GitLab

This causes KEY and OTP to be read from files.  You can specify the
same filename twice in which case it takes a line from each.  "-"
means stdin.

I have not provided a manpage patch at this stage.  Perhaps someone
else can do that.
Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
Signed-off-by: Simon Josefsson <simon@josefsson.org>

The way this was before allowed for the PAM authentication to
potentially succeed when the first `goto done` line is hit. If the
undefined data behind alwaysok is non-zero (which is quite probable)
this would happen.

In theory a local attacker could try to exhaust memory just enough to
hit this spot and get e.g. root access.
Signed-off-by: Simon Josefsson <simon@josefsson.org>

Fixes https://savannah.nongnu.org/support/?108939

https://bugzilla.redhat.com/show_bug.cgi?id=1129491