pam: create writable cgroups for unpriv users

configure.ac

@@ -646,6 +646,35 @@ else
 fi
 AM_CONDITIONAL([IS_BIONIC], [test "x$is_bionic" = "xyes"])
 
+AC_ARG_WITH(
+	[pamdir],
+	[AS_HELP_STRING([--with-pamdir=PATH],[Specify the directory where PAM modules are stored,
+						or "none" if PAM modules are not to be built])],
+	[pamdir="${withval}"],
+	[
+		if test "${prefix}" = "/usr"; then
+			pamdir="/lib${libdir##*/lib}/security"
+		else
+			pamdir="\$(libdir)/security"
+		fi
+	]
+)
+
+AM_CONDITIONAL([HAVE_PAM], [test x"$pamdir" != "xnone"])
+if test "z$pamdir" != "znone"; then
+	AC_ARG_VAR([PAM_CFLAGS], [C compiler flags for pam])
+	AC_ARG_VAR([PAM_LIBS], [linker flags for pam])
+	AC_CHECK_LIB(
+		[pam],
+		[pam_authenticate],
+		[PAM_LIBS="-lpam"],
+		[AC_MSG_ERROR([*** libpam not found.])
+		])
+
+	AC_SUBST(PAM_LIBS)
+	AC_SUBST([pamdir])
+fi
+
 # Some systems lack PR_CAPBSET_DROP definition => HAVE_DECL_PR_CAPBSET_DROP
 AC_CHECK_DECLS([PR_CAPBSET_DROP], [], [], [#include <sys/prctl.h>])
 
@@ -967,6 +996,9 @@ Security features:
  - SELinux: $enable_selinux
  - cgmanager: $enable_cgmanager
 
+PAM:
+ - cgroup PAM module: $pamdir
+
 Bindings:
  - lua: $enable_lua
  - python3: $enable_python

src/lxc/Makefile.am

@@ -317,6 +317,14 @@ init_lxc_static_LDADD = @CAP_LIBS@
 init_lxc_static_CFLAGS = $(AM_CFLAGS) -DNO_LXC_CONF
 endif
 
+if HAVE_PAM
+pam_LTLIBRARIES = pam_cgfs.la
+pam_cgfs_la_SOURCES = pam/pam_cgfs.c macro.h
+pam_cgfs_la_CFLAGS = $(AM_CFLAGS)
+pam_cgfs_la_LIBADD = $(AM_LIBS) $(PAM_LIBS) -L$(top_srcdir)
+pam_cgfs_la_LDFLAGS = $(AM_LDFLAGS) -module -avoid-version -shared
+endif
+
 install-exec-local: install-libLTLIBRARIES
 	mkdir -p $(DESTDIR)$(datadir)/lxc
 	install -c -m 644 lxc.functions $(DESTDIR)$(datadir)/lxc
@@ -331,3 +339,10 @@ install-exec-hook:
 
 uninstall-local:
 	$(RM) $(DESTDIR)$(libdir)/liblxc.so*
+if HAVE_PAM
+	$(RM) $(DESTDIR)$(pamdir)/pam_cgfs.so*
+
+install-data-hook: install-pamLTLIBRARIES
+	$(RM) "$(DESTDIR)$(pamdir)/pam_cgfs.la"
+	$(RM) "$(DESTDIR)$(pamdir)/pam_cgfs.a"
+endif