Stop assigning subids by default

Resolves: CVE-2024-56433 and #2334168

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

shadow-utils.login.defs

@@ -148,7 +148,7 @@ SYS_UID_MAX               999
 # Extra per user uids
 SUB_UID_MIN		   524288
 SUB_UID_MAX		600100000
-SUB_UID_COUNT		    65536
+SUB_UID_COUNT		        0
 
 #
 # Min/max values for automatic gid selection in groupadd(8)
@@ -161,7 +161,7 @@ SYS_GID_MAX               999
 # Extra per user group ids
 SUB_GID_MIN		   524288
 SUB_GID_MAX		600100000
-SUB_GID_COUNT		    65536
+SUB_GID_COUNT		        0
 
 #
 # Max number of login(1) retries if password is bad

shadow-utils.spec

@@ -1,7 +1,7 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
 Version: 4.17.4
-Release: 4%{?dist}
+Release: 5%{?dist}
 Epoch: 2
 License: BSD-3-Clause AND GPL-2.0-or-later
 URL: https://github.com/shadow-maint/shadow
@@ -272,8 +272,12 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_libdir}/libsubid.so
 
 %changelog
+* Fri Jul 18 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-5
+- Stop assigning subids by default
+  Resolves: CVE-2024-56433 and #2334168
+
 * Tue Jul 15 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-4
-* FSWC: Migrate to lastlog2
+- FSWC: Migrate to lastlog2
   Link: <https://fedoraproject.org/wiki/Changes/Migrate_to_lastlog2>
   Resolves: #2361588