In KF5/Plasma 5 world the kcheckpass binary has moved, and is now in
%_libdir/libexec/kcheckpass. Sources can be found in
plasma-workspace.git/ksmserver/screenlocker/kcheckpass/ (srcpkg is
plasma5-workspace).


Kcheckpass itself does *not* need to be SUID, if the correct pam config module
is in place (pam_unix.so). This however does not work for upgraders from some
earlier openSUSE releases, as the have pam_unix2.so instead (apparently noone
checks the rpmnew files).

For these users we either need to make the binary SUID, or change pam not to
use %config(noreplace) for /etc/pam.d/ stuff.

If this doesn't get a whitelist, i'll try to see with pam people why they don't
use plain %config