In bug 802807, we found that <= pam-1.5.1 was lacking a commit needed to properly interpret return codes from libxcrypt.
Unfortunately, there are complications with an incompatibility between this new pam version and systemd: bug 803050. AFAIK we've worked around this in glibc for now (via meddling with nsswitch).
If stabilising this version is going to be too messy, we can cherry-pick the primary aforementioned libxcrypt fix. The others are to do with minor build system improvemetns and we could nab those too if we want.
So, we either need to:
- stabilise pam-1.5.1_p20210622-r1
- cherry pick libxcrypt patches and backport to 1.5.1