RHEL 9.0.0 Alpha bootstrap
The content of this branch was automatically imported from Fedora ELN with the following as its source: https://src.fedoraproject.org/rpms/shadow-utils#9f643a301165a0b1bb1fcb7b9c425809d5791a2f
This commit is contained in:
parent
8c347fedcc
commit
4b110147f6
16
.gitignore
vendored
16
.gitignore
vendored
@ -0,0 +1,16 @@
|
|||||||
|
shadow-4.1.4.2.tar.bz2
|
||||||
|
/shadow-4.1.4.3.tar.bz2
|
||||||
|
/shadow-4.1.5.tar.bz2
|
||||||
|
/shadow-4.1.5.1.tar.bz2
|
||||||
|
/shadow-4.1.5.1.tar.bz2.sig
|
||||||
|
/shadow-4.2.1.tar.xz
|
||||||
|
/shadow-4.2.1.tar.xz.sig
|
||||||
|
/shadow-4.3.1.tar.gz
|
||||||
|
/shadow-4.5.tar.xz
|
||||||
|
/shadow-4.5.tar.xz.asc
|
||||||
|
/shadow-4.6.tar.xz
|
||||||
|
/shadow-4.6.tar.xz.asc
|
||||||
|
/shadow-4.8.tar.xz
|
||||||
|
/shadow-4.8.tar.xz.asc
|
||||||
|
/shadow-4.8.1.tar.xz
|
||||||
|
/shadow-4.8.1.tar.xz.asc
|
339
gpl-2.0.txt
Normal file
339
gpl-2.0.txt
Normal file
@ -0,0 +1,339 @@
|
|||||||
|
GNU GENERAL PUBLIC LICENSE
|
||||||
|
Version 2, June 1991
|
||||||
|
|
||||||
|
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||||
|
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||||
|
Everyone is permitted to copy and distribute verbatim copies
|
||||||
|
of this license document, but changing it is not allowed.
|
||||||
|
|
||||||
|
Preamble
|
||||||
|
|
||||||
|
The licenses for most software are designed to take away your
|
||||||
|
freedom to share and change it. By contrast, the GNU General Public
|
||||||
|
License is intended to guarantee your freedom to share and change free
|
||||||
|
software--to make sure the software is free for all its users. This
|
||||||
|
General Public License applies to most of the Free Software
|
||||||
|
Foundation's software and to any other program whose authors commit to
|
||||||
|
using it. (Some other Free Software Foundation software is covered by
|
||||||
|
the GNU Lesser General Public License instead.) You can apply it to
|
||||||
|
your programs, too.
|
||||||
|
|
||||||
|
When we speak of free software, we are referring to freedom, not
|
||||||
|
price. Our General Public Licenses are designed to make sure that you
|
||||||
|
have the freedom to distribute copies of free software (and charge for
|
||||||
|
this service if you wish), that you receive source code or can get it
|
||||||
|
if you want it, that you can change the software or use pieces of it
|
||||||
|
in new free programs; and that you know you can do these things.
|
||||||
|
|
||||||
|
To protect your rights, we need to make restrictions that forbid
|
||||||
|
anyone to deny you these rights or to ask you to surrender the rights.
|
||||||
|
These restrictions translate to certain responsibilities for you if you
|
||||||
|
distribute copies of the software, or if you modify it.
|
||||||
|
|
||||||
|
For example, if you distribute copies of such a program, whether
|
||||||
|
gratis or for a fee, you must give the recipients all the rights that
|
||||||
|
you have. You must make sure that they, too, receive or can get the
|
||||||
|
source code. And you must show them these terms so they know their
|
||||||
|
rights.
|
||||||
|
|
||||||
|
We protect your rights with two steps: (1) copyright the software, and
|
||||||
|
(2) offer you this license which gives you legal permission to copy,
|
||||||
|
distribute and/or modify the software.
|
||||||
|
|
||||||
|
Also, for each author's protection and ours, we want to make certain
|
||||||
|
that everyone understands that there is no warranty for this free
|
||||||
|
software. If the software is modified by someone else and passed on, we
|
||||||
|
want its recipients to know that what they have is not the original, so
|
||||||
|
that any problems introduced by others will not reflect on the original
|
||||||
|
authors' reputations.
|
||||||
|
|
||||||
|
Finally, any free program is threatened constantly by software
|
||||||
|
patents. We wish to avoid the danger that redistributors of a free
|
||||||
|
program will individually obtain patent licenses, in effect making the
|
||||||
|
program proprietary. To prevent this, we have made it clear that any
|
||||||
|
patent must be licensed for everyone's free use or not licensed at all.
|
||||||
|
|
||||||
|
The precise terms and conditions for copying, distribution and
|
||||||
|
modification follow.
|
||||||
|
|
||||||
|
GNU GENERAL PUBLIC LICENSE
|
||||||
|
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||||
|
|
||||||
|
0. This License applies to any program or other work which contains
|
||||||
|
a notice placed by the copyright holder saying it may be distributed
|
||||||
|
under the terms of this General Public License. The "Program", below,
|
||||||
|
refers to any such program or work, and a "work based on the Program"
|
||||||
|
means either the Program or any derivative work under copyright law:
|
||||||
|
that is to say, a work containing the Program or a portion of it,
|
||||||
|
either verbatim or with modifications and/or translated into another
|
||||||
|
language. (Hereinafter, translation is included without limitation in
|
||||||
|
the term "modification".) Each licensee is addressed as "you".
|
||||||
|
|
||||||
|
Activities other than copying, distribution and modification are not
|
||||||
|
covered by this License; they are outside its scope. The act of
|
||||||
|
running the Program is not restricted, and the output from the Program
|
||||||
|
is covered only if its contents constitute a work based on the
|
||||||
|
Program (independent of having been made by running the Program).
|
||||||
|
Whether that is true depends on what the Program does.
|
||||||
|
|
||||||
|
1. You may copy and distribute verbatim copies of the Program's
|
||||||
|
source code as you receive it, in any medium, provided that you
|
||||||
|
conspicuously and appropriately publish on each copy an appropriate
|
||||||
|
copyright notice and disclaimer of warranty; keep intact all the
|
||||||
|
notices that refer to this License and to the absence of any warranty;
|
||||||
|
and give any other recipients of the Program a copy of this License
|
||||||
|
along with the Program.
|
||||||
|
|
||||||
|
You may charge a fee for the physical act of transferring a copy, and
|
||||||
|
you may at your option offer warranty protection in exchange for a fee.
|
||||||
|
|
||||||
|
2. You may modify your copy or copies of the Program or any portion
|
||||||
|
of it, thus forming a work based on the Program, and copy and
|
||||||
|
distribute such modifications or work under the terms of Section 1
|
||||||
|
above, provided that you also meet all of these conditions:
|
||||||
|
|
||||||
|
a) You must cause the modified files to carry prominent notices
|
||||||
|
stating that you changed the files and the date of any change.
|
||||||
|
|
||||||
|
b) You must cause any work that you distribute or publish, that in
|
||||||
|
whole or in part contains or is derived from the Program or any
|
||||||
|
part thereof, to be licensed as a whole at no charge to all third
|
||||||
|
parties under the terms of this License.
|
||||||
|
|
||||||
|
c) If the modified program normally reads commands interactively
|
||||||
|
when run, you must cause it, when started running for such
|
||||||
|
interactive use in the most ordinary way, to print or display an
|
||||||
|
announcement including an appropriate copyright notice and a
|
||||||
|
notice that there is no warranty (or else, saying that you provide
|
||||||
|
a warranty) and that users may redistribute the program under
|
||||||
|
these conditions, and telling the user how to view a copy of this
|
||||||
|
License. (Exception: if the Program itself is interactive but
|
||||||
|
does not normally print such an announcement, your work based on
|
||||||
|
the Program is not required to print an announcement.)
|
||||||
|
|
||||||
|
These requirements apply to the modified work as a whole. If
|
||||||
|
identifiable sections of that work are not derived from the Program,
|
||||||
|
and can be reasonably considered independent and separate works in
|
||||||
|
themselves, then this License, and its terms, do not apply to those
|
||||||
|
sections when you distribute them as separate works. But when you
|
||||||
|
distribute the same sections as part of a whole which is a work based
|
||||||
|
on the Program, the distribution of the whole must be on the terms of
|
||||||
|
this License, whose permissions for other licensees extend to the
|
||||||
|
entire whole, and thus to each and every part regardless of who wrote it.
|
||||||
|
|
||||||
|
Thus, it is not the intent of this section to claim rights or contest
|
||||||
|
your rights to work written entirely by you; rather, the intent is to
|
||||||
|
exercise the right to control the distribution of derivative or
|
||||||
|
collective works based on the Program.
|
||||||
|
|
||||||
|
In addition, mere aggregation of another work not based on the Program
|
||||||
|
with the Program (or with a work based on the Program) on a volume of
|
||||||
|
a storage or distribution medium does not bring the other work under
|
||||||
|
the scope of this License.
|
||||||
|
|
||||||
|
3. You may copy and distribute the Program (or a work based on it,
|
||||||
|
under Section 2) in object code or executable form under the terms of
|
||||||
|
Sections 1 and 2 above provided that you also do one of the following:
|
||||||
|
|
||||||
|
a) Accompany it with the complete corresponding machine-readable
|
||||||
|
source code, which must be distributed under the terms of Sections
|
||||||
|
1 and 2 above on a medium customarily used for software interchange; or,
|
||||||
|
|
||||||
|
b) Accompany it with a written offer, valid for at least three
|
||||||
|
years, to give any third party, for a charge no more than your
|
||||||
|
cost of physically performing source distribution, a complete
|
||||||
|
machine-readable copy of the corresponding source code, to be
|
||||||
|
distributed under the terms of Sections 1 and 2 above on a medium
|
||||||
|
customarily used for software interchange; or,
|
||||||
|
|
||||||
|
c) Accompany it with the information you received as to the offer
|
||||||
|
to distribute corresponding source code. (This alternative is
|
||||||
|
allowed only for noncommercial distribution and only if you
|
||||||
|
received the program in object code or executable form with such
|
||||||
|
an offer, in accord with Subsection b above.)
|
||||||
|
|
||||||
|
The source code for a work means the preferred form of the work for
|
||||||
|
making modifications to it. For an executable work, complete source
|
||||||
|
code means all the source code for all modules it contains, plus any
|
||||||
|
associated interface definition files, plus the scripts used to
|
||||||
|
control compilation and installation of the executable. However, as a
|
||||||
|
special exception, the source code distributed need not include
|
||||||
|
anything that is normally distributed (in either source or binary
|
||||||
|
form) with the major components (compiler, kernel, and so on) of the
|
||||||
|
operating system on which the executable runs, unless that component
|
||||||
|
itself accompanies the executable.
|
||||||
|
|
||||||
|
If distribution of executable or object code is made by offering
|
||||||
|
access to copy from a designated place, then offering equivalent
|
||||||
|
access to copy the source code from the same place counts as
|
||||||
|
distribution of the source code, even though third parties are not
|
||||||
|
compelled to copy the source along with the object code.
|
||||||
|
|
||||||
|
4. You may not copy, modify, sublicense, or distribute the Program
|
||||||
|
except as expressly provided under this License. Any attempt
|
||||||
|
otherwise to copy, modify, sublicense or distribute the Program is
|
||||||
|
void, and will automatically terminate your rights under this License.
|
||||||
|
However, parties who have received copies, or rights, from you under
|
||||||
|
this License will not have their licenses terminated so long as such
|
||||||
|
parties remain in full compliance.
|
||||||
|
|
||||||
|
5. You are not required to accept this License, since you have not
|
||||||
|
signed it. However, nothing else grants you permission to modify or
|
||||||
|
distribute the Program or its derivative works. These actions are
|
||||||
|
prohibited by law if you do not accept this License. Therefore, by
|
||||||
|
modifying or distributing the Program (or any work based on the
|
||||||
|
Program), you indicate your acceptance of this License to do so, and
|
||||||
|
all its terms and conditions for copying, distributing or modifying
|
||||||
|
the Program or works based on it.
|
||||||
|
|
||||||
|
6. Each time you redistribute the Program (or any work based on the
|
||||||
|
Program), the recipient automatically receives a license from the
|
||||||
|
original licensor to copy, distribute or modify the Program subject to
|
||||||
|
these terms and conditions. You may not impose any further
|
||||||
|
restrictions on the recipients' exercise of the rights granted herein.
|
||||||
|
You are not responsible for enforcing compliance by third parties to
|
||||||
|
this License.
|
||||||
|
|
||||||
|
7. If, as a consequence of a court judgment or allegation of patent
|
||||||
|
infringement or for any other reason (not limited to patent issues),
|
||||||
|
conditions are imposed on you (whether by court order, agreement or
|
||||||
|
otherwise) that contradict the conditions of this License, they do not
|
||||||
|
excuse you from the conditions of this License. If you cannot
|
||||||
|
distribute so as to satisfy simultaneously your obligations under this
|
||||||
|
License and any other pertinent obligations, then as a consequence you
|
||||||
|
may not distribute the Program at all. For example, if a patent
|
||||||
|
license would not permit royalty-free redistribution of the Program by
|
||||||
|
all those who receive copies directly or indirectly through you, then
|
||||||
|
the only way you could satisfy both it and this License would be to
|
||||||
|
refrain entirely from distribution of the Program.
|
||||||
|
|
||||||
|
If any portion of this section is held invalid or unenforceable under
|
||||||
|
any particular circumstance, the balance of the section is intended to
|
||||||
|
apply and the section as a whole is intended to apply in other
|
||||||
|
circumstances.
|
||||||
|
|
||||||
|
It is not the purpose of this section to induce you to infringe any
|
||||||
|
patents or other property right claims or to contest validity of any
|
||||||
|
such claims; this section has the sole purpose of protecting the
|
||||||
|
integrity of the free software distribution system, which is
|
||||||
|
implemented by public license practices. Many people have made
|
||||||
|
generous contributions to the wide range of software distributed
|
||||||
|
through that system in reliance on consistent application of that
|
||||||
|
system; it is up to the author/donor to decide if he or she is willing
|
||||||
|
to distribute software through any other system and a licensee cannot
|
||||||
|
impose that choice.
|
||||||
|
|
||||||
|
This section is intended to make thoroughly clear what is believed to
|
||||||
|
be a consequence of the rest of this License.
|
||||||
|
|
||||||
|
8. If the distribution and/or use of the Program is restricted in
|
||||||
|
certain countries either by patents or by copyrighted interfaces, the
|
||||||
|
original copyright holder who places the Program under this License
|
||||||
|
may add an explicit geographical distribution limitation excluding
|
||||||
|
those countries, so that distribution is permitted only in or among
|
||||||
|
countries not thus excluded. In such case, this License incorporates
|
||||||
|
the limitation as if written in the body of this License.
|
||||||
|
|
||||||
|
9. The Free Software Foundation may publish revised and/or new versions
|
||||||
|
of the General Public License from time to time. Such new versions will
|
||||||
|
be similar in spirit to the present version, but may differ in detail to
|
||||||
|
address new problems or concerns.
|
||||||
|
|
||||||
|
Each version is given a distinguishing version number. If the Program
|
||||||
|
specifies a version number of this License which applies to it and "any
|
||||||
|
later version", you have the option of following the terms and conditions
|
||||||
|
either of that version or of any later version published by the Free
|
||||||
|
Software Foundation. If the Program does not specify a version number of
|
||||||
|
this License, you may choose any version ever published by the Free Software
|
||||||
|
Foundation.
|
||||||
|
|
||||||
|
10. If you wish to incorporate parts of the Program into other free
|
||||||
|
programs whose distribution conditions are different, write to the author
|
||||||
|
to ask for permission. For software which is copyrighted by the Free
|
||||||
|
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||||
|
make exceptions for this. Our decision will be guided by the two goals
|
||||||
|
of preserving the free status of all derivatives of our free software and
|
||||||
|
of promoting the sharing and reuse of software generally.
|
||||||
|
|
||||||
|
NO WARRANTY
|
||||||
|
|
||||||
|
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||||
|
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||||
|
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||||
|
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||||
|
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||||
|
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||||
|
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||||
|
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||||
|
REPAIR OR CORRECTION.
|
||||||
|
|
||||||
|
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||||
|
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||||
|
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||||
|
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||||
|
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||||
|
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||||
|
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||||
|
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||||
|
POSSIBILITY OF SUCH DAMAGES.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
How to Apply These Terms to Your New Programs
|
||||||
|
|
||||||
|
If you develop a new program, and you want it to be of the greatest
|
||||||
|
possible use to the public, the best way to achieve this is to make it
|
||||||
|
free software which everyone can redistribute and change under these terms.
|
||||||
|
|
||||||
|
To do so, attach the following notices to the program. It is safest
|
||||||
|
to attach them to the start of each source file to most effectively
|
||||||
|
convey the exclusion of warranty; and each file should have at least
|
||||||
|
the "copyright" line and a pointer to where the full notice is found.
|
||||||
|
|
||||||
|
<one line to give the program's name and a brief idea of what it does.>
|
||||||
|
Copyright (C) <year> <name of author>
|
||||||
|
|
||||||
|
This program is free software; you can redistribute it and/or modify
|
||||||
|
it under the terms of the GNU General Public License as published by
|
||||||
|
the Free Software Foundation; either version 2 of the License, or
|
||||||
|
(at your option) any later version.
|
||||||
|
|
||||||
|
This program is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
GNU General Public License for more details.
|
||||||
|
|
||||||
|
You should have received a copy of the GNU General Public License along
|
||||||
|
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||||
|
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||||
|
|
||||||
|
Also add information on how to contact you by electronic and paper mail.
|
||||||
|
|
||||||
|
If the program is interactive, make it output a short notice like this
|
||||||
|
when it starts in an interactive mode:
|
||||||
|
|
||||||
|
Gnomovision version 69, Copyright (C) year name of author
|
||||||
|
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||||
|
This is free software, and you are welcome to redistribute it
|
||||||
|
under certain conditions; type `show c' for details.
|
||||||
|
|
||||||
|
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||||
|
parts of the General Public License. Of course, the commands you use may
|
||||||
|
be called something other than `show w' and `show c'; they could even be
|
||||||
|
mouse-clicks or menu items--whatever suits your program.
|
||||||
|
|
||||||
|
You should also get your employer (if you work as a programmer) or your
|
||||||
|
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||||
|
necessary. Here is a sample; alter the names:
|
||||||
|
|
||||||
|
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||||
|
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||||
|
|
||||||
|
<signature of Ty Coon>, 1 April 1989
|
||||||
|
Ty Coon, President of Vice
|
||||||
|
|
||||||
|
This General Public License does not permit incorporating your program into
|
||||||
|
proprietary programs. If your program is a subroutine library, you may
|
||||||
|
consider it more useful to permit linking proprietary applications with the
|
||||||
|
library. If this is what you want to do, use the GNU Lesser General
|
||||||
|
Public License instead of this License.
|
36
shadow-4.1.5.1-default-range.patch
Normal file
36
shadow-4.1.5.1-default-range.patch
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
Index: shadow-4.5/lib/semanage.c
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/lib/semanage.c
|
||||||
|
+++ shadow-4.5/lib/semanage.c
|
||||||
|
@@ -143,6 +143,7 @@ static int semanage_user_mod (semanage_h
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
|
||||||
|
+#if 0
|
||||||
|
ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
|
||||||
|
if (ret != 0) {
|
||||||
|
fprintf (stderr,
|
||||||
|
@@ -150,6 +151,7 @@ static int semanage_user_mod (semanage_h
|
||||||
|
ret = 1;
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
+#endif
|
||||||
|
|
||||||
|
ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
|
||||||
|
if (ret != 0) {
|
||||||
|
@@ -200,6 +202,7 @@ static int semanage_user_add (semanage_h
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
|
||||||
|
+#if 0
|
||||||
|
ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
|
||||||
|
if (ret != 0) {
|
||||||
|
fprintf (stderr,
|
||||||
|
@@ -208,6 +211,7 @@ static int semanage_user_add (semanage_h
|
||||||
|
ret = 1;
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
+#endif
|
||||||
|
|
||||||
|
ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
|
||||||
|
if (ret != 0) {
|
21
shadow-4.1.5.1-info-parent-dir.patch
Normal file
21
shadow-4.1.5.1-info-parent-dir.patch
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
Index: shadow-4.5/man/newusers.8.xml
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/man/newusers.8.xml
|
||||||
|
+++ shadow-4.5/man/newusers.8.xml
|
||||||
|
@@ -218,7 +218,15 @@
|
||||||
|
<para>
|
||||||
|
If this field does not specify an existing directory, the
|
||||||
|
specified directory is created, with ownership set to the
|
||||||
|
- user being created or updated and its primary group.
|
||||||
|
+ user being created or updated and its primary group. Note
|
||||||
|
+ that newusers does not create parent directories of the new
|
||||||
|
+ user's home directory. The newusers command will fail to
|
||||||
|
+ create the home directory if the parent directories do not
|
||||||
|
+ exist, and will send a message to stderr informing the user
|
||||||
|
+ of the failure. The newusers command will not halt or return
|
||||||
|
+ a failure to the calling shell if it fails to create the home
|
||||||
|
+ directory, it will continue to process the batch of new users
|
||||||
|
+ specified.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
If the home directory of an existing user is changed,
|
13
shadow-4.1.5.1-logmsg.patch
Normal file
13
shadow-4.1.5.1-logmsg.patch
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
Index: shadow-4.5/src/useradd.c
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/src/useradd.c
|
||||||
|
+++ shadow-4.5/src/useradd.c
|
||||||
|
@@ -323,7 +323,7 @@ static void fail_exit (int code)
|
||||||
|
user_name, AUDIT_NO_ID,
|
||||||
|
SHADOW_AUDIT_FAILURE);
|
||||||
|
#endif
|
||||||
|
- SYSLOG ((LOG_INFO, "failed adding user '%s', data deleted", user_name));
|
||||||
|
+ SYSLOG ((LOG_INFO, "failed adding user '%s', exit code: %d", user_name, code));
|
||||||
|
exit (code);
|
||||||
|
}
|
||||||
|
|
16
shadow-4.1.5.1-userdel-helpfix.patch
Normal file
16
shadow-4.1.5.1-userdel-helpfix.patch
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
Index: shadow-4.5/src/userdel.c
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/src/userdel.c
|
||||||
|
+++ shadow-4.5/src/userdel.c
|
||||||
|
@@ -143,8 +143,9 @@ static void usage (int status)
|
||||||
|
"\n"
|
||||||
|
"Options:\n"),
|
||||||
|
Prog);
|
||||||
|
- (void) fputs (_(" -f, --force force removal of files,\n"
|
||||||
|
- " even if not owned by user\n"),
|
||||||
|
+ (void) fputs (_(" -f, --force force some actions that would fail otherwise\n"
|
||||||
|
+ " e.g. removal of user still logged in\n"
|
||||||
|
+ " or files, even if not owned by the user\n"),
|
||||||
|
usageout);
|
||||||
|
(void) fputs (_(" -h, --help display this help message and exit\n"), usageout);
|
||||||
|
(void) fputs (_(" -r, --remove remove home directory and mail spool\n"), usageout);
|
69
shadow-4.2.1-date-parsing.patch
Normal file
69
shadow-4.2.1-date-parsing.patch
Normal file
@ -0,0 +1,69 @@
|
|||||||
|
Index: shadow-4.5/libmisc/getdate.y
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/libmisc/getdate.y
|
||||||
|
+++ shadow-4.5/libmisc/getdate.y
|
||||||
|
@@ -152,6 +152,7 @@ static int yyHaveDay;
|
||||||
|
static int yyHaveRel;
|
||||||
|
static int yyHaveTime;
|
||||||
|
static int yyHaveZone;
|
||||||
|
+static int yyHaveYear;
|
||||||
|
static int yyTimezone;
|
||||||
|
static int yyDay;
|
||||||
|
static int yyHour;
|
||||||
|
@@ -293,18 +294,21 @@ date : tUNUMBER '/' tUNUMBER {
|
||||||
|
yyDay = $3;
|
||||||
|
yyYear = $5;
|
||||||
|
}
|
||||||
|
+ yyHaveYear++;
|
||||||
|
}
|
||||||
|
| tUNUMBER tSNUMBER tSNUMBER {
|
||||||
|
/* ISO 8601 format. yyyy-mm-dd. */
|
||||||
|
yyYear = $1;
|
||||||
|
yyMonth = -$2;
|
||||||
|
yyDay = -$3;
|
||||||
|
+ yyHaveYear++;
|
||||||
|
}
|
||||||
|
| tUNUMBER tMONTH tSNUMBER {
|
||||||
|
/* e.g. 17-JUN-1992. */
|
||||||
|
yyDay = $1;
|
||||||
|
yyMonth = $2;
|
||||||
|
yyYear = -$3;
|
||||||
|
+ yyHaveYear++;
|
||||||
|
}
|
||||||
|
| tMONTH tUNUMBER {
|
||||||
|
yyMonth = $1;
|
||||||
|
@@ -314,6 +318,7 @@ date : tUNUMBER '/' tUNUMBER {
|
||||||
|
yyMonth = $1;
|
||||||
|
yyDay = $2;
|
||||||
|
yyYear = $4;
|
||||||
|
+ yyHaveYear++;
|
||||||
|
}
|
||||||
|
| tUNUMBER tMONTH {
|
||||||
|
yyMonth = $2;
|
||||||
|
@@ -323,6 +328,7 @@ date : tUNUMBER '/' tUNUMBER {
|
||||||
|
yyMonth = $2;
|
||||||
|
yyDay = $1;
|
||||||
|
yyYear = $3;
|
||||||
|
+ yyHaveYear++;
|
||||||
|
}
|
||||||
|
;
|
||||||
|
|
||||||
|
@@ -395,7 +401,8 @@ relunit : tUNUMBER tYEAR_UNIT {
|
||||||
|
|
||||||
|
number : tUNUMBER
|
||||||
|
{
|
||||||
|
- if ((yyHaveTime != 0) && (yyHaveDate != 0) && (yyHaveRel == 0))
|
||||||
|
+ if ((yyHaveTime != 0 || $1 >= 100) && !yyHaveYear
|
||||||
|
+ && (yyHaveDate != 0) && (yyHaveRel == 0))
|
||||||
|
yyYear = $1;
|
||||||
|
else
|
||||||
|
{
|
||||||
|
@@ -802,7 +809,7 @@ yylex (void)
|
||||||
|
return LookupWord (buff);
|
||||||
|
}
|
||||||
|
if (c != '(')
|
||||||
|
- return *yyInput++;
|
||||||
|
+ return (unsigned char)*yyInput++;
|
||||||
|
Count = 0;
|
||||||
|
do
|
||||||
|
{
|
91
shadow-4.2.1-null-tm.patch
Normal file
91
shadow-4.2.1-null-tm.patch
Normal file
@ -0,0 +1,91 @@
|
|||||||
|
Index: shadow-4.5/src/faillog.c
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/src/faillog.c
|
||||||
|
+++ shadow-4.5/src/faillog.c
|
||||||
|
@@ -163,10 +163,14 @@ static void print_one (/*@null@*/const s
|
||||||
|
}
|
||||||
|
|
||||||
|
tm = localtime (&fl.fail_time);
|
||||||
|
+ if (tm == NULL) {
|
||||||
|
+ cp = "(unknown)";
|
||||||
|
+ } else {
|
||||||
|
#ifdef HAVE_STRFTIME
|
||||||
|
- strftime (ptime, sizeof (ptime), "%D %H:%M:%S %z", tm);
|
||||||
|
- cp = ptime;
|
||||||
|
+ strftime (ptime, sizeof (ptime), "%D %H:%M:%S %z", tm);
|
||||||
|
+ cp = ptime;
|
||||||
|
#endif
|
||||||
|
+ }
|
||||||
|
printf ("%-9s %5d %5d ",
|
||||||
|
pw->pw_name, fl.fail_cnt, fl.fail_max);
|
||||||
|
/* FIXME: cp is not defined ifndef HAVE_STRFTIME */
|
||||||
|
Index: shadow-4.5/src/chage.c
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/src/chage.c
|
||||||
|
+++ shadow-4.5/src/chage.c
|
||||||
|
@@ -168,6 +168,10 @@ static void date_to_str (char *buf, size
|
||||||
|
struct tm *tp;
|
||||||
|
|
||||||
|
tp = gmtime (&date);
|
||||||
|
+ if (tp == NULL) {
|
||||||
|
+ (void) snprintf (buf, maxsize, "(unknown)");
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
#ifdef HAVE_STRFTIME
|
||||||
|
(void) strftime (buf, maxsize, "%Y-%m-%d", tp);
|
||||||
|
#else
|
||||||
|
Index: shadow-4.5/src/lastlog.c
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/src/lastlog.c
|
||||||
|
+++ shadow-4.5/src/lastlog.c
|
||||||
|
@@ -158,13 +158,17 @@ static void print_one (/*@null@*/const s
|
||||||
|
|
||||||
|
ll_time = ll.ll_time;
|
||||||
|
tm = localtime (&ll_time);
|
||||||
|
+ if (tm == NULL) {
|
||||||
|
+ cp = "(unknown)";
|
||||||
|
+ } else {
|
||||||
|
#ifdef HAVE_STRFTIME
|
||||||
|
- strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
|
||||||
|
- cp = ptime;
|
||||||
|
+ strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
|
||||||
|
+ cp = ptime;
|
||||||
|
#else
|
||||||
|
- cp = asctime (tm);
|
||||||
|
- cp[24] = '\0';
|
||||||
|
+ cp = asctime (tm);
|
||||||
|
+ cp[24] = '\0';
|
||||||
|
#endif
|
||||||
|
+ }
|
||||||
|
|
||||||
|
if (ll.ll_time == (time_t) 0) {
|
||||||
|
cp = _("**Never logged in**\0");
|
||||||
|
Index: shadow-4.5/src/passwd.c
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/src/passwd.c
|
||||||
|
+++ shadow-4.5/src/passwd.c
|
||||||
|
@@ -455,6 +455,9 @@ static /*@observer@*/const char *date_to
|
||||||
|
struct tm *tm;
|
||||||
|
|
||||||
|
tm = gmtime (&t);
|
||||||
|
+ if (tm == NULL) {
|
||||||
|
+ return "(unknown)";
|
||||||
|
+ }
|
||||||
|
#ifdef HAVE_STRFTIME
|
||||||
|
(void) strftime (buf, sizeof buf, "%m/%d/%Y", tm);
|
||||||
|
#else /* !HAVE_STRFTIME */
|
||||||
|
Index: shadow-4.5/src/usermod.c
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/src/usermod.c
|
||||||
|
+++ shadow-4.5/src/usermod.c
|
||||||
|
@@ -210,6 +210,10 @@ static void date_to_str (/*@unique@*//*@
|
||||||
|
} else {
|
||||||
|
time_t t = (time_t) date;
|
||||||
|
tp = gmtime (&t);
|
||||||
|
+ if (tp == NULL) {
|
||||||
|
+ strncpy (buf, "unknown", maxsize);
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
#ifdef HAVE_STRFTIME
|
||||||
|
strftime (buf, maxsize, "%Y-%m-%d", tp);
|
||||||
|
#else
|
64
shadow-4.5-usermod-unlock.patch
Normal file
64
shadow-4.5-usermod-unlock.patch
Normal file
@ -0,0 +1,64 @@
|
|||||||
|
Index: shadow-4.5/src/usermod.c
|
||||||
|
===================================================================
|
||||||
|
--- shadow-4.5.orig/src/usermod.c
|
||||||
|
+++ shadow-4.5/src/usermod.c
|
||||||
|
@@ -455,14 +455,17 @@ static char *new_pw_passwd (char *pw_pas
|
||||||
|
strcat (buf, pw_pass);
|
||||||
|
pw_pass = buf;
|
||||||
|
} else if (Uflg && pw_pass[0] == '!') {
|
||||||
|
- char *s;
|
||||||
|
+ char *s = pw_pass;
|
||||||
|
|
||||||
|
- if (pw_pass[1] == '\0') {
|
||||||
|
+ while ('!' == *s)
|
||||||
|
+ ++s;
|
||||||
|
+
|
||||||
|
+ if (*s == '\0') {
|
||||||
|
fprintf (stderr,
|
||||||
|
_("%s: unlocking the user's password would result in a passwordless account.\n"
|
||||||
|
"You should set a password with usermod -p to unlock this user's password.\n"),
|
||||||
|
Prog);
|
||||||
|
- return pw_pass;
|
||||||
|
+ return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
#ifdef WITH_AUDIT
|
||||||
|
@@ -471,12 +474,15 @@ static char *new_pw_passwd (char *pw_pas
|
||||||
|
user_newname, (unsigned int) user_newid, 1);
|
||||||
|
#endif
|
||||||
|
SYSLOG ((LOG_INFO, "unlock user '%s' password", user_newname));
|
||||||
|
- s = pw_pass;
|
||||||
|
- while ('\0' != *s) {
|
||||||
|
- *s = *(s + 1);
|
||||||
|
- s++;
|
||||||
|
- }
|
||||||
|
+ memmove (pw_pass, s, strlen (s) + 1);
|
||||||
|
} else if (pflg) {
|
||||||
|
+ if (strchr (user_pass, ':') != NULL) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: The password field cannot contain a colon character.\n"),
|
||||||
|
+ Prog);
|
||||||
|
+ return NULL;
|
||||||
|
+
|
||||||
|
+ }
|
||||||
|
#ifdef WITH_AUDIT
|
||||||
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
||||||
|
"updating-password",
|
||||||
|
@@ -525,6 +531,8 @@ static void new_pwent (struct passwd *pw
|
||||||
|
if ( (!is_shadow_pwd)
|
||||||
|
|| (strcmp (pwent->pw_passwd, SHADOW_PASSWD_STRING) != 0)) {
|
||||||
|
pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd);
|
||||||
|
+ if (pwent->pw_passwd == NULL)
|
||||||
|
+ fail_exit (E_PW_UPDATE);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (uflg) {
|
||||||
|
@@ -639,6 +647,8 @@ static void new_spent (struct spwd *spen
|
||||||
|
* + aging has been requested
|
||||||
|
*/
|
||||||
|
spent->sp_pwdp = new_pw_passwd (spent->sp_pwdp);
|
||||||
|
+ if (spent->sp_pwdp == NULL)
|
||||||
|
+ fail_exit(E_PW_UPDATE);
|
||||||
|
|
||||||
|
if (pflg) {
|
||||||
|
spent->sp_lstchg = (long) gettime () / SCALE;
|
21
shadow-4.6-getenforce.patch
Normal file
21
shadow-4.6-getenforce.patch
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
diff -up shadow-4.6/lib/selinux.c.getenforce shadow-4.6/lib/selinux.c
|
||||||
|
--- shadow-4.6/lib/selinux.c.getenforce 2018-05-28 15:10:15.870315221 +0200
|
||||||
|
+++ shadow-4.6/lib/selinux.c 2018-05-28 15:10:15.894315731 +0200
|
||||||
|
@@ -75,7 +75,7 @@ int set_selinux_file_context (const char
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
error:
|
||||||
|
- if (security_getenforce () != 0) {
|
||||||
|
+ if (security_getenforce () > 0) {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
@@ -95,7 +95,7 @@ int reset_selinux_file_context (void)
|
||||||
|
selinux_checked = true;
|
||||||
|
}
|
||||||
|
if (selinux_enabled) {
|
||||||
|
- if (setfscreatecon (NULL) != 0) {
|
||||||
|
+ if (setfscreatecon (NULL) != 0 && security_getenforce () > 0) {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
}
|
15
shadow-4.6-move-home.patch
Normal file
15
shadow-4.6-move-home.patch
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
diff -up shadow-4.6/src/usermod.c.move-home shadow-4.6/src/usermod.c
|
||||||
|
--- shadow-4.6/src/usermod.c.move-home 2018-05-28 14:59:05.594076665 +0200
|
||||||
|
+++ shadow-4.6/src/usermod.c 2018-05-28 15:00:28.479837392 +0200
|
||||||
|
@@ -1845,6 +1845,11 @@ static void move_home (void)
|
||||||
|
Prog, prefix_user_home, prefix_user_newhome);
|
||||||
|
fail_exit (E_HOMEDIR);
|
||||||
|
}
|
||||||
|
+ } else {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: The previous home directory (%s) does "
|
||||||
|
+ "not exist or is inaccessible. Move cannot be completed.\n"),
|
||||||
|
+ Prog, prefix_user_home);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
41
shadow-4.6-redhat.patch
Normal file
41
shadow-4.6-redhat.patch
Normal file
@ -0,0 +1,41 @@
|
|||||||
|
diff -up shadow-4.6/src/useradd.c.redhat shadow-4.6/src/useradd.c
|
||||||
|
--- shadow-4.6/src/useradd.c.redhat 2018-04-29 18:42:37.000000000 +0200
|
||||||
|
+++ shadow-4.6/src/useradd.c 2018-05-28 13:37:16.695651258 +0200
|
||||||
|
@@ -98,7 +98,7 @@ const char *Prog;
|
||||||
|
static gid_t def_group = 100;
|
||||||
|
static const char *def_gname = "other";
|
||||||
|
static const char *def_home = "/home";
|
||||||
|
-static const char *def_shell = "";
|
||||||
|
+static const char *def_shell = "/sbin/nologin";
|
||||||
|
static const char *def_template = SKEL_DIR;
|
||||||
|
static const char *def_create_mail_spool = "no";
|
||||||
|
|
||||||
|
@@ -108,7 +108,7 @@ static const char *def_expire = "";
|
||||||
|
#define VALID(s) (strcspn (s, ":\n") == strlen (s))
|
||||||
|
|
||||||
|
static const char *user_name = "";
|
||||||
|
-static const char *user_pass = "!";
|
||||||
|
+static const char *user_pass = "!!";
|
||||||
|
static uid_t user_id;
|
||||||
|
static gid_t user_gid;
|
||||||
|
static const char *user_comment = "";
|
||||||
|
@@ -1114,9 +1114,9 @@ static void process_flags (int argc, cha
|
||||||
|
};
|
||||||
|
while ((c = getopt_long (argc, argv,
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
- "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:UZ:",
|
||||||
|
+ "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:UZ:",
|
||||||
|
#else /* !WITH_SELINUX */
|
||||||
|
- "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:U",
|
||||||
|
+ "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:U",
|
||||||
|
#endif /* !WITH_SELINUX */
|
||||||
|
long_options, NULL)) != -1) {
|
||||||
|
switch (c) {
|
||||||
|
@@ -1267,6 +1267,7 @@ static void process_flags (int argc, cha
|
||||||
|
case 'M':
|
||||||
|
Mflg = true;
|
||||||
|
break;
|
||||||
|
+ case 'n':
|
||||||
|
case 'N':
|
||||||
|
Nflg = true;
|
||||||
|
break;
|
34
shadow-4.6-sysugid-min-limit.patch
Normal file
34
shadow-4.6-sysugid-min-limit.patch
Normal file
@ -0,0 +1,34 @@
|
|||||||
|
diff -up shadow-4.6/libmisc/find_new_gid.c.min-limit shadow-4.6/libmisc/find_new_gid.c
|
||||||
|
--- shadow-4.6/libmisc/find_new_gid.c.min-limit 2018-04-29 18:42:37.000000001 +0200
|
||||||
|
+++ shadow-4.6/libmisc/find_new_gid.c 2018-11-06 10:51:20.554963292 +0100
|
||||||
|
@@ -82,6 +82,13 @@ static int get_ranges (bool sys_group, g
|
||||||
|
(unsigned long) *max_id);
|
||||||
|
return EINVAL;
|
||||||
|
}
|
||||||
|
+ /*
|
||||||
|
+ * Zero is reserved for root and the allocation algorithm does not
|
||||||
|
+ * work right with it.
|
||||||
|
+ */
|
||||||
|
+ if (*min_id == 0) {
|
||||||
|
+ *min_id = (gid_t) 1;
|
||||||
|
+ }
|
||||||
|
} else {
|
||||||
|
/* Non-system groups */
|
||||||
|
|
||||||
|
diff -up shadow-4.6/libmisc/find_new_uid.c.min-limit shadow-4.6/libmisc/find_new_uid.c
|
||||||
|
--- shadow-4.6/libmisc/find_new_uid.c.min-limit 2018-04-29 18:42:37.000000001 +0200
|
||||||
|
+++ shadow-4.6/libmisc/find_new_uid.c 2018-11-06 10:51:39.341399569 +0100
|
||||||
|
@@ -82,6 +82,13 @@ static int get_ranges (bool sys_user, ui
|
||||||
|
(unsigned long) *max_id);
|
||||||
|
return EINVAL;
|
||||||
|
}
|
||||||
|
+ /*
|
||||||
|
+ * Zero is reserved for root and the allocation algorithm does not
|
||||||
|
+ * work right with it.
|
||||||
|
+ */
|
||||||
|
+ if (*min_id == 0) {
|
||||||
|
+ *min_id = (uid_t) 1;
|
||||||
|
+ }
|
||||||
|
} else {
|
||||||
|
/* Non-system users */
|
||||||
|
|
35
shadow-4.8-crypt_h.patch
Normal file
35
shadow-4.8-crypt_h.patch
Normal file
@ -0,0 +1,35 @@
|
|||||||
|
diff -up shadow-4.8/configure.ac.crypt_h shadow-4.8/configure.ac
|
||||||
|
--- shadow-4.8/configure.ac.crypt_h 2020-01-13 10:26:17.400481712 +0100
|
||||||
|
+++ shadow-4.8/configure.ac 2020-01-13 10:29:11.563529093 +0100
|
||||||
|
@@ -32,7 +32,7 @@ AC_HEADER_STDC
|
||||||
|
AC_HEADER_SYS_WAIT
|
||||||
|
AC_HEADER_STDBOOL
|
||||||
|
|
||||||
|
-AC_CHECK_HEADERS(errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
|
||||||
|
+AC_CHECK_HEADERS(crypt.h errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
|
||||||
|
utmpx.h termios.h termio.h sgtty.h sys/ioctl.h syslog.h paths.h \
|
||||||
|
utime.h ulimit.h sys/capability.h sys/resource.h gshadow.h lastlog.h \
|
||||||
|
locale.h rpc/key_prot.h netdb.h acl/libacl.h attr/libattr.h \
|
||||||
|
diff -up shadow-4.8/lib/defines.h.crypt_h shadow-4.8/lib/defines.h
|
||||||
|
--- shadow-4.8/lib/defines.h.crypt_h 2019-07-23 17:26:08.000000000 +0200
|
||||||
|
+++ shadow-4.8/lib/defines.h 2020-01-13 10:26:17.400481712 +0100
|
||||||
|
@@ -4,6 +4,8 @@
|
||||||
|
#ifndef _DEFINES_H_
|
||||||
|
#define _DEFINES_H_
|
||||||
|
|
||||||
|
+#include "config.h"
|
||||||
|
+
|
||||||
|
#if HAVE_STDBOOL_H
|
||||||
|
# include <stdbool.h>
|
||||||
|
#else
|
||||||
|
@@ -94,6 +96,10 @@ char *strchr (), *strrchr (), *strtok ()
|
||||||
|
# include <unistd.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+#if HAVE_CRYPT_H
|
||||||
|
+# include <crypt.h> /* crypt(3) may be defined in here */
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
#if TIME_WITH_SYS_TIME
|
||||||
|
# include <sys/time.h>
|
||||||
|
# include <time.h>
|
100
shadow-4.8-goodname.patch
Normal file
100
shadow-4.8-goodname.patch
Normal file
@ -0,0 +1,100 @@
|
|||||||
|
diff -up shadow-4.8/libmisc/chkname.c.goodname shadow-4.8/libmisc/chkname.c
|
||||||
|
--- shadow-4.8/libmisc/chkname.c.goodname 2020-01-13 09:44:41.968507996 +0100
|
||||||
|
+++ shadow-4.8/libmisc/chkname.c 2020-01-13 09:46:27.863727732 +0100
|
||||||
|
@@ -55,26 +55,44 @@ static bool is_valid_name (const char *n
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
- * User/group names must match [a-z_][a-z0-9_-]*[$]
|
||||||
|
- */
|
||||||
|
+ * User/group names must match gnu e-regex:
|
||||||
|
+ * [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
|
||||||
|
+ *
|
||||||
|
+ * as a non-POSIX, extension, allow "$" as the last char for
|
||||||
|
+ * sake of Samba 3.x "add machine script"
|
||||||
|
+ *
|
||||||
|
+ * Also do not allow fully numeric names or just "." or "..".
|
||||||
|
+ */
|
||||||
|
+ int numeric;
|
||||||
|
|
||||||
|
- if (('\0' == *name) ||
|
||||||
|
- !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
|
||||||
|
+ if ('\0' == *name ||
|
||||||
|
+ ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
|
||||||
|
+ '\0' == name[1])) ||
|
||||||
|
+ !((*name >= 'a' && *name <= 'z') ||
|
||||||
|
+ (*name >= 'A' && *name <= 'Z') ||
|
||||||
|
+ (*name >= '0' && *name <= '9') ||
|
||||||
|
+ *name == '_' ||
|
||||||
|
+ *name == '.')) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ numeric = isdigit(*name);
|
||||||
|
+
|
||||||
|
while ('\0' != *++name) {
|
||||||
|
- if (!(( ('a' <= *name) && ('z' >= *name) ) ||
|
||||||
|
- ( ('0' <= *name) && ('9' >= *name) ) ||
|
||||||
|
- ('_' == *name) ||
|
||||||
|
- ('-' == *name) ||
|
||||||
|
- ( ('$' == *name) && ('\0' == *(name + 1)) )
|
||||||
|
+ if (!((*name >= 'a' && *name <= 'z') ||
|
||||||
|
+ (*name >= 'A' && *name <= 'Z') ||
|
||||||
|
+ (*name >= '0' && *name <= '9') ||
|
||||||
|
+ *name == '_' ||
|
||||||
|
+ *name == '.' ||
|
||||||
|
+ *name == '-' ||
|
||||||
|
+ (*name == '$' && name[1] == '\0')
|
||||||
|
)) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
+ numeric &= isdigit(*name);
|
||||||
|
}
|
||||||
|
|
||||||
|
- return true;
|
||||||
|
+ return !numeric;
|
||||||
|
}
|
||||||
|
|
||||||
|
bool is_valid_user_name (const char *name)
|
||||||
|
diff -up shadow-4.8/man/groupadd.8.xml.goodname shadow-4.8/man/groupadd.8.xml
|
||||||
|
--- shadow-4.8/man/groupadd.8.xml.goodname 2019-07-23 17:26:08.000000000 +0200
|
||||||
|
+++ shadow-4.8/man/groupadd.8.xml 2020-01-13 09:44:41.968507996 +0100
|
||||||
|
@@ -273,10 +273,12 @@
|
||||||
|
<refsect1 id='caveats'>
|
||||||
|
<title>CAVEATS</title>
|
||||||
|
<para>
|
||||||
|
- Groupnames must start with a lower case letter or an underscore,
|
||||||
|
- followed by lower case letters, digits, underscores, or dashes.
|
||||||
|
- They can end with a dollar sign.
|
||||||
|
- In regular expression terms: [a-z_][a-z0-9_-]*[$]?
|
||||||
|
+ Groupnames may contain only lower and upper case letters, digits,
|
||||||
|
+ underscores, or dashes. They can end with a dollar sign.
|
||||||
|
+
|
||||||
|
+ Dashes are not allowed at the beginning of the groupname.
|
||||||
|
+ Fully numeric groupnames and groupnames . or .. are
|
||||||
|
+ also disallowed.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
|
||||||
|
diff -up shadow-4.8/man/useradd.8.xml.goodname shadow-4.8/man/useradd.8.xml
|
||||||
|
--- shadow-4.8/man/useradd.8.xml.goodname 2019-10-05 03:23:58.000000000 +0200
|
||||||
|
+++ shadow-4.8/man/useradd.8.xml 2020-01-13 09:44:41.968507996 +0100
|
||||||
|
@@ -661,10 +661,14 @@
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
- Usernames must start with a lower case letter or an underscore,
|
||||||
|
- followed by lower case letters, digits, underscores, or dashes.
|
||||||
|
- They can end with a dollar sign.
|
||||||
|
- In regular expression terms: [a-z_][a-z0-9_-]*[$]?
|
||||||
|
+ Usernames may contain only lower and upper case letters, digits,
|
||||||
|
+ underscores, or dashes. They can end with a dollar sign.
|
||||||
|
+
|
||||||
|
+ Dashes are not allowed at the beginning of the username.
|
||||||
|
+ Fully numeric usernames and usernames . or .. are
|
||||||
|
+ also disallowed. It is not recommended to use usernames beginning
|
||||||
|
+ with . character as their home directories will be hidden in
|
||||||
|
+ the <command>ls</command> output.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
Usernames may only be up to 32 characters long.
|
11
shadow-4.8-ignore-login-prompt.patch
Normal file
11
shadow-4.8-ignore-login-prompt.patch
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
diff -up shadow-4.8/lib/getdef.c.login-prompt shadow-4.8/lib/getdef.c
|
||||||
|
--- shadow-4.8/lib/getdef.c.login-prompt 2020-01-13 10:38:44.852796681 +0100
|
||||||
|
+++ shadow-4.8/lib/getdef.c 2020-01-13 10:39:54.472612511 +0100
|
||||||
|
@@ -98,6 +98,7 @@ static struct itemdef def_table[] = {
|
||||||
|
{"LASTLOG_UID_MAX", NULL},
|
||||||
|
{"LOGIN_RETRIES", NULL},
|
||||||
|
{"LOGIN_TIMEOUT", NULL},
|
||||||
|
+ {"LOGIN_PLAIN_PROMPT", NULL},
|
||||||
|
{"LOG_OK_LOGINS", NULL},
|
||||||
|
{"LOG_UNKFAIL_ENAB", NULL},
|
||||||
|
{"MAIL_DIR", NULL},
|
86
shadow-4.8-long-entry.patch
Normal file
86
shadow-4.8-long-entry.patch
Normal file
@ -0,0 +1,86 @@
|
|||||||
|
diff -up shadow-4.8/lib/defines.h.long-entry shadow-4.8/lib/defines.h
|
||||||
|
--- shadow-4.8/lib/defines.h.long-entry 2020-01-13 10:29:45.288957339 +0100
|
||||||
|
+++ shadow-4.8/lib/defines.h 2020-01-13 10:30:47.482902954 +0100
|
||||||
|
@@ -388,6 +388,9 @@ extern char *strerror ();
|
||||||
|
# endif
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+/* Maximum length of passwd entry */
|
||||||
|
+#define PASSWD_ENTRY_MAX_LENGTH 32768
|
||||||
|
+
|
||||||
|
#ifdef HAVE_SECURE_GETENV
|
||||||
|
# define shadow_getenv(name) secure_getenv(name)
|
||||||
|
# else
|
||||||
|
diff -up shadow-4.8/lib/pwio.c.long-entry shadow-4.8/lib/pwio.c
|
||||||
|
--- shadow-4.8/lib/pwio.c.long-entry 2019-07-23 17:26:08.000000000 +0200
|
||||||
|
+++ shadow-4.8/lib/pwio.c 2020-01-13 10:29:45.288957339 +0100
|
||||||
|
@@ -79,7 +79,10 @@ static int passwd_put (const void *ent,
|
||||||
|
|| (pw->pw_gid == (gid_t)-1)
|
||||||
|
|| (valid_field (pw->pw_gecos, ":\n") == -1)
|
||||||
|
|| (valid_field (pw->pw_dir, ":\n") == -1)
|
||||||
|
- || (valid_field (pw->pw_shell, ":\n") == -1)) {
|
||||||
|
+ || (valid_field (pw->pw_shell, ":\n") == -1)
|
||||||
|
+ || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
|
||||||
|
+ strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
|
||||||
|
+ strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
diff -up shadow-4.8/lib/sgetpwent.c.long-entry shadow-4.8/lib/sgetpwent.c
|
||||||
|
--- shadow-4.8/lib/sgetpwent.c.long-entry 2019-10-05 03:23:58.000000000 +0200
|
||||||
|
+++ shadow-4.8/lib/sgetpwent.c 2020-01-13 10:29:45.288957339 +0100
|
||||||
|
@@ -57,7 +57,7 @@
|
||||||
|
struct passwd *sgetpwent (const char *buf)
|
||||||
|
{
|
||||||
|
static struct passwd pwent;
|
||||||
|
- static char pwdbuf[1024];
|
||||||
|
+ static char pwdbuf[PASSWD_ENTRY_MAX_LENGTH];
|
||||||
|
register int i;
|
||||||
|
register char *cp;
|
||||||
|
char *fields[NFIELDS];
|
||||||
|
@@ -67,8 +67,10 @@ struct passwd *sgetpwent (const char *bu
|
||||||
|
* the password structure remain valid.
|
||||||
|
*/
|
||||||
|
|
||||||
|
- if (strlen (buf) >= sizeof pwdbuf)
|
||||||
|
+ if (strlen (buf) >= sizeof pwdbuf) {
|
||||||
|
+ fprintf (stderr, "Too long passwd entry encountered, file corruption?\n");
|
||||||
|
return 0; /* fail if too long */
|
||||||
|
+ }
|
||||||
|
strcpy (pwdbuf, buf);
|
||||||
|
|
||||||
|
/*
|
||||||
|
diff -up shadow-4.8/lib/sgetspent.c.long-entry shadow-4.8/lib/sgetspent.c
|
||||||
|
--- shadow-4.8/lib/sgetspent.c.long-entry 2019-07-23 17:26:08.000000000 +0200
|
||||||
|
+++ shadow-4.8/lib/sgetspent.c 2020-01-13 10:29:45.289957322 +0100
|
||||||
|
@@ -48,7 +48,7 @@
|
||||||
|
*/
|
||||||
|
struct spwd *sgetspent (const char *string)
|
||||||
|
{
|
||||||
|
- static char spwbuf[1024];
|
||||||
|
+ static char spwbuf[PASSWD_ENTRY_MAX_LENGTH];
|
||||||
|
static struct spwd spwd;
|
||||||
|
char *fields[FIELDS];
|
||||||
|
char *cp;
|
||||||
|
@@ -61,6 +61,7 @@ struct spwd *sgetspent (const char *stri
|
||||||
|
*/
|
||||||
|
|
||||||
|
if (strlen (string) >= sizeof spwbuf) {
|
||||||
|
+ fprintf (stderr, "Too long shadow entry encountered, file corruption?\n");
|
||||||
|
return 0; /* fail if too long */
|
||||||
|
}
|
||||||
|
strcpy (spwbuf, string);
|
||||||
|
diff -up shadow-4.8/lib/shadowio.c.long-entry shadow-4.8/lib/shadowio.c
|
||||||
|
--- shadow-4.8/lib/shadowio.c.long-entry 2019-07-23 17:26:08.000000000 +0200
|
||||||
|
+++ shadow-4.8/lib/shadowio.c 2020-01-13 10:29:45.289957322 +0100
|
||||||
|
@@ -79,7 +79,9 @@ static int shadow_put (const void *ent,
|
||||||
|
|
||||||
|
if ( (NULL == sp)
|
||||||
|
|| (valid_field (sp->sp_namp, ":\n") == -1)
|
||||||
|
- || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
|
||||||
|
+ || (valid_field (sp->sp_pwdp, ":\n") == -1)
|
||||||
|
+ || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
|
||||||
|
+ 1000 > PASSWD_ENTRY_MAX_LENGTH)) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
240
shadow-4.8-selinux-perms.patch
Normal file
240
shadow-4.8-selinux-perms.patch
Normal file
@ -0,0 +1,240 @@
|
|||||||
|
diff -up shadow-4.8/src/chgpasswd.c.selinux-perms shadow-4.8/src/chgpasswd.c
|
||||||
|
--- shadow-4.8/src/chgpasswd.c.selinux-perms 2019-12-01 18:02:43.000000000 +0100
|
||||||
|
+++ shadow-4.8/src/chgpasswd.c 2020-01-13 10:21:44.558107260 +0100
|
||||||
|
@@ -39,6 +39,13 @@
|
||||||
|
#include <pwd.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
+#ifdef WITH_SELINUX
|
||||||
|
+#include <selinux/selinux.h>
|
||||||
|
+#include <selinux/avc.h>
|
||||||
|
+#endif
|
||||||
|
+#ifdef WITH_LIBAUDIT
|
||||||
|
+#include <libaudit.h>
|
||||||
|
+#endif
|
||||||
|
#ifdef ACCT_TOOLS_SETUID
|
||||||
|
#ifdef USE_PAM
|
||||||
|
#include "pam_defs.h"
|
||||||
|
@@ -80,6 +87,9 @@ static bool sgr_locked = false;
|
||||||
|
#endif
|
||||||
|
static bool gr_locked = false;
|
||||||
|
|
||||||
|
+/* The name of the caller */
|
||||||
|
+static char *myname = NULL;
|
||||||
|
+
|
||||||
|
/* local function prototypes */
|
||||||
|
static void fail_exit (int code);
|
||||||
|
static /*@noreturn@*/void usage (int status);
|
||||||
|
@@ -334,6 +344,63 @@ static void check_perms (void)
|
||||||
|
#endif /* ACCT_TOOLS_SETUID */
|
||||||
|
}
|
||||||
|
|
||||||
|
+#ifdef WITH_SELINUX
|
||||||
|
+static int
|
||||||
|
+log_callback (int type, const char *fmt, ...)
|
||||||
|
+{
|
||||||
|
+ int audit_fd;
|
||||||
|
+ va_list ap;
|
||||||
|
+
|
||||||
|
+ va_start(ap, fmt);
|
||||||
|
+#ifdef WITH_AUDIT
|
||||||
|
+ audit_fd = audit_open();
|
||||||
|
+
|
||||||
|
+ if (audit_fd >= 0) {
|
||||||
|
+ char *buf;
|
||||||
|
+
|
||||||
|
+ if (vasprintf (&buf, fmt, ap) < 0)
|
||||||
|
+ goto ret;
|
||||||
|
+ audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
|
||||||
|
+ NULL, 0);
|
||||||
|
+ audit_close(audit_fd);
|
||||||
|
+ free(buf);
|
||||||
|
+ goto ret;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+#endif
|
||||||
|
+ vsyslog (LOG_USER | LOG_INFO, fmt, ap);
|
||||||
|
+ret:
|
||||||
|
+ va_end(ap);
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void
|
||||||
|
+selinux_check_root (void)
|
||||||
|
+{
|
||||||
|
+ int status = -1;
|
||||||
|
+ security_context_t user_context;
|
||||||
|
+ union selinux_callback old_callback;
|
||||||
|
+
|
||||||
|
+ if (is_selinux_enabled() < 1)
|
||||||
|
+ return;
|
||||||
|
+
|
||||||
|
+ old_callback = selinux_get_callback(SELINUX_CB_LOG);
|
||||||
|
+ /* setup callbacks */
|
||||||
|
+ selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
|
||||||
|
+ if ((status = getprevcon(&user_context)) < 0) {
|
||||||
|
+ selinux_set_callback(SELINUX_CB_LOG, old_callback);
|
||||||
|
+ exit(1);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
|
||||||
|
+
|
||||||
|
+ selinux_set_callback(SELINUX_CB_LOG, old_callback);
|
||||||
|
+ freecon(user_context);
|
||||||
|
+ if (status != 0 && security_getenforce() != 0)
|
||||||
|
+ exit(1);
|
||||||
|
+}
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* open_files - lock and open the group databases
|
||||||
|
*/
|
||||||
|
@@ -427,6 +494,7 @@ int main (int argc, char **argv)
|
||||||
|
|
||||||
|
const struct group *gr;
|
||||||
|
struct group newgr;
|
||||||
|
+ struct passwd *pw = NULL;
|
||||||
|
int errors = 0;
|
||||||
|
int line = 0;
|
||||||
|
|
||||||
|
@@ -436,12 +504,37 @@ int main (int argc, char **argv)
|
||||||
|
(void) bindtextdomain (PACKAGE, LOCALEDIR);
|
||||||
|
(void) textdomain (PACKAGE);
|
||||||
|
|
||||||
|
+#ifdef WITH_SELINUX
|
||||||
|
+ selinux_check_root ();
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
process_root_flag ("-R", argc, argv);
|
||||||
|
|
||||||
|
process_flags (argc, argv);
|
||||||
|
|
||||||
|
OPENLOG ("chgpasswd");
|
||||||
|
|
||||||
|
+#ifdef WITH_AUDIT
|
||||||
|
+ audit_help_open ();
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Determine the name of the user that invoked this command. This
|
||||||
|
+ * is really hit or miss because there are so many ways that command
|
||||||
|
+ * can be executed and so many ways to trip up the routines that
|
||||||
|
+ * report the user name.
|
||||||
|
+ */
|
||||||
|
+ pw = get_my_pwent ();
|
||||||
|
+ if (NULL == pw) {
|
||||||
|
+ fprintf (stderr, _("%s: Cannot determine your user name.\n"),
|
||||||
|
+ Prog);
|
||||||
|
+ SYSLOG ((LOG_WARN,
|
||||||
|
+ "Cannot determine the user name of the caller (UID %lu)",
|
||||||
|
+ (unsigned long) getuid ()));
|
||||||
|
+ exit (E_NOPERM);
|
||||||
|
+ }
|
||||||
|
+ myname = xstrdup (pw->pw_name);
|
||||||
|
+
|
||||||
|
check_perms ();
|
||||||
|
|
||||||
|
#ifdef SHADOWGRP
|
||||||
|
diff -up shadow-4.8/src/chpasswd.c.selinux-perms shadow-4.8/src/chpasswd.c
|
||||||
|
--- shadow-4.8/src/chpasswd.c.selinux-perms 2019-12-01 18:02:43.000000000 +0100
|
||||||
|
+++ shadow-4.8/src/chpasswd.c 2020-01-13 10:21:44.558107260 +0100
|
||||||
|
@@ -39,6 +39,13 @@
|
||||||
|
#include <pwd.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
+#ifdef WITH_SELINUX
|
||||||
|
+#include <selinux/selinux.h>
|
||||||
|
+#include <selinux/avc.h>
|
||||||
|
+#endif
|
||||||
|
+#ifdef WITH_LIBAUDIT
|
||||||
|
+#include <libaudit.h>
|
||||||
|
+#endif
|
||||||
|
#ifdef USE_PAM
|
||||||
|
#include "pam_defs.h"
|
||||||
|
#endif /* USE_PAM */
|
||||||
|
@@ -332,6 +339,63 @@ static void check_perms (void)
|
||||||
|
#endif /* USE_PAM */
|
||||||
|
}
|
||||||
|
|
||||||
|
+#ifdef WITH_SELINUX
|
||||||
|
+static int
|
||||||
|
+log_callback (int type, const char *fmt, ...)
|
||||||
|
+{
|
||||||
|
+ int audit_fd;
|
||||||
|
+ va_list ap;
|
||||||
|
+
|
||||||
|
+ va_start(ap, fmt);
|
||||||
|
+#ifdef WITH_AUDIT
|
||||||
|
+ audit_fd = audit_open();
|
||||||
|
+
|
||||||
|
+ if (audit_fd >= 0) {
|
||||||
|
+ char *buf;
|
||||||
|
+
|
||||||
|
+ if (vasprintf (&buf, fmt, ap) < 0)
|
||||||
|
+ goto ret;
|
||||||
|
+ audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
|
||||||
|
+ NULL, 0);
|
||||||
|
+ audit_close(audit_fd);
|
||||||
|
+ free(buf);
|
||||||
|
+ goto ret;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+#endif
|
||||||
|
+ vsyslog (LOG_USER | LOG_INFO, fmt, ap);
|
||||||
|
+ret:
|
||||||
|
+ va_end(ap);
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void
|
||||||
|
+selinux_check_root (void)
|
||||||
|
+{
|
||||||
|
+ int status = -1;
|
||||||
|
+ security_context_t user_context;
|
||||||
|
+ union selinux_callback old_callback;
|
||||||
|
+
|
||||||
|
+ if (is_selinux_enabled() < 1)
|
||||||
|
+ return;
|
||||||
|
+
|
||||||
|
+ old_callback = selinux_get_callback(SELINUX_CB_LOG);
|
||||||
|
+ /* setup callbacks */
|
||||||
|
+ selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
|
||||||
|
+ if ((status = getprevcon(&user_context)) < 0) {
|
||||||
|
+ selinux_set_callback(SELINUX_CB_LOG, old_callback);
|
||||||
|
+ exit(1);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
|
||||||
|
+
|
||||||
|
+ selinux_set_callback(SELINUX_CB_LOG, old_callback);
|
||||||
|
+ freecon(user_context);
|
||||||
|
+ if (status != 0 && security_getenforce() != 0)
|
||||||
|
+ exit(1);
|
||||||
|
+}
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* open_files - lock and open the password databases
|
||||||
|
*/
|
||||||
|
@@ -428,6 +492,10 @@ int main (int argc, char **argv)
|
||||||
|
(void) bindtextdomain (PACKAGE, LOCALEDIR);
|
||||||
|
(void) textdomain (PACKAGE);
|
||||||
|
|
||||||
|
+#ifdef WITH_SELINUX
|
||||||
|
+ selinux_check_root ();
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
process_root_flag ("-R", argc, argv);
|
||||||
|
|
||||||
|
process_flags (argc, argv);
|
||||||
|
@@ -440,6 +508,10 @@ int main (int argc, char **argv)
|
||||||
|
|
||||||
|
OPENLOG ("chpasswd");
|
||||||
|
|
||||||
|
+#ifdef WITH_AUDIT
|
||||||
|
+ audit_help_open ();
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
check_perms ();
|
||||||
|
|
||||||
|
#ifdef USE_PAM
|
241
shadow-4.8-selinux.patch
Normal file
241
shadow-4.8-selinux.patch
Normal file
@ -0,0 +1,241 @@
|
|||||||
|
diff -up shadow-4.8/lib/commonio.c.selinux shadow-4.8/lib/commonio.c
|
||||||
|
--- shadow-4.8/lib/commonio.c.selinux 2019-07-23 17:26:08.000000000 +0200
|
||||||
|
+++ shadow-4.8/lib/commonio.c 2020-01-13 10:08:53.769101131 +0100
|
||||||
|
@@ -964,7 +964,7 @@ int commonio_close (struct commonio_db *
|
||||||
|
snprintf (buf, sizeof buf, "%s-", db->filename);
|
||||||
|
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
- if (set_selinux_file_context (buf) != 0) {
|
||||||
|
+ if (set_selinux_file_context (buf, db->filename) != 0) {
|
||||||
|
errors++;
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
@@ -997,7 +997,7 @@ int commonio_close (struct commonio_db *
|
||||||
|
snprintf (buf, sizeof buf, "%s+", db->filename);
|
||||||
|
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
- if (set_selinux_file_context (buf) != 0) {
|
||||||
|
+ if (set_selinux_file_context (buf, db->filename) != 0) {
|
||||||
|
errors++;
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
diff -up shadow-4.8/libmisc/copydir.c.selinux shadow-4.8/libmisc/copydir.c
|
||||||
|
--- shadow-4.8/libmisc/copydir.c.selinux 2019-07-23 17:26:08.000000000 +0200
|
||||||
|
+++ shadow-4.8/libmisc/copydir.c 2020-01-13 10:08:53.769101131 +0100
|
||||||
|
@@ -484,7 +484,7 @@ static int copy_dir (const char *src, co
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
- if (set_selinux_file_context (dst) != 0) {
|
||||||
|
+ if (set_selinux_file_context (dst, NULL) != 0) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
#endif /* WITH_SELINUX */
|
||||||
|
@@ -605,7 +605,7 @@ static int copy_symlink (const char *src
|
||||||
|
}
|
||||||
|
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
- if (set_selinux_file_context (dst) != 0) {
|
||||||
|
+ if (set_selinux_file_context (dst, NULL) != 0) {
|
||||||
|
free (oldlink);
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
@@ -684,7 +684,7 @@ static int copy_special (const char *src
|
||||||
|
int err = 0;
|
||||||
|
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
- if (set_selinux_file_context (dst) != 0) {
|
||||||
|
+ if (set_selinux_file_context (dst, NULL) != 0) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
#endif /* WITH_SELINUX */
|
||||||
|
@@ -744,7 +744,7 @@ static int copy_file (const char *src, c
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
- if (set_selinux_file_context (dst) != 0) {
|
||||||
|
+ if (set_selinux_file_context (dst, NULL) != 0) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
#endif /* WITH_SELINUX */
|
||||||
|
diff -up shadow-4.8/lib/prototypes.h.selinux shadow-4.8/lib/prototypes.h
|
||||||
|
--- shadow-4.8/lib/prototypes.h.selinux 2020-01-13 10:08:53.769101131 +0100
|
||||||
|
+++ shadow-4.8/lib/prototypes.h 2020-01-13 10:11:20.914627399 +0100
|
||||||
|
@@ -334,7 +334,7 @@ extern /*@observer@*/const char *crypt_m
|
||||||
|
|
||||||
|
/* selinux.c */
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
-extern int set_selinux_file_context (const char *dst_name);
|
||||||
|
+extern int set_selinux_file_context (const char *dst_name, const char *orig_name);
|
||||||
|
extern int reset_selinux_file_context (void);
|
||||||
|
extern int check_selinux_permit (const char *perm_name);
|
||||||
|
#endif
|
||||||
|
diff -up shadow-4.8/lib/selinux.c.selinux shadow-4.8/lib/selinux.c
|
||||||
|
--- shadow-4.8/lib/selinux.c.selinux 2019-11-12 01:18:25.000000000 +0100
|
||||||
|
+++ shadow-4.8/lib/selinux.c 2020-01-13 10:08:53.769101131 +0100
|
||||||
|
@@ -51,7 +51,7 @@ static bool selinux_enabled;
|
||||||
|
* Callers may have to Reset SELinux to create files with default
|
||||||
|
* contexts with reset_selinux_file_context
|
||||||
|
*/
|
||||||
|
-int set_selinux_file_context (const char *dst_name)
|
||||||
|
+int set_selinux_file_context (const char *dst_name, const char *orig_name)
|
||||||
|
{
|
||||||
|
/*@null@*/security_context_t scontext = NULL;
|
||||||
|
|
||||||
|
@@ -63,19 +63,23 @@ int set_selinux_file_context (const char
|
||||||
|
if (selinux_enabled) {
|
||||||
|
/* Get the default security context for this file */
|
||||||
|
if (matchpathcon (dst_name, 0, &scontext) < 0) {
|
||||||
|
- if (security_getenforce () != 0) {
|
||||||
|
- return 1;
|
||||||
|
- }
|
||||||
|
+ /* We could not get the default, copy the original */
|
||||||
|
+ if (orig_name == NULL)
|
||||||
|
+ goto error;
|
||||||
|
+ if (getfilecon (orig_name, &scontext) < 0)
|
||||||
|
+ goto error;
|
||||||
|
}
|
||||||
|
/* Set the security context for the next created file */
|
||||||
|
- if (setfscreatecon (scontext) < 0) {
|
||||||
|
- if (security_getenforce () != 0) {
|
||||||
|
- return 1;
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
+ if (setfscreatecon (scontext) < 0)
|
||||||
|
+ goto error;
|
||||||
|
freecon (scontext);
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
+ error:
|
||||||
|
+ if (security_getenforce () != 0) {
|
||||||
|
+ return 1;
|
||||||
|
+ }
|
||||||
|
+ return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
diff -up shadow-4.8/lib/semanage.c.selinux shadow-4.8/lib/semanage.c
|
||||||
|
--- shadow-4.8/lib/semanage.c.selinux 2019-07-23 17:26:08.000000000 +0200
|
||||||
|
+++ shadow-4.8/lib/semanage.c 2020-01-13 10:08:53.766101181 +0100
|
||||||
|
@@ -294,6 +294,9 @@ int set_seuser (const char *login_name,
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
|
|
||||||
|
+ /* drop obsolete matchpathcon cache */
|
||||||
|
+ matchpathcon_fini();
|
||||||
|
+
|
||||||
|
done:
|
||||||
|
semanage_seuser_key_free (key);
|
||||||
|
semanage_handle_destroy (handle);
|
||||||
|
@@ -369,6 +372,10 @@ int del_seuser (const char *login_name)
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
|
+
|
||||||
|
+ /* drop obsolete matchpathcon cache */
|
||||||
|
+ matchpathcon_fini();
|
||||||
|
+
|
||||||
|
done:
|
||||||
|
semanage_handle_destroy (handle);
|
||||||
|
return ret;
|
||||||
|
diff -up shadow-4.8/src/useradd.c.selinux shadow-4.8/src/useradd.c
|
||||||
|
--- shadow-4.8/src/useradd.c.selinux 2020-01-13 10:08:53.762101248 +0100
|
||||||
|
+++ shadow-4.8/src/useradd.c 2020-01-13 10:08:53.767101164 +0100
|
||||||
|
@@ -2078,7 +2078,7 @@ static void create_home (void)
|
||||||
|
++bhome;
|
||||||
|
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
- if (set_selinux_file_context (prefix_user_home) != 0) {
|
||||||
|
+ if (set_selinux_file_context (prefix_user_home, NULL) != 0) {
|
||||||
|
fprintf (stderr,
|
||||||
|
_("%s: cannot set SELinux context for home directory %s\n"),
|
||||||
|
Prog, user_home);
|
||||||
|
@@ -2232,6 +2232,7 @@ static void create_mail (void)
|
||||||
|
*/
|
||||||
|
int main (int argc, char **argv)
|
||||||
|
{
|
||||||
|
+ int rv = E_SUCCESS;
|
||||||
|
#ifdef ACCT_TOOLS_SETUID
|
||||||
|
#ifdef USE_PAM
|
||||||
|
pam_handle_t *pamh = NULL;
|
||||||
|
@@ -2454,27 +2455,12 @@ int main (int argc, char **argv)
|
||||||
|
|
||||||
|
usr_update ();
|
||||||
|
|
||||||
|
- if (mflg) {
|
||||||
|
- create_home ();
|
||||||
|
- if (home_added) {
|
||||||
|
- copy_tree (def_template, prefix_user_home, false, false,
|
||||||
|
- (uid_t)-1, user_id, (gid_t)-1, user_gid);
|
||||||
|
- } else {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: warning: the home directory %s already exists.\n"
|
||||||
|
- "%s: Not copying any file from skel directory into it.\n"),
|
||||||
|
- Prog, user_home, Prog);
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- /* Do not create mail directory for system accounts */
|
||||||
|
- if (!rflg) {
|
||||||
|
- create_mail ();
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
close_files ();
|
||||||
|
|
||||||
|
+ nscd_flush_cache ("passwd");
|
||||||
|
+ nscd_flush_cache ("group");
|
||||||
|
+ sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* tallylog_reset needs to be able to lookup
|
||||||
|
* a valid existing user name,
|
||||||
|
@@ -2485,8 +2471,9 @@ int main (int argc, char **argv)
|
||||||
|
}
|
||||||
|
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
- if (Zflg) {
|
||||||
|
- if (set_seuser (user_name, user_selinux) != 0) {
|
||||||
|
+ if (Zflg && *user_selinux) {
|
||||||
|
+ if (is_selinux_enabled () > 0) {
|
||||||
|
+ if (set_seuser (user_name, user_selinux) != 0) {
|
||||||
|
fprintf (stderr,
|
||||||
|
_("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
|
||||||
|
Prog, user_name, user_selinux);
|
||||||
|
@@ -2495,15 +2482,31 @@ int main (int argc, char **argv)
|
||||||
|
"adding SELinux user mapping",
|
||||||
|
user_name, (unsigned int) user_id, 0);
|
||||||
|
#endif /* WITH_AUDIT */
|
||||||
|
- fail_exit (E_SE_UPDATE);
|
||||||
|
+ rv = E_SE_UPDATE;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
#endif /* WITH_SELINUX */
|
||||||
|
|
||||||
|
- nscd_flush_cache ("passwd");
|
||||||
|
- nscd_flush_cache ("group");
|
||||||
|
- sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
|
||||||
|
+ if (mflg) {
|
||||||
|
+ create_home ();
|
||||||
|
+ if (home_added) {
|
||||||
|
+ copy_tree (def_template, prefix_user_home, false, true,
|
||||||
|
+ (uid_t)-1, user_id, (gid_t)-1, user_gid);
|
||||||
|
+ } else {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: warning: the home directory %s already exists.\n"
|
||||||
|
+ "%s: Not copying any file from skel directory into it.\n"),
|
||||||
|
+ Prog, user_home, Prog);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /* Do not create mail directory for system accounts */
|
||||||
|
+ if (!rflg) {
|
||||||
|
+ create_mail ();
|
||||||
|
+ }
|
||||||
|
|
||||||
|
- return E_SUCCESS;
|
||||||
|
+ return rv;
|
||||||
|
}
|
||||||
|
|
61
shadow-4.8-useradd-selinux-mail.patch
Normal file
61
shadow-4.8-useradd-selinux-mail.patch
Normal file
@ -0,0 +1,61 @@
|
|||||||
|
From 4dc62ebcf37d7568be1d4ca54367215eba8b8a28 Mon Sep 17 00:00:00 2001
|
||||||
|
From: ikerexxe <ipedrosa@redhat.com>
|
||||||
|
Date: Wed, 5 Feb 2020 15:04:39 +0100
|
||||||
|
Subject: [PATCH] useradd: doesn't generate /var/spool/mail/$USER with the
|
||||||
|
proper SELinux user identity
|
||||||
|
|
||||||
|
Explanation: use set_selinux_file_context() and reset_selinux_file_context() for create_mail() just as is done for create_home()
|
||||||
|
|
||||||
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1690527
|
||||||
|
---
|
||||||
|
src/useradd.c | 20 ++++++++++++++++++++
|
||||||
|
1 file changed, 20 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/src/useradd.c b/src/useradd.c
|
||||||
|
index a679392d..645d4a40 100644
|
||||||
|
--- a/src/useradd.c
|
||||||
|
+++ b/src/useradd.c
|
||||||
|
@@ -190,6 +190,7 @@ static bool home_added = false;
|
||||||
|
#define E_NAME_IN_USE 9 /* username already in use */
|
||||||
|
#define E_GRP_UPDATE 10 /* can't update group file */
|
||||||
|
#define E_HOMEDIR 12 /* can't create home directory */
|
||||||
|
+#define E_MAILBOXFILE 13 /* can't create mailbox file */
|
||||||
|
#define E_SE_UPDATE 14 /* can't update SELinux user mapping */
|
||||||
|
#ifdef ENABLE_SUBIDS
|
||||||
|
#define E_SUB_UID_UPDATE 16 /* can't update the subordinate uid file */
|
||||||
|
@@ -2210,6 +2211,16 @@ static void create_mail (void)
|
||||||
|
sprintf (file, "%s/%s/%s", prefix, spool, user_name);
|
||||||
|
else
|
||||||
|
sprintf (file, "%s/%s", spool, user_name);
|
||||||
|
+
|
||||||
|
+#ifdef WITH_SELINUX
|
||||||
|
+ if (set_selinux_file_context (file, NULL) != 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: cannot set SELinux context for mailbox file %s\n"),
|
||||||
|
+ Prog, file);
|
||||||
|
+ fail_exit (E_MAILBOXFILE);
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
fd = open (file, O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0);
|
||||||
|
if (fd < 0) {
|
||||||
|
perror (_("Creating mailbox file"));
|
||||||
|
@@ -2234,6 +2245,15 @@ static void create_mail (void)
|
||||||
|
|
||||||
|
fsync (fd);
|
||||||
|
close (fd);
|
||||||
|
+#ifdef WITH_SELINUX
|
||||||
|
+ /* Reset SELinux to create files with default contexts */
|
||||||
|
+ if (reset_selinux_file_context () != 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: cannot reset SELinux file creation context\n"),
|
||||||
|
+ Prog);
|
||||||
|
+ fail_exit (E_MAILBOXFILE);
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.24.1
|
||||||
|
|
2365
shadow-4.8.1-audit-update.patch
Normal file
2365
shadow-4.8.1-audit-update.patch
Normal file
File diff suppressed because it is too large
Load Diff
642
shadow-4.8.1-check-local-groups.patch
Normal file
642
shadow-4.8.1-check-local-groups.patch
Normal file
@ -0,0 +1,642 @@
|
|||||||
|
From 140510de9de4771feb3af1d859c09604043a4c9b Mon Sep 17 00:00:00 2001
|
||||||
|
From: ikerexxe <ipedrosa@redhat.com>
|
||||||
|
Date: Fri, 27 Mar 2020 14:23:02 +0100
|
||||||
|
Subject: [PATCH 1/2] usermod: check only local groups with -G option
|
||||||
|
|
||||||
|
Check only local groups when adding new supplementary groups to a user
|
||||||
|
|
||||||
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1727236
|
||||||
|
---
|
||||||
|
src/usermod.c | 220 ++++++++++++++++++++++++++++++++------------------
|
||||||
|
1 file changed, 143 insertions(+), 77 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/usermod.c b/src/usermod.c
|
||||||
|
index 05b98715..ef430296 100644
|
||||||
|
--- a/src/usermod.c
|
||||||
|
+++ b/src/usermod.c
|
||||||
|
@@ -183,6 +183,7 @@ static bool sub_gid_locked = false;
|
||||||
|
static void date_to_str (/*@unique@*//*@out@*/char *buf, size_t maxsize,
|
||||||
|
long int date);
|
||||||
|
static int get_groups (char *);
|
||||||
|
+static struct group * get_local_group (char * grp_name);
|
||||||
|
static /*@noreturn@*/void usage (int status);
|
||||||
|
static void new_pwent (struct passwd *);
|
||||||
|
static void new_spent (struct spwd *);
|
||||||
|
@@ -196,7 +197,9 @@ static void grp_update (void);
|
||||||
|
|
||||||
|
static void process_flags (int, char **);
|
||||||
|
static void close_files (void);
|
||||||
|
+static void close_group_files (void);
|
||||||
|
static void open_files (void);
|
||||||
|
+static void open_group_files (void);
|
||||||
|
static void usr_update (void);
|
||||||
|
static void move_home (void);
|
||||||
|
static void update_lastlog (void);
|
||||||
|
@@ -253,6 +256,11 @@ static int get_groups (char *list)
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /*
|
||||||
|
+ * Open the group files
|
||||||
|
+ */
|
||||||
|
+ open_group_files ();
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* So long as there is some data to be converted, strip off each
|
||||||
|
* name and look it up. A mix of numerical and string values for
|
||||||
|
@@ -272,7 +280,7 @@ static int get_groups (char *list)
|
||||||
|
* Names starting with digits are treated as numerical GID
|
||||||
|
* values, otherwise the string is looked up as is.
|
||||||
|
*/
|
||||||
|
- grp = prefix_getgr_nam_gid (list);
|
||||||
|
+ grp = get_local_group (list);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* There must be a match, either by GID value or by
|
||||||
|
@@ -322,6 +330,8 @@ static int get_groups (char *list)
|
||||||
|
gr_free ((struct group *)grp);
|
||||||
|
} while (NULL != list);
|
||||||
|
|
||||||
|
+ close_group_files ();
|
||||||
|
+
|
||||||
|
user_groups[ngroups] = (char *) 0;
|
||||||
|
|
||||||
|
/*
|
||||||
|
@@ -334,6 +344,44 @@ static int get_groups (char *list)
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
+/*
|
||||||
|
+ * get_local_group - checks if a given group name exists locally
|
||||||
|
+ *
|
||||||
|
+ * get_local_group() checks if a given group name exists locally.
|
||||||
|
+ * If the name exists the group information is returned, otherwise NULL is
|
||||||
|
+ * returned.
|
||||||
|
+ */
|
||||||
|
+static struct group * get_local_group(char * grp_name)
|
||||||
|
+{
|
||||||
|
+ const struct group *grp;
|
||||||
|
+ struct group *result_grp = NULL;
|
||||||
|
+ long long int gid;
|
||||||
|
+ char *endptr;
|
||||||
|
+
|
||||||
|
+ gid = strtoll (grp_name, &endptr, 10);
|
||||||
|
+ if ( ('\0' != *grp_name)
|
||||||
|
+ && ('\0' == *endptr)
|
||||||
|
+ && (ERANGE != errno)
|
||||||
|
+ && (gid == (gid_t)gid)) {
|
||||||
|
+ grp = gr_locate_gid ((gid_t) gid);
|
||||||
|
+ }
|
||||||
|
+ else {
|
||||||
|
+ grp = gr_locate(grp_name);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (grp != NULL) {
|
||||||
|
+ result_grp = __gr_dup (grp);
|
||||||
|
+ if (NULL == result_grp) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: Out of memory. Cannot find group '%s'.\n"),
|
||||||
|
+ Prog, grp_name);
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return result_grp;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
#ifdef ENABLE_SUBIDS
|
||||||
|
struct ulong_range
|
||||||
|
{
|
||||||
|
@@ -1447,50 +1495,7 @@ static void close_files (void)
|
||||||
|
}
|
||||||
|
|
||||||
|
if (Gflg || lflg) {
|
||||||
|
- if (gr_close () == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: failure while writing changes to %s\n"),
|
||||||
|
- Prog, gr_dbname ());
|
||||||
|
- SYSLOG ((LOG_ERR,
|
||||||
|
- "failure while writing changes to %s",
|
||||||
|
- gr_dbname ()));
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
-#ifdef SHADOWGRP
|
||||||
|
- if (is_shadow_grp) {
|
||||||
|
- if (sgr_close () == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: failure while writing changes to %s\n"),
|
||||||
|
- Prog, sgr_dbname ());
|
||||||
|
- SYSLOG ((LOG_ERR,
|
||||||
|
- "failure while writing changes to %s",
|
||||||
|
- sgr_dbname ()));
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
-#endif
|
||||||
|
-#ifdef SHADOWGRP
|
||||||
|
- if (is_shadow_grp) {
|
||||||
|
- if (sgr_unlock () == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: failed to unlock %s\n"),
|
||||||
|
- Prog, sgr_dbname ());
|
||||||
|
- SYSLOG ((LOG_ERR,
|
||||||
|
- "failed to unlock %s",
|
||||||
|
- sgr_dbname ()));
|
||||||
|
- /* continue */
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
-#endif
|
||||||
|
- if (gr_unlock () == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: failed to unlock %s\n"),
|
||||||
|
- Prog, gr_dbname ());
|
||||||
|
- SYSLOG ((LOG_ERR,
|
||||||
|
- "failed to unlock %s",
|
||||||
|
- gr_dbname ()));
|
||||||
|
- /* continue */
|
||||||
|
- }
|
||||||
|
+ close_group_files ();
|
||||||
|
}
|
||||||
|
|
||||||
|
if (is_shadow_pwd) {
|
||||||
|
@@ -1559,6 +1564,60 @@ static void close_files (void)
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
+/*
|
||||||
|
+ * close_group_files - close all of the files that were opened
|
||||||
|
+ *
|
||||||
|
+ * close_group_files() closes all of the files that were opened related
|
||||||
|
+ * with groups. This causes any modified entries to be written out.
|
||||||
|
+ */
|
||||||
|
+static void close_group_files (void)
|
||||||
|
+{
|
||||||
|
+ if (gr_close () == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: failure while writing changes to %s\n"),
|
||||||
|
+ Prog, gr_dbname ());
|
||||||
|
+ SYSLOG ((LOG_ERR,
|
||||||
|
+ "failure while writing changes to %s",
|
||||||
|
+ gr_dbname ()));
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+#ifdef SHADOWGRP
|
||||||
|
+ if (is_shadow_grp) {
|
||||||
|
+ if (sgr_close () == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: failure while writing changes to %s\n"),
|
||||||
|
+ Prog, sgr_dbname ());
|
||||||
|
+ SYSLOG ((LOG_ERR,
|
||||||
|
+ "failure while writing changes to %s",
|
||||||
|
+ sgr_dbname ()));
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
+#ifdef SHADOWGRP
|
||||||
|
+ if (is_shadow_grp) {
|
||||||
|
+ if (sgr_unlock () == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: failed to unlock %s\n"),
|
||||||
|
+ Prog, sgr_dbname ());
|
||||||
|
+ SYSLOG ((LOG_ERR,
|
||||||
|
+ "failed to unlock %s",
|
||||||
|
+ sgr_dbname ()));
|
||||||
|
+ /* continue */
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
+ if (gr_unlock () == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: failed to unlock %s\n"),
|
||||||
|
+ Prog, gr_dbname ());
|
||||||
|
+ SYSLOG ((LOG_ERR,
|
||||||
|
+ "failed to unlock %s",
|
||||||
|
+ gr_dbname ()));
|
||||||
|
+ /* continue */
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* open_files - lock and open the password files
|
||||||
|
*
|
||||||
|
@@ -1594,38 +1653,7 @@ static void open_files (void)
|
||||||
|
}
|
||||||
|
|
||||||
|
if (Gflg || lflg) {
|
||||||
|
- /*
|
||||||
|
- * Lock and open the group file. This will load all of the
|
||||||
|
- * group entries.
|
||||||
|
- */
|
||||||
|
- if (gr_lock () == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: cannot lock %s; try again later.\n"),
|
||||||
|
- Prog, gr_dbname ());
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
- gr_locked = true;
|
||||||
|
- if (gr_open (O_CREAT | O_RDWR) == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: cannot open %s\n"),
|
||||||
|
- Prog, gr_dbname ());
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
-#ifdef SHADOWGRP
|
||||||
|
- if (is_shadow_grp && (sgr_lock () == 0)) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: cannot lock %s; try again later.\n"),
|
||||||
|
- Prog, sgr_dbname ());
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
- sgr_locked = true;
|
||||||
|
- if (is_shadow_grp && (sgr_open (O_CREAT | O_RDWR) == 0)) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: cannot open %s\n"),
|
||||||
|
- Prog, sgr_dbname ());
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
-#endif
|
||||||
|
+ open_group_files ();
|
||||||
|
}
|
||||||
|
#ifdef ENABLE_SUBIDS
|
||||||
|
if (vflg || Vflg) {
|
||||||
|
@@ -1661,6 +1689,44 @@ static void open_files (void)
|
||||||
|
#endif /* ENABLE_SUBIDS */
|
||||||
|
}
|
||||||
|
|
||||||
|
+/*
|
||||||
|
+ * open_group_files - lock and open the group files
|
||||||
|
+ *
|
||||||
|
+ * open_group_files() loads all of the group entries.
|
||||||
|
+ */
|
||||||
|
+static void open_group_files (void)
|
||||||
|
+{
|
||||||
|
+ if (gr_lock () == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: cannot lock %s; try again later.\n"),
|
||||||
|
+ Prog, gr_dbname ());
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+ gr_locked = true;
|
||||||
|
+ if (gr_open (O_CREAT | O_RDWR) == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: cannot open %s\n"),
|
||||||
|
+ Prog, gr_dbname ());
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+#ifdef SHADOWGRP
|
||||||
|
+ if (is_shadow_grp && (sgr_lock () == 0)) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: cannot lock %s; try again later.\n"),
|
||||||
|
+ Prog, sgr_dbname ());
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+ sgr_locked = true;
|
||||||
|
+ if (is_shadow_grp && (sgr_open (O_CREAT | O_RDWR) == 0)) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: cannot open %s\n"),
|
||||||
|
+ Prog, sgr_dbname ());
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* usr_update - create the user entries
|
||||||
|
*
|
||||||
|
--
|
||||||
|
2.25.4
|
||||||
|
|
||||||
|
|
||||||
|
From 8762f465d487a52bf68f9c0b7c3c1eb3caea7bc9 Mon Sep 17 00:00:00 2001
|
||||||
|
From: ikerexxe <ipedrosa@redhat.com>
|
||||||
|
Date: Mon, 30 Mar 2020 09:08:23 +0200
|
||||||
|
Subject: [PATCH 2/2] useradd: check only local groups with -G option
|
||||||
|
|
||||||
|
Check only local groups when adding new supplementary groups to a user
|
||||||
|
|
||||||
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1727236
|
||||||
|
---
|
||||||
|
src/useradd.c | 234 +++++++++++++++++++++++++++++++++-----------------
|
||||||
|
1 file changed, 157 insertions(+), 77 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/useradd.c b/src/useradd.c
|
||||||
|
index 645d4a40..90210233 100644
|
||||||
|
--- a/src/useradd.c
|
||||||
|
+++ b/src/useradd.c
|
||||||
|
@@ -211,6 +211,7 @@ static void get_defaults (void);
|
||||||
|
static void show_defaults (void);
|
||||||
|
static int set_defaults (void);
|
||||||
|
static int get_groups (char *);
|
||||||
|
+static struct group * get_local_group (char * grp_name);
|
||||||
|
static void usage (int status);
|
||||||
|
static void new_pwent (struct passwd *);
|
||||||
|
|
||||||
|
@@ -220,7 +221,10 @@ static void grp_update (void);
|
||||||
|
|
||||||
|
static void process_flags (int argc, char **argv);
|
||||||
|
static void close_files (void);
|
||||||
|
+static void close_group_files (void);
|
||||||
|
+static void unlock_group_files (void);
|
||||||
|
static void open_files (void);
|
||||||
|
+static void open_group_files (void);
|
||||||
|
static void open_shadow (void);
|
||||||
|
static void faillog_reset (uid_t);
|
||||||
|
static void lastlog_reset (uid_t);
|
||||||
|
@@ -731,6 +735,11 @@ static int get_groups (char *list)
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /*
|
||||||
|
+ * Open the group files
|
||||||
|
+ */
|
||||||
|
+ open_group_files ();
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* So long as there is some data to be converted, strip off
|
||||||
|
* each name and look it up. A mix of numerical and string
|
||||||
|
@@ -749,7 +758,7 @@ static int get_groups (char *list)
|
||||||
|
* Names starting with digits are treated as numerical
|
||||||
|
* GID values, otherwise the string is looked up as is.
|
||||||
|
*/
|
||||||
|
- grp = prefix_getgr_nam_gid (list);
|
||||||
|
+ grp = get_local_group (list);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* There must be a match, either by GID value or by
|
||||||
|
@@ -799,6 +808,9 @@ static int get_groups (char *list)
|
||||||
|
user_groups[ngroups++] = xstrdup (grp->gr_name);
|
||||||
|
} while (NULL != list);
|
||||||
|
|
||||||
|
+ close_group_files ();
|
||||||
|
+ unlock_group_files ();
|
||||||
|
+
|
||||||
|
user_groups[ngroups] = (char *) 0;
|
||||||
|
|
||||||
|
/*
|
||||||
|
@@ -811,6 +823,44 @@ static int get_groups (char *list)
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
+/*
|
||||||
|
+ * get_local_group - checks if a given group name exists locally
|
||||||
|
+ *
|
||||||
|
+ * get_local_group() checks if a given group name exists locally.
|
||||||
|
+ * If the name exists the group information is returned, otherwise NULL is
|
||||||
|
+ * returned.
|
||||||
|
+ */
|
||||||
|
+static struct group * get_local_group(char * grp_name)
|
||||||
|
+{
|
||||||
|
+ const struct group *grp;
|
||||||
|
+ struct group *result_grp = NULL;
|
||||||
|
+ long long int gid;
|
||||||
|
+ char *endptr;
|
||||||
|
+
|
||||||
|
+ gid = strtoll (grp_name, &endptr, 10);
|
||||||
|
+ if ( ('\0' != *grp_name)
|
||||||
|
+ && ('\0' == *endptr)
|
||||||
|
+ && (ERANGE != errno)
|
||||||
|
+ && (gid == (gid_t)gid)) {
|
||||||
|
+ grp = gr_locate_gid ((gid_t) gid);
|
||||||
|
+ }
|
||||||
|
+ else {
|
||||||
|
+ grp = gr_locate(grp_name);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (grp != NULL) {
|
||||||
|
+ result_grp = __gr_dup (grp);
|
||||||
|
+ if (NULL == result_grp) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: Out of memory. Cannot find group '%s'.\n"),
|
||||||
|
+ Prog, grp_name);
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return result_grp;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* usage - display usage message and exit
|
||||||
|
*/
|
||||||
|
@@ -1530,23 +1580,9 @@ static void close_files (void)
|
||||||
|
SYSLOG ((LOG_ERR, "failure while writing changes to %s", spw_dbname ()));
|
||||||
|
fail_exit (E_PW_UPDATE);
|
||||||
|
}
|
||||||
|
- if (do_grp_update) {
|
||||||
|
- if (gr_close () == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: failure while writing changes to %s\n"), Prog, gr_dbname ());
|
||||||
|
- SYSLOG ((LOG_ERR, "failure while writing changes to %s", gr_dbname ()));
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
-#ifdef SHADOWGRP
|
||||||
|
- if (is_shadow_grp && (sgr_close () == 0)) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: failure while writing changes to %s\n"),
|
||||||
|
- Prog, sgr_dbname ());
|
||||||
|
- SYSLOG ((LOG_ERR, "failure while writing changes to %s", sgr_dbname ()));
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
-#endif
|
||||||
|
- }
|
||||||
|
+
|
||||||
|
+ close_group_files ();
|
||||||
|
+
|
||||||
|
#ifdef ENABLE_SUBIDS
|
||||||
|
if (is_sub_uid && (sub_uid_close () == 0)) {
|
||||||
|
fprintf (stderr,
|
||||||
|
@@ -1587,34 +1623,9 @@ static void close_files (void)
|
||||||
|
/* continue */
|
||||||
|
}
|
||||||
|
pw_locked = false;
|
||||||
|
- if (gr_unlock () == 0) {
|
||||||
|
- fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, gr_dbname ());
|
||||||
|
- SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
|
||||||
|
-#ifdef WITH_AUDIT
|
||||||
|
- audit_logger (AUDIT_ADD_USER, Prog,
|
||||||
|
- "unlocking-group-file",
|
||||||
|
- user_name, AUDIT_NO_ID,
|
||||||
|
- SHADOW_AUDIT_FAILURE);
|
||||||
|
-#endif
|
||||||
|
- /* continue */
|
||||||
|
- }
|
||||||
|
- gr_locked = false;
|
||||||
|
-#ifdef SHADOWGRP
|
||||||
|
- if (is_shadow_grp) {
|
||||||
|
- if (sgr_unlock () == 0) {
|
||||||
|
- fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sgr_dbname ());
|
||||||
|
- SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
|
||||||
|
-#ifdef WITH_AUDIT
|
||||||
|
- audit_logger (AUDIT_ADD_USER, Prog,
|
||||||
|
- "unlocking-gshadow-file",
|
||||||
|
- user_name, AUDIT_NO_ID,
|
||||||
|
- SHADOW_AUDIT_FAILURE);
|
||||||
|
-#endif
|
||||||
|
- /* continue */
|
||||||
|
- }
|
||||||
|
- sgr_locked = false;
|
||||||
|
- }
|
||||||
|
-#endif
|
||||||
|
+
|
||||||
|
+ unlock_group_files ();
|
||||||
|
+
|
||||||
|
#ifdef ENABLE_SUBIDS
|
||||||
|
if (is_sub_uid) {
|
||||||
|
if (sub_uid_unlock () == 0) {
|
||||||
|
@@ -1647,6 +1658,71 @@ static void close_files (void)
|
||||||
|
#endif /* ENABLE_SUBIDS */
|
||||||
|
}
|
||||||
|
|
||||||
|
+/*
|
||||||
|
+ * close_group_files - close all of the files that were opened
|
||||||
|
+ *
|
||||||
|
+ * close_group_files() closes all of the files that were opened related
|
||||||
|
+ * with groups. This causes any modified entries to be written out.
|
||||||
|
+ */
|
||||||
|
+static void close_group_files (void)
|
||||||
|
+{
|
||||||
|
+ if (do_grp_update) {
|
||||||
|
+ if (gr_close () == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: failure while writing changes to %s\n"), Prog, gr_dbname ());
|
||||||
|
+ SYSLOG ((LOG_ERR, "failure while writing changes to %s", gr_dbname ()));
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+#ifdef SHADOWGRP
|
||||||
|
+ if (is_shadow_grp && (sgr_close () == 0)) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: failure while writing changes to %s\n"),
|
||||||
|
+ Prog, sgr_dbname ());
|
||||||
|
+ SYSLOG ((LOG_ERR, "failure while writing changes to %s", sgr_dbname ()));
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+#endif /* SHADOWGRP */
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * unlock_group_files - unlock all of the files that were locked
|
||||||
|
+ *
|
||||||
|
+ * unlock_group_files() unlocks all of the files that were locked related
|
||||||
|
+ * with groups. This causes any modified entries to be written out.
|
||||||
|
+ */
|
||||||
|
+static void unlock_group_files (void)
|
||||||
|
+{
|
||||||
|
+ if (gr_unlock () == 0) {
|
||||||
|
+ fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, gr_dbname ());
|
||||||
|
+ SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
|
||||||
|
+#ifdef WITH_AUDIT
|
||||||
|
+ audit_logger (AUDIT_ADD_USER, Prog,
|
||||||
|
+ "unlocking-group-file",
|
||||||
|
+ user_name, AUDIT_NO_ID,
|
||||||
|
+ SHADOW_AUDIT_FAILURE);
|
||||||
|
+#endif /* WITH_AUDIT */
|
||||||
|
+ /* continue */
|
||||||
|
+ }
|
||||||
|
+ gr_locked = false;
|
||||||
|
+#ifdef SHADOWGRP
|
||||||
|
+ if (is_shadow_grp) {
|
||||||
|
+ if (sgr_unlock () == 0) {
|
||||||
|
+ fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sgr_dbname ());
|
||||||
|
+ SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
|
||||||
|
+#ifdef WITH_AUDIT
|
||||||
|
+ audit_logger (AUDIT_ADD_USER, Prog,
|
||||||
|
+ "unlocking-gshadow-file",
|
||||||
|
+ user_name, AUDIT_NO_ID,
|
||||||
|
+ SHADOW_AUDIT_FAILURE);
|
||||||
|
+#endif /* WITH_AUDIT */
|
||||||
|
+ /* continue */
|
||||||
|
+ }
|
||||||
|
+ sgr_locked = false;
|
||||||
|
+ }
|
||||||
|
+#endif /* SHADOWGRP */
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* open_files - lock and open the password files
|
||||||
|
*
|
||||||
|
@@ -1668,37 +1744,8 @@ static void open_files (void)
|
||||||
|
|
||||||
|
/* shadow file will be opened by open_shadow(); */
|
||||||
|
|
||||||
|
- /*
|
||||||
|
- * Lock and open the group file.
|
||||||
|
- */
|
||||||
|
- if (gr_lock () == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: cannot lock %s; try again later.\n"),
|
||||||
|
- Prog, gr_dbname ());
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
- gr_locked = true;
|
||||||
|
- if (gr_open (O_CREAT | O_RDWR) == 0) {
|
||||||
|
- fprintf (stderr, _("%s: cannot open %s\n"), Prog, gr_dbname ());
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
-#ifdef SHADOWGRP
|
||||||
|
- if (is_shadow_grp) {
|
||||||
|
- if (sgr_lock () == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: cannot lock %s; try again later.\n"),
|
||||||
|
- Prog, sgr_dbname ());
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
- sgr_locked = true;
|
||||||
|
- if (sgr_open (O_CREAT | O_RDWR) == 0) {
|
||||||
|
- fprintf (stderr,
|
||||||
|
- _("%s: cannot open %s\n"),
|
||||||
|
- Prog, sgr_dbname ());
|
||||||
|
- fail_exit (E_GRP_UPDATE);
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
-#endif
|
||||||
|
+ open_group_files ();
|
||||||
|
+
|
||||||
|
#ifdef ENABLE_SUBIDS
|
||||||
|
if (is_sub_uid) {
|
||||||
|
if (sub_uid_lock () == 0) {
|
||||||
|
@@ -1733,6 +1780,39 @@ static void open_files (void)
|
||||||
|
#endif /* ENABLE_SUBIDS */
|
||||||
|
}
|
||||||
|
|
||||||
|
+static void open_group_files (void)
|
||||||
|
+{
|
||||||
|
+ if (gr_lock () == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: cannot lock %s; try again later.\n"),
|
||||||
|
+ Prog, gr_dbname ());
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+ gr_locked = true;
|
||||||
|
+ if (gr_open (O_CREAT | O_RDWR) == 0) {
|
||||||
|
+ fprintf (stderr, _("%s: cannot open %s\n"), Prog, gr_dbname ());
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+#ifdef SHADOWGRP
|
||||||
|
+ if (is_shadow_grp) {
|
||||||
|
+ if (sgr_lock () == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: cannot lock %s; try again later.\n"),
|
||||||
|
+ Prog, sgr_dbname ());
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+ sgr_locked = true;
|
||||||
|
+ if (sgr_open (O_CREAT | O_RDWR) == 0) {
|
||||||
|
+ fprintf (stderr,
|
||||||
|
+ _("%s: cannot open %s\n"),
|
||||||
|
+ Prog, sgr_dbname ());
|
||||||
|
+ fail_exit (E_GRP_UPDATE);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+#endif /* SHADOWGRP */
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
static void open_shadow (void)
|
||||||
|
{
|
||||||
|
if (!is_shadow_pwd) {
|
||||||
|
--
|
||||||
|
2.25.4
|
||||||
|
|
341
shadow-4.8.1-manfix.patch
Normal file
341
shadow-4.8.1-manfix.patch
Normal file
@ -0,0 +1,341 @@
|
|||||||
|
diff -up shadow-4.8.1/man/chage.1.xml.manfix shadow-4.8.1/man/chage.1.xml
|
||||||
|
--- shadow-4.8.1/man/chage.1.xml.manfix 2019-10-05 01:28:34.000000000 +0200
|
||||||
|
+++ shadow-4.8.1/man/chage.1.xml 2020-03-17 15:34:48.750414984 +0100
|
||||||
|
@@ -102,6 +102,9 @@
|
||||||
|
Set the number of days since January 1st, 1970 when the password
|
||||||
|
was last changed. The date may also be expressed in the format
|
||||||
|
YYYY-MM-DD (or the format more commonly used in your area).
|
||||||
|
+ If the <replaceable>LAST_DAY</replaceable> is set to
|
||||||
|
+ <emphasis>0</emphasis> the user is forced to change his password
|
||||||
|
+ on the next log on.
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
@@ -119,6 +122,13 @@
|
||||||
|
system again.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
+ For example the following can be used to set an account to expire
|
||||||
|
+ in 180 days:
|
||||||
|
+ </para>
|
||||||
|
+ <programlisting>
|
||||||
|
+ chage -E $(date -d +180days +%Y-%m-%d)
|
||||||
|
+ </programlisting>
|
||||||
|
+ <para>
|
||||||
|
Passing the number <emphasis remap='I'>-1</emphasis> as the
|
||||||
|
<replaceable>EXPIRE_DATE</replaceable> will remove an account
|
||||||
|
expiration date.
|
||||||
|
@@ -239,6 +249,18 @@
|
||||||
|
The <command>chage</command> program requires a shadow password file to
|
||||||
|
be available.
|
||||||
|
</para>
|
||||||
|
+ <para>
|
||||||
|
+ The chage program will report only the information from the shadow
|
||||||
|
+ password file. This implies that configuration from other sources
|
||||||
|
+ (e.g. LDAP or empty password hash field from the passwd file) that
|
||||||
|
+ affect the user's login will not be shown in the chage output.
|
||||||
|
+ </para>
|
||||||
|
+ <para>
|
||||||
|
+ The <command>chage</command> program will also not report any
|
||||||
|
+ inconsistency between the shadow and passwd files (e.g. missing x in
|
||||||
|
+ the passwd file). The <command>pwck</command> can be used to check
|
||||||
|
+ for this kind of inconsistencies.
|
||||||
|
+ </para>
|
||||||
|
<para>The <command>chage</command> command is restricted to the root
|
||||||
|
user, except for the <option>-l</option> option, which may be used by
|
||||||
|
an unprivileged user to determine when their password or account is due
|
||||||
|
diff -up shadow-4.8.1/man/groupadd.8.xml.manfix shadow-4.8.1/man/groupadd.8.xml
|
||||||
|
--- shadow-4.8.1/man/groupadd.8.xml.manfix 2020-03-17 15:34:48.745414917 +0100
|
||||||
|
+++ shadow-4.8.1/man/groupadd.8.xml 2020-03-17 15:34:48.750414984 +0100
|
||||||
|
@@ -320,13 +320,13 @@
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>4</replaceable></term>
|
||||||
|
<listitem>
|
||||||
|
- <para>GID not unique (when <option>-o</option> not used)</para>
|
||||||
|
+ <para>GID is already used (when called without <option>-o</option>)</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>9</replaceable></term>
|
||||||
|
<listitem>
|
||||||
|
- <para>group name not unique</para>
|
||||||
|
+ <para>group name is already used</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
diff -up shadow-4.8.1/man/groupmems.8.xml.manfix shadow-4.8.1/man/groupmems.8.xml
|
||||||
|
--- shadow-4.8.1/man/groupmems.8.xml.manfix 2020-03-17 15:34:48.750414984 +0100
|
||||||
|
+++ shadow-4.8.1/man/groupmems.8.xml 2020-03-17 15:41:13.383588722 +0100
|
||||||
|
@@ -179,20 +179,10 @@
|
||||||
|
<refsect1 id='setup'>
|
||||||
|
<title>SETUP</title>
|
||||||
|
<para>
|
||||||
|
- The <command>groupmems</command> executable should be in mode
|
||||||
|
- <literal>2710</literal> as user <emphasis>root</emphasis> and in group
|
||||||
|
- <emphasis>groups</emphasis>. The system administrator can add users to
|
||||||
|
- group <emphasis>groups</emphasis> to allow or disallow them using the
|
||||||
|
- <command>groupmems</command> utility to manage their own group
|
||||||
|
- membership list.
|
||||||
|
+ In this operating system the <command>groupmems</command> executable
|
||||||
|
+ is not setuid and regular users cannot use it to manipulate
|
||||||
|
+ the membership of their own group.
|
||||||
|
</para>
|
||||||
|
-
|
||||||
|
- <programlisting>
|
||||||
|
- $ groupadd -r groups
|
||||||
|
- $ chmod 2710 groupmems
|
||||||
|
- $ chown root.groups groupmems
|
||||||
|
- $ groupmems -g groups -a gk4
|
||||||
|
- </programlisting>
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
<refsect1 id='configuration'>
|
||||||
|
diff -up shadow-4.8.1/man/ja/man5/login.defs.5.manfix shadow-4.8.1/man/ja/man5/login.defs.5
|
||||||
|
--- shadow-4.8.1/man/ja/man5/login.defs.5.manfix 2019-07-23 17:26:08.000000000 +0200
|
||||||
|
+++ shadow-4.8.1/man/ja/man5/login.defs.5 2020-03-17 15:34:48.750414984 +0100
|
||||||
|
@@ -147,10 +147,6 @@ 以下の参照表は、
|
||||||
|
shadow パスワード機能のどのプログラムが
|
||||||
|
どのパラメータを使用するかを示したものである。
|
||||||
|
.na
|
||||||
|
-.IP chfn 12
|
||||||
|
-CHFN_AUTH CHFN_RESTRICT
|
||||||
|
-.IP chsh 12
|
||||||
|
-CHFN_AUTH
|
||||||
|
.IP groupadd 12
|
||||||
|
GID_MAX GID_MIN
|
||||||
|
.IP newusers 12
|
||||||
|
diff -up shadow-4.8.1/man/login.defs.5.xml.manfix shadow-4.8.1/man/login.defs.5.xml
|
||||||
|
--- shadow-4.8.1/man/login.defs.5.xml.manfix 2020-01-17 16:47:56.000000000 +0100
|
||||||
|
+++ shadow-4.8.1/man/login.defs.5.xml 2020-03-17 15:34:48.750414984 +0100
|
||||||
|
@@ -164,6 +164,17 @@
|
||||||
|
long numeric parameters is machine-dependent.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
+ <para>
|
||||||
|
+ Please note that the parameters in this configuration file control the
|
||||||
|
+ behavior of the tools from the shadow-utils component. None of these
|
||||||
|
+ tools uses the PAM mechanism, and the utilities that use PAM (such as the
|
||||||
|
+ passwd command) should be configured elsewhere. The only values that
|
||||||
|
+ affect PAM modules are <emphasis>ENCRYPT_METHOD</emphasis> and <emphasis>SHA_CRYPT_MAX_ROUNDS</emphasis>
|
||||||
|
+ for pam_unix module, <emphasis>FAIL_DELAY</emphasis> for pam_faildelay module,
|
||||||
|
+ and <emphasis>UMASK</emphasis> for pam_umask module. Refer to
|
||||||
|
+ pam(8) for more information.
|
||||||
|
+ </para>
|
||||||
|
+
|
||||||
|
<para>The following configuration items are provided:</para>
|
||||||
|
|
||||||
|
<variablelist remap='IP'>
|
||||||
|
@@ -256,16 +267,6 @@
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
- <term>chfn</term>
|
||||||
|
- <listitem>
|
||||||
|
- <para>
|
||||||
|
- <phrase condition="no_pam">CHFN_AUTH</phrase>
|
||||||
|
- CHFN_RESTRICT
|
||||||
|
- <phrase condition="no_pam">LOGIN_STRING</phrase>
|
||||||
|
- </para>
|
||||||
|
- </listitem>
|
||||||
|
- </varlistentry>
|
||||||
|
- <varlistentry>
|
||||||
|
<term>chgpasswd</term>
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
@@ -286,14 +287,6 @@
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
- <varlistentry condition="no_pam">
|
||||||
|
- <term>chsh</term>
|
||||||
|
- <listitem>
|
||||||
|
- <para>
|
||||||
|
- CHSH_AUTH LOGIN_STRING
|
||||||
|
- </para>
|
||||||
|
- </listitem>
|
||||||
|
- </varlistentry>
|
||||||
|
<!-- expiry: no variables (CONSOLE_GROUPS linked, but not used) -->
|
||||||
|
<!-- faillog: no variables -->
|
||||||
|
<varlistentry>
|
||||||
|
@@ -359,34 +352,6 @@
|
||||||
|
<para>LASTLOG_UID_MAX</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
- <varlistentry>
|
||||||
|
- <term>login</term>
|
||||||
|
- <listitem>
|
||||||
|
- <para>
|
||||||
|
- <phrase condition="no_pam">CONSOLE</phrase>
|
||||||
|
- CONSOLE_GROUPS DEFAULT_HOME
|
||||||
|
- <phrase condition="no_pam">ENV_HZ ENV_PATH ENV_SUPATH
|
||||||
|
- ENV_TZ ENVIRON_FILE</phrase>
|
||||||
|
- ERASECHAR FAIL_DELAY
|
||||||
|
- <phrase condition="no_pam">FAILLOG_ENAB</phrase>
|
||||||
|
- FAKE_SHELL
|
||||||
|
- <phrase condition="no_pam">FTMP_FILE</phrase>
|
||||||
|
- HUSHLOGIN_FILE
|
||||||
|
- <phrase condition="no_pam">ISSUE_FILE</phrase>
|
||||||
|
- KILLCHAR
|
||||||
|
- <phrase condition="no_pam">LASTLOG_ENAB LASTLOG_UID_MAX</phrase>
|
||||||
|
- LOGIN_RETRIES
|
||||||
|
- <phrase condition="no_pam">LOGIN_STRING</phrase>
|
||||||
|
- LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB
|
||||||
|
- <phrase condition="no_pam">MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE
|
||||||
|
- MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB
|
||||||
|
- QUOTAS_ENAB</phrase>
|
||||||
|
- TTYGROUP TTYPERM TTYTYPE_FILE
|
||||||
|
- <phrase condition="no_pam">ULIMIT UMASK</phrase>
|
||||||
|
- USERGROUPS_ENAB
|
||||||
|
- </para>
|
||||||
|
- </listitem>
|
||||||
|
- </varlistentry>
|
||||||
|
<!-- logoutd: no variables -->
|
||||||
|
<varlistentry>
|
||||||
|
<term>newgrp / sg</term>
|
||||||
|
@@ -415,17 +380,6 @@
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
<!-- nologin: no variables -->
|
||||||
|
- <varlistentry condition="no_pam">
|
||||||
|
- <term>passwd</term>
|
||||||
|
- <listitem>
|
||||||
|
- <para>
|
||||||
|
- ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB
|
||||||
|
- PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN
|
||||||
|
- <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
|
||||||
|
- SHA_CRYPT_MIN_ROUNDS</phrase>
|
||||||
|
- </para>
|
||||||
|
- </listitem>
|
||||||
|
- </varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
<term>pwck</term>
|
||||||
|
<listitem>
|
||||||
|
@@ -452,32 +406,6 @@
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
- <varlistentry>
|
||||||
|
- <term>su</term>
|
||||||
|
- <listitem>
|
||||||
|
- <para>
|
||||||
|
- <phrase condition="no_pam">CONSOLE</phrase>
|
||||||
|
- CONSOLE_GROUPS DEFAULT_HOME
|
||||||
|
- <phrase condition="no_pam">ENV_HZ ENVIRON_FILE</phrase>
|
||||||
|
- ENV_PATH ENV_SUPATH
|
||||||
|
- <phrase condition="no_pam">ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB
|
||||||
|
- MAIL_DIR MAIL_FILE QUOTAS_ENAB</phrase>
|
||||||
|
- SULOG_FILE SU_NAME
|
||||||
|
- <phrase condition="no_pam">SU_WHEEL_ONLY</phrase>
|
||||||
|
- SYSLOG_SU_ENAB
|
||||||
|
- <phrase condition="no_pam">USERGROUPS_ENAB</phrase>
|
||||||
|
- </para>
|
||||||
|
- </listitem>
|
||||||
|
- </varlistentry>
|
||||||
|
- <varlistentry>
|
||||||
|
- <term>sulogin</term>
|
||||||
|
- <listitem>
|
||||||
|
- <para>
|
||||||
|
- ENV_HZ
|
||||||
|
- <phrase condition="no_pam">ENV_TZ</phrase>
|
||||||
|
- </para>
|
||||||
|
- </listitem>
|
||||||
|
- </varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
<term>useradd</term>
|
||||||
|
<listitem>
|
||||||
|
diff -up shadow-4.8.1/man/shadow.5.xml.manfix shadow-4.8.1/man/shadow.5.xml
|
||||||
|
--- shadow-4.8.1/man/shadow.5.xml.manfix 2019-12-01 17:52:32.000000000 +0100
|
||||||
|
+++ shadow-4.8.1/man/shadow.5.xml 2020-03-17 15:34:48.750414984 +0100
|
||||||
|
@@ -129,7 +129,7 @@
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
The date of the last password change, expressed as the number
|
||||||
|
- of days since Jan 1, 1970.
|
||||||
|
+ of days since Jan 1, 1970 00:00 UTC.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
The value 0 has a special meaning, which is that the user
|
||||||
|
@@ -208,8 +208,8 @@
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
After expiration of the password and this expiration period is
|
||||||
|
- elapsed, no login is possible using the current user's
|
||||||
|
- password. The user should contact her administrator.
|
||||||
|
+ elapsed, no login is possible for the user.
|
||||||
|
+ The user should contact her administrator.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
An empty field means that there are no enforcement of an
|
||||||
|
@@ -224,7 +224,7 @@
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
The date of expiration of the account, expressed as the number
|
||||||
|
- of days since Jan 1, 1970.
|
||||||
|
+ of days since Jan 1, 1970 00:00 UTC.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
Note that an account expiration differs from a password
|
||||||
|
diff -up shadow-4.8.1/man/useradd.8.xml.manfix shadow-4.8.1/man/useradd.8.xml
|
||||||
|
--- shadow-4.8.1/man/useradd.8.xml.manfix 2020-03-17 15:34:48.745414917 +0100
|
||||||
|
+++ shadow-4.8.1/man/useradd.8.xml 2020-03-17 15:34:48.751414997 +0100
|
||||||
|
@@ -359,6 +359,11 @@
|
||||||
|
<option>CREATE_HOME</option> is not enabled, no home
|
||||||
|
directories are created.
|
||||||
|
</para>
|
||||||
|
+ <para>
|
||||||
|
+ The directory where the user's home directory is created must
|
||||||
|
+ exist and have proper SELinux context and permissions. Otherwise
|
||||||
|
+ the user's home directory cannot be created or accessed.
|
||||||
|
+ </para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
diff -up shadow-4.8.1/man/usermod.8.xml.manfix shadow-4.8.1/man/usermod.8.xml
|
||||||
|
--- shadow-4.8.1/man/usermod.8.xml.manfix 2019-12-20 06:58:23.000000000 +0100
|
||||||
|
+++ shadow-4.8.1/man/usermod.8.xml 2020-03-17 15:34:48.751414997 +0100
|
||||||
|
@@ -143,7 +143,8 @@
|
||||||
|
If the <option>-m</option>
|
||||||
|
option is given, the contents of the current home directory will
|
||||||
|
be moved to the new home directory, which is created if it does
|
||||||
|
- not already exist.
|
||||||
|
+ not already exist. If the current home directory does not exist
|
||||||
|
+ the new home directory will not be created.
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
@@ -205,6 +206,12 @@
|
||||||
|
The group ownership of files outside of the user's home directory
|
||||||
|
must be fixed manually.
|
||||||
|
</para>
|
||||||
|
+ <para>
|
||||||
|
+ The change of the group ownership of files inside of the user's
|
||||||
|
+ home directory is also not done if the home dir owner uid is
|
||||||
|
+ different from the current or new user id. This is safety measure
|
||||||
|
+ for special home directories such as <filename>/</filename>.
|
||||||
|
+ </para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
@@ -267,7 +274,8 @@
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
Move the content of the user's home directory to the new
|
||||||
|
- location.
|
||||||
|
+ location. If the current home directory does not exist
|
||||||
|
+ the new home directory will not be created.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
This option is only valid in combination with the
|
||||||
|
@@ -381,6 +389,12 @@
|
||||||
|
must be fixed manually.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
+ The change of the user ownership of files inside of the user's
|
||||||
|
+ home directory is also not done if the home dir owner uid is
|
||||||
|
+ different from the current or new user id. This is safety measure
|
||||||
|
+ for special home directories such as <filename>/</filename>.
|
||||||
|
+ </para>
|
||||||
|
+ <para>
|
||||||
|
No checks will be performed with regard to the
|
||||||
|
<option>UID_MIN</option>, <option>UID_MAX</option>,
|
||||||
|
<option>SYS_UID_MIN</option>, or <option>SYS_UID_MAX</option>
|
35
shadow-4.8.1-useradd-man-clarification.patch
Normal file
35
shadow-4.8.1-useradd-man-clarification.patch
Normal file
@ -0,0 +1,35 @@
|
|||||||
|
From 6543c600d841e4f7779269412d470e50eae25b13 Mon Sep 17 00:00:00 2001
|
||||||
|
From: ikerexxe <ipedrosa@redhat.com>
|
||||||
|
Date: Wed, 4 Mar 2020 14:50:04 +0100
|
||||||
|
Subject: [PATCH] useradd: clarify the useradd -d parameter behavior in man
|
||||||
|
page
|
||||||
|
|
||||||
|
Explanation: clarify the useradd -d parameter as it does create directory HOME_DIR if it doesn't exit.
|
||||||
|
|
||||||
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1677005
|
||||||
|
|
||||||
|
Changelog: [serge] minor tweak to the text
|
||||||
|
---
|
||||||
|
man/useradd.8.xml | 6 ++++--
|
||||||
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/man/useradd.8.xml b/man/useradd.8.xml
|
||||||
|
index 03612ce8..023c0d69 100644
|
||||||
|
--- a/man/useradd.8.xml
|
||||||
|
+++ b/man/useradd.8.xml
|
||||||
|
@@ -181,8 +181,10 @@
|
||||||
|
login directory. The default is to append the
|
||||||
|
<replaceable>LOGIN</replaceable> name to
|
||||||
|
<replaceable>BASE_DIR</replaceable> and use that as the login
|
||||||
|
- directory name. The directory <replaceable>HOME_DIR</replaceable>
|
||||||
|
- does not have to exist but will not be created if it is missing.
|
||||||
|
+ directory name. If the directory
|
||||||
|
+ <replaceable>HOME_DIR</replaceable> does not exist, then it
|
||||||
|
+ will be created unless the <option>-M</option> option is
|
||||||
|
+ specified.
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
--
|
||||||
|
2.25.1
|
||||||
|
|
32
shadow-bsd.txt
Normal file
32
shadow-bsd.txt
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 1990 - 1994, Julianne Frances Haugh
|
||||||
|
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||||
|
* Copyright (c) 2000 - 2006, Tomasz Kłoczko
|
||||||
|
* Copyright (c) 2007 - 2011, Nicolas François
|
||||||
|
* All rights reserved.
|
||||||
|
*
|
||||||
|
* Redistribution and use in source and binary forms, with or without
|
||||||
|
* modification, are permitted provided that the following conditions
|
||||||
|
* are met:
|
||||||
|
* 1. Redistributions of source code must retain the above copyright
|
||||||
|
* notice, this list of conditions and the following disclaimer.
|
||||||
|
* 2. Redistributions in binary form must reproduce the above copyright
|
||||||
|
* notice, this list of conditions and the following disclaimer in the
|
||||||
|
* documentation and/or other materials provided with the distribution.
|
||||||
|
* 3. The name of the copyright holders or contributors may not be used to
|
||||||
|
* endorse or promote products derived from this software without
|
||||||
|
* specific prior written permission.
|
||||||
|
*
|
||||||
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||||
|
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||||
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||||
|
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||||
|
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||||
|
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||||
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||||
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||||
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||||
|
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
*/
|
||||||
|
|
43
shadow-utils.HOME_MODE.xml
Normal file
43
shadow-utils.HOME_MODE.xml
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
<!--
|
||||||
|
Copyright (c) 1991 - 1993, Julianne Frances Haugh
|
||||||
|
Copyright (c) 1991 - 1993, Chip Rosenthal
|
||||||
|
Copyright (c) 2007 - 2009, Nicolas François
|
||||||
|
All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions
|
||||||
|
are met:
|
||||||
|
1. Redistributions of source code must retain the above copyright
|
||||||
|
notice, this list of conditions and the following disclaimer.
|
||||||
|
2. Redistributions in binary form must reproduce the above copyright
|
||||||
|
notice, this list of conditions and the following disclaimer in the
|
||||||
|
documentation and/or other materials provided with the distribution.
|
||||||
|
3. The name of the copyright holders or contributors may not be used to
|
||||||
|
endorse or promote products derived from this software without
|
||||||
|
specific prior written permission.
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||||
|
``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||||
|
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||||
|
HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||||
|
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||||
|
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||||
|
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||||
|
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||||
|
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
-->
|
||||||
|
<varlistentry>
|
||||||
|
<term><option>HOME_MODE</option> (number)</term>
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
The mode for new home directories. If not specified,
|
||||||
|
the <option>UMASK</option> is used to create the mode.
|
||||||
|
</para>
|
||||||
|
<para>
|
||||||
|
<command>useradd</command> and <command>newusers</command> use this
|
||||||
|
to set the mode of the home directory they create.
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
268
shadow-utils.login.defs
Normal file
268
shadow-utils.login.defs
Normal file
@ -0,0 +1,268 @@
|
|||||||
|
#
|
||||||
|
# Please note that the parameters in this configuration file control the
|
||||||
|
# behavior of the tools from the shadow-utils component. None of these
|
||||||
|
# tools uses the PAM mechanism, and the utilities that use PAM (such as the
|
||||||
|
# passwd command) should therefore be configured elsewhere. Refer to
|
||||||
|
# /etc/pam.d/system-auth for more information.
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Delay in seconds before being allowed another attempt after a login failure
|
||||||
|
# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
|
||||||
|
# pam_unix(8) enforces a 2s delay)
|
||||||
|
#
|
||||||
|
#FAIL_DELAY 3
|
||||||
|
|
||||||
|
# Currently FAILLOG_ENAB is not supported
|
||||||
|
|
||||||
|
#
|
||||||
|
# Enable display of unknown usernames when login(1) failures are recorded.
|
||||||
|
#
|
||||||
|
#LOG_UNKFAIL_ENAB no
|
||||||
|
|
||||||
|
# Currently LOG_OK_LOGINS is not supported
|
||||||
|
|
||||||
|
# Currently LASTLOG_ENAB is not supported
|
||||||
|
|
||||||
|
#
|
||||||
|
# Limit the highest user ID number for which the lastlog entries should
|
||||||
|
# be updated.
|
||||||
|
#
|
||||||
|
# No LASTLOG_UID_MAX means that there is no user ID limit for writing
|
||||||
|
# lastlog entries.
|
||||||
|
#
|
||||||
|
#LASTLOG_UID_MAX
|
||||||
|
|
||||||
|
# Currently MAIL_CHECK_ENAB is not supported
|
||||||
|
|
||||||
|
# Currently OBSCURE_CHECKS_ENAB is not supported
|
||||||
|
|
||||||
|
# Currently PORTTIME_CHECKS_ENAB is not supported
|
||||||
|
|
||||||
|
# Currently QUOTAS_ENAB is not supported
|
||||||
|
|
||||||
|
# Currently SYSLOG_SU_ENAB is not supported
|
||||||
|
|
||||||
|
#
|
||||||
|
# Enable "syslog" logging of newgrp(1) and sg(1) activity.
|
||||||
|
#
|
||||||
|
#SYSLOG_SG_ENAB yes
|
||||||
|
|
||||||
|
# Currently CONSOLE is not supported
|
||||||
|
|
||||||
|
# Currently SULOG_FILE is not supported
|
||||||
|
|
||||||
|
# Currently MOTD_FILE is not supported
|
||||||
|
|
||||||
|
# Currently ISSUE_FILE is not supported
|
||||||
|
|
||||||
|
# Currently TTYTYPE_FILE is not supported
|
||||||
|
|
||||||
|
# Currently FTMP_FILE is not supported
|
||||||
|
|
||||||
|
# Currently NOLOGINS_FILE is not supported
|
||||||
|
|
||||||
|
# Currently SU_NAME is not supported
|
||||||
|
|
||||||
|
# *REQUIRED*
|
||||||
|
# Directory where mailboxes reside, _or_ name of file, relative to the
|
||||||
|
# home directory. If you _do_ define both, MAIL_DIR takes precedence.
|
||||||
|
#
|
||||||
|
MAIL_DIR /var/spool/mail
|
||||||
|
#MAIL_FILE .mail
|
||||||
|
|
||||||
|
#
|
||||||
|
# If defined, file which inhibits all the usual chatter during the login
|
||||||
|
# sequence. If a full pathname, then hushed mode will be enabled if the
|
||||||
|
# user's name or shell are found in the file. If not a full pathname, then
|
||||||
|
# hushed mode will be enabled if the file exists in the user's home directory.
|
||||||
|
#
|
||||||
|
#HUSHLOGIN_FILE .hushlogin
|
||||||
|
#HUSHLOGIN_FILE /etc/hushlogins
|
||||||
|
|
||||||
|
# Currently ENV_TZ is not supported
|
||||||
|
|
||||||
|
# Currently ENV_HZ is not supported
|
||||||
|
|
||||||
|
#
|
||||||
|
# The default PATH settings, for superuser and normal users.
|
||||||
|
#
|
||||||
|
# (they are minimal, add the rest in the shell startup files)
|
||||||
|
#ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin
|
||||||
|
#ENV_PATH PATH=/bin:/usr/bin
|
||||||
|
|
||||||
|
#
|
||||||
|
# Terminal permissions
|
||||||
|
#
|
||||||
|
# TTYGROUP Login tty will be assigned this group ownership.
|
||||||
|
# TTYPERM Login tty will be set to this permission.
|
||||||
|
#
|
||||||
|
# If you have a write(1) program which is "setgid" to a special group
|
||||||
|
# which owns the terminals, define TTYGROUP as the number of such group
|
||||||
|
# and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and
|
||||||
|
# set TTYPERM to either 622 or 600.
|
||||||
|
#
|
||||||
|
#TTYGROUP tty
|
||||||
|
#TTYPERM 0600
|
||||||
|
|
||||||
|
# Currently ERASECHAR, KILLCHAR and ULIMIT are not supported
|
||||||
|
|
||||||
|
# Default initial "umask" value used by login(1) on non-PAM enabled systems.
|
||||||
|
# Default "umask" value for pam_umask(8) on PAM enabled systems.
|
||||||
|
# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
|
||||||
|
# home directories if HOME_MODE is not set.
|
||||||
|
# 022 is the default value, but 027, or even 077, could be considered
|
||||||
|
# for increased privacy. There is no One True Answer here: each sysadmin
|
||||||
|
# must make up their mind.
|
||||||
|
UMASK 022
|
||||||
|
|
||||||
|
# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
|
||||||
|
# home directories.
|
||||||
|
# If HOME_MODE is not set, the value of UMASK is used to create the mode.
|
||||||
|
HOME_MODE 0700
|
||||||
|
|
||||||
|
# Password aging controls:
|
||||||
|
#
|
||||||
|
# PASS_MAX_DAYS Maximum number of days a password may be used.
|
||||||
|
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
|
||||||
|
# PASS_MIN_LEN Minimum acceptable password length.
|
||||||
|
# PASS_WARN_AGE Number of days warning given before a password expires.
|
||||||
|
#
|
||||||
|
PASS_MAX_DAYS 99999
|
||||||
|
PASS_MIN_DAYS 0
|
||||||
|
PASS_WARN_AGE 7
|
||||||
|
|
||||||
|
# Currently PASS_MIN_LEN is not supported
|
||||||
|
|
||||||
|
# Currently SU_WHEEL_ONLY is not supported
|
||||||
|
|
||||||
|
# Currently CRACKLIB_DICTPATH is not supported
|
||||||
|
|
||||||
|
#
|
||||||
|
# Min/max values for automatic uid selection in useradd(8)
|
||||||
|
#
|
||||||
|
UID_MIN 1000
|
||||||
|
UID_MAX 60000
|
||||||
|
# System accounts
|
||||||
|
SYS_UID_MIN 201
|
||||||
|
SYS_UID_MAX 999
|
||||||
|
# Extra per user uids
|
||||||
|
SUB_UID_MIN 100000
|
||||||
|
SUB_UID_MAX 600100000
|
||||||
|
SUB_UID_COUNT 65536
|
||||||
|
|
||||||
|
#
|
||||||
|
# Min/max values for automatic gid selection in groupadd(8)
|
||||||
|
#
|
||||||
|
GID_MIN 1000
|
||||||
|
GID_MAX 60000
|
||||||
|
# System accounts
|
||||||
|
SYS_GID_MIN 201
|
||||||
|
SYS_GID_MAX 999
|
||||||
|
# Extra per user group ids
|
||||||
|
SUB_GID_MIN 100000
|
||||||
|
SUB_GID_MAX 600100000
|
||||||
|
SUB_GID_COUNT 65536
|
||||||
|
|
||||||
|
#
|
||||||
|
# Max number of login(1) retries if password is bad
|
||||||
|
#
|
||||||
|
#LOGIN_RETRIES 3
|
||||||
|
|
||||||
|
#
|
||||||
|
# Max time in seconds for login(1)
|
||||||
|
#
|
||||||
|
#LOGIN_TIMEOUT 60
|
||||||
|
|
||||||
|
# Currently PASS_CHANGE_TRIES is not supported
|
||||||
|
|
||||||
|
# Currently PASS_ALWAYS_WARN is not supported
|
||||||
|
|
||||||
|
# Currently PASS_MAX_LEN is not supported
|
||||||
|
|
||||||
|
# Currently CHFN_AUTH is not supported
|
||||||
|
|
||||||
|
#
|
||||||
|
# Which fields may be changed by regular users using chfn(1) - use
|
||||||
|
# any combination of letters "frwh" (full name, room number, work
|
||||||
|
# phone, home phone). If not defined, no changes are allowed.
|
||||||
|
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
|
||||||
|
#
|
||||||
|
#CHFN_RESTRICT rwh
|
||||||
|
|
||||||
|
# Currently LOGIN_STRING is not supported
|
||||||
|
|
||||||
|
# Currently MD5_CRYPT_ENAB is not supported
|
||||||
|
|
||||||
|
#
|
||||||
|
# If set to MD5, MD5-based algorithm will be used for encrypting password
|
||||||
|
# If set to SHA256, SHA256-based algorithm will be used for encrypting password
|
||||||
|
# If set to SHA512, SHA512-based algorithm will be used for encrypting password
|
||||||
|
# If set to BLOWFISH, BLOWFISH-based algorithm will be used for encrypting password
|
||||||
|
# If set to DES, DES-based algorithm will be used for encrypting password (default)
|
||||||
|
#
|
||||||
|
ENCRYPT_METHOD SHA512
|
||||||
|
|
||||||
|
#
|
||||||
|
# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
|
||||||
|
#
|
||||||
|
# Define the number of SHA rounds.
|
||||||
|
# With a lot of rounds, it is more difficult to brute-force the password.
|
||||||
|
# However, more CPU resources will be needed to authenticate users if
|
||||||
|
# this value is increased.
|
||||||
|
#
|
||||||
|
# If not specified, the libc will choose the default number of rounds (5000).
|
||||||
|
# The values must be within the 1000-999999999 range.
|
||||||
|
#
|
||||||
|
#SHA_CRYPT_MAX_ROUNDS 5000
|
||||||
|
|
||||||
|
# Currently SHA_CRYPT_MIN_ROUNDS is not supported
|
||||||
|
|
||||||
|
# Currently BCRYPT_MIN_ROUNDS and BCRYPT_MAX_ROUNDS are not supported
|
||||||
|
|
||||||
|
# Currently CONSOLE_GROUPS is not supported
|
||||||
|
|
||||||
|
#
|
||||||
|
# Should login be allowed if we can't cd to the home directory?
|
||||||
|
# Default is yes.
|
||||||
|
#
|
||||||
|
#DEFAULT_HOME yes
|
||||||
|
|
||||||
|
# Currently ENVIRON_FILE is not supported
|
||||||
|
|
||||||
|
#
|
||||||
|
# If defined, this command is run when removing a user.
|
||||||
|
# It should remove any at/cron/print jobs etc. owned by
|
||||||
|
# the user to be removed (passed as the first argument).
|
||||||
|
#
|
||||||
|
#USERDEL_CMD /usr/sbin/userdel_local
|
||||||
|
|
||||||
|
#
|
||||||
|
# Enables userdel(8) to remove user groups if no members exist.
|
||||||
|
#
|
||||||
|
USERGROUPS_ENAB yes
|
||||||
|
|
||||||
|
#
|
||||||
|
# If set to a non-zero number, the shadow utilities will make sure that
|
||||||
|
# groups never have more than this number of users on one line.
|
||||||
|
# This permits to support split groups (groups split into multiple lines,
|
||||||
|
# with the same group ID, to avoid limitation of the line length in the
|
||||||
|
# group file).
|
||||||
|
#
|
||||||
|
# 0 is the default value and disables this feature.
|
||||||
|
#
|
||||||
|
#MAX_MEMBERS_PER_GROUP 0
|
||||||
|
|
||||||
|
#
|
||||||
|
# If useradd(8) should create home directories for users by default (non
|
||||||
|
# system users only).
|
||||||
|
# This option is overridden with the -M or -m flags on the useradd(8)
|
||||||
|
# command-line.
|
||||||
|
#
|
||||||
|
CREATE_HOME yes
|
||||||
|
|
||||||
|
#
|
||||||
|
# Force use shadow, even if shadow passwd & shadow group files are
|
||||||
|
# missing.
|
||||||
|
#
|
||||||
|
#FORCE_SHADOW yes
|
1256
shadow-utils.spec
Normal file
1256
shadow-utils.spec
Normal file
File diff suppressed because it is too large
Load Diff
9
shadow-utils.useradd
Normal file
9
shadow-utils.useradd
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
# useradd defaults file
|
||||||
|
GROUP=100
|
||||||
|
HOME=/home
|
||||||
|
INACTIVE=-1
|
||||||
|
EXPIRE=
|
||||||
|
SHELL=/bin/bash
|
||||||
|
SKEL=/etc/skel
|
||||||
|
CREATE_MAIL_SPOOL=yes
|
||||||
|
|
2
sources
Normal file
2
sources
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
SHA512 (shadow-4.8.1.tar.xz) = 780a983483d847ed3c91c82064a0fa902b6f4185225978241bc3bc03fcc3aa143975b46aee43151c6ba43efcfdb1819516b76ba7ad3d1d3c34fcc38ea42e917b
|
||||||
|
SHA512 (shadow-4.8.1.tar.xz.asc) = ec7686263c81d3feb8ee4314c3323a9a3ada74aafaaf99f4f0d9af9b1341f8c5ff5477ecf98dd94dbb7d921f532d655b0b6a87d94c71893f35dc9bc54c84dd42
|
77
tests/sanity/Makefile
Normal file
77
tests/sanity/Makefile
Normal file
@ -0,0 +1,77 @@
|
|||||||
|
# Copyright (c) 2006 Red Hat, Inc. All rights reserved. This copyrighted material
|
||||||
|
# is made available to anyone wishing to use, modify, copy, or
|
||||||
|
# redistribute it subject to the terms and conditions of the GNU General
|
||||||
|
# Public License v.2.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||||
|
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
|
||||||
|
# PARTICULAR PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program; if not, write to the Free Software
|
||||||
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
||||||
|
#
|
||||||
|
# Author: Jakub Hrozek
|
||||||
|
|
||||||
|
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
|
||||||
|
# Example Makefile for RHTS #
|
||||||
|
# This example is geared towards a test for a specific package #
|
||||||
|
# It does most of the work for you, but may require further coding #
|
||||||
|
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
|
||||||
|
|
||||||
|
# The toplevel namespace within which the test lives.
|
||||||
|
TOPLEVEL_NAMESPACE=CoreOS
|
||||||
|
|
||||||
|
# The name of the package under test:
|
||||||
|
PACKAGE_NAME=shadow-utils
|
||||||
|
|
||||||
|
# The path of the test below the package:
|
||||||
|
RELATIVE_PATH=sanity
|
||||||
|
|
||||||
|
# Version of the Test. Used with make tag.
|
||||||
|
export TESTVERSION=1.1
|
||||||
|
|
||||||
|
# The combined namespace of the test.
|
||||||
|
export TEST=/$(TOPLEVEL_NAMESPACE)/$(PACKAGE_NAME)/$(RELATIVE_PATH)
|
||||||
|
|
||||||
|
# A phony target is one that is not really the name of a file.
|
||||||
|
# It is just a name for some commands to be executed when you
|
||||||
|
# make an explicit request. There are two reasons to use a
|
||||||
|
# phony target: to avoid a conflict with a file of the same
|
||||||
|
# name, and to improve performance.
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
# Executables to be built should be added here, they will be generated on the system under test.
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
# Data files, .c files, scripts anything needed to either compile the test and/or run it.
|
||||||
|
FILES=$(METADATA) Makefile PURPOSE sanity_test.py runtest.sh
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
chmod a+x ./sanity_test.py
|
||||||
|
chmod a+x ./runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ *.rpm $(BUILT_FILES)
|
||||||
|
|
||||||
|
# Include Common Makefile
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
# Generate the testinfo.desc here:
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@touch $(METADATA)
|
||||||
|
@echo "Owner: Jakub Hrozek <jhrozek@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "License: GNU GPL" >> $(METADATA)
|
||||||
|
@echo "Description: Basic sanity test for shadow-utils" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: $(PACKAGE_NAME)" >> $(METADATA)
|
||||||
|
@echo "Requires: $(PACKAGE_NAME)" >> $(METADATA)
|
||||||
|
@echo "Requires: python" >> $(METADATA)
|
||||||
|
rhts-lint $(METADATA)
|
||||||
|
|
10
tests/sanity/PURPOSE
Normal file
10
tests/sanity/PURPOSE
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
This is a basic sanity test for the shadow-utils package. It is implemented
|
||||||
|
in python on top of the unittesting.py module.
|
||||||
|
|
||||||
|
Its purpose is to ensure that the binaries in the shadow-utils package behave
|
||||||
|
as expected and its switches/options work correctly.
|
||||||
|
|
||||||
|
For the most part, every binary in the shadow-utils package is represented by
|
||||||
|
a single class named Test<BinaryName>, i.e. TestUsermod etc. There are some
|
||||||
|
exceptions, like TestUseraddWeirdNameTest though.
|
||||||
|
|
24
tests/sanity/runtest.sh
Executable file
24
tests/sanity/runtest.sh
Executable file
@ -0,0 +1,24 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
. /usr/bin/rhts-environment.sh
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlFileBackup --clean /etc/default/useradd- /etc/default/useradd
|
||||||
|
setenforce 0
|
||||||
|
python sanity_test.py -v
|
||||||
|
setenforce 1
|
||||||
|
rlFileRestore
|
||||||
|
|
||||||
|
EXIT=$?
|
||||||
|
if [[ $EXIT -eq 0 ]]; then
|
||||||
|
RESULT="PASS"
|
||||||
|
else
|
||||||
|
RESULT="FAIL"
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
rlJournalEnd
|
||||||
|
|
||||||
|
echo "Result: $RESULT"
|
||||||
|
echo "Exit: $EXIT"
|
||||||
|
report_result $TEST $RESULT $EXIT
|
1013
tests/sanity/sanity_test.py
Executable file
1013
tests/sanity/sanity_test.py
Executable file
File diff suppressed because it is too large
Load Diff
13
tests/tests.yml
Normal file
13
tests/tests.yml
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
# This first play always runs on the local staging system
|
||||||
|
- hosts: localhost
|
||||||
|
roles:
|
||||||
|
- role: standard-test-beakerlib
|
||||||
|
tags:
|
||||||
|
- classic
|
||||||
|
- atomic
|
||||||
|
tests:
|
||||||
|
- sanity
|
||||||
|
required_packages:
|
||||||
|
- shadow-utils # sanity test needs shadow-utils
|
||||||
|
- python # sanity test needs python
|
Loading…
Reference in New Issue
Block a user