Linux-PAM-1.6.1.tar.xz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIcBAABCgAGBQJmFWt/AAoJEKgEH6g54W42NCwP/iWl8igdScTreVF6zV79Dqu1
+sl+ZjBr/dL+DOTcotsRnoAZUOy4ug3iktMZr1t0BMpWUorNmUofH4SZuhsX0CgRq
+47t5mVqCakwn4JLq8J9cLOciMno6ips5ZT4RbMgzRYd1WcBurCAxQSNLP3aQGgub
+RFObkqw5814ksz9Ge6QVhJ4l9P0wUoKfcpkzHj2Vq+cy0EzlBtnBGCHrMDgrz5aT
+mXqGVvWTPO+lR2S+7wOLUtPoRv0uvN6h97ZszaoGoJ6wa6yYwOYz12/AiIsVQhet
+cnr29ymuwPDqlrYGD1Hb0+ZUQExjVDQY90hdJ/ZntUlK7CY/2SotpDGB9kR8dTYJ
+fpIVmR6GEZ+xSjBqa7RaiL8ieZCgT3TIvsMqteiFkqI+2lhlSGHX3g3oNSd3sbqd
+PLok6W4L+xWDp89aMyYDDs/ISjBt5sSNK4NOOTZIMK4oeScGJJvrDL3S5DOSk1ku
+o3l9N62WStD7fk0LYnyUGZORg/ccK6Yy2fV22zBMm/76PoyA1yHfFxCW+HwwmcqR
+0riaFjA8cesZ3Dj79q24U3FRVdW5fTF9gS/5mK/Yj51KMMzTkUmbjksEC/AEBKzB
+9laXxPdIeKUwNlGs7Heo/NE87u4OZfyihwpzLaTcOzbpN3zDyH6aH5poDs1FSaQ2
+UoUkHsbCWJU/ksn/9BIQ
+=Dbz2
+-----END PGP SIGNATURE-----

pam-bsc1194818-cursor-escape.patch

@@ -0,0 +1,36 @@
+From 8ae228fa76ff9ef1d8d6b2199582d9206f1830c6 Mon Sep 17 00:00:00 2001
+From: Stanislav Brabec <sbrabec@suse.cz>
+Date: Mon, 22 Jul 2024 23:18:16 +0200
+Subject: [PATCH] libpam_misc: Use ECHOCTL in the terminal input
+
+Use the canonical terminal mode (line mode) and set ECHOCTL to prevent
+cursor escape from the login prompt using arrows or escape sequences.
+
+ICANON is the default in most cases anyway. ECHOCTL is default on tty, but
+for example not on pty, allowing cursor to escape.
+
+Stanislav Brabec <sbrabec@suse.com>
+---
+ libpam_misc/misc_conv.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/libpam_misc/misc_conv.c b/libpam_misc/misc_conv.c
+index 7410e929..6b839b48 100644
+--- a/libpam_misc/misc_conv.c
++++ b/libpam_misc/misc_conv.c
+@@ -145,9 +145,10 @@ static int read_string(int echo, const char *prompt, char **retstr)
+ 	    return -1;
+ 	}
+ 	memcpy(&term_tmp, &term_before, sizeof(term_tmp));
+-	if (!echo) {
++	if (echo)
++	    term_tmp.c_lflag |= ICANON | ECHOCTL;
++	else
+ 	    term_tmp.c_lflag &= ~(ECHO);
+-	}
+ 	have_term = 1;
+ 
+ 	/*
+-- 
+2.45.2
+

pam_issue-systemd.patch

@@ -0,0 +1,51 @@
+From 8401cef10cd5f62849c5fcfef4c82db92712296c Mon Sep 17 00:00:00 2001
+From: Thorsten Kukuk <kukuk@suse.com>
+Date: Wed, 4 Sep 2024 16:07:56 +0200
+Subject: [PATCH] pam_issue: only count class user
+
+Since systemd added new types of classes (e.g. manager*), we cannot
+use the count of all sessions anymore, but have to check which class
+this is.
+
+This is backward compatible, systemd v209 or newer is required.
+---
+ modules/pam_issue/pam_issue.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/modules/pam_issue/pam_issue.c b/modules/pam_issue/pam_issue.c
+index aade642ec5..e2c555c405 100644
+--- a/modules/pam_issue/pam_issue.c
++++ b/modules/pam_issue/pam_issue.c
+@@ -165,13 +165,31 @@ read_issue_quoted(pam_handle_t *pamh, FILE *fp, char **prompt)
+ 		{
+ 		    unsigned int users = 0;
+ #ifdef USE_LOGIND
+-		    int sessions = sd_get_sessions(NULL);
++		    char **sessions_list;
++		    int sessions = sd_get_sessions(&sessions_list);
+ 
+ 		    if (sessions < 0) {
+ 		      pam_syslog(pamh, LOG_ERR, "logind error: %s",
+ 				 strerror(-sessions));
+ 		      _pam_drop(issue);
+ 		      return PAM_SERVICE_ERR;
++		    } else if (sessions > 0 && sessions_list != NULL) {
++		      int i;
++
++		      for (i = 0; i < sessions; i++) {
++			char *class;
++
++			if (sd_session_get_class(sessions_list[i], &class) < 0 || class == NULL)
++			  continue;
++
++			if (strncmp(class, "user", 4) == 0) // user, user-early, user-incomplete
++			  users++;
++			free(class);
++		      }
++
++		      for (i = 0; i < sessions; i++)
++			free(sessions_list[i]);
++		      free(sessions_list);
+ 		    } else {
+ 		      users = sessions;
+ 		    }