diff -pruN 1:4.13+dfsg1-1/debian/changelog 1:4.13+dfsg1-1ubuntu1/debian/changelog --- 1:4.13+dfsg1-1/debian/changelog 2022-11-11 08:28:15.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/changelog 2022-11-23 10:55:02.000000000 +0000 @@ -1,3 +1,33 @@ +shadow (1:4.13+dfsg1-1ubuntu1) lunar; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - d/login.defs: Enable private home directories by default + - debian/login.defs: Update documentation of USERGROUPS_ENAB/UMASK + + USERGROUPS_ENAB: with pam_umask, the UPG handling does not only apply + to "former (pre-PAM) uses". + + UMASK: Explain that USERGROUPS_ENAB will modify this default for UPGs. + - debian/{source_shadow.py,login.install}: Add apport hook + - debian/patches/1010_extrausers.patch: + + Add support to passwd for libnss-extrausers + + Add automatic detection of "extrausers" for usermod -G + - d/p/1011_extrausers_toggle.patch: extrausers support for useradd/groupadd + - d/p/1012_extrausers_chfn.patch: --extrausers support for chfn tool + - d/p/1013_extrausers_deluser.patch: --extrausers support for userdel + - d/p/1014_extrausers_delgroup.patch: --extrausers support for groupdel + - d/p/1015_add_zsys_support.patch: zsys to handle home dir if available + - d/p/1016_extrausers_gpasswd.patch: extrausers support for gpasswd + - d/p/506_relaxed_usernames.patch, d/t/{control,numeric-username}: + + disallow purely numeric usernames + - d/t/smoke: Extend for extrausers support + * Dropped changes (not needed anymore): + - d/passwd.maintscript: cleanup /etc/init/passwd.conf 1:4.2-3.2ubuntu4~ + * Refresh patches: + - d/p/1010_extrausers.patch + - d/p/1011_extrausers_toggle.patch + - d/p/1015_add_zsys_support.patch + + -- Lukas Märdian Wed, 23 Nov 2022 11:55:02 +0100 + shadow (1:4.13+dfsg1-1) unstable; urgency=medium [ Balint Reczey ] @@ -52,6 +82,41 @@ shadow (1:4.12.3+dfsg1-1) unstable; urge -- Balint Reczey Tue, 04 Oct 2022 22:09:04 +0200 +shadow (1:4.11.1+dfsg1-2ubuntu1) kinetic; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB + will modify this default for UPGs. + + Enable private home directories by default + - debian/{source_shadow.py,login.install}: Add apport hook + - debian/patches/1010_extrausers.patch: + + Add support to passwd for libnss-extrausers + + Add automatic detection of "extrausers" for usermod -G + - debian/patches/1011_extrausers_toggle.patch: + + extrausers support for useradd and groupadd + - debian/patches/1012_extrausers_chfn.patch: + + add support for --extrausers to the chfn tool + - debian/patches/1013_extrausers_deluser.patch: + + add --extrausers option to "userdel" + - debian/patches/1014_extrausers_delgroup.patch: + + add --extrausers option to "groupdel" + - debian/patches/1015_add_zsys_support.patch: + + Call zsys to handle home directory if available. + - debian/patches/1016_extrausers_gpasswd.patch: + + Add support for extrausers in gpasswd. + - d/p/506_relaxed_usernames.patch, d/t/{control,numeric-username} + + disallow purely numeric usernames + - debian/tests/smoke: + + Extend for extrausers support + * Dropped changes, applied in Debian: + - Basic test in d/t/control and d/t/smoke + - Documentation about HOME_MODE in login.defs + + -- Lukas Märdian Mon, 23 May 2022 14:23:01 +0200 + shadow (1:4.11.1+dfsg1-2) unstable; urgency=medium [ Balint Reczey ] @@ -112,6 +177,46 @@ shadow (1:4.11.1+dfsg1-0exp1) experiment -- Balint Reczey Sat, 22 Jan 2022 21:03:44 +0100 +shadow (1:4.8.1-2ubuntu2) jammy; urgency=medium + + [ Michael Vogt ] + * debian/patches/1010_extrausers.patch: + Add automatic detection of "extrausers" for usermod -G + (LP: #1959375) + + -- Alberto Mardegan Mon, 14 Mar 2022 11:59:13 +0300 + +shadow (1:4.8.1-2ubuntu1) jammy; urgency=low + + * Merge from Debian unstable (LP: #1951161). Remaining changes: + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB + will modify this default for UPGs. + + Enable private home directories by default + - debian/{source_shadow.py,login.install}: Add apport hook + - debian/patches/1010_extrausers.patch: Add support to passwd for + libnss-extrausers + - debian/patches/1011_extrausers_toggle.patch: extrausers support for + useradd and groupadd + - debian/patches/1014_extrausers_delgroup.patch + + add --extrausers option to "groupdel" + - debian/patches/1013_extrausers_deluser.patch + + add --extrausers option to "userdel" + - debian/patches/1012_extrausers_chfn.patch + + add support for --extrausers to the chfn tool + - debian/patches/1015_add_zsys_support.patch + + Call zsys to handle home directory if available. + - debian/patches/1016_extrausers_gpasswd.patch + + Add support for extrausers in gpasswd. + - debian/patches/506_relaxed_usernames.patch + + disallow purely numeric usernames + * Dropped changes, included in Debian: + - debian/passwd.maintscripts: Clean up upstart configuration + + -- William 'jawn-smith' Wilson Mon, 15 Nov 2021 16:13:44 -0600 + shadow (1:4.8.1-2) unstable; urgency=medium * debian/control: Switch to libsemanage-dev from libsemanage1-dev @@ -145,6 +250,97 @@ shadow (1:4.8.1-1.1) unstable; urgency=m -- Johannes Schauer Marin Rodrigues Sat, 23 Oct 2021 21:04:57 +0200 +shadow (1:4.8.1-1ubuntu9) impish; urgency=medium + + * Disallow purely numeric usernames. This includes hexadecimal and + octal syntax. (LP: #1927078) + + -- William 'jawn-smith' Wilson Thu, 17 Jun 2021 14:35:15 -0500 + +shadow (1:4.8.1-1ubuntu8) hirsute; urgency=medium + + * Enable private home directories by default (LP: #48734) + - Set HOME_MODE=750 in login.defs to enable private home directories + + -- Alex Murray Thu, 07 Jan 2021 15:35:37 +1030 + +shadow (1:4.8.1-1ubuntu7) hirsute; urgency=medium + + [ Marcus Tomlinson ] + * debian/patches/1016_extrausers_gpasswd.patch: + - Add support for extrausers in gpasswd. + + -- Dimitri John Ledkov Wed, 02 Dec 2020 10:44:11 +0000 + +shadow (1:4.8.1-1ubuntu6) groovy; urgency=medium + + * debian/patches/1015_add_zsys_support.patch: + - Add support for ZSys user deletion (LP: #1881540) + - Fix a build warning + + -- Didier Roche Thu, 28 May 2020 08:37:47 +0200 + +shadow (1:4.8.1-1ubuntu5) focal; urgency=medium + + * debian/patches/1015_add_zsys_support.patch: + Fix regression on zfs system when the user dataset wasn’t created + (LP: #1873263) + - wrong variable was used when merged with debian + - reset the correct order to ensure owner and mod are correct. + + -- Didier Roche Thu, 16 Apr 2020 14:36:45 +0200 + +shadow (1:4.8.1-1ubuntu4) focal; urgency=medium + + * debian/patches/1015_add_zsys_support.patch: + - use now zsysctl command instead of zsys which isn't available anymore. + This fix creation of new user dataset on ZFS. + + -- Didier Roche Mon, 06 Apr 2020 09:51:10 +0200 + +shadow (1:4.8.1-1ubuntu3) focal; urgency=medium + + * debian/patches/1013_extrausers_deluser.patch: + - move "if (use_extrausers)" check before the test if the user + actually exists in the local database + * debian/tests: + - add smoke autopkgtest tests around {user,group}{add,del} with + and without extrausers to avoid regressions like the one fixed + in 4.8.1-1ubuntu2 + + -- Michael Vogt Mon, 09 Mar 2020 10:43:16 +0100 + +shadow (1:4.8.1-1ubuntu2) focal; urgency=medium + + * No-change rebuild to pick up dependency on libcrypt1. + + -- Matthias Klose Sat, 07 Mar 2020 10:16:01 +0100 + +shadow (1:4.8.1-1ubuntu1) focal; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB + will modify this default for UPGs. + - debian/{source_shadow.py,login.install}: Add apport hook + - debian/patches/1010_extrausers.patch: Add support to passwd for + libnss-extrausers + - debian/patches/1011_extrausers_toggle.patch: extrausers support for + useradd and groupadd + - debian/patches/1014_extrausers_delgroup.patch + + add --extrausers option to "groupdel" + - debian/patches/1013_extrausers_deluser.patch + + add --extrausers option to "userdel" + - debian/patches/1012_extrausers_chfn.patch: + + add support for --extrausers to the chfn tool + - debian/patches/1015_add_zsys_support.patch: + + Call zsys to handle home directory if available. + - debian/passwd.maintscripts: Clean up upstart configuration + + -- Balint Reczey Fri, 07 Feb 2020 16:32:06 +0100 + shadow (1:4.8.1-1) unstable; urgency=medium * debian/default/useradd: Fix typo DHSELL -> DSHELL (Closes: #897028) @@ -154,6 +350,31 @@ shadow (1:4.8.1-1) unstable; urgency=med -- Balint Reczey Fri, 07 Feb 2020 15:54:14 +0100 +shadow (1:4.8-1ubuntu1) focal; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB + will modify this default for UPGs. + - debian/{source_shadow.py,login.install}: Add apport hook + - debian/patches/1010_extrausers.patch: Add support to passwd for + libnss-extrausers + - debian/patches/1011_extrausers_toggle.patch: extrausers support for + useradd and groupadd + - debian/patches/1014_extrausers_delgroup.patch + + add --extrausers option to "groupdel" + - debian/patches/1013_extrausers_deluser.patch + + add --extrausers option to "userdel" + - debian/patches/1012_extrausers_chfn.patch: + + add support for --extrausers to the chfn tool + - debian/patches/1015_add_zsys_support.patch: + + Call zsys to handle home directory if available. + - debian/passwd.maintscripts: Clean up upstart configuration + + -- Balint Reczey Mon, 20 Jan 2020 15:16:35 +0100 + shadow (1:4.8-1) unstable; urgency=medium [ Laurent Bigonville ] @@ -225,6 +446,53 @@ shadow (1:4.7-1) unstable; urgency=mediu -- Balint Reczey Mon, 08 Jul 2019 15:58:46 +0200 +shadow (1:4.5-1.1ubuntu4) eoan; urgency=medium + + * debian/patches/1015_add_zsys_support.patch: + - Call zsys to handle home directory if available. + We call zsys to handle dataset creation for zsys system in a separate + home dataset for each user on the system. + This allows one to handle user dataset outside of /home and also renaming. + We don't support yet deletion, as removing the dataset would remove as + well every snapshot of the history, and so, revert to previous version + will result in user created, but no home directory, which is unwanted. + (LP: #1842902) + + -- Didier Roche Thu, 29 Aug 2019 15:00:07 +0200 + +shadow (1:4.5-1.1ubuntu3) eoan; urgency=medium + + * debian/patches/1014_extrausers_delgroup.patch + - add --extrausers option to "groupdel" (LP: #1840375) + + -- Michael Vogt Wed, 21 Aug 2019 11:40:17 +0200 + +shadow (1:4.5-1.1ubuntu2) disco; urgency=medium + + * debian/patches/1013_extrausers_deluser.patch + - add --extrausers option to "userdel" (LP: #1659534) + + -- Michael Vogt Fri, 22 Mar 2019 19:32:50 +0100 + +shadow (1:4.5-1.1ubuntu1) disco; urgency=low + + * Merge from Debian unstable. Remaining changes: + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB + will modify this default for UPGs. + - debian/{source_shadow.py,rules}: Add apport hook + - debian/patches/1010_extrausers.patch: Add support to passwd for + libnss-extrausers + - debian/patches/1011_extrausers_toggle.patch: extrausers support for + useradd and groupadd + - debian/patches/1012_extrausers_chfn.patch: add support for + --extrausers to the chfn tool + - debian/passwd.maintscripts: Clean up upstart configuration + + -- Steve Langasek Thu, 24 Jan 2019 15:46:48 -0800 + shadow (1:4.5-1.1) unstable; urgency=medium * Non-maintainer upload (greetings from DebCamp/DebConf Taiwan). @@ -238,6 +506,42 @@ shadow (1:4.5-1.1) unstable; urgency=med -- Andreas Henriksson Fri, 27 Jul 2018 10:07:37 +0200 +shadow (1:4.5-1ubuntu1) bionic; urgency=medium + + * Merge with Debian; remaining changes: + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB + will modify this default for UPGs. + - debian/{source_shadow.py,rules}: Add apport hook + - debian/patches/1010_extrausers.patch: Add support to passwd for + libnss-extrausers + - debian/patches/1011_extrausers_toggle.patch: extrausers support for + useradd and groupadd + - debian/patches/1012_extrausers_chfn.patch: add support for + --extrausers to the chfn tool + - debian/passwd.maintscripts: Clean up upstart configuration + * Dropped changes, included in Debian: + - Pass noupdate to pam_motd call for /run/motd.dynamic, to avoid running + /etc/update-motd.d/* scripts twice. + * Dropped changes, included upstream: + - debian/patches/userns/subuids-nonlocal-users: Don't limit + subuid/subgid support to local users. + - debian/patches/1021_no_subuids_for_system_users.patch + - debian/patches/CVE-2017-2616.patch: Check process's exit status before + sending signal + - debian/patches/CVE-2017-2616-regression.patch: Do not reset the + pid_child to 0 if the child process is still running. + - CVE-2017-2616 + - debian/patches/CVE-2016-6252.patch: parse directly into unsigned long + - CVE-2016-6252 + * Dropped obsoleted changes: + - debian/rules: setting DEB_*_INSTALLINIT_ARGS became obsolete after + switching to passwd.tmpfile from passwd.service + + -- Balint Reczey Thu, 25 Jan 2018 16:09:22 +0100 + shadow (1:4.5-1) unstable; urgency=medium * New upstream version 4.5 @@ -373,6 +677,86 @@ shadow (1:4.2-3.3) unstable; urgency=med -- Samuel Thibault Tue, 22 Nov 2016 18:31:28 +0000 +shadow (1:4.2-3.2ubuntu4) artful; urgency=medium + + * Drop upstart system jobs. + + -- Dimitri John Ledkov Mon, 21 Aug 2017 00:56:14 +0100 + +shadow (1:4.2-3.2ubuntu2) artful; urgency=medium + + * SECURITY UPDATE: su could be used to kill arbitrary processes. + - debian/patches/CVE-2017-2616.patch: Check process's exit status before + sending signal + - debian/patches/CVE-2017-2616-regression.patch: Do not reset the + pid_child to 0 if the child process is still running. + - CVE-2017-2616 + * SECURITY UPDATE: getulong() function could accidentally parse negative + numbers as large positive numbers. + - debian/patches/CVE-2016-6252.patch: parse directly into unsigned long + - CVE-2016-6252 + + -- Seth Arnold Thu, 18 May 2017 14:39:32 -0400 + +shadow (1:4.2-3.2ubuntu1) yakkety; urgency=medium + + * Merge with Debian; remaining changes: + - debian/passwd.upstart: Add an upstart job to clear locks on + [shadow-]passwd/group. + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB + will modify this default for UPGs. + - debian/{source_shadow.py,rules}: Add apport hook + - Pass noupdate to pam_motd call for /run/motd.dynamic, to avoid running + /etc/update-motd.d/* scripts twice. + - debian/patches/1010_extrausers.patch: Add support to passwd for + libnss-extrausers + - debian/patches/1011_extrausers_toggle.patch: extrausers support for + useradd and groupadd + - debian/patches/userns/subuids-nonlocal-users: Don't limit + subuid/subgid support to local users. + * Dropped changes, included in Debian: + - Allow LXC devices (lxc/console, lxc/tty[1234]), used from precise on. + - Add uidmap package based on upstream patches that introduce + newuidmap/newgidmap as well as /etc/subuid and /etc/subgid. Additional + updates on those to widen the default allocation to 65536 uids and gids + and only assign ranges to non-system users. + - debian/patches/1020_fix_user_busy_errors: Call sub_uid_close in all + error cases. + * Dropped changes, included upstream: + - debian/patches/495_stdout-encrypted-password: chpasswd can report + password hashes on stdout. + - debian/patches/496_su_kill_process_group: Kill the child process group, + rather than just the immediate child. + * Fix pam_motd calls so that the second pam_motd is the noupdate one rather + than the first, ensuring /run/motd.dynamic is always populated and shown + on the first login after boot. LP: #1368864. + * Don't call 'pam_exec uname', a change adopted in Debian without + coordination with the Debian PAM maintainer + * Use dh_installinit now for installing the upstart job, as we no longer + generate a dependency on upstart-job. + * Include /etc/sub[ug]id in the list of files to clear locks for on boot. + LP: #1304505 + * Add a systemd unit to go with the upstart job, so that lock clearing works + on newer Ubuntu releases. + * add support for "chfn --extrausers" (LP: #1495580) + * debian/patches/1010_extrausers.patch: + - Fix usermod to handle a readonly /etc gracefully (LP: #1562872) + * debian/patches/1010_extrausers.patch: + - Fix usermod to look in extrausers location for basic changes to a + user's passwd info. Fixes changing user's real name in Touch via + AccountsService. (Does not address updating groups yet, since that's + less useful now, as we can't update any system groups.) + * d/p/1021_no_subuids_for_system_users.patch: fix the not creating subuids + for system users. (LP: #1545884) + * Replace debian/passwd.service with debian/passwd.tmpfile, systemd tmpfile + handling has support for removing files for us on boot. Thanks to + Martin Pitt for the hint. + + -- Matthias Klose Tue, 20 Sep 2016 09:43:54 +0200 + shadow (1:4.2-3.2) unstable; urgency=medium * Non-maintainer upload. @@ -382,6 +766,93 @@ shadow (1:4.2-3.2) unstable; urgency=med -- Mattia Rizzolo Sun, 18 Sep 2016 14:42:16 +0000 +shadow (1:4.2-3.1ubuntu6) yakkety; urgency=medium + + * add support for "chfn --extrausers" (LP: #1495580) + + -- Michael Vogt Thu, 23 Jun 2016 08:02:00 +0200 + +shadow (1:4.2-3.1ubuntu5) xenial; urgency=medium + + * debian/patches/1010_extrausers.patch: + - Fix usermod to handle a readonly /etc gracefully (LP: #1562872) + + -- Michael Terry Mon, 28 Mar 2016 09:44:23 -0400 + +shadow (1:4.2-3.1ubuntu4) xenial; urgency=medium + + * debian/patches/1010_extrausers.patch: + - Fix usermod to look in extrausers location for basic changes to a + user's passwd info. Fixes changing user's real name in Touch via + AccountsService. (Does not address updating groups yet, since that's + less useful now, as we can't update any system groups.) + + -- Michael Terry Wed, 02 Mar 2016 15:01:19 -0500 + +shadow (1:4.2-3.1ubuntu3) xenial; urgency=medium + + * d/p/1021_no_subuids_for_system_users.patch: fix the not creating subuids + for system users. (LP: #1545884) + + -- Serge Hallyn Wed, 17 Feb 2016 20:57:59 -0800 + +shadow (1:4.2-3.1ubuntu2) xenial; urgency=medium + + * Replace debian/passwd.service with debian/passwd.tmpfile, systemd tmpfile + handling has support for removing files for us on boot. Thanks to + Martin Pitt for the hint. + + -- Steve Langasek Thu, 04 Feb 2016 14:01:27 -0800 + +shadow (1:4.2-3.1ubuntu1) xenial; urgency=low + + * Merge from Debian unstable. + - Includes pam_loginuid in login PAM config. LP: #1067779. + - Fixes typo in usermod -h output. LP: #1348873. + * Remaining changes: + - debian/passwd.upstart: Add an upstart job to clear locks on + [shadow-]passwd/group. + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB + will modify this default for UPGs. + - debian/{source_shadow.py,rules}: Add apport hook + - Pass noupdate to pam_motd call for /run/motd.dynamic, to avoid running + /etc/update-motd.d/* scripts twice. + - debian/patches/1010_extrausers.patch: Add support to passwd for + libnss-extrausers + - debian/patches/1011_extrausers_toggle.patch: extrausers support for + useradd and groupadd + - debian/patches/userns/subuids-nonlocal-users: Don't limit + subuid/subgid support to local users. + * Dropped changes, included in Debian: + - Allow LXC devices (lxc/console, lxc/tty[1234]), used from precise on. + - Add uidmap package based on upstream patches that introduce + newuidmap/newgidmap as well as /etc/subuid and /etc/subgid. Additional + updates on those to widen the default allocation to 65536 uids and gids + and only assign ranges to non-system users. + - debian/patches/1020_fix_user_busy_errors: Call sub_uid_close in all + error cases. + * Dropped changes, included upstream: + - debian/patches/495_stdout-encrypted-password: chpasswd can report + password hashes on stdout. + - debian/patches/496_su_kill_process_group: Kill the child process group, + rather than just the immediate child. + * Fix pam_motd calls so that the second pam_motd is the noupdate one rather + than the first, ensuring /run/motd.dynamic is always populated and shown + on the first login after boot. LP: #1368864. + * Don't call 'pam_exec uname', a change adopted in Debian without + coordination with the Debian PAM maintainer + * Use dh_installinit now for installing the upstart job, as we no longer + generate a dependency on upstart-job. + * Include /etc/sub[ug]id in the list of files to clear locks for on boot. + LP: #1304505 + * Add a systemd unit to go with the upstart job, so that lock clearing works + on newer Ubuntu releases. + + -- Steve Langasek Thu, 28 Jan 2016 22:21:41 -0800 + shadow (1:4.2-3.1) unstable; urgency=medium * Non-maintainer upload. @@ -492,6 +963,79 @@ shadow (1:4.2-1) experimental; urgency=l -- Christian Perrier Tue, 22 Apr 2014 09:01:42 +0200 +shadow (1:4.1.5.1-1.1ubuntu7) wily; urgency=medium + + * debian/patches/userns/subuids-nonlocal-users: Don't limit + subuid/subgid support to local users. Closes LP: #1475749. + + -- Steve Langasek Mon, 20 Jul 2015 18:44:12 -0700 + +shadow (1:4.1.5.1-1.1ubuntu6) wily; urgency=medium + + * extrausers support for useradd and groupadd (LP: #1323732) + + -- Sergio Schvezov Thu, 25 Jun 2015 15:26:55 -0300 + +shadow (1:4.1.5.1-1.1ubuntu5) wily; urgency=medium + + * debian/rules: Re-enable audit support. (LP: #1414817) + * debian/control: add libaudit-dev to Build-Depends. + + -- Mathieu Trudel-Lapierre Tue, 02 Jun 2015 10:46:18 -0400 + +shadow (1:4.1.5.1-1.1ubuntu4) vivid; urgency=medium + + * debian/patches/1020_fix_user_busy_errors: + - libmisc/user_busy.c: Call sub_uid_close in all error cases, otherwise + code that later opens it as RW fails obscurely. (LP: #1436937) + + -- William Grant Mon, 20 Apr 2015 18:41:47 +0100 + +shadow (1:4.1.5.1-1.1ubuntu3) vivid; urgency=medium + + * No change rebuild to get debug symbols for all architectures. + + -- Brian Murray Tue, 02 Dec 2014 11:39:38 -0800 + +shadow (1:4.1.5.1-1.1ubuntu2) utopic; urgency=medium + + * debian/patches/1010_extrausers.patch: + - Add support to passwd for libnss-extrausers by falling back to the + /var/lib/extrausers/ locations if it exists when updating + passwd or shadow. + + -- Michael Terry Fri, 18 Jul 2014 10:00:44 -0400 + +shadow (1:4.1.5.1-1.1ubuntu1) utopic; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - debian/passwd.upstart: Add an upstrat job to clear locks on + [shadow-]passwd/group. (LP: #523896). + - Allow LXC devices (lxc/console, lxc/tty[1234]) that we'll start using + in LXC with Precise. + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB + will modify this default for UPGs. (Closes: #583971) + - debian/{source_shadow.py,rules}: Add apport hook + - debian/patches/495_stdout-encrypted-password: chpasswd can report + password hashes on stdout (Debian bug 505640). + - Install upstart job by-hand, instead of using dh_installinit to avoid + dependency on upstart-job. + - Pass noupdate to pam_motd call for /run/motd.dynamic, to avoid running + /etc/update-motd.d/* scripts twice (LP: #1169558). + - debian/patches/496_su_kill_process_group: Kill the child process group, + rather than just the immediate child; this is needed now that su no + longer starts a controlling terminal when not running an interactive + shell (closes: #713979). + - Add uidmap package based on upstream patches that introduce + newuidmap/newgidmap as well as /etc/subuid and /etc/subgid. Additional + updates on those to widen the default allocation to 65536 uids and gids + and only assign ranges to non-system users. + + -- Stéphane Graber Fri, 02 May 2014 15:17:15 -0400 + shadow (1:4.1.5.1-1.1) unstable; urgency=medium * Non-maintainer upload. @@ -505,6 +1049,103 @@ shadow (1:4.1.5.1-1.1) unstable; urgency -- Samuel Thibault Sun, 16 Mar 2014 20:58:24 +0100 +shadow (1:4.1.5.1-1ubuntu9) trusty; urgency=medium + + * Set our subuid and subgid range to 65536 uids by default. + * Patch newusers to not add subuids and subgids to system users. + * Patch useradd to not add subuids and subgids to system users and to + regular users who don't fit between uid_min and uid_max. + (This is needed due to adduser not passing --system...) + + -- Stéphane Graber Sun, 16 Feb 2014 19:33:48 -0500 + +shadow (1:4.1.5.1-1ubuntu8) trusty; urgency=medium + + * Fix postinst to create subuid and subgid when missing as those won't + get created by usermod or any of the other tools. + + -- Stéphane Graber Fri, 17 Jan 2014 16:15:13 -0500 + +shadow (1:4.1.5.1-1ubuntu7) trusty; urgency=medium + + * Don't ship subuid/subgid as conffiles as that'll just cause problems + on upgrades. Instead simply touch them if they're not already present. + + -- Stéphane Graber Sun, 12 Jan 2014 12:59:46 -0500 + +shadow (1:4.1.5.1-1ubuntu6) saucy; urgency=low + + * debian/patches/496_su_kill_process_group: Kill the child process group, + rather than just the immediate child; this is needed now that su no + longer starts a controlling terminal when not running an interactive + shell (closes: #713979). + + -- Colin Watson Fri, 26 Jul 2013 16:55:52 +0100 + +shadow (1:4.1.5.1-1ubuntu5) saucy; urgency=low + + [ Serge Hallyn ] + * debian/patches/userns: patches from Eric Biederman to enable use of + subuids, plus some bugfix patches on top of them. (LP: #1192864) + * passwd.install: add new manpages + * debian/control, debian/uidmap.install: create new uidmap package + containing the new setuid-root binaries newuidmap and newgidmap + * debian/subuid, debian/rules: install a default /etc/subuid and /etc/subgid + * debian/patches/userns/16_add-argument-sanity-checking.patch: address + three sanity checking concerns brought up by sarnold at + http://lists.alioth.debian.org/pipermail/pkg-shadow-devel/2013-June/ \ + 009752.html. + + -- Dmitrijs Ledkovs Fri, 28 Jun 2013 11:31:51 +0100 + +shadow (1:4.1.5.1-1ubuntu4) raring; urgency=low + + * Pass noupdate to pam_motd call for /run/motd.dynamic, to avoid running + /etc/update-motd.d/* scripts twice (LP: #1169558). + + -- Colin Watson Thu, 18 Apr 2013 01:01:45 +0100 + +shadow (1:4.1.5.1-1ubuntu3) raring; urgency=low + + * Install upstart job by-hand, instead of using dh_installinit to avoid + dependency on upstart-job. + + -- Dmitrijs Ledkovs Mon, 18 Mar 2013 03:23:31 +0000 + +shadow (1:4.1.5.1-1ubuntu2) raring; urgency=low + + * Revert build-dependency from gettext:any to gettext, now that gettext is + Multi-Arch: foreign. + + -- Colin Watson Thu, 29 Nov 2012 15:27:11 +0000 + +shadow (1:4.1.5.1-1ubuntu1) raring; urgency=low + + * The "Yorkshire Blue" release. + * Merge from Debian unstable. Remaining changes: + - debian/passwd.upstart: Add an upstrat job to clear locks on + [shadow-]passwd/group. (LP: #523896). + - Build-depend on gettext:any for cross-building support. + - Allow LXC devices (lxc/console, lxc/tty[1234]) that we'll start using + in LXC with Precise. + - debian/login.defs: + + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + + Update documentation of UMASK: Explain that USERGROUPS_ENAB will modify + this default for UPGs. (Closes: #583971) + - debian/{source_shadow.py,rules}: Add apport hook + - debian/patches/495_stdout-encrypted-password: chpasswd can report + password hashes on stdout (Debian bug 505640). + + * Dropped changes, merged in Debian: + - Fix case of ttyAMA0-3 devices and move them near the ttyAM0-15 ones; + Debian #544184; fixes console on Vexpress boards (e.g. in QEMU). + - use SHA512 by default for password crypt routine. + - debian/rules: fix FTBFS from newer libtools + - Mark passwd Multi-Arch: foreign. + + -- Dmitrijs Ledkovs Tue, 23 Oct 2012 09:59:19 +0100 + shadow (1:4.1.5.1-1) unstable; urgency=low * The "Gruyère" release. @@ -648,6 +1289,68 @@ shadow (1:4.1.5-1) unstable; urgency=low -- Nicolas FRANCOIS (Nekral) Sun, 12 Feb 2012 22:27:03 +0100 +shadow (1:4.1.4.2+svn3283-3ubuntu7) quantal; urgency=low + + * debian/passwd.upstart: Add an upstrat job to clear locks on + [shadow-]passwd/group. (LP: #523896). + + -- Dmitrijs Ledkovs Fri, 31 Aug 2012 13:00:33 +0100 + +shadow (1:4.1.4.2+svn3283-3ubuntu6) quantal; urgency=low + + * debian/source_shadow.py: Fix compatibility with python3. Thanks Edward + Donovan! (LP: #1013171) + + -- Martin Pitt Mon, 18 Jun 2012 15:09:54 +0200 + +shadow (1:4.1.4.2+svn3283-3ubuntu5) precise; urgency=low + + * Build-depend on gettext:any for cross-building support. + + -- Colin Watson Mon, 09 Apr 2012 00:28:03 +0100 + +shadow (1:4.1.4.2+svn3283-3ubuntu4) precise; urgency=low + + * Allow LXC devices (lxc/console, lxc/tty[1234]) that we'll start using + in LXC with Precise. + + -- Stéphane Graber Fri, 10 Feb 2012 15:34:05 -0500 + +shadow (1:4.1.4.2+svn3283-3ubuntu3) precise; urgency=low + + * Fix case of ttyAMA0-3 devices and move them near the ttyAM0-15 ones; + Debian #544184; fixes console on Vexpress boards (e.g. in QEMU). + + -- Loïc Minier Wed, 30 Nov 2011 22:47:47 +0100 + +shadow (1:4.1.4.2+svn3283-3ubuntu2) oneiric; urgency=low + + * debian/login.defs: + - Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG + handling does not only apply to "former (pre-PAM) uses". + - Update documentation of UMASK: Explain that USERGROUPS_ENAB will modify + this default for UPGs. (Closes: #583971) + + -- Martin Pitt Fri, 24 Jun 2011 11:07:34 +0200 + +shadow (1:4.1.4.2+svn3283-3ubuntu1) natty; urgency=low + + * The "string cheese" release. + * Merge from Debian unstable. Remaining changes: + - Ubuntu specific: + + debian/login.defs: use SHA512 by default for password crypt routine. + - debian/{source_shadow.py,rules}: Add apport hook + - debian/rules: fix FTBFS from newer libtools + - debian/patches/495_stdout-encrypted-password: chpasswd can report + password hashes on stdout (Debian bug 505640). + * Dropped changes, merged in Debian: + - debian/patches/300_CVE-2011-0721: reject newlines in GECOS updates. + - CVE-2011-0721 + * Mark passwd Multi-Arch: foreign, so packages that aren't of the same + arch can depend on it. + + -- Steve Langasek Sun, 20 Feb 2011 15:59:15 -0800 + shadow (1:4.1.4.2+svn3283-3) unstable; urgency=high * The "Trappe d'Echourgnac" release. @@ -658,6 +1361,34 @@ shadow (1:4.1.4.2+svn3283-3) unstable; u -- Nicolas FRANCOIS (Nekral) Sun, 13 Feb 2011 23:20:05 +0100 +shadow (1:4.1.4.2+svn3283-2ubuntu3) natty; urgency=low + + * SECURITY UPDATE: could inject NIS groups memberships into /etc/passwd. + - debian/patches/300_CVE-2011-0721: reject newlines in GECOS updates. + - CVE-2011-0721 + + -- Kees Cook Tue, 15 Feb 2011 13:57:01 -0800 + +shadow (1:4.1.4.2+svn3283-2ubuntu2) natty; urgency=low + + * debian/patches/495_stdout-encrypted-password: adjust patch for changes + in src/chpasswd.c to fix FTBFS + + -- Oliver Grawert Tue, 04 Jan 2011 15:48:49 +0100 + +shadow (1:4.1.4.2+svn3283-2ubuntu1) natty; urgency=low + + * Merge from debian unstable. Remaining changes: + - Ubuntu specific: + + debian/login.defs: use SHA512 by default for password crypt routine. + - debian/{source_shadow.py,rules}: Add apport hook + - debian/rules: fix FTBFS from newer libtools + - debian/patches/495_stdout-encrypted-password: chpasswd can report + password hashes on stdout (Debian bug 505640). + - Rework 495_stdout-encrypted-password to cope with chpasswd using PAM. + + -- Oliver Grawert Wed, 24 Nov 2010 13:42:42 +0100 + shadow (1:4.1.4.2+svn3283-2) unstable; urgency=low * The "Bleu du Vercors-Sassenage" release. @@ -729,6 +1460,32 @@ shadow (1:4.1.4.2+svn3283-1) unstable; u -- Nicolas FRANCOIS (Nekral) Sun, 29 Aug 2010 21:14:12 +0200 +shadow (1:4.1.4.2-1ubuntu3) maverick; urgency=low + + * add ttyO0-3 to debian/securetty.linux, if OMAP kernels are built with + TI's DMA-offloaded driver instead of the default 8250 one the serial tty's + are called like that (LP: #512845). + + -- Oliver Grawert Tue, 31 Aug 2010 14:45:17 +0200 + +shadow (1:4.1.4.2-1ubuntu2) lucid; urgency=low + + * debian/{source_shadow.py,rules}: Add apport hook + * debian/rules: fix FTBFS from newer libtools + + -- Marc Deslauriers Tue, 26 Jan 2010 08:54:59 -0500 + +shadow (1:4.1.4.2-1ubuntu1) lucid; urgency=low + + * Merged with debian unstable. Remaning changes (LP: #477299): + - Ubuntu specific: + + debian/login.defs: use SHA512 by default for password crypt routine. + - debian/patches/495_stdout-encrypted-password: chpasswd can report + password hashes on stdout (Debian bug 505640). + - Rework 495_stdout-encrypted-password to cope with chpasswd using PAM. + + -- Nicolas Valcárcel Scerpella (Canonical) Sat, 07 Nov 2009 04:55:18 -0500 + shadow (1:4.1.4.2-1) unstable; urgency=low * The "Tome des Bauges" release. @@ -756,6 +1513,25 @@ shadow (1:4.1.4.2-1) unstable; urgency=l -- Nicolas FRANCOIS (Nekral) Fri, 24 Jul 2009 05:03:23 +0200 +shadow (1:4.1.4.1-1ubuntu2) karmic; urgency=low + + * debian/securetty.linux: also list ttyS2 and ttyS3; beagleboard uses ttyS2 + as serial port. + + -- Loïc Minier Fri, 31 Jul 2009 15:34:56 +0200 + +shadow (1:4.1.4.1-1ubuntu1) karmic; urgency=low + + * Resynchronise with Debian. Remaining changes: + - Ubuntu specific: + + debian/login.defs: use SHA512 by default for password crypt routine. + - debian/patches/495_stdout-encrypted-password: chpasswd can report + password hashes on stdout (Debian bug 505640). + * Rework 495_stdout-encrypted-password to cope with chpasswd using PAM. + It's looking a bit ugly now ... + + -- Colin Watson Wed, 03 Jun 2009 11:16:51 +0100 + shadow (1:4.1.4.1-1) unstable; urgency=low * The "Chevrotin" release. @@ -843,6 +1619,21 @@ shadow (1:4.1.4-1) unstable; urgency=low -- Nicolas FRANCOIS (Nekral) Mon, 11 May 2009 00:25:11 +0200 +shadow (1:4.1.3.1-1ubuntu1) karmic; urgency=low + + * Merge from debian unstable, remaining changes: + - Ubuntu specific: + + debian/login.defs: use SHA512 by default for password crypt routine. + - debian/patches/stdout-encrypted-password.patch: chpasswd can report + password hashes on stdout (debian bug 505640). + - debian/login.pam: Enable SELinux support (debian bug 527106). + - debian/securetty.linux: support Freescale MX-series (debian bug 527095). + * Add debian/patches/300_lastlog_failure: fixed upstream (debian bug 524873). + * Drop debian/patches/593_omit_lastchange_field_if_clock_is_misset: fixed + upstream. + + -- Kees Cook Tue, 05 May 2009 09:45:21 -0700 + shadow (1:4.1.3.1-1) unstable; urgency=low * The "Le Puant Macéré" release. @@ -938,6 +1729,108 @@ shadow (1:4.1.3-1) unstable; urgency=low -- Nicolas FRANCOIS (Nekral) Tue, 14 Apr 2009 23:33:22 +0200 +shadow (1:4.1.1-6ubuntu6) jaunty; urgency=low + + * debian/login.preinst: fix typo in grep (LP: #354887). + + -- Kees Cook Fri, 03 Apr 2009 22:12:07 -0700 + +shadow (1:4.1.1-6ubuntu5) jaunty; urgency=low + + * debian/login.preinst: add special-case handling to restore the + original white-space in /etc/login.defs that is changed by + system-tools-backends (LP: #316756). + + -- Kees Cook Fri, 03 Apr 2009 14:33:43 -0700 + +shadow (1:4.1.1-6ubuntu4) jaunty; urgency=low + + * debian/patches/593_omit_lastchange_field_if_clock_is_misset (LP: #349504) + - If the system clock is set to Jan 01, 1970, and a new user is created + the last changed field gets set to 0, which tells login that the + password is expired and must be changed. During installation, + this can cause autologin to fail. Having the clock set to 01/01/1970 + on a fresh install is common on the ARM architecture, so this is a high + priority bug since its likely to affect most ARM users on first install + + -- Michael Casadevall Thu, 02 Apr 2009 14:05:31 -0400 + +shadow (1:4.1.1-6ubuntu3) jaunty; urgency=low + + [ Bryan McLellan ] + * Don't do the vm-builder root password check on fresh installations + (LP: #340841). + + -- Colin Watson Tue, 17 Mar 2009 13:32:55 +0000 + +shadow (1:4.1.1-6ubuntu2) jaunty; urgency=low + + * debian/securetty.linux (LP: #316841) + - Updated securetty support for Freescale MX-series boards + + -- Michael Casadevall Tue, 13 Jan 2009 12:56:38 -0500 + +shadow (1:4.1.1-6ubuntu1) jaunty; urgency=low + + * Merge from debian unstable, remaining changes: + - Ubuntu specific: + + debian/login.pam: Enable SELinux support in login.pam. + + debian/rules: regenerate autoconf to avoid libtool-caused FTBFS. + + debian/login.defs: use SHA512 by default for password crypt routine. + + debian/passwd.postinst: disable the root password for virtual + machines created with vm-builder on Ubuntu 8.10. + - debian/patches/stdout-encrypted-password.patch: allow chpasswd to + report encrypted passwords to stdout for tools needing encrypted + passwords (debian bug 505640). + + -- Kees Cook Mon, 08 Dec 2008 00:44:46 -0800 + +shadow (1:4.1.1-6) unstable; urgency=medium + + * The "Rollot" release. + * debian/patches/303_login_symlink_attack: Fix a race condition that could + lead to gaining ownership or changing mode of arbitrary files. + Closes: #505271 + * debian/patches/304_su.1_synopsis: Fix the su synopsis. username is + referenced in the manpage, not LOGIN. Closes: #501830 + * debian/patches/305_login.1_japanese: Fix the path of the utmp and wtmp + files. Closes: #501353 + + -- Nicolas FRANCOIS (Nekral) Fri, 14 Nov 2008 21:52:42 +0100 + +shadow (1:4.1.1-5ubuntu3) jaunty; urgency=low + + * disable the root password for virtual machines created with vm-builder + on Ubuntu 8.10. (LP: #296841) + + -- Jamie Strandboge Thu, 13 Nov 2008 20:32:42 -0600 + +shadow (1:4.1.1-5ubuntu2) jaunty; urgency=low + + * debian/login.defs: use SHA512 by default for password crypt routine + (LP: #51551, currently Ubuntu specific). + * debian/patches/stdout-encrypted-password.patch: allow chpasswd to report + encrypted passwords to stdout for tools needing encrypted passwords + (debian bug 505640). + * debian/rules: regenerate autoconf to avoid libtool-caused FTBFS. + + -- Kees Cook Thu, 13 Nov 2008 16:43:48 -0800 + +shadow (1:4.1.1-5ubuntu1) jaunty; urgency=low + + * Merge from debian unstable, remaining changes: + - debian/login.pam: Enable SELinux support in login.pam. + + -- Scott James Remnant Wed, 05 Nov 2008 07:26:43 +0000 + +shadow (1:4.1.1-5) unstable; urgency=low + + * The "Bergues" release. + * debian/login.pam: restore the Etch behavior of pam_securetty.so in case of + unknown user. Closes: #443322, #495831 + + -- Nicolas FRANCOIS (Nekral) Sun, 14 Sep 2008 19:13:34 +0200 + shadow (1:4.1.1-4) unstable; urgency=low * The "Rocamadour" release. @@ -1015,6 +1908,13 @@ shadow (1:4.1.1-2) unstable; urgency=low -- Nicolas FRANCOIS (Nekral) Fri, 13 Jun 2008 01:27:16 +0200 +shadow (1:4.1.1-1ubuntu1) intrepid; urgency=low + + * Merge from debian unstable, remaining changes: + - debian/login.pam: Enable SELinux support in login.pam. + + -- Kees Cook Mon, 09 Jun 2008 10:08:38 -0700 + shadow (1:4.1.1-1) unstable; urgency=low * New upstream release. This closes the following bugs: @@ -1140,6 +2040,20 @@ shadow (1:4.1.0-1) unstable; urgency=low -- Christian Perrier Sat, 12 Jan 2008 20:40:02 +0100 +shadow (1:4.0.18.2-1ubuntu2) hardy; urgency=low + + * Add 498_make_useradd_faster_with_ldap: make useradd faster when + nsswitch uses LDAP or some other remote names database (LP: #120015), + thanks to Vince Busam. + + -- Matt T. Proud Fri, 08 Feb 2008 18:30:51 -0800 + +shadow (1:4.0.18.2-1ubuntu1) hardy; urgency=low + + * debian/login.pam: Enable SELinux support in login.pam (LP: #191326). + + -- Caleb Case Fri, 08 Feb 2008 02:20:06 -0500 + shadow (1:4.0.18.2-1) unstable; urgency=low * The "Vacherin" release. diff -pruN 1:4.13+dfsg1-1/debian/control 1:4.13+dfsg1-1ubuntu1/debian/control --- 1:4.13+dfsg1-1/debian/control 2022-11-11 08:28:15.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/control 2022-11-23 10:55:02.000000000 +0000 @@ -1,5 +1,6 @@ Source: shadow -Maintainer: Shadow package maintainers +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Shadow package maintainers Uploaders: Balint Reczey , Serge Hallyn Section: admin diff -pruN 1:4.13+dfsg1-1/debian/login.defs 1:4.13+dfsg1-1ubuntu1/debian/login.defs --- 1:4.13+dfsg1-1/debian/login.defs 2022-11-11 08:28:15.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/login.defs 2022-11-23 10:55:02.000000000 +0000 @@ -153,7 +153,7 @@ UMASK 022 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. -#HOME_MODE 0700 +HOME_MODE 0750 # # Password aging controls: @@ -227,13 +227,14 @@ DEFAULT_HOME yes #USERDEL_CMD /usr/sbin/userdel_local # +# Enable setting of the umask group bits to be the same as owner bits +# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is +# the same as gid, and username is the same as the primary group name. +# # If set to yes, userdel will remove the user's group if it contains no # more members, and useradd will create by default a group with the name # of the user. # -# Other former uses of this variable such as setting the umask when -# user==primary group are not used in PAM environments, such as Debian -# USERGROUPS_ENAB yes # diff -pruN 1:4.13+dfsg1-1/debian/login.install 1:4.13+dfsg1-1ubuntu1/debian/login.install --- 1:4.13+dfsg1-1/debian/login.install 2022-11-11 08:28:15.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/login.install 2022-11-23 10:55:02.000000000 +0000 @@ -1,4 +1,5 @@ debian/login.defs etc +debian/source_shadow.py usr/share/apport/package-hooks usr/share/locale/*/LC_MESSAGES/shadow.mo sbin/nologin usr/sbin usr/bin/faillog diff -pruN 1:4.13+dfsg1-1/debian/patches/1010_extrausers.patch 1:4.13+dfsg1-1ubuntu1/debian/patches/1010_extrausers.patch --- 1:4.13+dfsg1-1/debian/patches/1010_extrausers.patch 1970-01-01 00:00:00.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/patches/1010_extrausers.patch 2022-11-23 10:55:02.000000000 +0000 @@ -0,0 +1,307 @@ +From: Michael Terry +Date: Fri, 20 Dec 2019 16:45:51 +0100 +Subject: Add support to passwd for updating libnss-extrausers locations + +--- + lib/commonio.c | 2 ++ + lib/defines.h | 8 ++++++++ + src/passwd.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++- + src/usermod.c | 48 +++++++++++++++++++++++++++++++++++++++++++ + 4 files changed, 122 insertions(+), 1 deletion(-) + +--- a/lib/commonio.c ++++ b/lib/commonio.c +@@ -403,6 +403,7 @@ int commonio_lock (struct commonio_db *d + int i; + + #ifdef HAVE_LCKPWDF ++ if (strncmp(db->filename, "/etc/", 5) == 0) { + /* + * Only if the system libc has a real lckpwdf() - the one from + * lockpw.c calls us and would cause infinite recursion! +@@ -432,6 +433,7 @@ int commonio_lock (struct commonio_db *d + ulckpwdf (); + return 0; /* failure */ + } ++ } /* strncmp(db->filename, "/etc/", 5) == 0 */ + #endif /* !HAVE_LCKPWDF */ + + /* +--- a/lib/defines.h ++++ b/lib/defines.h +@@ -267,6 +267,14 @@ static inline void memzero(void *ptr, si + #endif + #endif + ++#ifndef EXTRAUSERS_PASSWD_FILE ++#define EXTRAUSERS_PASSWD_FILE "/var/lib/extrausers/passwd" ++#endif ++ ++#ifndef EXTRAUSERS_SHADOW_FILE ++#define EXTRAUSERS_SHADOW_FILE "/var/lib/extrausers/shadow" ++#endif ++ + #ifndef NULL + #define NULL ((void *) 0) + #endif +--- a/src/passwd.c ++++ b/src/passwd.c +@@ -536,8 +536,15 @@ static void update_noshadow (void) + { + const struct passwd *pw; + struct passwd *npw; ++ bool try_extrausers = strcmp (pw_dbname (), EXTRAUSERS_PASSWD_FILE) != 0 && ++ access (EXTRAUSERS_PASSWD_FILE, F_OK) == 0; + + if (pw_lock () == 0) { ++ if (try_extrausers) { ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ update_noshadow (); ++ return; ++ } + (void) fprintf (stderr, + _("%s: cannot lock %s; try again later.\n"), + Prog, pw_dbname ()); +@@ -545,6 +552,20 @@ static void update_noshadow (void) + } + pw_locked = true; + if (pw_open (O_CREAT | O_RDWR) == 0) { ++ if (try_extrausers) { ++ if (pw_unlock () == 0) { ++ (void) fprintf (stderr, ++ _("%s: failed to unlock %s\n"), ++ Prog, pw_dbname ()); ++ SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ())); ++ /* continue */ ++ } ++ pw_locked = false; ++ ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ update_noshadow (); ++ return; ++ } + (void) fprintf (stderr, + _("%s: cannot open %s\n"), + Prog, pw_dbname ()); +@@ -553,6 +574,21 @@ static void update_noshadow (void) + } + pw = pw_locate (name); + if (NULL == pw) { ++ if (try_extrausers) { ++ (void) pw_close (); ++ if (pw_unlock () == 0) { ++ (void) fprintf (stderr, ++ _("%s: failed to unlock %s\n"), ++ Prog, pw_dbname ()); ++ SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ())); ++ /* continue */ ++ } ++ pw_locked = false; ++ ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ update_noshadow (); ++ return; ++ } + (void) fprintf (stderr, + _("%s: user '%s' does not exist in %s\n"), + Prog, name, pw_dbname ()); +@@ -590,8 +626,15 @@ static void update_shadow (void) + { + const struct spwd *sp; + struct spwd *nsp; ++ bool try_extrausers = strcmp (spw_dbname (), EXTRAUSERS_SHADOW_FILE) != 0 && ++ access (EXTRAUSERS_SHADOW_FILE, F_OK) == 0; + + if (spw_lock () == 0) { ++ if (try_extrausers) { ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ update_shadow (); ++ return; ++ } + (void) fprintf (stderr, + _("%s: cannot lock %s; try again later.\n"), + Prog, spw_dbname ()); +@@ -599,6 +642,20 @@ static void update_shadow (void) + } + spw_locked = true; + if (spw_open (O_CREAT | O_RDWR) == 0) { ++ if (try_extrausers) { ++ if (spw_unlock () == 0) { ++ (void) fprintf (stderr, ++ _("%s: failed to unlock %s\n"), ++ Prog, spw_dbname ()); ++ SYSLOG ((LOG_ERR, "failed to unlock %s", spw_dbname ())); ++ /* continue */ ++ } ++ spw_locked = false; ++ ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ update_shadow (); ++ return; ++ } + (void) fprintf (stderr, + _("%s: cannot open %s\n"), + Prog, spw_dbname ()); +@@ -609,7 +666,9 @@ static void update_shadow (void) + if (NULL == sp) { + /* Try to update the password in /etc/passwd instead. */ + (void) spw_close (); +- update_noshadow (); ++ if (!try_extrausers) { ++ update_noshadow (); ++ } + if (spw_unlock () == 0) { + (void) fprintf (stderr, + _("%s: failed to unlock %s\n"), +@@ -618,6 +677,10 @@ static void update_shadow (void) + /* continue */ + } + spw_locked = false; ++ if (try_extrausers) { ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ update_shadow (); ++ } + return; + } + nsp = __spw_dup (sp); +--- a/src/usermod.c ++++ b/src/usermod.c +@@ -1584,7 +1584,18 @@ static void close_files (void) + */ + static void open_files (void) + { ++ bool try_extrausers = strcmp (pw_dbname (), EXTRAUSERS_PASSWD_FILE) != 0 && ++ access (EXTRAUSERS_PASSWD_FILE, F_OK) == 0; ++ + if (pw_lock () == 0) { ++ if (try_extrausers) { ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++ open_files (); ++ return; ++ } + fprintf (stderr, + _("%s: cannot lock %s; try again later.\n"), + Prog, pw_dbname ()); +@@ -1592,12 +1603,29 @@ static void open_files (void) + } + pw_locked = true; + if (pw_open (O_CREAT | O_RDWR) == 0) { ++ if (try_extrausers) { ++ pw_unlock (); ++ pw_locked = false; ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ open_files (); ++ return; ++ } + fprintf (stderr, + _("%s: cannot open %s\n"), + Prog, pw_dbname ()); + fail_exit (E_PW_UPDATE); + } + if (is_shadow_pwd && (spw_lock () == 0)) { ++ if (try_extrausers) { ++ pw_close (); ++ pw_unlock (); ++ pw_locked = false; ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ open_files (); ++ return; ++ } + fprintf (stderr, + _("%s: cannot lock %s; try again later.\n"), + Prog, spw_dbname ()); +@@ -1605,6 +1633,17 @@ static void open_files (void) + } + spw_locked = true; + if (is_shadow_pwd && (spw_open (O_CREAT | O_RDWR) == 0)) { ++ if (try_extrausers) { ++ pw_close (); ++ pw_unlock (); ++ spw_unlock (); ++ pw_locked = false; ++ spw_locked = false; ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ open_files (); ++ return; ++ } + fprintf (stderr, + _("%s: cannot open %s\n"), + Prog, spw_dbname ()); +@@ -1617,6 +1656,14 @@ static void open_files (void) + * group entries. + */ + if (gr_lock () == 0) { ++ if (try_extrausers) { ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++ open_files (); ++ return; ++ } + fprintf (stderr, + _("%s: cannot lock %s; try again later.\n"), + Prog, gr_dbname ()); +@@ -1624,6 +1671,16 @@ static void open_files (void) + } + gr_locked = true; + if (gr_open (O_CREAT | O_RDWR) == 0) { ++ if (try_extrausers) { ++ gr_unlock (); ++ gr_locked = false; ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++ open_files (); ++ return; ++ } + fprintf (stderr, + _("%s: cannot open %s\n"), + Prog, gr_dbname ()); +@@ -1631,6 +1688,16 @@ static void open_files (void) + } + #ifdef SHADOWGRP + if (is_shadow_grp && (sgr_lock () == 0)) { ++ if (try_extrausers) { ++ gr_unlock (); ++ gr_locked = false; ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++ open_files (); ++ return; ++ } + fprintf (stderr, + _("%s: cannot lock %s; try again later.\n"), + Prog, sgr_dbname ()); +@@ -1693,11 +1760,22 @@ static void usr_update (void) + struct spwd spent; + const struct spwd *spwd = NULL; + ++ bool try_extrausers = strcmp (pw_dbname (), EXTRAUSERS_PASSWD_FILE) != 0 && ++ access (EXTRAUSERS_PASSWD_FILE, F_OK) == 0; ++ + /* + * Locate the entry in /etc/passwd, which MUST exist. + */ + pwd = pw_locate (user_name); + if (NULL == pwd) { ++ if (try_extrausers) { ++ close_files (); ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ open_files (); ++ usr_update (); ++ return; ++ } + fprintf (stderr, + _("%s: user '%s' does not exist in %s\n"), + Prog, user_name, pw_dbname ()); diff -pruN 1:4.13+dfsg1-1/debian/patches/1011_extrausers_toggle.patch 1:4.13+dfsg1-1ubuntu1/debian/patches/1011_extrausers_toggle.patch --- 1:4.13+dfsg1-1/debian/patches/1011_extrausers_toggle.patch 1970-01-01 00:00:00.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/patches/1011_extrausers_toggle.patch 2022-11-23 10:55:02.000000000 +0000 @@ -0,0 +1,154 @@ +From: Ubuntu Developers +Date: Fri, 20 Dec 2019 16:45:51 +0100 +Subject: _extrausers_toggle + +--- + lib/defines.h | 16 ++++++++++++++++ + src/groupadd.c | 22 ++++++++++++++++++++++ + src/useradd.c | 23 +++++++++++++++++++++++ + 3 files changed, 61 insertions(+) + +--- a/lib/defines.h ++++ b/lib/defines.h +@@ -275,6 +275,22 @@ static inline void memzero(void *ptr, si + #define EXTRAUSERS_SHADOW_FILE "/var/lib/extrausers/shadow" + #endif + ++#ifndef EXTRAUSERS_GROUP_FILE ++#define EXTRAUSERS_GROUP_FILE "/var/lib/extrausers/group" ++#endif ++ ++#ifndef EXTRAUSERS_SHADOWGROUP_FILE ++#define EXTRAUSERS_SHADOWGROUP_FILE "/var/lib/extrausers/gshadow" ++#endif ++ ++#ifndef EXTRAUSERS_SUBUID_FILE ++#define EXTRAUSERS_SUBUID_FILE "/var/lib/extrausers/subuid" ++#endif ++ ++#ifndef EXTRAUSERS_SUBGID_FILE ++#define EXTRAUSERS_SUBGID_FILE "/var/lib/extrausers/subgid" ++#endif ++ + #ifndef NULL + #define NULL ((void *) 0) + #endif +--- a/src/groupadd.c ++++ b/src/groupadd.c +@@ -84,6 +84,12 @@ static void process_flags (int argc, cha + static void check_flags (void); + static void check_perms (void); + ++#ifndef EXTRAUSERS_OPT ++#define EXTRAUSERS_OPT 100000 ++#endif ++ ++static bool use_extrausers = false; ++ + /* + * usage - display usage message and exit + */ +@@ -107,6 +113,7 @@ static /*@noreturn@*/void usage (int sta + (void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout); + (void) fputs (_(" -P, --prefix PREFIX_DI directory prefix\n"), usageout); + (void) fputs (_(" -U, --users USERS list of user members of this group\n"), usageout); ++ (void) fputs (_(" --extrausers Use the extra users database\n"), usageout); + (void) fputs ("\n", usageout); + exit (status); + } +@@ -385,12 +392,16 @@ static void process_flags (int argc, cha + {"root", required_argument, NULL, 'R'}, + {"prefix", required_argument, NULL, 'P'}, + {"users", required_argument, NULL, 'U'}, ++ {"extrausers", no_argument, NULL, EXTRAUSERS_OPT}, + {NULL, 0, NULL, '\0'} + }; + + while ((c = getopt_long (argc, argv, "fg:hK:op:rR:P:U:", + long_options, NULL)) != -1) { + switch (c) { ++ case EXTRAUSERS_OPT: ++ use_extrausers = true; ++ break; + case 'f': + /* + * "force" - do nothing, just exit(0), if the +@@ -605,7 +616,18 @@ int main (int argc, char **argv) + + check_perms (); + ++ if (use_extrausers) { ++ fprintf (stderr, "ENTER EXTRAUSERS_GROUP_FILE"); ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++ fprintf (stderr, "EXIT EXTRAUSERS_GROUP_FILE"); ++ } ++ + #ifdef SHADOWGRP ++ if (use_extrausers) { ++ fprintf (stderr, "ENTER EXTRAUSERS_SHADOWGROUP_FILE"); ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++ fprintf (stderr, "EXIT EXTRAUSERS_SHADOWGROUP_FILE"); ++ } + is_shadow_grp = sgr_file_present (); + #endif + +--- a/src/useradd.c ++++ b/src/useradd.c +@@ -132,6 +132,12 @@ static bool do_grp_update = false; /* gr + + extern int allow_bad_names; + ++#ifndef EXTRAUSERS_OPT ++#define EXTRAUSERS_OPT 100000 ++#endif ++ ++static bool use_extrausers = false; ++ + static bool + bflg = false, /* new default root of home directory */ + cflg = false, /* comment (GECOS) field for new account */ +@@ -941,6 +947,7 @@ static void usage (int status) + #ifdef WITH_SELINUX + (void) fputs (_(" -Z, --selinux-user SEUSER use a specific SEUSER for the SELinux user mapping\n"), usageout); + #endif /* WITH_SELINUX */ ++ (void) fputs (_(" --extrausers Use the extra users database\n"), usageout); + (void) fputs ("\n", usageout); + exit (status); + } +@@ -1224,6 +1231,7 @@ static void process_flags (int argc, cha + #ifdef WITH_SELINUX + {"selinux-user", required_argument, NULL, 'Z'}, + #endif /* WITH_SELINUX */ ++ {"extrausers", no_argument, NULL, EXTRAUSERS_OPT}, + {NULL, 0, NULL, '\0'} + }; + while ((c = getopt_long (argc, argv, +@@ -1237,6 +1245,9 @@ static void process_flags (int argc, cha + "", + long_options, NULL)) != -1) { + switch (c) { ++ case EXTRAUSERS_OPT: ++ use_extrausers = true; ++ break; + case 'b': + if ( ( !VALID (optarg) ) + || ( optarg[0] != '/' )) { +@@ -2602,6 +2613,18 @@ int main (int argc, char **argv) + } + } + ++ if (use_extrausers) { ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++ /* TODO expose this information in other tools */ ++ sub_uid_setdbname(EXTRAUSERS_SUBUID_FILE); ++ sub_gid_setdbname(EXTRAUSERS_SUBGID_FILE); ++#ifdef SHADOWGRP ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++#endif ++ } ++ + /* + * Do the hard stuff: + * - open the files, diff -pruN 1:4.13+dfsg1-1/debian/patches/1012_extrausers_chfn.patch 1:4.13+dfsg1-1ubuntu1/debian/patches/1012_extrausers_chfn.patch --- 1:4.13+dfsg1-1/debian/patches/1012_extrausers_chfn.patch 1970-01-01 00:00:00.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/patches/1012_extrausers_chfn.patch 2022-11-23 10:55:02.000000000 +0000 @@ -0,0 +1,69 @@ +From: Michael Vogt +Date: Fri, 20 Dec 2019 16:45:51 +0100 +Subject: add support for --extrausers for chfn + +This add support for --extrausers to the chfn tool. +Bug-Ubuntu: https://bugs.launchpad.net/bugs/1495580 +--- + src/chfn.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/src/chfn.c ++++ b/src/chfn.c +@@ -49,6 +49,11 @@ static bool hflg = false; /* -h - set h + static bool oflg = false; /* -o - set other information */ + static bool pw_locked = false; + ++#ifndef EXTRAUSERS_OPT ++#define EXTRAUSERS_OPT 100000 ++#endif ++static bool use_extrausers = false; ++ + /* + * External identifiers + */ +@@ -101,6 +106,7 @@ static /*@noreturn@*/void usage (int sta + (void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout); + (void) fputs (_(" -u, --help display this help message and exit\n"), usageout); + (void) fputs (_(" -w, --work-phone WORK_PHONE change user's office phone number\n"), usageout); ++ (void) fputs (_(" --extrausers Use the extra users database\n"), usageout); + (void) fputs ("\n", usageout); + exit (status); + } +@@ -251,6 +257,7 @@ static void process_flags (int argc, cha + {"root", required_argument, NULL, 'R'}, + {"help", no_argument, NULL, 'u'}, + {"work-phone", required_argument, NULL, 'w'}, ++ {"extrausers", no_argument, NULL, EXTRAUSERS_OPT}, + {NULL, 0, NULL, '\0'} + }; + +@@ -264,6 +271,9 @@ static void process_flags (int argc, cha + while ((c = getopt_long (argc, argv, "f:h:o:r:R:uw:", + long_options, NULL)) != -1) { + switch (c) { ++ case EXTRAUSERS_OPT: ++ use_extrausers = true; ++ break; + case 'f': + if (!may_change_field ('f')) { + fprintf (stderr, +@@ -638,6 +648,18 @@ int main (int argc, char **argv) + /* parse the command line options */ + process_flags (argc, argv); + ++ if (use_extrausers) { ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++ /* TODO expose this information in other tools */ ++ sub_uid_setdbname(EXTRAUSERS_SUBUID_FILE); ++ sub_gid_setdbname(EXTRAUSERS_SUBGID_FILE); ++#ifdef SHADOWGRP ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++#endif ++ } ++ + /* + * Get the name of the user to check. It is either the command line + * name, or the name getlogin() returns. diff -pruN 1:4.13+dfsg1-1/debian/patches/1013_extrausers_deluser.patch 1:4.13+dfsg1-1ubuntu1/debian/patches/1013_extrausers_deluser.patch --- 1:4.13+dfsg1-1/debian/patches/1013_extrausers_deluser.patch 1970-01-01 00:00:00.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/patches/1013_extrausers_deluser.patch 2022-11-23 10:55:02.000000000 +0000 @@ -0,0 +1,69 @@ +From: Ubuntu Developers +Date: Fri, 20 Dec 2019 16:45:51 +0100 +Subject: _extrausers_deluser + +=================================================================== +--- + src/userdel.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +--- a/src/userdel.c ++++ b/src/userdel.c +@@ -119,6 +119,12 @@ static int remove_mailbox (void); + static int remove_tcbdir (const char *user_name, uid_t user_id); + #endif /* WITH_TCB */ + ++#ifndef EXTRAUSERS_OPT ++#define EXTRAUSERS_OPT 100000 ++#endif ++ ++static bool use_extrausers = false; ++ + /* + * usage - display usage message and exit + */ +@@ -138,6 +144,7 @@ static void usage (int status) + (void) fputs (_(" -r, --remove remove home directory and mail spool\n"), usageout); + (void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout); + (void) fputs (_(" -P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files\n"), usageout); ++ (void) fputs (_(" --extrausers Use the extra users database\n"), usageout); + #ifdef WITH_SELINUX + (void) fputs (_(" -Z, --selinux-user remove any SELinux user mapping for the user\n"), usageout); + #endif /* WITH_SELINUX */ +@@ -1018,6 +1025,7 @@ int main (int argc, char **argv) + {"remove", no_argument, NULL, 'r'}, + {"root", required_argument, NULL, 'R'}, + {"prefix", required_argument, NULL, 'P'}, ++ {"extrausers", no_argument, NULL, EXTRAUSERS_OPT}, + #ifdef WITH_SELINUX + {"selinux-user", no_argument, NULL, 'Z'}, + #endif /* WITH_SELINUX */ +@@ -1031,6 +1039,9 @@ int main (int argc, char **argv) + #endif /* !WITH_SELINUX */ + long_options, NULL)) != -1) { + switch (c) { ++ case EXTRAUSERS_OPT: ++ use_extrausers = true; ++ break; + case 'f': /* force remove even if not owned by user */ + fflg = true; + break; +@@ -1119,6 +1130,18 @@ int main (int argc, char **argv) + is_sub_gid = sub_gid_file_present (); + #endif /* ENABLE_SUBIDS */ + ++ if (use_extrausers) { ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++ /* TODO expose this information in other tools */ ++ sub_uid_setdbname(EXTRAUSERS_SUBUID_FILE); ++ sub_gid_setdbname(EXTRAUSERS_SUBGID_FILE); ++#ifdef SHADOWGRP ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++#endif ++ } ++ + /* + * Start with a quick check to see if the user exists. + */ diff -pruN 1:4.13+dfsg1-1/debian/patches/1014_extrausers_delgroup.patch 1:4.13+dfsg1-1ubuntu1/debian/patches/1014_extrausers_delgroup.patch --- 1:4.13+dfsg1-1/debian/patches/1014_extrausers_delgroup.patch 1970-01-01 00:00:00.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/patches/1014_extrausers_delgroup.patch 2022-11-23 10:55:02.000000000 +0000 @@ -0,0 +1,69 @@ +From: Ubuntu Developers +Date: Fri, 20 Dec 2019 16:45:51 +0100 +Subject: _extrausers_delgroup + +=================================================================== +--- + src/groupdel.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +--- a/src/groupdel.c ++++ b/src/groupdel.c +@@ -65,6 +65,12 @@ static void open_files (void); + static void group_busy (gid_t gid); + static void process_flags (int argc, char **argv); + ++#ifndef EXTRAUSERS_OPT ++#define EXTRAUSERS_OPT 100000 ++#endif ++ ++static bool use_extrausers = false; ++ + /* + * usage - display usage message and exit + */ +@@ -80,6 +86,7 @@ static /*@noreturn@*/void usage (int sta + (void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout); + (void) fputs (_(" -P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files\n"), usageout); + (void) fputs (_(" -f, --force delete group even if it is the primary group of a user\n"), usageout); ++ (void) fputs (_(" --extrausers Use the extra users database\n"), usageout); + (void) fputs ("\n", usageout); + exit (status); + } +@@ -304,6 +311,7 @@ static void process_flags (int argc, cha + {"force", no_argument, NULL, 'f'}, + {"root", required_argument, NULL, 'R'}, + {"prefix", required_argument, NULL, 'P'}, ++ {"extrausers", no_argument, NULL, EXTRAUSERS_OPT}, + {NULL, 0, NULL, '\0'} + }; + +@@ -320,6 +328,9 @@ static void process_flags (int argc, cha + case 'f': + check_group_busy = false; + break; ++ case EXTRAUSERS_OPT: ++ use_extrausers = true; ++ break; + default: + usage (E_USAGE); + } +@@ -463,6 +474,18 @@ int main (int argc, char **argv) + group_busy (group_id); + } + ++ if (use_extrausers) { ++ pw_setdbname (EXTRAUSERS_PASSWD_FILE); ++ spw_setdbname (EXTRAUSERS_SHADOW_FILE); ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++ /* TODO expose this information in other tools */ ++ sub_uid_setdbname(EXTRAUSERS_SUBUID_FILE); ++ sub_gid_setdbname(EXTRAUSERS_SUBGID_FILE); ++#ifdef SHADOWGRP ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++#endif ++ } ++ + /* + * Do the hard stuff - open the files, delete the group entries, + * then close and update the files. diff -pruN 1:4.13+dfsg1-1/debian/patches/1015_add_zsys_support.patch 1:4.13+dfsg1-1ubuntu1/debian/patches/1015_add_zsys_support.patch --- 1:4.13+dfsg1-1/debian/patches/1015_add_zsys_support.patch 1970-01-01 00:00:00.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/patches/1015_add_zsys_support.patch 2022-11-23 10:55:02.000000000 +0000 @@ -0,0 +1,188 @@ +From: Ubuntu Developers +Date: Fri, 29 Jun 2018 17:22:06 +0200 +Subject: Call zsys to handle home directory if available + +We call zsys to handle dataset creation for zsys system in a separate home +dataset for each user on the system. +This allows one to handle user dataset outside of /home and also renaming. +We don't handle with system users (uid < 1000) as we consider them by default +as part of the system. +We don't support yet deletion, as removing the dataset would remove as well +every snapshot of the history, and so, revert to previous version will result +in user created, but no home directory, which is unwanted. +Forwarded: not-needed +Origin: ubuntu +--- + src/useradd.c | 43 ++++++++++++++++++++++++++++++++++++++++++- + src/usermod.c | 36 +++++++++++++++++++++++++++++++++++- + 2 files changed, 77 insertions(+), 2 deletions(-) + +--- a/src/useradd.c ++++ b/src/useradd.c +@@ -2239,6 +2239,13 @@ static void usr_update (unsigned long su + */ + static void create_home (void) + { ++ const char zsys[] = "/sbin/zsysctl"; ++ const char *pname = "zsysctl"; ++ pid_t childpid; ++ int devnull_fd; ++ int zsys_failed; ++ int zsys_status; ++ + if (access (prefix_user_home, F_OK) != 0) { + char path[strlen (prefix_user_home) + 2]; + char *bhome, *cp; +@@ -2317,6 +2324,7 @@ static void create_home (void) + #endif + fail_exit (E_HOMEDIR); + } ++ + if (chown (path, 0, 0) < 0) { + fprintf (stderr, + _("%s: warning: chown on `%s' failed: %m\n"), +@@ -2327,6 +2335,47 @@ static void create_home (void) + _("%s: warning: chmod on `%s' failed: %m\n"), + Prog, path); + } ++ ++ // We don't create zsys user dataset for system users ++ zsys_failed = 0; ++ if (user_id < 1000) { ++ zsys_failed = 1; ++ } else { ++ zsys_failed = 0; ++ // Do a first chown before we prepare the mountpoint ++ if (chown (prefix_user_home, user_id, user_gid) < 0) { ++ fprintf (stderr, ++ _("%s: warning: chown on `%s' failed: %m\n"), ++ Prog, prefix_user_home); ++ } ++ switch (childpid = fork()) ++ { ++ case -1: /* error */ ++ zsys_failed = 1; ++ break; ++ case 0: /* child */ ++ devnull_fd = open("/dev/null", O_WRONLY); ++ if (devnull_fd == -1) { ++ perror("can't open /dev/null"); ++ exit(3); ++ } ++ // don't print zsys stdout and stderr ++ if (dup2(devnull_fd, 1) == -1 || (dup2(devnull_fd, 2) == -1)) { ++ exit(3); ++ } ++ execl(zsys, pname, "userdata", "create", user_name, path, NULL); ++ /* If we come here, something has gone terribly wrong */ ++ perror(zsys); ++ exit(42); /* don't continue, we now have 2 processes running! */ ++ /* NOTREACHED */ ++ break; ++ default: /* parent */ ++ if (waitpid(childpid, &zsys_status, 0) == -1 || !WIFEXITED(zsys_status) || WEXITSTATUS(zsys_status) != 0) ++ zsys_failed = 1; ++ break; ++ } ++ } ++ + } + cp = strtok (NULL, "/"); + } +--- a/src/usermod.c ++++ b/src/usermod.c +@@ -1867,6 +1867,12 @@ static void usr_update (void) + static void move_home (void) + { + struct stat sb; ++ const char zsys[] = "/sbin/zsysctl"; ++ const char *pname = "zsysctl"; ++ int devnull_fd; ++ pid_t childpid; ++ int zsys_failed; ++ int zsys_status; + + if (access (prefix_user_newhome, F_OK) == 0) { + /* +@@ -1901,7 +1907,35 @@ static void move_home (void) + } + #endif + +- if (rename (prefix_user_home, prefix_user_newhome) == 0) { ++ zsys_failed = 0; ++ switch (childpid = fork()) ++ { ++ case -1: /* error */ ++ zsys_failed = 1; ++ break; ++ case 0: /* child */ ++ devnull_fd = open("/dev/null", O_WRONLY); ++ if (devnull_fd == -1){ ++ perror("can't open /dev/null"); ++ exit(3); ++ } ++ // don't print zsys stdout and stderr ++ if (dup2(devnull_fd, 1) == -1 || (dup2(devnull_fd, 2) == -1)) { ++ exit(3); ++ } ++ execl(zsys, pname, "userdata", "set-home", prefix_user_home, prefix_user_newhome, NULL); ++ /* If we come here, something has gone terribly wrong */ ++ perror(zsys); ++ exit(42); /* don't continue, we now have 2 processes running! */ ++ /* NOTREACHED */ ++ break; ++ default: /* parent */ ++ if (waitpid(childpid, &zsys_status, 0) == -1 || !WIFEXITED(zsys_status) || WEXITSTATUS(zsys_status) != 0) ++ zsys_failed = 1; ++ break; ++ } ++ ++ if (zsys_failed == 0 || rename (prefix_user_home, prefix_user_newhome) == 0) { + /* FIXME: rename above may have broken symlinks + * pointing to the user's home directory + * with an absolute path. */ +--- a/src/userdel.c ++++ b/src/userdel.c +@@ -1283,6 +1283,42 @@ int main (int argc, char **argv) + } + #endif /* EXTRA_CHECK_HOME_DIR */ + ++ /* ZSys support: always dissociate dataset, even if we don’t delete the content */ ++ if (user_id >= 1000) { ++ const char zsys[] = "/sbin/zsysctl"; ++ const char *pname = "zsysctl"; ++ pid_t childpid; ++ int devnull_fd; ++ int zsys_status; ++ switch (childpid = fork()) ++ { ++ case -1: /* error */ ++ break; ++ case 0: /* child */ ++ devnull_fd = open("/dev/null", O_WRONLY); ++ if (devnull_fd == -1) { ++ perror("can't open /dev/null"); ++ exit(3); ++ } ++ // don't print ZSys stdout and stderr ++ if (dup2(devnull_fd, 1) == -1 || (dup2(devnull_fd, 2) == -1)) { ++ exit(3); ++ } ++ if (rflg) ++ execl(zsys, pname, "userdata", "dissociate", "--remove", user_name, NULL); ++ else ++ execl(zsys, pname, "userdata", "dissociate", user_name, NULL); ++ /* If we come here, something has gone terribly wrong */ ++ perror(zsys); ++ exit(42); /* don't continue, we now have 2 processes running! */ ++ /* NOTREACHED */ ++ break; ++ default: /* parent */ ++ waitpid(childpid, &zsys_status, 0); ++ break; ++ } ++ } ++ + if (rflg) { + #ifdef WITH_BTRFS + int is_subvolume = btrfs_is_subvolume (user_home); diff -pruN 1:4.13+dfsg1-1/debian/patches/1016_extrausers_gpasswd.patch 1:4.13+dfsg1-1ubuntu1/debian/patches/1016_extrausers_gpasswd.patch --- 1:4.13+dfsg1-1/debian/patches/1016_extrausers_gpasswd.patch 1970-01-01 00:00:00.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/patches/1016_extrausers_gpasswd.patch 2022-11-23 10:55:02.000000000 +0000 @@ -0,0 +1,50 @@ +From bea0ec0e35d7417b258dcbf85c700e204afd1a1e Mon Sep 17 00:00:00 2001 +From: Marcus Tomlinson +Date: Wed, 21 Oct 2020 13:18:01 +0100 +Subject: add extrausers flag + +--- + src/gpasswd.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/src/gpasswd.c ++++ b/src/gpasswd.c +@@ -101,6 +101,10 @@ static void log_gpasswd_success (const c + static void log_gpasswd_success_system (/*@null@*/unused void *arg); + static void log_gpasswd_success_group (/*@null@*/unused void *arg); + ++#ifndef EXTRAUSERS_OPT ++#define EXTRAUSERS_OPT 100000 ++#endif ++ + /* + * usage - display usage message + */ +@@ -119,6 +123,7 @@ static void usage (int status) + (void) fputs (_(" -r, --remove-password remove the GROUP's password\n"), usageout); + (void) fputs (_(" -R, --restrict restrict access to GROUP to its members\n"), usageout); + (void) fputs (_(" -M, --members USER,... set the list of members of GROUP\n"), usageout); ++ (void) fputs (_(" --extrausers use the extra users database\n"), usageout); + #ifdef SHADOWGRP + (void) fputs (_(" -A, --administrators ADMIN,...\n" + " set the list of administrators for GROUP\n"), usageout); +@@ -216,12 +221,19 @@ static void process_flags (int argc, cha + {"root", required_argument, NULL, 'Q'}, + {"remove-password", no_argument, NULL, 'r'}, + {"restrict", no_argument, NULL, 'R'}, ++ {"extrausers", no_argument, NULL, EXTRAUSERS_OPT}, + {NULL, 0, NULL, '\0'} + }; + + while ((c = getopt_long (argc, argv, "a:A:d:ghM:Q:rR", + long_options, NULL)) != -1) { + switch (c) { ++ case EXTRAUSERS_OPT: ++ gr_setdbname (EXTRAUSERS_GROUP_FILE); ++#ifdef SHADOWGRP ++ sgr_setdbname (EXTRAUSERS_SHADOWGROUP_FILE); ++#endif ++ break; + case 'a': /* add a user */ + aflg = true; + user = optarg; diff -pruN 1:4.13+dfsg1-1/debian/patches/506_relaxed_usernames 1:4.13+dfsg1-1ubuntu1/debian/patches/506_relaxed_usernames --- 1:4.13+dfsg1-1/debian/patches/506_relaxed_usernames 2022-11-11 08:28:15.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/patches/506_relaxed_usernames 2022-11-23 10:55:02.000000000 +0000 @@ -17,7 +17,7 @@ Details: --- a/libmisc/chkname.c +++ b/libmisc/chkname.c -@@ -32,44 +32,26 @@ +@@ -32,44 +32,61 @@ static bool is_valid_name (const char *n } /* @@ -45,6 +45,17 @@ Details: + * + * Allow more relaxed user/group names in Debian -- ^[^-~+:,\s][^:,\s]*$ + */ ++ bool is_numeric = true; ++ bool is_hex = true; ++ bool is_octal = true; ++ /* ++ * We skip the hex and octal checks for the first two characters in the ++ * loop, and inspect them individually before the loop starts. This ++ * checks for "0x" and "0o" at the beginning of the username while still ++ * treating "x" and "o" as non-numeric characters in all other scenarios ++ */ ++ int chars_checked = 0; ++ + if ( ('\0' == *name) + || ('-' == *name) + || ('~' == *name) @@ -63,23 +74,47 @@ Details: - *name == '-' || - (*name == '$' && name[1] == '\0') - )) { ++ /* if the username does not start with "0x" it is not hexadecimal */ ++ if (*name != '0' || *(name + 1) != 'x') { ++ is_hex = false; ++ } ++ /* if the username does not start with "0o" it is not octal */ ++ if (*name != '0' || *(name + 1) != 'o') { ++ is_octal = false; ++ } + do { + if ((':' == *name) || (',' == *name) || isspace(*name)) { return false; } - numeric &= isdigit(*name); - } ++ if ((*name < '0' || *name > '9')) { ++ is_numeric = false; ++ } ++ if ((*name < '0' || *name > '9') && ++ (*name < 'A' || *name > 'F') && ++ (*name < 'a' || *name > 'f') && ++ chars_checked >= 2) { ++ is_hex = false; ++ } ++ if ((*name < '0' || *name > '7') && chars_checked >= 2) { ++ is_octal = false; ++ } ++ chars_checked++; + name++; + } while ('\0' != *name); - return !numeric; ++ if (is_numeric || is_hex || is_octal) { ++ return false; ++ } + return true; } bool is_valid_user_name (const char *name) --- a/man/useradd.8.xml +++ b/man/useradd.8.xml -@@ -708,6 +708,14 @@ +@@ -708,6 +708,19 @@ the ls output. @@ -91,12 +126,17 @@ Details: + user's home directory. + + ++ On Ubuntu, the same constraints as Debian are in place, with the ++ additional constraint that the username cannot be fully numeric. ++ This includes octal and hexadecimal syntax. ++ ++ Usernames may only be up to 32 characters long. --- a/man/groupadd.8.xml +++ b/man/groupadd.8.xml -@@ -72,6 +72,12 @@ +@@ -72,6 +72,17 @@ also disallowed. @@ -106,6 +146,11 @@ Details: + end of line: '\n', tabulation: '\t', etc.). + + ++ On Ubuntu, the same constraints as Debian are in place, with the ++ additional constraint that the groupname cannot be fully numeric. ++ This includes octal and hexadecimal syntax. ++ ++ Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long. diff -pruN 1:4.13+dfsg1-1/debian/patches/series 1:4.13+dfsg1-1ubuntu1/debian/patches/series --- 1:4.13+dfsg1-1/debian/patches/series 2022-11-11 08:28:15.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/patches/series 2022-11-23 10:55:02.000000000 +0000 @@ -14,3 +14,10 @@ 505_useradd_recommend_adduser 506_relaxed_usernames 542_useradd-O_option +1010_extrausers.patch +1011_extrausers_toggle.patch +1012_extrausers_chfn.patch +1013_extrausers_deluser.patch +1014_extrausers_delgroup.patch +1015_add_zsys_support.patch +1016_extrausers_gpasswd.patch diff -pruN 1:4.13+dfsg1-1/debian/source_shadow.py 1:4.13+dfsg1-1ubuntu1/debian/source_shadow.py --- 1:4.13+dfsg1-1/debian/source_shadow.py 1970-01-01 00:00:00.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/source_shadow.py 2022-11-23 10:55:02.000000000 +0000 @@ -0,0 +1,26 @@ +#!/usr/bin/python + +'''Apport package hook for shadow + +(c) 2010 Canonical Ltd. +Contributors: +Marc Deslauriers + +This program is free software; you can redistribute it and/or modify it +under the terms of the GNU General Public License as published by the +Free Software Foundation; either version 2 of the License, or (at your +option) any later version. See http://www.gnu.org/copyleft/gpl.html for +the full text of the license. +''' + +from apport.hookutils import * + +def add_info(report): + + attach_file_if_exists(report, '/etc/login.defs', 'LoginDefs') + +if __name__ == '__main__': + report = {} + add_info(report) + for key in report: + print('[%s]\n%s' % (key, report[key])) diff -pruN 1:4.13+dfsg1-1/debian/tests/control 1:4.13+dfsg1-1ubuntu1/debian/tests/control --- 1:4.13+dfsg1-1/debian/tests/control 2022-11-11 08:28:15.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/tests/control 2022-11-23 10:55:02.000000000 +0000 @@ -1,2 +1,5 @@ Tests: smoke Restrictions: needs-root superficial + +Tests: numeric-username +Restrictions: needs-root, allow-stderr diff -pruN 1:4.13+dfsg1-1/debian/tests/numeric-username 1:4.13+dfsg1-1ubuntu1/debian/tests/numeric-username --- 1:4.13+dfsg1-1/debian/tests/numeric-username 1970-01-01 00:00:00.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/tests/numeric-username 2022-11-23 10:55:02.000000000 +0000 @@ -0,0 +1,25 @@ +#!/bin/sh + +set -ux + +# purely numeric usernames are considered invalid +for invalidUsername in "0" "00" "0123456789" "0x0" "0x0123456789" "0o0" "0o01234567" "0xDEADBEEF" "0xcafe42" "0xdeadbeef" "0xdeadBEEF" +do + useradd $invalidUsername + ret=$? + if [ $ret -eq 0 ] + then + exit 1 + fi +done + +# usernames that start with a digit and contain other valid characters should not fail +for validUsername in "0root" "0123456789root" "0-0" "0_0" "0.o" "0xo" "0-o" "0_o" "0x0x0x0" "0o0123456789" "0.0.0.0" "0x123.456.789" "0o123.456.789" "123.456" "0.0" "0xdeadbeefjawn-smith" "0o123jawn-smith" +do + useradd $validUsername + ret=$? + if [ $ret -ne 0 ] + then + exit 1 + fi +done diff -pruN 1:4.13+dfsg1-1/debian/tests/smoke 1:4.13+dfsg1-1ubuntu1/debian/tests/smoke --- 1:4.13+dfsg1-1/debian/tests/smoke 2022-11-11 08:28:15.000000000 +0000 +++ 1:4.13+dfsg1-1ubuntu1/debian/tests/smoke 2022-11-23 10:55:02.000000000 +0000 @@ -2,12 +2,31 @@ set -e +# smoke test for {user,group}{add,del} +mkdir -p /var/lib/extrausers + echo "Adding an user works" useradd shadow-test-user grep '^shadow-test-user:x:' /etc/passwd grep '^shadow-test-user:!:' /etc/shadow +# nothing got added to the extrausers +! grep -s 'shadow-test-user' /var/lib/extrausers/passwd +! grep -s 'shadow-test-user' /var/lib/extrausers/shadow echo "Removing an user works" userdel shadow-test-user ! grep 'shadow-test-user' /etc/passwd ! grep 'shadow-test-user' /etc/shadow + +echo "Adding an extrauser works" +useradd --extrausers shadow-test-user +grep '^shadow-test-user:x:' /var/lib/extrausers/passwd +grep '^shadow-test-user:!:' /var/lib/extrausers/shadow +# nothing got added to the system +! grep 'shadow-test-user' /etc/passwd +! grep 'shadow-test-user' /etc/shadow + +echo "Removing an extrauser works" +userdel --extrausers shadow-test-user +! grep 'shadow-test-user' /var/lib/extrausers/passwd +! grep 'shadow-test-user' /var/lib/extrausers/passwd