useradd: Do not reset non-existent data in {last,fail}log

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -16,41 +16,3 @@ shadow-4.1.4.2.tar.bz2
 /shadow-4.8.1.tar.xz.asc
 /shadow-4.9.tar.xz
 /shadow-4.9.tar.xz.asc
-/shadow-4.11.1.tar.xz
-/shadow-4.11.1.tar.xz.asc
-/shadow-4.12.3.tar.xz
-/shadow-4.12.3.tar.xz.asc
-/shadow-4.13.tar.xz
-/shadow-4.13.tar.xz.asc
-/shadow-4.14.0.tar.xz
-/shadow-4.14.0.tar.xz.asc
-/shadow-4.15.0rc2.tar.xz
-/shadow-4.15.0rc2.tar.xz.asc
-/shadow-4.15.0rc3.tar.xz
-/shadow-4.15.0rc3.tar.xz.asc
-/shadow-4.15.0.tar.xz
-/shadow-4.15.0.tar.xz.asc
-/shadow-4.15.1.tar.xz
-/shadow-4.15.1.tar.xz.asc
-/shadow-4.16.0.tar.xz
-/shadow-4.16.0.tar.xz.asc
-/shadow-4.17.0-rc1.tar.xz
-/shadow-4.17.0-rc1.tar.xz.asc
-/shadow-4.17.0.tar.xz
-/shadow-4.17.0.tar.xz.asc
-/shadow-4.17.4.tar.xz
-/shadow-4.17.4.tar.xz.asc
-/shadow-4.18.0.tar.xz
-/shadow-4.18.0.tar.xz.asc
-/shadow-4.19.0.tar.xz
-/shadow-4.19.0.tar.xz.asc
-/shadow-4.19.2.tar.xz
-/shadow-4.19.2.tar.xz.asc
-/shadow-4.19.3.tar.xz
-/shadow-4.19.3.tar.xz.asc
-/shadow-4.20.0-rc2.tar.xz
-/shadow-4.20.0-rc2.tar.xz.asc
-/shadow-4.20.0-rc3.tar.xz
-/shadow-4.20.0-rc3.tar.xz.asc
-/shadow-4.20.0.tar.xz
-/shadow-4.20.0.tar.xz.asc

passwd.pamd

@@ -1,5 +0,0 @@
-#%PAM-1.0
-# This tool only uses the password stack.
-password   substack	system-auth
--password   optional	pam_gnome_keyring.so use_authtok
-password   substack	postlogin

plans/tier0-functional.fmf

@@ -1,51 +0,0 @@
-summary: Tier 0 functional tests for shadow-utils
-description: |
-    Run comprehensive system tests for shadow-utils. These tests validate user and group
-    account management functionality by testing actual system operations including user
-    creation, password management, group operations, and verification of system files
-    (i.e. /etc/passwd, /etc/shadow).
-
-provision:
-    how: virtual
-    image: fedora
-
-prepare:
-    - name: Install general dependencies
-      how: install
-      package:
-        - expect
-        - gcc
-        - git
-        - libssh-devel
-        - python3-devel
-        - python3-pip
-
-    - name: Setup SSH keys for localhost testing
-      how: shell
-      script:
-        - ssh-keygen -t rsa -f /root/.ssh/id_rsa -N "" -q
-        - cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
-        - chmod 600 /root/.ssh/authorized_keys
-        - ssh-keyscan -H localhost >> /root/.ssh/known_hosts
-
-    - name: Clone shadow repository
-      how: shell
-      script:
-        - git clone https://github.com/shadow-maint/shadow.git /tmp/shadow-test
-
-    - name: Copy test topology for Fedora CI
-      how: shell
-      script:
-        - cp tests/mhc-fedora-ci.yaml /tmp/shadow-test/tests/system
-
-    - name: Install test dependencies
-      how: shell
-      script:
-        - pip3 install -r /tmp/shadow-test/tests/system/requirements.txt
-
-execute:
-    how: tmt
-    duration: 30m
-    script: |
-        cd /tmp/shadow-test/tests/system
-        pytest --mh-config=mhc-fedora-ci.yaml --mh-lazy-ssh -v

shadow-4.11.1-subordinateio-also-compare-the-owner-ID.patch

@@ -0,0 +1,108 @@
+From 3ec32f9975f262073f8fbdecd2bfaee4a1d3db48 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Wed, 13 Jul 2022 09:55:14 +0200
+Subject: [PATCH] subordinateio: also compare the owner ID
+
+IDs already populate /etc/subuid and /etc/subgid files so it's necessary
+not only to check for the owner name but also for the owner ID of a
+given range.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2093311
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ lib/subordinateio.c | 50 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+diff --git a/lib/subordinateio.c b/lib/subordinateio.c
+index 9ca70b8b..6bc45283 100644
+--- a/lib/subordinateio.c
++++ b/lib/subordinateio.c
+@@ -17,6 +17,8 @@
+ #include <ctype.h>
+ #include <fcntl.h>
+ 
++#define ID_SIZE 31
++
+ /*
+  * subordinate_dup: create a duplicate range
+  *
+@@ -745,6 +747,40 @@ gid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count)
+ 	return start == ULONG_MAX ? (gid_t) -1 : start;
+ }
+ 
++static bool get_owner_id(const char *owner, enum subid_type id_type, char *id)
++{
++	struct passwd *pw;
++	struct group *gr;
++	int ret = 0;
++
++	switch (id_type) {
++	case ID_TYPE_UID:
++		pw = getpwnam(owner);
++		if (pw == NULL) {
++			return false;
++		}
++		ret = snprintf(id, ID_SIZE, "%u", pw->pw_uid);
++		if (ret < 0 || ret >= ID_SIZE) {
++			return false;
++		}
++		break;
++	case ID_TYPE_GID:
++		gr = getgrnam(owner);
++		if (gr == NULL) {
++			return false;
++		}
++		ret = snprintf(id, ID_SIZE, "%u", gr->gr_gid);
++		if (ret < 0 || ret >= ID_SIZE) {
++			return false;
++		}
++		break;
++	default:
++		return false;
++	}
++
++	return true;
++}
++
+ /*
+  * int list_owner_ranges(const char *owner, enum subid_type id_type, struct subordinate_range ***ranges)
+  *
+@@ -770,6 +806,8 @@ int list_owner_ranges(const char *owner, enum subid_type id_type, struct subid_r
+ 	enum subid_status status;
+ 	int count = 0;
+ 	struct subid_nss_ops *h;
++	char id[ID_SIZE];
++	bool have_owner_id;
+ 
+ 	*in_ranges = NULL;
+ 
+@@ -798,6 +836,8 @@ int list_owner_ranges(const char *owner, enum subid_type id_type, struct subid_r
+ 		return -1;
+ 	}
+ 
++	have_owner_id = get_owner_id(owner, id_type, id);
++
+ 	commonio_rewind(db);
+ 	while ((range = commonio_next(db)) != NULL) {
+ 		if (0 == strcmp(range->owner, owner)) {
+@@ -808,6 +848,16 @@ int list_owner_ranges(const char *owner, enum subid_type id_type, struct subid_r
+ 				goto out;
+ 			}
+ 		}
++
++		// Let's also compare with the ID
++		if (have_owner_id == true && 0 == strcmp(range->owner, id)) {
++			if (!append_range(&ranges, range, count++)) {
++				free(ranges);
++				ranges = NULL;
++				count = -1;
++				goto out;
++			}
++		}
+ 	}
+ 
+ out:
+-- 
+2.37.3
+

shadow-4.2.1-date-parsing.patch

@@ -0,0 +1,69 @@
+Index: shadow-4.5/libmisc/getdate.y
+===================================================================
+--- shadow-4.5.orig/libmisc/getdate.y
++++ shadow-4.5/libmisc/getdate.y
+@@ -152,6 +152,7 @@ static int	yyHaveDay;
+ static int	yyHaveRel;
+ static int	yyHaveTime;
+ static int	yyHaveZone;
++static int      yyHaveYear;
+ static int	yyTimezone;
+ static int	yyDay;
+ static int	yyHour;
+@@ -293,18 +294,21 @@ date	: tUNUMBER '/' tUNUMBER {
+ 	      yyDay = $3;
+ 	      yyYear = $5;
+ 	    }
++	    yyHaveYear++;
+ 	}
+ 	| tUNUMBER tSNUMBER tSNUMBER {
+ 	    /* ISO 8601 format.  yyyy-mm-dd.  */
+ 	    yyYear = $1;
+ 	    yyMonth = -$2;
+ 	    yyDay = -$3;
++	    yyHaveYear++;
+ 	}
+ 	| tUNUMBER tMONTH tSNUMBER {
+ 	    /* e.g. 17-JUN-1992.  */
+ 	    yyDay = $1;
+ 	    yyMonth = $2;
+ 	    yyYear = -$3;
++	    yyHaveYear++;
+ 	}
+ 	| tMONTH tUNUMBER {
+ 	    yyMonth = $1;
+@@ -314,6 +318,7 @@ date	: tUNUMBER '/' tUNUMBER {
+ 	    yyMonth = $1;
+ 	    yyDay = $2;
+ 	    yyYear = $4;
++	    yyHaveYear++;
+ 	}
+ 	| tUNUMBER tMONTH {
+ 	    yyMonth = $2;
+@@ -323,6 +328,7 @@ date	: tUNUMBER '/' tUNUMBER {
+ 	    yyMonth = $2;
+ 	    yyDay = $1;
+ 	    yyYear = $3;
++	    yyHaveYear++;
+ 	}
+ 	;
+ 
+@@ -395,7 +401,8 @@ relunit	: tUNUMBER tYEAR_UNIT {
+ 
+ number	: tUNUMBER
+           {
+-	    if ((yyHaveTime != 0) && (yyHaveDate != 0) && (yyHaveRel == 0))
++	    if ((yyHaveTime != 0 || $1 >= 100) && !yyHaveYear
++		&& (yyHaveDate != 0) && (yyHaveRel == 0))
+ 	      yyYear = $1;
+ 	    else
+ 	      {
+@@ -802,7 +809,7 @@ yylex (void)
+ 	  return LookupWord (buff);
+ 	}
+       if (c != '(')
+-	return *yyInput++;
++	return (unsigned char)*yyInput++;
+       Count = 0;
+       do
+ 	{

shadow-4.5-usermod-unlock.patch

@@ -0,0 +1,64 @@
+Index: shadow-4.5/src/usermod.c
+===================================================================
+--- shadow-4.5.orig/src/usermod.c
++++ shadow-4.5/src/usermod.c
+@@ -455,14 +455,17 @@ static char *new_pw_passwd (char *pw_pas
+ 		strcat (buf, pw_pass);
+ 		pw_pass = buf;
+ 	} else if (Uflg && pw_pass[0] == '!') {
+-		char *s;
++		char *s = pw_pass;
+ 
+-		if (pw_pass[1] == '\0') {
++		while ('!' == *s)
++			++s;
++
++		if (*s == '\0') {
+ 			fprintf (stderr,
+ 			         _("%s: unlocking the user's password would result in a passwordless account.\n"
+ 			           "You should set a password with usermod -p to unlock this user's password.\n"),
+ 			         Prog);
+-			return pw_pass;
++			return NULL;
+ 		}
+ 
+ #ifdef WITH_AUDIT
+@@ -471,12 +474,15 @@ static char *new_pw_passwd (char *pw_pas
+ 		              user_newname, (unsigned int) user_newid, 1);
+ #endif
+ 		SYSLOG ((LOG_INFO, "unlock user '%s' password", user_newname));
+-		s = pw_pass;
+-		while ('\0' != *s) {
+-			*s = *(s + 1);
+-			s++;
+-		}
++		memmove (pw_pass, s, strlen (s) + 1);
+ 	} else if (pflg) {
++		if (strchr (user_pass, ':') != NULL) {
++			fprintf (stderr,
++			         _("%s: The password field cannot contain a colon character.\n"),
++			         Prog);
++			return NULL;
++
++		}
+ #ifdef WITH_AUDIT
+ 		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
+ 		              "updating-password",
+@@ -525,6 +531,8 @@ static void new_pwent (struct passwd *pw
+ 	if (   (!is_shadow_pwd)
+ 	    || (strcmp (pwent->pw_passwd, SHADOW_PASSWD_STRING) != 0)) {
+ 		pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd);
++		if (pwent->pw_passwd == NULL)
++			fail_exit (E_PW_UPDATE);
+ 	}
+ 
+ 	if (uflg) {
+@@ -639,6 +647,8 @@ static void new_spent (struct spwd *spen
+ 	 *  + aging has been requested
+ 	 */
+ 	spent->sp_pwdp = new_pw_passwd (spent->sp_pwdp);
++	if (spent->sp_pwdp == NULL)
++		fail_exit(E_PW_UPDATE);
+ 
+ 	if (pflg) {
+ 		spent->sp_lstchg = (long) gettime () / SCALE;

shadow-4.6-move-home.patch

@@ -0,0 +1,15 @@
+diff -up shadow-4.6/src/usermod.c.move-home shadow-4.6/src/usermod.c
+--- shadow-4.6/src/usermod.c.move-home	2018-05-28 14:59:05.594076665 +0200
++++ shadow-4.6/src/usermod.c	2018-05-28 15:00:28.479837392 +0200
+@@ -1845,6 +1845,11 @@ static void move_home (void)
+ 			         Prog, prefix_user_home, prefix_user_newhome);
+ 			fail_exit (E_HOMEDIR);
+ 		}
++	} else {
++		fprintf (stderr,
++		         _("%s: The previous home directory (%s) does "
++		           "not exist or is inaccessible. Move cannot be completed.\n"),
++		         Prog, prefix_user_home);
+ 	}
+ }
+ 

shadow-4.6-sysugid-min-limit.patch

@@ -0,0 +1,34 @@
+diff -up shadow-4.6/libmisc/find_new_gid.c.min-limit shadow-4.6/libmisc/find_new_gid.c
+--- shadow-4.6/libmisc/find_new_gid.c.min-limit	2018-04-29 18:42:37.000000001 +0200
++++ shadow-4.6/libmisc/find_new_gid.c	2018-11-06 10:51:20.554963292 +0100
+@@ -82,6 +82,13 @@ static int get_ranges (bool sys_group, g
+                             (unsigned long) *max_id);
+ 			return EINVAL;
+ 		}
++		/*
++		 * Zero is reserved for root and the allocation algorithm does not
++		 * work right with it.
++		 */
++		if (*min_id == 0) {
++			*min_id = (gid_t) 1;
++		}
+ 	} else {
+ 		/* Non-system groups */
+ 
+diff -up shadow-4.6/libmisc/find_new_uid.c.min-limit shadow-4.6/libmisc/find_new_uid.c
+--- shadow-4.6/libmisc/find_new_uid.c.min-limit	2018-04-29 18:42:37.000000001 +0200
++++ shadow-4.6/libmisc/find_new_uid.c	2018-11-06 10:51:39.341399569 +0100
+@@ -82,6 +82,13 @@ static int get_ranges (bool sys_user, ui
+                             (unsigned long) *max_id);
+ 			return EINVAL;
+ 		}
++		/*
++		 * Zero is reserved for root and the allocation algorithm does not
++		 * work right with it.
++		 */
++		if (*min_id == 0) {
++			*min_id = (uid_t) 1;
++		}
+ 	} else {
+ 		/* Non-system users */
+ 

shadow-4.8-goodname.patch

@@ -0,0 +1,100 @@
+diff -up shadow-4.8/libmisc/chkname.c.goodname shadow-4.8/libmisc/chkname.c
+--- shadow-4.8/libmisc/chkname.c.goodname	2020-01-13 09:44:41.968507996 +0100
++++ shadow-4.8/libmisc/chkname.c	2020-01-13 09:46:27.863727732 +0100
+@@ -55,26 +55,44 @@ static bool is_valid_name (const char *n
+ 	}
+ 
+ 	/*
+-	 * User/group names must match [a-z_][a-z0-9_-]*[$]
+-	 */
++         * User/group names must match gnu e-regex:
++         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
++         *
++         * as a non-POSIX, extension, allow "$" as the last char for
++         * sake of Samba 3.x "add machine script"
++         *
++         * Also do not allow fully numeric names or just "." or "..".
++         */
++	int numeric;
+ 
+-	if (('\0' == *name) ||
+-	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
++	if ('\0' == *name ||
++	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
++			      '\0' == name[1])) ||
++	    !((*name >= 'a' && *name <= 'z') ||
++	      (*name >= 'A' && *name <= 'Z') ||
++	      (*name >= '0' && *name <= '9') ||
++	      *name == '_' ||
++	      *name == '.')) {
+ 		return false;
+ 	}
+ 
++	numeric = isdigit(*name);
++
+ 	while ('\0' != *++name) {
+-		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
+-		      ( ('0' <= *name) && ('9' >= *name) ) ||
+-		      ('_' == *name) ||
+-		      ('-' == *name) ||
+-		      ( ('$' == *name) && ('\0' == *(name + 1)) )
++		if (!((*name >= 'a' && *name <= 'z') ||
++		      (*name >= 'A' && *name <= 'Z') ||
++		      (*name >= '0' && *name <= '9') ||
++		      *name == '_' ||
++		      *name == '.' ||
++		      *name == '-' ||
++		      (*name == '$' && name[1] == '\0')
+ 		     )) {
+ 			return false;
+ 		}
++		numeric &= isdigit(*name);
+ 	}
+ 
+-	return true;
++	return !numeric;
+ }
+ 
+ bool is_valid_user_name (const char *name)
+diff -up shadow-4.8/man/groupadd.8.xml.goodname shadow-4.8/man/groupadd.8.xml
+--- shadow-4.8/man/groupadd.8.xml.goodname	2019-07-23 17:26:08.000000000 +0200
++++ shadow-4.8/man/groupadd.8.xml	2020-01-13 09:44:41.968507996 +0100
+@@ -273,10 +273,12 @@
+    <refsect1 id='caveats'>
+      <title>CAVEATS</title>
+      <para>
+-       Groupnames must start with a lower case letter or an underscore,
+-       followed by lower case letters, digits, underscores, or dashes.
+-       They can end with a dollar sign.
+-       In regular expression terms: [a-z_][a-z0-9_-]*[$]?
++       Groupnames may contain only lower and upper case letters, digits,
++       underscores, or dashes. They can end with a dollar sign.
++
++       Dashes are not allowed at the beginning of the groupname.
++       Fully numeric groupnames and groupnames . or .. are
++       also disallowed.
+      </para>
+      <para>
+        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
+diff -up shadow-4.8/man/useradd.8.xml.goodname shadow-4.8/man/useradd.8.xml
+--- shadow-4.8/man/useradd.8.xml.goodname	2019-10-05 03:23:58.000000000 +0200
++++ shadow-4.8/man/useradd.8.xml	2020-01-13 09:44:41.968507996 +0100
+@@ -661,10 +661,14 @@
+     </para>
+ 
+     <para>
+-      Usernames must start with a lower case letter or an underscore,
+-      followed by lower case letters, digits, underscores, or dashes.
+-      They can end with a dollar sign.
+-      In regular expression terms: [a-z_][a-z0-9_-]*[$]?
++      Usernames may contain only lower and upper case letters, digits,
++      underscores, or dashes. They can end with a dollar sign.
++
++      Dashes are not allowed at the beginning of the username.
++      Fully numeric usernames and usernames . or .. are
++      also disallowed. It is not recommended to use usernames beginning
++      with . character as their home directories will be hidden in
++      the <command>ls</command> output.
+     </para>
+     <para>
+       Usernames may only be up to 32 characters long.

shadow-4.8-ignore-login-prompt.patch

@@ -0,0 +1,11 @@
+diff -up shadow-4.8/lib/getdef.c.login-prompt shadow-4.8/lib/getdef.c
+--- shadow-4.8/lib/getdef.c.login-prompt	2020-01-13 10:38:44.852796681 +0100
++++ shadow-4.8/lib/getdef.c	2020-01-13 10:39:54.472612511 +0100
+@@ -98,6 +98,7 @@ static struct itemdef def_table[] = {
+ 	{"LASTLOG_UID_MAX", NULL},
+ 	{"LOGIN_RETRIES", NULL},
+ 	{"LOGIN_TIMEOUT", NULL},
++	{"LOGIN_PLAIN_PROMPT", NULL},
+ 	{"LOG_OK_LOGINS", NULL},
+ 	{"LOG_UNKFAIL_ENAB", NULL},
+ 	{"MAIL_DIR", NULL},

shadow-4.8-long-entry.patch

@@ -0,0 +1,86 @@
+diff -up shadow-4.8/lib/defines.h.long-entry shadow-4.8/lib/defines.h
+--- shadow-4.8/lib/defines.h.long-entry	2020-01-13 10:29:45.288957339 +0100
++++ shadow-4.8/lib/defines.h	2020-01-13 10:30:47.482902954 +0100
+@@ -388,6 +388,9 @@ extern char *strerror ();
+ # endif
+ #endif
+ 
++/* Maximum length of passwd entry */
++#define PASSWD_ENTRY_MAX_LENGTH 32768
++
+ #ifdef HAVE_SECURE_GETENV
+ #  define shadow_getenv(name) secure_getenv(name)
+ # else
+diff -up shadow-4.8/lib/pwio.c.long-entry shadow-4.8/lib/pwio.c
+--- shadow-4.8/lib/pwio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
++++ shadow-4.8/lib/pwio.c	2020-01-13 10:29:45.288957339 +0100
+@@ -79,7 +79,10 @@ static int passwd_put (const void *ent,
+ 	    || (pw->pw_gid == (gid_t)-1)
+ 	    || (valid_field (pw->pw_gecos, ":\n") == -1)
+ 	    || (valid_field (pw->pw_dir, ":\n") == -1)
+-	    || (valid_field (pw->pw_shell, ":\n") == -1)) {
++	    || (valid_field (pw->pw_shell, ":\n") == -1)
++	    || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
++	        strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
++	        strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
+ 		return -1;
+ 	}
+ 
+diff -up shadow-4.8/lib/sgetpwent.c.long-entry shadow-4.8/lib/sgetpwent.c
+--- shadow-4.8/lib/sgetpwent.c.long-entry	2019-10-05 03:23:58.000000000 +0200
++++ shadow-4.8/lib/sgetpwent.c	2020-01-13 10:29:45.288957339 +0100
+@@ -57,7 +57,7 @@
+ struct passwd *sgetpwent (const char *buf)
+ {
+ 	static struct passwd pwent;
+-	static char pwdbuf[1024];
++	static char pwdbuf[PASSWD_ENTRY_MAX_LENGTH];
+ 	register int i;
+ 	register char *cp;
+ 	char *fields[NFIELDS];
+@@ -67,8 +67,10 @@ struct passwd *sgetpwent (const char *bu
+ 	 * the password structure remain valid.
+ 	 */
+ 
+-	if (strlen (buf) >= sizeof pwdbuf)
++	if (strlen (buf) >= sizeof pwdbuf) {
++		fprintf (stderr, "Too long passwd entry encountered, file corruption?\n");
+ 		return 0;	/* fail if too long */
++	}
+ 	strcpy (pwdbuf, buf);
+ 
+ 	/*
+diff -up shadow-4.8/lib/sgetspent.c.long-entry shadow-4.8/lib/sgetspent.c
+--- shadow-4.8/lib/sgetspent.c.long-entry	2019-07-23 17:26:08.000000000 +0200
++++ shadow-4.8/lib/sgetspent.c	2020-01-13 10:29:45.289957322 +0100
+@@ -48,7 +48,7 @@
+  */
+ struct spwd *sgetspent (const char *string)
+ {
+-	static char spwbuf[1024];
++	static char spwbuf[PASSWD_ENTRY_MAX_LENGTH];
+ 	static struct spwd spwd;
+ 	char *fields[FIELDS];
+ 	char *cp;
+@@ -61,6 +61,7 @@ struct spwd *sgetspent (const char *stri
+ 	 */
+ 
+ 	if (strlen (string) >= sizeof spwbuf) {
++		fprintf (stderr, "Too long shadow entry encountered, file corruption?\n");
+ 		return 0;	/* fail if too long */
+ 	}
+ 	strcpy (spwbuf, string);
+diff -up shadow-4.8/lib/shadowio.c.long-entry shadow-4.8/lib/shadowio.c
+--- shadow-4.8/lib/shadowio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
++++ shadow-4.8/lib/shadowio.c	2020-01-13 10:29:45.289957322 +0100
+@@ -79,7 +79,9 @@ static int shadow_put (const void *ent,
+ 
+ 	if (   (NULL == sp)
+ 	    || (valid_field (sp->sp_namp, ":\n") == -1)
+-	    || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
++	    || (valid_field (sp->sp_pwdp, ":\n") == -1)
++	    || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
++	        1000 > PASSWD_ENTRY_MAX_LENGTH)) {
+ 		return -1;
+ 	}
+ 

shadow-4.8-selinux-perms.patch

@@ -0,0 +1,240 @@
+diff -up shadow-4.8/src/chgpasswd.c.selinux-perms shadow-4.8/src/chgpasswd.c
+--- shadow-4.8/src/chgpasswd.c.selinux-perms	2019-12-01 18:02:43.000000000 +0100
++++ shadow-4.8/src/chgpasswd.c	2020-01-13 10:21:44.558107260 +0100
+@@ -39,6 +39,13 @@
+ #include <pwd.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#include <selinux/avc.h>
++#endif
++#ifdef WITH_LIBAUDIT
++#include <libaudit.h>
++#endif
+ #ifdef ACCT_TOOLS_SETUID
+ #ifdef USE_PAM
+ #include "pam_defs.h"
+@@ -80,6 +87,9 @@ static bool sgr_locked = false;
+ #endif
+ static bool gr_locked = false;
+ 
++/* The name of the caller */
++static char *myname = NULL;
++
+ /* local function prototypes */
+ static void fail_exit (int code);
+ static /*@noreturn@*/void usage (int status);
+@@ -334,6 +344,63 @@ static void check_perms (void)
+ #endif				/* ACCT_TOOLS_SETUID */
+ }
+ 
++#ifdef WITH_SELINUX
++static int
++log_callback (int type, const char *fmt, ...)
++{
++    int audit_fd;
++    va_list ap;
++
++    va_start(ap, fmt);
++#ifdef WITH_AUDIT
++    audit_fd = audit_open();
++
++    if (audit_fd >= 0) {
++	char *buf;
++
++	if (vasprintf (&buf, fmt, ap) < 0)
++		goto ret;
++	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
++				   NULL, 0);
++	audit_close(audit_fd);
++	free(buf);
++	goto ret;
++    }
++
++#endif
++    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
++ret:
++    va_end(ap);
++    return 0;
++}
++
++static void
++selinux_check_root (void)
++{
++    int status = -1;
++    security_context_t user_context;
++    union selinux_callback old_callback;
++
++    if (is_selinux_enabled() < 1)
++	return;
++
++    old_callback = selinux_get_callback(SELINUX_CB_LOG);
++    /* setup callbacks */
++    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
++    if ((status = getprevcon(&user_context)) < 0) {
++	selinux_set_callback(SELINUX_CB_LOG, old_callback);
++	exit(1);
++    }
++
++    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
++
++    selinux_set_callback(SELINUX_CB_LOG, old_callback);
++    freecon(user_context);
++    if (status != 0 && security_getenforce() != 0)
++	exit(1);
++}
++#endif
++
+ /*
+  * open_files - lock and open the group databases
+  */
+@@ -427,6 +494,7 @@ int main (int argc, char **argv)
+ 
+ 	const struct group *gr;
+ 	struct group newgr;
++	struct passwd *pw = NULL;
+ 	int errors = 0;
+ 	int line = 0;
+ 
+@@ -436,12 +504,37 @@ int main (int argc, char **argv)
+ 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
+ 	(void) textdomain (PACKAGE);
+ 
++#ifdef WITH_SELINUX
++	selinux_check_root ();
++#endif
++
+ 	process_root_flag ("-R", argc, argv);
+ 
+ 	process_flags (argc, argv);
+ 
+ 	OPENLOG ("chgpasswd");
+ 
++#ifdef WITH_AUDIT
++	audit_help_open ();
++#endif
++
++	/*
++	 * Determine the name of the user that invoked this command. This
++	 * is really hit or miss because there are so many ways that command
++	 * can be executed and so many ways to trip up the routines that
++	 * report the user name.
++	 */
++	pw = get_my_pwent ();
++	if (NULL == pw) {
++		fprintf (stderr, _("%s: Cannot determine your user name.\n"),
++		         Prog);
++		SYSLOG ((LOG_WARN,
++		         "Cannot determine the user name of the caller (UID %lu)",
++		         (unsigned long) getuid ()));
++		exit (E_NOPERM);
++	}
++	myname = xstrdup (pw->pw_name);
++
+ 	check_perms ();
+ 
+ #ifdef SHADOWGRP
+diff -up shadow-4.8/src/chpasswd.c.selinux-perms shadow-4.8/src/chpasswd.c
+--- shadow-4.8/src/chpasswd.c.selinux-perms	2019-12-01 18:02:43.000000000 +0100
++++ shadow-4.8/src/chpasswd.c	2020-01-13 10:21:44.558107260 +0100
+@@ -39,6 +39,13 @@
+ #include <pwd.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#include <selinux/avc.h>
++#endif
++#ifdef WITH_LIBAUDIT
++#include <libaudit.h>
++#endif
+ #ifdef USE_PAM
+ #include "pam_defs.h"
+ #endif				/* USE_PAM */
+@@ -332,6 +339,63 @@ static void check_perms (void)
+ #endif				/* USE_PAM */
+ }
+ 
++#ifdef WITH_SELINUX
++static int
++log_callback (int type, const char *fmt, ...)
++{
++    int audit_fd;
++    va_list ap;
++
++    va_start(ap, fmt);
++#ifdef WITH_AUDIT
++    audit_fd = audit_open();
++
++    if (audit_fd >= 0) {
++	char *buf;
++
++	if (vasprintf (&buf, fmt, ap) < 0)
++		goto ret;
++	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
++				   NULL, 0);
++	audit_close(audit_fd);
++	free(buf);
++	goto ret;
++    }
++
++#endif
++    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
++ret:
++    va_end(ap);
++    return 0;
++}
++
++static void
++selinux_check_root (void)
++{
++    int status = -1;
++    security_context_t user_context;
++    union selinux_callback old_callback;
++
++    if (is_selinux_enabled() < 1)
++	return;
++
++    old_callback = selinux_get_callback(SELINUX_CB_LOG);
++    /* setup callbacks */
++    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
++    if ((status = getprevcon(&user_context)) < 0) {
++	selinux_set_callback(SELINUX_CB_LOG, old_callback);
++	exit(1);
++    }
++
++    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
++
++    selinux_set_callback(SELINUX_CB_LOG, old_callback);
++    freecon(user_context);
++    if (status != 0 && security_getenforce() != 0)
++	exit(1);
++}
++#endif
++
+ /*
+  * open_files - lock and open the password databases
+  */
+@@ -428,6 +492,10 @@ int main (int argc, char **argv)
+ 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
+ 	(void) textdomain (PACKAGE);
+ 
++#ifdef WITH_SELINUX
++	selinux_check_root ();
++#endif
++
+ 	process_root_flag ("-R", argc, argv);
+ 
+ 	process_flags (argc, argv);
+@@ -440,6 +508,10 @@ int main (int argc, char **argv)
+ 
+ 	OPENLOG ("chpasswd");
+ 
++#ifdef WITH_AUDIT
++	audit_help_open ();
++#endif
++
+ 	check_perms ();
+ 
+ #ifdef USE_PAM

shadow-4.9-default-range.patch

@@ -0,0 +1,35 @@
+diff -up shadow-4.9/lib/semanage.c.default-range shadow-4.9/lib/semanage.c
+--- shadow-4.9/lib/semanage.c.default-range	2021-07-22 23:55:35.000000000 +0200
++++ shadow-4.9/lib/semanage.c	2021-08-02 12:43:16.822817392 +0200
+@@ -143,6 +143,7 @@ static int semanage_user_mod (semanage_h
+ 		goto done;
+ 	}
+ 
++#if 0
+ 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
+ 	if (ret != 0) {
+ 		fprintf (shadow_logfd,
+@@ -150,6 +151,7 @@ static int semanage_user_mod (semanage_h
+ 		ret = 1;
+ 		goto done;
+ 	}
++#endif
+ 
+ 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
+ 	if (ret != 0) {
+@@ -200,6 +202,7 @@ static int semanage_user_add (semanage_h
+ 		goto done;
+ 	}
+ 
++#if 0
+ 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
+ 	if (ret != 0) {
+ 		fprintf (shadow_logfd,
+@@ -208,6 +211,7 @@ static int semanage_user_add (semanage_h
+ 		ret = 1;
+ 		goto done;
+ 	}
++#endif
+ 
+ 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
+ 	if (ret != 0) {

shadow-4.9-getsubids.patch

@@ -0,0 +1,245 @@
+diff -up shadow-4.9/man/getsubids.1.xml.getsubids shadow-4.9/man/getsubids.1.xml
+--- shadow-4.9/man/getsubids.1.xml.getsubids	2021-11-18 16:27:33.951053120 +0100
++++ shadow-4.9/man/getsubids.1.xml	2021-11-18 16:27:33.951053120 +0100
+@@ -0,0 +1,141 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<!--
++   Copyright (c) 2021 Iker Pedrosa
++   All rights reserved.
++
++   Redistribution and use in source and binary forms, with or without
++   modification, are permitted provided that the following conditions
++   are met:
++   1. Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++   2. Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++   3. The name of the copyright holders or contributors may not be used to
++      endorse or promote products derived from this software without
++      specific prior written permission.
++
++   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
++   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
++   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++-->
++<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.5//EN"
++  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
++<!-- SHADOW-CONFIG-HERE -->
++]>
++
++<refentry id='getsubids.1'>
++  <refentryinfo>
++    <author>
++      <firstname>Iker</firstname>
++      <surname>Pedrosa</surname>
++      <contrib>Creation, 2021</contrib>
++    </author>
++  </refentryinfo>
++  <refmeta>
++    <refentrytitle>getsubids</refentrytitle>
++    <manvolnum>1</manvolnum>
++    <refmiscinfo class="sectdesc">User Commands</refmiscinfo>
++    <refmiscinfo class="source">shadow-utils</refmiscinfo>
++    <refmiscinfo class="version">&SHADOW_UTILS_VERSION;</refmiscinfo>
++  </refmeta>
++  <refnamediv id='name'>
++    <refname>getsubids</refname>
++    <refpurpose>get the subordinate id ranges for a user</refpurpose>
++  </refnamediv>
++
++  <refsynopsisdiv id='synopsis'>
++    <cmdsynopsis>
++      <command>getsubids</command>
++      <arg choice='opt'>
++        <replaceable>options</replaceable>
++      </arg>
++      <arg choice='plain'>
++        <replaceable>USER</replaceable>
++      </arg>
++    </cmdsynopsis>
++  </refsynopsisdiv>
++
++  <refsect1 id='description'>
++    <title>DESCRIPTION</title>
++    <para>
++      The <command>getsubids</command> command lists the subordinate user ID
++      ranges for a given user. The subordinate group IDs can be listed using
++      the <option>-g</option> option.
++    </para>
++  </refsect1>
++
++  <refsect1 id='options'>
++    <title>OPTIONS</title>
++    <para>
++      The options which apply to the <command>getsubids</command> command are:
++    </para>
++    <variablelist remap='IP'>
++      <varlistentry>
++        <term>
++          <option>-g</option>
++        </term>
++        <listitem>
++          <para>
++            List the subordinate group ID ranges.
++          </para>
++        </listitem>
++      </varlistentry>
++    </variablelist>
++  </refsect1>
++
++  <refsect1 id='example'>
++    <title>EXAMPLE</title>
++    <para>
++      For example, to obtain the subordinate UIDs of the testuser:
++    </para>
++    <para>
++<programlisting>
++$ getsubids testuser
++0: testuser 100000 65536
++</programlisting>
++    </para>
++    <para>
++      This command output provides (in order from left to right) the list
++      index, username, UID range start, and number of UIDs in range.
++    </para>
++  </refsect1>
++
++  <refsect1 id='see_also'>
++    <title>SEE ALSO</title>
++    <para>
++      <citerefentry>
++        <refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum>
++      </citerefentry>,
++      <citerefentry>
++        <refentrytitle>newgidmap</refentrytitle><manvolnum>1</manvolnum>
++      </citerefentry>,
++      <citerefentry>
++        <refentrytitle>newuidmap</refentrytitle><manvolnum>1</manvolnum>
++      </citerefentry>,
++      <citerefentry>
++        <refentrytitle>subgid</refentrytitle><manvolnum>5</manvolnum>
++      </citerefentry>,
++      <citerefentry>
++        <refentrytitle>subuid</refentrytitle><manvolnum>5</manvolnum>
++      </citerefentry>,
++      <citerefentry>
++        <refentrytitle>useradd</refentrytitle><manvolnum>8</manvolnum>
++      </citerefentry>,
++      <citerefentry>
++        <refentrytitle>userdel</refentrytitle><manvolnum>8</manvolnum>
++      </citerefentry>.
++      <citerefentry>
++        <refentrytitle>usermod</refentrytitle><manvolnum>8</manvolnum>
++      </citerefentry>,
++    </para>
++  </refsect1>
++</refentry>
+diff -up shadow-4.9/man/Makefile.am.getsubids shadow-4.9/man/Makefile.am
+--- shadow-4.9/man/Makefile.am.getsubids	2021-07-22 23:55:35.000000000 +0200
++++ shadow-4.9/man/Makefile.am	2021-11-18 16:27:33.951053120 +0100
+@@ -62,6 +62,7 @@ man_MANS += $(man_nopam)
+ endif
+ 
+ man_subids = \
++	man1/getsubids.1 \
+ 	man1/newgidmap.1 \
+ 	man1/newuidmap.1 \
+ 	man5/subgid.5 \
+@@ -80,6 +81,7 @@ man_XMANS = \
+ 	expiry.1.xml \
+ 	faillog.5.xml \
+ 	faillog.8.xml \
++	getsubids.1.xml \
+ 	gpasswd.1.xml \
+ 	groupadd.8.xml \
+ 	groupdel.8.xml \
+diff -up shadow-4.9/src/getsubids.c.getsubids shadow-4.9/src/getsubids.c
+--- shadow-4.9/src/getsubids.c.getsubids	2021-11-18 16:27:33.951053120 +0100
++++ shadow-4.9/src/getsubids.c	2021-11-18 16:27:33.951053120 +0100
+@@ -0,0 +1,46 @@
++#include <stdio.h>
++#include <string.h>
++#include <stdlib.h>
++#include "subid.h"
++#include "prototypes.h"
++
++const char *Prog;
++FILE *shadow_logfd = NULL;
++
++void usage(void)
++{
++	fprintf(stderr, "Usage: %s [-g] user\n", Prog);
++	fprintf(stderr, "    list subuid ranges for user\n");
++	fprintf(stderr, "    pass -g to list subgid ranges\n");
++	exit(EXIT_FAILURE);
++}
++
++int main(int argc, char *argv[])
++{
++	int i, count=0;
++	struct subid_range *ranges;
++	const char *owner;
++
++	Prog = Basename (argv[0]);
++	shadow_logfd = stderr;
++	if (argc < 2)
++		usage();
++	owner = argv[1];
++	if (argc == 3 && strcmp(argv[1], "-g") == 0) {
++		owner = argv[2];
++		count = get_subgid_ranges(owner, &ranges);
++	} else if (argc == 2 && strcmp(argv[1], "-h") == 0) {
++		usage();
++	} else {
++		count = get_subuid_ranges(owner, &ranges);
++	}
++	if (!ranges) {
++		fprintf(stderr, "Error fetching ranges\n");
++		exit(1);
++	}
++	for (i = 0; i < count; i++) {
++		printf("%d: %s %lu %lu\n", i, owner,
++			ranges[i].start, ranges[i].count);
++	}
++	return 0;
++}
+diff -up shadow-4.9/src/list_subid_ranges.c.getsubids shadow-4.9/src/list_subid_ranges.c
+diff -up shadow-4.9/src/Makefile.am.getsubids shadow-4.9/src/Makefile.am
+--- shadow-4.9/src/Makefile.am.getsubids	2021-11-18 16:27:33.943053061 +0100
++++ shadow-4.9/src/Makefile.am	2021-11-18 16:28:03.647272392 +0100
+@@ -157,8 +157,8 @@ if FCAPS
+ 	setcap cap_setgid+ep $(DESTDIR)$(ubindir)/newgidmap
+ endif
+ 
+-noinst_PROGRAMS += list_subid_ranges  \
+-					get_subid_owners \
++bin_PROGRAMS    +=  getsubids
++noinst_PROGRAMS +=  get_subid_owners \
+ 					new_subid_range \
+ 					free_subid_range \
+ 					check_subid_range
+@@ -174,13 +174,13 @@ MISCLIBS = \
+ 	$(LIBCRYPT) \
+ 	$(LIBTCB)
+ 
+-list_subid_ranges_LDADD = \
++getsubids_LDADD = \
+ 	$(top_builddir)/lib/libshadow.la \
+ 	$(top_builddir)/libmisc/libmisc.la \
+ 	$(top_builddir)/libsubid/libsubid.la \
+ 	$(MISCLIBS) -ldl
+ 
+-list_subid_ranges_CPPFLAGS = \
++getsubids_CPPFLAGS = \
+ 	-I$(top_srcdir)/lib \
+ 	-I$(top_srcdir)/libmisc \
+ 	-I$(top_srcdir)/libsubid

shadow-4.9-groupdel-fix-sigsegv-when-passwd-does-not-exist.patch

@@ -0,0 +1,13 @@
+diff -up shadow-4.9/libmisc/prefix_flag.c.groupdel-fix-sigsegv-when-passwd-does-not-exist shadow-4.9/libmisc/prefix_flag.c
+--- shadow-4.9/libmisc/prefix_flag.c.groupdel-fix-sigsegv-when-passwd-does-not-exist	2021-11-19 09:21:36.997091941 +0100
++++ shadow-4.9/libmisc/prefix_flag.c	2021-11-19 09:22:19.001341010 +0100
+@@ -288,6 +288,9 @@ extern struct passwd* prefix_getpwent()
+ 	if(!passwd_db_file) {
+ 		return getpwent();
+ 	}
++	if (!fp_pwent) {
++		return NULL;
++	}
+ 	return fgetpwent(fp_pwent);
+ }
+ extern void prefix_endpwent()

shadow-4.9-libmisc-fix-default-value-in-SHA_get_salt_rounds.patch

@@ -0,0 +1,60 @@
+From 234e8fa7b134d1ebabfdad980a3ae5b63c046c62 Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Sat, 14 Aug 2021 13:24:34 -0400
+Subject: [PATCH] libmisc: fix default value in SHA_get_salt_rounds()
+
+If SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS are both unspecified,
+use SHA_ROUNDS_DEFAULT.
+
+Previously, the code fell through, calling shadow_random(-1, -1). This
+ultimately set rounds = (unsigned long) -1, which ends up being a very
+large number! This then got capped to SHA_ROUNDS_MAX later in the
+function.
+
+The new behavior matches BCRYPT_get_salt_rounds().
+
+Bug: https://bugs.gentoo.org/808195
+Fixes: https://github.com/shadow-maint/shadow/issues/393
+---
+ libmisc/salt.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/libmisc/salt.c b/libmisc/salt.c
+index 91d528fd..30eefb9c 100644
+--- a/libmisc/salt.c
++++ b/libmisc/salt.c
+@@ -223,20 +223,21 @@ static /*@observer@*/const unsigned long SHA_get_salt_rounds (/*@null@*/int *pre
+ 		if ((-1 == min_rounds) && (-1 == max_rounds)) {
+ 			rounds = SHA_ROUNDS_DEFAULT;
+ 		}
++		else {
++			if (-1 == min_rounds) {
++				min_rounds = max_rounds;
++			}
+ 
+-		if (-1 == min_rounds) {
+-			min_rounds = max_rounds;
+-		}
++			if (-1 == max_rounds) {
++				max_rounds = min_rounds;
++			}
+ 
+-		if (-1 == max_rounds) {
+-			max_rounds = min_rounds;
+-		}
++			if (min_rounds > max_rounds) {
++				max_rounds = min_rounds;
++			}
+ 
+-		if (min_rounds > max_rounds) {
+-			max_rounds = min_rounds;
++			rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
+ 		}
+-
+-		rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
+ 	} else if (0 == *prefered_rounds) {
+ 		rounds = SHA_ROUNDS_DEFAULT;
+ 	} else {
+-- 
+2.31.1
+

shadow-4.9-manfix.patch

@@ -0,0 +1,180 @@
+diff -up shadow-4.8.1/man/groupmems.8.xml.manfix shadow-4.8.1/man/groupmems.8.xml
+--- shadow-4.8.1/man/groupmems.8.xml.manfix	2020-03-17 15:34:48.750414984 +0100
++++ shadow-4.8.1/man/groupmems.8.xml	2020-03-17 15:41:13.383588722 +0100
+@@ -179,20 +179,10 @@
+   <refsect1 id='setup'>
+     <title>SETUP</title>
+     <para>
+-      The <command>groupmems</command> executable should be in mode
+-      <literal>2710</literal> as user <emphasis>root</emphasis> and in group
+-      <emphasis>groups</emphasis>. The system administrator can add users to
+-      group <emphasis>groups</emphasis> to allow or disallow them using the
+-      <command>groupmems</command> utility to manage their own group
+-      membership list.
++      In this operating system the <command>groupmems</command> executable
++      is not setuid and regular users cannot use it to manipulate
++      the membership of their own group.
+     </para>
+-
+-    <programlisting>
+-	$ groupadd -r groups
+-	$ chmod 2710 groupmems
+-	$ chown root.groups groupmems
+-	$ groupmems -g groups -a gk4
+-    </programlisting>
+   </refsect1>
+ 
+   <refsect1 id='configuration'>
+diff -up shadow-4.8.1/man/ja/man5/login.defs.5.manfix shadow-4.8.1/man/ja/man5/login.defs.5
+--- shadow-4.8.1/man/ja/man5/login.defs.5.manfix	2019-07-23 17:26:08.000000000 +0200
++++ shadow-4.8.1/man/ja/man5/login.defs.5	2020-03-17 15:34:48.750414984 +0100
+@@ -147,10 +147,6 @@ 以下の参照表は、
+ shadow パスワード機能のどのプログラムが
+ どのパラメータを使用するかを示したものである。
+ .na
+-.IP chfn 12
+-CHFN_AUTH CHFN_RESTRICT
+-.IP chsh 12
+-CHFN_AUTH
+ .IP groupadd 12
+ GID_MAX GID_MIN
+ .IP newusers 12
+diff -up shadow-4.8.1/man/login.defs.5.xml.manfix shadow-4.8.1/man/login.defs.5.xml
+--- shadow-4.8.1/man/login.defs.5.xml.manfix	2020-01-17 16:47:56.000000000 +0100
++++ shadow-4.8.1/man/login.defs.5.xml	2020-03-17 15:34:48.750414984 +0100
+@@ -164,6 +164,17 @@
+       long numeric parameters is machine-dependent.
+     </para>
+ 
++    <para>
++      Please note that the parameters in this configuration file control the
++      behavior of the tools from the shadow-utils component. None of these
++      tools uses the PAM mechanism, and the utilities that use PAM (such as the
++      passwd command) should be configured elsewhere. The only values that
++      affect PAM modules are <emphasis>ENCRYPT_METHOD</emphasis> and <emphasis>SHA_CRYPT_MAX_ROUNDS</emphasis>
++      for pam_unix module, <emphasis>FAIL_DELAY</emphasis> for pam_faildelay module,
++      and <emphasis>UMASK</emphasis> for pam_umask module. Refer to
++      pam(8) for more information.
++    </para>
++
+     <para>The following configuration items are provided:</para>
+ 
+     <variablelist remap='IP'>
+@@ -256,16 +267,6 @@
+ 	</listitem>
+       </varlistentry>
+       <varlistentry>
+-	<term>chfn</term>
+-	<listitem>
+-	  <para>
+-	    <phrase condition="no_pam">CHFN_AUTH</phrase>
+-	    CHFN_RESTRICT
+-	    <phrase condition="no_pam">LOGIN_STRING</phrase>
+-	  </para>
+-	</listitem>
+-      </varlistentry>
+-      <varlistentry>
+ 	<term>chgpasswd</term>
+ 	<listitem>
+ 	  <para>
+@@ -286,14 +287,6 @@
+ 	  </para>
+ 	</listitem>
+       </varlistentry>
+-      <varlistentry condition="no_pam">
+-	<term>chsh</term>
+-	<listitem>
+-	  <para>
+-	    CHSH_AUTH LOGIN_STRING
+-	  </para>
+-	</listitem>
+-      </varlistentry>
+       <!-- expiry: no variables (CONSOLE_GROUPS linked, but not used) -->
+       <!-- faillog: no variables -->
+       <varlistentry>
+@@ -359,34 +352,6 @@
+ 	  <para>LASTLOG_UID_MAX</para>
+ 	</listitem>
+       </varlistentry>
+-      <varlistentry>
+-	<term>login</term>
+-	<listitem>
+-	  <para>
+-	    <phrase condition="no_pam">CONSOLE</phrase>
+-	    CONSOLE_GROUPS DEFAULT_HOME
+-	    <phrase condition="no_pam">ENV_HZ ENV_PATH ENV_SUPATH
+-	    ENV_TZ ENVIRON_FILE</phrase>
+-	    ERASECHAR FAIL_DELAY
+-	    <phrase condition="no_pam">FAILLOG_ENAB</phrase>
+-	    FAKE_SHELL
+-	    <phrase condition="no_pam">FTMP_FILE</phrase>
+-	    HUSHLOGIN_FILE
+-	    <phrase condition="no_pam">ISSUE_FILE</phrase>
+-	    KILLCHAR
+-	    <phrase condition="no_pam">LASTLOG_ENAB LASTLOG_UID_MAX</phrase>
+-	    LOGIN_RETRIES
+-	    <phrase condition="no_pam">LOGIN_STRING</phrase>
+-	    LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB
+-	    <phrase condition="no_pam">MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE
+-	    MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB
+-	    QUOTAS_ENAB</phrase>
+-	    TTYGROUP TTYPERM TTYTYPE_FILE
+-	    <phrase condition="no_pam">ULIMIT UMASK</phrase>
+-	    USERGROUPS_ENAB
+-	  </para>
+-	</listitem>
+-      </varlistentry>
+       <!-- logoutd: no variables -->
+       <varlistentry>
+ 	<term>newgrp / sg</term>
+@@ -415,17 +380,6 @@
+ 	</listitem>
+       </varlistentry>
+       <!-- nologin: no variables -->
+-      <varlistentry condition="no_pam">
+-	<term>passwd</term>
+-	<listitem>
+-	  <para>
+-	    ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB
+-	    PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN
+-	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
+-	    SHA_CRYPT_MIN_ROUNDS</phrase>
+-	  </para>
+-	</listitem>
+-      </varlistentry>
+       <varlistentry>
+ 	<term>pwck</term>
+ 	<listitem>
+@@ -452,32 +406,6 @@
+ 	  </para>
+ 	</listitem>
+       </varlistentry>
+-      <varlistentry>
+-	<term>su</term>
+-	<listitem>
+-	  <para>
+-	    <phrase condition="no_pam">CONSOLE</phrase>
+-	    CONSOLE_GROUPS DEFAULT_HOME
+-	    <phrase condition="no_pam">ENV_HZ ENVIRON_FILE</phrase>
+-	    ENV_PATH ENV_SUPATH
+-	    <phrase condition="no_pam">ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB
+-	    MAIL_DIR MAIL_FILE QUOTAS_ENAB</phrase>
+-	    SULOG_FILE SU_NAME
+-	    <phrase condition="no_pam">SU_WHEEL_ONLY</phrase>
+-	    SYSLOG_SU_ENAB
+-	    <phrase condition="no_pam">USERGROUPS_ENAB</phrase>
+-	  </para>
+-	</listitem>
+-      </varlistentry>
+-      <varlistentry>
+-	<term>sulogin</term>
+-	<listitem>
+-	  <para>
+-	    ENV_HZ
+-	    <phrase condition="no_pam">ENV_TZ</phrase>
+-	  </para>
+-	</listitem>
+-      </varlistentry>
+       <varlistentry>
+ 	<term>useradd</term>
+ 	<listitem>

shadow-4.9-move-create-home.patch

@@ -0,0 +1,88 @@
+From 09c752f00f9dfc610f66d68be38c9e5be8ca7f15 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Fri, 8 Oct 2021 13:09:59 +0200
+Subject: [PATCH] useradd: create directories after the SELinux user
+
+Create the home and mail folders after the SELinux user has been set for
+the added user. This will allow the folders to be created with the
+SELinux user label.
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ src/useradd.c | 46 +++++++++++++++++++++++-----------------------
+ 1 file changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index 6269c01c..b463a170 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -2670,27 +2670,12 @@ int main (int argc, char **argv)
+ 
+ 	usr_update ();
+ 
+-	if (mflg) {
+-		create_home ();
+-		if (home_added) {
+-			copy_tree (def_template, prefix_user_home, false, false,
+-			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
+-		} else {
+-			fprintf (stderr,
+-			         _("%s: warning: the home directory %s already exists.\n"
+-			           "%s: Not copying any file from skel directory into it.\n"),
+-			         Prog, user_home, Prog);
+-		}
+-
+-	}
+-
+-	/* Do not create mail directory for system accounts */
+-	if (!rflg) {
+-		create_mail ();
+-	}
+-
+ 	close_files ();
+ 
++	nscd_flush_cache ("passwd");
++	nscd_flush_cache ("group");
++	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
++
+ 	/*
+ 	 * tallylog_reset needs to be able to lookup
+ 	 * a valid existing user name,
+@@ -2716,15 +2701,30 @@ int main (int argc, char **argv)
+ 	}
+ #endif				/* WITH_SELINUX */
+ 
++	if (mflg) {
++		create_home ();
++		if (home_added) {
++			copy_tree (def_template, prefix_user_home, false, false,
++			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
++		} else {
++			fprintf (stderr,
++			         _("%s: warning: the home directory %s already exists.\n"
++			           "%s: Not copying any file from skel directory into it.\n"),
++			         Prog, user_home, Prog);
++		}
++
++	}
++
++	/* Do not create mail directory for system accounts */
++	if (!rflg) {
++		create_mail ();
++	}
++
+ 	if (run_parts ("/etc/shadow-maint/useradd-post.d", (char*)user_name,
+ 			"useradd")) {
+ 		exit(1);
+ 	}
+ 
+-	nscd_flush_cache ("passwd");
+-	nscd_flush_cache ("group");
+-	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
+-
+ 	return E_SUCCESS;
+ }
+ 
+-- 
+2.31.1
+

shadow-4.9-newgrp-fix-segmentation-fault.patch

@@ -0,0 +1,35 @@
+From 497e90751bc0d95cc998b0f06305040563903948 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Wed, 10 Nov 2021 12:02:04 +0100
+Subject: [PATCH] newgrp: fix segmentation fault
+
+Fix segmentation fault in newgrp when xgetspnam() returns a NULL value
+that is immediately freed.
+
+The error was committed in
+https://github.com/shadow-maint/shadow/commit/e65cc6aebcb4132fa413f00a905216a5b35b3d57
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2019553
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ src/newgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/newgrp.c b/src/newgrp.c
+index 730f47e8..566f1c89 100644
+--- a/src/newgrp.c
++++ b/src/newgrp.c
+@@ -163,8 +163,8 @@ static void check_perms (const struct group *grp,
+ 	spwd = xgetspnam (pwd->pw_name);
+ 	if (NULL != spwd) {
+ 		pwd->pw_passwd = xstrdup (spwd->sp_pwdp);
++		spw_free (spwd);
+ 	}
+-	spw_free (spwd);
+ 
+ 	if ((pwd->pw_passwd[0] == '\0') && (grp->gr_passwd[0] != '\0')) {
+ 		needspasswd = true;
+-- 
+2.31.1
+

shadow-4.9-newuidmap-libeconf-dependency.patch

@@ -0,0 +1,15 @@
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 7c1a3491..6cc873be 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -96,8 +96,8 @@ LIBCRYPT_NOPAM = $(LIBCRYPT)
+ endif
+ 
+ chage_LDADD    = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBECONF)
+-newuidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) -ldl
+-newgidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) -ldl
++newuidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) $(LIBECONF) -ldl
++newgidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) $(LIBECONF) -ldl
+ chfn_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)
+ chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
+ chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)

shadow-4.9-nss-get-shadow-logfd-with-log-get-logfd.patch

@@ -0,0 +1,48 @@
+From e101219ad71de11da3fdd1b3ec2620fd1a97b92c Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Mon, 10 Jan 2022 15:30:28 +0100
+Subject: [PATCH] nss: get shadow_logfd with log_get_logfd()
+
+If /etc/nsswitch.conf doesn't exist podman crashes because shadow_logfd
+is NULL. In order to avoid that load the log file descriptor with the
+log_get_logfd() helper function.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2038811
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ lib/nss.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/nss.c b/lib/nss.c
+index 02742902..06fa48e5 100644
+--- a/lib/nss.c
++++ b/lib/nss.c
+@@ -9,6 +9,7 @@
+ #include "prototypes.h"
+ #include "../libsubid/subid.h"
+ #include "shadowlog_internal.h"
++#include "shadowlog.h"
+ 
+ #define NSSWITCH "/etc/nsswitch.conf"
+ 
+@@ -42,6 +43,7 @@ void nss_init(const char *nsswitch_path) {
+ 	FILE *nssfp = NULL;
+ 	char *line = NULL, *p, *token, *saveptr;
+ 	size_t len = 0;
++	FILE *shadow_logfd = log_get_logfd();
+ 
+ 	if (atomic_flag_test_and_set(&nss_init_started)) {
+ 		// Another thread has started nss_init, wait for it to complete
+@@ -57,7 +59,7 @@ void nss_init(const char *nsswitch_path) {
+ 	//   subid:	files
+ 	nssfp = fopen(nsswitch_path, "r");
+ 	if (!nssfp) {
+-		fprintf(shadow_logfd, "Failed opening %s: %m", nsswitch_path);
++		fprintf(shadow_logfd, "Failed opening %s: %m\n", nsswitch_path);
+ 		atomic_store(&nss_init_completed, true);
+ 		return;
+ 	}
+-- 
+2.34.1
+

shadow-4.9-null-tm.patch

@@ -0,0 +1,70 @@
+Index: shadow-4.5/src/chage.c
+===================================================================
+--- shadow-4.5.orig/src/chage.c
++++ shadow-4.5/src/chage.c
+@@ -168,6 +168,10 @@ static void date_to_str (char *buf, size
+ 	struct tm *tp;
+ 
+ 	tp = gmtime (&date);
++	if (tp == NULL) {
++		(void) snprintf (buf, maxsize, "(unknown)");
++		return;
++	}
+ #ifdef HAVE_STRFTIME
+ 	(void) strftime (buf, maxsize, "%Y-%m-%d", tp);
+ #else
+Index: shadow-4.5/src/lastlog.c
+===================================================================
+--- shadow-4.5.orig/src/lastlog.c
++++ shadow-4.5/src/lastlog.c
+@@ -158,13 +158,17 @@ static void print_one (/*@null@*/const s
+ 
+ 	ll_time = ll.ll_time;
+ 	tm = localtime (&ll_time);
++	if (tm == NULL) {
++		cp = "(unknown)";
++	} else {
+ #ifdef HAVE_STRFTIME
+-	strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
+-	cp = ptime;
++		strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
++		cp = ptime;
+ #else
+-	cp = asctime (tm);
+-	cp[24] = '\0';
++		cp = asctime (tm);
++		cp[24] = '\0';
+ #endif
++	}
+ 
+ 	if (ll.ll_time == (time_t) 0) {
+ 		cp = _("**Never logged in**\0");
+Index: shadow-4.5/src/passwd.c
+===================================================================
+--- shadow-4.5.orig/src/passwd.c
++++ shadow-4.5/src/passwd.c
+@@ -455,6 +455,9 @@ static /*@observer@*/const char *date_to
+ 	struct tm *tm;
+ 
+ 	tm = gmtime (&t);
++	if (tm == NULL) {
++		return "(unknown)";
++	}
+ #ifdef HAVE_STRFTIME
+ 	(void) strftime (buf, sizeof buf, "%m/%d/%Y", tm);
+ #else				/* !HAVE_STRFTIME */
+Index: shadow-4.5/src/usermod.c
+===================================================================
+--- shadow-4.5.orig/src/usermod.c
++++ shadow-4.5/src/usermod.c
+@@ -210,6 +210,10 @@ static void date_to_str (/*@unique@*//*@
+ 	} else {
+ 		time_t t = (time_t) date;
+ 		tp = gmtime (&t);
++		if (tp == NULL) {
++			strncpy (buf, "unknown", maxsize);
++			return;
++		}
+ #ifdef HAVE_STRFTIME
+ 		strftime (buf, maxsize, "%Y-%m-%d", tp);
+ #else

shadow-4.9-pwck-fix-segfault-when-calling-fprintf.patch

@@ -0,0 +1,30 @@
+From d8e54618feea201987c1f3cb402ed50d1d8b604f Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Mon, 15 Nov 2021 12:40:15 +0100
+Subject: [PATCH] pwck: fix segfault when calling fprintf()
+
+As shadow_logfd variable is not set at the beginning of the program if
+something fails and fprintf() is called a segmentation fault happens.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2021339
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ src/pwck.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/pwck.c b/src/pwck.c
+index 4248944a..4ce86af2 100644
+--- a/src/pwck.c
++++ b/src/pwck.c
+@@ -857,6 +857,7 @@ int main (int argc, char **argv)
+ 	 * Get my name so that I can use it to report errors.
+ 	 */
+ 	Prog = Basename (argv[0]);
++	shadow_logfd = stderr;
+ 
+ 	(void) setlocale (LC_ALL, "");
+ 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
+-- 
+2.31.1
+

shadow-4.9-redhat.patch

@@ -0,0 +1,41 @@
+diff -up shadow-4.9/src/useradd.c.redhat shadow-4.9/src/useradd.c
+--- shadow-4.9/src/useradd.c.redhat	2021-07-22 23:55:35.000000000 +0200
++++ shadow-4.9/src/useradd.c	2021-08-02 11:45:11.942867250 +0200
+@@ -104,7 +104,7 @@ FILE *shadow_logfd = NULL;
+ static gid_t def_group = 1000;
+ static const char *def_gname = "other";
+ static const char *def_home = "/home";
+-static const char *def_shell = "/bin/bash";
++static const char *def_shell = "/sbin/nologin";
+ static const char *def_template = SKEL_DIR;
+ static const char *def_create_mail_spool = "yes";
+ 
+@@ -114,7 +114,7 @@ static const char *def_expire = "";
+ #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
+ 
+ static const char *user_name = "";
+-static const char *user_pass = "!";
++static const char *user_pass = "!!";
+ static uid_t user_id;
+ static gid_t user_gid;
+ static const char *user_comment = "";
+@@ -1204,9 +1204,9 @@ static void process_flags (int argc, cha
+ 		};
+ 		while ((c = getopt_long (argc, argv,
+ #ifdef WITH_SELINUX
+-		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:UZ:",
++		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:UZ:",
+ #else				/* !WITH_SELINUX */
+-		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:U",
++		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:U",
+ #endif				/* !WITH_SELINUX */
+ 		                         long_options, NULL)) != -1) {
+ 			switch (c) {
+@@ -1363,6 +1363,7 @@ static void process_flags (int argc, cha
+ 			case 'M':
+ 				Mflg = true;
+ 				break;
++			case 'n':
+ 			case 'N':
+ 				Nflg = true;
+ 				break;

shadow-4.9-rename-prog-to-shadow-progname.patch

@@ -0,0 +1,507 @@
+diff -up shadow-4.9/lib/commonio.c.debug2 shadow-4.9/lib/commonio.c
+--- shadow-4.9/lib/commonio.c.debug2	2022-01-10 10:57:47.535238522 +0100
++++ shadow-4.9/lib/commonio.c	2022-01-10 10:57:47.544238586 +0100
+@@ -147,7 +147,7 @@ static int do_lock_file (const char *fil
+ 		if (log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: %s: %s\n",
+-			                Prog, file, strerror (errno));
++			                shadow_progname, file, strerror (errno));
+ 		}
+ 		return 0;
+ 	}
+@@ -159,7 +159,7 @@ static int do_lock_file (const char *fil
+ 		if (log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: %s file write error: %s\n",
+-			                Prog, file, strerror (errno));
++			                shadow_progname, file, strerror (errno));
+ 		}
+ 		(void) close (fd);
+ 		unlink (file);
+@@ -169,7 +169,7 @@ static int do_lock_file (const char *fil
+ 		if (log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: %s file sync error: %s\n",
+-			                Prog, file, strerror (errno));
++			                shadow_progname, file, strerror (errno));
+ 		}
+ 		(void) close (fd);
+ 		unlink (file);
+@@ -182,7 +182,7 @@ static int do_lock_file (const char *fil
+ 		if ((0==retval) && log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: %s: lock file already used\n",
+-			                Prog, file);
++			                shadow_progname, file);
+ 		}
+ 		unlink (file);
+ 		return retval;
+@@ -193,7 +193,7 @@ static int do_lock_file (const char *fil
+ 		if (log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: %s: %s\n",
+-			                Prog, lock, strerror (errno));
++			                shadow_progname, lock, strerror (errno));
+ 		}
+ 		unlink (file);
+ 		errno = EINVAL;
+@@ -205,7 +205,7 @@ static int do_lock_file (const char *fil
+ 		if (log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: existing lock file %s without a PID\n",
+-			                Prog, lock);
++			                shadow_progname, lock);
+ 		}
+ 		unlink (file);
+ 		errno = EINVAL;
+@@ -216,7 +216,7 @@ static int do_lock_file (const char *fil
+ 		if (log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: existing lock file %s with an invalid PID '%s'\n",
+-			                Prog, lock, buf);
++			                shadow_progname, lock, buf);
+ 		}
+ 		unlink (file);
+ 		errno = EINVAL;
+@@ -226,7 +226,7 @@ static int do_lock_file (const char *fil
+ 		if (log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: lock %s already used by PID %lu\n",
+-			                Prog, lock, (unsigned long) pid);
++			                shadow_progname, lock, (unsigned long) pid);
+ 		}
+ 		unlink (file);
+ 		errno = EEXIST;
+@@ -236,7 +236,7 @@ static int do_lock_file (const char *fil
+ 		if (log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: cannot get lock %s: %s\n",
+-			                Prog, lock, strerror (errno));
++			                shadow_progname, lock, strerror (errno));
+ 		}
+ 		unlink (file);
+ 		return 0;
+@@ -248,13 +248,13 @@ static int do_lock_file (const char *fil
+ 		if ((0==retval) && log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: %s: lock file already used\n",
+-			                Prog, file);
++			                shadow_progname, file);
+ 		}
+ 	} else {
+ 		if (log) {
+ 			(void) fprintf (shadow_logfd,
+ 			                "%s: cannot get lock %s: %s\n",
+-			                Prog, lock, strerror (errno));
++			                shadow_progname, lock, strerror (errno));
+ 		}
+ 	}
+ 
+@@ -449,7 +449,7 @@ int commonio_lock (struct commonio_db *d
+ 				if (geteuid () != 0) {
+ 					(void) fprintf (shadow_logfd,
+ 					                "%s: Permission denied.\n",
+-					                Prog);
++					                shadow_progname);
+ 				}
+ 				return 0;	/* failure */
+ 			}
+@@ -484,7 +484,7 @@ int commonio_lock (struct commonio_db *d
+ 		/* no unnecessary retries on "permission denied" errors */
+ 		if (geteuid () != 0) {
+ 			(void) fprintf (shadow_logfd, "%s: Permission denied.\n",
+-			                Prog);
++			                shadow_progname);
+ 			return 0;
+ 		}
+ 	}
+diff -up shadow-4.9/lib/nscd.c.debug2 shadow-4.9/lib/nscd.c
+--- shadow-4.9/lib/nscd.c.debug2	2022-01-10 10:57:47.537238536 +0100
++++ shadow-4.9/lib/nscd.c	2022-01-10 10:57:47.544238586 +0100
+@@ -26,7 +26,7 @@ int nscd_flush_cache (const char *servic
+ 
+ 	if (run_command (cmd, spawnedArgs, spawnedEnv, &status) != 0) {
+ 		/* run_command writes its own more detailed message. */
+-		(void) fprintf (shadow_logfd, _(MSG_NSCD_FLUSH_CACHE_FAILED), Prog);
++		(void) fprintf (shadow_logfd, _(MSG_NSCD_FLUSH_CACHE_FAILED), shadow_progname);
+ 		return -1;
+ 	}
+ 
+@@ -34,7 +34,7 @@ int nscd_flush_cache (const char *servic
+ 	if (!WIFEXITED (status)) {
+ 		(void) fprintf (shadow_logfd,
+ 		                _("%s: nscd did not terminate normally (signal %d)\n"),
+-		                Prog, WTERMSIG (status));
++		                shadow_progname, WTERMSIG (status));
+ 		return -1;
+ 	} else if (code == E_CMD_NOTFOUND) {
+ 		/* nscd is not installed, or it is installed but uses an
+@@ -45,8 +45,8 @@ int nscd_flush_cache (const char *servic
+ 		return 0;
+ 	} else if (code != 0) {
+ 		(void) fprintf (shadow_logfd, _("%s: nscd exited with status %d\n"),
+-		                Prog, code);
+-		(void) fprintf (shadow_logfd, _(MSG_NSCD_FLUSH_CACHE_FAILED), Prog);
++		                shadow_progname, code);
++		(void) fprintf (shadow_logfd, _(MSG_NSCD_FLUSH_CACHE_FAILED), shadow_progname);
+ 		return -1;
+ 	}
+ 
+diff -up shadow-4.9/lib/selinux.c.debug2 shadow-4.9/lib/selinux.c
+--- shadow-4.9/lib/selinux.c.debug2	2022-01-10 10:57:47.538238543 +0100
++++ shadow-4.9/lib/selinux.c	2022-01-10 10:57:47.544238586 +0100
+@@ -216,7 +216,7 @@ int check_selinux_permit (const char *pe
+ 	if (getprevcon_raw (&user_context_raw) != 0) {
+ 		fprintf (shadow_logfd,
+ 		    _("%s: can not get previous SELinux process context: %s\n"),
+-		    Prog, strerror (errno));
++		    shadow_progname, strerror (errno));
+ 		SYSLOG ((LOG_WARN,
+ 		    "can not get previous SELinux process context: %s",
+ 		    strerror (errno)));
+diff -up shadow-4.9/lib/shadowlog.c.debug2 shadow-4.9/lib/shadowlog.c
+--- shadow-4.9/lib/shadowlog.c.debug2	2022-01-10 10:57:47.538238543 +0100
++++ shadow-4.9/lib/shadowlog.c	2022-01-10 10:57:47.544238586 +0100
+@@ -2,14 +2,17 @@
+ 
+ #include "lib/shadowlog_internal.h"
+ 
++const char *shadow_progname;
++FILE *shadow_logfd;
++
+ void log_set_progname(const char *progname)
+ {
+-	Prog = progname;
++	shadow_progname = progname;
+ }
+ 
+ const char *log_get_progname(void)
+ {
+-	return Prog;
++	return shadow_progname;
+ }
+ 
+ void log_set_logfd(FILE *fd)
+diff -up shadow-4.9/lib/shadowlog_internal.h.debug2 shadow-4.9/lib/shadowlog_internal.h
+--- shadow-4.9/lib/shadowlog_internal.h.debug2	2022-01-10 10:57:47.538238543 +0100
++++ shadow-4.9/lib/shadowlog_internal.h	2022-01-10 10:57:47.544238586 +0100
+@@ -1,2 +1,2 @@
+-const char *Prog; /* Program name showed in error messages */
+-FILE *shadow_logfd;  /* file descripter to which error messages are printed */
++extern const char *shadow_progname; /* Program name showed in error messages */
++extern FILE *shadow_logfd;  /* file descripter to which error messages are printed */
+diff -up shadow-4.9/lib/spawn.c.debug2 shadow-4.9/lib/spawn.c
+--- shadow-4.9/lib/spawn.c.debug2	2022-01-10 10:57:47.538238543 +0100
++++ shadow-4.9/lib/spawn.c	2022-01-10 10:57:47.544238586 +0100
+@@ -60,11 +60,11 @@ int run_command (const char *cmd, const
+ 			exit (E_CMD_NOTFOUND);
+ 		}
+ 		fprintf (shadow_logfd, "%s: cannot execute %s: %s\n",
+-		         Prog, cmd, strerror (errno));
++		         shadow_progname, cmd, strerror (errno));
+ 		exit (E_CMD_NOEXEC);
+ 	} else if ((pid_t)-1 == pid) {
+ 		fprintf (shadow_logfd, "%s: cannot execute %s: %s\n",
+-		         Prog, cmd, strerror (errno));
++		         shadow_progname, cmd, strerror (errno));
+ 		return -1;
+ 	}
+ 
+@@ -77,7 +77,7 @@ int run_command (const char *cmd, const
+ 
+ 	if ((pid_t)-1 == wpid) {
+ 		fprintf (shadow_logfd, "%s: waitpid (status: %d): %s\n",
+-		         Prog, *status, strerror (errno));
++		         shadow_progname, *status, strerror (errno));
+ 		return -1;
+ 	}
+ 
+diff -up shadow-4.9/lib/sssd.c.debug2 shadow-4.9/lib/sssd.c
+--- shadow-4.9/lib/sssd.c.debug2	2022-01-10 10:57:47.538238543 +0100
++++ shadow-4.9/lib/sssd.c	2022-01-10 10:57:47.544238586 +0100
+@@ -48,22 +48,22 @@ int sssd_flush_cache (int dbflags)
+ 	free(sss_cache_args);
+ 	if (rv != 0) {
+ 		/* run_command writes its own more detailed message. */
+-		SYSLOG ((LOG_WARN, MSG_SSSD_FLUSH_CACHE_FAILED, Prog));
++		SYSLOG ((LOG_WARN, MSG_SSSD_FLUSH_CACHE_FAILED, shadow_progname));
+ 		return -1;
+ 	}
+ 
+ 	code = WEXITSTATUS (status);
+ 	if (!WIFEXITED (status)) {
+ 		SYSLOG ((LOG_WARN, "%s: sss_cache did not terminate normally (signal %d)",
+-			Prog, WTERMSIG (status)));
++			shadow_progname, WTERMSIG (status)));
+ 		return -1;
+ 	} else if (code == E_CMD_NOTFOUND) {
+ 		/* sss_cache is not installed, or it is installed but uses an
+ 		   interpreter that is missing.  Probably the former. */
+ 		return 0;
+ 	} else if (code != 0) {
+-		SYSLOG ((LOG_WARN, "%s: sss_cache exited with status %d", Prog, code));
+-		SYSLOG ((LOG_WARN, MSG_SSSD_FLUSH_CACHE_FAILED, Prog));
++		SYSLOG ((LOG_WARN, "%s: sss_cache exited with status %d", shadow_progname, code));
++		SYSLOG ((LOG_WARN, MSG_SSSD_FLUSH_CACHE_FAILED, shadow_progname));
+ 		return -1;
+ 	}
+ 
+diff -up shadow-4.9/lib/tcbfuncs.c.debug2 shadow-4.9/lib/tcbfuncs.c
+--- shadow-4.9/lib/tcbfuncs.c.debug2	2022-01-10 10:57:47.538238543 +0100
++++ shadow-4.9/lib/tcbfuncs.c	2022-01-10 10:59:01.228764507 +0100
+@@ -74,7 +74,7 @@ shadowtcb_status shadowtcb_gain_priv (vo
+  * to exit soon.
+  */
+ #define OUT_OF_MEMORY do { \
+-	fprintf (shadow_logfd, _("%s: out of memory\n"), Prog); \
++	fprintf (shadow_logfd, _("%s: out of memory\n"), shadow_progname); \
+ 	(void) fflush (shadow_logfd); \
+ } while (false)
+ 
+@@ -120,7 +120,7 @@ static /*@null@*/ char *shadowtcb_path_r
+ 	if (lstat (path, &st) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot stat %s: %s\n"),
+-		         Prog, path, strerror (errno));
++		         shadow_progname, path, strerror (errno));
+ 		free (path);
+ 		return NULL;
+ 	}
+@@ -136,7 +136,7 @@ static /*@null@*/ char *shadowtcb_path_r
+ 	if (!S_ISLNK (st.st_mode)) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: %s is neither a directory, nor a symlink.\n"),
+-		         Prog, path);
++		         shadow_progname, path);
+ 		free (path);
+ 		return NULL;
+ 	}
+@@ -144,7 +144,7 @@ static /*@null@*/ char *shadowtcb_path_r
+ 	if (-1 == ret) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot read symbolic link %s: %s\n"),
+-		         Prog, path, strerror (errno));
++		         shadow_progname, path, strerror (errno));
+ 		free (path);
+ 		return NULL;
+ 	}
+@@ -153,7 +153,7 @@ static /*@null@*/ char *shadowtcb_path_r
+ 		link[sizeof(link) - 1] = '\0';
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Suspiciously long symlink: %s\n"),
+-		         Prog, link);
++		         shadow_progname, link);
+ 		return NULL;
+ 	}
+ 	link[(size_t)ret] = '\0';
+@@ -211,7 +211,7 @@ static shadowtcb_status mkdir_leading (c
+ 	if (stat (TCB_DIR, &st) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot stat %s: %s\n"),
+-		         Prog, TCB_DIR, strerror (errno));
++		         shadow_progname, TCB_DIR, strerror (errno));
+ 		goto out_free_path;
+ 	}
+ 	while ((ind = strchr (ptr, '/'))) {
+@@ -223,19 +223,19 @@ static shadowtcb_status mkdir_leading (c
+ 		if ((mkdir (dir, 0700) != 0) && (errno != EEXIST)) {
+ 			fprintf (shadow_logfd,
+ 			         _("%s: Cannot create directory %s: %s\n"),
+-			         Prog, dir, strerror (errno));
++			         shadow_progname, dir, strerror (errno));
+ 			goto out_free_dir;
+ 		}
+ 		if (chown (dir, 0, st.st_gid) != 0) {
+ 			fprintf (shadow_logfd,
+ 			         _("%s: Cannot change owner of %s: %s\n"),
+-			         Prog, dir, strerror (errno));
++			         shadow_progname, dir, strerror (errno));
+ 			goto out_free_dir;
+ 		}
+ 		if (chmod (dir, 0711) != 0) {
+ 			fprintf (shadow_logfd,
+ 			         _("%s: Cannot change mode of %s: %s\n"),
+-			         Prog, dir, strerror (errno));
++			         shadow_progname, dir, strerror (errno));
+ 			goto out_free_dir;
+ 		}
+ 		free (dir);
+@@ -265,7 +265,7 @@ static shadowtcb_status unlink_suffs (co
+ 		if ((unlink (tmp) != 0) && (errno != ENOENT)) {
+ 			fprintf (shadow_logfd,
+ 			         _("%s: unlink: %s: %s\n"),
+-			         Prog, tmp, strerror (errno));
++			         shadow_progname, tmp, strerror (errno));
+ 			free (tmp);
+ 			return SHADOWTCB_FAILURE;
+ 		}
+@@ -290,7 +290,7 @@ static shadowtcb_status rmdir_leading (c
+ 			if (errno != ENOTEMPTY) {
+ 				fprintf (shadow_logfd,
+ 				         _("%s: Cannot remove directory %s: %s\n"),
+-				         Prog, dir, strerror (errno));
++				         shadow_progname, dir, strerror (errno));
+ 				ret = SHADOWTCB_FAILURE;
+ 			}
+ 			free (dir);
+@@ -319,7 +319,7 @@ static shadowtcb_status move_dir (const
+ 	if (stat (olddir, &oldmode) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot stat %s: %s\n"),
+-		         Prog, olddir, strerror (errno));
++		         shadow_progname, olddir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	old_uid = oldmode.st_uid;
+@@ -346,7 +346,7 @@ static shadowtcb_status move_dir (const
+ 	if (rename (real_old_dir, real_new_dir) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot rename %s to %s: %s\n"),
+-		         Prog, real_old_dir, real_new_dir, strerror (errno));
++		         shadow_progname, real_old_dir, real_new_dir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	if (rmdir_leading (real_old_dir_rel) == SHADOWTCB_FAILURE) {
+@@ -355,7 +355,7 @@ static shadowtcb_status move_dir (const
+ 	if ((unlink (olddir) != 0) && (errno != ENOENT)) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot remove %s: %s\n"),
+-		         Prog, olddir, strerror (errno));
++		         shadow_progname, olddir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	if (asprintf (&newdir, TCB_DIR "/%s", user_newname) == -1) {
+@@ -369,7 +369,7 @@ static shadowtcb_status move_dir (const
+ 	    && (symlink (real_new_dir_rel, newdir) != 0)) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot create symbolic link %s: %s\n"),
+-		         Prog, real_new_dir_rel, strerror (errno));
++		         shadow_progname, real_new_dir_rel, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	ret = SHADOWTCB_SUCCESS;
+@@ -468,31 +468,31 @@ shadowtcb_status shadowtcb_move (/*@NULL
+ 	if (stat (tcbdir, &dirmode) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot stat %s: %s\n"),
+-		         Prog, tcbdir, strerror (errno));
++		         shadow_progname, tcbdir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	if (chown (tcbdir, 0, 0) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot change owners of %s: %s\n"),
+-		         Prog, tcbdir, strerror (errno));
++		         shadow_progname, tcbdir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	if (chmod (tcbdir, 0700) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot change mode of %s: %s\n"),
+-		         Prog, tcbdir, strerror (errno));
++		         shadow_progname, tcbdir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	if (lstat (shadow, &filemode) != 0) {
+ 		if (errno != ENOENT) {
+ 			fprintf (shadow_logfd,
+ 			         _("%s: Cannot lstat %s: %s\n"),
+-			         Prog, shadow, strerror (errno));
++			         shadow_progname, shadow, strerror (errno));
+ 			goto out_free;
+ 		}
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Warning, user %s has no tcb shadow file.\n"),
+-		         Prog, user_newname);
++		         shadow_progname, user_newname);
+ 	} else {
+ 		if (!S_ISREG (filemode.st_mode) ||
+ 			filemode.st_nlink != 1) {
+@@ -500,19 +500,19 @@ shadowtcb_status shadowtcb_move (/*@NULL
+ 			         _("%s: Emergency: %s's tcb shadow is not a "
+ 			           "regular file with st_nlink=1.\n"
+ 			           "The account is left locked.\n"),
+-			         Prog, user_newname);
++			         shadow_progname, user_newname);
+ 			goto out_free;
+ 		}
+ 		if (chown (shadow, user_newid, filemode.st_gid) != 0) {
+ 			fprintf (shadow_logfd,
+ 			         _("%s: Cannot change owner of %s: %s\n"),
+-			         Prog, shadow, strerror (errno));
++			         shadow_progname, shadow, strerror (errno));
+ 			goto out_free;
+ 		}
+ 		if (chmod (shadow, filemode.st_mode & 07777) != 0) {
+ 			fprintf (shadow_logfd,
+ 			         _("%s: Cannot change mode of %s: %s\n"),
+-			         Prog, shadow, strerror (errno));
++			         shadow_progname, shadow, strerror (errno));
+ 			goto out_free;
+ 		}
+ 	}
+@@ -522,7 +522,7 @@ shadowtcb_status shadowtcb_move (/*@NULL
+ 	if (chown (tcbdir, user_newid, dirmode.st_gid) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot change owner of %s: %s\n"),
+-		         Prog, tcbdir, strerror (errno));
++		         shadow_progname, tcbdir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	ret = SHADOWTCB_SUCCESS;
+@@ -547,7 +547,7 @@ shadowtcb_status shadowtcb_create (const
+ 	if (stat (TCB_DIR, &tcbdir_stat) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot stat %s: %s\n"),
+-		         Prog, TCB_DIR, strerror (errno));
++		         shadow_progname, TCB_DIR, strerror (errno));
+ 		return SHADOWTCB_FAILURE;
+ 	}
+ 	shadowgid = tcbdir_stat.st_gid;
+@@ -567,39 +567,39 @@ shadowtcb_status shadowtcb_create (const
+ 	if (mkdir (dir, 0700) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: mkdir: %s: %s\n"),
+-		         Prog, dir, strerror (errno));
++		         shadow_progname, dir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	fd = open (shadow, O_RDWR | O_CREAT | O_TRUNC, 0600);
+ 	if (fd < 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot open %s: %s\n"),
+-		         Prog, shadow, strerror (errno));
++		         shadow_progname, shadow, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	close (fd);
+ 	if (chown (shadow, 0, authgid) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot change owner of %s: %s\n"),
+-		         Prog, shadow, strerror (errno));
++		         shadow_progname, shadow, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	if (chmod (shadow, (mode_t) ((authgid == shadowgid) ? 0600 : 0640)) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot change mode of %s: %s\n"),
+-		         Prog, shadow, strerror (errno));
++		         shadow_progname, shadow, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	if (chown (dir, 0, authgid) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot change owner of %s: %s\n"),
+-		         Prog, dir, strerror (errno));
++		         shadow_progname, dir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	if (chmod (dir, (mode_t) ((authgid == shadowgid) ? 02700 : 02710)) != 0) {
+ 		fprintf (shadow_logfd,
+ 		         _("%s: Cannot change mode of %s: %s\n"),
+-		         Prog, dir, strerror (errno));
++		         shadow_progname, dir, strerror (errno));
+ 		goto out_free;
+ 	}
+ 	if (   (shadowtcb_set_user (name) == SHADOWTCB_FAILURE)

shadow-4.9-revert-useradd-fix-memleak.patch

@@ -0,0 +1,30 @@
+From 4624e9fca1b02b64e25e8b2280a0186182ab73ba Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serge@hallyn.com>
+Date: Sat, 14 Aug 2021 19:37:24 -0500
+Subject: [PATCH] Revert "useradd.c:fix memleaks of grp"
+
+In some cases, the value which was being freed is not actually
+safe to free.
+
+Closes #394
+
+This reverts commit c44b71cec25d60efc51aec9de3abce1f6efbfcf5.
+---
+ src/useradd.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index f90127cd..0d3f390d 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -413,7 +413,6 @@ static void get_defaults (void)
+ 			} else {
+ 				def_group = grp->gr_gid;
+ 				def_gname = xstrdup (grp->gr_name);
+-				gr_free(grp);
+ 			}
+ 		}
+ 
+-- 
+2.31.1
+

shadow-4.9-semanage-close-the-selabel-handle.patch

@@ -0,0 +1,61 @@
+From 234af5cf67fc1a3ba99fc246ba65869a3c416545 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Fri, 8 Oct 2021 13:13:13 +0200
+Subject: [PATCH] semanage: close the selabel handle
+
+Close the selabel handle to update the file_context. This means that the
+file_context will be remmaped and used by selabel_lookup() to return
+the appropriate context to label the home folder.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1993081
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ lib/prototypes.h | 1 +
+ lib/selinux.c    | 5 +++++
+ lib/semanage.c   | 1 +
+ 3 files changed, 7 insertions(+)
+
+diff --git a/lib/prototypes.h b/lib/prototypes.h
+index 1d1586d4..b697e0ec 100644
+--- a/lib/prototypes.h
++++ b/lib/prototypes.h
+@@ -392,6 +392,7 @@ extern /*@observer@*/const char *crypt_make_salt (/*@null@*//*@observer@*/const
+ /* selinux.c */
+ #ifdef WITH_SELINUX
+ extern int set_selinux_file_context (const char *dst_name, mode_t mode);
++extern void reset_selinux_handle (void);
+ extern int reset_selinux_file_context (void);
+ extern int check_selinux_permit (const char *perm_name);
+ #endif
+diff --git a/lib/selinux.c b/lib/selinux.c
+index c83545f9..b075d4c0 100644
+--- a/lib/selinux.c
++++ b/lib/selinux.c
+@@ -50,6 +50,11 @@ static void cleanup(void)
+ 	}
+ }
+ 
++void reset_selinux_handle (void)
++{
++    cleanup();
++}
++
+ /*
+  * set_selinux_file_context - Set the security context before any file or
+  *                            directory creation.
+diff --git a/lib/semanage.c b/lib/semanage.c
+index 0d30456a..a5bf9218 100644
+--- a/lib/semanage.c
++++ b/lib/semanage.c
+@@ -293,6 +293,7 @@ int set_seuser (const char *login_name, const char *seuser_name)
+ 	}
+ 
+ 	ret = 0;
++	reset_selinux_handle();
+ 
+ done:
+ 	semanage_seuser_key_free (key);
+-- 
+2.31.1
+

shadow-4.9-shadow-progname-default-init.patch

@@ -0,0 +1,39 @@
+diff -up shadow-4.9/lib/shadowlog.c.debug3 shadow-4.9/lib/shadowlog.c
+--- shadow-4.9/lib/shadowlog.c.debug3	2022-01-10 11:16:31.636261531 +0100
++++ shadow-4.9/lib/shadowlog.c	2022-01-10 11:16:31.637261538 +0100
+@@ -2,8 +2,8 @@
+ 
+ #include "lib/shadowlog_internal.h"
+ 
+-const char *shadow_progname;
+-FILE *shadow_logfd;
++const char *shadow_progname = "libshadow";
++FILE *shadow_logfd = NULL;
+ 
+ void log_set_progname(const char *progname)
+ {
+diff -up shadow-4.9/libsubid/api.c.debug3 shadow-4.9/libsubid/api.c
+--- shadow-4.9/libsubid/api.c.debug3	2022-01-10 11:16:31.637261538 +0100
++++ shadow-4.9/libsubid/api.c	2022-01-10 11:17:15.431574120 +0100
+@@ -40,17 +40,16 @@
+ #include "subid.h"
+ #include "shadowlog.h"
+ 
+-const char *Prog = "(libsubid)";
+-
+ bool libsubid_init(const char *progname, FILE * logfd)
+ {
+ 	FILE *shadow_logfd;
+ 	if (progname) {
+ 		progname = strdup(progname);
+-		if (progname)
+-			Prog = progname;
+-		else
++		if (!progname)
+ 			return false;
++		log_set_progname(progname);
++	} else {
++		log_set_progname("(libsubid)");
+ 	}
+ 
+ 	if (logfd) {

shadow-4.9-useradd-avoid-generating-empty-subid-range.patch

@@ -0,0 +1,79 @@
+diff --git a/src/useradd.c b/src/useradd.c
+index baeffb35..9abeea6e 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -142,9 +142,7 @@ static bool is_sub_gid = false;
+ static bool sub_uid_locked = false;
+ static bool sub_gid_locked = false;
+ static uid_t sub_uid_start;	/* New subordinate uid range */
+-static unsigned long sub_uid_count;
+ static gid_t sub_gid_start;	/* New subordinate gid range */
+-static unsigned long sub_gid_count;
+ #endif				/* ENABLE_SUBIDS */
+ static bool pw_locked = false;
+ static bool gr_locked = false;
+@@ -234,7 +232,7 @@ static void open_shadow (void);
+ static void faillog_reset (uid_t);
+ static void lastlog_reset (uid_t);
+ static void tallylog_reset (const char *);
+-static void usr_update (void);
++static void usr_update (unsigned long subuid_count, unsigned long subgid_count);
+ static void create_home (void);
+ static void create_mail (void);
+ static void check_uid_range(int rflg, uid_t user_id);
+@@ -2092,7 +2090,7 @@ static void tallylog_reset (const char *user_name)
+  *	usr_update() creates the password file entries for this user
+  *	and will update the group entries if required.
+  */
+-static void usr_update (void)
++static void usr_update (unsigned long subuid_count, unsigned long subgid_count)
+ {
+ 	struct passwd pwent;
+ 	struct spwd spent;
+@@ -2155,14 +2153,14 @@ static void usr_update (void)
+ 	}
+ #ifdef ENABLE_SUBIDS
+ 	if (is_sub_uid &&
+-	    (sub_uid_add(user_name, sub_uid_start, sub_uid_count) == 0)) {
++	    (sub_uid_add(user_name, sub_uid_start, subuid_count) == 0)) {
+ 		fprintf (stderr,
+ 		         _("%s: failed to prepare the new %s entry\n"),
+ 		         Prog, sub_uid_dbname ());
+ 		fail_exit (E_SUB_UID_UPDATE);
+ 	}
+ 	if (is_sub_gid &&
+-	    (sub_gid_add(user_name, sub_gid_start, sub_gid_count) == 0)) {
++	    (sub_gid_add(user_name, sub_gid_start, subgid_count) == 0)) {
+ 		fprintf (stderr,
+ 		         _("%s: failed to prepare the new %s entry\n"),
+ 		         Prog, sub_uid_dbname ());
+@@ -2624,16 +2622,16 @@ int main (int argc, char **argv)
+ 	}
+ 
+ #ifdef ENABLE_SUBIDS
+-	if (is_sub_uid && sub_uid_count != 0) {
+-		if (find_new_sub_uids(&sub_uid_start, &sub_uid_count) < 0) {
++	if (is_sub_uid && subuid_count != 0) {
++		if (find_new_sub_uids(&sub_uid_start, &subuid_count) < 0) {
+ 			fprintf (stderr,
+ 			         _("%s: can't create subordinate user IDs\n"),
+ 			         Prog);
+ 			fail_exit(E_SUB_UID_UPDATE);
+ 		}
+ 	}
+-	if (is_sub_gid && sub_gid_count != 0) {
+-		if (find_new_sub_gids(&sub_gid_start, &sub_gid_count) < 0) {
++	if (is_sub_gid && subgid_count != 0) {
++		if (find_new_sub_gids(&sub_gid_start, &subgid_count) < 0) {
+ 			fprintf (stderr,
+ 			         _("%s: can't create subordinate group IDs\n"),
+ 			         Prog);
+@@ -2642,7 +2640,7 @@ int main (int argc, char **argv)
+ 	}
+ #endif				/* ENABLE_SUBIDS */
+ 
+-	usr_update ();
++	usr_update (subuid_count, subgid_count);
+ 
+ 	close_files ();
+ 

shadow-4.9-useradd-copy-tree-argument.patch

@@ -0,0 +1,13 @@
+diff --git a/src/useradd.c b/src/useradd.c
+index b463a170..f7c97958 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -2704,7 +2704,7 @@ int main (int argc, char **argv)
+ 	if (mflg) {
+ 		create_home ();
+ 		if (home_added) {
+-			copy_tree (def_template, prefix_user_home, false, false,
++			copy_tree (def_template, prefix_user_home, false, true,
+ 			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
+ 		} else {
+ 			fprintf (stderr,

shadow-4.9-useradd-modify-check-ID-range-for-system-users.patch

@@ -0,0 +1,19 @@
+diff -up shadow-4.9/src/useradd.c.useradd-modify-check-ID-range-for-system-users shadow-4.9/src/useradd.c
+--- shadow-4.9/src/useradd.c.useradd-modify-check-ID-range-for-system-users	2022-08-22 12:50:34.359702764 +0200
++++ shadow-4.9/src/useradd.c	2022-08-22 12:54:25.144463425 +0200
+@@ -2319,12 +2319,10 @@ static void check_uid_range(int rflg, ui
+ {
+ 	uid_t uid_min ;
+ 	uid_t uid_max ;
+-	if(rflg){
+-		uid_min = (uid_t)getdef_ulong("SYS_UID_MIN",101UL);
++	if (rflg) {
+ 		uid_max = (uid_t)getdef_ulong("SYS_UID_MAX",getdef_ulong("UID_MIN",1000UL)-1);
+-		if(uid_min <= uid_max){
+-			if(user_id < uid_min || user_id >uid_max)
+-				fprintf(stderr, _("%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d range.\n"), Prog, user_name, user_id, uid_min, uid_max);
++		if (user_id > uid_max) {
++			fprintf(stderr, _("%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"), Prog, user_name, user_id, uid_max);
+ 		}
+ 	}else{
+ 		uid_min = (uid_t)getdef_ulong("UID_MIN", 1000UL);

shadow-4.9-useradd-stop-last-fail-log-reset.patch

@@ -0,0 +1,42 @@
+From ebf9b232b012725d2be5e750876c7336cf1c37fd Mon Sep 17 00:00:00 2001
+From: David Kalnischkies <david@kalnischkies.de>
+Date: Wed, 24 Aug 2022 13:21:01 +0200
+Subject: [PATCH] useradd: Do not reset non-existent data in {last,fail}log
+
+useradd does not create the files if they don't exist, but if they exist
+it will reset user data even if the data did not exist before creating
+a hole and an explicitly zero'd data point resulting (especially for
+high UIDs) in a lot of zeros ending up in containers and tarballs.
+---
+ src/useradd.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index 6eaeb533..39a744ee 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -1996,8 +1996,9 @@ static void faillog_reset (uid_t uid)
+ 	struct faillog fl;
+ 	int fd;
+ 	off_t offset_uid = (off_t) (sizeof fl) * uid;
++	struct stat st;
+ 
+-	if (access (FAILLOG_FILE, F_OK) != 0) {
++	if (stat (FAILLOG_FILE, &st) != 0 || st.st_size <= offset_uid) {
+ 		return;
+ 	}
+ 
+@@ -2033,8 +2034,9 @@ static void lastlog_reset (uid_t uid)
+ 	int fd;
+ 	off_t offset_uid = (off_t) (sizeof ll) * uid;
+ 	uid_t max_uid;
++	struct stat st;
+ 
+-	if (access (LASTLOG_FILE, F_OK) != 0) {
++	if (stat (LASTLOG_FILE, &st) != 0 || st.st_size <= offset_uid) {
+ 		return;
+ 	}
+ 
+-- 
+2.37.3
+

shadow-4.9-usermod-allow-all-group-types.patch

@@ -0,0 +1,322 @@
+From e481437ab9ebe9a8bf8fbaabe986d42b2f765991 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Tue, 3 Aug 2021 08:57:20 +0200
+Subject: [PATCH] usermod: allow all group types with -G option
+
+The only way of removing a group from the supplementary list is to use
+-G option, and list all groups that the user is a member of except for
+the one that wants to be removed. The problem lies when there's a user
+that contains both local and remote groups, and the group to be removed
+is a local one. As we need to include the remote group with -G option
+the command will fail.
+
+This reverts commit 140510de9de4771feb3af1d859c09604043a4c9b. This way,
+it would be possible to remove the remote groups from the supplementary
+list.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1967641
+Resolves: https://github.com/shadow-maint/shadow/issues/338
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ src/usermod.c | 220 ++++++++++++++++++--------------------------------
+ 1 file changed, 77 insertions(+), 143 deletions(-)
+
+diff --git a/src/usermod.c b/src/usermod.c
+index 03bb9b9d..a0c03afa 100644
+--- a/src/usermod.c
++++ b/src/usermod.c
+@@ -187,7 +187,6 @@ static bool sub_gid_locked = false;
+ static void date_to_str (/*@unique@*//*@out@*/char *buf, size_t maxsize,
+                          long int date);
+ static int get_groups (char *);
+-static struct group * get_local_group (char * grp_name);
+ static /*@noreturn@*/void usage (int status);
+ static void new_pwent (struct passwd *);
+ static void new_spent (struct spwd *);
+@@ -201,9 +200,7 @@ static void grp_update (void);
+ 
+ static void process_flags (int, char **);
+ static void close_files (void);
+-static void close_group_files (void);
+ static void open_files (void);
+-static void open_group_files (void);
+ static void usr_update (void);
+ static void move_home (void);
+ static void update_lastlog (void);
+@@ -260,11 +257,6 @@ static int get_groups (char *list)
+ 		return 0;
+ 	}
+ 
+-	/*
+-	 * Open the group files
+-	 */
+-	open_group_files ();
+-
+ 	/*
+ 	 * So long as there is some data to be converted, strip off each
+ 	 * name and look it up. A mix of numerical and string values for
+@@ -284,7 +276,7 @@ static int get_groups (char *list)
+ 		 * Names starting with digits are treated as numerical GID
+ 		 * values, otherwise the string is looked up as is.
+ 		 */
+-		grp = get_local_group (list);
++		grp = prefix_getgr_nam_gid (list);
+ 
+ 		/*
+ 		 * There must be a match, either by GID value or by
+@@ -334,8 +326,6 @@ static int get_groups (char *list)
+ 		gr_free ((struct group *)grp);
+ 	} while (NULL != list);
+ 
+-	close_group_files ();
+-
+ 	user_groups[ngroups] = (char *) 0;
+ 
+ 	/*
+@@ -348,44 +338,6 @@ static int get_groups (char *list)
+ 	return 0;
+ }
+ 
+-/*
+- * get_local_group - checks if a given group name exists locally
+- *
+- *	get_local_group() checks if a given group name exists locally.
+- *	If the name exists the group information is returned, otherwise NULL is
+- *	returned.
+- */
+-static struct group * get_local_group(char * grp_name)
+-{
+-	const struct group *grp;
+-	struct group *result_grp = NULL;
+-	long long int gid;
+-	char *endptr;
+-
+-	gid = strtoll (grp_name, &endptr, 10);
+-	if (   ('\0' != *grp_name)
+-		&& ('\0' == *endptr)
+-		&& (ERANGE != errno)
+-		&& (gid == (gid_t)gid)) {
+-		grp = gr_locate_gid ((gid_t) gid);
+-	}
+-	else {
+-		grp = gr_locate(grp_name);
+-	}
+-
+-	if (grp != NULL) {
+-		result_grp = __gr_dup (grp);
+-		if (NULL == result_grp) {
+-			fprintf (stderr,
+-					_("%s: Out of memory. Cannot find group '%s'.\n"),
+-					Prog, grp_name);
+-			fail_exit (E_GRP_UPDATE);
+-		}
+-	}
+-
+-	return result_grp;
+-}
+-
+ #ifdef ENABLE_SUBIDS
+ struct ulong_range
+ {
+@@ -1523,7 +1475,50 @@ static void close_files (void)
+ 	}
+ 
+ 	if (Gflg || lflg) {
+-		close_group_files ();
++		if (gr_close () == 0) {
++			fprintf (stderr,
++			         _("%s: failure while writing changes to %s\n"),
++			         Prog, gr_dbname ());
++			SYSLOG ((LOG_ERR,
++			         "failure while writing changes to %s",
++			         gr_dbname ()));
++			fail_exit (E_GRP_UPDATE);
++		}
++#ifdef SHADOWGRP
++		if (is_shadow_grp) {
++			if (sgr_close () == 0) {
++				fprintf (stderr,
++				         _("%s: failure while writing changes to %s\n"),
++				         Prog, sgr_dbname ());
++				SYSLOG ((LOG_ERR,
++				         "failure while writing changes to %s",
++				         sgr_dbname ()));
++				fail_exit (E_GRP_UPDATE);
++			}
++		}
++#endif
++#ifdef SHADOWGRP
++		if (is_shadow_grp) {
++			if (sgr_unlock () == 0) {
++				fprintf (stderr,
++				         _("%s: failed to unlock %s\n"),
++				         Prog, sgr_dbname ());
++				SYSLOG ((LOG_ERR,
++				         "failed to unlock %s",
++				         sgr_dbname ()));
++				/* continue */
++			}
++		}
++#endif
++		if (gr_unlock () == 0) {
++			fprintf (stderr,
++			         _("%s: failed to unlock %s\n"),
++			         Prog, gr_dbname ());
++			SYSLOG ((LOG_ERR,
++			         "failed to unlock %s",
++			         gr_dbname ()));
++			/* continue */
++		}
+ 	}
+ 
+ 	if (is_shadow_pwd) {
+@@ -1592,60 +1587,6 @@ static void close_files (void)
+ #endif
+ }
+ 
+-/*
+- * close_group_files - close all of the files that were opened
+- *
+- *	close_group_files() closes all of the files that were opened related
+- *  with groups. This causes any modified entries to be written out.
+- */
+-static void close_group_files (void)
+-{
+-	if (gr_close () == 0) {
+-		fprintf (stderr,
+-					_("%s: failure while writing changes to %s\n"),
+-					Prog, gr_dbname ());
+-		SYSLOG ((LOG_ERR,
+-					"failure while writing changes to %s",
+-					gr_dbname ()));
+-		fail_exit (E_GRP_UPDATE);
+-	}
+-#ifdef SHADOWGRP
+-	if (is_shadow_grp) {
+-		if (sgr_close () == 0) {
+-			fprintf (stderr,
+-						_("%s: failure while writing changes to %s\n"),
+-						Prog, sgr_dbname ());
+-			SYSLOG ((LOG_ERR,
+-						"failure while writing changes to %s",
+-						sgr_dbname ()));
+-			fail_exit (E_GRP_UPDATE);
+-		}
+-	}
+-#endif
+-#ifdef SHADOWGRP
+-	if (is_shadow_grp) {
+-		if (sgr_unlock () == 0) {
+-			fprintf (stderr,
+-						_("%s: failed to unlock %s\n"),
+-						Prog, sgr_dbname ());
+-			SYSLOG ((LOG_ERR,
+-						"failed to unlock %s",
+-						sgr_dbname ()));
+-			/* continue */
+-		}
+-	}
+-#endif
+-	if (gr_unlock () == 0) {
+-		fprintf (stderr,
+-					_("%s: failed to unlock %s\n"),
+-					Prog, gr_dbname ());
+-		SYSLOG ((LOG_ERR,
+-					"failed to unlock %s",
+-					gr_dbname ()));
+-		/* continue */
+-	}
+-}
+-
+ /*
+  * open_files - lock and open the password files
+  *
+@@ -1681,7 +1622,38 @@ static void open_files (void)
+ 	}
+ 
+ 	if (Gflg || lflg) {
+-		open_group_files ();
++		/*
++		 * Lock and open the group file. This will load all of the
++		 * group entries.
++		 */
++		if (gr_lock () == 0) {
++			fprintf (stderr,
++			         _("%s: cannot lock %s; try again later.\n"),
++			         Prog, gr_dbname ());
++			fail_exit (E_GRP_UPDATE);
++		}
++		gr_locked = true;
++		if (gr_open (O_CREAT | O_RDWR) == 0) {
++			fprintf (stderr,
++			         _("%s: cannot open %s\n"),
++			         Prog, gr_dbname ());
++			fail_exit (E_GRP_UPDATE);
++		}
++#ifdef SHADOWGRP
++		if (is_shadow_grp && (sgr_lock () == 0)) {
++			fprintf (stderr,
++			         _("%s: cannot lock %s; try again later.\n"),
++			         Prog, sgr_dbname ());
++			fail_exit (E_GRP_UPDATE);
++		}
++		sgr_locked = true;
++		if (is_shadow_grp && (sgr_open (O_CREAT | O_RDWR) == 0)) {
++			fprintf (stderr,
++			         _("%s: cannot open %s\n"),
++			         Prog, sgr_dbname ());
++			fail_exit (E_GRP_UPDATE);
++		}
++#endif
+ 	}
+ #ifdef ENABLE_SUBIDS
+ 	if (vflg || Vflg) {
+@@ -1717,44 +1689,6 @@ static void open_files (void)
+ #endif				/* ENABLE_SUBIDS */
+ }
+ 
+-/*
+- * open_group_files - lock and open the group files
+- *
+- *	open_group_files() loads all of the group entries.
+- */
+-static void open_group_files (void)
+-{
+-	if (gr_lock () == 0) {
+-		fprintf (stderr,
+-					_("%s: cannot lock %s; try again later.\n"),
+-					Prog, gr_dbname ());
+-		fail_exit (E_GRP_UPDATE);
+-	}
+-	gr_locked = true;
+-	if (gr_open (O_CREAT | O_RDWR) == 0) {
+-		fprintf (stderr,
+-					_("%s: cannot open %s\n"),
+-					Prog, gr_dbname ());
+-		fail_exit (E_GRP_UPDATE);
+-	}
+-
+-#ifdef SHADOWGRP
+-	if (is_shadow_grp && (sgr_lock () == 0)) {
+-		fprintf (stderr,
+-					_("%s: cannot lock %s; try again later.\n"),
+-					Prog, sgr_dbname ());
+-		fail_exit (E_GRP_UPDATE);
+-	}
+-	sgr_locked = true;
+-	if (is_shadow_grp && (sgr_open (O_CREAT | O_RDWR) == 0)) {
+-		fprintf (stderr,
+-					_("%s: cannot open %s\n"),
+-					Prog, sgr_dbname ());
+-		fail_exit (E_GRP_UPDATE);
+-	}
+-#endif
+-}
+-
+ /*
+  * usr_update - create the user entries
+  *
+-- 
+2.31.1
+

shadow-utils.login.defs

@@ -130,9 +130,10 @@ HOME_MODE	0700
 #
 PASS_MAX_DAYS	99999
 PASS_MIN_DAYS	0
-PASS_MIN_LEN	8
 PASS_WARN_AGE	7
 
+# Currently PASS_MIN_LEN is not supported
+
 # Currently SU_WHEEL_ONLY is not supported
 
 # Currently CRACKLIB_DICTPATH is not supported
@@ -146,7 +147,7 @@ UID_MAX                 60000
 SYS_UID_MIN               201
 SYS_UID_MAX               999
 # Extra per user uids
-SUB_UID_MIN		   524288
+SUB_UID_MIN		   100000
 SUB_UID_MAX		600100000
 SUB_UID_COUNT		    65536
 
@@ -159,7 +160,7 @@ GID_MAX                 60000
 SYS_GID_MIN               201
 SYS_GID_MAX               999
 # Extra per user group ids
-SUB_GID_MIN		   524288
+SUB_GID_MIN		   100000
 SUB_GID_MAX		600100000
 SUB_GID_COUNT		    65536
 
@@ -173,22 +174,11 @@ SUB_GID_COUNT		    65536
 #
 #LOGIN_TIMEOUT		60
 
-#
-# Maximum number of attempts to change password if rejected (too easy)
-#
-PASS_CHANGE_TRIES	5
+# Currently PASS_CHANGE_TRIES is not supported
 
-#
-# Warn about weak passwords (but still allow them) if you are root.
-#
-PASS_ALWAYS_WARN	yes
+# Currently PASS_ALWAYS_WARN is not supported
 
-#
-# Number of significant characters in the password for crypt().
-# Default is 8, don't change unless your crypt() is better.
-# Ignored if MD5_CRYPT_ENAB set to "yes".
-#
-#PASS_MAX_LEN		8
+# Currently PASS_MAX_LEN is not supported
 
 # Currently CHFN_AUTH is not supported
 
@@ -303,13 +293,3 @@ CREATE_HOME	yes
 # missing.
 #
 #FORCE_SHADOW    yes
-
-#
-# Select the HMAC cryptography algorithm.
-# Used in pam_timestamp module to calculate the keyed-hash message
-# authentication code.
-#
-# Note: It is recommended to check hmac(3) to see the possible algorithms
-# that are available in your system.
-#
-HMAC_CRYPTO_ALGO SHA512

shadow-utils.spec

@@ -1,30 +1,91 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
-Version: 4.20.0
-Release: 1%{?dist}
+Version: 4.9
+Release: 12%{?dist}
 Epoch: 2
-License: BSD-3-Clause AND GPL-2.0-or-later
+License: BSD and GPLv2+
 URL: https://github.com/shadow-maint/shadow
-Source0: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz
-Source1: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz.asc
+Source0: https://github.com/shadow-maint/shadow/releases/download/%{version}/shadow-%{version}.tar.xz
+Source1: https://github.com/shadow-maint/shadow/releases/download/%{version}/shadow-%{version}.tar.xz.asc
 Source2: shadow-utils.useradd
 Source3: shadow-utils.login.defs
 Source4: shadow-bsd.txt
 Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
 Source6: shadow-utils.HOME_MODE.xml
-Source7: passwd.pamd
 
 ### Globals ###
 %global includesubiddir %{_includedir}/shadow
-# Fail linking if there are undefined symbols.
-%global _ld_strict_symbol_defs 1
 
 ### Patches ###
+# Misc small changes - most probably non-upstreamable
+Patch0: shadow-4.9-redhat.patch
+# Be more lenient with acceptable user/group names - non upstreamable
+Patch1: shadow-4.8-goodname.patch
+# https://github.com/shadow-maint/shadow/commit/09c752f00f9dfc610f66d68be38c9e5be8ca7f15
+Patch2: shadow-4.9-move-create-home.patch
+# SElinux related - upstreamability unknown
+Patch3: shadow-4.9-default-range.patch
+# Misc manual page changes - non-upstreamable
+Patch4: shadow-4.9-manfix.patch
+# Date parsing improvement - could be upstreamed
+Patch5: shadow-4.2.1-date-parsing.patch
+# Additional error message - could be upstreamed
+Patch6: shadow-4.6-move-home.patch
+# Audit message changes - upstreamability unknown
+Patch7: shadow-4.9-audit-update.patch
+# Changes related to password unlocking - could be upstreamed
+Patch8: shadow-4.5-usermod-unlock.patch
+# Additional SElinux related changes - upstreamability unknown
+Patch9: shadow-4.8-selinux-perms.patch
+# Handle NULL return from *time funcs - could be upstreamed
+Patch10: shadow-4.9-null-tm.patch
+# Handle /etc/passwd corruption - could be upstreamed
+Patch11: shadow-4.8-long-entry.patch
+# Limit uid/gid allocation to non-zero - could be upstreamed
+Patch12: shadow-4.6-sysugid-min-limit.patch
+# Ignore LOGIN_PLAIN_PROMPT in login.defs - upstreamability unknown
+Patch13: shadow-4.8-ignore-login-prompt.patch
+# https://github.com/shadow-maint/shadow/commit/c6847011e8b656adacd9a0d2a78418cad0de34cb
+Patch14: shadow-4.9-newuidmap-libeconf-dependency.patch
+# https://github.com/shadow-maint/shadow/commit/e481437ab9ebe9a8bf8fbaabe986d42b2f765991
+Patch15: shadow-4.9-usermod-allow-all-group-types.patch
+# https://github.com/shadow-maint/shadow/commit/9dd720a28578eef5be8171697aae0906e4c53249
+Patch16: shadow-4.9-useradd-avoid-generating-empty-subid-range.patch
+# https://github.com/shadow-maint/shadow/commit/234e8fa7b134d1ebabfdad980a3ae5b63c046c62
+Patch17: shadow-4.9-libmisc-fix-default-value-in-SHA_get_salt_rounds.patch
+# https://github.com/shadow-maint/shadow/commit/234af5cf67fc1a3ba99fc246ba65869a3c416545
+Patch18: shadow-4.9-semanage-close-the-selabel-handle.patch
+# https://github.com/shadow-maint/shadow/commit/4624e9fca1b02b64e25e8b2280a0186182ab73ba
+Patch19: shadow-4.9-revert-useradd-fix-memleak.patch
+# https://github.com/shadow-maint/shadow/commit/06eb4e4d76ac7f1ac86e68a89b2dc9be7c7323a2
+Patch20: shadow-4.9-useradd-copy-tree-argument.patch
+# https://github.com/shadow-maint/shadow/commit/d8e54618feea201987c1f3cb402ed50d1d8b604f
+Patch21: shadow-4.9-pwck-fix-segfault-when-calling-fprintf.patch
+# https://github.com/shadow-maint/shadow/commit/497e90751bc0d95cc998b0f06305040563903948
+Patch22: shadow-4.9-newgrp-fix-segmentation-fault.patch
+# https://github.com/shadow-maint/shadow/commit/3b6ccf642c6bb2b7db087f09ee563ae9318af734
+Patch23: shadow-4.9-getsubids.patch
+# https://github.com/shadow-maint/shadow/commit/a757b458ffb4fb9a40bcbb4f7869449431c67f83
+Patch24: shadow-4.9-groupdel-fix-sigsegv-when-passwd-does-not-exist.patch
+# https://github.com/shadow-maint/shadow/commit/79157cbad87f42cdc2068d72e798488572c68bb2
+Patch25: shadow-4.9-make-shadow-logfd-and-prog-not-extern.patch
+# https://github.com/shadow-maint/shadow/commit/0e6fe5e728a45baff3977d73e81a27adb6ae30c6
+Patch26: shadow-4.9-rename-prog-to-shadow-progname.patch
+# https://github.com/shadow-maint/shadow/commit/2b0bdef6f9a18382e92b0fb6d893c4339123ffac
+# https://github.com/shadow-maint/shadow/commit/9750fd681919ed558a9b044248a284d567cddf1a
+Patch27: shadow-4.9-shadow-progname-default-init.patch
+# https://github.com/shadow-maint/shadow/commit/e101219ad71de11da3fdd1b3ec2620fd1a97b92c
+Patch28: shadow-4.9-nss-get-shadow-logfd-with-log-get-logfd.patch
+# https://github.com/shadow-maint/shadow/commit/f1f1678e13aa3ae49bdb139efaa2c5bc53dcfe92
+Patch29: shadow-4.9-useradd-modify-check-ID-range-for-system-users.patch
+# https://github.com/shadow-maint/shadow/commit/3ec32f9975f262073f8fbdecd2bfaee4a1d3db48
+Patch30: shadow-4.11.1-subordinateio-also-compare-the-owner-ID.patch
+# https://github.com/shadow-maint/shadow/commit/ebf9b232b012725d2be5e750876c7336cf1c37fd
+Patch31: shadow-4.9-useradd-stop-last-fail-log-reset.patch
 
 ### Dependencies ###
 Requires: audit-libs >= 1.6.5
 Requires: libselinux >= 1.25.2-1
-Requires: pam-libs
 Requires: setup
 
 ### Build Dependencies ###
@@ -37,38 +98,17 @@ BuildRequires: docbook-style-xsl
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: gettext-devel
-BuildRequires: git
 BuildRequires: itstool
 BuildRequires: libacl-devel
 BuildRequires: libattr-devel
-BuildRequires: libcmocka-devel
-BuildRequires: libeconf-devel
 BuildRequires: libselinux-devel >= 1.25.2-1
 BuildRequires: libsemanage-devel
 BuildRequires: libtool
-BuildRequires: libxcrypt-devel
 BuildRequires: libxslt
 BuildRequires: make
-BuildRequires: pam
-BuildRequires: pam-devel
 
 ### Provides ###
 Provides: shadow = %{epoch}:%{version}-%{release}
-Provides: passwd = 0.80-18
-Obsoletes: passwd <= 0.80-19
-
-%if "%{_sbindir}" == "%{_bindir}"
-# Compat symlinks for Requires in other packages.
-# We rely on filesystem to create the symlinks for us.
-Requires: filesystem(unmerged-sbin-symlinks)
-Provides: /usr/sbin/adduser
-Provides: /usr/sbin/useradd
-Provides: /usr/sbin/userdel
-Provides: /usr/sbin/usermod
-Provides: /usr/sbin/groupadd
-Provides: /usr/sbin/groupdel
-Provides: /usr/sbin/groupmod
-%endif
 
 %description
 The shadow-utils package includes the necessary programs for
@@ -77,14 +117,16 @@ programs for managing user and group accounts. The pwconv command
 converts passwords to the shadow password format. The pwunconv command
 unconverts shadow passwords and generates a passwd file (a standard
 UNIX password file). The pwck command checks the integrity of password
-and shadow files. The useradd, userdel, and usermod commands are used
-for managing user accounts. The groupadd, groupdel, and groupmod
-commands are used for managing group accounts.
+and shadow files. The lastlog command prints out the last login times
+for all users. The useradd, userdel, and usermod commands are used for
+managing user accounts. The groupadd, groupdel, and groupmod commands
+are used for managing group accounts.
 
 
 ### Subpackages ###
 %package subid
 Summary: A library to manage subordinate uid and gid ranges
+License: BSD and GPLv2+
 
 %description subid
 Utility library that provides a way to manage subid ranges.
@@ -92,13 +134,45 @@ Utility library that provides a way to manage subid ranges.
 
 %package subid-devel
 Summary: Development package for shadow-utils-subid
-Requires: shadow-utils-subid = %{epoch}:%{version}-%{release}
+License: BSD and GPLv2+
 
 %description subid-devel
 Development files for shadow-utils-subid.
 
 %prep
-%autosetup -p 1 -S git -n shadow-4.20.0
+%setup -q -n shadow-%{version}
+%patch0 -p1 -b .redhat
+%patch1 -p1 -b .goodname
+%patch2 -p1 -b .move-create-home
+%patch3 -p1 -b .default-range
+%patch4 -p1 -b .manfix
+%patch5 -p1 -b .date-parsing
+%patch6 -p1 -b .move-home
+%patch7 -p1 -b .audit-update
+%patch8 -p1 -b .unlock
+%patch9 -p1 -b .selinux-perms
+%patch10 -p1 -b .null-tm
+%patch11 -p1 -b .long-entry
+%patch12 -p1 -b .sysugid-min-limit
+%patch13 -p1 -b .login-prompt
+%patch14 -p1 -b .newuidmap-libeconf-dependency
+%patch15 -p1 -b .usermod-allow-all-group-types
+%patch16 -p1 -b .useradd-avoid-generating-empty-subid-range
+%patch17 -p1 -b .libmisc-fix-default-value-in-SHA_get_salt_rounds
+%patch18 -p1 -b .semanage-close-the-selabel-handle
+%patch19 -p1 -b .revert-useradd-fix-memleak
+%patch20 -p1 -b .useradd-copy-tree-argument
+%patch21 -p1 -b .pwck-fix-segfault-when-calling-fprintf
+%patch22 -p1 -b .newgrp-fix-segmentation-fault
+%patch23 -p1 -b .getsubids
+%patch24 -p1 -b .groupdel-fix-sigsegv-when-passwd-does-not-exist
+%patch25 -p1 -b .make-shadow-logfd-and-prog-not-extern
+%patch26 -p1 -b .rename-prog-to-shadow-progname
+%patch27 -p1 -b .shadow-progname-default-init
+%patch28 -p1 -b .nss-get-shadow-logfd-with-log-get-logfd
+%patch29 -p1 -b .useradd-modify-check-ID-range-for-system-users
+%patch30 -p1 -b .subordinateio-also-compare-the-owner-ID
+%patch31 -p1 -b .useradd-stop-last-fail-log-reset
 
 iconv -f ISO88591 -t utf-8  doc/HOWTO > doc/HOWTO.utf8
 cp -f doc/HOWTO.utf8 doc/HOWTO
@@ -106,39 +180,39 @@ cp -f doc/HOWTO.utf8 doc/HOWTO
 cp -a %{SOURCE4} %{SOURCE5} .
 cp -a %{SOURCE6} man/login.defs.d/HOME_MODE.xml
 
+# Force regeneration of getdate.c
+rm libmisc/getdate.c
+
 %build
+%ifarch sparc64
+#sparc64 need big PIE
+export CFLAGS="$RPM_OPT_FLAGS -fPIE"
+export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
+%else
+export CFLAGS="$RPM_OPT_FLAGS -fpie"
+export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
+%endif
+
 autoreconf
 %configure \
-        --disable-account-tools-setuid \
-        --enable-logind=no \
-        --enable-man \
         --enable-shadowgrp \
-        --enable-shared \
+        --enable-man \
         --with-audit \
-        --with-bcrypt \
-        --with-group-name-max-length=32 \
-        --with-libpam \
-        --with-selinux \
         --with-sha-crypt \
+        --with-bcrypt \
         --with-yescrypt \
-        --without-libbsd \
+        --with-selinux \
         --without-libcrack \
-        --without-nscd \
-        --without-sssd
+        --without-libpam \
+        --enable-shared \
+        --with-group-name-max-length=32
 %make_build
 
-%check
-make check
-
 %install
 %make_install gnulocaledir=$RPM_BUILD_ROOT%{_datadir}/locale MKINSTALLDIRS=`pwd`/mkinstalldirs
 install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/default
 install -p -c -m 0644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/login.defs
 install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/default/useradd
-install -d -m 755 $RPM_BUILD_ROOT%{_pam_confdir}
-install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/chpasswd
-install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/newusers
-install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/passwd
 
 
 ln -s useradd $RPM_BUILD_ROOT%{_sbindir}/adduser
@@ -147,28 +221,45 @@ for subdir in $RPM_BUILD_ROOT%{_mandir}/{??,??_??,??_??.*}/man* ; do
         test -d $subdir && test -e $subdir/useradd.8 && echo ".so man8/useradd.8" > $subdir/adduser.8
 done
 
-%if "%{_sbindir}" == "%{_bindir}"
-# The installation script doesn't actually use the configured paths :(
-mv -v $RPM_BUILD_ROOT/usr/sbin/* $RPM_BUILD_ROOT%{_bindir}/
-%endif
-
 # Remove binaries we don't use.
 rm $RPM_BUILD_ROOT%{_bindir}/chfn
 rm $RPM_BUILD_ROOT%{_bindir}/chsh
+rm $RPM_BUILD_ROOT%{_bindir}/expiry
+rm $RPM_BUILD_ROOT%{_bindir}/groups
 rm $RPM_BUILD_ROOT%{_bindir}/login
+rm $RPM_BUILD_ROOT%{_bindir}/passwd
 rm $RPM_BUILD_ROOT%{_bindir}/su
 rm $RPM_BUILD_ROOT%{_bindir}/faillog
+rm $RPM_BUILD_ROOT%{_sysconfdir}/login.access
+rm $RPM_BUILD_ROOT%{_sysconfdir}/limits
+rm $RPM_BUILD_ROOT%{_sbindir}/logoutd
 rm $RPM_BUILD_ROOT%{_sbindir}/nologin
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chsh.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chsh.*
+rm $RPM_BUILD_ROOT%{_mandir}/man1/expiry.*
+rm $RPM_BUILD_ROOT%{_mandir}/*/man1/expiry.*
+rm $RPM_BUILD_ROOT%{_mandir}/man1/groups.*
+rm $RPM_BUILD_ROOT%{_mandir}/*/man1/groups.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/login.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/login.*
+rm $RPM_BUILD_ROOT%{_mandir}/man1/passwd.*
+rm $RPM_BUILD_ROOT%{_mandir}/*/man1/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/su.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/su.*
+rm $RPM_BUILD_ROOT%{_mandir}/man5/limits.*
+rm $RPM_BUILD_ROOT%{_mandir}/*/man5/limits.*
+rm $RPM_BUILD_ROOT%{_mandir}/man5/login.access.*
+rm $RPM_BUILD_ROOT%{_mandir}/*/man5/login.access.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/passwd.*
+rm $RPM_BUILD_ROOT%{_mandir}/man5/porttime.*
+rm $RPM_BUILD_ROOT%{_mandir}/*/man5/porttime.*
+rm $RPM_BUILD_ROOT%{_mandir}/man5/suauth.*
+rm $RPM_BUILD_ROOT%{_mandir}/*/man5/suauth.*
+rm $RPM_BUILD_ROOT%{_mandir}/man8/logoutd.*
+rm $RPM_BUILD_ROOT%{_mandir}/*/man8/logoutd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/man3/getspnam.*
@@ -178,12 +269,6 @@ rm $RPM_BUILD_ROOT%{_mandir}/*/man5/faillog.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/faillog.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/faillog.*
 
-# Remove PAM service files we don't use.
-rm $RPM_BUILD_ROOT%{_pam_confdir}/chfn
-rm $RPM_BUILD_ROOT%{_pam_confdir}/chsh
-rm $RPM_BUILD_ROOT%{_pam_confdir}/login
-rm $RPM_BUILD_ROOT%{_pam_confdir}/su
-
 find $RPM_BUILD_ROOT%{_mandir} -depth -type d -empty -delete
 %find_lang shadow
 for dir in $(ls -1d $RPM_BUILD_ROOT%{_mandir}/{??,??_??}) ; do
@@ -199,25 +284,21 @@ echo $(ls)
 mkdir -p $RPM_BUILD_ROOT/%{includesubiddir}
 install -m 644 libsubid/subid.h $RPM_BUILD_ROOT/%{includesubiddir}/
 
-# Remove .la and .a files created by libsubid
+# Remove .la files created by libsubid
 rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.la
-rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 
 %files -f shadow.lang
 %doc NEWS doc/HOWTO README
 %license gpl-2.0.txt shadow-bsd.txt
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/login.defs
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/default/useradd
-%config(noreplace) %{_pam_confdir}/chpasswd
-%config(noreplace) %{_pam_confdir}/newusers
-%config(noreplace) %{_pam_confdir}/passwd
 %{_bindir}/sg
 %attr(4755,root,root) %{_bindir}/chage
 %attr(4755,root,root) %{_bindir}/gpasswd
+%{_bindir}/lastlog
 %attr(4755,root,root) %{_bindir}/newgrp
 %attr(0755,root,root) %caps(cap_setgid=ep) %{_bindir}/newgidmap
 %attr(0755,root,root) %caps(cap_setuid=ep) %{_bindir}/newuidmap
-%attr(4755,root,root) %{_bindir}/passwd
 %{_sbindir}/adduser
 %attr(0755,root,root)   %{_sbindir}/user*
 %attr(0755,root,root)   %{_sbindir}/group*
@@ -235,7 +316,6 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_mandir}/man1/newgrp.1*
 %{_mandir}/man1/newgidmap.1*
 %{_mandir}/man1/newuidmap.1*
-%{_mandir}/man1/passwd.*
 %{_mandir}/man3/shadow.3*
 %{_mandir}/man5/shadow.5*
 %{_mandir}/man5/login.defs.5*
@@ -251,6 +331,7 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_mandir}/man8/chgpasswd.8*
 %{_mandir}/man8/newusers.8*
 %{_mandir}/man8/*conv.8*
+%{_mandir}/man8/lastlog.8*
 %{_mandir}/man8/vipw.8*
 %{_mandir}/man8/vigr.8*
 
@@ -264,221 +345,15 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_libdir}/libsubid.so
 
 %changelog
-* Wed Jul 29 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-1
-- Rebase to version 4.20.0
-
-* Wed Jul 22 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-rc3-1
-- Rebase to version 4.20.0-rc3
-
-* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.3-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
-
-* Wed May 27 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-3
-- Enable use of PAM for chpasswd and newusers
-  Resolves: #2461179 and #2283963
-
-* Thu Apr 23 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-2
-- btrfs: simplify checks improve useradd behavior for non-btrfs
-
-* Wed Feb 11 2026 Debarshi Ray <rishi@fedoraproject.org> - 2:4.19.3-1
-- Rebase to version 4.19.3
-  Resolves: #2426288
-
-* Tue Jan 27 2026 Adam Williamson <awilliam@redhat.com> - 2:4.19.0-6
-- chkhash.c: fix escaping in SHA-256 / SHA-512 / MD5 regexes
-
-* Mon Jan 26 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-5
-- chkhash.c: fix support for ! and * in hashes
-- usermod.c: add back optimizations
-
-* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.0-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Mon Jan 12 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-3
-- useradd: Support config for creating home dirs as Btrfs subvolumes
-
-* Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-2
-- Enable unit-tests
-
-* Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-1
-- Rebase to version 4.19.0
-  Resolves: #2426288 and #2249524
-
-* Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-7
-- Also revert changes from -4 (last known good was -3)
-
-* Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-6
-- Revert changes from -5 (they were only meant for testing)
-
-* Tue Nov 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-5
-- Test CI
-
-* Fri Oct 31 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-4
-- Stop setting SELinux labels in chroot and prefix environments
-  Resolves: #2249524
-
-* Tue Jul 29 2025 Alexey Tikhonov <atikhono@redhat.com> - 2:4.18.0-3
-- Revert "Stop assigning subids by default"
-  Resolves: #2382662
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.18.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue Jul 22 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-1
-- Rebase to version 4.18.0. Resolves: #2374710
-
-* Fri Jul 18 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-5
-- Stop assigning subids by default
-  Resolves: CVE-2024-56433 and #2334168
-
-* Tue Jul 15 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-4
-- FSWC: Migrate to lastlog2
-  Link: <https://fedoraproject.org/wiki/Changes/Migrate_to_lastlog2>
-  Resolves: #2361588
-
-* Tue Mar 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-2
-- Add pam dependency for _pam_confdir missing macro. Resolves: #2354806
-
-* Thu Mar 20 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-1
-- Rebase to version 4.17.4. Resolves: #2353491
-- Fixes problems with expiration dates
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0-5
-- Add explicit BR: libxcrypt-devel
-
-* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.17.0-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.17.0-3
-- Rebuilt for the bin-sbin merge (2nd attempt)
-
-* Thu Dec 26 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0
-- Rebase to version 4.17.0. Resolves: #2293678
-
-* Sun Dec 22 2024 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0~rc1-2
-- Remove potentially dangerous {C,LD}FLAGS shenanigans
-- Fail linking if there are undefined symbols at link-time
-
-* Mon Dec  9 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0~rc1-1
-- Rebase to version 4.17.0-rc1
-
-* Tue Nov 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-7
-- SPDX license migration for subpackages
-
-* Wed Oct 16 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-6
-- Rebuilt for libeconf soname bump
-
-* Mon Oct  7 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-5
-- useradd: fix write_full() return value. Resolves: #2313559
-
-* Fri Sep 13 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-3
-- Disable nscd
-
-* Wed Aug 28 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-2
-- Rebase to version 4.16.0 (#2293678)
-
-* Tue Jul 23 2024 Kevin Fenzi <kevin@scrye.com> - 2:4.15.1-9
-- Revert chpasswd: use PAM again for now.
-
-* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.15.1-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-7
-- Rebuilt for the bin-sbin merge
-
-* Thu May 30 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-6
-- chpasswd: use PAM again (#2283963)
-
-* Mon May 20 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-5
-- Several fixes for issues detected by static analyzer tools
-
-* Thu Apr 11 2024 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-4
-- Fix build with %%_bindir==%%_sbindir
-- Add virtual Provides for old file paths used by other packages
-
-* Thu Mar 21 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-2
-- getdef: avoid spurious error messages about unknown configuration options.
-  Resolves: #2265291
-
-* Tue Mar 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-1
-- Wrong versioning for 4.15.0 RC releases makes the oficial release look lower than them.
-  Fix it by bumping the minor release to 4.15.1. Resolves: #2268690
-
-* Mon Mar 11 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
-- Rebase to version 4.15.0
-
-* Mon Feb 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-6
-- Build linking `libpam`
-
-* Thu Feb  1 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
-- passwd: Provide binary from this package. Enable libpam and
-  disable account-tools-setuid. Provide passwd PAM service file.
-  Resolves: #2233275
-- passwd: provide --stdin option
-
-* Mon Jan 29 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-4
-- Disable SSSD support. Resolves: #2253182
-
-* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.14.0-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Tue Oct  3 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-2
-- useradd: Set proper SELinux labels for def_usrtemplate
-
-* Wed Aug 16 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-1
-- Rebase to version 4.14.0. Resolves: #2229000
-
-* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Tue Jun 06 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 2:4.13-7
-- Remove unused libbsd-devel dependency
-
-* Mon Mar  6 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-6
-- Add libbsd-devel and libeconf-devel as build dependencies
-
-* Thu Mar  2 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-5
-- newuidmap and newgidmap: support passing pid as fd. Resolves: #2174752
-
-* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Wed Nov 23 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-3
-- Change SUB_UID_MIN and SUB_GID_MIN to 524288. Resolves: #2144558
-
-* Mon Nov 21 2022 Florian Weimer <fweimer@redhat.com> - 2:4.13-2
-- Fix gshadow configure check (switching to glibc implementation)
-
-* Wed Nov  9 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-1
-- Rebase to version 4.13
-- SPDX license migration
-
-* Wed Oct  5 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-3
-- chage: Fix regression in print_date. Resolves: #2129336
-
-* Fri Sep  9 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-2
+* Mon Oct 17 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-12
 - useradd: Do not reset non-existent data in {last,fail}log
 
-* Mon Aug 22 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-1
-- Rebase to version 4.12.3. Resolves: #2117809
+* Mon Sep 19 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-11
+- subordinateio: also compare the owner ID. Resolves: #2118227
 
-* Mon Aug  1 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-4
+* Mon Aug 22 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-10
 - useradd: modify check ID range for system users. Resolves: #2093692
 
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.11.1-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Feb 10 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-2
-- Fix explicit subid requirement for subid-devel
-
-* Tue Jan 25 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-1
-- Rebase to version 4.11.1 (#2034038)
-- Fix release sources
-- Add explicit subid requirement for subid-devel
-
-* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.9-10
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
 * Mon Jan 17 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-9
 - nss: get shadow_logfd with log_get_logfd() (#2038811)
 - lib: make shadow_logfd and Prog not extern
@@ -495,14 +370,11 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 * Fri Nov 12 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
 - useradd: change SELinux labels for home files (#2022658)
 
-* Thu Nov  4 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-6
+* Tue Nov  9 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-6
 - useradd: revert fix memleak of grp (#2018697)
 
-* Wed Oct 27 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-5
+* Tue Nov  2 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-5
 - useradd: generate home and mail directories with selinux user attribute
-
-* Thu Sep 23 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-4
-- login.defs: include HMAC_CRYPTO_ALGO key
 - Clean spec file: organize dependencies and move License location
 
 * Tue Aug 17 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-3

sources

@@ -1,2 +1,2 @@
-SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406
-SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac
+SHA512 (shadow-4.9.tar.xz) = 254cda49bb14505a7604821e7fa898bf4bf317d648e9ddc881ab80a6860d52053dfffacad6feab87c7d16608c35ed6b6cee99e7757eac930da3a7b31cdcd4b95
+SHA512 (shadow-4.9.tar.xz.asc) = 16c0ff7be263c9d471b05656c9a1d14da8ec9b17544910323ca6ab854126d1a03ece221e0caf610e65a9b1d080b4cd1b8b46973f20e3ae45ea0e5581ce6c90d9

tests/mhc-fedora-ci.yaml

@@ -1,13 +0,0 @@
-provisioned_topologies:
-- shadow
-domains:
-- id: shadow
-  hosts:
-  - hostname: localhost
-    role: shadow
-    conn:
-      type: ssh
-      host: localhost
-      user: root
-    artifacts:
-    - /var/log/*

tests/sanity/Makefile

@@ -0,0 +1,77 @@
+# Copyright (c) 2006 Red Hat, Inc. All rights reserved. This copyrighted material 
+# is made available to anyone wishing to use, modify, copy, or
+# redistribute it subject to the terms and conditions of the GNU General
+# Public License v.2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+#
+# Author: Jakub Hrozek
+
+#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
+# Example Makefile for RHTS                                          #
+# This example is geared towards a test for a specific package       #
+# It does most of the work for you, but may require further coding   #
+#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
+
+# The toplevel namespace within which the test lives.
+TOPLEVEL_NAMESPACE=CoreOS
+
+# The name of the package under test:
+PACKAGE_NAME=shadow-utils
+
+# The path of the test below the package:
+RELATIVE_PATH=sanity
+
+# Version of the Test. Used with make tag.
+export TESTVERSION=1.1
+
+# The combined namespace of the test.
+export TEST=/$(TOPLEVEL_NAMESPACE)/$(PACKAGE_NAME)/$(RELATIVE_PATH)
+
+# A phony target is one that is not really the name of a file.
+# It is just a name for some commands to be executed when you
+# make an explicit request. There are two reasons to use a
+# phony target: to avoid a conflict with a file of the same
+# name, and to improve performance.
+.PHONY: all install download clean
+
+# Executables to be built should be added here, they will be generated on the system under test.
+BUILT_FILES= 
+
+# Data files, .c files, scripts anything needed to either compile the test and/or run it.
+FILES=$(METADATA) Makefile PURPOSE sanity_test.py runtest.sh
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x ./sanity_test.py
+	chmod a+x ./runtest.sh
+
+clean:
+	rm -f *~ *.rpm $(BUILT_FILES)
+
+# Include Common Makefile
+include /usr/share/rhts/lib/rhts-make.include
+
+# Generate the testinfo.desc here:
+$(METADATA): Makefile
+	@touch $(METADATA)
+	@echo "Owner:        Jakub Hrozek <jhrozek@redhat.com>" > $(METADATA)
+	@echo "Name:         $(TEST)" >> $(METADATA)
+	@echo "Path:         $(TEST_DIR)" >> $(METADATA)
+	@echo "TestVersion:  $(TESTVERSION)" >> $(METADATA)
+	@echo "License:      GNU GPL" >> $(METADATA)
+	@echo "Description:  Basic sanity test for shadow-utils" >> $(METADATA)
+	@echo "TestTime:     5m" >> $(METADATA)
+	@echo "RunFor:       $(PACKAGE_NAME)" >> $(METADATA)
+	@echo "Requires:     $(PACKAGE_NAME)" >> $(METADATA)
+	@echo "Requires:     python" >> $(METADATA)
+	rhts-lint $(METADATA)
+

tests/sanity/PURPOSE

@@ -0,0 +1,10 @@
+This is a basic sanity test for the shadow-utils package. It is implemented
+in python on top of the unittesting.py module.
+
+Its purpose is to ensure that the binaries in the shadow-utils package behave
+as expected and its switches/options work correctly.
+
+For the most part, every binary in the shadow-utils package is represented by
+a single class named Test<BinaryName>, i.e. TestUsermod etc. There are some 
+exceptions, like TestUseraddWeirdNameTest though.
+

tests/sanity/runtest.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+. /usr/bin/rhts-environment.sh
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+rlFileBackup --clean /etc/default/useradd- /etc/default/useradd
+setenforce 0
+python sanity_test.py -v
+setenforce 1
+rlFileRestore
+
+EXIT=$?
+if [[ $EXIT -eq 0 ]]; then
+    RESULT="PASS"
+else
+    RESULT="FAIL"
+fi
+
+
+rlJournalEnd
+
+echo "Result: $RESULT"
+echo "Exit: $EXIT"
+report_result $TEST $RESULT $EXIT

tests/tests.yml

@@ -0,0 +1,13 @@
+---
+# This first play always runs on the local staging system
+- hosts: localhost
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    - atomic
+    tests:
+    - sanity
+    required_packages:
+    - shadow-utils     # sanity test needs shadow-utils
+    - python           # sanity test needs python