Rebase to version 4.20.0

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1 +1,56 @@
-shadow-4.1.4.1.tar.bz2
+shadow-4.1.4.2.tar.bz2
+/shadow-4.1.4.3.tar.bz2
+/shadow-4.1.5.tar.bz2
+/shadow-4.1.5.1.tar.bz2
+/shadow-4.1.5.1.tar.bz2.sig
+/shadow-4.2.1.tar.xz
+/shadow-4.2.1.tar.xz.sig
+/shadow-4.3.1.tar.gz
+/shadow-4.5.tar.xz
+/shadow-4.5.tar.xz.asc
+/shadow-4.6.tar.xz
+/shadow-4.6.tar.xz.asc
+/shadow-4.8.tar.xz
+/shadow-4.8.tar.xz.asc
+/shadow-4.8.1.tar.xz
+/shadow-4.8.1.tar.xz.asc
+/shadow-4.9.tar.xz
+/shadow-4.9.tar.xz.asc
+/shadow-4.11.1.tar.xz
+/shadow-4.11.1.tar.xz.asc
+/shadow-4.12.3.tar.xz
+/shadow-4.12.3.tar.xz.asc
+/shadow-4.13.tar.xz
+/shadow-4.13.tar.xz.asc
+/shadow-4.14.0.tar.xz
+/shadow-4.14.0.tar.xz.asc
+/shadow-4.15.0rc2.tar.xz
+/shadow-4.15.0rc2.tar.xz.asc
+/shadow-4.15.0rc3.tar.xz
+/shadow-4.15.0rc3.tar.xz.asc
+/shadow-4.15.0.tar.xz
+/shadow-4.15.0.tar.xz.asc
+/shadow-4.15.1.tar.xz
+/shadow-4.15.1.tar.xz.asc
+/shadow-4.16.0.tar.xz
+/shadow-4.16.0.tar.xz.asc
+/shadow-4.17.0-rc1.tar.xz
+/shadow-4.17.0-rc1.tar.xz.asc
+/shadow-4.17.0.tar.xz
+/shadow-4.17.0.tar.xz.asc
+/shadow-4.17.4.tar.xz
+/shadow-4.17.4.tar.xz.asc
+/shadow-4.18.0.tar.xz
+/shadow-4.18.0.tar.xz.asc
+/shadow-4.19.0.tar.xz
+/shadow-4.19.0.tar.xz.asc
+/shadow-4.19.2.tar.xz
+/shadow-4.19.2.tar.xz.asc
+/shadow-4.19.3.tar.xz
+/shadow-4.19.3.tar.xz.asc
+/shadow-4.20.0-rc2.tar.xz
+/shadow-4.20.0-rc2.tar.xz.asc
+/shadow-4.20.0-rc3.tar.xz
+/shadow-4.20.0-rc3.tar.xz.asc
+/shadow-4.20.0.tar.xz
+/shadow-4.20.0.tar.xz.asc

gpl-2.0.txt

@@ -0,0 +1,339 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

passwd.pamd

@@ -0,0 +1,5 @@
+#%PAM-1.0
+# This tool only uses the password stack.
+password   substack	system-auth
+-password   optional	pam_gnome_keyring.so use_authtok
+password   substack	postlogin

plans/tier0-functional.fmf

@@ -0,0 +1,51 @@
+summary: Tier 0 functional tests for shadow-utils
+description: |
+    Run comprehensive system tests for shadow-utils. These tests validate user and group
+    account management functionality by testing actual system operations including user
+    creation, password management, group operations, and verification of system files
+    (i.e. /etc/passwd, /etc/shadow).
+
+provision:
+    how: virtual
+    image: fedora
+
+prepare:
+    - name: Install general dependencies
+      how: install
+      package:
+        - expect
+        - gcc
+        - git
+        - libssh-devel
+        - python3-devel
+        - python3-pip
+
+    - name: Setup SSH keys for localhost testing
+      how: shell
+      script:
+        - ssh-keygen -t rsa -f /root/.ssh/id_rsa -N "" -q
+        - cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
+        - chmod 600 /root/.ssh/authorized_keys
+        - ssh-keyscan -H localhost >> /root/.ssh/known_hosts
+
+    - name: Clone shadow repository
+      how: shell
+      script:
+        - git clone https://github.com/shadow-maint/shadow.git /tmp/shadow-test
+
+    - name: Copy test topology for Fedora CI
+      how: shell
+      script:
+        - cp tests/mhc-fedora-ci.yaml /tmp/shadow-test/tests/system
+
+    - name: Install test dependencies
+      how: shell
+      script:
+        - pip3 install -r /tmp/shadow-test/tests/system/requirements.txt
+
+execute:
+    how: tmt
+    duration: 30m
+    script: |
+        cd /tmp/shadow-test/tests/system
+        pytest --mh-config=mhc-fedora-ci.yaml --mh-lazy-ssh -v

shadow-4.0.17-login.defs

@@ -1,58 +0,0 @@
-# *REQUIRED*
-#   Directory where mailboxes reside, _or_ name of file, relative to the
-#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
-#   QMAIL_DIR is for Qmail
-#
-#QMAIL_DIR	Maildir
-MAIL_DIR	/var/spool/mail
-#MAIL_FILE	.mail
-
-# Password aging controls:
-#
-#	PASS_MAX_DAYS	Maximum number of days a password may be used.
-#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
-#	PASS_MIN_LEN	Minimum acceptable password length.
-#	PASS_WARN_AGE	Number of days warning given before a password expires.
-#
-PASS_MAX_DAYS	99999
-PASS_MIN_DAYS	0
-PASS_MIN_LEN	5
-PASS_WARN_AGE	7
-
-#
-# Min/max values for automatic uid selection in useradd
-#
-UID_MIN			  500
-UID_MAX			60000
-
-#
-# Min/max values for automatic gid selection in groupadd
-#
-GID_MIN			  500
-GID_MAX			60000
-
-#
-# If defined, this command is run when removing a user.
-# It should remove any at/cron/print jobs etc. owned by
-# the user to be removed (passed as the first argument).
-#
-#USERDEL_CMD	/usr/sbin/userdel_local
-
-#
-# If useradd should create home directories for users by default
-# On RH systems, we do. This option is overridden with the -m flag on
-# useradd command line.
-#
-CREATE_HOME	yes
-
-# The permission mask is initialized to this value. If not specified, 
-# the permission mask will be initialized to 022.
-UMASK           077
-
-# This enables userdel to remove user groups if no members exist.
-#
-USERGROUPS_ENAB yes
-
-# Use MD5 or DES to encrypt password? Red Hat use MD5 by default.
-MD5_CRYPT_ENAB yes
-

shadow-4.1.4-redhat.patch

@@ -1,75 +0,0 @@
-diff -up shadow-4.1.4/libmisc/find_new_gid.c.redhat shadow-4.1.4/libmisc/find_new_gid.c
---- shadow-4.1.4/libmisc/find_new_gid.c.redhat	2009-04-23 19:36:42.000000000 +0200
-+++ shadow-4.1.4/libmisc/find_new_gid.c	2009-05-15 12:01:18.000000000 +0200
-@@ -58,11 +58,11 @@ int find_new_gid (bool sys_group,
- 	assert (gid != NULL);
- 
- 	if (!sys_group) {
--		gid_min = (gid_t) getdef_ulong ("GID_MIN", 1000UL);
-+		gid_min = (gid_t) getdef_ulong ("GID_MIN", 500UL);
- 		gid_max = (gid_t) getdef_ulong ("GID_MAX", 60000UL);
- 	} else {
- 		gid_min = (gid_t) getdef_ulong ("SYS_GID_MIN", 1UL);
--		gid_max = (gid_t) getdef_ulong ("GID_MIN", 1000UL) - 1;
-+		gid_max = (gid_t) getdef_ulong ("GID_MIN", 500UL) - 1;
- 		gid_max = (gid_t) getdef_ulong ("SYS_GID_MAX", (unsigned long) gid_max);
- 	}
- 	used_gids = alloca (sizeof (bool) * (gid_max +1));
-diff -up shadow-4.1.4/libmisc/find_new_uid.c.redhat shadow-4.1.4/libmisc/find_new_uid.c
---- shadow-4.1.4/libmisc/find_new_uid.c.redhat	2009-04-23 19:37:12.000000000 +0200
-+++ shadow-4.1.4/libmisc/find_new_uid.c	2009-05-15 12:01:39.000000000 +0200
-@@ -58,11 +58,11 @@ int find_new_uid (bool sys_user,
- 	assert (uid != NULL);
- 
- 	if (!sys_user) {
--		uid_min = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
-+		uid_min = (uid_t) getdef_ulong ("UID_MIN", 500UL);
- 		uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
- 	} else {
- 		uid_min = (uid_t) getdef_ulong ("SYS_UID_MIN", 1UL);
--		uid_max = (uid_t) getdef_ulong ("UID_MIN", 1000UL) - 1;
-+		uid_max = (uid_t) getdef_ulong ("UID_MIN", 500UL) - 1;
- 		uid_max = (uid_t) getdef_ulong ("SYS_UID_MAX", (unsigned long) uid_max);
- 	}
- 	used_uids = alloca (sizeof (bool) * (uid_max +1));
-diff -up shadow-4.1.4/src/useradd.c.redhat shadow-4.1.4/src/useradd.c
---- shadow-4.1.4/src/useradd.c.redhat	2009-05-10 20:26:35.000000000 +0200
-+++ shadow-4.1.4/src/useradd.c	2009-05-15 11:59:40.000000000 +0200
-@@ -90,7 +90,7 @@ char *Prog;
- static gid_t def_group = 100;
- static const char *def_gname = "other";
- static const char *def_home = "/home";
--static const char *def_shell = "";
-+static const char *def_shell = "/sbin/nologin";
- static const char *def_template = SKEL_DIR;
- static const char *def_create_mail_spool = "no";
- 
-@@ -102,7 +102,7 @@ static char def_file[] = USER_DEFAULTS_F
- #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
- 
- static const char *user_name = "";
--static const char *user_pass = "!";
-+static const char *user_pass = "!!";
- static uid_t user_id;
- static gid_t user_gid;
- static const char *user_comment = "";
-@@ -996,9 +996,9 @@ static void process_flags (int argc, cha
- 		};
- 		while ((c = getopt_long (argc, argv,
- #ifdef WITH_SELINUX
--		                         "b:c:d:De:f:g:G:k:K:lmMNop:rs:u:UZ:",
-+		                         "b:c:d:De:f:g:G:k:K:lmMnNop:rs:u:UZ:",
- #else
--		                         "b:c:d:De:f:g:G:k:K:lmMNop:rs:u:U",
-+		                         "b:c:d:De:f:g:G:k:K:lmMnNop:rs:u:U",
- #endif
- 		                         long_options, NULL)) != -1) {
- 			switch (c) {
-@@ -1148,6 +1148,7 @@ static void process_flags (int argc, cha
- 			case 'M':
- 				Mflg = true;
- 				break;
-+			case 'n':
- 			case 'N':
- 				Nflg = true;
- 				break;

shadow-4.1.4.1-goodname.patch

@@ -1,68 +0,0 @@
-diff -up shadow-4.1.4.1/libmisc/chkname.c.goodname shadow-4.1.4.1/libmisc/chkname.c
---- shadow-4.1.4.1/libmisc/chkname.c.goodname	2009-04-28 21:14:04.000000000 +0200
-+++ shadow-4.1.4.1/libmisc/chkname.c	2009-06-16 13:47:08.000000000 +0200
-@@ -49,20 +49,28 @@
- static bool is_valid_name (const char *name)
- {
- 	/*
--	 * User/group names must match [a-z_][a-z0-9_-]*[$]
--	 */
--	if (('\0' == *name) ||
--	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
-+         * User/group names must match gnu e-regex:
-+         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
-+         *
-+         * as a non-POSIX, extension, allow "$" as the last char for
-+         * sake of Samba 3.x "add machine script"
-+         */
-+	if ( ('\0' == *name) ||
-+             !((*name >= 'a' && *name <= 'z') ||
-+               (*name >= 'A' && *name <= 'Z') ||
-+               (*name >= '0' && *name <= '9') ||
-+               (*name == '_') || (*name == '.') 
-+	      )) {
- 		return false;
- 	}
- 
- 	while ('\0' != *++name) {
--		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
--		      ( ('0' <= *name) && ('9' >= *name) ) ||
--		      ('_' == *name) ||
--		      ('-' == *name) ||
--		      ( ('$' == *name) && ('\0' == *(name + 1)) )
--		     )) {
-+                if (!(  (*name >= 'a' && *name <= 'z') ||
-+                        (*name >= 'A' && *name <= 'Z') ||
-+                        (*name >= '0' && *name <= '9') ||
-+                        (*name == '_') || (*name == '.') || (*name == '-') ||
-+                        (*name == '$' && *(name + 1) == '\0') 
-+                     )) {
- 			return false;
- 		}
- 	}
-diff -up shadow-4.1.4.1/man/groupadd.8.goodname shadow-4.1.4.1/man/groupadd.8
---- shadow-4.1.4.1/man/groupadd.8.goodname	2009-05-22 15:56:08.000000000 +0200
-+++ shadow-4.1.4.1/man/groupadd.8	2009-06-16 13:50:41.000000000 +0200
-@@ -153,9 +153,7 @@ Shadow password suite configuration\&.
- .RE
- .SH "CAVEATS"
- .PP
--Groupnames must start with a lower case letter or an underscore, followed by lower case letters, digits, underscores, or dashes\&. They can end with a dollar sign\&. In regular expression terms: [a\-z_][a\-z0\-9_\-]*[$]?
--.PP
--Groupnames may only be up to 16 characters long\&.
-+Groupnames may only be up to 32 characters long\&.
- .PP
- You may not add a NIS or LDAP group\&. This must be performed on the corresponding server\&.
- .PP
-diff -up shadow-4.1.4.1/man/useradd.8.goodname shadow-4.1.4.1/man/useradd.8
---- shadow-4.1.4.1/man/useradd.8.goodname	2009-05-22 15:56:28.000000000 +0200
-+++ shadow-4.1.4.1/man/useradd.8	2009-06-16 13:51:17.000000000 +0200
-@@ -405,8 +405,6 @@ Similarly, if the username already exist
- \fBuseradd\fR
- will deny the user account creation request\&.
- .PP
--Usernames must start with a lower case letter or an underscore, followed by lower case letters, digits, underscores, or dashes\&. They can end with a dollar sign\&. In regular expression terms: [a\-z_][a\-z0\-9_\-]*[$]?
--.PP
- Usernames may only be up to 32 characters long\&.
- .SH "CONFIGURATION"
- .PP

shadow-4.1.4.1-largeGroup.patch

@@ -1,230 +0,0 @@
-diff -U0 shadow-4.1.4.1/ChangeLog.large_group shadow-4.1.4.1/ChangeLog
-diff -up shadow-4.1.4.1/lib/gshadow.c.large_group shadow-4.1.4.1/lib/gshadow.c
---- shadow-4.1.4.1/lib/gshadow.c.large_group	2009-04-23 13:53:56.000000000 +0200
-+++ shadow-4.1.4.1/lib/gshadow.c	2009-06-16 14:47:08.000000000 +0200
-@@ -2,7 +2,7 @@
-  * Copyright (c) 1990 - 1994, Julianne Frances Haugh
-  * Copyright (c) 1996 - 1998, Marek Michałkiewicz
-  * Copyright (c) 2005       , Tomasz Kłoczko
-- * Copyright (c) 2008       , Nicolas François
-+ * Copyright (c) 2008 - 2009, Nicolas François
-  * All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-@@ -41,7 +41,6 @@
- #include "prototypes.h"
- #include "defines.h"
- static /*@null@*/FILE *shadow;
--static char sgrbuf[BUFSIZ * 4];
- static /*@null@*//*@only@*/char **members = NULL;
- static size_t nmembers = 0;
- static /*@null@*//*@only@*/char **admins = NULL;
-@@ -131,12 +130,25 @@ void endsgent (void)
- 
- /*@observer@*//*@null@*/struct sgrp *sgetsgent (const char *string)
- {
-+	static char *sgrbuf = NULL;
-+	static size_t sgrbuflen = 0;
-+
- 	char *fields[FIELDS];
- 	char *cp;
- 	int i;
-+	size_t len = strlen (string) + 1;
-+
-+	if (len > sgrbuflen) {
-+		char *buf = (char *) realloc (sgrbuf, sizeof (char) * len);
-+		if (NULL == buf) {
-+			return NULL;
-+		}
-+		sgrbuf = buf;
-+		sgrbuflen = len;
-+	}
- 
--	strncpy (sgrbuf, string, sizeof sgrbuf - 1);
--	sgrbuf[sizeof sgrbuf - 1] = '\0';
-+	strncpy (sgrbuf, string, len);
-+	sgrbuf[len-1] = '\0';
- 
- 	cp = strrchr (sgrbuf, '\n');
- 	if (NULL != cp) {
-@@ -161,7 +173,7 @@ void endsgent (void)
- 	 * the line is invalid.
- 	 */
- 
--	if ((NULL != cp) || (i != FIELDS))
-+	if ((NULL != cp) || (i != FIELDS)) {
- #ifdef	USE_NIS
- 		if (!IS_NISCHAR (fields[0][0])) {
- 			return 0;
-@@ -171,6 +183,7 @@ void endsgent (void)
- #else
- 		return 0;
- #endif
-+	}
- 
- 	sgroup.sg_name = fields[0];
- 	sgroup.sg_passwd = fields[1];
-@@ -199,20 +212,48 @@ void endsgent (void)
- 
- /*@observer@*//*@null@*/struct sgrp *fgetsgent (/*@null@*/FILE * fp)
- {
--	char buf[sizeof sgrbuf];
-+	static size_t buflen = 0;
-+	static char *buf = NULL;
-+
- 	char *cp;
-+	struct sgrp *ret;
-+
-+	if (0 == buflen) {
-+		buf = (char *) malloc (BUFSIZ);
-+		if (NULL == buf) {
-+			return NULL;
-+		}
-+	}
- 
- 	if (NULL == fp) {
--		return (0);
-+		return NULL;
- 	}
- 
- #ifdef	USE_NIS
--	while (fgetsx (buf, (int) sizeof buf, fp) != (char *) 0)
-+	while (fgetsx (buf, (int) sizeof buf, fp) == buf)
- #else
--	if (fgetsx (buf, (int) sizeof buf, fp) != (char *) 0)
-+	if (fgetsx (buf, (int) sizeof buf, fp) == buf)
- #endif
- 	{
--		cp = strchr (buf, '\n');
-+		while (   ((cp = strrchr (buf, '\n')) == NULL)
-+		       && (feof (fp) == 0)) {
-+			size_t len;
-+
-+			cp = (char *) realloc (buf, buflen*2);
-+			if (NULL == cp) {
-+				return NULL;
-+			}
-+			buf = cp;
-+			buflen *= 2;
-+
-+			len = strlen (buf);
-+			if (fgetsx (&buf[len],
-+			            (int) (buflen - len),
-+			            fp) != &buf[len]) {
-+				return NULL;
-+			}
-+		}
-+		cp = strrchr (buf, '\n');
- 		if (NULL != cp) {
- 			*cp = '\0';
- 		}
-@@ -223,7 +264,7 @@ void endsgent (void)
- #endif
- 		return (sgetsgent (buf));
- 	}
--	return 0;
-+	return NULL;
- }
- 
- /*
-@@ -235,7 +276,6 @@ void endsgent (void)
- #ifdef	USE_NIS
- 	bool nis_1_group = false;
- 	struct sgrp *val;
--	char buf[BUFSIZ];
- #endif
- 	if (NULL == shadow) {
- 		setsgent ();
-@@ -334,7 +374,6 @@ void endsgent (void)
- 	struct sgrp *sgrp;
- 
- #ifdef	USE_NIS
--	char buf[BUFSIZ];
- 	static char save_name[16];
- 	int nis_disabled = 0;
- #endif
-diff -up shadow-4.1.4.1/libmisc/xgetgrgid.c.large_group shadow-4.1.4.1/libmisc/xgetgrgid.c
---- shadow-4.1.4.1/libmisc/xgetgrgid.c.large_group	2008-09-06 16:56:51.000000000 +0200
-+++ shadow-4.1.4.1/libmisc/xgetgrgid.c	2009-06-16 14:15:08.000000000 +0200
-@@ -58,7 +58,6 @@
- #define ARG_TYPE	gid_t
- #define ARG_NAME	gid
- #define DUP_FUNCTION	__gr_dup
--#define MAX_LENGTH	0x8000
- #define HAVE_FUNCTION_R (defined HAVE_GETGRGID_R)
- 
- #include "xgetXXbyYY.c"
-diff -up shadow-4.1.4.1/libmisc/xgetgrnam.c.large_group shadow-4.1.4.1/libmisc/xgetgrnam.c
---- shadow-4.1.4.1/libmisc/xgetgrnam.c.large_group	2008-09-06 16:56:57.000000000 +0200
-+++ shadow-4.1.4.1/libmisc/xgetgrnam.c	2009-06-16 14:15:08.000000000 +0200
-@@ -58,7 +58,6 @@
- #define ARG_TYPE	const char *
- #define ARG_NAME	name
- #define DUP_FUNCTION	__gr_dup
--#define MAX_LENGTH	0x8000
- #define HAVE_FUNCTION_R (defined HAVE_GETGRNAM_R)
- 
- #include "xgetXXbyYY.c"
-diff -up shadow-4.1.4.1/libmisc/xgetpwnam.c.large_group shadow-4.1.4.1/libmisc/xgetpwnam.c
---- shadow-4.1.4.1/libmisc/xgetpwnam.c.large_group	2008-09-06 16:57:05.000000000 +0200
-+++ shadow-4.1.4.1/libmisc/xgetpwnam.c	2009-06-16 14:15:08.000000000 +0200
-@@ -58,7 +58,6 @@
- #define ARG_TYPE	const char *
- #define ARG_NAME	name
- #define DUP_FUNCTION	__pw_dup
--#define MAX_LENGTH	0x8000
- #define HAVE_FUNCTION_R (defined HAVE_GETPWNAM_R)
- 
- #include "xgetXXbyYY.c"
-diff -up shadow-4.1.4.1/libmisc/xgetpwuid.c.large_group shadow-4.1.4.1/libmisc/xgetpwuid.c
---- shadow-4.1.4.1/libmisc/xgetpwuid.c.large_group	2008-09-06 16:57:11.000000000 +0200
-+++ shadow-4.1.4.1/libmisc/xgetpwuid.c	2009-06-16 14:15:08.000000000 +0200
-@@ -58,7 +58,6 @@
- #define ARG_TYPE	uid_t
- #define ARG_NAME	uid
- #define DUP_FUNCTION	__pw_dup
--#define MAX_LENGTH	0x8000
- #define HAVE_FUNCTION_R (defined HAVE_GETPWUID_R)
- 
- #include "xgetXXbyYY.c"
-diff -up shadow-4.1.4.1/libmisc/xgetspnam.c.large_group shadow-4.1.4.1/libmisc/xgetspnam.c
---- shadow-4.1.4.1/libmisc/xgetspnam.c.large_group	2008-09-06 16:57:17.000000000 +0200
-+++ shadow-4.1.4.1/libmisc/xgetspnam.c	2009-06-16 14:15:08.000000000 +0200
-@@ -58,7 +58,6 @@
- #define ARG_TYPE	const char *
- #define ARG_NAME	name
- #define DUP_FUNCTION	__spw_dup
--#define MAX_LENGTH	0x8000
- #define HAVE_FUNCTION_R (defined HAVE_GETSPNAM_R)
- 
- #include "xgetXXbyYY.c"
-diff -up shadow-4.1.4.1/libmisc/xgetXXbyYY.c.large_group shadow-4.1.4.1/libmisc/xgetXXbyYY.c
---- shadow-4.1.4.1/libmisc/xgetXXbyYY.c.large_group	2009-04-23 11:15:53.000000000 +0200
-+++ shadow-4.1.4.1/libmisc/xgetXXbyYY.c	2009-06-16 14:15:08.000000000 +0200
-@@ -79,7 +79,7 @@
- 		exit (13);
- 	}
- 
--	do {
-+	while (true) {
- 		int status;
- 		LOOKUP_TYPE *resbuf = NULL;
- 		buffer = (char *)realloc (buffer, length);
-@@ -106,8 +106,14 @@
- 			return NULL;
- 		}
- 
--		length *= 4;
--	} while (length < MAX_LENGTH);
-+		if (length <= ((size_t)-1 / 4)) {
-+			length *= 4;
-+		} else if (length == (size_t) -1) {
-+			break;
-+		} else {
-+			length = (size_t) -1;
-+		}
-+	}
- 
- 	free(buffer);
- 	free(result);
-diff -up shadow-4.1.4.1/NEWS.large_group shadow-4.1.4.1/NEWS

shadow-4.1.4.1-ldap.patch

@@ -1,85 +0,0 @@
-diff -up shadow-4.1.4.1/libmisc/find_new_gid.c.ldap shadow-4.1.4.1/libmisc/find_new_gid.c
---- shadow-4.1.4.1/libmisc/find_new_gid.c.ldap	2009-07-16 10:37:41.653798746 +0200
-+++ shadow-4.1.4.1/libmisc/find_new_gid.c	2009-07-16 10:44:14.482808945 +0200
-@@ -90,17 +90,26 @@ int find_new_gid (bool sys_group,
- 	 * but we also check the local database (gr_rewind/gr_next) in case
- 	 * some groups were created but the changes were not committed yet.
- 	 */
--	setgrent ();
--	while ((grp = getgrent ()) != NULL) {
--		if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
--			group_id = grp->gr_gid + 1;
-+	if (sys_group ) {
-+		for(group_id = gid_min; group_id<=gid_max; group_id++) {
-+			grp = getgrgid(group_id);
-+			if(grp)
-+				used_gids[grp->gr_gid] = true;
- 		}
--		/* create index of used GIDs */
--		if (grp->gr_gid <= gid_max) {
--			used_gids[grp->gr_gid] = true;
-+	}
-+	else {
-+		setgrent ();
-+		while ((grp = getgrent ()) != NULL) {
-+			if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
-+				group_id = grp->gr_gid + 1;
-+			}
-+			/* create index of used GIDs */
-+			if (grp->gr_gid <= gid_max) {
-+				used_gids[grp->gr_gid] = true;
-+			}
- 		}
-+		endgrent ();
- 	}
--	endgrent ();
- 	gr_rewind ();
- 	while ((grp = gr_next ()) != NULL) {
- 		if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
-diff -up shadow-4.1.4.1/libmisc/find_new_uid.c.ldap shadow-4.1.4.1/libmisc/find_new_uid.c
---- shadow-4.1.4.1/libmisc/find_new_uid.c.ldap	2009-07-16 10:37:41.653798746 +0200
-+++ shadow-4.1.4.1/libmisc/find_new_uid.c	2009-07-16 10:37:41.668798323 +0200
-@@ -91,17 +91,27 @@ int find_new_uid (bool sys_user,
- 	 * but we also check the local database (pw_rewind/pw_next) in case
- 	 * some users were created but the changes were not committed yet.
- 	 */
--	setpwent ();
--	while ((pwd = getpwent ()) != NULL) {
--		if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
--			user_id = pwd->pw_uid + 1;
-+	/* speed up sys users look up on LDAP boxes */
-+	if (sys_user) {
-+		for (user_id = uid_min; user_id<=uid_max; user_id++) {
-+			pwd = getpwuid(user_id);
-+			if(pwd)
-+				used_uids[user_id] = true;
- 		}
--		/* create index of used UIDs */
--		if (pwd->pw_uid <= uid_max) {
--			used_uids[pwd->pw_uid] = true;
-+	}
-+	else {
-+		setpwent ();
-+		while ((pwd = getpwent ()) != NULL) {
-+			if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
-+				user_id = pwd->pw_uid + 1;
-+			}
-+			/* create index of used UIDs */
-+			if (pwd->pw_uid <= uid_max) {
-+				used_uids[pwd->pw_uid] = true;
-+			}
- 		}
-+		endpwent ();
- 	}
--	endpwent ();
- 	pw_rewind ();
- 	while ((pwd = pw_next ()) != NULL) {
- 		if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
-@@ -113,6 +123,7 @@ int find_new_uid (bool sys_user,
- 		}
- 	}
- 
-+
- 	/* find free system account in reverse order */
- 	if (sys_user) {
- 		for (user_id = uid_max; user_id >= uid_min; user_id--) {

shadow-4.1.4.1-sysacc.patch

@@ -1,300 +0,0 @@
-diff -up shadow-4.1.4.1/libmisc/find_new_gid.c.sysacc shadow-4.1.4.1/libmisc/find_new_gid.c
---- shadow-4.1.4.1/libmisc/find_new_gid.c.sysacc	2009-07-16 11:51:34.807860808 +0200
-+++ shadow-4.1.4.1/libmisc/find_new_gid.c	2009-07-16 14:19:08.678798578 +0200
-@@ -52,7 +52,7 @@ int find_new_gid (bool sys_group,
-                   /*@null@*/gid_t const *preferred_gid)
- {
- 	const struct group *grp;
--	gid_t gid_min, gid_max, group_id;
-+	gid_t gid_min, gid_max, group_id, id;
- 	bool *used_gids;
- 
- 	assert (gid != NULL);
-@@ -61,7 +61,7 @@ int find_new_gid (bool sys_group,
- 		gid_min = (gid_t) getdef_ulong ("GID_MIN", 500UL);
- 		gid_max = (gid_t) getdef_ulong ("GID_MAX", 60000UL);
- 	} else {
--		gid_min = (gid_t) getdef_ulong ("SYS_GID_MIN", 1UL);
-+		gid_min = (gid_t) getdef_ulong ("SYS_GID_MIN", 201UL);
- 		gid_max = (gid_t) getdef_ulong ("GID_MIN", 500UL) - 1;
- 		gid_max = (gid_t) getdef_ulong ("SYS_GID_MAX", (unsigned long) gid_max);
- 	}
-@@ -80,7 +80,6 @@ int find_new_gid (bool sys_group,
- 		return 0;
- 	}
- 
--	group_id = gid_min;
- 
- 	/*
- 	 * Search the entire group file,
-@@ -91,13 +90,28 @@ int find_new_gid (bool sys_group,
- 	 * some groups were created but the changes were not committed yet.
- 	 */
- 	if (sys_group ) {
--		for(group_id = gid_min; group_id<=gid_max; group_id++) {
--			grp = getgrgid(group_id);
--			if(grp)
-+		group_id = gid_max;
-+		for(id = gid_max; id>=gid_min; id--) {
-+			grp = getgrgid(id);
-+			if(grp) {
-+				group_id = id - 1;
- 				used_gids[grp->gr_gid] = true;
-+			}
-+		}
-+
-+		gr_rewind ();
-+		while ((grp = gr_next ()) != NULL) {
-+			if ((grp->gr_gid <= group_id) && (grp->gr_gid >= gid_min)) {
-+				group_id = grp->gr_gid - 1;
-+			}
-+			/* create index of used GIDs */
-+			if (grp->gr_gid <= gid_max) {
-+				used_gids[grp->gr_gid] = true;
-+			}
- 		}
- 	}
- 	else {
-+		group_id = gid_min;
- 		setgrent ();
- 		while ((grp = getgrent ()) != NULL) {
- 			if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
-@@ -109,32 +123,16 @@ int find_new_gid (bool sys_group,
- 			}
- 		}
- 		endgrent ();
--	}
--	gr_rewind ();
--	while ((grp = gr_next ()) != NULL) {
--		if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
--			group_id = grp->gr_gid + 1;
--		}
--		/* create index of used GIDs */
--		if (grp->gr_gid <= gid_max) {
--			used_gids[grp->gr_gid] = true;
--		}
--	}
- 
--	/* find free system account in reverse order */
--	if (sys_group) {
--		for (group_id = gid_max; group_id >= gid_min; group_id--) {
--			if (false == used_gids[group_id]) {
--				break;
-+		gr_rewind ();
-+		while ((grp = gr_next ()) != NULL) {
-+			if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
-+				group_id = grp->gr_gid + 1;
-+			}
-+			/* create index of used GIDs */
-+			if (grp->gr_gid <= gid_max) {
-+				used_gids[grp->gr_gid] = true;
- 			}
--		}
--		if ( group_id < gid_min ) {
--			fprintf (stderr,
--			         _("%s: Can't get unique GID (no more available GIDs)\n"),
--			         Prog);
--			SYSLOG ((LOG_WARN,
--			         "no more available GID on the system"));
--			return -1;
- 		}
- 	}
- 
-@@ -143,16 +141,35 @@ int find_new_gid (bool sys_group,
- 	 * will give us GID_MAX+1 even if not unique. Search for the first
- 	 * free GID starting with GID_MIN.
- 	 */
--	if (group_id == gid_max + 1) {
--		for (group_id = gid_min; group_id < gid_max; group_id++) {
--			if (false == used_gids[group_id]) {
--				break;
-+	if (sys_group) {
-+		if (group_id == gid_min - 1) {
-+			for (group_id = gid_max; group_id >= gid_min; group_id--) {
-+				if (false == used_gids[group_id]) {
-+					break;
-+				}
-+			}
-+			if ( group_id < gid_min ) {
-+				fprintf (stderr,
-+				         _("%s: Can't get unique GID (no more available GIDs)\n"),
-+				         Prog);
-+				SYSLOG ((LOG_WARN,
-+				         "no more available GID on the system"));
-+				return -1;
- 			}
- 		}
--		if (group_id == gid_max) {
--			fprintf (stderr, _("%s: Can't get unique GID (no more available GIDs)\n"), Prog);
--			SYSLOG ((LOG_WARN, "no more available GID on the system"));
--			return -1;
-+	}
-+	else {
-+		if (group_id == gid_max + 1) {
-+			for (group_id = gid_min; group_id < gid_max; group_id++) {
-+				if (false == used_gids[group_id]) {
-+					break;
-+				}
-+			}
-+			if (group_id == gid_max) {
-+				fprintf (stderr, _("%s: Can't get unique GID (no more available GIDs)\n"), Prog);
-+				SYSLOG ((LOG_WARN, "no more available GID on the system"));
-+				return -1;
-+			}
- 		}
- 	}
- 
-diff -up shadow-4.1.4.1/libmisc/find_new_uid.c.sysacc shadow-4.1.4.1/libmisc/find_new_uid.c
---- shadow-4.1.4.1/libmisc/find_new_uid.c.sysacc	2009-07-16 11:51:34.807860808 +0200
-+++ shadow-4.1.4.1/libmisc/find_new_uid.c	2009-07-16 14:13:38.120798526 +0200
-@@ -52,7 +52,7 @@ int find_new_uid (bool sys_user,
-                   /*@null@*/uid_t const *preferred_uid)
- {
- 	const struct passwd *pwd;
--	uid_t uid_min, uid_max, user_id;
-+	uid_t uid_min, uid_max, user_id, id;
- 	bool *used_uids;
- 
- 	assert (uid != NULL);
-@@ -61,7 +61,7 @@ int find_new_uid (bool sys_user,
- 		uid_min = (uid_t) getdef_ulong ("UID_MIN", 500UL);
- 		uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
- 	} else {
--		uid_min = (uid_t) getdef_ulong ("SYS_UID_MIN", 1UL);
-+		uid_min = (uid_t) getdef_ulong ("SYS_UID_MIN", 201UL);
- 		uid_max = (uid_t) getdef_ulong ("UID_MIN", 500UL) - 1;
- 		uid_max = (uid_t) getdef_ulong ("SYS_UID_MAX", (unsigned long) uid_max);
- 	}
-@@ -81,8 +81,6 @@ int find_new_uid (bool sys_user,
- 	}
- 
- 
--	user_id = uid_min;
--
- 	/*
- 	 * Search the entire password file,
- 	 * looking for the largest unused value.
-@@ -91,15 +89,30 @@ int find_new_uid (bool sys_user,
- 	 * but we also check the local database (pw_rewind/pw_next) in case
- 	 * some users were created but the changes were not committed yet.
- 	 */
--	/* speed up sys users look up on LDAP boxes */
- 	if (sys_user) {
--		for (user_id = uid_min; user_id<=uid_max; user_id++) {
--			pwd = getpwuid(user_id);
--			if(pwd)
-+		user_id = uid_max;
-+		for (id = uid_max; id>=uid_min; id--) {
-+			pwd = getpwuid(id);
-+			if(pwd) {
-+				user_id = id - 1;
- 				used_uids[user_id] = true;
-+			}
- 		}
-+
-+		pw_rewind ();
-+		while ((pwd = pw_next ()) != NULL) {
-+			if ((pwd->pw_uid <= user_id) && (pwd->pw_uid >= uid_min)) {
-+				user_id = pwd->pw_uid - 1;
-+			}
-+			/* create index of used UIDs */
-+			if (pwd->pw_uid <= uid_max) {
-+				used_uids[pwd->pw_uid] = true;
-+			}
-+		}
-+
- 	}
- 	else {
-+		user_id = uid_min;
- 		setpwent ();
- 		while ((pwd = getpwent ()) != NULL) {
- 			if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
-@@ -111,51 +124,55 @@ int find_new_uid (bool sys_user,
- 			}
- 		}
- 		endpwent ();
--	}
--	pw_rewind ();
--	while ((pwd = pw_next ()) != NULL) {
--		if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
--			user_id = pwd->pw_uid + 1;
--		}
--		/* create index of used UIDs */
--		if (pwd->pw_uid <= uid_max) {
--			used_uids[pwd->pw_uid] = true;
--		}
--	}
--
- 
--	/* find free system account in reverse order */
--	if (sys_user) {
--		for (user_id = uid_max; user_id >= uid_min; user_id--) {
--			if (false == used_uids[user_id]) {
--				break;
-+		pw_rewind ();
-+		while ((pwd = pw_next ()) != NULL) {
-+			if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
-+				user_id = pwd->pw_uid + 1;
-+			}
-+			/* create index of used UIDs */
-+			if (pwd->pw_uid <= uid_max) {
-+				used_uids[pwd->pw_uid] = true;
- 			}
--		}
--		if (user_id < uid_min ) {
--			fprintf (stderr,
--			         _("%s: Can't get unique system UID (no more available UIDs)\n"),
--			         Prog);
--			SYSLOG ((LOG_WARN,
--			         "no more available UID on the system"));
--			return -1;
- 		}
- 	}
- 
-+
- 	/*
- 	 * If a user with UID equal to UID_MAX exists, the above algorithm
- 	 * will give us UID_MAX+1 even if not unique. Search for the first
- 	 * free UID starting with UID_MIN.
- 	 */
--	if (user_id == uid_max + 1) {
--		for (user_id = uid_min; user_id < uid_max; user_id++) {
--			if (false == used_uids[user_id]) {
--				break;
-+	if (sys_user) {
-+		if (user_id == uid_min - 1) {
-+			for (user_id = uid_max; user_id >= uid_min; user_id--) {
-+				if (false == used_uids[user_id]) {
-+					break;
-+				}
-+			}
-+			if (user_id < uid_min ) {
-+				fprintf (stderr,
-+				         _("%s: Can't get unique system UID (no more available UIDs)\n"),
-+				         Prog);
-+				SYSLOG ((LOG_WARN,
-+				         "no more available UID on the system"));
-+				return -1;
- 			}
- 		}
--		if (user_id == uid_max) {
--			fprintf (stderr, _("%s: Can't get unique UID (no more available UIDs)\n"), Prog);
--			SYSLOG ((LOG_WARN, "no more available UID on the system"));
--			return -1;
-+	}
-+	else {
-+		if (user_id == uid_max + 1) {
-+			for (user_id = uid_min; user_id < uid_max; user_id++) {
-+				if (false == used_uids[user_id]) {
-+					break;
-+				}
-+			}
-+			if (user_id == uid_max) {
-+				fprintf (stderr, _("%s: Can't get unique UID (no more available UIDs)\n"),
-+                                                 Prog);
-+				SYSLOG ((LOG_WARN, "no more available UID on the system"));
-+				return -1;
-+			}
- 		}
- 	}
- 

shadow-bsd.txt

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 1990 - 1994, Julianne Frances Haugh
+ * Copyright (c) 1996 - 2000, Marek Michałkiewicz
+ * Copyright (c) 2000 - 2006, Tomasz Kłoczko
+ * Copyright (c) 2007 - 2011, Nicolas François
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the copyright holders or contributors may not be used to
+ *    endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+

shadow-utils.HOME_MODE.xml

@@ -0,0 +1,43 @@
+<!--
+   Copyright (c) 1991 - 1993, Julianne Frances Haugh
+   Copyright (c) 1991 - 1993, Chip Rosenthal
+   Copyright (c) 2007 - 2009, Nicolas François
+   All rights reserved.
+  
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions
+   are met:
+   1. Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+   2. Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+   3. The name of the copyright holders or contributors may not be used to
+      endorse or promote products derived from this software without
+      specific prior written permission.
+  
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+<varlistentry>
+  <term><option>HOME_MODE</option> (number)</term>
+  <listitem>
+    <para>
+      The mode for new home directories. If not specified,
+      the <option>UMASK</option> is used to create the mode.
+    </para>
+    <para>
+      <command>useradd</command> and <command>newusers</command> use this
+      to set the mode of the home directory they create.
+    </para>
+  </listitem>
+</varlistentry>

shadow-utils.login.defs

@@ -0,0 +1,315 @@
+#
+# Please note that the parameters in this configuration file control the
+# behavior of the tools from the shadow-utils component. None of these
+# tools uses the PAM mechanism, and the utilities that use PAM (such as the
+# passwd command) should therefore be configured elsewhere. Refer to
+# /etc/pam.d/system-auth for more information.
+#
+
+#
+# Delay in seconds before being allowed another attempt after a login failure
+# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
+#       pam_unix(8) enforces a 2s delay)
+#
+#FAIL_DELAY		3
+
+# Currently FAILLOG_ENAB is not supported
+
+#
+# Enable display of unknown usernames when login(1) failures are recorded.
+#
+#LOG_UNKFAIL_ENAB	no
+
+# Currently LOG_OK_LOGINS is not supported
+
+# Currently LASTLOG_ENAB is not supported
+
+#
+# Limit the highest user ID number for which the lastlog entries should
+# be updated.
+#
+# No LASTLOG_UID_MAX means that there is no user ID limit for writing
+# lastlog entries.
+#
+#LASTLOG_UID_MAX
+
+# Currently MAIL_CHECK_ENAB is not supported
+
+# Currently OBSCURE_CHECKS_ENAB is not supported
+
+# Currently PORTTIME_CHECKS_ENAB is not supported
+
+# Currently QUOTAS_ENAB is not supported
+
+# Currently SYSLOG_SU_ENAB is not supported
+
+#
+# Enable "syslog" logging of newgrp(1) and sg(1) activity.
+#
+#SYSLOG_SG_ENAB		yes
+
+# Currently CONSOLE is not supported
+
+# Currently SULOG_FILE is not supported
+
+# Currently MOTD_FILE is not supported
+
+# Currently ISSUE_FILE is not supported
+
+# Currently TTYTYPE_FILE is not supported
+
+# Currently FTMP_FILE is not supported
+
+# Currently NOLOGINS_FILE is not supported
+
+# Currently SU_NAME is not supported
+
+# *REQUIRED*
+#   Directory where mailboxes reside, _or_ name of file, relative to the
+#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
+#
+MAIL_DIR	/var/spool/mail
+#MAIL_FILE	.mail
+
+#
+# If defined, file which inhibits all the usual chatter during the login
+# sequence.  If a full pathname, then hushed mode will be enabled if the
+# user's name or shell are found in the file.  If not a full pathname, then
+# hushed mode will be enabled if the file exists in the user's home directory.
+#
+#HUSHLOGIN_FILE	.hushlogin
+#HUSHLOGIN_FILE	/etc/hushlogins
+
+# Currently ENV_TZ is not supported
+
+# Currently ENV_HZ is not supported
+
+#
+# The default PATH settings, for superuser and normal users.
+#
+# (they are minimal, add the rest in the shell startup files)
+#ENV_SUPATH	PATH=/sbin:/bin:/usr/sbin:/usr/bin
+#ENV_PATH	PATH=/bin:/usr/bin
+
+#
+# Terminal permissions
+#
+#	TTYGROUP	Login tty will be assigned this group ownership.
+#	TTYPERM		Login tty will be set to this permission.
+#
+# If you have a write(1) program which is "setgid" to a special group
+# which owns the terminals, define TTYGROUP as the number of such group
+# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
+# set TTYPERM to either 622 or 600.
+#
+#TTYGROUP	tty
+#TTYPERM		0600
+
+# Currently ERASECHAR, KILLCHAR and ULIMIT are not supported
+
+# Default initial "umask" value used by login(1) on non-PAM enabled systems.
+# Default "umask" value for pam_umask(8) on PAM enabled systems.
+# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
+# home directories if HOME_MODE is not set.
+# 022 is the default value, but 027, or even 077, could be considered
+# for increased privacy. There is no One True Answer here: each sysadmin
+# must make up their mind.
+UMASK		022
+
+# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
+# home directories.
+# If HOME_MODE is not set, the value of UMASK is used to create the mode.
+HOME_MODE	0700
+
+# Password aging controls:
+#
+#	PASS_MAX_DAYS	Maximum number of days a password may be used.
+#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
+#	PASS_MIN_LEN	Minimum acceptable password length.
+#	PASS_WARN_AGE	Number of days warning given before a password expires.
+#
+PASS_MAX_DAYS	99999
+PASS_MIN_DAYS	0
+PASS_MIN_LEN	8
+PASS_WARN_AGE	7
+
+# Currently SU_WHEEL_ONLY is not supported
+
+# Currently CRACKLIB_DICTPATH is not supported
+
+#
+# Min/max values for automatic uid selection in useradd(8)
+#
+UID_MIN                  1000
+UID_MAX                 60000
+# System accounts
+SYS_UID_MIN               201
+SYS_UID_MAX               999
+# Extra per user uids
+SUB_UID_MIN		   524288
+SUB_UID_MAX		600100000
+SUB_UID_COUNT		    65536
+
+#
+# Min/max values for automatic gid selection in groupadd(8)
+#
+GID_MIN                  1000
+GID_MAX                 60000
+# System accounts
+SYS_GID_MIN               201
+SYS_GID_MAX               999
+# Extra per user group ids
+SUB_GID_MIN		   524288
+SUB_GID_MAX		600100000
+SUB_GID_COUNT		    65536
+
+#
+# Max number of login(1) retries if password is bad
+#
+#LOGIN_RETRIES		3
+
+#
+# Max time in seconds for login(1)
+#
+#LOGIN_TIMEOUT		60
+
+#
+# Maximum number of attempts to change password if rejected (too easy)
+#
+PASS_CHANGE_TRIES	5
+
+#
+# Warn about weak passwords (but still allow them) if you are root.
+#
+PASS_ALWAYS_WARN	yes
+
+#
+# Number of significant characters in the password for crypt().
+# Default is 8, don't change unless your crypt() is better.
+# Ignored if MD5_CRYPT_ENAB set to "yes".
+#
+#PASS_MAX_LEN		8
+
+# Currently CHFN_AUTH is not supported
+
+#
+# Which fields may be changed by regular users using chfn(1) - use
+# any combination of letters "frwh" (full name, room number, work
+# phone, home phone).  If not defined, no changes are allowed.
+# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
+# 
+#CHFN_RESTRICT		rwh
+
+# Currently LOGIN_STRING is not supported
+
+# Currently MD5_CRYPT_ENAB is not supported
+
+#
+# If set to MD5, MD5-based algorithm will be used for encrypting password
+# If set to SHA256, SHA256-based algorithm will be used for encrypting password
+# If set to SHA512, SHA512-based algorithm will be used for encrypting password
+# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
+# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
+# If set to DES, DES-based algorithm will be used for encrypting password (default)
+#
+ENCRYPT_METHOD YESCRYPT
+
+#
+# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
+#
+# Define the number of SHA rounds.
+# With a lot of rounds, it is more difficult to brute-force the password.
+# However, more CPU resources will be needed to authenticate users if
+# this value is increased.
+#
+# If not specified, the libc will choose the default number of rounds (5000).
+# The values must be within the 1000-999999999 range.
+#
+#SHA_CRYPT_MAX_ROUNDS 5000
+
+# Currently SHA_CRYPT_MIN_ROUNDS is not supported
+
+#
+# Only works if ENCRYPT_METHOD is set to BCRYPT.
+#
+# Define the number of BCRYPT rounds.
+# With a lot of rounds, it is more difficult to brute-force the password.
+# However, more CPU resources will be needed to authenticate users if
+# this value is increased.
+#
+# If not specified, 13 rounds will be attempted.
+# If only one of the MIN or MAX values is set, then this value will be used.
+# If MIN > MAX, the highest value will be used.
+#
+#BCRYPT_MIN_ROUNDS 13
+#BCRYPT_MAX_ROUNDS 31
+
+#
+# Only works if ENCRYPT_METHOD is set to YESCRYPT.
+#
+# Define the YESCRYPT cost factor.
+# With a higher cost factor, it is more difficult to brute-force the password.
+# However, more CPU time and more memory will be needed to authenticate users
+# if this value is increased.
+#
+# If not specified, a cost factor of 5 will be used.
+# The value must be within the 1-11 range.
+#
+#YESCRYPT_COST_FACTOR 5
+
+# Currently CONSOLE_GROUPS is not supported
+
+#
+# Should login be allowed if we can't cd to the home directory?
+# Default is yes.
+#
+#DEFAULT_HOME	yes
+
+# Currently ENVIRON_FILE is not supported
+
+#
+# If defined, this command is run when removing a user.
+# It should remove any at/cron/print jobs etc. owned by
+# the user to be removed (passed as the first argument).
+#
+#USERDEL_CMD	/usr/sbin/userdel_local
+
+#
+# Enables userdel(8) to remove user groups if no members exist.
+#
+USERGROUPS_ENAB yes
+
+#
+# If set to a non-zero number, the shadow utilities will make sure that
+# groups never have more than this number of users on one line.
+# This permits to support split groups (groups split into multiple lines,
+# with the same group ID, to avoid limitation of the line length in the
+# group file).
+#
+# 0 is the default value and disables this feature.
+#
+#MAX_MEMBERS_PER_GROUP	0
+
+#
+# If useradd(8) should create home directories for users by default (non
+# system users only).
+# This option is overridden with the -M or -m flags on the useradd(8)
+# command-line.
+#
+CREATE_HOME	yes
+
+#
+# Force use shadow, even if shadow passwd & shadow group files are
+# missing.
+#
+#FORCE_SHADOW    yes
+
+#
+# Select the HMAC cryptography algorithm.
+# Used in pam_timestamp module to calculate the keyed-hash message
+# authentication code.
+#
+# Note: It is recommended to check hmac(3) to see the possible algorithms
+# that are available in your system.
+#
+HMAC_CRYPTO_ALGO SHA512

sources

@@ -1 +1,2 @@
-62f7dae4cb54fa84e478c4602d58cbe8  shadow-4.1.4.1.tar.bz2
+SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406
+SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac

tests/mhc-fedora-ci.yaml

@@ -0,0 +1,13 @@
+provisioned_topologies:
+- shadow
+domains:
+- id: shadow
+  hosts:
+  - hostname: localhost
+    role: shadow
+    conn:
+      type: ssh
+      host: localhost
+      user: root
+    artifacts:
+    - /var/log/*