Vendor import of OpenPAM Lycopsida.

67 files changed, 1816 insertions, 935 deletions

diff --git a/lib/Makefile.am b/lib/Makefile.am
index c748079..3a2e60e 100644
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -1,4 +1,4 @@
-# $Id: Makefile.am 395 2007-06-03 20:26:18Z des $
+# $Id: Makefile.am 499 2011-11-22 11:51:50Z des $
 
 NULL =
 
@@ -6,11 +6,18 @@ INCLUDES = -I$(top_srcdir)/include
 
 lib_LTLIBRARIES = libpam.la
 
-noinst_HEADERS = openpam_impl.h
+noinst_HEADERS = \
+	openpam_constants.h \
+	openpam_debug.h \
+	openpam_impl.h \
+	openpam_strlcmp.h \
+	openpam_strlcpy.h
 
 libpam_la_SOURCES = \
 	openpam_borrow_cred.c \
+	openpam_check_owner_perms.c \
 	openpam_configure.c \
+	openpam_constants.c \
 	openpam_dispatch.c \
 	openpam_dynamic.c \
 	openpam_findenv.c \
@@ -24,6 +31,7 @@ libpam_la_SOURCES = \
 	openpam_restore_cred.c \
 	openpam_set_option.c \
 	openpam_static.c \
+	openpam_subst.c \
 	openpam_ttyconv.c \
 	pam_acct_mgmt.c \
 	pam_authenticate.c \
@@ -52,9 +60,8 @@ libpam_la_SOURCES = \
 	pam_vprompt.c \
 	$(NULL)
 
-libpam_la_CFLAGS = -DOPENPAM_MODULES_DIR='"@OPENPAM_MODULES_DIR@/"'
-
-libpam_la_LDFLAGS = -no-undefined -version-info @LIB_MAJ@ @DL_LIBS@
+libpam_la_LDFLAGS = -no-undefined -version-info @LIB_MAJ@
+libpam_la_LIBADD = @DL_LIBS@
 
 EXTRA_DIST = \
 	pam_authenticate_secondary.c \
diff --git a/lib/Makefile.in b/lib/Makefile.in
index f1ab0ad..0052ce2 100644
--- a/lib/Makefile.in
+++ b/lib/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.9.6 from Makefile.am.
+# Makefile.in generated by automake 1.11.1 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005  Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009  Free Software Foundation,
+# Inc.
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
@@ -14,18 +15,15 @@
 
 @SET_MAKE@
 
-# $Id: Makefile.am 395 2007-06-03 20:26:18Z des $
+# $Id: Makefile.am 499 2011-11-22 11:51:50Z des $
 
 
-srcdir = @srcdir@
-top_srcdir = @top_srcdir@
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
-top_builddir = ..
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
 am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
-INSTALL = @INSTALL@
 install_sh_DATA = $(install_sh) -c -m 644
 install_sh_PROGRAM = $(install_sh) -c
 install_sh_SCRIPT = $(install_sh) -c
@@ -39,7 +37,6 @@ PRE_UNINSTALL = :
 POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
-target_triplet = @target@
 subdir = lib
 DIST_COMMON = $(noinst_HEADERS) $(srcdir)/Makefile.am \
 	$(srcdir)/Makefile.in
@@ -50,53 +47,65 @@ am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
 am__vpath_adj = case $$p in \
     $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
     *) f=$$p;; \
   esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
 am__installdirs = "$(DESTDIR)$(libdir)"
-libLTLIBRARIES_INSTALL = $(INSTALL)
 LTLIBRARIES = $(lib_LTLIBRARIES)
-libpam_la_LIBADD =
+libpam_la_DEPENDENCIES =
 am__objects_1 =
-am_libpam_la_OBJECTS = libpam_la-openpam_borrow_cred.lo \
-	libpam_la-openpam_configure.lo libpam_la-openpam_dispatch.lo \
-	libpam_la-openpam_dynamic.lo libpam_la-openpam_findenv.lo \
-	libpam_la-openpam_free_data.lo \
-	libpam_la-openpam_free_envlist.lo \
-	libpam_la-openpam_get_option.lo libpam_la-openpam_load.lo \
-	libpam_la-openpam_log.lo libpam_la-openpam_nullconv.lo \
-	libpam_la-openpam_readline.lo \
-	libpam_la-openpam_restore_cred.lo \
-	libpam_la-openpam_set_option.lo libpam_la-openpam_static.lo \
-	libpam_la-openpam_ttyconv.lo libpam_la-pam_acct_mgmt.lo \
-	libpam_la-pam_authenticate.lo libpam_la-pam_chauthtok.lo \
-	libpam_la-pam_close_session.lo libpam_la-pam_end.lo \
-	libpam_la-pam_error.lo libpam_la-pam_get_authtok.lo \
-	libpam_la-pam_get_data.lo libpam_la-pam_get_item.lo \
-	libpam_la-pam_get_user.lo libpam_la-pam_getenv.lo \
-	libpam_la-pam_getenvlist.lo libpam_la-pam_info.lo \
-	libpam_la-pam_open_session.lo libpam_la-pam_prompt.lo \
-	libpam_la-pam_putenv.lo libpam_la-pam_set_data.lo \
-	libpam_la-pam_set_item.lo libpam_la-pam_setcred.lo \
-	libpam_la-pam_setenv.lo libpam_la-pam_start.lo \
-	libpam_la-pam_strerror.lo libpam_la-pam_verror.lo \
-	libpam_la-pam_vinfo.lo libpam_la-pam_vprompt.lo \
-	$(am__objects_1)
+am_libpam_la_OBJECTS = openpam_borrow_cred.lo \
+	openpam_check_owner_perms.lo openpam_configure.lo \
+	openpam_constants.lo openpam_dispatch.lo openpam_dynamic.lo \
+	openpam_findenv.lo openpam_free_data.lo \
+	openpam_free_envlist.lo openpam_get_option.lo openpam_load.lo \
+	openpam_log.lo openpam_nullconv.lo openpam_readline.lo \
+	openpam_restore_cred.lo openpam_set_option.lo \
+	openpam_static.lo openpam_subst.lo openpam_ttyconv.lo \
+	pam_acct_mgmt.lo pam_authenticate.lo pam_chauthtok.lo \
+	pam_close_session.lo pam_end.lo pam_error.lo \
+	pam_get_authtok.lo pam_get_data.lo pam_get_item.lo \
+	pam_get_user.lo pam_getenv.lo pam_getenvlist.lo pam_info.lo \
+	pam_open_session.lo pam_prompt.lo pam_putenv.lo \
+	pam_set_data.lo pam_set_item.lo pam_setcred.lo pam_setenv.lo \
+	pam_start.lo pam_strerror.lo pam_verror.lo pam_vinfo.lo \
+	pam_vprompt.lo $(am__objects_1)
 libpam_la_OBJECTS = $(am_libpam_la_OBJECTS)
-DEFAULT_INCLUDES = -I. -I$(srcdir) -I$(top_builddir)
+libpam_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(libpam_la_LDFLAGS) $(LDFLAGS) -o $@
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
 am__depfiles_maybe = depfiles
+am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
-LTCOMPILE = $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) \
-	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
-	$(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+	--mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
+	$(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
 CCLD = $(CC)
-LINK = $(LIBTOOL) --tag=CC --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
-	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+	--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
+	$(LDFLAGS) -o $@
 SOURCES = $(libpam_la_SOURCES)
 DIST_SOURCES = $(libpam_la_SOURCES)
 HEADERS = $(noinst_HEADERS)
@@ -104,8 +113,6 @@ ETAGS = etags
 CTAGS = ctags
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
-AMDEP_FALSE = @AMDEP_FALSE@
-AMDEP_TRUE = @AMDEP_TRUE@
 AMTAR = @AMTAR@
 AR = @AR@
 AUTOCONF = @AUTOCONF@
@@ -118,42 +125,50 @@ CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CRYPT_LIBS = @CRYPT_LIBS@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
+DLLTOOL = @DLLTOOL@
 DL_LIBS = @DL_LIBS@
-ECHO = @ECHO@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
 ECHO_C = @ECHO_C@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
-F77 = @F77@
-FFLAGS = @FFLAGS@
+FGREP = @FGREP@
 GREP = @GREP@
+INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
 INSTALL_PROGRAM = @INSTALL_PROGRAM@
 INSTALL_SCRIPT = @INSTALL_SCRIPT@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LD = @LD@
 LDFLAGS = @LDFLAGS@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@
 LIB_MAJ = @LIB_MAJ@
+LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+NM = @NM@
+NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
 OBJEXT = @OBJEXT@
 OPENPAM_MODULES_DIR = @OPENPAM_MODULES_DIR@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
 PACKAGE = @PACKAGE@
 PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
 PACKAGE_NAME = @PACKAGE_NAME@
 PACKAGE_STRING = @PACKAGE_STRING@
 PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 RANLIB = @RANLIB@
@@ -162,19 +177,13 @@ SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
 VERSION = @VERSION@
-WITH_DOC_FALSE = @WITH_DOC_FALSE@
-WITH_DOC_TRUE = @WITH_DOC_TRUE@
-WITH_PAM_UNIX_FALSE = @WITH_PAM_UNIX_FALSE@
-WITH_PAM_UNIX_TRUE = @WITH_PAM_UNIX_TRUE@
-WITH_SU_FALSE = @WITH_SU_FALSE@
-WITH_SU_TRUE = @WITH_SU_TRUE@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
-ac_ct_F77 = @ac_ct_F77@
-am__fastdepCC_FALSE = @am__fastdepCC_FALSE@
-am__fastdepCC_TRUE = @am__fastdepCC_TRUE@
-am__fastdepCXX_FALSE = @am__fastdepCXX_FALSE@
-am__fastdepCXX_TRUE = @am__fastdepCXX_TRUE@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
@@ -186,6 +195,7 @@ build_alias = @build_alias@
 build_cpu = @build_cpu@
 build_os = @build_os@
 build_vendor = @build_vendor@
+builddir = @builddir@
 datadir = @datadir@
 datarootdir = @datarootdir@
 docdir = @docdir@
@@ -213,19 +223,27 @@ program_transform_name = @program_transform_name@
 psdir = @psdir@
 sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
 sysconfdir = @sysconfdir@
-target = @target@
 target_alias = @target_alias@
-target_cpu = @target_cpu@
-target_os = @target_os@
-target_vendor = @target_vendor@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
 NULL = 
 INCLUDES = -I$(top_srcdir)/include
 lib_LTLIBRARIES = libpam.la
-noinst_HEADERS = openpam_impl.h
+noinst_HEADERS = \
+	openpam_constants.h \
+	openpam_debug.h \
+	openpam_impl.h \
+	openpam_strlcmp.h \
+	openpam_strlcpy.h
+
 libpam_la_SOURCES = \
 	openpam_borrow_cred.c \
+	openpam_check_owner_perms.c \
 	openpam_configure.c \
+	openpam_constants.c \
 	openpam_dispatch.c \
 	openpam_dynamic.c \
 	openpam_findenv.c \
@@ -239,6 +257,7 @@ libpam_la_SOURCES = \
 	openpam_restore_cred.c \
 	openpam_set_option.c \
 	openpam_static.c \
+	openpam_subst.c \
 	openpam_ttyconv.c \
 	pam_acct_mgmt.c \
 	pam_authenticate.c \
@@ -267,8 +286,8 @@ libpam_la_SOURCES = \
 	pam_vprompt.c \
 	$(NULL)
 
-libpam_la_CFLAGS = -DOPENPAM_MODULES_DIR='"@OPENPAM_MODULES_DIR@/"'
-libpam_la_LDFLAGS = -no-undefined -version-info @LIB_MAJ@ @DL_LIBS@
+libpam_la_LDFLAGS = -no-undefined -version-info @LIB_MAJ@
+libpam_la_LIBADD = @DL_LIBS@
 EXTRA_DIST = \
 	pam_authenticate_secondary.c \
 	pam_get_mapped_authtok.c \
@@ -296,14 +315,14 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
-	      cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
-		&& exit 0; \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign  lib/Makefile'; \
-	cd $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign  lib/Makefile
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign lib/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign lib/Makefile
 .PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
@@ -321,23 +340,28 @@ $(top_srcdir)/configure:  $(am__configure_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(ACLOCAL_M4):  $(am__aclocal_m4_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
 install-libLTLIBRARIES: $(lib_LTLIBRARIES)
 	@$(NORMAL_INSTALL)
-	test -z "$(libdir)" || $(mkdir_p) "$(DESTDIR)$(libdir)"
-	@list='$(lib_LTLIBRARIES)'; for p in $$list; do \
+	test -z "$(libdir)" || $(MKDIR_P) "$(DESTDIR)$(libdir)"
+	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+	list2=; for p in $$list; do \
 	  if test -f $$p; then \
-	    f=$(am__strip_dir) \
-	    echo " $(LIBTOOL) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(libdir)/$$f'"; \
-	    $(LIBTOOL) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(libdir)/$$f"; \
+	    list2="$$list2 $$p"; \
 	  else :; fi; \
-	done
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(libdir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(libdir)"; \
+	}
 
 uninstall-libLTLIBRARIES:
 	@$(NORMAL_UNINSTALL)
-	@set -x; list='$(lib_LTLIBRARIES)'; for p in $$list; do \
-	  p=$(am__strip_dir) \
-	  echo " $(LIBTOOL) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$p'"; \
-	  $(LIBTOOL) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$p"; \
+	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$f"; \
 	done
 
 clean-libLTLIBRARIES:
@@ -349,7 +373,7 @@ clean-libLTLIBRARIES:
 	  rm -f "$${dir}/so_locations"; \
 	done
 libpam.la: $(libpam_la_OBJECTS) $(libpam_la_DEPENDENCIES) 
-	$(LINK) -rpath $(libdir) $(libpam_la_LDFLAGS) $(libpam_la_OBJECTS) $(libpam_la_LIBADD) $(LIBS)
+	$(libpam_la_LINK) -rpath $(libdir) $(libpam_la_OBJECTS) $(libpam_la_LIBADD) $(LIBS)
 
 mostlyclean-compile:
 	-rm -f *.$(OBJEXT)
@@ -357,438 +381,157 @@ mostlyclean-compile:
 distclean-compile:
 	-rm -f *.tab.c
 
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_borrow_cred.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_configure.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_dispatch.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_dynamic.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_findenv.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_free_data.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_free_envlist.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_get_option.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_load.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_log.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_nullconv.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_readline.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_restore_cred.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_set_option.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_static.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-openpam_ttyconv.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_acct_mgmt.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_authenticate.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_chauthtok.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_close_session.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_end.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_error.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_get_authtok.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_get_data.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_get_item.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_get_user.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_getenv.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_getenvlist.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_info.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_open_session.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_prompt.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_putenv.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_set_data.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_set_item.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_setcred.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_setenv.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_start.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_strerror.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_verror.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_vinfo.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libpam_la-pam_vprompt.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_borrow_cred.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_check_owner_perms.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_configure.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_constants.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_dispatch.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_dynamic.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_findenv.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_free_data.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_free_envlist.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_get_option.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_load.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_log.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_nullconv.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_readline.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_restore_cred.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_set_option.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_static.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_subst.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/openpam_ttyconv.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_acct_mgmt.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_authenticate.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_chauthtok.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_close_session.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_end.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_error.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_get_authtok.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_get_data.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_get_item.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_get_user.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_getenv.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_getenvlist.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_info.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_open_session.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_prompt.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_putenv.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_set_data.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_set_item.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_setcred.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_setenv.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_start.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_strerror.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_verror.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_vinfo.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_vprompt.Plo@am__quote@
 
 .c.o:
-@am__fastdepCC_TRUE@	if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ $<; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
+@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(COMPILE) -c $<
 
 .c.obj:
-@am__fastdepCC_TRUE@	if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ `$(CYGPATH_W) '$<'`; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
+@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
-@am__fastdepCC_TRUE@	if $(LTCOMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ $<; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Plo"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
+@am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(LTCOMPILE) -c -o $@ $<
 
-libpam_la-openpam_borrow_cred.lo: openpam_borrow_cred.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_borrow_cred.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_borrow_cred.Tpo" -c -o libpam_la-openpam_borrow_cred.lo `test -f 'openpam_borrow_cred.c' || echo '$(srcdir)/'`openpam_borrow_cred.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_borrow_cred.Tpo" "$(DEPDIR)/libpam_la-openpam_borrow_cred.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_borrow_cred.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_borrow_cred.c' object='libpam_la-openpam_borrow_cred.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_borrow_cred.lo `test -f 'openpam_borrow_cred.c' || echo '$(srcdir)/'`openpam_borrow_cred.c
-
-libpam_la-openpam_configure.lo: openpam_configure.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_configure.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_configure.Tpo" -c -o libpam_la-openpam_configure.lo `test -f 'openpam_configure.c' || echo '$(srcdir)/'`openpam_configure.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_configure.Tpo" "$(DEPDIR)/libpam_la-openpam_configure.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_configure.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_configure.c' object='libpam_la-openpam_configure.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_configure.lo `test -f 'openpam_configure.c' || echo '$(srcdir)/'`openpam_configure.c
-
-libpam_la-openpam_dispatch.lo: openpam_dispatch.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_dispatch.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_dispatch.Tpo" -c -o libpam_la-openpam_dispatch.lo `test -f 'openpam_dispatch.c' || echo '$(srcdir)/'`openpam_dispatch.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_dispatch.Tpo" "$(DEPDIR)/libpam_la-openpam_dispatch.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_dispatch.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_dispatch.c' object='libpam_la-openpam_dispatch.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_dispatch.lo `test -f 'openpam_dispatch.c' || echo '$(srcdir)/'`openpam_dispatch.c
-
-libpam_la-openpam_dynamic.lo: openpam_dynamic.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_dynamic.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_dynamic.Tpo" -c -o libpam_la-openpam_dynamic.lo `test -f 'openpam_dynamic.c' || echo '$(srcdir)/'`openpam_dynamic.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_dynamic.Tpo" "$(DEPDIR)/libpam_la-openpam_dynamic.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_dynamic.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_dynamic.c' object='libpam_la-openpam_dynamic.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_dynamic.lo `test -f 'openpam_dynamic.c' || echo '$(srcdir)/'`openpam_dynamic.c
-
-libpam_la-openpam_findenv.lo: openpam_findenv.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_findenv.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_findenv.Tpo" -c -o libpam_la-openpam_findenv.lo `test -f 'openpam_findenv.c' || echo '$(srcdir)/'`openpam_findenv.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_findenv.Tpo" "$(DEPDIR)/libpam_la-openpam_findenv.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_findenv.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_findenv.c' object='libpam_la-openpam_findenv.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_findenv.lo `test -f 'openpam_findenv.c' || echo '$(srcdir)/'`openpam_findenv.c
-
-libpam_la-openpam_free_data.lo: openpam_free_data.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_free_data.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_free_data.Tpo" -c -o libpam_la-openpam_free_data.lo `test -f 'openpam_free_data.c' || echo '$(srcdir)/'`openpam_free_data.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_free_data.Tpo" "$(DEPDIR)/libpam_la-openpam_free_data.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_free_data.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_free_data.c' object='libpam_la-openpam_free_data.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_free_data.lo `test -f 'openpam_free_data.c' || echo '$(srcdir)/'`openpam_free_data.c
-
-libpam_la-openpam_free_envlist.lo: openpam_free_envlist.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_free_envlist.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_free_envlist.Tpo" -c -o libpam_la-openpam_free_envlist.lo `test -f 'openpam_free_envlist.c' || echo '$(srcdir)/'`openpam_free_envlist.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_free_envlist.Tpo" "$(DEPDIR)/libpam_la-openpam_free_envlist.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_free_envlist.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_free_envlist.c' object='libpam_la-openpam_free_envlist.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_free_envlist.lo `test -f 'openpam_free_envlist.c' || echo '$(srcdir)/'`openpam_free_envlist.c
-
-libpam_la-openpam_get_option.lo: openpam_get_option.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_get_option.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_get_option.Tpo" -c -o libpam_la-openpam_get_option.lo `test -f 'openpam_get_option.c' || echo '$(srcdir)/'`openpam_get_option.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_get_option.Tpo" "$(DEPDIR)/libpam_la-openpam_get_option.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_get_option.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_get_option.c' object='libpam_la-openpam_get_option.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_get_option.lo `test -f 'openpam_get_option.c' || echo '$(srcdir)/'`openpam_get_option.c
-
-libpam_la-openpam_load.lo: openpam_load.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_load.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_load.Tpo" -c -o libpam_la-openpam_load.lo `test -f 'openpam_load.c' || echo '$(srcdir)/'`openpam_load.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_load.Tpo" "$(DEPDIR)/libpam_la-openpam_load.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_load.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_load.c' object='libpam_la-openpam_load.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_load.lo `test -f 'openpam_load.c' || echo '$(srcdir)/'`openpam_load.c
-
-libpam_la-openpam_log.lo: openpam_log.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_log.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_log.Tpo" -c -o libpam_la-openpam_log.lo `test -f 'openpam_log.c' || echo '$(srcdir)/'`openpam_log.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_log.Tpo" "$(DEPDIR)/libpam_la-openpam_log.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_log.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_log.c' object='libpam_la-openpam_log.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_log.lo `test -f 'openpam_log.c' || echo '$(srcdir)/'`openpam_log.c
-
-libpam_la-openpam_nullconv.lo: openpam_nullconv.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_nullconv.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_nullconv.Tpo" -c -o libpam_la-openpam_nullconv.lo `test -f 'openpam_nullconv.c' || echo '$(srcdir)/'`openpam_nullconv.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_nullconv.Tpo" "$(DEPDIR)/libpam_la-openpam_nullconv.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_nullconv.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_nullconv.c' object='libpam_la-openpam_nullconv.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_nullconv.lo `test -f 'openpam_nullconv.c' || echo '$(srcdir)/'`openpam_nullconv.c
-
-libpam_la-openpam_readline.lo: openpam_readline.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_readline.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_readline.Tpo" -c -o libpam_la-openpam_readline.lo `test -f 'openpam_readline.c' || echo '$(srcdir)/'`openpam_readline.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_readline.Tpo" "$(DEPDIR)/libpam_la-openpam_readline.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_readline.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_readline.c' object='libpam_la-openpam_readline.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_readline.lo `test -f 'openpam_readline.c' || echo '$(srcdir)/'`openpam_readline.c
-
-libpam_la-openpam_restore_cred.lo: openpam_restore_cred.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_restore_cred.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_restore_cred.Tpo" -c -o libpam_la-openpam_restore_cred.lo `test -f 'openpam_restore_cred.c' || echo '$(srcdir)/'`openpam_restore_cred.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_restore_cred.Tpo" "$(DEPDIR)/libpam_la-openpam_restore_cred.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_restore_cred.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_restore_cred.c' object='libpam_la-openpam_restore_cred.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_restore_cred.lo `test -f 'openpam_restore_cred.c' || echo '$(srcdir)/'`openpam_restore_cred.c
-
-libpam_la-openpam_set_option.lo: openpam_set_option.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_set_option.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_set_option.Tpo" -c -o libpam_la-openpam_set_option.lo `test -f 'openpam_set_option.c' || echo '$(srcdir)/'`openpam_set_option.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_set_option.Tpo" "$(DEPDIR)/libpam_la-openpam_set_option.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_set_option.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_set_option.c' object='libpam_la-openpam_set_option.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_set_option.lo `test -f 'openpam_set_option.c' || echo '$(srcdir)/'`openpam_set_option.c
-
-libpam_la-openpam_static.lo: openpam_static.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_static.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_static.Tpo" -c -o libpam_la-openpam_static.lo `test -f 'openpam_static.c' || echo '$(srcdir)/'`openpam_static.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_static.Tpo" "$(DEPDIR)/libpam_la-openpam_static.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_static.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_static.c' object='libpam_la-openpam_static.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_static.lo `test -f 'openpam_static.c' || echo '$(srcdir)/'`openpam_static.c
-
-libpam_la-openpam_ttyconv.lo: openpam_ttyconv.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-openpam_ttyconv.lo -MD -MP -MF "$(DEPDIR)/libpam_la-openpam_ttyconv.Tpo" -c -o libpam_la-openpam_ttyconv.lo `test -f 'openpam_ttyconv.c' || echo '$(srcdir)/'`openpam_ttyconv.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-openpam_ttyconv.Tpo" "$(DEPDIR)/libpam_la-openpam_ttyconv.Plo"; else rm -f "$(DEPDIR)/libpam_la-openpam_ttyconv.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='openpam_ttyconv.c' object='libpam_la-openpam_ttyconv.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-openpam_ttyconv.lo `test -f 'openpam_ttyconv.c' || echo '$(srcdir)/'`openpam_ttyconv.c
-
-libpam_la-pam_acct_mgmt.lo: pam_acct_mgmt.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_acct_mgmt.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_acct_mgmt.Tpo" -c -o libpam_la-pam_acct_mgmt.lo `test -f 'pam_acct_mgmt.c' || echo '$(srcdir)/'`pam_acct_mgmt.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_acct_mgmt.Tpo" "$(DEPDIR)/libpam_la-pam_acct_mgmt.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_acct_mgmt.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_acct_mgmt.c' object='libpam_la-pam_acct_mgmt.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_acct_mgmt.lo `test -f 'pam_acct_mgmt.c' || echo '$(srcdir)/'`pam_acct_mgmt.c
-
-libpam_la-pam_authenticate.lo: pam_authenticate.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_authenticate.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_authenticate.Tpo" -c -o libpam_la-pam_authenticate.lo `test -f 'pam_authenticate.c' || echo '$(srcdir)/'`pam_authenticate.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_authenticate.Tpo" "$(DEPDIR)/libpam_la-pam_authenticate.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_authenticate.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_authenticate.c' object='libpam_la-pam_authenticate.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_authenticate.lo `test -f 'pam_authenticate.c' || echo '$(srcdir)/'`pam_authenticate.c
-
-libpam_la-pam_chauthtok.lo: pam_chauthtok.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_chauthtok.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_chauthtok.Tpo" -c -o libpam_la-pam_chauthtok.lo `test -f 'pam_chauthtok.c' || echo '$(srcdir)/'`pam_chauthtok.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_chauthtok.Tpo" "$(DEPDIR)/libpam_la-pam_chauthtok.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_chauthtok.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_chauthtok.c' object='libpam_la-pam_chauthtok.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_chauthtok.lo `test -f 'pam_chauthtok.c' || echo '$(srcdir)/'`pam_chauthtok.c
-
-libpam_la-pam_close_session.lo: pam_close_session.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_close_session.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_close_session.Tpo" -c -o libpam_la-pam_close_session.lo `test -f 'pam_close_session.c' || echo '$(srcdir)/'`pam_close_session.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_close_session.Tpo" "$(DEPDIR)/libpam_la-pam_close_session.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_close_session.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_close_session.c' object='libpam_la-pam_close_session.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_close_session.lo `test -f 'pam_close_session.c' || echo '$(srcdir)/'`pam_close_session.c
-
-libpam_la-pam_end.lo: pam_end.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_end.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_end.Tpo" -c -o libpam_la-pam_end.lo `test -f 'pam_end.c' || echo '$(srcdir)/'`pam_end.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_end.Tpo" "$(DEPDIR)/libpam_la-pam_end.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_end.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_end.c' object='libpam_la-pam_end.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_end.lo `test -f 'pam_end.c' || echo '$(srcdir)/'`pam_end.c
-
-libpam_la-pam_error.lo: pam_error.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_error.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_error.Tpo" -c -o libpam_la-pam_error.lo `test -f 'pam_error.c' || echo '$(srcdir)/'`pam_error.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_error.Tpo" "$(DEPDIR)/libpam_la-pam_error.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_error.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_error.c' object='libpam_la-pam_error.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_error.lo `test -f 'pam_error.c' || echo '$(srcdir)/'`pam_error.c
-
-libpam_la-pam_get_authtok.lo: pam_get_authtok.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_get_authtok.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_get_authtok.Tpo" -c -o libpam_la-pam_get_authtok.lo `test -f 'pam_get_authtok.c' || echo '$(srcdir)/'`pam_get_authtok.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_get_authtok.Tpo" "$(DEPDIR)/libpam_la-pam_get_authtok.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_get_authtok.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_get_authtok.c' object='libpam_la-pam_get_authtok.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_get_authtok.lo `test -f 'pam_get_authtok.c' || echo '$(srcdir)/'`pam_get_authtok.c
-
-libpam_la-pam_get_data.lo: pam_get_data.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_get_data.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_get_data.Tpo" -c -o libpam_la-pam_get_data.lo `test -f 'pam_get_data.c' || echo '$(srcdir)/'`pam_get_data.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_get_data.Tpo" "$(DEPDIR)/libpam_la-pam_get_data.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_get_data.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_get_data.c' object='libpam_la-pam_get_data.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_get_data.lo `test -f 'pam_get_data.c' || echo '$(srcdir)/'`pam_get_data.c
-
-libpam_la-pam_get_item.lo: pam_get_item.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_get_item.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_get_item.Tpo" -c -o libpam_la-pam_get_item.lo `test -f 'pam_get_item.c' || echo '$(srcdir)/'`pam_get_item.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_get_item.Tpo" "$(DEPDIR)/libpam_la-pam_get_item.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_get_item.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_get_item.c' object='libpam_la-pam_get_item.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_get_item.lo `test -f 'pam_get_item.c' || echo '$(srcdir)/'`pam_get_item.c
-
-libpam_la-pam_get_user.lo: pam_get_user.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_get_user.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_get_user.Tpo" -c -o libpam_la-pam_get_user.lo `test -f 'pam_get_user.c' || echo '$(srcdir)/'`pam_get_user.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_get_user.Tpo" "$(DEPDIR)/libpam_la-pam_get_user.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_get_user.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_get_user.c' object='libpam_la-pam_get_user.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_get_user.lo `test -f 'pam_get_user.c' || echo '$(srcdir)/'`pam_get_user.c
-
-libpam_la-pam_getenv.lo: pam_getenv.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_getenv.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_getenv.Tpo" -c -o libpam_la-pam_getenv.lo `test -f 'pam_getenv.c' || echo '$(srcdir)/'`pam_getenv.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_getenv.Tpo" "$(DEPDIR)/libpam_la-pam_getenv.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_getenv.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_getenv.c' object='libpam_la-pam_getenv.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_getenv.lo `test -f 'pam_getenv.c' || echo '$(srcdir)/'`pam_getenv.c
-
-libpam_la-pam_getenvlist.lo: pam_getenvlist.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_getenvlist.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_getenvlist.Tpo" -c -o libpam_la-pam_getenvlist.lo `test -f 'pam_getenvlist.c' || echo '$(srcdir)/'`pam_getenvlist.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_getenvlist.Tpo" "$(DEPDIR)/libpam_la-pam_getenvlist.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_getenvlist.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_getenvlist.c' object='libpam_la-pam_getenvlist.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_getenvlist.lo `test -f 'pam_getenvlist.c' || echo '$(srcdir)/'`pam_getenvlist.c
-
-libpam_la-pam_info.lo: pam_info.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_info.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_info.Tpo" -c -o libpam_la-pam_info.lo `test -f 'pam_info.c' || echo '$(srcdir)/'`pam_info.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_info.Tpo" "$(DEPDIR)/libpam_la-pam_info.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_info.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_info.c' object='libpam_la-pam_info.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_info.lo `test -f 'pam_info.c' || echo '$(srcdir)/'`pam_info.c
-
-libpam_la-pam_open_session.lo: pam_open_session.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_open_session.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_open_session.Tpo" -c -o libpam_la-pam_open_session.lo `test -f 'pam_open_session.c' || echo '$(srcdir)/'`pam_open_session.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_open_session.Tpo" "$(DEPDIR)/libpam_la-pam_open_session.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_open_session.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_open_session.c' object='libpam_la-pam_open_session.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_open_session.lo `test -f 'pam_open_session.c' || echo '$(srcdir)/'`pam_open_session.c
-
-libpam_la-pam_prompt.lo: pam_prompt.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_prompt.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_prompt.Tpo" -c -o libpam_la-pam_prompt.lo `test -f 'pam_prompt.c' || echo '$(srcdir)/'`pam_prompt.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_prompt.Tpo" "$(DEPDIR)/libpam_la-pam_prompt.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_prompt.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_prompt.c' object='libpam_la-pam_prompt.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_prompt.lo `test -f 'pam_prompt.c' || echo '$(srcdir)/'`pam_prompt.c
-
-libpam_la-pam_putenv.lo: pam_putenv.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_putenv.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_putenv.Tpo" -c -o libpam_la-pam_putenv.lo `test -f 'pam_putenv.c' || echo '$(srcdir)/'`pam_putenv.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_putenv.Tpo" "$(DEPDIR)/libpam_la-pam_putenv.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_putenv.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_putenv.c' object='libpam_la-pam_putenv.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_putenv.lo `test -f 'pam_putenv.c' || echo '$(srcdir)/'`pam_putenv.c
-
-libpam_la-pam_set_data.lo: pam_set_data.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_set_data.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_set_data.Tpo" -c -o libpam_la-pam_set_data.lo `test -f 'pam_set_data.c' || echo '$(srcdir)/'`pam_set_data.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_set_data.Tpo" "$(DEPDIR)/libpam_la-pam_set_data.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_set_data.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_set_data.c' object='libpam_la-pam_set_data.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_set_data.lo `test -f 'pam_set_data.c' || echo '$(srcdir)/'`pam_set_data.c
-
-libpam_la-pam_set_item.lo: pam_set_item.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_set_item.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_set_item.Tpo" -c -o libpam_la-pam_set_item.lo `test -f 'pam_set_item.c' || echo '$(srcdir)/'`pam_set_item.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_set_item.Tpo" "$(DEPDIR)/libpam_la-pam_set_item.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_set_item.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_set_item.c' object='libpam_la-pam_set_item.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_set_item.lo `test -f 'pam_set_item.c' || echo '$(srcdir)/'`pam_set_item.c
-
-libpam_la-pam_setcred.lo: pam_setcred.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_setcred.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_setcred.Tpo" -c -o libpam_la-pam_setcred.lo `test -f 'pam_setcred.c' || echo '$(srcdir)/'`pam_setcred.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_setcred.Tpo" "$(DEPDIR)/libpam_la-pam_setcred.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_setcred.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_setcred.c' object='libpam_la-pam_setcred.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_setcred.lo `test -f 'pam_setcred.c' || echo '$(srcdir)/'`pam_setcred.c
-
-libpam_la-pam_setenv.lo: pam_setenv.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_setenv.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_setenv.Tpo" -c -o libpam_la-pam_setenv.lo `test -f 'pam_setenv.c' || echo '$(srcdir)/'`pam_setenv.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_setenv.Tpo" "$(DEPDIR)/libpam_la-pam_setenv.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_setenv.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_setenv.c' object='libpam_la-pam_setenv.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_setenv.lo `test -f 'pam_setenv.c' || echo '$(srcdir)/'`pam_setenv.c
-
-libpam_la-pam_start.lo: pam_start.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_start.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_start.Tpo" -c -o libpam_la-pam_start.lo `test -f 'pam_start.c' || echo '$(srcdir)/'`pam_start.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_start.Tpo" "$(DEPDIR)/libpam_la-pam_start.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_start.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_start.c' object='libpam_la-pam_start.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_start.lo `test -f 'pam_start.c' || echo '$(srcdir)/'`pam_start.c
-
-libpam_la-pam_strerror.lo: pam_strerror.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_strerror.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_strerror.Tpo" -c -o libpam_la-pam_strerror.lo `test -f 'pam_strerror.c' || echo '$(srcdir)/'`pam_strerror.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_strerror.Tpo" "$(DEPDIR)/libpam_la-pam_strerror.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_strerror.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_strerror.c' object='libpam_la-pam_strerror.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_strerror.lo `test -f 'pam_strerror.c' || echo '$(srcdir)/'`pam_strerror.c
-
-libpam_la-pam_verror.lo: pam_verror.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_verror.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_verror.Tpo" -c -o libpam_la-pam_verror.lo `test -f 'pam_verror.c' || echo '$(srcdir)/'`pam_verror.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_verror.Tpo" "$(DEPDIR)/libpam_la-pam_verror.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_verror.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_verror.c' object='libpam_la-pam_verror.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_verror.lo `test -f 'pam_verror.c' || echo '$(srcdir)/'`pam_verror.c
-
-libpam_la-pam_vinfo.lo: pam_vinfo.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_vinfo.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_vinfo.Tpo" -c -o libpam_la-pam_vinfo.lo `test -f 'pam_vinfo.c' || echo '$(srcdir)/'`pam_vinfo.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_vinfo.Tpo" "$(DEPDIR)/libpam_la-pam_vinfo.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_vinfo.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_vinfo.c' object='libpam_la-pam_vinfo.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_vinfo.lo `test -f 'pam_vinfo.c' || echo '$(srcdir)/'`pam_vinfo.c
-
-libpam_la-pam_vprompt.lo: pam_vprompt.c
-@am__fastdepCC_TRUE@	if $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -MT libpam_la-pam_vprompt.lo -MD -MP -MF "$(DEPDIR)/libpam_la-pam_vprompt.Tpo" -c -o libpam_la-pam_vprompt.lo `test -f 'pam_vprompt.c' || echo '$(srcdir)/'`pam_vprompt.c; \
-@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libpam_la-pam_vprompt.Tpo" "$(DEPDIR)/libpam_la-pam_vprompt.Plo"; else rm -f "$(DEPDIR)/libpam_la-pam_vprompt.Tpo"; exit 1; fi
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pam_vprompt.c' object='libpam_la-pam_vprompt.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libpam_la_CFLAGS) $(CFLAGS) -c -o libpam_la-pam_vprompt.lo `test -f 'pam_vprompt.c' || echo '$(srcdir)/'`pam_vprompt.c
-
 mostlyclean-libtool:
 	-rm -f *.lo
 
 clean-libtool:
 	-rm -rf .libs _libs
 
-distclean-libtool:
-	-rm -f libtool
-uninstall-info-am:
-
 ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
 	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
-	  $(AWK) '    { files[$$0] = 1; } \
-	       END { for (i in files) print i; }'`; \
+	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+	      END { if (nonempty) { for (i in files) print i; }; }'`; \
 	mkid -fID $$unique
 tags: TAGS
 
 TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 		$(TAGS_FILES) $(LISP)
-	tags=; \
+	set x; \
 	here=`pwd`; \
 	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
-	  $(AWK) '    { files[$$0] = 1; } \
-	       END { for (i in files) print i; }'`; \
-	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+	      END { if (nonempty) { for (i in files) print i; }; }'`; \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
 	  test -n "$$unique" || unique=$$empty_fix; \
-	  $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	    $$tags $$unique; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
 	fi
 ctags: CTAGS
 CTAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 		$(TAGS_FILES) $(LISP)
-	tags=; \
-	here=`pwd`; \
 	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
-	  $(AWK) '    { files[$$0] = 1; } \
-	       END { for (i in files) print i; }'`; \
-	test -z "$(CTAGS_ARGS)$$tags$$unique" \
+	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+	      END { if (nonempty) { for (i in files) print i; }; }'`; \
+	test -z "$(CTAGS_ARGS)$$unique" \
 	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
-	     $$tags $$unique
+	     $$unique
 
 GTAGS:
 	here=`$(am__cd) $(top_builddir) && pwd` \
-	  && cd $(top_srcdir) \
-	  && gtags -i $(GTAGS_ARGS) $$here
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
 
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 
 distdir: $(DISTFILES)
-	@srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; \
-	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's|.|.|g'`; \
-	list='$(DISTFILES)'; for file in $$list; do \
-	  case $$file in \
-	    $(srcdir)/*) file=`echo "$$file" | sed "s|^$$srcdirstrip/||"`;; \
-	    $(top_srcdir)/*) file=`echo "$$file" | sed "s|^$$topsrcdirstrip/|$(top_builddir)/|"`;; \
-	  esac; \
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
 	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
-	  dir=`echo "$$file" | sed -e 's,/[^/]*$$,,'`; \
-	  if test "$$dir" != "$$file" && test "$$dir" != "."; then \
-	    dir="/$$dir"; \
-	    $(mkdir_p) "$(distdir)$$dir"; \
-	  else \
-	    dir=''; \
-	  fi; \
 	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
 	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
 	    fi; \
-	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
 	  else \
-	    test -f $(distdir)/$$file \
-	    || cp -p $$d/$$file $(distdir)/$$file \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
 	    || exit 1; \
 	  fi; \
 	done
@@ -797,7 +540,7 @@ check: check-am
 all-am: Makefile $(LTLIBRARIES) $(HEADERS)
 installdirs:
 	for dir in "$(DESTDIR)$(libdir)"; do \
-	  test -z "$$dir" || $(mkdir_p) "$$dir"; \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
 	done
 install: install-am
 install-exec: install-exec-am
@@ -819,6 +562,7 @@ clean-generic:
 
 distclean-generic:
 	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -832,7 +576,7 @@ distclean: distclean-am
 	-rm -rf ./$(DEPDIR)
 	-rm -f Makefile
 distclean-am: clean-am distclean-compile distclean-generic \
-	distclean-libtool distclean-tags
+	distclean-tags
 
 dvi: dvi-am
 
@@ -840,18 +584,38 @@ dvi-am:
 
 html: html-am
 
+html-am:
+
 info: info-am
 
 info-am:
 
 install-data-am:
 
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
 install-exec-am: install-libLTLIBRARIES
 
+install-html: install-html-am
+
+install-html-am:
+
 install-info: install-info-am
 
+install-info-am:
+
 install-man:
 
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
 installcheck-am:
 
 maintainer-clean: maintainer-clean-am
@@ -872,20 +636,24 @@ ps: ps-am
 
 ps-am:
 
-uninstall-am: uninstall-info-am uninstall-libLTLIBRARIES
+uninstall-am: uninstall-libLTLIBRARIES
+
+.MAKE: install-am install-strip
 
 .PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
 	clean-libLTLIBRARIES clean-libtool ctags distclean \
 	distclean-compile distclean-generic distclean-libtool \
 	distclean-tags distdir dvi dvi-am html html-am info info-am \
-	install install-am install-data install-data-am install-exec \
-	install-exec-am install-info install-info-am \
-	install-libLTLIBRARIES install-man install-strip installcheck \
+	install install-am install-data install-data-am install-dvi \
+	install-dvi-am install-exec install-exec-am install-html \
+	install-html-am install-info install-info-am \
+	install-libLTLIBRARIES install-man install-pdf install-pdf-am \
+	install-ps install-ps-am install-strip installcheck \
 	installcheck-am installdirs maintainer-clean \
 	maintainer-clean-generic mostlyclean mostlyclean-compile \
 	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
-	tags uninstall uninstall-am uninstall-info-am \
-	uninstall-libLTLIBRARIES
+	tags uninstall uninstall-am uninstall-libLTLIBRARIES
+
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/lib/openpam_borrow_cred.c b/lib/openpam_borrow_cred.c
index 79a349f..e0dfc55 100644
--- a/lib/openpam_borrow_cred.c
+++ b/lib/openpam_borrow_cred.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_borrow_cred.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_borrow_cred.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <grp.h>
diff --git a/lib/openpam_check_owner_perms.c b/lib/openpam_check_owner_perms.c
new file mode 100644
index 0000000..67cedc0
--- /dev/null
+++ b/lib/openpam_check_owner_perms.c
@@ -0,0 +1,127 @@
+/*-
+ * Copyright (c) 2011 Dag-Erling Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: openpam_check_owner_perms.c 499 2011-11-22 11:51:50Z des $
+ */
+
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <security/pam_appl.h>
+
+#include "openpam_impl.h"
+
+/*
+ * OpenPAM internal
+ *
+ * Verify that the file or directory referenced by the given descriptor is
+ * owned by either root or the arbitrator and that it is not writable by
+ * group or other.
+ */
+
+int
+openpam_check_desc_owner_perms(const char *name, int fd)
+{
+	uid_t root, arbitrator;
+	struct stat sb;
+	int serrno;
+
+	root = 0;
+	arbitrator = geteuid();
+	if (fstat(fd, &sb) != 0) {
+		serrno = errno;
+		openpam_log(PAM_LOG_ERROR, "%s: %m", name);
+		errno = serrno;
+		return (-1);
+	}
+	if ((sb.st_uid != root && sb.st_uid != arbitrator) ||
+	    (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
+		openpam_log(PAM_LOG_ERROR,
+		    "%s: insecure ownership or permissions", name);
+		errno = EPERM;
+		return (-1);
+	}
+	return (0);
+}
+
+/*
+ * OpenPAM internal
+ *
+ * Verify that a file or directory and all components of the path leading
+ * up to it are owned by either root or the arbitrator and that they are
+ * not writable by group or other.
+ *
+ * Note that openpam_check_file_owner_perms() should be used instead if
+ * possible to avoid a race between the ownership / permission check and
+ * the actual open().
+ */
+
+int
+openpam_check_path_owner_perms(const char *path)
+{
+	uid_t root, arbitrator;
+	char pathbuf[PATH_MAX];
+	struct stat sb;
+	int len, serrno;
+
+	root = 0;
+	arbitrator = geteuid();
+	if (realpath(path, pathbuf) == NULL)
+		return (-1);
+	len = strlen(pathbuf);
+	while (len > 0) {
+		if (stat(pathbuf, &sb) != 0) {
+			serrno = errno;
+			openpam_log(PAM_LOG_ERROR, "%s: %m", pathbuf);
+			errno = serrno;
+			return (-1);
+		}
+		if ((sb.st_uid != root && sb.st_uid != arbitrator) ||
+		    (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
+			openpam_log(PAM_LOG_ERROR,
+			    "%s: insecure ownership or permissions", pathbuf);
+			errno = EPERM;
+			return (-1);
+		}
+		while (--len > 0 && pathbuf[len] != '/')
+			pathbuf[len] = '\0';
+	}
+	return (0);
+}
+
+/*
+ * NOPARSE
+ */
diff --git a/lib/openpam_configure.c b/lib/openpam_configure.c
index f9197ad..d395565 100644
--- a/lib/openpam_configure.c
+++ b/lib/openpam_configure.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_configure.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_configure.c 500 2011-11-22 12:07:03Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <ctype.h>
 #include <errno.h>
 #include <stdio.h>
@@ -44,80 +48,301 @@
 #include <security/pam_appl.h>
 
 #include "openpam_impl.h"
+#include "openpam_strlcmp.h"
 
-const char *_pam_facility_name[PAM_NUM_FACILITIES] = {
-	[PAM_ACCOUNT]		= "account",
-	[PAM_AUTH]		= "auth",
-	[PAM_PASSWORD]		= "password",
-	[PAM_SESSION]		= "session",
-};
+static int openpam_load_chain(pam_handle_t *, const char *, pam_facility_t);
 
-const char *_pam_control_flag_name[PAM_NUM_CONTROL_FLAGS] = {
-	[PAM_BINDING]		= "binding",
-	[PAM_OPTIONAL]		= "optional",
-	[PAM_REQUIRED]		= "required",
-	[PAM_REQUISITE]		= "requisite",
-	[PAM_SUFFICIENT]	= "sufficient",
-};
+/*
+ * Evaluates to non-zero if the argument is a linear whitespace character.
+ */
+#define is_lws(ch)				\
+	(ch == ' ' || ch == '\t')
 
-static int openpam_load_chain(pam_handle_t *, const char *, pam_facility_t);
+/*
+ * Evaluates to non-zero if the argument is a printable ASCII character.
+ * Assumes that the execution character set is a superset of ASCII.
+ */
+#define is_p(ch) \
+	(ch >= '!' && ch <= '~')
+
+/*
+ * Returns non-zero if the argument belongs to the POSIX Portable Filename
+ * Character Set.  Assumes that the execution character set is a superset
+ * of ASCII.
+ */
+#define is_pfcs(ch)				\
+	((ch >= '0' && ch <= '9') ||		\
+	 (ch >= 'A' && ch <= 'Z') ||		\
+	 (ch >= 'a' && ch <= 'z') ||		\
+	 ch == '.' || ch == '_' || ch == '-')
 
 /*
- * Matches a word against the first one in a string.
- * Returns non-zero if they match.
+ * Parse the service name.
+ *
+ * Returns the length of the service name, or 0 if the end of the string
+ * was reached or a disallowed non-whitespace character was encountered.
+ *
+ * If parse_service_name() is successful, it updates *service to point to
+ * the first character of the service name and *line to point one
+ * character past the end.  If it reaches the end of the string, it
+ * updates *line to point to the terminating NUL character and leaves
+ * *service unmodified.  In all other cases, it leaves both *line and
+ * *service unmodified.
+ *
+ * Allowed characters are all characters in the POSIX portable filename
+ * character set.
  */
 static int
-match_word(const char *str, const char *word)
+parse_service_name(char **line, char **service)
 {
+	char *b, *e;
 
-	while (*str && tolower(*str) == tolower(*word))
-		++str, ++word;
-	return (*str == ' ' && *word == '\0');
+	for (b = *line; *b && is_lws(*b); ++b)
+		/* nothing */ ;
+	if (!*b) {
+		*line = b;
+		return (0);
+	}
+	for (e = b; *e && !is_lws(*e); ++e)
+		if (!is_pfcs(*e))
+			return (0);
+	if (e == b)
+		return (0);
+	*line = e;
+	*service = b;
+	return (e - b);
 }
 
 /*
- * Return a pointer to the next word (or the final NUL) in a string.
+ * Parse the facility name.
+ *
+ * Returns the corresponding pam_facility_t value, or -1 if the end of the
+ * string was reached, a disallowed non-whitespace character was
+ * encountered, or the first word was not a recognized facility name.
+ *
+ * If parse_facility_name() is successful, it updates *line to point one
+ * character past the end of the facility name.  If it reaches the end of
+ * the string, it updates *line to point to the terminating NUL character.
+ * In all other cases, it leaves *line unmodified.
  */
-static const char *
-next_word(const char *str)
+static pam_facility_t
+parse_facility_name(char **line)
 {
+	char *b, *e;
+	int i;
 
-	/* skip current word */
-	while (*str && *str != ' ')
-		++str;
-	/* skip whitespace */
-	while (*str == ' ')
-		++str;
-	return (str);
+	for (b = *line; *b && is_lws(*b); ++b)
+		/* nothing */ ;
+	if (!*b) {
+		*line = b;
+		return ((pam_facility_t)-1);
+	}
+	for (e = b; *e && !is_lws(*e); ++e)
+		/* nothing */ ;
+	if (e == b)
+		return ((pam_facility_t)-1);
+	for (i = 0; i < PAM_NUM_FACILITIES; ++i)
+		if (strlcmp(pam_facility_name[i], b, e - b) == 0)
+			break;
+	if (i == PAM_NUM_FACILITIES)
+		return ((pam_facility_t)-1);
+	*line = e;
+	return (i);
 }
 
 /*
- * Return a malloc()ed copy of the first word in a string.
+ * Parse the word "include".
+ *
+ * If the next word on the line is "include", parse_include() updates
+ * *line to point one character past "include" and returns 1.  Otherwise,
+ * it leaves *line unmodified and returns 0.
+ */
+static int
+parse_include(char **line)
+{
+	char *b, *e;
+
+	for (b = *line; *b && is_lws(*b); ++b)
+		/* nothing */ ;
+	if (!*b) {
+		*line = b;
+		return (-1);
+	}
+	for (e = b; *e && !is_lws(*e); ++e)
+		/* nothing */ ;
+	if (e == b)
+		return (0);
+	if (strlcmp("include", b, e - b) != 0)
+		return (0);
+	*line = e;
+	return (1);
+}
+
+/*
+ * Parse the control flag.
+ *
+ * Returns the corresponding pam_control_t value, or -1 if the end of the
+ * string was reached, a disallowed non-whitespace character was
+ * encountered, or the first word was not a recognized control flag.
+ *
+ * If parse_control_flag() is successful, it updates *line to point one
+ * character past the end of the control flag.  If it reaches the end of
+ * the string, it updates *line to point to the terminating NUL character.
+ * In all other cases, it leaves *line unmodified.
+ */
+static pam_control_t
+parse_control_flag(char **line)
+{
+	char *b, *e;
+	int i;
+
+	for (b = *line; *b && is_lws(*b); ++b)
+		/* nothing */ ;
+	if (!*b) {
+		*line = b;
+		return ((pam_control_t)-1);
+	}
+	for (e = b; *e && !is_lws(*e); ++e)
+		/* nothing */ ;
+	if (e == b)
+		return ((pam_control_t)-1);
+	for (i = 0; i < PAM_NUM_CONTROL_FLAGS; ++i)
+		if (strlcmp(pam_control_flag_name[i], b, e - b) == 0)
+			break;
+	if (i == PAM_NUM_CONTROL_FLAGS)
+		return ((pam_control_t)-1);
+	*line = e;
+	return (i);
+}
+
+/*
+ * Parse a file name.
+ *
+ * Returns the length of the file name, or 0 if the end of the string was
+ * reached or a disallowed non-whitespace character was encountered.
+ *
+ * If parse_filename() is successful, it updates *filename to point to the
+ * first character of the filename and *line to point one character past
+ * the end.  If it reaches the end of the string, it updates *line to
+ * point to the terminating NUL character and leaves *filename unmodified.
+ * In all other cases, it leaves both *line and *filename unmodified.
+ *
+ * Allowed characters are all characters in the POSIX portable filename
+ * character set, plus the path separator (forward slash).
+ */
+static int
+parse_filename(char **line, char **filename)
+{
+	char *b, *e;
+
+	for (b = *line; *b && is_lws(*b); ++b)
+		/* nothing */ ;
+	if (!*b) {
+		*line = b;
+		return (0);
+	}
+	for (e = b; *e && !is_lws(*e); ++e)
+		if (!is_pfcs(*e) && *e != '/')
+			return (0);
+	if (e == b)
+		return (0);
+	*line = e;
+	*filename = b;
+	return (e - b);
+}
+
+/*
+ * Parse an option.
+ *
+ * Returns a dynamically allocated string containing the next module
+ * option, or NULL if the end of the string was reached or a disallowed
+ * non-whitespace character was encountered.
+ *
+ * If parse_option() is successful, it updates *line to point one
+ * character past the end of the option.  If it reaches the end of the
+ * string, it updates *line to point to the terminating NUL character.  In
+ * all other cases, it leaves *line unmodified.
+ *
+ * If parse_option() fails to allocate memory, it will return NULL and set
+ * errno to a non-zero value.
+ *
+ * Allowed characters for option names are all characters in the POSIX
+ * portable filename character set.  Allowed characters for option values
+ * are any printable non-whitespace characters.  The option value may be
+ * quoted in either single or double quotes, in which case space
+ * characters and whichever quote character was not used are allowed.
+ * Note that the entire value must be quoted, not just part of it.
  */
 static char *
-dup_word(const char *str)
+parse_option(char **line)
 {
-	const char *end;
-	char *word;
+	char *nb, *ne, *vb, *ve;
+	unsigned char q = 0;
+	char *option;
+	size_t size;
 
-	for (end = str; *end && *end != ' '; ++end)
+	errno = 0;
+	for (nb = *line; *nb && is_lws(*nb); ++nb)
 		/* nothing */ ;
-	if (asprintf(&word, "%.*s", (int)(end - str), str) < 0)
+	if (!*nb) {
+		*line = nb;
+		return (NULL);
+	}
+	for (ne = nb; *ne && !is_lws(*ne) && *ne != '='; ++ne)
+		if (!is_pfcs(*ne))
+			return (NULL);
+	if (ne == nb)
+		return (NULL);
+	if (*ne == '=') {
+		vb = ne + 1;
+		if (*vb == '"' || *vb == '\'')
+			q = *vb++;
+		for (ve = vb;
+		     *ve && *ve != q && (is_p(*ve) || (q && is_lws(*ve)));
+		     ++ve)
+			/* nothing */ ;
+		if (q && *ve != q)
+			/* non-printable character or missing endquote */
+			return (NULL);
+		if (q && *(ve + 1) && !is_lws(*(ve + 1)))
+			/* garbage after value */
+			return (NULL);
+	} else {
+		vb = ve = ne;
+	}
+	size = (ne - nb) + 1;
+	if (ve > vb)
+		size += (ve - vb) + 1;
+	if ((option = malloc(size)) == NULL)
 		return (NULL);
-	return (word);
+	strncpy(option, nb, ne - nb);
+	if (ve > vb) {
+		option[ne - nb] = '=';
+		strncpy(option + (ne - nb) + 1, vb, ve - vb);
+	}
+	option[size - 1] = '\0';
+	*line = q ? ve + 1 : ve;
+	return (option);
 }
 
 /*
- * Return the length of the first word in a string.
+ * Consume trailing whitespace.
+ *
+ * If there are no non-whitespace characters left on the line, parse_eol()
+ * updates *line to point at the terminating NUL character and returns 0.
+ * Otherwise, it leaves *line unmodified and returns a non-zero value.
  */
 static int
-wordlen(const char *str)
+parse_eol(char **line)
 {
-	int i;
+	char *p;
 
-	for (i = 0; str[i] && str[i] != ' '; ++i)
+	for (p = *line; *p && is_lws(*p); ++p)
 		/* nothing */ ;
-	return (i);
+	if (*p)
+		return ((unsigned char)*p);
+	*line = p;
+	return (0);
 }
 
 typedef enum { pam_conf_style, pam_d_style } openpam_style_t;
@@ -126,126 +351,139 @@ typedef enum { pam_conf_style, pam_d_style } openpam_style_t;
  * Extracts given chains from a policy file.
  */
 static int
-openpam_read_chain(pam_handle_t *pamh,
+openpam_parse_chain(pam_handle_t *pamh,
 	const char *service,
 	pam_facility_t facility,
 	const char *filename,
 	openpam_style_t style)
 {
 	pam_chain_t *this, **next;
-	const char *p, *q;
-	int count, i, lineno, ret;
 	pam_facility_t fclt;
 	pam_control_t ctlf;
-	char *line, *name;
+	char *line, *str, *name;
+	char *option, **optv;
+	int len, lineno, ret;
 	FILE *f;
 
 	if ((f = fopen(filename, "r")) == NULL) {
 		openpam_log(errno == ENOENT ? PAM_LOG_DEBUG : PAM_LOG_NOTICE,
 		    "%s: %m", filename);
-		return (0);
+		return (PAM_SUCCESS);
+	}
+	if (openpam_check_desc_owner_perms(filename, fileno(f)) != 0) {
+		fclose(f);
+		return (PAM_SYSTEM_ERR);
 	}
 	this = NULL;
-	count = lineno = 0;
+	name = NULL;
+	lineno = 0;
 	while ((line = openpam_readline(f, &lineno, NULL)) != NULL) {
-		p = line;
-
-		/* match service name */
+		/* get service name if necessary */
 		if (style == pam_conf_style) {
-			if (!match_word(p, service)) {
+			if ((len = parse_service_name(&line, &str)) == 0) {
+				openpam_log(PAM_LOG_NOTICE,
+				    "%s(%d): invalid service name (ignored)",
+				    filename, lineno);
+				FREE(line);
+				continue;
+			}
+			if (strlcmp(service, str, len) != 0) {
 				FREE(line);
 				continue;
 			}
-			p = next_word(p);
 		}
 
-		/* match facility name */
-		for (fclt = 0; fclt < PAM_NUM_FACILITIES; ++fclt)
-			if (match_word(p, _pam_facility_name[fclt]))
-				break;
-		if (fclt == PAM_NUM_FACILITIES) {
-			openpam_log(PAM_LOG_NOTICE,
-			    "%s(%d): invalid facility '%.*s' (ignored)",
-			    filename, lineno, wordlen(p), p);
+		/* get facility name */
+		if ((fclt = parse_facility_name(&line)) == (pam_facility_t)-1) {
+			openpam_log(PAM_LOG_ERROR,
+			    "%s(%d): missing or invalid facility",
+			    filename, lineno);
 			goto fail;
 		}
 		if (facility != fclt && facility != PAM_FACILITY_ANY) {
 			FREE(line);
 			continue;
 		}
-		p = next_word(p);
 
-		/* include other chain */
-		if (match_word(p, "include")) {
-			p = next_word(p);
-			if (*next_word(p) != '\0')
-				openpam_log(PAM_LOG_NOTICE,
-				    "%s(%d): garbage at end of 'include' line",
+		/* check for "include" */
+		if (parse_include(&line)) {
+			if ((len = parse_service_name(&line, &str)) == 0) {
+				openpam_log(PAM_LOG_ERROR,
+				    "%s(%d): missing or invalid filename",
 				    filename, lineno);
-			if ((name = dup_word(p)) == NULL)
+				goto fail;
+			}
+			if ((name = strndup(str, len)) == NULL)
 				goto syserr;
+			if (parse_eol(&line) != 0) {
+				openpam_log(PAM_LOG_ERROR,
+				    "%s(%d): garbage at end of line",
+				    filename, lineno);
+				goto fail;
+			}
 			ret = openpam_load_chain(pamh, name, fclt);
 			FREE(name);
-			if (ret < 0)
+			if (ret != PAM_SUCCESS)
 				goto fail;
-			count += ret;
 			FREE(line);
 			continue;
 		}
 
-		/* allocate new entry */
-		if ((this = calloc(1, sizeof *this)) == NULL)
-			goto syserr;
+		/* get control flag */
+		if ((ctlf = parse_control_flag(&line)) == (pam_control_t)-1) {
+			openpam_log(PAM_LOG_ERROR,
+			    "%s(%d): missing or invalid control flag",
+			    filename, lineno);
+			goto fail;
+		}
 
-		/* control flag */
-		for (ctlf = 0; ctlf < PAM_NUM_CONTROL_FLAGS; ++ctlf)
-			if (match_word(p, _pam_control_flag_name[ctlf]))
-				break;
-		if (ctlf == PAM_NUM_CONTROL_FLAGS) {
+		/* get module name */
+		if ((len = parse_filename(&line, &str)) == 0) {
 			openpam_log(PAM_LOG_ERROR,
-			    "%s(%d): invalid control flag '%.*s'",
-			    filename, lineno, wordlen(p), p);
+			    "%s(%d): missing or invalid module name",
+			    filename, lineno);
 			goto fail;
 		}
+		if ((name = strndup(str, len)) == NULL)
+			goto syserr;
+
+		/* allocate new entry */
+		if ((this = calloc(1, sizeof *this)) == NULL)
+			goto syserr;
 		this->flag = ctlf;
 
-		/* module name */
-		p = next_word(p);
-		if (*p == '\0') {
+		/* get module options */
+		if ((this->optv = malloc(sizeof *optv)) == NULL)
+			goto syserr;
+		this->optc = 0;
+		while ((option = parse_option(&line)) != NULL) {
+			optv = realloc(this->optv,
+			    (this->optc + 2) * sizeof *optv);
+			if (optv == NULL)
+				goto syserr;
+			this->optv = optv;
+			this->optv[this->optc++] = option;
+		}
+		this->optv[this->optc] = NULL;
+		if (*line != '\0') {
 			openpam_log(PAM_LOG_ERROR,
-			    "%s(%d): missing module name",
+			    "%s(%d): syntax error in module options",
 			    filename, lineno);
 			goto fail;
 		}
-		if ((name = dup_word(p)) == NULL)
-			goto syserr;
+
+		/* load module */
 		this->module = openpam_load_module(name);
 		FREE(name);
 		if (this->module == NULL)
 			goto fail;
 
-		/* module options */
-		p = q = next_word(p);
-		while (*q != '\0') {
-			++this->optc;
-			q = next_word(q);
-		}
-		this->optv = calloc(this->optc + 1, sizeof(char *));
-		if (this->optv == NULL)
-			goto syserr;
-		for (i = 0; i < this->optc; ++i) {
-			if ((this->optv[i] = dup_word(p)) == NULL)
-				goto syserr;
-			p = next_word(p);
-		}
-
 		/* hook it up */
 		for (next = &pamh->chains[fclt]; *next != NULL;
 		     next = &(*next)->next)
 			/* nothing */ ;
 		*next = this;
 		this = NULL;
-		++count;
 
 		/* next please... */
 		FREE(line);
@@ -253,14 +491,20 @@ openpam_read_chain(pam_handle_t *pamh,
 	if (!feof(f))
 		goto syserr;
 	fclose(f);
-	return (count);
- syserr:
+	return (PAM_SUCCESS);
+syserr:
 	openpam_log(PAM_LOG_ERROR, "%s: %m", filename);
- fail:
+fail:
+	if (this && this->optc) {
+		while (this->optc--)
+			FREE(this->optv[this->optc]);
+		FREE(this->optv);
+	}
 	FREE(this);
 	FREE(line);
+	FREE(name);
 	fclose(f);
-	return (-1);
+	return (PAM_SYSTEM_ERR);
 }
 
 static const char *openpam_policy_path[] = {
@@ -283,26 +527,26 @@ openpam_load_chain(pam_handle_t *pamh,
 	const char **path;
 	char *filename;
 	size_t len;
-	int r;
+	int ret;
 
 	for (path = openpam_policy_path; *path != NULL; ++path) {
 		len = strlen(*path);
 		if ((*path)[len - 1] == '/') {
 			if (asprintf(&filename, "%s%s", *path, service) < 0) {
 				openpam_log(PAM_LOG_ERROR, "asprintf(): %m");
-				return (-PAM_BUF_ERR);
+				return (PAM_BUF_ERR);
 			}
-			r = openpam_read_chain(pamh, service, facility,
+			ret = openpam_parse_chain(pamh, service, facility,
 			    filename, pam_d_style);
 			FREE(filename);
 		} else {
-			r = openpam_read_chain(pamh, service, facility,
+			ret = openpam_parse_chain(pamh, service, facility,
 			    *path, pam_conf_style);
 		}
-		if (r != 0)
-			return (r);
+		if (ret != PAM_SUCCESS)
+			return (ret);
 	}
-	return (0);
+	return (PAM_SUCCESS);
 }
 
 /*
@@ -316,18 +560,23 @@ openpam_configure(pam_handle_t *pamh,
 	const char *service)
 {
 	pam_facility_t fclt;
+	const char *p;
+
+	for (p = service; *p; ++p)
+		if (!is_pfcs(*p))
+			return (PAM_SYSTEM_ERR);
 
-	if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0)
+	if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) != PAM_SUCCESS)
 		goto load_err;
 
 	for (fclt = 0; fclt < PAM_NUM_FACILITIES; ++fclt) {
 		if (pamh->chains[fclt] != NULL)
 			continue;
-		if (openpam_load_chain(pamh, PAM_OTHER, fclt) < 0)
+		if (openpam_load_chain(pamh, PAM_OTHER, fclt) != PAM_SUCCESS)
 			goto load_err;
 	}
 	return (PAM_SUCCESS);
- load_err:
+load_err:
 	openpam_clear_chains(pamh->chains);
 	return (PAM_SYSTEM_ERR);
 }
diff --git a/lib/openpam_constants.c b/lib/openpam_constants.c
new file mode 100644
index 0000000..833e81f
--- /dev/null
+++ b/lib/openpam_constants.c
@@ -0,0 +1,127 @@
+/*-
+ * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project by ThinkSec AS and
+ * Network Associates Laboratories, the Security Research Division of
+ * Network Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
+ * ("CBOSS"), as part of the DARPA CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: openpam_constants.c 491 2011-11-12 00:12:32Z des $
+ */
+
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <security/pam_appl.h>
+
+#include "openpam_impl.h"
+
+const char *pam_err_name[PAM_NUM_ERRORS] = {
+	"PAM_SUCCESS",
+	"PAM_OPEN_ERR",
+	"PAM_SYMBOL_ERR",
+	"PAM_SERVICE_ERR",
+	"PAM_SYSTEM_ERR",
+	"PAM_BUF_ERR",
+	"PAM_CONV_ERR",
+	"PAM_PERM_DENIED",
+	"PAM_MAXTRIES",
+	"PAM_AUTH_ERR",
+	"PAM_NEW_AUTHTOK_REQD",
+	"PAM_CRED_INSUFFICIENT",
+	"PAM_AUTHINFO_UNAVAIL",
+	"PAM_USER_UNKNOWN",
+	"PAM_CRED_UNAVAIL",
+	"PAM_CRED_EXPIRED",
+	"PAM_CRED_ERR",
+	"PAM_ACCT_EXPIRED",
+	"PAM_AUTHTOK_EXPIRED",
+	"PAM_SESSION_ERR",
+	"PAM_AUTHTOK_ERR",
+	"PAM_AUTHTOK_RECOVERY_ERR",
+	"PAM_AUTHTOK_LOCK_BUSY",
+	"PAM_AUTHTOK_DISABLE_AGING",
+	"PAM_NO_MODULE_DATA",
+	"PAM_IGNORE",
+	"PAM_ABORT",
+	"PAM_TRY_AGAIN",
+	"PAM_MODULE_UNKNOWN",
+	"PAM_DOMAIN_UNKNOWN"
+};
+
+const char *pam_item_name[PAM_NUM_ITEMS] = {
+	"(NO ITEM)",
+	"PAM_SERVICE",
+	"PAM_USER",
+	"PAM_TTY",
+	"PAM_RHOST",
+	"PAM_CONV",
+	"PAM_AUTHTOK",
+	"PAM_OLDAUTHTOK",
+	"PAM_RUSER",
+	"PAM_USER_PROMPT",
+	"PAM_REPOSITORY",
+	"PAM_AUTHTOK_PROMPT",
+	"PAM_OLDAUTHTOK_PROMPT",
+	"PAM_HOST",
+};
+
+const char *pam_facility_name[PAM_NUM_FACILITIES] = {
+	[PAM_ACCOUNT]		= "account",
+	[PAM_AUTH]		= "auth",
+	[PAM_PASSWORD]		= "password",
+	[PAM_SESSION]		= "session",
+};
+
+const char *pam_control_flag_name[PAM_NUM_CONTROL_FLAGS] = {
+	[PAM_BINDING]		= "binding",
+	[PAM_OPTIONAL]		= "optional",
+	[PAM_REQUIRED]		= "required",
+	[PAM_REQUISITE]		= "requisite",
+	[PAM_SUFFICIENT]	= "sufficient",
+};
+
+const char *pam_func_name[PAM_NUM_PRIMITIVES] = {
+	"pam_authenticate",
+	"pam_setcred",
+	"pam_acct_mgmt",
+	"pam_open_session",
+	"pam_close_session",
+	"pam_chauthtok"
+};
+
+const char *pam_sm_func_name[PAM_NUM_PRIMITIVES] = {
+	"pam_sm_authenticate",
+	"pam_sm_setcred",
+	"pam_sm_acct_mgmt",
+	"pam_sm_open_session",
+	"pam_sm_close_session",
+	"pam_sm_chauthtok"
+};
diff --git a/lib/openpam_constants.h b/lib/openpam_constants.h
new file mode 100644
index 0000000..b923179
--- /dev/null
+++ b/lib/openpam_constants.h
@@ -0,0 +1,40 @@
+/*-
+ * Copyright (c) 2011 Dag-Erling Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: openpam_constants.h 491 2011-11-12 00:12:32Z des $
+ */
+
+#ifndef OPENPAM_CONSTANTS_INCLUDED
+#define OPENPAM_CONSTANTS_INCLUDED
+
+extern const char *pam_err_name[PAM_NUM_ERRORS];
+extern const char *pam_item_name[PAM_NUM_ITEMS];
+extern const char *pam_facility_name[PAM_NUM_FACILITIES];
+extern const char *pam_control_flag_name[PAM_NUM_CONTROL_FLAGS];
+extern const char *pam_func_name[PAM_NUM_PRIMITIVES];
+extern const char *pam_sm_func_name[PAM_NUM_PRIMITIVES];
+
+#endif
diff --git a/lib/openpam_debug.h b/lib/openpam_debug.h
new file mode 100644
index 0000000..ef2884d
--- /dev/null
+++ b/lib/openpam_debug.h
@@ -0,0 +1,103 @@
+/*-
+ * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project by ThinkSec AS and
+ * Network Associates Laboratories, the Security Research Division of
+ * Network Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
+ * ("CBOSS"), as part of the DARPA CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: openpam_debug.h 491 2011-11-12 00:12:32Z des $
+ */
+
+#ifndef OPENPAM_DEBUG_INCLUDED
+#define OPENPAM_DEBUG_INCLUDED
+
+#ifdef OPENPAM_DEBUG
+#define ENTER() openpam_log(PAM_LOG_DEBUG, "entering")
+#define ENTERI(i) do { \
+	int i_ = (i); \
+	if (i_ > 0 && i_ < PAM_NUM_ITEMS) \
+		openpam_log(PAM_LOG_DEBUG, "entering: %s", pam_item_name[i_]); \
+	else \
+		openpam_log(PAM_LOG_DEBUG, "entering: %d", i_); \
+} while (0)
+#define ENTERN(n) do { \
+	int n_ = (n); \
+	openpam_log(PAM_LOG_DEBUG, "entering: %d", n_); \
+} while (0)
+#define ENTERS(s) do { \
+	const char *s_ = (s); \
+	if (s_ == NULL) \
+		openpam_log(PAM_LOG_DEBUG, "entering: NULL"); \
+	else \
+		openpam_log(PAM_LOG_DEBUG, "entering: '%s'", s_); \
+} while (0)
+#define	RETURNV() openpam_log(PAM_LOG_DEBUG, "returning")
+#define RETURNC(c) do { \
+	int c_ = (c); \
+	if (c_ >= 0 && c_ < PAM_NUM_ERRORS) \
+		openpam_log(PAM_LOG_DEBUG, "returning %s", pam_err_name[c_]); \
+	else \
+		openpam_log(PAM_LOG_DEBUG, "returning %d!", c_); \
+	return (c_); \
+} while (0)
+#define	RETURNN(n) do { \
+	int n_ = (n); \
+	openpam_log(PAM_LOG_DEBUG, "returning %d", n_); \
+	return (n_); \
+} while (0)
+#define	RETURNP(p) do { \
+	const void *p_ = (p); \
+	if (p_ == NULL) \
+		openpam_log(PAM_LOG_DEBUG, "returning NULL"); \
+	else \
+		openpam_log(PAM_LOG_DEBUG, "returning %p", p_); \
+	return (p_); \
+} while (0)
+#define	RETURNS(s) do { \
+	const char *s_ = (s); \
+	if (s_ == NULL) \
+		openpam_log(PAM_LOG_DEBUG, "returning NULL"); \
+	else \
+		openpam_log(PAM_LOG_DEBUG, "returning '%s'", s_); \
+	return (s_); \
+} while (0)
+#else
+#define ENTER()
+#define ENTERI(i)
+#define ENTERN(n)
+#define ENTERS(s)
+#define RETURNV() return
+#define RETURNC(c) return (c)
+#define RETURNN(n) return (n)
+#define RETURNP(p) return (p)
+#define RETURNS(s) return (s)
+#endif
+
+#endif
diff --git a/lib/openpam_dispatch.c b/lib/openpam_dispatch.c
index 69fe472..54dfd3b 100644
--- a/lib/openpam_dispatch.c
+++ b/lib/openpam_dispatch.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_dispatch.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_dispatch.c 501 2011-12-07 01:28:05Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
@@ -42,9 +46,9 @@
 #include "openpam_impl.h"
 
 #if !defined(OPENPAM_RELAX_CHECKS)
-static void _openpam_check_error_code(int, int);
+static void openpam_check_error_code(int, int);
 #else
-#define _openpam_check_error_code(a, b)
+#define openpam_check_error_code(a, b)
 #endif /* !defined(OPENPAM_RELAX_CHECKS) */
 
 /*
@@ -60,9 +64,7 @@ openpam_dispatch(pam_handle_t *pamh,
 {
 	pam_chain_t *chain;
 	int err, fail, r;
-#ifdef DEBUG
 	int debug;
-#endif
 
 	ENTER();
 	if (pamh == NULL)
@@ -72,9 +74,9 @@ openpam_dispatch(pam_handle_t *pamh,
 	if (pamh->current != NULL) {
 		openpam_log(PAM_LOG_ERROR,
 		    "%s() called while %s::%s() is in progress",
-		    _pam_func_name[primitive],
+		    pam_func_name[primitive],
 		    pamh->current->module->path,
-		    _pam_sm_func_name[pamh->primitive]);
+		    pam_sm_func_name[pamh->primitive]);
 		RETURNC(PAM_ABORT);
 	}
 
@@ -102,28 +104,24 @@ openpam_dispatch(pam_handle_t *pamh,
 	for (err = fail = 0; chain != NULL; chain = chain->next) {
 		if (chain->module->func[primitive] == NULL) {
 			openpam_log(PAM_LOG_ERROR, "%s: no %s()",
-			    chain->module->path, _pam_sm_func_name[primitive]);
-			continue;
+			    chain->module->path, pam_sm_func_name[primitive]);
+			r = PAM_SYSTEM_ERR;
 		} else {
 			pamh->primitive = primitive;
 			pamh->current = chain;
-#ifdef DEBUG
 			debug = (openpam_get_option(pamh, "debug") != NULL);
 			if (debug)
-				++_openpam_debug;
+				++openpam_debug;
 			openpam_log(PAM_LOG_DEBUG, "calling %s() in %s",
-			    _pam_sm_func_name[primitive], chain->module->path);
-#endif
+			    pam_sm_func_name[primitive], chain->module->path);
 			r = (chain->module->func[primitive])(pamh, flags,
 			    chain->optc, (const char **)chain->optv);
 			pamh->current = NULL;
-#ifdef DEBUG
 			openpam_log(PAM_LOG_DEBUG, "%s: %s(): %s",
-			    chain->module->path, _pam_sm_func_name[primitive],
+			    chain->module->path, pam_sm_func_name[primitive],
 			    pam_strerror(pamh, r));
 			if (debug)
-				--_openpam_debug;
-#endif
+				--openpam_debug;
 		}
 
 		if (r == PAM_IGNORE)
@@ -143,7 +141,7 @@ openpam_dispatch(pam_handle_t *pamh,
 			continue;
 		}
 
-		_openpam_check_error_code(primitive, r);
+		openpam_check_error_code(primitive, r);
 
 		/*
 		 * Record the return code from the first module to
@@ -177,7 +175,7 @@ openpam_dispatch(pam_handle_t *pamh,
 
 #if !defined(OPENPAM_RELAX_CHECKS)
 static void
-_openpam_check_error_code(int primitive, int r)
+openpam_check_error_code(int primitive, int r)
 {
 	/* common error codes */
 	if (r == PAM_SUCCESS ||
@@ -229,7 +227,7 @@ _openpam_check_error_code(int primitive, int r)
 	}
 
 	openpam_log(PAM_LOG_ERROR, "%s(): unexpected return value %d",
-	    _pam_sm_func_name[primitive], r);
+	    pam_sm_func_name[primitive], r);
 }
 #endif /* !defined(OPENPAM_RELAX_CHECKS) */
 
diff --git a/lib/openpam_dynamic.c b/lib/openpam_dynamic.c
index 084408e..d44174f 100644
--- a/lib/openpam_dynamic.c
+++ b/lib/openpam_dynamic.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,13 +32,19 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_dynamic.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_dynamic.c 502 2011-12-18 13:59:22Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <dlfcn.h>
+#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
 
 #include <security/pam_appl.h>
 
@@ -51,21 +57,35 @@
 /*
  * OpenPAM internal
  *
+ * Perform sanity checks and attempt to load a module
+ */
+
+static void *
+try_dlopen(const char *modfn)
+{
+
+	if (openpam_check_path_owner_perms(modfn) != 0)
+		return (NULL);
+	return (dlopen(modfn, RTLD_NOW));
+}
+    
+/*
+ * OpenPAM internal
+ *
  * Locate a dynamically linked module
  */
 
 pam_module_t *
 openpam_dynamic(const char *path)
 {
+	const pam_module_t *dlmodule;
 	pam_module_t *module;
 	const char *prefix;
 	char *vpath;
 	void *dlh;
-	int i;
+	int i, serrno;
 
 	dlh = NULL;
-	if ((module = calloc(1, sizeof *module)) == NULL)
-		goto buf_err;
 
 	/* Prepend the standard prefix if not an absolute pathname. */
 	if (path[0] != '/')
@@ -75,33 +95,36 @@ openpam_dynamic(const char *path)
 
 	/* try versioned module first, then unversioned module */
 	if (asprintf(&vpath, "%s%s.%d", prefix, path, LIB_MAJ) < 0)
-		goto buf_err;
-	if ((dlh = dlopen(vpath, RTLD_NOW)) == NULL) {
-		openpam_log(PAM_LOG_DEBUG, "%s: %s", vpath, dlerror());
+		goto err;
+	if ((dlh = try_dlopen(vpath)) == NULL && errno == ENOENT) {
 		*strrchr(vpath, '.') = '\0';
-		if ((dlh = dlopen(vpath, RTLD_NOW)) == NULL) {
-			openpam_log(PAM_LOG_DEBUG, "%s: %s", vpath, dlerror());
-			FREE(vpath);
-			FREE(module);
-			return (NULL);
-		}
+		dlh = try_dlopen(vpath);
 	}
+	serrno = errno;
 	FREE(vpath);
+	errno = serrno;
+	if (dlh == NULL)
+		goto err;
+	if ((module = calloc(1, sizeof *module)) == NULL)
+		goto buf_err;
 	if ((module->path = strdup(path)) == NULL)
 		goto buf_err;
 	module->dlh = dlh;
+	dlmodule = dlsym(dlh, "_pam_module");
 	for (i = 0; i < PAM_NUM_PRIMITIVES; ++i) {
-		module->func[i] = (pam_func_t)dlsym(dlh, _pam_sm_func_name[i]);
+		module->func[i] = dlmodule ? dlmodule->func[i] :
+		    (pam_func_t)dlsym(dlh, pam_sm_func_name[i]);
 		if (module->func[i] == NULL)
 			openpam_log(PAM_LOG_DEBUG, "%s: %s(): %s",
-			    path, _pam_sm_func_name[i], dlerror());
+			    path, pam_sm_func_name[i], dlerror());
 	}
 	return (module);
- buf_err:
-	openpam_log(PAM_LOG_ERROR, "%m");
+buf_err:
 	if (dlh != NULL)
 		dlclose(dlh);
 	FREE(module);
+err:
+	openpam_log(PAM_LOG_ERROR, "%m");
 	return (NULL);
 }
 
diff --git a/lib/openpam_findenv.c b/lib/openpam_findenv.c
index d78e147..b833ec9 100644
--- a/lib/openpam_findenv.c
+++ b/lib/openpam_findenv.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_findenv.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_findenv.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <string.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/openpam_free_data.c b/lib/openpam_free_data.c
index e071c0a..561687c 100644
--- a/lib/openpam_free_data.c
+++ b/lib/openpam_free_data.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_free_data.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_free_data.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/lib/openpam_free_envlist.c b/lib/openpam_free_envlist.c
index 346c2dd..14754dc 100644
--- a/lib/openpam_free_envlist.c
+++ b/lib/openpam_free_envlist.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2005 Dag-Erling Coïdan Smørgrav
+ * Copyright (c) 2005-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -25,9 +25,13 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $Id: openpam_free_envlist.c 320 2006-02-16 20:33:19Z des $
+ * $Id: openpam_free_envlist.c 447 2011-10-22 02:47:36Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdlib.h>
 
 #include <security/pam_appl.h>
@@ -63,4 +67,6 @@ openpam_free_envlist(char **envlist)
  * frees all the environment variables in an environment list, and the
  * list itself.
  * It is suitable for freeing the return value from =pam_getenvlist.
+ *
+ * AUTHOR DES
  */
diff --git a/lib/openpam_get_option.c b/lib/openpam_get_option.c
index 73bc070..b5faa87 100644
--- a/lib/openpam_get_option.c
+++ b/lib/openpam_get_option.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_get_option.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_get_option.c 482 2011-11-03 16:33:02Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <string.h>
diff --git a/lib/openpam_impl.h b/lib/openpam_impl.h
index 7704d4e..ba4d455 100644
--- a/lib/openpam_impl.h
+++ b/lib/openpam_impl.h
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,24 +32,15 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_impl.h 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_impl.h 499 2011-11-22 11:51:50Z des $
  */
 
-#ifndef _OPENPAM_IMPL_H_INCLUDED
-#define _OPENPAM_IMPL_H_INCLUDED
-
-#ifdef HAVE_CONFIG_H
-# include <config.h>
-#endif
+#ifndef OPENPAM_IMPL_H_INCLUDED
+#define OPENPAM_IMPL_H_INCLUDED
 
 #include <security/openpam.h>
 
-extern const char *_pam_func_name[PAM_NUM_PRIMITIVES];
-extern const char *_pam_sm_func_name[PAM_NUM_PRIMITIVES];
-extern const char *_pam_err_name[PAM_NUM_ERRORS];
-extern const char *_pam_item_name[PAM_NUM_ITEMS];
-
-extern int _openpam_debug;
+extern int openpam_debug;
 
 /*
  * Control flags
@@ -75,6 +66,9 @@ typedef enum {
 	PAM_NUM_FACILITIES
 } pam_facility_t;
 
+/*
+ * Module chains
+ */
 typedef struct pam_chain pam_chain_t;
 struct pam_chain {
 	pam_module_t	*module;
@@ -84,6 +78,21 @@ struct pam_chain {
 	pam_chain_t	*next;
 };
 
+/*
+ * Service policies
+ */
+#if defined(OPENPAM_EMBEDDED)
+typedef struct pam_policy pam_policy_t;
+struct pam_policy {
+	const char	*service;
+	pam_chain_t	*chains[PAM_NUM_FACILITIES];
+};
+extern pam_policy_t *pam_embedded_policies[];
+#endif
+
+/*
+ * Module-specific data
+ */
 typedef struct pam_data pam_data_t;
 struct pam_data {
 	char		*name;
@@ -92,6 +101,9 @@ struct pam_data {
 	pam_data_t	*next;
 };
 
+/*
+ * PAM context
+ */
 struct pam_handle {
 	char		*service;
 
@@ -111,6 +123,9 @@ struct pam_handle {
 };
 
 #ifdef NGROUPS_MAX
+/*
+ * Saved credentials
+ */
 #define PAM_SAVED_CRED "pam_saved_cred"
 struct pam_saved_cred {
 	uid_t	 euid;
@@ -120,14 +135,23 @@ struct pam_saved_cred {
 };
 #endif
 
+/*
+ * Default policy
+ */
 #define PAM_OTHER	"other"
 
+/*
+ * Internal functions
+ */
 int		 openpam_configure(pam_handle_t *, const char *);
 int		 openpam_dispatch(pam_handle_t *, int, int);
 int		 openpam_findenv(pam_handle_t *, const char *, size_t);
 pam_module_t	*openpam_load_module(const char *);
 void		 openpam_clear_chains(pam_chain_t **);
 
+int		 openpam_check_desc_owner_perms(const char *, int);
+int		 openpam_check_path_owner_perms(const char *);
+
 #ifdef OPENPAM_STATIC_MODULES
 pam_module_t	*openpam_static(const char *);
 #endif
@@ -135,66 +159,7 @@ pam_module_t	*openpam_dynamic(const char *);
 
 #define	FREE(p) do { free((p)); (p) = NULL; } while (0)
 
-#ifdef DEBUG
-#define ENTER() openpam_log(PAM_LOG_DEBUG, "entering")
-#define ENTERI(i) do { \
-	int _i = (i); \
-	if (_i > 0 && _i < PAM_NUM_ITEMS) \
-		openpam_log(PAM_LOG_DEBUG, "entering: %s", _pam_item_name[_i]); \
-	else \
-		openpam_log(PAM_LOG_DEBUG, "entering: %d", _i); \
-} while (0)
-#define ENTERN(n) do { \
-	int _n = (n); \
-	openpam_log(PAM_LOG_DEBUG, "entering: %d", _n); \
-} while (0)
-#define ENTERS(s) do { \
-	const char *_s = (s); \
-	if (_s == NULL) \
-		openpam_log(PAM_LOG_DEBUG, "entering: NULL"); \
-	else \
-		openpam_log(PAM_LOG_DEBUG, "entering: '%s'", _s); \
-} while (0)
-#define	RETURNV() openpam_log(PAM_LOG_DEBUG, "returning")
-#define RETURNC(c) do { \
-	int _c = (c); \
-	if (_c >= 0 && _c < PAM_NUM_ERRORS) \
-		openpam_log(PAM_LOG_DEBUG, "returning %s", _pam_err_name[_c]); \
-	else \
-		openpam_log(PAM_LOG_DEBUG, "returning %d!", _c); \
-	return (_c); \
-} while (0)
-#define	RETURNN(n) do { \
-	int _n = (n); \
-	openpam_log(PAM_LOG_DEBUG, "returning %d", _n); \
-	return (_n); \
-} while (0)
-#define	RETURNP(p) do { \
-	const void *_p = (p); \
-	if (_p == NULL) \
-		openpam_log(PAM_LOG_DEBUG, "returning NULL"); \
-	else \
-		openpam_log(PAM_LOG_DEBUG, "returning %p", _p); \
-	return (p); \
-} while (0)
-#define	RETURNS(s) do { \
-	const char *_s = (s); \
-	if (_s == NULL) \
-		openpam_log(PAM_LOG_DEBUG, "returning NULL"); \
-	else \
-		openpam_log(PAM_LOG_DEBUG, "returning '%s'", _s); \
-	return (_s); \
-} while (0)
-#else
-#define ENTER()
-#define ENTERI(i)
-#define ENTERN(n)
-#define ENTERS(s)
-#define RETURNV() return
-#define RETURNC(c) return (c)
-#define RETURNN(n) return (n)
-#define RETURNP(p) return (p)
-#define RETURNS(s) return (s)
-#endif
+#include "openpam_constants.h"
+#include "openpam_debug.h"
 
 #endif
diff --git a/lib/openpam_load.c b/lib/openpam_load.c
index 303f3f5..0eb8ea7 100644
--- a/lib/openpam_load.c
+++ b/lib/openpam_load.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_load.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_load.c 491 2011-11-12 00:12:32Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <dlfcn.h>
 #include <stdlib.h>
 #include <string.h>
@@ -43,24 +47,6 @@
 
 #include "openpam_impl.h"
 
-const char *_pam_func_name[PAM_NUM_PRIMITIVES] = {
-	"pam_authenticate",
-	"pam_setcred",
-	"pam_acct_mgmt",
-	"pam_open_session",
-	"pam_close_session",
-	"pam_chauthtok"
-};
-
-const char *_pam_sm_func_name[PAM_NUM_PRIMITIVES] = {
-	"pam_sm_authenticate",
-	"pam_sm_setcred",
-	"pam_sm_acct_mgmt",
-	"pam_sm_open_session",
-	"pam_sm_close_session",
-	"pam_sm_chauthtok"
-};
-
 /*
  * Locate a matching dynamic or static module.
  */
@@ -122,10 +108,8 @@ openpam_destroy_chain(pam_chain_t *chain)
 		return;
 	openpam_destroy_chain(chain->next);
 	chain->next = NULL;
-	while (chain->optc) {
-		--chain->optc;
+	while (chain->optc--)
 		FREE(chain->optv[chain->optc]);
-	}
 	FREE(chain->optv);
 	openpam_release_module(chain->module);
 	chain->module = NULL;
diff --git a/lib/openpam_log.c b/lib/openpam_log.c
index e492294..9e3d28b 100644
--- a/lib/openpam_log.c
+++ b/lib/openpam_log.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_log.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_log.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <ctype.h>
 #include <stdarg.h>
 #include <stdio.h>
@@ -47,9 +51,9 @@
 #include "openpam_impl.h"
 
 #ifdef OPENPAM_DEBUG
-int _openpam_debug = 1;
+int openpam_debug = 1;
 #else
-int _openpam_debug = 0;
+int openpam_debug = 0;
 #endif
 
 #if !defined(openpam_log)
@@ -68,7 +72,7 @@ openpam_log(int level, const char *fmt, ...)
 
 	switch (level) {
 	case PAM_LOG_DEBUG:
-		if (!_openpam_debug)
+		if (!openpam_debug)
 			return;
 		priority = LOG_DEBUG;
 		break;
@@ -99,7 +103,7 @@ _openpam_log(int level, const char *func, const char *fmt, ...)
 
 	switch (level) {
 	case PAM_LOG_DEBUG:
-		if (!_openpam_debug)
+		if (!openpam_debug)
 			return;
 		priority = LOG_DEBUG;
 		break;
@@ -136,7 +140,7 @@ _openpam_log(int level, const char *func, const char *fmt, ...)
  *	=PAM_LOG_DEBUG:
  *		Debugging messages.
  *		These messages are normally not logged unless the global
- *		integer variable :_openpam_debug is set to a non-zero
+ *		integer variable :openpam_debug is set to a non-zero
  *		value, in which case they are logged with a =syslog
  *		priority of =LOG_DEBUG.
  *	=PAM_LOG_VERBOSE:
diff --git a/lib/openpam_nullconv.c b/lib/openpam_nullconv.c
index 3294dcf..a95b1e0 100644
--- a/lib/openpam_nullconv.c
+++ b/lib/openpam_nullconv.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_nullconv.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_nullconv.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/types.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/openpam_readline.c b/lib/openpam_readline.c
index 17f03f3..9cc8cc1 100644
--- a/lib/openpam_readline.c
+++ b/lib/openpam_readline.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_readline.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_readline.c 473 2011-11-03 10:48:25Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -83,33 +87,23 @@ openpam_readline(FILE *f, int *lineno, size_t *lenp)
 		}
 		/* eof */
 		if (ch == EOF) {
-			/* remove trailing whitespace */
-			while (len > 0 && isspace((int)line[len - 1]))
-				--len;
-			line[len] = '\0';
-			if (len == 0)
-				goto fail;
+			/* done */
 			break;
 		}
 		/* eol */
 		if (ch == '\n') {
 			if (lineno != NULL)
 				++*lineno;
-
-			/* remove trailing whitespace */
-			while (len > 0 && isspace((int)line[len - 1]))
-				--len;
-			line[len] = '\0';
 			/* skip blank lines */
 			if (len == 0)
 				continue;
 			/* continuation */
 			if (line[len - 1] == '\\') {
 				line[--len] = '\0';
-				/* fall through to whitespace case */
-			} else {
-				break;
+				continue;
 			}
+			/* done */
+			break;
 		}
 		/* whitespace */
 		if (isspace(ch)) {
@@ -123,10 +117,16 @@ openpam_readline(FILE *f, int *lineno, size_t *lenp)
 		line_putch(ch);
 	}
 
+	/* remove trailing whitespace */
+	while (len > 0 && isspace((unsigned char)line[len - 1]))
+		--len;
+	line[len] = '\0';
+	if (len == 0)
+		goto fail;
 	if (lenp != NULL)
 		*lenp = len;
 	return (line);
- fail:
+fail:
 	FREE(line);
 	return (NULL);
 }
@@ -136,13 +136,14 @@ openpam_readline(FILE *f, int *lineno, size_t *lenp)
  * in a NUL-terminated buffer allocated with =malloc.
  *
  * The =openpam_readline function performs a certain amount of processing
- * on the data it reads.
- * Comments (introduced by a hash sign) are stripped, as is leading and
- * trailing whitespace.
- * Any amount of linear whitespace is collapsed to a single space.
- * Blank lines are ignored.
- * If a line ends in a backslash, the backslash is stripped and the next
- * line is appended.
+ * on the data it reads:
+ *
+ *  - Comments (introduced by a hash sign) are stripped, as is leading and
+ *    trailing whitespace.
+ *  - Any amount of linear whitespace is collapsed to a single space.
+ *  - Blank lines are ignored.
+ *  - If a line ends in a backslash, the backslash is stripped and the
+ *    next line is appended.
  *
  * If =lineno is not =NULL, the integer variable it points to is
  * incremented every time a newline character is read.
diff --git a/lib/openpam_restore_cred.c b/lib/openpam_restore_cred.c
index 20e80d4..41d44d0 100644
--- a/lib/openpam_restore_cred.c
+++ b/lib/openpam_restore_cred.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_restore_cred.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_restore_cred.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <grp.h>
diff --git a/lib/openpam_set_option.c b/lib/openpam_set_option.c
index 57161d3..c7cb1c7 100644
--- a/lib/openpam_set_option.c
+++ b/lib/openpam_set_option.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_set_option.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_set_option.c 482 2011-11-03 16:33:02Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <stdio.h>
diff --git a/lib/openpam_static.c b/lib/openpam_static.c
index c06ceed..40b807c 100644
--- a/lib/openpam_static.c
+++ b/lib/openpam_static.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_static.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_static.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <string.h>
 
 #include <security/pam_appl.h>
@@ -43,7 +47,7 @@
 
 #ifdef OPENPAM_STATIC_MODULES
 
-SET_DECLARE(_openpam_static_modules, pam_module_t);
+SET_DECLARE(openpam_static_modules, pam_module_t);
 
 /*
  * OpenPAM internal
@@ -56,7 +60,7 @@ openpam_static(const char *path)
 {
 	pam_module_t **module;
 
-	SET_FOREACH(module, _openpam_static_modules) {
+	SET_FOREACH(module, openpam_static_modules) {
 		if (strcmp((*module)->path, path) == 0)
 			return (*module);
 	}
diff --git a/lib/openpam_strlcmp.h b/lib/openpam_strlcmp.h
new file mode 100644
index 0000000..c692225
--- /dev/null
+++ b/lib/openpam_strlcmp.h
@@ -0,0 +1,46 @@
+/*-
+ * Copyright (c) 2011 Dag-Erling Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: openpam_strlcmp.h 475 2011-11-03 15:29:24Z des $
+ */
+
+#ifndef OPENPAM_STRLCMP_H_INCLUDED
+#define OPENPAM_STRLCMP_H_INCLUDED
+
+#ifndef HAVE_STRLCMP
+/* like strcmp(3), but verifies that the entirety of s1 was matched */
+static int
+strlcmp(const char *s1, const char *s2, size_t len)
+{
+
+	for (; len && *s1 && *s2; --len, ++s1, ++s2)
+		if (*s1 != *s2)
+			return ((unsigned char)*s1 - (unsigned char)*s2);
+	return ((unsigned char)*s1);
+}
+#endif
+
+#endif
diff --git a/lib/openpam_strlcpy.h b/lib/openpam_strlcpy.h
new file mode 100644
index 0000000..921653b
--- /dev/null
+++ b/lib/openpam_strlcpy.h
@@ -0,0 +1,49 @@
+/*-
+ * Copyright (c) 2011 Dag-Erling Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: openpam_strlcpy.h 492 2011-11-20 02:04:17Z des $
+ */
+
+#ifndef OPENPAM_STRLCPY_H_INCLUDED
+#define OPENPAM_STRLCPY_H_INCLUDED
+
+#ifndef HAVE_STRLCPY
+/* like strcpy(3), but always NUL-terminates; returns strlen(src) */
+size_t
+strlcpy(char *dst, const char *src, size_t size)
+{
+	size_t len;
+
+	for (len = 0; *src && size > 1; ++len, --size)
+		*dst++ = *src++;
+	*dst = '\0';
+	while (*src)
+		++len, ++src;
+	return (len);
+}
+#endif
+
+#endif
diff --git a/lib/openpam_subst.c b/lib/openpam_subst.c
new file mode 100644
index 0000000..d54b827
--- /dev/null
+++ b/lib/openpam_subst.c
@@ -0,0 +1,168 @@
+/*-
+ * Copyright (c) 2011 Dag-Erling Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: openpam_subst.c 461 2011-11-02 14:00:38Z des $
+ */
+
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <security/pam_appl.h>
+
+#include "openpam_impl.h"
+
+#define subst_char(ch) do {			\
+	int ch_ = (ch);				\
+	if (buf && len < *bufsize)		\
+		*buf++ = ch_;			\
+	++len;					\
+} while (0)
+
+#define subst_string(s) do {			\
+	const char *s_ = (s);			\
+	while (*s_)				\
+		subst_char(*s_++);		\
+} while (0)
+
+#define subst_item(i) do {			\
+	int i_ = (i);				\
+	const void *p_;				\
+	ret = pam_get_item(pamh, i_, &p_);	\
+	if (ret == PAM_SUCCESS && p_ != NULL)	\
+		subst_string(p_);		\
+} while (0)
+
+/*
+ * OpenPAM internal
+ *
+ * Substitute PAM item values in a string
+ */
+
+int
+openpam_subst(const pam_handle_t *pamh,
+    char *buf, size_t *bufsize, const char *template)
+{
+	size_t len;
+	int ret;
+
+	ENTERS(template);
+	if (template == NULL)
+		template = "(null)";
+
+	len = 1; /* initialize to 1 for terminating NUL */
+	ret = PAM_SUCCESS;
+	while (*template && ret == PAM_SUCCESS) {
+		if (template[0] == '%') {
+			++template;
+			switch (*template) {
+			case 's':
+				subst_item(PAM_SERVICE);
+				break;
+			case 't':
+				subst_item(PAM_TTY);
+				break;
+			case 'h':
+				subst_item(PAM_HOST);
+				break;
+			case 'u':
+				subst_item(PAM_USER);
+				break;
+			case 'H':
+				subst_item(PAM_RHOST);
+				break;
+			case 'U':
+				subst_item(PAM_RUSER);
+				break;
+			case '\0':
+				subst_char('%');
+				break;
+			default:
+				subst_char('%');
+				subst_char(*template);
+			}
+			++template;
+		} else {
+			subst_char(*template++);
+		}
+	}
+	if (buf)
+		*buf = '\0';
+	if (ret == PAM_SUCCESS) {
+		if (len > *bufsize)
+			ret = PAM_TRY_AGAIN;
+		*bufsize = len;
+	}
+	RETURNC(ret);
+}
+
+/*
+ * Error codes:
+ *
+ *	=pam_get_item
+ *	!PAM_SYMBOL_ERR
+ *	PAM_TRY_AGAIN
+ */
+
+/**
+ * The =openpam_subst function expands a string, substituting PAM item
+ * values for all occurrences of specific substitution codes.
+ * The =template argument points to the initial string.
+ * The result is stored in the buffer pointed to by the =buf argument; the
+ * =bufsize argument specifies the size of that buffer.
+ * The actual size of the resulting string, including the terminating NUL
+ * character, is stored in the location pointed to by the =bufsize
+ * argument.
+ *
+ * If =buf is NULL, or if the buffer is too small to hold the expanded
+ * string, =bufsize is updated to reflect the amount of space required to
+ * hold the entire string, and =openpam_subst returns =PAM_TRY_AGAIN.
+ *
+ * If =openpam_subst fails for any other reason, the =bufsize argument is
+ * untouched, but part of the buffer may still have been overwritten.
+ *
+ * Substitution codes are introduced by a percent character and correspond
+ * to PAM items:
+ *
+ *	%H:
+ *		Replaced by the current value of the =PAM_RHOST item.
+ *	%h:
+ *		Replaced by the current value of the =PAM_HOST item.
+ *	%s:
+ *		Replaced by the current value of the =PAM_SERVICE item.
+ *	%t:
+ *		Replaced by the current value of the =PAM_TTY item.
+ *	%U:
+ *		Replaced by the current value of the =PAM_RUSER item.
+ *	%u:
+ *		Replaced by the current value of the =PAM_USER item.
+ *
+ * >pam_get_authtok
+ * >pam_get_item
+ * >pam_get_user
+ *
+ * AUTHOR DES
+ */
diff --git a/lib/openpam_ttyconv.c b/lib/openpam_ttyconv.c
index a6820b9..ec078f4 100644
--- a/lib/openpam_ttyconv.c
+++ b/lib/openpam_ttyconv.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: openpam_ttyconv.c 408 2007-12-21 11:36:24Z des $
+ * $Id: openpam_ttyconv.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/types.h>
 
 #include <ctype.h>
@@ -211,7 +215,7 @@ openpam_ttyconv(int n,
 	}
 	*resp = aresp;
 	RETURNC(PAM_SUCCESS);
- fail:
+fail:
 	for (i = 0; i < n; ++i) {
 		if (aresp[i].resp != NULL) {
 			memset(aresp[i].resp, 0, strlen(aresp[i].resp));
diff --git a/lib/pam_acct_mgmt.c b/lib/pam_acct_mgmt.c
index 0088ecf..49c34ab 100644
--- a/lib/pam_acct_mgmt.c
+++ b/lib/pam_acct_mgmt.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_acct_mgmt.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_acct_mgmt.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_authenticate.c b/lib/pam_authenticate.c
index 3b5a78d..fc6c20f 100644
--- a/lib/pam_authenticate.c
+++ b/lib/pam_authenticate.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_authenticate.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_authenticate.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_authenticate_secondary.c b/lib/pam_authenticate_secondary.c
index 27e3ce7..1a57313 100644
--- a/lib/pam_authenticate_secondary.c
+++ b/lib/pam_authenticate_secondary.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_authenticate_secondary.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_authenticate_secondary.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <security/pam_appl.h>
 
 /*
diff --git a/lib/pam_chauthtok.c b/lib/pam_chauthtok.c
index ecf1063..1750b0f 100644
--- a/lib/pam_chauthtok.c
+++ b/lib/pam_chauthtok.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_chauthtok.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_chauthtok.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_close_session.c b/lib/pam_close_session.c
index ab50e35..9e63a1d 100644
--- a/lib/pam_close_session.c
+++ b/lib/pam_close_session.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_close_session.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_close_session.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_end.c b/lib/pam_end.c
index 80baf8a..09cde35 100644
--- a/lib/pam_end.c
+++ b/lib/pam_end.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_end.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_end.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdlib.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_error.c b/lib/pam_error.c
index f42a6b5..1e0de5b 100644
--- a/lib/pam_error.c
+++ b/lib/pam_error.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_error.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_error.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/lib/pam_get_authtok.c b/lib/pam_get_authtok.c
index 2a974c9..a0613ef 100644
--- a/lib/pam_get_authtok.c
+++ b/lib/pam_get_authtok.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_get_authtok.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_get_authtok.c 455 2011-10-29 18:31:11Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <stdlib.h>
@@ -61,8 +65,10 @@ pam_get_authtok(pam_handle_t *pamh,
 	const char **authtok,
 	const char *prompt)
 {
+	char prompt_buf[1024];
+	size_t prompt_size;
 	const void *oldauthtok, *prevauthtok, *promptp;
-	const char *default_prompt;
+	const char *prompt_option, *default_prompt;
 	char *resp, *resp2;
 	int pitem, r, style, twice;
 
@@ -74,6 +80,7 @@ pam_get_authtok(pam_handle_t *pamh,
 	switch (item) {
 	case PAM_AUTHTOK:
 		pitem = PAM_AUTHTOK_PROMPT;
+		prompt_option = "authtok_prompt";
 		default_prompt = authtok_prompt;
 		r = pam_get_item(pamh, PAM_OLDAUTHTOK, &oldauthtok);
 		if (r == PAM_SUCCESS && oldauthtok != NULL) {
@@ -83,6 +90,7 @@ pam_get_authtok(pam_handle_t *pamh,
 		break;
 	case PAM_OLDAUTHTOK:
 		pitem = PAM_OLDAUTHTOK_PROMPT;
+		prompt_option = "oldauthtok_prompt";
 		default_prompt = oldauthtok_prompt;
 		twice = 0;
 		break;
@@ -99,13 +107,21 @@ pam_get_authtok(pam_handle_t *pamh,
 		else if (openpam_get_option(pamh, "use_first_pass"))
 			RETURNC(r == PAM_SUCCESS ? PAM_AUTH_ERR : r);
 	}
-	if (prompt == NULL) {
-		r = pam_get_item(pamh, pitem, &promptp);
-		if (r != PAM_SUCCESS || promptp == NULL)
-			prompt = default_prompt;
-		else
+	/* pam policy overrides the module's choice */
+	if ((promptp = openpam_get_option(pamh, prompt_option)) != NULL)
+		prompt = promptp;
+	/* no prompt provided, see if there is one tucked away somewhere */
+	if (prompt == NULL)
+		if (pam_get_item(pamh, pitem, &promptp) && promptp != NULL)
 			prompt = promptp;
-	}
+	/* fall back to hardcoded default */
+	if (prompt == NULL)
+		prompt = default_prompt;
+	/* expand */
+	prompt_size = sizeof prompt_buf;
+	r = openpam_subst(pamh, prompt_buf, &prompt_size, prompt);
+	if (r == PAM_SUCCESS && prompt_size <= sizeof prompt_buf)
+		prompt = prompt_buf;
 	style = openpam_get_option(pamh, "echo_pass") ?
 	    PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF;
 	r = pam_prompt(pamh, style, &resp, "%s", prompt);
@@ -160,6 +176,13 @@ pam_get_authtok(pam_handle_t *pamh,
  * If it is =NULL, the =PAM_AUTHTOK_PROMPT or =PAM_OLDAUTHTOK_PROMPT item,
  * as appropriate, will be used.
  * If that item is also =NULL, a hardcoded default prompt will be used.
+ * Either way, the prompt is expanded using =openpam_subst before it is
+ * passed to the conversation function.
+ *
+ * If =pam_get_authtok is called from a module and the ;authtok_prompt /
+ * ;oldauthtok_prompt option is set in the policy file, the value of that
+ * option takes precedence over both the =prompt argument and the
+ * =PAM_AUTHTOK_PROMPT / =PAM_OLDAUTHTOK_PROMPT item.
  *
  * If =item is set to =PAM_AUTHTOK and there is a non-null =PAM_OLDAUTHTOK
  * item, =pam_get_authtok will ask the user to confirm the new token by
@@ -168,4 +191,5 @@ pam_get_authtok(pam_handle_t *pamh,
  *
  * >pam_get_item
  * >pam_get_user
+ * >openpam_subst
  */
diff --git a/lib/pam_get_data.c b/lib/pam_get_data.c
index 0cceef0..1a8ba1d 100644
--- a/lib/pam_get_data.c
+++ b/lib/pam_get_data.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_get_data.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_get_data.c 444 2011-10-22 01:03:23Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <string.h>
 
 #include <security/pam_appl.h>
@@ -80,6 +84,7 @@ pam_get_data(const pam_handle_t *pamh,
  * context specified by the =pamh argument.
  * A pointer to the object is stored in the location pointed to by the
  * =data argument.
+ * If =pam_get_data fails, the =data argument is untouched.
  *
  * This function and its counterpart =pam_set_data are useful for managing
  * data that are meaningful only to a particular service module.
diff --git a/lib/pam_get_item.c b/lib/pam_get_item.c
index 9f127be..95b9df6 100644
--- a/lib/pam_get_item.c
+++ b/lib/pam_get_item.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,31 +32,19 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_get_item.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_get_item.c 491 2011-11-12 00:12:32Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
 
 #include "openpam_impl.h"
 
-const char *_pam_item_name[PAM_NUM_ITEMS] = {
-	"(NO ITEM)",
-	"PAM_SERVICE",
-	"PAM_USER",
-	"PAM_TTY",
-	"PAM_RHOST",
-	"PAM_CONV",
-	"PAM_AUTHTOK",
-	"PAM_OLDAUTHTOK",
-	"PAM_RUSER",
-	"PAM_USER_PROMPT",
-	"PAM_REPOSITORY",
-	"PAM_AUTHTOK_PROMPT",
-	"PAM_OLDAUTHTOK_PROMPT"
-};
-
 /*
  * XSSO 4.2.1
  * XSSO 6 page 46
@@ -83,9 +71,10 @@ pam_get_item(const pam_handle_t *pamh,
 	case PAM_RUSER:
 	case PAM_CONV:
 	case PAM_USER_PROMPT:
+	case PAM_REPOSITORY:
 	case PAM_AUTHTOK_PROMPT:
 	case PAM_OLDAUTHTOK_PROMPT:
-	case PAM_REPOSITORY:
+	case PAM_HOST:
 		*item = pamh->item[item_type];
 		RETURNC(PAM_SUCCESS);
 	default:
@@ -102,10 +91,12 @@ pam_get_item(const pam_handle_t *pamh,
 
 /**
  * The =pam_get_item function stores a pointer to the item specified by
- * the =item_type argument in the location specified by the =item
+ * the =item_type argument in the location pointed to by the =item
  * argument.
  * The item is retrieved from the PAM context specified by the =pamh
  * argument.
+ * If =pam_get_item fails, the =item argument is untouched.
+ *
  * The following item types are recognized:
  *
  *	=PAM_SERVICE:
@@ -135,6 +126,8 @@ pam_get_item(const pam_handle_t *pamh,
  *	=PAM_OLDAUTHTOK_PROMPT:
  *		The prompt to use when asking the applicant for an
  *		expired authentication token prior to changing it.
+ *	=PAM_HOST:
+ *		The name of the host the application runs on.
  *
  * See =pam_start for a description of =struct pam_conv.
  *
diff --git a/lib/pam_get_mapped_authtok.c b/lib/pam_get_mapped_authtok.c
index c49a918..54ff6c3 100644
--- a/lib/pam_get_mapped_authtok.c
+++ b/lib/pam_get_mapped_authtok.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_get_mapped_authtok.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_get_mapped_authtok.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <security/pam_appl.h>
 
 /*
diff --git a/lib/pam_get_mapped_username.c b/lib/pam_get_mapped_username.c
index 359baee..4f8ac17 100644
--- a/lib/pam_get_mapped_username.c
+++ b/lib/pam_get_mapped_username.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_get_mapped_username.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_get_mapped_username.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <security/pam_appl.h>
 
 /*
diff --git a/lib/pam_get_user.c b/lib/pam_get_user.c
index 115a3ea..53245b9 100644
--- a/lib/pam_get_user.c
+++ b/lib/pam_get_user.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_get_user.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_get_user.c 455 2011-10-29 18:31:11Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <stdlib.h>
@@ -58,6 +62,8 @@ pam_get_user(pam_handle_t *pamh,
 	const char **user,
 	const char *prompt)
 {
+	char prompt_buf[1024];
+	size_t prompt_size;
 	const void *promptp;
 	char *resp;
 	int r;
@@ -68,13 +74,22 @@ pam_get_user(pam_handle_t *pamh,
 	r = pam_get_item(pamh, PAM_USER, (const void **)user);
 	if (r == PAM_SUCCESS && *user != NULL)
 		RETURNC(PAM_SUCCESS);
-	if (prompt == NULL) {
-		r = pam_get_item(pamh, PAM_USER_PROMPT, &promptp);
-		if (r != PAM_SUCCESS || promptp == NULL)
-			prompt = user_prompt;
-		else
+	/* pam policy overrides the module's choice */
+	if ((promptp = openpam_get_option(pamh, "user_prompt")) != NULL)
+		prompt = promptp;
+	/* no prompt provided, see if there is one tucked away somewhere */
+	if (prompt == NULL)
+		if (pam_get_item(pamh, PAM_USER_PROMPT, &promptp) &&
+		    promptp != NULL)
 			prompt = promptp;
-	}
+	/* fall back to hardcoded default */
+	if (prompt == NULL)
+		prompt = user_prompt;
+	/* expand */
+	prompt_size = sizeof prompt_buf;
+	r = openpam_subst(pamh, prompt_buf, &prompt_size, prompt);
+	if (r == PAM_SUCCESS && prompt_size <= sizeof prompt_buf)
+		prompt = prompt_buf;
 	r = pam_prompt(pamh, PAM_PROMPT_ECHO_ON, &resp, "%s", prompt);
 	if (r != PAM_SUCCESS)
 		RETURNC(r);
@@ -105,9 +120,16 @@ pam_get_user(pam_handle_t *pamh,
  *
  * The =prompt argument specifies a prompt to use if no user name is
  * cached.
- * If it is =NULL, the =PAM_USER_PROMPT will be used.
+ * If it is =NULL, the =PAM_USER_PROMPT item will be used.
  * If that item is also =NULL, a hardcoded default prompt will be used.
+ * Either way, the prompt is expanded using =openpam_subst before it is
+ * passed to the conversation function.
+ *
+ * If =pam_get_user is called from a module and the ;user_prompt option is
+ * set in the policy file, the value of that option takes precedence over
+ * both the =prompt argument and the =PAM_USER_PROMPT item.
  *
  * >pam_get_item
  * >pam_get_authtok
+ * >openpam_subst
  */
diff --git a/lib/pam_getenv.c b/lib/pam_getenv.c
index f2d7910..e2ebf57 100644
--- a/lib/pam_getenv.c
+++ b/lib/pam_getenv.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_getenv.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_getenv.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/lib/pam_getenvlist.c b/lib/pam_getenvlist.c
index c0e128a..06c003f 100644
--- a/lib/pam_getenvlist.c
+++ b/lib/pam_getenvlist.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_getenvlist.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_getenvlist.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/lib/pam_info.c b/lib/pam_info.c
index 2e4dbc7..7e51dbf 100644
--- a/lib/pam_info.c
+++ b/lib/pam_info.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_info.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_info.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/lib/pam_open_session.c b/lib/pam_open_session.c
index f8d6eca..36c59b0 100644
--- a/lib/pam_open_session.c
+++ b/lib/pam_open_session.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_open_session.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_open_session.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_prompt.c b/lib/pam_prompt.c
index 76da55f..194e765 100644
--- a/lib/pam_prompt.c
+++ b/lib/pam_prompt.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_prompt.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_prompt.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/types.h>
 
 #include <stdarg.h>
diff --git a/lib/pam_putenv.c b/lib/pam_putenv.c
index 79d6228..369066d 100644
--- a/lib/pam_putenv.c
+++ b/lib/pam_putenv.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_putenv.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_putenv.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/lib/pam_set_data.c b/lib/pam_set_data.c
index 963de92..a8de632 100644
--- a/lib/pam_set_data.c
+++ b/lib/pam_set_data.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_set_data.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_set_data.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/lib/pam_set_item.c b/lib/pam_set_item.c
index 9b60618..05d538f 100644
--- a/lib/pam_set_item.c
+++ b/lib/pam_set_item.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_set_item.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_set_item.c 496 2011-11-21 16:20:45Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <stdlib.h>
@@ -66,6 +70,10 @@ pam_set_item(pam_handle_t *pamh,
 	osize = nsize = 0;
 	switch (item_type) {
 	case PAM_SERVICE:
+		/* set once only, by pam_start() */
+		if (*slot != NULL)
+			RETURNC(PAM_SYSTEM_ERR);
+		/* fall through */
 	case PAM_USER:
 	case PAM_AUTHTOK:
 	case PAM_OLDAUTHTOK:
@@ -75,6 +83,7 @@ pam_set_item(pam_handle_t *pamh,
 	case PAM_USER_PROMPT:
 	case PAM_AUTHTOK_PROMPT:
 	case PAM_OLDAUTHTOK_PROMPT:
+	case PAM_HOST:
 		if (*slot != NULL)
 			osize = strlen(*slot) + 1;
 		if (item != NULL)
diff --git a/lib/pam_set_mapped_authtok.c b/lib/pam_set_mapped_authtok.c
index 01ad255..d8db84f 100644
--- a/lib/pam_set_mapped_authtok.c
+++ b/lib/pam_set_mapped_authtok.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_set_mapped_authtok.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_set_mapped_authtok.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <security/pam_appl.h>
 
 /*
diff --git a/lib/pam_set_mapped_username.c b/lib/pam_set_mapped_username.c
index ae3619b..4b8f815 100644
--- a/lib/pam_set_mapped_username.c
+++ b/lib/pam_set_mapped_username.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_set_mapped_username.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_set_mapped_username.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <security/pam_appl.h>
 
 /*
diff --git a/lib/pam_setcred.c b/lib/pam_setcred.c
index 80eb468..51fb081 100644
--- a/lib/pam_setcred.c
+++ b/lib/pam_setcred.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_setcred.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_setcred.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_setenv.c b/lib/pam_setenv.c
index e73f6b5..fbe6a8f 100644
--- a/lib/pam_setenv.c
+++ b/lib/pam_setenv.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_setenv.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_setenv.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
diff --git a/lib/pam_sm_acct_mgmt.c b/lib/pam_sm_acct_mgmt.c
index a57e86a..f5c14cf 100644
--- a/lib/pam_sm_acct_mgmt.c
+++ b/lib/pam_sm_acct_mgmt.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_acct_mgmt.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_acct_mgmt.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_sm_authenticate.c b/lib/pam_sm_authenticate.c
index 7f4bb1c..97851af 100644
--- a/lib/pam_sm_authenticate.c
+++ b/lib/pam_sm_authenticate.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_authenticate.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_authenticate.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_sm_authenticate_secondary.c b/lib/pam_sm_authenticate_secondary.c
index bde0366..3f3f6bd 100644
--- a/lib/pam_sm_authenticate_secondary.c
+++ b/lib/pam_sm_authenticate_secondary.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_authenticate_secondary.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_authenticate_secondary.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_sm_chauthtok.c b/lib/pam_sm_chauthtok.c
index 2c41d6d..593344c 100644
--- a/lib/pam_sm_chauthtok.c
+++ b/lib/pam_sm_chauthtok.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_chauthtok.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_chauthtok.c 466 2011-11-02 23:33:43Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
@@ -80,4 +84,8 @@ pam_sm_chauthtok(pam_handle_t *pamh,
 /**
  * The =pam_sm_chauthtok function is the service module's implementation
  * of the =pam_chauthtok API function.
+ *
+ * When the application calls =pam_chauthtok, the service function is
+ * called twice, first with the =PAM_PRELIM_CHECK flag set and then again
+ * with the =PAM_UPDATE_AUTHTOK flag set.
  */
diff --git a/lib/pam_sm_close_session.c b/lib/pam_sm_close_session.c
index 25cee92..290f497 100644
--- a/lib/pam_sm_close_session.c
+++ b/lib/pam_sm_close_session.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_close_session.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_close_session.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_sm_get_mapped_authtok.c b/lib/pam_sm_get_mapped_authtok.c
index 9d85d5f..e86e6e5 100644
--- a/lib/pam_sm_get_mapped_authtok.c
+++ b/lib/pam_sm_get_mapped_authtok.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_get_mapped_authtok.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_get_mapped_authtok.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_sm_get_mapped_username.c b/lib/pam_sm_get_mapped_username.c
index ee4d250..596ca6c 100644
--- a/lib/pam_sm_get_mapped_username.c
+++ b/lib/pam_sm_get_mapped_username.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_get_mapped_username.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_get_mapped_username.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_sm_open_session.c b/lib/pam_sm_open_session.c
index bfe0794..acb401a 100644
--- a/lib/pam_sm_open_session.c
+++ b/lib/pam_sm_open_session.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_open_session.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_open_session.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_sm_set_mapped_authtok.c b/lib/pam_sm_set_mapped_authtok.c
index 54fd370..dab40fd 100644
--- a/lib/pam_sm_set_mapped_authtok.c
+++ b/lib/pam_sm_set_mapped_authtok.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_set_mapped_authtok.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_set_mapped_authtok.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_sm_set_mapped_username.c b/lib/pam_sm_set_mapped_username.c
index 0239dbb..3011016 100644
--- a/lib/pam_sm_set_mapped_username.c
+++ b/lib/pam_sm_set_mapped_username.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_set_mapped_username.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_set_mapped_username.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_sm_setcred.c b/lib/pam_sm_setcred.c
index 4d472b3..0d30683 100644
--- a/lib/pam_sm_setcred.c
+++ b/lib/pam_sm_setcred.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_sm_setcred.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_sm_setcred.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <sys/param.h>
 
 #include <security/pam_appl.h>
diff --git a/lib/pam_start.c b/lib/pam_start.c
index ee6468b..84e0085 100644
--- a/lib/pam_start.c
+++ b/lib/pam_start.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,14 +32,27 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_start.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_start.c 503 2011-12-18 14:00:33Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
 
 #include <security/pam_appl.h>
 
 #include "openpam_impl.h"
+#include "openpam_strlcpy.h"
+
+#ifdef _SC_HOST_NAME_MAX
+#define HOST_NAME_MAX sysconf(_SC_HOST_NAME_MAX)
+#else
+#define HOST_NAME_MAX 1024
+#endif
 
 /*
  * XSSO 4.2.1
@@ -54,6 +67,7 @@ pam_start(const char *service,
 	const struct pam_conv *pam_conv,
 	pam_handle_t **pamh)
 {
+	char hostname[HOST_NAME_MAX + 1];
 	struct pam_handle *ph;
 	int r;
 
@@ -62,20 +76,20 @@ pam_start(const char *service,
 		RETURNC(PAM_BUF_ERR);
 	if ((r = pam_set_item(ph, PAM_SERVICE, service)) != PAM_SUCCESS)
 		goto fail;
+	if (gethostname(hostname, sizeof hostname) != 0)
+		strlcpy(hostname, "localhost", sizeof hostname);
+	if ((r = pam_set_item(ph, PAM_HOST, hostname)) != PAM_SUCCESS)
+		goto fail;
 	if ((r = pam_set_item(ph, PAM_USER, user)) != PAM_SUCCESS)
 		goto fail;
 	if ((r = pam_set_item(ph, PAM_CONV, pam_conv)) != PAM_SUCCESS)
 		goto fail;
-
-	r = openpam_configure(ph, service);
-	if (r != PAM_SUCCESS)
+	if ((r = openpam_configure(ph, service)) != PAM_SUCCESS)
 		goto fail;
-
 	*pamh = ph;
 	openpam_log(PAM_LOG_DEBUG, "pam_start(\"%s\") succeeded", service);
 	RETURNC(PAM_SUCCESS);
-
- fail:
+fail:
 	pam_end(ph, r);
 	RETURNC(r);
 }
diff --git a/lib/pam_strerror.c b/lib/pam_strerror.c
index 24498c4..e29219d 100644
--- a/lib/pam_strerror.c
+++ b/lib/pam_strerror.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,48 +32,19 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_strerror.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_strerror.c 491 2011-11-12 00:12:32Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdio.h>
 
 #include <security/pam_appl.h>
 
 #include "openpam_impl.h"
 
-const char *_pam_err_name[PAM_NUM_ERRORS] = {
-	"PAM_SUCCESS",
-	"PAM_OPEN_ERR",
-	"PAM_SYMBOL_ERR",
-	"PAM_SERVICE_ERR",
-	"PAM_SYSTEM_ERR",
-	"PAM_BUF_ERR",
-	"PAM_CONV_ERR",
-	"PAM_PERM_DENIED",
-	"PAM_MAXTRIES",
-	"PAM_AUTH_ERR",
-	"PAM_NEW_AUTHTOK_REQD",
-	"PAM_CRED_INSUFFICIENT",
-	"PAM_AUTHINFO_UNAVAIL",
-	"PAM_USER_UNKNOWN",
-	"PAM_CRED_UNAVAIL",
-	"PAM_CRED_EXPIRED",
-	"PAM_CRED_ERR",
-	"PAM_ACCT_EXPIRED",
-	"PAM_AUTHTOK_EXPIRED",
-	"PAM_SESSION_ERR",
-	"PAM_AUTHTOK_ERR",
-	"PAM_AUTHTOK_RECOVERY_ERR",
-	"PAM_AUTHTOK_LOCK_BUSY",
-	"PAM_AUTHTOK_DISABLE_AGING",
-	"PAM_NO_MODULE_DATA",
-	"PAM_IGNORE",
-	"PAM_ABORT",
-	"PAM_TRY_AGAIN",
-	"PAM_MODULE_UNKNOWN",
-	"PAM_DOMAIN_UNKNOWN"
-};
-
 /*
  * XSSO 4.2.1
  * XSSO 6 page 92
@@ -159,6 +130,8 @@ pam_strerror(const pam_handle_t *pamh,
 /**
  * The =pam_strerror function returns a pointer to a string containing a
  * textual description of the error indicated by the =error_number
- * argument, in the context of the PAM transaction described by the =pamh
  * argument.
+ * The =pamh argument is ignored.
+ * For compatibility with other implementations, it should be either a
+ * valid PAM handle returned by a previous call to =pam_start, or =NULL.
  */
diff --git a/lib/pam_verror.c b/lib/pam_verror.c
index 0b128d1..9ed85b6 100644
--- a/lib/pam_verror.c
+++ b/lib/pam_verror.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_verror.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_verror.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdarg.h>
 #include <stdlib.h>
 
diff --git a/lib/pam_vinfo.c b/lib/pam_vinfo.c
index 5282714..95f45f4 100644
--- a/lib/pam_vinfo.c
+++ b/lib/pam_vinfo.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_vinfo.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_vinfo.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdarg.h>
 #include <stdlib.h>
 
diff --git a/lib/pam_vprompt.c b/lib/pam_vprompt.c
index e1215c3..1e390e0 100644
--- a/lib/pam_vprompt.c
+++ b/lib/pam_vprompt.c
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2007 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2011 Dag-Erling Smørgrav
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -32,9 +32,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pam_vprompt.c 408 2007-12-21 11:36:24Z des $
+ * $Id: pam_vprompt.c 437 2011-09-13 12:00:13Z des $
  */
 
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>