Call _pam_clear_grantors() before executing the stack.

	Call _pam_auditlog() when appropriate.

	libpam/pam_handlers.c (extract_modulename): Do not allow empty module name

	or just "?" to avoid confusing audit trail.

	(_pam_add_handler): Test for NULL return from extract_modulename().

	Clear grantor field of handler.

	libpam/pam_private.h: Add grantor field to struct handler, add handler pointer

	parameter to _pam_auditlog().

2014-08-26  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_mkhomedir: Drop superfluous stat() call.

	modules/pam_mkhomedir/mkhomedir_helper.c (create_homedir): Drop superfluous

	stat() call.

	pam_exec: Do not depend on open() returning STDOUT_FILENO.

	modules/pam_exec/pam_exec.c (call_exec): Move the descriptor to

	STDOUT_FILENO if needed.

2014-08-25  Robin Hack  <rhack@redhat.com>

	pam_keyinit: Check return value of setregid.

	modules/pam_keyinit/pam_keyinit.c (pam_sm_open_session): Log if setregid() fails.

	pam_filter: Avoid leaking descriptors when fork() fails.

	modules/pam_filter/pam_filter.c (set_filter): Close descriptors when fork() fails.

2014-08-14  Robin Hack  <rhack@redhat.com>

	pam_echo: Avoid leaking file descriptor.

	modules/pam_echo/pam_echo.c (pam_echo): Close fd in error cases.

2014-08-13  Robin Hack  <rhack@redhat.com>

	pam_tty_audit: Silence Coverity reporting uninitialized use.

	modules/pam_tty_audit/pam_tty_audit.c (nl_recv): Initialize also

	msg_flags.

2014-08-13  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_tally2: Avoid uninitialized use of fileinfo.

	Problem found by Robin Hack <rhack@redhat.com>.

	modules/pam_tally2/pam_tally2.c (get_tally): Do not depend on file size

	just try to read it.

	pam_access: Avoid uninitialized access of line.

	* modules/pam_access/pam_access.c (login_access): Reorder condition

	so line is not accessed when uninitialized.

2014-08-05  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_lastlog: Properly clean up last_login structure before use.

	modules/pam_lastlog/pam_lastlog.c (last_login_write): Properly clean up last_login

	structure before use.

2014-07-21  Tomas Mraz  <tmraz@fedoraproject.org>

	Make pam_pwhistory and pam_unix tolerant of corrupted opasswd file.

	* modules/pam_pwhistory/opasswd.c (parse_entry): Test for missing fields

	in opasswd entry and return error.

	* modules/pam_unix/passverify.c (save_old_password): Test for missing fields

	in opasswd entry and skip it.

2014-07-01  Dmitry V. Levin  <ldv@altlinux.org>

	doc: add missing build dependencies for soelim stubs.

	* doc/man/Makefile.am [ENABLE_REGENERATE_MAN]: Add dependencies for

	pam_verror.3, pam_vinfo.3, pam_vprompt.3, and pam_vsyslog.3 soelim stubs.

2014-06-23  Dmitry V. Levin  <ldv@altlinux.org>

	doc: fix install in case of out of tree build (ticket #31)

	* doc/adg/Makefile.am (install-data-local, releasedocs): Fall back

	to srcdir if documentation files haven't been found in builddir.

	(releasedocs): Treat missing documentation files as an error.

	* doc/mwg/Makefile.am: Likewise.

	* doc/sag/Makefile.am: Likewise.

2014-06-19  Dmitry V. Levin  <ldv@altlinux.org>

	doc: fix installation of adg-*.html and mwg-*.html files (ticket #31)

	Fix a typo due to which sag-*.html files might be installed instead of

	adg-*.html and mwg-*.html files.

	* doc/adg/Makefile.am (install-data-local): Install adg-*.html instead

	of sag-*.html.

	* doc/mwg/Makefile.am (install-data-local): Install mwg-*.html instead

	of sag-*.html.

	Patch-by: Mike Frysinger <vapier@gentoo.org>

2014-06-19  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_limits: nofile refers to file descriptors not files.

	modules/pam_limits/limits.conf.5.xml: Correct documentation of nofile limit.

	modules/pam_limits/limits.conf: Likewise.

	pam_limits: clarify documentation of maxlogins and maxsyslogins limits.

	modules/pam_limits/limits.conf.5.xml: clarify documentation of

	maxlogins and maxsyslogins limits.

	pam_unix: Check for NULL return from Goodcrypt_md5().

	modules/pam_unix/pam_unix_passwd.c (check_old_password): Check for

	NULL return from Goodcrypt_md5().

	pam_unix: check for NULL return from malloc()

	* modules/pam_unix/md5_crypt.c (crypt_md5): Check for NULL return from malloc().

2014-05-22  Tomas Mraz  <tmraz@fedoraproject.org>

	pam_loginuid: Document one more possible case of PAM_IGNORE return.

	modules/pam_loginuid/pam_loginuid.8.xml: Document one more possible case

	of PAM_IGNORE return value.

	pam_loginuid: Document other possible return values.

	modules/pam_loginuid/pam_loginuid.8.xml: Document the possible return

	values.

2014-03-26  Dmitry V. Levin  <ldv@altlinux.org>

	pam_timestamp: fix potential directory traversal issue (ticket #27)

	pam_timestamp uses values of PAM_RUSER and PAM_TTY as components of

	the timestamp pathname it creates, so extra care should be taken to

	avoid potential directory traversal issues.

	* modules/pam_timestamp/pam_timestamp.c (check_tty): Treat

	"." and ".." tty values as invalid.