fix PAM service files --without-selinux

Make pam_selinux.so optional in environments where the module isn't provided.

diff --git a/etc/pam.d/login b/etc/pam.d/login
index 5a648065be325d1841e0cd341ba4a79ec1e48ffc..c1649b37c4b3adb3f20fb05943b4ed9e32eb0c56 100644 (file)
--- a/etc/pam.d/login
+++ b/etc/pam.d/login
@@ -4,8 +4,8 @@ auth            include         system-auth
 account                required        pam_nologin.so
 account                include         system-auth
 password       include         system-auth
-session                required        pam_selinux.so close
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
 session                include         system-auth
 session                required        pam_loginuid.so
 session                optional        pam_console.so
-session                required        pam_selinux.so open
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

diff --git a/etc/pam.d/su b/etc/pam.d/su
index 7ef7134b9f5b50814f2d549fb8738a9e989e7c0c..35602bc8887d315b6b48c87bd1ec54386bea05b9 100644 (file)
--- a/etc/pam.d/su
+++ b/etc/pam.d/su
@@ -7,7 +7,7 @@ auth            required        pam_wheel.so use_uid
 auth           include         system-auth
 account                include         system-auth
 password       include         system-auth
-session                required        pam_selinux.so close
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
 session                include         system-auth
-session                required        pam_selinux.so open multiple
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
 session                optional        pam_xauth.so