rpms/shadow-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

do not allow "." and ".." user names

Browse Source
This commit is contained in:
Tomas Mraz 2017-09-15 17:54:22 +02:00
parent 2c7fd6de84
commit b90f1c3912
2 changed files with 47 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
shadow-4.1.5.1-goodname.patch → shadow-4.5-goodname.patch
View File

@ -1,7 +1,7 @@
diff -up shadow-4.1.5.1/libmisc/chkname.c.goodname shadow-4.1.5.1/libmisc/chkname.c diff -up shadow-4.5/libmisc/chkname.c.goodname shadow-4.5/libmisc/chkname.c
--- shadow-4.1.5.1/libmisc/chkname.c.goodname 2009-07-13 00:24:45.000000000 +0200 --- shadow-4.5/libmisc/chkname.c.goodname 2014-09-01 16:36:40.000000000 +0200
+++ shadow-4.1.5.1/libmisc/chkname.c 2014-09-09 17:35:17.207303124 +0200 +++ shadow-4.5/libmisc/chkname.c 2017-09-15 17:06:29.917939977 +0200
@@ -47,27 +47,42 @@ @@ -47,27 +47,46 @@
#include "chkname.h" #include "chkname.h"
static bool is_valid_name (const char *name) static bool is_valid_name (const char *name)
@ -18,16 +18,18 @@ diff -up shadow-4.1.5.1/libmisc/chkname.c.goodname shadow-4.1.5.1/libmisc/chknam
+ * as a non-POSIX, extension, allow "$" as the last char for + * as a non-POSIX, extension, allow "$" as the last char for
+ * sake of Samba 3.x "add machine script" + * sake of Samba 3.x "add machine script"
+ * + *
+ * Also do not allow fully numeric names. + * Also do not allow fully numeric names or just "." or "..".
+ */ + */
+ int numeric; + int numeric;
+ +
+ if ( ('\0' == *name) || + if ('\0' == *name ||
+ ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
+ '\0' == name[1])) ||
+ !((*name >= 'a' && *name <= 'z') || + !((*name >= 'a' && *name <= 'z') ||
+ (*name >= 'A' && *name <= 'Z') || + (*name >= 'A' && *name <= 'Z') ||
+ (*name >= '0' && *name <= '9') || + (*name >= '0' && *name <= '9') ||
+ (*name == '_') || (*name == '.') + *name == '_' ||
+ )) { + *name == '.')) {
return false; return false;
} }
@ -39,13 +41,14 @@ diff -up shadow-4.1.5.1/libmisc/chkname.c.goodname shadow-4.1.5.1/libmisc/chknam
- ('_' == *name) || - ('_' == *name) ||
- ('-' == *name) || - ('-' == *name) ||
- ( ('$' == *name) && ('\0' == *(name + 1)) ) - ( ('$' == *name) && ('\0' == *(name + 1)) )
- )) {
+ if (!((*name >= 'a' && *name <= 'z') || + if (!((*name >= 'a' && *name <= 'z') ||
+ (*name >= 'A' && *name <= 'Z') || + (*name >= 'A' && *name <= 'Z') ||
+ (*name >= '0' && *name <= '9') || + (*name >= '0' && *name <= '9') ||
+ (*name == '_') || (*name == '.') || (*name == '-') || + *name == '_' ||
+ (*name == '$' && *(name + 1) == '\0') + *name == '.' ||
+ )) { + *name == '-' ||
+ (*name == '$' && name[1] == '\0')
)) {
return false; return false;
} }
+ numeric &= isdigit(*name); + numeric &= isdigit(*name);
@ -56,10 +59,10 @@ diff -up shadow-4.1.5.1/libmisc/chkname.c.goodname shadow-4.1.5.1/libmisc/chknam
} }
bool is_valid_user_name (const char *name) bool is_valid_user_name (const char *name)
diff -up shadow-4.1.5.1/man/groupadd.8.xml.goodname shadow-4.1.5.1/man/groupadd.8.xml diff -up shadow-4.5/man/groupadd.8.xml.goodname shadow-4.5/man/groupadd.8.xml
--- shadow-4.1.5.1/man/groupadd.8.xml.goodname 2012-05-25 13:45:27.000000000 +0200 --- shadow-4.5/man/groupadd.8.xml.goodname 2014-09-01 16:36:40.000000000 +0200
+++ shadow-4.1.5.1/man/groupadd.8.xml 2014-09-09 17:28:46.330300342 +0200 +++ shadow-4.5/man/groupadd.8.xml 2017-08-14 10:27:24.657391521 +0200
@@ -259,12 +259,6 @@ @@ -256,12 +256,6 @@
<refsect1 id='caveats'> <refsect1 id='caveats'>
<title>CAVEATS</title> <title>CAVEATS</title>
<para> <para>
@ -72,10 +75,22 @@ diff -up shadow-4.1.5.1/man/groupadd.8.xml.goodname shadow-4.1.5.1/man/groupadd.
Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long. Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
</para> </para>
<para> <para>
diff -up shadow-4.1.5.1/man/useradd.8.xml.goodname shadow-4.1.5.1/man/useradd.8.xml diff -up shadow-4.5/man/useradd.8.xml.goodname shadow-4.5/man/useradd.8.xml
--- shadow-4.1.5.1/man/useradd.8.xml.goodname 2012-05-25 13:45:29.000000000 +0200 --- shadow-4.5/man/useradd.8.xml.goodname 2016-08-15 04:48:14.000000000 +0200
+++ shadow-4.1.5.1/man/useradd.8.xml 2014-09-09 17:28:46.330300342 +0200 +++ shadow-4.5/man/useradd.8.xml 2017-08-14 10:27:24.667391382 +0200
@@ -366,7 +366,7 @@ @@ -347,6 +347,11 @@
<option>CREATE_HOME</option> is not enabled, no home
directories are created.
</para>
+ <para>
+ The directory where the user's home directory is created must
+ exist and have proper SELinux context and permissions. Otherwise
+ the user's home directory cannot be created or accessed.
+ </para>
</listitem>
</varlistentry>
<varlistentry>
@@ -355,7 +360,7 @@
</term> </term>
<listitem> <listitem>
<para> <para>
@ -84,7 +99,7 @@ diff -up shadow-4.1.5.1/man/useradd.8.xml.goodname shadow-4.1.5.1/man/useradd.8.
wide setting from <filename>/etc/login.defs</filename> wide setting from <filename>/etc/login.defs</filename>
(<option>CREATE_HOME</option>) is set to (<option>CREATE_HOME</option>) is set to
<replaceable>yes</replaceable>. <replaceable>yes</replaceable>.
@@ -654,12 +654,6 @@ @@ -633,12 +638,6 @@
</para> </para>
<para> <para>

7
shadow-utils.spec
View File

@ -1,7 +1,7 @@
Summary: Utilities for managing accounts and shadow password files Summary: Utilities for managing accounts and shadow password files
Name: shadow-utils Name: shadow-utils
Version: 4.5 Version: 4.5
Release: 4%{?dist} Release: 5%{?dist}
Epoch: 2 Epoch: 2
URL: http://pkg-shadow.alioth.debian.org/ URL: http://pkg-shadow.alioth.debian.org/
Source0: https://github.com/shadow-maint/shadow/releases/download/%{version}/shadow-%{version}.tar.xz Source0: https://github.com/shadow-maint/shadow/releases/download/%{version}/shadow-%{version}.tar.xz
@ -11,7 +11,7 @@ Source3: shadow-utils.login.defs
Source4: shadow-bsd.txt Source4: shadow-bsd.txt
Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
Patch0: shadow-4.1.5-redhat.patch Patch0: shadow-4.1.5-redhat.patch
Patch1: shadow-4.1.5.1-goodname.patch Patch1: shadow-4.5-goodname.patch
Patch2: shadow-4.1.5.1-info-parent-dir.patch Patch2: shadow-4.1.5.1-info-parent-dir.patch
Patch6: shadow-4.5-selinux.patch Patch6: shadow-4.5-selinux.patch
Patch7: shadow-4.1.5-2ndskip.patch Patch7: shadow-4.1.5-2ndskip.patch
@ -234,6 +234,9 @@ rm -rf $RPM_BUILD_ROOT
%{_mandir}/man8/vigr.8* %{_mandir}/man8/vigr.8*
%changelog %changelog
* Fri Sep 15 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-5
- do not allow "." and ".." user names
* Mon Aug 14 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-4 * Mon Aug 14 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-4
- allow switching to secondary group without checking the membership - allow switching to secondary group without checking the membership
explicitly (patch from upstream) explicitly (patch from upstream)