From 5150d54da72bf67d500174a44858776f573a2e2c Mon Sep 17 00:00:00 2001
From: Xi Ruoyao <xry111@xry111.site>
Date: Sat, 2 Mar 2024 18:03:00 +0800
Subject: [PATCH] linux-pam: Mention kernel AUDIT configuration

pam_loginuid.so will do nothing if AUDIT not enabled.
---
 kernel-config/postlfs/security/linux-pam.toml |  1 +
 postlfs/security/linux-pam-kernel.xml         |  7 ++++++
 postlfs/security/linux-pam.xml                | 23 +++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 kernel-config/postlfs/security/linux-pam.toml
 create mode 100644 postlfs/security/linux-pam-kernel.xml

diff --git a/kernel-config/postlfs/security/linux-pam.toml b/kernel-config/postlfs/security/linux-pam.toml
new file mode 100644
index 0000000000..03c5599428
--- /dev/null
+++ b/kernel-config/postlfs/security/linux-pam.toml
@@ -0,0 +1 @@
+AUDIT='*'
diff --git a/postlfs/security/linux-pam-kernel.xml b/postlfs/security/linux-pam-kernel.xml
new file mode 100644
index 0000000000..7d0568d713
--- /dev/null
+++ b/postlfs/security/linux-pam-kernel.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE note PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
+<!-- Automatically generated by kernel-config.py
+     DO NOT EDIT! -->
+<screen><emphasis role='blue'>G</emphasis>eneral setup ---&gt;
+  [*] <emphasis role='blue'>A</emphasis>uditing support                                                   [AUDIT]</screen>
diff --git a/postlfs/security/linux-pam.xml b/postlfs/security/linux-pam.xml
index 3daa7c161b..c0eae23f20 100644
--- a/postlfs/security/linux-pam.xml
+++ b/postlfs/security/linux-pam.xml
@@ -138,6 +138,29 @@
 
   </sect2>
 
+  <sect2 role="kernel" id="linux-pam-kernel">
+    <title>Kernel Configuration</title>
+
+    <para>
+      For the PAM module <filename
+      class='libraryfile'>pam_loginuid.so</filename> (referred by
+      the PAM configuration file <filename>system-session</filename> if
+      <phrase revision='sysv'><xref linkend='elogind'/> is
+      built</phrase><phrase revision='systemd'><xref linkend='systemd'/> is
+      rebuilt with PAM support</phrase> later) to work,
+      a kernel configuration parameter need to be set or the module will
+      just do nothing:
+    </para>
+
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+      href="linux-pam-kernel.xml"/>
+
+    <indexterm zone="linux-pam linux-pam-kernel">
+      <primary sortas="d-linux-pam">Linux-PAM</primary>
+    </indexterm>
+
+  </sect2>
+
   <sect2 role="installation">
     <title>Installation of Linux PAM</title>