uninitialized value $3 / $curmod

Thanks for the patch, but that's not a correct fix. $3 is never supposed to be unset here, so the root error is somewhere else.

I also can't reproduce the problem with your provided test case. You must have previous pam-auth-update settings in your environment that are contributing to the problem.

Please provide:
 - the exact output of the pam-auth-update command
 - a tarball of /etc/pam.d/common-* and /var/lib/pam

The output of pam-auth-update:

$ sudo pam-auth-update
Use of uninitialized value $3 in split at /usr/sbin/pam-auth-update line 623, <CURRENT> line 32.
Use of uninitialized value $curmod in quotemeta at /usr/sbin/pam-auth-update line 631, <CURRENT> line 32.
Use of uninitialized value $curmod in hash element at /usr/sbin/pam-auth-update line 653, <CURRENT> line 32.
Use of uninitialized value $curmod in hash element at /usr/sbin/pam-auth-update line 653, <CURRENT> line 32.

$ sudo pam-auth-update --package
Use of uninitialized value $3 in split at /usr/sbin/pam-auth-update line 623, <CURRENT> line 32.
Use of uninitialized value $curmod in quotemeta at /usr/sbin/pam-auth-update line 631, <CURRENT> line 32.
Use of uninitialized value $curmod in hash element at /usr/sbin/pam-auth-update line 653, <CURRENT> line 32.
Use of uninitialized value $curmod in hash element at /usr/sbin/pam-auth-update line 653, <CURRENT> line 32

You appear to have a /usr/share/pam-config/mkhomedir file which doesn't come from any Ubuntu package. Could you please attach this file as well?

(there's also a /usr/share/pam-config/sss-password that's not packaged; I'm pretty sure the problem is with the mkhomedir' profile, but maybe you want to attach both of these while you're at it)

Yes, of course.
Here they are.

Thanks, I've been able to reproduce the problem now, though it's rather tricky - it requires both the libpam-sss package and the mkhomedir profile that you have available locally, in order to reproduce this. (It seems that the sss profiles you have on your system come from precise-updates and don't look the same in the precise version of the package; however, this apparently has no bearing on the problem.)

Essentially, this is a problem with the handling of trailing whitespace in the pam config (/usr/share/pam-configs/mkhomedir has a whitespace-only line at the end of the file). pam-auth-update should be fixed to ignore such blank lines, and not store them to /var/lib/pam/foo, which is where the problem arises.

I think this should do the job:

--- debian/local/pam-auth-update 2011-10-30 19:06:55 +0000
+++ debian/local/pam-auth-update 2013-04-15 19:06:23 +0000
@@ -686,7 +686,7 @@
   } else {
    chomp;
    s/^\s+//;
- $profile{$fieldname} .= "\n$_";
+ $profile{$fieldname} .= "\n$_" if ($_);
    $profile{$fieldname} =~ s/^[\n\s]+//;
   }
  }

This bug was fixed in the package pam - 1.1.3-10ubuntu1

---------------
pam (1.1.3-10ubuntu1) trusty; urgency=low

  * Merge from Debian unstable, remaining changes:
    - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's
      not present there or in /etc/security/pam_env.conf. (should send to
      Debian).
    - debian/libpam0g.postinst: only ask questions during update-manager when
      there are non-default services running.
    - debian/libpam0g.postinst: check if gdm is actually running before
      trying to reload it.
    - debian/libpam0g.postinst: the init script for 'samba' is now named
      'smbd' in Ubuntu, so fix the restart handling.
    - Change Vcs-Bzr to point at the Ubuntu branch.
    - debian/patches-applied/series: Ubuntu patches are as below ...
    - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly
      initialise RLIMIT_NICE rather than relying on the kernel limits.
    - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:
      Deprecate pam_unix's explicit "usergroups" option and instead read it
      from /etc/login.def's "USERGROUP_ENAB" option if umask is only defined
      there. This restores compatibility with the pre-PAM behaviour of login.
    - debian/patches-applied/pam_motd-legal-notice: display the contents of
      /etc/legal once, then set a flag in the user's homedir to prevent
      showing it again.
    - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage
      for update-motd, with some best practices and notes of explanation.
    - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)
      to update-motd(5)
    - debian/local/common-session{,-noninteractive}: Enable pam_umask by
      default, now that the umask setting is gone from /etc/profile.
    - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.
    - Build-depend on libfl-dev in addition to flex, for cross-building
      support.
    - Add /usr/local/games to PATH.
    - Disable libaudit for stage1 bootstrap.
    - Adjust debian/patches-applied/update-motd to write to
      /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed
      to use this file and no longer links /etc/motd to /var/run/motd.

pam (1.1.3-10) unstable; urgency=low

  * Fix pam-auth-update handling of trailing blank lines in the fields of
    profiles. LP: #1160288.
  * Reintroduce libaudit support now that libaudit has been multiarched.
    Closes: #699159.

pam (1.1.3-9) unstable; urgency=low

  * Revert libaudit support for now, because libaudit isn't multiarched yet
    in unstable so this regresses cross-installability. Reopens bug
    #699159.
  * Add an or'ed dependency on cdebconf, which also implements the
    xloadtemplatefile extension that prevents us from depending on just
    'debconf-2.0'. Thanks to Régis Boudin <email address hidden> for the info.
    Closes: #677278.
 -- Steve Langasek <email address hidden> Sun, 20 Oct 2013 18:21:34 -0700