- move setgid before setuid in pam_keyinit (#212329) - make username check in pam_unix consistent with useradd (#212153)