So, I have been half-heartedly version tracking the contents of
/etc/pam.d.
After having applied updates a while back, I've started working again recently in that directory to enable additional access controls.
So, I see several files have been added or changed since last I made a commit, including this one for which no provenance information was obvious:
# dpkg -S /etc/pam.d/gdm-welcome
dpkg-query: no path found matching pattern /etc/pam.d/gdm-welcome
Searching for debian gdm-welcome and ubuntu gdm-welcome weren't much
help.
Even including the full path wasn't useful, but searching
debian "/etc/pam.d/gdm-welcome" finally turned up:
https://apt-browse.org/browse/debian/wheezy/main/i386/gdm3/3.4.1-8/debian/postinst
in which one finds the stanza:
if [ ! -f /etc/pam.d/gdm-welcome ]; then
ln -s gdm3-autologin /etc/pam.d/gdm-welcome
fi
and sure enough, it's a link to a file with reasonable provenance:
# ls -ld /etc/pam.d/gdm-welcome
lrwxrwxrwx 1 root root 14 Feb 4 2015 /etc/pam.d/gdm-welcome -> gdm3-autologin
# dpkg -S /etc/pam.d/gdm3-autologin
gdm3: /etc/pam.d/gdm3-autologin