So, I've been thinking about this issue. I'm not sure I have great solutions for the etch->lenny case. However it seems like we could do better for the future.
Here's a possibility. When libpam failes to be able to dlopen a module, it could look at a version epoch stored somewhere in s/etc. If the epoch is different than the epoch it was started with, then it could indicate to an application that a restart is required. We could potentially even call exit(1) although that's probably more excessive than we might want. Does this seem like a reasonable approach? -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org