linux-pam: 1.6.1 -> 1.7.1 (#418255)

pkgs/by-name/kb/kbd/package.nix

···
   xz,
   zstd,
   gitUpdater,
+  withVlock ? true,
 }:
 
 stdenv.mkDerivation rec {
···
   # reduces closure size for most use cases.
   outputs = [
     "out"
-    "vlock"
     "dev"
     "scripts"
     "man"
+  ]
+  ++ lib.optionals withVlock [
+    "vlock"
   ];
 
   configureFlags = [
     "--enable-optional-progs"
     "--enable-libkeymap"
     "--disable-nls"
+    (lib.enableFeature withVlock "vlock")
   ]
   ++ lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"
···
 
   buildInputs = [
     check
-    pam
     bash
-  ];
+  ]
+  ++ lib.optionals withVlock [ pam ];
+
   NIX_LDFLAGS = lib.optional stdenv.hostPlatform.isStatic "-laudit";
   nativeBuildInputs = [
     autoreconfHook

pkgs/by-name/li/linux-pam/package.nix

···
   lib,
   stdenv,
   buildPackages,
-  fetchurl,
-  fetchpatch,
+  fetchFromGitHub,
   flex,
   db4,
   gettext,
+  ninja,
   audit,
   libxcrypt,
   nixosTests,
-  autoreconfHook269,
-  pkg-config-unwrapped,
+  meson,
+  pkg-config,
+  systemdLibs,
+  docbook5,
+  libxslt,
+  libxml2,
+  w3m-batch,
+  findXMLCatalogs,
+  docbook_xsl_ns,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "linux-pam";
-  version = "1.6.1";
+  version = "1.7.1";
 
-  src = fetchurl {
-    url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    hash = "sha256-+JI8dAFZBS1xnb/CovgZQtaN00/K9hxwagLJuA/u744=";
+  src = fetchFromGitHub {
+    owner = "linux-pam";
+    repo = "linux-pam";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-kANcwxifQz2tYPSrSBSFiYNTm51Gr10L/zroCqm8ZHQ=";
   };
 
-  patches = [
-    ./suid-wrapper-path.patch
-    # required for fixing CVE-2025-6020
-    (fetchpatch {
-      url = "https://github.com/linux-pam/linux-pam/commit/10b80543807e3fc5af5f8bcfd8bb6e219bb3cecc.patch";
-      hash = "sha256-VS3D3wUbDxDXRriIuEvvgeZixzDA58EfiLygfFeisGg=";
-    })
-    # Manually cherry-picked from 475bd60c552b98c7eddb3270b0b4196847c0072e
-    ./CVE-2025-6020.patch
-  ];
-
-  # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
-  postPatch =
-    lib.optionalString (stdenv.buildPlatform.isDarwin && stdenv.buildPlatform != stdenv.hostPlatform)
-      ''
-        rm CHANGELOG
-        touch ChangeLog
-      '';
+  # patching unix_chkpwd is required as the nix store entry does not have the necessary bits
+  postPatch = ''
+    substituteInPlace modules/module-meson.build \
+      --replace-fail "sbindir / 'unix_chkpwd'" "'/run/wrappers/bin/unix_chkpwd'"
+  '';
 
   outputs = [
     "out"
     "doc"
-    "man" # "modules"
+    "man"
+    # "modules"
   ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  # autoreconfHook269 is needed for `suid-wrapper-path.patch` above.
-  # pkg-config-unwrapped is needed for `AC_CHECK_LIB` and `AC_SEARCH_LIBS`
   nativeBuildInputs = [
     flex
-    autoreconfHook269
-    pkg-config-unwrapped
-  ]
-  ++ lib.optional stdenv.buildPlatform.isDarwin gettext;
+    meson
+    ninja
+    pkg-config
+    gettext
+
+    libxslt
+    libxml2
+    w3m-batch
+    findXMLCatalogs
+    docbook_xsl_ns
+    docbook5
+  ];
 
   buildInputs = [
     db4
     libxcrypt
   ]
-  ++ lib.optional stdenv.buildPlatform.isLinux audit;
+  ++ lib.optionals stdenv.buildPlatform.isLinux [
+    audit
+    systemdLibs
+  ];
 
   enableParallelBuilding = true;
 
-  configureFlags = [
-    "--includedir=${placeholder "out"}/include/security"
-    "--enable-sconfigdir=/etc/security"
-    # The module is deprecated. We re-enable it explicitly until NixOS
-    # module stops using it.
-    "--enable-lastlog"
-  ];
-
-  installFlags = [
-    "SCONFIGDIR=${placeholder "out"}/etc/security"
+  mesonAutoFeatures = "auto";
+  mesonFlags = [
+    (lib.mesonEnable "logind" stdenv.buildPlatform.isLinux)
+    (lib.mesonEnable "audit" stdenv.buildPlatform.isLinux)
+    (lib.mesonEnable "pam_lastlog" (!stdenv.hostPlatform.isMusl)) # TODO: switch to pam_lastlog2, pam_lastlog is deprecated and broken on musl
+    (lib.mesonEnable "pam_unix" true)
+    # (lib.mesonBool "pam-debug" true) # warning: slower execution due to debug makes VM tests fail!
+    (lib.mesonOption "sysconfdir" "etc") # relative to meson prefix, which is $out
+    (lib.mesonEnable "elogind" false)
+    (lib.mesonEnable "econf" false)
+    (lib.mesonEnable "selinux" false)
+    (lib.mesonEnable "nis" false)
+    (lib.mesonBool "xtests" false)
+    (lib.mesonBool "examples" false)
   ];
 
   doCheck = false; # fails
 
-  passthru.tests = {
-    inherit (nixosTests)
-      pam-oath-login
-      pam-u2f
-      pam-lastlog
-      shadow
-      sssd-ldap
-      ;
+  passthru = {
+    tests = {
+      inherit (nixosTests)
+        pam-oath-login
+        pam-u2f
+        pam-lastlog
+        shadow
+        sssd-ldap
+        ;
+    };
+    updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/linux-pam/linux-pam/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/linux-pam/linux-pam";
     description = "Pluggable Authentication Modules, a flexible mechanism for authenticating user";
-    platforms = platforms.linux;
-    license = licenses.bsd3;
+    platforms = lib.platforms.linux;
+    license = lib.licenses.bsd3;
   };
-}
+})

pkgs/by-name/li/linux-pam/suid-wrapper-path.patch

···
-It needs the SUID version during runtime, and that can't be in /nix/store/**
---- a/modules/pam_unix/Makefile.am
-+++ b/modules/pam_unix/Makefile.am
-@@ -21 +21 @@
--	-DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" \
-+	-DCHKPWD_HELPER=\"/run/wrappers/bin/unix_chkpwd\" \

pkgs/os-specific/linux/systemd/default.nix

···
   withLogind ? true,
   withMachined ? true,
   withNetworkd ? true,
+  withNspawn ? !buildLibsOnly,
   withNss ? !stdenv.hostPlatform.isMusl,
   withOomd ? true,
   withOpenSSL ? true,
···
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
   releaseTimestamp = "1734643670";
+
+  kbd' = if withPam then kbd else kbd.override { withVlock = false; };
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
···
     ./0019-meson-Don-t-link-ssh-dropins.patch
 
     ./0020-install-unit_file_exists_full-follow-symlinks.patch
+
+    # add nspawn build option flag
+    # required to disable nspawn for systemdLibs to avoid dependency on getent
+    # https://github.com/systemd/systemd/pull/36876, remove for systemd 258
+    (fetchpatch {
+      # required for the actual patch to apply
+      url = "https://github.com/systemd/systemd/commit/b1fb2d971c810e0bdf9ff0ae567a1c6c230e4e5d.patch";
+      hash = "sha256-JBheazg1OFkx8vUl2l8+34BoEPVURBQJHxqntOBYB60=";
+      includes = [ "src/nspawn/meson.build" ];
+    })
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/d95818f5221d9b9b19648cffa0cb2407f023b27e.patch";
+      hash = "sha256-FTpWGec5ivlkyEEDMCPaLE+BH91e7JI0kH8pS88bBDY=";
+      excludes = [ "test/fuzz/meson.build" ];
+    })
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0021-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
···
     ninja
     meson
     glibcLocales
-    getent
     m4
     autoPatchelfHook
 
···
 
   buildInputs = [
     libxcrypt
-    libcap
+    (if withPam then libcap else libcap.override { usePam = false; })
     libuuid
     linuxHeaders
     bashInteractive # for patch shebangs
···
     (lib.mesonOption "pkgconfigdatadir" "${placeholder "dev"}/share/pkgconfig")
 
     # Keyboard
-    (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys")
-    (lib.mesonOption "setfont-path" "${kbd}/bin/setfont")
+    (lib.mesonOption "loadkeys-path" "${kbd'}/bin/loadkeys")
+    (lib.mesonOption "setfont-path" "${kbd'}/bin/setfont")
 
     # SBAT
     (lib.mesonOption "sbat-distro" "nixos")
···
     (lib.mesonEnable "gnutls" false)
     (lib.mesonEnable "xkbcommon" false)
     (lib.mesonEnable "man" true)
+    (lib.mesonEnable "nspawn" withNspawn)
 
     (lib.mesonBool "analyze" withAnalyze)
     (lib.mesonBool "logind" withLogind)
···
       # build fails with an error message.
       binaryReplacements = [
         {
-          search = "/usr/bin/getent";
-          replacement = "${getent}/bin/getent";
-          where = [ "src/nspawn/nspawn-setuid.c" ];
-        }
-        {
           search = "/sbin/mkswap";
           replacement = "${lib.getBin util-linux}/sbin/mkswap";
           where = [
···
           search = "/usr/lib/systemd/systemd-fsck";
           replacement = "$out/lib/systemd/systemd-fsck";
           where = [ "man/systemd-fsck@.service.xml" ];
+        }
+      ]
+      ++ lib.optionals withNspawn [
+        {
+          search = "/usr/bin/getent";
+          replacement = "${getent}/bin/getent";
+          where = [ "src/nspawn/nspawn-setuid.c" ];
         }
       ]
       ++ lib.optionals withImportd [
···
       withUtmp
       util-linux
       kmod
-      kbd
       ;
+
+    kbd = kbd';
 
     # Many TPM2-related units are only installed if this trio of features are
     # enabled. See https://github.com/systemd/systemd/blob/876ee10e0eb4bbb0920bdab7817a9f06cc34910f/units/meson.build#L521