From e1cfa31731cd68aa2d76ebfb3142037d16d3bb1e Mon Sep 17 00:00:00 2001
From: Iker Pedrosa <ipedrosa@redhat.com>
Date: Fri, 18 Jul 2025 17:33:47 +0200
Subject: [PATCH] Stop assigning subids by default

Resolves: CVE-2024-56433 and #2334168

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 shadow-utils.login.defs | 4 ++--
 shadow-utils.spec       | 8 ++++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/shadow-utils.login.defs b/shadow-utils.login.defs
index e84c7ab..1e9129a 100644
--- a/shadow-utils.login.defs
+++ b/shadow-utils.login.defs
@@ -148,7 +148,7 @@ SYS_UID_MAX               999
 # Extra per user uids
 SUB_UID_MIN		   524288
 SUB_UID_MAX		600100000
-SUB_UID_COUNT		    65536
+SUB_UID_COUNT		        0
 
 #
 # Min/max values for automatic gid selection in groupadd(8)
@@ -161,7 +161,7 @@ SYS_GID_MAX               999
 # Extra per user group ids
 SUB_GID_MIN		   524288
 SUB_GID_MAX		600100000
-SUB_GID_COUNT		    65536
+SUB_GID_COUNT		        0
 
 #
 # Max number of login(1) retries if password is bad
diff --git a/shadow-utils.spec b/shadow-utils.spec
index a3cc639..834ff15 100644
--- a/shadow-utils.spec
+++ b/shadow-utils.spec
@@ -1,7 +1,7 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
 Version: 4.17.4
-Release: 4%{?dist}
+Release: 5%{?dist}
 Epoch: 2
 License: BSD-3-Clause AND GPL-2.0-or-later
 URL: https://github.com/shadow-maint/shadow
@@ -272,8 +272,12 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_libdir}/libsubid.so
 
 %changelog
+* Fri Jul 18 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-5
+- Stop assigning subids by default
+  Resolves: CVE-2024-56433 and #2334168
+
 * Tue Jul 15 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-4
-* FSWC: Migrate to lastlog2
+- FSWC: Migrate to lastlog2
   Link: <https://fedoraproject.org/wiki/Changes/Migrate_to_lastlog2>
   Resolves: #2361588