diff --git a/backport-lib-csrand.c-Fix-the-lower-part-of-the-domain-of-csr.patch b/backport-lib-csrand.c-Fix-the-lower-part-of-the-domain-of-csr.patch deleted file mode 100644 index 36fc9a3399c86408f03945012ad019d35f8785ef..0000000000000000000000000000000000000000 --- a/backport-lib-csrand.c-Fix-the-lower-part-of-the-domain-of-csr.patch +++ /dev/null @@ -1,79 +0,0 @@ -From ad0958b816f28e53d9bda4486e969ec3ca63538a Mon Sep 17 00:00:00 2001 -From: Alejandro Colomar -Date: Wed, 19 Jun 2024 19:54:16 +0200 -Subject: [PATCH] lib/csrand.c: Fix the lower part of the domain of - csrand_uniform() - -I accidentally broke this code during an un-optimization. We need to -start from a random value of the width of the limit, that is, 32 bits. - -Thanks to Jason for pointing to his similar code in the kernel, which -made me see my mistake. - -Fixes: 2a61122b5e8f ("Unoptimize the higher part of the domain of csrand_uniform()") -Closes: -Reported-by: Michael Brunnbauer -Link: -Cc: "Jason A. Donenfeld" -Link: -Link: -Link: -Tested-by: Michael Brunnbauer -Reviewed-by: Michael Brunnbauer -Signed-off-by: Alejandro Colomar -Cherry-picked-from: 4119a2dce564 ("lib/csrand.c: Fix the lower part of the domain of csrand_uniform()") -Cc: "Serge E. Hallyn" -Link: -Signed-off-by: Alejandro Colomar - -Conflict: N/A -Reference: https://github.com/shadow-maint/shadow/commit/ad0958b816f28e53d9bda4486e969ec3ca63538a - ---- - lib/csrand.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - -diff --git a/lib/csrand.c b/lib/csrand.c -index e85eaa8a..16bcccf0 100644 ---- a/lib/csrand.c -+++ b/lib/csrand.c -@@ -22,6 +22,7 @@ - #include "shadowlog.h" - - -+static uint32_t csrand32(void); - static uint32_t csrand_uniform32(uint32_t n); - static unsigned long csrand_uniform_slow(unsigned long n); - -@@ -96,6 +97,13 @@ csrand_interval(unsigned long min, unsigned long max) - } - - -+static uint32_t -+csrand32(void) -+{ -+ return csrand(); -+} -+ -+ - /* - * Fast Random Integer Generation in an Interval - * ACM Transactions on Modeling and Computer Simulation 29 (1), 2019 -@@ -108,12 +116,12 @@ csrand_uniform32(uint32_t n) - uint64_t r, mult; - - if (n == 0) -- return csrand(); -+ return csrand32(); - - bound = -n % n; // analogous to `2^32 % n`, since `x % y == (x-y) % y` - - do { -- r = csrand(); -+ r = csrand32(); - mult = r * n; - rem = mult; // analogous to `mult % 2^32` - } while (rem < bound); // p = (2^32 % n) / 2^32; W.C.: n=2^31+1, p=0.5 --- -2.46.0 - diff --git a/backport-lib-encrypt.c-Do-not-exit-in-error-case.patch b/backport-lib-encrypt.c-Do-not-exit-in-error-case.patch deleted file mode 100644 index 2230291e991c22b885b44ab642eeb25292a4660c..0000000000000000000000000000000000000000 --- a/backport-lib-encrypt.c-Do-not-exit-in-error-case.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 6cbce81df97a16363c46cbd1e8202c3b4f0a2205 Mon Sep 17 00:00:00 2001 -From: Tobias Stoeckmann -Date: Sun, 19 Jan 2025 21:23:54 +0100 -Subject: [PATCH] lib/encrypt.c: Do not exit in error case - -If crypt fails, pw_encrypt calls exit. This has the consequence that the -plaintext password is not cleared. - -A valid password can fail if the underlying library does not support it. -One such example is SHA512, for which the password must not be longer -than 256 characters on musl. A password longer than this with glibc -works, so it is actually possible that a user, running passwd, tries to -enter the old password but the musl-based passwd binary simply exits. -Let passwd clear the password before exiting. - -Reviewed-by: Alejandro Colomar -Signed-off-by: Tobias Stoeckmann ---- - lib/encrypt.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/lib/encrypt.c b/lib/encrypt.c -index c84a2552..9c1cb406 100644 ---- a/lib/encrypt.c -+++ b/lib/encrypt.c -@@ -65,7 +65,8 @@ - (void) fprintf (shadow_logfd, - _("crypt method not supported by libcrypt? (%s)\n"), - method); -- exit (EXIT_FAILURE); -+ errno = EINVAL; -+ return NULL; - } - - if (strlen (cp) != 13) { --- -2.33.0 - diff --git a/backport-lib-idmapping.c--Use-long-constants-in-prctl-2.patch b/backport-lib-idmapping.c--Use-long-constants-in-prctl-2.patch deleted file mode 100644 index 2950a89df35c249f07a4bd64d6886d7f7c76440e..0000000000000000000000000000000000000000 --- a/backport-lib-idmapping.c--Use-long-constants-in-prctl-2.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 80efeebaf296dc4814e15d67977726b3ee93c048 Mon Sep 17 00:00:00 2001 -From: Alejandro Colomar -Date: Fri, 31 May 2024 18:30:16 +0200 -Subject: [PATCH] lib/idmapping.c: Use long constants in prctl(2), and remove - 0s - -The prctl(2) system-call wrapper is implemented as a variadic function. -This makes it important to pass arguments to it of the right type (and -more importantly of the right width), to avoid undefined behavior. - -While at it, check errors with ==-1, not <0, which is more explicit. - -Also, PR_SET_KEEPCAPS(2const) doesn't need all arguments, so it can be -called with just two of them; remove unnecessary 0s. - -See-also: prctl(2), PR_SET_KEEPCAPS(2const) -Link: -Cc: Xi Ruoyao -Cc: Lukas Slebodnik -Signed-off-by: Alejandro Colomar ---- - lib/idmapping.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/idmapping.c b/lib/idmapping.c -index fe3ccdfe3..5cbb6fefc 100644 ---- a/lib/idmapping.c -+++ b/lib/idmapping.c -@@ -159,7 +159,7 @@ void write_mapping(int proc_dir_fd, int ranges, const struct map_range *mappings - - /* Align setuid- and fscaps-based new{g,u}idmap behavior. */ - if (geteuid() == 0 && geteuid() != ruid) { -- if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) { -+ if (prctl(PR_SET_KEEPCAPS, 1L) == -1) { - fprintf(log_get_logfd(), _("%s: Could not prctl(PR_SET_KEEPCAPS)\n"), log_get_progname()); - exit(EXIT_FAILURE); - } diff --git a/backport-libsubid-Dealocate-memory-on-exit.patch b/backport-libsubid-Dealocate-memory-on-exit.patch deleted file mode 100644 index 2217a3fb55c8399caee5c1794dfcb124671861b0..0000000000000000000000000000000000000000 --- a/backport-libsubid-Dealocate-memory-on-exit.patch +++ /dev/null @@ -1,20 +0,0 @@ -From 7949f2f026f0123467cdaad1e1992d5dc905872c Mon Sep 17 00:00:00 2001 -From: Daniel Bershatsky -Date: Wed, 12 Jun 2024 19:26:45 +0300 -Subject: [PATCH] libsubid: Dealocate memory on exit - ---- - src/getsubids.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/getsubids.c b/src/getsubids.c -index fb645b194..0753abd7a 100644 ---- a/src/getsubids.c -+++ b/src/getsubids.c -@@ -44,5 +44,6 @@ int main(int argc, char *argv[]) - printf("%d: %s %lu %lu\n", i, owner, - ranges[i].start, ranges[i].count); - } -+ free(ranges); - return 0; - } diff --git a/backport-man-lastlog-remove-wrong-use-of-keyword-term.patch b/backport-man-lastlog-remove-wrong-use-of-keyword-term.patch deleted file mode 100644 index 275dd2292d26f8c7f0e532f3b0e7c17f3ba28440..0000000000000000000000000000000000000000 --- a/backport-man-lastlog-remove-wrong-use-of-keyword-term.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 9f57beb31ade241aeda412a8ada4912bab83bd40 Mon Sep 17 00:00:00 2001 -From: Serge Hallyn -Date: Wed, 5 Jun 2024 08:02:27 -0500 -Subject: [PATCH] man/lastlog: remove wrong use of keyword term - -Per https://tdg.docbook.org/tdg/4.5/term, term is a word being -defined in a varlistentry. The 'high uid' description is not a -varlistentry, so and show up in the processed -manpage. See debian Bug#1072297. - -Signed-off-by: Serge Hallyn ---- - man/lastlog.8.xml | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/man/lastlog.8.xml b/man/lastlog.8.xml -index 7a4ba967f..6700791c1 100644 ---- a/man/lastlog.8.xml -+++ b/man/lastlog.8.xml -@@ -211,8 +211,8 @@ - to hang as it processes entries with UIDs 171-799). - - -- Having high UIDs can create problems when handling the -- /var/log/lastlog with external tools. Although the -+ Having high UIDs can create problems when handling the -+ /var/log/lastlog with external tools. Although the - actual file is sparse and does not use too much space, certain - applications are not designed to identify sparse files by default and may - require a specific option to handle them. diff --git a/backport-port-fix-OVERRUN-CWE-119.patch b/backport-port-fix-OVERRUN-CWE-119.patch deleted file mode 100644 index c3f1886a5568e96fe39eb70fa18584fb72eb2c71..0000000000000000000000000000000000000000 --- a/backport-port-fix-OVERRUN-CWE-119.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 4c16416ebc5f0958d58a1ea1e7890eafd9f8bb75 Mon Sep 17 00:00:00 2001 -From: Iker Pedrosa -Date: Wed, 15 May 2024 12:25:51 +0200 -Subject: [PATCH] port: fix OVERRUN (CWE-119) - -``` -shadow-4.15.0/lib/port.c:154:2: alias: Assigning: "port.pt_names" = "ttys". "port.pt_names" now points to element 0 of "ttys" (which consists of 65 8-byte elements). -shadow-4.15.0/lib/port.c:155:2: cond_const: Checking "j < 64" implies that "j" is 64 on the false branch. -shadow-4.15.0/lib/port.c:175:2: overrun-local: Overrunning array of 65 8-byte elements at element index 65 (byte offset 527) by dereferencing pointer "port.pt_names + (j + 1)". -173| *cp = '\0'; -174| cp++; -175|-> port.pt_names[j + 1] = NULL; -176| -177| /* -``` - -Resolves: https://issues.redhat.com/browse/RHEL-35383 - -Signed-off-by: Iker Pedrosa -Reviewed-by: Alejandro Colomar - -Conflict: N/A -Reference: https://github.com/shadow-maint/shadow/commit/4c16416ebc5f0958d58a1ea1e7890eafd9f8bb75 - ---- - lib/port.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/port.c b/lib/port.c -index 05b95651..60ff8989 100644 ---- a/lib/port.c -+++ b/lib/port.c -@@ -168,7 +168,7 @@ again: - } - *cp = '\0'; - cp++; -- port.pt_names[j + 1] = NULL; -+ port.pt_names[j] = NULL; - - /* - * Get the list of user names. It is the second colon --- -2.33.0 - diff --git a/backport-src-gpasswd-Clear-password-in-more-cases.patch b/backport-src-gpasswd-Clear-password-in-more-cases.patch deleted file mode 100644 index 94f8ce98380bf1d252a9cdaf2a527b54cd5087d0..0000000000000000000000000000000000000000 --- a/backport-src-gpasswd-Clear-password-in-more-cases.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 6b4bbbeecd676c9423f82658bb3a8f6990218e8d Mon Sep 17 00:00:00 2001 -From: Tobias Stoeckmann -Date: Sun, 19 Jan 2025 21:27:50 +0100 -Subject: [PATCH] src/gpasswd: Clear password in more cases - -If encryption of password fails, clear the memory before exiting. - -Reviewed-by: Alejandro Colomar -Signed-off-by: Tobias Stoeckmann ---- - src/gpasswd.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/gpasswd.c b/src/gpasswd.c -index 560b0ea7..e9e111a9 100644 ---- a/src/gpasswd.c -+++ b/src/gpasswd.c -@@ -864,13 +864,13 @@ static void change_passwd (struct group *gr) - - salt = crypt_make_salt (NULL, NULL); - cp = pw_encrypt (pass, salt); -+ memzero (pass, sizeof pass); - if (NULL == cp) { - fprintf (stderr, - _("%s: failed to crypt password with salt '%s': %s\n"), - Prog, salt, strerror (errno)); - exit (1); - } -- memzero (pass, sizeof pass); - #ifdef SHADOWGRP - if (is_shadowgrp) { - gr->gr_passwd = SHADOW_PASSWD_STRING; --- -2.33.0 - diff --git a/backport-src-groupmod.c-delete-gr_free_members-grp-to-avoid-d.patch b/backport-src-groupmod.c-delete-gr_free_members-grp-to-avoid-d.patch deleted file mode 100644 index 47193109a711f7f00838780305ebceb77059eec7..0000000000000000000000000000000000000000 --- a/backport-src-groupmod.c-delete-gr_free_members-grp-to-avoid-d.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 10429edc14673fbb8c78b25f1872c34e88e5f07f Mon Sep 17 00:00:00 2001 -From: lixinyun -Date: Wed, 29 May 2024 06:53:02 +0800 -Subject: [PATCH] src/groupmod.c: delete gr_free_members(&grp) to avoid double - free - -Groupmod -U may cause crashes because of double free. If without -a, the first free of (*ogrp).gr_mem is in gr_free_members(&grp), and then in gr_update without -n or gr_remove with -n. -Considering the minimal impact of modifications on existing code, delete gr_free_members(&grp) to avoid double free.Although this may seem reckless, the second free in two different positions will definitely be triggered, and the following two test cases can be used to illustrate the situation : - -[root@localhost src]# ./useradd u1 -[root@localhost src]# ./useradd u2 -[root@localhost src]# ./useradd u3 -[root@localhost src]# ./groupadd -U u1,u2,u3 g1 -[root@localhost src]# ./groupmod -n g2 -U u1,u2 g1 -Segmentation fault - -This case would free (*ogrp).gr_mem in gr_free_members(&grp) due to assignment statements grp = *ogrp, then in if (nflg && (gr_remove (group_name) == 0)), which finally calls gr_free_members(grent) to free (*ogrp).gr_mem again. - -[root@localhost src]# ./useradd u1 -[root@localhost src]# ./useradd u2 -[root@localhost src]# ./useradd u3 -[root@localhost src]# ./groupadd -U u1,u2,u3 g1 -[root@localhost src]# ./groupmod -U u1,u2 g1 -Segmentation fault - -The other case would free (*ogrp).gr_mem in gr_free_members(&grp) too, then in if (gr_update (&grp) == 0), which finally calls gr_free_members(grent) too to free (*ogrp).gr_mem again. - -So the first free is unnecessary, maybe we can drop it. - -Fixes: 342c934a3590 ("add -U option to groupadd and groupmod") -Closes: -Link: -Link: -Link: -Cc: "Serge E. Hallyn" -Reviewed-by: Alejandro Colomar -Signed-off-by: lixinyun - -Conflict: N/A -Reference: https://github.com/shadow-maint/shadow/commit/10429edc14673fbb8c78b25f1872c34e88e5f07f - ---- - src/groupmod.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/src/groupmod.c b/src/groupmod.c -index a29cf73f..989d7ea3 100644 ---- a/src/groupmod.c -+++ b/src/groupmod.c -@@ -250,8 +250,6 @@ static void grp_update (void) - - if (!aflg) { - // requested to replace the existing groups -- if (NULL != grp.gr_mem[0]) -- gr_free_members(&grp); - grp.gr_mem = XMALLOC(1, char *); - grp.gr_mem[0] = NULL; - } else { --- -2.33.0 - diff --git a/backport-src-useradd.c-get_groups-Fix-memory-leak.patch b/backport-src-useradd.c-get_groups-Fix-memory-leak.patch deleted file mode 100644 index c41111813b339a4ee5907ca5e49ee1db2f80c40d..0000000000000000000000000000000000000000 --- a/backport-src-useradd.c-get_groups-Fix-memory-leak.patch +++ /dev/null @@ -1,32 +0,0 @@ -From feead2f639506d49cef9dde385eb56cd3413ecf0 Mon Sep 17 00:00:00 2001 -From: sgakerru -Date: Sat, 19 Oct 2024 13:26:44 +0400 -Subject: [PATCH] src/useradd.c: get_groups(): Fix memory leak - ---- - src/useradd.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/src/useradd.c b/src/useradd.c -index 64e7a412..bd3b0624 100644 ---- a/src/useradd.c -+++ b/src/useradd.c -@@ -760,6 +760,15 @@ static int get_groups (char *list) - int errors = 0; - int ngroups = 0; - -+ /* -+ * Free previous group list before creating a new one. -+ */ -+ int i = 0; -+ while (NULL != user_groups[i]) { -+ free(user_groups[i]); -+ user_groups[i++] = NULL; -+ } -+ - if ('\0' == *list) { - return 0; - } --- -2.33.0 - diff --git a/backport-src-usermod.c-update_group_file-Fix-RESOURCE_LEAK-CW.patch b/backport-src-usermod.c-update_group_file-Fix-RESOURCE_LEAK-CW.patch deleted file mode 100644 index 7673f7c2955563ad3f137c7739745e613429ae7a..0000000000000000000000000000000000000000 --- a/backport-src-usermod.c-update_group_file-Fix-RESOURCE_LEAK-CW.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 61964aa06b9e6e0643a6519f64290f18ac04867f Mon Sep 17 00:00:00 2001 -From: Alejandro Colomar -Date: Thu, 16 May 2024 13:54:06 +0200 -Subject: [PATCH] src/usermod.c: update_group_file(): Fix RESOURCE_LEAK - (CWE-772) - -Report: -> shadow-4.15.0/src/usermod.c:734:3: alloc_fn: Storage is returned from allocation function "__gr_dup". -> shadow-4.15.0/src/usermod.c:734:3: var_assign: Assigning: "ngrp" = storage returned from "__gr_dup(grp)". -> shadow-4.15.0/src/usermod.c:815:1: leaked_storage: Variable "ngrp" going out of scope leaks the storage it points to. -> 813| gr_free(ngrp); -> 814| } -> 815|-> } -> 816| -> 817| #ifdef SHADOWGRP - -Link: https://issues.redhat.com/browse/RHEL-35383 -Reported-by: Iker Pedrosa -Signed-off-by: Alejandro Colomar - -Conflict: N/A -Reference: https://github.com/shadow-maint/shadow/commit/61964aa06b9e6e0643a6519f64290f18ac04867f - ---- - src/usermod.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/usermod.c b/src/usermod.c -index 3048f801..e0cfdd83 100644 ---- a/src/usermod.c -+++ b/src/usermod.c -@@ -780,9 +780,8 @@ update_group_file(void) - SYSLOG ((LOG_INFO, "add '%s' to group '%s'", - user_newname, ngrp->gr_name)); - } -- if (!changed) { -- continue; -- } -+ if (!changed) -+ goto free_ngrp; - - changed = false; - if (gr_update (ngrp) == 0) { -@@ -793,6 +792,7 @@ update_group_file(void) - fail_exit (E_GRP_UPDATE); - } - -+free_ngrp: - gr_free(ngrp); - } - } --- -2.33.0 - diff --git a/backport-src-usermod.c-update_gshadow_file-Fix-RESOURCE_LEAK-.patch b/backport-src-usermod.c-update_gshadow_file-Fix-RESOURCE_LEAK-.patch deleted file mode 100644 index dfa9d1342c9f14ecf3a30ab066f2eb0cb16d4cbb..0000000000000000000000000000000000000000 --- a/backport-src-usermod.c-update_gshadow_file-Fix-RESOURCE_LEAK-.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 71a3238b7996285fc3c8dec841244ba95d663fa5 Mon Sep 17 00:00:00 2001 -From: Alejandro Colomar -Date: Fri, 17 May 2024 02:15:15 +0200 -Subject: [PATCH] src/usermod.c: update_gshadow_file(): Fix RESOURCE_LEAK - (CWE-772) - -Report: -> shadow-4.15.0/src/usermod.c:864:3: alloc_fn: Storage is returned from allocation function "__sgr_dup". -> shadow-4.15.0/src/usermod.c:864:3: var_assign: Assigning: "nsgrp" = storage returned from "__sgr_dup(sgrp)". -> shadow-4.15.0/src/usermod.c:964:1: leaked_storage: Variable "nsgrp" going out of scope leaks the storage it points to. -> 962| free (nsgrp); -> 963| } -> 964|-> } -> 965| #endif /* SHADOWGRP */ -> 966| - -Link: https://issues.redhat.com/browse/RHEL-35383 -Reported-by: Iker Pedrosa -Signed-off-by: Alejandro Colomar - -Conflict: N/A -Reference: https://github.com/shadow-maint/shadow/commit/71a3238b7996285fc3c8dec841244ba95d663fa5 - ---- - src/usermod.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/usermod.c b/src/usermod.c -index e0cfdd83..bb5d3535 100644 ---- a/src/usermod.c -+++ b/src/usermod.c -@@ -921,9 +921,8 @@ update_gshadow_file(void) - SYSLOG ((LOG_INFO, "add '%s' to shadow group '%s'", - user_newname, nsgrp->sg_name)); - } -- if (!changed) { -- continue; -- } -+ if (!changed) -+ goto free_nsgrp; - - changed = false; - -@@ -939,6 +938,7 @@ update_gshadow_file(void) - fail_exit (E_GRP_UPDATE); - } - -+free_nsgrp: - free (nsgrp); - } - } --- -2.33.0 - diff --git a/limit-username-length-to-32.patch b/limit-username-length-to-32.patch index 23e9f3a836c29c221464148e006f1b70be02394e..0673190f0ef4d8a27d59e95707328d959005adbd 100644 --- a/limit-username-length-to-32.patch +++ b/limit-username-length-to-32.patch @@ -4,31 +4,28 @@ Date: Thu, 16 Jan 2025 16:30:09 +0800 Subject: [PATCH] limit username length to 32 --- - lib/chkname.c | 4 ++-- + lib/chkname.c | 2 +- lib/chkname.h | 4 ++++ - 2 files changed, 6 insertions(+), 2 deletions(-) + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/chkname.c b/lib/chkname.c -index 2b83361..ae6180f 100644 +index 57d6d96..983372d 100644 --- a/lib/chkname.c +++ b/lib/chkname.c -@@ -75,9 +75,9 @@ static bool is_valid_name (const char *name) - bool is_valid_user_name (const char *name) +@@ -113,7 +113,7 @@ is_valid_name(const char *name) + bool + is_valid_user_name(const char *name) { - /* -- * User names length are limited by the kernel -+ * User names length are limited by USER_NAME_MAX_LENGTH - */ -- if (strlen (name) > sysconf(_SC_LOGIN_NAME_MAX)) { -+ if (strlen (name) > USER_NAME_MAX_LENGTH) { +- if (strlen(name) >= login_name_max_size()) { ++ if (strlen(name) > USER_NAME_MAX_LENGTH) { + errno = EOVERFLOW; return false; } - diff --git a/lib/chkname.h b/lib/chkname.h -index 0771347..4af8f32 100644 +index 4306a8a..09e045d 100644 --- a/lib/chkname.h +++ b/lib/chkname.h -@@ -25,3 +25,7 @@ extern bool is_valid_user_name (const char *name); +@@ -32,3 +32,7 @@ extern bool is_valid_user_name (const char *name); extern bool is_valid_group_name (const char *name); #endif @@ -37,5 +34,5 @@ index 0771347..4af8f32 100644 +#define USER_NAME_MAX_LENGTH 32 +#endif -- -2.18.2 +2.43.0 diff --git a/shadow-4.14.3.tar.xz b/shadow-4.14.3.tar.xz deleted file mode 100644 index 3795345c6fd56ac2fdf0086224fd1ea39233e693..0000000000000000000000000000000000000000 Binary files a/shadow-4.14.3.tar.xz and /dev/null differ diff --git a/shadow-4.18.0.tar.xz b/shadow-4.18.0.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..d4d2192ff4abcb18cd3bfda91c46208c8a8cef30 Binary files /dev/null and b/shadow-4.18.0.tar.xz differ diff --git a/shadow-add-sm3-crypt-support.patch b/shadow-add-sm3-crypt-support.patch index b5ee39e0052c05e66a90156fc5ecd9d019b41cb2..9d8ef7f1b819774be45f63a41f5464f61e59fbf4 100644 --- a/shadow-add-sm3-crypt-support.patch +++ b/shadow-add-sm3-crypt-support.patch @@ -20,7 +20,7 @@ diff --git a/configure.ac b/configure.ac index 5dcd22e..c9cbbf7 100644 --- a/configure.ac +++ b/configure.ac -@@ -249,6 +249,9 @@ AC_ARG_WITH(libcrack, +@@ -249,6 +249,9 @@ AC_ARG_WITH(tcb, AC_ARG_WITH(sha-crypt, [AS_HELP_STRING([--with-sha-crypt], [allow the SHA256 and SHA512 password encryption algorithms @<:@default=yes@:>@])], [with_sha_crypt=$withval], [with_sha_crypt=yes]) @@ -112,14 +112,14 @@ index 88a8773..b452092 100644 --- a/lib/obscure.c +++ b/lib/obscure.c @@ -198,6 +198,9 @@ static /*@observer@*//*@null@*/const char *obscure_msg ( - || (strcmp (result, "SHA256") == 0) - || (strcmp (result, "SHA512") == 0) + || streq(result, "SHA256") + || streq(result, "SHA512") #endif +#ifdef USE_SM3_CRYPT -+ || (strcmp (result, "SM3") == 0) ++ || streq(result, "SM3") +#endif #ifdef USE_BCRYPT - || (strcmp (result, "BCRYPT") == 0) + || streq(result, "BCRYPT") #endif diff --git a/lib/salt.c b/lib/salt.c index dc242ff..e584cc1 100644 @@ -249,13 +249,13 @@ index dc242ff..e584cc1 100644 SHA_salt_rounds_to_buf (result, rounds); #endif /* USE_SHA_CRYPT */ +#ifdef USE_SM3_CRYPT -+ } else if (0 == strcmp (method, "SM3")) { ++ } else if (streq(method, "SM3")) { + strcpy(result, "$sm3$"); + salt_len = SM3_CRYPT_SALT_SIZE; + rounds = SM3_get_salt_rounds ((int *) arg); + SM3_salt_rounds_to_buf (result, rounds); +#endif /* USE_SM3_CRYPT */ - } else if (0 != strcmp (method, "DES")) { + } else if (!streq(method, "DES")) { fprintf (log_get_logfd(), _("Invalid ENCRYPT_METHOD value: '%s'.\n" diff --git a/src/chgpasswd.c b/src/chgpasswd.c @@ -263,7 +263,7 @@ index 7b773e2..a751dda 100644 --- a/src/chgpasswd.c +++ b/src/chgpasswd.c @@ -39,15 +39,18 @@ - const char *Prog; + static const char Prog[] = "chgpasswd"; static bool eflg = false; static bool md5flg = false; -#if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT) @@ -350,8 +350,8 @@ index 7b773e2..a751dda 100644 } #endif /* USE_YESCRYPT */ +#if defined(USE_SM3_CRYPT) -+ if (( (0 == strcmp (crypt_method, "SM3")) -+ && (0 == getlong(optarg, &sm3_rounds)))) { ++ if (( streq(crypt_method, "SM3") ++ && (-1 == str2sl(&sm3_rounds, optarg)))) { + bad_s = 1; + } +#endif /* USE_SM3_CRYPT */ @@ -378,10 +378,10 @@ index 7b773e2..a751dda 100644 _("%s: %s flag is only allowed with the %s flag\n"), @@ -268,6 +280,9 @@ static void check_flags (void) #ifdef USE_YESCRYPT - && (0 != strcmp (crypt_method, "YESCRYPT")) + && !streq(crypt_method, "YESCRYPT") #endif /* USE_YESCRYPT */ +#ifdef USE_SM3_CRYPT -+ && (0 != strcmp (crypt_method, "SM3")) ++ && !streq(crypt_method, "SM3") +#endif /* USE_SM3_CRYPT */ ) { fprintf (stderr, @@ -394,13 +394,13 @@ index 7b773e2..a751dda 100644 +#if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT) || defined(USE_SM3_CRYPT) if (sflg) { #if defined(USE_SHA_CRYPT) - if ( (0 == strcmp (crypt_method, "SHA256")) + if ( streq(crypt_method, "SHA256") @@ -516,6 +531,11 @@ int main (int argc, char **argv) arg = &yescrypt_cost; } #endif /* USE_YESCRYPT */ +#if defined(USE_SM3_CRYPT) -+ if (0 == strcmp (crypt_method, "SM3")) { ++ if (streq(crypt_method, "SM3")) { + arg = &sm3_rounds; + } +#endif /* USE_SM3_CRYPT */ @@ -412,7 +412,7 @@ index 1a1a5d5..a2b6e9e 100644 --- a/src/chpasswd.c +++ b/src/chpasswd.c @@ -38,7 +38,7 @@ - const char *Prog; + static const char Prog[] = "chpasswd"; static bool eflg = false; static bool md5flg = false; -#if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT) @@ -497,7 +497,7 @@ index 1a1a5d5..a2b6e9e 100644 - if (bad_s != 0) { +#if defined(USE_SM3_CRYPT) + if (IS_CRYPT_METHOD("SM3") -+ && (0 == getlong(optarg, &sm3_rounds))) { ++ && (-1 == str2sl(&sm3_rounds, optarg))) { + bad_s = 1; + } +#endif /* USE_SM3_CRYPT */ @@ -596,21 +596,21 @@ index 08f7979..6effa82 100644 #endif /* USE_YESCRYPT */ +#if defined(USE_SM3_CRYPT) + if (sflg) { -+ if (0 == strcmp (crypt_method, "SM3")) { ++ if (streq(crypt_method, "SM3")) { + crypt_arg = &sm3_rounds; + } + } +#endif /* USE_SM3_CRYPT */ } - if ((NULL != crypt_method) && (0 == strcmp(crypt_method, "NONE"))) { + if ((NULL != crypt_method) && streq(crypt_method, "NONE")) { @@ -492,6 +505,13 @@ static int add_passwd (struct passwd *pwd, const char *password) } } #endif /* USE_PAM */ +#if defined(USE_SM3_CRYPT) + if (sflg) { -+ if (0 == strcmp (crypt_method, "SM3")) { ++ if (streq(crypt_method, "SM3")) { + crypt_arg = &sm3_rounds; + } + } @@ -670,8 +670,8 @@ index 08f7979..6effa82 100644 } #endif /* USE_YESCRYPT */ +#if defined(USE_SM3_CRYPT) -+ if (( (0 == strcmp (crypt_method, "SM3")) -+ && (0 == getlong(optarg, &sm3_rounds)))) { ++ if (( streq(crypt_method, "SM3") ++ && (-1 == str2sl(&sm3_rounds, optarg)))) { + bad_s = 1; + } +#endif /* USE_SM3_CRYPT */ @@ -703,16 +703,16 @@ index 08f7979..6effa82 100644 +#endif /* USE_SHA_CRYPT || USE_BCRYPT || USE_YESCRYPT || USE_SM3_CRYPT */ if (cflg) { - if ( (0 != strcmp (crypt_method, "DES")) + if ( !streq(crypt_method, "DES") @@ -745,6 +771,9 @@ static void check_flags (void) - && (0 != strcmp (crypt_method, "SHA256")) - && (0 != strcmp (crypt_method, "SHA512")) + && !streq(crypt_method, "SHA256") + && !streq(crypt_method, "SHA512") #endif /* USE_SHA_CRYPT */ +#ifdef USE_SM3_CRYPT -+ && (0 != strcmp (crypt_method, "SM3")) ++ && !streq(crypt_method, "SM3") +#endif /* USE_SM3_CRYPT */ #ifdef USE_BCRYPT - && (0 != strcmp (crypt_method, "BCRYPT")) + && !streq(crypt_method, "BCRYPT") #endif /* USE_BCRYPT */ diff --git a/src/passwd.c b/src/passwd.c index 5d59e8c..20284c6 100644 @@ -738,10 +738,10 @@ index 5d59e8c..20284c6 100644 static bool do_update_pwd = false; @@ -268,6 +268,9 @@ static int new_password (const struct passwd *pw) #ifdef USE_YESCRYPT - || (strcmp (method, "YESCRYPT") == 0) + || streq(method, "YESCRYPT") #endif /* USE_YESCRYPT*/ +#ifdef USE_SM3_CRYPT -+ || (strcmp (method, "SM3") == 0) ++ || streq(method, "SM3") +#endif /* USE_SM3_CRYPT */ ) { diff --git a/shadow.spec b/shadow.spec index 48a801e6b25098dd80bd3624579b53bcee7cf546..48e220e655b338ea5b2445a9dd5e2610baaead61 100644 --- a/shadow.spec +++ b/shadow.spec @@ -1,6 +1,6 @@ Name: shadow -Version: 4.14.3 -Release: 9 +Version: 4.18.0 +Release: 1 Epoch: 2 License: BSD-3-Clause AND GPL-2.0-or-later Summary: Tools for managing accounts and shadow password files @@ -19,19 +19,7 @@ Source7: newusers Patch0: usermod-unlock.patch Patch1: shadow-add-sm3-crypt-support.patch Patch2: shadow-Remove-encrypted-passwd-for-useradd-gr.patch -Patch3: backport-port-fix-OVERRUN-CWE-119.patch -Patch4: backport-src-usermod.c-update_group_file-Fix-RESOURCE_LEAK-CW.patch -Patch5: backport-src-usermod.c-update_gshadow_file-Fix-RESOURCE_LEAK-.patch -Patch6: backport-src-groupmod.c-delete-gr_free_members-grp-to-avoid-d.patch - -Patch7: backport-lib-idmapping.c--Use-long-constants-in-prctl-2.patch -Patch8: backport-libsubid-Dealocate-memory-on-exit.patch -Patch9: backport-man-lastlog-remove-wrong-use-of-keyword-term.patch -Patch10: limit-username-length-to-32.patch -Patch11: backport-lib-csrand.c-Fix-the-lower-part-of-the-domain-of-csr.patch -Patch12: backport-src-useradd.c-get_groups-Fix-memory-leak.patch -Patch13: backport-src-gpasswd-Clear-password-in-more-cases.patch -Patch14: backport-lib-encrypt.c-Do-not-exit-in-error-case.patch +Patch3: limit-username-length-to-32.patch BuildRequires: gcc, libselinux-devel, audit-libs-devel, libsemanage-devel BuildRequires: libacl-devel, libattr-devel @@ -102,7 +90,6 @@ done rm $RPM_BUILD_ROOT/%{_bindir}/chfn rm $RPM_BUILD_ROOT/%{_bindir}/chsh rm $RPM_BUILD_ROOT/%{_bindir}/expiry -rm $RPM_BUILD_ROOT/%{_bindir}/groups rm $RPM_BUILD_ROOT/%{_bindir}/login rm $RPM_BUILD_ROOT/%{_bindir}/passwd rm $RPM_BUILD_ROOT/%{_bindir}/su @@ -115,8 +102,6 @@ rm $RPM_BUILD_ROOT/%{_mandir}/man1/chsh.* rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/chsh.* rm $RPM_BUILD_ROOT/%{_mandir}/man1/expiry.* rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/expiry.* -rm $RPM_BUILD_ROOT/%{_mandir}/man1/groups.* -rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/groups.* rm $RPM_BUILD_ROOT/%{_mandir}/man1/login.* rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/login.* rm $RPM_BUILD_ROOT/%{_mandir}/man1/passwd.* @@ -125,7 +110,6 @@ rm $RPM_BUILD_ROOT/%{_mandir}/man1/su.* rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/su.* rm $RPM_BUILD_ROOT/%{_mandir}/man5/passwd.* rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/passwd.* -rm $RPM_BUILD_ROOT/%{_mandir}/man5/suauth.* rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/suauth.* rm $RPM_BUILD_ROOT/%{_mandir}/man8/logoutd.* rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/logoutd.* @@ -195,6 +179,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.{la,a} %{_mandir}/*/* %changelog +* Thu Dec 04 2025 yixiangzhike - 2:4.18.0-1 +- update to 4.18.0 + * Wed Nov 05 2025 Funda Wang - 2:4.14.3-9 - drop useless gnome-doc-utils buildrequirement diff --git a/usermod-unlock.patch b/usermod-unlock.patch index a26afe348d63e1ec13036d6605310e3f6caac1cb..a56f5a4554ca0ccb62749713bb5319c3d991d760 100644 --- a/usermod-unlock.patch +++ b/usermod-unlock.patch @@ -3,9 +3,9 @@ Index: shadow-4.5/src/usermod.c --- a/src/usermod.c +++ b/src/usermod.c @@ -434,12 +434,17 @@ static char *new_pw_passwd (char *pw_pass) - strcat (buf, pw_pass); - pw_pass = buf; - } else if (Uflg && pw_pass[0] == '!') { + SYSLOG ((LOG_INFO, "lock user '%s' password", user_newname)); + pw_pass = xaprintf("!%s", pw_pass); + } else if (Uflg && strprefix(pw_pass, "!")) { - if (pw_pass[1] == '\0') { + char *s = pw_pass; + @@ -35,10 +35,10 @@ Index: shadow-4.5/src/usermod.c + } #ifdef WITH_AUDIT audit_logger (AUDIT_USER_CHAUTHTOK, Prog, - "changing password", user_newname, user_newid, 1); + "updating-password", user_newname, user_newid, 1); @@ -495,6 +507,8 @@ static void new_pwent (struct passwd *pwent) if ( (!is_shadow_pwd) - || (strcmp (pwent->pw_passwd, SHADOW_PASSWD_STRING) != 0)) { + || !streq(pwent->pw_passwd, SHADOW_PASSWD_STRING)) { pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd); + if (pwent->pw_passwd == NULL) + fail_exit (E_PW_UPDATE); @@ -53,5 +53,5 @@ Index: shadow-4.5/src/usermod.c + fail_exit(E_PW_UPDATE); if (pflg) { - spent->sp_lstchg = gettime () / SCALE; + spent->sp_lstchg = gettime () / DAY;