cros_post_src_install_shadow_flatcar_modifications() {
    (
        insopts -m 0644
        insinto /usr/lib/tmpfiles.d
        newins - var-shadow.conf <<'EOF'
f   /var/log/faillog        -   -   -   -   -
EOF
    )

    local f
    # install these for backward compatibility
    for f in 'securetty' 'login.defs'; do
        dosym -r "/usr/share/flatcar/etc/${f}" "/usr/share/shadow/${f}"
        insinto /usr/share/flatcar/etc
        newins - "${f}"
    done
    dosym -r /usr/share/flatcar/etc/default/useradd /usr/share/shadow/useradd
    insinto /usr/share/flatcar/etc/default
    newins - useradd

    # Install our own securetty file with additional arch-specific cruft
    local devs=''
    case $(tc-arch) in
        ppc*)
            devs="hvc0 hvsi0 ttyPSC0";;
        hppa)
            devs="ttyB0";;
        arm)
            devs="ttyFB0 ttySAC0 ttySAC1 ttySAC2 ttySAC3 ttymxc0 ttymxc1 ttymxc2 ttymxc3 ttyO0 ttyO1 ttyO2";;
        sh)
            devs="ttySC0 ttySC1";;
        amd64|x86)
            devs="hvc0";;
    esac

    insopts -m0600
    insinto /etc/
    newins - securetty <<EOF
# /etc/securetty: list of terminals on which root is allowed to login.
# See securetty(5) and login(1).
console

vc/0
vc/1
vc/2
vc/3
vc/4
vc/5
vc/6
vc/7
vc/8
vc/9
vc/10
vc/11
vc/12
tty0
tty1
tty2
tty3
tty4
tty5
tty6
tty7
tty8
tty9
tty10
tty11
tty12

tts/0
ttyS0

${devs}
EOF

    # Move pam files to /usr.
    vendorize_pam_files
}
