File pam_pkcs11.spec of Package pam_pkcs11.37564

#
# spec file for package pam_pkcs11
#
# Copyright (c) 2025 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via https://bugs.opensuse.org/
#


Name:           pam_pkcs11
Version:        0.6.8
Release:        0
URL:            http://www.opensc-project.org/pam_pkcs11/
Summary:        PKCS #11 PAM Module
License:        LGPL-2.1-or-later
Group:          Productivity/Security
Source:         %{name}-%{version}.tar.gz
Source1:        pam_pkcs11-common-auth-smartcard.pam
Source2:        baselibs.conf
Source3:        pkcs11_eventmgr.service
Patch1:         %{name}-0.5.3-nss-conf.patch
Patch3:         %{name}-0.6.0-nss-autoconf.patch
Patch5:         0001-verify-using-a-nonce-from-the-system-not-the-card.patch
Patch6:         0002-fixed-buffer-overflow-with-long-home-directory.patch
Patch7:         0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch
# PATCH-FIX-UPSTREAM: bsc#1237058 CVE-2025-24031:  vulnerable to segmentation fault on ctrl-c/ctrl-d when asked for PIN
Patch8:         pam_pkcs11-CVE-2025-24031.patch
# PATCH-FIX-UPSTREAM: bsc#1237062 CVE-2025-24032: vulnerable to authentication bypass with default value for `cert_policy` (`none`)
Patch9:         pam_pkcs11-CVE-2025-24032.patch
BuildRequires:  curl-devel
BuildRequires:  flex
BuildRequires:  libxslt
BuildRequires:  mozilla-nss-devel
BuildRequires:  openldap2-devel
BuildRequires:  openssl-devel
BuildRequires:  pam-devel
BuildRequires:  pcsc-lite-devel
BuildRequires:  pkg-config
BuildRoot:      %{_tmppath}/%{name}-%{version}-build

%description
This Linux PAM module allows X.509 a certificate-based user
authentication. The certificate and its dedicated private key are
thereby accessed by means of an appropriate PKCS #11 module. For the
verification of the users' certificates, locally stored CA certificates
as well as online or locally accessible CRLs are used.

Additionally, the package includes pam_pkcs11-related tools: *
   pkcs11_eventmgr: Generates actions on card insert, removal, or
   time-out events

* pklogin_finder: Gets the login name that maps to a certificate

* pkcs11_inspect: Inspects the contents of a certificate

* make_hash_links: Creates hash link directories for storing CAs and
CRLs

Authors:
--------
    Mario Strasser <mast@gmx.net>
    Juan Antonio Martinez <jonsito@teleline.es>
    Antti Tapaninen <aet@cc.hut.fi>
    Timo Sirainen <tss@iki.fi>
    Ludovic Rousseau <ludovic.rousseau@free.fr>
    Andreas Jellinghaus <aj@dungeon.inka.de>
    Dominik Fischer <dom_fischer@web.de>
    Ville Skyttä <vskytta@gmail.com>

%prep
%setup -q
%patch1 -p1
%patch3 -p1
%patch5 -p1
%patch6 -p1
%patch7 -p1
%patch8 -p1
%patch9 -p1

cp -a %{S:1} common-auth-smartcard
mv po/pt_br.po po/pt_BR.po
sed -i s/pt_br/pt_BR/ configure.in configure
sed -i s:/lib/:/%{_lib}/:g etc/pam_pkcs11.conf.example.in etc/pkcs11_eventmgr.conf.example

%build
%configure\
	--docdir=%{_docdir}/%{name}\
	--with-nss\
	--with-curl
make %{?jobs:-j%jobs}

%check
make check

%install
%makeinstall
mkdir -p $RPM_BUILD_ROOT/%{_lib}
mv $RPM_BUILD_ROOT%{_libdir}/security $RPM_BUILD_ROOT/%{_lib}
rm $RPM_BUILD_ROOT%{_libdir}/pam_pkcs11/*.*a $RPM_BUILD_ROOT/%{_lib}/security/*.*a
# Hardcoded defaults... no sysconfdir
install -dm 755 $RPM_BUILD_ROOT%{_sysconfdir}/pam_pkcs11/cacerts
install -dm 755 $RPM_BUILD_ROOT%{_sysconfdir}/pam_pkcs11/crls
cd etc
for conf in *.conf.example ; do
    install -m 644 ${conf} $RPM_BUILD_ROOT%{_sysconfdir}/pam_pkcs11/${conf%.example}
done
cd ..
mkdir -p $RPM_BUILD_ROOT%{_docdir}/%{name}
cp -a AUTHORS COPYING ChangeLog ChangeLog.svn NEWS README TODO doc/pam_pkcs11.html doc/mappers_api.html doc/api doc/README.autologin doc/README.mappers $RPM_BUILD_ROOT%{_docdir}/%{name}
mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
cp common-auth-smartcard $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/
%find_lang %{name}
install -D -m 644 %{SOURCE3} %{buildroot}%{_unitdir}/pkcs11_eventmgr.service

%pre
%service_add_pre pkcs11_eventmgr.service

%post
%service_add_post pkcs11_eventmgr.service

%preun
%service_del_preun pkcs11_eventmgr.service

%postun
%service_del_postun pkcs11_eventmgr.service

%clean
rm -rf $RPM_BUILD_ROOT

%files -f  %{name}.lang
%defattr (-, root, root)
%doc %{_docdir}/%{name}
%{_bindir}/*
%{_libdir}/pam_pkcs11
/%{_lib}/security/*.so
%doc %{_mandir}/man?/*.*
%dir %{_sysconfdir}/pam_pkcs11
%dir %{_sysconfdir}/pam_pkcs11/cacerts
%dir %{_sysconfdir}/pam_pkcs11/crls
%{_unitdir}/pkcs11_eventmgr.service
%config(noreplace) %{_sysconfdir}/pam_pkcs11/*.conf
%config(noreplace) %{_sysconfdir}/pam.d/common-auth-smartcard

%changelog