btrfs: simplify checks improve useradd behavior for non-btrfs

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
2026-04-29 10:25:15 +02:00
14 changed files with 1556 additions and 104 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
 1
--- a/.gitignore
+++ b/.gitignore
@ -44,13 +44,3 @@ shadow-4.1.4.2.tar.bz2
 /shadow-4.18.0.tar.xz.asc
 /shadow-4.19.0.tar.xz
 /shadow-4.19.0.tar.xz.asc
 /shadow-4.19.2.tar.xz
 /shadow-4.19.2.tar.xz.asc
 /shadow-4.19.3.tar.xz
 /shadow-4.19.3.tar.xz.asc
 /shadow-4.20.0-rc2.tar.xz
 /shadow-4.20.0-rc2.tar.xz.asc
 /shadow-4.20.0-rc3.tar.xz
 /shadow-4.20.0-rc3.tar.xz.asc
 /shadow-4.20.0.tar.xz
 /shadow-4.20.0.tar.xz.asc
--- a/1520.patch
+++ b/1520.patch
@ -0,0 +1,40 @@
 From b721cdd03daa3416127289da02fe781efb2562df Mon Sep 17 00:00:00 2001
 From: Adam Williamson <awilliam@redhat.com>
 Date: Tue, 27 Jan 2026 15:11:07 -0800
 Subject: [PATCH] lib/chkhash.c: fix escaping in SHA-256 / SHA-512 / MD5
 regexes
 `\\n` inside square brackets doesn't include or exclude the
 newline character. It includes or excludes a literal slash and
 the literal character 'n'.
 Fixes: c44f1e096a19 (2025-07-20; "chpasswd: Check hash before write when using -e")
 Closes: <https://github.com/shadow-maint/shadow/issues/1519>
 Signed-off-by: Adam Williamson <awilliam@redhat.com>
 ---
 lib/chkhash.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/lib/chkhash.c b/lib/chkhash.c
 index 101f2004e8..9123038ade 100644
 --- a/lib/chkhash.c
 +++ b/lib/chkhash.c
@@ -62,15 +62,15 @@ is_valid_hash(const char *hash)
 		return true;
 	// SHA-512: $6$ + salt + $ + 86-char hash
 -	if (match_regex("^\\$6\\$(rounds=[1-9][0-9]{3,8}\\$)?[^$:\\n]{1,16}\\$[./A-Za-z0-9]{86}$", hash))
 +	if (match_regex("^\\$6\\$(rounds=[1-9][0-9]{3,8}\\$)?[^$:\n]{1,16}\\$[./A-Za-z0-9]{86}$", hash))
 		return true;
 	// SHA-256: $5$ + salt + $ + 43-char hash
 -	if (match_regex("^\\$5\\$(rounds=[1-9][0-9]{3,8}\\$)?[^$:\\n]{1,16}\\$[./A-Za-z0-9]{43}$", hash))
 +	if (match_regex("^\\$5\\$(rounds=[1-9][0-9]{3,8}\\$)?[^$:\n]{1,16}\\$[./A-Za-z0-9]{43}$", hash))
 		return true;
 	// MD5: $1$ + salt + $ + 22-char hash
 -	if (match_regex("^\\$1\\$[^$:\\n]{1,8}\\$[./A-Za-z0-9]{22}$", hash))
 +	if (match_regex("^\\$1\\$[^$:\n]{1,8}\\$[./A-Za-z0-9]{22}$", hash))
 		return true;
 	// DES: exactly 13 characters from [A-Za-z0-9./]
--- a/plans/tier0-functional.fmf
+++ b/plans/tier0-functional.fmf
@ -1,51 +0,0 @@
 summary: Tier 0 functional tests for shadow-utils
 description: |
    Run comprehensive system tests for shadow-utils. These tests validate user and group
    account management functionality by testing actual system operations including user
    creation, password management, group operations, and verification of system files
    (i.e. /etc/passwd, /etc/shadow).
 provision:
    how: virtual
    image: fedora
 prepare:
    - name: Install general dependencies
      how: install
      package:
        - expect
        - gcc
        - git
        - libssh-devel
        - python3-devel
        - python3-pip
    - name: Setup SSH keys for localhost testing
      how: shell
      script:
        - ssh-keygen -t rsa -f /root/.ssh/id_rsa -N "" -q
        - cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
        - chmod 600 /root/.ssh/authorized_keys
        - ssh-keyscan -H localhost >> /root/.ssh/known_hosts
    - name: Clone shadow repository
      how: shell
      script:
        - git clone https://github.com/shadow-maint/shadow.git /tmp/shadow-test
    - name: Copy test topology for Fedora CI
      how: shell
      script:
        - cp tests/mhc-fedora-ci.yaml /tmp/shadow-test/tests/system
    - name: Install test dependencies
      how: shell
      script:
        - pip3 install -r /tmp/shadow-test/tests/system/requirements.txt
 execute:
    how: tmt
    duration: 30m
    script: |
        cd /tmp/shadow-test/tests/system
        pytest --mh-config=mhc-fedora-ci.yaml --mh-lazy-ssh -v
--- a/shadow-4-19-useradd-support-btrfs.patch
+++ b/shadow-4-19-useradd-support-btrfs.patch
@ -0,0 +1,149 @@
 From 3e8c105f0703264e947d8c034b90419794955d49 Mon Sep 17 00:00:00 2001
 From: Hadi Chokr <hadichokr@icloud.com>
 Date: Fri, 12 Dec 2025 11:18:06 +0100
 Subject: [PATCH] src/useradd: Support config for creating home dirs as Btrfs
 subvolumes
 Closes: #1162
 Co-authored-by: Neal Gompa <ngompa@velocitylimitless.com>
 Signed-off-by: Hadi Chokr <hadichokr@icloud.com>
 Signed-off-by: Neal Gompa <ngompa@velocitylimitless.com>
 Reviewed-by: Alejandro Colomar <alx@kernel.org>
 ---
 man/useradd.8.xml | 27 +++++++++++++++++++++++++++
 src/useradd.c     | 24 ++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 diff --git a/man/useradd.8.xml b/man/useradd.8.xml
 index e6db7f6d..c745a620 100644
 --- a/man/useradd.8.xml
 +++ b/man/useradd.8.xml
@@ -134,6 +134,33 @@
 	  </para>
 	</listitem>
       </varlistentry>
 +      <varlistentry>
 +	<term>
 +	  <option>--btrfs-subvolume-home</option>
 +	</term>
 +	<listitem>
 +	  <para>
 +	    Create the user's home directory as a Btrfs subvolume.
 +	  </para>
 +	  <para>
 +	    If this option is not specified,
 +		<command>useradd</command> will follow the default behavior
 +		defined by the <option>BTRFS_SUBVOLUME_HOME</option> variable
 +		in <filename>/etc/default/useradd</filename>.
 +	    If this variable is not set, the default value is no.
 +	  </para>
 +	  <para>
 +	    When the <option>--btrfs-subvolume-home</option> command-line option
 +	    is specified,
 +		a Btrfs subvolume is created
 +		regardless of any configuration file settings.
 +	  </para>
 +	  <para>
 +	    Note: this feature works only if the underlying filesystem supports
 +	    Btrfs subvolumes.
 +	  </para>
 +	</listitem>
 +      </varlistentry>
       <varlistentry>
 	<term>
 	  <option>-c</option>, <option>--comment</option>&nbsp;<replaceable>COMMENT</replaceable>
 diff --git a/src/useradd.c b/src/useradd.c
 index 899efe3c..8433ed8a 100644
 --- a/src/useradd.c
 +++ b/src/useradd.c
@@ -114,6 +114,7 @@ static const char *def_shell = "/bin/bash";
 static const char *def_template = SKEL_DIR;
 static const char *def_usrtemplate = USRSKELDIR;
 static const char *def_create_mail_spool = "yes";
 +static const char *def_btrfs_subvolume_home = "no";
 static const char *def_log_init = "yes";
 static long def_inactive = -1;
@@ -222,6 +223,7 @@ static bool home_added = false;
 #define DSKEL			"SKEL"
 #define DUSRSKEL		"USRSKEL"
 #define DCREATE_MAIL_SPOOL	"CREATE_MAIL_SPOOL"
 +#define DBTRFS_SUBVOLUME_HOME	"BTRFS_SUBVOLUME_HOME"
 #define DLOG_INIT		"LOG_INIT"
 /* local function prototypes */
@@ -456,6 +458,7 @@ get_defaults(const struct option_flags *flags)
 				def_usrtemplate = xstrdup(ccp);
 			}
 		}
 +
 		/*
 		 * Create by default user mail spool or not ?
 		 */
@@ -466,6 +469,15 @@ get_defaults(const struct option_flags *flags)
 			def_create_mail_spool = xstrdup(ccp);
 		}
 +		/*
 +		 * Create home directories as Btrfs subvolumes by default?
 +		 */
 +		else if (streq(buf, DBTRFS_SUBVOLUME_HOME)) {
 +			if (streq(ccp, ""))
 +				ccp = "no";
 +			def_btrfs_subvolume_home = xstrdup(ccp);
 +		}
 +
 		/*
 		 * By default do we add the user to the lastlog and faillog databases ?
 		 */
@@ -500,6 +512,7 @@ static void show_defaults (void)
 	printf ("SKEL=%s\n", def_template);
 	printf ("USRSKEL=%s\n", def_usrtemplate);
 	printf ("CREATE_MAIL_SPOOL=%s\n", def_create_mail_spool);
 +	printf ("BTRFS_SUBVOLUME_HOME=%s\n", def_btrfs_subvolume_home);
 	printf ("LOG_INIT=%s\n", def_log_init);
 }
@@ -523,6 +536,7 @@ set_defaults(void)
 	bool  out_skel = false;
 	bool  out_usrskel = false;
 	bool  out_create_mail_spool = false;
 +	bool  out_btrfs_subvolume_home = false;
 	bool  out_log_init = false;
 	char  buf[1024];
 	char  *new_file = NULL;
@@ -639,6 +653,11 @@ set_defaults(void)
 			        DCREATE_MAIL_SPOOL "=%s\n",
 			        def_create_mail_spool);
 			out_create_mail_spool = true;
 +		} else if (!out_btrfs_subvolume_home && streq(buf, DBTRFS_SUBVOLUME_HOME)) {
 +			fprintf(ofp,
 +			        DBTRFS_SUBVOLUME_HOME "=%s\n",
 +			        def_btrfs_subvolume_home);
 +			out_btrfs_subvolume_home = true;
 		} else if (!out_log_init && streq(buf, DLOG_INIT)) {
 			fprintf(ofp, DLOG_INIT "=%s\n", def_log_init);
 			out_log_init = true;
@@ -673,6 +692,8 @@ set_defaults(void)
 	if (!out_create_mail_spool)
 		fprintf (ofp, DCREATE_MAIL_SPOOL "=%s\n", def_create_mail_spool);
 +	if (!out_btrfs_subvolume_home)
 +		fprintf (ofp, DBTRFS_SUBVOLUME_HOME "=%s\n", def_btrfs_subvolume_home);
 	if (!out_log_init)
 		fprintf (ofp, DLOG_INIT "=%s\n", def_log_init);
 	/*
@@ -1431,6 +1452,9 @@ static void process_flags (int argc, char **argv, struct option_flags *flags)
 		}
 	}
 +	if (!subvolflg && strcaseeq(def_btrfs_subvolume_home, "yes"))
 +		subvolflg = true;
 +
 	if (!gflg && !Nflg && !Uflg) {
 		/* Get the settings from login.defs */
 		Uflg = getdef_bool ("USERGROUPS_ENAB");
 -- 
 2.52.0
--- a/shadow-4.15.0-manfix.patch
+++ b/shadow-4.15.0-manfix.patch
@ -0,0 +1,162 @@
 diff -up shadow-4.15.0/man/groupmems.8.xml.manfix shadow-4.15.0/man/groupmems.8.xml
 --- shadow-4.15.0/man/groupmems.8.xml.manfix	2023-05-26 04:56:11.000000000 +0200
 +++ shadow-4.15.0/man/groupmems.8.xml	2024-02-09 10:42:20.337036378 +0100
@@ -156,20 +156,10 @@
   <refsect1 id='setup'>
     <title>SETUP</title>
     <para>
 -      The <command>groupmems</command> executable should be in mode
 -      <literal>2710</literal> as user <emphasis>root</emphasis> and in group
 -      <emphasis>groups</emphasis>. The system administrator can add users to
 -      group <emphasis>groups</emphasis> to allow or disallow them using the
 -      <command>groupmems</command> utility to manage their own group
 -      membership list.
 +      In this operating system the <command>groupmems</command> executable
 +      is not setuid and regular users cannot use it to manipulate
 +      the membership of their own group.
     </para>
 -
 -    <programlisting>
 -	$ groupadd -r groups
 -	$ chmod 2710 groupmems
 -	$ chown root:groups groupmems
 -	$ groupmems -g groups -a gk4
 -    </programlisting>
   </refsect1>
   <refsect1 id='configuration'>
 diff -up shadow-4.15.0/man/ja/man5/login.defs.5.manfix shadow-4.15.0/man/ja/man5/login.defs.5
 --- shadow-4.15.0/man/ja/man5/login.defs.5.manfix	2023-03-13 21:58:56.000000000 +0100
 +++ shadow-4.15.0/man/ja/man5/login.defs.5	2024-02-09 10:42:20.337036378 +0100
@@ -123,10 +123,6 @@ 以下の参照表は、
 shadow パスワード機能のどのプログラムが
 どのパラメータを使用するかを示したものである。
 .na
 -.IP chfn 12
 -CHFN_AUTH CHFN_RESTRICT
 -.IP chsh 12
 -CHFN_AUTH
 .IP groupadd 12
 GID_MAX GID_MIN
 .IP newusers 12
 diff -up shadow-4.15.0/man/login.defs.5.xml.manfix shadow-4.15.0/man/login.defs.5.xml
 --- shadow-4.15.0/man/login.defs.5.xml.manfix	2024-01-22 22:36:43.000000000 +0100
 +++ shadow-4.15.0/man/login.defs.5.xml	2024-02-09 10:45:49.014407259 +0100
@@ -144,6 +144,17 @@
       long numeric parameters is machine-dependent.
     </para>
 +    <para>
 +      Please note that the parameters in this configuration file control the
 +      behavior of the tools from the shadow-utils component. None of these
 +      tools uses the PAM mechanism, and the utilities that use PAM (such as the
 +      passwd command) should be configured elsewhere. The only values that
 +      affect PAM modules are <emphasis>ENCRYPT_METHOD</emphasis> and <emphasis>SHA_CRYPT_MAX_ROUNDS</emphasis>
 +      for pam_unix module, <emphasis>FAIL_DELAY</emphasis> for pam_faildelay module,
 +      and <emphasis>UMASK</emphasis> for pam_umask module. Refer to
 +      pam(8) for more information.
 +    </para>
 +
     <para>The following configuration items are provided:</para>
     <variablelist remap='IP'>
@@ -240,16 +251,6 @@
 	</listitem>
       </varlistentry>
       <varlistentry>
 -	<term>chfn</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CHFN_AUTH</phrase>
 -	    CHFN_RESTRICT
 -	    <phrase condition="no_pam">LOGIN_STRING</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
 -      <varlistentry>
 	<term>chgpasswd</term>
 	<listitem>
 	  <para>
@@ -276,14 +277,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
 -      <varlistentry condition="no_pam">
 -	<term>chsh</term>
 -	<listitem>
 -	  <para>
 -	    CHSH_AUTH LOGIN_STRING
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <!-- expiry: no variables (CONSOLE_GROUPS linked, but not used) -->
       <!-- faillog: no variables -->
       <varlistentry>
@@ -352,34 +345,6 @@
 	  <para>LASTLOG_UID_MAX</para>
 	</listitem>
       </varlistentry>
 -      <varlistentry>
 -	<term>login</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CONSOLE</phrase>
 -	    CONSOLE_GROUPS DEFAULT_HOME
 -	    <phrase condition="no_pam">ENV_HZ ENV_PATH ENV_SUPATH
 -	    ENV_TZ ENVIRON_FILE</phrase>
 -	    ERASECHAR FAIL_DELAY
 -	    <phrase condition="no_pam">FAILLOG_ENAB</phrase>
 -	    FAKE_SHELL
 -	    <phrase condition="no_pam">FTMP_FILE</phrase>
 -	    HUSHLOGIN_FILE
 -	    <phrase condition="no_pam">ISSUE_FILE</phrase>
 -	    KILLCHAR
 -	    <phrase condition="no_pam">LASTLOG_ENAB LASTLOG_UID_MAX</phrase>
 -	    LOGIN_RETRIES
 -	    <phrase condition="no_pam">LOGIN_STRING</phrase>
 -	    LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB
 -	    <phrase condition="no_pam">MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE
 -	    MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB
 -	    QUOTAS_ENAB</phrase>
 -	    TTYGROUP TTYPERM TTYTYPE_FILE
 -	    <phrase condition="no_pam">ULIMIT UMASK</phrase>
 -	    USERGROUPS_ENAB
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <!-- logoutd: no variables -->
       <varlistentry>
 	<term>newgrp / sg</term>
@@ -451,32 +416,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
 -      <varlistentry>
 -	<term>su</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CONSOLE</phrase>
 -	    CONSOLE_GROUPS DEFAULT_HOME
 -	    <phrase condition="no_pam">ENV_HZ ENVIRON_FILE</phrase>
 -	    ENV_PATH ENV_SUPATH
 -	    <phrase condition="no_pam">ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB
 -	    MAIL_DIR MAIL_FILE QUOTAS_ENAB</phrase>
 -	    SULOG_FILE SU_NAME
 -	    <phrase condition="no_pam">SU_WHEEL_ONLY</phrase>
 -	    SYSLOG_SU_ENAB
 -	    <phrase condition="no_pam">USERGROUPS_ENAB</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
 -      <varlistentry condition="no_pam">
 -	<term>sulogin</term>
 -	<listitem>
 -	  <para>
 -	    ENV_HZ
 -	    ENV_TZ
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <varlistentry>
 	<term>useradd</term>
 	<listitem>
--- a/shadow-4.19.0-account-tools-setuid.patch
+++ b/shadow-4.19.0-account-tools-setuid.patch
@ -0,0 +1,377 @@
 diff -up shadow-4.19.0-rc1/src/chpasswd.c.account-tools-setuid shadow-4.19.0-rc1/src/chpasswd.c
 --- shadow-4.19.0-rc1/src/chpasswd.c.account-tools-setuid	2025-12-07 16:56:38.563285789 +0100
 +++ shadow-4.19.0-rc1/src/chpasswd.c	2025-12-09 14:54:29.232282499 +0100
@@ -466,9 +466,11 @@ int main (int argc, char **argv)
 	char *newpwd;
 	const char *salt;
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 	bool use_pam = true;
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 	bool errors = false;
 	intmax_t line = 0;
@@ -495,19 +497,23 @@ int main (int argc, char **argv)
 	process_root_flag ("-R", argc, argv);
 	prefix = process_prefix_flag ("-P", argc, argv);
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 	if (md5flg || eflg || cflg || prefix[0]) {
 		use_pam = false;
 	}
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 	OPENLOG (Prog);
 	check_perms ();
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 	if (!use_pam)
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 	{
 		is_shadow_pwd = spw_file_present ();
@@ -562,6 +568,7 @@ int main (int argc, char **argv)
 		}
 		newpwd = cp;
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 		if (use_pam) {
 			if (do_pam_passwd_non_interactive (Prog, name, newpwd) != 0) {
@@ -572,6 +579,7 @@ int main (int argc, char **argv)
 			}
 		} else
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 		{
 		/*
@@ -706,9 +714,11 @@ int main (int argc, char **argv)
 	 * password database.
 	 */
 	if (errors) {
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 		if (!use_pam)
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 		{
 			fprintf (stderr,
 			         _("%s: error detected, changes ignored\n"),
@@ -717,9 +727,11 @@ int main (int argc, char **argv)
 		fail_exit (1, process_selinux);
 	}
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 	if (!use_pam)
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 	{
 	/* Save the changes */
 		close_files (&flags);
 diff -up shadow-4.19.0-rc1/src/groupmems.c.account-tools-setuid shadow-4.19.0-rc1/src/groupmems.c
 --- shadow-4.19.0-rc1/src/groupmems.c.account-tools-setuid	2025-12-07 16:56:38.564285805 +0100
 +++ shadow-4.19.0-rc1/src/groupmems.c	2025-12-09 14:57:23.767054141 +0100
@@ -14,9 +14,11 @@
 #include <grp.h>
 #include <stdio.h>
 #include <sys/types.h>
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 #include "pam_defs.h"
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 #include <pwd.h>
 #include "alloc/malloc.h"
@@ -432,6 +434,7 @@ static void
 check_perms(MAYBE_UNUSED bool process_selinux)
 {
 	if (!list) {
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 		pam_handle_t *pamh = NULL;
 		int retval;
@@ -465,7 +468,8 @@ check_perms(MAYBE_UNUSED bool process_se
 			fail_exit (1, process_selinux);
 		}
 		(void) pam_end (pamh, retval);
 -#endif
 +#endif /* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 	}
 }
 diff -up shadow-4.19.0-rc1/src/newusers.c.account-tools-setuid shadow-4.19.0-rc1/src/newusers.c
 --- shadow-4.19.0-rc1/src/newusers.c.account-tools-setuid	2025-12-07 16:56:38.565285821 +0100
 +++ shadow-4.19.0-rc1/src/newusers.c	2025-12-09 15:07:40.115500988 +0100
@@ -74,6 +74,7 @@ struct option_flags {
 static const char Prog[] = "newusers";
 static bool rflg = false;	/* create a system account */
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 static /*@null@*//*@observer@*/char *crypt_method = NULL;
 #define cflg (NULL != crypt_method)
@@ -90,6 +91,7 @@ static long bcrypt_rounds = 13;
 static long yescrypt_cost = 5;
 #endif				/* USE_YESCRYPT */
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 static bool is_shadow;
 #ifdef SHADOWGRP
@@ -112,9 +114,11 @@ NORETURN static void fail_exit (int, boo
 static int add_group (const char *, const char *, gid_t *, gid_t);
 static int get_user_id (const char *, uid_t *);
 static int add_user (const char *, uid_t, gid_t);
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 static int update_passwd (struct passwd *, const char *);
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 static int add_passwd (struct passwd *, const char *);
 static void process_flags (int argc, char **argv, struct option_flags *flags);
 static void check_flags (void);
@@ -136,6 +140,7 @@ static void usage (int status)
 	                  "Options:\n"),
 	                Prog);
 	(void) fputs (_("  -b, --badname                 allow bad names\n"), usageout);
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 	(void) fprintf (usageout,
 	                _("  -c, --crypt-method METHOD     the crypt method (one of %s)\n"),
@@ -151,9 +156,11 @@ static void usage (int status)
 #endif
 	               );
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 	(void) fputs (_("  -h, --help                    display this help message and exit\n"), usageout);
 	(void) fputs (_("  -r, --system                  create system accounts\n"), usageout);
 	(void) fputs (_("  -R, --root CHROOT_DIR         directory to chroot into\n"), usageout);
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 #if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT)
 	(void) fputs (_("  -s, --sha-rounds              number of rounds for the SHA, BCRYPT\n"
@@ -161,6 +168,7 @@ static void usage (int status)
 	              usageout);
 #endif				/* USE_SHA_CRYPT || USE_BCRYPT || USE_YESCRYPT */
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 	(void) fputs ("\n", usageout);
 	exit (status);
@@ -426,6 +434,7 @@ static int add_user (const char *name, u
 	return (pw_update (&pwent) == 0) ? -1 : 0;
 }
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 /*
  * update_passwd - update the password in the passwd entry
@@ -478,6 +487,7 @@ static int update_passwd (struct passwd
 	return 0;
 }
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 /*
  * add_passwd - add or update the encrypted password
@@ -487,10 +497,13 @@ add_passwd(struct passwd *pwd, MAYBE_UNU
 {
 	const struct spwd *sp;
 	struct spwd spent;
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 	char *cp;
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 	void *crypt_arg = NULL;
 	if (NULL != crypt_method) {
@@ -528,13 +541,14 @@ add_passwd(struct passwd *pwd, MAYBE_UNU
 		return update_passwd (pwd, password);
 	}
 #endif				/* USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 	/*
 	 * Do the first and easiest shadow file case. The user already
 	 * exists in the shadow password file.
 	 */
 	sp = spw_locate (pwd->pw_name);
 -#ifndef USE_PAM
 +#if !defined(ACCT_TOOLS_SETUID) && !defined(USE_PAM)
 	if (NULL != sp) {
 		spent = *sp;
 		if (   (NULL != crypt_method)
@@ -571,7 +585,7 @@ add_passwd(struct passwd *pwd, MAYBE_UNU
 	if (!streq(pwd->pw_passwd, "x")) {
 		return update_passwd (pwd, password);
 	}
 -#else				/* USE_PAM */
 +#else				/* !ACCT_TOOLS_SETUID && !USE_PAM */
 	/*
 	 * If there is already a shadow entry, do not touch it.
 	 * If there is already a passwd entry with a password, do not
@@ -582,14 +596,14 @@ add_passwd(struct passwd *pwd, MAYBE_UNU
 	    || !streq(pwd->pw_passwd, "x")) {
 		return 0;
 	}
 -#endif				/* USE_PAM */
 +#endif				/* !ACCT_TOOLS_SETUID && !USE_PAM */
 	/*
 	 * Now the really hard case - I need to create an entirely new
 	 * shadow password file entry.
 	 */
 	spent.sp_namp = pwd->pw_name;
 -#ifndef USE_PAM
 +#if !defined(ACCT_TOOLS_SETUID) && !defined(USE_PAM)
 	if ((crypt_method != NULL) && streq(crypt_method, "NONE")) {
 		spent.sp_pwdp = (char *)password;
 	} else {
@@ -647,32 +647,38 @@ add_passwd(struct passwd *pwd, MAYBE_UNU
 static void process_flags (int argc, char **argv, struct option_flags *flags)
 {
 	int c;
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 #if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT)
 	int bad_s;
 #endif				/* USE_SHA_CRYPT || USE_BCRYPT || USE_YESCRYPT */
 #endif 				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 	static struct option long_options[] = {
 		{"badname",      no_argument,       NULL, 'b'},
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 		{"crypt-method", required_argument, NULL, 'c'},
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 		{"help",         no_argument,       NULL, 'h'},
 		{"system",       no_argument,       NULL, 'r'},
 		{"root",         required_argument, NULL, 'R'},
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 #if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT)
 		{"sha-rounds",   required_argument, NULL, 's'},
 #endif				/* USE_SHA_CRYPT || USE_BCRYPT || USE_YESCRYPT */
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 		{NULL, 0, NULL, '\0'}
 	};
 	while ((c = getopt_long (argc, argv,
 -#ifndef USE_PAM
 +#if !defined(ACCT_TOOLS_SETUID) && !defined(USE_PAM)
 #if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT)
 	                         "c:bhrs:",
 -#else				/* !USE_SHA_CRYPT && !USE_BCRYPT && !USE_YESCRYPT */
 +#else				/* !ACCT_TOOLS_SETUID && !USE_PAM */
 	                         "c:bhr",
 #endif				/* USE_SHA_CRYPT || USE_BCRYPT || USE_YESCRYPT */
 #else				/* USE_PAM */
@@ -670,11 +690,13 @@ static void process_flags (int argc, cha
 		case 'b':
 			allow_bad_names = true;
 			break;
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 		case 'c':
 			crypt_method = optarg;
 			break;
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 		case 'h':
 			usage (EXIT_SUCCESS);
 			break;
@@ -684,6 +706,7 @@ static void process_flags (int argc, cha
 		case 'R': /* no-op, handled in process_root_flag () */
 			flags->chroot = true;
 			break;
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 #if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT)
 		case 's':
@@ -723,6 +746,7 @@ static void process_flags (int argc, cha
 			break;
 #endif				/* USE_SHA_CRYPT || USE_BCRYPT || USE_YESCRYPT */
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 		default:
 			usage (EXIT_FAILURE);
 			break;
@@ -755,6 +779,7 @@ static void process_flags (int argc, cha
  */
 static void check_flags (void)
 {
 +#ifndef ACCT_TOOLS_SETUID
 #ifndef USE_PAM
 #if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT)
 	if (sflg && !cflg) {
@@ -787,6 +812,7 @@ static void check_flags (void)
 		}
 	}
 #endif				/* !USE_PAM */
 +#endif /* !ACCT_TOOLS_SETUID */
 }
 /*
@@ -1065,12 +1091,14 @@ int main (int argc, char **argv)
 	intmax_t line = 0;
 	uid_t uid;
 	gid_t gid;
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 	intmax_t *lines = NULL;
 	char **usernames = NULL;
 	char **passwords = NULL;
 	size_t nusers = 0;
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 	struct option_flags  flags = {.chroot = false};
 	bool process_selinux;
@@ -1193,6 +1221,7 @@ int main (int argc, char **argv)
 		}
 		newpw = *pw;
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 		/* keep the list of user/password for later update by PAM */
 		nusers++;
@@ -1207,6 +1236,7 @@ int main (int argc, char **argv)
 		usernames[nusers-1] = xstrdup(fields[0]);
 		passwords[nusers-1] = xstrdup(fields[1]);
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 		if (!streq(fields[1], "") && add_passwd(&newpw, fields[1]) != 0) {
 			fprintf (stderr,
 			         _("%s: line %jd: can't update password\n"),
@@ -1321,6 +1351,7 @@ int main (int argc, char **argv)
 	nscd_flush_cache ("group");
 	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
 +#ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 	/* Now update the passwords using PAM */
 	for (size_t i = 0; i < nusers; i++) {
@@ -1334,6 +1365,7 @@ int main (int argc, char **argv)
 		}
 	}
 #endif				/* USE_PAM */
 +#endif /* ACCT_TOOLS_SETUID */
 	exit (EXIT_SUCCESS);
 }
--- a/shadow-4.19.0-chkhash1.patch
+++ b/shadow-4.19.0-chkhash1.patch
@ -0,0 +1,88 @@
 From 87ec7a52ab25dd6e91253c274fd651f16844cf2a Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Wed, 7 Jan 2026 23:39:53 +0100
 Subject: [PATCH 1/2] lib/chkhash.c: is_valid_hash(): Accept a leading '!'
 A leading '!' means that the account is locked.
 Fixes: c44f1e096a19 (2025-07-20; "chpasswd: Check hash before write when using -e")
 Link: <https://github.com/shadow-maint/shadow/issues/1483>
 Link: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1124835>
 Reported-by: Chris Hofstaedtler <zeha@debian.org>
 Reviewed-by: Chris Hofstaedtler <zeha@debian.org>
 Cc: vinz <mmpx09@protonmail.com>
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 lib/chkhash.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/lib/chkhash.c b/lib/chkhash.c
 index 66870500..cb45f3aa 100644
 --- a/lib/chkhash.c
 +++ b/lib/chkhash.c
@@ -7,6 +7,8 @@
 #include <stddef.h>
 #include <string.h>
 +#include "string/strcmp/strprefix.h"
 +
 /*
  * match_regex - return true if match, false if not
@@ -37,6 +39,8 @@ match_regex(const char *pattern, const char *string)
 bool 
 is_valid_hash(const char *hash) 
 {
 +	hash = strprefix(hash, "!") ?: hash;
 +
 	// Minimum hash length
 	if (strlen(hash) < 13)
 		return false;
 -- 
 2.52.0
 From ddc2549f87e3001f663d5179e9b6d7fe2e1f3b3f Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Wed, 7 Jan 2026 23:44:26 +0100
 Subject: [PATCH 2/2] lib/chkhash.c: is_valid_hash(): Accept '*' as the hash
 This is widely accepted as an invalid hash, to remove password access
 for an account (that is, no passwords will match the "hash").
 Fixes: c44f1e096a19 (2025-07-20; "chpasswd: Check hash before write when using -e")
 Closes: <https://github.com/shadow-maint/shadow/issues/1483>
 Closes: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1124835>
 Reported-by: Chris Hofstaedtler <zeha@debian.org>
 Reviewed-by: Chris Hofstaedtler <zeha@debian.org>
 Cc: vinz <mmpx09@protonmail.com>
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 lib/chkhash.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/lib/chkhash.c b/lib/chkhash.c
 index cb45f3aa..71e0fb4e 100644
 --- a/lib/chkhash.c
 +++ b/lib/chkhash.c
@@ -7,6 +7,7 @@
 #include <stddef.h>
 #include <string.h>
 +#include "string/strcmp/streq.h"
 #include "string/strcmp/strprefix.h"
@@ -41,6 +42,9 @@ is_valid_hash(const char *hash)
 {
 	hash = strprefix(hash, "!") ?: hash;
 +	if (streq(hash, "*"))
 +		return true;
 +
 	// Minimum hash length
 	if (strlen(hash) < 13)
 		return false;
 -- 
 2.52.0
--- a/shadow-4.19.0-chkhash2.patch
+++ b/shadow-4.19.0-chkhash2.patch
@ -0,0 +1,137 @@
 From 9b67543987e3d140c86f1b8e2b5db5c10d8bc3c5 Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Thu, 15 Jan 2026 01:11:52 +0100
 Subject: [PATCH 1/4] lib/chkhash.c: is_valid_hash(): Accept an empty hash
 It represents a passwordless account.
 That is discouraged, but accepted.
 Fixes: c44f1e096a19 (2025-07-20; "chpasswd: Check hash before write when using -e")
 Link: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1124835>
 Reported-by: Marc 'Zugschlus' Haber <mh+githubvisible@zugschlus.de>
 Reported-by: "Serge E. Hallyn" <serge@hallyn.com>
 Reported-by: Adam Williamson <awilliam@redhat.com>
 Co-authored-by: "Serge E. Hallyn" <serge@hallyn.com>
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 lib/chkhash.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/lib/chkhash.c b/lib/chkhash.c
 index 71e0fb4e..d0a8dc01 100644
 --- a/lib/chkhash.c
 +++ b/lib/chkhash.c
@@ -42,6 +42,10 @@ is_valid_hash(const char *hash)
 {
 	hash = strprefix(hash, "!") ?: hash;
 +	// Passwordless account; discouraged
 +	if (streq(hash, ""))
 +		return true;
 +
 	if (streq(hash, "*"))
 		return true;
 -- 
 2.52.0
 From bce404a7a831de911cf20fc8d4c548957f70bc72 Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Thu, 15 Jan 2026 01:14:46 +0100
 Subject: [PATCH 2/4] lib/chkhash.c: is_valid_hash(): Update comment
 This checks the entire shadow(5) 2nd field, which is more than just
 a hash.
 Reported-by: Tobias Stoeckmann <tobias@stoeckmann.org>
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 lib/chkhash.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)
 diff --git a/lib/chkhash.c b/lib/chkhash.c
 index d0a8dc01..1723f862 100644
 --- a/lib/chkhash.c
 +++ b/lib/chkhash.c
@@ -31,9 +31,7 @@ match_regex(const char *pattern, const char *string)
 /*
 - * is_valid_hash - check if the given string is a valid password hash
 - *
 - * Returns true if the string appears to be a valid hash, false otherwise.
 + * is_valid_hash - check if the string is a valid shadow(5) 2nd field.
  *
  * regex from: https://man.archlinux.org/man/crypt.5.en
  */
 -- 
 2.52.0
 From 9a86c515a1e7caeeb9e60fa63871170a2dfd98f0 Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Thu, 15 Jan 2026 01:24:10 +0100
 Subject: [PATCH 3/4] lib/chkhash.c: is_valid_hash(): Comment meaning of !hash
 and *
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 lib/chkhash.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/lib/chkhash.c b/lib/chkhash.c
 index 1723f862..101f2004 100644
 --- a/lib/chkhash.c
 +++ b/lib/chkhash.c
@@ -38,12 +38,14 @@ match_regex(const char *pattern, const char *string)
 bool 
 is_valid_hash(const char *hash) 
 {
 +	// Password temporarily locked
 	hash = strprefix(hash, "!") ?: hash;
 	// Passwordless account; discouraged
 	if (streq(hash, ""))
 		return true;
 +	// Password permanently locked (and forgotten)
 	if (streq(hash, "*"))
 		return true;
 -- 
 2.52.0
 From 6be13b2f84a2c1a0d0f4129b5258b4b443e7f86c Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Fri, 16 Jan 2026 01:52:32 +0100
 Subject: [PATCH 4/4] man/shadow.5.xml: Document "*"
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 man/shadow.5.xml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/man/shadow.5.xml b/man/shadow.5.xml
 index dc7fdfde..d3cc0398 100644
 --- a/man/shadow.5.xml
 +++ b/man/shadow.5.xml
@@ -82,8 +82,12 @@
 	    If the password field begins with an exclamation mark <emphasis>!</emphasis>,
 	    the password is locked.
 	    The remaining characters on the
 -	    line represent the password field before the password was
 -	    locked.
 +	    line represent the password hash.
 +	  </para>
 +	  <para>
 +	    If the password hash consists of a star <emphasis>*</emphasis>,
 +	    password access is effectively disallowed;
 +	    this is because no password can produce a hash like this.
 	  </para>
 	  <para>
 	    Refer to <citerefentry><refentrytitle>crypt</refentrytitle>
 -- 
 2.52.0
--- a/shadow-4.19.0-useradd-fix-btrfs.patch
+++ b/shadow-4.19.0-useradd-fix-btrfs.patch
@ -0,0 +1,492 @@
 From 4079070c4b8ced8df9d86366ad113fc3c2e4e49c Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Wed, 22 Apr 2026 11:02:36 +0200
 Subject: [PATCH 1/5] lib/btrfs.c: btrfs_is_subvolume(): Simplify error check
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 lib/btrfs.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/lib/btrfs.c b/lib/btrfs.c
 index 85ec7dbc..fe20cf30 100644
 --- a/lib/btrfs.c
 +++ b/lib/btrfs.c
@@ -67,8 +67,7 @@ int btrfs_is_subvolume(const char *path)
 	if (ret <= 0)
 		return ret;
 -	ret = stat(path, &st);
 -	if (ret == -1)
 +	if (stat(path, &st) == -1)
 		return -1;
 	if (st.st_ino != BTRFS_FIRST_FREE_OBJECTID || !S_ISDIR(st.st_mode)) {
 -- 
 2.53.0
 From 7a4faaaf46314547cc5e6c8264c3a11753ef9352 Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Wed, 22 Apr 2026 11:14:20 +0200
 Subject: [PATCH 2/5] lib/, src/: Move statfs(2) call out of is_btrfs()
 This simplifies the return value of is_btrfs() into a boolean.
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 lib/btrfs.c      | 25 +++++++++----------------
 lib/prototypes.h |  3 ++-
 src/useradd.c    | 11 +++++++++--
 3 files changed, 20 insertions(+), 19 deletions(-)
 diff --git a/lib/btrfs.c b/lib/btrfs.c
 index fe20cf30..065c7938 100644
 --- a/lib/btrfs.c
 +++ b/lib/btrfs.c
@@ -60,12 +60,13 @@ int btrfs_remove_subvolume(const char *path)
  */
 int btrfs_is_subvolume(const char *path)
 {
 -	struct stat st;
 -	int ret;
 +	struct stat    st;
 +	struct statfs  sfs;
 -	ret = is_btrfs(path);
 -	if (ret <= 0)
 -		return ret;
 +	if (statfs(path, &sfs) == -1)
 +		return -1;
 +	if (!is_btrfs(&sfs))
 +		return 0;
 	if (stat(path, &st) == -1)
 		return -1;
@@ -78,16 +79,8 @@ int btrfs_is_subvolume(const char *path)
 }
 -/* Adapted from btrfsprogs */
 -int is_btrfs(const char *path)
 +bool
 +is_btrfs(const struct statfs *sfs)
 {
 -	struct statfs sfs;
 -	int ret;
 -
 -	ret = statfs(path, &sfs);
 -	if (ret == -1)
 -		return -1;
 -
 -	return sfs.f_type == BTRFS_SUPER_MAGIC;
 +	return sfs->f_type == BTRFS_SUPER_MAGIC;
 }
 -
 diff --git a/lib/prototypes.h b/lib/prototypes.h
 index 9a03e312..42aa2923 100644
 --- a/lib/prototypes.h
 +++ b/lib/prototypes.h
@@ -23,6 +23,7 @@
 #include <sys/socket.h>
 #include <sys/stat.h>
 +#include <sys/statfs.h>
 #include <sys/types.h>
 #include <pwd.h>
 #include <grp.h>
@@ -54,7 +55,7 @@ extern int isexpired (const struct passwd *, /*@null@*/const struct spwd *);
 extern int btrfs_create_subvolume(const char *path);
 extern int btrfs_remove_subvolume(const char *path);
 extern int btrfs_is_subvolume(const char *path);
 -extern int is_btrfs(const char *path);
 +extern bool is_btrfs(const struct statfs *sfs);
 #endif
 /* basename() renamed to Basename() to avoid libc name space confusion */
 diff --git a/src/useradd.c b/src/useradd.c
 index df679d28..5ce6cd6a 100644
 --- a/src/useradd.c
 +++ b/src/useradd.c
@@ -25,6 +25,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <sys/stat.h>
 +#include <sys/statfs.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <time.h>
@@ -2265,6 +2266,7 @@ static void create_home(const struct option_flags *flags)
 #if WITH_BTRFS
 		if (subvolflg && (strlen(prefix_user_home) - (int)strlen(path)) <= 1) {
 			char *btrfs_check = strdup(path);
 +			struct statfs  sfs;
 			if (!btrfs_check) {
 				fprintf(stderr,
@@ -2273,13 +2275,18 @@ static void create_home(const struct option_flags *flags)
 				fail_exit(E_HOMEDIR, process_selinux);
 			}
 			stpcpy(&btrfs_check[strlen(path) - strlen(cp) - 1], "");
 -			if (is_btrfs(btrfs_check) <= 0) {
 +			if (statfs(btrfs_check, &sfs) == -1) {
 +				fprintf(stderr, "%s: statfs(\"%s\"): %s\n",
 +					Prog, btrfs_check, strerrno());
 +				fail_exit(E_HOMEDIR, process_selinux);
 +			}
 +			free(btrfs_check);
 +			if (!is_btrfs(&sfs)) {
 				fprintf(stderr,
 					_("%s: home directory \"%s\" must be mounted on BTRFS\n"),
 					Prog, path);
 				fail_exit(E_HOMEDIR, process_selinux);
 			}
 -			free(btrfs_check);
 			// make subvolume to mount for user instead of directory
 			if (btrfs_create_subvolume(path)) {
 				fprintf(stderr,
 -- 
 2.53.0
 From 96460c7240264c0022cebc9ba1774993ee2594cf Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Wed, 22 Apr 2026 11:21:14 +0200
 Subject: [PATCH 3/5] lib/, src/: Move btrfs.c prototypes to lib/btrfs.h
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 lib/Makefile.am  |  2 +-
 lib/btrfs.c      |  4 ++++
 lib/btrfs.h      | 23 +++++++++++++++++++++++
 lib/prototypes.h |  9 ---------
 src/useradd.c    |  1 +
 src/userdel.c    |  1 +
 src/usermod.c    |  1 +
 7 files changed, 31 insertions(+), 10 deletions(-)
 create mode 100644 lib/btrfs.h
 diff --git a/lib/Makefile.am b/lib/Makefile.am
 index 7c488f82..0664e610 100644
 --- a/lib/Makefile.am
 +++ b/lib/Makefile.am
@@ -290,7 +290,7 @@ libshadow_la_SOURCES += tcbfuncs.c tcbfuncs.h
 endif
 if WITH_BTRFS
 -libshadow_la_SOURCES += btrfs.c
 +libshadow_la_SOURCES += btrfs.c btrfs.h
 endif
 if ENABLE_LASTLOG
 diff --git a/lib/btrfs.c b/lib/btrfs.c
 index 065c7938..15b6b315 100644
 --- a/lib/btrfs.c
 +++ b/lib/btrfs.c
@@ -1,3 +1,7 @@
 +#include "config.h"
 +
 +#include "btrfs.h"
 +
 #include <linux/btrfs_tree.h>
 #include <linux/magic.h>
 #include <sys/statfs.h>
 diff --git a/lib/btrfs.h b/lib/btrfs.h
 new file mode 100644
 index 00000000..50b70488
 --- /dev/null
 +++ b/lib/btrfs.h
@@ -0,0 +1,23 @@
 +// SPDX-FileCopyrightText: 2026, Alejandro Colomar <alx@kernel.org>
 +// SPDX-License-Identifier: BSD-3-Clause
 +
 +
 +#ifndef SHADOW_INCLUDE_LIB_BTRFS_H_
 +#define SHADOW_INCLUDE_LIB_BTRFS_H_
 +
 +
 +#include "config.h"
 +
 +#include <stdbool.h>
 +#include <sys/statfs.h>
 +
 +
 +#ifdef WITH_BTRFS
 +int btrfs_create_subvolume(const char *path);
 +int btrfs_remove_subvolume(const char *path);
 +int btrfs_is_subvolume(const char *path);
 +bool is_btrfs(const struct statfs *sfs);
 +#endif
 +
 +
 +#endif  // include guard
 diff --git a/lib/prototypes.h b/lib/prototypes.h
 index 42aa2923..d22c477a 100644
 --- a/lib/prototypes.h
 +++ b/lib/prototypes.h
@@ -23,7 +23,6 @@
 #include <sys/socket.h>
 #include <sys/stat.h>
 -#include <sys/statfs.h>
 #include <sys/types.h>
 #include <pwd.h>
 #include <grp.h>
@@ -50,14 +49,6 @@ extern int expire (const struct passwd *, /*@null@*/const struct spwd *);
 /* isexpired.c */
 extern int isexpired (const struct passwd *, /*@null@*/const struct spwd *);
 -/* btrfs.c */
 -#ifdef WITH_BTRFS
 -extern int btrfs_create_subvolume(const char *path);
 -extern int btrfs_remove_subvolume(const char *path);
 -extern int btrfs_is_subvolume(const char *path);
 -extern bool is_btrfs(const struct statfs *sfs);
 -#endif
 -
 /* basename() renamed to Basename() to avoid libc name space confusion */
 /* basename.c */
 extern /*@observer@*/const char *Basename (const char *str);
 diff --git a/src/useradd.c b/src/useradd.c
 index 5ce6cd6a..9bd32b11 100644
 --- a/src/useradd.c
 +++ b/src/useradd.c
@@ -34,6 +34,7 @@
 #include "alloc/malloc.h"
 #include "atoi/a2i.h"
 #include "atoi/getnum.h"
 +#include "btrfs.h"
 #include "chkname.h"
 #include "defines.h"
 #include "faillog.h"
 diff --git a/src/userdel.c b/src/userdel.c
 index 9b7d81be..ebd064c0 100644
 --- a/src/userdel.c
 +++ b/src/userdel.c
@@ -20,6 +20,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 +#include "btrfs.h"
 #ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 #include "pam_defs.h"
 diff --git a/src/usermod.c b/src/usermod.c
 index 7c0321a6..3afe19ea 100644
 --- a/src/usermod.c
 +++ b/src/usermod.c
@@ -32,6 +32,7 @@
 #include "alloc/malloc.h"
 #include "atoi/a2i.h"
 #include "atoi/getnum.h"
 +#include "btrfs.h"
 #include "chkname.h"
 #include "defines.h"
 #include "faillog.h"
 -- 
 2.53.0
 From 7be9a6540f1cad477fd4f4e83d25904a5095bb86 Mon Sep 17 00:00:00 2001
 From: Hadi Chokr <hadichokr@icloud.com>
 Date: Tue, 21 Apr 2026 09:18:19 +0200
 Subject: [PATCH 4/5] useradd(8): fallback to regular dir for BTRFS home on
 non-BTRFS parent
 When the --btrfs-subvolume-home option is used but the parent directory
 is not on a BTRFS filesystem, useradd previously failed with an error.
 This is too strict; instead, fall back to creating a regular directory
 and issue a warning.  The subvolume creation is attempted only when the
 parent is BTRFS.  Otherwise, a regular directory is created and a
 syslog(3) warning is logged.
 Fixes: 3e8c105 (2026-01-02; "src/useradd: Support config for creating home dirs as Btrfs subvolumes")
 Co-authored-by: Hadi Chokr <hadichokr@icloud.com>
 Co-authored-by: Alejandro Colomar <alx@kernel.org>
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 man/useradd.8.xml | 27 ++++++++++++++++++++++--
 src/useradd.c     | 52 +++++++++++++++++++++++------------------------
 2 files changed, 51 insertions(+), 28 deletions(-)
 diff --git a/man/useradd.8.xml b/man/useradd.8.xml
 index 8a087e13..0bde6683 100644
 --- a/man/useradd.8.xml
 +++ b/man/useradd.8.xml
@@ -2,6 +2,7 @@
 <!--
    SPDX-FileCopyrightText: 1991 - 1994, Julianne Frances Haugh
    SPDX-FileCopyrightText: 2007 - 2011, Nicolas François
 +   SPDX-FileCopyrightText: 2025 - 2026, Hadi Chokr
    SPDX-License-Identifier: BSD-3-Clause
 -->
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.5//EN"
@@ -156,8 +157,30 @@
 		regardless of any configuration file settings.
 	  </para>
 	  <para>
 -	    Note: this feature works only if the underlying filesystem supports
 -	    Btrfs subvolumes.
 +	    If the parent directory of the user's home directory is
 +	    <emphasis>not</emphasis> on a Btrfs filesystem,
 +	    <command>useradd</command> will <emphasis>not</emphasis> create a
 +	    subvolume.
 +	    Instead, it creates a regular directory,
 +	    prints a warning to standard error,
 +	    and logs the event via syslog at level
 +	    <constant>LOG_WARN</constant>.
 +	    The user account is still created successfully.
 +	  </para>
 +	  <para>
 +	    If the filesystem type cannot be determined (e.g., because of
 +	    insufficient permissions, an I/O error,
 +	    or a
 +	    <citerefentry>
 +	      <refentrytitle>statfs</refentrytitle>
 +	      <manvolnum>2</manvolnum>
 +	    </citerefentry>
 +	    failure),
 +	    <command>useradd</command> treats this as a fatal error:
 +	    the home directory is not created,
 +	    the command exits with a non‑zero status
 +	    (<literal>E_HOMEDIR</literal>, 12),
 +	    and an error message is printed.
 	  </para>
 	</listitem>
       </varlistentry>
 diff --git a/src/useradd.c b/src/useradd.c
 index 9bd32b11..9210379c 100644
 --- a/src/useradd.c
 +++ b/src/useradd.c
@@ -1,11 +1,11 @@
 -/*
 - * SPDX-FileCopyrightText: 1991 - 1994, Julianne Frances Haugh
 - * SPDX-FileCopyrightText: 1996 - 2000, Marek Michałkiewicz
 - * SPDX-FileCopyrightText: 2000 - 2006, Tomasz Kłoczko
 - * SPDX-FileCopyrightText: 2007 - 2012, Nicolas François
 - *
 - * SPDX-License-Identifier: BSD-3-Clause
 - */
 +// SPDX-FileCopyrightText: 1991-1994, Julianne Frances Haugh
 +// SPDX-FileCopyrightText: 1996-2000, Marek Michałkiewicz
 +// SPDX-FileCopyrightText: 2000-2006, Tomasz Kłoczko
 +// SPDX-FileCopyrightText: 2007-2012, Nicolas François
 +// SPDX-FileCopyrightText: 2025-2026, Hadi Chokr
 +// SPDX-FileCopyrightText: 2026, Alejandro Colomar <alx@kernel.org>
 +// SPDX-License-Identifier: BSD-3-Clause
 +
 #include "config.h"
@@ -2251,6 +2251,8 @@ static void create_home(const struct option_flags *flags)
 	   owner root:root.
 	 */
 	for (cp = strtok(bhome, "/"); cp != NULL; cp = strtok(NULL, "/")) {
 +		bool  dir_created;
 +
 		/* Avoid turning a relative path into an absolute path. */
 		if (strprefix(bhome, "/") || !streq(path, ""))
 			strcat(path, "/");
@@ -2260,10 +2262,7 @@ static void create_home(const struct option_flags *flags)
 			continue;
 		}
 -		/* Check if parent directory is BTRFS, fail if requesting
 -		   subvolume but no BTRFS. The paths could be different by the
 -		   trailing slash
 -		 */
 +		dir_created = false;
 #if WITH_BTRFS
 		if (subvolflg && (strlen(prefix_user_home) - (int)strlen(path)) <= 1) {
 			char *btrfs_check = strdup(path);
@@ -2284,25 +2283,26 @@ static void create_home(const struct option_flags *flags)
 			free(btrfs_check);
 			if (!is_btrfs(&sfs)) {
 				fprintf(stderr,
 -					_("%s: home directory \"%s\" must be mounted on BTRFS\n"),
 -					Prog, path);
 -				fail_exit(E_HOMEDIR, process_selinux);
 +				        _("%s: warning: \"%s\" is not on BTRFS; creating regular directory instead of subvolume\n"),
 +				        Prog, prefix_user_home);
 +			} else {
 +				if (btrfs_create_subvolume(path)) {
 +					fprintf(stderr,
 +					        _("%s: failed to create BTRFS subvolume: %s\n"),
 +						Prog, path);
 +					fail_exit(E_HOMEDIR, process_selinux);
 +				}
 +				dir_created = true;
 			}
 -			// make subvolume to mount for user instead of directory
 -			if (btrfs_create_subvolume(path)) {
 -				fprintf(stderr,
 -					_("%s: failed to create BTRFS subvolume: %s\n"),
 +		}
 +#endif
 +		if (!dir_created) {
 +			if (mkdir(path, 0) != 0) {
 +				fprintf(stderr, _("%s: cannot create directory %s\n"),
 					Prog, path);
 				fail_exit(E_HOMEDIR, process_selinux);
 			}
 		}
 -		else
 -#endif
 -		if (mkdir(path, 0) != 0) {
 -			fprintf(stderr, _("%s: cannot create directory %s\n"),
 -				Prog, path);
 -			fail_exit(E_HOMEDIR, process_selinux);
 -		}
 		if (chown(path, 0, 0) < 0) {
 			fprintf(stderr,
 				_("%s: warning: chown on `%s' failed: %m\n"),
 -- 
 2.53.0
 From 827f69b864461ab6d7549762bef06ab4495d2587 Mon Sep 17 00:00:00 2001
 From: Hadi Chokr <hadichokr@icloud.com>
 Date: Mon, 20 Apr 2026 12:27:31 +0200
 Subject: [PATCH 5/5] man/useradd.8.xml: Remove trailing spaces from
 useradd.8.xml
 Signed-off-by: Hadi Chokr <hadichokr@icloud.com>
 Reviewed-by: Alejandro Colomar <alx@kernel.org>
 ---
 man/useradd.8.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/man/useradd.8.xml b/man/useradd.8.xml
 index 0bde6683..f85780e2 100644
 --- a/man/useradd.8.xml
 +++ b/man/useradd.8.xml
@@ -207,7 +207,7 @@
 	    user's login directory. The default is to append the
 	    <replaceable>LOGIN</replaceable> name to
 	    <replaceable>BASE_DIR</replaceable> and use that as the
 -	    login directory name.  
 +	    login directory name.
 	    The directory <replaceable>HOME_DIR</replaceable> is not created by
 	    default.  However it will be created for non-system users if either the
 	    <option>-m</option> flag is specifed or
@@ -422,7 +422,7 @@
 	</term>
 	<listitem>
 	  <para>
 -	    Create the user's home directory if it does not exist. 
 +	    Create the user's home directory if it does not exist.
 	    The files and directories contained in the skeleton directory
 	    (which can be defined with the <option>-k</option> option)
 	    will be copied to the home directory.
@@ -512,7 +512,7 @@
             password himself.
 	  </para>
 	  <para>
 -	    <emphasis role="bold">Note:</emphasis>Avoid this option on the command  
 +	    <emphasis role="bold">Note:</emphasis>Avoid this option on the command
 	     line because the password (or encrypted password) will
 	    be visible by users listing the processes.
 	  </para>
 -- 
 2.53.0
--- a/shadow-4.19.0-usermod-add-optimizations.patch
+++ b/shadow-4.19.0-usermod-add-optimizations.patch
@ -0,0 +1,75 @@
 From 958b4859991e700b61af2f9e07e3aa87ad1d9218 Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Sat, 17 Jan 2026 00:56:21 +0100
 Subject: [PATCH] Revert "src/usermod.c: Remove optimizations"
 This wasn't only an optimization; it also skipped some checks that were
 now spuriously triggering errors.  We may be able to get rid of the
 optimizations, but that will need more analysis.  For now, let's revert
 to a known-good state.
 Fixes: 6a8a25dc7de6 (2025-10-15; "src/usermod.c: Remove optimizations")
 Reverts: 6a8a25dc7de6 (2025-10-15; "src/usermod.c: Remove optimizations")
 Closes: <https://github.com/shadow-maint/shadow/issues/1509>
 Reported-by: Adam Williamson <awilliam@redhat.com>
 Signed-off-by: Alejandro Colomar <alx@kernel.org>
 ---
 src/usermod.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 diff --git a/src/usermod.c b/src/usermod.c
 index 7400bf84..7cd7a859 100644
 --- a/src/usermod.c
 +++ b/src/usermod.c
@@ -1391,6 +1391,48 @@ process_flags(int argc, char **argv, struct option_flags *flags)
 	}
 #endif				/* WITH_SELINUX */
 +	if (user_newid == user_id) {
 +		uflg = false;
 +		oflg = false;
 +	}
 +	if (user_newgid == user_gid) {
 +		gflg = false;
 +	}
 +	if (   (NULL != user_newshell)
 +	    && streq(user_newshell, user_shell)) {
 +		sflg = false;
 +	}
 +	if (streq(user_newname, user_name)) {
 +		lflg = false;
 +	}
 +	if (user_newinactive == user_inactive) {
 +		fflg = false;
 +	}
 +	if (user_newexpire == user_expire) {
 +		eflg = false;
 +	}
 +	if (   (NULL != user_newhome)
 +	    && streq(user_newhome, user_home)) {
 +		dflg = false;
 +		mflg = false;
 +	}
 +	if (   (NULL != user_newcomment)
 +	    && streq(user_newcomment, user_comment)) {
 +		cflg = false;
 +	}
 +
 +	if (!(Uflg || uflg || sflg || pflg || mflg || Lflg ||
 +	      lflg || Gflg || gflg || fflg || eflg || dflg || cflg
 +#ifdef ENABLE_SUBIDS
 +	      || vflg || Vflg || wflg || Wflg
 +#endif				/* ENABLE_SUBIDS */
 +#ifdef WITH_SELINUX
 +	      || Zflg
 +#endif				/* WITH_SELINUX */
 +	)) {
 +		exit (E_SUCCESS);
 +	}
 +
 	if (!is_shadow_pwd && (eflg || fflg)) {
 		fprintf (stderr,
 		         _("%s: shadow passwords required for -e and -f\n"),
 -- 
 2.52.0
--- a/shadow-utils.spec
+++ b/shadow-utils.spec
@ -1,12 +1,12 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
-Version: 4.20.0
+Version: 4.19.0
-Release: 1%{?dist}
+Release: 7%{?dist}
 Epoch: 2
 License: BSD-3-Clause AND GPL-2.0-or-later
 URL: https://github.com/shadow-maint/shadow
-Source0: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz
+Source0: https://github.com/shadow-maint/shadow/releases/download/4.19.0/shadow-4.19.0.tar.xz
-Source1: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz.asc
+Source1: https://github.com/shadow-maint/shadow/releases/download/4.19.0/shadow-4.19.0.tar.xz.asc
 Source2: shadow-utils.useradd
 Source3: shadow-utils.login.defs
 Source4: shadow-bsd.txt
@ -20,6 +20,25 @@ Source7: passwd.pamd
 %global _ld_strict_symbol_defs 1
 ### Patches ###
 # Misc manual page changes - non-upstreamable
 Patch0: shadow-4.15.0-manfix.patch
 # Probably non-upstreamable
 Patch1: shadow-4.19.0-account-tools-setuid.patch
 # https://github.com/shadow-maint/shadow/commit/3e8c105f0703264e947d8c034b90419794955d49
 Patch2: shadow-4-19-useradd-support-btrfs.patch
 # https://github.com/shadow-maint/shadow/commit/3e8c105f0703264e947d8c034b90419794955d49
 Patch3: shadow-4.19.0-chkhash1.patch
 # https://github.com/shadow-maint/shadow/commit/9b67543987e3d140c86f1b8e2b5db5c10d8bc3c5
 Patch4: shadow-4.19.0-chkhash2.patch
 # https://github.com/shadow-maint/shadow/commit/958b4859991e700b61af2f9e07e3aa87ad1d9218
 Patch5: shadow-4.19.0-usermod-add-optimizations.patch
 # https://github.com/shadow-maint/shadow/pull/1520
 # Approved by upstream for 4.19.3 this weekend:
 # https://github.com/shadow-maint/shadow/issues/1521
 # Fixes the hash check to accept hashes with \ or n in the salt
 Patch6: 1520.patch
 # https://github.com/shadow-maint/shadow/commit/827f69b864461ab6d7549762bef06ab4495d2587
 Patch7: shadow-4.19.0-useradd-fix-btrfs.patch
 ### Dependencies ###
 Requires: audit-libs >= 1.6.5
@ -98,7 +117,7 @@ Requires: shadow-utils-subid = %{epoch}:%{version}-%{release}
 Development files for shadow-utils-subid.
 %prep
-%autosetup -p 1 -S git -n shadow-4.20.0
+%autosetup -p 1 -S git -n shadow-4.19.0
 iconv -f ISO88591 -t utf-8  doc/HOWTO > doc/HOWTO.utf8
 cp -f doc/HOWTO.utf8 doc/HOWTO
@ -136,8 +155,6 @@ install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/default
 install -p -c -m 0644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/login.defs
 install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/default/useradd
 install -d -m 755 $RPM_BUILD_ROOT%{_pam_confdir}
 install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/chpasswd
 install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/newusers
 install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/passwd
@ -155,20 +172,26 @@ mv -v $RPM_BUILD_ROOT/usr/sbin/* $RPM_BUILD_ROOT%{_bindir}/
 # Remove binaries we don't use.
 rm $RPM_BUILD_ROOT%{_bindir}/chfn
 rm $RPM_BUILD_ROOT%{_bindir}/chsh
 rm $RPM_BUILD_ROOT%{_bindir}/expiry
 rm $RPM_BUILD_ROOT%{_bindir}/login
 rm $RPM_BUILD_ROOT%{_bindir}/su
 rm $RPM_BUILD_ROOT%{_bindir}/faillog
 rm $RPM_BUILD_ROOT%{_sbindir}/logoutd
 rm $RPM_BUILD_ROOT%{_sbindir}/nologin
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chfn.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/chsh.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chsh.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/expiry.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/expiry.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/login.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/login.*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/su.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man1/su.*
 rm $RPM_BUILD_ROOT%{_mandir}/man5/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man5/passwd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/logoutd.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/logoutd.*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/*/man8/nologin.*
 rm $RPM_BUILD_ROOT%{_mandir}/man3/getspnam.*
@ -180,8 +203,11 @@ rm $RPM_BUILD_ROOT%{_mandir}/*/man8/faillog.*
 # Remove PAM service files we don't use.
 rm $RPM_BUILD_ROOT%{_pam_confdir}/chfn
 rm $RPM_BUILD_ROOT%{_pam_confdir}/chpasswd
 rm $RPM_BUILD_ROOT%{_pam_confdir}/chsh
 rm $RPM_BUILD_ROOT%{_pam_confdir}/groupmems
 rm $RPM_BUILD_ROOT%{_pam_confdir}/login
 rm $RPM_BUILD_ROOT%{_pam_confdir}/newusers
 rm $RPM_BUILD_ROOT%{_pam_confdir}/su
 find $RPM_BUILD_ROOT%{_mandir} -depth -type d -empty -delete
@ -208,8 +234,6 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %license gpl-2.0.txt shadow-bsd.txt
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/login.defs
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/default/useradd
 %config(noreplace) %{_pam_confdir}/chpasswd
 %config(noreplace) %{_pam_confdir}/newusers
 %config(noreplace) %{_pam_confdir}/passwd
 %{_bindir}/sg
 %attr(4755,root,root) %{_bindir}/chage
@ -264,26 +288,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_libdir}/libsubid.so
 %changelog
-* Wed Jul 29 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-1
+* Wed Apr 29 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-7
 - Rebase to version 4.20.0
 * Wed Jul 22 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-rc3-1
 - Rebase to version 4.20.0-rc3
 * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.3-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 * Wed May 27 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-3
 - Enable use of PAM for chpasswd and newusers
  Resolves: #2461179 and #2283963
 * Thu Apr 23 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-2
 - btrfs: simplify checks improve useradd behavior for non-btrfs
 * Wed Feb 11 2026 Debarshi Ray <rishi@fedoraproject.org> - 2:4.19.3-1
 - Rebase to version 4.19.3
  Resolves: #2426288
 * Tue Jan 27 2026 Adam Williamson <awilliam@redhat.com> - 2:4.19.0-6
 - chkhash.c: fix escaping in SHA-256 / SHA-512 / MD5 regexes
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406
+SHA512 (shadow-4.19.0.tar.xz) = 0846c34f426101213ab6277bbcdc58c28b3a54df2f68d1c1addcc8c5aa79ce3e15d5d8dfcb9cc6dbd1b758e0cd8676c68ca65268f5a037d4c24aa7d358c9a390
-SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac
+SHA512 (shadow-4.19.0.tar.xz.asc) = 34c1a764d06a5d24533cbb57310de7462eb632c1de904901699d48f44401b1b1f4751db35f2b0e2b9a057cf1a777ccddbae4bc6b19a6db865ebc3e30fde0d060
--- a/tests/mhc-fedora-ci.yaml
+++ b/tests/mhc-fedora-ci.yaml
@ -1,13 +0,0 @@
 provisioned_topologies:
 - shadow
 domains:
 - id: shadow
  hosts:
  - hostname: localhost
    role: shadow
    conn:
      type: ssh
      host: localhost
      user: root
    artifacts:
    - /var/log/*
`@ -1,2 +1,2 @@`
	`SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406`	`SHA512 (shadow-4.19.0.tar.xz) = 0846c34f426101213ab6277bbcdc58c28b3a54df2f68d1c1addcc8c5aa79ce3e15d5d8dfcb9cc6dbd1b758e0cd8676c68ca65268f5a037d4c24aa7d358c9a390`
	`SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac`	`SHA512 (shadow-4.19.0.tar.xz.asc) = 34c1a764d06a5d24533cbb57310de7462eb632c1de904901699d48f44401b1b1f4751db35f2b0e2b9a057cf1a777ccddbae4bc6b19a6db865ebc3e30fde0d060`