Fix configure not detecting maildir, etc properly. Fix pam_env set variables

not being set.

7 files changed, 388 insertions, 12 deletions

diff --git a/sys-apps/shadow/ChangeLog b/sys-apps/shadow/ChangeLog
index a5fa263321a8..9525e3f86080 100644
--- a/sys-apps/shadow/ChangeLog
+++ b/sys-apps/shadow/ChangeLog
@@ -1,6 +1,10 @@
 # ChangeLog for sys-apps/shadow
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/shadow/ChangeLog,v 1.85 2004/11/07 09:13:01 kumba Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/shadow/ChangeLog,v 1.86 2004/11/07 19:56:30 azarah Exp $
+
+  07 Nov 2004; Martin Schlemmer <azarah@gentoo.org> :
+  Fix configure not detecting maildir, etc properly. Fix pam_env set variables
+  not being set.
 
   07 Nov 2004; Joshua Kinard <kumba@gentoo.org> shadow-4.0.5-r2.ebuild:
   Marked stable on mips.
diff --git a/sys-apps/shadow/Manifest b/sys-apps/shadow/Manifest
index d68b71f52592..644d0d3783ee 100644
--- a/sys-apps/shadow/Manifest
+++ b/sys-apps/shadow/Manifest
@@ -1,32 +1,35 @@
+MD5 e70a2b4b7f537a46b9a5b4bf6ae954f0 shadow-4.0.5-r3.ebuild 5548
 MD5 de00f40bf1fed9fd5a4d5f2594c33cf9 ChangeLog 15871
-MD5 9a09f8d531c582e78977dbfd96edc1f2 metadata.xml 164
+MD5 226400fa60e88f85f3185e36b4aab178 shadow-4.0.5-r1.ebuild 5235
 MD5 23ef7363bf5ffa1d0f3343ff2a618e5d shadow-4.0.4.1-r4.ebuild 5943
 MD5 f967b8c89896d0101831a6548ce94a52 shadow-4.0.5.ebuild 5099
-MD5 226400fa60e88f85f3185e36b4aab178 shadow-4.0.5-r1.ebuild 5235
-MD5 8cd71974166efd4fef349e19012808c8 shadow-4.0.5-r2.ebuild 5474
+MD5 9a09f8d531c582e78977dbfd96edc1f2 metadata.xml 164
+MD5 d8b8542a7bc013011a293732ca504a50 files/digest-shadow-4.0.5-r3 66
+MD5 aaf16ddabef285df169e37254b13561c files/shadow-4.0.4.1-selinux.diff 4296
 MD5 cef6788bc7c8c5468c1b1f68df77ed9e files/digest-shadow-4.0.4.1-r4 67
 MD5 058f760e522ab65e270293003805fe61 files/shadow-4.0.4.1-userdel-missing-brackets.patch 380
 MD5 a99f871c88548d503bad935d2aa6f412 files/shadow-4.0.4.1-nls-manpages.patch 355
+MD5 020e030c2d09b206e88cf9051ced6244 files/shadow-4.0.4.1-nonis.patch 1504
 MD5 d8b8542a7bc013011a293732ca504a50 files/digest-shadow-4.0.5 66
 MD5 d8b8542a7bc013011a293732ca504a50 files/digest-shadow-4.0.5-r1 66
 MD5 2d2faa6b9a837f9319de52a780485743 files/securetty 243
 MD5 7becc41b4f7264483ee3ff0ca8277084 files/shadow-4.0.4.1-passwd-typo.patch 438
 MD5 38ab75648a10b5d49d2aaffab77d787e files/shadow-4.0.5-login.defs.patch 753
+MD5 b8efca60a25e256eebe54c3d0db0760f files/shadow-4.0.4.1-gcc34-xmalloc.patch 361
+MD5 201f1321262da41ccd1a0283216ae9a7 files/shadow-4.0.4.1-su-pam_open_session.patch 4886
 MD5 c31db5c71b0cdfca75346abc2887aa02 files/shadow-4.0.5-nls-manpages.patch 362
 MD5 d8b8542a7bc013011a293732ca504a50 files/digest-shadow-4.0.5-r2 66
+MD5 bb55107c3a9354ef2d1977547fdb5a83 files/shadow-4.0.4.1-useradd-manpage-update.patch 958
 MD5 20fd2dc35b8671b91e120b90281b4cf3 files/shadow-4.0.5-hack-X-envvars.patch 521
 MD5 391991f50203bd8b7738474051befdee files/shadow-4.0.5-remove-else.patch 531
 MD5 636f233fa173a998195016c3808173d4 files/shadow-4.0.5-skey.patch 395
-MD5 b8efca60a25e256eebe54c3d0db0760f files/shadow-4.0.4.1-gcc34-xmalloc.patch 361
-MD5 020e030c2d09b206e88cf9051ced6244 files/shadow-4.0.4.1-nonis.patch 1504
-MD5 aaf16ddabef285df169e37254b13561c files/shadow-4.0.4.1-selinux.diff 4296
-MD5 201f1321262da41ccd1a0283216ae9a7 files/shadow-4.0.4.1-su-pam_open_session.patch 4886
-MD5 bb55107c3a9354ef2d1977547fdb5a83 files/shadow-4.0.4.1-useradd-manpage-update.patch 958
+MD5 fda41657b856ffaeec5a2734b312409b files/shadow-4.0.5-fix-mail-configure.patch 5452
+MD5 c5e9081ed43837797e2f1617b7ce1c24 files/shadow-4.0.5-fix-adding-of-pam_env-set-env-vars.patch 285
 MD5 6e0bc0211949c624da0ea08d994a7038 files/default/useradd 96
-MD5 51b0337bd261f6ed5e53af5dc196431a files/pam.d/system-auth 499
-MD5 a5311bbc9c1fc378a6b0bfb3ca1b2394 files/pam.d/login 431
 MD5 344d17a865edc40adebe07797853c839 files/pam.d/other 198
+MD5 942190363cb06bd4cf1b3acdcca6c513 files/pam.d/su 1296
+MD5 51b0337bd261f6ed5e53af5dc196431a files/pam.d/system-auth 499
 MD5 a1c7fb84c2dc309db86ba7b8d3dfae76 files/pam.d/passwd 214
 MD5 60d44a6f43aafcb9ca35858ab2534a49 files/pam.d/shadow 227
-MD5 0a8b62ed0426b607b92e275d63fa7cbf files/pam.d/su 1247
+MD5 a5311bbc9c1fc378a6b0bfb3ca1b2394 files/pam.d/login 431
 MD5 1baa646400c4a596290e9d4b9e1c09b2 files/pam.d/system-auth-1.1 491
diff --git a/sys-apps/shadow/files/digest-shadow-4.0.5-r3 b/sys-apps/shadow/files/digest-shadow-4.0.5-r3
new file mode 100644
index 000000000000..00b3a379adf1
--- /dev/null
+++ b/sys-apps/shadow/files/digest-shadow-4.0.5-r3
@@ -0,0 +1 @@
+MD5 cca17a4843a3b5b324a5398faf81c3b4 shadow-4.0.5.tar.bz2 1012361
diff --git a/sys-apps/shadow/files/pam.d/su b/sys-apps/shadow/files/pam.d/su
index 00cd3bdcca3a..c9458bf8695d 100644
--- a/sys-apps/shadow/files/pam.d/su
+++ b/sys-apps/shadow/files/pam.d/su
@@ -27,5 +27,6 @@ account    required	/lib/security/pam_stack.so service=system-auth
 password   required	/lib/security/pam_stack.so service=system-auth
 
 session    required	/lib/security/pam_stack.so service=system-auth
+session    required     /lib/security/pam_env.so
 session    optional	/lib/security/pam_xauth.so
 
diff --git a/sys-apps/shadow/files/shadow-4.0.5-fix-adding-of-pam_env-set-env-vars.patch b/sys-apps/shadow/files/shadow-4.0.5-fix-adding-of-pam_env-set-env-vars.patch
new file mode 100644
index 000000000000..c6ac906df360
--- /dev/null
+++ b/sys-apps/shadow/files/shadow-4.0.5-fix-adding-of-pam_env-set-env-vars.patch
@@ -0,0 +1,11 @@
+--- shadow-4.0.5/src/su.c	2004-11-07 20:51:54.992246016 +0200
++++ shadow-4.0.5.az/src/su.c	2004-11-07 20:47:56.972430528 +0200
+@@ -684,7 +684,7 @@
+ 	envcp = pam_getenvlist (pamh);
+ 	if (envcp) {
+ 		while (*envcp) {
+-			putenv (*envcp);
++			addenv (*envcp, NULL);
+ 			envcp++;
+ 		}
+ 	}
diff --git a/sys-apps/shadow/files/shadow-4.0.5-fix-mail-configure.patch b/sys-apps/shadow/files/shadow-4.0.5-fix-mail-configure.patch
new file mode 100644
index 000000000000..bdc8c818fd61
--- /dev/null
+++ b/sys-apps/shadow/files/shadow-4.0.5-fix-mail-configure.patch
@@ -0,0 +1,165 @@
+--- shadow-4.0.5/configure.in	2004-11-07 19:29:12.275693608 +0200
++++ shadow-4.0.5.az/configure.in	2004-11-07 19:28:29.246235080 +0200
+@@ -131,41 +131,48 @@
+ fi
+ 
+ AC_CACHE_CHECK([location of shared mail directory], shadow_cv_maildir,
+-[for maildir in /var/mail /var/spool/mail /usr/spool/mail /usr/mail none; do
+-	if test -d $maildir; then
++[for shadow_cv_maildir in /var/mail /var/spool/mail /usr/spool/mail /usr/mail none; do
++	if test -d $shadow_cv_maildir; then
+ 		break
+ 	fi
+ done])
+-AC_DEFINE_UNQUOTED(MAIL_SPOOL_DIR, "$shadow_cv_maildir")
++if test "$shadow_cv_maildir" != "none"; then
++	AC_DEFINE_UNQUOTED(MAIL_SPOOL_DIR, "$shadow_cv_maildir")
++fi
+ 
+ AC_CACHE_CHECK([location of user mail file], shadow_cv_mailfile,
+-[for mailfile in Mailbox mailbox Mail mail .mail none; do
++[for shadow_cv_mailfile in Mailbox mailbox Mail mail .mail none; do
+ 	if test -f $HOME/$shadow_cv_mailfile; then
+ 		break
+ 	fi
+ done])
+-AC_DEFINE_UNQUOTED(MAIL_SPOOL_FILE, "$shadow_cv_mailfile")
++if test "$shadow_cv_mailfile" != "none"; then
++	AC_DEFINE_UNQUOTED(MAIL_SPOOL_FILE, "$shadow_cv_mailfile")
++fi
+ 
+ AC_CACHE_CHECK([location of utmp], shadow_cv_utmpdir,
+-[for utmpdir in /var/run /var/adm /usr/adm /etc none; do
++[for shadow_cv_utmpdir in /var/run /var/adm /usr/adm /etc none; do
+ 	if test -f $shadow_cv_utmpdir/utmp; then
+ 		break
+ 	fi
+ done])
+ if test "$shadow_cv_utmpdir" = "none"; then
+ 	AC_MSG_WARN(utmp file not found)
++else
++	AC_DEFINE_UNQUOTED(_UTMP_FILE, "$shadow_cv_utmpdir/utmp")
+ fi
+-AC_DEFINE_UNQUOTED(_UTMP_FILE, "$shadow_cv_utmpdir/utmp")
+ 
+ AC_CACHE_CHECK([location of faillog/lastlog/wtmp], shadow_cv_logdir,
+ [for shadow_cv_logdir in /var/log /var/adm /usr/adm /etc; do
+-	if test -d $logdir; then
++	if test -d $shadow_cv_logdir; then
+ 		break
+ 	fi
+ done])
+-AC_DEFINE_UNQUOTED(_WTMP_FILE, "$shadow_cv_logdir/wtmp")
+-AC_DEFINE_UNQUOTED(LASTLOG_FILE, "$shadow_cv_logdir/lastlog")
+-AC_DEFINE_UNQUOTED(FAILLOG_FILE, "$shadow_cv_logdir/faillog")
++if test "$shadow_cv_logdir" != "none"; then
++	AC_DEFINE_UNQUOTED(_WTMP_FILE, "$shadow_cv_logdir/wtmp")
++	AC_DEFINE_UNQUOTED(LASTLOG_FILE, "$shadow_cv_logdir/lastlog")
++	AC_DEFINE_UNQUOTED(FAILLOG_FILE, "$shadow_cv_logdir/faillog")
++fi
+ 
+ AC_CACHE_CHECK([location of the passwd program], shadow_cv_passwd_dir,
+ [if test -f /usr/bin/passwd; then
+--- shadow-4.0.5/configure	2004-11-07 19:29:07.210463640 +0200
++++ shadow-4.0.5.az/configure	2004-11-07 19:28:29.253234016 +0200
+@@ -22286,25 +22284,27 @@
+ if test "${shadow_cv_maildir+set}" = set; then
+   echo $ECHO_N "(cached) $ECHO_C" >&6
+ else
+-  for maildir in /var/mail /var/spool/mail /usr/spool/mail /usr/mail none; do
+-	if test -d $maildir; then
++  for shadow_cv_maildir in /var/mail /var/spool/mail /usr/spool/mail /usr/mail none; do
++	if test -d $shadow_cv_maildir; then
+ 		break
+ 	fi
+ done
+ fi
+ echo "$as_me:$LINENO: result: $shadow_cv_maildir" >&5
+ echo "${ECHO_T}$shadow_cv_maildir" >&6
+-cat >>confdefs.h <<_ACEOF
++if test "$shadow_cv_maildir" != "none"; then
++	cat >>confdefs.h <<_ACEOF
+ #define MAIL_SPOOL_DIR "$shadow_cv_maildir"
+ _ACEOF
+ 
++fi
+ 
+ echo "$as_me:$LINENO: checking location of user mail file" >&5
+ echo $ECHO_N "checking location of user mail file... $ECHO_C" >&6
+ if test "${shadow_cv_mailfile+set}" = set; then
+   echo $ECHO_N "(cached) $ECHO_C" >&6
+ else
+-  for mailfile in Mailbox mailbox Mail mail .mail none; do
++  for shadow_cv_mailfile in Mailbox mailbox Mail mail .mail none; do
+ 	if test -f $HOME/$shadow_cv_mailfile; then
+ 		break
+ 	fi
+@@ -22312,17 +22312,19 @@
+ fi
+ echo "$as_me:$LINENO: result: $shadow_cv_mailfile" >&5
+ echo "${ECHO_T}$shadow_cv_mailfile" >&6
+-cat >>confdefs.h <<_ACEOF
++if test "$shadow_cv_mailfile" != "none"; then
++	cat >>confdefs.h <<_ACEOF
+ #define MAIL_SPOOL_FILE "$shadow_cv_mailfile"
+ _ACEOF
+ 
++fi
+ 
+ echo "$as_me:$LINENO: checking location of utmp" >&5
+ echo $ECHO_N "checking location of utmp... $ECHO_C" >&6
+ if test "${shadow_cv_utmpdir+set}" = set; then
+   echo $ECHO_N "(cached) $ECHO_C" >&6
+ else
+-  for utmpdir in /var/run /var/adm /usr/adm /etc none; do
++  for shadow_cv_utmpdir in /var/run /var/adm /usr/adm /etc none; do
+ 	if test -f $shadow_cv_utmpdir/utmp; then
+ 		break
+ 	fi
+@@ -22333,11 +22335,12 @@
+ if test "$shadow_cv_utmpdir" = "none"; then
+ 	{ echo "$as_me:$LINENO: WARNING: utmp file not found" >&5
+ echo "$as_me: WARNING: utmp file not found" >&2;}
+-fi
+-cat >>confdefs.h <<_ACEOF
++else
++	cat >>confdefs.h <<_ACEOF
+ #define _UTMP_FILE "$shadow_cv_utmpdir/utmp"
+ _ACEOF
+ 
++fi
+ 
+ echo "$as_me:$LINENO: checking location of faillog/lastlog/wtmp" >&5
+ echo $ECHO_N "checking location of faillog/lastlog/wtmp... $ECHO_C" >&6
+@@ -22345,25 +22348,27 @@
+   echo $ECHO_N "(cached) $ECHO_C" >&6
+ else
+   for shadow_cv_logdir in /var/log /var/adm /usr/adm /etc; do
+-	if test -d $logdir; then
++	if test -d $shadow_cv_logdir; then
+ 		break
+ 	fi
+ done
+ fi
+ echo "$as_me:$LINENO: result: $shadow_cv_logdir" >&5
+ echo "${ECHO_T}$shadow_cv_logdir" >&6
+-cat >>confdefs.h <<_ACEOF
++if test "$shadow_cv_logdir" != "none"; then
++	cat >>confdefs.h <<_ACEOF
+ #define _WTMP_FILE "$shadow_cv_logdir/wtmp"
+ _ACEOF
+ 
+-cat >>confdefs.h <<_ACEOF
++	cat >>confdefs.h <<_ACEOF
+ #define LASTLOG_FILE "$shadow_cv_logdir/lastlog"
+ _ACEOF
+ 
+-cat >>confdefs.h <<_ACEOF
++	cat >>confdefs.h <<_ACEOF
+ #define FAILLOG_FILE "$shadow_cv_logdir/faillog"
+ _ACEOF
+ 
++fi
+ 
+ echo "$as_me:$LINENO: checking location of the passwd program" >&5
+ echo $ECHO_N "checking location of the passwd program... $ECHO_C" >&6
diff --git a/sys-apps/shadow/shadow-4.0.5-r3.ebuild b/sys-apps/shadow/shadow-4.0.5-r3.ebuild
new file mode 100644
index 000000000000..76a9048a82cc
--- /dev/null
+++ b/sys-apps/shadow/shadow-4.0.5-r3.ebuild
@@ -0,0 +1,191 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/shadow/shadow-4.0.5-r3.ebuild,v 1.1 2004/11/07 19:56:30 azarah Exp $
+
+inherit eutils libtool gnuconfig flag-o-matic
+
+FORCE_SYSTEMAUTH_UPDATE="no"
+SELINUX_PATCH="shadow-4.0.4.1-selinux.diff"
+
+DESCRIPTION="Utilities to deal with user accounts"
+HOMEPAGE="http://shadow.pld.org.pl/"
+SRC_URI="ftp://ftp.pld.org.pl/software/shadow/${P}.tar.bz2"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+IUSE="pam selinux nls skey"
+
+RDEPEND=">=sys-libs/cracklib-2.7-r3
+	pam? ( >=sys-libs/pam-0.75-r4 )
+	!pam? ( !virtual/login )
+	skey? ( app-admin/skey )
+	selinux? ( sys-libs/libselinux )"
+DEPEND="${DEPEND}
+	>=sys-apps/portage-2.0.51-r2
+	nls? ( sys-devel/gettext )"
+#this requires a newer portage (>2.0.51-r2)
+#PROVIDE="!pam? ( virtual/login )"
+
+pkg_preinst() {
+	rm -f ${ROOT}/etc/pam.d/system-auth.new
+}
+
+src_unpack() {
+	unpack ${A}
+	cd ${S}
+
+	# uclibc support, corrects NIS usage
+	epatch ${FILESDIR}/shadow-4.0.4.1-nonis.patch
+
+	# If su should not simulate a login shell, use '/bin/sh' as shell to enable
+	# running of commands as user with /bin/false as shell, closing bug #15015.
+	# *** This one could be a security hole; disable for now ***
+	#epatch ${FILESDIR}/${P}-nologin-run-sh.patch
+
+	# don't install manpages if USE=-nls
+	epatch ${FILESDIR}/shadow-${PV}-nls-manpages.patch
+
+	# tweak the default login.defs
+	epatch ${FILESDIR}/shadow-${PV}-login.defs.patch
+
+	# fix small graphical typo in passwd.1 #68150
+	epatch ${FILESDIR}/shadow-4.0.4.1-passwd-typo.patch
+
+	# skeychallenge call needs updating #69741
+	epatch ${FILESDIR}/shadow-${PV}-skey.patch
+
+	# remove an extra else #69212
+	epatch ${FILESDIR}/shadow-${PV}-remove-else.patch
+
+	# The new configure changes do not detect maildir and mailfile
+	# properly.
+	epatch ${FILESDIR}/shadow-${PV}-fix-mail-configure.patch
+
+	# Use addenv and not putenv so that pam_env added variables will
+	# actually end up in the environment
+	epatch ${FILESDIR}/shadow-${PV}-fix-adding-of-pam_env-set-env-vars.patch
+
+	# Allows shadow configure detect newer systems properly
+	gnuconfig_update
+	elibtoolize
+}
+
+src_compile() {
+	append-ldflags -Wl,-z,now
+	econf \
+		--disable-desrpc \
+		--with-libcrypt \
+		--with-libcrack \
+		--enable-shared=no \
+		--enable-static=yes \
+		$(use_with pam libpam) \
+		$(use_with skey libskey) \
+		$(use_with selinux) \
+		$(use_enable nls) \
+		|| die "bad configure"
+	emake || die "compile problem"
+}
+
+src_install() {
+	make DESTDIR=${D} install || die "install problem"
+	dosym useradd /usr/sbin/adduser
+
+	# lock down setuid perms #47208
+	fperms go-r /bin/su /usr/bin/ch{fn,sh,age} \
+		/usr/bin/{expiry,newgrp,passwd,gpasswd} || die "fperms"
+
+	# Remove libshadow and libmisc; see bug 37725 and the following
+	# comment from shadow's README.linux:
+	#   Currently, libshadow.a is for internal use only, so if you see
+	#   -lshadow in a Makefile of some other package, it is safe to
+	#   remove it.
+	rm -f ${D}/lib/lib{misc,shadow}.{a,la}
+
+	# Do not install this login, but rather the one from
+	# pam-login, as this one have a serious root exploit
+	# with pam support enabled.
+	use pam && rm ${D}/bin/login
+
+	insinto /etc
+	# Using a securetty with devfs device names added
+	# (compat names kept for non-devfs compatibility)
+	insopts -m0600 ; doins ${FILESDIR}/securetty
+	insopts -m0600 ; doins etc/login.access
+	insopts -m0644 ; doins etc/limits
+
+	# needed for 'adduser -D'
+	insinto /etc/default
+	insopts -m0600
+	doins ${FILESDIR}/default/useradd
+
+	# move passwd to / to help recover broke systems #64441
+	mv ${D}/usr/bin/passwd ${D}/bin/
+	dosym /bin/passwd /usr/bin/passwd
+
+	if use pam ; then
+		insinto /etc/pam.d ; insopts -m0644
+		for x in ${FILESDIR}/pam.d/*; do
+			[ -f ${x} ] && doins ${x}
+		done
+		cd ${FILESDIR}/pam.d
+		# Make sure /etc/pam.d/system-auth is the new version ..
+		mv ${D}/etc/pam.d/system-auth-1.1 ${D}/etc/pam.d/system-auth
+		newins system-auth-1.1 system-auth.new || die
+		for x in chage chsh chfn chpasswd newusers \
+		         user{add,del,mod} group{add,del,mod} ; do
+			newins shadow ${x}
+		done
+
+		# remove manpages that pam will install for us
+		# and/or don't apply when using pam
+
+		find ${D}/usr/share/man \
+			'(' -name 'login.1' -o -name 'suauth.5' ')' \
+			-exec rm {} \;
+	else
+		insinto /etc
+		insopts -m0644
+		newins etc/login.defs.linux login.defs
+	fi
+
+	# Remove manpages that are handled by other packages
+	find ${D}/usr/share/man \
+		'(' -name id.1 -o -name passwd.5 -o -name getspnam.3 ')' \
+		-exec rm {} \;
+
+	cd ${S}/doc
+	dodoc INSTALL README WISHLIST
+	docinto txt
+	dodoc HOWTO LSM README.* *.txt
+
+	# ttyB0 is the PDC software console
+	if [ "${ARCH}" = "hppa" ]
+	then
+		echo "ttyB0" >> ${D}/etc/securetty
+	fi
+}
+
+pkg_postinst() {
+	use pam || return 0;
+	local CHECK1="$(md5sum ${ROOT}/etc/pam.d/system-auth | cut -d ' ' -f 1)"
+	local CHECK2="$(md5sum ${ROOT}/etc/pam.d/system-auth.new | cut -d ' ' -f 1)"
+
+	if [ "${CHECK1}" != "${CHECK2}" -a "${FORCE_SYSTEMAUTH_UPDATE}" = "yes" ]
+	then
+		ewarn "Due to a security issue, ${ROOT}etc/pam.d/system-auth "
+		ewarn "is being updated automatically. Your old "
+		ewarn "system-auth will be backed up as:"
+		ewarn
+		ewarn "  ${ROOT}etc/pam.d/system-auth.bak"
+		echo
+
+		cp -a ${ROOT}/etc/pam.d/system-auth \
+			${ROOT}/etc/pam.d/system-auth.bak;
+		mv -f ${ROOT}/etc/pam.d/system-auth.new \
+			${ROOT}/etc/pam.d/system-auth
+		rm -f ${ROOT}/etc/pam.d/._cfg????_system-auth
+	else
+		rm -f ${ROOT}/etc/pam.d/system-auth.new
+	fi
+}