diff --git a/metadata/md5-cache/sys-libs/pam-1.1.8-r2 b/metadata/md5-cache/sys-libs/pam-1.1.8-r2
deleted file mode 100644
index e82384b..0000000
--- a/metadata/md5-cache/sys-libs/pam-1.1.8-r2
+++ /dev/null
@@ -1,14 +0,0 @@
-DEFINED_PHASES=compile configure install postinst preinst prepare pretend test
-DEPEND=nls? ( >=virtual/libintl-0-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) cracklib? ( >=sys-libs/cracklib-2.9.1-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) audit? ( >=sys-process/audit-2.2.2[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) selinux? ( >=sys-libs/libselinux-2.2.2-r4[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) berkdb? ( >=sys-libs/db-4.8.30-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) elibc_glibc? ( >=sys-libs/glibc-2.7 nis? ( || ( >=net-libs/libtirpc-0.2.4-r2[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] <sys-libs/glibc-2.14 ) ) ) >=sys-devel/libtool-2 >=sys-devel/flex-2.5.39-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] nls? ( sys-devel/gettext ) >=virtual/pkgconfig-0-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?]
-DESCRIPTION=Linux-PAM (Pluggable Authentication Modules)
-EAPI=5
-HOMEPAGE=https://fedorahosted.org/linux-pam/
-IUSE=cracklib nls elibc_FreeBSD selinux vim-syntax audit test elibc_glibc debug berkdb nis abi_x86_32 abi_x86_64 abi_x86_x32 abi_mips_n32 abi_mips_n64 abi_mips_o32 abi_ppc_32 abi_ppc_64 abi_s390_32 abi_s390_64
-KEYWORDS=*
-LICENSE=|| ( BSD GPL-2 )
-PDEPEND=sys-auth/pambase vim-syntax? ( app-vim/pam-syntax )
-RDEPEND=nls? ( >=virtual/libintl-0-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) cracklib? ( >=sys-libs/cracklib-2.9.1-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) audit? ( >=sys-process/audit-2.2.2[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) selinux? ( >=sys-libs/libselinux-2.2.2-r4[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) berkdb? ( >=sys-libs/db-4.8.30-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) elibc_glibc? ( >=sys-libs/glibc-2.7 nis? ( || ( >=net-libs/libtirpc-0.2.4-r2[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] <sys-libs/glibc-2.14 ) ) ) !<sys-apps/openrc-0.11.8 !sys-auth/openpam !sys-auth/pam_userdb abi_x86_32? ( !<=app-emulation/emul-linux-x86-baselibs-20140508-r7 !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)] )
-SLOT=0
-SRC_URI=http://www.linux-pam.org/library/Linux-PAM-1.1.8.tar.bz2 http://www.linux-pam.org/documentation/Linux-PAM-1.1.8-docs.tar.bz2
-_eclasses_=db-use	8d7baa3efc7c38c7d5c5e7353c5460dc	eutils	06133990e861be0fe60c2b428fd025d9	flag-o-matic	5d5921a298e95441da2f85be419894c0	libtool	52d0e17251d04645ffaa61bfdd858944	multibuild	6d4858dc00f8bc51caf3f957f8430eb0	multilib	3bf24e6abb9b76d9f6c20600f0b716bf	multilib-build	0983c7893df461213a05f791cc7dea6d	multilib-minimal	13dd976916c35a1e2c8d170e840c7018	pam	3f746974e1cc47cabe3bd488c08cdc8e	toolchain-funcs	48b38a216afb92db6314d6c3187abea3	versionator	865bc8b2fc9fcfb6d520bdf5a110f5ed
-_md5_=83161741df6527d0c563807a76c4b350
diff --git a/metadata/md5-cache/sys-libs/pam-1.2.1-r1 b/metadata/md5-cache/sys-libs/pam-1.2.1-r1
new file mode 100644
index 0000000..359cc5b
--- /dev/null
+++ b/metadata/md5-cache/sys-libs/pam-1.2.1-r1
@@ -0,0 +1,14 @@
+DEFINED_PHASES=compile configure install postinst preinst prepare pretend test unpack
+DEPEND=nls? ( >=virtual/libintl-0-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) cracklib? ( >=sys-libs/cracklib-2.9.1-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) audit? ( >=sys-process/audit-2.2.2[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) selinux? ( >=sys-libs/libselinux-2.2.2-r4[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) berkdb? ( >=sys-libs/db-4.8.30-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) nis? ( >=net-libs/libtirpc-0.2.4-r2[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) >=sys-devel/libtool-2 >=sys-devel/flex-2.5.39-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] nls? ( sys-devel/gettext ) >=virtual/pkgconfig-0-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] filecaps? ( sys-libs/libcap )
+DESCRIPTION=Linux-PAM (Pluggable Authentication Modules)
+EAPI=5
+HOMEPAGE=http://www.linux-pam.org/ https://fedorahosted.org/linux-pam/
+IUSE=audit berkdb cracklib debug nis nls +pie selinux test vim-syntax abi_x86_32 abi_x86_64 abi_x86_x32 abi_mips_n32 abi_mips_n64 abi_mips_o32 abi_ppc_32 abi_ppc_64 abi_s390_32 abi_s390_64 +filecaps
+KEYWORDS=*
+LICENSE=|| ( BSD GPL-2 )
+PDEPEND=sys-auth/pambase vim-syntax? ( app-vim/pam-syntax )
+RDEPEND=nls? ( >=virtual/libintl-0-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) cracklib? ( >=sys-libs/cracklib-2.9.1-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) audit? ( >=sys-process/audit-2.2.2[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) selinux? ( >=sys-libs/libselinux-2.2.2-r4[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) berkdb? ( >=sys-libs/db-4.8.30-r1[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) nis? ( >=net-libs/libtirpc-0.2.4-r2[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?] ) !<sys-apps/openrc-0.11.8 !sys-auth/openpam !sys-auth/pam_userdb abi_x86_32? ( !<=app-emulation/emul-linux-x86-baselibs-20140508-r7 !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)] )
+SLOT=0
+SRC_URI=http://www.linux-pam.org/library/Linux-PAM-1.2.1.tar.bz2 http://www.linux-pam.org/documentation/Linux-PAM-1.2.0-docs.tar.bz2
+_eclasses_=db-use	8d7baa3efc7c38c7d5c5e7353c5460dc	eutils	06133990e861be0fe60c2b428fd025d9	fcaps	eeefea88d5fef2853d4c1e3770340302	flag-o-matic	5d5921a298e95441da2f85be419894c0	libtool	52d0e17251d04645ffaa61bfdd858944	multibuild	6d4858dc00f8bc51caf3f957f8430eb0	multilib	3bf24e6abb9b76d9f6c20600f0b716bf	multilib-build	0983c7893df461213a05f791cc7dea6d	multilib-minimal	13dd976916c35a1e2c8d170e840c7018	pam	3f746974e1cc47cabe3bd488c08cdc8e	toolchain-funcs	48b38a216afb92db6314d6c3187abea3	versionator	865bc8b2fc9fcfb6d520bdf5a110f5ed
+_md5_=ff698d7b3e70154a765ec7d785a04dbb
diff --git a/sys-libs/pam/Manifest b/sys-libs/pam/Manifest
index 47b34a2..598cac7 100644
--- a/sys-libs/pam/Manifest
+++ b/sys-libs/pam/Manifest
@@ -1,2 +1,2 @@
-DIST Linux-PAM-1.1.8-docs.tar.bz2 147887 SHA256 c4bb6a0e8307d2ab5611457fecf20fcbd6cdfff51dea524f0f06c74e4f3b4ff8 SHA512 36aa99996f8cc0640686d2af40845e18ad4b48183f18de9e1495427550ad5b61e2f59e25f6d5e8df1277cd3f171fd69bf6c49fe7c5b31f0b290e3641b65521e8 WHIRLPOOL c4b373e59fac30a29c2b16f01419492c72fae2ceb15b157418bba4899b75cf4b97bac4559b688ef8d5a231cc972f72654c4e10d63a0b72a0d6573388f7125f87
-DIST Linux-PAM-1.1.8.tar.bz2 1148944 SHA256 c4b1f23a236d169e2496fea20721578d864ba00f7242d2b41d81050ac87a1e55 SHA512 245785ab4e187ceaab6393967352c8d2a2319c64e1e83285d0251cc02995dc2edab8e3001301b6d9f6774c441b7557d9caf4dfdf94c7cd5d44aa53ae759d9e5d WHIRLPOOL b4ec7baeb57b9d987086fe3e007e08e8b9c92b2ff86a94f8003a87c8448925835808661cd719d2445570aa8dd1c20fcbbe8bd465d73f4af8cd7edde0f650a734
+DIST Linux-PAM-1.2.0-docs.tar.bz2 490586 SHA256 3bc9ae398f759e372dbf4065ceed2df8b1ac5ab62c6688cb5f7849ce773df2c3 SHA512 028b7f9d6b0a5cf38f063e0f82ac3d0955e1e41d77c9f3fc803363d9ea710d71366e0a91f31b418cac397bb6639442de908fa00f02cd94cf612496d1b43c7e4c WHIRLPOOL 9a329b610d840c904050b2261e5ce34ac54232b0c7d51c12ee45c9e758ab6659ea8562e032fa9815c2beab0cfa1ea455dbfbf3cdef39d30d299a8bc5286f7a14
+DIST Linux-PAM-1.2.1.tar.bz2 1279523 SHA256 342b1211c0d3b203a7df2540a5b03a428a087bd8a48c17e49ae268f992b334d9 SHA512 4572aa1eaf5a1312410c74b5ed055b2592c5efe2bb82f59981da4e9e93555ad40aee3a89f446d9dc6c6af79efc04c33f739f66db9edc07e02479475a14e426da WHIRLPOOL 562917945b3b3a407955cc5bf5cd251ff7e257a94055d7cfbf06d5c2619b58d61624f16848de3512ddf61636ad8618315de3f7bd8e4e51b3b7d109adfa212c8a
diff --git a/sys-libs/pam/files/Linux-PAM-1.1.5+glibc-2.16.patch b/sys-libs/pam/files/Linux-PAM-1.1.5+glibc-2.16.patch
new file mode 100644
index 0000000..114d3e4
--- /dev/null
+++ b/sys-libs/pam/files/Linux-PAM-1.1.5+glibc-2.16.patch
@@ -0,0 +1,20 @@
+--- a/modules/pam_unix/pam_unix_acct.c	2011-06-21 11:04:56.000000000 +0200
++++ b/modules/pam_unix/pam_unix_acct.c	2012-07-05 16:04:35.643727485 +0200
+@@ -41,6 +41,7 @@
+ #include <string.h>
+ #include <unistd.h>
+ #include <sys/types.h>
++#include <sys/resource.h>
+ #include <syslog.h>
+ #include <pwd.h>
+ #include <shadow.h>
+--- a/modules/pam_unix/pam_unix_passwd.c	2012-07-16 11:49:25.954638105 -0500
++++ b/modules/pam_unix/pam_unix_passwd.c	2012-07-16 11:50:04.408635441 -0500
+@@ -46,6 +46,7 @@
+ #include <unistd.h>
+ #include <errno.h>
+ #include <sys/types.h>
++#include <sys/resource.h>
+ #include <pwd.h>
+ #include <syslog.h>
+ #include <shadow.h>
diff --git a/sys-libs/pam/files/Linux-PAM-1.1.6+glibc-2.16.patch b/sys-libs/pam/files/Linux-PAM-1.1.6+glibc-2.16.patch
new file mode 100644
index 0000000..cddda35
--- /dev/null
+++ b/sys-libs/pam/files/Linux-PAM-1.1.6+glibc-2.16.patch
@@ -0,0 +1,29 @@
+From 18da0c4763f5e079f8b2df45fa462b0b70b6fd3a Mon Sep 17 00:00:00 2001
+From: "Jory A. Pratt" <anarchy@gentoo.org>
+Date: Sun, 7 Oct 2012 11:44:17 -0700
+Subject: [PATCH] Fix building with GLIBC 2.16 and SELinux.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+
+Signed-off-by: Diego Elio Pettenò <flameeyes@flameeyes.eu>
+---
+ modules/pam_unix/pam_unix_passwd.c | 1 +
+ 1 file modificato, 1 inserzione(+)
+
+diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c
+index 9e1302d..b5f5ae9 100644
+--- a/modules/pam_unix/pam_unix_passwd.c
++++ b/modules/pam_unix/pam_unix_passwd.c
+@@ -46,6 +46,7 @@
+ #include <unistd.h>
+ #include <errno.h>
+ #include <sys/types.h>
++#include <sys/resource.h>
+ #include <pwd.h>
+ #include <syslog.h>
+ #include <shadow.h>
+-- 
+1.7.12
+
diff --git a/sys-libs/pam/files/Linux-PAM-1.1.6-destdir.patch b/sys-libs/pam/files/Linux-PAM-1.1.6-destdir.patch
new file mode 100644
index 0000000..6859ccb
--- /dev/null
+++ b/sys-libs/pam/files/Linux-PAM-1.1.6-destdir.patch
@@ -0,0 +1,48 @@
+From d7e6b921cd34f7ad8fc4d05065c75d13ba330896 Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <tmraz@fedoraproject.org>
+Date: Fri, 17 Aug 2012 14:46:40 +0200
+Subject: [PATCH] Add missing $(DESTDIR) when making directories on install.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+modules/pam_namespace/Makefile.am: Add missing $(DESTDIR) when making
+$(namespaceddir) on install.
+modules/pam_sepermit/Makefile.am: Add missing $(DESTDIR) when making
+$(sepermitlockdir) on install.
+
+Signed-off-by: Diego Elio Pettenò <flameeyes@flameeyes.eu>
+---
+ modules/pam_namespace/Makefile.am |    2 +-
+ modules/pam_sepermit/Makefile.am  |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/modules/pam_namespace/Makefile.am b/modules/pam_namespace/Makefile.am
+index a28f196..ebb00f3 100644
+--- a/modules/pam_namespace/Makefile.am
++++ b/modules/pam_namespace/Makefile.am
+@@ -40,7 +40,7 @@ if HAVE_UNSHARE
+   secureconf_SCRIPTS = namespace.init
+ 
+ install-data-local:
+-	mkdir -p $(namespaceddir)
++	mkdir -p $(DESTDIR)$(namespaceddir)
+ endif
+ 
+ 
+diff --git a/modules/pam_sepermit/Makefile.am b/modules/pam_sepermit/Makefile.am
+index cfc5594..bc82275 100644
+--- a/modules/pam_sepermit/Makefile.am
++++ b/modules/pam_sepermit/Makefile.am
+@@ -35,7 +35,7 @@ if HAVE_LIBSELINUX
+   securelib_LTLIBRARIES = pam_sepermit.la
+ 
+ install-data-local:
+-	mkdir -p $(sepermitlockdir)
++	mkdir -p $(DESTDIR)$(sepermitlockdir)
+ endif
+ if ENABLE_REGENERATE_MAN
+ noinst_DATA = README pam_sepermit.8 sepermit.conf.5
+-- 
+1.7.8.6
+
diff --git a/sys-libs/pam/files/pam-1.1.8-CVE-2013-7041.patch b/sys-libs/pam/files/pam-1.1.8-CVE-2013-7041.patch
new file mode 100644
index 0000000..338aa96
--- /dev/null
+++ b/sys-libs/pam/files/pam-1.1.8-CVE-2013-7041.patch
@@ -0,0 +1,54 @@
+https://bugs.gentoo.org/493432
+
+From 57a1e2b274d0a6376d92ada9926e5c5741e7da20 Mon Sep 17 00:00:00 2001
+From: "Dmitry V. Levin" <ldv@altlinux.org>
+Date: Fri, 24 Jan 2014 22:18:32 +0000
+Subject: [PATCH] pam_userdb: fix password hash comparison
+
+Starting with commit Linux-PAM-0-77-28-g0b3e583 that introduced hashed
+passwords support in pam_userdb, hashes are compared case-insensitively.
+This bug leads to accepting hashes for completely different passwords in
+addition to those that should be accepted.
+
+Additionally, commit Linux-PAM-1_1_6-13-ge2a8187 that added support for
+modern password hashes with different lengths and settings, did not
+update the hash comparison accordingly, which leads to accepting
+computed hashes longer than stored hashes when the latter is a prefix
+of the former.
+
+* modules/pam_userdb/pam_userdb.c (user_lookup): Reject the computed
+hash whose length differs from the stored hash length.
+Compare computed and stored hashes case-sensitively.
+Fixes CVE-2013-7041.
+
+Bug-Debian: http://bugs.debian.org/731368
+---
+ modules/pam_userdb/pam_userdb.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/modules/pam_userdb/pam_userdb.c b/modules/pam_userdb/pam_userdb.c
+index de8b5b1..ff040e6 100644
+--- a/modules/pam_userdb/pam_userdb.c
++++ b/modules/pam_userdb/pam_userdb.c
+@@ -222,12 +222,15 @@ user_lookup (pam_handle_t *pamh, const char *database, const char *cryptmode,
+ 	  } else {
+ 	    cryptpw = crypt (pass, data.dptr);
+ 
+-	    if (cryptpw) {
+-	      compare = strncasecmp (data.dptr, cryptpw, data.dsize);
++	    if (cryptpw && strlen(cryptpw) == (size_t)data.dsize) {
++	      compare = memcmp(data.dptr, cryptpw, data.dsize);
+ 	    } else {
+ 	      compare = -2;
+ 	      if (ctrl & PAM_DEBUG_ARG) {
+-		pam_syslog(pamh, LOG_INFO, "crypt() returned NULL");
++		if (cryptpw)
++		  pam_syslog(pamh, LOG_INFO, "lengths of computed and stored hashes differ");
++		else
++		  pam_syslog(pamh, LOG_INFO, "crypt() returned NULL");
+ 	      }
+ 	    };
+ 
+-- 
+2.4.0
+
diff --git a/sys-libs/pam/files/pam-1.1.8-CVE-2014-2583.patch b/sys-libs/pam/files/pam-1.1.8-CVE-2014-2583.patch
new file mode 100644
index 0000000..7965b77
--- /dev/null
+++ b/sys-libs/pam/files/pam-1.1.8-CVE-2014-2583.patch
@@ -0,0 +1,58 @@
+https://bugs.gentoo.org/505604
+
+From 9dcead87e6d7f66d34e7a56d11a30daca367dffb Mon Sep 17 00:00:00 2001
+From: "Dmitry V. Levin" <ldv@altlinux.org>
+Date: Wed, 26 Mar 2014 22:17:23 +0000
+Subject: [PATCH] pam_timestamp: fix potential directory traversal issue
+ (ticket #27)
+
+pam_timestamp uses values of PAM_RUSER and PAM_TTY as components of
+the timestamp pathname it creates, so extra care should be taken to
+avoid potential directory traversal issues.
+
+* modules/pam_timestamp/pam_timestamp.c (check_tty): Treat
+"." and ".." tty values as invalid.
+(get_ruser): Treat "." and ".." ruser values, as well as any ruser
+value containing '/', as invalid.
+
+Fixes CVE-2014-2583.
+
+Reported-by: Sebastian Krahmer <krahmer@suse.de>
+---
+ modules/pam_timestamp/pam_timestamp.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/modules/pam_timestamp/pam_timestamp.c b/modules/pam_timestamp/pam_timestamp.c
+index 5193733..b3f08b1 100644
+--- a/modules/pam_timestamp/pam_timestamp.c
++++ b/modules/pam_timestamp/pam_timestamp.c
+@@ -158,7 +158,7 @@ check_tty(const char *tty)
+ 		tty = strrchr(tty, '/') + 1;
+ 	}
+ 	/* Make sure the tty wasn't actually a directory (no basename). */
+-	if (strlen(tty) == 0) {
++	if (!strlen(tty) || !strcmp(tty, ".") || !strcmp(tty, "..")) {
+ 		return NULL;
+ 	}
+ 	return tty;
+@@ -243,6 +243,17 @@ get_ruser(pam_handle_t *pamh, char *ruserbuf, size_t ruserbuflen)
+ 		if (pwd != NULL) {
+ 			ruser = pwd->pw_name;
+ 		}
++	} else {
++		/*
++		 * This ruser is used by format_timestamp_name as a component
++		 * of constructed timestamp pathname, so ".", "..", and '/'
++		 * are disallowed to avoid potential path traversal issues.
++		 */
++		if (!strcmp(ruser, ".") ||
++		    !strcmp(ruser, "..") ||
++		    strchr(ruser, '/')) {
++			ruser = NULL;
++		}
+ 	}
+ 	if (ruser == NULL || strlen(ruser) >= ruserbuflen) {
+ 		*ruserbuf = '\0';
+-- 
+2.4.0
+
diff --git a/sys-libs/pam/pam-1.1.8-r2.ebuild b/sys-libs/pam/pam-1.2.1-r1.ebuild
similarity index 82%
rename from sys-libs/pam/pam-1.1.8-r2.ebuild
rename to sys-libs/pam/pam-1.2.1-r1.ebuild
index 47ffcdd..971b0a7 100644
--- a/sys-libs/pam/pam-1.1.8-r2.ebuild
+++ b/sys-libs/pam/pam-1.2.1-r1.ebuild
@@ -1,34 +1,30 @@
-# Copyright 1999-2014 Gentoo Foundation
+# Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-libs/pam/pam-1.1.8-r2.ebuild,v 1.12 2014/09/15 08:24:10 ago Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-libs/pam/pam-1.2.1-r1.ebuild,v 1.1 2015/07/13 05:03:16 vapier Exp $
 
 EAPI=5
 
-inherit libtool multilib multilib-minimal eutils pam toolchain-funcs flag-o-matic db-use
+inherit libtool multilib multilib-minimal eutils pam toolchain-funcs flag-o-matic db-use fcaps
 
 MY_PN="Linux-PAM"
 MY_P="${MY_PN}-${PV}"
 
-HOMEPAGE="https://fedorahosted.org/linux-pam/"
 DESCRIPTION="Linux-PAM (Pluggable Authentication Modules)"
-
+HOMEPAGE="http://www.linux-pam.org/ https://fedorahosted.org/linux-pam/"
 SRC_URI="http://www.linux-pam.org/library/${MY_P}.tar.bz2
-	http://www.linux-pam.org/documentation/${MY_P}-docs.tar.bz2"
+	http://www.linux-pam.org/documentation/${MY_PN}-1.2.0-docs.tar.bz2"
 
 LICENSE="|| ( BSD GPL-2 )"
 SLOT="0"
 KEYWORDS="*"
-IUSE="cracklib nls elibc_FreeBSD selinux vim-syntax audit test elibc_glibc debug berkdb nis"
+IUSE="audit berkdb cracklib debug nis nls +pie selinux test vim-syntax"
 
 RDEPEND="nls? ( >=virtual/libintl-0-r1[${MULTILIB_USEDEP}] )
 	cracklib? ( >=sys-libs/cracklib-2.9.1-r1[${MULTILIB_USEDEP}] )
 	audit? ( >=sys-process/audit-2.2.2[${MULTILIB_USEDEP}] )
 	selinux? ( >=sys-libs/libselinux-2.2.2-r4[${MULTILIB_USEDEP}] )
 	berkdb? ( >=sys-libs/db-4.8.30-r1[${MULTILIB_USEDEP}] )
-	elibc_glibc? (
-		>=sys-libs/glibc-2.7
-		nis? ( || ( >=net-libs/libtirpc-0.2.4-r2[${MULTILIB_USEDEP}] <sys-libs/glibc-2.14 ) )
-	)"
+	nis? ( >=net-libs/libtirpc-0.2.4-r2[${MULTILIB_USEDEP}] )"
 DEPEND="${RDEPEND}
 	>=sys-devel/libtool-2
 	>=sys-devel/flex-2.5.39-r1[${MULTILIB_USEDEP}]
@@ -80,7 +76,7 @@
 		retval=1
 	fi
 
-	return $retval
+	return ${retval}
 }
 
 pkg_pretend() {
@@ -89,23 +85,32 @@
 	check_old_modules
 }
 
-src_prepare() {
-	epatch "${FILESDIR}"/${PN}-1.1.8-doc-install.patch #473650
+src_unpack() {
+	# Upstream didn't release a new doc tarball (since nothing changed?).
+	unpack ${MY_PN}-1.2.0-docs.tar.bz2
+	mv Linux-PAM-1.2.{0,1} || die
+	unpack ${MY_P}.tar.bz2
+}
 
+src_prepare() {
 	elibtoolize
 }
 
 multilib_src_configure() {
+	# Do not let user's BROWSER setting mess us up. #549684
+	unset BROWSER
+
 	# Disable automatic detection of libxcrypt; we _don't_ want the
 	# user to link libxcrypt in by default, since we won't track the
 	# dependency and allow to break PAM this way.
 	export ac_cv_header_xcrypt_h=no
 
 	local myconf=(
-		--htmldir="${EPREFIX}"/usr/share/doc/${PF}/html
-		--libdir="${EPREFIX}"/usr/$(get_libdir) \
+		--docdir='$(datarootdir)'/doc/${PF}
+		--htmldir='$(docdir)/html'
+		--libdir='$(prefix)'/$(get_libdir)
 		--enable-securedir="${EPREFIX}"/$(get_libdir)/security
-		--enable-isadir="${EPREFIX}"/$(get_libdir)/security
+		--enable-isadir='.' #464016
 		$(use_enable nls)
 		$(use_enable selinux)
 		$(use_enable cracklib)
@@ -113,14 +118,11 @@
 		$(use_enable debug)
 		$(use_enable berkdb db)
 		$(use_enable nis)
+		$(use_enable pie)
 		--with-db-uniquename=-$(db_findver sys-libs/db)
 		--disable-prelude
 	)
 
-	if use hppa || use elibc_FreeBSD; then
-		myconf+=( --disable-pie )
-	fi
-
 	ECONF_SOURCE=${S} \
 	econf "${myconf[@]}"
 }
@@ -156,10 +158,8 @@
 	einstalldocs
 	prune_libtool_files --all
 
-	# Need to be suid
-	fperms u+s /sbin/unix_chkpwd
-
 	docinto modules
+	local dir
 	for dir in modules/pam_*; do
 		newdoc "${dir}"/README README."$(basename "${dir}")"
 	done
@@ -195,4 +195,8 @@
 		elog "  chmod -x /var/log/tallylog"
 		elog ""
 	fi
+
+	# The pam_unix module needs to check the password of the user which requires
+	# read access to /etc/shadow only.
+	fcaps cap_dac_override sbin/unix_chkpwd
 }