Package init

2019-09-30 10:54:30 -04:00 · 2019-09-30 10:54:30 -04:00 · 633af1b98d
commit 633af1b98d
27 changed files with 2967 additions and 0 deletions
--- a/kadm5.acl
+++ b/kadm5.acl
@ -0,0 +1 @@
 */admin@EXAMPLE.COM	*
--- a/kadmin.service
+++ b/kadmin.service
@ -0,0 +1,15 @@
 [Unit]
 Description=Kerberos 5 Password-changing and Administration
 Wants=network-online.target
 After=syslog.target network.target network-online.target
 AssertPathExists=!/var/kerberos/krb5kdc/kpropd.acl
 [Service]
 Type=forking
 PIDFile=/var/run/kadmind.pid
 EnvironmentFile=-/etc/sysconfig/kadmin
 ExecStart=/usr/sbin/kadmind -P /var/run/kadmind.pid $KADMIND_ARGS
 ExecReload=/bin/kill -HUP $MAINPID
 [Install]
 WantedBy=multi-user.target
--- a/kadmin.sysconfig
+++ b/kadmin.sysconfig
@ -0,0 +1 @@
 KADMIND_ARGS=
--- a/kadmind.logrotate
+++ b/kadmind.logrotate
@ -0,0 +1,9 @@
 /var/log/kadmind.log {
    missingok
    notifempty
    monthly
    rotate 12
    postrotate
 	/bin/kill -HUP `cat /var/run/kadmind.pid 2>/dev/null` 2> /dev/null || true
    endscript
 }
--- a/kdc.conf
+++ b/kdc.conf
@ -0,0 +1,13 @@
 [kdcdefaults]
    kdc_ports = 88
    kdc_tcp_ports = 88
    spake_preauth_kdc_challenge = edwards25519
 [realms]
 EXAMPLE.COM = {
     #master_key_type = aes256-cts
     acl_file = /var/kerberos/krb5kdc/kadm5.acl
     dict_file = /usr/share/dict/words
     admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
     supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal
 }
--- a/kprop.service
+++ b/kprop.service
@ -0,0 +1,13 @@
 [Unit]
 Description=Kerberos 5 Propagation
 Wants=network-online.target
 After=syslog.target network.target network-online.target
 AssertPathExists=/var/kerberos/krb5kdc/kpropd.acl
 [Service]
 Type=forking
 EnvironmentFile=-/etc/sysconfig/kprop
 ExecStart=/usr/sbin/kpropd $KPROPD_ARGS
 [Install]
 WantedBy=multi-user.target
--- a/kprop.sysconfig
+++ b/kprop.sysconfig
@ -0,0 +1 @@
 KPROPD_ARGS=
--- a/krb5-1.11-kpasswdtest.patch
+++ b/krb5-1.11-kpasswdtest.patch
@ -0,0 +1,21 @@
 From fc2953ce9ce06ff896b1687e1c0cc9b8a4357d09 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:52:01 -0400
 Subject: [PATCH] krb5-1.11-kpasswdtest.patch
 ---
 src/kadmin/testing/proto/krb5.conf.proto | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/kadmin/testing/proto/krb5.conf.proto b/src/kadmin/testing/proto/krb5.conf.proto
 index 00c442978..9c4bc1de7 100644
 --- a/src/kadmin/testing/proto/krb5.conf.proto
 +++ b/src/kadmin/testing/proto/krb5.conf.proto
@@ -9,6 +9,7 @@
 	__REALM__ = {
 		kdc = __KDCHOST__:1750
 		admin_server = __KDCHOST__:1751
 +		kpasswd_server = __KDCHOST__:1752
 		database_module = foobar_db2_module_blah
 	}
--- a/krb5-1.11-run_user_0.patch
+++ b/krb5-1.11-run_user_0.patch
@ -0,0 +1,44 @@
 From b0adf9a65d5c22a77cf957ceb1c298baff01555d Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:49:57 -0400
 Subject: [PATCH] krb5-1.11-run_user_0.patch
 A hack: if we're looking at creating a ccache directory directly below
 the /run/user/0 directory, and /run/user/0 doesn't exist, try to create
 it, too.
 ---
 src/lib/krb5/ccache/cc_dir.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 diff --git a/src/lib/krb5/ccache/cc_dir.c b/src/lib/krb5/ccache/cc_dir.c
 index 73f0fe62d..4850c0d07 100644
 --- a/src/lib/krb5/ccache/cc_dir.c
 +++ b/src/lib/krb5/ccache/cc_dir.c
@@ -61,6 +61,8 @@
 #include <dirent.h>
 +#define ROOT_SPECIAL_DCC_PARENT "/run/user/0"
 +
 extern const krb5_cc_ops krb5_dcc_ops;
 extern const krb5_cc_ops krb5_fcc_ops;
@@ -237,6 +239,18 @@ verify_dir(krb5_context context, const char *dirname)
     if (stat(dirname, &st) < 0) {
         if (errno == ENOENT) {
 +            if (strncmp(dirname, ROOT_SPECIAL_DCC_PARENT "/",
 +                        sizeof(ROOT_SPECIAL_DCC_PARENT)) == 0 &&
 +                stat(ROOT_SPECIAL_DCC_PARENT, &st) < 0 &&
 +                errno == ENOENT) {
 +#ifdef USE_SELINUX
 +                selabel = krb5int_push_fscreatecon_for(ROOT_SPECIAL_DCC_PARENT);
 +#endif
 +                status = mkdir(ROOT_SPECIAL_DCC_PARENT, S_IRWXU);
 +#ifdef USE_SELINUX
 +                krb5int_pop_fscreatecon(selabel);
 +#endif
 +            }
 #ifdef USE_SELINUX
             selabel = krb5int_push_fscreatecon_for(dirname);
 #endif
--- a/krb5-1.12-api.patch
+++ b/krb5-1.12-api.patch
@ -0,0 +1,37 @@
 From abb19d2d2eac5f9f6e4a1bf26f59f3a62143dab9 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:47:00 -0400
 Subject: [PATCH] krb5-1.12-api.patch
 Reference docs don't define what happens if you call krb5_realm_compare() with
 malformed krb5_principal structures.  Define a behavior which keeps it from
 crashing if applications don't check ahead of time.
 ---
 src/lib/krb5/krb/princ_comp.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/src/lib/krb5/krb/princ_comp.c b/src/lib/krb5/krb/princ_comp.c
 index a6936107d..0ed78833b 100644
 --- a/src/lib/krb5/krb/princ_comp.c
 +++ b/src/lib/krb5/krb/princ_comp.c
@@ -36,6 +36,10 @@ realm_compare_flags(krb5_context context,
     const krb5_data *realm1 = &princ1->realm;
     const krb5_data *realm2 = &princ2->realm;
 +    if (princ1 == NULL || princ2 == NULL)
 +        return FALSE;
 +    if (realm1 == NULL || realm2 == NULL)
 +        return FALSE;
     if (realm1->length != realm2->length)
         return FALSE;
     if (realm1->length == 0)
@@ -88,6 +92,9 @@ krb5_principal_compare_flags(krb5_context context,
     krb5_principal upn2 = NULL;
     krb5_boolean ret = FALSE;
 +    if (princ1 == NULL || princ2 == NULL)
 +        return FALSE;
 +
     if (flags & KRB5_PRINCIPAL_COMPARE_ENTERPRISE) {
         /* Treat UPNs as if they were real principals */
         if (princ1->type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
--- a/krb5-1.12-ksu-path.patch
+++ b/krb5-1.12-ksu-path.patch
@ -0,0 +1,22 @@
 From 7f076496c7441cd108929aa05dbe009f34054bf5 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:32:09 -0400
 Subject: [PATCH] krb5-1.12-ksu-path.patch
 Set the default PATH to the one set by login.
 ---
 src/clients/ksu/Makefile.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
 index 5755bb58a..9d58f29b5 100644
 --- a/src/clients/ksu/Makefile.in
 +++ b/src/clients/ksu/Makefile.in
@@ -1,6 +1,6 @@
 mydir=clients$(S)ksu
 BUILDTOP=$(REL)..$(S)..
 -DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/bin /local/bin"'
 +DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/usr/local/sbin /usr/local/bin /sbin /bin /usr/sbin /usr/bin"'
 KSU_LIBS=@KSU_LIBS@
 PAM_LIBS=@PAM_LIBS@
--- a/krb5-1.12-ktany.patch
+++ b/krb5-1.12-ktany.patch
@ -0,0 +1,366 @@
 From 01acbf3cbd60bd460e6ec6702589451d19c89933 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:33:53 -0400
 Subject: [PATCH] krb5-1.12-ktany.patch
 Adds an "ANY" keytab type which is a list of other keytab locations to search
 when searching for a specific entry.  When iterated through, it only presents
 the contents of the first keytab.
 ---
 src/lib/krb5/keytab/Makefile.in |   3 +
 src/lib/krb5/keytab/kt_any.c    | 292 ++++++++++++++++++++++++++++++++
 src/lib/krb5/keytab/ktbase.c    |   7 +-
 3 files changed, 301 insertions(+), 1 deletion(-)
 create mode 100644 src/lib/krb5/keytab/kt_any.c
 diff --git a/src/lib/krb5/keytab/Makefile.in b/src/lib/krb5/keytab/Makefile.in
 index 2a8fceb00..ffd179fb2 100644
 --- a/src/lib/krb5/keytab/Makefile.in
 +++ b/src/lib/krb5/keytab/Makefile.in
@@ -12,6 +12,7 @@ STLIBOBJS= \
 	ktfr_entry.o	\
 	ktremove.o	\
 	ktfns.o		\
 +	kt_any.o	\
 	kt_file.o	\
 	kt_memory.o	\
 	kt_srvtab.o	\
@@ -24,6 +25,7 @@ OBJS=	\
 	$(OUTPRE)ktfr_entry.$(OBJEXT)	\
 	$(OUTPRE)ktremove.$(OBJEXT)	\
 	$(OUTPRE)ktfns.$(OBJEXT)	\
 +	$(OUTPRE)kt_any.$(OBJEXT)	\
 	$(OUTPRE)kt_file.$(OBJEXT)	\
 	$(OUTPRE)kt_memory.$(OBJEXT)	\
 	$(OUTPRE)kt_srvtab.$(OBJEXT)	\
@@ -36,6 +38,7 @@ SRCS=	\
 	$(srcdir)/ktfr_entry.c	\
 	$(srcdir)/ktremove.c	\
 	$(srcdir)/ktfns.c	\
 +	$(srcdir)/kt_any.c	\
 	$(srcdir)/kt_file.c	\
 	$(srcdir)/kt_memory.c	\
 	$(srcdir)/kt_srvtab.c	\
 diff --git a/src/lib/krb5/keytab/kt_any.c b/src/lib/krb5/keytab/kt_any.c
 new file mode 100644
 index 000000000..1b9b7765b
 --- /dev/null
 +++ b/src/lib/krb5/keytab/kt_any.c
@@ -0,0 +1,292 @@
 +/*
 + * lib/krb5/keytab/kt_any.c
 + *
 + * Copyright 1998, 1999 by the Massachusetts Institute of Technology.
 + * All Rights Reserved.
 + *
 + * Export of this software from the United States of America may
 + *   require a specific license from the United States Government.
 + *   It is the responsibility of any person or organization contemplating
 + *   export to obtain such a license before exporting.
 + * 
 + * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 + * distribute this software and its documentation for any purpose and
 + * without fee is hereby granted, provided that the above copyright
 + * notice appear in all copies and that both that copyright notice and
 + * this permission notice appear in supporting documentation, and that
 + * the name of M.I.T. not be used in advertising or publicity pertaining
 + * to distribution of the software without specific, written prior
 + * permission.  M.I.T. makes no representations about the suitability of
 + * this software for any purpose.  It is provided "as is" without express
 + * or implied warranty.
 + * 
 + *
 + * krb5_kta_ops
 + */
 +
 +#include "k5-int.h"
 +
 +typedef struct _krb5_ktany_data {
 +    char *name;
 +    krb5_keytab *choices;
 +    int nchoices;
 +} krb5_ktany_data;
 +
 +typedef struct _krb5_ktany_cursor_data {
 +    int which;
 +    krb5_kt_cursor cursor;
 +} krb5_ktany_cursor_data;
 +
 +static krb5_error_code krb5_ktany_resolve
 +	          (krb5_context,
 +		   const char *,
 +		   krb5_keytab *);
 +static krb5_error_code krb5_ktany_get_name
 +	          (krb5_context context,
 +		   krb5_keytab id,
 +		   char *name,
 +		   unsigned int len);
 +static krb5_error_code krb5_ktany_close
 +	          (krb5_context context,
 +		   krb5_keytab id);
 +static krb5_error_code krb5_ktany_get_entry
 +	          (krb5_context context,
 +		   krb5_keytab id,
 +		   krb5_const_principal principal,
 +		   krb5_kvno kvno,
 +		   krb5_enctype enctype,
 +		   krb5_keytab_entry *entry);
 +static krb5_error_code krb5_ktany_start_seq_get
 +	          (krb5_context context,
 +		   krb5_keytab id,
 +		   krb5_kt_cursor *cursorp);
 +static krb5_error_code krb5_ktany_next_entry
 +	          (krb5_context context,
 +		   krb5_keytab id,
 +		   krb5_keytab_entry *entry,
 +		   krb5_kt_cursor *cursor);
 +static krb5_error_code krb5_ktany_end_seq_get
 +	          (krb5_context context,
 +		   krb5_keytab id,
 +		   krb5_kt_cursor *cursor);
 +static void cleanup
 +	          (krb5_context context,
 +		   krb5_ktany_data *data,
 +		   int nchoices);
 +
 +struct _krb5_kt_ops krb5_kta_ops = {
 +    0,
 +    "ANY", 	/* Prefix -- this string should not appear anywhere else! */
 +    krb5_ktany_resolve,
 +    krb5_ktany_get_name,
 +    krb5_ktany_close,
 +    krb5_ktany_get_entry,
 +    krb5_ktany_start_seq_get,
 +    krb5_ktany_next_entry,
 +    krb5_ktany_end_seq_get,
 +    NULL,
 +    NULL,
 +    NULL,
 +};
 +
 +static krb5_error_code
 +krb5_ktany_resolve(context, name, id)
 +    krb5_context context;
 +    const char *name;
 +    krb5_keytab *id;
 +{
 +    const char *p, *q;
 +    char *copy;
 +    krb5_error_code kerror;
 +    krb5_ktany_data *data;
 +    int i;
 +
 +    /* Allocate space for our data and remember a copy of the name. */
 +    if ((data = (krb5_ktany_data *)malloc(sizeof(krb5_ktany_data))) == NULL)
 +	return(ENOMEM);
 +    if ((data->name = (char *)malloc(strlen(name) + 1)) == NULL) {
 +	free(data);
 +	return(ENOMEM);
 +    }
 +    strcpy(data->name, name);
 +
 +    /* Count the number of choices and allocate memory for them. */
 +    data->nchoices = 1;
 +    for (p = name; (q = strchr(p, ',')) != NULL; p = q + 1)
 +	data->nchoices++;
 +    if ((data->choices = (krb5_keytab *)
 +	 malloc(data->nchoices * sizeof(krb5_keytab))) == NULL) {
 +	free(data->name);
 +	free(data);
 +	return(ENOMEM);
 +    }
 +
 +    /* Resolve each of the choices. */
 +    i = 0;
 +    for (p = name; (q = strchr(p, ',')) != NULL; p = q + 1) {
 +	/* Make a copy of the choice name so we can terminate it. */
 +	if ((copy = (char *)malloc(q - p + 1)) == NULL) {
 +	    cleanup(context, data, i);
 +	    return(ENOMEM);
 +	}
 +	memcpy(copy, p, q - p);
 +	copy[q - p] = 0;
 +
 +	/* Try resolving the choice name. */
 +	kerror = krb5_kt_resolve(context, copy, &data->choices[i]);
 +	free(copy);
 +	if (kerror) {
 +	    cleanup(context, data, i);
 +	    return(kerror);
 +	}
 +	i++;
 +    }
 +    if ((kerror = krb5_kt_resolve(context, p, &data->choices[i]))) {
 +	cleanup(context, data, i);
 +	return(kerror);
 +    }
 +
 +    /* Allocate and fill in an ID for the caller. */
 +    if ((*id = (krb5_keytab)malloc(sizeof(**id))) == NULL) {
 +	cleanup(context, data, i);
 +	return(ENOMEM);
 +    }
 +    (*id)->ops = &krb5_kta_ops;
 +    (*id)->data = (krb5_pointer)data;
 +    (*id)->magic = KV5M_KEYTAB;
 +
 +    return(0);
 +}
 +
 +static krb5_error_code
 +krb5_ktany_get_name(context, id, name, len)
 +    krb5_context context;
 +    krb5_keytab id;
 +    char *name;
 +    unsigned int len;
 +{
 +    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
 +
 +    if (len < strlen(data->name) + 1)
 +	return(KRB5_KT_NAME_TOOLONG);
 +    strcpy(name, data->name);
 +    return(0);
 +}
 +
 +static krb5_error_code
 +krb5_ktany_close(context, id)
 +    krb5_context context;
 +    krb5_keytab id;
 +{
 +    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
 +
 +    cleanup(context, data, data->nchoices);
 +    id->ops = 0;
 +    free(id);
 +    return(0);
 +}
 +
 +static krb5_error_code
 +krb5_ktany_get_entry(context, id, principal, kvno, enctype, entry)
 +    krb5_context context;
 +    krb5_keytab id;
 +    krb5_const_principal principal;
 +    krb5_kvno kvno;
 +    krb5_enctype enctype;
 +    krb5_keytab_entry *entry;
 +{
 +    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
 +    krb5_error_code kerror = KRB5_KT_NOTFOUND;
 +    int i;
 +
 +    for (i = 0; i < data->nchoices; i++) {
 +	if ((kerror = krb5_kt_get_entry(context, data->choices[i], principal,
 +					kvno, enctype, entry)) != ENOENT)
 +	    return kerror;
 +    }
 +    return kerror;
 +}
 +
 +static krb5_error_code
 +krb5_ktany_start_seq_get(context, id, cursorp)
 +    krb5_context context;
 +    krb5_keytab id;
 +    krb5_kt_cursor *cursorp;
 +{
 +    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
 +    krb5_ktany_cursor_data *cdata;
 +    krb5_error_code kerror = ENOENT;
 +    int i;
 +
 +    if ((cdata = (krb5_ktany_cursor_data *)
 +	 malloc(sizeof(krb5_ktany_cursor_data))) == NULL)
 +	return(ENOMEM);
 +
 +    /* Find a choice which can handle the serialization request. */
 +    for (i = 0; i < data->nchoices; i++) {
 +	if ((kerror = krb5_kt_start_seq_get(context, data->choices[i],
 +					    &cdata->cursor)) == 0)
 +	    break;
 +	else if (kerror != ENOENT) {
 +	    free(cdata);
 +	    return(kerror);
 +	}
 +    }
 +
 +    if (i == data->nchoices) {
 +	/* Everyone returned ENOENT, so no go. */
 +	free(cdata);
 +	return(kerror);
 +    }
 +
 +    cdata->which = i;
 +    *cursorp = (krb5_kt_cursor)cdata;
 +    return(0);
 +}
 +
 +static krb5_error_code
 +krb5_ktany_next_entry(context, id, entry, cursor)
 +    krb5_context context;
 +    krb5_keytab id;
 +    krb5_keytab_entry *entry;
 +    krb5_kt_cursor *cursor;
 +{
 +    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
 +    krb5_ktany_cursor_data *cdata = (krb5_ktany_cursor_data *)*cursor;
 +    krb5_keytab choice_id;
 +
 +    choice_id = data->choices[cdata->which];
 +    return(krb5_kt_next_entry(context, choice_id, entry, &cdata->cursor));
 +}
 +
 +static krb5_error_code
 +krb5_ktany_end_seq_get(context, id, cursor)
 +    krb5_context context;
 +    krb5_keytab id;
 +    krb5_kt_cursor *cursor;
 +{
 +    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
 +    krb5_ktany_cursor_data *cdata = (krb5_ktany_cursor_data *)*cursor;
 +    krb5_keytab choice_id;
 +    krb5_error_code kerror;
 +
 +    choice_id = data->choices[cdata->which];
 +    kerror = krb5_kt_end_seq_get(context, choice_id, &cdata->cursor);
 +    free(cdata);
 +    return(kerror);
 +}
 +
 +static void
 +cleanup(context, data, nchoices)
 +    krb5_context context;
 +    krb5_ktany_data *data;
 +    int nchoices;
 +{
 +    int i;
 +
 +    free(data->name);
 +    for (i = 0; i < nchoices; i++)
 +	krb5_kt_close(context, data->choices[i]);
 +    free(data->choices);
 +    free(data);
 +}
 diff --git a/src/lib/krb5/keytab/ktbase.c b/src/lib/krb5/keytab/ktbase.c
 index 0d39b2940..6534d7c52 100644
 --- a/src/lib/krb5/keytab/ktbase.c
 +++ b/src/lib/krb5/keytab/ktbase.c
@@ -57,14 +57,19 @@ extern const krb5_kt_ops krb5_ktf_ops;
 extern const krb5_kt_ops krb5_ktf_writable_ops;
 extern const krb5_kt_ops krb5_kts_ops;
 extern const krb5_kt_ops krb5_mkt_ops;
 +extern const krb5_kt_ops krb5_kta_ops;
 struct krb5_kt_typelist {
     const krb5_kt_ops *ops;
     const struct krb5_kt_typelist *next;
 };
 +static struct krb5_kt_typelist krb5_kt_typelist_any = {
 +    &krb5_kta_ops,
 +    NULL
 +};
 const static struct krb5_kt_typelist krb5_kt_typelist_srvtab = {
     &krb5_kts_ops,
 -    NULL
 +    &krb5_kt_typelist_any
 };
 const static struct krb5_kt_typelist krb5_kt_typelist_memory = {
     &krb5_mkt_ops,
--- a/krb5-1.12.1-pam.patch
+++ b/krb5-1.12.1-pam.patch
@ -0,0 +1,776 @@
 From 4cbb4325a86d1d71fa45d254221ec460c41b434d Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:29:58 -0400
 Subject: [PATCH] krb5-1.12.1-pam.patch
 Modify ksu so that it performs account and session management on behalf
 of
 the target user account, mimicking the action of regular su.  The
 default
 service name is "ksu", because on Fedora at least the configuration used
 is determined by whether or not a login shell is being opened, and so
 this may need to vary, too.  At run-time, ksu's behavior can be reset to
 the earlier, non-PAM behavior by setting "use_pam" to false in the [ksu]
 section of /etc/krb5.conf.
 When enabled, ksu gains a dependency on libpam.
 Originally RT#5939, though it's changed since then to perform the
 account
 and session management before dropping privileges, and to apply on top
 of
 changes we're proposing for how it handles cache collections.
 ---
 src/aclocal.m4              |  67 +++++++
 src/clients/ksu/Makefile.in |   8 +-
 src/clients/ksu/main.c      |  87 +++++++-
 src/clients/ksu/pam.c       | 389 ++++++++++++++++++++++++++++++++++++
 src/clients/ksu/pam.h       |  57 ++++++
 src/configure.in            |   2 +
 6 files changed, 607 insertions(+), 3 deletions(-)
 create mode 100644 src/clients/ksu/pam.c
 create mode 100644 src/clients/ksu/pam.h
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
 index 3752d9b..340546d 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
@@ -1697,3 +1697,70 @@ AC_DEFUN(KRB5_AC_PERSISTENT_KEYRING,[
       ]))
 ])dnl
 dnl
 +dnl
 +dnl Use PAM instead of local crypt() compare for checking local passwords,
 +dnl and perform PAM account, session management, and password-changing where
 +dnl appropriate.
 +dnl 
 +AC_DEFUN(KRB5_WITH_PAM,[
 +AC_ARG_WITH(pam,[AC_HELP_STRING(--with-pam,[compile with PAM support])],
 +	    withpam="$withval",withpam=auto)
 +AC_ARG_WITH(pam-ksu-service,[AC_HELP_STRING(--with-ksu-service,[PAM service name for ksu ["ksu"]])],
 +	    withksupamservice="$withval",withksupamservice=ksu)
 +old_LIBS="$LIBS"
 +if test "$withpam" != no ; then
 +	AC_MSG_RESULT([checking for PAM...])
 +	PAM_LIBS=
 +
 +	AC_CHECK_HEADERS(security/pam_appl.h)
 +	if test "x$ac_cv_header_security_pam_appl_h" != xyes ; then
 +		if test "$withpam" = auto ; then
 +			AC_MSG_RESULT([Unable to locate security/pam_appl.h.])
 +			withpam=no
 +		else
 +			AC_MSG_ERROR([Unable to locate security/pam_appl.h.])
 +		fi
 +	fi
 +
 +	LIBS=
 +	unset ac_cv_func_pam_start
 +	AC_CHECK_FUNCS(putenv pam_start)
 +	if test "x$ac_cv_func_pam_start" = xno ; then
 +		unset ac_cv_func_pam_start
 +		AC_CHECK_LIB(dl,dlopen)
 +		AC_CHECK_FUNCS(pam_start)
 +		if test "x$ac_cv_func_pam_start" = xno ; then
 +			AC_CHECK_LIB(pam,pam_start)
 +			unset ac_cv_func_pam_start
 +			unset ac_cv_func_pam_getenvlist
 +			AC_CHECK_FUNCS(pam_start pam_getenvlist)
 +			if test "x$ac_cv_func_pam_start" = xyes ; then
 +				PAM_LIBS="$LIBS"
 +			else
 +				if test "$withpam" = auto ; then
 +					AC_MSG_RESULT([Unable to locate libpam.])
 +					withpam=no
 +				else
 +					AC_MSG_ERROR([Unable to locate libpam.])
 +				fi
 +			fi
 +		fi
 +	fi
 +	if test "$withpam" != no ; then
 +		AC_MSG_NOTICE([building with PAM support])
 +		AC_DEFINE(USE_PAM,1,[Define if Kerberos-aware tools should support PAM])
 +		AC_DEFINE_UNQUOTED(KSU_PAM_SERVICE,"$withksupamservice",
 +				   [Define to the name of the PAM service name to be used by ksu.])
 +		PAM_LIBS="$LIBS"
 +		NON_PAM_MAN=".\\\" "
 +		PAM_MAN=
 +	else
 +		PAM_MAN=".\\\" "
 +		NON_PAM_MAN=
 +	fi
 +fi
 +LIBS="$old_LIBS"
 +AC_SUBST(PAM_LIBS)
 +AC_SUBST(PAM_MAN)
 +AC_SUBST(NON_PAM_MAN)
 +])dnl
 diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
 index b2fcbf2..5755bb5 100644
 --- a/src/clients/ksu/Makefile.in
 +++ b/src/clients/ksu/Makefile.in
@@ -3,12 +3,14 @@ BUILDTOP=$(REL)..$(S)..
 DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/bin /local/bin"'
 KSU_LIBS=@KSU_LIBS@
 +PAM_LIBS=@PAM_LIBS@
 SRCS = \
 	$(srcdir)/krb_auth_su.c \
 	$(srcdir)/ccache.c \
 	$(srcdir)/authorization.c \
 	$(srcdir)/main.c \
 +	$(srcdir)/pam.c \
 	$(srcdir)/heuristic.c \
 	$(srcdir)/xmalloc.c \
 	$(srcdir)/setenv.c
@@ -17,13 +19,17 @@ OBJS = \
 	ccache.o \
 	authorization.o \
 	main.o \
 +	pam.o \
 	heuristic.o \
 	xmalloc.o @SETENVOBJ@
 all: ksu
 ksu: $(OBJS) $(KRB5_BASE_DEPLIBS)
 -	$(CC_LINK) -o $@ $(OBJS) $(KRB5_BASE_LIBS) $(KSU_LIBS)
 +	$(CC_LINK) -o $@ $(OBJS) $(KRB5_BASE_LIBS) $(KSU_LIBS) $(PAM_LIBS)
 +
 +pam.o: pam.c
 +	$(CC) $(ALL_CFLAGS) -c $<
 clean:
 	$(RM) ksu
 diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
 index d9596d9..016ec24 100644
 --- a/src/clients/ksu/main.c
 +++ b/src/clients/ksu/main.c
@@ -26,6 +26,7 @@
  * KSU was writen by:  Ari Medvinsky, ari@isi.edu
  */
 +#include "autoconf.h"
 #include "ksu.h"
 #include "adm_proto.h"
 #include <sys/types.h>
@@ -33,6 +34,10 @@
 #include <signal.h>
 #include <grp.h>
 +#ifdef USE_PAM
 +#include "pam.h"
 +#endif
 +
 /* globals */
 char * prog_name;
 int auth_debug =0;
@@ -40,6 +45,7 @@ char k5login_path[MAXPATHLEN];
 char k5users_path[MAXPATHLEN];
 char * gb_err = NULL;
 int quiet = 0;
 +int force_fork = 0;
 /***********/
 #define KS_TEMPORARY_CACHE "MEMORY:_ksu"
@@ -528,6 +534,23 @@ main (argc, argv)
                prog_name,target_user,client_name,
                source_user,ontty());
 +#ifdef USE_PAM
 +        if (appl_pam_enabled(ksu_context, "ksu")) {
 +            if (appl_pam_acct_mgmt(KSU_PAM_SERVICE, 1, target_user, NULL,
 +                                   NULL, source_user,
 +                                   ttyname(STDERR_FILENO)) != 0) {
 +                fprintf(stderr, "Access denied for %s.\n", target_user);
 +                exit(1);
 +            }
 +            if (appl_pam_requires_chauthtok()) {
 +                fprintf(stderr, "Password change required for %s.\n",
 +                        target_user);
 +                exit(1);
 +            }
 +            force_fork++;
 +        }
 +#endif
 +
         /* Run authorization as target.*/
         if (krb5_seteuid(target_uid)) {
             com_err(prog_name, errno, _("while switching to target for "
@@ -588,6 +611,24 @@ main (argc, argv)
             exit(1);
         }
 +#ifdef USE_PAM
 +    } else {
 +        /* we always do PAM account management, even for root */
 +        if (appl_pam_enabled(ksu_context, "ksu")) {
 +            if (appl_pam_acct_mgmt(KSU_PAM_SERVICE, 1, target_user, NULL,
 +                                   NULL, source_user,
 +                                   ttyname(STDERR_FILENO)) != 0) {
 +                fprintf(stderr, "Access denied for %s.\n", target_user);
 +                exit(1);
 +            }
 +            if (appl_pam_requires_chauthtok()) {
 +                fprintf(stderr, "Password change required for %s.\n",
 +                        target_user);
 +                exit(1);
 +            }
 +            force_fork++;
 +        }
 +#endif
     }
     if( some_rest_copy){
@@ -644,6 +685,29 @@ main (argc, argv)
         fprintf(stderr, _("ksu: couldn't set environment variable SHELL\n"));
         exit(1);
     }
 +#ifdef USE_PAM
 +    if (appl_pam_enabled(ksu_context, "ksu")) {
 +        if (appl_pam_session_open() != 0) {
 +            fprintf(stderr, "Error opening session for %s.\n", target_user);
 +            exit(1);
 +        }
 +#ifdef DEBUG
 +        if (auth_debug){
 +            printf(" Opened PAM session.\n");
 +        }
 +#endif
 +        if (appl_pam_cred_init()) {
 +            fprintf(stderr, "Error initializing credentials for %s.\n",
 +                    target_user);
 +            exit(1);
 +        }
 +#ifdef DEBUG
 +        if (auth_debug){
 +            printf(" Initialized PAM credentials.\n");
 +        }
 +#endif
 +    }
 +#endif
     /* set permissions */
     if (setgid(target_pwd->pw_gid) < 0) {
@@ -742,7 +806,7 @@ main (argc, argv)
         fprintf(stderr, "program to be execed %s\n",params[0]);
     }
 -    if( keep_target_cache ) {
 +    if( keep_target_cache && !force_fork ) {
         execv(params[0], params);
         com_err(prog_name, errno, _("while trying to execv %s"), params[0]);
         sweep_up(ksu_context, cc_target);
@@ -772,16 +836,35 @@ main (argc, argv)
             if (ret_pid == -1) {
                 com_err(prog_name, errno, _("while calling waitpid"));
             }
 -            sweep_up(ksu_context, cc_target);
 +            if( !keep_target_cache ) {
 +                sweep_up(ksu_context, cc_target);
 +            }
             exit (statusp);
         case -1:
             com_err(prog_name, errno, _("while trying to fork."));
             sweep_up(ksu_context, cc_target);
             exit (1);
         case 0:
 +#ifdef USE_PAM
 +            if (appl_pam_enabled(ksu_context, "ksu")) {
 +                if (appl_pam_setenv() != 0) {
 +                    fprintf(stderr, "Error setting up environment for %s.\n",
 +                            target_user);
 +                    exit (1);
 +                }
 +#ifdef DEBUG
 +                if (auth_debug){
 +                    printf(" Set up PAM environment.\n");
 +                }
 +#endif
 +            }
 +#endif
             execv(params[0], params);
             com_err(prog_name, errno, _("while trying to execv %s"),
                     params[0]);
 +            if( keep_target_cache ) {
 +                sweep_up(ksu_context, cc_target);
 +            }
             exit (1);
         }
     }
 diff --git a/src/clients/ksu/pam.c b/src/clients/ksu/pam.c
 new file mode 100644
 index 0000000..cbfe487
 --- /dev/null
 +++ b/src/clients/ksu/pam.c
@@ -0,0 +1,389 @@
 +/*
 + * src/clients/ksu/pam.c
 + *
 + * Copyright 2007,2009,2010 Red Hat, Inc.
 + *
 + * All Rights Reserved.
 + *
 + * Redistribution and use in source and binary forms, with or without
 + * modification, are permitted provided that the following conditions are met:
 + *
 + *  Redistributions of source code must retain the above copyright notice, this
 + *  list of conditions and the following disclaimer.
 + *
 + *  Redistributions in binary form must reproduce the above copyright notice,
 + *  this list of conditions and the following disclaimer in the documentation
 + *  and/or other materials provided with the distribution.
 + *
 + *  Neither the name of Red Hat, Inc. nor the names of its contributors may be
 + *  used to endorse or promote products derived from this software without
 + *  specific prior written permission.
 + *
 + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 + * POSSIBILITY OF SUCH DAMAGE.
 + * 
 + * Convenience wrappers for using PAM.
 + */
 +
 +#include "autoconf.h"
 +#ifdef USE_PAM
 +#include <sys/types.h>
 +#include <stdio.h>
 +#include <stdlib.h>
 +#include <string.h>
 +#include <unistd.h>
 +#include "k5-int.h"
 +#include "pam.h"
 +
 +#ifndef MAXPWSIZE
 +#define MAXPWSIZE 128
 +#endif
 +
 +static int appl_pam_started;
 +static pid_t appl_pam_starter = -1;
 +static int appl_pam_session_opened;
 +static int appl_pam_creds_initialized;
 +static int appl_pam_pwchange_required;
 +static pam_handle_t *appl_pamh;
 +static struct pam_conv appl_pam_conv;
 +static char *appl_pam_user;
 +struct appl_pam_non_interactive_args {
 +	const char *user;
 +	const char *password;
 +};
 +
 +int
 +appl_pam_enabled(krb5_context context, const char *section)
 +{
 +	int enabled = 1;
 +	if ((context != NULL) && (context->profile != NULL)) {
 +		if (profile_get_boolean(context->profile,
 +					section,
 +					USE_PAM_CONFIGURATION_KEYWORD,
 +					NULL,
 +					enabled, &enabled) != 0) {
 +			enabled = 1;
 +		}
 +	}
 +	return enabled;
 +}
 +
 +void
 +appl_pam_cleanup(void)
 +{
 +	if (getpid() != appl_pam_starter) {
 +		return;
 +	}
 +#ifdef DEBUG
 +	printf("Called to clean up PAM.\n");
 +#endif
 +	if (appl_pam_creds_initialized) {
 +#ifdef DEBUG
 +		printf("Deleting PAM credentials.\n");
 +#endif
 +		pam_setcred(appl_pamh, PAM_DELETE_CRED);
 +		appl_pam_creds_initialized = 0;
 +	}
 +	if (appl_pam_session_opened) {
 +#ifdef DEBUG
 +		printf("Closing PAM session.\n");
 +#endif
 +		pam_close_session(appl_pamh, 0);
 +		appl_pam_session_opened = 0;
 +	}
 +	appl_pam_pwchange_required = 0;
 +	if (appl_pam_started) {
 +#ifdef DEBUG
 +		printf("Shutting down PAM.\n");
 +#endif
 +		pam_end(appl_pamh, 0);
 +		appl_pam_started = 0;
 +		appl_pam_starter = -1;
 +		free(appl_pam_user);
 +		appl_pam_user = NULL;
 +	}
 +}
 +static int
 +appl_pam_interactive_converse(int num_msg, const struct pam_message **msg,
 +			      struct pam_response **presp, void *appdata_ptr)
 +{
 +	const struct pam_message *message;
 +	struct pam_response *resp;
 +	int i, code;
 +	char *pwstring, pwbuf[MAXPWSIZE];
 +	unsigned int pwsize;
 +	resp = malloc(sizeof(struct pam_response) * num_msg);
 +	if (resp == NULL) {
 +		return PAM_BUF_ERR;
 +	}
 +	memset(resp, 0, sizeof(struct pam_response) * num_msg);
 +	code = PAM_SUCCESS;
 +	for (i = 0; i < num_msg; i++) {
 +		message = &(msg[0][i]); /* XXX */
 +		message = msg[i]; /* XXX */
 +		pwstring = NULL;
 +		switch (message->msg_style) {
 +		case PAM_TEXT_INFO:
 +		case PAM_ERROR_MSG:
 +			printf("[%s]\n", message->msg ? message->msg : "");
 +			fflush(stdout);
 +			resp[i].resp = NULL;
 +			resp[i].resp_retcode = PAM_SUCCESS;
 +			break;
 +		case PAM_PROMPT_ECHO_ON:
 +		case PAM_PROMPT_ECHO_OFF:
 +			if (message->msg_style == PAM_PROMPT_ECHO_ON) {
 +				if (fgets(pwbuf, sizeof(pwbuf),
 +					  stdin) != NULL) {
 +					pwbuf[strcspn(pwbuf, "\r\n")] = '\0';
 +					pwstring = pwbuf;
 +				}
 +			} else {
 +				pwstring = getpass(message->msg ?
 +						   message->msg :
 +						   "");
 +			}
 +			if ((pwstring != NULL) && (pwstring[0] != '\0')) {
 +				pwsize = strlen(pwstring);
 +				resp[i].resp = malloc(pwsize + 1);
 +				if (resp[i].resp == NULL) {
 +					resp[i].resp_retcode = PAM_BUF_ERR;
 +				} else {
 +					memcpy(resp[i].resp, pwstring, pwsize);
 +					resp[i].resp[pwsize] = '\0';
 +					resp[i].resp_retcode = PAM_SUCCESS;
 +				}
 +			} else {
 +				resp[i].resp_retcode = PAM_CONV_ERR;
 +				code = PAM_CONV_ERR;
 +			}
 +			break;
 +		default:
 +			break;
 +		}
 +	}
 +	*presp = resp;
 +	return code;
 +}
 +static int
 +appl_pam_non_interactive_converse(int num_msg,
 +				  const struct pam_message **msg,
 +				  struct pam_response **presp,
 +				  void *appdata_ptr)
 +{
 +	const struct pam_message *message;
 +	struct pam_response *resp;
 +	int i, code;
 +	unsigned int pwsize;
 +	struct appl_pam_non_interactive_args *args;
 +	const char *pwstring;
 +	resp = malloc(sizeof(struct pam_response) * num_msg);
 +	if (resp == NULL) {
 +		return PAM_BUF_ERR;
 +	}
 +	args = appdata_ptr;
 +	memset(resp, 0, sizeof(struct pam_response) * num_msg);
 +	code = PAM_SUCCESS;
 +	for (i = 0; i < num_msg; i++) {
 +		message = &((*msg)[i]);
 +		message = msg[i];
 +		pwstring = NULL;
 +		switch (message->msg_style) {
 +		case PAM_TEXT_INFO:
 +		case PAM_ERROR_MSG:
 +			break;
 +		case PAM_PROMPT_ECHO_ON:
 +		case PAM_PROMPT_ECHO_OFF:
 +			if (message->msg_style == PAM_PROMPT_ECHO_ON) {
 +				/* assume "user" */
 +				pwstring = args->user;
 +			} else {
 +				/* assume "password" */
 +				pwstring = args->password;
 +			}
 +			if ((pwstring != NULL) && (pwstring[0] != '\0')) {
 +				pwsize = strlen(pwstring);
 +				resp[i].resp = malloc(pwsize + 1);
 +				if (resp[i].resp == NULL) {
 +					resp[i].resp_retcode = PAM_BUF_ERR;
 +				} else {
 +					memcpy(resp[i].resp, pwstring, pwsize);
 +					resp[i].resp[pwsize] = '\0';
 +					resp[i].resp_retcode = PAM_SUCCESS;
 +				}
 +			} else {
 +				resp[i].resp_retcode = PAM_CONV_ERR;
 +				code = PAM_CONV_ERR;
 +			}
 +			break;
 +		default:
 +			break;
 +		}
 +	}
 +	*presp = resp;
 +	return code;
 +}
 +static int
 +appl_pam_start(const char *service, int interactive,
 +	       const char *login_username,
 +	       const char *non_interactive_password,
 +	       const char *hostname,
 +	       const char *ruser,
 +	       const char *tty)
 +{
 +	static int exit_handler_registered;
 +	static struct appl_pam_non_interactive_args args;
 +	int ret = 0;
 +	if (appl_pam_started &&
 +	    (strcmp(login_username, appl_pam_user) != 0)) {
 +		appl_pam_cleanup();
 +		appl_pam_user = NULL;
 +	}
 +	if (!appl_pam_started) {
 +#ifdef DEBUG
 +		printf("Starting PAM up (service=\"%s\",user=\"%s\").\n",
 +		       service, login_username);
 +#endif
 +		memset(&appl_pam_conv, 0, sizeof(appl_pam_conv));
 +		appl_pam_conv.conv = interactive ?
 +				     &appl_pam_interactive_converse :
 +				     &appl_pam_non_interactive_converse;
 +		memset(&args, 0, sizeof(args));
 +		args.user = strdup(login_username);
 +		args.password = non_interactive_password ?
 +				strdup(non_interactive_password) :
 +				NULL;
 +		appl_pam_conv.appdata_ptr = &args;
 +		ret = pam_start(service, login_username,
 +				&appl_pam_conv, &appl_pamh);
 +		if (ret == 0) {
 +			if (hostname != NULL) {
 +#ifdef DEBUG
 +				printf("Setting PAM_RHOST to \"%s\".\n", hostname);
 +#endif
 +				pam_set_item(appl_pamh, PAM_RHOST, hostname);
 +			}
 +			if (ruser != NULL) {
 +#ifdef DEBUG
 +				printf("Setting PAM_RUSER to \"%s\".\n", ruser);
 +#endif
 +				pam_set_item(appl_pamh, PAM_RUSER, ruser);
 +			}
 +			if (tty != NULL) {
 +#ifdef DEBUG
 +				printf("Setting PAM_TTY to \"%s\".\n", tty);
 +#endif
 +				pam_set_item(appl_pamh, PAM_TTY, tty);
 +			}
 +			if (!exit_handler_registered &&
 +			    (atexit(appl_pam_cleanup) != 0)) {
 +				pam_end(appl_pamh, 0);
 +				appl_pamh = NULL;
 +				ret = -1;
 +			} else {
 +				appl_pam_started = 1;
 +				appl_pam_starter = getpid();
 +				appl_pam_user = strdup(login_username);
 +				exit_handler_registered = 1;
 +			}
 +		}
 +	}
 +	return ret;
 +}
 +int
 +appl_pam_acct_mgmt(const char *service, int interactive,
 +		   const char *login_username,
 +		   const char *non_interactive_password,
 +		   const char *hostname,
 +		   const char *ruser,
 +		   const char *tty)
 +{
 +	int ret;
 +	appl_pam_pwchange_required = 0;
 +	ret = appl_pam_start(service, interactive, login_username,
 +			     non_interactive_password, hostname, ruser, tty);
 +	if (ret == 0) {
 +#ifdef DEBUG
 +		printf("Calling pam_acct_mgmt().\n");
 +#endif
 +		ret = pam_acct_mgmt(appl_pamh, 0);
 +		switch (ret) {
 +		case PAM_IGNORE:
 +			ret = 0;
 +			break;
 +		case PAM_NEW_AUTHTOK_REQD:
 +			appl_pam_pwchange_required = 1;
 +			ret = 0;
 +			break;
 +		default:
 +			break;
 +		}
 +	}
 +	return ret;
 +}
 +int
 +appl_pam_requires_chauthtok(void)
 +{
 +	return appl_pam_pwchange_required;
 +}
 +int
 +appl_pam_session_open(void)
 +{
 +	int ret = 0;
 +	if (appl_pam_started) {
 +#ifdef DEBUG
 +		printf("Opening PAM session.\n");
 +#endif
 +		ret = pam_open_session(appl_pamh, 0);
 +		if (ret == 0) {
 +			appl_pam_session_opened = 1;
 +		}
 +	}
 +	return ret;
 +}
 +int
 +appl_pam_setenv(void)
 +{
 +	int ret = 0;
 +#ifdef HAVE_PAM_GETENVLIST
 +#ifdef HAVE_PUTENV
 +	int i;
 +	char **list;
 +	if (appl_pam_started) {
 +		list = pam_getenvlist(appl_pamh);
 +		for (i = 0; ((list != NULL) && (list[i] != NULL)); i++) {
 +#ifdef DEBUG
 +			printf("Setting \"%s\" in environment.\n", list[i]);
 +#endif
 +			putenv(list[i]);
 +		}
 +	}
 +#endif
 +#endif
 +	return ret;
 +}
 +int
 +appl_pam_cred_init(void)
 +{
 +	int ret = 0;
 +	if (appl_pam_started) {
 +#ifdef DEBUG
 +		printf("Initializing PAM credentials.\n");
 +#endif
 +		ret = pam_setcred(appl_pamh, PAM_ESTABLISH_CRED);
 +		if (ret == 0) {
 +			appl_pam_creds_initialized = 1;
 +		}
 +	}
 +	return ret;
 +}
 +#endif
 diff --git a/src/clients/ksu/pam.h b/src/clients/ksu/pam.h
 new file mode 100644
 index 0000000..0ab7656
 --- /dev/null
 +++ b/src/clients/ksu/pam.h
@@ -0,0 +1,57 @@
 +/*
 + * src/clients/ksu/pam.h
 + *
 + * Copyright 2007,2009,2010 Red Hat, Inc.
 + *
 + * All Rights Reserved.
 + *
 + * Redistribution and use in source and binary forms, with or without
 + * modification, are permitted provided that the following conditions are met:
 + *
 + *  Redistributions of source code must retain the above copyright notice, this
 + *  list of conditions and the following disclaimer.
 + *
 + *  Redistributions in binary form must reproduce the above copyright notice,
 + *  this list of conditions and the following disclaimer in the documentation
 + *  and/or other materials provided with the distribution.
 + *
 + *  Neither the name of Red Hat, Inc. nor the names of its contributors may be
 + *  used to endorse or promote products derived from this software without
 + *  specific prior written permission.
 + *
 + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 + * POSSIBILITY OF SUCH DAMAGE.
 + * 
 + * Convenience wrappers for using PAM.
 + */
 +
 +#include <krb5.h>
 +#ifdef HAVE_SECURITY_PAM_APPL_H
 +#include <security/pam_appl.h>
 +#endif
 +
 +#define USE_PAM_CONFIGURATION_KEYWORD "use_pam"
 +
 +#ifdef USE_PAM
 +int appl_pam_enabled(krb5_context context, const char *section);
 +int appl_pam_acct_mgmt(const char *service, int interactive,
 +		       const char *local_username,
 +		       const char *non_interactive_password,
 +		       const char *hostname,
 +		       const char *ruser,
 +		       const char *tty);
 +int appl_pam_requires_chauthtok(void);
 +int appl_pam_session_open(void);
 +int appl_pam_setenv(void);
 +int appl_pam_cred_init(void);
 +void appl_pam_cleanup(void);
 +#endif
 diff --git a/src/configure.in b/src/configure.in
 index 61ef738..e9a12ac 100644
 --- a/src/configure.in
 +++ b/src/configure.in
@@ -1352,6 +1352,8 @@ AC_SUBST([VERTO_VERSION])
 AC_PATH_PROG(GROFF, groff)
 +KRB5_WITH_PAM
 +
 # Make localedir work in autoconf 2.5x.
 if test "${localedir+set}" != set; then
     localedir='$(datadir)/locale'
 -- 
 2.19.1
--- a/krb5-1.13-dirsrv-accountlock.patch
+++ b/krb5-1.13-dirsrv-accountlock.patch
@ -0,0 +1,75 @@
 From bd9a3cc0c53f6dc47a124eb6e8f698c7f1d3cd36 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:47:44 -0400
 Subject: [PATCH] krb5-1.13-dirsrv-accountlock.patch
 Treat 'nsAccountLock: true' the same as 'loginDisabled: true'.  Updated from
 original version filed as RT#5891.
 ---
 src/aclocal.m4                                  |  9 +++++++++
 src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c    | 17 +++++++++++++++++
 .../kdb/ldap/libkdb_ldap/ldap_principal.c       |  3 +++
 3 files changed, 29 insertions(+)
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
 index 5eeaa2d8a..1fd243094 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
@@ -1677,6 +1677,15 @@ if test "$with_ldap" = yes; then
   AC_MSG_NOTICE(enabling OpenLDAP database backend module support)
   OPENLDAP_PLUGIN=yes
 fi
 +AC_ARG_WITH([dirsrv-account-locking],
 +[  --with-dirsrv-account-locking       compile 389/Red Hat/Fedora/Netscape Directory Server database backend module],
 +[case "$withval" in
 +    yes | no) ;;
 +    *)  AC_MSG_ERROR(Invalid option value --with-dirsrv-account-locking="$withval") ;;
 +esac], with_dirsrv_account_locking=no)
 +if test $with_dirsrv_account_locking = yes; then
 +    AC_DEFINE(HAVE_DIRSRV_ACCOUNT_LOCKING,1,[Define if LDAP KDB interface should heed 389 DS's nsAccountLock attribute.])
 +fi
 ])dnl
 dnl
 dnl If libkeyutils exists (on Linux) include it and use keyring ccache
 diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
 index 5b9d1e9fa..4e7270065 100644
 --- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
 +++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
@@ -1652,6 +1652,23 @@ populate_krb5_db_entry(krb5_context context, krb5_ldap_context *ldap_context,
     ret = krb5_dbe_update_tl_data(context, entry, &userinfo_tl_data);
     if (ret)
         goto cleanup;
 +#ifdef HAVE_DIRSRV_ACCOUNT_LOCKING
 +    {
 +        krb5_timestamp              expiretime=0;
 +        char                        *is_login_disabled=NULL;
 +
 +        /* LOGIN DISABLED */
 +        ret = krb5_ldap_get_string(ld, ent, "nsAccountLock", &is_login_disabled,
 +                                   &attr_present);
 +        if (ret)
 +            goto cleanup;
 +        if (attr_present == TRUE) {
 +            if (strcasecmp(is_login_disabled, "TRUE")== 0)
 +                entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
 +            free (is_login_disabled);
 +        }
 +    }
 +#endif
     ret = krb5_read_tkt_policy(context, ldap_context, entry, tktpolname);
     if (ret)
 diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
 index d722dbfa6..5e8e9a897 100644
 --- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
 +++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
@@ -54,6 +54,9 @@ char     *principal_attributes[] = { "krbprincipalname",
                                      "krbLastFailedAuth",
                                      "krbLoginFailedCount",
                                      "krbLastSuccessfulAuth",
 +#ifdef HAVE_DIRSRV_ACCOUNT_LOCKING
 +                                     "nsAccountLock",
 +#endif
                                      "krbLastPwdChange",
                                      "krbLastAdminUnlock",
                                      "krbPrincipalAuthInd",
--- a/krb5-1.15-beta1-buildconf.patch
+++ b/krb5-1.15-beta1-buildconf.patch
@ -0,0 +1,70 @@
 From 162ba7fbce23d82719956de1b126e48fe676e9d1 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:45:26 -0400
 Subject: [PATCH] krb5-1.15-beta1-buildconf.patch
 Build binaries in this package as RELRO PIEs, libraries as partial RELRO,
 and install shared libraries with the execute bit set on them.  Prune out
 the -L/usr/lib* and PIE flags where they might leak out and affect
 apps which just want to link with the libraries. FIXME: needs to check and
 not just assume that the compiler supports using these flags.
 ---
 src/build-tools/krb5-config.in | 7 +++++++
 src/config/pre.in              | 2 +-
 src/config/shlib.conf          | 5 +++--
 3 files changed, 11 insertions(+), 3 deletions(-)
 diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
 index c17cb5eb5..1891dea99 100755
 --- a/src/build-tools/krb5-config.in
 +++ b/src/build-tools/krb5-config.in
@@ -226,6 +226,13 @@ if test -n "$do_libs"; then
 	    -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
 	    -e 's#\$(CFLAGS)##'`
 +    if test `dirname $libdir` = /usr ; then
 +        lib_flags=`echo $lib_flags | sed -e "s#-L$libdir##" -e "s#$RPATH_FLAG$libdir##"`
 +    fi
 +    lib_flags=`echo $lib_flags | sed -e "s#-fPIE##g" -e "s#-pie##g"`
 +    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,relro##g"`
 +    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,now##g"`
 +
     if test $library = 'kdb'; then
 	lib_flags="$lib_flags -lkdb5 $KDB5_DB_LIB"
 	library=krb5
 diff --git a/src/config/pre.in b/src/config/pre.in
 index d4714d29a..03f5c8890 100644
 --- a/src/config/pre.in
 +++ b/src/config/pre.in
@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
 INSTALL_SCRIPT=@INSTALL_PROGRAM@
 INSTALL_DATA=@INSTALL_DATA@
 INSTALL_SHLIB=@INSTALL_SHLIB@
 -INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
 +INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755
 ## This is needed because autoconf will sometimes define @exec_prefix@ to be
 ## ${prefix}.
 prefix=@prefix@
 diff --git a/src/config/shlib.conf b/src/config/shlib.conf
 index 3e4af6c02..2b20c3fda 100644
 --- a/src/config/shlib.conf
 +++ b/src/config/shlib.conf
@@ -423,7 +423,7 @@ mips-*-netbsd*)
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
 	# UNDEF_CHECK is suppressed by --enable-asan
 -	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)'
 +	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)  -Wl,-z,relro -Wl,--warn-shared-textrel'
 	UNDEF_CHECK='-Wl,--no-undefined'
 	# $(EXPORT_CHECK) runs export-check.pl when in maintainer mode.
 	LDCOMBINE_TAIL='-Wl,--version-script binutils.versions $(EXPORT_CHECK)'
@@ -435,7 +435,8 @@ mips-*-netbsd*)
 	SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
 	PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)'
 -	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)'
 +	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) -pie -Wl,-z,relro -Wl,-z,now $(LDFLAGS)'
 +	INSTALL_SHLIB='${INSTALL} -m755'
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)'
 	CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)'
 	CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)'
--- a/krb5-1.15.1-selinux-label.patch
+++ b/krb5-1.15.1-selinux-label.patch
--- a/krb5-1.17.tar.gz
+++ b/krb5-1.17.tar.gz
--- a/krb5-1.17.tar.gz.asc
+++ b/krb5-1.17.tar.gz.asc
@ -0,0 +1,17 @@
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 iQIcBAABAgAGBQJcNMxOAAoJEAy6CFdfg3LfjAwP/2/oQe+4Bs/XwZTwNfakTbBl
 YHSY8MNAHIKsLh6Bn+SJBQQXSE0fEsm0hYH+JWz85+mzlZk7TbNZUI+zeikhLxi6
 +d8MMQBpk2mQN0dkIeWjTdfkcThGCDSL7l0fh3MuEfN5C7QPAPD1JL1ZeqXPH5AV
 PSQRC9s2wiOTwwuHM2i27rZ7gdhL/xfJ3ZPUFJH4klRgszwp9j10I/nh4/XyS/wB
 82umjfusFPa9VNSPzm1jm94oRmALkR3CHGvmku2XD3YOv/f5yO8C1cHWNNLxg+5h
 EqVv05ddb6iLku4fRhkEjfN3VgCtEvXuMkuAXppkDJJ7wWxMBWgCIr1DS/x7LfbL
 CI0ZTejn8HCUBNmRWsKkUuebgHJ7ccch8p/Fp0cV4eT1FL35N2oV51u7+/zK6R8y
 1dygUF2VWFOqwm8cyczdFue7dFQVDGCw7R2eK5lXY3NpZVmJblQ/gNLMcbOxGBis
 H2dOzSn+CnxlD/2LqOZnhQ1WnGBhOMxoINwX/MQsIvkwAFaM1EsdhPIP/6mSVA/g
 p04+YQ2u2ag7Pq3zHsMIonC18w4ZqDPcvXvOXqCHtlQBDAMtb927XvjoTNj5W8Ei
 jywxqdWuuqalmrKGPEsKVOJZN6xg7UTgaKzcvQTvW7D3gLbrTT2iM++VKB3vh9V9
 SkULnR3c7fKMzFeLb/Q2
 =4hZX
 -----END PGP SIGNATURE-----
--- a/krb5-1.3.1-dns.patch
+++ b/krb5-1.3.1-dns.patch
@ -0,0 +1,22 @@
 From 2338e73d8dced4f85d6b4f5a0f7df21033ac78c1 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:46:21 -0400
 Subject: [PATCH] krb5-1.3.1-dns.patch
 We want to be able to use --with-netlib and --enable-dns at the same time.
 ---
 src/aclocal.m4 | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
 index 6257dba40..5eeaa2d8a 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
@@ -726,6 +726,7 @@ AC_HELP_STRING([--with-netlib=LIBS], use user defined resolver library),
 	LIBS="$LIBS $withval"
 	AC_MSG_RESULT("netlib will use \'$withval\'")
   fi
 +  KRB5_AC_ENABLE_DNS
 ],dnl
 [AC_LIBRARY_NET]
 )])dnl
--- a/krb5-1.9-debuginfo.patch
+++ b/krb5-1.9-debuginfo.patch
@ -0,0 +1,39 @@
 From 20bc1c9b1d37138d1a8538f9cef22108c8fabf4f Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:49:25 -0400
 Subject: [PATCH] krb5-1.9-debuginfo.patch
 We want to keep these y.tab.c files around because the debuginfo points to
 them.  It would be more elegant at the end to use symbolic links, but that
 could mess up people working in the tree on other things.
 ---
 src/kadmin/cli/Makefile.in                 | 5 +++++
 src/plugins/kdb/ldap/ldap_util/Makefile.in | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)
 diff --git a/src/kadmin/cli/Makefile.in b/src/kadmin/cli/Makefile.in
 index adfea6e2b..d1327e400 100644
 --- a/src/kadmin/cli/Makefile.in
 +++ b/src/kadmin/cli/Makefile.in
@@ -37,3 +37,8 @@ clean-unix::
 # CC_LINK is not meant for compilation and this use may break in the future.
 datetest: getdate.c
 	$(CC_LINK) $(ALL_CFLAGS) -DTEST -o datetest getdate.c
 +
 +%.c: %.y
 +	$(RM) y.tab.c $@
 +	$(YACC.y) $< 
 +	$(CP) y.tab.c $@
 diff --git a/src/plugins/kdb/ldap/ldap_util/Makefile.in b/src/plugins/kdb/ldap/ldap_util/Makefile.in
 index 8669c2436..a22f23c02 100644
 --- a/src/plugins/kdb/ldap/ldap_util/Makefile.in
 +++ b/src/plugins/kdb/ldap/ldap_util/Makefile.in
@@ -20,7 +20,7 @@ $(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIB) $(GETDATE)
 getdate.c: $(GETDATE)
 	$(RM) getdate.c y.tab.c
 	$(YACC) $(GETDATE)
 -	$(MV) y.tab.c getdate.c
 +	$(CP) y.tab.c getdate.c
 install:
 	$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG)
--- a/krb5-krb5kdc.conf
+++ b/krb5-krb5kdc.conf
@ -0,0 +1 @@
 d /var/run/krb5kdc 0755 root root
--- a/krb5.conf
+++ b/krb5.conf
@ -0,0 +1,28 @@
 # To opt out of the system crypto-policies configuration of krb5, remove the
 # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
 includedir /etc/krb5.conf.d/
 [logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log
 [libdefaults]
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
    spake_preauth_groups = edwards25519
 #    default_realm = EXAMPLE.COM
 [realms]
 # EXAMPLE.COM = {
 #     kdc = kerberos.example.com
 #     admin_server = kerberos.example.com
 # }
 [domain_realm]
 # .example.com = EXAMPLE.COM
 # example.com = EXAMPLE.COM
--- a/krb5.spec
+++ b/krb5.spec
@ -0,0 +1,299 @@
 Name:     krb5
 Version:  1.17
 Release:  2
 Summary:  The Kerberos network authentication protocol
 License:  MIT
 URL:      http://web.mit.edu/kerberos/www/
 Source0:  https://web.mit.edu/kerberos/dist/krb5/1.17/%{name}-%{version}.tar.gz
 Source1:  https://web.mit.edu/kerberos/dist/krb5/1.17/%{name}-%{version}.tar.gz.asc
 Source2:  kprop.service
 Source3:  kadmin.service
 Source4:  krb5kdc.service
 Source5:  krb5.conf
 Source6:  kdc.conf
 Source7:  kadm5.acl
 Source8:  krb5kdc.sysconfig
 Source9:  kadmin.sysconfig
 Source10: kprop.sysconfig
 Source11: ksu.pamd
 Source12: krb5kdc.logrotate
 Source13: kadmind.logrotate
 Source14: krb5-krb5kdc.conf
 Patch26: krb5-1.12.1-pam.patch
 Patch27: krb5-1.15.1-selinux-label.patch
 Patch28: krb5-1.12-ksu-path.patch
 Patch29: krb5-1.12-ktany.patch
 Patch30: krb5-1.15-beta1-buildconf.patch
 Patch31: krb5-1.3.1-dns.patch
 Patch32: krb5-1.12-api.patch
 Patch33: krb5-1.13-dirsrv-accountlock.patch
 Patch34: krb5-1.9-debuginfo.patch
 Patch35: krb5-1.11-run_user_0.patch
 Patch36: krb5-1.11-kpasswdtest.patch
 BuildRequires:  gcc make automake autoconf pkgconfig pam-devel libselinux-devel
 BuildRequires:  libcom_err-devel openssl-devel openldap-devel libss-devel libverto-module-base
 # tests
 BuildRequires: perl-interpreter dejagnu python3 tcl-devel
 BuildRequires: net-tools rpcbind hostname iproute libverto-devel
 BuildRequires: nss_wrapper socket_wrapper keyutils, keyutils-libs-devel
 Requires:      coreutils gawk grep sed keyutils
 Obsoletes:     libkadm5 krb5-libs
 Provides:      libkadm5 krb5-libs
 %description
 Kerberos is a network authentication protocol.
 It is designed to provide strong authentication
 for client/server applications by using secret-key
 cryptography.
 %package server
 Summary:    krb5 server
 Requires:   %{name} = %{version}-%{release}
 Requires:   logrotate libverto systemd words crypto-policies
 Obsoletes:  krb5-pkinit krb5-server-ldap
 Provides:   krb5-pkinit krb5-server-ldap
 Obsoletes:  krb5-pkinit-openssl < %{version}-%{release}
 Provides:   krb5-pkinit-openssl = %{version}-%{release}
 %description server
 This package provides krb5 server programs.
 %package client
 Summary:    krb5 client
 Requires:   %{name} = %{version}-%{release}
 Obsoletes:  %{name}-workstation
 Provides:   %{name}-workstation
 %description client
 This package provides krb5 client programs.
 %package devel
 Summary:    Development files for compiling with krb5
 Requires:   %{name} = %{version}-%{release}
 Requires:   e2fsprogs-devel keyutils-libs-devel libselinux-devel libverto-devel
 Provides:   krb5-kdb-version = 7.0
 %description devel
 %{summary}.
 %package help
 Summary:    The documents for krb5
 BuildArch:  noarch
 %description help
 %{summary}.
 %prep
 %autosetup -n %{name}-%{version} -p1
 pushd src
 autoreconf -fiv
 popd
 %build
 pushd src
 %configure \
    --enable-shared \
    --localstatedir=%{_var}/kerberos \
    --disable-rpath \
    --with-netlib=-lresolv \
    --with-tcl \
    --enable-dns-for-realm \
    --with-ldap \
    --enable-pkinit \
    --with-crypto-impl=openssl \
    --with-tls-impl=openssl \
    --with-system-verto \
    --with-prng-alg=os \
    --with-system-et \
    --with-system-ss \
    --with-pam \
    --with-selinux \
    --without-krb5-config
 %make_build
 popd
 %install
 pushd src
 %make_install
 popd
 mkdir -p $RPM_BUILD_ROOT/etc
 install -pm 644 %{SOURCE5} $RPM_BUILD_ROOT/etc/krb5.conf
 mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc
 install -pm 600 %{SOURCE6} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
 install -pm 600 %{SOURCE7} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
 mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5/user
 mkdir -p $RPM_BUILD_ROOT/etc/krb5.conf.d
 ln -sv /etc/crypto-policies/back-ends/krb5.config $RPM_BUILD_ROOT/etc/krb5.conf.d/crypto-policies
 mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss
 mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss/mech.d
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
 install -pm 644 %{SOURCE2} $RPM_BUILD_ROOT%{_unitdir}
 install -pm 644 %{SOURCE3} $RPM_BUILD_ROOT%{_unitdir}
 install -pm 644 %{SOURCE4} $RPM_BUILD_ROOT%{_unitdir}
 mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/run/krb5kdc
 mkdir -p $RPM_BUILD_ROOT/%{_tmpfilesdir}
 install -pm 644 %{SOURCE14} $RPM_BUILD_ROOT/%{_tmpfilesdir}/
 # install sysconfig files for server
 mkdir -p $RPM_BUILD_ROOT/etc/sysconfig
 install -pm 644 %{SOURCE8} $RPM_BUILD_ROOT/etc/sysconfig/`basename %{SOURCE8} .sysconfig`
 install -pm 644 %{SOURCE9} $RPM_BUILD_ROOT/etc/sysconfig/`basename %{SOURCE9} .sysconfig`
 install -pm 644 %{SOURCE10} $RPM_BUILD_ROOT/etc/sysconfig/`basename %{SOURCE10} .sysconfig`
 # install logrotate config files for server
 mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d/
 install -pm 644 %{SOURCE12} $RPM_BUILD_ROOT/etc/logrotate.d/`basename %{SOURCE12} .logrotate`
 install -pm 644 %{SOURCE13} $RPM_BUILD_ROOT/etc/logrotate.d/`basename %{SOURCE13} .logrotate`
 # PAM configuration files.
 mkdir -p $RPM_BUILD_ROOT/etc/pam.d/
 install -pm 644 %{SOURCE11} $RPM_BUILD_ROOT/etc/pam.d/`basename %{SOURCE11} .pamd`
 install -d -m 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth
 install -d -m 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/kdb
 install -d -m 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/authdata
 rm -vf %{buildroot}/%{_sbindir}/krb5-send-pr
 rm -vrf %{buildroot}/%{_datadir}/examples
 rm -vf %{buildroot}/%{_libdir}/krb5/plugins/preauth/test.so
 %find_lang mit-krb5
 %check
 make -C src runenv.py
 make -C src check || :
 %post -p /sbin/ldconfig
 %postun -p /sbin/ldconfig
 %post server
 %systemd_post krb5kdc.service kadmin.service kprop.service
 /bin/systemctl daemon-reload
 %preun server
 %systemd_preun krb5kdc.service kadmin.service kprop.service
 %postun server
 %systemd_postun_with_restart krb5kdc.service kadmin.service kprop.service
 %files -f mit-krb5.lang
 %defattr(-,root,root)
 %doc NOTICE README
 %dir /etc/gss
 %dir /etc/gss/mech.d
 %dir /etc/krb5.conf.d
 %config(noreplace) /etc/krb5.conf
 %config(noreplace) /etc/krb5.conf.d/crypto-policies
 %{_libdir}/libgssapi_krb5.so.*
 %{_libdir}/libgssrpc.so.*
 %{_libdir}/libk5crypto.so.*
 %{_libdir}/libkdb5.so.*
 %{_libdir}/libkrad.so.*
 %{_libdir}/libkrb5.so.*
 %{_libdir}/libkrb5support.so.*
 %{_libdir}/libkadm5clnt_mit.so.*
 %{_libdir}/libkadm5srv_mit.so.*
 %files server
 %defattr(-,root,root)
 %{_unitdir}/krb5kdc.service
 %{_unitdir}/kadmin.service
 %{_unitdir}/kprop.service
 %{_tmpfilesdir}/krb5-krb5kdc.conf
 %dir %{_localstatedir}/run/krb5kdc
 %config(noreplace) /etc/sysconfig/krb5kdc
 %config(noreplace) /etc/sysconfig/kadmin
 %config(noreplace) /etc/sysconfig/kprop
 %config(noreplace) /etc/logrotate.d/krb5kdc
 %config(noreplace) /etc/logrotate.d/kadmind
 %dir %{_var}/kerberos
 %dir %{_var}/kerberos/krb5kdc
 %config(noreplace) %{_var}/kerberos/krb5kdc/kdc.conf
 %config(noreplace) %{_var}/kerberos/krb5kdc/kadm5.acl
 %dir %{_libdir}/krb5
 %dir %{_libdir}/krb5/plugins
 %dir %{_libdir}/krb5/plugins/kdb
 %dir %{_libdir}/krb5/plugins/preauth
 %dir %{_libdir}/krb5/plugins/authdata
 %dir %{_libdir}/krb5/plugins/tls
 %{_libdir}/krb5/plugins/preauth/otp.so
 %{_libdir}/krb5/plugins/preauth/pkinit.so
 %{_libdir}/krb5/plugins/preauth/spake.so
 %{_libdir}/krb5/plugins/kdb/db2.so
 %{_libdir}/krb5/plugins/kdb/kldap.so
 %{_libdir}/krb5/plugins/tls/k5tls.so
 %{_libdir}/libkdb_ldap.so
 %{_libdir}/libkdb_ldap.so.*
 %{_sbindir}/kdb5_ldap_util
 %{_sbindir}/kadmin.local
 %{_sbindir}/kadmind
 %{_sbindir}/kdb5_util
 %{_sbindir}/kprop
 %{_sbindir}/kpropd
 %{_sbindir}/kproplog
 %{_sbindir}/krb5kdc
 %{_bindir}/sclient
 %{_sbindir}/sserver
 %files client
 %defattr(-,root,root)
 %config(noreplace) /etc/pam.d/ksu
 %{_bindir}/kdestroy
 %{_bindir}/kinit
 %{_bindir}/klist
 %{_bindir}/kpasswd
 %{_bindir}/kswitch
 %{_bindir}/kvno
 %{_bindir}/kadmin
 %{_bindir}/k5srvutil
 %{_bindir}/ktutil
 %attr(4755,root,root) %{_bindir}/ksu
 %files devel
 %defattr(-,root,root)
 %{_includedir}/*
 %{_libdir}/{libgssapi_krb5.so,libgssrpc.so,libk5crypto.so,libkdb5.so,libkrad.so,libkrb5.so,libkrb5support.so}
 %{_libdir}/pkgconfig/*
 %{_libdir}/libkadm5clnt.so
 %{_libdir}/libkadm5clnt_mit.so
 %{_libdir}/libkadm5srv.so
 %{_libdir}/libkadm5srv_mit.so
 %{_bindir}/krb5-config
 %{_bindir}/sim_client
 %{_bindir}/gss-client
 %{_bindir}/uuclient
 %{_sbindir}/sim_server
 %{_sbindir}/gss-server
 %{_sbindir}/uuserver
 %files help
 %defattr(-,root,root)
 %{_mandir}/man1/*
 %{_mandir}/man5/*
 %{_mandir}/man5/{.k5identity.5.*,.k5login.5.*}
 %{_mandir}/man7/*
 %{_mandir}/man8/*
 %changelog
 * Tue Sep 24 2019 openEuler Buildteam <buildteam@openeuler.org> - 1.17-2
 - Adjust requires
 * Thu Sep 19 2019 openEuler Buildteam <buildteam@openeuler.org> - 1.17-1
 - Package init
--- a/krb5kdc.logrotate
+++ b/krb5kdc.logrotate
@ -0,0 +1,9 @@
 /var/log/krb5kdc.log {
    missingok
    notifempty
    monthly
    rotate 12
    postrotate
 	/bin/kill -HUP `cat /var/run/krb5kdc.pid 2>/dev/null` 2> /dev/null || true
    endscript
 }
--- a/krb5kdc.service
+++ b/krb5kdc.service
@ -0,0 +1,14 @@
 [Unit]
 Description=Kerberos 5 KDC
 Wants=network-online.target
 After=syslog.target network.target network-online.target
 [Service]
 Type=forking
 PIDFile=/var/run/krb5kdc.pid
 EnvironmentFile=-/etc/sysconfig/krb5kdc
 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5kdc.pid $KRB5KDC_ARGS
 ExecReload=/bin/kill -HUP $MAINPID
 [Install]
 WantedBy=multi-user.target
--- a/krb5kdc.sysconfig
+++ b/krb5kdc.sysconfig
@ -0,0 +1 @@
 KRB5KDC_ARGS=
--- a/ksu.pamd
+++ b/ksu.pamd
@ -0,0 +1,4 @@
 #%PAM-1.0
 auth    include  su
 account include  su
 session include  su