Summary: An extensible library providing authentication for applications
Name: pam
Version: 1.5.3
Release: 4%{?dist}
License: BSD and GPLv2+
URL: http://www.linux-pam.org
Source0: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz
Source1: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz.asc
Source2: config-util.pamd
Source3: other.pamd
Source4: system-auth.5
Source5: config-util.5
Source6: postlogin.5
Source7: pamtmp.conf
Source8: gpl-2.0.txt

Patch3000: pam-1.5.3-userdb-gdbm.patch
Patch5000: add-sm3-support.patch

Patch0001: pam-1.5.3-CVE-2024-22365.patch

BuildRequires: gcc, make, automake, autoconf, bison, flex, libtool, pkgconfig
BuildRequires: audit-libs-devel, gettext-devel, gdbm-devel, libeconf-devel, libnsl2-devel
BuildRequires: systemd, libselinux-devel, libtirpc-devel, libxcrypt-devel, openssl-devel >= 3.0.0
Requires: libpwquality, setup, authselect >= 1.3

%description
PAM (Pluggable Authentication Modules) is a security tool that allows setting authentication
policy without recompiling programs.

%package devel
Summary: Library for developing PAM-aware applications and modules for PAM
Requires: pam = %{version}-%{release}

%description devel
PAM is a security tool which allows setting authentication policy without recompiling programs.
This package contains header files used for building both PAM-aware applications and modules.

%prep
%autosetup -n Linux-PAM-%{version} -p1
cp %{SOURCE8} .

%build
%configure \
  --libdir=%{_libdir} \
  --includedir=%{_includedir}/security \
  --disable-rpath \
  --disable-static \
  --disable-prelude \
  --enable-audit \
  --enable-openssl \
  --enable-selinux \
  --enable-lastlog \
  --enable-db=gdbm
%make_build

%install
%make_install

install -d -m 755 %{buildroot}%{_sysconfdir}/pam.d
install -d -m 755 %{buildroot}%{_datadir}/pam.d
install -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/pam.d/other
install -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/pam.d/config-util
install -d -m 755 %{buildroot}/var/run/faillock

for phase in auth acct passwd session ; do
  ln -sf pam_unix.so %{buildroot}%{_libdir}/security/pam_unix_${phase}.so
done
ln -sf pam_sepermit.so %{buildroot}%{_libdir}/security/pam_selinux_permit.so
install -m 644 -D modules/pam_namespace/pam_namespace.service \
  %{buildroot}%{_unitdir}/pam_namespace.service
install -m 600 /dev/null %{buildroot}%{_sysconfdir}/security/opasswd
install -m 644 -D %{SOURCE7} %{buildroot}%{_prefix}/lib/tmpfiles.d/pam.conf

install -m 644 %{SOURCE4} %{SOURCE5} %{SOURCE6} %{buildroot}%{_mandir}/man5/
ln -sf system-auth.5 %{buildroot}%{_mandir}/man5/password-auth.5
ln -sf system-auth.5 %{buildroot}%{_mandir}/man5/fingerprint-auth.5
ln -sf system-auth.5 %{buildroot}%{_mandir}/man5/smartcard-auth.5

rm -rf %{buildroot}%{_datadir}/doc/Linux-PAM
rm -f %{buildroot}%{_sysconfdir}/environment
rm -f %{buildroot}%{_libdir}/$libpam*.la
rm -f %{buildroot}%{_libdir}/security/*.la
rm -rf %{buildroot}/usr/share/doc/pam

install -d -m 755 %{buildroot}%{_pkgdocdir}
install -p -m 644 doc/specs/rfc86.0.txt %{buildroot}%{_pkgdocdir}
%find_lang Linux-PAM

%check
%make_build check || :

%files -f Linux-PAM.lang
%license Copyright
%license gpl-2.0.txt
%dir %{_sysconfdir}/pam.d
%dir %{_datadir}/pam.d
%config(noreplace) %{_sysconfdir}/pam.d/other
%config(noreplace) %{_sysconfdir}/pam.d/config-util
%{_libdir}/libpam.so.0*
%{_libdir}/libpamc.so.0*
%{_libdir}/libpam_misc.so.0*
%{_sbindir}/pam_namespace_helper
%{_sbindir}/faillock
%attr(4755,root,root) %{_sbindir}/pam_timestamp_check
%attr(4755,root,root) %{_sbindir}/unix_chkpwd
%attr(0700,root,root) %{_sbindir}/unix_update
%attr(0755,root,root) %{_sbindir}/mkhomedir_helper
%attr(0755,root,root) %{_sbindir}/pwhistory_helper
%dir %{_libdir}/security
%{_libdir}/security/*
%{_unitdir}/pam_namespace.service
%dir %{_sysconfdir}/security
%config(noreplace) %{_sysconfdir}/security/access.conf
%config(noreplace) %{_sysconfdir}/security/faillock.conf
%config(noreplace) %{_sysconfdir}/security/group.conf
%config(noreplace) %{_sysconfdir}/security/limits.conf
%dir %{_sysconfdir}/security/limits.d
%config(noreplace) %{_sysconfdir}/security/namespace.conf
%dir %{_sysconfdir}/security/namespace.d
%attr(755,root,root) %config(noreplace) %{_sysconfdir}/security/namespace.init
%config(noreplace) %{_sysconfdir}/security/pam_env.conf
%config(noreplace) %{_sysconfdir}/security/time.conf
%config(noreplace) %{_sysconfdir}/security/opasswd
%config(noreplace) %{_sysconfdir}/security/sepermit.conf
%config(noreplace) %{_sysconfdir}/security/pwhistory.conf
%dir /var/run/sepermit
%dir /var/run/faillock
%{_prefix}/lib/tmpfiles.d/pam.conf
%{_mandir}/man5/*
%{_mandir}/man8/*

%files devel
%dir %{_pkgdocdir}
%doc %{_pkgdocdir}/rfc86.0.txt
%{_includedir}/security
%{_mandir}/man3/*
%{_libdir}/libpam.so
%{_libdir}/libpamc.so
%{_libdir}/libpam_misc.so
%{_libdir}/pkgconfig/pam.pc
%{_libdir}/pkgconfig/pam_misc.pc
%{_libdir}/pkgconfig/pamc.pc

%changelog
* Tue Jan 30 2024 wynnfeng <wynnfeng@tencent.com> - 1.5.3-4
- fix CVE-2024-22365

* Fri Jan 19 2024 Miaojun Dong <zoedong@tencent.com> - 1.5.3-3
- Enable (deprecated) pam_lastlog module
- Switch pam_userdb from BerkeleyDB to GDBM

* Fri Sep 08 2023 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 1.5.3-2
- Rebuilt for OpenCloudOS Stream 23.09

* Wed Aug 02 2023 Miaojun Dong <zoedong@tencent.com> - 1.5.3-1
- Bump version to 1.5.3

* Fri Apr 28 2023 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 1.5.2-4
- Rebuilt for OpenCloudOS Stream 23.05

* Fri Mar 31 2023 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 1.5.2-3
- Rebuilt for OpenCloudOS Stream 23

* Mon Feb 20 2023 Miaojun Dong <zoedong@tencent.com> - 1.5.2-2
- Add sm3 support.

* Fri May 20 2022 TAO WU <tallwu@tencent.com> - 1.5.2-1
- Initial build.