LGTM, please commit.
On Thu, 2020-05-14 at 05:06 +0300, Dmitry V. Levin wrote:
Deprecate pam_cracklib, there are two better alternatives to this
obsolete module: pam_passwdqc from passwdqc project and pam_pwquality
from libpwquality project.
Deprecate pam_tally and pam_tally2 in favour of pam_faillock.
* configure.ac: Implement --enable-cracklib=check that enables build
of pam_cracklib when libcrack is available.
Disable build of pam_cracklib, pam_tally, and pam_tally2 by default.
* NEWS: Mention this change.
* ci/run-build-and-tests.sh (DISTCHECK_CONFIGURE_FLAGS): Add
--enable-tally, --enable-tally2, and --enable-cracklib=check
to check build of these deprecated modules.
---
NEWS | 5 +++++
ci/run-build-and-tests.sh | 2 +-
configure.ac | 38 +++++++++++++++++++++++++----------
---
3 files changed, 31 insertions(+), 14 deletions(-)
diff --git a/NEWS b/NEWS
index eb31f960..e8c0de87 100644
--- a/NEWS
+++ b/NEWS
@@ -44,6 +44,11 @@ Release 1.4.0
* Added new API call pam_start_confdir() for special applications
that
cannot use the system-default PAM configuration paths and need to
explicitly specify another path
+* Deprecated pam_cracklib: this module is no longer built by default
and will
+ be removed in the next release, use pam_passwdqc (from passwdqc
project)
+ or pam_pwquality (from libpwquality project) instead
+* Deprecated pam_tally and pam_tally2: these modules are no longer
built
+ by default and will be removed in the next release, use
pam_faillock instead
Release 1.3.1
* pam_motd: add support for a motd.d directory
diff --git a/ci/run-build-and-tests.sh b/ci/run-build-and-tests.sh
index 070fc72a..a16282ca 100755
--- a/ci/run-build-and-tests.sh
+++ b/ci/run-build-and-tests.sh
@@ -5,7 +5,7 @@
#
# SPDX-License-Identifier: GPL-2.0-or-later
-DISTCHECK_CONFIGURE_FLAGS='--disable-dependency-tracking --enable-
Werror'
+DISTCHECK_CONFIGURE_FLAGS='--disable-dependency-tracking --enable-
Werror --enable-tally --enable-tally2 --enable-cracklib=check'
export DISTCHECK_CONFIGURE_FLAGS
case "${TARGET-}" in
diff --git a/configure.ac b/configure.ac
index b8687c88..ea08a7a3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -375,16 +375,26 @@ case "$ac_cv_search_dlopen" in
esac
AC_SUBST(LIBDL)
-# Check for cracklib
AC_ARG_ENABLE([cracklib],
- AS_HELP_STRING([--disable-cracklib],[do not use cracklib]),
- WITH_CRACKLIB=$enableval, WITH_CRACKLIB=yes)
-if test x"$WITH_CRACKLIB" != xno ; then
- AC_CHECK_HEADERS([crack.h],
- AC_CHECK_LIB([crack], [FascistCheck], LIBCRACK="-
lcrack", LIBCRACK=""))
-else
- LIBCRACK=""
-fi
+ [AS_HELP_STRING([--enable-cracklib],
+ [build deprecated pam_cracklib module])],
+ [], [enable_cracklib=no])
+LIBCRACK=""
+case "$enable_cracklib" in
+ no) ;;
+ yes|check)
+ dnl Check for cracklib
+ AC_CHECK_HEADERS([crack.h],
+ [AC_CHECK_LIB([crack], [FascistCheck],
+ [LIBCRACK="-lcrack"])])
+ if test -z "$LIBCRACK"; then
+ if test "$enable_cracklib" = yes; then
+ AC_MSG_FAILURE([failed to find cracklib])
+ fi
+ fi
+ ;;
+ *) AC_MSG_ERROR([bad value $enable_cracklib for --enable-cracklib
option]) ;;
+esac
AC_SUBST(LIBCRACK)
dnl Look for Linux Auditing library - see documentation
@@ -666,16 +676,18 @@ fi
AC_DEFINE_UNQUOTED(PAM_USERTYPE_OVERFLOW_UID,
$opt_kerneloverflowuid, [Kernel overflow uid.])
AC_ARG_ENABLE([tally],
- [AS_HELP_STRING([--disable-tally], [do not build
pam_tally module])],
- [], [enable_tally=yes])
+ [AS_HELP_STRING([--enable-tally],
+ [build deprecated pam_tally module])],
+ [], [enable_tally=no])
case "$enable_tally" in
yes|no) ;;
*) AC_MSG_ERROR([bad value $enable_tally for --enable-tally
option]) ;;
esac
AC_ARG_ENABLE([tally2],
- [AS_HELP_STRING([--disable-tally2], [do not build
pam_tally2 module])],
- [], [enable_tally2=yes])
+ [AS_HELP_STRING([--enable-tally2],
+ [build deprecated pam_tally2 module])],
+ [], [enable_tally2=no])
case "$enable_tally2" in
yes|no) ;;
*) AC_MSG_ERROR([bad value $enable_tally2 for --enable-tally2
option]) ;;
--
ldv
_______________________________________________
Pam-developers mailing list -- pam-developers(a)lists.fedorahosted.org
To unsubscribe send an email to
pam-developers-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/pam-developers@lists.fedorah...
--
Tomáš Mráz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
[You'll know whether the road is wrong if you carefully listen to your
conscience.]