pam (1.7.0-5) unstable; urgency=high

  * pam_access: backport upstream commit to implement nodns option to allow people to work around #1087019

 -- Sam Hartman <hartmans@debian.org>  Sun, 29 Jun 2025 11:40:46 -0600

pam (1.7.0-4) experimental; urgency=high

  [ Gioele Barabucci ]
  * d/control: Update standards version to 4.7.0, no changes needed
  * d/TODO: Remove outdated item about fop (Closes: #629438)

  [ Sam Hartman ]
  * Fix CVE-2025-6020: local privilege escalation in pam_namespace, Closes: 1107919

  [ James Morris ]
  * pam_access improperly checks for group membership of a user.
    (Closes: #1103339)

 -- Sam Hartman <hartmans@debian.org>  Thu, 26 Jun 2025 11:42:58 -0600

pam (1.7.0-3) unstable; urgency=high

  * Disable HURD suid patch for now because it breaks on Linux, Closes:
    #1095194

 -- Sam Hartman <hartmans@debian.org>  Tue, 11 Feb 2025 05:19:04 -0700

pam (1.7.0-2) unstable; urgency=medium

  * Release to unstable

 -- Sam Hartman <hartmans@debian.org>  Wed, 29 Jan 2025 18:58:07 -0700

pam (1.7.0-1) experimental; urgency=medium

  * New upstream version, Closes: #1088923
    - ChangeLog removed upstream, do not install it.
    - Upstream claims CVE-2024-10041 is fixed by PAM 1.6.0, Closes:
      #1086038
  * Build depend on meson
  * Depend on fop
  * Use installed faillock and namespace man page rather than source man page.
  * Install text module documentation in libpam-doc/txt
  * Build and install pdf documentation
  * Remove Steve from uploaders, thanks for all your contributions; you
    will be missed.
  * In response to lintian complaint, clarify that PAM can be distributed under any version of the GPL.
  * Pdf files are compressed; update doc-base
  * Properly handle environment.5 manpage, Closes: #1081181
  * Move pam module man pages into libpam-runtime to avoid  multi-arch uninstallability
  * Move libpam0g-dev man pages into libpam-doc
  * Build depend on pkgconf rather than pkg-config
  * Only build-depend on documentation tools for arch-indep builds; do not build docs for arch all builds, Closes: #1093222
  * pam_limits: do not override systemd's limits by default; add the set_all option to restore previous behavior, Closes: #995236
  * Document pam_limits change in news

 -- Sam Hartman <hartmans@debian.org>  Thu, 16 Jan 2025 15:59:23 -0700

pam (1.5.3-7) unstable; urgency=medium

  * Correct Build depends for docbook5, Closes: #1065064
  * Regenerate patches to capture date change in pam_getitem.3
  * Depend on libdb-dev again, bringing back pam_userdb, Closes: #1065088
  * Document pam_umask change, Closes: #1065806

 -- Sam Hartman <hartmans@debian.org>  Mon, 08 Apr 2024 16:35:07 -0600

pam (1.5.3-6) unstable; urgency=medium

  [ Dan Bungert ]
  * Fix FTBFS when built with -Werror=implicit-function-declaration

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 29 Feb 2024 12:56:32 -0800

pam (1.5.3-5) unstable; urgency=medium

  * Revert renaming libpam0g to libpam0t64 for time_t transition: apt
    sometimes removes libpam0g rather than simply letting libpam0t64
    replace libpam0g (and deconfiguring libpam0g), leaving a system where
    essential packages are broken,  Closes: #1065017
    * Since libpam0t64 is going away, we do not need dpkg-diversions for it.
    * As a consequence libpam_misc has an ABI break without a package name
    change.  We believe nothing in the archive depends on this ABI, and at
    least until we come up with a better solution this is the least bad option.
  * For now remove libdb-dev so that libdb-dev can undergo time_t
    transition.  That means this version of pam does not include
    pam_userdb, which makes pam unsuitable for release.
  * Replace/break libpam0t64

 -- Sam Hartman <hartmans@debian.org>  Thu, 29 Feb 2024 09:46:54 -0700

pam (1.5.3-4) unstable; urgency=medium

  * Upload to unstable
  * Revert 1.5.2-9.1 changes to debian/rules now that we use
    debian/patches properly.

 -- Sam Hartman <hartmans@debian.org>  Tue, 27 Feb 2024 21:30:52 -0700

pam (1.5.3-3) experimental; urgency=medium

  [ Helmut Grohne ]
  * Mitigate /usr-move file loss. (Closes: #1062802)

 -- Helmut Grohne <helmut@subdivi.de>  Sat, 03 Feb 2024 12:18:52 +0100

pam (1.5.3-2) experimental; urgency=medium

  * Rename libpam0g to libpamt64 for time_t transition
  * New Swedish Translations, Thanks Martin Bagge / brother, Closes: #1057775
  * pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS
    situations (CVE-2024-22365) (Closes: #1061097)

 -- Sam Hartman <hartmans@debian.org>  Fri, 02 Feb 2024 11:27:45 -0700

pam (1.5.3-1) experimental; urgency=medium

  [ Sam Hartman ]
  * New upstream version
  * Since we no longer build with NIS support, drop Debian patches related
    to NIS
  [ Debian Janitor]
  * Update lintian override info to new format:
    + debian/libpam-runtime.lintian-overrides: line 5, 7, 9-13
    + debian/libpam-modules.lintian-overrides: line 5-10, 14
  * Trim trailing whitespace.
  * Move source package lintian overrides to debian/source.
  * Update renamed lintian tag names in lintian overrides.
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.
  * Drop unnecessary dependency on dh-autoreconf.
  * Update standards version to 4.6.2, no changes needed.

  [ Andreas Henriksson ]
  * debian/rules: use --enable-usergroups configure flag (Closes: #583958)
  * Use pam_umask.so in common-session{-noninteractive} (Closes: #711104)

  [ Debian Janitor ]
  * Apply multi-arch hints. + libpam-doc: Add Multi-Arch: foreign.

  [ Sam Hartman ]
  * Drop NIS patches and rearrange other patches.
  * Update patch to move pam manpage to section 7: docbook tools now take
    the man page output name from the xml so we need to update the
    Makefile.
  * Now PAM.7 is actually installed as pam.7 so update packaging
  * pam-auth-update: Session-Interactive-Only set to anything other than
    yes counts as undefined/no, thanks Lucas Nussbaum, Closes: #982309
  * Use logind instead of utmp in pam_issue and pam_timestamp; utmp is not
    y2038-safe.

  [ Sam Hartman ]
  * Add new common-session-* templates to pam-auth-update.

  [ Chris Hofstaedtler ]
  * Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes
    usrmerge aliasing symlinks are in place since bookworm to keep
    compatibility with PAM modules still installing into /lib.
    (DEP17 M2) (Closes: #1060160).
  * Update lintian override for setgid binary.

 -- Sam Hartman <hartmans@debian.org>  Mon, 15 Jan 2024 15:45:50 -0700

pam (1.5.2-9.1) unstable; urgency=medium

  * Non-maintainer upload acked by Sam Hartman.
  * Really fix quilt-related FTBFS: (Closes: #1054505)
    pam is a 3.0 (quilt) source package and has a .pc directory after unpack
    despite having no debian/patches. Even when setting QUILT_PATCH_DIR or
    QUILT_PATCHES, quilt is now mislead to using the non-existent
    debian/patches and this makes dh_quilt_unpatch fail, so we delete that
    directory unless it corresponds to the real debian/patches-applied that we
    want to be used.

 -- Helmut Grohne <helmut@subdivi.de>  Tue, 24 Oct 2023 19:38:53 +0200

pam (1.5.2-9) unstable; urgency=low

  * Revert 1.5.2-8 upload; as far as I can tell the change is incorrect,
    Closes: #1054493

 -- Sam Hartman <hartmans@debian.org>  Tue, 24 Oct 2023 09:19:43 -0600

pam (1.5.2-7) unstable; urgency=medium

  [ Steve Langasek ]
  * Drop reference to stale package version in libpam-modules.postinst;
    thanks, Gioele Barabucci <gioele@svario.it>.

  [ Sam Hartman ]
  * Fix pam-auth-update --disable logic error, Closes: #1039873
  * Set myself as maintainer; thanks Steve for past and future work.
  * Fix watch file, thanks Daniel Lewart, Closes: #1040310
  * Install upstream NEWS file as main upstream changelog; detailed
    CHANGELOG only  in libpam-doc, Closes: #1040315
  * Updated Turkish Debconf translations, Thanks Atila KOÇ, Closes: #1029002

 -- Sam Hartman <hartmans@debian.org>  Wed, 16 Aug 2023 17:22:53 -0600

pam (1.5.2-6) unstable; urgency=medium

  * Update debian/copyright, Thanks Bastian Germann, Closes: #460232
  * When pam-auth-update is called with --root,  use
    /usr/share/pam-configs from the root not from the host system, Thanks
    Johannes Schauer Marin Rodrigues, Closes: #1022952
  * Build-depend on libcrypt-dev, Closes: #1024645
  *  Add pam-auth-udpate --disable, Closes: #1004000
  * Add autopkgtests

 -- Sam Hartman <hartmans@debian.org>  Tue, 03 Jan 2023 13:15:23 -0700

pam (1.5.2-5) unstable; urgency=medium

  * pam_namespace_helper manpage *wasn't* missing, it was just being
    wrongly shipped in libpam-modules instead - so complete the moving
    of the manpage to the libpam-modules-bin where it belongs with the
    binary.  Really Closes: #1021336.

 -- Steve Langasek <vorlon@debian.org>  Thu, 06 Oct 2022 18:56:06 +0000

pam (1.5.2-4) unstable; urgency=medium

  * pam_namespace_helper manpage was missing, but namespace.conf.5 was
    already shipped in libpam-modules.  Leave it there.  Closes: #1021336.

 -- Steve Langasek <vorlon@debian.org>  Thu, 06 Oct 2022 17:28:36 +0000

pam (1.5.2-3) unstable; urgency=medium

  * Add missing manpages for pam_namespace which for some reason don't get
    installed by the upstream rules
  * Drop obsolete upgrade code from maintainer scripts which is no longer
    used
  * Drop manual multiarch file handling in favor of dh-exec.
  * No special-case needed for pam_modutil_sanitize_helper_fds in symbols
    file, it's covered by the existing globs.
  * debian/local/Debian-PAM-MiniPolicy: drop references to ancient
    package versions.  Thanks, Marc Haber.
  * Support DPKG_ROOT in the postinst scripts.  Closes: #993161.
    Thanks, Johannes Schauer Marin Rodrigues.
  * Further proof libpam-runtime postinst for DPKG_ROOT just in case.

 -- Steve Langasek <vorlon@debian.org>  Thu, 06 Oct 2022 04:05:02 +0000

pam (1.5.2-2) unstable; urgency=medium

  * Pass --with-systemdunitdir=/usr/lib/systemd/system for consistent
    builds whether we are or aren't building in an environment with systemd
    present.
  * Install the pam_namespace.service unit in the libpam-modules-bin
    package.

 -- Steve Langasek <vorlon@debian.org>  Thu, 18 Aug 2022 16:47:57 +0000

pam (1.5.2-1) unstable; urgency=medium

  * New upstream release.
    - fixes compatibility with libpam-systemd.  Closes: #1017467.
    - fixes bashisms in configure.ac.  Closes: #998361.
  * Refresh patches.
  * Drop patches included or obsoleted upstream:
    - debian/patches-applied/pam_unix_fix_sgid_shadow_auth.patch
    - debian/patches-applied/pam_unix_initialize_daysleft
    - debian/patches-applied/pam_faillock_create_directory
    - debian/patches-applied/pam_unix_avoid_checksalt
    - debian/patches-applied/pam_env-allow-environment-files-without-EOL-at-EOF.patch
  * Drop libpam-cracklib which has been obsoleted upstream.
  * Add pkgconfig .pc files to libpam0g-dev.  Closes: #1012688.
  * Update .symbols file.
  * Updated Romanian debconf translation, thanks Andrei Popescu, Closes:
    #986416
  * Drop versioning of quilt build-dependency to quiet lintian, since the
    version is satisfied by oldoldoldstable.
  * Drop unused build-build-dependency on bzip2.
  * Adjust lintian overrides for latest lintian syntax.
  * Update Standards-Version.
  * Bump debhelper compat to 13.
  * debian/not-installed: document upstream files that aren't used.
  * Override incorrect lintian warning about use of dpkg database.
  * Override lintian warning for PAM module manpages being in section 8
  * Override lintian warning for unused debconf templates
  * Install additional upstream manpages: faillock(8), environment(5),
    pwhistory_helper(8)
  * Install additional helpers in libpam-modules-bin: pam_namespace_helper,
    pwhistory_helper
  * Fix wrong syntax in symbols file

 -- Steve Langasek <vorlon@debian.org>  Thu, 18 Aug 2022 07:27:16 +0000

pam (1.4.0-13) unstable; urgency=medium

  * Don't build with NIS support.  This is only used for password changes on
    NIS systems, and is pulling a large dependency chain into the Essential
    package set which is not justifiable.

 -- Steve Langasek <vorlon@debian.org>  Mon, 25 Apr 2022 16:12:04 -0700

pam (1.4.0-11) unstable; urgency=medium

  * Whitespace fixes in debconf templates.

  [ Sergio Durigan Junior ]
  * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:
    Allow /etc/environment files without EOL at EOF.  In other words,
    allow files without a newline at the end. (LP: #1953201)

 -- Steve Langasek <vorlon@debian.org>  Mon, 06 Dec 2021 11:11:31 -0800

pam (1.4.0-10) unstable; urgency=medium

  * Fix syntax error in libpam0g.postinst when a systemd unit fails,
    Closes: #992538
  * Include upstream patch not to use crypt_checksalt; without this
    passwords set prior to bullseye were considered expired, Closes:
    #992848
  * Support DPKG_ROOT for pam-auth-update, thanks Johannes 'josch' Schauer
    Closes: #983427


 -- Sam Hartman <hartmans@debian.org>  Thu, 26 Aug 2021 13:43:23 -0600

pam (1.4.0-9) unstable; urgency=medium

  * Revert prefer the multiarch path from 1.4.0-8: It turns out that
    Debian uses DEFAULT_MODULE_PATH and _PAM_ISA in the opposite meaning
    of upstream.  If I had read the patch header of
    patches-applied/lib_security_multiarch_compat more closely I would
    have noticed this.  The effect of 1.4.0-9 is what is stated in the
    1.4.0-8 changelog: we prefer multiarch paths, but the original patch
    did that.
  * I did test this in 1.4.0-8, but my test design was flawed.  I placed a
    invalid shared object in /lib/security and confirmed it did not shadow
    an object in /lib/x86_64-linux-gnu/security.  However I realized
    shortly after releasing 1.4.0-8 that a valid shared object in
    /lib/security will shadow one in the multiarch path.

 -- Sam Hartman <hartmans@debian.org>  Fri, 09 Jul 2021 10:55:02 -0600

pam (1.4.0-8) unstable; urgency=high

  [ Hideki Yamane ]
  * debian/patches-applied/lib_security_multiarch_compat
    - Fix regression introduced in 1.4.0-1: search both /lib/security and
    /lib/[multiarch_tripple]/security/, Closes: #990790

  [ Sam Hartman ]
  * Reword changelog
  * Prefer the multiarch path (_PAM_ISA) to the non-multiarch path.
    That's different than buster, but  guarantees everything already
    working in bullseye will continue to work and also guarantees that
    when multiarch modules are available we use them.

 -- Hideki Yamane <henrich@debian.org>  Tue, 06 Jul 2021 22:09:15 +0900

pam (1.4.0-7) unstable; urgency=medium

  * Updated portuguese debconf translation, thanks Pedro Ribeiro, Closes:
    #983594
  * Updated Simplified Chinese Translations, thanks Boyuan Yang
  * Updated Bulgarian Translation, Thanks Damyan Ivanov
  * Updated translation from the Slovak team, thanks Ladislav Michnovič,
    Closes: #984891
  * Updated Catalan translation, thanks Alex Muntada, Closes: #984568
  * Updated Brazilian Portuguese translation, Thanks  Adriano Rafael Gomes,
    Closes: #984656
  * French Debconf translations, thanks  Jean-Pierre Giraud    , Closes:
    #984910
  * Updated russian Debconf translations, thanks Алексей Шилин, Closes:
    #984878
  * Updated Dutch debconf templates, Thanks Frans Spiesschaert, Closes:
    #984823
      * Updated German Debconf translations, Thanks Sven Joachim
  * Code review fixes for the fix to #982295, thanks Mark Hindley
    - Actually set service to $1 rather than happening to use a variable
      of the same name in enclosing scope
    - Remove dead code setting idl when not used
  * Code review fixes to the fix for #982530, thanks Martin Schurz
    - Include '-' in the file matching regexp so we search
    /etc/pam.d/common-* for uses of pam_tally.  The profile check will
      catch this unless the user has overwridden the configuration
    - Fix capitalization of pam_Tally in debconf description


 -- Sam Hartman <hartmans@debian.org>  Mon, 15 Mar 2021 15:01:55 -0400

pam (1.4.0-6) unstable; urgency=medium

  * Clearly it's been too long since I've done debconf; run
    debconf-updatepo so the translations will show up as needing
    translating.

 -- Sam Hartman <hartmans@debian.org>  Fri, 26 Feb 2021 10:48:23 -0500

pam (1.4.0-5) unstable; urgency=low

  * Remove profiles containing pam_tally or pam_tally2 since we no longer
    build them.
  * Also, fail to permit profiles to be selected that include pam_tally
    once the new pam-auth-update is installed
  * Check for any user-added references to pam_tally and halt the upgrade,
    Closes: #982530
  * Handle services with systemd units but no init scripts, Closes: #982295
  * Register md5sum for new common-password template, Closes: #982898
  * After reading pam-auth-update source, I agree with Lucas Nussbaum
    that common-session is intended only for interactive sessions.
    Otherwise pam-auth-update should not duplicate module configurations
    between common-session-noninteractive and common-session, so update
    the documentation, Closes: #982297

 -- Sam Hartman <hartmans@debian.org>  Thu, 25 Feb 2021 15:48:22 -0500

pam (1.4.0-4) unstable; urgency=medium

  * Document in README.source how to avoid multi-arch problems with documentation, Closes: #851650
  * Update header to common-password talking about sha512
  * The fix for  #977648 incorrectly assumed how prerm scripts are called; update.

 -- Sam Hartman <hartmans@debian.org>  Wed, 03 Feb 2021 12:35:12 -0500

pam (1.4.0-3) unstable; urgency=medium

  [ Josh Triplett ]
  * libpam-runtime.postrm: Remove session-noninteractive files on purge,
    Closes: #978601

  [ Sam Hartman ]
  * patches-applied/pam_mkhomedir_stat_before_opendir: Stat the skeleton
    directory before opendir, Closes: #834589
  * libpam-modules.install: Install pam_faillock binaries, Closes: #981092
  * debian/patches-applied/pam_unix_initialize_daysleft : Initialize days before password expire, Closes: #980285
  * pam-configs/unix: Default to yescript rather than sha512.  From a theoretical security standpoint, it looks like yescript has similar security properties, assuming (as we typically do in the crypto protocol community) that sha256 is still reasonable.  However, in terms of practical resistant to password cracking, particularly in terms of valuing space complexity as well as time complexity, yescript is superior, Closes: #978553
  * No infinite loop on purge of libpam-runtime, Closes: #977648
  * patches-applied/pam_faillock_create_directory: create /run/faillock when needed.


 -- Sam Hartman <hartmans@debian.org>  Mon, 01 Feb 2021 15:27:08 -0500

pam (1.4.0-2) unstable; urgency=medium

  * Restart services on upgrade to 1.4.0.  Closes: #978555.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 28 Dec 2020 19:20:38 -0800

pam (1.4.0-1) unstable; urgency=medium

  * New upstream release.  Closes: #948188.
    - Stop using obsoleted selinux headers.  Closes: #956355.
    - Continue building pam_cracklib, which is deprecated upstream;
      the replacement, pam_passwdqc, is packaged separately.
    - Update symbols file for new symbols.
    - Refresh lintian overrides for changes to available pam modules.
  * Drop patches to implement "nullok_secure" option for pam_unix.
    Closes: #674857, #936071, LP: #1860826.
  * debian/patches-applied/cve-2010-4708.patch: drop, applied upstream.
  * debian/patches-applied/nullok_secure-compat.patch: Support
    nullok_secure as a deprecated alias for nullok.
  * debian/pam-configs/unix: use nullok, not nullok_secure.
  * Drop pam_tally and pam_tally2 modules, which have been deprecated
    upstream in favor of pam_faillock.  Closes: #569746, LP: #772121.
  * Add hardening+=bindnow to build options, per lintian.

 -- Steve Langasek <vorlon@debian.org>  Mon, 28 Dec 2020 06:05:13 +0000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libpam-doc`.
