From f6eac02ad1275ced275d48cc8226fa0337a8aedb Mon Sep 17 00:00:00 2001
From: Matthew Haughton <3flex@users.noreply.github.com>
Date: Tue, 12 Aug 2014 21:15:47 -0400
Subject: [PATCH] only run 'update-pam' when needed

TelekomLabs-DCO-1.1-Signed-off-by: Matthew Haughton <matt@3flex.com.au> (github: 3flex)
---
 manifests/pam.pp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/manifests/pam.pp b/manifests/pam.pp
index b2938c3..00468e7 100644
--- a/manifests/pam.pp
+++ b/manifests/pam.pp
@@ -67,6 +67,7 @@
           owner   => root,
           group   => root,
           mode    => '0640',
+          notify  => Exec['update-pam'],
         }
 
       } else {
@@ -75,6 +76,7 @@
         # delete passwdqc file on ubuntu and debian
         file { $passwdqc_path:
           ensure => absent,
+          notify => Exec['update-pam'],
         }
 
         # make sure the package is not on the system,
@@ -98,15 +100,18 @@
           owner   => root,
           group   => root,
           mode    => '0640',
+          notify  => Exec['update-pam'],
         }
       } else {
         file { $tally2_path:
           ensure => absent,
+          notify => Exec['update-pam'],
         }
       }
 
       exec { 'update-pam':
-        command => '/usr/sbin/pam-auth-update --package'
+        command     => '/usr/sbin/pam-auth-update --package',
+        refreshonly => true,
       }
     }