useradd: fix write_full() return value

Resolves: #2313559

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

.gitignore

@@ -32,5 +32,3 @@ shadow-4.1.4.2.tar.bz2
 /shadow-4.15.0.tar.xz.asc
 /shadow-4.15.1.tar.xz
 /shadow-4.15.1.tar.xz.asc
-/shadow-4.16.0.tar.xz
-/shadow-4.16.0.tar.xz.asc

shadow-4.15.0-getdef-spurious-error.patch

@@ -0,0 +1,137 @@
+From ead55e9ba8958504e23e29545f90c4dd925c7462 Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serge@hallyn.com>
+Date: Wed, 20 Mar 2024 17:39:46 -0500
+Subject: [PATCH] getdef: avoid spurious error messages about unknown
+ configuration options
+
+def_find can return NULL for unset, not just unknown, config options.  So
+move the decision of whether to log an error message about an unknown config
+option back into def_find, which knows the difference.  Only putdef_str()
+will pass a char* srcfile to def_find, so only calls from putdef_str will
+cause the message, which was the original intent of fa68441bc4be8.
+
+closes #967
+
+fixes: fa68441bc4be8 ("Improve the login.defs unknown item error message")
+Signed-off-by: Serge Hallyn <serge@hallyn.com>
+---
+ lib/getdef.c | 30 ++++++++++++++++--------------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+diff --git a/lib/getdef.c b/lib/getdef.c
+index 4d4d4e19..ef2ae1f0 100644
+--- a/lib/getdef.c
++++ b/lib/getdef.c
+@@ -176,7 +176,7 @@ static const char* def_fname = LOGINDEFS;	/* login config defs file       */
+ static bool def_loaded = false;		/* are defs already loaded?     */
+ 
+ /* local function prototypes */
+-static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *);
++static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *, const char *);
+ static void def_load (void);
+ 
+ 
+@@ -195,7 +195,7 @@ static void def_load (void);
+ 		def_load ();
+ 	}
+ 
+-	d = def_find (item);
++	d = def_find (item, NULL);
+ 	return (NULL == d) ? NULL : d->value;
+ }
+ 
+@@ -214,7 +214,7 @@ bool getdef_bool (const char *item)
+ 		def_load ();
+ 	}
+ 
+-	d = def_find (item);
++	d = def_find (item, NULL);
+ 	if ((NULL == d) || (NULL == d->value)) {
+ 		return false;
+ 	}
+@@ -240,7 +240,7 @@ int getdef_num (const char *item, int dflt)
+ 		def_load ();
+ 	}
+ 
+-	d = def_find (item);
++	d = def_find (item, NULL);
+ 	if ((NULL == d) || (NULL == d->value)) {
+ 		return dflt;
+ 	}
+@@ -275,7 +275,7 @@ unsigned int getdef_unum (const char *item, unsigned int dflt)
+ 		def_load ();
+ 	}
+ 
+-	d = def_find (item);
++	d = def_find (item, NULL);
+ 	if ((NULL == d) || (NULL == d->value)) {
+ 		return dflt;
+ 	}
+@@ -310,7 +310,7 @@ long getdef_long (const char *item, long dflt)
+ 		def_load ();
+ 	}
+ 
+-	d = def_find (item);
++	d = def_find (item, NULL);
+ 	if ((NULL == d) || (NULL == d->value)) {
+ 		return dflt;
+ 	}
+@@ -342,7 +342,7 @@ unsigned long getdef_ulong (const char *item, unsigned long dflt)
+ 		def_load ();
+ 	}
+ 
+-	d = def_find (item);
++	d = def_find (item, NULL);
+ 	if ((NULL == d) || (NULL == d->value)) {
+ 		return dflt;
+ 	}
+@@ -375,12 +375,9 @@ int putdef_str (const char *name, const char *value, const char *srcfile)
+ 	 * Locate the slot to save the value.  If this parameter
+ 	 * is unknown then "def_find" will print an err message.
+ 	 */
+-	d = def_find (name);
+-	if (NULL == d) {
+-		if (NULL != srcfile)
+-			SYSLOG ((LOG_CRIT, "shadow: unknown configuration item '%s' in '%s'", name, srcfile));
++	d = def_find (name, srcfile);
++	if (NULL == d)
+ 		return -1;
+-	}
+ 
+ 	/*
+ 	 * Save off the value.
+@@ -404,9 +401,12 @@ int putdef_str (const char *name, const char *value, const char *srcfile)
+  *
+  * Search through a table of configurable items to locate the
+  * specified configuration option.
++ *
++ * If srcfile is not NULL, and the item is not found, then report an error saying
++ * the unknown item was used in this file.
+  */
+ 
+-static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *name)
++static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *name, const char *srcfile)
+ {
+ 	struct itemdef *ptr;
+ 
+@@ -432,6 +432,8 @@ static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *name)
+ 	fprintf (shadow_logfd,
+ 	         _("configuration error - unknown item '%s' (notify administrator)\n"),
+ 	         name);
++	if (srcfile != NULL)
++		SYSLOG ((LOG_CRIT, "shadow: unknown configuration item '%s' in '%s'", name, srcfile));
+ 
+ out:
+ 	return NULL;
+@@ -610,7 +612,7 @@ int main (int argc, char **argv)
+ 	def_load ();
+ 
+ 	for (i = 0; i < NUMDEFS; ++i) {
+-		d = def_find (def_table[i].name);
++		d = def_find (def_table[i].name, NULL);
+ 		if (NULL == d) {
+ 			printf ("error - lookup '%s' failed\n",
+ 			        def_table[i].name);
+-- 
+2.44.0
+

shadow-4.15.1-audit-update.patch

@@ -851,6 +851,15 @@ diff -up shadow-4.15.1/src/groupdel.c.audit-update shadow-4.15.1/src/groupdel.c
  		}
  
  		group_id = grp->gr_gid;
+@@ -447,7 +451,7 @@ int main (int argc, char **argv)
+ 			         _("%s: %s is the NIS master\n"),
+ 			         Prog, nis_master);
+ 		}
+-		exit (E_NOTFOUND);
++		fail_exit (E_NOTFOUND);
+ 	}
+ #endif
+ 
 diff -up shadow-4.15.1/src/groupmod.c.audit-update shadow-4.15.1/src/groupmod.c
 --- shadow-4.15.1/src/groupmod.c.audit-update	2024-03-08 22:27:04.000000000 +0100
 +++ shadow-4.15.1/src/groupmod.c	2024-05-20 11:52:05.640758536 +0200
@@ -1837,8 +1846,8 @@ diff -up shadow-4.15.1/src/usermod.c.audit-update shadow-4.15.1/src/usermod.c
  #endif
  		SYSLOG ((LOG_INFO,
 @@ -604,8 +604,8 @@ static void new_spent (struct spwd *spen
- 		DAY_TO_STR(new_exp, user_newexpire);
- 		DAY_TO_STR(old_exp, user_expire);
+ 		date_to_str (sizeof(new_exp), new_exp, user_newexpire * DAY);
+ 		date_to_str (sizeof(old_exp), old_exp, user_expire * DAY);
  #ifdef WITH_AUDIT
 -		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
 -		              "changing expiration date",

shadow-4.15.1-useradd-fix-write-full-return.patch

@@ -0,0 +1,34 @@
+From 8903b94c86c978e8abef623358fd3e4629c06967 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Mon, 9 Sep 2024 10:36:17 +0200
+Subject: [PATCH] useradd: fix write_full() return value
+
+write_full() returns -1 on error and useradd was checking another value.
+
+Closes: https://github.com/shadow-maint/shadow/issues/1072
+Fixes: f45498a6c286 ("libmisc/write_full.c: Improve write_full()")
+
+Reported-by: <https://github.com/brown-midas>
+Suggested-by: <https://github.com/brown-midas>
+Reviewed-by: Alejandro Colomar <alx@kernel.org>
+Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ src/useradd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index 02c500d0..d64fd892 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -2042,7 +2042,7 @@ static void lastlog_reset (uid_t uid)
+ 		return;
+ 	}
+ 	if (   (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
+-	    || (write_full (fd, &ll, sizeof (ll)) != (ssize_t) sizeof (ll))
++	    || (write_full (fd, &ll, sizeof (ll)) == -1)
+ 	    || (fsync (fd) != 0)) {
+ 		fprintf (stderr,
+ 		         _("%s: failed to reset the lastlog entry of UID %lu: %s\n"),
+-- 
+2.46.0
+

shadow-utils.spec

@@ -1,7 +1,7 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
-Version: 4.16.0
-Release: 1%{?dist}
+Version: 4.15.1
+Release: 12%{?dist}
 Epoch: 2
 License: BSD-3-Clause AND GPL-2.0-or-later
 URL: https://github.com/shadow-maint/shadow
@@ -22,10 +22,16 @@ Source7: passwd.pamd
 Patch0: shadow-4.15.0-manfix.patch
 # Date parsing improvement - could be upstreamed
 Patch1: shadow-4.15.0-date-parsing.patch
+# Several patches already available upstream. PRs:#994, #996, #997
+Patch2: shadow-4.15.1-sast-fixes.patch
 # Audit message changes - partially upstreamed
-Patch2: shadow-4.15.1-audit-update.patch
+Patch3: shadow-4.15.1-audit-update.patch
 # Probably non-upstreamable
-Patch3: shadow-4.15.0-account-tools-setuid.patch
+Patch4: shadow-4.15.0-account-tools-setuid.patch
+# https://github.com/shadow-maint/shadow/commit/ead55e9ba8958504e23e29545f90c4dd925c7462
+Patch5: shadow-4.15.0-getdef-spurious-error.patch
+# https://github.com/shadow-maint/shadow/commit/8903b94c86c978e8abef623358fd3e4629c06967
+Patch6: shadow-4.15.1-useradd-fix-write-full-return.patch
 
 ### Dependencies ###
 Requires: audit-libs >= 1.6.5
@@ -127,22 +133,23 @@ export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
 
 autoreconf
 %configure \
+	--disable-account-tools-setuid \
+	--enable-lastlog \
+	--enable-logind=no \
+	--enable-man \
         --enable-shadowgrp \
-        --enable-man \
+        --enable-shared \
         --with-audit \
-        --with-libpam \
-        --with-sha-crypt \
         --with-bcrypt \
-        --with-yescrypt \
+        --with-group-name-max-length=32 \
+        --with-libpam \
         --with-selinux \
+        --with-sha-crypt \
+        --with-yescrypt \
         --without-libbsd \
         --without-libcrack \
-        --without-sssd \
-        --enable-shared \
-        --with-group-name-max-length=32 \
-        --enable-lastlog \
-        --enable-logind=no \
-        --disable-account-tools-setuid
+	--without-nscd \
+        --without-sssd
 %make_build
 
 %install
@@ -291,8 +298,11 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_libdir}/libsubid.so
 
 %changelog
-* Tue Aug 13 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-1
-- Rebase to version 4.16.0 (#2293678)
+* Thu Oct 10 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-12
+- useradd: fix write_full() return value. Resolves: #2313559
+
+* Wed Sep 18 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-10
+- Disable nscd
 
 * Tue Jul 23 2024 Kevin Fenzi <kevin@scrye.com> - 2:4.15.1-9
 - Revert chpasswd: use PAM again for now.

sources

@@ -1,2 +1,2 @@
-SHA512 (shadow-4.16.0.tar.xz) = 3986572c74cce013c733c592ef5a8113e69bba8fee74fb697fe8206bd616d29553e42822e663478db81b3e17b26b403bc69b3492dd981b87643b0e1c55035ecf
-SHA512 (shadow-4.16.0.tar.xz.asc) = be98d5c157115869e23932e347b609ab342c0bc1a9d716d07ae61b497779c1a5a436534eb3ee0294687eca5831e193776a005d13b43b6979c8acd380b9372550
+SHA512 (shadow-4.15.1.tar.xz) = 2667a1d781066adce42e684463329c3f32d28c07b7b79b628525bffcd61c078f6ff430be3d42976d0509d9f9a55cd80f5a50d479b85155476cee7f00f06708d8
+SHA512 (shadow-4.15.1.tar.xz.asc) = 0a39d6a45b7d8df12aade89ed9fc9d481c91297dbd34e85fe831426c1d0051cbcf8478759306b8871cd6b1835604c5836decf398d0165c50ac52fee365561446