Wed Feb 12 05:05:50 UTC 202020200212050550

Hey folks! PAM has finally landed in /testing. Some here wanted it to go
right into the main tree immediately, and in a more normal development cycle
I'd have been inclined to agree (it is -current, after all). But it's
probably better for it to appear in /testing first, to make sure we didn't
miss any bugs and also to serve as a warning shot that we'll be shaking up
the tree pretty good over the next few weeks. I'd like to see this merged
into the main tree in a day or two, so any testing is greatly appreciated.
Switching to the PAM packages (or reverting from them) is as easy as
installing all of them with upgradepkg --install-new, and if reverting then
remove the three leftover _pam packages. After reverting, a bit of residue
will remain in /etc/pam.d/ and /etc/security/ which can either be manually
deleted or simply ignored. While there are many more features available in
PAM compared with plain shadow, out of the box about the only noticable
change is the use of cracklib and libpwquality to check the quality of a
user-supplied password. Hopefully having PAM and krb5 will get us on track
to having proper Active Directory integration as well as using code paths
that are likely better audited these days. The attack surface *might* be
bigger, but it's also a lot better scrutinized.
Thanks to Robby Workman and Vincent Batts who did most of the initial heavy
lifting on the core PAM packages as a side project for many years. Thanks
also to Phantom X whose PAM related SlackBuilds were a valuable reference.
And thanks as well to ivandi - I learned a lot from the SlackMATE build
scripts and was even occasionally thankful for the amusing ways you would
kick my ass on LQ. ;-) You're more than welcome to let us know where we've
messed up this time.
The binutils and glibc packages in /testing were removed and are off the
table for now. I'm not seeing much upside to heading down that rabbit hole
at the moment. Next we need to be looking at Xfce 4.14 and Plasma 5.18 LTS
and some other things that have been held back since KDE4 couldn't use them.
Cheers! :-)
a/kernel-generic-5.4.19-x86_64-1.txz:  Upgraded.
a/kernel-huge-5.4.19-x86_64-1.txz:  Upgraded.
a/kernel-modules-5.4.19-x86_64-1.txz:  Upgraded.
a/lvm2-2.03.08-x86_64-1.txz:  Upgraded.
a/shadow-4.8.1-x86_64-2.txz:  Rebuilt.
  Automatically backup /etc/login.defs and install the new version if
  incompatible PAM options are detected.
d/kernel-headers-5.4.19-x86-1.txz:  Upgraded.
k/kernel-source-5.4.19-noarch-1.txz:  Upgraded.
  VALIDATE_FS_PARSER y -> n
xap/mozilla-thunderbird-68.5.0-x86_64-1.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/68.5.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6793
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6794
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6795
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6797
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6798
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6792
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6800
  (* Security fix *)
isolinux/initrd.img:  Rebuilt.
kernels/*:  Upgraded.
testing/packages/PAM/ConsoleKit2-1.2.1-x86_64-1_pam.txz:  Added.
testing/packages/PAM/at-3.2.1-x86_64-1_pam.txz:  Added.
testing/packages/PAM/cifs-utils-6.10-x86_64-2_pam.txz:  Added.
testing/packages/PAM/cracklib-2.9.7-x86_64-1_pam.txz:  Added.
testing/packages/PAM/cups-2.3.1-x86_64-1_pam.txz:  Added.
testing/packages/PAM/cyrus-sasl-2.1.27-x86_64-2_pam.txz:  Added.
testing/packages/PAM/dovecot-2.3.9.2-x86_64-1_pam.txz:  Added.
testing/packages/PAM/gnome-keyring-3.34.0-x86_64-1_pam.txz:  Added.
testing/packages/PAM/hplip-3.19.12-x86_64-2_pam.txz:  Added.
testing/packages/PAM/kde-workspace-4.11.22-x86_64-6_pam.txz:  Added.
testing/packages/PAM/libcap-2.31-x86_64-1_pam.txz:  Added.
testing/packages/PAM/libcgroup-0.41-x86_64-5_pam.txz:  Added.
testing/packages/PAM/libpwquality-1.4.2-x86_64-1_pam.txz:  Added.
testing/packages/PAM/mariadb-10.4.12-x86_64-1_pam.txz:  Added.
testing/packages/PAM/netatalk-3.1.12-x86_64-2_pam.txz:  Added.
testing/packages/PAM/netkit-rsh-0.17-x86_64-2_pam.txz:  Added.
testing/packages/PAM/openssh-8.1p1-x86_64-1_pam.txz:  Added.
testing/packages/PAM/openvpn-2.4.8-x86_64-1_pam.txz:  Added.
testing/packages/PAM/pam-1.3.1-x86_64-1_pam.txz:  Added.
testing/packages/PAM/polkit-0.116-x86_64-1_pam.txz:  Added.
testing/packages/PAM/popa3d-1.0.3-x86_64-3_pam.txz:  Added.
testing/packages/PAM/ppp-2.4.7-x86_64-3_pam.txz:  Added.
testing/packages/PAM/proftpd-1.3.6b-x86_64-1_pam.txz:  Added.
testing/packages/PAM/samba-4.11.6-x86_64-1_pam.txz:  Added.
testing/packages/PAM/screen-4.8.0-x86_64-1_pam.txz:  Added.
testing/packages/PAM/shadow-4.8.1-x86_64-2_pam.txz:  Added.
testing/packages/PAM/sudo-1.8.31-x86_64-1_pam.txz:  Added.
testing/packages/PAM/system-config-printer-1.5.12-x86_64-2_pam.txz:  Added.
testing/packages/PAM/util-linux-2.35.1-x86_64-1_pam.txz:  Added.
testing/packages/PAM/vsftpd-3.0.3-x86_64-5_pam.txz:  Added.
testing/packages/PAM/xdm-1.1.11-x86_64-9_pam.txz:  Added.
testing/packages/PAM/xlockmore-5.62-x86_64-1_pam.txz:  Added.
testing/packages/PAM/xscreensaver-5.43-x86_64-1_pam.txz:  Added.
testing/packages/binutils-2.34-x86_64-1.txz:  Removed.
testing/packages/glibc-2.31-x86_64-1.txz:  Removed.
testing/packages/glibc-i18n-2.31-x86_64-1.txz:  Removed.
testing/packages/glibc-profile-2.31-x86_64-1.txz:  Removed.
testing/packages/glibc-solibs-2.31-x86_64-1.txz:  Removed.
usb-and-pxe-installers/usbboot.img:  Rebuilt.

1 files changed, 0 insertions, 161 deletions

diff --git a/testing/source/glibc/doinst.sh-glibc-solibs b/testing/source/glibc/doinst.sh-glibc-solibs
deleted file mode 100644
index 3d4466043..000000000
--- a/testing/source/glibc/doinst.sh-glibc-solibs
+++ /dev/null
@@ -1,161 +0,0 @@
-#!/bin/sh
-# Copyright (C) 2002, 2005  Slackware Linux, Inc.
-# Copyright 2005, 2006, 2011, 2012, 2018  Patrick J. Volkerding, Sebeka, Minnesota, USA
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License
-# as published by the Free Software Foundation; either version 2
-# of the License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# Swap glibc on the fly.
-#
-# If we're on a running system we have to handle this _very_ carefully.  :-)
-# The tricks involved here get trickier every time...
-
-# OK, now we have to be sure of a few things.  First, you do have a 2.6
-# kernel running, right?
-
-if [ -r /proc/ksyms ]; then
-  echo "FATAL: you need to be running a 2.6.x kernel in order to upgrade"
-  echo "to this version of glibc."
-  echo
-  sleep 999
-  exit 1
-fi
-
-# Next, stop using the /lib/ntpl libraries.  These are now obsolete and
-# will break the installation if present:
-if [ -d lib/tls ]; then
-  mkdir -p lib/obsolete
-  mv lib/tls lib/obsolete
-fi
-if [ -x sbin/ldconfig ]; then
-  sbin/ldconfig -r . 2> /dev/null
-fi
-
-# Install NPTL glibc libraries:
-if [ -x /sbin/ldconfig -a -d lib/incoming ]; then # swap on the fly
-  # Try to protect with flock against another installpkg/removepkg running
-  # ldconfig while we're doing the on-the-fly install:
-  mkdir -p run/lock/pkgtools
-  ( flock 9 || exit 11
-    # First create copies of the incoming libraries:
-    ( cd lib/incoming
-      for file in * ; do
-        if [ ! -r ../${file}.incoming ]; then
-          cp -a $file ../${file}.incoming
-        fi
-      done
-    )
-    # Then switch to them all at once:
-    /sbin/ldconfig -l lib/*.incoming 2> /dev/null
-    # Remove old versions of the glibc libraries. If you really don't want to
-    # do this for some reason, create a file /etc/glibc-nowipe.
-    if [ ! -r etc/glibc-nowipe ]; then
-      ( cd lib
-        for INCOMING in incoming/*-* ; do
-          LIBPREFIX=$(basename $INCOMING | cut -f 1 -d -)
-          for LIBRARY in ${LIBPREFIX}-* ; do
-            # Don't remove the library if it ends in .incoming:
-            if [ "$(echo $LIBRARY | rev | cut -f 1 -d .)" = "gnimocni" ]; then
-              continue
-            fi
-            # Don't remove symlinks:
-            if [ -L $LIBRARY ]; then
-              continue
-            fi
-            rm -f $LIBRARY
-          done
-        done
-      )
-    fi
-    # Finally, rename them and clean up:
-    ( cd lib
-      for file in *.incoming ; do
-        rm -f `basename $file .incoming`
-        cp -a $file `basename $file .incoming`
-        /sbin/ldconfig -l `basename $file .incoming` 2> /dev/null
-        rm -f $file
-      done
-    )
-  ) 9> run/lock/pkgtools/ldconfig.lock
-else # no ldconfig? This is a broken situation, but we will do what we can:
-  ( cd lib/incoming
-    for file in * ; do
-      cp -a $file ..
-    done
-  )
-fi
-# Now, get rid of the temporary directory:
-rm -rf lib/incoming
-# Done installing NPTL glibc libraries.
-
-# Handle config files:
-config() {
-  NEW="$1"
-  OLD="$(dirname $NEW)/$(basename $NEW .new)"
-  # If there's no config file by that name, mv it over:
-  if [ ! -r $OLD ]; then
-    mv $NEW $OLD
-  elif [ "$(cat $OLD | md5sum)" = "$(cat $NEW | md5sum)" ]; then # toss the redundant copy
-    rm $NEW
-  fi
-  # Otherwise, we leave the .new copy for the admin to consider...
-}
-config etc/profile.d/glibc.csh.new
-config etc/profile.d/glibc.sh.new
-# Clearly you already decided this issue.  :-)
-rm -f etc/profile.d/glibc.csh.new
-rm -f etc/profile.d/glibc.sh.new
-
-# This block below *should* be dead code, but it's probably safer to leave it
-# here as a fallback. It no longer has complete coverage of all the links
-# that would be needed in /lib${LIBDIRSUFFIX}, but it covers enough that if
-# we did fall back on this the machine would boot until it reached the boot
-# time call to ldconfig, which would then take care of any missing links.
-if [ ! -x /sbin/ldconfig ]; then
-( cd lib ; rm -rf libnss_nis.so.2 )
-( cd lib ; ln -sf libnss_nis-@@VERSION@@.so libnss_nis.so.2 )
-( cd lib ; rm -rf libm.so.6 )
-( cd lib ; ln -sf libm-@@VERSION@@.so libm.so.6 )
-( cd lib ; rm -rf libnss_files.so.2 )
-( cd lib ; ln -sf libnss_files-@@VERSION@@.so libnss_files.so.2 )
-( cd lib ; rm -rf libresolv.so.2 )
-( cd lib ; ln -sf libresolv-@@VERSION@@.so libresolv.so.2 )
-( cd lib ; rm -rf libnsl.so.1 )
-( cd lib ; ln -sf libnsl-@@VERSION@@.so libnsl.so.1 )
-( cd lib ; rm -rf libutil.so.1 )
-( cd lib ; ln -sf libutil-@@VERSION@@.so libutil.so.1 )
-( cd lib ; rm -rf libnss_compat.so.2 )
-( cd lib ; ln -sf libnss_compat-@@VERSION@@.so libnss_compat.so.2 )
-( cd lib ; rm -rf libthread_db.so.1 )
-( cd lib ; ln -sf libthread_db-1.0.so libthread_db.so.1 )
-( cd lib ; rm -rf libnss_hesiod.so.2 )
-( cd lib ; ln -sf libnss_hesiod-@@VERSION@@.so libnss_hesiod.so.2 )
-( cd lib ; rm -rf libanl.so.1 )
-( cd lib ; ln -sf libanl-@@VERSION@@.so libanl.so.1 )
-( cd lib ; rm -rf libcrypt.so.1 )
-( cd lib ; ln -sf libcrypt-@@VERSION@@.so libcrypt.so.1 )
-( cd lib ; rm -rf libBrokenLocale.so.1 )
-( cd lib ; ln -sf libBrokenLocale-@@VERSION@@.so libBrokenLocale.so.1 )
-( cd lib ; rm -rf ld-linux.so.2 )
-( cd lib ; ln -sf ld-@@VERSION@@.so ld-linux.so.2 )
-( cd lib ; rm -rf libdl.so.2 )
-( cd lib ; ln -sf libdl-@@VERSION@@.so libdl.so.2 )
-( cd lib ; rm -rf libnss_dns.so.2 )
-( cd lib ; ln -sf libnss_dns-@@VERSION@@.so libnss_dns.so.2 )
-( cd lib ; rm -rf libpthread.so.0 )
-( cd lib ; ln -sf libpthread-@@VERSION@@.so libpthread.so.0 )
-( cd lib ; rm -rf libnss_nisplus.so.2 )
-( cd lib ; ln -sf libnss_nisplus-@@VERSION@@.so libnss_nisplus.so.2 )
-( cd lib ; rm -rf libc.so.6 )
-( cd lib ; ln -sf libc-@@VERSION@@.so libc.so.6 )
-( cd lib ; rm -rf librt.so.1 )
-( cd lib ; ln -sf librt-@@VERSION@@.so librt.so.1 )
-fi
-