From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Wed, 14 Feb 2024 13:22:40 +0000 (+0100)
Subject: Use PAM password-auth or system-auth if present
X-Git-Tag: v2.4.8~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8779fcac19f8d99d78f2697bec9ef9f2fbe1bdcb;p=thirdparty%2Fcups.git

Use PAM password-auth or system-auth if present

Enables possibility to use PAM modules password-auth or system-auth
if they exist during compilation. password-auth module is
for remote authentication and system-auth for local authentication.
---

diff --git a/CHANGES.md b/CHANGES.md
index e21d0b53ac..8290c5e4bd 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -8,6 +8,7 @@ Changes in CUPS v2.4.8 (TBA)
   (Issue #829)
 - Added new value for 'lpstat' option '-W' - successfull - for getting
   successfully printed jobs (Issue #830)
+- Added support for PAM modules password-auth and system-auth (Issue #892)
 - Raised `cups_enum_dests()` timeout for listing available IPP printers (Issue #751)
 - Fixed the web interface not showing an error for a non-existent printer
   (Issue #423)
diff --git a/conf/pam.password b/conf/pam.password
new file mode 100644
index 0000000000..6146a9134d
--- /dev/null
+++ b/conf/pam.password
@@ -0,0 +1,4 @@
+#%PAM-1.0
+# Use password-auth common PAM configuration for the daemon
+auth     include  password-auth
+account  include  password-auth
diff --git a/conf/pam.system b/conf/pam.system
new file mode 100644
index 0000000000..9e7c820f45
--- /dev/null
+++ b/conf/pam.system
@@ -0,0 +1,3 @@
+#%PAM-1.0
+auth     include  system-auth
+account  include  system-auth
diff --git a/config-scripts/cups-pam.m4 b/config-scripts/cups-pam.m4
index cf983b0311..f4d6ecbd95 100644
--- a/config-scripts/cups-pam.m4
+++ b/config-scripts/cups-pam.m4
@@ -71,6 +71,10 @@ AS_IF([test x$enable_pam != xno], [
 	    PAMMOD="pam_${with_pam_module}.so"
 	], [test -f /etc/pam.d/common-auth], [
 	    PAMFILE="pam.common"
+	], [test -f /etc/pam.d/password-auth], [
+	    PAMFILE="pam.password"
+	], [test -f /etc/pam.d/system-auth], [
+	    PAMFILE="pam.system"
 	], [
 	    moddir=""
 	    for dir in /lib/security /lib64/security /lib/x86_64-linux-gnu/security /var/lib/pam; do
diff --git a/configure b/configure
index 7af3d1c9ca..1921738cfa 100755
--- a/configure
+++ b/configure
@@ -10396,6 +10396,16 @@ then :
 
 	    PAMFILE="pam.common"
 
+elif test -f /etc/pam.d/password-auth
+then :
+
+	    PAMFILE="pam.password"
+
+elif test -f /etc/pam.d/system-auth
+then :
+
+	    PAMFILE="pam.system"
+
 else $as_nop
 
 	    moddir=""