Add a Valgrind test of the PAM config.

.github/configs

@@ -208,10 +208,14 @@ case "$config" in
 	LIBCRYPTOFLAGS="--without-openssl"
 	TEST_TARGET=t-exec
 	;;
-    valgrind-[1-4]|valgrind-unit)
+    valgrind-[1-4]|valgrind-unit|valgrind-pam-1)
 	# rlimit sandbox and FORTIFY_SOURCE confuse Valgrind.
 	CONFIGFLAGS="--without-sandbox --without-hardening"
 	CONFIGFLAGS="$CONFIGFLAGS --with-cppflags=-D_FORTIFY_SOURCE=0"
+	if [ "${config}" = "valgrind-pam-1" ]; then
+		CONFIGFLAGS="$CONFIGFLAGS --with-pam"
+		SSHD_CONFOPTS="UsePam yes"
+	fi
 	TEST_TARGET="t-exec USE_VALGRIND=1"
 	TEST_SSH_ELAPSED_TIMES=1
 	export TEST_SSH_ELAPSED_TIMES
@@ -222,7 +226,7 @@ case "$config" in
 	tests3="krl forward-control sshsig agent-restrict kextype sftp"
 	tests4="cert-userkey cert-hostkey kextype sftp-perm keygen-comment percent"
 	case "$config" in
-	    valgrind-1)
+	    valgrind-1|valgrind-pam)
 		# All tests except agent-timeout (which is flaky under valgrind),
 		# connection-timeout (which doesn't work since it's so slow)
 		# and hostbased (since valgrind won't let ssh exec keysign).

.github/workflows/c-cpp.yml

@@ -63,6 +63,7 @@ jobs:
           - { target: ubuntu-22.04, config: valgrind-2 }
           - { target: ubuntu-22.04, config: valgrind-3 }
           - { target: ubuntu-22.04, config: valgrind-4 }
+          - { target: ubuntu-22.04, config: valgrind-pam-1 }
           - { target: ubuntu-22.04, config: valgrind-unit }
           - { target: ubuntu-22.04, config: without-openssl }
           - { target: ubuntu-latest, config: gcc-14 }