Last commit made on 2016-03-16
Get this branch:
git clone -b ubuntu/trusty-devel https://git.launchpad.net/ubuntu/+source/pam
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information


Recent commits

b1810e9... by Marc Deslauriers on 2016-03-16

Import patches-unapplied version 1.1.8-1ubuntu2.2 to ubuntu/trusty-security

Imported using git-ubuntu import.

Changelog parent: e0d0db54a7c40bd2d2ddd6f6fefb77b5008d688f

New changelog entries:
  * SECURITY REGRESSION: multiarch update issue (LP: #1558114)
    - debian/patches-applied/cve-2015-3238.patch: removed manpage changes
      so they don't get regenerated during build.
    - CVE-2015-3238

e0d0db5... by Marc Deslauriers on 2016-03-15

Import patches-unapplied version 1.1.8-1ubuntu2.1 to ubuntu/trusty-security

Imported using git-ubuntu import.

Changelog parent: a980decec1ac379f9032d3a794d6e069fbd36eb6

New changelog entries:
  * SECURITY UPDATE: pam_userdb case-insensitive search issue
    - debian/patches-applied/cve-2013-7041.patch: fix password hash
      comparison in modules/pam_userdb/pam_userdb.c.
    - CVE-2013-7041
  * SECURITY UPDATE: directory traversal issue in pam_timestamp
    - debian/patches-applied/cve-2014-2583.patch: fix potential directory
      traversal issue in modules/pam_timestamp/pam_timestamp.c.
    - CVE-2014-2583
  * SECURITY UPDATE: username enumeration via large passwords
    - debian/patches-applied/cve-2015-3238.patch: limit password size to
      prevent a helper function hang in modules/pam_exec/pam_exec.8.xml,
      modules/pam_exec/pam_exec.c, modules/pam_unix/pam_unix.8.xml,
      modules/pam_unix/pam_unix_passwd.c, modules/pam_unix/passverify.c,
      modules/pam_unix/passverify.h, modules/pam_unix/support.c.
    - CVE-2015-3238

a980dec... by Stéphane Graber on 2014-01-31

Import patches-unapplied version 1.1.8-1ubuntu2 to ubuntu/trusty-proposed

Imported using git-ubuntu import.

Changelog parent: 53f25be7061632c68f90a95608a85ca5c98140a8

New changelog entries:
  * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:
    Update patch with follow-up changes to loginuid.c

53f25be... by Steve Langasek on 2014-01-16

Import patches-unapplied version 1.1.8-1ubuntu1 to ubuntu/trusty-proposed

Imported using git-ubuntu import.

Changelog parent: ddf435935ce505b74b471c47724c86b1fc0cf719

New changelog entries:
  * Merge from Debian unstable, remaining changes:
    - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's
      not present there or in /etc/security/pam_env.conf. (should send to
    - debian/libpam0g.postinst: only ask questions during update-manager when
      there are non-default services running.
    - debian/libpam0g.postinst: check if gdm is actually running before
      trying to reload it.
    - debian/libpam0g.postinst: the init script for 'samba' is now named
      'smbd' in Ubuntu, so fix the restart handling.
    - Change Vcs-Bzr to point at the Ubuntu branch.
    - debian/patches-applied/series: Ubuntu patches are as below ...
    - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly
      initialise RLIMIT_NICE rather than relying on the kernel limits.
    - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:
      Deprecate pam_unix's explicit "usergroups" option and instead read it
      from /etc/login.def's "USERGROUP_ENAB" option if umask is only defined
      there. This restores compatibility with the pre-PAM behaviour of login.
    - debian/patches-applied/pam_motd-legal-notice: display the contents of
      /etc/legal once, then set a flag in the user's homedir to prevent
      showing it again.
    - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage
      for update-motd, with some best practices and notes of explanation.
    - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)
      to update-motd(5)
    - debian/local/common-session{,-noninteractive}: Enable pam_umask by
      default, now that the umask setting is gone from /etc/profile.
    - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.
    - Build-depend on libfl-dev in addition to flex, for cross-building
    - Add /usr/local/games to PATH.
    - Adjust debian/patches-applied/update-motd to write to
      /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed
      to use this file and no longer links /etc/motd to /var/run/motd.
  * debian/patches-applied/pam_umask_usergroups_from_login.defs.patch: include
    patch to autogenerated manpage file

ddf4359... by Steve Langasek on 2014-01-16

Import patches-unapplied version 1.1.8-1 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 69ead1cbc228a0f82c9104e88717fa7528869176

New changelog entries:
  * New upstream release.
    - includes upstream changes to pam_exec. Closes: #670147.
    - adds support for newer hashing algorithms to pam_userdb.
      Closes: #671740.
    - fixes handling of 'quiet' argument to pam_listfile, to match the
      documentation. Closes: #592219.
    - fixes handling of @users@@hosts netgroup syntax in access.conf.
      Closes: #681223.
    - fixes installation of the /etc/security/namespace.d directory.
      Closes: #710998.
    - 027_pam_limits_better_init_allow_explicit_root: support for reading
      /proc/1/limits is upstream, this patch now only handles the policy
      of resetting limits by default and not applying glob limits to root.
    - debian/patches/fix-manpage-crud: drop, manpages now being generated
      upstream with a newer, fixed xsltproc.
    - debian/patches/pam_env-fix-overflow.patch, pam_env-fix-dos.patch,
      glibc-2_16-compilation-fix.patch, sys-types-include.patch: drop,
      included upstream.
  * Add build-dependency on pkg-config.
  * Ensure autogenerated files are after source files in all relevant patches,
    so that regenerating documentation doesn't cause build skew.
  * Drop the --disable-regenerate-docu argument, restoring the HTML manuals
    to the libpam-doc package. Closes: #700485.
  * No need to override dh_compress in debian/rules, it already handles .html
    files correctly.
  * debian/libpam-cracklib.prerm: use $DPKG_MAINTSCRIPT_PACKAGE_COUNT to avoid
    prematurely removing the PAM config when the package is installed for
    multiple architectures. Closes: #647428.

69ead1c... by Steve Langasek on 2014-01-14

Import patches-unapplied version 1.1.3-11 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 7c1fafa75e2810a101a0dcd17e9038f9df3beda9

New changelog entries:
  [ Wookey ]
  * Disable libaudit for stage1 bootstrap.
  [ Steve Langasek ]
  * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:
    Ignore failure in user namespaces.
  * Use [linux-any] in build-deps, instead of hard-coding a list of
    non-Linux archs. Closes: #634516.

7c1fafa... by Steve Langasek on 2013-10-20

Import patches-unapplied version 1.1.3-10 to debian/sid

Imported using git-ubuntu import.

Changelog parent: a994cb35f25d060827b9b68328cfe8b6d0d93955

New changelog entries:
  * Fix pam-auth-update handling of trailing blank lines in the fields of
    profiles. LP: #1160288.
  * Reintroduce libaudit support now that libaudit has been multiarched.
    Closes: #699159.

a994cb3... by Steve Langasek on 2013-02-12

Import patches-unapplied version 1.1.3-9 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 0c8ca15168d37c1ce01c7cb7d859008447679269

New changelog entries:
  * Revert libaudit support for now, because libaudit isn't multiarched yet
    in unstable so this regresses cross-installability. Reopens bug
  * Add an or'ed dependency on cdebconf, which also implements the
    xloadtemplatefile extension that prevents us from depending on just
    'debconf-2.0'. Thanks to Régis Boudin <email address hidden> for the info.
    Closes: #677278.

0c8ca15... by Steve Langasek on 2013-02-12

Import patches-unapplied version 1.1.3-8 to debian/sid

Imported using git-ubuntu import.

Changelog parent: fe98a1d14641b9634c61c2ceb2ff7bcb04432986

New changelog entries:
  * Confirm NMU for bug #611136; thanks to Michael Gilbert.
    - As a side effect, there will no longer be errors from reading the
      .pam_environment twice since we are now reading it 0 times.
      LP: #955032.
  * Adjust the pam_env documentation to match the module behavior resulting
    from the previous security upload. Closes: #693995.
  * debian/rules: never regenerate manpages at build time; this may cause
    build skew that breaks the world in a multiarch context. LP: #1095887.
  * debian/patches-applied/glibc-2_16-compilation-fix.patch: fix missing
    include causing build failure with eglibc 2.16. Thanks to Daniel
    Schepler <email address hidden>. Closes: #693450.
  * Ditch autoconf patch in favor of a build-dependency on dh-autoreconf,
    which will let us keep up-to-date with newer autotools. In the present
    instance, this gets us aarch64 support.
  * Install pam_timestamp_check - and while we're at it, move the manpage
    to the correct binary package. Closes: #648695.
  * Update lintian overrides to suppress some noise about hardening and
  * Enable audit support, by popular demand. This should have no major
    impact unless you're also running auditd; but I reserve the right to
    disable this again in the event that this causes a performance hit or
    breaks upgrades (since the dependency is pulled into libpam, not just
    into pam_tty_audit). Closes: #699159, LP: #937005.

fe98a1d... by Michael Gilbert <email address hidden> on 2012-04-29

Import patches-unapplied version 1.1.3-7.1 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 0260ad338b33a4b9d95e026676b96ecc0cc9b6d4

New changelog entries:
  * Non-maintainer upload.
  * Fix cve-2011-4708: user-configurable .pam_environment allows
    administrator-level changes without root access (closes: #611136).