Relevant BUGIDs:

Purpose of commit: new feature

Commit summary:
---------------

2006-06-28  Thorsten Kukuk  <kukuk@thkukuk.de>

        * configure.in: Remove checks for sgml* tools.

        * doc/sag: System Administrator Guide as XML source.
        * doc/sag/Makefile.am: New.
        * doc/sag/Linux-PAM_SAG.xml: New, main XML document.
        * doc/sag/pam_*.xml: New, wrapper to include module documentation.

38 files changed, 1858 insertions, 0 deletions

diff --git a/doc/sag/.cvsignore b/doc/sag/.cvsignore
new file mode 100644
index 00000000..b1fe2134
--- /dev/null
+++ b/doc/sag/.cvsignore
@@ -0,0 +1,4 @@
+Makefile
+Makefile.in
+*~
+html
diff --git a/doc/sag/Linux-PAM_SAG.xml b/doc/sag/Linux-PAM_SAG.xml
new file mode 100644
index 00000000..53963fa2
--- /dev/null
+++ b/doc/sag/Linux-PAM_SAG.xml
@@ -0,0 +1,564 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+	"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<book>
+  <bookinfo>
+    <title>The Linux-PAM System Administrators' Guide</title>
+    <authorgroup>
+      <author>
+        <firstname>Andrew G.</firstname>
+        <surname>Morgan</surname>
+        <email>morgan@kernel.org</email>
+      </author>
+      <author>
+        <firstname>Thorsten</firstname>
+        <surname>Kukuk</surname>
+        <email>kukuk@thkukuk.de</email>
+      </author>
+    </authorgroup>
+    <releaseinfo>Version 0.99, 22. June 2006</releaseinfo>
+    <abstract>
+      <para>
+        This manual documents what a system-administrator needs to know about
+        the <emphasis remap='B'>Linux-PAM</emphasis> library. It covers the
+        correct syntax of the PAM configuration file and discusses strategies
+        for maintaining a secure system.
+      </para>
+    </abstract>
+  </bookinfo>
+
+  <chapter id='sag-introductoin'>
+    <title>Introduction</title>
+    <para>
+      <emphasis remap='B'>Linux-PAM</emphasis> (Pluggable Authentication
+      Modules for Linux) is a suite of shared libraries that enable the
+      local system administrator to choose how applications authenticate users.
+    </para>
+    <para>
+      In other words, without (rewriting and) recompiling a PAM-aware
+      application, it is possible to switch between the authentication
+      mechanism(s) it uses. Indeed, one may entirely upgrade the local
+      authentication system without touching the applications themselves.
+    </para>
+    <para>
+      Historically an application that has required a given user to be
+      authenticated, has had to be compiled to use a specific authentication
+      mechanism.  For example, in the case of traditional UN*X systems, the
+      identity of the user is verified by the user entering a correct
+      password.  This password, after being prefixed by a two character
+      ``salt'', is encrypted (with crypt(3)). The user is then authenticated
+      if this encrypted password is identical to the second field of the
+      user's entry in the system password database (the
+      <filename>/etc/passwd</filename> file).  On such systems, most if
+      not all forms of privileges are granted based on this single
+      authentication scheme. Privilege comes in the form of a personal
+      user-identifier (UID) and membership of various groups. Services and
+      applications are available based on the personal and group identity
+      of the user. Traditionally, group membership has been assigned based
+      on entries in the <filename>/etc/group</filename> file.
+    </para>
+    <para>
+      It is the purpose of the <emphasis remap='B'>Linux-PAM</emphasis>
+      project to separate the development of privilege granting software
+      from the development of secure and appropriate authentication schemes.
+      This is accomplished by providing a library of functions that an
+      application may use to request that a user be authenticated. This
+      PAM library is configured locally with a system file,
+      <filename>/etc/pam.conf</filename> (or a series of configuration
+      files located in <filename>/etc/pam.d/</filename>) to authenticate a
+      user request via the locally available authentication modules. The
+      modules themselves will usually be located in the directory
+      <filename>/lib/security</filename> or
+      <filename>/lib64/security</filename> and take the form of dynamically
+      loadable object files (see <citerefentry>
+        <refentrytitle>dlopen</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>).
+    </para>
+  </chapter>
+
+  <chapter id="sag-text-conventions">
+    <title>Some comments on the text</title>
+    <para>
+      Before proceeding to read the rest of this document, it should be
+      noted that the text assumes that certain files are placed in certain
+      directories.  Where they have been specified, the conventions we adopt
+      here for locating these files are those of the relevant RFC (RFC-86.0,
+      see <link linkend="sag-see-also">bibliography"</link>). If you are
+      using a distribution of Linux (or some other operating system) that
+      supports PAM but chooses to distribute these files in a diferent way
+      you should be careful when copying examples directly from the text.
+    </para>
+    <para>
+      As an example of the above, where it is explicit, the text assumes
+      that PAM loadable object files (the
+      <emphasis remap='B'>modules</emphasis>) are to be located in
+      the following directory: <filename>/lib/security/</filename> or
+      <filename>/lib64/security</filename> depending on the architecture.
+      This is generally the location that seems to be compatible with the
+      Filesystem Hierarchy Standard (FHS). On Solaris, which has its own
+      licensed version of PAM, and some other implementations of UN*X,
+      these files can be found in <filename>/usr/lib/security</filename>.
+      Please be careful to perform the necessary transcription when using
+      the examples from the text.
+    </para>
+  </chapter>
+
+  <chapter id="sag-overview">
+    <title>Overview</title>
+    <para>
+      For the uninitiated, we begin by considering an example.  We take an
+      application that grants some service to users;
+      <command>login</command> is one such program.
+      <command>Login</command> does two things, it first establishes that
+      the requesting user is whom they claim to be and second provides
+      them with the requested service: in the case of
+      <command>login</command> the service is a command shell
+      (bash, tcsh, zsh, etc.) running with the identity of the user.
+    </para>
+    <para>
+      Traditionally, the former step is achieved by the
+      <command>login</command> application prompting the user for a
+      password and then verifying that it agrees with that located on
+      the system; hence verifying that as far as the system is concerned
+      the user is who they claim to be. This is the task that is delegated
+      to <emphasis remap='B'>Linux-PAM</emphasis>.
+    </para>
+    <para>
+      From the perspective of the application programmer (in this case
+      the person that wrote the <command>login</command> application),
+      <emphasis remap='B'>Linux-PAM</emphasis> takes care of this
+      authentication task -- verifying the identity of the user.
+    </para>
+    <para>
+      The flexibility of <emphasis remap='B'>Linux-PAM</emphasis> is
+      that <emphasis>you</emphasis>, the system administrator, have
+      the freedom to stipulate which authentication scheme is to be
+      used. You have the freedom to set the scheme for any/all
+      PAM-aware applications on your Linux system. That is, you can
+      authenticate from anything as naive as
+      <emphasis>simple trust</emphasis> (<command>pam_permit</command>)
+      to something as paranoid as a combination of a retinal scan, a
+      voice print and a one-time password!
+    </para>
+    <para>
+      To illustrate the flexibility you face, consider the following
+      situation: a system administrator (parent) wishes to improve the
+      mathematical ability of her users (children). She can configure
+      their favorite ``Shoot 'em up game'' (PAM-aware of course) to
+      authenticate them with a request for the product of a couple of
+      random numbers less than 12. It is clear that if the game is any
+      good they will soon learn their
+      <emphasis>multiplication tables</emphasis>. As they mature, the
+      authentication can be upgraded to include (long) division!
+    </para>
+    <para>
+      <emphasis remap='B'>Linux-PAM</emphasis> deals with four
+      separate types of (management) task. These are:
+      <emphasis>authentication management</emphasis>;
+      <emphasis>account management</emphasis>;
+      <emphasis>session management</emphasis>; and
+      <emphasis>password management</emphasis>.
+      The association of the preferred management scheme with the behavior
+      of an application is made with entries in the relevant
+      <emphasis remap='B'>Linux-PAM</emphasis> configuration file.
+      The management functions are performed by <emphasis>modules</emphasis>
+      specified in the configuration file. The syntax for this
+      file is discussed in the section
+      <link  linkend="sag-configuration">below</link>.
+    </para>
+    <para>
+      Here is a figure that describes the overall organization of
+      <emphasis remap='B'>Linux-PAM</emphasis>:
+      <programlisting>
+  +----------------+
+  | application: X |
+  +----------------+       /  +----------+     +================+
+  | authentication-[----&gt;--\--] Linux-   |--&lt;--| PAM config file|
+  |       +        [----&lt;--/--]   PAM    |     |================|
+  |[conversation()][--+    \  |          |     | X auth .. a.so |
+  +----------------+  |    /  +-n--n-----+     | X auth .. b.so |
+  |                |  |       __|  |           |           _____/
+  |  service user  |  A      |     |           |____,-----'
+  |                |  |      V     A
+  +----------------+  +------|-----|---------+ -----+------+
+                         +---u-----u----+    |      |      |
+                         |   auth....   |--[ a ]--[ b ]--[ c ]
+                         +--------------+
+                         |   acct....   |--[ b ]--[ d ]
+                         +--------------+
+                         |   password   |--[ b ]--[ c ]
+                         +--------------+
+                         |   session    |--[ e ]--[ c ]
+                         +--------------+
+      </programlisting>
+      By way of explanation, the left of the figure represents the
+      application; application X.  Such an application interfaces with the
+      <emphasis remap='B'>Linux-PAM</emphasis> library and knows none of
+      the specifics of its configured authentication method. The
+      <emphasis remap='B'>Linux-PAM</emphasis> library (in the center)
+      consults the contents of the PAM configuration file and loads the
+      modules that are appropriate for application-X. These modules fall
+      into one of four management groups (lower-center) and are stacked in
+      the order they appear in the configuration file. These modules, when
+      called by <emphasis remap='B'>Linux-PAM</emphasis>, perform the
+      various authentication tasks for the application. Textual information,
+      required from/or offered to the user, can be exchanged through the
+      use of the application-supplied <emphasis>conversation</emphasis>
+      function.
+    </para>
+    <para>
+      If a program is going to use PAM, then it has to have PAM
+      functions explicitly coded into the program. If you have
+      access to the source code you can add the appropriate PAM
+      functions. If you do not have accessto the source code, and
+      the binary does not have the PAM functions included, then
+      it is not possible to use PAM.
+    </para>
+  </chapter>
+
+  <chapter id="sag-configuration">
+    <title>The Linux-PAM configuration file</title>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../man/pam.conf-desc.xml"
+     xpointer='xpointer(//section[@id = "pam.conf-desc"]/*)' />
+     <section id='sag-configuration-file'>
+       <title>Configuration file syntax</title>
+       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+        href="../man/pam.conf-syntax.xml"
+        xpointer='xpointer(//section[@id = "pam.conf-syntax"]/*)' />
+     </section>
+     <section id='sag-configuratin-dirctory'>
+       <title>Directory based configuration</title>
+       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+        href="../man/pam.conf-dir.xml"
+        xpointer='xpointer(//section[@id = "pam.conf-dir"]/*)' />
+     </section>
+     <section id='sag-configuration-example'>
+       <title>Example configuration file entries</title>
+       <para>
+         In this section, we give some examples of entries that can
+         be present in the <emphasis remap='B'>Linux-PAM</emphasis>
+         configuration file. As a first attempt at configuring your
+         system you could do worse than to implement these.
+       </para>
+       <para>
+         If a system is to be considered secure, it had better have a
+         reasonably secure '<emphasis remap='B'>other</emphasis> entry.
+         The following is a paranoid setting (which is not a bad place
+         to start!):
+       </para>
+       <programlisting>
+#
+# default; deny access
+#
+other   auth     required       pam_deny.so
+other   account  required       pam_deny.so
+other   password required       pam_deny.so
+other   session  required       pam_deny.so
+       </programlisting>
+       <para>
+         Whilst fundamentally a secure default, this is not very
+         sympathetic to a misconfigured system. For example, such
+         a system is vulnerable to locking everyone out should the
+         rest of the file become badly written.
+       </para>
+       <para>
+         The module <command>pam_deny</command> (documented in a
+         <link linkend="sag-pam_deny">later section</link>) is not very
+         sophisticated. For example, it logs no information when it
+         is invoked so unless the users of a system contact the
+         administrator when failing to execute a service application,
+         the administrator may go for a long while in ignorance of the
+         fact that his system is misconfigured.
+       </para>
+       <para>
+         The addition of the following line before those in the above
+         example would provide a suitable warning to the administrator.
+       </para>
+       <programlisting>
+#
+# default; wake up! This application is not configured
+#
+other   auth     required       pam_warn.so
+other   password required       pam_warn.so
+       </programlisting>
+       <para>
+         Having two '<command>other auth</command>' lines is an
+         example of stacking.
+       </para>
+       <para>
+         On a system that uses the <filename>/etc/pam.d/</filename>
+         configuration, the corresponding default setup would be
+         achieved with the following file:
+       </para>
+       <programlisting>
+#
+# default configuration: /etc/pam.d/other
+#
+auth     required       pam_warn.so
+auth     required       pam_deny.so
+account  required       pam_deny.so
+password required       pam_warn.so
+password required       pam_deny.so
+session  required       pam_deny.so
+       </programlisting>
+       <para>
+         This is the only explicit example we give for an
+         <filename>/etc/pam.d/</filename> file. In general, it
+         should be clear how to transpose the remaining examples
+         to this configuration scheme.
+       </para>
+       <para>
+         On a less sensitive computer, one on which the system
+         administrator wishes to remain ignorant of much of the
+         power of <emphasis remap='B'>Linux-PAM</emphasis>, the
+         following selection of lines (in
+         <filename>/etc/pam.d/other</filename>) is likely to
+         mimic the historically familiar Linux setup.
+       </para>
+       <programlisting>
+#
+# default; standard UN*X access
+#
+auth     required       pam_unix.so
+account  required       pam_unix.so
+password required       pam_unix.so
+session  required       pam_unix.so
+       </programlisting>
+       <para>
+         In general this will provide a starting place for most applications.
+       </para>
+     </section>
+  </chapter>
+
+  <chapter id='sag-security-issues'>
+    <title>Security issues</title>
+    <section id='sag-scurity-issues-wrong'>
+      <title>If something goes wrong</title>
+      <para>
+        <emphasis remap='B'>Linux-PAM</emphasis> has the potential
+        to seriously change the security of your system. You can
+        choose to have no security or absolute security (no access
+        permitted). In general, <emphasis remap='B'>Linux-PAM</emphasis>
+        errs towards the latter. Any number of configuration errors
+        can dissable access to your system partially, or completely.
+      </para>
+      <para>
+        The most dramatic problem that is likely to be encountered when
+        configuring <emphasis remap='B'>Linux-PAM</emphasis> is that of
+        <emphasis>deleting</emphasis> the configuration file(s):
+        <filename>/etc/pam.d/*</filename> and/or
+        <filename>/etc/pam.conf</filename>. This will lock you out of
+        your own system!
+      </para>
+      <para>
+        To recover, your best bet is to restore the system from a
+        backup or boot the system into a rescue system and correct
+        things from there.
+      </para>
+    </section>
+    <section id='sag-security-issues-other'>
+      <title>Avoid having a weak `other' configuration</title>
+      <para>
+        It is not a good thing to have a weak default
+        (<emphasis remap='B'>other</emphasis>) entry.
+        This service is the default configuration for all PAM aware
+        applications and if it is weak, your system is likely to be
+        vulnerable to attack.
+      </para>
+      <para>
+        Here is a sample "other" configuration file. The
+        <command>pam_deny</command> module will deny access and the
+        <command>pam_warn</command> module will send a syslog message
+        to <emphasis>auth.notice</emphasis>:
+      </para>
+      <programlisting>
+#
+# The PAM configuration file for the `other' service
+#
+auth      required   pam_deny.so
+auth      required   pam_warn.so
+account   required   pam_deny.so
+account   required   pam_warn.so
+password  required   pam_deny.so
+password  required   pam_warn.so
+session   required   pam_deny.so
+session   required   pam_warn.so
+      </programlisting>
+    </section>
+  </chapter>
+
+  <chapter id='sag-module-reference'>
+    <title>A reference guide for available modules</title>
+    <para>
+      Here, we collect together the descriptions of the various modules
+      coming with Linux-PAM.
+    </para>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_access.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_cracklib.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_debug.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_deny.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_echo.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_env.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_exec.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_filter.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_ftp.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_group.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_issue.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_keyinit.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_lastlog.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_limits.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_listfile.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_localuser.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_mail.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_mkhomedir.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_motd.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_namespace.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_nologin.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_permit.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_rhosts.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_rootok.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_securetty.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_selinux.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_shells.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_succeed_if.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_tally.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_time.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_umask.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_userdb.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_warn.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_wheel.xml"/>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="pam_xauth.xml"/>
+  </chapter>
+
+  <chapter id="sag-see-also">
+    <title>See also</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The Linux-PAM Application Writers' Guide.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Linux-PAM Module Writers' Guide.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The V. Samar and R. Schemers (SunSoft), ``UNIFIED LOGIN WITH
+          PLUGGABLE AUTHENTICATION MODULES'', Open Software Foundation
+          Request For Comments 86.0, October 1995.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </chapter>
+
+  <chapter id='sag-author'>
+    <title>Author/acknowledgments</title>
+    <para>
+      This document was written by Andrew G. Morgan (morgan@kernel.org)
+      with many contributions from
+      Chris Adams, Peter Allgeyer, Tim Baverstock, Tim Berger,
+      Craig S. Bell, Derrick J. Brashear, Ben Buxton, Seth Chaiklin,
+      Oliver Crow, Chris Dent, Marc Ewing, Cristian Gafton,
+      Emmanuel Galanos, Brad M. Garcia, Eric Hester, Michel D'Hooge,
+      Roger Hu, Eric Jacksch, Michael K. Johnson, David Kinchlea,
+      Olaf Kirch, Marcin Korzonek, Thorsten Kukuk, Stephen Langasek,
+      Nicolai Langfeldt, Elliot Lee, Luke Kenneth Casson Leighton,
+      Al Longyear, Ingo Luetkebohle, Marek Michalkiewicz,
+      Robert Milkowski, Aleph One, Martin Pool, Sean Reifschneider,
+      Jan Rekorajski, Erik Troan, Theodore Ts'o, Jeff Uphoff, Myles Uyema,
+      Savochkin Andrey Vladimirovich, Ronald Wahl, David Wood, John Wilmes,
+      Joseph S. D. Yao and Alex O. Yuriev.
+    </para>
+    <para>
+      Thanks are also due to Sun Microsystems, especially to Vipin Samar and
+      Charlie Lai for their advice. At an early stage in the development of
+      <emphasis remap='B'>Linux-PAM</emphasis>, Sun graciously made the
+      documentation for their implementation of PAM available. This act
+      greatly accelerated the development of
+      <emphasis remap='B'>Linux-PAM</emphasis>.
+    </para>
+  </chapter>
+
+  <chapter id='sag-copyright'>
+    <title>Copyright information for this document</title>
+    <programlisting>
+Copyright (c) 2006 Thorsten Kukuk &lt;kukuk@thkukuk.de&gt;
+Copyright (c) 1996-2002 Andrew G. Morgan &lt;morgan@kernel.org&gt;
+    </programlisting>
+    <para>
+      Redistribution and use in source and binary forms, with or without
+      modification, are permitted provided that the following conditions are
+      met:
+    </para>
+    <programlisting>
+1. Redistributions of source code must retain the above copyright
+   notice, and the entire permission notice in its entirety,
+   including the disclaimer of warranties.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+3. The name of the author may not be used to endorse or promote
+   products derived from this software without specific prior
+   written permission.
+    </programlisting>
+    <para>
+      Alternatively, this product may be distributed under the terms of
+      the GNU General Public License (GPL), in which case the provisions
+      of the GNU GPL are required instead of the above restrictions.
+      (This clause is necessary due to a potential bad interaction between
+      the GNU GPL and the restrictions contained in a BSD-style copyright.)
+    </para>
+    <programlisting>
+THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+    </programlisting>
+  </chapter>
+</book>
diff --git a/doc/sag/Makefile.am b/doc/sag/Makefile.am
new file mode 100644
index 00000000..f8d7c5f9
--- /dev/null
+++ b/doc/sag/Makefile.am
@@ -0,0 +1,48 @@
+#
+# Copyright (c) 2006 Thorsten Kukuk <kukuk@thkukuk.de>
+#
+
+CLEANFILES = Linux-PAM_SAG.fo *~
+
+EXTRA_DIST = $(XMLS)
+
+XMLS = Linux-PAM_SAG.xml $(shell ls pam_*.xml)
+
+if ENABLE_REGENERATE_MAN
+MAINTAINERCLEANFILES = Linux-PAM_SAG.txt Linux-PAM_SAG.pdf html/*.html
+
+all: Linux-PAM_SAG.txt html/Linux-PAM_SAG.html Linux-PAM_SAG.pdf
+
+Linux-PAM_SAG.pdf: $(XMLS)
+if ENABLE_GENERATE_PDF
+	$(XMLLINT) --nonet --xinclude --postvalid --noent --noout $<
+	$(XSLTPROC) --stringparam generate.toc "book toc" \
+	  --stringparam section.autolabel 1 \
+	  --stringparam section.label.includes.component.label 1 \
+	  --stringparam toc.max.depth 2 --xinclude --nonet \
+	http://docbook.sourceforge.net/release/xsl/current/fo/docbook.xsl $< > Linux-PAM_SAG.fo
+	$(FO2PDF) Linux-PAM_SAG.fo $(srcdir)/$@
+else
+	echo "No fo2pdf processor installed, skip PDF generation"
+endif
+
+Linux-PAM_SAG.txt: $(XMLS)
+	$(XMLLINT) --nonet --xinclude --postvalid --noent --noout $<
+	$(XSLTPROC) --stringparam generate.toc "book toc" \
+	  --stringparam section.autolabel 1 \
+	  --stringparam section.label.includes.component.label 1 \
+	  --stringparam toc.max.depth 2 --xinclude --nonet \
+	  http://docbook.sourceforge.net/release/xsl/current/html/docbook.xsl $< | $(BROWSER) > $(srcdir)/$@
+
+html/Linux-PAM_SAG.html: $(XMLS)
+	@test -d $(srcdir)/html || mkdir -p $(srcdir)/html
+	$(XMLLINT) --nonet --xinclude --postvalid --noent --noout $<
+	$(XSLTPROC) --stringparam base.dir html/ \
+	  --stringparam root.filename Linux-PAM_SAG \
+	  --stringparam use.id.as.filename 1 \
+	  --stringparam chunk.first.sections 1 \
+	  --stringparam section.autolabel 1 \
+	  --stringparam section.label.includes.component.label 1 \
+	  --stringparam toc.max.depth 2 --xinclude --nonet \
+	  http://docbook.sourceforge.net/release/xsl/current/html/chunk.xsl $<
+endif
diff --git a/doc/sag/pam_access.xml b/doc/sag/pam_access.xml
new file mode 100644
index 00000000..9ede469b
--- /dev/null
+++ b/doc/sag/pam_access.xml
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_access'>
+  <title>pam_access - logdaemon style login access control</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_access/pam_access.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_access-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_access/pam_access.8.xml" xpointer='xpointer(//refsect1[@id = "pam_access-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_access/access.conf.5.xml" xpointer='xpointer(//refsect1[@id = "access.conf-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_access/pam_access.8.xml" xpointer='xpointer(//refsect1[@id = "pam_access-options"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_access/pam_access.8.xml" xpointer='xpointer(//refsect1[@id = "pam_access-services"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_access/pam_access.8.xml" xpointer='xpointer(//refsect1[@id = "pam_access-return_values"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_access/pam_access.8.xml" xpointer='xpointer(//refsect1[@id = "pam_access-files"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_access/access.conf.5.xml" xpointer='xpointer(//refsect1[@id = "access.conf-examples"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_access/pam_access.8.xml" xpointer='xpointer(//refsect1[@id = "pam_access-authors"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_cracklib.xml b/doc/sag/pam_cracklib.xml
new file mode 100644
index 00000000..58f0edb0
--- /dev/null
+++ b/doc/sag/pam_cracklib.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_cracklib'>
+  <title>pam_cracklib - checks the password against dictionary words</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_cracklib/pam_cracklib.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_cracklib-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_cracklib-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_cracklib/pam_cracklib.8.xml" xpointer='xpointer(//refsect1[@id = "pam_cracklib-description"]/*)'/>
+  </section>
+  <section id='sag-pam_cracklib-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_cracklib/pam_cracklib.8.xml" xpointer='xpointer(//refsect1[@id = "pam_cracklib-options"]/*)'/>
+  </section>
+  <section id='sag-pam_cracklib-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_cracklib/pam_cracklib.8.xml" xpointer='xpointer(//refsect1[@id = "pam_cracklib-services"]/*)'/>
+  </section>
+  <section id='sag-pam_cracklib-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_cracklib/pam_cracklib.8.xml" xpointer='xpointer(//refsect1[@id = "pam_cracklib-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_cracklib-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_cracklib/pam_cracklib.8.xml" xpointer='xpointer(//refsect1[@id = "pam_cracklib-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_cracklib-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_cracklib/pam_cracklib.8.xml" xpointer='xpointer(//refsect1[@id = "pam_cracklib-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_debug.xml b/doc/sag/pam_debug.xml
new file mode 100644
index 00000000..6ec398b8
--- /dev/null
+++ b/doc/sag/pam_debug.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_debug'>
+  <title>pam_debug - debug the PAM stack</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_debug/pam_debug.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_debug-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_debug-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_debug/pam_debug.8.xml" xpointer='xpointer(//refsect1[@id = "pam_debug-description"]/*)'/>
+  </section>
+  <section id='sag-pam_debug-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_debug/pam_debug.8.xml" xpointer='xpointer(//refsect1[@id = "pam_debug-options"]/*)'/>
+  </section>
+  <section id='sag-pam_debug-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_debug/pam_debug.8.xml" xpointer='xpointer(//refsect1[@id = "pam_debug-services"]/*)'/>
+  </section>
+  <section id='sag-pam_debug-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_debug/pam_debug.8.xml" xpointer='xpointer(//refsect1[@id = "pam_debug-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_debug-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_debug/pam_debug.8.xml" xpointer='xpointer(//refsect1[@id = "pam_debug-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_debug-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_debug/pam_debug.8.xml" xpointer='xpointer(//refsect1[@id = "pam_debug-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_deny.xml b/doc/sag/pam_deny.xml
new file mode 100644
index 00000000..eaaada3b
--- /dev/null
+++ b/doc/sag/pam_deny.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_deny'>
+  <title>pam_deny - locking-out PAM module</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_deny/pam_deny.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_deny-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_deny-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_deny/pam_deny.8.xml" xpointer='xpointer(//refsect1[@id = "pam_deny-description"]/*)'/>
+  </section>
+  <section id='sag-pam_deny-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_deny/pam_deny.8.xml" xpointer='xpointer(//refsect1[@id = "pam_deny-options"]/*)'/>
+  </section>
+  <section id='sag-pam_deny-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_deny/pam_deny.8.xml" xpointer='xpointer(//refsect1[@id = "pam_deny-services"]/*)'/>
+  </section>
+  <section id='sag-pam_deny-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_deny/pam_deny.8.xml" xpointer='xpointer(//refsect1[@id = "pam_deny-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_deny-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_deny/pam_deny.8.xml" xpointer='xpointer(//refsect1[@id = "pam_deny-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_deny-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_deny/pam_deny.8.xml" xpointer='xpointer(//refsect1[@id = "pam_deny-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_echo.xml b/doc/sag/pam_echo.xml
new file mode 100644
index 00000000..0f1b1d38
--- /dev/null
+++ b/doc/sag/pam_echo.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_echo'>
+  <title>pam_echo - print text messages</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_echo/pam_echo.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_echo-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_echo/pam_echo.8.xml" xpointer='xpointer(//refsect1[@id = "pam_echo-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_echo/pam_echo.8.xml" xpointer='xpointer(//refsect1[@id = "pam_echo-options"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_echo/pam_echo.8.xml" xpointer='xpointer(//refsect1[@id = "pam_echo-services"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_echo/pam_echo.8.xml" xpointer='xpointer(//refsect1[@id = "pam_echo-return_values"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_echo/pam_echo.8.xml" xpointer='xpointer(//refsect1[@id = "pam_echo-examples"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_echo/pam_echo.8.xml" xpointer='xpointer(//refsect1[@id = "pam_echo-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_env.xml b/doc/sag/pam_env.xml
new file mode 100644
index 00000000..7e5f0a91
--- /dev/null
+++ b/doc/sag/pam_env.xml
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_env'>
+  <title>pam_env - set/unset environment variables</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_env/pam_env.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_env-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_env/pam_env.8.xml" xpointer='xpointer(//refsect1[@id = "pam_env-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_env/pam_env.conf.5.xml" xpointer='xpointer(//refsect1[@id = "pam_env.conf-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_env/pam_env.8.xml" xpointer='xpointer(//refsect1[@id = "pam_env-options"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_env/pam_env.8.xml" xpointer='xpointer(//refsect1[@id = "pam_env-services"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_env/pam_env.8.xml" xpointer='xpointer(//refsect1[@id = "pam_env-return_values"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_env/pam_env.8.xml" xpointer='xpointer(//refsect1[@id = "pam_env-files"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_env/pam_env.conf.5.xml" xpointer='xpointer(//refsect1[@id = "pam_env.conf-examples"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_env/pam_env.8.xml" xpointer='xpointer(//refsect1[@id = "pam_env-authors"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_exec.xml b/doc/sag/pam_exec.xml
new file mode 100644
index 00000000..ea65c202
--- /dev/null
+++ b/doc/sag/pam_exec.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_exec'>
+  <title>pam_exec - call an external command</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_exec/pam_exec.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_exec-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_exec/pam_exec.8.xml" xpointer='xpointer(//refsect1[@id = "pam_exec-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_exec/pam_exec.8.xml" xpointer='xpointer(//refsect1[@id = "pam_exec-options"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_exec/pam_exec.8.xml" xpointer='xpointer(//refsect1[@id = "pam_exec-services"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_exec/pam_exec.8.xml" xpointer='xpointer(//refsect1[@id = "pam_exec-return_values"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_exec/pam_exec.8.xml" xpointer='xpointer(//refsect1[@id = "pam_exec-examples"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_exec/pam_exec.8.xml" xpointer='xpointer(//refsect1[@id = "pam_exec-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_filter.xml b/doc/sag/pam_filter.xml
new file mode 100644
index 00000000..4248704d
--- /dev/null
+++ b/doc/sag/pam_filter.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_filter'>
+  <title>pam_filter - filter module</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_filter/pam_filter.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_filter-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_filter-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_filter/pam_filter.8.xml" xpointer='xpointer(//refsect1[@id = "pam_filter-description"]/*)'/>
+  </section>
+  <section id='sag-pam_filter-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_filter/pam_filter.8.xml" xpointer='xpointer(//refsect1[@id = "pam_filter-options"]/*)'/>
+  </section>
+  <section id='sag-pam_filter-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_filter/pam_filter.8.xml" xpointer='xpointer(//refsect1[@id = "pam_filter-services"]/*)'/>
+  </section>
+  <section id='sag-pam_filter-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_filter/pam_filter.8.xml" xpointer='xpointer(//refsect1[@id = "pam_filter-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_filter-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_filter/pam_filter.8.xml" xpointer='xpointer(//refsect1[@id = "pam_filter-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_filter-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_filter/pam_filter.8.xml" xpointer='xpointer(//refsect1[@id = "pam_filter-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_ftp.xml b/doc/sag/pam_ftp.xml
new file mode 100644
index 00000000..c53139ca
--- /dev/null
+++ b/doc/sag/pam_ftp.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_ftp'>
+  <title>pam_ftp - module for anonymous access</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_ftp/pam_ftp.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_ftp-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_ftp-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_ftp/pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-description"]/*)'/>
+  </section>
+  <section id='sag-pam_ftp-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_ftp/pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-options"]/*)'/>
+  </section>
+  <section id='sag-pam_ftp-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_ftp/pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-services"]/*)'/>
+  </section>
+  <section id='sag-pam_ftp-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_ftp/pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_ftp-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_ftp/pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_ftp-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_ftp/pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_group.xml b/doc/sag/pam_group.xml
new file mode 100644
index 00000000..a5025be1
--- /dev/null
+++ b/doc/sag/pam_group.xml
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_group'>
+  <title>pam_group - module to modify group access</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_group/pam_group.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_group-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_group/pam_group.8.xml" xpointer='xpointer(//refsect1[@id = "pam_group-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_group/group.conf.5.xml" xpointer='xpointer(//refsect1[@id = "group.conf-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_group/pam_group.8.xml" xpointer='xpointer(//refsect1[@id = "pam_group-options"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_group/pam_group.8.xml" xpointer='xpointer(//refsect1[@id = "pam_group-services"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_group/pam_group.8.xml" xpointer='xpointer(//refsect1[@id = "pam_group-return_values"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_group/pam_group.8.xml" xpointer='xpointer(//refsect1[@id = "pam_group-files"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_group/group.conf.5.xml" xpointer='xpointer(//refsect1[@id = "group.conf-examples"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_group/pam_group.8.xml" xpointer='xpointer(//refsect1[@id = "pam_group-authors"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_issue.xml b/doc/sag/pam_issue.xml
new file mode 100644
index 00000000..f9283de6
--- /dev/null
+++ b/doc/sag/pam_issue.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_issue'>
+  <title>pam_issue - add issue file to user prompt</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_issue/pam_issue.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_issue-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_issue-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_issue/pam_issue.8.xml" xpointer='xpointer(//refsect1[@id = "pam_issue-description"]/*)'/>
+  </section>
+  <section id='sag-pam_issue-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_issue/pam_issue.8.xml" xpointer='xpointer(//refsect1[@id = "pam_issue-options"]/*)'/>
+  </section>
+  <section id='sag-pam_issue-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_issue/pam_issue.8.xml" xpointer='xpointer(//refsect1[@id = "pam_issue-services"]/*)'/>
+  </section>
+  <section id='sag-pam_issue-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_issue/pam_issue.8.xml" xpointer='xpointer(//refsect1[@id = "pam_issue-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_issue-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_issue/pam_issue.8.xml" xpointer='xpointer(//refsect1[@id = "pam_issue-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_issue-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_issue/pam_issue.8.xml" xpointer='xpointer(//refsect1[@id = "pam_issue-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_keyinit.xml b/doc/sag/pam_keyinit.xml
new file mode 100644
index 00000000..4925900b
--- /dev/null
+++ b/doc/sag/pam_keyinit.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_keyinit'>
+  <title>pam_keyinit - display the keyinit file</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_keyinit/pam_keyinit.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_keyinit-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_keyinit-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_keyinit/pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-description"]/*)'/>
+  </section>
+  <section id='sag-pam_keyinit-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_keyinit/pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-options"]/*)'/>
+  </section>
+  <section id='sag-pam_keyinit-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_keyinit/pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-services"]/*)'/>
+  </section>
+  <section id='sag-pam_keyinit-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_keyinit/pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_keyinit-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_keyinit/pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_keyinit-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_keyinit/pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_lastlog.xml b/doc/sag/pam_lastlog.xml
new file mode 100644
index 00000000..a8012b1c
--- /dev/null
+++ b/doc/sag/pam_lastlog.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_lastlog'>
+  <title>pam_lastlog - display date of last login</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_lastlog/pam_lastlog.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_lastlog-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_lastlog-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_lastlog/pam_lastlog.8.xml" xpointer='xpointer(//refsect1[@id = "pam_lastlog-description"]/*)'/>
+  </section>
+  <section id='sag-pam_lastlog-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_lastlog/pam_lastlog.8.xml" xpointer='xpointer(//refsect1[@id = "pam_lastlog-options"]/*)'/>
+  </section>
+  <section id='sag-pam_lastlog-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_lastlog/pam_lastlog.8.xml" xpointer='xpointer(//refsect1[@id = "pam_lastlog-services"]/*)'/>
+  </section>
+  <section id='sag-pam_lastlog-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_lastlog/pam_lastlog.8.xml" xpointer='xpointer(//refsect1[@id = "pam_lastlog-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_lastlog-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_lastlog/pam_lastlog.8.xml" xpointer='xpointer(//refsect1[@id = "pam_lastlog-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_lastlog-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_lastlog/pam_lastlog.8.xml" xpointer='xpointer(//refsect1[@id = "pam_lastlog-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_limits.xml b/doc/sag/pam_limits.xml
new file mode 100644
index 00000000..a021fc27
--- /dev/null
+++ b/doc/sag/pam_limits.xml
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_limits'>
+  <title>pam_limits - limit resources</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_limits/pam_limits.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_limits-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_limits/pam_limits.8.xml" xpointer='xpointer(//refsect1[@id = "pam_limits-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_limits/limits.conf.5.xml" xpointer='xpointer(//refsect1[@id = "limits.conf-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_limits/pam_limits.8.xml" xpointer='xpointer(//refsect1[@id = "pam_limits-options"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_limits/pam_limits.8.xml" xpointer='xpointer(//refsect1[@id = "pam_limits-services"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_limits/pam_limits.8.xml" xpointer='xpointer(//refsect1[@id = "pam_limits-return_values"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_limits/pam_limits.8.xml" xpointer='xpointer(//refsect1[@id = "pam_limits-files"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_limits/limits.conf.5.xml" xpointer='xpointer(//refsect1[@id = "limits.conf-examples"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_limits/pam_limits.8.xml" xpointer='xpointer(//refsect1[@id = "pam_limits-authors"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_listfile.xml b/doc/sag/pam_listfile.xml
new file mode 100644
index 00000000..fe3f6b0c
--- /dev/null
+++ b/doc/sag/pam_listfile.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_listfile'>
+  <title>pam_listfile - deny or allow services based on an arbitrary file</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_listfile/pam_listfile.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_listfile-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_listfile-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_listfile/pam_listfile.8.xml" xpointer='xpointer(//refsect1[@id = "pam_listfile-description"]/*)'/>
+  </section>
+  <section id='sag-pam_listfile-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_listfile/pam_listfile.8.xml" xpointer='xpointer(//refsect1[@id = "pam_listfile-options"]/*)'/>
+  </section>
+  <section id='sag-pam_listfile-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_listfile/pam_listfile.8.xml" xpointer='xpointer(//refsect1[@id = "pam_listfile-services"]/*)'/>
+  </section>
+  <section id='sag-pam_listfile-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_listfile/pam_listfile.8.xml" xpointer='xpointer(//refsect1[@id = "pam_listfile-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_listfile-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_listfile/pam_listfile.8.xml" xpointer='xpointer(//refsect1[@id = "pam_listfile-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_listfile-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_listfile/pam_listfile.8.xml" xpointer='xpointer(//refsect1[@id = "pam_listfile-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_localuser.xml b/doc/sag/pam_localuser.xml
new file mode 100644
index 00000000..0f13d368
--- /dev/null
+++ b/doc/sag/pam_localuser.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_localuser'>
+  <title>pam_localuser - require users to be listed in /etc/passwd</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_localuser/pam_localuser.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_localuser-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_localuser-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_localuser/pam_localuser.8.xml" xpointer='xpointer(//refsect1[@id = "pam_localuser-description"]/*)'/>
+  </section>
+  <section id='sag-pam_localuser-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_localuser/pam_localuser.8.xml" xpointer='xpointer(//refsect1[@id = "pam_localuser-options"]/*)'/>
+  </section>
+  <section id='sag-pam_localuser-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_localuser/pam_localuser.8.xml" xpointer='xpointer(//refsect1[@id = "pam_localuser-services"]/*)'/>
+  </section>
+  <section id='sag-pam_localuser-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_localuser/pam_localuser.8.xml" xpointer='xpointer(//refsect1[@id = "pam_localuser-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_localuser-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_localuser/pam_localuser.8.xml" xpointer='xpointer(//refsect1[@id = "pam_localuser-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_localuser-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_localuser/pam_localuser.8.xml" xpointer='xpointer(//refsect1[@id = "pam_localuser-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_mail.xml b/doc/sag/pam_mail.xml
new file mode 100644
index 00000000..879c8940
--- /dev/null
+++ b/doc/sag/pam_mail.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_mail'>
+  <title>pam_mail - inform about available mail</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mail/pam_mail.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_mail-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_mail-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mail/pam_mail.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mail-description"]/*)'/>
+  </section>
+  <section id='sag-pam_mail-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mail/pam_mail.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mail-options"]/*)'/>
+  </section>
+  <section id='sag-pam_mail-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mail/pam_mail.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mail-services"]/*)'/>
+  </section>
+  <section id='sag-pam_mail-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mail/pam_mail.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mail-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_mail-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mail/pam_mail.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mail-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_mail-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mail/pam_mail.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mail-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_mkhomedir.xml b/doc/sag/pam_mkhomedir.xml
new file mode 100644
index 00000000..a1465439
--- /dev/null
+++ b/doc/sag/pam_mkhomedir.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_mkhomedir'>
+  <title>pam_mkhomedir - create users home directory</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mkhomedir/pam_mkhomedir.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_mkhomedir-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_mkhomedir-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mkhomedir/pam_mkhomedir.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mkhomedir-description"]/*)'/>
+  </section>
+  <section id='sag-pam_mkhomedir-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mkhomedir/pam_mkhomedir.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mkhomedir-options"]/*)'/>
+  </section>
+  <section id='sag-pam_mkhomedir-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mkhomedir/pam_mkhomedir.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mkhomedir-services"]/*)'/>
+  </section>
+  <section id='sag-pam_mkhomedir-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mkhomedir/pam_mkhomedir.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mkhomedir-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_mkhomedir-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mkhomedir/pam_mkhomedir.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mkhomedir-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_mkhomedir-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_mkhomedir/pam_mkhomedir.8.xml" xpointer='xpointer(//refsect1[@id = "pam_mkhomedir-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_motd.xml b/doc/sag/pam_motd.xml
new file mode 100644
index 00000000..847a047c
--- /dev/null
+++ b/doc/sag/pam_motd.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_motd'>
+  <title>pam_motd - display the motd file</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_motd/pam_motd.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_motd-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_motd-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_motd/pam_motd.8.xml" xpointer='xpointer(//refsect1[@id = "pam_motd-description"]/*)'/>
+  </section>
+  <section id='sag-pam_motd-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_motd/pam_motd.8.xml" xpointer='xpointer(//refsect1[@id = "pam_motd-options"]/*)'/>
+  </section>
+  <section id='sag-pam_motd-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_motd/pam_motd.8.xml" xpointer='xpointer(//refsect1[@id = "pam_motd-services"]/*)'/>
+  </section>
+  <section id='sag-pam_motd-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_motd/pam_motd.8.xml" xpointer='xpointer(//refsect1[@id = "pam_motd-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_motd-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_motd/pam_motd.8.xml" xpointer='xpointer(//refsect1[@id = "pam_motd-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_motd-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_motd/pam_motd.8.xml" xpointer='xpointer(//refsect1[@id = "pam_motd-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_namespace.xml b/doc/sag/pam_namespace.xml
new file mode 100644
index 00000000..43ddca1f
--- /dev/null
+++ b/doc/sag/pam_namespace.xml
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_namespace'>
+  <title>pam_namespace - setup a private namespace</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_namespace/pam_namespace.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_namespace-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_namespace/pam_namespace.8.xml" xpointer='xpointer(//refsect1[@id = "pam_namespace-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_namespace/namespace.conf.5.xml" xpointer='xpointer(//refsect1[@id = "namespace.conf-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_namespace/pam_namespace.8.xml" xpointer='xpointer(//refsect1[@id = "pam_namespace-options"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_namespace/pam_namespace.8.xml" xpointer='xpointer(//refsect1[@id = "pam_namespace-services"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_namespace/pam_namespace.8.xml" xpointer='xpointer(//refsect1[@id = "pam_namespace-return_values"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_namespace/pam_namespace.8.xml" xpointer='xpointer(//refsect1[@id = "pam_namespace-files"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_namespace/namespace.conf.5.xml" xpointer='xpointer(//refsect1[@id = "namespace.conf-examples"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_namespace/pam_namespace.8.xml" xpointer='xpointer(//refsect1[@id = "pam_namespace-authors"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_nologin.xml b/doc/sag/pam_nologin.xml
new file mode 100644
index 00000000..b05652f5
--- /dev/null
+++ b/doc/sag/pam_nologin.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_nologin'>
+  <title>pam_nologin - prevent non-root users from login</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_nologin/pam_nologin.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_nologin-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_nologin-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_nologin/pam_nologin.8.xml" xpointer='xpointer(//refsect1[@id = "pam_nologin-description"]/*)'/>
+  </section>
+  <section id='sag-pam_nologin-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_nologin/pam_nologin.8.xml" xpointer='xpointer(//refsect1[@id = "pam_nologin-options"]/*)'/>
+  </section>
+  <section id='sag-pam_nologin-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_nologin/pam_nologin.8.xml" xpointer='xpointer(//refsect1[@id = "pam_nologin-services"]/*)'/>
+  </section>
+  <section id='sag-pam_nologin-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_nologin/pam_nologin.8.xml" xpointer='xpointer(//refsect1[@id = "pam_nologin-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_nologin-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_nologin/pam_nologin.8.xml" xpointer='xpointer(//refsect1[@id = "pam_nologin-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_nologin-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_nologin/pam_nologin.8.xml" xpointer='xpointer(//refsect1[@id = "pam_nologin-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_permit.xml b/doc/sag/pam_permit.xml
new file mode 100644
index 00000000..82febe01
--- /dev/null
+++ b/doc/sag/pam_permit.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_permit'>
+  <title>pam_permit - the promiscuous module</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_permit/pam_permit.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_permit-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_permit-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_permit/pam_permit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_permit-description"]/*)'/>
+  </section>
+  <section id='sag-pam_permit-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_permit/pam_permit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_permit-options"]/*)'/>
+  </section>
+  <section id='sag-pam_permit-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_permit/pam_permit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_permit-services"]/*)'/>
+  </section>
+  <section id='sag-pam_permit-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_permit/pam_permit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_permit-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_permit-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_permit/pam_permit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_permit-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_permit-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_permit/pam_permit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_permit-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_rhosts.xml b/doc/sag/pam_rhosts.xml
new file mode 100644
index 00000000..10ae9361
--- /dev/null
+++ b/doc/sag/pam_rhosts.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_rhosts'>
+  <title>pam_rhosts - grant access using .rhosts file</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rhosts/pam_rhosts.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_rhosts-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_rhosts-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rhosts/pam_rhosts.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rhosts-description"]/*)'/>
+  </section>
+  <section id='sag-pam_rhosts-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rhosts/pam_rhosts.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rhosts-options"]/*)'/>
+  </section>
+  <section id='sag-pam_rhosts-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rhosts/pam_rhosts.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rhosts-services"]/*)'/>
+  </section>
+  <section id='sag-pam_rhosts-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rhosts/pam_rhosts.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rhosts-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_rhosts-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rhosts/pam_rhosts.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rhosts-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_rhosts-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rhosts/pam_rhosts.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rhosts-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_rootok.xml b/doc/sag/pam_rootok.xml
new file mode 100644
index 00000000..6907bd89
--- /dev/null
+++ b/doc/sag/pam_rootok.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_rootok'>
+  <title>pam_rootok - gain only root access</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rootok/pam_rootok.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_rootok-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_rootok-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rootok/pam_rootok.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rootok-description"]/*)'/>
+  </section>
+  <section id='sag-pam_rootok-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rootok/pam_rootok.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rootok-options"]/*)'/>
+  </section>
+  <section id='sag-pam_rootok-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rootok/pam_rootok.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rootok-services"]/*)'/>
+  </section>
+  <section id='sag-pam_rootok-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rootok/pam_rootok.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rootok-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_rootok-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rootok/pam_rootok.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rootok-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_rootok-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_rootok/pam_rootok.8.xml" xpointer='xpointer(//refsect1[@id = "pam_rootok-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_securetty.xml b/doc/sag/pam_securetty.xml
new file mode 100644
index 00000000..061546cc
--- /dev/null
+++ b/doc/sag/pam_securetty.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_securetty'>
+  <title>pam_securetty - limit root login to special devices</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_securetty/pam_securetty.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_securetty-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_securetty-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_securetty/pam_securetty.8.xml" xpointer='xpointer(//refsect1[@id = "pam_securetty-description"]/*)'/>
+  </section>
+  <section id='sag-pam_securetty-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_securetty/pam_securetty.8.xml" xpointer='xpointer(//refsect1[@id = "pam_securetty-options"]/*)'/>
+  </section>
+  <section id='sag-pam_securetty-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_securetty/pam_securetty.8.xml" xpointer='xpointer(//refsect1[@id = "pam_securetty-services"]/*)'/>
+  </section>
+  <section id='sag-pam_securetty-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_securetty/pam_securetty.8.xml" xpointer='xpointer(//refsect1[@id = "pam_securetty-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_securetty-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_securetty/pam_securetty.8.xml" xpointer='xpointer(//refsect1[@id = "pam_securetty-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_securetty-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_securetty/pam_securetty.8.xml" xpointer='xpointer(//refsect1[@id = "pam_securetty-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_selinux.xml b/doc/sag/pam_selinux.xml
new file mode 100644
index 00000000..a0fb293b
--- /dev/null
+++ b/doc/sag/pam_selinux.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_selinux'>
+  <title>pam_selinux - set the default security context</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_selinux/pam_selinux.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_selinux-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_selinux-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_selinux/pam_selinux.8.xml" xpointer='xpointer(//refsect1[@id = "pam_selinux-description"]/*)'/>
+  </section>
+  <section id='sag-pam_selinux-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_selinux/pam_selinux.8.xml" xpointer='xpointer(//refsect1[@id = "pam_selinux-options"]/*)'/>
+  </section>
+  <section id='sag-pam_selinux-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_selinux/pam_selinux.8.xml" xpointer='xpointer(//refsect1[@id = "pam_selinux-services"]/*)'/>
+  </section>
+  <section id='sag-pam_selinux-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_selinux/pam_selinux.8.xml" xpointer='xpointer(//refsect1[@id = "pam_selinux-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_selinux-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_selinux/pam_selinux.8.xml" xpointer='xpointer(//refsect1[@id = "pam_selinux-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_selinux-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_selinux/pam_selinux.8.xml" xpointer='xpointer(//refsect1[@id = "pam_selinux-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_shells.xml b/doc/sag/pam_shells.xml
new file mode 100644
index 00000000..87bc6fdb
--- /dev/null
+++ b/doc/sag/pam_shells.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_shells'>
+  <title>pam_shells - check for valid login shell</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_shells/pam_shells.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_shells-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_shells-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_shells/pam_shells.8.xml" xpointer='xpointer(//refsect1[@id = "pam_shells-description"]/*)'/>
+  </section>
+  <section id='sag-pam_shells-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_shells/pam_shells.8.xml" xpointer='xpointer(//refsect1[@id = "pam_shells-options"]/*)'/>
+  </section>
+  <section id='sag-pam_shells-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_shells/pam_shells.8.xml" xpointer='xpointer(//refsect1[@id = "pam_shells-services"]/*)'/>
+  </section>
+  <section id='sag-pam_shells-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_shells/pam_shells.8.xml" xpointer='xpointer(//refsect1[@id = "pam_shells-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_shells-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_shells/pam_shells.8.xml" xpointer='xpointer(//refsect1[@id = "pam_shells-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_shells-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_shells/pam_shells.8.xml" xpointer='xpointer(//refsect1[@id = "pam_shells-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_succeed_if.xml b/doc/sag/pam_succeed_if.xml
new file mode 100644
index 00000000..0d7304a4
--- /dev/null
+++ b/doc/sag/pam_succeed_if.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_succeed_if'>
+  <title>pam_succeed_if - test account characteristics</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_succeed_if/pam_succeed_if.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_succeed_if-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_succeed_if-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_succeed_if/pam_succeed_if.8.xml" xpointer='xpointer(//refsect1[@id = "pam_succeed_if-description"]/*)'/>
+  </section>
+  <section id='sag-pam_succeed_if-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_succeed_if/pam_succeed_if.8.xml" xpointer='xpointer(//refsect1[@id = "pam_succeed_if-options"]/*)'/>
+  </section>
+  <section id='sag-pam_succeed_if-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_succeed_if/pam_succeed_if.8.xml" xpointer='xpointer(//refsect1[@id = "pam_succeed_if-services"]/*)'/>
+  </section>
+  <section id='sag-pam_succeed_if-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_succeed_if/pam_succeed_if.8.xml" xpointer='xpointer(//refsect1[@id = "pam_succeed_if-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_succeed_if-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_succeed_if/pam_succeed_if.8.xml" xpointer='xpointer(//refsect1[@id = "pam_succeed_if-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_succeed_if-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_succeed_if/pam_succeed_if.8.xml" xpointer='xpointer(//refsect1[@id = "pam_succeed_if-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_tally.xml b/doc/sag/pam_tally.xml
new file mode 100644
index 00000000..df34a511
--- /dev/null
+++ b/doc/sag/pam_tally.xml
@@ -0,0 +1,38 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_tally'>
+  <title>pam_tally - login counter (tallying) module</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_tally/pam_tally.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_tally-cmdsynopsis1"]/*)'/>
+  </cmdsynopsis>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_tally/pam_tally.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_tally-cmdsynopsis2"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_tally-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_tally/pam_tally.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tally-description"]/*)'/>
+  </section>
+  <section id='sag-pam_tally-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_tally/pam_tally.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tally-options"]/*)'/>
+  </section>
+  <section id='sag-pam_tally-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_tally/pam_tally.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tally-services"]/*)'/>
+  </section>
+  <section id='sag-pam_tally-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_tally/pam_tally.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tally-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_tally-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_tally/pam_tally.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tally-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_tally-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_tally/pam_tally.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tally-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_time.xml b/doc/sag/pam_time.xml
new file mode 100644
index 00000000..c997c24c
--- /dev/null
+++ b/doc/sag/pam_time.xml
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_time'>
+  <title>pam_time - time controled access</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_time/pam_time.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_time-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_time/pam_time.8.xml" xpointer='xpointer(//refsect1[@id = "pam_time-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_time/time.conf.5.xml" xpointer='xpointer(//refsect1[@id = "time.conf-description"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_time/pam_time.8.xml" xpointer='xpointer(//refsect1[@id = "pam_time-options"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_time/pam_time.8.xml" xpointer='xpointer(//refsect1[@id = "pam_time-services"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_time/pam_time.8.xml" xpointer='xpointer(//refsect1[@id = "pam_time-return_values"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_time/pam_time.8.xml" xpointer='xpointer(//refsect1[@id = "pam_time-files"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_time/time.conf.5.xml" xpointer='xpointer(//refsect1[@id = "time.conf-examples"]/*)'/>
+  </section>
+  <section>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_time/pam_time.8.xml" xpointer='xpointer(//refsect1[@id = "pam_time-authors"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_umask.xml b/doc/sag/pam_umask.xml
new file mode 100644
index 00000000..af68f647
--- /dev/null
+++ b/doc/sag/pam_umask.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_umask'>
+  <title>pam_umask - set the file mode creation mask</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_umask/pam_umask.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_umask-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_umask-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_umask/pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-description"]/*)'/>
+  </section>
+  <section id='sag-pam_umask-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_umask/pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-options"]/*)'/>
+  </section>
+  <section id='sag-pam_umask-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_umask/pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-services"]/*)'/>
+  </section>
+  <section id='sag-pam_umask-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_umask/pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_umask-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_umask/pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_umask-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_umask/pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_userdb.xml b/doc/sag/pam_userdb.xml
new file mode 100644
index 00000000..ae934cf6
--- /dev/null
+++ b/doc/sag/pam_userdb.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_userdb'>
+  <title>pam_userdb - authenticate against a db database</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_userdb/pam_userdb.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_userdb-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_userdb-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_userdb/pam_userdb.8.xml" xpointer='xpointer(//refsect1[@id = "pam_userdb-description"]/*)'/>
+  </section>
+  <section id='sag-pam_userdb-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_userdb/pam_userdb.8.xml" xpointer='xpointer(//refsect1[@id = "pam_userdb-options"]/*)'/>
+  </section>
+  <section id='sag-pam_userdb-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_userdb/pam_userdb.8.xml" xpointer='xpointer(//refsect1[@id = "pam_userdb-services"]/*)'/>
+  </section>
+  <section id='sag-pam_userdb-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_userdb/pam_userdb.8.xml" xpointer='xpointer(//refsect1[@id = "pam_userdb-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_userdb-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_userdb/pam_userdb.8.xml" xpointer='xpointer(//refsect1[@id = "pam_userdb-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_userdb-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_userdb/pam_userdb.8.xml" xpointer='xpointer(//refsect1[@id = "pam_userdb-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_warn.xml b/doc/sag/pam_warn.xml
new file mode 100644
index 00000000..3d42a757
--- /dev/null
+++ b/doc/sag/pam_warn.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_warn'>
+  <title>pam_warn - logs all PAM items</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_warn/pam_warn.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_warn-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_warn-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_warn/pam_warn.8.xml" xpointer='xpointer(//refsect1[@id = "pam_warn-description"]/*)'/>
+  </section>
+  <section id='sag-pam_warn-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_warn/pam_warn.8.xml" xpointer='xpointer(//refsect1[@id = "pam_warn-options"]/*)'/>
+  </section>
+  <section id='sag-pam_warn-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_warn/pam_warn.8.xml" xpointer='xpointer(//refsect1[@id = "pam_warn-services"]/*)'/>
+  </section>
+  <section id='sag-pam_warn-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_warn/pam_warn.8.xml" xpointer='xpointer(//refsect1[@id = "pam_warn-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_warn-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_warn/pam_warn.8.xml" xpointer='xpointer(//refsect1[@id = "pam_warn-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_warn-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_warn/pam_warn.8.xml" xpointer='xpointer(//refsect1[@id = "pam_warn-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_wheel.xml b/doc/sag/pam_wheel.xml
new file mode 100644
index 00000000..69175124
--- /dev/null
+++ b/doc/sag/pam_wheel.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_wheel'>
+  <title>pam_wheel - only permit root access to members of group wheel</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_wheel/pam_wheel.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_wheel-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_wheel-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_wheel/pam_wheel.8.xml" xpointer='xpointer(//refsect1[@id = "pam_wheel-description"]/*)'/>
+  </section>
+  <section id='sag-pam_wheel-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_wheel/pam_wheel.8.xml" xpointer='xpointer(//refsect1[@id = "pam_wheel-options"]/*)'/>
+  </section>
+  <section id='sag-pam_wheel-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_wheel/pam_wheel.8.xml" xpointer='xpointer(//refsect1[@id = "pam_wheel-services"]/*)'/>
+  </section>
+  <section id='sag-pam_wheel-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_wheel/pam_wheel.8.xml" xpointer='xpointer(//refsect1[@id = "pam_wheel-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_wheel-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_wheel/pam_wheel.8.xml" xpointer='xpointer(//refsect1[@id = "pam_wheel-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_wheel-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_wheel/pam_wheel.8.xml" xpointer='xpointer(//refsect1[@id = "pam_wheel-author"]/*)'/>
+  </section>
+</section>
diff --git a/doc/sag/pam_xauth.xml b/doc/sag/pam_xauth.xml
new file mode 100644
index 00000000..84ca5ddb
--- /dev/null
+++ b/doc/sag/pam_xauth.xml
@@ -0,0 +1,34 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+        "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='sag-pam_xauth'>
+  <title>pam_xauth - forward xauth keys between users</title>
+  <cmdsynopsis>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_xauth/pam_xauth.8.xml" xpointer='xpointer(//cmdsynopsis[@id = "pam_xauth-cmdsynopsis"]/*)'/>
+  </cmdsynopsis>
+  <section id='sag-pam_xauth-description'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_xauth/pam_xauth.8.xml" xpointer='xpointer(//refsect1[@id = "pam_xauth-description"]/*)'/>
+  </section>
+  <section id='sag-pam_xauth-options'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_xauth/pam_xauth.8.xml" xpointer='xpointer(//refsect1[@id = "pam_xauth-options"]/*)'/>
+  </section>
+  <section id='sag-pam_xauth-services'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_xauth/pam_xauth.8.xml" xpointer='xpointer(//refsect1[@id = "pam_xauth-services"]/*)'/>
+  </section>
+  <section id='sag-pam_xauth-return_values'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_xauth/pam_xauth.8.xml" xpointer='xpointer(//refsect1[@id = "pam_xauth-return_values"]/*)'/>
+  </section>
+  <section id='sag-pam_xauth-examples'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_xauth/pam_xauth.8.xml" xpointer='xpointer(//refsect1[@id = "pam_xauth-examples"]/*)'/>
+  </section>
+  <section id='sag-pam_xauth-author'>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+     href="../../modules/pam_xauth/pam_xauth.8.xml" xpointer='xpointer(//refsect1[@id = "pam_xauth-author"]/*)'/>
+  </section>
+</section>