This question is meant for general application, but I can use some specific examples to illustrate the nature of my question. When certain Linux authentication packages like krb5, sssd, or pam_pkcs11 are installed something goes into the files under the PAM configuration directory (like /etc/pam.d/system-auth and /etc/pam.d/password-auth) and will add or modify a line to point to the new .so files that were installed, like pam_krb5.so, pam_sssd.so, or pam_pkcs11.so for use.
This seems to happen automatically for certain packages without user intervention just by installing the rpm packages (with yum or directly with the rpm tool), like I've observed is the case with installing the sssd package (on RHEL 7 at least) which will add references to pam_sssd.so into the *-auth PAM files. I figured that the only way this could be possible was via the internal scripts that rpms can have, so I looked up how to list the internal scripts in the SPEC of the rpm, mounted a RHEL 7 image to peer into the source packages, and ran this inside the Packages directory:
sudo rpm --scripts -qpl sssd-* | grep -i pam
Yet I get no lines returned that would indicate that anything is touching files in the /etc/pam.d directory, even though if I remove the grep I do see results for if/then script logic doing other things, so the --scripts parameter is working.
I am also curious, in a very a particular example case, what adds this line to my
/etc/pam.d/system-auth
file:
auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_pkcs11.so nodebug
If it is not an internal script to the RPMs, I was wondering if it might have been a certain binary among the newly installed files that was run initially, and that is what is responsible for adding those changes, but have not seen any evidence of that.
Furthermore, I had actually grep'd for authconfig lines in the RPM scripts as well, since I know that authconfig can do that, but didn't find anything. Yet it seems like it must be running authconfig or something equivalent in the background to do that.
Does anyone have any insights into what makes those changes?
yum install sssd
and it didn't touch /etc/pam.d/system-auth-ac at all.