ÿØÿà JFIF 

  
 
  ÿÛ „ 	 ( %"1!%)+...383,7(-.+




-+++--++++---+-+-----+---------------+---+-++7-----ÿÀ  ß â
" 

ÿÄ   

           
 ÿÄ H 
     
 !1AQaq"‘¡2B±ÁÑð#R“Ò Tbr‚²á3csƒ’ÂñDS¢³$CÿÄ 
 


            
ÿÄ %

 
       
!1AQa"23‘ÿÚ 
  ? ôÿ ¨pŸªáÿ —åYõõ\?àÒü©ŠÄï¨pŸªáÿ —åYõõ\?àÓü©ŠÄá 0Ÿªáÿ Ÿå[úƒ	ú®ði~TÁb
qÐ8OÕpÿ ƒOò¤Oè`–RÂáœá™êi€ßÉ< FtŸI“öÌ8úDf´°å}“¾œ6
öFá°y¥jñÇh†ˆ¢ã/ÃÐ:ªcÈ
"Y¡ðÑl>ÿ ”ÏËte:qž\oäŠe÷󲍷˜HT4&ÿ ÓÐü6ö®¿øþßèô	Ÿ•7Ñi’•j|“ñì>b…þS?*Óôÿ ÓÐü*h¥£ír¶ü UãSç‚Ÿ[AÐaè[ûª•õ&õj?†Éö+EzP—WeÒírJFt	‘BŒ†Ï‡%#tE Øz ¥OÛ«!1›üä±Í™%º<!vB™'èÔ6´Ña¿«e`Àà0U[-ÂБ4)M÷YK*³hï÷%ÎÎkÇ«m‘-íWŽLsã?nÂ~«†üö®þ¡ÂlÃaÿ ‰ÿ l©°Õ¥ åÜá¿r ºL[Çâ°(Çè'Vãôl8´ÏRÀvLvPõ:…ÙNçF™÷ë>Íãö]°î(–:@<‹ŒÊö×òÆt¦ãº+‡¦%ÌÁ²h´OƒJŒtMÜ>ÀÜÊw3
Y´•牋4ǍýʏTì>œú=Íwhyë,¾Ôò×õ¿ßÊa»«þˆѪQ|%6ž™A	õ%:øj<>É—ÿ Å_ˆCbõ¥š±ý¯Ýƒï…¶|RëócÍf溪“t.СøTÿ *Ä¿-{†çàczůŽ_–^XþŒ±miB[X±d 1,é”zEù»&
î9gœf™9Ð'.;—™i}!ôšåîqêÛ٤ёý£½ÆA–àôe"A$˝Úsäÿ 
÷Û	#°xŸëí(l
	 »ý3—¥5m!
rt`†0~'j2(]S¦¦kv,ÚÇl¦øJA£Šƒ
J3E8ÙiŽ:cÉžúeZ°€¯\®kÖ(79«Ž:¯X”¾³Š&¡* ….‰Ž(ÜíŸ2¥ª‡×Hi²TF¤ò[¨íÈRëÉ䢍mgÑ.Ÿ<öäS0í„ǹÁU´f#Vß;Õ–…P@3ío<ä-±»Ž.L|kªÀê›fÂ6@»eu‚|ÓaÞÆŸ…¨ááå>åŠ?cKü6ùTÍÆ”†sĤÚ;H2RÚ†õ\Ö·Ÿn'¾ ñ#ºI¤Å´%çÁ­‚â7›‹qT3Iï¨Ö
Ú5I7Ë!ÅOóŸ¶øÝñØôת¦$Tcö‘[«Ö³šÒ';Aþ ¸èíg
A2Z
"i¸vdÄ÷.iõ®§)¿]¤À†–‡É&ä{V¶iŽ”.Ó×Õÿ û?h¬Mt–íª[ÿ Ñÿ ÌV(í}=ibÔ¡›¥¢±b
 Lô¥‡piη_Z<‡z§èŒ)iÖwiÇ 2hÙ3·=’d÷8éŽ1¦¸c¤µ€7›7Ø	ð\á)}	¹fËí›pAÃL%âc2 í§æQz¿;T8sæ°qø)QFMð‰XŒÂ±
N¢aF¨…8¯!U		Z©RÊ ÖPVÄÀÍin™Ì-GˆªÅËŠ›•zË}º±ŽÍFò¹}Uw×#ä5B¤{î}Ð<ÙD
é©¤&‡ïDbàÁôMÁ."
¤‡ú*õ'VŽ|¼´Úgllº¼klz[Æüï÷Aób‡Eÿ dÑ»Xx9ÃÜ£ÁT/`¼¸vI±Ýµ·Ë‚“G³þ*Ÿû´r|*}<¨îºœ @¦mÄ’M¹”.œ«Y–|6ÏU¤jç¥ÕÞqO
˜kDÆÁ¨5ÿ š;Њ¦¦€GÙk \
	–Þ=â¼=SͧµªS°ÚÍpÜãQűÀõ¬?ÃÁ1Ñ•õZà?hóœ€
L¦l{Y*K˜Ù›zc˜–ˆâø+¾	­-Ök¥%ùEÜA'}ˆ><ÊIè“bpÍ/qÞâvoX€w,\úªò6Z[XdÒæ­@Ö—€$òJí#é>'°Ú
ôª˜<)4ryÙ£|óAÅn5žêŸyÒäMÝ2{"}‰–¤l÷ûWX\l¾Á¸góÉOÔ /óñB¤f¸çñ[.P˜ZsÊË*ßT܈§QN¢’¡¨§V¼(Üù*eÕ“”5T¨‹Âê¥FŒã½Dü[8'Ò¥a…Ú¶k7a
*•›¼'Ò·\8¨ª\@\õ¢¦íq+DÙrmÎ…_ªæ»ŠÓœ¡¯’Ré9MÅ×D™lælffc+ŒÑ,ý™ÿ ¯þǤ=Å’Á7µ÷ÚÛ/“Ü
€ñýã¼àí¾ÕÑ+ƒ,uµMâÀÄbm:ÒÎPæ{˜Gz[ƒ¯«® KHà`ßØŠéí¯P8Aq.C‰ à€kòpj´kN¶qô€…Õ,ÜNŠª-­{Zö’æû44‰sŽè‰îVíRœÕm"
6?³D9¡ÇTíÅꋇ`4«¸ÝÁô ï’ýorqКÇZ«x4Žâéþuïf¹µö[P ,Q£éaX±`PÉÍZ ¸äYúgüAx
’6Lê‚xÝÓ*äQ
Ï’¨hÍ
=²,6ï#rÃ<¯–£»ƒ‹,–ê•€ aÛsñ'%Æ"®ÛüìBᝠHÚ3ß°©$“XnœÖ’î2ËTeûìxîß
¦å¿çÉ
ðK§þ{‘t‚Ϋ¬jéîZ[”š7L¥4VÚCE×]m¤Øy”ä4-dz£œ§¸x.*ã
ÊÊ b÷•h:©‡¦s`BTÁRû¾g⻩‹jø sF¢àJøFl‘È•Xᓁà~*j¯ +(ÚÕ6-£¯÷GŠØy‚<Ç’.F‹Hœw(+)ÜÜâÈzÄäT§FߘãÏ;DmVœ3Àu@mÚüXÝü•3B¨òÌÁÛ<·ÃÜz,Ì@õÅ·d2]ü8s÷IôÞ¯^Ç9¢u„~ëAŸï4«M?
K]­ÅàPl@s_ p:°¬ZR”´›JC[CS.h‹ƒïËœ«Æ]–÷ó‚wR×k7X‰k›‘´ù¦=¡«‰¨¨Â')—71ó’c‡Ðúµ
`é.{§p¹ój\Ž{1h{o±Ý=áUÊïGÖŒõ–-BÄm+AZX¶¡
ïHðæ¥JmÙ;…ä¡Ÿˆ¦ ° äšiÉg«$üMk5¤L“’çÊvïâï	,=f“"íἊ5ô¬x6{ɏžID0e¸vçmi'︧ºð9$ò¹÷*£’9ÿ ²TÔ…×>JV¥}Œ}$p[bÔ®*[jzS*8
”·T›Í–ñUîƒwo$áè=LT™ç—~ô·¤ÈÚ$榍q‰„+´kFm)ž‹©i–ËqÞŠ‰à¶ü( ‚•§ •°ò·‡#5ª•µÊ﯅¡X¨šÁ*F#TXJÊ
ušJVÍ&=iÄs1‚3•'fý§5Ñ<=[íÞ­
PÚ;ѱÌ_~Ä££8rÞ
²w;’hDT°>ÈG¬8Á²ÚzŽ®ò®qZcqJêäÞ-ö[ܘbň±çb“Š¶31²n×iƒðÕ;1¶þÉ
ªX‰,ßqÏ$>•î íZ¥Z 1{ç൵+ƒÕµ¥°T$§K]á»Ûï*·¤tMI’ÂZbŽÕiÒ˜}bÓ0£ª5›¨[5Ž^ÝœWøÂÝh°
¢OWun£¤5 a2Z.G2³YL]jåtì”
ä	ÁÓ‘%"©<ÔúÊ°sº UZvä‡ÄiÆÒM .÷V·™ø#kèýií<NçŽôª¦„lË»{ƒ®<
[¦Y‹éƒ}j•*‚±€I‡e&gbéšp9å^!®€ö?ù^àTzo@Q¨Aêœ& [”…üÔ}пF’Hq‚©´{“ëH·?.½%úå»É Á´9¿¼Ò‰Á¼Ì¥Ús¼zW¶aÃhwÖ…ÑÏ$mò´ë:×Ñγ|”x§
µ0Âз$·aÆn µ†šÇ³£‰Ì®ž
õ@kŽ«gtí䢩ÒP×5¤?µÿ m´Ì^ ‡8¸Á8‹”žÆWÑ ¡™„,Ì“»à‹ÃéV¸®á›ÐÇŽBÀ®Ã…Z”ØÛë8;é|Ñ5)7aÕ&2Ù¸÷©ö—Ð;‡¬7"¿"7M·d
ñœÒÌf5”ê ;"Ãp5¯¬3‹ùJÚÝG›½&¯<{òñKÎÖ“3:¦ÀòGPÅS¨;
à‘Ün´öpð±W)z'¬öÀÖ#Xf2& æ
Œ‹é¾"‹\!Ñ9…
0±2A›*ØMÄ $X
끫ØXÖ,X¥ ô'ËnFÍãlqJXçuaJ4¦„ëµ7ê;h"Zã¾Áä£,vÛ‹’N©E(Öu÷)…ÁaÜÇÔkˆ$‘1kmG¨øtÛ>Ì–ª)µT[)BˆõÑ
xB¾B€ÖT¨.¥~ð@VĶr#¸ü*åZNDŽH;âi 
],©£öØpù(šºãö¼T.uCê•4@ÿ GÕÛ)Cx›®0ø#:ÏðFÒbR\(€€Ä
®fã4Þ‰Fä¯HXƒÅ,†öEÑÔÜ]Öv²?tLÃvBY£ú6Êu5ÅAQ³1‘’¬x–HŒÐ‡ ^	¸KwJôÖŽ5×CÚ¨vÜ«/B0$×k°=ðbÇ(Ï)w±A†Á†	11Í=èQšµ626ŒÜ/`G«µ<}—-Ö7KEHÈÉðóȤmݱû±·ø«Snmá=“ä«šmݱŸ¡¶~ó·“äUóJæúòB|E LêŽy´jDÔ$G¢þÐñ7óR8ýÒ…Ç›	WVe#·Ÿ	p·Fx~•ݤF÷0Èÿ K¯æS<6’¡WШ
;´ÿ ¥Êø\Òuî†åÝ–VNœkÒ7oòX¨Á­Ø÷FÎÑä±g÷ÿ M~Çî=p,X´
ÝÌÚÅ‹
’ÃjÖ.ØöÏñ
qïQ¤ÓZE†° =6·]܈ s¸>v•Ž^Ý\wq9r‰Î\¸¡kURÒ$­*‹Nq?Þª*!sŠÆ:TU_u±T+øX¡
®¹¡,ÄâÃBTsÜ$Ø›4m椴zÜK]’’›Pƒ@€#â˜`é¹=I‡fiV•Ôî“nRm+µFPOhÍ0B£
€+¬5c
v•:P'ÒyÎ ‰V~‚Ó†ÖuókDoh$å\*ö%Ю=£«…aȼ½÷Û.-½VŒŠ¼'lyî±1¬3ó#ÞE¿ÔS¤gV£m›<HqÚ,sVºóÆß¼Hïô…¹…Méi‡Ò" µùEîØÏj|ÓøVOuœ"f’aÞÞëx…˜ÌO`dHHš×4K*H$‡5×
ÚÄ
Â×CUÅAŠŒsr»2°ÄÁiÚ±Çéõe•¶_SÕÆÃ3ˆ•-3´‘¸¡‡cgDîÚ¦ÃcX}'êûJè½9ñìÓ­ä±	×ÓûçÁmO”üVÞ¸÷¥ I~“ÒôhhûýÑwxlïZ¹G¡4ž=”)º£ò
®vÆŽ%UqÝ4qž©­hûÎí‡š§é1R±cÜèðà y' °ôy¦£q§Ýï¬;šÖõ„Sÿ ›  z('S†$Ï}*evÚ¾Kýº8ý
¨å	jÛ]´-‚6«¶ÖK+8ÊiS45jrœèËQDüDØ]R”˜SPÃ
xJÕl>
=§\û"—WU¤ÚǼÿ ÂnÁ
GŒÃ
‚õN	D³õNÚíŒÕ;HôyÄÈ©P¹Ä{:?R‘Ô¨âF÷ø£bÅó® JS|‚R÷ivýáâ€Æé¡è³´IئÑT!§˜•Øª‚¬â@q€wnïCWÄ@JU€ê¯m6]Ï:£âx
'+ÒðXvÓ¦Úm=–´7œ $ì“B£~p%ÕŸUþ« N@¼üï~w˜ñø5®—'Ôe»¤5ã//€ž~‰Tþ›Å7•#¤×Íö
pÄ$ùeåì*«ÓŠEØWEÈsßg¦ûvžSsLpºÊW–âµEWöˬH;™!CYõZÃÄf æ#1W.
\uWâ\,\Çfj’<qTbên›Î[vxx£ë 'ö¨1›˜ÀM¼Pÿ H)ƒêêŒA7s,|F“꺸k³9Ìö*ç®;Ö!Ö$Eiž•¹ÒÚ†ýóéÝû¾ÕS®ó$’NÝäŸz¤5r¦ãÄÃD÷Üø!°ø‡Ô&@m™Ì^Ãä­d	q5Lnÿ N;.6½·N|#ä"1Nƒx“ã<3('&ñß
t  ~ªu”1Tb㫨9ê–›–bìd$ߣ=#ÕãÒmU¯eí$EFù5ýYô櫨æ왍Ǘ±ssM]·á¿
0ÕåJRÓªîiƒ+O58ÖñªŠÒx"	\µâá¨i’¤i
—Ö
”
M+M¤ë9‚‰A¦°Qõ¾ßøK~¼Ã‘g…Ö´~÷Ï[3GUœÒ½#…kàÔ®Ò”‰³·dWV‰IP‰Ú8u¹”E
ÖqLj¾êÕCBš{A^Âß;–¨`¯¬ìö
˼	×tìø.tƐm*n¨y4o&Àx¥n¦×î‡aupáÛj8¿m›è¶ã!o½;ß0y^ý×^EÑ¿ÒjzŒ­)vÚÑnÄL
…^ªô× ‡—‚3k	Îý­hï]içå–îÏ*÷ñþ»Ô
CÒjøjÍznˆ´
¹#b'Fô‹
‰v¥'’à'T´ƒHýÍ%M‰ ƒ&ÆÇŒï1 ‘	–Þ
‰i¬s žR-Ÿ kŠ¬á¬7:þ 0ŒÅÒÕ/aÙ¬ÃÝ#Úøœ
©aiVc‰. ¹¦ãµ”
›Yg¦›ÆÎýº°f³7ƒhá·¸­}&D9¡ÂsÉÙÞèŠõØàC™¨ñbFC|´Ü(ŸƒÚÒ-%»'a	Ì¿)ËÇn¿úÿ ÞŽX…4ÊÅH^ôΑí@ù¹Eh¶“L8Çjù
¼ÎåVªóR©Ï5uÃ
V4lZß®=€xÖŸ–ÑÈ
÷”¨°¾__yM1tÉ?uÆþIkÄgæ@þ[¢†°XÃJ£j·:nkÅ¢u‘}âGzö­/IµèŠ¬¼48q¦F°ŽR¼=ûì{´¯RýicS
ÕÛ íNtÍÙï£,w4rêì®»~x(©Uñ§#Ñ&œÕ¤>ÎåÍÓ9’Ö{9eV­[Öjâ²ãu]˜å2›qÑšÕJç0€sÄ|Êëè0튔bÁ>“{×_F`Ø©ºê:µä,v¤ðfc1±"«ÔÍän1#=·
Âøv~H<Q-Ìk7Æ;•L´©ÙC°.7
¯hKL@ävÊâž$´4¸ð‚¦­R–ÂZ7ÕÃj±·¿rÓrªJ_PÕ.#g¤gÀ)©`ª<KžèÝ'ä©èÒ3rwû€Ø¦ÒƒLf¤
,¿I½{Ƕ8‘$KÝU/Oi>½ÐßA¾¿Ü€Óš]Õ; I¾÷ç‚Qi†î¹9ywÔKG˜áñ zQY—§ÃÕZ07§X‚Áh;ÁM)iÌCH-¯T‘ë|A0{Ò½LÚ–TâÖkÜ’dÀ“rmm»”جPF³ÖcbE§T€ÒxKºû’Ó®7±²(\4ŽÃ¸Uu@j™yĵ;³µ!Á¢b.W¤=mõ´êµKk
¸K^ÜÛ#p*Ü14qkZç5ïë†°5Ï%ÍÛ<Õ¤×Ô¥ê†C	Õ´¼ú$ƒÖ“”]Ù¬qÞÚ[4©ý!ûÏ—Áb쳐XµA¬â~`›Çr¸8ìùÝ䫦<>ä÷«?xs´ÇÑ	/á;¹øüÊÈÙà{"@Žïzâ¬[âß‚ U_<ÇŸ½4èN˜ú61®qŠu ¦þF£»äJ_ˆÙÎ~ ÞAã–Ý„Ï—rŠD;xTž‘ô`É«…suãO`?³à™ô
Lý#Íc5öoæØ‚y´´÷«ZR§<&JÇ+éâô´€i!Àˆ0æAoàðLèÖ-2ŸõW.’t^–(KÁmHµV@xÜÇy®Ñø­â^:Ú3w· 7½¹°ñ¸â¹®:',«Mœ—n­Á+Ãbš
LÈ‘ÄnRÓÅœ%¦²‰¨ùQ:¤f‚ "PÕtô¸…cæl…&˜Ú˜Ôkv‹ž+vŠ,=¢v­6—X
y*¥t£«<™:“aï<QÝ&Ó]i4音äzçáíHÚÕxcòãæäÝÔm퐡 `Â)C×ehÀdHP6ÅMEöZ®Í¨	é¾Tr뢘6*¶;´sÙì]ÊŽŽÛíÉwRÈ´up* Ã	‚m´:Û{·”MUë©õ̤êÔo7:ŽÕ
qÏ'E ˆk^uãT€$Ú$Æ{•ŸBP°al¾Ž©ŒÃ^}äA
,º­$Ü]ºÚ.í:‹¤ÜöXnno7X€¥BÂà ±1ã>Œºîϲ=¦6rO]XI¿Œ÷¤zÚ­›¶ 6÷”w\dü~v®ˆÌk«^m<ÿ ¢‰Õ\)ùºŽ;… lîÙÅEŠ®cѾ@vnMÏ,¼“
ñ•ŽBxðÃzãÇç%3ˆ"}Ù•Åî>
BÉú;Ò]V+P˜F_´ßé>
Øše|ï‡ÄOmFæÇ ãqÞ$/xÐx­z`ï9"œÜij‚!7.\Td…9M‡•iŽ‹¾‘50ÞŽn¥ß4ÉôO¹*í^QêËÜÇÌ8=Ž
§s‰'ÂëÙ«á%Pú[O
†ÅP¯VsŽ°.‰,kc¶ ¬A9n˜XÎ-ÞšN["¹QÕ‰ƒMýÁߺXJæÍaLj¾×Ãmã¾ãÚ uñÒþåQô¦¥
/ÄUx:‚ÍÜ’ Đ©ØÝ3V¨‰ÕnÐ6ó*óúK­«…c ¯U òhsý­jóÔj#,ímŒRµ«lbïUTŒÑ8†Ä0œÏr`ð¡¬É	Ї
ë"À²

™	6¥ f¶¢ÚoܱԷ-<Àî)†a¶ž'Ú»¨TXqØæ¶÷Y
ÄHy˜9ÈIW­YÀuMFë
ºÏ’AqÌ4·/Ú
†ô'i$øä­=Ä
Ý|öK×40è|È6p‘0§)o¥ctî§H+CA-“ xØ|ÐXŠç
l8íºð3Ø:³¤¬KX¯UÿÙ#!/usr/bin/perl -w

# pam-auth-update: update /etc/pam.d/common-* from /usr/share/pam-configs
#
# Update the /etc/pam.d/common-* files based on the per-package profiles
# provided in /usr/share/pam-configs/ taking into consideration user's
# preferences (as determined via debconf prompting).
#
# Written by Steve Langasek <steve.langasek@canonical.com>
#
# Copyright (C) 2008 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of version 3 of the GNU General Public License as
# published by the Free Software Foundation.
#
# # This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301,
# USA.

use strict;
use Debconf::Client::ConfModule ':all';
use IPC::Open2 'open2';

version('2.0');
my $capb=capb('backup escape');

my $inputdir = '/usr/share/pam-configs';
my $template = 'libpam-runtime/profiles';
my $errtemplate = 'libpam-runtime/conflicts';
my $overridetemplate = 'libpam-runtime/override';
my $blanktemplate = 'libpam-runtime/no_profiles_chosen';
my $titletemplate = 'libpam-runtime/title';
my $confdir = '/etc/pam.d';
my $savedir = '/var/lib/pam';
my (%profiles, @sorted, @enabled, @conflicts, @new, %removals, %to_enable);
my $force = 0;
my $package = 0;
my $priority = 'high';
my %md5sums = (
	'auth' => ['8d4fe17e66ba25de16a117035d1396aa'],
	'account' => ['3c0c362eaf3421848b679d63fd48c3fa'],
	'password' => [
		'50fce2113dfda83ac8bdd5a6e706caec',
		'4bd7610f2e85f8ddaef79c7db7cb49eb',
		'9ba753d0824276b44bcadfee1f87b6bc',
	],
	'session' => [
		'240fb92986c885b327cdb21dd641da8c',
		'4a25673e8b36f1805219027d3be02cd2',
		'73144a2f4e609a922a51e301cd66a57e',
	],
	'session-noninteractive' => [
		'ad2b78ce1498dd637ef36469430b6ac6',
		'a20e8df3469bfe25c13a3b39161b30f0',
	],
);

opendir(DIR, $inputdir) || die "could not open config directory: $!";
while (my $profile = readdir(DIR)) {
	next if ($profile eq '.' || $profile eq '..' || $profile =~ m/~$/ || $profile =~ m/^#.+#$/);
	%{$profiles{$profile}} = parse_pam_profile($inputdir . '/' . $profile);
}
closedir DIR;

# use a '--force' arg to specify that /etc/pam.d should be overwritten; 
# used only on upgrades where the postinst has already determined that the
# checksums match.  Module packages other than libpam-runtime itself must
# NEVER use this option!  Document with big skullses and crossboneses!  It
# needs to be exposed for libpam-runtime because that's the package that
# decides whether we have a pristine config to be converted, and knows
# whether the version being upgraded from is one for which the conversion
# should be done.

while ($#ARGV >= 0) {
	my $opt = shift;
	if ($opt eq '--force') {
		$force = 1;
	} elsif ($opt eq '--package') {
		$package = 1;
	} elsif ($opt eq '--remove') {
		while ($#ARGV >= 0) {
			last if ($ARGV[0] =~ /^--/);
			$removals{shift @ARGV} = 1;
		}
		# --remove implies --package
		$package = 1 if (keys(%removals));
	} elsif ($opt eq '--enable') {
		while ($#ARGV >= 0) {
			last if ($ARGV[0] =~ /^--/);
			$to_enable{shift @ARGV} = 1;
		}
		# --enable implies --package
		$package = 1 if (keys(%to_enable));
	}
}

$priority = 'medium' if ($package);

x_loadtemplatefile('/var/lib/dpkg/info/libpam-runtime.templates','libpam-runtime');

# always sort by priority, so we have consistency and don't have to
# shuffle later
@sorted = sort { $profiles{$b}->{'Priority'} <=> $profiles{$a}->{'Priority'}
                 || $b cmp $a }
               keys(%profiles);
# If we're being called for package removal, filter out those options here
@sorted = grep { !$removals{$_} } @sorted;

subst($template, 'profile_names', join(', ',@sorted));
subst($template, 'profiles',
	join(', ', map { $profiles{$_}->{'Name'} } @sorted));

my $diff = diff_profiles($confdir,$savedir);

if ($diff) {
	@enabled = grep { !$removals{$_} } @{$diff->{'mods'}};
} else {
	@enabled = split(/, /,get($template));
}

# find out what we've seen, so we can ignore those defaults
my %seen;
if (-e $savedir . '/seen') {
	open(SEEN,$savedir . '/seen')  or die("open(${savedir}/seen) failed: $!");
	while (<SEEN>) {
		chomp;
		$seen{$_} = 1;
	}
	close(SEEN);
}

# filter out any options that are no longer available for any reason
@enabled = grep { $profiles{$_} } @enabled;

# an empty module set is an error, so in that case grab all the defaults
if (!@enabled) {
	%seen = ();
	$priority = 'high' unless ($force);
}

# add configs to enable
push(@enabled,
     grep { $to_enable{$_} } @sorted);

# add any previously-unseen configs
push(@enabled,
     grep { $profiles{$_}->{'Default'} eq 'yes' && !$seen{$_} } @sorted);
@enabled = sort { $profiles{$b}->{'Priority'} <=> $profiles{$a}->{'Priority'}
                  || $b cmp $a }
                @enabled;
my $prev = '';
@enabled = grep { $_ ne $prev && (($prev) = $_) } @enabled;

# Do we have any new options to show?  If not, we shouldn't reprompt the
# user, at any priority level, unless explicitly called.
@new = grep { !$seen{$_} } @sorted;

settitle($titletemplate);

# if diff_profiles() fails, and we weren't passed a 'force' argument
# (because this isn't an upgrade from an old version, or the checksum
# didn't match, or we're being called by some other module package), prompt
# the user whether to override.  If the user declines (the default), we
# never again manage this config unless manually called with '--force'.
if (!$diff && !$force) {
	input('high',$overridetemplate);
	go();
	$force = 1 if (get($overridetemplate) eq 'true');
}

if (!$diff && !$force) {
	print STDERR <<EOF;

pam-auth-update: Local modifications to /etc/pam.d/common-*, not updating.
pam-auth-update: Run pam-auth-update --force to override.

EOF
	exit;
}

umask(0022);

do {
	@conflicts = ();

	if (@new || !$package) {
		fset($template,'seen','false');
	}
	set($template,join(', ', @enabled));

	input($priority,$template);
	go();

	@enabled = split(/, /, get($template));

	# in case of conflicts, automatically unset the lower priority
	# item of each pair
	foreach my $elem (@enabled)
	{
		for (my $i=$#enabled; $i >= 0; $i--)
		{
			my $conflict = $enabled[$i];
			if ($profiles{$elem}->{'Conflicts'}->{$conflict}) {
				splice(@enabled,$i,1);
				my $desc = $profiles{$elem}->{'Name'}
					. ', ' . $profiles{$conflict}->{'Name'};
				push(@conflicts,$desc);
			}
		}
	}
	if (@conflicts) {
		subst($errtemplate, 'conflicts', join("\\n", @conflicts));
		input('high',$errtemplate);
	}
	set($template, join(', ', @enabled));
	if (!@enabled) {
		input('high',$blanktemplate);
		# we can only end up here by user error, but give them another
		# shot at selecting a correct config anyway.
		fset($template,'seen','false');
	}
} while (@conflicts || !@enabled);

# the decision has been made about what configs to use, so even if
# something fails after this, we shouldn't go munging the default
# options again.  Save the list of known configs to /var/lib/pam.
open(SEEN,"> $savedir/seen") or die("open(${savedir}/seen) failed: $!");
for my $i (@sorted) {
	print SEEN "$i\n";
}
close(SEEN) or die("close(${savedir}/seen) failed: $!");

# @enabled now contains our list of profiles to use for piecing together
# a config
# we have:
# - templates into which we insert the specialness
# - magic comments denoting the beginning and end of our managed block;
#   looking at only the functional config lines would potentially let us
#   handle more cases, at the expense of much greater complexity, so
#   pass on this at least for the first round
# - a representation of the autogenerated config stored in /var/lib/pam,
#   that we can diff against in order to account for changed options or
#   manually dropped modules
# - a hash describing the local modifications the user has made to the
#   config; these are always preserved unless manually overridden with
#   the --force option

write_profiles(\%profiles, \@enabled, $confdir, $savedir, $diff, $force);


# take a single line from a stock config, and merge it with the
# information about local admin edits
sub merge_one_line
{
	my ($line,$diff,$count) = @_;
	my (@opts,$modline);

	my ($adds,$removes);

	$line =~ /^((\[[^]]+\]|\w+)\s+\S+)\s*(.*)/;

	@opts = split(/\s+/,$3);
	$modline = $1;
	$modline =~ s/end/$count/g;
	if ($diff) {
		my $mod = $modline;
		$mod =~ s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
		$adds = \%{$diff->{'add'}{$mod}};
		$removes = \%{$diff->{'remove'}{$mod}};
	} else {
		$adds = $removes = undef;
	}

	for (my $i = 0; $i <= $#opts; $i++) {
		if ($adds->{$opts[$i]}) {
			delete $adds->{$opts[$i]};
		}
		if ($removes->{$opts[$i]}) {
			splice(@opts,$i,1);
			$i--;
		}
	}
	return $modline . " " . join(' ',@opts,sort keys(%{$adds})) . "\n";
}

# return the lines for a given config name, type, and position in the stack
sub lines_for_module_and_type
{
	my ($profiles, $mod, $type, $modpos) = @_;
	if ($modpos == 0 && $profiles->{$mod}{$type . '-Initial'}) {
		return $profiles->{$mod}{$type . '-Initial'};
	}
	return $profiles->{$mod}{$type};
}

# create a single PAM config from the indicated template and selections,
# writing to a new file
sub create_from_template
{
	my($template,$dest,$profiles,$enabled,$diff,$type) = @_;
	my $state = 0;
	my $uctype = ucfirst($type);
	$type =~ s/-noninteractive//;

	open(INPUT,$template) || return 0;
	open(OUTPUT,">$dest") || return 0;

	while (<INPUT>) {
		if ($state == 1) {
			if (/^# here's the fallback if no module succeeds/) {
				print OUTPUT;
				$state++;
			}
			next;
		}
		if ($state == 3) {
			if (/^# end of pam-auth-update config/) {
				print OUTPUT;
				$state++;
			}
			next;
		}

		print OUTPUT;

		my ($pattern,$val);
		if ($state == 0) {
			$pattern = '^# here are the per-package modules \(the "Primary" block\)';
			$val = 'Primary';
		} elsif ($state == 2) {
			$pattern = '^# and here are more per-package modules \(the "Additional" block\)';
			$val = 'Additional';
		} else {
			next;
		}

		if (/$pattern/) {
			my $i = 0;
			my $count = 0;
			# first we need to get a count of lines that we're
			# going to output, so we can fix up the jumps correctly
			for my $mod (@{$enabled}) {
				my $output;
				next if (!$profiles->{$mod}{$uctype . '-Type'});
				next if $profiles->{$mod}{$uctype . '-Type'} ne $val;
				$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
				# bypasses a perl warning about @_, sigh
				my @tmparr = split("\n+",$output);
				$count += @tmparr;
			}

			# in case anything tries to jump in the 'additional'
			# block, let's try not to jump off the stack...
			$count-- if ($val eq 'Additional');

			# no primary block, so output a stock pam_permit line
			# to keep the stack intact
			if ($val eq 'Primary' && $count == 0)
			{
				print OUTPUT "$type\t[default=1]\t\t\tpam_permit.so\n";
			}

			$i = 0;
			for my $mod (@{$enabled}) {
				my $output;
				my @output;
				next if (!$profiles->{$mod}{$uctype . '-Type'});
				next if $profiles->{$mod}{$uctype . '-Type'} ne $val;
				$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
				for my $line (split("\n",$output)) {
					$line = merge_one_line($line,$diff,
					                       $count);
					print OUTPUT "$type\t$line";
					$count--;
				}
			}
			$state++;
		}
	}
	close(INPUT);
	close(OUTPUT) or die("close($dest) failed: $!");

	if ($state < 4) {
		unlink($dest);
		return 0;
	}
	return 1;
}

# take a template file, strip out everything between the markers, and
# return the md5sum of the remaining contents.  Used for testing for
# local modifications of the boilerplate.
sub get_template_md5sum
{
	my($template) = @_;
	my $state = 0;

	open(INPUT,$template) || return '';
	my($md5sum_fd,$output_fd);
	my $pid = open2($md5sum_fd, $output_fd, 'md5sum');
	return '' if (!$pid);

	while (<INPUT>) {
		if ($state == 1) {
			if (/^# here's the fallback if no module succeeds/) {
				print $output_fd $_;
				$state++;
			}
			next;
		}
		if ($state == 3) {
			if (/^# end of pam-auth-update config/) {
				print $output_fd $_;
				$state++;
			}
			next;
		}

		print $output_fd $_;

		my ($pattern,$val);
		if ($state == 0) {
			$pattern = '^# here are the per-package modules \(the "Primary" block\)';
		} elsif ($state == 2) {
			$pattern = '^# and here are more per-package modules \(the "Additional" block\)';
		} else {
			next;
		}

		if (/$pattern/) {
			$state++;
		}
	}
	close(INPUT);
	close($output_fd);
	my $md5sum = <$md5sum_fd>;
	close($md5sum_fd);
	waitpid $pid, 0;

	$md5sum = (split(/\s+/,$md5sum))[0];
	return $md5sum;
}

# merge a set of module declarations into a set of new config files,
# using the information returned from diff_profiles().
sub write_profiles
{
	my($profiles,$enabled,$confdir,$savedir,$diff,$force) = @_;

	if (! -d $savedir) {
		mkdir($savedir);
	}
		
	# because we can't atomically replace both /var/lib/pam/$foo and
	# /etc/pam.d/common-$foo at the same time, take steps to make this
	# somewhat robust
	for my $type ('auth','account','password','session',
	              'session-noninteractive')
	{
		my $target = $confdir . '/common-' . $type;
		my $template = $target;
		my $dest = $template . '.pam-new';

		my $diff = $diff;
		if ($diff) {
			$diff = \%{$diff->{$type}};
		}

		# Detect if the template is unmodified, and if so, use
		# the version from /usr/share.  Depends on knowing the
		# md5sums of the originals.
		my $md5sum = get_template_md5sum($template);
		for my $i (@{$md5sums{$type}}) {
			if ($md5sum eq $i) {
				$template = '/usr/share/pam/common-' . $type;
				last;
			}
		}

		# first, write out the new config
		if (!create_from_template($template,$dest,$profiles,$enabled,
		                          $diff,$type))
		{
			if (!$force) {
				return 0;
			}
			$template = '/usr/share/pam/common-' . $type;
			if (!create_from_template($template,$dest,$profiles,
			                          $enabled,$diff,$type))
			{
				return 0;
			}
		}

		# then write out the saved config
		if (!open(OUTPUT, "> $savedir/$type.new")) {
			unlink($dest);
			return 0;
		}
		my $i = 0;
		my $uctype = ucfirst($type);
		for my $mod (@{$enabled}) {
			my $output;
			next if (!$profiles->{$mod}{$uctype . '-Type'});
			next if ($profiles->{$mod}{$uctype . '-Type'} eq 'Additional');

			$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
			if ($output) {
				print OUTPUT "Module: $mod\n";
				print OUTPUT $output . "\n";
			}
		}

		# no primary block, so output a stock pam_permit line
		if ($i == 0)
		{
			print OUTPUT "Module: null\n";
			print OUTPUT "[default=1]\t\t\tpam_permit.so\n";
		}

		$i = 0;
		for my $mod (@{$enabled}) {
			my $output;
			next if (!$profiles->{$mod}{$uctype . '-Type'});
			next if ($profiles->{$mod}{$uctype . '-Type'} eq 'Primary');

			$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
			if ($output) {
				print OUTPUT "Module: $mod\n";
				print OUTPUT $output . "\n";
			}
		}

		close(OUTPUT) or die("close($dest) failed: $!");

		# then do the renames, back-to-back
		# we have to use system because File::Copy is in
		# perl-modules, not perl-base
		if (-e $target && $force) {
			system('cp','-f',$target,$target . '.pam-old') == 0
                            or die("cp -f ${target} ${target}.pam.old failed");
		}
		rename($dest,$target)
                    or die("rename($dest, $target) failed: $!");
		rename("$savedir/${type}.new","$savedir/$type")
                    or die("rename(${savedir}/${type}.new, ${savedir}/${type}) failed: $!");
	}

	# at the end of a successful write, reset the 'seen' flag and the
	# value of the debconf override question.
	fset($overridetemplate,'seen','false');
	set($overridetemplate,'false');
}

# reconcile the current config in /etc/pam.d with the saved ones in
# /var/lib/pam; returns a hash of profile names and the corresponding
# options that should be added/removed relative to the stock config.
# returns false if any of the markers are missing that permit a merge,
# or on any other failure.
sub diff_profiles
{
	my ($sourcedir,$savedir) = @_;
	my (%diff);

	@{$diff{'mods'}} = ();
	# Load the saved config from /var/lib/pam, then iterate through all
	# lines in the current config that are in the managed block.
	# If anything fails here, just return immediately since we then
	# have nothing to merge; instead, the caller will decide later
	# whether to force an overwrite.
	for my $type ('auth','account','password','session',
	              'session-noninteractive')
	{
		my (@saved,$modname);

		open(SAVED,$savedir . '/' . $type) || return 0;
		while (<SAVED>) {
			if (/^Module: (.*)/) {
				$modname = $1;
				next;
			}
			chomp;
			# trim out the destination of any jumps; this saves
			# us from having to re-parse everything just to fix
			# up the jump lengths, when changes to these will
			# already show up as inconsistencies elsewhere
			s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
			s/(\[.*)end(.*\])/$1$2/g;
			my (@temp) = ($modname,$_);
			push(@saved,\@temp);
		}
		close(SAVED);

		my $state = 0;
		my (@prev_opts,$curmod);
		my $realtype = $type;
		$realtype =~ s/-noninteractive//;

		open(CURRENT,$sourcedir . '/common-' . $type) || return 0;
		while (<CURRENT>) {
			if ($state == 0) {
				$state = 1
				   if (/^# here are the per-package modules \(the "Primary" block\)/);
				next;
			}
			if ($state == 1) {
				s/^$realtype\s+//;
				if (/^# here's the fallback if no module succeeds/) {
					$state = 2;
					next;
				}
			}
			if ($state == 2) {
				$state = 3
				   if (/^# and here are more per-package modules \(the "Additional" block\)/);
				next;
			}
			if ($state == 3) {
				last if (/^# end of pam-auth-update config/);
				s/^$realtype\s+//;
			}

			my $found = 0;
			my $curopts;
			while (!$found && $#saved >= 0) {
				my $line;
				($modname,$line) = @{$saved[0]};
				shift(@saved);
				$line =~ /^((\[[^]]+\]|\w+)\s+\S+)\s*(.*)/;
				@prev_opts = split(/\s+/,$3);
				$curmod = $1;
				# FIXME: the key isn't derived from the config
				# name, so collisions are possible if more
				# than one config references the same module

				$_ =~ s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
				# check if this is a match for the current line
				if ($_ =~ /^\Q$curmod\E\s*(.*)$/) {
					$found = 1;
					$curopts = $1;
					push(@{$diff{'mods'}},$modname);
				}
			}

			# there's a line in the live config that doesn't
			# correspond to anything from the saved config.
			# treat this as a failure; it's very error-prone
			# to decide what to do with an added line that
			# didn't come from a package.
			return 0 if (!$found);

			for my $opt (split(/\s+/,$curopts)) {
				my $found = 0;
				for (my $i = 0; $i <= $#prev_opts; $i++) {
					if ($prev_opts[$i] eq $opt) {
						$found = 1;
						splice(@prev_opts,$i,1);
					}
				}
				$diff{$type}{'add'}{$curmod}{$opt} = 1 if (!$found);
			}
			for my $opt (@prev_opts) {
				$diff{$type}{'remove'}{$curmod}{$opt} = 1;
			}
		}
		close(CURRENT);

		# we couldn't parse the config, so the merge fails
		return 0 if ($state < 3);
	}
	return \%diff;
}

# simple function to parse a provided config file, in pseudo-RFC822
# format,
sub parse_pam_profile
{
	my ($profile) = $_[0];
	my $fieldname;
	my %profile;
	open(PROFILE, $profile) || die "could not read profile $profile: $!";
	while (<PROFILE>) {
		if (/^(\S+):\s+(.*)\s*$/) {
			$fieldname = $1;
			# compatibility with the first implementation round;
			# "Auth-Final" is now just called "Auth"
			$fieldname =~ s/-Final$//;
			if ($fieldname eq 'Conflicts') {
				foreach my $elem (split(/, /, $2)) {
					$profile{'Conflicts'}->{$elem} = 1;
				}
			} else {
				$profile{$fieldname} = $2;
			}
		} else {
			chomp;
			s/^\s+//;
			s/\s+$//;
			$profile{$fieldname} .= "\n$_" if ($_);
			$profile{$fieldname} =~ s/^[\n\s]+//;
		}
	}
	close(PROFILE);
	if (!defined($profile{'Session-Interactive-Only'})) {
			$profile{'Session-noninteractive-Type'} = $profile{'Session-Type'};
			$profile{'Session-noninteractive'} = $profile{'Session'};
			$profile{'Session-noninteractive-Initial'} = $profile{'Session-Initial'};
	}
	return %profile;
}