Add build dependencies

Add libbsd-devel and libeconf-devel as build dependencies Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
newuidmap and newgidmap: support passing pid as fd
2023-03-27 14:08:51 +02:00 · 2023-03-21 09:56:32 +01:00 · 2022-11-29 10:18:07 +01:00
29 changed files with 5008 additions and 371 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
 1
--- a/.gitignore
+++ b/.gitignore
@ -20,37 +20,3 @@ shadow-4.1.4.2.tar.bz2
 /shadow-4.11.1.tar.xz.asc
 /shadow-4.12.3.tar.xz
 /shadow-4.12.3.tar.xz.asc
 /shadow-4.13.tar.xz
 /shadow-4.13.tar.xz.asc
 /shadow-4.14.0.tar.xz
 /shadow-4.14.0.tar.xz.asc
 /shadow-4.15.0rc2.tar.xz
 /shadow-4.15.0rc2.tar.xz.asc
 /shadow-4.15.0rc3.tar.xz
 /shadow-4.15.0rc3.tar.xz.asc
 /shadow-4.15.0.tar.xz
 /shadow-4.15.0.tar.xz.asc
 /shadow-4.15.1.tar.xz
 /shadow-4.15.1.tar.xz.asc
 /shadow-4.16.0.tar.xz
 /shadow-4.16.0.tar.xz.asc
 /shadow-4.17.0-rc1.tar.xz
 /shadow-4.17.0-rc1.tar.xz.asc
 /shadow-4.17.0.tar.xz
 /shadow-4.17.0.tar.xz.asc
 /shadow-4.17.4.tar.xz
 /shadow-4.17.4.tar.xz.asc
 /shadow-4.18.0.tar.xz
 /shadow-4.18.0.tar.xz.asc
 /shadow-4.19.0.tar.xz
 /shadow-4.19.0.tar.xz.asc
 /shadow-4.19.2.tar.xz
 /shadow-4.19.2.tar.xz.asc
 /shadow-4.19.3.tar.xz
 /shadow-4.19.3.tar.xz.asc
 /shadow-4.20.0-rc2.tar.xz
 /shadow-4.20.0-rc2.tar.xz.asc
 /shadow-4.20.0-rc3.tar.xz
 /shadow-4.20.0-rc3.tar.xz.asc
 /shadow-4.20.0.tar.xz
 /shadow-4.20.0.tar.xz.asc
--- a/passwd.pamd
+++ b/passwd.pamd
@ -1,5 +0,0 @@
 #%PAM-1.0
 # This tool only uses the password stack.
 password   substack	system-auth
 -password   optional	pam_gnome_keyring.so use_authtok
 password   substack	postlogin
--- a/plans/tier0-functional.fmf
+++ b/plans/tier0-functional.fmf
@ -1,51 +0,0 @@
 summary: Tier 0 functional tests for shadow-utils
 description: |
    Run comprehensive system tests for shadow-utils. These tests validate user and group
    account management functionality by testing actual system operations including user
    creation, password management, group operations, and verification of system files
    (i.e. /etc/passwd, /etc/shadow).
 provision:
    how: virtual
    image: fedora
 prepare:
    - name: Install general dependencies
      how: install
      package:
        - expect
        - gcc
        - git
        - libssh-devel
        - python3-devel
        - python3-pip
    - name: Setup SSH keys for localhost testing
      how: shell
      script:
        - ssh-keygen -t rsa -f /root/.ssh/id_rsa -N "" -q
        - cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
        - chmod 600 /root/.ssh/authorized_keys
        - ssh-keyscan -H localhost >> /root/.ssh/known_hosts
    - name: Clone shadow repository
      how: shell
      script:
        - git clone https://github.com/shadow-maint/shadow.git /tmp/shadow-test
    - name: Copy test topology for Fedora CI
      how: shell
      script:
        - cp tests/mhc-fedora-ci.yaml /tmp/shadow-test/tests/system
    - name: Install test dependencies
      how: shell
      script:
        - pip3 install -r /tmp/shadow-test/tests/system/requirements.txt
 execute:
    how: tmt
    duration: 30m
    script: |
        cd /tmp/shadow-test/tests/system
        pytest --mh-config=mhc-fedora-ci.yaml --mh-lazy-ssh -v
--- a/shadow-4.11.1-audit-update.patch
+++ b/shadow-4.11.1-audit-update.patch
--- a/shadow-4.11.1-null-tm.patch
+++ b/shadow-4.11.1-null-tm.patch
@ -0,0 +1,22 @@
 diff -up shadow-4.11.1/src/chage.c.null-tm shadow-4.11.1/src/chage.c
 diff -up shadow-4.11.1/src/lastlog.c.null-tm shadow-4.11.1/src/lastlog.c
 --- shadow-4.11.1/src/lastlog.c.null-tm	2022-01-03 15:31:56.348555620 +0100
 +++ shadow-4.11.1/src/lastlog.c	2022-01-03 15:38:41.262229024 +0100
@@ -151,9 +151,12 @@ static void print_one (/*@null@*/const s
 	ll_time = ll.ll_time;
 	tm = localtime (&ll_time);
 -	strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
 -	cp = ptime;
 -
 +	if (tm == NULL) {
 +		cp = "(unknown)";
 +	} else {
 +		strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
 +		cp = ptime;
 +	}
 	if (ll.ll_time == (time_t) 0) {
 		cp = _("**Never logged in**\0");
 	}
 diff -up shadow-4.11.1/src/passwd.c.null-tm shadow-4.11.1/src/passwd.c
 diff -up shadow-4.11.1/src/usermod.c.null-tm shadow-4.11.1/src/usermod.c
--- a/shadow-4.12.3-chage-print-date-regression.patch
+++ b/shadow-4.12.3-chage-print-date-regression.patch
@ -0,0 +1,32 @@
 From e503fd574b7dbf6b21b1168e20938f0922807916 Mon Sep 17 00:00:00 2001
 From: Xiami <1927254+Xiami2012@users.noreply.github.com>
 Date: Wed, 5 Oct 2022 18:11:28 +0800
 Subject: [PATCH] chage: Fix regression in print_date
 Introduced by c6c8130db4319613a91dd07bbb845f6c33c5f79f
 After removing snprintf, the format string should get unescaped once.
 Fixes #564
 Reporter and patch author: DerMouse (github.com/DerMouse)
 ---
 src/chage.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/chage.c b/src/chage.c
 index 8cf67794..01570d72 100644
 --- a/src/chage.c
 +++ b/src/chage.c
@@ -228,7 +228,7 @@ static void print_date (time_t date)
 	if (NULL == tp) {
 		(void) printf ("time_t: %lu\n", (unsigned long)date);
 	} else {
 -		(void) strftime (buf, sizeof buf, iflg ? "%%Y-%%m-%%d" : "%%b %%d, %%Y", tp);
 +		(void) strftime (buf, sizeof buf, iflg ? "%Y-%m-%d" : "%b %d, %Y", tp);
 		(void) puts (buf);
 	}
 }
 -- 
 2.37.3
--- a/shadow-4.12.3-goodname.patch
+++ b/shadow-4.12.3-goodname.patch
@ -0,0 +1,100 @@
 diff -up shadow-4.12.3/libmisc/chkname.c.goodname shadow-4.12.3/libmisc/chkname.c
 --- shadow-4.12.3/libmisc/chkname.c.goodname	2022-06-19 16:16:48.000000000 +0200
 +++ shadow-4.12.3/libmisc/chkname.c	2022-08-22 16:00:27.646087971 +0200
@@ -32,26 +32,44 @@ static bool is_valid_name (const char *n
 	}
 	/*
 -	 * User/group names must match [a-z_][a-z0-9_-]*[$]
 -	 */
 +         * User/group names must match gnu e-regex:
 +         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
 +         *
 +         * as a non-POSIX, extension, allow "$" as the last char for
 +         * sake of Samba 3.x "add machine script"
 +         *
 +         * Also do not allow fully numeric names or just "." or "..".
 +         */
 +	int numeric;
 -	if (('\0' == *name) ||
 -	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
 +	if ('\0' == *name ||
 +	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
 +			      '\0' == name[1])) ||
 +	    !((*name >= 'a' && *name <= 'z') ||
 +	      (*name >= 'A' && *name <= 'Z') ||
 +	      (*name >= '0' && *name <= '9') ||
 +	      *name == '_' ||
 +	      *name == '.')) {
 		return false;
 	}
 +	numeric = isdigit(*name);
 +
 	while ('\0' != *++name) {
 -		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
 -		      ( ('0' <= *name) && ('9' >= *name) ) ||
 -		      ('_' == *name) ||
 -		      ('-' == *name) ||
 -		      ( ('$' == *name) && ('\0' == *(name + 1)) )
 +		if (!((*name >= 'a' && *name <= 'z') ||
 +		      (*name >= 'A' && *name <= 'Z') ||
 +		      (*name >= '0' && *name <= '9') ||
 +		      *name == '_' ||
 +		      *name == '.' ||
 +		      *name == '-' ||
 +		      (*name == '$' && name[1] == '\0')
 		     )) {
 			return false;
 		}
 +		numeric &= isdigit(*name);
 	}
 -	return true;
 +	return !numeric;
 }
 bool is_valid_user_name (const char *name)
 diff -up shadow-4.12.3/man/groupadd.8.xml.goodname shadow-4.12.3/man/groupadd.8.xml
 --- shadow-4.12.3/man/groupadd.8.xml.goodname	2022-08-22 16:00:27.646087971 +0200
 +++ shadow-4.12.3/man/groupadd.8.xml	2022-08-22 16:01:59.301779733 +0200
@@ -64,10 +64,12 @@
       files as needed.
     </para>
      <para>
 -       Groupnames must start with a lower case letter or an underscore,
 -       followed by lower case letters, digits, underscores, or dashes.
 -       They can end with a dollar sign.
 -       In regular expression terms: [a-z_][a-z0-9_-]*[$]?
 +       Groupnames may contain only lower and upper case letters, digits,
 +       underscores, or dashes. They can end with a dollar sign.
 +
 +       Dashes are not allowed at the beginning of the groupname.
 +       Fully numeric groupnames and groupnames . or .. are
 +       also disallowed.
      </para>
      <para>
        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
 diff -up shadow-4.12.3/man/useradd.8.xml.goodname shadow-4.12.3/man/useradd.8.xml
 --- shadow-4.12.3/man/useradd.8.xml.goodname	2022-08-22 14:46:57.000000000 +0200
 +++ shadow-4.12.3/man/useradd.8.xml	2022-08-22 16:00:27.646087971 +0200
@@ -692,10 +692,14 @@
     </para>
     <para>
 -      Usernames must start with a lower case letter or an underscore,
 -      followed by lower case letters, digits, underscores, or dashes.
 -      They can end with a dollar sign.
 -      In regular expression terms: [a-z_][a-z0-9_-]*[$]?
 +      Usernames may contain only lower and upper case letters, digits,
 +      underscores, or dashes. They can end with a dollar sign.
 +
 +      Dashes are not allowed at the beginning of the username.
 +      Fully numeric usernames and usernames . or .. are
 +      also disallowed. It is not recommended to use usernames beginning
 +      with . character as their home directories will be hidden in
 +      the <command>ls</command> output.
     </para>
     <para>
       Usernames may only be up to 32 characters long.
--- a/shadow-4.12.3-long-entry.patch
+++ b/shadow-4.12.3-long-entry.patch
@ -0,0 +1,86 @@
 diff -up shadow-4.12.3/lib/defines.h.long-entry shadow-4.12.3/lib/defines.h
 --- shadow-4.12.3/lib/defines.h.long-entry	2022-08-18 23:51:37.000000000 +0200
 +++ shadow-4.12.3/lib/defines.h	2022-08-22 16:12:27.412522768 +0200
@@ -335,6 +335,9 @@ extern char *strerror ();
 # endif
 #endif
 +/* Maximum length of passwd entry */
 +#define PASSWD_ENTRY_MAX_LENGTH 32768
 +
 #ifdef HAVE_SECURE_GETENV
 #  define shadow_getenv(name) secure_getenv(name)
 # else
 diff -up shadow-4.12.3/lib/pwio.c.long-entry shadow-4.12.3/lib/pwio.c
 --- shadow-4.12.3/lib/pwio.c.long-entry	2022-06-19 16:16:48.000000000 +0200
 +++ shadow-4.12.3/lib/pwio.c	2022-08-22 16:12:27.412522768 +0200
@@ -56,7 +56,10 @@ static int passwd_put (const void *ent,
 	    || (pw->pw_gid == (gid_t)-1)
 	    || (valid_field (pw->pw_gecos, ":\n") == -1)
 	    || (valid_field (pw->pw_dir, ":\n") == -1)
 -	    || (valid_field (pw->pw_shell, ":\n") == -1)) {
 +	    || (valid_field (pw->pw_shell, ":\n") == -1)
 +	    || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
 +	        strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
 +	        strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
 		return -1;
 	}
 diff -up shadow-4.12.3/lib/sgetpwent.c.long-entry shadow-4.12.3/lib/sgetpwent.c
 --- shadow-4.12.3/lib/sgetpwent.c.long-entry	2022-08-09 00:30:40.000000000 +0200
 +++ shadow-4.12.3/lib/sgetpwent.c	2022-08-22 16:14:10.955309200 +0200
@@ -34,7 +34,7 @@
 struct passwd *sgetpwent (const char *buf)
 {
 	static struct passwd pwent;
 -	static char pwdbuf[1024];
 +	static char pwdbuf[PASSWD_ENTRY_MAX_LENGTH];
 	int i;
 	char *cp;
 	char *fields[NFIELDS];
@@ -44,8 +44,10 @@ struct passwd *sgetpwent (const char *bu
 	 * the password structure remain valid.
 	 */
 -	if (strlen (buf) >= sizeof pwdbuf)
 +	if (strlen (buf) >= sizeof pwdbuf) {
 +		fprintf (stderr, "Too long passwd entry encountered, file corruption?\n");
 		return 0;	/* fail if too long */
 +	}
 	strcpy (pwdbuf, buf);
 	/*
 diff -up shadow-4.12.3/lib/sgetspent.c.long-entry shadow-4.12.3/lib/sgetspent.c
 --- shadow-4.12.3/lib/sgetspent.c.long-entry	2022-06-19 16:16:54.000000000 +0200
 +++ shadow-4.12.3/lib/sgetspent.c	2022-08-22 16:12:27.413522776 +0200
@@ -25,7 +25,7 @@
  */
 struct spwd *sgetspent (const char *string)
 {
 -	static char spwbuf[1024];
 +	static char spwbuf[PASSWD_ENTRY_MAX_LENGTH];
 	static struct spwd spwd;
 	char *fields[FIELDS];
 	char *cp;
@@ -37,6 +37,7 @@ struct spwd *sgetspent (const char *stri
 	 */
 	if (strlen (string) >= sizeof spwbuf) {
 +		fprintf (stderr, "Too long shadow entry encountered, file corruption?\n");
 		return 0;	/* fail if too long */
 	}
 	strcpy (spwbuf, string);
 diff -up shadow-4.12.3/lib/shadowio.c.long-entry shadow-4.12.3/lib/shadowio.c
 --- shadow-4.12.3/lib/shadowio.c.long-entry	2022-06-19 16:16:48.000000000 +0200
 +++ shadow-4.12.3/lib/shadowio.c	2022-08-22 16:12:27.413522776 +0200
@@ -56,7 +56,9 @@ static int shadow_put (const void *ent,
 	if (   (NULL == sp)
 	    || (valid_field (sp->sp_namp, ":\n") == -1)
 -	    || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
 +	    || (valid_field (sp->sp_pwdp, ":\n") == -1)
 +	    || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
 +	        1000 > PASSWD_ENTRY_MAX_LENGTH)) {
 		return -1;
 	}
--- a/shadow-4.12.3-redhat.patch
+++ b/shadow-4.12.3-redhat.patch
@ -0,0 +1,38 @@
 diff -up shadow-4.12.3/src/useradd.c.redhat shadow-4.12.3/src/useradd.c
 --- shadow-4.12.3/src/useradd.c.redhat	2022-08-06 18:22:45.000000000 +0200
 +++ shadow-4.12.3/src/useradd.c	2022-08-22 15:57:19.034664441 +0200
@@ -82,7 +82,7 @@ const char *Prog;
 static gid_t def_group = 1000;
 static const char *def_gname = "other";
 static const char *def_home = "/home";
 -static const char *def_shell = "/bin/bash";
 +static const char *def_shell = "/sbin/nologin";
 static const char *def_template = SKEL_DIR;
 static const char *def_create_mail_spool = "yes";
 static const char *def_log_init = "yes";
@@ -93,7 +93,7 @@ static const char *def_expire = "";
 #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
 static const char *user_name = "";
 -static const char *user_pass = "!";
 +static const char *user_pass = "!!";
 static uid_t user_id;
 static gid_t user_gid;
 static const char *user_comment = "";
@@ -1227,7 +1227,7 @@ static void process_flags (int argc, cha
 			{NULL, 0, NULL, '\0'}
 		};
 		while ((c = getopt_long (argc, argv,
 -					 "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:U"
 +					 "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:U"
 #ifdef WITH_SELINUX
 		                         "Z:"
 #endif				/* WITH_SELINUX */
@@ -1395,6 +1395,7 @@ static void process_flags (int argc, cha
 			case 'M':
 				Mflg = true;
 				break;
 +			case 'n':
 			case 'N':
 				Nflg = true;
 				break;
--- a/shadow-4.12.3-selinux-perms.patch
+++ b/shadow-4.12.3-selinux-perms.patch
@ -0,0 +1,240 @@
 diff -up shadow-4.12.3/src/chgpasswd.c.selinux-perms shadow-4.12.3/src/chgpasswd.c
 --- shadow-4.12.3/src/chgpasswd.c.selinux-perms	2022-06-19 16:16:48.000000000 +0200
 +++ shadow-4.12.3/src/chgpasswd.c	2022-08-22 16:09:02.006970030 +0200
@@ -16,6 +16,13 @@
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
 +#ifdef WITH_SELINUX
 +#include <selinux/selinux.h>
 +#include <selinux/avc.h>
 +#endif
 +#ifdef WITH_LIBAUDIT
 +#include <libaudit.h>
 +#endif
 #ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 #include "pam_defs.h"
@@ -61,6 +68,9 @@ static bool sgr_locked = false;
 #endif
 static bool gr_locked = false;
 +/* The name of the caller */
 +static char *myname = NULL;
 +
 /* local function prototypes */
 static void fail_exit (int code);
 static /*@noreturn@*/void usage (int status);
@@ -318,6 +328,63 @@ static void check_perms (void)
 #endif				/* ACCT_TOOLS_SETUID */
 }
 +#ifdef WITH_SELINUX
 +static int
 +log_callback (int type, const char *fmt, ...)
 +{
 +    int audit_fd;
 +    va_list ap;
 +
 +    va_start(ap, fmt);
 +#ifdef WITH_AUDIT
 +    audit_fd = audit_open();
 +
 +    if (audit_fd >= 0) {
 +	char *buf;
 +
 +	if (vasprintf (&buf, fmt, ap) < 0)
 +		goto ret;
 +	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
 +				   NULL, 0);
 +	audit_close(audit_fd);
 +	free(buf);
 +	goto ret;
 +    }
 +
 +#endif
 +    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
 +ret:
 +    va_end(ap);
 +    return 0;
 +}
 +
 +static void
 +selinux_check_root (void)
 +{
 +    int status = -1;
 +    security_context_t user_context;
 +    union selinux_callback old_callback;
 +
 +    if (is_selinux_enabled() < 1)
 +	return;
 +
 +    old_callback = selinux_get_callback(SELINUX_CB_LOG);
 +    /* setup callbacks */
 +    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
 +    if ((status = getprevcon(&user_context)) < 0) {
 +	selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +	exit(1);
 +    }
 +
 +    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
 +
 +    selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +    freecon(user_context);
 +    if (status != 0 && security_getenforce() != 0)
 +	exit(1);
 +}
 +#endif
 +
 /*
  * open_files - lock and open the group databases
  */
@@ -411,6 +478,7 @@ int main (int argc, char **argv)
 	const struct group *gr;
 	struct group newgr;
 +	struct passwd *pw = NULL;
 	int errors = 0;
 	int line = 0;
@@ -422,12 +490,37 @@ int main (int argc, char **argv)
 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
 	(void) textdomain (PACKAGE);
 +#ifdef WITH_SELINUX
 +	selinux_check_root ();
 +#endif
 +
 	process_root_flag ("-R", argc, argv);
 	process_flags (argc, argv);
 	OPENLOG ("chgpasswd");
 +#ifdef WITH_AUDIT
 +	audit_help_open ();
 +#endif
 +
 +	/*
 +	 * Determine the name of the user that invoked this command. This
 +	 * is really hit or miss because there are so many ways that command
 +	 * can be executed and so many ways to trip up the routines that
 +	 * report the user name.
 +	 */
 +	pw = get_my_pwent ();
 +	if (NULL == pw) {
 +		fprintf (stderr, _("%s: Cannot determine your user name.\n"),
 +		         Prog);
 +		SYSLOG ((LOG_WARN,
 +		         "Cannot determine the user name of the caller (UID %lu)",
 +		         (unsigned long) getuid ()));
 +		exit (E_NOPERM);
 +	}
 +	myname = xstrdup (pw->pw_name);
 +
 	check_perms ();
 #ifdef SHADOWGRP
 diff -up shadow-4.12.3/src/chpasswd.c.selinux-perms shadow-4.12.3/src/chpasswd.c
 --- shadow-4.12.3/src/chpasswd.c.selinux-perms	2022-06-19 16:16:48.000000000 +0200
 +++ shadow-4.12.3/src/chpasswd.c	2022-08-22 16:10:56.702835681 +0200
@@ -16,6 +16,13 @@
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
 +#ifdef WITH_SELINUX
 +#include <selinux/selinux.h>
 +#include <selinux/avc.h>
 +#endif
 +#ifdef WITH_LIBAUDIT
 +#include <libaudit.h>
 +#endif
 #ifdef USE_PAM
 #include "pam_defs.h"
 #endif				/* USE_PAM */
@@ -318,6 +325,63 @@ static void check_perms (void)
 #endif				/* USE_PAM */
 }
 +#ifdef WITH_SELINUX
 +static int
 +log_callback (int type, const char *fmt, ...)
 +{
 +    int audit_fd;
 +    va_list ap;
 +
 +    va_start(ap, fmt);
 +#ifdef WITH_AUDIT
 +    audit_fd = audit_open();
 +
 +    if (audit_fd >= 0) {
 +	char *buf;
 +
 +	if (vasprintf (&buf, fmt, ap) < 0)
 +		goto ret;
 +	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
 +				   NULL, 0);
 +	audit_close(audit_fd);
 +	free(buf);
 +	goto ret;
 +    }
 +
 +#endif
 +    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
 +ret:
 +    va_end(ap);
 +    return 0;
 +}
 +
 +static void
 +selinux_check_root (void)
 +{
 +    int status = -1;
 +    security_context_t user_context;
 +    union selinux_callback old_callback;
 +
 +    if (is_selinux_enabled() < 1)
 +	return;
 +
 +    old_callback = selinux_get_callback(SELINUX_CB_LOG);
 +    /* setup callbacks */
 +    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
 +    if ((status = getprevcon(&user_context)) < 0) {
 +	selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +	exit(1);
 +    }
 +
 +    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
 +
 +    selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +    freecon(user_context);
 +    if (status != 0 && security_getenforce() != 0)
 +	exit(1);
 +}
 +#endif
 +
 /*
  * open_files - lock and open the password databases
  */
@@ -450,6 +514,10 @@ int main (int argc, char **argv)
 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
 	(void) textdomain (PACKAGE);
 +#ifdef WITH_SELINUX
 +	selinux_check_root ();
 +#endif
 +
 	process_flags (argc, argv);
 	salt = get_salt();
@@ -463,6 +531,10 @@ int main (int argc, char **argv)
 	OPENLOG ("chpasswd");
 +#ifdef WITH_AUDIT
 +	audit_help_open ();
 +#endif
 +
 	check_perms ();
 #ifdef USE_PAM
--- a/shadow-4.12.3-useradd-stop-last-fail-log-reset.patch
+++ b/shadow-4.12.3-useradd-stop-last-fail-log-reset.patch
@ -0,0 +1,42 @@
 From ebf9b232b012725d2be5e750876c7336cf1c37fd Mon Sep 17 00:00:00 2001
 From: David Kalnischkies <david@kalnischkies.de>
 Date: Wed, 24 Aug 2022 13:21:01 +0200
 Subject: [PATCH] useradd: Do not reset non-existent data in {last,fail}log
 useradd does not create the files if they don't exist, but if they exist
 it will reset user data even if the data did not exist before creating
 a hole and an explicitly zero'd data point resulting (especially for
 high UIDs) in a lot of zeros ending up in containers and tarballs.
 ---
 src/useradd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
 diff --git a/src/useradd.c b/src/useradd.c
 index 6eaeb533..39a744ee 100644
 --- a/src/useradd.c
 +++ b/src/useradd.c
@@ -1996,8 +1996,9 @@ static void faillog_reset (uid_t uid)
 	struct faillog fl;
 	int fd;
 	off_t offset_uid = (off_t) (sizeof fl) * uid;
 +	struct stat st;
 -	if (access (FAILLOG_FILE, F_OK) != 0) {
 +	if (stat (FAILLOG_FILE, &st) != 0 || st.st_size <= offset_uid) {
 		return;
 	}
@@ -2033,8 +2034,9 @@ static void lastlog_reset (uid_t uid)
 	int fd;
 	off_t offset_uid = (off_t) (sizeof ll) * uid;
 	uid_t max_uid;
 +	struct stat st;
 -	if (access (LASTLOG_FILE, F_OK) != 0) {
 +	if (stat (LASTLOG_FILE, &st) != 0 || st.st_size <= offset_uid) {
 		return;
 	}
 -- 
 2.37.3
--- a/shadow-4.13-newidmap-support-passing-pid-as-fd.patch
+++ b/shadow-4.13-newidmap-support-passing-pid-as-fd.patch
@ -0,0 +1,441 @@
 From 6974df39a708abf8bafbdfa2b7827e0f70f874cb Mon Sep 17 00:00:00 2001
 From: Serge Hallyn <serge@hallyn.com>
 Date: Mon, 6 Feb 2023 22:49:42 -0600
 Subject: [PATCH] newuidmap and newgidmap: support passing pid as fd
 Closes #635
 newuidmap and newgidmap currently take an integner pid as
 the first argument, determining the process id on which to
 act.  Accept also "fd:N", where N must be an open file
 descriptor to the /proc/pid directory for the process to
 act upon.  This way, if you
 exec 10</proc/99
 newuidmap fd:10 100000 0 65536
 and pid 99 dies and a new process happens to take pid 99 before
 newuidmap happens to do its work, then since newuidmap will use
 openat() using fd 10, it won't change the mapping for the new
 process.
 Example:
 // terminal 1:
 serge@jerom ~/src/nsexec$ ./nsexec -W -s 0 -S 0 -U
 about to unshare with 10000000
 Press any key to exec (I am 129176)
 // terminal 2:
 serge@jerom ~/src/shadow$ exec 10</proc/129176
 serge@jerom ~/src/shadow$ sudo chown root src/newuidmap src/newgidmap
 serge@jerom ~/src/shadow$ sudo chmod u+s src/newuidmap
 serge@jerom ~/src/shadow$ sudo chmod u+s src/newgidmap
 serge@jerom ~/src/shadow$ ./src/newuidmap fd:10 0 100000 10
 serge@jerom ~/src/shadow$ ./src/newgidmap fd:10 0 100000 10
 // Terminal 1:
 uid=0(root) gid=0(root) groups=0(root)
 Signed-off-by: Serge Hallyn <serge@hallyn.com>
 ---
 lib/get_pid.c       | 51 +++++++++++++++++++++++++++++++++++++++++++++
 lib/prototypes.h    |  2 ++
 man/newgidmap.1.xml | 11 ++++++++++
 man/newuidmap.1.xml | 11 ++++++++++
 src/newgidmap.c     | 41 ++++++++++++++----------------------
 src/newuidmap.c     | 40 +++++++++++++----------------------
 6 files changed, 106 insertions(+), 50 deletions(-)
 diff --git a/lib/get_pid.c b/lib/get_pid.c
 index 10184bf0..ab91d158 100644
 --- a/lib/get_pid.c
 +++ b/lib/get_pid.c
@@ -10,6 +10,9 @@
 #include "prototypes.h"
 #include "defines.h"
 +#include <sys/types.h>
 +#include <sys/stat.h>
 +#include <fcntl.h>
 int get_pid (const char *pidstr, pid_t *pid)
 {
@@ -29,3 +32,51 @@ int get_pid (const char *pidstr, pid_t *pid)
 	return 1;
 }
 +/*
 + * If use passed in fd:4 as an argument, then return the
 + * value '4', the fd to use.
 + */
 +int get_pidfd_from_fd(const char *pidfdstr)
 +{
 +	long long int val;
 +	char *endptr;
 +
 +	errno = 0;
 +	val = strtoll (pidfdstr, &endptr, 10);
 +	if (   ('\0' == *pidfdstr)
 +	    || ('\0' != *endptr)
 +	    || (ERANGE == errno)
 +	    || (/*@+longintegral@*/val != (pid_t)val)/*@=longintegral@*/) {
 +		return 0;
 +	}
 +
 +	return (int)val;
 +}
 +
 +int open_pidfd(const char *pidstr)
 +{
 +	int proc_dir_fd;
 +	int written;
 +	char proc_dir_name[32];
 +	pid_t target;
 +
 +	if (get_pid(pidstr, &target) == 0)
 +		return -ENOENT;
 +
 +	/* max string length is 6 + 10 + 1 + 1 = 18, allocate 32 bytes */
 +	written = snprintf(proc_dir_name, sizeof(proc_dir_name), "/proc/%u/",
 +		target);
 +	if ((written <= 0) || ((size_t)written >= sizeof(proc_dir_name))) {
 +		fprintf(stderr, "snprintf of proc path failed for %u: %s\n",
 +			target, strerror(errno));
 +		return -EINVAL;
 +	}
 +
 +	proc_dir_fd = open(proc_dir_name, O_DIRECTORY);
 +	if (proc_dir_fd < 0) {
 +		fprintf(stderr, _("Could not open proc directory for target %u: %s\n"),
 +			target, strerror(errno));
 +		return -EINVAL;
 +	}
 +	return proc_dir_fd;
 +}
 diff --git a/lib/prototypes.h b/lib/prototypes.h
 index 400d5b97..21df6f61 100644
 --- a/lib/prototypes.h
 +++ b/lib/prototypes.h
@@ -160,6 +160,8 @@ extern int getlong (const char *numstr, /*@out@*/long int *result);
 /* get_pid.c */
 extern int get_pid (const char *pidstr, pid_t *pid);
 +extern int get_pidfd_from_fd(const char *pidfdstr);
 +extern int open_pidfd(const char *pidstr);
 /* getrange */
 extern int getrange (const char *range,
 diff --git a/man/newgidmap.1.xml b/man/newgidmap.1.xml
 index e4ebc69e..9b7683eb 100644
 --- a/man/newgidmap.1.xml
 +++ b/man/newgidmap.1.xml
@@ -116,6 +116,17 @@
     <para>
       Note that newgidmap may be used only once for a given process.
     </para>
 +    <para>
 +      Instead of an integer process id, the first argument may be
 +      specified as <replaceable>fd:N</replaceable>, where the integer N
 +      is the file descriptor number for the calling process's opened
 +      file for <filename>/proc/[pid[</filename>.  In this case,
 +      <command>newgidmap</command> will use
 +      <refentrytitle>openat</refentrytitle><manvolnum>2</manvolnum>
 +      to open the <filename>gid_map</filename> file under that
 +      directory, avoiding a TOCTTOU in case the process exits and
 +      the pid is immediately reused.
 +    </para>
   </refsect1>
 diff --git a/man/newuidmap.1.xml b/man/newuidmap.1.xml
 index f5cb5b48..ca917a77 100644
 --- a/man/newuidmap.1.xml
 +++ b/man/newuidmap.1.xml
@@ -116,6 +116,17 @@
     <para>
       Note that newuidmap may be used only once for a given process.
     </para>
 +    <para>
 +      Instead of an integer process id, the first argument may be
 +      specified as <replaceable>fd:N</replaceable>, where the integer N
 +      is the file descriptor number for the calling process's opened
 +      file for <filename>/proc/[pid[</filename>.  In this case,
 +      <command>newuidmap</command> will use
 +      <refentrytitle>openat</refentrytitle><manvolnum>2</manvolnum>
 +      to open the <filename>uid_map</filename> file under that
 +      directory, avoiding a TOCTTOU in case the process exits and
 +      the pid is immediately reused.
 +    </para>
   </refsect1>
   <refsect1 id='options'>
 diff --git a/src/newgidmap.c b/src/newgidmap.c
 index 01d0fe90..d6d29725 100644
 --- a/src/newgidmap.c
 +++ b/src/newgidmap.c
@@ -69,7 +69,7 @@ static void verify_ranges(struct passwd *pw, int ranges,
 static void usage(void)
 {
 -	fprintf(stderr, _("usage: %s <pid> <gid> <lowergid> <count> [ <gid> <lowergid> <count> ] ... \n"), Prog);
 +	fprintf(stderr, _("usage: %s [<pid|fd:<pidfd>] <gid> <lowergid> <count> [ <gid> <lowergid> <count> ] ... \n"), Prog);
 	exit(EXIT_FAILURE);
 }
@@ -143,15 +143,12 @@ out:
  */
 int main(int argc, char **argv)
 {
 -	char proc_dir_name[32];
 	char *target_str;
 -	pid_t target;
 	int proc_dir_fd;
 	int ranges;
 	struct map_range *mappings;
 	struct stat st;
 	struct passwd *pw;
 -	int written;
 	bool allow_setgroups = false;
 	Prog = Basename (argv[0]);
@@ -168,25 +165,19 @@ int main(int argc, char **argv)
 	/* Find the process that needs its user namespace
 	 * gid mapping set.
 	 */
 -	target_str = argv[1];
 -	if (!get_pid(target_str, &target))
 -		usage();
 -	/* max string length is 6 + 10 + 1 + 1 = 18, allocate 32 bytes */
 -	written = snprintf(proc_dir_name, sizeof(proc_dir_name), "/proc/%u/",
 -		target);
 -	if ((written <= 0) || (written >= sizeof(proc_dir_name))) {
 -		fprintf(stderr, "%s: snprintf of proc path failed: %s\n",
 -			Prog, strerror(errno));
 -	}
 -
 -	proc_dir_fd = open(proc_dir_name, O_DIRECTORY);
 -	if (proc_dir_fd < 0) {
 -		fprintf(stderr, _("%s: Could not open proc directory for target %u\n"),
 -			Prog, target);
 -		return EXIT_FAILURE;
 +	target_str = argv[1];
 +	if (strlen(target_str) > 3 && strncmp(target_str, "fd:", 3) == 0) {
 +		/* the user passed in a /proc/pid fd for the process */
 +		target_str = &target_str[3];
 +		proc_dir_fd = get_pidfd_from_fd(target_str);
 +		if (proc_dir_fd < 0)
 +			usage();
 +	} else {
 +		proc_dir_fd = open_pidfd(target_str);
 +		if (proc_dir_fd < 0)
 +			usage();
 	}
 -
 	/* Who am i? */
 	pw = get_my_pwent ();
 	if (NULL == pw) {
@@ -200,8 +191,8 @@ int main(int argc, char **argv)
 	/* Get the effective uid and effective gid of the target process */
 	if (fstat(proc_dir_fd, &st) < 0) {
 -		fprintf(stderr, _("%s: Could not stat directory for target %u\n"),
 -			Prog, target);
 +		fprintf(stderr, _("%s: Could not stat directory for process\n"),
 +			Prog);
 		return EXIT_FAILURE;
 	}
@@ -213,8 +204,8 @@ int main(int argc, char **argv)
 	    (!getdef_bool("GRANT_AUX_GROUP_SUBIDS") && (getgid() != pw->pw_gid)) ||
 	    (pw->pw_uid != st.st_uid) ||
 	    (getgid() != st.st_gid)) {
 -		fprintf(stderr, _( "%s: Target %u is owned by a different user: uid:%lu pw_uid:%lu st_uid:%lu, gid:%lu pw_gid:%lu st_gid:%lu\n" ),
 -			Prog, target,
 +		fprintf(stderr, _( "%s: Target process is owned by a different user: uid:%lu pw_uid:%lu st_uid:%lu, gid:%lu pw_gid:%lu st_gid:%lu\n" ),
 +			Prog,
 			(unsigned long int)getuid(), (unsigned long int)pw->pw_uid, (unsigned long int)st.st_uid,
 			(unsigned long int)getgid(), (unsigned long int)pw->pw_gid, (unsigned long int)st.st_gid);
 		return EXIT_FAILURE;
 diff --git a/src/newuidmap.c b/src/newuidmap.c
 index e8798409..e99655c9 100644
 --- a/src/newuidmap.c
 +++ b/src/newuidmap.c
@@ -64,7 +64,7 @@ static void verify_ranges(struct passwd *pw, int ranges,
 static void usage(void)
 {
 -	fprintf(stderr, _("usage: %s <pid> <uid> <loweruid> <count> [ <uid> <loweruid> <count> ] ... \n"), Prog);
 +	fprintf(stderr, _("usage: %s [<pid>|fd:<pidfd>] <uid> <loweruid> <count> [ <uid> <loweruid> <count> ] ... \n"), Prog);
 	exit(EXIT_FAILURE);
 }
@@ -73,15 +73,12 @@ static void usage(void)
  */
 int main(int argc, char **argv)
 {
 -	char proc_dir_name[32];
 	char *target_str;
 -	pid_t target;
 	int proc_dir_fd;
 	int ranges;
 	struct map_range *mappings;
 	struct stat st;
 	struct passwd *pw;
 -	int written;
 	Prog = Basename (argv[0]);
 	log_set_progname(Prog);
@@ -94,26 +91,20 @@ int main(int argc, char **argv)
 	if (argc < 2)
 		usage();
 +	target_str = argv[1];
 	/* Find the process that needs its user namespace
 	 * uid mapping set.
 	 */
 -	target_str = argv[1];
 -	if (!get_pid(target_str, &target))
 -		usage();
 -
 -	/* max string length is 6 + 10 + 1 + 1 = 18, allocate 32 bytes */
 -	written = snprintf(proc_dir_name, sizeof(proc_dir_name), "/proc/%u/",
 -		target);
 -	if ((written <= 0) || (written >= sizeof(proc_dir_name))) {
 -		fprintf(stderr, "%s: snprintf of proc path failed: %s\n",
 -			Prog, strerror(errno));
 -	}
 -
 -	proc_dir_fd = open(proc_dir_name, O_DIRECTORY);
 -	if (proc_dir_fd < 0) {
 -		fprintf(stderr, _("%s: Could not open proc directory for target %u\n"),
 -			Prog, target);
 -		return EXIT_FAILURE;
 +	if (strlen(target_str) > 3 && strncmp(target_str, "fd:", 3) == 0) {
 +		/* the user passed in a /proc/pid fd for the process */
 +		target_str = &target_str[3];
 +		proc_dir_fd = get_pidfd_from_fd(target_str);
 +		if (proc_dir_fd < 0)
 +			usage();
 +	} else {
 +		proc_dir_fd = open_pidfd(target_str);
 +		if (proc_dir_fd < 0)
 +			usage();
 	}
 	/* Who am i? */
@@ -129,8 +120,7 @@ int main(int argc, char **argv)
 	/* Get the effective uid and effective gid of the target process */
 	if (fstat(proc_dir_fd, &st) < 0) {
 -		fprintf(stderr, _("%s: Could not stat directory for target %u\n"),
 -			Prog, target);
 +		fprintf(stderr, _("%s: Could not stat directory for target process\n"), Prog);
 		return EXIT_FAILURE;
 	}
@@ -142,8 +132,8 @@ int main(int argc, char **argv)
 	    (!getdef_bool("GRANT_AUX_GROUP_SUBIDS") && (getgid() != pw->pw_gid)) ||
 	    (pw->pw_uid != st.st_uid) ||
 	    (getgid() != st.st_gid)) {
 -		fprintf(stderr, _( "%s: Target process %u is owned by a different user: uid:%lu pw_uid:%lu st_uid:%lu, gid:%lu pw_gid:%lu st_gid:%lu\n" ),
 -			Prog, target,
 +		fprintf(stderr, _( "%s: Target process is owned by a different user: uid:%lu pw_uid:%lu st_uid:%lu, gid:%lu pw_gid:%lu st_gid:%lu\n" ),
 +			Prog,
 			(unsigned long int)getuid(), (unsigned long int)pw->pw_uid, (unsigned long int)st.st_uid,
 			(unsigned long int)getgid(), (unsigned long int)pw->pw_gid, (unsigned long int)st.st_gid);
 		return EXIT_FAILURE;
 -- 
 2.39.2
 From 7ff33fae6f9cd79c0e012671c37a172e9a681d0b Mon Sep 17 00:00:00 2001
 From: Serge Hallyn <serge@hallyn.com>
 Date: Fri, 24 Feb 2023 13:52:32 -0600
 Subject: [PATCH] get_pidfd_from_fd: return -1 on error, not 0
 Fixes: 6974df39a: newuidmap and newgidmap: support passing pid as fd
 Signed-off-by: Serge Hallyn <serge@hallyn.com>
 ---
 lib/get_pid.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/lib/get_pid.c b/lib/get_pid.c
 index ab91d158..5b6d9da4 100644
 --- a/lib/get_pid.c
 +++ b/lib/get_pid.c
@@ -35,6 +35,7 @@ int get_pid (const char *pidstr, pid_t *pid)
 /*
  * If use passed in fd:4 as an argument, then return the
  * value '4', the fd to use.
 + * On error, return -1.
  */
 int get_pidfd_from_fd(const char *pidfdstr)
 {
@@ -47,7 +48,7 @@ int get_pidfd_from_fd(const char *pidfdstr)
 	    || ('\0' != *endptr)
 	    || (ERANGE == errno)
 	    || (/*@+longintegral@*/val != (pid_t)val)/*@=longintegral@*/) {
 -		return 0;
 +		return -1;
 	}
 	return (int)val;
 -- 
 2.39.2
 From 05e2adf509ba0e3779dae66a276b86927a8e1e0e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Vin=C3=ADcius=20dos=20Santos=20Oliveira?=
 <vini.ipsmaker@gmail.com>
 Date: Fri, 24 Feb 2023 18:06:02 -0300
 Subject: [PATCH] Validate fds created by the user
 write_mapping() will do the following:
 openat(proc_dir_fd, map_file, O_WRONLY);
 An attacker could create a directory containing a symlink named
 "uid_map" pointing to any file owned by root, and thus allow him to
 overwrite any root-owned file.
 ---
 lib/get_pid.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 diff --git a/lib/get_pid.c b/lib/get_pid.c
 index 5b6d9da4..8e5e6014 100644
 --- a/lib/get_pid.c
 +++ b/lib/get_pid.c
@@ -41,6 +41,8 @@ int get_pidfd_from_fd(const char *pidfdstr)
 {
 	long long int val;
 	char *endptr;
 +	struct stat st;
 +	dev_t proc_st_dev, proc_st_rdev;
 	errno = 0;
 	val = strtoll (pidfdstr, &endptr, 10);
@@ -51,6 +53,21 @@ int get_pidfd_from_fd(const char *pidfdstr)
 		return -1;
 	}
 +	if (stat("/proc/self/uid_map", &st) < 0) {
 +		return -1;
 +	}
 +
 +	proc_st_dev = st.st_dev;
 +	proc_st_rdev = st.st_rdev;
 +
 +	if (fstat(val, &st) < 0) {
 +		return -1;
 +	}
 +
 +	if (st.st_dev != proc_st_dev || st.st_rdev != proc_st_rdev) {
 +		return -1;
 +	}
 +
 	return (int)val;
 }
 -- 
 2.39.2
--- a/shadow-4.2.1-date-parsing.patch
+++ b/shadow-4.2.1-date-parsing.patch
@ -0,0 +1,69 @@
 Index: shadow-4.5/libmisc/getdate.y
 ===================================================================
 --- shadow-4.5.orig/libmisc/getdate.y
 +++ shadow-4.5/libmisc/getdate.y
@@ -152,6 +152,7 @@ static int	yyHaveDay;
 static int	yyHaveRel;
 static int	yyHaveTime;
 static int	yyHaveZone;
 +static int      yyHaveYear;
 static int	yyTimezone;
 static int	yyDay;
 static int	yyHour;
@@ -293,18 +294,21 @@ date	: tUNUMBER '/' tUNUMBER {
 	      yyDay = $3;
 	      yyYear = $5;
 	    }
 +	    yyHaveYear++;
 	}
 	| tUNUMBER tSNUMBER tSNUMBER {
 	    /* ISO 8601 format.  yyyy-mm-dd.  */
 	    yyYear = $1;
 	    yyMonth = -$2;
 	    yyDay = -$3;
 +	    yyHaveYear++;
 	}
 	| tUNUMBER tMONTH tSNUMBER {
 	    /* e.g. 17-JUN-1992.  */
 	    yyDay = $1;
 	    yyMonth = $2;
 	    yyYear = -$3;
 +	    yyHaveYear++;
 	}
 	| tMONTH tUNUMBER {
 	    yyMonth = $1;
@@ -314,6 +318,7 @@ date	: tUNUMBER '/' tUNUMBER {
 	    yyMonth = $1;
 	    yyDay = $2;
 	    yyYear = $4;
 +	    yyHaveYear++;
 	}
 	| tUNUMBER tMONTH {
 	    yyMonth = $2;
@@ -323,6 +328,7 @@ date	: tUNUMBER '/' tUNUMBER {
 	    yyMonth = $2;
 	    yyDay = $1;
 	    yyYear = $3;
 +	    yyHaveYear++;
 	}
 	;
@@ -395,7 +401,8 @@ relunit	: tUNUMBER tYEAR_UNIT {
 number	: tUNUMBER
           {
 -	    if ((yyHaveTime != 0) && (yyHaveDate != 0) && (yyHaveRel == 0))
 +	    if ((yyHaveTime != 0 || $1 >= 100) && !yyHaveYear
 +		&& (yyHaveDate != 0) && (yyHaveRel == 0))
 	      yyYear = $1;
 	    else
 	      {
@@ -802,7 +809,7 @@ yylex (void)
 	  return LookupWord (buff);
 	}
       if (c != '(')
 -	return *yyInput++;
 +	return (unsigned char)*yyInput++;
       Count = 0;
       do
 	{
--- a/shadow-4.5-usermod-unlock.patch
+++ b/shadow-4.5-usermod-unlock.patch
@ -0,0 +1,64 @@
 Index: shadow-4.5/src/usermod.c
 ===================================================================
 --- shadow-4.5.orig/src/usermod.c
 +++ shadow-4.5/src/usermod.c
@@ -455,14 +455,17 @@ static char *new_pw_passwd (char *pw_pas
 		strcat (buf, pw_pass);
 		pw_pass = buf;
 	} else if (Uflg && pw_pass[0] == '!') {
 -		char *s;
 +		char *s = pw_pass;
 -		if (pw_pass[1] == '\0') {
 +		while ('!' == *s)
 +			++s;
 +
 +		if (*s == '\0') {
 			fprintf (stderr,
 			         _("%s: unlocking the user's password would result in a passwordless account.\n"
 			           "You should set a password with usermod -p to unlock this user's password.\n"),
 			         Prog);
 -			return pw_pass;
 +			return NULL;
 		}
 #ifdef WITH_AUDIT
@@ -471,12 +474,15 @@ static char *new_pw_passwd (char *pw_pas
 		              user_newname, (unsigned int) user_newid, 1);
 #endif
 		SYSLOG ((LOG_INFO, "unlock user '%s' password", user_newname));
 -		s = pw_pass;
 -		while ('\0' != *s) {
 -			*s = *(s + 1);
 -			s++;
 -		}
 +		memmove (pw_pass, s, strlen (s) + 1);
 	} else if (pflg) {
 +		if (strchr (user_pass, ':') != NULL) {
 +			fprintf (stderr,
 +			         _("%s: The password field cannot contain a colon character.\n"),
 +			         Prog);
 +			return NULL;
 +
 +		}
 #ifdef WITH_AUDIT
 		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
 		              "updating-password",
@@ -525,6 +531,8 @@ static void new_pwent (struct passwd *pw
 	if (   (!is_shadow_pwd)
 	    || (strcmp (pwent->pw_passwd, SHADOW_PASSWD_STRING) != 0)) {
 		pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd);
 +		if (pwent->pw_passwd == NULL)
 +			fail_exit (E_PW_UPDATE);
 	}
 	if (uflg) {
@@ -639,6 +647,8 @@ static void new_spent (struct spwd *spen
 	 *  + aging has been requested
 	 */
 	spent->sp_pwdp = new_pw_passwd (spent->sp_pwdp);
 +	if (spent->sp_pwdp == NULL)
 +		fail_exit(E_PW_UPDATE);
 	if (pflg) {
 		spent->sp_lstchg = (long) gettime () / SCALE;
--- a/shadow-4.6-move-home.patch
+++ b/shadow-4.6-move-home.patch
@ -0,0 +1,15 @@
 diff -up shadow-4.6/src/usermod.c.move-home shadow-4.6/src/usermod.c
 --- shadow-4.6/src/usermod.c.move-home	2018-05-28 14:59:05.594076665 +0200
 +++ shadow-4.6/src/usermod.c	2018-05-28 15:00:28.479837392 +0200
@@ -1845,6 +1845,11 @@ static void move_home (void)
 			         Prog, prefix_user_home, prefix_user_newhome);
 			fail_exit (E_HOMEDIR);
 		}
 +	} else {
 +		fprintf (stderr,
 +		         _("%s: The previous home directory (%s) does "
 +		           "not exist or is inaccessible. Move cannot be completed.\n"),
 +		         Prog, prefix_user_home);
 	}
 }
--- a/shadow-4.6-sysugid-min-limit.patch
+++ b/shadow-4.6-sysugid-min-limit.patch
@ -0,0 +1,34 @@
 diff -up shadow-4.6/libmisc/find_new_gid.c.min-limit shadow-4.6/libmisc/find_new_gid.c
 --- shadow-4.6/libmisc/find_new_gid.c.min-limit	2018-04-29 18:42:37.000000001 +0200
 +++ shadow-4.6/libmisc/find_new_gid.c	2018-11-06 10:51:20.554963292 +0100
@@ -82,6 +82,13 @@ static int get_ranges (bool sys_group, g
                             (unsigned long) *max_id);
 			return EINVAL;
 		}
 +		/*
 +		 * Zero is reserved for root and the allocation algorithm does not
 +		 * work right with it.
 +		 */
 +		if (*min_id == 0) {
 +			*min_id = (gid_t) 1;
 +		}
 	} else {
 		/* Non-system groups */
 diff -up shadow-4.6/libmisc/find_new_uid.c.min-limit shadow-4.6/libmisc/find_new_uid.c
 --- shadow-4.6/libmisc/find_new_uid.c.min-limit	2018-04-29 18:42:37.000000001 +0200
 +++ shadow-4.6/libmisc/find_new_uid.c	2018-11-06 10:51:39.341399569 +0100
@@ -82,6 +82,13 @@ static int get_ranges (bool sys_user, ui
                             (unsigned long) *max_id);
 			return EINVAL;
 		}
 +		/*
 +		 * Zero is reserved for root and the allocation algorithm does not
 +		 * work right with it.
 +		 */
 +		if (*min_id == 0) {
 +			*min_id = (uid_t) 1;
 +		}
 	} else {
 		/* Non-system users */
--- a/shadow-4.8-ignore-login-prompt.patch
+++ b/shadow-4.8-ignore-login-prompt.patch
@ -0,0 +1,11 @@
 diff -up shadow-4.8/lib/getdef.c.login-prompt shadow-4.8/lib/getdef.c
 --- shadow-4.8/lib/getdef.c.login-prompt	2020-01-13 10:38:44.852796681 +0100
 +++ shadow-4.8/lib/getdef.c	2020-01-13 10:39:54.472612511 +0100
@@ -98,6 +98,7 @@ static struct itemdef def_table[] = {
 	{"LASTLOG_UID_MAX", NULL},
 	{"LOGIN_RETRIES", NULL},
 	{"LOGIN_TIMEOUT", NULL},
 +	{"LOGIN_PLAIN_PROMPT", NULL},
 	{"LOG_OK_LOGINS", NULL},
 	{"LOG_UNKFAIL_ENAB", NULL},
 	{"MAIL_DIR", NULL},
--- a/shadow-4.9-default-range.patch
+++ b/shadow-4.9-default-range.patch
@ -0,0 +1,35 @@
 diff -up shadow-4.9/lib/semanage.c.default-range shadow-4.9/lib/semanage.c
 --- shadow-4.9/lib/semanage.c.default-range	2021-07-22 23:55:35.000000000 +0200
 +++ shadow-4.9/lib/semanage.c	2021-08-02 12:43:16.822817392 +0200
@@ -143,6 +143,7 @@ static int semanage_user_mod (semanage_h
 		goto done;
 	}
 +#if 0
 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
 	if (ret != 0) {
 		fprintf (shadow_logfd,
@@ -150,6 +151,7 @@ static int semanage_user_mod (semanage_h
 		ret = 1;
 		goto done;
 	}
 +#endif
 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
 	if (ret != 0) {
@@ -200,6 +202,7 @@ static int semanage_user_add (semanage_h
 		goto done;
 	}
 +#if 0
 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
 	if (ret != 0) {
 		fprintf (shadow_logfd,
@@ -208,6 +211,7 @@ static int semanage_user_add (semanage_h
 		ret = 1;
 		goto done;
 	}
 +#endif
 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
 	if (ret != 0) {
--- a/shadow-4.9-manfix.patch
+++ b/shadow-4.9-manfix.patch
@ -0,0 +1,180 @@
 diff -up shadow-4.8.1/man/groupmems.8.xml.manfix shadow-4.8.1/man/groupmems.8.xml
 --- shadow-4.8.1/man/groupmems.8.xml.manfix	2020-03-17 15:34:48.750414984 +0100
 +++ shadow-4.8.1/man/groupmems.8.xml	2020-03-17 15:41:13.383588722 +0100
@@ -179,20 +179,10 @@
   <refsect1 id='setup'>
     <title>SETUP</title>
     <para>
 -      The <command>groupmems</command> executable should be in mode
 -      <literal>2710</literal> as user <emphasis>root</emphasis> and in group
 -      <emphasis>groups</emphasis>. The system administrator can add users to
 -      group <emphasis>groups</emphasis> to allow or disallow them using the
 -      <command>groupmems</command> utility to manage their own group
 -      membership list.
 +      In this operating system the <command>groupmems</command> executable
 +      is not setuid and regular users cannot use it to manipulate
 +      the membership of their own group.
     </para>
 -
 -    <programlisting>
 -	$ groupadd -r groups
 -	$ chmod 2710 groupmems
 -	$ chown root.groups groupmems
 -	$ groupmems -g groups -a gk4
 -    </programlisting>
   </refsect1>
   <refsect1 id='configuration'>
 diff -up shadow-4.8.1/man/ja/man5/login.defs.5.manfix shadow-4.8.1/man/ja/man5/login.defs.5
 --- shadow-4.8.1/man/ja/man5/login.defs.5.manfix	2019-07-23 17:26:08.000000000 +0200
 +++ shadow-4.8.1/man/ja/man5/login.defs.5	2020-03-17 15:34:48.750414984 +0100
@@ -147,10 +147,6 @@ 以下の参照表は、
 shadow パスワード機能のどのプログラムが
 どのパラメータを使用するかを示したものである。
 .na
 -.IP chfn 12
 -CHFN_AUTH CHFN_RESTRICT
 -.IP chsh 12
 -CHFN_AUTH
 .IP groupadd 12
 GID_MAX GID_MIN
 .IP newusers 12
 diff -up shadow-4.8.1/man/login.defs.5.xml.manfix shadow-4.8.1/man/login.defs.5.xml
 --- shadow-4.8.1/man/login.defs.5.xml.manfix	2020-01-17 16:47:56.000000000 +0100
 +++ shadow-4.8.1/man/login.defs.5.xml	2020-03-17 15:34:48.750414984 +0100
@@ -164,6 +164,17 @@
       long numeric parameters is machine-dependent.
     </para>
 +    <para>
 +      Please note that the parameters in this configuration file control the
 +      behavior of the tools from the shadow-utils component. None of these
 +      tools uses the PAM mechanism, and the utilities that use PAM (such as the
 +      passwd command) should be configured elsewhere. The only values that
 +      affect PAM modules are <emphasis>ENCRYPT_METHOD</emphasis> and <emphasis>SHA_CRYPT_MAX_ROUNDS</emphasis>
 +      for pam_unix module, <emphasis>FAIL_DELAY</emphasis> for pam_faildelay module,
 +      and <emphasis>UMASK</emphasis> for pam_umask module. Refer to
 +      pam(8) for more information.
 +    </para>
 +
     <para>The following configuration items are provided:</para>
     <variablelist remap='IP'>
@@ -256,16 +267,6 @@
 	</listitem>
       </varlistentry>
       <varlistentry>
 -	<term>chfn</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CHFN_AUTH</phrase>
 -	    CHFN_RESTRICT
 -	    <phrase condition="no_pam">LOGIN_STRING</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
 -      <varlistentry>
 	<term>chgpasswd</term>
 	<listitem>
 	  <para>
@@ -286,14 +287,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
 -      <varlistentry condition="no_pam">
 -	<term>chsh</term>
 -	<listitem>
 -	  <para>
 -	    CHSH_AUTH LOGIN_STRING
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <!-- expiry: no variables (CONSOLE_GROUPS linked, but not used) -->
       <!-- faillog: no variables -->
       <varlistentry>
@@ -359,34 +352,6 @@
 	  <para>LASTLOG_UID_MAX</para>
 	</listitem>
       </varlistentry>
 -      <varlistentry>
 -	<term>login</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CONSOLE</phrase>
 -	    CONSOLE_GROUPS DEFAULT_HOME
 -	    <phrase condition="no_pam">ENV_HZ ENV_PATH ENV_SUPATH
 -	    ENV_TZ ENVIRON_FILE</phrase>
 -	    ERASECHAR FAIL_DELAY
 -	    <phrase condition="no_pam">FAILLOG_ENAB</phrase>
 -	    FAKE_SHELL
 -	    <phrase condition="no_pam">FTMP_FILE</phrase>
 -	    HUSHLOGIN_FILE
 -	    <phrase condition="no_pam">ISSUE_FILE</phrase>
 -	    KILLCHAR
 -	    <phrase condition="no_pam">LASTLOG_ENAB LASTLOG_UID_MAX</phrase>
 -	    LOGIN_RETRIES
 -	    <phrase condition="no_pam">LOGIN_STRING</phrase>
 -	    LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB
 -	    <phrase condition="no_pam">MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE
 -	    MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB
 -	    QUOTAS_ENAB</phrase>
 -	    TTYGROUP TTYPERM TTYTYPE_FILE
 -	    <phrase condition="no_pam">ULIMIT UMASK</phrase>
 -	    USERGROUPS_ENAB
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <!-- logoutd: no variables -->
       <varlistentry>
 	<term>newgrp / sg</term>
@@ -415,17 +380,6 @@
 	</listitem>
       </varlistentry>
       <!-- nologin: no variables -->
 -      <varlistentry condition="no_pam">
 -	<term>passwd</term>
 -	<listitem>
 -	  <para>
 -	    ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB
 -	    PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN
 -	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
 -	    SHA_CRYPT_MIN_ROUNDS</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <varlistentry>
 	<term>pwck</term>
 	<listitem>
@@ -452,32 +406,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
 -      <varlistentry>
 -	<term>su</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CONSOLE</phrase>
 -	    CONSOLE_GROUPS DEFAULT_HOME
 -	    <phrase condition="no_pam">ENV_HZ ENVIRON_FILE</phrase>
 -	    ENV_PATH ENV_SUPATH
 -	    <phrase condition="no_pam">ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB
 -	    MAIL_DIR MAIL_FILE QUOTAS_ENAB</phrase>
 -	    SULOG_FILE SU_NAME
 -	    <phrase condition="no_pam">SU_WHEEL_ONLY</phrase>
 -	    SYSLOG_SU_ENAB
 -	    <phrase condition="no_pam">USERGROUPS_ENAB</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
 -      <varlistentry>
 -	<term>sulogin</term>
 -	<listitem>
 -	  <para>
 -	    ENV_HZ
 -	    <phrase condition="no_pam">ENV_TZ</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <varlistentry>
 	<term>useradd</term>
 	<listitem>
--- a/shadow-utils.login.defs
+++ b/shadow-utils.login.defs
@ -130,9 +130,10 @@ HOME_MODE	0700
 #
 PASS_MAX_DAYS	99999
 PASS_MIN_DAYS	0
 PASS_MIN_LEN	8
 PASS_WARN_AGE	7
 # Currently PASS_MIN_LEN is not supported
 # Currently SU_WHEEL_ONLY is not supported
 # Currently CRACKLIB_DICTPATH is not supported
@ -173,22 +174,11 @@ SUB_GID_COUNT		    65536
 #
 #LOGIN_TIMEOUT		60
-#
+# Currently PASS_CHANGE_TRIES is not supported
 # Maximum number of attempts to change password if rejected (too easy)
 #
 PASS_CHANGE_TRIES	5
-#
+# Currently PASS_ALWAYS_WARN is not supported
 # Warn about weak passwords (but still allow them) if you are root.
 #
 PASS_ALWAYS_WARN	yes
-#
+# Currently PASS_MAX_LEN is not supported
 # Number of significant characters in the password for crypt().
 # Default is 8, don't change unless your crypt() is better.
 # Ignored if MD5_CRYPT_ENAB set to "yes".
 #
 #PASS_MAX_LEN		8
 # Currently CHFN_AUTH is not supported
--- a/shadow-utils.spec
+++ b/shadow-utils.spec
@ -1,30 +1,60 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
-Version: 4.20.0
+Version: 4.12.3
-Release: 1%{?dist}
+Release: 6%{?dist}
 Epoch: 2
-License: BSD-3-Clause AND GPL-2.0-or-later
+License: BSD and GPLv2+
 URL: https://github.com/shadow-maint/shadow
-Source0: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz
+Source0: https://github.com/shadow-maint/shadow/releases/download/v%{version}/shadow-%{version}.tar.xz
-Source1: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz.asc
+Source1: https://github.com/shadow-maint/shadow/releases/download/v%{version}/shadow-%{version}.tar.xz.asc
 Source2: shadow-utils.useradd
 Source3: shadow-utils.login.defs
 Source4: shadow-bsd.txt
 Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
 Source6: shadow-utils.HOME_MODE.xml
 Source7: passwd.pamd
 ### Globals ###
 %global includesubiddir %{_includedir}/shadow
 # Fail linking if there are undefined symbols.
 %global _ld_strict_symbol_defs 1
 ### Patches ###
 # Misc small changes - most probably non-upstreamable
 Patch0: shadow-4.12.3-redhat.patch
 # https://github.com/shadow-maint/shadow/commit/cfc981df2afc615e3792b918e9ee49e631b0a3a9
 Patch1: shadow-4.12.3-goodname.patch
 # SElinux related - upstreamability unknown
 Patch3: shadow-4.9-default-range.patch
 # Misc manual page changes - non-upstreamable
 Patch4: shadow-4.9-manfix.patch
 # Date parsing improvement - could be upstreamed
 Patch5: shadow-4.2.1-date-parsing.patch
 # Additional error message - could be upstreamed
 Patch6: shadow-4.6-move-home.patch
 # Audit message changes - upstreamability unknown
 Patch7: shadow-4.11.1-audit-update.patch
 # Changes related to password unlocking - could be upstreamed
 Patch8: shadow-4.5-usermod-unlock.patch
 # Additional SElinux related changes - upstreamability unknown
 Patch9: shadow-4.12.3-selinux-perms.patch
 # Handle NULL return from *time funcs - upstreamable
 Patch10: shadow-4.11.1-null-tm.patch
 # Handle /etc/passwd corruption - could be upstreamed
 Patch11: shadow-4.12.3-long-entry.patch
 # Limit uid/gid allocation to non-zero - could be upstreamed
 Patch12: shadow-4.6-sysugid-min-limit.patch
 # Ignore LOGIN_PLAIN_PROMPT in login.defs - upstreamability unknown
 Patch13: shadow-4.8-ignore-login-prompt.patch
 # https://github.com/shadow-maint/shadow/commit/ebf9b232b012725d2be5e750876c7336cf1c37fd
 Patch14: shadow-4.12.3-useradd-stop-last-fail-log-reset.patch
 # https://github.com/shadow-maint/shadow/commit/e503fd574b7dbf6b21b1168e20938f0922807916
 Patch15: shadow-4.12.3-chage-print-date-regression.patch
 # https://github.com/shadow-maint/shadow/commit/6974df39a708abf8bafbdfa2b7827e0f70f874cb
 # https://github.com/shadow-maint/shadow/commit/7ff33fae6f9cd79c0e012671c37a172e9a681d0b
 # https://github.com/shadow-maint/shadow/commit/05e2adf509ba0e3779dae66a276b86927a8e1e0e
 Patch16: shadow-4.13-newidmap-support-passing-pid-as-fd.patch
 ### Dependencies ###
 Requires: audit-libs >= 1.6.5
 Requires: libselinux >= 1.25.2-1
 Requires: pam-libs
 Requires: setup
 ### Build Dependencies ###
@ -37,38 +67,19 @@ BuildRequires: docbook-style-xsl
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: gettext-devel
 BuildRequires: git
 BuildRequires: itstool
 BuildRequires: libacl-devel
 BuildRequires: libattr-devel
-BuildRequires: libcmocka-devel
+BuildRequires: libbsd-devel
 BuildRequires: libeconf-devel
 BuildRequires: libselinux-devel >= 1.25.2-1
 BuildRequires: libsemanage-devel
 BuildRequires: libtool
 BuildRequires: libxcrypt-devel
 BuildRequires: libxslt
 BuildRequires: make
 BuildRequires: pam
 BuildRequires: pam-devel
 ### Provides ###
 Provides: shadow = %{epoch}:%{version}-%{release}
 Provides: passwd = 0.80-18
 Obsoletes: passwd <= 0.80-19
 %if "%{_sbindir}" == "%{_bindir}"
 # Compat symlinks for Requires in other packages.
 # We rely on filesystem to create the symlinks for us.
 Requires: filesystem(unmerged-sbin-symlinks)
 Provides: /usr/sbin/adduser
 Provides: /usr/sbin/useradd
 Provides: /usr/sbin/userdel
 Provides: /usr/sbin/usermod
 Provides: /usr/sbin/groupadd
 Provides: /usr/sbin/groupdel
 Provides: /usr/sbin/groupmod
 %endif
 %description
 The shadow-utils package includes the necessary programs for
@ -77,14 +88,16 @@ programs for managing user and group accounts. The pwconv command
 converts passwords to the shadow password format. The pwunconv command
 unconverts shadow passwords and generates a passwd file (a standard
 UNIX password file). The pwck command checks the integrity of password
-and shadow files. The useradd, userdel, and usermod commands are used
+and shadow files. The lastlog command prints out the last login times
-for managing user accounts. The groupadd, groupdel, and groupmod
+for all users. The useradd, userdel, and usermod commands are used for
-commands are used for managing group accounts.
+managing user accounts. The groupadd, groupdel, and groupmod commands
 are used for managing group accounts.
 ### Subpackages ###
 %package subid
 Summary: A library to manage subordinate uid and gid ranges
 License: BSD and GPLv2+
 %description subid
 Utility library that provides a way to manage subid ranges.
@ -92,13 +105,30 @@ Utility library that provides a way to manage subid ranges.
 %package subid-devel
 Summary: Development package for shadow-utils-subid
 License: BSD and GPLv2+
 Requires: shadow-utils-subid = %{epoch}:%{version}-%{release}
 %description subid-devel
 Development files for shadow-utils-subid.
 %prep
-%autosetup -p 1 -S git -n shadow-4.20.0
+%setup -q -n shadow-%{version}
 %patch0 -p1 -b .redhat
 %patch1 -p1 -b .goodname
 %patch3 -p1 -b .default-range
 %patch4 -p1 -b .manfix
 %patch5 -p1 -b .date-parsing
 %patch6 -p1 -b .move-home
 %patch7 -p1 -b .audit-update
 %patch8 -p1 -b .unlock
 %patch9 -p1 -b .selinux-perms
 %patch10 -p1 -b .null-tm
 %patch11 -p1 -b .long-entry
 %patch12 -p1 -b .sysugid-min-limit
 %patch13 -p1 -b .login-prompt
 %patch14 -p1 -b .useradd-stop-last-fail-log-reset
 %patch15 -p1 -b .chage-print-date-regression
 %patch16 -p1 -b .newidmap-pid-fd
 iconv -f ISO88591 -t utf-8  doc/HOWTO > doc/HOWTO.utf8
 cp -f doc/HOWTO.utf8 doc/HOWTO
@ -106,39 +136,39 @@ cp -f doc/HOWTO.utf8 doc/HOWTO
 cp -a %{SOURCE4} %{SOURCE5} .
 cp -a %{SOURCE6} man/login.defs.d/HOME_MODE.xml
 # Force regeneration of getdate.c
 rm libmisc/getdate.c
 %build
 %ifarch sparc64
 #sparc64 need big PIE
 export CFLAGS="$RPM_OPT_FLAGS -fPIE"
 export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
 %else
 export CFLAGS="$RPM_OPT_FLAGS -fpie"
 export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
 %endif
 autoreconf
 %configure \
        --disable-account-tools-setuid \
        --enable-logind=no \
        --enable-man \
        --enable-shadowgrp \
-        --enable-shared \
+        --enable-man \
        --with-audit \
        --with-bcrypt \
        --with-group-name-max-length=32 \
        --with-libpam \
        --with-selinux \
        --with-sha-crypt \
        --with-bcrypt \
        --with-yescrypt \
-        --without-libbsd \
+        --with-selinux \
        --without-libcrack \
-        --without-nscd \
+        --without-libpam \
-        --without-sssd
+        --enable-shared \
        --with-group-name-max-length=32
 %make_build
 %check
 make check
 %install
 %make_install gnulocaledir=$RPM_BUILD_ROOT%{_datadir}/locale MKINSTALLDIRS=`pwd`/mkinstalldirs
 install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/default
 install -p -c -m 0644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/login.defs
 install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/default/useradd
 install -d -m 755 $RPM_BUILD_ROOT%{_pam_confdir}
 install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/chpasswd
 install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/newusers
 install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/passwd
 ln -s useradd $RPM_BUILD_ROOT%{_sbindir}/adduser
@ -147,28 +177,45 @@ for subdir in $RPM_BUILD_ROOT%{_mandir}/{??,??_??,??_??.*}/man* ; do
        test -d $subdir && test -e $subdir/useradd.8 && echo ".so man8/useradd.8" > $subdir/adduser.8
 done
 %if "%{_sbindir}" == "%{_bindir}"
 # The installation script doesn't actually use the configured paths :(
 mv -v $RPM_BUILD_ROOT/usr/sbin/* $RPM_BUILD_ROOT%{_bindir}/
 %endif
 # Remove binaries we don't use.
 rm $RPM_BUILD_ROOT%{_bindir}/chfn
 rm $RPM_BUILD_ROOT%{_bindir}/chsh
 rm $RPM_BUILD_ROOT%{_bindir}/expiry
 rm $RPM_BUILD_ROOT%{_bindir}/groups
 rm $RPM_BUILD_ROOT%{_bindir}/login
 rm $RPM_BUILD_ROOT%{_bindir}/passwd
 rm $RPM_BUILD_ROOT%{_bindir}/su
 rm $RPM_BUILD_ROOT%{_bindir}/faillog
 rm $RPM_BUILD_ROOT%{_sysconfdir}/login.access
 rm $RPM_BUILD_ROOT%{_sysconfdir}/limits
 rm $RPM_BUILD_ROOT%{_sbindir}/logoutd
 rm $RPM_BUILD_ROOT%{_sbindir}/nologin
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chsh.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chsh.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/expiry.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/expiry.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/groups.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/groups.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/login.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/login.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/su.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/su.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/limits.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/limits.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/login.access.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/login.access.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/porttime.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/porttime.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/suauth.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/suauth.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/logoutd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/logoutd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/man3/getspnam.*
@ -178,12 +225,6 @@ rm $RPM_BUILD_ROOT%{_mandir}/*/man5/faillog.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/faillog.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/faillog.*
 # Remove PAM service files we don't use.
 rm $RPM_BUILD_ROOT%{_pam_confdir}/chfn
 rm $RPM_BUILD_ROOT%{_pam_confdir}/chsh
 rm $RPM_BUILD_ROOT%{_pam_confdir}/login
 rm $RPM_BUILD_ROOT%{_pam_confdir}/su
 find $RPM_BUILD_ROOT%{_mandir} -depth -type d -empty -delete
 %find_lang shadow
 for dir in $(ls -1d $RPM_BUILD_ROOT%{_mandir}/{??,??_??}) ; do
@ -208,16 +249,13 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %license gpl-2.0.txt shadow-bsd.txt
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/login.defs
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/default/useradd
 %config(noreplace) %{_pam_confdir}/chpasswd
 %config(noreplace) %{_pam_confdir}/newusers
 %config(noreplace) %{_pam_confdir}/passwd
 %{_bindir}/sg
 %attr(4755,root,root) %{_bindir}/chage
 %attr(4755,root,root) %{_bindir}/gpasswd
 %{_bindir}/lastlog
 %attr(4755,root,root) %{_bindir}/newgrp
 %attr(0755,root,root) %caps(cap_setgid=ep) %{_bindir}/newgidmap
 %attr(0755,root,root) %caps(cap_setuid=ep) %{_bindir}/newuidmap
 %attr(4755,root,root) %{_bindir}/passwd
 %{_sbindir}/adduser
 %attr(0755,root,root)   %{_sbindir}/user*
 %attr(0755,root,root)   %{_sbindir}/group*
@ -235,7 +273,6 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_mandir}/man1/newgrp.1*
 %{_mandir}/man1/newgidmap.1*
 %{_mandir}/man1/newuidmap.1*
 %{_mandir}/man1/passwd.*
 %{_mandir}/man3/shadow.3*
 %{_mandir}/man5/shadow.5*
 %{_mandir}/man5/login.defs.5*
@ -251,6 +288,7 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_mandir}/man8/chgpasswd.8*
 %{_mandir}/man8/newusers.8*
 %{_mandir}/man8/*conv.8*
 %{_mandir}/man8/lastlog.8*
 %{_mandir}/man8/vipw.8*
 %{_mandir}/man8/vigr.8*
@ -264,195 +302,15 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_libdir}/libsubid.so
 %changelog
-* Wed Jul 29 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-1
+* Mon Mar 27 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-6
 - Rebase to version 4.20.0
 * Wed Jul 22 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-rc3-1
 - Rebase to version 4.20.0-rc3
 * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.3-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 * Wed May 27 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-3
 - Enable use of PAM for chpasswd and newusers
  Resolves: #2461179 and #2283963
 * Thu Apr 23 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-2
 - btrfs: simplify checks improve useradd behavior for non-btrfs
 * Wed Feb 11 2026 Debarshi Ray <rishi@fedoraproject.org> - 2:4.19.3-1
 - Rebase to version 4.19.3
  Resolves: #2426288
 * Tue Jan 27 2026 Adam Williamson <awilliam@redhat.com> - 2:4.19.0-6
 - chkhash.c: fix escaping in SHA-256 / SHA-512 / MD5 regexes
 * Mon Jan 26 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-5
 - chkhash.c: fix support for ! and * in hashes
 - usermod.c: add back optimizations
 * Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
 * Mon Jan 12 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-3
 - useradd: Support config for creating home dirs as Btrfs subvolumes
 * Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-2
 - Enable unit-tests
 * Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-1
 - Rebase to version 4.19.0
  Resolves: #2426288 and #2249524
 * Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-7
 - Also revert changes from -4 (last known good was -3)
 * Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-6
 - Revert changes from -5 (they were only meant for testing)
 * Tue Nov 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-5
 - Test CI
 * Fri Oct 31 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-4
 - Stop setting SELinux labels in chroot and prefix environments
  Resolves: #2249524
 * Tue Jul 29 2025 Alexey Tikhonov <atikhono@redhat.com> - 2:4.18.0-3
 - Revert "Stop assigning subids by default"
  Resolves: #2382662
 * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.18.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 * Tue Jul 22 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-1
 - Rebase to version 4.18.0. Resolves: #2374710
 * Fri Jul 18 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-5
 - Stop assigning subids by default
  Resolves: CVE-2024-56433 and #2334168
 * Tue Jul 15 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-4
 - FSWC: Migrate to lastlog2
  Link: <https://fedoraproject.org/wiki/Changes/Migrate_to_lastlog2>
  Resolves: #2361588
 * Tue Mar 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-2
 - Add pam dependency for _pam_confdir missing macro. Resolves: #2354806
 * Thu Mar 20 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-1
 - Rebase to version 4.17.4. Resolves: #2353491
 - Fixes problems with expiration dates
 * Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0-5
 - Add explicit BR: libxcrypt-devel
 * Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.17.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.17.0-3
 - Rebuilt for the bin-sbin merge (2nd attempt)
 * Thu Dec 26 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0
 - Rebase to version 4.17.0. Resolves: #2293678
 * Sun Dec 22 2024 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0~rc1-2
 - Remove potentially dangerous {C,LD}FLAGS shenanigans
 - Fail linking if there are undefined symbols at link-time
 * Mon Dec  9 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0~rc1-1
 - Rebase to version 4.17.0-rc1
 * Tue Nov 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-7
 - SPDX license migration for subpackages
 * Wed Oct 16 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-6
 - Rebuilt for libeconf soname bump
 * Mon Oct  7 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-5
 - useradd: fix write_full() return value. Resolves: #2313559
 * Fri Sep 13 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-3
 - Disable nscd
 * Wed Aug 28 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-2
 - Rebase to version 4.16.0 (#2293678)
 * Tue Jul 23 2024 Kevin Fenzi <kevin@scrye.com> - 2:4.15.1-9
 - Revert chpasswd: use PAM again for now.
 * Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.15.1-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-7
 - Rebuilt for the bin-sbin merge
 * Thu May 30 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-6
 - chpasswd: use PAM again (#2283963)
 * Mon May 20 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-5
 - Several fixes for issues detected by static analyzer tools
 * Thu Apr 11 2024 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-4
 - Fix build with %%_bindir==%%_sbindir
 - Add virtual Provides for old file paths used by other packages
 * Thu Mar 21 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-2
 - getdef: avoid spurious error messages about unknown configuration options.
  Resolves: #2265291
 * Tue Mar 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-1
 - Wrong versioning for 4.15.0 RC releases makes the oficial release look lower than them.
  Fix it by bumping the minor release to 4.15.1. Resolves: #2268690
 * Mon Mar 11 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
 - Rebase to version 4.15.0
 * Mon Feb 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-6
 - Build linking `libpam`
 * Thu Feb  1 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
 - passwd: Provide binary from this package. Enable libpam and
  disable account-tools-setuid. Provide passwd PAM service file.
  Resolves: #2233275
 - passwd: provide --stdin option
 * Mon Jan 29 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-4
 - Disable SSSD support. Resolves: #2253182
 * Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.14.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 * Tue Oct  3 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-2
 - useradd: Set proper SELinux labels for def_usrtemplate
 * Wed Aug 16 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-1
 - Rebase to version 4.14.0. Resolves: #2229000
 * Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 * Tue Jun 06 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 2:4.13-7
 - Remove unused libbsd-devel dependency
 * Mon Mar  6 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-6
 - Add libbsd-devel and libeconf-devel as build dependencies
-* Thu Mar  2 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-5
+* Tue Mar 21 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-5
 - newuidmap and newgidmap: support passing pid as fd. Resolves: #2174752
-* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-4
+* Tue Nov 29 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 * Wed Nov 23 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-3
 - Change SUB_UID_MIN and SUB_GID_MIN to 524288. Resolves: #2144558
 * Mon Nov 21 2022 Florian Weimer <fweimer@redhat.com> - 2:4.13-2
 - Fix gshadow configure check (switching to glibc implementation)
 * Wed Nov  9 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-1
 - Rebase to version 4.13
 - SPDX license migration
 * Wed Oct  5 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-3
 - chage: Fix regression in print_date. Resolves: #2129336
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406
+SHA512 (shadow-4.12.3.tar.xz) = 0529889258f54e7634762dc154aa680d55f8c5f1654afadd1b7431cfbb890a3b1ba27c7ff4b7c45986e4ee2289946db2e420b23ed13e4e5b15800a1fb3a013bc
-SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac
+SHA512 (shadow-4.12.3.tar.xz.asc) = d3f294d86c0e2174c88809810a801737c01cd01f9cadbe7b1ae382b2745d86e2e30c0718fa6489c2abb65500ed94c8ac1961d05243b5a1800c966384c69281c9
--- a/tests/mhc-fedora-ci.yaml
+++ b/tests/mhc-fedora-ci.yaml
@ -1,13 +0,0 @@
 provisioned_topologies:
 - shadow
 domains:
 - id: shadow
  hosts:
  - hostname: localhost
    role: shadow
    conn:
      type: ssh
      host: localhost
      user: root
    artifacts:
    - /var/log/*
--- a/tests/sanity/Makefile
+++ b/tests/sanity/Makefile
@ -0,0 +1,77 @@
 # Copyright (c) 2006 Red Hat, Inc. All rights reserved. This copyrighted material 
 # is made available to anyone wishing to use, modify, copy, or
 # redistribute it subject to the terms and conditions of the GNU General
 # Public License v.2.
 #
 # This program is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 # PARTICULAR PURPOSE. See the GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 #
 # Author: Jakub Hrozek
 #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
 # Example Makefile for RHTS                                          #
 # This example is geared towards a test for a specific package       #
 # It does most of the work for you, but may require further coding   #
 #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
 # The toplevel namespace within which the test lives.
 TOPLEVEL_NAMESPACE=CoreOS
 # The name of the package under test:
 PACKAGE_NAME=shadow-utils
 # The path of the test below the package:
 RELATIVE_PATH=sanity
 # Version of the Test. Used with make tag.
 export TESTVERSION=1.1
 # The combined namespace of the test.
 export TEST=/$(TOPLEVEL_NAMESPACE)/$(PACKAGE_NAME)/$(RELATIVE_PATH)
 # A phony target is one that is not really the name of a file.
 # It is just a name for some commands to be executed when you
 # make an explicit request. There are two reasons to use a
 # phony target: to avoid a conflict with a file of the same
 # name, and to improve performance.
 .PHONY: all install download clean
 # Executables to be built should be added here, they will be generated on the system under test.
 BUILT_FILES= 
 # Data files, .c files, scripts anything needed to either compile the test and/or run it.
 FILES=$(METADATA) Makefile PURPOSE sanity_test.py runtest.sh
 run: $(FILES) build
 	./runtest.sh
 build: $(BUILT_FILES)
 	chmod a+x ./sanity_test.py
 	chmod a+x ./runtest.sh
 clean:
 	rm -f *~ *.rpm $(BUILT_FILES)
 # Include Common Makefile
 include /usr/share/rhts/lib/rhts-make.include
 # Generate the testinfo.desc here:
 $(METADATA): Makefile
 	@touch $(METADATA)
 	@echo "Owner:        Jakub Hrozek <jhrozek@redhat.com>" > $(METADATA)
 	@echo "Name:         $(TEST)" >> $(METADATA)
 	@echo "Path:         $(TEST_DIR)" >> $(METADATA)
 	@echo "TestVersion:  $(TESTVERSION)" >> $(METADATA)
 	@echo "License:      GNU GPL" >> $(METADATA)
 	@echo "Description:  Basic sanity test for shadow-utils" >> $(METADATA)
 	@echo "TestTime:     5m" >> $(METADATA)
 	@echo "RunFor:       $(PACKAGE_NAME)" >> $(METADATA)
 	@echo "Requires:     $(PACKAGE_NAME)" >> $(METADATA)
 	@echo "Requires:     python" >> $(METADATA)
 	rhts-lint $(METADATA)
--- a/tests/sanity/PURPOSE
+++ b/tests/sanity/PURPOSE
@ -0,0 +1,10 @@
 This is a basic sanity test for the shadow-utils package. It is implemented
 in python on top of the unittesting.py module.
 Its purpose is to ensure that the binaries in the shadow-utils package behave
 as expected and its switches/options work correctly.
 For the most part, every binary in the shadow-utils package is represented by
 a single class named Test<BinaryName>, i.e. TestUsermod etc. There are some 
 exceptions, like TestUseraddWeirdNameTest though.
--- a/tests/sanity/runtest.sh
+++ b/tests/sanity/runtest.sh
@ -0,0 +1,24 @@
 #!/bin/bash
 . /usr/bin/rhts-environment.sh
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 rlJournalStart
 rlFileBackup --clean /etc/default/useradd- /etc/default/useradd
 setenforce 0
 python sanity_test.py -v
 setenforce 1
 rlFileRestore
 EXIT=$?
 if [[ $EXIT -eq 0 ]]; then
    RESULT="PASS"
 else
    RESULT="FAIL"
 fi
 rlJournalEnd
 echo "Result: $RESULT"
 echo "Exit: $EXIT"
 report_result $TEST $RESULT $EXIT
--- a/tests/sanity/sanity_test.py
+++ b/tests/sanity/sanity_test.py
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,13 @@
 ---
 # This first play always runs on the local staging system
 - hosts: localhost
  roles:
  - role: standard-test-beakerlib
    tags:
    - classic
    - atomic
    tests:
    - sanity
    required_packages:
    - shadow-utils     # sanity test needs shadow-utils
    - python           # sanity test needs python
Author	SHA1	Message	Date
Iker Pedrosa	286be4ff99	Add build dependencies Add libbsd-devel and libeconf-devel as build dependencies Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>	2023-03-27 14:08:51 +02:00
Iker Pedrosa	1e7ad7815a	newuidmap and newgidmap: support passing pid as fd Resolves: #2174752 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>	2023-03-21 09:56:32 +01:00
Iker Pedrosa	352ac0715c	Change SUB_UID_MIN and SUB_GID_MIN to 524288 Resolves: #2144558 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>	2022-11-29 10:18:07 +01:00
`@ -1,2 +1,2 @@`
	`SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406`	`SHA512 (shadow-4.12.3.tar.xz) = 0529889258f54e7634762dc154aa680d55f8c5f1654afadd1b7431cfbb890a3b1ba27c7ff4b7c45986e4ee2289946db2e420b23ed13e4e5b15800a1fb3a013bc`
	`SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac`	`SHA512 (shadow-4.12.3.tar.xz.asc) = d3f294d86c0e2174c88809810a801737c01cd01f9cadbe7b1ae382b2745d86e2e30c0718fa6489c2abb65500ed94c8ac1961d05243b5a1800c966384c69281c9`