[gentoo-commits] proj/kde:master commit in: sys-auth/pambase/files/, sys-auth/pambase/

[Dennis Schridde]

commit:     23983c0b56e5619339c85eff017db88536e980c0
Author:     Dennis Schridde <devurandom <AT> gmx <DOT> net>
AuthorDate: Wed Nov 21 13:53:16 2012 +0000
Commit:     Dennis Schridde <devurandom <AT> gmx <DOT> net>
CommitDate: Wed Nov 21 13:53:16 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/kde.git;a=commit;h=23983c0b

[sys-auth/pambase] Fix KDE autologin (bug #422495)

Was showing lastlog dialogue box on every login, delaying the time until the system becomes usable unnecessarily.

pam_lastlog is now silent by default and only for login shells it shows a message.

Thanks to Andrei Mihăilă and Egor Y. Egorov!

Bug: #422495

Package-Manager: portage-2.2.0_alpha142

---
 .../files/pambase-20120417-lastlog-silent.patch    |   20 ++++
 .../pambase/files/pambase-20120417-systemd.patch   |   29 ++++++
 sys-auth/pambase/metadata.xml                      |   84 ++++++++++++++++
 sys-auth/pambase/pambase-20120417-r2.ebuild        |  106 ++++++++++++++++++++
 4 files changed, 239 insertions(+), 0 deletions(-)

diff --git a/sys-auth/pambase/files/pambase-20120417-lastlog-silent.patch b/sys-auth/pambase/files/pambase-20120417-lastlog-silent.patch
new file mode 100644
index 0000000..79266a7
--- /dev/null
+++ b/sys-auth/pambase/files/pambase-20120417-lastlog-silent.patch
@@ -0,0 +1,20 @@
+--- pambase-20120417/login.in.orig	2012-11-21 14:31:49.031948988 +0100
++++ pambase-20120417/login.in	2012-11-21 14:32:41.172330601 +0100
+@@ -3,4 +3,6 @@
+ 
+ account    include	system-local-login
+ password   include	system-local-login
++
++session    optional pam_lastlog.so DEBUG
+ session    include	system-local-login
+--- pambase-20120417/system-login.in.orig	2012-11-21 14:31:42.232160039 +0100
++++ pambase-20120417/system-login.in	2012-11-21 14:35:20.738025880 +0100
+@@ -41,7 +41,7 @@
+ session		required	pam_env.so DEBUG
+ #endif
+ #if HAVE_LASTLOG
+-session		optional	pam_lastlog.so DEBUG
++session		optional	pam_lastlog.so silent DEBUG
+ #endif
+ session		include		system-auth
+ #if HAVE_CONSOLEKIT

diff --git a/sys-auth/pambase/files/pambase-20120417-systemd.patch b/sys-auth/pambase/files/pambase-20120417-systemd.patch
new file mode 100644
index 0000000..047fb41
--- /dev/null
+++ b/sys-auth/pambase/files/pambase-20120417-systemd.patch
@@ -0,0 +1,29 @@
+http://bugs.gentoo.org/372229
+
+--- Makefile
++++ Makefile
+@@ -28,6 +28,10 @@
+ PAMFLAGS += -DHAVE_CONSOLEKIT=1
+ endif
+ 
++ifeq "$(SYSTEMD)" "yes"
++PAMFLAGS += -DHAVE_SYSTEMD=1
++endif
++
+ ifeq "$(GNOME_KEYRING)" "yes"
+ PAMFLAGS += -DHAVE_GNOME_KEYRING=1
+ endif
+--- system-login.in
++++ system-login.in
+@@ -45,7 +45,10 @@
+ #endif
+ session		include		system-auth
+ #if HAVE_CONSOLEKIT
+-session		optional	pam_ck_connector.so nox11
++-session	optional	pam_ck_connector.so nox11
++#endif
++#if HAVE_SYSTEMD
++-session	optional	pam_systemd.so
+ #endif
+ #if HAVE_GNOME_KEYRING
+ session		optional	pam_gnome_keyring.so auto_start

diff --git a/sys-auth/pambase/metadata.xml b/sys-auth/pambase/metadata.xml
new file mode 100644
index 0000000..7a35775
--- /dev/null
+++ b/sys-auth/pambase/metadata.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <herd>pam</herd>
+  <maintainer>
+    <email>pam-bugs@g.o</email>
+  </maintainer>
+  <use>
+    <flag name="cracklib">
+      Enable pam_cracklib module on system authentication stack. This
+      produces warnings when changing password to something easily
+      crackable. It requires the same USE flag to be enabled on
+      <pkg>sys-libs/pam</pkg> or system login might be impossible.
+    </flag>
+    <flag name="consolekit">
+      Enable pam_ck_connector module on local system logins. This
+      allows for console logins to make use of ConsoleKit
+      authorization.
+    </flag>
+    <flag name="systemd">
+      Use pam_systemd module to register user sessions in the systemd
+      control group hierarchy.
+    </flag>
+    <flag name="gnome-keyring">
+      Enable pam_gnome_keyring module on system login stack. This
+      enables proper Gnome Keyring access to logins, whether they are
+      done with the login shell, a Desktop Manager or a remote login
+      systems such as SSH.
+    </flag>
+    <flag name="debug">
+      Enable debug information logging on syslog(3) for all the
+      modules supporting this in the system authentication and system
+      login stacks.
+    </flag>
+    <flag name="passwdqc">
+      Enable pam_passwdqc module on system auth stack for password
+      quality validation. This is an alternative to pam_cracklib
+      producing warnings, rejecting or providing example passwords
+      when changing your system password. It is used by default by
+      OpenWall GNU/*/Linux and by FreeBSD.
+    </flag>
+    <flag name="mktemp">
+      Enable pam_mktemp module on system auth stack for session
+      handling. This module creates a private temporary directory for
+      the user, and sets TMP and TMPDIR accordingly.
+    </flag>
+    <flag name="pam_ssh">
+      Enable pam_ssh module on system auth stack for authentication
+      and session handling. This module will accept as password the
+      passphrase of a private SSH key (one of ~/.ssh/id_rsa,
+      ~/.ssh/id_dsa or ~/.ssh/identity), and will spawn an ssh-agent
+      instance to cache the open key.
+    </flag>
+    <flag name="sha512">
+      Switch Linux-PAM's pam_unix module to use sha512 for passwords
+      hashes rather than MD5. This option requires
+      <pkg>&gt;=sys-libs/pam-1.0.1</pkg> built against
+      <pkg>&gt;=sys-libs/glibc-2.7</pkg>, if it's built against an
+      earlier version, it will silently be ignored, and MD5 hashes
+      will be used. All the passwords changed after this USE flag is
+      enabled will be saved to the shadow file hashed using SHA512
+      function. The password previously saved will be left
+      untouched. Please note that while SHA512-hashed passwords will
+      still be recognised if the USE flag is removed, the shadow file
+      will not be compatible with systems using an earlier glibc
+      version.
+    </flag>
+    <flag name="pam_krb5">
+      Enable pam_krb5 module on system auth stack, as an alternative
+      to pam_unix. If Kerberos authentication succeed, only pam_unix
+      will be ignore, and all the other modules will proceed as usual,
+      including Gnome Keyring and other session modules. It requires
+      <pkg>sys-libs/pam</pkg> as PAM implementation.
+    </flag>
+    <flag name="minimal">
+      Disables the standard PAM modules that provide extra information
+      to users on login; this includes pam_tally (and pam_tally2 for
+      Linux PAM 1.1 and later), pam_lastlog, pam_motd and other
+      similar modules. This might not be a good idea on a multi-user
+      system but could reduce slightly the overhead on single-user
+      non-networked systems.
+    </flag>
+  </use>
+</pkgmetadata>

diff --git a/sys-auth/pambase/pambase-20120417-r2.ebuild b/sys-auth/pambase/pambase-20120417-r2.ebuild
new file mode 100644
index 0000000..2fe7d41
--- /dev/null
+++ b/sys-auth/pambase/pambase-20120417-r2.ebuild
@@ -0,0 +1,106 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-auth/pambase/pambase-20120417-r1.ebuild,v 1.1 2012/06/19 07:55:53 ssuominen Exp $
+
+EAPI=4
+inherit eutils
+
+DESCRIPTION="PAM base configuration files"
+HOMEPAGE="http://www.gentoo.org/proj/en/base/pam/"
+SRC_URI="http://dev.gentoo.org/~flameeyes/${PN}/${P}.tar.bz2
+	http://dev.gentoo.org/~phajdan.jr/${PN}/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 -sparc-fbsd -x86-fbsd ~x86-freebsd ~amd64-linux ~ia64-linux ~x86-linux"
+IUSE="consolekit cracklib debug gnome-keyring minimal mktemp pam_krb5 pam_ssh passwdqc selinux +sha512 systemd"
+
+RESTRICT=binchecks
+
+MIN_PAM_REQ=1.1.3
+
+RDEPEND="
+	|| (
+		>=sys-libs/pam-${MIN_PAM_REQ}
+		( sys-auth/openpam || ( sys-freebsd/freebsd-pam-modules sys-netbsd/netbsd-pam-modules ) )
+		)
+	consolekit? ( >=sys-auth/consolekit-0.4.5_p2012[pam] )
+	cracklib? ( >=sys-libs/pam-${MIN_PAM_REQ}[cracklib] )
+	gnome-keyring? ( >=gnome-base/gnome-keyring-2.32[pam] )
+	mktemp? ( sys-auth/pam_mktemp )
+	pam_krb5? (
+		>=sys-libs/pam-${MIN_PAM_REQ}
+		>=sys-auth/pam_krb5-4.3
+		)
+	pam_ssh? ( sys-auth/pam_ssh )
+	passwdqc? ( >=sys-auth/pam_passwdqc-1.0.4 )
+	selinux? ( >=sys-libs/pam-${MIN_PAM_REQ}[selinux] )
+	sha512? ( >=sys-libs/pam-${MIN_PAM_REQ} )
+	systemd? ( >=sys-apps/systemd-44-r1[pam] )
+	!<sys-apps/shadow-4.1.5-r1
+	!<sys-freebsd/freebsd-pam-modules-6.2-r1
+	!<sys-libs/pam-0.99.9.0-r1"
+DEPEND="app-portage/portage-utils"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${P}-systemd.patch
+	epatch "${FILESDIR}"/${P}-lastlog-silent.patch
+}
+
+src_compile() {
+	local implementation=
+	local linux_pam_version=
+	if has_version sys-libs/pam; then
+		implementation=linux-pam
+		local ver_str=$(qatom `best_version sys-libs/pam` | cut -d ' ' -f 3)
+		linux_pam_version=$(printf "0x%02x%02x%02x" ${ver_str//\./ })
+	elif has_version sys-auth/openpam; then
+		implementation=openpam
+	else
+		die "PAM implementation not identified"
+	fi
+
+	use_var() {
+		local varname=$(echo $1 | tr [a-z] [A-Z])
+		local usename=${2-$(echo $1 | tr [A-Z] [a-z])}
+		local varvalue=$(usex $usename)
+		echo "${varname}=${varvalue}"
+	}
+
+	emake \
+		GIT=true \
+		$(use_var debug) \
+		$(use_var cracklib) \
+		$(use_var passwdqc) \
+		$(use_var consolekit) \
+		$(use_var systemd) \
+		$(use_var GNOME_KEYRING gnome-keyring) \
+		$(use_var selinux) \
+		$(use_var mktemp) \
+		$(use_var PAM_SSH pam_ssh) \
+		$(use_var sha512) \
+		$(use_var KRB5 pam_krb5) \
+		$(use_var minimal) \
+		IMPLEMENTATION=${implementation} \
+		LINUX_PAM_VERSION=${linux_pam_version}
+}
+
+src_test() { :; }
+
+src_install() {
+	emake GIT=true DESTDIR="${ED}" install
+}
+
+pkg_postinst() {
+	if use sha512; then
+		elog "Starting from version 20080801, pambase optionally enables"
+		elog "SHA512-hashed passwords. For this to work, you need sys-libs/pam-1.0.1"
+		elog "built against sys-libs/glibc-2.7 or later."
+		elog "If you don't have support for this, it will automatically fallback"
+		elog "to MD5-hashed passwords, just like before."
+		elog
+		elog "Please note that the change only affects the newly-changed passwords"
+		elog "and that SHA512-hashed passwords will not work on earlier versions"
+		elog "of glibc or Linux-PAM."
+	fi
+}