dist-git conversion

#2781)

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,56 +1,3 @@
-shadow-4.1.4.2.tar.bz2
-/shadow-4.1.4.3.tar.bz2
-/shadow-4.1.5.tar.bz2
-/shadow-4.1.5.1.tar.bz2
-/shadow-4.1.5.1.tar.bz2.sig
-/shadow-4.2.1.tar.xz
-/shadow-4.2.1.tar.xz.sig
-/shadow-4.3.1.tar.gz
-/shadow-4.5.tar.xz
-/shadow-4.5.tar.xz.asc
-/shadow-4.6.tar.xz
-/shadow-4.6.tar.xz.asc
-/shadow-4.8.tar.xz
-/shadow-4.8.tar.xz.asc
-/shadow-4.8.1.tar.xz
-/shadow-4.8.1.tar.xz.asc
-/shadow-4.9.tar.xz
-/shadow-4.9.tar.xz.asc
-/shadow-4.11.1.tar.xz
-/shadow-4.11.1.tar.xz.asc
-/shadow-4.12.3.tar.xz
-/shadow-4.12.3.tar.xz.asc
-/shadow-4.13.tar.xz
-/shadow-4.13.tar.xz.asc
-/shadow-4.14.0.tar.xz
-/shadow-4.14.0.tar.xz.asc
-/shadow-4.15.0rc2.tar.xz
-/shadow-4.15.0rc2.tar.xz.asc
-/shadow-4.15.0rc3.tar.xz
-/shadow-4.15.0rc3.tar.xz.asc
-/shadow-4.15.0.tar.xz
-/shadow-4.15.0.tar.xz.asc
-/shadow-4.15.1.tar.xz
-/shadow-4.15.1.tar.xz.asc
-/shadow-4.16.0.tar.xz
-/shadow-4.16.0.tar.xz.asc
-/shadow-4.17.0-rc1.tar.xz
-/shadow-4.17.0-rc1.tar.xz.asc
-/shadow-4.17.0.tar.xz
-/shadow-4.17.0.tar.xz.asc
-/shadow-4.17.4.tar.xz
-/shadow-4.17.4.tar.xz.asc
-/shadow-4.18.0.tar.xz
-/shadow-4.18.0.tar.xz.asc
-/shadow-4.19.0.tar.xz
-/shadow-4.19.0.tar.xz.asc
-/shadow-4.19.2.tar.xz
-/shadow-4.19.2.tar.xz.asc
-/shadow-4.19.3.tar.xz
-/shadow-4.19.3.tar.xz.asc
-/shadow-4.20.0-rc2.tar.xz
-/shadow-4.20.0-rc2.tar.xz.asc
-/shadow-4.20.0-rc3.tar.xz
-/shadow-4.20.0-rc3.tar.xz.asc
-/shadow-4.20.0.tar.xz
-/shadow-4.20.0.tar.xz.asc
+shadow-4.0.17-login.defs
+shadow-4.0.18.1-useradd
+shadow-4.1.1.tar.bz2

gpl-2.0.txt

@@ -1,339 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Lesser General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-                            NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.

passwd.pamd

@@ -1,5 +0,0 @@
-#%PAM-1.0
-# This tool only uses the password stack.
-password   substack	system-auth
--password   optional	pam_gnome_keyring.so use_authtok
-password   substack	postlogin

plans/tier0-functional.fmf

@@ -1,51 +0,0 @@
-summary: Tier 0 functional tests for shadow-utils
-description: |
-    Run comprehensive system tests for shadow-utils. These tests validate user and group
-    account management functionality by testing actual system operations including user
-    creation, password management, group operations, and verification of system files
-    (i.e. /etc/passwd, /etc/shadow).
-
-provision:
-    how: virtual
-    image: fedora
-
-prepare:
-    - name: Install general dependencies
-      how: install
-      package:
-        - expect
-        - gcc
-        - git
-        - libssh-devel
-        - python3-devel
-        - python3-pip
-
-    - name: Setup SSH keys for localhost testing
-      how: shell
-      script:
-        - ssh-keygen -t rsa -f /root/.ssh/id_rsa -N "" -q
-        - cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
-        - chmod 600 /root/.ssh/authorized_keys
-        - ssh-keyscan -H localhost >> /root/.ssh/known_hosts
-
-    - name: Clone shadow repository
-      how: shell
-      script:
-        - git clone https://github.com/shadow-maint/shadow.git /tmp/shadow-test
-
-    - name: Copy test topology for Fedora CI
-      how: shell
-      script:
-        - cp tests/mhc-fedora-ci.yaml /tmp/shadow-test/tests/system
-
-    - name: Install test dependencies
-      how: shell
-      script:
-        - pip3 install -r /tmp/shadow-test/tests/system/requirements.txt
-
-execute:
-    how: tmt
-    duration: 30m
-    script: |
-        cd /tmp/shadow-test/tests/system
-        pytest --mh-config=mhc-fedora-ci.yaml --mh-lazy-ssh -v

shadow-4.0.17-login.defs

@@ -0,0 +1,58 @@
+# *REQUIRED*
+#   Directory where mailboxes reside, _or_ name of file, relative to the
+#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
+#   QMAIL_DIR is for Qmail
+#
+#QMAIL_DIR	Maildir
+MAIL_DIR	/var/spool/mail
+#MAIL_FILE	.mail
+
+# Password aging controls:
+#
+#	PASS_MAX_DAYS	Maximum number of days a password may be used.
+#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
+#	PASS_MIN_LEN	Minimum acceptable password length.
+#	PASS_WARN_AGE	Number of days warning given before a password expires.
+#
+PASS_MAX_DAYS	99999
+PASS_MIN_DAYS	0
+PASS_MIN_LEN	5
+PASS_WARN_AGE	7
+
+#
+# Min/max values for automatic uid selection in useradd
+#
+UID_MIN			  500
+UID_MAX			60000
+
+#
+# Min/max values for automatic gid selection in groupadd
+#
+GID_MIN			  500
+GID_MAX			60000
+
+#
+# If defined, this command is run when removing a user.
+# It should remove any at/cron/print jobs etc. owned by
+# the user to be removed (passed as the first argument).
+#
+#USERDEL_CMD	/usr/sbin/userdel_local
+
+#
+# If useradd should create home directories for users by default
+# On RH systems, we do. This option is overridden with the -m flag on
+# useradd command line.
+#
+CREATE_HOME	yes
+
+# The permission mask is initialized to this value. If not specified, 
+# the permission mask will be initialized to 022.
+UMASK           077
+
+# This enables userdel to remove user groups if no members exist.
+#
+USERGROUPS_ENAB yes
+
+# Use MD5 or DES to encrypt password? Red Hat use MD5 by default.
+MD5_CRYPT_ENAB yes
+

shadow-4.1.0-goodname.patch

@@ -0,0 +1,93 @@
+diff -up shadow-4.1.0/libmisc/chkname.c.goodname shadow-4.1.0/libmisc/chkname.c
+--- shadow-4.1.0/libmisc/chkname.c.goodname	2007-11-11 00:45:59.000000000 +0100
++++ shadow-4.1.0/libmisc/chkname.c	2007-12-12 13:57:20.000000000 +0100
+@@ -18,16 +18,24 @@
+ static int good_name (const char *name)
+ {
+ 	/*
+-	 * User/group names must match [a-z_][a-z0-9_-]*[$]
+-	 */
+-	if (!*name || !((*name >= 'a' && *name <= 'z') || *name == '_'))
++         * User/group names must match gnu e-regex:
++         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
++         *
++         * as a non-POSIX, extension, allow "$" as the last char for
++         * sake of Samba 3.x "add machine script"
++         */
++	if (!*name || !((*name >= 'a' && *name <= 'z')
++             || (*name >= 'A' && *name <= 'Z')
++             || (*name >= '0' && *name <= '9')
++             || *name == '_' || *name == '.'))
+ 		return 0;
+ 
+ 	while (*++name) {
+-		if (!((*name >= 'a' && *name <= 'z') ||
+-		      (*name >= '0' && *name <= '9') ||
+-		      *name == '_' || *name == '-' ||
+-		      (*name == '$' && *(name + 1) == '\0')))
++		if (!(  (*name >= 'a' && *name <= 'z')
++		     || (*name >= 'A' && *name <= 'Z')
++                     || (*name >= '0' && *name <= '9')
++                     || *name == '_' || *name == '.' || *name == '-'
++                     || (*name == '$' && *(name + 1) == '\0')))
+ 			return 0;
+ 	}
+ 
+@@ -43,10 +51,9 @@ int check_user_name (const char *name)
+ #endif
+ 
+ 	/*
+-	 * User names are limited by whatever utmp can
+-	 * handle (usually max 8 characters).
++	 * User names are limited by whatever utmp can handle.
+ 	 */
+-	if (strlen (name) > sizeof (ut.ut_user))
++	if (strlen(name) + 1 > sizeof(ut.ut_user))
+ 		return 0;
+ 
+ 	return good_name (name);
+@@ -54,11 +61,13 @@ int check_user_name (const char *name)
+ 
+ int check_group_name (const char *name)
+ {
+-	/*
+-	 * Arbitrary limit for group names - max 16
+-	 * characters (same as on HP-UX 10).
+-	 */
+-	if (strlen (name) > 16)
++#if HAVE_UTMPX_H
++	struct utmpx ut;
++#else
++	struct utmp ut;
++#endif
++
++	if (strlen(name) + 1 > sizeof(ut.ut_user))
+ 		return 0;
+ 
+ 	return good_name (name);
+diff -up shadow-4.1.0/man/groupadd.8.goodname shadow-4.1.0/man/groupadd.8
+--- shadow-4.1.0/man/groupadd.8.goodname	2007-12-12 13:51:43.000000000 +0100
++++ shadow-4.1.0/man/groupadd.8	2007-12-12 14:00:29.000000000 +0100
+@@ -126,9 +126,7 @@ Shadow password suite configuration\.
+ .RE
+ .SH "CAVEATS"
+ .PP
+-Groupnames must begin with a lower case letter or an underscore, and only lower case letters, underscores, dashes, and dollar signs may follow\. In regular expression terms: [a\-z_][a\-z0\-9_\-]*[$]
+-.PP
+-Groupnames may only be up to 16 characters long\.
++Groupnames may only be up to 32 characters long\.
+ .PP
+ You may not add a NIS or LDAP group\. This must be performed on the corresponding server\.
+ .PP
+diff -up shadow-4.1.0/man/useradd.8.goodname shadow-4.1.0/man/useradd.8
+--- shadow-4.1.0/man/useradd.8.goodname	2007-12-12 13:51:43.000000000 +0100
++++ shadow-4.1.0/man/useradd.8	2007-12-12 14:01:36.000000000 +0100
+@@ -242,8 +242,6 @@ You may not add a user to a NIS or LDAP 
+ Similarly, if the username already exists in an external user database such as NIS or LDAP,
+ \fBuseradd\fR
+ will deny the user account creation request\.
+-.PP
+-Usernames must begin with a lower case letter or an underscore, and only lower case letters, underscores, dashes, and dollar signs may follow\. In regular expression terms: [a\-z_][a\-z0\-9_\-]*[$]
+ .SH "CONFIGURATION"
+ .PP
+ The following configuration variables in

shadow-4.1.1-audit.patch

@@ -0,0 +1,26 @@
+diff -up shadow-4.1.1/src/newgrp.c.audit shadow-4.1.1/src/newgrp.c
+--- shadow-4.1.1/src/newgrp.c.audit	2008-04-03 15:20:25.000000000 +0200
++++ shadow-4.1.1/src/newgrp.c	2008-04-03 15:22:00.000000000 +0200
+@@ -53,6 +53,10 @@ static GETGROUPS_T *grouplist;
+ static char *Prog;
+ static int is_newgrp;
+ 
++#ifdef WITH_AUDIT
++	char audit_buf[80];
++#endif
++
+ /* local function prototypes */
+ static void usage (void);
+ static void check_perms (const struct group *grp,
+@@ -349,10 +353,9 @@ int main (int argc, char **argv)
+ #endif
+ 
+ #ifdef WITH_AUDIT
+-	char audit_buf[80];
+-
+ 	audit_help_open ();
+ #endif
++
+ 	setlocale (LC_ALL, "");
+ 	bindtextdomain (PACKAGE, LOCALEDIR);
+ 	textdomain (PACKAGE);

shadow-4.1.1-redhat.patch

@@ -0,0 +1,272 @@
+diff -up shadow-4.1.1/libmisc/find_new_ids.c.redhat shadow-4.1.1/libmisc/find_new_ids.c
+--- shadow-4.1.1/libmisc/find_new_ids.c.redhat	2008-04-03 12:18:51.000000000 +0200
++++ shadow-4.1.1/libmisc/find_new_ids.c	2008-04-03 13:30:44.000000000 +0200
+@@ -26,11 +26,11 @@ int find_new_uid (int sys_user, uid_t *u
+ 	assert (uid != NULL);
+ 
+ 	if (sys_user == 0) {
+-		uid_min = getdef_unum ("UID_MIN", 1000);
++		uid_min = getdef_unum ("UID_MIN", 500);
+ 		uid_max = getdef_unum ("UID_MAX", 60000);
+ 	} else {
+ 		uid_min = getdef_unum ("SYS_UID_MIN", 1);
+-		uid_max = getdef_unum ("UID_MIN", 1000) - 1;
++		uid_max = getdef_unum ("UID_MIN", 500) - 1;
+ 		uid_max = getdef_unum ("SYS_UID_MAX", uid_max);
+ 	}
+ 
+@@ -108,11 +108,11 @@ int find_new_gid (int sys_group, gid_t *
+ 	assert (gid != NULL);
+ 
+ 	if (sys_group == 0) {
+-		gid_min = getdef_unum ("GID_MIN", 1000);
++		gid_min = getdef_unum ("GID_MIN", 500);
+ 		gid_max = getdef_unum ("GID_MAX", 60000);
+ 	} else {
+ 		gid_min = getdef_unum ("SYS_GID_MIN", 1);
+-		gid_max = getdef_unum ("GID_MIN", 1000) - 1;
++		gid_max = getdef_unum ("GID_MIN", 500) - 1;
+ 		gid_max = getdef_unum ("SYS_GID_MAX", gid_max);
+ 	}
+ 
+diff -up shadow-4.1.1/src/useradd.c.redhat shadow-4.1.1/src/useradd.c
+--- shadow-4.1.1/src/useradd.c.redhat	2008-03-08 23:42:05.000000000 +0100
++++ shadow-4.1.1/src/useradd.c	2008-04-03 14:07:32.000000000 +0200
+@@ -82,7 +82,7 @@
+ static gid_t def_group = 100;
+ static const char *def_gname = "other";
+ static const char *def_home = "/home";
+-static const char *def_shell = "";
++static const char *def_shell = "/sbin/nologin";
+ static const char *def_template = SKEL_DIR;
+ static const char *def_create_mail_spool = "no";
+ 
+@@ -94,7 +94,7 @@ static char def_file[] = USER_DEFAULTS_F
+ #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
+ 
+ static const char *user_name = "";
+-static const char *user_pass = "!";
++static const char *user_pass = "!!";
+ static uid_t user_id;
+ static gid_t user_gid;
+ static const char *user_comment = "";
+@@ -130,6 +130,7 @@ static int
+     kflg = 0,			/* specify a directory to fill new user directory */
+     lflg = 0,			/* do not add user to lastlog database file */
+     mflg = 0,			/* create user's home directory if it doesn't exist */
++    Mflg = 0,                   /* do NOT create user's home directory no matter what */
+     Nflg = 0,			/* do not create a group having the same name as the user, but add the user to def_group (or the group specified with -g) */
+     oflg = 0,			/* permit non-unique user ID to be specified with -u */
+     rflg = 0,			/* create a system account */
+@@ -653,6 +654,7 @@ static void usage (void)
+ 	         "                                faillog databases\n"
+ 	         "  -m, --create-home             create home directory for the new user\n"
+ 	         "                                account\n"
++		 "  -M, 	                  do not create user's home directory(overrides /etc/login.defs)\n"		
+ 	         "  -N, --no-user-group           do not create a group with the same name as\n"
+ 	         "                                the user\n"
+ 	         "  -o, --non-unique              allow create user with duplicate\n"
+@@ -883,7 +885,7 @@ static void process_flags (int argc, cha
+ 			{NULL, 0, NULL, '\0'}
+ 		};
+ 		while ((c =
+-			getopt_long (argc, argv, "b:c:d:De:f:g:G:k:K:lmMNop:rs:u:U",
++			getopt_long (argc, argv, "b:c:d:De:f:g:G:k:K:lmMnNop:rs:u:U",
+ 				     long_options, NULL)) != -1) {
+ 			switch (c) {
+ 			case 'b':
+@@ -1023,6 +1025,10 @@ static void process_flags (int argc, cha
+ 			case 'm':
+ 				mflg++;
+ 				break;
++                        case 'M':
++                                Mflg++;
++                                break;
++       			case 'n':
+ 			case 'N':
+ 				Nflg++;
+ 				break;
+@@ -1076,6 +1082,9 @@ static void process_flags (int argc, cha
+ 		Uflg = getdef_bool ("USERGROUPS_ENAB");
+ 	}
+ 
++        if (mflg && Mflg) /* the admin is not decided .. create or not ? */
++               usage();
++
+ 	/*
+ 	 * Certain options are only valid in combination with others.
+ 	 * Check it here so that they can be specified in any order.
+@@ -1625,6 +1634,14 @@ int main (int argc, char **argv)
+ 	}
+ #endif				/* USE_PAM */
+ 
++        if (!rflg) /* for system accounts defaults are ignored and we
++                    * do not create a home dir -- gafton */
++        	if (getdef_bool("CREATE_HOME"))
++               		mflg = 1;
++
++        if (Mflg) /* absolutely sure that we do not create home dirs */
++        	mflg = 0;
++
+ 	/*
+ 	 * See if we are messing with the defaults file, or creating
+ 	 * a new user.
+@@ -1724,27 +1741,22 @@ int main (int argc, char **argv)
+ 				 ("%s: warning: the home directory already exists.\n"
+ 				  "Not copying any file from skel directory into it.\n"),
+ 				 Prog);
+-
+-	} else if (getdef_str ("CREATE_HOME")) {
+-		/*
+-		 * RedHat added the CREATE_HOME option in login.defs in their
+-		 * version of shadow-utils (which makes -m the default, with
+-		 * new -M option to turn it off). Unfortunately, this
+-		 * changes the way useradd works (it can be run by scripts
+-		 * expecting some standard behaviour), compared to other
+-		 * Unices and other Linux distributions, and also adds a lot
+-		 * of confusion :-(.
+-		 * So we now recognize CREATE_HOME and give a warning here
+-		 * (better than "configuration error ... notify administrator"
+-		 * errors in every program that reads /etc/login.defs). -MM
+-		 */
+-		fprintf (stderr,
+-			 _
+-			 ("%s: warning: CREATE_HOME not supported, please use -m instead.\n"),
+-			 Prog);
+ 	}
+-
+-	create_mail ();
++        /* Warning removed to protect the innocent. */
++        /*
++         * The whole idea about breaking some stupid scripts by creating a new
++         * variable is crap - I could care less about the scripts. Historically
++         * adduser type programs have always created the home directories and
++         * I don't like the idea of providing a script when we can fix the
++         * binary itself. And if the scripts are using the right options to the
++         * useradd then they will not break. If not, they depend on unspecified
++         * behavior and they will break, but they were broken anyway to begin
++         * with --gafton
++         */
++
++	/* Do not create mail directory for system accounts */
++	if( !rflg )
++		create_mail ();
+ 
+ 	close_files ();
+ 
+diff -up shadow-4.1.1/src/groupadd.c.redhat shadow-4.1.1/src/groupadd.c
+diff -up shadow-4.1.1/man/useradd.8.redhat shadow-4.1.1/man/useradd.8
+--- shadow-4.1.1/man/useradd.8.redhat	2008-04-03 00:43:14.000000000 +0200
++++ shadow-4.1.1/man/useradd.8	2008-04-03 14:20:23.000000000 +0200
+@@ -25,9 +25,9 @@ When invoked without the
+ \fB\-D\fR
+ option, the
+ \fBuseradd\fR
+-command creates a new user account using the values specified on the command line plus the default values from the system\. Depending on command line options, the
++command creates a new user account using the values specified on the command line and the default values from the system. Depending on command line options, the 
+ \fBuseradd\fR
+-command will update system files and may also create the new user\'s home directory and copy initial files\.
++command will update system files and may also create the new user's home directory and copy initial files. The version provided with Red Hat Linux will create a group for each user added to the system by default.
+ .SH "OPTIONS"
+ .PP
+ The options which apply to the
+@@ -84,7 +84,7 @@ The number of days after a password expi
+ .PP
+ \fB\-g\fR, \fB\-\-gid\fR \fIGROUP\fR
+ .RS 4
+-The group name or number of the user\'s initial login group\. The group name must exist\. A group number must refer to an already existing group\. The default group number is 1 or whatever is specified in
++The group name or number of the user\'s initial login group\. The group name must exist\. A group number must refer to an already existing group\.
+ \fI/etc/default/useradd\fR\.
+ .RE
+ .PP
+@@ -100,6 +100,13 @@ option\. The default is for the user to 
+ Display help message and exit\.
+ .RE
+ .PP
++\fB-M\fR
++.RS 4
++The user\'s home directory will not be created, even if the system wide settings from 
++\fI/etc/login.defs\fR 
++is to create home dirs\.
++.RE
++.PP
+ \fB\-m\fR, \fB\-\-create\-home\fR
+ .RS 4
+ The user\'s home directory will be created if it does not exist\. The files contained in
+@@ -174,6 +181,19 @@ The encrypted password, as returned by
+ \fBcrypt\fR(3)\. The default is to disable the account\.
+ .RE
+ .PP
++\fB-r\fR
++.RS 4
++This flag is used to create a system account\. That is, a user with a UID lower than the value of UID_MIN defined in 
++\fI/etc/login.defs\fR 
++and whose password does not expire\. Note that 
++\fBuseradd\fR 
++will not create a home directory for such an user, regardless of the default setting in 
++\fI/etc/login.defs\fR\. 
++You have to specify 
++\fB-m\fR 
++option if you want a home directory for a system account to be created\. This is an option added by Red Hat\.
++.RE
++.PP
+ \fB\-s\fR, \fB\-\-shell\fR \fISHELL\fR
+ .RS 4
+ The name of the user\'s login shell\. The default is to leave this field blank, which causes the system to select the default login shell\.
+@@ -244,6 +264,8 @@ The name of a new user\'s login shell\.
+ The system administrator is responsible for placing the default user files in the
+ \fI/etc/skel/\fR
+ directory\.
++.br
++This version of useradd was modified by Red Hat to suit Red Hat user/group conventions\.
+ .SH "CAVEATS"
+ .PP
+ You may not add a user to a NIS or LDAP group\. This must be performed on the corresponding server\.
+@@ -381,6 +403,11 @@ Secure user account information\.
+ Group account information\.
+ .RE
+ .PP
++\fI/etc/gshadow\fR
++.RS 4
++Secure group account information\.
++.RE
++.PP
+ \fI/etc/default/useradd\fR
+ .RS 4
+ Default values for account creation\.
+diff -up shadow-4.1.1/man/groupadd.8.redhat shadow-4.1.1/man/groupadd.8
+--- shadow-4.1.1/man/groupadd.8.redhat	2008-04-03 00:42:54.000000000 +0200
++++ shadow-4.1.1/man/groupadd.8	2008-04-03 14:27:04.000000000 +0200
+@@ -14,7 +14,7 @@
+ groupadd \- create a new group
+ .SH "SYNOPSIS"
+ .HP 9
+-\fBgroupadd\fR [\-g\ \fIGID\fR\ [\-o]] [\-f] [\-K\ \fIKEY\fR=\fIVALUE\fR] \fIgroup\fR
++\fBgroupadd\fR [\-g\ \fIgid\fR\ [\-o]] [\-r] [\-f] [\-K\ \fIKEY\fR=\fIVALUE\fR] \fIgroup\fR
+ .SH "DESCRIPTION"
+ .PP
+ The
+@@ -34,11 +34,22 @@ This option causes the command to simply
+ is turned off)\.
+ .RE
+ .PP
++\fB-r\fR
++.RS 4
++This flag instructs
++\fBgroupadd\fR
++to add a system account\.  The first available
++\fIgid\fR
++lower than 499 will be automatically selected unless the
++\fB-g\fR
++option is also given on the command line\. This is an option added by Red Hat\.
++.RE
++.PP
+ \fB\-g\fR, \fB\-\-gid\fR \fIGID\fR
+ .RS 4
+ The numerical value of the group\'s ID\. This value must be unique, unless the
+ \fB\-o\fR
+-option is used\. The value must be non\-negative\. The default is to use the smallest ID value greater than 999 and greater than every other group\. Values between 0 and 999 are typically reserved for system accounts\.
++option is used\. The value must be non\-negative\. The default is to use the smallest ID value greater than 499 and greater than every other group\. Values between 0 and 500 are typically reserved for system accounts\.
+ .RE
+ .PP
+ \fB\-h\fR, \fB\-\-help\fR

shadow-4.1.1-saltSize.patch

@@ -0,0 +1,17 @@
+diff -up shadow-4.1.1/libmisc/salt.c.saltSize shadow-4.1.1/libmisc/salt.c
+--- shadow-4.1.1/libmisc/salt.c.saltSize	2008-05-20 13:36:06.000000000 +0200
++++ shadow-4.1.1/libmisc/salt.c	2008-05-20 13:39:30.000000000 +0200
+@@ -90,9 +90,10 @@ static void seedRNG (void)
+  */
+ static unsigned int SHA_salt_size (void)
+ {
+-	double rand_rounds = 9 * random ();
+-	rand_rounds /= RAND_MAX;
+-	return 8 + rand_rounds;
++        unsigned int rand_rounds;
++        seedRNG ();
++        rand_rounds = random () % 9;
++        return 8 + rand_rounds;
+ }
+ 
+ /* ! Arguments evaluated twice ! */

shadow-4.1.1-selinux.patch

@@ -0,0 +1,490 @@
+diff -up /dev/null shadow-4.1.1/libmisc/system.c
+--- /dev/null	2008-03-19 11:34:26.687502959 +0100
++++ shadow-4.1.1/libmisc/system.c	2008-04-05 14:55:29.000000000 +0200
+@@ -0,0 +1,37 @@
++#include <config.h>
++
++#ident "$Id: shadow-4.1.1-selinux.patch,v 1.1 2008/04/05 13:17:48 pvrabec Exp $"
++
++#include <stdio.h>
++#include <sys/wait.h>
++#include <fcntl.h>
++#include "prototypes.h"
++#include "defines.h"
++
++int safe_system(const char *command, const char *argv[], const char *env[], int ignore_stderr)
++{
++	int status = -1;
++	int fd;
++	pid_t pid;
++	
++	pid = fork();
++	if (pid < 0) 
++		return -1;
++
++	if (pid) {       /* Parent */
++		waitpid(pid, &status, 0);
++		return status;
++	}
++
++	fd = open("/dev/null", O_RDWR);
++	/* Child */
++	dup2(fd,0);	// Close Stdin
++	if (ignore_stderr)
++		dup2(fd,2);	// Close Stderr
++	
++	execve(command, (char *const *) argv, (char *const *) env);
++	fprintf (stderr,
++		 _("Failed to exec '%s'\n"), argv[0]);
++	exit (-1);
++}
++
+diff -up shadow-4.1.1/libmisc/copydir.c.selinux shadow-4.1.1/libmisc/copydir.c
+--- shadow-4.1.1/libmisc/copydir.c.selinux	2008-01-06 13:02:04.000000000 +0100
++++ shadow-4.1.1/libmisc/copydir.c	2008-04-05 14:55:29.000000000 +0200
+@@ -82,7 +82,7 @@ static int copy_file (const char *src, c
+  *	symlink, directory, ...
+  *
+  */
+-static int selinux_file_context (const char *dst_name)
++int selinux_file_context (const char *dst_name)
+ {
+ 	security_context_t scontext = NULL;
+ 
+@@ -253,6 +253,12 @@ int copy_tree (const char *src_root, con
+ 		src_orig = 0;
+ 		dst_orig = 0;
+ 	}
++
++#ifdef WITH_SELINUX
++        /* Reset SELinux to create files with default contexts */
++        setfscreatecon (NULL);
++#endif
++
+ 	return err;
+ }
+ 
+diff -up shadow-4.1.1/libmisc/Makefile.am.selinux shadow-4.1.1/libmisc/Makefile.am
+--- shadow-4.1.1/libmisc/Makefile.am.selinux	2008-01-27 15:21:48.000000000 +0100
++++ shadow-4.1.1/libmisc/Makefile.am	2008-04-05 14:55:29.000000000 +0200
+@@ -43,6 +43,7 @@ libmisc_a_SOURCES = \
+ 	setugid.c \
+ 	setupenv.c \
+ 	shell.c \
++	system.c \
+ 	strtoday.c \
+ 	sub.c \
+ 	sulog.c \
+diff -up shadow-4.1.1/src/useradd.c.selinux shadow-4.1.1/src/useradd.c
+--- shadow-4.1.1/src/useradd.c.selinux	2008-04-05 14:55:29.000000000 +0200
++++ shadow-4.1.1/src/useradd.c	2008-04-05 14:55:29.000000000 +0200
+@@ -101,6 +101,7 @@ static const char *user_comment = "";
+ static const char *user_home = "";
+ static const char *user_shell = "";
+ static const char *create_mail_spool = "";
++static const char *user_selinux = "";
+ 
+ static long user_expire = -1;
+ static int is_shadow_pwd;
+@@ -173,6 +174,7 @@ static int set_defaults (void);
+ static int get_groups (char *);
+ static void usage (void);
+ static void new_pwent (struct passwd *);
++static void selinux_update_mapping (void);
+ 
+ static long scale_age (long);
+ static void new_spent (struct spwd *);
+@@ -373,6 +375,7 @@ static void get_defaults (void)
+ 			def_create_mail_spool = xstrdup (cp);
+ 		}
+ 	}
++	fclose(fp);
+ }
+ 
+ /*
+@@ -665,6 +668,9 @@ static void usage (void)
+ 	         "  -s, --shell SHELL             the login shell for the new user account\n"
+ 	         "  -u, --uid UID                 force use the UID for the new user account\n"
+ 	         "  -U, --user-group              create a group with the same name as the user\n"
++#ifdef WITH_SELINUX
++                 "  -Z, --selinux-user SEUSER     use a specific SEUSER for the SELinux user mapping\n"
++#endif
+ 	         "\n"), stderr);
+ 	exit (E_USAGE);
+ }
+@@ -880,12 +886,19 @@ static void process_flags (int argc, cha
+ 			{"password", required_argument, NULL, 'p'},
+ 			{"system", no_argument, NULL, 'r'},
+ 			{"shell", required_argument, NULL, 's'},
++#ifdef WITH_SELINUX
++                        {"selinux-user", required_argument, NULL, 'Z'},
++#endif
+ 			{"uid", required_argument, NULL, 'u'},
+ 			{"user-group", no_argument, NULL, 'U'},
+ 			{NULL, 0, NULL, '\0'}
+ 		};
+ 		while ((c =
++#ifdef WITH_SELINUX
++ 			getopt_long (argc, argv, "b:c:d:De:f:g:G:k:K:lmMnNop:rs:u:UZ:",
++#else
+ 			getopt_long (argc, argv, "b:c:d:De:f:g:G:k:K:lmMnNop:rs:u:U",
++#endif
+ 				     long_options, NULL)) != -1) {
+ 			switch (c) {
+ 			case 'b':
+@@ -1070,6 +1083,17 @@ static void process_flags (int argc, cha
+ 			case 'U':
+ 				Uflg++;
+ 				break;
++#ifdef WITH_SELINUX
++                         case 'Z':
++                                if (is_selinux_enabled() > 0)
++                                        user_selinux = optarg;
++                                else {
++                                        fprintf (stderr,_("%s: -Z requires SELinux enabled kernel\n"), Prog);
++
++                                        exit (E_BAD_ARG);
++                                }
++                                break;
++#endif
+ 			default:
+ 				usage ();
+ 			}
+@@ -1476,6 +1500,33 @@ static void usr_update (void)
+ 		grp_update ();
+ }
+ 
++static void selinux_update_mapping () {
++
++#ifdef WITH_SELINUX
++	if (is_selinux_enabled() <= 0) return;
++
++        if (*user_selinux) { /* must be done after passwd write() */
++		const char *argv[7];
++		argv[0] = "/usr/sbin/semanage";
++		argv[1] = "login";
++		argv[2] = "-a";
++		argv[3] = "-s";
++		argv[4] = user_selinux;
++		argv[5] = user_name;
++		argv[6] = NULL;
++                if (safe_system(argv[0], argv, NULL, 0)) {
++			fprintf (stderr,
++				 _("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
++				 Prog, user_name, user_selinux);
++#ifdef WITH_AUDIT
++			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
++				      "adding SELinux user mapping", user_name, user_id, 0);
++#endif        
++		}
++	}
++#endif
++
++}
+ /*
+  * create_home - create the user's home directory
+  *
+@@ -1485,7 +1536,11 @@ static void usr_update (void)
+  */
+ static void create_home (void)
+ {
++
+ 	if (access (user_home, F_OK)) {
++#ifdef WITH_SELINUX
++		selinux_file_context (user_home);
++#endif
+ 		/* XXX - create missing parent directories.  --marekm */
+ 		if (mkdir (user_home, 0)) {
+ 			fprintf (stderr,
+@@ -1507,6 +1562,10 @@ static void create_home (void)
+ 		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
+ 			      "adding home directory", user_name, user_id, 1);
+ #endif
++#ifdef WITH_SELINUX
++	/* Reset SELinux to create files with default contexts */
++		setfscreatecon (NULL);
++#endif
+ 	}
+ }
+ 
+@@ -1760,6 +1819,8 @@ int main (int argc, char **argv)
+ 
+ 	close_files ();
+ 
++	selinux_update_mapping();
++
+ 	nscd_flush_cache ("passwd");
+ 	nscd_flush_cache ("group");
+ 
+diff -up shadow-4.1.1/src/usermod.c.selinux shadow-4.1.1/src/usermod.c
+--- shadow-4.1.1/src/usermod.c.selinux	2008-02-24 13:35:13.000000000 +0100
++++ shadow-4.1.1/src/usermod.c	2008-04-05 14:55:29.000000000 +0200
+@@ -91,6 +91,7 @@ static char *user_newcomment;
+ static char *user_home;
+ static char *user_newhome;
+ static char *user_shell;
++static const char *user_selinux = "";
+ static char *user_newshell;
+ static long user_expire;
+ static long user_newexpire;
+@@ -138,6 +139,7 @@ static void date_to_str (char *buf, size
+ static int get_groups (char *);
+ static void usage (void);
+ static void new_pwent (struct passwd *);
++static void selinux_update_mapping (void);
+ 
+ static void new_spent (struct spwd *);
+ static void fail_exit (int);
+@@ -320,6 +322,9 @@ static void usage (void)
+ 	         "  -s, --shell SHELL             new login shell for the user account\n"
+ 	         "  -u, --uid UID                 new UID for the user account\n"
+ 	         "  -U, --unlock                  unlock the user account\n"
++#ifdef WITH_SELINUX
++                 "  -Z, --selinux-user            new selinux user mapping for the user account\n"
++#endif
+ 	         "\n"), stderr);
+ 	exit (E_USAGE);
+ }
+@@ -846,13 +851,20 @@ static void process_flags (int argc, cha
+ 			{"move-home", no_argument, NULL, 'm'},
+ 			{"non-unique", no_argument, NULL, 'o'},
+ 			{"password", required_argument, NULL, 'p'},
++#ifdef WITH_SELINUX
++                        {"selinux-user", required_argument, NULL, 'Z'},
++#endif
+ 			{"shell", required_argument, NULL, 's'},
+ 			{"uid", required_argument, NULL, 'u'},
+ 			{"unlock", no_argument, NULL, 'U'},
+ 			{NULL, 0, NULL, '\0'}
+ 		};
+ 		while ((c =
+-			getopt_long (argc, argv, "ac:d:e:f:g:G:hl:Lmop:s:u:U",
++#ifdef WITH_SELINUX
++                        getopt_long (argc, argv, "ac:d:e:f:g:G:hl:Lmop:s:u:UZ:",
++#else
++                        getopt_long (argc, argv, "ac:d:e:f:g:G:hl:Lmop:s:u:U",
++#endif
+ 				     long_options, NULL)) != -1) {
+ 			switch (c) {
+ 			case 'a':
+@@ -953,6 +965,16 @@ static void process_flags (int argc, cha
+ 			case 'U':
+ 				Uflg++;
+ 				break;
++#ifdef WITH_SELINUX
++                         case 'Z':
++                                if (is_selinux_enabled() > 0)
++                                        user_selinux = optarg;
++                                else {
++                                        fprintf (stderr, _("%s: -Z requires SELinux enabled kernel\n"), Prog);
++                                        exit (E_BAD_ARG);
++                                }
++                                break;
++#endif
+ 			default:
+ 				usage ();
+ 			}
+@@ -1530,6 +1552,8 @@ int main (int argc, char **argv)
+ 	nscd_flush_cache ("passwd");
+ 	nscd_flush_cache ("group");
+ 
++	selinux_update_mapping();
++
+ 	if (mflg)
+ 		move_home ();
+ 
+@@ -1558,3 +1582,62 @@ int main (int argc, char **argv)
+ 	exit (E_SUCCESS);
+ 	/* NOT REACHED */
+ }
++
++static void selinux_update_mapping () {
++#ifdef WITH_SELINUX
++	const char *argv[7];
++
++	if (is_selinux_enabled() <= 0) return;
++
++        if (*user_selinux) { 
++		argv[0] = "/usr/sbin/semanage";
++		argv[1] = "login";
++		argv[2] = "-m";
++		argv[3] = "-s";
++		argv[4] = user_selinux;
++		argv[5] = user_name;
++		argv[6] = NULL;
++                if (safe_system(argv[0], argv, NULL, 1)) {
++			argv[2] = "-a";
++			if (safe_system(argv[0], argv, NULL, 0)) {
++				fprintf (stderr,
++					 _("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
++					 Prog, user_name, user_selinux);
++#ifdef WITH_AUDIT
++				audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
++					      "modifying User mapping ", user_name, user_id, 0);
++#endif        
++			}
++		}
++        }
++        
++	if (dflg || *user_selinux) {
++		argv[0] = "/usr/sbin/genhomedircon";
++		argv[1] = NULL;
++		if(safe_system(argv[0], argv, NULL,0)) {
++			fprintf (stderr,
++				 _("%s: warning: unable to relabel the homedir %s for %s.\n"),
++				 Prog, user_home, user_name);
++#ifdef WITH_AUDIT
++			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
++			      "relabeling home directory", user_name, user_id, 0);
++#endif
++		}
++
++		argv[0] = "/sbin/restorecon";
++		argv[1] = "-F";
++		argv[2] = "-R";
++		argv[3] = user_home;
++		argv[4] = NULL;
++                if (safe_system(argv[0], argv, NULL, 0)) {
++			fprintf (stderr,
++				 _("%s: warning: unable to relabel the homedir %s for %s.\n"),
++				 Prog, user_home, user_name);
++#ifdef WITH_AUDIT
++			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
++				      "relabeling home directory", user_name, user_id, 0);
++#endif        
++		}
++	}
++#endif
++}
+diff -up shadow-4.1.1/src/userdel.c.selinux shadow-4.1.1/src/userdel.c
+--- shadow-4.1.1/src/userdel.c.selinux	2008-03-08 21:48:26.000000000 +0100
++++ shadow-4.1.1/src/userdel.c	2008-04-05 14:55:29.000000000 +0200
+@@ -809,6 +809,17 @@ int main (int argc, char **argv)
+ #endif
+ 	}
+ 
++#ifdef WITH_SELINUX
++	if (is_selinux_enabled() > 0) { 
++		const char *argv[5];
++		argv[0] = "/usr/sbin/semanage";
++		argv[1] = "login";
++		argv[2] = "-d";
++		argv[3] = user_name;
++		argv[4] = NULL;
++                safe_system(argv[0], argv, NULL, 1);
++        }
++#endif        
+ 	/*
+ 	 * Cancel any crontabs or at jobs. Have to do this before we remove
+ 	 * the entry from /etc/passwd.
+diff -up shadow-4.1.1/man/useradd.8.selinux shadow-4.1.1/man/useradd.8
+--- shadow-4.1.1/man/useradd.8.selinux	2008-04-05 14:55:29.000000000 +0200
++++ shadow-4.1.1/man/useradd.8	2008-04-05 15:00:03.000000000 +0200
+@@ -219,6 +219,11 @@ options are not specified) is defined by
+ variable in
+ \fIlogin\.defs\fR\.
+ .RE
++.PP
++\fB\-Z\fR, \fB\-\-selinux-user\fR \fISEUSER\fR
++.RS 4
++The SELinux user for the user\'s login\. The default is to leave this field blank, which causes the system to select the default SELinux user\.
++.RE
+ .SS "Changing the default values"
+ .PP
+ When invoked with only the
+diff -up shadow-4.1.1/man/usermod.8.xml.selinux shadow-4.1.1/man/usermod.8.xml
+--- shadow-4.1.1/man/usermod.8.xml.selinux	2007-12-31 17:48:34.000000000 +0100
++++ shadow-4.1.1/man/usermod.8.xml	2008-04-05 14:55:29.000000000 +0200
+@@ -245,6 +245,19 @@
+ 	  </para>
+ 	</listitem>
+       </varlistentry>
++       <varlistentry>
++        <term>
++         <option>-Z</option>, <option>--selinux-user</option>
++         <replaceable>SEUSER</replaceable>
++       </term>
++       <listitem>
++         <para>
++           The SELinux user for the user's login. The default is to leave this
++           field the blank, which causes the system to select the default
++           SELinux user.
++         </para>
++       </listitem>
++      </varlistentry>
+     </variablelist>
+   </refsect1>
+ 
+diff -up shadow-4.1.1/man/usermod.8.selinux shadow-4.1.1/man/usermod.8
+--- shadow-4.1.1/man/usermod.8.selinux	2008-04-03 00:43:16.000000000 +0200
++++ shadow-4.1.1/man/usermod.8	2008-04-05 14:55:29.000000000 +0200
+@@ -133,6 +133,11 @@ Note: if you wish to unlock the account 
+ value from
+ \fI/etc/default/useradd\fR)\.
+ .RE
++.PP
++\fB\-Z\fR, \fB\-\-selinux-user\fR \fISEUSER\fR
++.RS 4
++The SELinux user for the user\'s login\. The default is to leave this field blank, which causes the system to select the default SELinux user.
++.RE
+ .SH "CAVEATS"
+ .PP
+ 
+diff -up shadow-4.1.1/man/useradd.8.xml.selinux shadow-4.1.1/man/useradd.8.xml
+--- shadow-4.1.1/man/useradd.8.xml.selinux	2008-02-25 22:01:23.000000000 +0100
++++ shadow-4.1.1/man/useradd.8.xml	2008-04-05 14:55:29.000000000 +0200
+@@ -326,6 +326,19 @@
+ 	  </para>
+ 	</listitem>
+       </varlistentry>
++      <varlistentry>
++	<term>
++	  <option>-Z</option>, <option>--selinux-user</option>
++	  <replaceable>SEUSER</replaceable>
++	</term>
++	<listitem>
++	  <para>
++	    The SELinux user for the user's login. The default is to leave this
++	    field blank, which causes the system to select the default SELinux
++            user.
++	  </para>
++	</listitem>
++      </varlistentry>
+     </variablelist>
+ 
+     <refsect2 id='changing_the_default_values'>
+diff -up shadow-4.1.1/lib/defines.h.selinux shadow-4.1.1/lib/defines.h
+--- shadow-4.1.1/lib/defines.h.selinux	2008-02-03 18:52:52.000000000 +0100
++++ shadow-4.1.1/lib/defines.h	2008-04-05 14:55:29.000000000 +0200
+@@ -321,4 +321,7 @@ extern char *strerror ();
+ # define unused
+ #endif
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#endif
+ #endif				/* _DEFINES_H_ */
+diff -up shadow-4.1.1/lib/prototypes.h.selinux shadow-4.1.1/lib/prototypes.h
+--- shadow-4.1.1/lib/prototypes.h.selinux	2008-03-18 00:01:32.000000000 +0100
++++ shadow-4.1.1/lib/prototypes.h	2008-04-05 15:03:41.000000000 +0200
+@@ -51,6 +51,10 @@ extern int copy_tree (const char *src_ro
+                       long int uid, long int gid);
+ extern int remove_tree (const char *root);
+ 
++#ifdef WITH_SELINUX
++extern int selinux_file_context (const char *dst_name);
++#endif
++
+ /* encrypt.c */
+ extern char *pw_encrypt (const char *, const char *);
+ 
+@@ -194,6 +198,9 @@ extern struct spwd *__spw_dup (const str
+ /* shell.c */
+ extern int shell (const char *, const char *, char *const *);
+ 
++/* system.c */
++extern int safe_system(const char *command, const char *argv[], const char *env[], int ignore_stderr);
++
+ /* strtoday.c */
+ extern long strtoday (const char *);
+ 

shadow-4.1.1-sysAccountDownhill.patch

@@ -0,0 +1,94 @@
+diff -up shadow-4.1.1/libmisc/find_new_ids.c.sysAccountDownhill shadow-4.1.1/libmisc/find_new_ids.c
+--- shadow-4.1.1/libmisc/find_new_ids.c.sysAccountDownhill	2008-04-04 21:46:08.000000000 +0200
++++ shadow-4.1.1/libmisc/find_new_ids.c	2008-04-04 21:50:04.000000000 +0200
+@@ -22,6 +22,7 @@ int find_new_uid (int sys_user, uid_t *u
+ {
+ 	const struct passwd *pwd;
+ 	uid_t uid_min, uid_max, user_id;
++	char * index;
+ 
+ 	assert (uid != NULL);
+ 
+@@ -32,6 +33,8 @@ int find_new_uid (int sys_user, uid_t *u
+ 		uid_min = getdef_unum ("SYS_UID_MIN", 1);
+ 		uid_max = getdef_unum ("UID_MIN", 500) - 1;
+ 		uid_max = getdef_unum ("SYS_UID_MAX", uid_max);
++                index = alloca (sizeof (char) * uid_max +1);
++                memset (index, 0, sizeof (char) * uid_max + 1);
+ 	}
+ 
+ 	if (   (NULL != preferred_uid)
+@@ -61,8 +64,24 @@ int find_new_uid (int sys_user, uid_t *u
+ 	pw_rewind ();
+ 	while (   ((pwd = getpwent ()) != NULL)
+ 	       || ((pwd = pw_next ()) != NULL)) {
+-		if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
+-			user_id = pwd->pw_uid + 1;
++		if (sys_user == 0) {
++			if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
++				user_id = pwd->pw_uid + 1;
++			}
++		}
++		else {
++			/* create index of occupied system accounts UIDs */
++ 	 		if (pwd->pw_uid <= uid_max)
++				index[pwd->pw_uid] = 1;
++		}
++	}
++
++	/* find free system account */
++        if(sys_user) {
++                for( user_id = uid_max; (user_id >= uid_min) && index[user_id]; user_id--);
++                if ( user_id < uid_min ) {
++               		fputs (_("Can't get unique UID (no more available UIDs)\n"), stderr);
++			return -1;
+ 		}
+ 	}
+ 
+@@ -104,6 +123,7 @@ int find_new_gid (int sys_group, gid_t *
+ {
+ 	const struct group *grp;
+ 	gid_t gid_min, gid_max, group_id;
++        char * index;
+ 
+ 	assert (gid != NULL);
+ 
+@@ -114,6 +134,8 @@ int find_new_gid (int sys_group, gid_t *
+ 		gid_min = getdef_unum ("SYS_GID_MIN", 1);
+ 		gid_max = getdef_unum ("GID_MIN", 500) - 1;
+ 		gid_max = getdef_unum ("SYS_GID_MAX", gid_max);
++                index = alloca (sizeof (char) * gid_max +1);
++                memset (index, 0, sizeof (char) * gid_max + 1);
+ 	}
+ 
+ 	if (   (NULL != preferred_gid)
+@@ -142,11 +164,27 @@ int find_new_gid (int sys_group, gid_t *
+ 	gr_rewind ();
+ 	while (   ((grp = getgrent ()) != NULL)
+ 	       || ((grp = gr_next ()) != NULL)) {
+-		if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
+-			group_id = grp->gr_gid + 1;
++		if (sys_group == 0) {
++			if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
++				group_id = grp->gr_gid + 1;
++			}
++		}
++		else {
++ 	                /* create index of occupied system accounts GIDs */
++			if (grp->gr_gid <= gid_max)
++ 				index[grp->gr_gid] = 1;
+ 		}
+ 	}
+ 
++        /* find free system account */
++        if(sys_group) {
++                for( group_id = gid_max; (group_id >= gid_min) && index[group_id]; group_id--);
++                if ( group_id < gid_min ) {
++       			fputs (_("Can't get unique GID (no more available GIDs)\n"), stderr);
++			return -1;
++       		}
++        }
++
+ 	/*
+ 	 * If a group with GID equal to GID_MAX exists, the above algorithm
+ 	 * will give us GID_MAX+1 even if not unique. Search for the first

shadow-4.1.2-gmSEGV.patch

@@ -0,0 +1,30 @@
+diff -up shadow-4.1.2/src/groupmems.c.gmSEGV shadow-4.1.2/src/groupmems.c
+--- shadow-4.1.2/src/groupmems.c.gmSEGV	2008-04-22 22:05:11.000000000 +0200
++++ shadow-4.1.2/src/groupmems.c	2008-09-02 08:30:52.000000000 +0200
+@@ -95,7 +95,7 @@ static char *whoami (void)
+ 	}
+ }
+ 
+-static void addtogroup (char *user, char **members)
++static char **addtogroup (char *user, char **members)
+ {
+ 	int i;
+ 
+@@ -109,6 +109,8 @@ static void addtogroup (char *user, char
+ 	members = (char **) realloc (members, sizeof (char *) * (i+2));
+ 	members[i] = user;
+ 	members[i + 1] = NULL;
++
++	return members;
+ }
+ 
+ static void rmfromgroup (char *user, char **members)
+@@ -285,7 +287,7 @@ int main (int argc, char **argv) 
+ 	grp = (struct group *) gr_locate (name);
+ 
+ 	if (NULL != adduser) {
+-		addtogroup (adduser, grp->gr_mem);
++		grp->gr_mem = addtogroup (adduser, grp->gr_mem);
+ 		gr_update (grp);
+ 	} else if (NULL != deluser) {
+ 		rmfromgroup (deluser, grp->gr_mem);

shadow-bsd.txt

@@ -1,32 +0,0 @@
-/*
- * Copyright (c) 1990 - 1994, Julianne Frances Haugh
- * Copyright (c) 1996 - 2000, Marek Michałkiewicz
- * Copyright (c) 2000 - 2006, Tomasz Kłoczko
- * Copyright (c) 2007 - 2011, Nicolas François
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the copyright holders or contributors may not be used to
- *    endorse or promote products derived from this software without
- *    specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
- * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-

shadow-utils.HOME_MODE.xml

@@ -1,43 +0,0 @@
-<!--
-   Copyright (c) 1991 - 1993, Julianne Frances Haugh
-   Copyright (c) 1991 - 1993, Chip Rosenthal
-   Copyright (c) 2007 - 2009, Nicolas François
-   All rights reserved.
-  
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions
-   are met:
-   1. Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-   2. Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-   3. The name of the copyright holders or contributors may not be used to
-      endorse or promote products derived from this software without
-      specific prior written permission.
-  
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
-   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--->
-<varlistentry>
-  <term><option>HOME_MODE</option> (number)</term>
-  <listitem>
-    <para>
-      The mode for new home directories. If not specified,
-      the <option>UMASK</option> is used to create the mode.
-    </para>
-    <para>
-      <command>useradd</command> and <command>newusers</command> use this
-      to set the mode of the home directory they create.
-    </para>
-  </listitem>
-</varlistentry>

shadow-utils.login.defs

@@ -1,315 +0,0 @@
-#
-# Please note that the parameters in this configuration file control the
-# behavior of the tools from the shadow-utils component. None of these
-# tools uses the PAM mechanism, and the utilities that use PAM (such as the
-# passwd command) should therefore be configured elsewhere. Refer to
-# /etc/pam.d/system-auth for more information.
-#
-
-#
-# Delay in seconds before being allowed another attempt after a login failure
-# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
-#       pam_unix(8) enforces a 2s delay)
-#
-#FAIL_DELAY		3
-
-# Currently FAILLOG_ENAB is not supported
-
-#
-# Enable display of unknown usernames when login(1) failures are recorded.
-#
-#LOG_UNKFAIL_ENAB	no
-
-# Currently LOG_OK_LOGINS is not supported
-
-# Currently LASTLOG_ENAB is not supported
-
-#
-# Limit the highest user ID number for which the lastlog entries should
-# be updated.
-#
-# No LASTLOG_UID_MAX means that there is no user ID limit for writing
-# lastlog entries.
-#
-#LASTLOG_UID_MAX
-
-# Currently MAIL_CHECK_ENAB is not supported
-
-# Currently OBSCURE_CHECKS_ENAB is not supported
-
-# Currently PORTTIME_CHECKS_ENAB is not supported
-
-# Currently QUOTAS_ENAB is not supported
-
-# Currently SYSLOG_SU_ENAB is not supported
-
-#
-# Enable "syslog" logging of newgrp(1) and sg(1) activity.
-#
-#SYSLOG_SG_ENAB		yes
-
-# Currently CONSOLE is not supported
-
-# Currently SULOG_FILE is not supported
-
-# Currently MOTD_FILE is not supported
-
-# Currently ISSUE_FILE is not supported
-
-# Currently TTYTYPE_FILE is not supported
-
-# Currently FTMP_FILE is not supported
-
-# Currently NOLOGINS_FILE is not supported
-
-# Currently SU_NAME is not supported
-
-# *REQUIRED*
-#   Directory where mailboxes reside, _or_ name of file, relative to the
-#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
-#
-MAIL_DIR	/var/spool/mail
-#MAIL_FILE	.mail
-
-#
-# If defined, file which inhibits all the usual chatter during the login
-# sequence.  If a full pathname, then hushed mode will be enabled if the
-# user's name or shell are found in the file.  If not a full pathname, then
-# hushed mode will be enabled if the file exists in the user's home directory.
-#
-#HUSHLOGIN_FILE	.hushlogin
-#HUSHLOGIN_FILE	/etc/hushlogins
-
-# Currently ENV_TZ is not supported
-
-# Currently ENV_HZ is not supported
-
-#
-# The default PATH settings, for superuser and normal users.
-#
-# (they are minimal, add the rest in the shell startup files)
-#ENV_SUPATH	PATH=/sbin:/bin:/usr/sbin:/usr/bin
-#ENV_PATH	PATH=/bin:/usr/bin
-
-#
-# Terminal permissions
-#
-#	TTYGROUP	Login tty will be assigned this group ownership.
-#	TTYPERM		Login tty will be set to this permission.
-#
-# If you have a write(1) program which is "setgid" to a special group
-# which owns the terminals, define TTYGROUP as the number of such group
-# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
-# set TTYPERM to either 622 or 600.
-#
-#TTYGROUP	tty
-#TTYPERM		0600
-
-# Currently ERASECHAR, KILLCHAR and ULIMIT are not supported
-
-# Default initial "umask" value used by login(1) on non-PAM enabled systems.
-# Default "umask" value for pam_umask(8) on PAM enabled systems.
-# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
-# home directories if HOME_MODE is not set.
-# 022 is the default value, but 027, or even 077, could be considered
-# for increased privacy. There is no One True Answer here: each sysadmin
-# must make up their mind.
-UMASK		022
-
-# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
-# home directories.
-# If HOME_MODE is not set, the value of UMASK is used to create the mode.
-HOME_MODE	0700
-
-# Password aging controls:
-#
-#	PASS_MAX_DAYS	Maximum number of days a password may be used.
-#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
-#	PASS_MIN_LEN	Minimum acceptable password length.
-#	PASS_WARN_AGE	Number of days warning given before a password expires.
-#
-PASS_MAX_DAYS	99999
-PASS_MIN_DAYS	0
-PASS_MIN_LEN	8
-PASS_WARN_AGE	7
-
-# Currently SU_WHEEL_ONLY is not supported
-
-# Currently CRACKLIB_DICTPATH is not supported
-
-#
-# Min/max values for automatic uid selection in useradd(8)
-#
-UID_MIN                  1000
-UID_MAX                 60000
-# System accounts
-SYS_UID_MIN               201
-SYS_UID_MAX               999
-# Extra per user uids
-SUB_UID_MIN		   524288
-SUB_UID_MAX		600100000
-SUB_UID_COUNT		    65536
-
-#
-# Min/max values for automatic gid selection in groupadd(8)
-#
-GID_MIN                  1000
-GID_MAX                 60000
-# System accounts
-SYS_GID_MIN               201
-SYS_GID_MAX               999
-# Extra per user group ids
-SUB_GID_MIN		   524288
-SUB_GID_MAX		600100000
-SUB_GID_COUNT		    65536
-
-#
-# Max number of login(1) retries if password is bad
-#
-#LOGIN_RETRIES		3
-
-#
-# Max time in seconds for login(1)
-#
-#LOGIN_TIMEOUT		60
-
-#
-# Maximum number of attempts to change password if rejected (too easy)
-#
-PASS_CHANGE_TRIES	5
-
-#
-# Warn about weak passwords (but still allow them) if you are root.
-#
-PASS_ALWAYS_WARN	yes
-
-#
-# Number of significant characters in the password for crypt().
-# Default is 8, don't change unless your crypt() is better.
-# Ignored if MD5_CRYPT_ENAB set to "yes".
-#
-#PASS_MAX_LEN		8
-
-# Currently CHFN_AUTH is not supported
-
-#
-# Which fields may be changed by regular users using chfn(1) - use
-# any combination of letters "frwh" (full name, room number, work
-# phone, home phone).  If not defined, no changes are allowed.
-# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
-# 
-#CHFN_RESTRICT		rwh
-
-# Currently LOGIN_STRING is not supported
-
-# Currently MD5_CRYPT_ENAB is not supported
-
-#
-# If set to MD5, MD5-based algorithm will be used for encrypting password
-# If set to SHA256, SHA256-based algorithm will be used for encrypting password
-# If set to SHA512, SHA512-based algorithm will be used for encrypting password
-# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
-# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
-# If set to DES, DES-based algorithm will be used for encrypting password (default)
-#
-ENCRYPT_METHOD YESCRYPT
-
-#
-# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
-#
-# Define the number of SHA rounds.
-# With a lot of rounds, it is more difficult to brute-force the password.
-# However, more CPU resources will be needed to authenticate users if
-# this value is increased.
-#
-# If not specified, the libc will choose the default number of rounds (5000).
-# The values must be within the 1000-999999999 range.
-#
-#SHA_CRYPT_MAX_ROUNDS 5000
-
-# Currently SHA_CRYPT_MIN_ROUNDS is not supported
-
-#
-# Only works if ENCRYPT_METHOD is set to BCRYPT.
-#
-# Define the number of BCRYPT rounds.
-# With a lot of rounds, it is more difficult to brute-force the password.
-# However, more CPU resources will be needed to authenticate users if
-# this value is increased.
-#
-# If not specified, 13 rounds will be attempted.
-# If only one of the MIN or MAX values is set, then this value will be used.
-# If MIN > MAX, the highest value will be used.
-#
-#BCRYPT_MIN_ROUNDS 13
-#BCRYPT_MAX_ROUNDS 31
-
-#
-# Only works if ENCRYPT_METHOD is set to YESCRYPT.
-#
-# Define the YESCRYPT cost factor.
-# With a higher cost factor, it is more difficult to brute-force the password.
-# However, more CPU time and more memory will be needed to authenticate users
-# if this value is increased.
-#
-# If not specified, a cost factor of 5 will be used.
-# The value must be within the 1-11 range.
-#
-#YESCRYPT_COST_FACTOR 5
-
-# Currently CONSOLE_GROUPS is not supported
-
-#
-# Should login be allowed if we can't cd to the home directory?
-# Default is yes.
-#
-#DEFAULT_HOME	yes
-
-# Currently ENVIRON_FILE is not supported
-
-#
-# If defined, this command is run when removing a user.
-# It should remove any at/cron/print jobs etc. owned by
-# the user to be removed (passed as the first argument).
-#
-#USERDEL_CMD	/usr/sbin/userdel_local
-
-#
-# Enables userdel(8) to remove user groups if no members exist.
-#
-USERGROUPS_ENAB yes
-
-#
-# If set to a non-zero number, the shadow utilities will make sure that
-# groups never have more than this number of users on one line.
-# This permits to support split groups (groups split into multiple lines,
-# with the same group ID, to avoid limitation of the line length in the
-# group file).
-#
-# 0 is the default value and disables this feature.
-#
-#MAX_MEMBERS_PER_GROUP	0
-
-#
-# If useradd(8) should create home directories for users by default (non
-# system users only).
-# This option is overridden with the -M or -m flags on the useradd(8)
-# command-line.
-#
-CREATE_HOME	yes
-
-#
-# Force use shadow, even if shadow passwd & shadow group files are
-# missing.
-#
-#FORCE_SHADOW    yes
-
-#
-# Select the HMAC cryptography algorithm.
-# Used in pam_timestamp module to calculate the keyed-hash message
-# authentication code.
-#
-# Note: It is recommended to check hmac(3) to see the possible algorithms
-# that are available in your system.
-#
-HMAC_CRYPTO_ALGO SHA512

shadow-utils.useradd

@@ -1,9 +0,0 @@
-# useradd defaults file
-GROUP=100
-HOME=/home
-INACTIVE=-1
-EXPIRE=
-SHELL=/bin/bash
-SKEL=/etc/skel
-CREATE_MAIL_SPOOL=yes
-

sources

@@ -1,2 +1,3 @@
-SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406
-SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac
+e91727c55dbafc9915250e31535f13bb  shadow-4.0.17-login.defs
+ebdf46b79f9b414353c9ae8aba4d55cc  shadow-4.0.18.1-useradd
+b1aa30abb3cce16a37b53e45e1ec70a4  shadow-4.1.1.tar.bz2

tests/mhc-fedora-ci.yaml

@@ -1,13 +0,0 @@
-provisioned_topologies:
-- shadow
-domains:
-- id: shadow
-  hosts:
-  - hostname: localhost
-    role: shadow
-    conn:
-      type: ssh
-      host: localhost
-      user: root
-    artifacts:
-    - /var/log/*