- Add common-session-nonlogin and postlogin-* pam.d config files

for https://github.com/SUSE/pam-config/pull/16, pam_lastlog2
  and upcoming pam_wtmpdb.

OBS-URL: https://build.opensuse.org/package/show/Linux-PAM/pam?expand=0&rev=273

common-session-nonlogin.pamd

@@ -0,0 +1,14 @@
+#
+# /etc/pam.d/common-session-nonlogin - session-related modules common
+# to services not doing a real login
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define tasks to be performed
+# at the start and end of sessions of *any* kind (both interactive and
+# non-interactive), but not if they don't create a new login session
+# (e.g. like cron, chfn, chsh, ...)
+#
+session	required	pam_limits.so
+session	required	pam_unix.so	try_first_pass
+session optional	pam_umask.so
+session optional	pam_env.so

pam.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Mar 20 10:12:41 UTC 2023 - Thorsten Kukuk <kukuk@suse.com>
+
+- Add common-session-nonlogin and postlogin-* pam.d config files
+  for https://github.com/SUSE/pam-config/pull/16, pam_lastlog2
+  and upcoming pam_wtmpdb.
+
 -------------------------------------------------------------------
 Fri Mar 10 18:27:09 UTC 2023 - Giuliano Belinassi <giuliano.belinassi@suse.com>
 

pam.spec

@@ -88,6 +88,11 @@ Source12:       pam-login_defs-check.sh
 Source13:       pam.tmpfiles
 Source14:       Linux-PAM-%{version}-docs.tar.xz.asc
 Source15:       Linux-PAM-%{version}.tar.xz.asc
+Source20:       common-session-nonlogin.pamd
+Source21:       postlogin-auth.pamd
+Source22:       postlogin-account.pamd
+Source23:       postlogin-password.pamd
+Source24:       postlogin-session.pamd
 Patch1:         pam-limit-nproc.patch
 Patch3:         pam-xauth_ownership.patch
 Patch4:         pam-bsc1177858-dont-free-environment-string.patch
@@ -276,6 +281,11 @@ install -m 644 %{SOURCE4} %{buildroot}%{_pam_vendordir}/common-auth
 install -m 644 %{SOURCE5} %{buildroot}%{_pam_vendordir}/common-account
 install -m 644 %{SOURCE6} %{buildroot}%{_pam_vendordir}/common-password
 install -m 644 %{SOURCE7} %{buildroot}%{_pam_vendordir}/common-session
+install -m 644 %{SOURCE20} %{buildroot}%{_pam_vendordir}/common-session-nonlogin
+install -m 644 %{SOURCE21} %{buildroot}%{_pam_vendordir}/postlogin-auth
+install -m 644 %{SOURCE22} %{buildroot}%{_pam_vendordir}/postlogin-account
+install -m 644 %{SOURCE23} %{buildroot}%{_pam_vendordir}/postlogin-password
+install -m 644 %{SOURCE24} %{buildroot}%{_pam_vendordir}/postlogin-session
 mkdir -p %{buildroot}%{_prefix}/lib/motd.d
 #
 # Remove crap
@@ -374,6 +384,7 @@ done
 %else
 %{_pam_vendordir}/other
 %{_pam_vendordir}/common-*
+%{_pam_vendordir}/postlogin-*
 %endif
 %{_distconfdir}/environment
 %{_pam_secdistconfdir}/access.conf

postlogin-account.pamd

@@ -0,0 +1,10 @@
+#
+# /etc/pam.d/postlogin-account - account settings common to login services
+#
+# This file is included from login service-specific PAM config files,
+# and contains the PAM modules which should be called after
+# the modules of "common-account".
+#
+# This file should only be included from services doing real logins,
+# so like "login", "xdm" or "sshd", but not "chsh" or "cron".
+#

postlogin-auth.pamd

@@ -0,0 +1,10 @@
+#
+# /etc/pam.d/postlogin-auth - authentication settings common to login services
+#
+# This file is included from login service-specific PAM config files,
+# and contains the PAM modules which should be called after
+# the modules of "common-auth".
+#
+# This file should only be included from services doing real logins,
+# so like "login", "xdm" or "sshd", but not "chsh" or "cron".
+#

postlogin-password.pamd

@@ -0,0 +1,10 @@
+#
+# /etc/pam.d/postlogin-password - password settings common to login services
+#
+# This file is included from login service-specific PAM config files,
+# and contains the PAM modules which should be called after
+# the modules of "common-password".
+#
+# This file should only be included from services doing real logins,
+# so like "login", "xdm" or "sshd", but not "chsh" or "cron".
+#

postlogin-session.pamd

@@ -0,0 +1,10 @@
+#
+# /etc/pam.d/postlogin-session - session settings common to login services
+#
+# This file is included from login service-specific PAM config files,
+# and contains the PAM modules which should be called after
+# the modules of "common-session".
+#
+# This file should only be included from services doing real logins,
+# so like "login", "xdm" or "sshd", but not "chsh" or "cron".
+#