feat: add various system and theme icons, configuration files, and support assets

squashfs-root/usr/sbin/getty

@@ -0,0 +1 @@
+agetty

squashfs-root/usr/sbin/halt

@@ -0,0 +1 @@
+../bin/systemctl

squashfs-root/usr/sbin/init

@@ -0,0 +1 @@
+../lib/systemd/systemd

squashfs-root/usr/sbin/pam-auth-update

@@ -0,0 +1,747 @@
+#!/usr/bin/perl -w
+
+# pam-auth-update: update /etc/pam.d/common-* from /usr/share/pam-configs
+#
+# Update the /etc/pam.d/common-* files based on the per-package profiles
+# provided in /usr/share/pam-configs/ taking into consideration user's
+# preferences (as determined via debconf prompting).
+#
+# Written by Steve Langasek <steve.langasek@canonical.com>
+#
+# Copyright (C) 2008 Canonical Ltd.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of version 3 of the GNU General Public License as
+# published by the Free Software Foundation.
+#
+# # This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301,
+# USA.
+
+use strict;
+use Debconf::Client::ConfModule ':all';
+use IPC::Open2 'open2';
+
+version('2.0');
+my $capb=capb('backup escape');
+
+my $inputdir = '/usr/share/pam-configs';
+my $template = 'libpam-runtime/profiles';
+my $errtemplate = 'libpam-runtime/conflicts';
+my $overridetemplate = 'libpam-runtime/override';
+my $blanktemplate = 'libpam-runtime/no_profiles_chosen';
+my $titletemplate = 'libpam-runtime/title';
+my $confdir = '/etc/pam.d';
+my $savedir = '/var/lib/pam';
+my (%profiles, @sorted, @enabled, @conflicts, @new, %removals, %to_disable, %to_enable);
+my $force = 0;
+my $package = 0;
+my $priority = 'high';
+my %md5sums = (
+	'auth' => ['8d4fe17e66ba25de16a117035d1396aa'],
+	'account' => ['3c0c362eaf3421848b679d63fd48c3fa'],
+	'password' => [
+	        '4d5c92d595a46b69cd61f18feb4c0574',
+		'50fce2113dfda83ac8bdd5a6e706caec',
+		'4bd7610f2e85f8ddaef79c7db7cb49eb',
+		'9ba753d0824276b44bcadfee1f87b6bc',
+	],
+	'session' => [
+        	'f297c731a467822cbd86e1283263e8a3',
+		'240fb92986c885b327cdb21dd641da8c',
+		'4a25673e8b36f1805219027d3be02cd2',
+		'd38511a6ce8324742c151eed9fb57ba1',
+	],
+	'session-noninteractive' => [
+		'ad2b78ce1498dd637ef36469430b6ac6',
+                '53c1ede0bf4c07879d3582d875917545',
+		'a20e8df3469bfe25c13a3b39161b30f0',
+	],
+);
+my @invalid_modules = ('pam_tally');
+
+# use a '--force' arg to specify that /etc/pam.d should be overwritten; 
+# used only on upgrades where the postinst has already determined that the
+# checksums match.  Module packages other than libpam-runtime itself must
+# NEVER use this option!  Document with big skullses and crossboneses!  It
+# needs to be exposed for libpam-runtime because that's the package that
+# decides whether we have a pristine config to be converted, and knows
+# whether the version being upgraded from is one for which the conversion
+# should be done.
+
+while ($#ARGV >= 0) {
+	my $opt = shift;
+	if ($opt eq '--force') {
+		$force = 1;
+	} elsif ($opt eq '--package') {
+		$package = 1;
+        } elsif ($opt eq '--root') {
+                my $rootdir = shift @ARGV;
+                $savedir = "${rootdir}$savedir";
+                $confdir = "${rootdir}$confdir";
+               $inputdir = "${rootdir}$inputdir";
+	} elsif ($opt eq '--remove') {
+		while ($#ARGV >= 0) {
+			last if ($ARGV[0] =~ /^--/);
+			$removals{shift @ARGV} = 1;
+		}
+		# --remove implies --package
+		$package = 1 if (keys(%removals));
+	} elsif ($opt eq '--disable') {
+		while ($#ARGV >= 0) {
+			last if ($ARGV[0] =~ /^--/);
+			$to_disable{shift @ARGV} = 1;
+		}
+		# --disable implies --package
+		$package = 1 if (keys(%to_disable));
+	} elsif ($opt eq '--enable') {
+		while ($#ARGV >= 0) {
+			last if ($ARGV[0] =~ /^--/);
+			$to_enable{shift @ARGV} = 1;
+		}
+		# --enable implies --package
+		$package = 1 if (keys(%to_enable));
+	}
+}
+
+opendir(DIR, $inputdir) || die "could not open config directory: $!";
+while (my $profile = readdir(DIR)) {
+	next if ($profile eq '.' || $profile eq '..' || $profile =~ m/~$/ || $profile =~ m/^#.+#$/);
+	%{$profiles{$profile}} = parse_pam_profile($inputdir . '/' . $profile);
+	if (defined $profiles{$profile}{'disabled'} and $profiles{$profile}{'disabled'}) {
+		delete $profiles{$profile};
+	}
+}
+closedir DIR;
+
+$priority = 'medium' if ($package);
+
+x_loadtemplatefile('/var/lib/dpkg/info/libpam-runtime.templates','libpam-runtime');
+
+# always sort by priority, so we have consistency and don't have to
+# shuffle later
+@sorted = sort { $profiles{$b}->{'Priority'} <=> $profiles{$a}->{'Priority'}
+                 || $b cmp $a }
+               keys(%profiles);
+# If we're being called for package removal, filter out those options here
+@sorted = grep { !$removals{$_} } @sorted;
+
+subst($template, 'profile_names', join(', ',@sorted));
+subst($template, 'profiles',
+	join(', ', map { $profiles{$_}->{'Name'} } @sorted));
+
+my $diff = diff_profiles($confdir,$savedir);
+
+if ($diff) {
+	@enabled = grep { !$removals{$_} } @{$diff->{'mods'}};
+} else {
+	@enabled = split(/, /,get($template));
+}
+
+# find out what we've seen, so we can ignore those defaults
+my %seen;
+if (-e $savedir . '/seen') {
+	open(SEEN,$savedir . '/seen')  or die("open(${savedir}/seen) failed: $!");
+	while (<SEEN>) {
+		chomp;
+		$seen{$_} = 1;
+	}
+	close(SEEN);
+}
+
+# filter out any options that are no longer available for any reason
+@enabled = grep { $profiles{$_} } @enabled;
+
+# add configs to enable
+push(@enabled,
+     grep { $to_enable{$_} } @sorted);
+
+# Disable anything explicitly disabled
+@enabled = grep {!$to_disable{$_} } @enabled;
+# And we've seen anything we disable
+foreach my $i (keys %to_disable) {
+        $seen{$i} = 1;
+}
+
+# an empty module set is an error, so in that case grab all the defaults
+if (!@enabled) {
+	%seen = ();
+	$priority = 'high' unless ($force);
+}
+
+
+# add any previously-unseen configs
+push(@enabled,
+     grep { $profiles{$_}->{'Default'} eq 'yes' && !$seen{$_} } @sorted);
+@enabled = sort { $profiles{$b}->{'Priority'} <=> $profiles{$a}->{'Priority'}
+                  || $b cmp $a }
+                @enabled;
+my $prev = '';
+@enabled = grep { $_ ne $prev && (($prev) = $_) } @enabled;
+
+# Do we have any new options to show?  If not, we shouldn't reprompt the
+# user, at any priority level, unless explicitly called.
+@new = grep { !$seen{$_} } @sorted;
+
+settitle($titletemplate);
+
+# if diff_profiles() fails, and we weren't passed a 'force' argument
+# (because this isn't an upgrade from an old version, or the checksum
+# didn't match, or we're being called by some other module package), prompt
+# the user whether to override.  If the user declines (the default), we
+# never again manage this config unless manually called with '--force'.
+if (!$diff && !$force) {
+	input('high',$overridetemplate);
+	go();
+	$force = 1 if (get($overridetemplate) eq 'true');
+}
+
+if (!$diff && !$force) {
+	print STDERR <<EOF;
+
+pam-auth-update: Local modifications to /etc/pam.d/common-*, not updating.
+pam-auth-update: Run pam-auth-update --force to override.
+
+EOF
+	exit;
+}
+
+umask(0022);
+
+do {
+	@conflicts = ();
+
+	if (@new || !$package) {
+		fset($template,'seen','false');
+	}
+	set($template,join(', ', @enabled));
+
+	input($priority,$template);
+	go();
+
+	@enabled = split(/, /, get($template));
+
+	# in case of conflicts, automatically unset the lower priority
+	# item of each pair
+	foreach my $elem (@enabled)
+	{
+		for (my $i=$#enabled; $i >= 0; $i--)
+		{
+			my $conflict = $enabled[$i];
+			if ($profiles{$elem}->{'Conflicts'}->{$conflict}) {
+				splice(@enabled,$i,1);
+				my $desc = $profiles{$elem}->{'Name'}
+					. ', ' . $profiles{$conflict}->{'Name'};
+				push(@conflicts,$desc);
+			}
+		}
+	}
+	if (@conflicts) {
+		subst($errtemplate, 'conflicts', join("\\n", @conflicts));
+		input('high',$errtemplate);
+	}
+	set($template, join(', ', @enabled));
+	if (!@enabled) {
+		input('high',$blanktemplate);
+		# we can only end up here by user error, but give them another
+		# shot at selecting a correct config anyway.
+		fset($template,'seen','false');
+	}
+} while (@conflicts || !@enabled);
+
+# the decision has been made about what configs to use, so even if
+# something fails after this, we shouldn't go munging the default
+# options again.  Save the list of known configs to /var/lib/pam.
+open(SEEN,"> $savedir/seen") or die("open(${savedir}/seen) failed: $!");
+for my $i (@sorted) {
+	print SEEN "$i\n";
+}
+close(SEEN) or die("close(${savedir}/seen) failed: $!");
+
+# @enabled now contains our list of profiles to use for piecing together
+# a config
+# we have:
+# - templates into which we insert the specialness
+# - magic comments denoting the beginning and end of our managed block;
+#   looking at only the functional config lines would potentially let us
+#   handle more cases, at the expense of much greater complexity, so
+#   pass on this at least for the first round
+# - a representation of the autogenerated config stored in /var/lib/pam,
+#   that we can diff against in order to account for changed options or
+#   manually dropped modules
+# - a hash describing the local modifications the user has made to the
+#   config; these are always preserved unless manually overridden with
+#   the --force option
+
+write_profiles(\%profiles, \@enabled, $confdir, $savedir, $diff, $force);
+
+
+# take a single line from a stock config, and merge it with the
+# information about local admin edits
+sub merge_one_line
+{
+	my ($line,$diff,$count) = @_;
+	my (@opts,$modline);
+
+	my ($adds,$removes);
+
+	$line =~ /^((\[[^]]+\]|\w+)\s+\S+)\s*(.*)/;
+
+	@opts = split(/\s+/,$3);
+	$modline = $1;
+	$modline =~ s/end/$count/g;
+	if ($diff) {
+		my $mod = $modline;
+		$mod =~ s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
+		$adds = \%{$diff->{'add'}{$mod}};
+		$removes = \%{$diff->{'remove'}{$mod}};
+	} else {
+		$adds = $removes = undef;
+	}
+
+	for (my $i = 0; $i <= $#opts; $i++) {
+		if ($adds->{$opts[$i]}) {
+			delete $adds->{$opts[$i]};
+		}
+		if ($removes->{$opts[$i]}) {
+			splice(@opts,$i,1);
+			$i--;
+		}
+	}
+	return $modline . " " . join(' ',@opts,sort keys(%{$adds})) . "\n";
+}
+
+# return the lines for a given config name, type, and position in the stack
+sub lines_for_module_and_type
+{
+	my ($profiles, $mod, $type, $modpos) = @_;
+	if ($modpos == 0 && $profiles->{$mod}{$type . '-Initial'}) {
+		return $profiles->{$mod}{$type . '-Initial'};
+	}
+	return $profiles->{$mod}{$type};
+}
+
+# create a single PAM config from the indicated template and selections,
+# writing to a new file
+sub create_from_template
+{
+	my($template,$dest,$profiles,$enabled,$diff,$type) = @_;
+	my $state = 0;
+	my $uctype = ucfirst($type);
+	$type =~ s/-noninteractive//;
+
+	open(INPUT,$template) || return 0;
+	open(OUTPUT,">$dest") || return 0;
+
+	while (<INPUT>) {
+		if ($state == 1) {
+			if (/^# here's the fallback if no module succeeds/) {
+				print OUTPUT;
+				$state++;
+			}
+			next;
+		}
+		if ($state == 3) {
+			if (/^# end of pam-auth-update config/) {
+				print OUTPUT;
+				$state++;
+			}
+			next;
+		}
+
+		print OUTPUT;
+
+		my ($pattern,$val);
+		if ($state == 0) {
+			$pattern = '^# here are the per-package modules \(the "Primary" block\)';
+			$val = 'Primary';
+		} elsif ($state == 2) {
+			$pattern = '^# and here are more per-package modules \(the "Additional" block\)';
+			$val = 'Additional';
+		} else {
+			next;
+		}
+
+		if (/$pattern/) {
+			my $i = 0;
+			my $count = 0;
+			# first we need to get a count of lines that we're
+			# going to output, so we can fix up the jumps correctly
+			for my $mod (@{$enabled}) {
+				my $output;
+				next if (!$profiles->{$mod}{$uctype . '-Type'});
+				next if $profiles->{$mod}{$uctype . '-Type'} ne $val;
+				$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
+				# bypasses a perl warning about @_, sigh
+				my @tmparr = split("\n+",$output);
+				$count += @tmparr;
+			}
+
+			# in case anything tries to jump in the 'additional'
+			# block, let's try not to jump off the stack...
+			$count-- if ($val eq 'Additional');
+
+			# no primary block, so output a stock pam_permit line
+			# to keep the stack intact
+			if ($val eq 'Primary' && $count == 0)
+			{
+				print OUTPUT "$type\t[default=1]\t\t\tpam_permit.so\n";
+			}
+
+			$i = 0;
+			for my $mod (@{$enabled}) {
+				my $output;
+				my @output;
+				next if (!$profiles->{$mod}{$uctype . '-Type'});
+				next if $profiles->{$mod}{$uctype . '-Type'} ne $val;
+				$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
+				for my $line (split("\n",$output)) {
+					$line = merge_one_line($line,$diff,
+					                       $count);
+					print OUTPUT "$type\t$line";
+					$count--;
+				}
+			}
+			$state++;
+		}
+	}
+	close(INPUT);
+	close(OUTPUT) or die("close($dest) failed: $!");
+
+	if ($state < 4) {
+		unlink($dest);
+		return 0;
+	}
+	return 1;
+}
+
+# take a template file, strip out everything between the markers, and
+# return the md5sum of the remaining contents.  Used for testing for
+# local modifications of the boilerplate.
+sub get_template_md5sum
+{
+	my($template) = @_;
+	my $state = 0;
+
+	open(INPUT,$template) || return '';
+	my($md5sum_fd,$output_fd);
+	my $pid = open2($md5sum_fd, $output_fd, 'md5sum');
+	return '' if (!$pid);
+
+	while (<INPUT>) {
+		if ($state == 1) {
+			if (/^# here's the fallback if no module succeeds/) {
+				print $output_fd $_;
+				$state++;
+			}
+			next;
+		}
+		if ($state == 3) {
+			if (/^# end of pam-auth-update config/) {
+				print $output_fd $_;
+				$state++;
+			}
+			next;
+		}
+
+		print $output_fd $_;
+
+		my ($pattern,$val);
+		if ($state == 0) {
+			$pattern = '^# here are the per-package modules \(the "Primary" block\)';
+		} elsif ($state == 2) {
+			$pattern = '^# and here are more per-package modules \(the "Additional" block\)';
+		} else {
+			next;
+		}
+
+		if (/$pattern/) {
+			$state++;
+		}
+	}
+	close(INPUT);
+	close($output_fd);
+	my $md5sum = <$md5sum_fd>;
+	close($md5sum_fd);
+	waitpid $pid, 0;
+
+	$md5sum = (split(/\s+/,$md5sum))[0];
+	return $md5sum;
+}
+
+# merge a set of module declarations into a set of new config files,
+# using the information returned from diff_profiles().
+sub write_profiles
+{
+	my($profiles,$enabled,$confdir,$savedir,$diff,$force) = @_;
+
+	if (! -d $savedir) {
+		mkdir($savedir);
+	}
+		
+	# because we can't atomically replace both /var/lib/pam/$foo and
+	# /etc/pam.d/common-$foo at the same time, take steps to make this
+	# somewhat robust
+	for my $type ('auth','account','password','session',
+	              'session-noninteractive')
+	{
+		my $target = $confdir . '/common-' . $type;
+		my $template = $target;
+		my $dest = $template . '.pam-new';
+
+		my $diff = $diff;
+		if ($diff) {
+			$diff = \%{$diff->{$type}};
+		}
+
+		# Detect if the template is unmodified, and if so, use
+		# the version from /usr/share.  Depends on knowing the
+		# md5sums of the originals.
+		my $md5sum = get_template_md5sum($template);
+		for my $i (@{$md5sums{$type}}) {
+			if ($md5sum eq $i) {
+				$template = '/usr/share/pam/common-' . $type;
+				last;
+			}
+		}
+
+		# first, write out the new config
+		if (!create_from_template($template,$dest,$profiles,$enabled,
+		                          $diff,$type))
+		{
+			if (!$force) {
+				return 0;
+			}
+			$template = '/usr/share/pam/common-' . $type;
+			if (!create_from_template($template,$dest,$profiles,
+			                          $enabled,$diff,$type))
+			{
+				return 0;
+			}
+		}
+
+		# then write out the saved config
+		if (!open(OUTPUT, "> $savedir/$type.new")) {
+			unlink($dest);
+			return 0;
+		}
+		my $i = 0;
+		my $uctype = ucfirst($type);
+		for my $mod (@{$enabled}) {
+			my $output;
+			next if (!$profiles->{$mod}{$uctype . '-Type'});
+			next if ($profiles->{$mod}{$uctype . '-Type'} eq 'Additional');
+
+			$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
+			if ($output) {
+				print OUTPUT "Module: $mod\n";
+				print OUTPUT $output . "\n";
+			}
+		}
+
+		# no primary block, so output a stock pam_permit line
+		if ($i == 0)
+		{
+			print OUTPUT "Module: null\n";
+			print OUTPUT "[default=1]\t\t\tpam_permit.so\n";
+		}
+
+		$i = 0;
+		for my $mod (@{$enabled}) {
+			my $output;
+			next if (!$profiles->{$mod}{$uctype . '-Type'});
+			next if ($profiles->{$mod}{$uctype . '-Type'} eq 'Primary');
+
+			$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
+			if ($output) {
+				print OUTPUT "Module: $mod\n";
+				print OUTPUT $output . "\n";
+			}
+		}
+
+		close(OUTPUT) or die("close($dest) failed: $!");
+
+		# then do the renames, back-to-back
+		# we have to use system because File::Copy is in
+		# perl-modules, not perl-base
+		if (-e $target && $force) {
+			system('cp','-f',$target,$target . '.pam-old') == 0
+                            or die("cp -f ${target} ${target}.pam.old failed");
+		}
+		rename($dest,$target)
+                    or die("rename($dest, $target) failed: $!");
+		rename("$savedir/${type}.new","$savedir/$type")
+                    or die("rename(${savedir}/${type}.new, ${savedir}/${type}) failed: $!");
+	}
+
+	# at the end of a successful write, reset the 'seen' flag and the
+	# value of the debconf override question.
+	fset($overridetemplate,'seen','false');
+	set($overridetemplate,'false');
+}
+
+# reconcile the current config in /etc/pam.d with the saved ones in
+# /var/lib/pam; returns a hash of profile names and the corresponding
+# options that should be added/removed relative to the stock config.
+# returns false if any of the markers are missing that permit a merge,
+# or on any other failure.
+sub diff_profiles
+{
+	my ($sourcedir,$savedir) = @_;
+	my (%diff);
+
+	@{$diff{'mods'}} = ();
+	# Load the saved config from /var/lib/pam, then iterate through all
+	# lines in the current config that are in the managed block.
+	# If anything fails here, just return immediately since we then
+	# have nothing to merge; instead, the caller will decide later
+	# whether to force an overwrite.
+	for my $type ('auth','account','password','session',
+	              'session-noninteractive')
+	{
+		my (@saved,$modname);
+
+		open(SAVED,$savedir . '/' . $type) || return 0;
+		while (<SAVED>) {
+			if (/^Module: (.*)/) {
+				$modname = $1;
+				next;
+			}
+			chomp;
+			# trim out the destination of any jumps; this saves
+			# us from having to re-parse everything just to fix
+			# up the jump lengths, when changes to these will
+			# already show up as inconsistencies elsewhere
+			s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
+			s/(\[.*)end(.*\])/$1$2/g;
+			my (@temp) = ($modname,$_);
+			push(@saved,\@temp);
+		}
+		close(SAVED);
+
+		my $state = 0;
+		my (@prev_opts,$curmod);
+		my $realtype = $type;
+		$realtype =~ s/-noninteractive//;
+
+		open(CURRENT,$sourcedir . '/common-' . $type) || return 0;
+		while (<CURRENT>) {
+			if ($state == 0) {
+				$state = 1
+				   if (/^# here are the per-package modules \(the "Primary" block\)/);
+				next;
+			}
+			if ($state == 1) {
+				s/^$realtype\s+//;
+				if (/^# here's the fallback if no module succeeds/) {
+					$state = 2;
+					next;
+				}
+			}
+			if ($state == 2) {
+				$state = 3
+				   if (/^# and here are more per-package modules \(the "Additional" block\)/);
+				next;
+			}
+			if ($state == 3) {
+				last if (/^# end of pam-auth-update config/);
+				s/^$realtype\s+//;
+			}
+
+			my $found = 0;
+			my $curopts;
+			while (!$found && $#saved >= 0) {
+				my $line;
+				($modname,$line) = @{$saved[0]};
+				shift(@saved);
+				$line =~ /^((\[[^]]+\]|\w+)\s+\S+)\s*(.*)/;
+				@prev_opts = split(/\s+/,$3);
+				$curmod = $1;
+				# FIXME: the key isn't derived from the config
+				# name, so collisions are possible if more
+				# than one config references the same module
+
+				$_ =~ s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
+				# check if this is a match for the current line
+				if ($_ =~ /^\Q$curmod\E\s*(.*)$/) {
+					$found = 1;
+					$curopts = $1;
+					push(@{$diff{'mods'}},$modname);
+				}
+			}
+
+			# there's a line in the live config that doesn't
+			# correspond to anything from the saved config.
+			# treat this as a failure; it's very error-prone
+			# to decide what to do with an added line that
+			# didn't come from a package.
+			return 0 if (!$found);
+
+			for my $opt (split(/\s+/,$curopts)) {
+				my $found = 0;
+				for (my $i = 0; $i <= $#prev_opts; $i++) {
+					if ($prev_opts[$i] eq $opt) {
+						$found = 1;
+						splice(@prev_opts,$i,1);
+					}
+				}
+				$diff{$type}{'add'}{$curmod}{$opt} = 1 if (!$found);
+			}
+			for my $opt (@prev_opts) {
+				$diff{$type}{'remove'}{$curmod}{$opt} = 1;
+			}
+		}
+		close(CURRENT);
+
+		# we couldn't parse the config, so the merge fails
+		return 0 if ($state < 3);
+	}
+	return \%diff;
+}
+
+# simple function to parse a provided config file, in pseudo-RFC822
+# format,
+sub parse_pam_profile
+{
+	my ($profile) = $_[0];
+	my $fieldname;
+	my %profile;
+	open(PROFILE, $profile) || die "could not read profile $profile: $!";
+	while (<PROFILE>) {
+		if (/^(\S+):\s+(.*)\s*$/) {
+			$fieldname = $1;
+			# compatibility with the first implementation round;
+			# "Auth-Final" is now just called "Auth"
+			$fieldname =~ s/-Final$//;
+			if ($fieldname eq 'Conflicts') {
+				foreach my $elem (split(/, /, $2)) {
+					$profile{'Conflicts'}->{$elem} = 1;
+				}
+			} else {
+				$profile{$fieldname} = $2;
+			}
+		} else {
+			chomp;
+			s/^\s+//;
+			s/\s+$//;
+			$profile{$fieldname} .= "\n$_" if ($_);
+                        if (grep { $profile{$fieldname} =~ /$_/} @invalid_modules) {
+                          $profile{'disabled'} = 1;
+                        }
+			$profile{$fieldname} =~ s/^[\n\s]+//;
+		}
+	}
+	close(PROFILE);
+	if (!defined($profile{'Session-Interactive-Only'}) or $profile{'Session-Interactive-Only'} ne 'yes') {
+			$profile{'Session-noninteractive-Type'} = $profile{'Session-Type'};
+			$profile{'Session-noninteractive'} = $profile{'Session'};
+			$profile{'Session-noninteractive-Initial'} = $profile{'Session-Initial'};
+	}
+	return %profile;
+}

squashfs-root/usr/sbin/pam_getenv

@@ -0,0 +1,123 @@
+#!/usr/bin/perl -w
+
+=head1 NAME
+
+pam_getenv - get environment variables from /etc/environment
+
+=head1 SYNOPSIS
+
+pam_getenv B<[-l] [-s]> I<env_var>
+
+=head1 DESCRIPTION
+
+This tool  will print out the value of I<env_var> from F</etc/environment>.  It will attempt to expand environment variable references in the definition of I<env_var> but will fail if PAM items are expanded.
+
+The B<-l> option indicates the script should return an environment variable related to default locale information.
+
+The B<-s> option indicates that the script should return an
+system default environment variable.
+
+Currently neither the B<-l> or B<-s> options do anything.  They are
+included because future versions of Debian may have a separate
+repository for the initial environment used by init scripts and for
+system locale information.  These options will allow this script to be
+a stable interface even in that environment.
+
+=cut
+
+# Copyright 2004 by Sam Hartman
+# This script may be copied under the terms of the GNU GPL
+# version 2, or at your option any later version.
+
+use strict;
+use vars qw(*CONFIGFILE *ENVFILE);
+
+sub read_line($) {
+  my $fh = shift;
+  my $line;
+  local $_;
+  line: while (<$fh>) {
+    chomp;
+    s/^\s+//;
+s/\#.*$//;
+    next if $_ eq "";
+    if (s/\\\s*$//) {
+      $line .= $_;
+      next line;
+    }
+
+    $line .= $_;
+    last;
+  }
+  $line;
+  
+}
+
+
+sub parse_line($) {
+  my $var;
+  my (%x, @x);
+  local $_ = shift;
+  return undef unless defined $_ and s/(\S+)\s//;
+  $var->{Name} = $1;
+  s/^\s*//;
+  @x = split(/=([^"\s]\S*|"[^"]*")\s*/, $_);
+  unless (scalar(@x)%2 == 0) {
+    push @x, undef;
+  }
+  %x = @x;
+  @{$var}{"Default", "Override"} =
+    @x{"DEFAULT", "OVERRIDE"};
+  $var;
+}
+
+sub expand_val($) {
+  my ($val) = @_;
+return undef unless $val;
+	die "Cannot handle PAM items\n" if /(?<!\\)\@/;
+  $val =~ s/(?<!\\)\$\{([^}]+)\}/$ENV{$1}||""/eg;
+  return $val;
+}
+
+my $lookup;
+
+while ($_ = shift) {
+  next if $_ eq "-s";
+  next if $_ eq "-l";
+  $lookup = $_;
+  last;
+}
+unless (defined $lookup) {
+  die "Usage: pam_getenv [-l] [-s] env_var\n";
+}
+
+my %allvars;
+
+open (CONFIGFILE, "/etc/security/pam_env.conf")
+  or die "Cannot open environment file: $!\n";
+
+while (my $var = parse_line(read_line(\*CONFIGFILE))) {
+  my $val;
+  unless ($val = expand_val($var->{Override})) {
+    $val = expand_val($var->{Default});
+  }
+  $allvars{$var->{Name}} = $val;
+}
+
+if (open (ENVFILE, "/etc/environment")) {
+  while (my $line = read_line(\*ENVFILE)) {
+    $line =~ s/^export //;
+    $line =~ /(.*?)=(.+)/ or next;
+    my ($var, $val) = ($1, $2);
+    # This is bizarre logic (" and ' match each other, quotes are only
+    # significant at the start and end of the string, and the trailing quote
+    # may be omitted), but it's what pam_env does.
+    $val =~ s/^["'](.*?)["']?$/$1/;
+    $allvars{$var} = $val;
+  }
+}
+
+if (exists $allvars{$lookup}) {
+  print $allvars{$lookup}, "\n";
+  exit(0);
+}

squashfs-root/usr/sbin/pam_namespace_helper

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+CONF=/etc/security/namespace.conf
+
+# Match logic of process_line(), except lines with $HOME are ignored
+# skip the leading white space, rip off the comments, ignore empty lines
+sed -e 's/^[ 	]*//g' -e 's/#.*//g' -e '/.*\$HOME.*/d'  -e '/^$/d' < $CONF | \
+    while read polydir instance_prefix method uids; do
+	if [ ! -e "$instance_prefix" ]; then
+	    echo "mkdir $instance_prefix"
+	    mkdir --parents --mode=0 -Z "$instance_prefix"
+	fi
+    done
+
+exit 0

squashfs-root/usr/sbin/poweroff

@@ -0,0 +1 @@
+../bin/systemctl

squashfs-root/usr/sbin/reboot

@@ -0,0 +1 @@
+../bin/systemctl

squashfs-root/usr/sbin/runlevel

@@ -0,0 +1 @@
+../bin/systemctl

squashfs-root/usr/sbin/shutdown

@@ -0,0 +1 @@
+../bin/systemctl

squashfs-root/usr/sbin/telinit

@@ -0,0 +1 @@
+../bin/systemctl

squashfs-root/usr/sbin/update-ca-certificates

@@ -0,0 +1,216 @@
+#!/bin/sh -e
+#
+# update-ca-certificates
+#
+# Copyright (c) 2003 Fumitoshi UKAI <ukai@debian.or.jp>
+# Copyright (c) 2009 Philipp Kern <pkern@debian.org>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02111-1301,
+# USA.
+#
+
+verbose=0
+fresh=0
+default=0
+CERTSCONF=/etc/ca-certificates.conf
+CERTSDIR=/usr/share/ca-certificates
+LOCALCERTSDIR=/usr/local/share/ca-certificates
+CERTBUNDLE=ca-certificates.crt
+ETCCERTSDIR=/etc/ssl/certs
+HOOKSDIR=/etc/ca-certificates/update.d
+
+while [ $# -gt 0 ];
+do
+  case $1 in
+    --verbose|-v)
+      verbose=1;;
+    --fresh|-f)
+      fresh=1;;
+    --default|-d)
+      default=1
+      fresh=1;;
+    --certsconf)
+      shift
+      CERTSCONF="$1";;
+    --certsdir)
+      shift
+      CERTSDIR="$1";;
+    --localcertsdir)
+      shift
+      LOCALCERTSDIR="$1";;
+    --certbundle)
+      shift
+      CERTBUNDLE="$1";;
+    --etccertsdir)
+      shift
+      ETCCERTSDIR="$1";;
+    --hooksdir)
+      shift
+      HOOKSDIR="$1";;
+    --help|-h|*)
+      echo "$0: [--verbose] [--fresh]"
+      exit;;
+  esac
+  shift
+done
+
+if [ ! -s "$CERTSCONF" ]
+then
+  fresh=1
+fi
+
+cleanup() {
+  rm -f "$TEMPBUNDLE"
+  rm -f "$ADDED"
+  rm -f "$REMOVED"
+}
+trap cleanup 0
+
+# Helper files.  (Some of them are not simple arrays because we spawn
+# subshells later on.)
+TEMPBUNDLE="${ETCCERTSDIR}/${CERTBUNDLE}.new"
+ADDED="$(mktemp -p "${TMPDIR:-/tmp}" "ca-certificates.tmp.XXXXXX")"
+REMOVED="$(mktemp -p "${TMPDIR:-/tmp}" "ca-certificates.tmp.XXXXXX")"
+
+# Adds a certificate to the list of trusted ones.  This includes a symlink
+# in /etc/ssl/certs to the certificate file and its inclusion into the
+# bundle.
+add() {
+  CERT="$1"
+  PEM="$ETCCERTSDIR/$(basename "$CERT" .crt | sed -e 's/ /_/g' \
+                                                  -e 's/[()]/=/g' \
+                                                  -e 's/,/_/g').pem"
+  if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "$CERT" ]
+  then
+    ln -sf "$CERT" "$PEM"
+    echo "+$PEM" >> "$ADDED"
+  fi
+  # Add trailing newline to certificate, if it is missing (#635570)
+  sed -e '$a\' "$CERT" >> "$TEMPBUNDLE"
+}
+
+remove() {
+  CERT="$1"
+  PEM="$ETCCERTSDIR/$(basename "$CERT" .crt).pem"
+  if test -L "$PEM"
+  then
+    rm -f "$PEM"
+    echo "-$PEM" >> "$REMOVED"
+  fi
+}
+
+cd "$ETCCERTSDIR"
+if [ "$fresh" = 1 ]; then
+  echo "Clearing symlinks in $ETCCERTSDIR..."
+  find . -type l -print | while read -r symlink
+  do
+    case $(readlink "$symlink") in
+      $CERTSDIR*|$LOCALCERTSDIR*) rm -f "$symlink";;
+    esac
+  done
+  find . -type l -print | while read -r symlink
+  do
+    test -f "$symlink" || rm -f "$symlink"
+  done
+  echo "done."
+fi
+
+echo "Updating certificates in $ETCCERTSDIR..."
+
+# Add default certificate authorities if requested
+if [ "$default" = 1 ]; then
+  find -L "$CERTSDIR" -type f -name '*.crt' | sort | while read -r crt
+  do
+    add "$crt"
+  done
+fi
+
+# Handle certificates that should be removed.  This is an explicit act
+# by prefixing lines in the configuration files with exclamation marks (!).
+sed -n -e '/^$/d' -e 's/^!//p' "$CERTSCONF" | while read -r crt
+do
+  remove "$CERTSDIR/$crt"
+done
+
+sed -e '/^$/d' -e '/^#/d' -e '/^!/d' "$CERTSCONF" | while read -r crt
+do
+  if ! test -f "$CERTSDIR/$crt"
+  then
+    echo "W: $CERTSDIR/$crt not found, but listed in $CERTSCONF." >&2
+    continue
+  fi
+  add "$CERTSDIR/$crt"
+done
+
+# Now process certificate authorities installed by the local system
+# administrator.
+if [ -d "$LOCALCERTSDIR" ]
+then
+  find -L "$LOCALCERTSDIR" -type f -name '*.crt' | sort | while read -r crt
+  do
+    add "$crt"
+  done
+fi
+
+ADDED_CNT=$(wc -l < "$ADDED")
+REMOVED_CNT=$(wc -l < "$REMOVED")
+
+if [ "$ADDED_CNT" -gt 0 ] || [ "$REMOVED_CNT" -gt 0 ]
+then
+  # only run if set of files has changed
+  # Remove orphan symlinks found in ETCCERTSDIR to prevent `openssl rehash`
+  # from exiting with an error. See #895482, #895473.
+  find "$ETCCERTSDIR" -type l ! -exec test -e {} \; -print | while read -r orphan
+  do
+    rm -f "$orphan"
+    if [ "$verbose" = 1 ]; then
+      echo "Removed orphan symlink $orphan"
+    fi
+  done
+  if [ "$verbose" = 0 ]
+  then
+    openssl rehash . > /dev/null
+  else
+    openssl rehash -v .
+  fi
+fi
+
+# chmod and mv only if TEMPBUNDLE exists or install may fail, #996005
+if [ -f "$TEMPBUNDLE" ]
+then
+  chmod 0644 "$TEMPBUNDLE"
+  mv -f "$TEMPBUNDLE" "$CERTBUNDLE"
+  # Restore proper SELinux label after moving the file
+  [ -x /sbin/restorecon ] && /sbin/restorecon "$CERTBUNDLE" >/dev/null 2>&1
+fi
+
+echo "$ADDED_CNT added, $REMOVED_CNT removed; done."
+
+if [ -d "$HOOKSDIR" ]
+then
+
+  echo "Running hooks in $HOOKSDIR..."
+  VERBOSE_ARG=
+  [ "$verbose" = 0 ] || VERBOSE_ARG="--verbose"
+  eval run-parts "$VERBOSE_ARG" --test -- "$HOOKSDIR" | while read -r hook
+  do
+    ( cat "$ADDED"
+      cat "$REMOVED" ) | "$hook" || echo "E: $hook exited with code $?."
+  done
+  echo "done."
+
+fi
+
+# vim:set et sw=2:

squashfs-root/usr/sbin/update-icon-caches

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+case "$1" in
+    ""|-h|--help)
+        echo "Usage: $0 directory [ ... ]"
+        exit 1
+        ;;
+esac
+
+for dir in "$@"; do
+    if [ ! -d "$dir" ]; then
+        continue
+    fi
+    if [ -f "$dir"/index.theme ]; then
+        # Generate or regenerate the cache    
+        if ! gtk-update-icon-cache --force --quiet "$dir"; then
+            echo "WARNING: icon cache generation failed for $dir"
+        fi
+    else
+        # No more index.theme, remove the cache if it exists
+        rm -f "$dir"/icon-theme.cache
+        rmdir -p --ignore-fail-on-non-empty "$dir"
+    fi
+done
+
+exit 0