New upstream version 1.1.8

12 files changed, 606 insertions, 784 deletions

diff --git a/modules/pam_namespace/Makefile.am b/modules/pam_namespace/Makefile.am
index 44513de0..ebb00f36 100644
--- a/modules/pam_namespace/Makefile.am
+++ b/modules/pam_namespace/Makefile.am
@@ -34,11 +34,13 @@ noinst_HEADERS = md5.h pam_namespace.h argv_parse.h
 if HAVE_UNSHARE
   securelib_LTLIBRARIES = pam_namespace.la
   pam_namespace_la_SOURCES = pam_namespace.c md5.c argv_parse.c
-  pam_namespace_la_LIBADD = -L$(top_builddir)/libpam -lpam @LIBSELINUX@
+  pam_namespace_la_LIBADD = $(top_builddir)/libpam/libpam.la @LIBSELINUX@
 
   secureconf_DATA = namespace.conf
   secureconf_SCRIPTS = namespace.init
-  namespaced_DATA =
+
+install-data-local:
+	mkdir -p $(DESTDIR)$(namespaceddir)
 endif
 
 
diff --git a/modules/pam_namespace/Makefile.in b/modules/pam_namespace/Makefile.in
index 3c5ac49b..8936af68 100644
--- a/modules/pam_namespace/Makefile.in
+++ b/modules/pam_namespace/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.1 from Makefile.am.
+# Makefile.in generated by automake 1.11.1 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008  Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009  Free Software Foundation,
+# Inc.
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
@@ -24,8 +25,9 @@
 
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
 am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
 install_sh_DATA = $(install_sh) -c -m 644
 install_sh_PROGRAM = $(install_sh) -c
@@ -46,7 +48,7 @@ DIST_COMMON = README $(noinst_HEADERS) $(srcdir)/Makefile.am \
 	$(srcdir)/Makefile.in
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
-	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/iconv.m4 \
 	$(top_srcdir)/m4/japhar_grep_cflags.m4 \
 	$(top_srcdir)/m4/jh_path_xml_catalog.m4 \
 	$(top_srcdir)/m4/ld-O1.m4 $(top_srcdir)/m4/ld-as-needed.m4 \
@@ -59,32 +61,47 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
 	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/configure.in
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs
+mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
 am__vpath_adj = case $$p in \
     $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
     *) f=$$p;; \
   esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
 am__installdirs = "$(DESTDIR)$(securelibdir)" \
 	"$(DESTDIR)$(secureconfdir)" "$(DESTDIR)$(man5dir)" \
-	"$(DESTDIR)$(man8dir)" "$(DESTDIR)$(namespaceddir)" \
-	"$(DESTDIR)$(secureconfdir)"
-securelibLTLIBRARIES_INSTALL = $(INSTALL)
+	"$(DESTDIR)$(man8dir)" "$(DESTDIR)$(secureconfdir)"
 LTLIBRARIES = $(securelib_LTLIBRARIES)
-pam_namespace_la_DEPENDENCIES =
+@HAVE_UNSHARE_TRUE@pam_namespace_la_DEPENDENCIES =  \
+@HAVE_UNSHARE_TRUE@	$(top_builddir)/libpam/libpam.la
 am__pam_namespace_la_SOURCES_DIST = pam_namespace.c md5.c argv_parse.c
 @HAVE_UNSHARE_TRUE@am_pam_namespace_la_OBJECTS = pam_namespace.lo \
 @HAVE_UNSHARE_TRUE@	md5.lo argv_parse.lo
 pam_namespace_la_OBJECTS = $(am_pam_namespace_la_OBJECTS)
 @HAVE_UNSHARE_TRUE@am_pam_namespace_la_rpath = -rpath $(securelibdir)
-secureconfSCRIPT_INSTALL = $(INSTALL_SCRIPT)
 SCRIPTS = $(secureconf_SCRIPTS)
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
-depcomp = $(SHELL) $(top_srcdir)/depcomp
+depcomp = $(SHELL) $(top_srcdir)/build-aux/depcomp
 am__depfiles_maybe = depfiles
+am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
 LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -100,12 +117,12 @@ man5dir = $(mandir)/man5
 man8dir = $(mandir)/man8
 NROFF = nroff
 MANS = $(man_MANS)
-namespacedDATA_INSTALL = $(INSTALL_DATA)
-secureconfDATA_INSTALL = $(INSTALL_DATA)
-DATA = $(namespaced_DATA) $(noinst_DATA) $(secureconf_DATA)
+DATA = $(noinst_DATA) $(secureconf_DATA)
 HEADERS = $(noinst_HEADERS)
 ETAGS = etags
 CTAGS = ctags
+am__tty_colors = \
+red=; grn=; lgn=; blu=; std=
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -135,7 +152,6 @@ EGREP = @EGREP@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
 FO2PDF = @FO2PDF@
-GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
 GMSGFMT = @GMSGFMT@
 GMSGFMT_015 = @GMSGFMT_015@
 GREP = @GREP@
@@ -159,7 +175,6 @@ LIBDB = @LIBDB@
 LIBDL = @LIBDL@
 LIBICONV = @LIBICONV@
 LIBINTL = @LIBINTL@
-LIBNSL = @LIBNSL@
 LIBOBJS = @LIBOBJS@
 LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@
 LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@
@@ -181,6 +196,8 @@ MKDIR_P = @MKDIR_P@
 MSGFMT = @MSGFMT@
 MSGFMT_015 = @MSGFMT_015@
 MSGMERGE = @MSGMERGE@
+NIS_CFLAGS = @NIS_CFLAGS@
+NIS_LIBS = @NIS_LIBS@
 NM = @NM@
 NMEDIT = @NMEDIT@
 OBJDUMP = @OBJDUMP@
@@ -192,10 +209,12 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
 PACKAGE_NAME = @PACKAGE_NAME@
 PACKAGE_STRING = @PACKAGE_STRING@
 PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 PIE_CFLAGS = @PIE_CFLAGS@
 PIE_LDFLAGS = @PIE_LDFLAGS@
+PKG_CONFIG = @PKG_CONFIG@
 POSUB = @POSUB@
 RANLIB = @RANLIB@
 SCONFIGDIR = @SCONFIGDIR@
@@ -208,7 +227,6 @@ USE_NLS = @USE_NLS@
 VERSION = @VERSION@
 XGETTEXT = @XGETTEXT@
 XGETTEXT_015 = @XGETTEXT_015@
-XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
 XMLCATALOG = @XMLCATALOG@
 XMLLINT = @XMLLINT@
 XML_CATALOG_FILE = @XML_CATALOG_FILE@
@@ -250,6 +268,8 @@ install_sh = @install_sh@
 libc_cv_fpie = @libc_cv_fpie@
 libdir = @libdir@
 libexecdir = @libexecdir@
+libtirpc_CFLAGS = @libtirpc_CFLAGS@
+libtirpc_LIBS = @libtirpc_LIBS@
 localedir = @localedir@
 localstatedir = @localstatedir@
 lt_ECHO = @lt_ECHO@
@@ -290,10 +310,9 @@ AM_LDFLAGS = -no-undefined -avoid-version -module $(am__append_1)
 noinst_HEADERS = md5.h pam_namespace.h argv_parse.h
 @HAVE_UNSHARE_TRUE@securelib_LTLIBRARIES = pam_namespace.la
 @HAVE_UNSHARE_TRUE@pam_namespace_la_SOURCES = pam_namespace.c md5.c argv_parse.c
-@HAVE_UNSHARE_TRUE@pam_namespace_la_LIBADD = -L$(top_builddir)/libpam -lpam @LIBSELINUX@
+@HAVE_UNSHARE_TRUE@pam_namespace_la_LIBADD = $(top_builddir)/libpam/libpam.la @LIBSELINUX@
 @HAVE_UNSHARE_TRUE@secureconf_DATA = namespace.conf
 @HAVE_UNSHARE_TRUE@secureconf_SCRIPTS = namespace.init
-@HAVE_UNSHARE_TRUE@namespaced_DATA = 
 @ENABLE_REGENERATE_MAN_TRUE@noinst_DATA = README
 all: all-am
 
@@ -303,14 +322,14 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
-	      cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
-		&& exit 0; \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu  modules/pam_namespace/Makefile'; \
-	cd $(top_srcdir) && \
-	  $(AUTOMAKE) --gnu  modules/pam_namespace/Makefile
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu modules/pam_namespace/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --gnu modules/pam_namespace/Makefile
 .PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
@@ -328,23 +347,28 @@ $(top_srcdir)/configure:  $(am__configure_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(ACLOCAL_M4):  $(am__aclocal_m4_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
 install-securelibLTLIBRARIES: $(securelib_LTLIBRARIES)
 	@$(NORMAL_INSTALL)
 	test -z "$(securelibdir)" || $(MKDIR_P) "$(DESTDIR)$(securelibdir)"
-	@list='$(securelib_LTLIBRARIES)'; for p in $$list; do \
+	@list='$(securelib_LTLIBRARIES)'; test -n "$(securelibdir)" || list=; \
+	list2=; for p in $$list; do \
 	  if test -f $$p; then \
-	    f=$(am__strip_dir) \
-	    echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(securelibLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(securelibdir)/$$f'"; \
-	    $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(securelibLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(securelibdir)/$$f"; \
+	    list2="$$list2 $$p"; \
 	  else :; fi; \
-	done
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(securelibdir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(securelibdir)"; \
+	}
 
 uninstall-securelibLTLIBRARIES:
 	@$(NORMAL_UNINSTALL)
-	@list='$(securelib_LTLIBRARIES)'; for p in $$list; do \
-	  p=$(am__strip_dir) \
-	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(securelibdir)/$$p'"; \
-	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(securelibdir)/$$p"; \
+	@list='$(securelib_LTLIBRARIES)'; test -n "$(securelibdir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(securelibdir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(securelibdir)/$$f"; \
 	done
 
 clean-securelibLTLIBRARIES:
@@ -360,22 +384,37 @@ pam_namespace.la: $(pam_namespace_la_OBJECTS) $(pam_namespace_la_DEPENDENCIES)
 install-secureconfSCRIPTS: $(secureconf_SCRIPTS)
 	@$(NORMAL_INSTALL)
 	test -z "$(secureconfdir)" || $(MKDIR_P) "$(DESTDIR)$(secureconfdir)"
-	@list='$(secureconf_SCRIPTS)'; for p in $$list; do \
+	@list='$(secureconf_SCRIPTS)'; test -n "$(secureconfdir)" || list=; \
+	for p in $$list; do \
 	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  if test -f $$d$$p; then \
-	    f=`echo "$$p" | sed 's|^.*/||;$(transform)'`; \
-	    echo " $(secureconfSCRIPT_INSTALL) '$$d$$p' '$(DESTDIR)$(secureconfdir)/$$f'"; \
-	    $(secureconfSCRIPT_INSTALL) "$$d$$p" "$(DESTDIR)$(secureconfdir)/$$f"; \
-	  else :; fi; \
-	done
+	  if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \
+	done | \
+	sed -e 'p;s,.*/,,;n' \
+	    -e 'h;s|.*|.|' \
+	    -e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \
+	$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \
+	  { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
+	    if ($$2 == $$4) { files[d] = files[d] " " $$1; \
+	      if (++n[d] == $(am__install_max)) { \
+		print "f", d, files[d]; n[d] = 0; files[d] = "" } } \
+	    else { print "f", d "/" $$4, $$1 } } \
+	  END { for (d in files) print "f", d, files[d] }' | \
+	while read type dir files; do \
+	     if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
+	     test -z "$$files" || { \
+	       echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(secureconfdir)$$dir'"; \
+	       $(INSTALL_SCRIPT) $$files "$(DESTDIR)$(secureconfdir)$$dir" || exit $$?; \
+	     } \
+	; done
 
 uninstall-secureconfSCRIPTS:
 	@$(NORMAL_UNINSTALL)
-	@list='$(secureconf_SCRIPTS)'; for p in $$list; do \
-	  f=`echo "$$p" | sed 's|^.*/||;$(transform)'`; \
-	  echo " rm -f '$(DESTDIR)$(secureconfdir)/$$f'"; \
-	  rm -f "$(DESTDIR)$(secureconfdir)/$$f"; \
-	done
+	@list='$(secureconf_SCRIPTS)'; test -n "$(secureconfdir)" || exit 0; \
+	files=`for p in $$list; do echo "$$p"; done | \
+	       sed -e 's,.*/,,;$(transform)'`; \
+	test -n "$$list" || exit 0; \
+	echo " ( cd '$(DESTDIR)$(secureconfdir)' && rm -f" $$files ")"; \
+	cd "$(DESTDIR)$(secureconfdir)" && rm -f $$files
 
 mostlyclean-compile:
 	-rm -f *.$(OBJEXT)
@@ -389,21 +428,21 @@ distclean-compile:
 
 .c.o:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(COMPILE) -c $<
 
 .c.obj:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
 @am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(LTCOMPILE) -c -o $@ $<
@@ -413,144 +452,116 @@ mostlyclean-libtool:
 
 clean-libtool:
 	-rm -rf .libs _libs
-install-man5: $(man5_MANS) $(man_MANS)
+install-man5: $(man_MANS)
 	@$(NORMAL_INSTALL)
 	test -z "$(man5dir)" || $(MKDIR_P) "$(DESTDIR)$(man5dir)"
-	@list='$(man5_MANS) $(dist_man5_MANS) $(nodist_man5_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.5*) list="$$list $$i" ;; \
-	  esac; \
+	@list=''; test -n "$(man5dir)" || exit 0; \
+	{ for i in $$list; do echo "$$i"; done; \
+	l2='$(man_MANS)'; for i in $$l2; do echo "$$i"; done | \
+	  sed -n '/\.5[a-z]*$$/p'; \
+	} | while read p; do \
+	  if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; echo "$$p"; \
+	done | \
+	sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^5][0-9a-z]*$$,5,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
+	sed 'N;N;s,\n, ,g' | { \
+	list=; while read file base inst; do \
+	  if test "$$base" = "$$inst"; then list="$$list $$file"; else \
+	    echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man5dir)/$$inst'"; \
+	    $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man5dir)/$$inst" || exit $$?; \
+	  fi; \
 	done; \
-	for i in $$list; do \
-	  if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \
-	  else file=$$i; fi; \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    5*) ;; \
-	    *) ext='5' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man5dir)/$$inst'"; \
-	  $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man5dir)/$$inst"; \
-	done
+	for i in $$list; do echo "$$i"; done | $(am__base_list) | \
+	while read files; do \
+	  test -z "$$files" || { \
+	    echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man5dir)'"; \
+	    $(INSTALL_DATA) $$files "$(DESTDIR)$(man5dir)" || exit $$?; }; \
+	done; }
+
 uninstall-man5:
 	@$(NORMAL_UNINSTALL)
-	@list='$(man5_MANS) $(dist_man5_MANS) $(nodist_man5_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.5*) list="$$list $$i" ;; \
-	  esac; \
-	done; \
-	for i in $$list; do \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    5*) ;; \
-	    *) ext='5' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " rm -f '$(DESTDIR)$(man5dir)/$$inst'"; \
-	  rm -f "$(DESTDIR)$(man5dir)/$$inst"; \
-	done
-install-man8: $(man8_MANS) $(man_MANS)
+	@list=''; test -n "$(man5dir)" || exit 0; \
+	files=`{ for i in $$list; do echo "$$i"; done; \
+	l2='$(man_MANS)'; for i in $$l2; do echo "$$i"; done | \
+	  sed -n '/\.5[a-z]*$$/p'; \
+	} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^5][0-9a-z]*$$,5,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
+	test -z "$$files" || { \
+	  echo " ( cd '$(DESTDIR)$(man5dir)' && rm -f" $$files ")"; \
+	  cd "$(DESTDIR)$(man5dir)" && rm -f $$files; }
+install-man8: $(man_MANS)
 	@$(NORMAL_INSTALL)
 	test -z "$(man8dir)" || $(MKDIR_P) "$(DESTDIR)$(man8dir)"
-	@list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.8*) list="$$list $$i" ;; \
-	  esac; \
-	done; \
-	for i in $$list; do \
-	  if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \
-	  else file=$$i; fi; \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    8*) ;; \
-	    *) ext='8' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \
-	  $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst"; \
-	done
-uninstall-man8:
-	@$(NORMAL_UNINSTALL)
-	@list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.8*) list="$$list $$i" ;; \
-	  esac; \
+	@list=''; test -n "$(man8dir)" || exit 0; \
+	{ for i in $$list; do echo "$$i"; done; \
+	l2='$(man_MANS)'; for i in $$l2; do echo "$$i"; done | \
+	  sed -n '/\.8[a-z]*$$/p'; \
+	} | while read p; do \
+	  if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; echo "$$p"; \
+	done | \
+	sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
+	sed 'N;N;s,\n, ,g' | { \
+	list=; while read file base inst; do \
+	  if test "$$base" = "$$inst"; then list="$$list $$file"; else \
+	    echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \
+	    $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst" || exit $$?; \
+	  fi; \
 	done; \
-	for i in $$list; do \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    8*) ;; \
-	    *) ext='8' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " rm -f '$(DESTDIR)$(man8dir)/$$inst'"; \
-	  rm -f "$(DESTDIR)$(man8dir)/$$inst"; \
-	done
-install-namespacedDATA: $(namespaced_DATA)
-	@$(NORMAL_INSTALL)
-	test -z "$(namespaceddir)" || $(MKDIR_P) "$(DESTDIR)$(namespaceddir)"
-	@list='$(namespaced_DATA)'; for p in $$list; do \
-	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  f=$(am__strip_dir) \
-	  echo " $(namespacedDATA_INSTALL) '$$d$$p' '$(DESTDIR)$(namespaceddir)/$$f'"; \
-	  $(namespacedDATA_INSTALL) "$$d$$p" "$(DESTDIR)$(namespaceddir)/$$f"; \
-	done
+	for i in $$list; do echo "$$i"; done | $(am__base_list) | \
+	while read files; do \
+	  test -z "$$files" || { \
+	    echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man8dir)'"; \
+	    $(INSTALL_DATA) $$files "$(DESTDIR)$(man8dir)" || exit $$?; }; \
+	done; }
 
-uninstall-namespacedDATA:
+uninstall-man8:
 	@$(NORMAL_UNINSTALL)
-	@list='$(namespaced_DATA)'; for p in $$list; do \
-	  f=$(am__strip_dir) \
-	  echo " rm -f '$(DESTDIR)$(namespaceddir)/$$f'"; \
-	  rm -f "$(DESTDIR)$(namespaceddir)/$$f"; \
-	done
+	@list=''; test -n "$(man8dir)" || exit 0; \
+	files=`{ for i in $$list; do echo "$$i"; done; \
+	l2='$(man_MANS)'; for i in $$l2; do echo "$$i"; done | \
+	  sed -n '/\.8[a-z]*$$/p'; \
+	} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
+	test -z "$$files" || { \
+	  echo " ( cd '$(DESTDIR)$(man8dir)' && rm -f" $$files ")"; \
+	  cd "$(DESTDIR)$(man8dir)" && rm -f $$files; }
 install-secureconfDATA: $(secureconf_DATA)
 	@$(NORMAL_INSTALL)
 	test -z "$(secureconfdir)" || $(MKDIR_P) "$(DESTDIR)$(secureconfdir)"
-	@list='$(secureconf_DATA)'; for p in $$list; do \
+	@list='$(secureconf_DATA)'; test -n "$(secureconfdir)" || list=; \
+	for p in $$list; do \
 	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  f=$(am__strip_dir) \
-	  echo " $(secureconfDATA_INSTALL) '$$d$$p' '$(DESTDIR)$(secureconfdir)/$$f'"; \
-	  $(secureconfDATA_INSTALL) "$$d$$p" "$(DESTDIR)$(secureconfdir)/$$f"; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(secureconfdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(secureconfdir)" || exit $$?; \
 	done
 
 uninstall-secureconfDATA:
 	@$(NORMAL_UNINSTALL)
-	@list='$(secureconf_DATA)'; for p in $$list; do \
-	  f=$(am__strip_dir) \
-	  echo " rm -f '$(DESTDIR)$(secureconfdir)/$$f'"; \
-	  rm -f "$(DESTDIR)$(secureconfdir)/$$f"; \
-	done
+	@list='$(secureconf_DATA)'; test -n "$(secureconfdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	test -n "$$files" || exit 0; \
+	echo " ( cd '$(DESTDIR)$(secureconfdir)' && rm -f" $$files ")"; \
+	cd "$(DESTDIR)$(secureconfdir)" && rm -f $$files
 
 ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
 	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
-	  $(AWK) '{ files[$$0] = 1; nonemtpy = 1; } \
+	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
 	      END { if (nonempty) { for (i in files) print i; }; }'`; \
 	mkid -fID $$unique
 tags: TAGS
 
 TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 		$(TAGS_FILES) $(LISP)
-	tags=; \
+	set x; \
 	here=`pwd`; \
 	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
@@ -558,37 +569,43 @@ TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 	  done | \
 	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
 	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
 	  test -n "$$unique" || unique=$$empty_fix; \
-	  $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	    $$tags $$unique; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
 	fi
 ctags: CTAGS
 CTAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 		$(TAGS_FILES) $(LISP)
-	tags=; \
 	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
 	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
 	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	test -z "$(CTAGS_ARGS)$$tags$$unique" \
+	test -z "$(CTAGS_ARGS)$$unique" \
 	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
-	     $$tags $$unique
+	     $$unique
 
 GTAGS:
 	here=`$(am__cd) $(top_builddir) && pwd` \
-	  && cd $(top_srcdir) \
-	  && gtags -i $(GTAGS_ARGS) $$here
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
 
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 
 check-TESTS: $(TESTS)
-	@failed=0; all=0; xfail=0; xpass=0; skip=0; ws='[	 ]'; \
+	@failed=0; all=0; xfail=0; xpass=0; skip=0; \
 	srcdir=$(srcdir); export srcdir; \
 	list=' $(TESTS) '; \
+	$(am__tty_colors); \
 	if test -n "$$list"; then \
 	  for tst in $$list; do \
 	    if test -f ./$$tst; then dir=./; \
@@ -597,49 +614,63 @@ check-TESTS: $(TESTS)
 	    if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \
 	      all=`expr $$all + 1`; \
 	      case " $(XFAIL_TESTS) " in \
-	      *$$ws$$tst$$ws*) \
+	      *[\ \	]$$tst[\ \	]*) \
 		xpass=`expr $$xpass + 1`; \
 		failed=`expr $$failed + 1`; \
-		echo "XPASS: $$tst"; \
+		col=$$red; res=XPASS; \
 	      ;; \
 	      *) \
-		echo "PASS: $$tst"; \
+		col=$$grn; res=PASS; \
 	      ;; \
 	      esac; \
 	    elif test $$? -ne 77; then \
 	      all=`expr $$all + 1`; \
 	      case " $(XFAIL_TESTS) " in \
-	      *$$ws$$tst$$ws*) \
+	      *[\ \	]$$tst[\ \	]*) \
 		xfail=`expr $$xfail + 1`; \
-		echo "XFAIL: $$tst"; \
+		col=$$lgn; res=XFAIL; \
 	      ;; \
 	      *) \
 		failed=`expr $$failed + 1`; \
-		echo "FAIL: $$tst"; \
+		col=$$red; res=FAIL; \
 	      ;; \
 	      esac; \
 	    else \
 	      skip=`expr $$skip + 1`; \
-	      echo "SKIP: $$tst"; \
+	      col=$$blu; res=SKIP; \
 	    fi; \
+	    echo "$${col}$$res$${std}: $$tst"; \
 	  done; \
+	  if test "$$all" -eq 1; then \
+	    tests="test"; \
+	    All=""; \
+	  else \
+	    tests="tests"; \
+	    All="All "; \
+	  fi; \
 	  if test "$$failed" -eq 0; then \
 	    if test "$$xfail" -eq 0; then \
-	      banner="All $$all tests passed"; \
+	      banner="$$All$$all $$tests passed"; \
 	    else \
-	      banner="All $$all tests behaved as expected ($$xfail expected failures)"; \
+	      if test "$$xfail" -eq 1; then failures=failure; else failures=failures; fi; \
+	      banner="$$All$$all $$tests behaved as expected ($$xfail expected $$failures)"; \
 	    fi; \
 	  else \
 	    if test "$$xpass" -eq 0; then \
-	      banner="$$failed of $$all tests failed"; \
+	      banner="$$failed of $$all $$tests failed"; \
 	    else \
-	      banner="$$failed of $$all tests did not behave as expected ($$xpass unexpected passes)"; \
+	      if test "$$xpass" -eq 1; then passes=pass; else passes=passes; fi; \
+	      banner="$$failed of $$all $$tests did not behave as expected ($$xpass unexpected $$passes)"; \
 	    fi; \
 	  fi; \
 	  dashes="$$banner"; \
 	  skipped=""; \
 	  if test "$$skip" -ne 0; then \
-	    skipped="($$skip tests were not run)"; \
+	    if test "$$skip" -eq 1; then \
+	      skipped="($$skip test was not run)"; \
+	    else \
+	      skipped="($$skip tests were not run)"; \
+	    fi; \
 	    test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \
 	      dashes="$$skipped"; \
 	  fi; \
@@ -650,15 +681,32 @@ check-TESTS: $(TESTS)
 	      dashes="$$report"; \
 	  fi; \
 	  dashes=`echo "$$dashes" | sed s/./=/g`; \
-	  echo "$$dashes"; \
+	  if test "$$failed" -eq 0; then \
+	    echo "$$grn$$dashes"; \
+	  else \
+	    echo "$$red$$dashes"; \
+	  fi; \
 	  echo "$$banner"; \
 	  test -z "$$skipped" || echo "$$skipped"; \
 	  test -z "$$report" || echo "$$report"; \
-	  echo "$$dashes"; \
+	  echo "$$dashes$$std"; \
 	  test "$$failed" -eq 0; \
 	else :; fi
 
 distdir: $(DISTFILES)
+	@list='$(MANS)'; if test -n "$$list"; then \
+	  list=`for p in $$list; do \
+	    if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
+	    if test -f "$$d$$p"; then echo "$$d$$p"; else :; fi; done`; \
+	  if test -n "$$list" && \
+	    grep 'ab help2man is required to generate this page' $$list >/dev/null; then \
+	    echo "error: found man pages containing the \`missing help2man' replacement text:" >&2; \
+	    grep -l 'ab help2man is required to generate this page' $$list | sed 's/^/         /' >&2; \
+	    echo "       to fix them, install help2man, remove and regenerate the man pages;" >&2; \
+	    echo "       typically \`make maintainer-clean' will remove them" >&2; \
+	    exit 1; \
+	  else :; fi; \
+	else :; fi
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -674,13 +722,17 @@ distdir: $(DISTFILES)
 	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
 	  if test -d $$d/$$file; then \
 	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
 	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
 	    fi; \
-	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
 	  else \
-	    test -f $(distdir)/$$file \
-	    || cp -p $$d/$$file $(distdir)/$$file \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
 	    || exit 1; \
 	  fi; \
 	done
@@ -689,7 +741,7 @@ check-am: all-am
 check: check-am
 all-am: Makefile $(LTLIBRARIES) $(SCRIPTS) $(MANS) $(DATA) $(HEADERS)
 installdirs:
-	for dir in "$(DESTDIR)$(securelibdir)" "$(DESTDIR)$(secureconfdir)" "$(DESTDIR)$(man5dir)" "$(DESTDIR)$(man8dir)" "$(DESTDIR)$(namespaceddir)" "$(DESTDIR)$(secureconfdir)"; do \
+	for dir in "$(DESTDIR)$(securelibdir)" "$(DESTDIR)$(secureconfdir)" "$(DESTDIR)$(man5dir)" "$(DESTDIR)$(man8dir)" "$(DESTDIR)$(secureconfdir)"; do \
 	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
 	done
 install: install-am
@@ -713,11 +765,13 @@ clean-generic:
 
 distclean-generic:
 	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
 	@echo "it deletes files that may require special tools to rebuild."
 	-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
+@HAVE_UNSHARE_FALSE@install-data-local:
 clean: clean-am
 
 clean-am: clean-generic clean-libtool clean-securelibLTLIBRARIES \
@@ -735,28 +789,39 @@ dvi-am:
 
 html: html-am
 
+html-am:
+
 info: info-am
 
 info-am:
 
-install-data-am: install-man install-namespacedDATA \
-	install-secureconfDATA install-secureconfSCRIPTS \
-	install-securelibLTLIBRARIES
+install-data-am: install-data-local install-man install-secureconfDATA \
+	install-secureconfSCRIPTS install-securelibLTLIBRARIES
 
 install-dvi: install-dvi-am
 
+install-dvi-am:
+
 install-exec-am:
 
 install-html: install-html-am
 
+install-html-am:
+
 install-info: install-info-am
 
+install-info-am:
+
 install-man: install-man5 install-man8
 
 install-pdf: install-pdf-am
 
+install-pdf-am:
+
 install-ps: install-ps-am
 
+install-ps-am:
+
 installcheck-am:
 
 maintainer-clean: maintainer-clean-am
@@ -777,35 +842,37 @@ ps: ps-am
 
 ps-am:
 
-uninstall-am: uninstall-man uninstall-namespacedDATA \
-	uninstall-secureconfDATA uninstall-secureconfSCRIPTS \
-	uninstall-securelibLTLIBRARIES
+uninstall-am: uninstall-man uninstall-secureconfDATA \
+	uninstall-secureconfSCRIPTS uninstall-securelibLTLIBRARIES
 
 uninstall-man: uninstall-man5 uninstall-man8
 
-.MAKE: install-am install-strip
+.MAKE: check-am install-am install-strip
 
 .PHONY: CTAGS GTAGS all all-am check check-TESTS check-am clean \
 	clean-generic clean-libtool clean-securelibLTLIBRARIES ctags \
 	distclean distclean-compile distclean-generic \
 	distclean-libtool distclean-tags distdir dvi dvi-am html \
 	html-am info info-am install install-am install-data \
-	install-data-am install-dvi install-dvi-am install-exec \
-	install-exec-am install-html install-html-am install-info \
-	install-info-am install-man install-man5 install-man8 \
-	install-namespacedDATA install-pdf install-pdf-am install-ps \
+	install-data-am install-data-local install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-man5 \
+	install-man8 install-pdf install-pdf-am install-ps \
 	install-ps-am install-secureconfDATA install-secureconfSCRIPTS \
 	install-securelibLTLIBRARIES install-strip installcheck \
 	installcheck-am installdirs maintainer-clean \
 	maintainer-clean-generic mostlyclean mostlyclean-compile \
 	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
 	tags uninstall uninstall-am uninstall-man uninstall-man5 \
-	uninstall-man8 uninstall-namespacedDATA \
-	uninstall-secureconfDATA uninstall-secureconfSCRIPTS \
-	uninstall-securelibLTLIBRARIES
+	uninstall-man8 uninstall-secureconfDATA \
+	uninstall-secureconfSCRIPTS uninstall-securelibLTLIBRARIES
+
 
+@HAVE_UNSHARE_TRUE@install-data-local:
+@HAVE_UNSHARE_TRUE@	mkdir -p $(DESTDIR)$(namespaceddir)
 @ENABLE_REGENERATE_MAN_TRUE@README: pam_namespace.8.xml namespace.conf.5.xml
 @ENABLE_REGENERATE_MAN_TRUE@-include $(top_srcdir)/Make.xml.rules
+
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
diff --git a/modules/pam_namespace/README b/modules/pam_namespace/README
index 413b8fd6..41cc5403 100644
--- a/modules/pam_namespace/README
+++ b/modules/pam_namespace/README
@@ -68,12 +68,14 @@ ignore_instance_parent_mode
     will reduce security and isolation goals of the polyinstantiation
     mechanism.
 
-no_unmount_on_close
+unmount_on_close
 
-    For certain trusted programs such as newrole, open session is called from a
-    child process while the parent performs close session and pam end
-    functions. For these commands use this option to instruct pam_close_session
-    to not unmount the bind mounted polyinstantiated directory in the parent.
+    Explicitly unmount the polyinstantiated directories instead of relying on
+    automatic namespace destruction after the last process in a namespace
+    exits. This option should be used only in case it is ensured by other means
+    that there cannot be any processes running in the private namespace left
+    after the session close. It is also useful only in case there are multiple
+    pam session calls in sequence from the same process.
 
 use_current_context
 
@@ -87,6 +89,20 @@ use_default_context
     context with setexeccon call. The module will use the default SELinux
     context of the user for the level and context polyinstantiation.
 
+mount_private
+
+    This option can be used on systems where the / mount point or its submounts
+    are made shared (for example with a mount --make-rshared / command). The
+    module will mark the whole directory tree so any mount and unmount
+    operations in the polyinstantiation namespace are private. Normally the
+    pam_namespace will try to detect the shared / mount point and make the
+    polyinstantiated directories private automatically. This option has to be
+    used just when only a subtree is shared and / is not.
+
+    Note that mounts and unmounts done in the private namespace will not affect
+    the parent namespace if this option is used or when the shared / mount
+    point is autodetected.
+
 DESCRIPTION
 
 The pam_namespace.so module allows setup of private namespaces with
@@ -151,6 +167,10 @@ noinit - instance directory init script will not be executed.
 shared - the instance directories for "context" and "level" methods will not
 contain the user name and will be shared among all users.
 
+mntopts=value - value of this flag is passed to the mount call when the tmpfs
+mount is done. It allows for example the specification of the maximum size of
+the tmpfs instance that is created by the mount call. See mount(8) for details.
+
 The directory where polyinstantiated instances are to be created, must exist
 and must have, by default, the mode of 0000. The requirement that the instance
 parent be of mode 0000 can be overridden with the command line option
diff --git a/modules/pam_namespace/md5.c b/modules/pam_namespace/md5.c
index b23d1607..dc95ab14 100644
--- a/modules/pam_namespace/md5.c
+++ b/modules/pam_namespace/md5.c
@@ -1,5 +1,5 @@
 /*
- * $Id: md5.c,v 1.1 2006/06/27 13:07:43 t8m Exp $
+ * $Id$
  *
  * This code implements the MD5 message-digest algorithm.
  * The algorithm is due to Ron Rivest.  This code was
@@ -107,7 +107,7 @@ void MD5Name(MD5Update)(struct MD5Context *ctx, unsigned const char *buf, unsign
 }
 
 /*
- * Final wrapup - pad to 64-byte boundary with the bit pattern 
+ * Final wrapup - pad to 64-byte boundary with the bit pattern
  * 1 0* (64-bit count of bits processed, MSB-first)
  */
 void MD5Name(MD5Final)(unsigned char digest[16], struct MD5Context *ctx)
@@ -142,8 +142,7 @@ void MD5Name(MD5Final)(unsigned char digest[16], struct MD5Context *ctx)
 	byteReverse(ctx->in, 14);
 
 	/* Append length in bits and transform */
-	((uint32 *) ctx->in)[14] = ctx->bits[0];
-	((uint32 *) ctx->in)[15] = ctx->bits[1];
+	memcpy((uint32 *)ctx->in + 14, ctx->bits, 2*sizeof(uint32));
 
 	MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in);
 	byteReverse((unsigned char *) ctx->buf, 4);
diff --git a/modules/pam_namespace/namespace.conf b/modules/pam_namespace/namespace.conf
index f973225f..b611a0f2 100644
--- a/modules/pam_namespace/namespace.conf
+++ b/modules/pam_namespace/namespace.conf
@@ -5,8 +5,8 @@
 # Uncommenting the following three lines will polyinstantiate
 # /tmp, /var/tmp and user's home directories. /tmp and /var/tmp will
 # be polyinstantiated based on the MLS level part of the security context as well as user
-# name, Polyinstantion will not be performed for user root and adm for directories 
-# /tmp and /var/tmp, whereas home directories will be polyinstantiated for all users. 
+# name, Polyinstantion will not be performed for user root and adm for directories
+# /tmp and /var/tmp, whereas home directories will be polyinstantiated for all users.
 # The user name and context is appended to the instance prefix.
 #
 # Note that instance directories do not have to reside inside the
diff --git a/modules/pam_namespace/namespace.conf.5 b/modules/pam_namespace/namespace.conf.5
index 0ae8c03b..8a530c30 100644
--- a/modules/pam_namespace/namespace.conf.5
+++ b/modules/pam_namespace/namespace.conf.5
@@ -1,161 +1,22 @@
+'\" t
 .\"     Title: namespace.conf
 .\"    Author: [see the "AUTHORS" section]
-.\" Generator: DocBook XSL Stylesheets v1.74.0 <http://docbook.sf.net/>
-.\"      Date: 10/27/2010
+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
+.\"      Date: 09/19/2013
 .\"    Manual: Linux-PAM Manual
 .\"    Source: Linux-PAM Manual
 .\"  Language: English
 .\"
-.TH "NAMESPACE\&.CONF" "5" "10/27/2010" "Linux-PAM Manual" "Linux\-PAM Manual"
+.TH "NAMESPACE\&.CONF" "5" "09/19/2013" "Linux-PAM Manual" "Linux\-PAM Manual"
 .\" -----------------------------------------------------------------
-.\" * (re)Define some macros
+.\" * Define some portability stuff
 .\" -----------------------------------------------------------------
 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" toupper - uppercase a string (locale-aware)
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de toupper
-.tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ
-\\$*
-.tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" SH-xref - format a cross-reference to an SH section
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de SH-xref
-.ie n \{\
-.\}
-.toupper \\$*
-.el \{\
-\\$*
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" SH - level-one heading that works better for non-TTY output
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de1 SH
-.\" put an extra blank line of space above the head in non-TTY output
-.if t \{\
-.sp 1
-.\}
-.sp \\n[PD]u
-.nr an-level 1
-.set-an-margin
-.nr an-prevailing-indent \\n[IN]
-.fi
-.in \\n[an-margin]u
-.ti 0
-.HTML-TAG ".NH \\n[an-level]"
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-\." make the size of the head bigger
-.ps +3
-.ft B
-.ne (2v + 1u)
-.ie n \{\
-.\" if n (TTY output), use uppercase
-.toupper \\$*
-.\}
-.el \{\
-.nr an-break-flag 0
-.\" if not n (not TTY), use normal case (not uppercase)
-\\$1
-.in \\n[an-margin]u
-.ti 0
-.\" if not n (not TTY), put a border/line under subheading
-.sp -.6
-\l'\n(.lu'
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" SS - level-two heading that works better for non-TTY output
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de1 SS
-.sp \\n[PD]u
-.nr an-level 1
-.set-an-margin
-.nr an-prevailing-indent \\n[IN]
-.fi
-.in \\n[IN]u
-.ti \\n[SN]u
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-.ps \\n[PS-SS]u
-\." make the size of the head bigger
-.ps +2
-.ft B
-.ne (2v + 1u)
-.if \\n[.$] \&\\$*
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" BB/BE - put background/screen (filled box) around block of text
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de BB
-.if t \{\
-.sp -.5
-.br
-.in +2n
-.ll -2n
-.gcolor red
-.di BX
-.\}
-..
-.de EB
-.if t \{\
-.if "\\$2"adjust-for-leading-newline" \{\
-.sp -1
-.\}
-.br
-.di
-.in
-.ll
-.gcolor
-.nr BW \\n(.lu-\\n(.i
-.nr BH \\n(dn+.5v
-.ne \\n(BHu+.5v
-.ie "\\$2"adjust-for-leading-newline" \{\
-\M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
-.\}
-.el \{\
-\M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
-.\}
-.in 0
-.sp -.5v
-.nf
-.BX
-.in
-.sp .5v
-.fi
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" BM/EM - put colored marker in margin next to block of text
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de BM
-.if t \{\
-.br
-.ll -2n
-.gcolor red
-.di BX
-.\}
-..
-.de EM
-.if t \{\
-.br
-.di
-.ll
-.gcolor
-.nr BH \\n(dn
-.ne \\n(BHu
-\M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[]
-.in 0
-.nf
-.BX
-.in
-.fi
-.\}
-..
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
 .\" -----------------------------------------------------------------
 .\" * set default formatting
 .\" -----------------------------------------------------------------
@@ -166,22 +27,22 @@
 .\" -----------------------------------------------------------------
 .\" * MAIN CONTENT STARTS HERE *
 .\" -----------------------------------------------------------------
-.SH "Name"
+.SH "NAME"
 namespace.conf \- the namespace configuration file
 .SH "DESCRIPTION"
 .PP
 The
 \fIpam_namespace\&.so\fR
 module allows setup of private namespaces with polyinstantiated directories\&. Directories can be polyinstantiated based on user name or, in the case of SELinux, user name, sensitivity level or complete security context\&. If an executable script
-\FC/etc/security/namespace\&.init\F[]
+/etc/security/namespace\&.init
 exists, it is used to initialize the namespace every time an instance directory is set up and mounted\&. The script receives the polyinstantiated directory path and the instance directory path as its arguments\&.
 .PP
 The
-\FC/etc/security/namespace\&.conf\F[]
+/etc/security/namespace\&.conf
 file specifies which directories are polyinstantiated, how they are polyinstantiated, how instance directories would be named, and any users for whom polyinstantiation would not be performed\&.
 .PP
 When someone logs in, the file
-\FCnamespace\&.conf\F[]
+namespace\&.conf
 is scanned\&. Comments are marked by
 \fI#\fR
 characters\&. Each non comment line represents one polyinstantiated directory\&. The fields are separated by spaces but can be quoted by
@@ -192,15 +53,12 @@ characters also escape sequences
 \fI\et\fR
 are recognized\&. The fields are as follows:
 .PP
-\fIpolydir\fR
-\fIinstance_prefix\fR
-\fImethod\fR
-\fIlist_of_uids\fR
+\fIpolydir\fR\fIinstance_prefix\fR\fImethod\fR\fIlist_of_uids\fR
 .PP
 The first field,
 \fIpolydir\fR, is the absolute pathname of the directory to polyinstantiate\&. The special string
 \fI$HOME\fR
-is replaced with the user\'s home directory, and
+is replaced with the user\*(Aqs home directory, and
 \fI$USER\fR
 with the username\&. This field cannot be blank\&.
 .PP
@@ -210,12 +68,12 @@ is the string prefix used to build the pathname for the instantiation of <polydi
 \fImethod\fR
 it is then appended with "instance differentiation string" to generate the final instance directory path\&. This directory is created if it did not exist already, and is then bind mounted on the <polydir> to provide an instance of <polydir> based on the <method> column\&. The special string
 \fI$HOME\fR
-is replaced with the user\'s home directory, and
+is replaced with the user\*(Aqs home directory, and
 \fI$USER\fR
 with the username\&. This field cannot be blank\&.
 .PP
 The third field,
-\fImethod\fR, is the method used for polyinstantiation\&. It can take these values; "user" for polyinstantiation based on user name, "level" for polyinstantiation based on process MLS level and user name, "context" for polyinstantiation based on process security context and user name, "tmpfs" for mounting tmpfs filesystem as an instance dir, and "tmpdir" for creating temporary directory as an instance dir which is removed when the user\'s session is closed\&. Methods "context" and "level" are only available with SELinux\&. This field cannot be blank\&.
+\fImethod\fR, is the method used for polyinstantiation\&. It can take these values; "user" for polyinstantiation based on user name, "level" for polyinstantiation based on process MLS level and user name, "context" for polyinstantiation based on process security context and user name, "tmpfs" for mounting tmpfs filesystem as an instance dir, and "tmpdir" for creating temporary directory as an instance dir which is removed when the user\*(Aqs session is closed\&. Methods "context" and "level" are only available with SELinux\&. This field cannot be blank\&.
 .PP
 The fourth field,
 \fIlist_of_uids\fR, is a comma separated list of user names for whom the polyinstantiation is not performed\&. If left blank, polyinstantiation will be performed for all users\&. If the list is preceded with a single "~" character, polyinstantiation is performed only for users in the list\&.
@@ -231,7 +89,7 @@ characters\&.
 .PP
 \fIiscript\fR=\fIpath\fR
 \- path to the instance directory init script\&. The base directory for relative paths is
-\FC/etc/security/namespace\&.d\F[]\&.
+/etc/security/namespace\&.d\&.
 .PP
 \fInoinit\fR
 \- instance directory init script will not be executed\&.
@@ -239,11 +97,16 @@ characters\&.
 \fIshared\fR
 \- the instance directories for "context" and "level" methods will not contain the user name and will be shared among all users\&.
 .PP
+\fImntopts\fR=\fIvalue\fR
+\- value of this flag is passed to the mount call when the tmpfs mount is done\&. It allows for example the specification of the maximum size of the tmpfs instance that is created by the mount call\&. See
+\fBmount\fR(8)
+for details\&.
+.PP
 The directory where polyinstantiated instances are to be created, must exist and must have, by default, the mode of 0000\&. The requirement that the instance parent be of mode 0000 can be overridden with the command line option
 \fIignore_instance_parent_mode\fR
 .PP
 In case of context or level polyinstantiation the SELinux context which is used for polyinstantiation is the context used for executing a new process as obtained by getexeccon\&. This context must be set by the calling application or
-\FCpam_selinux\&.so\F[]
+pam_selinux\&.so
 module\&. If this context is not set the polyinstatiation will be based just on user name\&.
 .PP
 The "instance differentiation string" is <user name> for "user" method and <user name>_<raw directory context> for "context" and "level" methods\&. If the whole string is too long the end of it is replaced with md5sum of itself\&. Also when command line option
@@ -252,22 +115,14 @@ is used the whole string is replaced with md5sum of itself\&.
 .SH "EXAMPLES"
 .PP
 These are some example lines which might be specified in
-\FC/etc/security/namespace\&.conf\F[]\&.
+/etc/security/namespace\&.conf\&.
 .sp
 .if n \{\
 .RS 4
 .\}
-.fam C
-.ps -1
 .nf
-.if t \{\
-.sp -1
-.\}
-.BB lightgray adjust-for-leading-newline
-.sp -1
-
       # The following three lines will polyinstantiate /tmp,
-      # /var/tmp and user\'s home directories\&. /tmp and /var/tmp
+      # /var/tmp and user\*(Aqs home directories\&. /tmp and /var/tmp
       # will be polyinstantiated based on the security level
       # as well as user name, whereas home directory will be
       # polyinstantiated based on the full security context and user name\&.
@@ -286,13 +141,7 @@ These are some example lines which might be specified in
       /var/tmp /var/tmp/tmp\-inst/   	level      root,adm
       $HOME    $HOME/$USER\&.inst/inst\- context
     
-.EB lightgray adjust-for-leading-newline
-.if t \{\
-.sp 1
-.\}
 .fi
-.fam
-.ps +1
 .if n \{\
 .RE
 .\}
@@ -304,7 +153,6 @@ session required pam_namespace\&.so [arguments]
 This module also depends on pam_selinux\&.so setting the context\&.
 .SH "SEE ALSO"
 .PP
-
 \fBpam_namespace\fR(8),
 \fBpam.d\fR(5),
 \fBpam\fR(8)
diff --git a/modules/pam_namespace/namespace.conf.5.xml b/modules/pam_namespace/namespace.conf.5.xml
index 61c8673b..c7698cb4 100644
--- a/modules/pam_namespace/namespace.conf.5.xml
+++ b/modules/pam_namespace/namespace.conf.5.xml
@@ -61,7 +61,7 @@
     <para>
       The second field, <replaceable>instance_prefix</replaceable> is
       the string prefix used to build the pathname for the instantiation
-      of &lt;polydir&gt;. Depending on the polyinstantiation 
+      of &lt;polydir&gt;. Depending on the polyinstantiation
       <replaceable>method</replaceable> it is then appended with
       "instance differentiation string" to generate the final
       instance directory path. This directory is created if it did not exist
@@ -75,7 +75,7 @@
     <para>
       The third field, <replaceable>method</replaceable>, is the method
       used for polyinstantiation. It can take these values; "user"
-      for polyinstantiation based on user name, "level" for 
+      for polyinstantiation based on user name, "level" for
       polyinstantiation based on process MLS level and user name, "context" for
       polyinstantiation based on process security context and user name,
       "tmpfs" for mounting tmpfs filesystem as an instance dir, and
@@ -97,7 +97,7 @@
       The <replaceable>method</replaceable> field can contain also following
       optional flags separated by <emphasis>:</emphasis> characters.
     </para>
-    
+
     <para><emphasis>create</emphasis>=<replaceable>mode</replaceable>,<replaceable>owner</replaceable>,<replaceable>group</replaceable>
       - create the polyinstantiated directory. The mode, owner and group parameters
       are optional. The default for mode is determined by umask, the default
@@ -119,6 +119,14 @@
       contain the user name and will be shared among all users.
     </para>
 
+    <para><emphasis>mntopts</emphasis>=<replaceable>value</replaceable>
+      - value of this flag is passed to the mount call when the tmpfs mount is
+      done. It allows for example the specification of the maximum size of the
+      tmpfs instance that is created by the mount call. See <citerefentry>
+      <refentrytitle>mount</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry> for details.
+    </para>
+
     <para>
       The directory where polyinstantiated instances are to be
       created, must exist and must have, by default, the mode of 0000.  The
diff --git a/modules/pam_namespace/namespace.init b/modules/pam_namespace/namespace.init
index 9898bf3a..9ab58062 100755
--- a/modules/pam_namespace/namespace.init
+++ b/modules/pam_namespace/namespace.init
@@ -1,5 +1,5 @@
 #!/bin/sh -p
-# It receives polydir path as $1, the instance path as $2, 
+# It receives polydir path as $1, the instance path as $2,
 # a flag whether the instance dir was newly created (0 - no, 1 - yes) in $3,
 # and user name in $4.
 #
diff --git a/modules/pam_namespace/pam_namespace.8 b/modules/pam_namespace/pam_namespace.8
index f110115f..0037a03f 100644
--- a/modules/pam_namespace/pam_namespace.8
+++ b/modules/pam_namespace/pam_namespace.8
@@ -1,161 +1,22 @@
+'\" t
 .\"     Title: pam_namespace
 .\"    Author: [see the "AUTHORS" section]
-.\" Generator: DocBook XSL Stylesheets v1.74.0 <http://docbook.sf.net/>
-.\"      Date: 10/27/2010
+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
+.\"      Date: 09/19/2013
 .\"    Manual: Linux-PAM Manual
 .\"    Source: Linux-PAM Manual
 .\"  Language: English
 .\"
-.TH "PAM_NAMESPACE" "8" "10/27/2010" "Linux-PAM Manual" "Linux-PAM Manual"
+.TH "PAM_NAMESPACE" "8" "09/19/2013" "Linux-PAM Manual" "Linux-PAM Manual"
 .\" -----------------------------------------------------------------
-.\" * (re)Define some macros
+.\" * Define some portability stuff
 .\" -----------------------------------------------------------------
 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" toupper - uppercase a string (locale-aware)
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de toupper
-.tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ
-\\$*
-.tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" SH-xref - format a cross-reference to an SH section
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de SH-xref
-.ie n \{\
-.\}
-.toupper \\$*
-.el \{\
-\\$*
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" SH - level-one heading that works better for non-TTY output
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de1 SH
-.\" put an extra blank line of space above the head in non-TTY output
-.if t \{\
-.sp 1
-.\}
-.sp \\n[PD]u
-.nr an-level 1
-.set-an-margin
-.nr an-prevailing-indent \\n[IN]
-.fi
-.in \\n[an-margin]u
-.ti 0
-.HTML-TAG ".NH \\n[an-level]"
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-\." make the size of the head bigger
-.ps +3
-.ft B
-.ne (2v + 1u)
-.ie n \{\
-.\" if n (TTY output), use uppercase
-.toupper \\$*
-.\}
-.el \{\
-.nr an-break-flag 0
-.\" if not n (not TTY), use normal case (not uppercase)
-\\$1
-.in \\n[an-margin]u
-.ti 0
-.\" if not n (not TTY), put a border/line under subheading
-.sp -.6
-\l'\n(.lu'
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" SS - level-two heading that works better for non-TTY output
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de1 SS
-.sp \\n[PD]u
-.nr an-level 1
-.set-an-margin
-.nr an-prevailing-indent \\n[IN]
-.fi
-.in \\n[IN]u
-.ti \\n[SN]u
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-.ps \\n[PS-SS]u
-\." make the size of the head bigger
-.ps +2
-.ft B
-.ne (2v + 1u)
-.if \\n[.$] \&\\$*
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" BB/BE - put background/screen (filled box) around block of text
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de BB
-.if t \{\
-.sp -.5
-.br
-.in +2n
-.ll -2n
-.gcolor red
-.di BX
-.\}
-..
-.de EB
-.if t \{\
-.if "\\$2"adjust-for-leading-newline" \{\
-.sp -1
-.\}
-.br
-.di
-.in
-.ll
-.gcolor
-.nr BW \\n(.lu-\\n(.i
-.nr BH \\n(dn+.5v
-.ne \\n(BHu+.5v
-.ie "\\$2"adjust-for-leading-newline" \{\
-\M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
-.\}
-.el \{\
-\M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
-.\}
-.in 0
-.sp -.5v
-.nf
-.BX
-.in
-.sp .5v
-.fi
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" BM/EM - put colored marker in margin next to block of text
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de BM
-.if t \{\
-.br
-.ll -2n
-.gcolor red
-.di BX
-.\}
-..
-.de EM
-.if t \{\
-.br
-.di
-.ll
-.gcolor
-.nr BH \\n(dn
-.ne \\n(BHu
-\M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[]
-.in 0
-.nf
-.BX
-.in
-.fi
-.\}
-..
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
 .\" -----------------------------------------------------------------
 .\" * set default formatting
 .\" -----------------------------------------------------------------
@@ -166,17 +27,15 @@
 .\" -----------------------------------------------------------------
 .\" * MAIN CONTENT STARTS HERE *
 .\" -----------------------------------------------------------------
-.SH "Name"
+.SH "NAME"
 pam_namespace \- PAM module for configuring namespace for a session
-.SH "Synopsis"
-.fam C
+.SH "SYNOPSIS"
 .HP \w'\fBpam_namespace\&.so\fR\ 'u
-\fBpam_namespace\&.so\fR [debug] [unmnt_remnt] [unmnt_only] [require_selinux] [gen_hash] [ignore_config_error] [ignore_instance_parent_mode] [no_unmount_on_close] [use_current_context] [use_default_context]
-.fam
+\fBpam_namespace\&.so\fR [debug] [unmnt_remnt] [unmnt_only] [require_selinux] [gen_hash] [ignore_config_error] [ignore_instance_parent_mode] [unmount_on_close] [use_current_context] [use_default_context] [mount_private]
 .SH "DESCRIPTION"
 .PP
 The pam_namespace PAM module sets up a private namespace for a session with polyinstantiated directories\&. A polyinstantiated directory provides a different instance of itself based on user name, or when using SELinux, user name, security context or both\&. If an executable script
-\FC/etc/security/namespace\&.init\F[]
+/etc/security/namespace\&.init
 exists, it is used to initialize the instance directory after it is set up and mounted on the polyinstantiated directory\&. The script receives the polyinstantiated directory path, the instance directory path, flag whether the instance directory was newly created (0 for no, 1 for yes), and the user name as its arguments\&.
 .PP
 The pam_namespace module disassociates the session namespace from the parent namespace\&. Any mounts/unmounts performed in the parent namespace, such as mounting of devices, are not reflected in the session namespace\&. To propagate selected mount/unmount events from the parent namespace into the disassociated session namespace, an administrator may use the special shared\-subtree feature\&. For additional information on shared\-subtree feature, please refer to the mount(8) man page and the shared\-subtree description at http://lwn\&.net/Articles/159077 and http://lwn\&.net/Articles/159092\&.
@@ -217,9 +76,9 @@ If a line in the configuration file corresponding to a polyinstantiated director
 Instance parent directories by default are expected to have the restrictive mode of 000\&. Using this option, an administrator can choose to ignore the mode of the instance parent\&. This option should be used with caution as it will reduce security and isolation goals of the polyinstantiation mechanism\&.
 .RE
 .PP
-\fBno_unmount_on_close\fR
+\fBunmount_on_close\fR
 .RS 4
-For certain trusted programs such as newrole, open session is called from a child process while the parent performs close session and pam end functions\&. For these commands use this option to instruct pam_close_session to not unmount the bind mounted polyinstantiated directory in the parent\&.
+Explicitly unmount the polyinstantiated directories instead of relying on automatic namespace destruction after the last process in a namespace exits\&. This option should be used only in case it is ensured by other means that there cannot be any processes running in the private namespace left after the session close\&. It is also useful only in case there are multiple pam session calls in sequence from the same process\&.
 .RE
 .PP
 \fBuse_current_context\fR
@@ -231,6 +90,15 @@ Useful for services which do not change the SELinux context with setexeccon call
 .RS 4
 Useful for services which do not use pam_selinux for changing the SELinux context with setexeccon call\&. The module will use the default SELinux context of the user for the level and context polyinstantiation\&.
 .RE
+.PP
+\fBmount_private\fR
+.RS 4
+This option can be used on systems where the / mount point or its submounts are made shared (for example with a
+\fBmount \-\-make\-rshared /\fR
+command)\&. The module will mark the whole directory tree so any mount and unmount operations in the polyinstantiation namespace are private\&. Normally the pam_namespace will try to detect the shared / mount point and make the polyinstantiated directories private automatically\&. This option has to be used just when only a subtree is shared and / is not\&.
+.sp
+Note that mounts and unmounts done in the private namespace will not affect the parent namespace if this option is used or when the shared / mount point is autodetected\&.
+.RE
 .SH "MODULE TYPES PROVIDED"
 .PP
 Only the
@@ -254,17 +122,17 @@ Unexpected namespace configuration error occurred\&.
 .RE
 .SH "FILES"
 .PP
-\FC/etc/security/namespace\&.conf\F[]
+/etc/security/namespace\&.conf
 .RS 4
 Main configuration file
 .RE
 .PP
-\FC/etc/security/namespace\&.d\F[]
+/etc/security/namespace\&.d
 .RS 4
 Directory for additional configuration files
 .RE
 .PP
-\FC/etc/security/namespace\&.init\F[]
+/etc/security/namespace\&.init
 .RS 4
 Init script for instance directories
 .RE
@@ -279,24 +147,14 @@ To use polyinstantiation with graphical display manager gdm, insert the followin
 /usr/sbin/gdm\-safe\-restart
 .PP
 This allows gdm to restart after each session and appropriately adjust namespaces of display manager and the X server\&. If polyinstantiation of /tmp is desired along with the graphical environment, then additional configuration changes are needed to address the interaction of X server and font server namespaces with their use of /tmp to create communication sockets\&. Please use the initialization script
-\FC/etc/security/namespace\&.init\F[]
+/etc/security/namespace\&.init
 to ensure that the X server and its clients can appropriately access the communication socket X0\&. Please refer to the sample instructions provided in the comment section of the instance initialization script
-\FC/etc/security/namespace\&.init\F[]\&. In addition, perform the following changes to use graphical environment with polyinstantiation of /tmp:
+/etc/security/namespace\&.init\&. In addition, perform the following changes to use graphical environment with polyinstantiation of /tmp:
 .PP
-
-.sp
 .if n \{\
 .RS 4
 .\}
-.fam C
-.ps -1
 .nf
-.if t \{\
-.sp -1
-.\}
-.BB lightgray adjust-for-leading-newline
-.sp -1
-
       1\&. Disable the use of font server by commenting out "FontPath"
          line in /etc/X11/xorg\&.conf\&. If you do want to use the font server
          then you will have to augment the instance initialization
@@ -310,20 +168,13 @@ to ensure that the X server and its clients can appropriately access the communi
          "AlwaysRestartServer=true", and it is not overridden by
          /etc/gdm/custom\&.conf\&.
     
-.EB lightgray adjust-for-leading-newline
-.if t \{\
-.sp 1
-.\}
 .fi
-.fam
-.ps +1
 .if n \{\
 .RE
 .\}
 .sp
 .SH "SEE ALSO"
 .PP
-
 \fBnamespace.conf\fR(5),
 \fBpam.d\fR(5),
 \fBmount\fR(8),
diff --git a/modules/pam_namespace/pam_namespace.8.xml b/modules/pam_namespace/pam_namespace.8.xml
index 48021c80..f0f80d33 100644
--- a/modules/pam_namespace/pam_namespace.8.xml
+++ b/modules/pam_namespace/pam_namespace.8.xml
@@ -44,7 +44,7 @@
         ignore_instance_parent_mode
       </arg>
       <arg choice="opt">
-        no_unmount_on_close
+        unmount_on_close
       </arg>
       <arg choice="opt">
         use_current_context
@@ -195,16 +195,17 @@
 
       <varlistentry>
         <term>
-          <option>no_unmount_on_close</option>
+          <option>unmount_on_close</option>
         </term>
         <listitem>
           <para>
-           For certain trusted programs such as newrole, open session
-           is called from a child process while the parent performs
-           close session and pam end functions. For these commands
-           use this option to instruct pam_close_session to not
-           unmount the bind mounted polyinstantiated directory in the
-            parent.
+           Explicitly unmount the polyinstantiated directories instead
+           of relying on automatic namespace destruction after the last
+           process in a namespace exits. This option should be used
+           only in case it is ensured by other means that there cannot be
+           any processes running in the private namespace left after the
+           session close. It is also useful only in case there are
+           multiple pam session calls in sequence from the same process.
           </para>
         </listitem>
       </varlistentry>
@@ -246,12 +247,18 @@
 	    This option can be used on systems where the / mount point or
 	    its submounts are made shared (for example with a
 	    <command>mount --make-rshared /</command> command).
-	    The module will make the polyinstantiated directory mount points
-	    private. Normally the pam_namespace will try to detect the
+	    The module will mark the whole directory tree so any mount and
+	    unmount operations in the polyinstantiation namespace are private.
+	    Normally the pam_namespace will try to detect the
 	    shared / mount point and make the polyinstantiated directories
 	    private automatically. This option has to be used just when
 	    only a subtree is shared and / is not.
           </para>
+          <para>
+	    Note that mounts and unmounts done in the private namespace will not
+	    affect the parent namespace if this option is used or when the
+	    shared / mount point is autodetected.
+          </para>
         </listitem>
       </varlistentry>
 
diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
index 4a99184a..e0d5e30b 100644
--- a/modules/pam_namespace/pam_namespace.c
+++ b/modules/pam_namespace/pam_namespace.c
@@ -64,6 +64,7 @@ static void del_polydir(struct polydir_s *poly)
 	if (poly) {
 		free(poly->uid);
 		free(poly->init_script);
+		free(poly->mount_opts);
 		free(poly);
 	}
 }
@@ -76,7 +77,7 @@ static void del_polydir_list(struct polydir_s *polydirs_ptr)
         struct polydir_s *dptr = polydirs_ptr;
 
 	while (dptr) {
-        	struct polydir_s *tptr = dptr;
+		struct polydir_s *tptr = dptr;
 		dptr = dptr->next;
 		del_polydir(tptr);
 	}
@@ -163,9 +164,9 @@ static int parse_create_params(char *params, struct polydir_s *poly)
     poly->group = (gid_t)ULONG_MAX;
 
     if (*params != '=')
-    	return 0;
+	return 0;
     params++;
-    
+
     next = strchr(params, ',');
     if (next != NULL) {
 	*next = '\0';
@@ -182,7 +183,7 @@ static int parse_create_params(char *params, struct polydir_s *poly)
 
     params = next;
     if (params == NULL)
-    	return 0;
+	return 0;
     next = strchr(params, ',');
     if (next != NULL) {
 	*next = '\0';
@@ -200,22 +201,22 @@ static int parse_create_params(char *params, struct polydir_s *poly)
     if (params == NULL || *params == '\0') {
 	if (pwd != NULL)
 	    poly->group = pwd->pw_gid;
-    	return 0;
+	return 0;
     }
     grp = getgrnam(params);
     if (grp == NULL)
-    	return -1;
+	return -1;
     poly->group = grp->gr_gid;
-    
+
     return 0;
 }
 
 static int parse_iscript_params(char *params, struct polydir_s *poly)
 {
     if (*params != '=')
-    	return 0;
+	return 0;
     params++;
-    
+
     if (*params != '\0') {
 	if (*params != '/') { /* path is relative to NAMESPACE_D_DIR */
 		if (asprintf(&poly->init_script, "%s%s", NAMESPACE_D_DIR, params) == -1)
@@ -235,11 +236,11 @@ static int parse_method(char *method, struct polydir_s *poly,
     enum polymethod pm;
     char *sptr = NULL;
     static const char *method_names[] = { "user", "context", "level", "tmpdir",
-    	"tmpfs", NULL };
+	"tmpfs", NULL };
     static const char *flag_names[] = { "create", "noinit", "iscript",
-    	"shared", NULL };
+	"shared", "mntopts", NULL };
     static const unsigned int flag_values[] = { POLYDIR_CREATE, POLYDIR_NOINIT,
-    	POLYDIR_ISCRIPT, POLYDIR_SHARED };
+	POLYDIR_ISCRIPT, POLYDIR_SHARED, POLYDIR_MNTOPTS };
     int i;
     char *flag;
 
@@ -247,41 +248,55 @@ static int parse_method(char *method, struct polydir_s *poly,
     pm = NONE;
 
     for (i = 0; method_names[i]; i++) {
-    	if (strcmp(method, method_names[i]) == 0) {
-    		pm = i + 1; /* 0 = NONE */
-    	}
+	if (strcmp(method, method_names[i]) == 0) {
+		pm = i + 1; /* 0 = NONE */
+	}
     }
 
     if (pm == NONE) {
         pam_syslog(idata->pamh, LOG_NOTICE, "Unknown method");
         return -1;
     }
-    
+
     poly->method = pm;
-    
+
     while ((flag=strtok_r(NULL, ":", &sptr)) != NULL) {
-    	for (i = 0; flag_names[i]; i++) {
-    		int namelen = strlen(flag_names[i]);
-
-    		if (strncmp(flag, flag_names[i], namelen) == 0) {
-    			poly->flags |= flag_values[i];
-    			switch (flag_values[i]) {
-    			    case POLYDIR_CREATE:
-    			    	if (parse_create_params(flag+namelen, poly) != 0) {
+	for (i = 0; flag_names[i]; i++) {
+		int namelen = strlen(flag_names[i]);
+
+		if (strncmp(flag, flag_names[i], namelen) == 0) {
+			poly->flags |= flag_values[i];
+			switch (flag_values[i]) {
+			    case POLYDIR_CREATE:
+				if (parse_create_params(flag+namelen, poly) != 0) {
 				        pam_syslog(idata->pamh, LOG_CRIT, "Invalid create parameters");
-    			    		return -1;
-    			    	}
-    			    	break;
+					return -1;
+				}
+				break;
 
-    			    case POLYDIR_ISCRIPT:
-    			    	if (parse_iscript_params(flag+namelen, poly) != 0) {
+			    case POLYDIR_ISCRIPT:
+				if (parse_iscript_params(flag+namelen, poly) != 0) {
 				        pam_syslog(idata->pamh, LOG_CRIT, "Memory allocation error");
-    			    		return -1;
-    			    	};
-    			    	break;
-    			}
-    		}
-    	}
+					return -1;
+				};
+				break;
+
+			    case POLYDIR_MNTOPTS:
+				if (flag[namelen] != '=')
+					break;
+				if (poly->method != TMPFS) {
+					pam_syslog(idata->pamh, LOG_WARNING, "Mount options applicable only to tmpfs method");
+					break;
+				}
+				free(poly->mount_opts); /* if duplicate mntopts specified */
+				if ((poly->mount_opts = strdup(flag+namelen+1)) == NULL) {
+					pam_syslog(idata->pamh, LOG_CRIT, "Memory allocation error");
+					return -1;
+				}
+				break;
+			}
+		}
+	}
     }
 
     return 0;
@@ -337,7 +352,7 @@ static int process_line(char *line, const char *home, const char *rhome,
 
     poly = calloc(1, sizeof(*poly));
     if (poly == NULL)
-    	goto erralloc;
+	goto erralloc;
 
     /*
      * Initialize and scan the five strings from the line from the
@@ -383,12 +398,12 @@ static int process_line(char *line, const char *home, const char *rhome,
 	    dir = NULL;
 	    goto erralloc;
     }
-    
+
     if ((dir=expand_variables(dir, var_names, var_values)) == NULL) {
 	    instance_prefix = NULL;
 	    goto erralloc;
     }
-    
+
     if ((instance_prefix=expand_variables(instance_prefix, var_names, var_values))
 	    == NULL) {
 	    goto erralloc;
@@ -409,12 +424,12 @@ static int process_line(char *line, const char *home, const char *rhome,
     if (len > 0 && rdir[len-1] == '/') {
 	    rdir[len-1] = '\0';
     }
-    
+
     if (dir[0] == '\0' || rdir[0] == '\0') {
-    	    pam_syslog(idata->pamh, LOG_NOTICE, "Invalid polydir");
-    	    goto skipping;
+	    pam_syslog(idata->pamh, LOG_NOTICE, "Invalid polydir");
+	    goto skipping;
     }
-    
+
     /*
      * Populate polyinstantiated directory structure with appropriate
      * pathnames and the method with which to polyinstantiate.
@@ -430,14 +445,14 @@ static int process_line(char *line, const char *home, const char *rhome,
     strcpy(poly->instance_prefix, instance_prefix);
 
     if (parse_method(method, poly, idata) != 0) {
-    	    goto skipping;
+	    goto skipping;
     }
 
     if (poly->method == TMPDIR) {
-    	if (sizeof(poly->instance_prefix) - strlen(poly->instance_prefix) < 7) {
-    		pam_syslog(idata->pamh, LOG_NOTICE, "Pathnames too long");
-    		goto skipping;
-    	}
+	if (sizeof(poly->instance_prefix) - strlen(poly->instance_prefix) < 7) {
+		pam_syslog(idata->pamh, LOG_NOTICE, "Pathnames too long");
+		goto skipping;
+	}
 	strcat(poly->instance_prefix, "XXXXXX");
     }
 
@@ -463,7 +478,7 @@ static int process_line(char *line, const char *home, const char *rhome,
         uid_t *uidptr;
         const char *ustr, *sstr;
         int count, i;
-	
+
 	if (*uids == '~') {
 		poly->flags |= POLYDIR_EXCLUSIVE;
 		uids++;
@@ -488,8 +503,8 @@ static int process_line(char *line, const char *home, const char *rhome,
 
             pwd = pam_modutil_getpwnam(idata->pamh, ustr);
             if (pwd == NULL) {
-        	pam_syslog(idata->pamh, LOG_ERR, "Unknown user %s in configuration", ustr);
-        	poly->num_uids--;
+		pam_syslog(idata->pamh, LOG_ERR, "Unknown user %s in configuration", ustr);
+		poly->num_uids--;
             } else {
                 *uidptr = pwd->pw_uid;
                 uidptr++;
@@ -508,7 +523,7 @@ static int process_line(char *line, const char *home, const char *rhome,
 
 erralloc:
     pam_syslog(idata->pamh, LOG_CRIT, "Memory allocation error");
-    
+
 skipping:
     if (idata->flags & PAMNS_IGN_CONFIG_ERR)
         retval = 0;
@@ -554,9 +569,9 @@ static int parse_config_file(struct instance_data *idata)
         return PAM_SESSION_ERR;
     }
     if ((home=strdup(cpwd->pw_dir)) == NULL) {
-    	pam_syslog(idata->pamh, LOG_CRIT,
-    		"Memory allocation error");
-    	return PAM_SESSION_ERR;
+	pam_syslog(idata->pamh, LOG_CRIT,
+		"Memory allocation error");
+	return PAM_SESSION_ERR;
     }
 
     cpwd = pam_modutil_getpwnam(idata->pamh, idata->ruser);
@@ -568,10 +583,10 @@ static int parse_config_file(struct instance_data *idata)
     }
 
     if ((rhome=strdup(cpwd->pw_dir)) == NULL) {
-    	pam_syslog(idata->pamh, LOG_CRIT,
-    		"Memory allocation error");
-    	free(home);
-    	return PAM_SESSION_ERR;
+	pam_syslog(idata->pamh, LOG_CRIT,
+		"Memory allocation error");
+	free(home);
+	return PAM_SESSION_ERR;
     }
 
     /*
@@ -594,7 +609,7 @@ static int parse_config_file(struct instance_data *idata)
 	fil = fopen(confname, "r");
 	if (fil == NULL) {
 	    pam_syslog(idata->pamh, LOG_ERR, "Error opening config file %s",
-		confname);	    
+		confname);
             globfree(&globbuf);
 	    free(rhome);
 	    free(home);
@@ -625,14 +640,14 @@ static int parse_config_file(struct instance_data *idata)
 	if (n >= globbuf.gl_pathc)
 	    break;
 
-	confname = globbuf.gl_pathv[n];	
+	confname = globbuf.gl_pathv[n];
 	n++;
     }
-    
+
     globfree(&globbuf);
     free(rhome);
     free(home);
-    
+
     /* All done...just some debug stuff */
     if (idata->flags & PAMNS_DEBUG) {
         struct polydir_s *dptr = idata->polydirs_ptr;
@@ -640,7 +655,7 @@ static int parse_config_file(struct instance_data *idata)
         uid_t i;
 
         pam_syslog(idata->pamh, LOG_DEBUG,
-    	    dptr?"Configured poly dirs:":"No configured poly dirs");
+	    dptr?"Configured poly dirs:":"No configured poly dirs");
         while (dptr) {
             pam_syslog(idata->pamh, LOG_DEBUG, "dir='%s' iprefix='%s' meth=%d",
 		   dptr->dir, dptr->instance_prefix, dptr->method);
@@ -667,7 +682,7 @@ static int ns_override(struct polydir_s *polyptr, struct instance_data *idata,
     unsigned int i;
 
     if (idata->flags & PAMNS_DEBUG)
-    	pam_syslog(idata->pamh, LOG_DEBUG,
+	pam_syslog(idata->pamh, LOG_DEBUG,
 		"Checking for ns override in dir %s for uid %d",
 		polyptr->dir, uid);
 
@@ -745,7 +760,7 @@ static int form_context(const struct polydir_s *polyptr,
 		rc = getexeccon(&scon);
 	}
 	if (rc < 0 || scon == NULL) {
-		pam_syslog(idata->pamh, LOG_ERR, 
+		pam_syslog(idata->pamh, LOG_ERR,
 			   "Error getting exec context, %m");
 		return PAM_SESSION_ERR;
 	}
@@ -870,17 +885,17 @@ static int poly_name(const struct polydir_s *polyptr, char **i_name,
 	}
         pm = USER;
     }
-    
+
     switch (pm) {
         case USER:
 	    if (asprintf(i_name, "%s", idata->user) < 0) {
 		*i_name = NULL;
 		goto fail;
-	    }	    
-    	    break;
+	    }
+	    break;
 
 #ifdef WITH_SELINUX
-    	case LEVEL:
+	case LEVEL:
         case CONTEXT:
 	    if (selinux_trans_to_raw_context(*i_context, &rawcon) < 0) {
 		pam_syslog(idata->pamh, LOG_ERR, "Error translating directory context");
@@ -890,27 +905,27 @@ static int poly_name(const struct polydir_s *polyptr, char **i_name,
 		if (asprintf(i_name, "%s", rawcon) < 0) {
 			*i_name = NULL;
 			goto fail;
-	   	}
+		}
 	    } else {
 		if (asprintf(i_name, "%s_%s", rawcon, idata->user) < 0) {
 			*i_name = NULL;
 			goto fail;
-	   	}
+		}
 	    }
-    	    break;
+	    break;
 
 #endif /* WITH_SELINUX */
 
 	case TMPDIR:
 	case TMPFS:
 	    if ((*i_name=strdup("")) == NULL)
-	    	goto fail;
+		goto fail;
 	    return PAM_SUCCESS;
 
-    	default:
-    	    if (idata->flags & PAMNS_DEBUG)
-    	        pam_syslog(idata->pamh, LOG_ERR, "Unknown method");
-    	    goto fail;
+	default:
+	    if (idata->flags & PAMNS_DEBUG)
+	        pam_syslog(idata->pamh, LOG_ERR, "Unknown method");
+	    goto fail;
     }
 
     if (idata->flags & PAMNS_DEBUG)
@@ -919,24 +934,24 @@ static int poly_name(const struct polydir_s *polyptr, char **i_name,
     if ((idata->flags & PAMNS_GEN_HASH) || strlen(*i_name) > NAMESPACE_MAX_DIR_LEN) {
         hash = md5hash(*i_name, idata);
         if (hash == NULL) {
-    	    goto fail;
+	    goto fail;
         }
         if (idata->flags & PAMNS_GEN_HASH) {
-    	    free(*i_name);
+	    free(*i_name);
 	    *i_name = hash;
 	    hash = NULL;
         } else {
-    	    char *newname;
-    	    if (asprintf(&newname, "%.*s_%s", NAMESPACE_MAX_DIR_LEN-1-(int)strlen(hash),
-    		*i_name, hash) < 0) {
-    		goto fail;
-    	    }
-    	    free(*i_name);
-    	    *i_name = newname;
+	    char *newname;
+	    if (asprintf(&newname, "%.*s_%s", NAMESPACE_MAX_DIR_LEN-1-(int)strlen(hash),
+		*i_name, hash) < 0) {
+		goto fail;
+	    }
+	    free(*i_name);
+	    *i_name = newname;
         }
     }
     rc = PAM_SUCCESS;
-    
+
 fail:
     free(hash);
 #ifdef WITH_SELINUX
@@ -959,34 +974,34 @@ static int protect_mount(int dfd, const char *path, struct instance_data *idata)
 {
 	struct protect_dir_s *dir = idata->protect_dirs;
 	char tmpbuf[64];
-	
+
 	while (dir != NULL) {
 		if (strcmp(path, dir->dir) == 0) {
 			return 0;
 		}
 		dir = dir->next;
 	}
-	
+
 	dir = calloc(1, sizeof(*dir));
-	
+
 	if (dir == NULL) {
 		return -1;
 	}
-	
+
 	dir->dir = strdup(path);
-	
+
 	if (dir->dir == NULL) {
 		free(dir);
 		return -1;
 	}
-	
+
 	snprintf(tmpbuf, sizeof(tmpbuf), "/proc/self/fd/%d", dfd);
-	
+
 	if (idata->flags & PAMNS_DEBUG) {
 		pam_syslog(idata->pamh, LOG_INFO,
 			"Protect mount of %s over itself", path);
 	}
-	
+
 	if (mount(tmpbuf, tmpbuf, NULL, MS_BIND, NULL) != 0) {
 		int save_errno = errno;
 		pam_syslog(idata->pamh, LOG_ERR,
@@ -996,14 +1011,14 @@ static int protect_mount(int dfd, const char *path, struct instance_data *idata)
 		errno = save_errno;
 		return -1;
 	}
-	
+
 	dir->next = idata->protect_dirs;
 	idata->protect_dirs = dir;
 
 	return 0;
 }
 
-static int protect_dir(const char *path, mode_t mode, int do_mkdir, int always,
+static int protect_dir(const char *path, mode_t mode, int do_mkdir,
 	struct instance_data *idata)
 {
 	char *p = strdup(path);
@@ -1019,15 +1034,15 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, int always,
 	if (p == NULL) {
 		goto error;
 	}
-	
+
 	if (*dir == '/') {
 		dfd = open("/", flags);
 		if (dfd == -1) {
 			goto error;
 		}
-		dir++; 	/* assume / is safe */
+		dir++;	/* assume / is safe */
 	}
-	
+
 	while ((d=strchr(dir, '/')) != NULL) {
 		*d = '\0';
 		dfd_next = openat(dfd, dir, flags);
@@ -1042,8 +1057,8 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, int always,
 		if (fstat(dfd, &st) != 0) {
 			goto error;
 		}
-		
-		if (flags & O_NOFOLLOW) { 
+
+		if (flags & O_NOFOLLOW) {
 			/* we are inside user-owned dir - protect */
 			if (protect_mount(dfd, p, idata) == -1)
 				goto error;
@@ -1058,14 +1073,14 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, int always,
 	}
 
 	rv = openat(dfd, dir, flags);
-	
+
 	if (rv == -1) {
 		if (!do_mkdir || mkdirat(dfd, dir, mode) != 0) {
 			goto error;
 		}
 		rv = openat(dfd, dir, flags);
 	}
-	
+
 	if (rv != -1) {
 		if (fstat(rv, &st) != 0) {
 			save_errno = errno;
@@ -1082,7 +1097,7 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, int always,
 		}
 	}
 
-	if ((flags & O_NOFOLLOW) || always) { 
+	if (flags & O_NOFOLLOW) {
 		/* we are inside user-owned dir - protect */
 		if (protect_mount(rv, p, idata) == -1) {
 			save_errno = errno;
@@ -1124,7 +1139,7 @@ static int check_inst_parent(char *ipath, struct instance_data *idata)
 	if (trailing_slash)
 		*trailing_slash = '\0';
 
-	dfd = protect_dir(inst_parent, 0, 1, 0, idata);
+	dfd = protect_dir(inst_parent, 0, 1, idata);
 
 	if (dfd == -1 || fstat(dfd, &instpbuf) < 0) {
 		pam_syslog(idata->pamh, LOG_ERR,
@@ -1251,7 +1266,7 @@ static int create_polydir(struct polydir_s *polyptr,
 		pam_syslog(idata->pamh, LOG_DEBUG,
                        "Polydir %s context: %s", dir, (char *)dircon);
 	    if (setfscreatecon(dircon) != 0)
-            	pam_syslog(idata->pamh, LOG_NOTICE,
+		pam_syslog(idata->pamh, LOG_NOTICE,
                        "Error setting context for directory %s: %m", dir);
 	    freecon(dircon);
         }
@@ -1259,7 +1274,7 @@ static int create_polydir(struct polydir_s *polyptr,
     }
 #endif
 
-    rc = protect_dir(dir, mode, 1, idata->flags & PAMNS_MOUNT_PRIVATE, idata);
+    rc = protect_dir(dir, mode, 1, idata);
     if (rc == -1) {
             pam_syslog(idata->pamh, LOG_ERR,
                        "Error creating directory %s: %m", dir);
@@ -1279,15 +1294,15 @@ static int create_polydir(struct polydir_s *polyptr,
             pam_syslog(idata->pamh, LOG_DEBUG, "Created polydir %s", dir);
 
     if (polyptr->mode != (mode_t)ULONG_MAX) {
-    	/* explicit mode requested */
-    	if (fchmod(rc, mode) != 0) {
+	/* explicit mode requested */
+	if (fchmod(rc, mode) != 0) {
 		pam_syslog(idata->pamh, LOG_ERR,
-                    	"Error changing mode of directory %s: %m", dir);
+			   "Error changing mode of directory %s: %m", dir);
                 close(rc);
                 umount(dir); /* undo the eventual protection bind mount */
-    		rmdir(dir);
-        	return PAM_SESSION_ERR;
-    	}
+		rmdir(dir);
+		return PAM_SESSION_ERR;
+	}
     }
 
     if (polyptr->owner != (uid_t)ULONG_MAX)
@@ -1345,14 +1360,14 @@ static int create_instance(struct polydir_s *polyptr, char *ipath, struct stat *
      * attributes to match that of the original directory that is being
      * polyinstantiated.
      */
-    
+
     if (polyptr->method == TMPDIR) {
-    	if (mkdtemp(polyptr->instance_prefix) == NULL) {
+	if (mkdtemp(polyptr->instance_prefix) == NULL) {
             pam_syslog(idata->pamh, LOG_ERR, "Error creating temporary instance %s, %m",
 			polyptr->instance_prefix);
 	    polyptr->method = NONE; /* do not clean up! */
 	    return PAM_SESSION_ERR;
-    	}
+	}
 	/* copy the actual directory name to ipath */
 	strcpy(ipath, polyptr->instance_prefix);
     } else if (mkdir(ipath, S_IRUSR) < 0) {
@@ -1447,26 +1462,26 @@ static int ns_setup(struct polydir_s *polyptr,
         pam_syslog(idata->pamh, LOG_DEBUG,
                "Set namespace for directory %s", polyptr->dir);
 
-    retval = protect_dir(polyptr->dir, 0, 0, idata->flags & PAMNS_MOUNT_PRIVATE, idata);
+    retval = protect_dir(polyptr->dir, 0, 0, idata);
 
     if (retval < 0 && errno != ENOENT) {
 	pam_syslog(idata->pamh, LOG_ERR, "Polydir %s access error: %m",
 		polyptr->dir);
-	return PAM_SESSION_ERR;    
+	return PAM_SESSION_ERR;
     }
 
     if (retval < 0) {
- 	if ((polyptr->flags & POLYDIR_CREATE) &&
+	if ((polyptr->flags & POLYDIR_CREATE) &&
 		create_polydir(polyptr, idata) != PAM_SUCCESS)
 		return PAM_SESSION_ERR;
     } else {
-    	close(retval);
+	close(retval);
     }
-    
+
     if (polyptr->method == TMPFS) {
-	if (mount("tmpfs", polyptr->dir, "tmpfs", 0, NULL) < 0) {
+	if (mount("tmpfs", polyptr->dir, "tmpfs", 0, polyptr->mount_opts) < 0) {
 	    pam_syslog(idata->pamh, LOG_ERR, "Error mounting tmpfs on %s, %m",
-        	polyptr->dir);
+		polyptr->dir);
             return PAM_SESSION_ERR;
 	}
 
@@ -1481,7 +1496,7 @@ static int ns_setup(struct polydir_s *polyptr,
 		polyptr->dir);
         return PAM_SESSION_ERR;
     }
- 
+
     /*
      * Obtain the name of instance pathname based on the
      * polyinstantiation method and instance context returned by
@@ -1495,8 +1510,8 @@ static int ns_setup(struct polydir_s *polyptr,
 #endif
 
     if (retval != PAM_SUCCESS) {
-    	if (retval != PAM_IGNORE)
-        	pam_syslog(idata->pamh, LOG_ERR, "Error getting instance name");
+	if (retval != PAM_IGNORE)
+		pam_syslog(idata->pamh, LOG_ERR, "Error getting instance name");
         goto cleanup;
     } else {
 #ifdef WITH_SELINUX
@@ -1526,30 +1541,14 @@ static int ns_setup(struct polydir_s *polyptr,
 #endif
 
     if (retval == PAM_IGNORE) {
-    	newdir = 0;
-    	retval = PAM_SUCCESS;
+	newdir = 0;
+	retval = PAM_SUCCESS;
     }
 
     if (retval != PAM_SUCCESS) {
         goto error_out;
     }
 
-    if (idata->flags & PAMNS_MOUNT_PRIVATE) {
-        /*
-         * Make the polyinstantiated dir private mount. This depends
-         * on making the dir a mount point in the protect_dir call.
-         */
-        if (mount(polyptr->dir, polyptr->dir, NULL, MS_PRIVATE|MS_REC, NULL) < 0) {
-            pam_syslog(idata->pamh, LOG_ERR, "Error making %s a private mount, %m",
-                       polyptr->dir);
-            goto error_out;
-        }
-        if (idata->flags & PAMNS_DEBUG)
-            pam_syslog(idata->pamh, LOG_DEBUG,
-                      "Polyinstantiated directory %s made as private mount", polyptr->dir);
-
-    }
-
     /*
      * Bind mount instance directory on top of the polyinstantiated
      * directory to provide an instance of polyinstantiated directory
@@ -1647,7 +1646,7 @@ static int cleanup_tmpdirs(struct instance_data *idata)
 		}
 		if (!WIFEXITED(status) || WIFSIGNALED(status) > 0) {
 		    pam_syslog(idata->pamh, LOG_ERR,
-		    	"Error removing %s", pptr->instance_prefix);
+			"Error removing %s", pptr->instance_prefix);
 		}
 	    } else if (pid < 0) {
 		pam_syslog(idata->pamh, LOG_ERR,
@@ -1686,14 +1685,14 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt)
      */
     for (pptr = idata->polydirs_ptr; pptr; pptr = pptr->next) {
         if (ns_override(pptr, idata, idata->uid)) {
-    	    if (unmnt == NO_UNMNT || ns_override(pptr, idata, idata->ruid)) {
-        	if (idata->flags & PAMNS_DEBUG)
-        	    pam_syslog(idata->pamh, LOG_DEBUG,
+	    if (unmnt == NO_UNMNT || ns_override(pptr, idata, idata->ruid)) {
+		if (idata->flags & PAMNS_DEBUG)
+		    pam_syslog(idata->pamh, LOG_DEBUG,
 			"Overriding poly for user %d for dir %s",
 			idata->uid, pptr->dir);
 	    } else {
-        	if (idata->flags & PAMNS_DEBUG)
-            	    pam_syslog(idata->pamh, LOG_DEBUG,
+		if (idata->flags & PAMNS_DEBUG)
+		    pam_syslog(idata->pamh, LOG_DEBUG,
 			"Need unmount ns for user %d for dir %s",
 			idata->ruid, pptr->dir);
 		need_poly = 1;
@@ -1720,8 +1719,22 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt)
 		"Unable to unshare from parent namespace, %m");
             return PAM_SESSION_ERR;
         }
+	if (idata->flags & PAMNS_MOUNT_PRIVATE) {
+	    /*
+	     * Remount / as SLAVE so that nothing mounted in the namespace
+	     * shows up in the parent
+	     */
+	    if (mount("/", "/", NULL, MS_SLAVE | MS_REC , NULL) < 0) {
+		pam_syslog(idata->pamh, LOG_ERR,
+			"Failed to mark / as a slave mount point, %m");
+		return PAM_SESSION_ERR;
+	    }
+	    if (idata->flags & PAMNS_DEBUG)
+		pam_syslog(idata->pamh, LOG_DEBUG,
+			"The / mount point was marked as slave");
+	}
     } else {
-    	del_polydir_list(idata->polydirs_ptr);
+	del_polydir_list(idata->polydirs_ptr);
         return PAM_SUCCESS;
     }
 
@@ -1768,12 +1781,12 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt)
                      * are available from
                      */
                     strcpy(poly_parent, pptr->rdir);
-    	            fptr = strchr(poly_parent, '/');
-        	    cptr = strrchr(poly_parent, '/');
-        	    if (fptr && cptr && (fptr == cptr))
-        	        strcpy(poly_parent, "/");
-        	    else if (cptr)
-        	        *cptr = '\0';
+		    fptr = strchr(poly_parent, '/');
+		    cptr = strrchr(poly_parent, '/');
+		    if (fptr && cptr && (fptr == cptr))
+			strcpy(poly_parent, "/");
+		    else if (cptr)
+			*cptr = '\0';
                     if (chdir(poly_parent) < 0) {
                         pam_syslog(idata->pamh, LOG_ERR,
 				"Can't chdir to %s, %m", poly_parent);
@@ -1781,12 +1794,12 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt)
                 }
 
                 if (umount(pptr->rdir) < 0) {
-            	    int saved_errno = errno;
-            	    pam_syslog(idata->pamh, LOG_ERR, "Unmount of %s failed, %m",
-                    	pptr->rdir);
-            	    if (saved_errno != EINVAL) {
-                	retval = PAM_SESSION_ERR;
-                	goto out;
+		    int saved_errno = errno;
+		    pam_syslog(idata->pamh, LOG_ERR, "Unmount of %s failed, %m",
+			pptr->rdir);
+		    if (saved_errno != EINVAL) {
+			retval = PAM_SESSION_ERR;
+			goto out;
                     }
                 } else if (idata->flags & PAMNS_DEBUG)
                     pam_syslog(idata->pamh, LOG_DEBUG, "Umount succeeded %s",
@@ -1803,20 +1816,20 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt)
     }
 out:
     if (retval != PAM_SUCCESS) {
-    	cleanup_tmpdirs(idata);
-    	unprotect_dirs(idata->protect_dirs);
+	cleanup_tmpdirs(idata);
+	unprotect_dirs(idata->protect_dirs);
     } else if (pam_set_data(idata->pamh, NAMESPACE_PROTECT_DATA, idata->protect_dirs,
-    		cleanup_protect_data) != PAM_SUCCESS) {
+		cleanup_protect_data) != PAM_SUCCESS) {
 	pam_syslog(idata->pamh, LOG_ERR, "Unable to set namespace protect data");
-    	cleanup_tmpdirs(idata);
-    	unprotect_dirs(idata->protect_dirs);
+	cleanup_tmpdirs(idata);
+	unprotect_dirs(idata->protect_dirs);
 	return PAM_SYSTEM_ERR;
     } else if (pam_set_data(idata->pamh, NAMESPACE_POLYDIR_DATA, idata->polydirs_ptr,
-    		cleanup_polydir_data) != PAM_SUCCESS) {
+		cleanup_polydir_data) != PAM_SUCCESS) {
 	pam_syslog(idata->pamh, LOG_ERR, "Unable to set namespace polydir data");
-    	cleanup_tmpdirs(idata);
-    	pam_set_data(idata->pamh, NAMESPACE_PROTECT_DATA, NULL, NULL);
-    	idata->protect_dirs = NULL;
+	cleanup_tmpdirs(idata);
+	pam_set_data(idata->pamh, NAMESPACE_PROTECT_DATA, NULL, NULL);
+	idata->protect_dirs = NULL;
 	return PAM_SYSTEM_ERR;
     }
     return retval;
@@ -1943,7 +1956,7 @@ static int get_user_data(struct instance_data *idata)
     int retval;
     char *user_name;
     struct passwd *pwd;
-    /* 
+    /*
      * Lookup user and fill struct items
      */
     retval = pam_get_item(idata->pamh, PAM_USER, (void*) &user_name );
@@ -1969,10 +1982,10 @@ static int get_user_data(struct instance_data *idata)
     /* Fill in RUSER too */
     retval = pam_get_item(idata->pamh, PAM_RUSER, (void*) &user_name );
     if ( user_name != NULL && retval == PAM_SUCCESS && user_name[0] != '\0' ) {
-    	strncat(idata->ruser, user_name, sizeof(idata->ruser) - 1);
-    	pwd = pam_modutil_getpwnam(idata->pamh, user_name);
+	strncat(idata->ruser, user_name, sizeof(idata->ruser) - 1);
+	pwd = pam_modutil_getpwnam(idata->pamh, user_name);
     } else {
-    	pwd = pam_modutil_getpwuid(idata->pamh, getuid());
+	pwd = pam_modutil_getpwuid(idata->pamh, getuid());
     }
     if (!pwd) {
 	pam_syslog(idata->pamh, LOG_ERR, "user unknown '%s'", user_name);
@@ -2005,7 +2018,7 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED,
 #ifdef WITH_SELINUX
     if (is_selinux_enabled())
         idata.flags |= PAMNS_SELINUX_ENABLED;
-    if (ctxt_based_inst_needed()) 
+    if (ctxt_based_inst_needed())
         idata.flags |= PAMNS_CTXT_BASED_INST;
 #endif
 
@@ -2036,7 +2049,7 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED,
             unmnt = UNMNT_ONLY;
 	if (strcmp(argv[i], "require_selinux") == 0) {
 		if (!(idata.flags & PAMNS_SELINUX_ENABLED)) {
-        		pam_syslog(idata.pamh, LOG_ERR,
+			pam_syslog(idata.pamh, LOG_ERR,
 		    "selinux_required option given and selinux is disabled");
 			return PAM_SESSION_ERR;
 		}
@@ -2047,7 +2060,7 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED,
 
     retval = get_user_data(&idata);
     if (retval != PAM_SUCCESS)
-    	return retval;
+	return retval;
 
     if (root_shared()) {
 	idata.flags |= PAMNS_MOUNT_PRIVATE;
@@ -2110,24 +2123,26 @@ PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED,
             idata.flags |= PAMNS_DEBUG;
         if (strcmp(argv[i], "ignore_config_error") == 0)
             idata.flags |= PAMNS_IGN_CONFIG_ERR;
-        if (strcmp(argv[i], "no_unmount_on_close") == 0)
-            idata.flags |= PAMNS_NO_UNMOUNT_ON_CLOSE;
+        if (strcmp(argv[i], "unmount_on_close") == 0)
+            idata.flags |= PAMNS_UNMOUNT_ON_CLOSE;
     }
 
     if (idata.flags & PAMNS_DEBUG)
         pam_syslog(idata.pamh, LOG_DEBUG, "close_session - start");
 
     /*
-     * For certain trusted programs such as newrole, open session
-     * is called from a child process while the parent perfoms
-     * close session and pam end functions. For these commands
-     * pam_close_session should not perform the unmount of the
-     * polyinstantiatied directory because it will result in
-     * undoing of parents polyinstantiatiaion. These commands
-     * will invoke pam_namespace with the "no_unmount_on_close"
-     * argument.
+     * Normally the unmount is implicitly done when the last
+     * process in the private namespace exits.
+     * If it is ensured that there are no child processes left in
+     * the private namespace by other means and if there are
+     * multiple sessions opened and closed sequentially by the
+     * same process, the "unmount_on_close" option might be
+     * used to unmount the polydirs explicitly.
      */
-    if (idata.flags & PAMNS_NO_UNMOUNT_ON_CLOSE) {
+    if (!(idata.flags & PAMNS_UNMOUNT_ON_CLOSE)) {
+	pam_set_data(idata.pamh, NAMESPACE_POLYDIR_DATA, NULL, NULL);
+	pam_set_data(idata.pamh, NAMESPACE_PROTECT_DATA, NULL, NULL);
+
 	if (idata.flags & PAMNS_DEBUG)
 	    pam_syslog(idata.pamh, LOG_DEBUG, "close_session - sucessful");
         return PAM_SUCCESS;
@@ -2135,13 +2150,13 @@ PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED,
 
     retval = get_user_data(&idata);
     if (retval != PAM_SUCCESS)
-    	return retval;
+	return retval;
 
     retval = pam_get_data(idata.pamh, NAMESPACE_POLYDIR_DATA, (const void **)&polyptr);
     if (retval != PAM_SUCCESS || polyptr == NULL)
-    	/* nothing to reset */
-    	return PAM_SUCCESS;
-    	
+	/* nothing to reset */
+	return PAM_SUCCESS;
+
     idata.polydirs_ptr = polyptr;
 
     if (idata.flags & PAMNS_DEBUG)
@@ -2160,7 +2175,7 @@ PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED,
 
     pam_set_data(idata.pamh, NAMESPACE_POLYDIR_DATA, NULL, NULL);
     pam_set_data(idata.pamh, NAMESPACE_PROTECT_DATA, NULL, NULL);
-    
+
     return PAM_SUCCESS;
 }
 
diff --git a/modules/pam_namespace/pam_namespace.h b/modules/pam_namespace/pam_namespace.h
index c49995c0..47ebcc33 100644
--- a/modules/pam_namespace/pam_namespace.h
+++ b/modules/pam_namespace/pam_namespace.h
@@ -1,5 +1,5 @@
 /******************************************************************************
- * A module for Linux-PAM that will set the default namespace after 
+ * A module for Linux-PAM that will set the default namespace after
  * establishing a session via PAM.
  *
  * (C) Copyright IBM Corporation 2005
@@ -81,6 +81,10 @@
 #ifndef MS_PRIVATE
 #define MS_PRIVATE (1<<18)
 #endif
+#ifndef MS_SLAVE
+#define MS_SLAVE (1<<19)
+#endif
+
 
 /*
  * Module defines
@@ -101,7 +105,7 @@
 #define PAMNS_GEN_HASH        0x00002000 /* Generate md5 hash for inst names */
 #define PAMNS_IGN_CONFIG_ERR  0x00004000 /* Ignore format error in conf file */
 #define PAMNS_IGN_INST_PARENT_MODE  0x00008000 /* Ignore instance parent mode */
-#define PAMNS_NO_UNMOUNT_ON_CLOSE  0x00010000 /* no unmount at session close */
+#define PAMNS_UNMOUNT_ON_CLOSE  0x00010000 /* Unmount at session close */
 #define PAMNS_USE_CURRENT_CONTEXT  0x00020000 /* use getcon instead of getexeccon */
 #define PAMNS_USE_DEFAULT_CONTEXT  0x00040000 /* use get_default_context instead of getexeccon */
 #define PAMNS_MOUNT_PRIVATE   0x00080000 /* Make the polydir mounts private */
@@ -112,6 +116,7 @@
 #define POLYDIR_NOINIT        0x00000004 /* no init script */
 #define POLYDIR_SHARED        0x00000008 /* share context/level instances among users */
 #define POLYDIR_ISCRIPT       0x00000010 /* non default init script */
+#define POLYDIR_MNTOPTS       0x00000020 /* mount options for tmpfs mount */
 
 
 #define NAMESPACE_MAX_DIR_LEN 80
@@ -134,9 +139,9 @@ enum polymethod {
 /*
  * Depending on the application using this namespace module, we
  * may need to unmount priviously bind mounted instance directory.
- * Applications such as login and sshd, that establish a new 
+ * Applications such as login and sshd, that establish a new
  * session unmount of instance directory is not needed. For applications
- * such as su and newrole, that switch the identity, this module 
+ * such as su and newrole, that switch the identity, this module
  * has to unmount previous instance directory first and re-mount
  * based on the new indentity. For other trusted applications that
  * just want to undo polyinstantiation, only unmount of previous
@@ -160,6 +165,7 @@ struct polydir_s {
     uid_t *uid;				/* list of override uids */
     unsigned int flags;			/* polydir flags */
     char *init_script;			/* path to init script */
+    char *mount_opts;			/* mount options for tmpfs mount */
     uid_t owner;			/* user which should own the polydir */
     gid_t group;			/* group which should own the polydir */
     mode_t mode;			/* mode of the polydir */
@@ -182,4 +188,3 @@ struct instance_data {
     uid_t ruid;			/* The uid of the requesting user */
     unsigned long flags;	/* Flags for debug, selinux etc */
 };
-