diff --git a/debian/changelog b/debian/changelog
index 9b1bed21..e3452ab9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+shadow (1:4.1.4-3) unstable; urgency=low
+
+  * The "Banonet" release.
+  * debian/login.pam: Really ignore pam_selinux.so failures when the module do
+    not exist. Closes: #528673
+
+ -- Nicolas FRANCOIS (Nekral) <nicolas.francois@centraliens.net>  Sat, 16 May 2009 12:11:15 +0200
+
 shadow (1:4.1.4-2) unstable; urgency=low
 
   * The "Banon" release.
diff --git a/debian/login.pam b/debian/login.pam
index bdf85375..33e48a76 100644
--- a/debian/login.pam
+++ b/debian/login.pam
@@ -93,6 +93,6 @@ session    optional   pam_mail.so standard
 # SELinux needs to intervene at login time to ensure that the process
 # starts in the proper default security context. Only sessions which are
 # intended to run in the user's context should be run after this.
-session required pam_selinux.so open
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
 # When the module is present, "required" would be sufficient (When SELinux
 # is disabled, this returns success.)