Rebase to version 4.20.0

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -16,3 +16,41 @@ shadow-4.1.4.2.tar.bz2
 /shadow-4.8.1.tar.xz.asc
 /shadow-4.9.tar.xz
 /shadow-4.9.tar.xz.asc
+/shadow-4.11.1.tar.xz
+/shadow-4.11.1.tar.xz.asc
+/shadow-4.12.3.tar.xz
+/shadow-4.12.3.tar.xz.asc
+/shadow-4.13.tar.xz
+/shadow-4.13.tar.xz.asc
+/shadow-4.14.0.tar.xz
+/shadow-4.14.0.tar.xz.asc
+/shadow-4.15.0rc2.tar.xz
+/shadow-4.15.0rc2.tar.xz.asc
+/shadow-4.15.0rc3.tar.xz
+/shadow-4.15.0rc3.tar.xz.asc
+/shadow-4.15.0.tar.xz
+/shadow-4.15.0.tar.xz.asc
+/shadow-4.15.1.tar.xz
+/shadow-4.15.1.tar.xz.asc
+/shadow-4.16.0.tar.xz
+/shadow-4.16.0.tar.xz.asc
+/shadow-4.17.0-rc1.tar.xz
+/shadow-4.17.0-rc1.tar.xz.asc
+/shadow-4.17.0.tar.xz
+/shadow-4.17.0.tar.xz.asc
+/shadow-4.17.4.tar.xz
+/shadow-4.17.4.tar.xz.asc
+/shadow-4.18.0.tar.xz
+/shadow-4.18.0.tar.xz.asc
+/shadow-4.19.0.tar.xz
+/shadow-4.19.0.tar.xz.asc
+/shadow-4.19.2.tar.xz
+/shadow-4.19.2.tar.xz.asc
+/shadow-4.19.3.tar.xz
+/shadow-4.19.3.tar.xz.asc
+/shadow-4.20.0-rc2.tar.xz
+/shadow-4.20.0-rc2.tar.xz.asc
+/shadow-4.20.0-rc3.tar.xz
+/shadow-4.20.0-rc3.tar.xz.asc
+/shadow-4.20.0.tar.xz
+/shadow-4.20.0.tar.xz.asc

passwd.pamd

@@ -0,0 +1,5 @@
+#%PAM-1.0
+# This tool only uses the password stack.
+password   substack	system-auth
+-password   optional	pam_gnome_keyring.so use_authtok
+password   substack	postlogin

plans/tier0-functional.fmf

@@ -0,0 +1,51 @@
+summary: Tier 0 functional tests for shadow-utils
+description: |
+    Run comprehensive system tests for shadow-utils. These tests validate user and group
+    account management functionality by testing actual system operations including user
+    creation, password management, group operations, and verification of system files
+    (i.e. /etc/passwd, /etc/shadow).
+
+provision:
+    how: virtual
+    image: fedora
+
+prepare:
+    - name: Install general dependencies
+      how: install
+      package:
+        - expect
+        - gcc
+        - git
+        - libssh-devel
+        - python3-devel
+        - python3-pip
+
+    - name: Setup SSH keys for localhost testing
+      how: shell
+      script:
+        - ssh-keygen -t rsa -f /root/.ssh/id_rsa -N "" -q
+        - cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
+        - chmod 600 /root/.ssh/authorized_keys
+        - ssh-keyscan -H localhost >> /root/.ssh/known_hosts
+
+    - name: Clone shadow repository
+      how: shell
+      script:
+        - git clone https://github.com/shadow-maint/shadow.git /tmp/shadow-test
+
+    - name: Copy test topology for Fedora CI
+      how: shell
+      script:
+        - cp tests/mhc-fedora-ci.yaml /tmp/shadow-test/tests/system
+
+    - name: Install test dependencies
+      how: shell
+      script:
+        - pip3 install -r /tmp/shadow-test/tests/system/requirements.txt
+
+execute:
+    how: tmt
+    duration: 30m
+    script: |
+        cd /tmp/shadow-test/tests/system
+        pytest --mh-config=mhc-fedora-ci.yaml --mh-lazy-ssh -v

shadow-4.2.1-date-parsing.patch

@@ -1,69 +0,0 @@
-Index: shadow-4.5/libmisc/getdate.y
-===================================================================
---- shadow-4.5.orig/libmisc/getdate.y
-+++ shadow-4.5/libmisc/getdate.y
-@@ -152,6 +152,7 @@ static int	yyHaveDay;
- static int	yyHaveRel;
- static int	yyHaveTime;
- static int	yyHaveZone;
-+static int      yyHaveYear;
- static int	yyTimezone;
- static int	yyDay;
- static int	yyHour;
-@@ -293,18 +294,21 @@ date	: tUNUMBER '/' tUNUMBER {
- 	      yyDay = $3;
- 	      yyYear = $5;
- 	    }
-+	    yyHaveYear++;
- 	}
- 	| tUNUMBER tSNUMBER tSNUMBER {
- 	    /* ISO 8601 format.  yyyy-mm-dd.  */
- 	    yyYear = $1;
- 	    yyMonth = -$2;
- 	    yyDay = -$3;
-+	    yyHaveYear++;
- 	}
- 	| tUNUMBER tMONTH tSNUMBER {
- 	    /* e.g. 17-JUN-1992.  */
- 	    yyDay = $1;
- 	    yyMonth = $2;
- 	    yyYear = -$3;
-+	    yyHaveYear++;
- 	}
- 	| tMONTH tUNUMBER {
- 	    yyMonth = $1;
-@@ -314,6 +318,7 @@ date	: tUNUMBER '/' tUNUMBER {
- 	    yyMonth = $1;
- 	    yyDay = $2;
- 	    yyYear = $4;
-+	    yyHaveYear++;
- 	}
- 	| tUNUMBER tMONTH {
- 	    yyMonth = $2;
-@@ -323,6 +328,7 @@ date	: tUNUMBER '/' tUNUMBER {
- 	    yyMonth = $2;
- 	    yyDay = $1;
- 	    yyYear = $3;
-+	    yyHaveYear++;
- 	}
- 	;
- 
-@@ -395,7 +401,8 @@ relunit	: tUNUMBER tYEAR_UNIT {
- 
- number	: tUNUMBER
-           {
--	    if ((yyHaveTime != 0) && (yyHaveDate != 0) && (yyHaveRel == 0))
-+	    if ((yyHaveTime != 0 || $1 >= 100) && !yyHaveYear
-+		&& (yyHaveDate != 0) && (yyHaveRel == 0))
- 	      yyYear = $1;
- 	    else
- 	      {
-@@ -802,7 +809,7 @@ yylex (void)
- 	  return LookupWord (buff);
- 	}
-       if (c != '(')
--	return *yyInput++;
-+	return (unsigned char)*yyInput++;
-       Count = 0;
-       do
- 	{

shadow-4.5-usermod-unlock.patch

@@ -1,64 +0,0 @@
-Index: shadow-4.5/src/usermod.c
-===================================================================
---- shadow-4.5.orig/src/usermod.c
-+++ shadow-4.5/src/usermod.c
-@@ -455,14 +455,17 @@ static char *new_pw_passwd (char *pw_pas
- 		strcat (buf, pw_pass);
- 		pw_pass = buf;
- 	} else if (Uflg && pw_pass[0] == '!') {
--		char *s;
-+		char *s = pw_pass;
- 
--		if (pw_pass[1] == '\0') {
-+		while ('!' == *s)
-+			++s;
-+
-+		if (*s == '\0') {
- 			fprintf (stderr,
- 			         _("%s: unlocking the user's password would result in a passwordless account.\n"
- 			           "You should set a password with usermod -p to unlock this user's password.\n"),
- 			         Prog);
--			return pw_pass;
-+			return NULL;
- 		}
- 
- #ifdef WITH_AUDIT
-@@ -471,12 +474,15 @@ static char *new_pw_passwd (char *pw_pas
- 		              user_newname, (unsigned int) user_newid, 1);
- #endif
- 		SYSLOG ((LOG_INFO, "unlock user '%s' password", user_newname));
--		s = pw_pass;
--		while ('\0' != *s) {
--			*s = *(s + 1);
--			s++;
--		}
-+		memmove (pw_pass, s, strlen (s) + 1);
- 	} else if (pflg) {
-+		if (strchr (user_pass, ':') != NULL) {
-+			fprintf (stderr,
-+			         _("%s: The password field cannot contain a colon character.\n"),
-+			         Prog);
-+			return NULL;
-+
-+		}
- #ifdef WITH_AUDIT
- 		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
- 		              "updating-password",
-@@ -525,6 +531,8 @@ static void new_pwent (struct passwd *pw
- 	if (   (!is_shadow_pwd)
- 	    || (strcmp (pwent->pw_passwd, SHADOW_PASSWD_STRING) != 0)) {
- 		pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd);
-+		if (pwent->pw_passwd == NULL)
-+			fail_exit (E_PW_UPDATE);
- 	}
- 
- 	if (uflg) {
-@@ -639,6 +647,8 @@ static void new_spent (struct spwd *spen
- 	 *  + aging has been requested
- 	 */
- 	spent->sp_pwdp = new_pw_passwd (spent->sp_pwdp);
-+	if (spent->sp_pwdp == NULL)
-+		fail_exit(E_PW_UPDATE);
- 
- 	if (pflg) {
- 		spent->sp_lstchg = (long) gettime () / SCALE;

shadow-4.6-move-home.patch

@@ -1,15 +0,0 @@
-diff -up shadow-4.6/src/usermod.c.move-home shadow-4.6/src/usermod.c
---- shadow-4.6/src/usermod.c.move-home	2018-05-28 14:59:05.594076665 +0200
-+++ shadow-4.6/src/usermod.c	2018-05-28 15:00:28.479837392 +0200
-@@ -1845,6 +1845,11 @@ static void move_home (void)
- 			         Prog, prefix_user_home, prefix_user_newhome);
- 			fail_exit (E_HOMEDIR);
- 		}
-+	} else {
-+		fprintf (stderr,
-+		         _("%s: The previous home directory (%s) does "
-+		           "not exist or is inaccessible. Move cannot be completed.\n"),
-+		         Prog, prefix_user_home);
- 	}
- }
- 

shadow-4.6-sysugid-min-limit.patch

@@ -1,34 +0,0 @@
-diff -up shadow-4.6/libmisc/find_new_gid.c.min-limit shadow-4.6/libmisc/find_new_gid.c
---- shadow-4.6/libmisc/find_new_gid.c.min-limit	2018-04-29 18:42:37.000000001 +0200
-+++ shadow-4.6/libmisc/find_new_gid.c	2018-11-06 10:51:20.554963292 +0100
-@@ -82,6 +82,13 @@ static int get_ranges (bool sys_group, g
-                             (unsigned long) *max_id);
- 			return EINVAL;
- 		}
-+		/*
-+		 * Zero is reserved for root and the allocation algorithm does not
-+		 * work right with it.
-+		 */
-+		if (*min_id == 0) {
-+			*min_id = (gid_t) 1;
-+		}
- 	} else {
- 		/* Non-system groups */
- 
-diff -up shadow-4.6/libmisc/find_new_uid.c.min-limit shadow-4.6/libmisc/find_new_uid.c
---- shadow-4.6/libmisc/find_new_uid.c.min-limit	2018-04-29 18:42:37.000000001 +0200
-+++ shadow-4.6/libmisc/find_new_uid.c	2018-11-06 10:51:39.341399569 +0100
-@@ -82,6 +82,13 @@ static int get_ranges (bool sys_user, ui
-                             (unsigned long) *max_id);
- 			return EINVAL;
- 		}
-+		/*
-+		 * Zero is reserved for root and the allocation algorithm does not
-+		 * work right with it.
-+		 */
-+		if (*min_id == 0) {
-+			*min_id = (uid_t) 1;
-+		}
- 	} else {
- 		/* Non-system users */
- 

shadow-4.8-goodname.patch

@@ -1,100 +0,0 @@
-diff -up shadow-4.8/libmisc/chkname.c.goodname shadow-4.8/libmisc/chkname.c
---- shadow-4.8/libmisc/chkname.c.goodname	2020-01-13 09:44:41.968507996 +0100
-+++ shadow-4.8/libmisc/chkname.c	2020-01-13 09:46:27.863727732 +0100
-@@ -55,26 +55,44 @@ static bool is_valid_name (const char *n
- 	}
- 
- 	/*
--	 * User/group names must match [a-z_][a-z0-9_-]*[$]
--	 */
-+         * User/group names must match gnu e-regex:
-+         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
-+         *
-+         * as a non-POSIX, extension, allow "$" as the last char for
-+         * sake of Samba 3.x "add machine script"
-+         *
-+         * Also do not allow fully numeric names or just "." or "..".
-+         */
-+	int numeric;
- 
--	if (('\0' == *name) ||
--	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
-+	if ('\0' == *name ||
-+	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
-+			      '\0' == name[1])) ||
-+	    !((*name >= 'a' && *name <= 'z') ||
-+	      (*name >= 'A' && *name <= 'Z') ||
-+	      (*name >= '0' && *name <= '9') ||
-+	      *name == '_' ||
-+	      *name == '.')) {
- 		return false;
- 	}
- 
-+	numeric = isdigit(*name);
-+
- 	while ('\0' != *++name) {
--		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
--		      ( ('0' <= *name) && ('9' >= *name) ) ||
--		      ('_' == *name) ||
--		      ('-' == *name) ||
--		      ( ('$' == *name) && ('\0' == *(name + 1)) )
-+		if (!((*name >= 'a' && *name <= 'z') ||
-+		      (*name >= 'A' && *name <= 'Z') ||
-+		      (*name >= '0' && *name <= '9') ||
-+		      *name == '_' ||
-+		      *name == '.' ||
-+		      *name == '-' ||
-+		      (*name == '$' && name[1] == '\0')
- 		     )) {
- 			return false;
- 		}
-+		numeric &= isdigit(*name);
- 	}
- 
--	return true;
-+	return !numeric;
- }
- 
- bool is_valid_user_name (const char *name)
-diff -up shadow-4.8/man/groupadd.8.xml.goodname shadow-4.8/man/groupadd.8.xml
---- shadow-4.8/man/groupadd.8.xml.goodname	2019-07-23 17:26:08.000000000 +0200
-+++ shadow-4.8/man/groupadd.8.xml	2020-01-13 09:44:41.968507996 +0100
-@@ -273,10 +273,12 @@
-    <refsect1 id='caveats'>
-      <title>CAVEATS</title>
-      <para>
--       Groupnames must start with a lower case letter or an underscore,
--       followed by lower case letters, digits, underscores, or dashes.
--       They can end with a dollar sign.
--       In regular expression terms: [a-z_][a-z0-9_-]*[$]?
-+       Groupnames may contain only lower and upper case letters, digits,
-+       underscores, or dashes. They can end with a dollar sign.
-+
-+       Dashes are not allowed at the beginning of the groupname.
-+       Fully numeric groupnames and groupnames . or .. are
-+       also disallowed.
-      </para>
-      <para>
-        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
-diff -up shadow-4.8/man/useradd.8.xml.goodname shadow-4.8/man/useradd.8.xml
---- shadow-4.8/man/useradd.8.xml.goodname	2019-10-05 03:23:58.000000000 +0200
-+++ shadow-4.8/man/useradd.8.xml	2020-01-13 09:44:41.968507996 +0100
-@@ -661,10 +661,14 @@
-     </para>
- 
-     <para>
--      Usernames must start with a lower case letter or an underscore,
--      followed by lower case letters, digits, underscores, or dashes.
--      They can end with a dollar sign.
--      In regular expression terms: [a-z_][a-z0-9_-]*[$]?
-+      Usernames may contain only lower and upper case letters, digits,
-+      underscores, or dashes. They can end with a dollar sign.
-+
-+      Dashes are not allowed at the beginning of the username.
-+      Fully numeric usernames and usernames . or .. are
-+      also disallowed. It is not recommended to use usernames beginning
-+      with . character as their home directories will be hidden in
-+      the <command>ls</command> output.
-     </para>
-     <para>
-       Usernames may only be up to 32 characters long.

shadow-4.8-ignore-login-prompt.patch

@@ -1,11 +0,0 @@
-diff -up shadow-4.8/lib/getdef.c.login-prompt shadow-4.8/lib/getdef.c
---- shadow-4.8/lib/getdef.c.login-prompt	2020-01-13 10:38:44.852796681 +0100
-+++ shadow-4.8/lib/getdef.c	2020-01-13 10:39:54.472612511 +0100
-@@ -98,6 +98,7 @@ static struct itemdef def_table[] = {
- 	{"LASTLOG_UID_MAX", NULL},
- 	{"LOGIN_RETRIES", NULL},
- 	{"LOGIN_TIMEOUT", NULL},
-+	{"LOGIN_PLAIN_PROMPT", NULL},
- 	{"LOG_OK_LOGINS", NULL},
- 	{"LOG_UNKFAIL_ENAB", NULL},
- 	{"MAIL_DIR", NULL},

shadow-4.8-long-entry.patch

@@ -1,86 +0,0 @@
-diff -up shadow-4.8/lib/defines.h.long-entry shadow-4.8/lib/defines.h
---- shadow-4.8/lib/defines.h.long-entry	2020-01-13 10:29:45.288957339 +0100
-+++ shadow-4.8/lib/defines.h	2020-01-13 10:30:47.482902954 +0100
-@@ -388,6 +388,9 @@ extern char *strerror ();
- # endif
- #endif
- 
-+/* Maximum length of passwd entry */
-+#define PASSWD_ENTRY_MAX_LENGTH 32768
-+
- #ifdef HAVE_SECURE_GETENV
- #  define shadow_getenv(name) secure_getenv(name)
- # else
-diff -up shadow-4.8/lib/pwio.c.long-entry shadow-4.8/lib/pwio.c
---- shadow-4.8/lib/pwio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
-+++ shadow-4.8/lib/pwio.c	2020-01-13 10:29:45.288957339 +0100
-@@ -79,7 +79,10 @@ static int passwd_put (const void *ent,
- 	    || (pw->pw_gid == (gid_t)-1)
- 	    || (valid_field (pw->pw_gecos, ":\n") == -1)
- 	    || (valid_field (pw->pw_dir, ":\n") == -1)
--	    || (valid_field (pw->pw_shell, ":\n") == -1)) {
-+	    || (valid_field (pw->pw_shell, ":\n") == -1)
-+	    || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
-+	        strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
-+	        strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
- 		return -1;
- 	}
- 
-diff -up shadow-4.8/lib/sgetpwent.c.long-entry shadow-4.8/lib/sgetpwent.c
---- shadow-4.8/lib/sgetpwent.c.long-entry	2019-10-05 03:23:58.000000000 +0200
-+++ shadow-4.8/lib/sgetpwent.c	2020-01-13 10:29:45.288957339 +0100
-@@ -57,7 +57,7 @@
- struct passwd *sgetpwent (const char *buf)
- {
- 	static struct passwd pwent;
--	static char pwdbuf[1024];
-+	static char pwdbuf[PASSWD_ENTRY_MAX_LENGTH];
- 	register int i;
- 	register char *cp;
- 	char *fields[NFIELDS];
-@@ -67,8 +67,10 @@ struct passwd *sgetpwent (const char *bu
- 	 * the password structure remain valid.
- 	 */
- 
--	if (strlen (buf) >= sizeof pwdbuf)
-+	if (strlen (buf) >= sizeof pwdbuf) {
-+		fprintf (stderr, "Too long passwd entry encountered, file corruption?\n");
- 		return 0;	/* fail if too long */
-+	}
- 	strcpy (pwdbuf, buf);
- 
- 	/*
-diff -up shadow-4.8/lib/sgetspent.c.long-entry shadow-4.8/lib/sgetspent.c
---- shadow-4.8/lib/sgetspent.c.long-entry	2019-07-23 17:26:08.000000000 +0200
-+++ shadow-4.8/lib/sgetspent.c	2020-01-13 10:29:45.289957322 +0100
-@@ -48,7 +48,7 @@
-  */
- struct spwd *sgetspent (const char *string)
- {
--	static char spwbuf[1024];
-+	static char spwbuf[PASSWD_ENTRY_MAX_LENGTH];
- 	static struct spwd spwd;
- 	char *fields[FIELDS];
- 	char *cp;
-@@ -61,6 +61,7 @@ struct spwd *sgetspent (const char *stri
- 	 */
- 
- 	if (strlen (string) >= sizeof spwbuf) {
-+		fprintf (stderr, "Too long shadow entry encountered, file corruption?\n");
- 		return 0;	/* fail if too long */
- 	}
- 	strcpy (spwbuf, string);
-diff -up shadow-4.8/lib/shadowio.c.long-entry shadow-4.8/lib/shadowio.c
---- shadow-4.8/lib/shadowio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
-+++ shadow-4.8/lib/shadowio.c	2020-01-13 10:29:45.289957322 +0100
-@@ -79,7 +79,9 @@ static int shadow_put (const void *ent,
- 
- 	if (   (NULL == sp)
- 	    || (valid_field (sp->sp_namp, ":\n") == -1)
--	    || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
-+	    || (valid_field (sp->sp_pwdp, ":\n") == -1)
-+	    || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
-+	        1000 > PASSWD_ENTRY_MAX_LENGTH)) {
- 		return -1;
- 	}
- 

shadow-4.8-selinux-perms.patch

@@ -1,240 +0,0 @@
-diff -up shadow-4.8/src/chgpasswd.c.selinux-perms shadow-4.8/src/chgpasswd.c
---- shadow-4.8/src/chgpasswd.c.selinux-perms	2019-12-01 18:02:43.000000000 +0100
-+++ shadow-4.8/src/chgpasswd.c	2020-01-13 10:21:44.558107260 +0100
-@@ -39,6 +39,13 @@
- #include <pwd.h>
- #include <stdio.h>
- #include <stdlib.h>
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#include <selinux/avc.h>
-+#endif
-+#ifdef WITH_LIBAUDIT
-+#include <libaudit.h>
-+#endif
- #ifdef ACCT_TOOLS_SETUID
- #ifdef USE_PAM
- #include "pam_defs.h"
-@@ -80,6 +87,9 @@ static bool sgr_locked = false;
- #endif
- static bool gr_locked = false;
- 
-+/* The name of the caller */
-+static char *myname = NULL;
-+
- /* local function prototypes */
- static void fail_exit (int code);
- static /*@noreturn@*/void usage (int status);
-@@ -334,6 +344,63 @@ static void check_perms (void)
- #endif				/* ACCT_TOOLS_SETUID */
- }
- 
-+#ifdef WITH_SELINUX
-+static int
-+log_callback (int type, const char *fmt, ...)
-+{
-+    int audit_fd;
-+    va_list ap;
-+
-+    va_start(ap, fmt);
-+#ifdef WITH_AUDIT
-+    audit_fd = audit_open();
-+
-+    if (audit_fd >= 0) {
-+	char *buf;
-+
-+	if (vasprintf (&buf, fmt, ap) < 0)
-+		goto ret;
-+	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
-+				   NULL, 0);
-+	audit_close(audit_fd);
-+	free(buf);
-+	goto ret;
-+    }
-+
-+#endif
-+    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
-+ret:
-+    va_end(ap);
-+    return 0;
-+}
-+
-+static void
-+selinux_check_root (void)
-+{
-+    int status = -1;
-+    security_context_t user_context;
-+    union selinux_callback old_callback;
-+
-+    if (is_selinux_enabled() < 1)
-+	return;
-+
-+    old_callback = selinux_get_callback(SELINUX_CB_LOG);
-+    /* setup callbacks */
-+    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
-+    if ((status = getprevcon(&user_context)) < 0) {
-+	selinux_set_callback(SELINUX_CB_LOG, old_callback);
-+	exit(1);
-+    }
-+
-+    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
-+
-+    selinux_set_callback(SELINUX_CB_LOG, old_callback);
-+    freecon(user_context);
-+    if (status != 0 && security_getenforce() != 0)
-+	exit(1);
-+}
-+#endif
-+
- /*
-  * open_files - lock and open the group databases
-  */
-@@ -427,6 +494,7 @@ int main (int argc, char **argv)
- 
- 	const struct group *gr;
- 	struct group newgr;
-+	struct passwd *pw = NULL;
- 	int errors = 0;
- 	int line = 0;
- 
-@@ -436,12 +504,37 @@ int main (int argc, char **argv)
- 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
- 	(void) textdomain (PACKAGE);
- 
-+#ifdef WITH_SELINUX
-+	selinux_check_root ();
-+#endif
-+
- 	process_root_flag ("-R", argc, argv);
- 
- 	process_flags (argc, argv);
- 
- 	OPENLOG ("chgpasswd");
- 
-+#ifdef WITH_AUDIT
-+	audit_help_open ();
-+#endif
-+
-+	/*
-+	 * Determine the name of the user that invoked this command. This
-+	 * is really hit or miss because there are so many ways that command
-+	 * can be executed and so many ways to trip up the routines that
-+	 * report the user name.
-+	 */
-+	pw = get_my_pwent ();
-+	if (NULL == pw) {
-+		fprintf (stderr, _("%s: Cannot determine your user name.\n"),
-+		         Prog);
-+		SYSLOG ((LOG_WARN,
-+		         "Cannot determine the user name of the caller (UID %lu)",
-+		         (unsigned long) getuid ()));
-+		exit (E_NOPERM);
-+	}
-+	myname = xstrdup (pw->pw_name);
-+
- 	check_perms ();
- 
- #ifdef SHADOWGRP
-diff -up shadow-4.8/src/chpasswd.c.selinux-perms shadow-4.8/src/chpasswd.c
---- shadow-4.8/src/chpasswd.c.selinux-perms	2019-12-01 18:02:43.000000000 +0100
-+++ shadow-4.8/src/chpasswd.c	2020-01-13 10:21:44.558107260 +0100
-@@ -39,6 +39,13 @@
- #include <pwd.h>
- #include <stdio.h>
- #include <stdlib.h>
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#include <selinux/avc.h>
-+#endif
-+#ifdef WITH_LIBAUDIT
-+#include <libaudit.h>
-+#endif
- #ifdef USE_PAM
- #include "pam_defs.h"
- #endif				/* USE_PAM */
-@@ -332,6 +339,63 @@ static void check_perms (void)
- #endif				/* USE_PAM */
- }
- 
-+#ifdef WITH_SELINUX
-+static int
-+log_callback (int type, const char *fmt, ...)
-+{
-+    int audit_fd;
-+    va_list ap;
-+
-+    va_start(ap, fmt);
-+#ifdef WITH_AUDIT
-+    audit_fd = audit_open();
-+
-+    if (audit_fd >= 0) {
-+	char *buf;
-+
-+	if (vasprintf (&buf, fmt, ap) < 0)
-+		goto ret;
-+	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
-+				   NULL, 0);
-+	audit_close(audit_fd);
-+	free(buf);
-+	goto ret;
-+    }
-+
-+#endif
-+    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
-+ret:
-+    va_end(ap);
-+    return 0;
-+}
-+
-+static void
-+selinux_check_root (void)
-+{
-+    int status = -1;
-+    security_context_t user_context;
-+    union selinux_callback old_callback;
-+
-+    if (is_selinux_enabled() < 1)
-+	return;
-+
-+    old_callback = selinux_get_callback(SELINUX_CB_LOG);
-+    /* setup callbacks */
-+    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
-+    if ((status = getprevcon(&user_context)) < 0) {
-+	selinux_set_callback(SELINUX_CB_LOG, old_callback);
-+	exit(1);
-+    }
-+
-+    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
-+
-+    selinux_set_callback(SELINUX_CB_LOG, old_callback);
-+    freecon(user_context);
-+    if (status != 0 && security_getenforce() != 0)
-+	exit(1);
-+}
-+#endif
-+
- /*
-  * open_files - lock and open the password databases
-  */
-@@ -428,6 +492,10 @@ int main (int argc, char **argv)
- 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
- 	(void) textdomain (PACKAGE);
- 
-+#ifdef WITH_SELINUX
-+	selinux_check_root ();
-+#endif
-+
- 	process_root_flag ("-R", argc, argv);
- 
- 	process_flags (argc, argv);
-@@ -440,6 +508,10 @@ int main (int argc, char **argv)
- 
- 	OPENLOG ("chpasswd");
- 
-+#ifdef WITH_AUDIT
-+	audit_help_open ();
-+#endif
-+
- 	check_perms ();
- 
- #ifdef USE_PAM

shadow-4.9-default-range.patch

@@ -1,35 +0,0 @@
-diff -up shadow-4.9/lib/semanage.c.default-range shadow-4.9/lib/semanage.c
---- shadow-4.9/lib/semanage.c.default-range	2021-07-22 23:55:35.000000000 +0200
-+++ shadow-4.9/lib/semanage.c	2021-08-02 12:43:16.822817392 +0200
-@@ -143,6 +143,7 @@ static int semanage_user_mod (semanage_h
- 		goto done;
- 	}
- 
-+#if 0
- 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
- 	if (ret != 0) {
- 		fprintf (shadow_logfd,
-@@ -150,6 +151,7 @@ static int semanage_user_mod (semanage_h
- 		ret = 1;
- 		goto done;
- 	}
-+#endif
- 
- 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
- 	if (ret != 0) {
-@@ -200,6 +202,7 @@ static int semanage_user_add (semanage_h
- 		goto done;
- 	}
- 
-+#if 0
- 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
- 	if (ret != 0) {
- 		fprintf (shadow_logfd,
-@@ -208,6 +211,7 @@ static int semanage_user_add (semanage_h
- 		ret = 1;
- 		goto done;
- 	}
-+#endif
- 
- 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
- 	if (ret != 0) {

shadow-4.9-libmisc-fix-default-value-in-SHA_get_salt_rounds.patch

@@ -1,60 +0,0 @@
-From 234e8fa7b134d1ebabfdad980a3ae5b63c046c62 Mon Sep 17 00:00:00 2001
-From: Mike Gilbert <floppym@gentoo.org>
-Date: Sat, 14 Aug 2021 13:24:34 -0400
-Subject: [PATCH] libmisc: fix default value in SHA_get_salt_rounds()
-
-If SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS are both unspecified,
-use SHA_ROUNDS_DEFAULT.
-
-Previously, the code fell through, calling shadow_random(-1, -1). This
-ultimately set rounds = (unsigned long) -1, which ends up being a very
-large number! This then got capped to SHA_ROUNDS_MAX later in the
-function.
-
-The new behavior matches BCRYPT_get_salt_rounds().
-
-Bug: https://bugs.gentoo.org/808195
-Fixes: https://github.com/shadow-maint/shadow/issues/393
----
- libmisc/salt.c | 21 +++++++++++----------
- 1 file changed, 11 insertions(+), 10 deletions(-)
-
-diff --git a/libmisc/salt.c b/libmisc/salt.c
-index 91d528fd..30eefb9c 100644
---- a/libmisc/salt.c
-+++ b/libmisc/salt.c
-@@ -223,20 +223,21 @@ static /*@observer@*/const unsigned long SHA_get_salt_rounds (/*@null@*/int *pre
- 		if ((-1 == min_rounds) && (-1 == max_rounds)) {
- 			rounds = SHA_ROUNDS_DEFAULT;
- 		}
-+		else {
-+			if (-1 == min_rounds) {
-+				min_rounds = max_rounds;
-+			}
- 
--		if (-1 == min_rounds) {
--			min_rounds = max_rounds;
--		}
-+			if (-1 == max_rounds) {
-+				max_rounds = min_rounds;
-+			}
- 
--		if (-1 == max_rounds) {
--			max_rounds = min_rounds;
--		}
-+			if (min_rounds > max_rounds) {
-+				max_rounds = min_rounds;
-+			}
- 
--		if (min_rounds > max_rounds) {
--			max_rounds = min_rounds;
-+			rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
- 		}
--
--		rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
- 	} else if (0 == *prefered_rounds) {
- 		rounds = SHA_ROUNDS_DEFAULT;
- 	} else {
--- 
-2.31.1
-

shadow-4.9-manfix.patch

@@ -1,180 +0,0 @@
-diff -up shadow-4.8.1/man/groupmems.8.xml.manfix shadow-4.8.1/man/groupmems.8.xml
---- shadow-4.8.1/man/groupmems.8.xml.manfix	2020-03-17 15:34:48.750414984 +0100
-+++ shadow-4.8.1/man/groupmems.8.xml	2020-03-17 15:41:13.383588722 +0100
-@@ -179,20 +179,10 @@
-   <refsect1 id='setup'>
-     <title>SETUP</title>
-     <para>
--      The <command>groupmems</command> executable should be in mode
--      <literal>2710</literal> as user <emphasis>root</emphasis> and in group
--      <emphasis>groups</emphasis>. The system administrator can add users to
--      group <emphasis>groups</emphasis> to allow or disallow them using the
--      <command>groupmems</command> utility to manage their own group
--      membership list.
-+      In this operating system the <command>groupmems</command> executable
-+      is not setuid and regular users cannot use it to manipulate
-+      the membership of their own group.
-     </para>
--
--    <programlisting>
--	$ groupadd -r groups
--	$ chmod 2710 groupmems
--	$ chown root.groups groupmems
--	$ groupmems -g groups -a gk4
--    </programlisting>
-   </refsect1>
- 
-   <refsect1 id='configuration'>
-diff -up shadow-4.8.1/man/ja/man5/login.defs.5.manfix shadow-4.8.1/man/ja/man5/login.defs.5
---- shadow-4.8.1/man/ja/man5/login.defs.5.manfix	2019-07-23 17:26:08.000000000 +0200
-+++ shadow-4.8.1/man/ja/man5/login.defs.5	2020-03-17 15:34:48.750414984 +0100
-@@ -147,10 +147,6 @@ 以下の参照表は、
- shadow パスワード機能のどのプログラムが
- どのパラメータを使用するかを示したものである。
- .na
--.IP chfn 12
--CHFN_AUTH CHFN_RESTRICT
--.IP chsh 12
--CHFN_AUTH
- .IP groupadd 12
- GID_MAX GID_MIN
- .IP newusers 12
-diff -up shadow-4.8.1/man/login.defs.5.xml.manfix shadow-4.8.1/man/login.defs.5.xml
---- shadow-4.8.1/man/login.defs.5.xml.manfix	2020-01-17 16:47:56.000000000 +0100
-+++ shadow-4.8.1/man/login.defs.5.xml	2020-03-17 15:34:48.750414984 +0100
-@@ -164,6 +164,17 @@
-       long numeric parameters is machine-dependent.
-     </para>
- 
-+    <para>
-+      Please note that the parameters in this configuration file control the
-+      behavior of the tools from the shadow-utils component. None of these
-+      tools uses the PAM mechanism, and the utilities that use PAM (such as the
-+      passwd command) should be configured elsewhere. The only values that
-+      affect PAM modules are <emphasis>ENCRYPT_METHOD</emphasis> and <emphasis>SHA_CRYPT_MAX_ROUNDS</emphasis>
-+      for pam_unix module, <emphasis>FAIL_DELAY</emphasis> for pam_faildelay module,
-+      and <emphasis>UMASK</emphasis> for pam_umask module. Refer to
-+      pam(8) for more information.
-+    </para>
-+
-     <para>The following configuration items are provided:</para>
- 
-     <variablelist remap='IP'>
-@@ -256,16 +267,6 @@
- 	</listitem>
-       </varlistentry>
-       <varlistentry>
--	<term>chfn</term>
--	<listitem>
--	  <para>
--	    <phrase condition="no_pam">CHFN_AUTH</phrase>
--	    CHFN_RESTRICT
--	    <phrase condition="no_pam">LOGIN_STRING</phrase>
--	  </para>
--	</listitem>
--      </varlistentry>
--      <varlistentry>
- 	<term>chgpasswd</term>
- 	<listitem>
- 	  <para>
-@@ -286,14 +287,6 @@
- 	  </para>
- 	</listitem>
-       </varlistentry>
--      <varlistentry condition="no_pam">
--	<term>chsh</term>
--	<listitem>
--	  <para>
--	    CHSH_AUTH LOGIN_STRING
--	  </para>
--	</listitem>
--      </varlistentry>
-       <!-- expiry: no variables (CONSOLE_GROUPS linked, but not used) -->
-       <!-- faillog: no variables -->
-       <varlistentry>
-@@ -359,34 +352,6 @@
- 	  <para>LASTLOG_UID_MAX</para>
- 	</listitem>
-       </varlistentry>
--      <varlistentry>
--	<term>login</term>
--	<listitem>
--	  <para>
--	    <phrase condition="no_pam">CONSOLE</phrase>
--	    CONSOLE_GROUPS DEFAULT_HOME
--	    <phrase condition="no_pam">ENV_HZ ENV_PATH ENV_SUPATH
--	    ENV_TZ ENVIRON_FILE</phrase>
--	    ERASECHAR FAIL_DELAY
--	    <phrase condition="no_pam">FAILLOG_ENAB</phrase>
--	    FAKE_SHELL
--	    <phrase condition="no_pam">FTMP_FILE</phrase>
--	    HUSHLOGIN_FILE
--	    <phrase condition="no_pam">ISSUE_FILE</phrase>
--	    KILLCHAR
--	    <phrase condition="no_pam">LASTLOG_ENAB LASTLOG_UID_MAX</phrase>
--	    LOGIN_RETRIES
--	    <phrase condition="no_pam">LOGIN_STRING</phrase>
--	    LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB
--	    <phrase condition="no_pam">MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE
--	    MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB
--	    QUOTAS_ENAB</phrase>
--	    TTYGROUP TTYPERM TTYTYPE_FILE
--	    <phrase condition="no_pam">ULIMIT UMASK</phrase>
--	    USERGROUPS_ENAB
--	  </para>
--	</listitem>
--      </varlistentry>
-       <!-- logoutd: no variables -->
-       <varlistentry>
- 	<term>newgrp / sg</term>
-@@ -415,17 +380,6 @@
- 	</listitem>
-       </varlistentry>
-       <!-- nologin: no variables -->
--      <varlistentry condition="no_pam">
--	<term>passwd</term>
--	<listitem>
--	  <para>
--	    ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB
--	    PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN
--	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
--	    SHA_CRYPT_MIN_ROUNDS</phrase>
--	  </para>
--	</listitem>
--      </varlistentry>
-       <varlistentry>
- 	<term>pwck</term>
- 	<listitem>
-@@ -452,32 +406,6 @@
- 	  </para>
- 	</listitem>
-       </varlistentry>
--      <varlistentry>
--	<term>su</term>
--	<listitem>
--	  <para>
--	    <phrase condition="no_pam">CONSOLE</phrase>
--	    CONSOLE_GROUPS DEFAULT_HOME
--	    <phrase condition="no_pam">ENV_HZ ENVIRON_FILE</phrase>
--	    ENV_PATH ENV_SUPATH
--	    <phrase condition="no_pam">ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB
--	    MAIL_DIR MAIL_FILE QUOTAS_ENAB</phrase>
--	    SULOG_FILE SU_NAME
--	    <phrase condition="no_pam">SU_WHEEL_ONLY</phrase>
--	    SYSLOG_SU_ENAB
--	    <phrase condition="no_pam">USERGROUPS_ENAB</phrase>
--	  </para>
--	</listitem>
--      </varlistentry>
--      <varlistentry>
--	<term>sulogin</term>
--	<listitem>
--	  <para>
--	    ENV_HZ
--	    <phrase condition="no_pam">ENV_TZ</phrase>
--	  </para>
--	</listitem>
--      </varlistentry>
-       <varlistentry>
- 	<term>useradd</term>
- 	<listitem>

shadow-4.9-move-create-home.patch

@@ -1,64 +0,0 @@
-diff --git a/src/useradd.c b/src/useradd.c
-index baeffb35..02e1402c 100644
---- a/src/useradd.c
-+++ b/src/useradd.c
-@@ -2644,27 +2644,12 @@ int main (int argc, char **argv)
- 
- 	usr_update ();
- 
--	if (mflg) {
--		create_home ();
--		if (home_added) {
--			copy_tree (def_template, prefix_user_home, false, false,
--			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
--		} else {
--			fprintf (stderr,
--			         _("%s: warning: the home directory %s already exists.\n"
--			           "%s: Not copying any file from skel directory into it.\n"),
--			         Prog, user_home, Prog);
--		}
--
--	}
--
--	/* Do not create mail directory for system accounts */
--	if (!rflg) {
--		create_mail ();
--	}
--
- 	close_files ();
- 
-+	nscd_flush_cache ("passwd");
-+	nscd_flush_cache ("group");
-+	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
-+
- 	/*
- 	 * tallylog_reset needs to be able to lookup
- 	 * a valid existing user name,
-@@ -2695,9 +2680,24 @@ int main (int argc, char **argv)
- 		exit(1);
- 	}
- 
--	nscd_flush_cache ("passwd");
--	nscd_flush_cache ("group");
--	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
-+	if (mflg) {
-+		create_home ();
-+		if (home_added) {
-+			copy_tree (def_template, prefix_user_home, false, true,
-+			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
-+		} else {
-+			fprintf (stderr,
-+			         _("%s: warning: the home directory %s already exists.\n"
-+			           "%s: Not copying any file from skel directory into it.\n"),
-+			         Prog, user_home, Prog);
-+		}
-+
-+	}
-+
-+	/* Do not create mail directory for system accounts */
-+	if (!rflg) {
-+		create_mail ();
-+	}
- 
- 	return E_SUCCESS;
- }

shadow-4.9-newuidmap-libeconf-dependency.patch

@@ -1,15 +0,0 @@
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 7c1a3491..6cc873be 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -96,8 +96,8 @@ LIBCRYPT_NOPAM = $(LIBCRYPT)
- endif
- 
- chage_LDADD    = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBECONF)
--newuidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) -ldl
--newgidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) -ldl
-+newuidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) $(LIBECONF) -ldl
-+newgidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) $(LIBECONF) -ldl
- chfn_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)
- chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
- chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)

shadow-4.9-null-tm.patch

@@ -1,70 +0,0 @@
-Index: shadow-4.5/src/chage.c
-===================================================================
---- shadow-4.5.orig/src/chage.c
-+++ shadow-4.5/src/chage.c
-@@ -168,6 +168,10 @@ static void date_to_str (char *buf, size
- 	struct tm *tp;
- 
- 	tp = gmtime (&date);
-+	if (tp == NULL) {
-+		(void) snprintf (buf, maxsize, "(unknown)");
-+		return;
-+	}
- #ifdef HAVE_STRFTIME
- 	(void) strftime (buf, maxsize, "%Y-%m-%d", tp);
- #else
-Index: shadow-4.5/src/lastlog.c
-===================================================================
---- shadow-4.5.orig/src/lastlog.c
-+++ shadow-4.5/src/lastlog.c
-@@ -158,13 +158,17 @@ static void print_one (/*@null@*/const s
- 
- 	ll_time = ll.ll_time;
- 	tm = localtime (&ll_time);
-+	if (tm == NULL) {
-+		cp = "(unknown)";
-+	} else {
- #ifdef HAVE_STRFTIME
--	strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
--	cp = ptime;
-+		strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
-+		cp = ptime;
- #else
--	cp = asctime (tm);
--	cp[24] = '\0';
-+		cp = asctime (tm);
-+		cp[24] = '\0';
- #endif
-+	}
- 
- 	if (ll.ll_time == (time_t) 0) {
- 		cp = _("**Never logged in**\0");
-Index: shadow-4.5/src/passwd.c
-===================================================================
---- shadow-4.5.orig/src/passwd.c
-+++ shadow-4.5/src/passwd.c
-@@ -455,6 +455,9 @@ static /*@observer@*/const char *date_to
- 	struct tm *tm;
- 
- 	tm = gmtime (&t);
-+	if (tm == NULL) {
-+		return "(unknown)";
-+	}
- #ifdef HAVE_STRFTIME
- 	(void) strftime (buf, sizeof buf, "%m/%d/%Y", tm);
- #else				/* !HAVE_STRFTIME */
-Index: shadow-4.5/src/usermod.c
-===================================================================
---- shadow-4.5.orig/src/usermod.c
-+++ shadow-4.5/src/usermod.c
-@@ -210,6 +210,10 @@ static void date_to_str (/*@unique@*//*@
- 	} else {
- 		time_t t = (time_t) date;
- 		tp = gmtime (&t);
-+		if (tp == NULL) {
-+			strncpy (buf, "unknown", maxsize);
-+			return;
-+		}
- #ifdef HAVE_STRFTIME
- 		strftime (buf, maxsize, "%Y-%m-%d", tp);
- #else

shadow-4.9-redhat.patch

@@ -1,41 +0,0 @@
-diff -up shadow-4.9/src/useradd.c.redhat shadow-4.9/src/useradd.c
---- shadow-4.9/src/useradd.c.redhat	2021-07-22 23:55:35.000000000 +0200
-+++ shadow-4.9/src/useradd.c	2021-08-02 11:45:11.942867250 +0200
-@@ -104,7 +104,7 @@ FILE *shadow_logfd = NULL;
- static gid_t def_group = 1000;
- static const char *def_gname = "other";
- static const char *def_home = "/home";
--static const char *def_shell = "/bin/bash";
-+static const char *def_shell = "/sbin/nologin";
- static const char *def_template = SKEL_DIR;
- static const char *def_create_mail_spool = "yes";
- 
-@@ -114,7 +114,7 @@ static const char *def_expire = "";
- #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
- 
- static const char *user_name = "";
--static const char *user_pass = "!";
-+static const char *user_pass = "!!";
- static uid_t user_id;
- static gid_t user_gid;
- static const char *user_comment = "";
-@@ -1204,9 +1204,9 @@ static void process_flags (int argc, cha
- 		};
- 		while ((c = getopt_long (argc, argv,
- #ifdef WITH_SELINUX
--		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:UZ:",
-+		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:UZ:",
- #else				/* !WITH_SELINUX */
--		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:U",
-+		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:U",
- #endif				/* !WITH_SELINUX */
- 		                         long_options, NULL)) != -1) {
- 			switch (c) {
-@@ -1363,6 +1363,7 @@ static void process_flags (int argc, cha
- 			case 'M':
- 				Mflg = true;
- 				break;
-+			case 'n':
- 			case 'N':
- 				Nflg = true;
- 				break;

shadow-4.9-useradd-avoid-generating-empty-subid-range.patch

@@ -1,79 +0,0 @@
-diff --git a/src/useradd.c b/src/useradd.c
-index baeffb35..9abeea6e 100644
---- a/src/useradd.c
-+++ b/src/useradd.c
-@@ -142,9 +142,7 @@ static bool is_sub_gid = false;
- static bool sub_uid_locked = false;
- static bool sub_gid_locked = false;
- static uid_t sub_uid_start;	/* New subordinate uid range */
--static unsigned long sub_uid_count;
- static gid_t sub_gid_start;	/* New subordinate gid range */
--static unsigned long sub_gid_count;
- #endif				/* ENABLE_SUBIDS */
- static bool pw_locked = false;
- static bool gr_locked = false;
-@@ -234,7 +232,7 @@ static void open_shadow (void);
- static void faillog_reset (uid_t);
- static void lastlog_reset (uid_t);
- static void tallylog_reset (const char *);
--static void usr_update (void);
-+static void usr_update (unsigned long subuid_count, unsigned long subgid_count);
- static void create_home (void);
- static void create_mail (void);
- static void check_uid_range(int rflg, uid_t user_id);
-@@ -2092,7 +2090,7 @@ static void tallylog_reset (const char *user_name)
-  *	usr_update() creates the password file entries for this user
-  *	and will update the group entries if required.
-  */
--static void usr_update (void)
-+static void usr_update (unsigned long subuid_count, unsigned long subgid_count)
- {
- 	struct passwd pwent;
- 	struct spwd spent;
-@@ -2155,14 +2153,14 @@ static void usr_update (void)
- 	}
- #ifdef ENABLE_SUBIDS
- 	if (is_sub_uid &&
--	    (sub_uid_add(user_name, sub_uid_start, sub_uid_count) == 0)) {
-+	    (sub_uid_add(user_name, sub_uid_start, subuid_count) == 0)) {
- 		fprintf (stderr,
- 		         _("%s: failed to prepare the new %s entry\n"),
- 		         Prog, sub_uid_dbname ());
- 		fail_exit (E_SUB_UID_UPDATE);
- 	}
- 	if (is_sub_gid &&
--	    (sub_gid_add(user_name, sub_gid_start, sub_gid_count) == 0)) {
-+	    (sub_gid_add(user_name, sub_gid_start, subgid_count) == 0)) {
- 		fprintf (stderr,
- 		         _("%s: failed to prepare the new %s entry\n"),
- 		         Prog, sub_uid_dbname ());
-@@ -2624,16 +2622,16 @@ int main (int argc, char **argv)
- 	}
- 
- #ifdef ENABLE_SUBIDS
--	if (is_sub_uid && sub_uid_count != 0) {
--		if (find_new_sub_uids(&sub_uid_start, &sub_uid_count) < 0) {
-+	if (is_sub_uid && subuid_count != 0) {
-+		if (find_new_sub_uids(&sub_uid_start, &subuid_count) < 0) {
- 			fprintf (stderr,
- 			         _("%s: can't create subordinate user IDs\n"),
- 			         Prog);
- 			fail_exit(E_SUB_UID_UPDATE);
- 		}
- 	}
--	if (is_sub_gid && sub_gid_count != 0) {
--		if (find_new_sub_gids(&sub_gid_start, &sub_gid_count) < 0) {
-+	if (is_sub_gid && subgid_count != 0) {
-+		if (find_new_sub_gids(&sub_gid_start, &subgid_count) < 0) {
- 			fprintf (stderr,
- 			         _("%s: can't create subordinate group IDs\n"),
- 			         Prog);
-@@ -2642,7 +2640,7 @@ int main (int argc, char **argv)
- 	}
- #endif				/* ENABLE_SUBIDS */
- 
--	usr_update ();
-+	usr_update (subuid_count, subgid_count);
- 
- 	close_files ();
- 

shadow-4.9-usermod-allow-all-group-types.patch

@@ -1,322 +0,0 @@
-From e481437ab9ebe9a8bf8fbaabe986d42b2f765991 Mon Sep 17 00:00:00 2001
-From: Iker Pedrosa <ipedrosa@redhat.com>
-Date: Tue, 3 Aug 2021 08:57:20 +0200
-Subject: [PATCH] usermod: allow all group types with -G option
-
-The only way of removing a group from the supplementary list is to use
--G option, and list all groups that the user is a member of except for
-the one that wants to be removed. The problem lies when there's a user
-that contains both local and remote groups, and the group to be removed
-is a local one. As we need to include the remote group with -G option
-the command will fail.
-
-This reverts commit 140510de9de4771feb3af1d859c09604043a4c9b. This way,
-it would be possible to remove the remote groups from the supplementary
-list.
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1967641
-Resolves: https://github.com/shadow-maint/shadow/issues/338
-
-Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
----
- src/usermod.c | 220 ++++++++++++++++++--------------------------------
- 1 file changed, 77 insertions(+), 143 deletions(-)
-
-diff --git a/src/usermod.c b/src/usermod.c
-index 03bb9b9d..a0c03afa 100644
---- a/src/usermod.c
-+++ b/src/usermod.c
-@@ -187,7 +187,6 @@ static bool sub_gid_locked = false;
- static void date_to_str (/*@unique@*//*@out@*/char *buf, size_t maxsize,
-                          long int date);
- static int get_groups (char *);
--static struct group * get_local_group (char * grp_name);
- static /*@noreturn@*/void usage (int status);
- static void new_pwent (struct passwd *);
- static void new_spent (struct spwd *);
-@@ -201,9 +200,7 @@ static void grp_update (void);
- 
- static void process_flags (int, char **);
- static void close_files (void);
--static void close_group_files (void);
- static void open_files (void);
--static void open_group_files (void);
- static void usr_update (void);
- static void move_home (void);
- static void update_lastlog (void);
-@@ -260,11 +257,6 @@ static int get_groups (char *list)
- 		return 0;
- 	}
- 
--	/*
--	 * Open the group files
--	 */
--	open_group_files ();
--
- 	/*
- 	 * So long as there is some data to be converted, strip off each
- 	 * name and look it up. A mix of numerical and string values for
-@@ -284,7 +276,7 @@ static int get_groups (char *list)
- 		 * Names starting with digits are treated as numerical GID
- 		 * values, otherwise the string is looked up as is.
- 		 */
--		grp = get_local_group (list);
-+		grp = prefix_getgr_nam_gid (list);
- 
- 		/*
- 		 * There must be a match, either by GID value or by
-@@ -334,8 +326,6 @@ static int get_groups (char *list)
- 		gr_free ((struct group *)grp);
- 	} while (NULL != list);
- 
--	close_group_files ();
--
- 	user_groups[ngroups] = (char *) 0;
- 
- 	/*
-@@ -348,44 +338,6 @@ static int get_groups (char *list)
- 	return 0;
- }
- 
--/*
-- * get_local_group - checks if a given group name exists locally
-- *
-- *	get_local_group() checks if a given group name exists locally.
-- *	If the name exists the group information is returned, otherwise NULL is
-- *	returned.
-- */
--static struct group * get_local_group(char * grp_name)
--{
--	const struct group *grp;
--	struct group *result_grp = NULL;
--	long long int gid;
--	char *endptr;
--
--	gid = strtoll (grp_name, &endptr, 10);
--	if (   ('\0' != *grp_name)
--		&& ('\0' == *endptr)
--		&& (ERANGE != errno)
--		&& (gid == (gid_t)gid)) {
--		grp = gr_locate_gid ((gid_t) gid);
--	}
--	else {
--		grp = gr_locate(grp_name);
--	}
--
--	if (grp != NULL) {
--		result_grp = __gr_dup (grp);
--		if (NULL == result_grp) {
--			fprintf (stderr,
--					_("%s: Out of memory. Cannot find group '%s'.\n"),
--					Prog, grp_name);
--			fail_exit (E_GRP_UPDATE);
--		}
--	}
--
--	return result_grp;
--}
--
- #ifdef ENABLE_SUBIDS
- struct ulong_range
- {
-@@ -1523,7 +1475,50 @@ static void close_files (void)
- 	}
- 
- 	if (Gflg || lflg) {
--		close_group_files ();
-+		if (gr_close () == 0) {
-+			fprintf (stderr,
-+			         _("%s: failure while writing changes to %s\n"),
-+			         Prog, gr_dbname ());
-+			SYSLOG ((LOG_ERR,
-+			         "failure while writing changes to %s",
-+			         gr_dbname ()));
-+			fail_exit (E_GRP_UPDATE);
-+		}
-+#ifdef SHADOWGRP
-+		if (is_shadow_grp) {
-+			if (sgr_close () == 0) {
-+				fprintf (stderr,
-+				         _("%s: failure while writing changes to %s\n"),
-+				         Prog, sgr_dbname ());
-+				SYSLOG ((LOG_ERR,
-+				         "failure while writing changes to %s",
-+				         sgr_dbname ()));
-+				fail_exit (E_GRP_UPDATE);
-+			}
-+		}
-+#endif
-+#ifdef SHADOWGRP
-+		if (is_shadow_grp) {
-+			if (sgr_unlock () == 0) {
-+				fprintf (stderr,
-+				         _("%s: failed to unlock %s\n"),
-+				         Prog, sgr_dbname ());
-+				SYSLOG ((LOG_ERR,
-+				         "failed to unlock %s",
-+				         sgr_dbname ()));
-+				/* continue */
-+			}
-+		}
-+#endif
-+		if (gr_unlock () == 0) {
-+			fprintf (stderr,
-+			         _("%s: failed to unlock %s\n"),
-+			         Prog, gr_dbname ());
-+			SYSLOG ((LOG_ERR,
-+			         "failed to unlock %s",
-+			         gr_dbname ()));
-+			/* continue */
-+		}
- 	}
- 
- 	if (is_shadow_pwd) {
-@@ -1592,60 +1587,6 @@ static void close_files (void)
- #endif
- }
- 
--/*
-- * close_group_files - close all of the files that were opened
-- *
-- *	close_group_files() closes all of the files that were opened related
-- *  with groups. This causes any modified entries to be written out.
-- */
--static void close_group_files (void)
--{
--	if (gr_close () == 0) {
--		fprintf (stderr,
--					_("%s: failure while writing changes to %s\n"),
--					Prog, gr_dbname ());
--		SYSLOG ((LOG_ERR,
--					"failure while writing changes to %s",
--					gr_dbname ()));
--		fail_exit (E_GRP_UPDATE);
--	}
--#ifdef SHADOWGRP
--	if (is_shadow_grp) {
--		if (sgr_close () == 0) {
--			fprintf (stderr,
--						_("%s: failure while writing changes to %s\n"),
--						Prog, sgr_dbname ());
--			SYSLOG ((LOG_ERR,
--						"failure while writing changes to %s",
--						sgr_dbname ()));
--			fail_exit (E_GRP_UPDATE);
--		}
--	}
--#endif
--#ifdef SHADOWGRP
--	if (is_shadow_grp) {
--		if (sgr_unlock () == 0) {
--			fprintf (stderr,
--						_("%s: failed to unlock %s\n"),
--						Prog, sgr_dbname ());
--			SYSLOG ((LOG_ERR,
--						"failed to unlock %s",
--						sgr_dbname ()));
--			/* continue */
--		}
--	}
--#endif
--	if (gr_unlock () == 0) {
--		fprintf (stderr,
--					_("%s: failed to unlock %s\n"),
--					Prog, gr_dbname ());
--		SYSLOG ((LOG_ERR,
--					"failed to unlock %s",
--					gr_dbname ()));
--		/* continue */
--	}
--}
--
- /*
-  * open_files - lock and open the password files
-  *
-@@ -1681,7 +1622,38 @@ static void open_files (void)
- 	}
- 
- 	if (Gflg || lflg) {
--		open_group_files ();
-+		/*
-+		 * Lock and open the group file. This will load all of the
-+		 * group entries.
-+		 */
-+		if (gr_lock () == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot lock %s; try again later.\n"),
-+			         Prog, gr_dbname ());
-+			fail_exit (E_GRP_UPDATE);
-+		}
-+		gr_locked = true;
-+		if (gr_open (O_CREAT | O_RDWR) == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot open %s\n"),
-+			         Prog, gr_dbname ());
-+			fail_exit (E_GRP_UPDATE);
-+		}
-+#ifdef SHADOWGRP
-+		if (is_shadow_grp && (sgr_lock () == 0)) {
-+			fprintf (stderr,
-+			         _("%s: cannot lock %s; try again later.\n"),
-+			         Prog, sgr_dbname ());
-+			fail_exit (E_GRP_UPDATE);
-+		}
-+		sgr_locked = true;
-+		if (is_shadow_grp && (sgr_open (O_CREAT | O_RDWR) == 0)) {
-+			fprintf (stderr,
-+			         _("%s: cannot open %s\n"),
-+			         Prog, sgr_dbname ());
-+			fail_exit (E_GRP_UPDATE);
-+		}
-+#endif
- 	}
- #ifdef ENABLE_SUBIDS
- 	if (vflg || Vflg) {
-@@ -1717,44 +1689,6 @@ static void open_files (void)
- #endif				/* ENABLE_SUBIDS */
- }
- 
--/*
-- * open_group_files - lock and open the group files
-- *
-- *	open_group_files() loads all of the group entries.
-- */
--static void open_group_files (void)
--{
--	if (gr_lock () == 0) {
--		fprintf (stderr,
--					_("%s: cannot lock %s; try again later.\n"),
--					Prog, gr_dbname ());
--		fail_exit (E_GRP_UPDATE);
--	}
--	gr_locked = true;
--	if (gr_open (O_CREAT | O_RDWR) == 0) {
--		fprintf (stderr,
--					_("%s: cannot open %s\n"),
--					Prog, gr_dbname ());
--		fail_exit (E_GRP_UPDATE);
--	}
--
--#ifdef SHADOWGRP
--	if (is_shadow_grp && (sgr_lock () == 0)) {
--		fprintf (stderr,
--					_("%s: cannot lock %s; try again later.\n"),
--					Prog, sgr_dbname ());
--		fail_exit (E_GRP_UPDATE);
--	}
--	sgr_locked = true;
--	if (is_shadow_grp && (sgr_open (O_CREAT | O_RDWR) == 0)) {
--		fprintf (stderr,
--					_("%s: cannot open %s\n"),
--					Prog, sgr_dbname ());
--		fail_exit (E_GRP_UPDATE);
--	}
--#endif
--}
--
- /*
-  * usr_update - create the user entries
-  *
--- 
-2.31.1
-

shadow-utils.login.defs

@@ -130,10 +130,9 @@ HOME_MODE	0700
 #
 PASS_MAX_DAYS	99999
 PASS_MIN_DAYS	0
+PASS_MIN_LEN	8
 PASS_WARN_AGE	7
 
-# Currently PASS_MIN_LEN is not supported
-
 # Currently SU_WHEEL_ONLY is not supported
 
 # Currently CRACKLIB_DICTPATH is not supported
@@ -147,7 +146,7 @@ UID_MAX                 60000
 SYS_UID_MIN               201
 SYS_UID_MAX               999
 # Extra per user uids
-SUB_UID_MIN		   100000
+SUB_UID_MIN		   524288
 SUB_UID_MAX		600100000
 SUB_UID_COUNT		    65536
 
@@ -160,7 +159,7 @@ GID_MAX                 60000
 SYS_GID_MIN               201
 SYS_GID_MAX               999
 # Extra per user group ids
-SUB_GID_MIN		   100000
+SUB_GID_MIN		   524288
 SUB_GID_MAX		600100000
 SUB_GID_COUNT		    65536
 
@@ -174,11 +173,22 @@ SUB_GID_COUNT		    65536
 #
 #LOGIN_TIMEOUT		60
 
-# Currently PASS_CHANGE_TRIES is not supported
+#
+# Maximum number of attempts to change password if rejected (too easy)
+#
+PASS_CHANGE_TRIES	5
 
-# Currently PASS_ALWAYS_WARN is not supported
+#
+# Warn about weak passwords (but still allow them) if you are root.
+#
+PASS_ALWAYS_WARN	yes
 
-# Currently PASS_MAX_LEN is not supported
+#
+# Number of significant characters in the password for crypt().
+# Default is 8, don't change unless your crypt() is better.
+# Ignored if MD5_CRYPT_ENAB set to "yes".
+#
+#PASS_MAX_LEN		8
 
 # Currently CHFN_AUTH is not supported
 

shadow-utils.spec

@@ -1,62 +1,30 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
-Version: 4.9
-Release: 4%{?dist}
+Version: 4.20.0
+Release: 1%{?dist}
 Epoch: 2
-License: BSD and GPLv2+
+License: BSD-3-Clause AND GPL-2.0-or-later
 URL: https://github.com/shadow-maint/shadow
-Source0: https://github.com/shadow-maint/shadow/releases/download/%{version}/shadow-%{version}.tar.xz
-Source1: https://github.com/shadow-maint/shadow/releases/download/%{version}/shadow-%{version}.tar.xz.asc
+Source0: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz
+Source1: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz.asc
 Source2: shadow-utils.useradd
 Source3: shadow-utils.login.defs
 Source4: shadow-bsd.txt
 Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
 Source6: shadow-utils.HOME_MODE.xml
+Source7: passwd.pamd
 
 ### Globals ###
 %global includesubiddir %{_includedir}/shadow
+# Fail linking if there are undefined symbols.
+%global _ld_strict_symbol_defs 1
 
 ### Patches ###
-# Misc small changes - most probably non-upstreamable
-Patch0: shadow-4.9-redhat.patch
-# Be more lenient with acceptable user/group names - non upstreamable
-Patch1: shadow-4.8-goodname.patch
-# Move create home to the end of main - upstreamability unknown
-Patch2: shadow-4.9-move-create-home.patch
-# SElinux related - upstreamability unknown
-Patch3: shadow-4.9-default-range.patch
-# Misc manual page changes - non-upstreamable
-Patch4: shadow-4.9-manfix.patch
-# Date parsing improvement - could be upstreamed
-Patch5: shadow-4.2.1-date-parsing.patch
-# Additional error message - could be upstreamed
-Patch6: shadow-4.6-move-home.patch
-# Audit message changes - upstreamability unknown
-Patch7: shadow-4.9-audit-update.patch
-# Changes related to password unlocking - could be upstreamed
-Patch8: shadow-4.5-usermod-unlock.patch
-# Additional SElinux related changes - upstreamability unknown
-Patch9: shadow-4.8-selinux-perms.patch
-# Handle NULL return from *time funcs - could be upstreamed
-Patch10: shadow-4.9-null-tm.patch
-# Handle /etc/passwd corruption - could be upstreamed
-Patch11: shadow-4.8-long-entry.patch
-# Limit uid/gid allocation to non-zero - could be upstreamed
-Patch12: shadow-4.6-sysugid-min-limit.patch
-# Ignore LOGIN_PLAIN_PROMPT in login.defs - upstreamability unknown
-Patch13: shadow-4.8-ignore-login-prompt.patch
-# https://github.com/shadow-maint/shadow/commit/c6847011e8b656adacd9a0d2a78418cad0de34cb
-Patch14: shadow-4.9-newuidmap-libeconf-dependency.patch
-# https://github.com/shadow-maint/shadow/commit/e481437ab9ebe9a8bf8fbaabe986d42b2f765991
-Patch15: shadow-4.9-usermod-allow-all-group-types.patch
-# https://github.com/shadow-maint/shadow/commit/9dd720a28578eef5be8171697aae0906e4c53249
-Patch16: shadow-4.9-useradd-avoid-generating-empty-subid-range.patch
-# https://github.com/shadow-maint/shadow/commit/234e8fa7b134d1ebabfdad980a3ae5b63c046c62
-Patch17: shadow-4.9-libmisc-fix-default-value-in-SHA_get_salt_rounds.patch
 
 ### Dependencies ###
 Requires: audit-libs >= 1.6.5
 Requires: libselinux >= 1.25.2-1
+Requires: pam-libs
 Requires: setup
 
 ### Build Dependencies ###
@@ -69,17 +37,38 @@ BuildRequires: docbook-style-xsl
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: gettext-devel
+BuildRequires: git
 BuildRequires: itstool
 BuildRequires: libacl-devel
 BuildRequires: libattr-devel
+BuildRequires: libcmocka-devel
+BuildRequires: libeconf-devel
 BuildRequires: libselinux-devel >= 1.25.2-1
 BuildRequires: libsemanage-devel
 BuildRequires: libtool
+BuildRequires: libxcrypt-devel
 BuildRequires: libxslt
 BuildRequires: make
+BuildRequires: pam
+BuildRequires: pam-devel
 
 ### Provides ###
 Provides: shadow = %{epoch}:%{version}-%{release}
+Provides: passwd = 0.80-18
+Obsoletes: passwd <= 0.80-19
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Compat symlinks for Requires in other packages.
+# We rely on filesystem to create the symlinks for us.
+Requires: filesystem(unmerged-sbin-symlinks)
+Provides: /usr/sbin/adduser
+Provides: /usr/sbin/useradd
+Provides: /usr/sbin/userdel
+Provides: /usr/sbin/usermod
+Provides: /usr/sbin/groupadd
+Provides: /usr/sbin/groupdel
+Provides: /usr/sbin/groupmod
+%endif
 
 %description
 The shadow-utils package includes the necessary programs for
@@ -88,16 +77,14 @@ programs for managing user and group accounts. The pwconv command
 converts passwords to the shadow password format. The pwunconv command
 unconverts shadow passwords and generates a passwd file (a standard
 UNIX password file). The pwck command checks the integrity of password
-and shadow files. The lastlog command prints out the last login times
-for all users. The useradd, userdel, and usermod commands are used for
-managing user accounts. The groupadd, groupdel, and groupmod commands
-are used for managing group accounts.
+and shadow files. The useradd, userdel, and usermod commands are used
+for managing user accounts. The groupadd, groupdel, and groupmod
+commands are used for managing group accounts.
 
 
 ### Subpackages ###
 %package subid
 Summary: A library to manage subordinate uid and gid ranges
-License: BSD and GPLv2+
 
 %description subid
 Utility library that provides a way to manage subid ranges.
@@ -105,31 +92,13 @@ Utility library that provides a way to manage subid ranges.
 
 %package subid-devel
 Summary: Development package for shadow-utils-subid
-License: BSD and GPLv2+
+Requires: shadow-utils-subid = %{epoch}:%{version}-%{release}
 
 %description subid-devel
 Development files for shadow-utils-subid.
 
 %prep
-%setup -q -n shadow-%{version}
-%patch0 -p1 -b .redhat
-%patch1 -p1 -b .goodname
-%patch2 -p1 -b .move-create-home
-%patch3 -p1 -b .default-range
-%patch4 -p1 -b .manfix
-%patch5 -p1 -b .date-parsing
-%patch6 -p1 -b .move-home
-%patch7 -p1 -b .audit-update
-%patch8 -p1 -b .unlock
-%patch9 -p1 -b .selinux-perms
-%patch10 -p1 -b .null-tm
-%patch11 -p1 -b .long-entry
-%patch12 -p1 -b .sysugid-min-limit
-%patch13 -p1 -b .login-prompt
-%patch14 -p1 -b .newuidmap-libeconf-dependency
-%patch15 -p1 -b .usermod-allow-all-group-types
-%patch16 -p1 -b .useradd-avoid-generating-empty-subid-range
-%patch17 -p1 -b .libmisc-fix-default-value-in-SHA_get_salt_rounds
+%autosetup -p 1 -S git -n shadow-4.20.0
 
 iconv -f ISO88591 -t utf-8  doc/HOWTO > doc/HOWTO.utf8
 cp -f doc/HOWTO.utf8 doc/HOWTO
@@ -137,39 +106,39 @@ cp -f doc/HOWTO.utf8 doc/HOWTO
 cp -a %{SOURCE4} %{SOURCE5} .
 cp -a %{SOURCE6} man/login.defs.d/HOME_MODE.xml
 
-# Force regeneration of getdate.c
-rm libmisc/getdate.c
-
 %build
-%ifarch sparc64
-#sparc64 need big PIE
-export CFLAGS="$RPM_OPT_FLAGS -fPIE"
-export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
-%else
-export CFLAGS="$RPM_OPT_FLAGS -fpie"
-export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
-%endif
-
 autoreconf
 %configure \
-        --enable-shadowgrp \
+        --disable-account-tools-setuid \
+        --enable-logind=no \
         --enable-man \
-        --with-audit \
-        --with-sha-crypt \
-        --with-bcrypt \
-        --with-yescrypt \
-        --with-selinux \
-        --without-libcrack \
-        --without-libpam \
+        --enable-shadowgrp \
         --enable-shared \
-        --with-group-name-max-length=32
+        --with-audit \
+        --with-bcrypt \
+        --with-group-name-max-length=32 \
+        --with-libpam \
+        --with-selinux \
+        --with-sha-crypt \
+        --with-yescrypt \
+        --without-libbsd \
+        --without-libcrack \
+        --without-nscd \
+        --without-sssd
 %make_build
 
+%check
+make check
+
 %install
 %make_install gnulocaledir=$RPM_BUILD_ROOT%{_datadir}/locale MKINSTALLDIRS=`pwd`/mkinstalldirs
 install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/default
 install -p -c -m 0644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/login.defs
 install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/default/useradd
+install -d -m 755 $RPM_BUILD_ROOT%{_pam_confdir}
+install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/chpasswd
+install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/newusers
+install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/passwd
 
 
 ln -s useradd $RPM_BUILD_ROOT%{_sbindir}/adduser
@@ -178,45 +147,28 @@ for subdir in $RPM_BUILD_ROOT%{_mandir}/{??,??_??,??_??.*}/man* ; do
         test -d $subdir && test -e $subdir/useradd.8 && echo ".so man8/useradd.8" > $subdir/adduser.8
 done
 
+%if "%{_sbindir}" == "%{_bindir}"
+# The installation script doesn't actually use the configured paths :(
+mv -v $RPM_BUILD_ROOT/usr/sbin/* $RPM_BUILD_ROOT%{_bindir}/
+%endif
+
 # Remove binaries we don't use.
 rm $RPM_BUILD_ROOT%{_bindir}/chfn
 rm $RPM_BUILD_ROOT%{_bindir}/chsh
-rm $RPM_BUILD_ROOT%{_bindir}/expiry
-rm $RPM_BUILD_ROOT%{_bindir}/groups
 rm $RPM_BUILD_ROOT%{_bindir}/login
-rm $RPM_BUILD_ROOT%{_bindir}/passwd
 rm $RPM_BUILD_ROOT%{_bindir}/su
 rm $RPM_BUILD_ROOT%{_bindir}/faillog
-rm $RPM_BUILD_ROOT%{_sysconfdir}/login.access
-rm $RPM_BUILD_ROOT%{_sysconfdir}/limits
-rm $RPM_BUILD_ROOT%{_sbindir}/logoutd
 rm $RPM_BUILD_ROOT%{_sbindir}/nologin
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chsh.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chsh.*
-rm $RPM_BUILD_ROOT%{_mandir}/man1/expiry.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man1/expiry.*
-rm $RPM_BUILD_ROOT%{_mandir}/man1/groups.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man1/groups.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/login.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/login.*
-rm $RPM_BUILD_ROOT%{_mandir}/man1/passwd.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man1/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/su.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/su.*
-rm $RPM_BUILD_ROOT%{_mandir}/man5/limits.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man5/limits.*
-rm $RPM_BUILD_ROOT%{_mandir}/man5/login.access.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man5/login.access.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/passwd.*
-rm $RPM_BUILD_ROOT%{_mandir}/man5/porttime.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man5/porttime.*
-rm $RPM_BUILD_ROOT%{_mandir}/man5/suauth.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man5/suauth.*
-rm $RPM_BUILD_ROOT%{_mandir}/man8/logoutd.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man8/logoutd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/man3/getspnam.*
@@ -226,6 +178,12 @@ rm $RPM_BUILD_ROOT%{_mandir}/*/man5/faillog.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/faillog.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/faillog.*
 
+# Remove PAM service files we don't use.
+rm $RPM_BUILD_ROOT%{_pam_confdir}/chfn
+rm $RPM_BUILD_ROOT%{_pam_confdir}/chsh
+rm $RPM_BUILD_ROOT%{_pam_confdir}/login
+rm $RPM_BUILD_ROOT%{_pam_confdir}/su
+
 find $RPM_BUILD_ROOT%{_mandir} -depth -type d -empty -delete
 %find_lang shadow
 for dir in $(ls -1d $RPM_BUILD_ROOT%{_mandir}/{??,??_??}) ; do
@@ -241,21 +199,25 @@ echo $(ls)
 mkdir -p $RPM_BUILD_ROOT/%{includesubiddir}
 install -m 644 libsubid/subid.h $RPM_BUILD_ROOT/%{includesubiddir}/
 
-# Remove .la files created by libsubid
+# Remove .la and .a files created by libsubid
 rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.la
+rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 
 %files -f shadow.lang
 %doc NEWS doc/HOWTO README
 %license gpl-2.0.txt shadow-bsd.txt
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/login.defs
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/default/useradd
+%config(noreplace) %{_pam_confdir}/chpasswd
+%config(noreplace) %{_pam_confdir}/newusers
+%config(noreplace) %{_pam_confdir}/passwd
 %{_bindir}/sg
 %attr(4755,root,root) %{_bindir}/chage
 %attr(4755,root,root) %{_bindir}/gpasswd
-%{_bindir}/lastlog
 %attr(4755,root,root) %{_bindir}/newgrp
 %attr(0755,root,root) %caps(cap_setgid=ep) %{_bindir}/newgidmap
 %attr(0755,root,root) %caps(cap_setuid=ep) %{_bindir}/newuidmap
+%attr(4755,root,root) %{_bindir}/passwd
 %{_sbindir}/adduser
 %attr(0755,root,root)   %{_sbindir}/user*
 %attr(0755,root,root)   %{_sbindir}/group*
@@ -273,6 +235,7 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.la
 %{_mandir}/man1/newgrp.1*
 %{_mandir}/man1/newgidmap.1*
 %{_mandir}/man1/newuidmap.1*
+%{_mandir}/man1/passwd.*
 %{_mandir}/man3/shadow.3*
 %{_mandir}/man5/shadow.5*
 %{_mandir}/man5/login.defs.5*
@@ -288,18 +251,256 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.la
 %{_mandir}/man8/chgpasswd.8*
 %{_mandir}/man8/newusers.8*
 %{_mandir}/man8/*conv.8*
-%{_mandir}/man8/lastlog.8*
 %{_mandir}/man8/vipw.8*
 %{_mandir}/man8/vigr.8*
 
 %files subid
 %{_libdir}/libsubid.so.*
+%{_bindir}/getsubids
+%{_mandir}/man1/getsubids.1*
 
 %files subid-devel
 %{includesubiddir}/subid.h
 %{_libdir}/libsubid.so
 
 %changelog
+* Wed Jul 29 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-1
+- Rebase to version 4.20.0
+
+* Wed Jul 22 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-rc3-1
+- Rebase to version 4.20.0-rc3
+
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Wed May 27 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-3
+- Enable use of PAM for chpasswd and newusers
+  Resolves: #2461179 and #2283963
+
+* Thu Apr 23 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-2
+- btrfs: simplify checks improve useradd behavior for non-btrfs
+
+* Wed Feb 11 2026 Debarshi Ray <rishi@fedoraproject.org> - 2:4.19.3-1
+- Rebase to version 4.19.3
+  Resolves: #2426288
+
+* Tue Jan 27 2026 Adam Williamson <awilliam@redhat.com> - 2:4.19.0-6
+- chkhash.c: fix escaping in SHA-256 / SHA-512 / MD5 regexes
+
+* Mon Jan 26 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-5
+- chkhash.c: fix support for ! and * in hashes
+- usermod.c: add back optimizations
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Mon Jan 12 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-3
+- useradd: Support config for creating home dirs as Btrfs subvolumes
+
+* Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-2
+- Enable unit-tests
+
+* Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-1
+- Rebase to version 4.19.0
+  Resolves: #2426288 and #2249524
+
+* Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-7
+- Also revert changes from -4 (last known good was -3)
+
+* Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-6
+- Revert changes from -5 (they were only meant for testing)
+
+* Tue Nov 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-5
+- Test CI
+
+* Fri Oct 31 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-4
+- Stop setting SELinux labels in chroot and prefix environments
+  Resolves: #2249524
+
+* Tue Jul 29 2025 Alexey Tikhonov <atikhono@redhat.com> - 2:4.18.0-3
+- Revert "Stop assigning subids by default"
+  Resolves: #2382662
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.18.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue Jul 22 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-1
+- Rebase to version 4.18.0. Resolves: #2374710
+
+* Fri Jul 18 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-5
+- Stop assigning subids by default
+  Resolves: CVE-2024-56433 and #2334168
+
+* Tue Jul 15 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-4
+- FSWC: Migrate to lastlog2
+  Link: <https://fedoraproject.org/wiki/Changes/Migrate_to_lastlog2>
+  Resolves: #2361588
+
+* Tue Mar 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-2
+- Add pam dependency for _pam_confdir missing macro. Resolves: #2354806
+
+* Thu Mar 20 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-1
+- Rebase to version 4.17.4. Resolves: #2353491
+- Fixes problems with expiration dates
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0-5
+- Add explicit BR: libxcrypt-devel
+
+* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.17.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.17.0-3
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Thu Dec 26 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0
+- Rebase to version 4.17.0. Resolves: #2293678
+
+* Sun Dec 22 2024 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0~rc1-2
+- Remove potentially dangerous {C,LD}FLAGS shenanigans
+- Fail linking if there are undefined symbols at link-time
+
+* Mon Dec  9 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0~rc1-1
+- Rebase to version 4.17.0-rc1
+
+* Tue Nov 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-7
+- SPDX license migration for subpackages
+
+* Wed Oct 16 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-6
+- Rebuilt for libeconf soname bump
+
+* Mon Oct  7 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-5
+- useradd: fix write_full() return value. Resolves: #2313559
+
+* Fri Sep 13 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-3
+- Disable nscd
+
+* Wed Aug 28 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-2
+- Rebase to version 4.16.0 (#2293678)
+
+* Tue Jul 23 2024 Kevin Fenzi <kevin@scrye.com> - 2:4.15.1-9
+- Revert chpasswd: use PAM again for now.
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.15.1-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-7
+- Rebuilt for the bin-sbin merge
+
+* Thu May 30 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-6
+- chpasswd: use PAM again (#2283963)
+
+* Mon May 20 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-5
+- Several fixes for issues detected by static analyzer tools
+
+* Thu Apr 11 2024 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-4
+- Fix build with %%_bindir==%%_sbindir
+- Add virtual Provides for old file paths used by other packages
+
+* Thu Mar 21 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-2
+- getdef: avoid spurious error messages about unknown configuration options.
+  Resolves: #2265291
+
+* Tue Mar 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-1
+- Wrong versioning for 4.15.0 RC releases makes the oficial release look lower than them.
+  Fix it by bumping the minor release to 4.15.1. Resolves: #2268690
+
+* Mon Mar 11 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
+- Rebase to version 4.15.0
+
+* Mon Feb 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-6
+- Build linking `libpam`
+
+* Thu Feb  1 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
+- passwd: Provide binary from this package. Enable libpam and
+  disable account-tools-setuid. Provide passwd PAM service file.
+  Resolves: #2233275
+- passwd: provide --stdin option
+
+* Mon Jan 29 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-4
+- Disable SSSD support. Resolves: #2253182
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.14.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Tue Oct  3 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-2
+- useradd: Set proper SELinux labels for def_usrtemplate
+
+* Wed Aug 16 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-1
+- Rebase to version 4.14.0. Resolves: #2229000
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jun 06 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 2:4.13-7
+- Remove unused libbsd-devel dependency
+
+* Mon Mar  6 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-6
+- Add libbsd-devel and libeconf-devel as build dependencies
+
+* Thu Mar  2 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-5
+- newuidmap and newgidmap: support passing pid as fd. Resolves: #2174752
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Wed Nov 23 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-3
+- Change SUB_UID_MIN and SUB_GID_MIN to 524288. Resolves: #2144558
+
+* Mon Nov 21 2022 Florian Weimer <fweimer@redhat.com> - 2:4.13-2
+- Fix gshadow configure check (switching to glibc implementation)
+
+* Wed Nov  9 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-1
+- Rebase to version 4.13
+- SPDX license migration
+
+* Wed Oct  5 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-3
+- chage: Fix regression in print_date. Resolves: #2129336
+
+* Fri Sep  9 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-2
+- useradd: Do not reset non-existent data in {last,fail}log
+
+* Mon Aug 22 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-1
+- Rebase to version 4.12.3. Resolves: #2117809
+
+* Mon Aug  1 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-4
+- useradd: modify check ID range for system users. Resolves: #2093692
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.11.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Thu Feb 10 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-2
+- Fix explicit subid requirement for subid-devel
+
+* Tue Jan 25 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-1
+- Rebase to version 4.11.1 (#2034038)
+- Fix release sources
+- Add explicit subid requirement for subid-devel
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.9-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Mon Jan 17 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-9
+- nss: get shadow_logfd with log_get_logfd() (#2038811)
+- lib: make shadow_logfd and Prog not extern
+- lib: rename Prog to shadow_progname
+- lib: provide default values for shadow_progname
+- libsubid: use log_set_progname in subid_init
+
+* Fri Nov 19 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-8
+- getsubids: provide system binary and man page (#1980780)
+- pwck: fix segfault when calling fprintf() (#2021339)
+- newgrp: fix segmentation fault (#2019553)
+- groupdel: fix SIGSEGV when passwd does not exist (#1986111)
+
+* Fri Nov 12 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
+- useradd: change SELinux labels for home files (#2022658)
+
+* Thu Nov  4 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-6
+- useradd: revert fix memleak of grp (#2018697)
+
+* Wed Oct 27 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-5
+- useradd: generate home and mail directories with selinux user attribute
+
 * Thu Sep 23 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-4
 - login.defs: include HMAC_CRYPTO_ALGO key
 - Clean spec file: organize dependencies and move License location

sources

@@ -1,2 +1,2 @@
-SHA512 (shadow-4.9.tar.xz) = 254cda49bb14505a7604821e7fa898bf4bf317d648e9ddc881ab80a6860d52053dfffacad6feab87c7d16608c35ed6b6cee99e7757eac930da3a7b31cdcd4b95
-SHA512 (shadow-4.9.tar.xz.asc) = 16c0ff7be263c9d471b05656c9a1d14da8ec9b17544910323ca6ab854126d1a03ece221e0caf610e65a9b1d080b4cd1b8b46973f20e3ae45ea0e5581ce6c90d9
+SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406
+SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac

tests/mhc-fedora-ci.yaml

@@ -0,0 +1,13 @@
+provisioned_topologies:
+- shadow
+domains:
+- id: shadow
+  hosts:
+  - hostname: localhost
+    role: shadow
+    conn:
+      type: ssh
+      host: localhost
+      user: root
+    artifacts:
+    - /var/log/*

tests/sanity/Makefile

@@ -1,77 +0,0 @@
-# Copyright (c) 2006 Red Hat, Inc. All rights reserved. This copyrighted material 
-# is made available to anyone wishing to use, modify, copy, or
-# redistribute it subject to the terms and conditions of the GNU General
-# Public License v.2.
-#
-# This program is distributed in the hope that it will be useful, but WITHOUT ANY
-# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE. See the GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-#
-# Author: Jakub Hrozek
-
-#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
-# Example Makefile for RHTS                                          #
-# This example is geared towards a test for a specific package       #
-# It does most of the work for you, but may require further coding   #
-#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
-
-# The toplevel namespace within which the test lives.
-TOPLEVEL_NAMESPACE=CoreOS
-
-# The name of the package under test:
-PACKAGE_NAME=shadow-utils
-
-# The path of the test below the package:
-RELATIVE_PATH=sanity
-
-# Version of the Test. Used with make tag.
-export TESTVERSION=1.1
-
-# The combined namespace of the test.
-export TEST=/$(TOPLEVEL_NAMESPACE)/$(PACKAGE_NAME)/$(RELATIVE_PATH)
-
-# A phony target is one that is not really the name of a file.
-# It is just a name for some commands to be executed when you
-# make an explicit request. There are two reasons to use a
-# phony target: to avoid a conflict with a file of the same
-# name, and to improve performance.
-.PHONY: all install download clean
-
-# Executables to be built should be added here, they will be generated on the system under test.
-BUILT_FILES= 
-
-# Data files, .c files, scripts anything needed to either compile the test and/or run it.
-FILES=$(METADATA) Makefile PURPOSE sanity_test.py runtest.sh
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	chmod a+x ./sanity_test.py
-	chmod a+x ./runtest.sh
-
-clean:
-	rm -f *~ *.rpm $(BUILT_FILES)
-
-# Include Common Makefile
-include /usr/share/rhts/lib/rhts-make.include
-
-# Generate the testinfo.desc here:
-$(METADATA): Makefile
-	@touch $(METADATA)
-	@echo "Owner:        Jakub Hrozek <jhrozek@redhat.com>" > $(METADATA)
-	@echo "Name:         $(TEST)" >> $(METADATA)
-	@echo "Path:         $(TEST_DIR)" >> $(METADATA)
-	@echo "TestVersion:  $(TESTVERSION)" >> $(METADATA)
-	@echo "License:      GNU GPL" >> $(METADATA)
-	@echo "Description:  Basic sanity test for shadow-utils" >> $(METADATA)
-	@echo "TestTime:     5m" >> $(METADATA)
-	@echo "RunFor:       $(PACKAGE_NAME)" >> $(METADATA)
-	@echo "Requires:     $(PACKAGE_NAME)" >> $(METADATA)
-	@echo "Requires:     python" >> $(METADATA)
-	rhts-lint $(METADATA)
-

tests/sanity/PURPOSE

@@ -1,10 +0,0 @@
-This is a basic sanity test for the shadow-utils package. It is implemented
-in python on top of the unittesting.py module.
-
-Its purpose is to ensure that the binaries in the shadow-utils package behave
-as expected and its switches/options work correctly.
-
-For the most part, every binary in the shadow-utils package is represented by
-a single class named Test<BinaryName>, i.e. TestUsermod etc. There are some 
-exceptions, like TestUseraddWeirdNameTest though.
-

tests/sanity/runtest.sh

@@ -1,24 +0,0 @@
-#!/bin/bash
-. /usr/bin/rhts-environment.sh
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-rlFileBackup --clean /etc/default/useradd- /etc/default/useradd
-setenforce 0
-python sanity_test.py -v
-setenforce 1
-rlFileRestore
-
-EXIT=$?
-if [[ $EXIT -eq 0 ]]; then
-    RESULT="PASS"
-else
-    RESULT="FAIL"
-fi
-
-
-rlJournalEnd
-
-echo "Result: $RESULT"
-echo "Exit: $EXIT"
-report_result $TEST $RESULT $EXIT

tests/tests.yml

@@ -1,13 +0,0 @@
----
-# This first play always runs on the local staging system
-- hosts: localhost
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    - atomic
-    tests:
-    - sanity
-    required_packages:
-    - shadow-utils     # sanity test needs shadow-utils
-    - python           # sanity test needs python