pam modules need dynamic 32-bit support and are missing from ia32-libs

libpam-runtime itself doesn't contain any modules

You're right. I was thinking of libpam-modules, but it won't work anyway.

If compiled in a 32 bit environment, pam will look in /lib/security for its modules, and this clearly won't work as the modules it'll find there are 64 bit ones.

then a patch is needed to ask for the personality at runtime and set the directory accordingly.

Please reconsider raising importance of this bug.

It prevents all 32bit software (using PAM) from working!

As a workaround I fixed this by
* copying PAM modules from a 32bit system into /lib32/security
* manually patched/compiled libpam.so (from ia32-libs) to point to /lib32/security instead of /lib/security

Works great, but I would really like to see this officially fixed.

Cheers

This will be fixed with the deployment of multiarch.

Is there a small workaround we can do for Lucid?

Had the same problem yesterday and ended up doing the following:

1. copying PAM modules from a 32bit system into /lib32/security (as per comment #4)
2. editing the config file for the shoftware I wanted to use in /etc/pam.d to use absolute paths to /lib32/security
3. patch the 32bit libpam the hard way:

# cd ~
# cp /lib32/libpam.so.0.81.6 ~/libpam.so.0.81.6.orig
# sed 's/\/lib\/security/\/l32\/security/g' < libpam.so.0.81.6.orig > libpam.so.0.81.6.patched
# sudo cp libpam.so.0.81.6.patched /lib32/libpam.so.0.81.6
# sudo ln -s /lib32 /l32

The workaround provided in the previous comment works splendidly. Unfortunately every update to ia32-libs overwrites libpam.so.0.81.6 with the original unpatched version. While the bug is waiting to be fixed, would it be possible, as a temporary workaround, to rename libpam.so in the ia32-libs package, so that it does not overwrite the file already installed in the system? The file is unusable anyway in the form as it currently exists in ia32-libs.

As of version 1.1.2-2ubuntu4 in natty, libpam now looks in (and installs its own modules to) /lib/$(DEB_HOST_MULTIARCH)/security before /lib/security. This means that it is now possible to correctly install 32-bit and 64-bit pam modules side-by-side on an Ubuntu system.

Note however that the /lib/$(DEB_HOST_MULTIARCH) path is reserved for native packages of that architecture; ia32-libs is NOT allowed to package libpam-modules and ship its contents in /lib/i386-linux-gnu/security. Users who need this can:

 - wait for multiarch support to be ready for use,
 - manually copy the 32-bit modules they need from ia32-libs to the /lib/i386-linux-gnu/security directory, or
 - continue to use one of the workarounds mentioned in this bug.

ia32-libs in precise now pulls in the native i386 packages for everything, including pam modules; considering this fixed now.