groupdel: fix SIGSEGV when passwd does not exist (#1986111 )

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
allow all types of groups when modifying supplementary groups (#1975327 )
2021-11-30 14:45:25 +01:00 · 2021-08-09 10:15:44 +02:00
38 changed files with 5642 additions and 600 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
 1
--- a/.gitignore
+++ b/.gitignore
@ -14,43 +14,3 @@ shadow-4.1.4.2.tar.bz2
 /shadow-4.8.tar.xz.asc
 /shadow-4.8.1.tar.xz
 /shadow-4.8.1.tar.xz.asc
 /shadow-4.9.tar.xz
 /shadow-4.9.tar.xz.asc
 /shadow-4.11.1.tar.xz
 /shadow-4.11.1.tar.xz.asc
 /shadow-4.12.3.tar.xz
 /shadow-4.12.3.tar.xz.asc
 /shadow-4.13.tar.xz
 /shadow-4.13.tar.xz.asc
 /shadow-4.14.0.tar.xz
 /shadow-4.14.0.tar.xz.asc
 /shadow-4.15.0rc2.tar.xz
 /shadow-4.15.0rc2.tar.xz.asc
 /shadow-4.15.0rc3.tar.xz
 /shadow-4.15.0rc3.tar.xz.asc
 /shadow-4.15.0.tar.xz
 /shadow-4.15.0.tar.xz.asc
 /shadow-4.15.1.tar.xz
 /shadow-4.15.1.tar.xz.asc
 /shadow-4.16.0.tar.xz
 /shadow-4.16.0.tar.xz.asc
 /shadow-4.17.0-rc1.tar.xz
 /shadow-4.17.0-rc1.tar.xz.asc
 /shadow-4.17.0.tar.xz
 /shadow-4.17.0.tar.xz.asc
 /shadow-4.17.4.tar.xz
 /shadow-4.17.4.tar.xz.asc
 /shadow-4.18.0.tar.xz
 /shadow-4.18.0.tar.xz.asc
 /shadow-4.19.0.tar.xz
 /shadow-4.19.0.tar.xz.asc
 /shadow-4.19.2.tar.xz
 /shadow-4.19.2.tar.xz.asc
 /shadow-4.19.3.tar.xz
 /shadow-4.19.3.tar.xz.asc
 /shadow-4.20.0-rc2.tar.xz
 /shadow-4.20.0-rc2.tar.xz.asc
 /shadow-4.20.0-rc3.tar.xz
 /shadow-4.20.0-rc3.tar.xz.asc
 /shadow-4.20.0.tar.xz
 /shadow-4.20.0.tar.xz.asc
--- a/passwd.pamd
+++ b/passwd.pamd
@ -1,5 +0,0 @@
 #%PAM-1.0
 # This tool only uses the password stack.
 password   substack	system-auth
 -password   optional	pam_gnome_keyring.so use_authtok
 password   substack	postlogin
--- a/plans/tier0-functional.fmf
+++ b/plans/tier0-functional.fmf
@ -1,51 +0,0 @@
 summary: Tier 0 functional tests for shadow-utils
 description: |
    Run comprehensive system tests for shadow-utils. These tests validate user and group
    account management functionality by testing actual system operations including user
    creation, password management, group operations, and verification of system files
    (i.e. /etc/passwd, /etc/shadow).
 provision:
    how: virtual
    image: fedora
 prepare:
    - name: Install general dependencies
      how: install
      package:
        - expect
        - gcc
        - git
        - libssh-devel
        - python3-devel
        - python3-pip
    - name: Setup SSH keys for localhost testing
      how: shell
      script:
        - ssh-keygen -t rsa -f /root/.ssh/id_rsa -N "" -q
        - cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
        - chmod 600 /root/.ssh/authorized_keys
        - ssh-keyscan -H localhost >> /root/.ssh/known_hosts
    - name: Clone shadow repository
      how: shell
      script:
        - git clone https://github.com/shadow-maint/shadow.git /tmp/shadow-test
    - name: Copy test topology for Fedora CI
      how: shell
      script:
        - cp tests/mhc-fedora-ci.yaml /tmp/shadow-test/tests/system
    - name: Install test dependencies
      how: shell
      script:
        - pip3 install -r /tmp/shadow-test/tests/system/requirements.txt
 execute:
    how: tmt
    duration: 30m
    script: |
        cd /tmp/shadow-test/tests/system
        pytest --mh-config=mhc-fedora-ci.yaml --mh-lazy-ssh -v
--- a/shadow-4.1.5.1-default-range.patch
+++ b/shadow-4.1.5.1-default-range.patch
@ -0,0 +1,36 @@
 Index: shadow-4.5/lib/semanage.c
 ===================================================================
 --- shadow-4.5.orig/lib/semanage.c
 +++ shadow-4.5/lib/semanage.c
@@ -143,6 +143,7 @@ static int semanage_user_mod (semanage_h
 		goto done;
 	}
 +#if 0
 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
 	if (ret != 0) {
 		fprintf (stderr,
@@ -150,6 +151,7 @@ static int semanage_user_mod (semanage_h
 		ret = 1;
 		goto done;
 	}
 +#endif
 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
 	if (ret != 0) {
@@ -200,6 +202,7 @@ static int semanage_user_add (semanage_h
 		goto done;
 	}
 +#if 0
 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
 	if (ret != 0) {
 		fprintf (stderr,
@@ -208,6 +211,7 @@ static int semanage_user_add (semanage_h
 		ret = 1;
 		goto done;
 	}
 +#endif
 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
 	if (ret != 0) {
--- a/shadow-4.1.5.1-info-parent-dir.patch
+++ b/shadow-4.1.5.1-info-parent-dir.patch
@ -0,0 +1,21 @@
 Index: shadow-4.5/man/newusers.8.xml
 ===================================================================
 --- shadow-4.5.orig/man/newusers.8.xml
 +++ shadow-4.5/man/newusers.8.xml
@@ -218,7 +218,15 @@
 	  <para>
 	    If this field does not specify an existing directory, the
 	    specified directory is created, with ownership set to the
 -	    user being created or updated and its primary group.
 +	    user being created or updated and its primary group. Note 
 +            that newusers does not create parent directories of the new 
 +            user's home directory. The newusers command will fail to 
 +            create the home directory if the parent directories do not 
 +            exist, and will send a message to stderr informing the user 
 +            of the failure. The newusers command will not halt or return 
 +            a failure to the calling shell if it fails to create the home 
 +            directory, it will continue to process the batch of new users 
 +            specified.
 	  </para>
 	  <para>
 	    If the home directory of an existing user is changed,
--- a/shadow-4.1.5.1-logmsg.patch
+++ b/shadow-4.1.5.1-logmsg.patch
@ -0,0 +1,13 @@
 Index: shadow-4.5/src/useradd.c
 ===================================================================
 --- shadow-4.5.orig/src/useradd.c
 +++ shadow-4.5/src/useradd.c
@@ -323,7 +323,7 @@ static void fail_exit (int code)
 	              user_name, AUDIT_NO_ID,
 	              SHADOW_AUDIT_FAILURE);
 #endif
 -	SYSLOG ((LOG_INFO, "failed adding user '%s', data deleted", user_name));
 +	SYSLOG ((LOG_INFO, "failed adding user '%s', exit code: %d", user_name, code));
 	exit (code);
 }
--- a/shadow-4.1.5.1-userdel-helpfix.patch
+++ b/shadow-4.1.5.1-userdel-helpfix.patch
@ -0,0 +1,16 @@
 Index: shadow-4.5/src/userdel.c
 ===================================================================
 --- shadow-4.5.orig/src/userdel.c
 +++ shadow-4.5/src/userdel.c
@@ -143,8 +143,9 @@ static void usage (int status)
 	                  "\n"
 	                  "Options:\n"),
 	                Prog);
 -	(void) fputs (_("  -f, --force                   force removal of files,\n"
 -	                "                                even if not owned by user\n"),
 +	(void) fputs (_("  -f, --force                   force some actions that would fail otherwise\n"
 +			"                                e.g. removal of user still logged in\n"
 +			"                                or files, even if not owned by the user\n"),
 	              usageout);
 	(void) fputs (_("  -h, --help                    display this help message and exit\n"), usageout);
 	(void) fputs (_("  -r, --remove                  remove home directory and mail spool\n"), usageout);
--- a/shadow-4.2.1-date-parsing.patch
+++ b/shadow-4.2.1-date-parsing.patch
@ -0,0 +1,69 @@
 Index: shadow-4.5/libmisc/getdate.y
 ===================================================================
 --- shadow-4.5.orig/libmisc/getdate.y
 +++ shadow-4.5/libmisc/getdate.y
@@ -152,6 +152,7 @@ static int	yyHaveDay;
 static int	yyHaveRel;
 static int	yyHaveTime;
 static int	yyHaveZone;
 +static int      yyHaveYear;
 static int	yyTimezone;
 static int	yyDay;
 static int	yyHour;
@@ -293,18 +294,21 @@ date	: tUNUMBER '/' tUNUMBER {
 	      yyDay = $3;
 	      yyYear = $5;
 	    }
 +	    yyHaveYear++;
 	}
 	| tUNUMBER tSNUMBER tSNUMBER {
 	    /* ISO 8601 format.  yyyy-mm-dd.  */
 	    yyYear = $1;
 	    yyMonth = -$2;
 	    yyDay = -$3;
 +	    yyHaveYear++;
 	}
 	| tUNUMBER tMONTH tSNUMBER {
 	    /* e.g. 17-JUN-1992.  */
 	    yyDay = $1;
 	    yyMonth = $2;
 	    yyYear = -$3;
 +	    yyHaveYear++;
 	}
 	| tMONTH tUNUMBER {
 	    yyMonth = $1;
@@ -314,6 +318,7 @@ date	: tUNUMBER '/' tUNUMBER {
 	    yyMonth = $1;
 	    yyDay = $2;
 	    yyYear = $4;
 +	    yyHaveYear++;
 	}
 	| tUNUMBER tMONTH {
 	    yyMonth = $2;
@@ -323,6 +328,7 @@ date	: tUNUMBER '/' tUNUMBER {
 	    yyMonth = $2;
 	    yyDay = $1;
 	    yyYear = $3;
 +	    yyHaveYear++;
 	}
 	;
@@ -395,7 +401,8 @@ relunit	: tUNUMBER tYEAR_UNIT {
 number	: tUNUMBER
           {
 -	    if ((yyHaveTime != 0) && (yyHaveDate != 0) && (yyHaveRel == 0))
 +	    if ((yyHaveTime != 0 || $1 >= 100) && !yyHaveYear
 +		&& (yyHaveDate != 0) && (yyHaveRel == 0))
 	      yyYear = $1;
 	    else
 	      {
@@ -802,7 +809,7 @@ yylex (void)
 	  return LookupWord (buff);
 	}
       if (c != '(')
 -	return *yyInput++;
 +	return (unsigned char)*yyInput++;
       Count = 0;
       do
 	{
--- a/shadow-4.2.1-null-tm.patch
+++ b/shadow-4.2.1-null-tm.patch
@ -0,0 +1,91 @@
 Index: shadow-4.5/src/faillog.c
 ===================================================================
 --- shadow-4.5.orig/src/faillog.c
 +++ shadow-4.5/src/faillog.c
@@ -163,10 +163,14 @@ static void print_one (/*@null@*/const s
 	}
 	tm = localtime (&fl.fail_time);
 +	if (tm == NULL) {
 +		cp = "(unknown)";
 +	} else {
 #ifdef HAVE_STRFTIME
 -	strftime (ptime, sizeof (ptime), "%D %H:%M:%S %z", tm);
 -	cp = ptime;
 +		strftime (ptime, sizeof (ptime), "%D %H:%M:%S %z", tm);
 +		cp = ptime;
 #endif
 +	}
 	printf ("%-9s   %5d    %5d   ",
 	        pw->pw_name, fl.fail_cnt, fl.fail_max);
 	/* FIXME: cp is not defined ifndef HAVE_STRFTIME */
 Index: shadow-4.5/src/chage.c
 ===================================================================
 --- shadow-4.5.orig/src/chage.c
 +++ shadow-4.5/src/chage.c
@@ -168,6 +168,10 @@ static void date_to_str (char *buf, size
 	struct tm *tp;
 	tp = gmtime (&date);
 +	if (tp == NULL) {
 +		(void) snprintf (buf, maxsize, "(unknown)");
 +		return;
 +	}
 #ifdef HAVE_STRFTIME
 	(void) strftime (buf, maxsize, "%Y-%m-%d", tp);
 #else
 Index: shadow-4.5/src/lastlog.c
 ===================================================================
 --- shadow-4.5.orig/src/lastlog.c
 +++ shadow-4.5/src/lastlog.c
@@ -158,13 +158,17 @@ static void print_one (/*@null@*/const s
 	ll_time = ll.ll_time;
 	tm = localtime (&ll_time);
 +	if (tm == NULL) {
 +		cp = "(unknown)";
 +	} else {
 #ifdef HAVE_STRFTIME
 -	strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
 -	cp = ptime;
 +		strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
 +		cp = ptime;
 #else
 -	cp = asctime (tm);
 -	cp[24] = '\0';
 +		cp = asctime (tm);
 +		cp[24] = '\0';
 #endif
 +	}
 	if (ll.ll_time == (time_t) 0) {
 		cp = _("**Never logged in**\0");
 Index: shadow-4.5/src/passwd.c
 ===================================================================
 --- shadow-4.5.orig/src/passwd.c
 +++ shadow-4.5/src/passwd.c
@@ -455,6 +455,9 @@ static /*@observer@*/const char *date_to
 	struct tm *tm;
 	tm = gmtime (&t);
 +	if (tm == NULL) {
 +		return "(unknown)";
 +	}
 #ifdef HAVE_STRFTIME
 	(void) strftime (buf, sizeof buf, "%m/%d/%Y", tm);
 #else				/* !HAVE_STRFTIME */
 Index: shadow-4.5/src/usermod.c
 ===================================================================
 --- shadow-4.5.orig/src/usermod.c
 +++ shadow-4.5/src/usermod.c
@@ -210,6 +210,10 @@ static void date_to_str (/*@unique@*//*@
 	} else {
 		time_t t = (time_t) date;
 		tp = gmtime (&t);
 +		if (tp == NULL) {
 +			strncpy (buf, "unknown", maxsize);
 +			return;
 +		}
 #ifdef HAVE_STRFTIME
 		strftime (buf, maxsize, "%Y-%m-%d", tp);
 #else
--- a/shadow-4.5-usermod-unlock.patch
+++ b/shadow-4.5-usermod-unlock.patch
@ -0,0 +1,64 @@
 Index: shadow-4.5/src/usermod.c
 ===================================================================
 --- shadow-4.5.orig/src/usermod.c
 +++ shadow-4.5/src/usermod.c
@@ -455,14 +455,17 @@ static char *new_pw_passwd (char *pw_pas
 		strcat (buf, pw_pass);
 		pw_pass = buf;
 	} else if (Uflg && pw_pass[0] == '!') {
 -		char *s;
 +		char *s = pw_pass;
 -		if (pw_pass[1] == '\0') {
 +		while ('!' == *s)
 +			++s;
 +
 +		if (*s == '\0') {
 			fprintf (stderr,
 			         _("%s: unlocking the user's password would result in a passwordless account.\n"
 			           "You should set a password with usermod -p to unlock this user's password.\n"),
 			         Prog);
 -			return pw_pass;
 +			return NULL;
 		}
 #ifdef WITH_AUDIT
@@ -471,12 +474,15 @@ static char *new_pw_passwd (char *pw_pas
 		              user_newname, (unsigned int) user_newid, 1);
 #endif
 		SYSLOG ((LOG_INFO, "unlock user '%s' password", user_newname));
 -		s = pw_pass;
 -		while ('\0' != *s) {
 -			*s = *(s + 1);
 -			s++;
 -		}
 +		memmove (pw_pass, s, strlen (s) + 1);
 	} else if (pflg) {
 +		if (strchr (user_pass, ':') != NULL) {
 +			fprintf (stderr,
 +			         _("%s: The password field cannot contain a colon character.\n"),
 +			         Prog);
 +			return NULL;
 +
 +		}
 #ifdef WITH_AUDIT
 		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
 		              "updating-password",
@@ -525,6 +531,8 @@ static void new_pwent (struct passwd *pw
 	if (   (!is_shadow_pwd)
 	    || (strcmp (pwent->pw_passwd, SHADOW_PASSWD_STRING) != 0)) {
 		pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd);
 +		if (pwent->pw_passwd == NULL)
 +			fail_exit (E_PW_UPDATE);
 	}
 	if (uflg) {
@@ -639,6 +647,8 @@ static void new_spent (struct spwd *spen
 	 *  + aging has been requested
 	 */
 	spent->sp_pwdp = new_pw_passwd (spent->sp_pwdp);
 +	if (spent->sp_pwdp == NULL)
 +		fail_exit(E_PW_UPDATE);
 	if (pflg) {
 		spent->sp_lstchg = (long) gettime () / SCALE;
--- a/shadow-4.6-getenforce.patch
+++ b/shadow-4.6-getenforce.patch
@ -0,0 +1,21 @@
 diff -up shadow-4.6/lib/selinux.c.getenforce shadow-4.6/lib/selinux.c
 --- shadow-4.6/lib/selinux.c.getenforce	2018-05-28 15:10:15.870315221 +0200
 +++ shadow-4.6/lib/selinux.c	2018-05-28 15:10:15.894315731 +0200
@@ -75,7 +75,7 @@ int set_selinux_file_context (const char
 	}
 	return 0;
     error:
 -	if (security_getenforce () != 0) {
 +	if (security_getenforce () > 0) {
 		return 1;
 	}
 	return 0;
@@ -95,7 +95,7 @@ int reset_selinux_file_context (void)
 		selinux_checked = true;
 	}
 	if (selinux_enabled) {
 -		if (setfscreatecon (NULL) != 0) {
 +		if (setfscreatecon (NULL) != 0 && security_getenforce () > 0) {
 			return 1;
 		}
 	}
--- a/shadow-4.6-move-home.patch
+++ b/shadow-4.6-move-home.patch
@ -0,0 +1,15 @@
 diff -up shadow-4.6/src/usermod.c.move-home shadow-4.6/src/usermod.c
 --- shadow-4.6/src/usermod.c.move-home	2018-05-28 14:59:05.594076665 +0200
 +++ shadow-4.6/src/usermod.c	2018-05-28 15:00:28.479837392 +0200
@@ -1845,6 +1845,11 @@ static void move_home (void)
 			         Prog, prefix_user_home, prefix_user_newhome);
 			fail_exit (E_HOMEDIR);
 		}
 +	} else {
 +		fprintf (stderr,
 +		         _("%s: The previous home directory (%s) does "
 +		           "not exist or is inaccessible. Move cannot be completed.\n"),
 +		         Prog, prefix_user_home);
 	}
 }
--- a/shadow-4.6-redhat.patch
+++ b/shadow-4.6-redhat.patch
@ -0,0 +1,41 @@
 diff -up shadow-4.6/src/useradd.c.redhat shadow-4.6/src/useradd.c
 --- shadow-4.6/src/useradd.c.redhat	2018-04-29 18:42:37.000000000 +0200
 +++ shadow-4.6/src/useradd.c	2018-05-28 13:37:16.695651258 +0200
@@ -98,7 +98,7 @@ const char *Prog;
 static gid_t def_group = 100;
 static const char *def_gname = "other";
 static const char *def_home = "/home";
 -static const char *def_shell = "";
 +static const char *def_shell = "/sbin/nologin";
 static const char *def_template = SKEL_DIR;
 static const char *def_create_mail_spool = "no";
@@ -108,7 +108,7 @@ static const char *def_expire = "";
 #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
 static const char *user_name = "";
 -static const char *user_pass = "!";
 +static const char *user_pass = "!!";
 static uid_t user_id;
 static gid_t user_gid;
 static const char *user_comment = "";
@@ -1114,9 +1114,9 @@ static void process_flags (int argc, cha
 		};
 		while ((c = getopt_long (argc, argv,
 #ifdef WITH_SELINUX
 -		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:UZ:",
 +		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:UZ:",
 #else				/* !WITH_SELINUX */
 -		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:U",
 +		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:U",
 #endif				/* !WITH_SELINUX */
 		                         long_options, NULL)) != -1) {
 			switch (c) {
@@ -1267,6 +1267,7 @@ static void process_flags (int argc, cha
 			case 'M':
 				Mflg = true;
 				break;
 +			case 'n':
 			case 'N':
 				Nflg = true;
 				break;
--- a/shadow-4.6-sysugid-min-limit.patch
+++ b/shadow-4.6-sysugid-min-limit.patch
@ -0,0 +1,34 @@
 diff -up shadow-4.6/libmisc/find_new_gid.c.min-limit shadow-4.6/libmisc/find_new_gid.c
 --- shadow-4.6/libmisc/find_new_gid.c.min-limit	2018-04-29 18:42:37.000000001 +0200
 +++ shadow-4.6/libmisc/find_new_gid.c	2018-11-06 10:51:20.554963292 +0100
@@ -82,6 +82,13 @@ static int get_ranges (bool sys_group, g
                             (unsigned long) *max_id);
 			return EINVAL;
 		}
 +		/*
 +		 * Zero is reserved for root and the allocation algorithm does not
 +		 * work right with it.
 +		 */
 +		if (*min_id == 0) {
 +			*min_id = (gid_t) 1;
 +		}
 	} else {
 		/* Non-system groups */
 diff -up shadow-4.6/libmisc/find_new_uid.c.min-limit shadow-4.6/libmisc/find_new_uid.c
 --- shadow-4.6/libmisc/find_new_uid.c.min-limit	2018-04-29 18:42:37.000000001 +0200
 +++ shadow-4.6/libmisc/find_new_uid.c	2018-11-06 10:51:39.341399569 +0100
@@ -82,6 +82,13 @@ static int get_ranges (bool sys_user, ui
                             (unsigned long) *max_id);
 			return EINVAL;
 		}
 +		/*
 +		 * Zero is reserved for root and the allocation algorithm does not
 +		 * work right with it.
 +		 */
 +		if (*min_id == 0) {
 +			*min_id = (uid_t) 1;
 +		}
 	} else {
 		/* Non-system users */
--- a/shadow-4.8-crypt_h.patch
+++ b/shadow-4.8-crypt_h.patch
@ -0,0 +1,35 @@
 diff -up shadow-4.8/configure.ac.crypt_h shadow-4.8/configure.ac
 --- shadow-4.8/configure.ac.crypt_h	2020-01-13 10:26:17.400481712 +0100
 +++ shadow-4.8/configure.ac	2020-01-13 10:29:11.563529093 +0100
@@ -32,7 +32,7 @@ AC_HEADER_STDC
 AC_HEADER_SYS_WAIT
 AC_HEADER_STDBOOL
 -AC_CHECK_HEADERS(errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
 +AC_CHECK_HEADERS(crypt.h errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
 	utmpx.h termios.h termio.h sgtty.h sys/ioctl.h syslog.h paths.h \
 	utime.h ulimit.h sys/capability.h sys/resource.h gshadow.h lastlog.h \
 	locale.h rpc/key_prot.h netdb.h acl/libacl.h attr/libattr.h \
 diff -up shadow-4.8/lib/defines.h.crypt_h shadow-4.8/lib/defines.h
 --- shadow-4.8/lib/defines.h.crypt_h	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8/lib/defines.h	2020-01-13 10:26:17.400481712 +0100
@@ -4,6 +4,8 @@
 #ifndef _DEFINES_H_
 #define _DEFINES_H_
 +#include "config.h"
 +
 #if HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
@@ -94,6 +96,10 @@ char *strchr (), *strrchr (), *strtok ()
 # include <unistd.h>
 #endif
 +#if HAVE_CRYPT_H
 +# include <crypt.h>		/* crypt(3) may be defined in here */
 +#endif
 +
 #if TIME_WITH_SYS_TIME
 # include <sys/time.h>
 # include <time.h>
--- a/shadow-4.8-goodname.patch
+++ b/shadow-4.8-goodname.patch
@ -0,0 +1,100 @@
 diff -up shadow-4.8/libmisc/chkname.c.goodname shadow-4.8/libmisc/chkname.c
 --- shadow-4.8/libmisc/chkname.c.goodname	2020-01-13 09:44:41.968507996 +0100
 +++ shadow-4.8/libmisc/chkname.c	2020-01-13 09:46:27.863727732 +0100
@@ -55,26 +55,44 @@ static bool is_valid_name (const char *n
 	}
 	/*
 -	 * User/group names must match [a-z_][a-z0-9_-]*[$]
 -	 */
 +         * User/group names must match gnu e-regex:
 +         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
 +         *
 +         * as a non-POSIX, extension, allow "$" as the last char for
 +         * sake of Samba 3.x "add machine script"
 +         *
 +         * Also do not allow fully numeric names or just "." or "..".
 +         */
 +	int numeric;
 -	if (('\0' == *name) ||
 -	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
 +	if ('\0' == *name ||
 +	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
 +			      '\0' == name[1])) ||
 +	    !((*name >= 'a' && *name <= 'z') ||
 +	      (*name >= 'A' && *name <= 'Z') ||
 +	      (*name >= '0' && *name <= '9') ||
 +	      *name == '_' ||
 +	      *name == '.')) {
 		return false;
 	}
 +	numeric = isdigit(*name);
 +
 	while ('\0' != *++name) {
 -		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
 -		      ( ('0' <= *name) && ('9' >= *name) ) ||
 -		      ('_' == *name) ||
 -		      ('-' == *name) ||
 -		      ( ('$' == *name) && ('\0' == *(name + 1)) )
 +		if (!((*name >= 'a' && *name <= 'z') ||
 +		      (*name >= 'A' && *name <= 'Z') ||
 +		      (*name >= '0' && *name <= '9') ||
 +		      *name == '_' ||
 +		      *name == '.' ||
 +		      *name == '-' ||
 +		      (*name == '$' && name[1] == '\0')
 		     )) {
 			return false;
 		}
 +		numeric &= isdigit(*name);
 	}
 -	return true;
 +	return !numeric;
 }
 bool is_valid_user_name (const char *name)
 diff -up shadow-4.8/man/groupadd.8.xml.goodname shadow-4.8/man/groupadd.8.xml
 --- shadow-4.8/man/groupadd.8.xml.goodname	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8/man/groupadd.8.xml	2020-01-13 09:44:41.968507996 +0100
@@ -273,10 +273,12 @@
    <refsect1 id='caveats'>
      <title>CAVEATS</title>
      <para>
 -       Groupnames must start with a lower case letter or an underscore,
 -       followed by lower case letters, digits, underscores, or dashes.
 -       They can end with a dollar sign.
 -       In regular expression terms: [a-z_][a-z0-9_-]*[$]?
 +       Groupnames may contain only lower and upper case letters, digits,
 +       underscores, or dashes. They can end with a dollar sign.
 +
 +       Dashes are not allowed at the beginning of the groupname.
 +       Fully numeric groupnames and groupnames . or .. are
 +       also disallowed.
      </para>
      <para>
        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
 diff -up shadow-4.8/man/useradd.8.xml.goodname shadow-4.8/man/useradd.8.xml
 --- shadow-4.8/man/useradd.8.xml.goodname	2019-10-05 03:23:58.000000000 +0200
 +++ shadow-4.8/man/useradd.8.xml	2020-01-13 09:44:41.968507996 +0100
@@ -661,10 +661,14 @@
     </para>
     <para>
 -      Usernames must start with a lower case letter or an underscore,
 -      followed by lower case letters, digits, underscores, or dashes.
 -      They can end with a dollar sign.
 -      In regular expression terms: [a-z_][a-z0-9_-]*[$]?
 +      Usernames may contain only lower and upper case letters, digits,
 +      underscores, or dashes. They can end with a dollar sign.
 +
 +      Dashes are not allowed at the beginning of the username.
 +      Fully numeric usernames and usernames . or .. are
 +      also disallowed. It is not recommended to use usernames beginning
 +      with . character as their home directories will be hidden in
 +      the <command>ls</command> output.
     </para>
     <para>
       Usernames may only be up to 32 characters long.
--- a/shadow-4.8-ignore-login-prompt.patch
+++ b/shadow-4.8-ignore-login-prompt.patch
@ -0,0 +1,11 @@
 diff -up shadow-4.8/lib/getdef.c.login-prompt shadow-4.8/lib/getdef.c
 --- shadow-4.8/lib/getdef.c.login-prompt	2020-01-13 10:38:44.852796681 +0100
 +++ shadow-4.8/lib/getdef.c	2020-01-13 10:39:54.472612511 +0100
@@ -98,6 +98,7 @@ static struct itemdef def_table[] = {
 	{"LASTLOG_UID_MAX", NULL},
 	{"LOGIN_RETRIES", NULL},
 	{"LOGIN_TIMEOUT", NULL},
 +	{"LOGIN_PLAIN_PROMPT", NULL},
 	{"LOG_OK_LOGINS", NULL},
 	{"LOG_UNKFAIL_ENAB", NULL},
 	{"MAIL_DIR", NULL},
--- a/shadow-4.8-long-entry.patch
+++ b/shadow-4.8-long-entry.patch
@ -0,0 +1,86 @@
 diff -up shadow-4.8/lib/defines.h.long-entry shadow-4.8/lib/defines.h
 --- shadow-4.8/lib/defines.h.long-entry	2020-01-13 10:29:45.288957339 +0100
 +++ shadow-4.8/lib/defines.h	2020-01-13 10:30:47.482902954 +0100
@@ -388,6 +388,9 @@ extern char *strerror ();
 # endif
 #endif
 +/* Maximum length of passwd entry */
 +#define PASSWD_ENTRY_MAX_LENGTH 32768
 +
 #ifdef HAVE_SECURE_GETENV
 #  define shadow_getenv(name) secure_getenv(name)
 # else
 diff -up shadow-4.8/lib/pwio.c.long-entry shadow-4.8/lib/pwio.c
 --- shadow-4.8/lib/pwio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8/lib/pwio.c	2020-01-13 10:29:45.288957339 +0100
@@ -79,7 +79,10 @@ static int passwd_put (const void *ent,
 	    || (pw->pw_gid == (gid_t)-1)
 	    || (valid_field (pw->pw_gecos, ":\n") == -1)
 	    || (valid_field (pw->pw_dir, ":\n") == -1)
 -	    || (valid_field (pw->pw_shell, ":\n") == -1)) {
 +	    || (valid_field (pw->pw_shell, ":\n") == -1)
 +	    || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
 +	        strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
 +	        strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
 		return -1;
 	}
 diff -up shadow-4.8/lib/sgetpwent.c.long-entry shadow-4.8/lib/sgetpwent.c
 --- shadow-4.8/lib/sgetpwent.c.long-entry	2019-10-05 03:23:58.000000000 +0200
 +++ shadow-4.8/lib/sgetpwent.c	2020-01-13 10:29:45.288957339 +0100
@@ -57,7 +57,7 @@
 struct passwd *sgetpwent (const char *buf)
 {
 	static struct passwd pwent;
 -	static char pwdbuf[1024];
 +	static char pwdbuf[PASSWD_ENTRY_MAX_LENGTH];
 	register int i;
 	register char *cp;
 	char *fields[NFIELDS];
@@ -67,8 +67,10 @@ struct passwd *sgetpwent (const char *bu
 	 * the password structure remain valid.
 	 */
 -	if (strlen (buf) >= sizeof pwdbuf)
 +	if (strlen (buf) >= sizeof pwdbuf) {
 +		fprintf (stderr, "Too long passwd entry encountered, file corruption?\n");
 		return 0;	/* fail if too long */
 +	}
 	strcpy (pwdbuf, buf);
 	/*
 diff -up shadow-4.8/lib/sgetspent.c.long-entry shadow-4.8/lib/sgetspent.c
 --- shadow-4.8/lib/sgetspent.c.long-entry	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8/lib/sgetspent.c	2020-01-13 10:29:45.289957322 +0100
@@ -48,7 +48,7 @@
  */
 struct spwd *sgetspent (const char *string)
 {
 -	static char spwbuf[1024];
 +	static char spwbuf[PASSWD_ENTRY_MAX_LENGTH];
 	static struct spwd spwd;
 	char *fields[FIELDS];
 	char *cp;
@@ -61,6 +61,7 @@ struct spwd *sgetspent (const char *stri
 	 */
 	if (strlen (string) >= sizeof spwbuf) {
 +		fprintf (stderr, "Too long shadow entry encountered, file corruption?\n");
 		return 0;	/* fail if too long */
 	}
 	strcpy (spwbuf, string);
 diff -up shadow-4.8/lib/shadowio.c.long-entry shadow-4.8/lib/shadowio.c
 --- shadow-4.8/lib/shadowio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8/lib/shadowio.c	2020-01-13 10:29:45.289957322 +0100
@@ -79,7 +79,9 @@ static int shadow_put (const void *ent,
 	if (   (NULL == sp)
 	    || (valid_field (sp->sp_namp, ":\n") == -1)
 -	    || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
 +	    || (valid_field (sp->sp_pwdp, ":\n") == -1)
 +	    || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
 +	        1000 > PASSWD_ENTRY_MAX_LENGTH)) {
 		return -1;
 	}
--- a/shadow-4.8-selinux-perms.patch
+++ b/shadow-4.8-selinux-perms.patch
@ -0,0 +1,240 @@
 diff -up shadow-4.8/src/chgpasswd.c.selinux-perms shadow-4.8/src/chgpasswd.c
 --- shadow-4.8/src/chgpasswd.c.selinux-perms	2019-12-01 18:02:43.000000000 +0100
 +++ shadow-4.8/src/chgpasswd.c	2020-01-13 10:21:44.558107260 +0100
@@ -39,6 +39,13 @@
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
 +#ifdef WITH_SELINUX
 +#include <selinux/selinux.h>
 +#include <selinux/avc.h>
 +#endif
 +#ifdef WITH_LIBAUDIT
 +#include <libaudit.h>
 +#endif
 #ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 #include "pam_defs.h"
@@ -80,6 +87,9 @@ static bool sgr_locked = false;
 #endif
 static bool gr_locked = false;
 +/* The name of the caller */
 +static char *myname = NULL;
 +
 /* local function prototypes */
 static void fail_exit (int code);
 static /*@noreturn@*/void usage (int status);
@@ -334,6 +344,63 @@ static void check_perms (void)
 #endif				/* ACCT_TOOLS_SETUID */
 }
 +#ifdef WITH_SELINUX
 +static int
 +log_callback (int type, const char *fmt, ...)
 +{
 +    int audit_fd;
 +    va_list ap;
 +
 +    va_start(ap, fmt);
 +#ifdef WITH_AUDIT
 +    audit_fd = audit_open();
 +
 +    if (audit_fd >= 0) {
 +	char *buf;
 +
 +	if (vasprintf (&buf, fmt, ap) < 0)
 +		goto ret;
 +	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
 +				   NULL, 0);
 +	audit_close(audit_fd);
 +	free(buf);
 +	goto ret;
 +    }
 +
 +#endif
 +    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
 +ret:
 +    va_end(ap);
 +    return 0;
 +}
 +
 +static void
 +selinux_check_root (void)
 +{
 +    int status = -1;
 +    security_context_t user_context;
 +    union selinux_callback old_callback;
 +
 +    if (is_selinux_enabled() < 1)
 +	return;
 +
 +    old_callback = selinux_get_callback(SELINUX_CB_LOG);
 +    /* setup callbacks */
 +    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
 +    if ((status = getprevcon(&user_context)) < 0) {
 +	selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +	exit(1);
 +    }
 +
 +    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
 +
 +    selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +    freecon(user_context);
 +    if (status != 0 && security_getenforce() != 0)
 +	exit(1);
 +}
 +#endif
 +
 /*
  * open_files - lock and open the group databases
  */
@@ -427,6 +494,7 @@ int main (int argc, char **argv)
 	const struct group *gr;
 	struct group newgr;
 +	struct passwd *pw = NULL;
 	int errors = 0;
 	int line = 0;
@@ -436,12 +504,37 @@ int main (int argc, char **argv)
 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
 	(void) textdomain (PACKAGE);
 +#ifdef WITH_SELINUX
 +	selinux_check_root ();
 +#endif
 +
 	process_root_flag ("-R", argc, argv);
 	process_flags (argc, argv);
 	OPENLOG ("chgpasswd");
 +#ifdef WITH_AUDIT
 +	audit_help_open ();
 +#endif
 +
 +	/*
 +	 * Determine the name of the user that invoked this command. This
 +	 * is really hit or miss because there are so many ways that command
 +	 * can be executed and so many ways to trip up the routines that
 +	 * report the user name.
 +	 */
 +	pw = get_my_pwent ();
 +	if (NULL == pw) {
 +		fprintf (stderr, _("%s: Cannot determine your user name.\n"),
 +		         Prog);
 +		SYSLOG ((LOG_WARN,
 +		         "Cannot determine the user name of the caller (UID %lu)",
 +		         (unsigned long) getuid ()));
 +		exit (E_NOPERM);
 +	}
 +	myname = xstrdup (pw->pw_name);
 +
 	check_perms ();
 #ifdef SHADOWGRP
 diff -up shadow-4.8/src/chpasswd.c.selinux-perms shadow-4.8/src/chpasswd.c
 --- shadow-4.8/src/chpasswd.c.selinux-perms	2019-12-01 18:02:43.000000000 +0100
 +++ shadow-4.8/src/chpasswd.c	2020-01-13 10:21:44.558107260 +0100
@@ -39,6 +39,13 @@
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
 +#ifdef WITH_SELINUX
 +#include <selinux/selinux.h>
 +#include <selinux/avc.h>
 +#endif
 +#ifdef WITH_LIBAUDIT
 +#include <libaudit.h>
 +#endif
 #ifdef USE_PAM
 #include "pam_defs.h"
 #endif				/* USE_PAM */
@@ -332,6 +339,63 @@ static void check_perms (void)
 #endif				/* USE_PAM */
 }
 +#ifdef WITH_SELINUX
 +static int
 +log_callback (int type, const char *fmt, ...)
 +{
 +    int audit_fd;
 +    va_list ap;
 +
 +    va_start(ap, fmt);
 +#ifdef WITH_AUDIT
 +    audit_fd = audit_open();
 +
 +    if (audit_fd >= 0) {
 +	char *buf;
 +
 +	if (vasprintf (&buf, fmt, ap) < 0)
 +		goto ret;
 +	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
 +				   NULL, 0);
 +	audit_close(audit_fd);
 +	free(buf);
 +	goto ret;
 +    }
 +
 +#endif
 +    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
 +ret:
 +    va_end(ap);
 +    return 0;
 +}
 +
 +static void
 +selinux_check_root (void)
 +{
 +    int status = -1;
 +    security_context_t user_context;
 +    union selinux_callback old_callback;
 +
 +    if (is_selinux_enabled() < 1)
 +	return;
 +
 +    old_callback = selinux_get_callback(SELINUX_CB_LOG);
 +    /* setup callbacks */
 +    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
 +    if ((status = getprevcon(&user_context)) < 0) {
 +	selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +	exit(1);
 +    }
 +
 +    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
 +
 +    selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +    freecon(user_context);
 +    if (status != 0 && security_getenforce() != 0)
 +	exit(1);
 +}
 +#endif
 +
 /*
  * open_files - lock and open the password databases
  */
@@ -428,6 +492,10 @@ int main (int argc, char **argv)
 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
 	(void) textdomain (PACKAGE);
 +#ifdef WITH_SELINUX
 +	selinux_check_root ();
 +#endif
 +
 	process_root_flag ("-R", argc, argv);
 	process_flags (argc, argv);
@@ -440,6 +508,10 @@ int main (int argc, char **argv)
 	OPENLOG ("chpasswd");
 +#ifdef WITH_AUDIT
 +	audit_help_open ();
 +#endif
 +
 	check_perms ();
 #ifdef USE_PAM
--- a/shadow-4.8-selinux.patch
+++ b/shadow-4.8-selinux.patch
@ -0,0 +1,241 @@
 diff -up shadow-4.8/lib/commonio.c.selinux shadow-4.8/lib/commonio.c
 --- shadow-4.8/lib/commonio.c.selinux	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8/lib/commonio.c	2020-01-13 10:08:53.769101131 +0100
@@ -964,7 +964,7 @@ int commonio_close (struct commonio_db *
 		snprintf (buf, sizeof buf, "%s-", db->filename);
 #ifdef WITH_SELINUX
 -		if (set_selinux_file_context (buf) != 0) {
 +		if (set_selinux_file_context (buf, db->filename) != 0) {
 			errors++;
 		}
 #endif
@@ -997,7 +997,7 @@ int commonio_close (struct commonio_db *
 	snprintf (buf, sizeof buf, "%s+", db->filename);
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (buf) != 0) {
 +	if (set_selinux_file_context (buf, db->filename) != 0) {
 		errors++;
 	}
 #endif
 diff -up shadow-4.8/libmisc/copydir.c.selinux shadow-4.8/libmisc/copydir.c
 --- shadow-4.8/libmisc/copydir.c.selinux	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8/libmisc/copydir.c	2020-01-13 10:08:53.769101131 +0100
@@ -484,7 +484,7 @@ static int copy_dir (const char *src, co
 	 */
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (dst) != 0) {
 +	if (set_selinux_file_context (dst, NULL) != 0) {
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
@@ -605,7 +605,7 @@ static int copy_symlink (const char *src
 	}
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (dst) != 0) {
 +	if (set_selinux_file_context (dst, NULL) != 0) {
 		free (oldlink);
 		return -1;
 	}
@@ -684,7 +684,7 @@ static int copy_special (const char *src
 	int err = 0;
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (dst) != 0) {
 +	if (set_selinux_file_context (dst, NULL) != 0) {
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
@@ -744,7 +744,7 @@ static int copy_file (const char *src, c
 		return -1;
 	}
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (dst) != 0) {
 +	if (set_selinux_file_context (dst, NULL) != 0) {
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
 diff -up shadow-4.8/lib/prototypes.h.selinux shadow-4.8/lib/prototypes.h
 --- shadow-4.8/lib/prototypes.h.selinux	2020-01-13 10:08:53.769101131 +0100
 +++ shadow-4.8/lib/prototypes.h	2020-01-13 10:11:20.914627399 +0100
@@ -334,7 +334,7 @@ extern /*@observer@*/const char *crypt_m
 /* selinux.c */
 #ifdef WITH_SELINUX
 -extern int set_selinux_file_context (const char *dst_name);
 +extern int set_selinux_file_context (const char *dst_name, const char *orig_name);
 extern int reset_selinux_file_context (void);
 extern int check_selinux_permit (const char *perm_name);
 #endif
 diff -up shadow-4.8/lib/selinux.c.selinux shadow-4.8/lib/selinux.c
 --- shadow-4.8/lib/selinux.c.selinux	2019-11-12 01:18:25.000000000 +0100
 +++ shadow-4.8/lib/selinux.c	2020-01-13 10:08:53.769101131 +0100
@@ -51,7 +51,7 @@ static bool selinux_enabled;
  *	Callers may have to Reset SELinux to create files with default
  *	contexts with reset_selinux_file_context
  */
 -int set_selinux_file_context (const char *dst_name)
 +int set_selinux_file_context (const char *dst_name, const char *orig_name)
 {
 	/*@null@*/security_context_t scontext = NULL;
@@ -63,19 +63,23 @@ int set_selinux_file_context (const char
 	if (selinux_enabled) {
 		/* Get the default security context for this file */
 		if (matchpathcon (dst_name, 0, &scontext) < 0) {
 -			if (security_getenforce () != 0) {
 -				return 1;
 -			}
 +			/* We could not get the default, copy the original */
 +			if (orig_name == NULL)
 +				goto error;
 +			if (getfilecon (orig_name, &scontext) < 0)
 +				goto error;
 		}
 		/* Set the security context for the next created file */
 -		if (setfscreatecon (scontext) < 0) {
 -			if (security_getenforce () != 0) {
 -				return 1;
 -			}
 -		}
 +		if (setfscreatecon (scontext) < 0)
 +			goto error;
 		freecon (scontext);
 	}
 	return 0;
 +    error:
 +	if (security_getenforce () != 0) {
 +		return 1;
 +	}
 +	return 0;
 }
 /*
 diff -up shadow-4.8/lib/semanage.c.selinux shadow-4.8/lib/semanage.c
 --- shadow-4.8/lib/semanage.c.selinux	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8/lib/semanage.c	2020-01-13 10:08:53.766101181 +0100
@@ -294,6 +294,9 @@ int set_seuser (const char *login_name,
 	ret = 0;
 +        /* drop obsolete matchpathcon cache */
 +        matchpathcon_fini();
 +
 done:
 	semanage_seuser_key_free (key);
 	semanage_handle_destroy (handle);
@@ -369,6 +372,10 @@ int del_seuser (const char *login_name)
 	}
 	ret = 0;
 +
 +        /* drop obsolete matchpathcon cache */
 +        matchpathcon_fini();
 +
 done:
 	semanage_handle_destroy (handle);
 	return ret;
 diff -up shadow-4.8/src/useradd.c.selinux shadow-4.8/src/useradd.c
 --- shadow-4.8/src/useradd.c.selinux	2020-01-13 10:08:53.762101248 +0100
 +++ shadow-4.8/src/useradd.c	2020-01-13 10:08:53.767101164 +0100
@@ -2078,7 +2078,7 @@ static void create_home (void)
 		++bhome;
 #ifdef WITH_SELINUX
 -		if (set_selinux_file_context (prefix_user_home) != 0) {
 +		if (set_selinux_file_context (prefix_user_home, NULL) != 0) {
 			fprintf (stderr,
 			         _("%s: cannot set SELinux context for home directory %s\n"),
 			         Prog, user_home);
@@ -2232,6 +2232,7 @@ static void create_mail (void)
  */
 int main (int argc, char **argv)
 {
 +	int rv = E_SUCCESS;
 #ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 	pam_handle_t *pamh = NULL;
@@ -2454,27 +2455,12 @@ int main (int argc, char **argv)
 	usr_update ();
 -	if (mflg) {
 -		create_home ();
 -		if (home_added) {
 -			copy_tree (def_template, prefix_user_home, false, false,
 -			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
 -		} else {
 -			fprintf (stderr,
 -			         _("%s: warning: the home directory %s already exists.\n"
 -			           "%s: Not copying any file from skel directory into it.\n"),
 -			         Prog, user_home, Prog);
 -		}
 -
 -	}
 -
 -	/* Do not create mail directory for system accounts */
 -	if (!rflg) {
 -		create_mail ();
 -	}
 -
 	close_files ();
 +	nscd_flush_cache ("passwd");
 +	nscd_flush_cache ("group");
 +	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
 +
 	/*
 	 * tallylog_reset needs to be able to lookup
 	 * a valid existing user name,
@@ -2485,8 +2471,9 @@ int main (int argc, char **argv)
 	}
 #ifdef WITH_SELINUX
 -	if (Zflg) {
 -		if (set_seuser (user_name, user_selinux) != 0) {
 +	if (Zflg && *user_selinux) {
 +		if (is_selinux_enabled () > 0) {
 +		    if (set_seuser (user_name, user_selinux) != 0) {
 			fprintf (stderr,
 			         _("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
 			         Prog, user_name, user_selinux);
@@ -2495,15 +2482,31 @@ int main (int argc, char **argv)
 			              "adding SELinux user mapping",
 			              user_name, (unsigned int) user_id, 0);
 #endif				/* WITH_AUDIT */
 -			fail_exit (E_SE_UPDATE);
 +			rv = E_SE_UPDATE;
 +		    }
 		}
 	}
 #endif				/* WITH_SELINUX */
 -	nscd_flush_cache ("passwd");
 -	nscd_flush_cache ("group");
 -	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
 +	if (mflg) {
 +		create_home ();
 +		if (home_added) {
 +			copy_tree (def_template, prefix_user_home, false, true,
 +			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
 +		} else {
 +			fprintf (stderr,
 +			         _("%s: warning: the home directory %s already exists.\n"
 +			           "%s: Not copying any file from skel directory into it.\n"),
 +			         Prog, user_home, Prog);
 +		}
 +
 +	}
 +
 +	/* Do not create mail directory for system accounts */
 +	if (!rflg) {
 +		create_mail ();
 +	}
 -	return E_SUCCESS;
 +	return rv;
 }
--- a/shadow-4.8-useradd-selinux-mail.patch
+++ b/shadow-4.8-useradd-selinux-mail.patch
@ -0,0 +1,61 @@
 From 4dc62ebcf37d7568be1d4ca54367215eba8b8a28 Mon Sep 17 00:00:00 2001
 From: ikerexxe <ipedrosa@redhat.com>
 Date: Wed, 5 Feb 2020 15:04:39 +0100
 Subject: [PATCH] useradd: doesn't generate /var/spool/mail/$USER with the
 proper SELinux user identity
 Explanation: use set_selinux_file_context() and reset_selinux_file_context() for create_mail() just as is done for create_home()
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1690527
 ---
 src/useradd.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 diff --git a/src/useradd.c b/src/useradd.c
 index a679392d..645d4a40 100644
 --- a/src/useradd.c
 +++ b/src/useradd.c
@@ -190,6 +190,7 @@ static bool home_added = false;
 #define E_NAME_IN_USE	9	/* username already in use */
 #define E_GRP_UPDATE	10	/* can't update group file */
 #define E_HOMEDIR	12	/* can't create home directory */
 +#define E_MAILBOXFILE	13	/* can't create mailbox file */
 #define E_SE_UPDATE	14	/* can't update SELinux user mapping */
 #ifdef ENABLE_SUBIDS
 #define E_SUB_UID_UPDATE 16	/* can't update the subordinate uid file */
@@ -2210,6 +2211,16 @@ static void create_mail (void)
 			sprintf (file, "%s/%s/%s", prefix, spool, user_name);
 		else
 			sprintf (file, "%s/%s", spool, user_name);
 +
 +#ifdef WITH_SELINUX
 +		if (set_selinux_file_context (file, NULL) != 0) {
 +			fprintf (stderr,
 +			         _("%s: cannot set SELinux context for mailbox file %s\n"),
 +			         Prog, file);
 +			fail_exit (E_MAILBOXFILE);
 +		}
 +#endif
 +
 		fd = open (file, O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0);
 		if (fd < 0) {
 			perror (_("Creating mailbox file"));
@@ -2234,6 +2245,15 @@ static void create_mail (void)
 		fsync (fd);
 		close (fd);
 +#ifdef WITH_SELINUX
 +		/* Reset SELinux to create files with default contexts */
 +		if (reset_selinux_file_context () != 0) {
 +			fprintf (stderr,
 +			         _("%s: cannot reset SELinux file creation context\n"),
 +			         Prog);
 +			fail_exit (E_MAILBOXFILE);
 +		}
 +#endif
 	}
 }
 -- 
 2.24.1
--- a/shadow-4.8.1-audit-update.patch
+++ b/shadow-4.8.1-audit-update.patch
--- a/shadow-4.8.1-check-local-groups.patch
+++ b/shadow-4.8.1-check-local-groups.patch
@ -0,0 +1,331 @@
 From 8762f465d487a52bf68f9c0b7c3c1eb3caea7bc9 Mon Sep 17 00:00:00 2001
 From: ikerexxe <ipedrosa@redhat.com>
 Date: Mon, 30 Mar 2020 09:08:23 +0200
 Subject: [PATCH 2/2] useradd: check only local groups with -G option
 Check only local groups when adding new supplementary groups to a user
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1727236
 ---
 src/useradd.c | 234 +++++++++++++++++++++++++++++++++-----------------
 1 file changed, 157 insertions(+), 77 deletions(-)
 diff --git a/src/useradd.c b/src/useradd.c
 index 645d4a40..90210233 100644
 --- a/src/useradd.c
 +++ b/src/useradd.c
@@ -211,6 +211,7 @@ static void get_defaults (void);
 static void show_defaults (void);
 static int set_defaults (void);
 static int get_groups (char *);
 +static struct group * get_local_group (char * grp_name);
 static void usage (int status);
 static void new_pwent (struct passwd *);
@@ -220,7 +221,10 @@ static void grp_update (void);
 static void process_flags (int argc, char **argv);
 static void close_files (void);
 +static void close_group_files (void);
 +static void unlock_group_files (void);
 static void open_files (void);
 +static void open_group_files (void);
 static void open_shadow (void);
 static void faillog_reset (uid_t);
 static void lastlog_reset (uid_t);
@@ -731,6 +735,11 @@ static int get_groups (char *list)
 		return 0;
 	}
 +	/*
 +	 * Open the group files
 +	 */
 +	open_group_files ();
 +
 	/*
 	 * So long as there is some data to be converted, strip off
 	 * each name and look it up. A mix of numerical and string
@@ -749,7 +758,7 @@ static int get_groups (char *list)
 		 * Names starting with digits are treated as numerical
 		 * GID values, otherwise the string is looked up as is.
 		 */
 -		grp = prefix_getgr_nam_gid (list);
 +		grp = get_local_group (list);
 		/*
 		 * There must be a match, either by GID value or by
@@ -799,6 +808,9 @@ static int get_groups (char *list)
 		user_groups[ngroups++] = xstrdup (grp->gr_name);
 	} while (NULL != list);
 +	close_group_files ();
 +	unlock_group_files ();
 +
 	user_groups[ngroups] = (char *) 0;
 	/*
@@ -811,6 +823,44 @@ static int get_groups (char *list)
 	return 0;
 }
 +/*
 + * get_local_group - checks if a given group name exists locally
 + *
 + *	get_local_group() checks if a given group name exists locally.
 + *	If the name exists the group information is returned, otherwise NULL is
 + *	returned.
 + */
 +static struct group * get_local_group(char * grp_name)
 +{
 +	const struct group *grp;
 +	struct group *result_grp = NULL;
 +	long long int gid;
 +	char *endptr;
 +
 +	gid = strtoll (grp_name, &endptr, 10);
 +	if (   ('\0' != *grp_name)
 +		&& ('\0' == *endptr)
 +		&& (ERANGE != errno)
 +		&& (gid == (gid_t)gid)) {
 +		grp = gr_locate_gid ((gid_t) gid);
 +	}
 +	else {
 +		grp = gr_locate(grp_name);
 +	}
 +
 +	if (grp != NULL) {
 +		result_grp = __gr_dup (grp);
 +		if (NULL == result_grp) {
 +			fprintf (stderr,
 +					_("%s: Out of memory. Cannot find group '%s'.\n"),
 +					Prog, grp_name);
 +			fail_exit (E_GRP_UPDATE);
 +		}
 +	}
 +
 +	return result_grp;
 +}
 +
 /*
  * usage - display usage message and exit
  */
@@ -1530,23 +1580,9 @@ static void close_files (void)
 		SYSLOG ((LOG_ERR, "failure while writing changes to %s", spw_dbname ()));
 		fail_exit (E_PW_UPDATE);
 	}
 -	if (do_grp_update) {
 -		if (gr_close () == 0) {
 -			fprintf (stderr,
 -			         _("%s: failure while writing changes to %s\n"), Prog, gr_dbname ());
 -			SYSLOG ((LOG_ERR, "failure while writing changes to %s", gr_dbname ()));
 -			fail_exit (E_GRP_UPDATE);
 -		}
 -#ifdef	SHADOWGRP
 -		if (is_shadow_grp && (sgr_close () == 0)) {
 -			fprintf (stderr,
 -			         _("%s: failure while writing changes to %s\n"),
 -			         Prog, sgr_dbname ());
 -			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sgr_dbname ()));
 -			fail_exit (E_GRP_UPDATE);
 -		}
 -#endif
 -	}
 +
 +	close_group_files ();
 +
 #ifdef ENABLE_SUBIDS
 	if (is_sub_uid  && (sub_uid_close () == 0)) {
 		fprintf (stderr,
@@ -1587,34 +1623,9 @@ static void close_files (void)
 		/* continue */
 	}
 	pw_locked = false;
 -	if (gr_unlock () == 0) {
 -		fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, gr_dbname ());
 -		SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
 -#ifdef WITH_AUDIT
 -		audit_logger (AUDIT_ADD_USER, Prog,
 -		              "unlocking-group-file",
 -		              user_name, AUDIT_NO_ID,
 -		              SHADOW_AUDIT_FAILURE);
 -#endif
 -		/* continue */
 -	}
 -	gr_locked = false;
 -#ifdef	SHADOWGRP
 -	if (is_shadow_grp) {
 -		if (sgr_unlock () == 0) {
 -			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sgr_dbname ());
 -			SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
 -#ifdef WITH_AUDIT
 -			audit_logger (AUDIT_ADD_USER, Prog,
 -			              "unlocking-gshadow-file",
 -			              user_name, AUDIT_NO_ID,
 -			              SHADOW_AUDIT_FAILURE);
 -#endif
 -			/* continue */
 -		}
 -		sgr_locked = false;
 -	}
 -#endif
 +
 +	unlock_group_files ();
 +
 #ifdef ENABLE_SUBIDS
 	if (is_sub_uid) {
 		if (sub_uid_unlock () == 0) {
@@ -1647,6 +1658,71 @@ static void close_files (void)
 #endif				/* ENABLE_SUBIDS */
 }
 +/*
 + * close_group_files - close all of the files that were opened
 + *
 + *	close_group_files() closes all of the files that were opened related
 + *  with groups. This causes any modified entries to be written out.
 + */
 +static void close_group_files (void)
 +{
 +	if (do_grp_update) {
 +		if (gr_close () == 0) {
 +			fprintf (stderr,
 +			         _("%s: failure while writing changes to %s\n"), Prog, gr_dbname ());
 +			SYSLOG ((LOG_ERR, "failure while writing changes to %s", gr_dbname ()));
 +			fail_exit (E_GRP_UPDATE);
 +		}
 +#ifdef	SHADOWGRP
 +		if (is_shadow_grp && (sgr_close () == 0)) {
 +			fprintf (stderr,
 +			         _("%s: failure while writing changes to %s\n"),
 +			         Prog, sgr_dbname ());
 +			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sgr_dbname ()));
 +			fail_exit (E_GRP_UPDATE);
 +		}
 +#endif /* SHADOWGRP */
 +	}
 +}
 +
 +/*
 + * unlock_group_files - unlock all of the files that were locked
 + *
 + *	unlock_group_files() unlocks all of the files that were locked related
 + *  with groups. This causes any modified entries to be written out.
 + */
 +static void unlock_group_files (void)
 +{
 +	if (gr_unlock () == 0) {
 +		fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, gr_dbname ());
 +		SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
 +#ifdef WITH_AUDIT
 +		audit_logger (AUDIT_ADD_USER, Prog,
 +		              "unlocking-group-file",
 +		              user_name, AUDIT_NO_ID,
 +		              SHADOW_AUDIT_FAILURE);
 +#endif /* WITH_AUDIT */
 +		/* continue */
 +	}
 +	gr_locked = false;
 +#ifdef	SHADOWGRP
 +	if (is_shadow_grp) {
 +		if (sgr_unlock () == 0) {
 +			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sgr_dbname ());
 +			SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
 +#ifdef WITH_AUDIT
 +			audit_logger (AUDIT_ADD_USER, Prog,
 +			              "unlocking-gshadow-file",
 +			              user_name, AUDIT_NO_ID,
 +			              SHADOW_AUDIT_FAILURE);
 +#endif /* WITH_AUDIT */
 +			/* continue */
 +		}
 +		sgr_locked = false;
 +	}
 +#endif /* SHADOWGRP */
 +}
 +
 /*
  * open_files - lock and open the password files
  *
@@ -1668,37 +1744,8 @@ static void open_files (void)
 	/* shadow file will be opened by open_shadow(); */
 -	/*
 -	 * Lock and open the group file.
 -	 */
 -	if (gr_lock () == 0) {
 -		fprintf (stderr,
 -		         _("%s: cannot lock %s; try again later.\n"),
 -		         Prog, gr_dbname ());
 -		fail_exit (E_GRP_UPDATE);
 -	}
 -	gr_locked = true;
 -	if (gr_open (O_CREAT | O_RDWR) == 0) {
 -		fprintf (stderr, _("%s: cannot open %s\n"), Prog, gr_dbname ());
 -		fail_exit (E_GRP_UPDATE);
 -	}
 -#ifdef  SHADOWGRP
 -	if (is_shadow_grp) {
 -		if (sgr_lock () == 0) {
 -			fprintf (stderr,
 -			         _("%s: cannot lock %s; try again later.\n"),
 -			         Prog, sgr_dbname ());
 -			fail_exit (E_GRP_UPDATE);
 -		}
 -		sgr_locked = true;
 -		if (sgr_open (O_CREAT | O_RDWR) == 0) {
 -			fprintf (stderr,
 -			         _("%s: cannot open %s\n"),
 -			         Prog, sgr_dbname ());
 -			fail_exit (E_GRP_UPDATE);
 -		}
 -	}
 -#endif
 +	open_group_files ();
 +
 #ifdef ENABLE_SUBIDS
 	if (is_sub_uid) {
 		if (sub_uid_lock () == 0) {
@@ -1733,6 +1780,39 @@ static void open_files (void)
 #endif				/* ENABLE_SUBIDS */
 }
 +static void open_group_files (void)
 +{
 +	if (gr_lock () == 0) {
 +		fprintf (stderr,
 +		         _("%s: cannot lock %s; try again later.\n"),
 +		         Prog, gr_dbname ());
 +		fail_exit (E_GRP_UPDATE);
 +	}
 +	gr_locked = true;
 +	if (gr_open (O_CREAT | O_RDWR) == 0) {
 +		fprintf (stderr, _("%s: cannot open %s\n"), Prog, gr_dbname ());
 +		fail_exit (E_GRP_UPDATE);
 +	}
 +
 +#ifdef  SHADOWGRP
 +	if (is_shadow_grp) {
 +		if (sgr_lock () == 0) {
 +			fprintf (stderr,
 +			         _("%s: cannot lock %s; try again later.\n"),
 +			         Prog, sgr_dbname ());
 +			fail_exit (E_GRP_UPDATE);
 +		}
 +		sgr_locked = true;
 +		if (sgr_open (O_CREAT | O_RDWR) == 0) {
 +			fprintf (stderr,
 +			         _("%s: cannot open %s\n"),
 +			         Prog, sgr_dbname ());
 +			fail_exit (E_GRP_UPDATE);
 +		}
 +	}
 +#endif /* SHADOWGRP */
 +}
 +
 static void open_shadow (void)
 {
 	if (!is_shadow_pwd) {
 -- 
 2.25.4
--- a/shadow-4.8.1-commonio-force-lock-file-sync.patch
+++ b/shadow-4.8.1-commonio-force-lock-file-sync.patch
@ -0,0 +1,39 @@
 From fb0f702cbf958a5ee9097c1611212c9880b347ce Mon Sep 17 00:00:00 2001
 From: ikerexxe <ipedrosa@redhat.com>
 Date: Mon, 2 Nov 2020 17:08:55 +0100
 Subject: [PATCH] commonio: force lock file sync
 lib/commonio.c: after writing to the lock file, force a file sync to
 the storage system.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1862056
 ---
 lib/commonio.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)
 diff --git a/lib/commonio.c b/lib/commonio.c
 index 16fa7e75..c5b3d104 100644
 --- a/lib/commonio.c
 +++ b/lib/commonio.c
@@ -157,7 +157,17 @@ static int do_lock_file (const char *file, const char *lock, bool log)
 	if (write (fd, buf, (size_t) len) != len) {
 		if (log) {
 			(void) fprintf (stderr,
 -			                "%s: %s: %s\n",
 +			                "%s: %s file write error: %s\n",
 +			                Prog, file, strerror (errno));
 +		}
 +		(void) close (fd);
 +		unlink (file);
 +		return 0;
 +	}
 +	if (fdatasync (fd) == -1) {
 +		if (log) {
 +			(void) fprintf (stderr,
 +			                "%s: %s file sync error: %s\n",
 			                Prog, file, strerror (errno));
 		}
 		(void) close (fd);
 -- 
 2.26.2
--- a/shadow-4.8.1-man-include-lastlog-file-caveat.patch
+++ b/shadow-4.8.1-man-include-lastlog-file-caveat.patch
@ -0,0 +1,33 @@
 From df6ec1d1693c8c80c323b40d6fc82bb549363db3 Mon Sep 17 00:00:00 2001
 From: Iker Pedrosa <ipedrosa@redhat.com>
 Date: Mon, 29 Mar 2021 05:26:28 +0200
 Subject: [PATCH] man: include lastlog file caveat (#313)
 man/lastlog.8.xml: add another point to the caveats section regarding
 the handling of the lastlog file by external tools.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=951564
 ---
 man/lastlog.8.xml | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/man/lastlog.8.xml b/man/lastlog.8.xml
 index fc096c8f..7e68282f 100644
 --- a/man/lastlog.8.xml
 +++ b/man/lastlog.8.xml
@@ -233,5 +233,12 @@
       is no entries for users with UID between 170 and 800 lastlog will appear
       to hang as it processes entries with UIDs 171-799).
     </para>
 +    <para>
 +      Having high UIDs can create problems when handling the <term><filename>
 +      /var/log/lastlog</filename></term> with external tools. Although the
 +      actual file is sparse and does not use too much space, certain
 +      applications are not designed to identify sparse files by default and may
 +      require a specific option to handle them.
 +    </para>
   </refsect1>
 </refentry>
 -- 
 2.30.2
--- a/shadow-4.8.1-manfix.patch
+++ b/shadow-4.8.1-manfix.patch
@ -0,0 +1,341 @@
 diff -up shadow-4.8.1/man/chage.1.xml.manfix shadow-4.8.1/man/chage.1.xml
 --- shadow-4.8.1/man/chage.1.xml.manfix	2019-10-05 01:28:34.000000000 +0200
 +++ shadow-4.8.1/man/chage.1.xml	2020-03-17 15:34:48.750414984 +0100
@@ -102,6 +102,9 @@
 	    Set the number of days since January 1st, 1970 when the password
 	    was last changed. The date may also be expressed in the format
 	    YYYY-MM-DD (or the format more commonly used in your area).
 +	    If the <replaceable>LAST_DAY</replaceable> is set to
 +	    <emphasis>0</emphasis> the user is forced to change his password
 +	    on the next log on.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -119,6 +122,13 @@
 	    system again.
 	  </para>
 	  <para>
 +	    For example the following can be used to set an account to expire
 +	    in 180 days:
 +	  </para>
 +	  <programlisting>
 +	    chage -E $(date -d +180days +%Y-%m-%d)
 +	  </programlisting>
 +	  <para>
 	    Passing the number <emphasis remap='I'>-1</emphasis> as the
 	    <replaceable>EXPIRE_DATE</replaceable> will remove an account
 	    expiration date.
@@ -239,6 +249,18 @@
       The <command>chage</command> program requires a shadow password file to
       be available.
     </para>
 +    <para>
 +      The chage program will report only the information from the shadow
 +      password file. This implies that configuration from other sources
 +     (e.g. LDAP or empty password hash field from the passwd file) that
 +     affect the user's login will not be shown in the chage output.
 +    </para>
 +    <para>
 +      The <command>chage</command> program will also not report any
 +      inconsistency between the shadow and passwd files (e.g. missing x in
 +      the passwd file). The <command>pwck</command> can be used to check
 +      for this kind of inconsistencies.
 +    </para>
     <para>The <command>chage</command> command is restricted to the root
       user, except for the <option>-l</option> option, which may be used by
       an unprivileged user to determine when their password or account is due
 diff -up shadow-4.8.1/man/groupadd.8.xml.manfix shadow-4.8.1/man/groupadd.8.xml
 --- shadow-4.8.1/man/groupadd.8.xml.manfix	2020-03-17 15:34:48.745414917 +0100
 +++ shadow-4.8.1/man/groupadd.8.xml	2020-03-17 15:34:48.750414984 +0100
@@ -320,13 +320,13 @@
 	<varlistentry>
 	  <term><replaceable>4</replaceable></term>
 	  <listitem>
 -	    <para>GID not unique (when <option>-o</option> not used)</para>
 +	    <para>GID is already used (when called without <option>-o</option>)</para>
 	  </listitem>
 	</varlistentry>
 	<varlistentry>
 	  <term><replaceable>9</replaceable></term>
 	  <listitem>
 -	    <para>group name not unique</para>
 +	    <para>group name is already used</para>
 	  </listitem>
 	</varlistentry>
 	<varlistentry>
 diff -up shadow-4.8.1/man/groupmems.8.xml.manfix shadow-4.8.1/man/groupmems.8.xml
 --- shadow-4.8.1/man/groupmems.8.xml.manfix	2020-03-17 15:34:48.750414984 +0100
 +++ shadow-4.8.1/man/groupmems.8.xml	2020-03-17 15:41:13.383588722 +0100
@@ -179,20 +179,10 @@
   <refsect1 id='setup'>
     <title>SETUP</title>
     <para>
 -      The <command>groupmems</command> executable should be in mode
 -      <literal>2710</literal> as user <emphasis>root</emphasis> and in group
 -      <emphasis>groups</emphasis>. The system administrator can add users to
 -      group <emphasis>groups</emphasis> to allow or disallow them using the
 -      <command>groupmems</command> utility to manage their own group
 -      membership list.
 +      In this operating system the <command>groupmems</command> executable
 +      is not setuid and regular users cannot use it to manipulate
 +      the membership of their own group.
     </para>
 -
 -    <programlisting>
 -	$ groupadd -r groups
 -	$ chmod 2710 groupmems
 -	$ chown root.groups groupmems
 -	$ groupmems -g groups -a gk4
 -    </programlisting>
   </refsect1>
   <refsect1 id='configuration'>
 diff -up shadow-4.8.1/man/ja/man5/login.defs.5.manfix shadow-4.8.1/man/ja/man5/login.defs.5
 --- shadow-4.8.1/man/ja/man5/login.defs.5.manfix	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8.1/man/ja/man5/login.defs.5	2020-03-17 15:34:48.750414984 +0100
@@ -147,10 +147,6 @@ 以下の参照表は、
 shadow パスワード機能のどのプログラムが
 どのパラメータを使用するかを示したものである。
 .na
 -.IP chfn 12
 -CHFN_AUTH CHFN_RESTRICT
 -.IP chsh 12
 -CHFN_AUTH
 .IP groupadd 12
 GID_MAX GID_MIN
 .IP newusers 12
 diff -up shadow-4.8.1/man/login.defs.5.xml.manfix shadow-4.8.1/man/login.defs.5.xml
 --- shadow-4.8.1/man/login.defs.5.xml.manfix	2020-01-17 16:47:56.000000000 +0100
 +++ shadow-4.8.1/man/login.defs.5.xml	2020-03-17 15:34:48.750414984 +0100
@@ -164,6 +164,17 @@
       long numeric parameters is machine-dependent.
     </para>
 +    <para>
 +      Please note that the parameters in this configuration file control the
 +      behavior of the tools from the shadow-utils component. None of these
 +      tools uses the PAM mechanism, and the utilities that use PAM (such as the
 +      passwd command) should be configured elsewhere. The only values that
 +      affect PAM modules are <emphasis>ENCRYPT_METHOD</emphasis> and <emphasis>SHA_CRYPT_MAX_ROUNDS</emphasis>
 +      for pam_unix module, <emphasis>FAIL_DELAY</emphasis> for pam_faildelay module,
 +      and <emphasis>UMASK</emphasis> for pam_umask module. Refer to
 +      pam(8) for more information.
 +    </para>
 +
     <para>The following configuration items are provided:</para>
     <variablelist remap='IP'>
@@ -256,16 +267,6 @@
 	</listitem>
       </varlistentry>
       <varlistentry>
 -	<term>chfn</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CHFN_AUTH</phrase>
 -	    CHFN_RESTRICT
 -	    <phrase condition="no_pam">LOGIN_STRING</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
 -      <varlistentry>
 	<term>chgpasswd</term>
 	<listitem>
 	  <para>
@@ -286,14 +287,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
 -      <varlistentry condition="no_pam">
 -	<term>chsh</term>
 -	<listitem>
 -	  <para>
 -	    CHSH_AUTH LOGIN_STRING
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <!-- expiry: no variables (CONSOLE_GROUPS linked, but not used) -->
       <!-- faillog: no variables -->
       <varlistentry>
@@ -359,34 +352,6 @@
 	  <para>LASTLOG_UID_MAX</para>
 	</listitem>
       </varlistentry>
 -      <varlistentry>
 -	<term>login</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CONSOLE</phrase>
 -	    CONSOLE_GROUPS DEFAULT_HOME
 -	    <phrase condition="no_pam">ENV_HZ ENV_PATH ENV_SUPATH
 -	    ENV_TZ ENVIRON_FILE</phrase>
 -	    ERASECHAR FAIL_DELAY
 -	    <phrase condition="no_pam">FAILLOG_ENAB</phrase>
 -	    FAKE_SHELL
 -	    <phrase condition="no_pam">FTMP_FILE</phrase>
 -	    HUSHLOGIN_FILE
 -	    <phrase condition="no_pam">ISSUE_FILE</phrase>
 -	    KILLCHAR
 -	    <phrase condition="no_pam">LASTLOG_ENAB LASTLOG_UID_MAX</phrase>
 -	    LOGIN_RETRIES
 -	    <phrase condition="no_pam">LOGIN_STRING</phrase>
 -	    LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB
 -	    <phrase condition="no_pam">MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE
 -	    MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB
 -	    QUOTAS_ENAB</phrase>
 -	    TTYGROUP TTYPERM TTYTYPE_FILE
 -	    <phrase condition="no_pam">ULIMIT UMASK</phrase>
 -	    USERGROUPS_ENAB
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <!-- logoutd: no variables -->
       <varlistentry>
 	<term>newgrp / sg</term>
@@ -415,17 +380,6 @@
 	</listitem>
       </varlistentry>
       <!-- nologin: no variables -->
 -      <varlistentry condition="no_pam">
 -	<term>passwd</term>
 -	<listitem>
 -	  <para>
 -	    ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB
 -	    PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN
 -	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
 -	    SHA_CRYPT_MIN_ROUNDS</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <varlistentry>
 	<term>pwck</term>
 	<listitem>
@@ -452,32 +406,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
 -      <varlistentry>
 -	<term>su</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CONSOLE</phrase>
 -	    CONSOLE_GROUPS DEFAULT_HOME
 -	    <phrase condition="no_pam">ENV_HZ ENVIRON_FILE</phrase>
 -	    ENV_PATH ENV_SUPATH
 -	    <phrase condition="no_pam">ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB
 -	    MAIL_DIR MAIL_FILE QUOTAS_ENAB</phrase>
 -	    SULOG_FILE SU_NAME
 -	    <phrase condition="no_pam">SU_WHEEL_ONLY</phrase>
 -	    SYSLOG_SU_ENAB
 -	    <phrase condition="no_pam">USERGROUPS_ENAB</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
 -      <varlistentry>
 -	<term>sulogin</term>
 -	<listitem>
 -	  <para>
 -	    ENV_HZ
 -	    <phrase condition="no_pam">ENV_TZ</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <varlistentry>
 	<term>useradd</term>
 	<listitem>
 diff -up shadow-4.8.1/man/shadow.5.xml.manfix shadow-4.8.1/man/shadow.5.xml
 --- shadow-4.8.1/man/shadow.5.xml.manfix	2019-12-01 17:52:32.000000000 +0100
 +++ shadow-4.8.1/man/shadow.5.xml	2020-03-17 15:34:48.750414984 +0100
@@ -129,7 +129,7 @@
 	<listitem>
 	  <para>
 	    The date of the last password change, expressed as the number
 -	    of days since Jan 1, 1970.
 +	    of days since Jan 1, 1970 00:00 UTC.
 	  </para>
 	  <para>
 	    The value 0 has a special meaning, which is that the user
@@ -208,8 +208,8 @@
 	  </para>
 	  <para>
 	    After expiration of the password and this expiration period is
 -	    elapsed, no login is possible using the current user's
 -	    password.  The user should contact her administrator.
 +	    elapsed, no login is possible for the user.
 +	    The user should contact her administrator.
 	  </para>
 	  <para>
 	    An empty field means that there are no enforcement of an
@@ -224,7 +224,7 @@
 	<listitem>
 	  <para>
 	    The date of expiration of the account, expressed as the number
 -	    of days since Jan 1, 1970.
 +	    of days since Jan 1, 1970 00:00 UTC.
 	  </para>
 	  <para>
 	    Note that an account expiration differs from a password
 diff -up shadow-4.8.1/man/useradd.8.xml.manfix shadow-4.8.1/man/useradd.8.xml
 --- shadow-4.8.1/man/useradd.8.xml.manfix	2020-03-17 15:34:48.745414917 +0100
 +++ shadow-4.8.1/man/useradd.8.xml	2020-03-17 15:34:48.751414997 +0100
@@ -359,6 +359,11 @@
 	    <option>CREATE_HOME</option> is not enabled, no home
 	    directories are created.
 	  </para>
 +	  <para>
 +	    The directory where the user's home directory is created must
 +	    exist and have proper SELinux context and permissions. Otherwise
 +	    the user's home directory cannot be created or accessed.
 +	  </para>
 	</listitem>
       </varlistentry>
       <varlistentry>
 diff -up shadow-4.8.1/man/usermod.8.xml.manfix shadow-4.8.1/man/usermod.8.xml
 --- shadow-4.8.1/man/usermod.8.xml.manfix	2019-12-20 06:58:23.000000000 +0100
 +++ shadow-4.8.1/man/usermod.8.xml	2020-03-17 15:34:48.751414997 +0100
@@ -143,7 +143,8 @@
 	    If the <option>-m</option>
 	    option is given, the contents of the current home directory will
 	    be moved to the new home directory, which is created if it does
 -	    not already exist.
 +	    not already exist. If the current home directory does not exist
 +	    the new home directory will not be created.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -205,6 +206,12 @@
 	    The group ownership of files outside of the user's home directory
 	    must be fixed manually.
 	  </para>
 +	  <para>
 +	    The change of the group ownership of files inside of the user's
 +	    home directory is also not done if the home dir owner uid is
 +	    different from the current or new user id. This is safety measure
 +	    for special home directories such as <filename>/</filename>.
 +	  </para>
 	</listitem>
       </varlistentry>
       <varlistentry>
@@ -267,7 +274,8 @@
 	<listitem>
 	  <para>
 	    Move the content of the user's home directory to the new
 -	    location.
 +	    location. If the current home directory does not exist
 +	    the new home directory will not be created.
 	  </para>
 	  <para>
 	    This option is only valid in combination with the
@@ -381,6 +389,12 @@
 	    must be fixed manually.
 	  </para>
 	  <para>
 +	    The change of the user ownership of files inside of the user's
 +	    home directory is also not done if the home dir owner uid is
 +	    different from the current or new user id. This is safety measure
 +	    for special home directories such as <filename>/</filename>.
 +	  </para>
 +	  <para>
 	    No checks will be performed with regard to the
 	    <option>UID_MIN</option>, <option>UID_MAX</option>,
 	    <option>SYS_UID_MIN</option>, or <option>SYS_UID_MAX</option>
--- a/shadow-4.8.1-useradd-man-clarification.patch
+++ b/shadow-4.8.1-useradd-man-clarification.patch
@ -0,0 +1,35 @@
 From 6543c600d841e4f7779269412d470e50eae25b13 Mon Sep 17 00:00:00 2001
 From: ikerexxe <ipedrosa@redhat.com>
 Date: Wed, 4 Mar 2020 14:50:04 +0100
 Subject: [PATCH] useradd: clarify the useradd -d parameter behavior in man
 page
 Explanation: clarify the useradd -d parameter as it does create directory HOME_DIR if it doesn't exit.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1677005
 Changelog: [serge] minor tweak to the text
 ---
 man/useradd.8.xml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
 diff --git a/man/useradd.8.xml b/man/useradd.8.xml
 index 03612ce8..023c0d69 100644
 --- a/man/useradd.8.xml
 +++ b/man/useradd.8.xml
@@ -181,8 +181,10 @@
 	    login directory. The default is to append the
 	    <replaceable>LOGIN</replaceable> name to
 	    <replaceable>BASE_DIR</replaceable> and use that as the login
 -	    directory name. The directory <replaceable>HOME_DIR</replaceable>
 -	    does not have to exist but will not be created if it is missing.
 +	    directory name.  If the directory
 +	    <replaceable>HOME_DIR</replaceable> does not exist, then it
 +	    will be created unless the <option>-M</option> option is
 +	    specified.
 	  </para>
 	</listitem>
       </varlistentry>
 -- 
 2.25.1
--- a/shadow-4.9-groupdel-fix-sigsegv-when-passwd-does-not-exist.patch
+++ b/shadow-4.9-groupdel-fix-sigsegv-when-passwd-does-not-exist.patch
@ -0,0 +1,13 @@
 diff -up shadow-4.9/libmisc/prefix_flag.c.groupdel-fix-sigsegv-when-passwd-does-not-exist shadow-4.9/libmisc/prefix_flag.c
 --- shadow-4.9/libmisc/prefix_flag.c.groupdel-fix-sigsegv-when-passwd-does-not-exist	2021-11-19 09:21:36.997091941 +0100
 +++ shadow-4.9/libmisc/prefix_flag.c	2021-11-19 09:22:19.001341010 +0100
@@ -288,6 +288,9 @@ extern struct passwd* prefix_getpwent()
 	if(!passwd_db_file) {
 		return getpwent();
 	}
 +	if (!fp_pwent) {
 +		return NULL;
 +	}
 	return fgetpwent(fp_pwent);
 }
 extern void prefix_endpwent()
--- a/shadow-utils.login.defs
+++ b/shadow-utils.login.defs
@ -130,9 +130,10 @@ HOME_MODE	0700
 #
 PASS_MAX_DAYS	99999
 PASS_MIN_DAYS	0
 PASS_MIN_LEN	8
 PASS_WARN_AGE	7
 # Currently PASS_MIN_LEN is not supported
 # Currently SU_WHEEL_ONLY is not supported
 # Currently CRACKLIB_DICTPATH is not supported
@ -146,7 +147,7 @@ UID_MAX                 60000
 SYS_UID_MIN               201
 SYS_UID_MAX               999
 # Extra per user uids
-SUB_UID_MIN		   524288
+SUB_UID_MIN		   100000
 SUB_UID_MAX		600100000
 SUB_UID_COUNT		    65536
@ -159,7 +160,7 @@ GID_MAX                 60000
 SYS_GID_MIN               201
 SYS_GID_MAX               999
 # Extra per user group ids
-SUB_GID_MIN		   524288
+SUB_GID_MIN		   100000
 SUB_GID_MAX		600100000
 SUB_GID_COUNT		    65536
@ -173,22 +174,11 @@ SUB_GID_COUNT		    65536
 #
 #LOGIN_TIMEOUT		60
-#
+# Currently PASS_CHANGE_TRIES is not supported
 # Maximum number of attempts to change password if rejected (too easy)
 #
 PASS_CHANGE_TRIES	5
-#
+# Currently PASS_ALWAYS_WARN is not supported
 # Warn about weak passwords (but still allow them) if you are root.
 #
 PASS_ALWAYS_WARN	yes
-#
+# Currently PASS_MAX_LEN is not supported
 # Number of significant characters in the password for crypt().
 # Default is 8, don't change unless your crypt() is better.
 # Ignored if MD5_CRYPT_ENAB set to "yes".
 #
 #PASS_MAX_LEN		8
 # Currently CHFN_AUTH is not supported
@ -208,11 +198,10 @@ PASS_ALWAYS_WARN	yes
 # If set to MD5, MD5-based algorithm will be used for encrypting password
 # If set to SHA256, SHA256-based algorithm will be used for encrypting password
 # If set to SHA512, SHA512-based algorithm will be used for encrypting password
-# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
+# If set to BLOWFISH, BLOWFISH-based algorithm will be used for encrypting password
 # If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
 # If set to DES, DES-based algorithm will be used for encrypting password (default)
 #
-ENCRYPT_METHOD YESCRYPT
+ENCRYPT_METHOD SHA512
 #
 # Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
@ -229,33 +218,7 @@ ENCRYPT_METHOD YESCRYPT
 # Currently SHA_CRYPT_MIN_ROUNDS is not supported
-#
+# Currently BCRYPT_MIN_ROUNDS and BCRYPT_MAX_ROUNDS are not supported
 # Only works if ENCRYPT_METHOD is set to BCRYPT.
 #
 # Define the number of BCRYPT rounds.
 # With a lot of rounds, it is more difficult to brute-force the password.
 # However, more CPU resources will be needed to authenticate users if
 # this value is increased.
 #
 # If not specified, 13 rounds will be attempted.
 # If only one of the MIN or MAX values is set, then this value will be used.
 # If MIN > MAX, the highest value will be used.
 #
 #BCRYPT_MIN_ROUNDS 13
 #BCRYPT_MAX_ROUNDS 31
 #
 # Only works if ENCRYPT_METHOD is set to YESCRYPT.
 #
 # Define the YESCRYPT cost factor.
 # With a higher cost factor, it is more difficult to brute-force the password.
 # However, more CPU time and more memory will be needed to authenticate users
 # if this value is increased.
 #
 # If not specified, a cost factor of 5 will be used.
 # The value must be within the 1-11 range.
 #
 #YESCRYPT_COST_FACTOR 5
 # Currently CONSOLE_GROUPS is not supported
@ -303,13 +266,3 @@ CREATE_HOME	yes
 # missing.
 #
 #FORCE_SHADOW    yes
 #
 # Select the HMAC cryptography algorithm.
 # Used in pam_timestamp module to calculate the keyed-hash message
 # authentication code.
 #
 # Note: It is recommended to check hmac(3) to see the possible algorithms
 # that are available in your system.
 #
 HMAC_CRYPTO_ALGO SHA512
--- a/shadow-utils.spec
+++ b/shadow-utils.spec
@ -1,74 +1,83 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
-Version: 4.20.0
+Version: 4.8.1
-Release: 1%{?dist}
+Release: 10%{?dist}
 Epoch: 2
 License: BSD-3-Clause AND GPL-2.0-or-later
 URL: https://github.com/shadow-maint/shadow
-Source0: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz
+Source0: https://github.com/shadow-maint/shadow/releases/download/%{version}/shadow-%{version}.tar.xz
-Source1: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz.asc
+Source1: https://github.com/shadow-maint/shadow/releases/download/%{version}/shadow-%{version}.tar.xz.asc
 Source2: shadow-utils.useradd
 Source3: shadow-utils.login.defs
 Source4: shadow-bsd.txt
 Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
 Source6: shadow-utils.HOME_MODE.xml
-Source7: passwd.pamd
+# Misc small changes - most probably non-upstreamable
 Patch0: shadow-4.6-redhat.patch
 # Be more lenient with acceptable user/group names - non upstreamable
 Patch1: shadow-4.8-goodname.patch
 # https://github.com/shadow-maint/shadow/commit/7384865775b0203b9cf5337a047744f0a4555868
 Patch2: shadow-4.1.5.1-info-parent-dir.patch
 # Misc SElinux related changes - upstreamability unknown
 Patch6: shadow-4.8-selinux.patch
 # https://github.com/shadow-maint/shadow/commit/a8361e741040cd926c9c93aac89820052531b1a3
 Patch11: shadow-4.1.5.1-logmsg.patch
 # SElinux related - upstreamability unknown
 Patch14: shadow-4.1.5.1-default-range.patch
 # Misc manual page changes
 # https://github.com/shadow-maint/shadow/commit/c0818ab01d1896784245eedec9495e1e6e0260af
 # Changes in man/groupmems.8.xml, man/ja/man5/login.defs.5 and man/login.defs.5.xml not upstreamed
 Patch15: shadow-4.8.1-manfix.patch
 # https://github.com/shadow-maint/shadow/commit/f4cbf38ad7801bab6fae50e9b5a2effc3c48a1ea
 Patch17: shadow-4.1.5.1-userdel-helpfix.patch
 # Date parsing improvement - could be upstreamed
 Patch19: shadow-4.2.1-date-parsing.patch
 # Additional error message - could be upstreamed
 Patch21: shadow-4.6-move-home.patch
 # Audit message changes - upstreamability unknown
 Patch22: shadow-4.8.1-audit-update.patch
 # Changes related to password unlocking - could be upstreamed
 Patch23: shadow-4.5-usermod-unlock.patch
 # Additional SElinux related changes - upstreamability unknown
 Patch28: shadow-4.8-selinux-perms.patch
 # Handle NULL return from *time funcs - could be upstreamed
 Patch29: shadow-4.2.1-null-tm.patch
 # SElinux related - upstreamability unknown
 Patch31: shadow-4.6-getenforce.patch
 # Handle include of crypt.h - could be upstreamed
 Patch32: shadow-4.8-crypt_h.patch
 # Handle /etc/passwd corruption - could be upstreamed
 Patch33: shadow-4.8-long-entry.patch
 # Limit uid/gid allocation to non-zero - could be upstreamed
 Patch38: shadow-4.6-sysugid-min-limit.patch
 # Ignore LOGIN_PLAIN_PROMPT in login.defs - upstreamability unknown
 Patch40: shadow-4.8-ignore-login-prompt.patch
 # Generate /var/spool/mail/$USER with the proper SELinux user identity - already upstreamed
 Patch42: shadow-4.8-useradd-selinux-mail.patch
 # Clarify useradd man regarding "-d" parameter - already upstreamed
 Patch43: shadow-4.8.1-useradd-man-clarification.patch
 # https://github.com/shadow-maint/shadow/commit/8762f465d487a52bf68f9c0b7c3c1eb3caea7bc9
 Patch44: shadow-4.8.1-check-local-groups.patch
 # https://github.com/shadow-maint/shadow/commit/599cc003daf833bffdc9cbe0d33dc8b3e7ec74c8
 Patch45: shadow-4.8.1-commonio-force-lock-file-sync.patch
 # https://github.com/shadow-maint/shadow/commit/df6ec1d1693c8c80c323b40d6fc82bb549363db3
 Patch46: shadow-4.8.1-man-include-lastlog-file-caveat.patch
 # https://github.com/shadow-maint/shadow/commit/a757b458ffb4fb9a40bcbb4f7869449431c67f83
 Patch47: shadow-4.9-groupdel-fix-sigsegv-when-passwd-does-not-exist.patch
-### Globals ###
+License: BSD and GPLv2+
 %global includesubiddir %{_includedir}/shadow
 # Fail linking if there are undefined symbols.
 %global _ld_strict_symbol_defs 1
 ### Patches ###
 ### Dependencies ###
 Requires: audit-libs >= 1.6.5
 Requires: libselinux >= 1.25.2-1
 Requires: pam-libs
 Requires: setup
 ### Build Dependencies ###
 BuildRequires: audit-libs-devel >= 1.6.5
 BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: bison
 BuildRequires: docbook-dtds
 BuildRequires: docbook-style-xsl
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: gettext-devel
 BuildRequires: git
 BuildRequires: itstool
 BuildRequires: libacl-devel
 BuildRequires: libattr-devel
 BuildRequires: libcmocka-devel
 BuildRequires: libeconf-devel
 BuildRequires: libselinux-devel >= 1.25.2-1
 BuildRequires: libsemanage-devel
 BuildRequires: libtool
 BuildRequires: libxcrypt-devel
 BuildRequires: libxslt
 BuildRequires: make
-BuildRequires: pam
+BuildRequires: gcc
-BuildRequires: pam-devel
+BuildRequires: libselinux-devel >= 1.25.2-1
-
+BuildRequires: audit-libs-devel >= 1.6.5
-### Provides ###
+BuildRequires: libsemanage-devel
 BuildRequires: libacl-devel, libattr-devel
 BuildRequires: bison, flex, docbook-style-xsl, docbook-dtds
 BuildRequires: autoconf, automake, libtool, gettext-devel
 BuildRequires: /usr/bin/xsltproc, /usr/bin/itstool
 Requires: libselinux >= 1.25.2-1
 Requires: audit-libs >= 1.6.5
 Requires: setup
 Provides: shadow = %{epoch}:%{version}-%{release}
 Provides: passwd = 0.80-18
 Obsoletes: passwd <= 0.80-19
 %if "%{_sbindir}" == "%{_bindir}"
 # Compat symlinks for Requires in other packages.
 # We rely on filesystem to create the symlinks for us.
 Requires: filesystem(unmerged-sbin-symlinks)
 Provides: /usr/sbin/adduser
 Provides: /usr/sbin/useradd
 Provides: /usr/sbin/userdel
 Provides: /usr/sbin/usermod
 Provides: /usr/sbin/groupadd
 Provides: /usr/sbin/groupdel
 Provides: /usr/sbin/groupmod
 %endif
 %description
 The shadow-utils package includes the necessary programs for
@ -77,28 +86,38 @@ programs for managing user and group accounts. The pwconv command
 converts passwords to the shadow password format. The pwunconv command
 unconverts shadow passwords and generates a passwd file (a standard
 UNIX password file). The pwck command checks the integrity of password
-and shadow files. The useradd, userdel, and usermod commands are used
+and shadow files. The lastlog command prints out the last login times
-for managing user accounts. The groupadd, groupdel, and groupmod
+for all users. The useradd, userdel, and usermod commands are used for
-commands are used for managing group accounts.
+managing user accounts. The groupadd, groupdel, and groupmod commands
-
+are used for managing group accounts.
 ### Subpackages ###
 %package subid
 Summary: A library to manage subordinate uid and gid ranges
 %description subid
 Utility library that provides a way to manage subid ranges.
 %package subid-devel
 Summary: Development package for shadow-utils-subid
 Requires: shadow-utils-subid = %{epoch}:%{version}-%{release}
 %description subid-devel
 Development files for shadow-utils-subid.
 %prep
-%autosetup -p 1 -S git -n shadow-4.20.0
+%setup -q -n shadow-%{version}
 %patch0 -p1 -b .redhat
 %patch1 -p1 -b .goodname
 %patch2 -p1 -b .info-parent-dir
 %patch6 -p1 -b .selinux
 %patch11 -p1 -b .logmsg
 %patch14 -p1 -b .default-range
 %patch15 -p1 -b .manfix
 %patch17 -p1 -b .userdel
 %patch19 -p1 -b .date-parsing
 %patch21 -p1 -b .move-home
 %patch22 -p1 -b .audit-update
 %patch23 -p1 -b .unlock
 %patch28 -p1 -b .selinux-perms
 %patch29 -p1 -b .null-tm
 %patch31 -p1 -b .getenforce
 %patch32 -p1 -b .crypt_h
 %patch33 -p1 -b .long-entry
 %patch38 -p1 -b .sysugid-min-limit
 %patch40 -p1 -b .login-prompt
 %patch42 -p1 -b .useradd-selinux-mail
 %patch43 -p1 -b .useradd-man-clarification
 %patch44 -p1 -b .check-local-groups
 %patch45 -p1 -b .commonio-force-lock-file-sync
 %patch46 -p1 -b .man-include-lastlog-file-caveat
 %patch47 -p1 -b .groupdel-fix-sigsegv-when-passwd-does-not-exist
 iconv -f ISO88591 -t utf-8  doc/HOWTO > doc/HOWTO.utf8
 cp -f doc/HOWTO.utf8 doc/HOWTO
@ -106,39 +125,37 @@ cp -f doc/HOWTO.utf8 doc/HOWTO
 cp -a %{SOURCE4} %{SOURCE5} .
 cp -a %{SOURCE6} man/login.defs.d/HOME_MODE.xml
 # Force regeneration of getdate.c
 rm libmisc/getdate.c
 %build
 %ifarch sparc64
 #sparc64 need big PIE
 export CFLAGS="$RPM_OPT_FLAGS -fPIE"
 export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
 %else
 export CFLAGS="$RPM_OPT_FLAGS -fpie"
 export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
 %endif
 autoreconf
 %configure \
        --disable-account-tools-setuid \
        --enable-logind=no \
        --enable-man \
        --enable-shadowgrp \
-        --enable-shared \
+        --enable-man \
        --with-audit \
        --with-bcrypt \
        --with-group-name-max-length=32 \
        --with-libpam \
        --with-selinux \
        --with-sha-crypt \
-        --with-yescrypt \
+        --with-selinux \
        --without-libbsd \
        --without-libcrack \
-        --without-nscd \
+        --without-libpam \
-        --without-sssd
+        --disable-shared \
        --with-group-name-max-length=32
 %make_build
 %check
 make check
 %install
 %make_install gnulocaledir=$RPM_BUILD_ROOT%{_datadir}/locale MKINSTALLDIRS=`pwd`/mkinstalldirs
 install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/default
 install -p -c -m 0644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/login.defs
 install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/default/useradd
 install -d -m 755 $RPM_BUILD_ROOT%{_pam_confdir}
 install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/chpasswd
 install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/newusers
 install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/passwd
 ln -s useradd $RPM_BUILD_ROOT%{_sbindir}/adduser
@ -147,28 +164,45 @@ for subdir in $RPM_BUILD_ROOT%{_mandir}/{??,??_??,??_??.*}/man* ; do
        test -d $subdir && test -e $subdir/useradd.8 && echo ".so man8/useradd.8" > $subdir/adduser.8
 done
 %if "%{_sbindir}" == "%{_bindir}"
 # The installation script doesn't actually use the configured paths :(
 mv -v $RPM_BUILD_ROOT/usr/sbin/* $RPM_BUILD_ROOT%{_bindir}/
 %endif
 # Remove binaries we don't use.
 rm $RPM_BUILD_ROOT%{_bindir}/chfn
 rm $RPM_BUILD_ROOT%{_bindir}/chsh
 rm $RPM_BUILD_ROOT%{_bindir}/expiry
 rm $RPM_BUILD_ROOT%{_bindir}/groups
 rm $RPM_BUILD_ROOT%{_bindir}/login
 rm $RPM_BUILD_ROOT%{_bindir}/passwd
 rm $RPM_BUILD_ROOT%{_bindir}/su
 rm $RPM_BUILD_ROOT%{_bindir}/faillog
 rm $RPM_BUILD_ROOT%{_sysconfdir}/login.access
 rm $RPM_BUILD_ROOT%{_sysconfdir}/limits
 rm $RPM_BUILD_ROOT%{_sbindir}/logoutd
 rm $RPM_BUILD_ROOT%{_sbindir}/nologin
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chsh.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chsh.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/expiry.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/expiry.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/groups.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/groups.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/login.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/login.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/su.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/su.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/limits.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/limits.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/login.access.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/login.access.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/porttime.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/porttime.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/suauth.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/suauth.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/logoutd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/logoutd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/man3/getspnam.*
@ -178,12 +212,6 @@ rm $RPM_BUILD_ROOT%{_mandir}/*/man5/faillog.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/faillog.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/faillog.*
 # Remove PAM service files we don't use.
 rm $RPM_BUILD_ROOT%{_pam_confdir}/chfn
 rm $RPM_BUILD_ROOT%{_pam_confdir}/chsh
 rm $RPM_BUILD_ROOT%{_pam_confdir}/login
 rm $RPM_BUILD_ROOT%{_pam_confdir}/su
 find $RPM_BUILD_ROOT%{_mandir} -depth -type d -empty -delete
 %find_lang shadow
 for dir in $(ls -1d $RPM_BUILD_ROOT%{_mandir}/{??,??_??}) ; do
@ -194,30 +222,18 @@ for dir in $(ls -1d $RPM_BUILD_ROOT%{_mandir}/{??,??_??}) ; do
    echo "%%lang($lang) $dir/man*/*" >> shadow.lang
 done
 # Move header files to its own folder
 echo $(ls)
 mkdir -p $RPM_BUILD_ROOT/%{includesubiddir}
 install -m 644 libsubid/subid.h $RPM_BUILD_ROOT/%{includesubiddir}/
 # Remove .la and .a files created by libsubid
 rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.la
 rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %files -f shadow.lang
 %doc NEWS doc/HOWTO README
 %license gpl-2.0.txt shadow-bsd.txt
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/login.defs
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/default/useradd
 %config(noreplace) %{_pam_confdir}/chpasswd
 %config(noreplace) %{_pam_confdir}/newusers
 %config(noreplace) %{_pam_confdir}/passwd
 %{_bindir}/sg
 %attr(4755,root,root) %{_bindir}/chage
 %attr(4755,root,root) %{_bindir}/gpasswd
 %{_bindir}/lastlog
 %attr(4755,root,root) %{_bindir}/newgrp
 %attr(0755,root,root) %caps(cap_setgid=ep) %{_bindir}/newgidmap
 %attr(0755,root,root) %caps(cap_setuid=ep) %{_bindir}/newuidmap
 %attr(4755,root,root) %{_bindir}/passwd
 %{_sbindir}/adduser
 %attr(0755,root,root)   %{_sbindir}/user*
 %attr(0755,root,root)   %{_sbindir}/group*
@ -235,7 +251,6 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_mandir}/man1/newgrp.1*
 %{_mandir}/man1/newgidmap.1*
 %{_mandir}/man1/newuidmap.1*
 %{_mandir}/man1/passwd.*
 %{_mandir}/man3/shadow.3*
 %{_mandir}/man5/shadow.5*
 %{_mandir}/man5/login.defs.5*
@ -251,321 +266,16 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_mandir}/man8/chgpasswd.8*
 %{_mandir}/man8/newusers.8*
 %{_mandir}/man8/*conv.8*
 %{_mandir}/man8/lastlog.8*
 %{_mandir}/man8/vipw.8*
 %{_mandir}/man8/vigr.8*
 %files subid
 %{_libdir}/libsubid.so.*
 %{_bindir}/getsubids
 %{_mandir}/man1/getsubids.1*
 %files subid-devel
 %{includesubiddir}/subid.h
 %{_libdir}/libsubid.so
 %changelog
-* Wed Jul 29 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-1
+* Tue Nov 30 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-10
 - Rebase to version 4.20.0
 * Wed Jul 22 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-rc3-1
 - Rebase to version 4.20.0-rc3
 * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.3-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 * Wed May 27 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-3
 - Enable use of PAM for chpasswd and newusers
  Resolves: #2461179 and #2283963
 * Thu Apr 23 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-2
 - btrfs: simplify checks improve useradd behavior for non-btrfs
 * Wed Feb 11 2026 Debarshi Ray <rishi@fedoraproject.org> - 2:4.19.3-1
 - Rebase to version 4.19.3
  Resolves: #2426288
 * Tue Jan 27 2026 Adam Williamson <awilliam@redhat.com> - 2:4.19.0-6
 - chkhash.c: fix escaping in SHA-256 / SHA-512 / MD5 regexes
 * Mon Jan 26 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-5
 - chkhash.c: fix support for ! and * in hashes
 - usermod.c: add back optimizations
 * Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
 * Mon Jan 12 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-3
 - useradd: Support config for creating home dirs as Btrfs subvolumes
 * Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-2
 - Enable unit-tests
 * Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-1
 - Rebase to version 4.19.0
  Resolves: #2426288 and #2249524
 * Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-7
 - Also revert changes from -4 (last known good was -3)
 * Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-6
 - Revert changes from -5 (they were only meant for testing)
 * Tue Nov 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-5
 - Test CI
 * Fri Oct 31 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-4
 - Stop setting SELinux labels in chroot and prefix environments
  Resolves: #2249524
 * Tue Jul 29 2025 Alexey Tikhonov <atikhono@redhat.com> - 2:4.18.0-3
 - Revert "Stop assigning subids by default"
  Resolves: #2382662
 * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.18.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 * Tue Jul 22 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-1
 - Rebase to version 4.18.0. Resolves: #2374710
 * Fri Jul 18 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-5
 - Stop assigning subids by default
  Resolves: CVE-2024-56433 and #2334168
 * Tue Jul 15 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-4
 - FSWC: Migrate to lastlog2
  Link: <https://fedoraproject.org/wiki/Changes/Migrate_to_lastlog2>
  Resolves: #2361588
 * Tue Mar 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-2
 - Add pam dependency for _pam_confdir missing macro. Resolves: #2354806
 * Thu Mar 20 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-1
 - Rebase to version 4.17.4. Resolves: #2353491
 - Fixes problems with expiration dates
 * Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0-5
 - Add explicit BR: libxcrypt-devel
 * Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.17.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.17.0-3
 - Rebuilt for the bin-sbin merge (2nd attempt)
 * Thu Dec 26 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0
 - Rebase to version 4.17.0. Resolves: #2293678
 * Sun Dec 22 2024 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0~rc1-2
 - Remove potentially dangerous {C,LD}FLAGS shenanigans
 - Fail linking if there are undefined symbols at link-time
 * Mon Dec  9 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0~rc1-1
 - Rebase to version 4.17.0-rc1
 * Tue Nov 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-7
 - SPDX license migration for subpackages
 * Wed Oct 16 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-6
 - Rebuilt for libeconf soname bump
 * Mon Oct  7 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-5
 - useradd: fix write_full() return value. Resolves: #2313559
 * Fri Sep 13 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-3
 - Disable nscd
 * Wed Aug 28 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-2
 - Rebase to version 4.16.0 (#2293678)
 * Tue Jul 23 2024 Kevin Fenzi <kevin@scrye.com> - 2:4.15.1-9
 - Revert chpasswd: use PAM again for now.
 * Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.15.1-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-7
 - Rebuilt for the bin-sbin merge
 * Thu May 30 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-6
 - chpasswd: use PAM again (#2283963)
 * Mon May 20 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-5
 - Several fixes for issues detected by static analyzer tools
 * Thu Apr 11 2024 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-4
 - Fix build with %%_bindir==%%_sbindir
 - Add virtual Provides for old file paths used by other packages
 * Thu Mar 21 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-2
 - getdef: avoid spurious error messages about unknown configuration options.
  Resolves: #2265291
 * Tue Mar 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-1
 - Wrong versioning for 4.15.0 RC releases makes the oficial release look lower than them.
  Fix it by bumping the minor release to 4.15.1. Resolves: #2268690
 * Mon Mar 11 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
 - Rebase to version 4.15.0
 * Mon Feb 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-6
 - Build linking `libpam`
 * Thu Feb  1 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
 - passwd: Provide binary from this package. Enable libpam and
  disable account-tools-setuid. Provide passwd PAM service file.
  Resolves: #2233275
 - passwd: provide --stdin option
 * Mon Jan 29 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-4
 - Disable SSSD support. Resolves: #2253182
 * Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.14.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 * Tue Oct  3 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-2
 - useradd: Set proper SELinux labels for def_usrtemplate
 * Wed Aug 16 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-1
 - Rebase to version 4.14.0. Resolves: #2229000
 * Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 * Tue Jun 06 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 2:4.13-7
 - Remove unused libbsd-devel dependency
 * Mon Mar  6 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-6
 - Add libbsd-devel and libeconf-devel as build dependencies
 * Thu Mar  2 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-5
 - newuidmap and newgidmap: support passing pid as fd. Resolves: #2174752
 * Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 * Wed Nov 23 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-3
 - Change SUB_UID_MIN and SUB_GID_MIN to 524288. Resolves: #2144558
 * Mon Nov 21 2022 Florian Weimer <fweimer@redhat.com> - 2:4.13-2
 - Fix gshadow configure check (switching to glibc implementation)
 * Wed Nov  9 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-1
 - Rebase to version 4.13
 - SPDX license migration
 * Wed Oct  5 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-3
 - chage: Fix regression in print_date. Resolves: #2129336
 * Fri Sep  9 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-2
 - useradd: Do not reset non-existent data in {last,fail}log
 * Mon Aug 22 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-1
 - Rebase to version 4.12.3. Resolves: #2117809
 * Mon Aug  1 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-4
 - useradd: modify check ID range for system users. Resolves: #2093692
 * Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.11.1-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 * Thu Feb 10 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-2
 - Fix explicit subid requirement for subid-devel
 * Tue Jan 25 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-1
 - Rebase to version 4.11.1 (#2034038)
 - Fix release sources
 - Add explicit subid requirement for subid-devel
 * Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.9-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 * Mon Jan 17 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-9
 - nss: get shadow_logfd with log_get_logfd() (#2038811)
 - lib: make shadow_logfd and Prog not extern
 - lib: rename Prog to shadow_progname
 - lib: provide default values for shadow_progname
 - libsubid: use log_set_progname in subid_init
 * Fri Nov 19 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-8
 - getsubids: provide system binary and man page (#1980780)
 - pwck: fix segfault when calling fprintf() (#2021339)
 - newgrp: fix segmentation fault (#2019553)
 - groupdel: fix SIGSEGV when passwd does not exist (#1986111)
-* Fri Nov 12 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
+* Mon Aug  9 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-9
- useradd: change SELinux labels for home files (#2022658)
+- allow all types of groups when modifying supplementary groups (#1975327)
 * Thu Nov  4 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-6
 - useradd: revert fix memleak of grp (#2018697)
 * Wed Oct 27 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-5
 - useradd: generate home and mail directories with selinux user attribute
 * Thu Sep 23 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-4
 - login.defs: include HMAC_CRYPTO_ALGO key
 - Clean spec file: organize dependencies and move License location
 * Tue Aug 17 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-3
 - libmisc: fix default value in SHA_get_salt_rounds()
 * Mon Aug  9 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-2
 - useradd: avoid generating an empty subid range (#1990653)
 * Wed Aug  4 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-1
 - Rebase to version 4.9
 - usermod: allow all group types with -G option (#1975327)
 - Clean spec file
 * Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.8.1-20
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 * Wed Jul 14 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-19
 - Add patch to fix 'fread returns element count, not element size'
 * Wed Jul 14 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-18
 - Fix regression issues detected in rhbz#667593 and rhbz#672510
 * Mon Jul 12 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-17
 - Enable bcrypt support, as libxcrypt supports it well
 * Sun Jul 04 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-16
 - Add a patch to obtain random bytes using getentropy()
 - Update shadow-4.8-crypt_h.patch with the upstreamed version
 - Add a patch to make use of crypt_gensalt() from libxcrypt
 * Tue Jun 29 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-15
 - useradd: free correct pointer (#1976809)
 * Mon Jun 28 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-14
 - Add a patch to fix the used prefix for the bcrypt hash method
 - Add a patch to cleanup the code in libmisc/salt.c
 - Add a patch adding some clarifying comments in libmisc/salt.c
 - Add a patch to obtain random bytes from /dev/urandom
 * Mon Jun 28 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-13
 - Covscan fixes
 * Mon Jun 21 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-12
 - Backport support for yescrypt hash method
 - Add a patch to fix the parameter type of YESCRYPT_salt_cost()
 * Mon Jun 21 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-11
 - libsubid: don't print error messages on stderr by default
 - libsubid: libsubid_init return false if out of memory
 - useradd: fix SUB_UID_COUNT=0
 - libsubid: don't return owner in list_owner_ranges API call
 - libsubid: libsubid_init don't print messages on error
 - libsubid: fix newusers when nss provides subids
 - man: clarify subid delegation
 - libsubid: make shadow_logfd not extern
 * Thu May  6 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-10
 - man: mention NSS in new[ug]idmap manpages
 - libsubid: move development header to shadow folder
 * Fri Apr 16 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-9
 - libsubid: creation and nsswitch support
 - Creation of subid and subid-devel subpackages
 * Mon Mar 29 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-8
 - man: include lastlog file caveat (#951564)
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406
+SHA512 (shadow-4.8.1.tar.xz) = 780a983483d847ed3c91c82064a0fa902b6f4185225978241bc3bc03fcc3aa143975b46aee43151c6ba43efcfdb1819516b76ba7ad3d1d3c34fcc38ea42e917b
-SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac
+SHA512 (shadow-4.8.1.tar.xz.asc) = ec7686263c81d3feb8ee4314c3323a9a3ada74aafaaf99f4f0d9af9b1341f8c5ff5477ecf98dd94dbb7d921f532d655b0b6a87d94c71893f35dc9bc54c84dd42
--- a/tests/mhc-fedora-ci.yaml
+++ b/tests/mhc-fedora-ci.yaml
@ -1,13 +0,0 @@
 provisioned_topologies:
 - shadow
 domains:
 - id: shadow
  hosts:
  - hostname: localhost
    role: shadow
    conn:
      type: ssh
      host: localhost
      user: root
    artifacts:
    - /var/log/*
--- a/tests/sanity/Makefile
+++ b/tests/sanity/Makefile
@ -0,0 +1,77 @@
 # Copyright (c) 2006 Red Hat, Inc. All rights reserved. This copyrighted material 
 # is made available to anyone wishing to use, modify, copy, or
 # redistribute it subject to the terms and conditions of the GNU General
 # Public License v.2.
 #
 # This program is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 # PARTICULAR PURPOSE. See the GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 #
 # Author: Jakub Hrozek
 #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
 # Example Makefile for RHTS                                          #
 # This example is geared towards a test for a specific package       #
 # It does most of the work for you, but may require further coding   #
 #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
 # The toplevel namespace within which the test lives.
 TOPLEVEL_NAMESPACE=CoreOS
 # The name of the package under test:
 PACKAGE_NAME=shadow-utils
 # The path of the test below the package:
 RELATIVE_PATH=sanity
 # Version of the Test. Used with make tag.
 export TESTVERSION=1.1
 # The combined namespace of the test.
 export TEST=/$(TOPLEVEL_NAMESPACE)/$(PACKAGE_NAME)/$(RELATIVE_PATH)
 # A phony target is one that is not really the name of a file.
 # It is just a name for some commands to be executed when you
 # make an explicit request. There are two reasons to use a
 # phony target: to avoid a conflict with a file of the same
 # name, and to improve performance.
 .PHONY: all install download clean
 # Executables to be built should be added here, they will be generated on the system under test.
 BUILT_FILES= 
 # Data files, .c files, scripts anything needed to either compile the test and/or run it.
 FILES=$(METADATA) Makefile PURPOSE sanity_test.py runtest.sh
 run: $(FILES) build
 	./runtest.sh
 build: $(BUILT_FILES)
 	chmod a+x ./sanity_test.py
 	chmod a+x ./runtest.sh
 clean:
 	rm -f *~ *.rpm $(BUILT_FILES)
 # Include Common Makefile
 include /usr/share/rhts/lib/rhts-make.include
 # Generate the testinfo.desc here:
 $(METADATA): Makefile
 	@touch $(METADATA)
 	@echo "Owner:        Jakub Hrozek <jhrozek@redhat.com>" > $(METADATA)
 	@echo "Name:         $(TEST)" >> $(METADATA)
 	@echo "Path:         $(TEST_DIR)" >> $(METADATA)
 	@echo "TestVersion:  $(TESTVERSION)" >> $(METADATA)
 	@echo "License:      GNU GPL" >> $(METADATA)
 	@echo "Description:  Basic sanity test for shadow-utils" >> $(METADATA)
 	@echo "TestTime:     5m" >> $(METADATA)
 	@echo "RunFor:       $(PACKAGE_NAME)" >> $(METADATA)
 	@echo "Requires:     $(PACKAGE_NAME)" >> $(METADATA)
 	@echo "Requires:     python" >> $(METADATA)
 	rhts-lint $(METADATA)
--- a/tests/sanity/PURPOSE
+++ b/tests/sanity/PURPOSE
@ -0,0 +1,10 @@
 This is a basic sanity test for the shadow-utils package. It is implemented
 in python on top of the unittesting.py module.
 Its purpose is to ensure that the binaries in the shadow-utils package behave
 as expected and its switches/options work correctly.
 For the most part, every binary in the shadow-utils package is represented by
 a single class named Test<BinaryName>, i.e. TestUsermod etc. There are some 
 exceptions, like TestUseraddWeirdNameTest though.
--- a/tests/sanity/runtest.sh
+++ b/tests/sanity/runtest.sh
@ -0,0 +1,24 @@
 #!/bin/bash
 . /usr/bin/rhts-environment.sh
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 rlJournalStart
 rlFileBackup --clean /etc/default/useradd- /etc/default/useradd
 setenforce 0
 python sanity_test.py -v
 setenforce 1
 rlFileRestore
 EXIT=$?
 if [[ $EXIT -eq 0 ]]; then
    RESULT="PASS"
 else
    RESULT="FAIL"
 fi
 rlJournalEnd
 echo "Result: $RESULT"
 echo "Exit: $EXIT"
 report_result $TEST $RESULT $EXIT
--- a/tests/sanity/sanity_test.py
+++ b/tests/sanity/sanity_test.py
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,13 @@
 ---
 # This first play always runs on the local staging system
 - hosts: localhost
  roles:
  - role: standard-test-beakerlib
    tags:
    - classic
    - atomic
    tests:
    - sanity
    required_packages:
    - shadow-utils     # sanity test needs shadow-utils
    - python           # sanity test needs python
Author	SHA1	Message	Date
Iker Pedrosa	520f3b8272	groupdel: fix SIGSEGV when passwd does not exist (#1986111 ) Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>	2021-11-30 14:45:25 +01:00
Iker Pedrosa	3019026005	allow all types of groups when modifying supplementary groups (#1975327 ) Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>	2021-08-09 10:15:44 +02:00
`@ -1,2 +1,2 @@`
	`SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406`	`SHA512 (shadow-4.8.1.tar.xz) = 780a983483d847ed3c91c82064a0fa902b6f4185225978241bc3bc03fcc3aa143975b46aee43151c6ba43efcfdb1819516b76ba7ad3d1d3c34fcc38ea42e917b`
	`SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac`	`SHA512 (shadow-4.8.1.tar.xz.asc) = ec7686263c81d3feb8ee4314c3323a9a3ada74aafaaf99f4f0d9af9b1341f8c5ff5477ecf98dd94dbb7d921f532d655b0b6a87d94c71893f35dc9bc54c84dd42`