31+mkdir -p %{buildroot}%{_prefix}%{_sysconfdir}/pam.d
32+cat > %{buildroot}%{_prefix}%{_sysconfdir}/pam.d/physlock <<-'EOF'

That took me two seconds to understand why this looks so weird :)

you likely want to use distconfdir here.

On old systems, you have this defined to be /etc, on newer systems it is pre-defined to be /usr/etc.

The way you package it now, it has potential to fail when distconfdir is not defined, as then you create the files in prefix/sysconfdir (aka /usr/etc) but in the files section you then use distconfdir, which has been redefined to sysconfdir, aka /etc