From 1ed75d980adb9547b81e0e2d651eb2b2f1736ef8 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Mon, 15 Jun 2026 02:23:19 -0600
Subject: [PATCH] linux-pam: 1.7.1 -> 1.7.2

https://github.com/linux-pam/linux-pam/releases/tag/v1.7.2
Diff: https://github.com/linux-pam/linux-pam/compare/v1.7.1...v1.7.2
---
 pkgs/by-name/li/linux-pam/package.nix | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/linux-pam/package.nix b/pkgs/by-name/li/linux-pam/package.nix
index 5e1fdfd4a7ce..0da213b857c0 100644
--- a/pkgs/by-name/li/linux-pam/package.nix
+++ b/pkgs/by-name/li/linux-pam/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPackages,
   fetchFromGitHub,
+  fetchpatch,
   flex,
   db4,
   gettext,
@@ -33,18 +34,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "linux-pam";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "linux-pam";
     repo = "linux-pam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kANcwxifQz2tYPSrSBSFiYNTm51Gr10L/zroCqm8ZHQ=";
-
+    hash = "sha256-V3XQqolinh+MqUefMDYJF9zP4fBJTHc7YKN+NEGjx1g=";
   };
 
   __structuredAttrs = true;
 
+  patches = [
+    (fetchpatch {
+      name = "secure-opendir-fix-error-handling.patch";
+      url = "https://github.com/linux-pam/linux-pam/commit/dd62bac17221911106de165607c6925ea54b18d1.patch?full_index=1";
+      hash = "sha256-ddgDYdVfdXfTaMFV1hO3RJX9w1NHmE7yi3PxsHOdpvY=";
+    })
+  ];
+
   # patching unix_chkpwd is required as the nix store entry does not have the necessary bits
   postPatch = ''
     substituteInPlace modules/module-meson.build \
@@ -104,6 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "nis" false)
     (lib.mesonBool "xtests" false)
     (lib.mesonBool "examples" false)
+    (lib.mesonOption "vendordir" "${placeholder "out"}/etc")
   ]
   # warning: slower execution due to debug makes VM tests fail!
   ++ lib.optional debugMode (lib.mesonBool "pam-debug" true);