summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended/shadow/files
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-extended/shadow/files')
-rw-r--r--meta/recipes-extended/shadow/files/0001-Do-not-read-login.defs-before-doing-chroot.patch46
-rw-r--r--meta/recipes-extended/shadow/files/0001-su.c-fix-to-exec-command-correctly.patch25
-rw-r--r--meta/recipes-extended/shadow/files/0001-useradd.c-create-parent-directories-when-necessary.patch109
-rw-r--r--meta/recipes-extended/shadow/files/allow-for-setting-password-in-clear-text.patch201
-rw-r--r--meta/recipes-extended/shadow/files/check_size_of_uid_t_and_gid_t_using_AC_CHECK_SIZEOF.patch41
-rw-r--r--meta/recipes-extended/shadow/files/commonio.c-fix-unexpected-open-failure-in-chroot-env.patch46
-rw-r--r--meta/recipes-extended/shadow/files/disable-syslog.patch34
-rw-r--r--meta/recipes-extended/shadow/files/fix-installation-failure-with-subids-disabled.patch28
-rw-r--r--meta/recipes-extended/shadow/files/login.defs_shadow-sysroot386
-rw-r--r--meta/recipes-extended/shadow/files/login_defs_pam.sed32
-rw-r--r--meta/recipes-extended/shadow/files/pam.d/chfn14
-rw-r--r--meta/recipes-extended/shadow/files/pam.d/chpasswd4
-rw-r--r--meta/recipes-extended/shadow/files/pam.d/chsh19
-rw-r--r--meta/recipes-extended/shadow/files/pam.d/login81
-rw-r--r--meta/recipes-extended/shadow/files/pam.d/newusers4
-rw-r--r--meta/recipes-extended/shadow/files/pam.d/passwd5
-rw-r--r--meta/recipes-extended/shadow/files/pam.d/su57
-rw-r--r--meta/recipes-extended/shadow/files/securetty234
-rw-r--r--meta/recipes-extended/shadow/files/shadow-4.1.3-dots-in-usernames.patch27
-rw-r--r--meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch91
-rw-r--r--meta/recipes-extended/shadow/files/usermod-fix-compilation-failure-with-subids-disabled.patch33
21 files changed, 1517 insertions, 0 deletions
diff --git a/meta/recipes-extended/shadow/files/0001-Do-not-read-login.defs-before-doing-chroot.patch b/meta/recipes-extended/shadow/files/0001-Do-not-read-login.defs-before-doing-chroot.patch
new file mode 100644
index 0000000000..828b95a572
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/0001-Do-not-read-login.defs-before-doing-chroot.patch
@@ -0,0 +1,46 @@
1From 170c25c8e0b5c3dc2615d1db94c8d24a13ff99bf Mon Sep 17 00:00:00 2001
2From: Peter Kjellerstedt <pkj@axis.com>
3Date: Thu, 11 Sep 2014 15:11:23 +0200
4Subject: [PATCH] Do not read login.defs before doing chroot()
5
6If "useradd --root <root> ..." was used, the login.defs file would still
7be read from /etc/login.defs instead of <root>/etc/login.defs. This was
8due to getdef_ulong() being called before process_root_flag().
9
10Upstream-Status: Submitted [http://lists.alioth.debian.org/pipermail/pkg-shadow-devel/2014-September/010446.html]
11
12Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
13---
14 src/useradd.c | 8 ++++++--
15 1 file changed, 6 insertions(+), 2 deletions(-)
16
17diff --git a/src/useradd.c b/src/useradd.c
18index a8a1f76..e1ebf50 100644
19--- a/src/useradd.c
20+++ b/src/useradd.c
21@@ -1993,9 +1993,11 @@ int main (int argc, char **argv)
22 #endif /* USE_PAM */
23 #endif /* ACCT_TOOLS_SETUID */
24
25+#ifdef ENABLE_SUBIDS
26 /* Needed for userns check */
27- uid_t uid_min = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
28- uid_t uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
29+ uid_t uid_min;
30+ uid_t uid_max;
31+#endif
32
33 /*
34 * Get my name so that I can use it to report errors.
35@@ -2026,6 +2028,8 @@ int main (int argc, char **argv)
36 is_shadow_grp = sgr_file_present ();
37 #endif
38 #ifdef ENABLE_SUBIDS
39+ uid_min = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
40+ uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
41 is_sub_uid = sub_uid_file_present () && !rflg &&
42 (!user_id || (user_id <= uid_max && user_id >= uid_min));
43 is_sub_gid = sub_gid_file_present () && !rflg &&
44--
451.9.0
46
diff --git a/meta/recipes-extended/shadow/files/0001-su.c-fix-to-exec-command-correctly.patch b/meta/recipes-extended/shadow/files/0001-su.c-fix-to-exec-command-correctly.patch
new file mode 100644
index 0000000000..31337de362
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/0001-su.c-fix-to-exec-command-correctly.patch
@@ -0,0 +1,25 @@
1Upstream-Status: Pending
2
3Subject: su.c: fix to exec command correctly
4
5Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
6---
7 src/su.c | 2 +-
8 1 file changed, 1 insertion(+), 1 deletion(-)
9
10diff --git a/src/su.c b/src/su.c
11index 3704217..bc4f2ac 100644
12--- a/src/su.c
13+++ b/src/su.c
14@@ -1156,7 +1156,7 @@ int main (int argc, char **argv)
15 * Use the shell and create an argv
16 * with the rest of the command line included.
17 */
18- argv[-1] = cp;
19+ argv[-1] = shellstr;
20 execve_shell (shellstr, &argv[-1], environ);
21 err = errno;
22 (void) fprintf (stderr,
23--
241.7.9.5
25
diff --git a/meta/recipes-extended/shadow/files/0001-useradd.c-create-parent-directories-when-necessary.patch b/meta/recipes-extended/shadow/files/0001-useradd.c-create-parent-directories-when-necessary.patch
new file mode 100644
index 0000000000..85dde8e1bb
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/0001-useradd.c-create-parent-directories-when-necessary.patch
@@ -0,0 +1,109 @@
1Upstream-Status: Inappropriate [OE specific]
2
3Subject: useradd.c: create parent directories when necessary
4
5Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
6---
7 src/useradd.c | 72 +++++++++++++++++++++++++++++++++++++++------------------
8 1 file changed, 49 insertions(+), 23 deletions(-)
9
10diff --git a/src/useradd.c b/src/useradd.c
11index 4bd969d..cb5dd6c 100644
12--- a/src/useradd.c
13+++ b/src/useradd.c
14@@ -1893,6 +1893,35 @@ static void usr_update (void)
15 }
16
17 /*
18+ * mkdir_p - create directories, including parent directories when needed
19+ *
20+ * similar to `mkdir -p'
21+ */
22+void mkdir_p(const char *path) {
23+ int len = strlen(path);
24+ char newdir[len + 1];
25+ mode_t mode = 0755;
26+ int i = 0;
27+
28+ if (path[i] == '\0') {
29+ return;
30+ }
31+
32+ /* skip the leading '/' */
33+ i++;
34+
35+ while(path[i] != '\0') {
36+ if (path[i] == '/') {
37+ strncpy(newdir, path, i);
38+ newdir[i] = '\0';
39+ mkdir(newdir, mode);
40+ }
41+ i++;
42+ }
43+ mkdir(path, mode);
44+}
45+
46+/*
47 * create_home - create the user's home directory
48 *
49 * create_home() creates the user's home directory if it does not
50@@ -1907,36 +1936,33 @@ static void create_home (void)
51 fail_exit (E_HOMEDIR);
52 }
53 #endif
54- /* XXX - create missing parent directories. --marekm */
55- if (mkdir (user_home, 0) != 0) {
56- fprintf (stderr,
57- _("%s: cannot create directory %s\n"),
58- Prog, user_home);
59-#ifdef WITH_AUDIT
60- audit_logger (AUDIT_ADD_USER, Prog,
61- "adding home directory",
62- user_name, (unsigned int) user_id,
63- SHADOW_AUDIT_FAILURE);
64-#endif
65- fail_exit (E_HOMEDIR);
66- }
67- chown (user_home, user_id, user_gid);
68- chmod (user_home,
69- 0777 & ~getdef_num ("UMASK", GETDEF_DEFAULT_UMASK));
70- home_added = true;
71+ mkdir_p(user_home);
72+ }
73+ if (access (user_home, F_OK) != 0) {
74 #ifdef WITH_AUDIT
75 audit_logger (AUDIT_ADD_USER, Prog,
76 "adding home directory",
77 user_name, (unsigned int) user_id,
78- SHADOW_AUDIT_SUCCESS);
79+ SHADOW_AUDIT_FAILURE);
80 #endif
81-#ifdef WITH_SELINUX
82- /* Reset SELinux to create files with default contexts */
83- if (reset_selinux_file_context () != 0) {
84- fail_exit (E_HOMEDIR);
85- }
86+ fail_exit (E_HOMEDIR);
87+ }
88+ chown (user_home, user_id, user_gid);
89+ chmod (user_home,
90+ 0777 & ~getdef_num ("UMASK", GETDEF_DEFAULT_UMASK));
91+ home_added = true;
92+#ifdef WITH_AUDIT
93+ audit_logger (AUDIT_ADD_USER, Prog,
94+ "adding home directory",
95+ user_name, (unsigned int) user_id,
96+ SHADOW_AUDIT_SUCCESS);
97 #endif
98+#ifdef WITH_SELINUX
99+ /* Reset SELinux to create files with default contexts */
100+ if (reset_selinux_file_context () != 0) {
101+ fail_exit (E_HOMEDIR);
102 }
103+#endif
104 }
105
106 /*
107--
1081.7.9.5
109
diff --git a/meta/recipes-extended/shadow/files/allow-for-setting-password-in-clear-text.patch b/meta/recipes-extended/shadow/files/allow-for-setting-password-in-clear-text.patch
new file mode 100644
index 0000000000..68da25f406
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/allow-for-setting-password-in-clear-text.patch
@@ -0,0 +1,201 @@
1Upstream-Status: Inappropriate [OE specific]
2
3Allow for setting password in clear text.
4
5Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
6---
7 src/Makefile.am | 8 ++++----
8 src/groupadd.c | 8 +++++++-
9 src/groupmod.c | 8 +++++++-
10 src/useradd.c | 9 +++++++--
11 src/usermod.c | 8 +++++++-
12 5 files changed, 32 insertions(+), 9 deletions(-)
13
14diff --git a/src/Makefile.am b/src/Makefile.am
15index 25e288d..856b087 100644
16--- a/src/Makefile.am
17+++ b/src/Makefile.am
18@@ -88,10 +88,10 @@ chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBSELINUX) $(LIBCRYPT)
19 chsh_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
20 chpasswd_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT)
21 gpasswd_LDADD = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT)
22-groupadd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
23+groupadd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT)
24 groupdel_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
25 groupmems_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX)
26-groupmod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
27+groupmod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT)
28 grpck_LDADD = $(LDADD) $(LIBSELINUX)
29 grpconv_LDADD = $(LDADD) $(LIBSELINUX)
30 grpunconv_LDADD = $(LDADD) $(LIBSELINUX)
31@@ -111,9 +111,9 @@ su_SOURCES = \
32 suauth.c
33 su_LDADD = $(LDADD) $(LIBPAM) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
34 sulogin_LDADD = $(LDADD) $(LIBCRYPT)
35-useradd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR)
36+useradd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR) $(LIBCRYPT)
37 userdel_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE)
38-usermod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR)
39+usermod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR) $(LIBCRYPT)
40 vipw_LDADD = $(LDADD) $(LIBSELINUX)
41
42 install-am: all-am
43diff --git a/src/groupadd.c b/src/groupadd.c
44index f716f57..4e28c26 100644
45--- a/src/groupadd.c
46+++ b/src/groupadd.c
47@@ -124,6 +124,7 @@ static /*@noreturn@*/void usage (int status)
48 (void) fputs (_(" -o, --non-unique allow to create groups with duplicate\n"
49 " (non-unique) GID\n"), usageout);
50 (void) fputs (_(" -p, --password PASSWORD use this encrypted password for the new group\n"), usageout);
51+ (void) fputs (_(" -P, --clear-password PASSWORD use this clear password for the new group\n"), usageout);
52 (void) fputs (_(" -r, --system create a system account\n"), usageout);
53 (void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
54 (void) fputs ("\n", usageout);
55@@ -387,12 +388,13 @@ static void process_flags (int argc, char **argv)
56 {"key", required_argument, NULL, 'K'},
57 {"non-unique", no_argument, NULL, 'o'},
58 {"password", required_argument, NULL, 'p'},
59+ {"clear-password", required_argument, NULL, 'P'},
60 {"system", no_argument, NULL, 'r'},
61 {"root", required_argument, NULL, 'R'},
62 {NULL, 0, NULL, '\0'}
63 };
64
65- while ((c = getopt_long (argc, argv, "fg:hK:op:rR:",
66+ while ((c = getopt_long (argc, argv, "fg:hK:op:P:rR:",
67 long_options, NULL)) != -1) {
68 switch (c) {
69 case 'f':
70@@ -444,6 +446,10 @@ static void process_flags (int argc, char **argv)
71 pflg = true;
72 group_passwd = optarg;
73 break;
74+ case 'P':
75+ pflg = true;
76+ group_passwd = pw_encrypt (optarg, crypt_make_salt (NULL, NULL));
77+ break;
78 case 'r':
79 rflg = true;
80 break;
81diff --git a/src/groupmod.c b/src/groupmod.c
82index d9d3807..68f49d1 100644
83--- a/src/groupmod.c
84+++ b/src/groupmod.c
85@@ -127,6 +127,7 @@ static void usage (int status)
86 (void) fputs (_(" -o, --non-unique allow to use a duplicate (non-unique) GID\n"), usageout);
87 (void) fputs (_(" -p, --password PASSWORD change the password to this (encrypted)\n"
88 " PASSWORD\n"), usageout);
89+ (void) fputs (_(" -P, --clear-password PASSWORD change the password to this clear PASSWORD\n"), usageout);
90 (void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
91 (void) fputs ("\n", usageout);
92 exit (status);
93@@ -375,10 +376,11 @@ static void process_flags (int argc, char **argv)
94 {"new-name", required_argument, NULL, 'n'},
95 {"non-unique", no_argument, NULL, 'o'},
96 {"password", required_argument, NULL, 'p'},
97+ {"clear-password", required_argument, NULL, 'P'},
98 {"root", required_argument, NULL, 'R'},
99 {NULL, 0, NULL, '\0'}
100 };
101- while ((c = getopt_long (argc, argv, "g:hn:op:R:",
102+ while ((c = getopt_long (argc, argv, "g:hn:op:P:R:",
103 long_options, NULL)) != -1) {
104 switch (c) {
105 case 'g':
106@@ -405,6 +407,10 @@ static void process_flags (int argc, char **argv)
107 group_passwd = optarg;
108 pflg = true;
109 break;
110+ case 'P':
111+ group_passwd = pw_encrypt (optarg, crypt_make_salt (NULL, NULL));
112+ pflg = true;
113+ break;
114 case 'R': /* no-op, handled in process_root_flag () */
115 break;
116 default:
117diff --git a/src/useradd.c b/src/useradd.c
118index b3bd451..4416f90 100644
119--- a/src/useradd.c
120+++ b/src/useradd.c
121@@ -773,6 +773,7 @@ static void usage (int status)
122 (void) fputs (_(" -o, --non-unique allow to create users with duplicate\n"
123 " (non-unique) UID\n"), usageout);
124 (void) fputs (_(" -p, --password PASSWORD encrypted password of the new account\n"), usageout);
125+ (void) fputs (_(" -P, --clear-password PASSWORD clear password of the new account\n"), usageout);
126 (void) fputs (_(" -r, --system create a system account\n"), usageout);
127 (void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
128 (void) fputs (_(" -s, --shell SHELL login shell of the new account\n"), usageout);
129@@ -1047,6 +1048,7 @@ static void process_flags (int argc, char **argv)
130 {"no-user-group", no_argument, NULL, 'N'},
131 {"non-unique", no_argument, NULL, 'o'},
132 {"password", required_argument, NULL, 'p'},
133+ {"clear-password", required_argument, NULL, 'P'},
134 {"system", no_argument, NULL, 'r'},
135 {"root", required_argument, NULL, 'R'},
136 {"shell", required_argument, NULL, 's'},
137@@ -1059,9 +1061,9 @@ static void process_flags (int argc, char **argv)
138 };
139 while ((c = getopt_long (argc, argv,
140 #ifdef WITH_SELINUX
141- "b:c:d:De:f:g:G:hk:K:lmMNop:rR:s:u:UZ:",
142+ "b:c:d:De:f:g:G:hk:K:lmMNop:P:rR:s:u:UZ:",
143 #else /* !WITH_SELINUX */
144- "b:c:d:De:f:g:G:hk:K:lmMNop:rR:s:u:U",
145+ "b:c:d:De:f:g:G:hk:K:lmMNop:P:rR:s:u:U",
146 #endif /* !WITH_SELINUX */
147 long_options, NULL)) != -1) {
148 switch (c) {
149@@ -1227,6 +1229,9 @@ static void process_flags (int argc, char **argv)
150 }
151 user_pass = optarg;
152 break;
153+ case 'P': /* set clear text password */
154+ user_pass = pw_encrypt (optarg, crypt_make_salt (NULL, NULL));
155+ break;
156 case 'r':
157 rflg = true;
158 break;
159diff --git a/src/usermod.c b/src/usermod.c
160index e7d4351..b79f7a3 100644
161--- a/src/usermod.c
162+++ b/src/usermod.c
163@@ -419,6 +419,7 @@ static /*@noreturn@*/void usage (int status)
164 " new location (use only with -d)\n"), usageout);
165 (void) fputs (_(" -o, --non-unique allow using duplicate (non-unique) UID\n"), usageout);
166 (void) fputs (_(" -p, --password PASSWORD use encrypted password for the new password\n"), usageout);
167+ (void) fputs (_(" -P, --clear-password PASSWORD use clear password for the new password\n"), usageout);
168 (void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
169 (void) fputs (_(" -s, --shell SHELL new login shell for the user account\n"), usageout);
170 (void) fputs (_(" -u, --uid UID new UID for the user account\n"), usageout);
171@@ -996,6 +997,7 @@ static void process_flags (int argc, char **argv)
172 {"move-home", no_argument, NULL, 'm'},
173 {"non-unique", no_argument, NULL, 'o'},
174 {"password", required_argument, NULL, 'p'},
175+ {"clear-password", required_argument, NULL, 'P'},
176 {"root", required_argument, NULL, 'R'},
177 {"shell", required_argument, NULL, 's'},
178 {"uid", required_argument, NULL, 'u'},
179@@ -1012,7 +1014,7 @@ static void process_flags (int argc, char **argv)
180 {NULL, 0, NULL, '\0'}
181 };
182 while ((c = getopt_long (argc, argv,
183- "ac:d:e:f:g:G:hl:Lmop:R:s:u:U"
184+ "ac:d:e:f:g:G:hl:Lmop:P:R:s:u:U"
185 #ifdef ENABLE_SUBIDS
186 "v:w:V:W:"
187 #endif /* ENABLE_SUBIDS */
188@@ -1112,6 +1114,10 @@ static void process_flags (int argc, char **argv)
189 user_pass = optarg;
190 pflg = true;
191 break;
192+ case 'P':
193+ user_pass = pw_encrypt (optarg, crypt_make_salt (NULL, NULL));
194+ pflg = true;
195+ break;
196 case 'R': /* no-op, handled in process_root_flag () */
197 break;
198 case 's':
199--
2001.7.9.5
201
diff --git a/meta/recipes-extended/shadow/files/check_size_of_uid_t_and_gid_t_using_AC_CHECK_SIZEOF.patch b/meta/recipes-extended/shadow/files/check_size_of_uid_t_and_gid_t_using_AC_CHECK_SIZEOF.patch
new file mode 100644
index 0000000000..60f2ed548a
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/check_size_of_uid_t_and_gid_t_using_AC_CHECK_SIZEOF.patch
@@ -0,0 +1,41 @@
1From 2cb54158b80cdbd97ca3b36df83f9255e923ae3f Mon Sep 17 00:00:00 2001
2From: James Le Cuirot <chewi@aura-online.co.uk>
3Date: Sat, 23 Aug 2014 09:46:39 +0100
4Subject: [PATCH] Check size of uid_t and gid_t using AC_CHECK_SIZEOF
5
6This built-in check is simpler than the previous method and, most
7importantly, works when cross-compiling.
8
9Upstream-Status: Accepted
10[https://github.com/shadow-maint/shadow/commit/2cb54158b80cdbd97ca3b36df83f9255e923ae3f]
11
12Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
13---
14 configure.in | 14 ++++----------
15 1 file changed, 4 insertions(+), 10 deletions(-)
16
17diff --git a/configure.in b/configure.in
18index 1a3f841..4a4d6d0 100644
19--- a/configure.in
20+++ b/configure.in
21@@ -335,16 +335,10 @@ if test "$enable_subids" != "no"; then
22 dnl
23 dnl FIXME: check if 32 bit UIDs/GIDs are supported by libc
24 dnl
25- AC_RUN_IFELSE([AC_LANG_SOURCE([
26-#include <sys/types.h>
27-int main(void) {
28- uid_t u;
29- gid_t g;
30- return (sizeof u < 4) || (sizeof g < 4);
31-}
32- ])], [id32bit="yes"], [id32bit="no"])
33-
34- if test "x$id32bit" = "xyes"; then
35+ AC_CHECK_SIZEOF([uid_t],, [#include "sys/types.h"])
36+ AC_CHECK_SIZEOF([gid_t],, [#include "sys/types.h"])
37+
38+ if test "$ac_cv_sizeof_uid_t" -ge 4 && test "$ac_cv_sizeof_gid_t" -ge 4; then
39 AC_DEFINE(ENABLE_SUBIDS, 1, [Define to support the subordinate IDs.])
40 enable_subids="yes"
41 else
diff --git a/meta/recipes-extended/shadow/files/commonio.c-fix-unexpected-open-failure-in-chroot-env.patch b/meta/recipes-extended/shadow/files/commonio.c-fix-unexpected-open-failure-in-chroot-env.patch
new file mode 100644
index 0000000000..4fa3d184ed
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/commonio.c-fix-unexpected-open-failure-in-chroot-env.patch
@@ -0,0 +1,46 @@
1Upstream-Status: Inappropriate [OE specific]
2
3commonio.c: fix unexpected open failure in chroot environment
4
5When using commands with '-R <newroot>' option in our pseudo environment,
6we would usually get the 'Pemission Denied' error. This patch serves as
7a workaround to this problem.
8
9Note that this patch doesn't change the logic in the code, it just expands
10the codes.
11
12Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
13---
14 lib/commonio.c | 16 ++++++++++++----
15 1 file changed, 12 insertions(+), 4 deletions(-)
16
17diff --git a/lib/commonio.c b/lib/commonio.c
18index cc536bf..51cafd9 100644
19--- a/lib/commonio.c
20+++ b/lib/commonio.c
21@@ -613,10 +613,18 @@ int commonio_open (struct commonio_db *db, int mode)
22 db->cursor = NULL;
23 db->changed = false;
24
25- fd = open (db->filename,
26- (db->readonly ? O_RDONLY : O_RDWR)
27- | O_NOCTTY | O_NONBLOCK | O_NOFOLLOW);
28- saved_errno = errno;
29+ if (db->readonly) {
30+ fd = open (db->filename,
31+ (true ? O_RDONLY : O_RDWR)
32+ | O_NOCTTY | O_NONBLOCK | O_NOFOLLOW);
33+ saved_errno = errno;
34+ } else {
35+ fd = open (db->filename,
36+ (false ? O_RDONLY : O_RDWR)
37+ | O_NOCTTY | O_NONBLOCK | O_NOFOLLOW);
38+ saved_errno = errno;
39+ }
40+
41 db->fp = NULL;
42 if (fd >= 0) {
43 #ifdef WITH_TCB
44--
451.7.9.5
46
diff --git a/meta/recipes-extended/shadow/files/disable-syslog.patch b/meta/recipes-extended/shadow/files/disable-syslog.patch
new file mode 100644
index 0000000000..1943fd6faf
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/disable-syslog.patch
@@ -0,0 +1,34 @@
1Disable use of syslog to prevent sysroot user and group additions from
2writing entries to the host's syslog. This patch should only be used
3with the shadow-native recipe.
4
5Upstream-Status: Inappropriate [disable feature]
6
7Signed-off-by: Scott Garman <scott.a.garman@intel.com>
8
9diff -urN shadow-4.1.4.3.orig//src/groupadd.c shadow-4.1.4.3/src/groupadd.c
10--- shadow-4.1.4.3.orig//src/groupadd.c 2011-02-13 09:58:16.000000000 -0800
11+++ shadow-4.1.4.3/src/groupadd.c 2012-04-05 10:05:59.440001758 -0700
12@@ -34,6 +34,9 @@
13
14 #ident "$Id: groupadd.c 3015 2009-06-05 22:16:56Z nekral-guest $"
15
16+/* Disable use of syslog since we're running this command against a sysroot */
17+#undef USE_SYSLOG
18+
19 #include <ctype.h>
20 #include <fcntl.h>
21 #include <getopt.h>
22diff -urN shadow-4.1.4.3.orig//src/useradd.c shadow-4.1.4.3/src/useradd.c
23--- shadow-4.1.4.3.orig//src/useradd.c 2011-02-13 09:58:16.000000000 -0800
24+++ shadow-4.1.4.3/src/useradd.c 2012-04-05 10:06:25.076001315 -0700
25@@ -34,6 +34,9 @@
26
27 #ident "$Id: useradd.c 3015 2009-06-05 22:16:56Z nekral-guest $"
28
29+/* Disable use of syslog since we're running this command against a sysroot */
30+#undef USE_SYSLOG
31+
32 #include <assert.h>
33 #include <ctype.h>
34 #include <errno.h>
diff --git a/meta/recipes-extended/shadow/files/fix-installation-failure-with-subids-disabled.patch b/meta/recipes-extended/shadow/files/fix-installation-failure-with-subids-disabled.patch
new file mode 100644
index 0000000000..02cb91aafd
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/fix-installation-failure-with-subids-disabled.patch
@@ -0,0 +1,28 @@
1Upstream-Status: Pending
2
3Subject: fix installation failure with subids disabled
4
5Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
6---
7 src/Makefile.am | 5 ++++-
8 1 file changed, 4 insertions(+), 1 deletion(-)
9
10diff --git a/src/Makefile.am b/src/Makefile.am
11index 25e288d..076f8ef 100644
12--- a/src/Makefile.am
13+++ b/src/Makefile.am
14@@ -52,7 +52,10 @@ usbin_PROGRAMS = \
15 noinst_PROGRAMS = id sulogin
16
17 suidbins = su
18-suidubins = chage chfn chsh expiry gpasswd newgrp passwd newuidmap newgidmap
19+suidubins = chage chfn chsh expiry gpasswd newgrp passwd
20+if ENABLE_SUBIDS
21+suidubins += newgidmap newuidmap
22+endif
23 if ACCT_TOOLS_SETUID
24 suidubins += chage chgpasswd chpasswd groupadd groupdel groupmod newusers useradd userdel usermod
25 endif
26--
271.7.9.5
28
diff --git a/meta/recipes-extended/shadow/files/login.defs_shadow-sysroot b/meta/recipes-extended/shadow/files/login.defs_shadow-sysroot
new file mode 100644
index 0000000000..8a68dd341a
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/login.defs_shadow-sysroot
@@ -0,0 +1,386 @@
1#
2# /etc/login.defs - Configuration control definitions for the shadow package.
3#
4# $Id: login.defs 3038 2009-07-23 20:41:35Z nekral-guest $
5#
6
7#
8# Delay in seconds before being allowed another attempt after a login failure
9# Note: When PAM is used, some modules may enfore a minimal delay (e.g.
10# pam_unix enforces a 2s delay)
11#
12FAIL_DELAY 3
13
14#
15# Enable logging and display of /var/log/faillog login failure info.
16#
17#FAILLOG_ENAB yes
18
19#
20# Enable display of unknown usernames when login failures are recorded.
21#
22LOG_UNKFAIL_ENAB no
23
24#
25# Enable logging of successful logins
26#
27LOG_OK_LOGINS no
28
29#
30# Enable logging and display of /var/log/lastlog login time info.
31#
32#LASTLOG_ENAB yes
33
34#
35# Enable checking and display of mailbox status upon login.
36#
37# Disable if the shell startup files already check for mail
38# ("mailx -e" or equivalent).
39#
40##MAIL_CHECK_ENAB yes
41
42#
43# Enable additional checks upon password changes.
44#
45#OBSCURE_CHECKS_ENAB yes
46
47#
48# Enable checking of time restrictions specified in /etc/porttime.
49#
50#PORTTIME_CHECKS_ENAB yes
51
52#
53# Enable setting of ulimit, umask, and niceness from passwd gecos field.
54#
55#QUOTAS_ENAB yes
56
57#
58# Enable "syslog" logging of su activity - in addition to sulog file logging.
59# SYSLOG_SG_ENAB does the same for newgrp and sg.
60#
61SYSLOG_SU_ENAB yes
62SYSLOG_SG_ENAB yes
63
64#
65# If defined, either full pathname of a file containing device names or
66# a ":" delimited list of device names. Root logins will be allowed only
67# upon these devices.
68#
69CONSOLE /etc/securetty
70#CONSOLE console:tty01:tty02:tty03:tty04
71
72#
73# If defined, all su activity is logged to this file.
74#
75#SULOG_FILE /var/log/sulog
76
77#
78# If defined, ":" delimited list of "message of the day" files to
79# be displayed upon login.
80#
81#MOTD_FILE /etc/motd
82#MOTD_FILE /etc/motd:/usr/lib/news/news-motd
83
84#
85# If defined, this file will be output before each login prompt.
86#
87#ISSUE_FILE /etc/issue
88
89#
90# If defined, file which maps tty line to TERM environment parameter.
91# Each line of the file is in a format something like "vt100 tty01".
92#
93#TTYTYPE_FILE /etc/ttytype
94
95#
96# If defined, login failures will be logged here in a utmp format.
97# last, when invoked as lastb, will read /var/log/btmp, so...
98#
99#FTMP_FILE /var/log/btmp
100
101#
102# If defined, name of file whose presence which will inhibit non-root
103# logins. The contents of this file should be a message indicating
104# why logins are inhibited.
105#
106#NOLOGINS_FILE /etc/nologin
107
108#
109# If defined, the command name to display when running "su -". For
110# example, if this is defined as "su" then a "ps" will display the
111# command is "-su". If not defined, then "ps" would display the
112# name of the shell actually being run, e.g. something like "-sh".
113#
114SU_NAME su
115
116#
117# *REQUIRED*
118# Directory where mailboxes reside, _or_ name of file, relative to the
119# home directory. If you _do_ define both, #MAIL_DIR takes precedence.
120#
121#MAIL_DIR /var/spool/mail
122MAIL_FILE .mail
123
124#
125# If defined, file which inhibits all the usual chatter during the login
126# sequence. If a full pathname, then hushed mode will be enabled if the
127# user's name or shell are found in the file. If not a full pathname, then
128# hushed mode will be enabled if the file exists in the user's home directory.
129#
130HUSHLOGIN_FILE .hushlogin
131#HUSHLOGIN_FILE /etc/hushlogins
132
133#
134# If defined, either a TZ environment parameter spec or the
135# fully-rooted pathname of a file containing such a spec.
136#
137#ENV_TZ TZ=CST6CDT
138#ENV_TZ /etc/tzname
139
140#
141# If defined, an HZ environment parameter spec.
142#
143# for Linux/x86
144#ENV_HZ HZ=100
145# For Linux/Alpha...
146#ENV_HZ HZ=1024
147
148#
149# *REQUIRED* The default PATH settings, for superuser and normal users.
150#
151# (they are minimal, add the rest in the shell startup files)
152ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin
153ENV_PATH PATH=/bin:/usr/bin
154
155#
156# Terminal permissions
157#
158# TTYGROUP Login tty will be assigned this group ownership.
159# TTYPERM Login tty will be set to this permission.
160#
161# If you have a "write" program which is "setgid" to a special group
162# which owns the terminals, define TTYGROUP to the group number and
163# TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign
164# TTYPERM to either 622 or 600.
165#
166TTYGROUP tty
167TTYPERM 0600
168
169#
170# Login configuration initializations:
171#
172# ERASECHAR Terminal ERASE character ('\010' = backspace).
173# KILLCHAR Terminal KILL character ('\025' = CTRL/U).
174# ULIMIT Default "ulimit" value.
175#
176# The ERASECHAR and KILLCHAR are used only on System V machines.
177# The ULIMIT is used only if the system supports it.
178# (now it works with setrlimit too; ulimit is in 512-byte units)
179#
180# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
181#
182ERASECHAR 0177
183KILLCHAR 025
184#ULIMIT 2097152
185
186# Default initial "umask" value for non-PAM enabled systems.
187# UMASK is also used by useradd and newusers to set the mode of new home
188# directories.
189# 022 is the default value, but 027, or even 077, could be considered
190# better for privacy. There is no One True Answer here: each sysadmin
191# must make up her mind.
192UMASK 022
193
194#
195# Password aging controls:
196#
197# PASS_MAX_DAYS Maximum number of days a password may be used.
198# PASS_MIN_DAYS Minimum number of days allowed between password changes.
199# PASS_MIN_LEN Minimum acceptable password length.
200# PASS_WARN_AGE Number of days warning given before a password expires.
201#
202PASS_MAX_DAYS 99999
203PASS_MIN_DAYS 0
204#PASS_MIN_LEN 5
205PASS_WARN_AGE 7
206
207#
208# If "yes", the user must be listed as a member of the first gid 0 group
209# in /etc/group (called "root" on most Linux systems) to be able to "su"
210# to uid 0 accounts. If the group doesn't exist or is empty, no one
211# will be able to "su" to uid 0.
212#
213#SU_WHEEL_ONLY no
214
215#
216# If compiled with cracklib support, where are the dictionaries
217#
218#CRACKLIB_DICTPATH /var/cache/cracklib/cracklib_dict
219
220#
221# Min/max values for automatic uid selection in useradd
222#
223UID_MIN 1000
224UID_MAX 60000
225# System accounts
226SYS_UID_MIN 101
227SYS_UID_MAX 999
228
229#
230# Min/max values for automatic gid selection in groupadd
231#
232GID_MIN 1000
233GID_MAX 60000
234# System accounts
235SYS_GID_MIN 101
236SYS_GID_MAX 999
237
238#
239# Max number of login retries if password is bad
240#
241LOGIN_RETRIES 5
242
243#
244# Max time in seconds for login
245#
246LOGIN_TIMEOUT 60
247
248#
249# Maximum number of attempts to change password if rejected (too easy)
250#
251#PASS_CHANGE_TRIES 5
252
253#
254# Warn about weak passwords (but still allow them) if you are root.
255#
256#PASS_ALWAYS_WARN yes
257
258#
259# Number of significant characters in the password for crypt().
260# Default is 8, don't change unless your crypt() is better.
261# Ignored if MD5_CRYPT_ENAB set to "yes".
262#
263#PASS_MAX_LEN 8
264
265#
266# Require password before chfn/chsh can make any changes.
267#
268#CHFN_AUTH yes
269
270#
271# Which fields may be changed by regular users using chfn - use
272# any combination of letters "frwh" (full name, room number, work
273# phone, home phone). If not defined, no changes are allowed.
274# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
275#
276CHFN_RESTRICT rwh
277
278#
279# Password prompt (%s will be replaced by user name).
280#
281# XXX - it doesn't work correctly yet, for now leave it commented out
282# to use the default which is just "Password: ".
283#LOGIN_STRING "%s's Password: "
284
285#
286# Only works if compiled with MD5_CRYPT defined:
287# If set to "yes", new passwords will be encrypted using the MD5-based
288# algorithm compatible with the one used by recent releases of FreeBSD.
289# It supports passwords of unlimited length and longer salt strings.
290# Set to "no" if you need to copy encrypted passwords to other systems
291# which don't understand the new algorithm. Default is "no".
292#
293# Note: If you use PAM, it is recommended to use a value consistent with
294# the PAM modules configuration.
295#
296# This variable is deprecated. You should use ENCRYPT_METHOD.
297#
298#MD5_CRYPT_ENAB no
299
300#
301# Only works if compiled with ENCRYPTMETHOD_SELECT defined:
302# If set to MD5 , MD5-based algorithm will be used for encrypting password
303# If set to SHA256, SHA256-based algorithm will be used for encrypting password
304# If set to SHA512, SHA512-based algorithm will be used for encrypting password
305# If set to DES, DES-based algorithm will be used for encrypting password (default)
306# Overrides the MD5_CRYPT_ENAB option
307#
308# Note: If you use PAM, it is recommended to use a value consistent with
309# the PAM modules configuration.
310#
311#ENCRYPT_METHOD DES
312
313#
314# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
315#
316# Define the number of SHA rounds.
317# With a lot of rounds, it is more difficult to brute forcing the password.
318# But note also that it more CPU resources will be needed to authenticate
319# users.
320#
321# If not specified, the libc will choose the default number of rounds (5000).
322# The values must be inside the 1000-999999999 range.
323# If only one of the MIN or MAX values is set, then this value will be used.
324# If MIN > MAX, the highest value will be used.
325#
326# SHA_CRYPT_MIN_ROUNDS 5000
327# SHA_CRYPT_MAX_ROUNDS 5000
328
329#
330# List of groups to add to the user's supplementary group set
331# when logging in on the console (as determined by the CONSOLE
332# setting). Default is none.
333#
334# Use with caution - it is possible for users to gain permanent
335# access to these groups, even when not logged in on the console.
336# How to do it is left as an exercise for the reader...
337#
338#CONSOLE_GROUPS floppy:audio:cdrom
339
340#
341# Should login be allowed if we can't cd to the home directory?
342# Default in no.
343#
344DEFAULT_HOME yes
345
346#
347# If this file exists and is readable, login environment will be
348# read from it. Every line should be in the form name=value.
349#
350#ENVIRON_FILE /etc/environment
351
352#
353# If defined, this command is run when removing a user.
354# It should remove any at/cron/print jobs etc. owned by
355# the user to be removed (passed as the first argument).
356#
357#USERDEL_CMD /usr/sbin/userdel_local
358
359#
360# Enable setting of the umask group bits to be the same as owner bits
361# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is
362# the same as gid, and username is the same as the primary group name.
363#
364# This also enables userdel to remove user groups if no members exist.
365#
366USERGROUPS_ENAB yes
367
368#
369# If set to a non-nul number, the shadow utilities will make sure that
370# groups never have more than this number of users on one line.
371# This permit to support split groups (groups split into multiple lines,
372# with the same group ID, to avoid limitation of the line length in the
373# group file).
374#
375# 0 is the default value and disables this feature.
376#
377#MAX_MEMBERS_PER_GROUP 0
378
379#
380# If useradd should create home directories for users by default (non
381# system users only)
382# This option is overridden with the -M or -m flags on the useradd command
383# line.
384#
385CREATE_HOME yes
386
diff --git a/meta/recipes-extended/shadow/files/login_defs_pam.sed b/meta/recipes-extended/shadow/files/login_defs_pam.sed
new file mode 100644
index 0000000000..0a1f3be4af
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/login_defs_pam.sed
@@ -0,0 +1,32 @@
1/^FAILLOG_ENAB/b comment
2/^LASTLOG_ENAB/b comment
3/^MAIL_CHECK_ENAB/b comment
4/^OBSCURE_CHECKS_ENAB/b comment
5/^PORTTIME_CHECKS_ENAB/b comment
6/^QUOTAS_ENAB/b comment
7/^MOTD_FILE/b comment
8/^FTMP_FILE/b comment
9/^NOLOGINS_FILE/b comment
10/^ENV_HZ/b comment
11/^ENV_TZ/b comment
12/^PASS_MIN_LEN/b comment
13/^SU_WHEEL_ONLY/b comment
14/^CRACKLIB_DICTPATH/b comment
15/^PASS_CHANGE_TRIES/b comment
16/^PASS_ALWAYS_WARN/b comment
17/^PASS_MAX_LEN/b comment
18/^PASS_MIN_LEN/b comment
19/^CHFN_AUTH/b comment
20/^CHSH_AUTH/b comment
21/^ISSUE_FILE/b comment
22/^LOGIN_STRING/b comment
23/^ULIMIT/b comment
24/^ENVIRON_FILE/b comment
25
26b exit
27
28: comment
29 s:^:#:
30
31: exit
32
diff --git a/meta/recipes-extended/shadow/files/pam.d/chfn b/meta/recipes-extended/shadow/files/pam.d/chfn
new file mode 100644
index 0000000000..baf7698bba
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/pam.d/chfn
@@ -0,0 +1,14 @@
1#
2# The PAM configuration file for the Shadow `chfn' service
3#
4
5# This allows root to change user infomation without being
6# prompted for a password
7auth sufficient pam_rootok.so
8
9# The standard Unix authentication modules, used with
10# NIS (man nsswitch) as well as normal /etc/passwd and
11# /etc/shadow entries.
12auth include common-auth
13account include common-account
14session include common-session
diff --git a/meta/recipes-extended/shadow/files/pam.d/chpasswd b/meta/recipes-extended/shadow/files/pam.d/chpasswd
new file mode 100644
index 0000000000..9e3efa68ba
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/pam.d/chpasswd
@@ -0,0 +1,4 @@
1# The PAM configuration file for the Shadow 'chpasswd' service
2#
3
4password include common-password
diff --git a/meta/recipes-extended/shadow/files/pam.d/chsh b/meta/recipes-extended/shadow/files/pam.d/chsh
new file mode 100644
index 0000000000..8fb169f64e
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/pam.d/chsh
@@ -0,0 +1,19 @@
1#
2# The PAM configuration file for the Shadow `chsh' service
3#
4
5# This will not allow a user to change their shell unless
6# their current one is listed in /etc/shells. This keeps
7# accounts with special shells from changing them.
8auth required pam_shells.so
9
10# This allows root to change user shell without being
11# prompted for a password
12auth sufficient pam_rootok.so
13
14# The standard Unix authentication modules, used with
15# NIS (man nsswitch) as well as normal /etc/passwd and
16# /etc/shadow entries.
17auth include common-auth
18account include common-account
19session include common-session
diff --git a/meta/recipes-extended/shadow/files/pam.d/login b/meta/recipes-extended/shadow/files/pam.d/login
new file mode 100644
index 0000000000..b340058539
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/pam.d/login
@@ -0,0 +1,81 @@
1#
2# The PAM configuration file for the Shadow `login' service
3#
4
5# Enforce a minimal delay in case of failure (in microseconds).
6# (Replaces the `FAIL_DELAY' setting from login.defs)
7# Note that other modules may require another minimal delay. (for example,
8# to disable any delay, you should add the nodelay option to pam_unix)
9auth optional pam_faildelay.so delay=3000000
10
11# Outputs an issue file prior to each login prompt (Replaces the
12# ISSUE_FILE option from login.defs). Uncomment for use
13# auth required pam_issue.so issue=/etc/issue
14
15# Disallows root logins except on tty's listed in /etc/securetty
16# (Replaces the `CONSOLE' setting from login.defs)
17# Note that it is included as a "requisite" module. No password prompts will
18# be displayed if this module fails to avoid having the root password
19# transmitted on unsecure ttys.
20# You can change it to a "required" module if you think it permits to
21# guess valid user names of your system (invalid user names are considered
22# as possibly being root).
23auth [success=ok ignore=ignore user_unknown=ignore default=die] pam_securetty.so
24
25# Disallows other than root logins when /etc/nologin exists
26# (Replaces the `NOLOGINS_FILE' option from login.defs)
27auth requisite pam_nologin.so
28
29# This module parses environment configuration file(s)
30# and also allows you to use an extended config
31# file /etc/security/pam_env.conf.
32#
33# parsing /etc/environment needs "readenv=1"
34session required pam_env.so readenv=1
35
36# Standard Un*x authentication.
37auth include common-auth
38
39# This allows certain extra groups to be granted to a user
40# based on things like time of day, tty, service, and user.
41# Please edit /etc/security/group.conf to fit your needs
42# (Replaces the `CONSOLE_GROUPS' option in login.defs)
43auth optional pam_group.so
44
45# Uncomment and edit /etc/security/time.conf if you need to set
46# time restrainst on logins.
47# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
48# as well as /etc/porttime)
49# account requisite pam_time.so
50
51# Uncomment and edit /etc/security/access.conf if you need to
52# set access limits.
53# (Replaces /etc/login.access file)
54# account required pam_access.so
55
56# Sets up user limits according to /etc/security/limits.conf
57# (Replaces the use of /etc/limits in old login)
58session required pam_limits.so
59
60# Prints the last login info upon succesful login
61# (Replaces the `LASTLOG_ENAB' option from login.defs)
62session optional pam_lastlog.so
63
64# Prints the motd upon succesful login
65# (Replaces the `MOTD_FILE' option in login.defs)
66session optional pam_motd.so
67
68# Prints the status of the user's mailbox upon succesful login
69# (Replaces the `MAIL_CHECK_ENAB' option from login.defs).
70#
71# This also defines the MAIL environment variable
72# However, userdel also needs MAIL_DIR and MAIL_FILE variables
73# in /etc/login.defs to make sure that removing a user
74# also removes the user's mail spool file.
75# See comments in /etc/login.defs
76session optional pam_mail.so standard
77
78# Standard Un*x account and session
79account include common-account
80password include common-password
81session include common-session
diff --git a/meta/recipes-extended/shadow/files/pam.d/newusers b/meta/recipes-extended/shadow/files/pam.d/newusers
new file mode 100644
index 0000000000..4aa3dde48b
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/pam.d/newusers
@@ -0,0 +1,4 @@
1# The PAM configuration file for the Shadow 'newusers' service
2#
3
4password include common-password
diff --git a/meta/recipes-extended/shadow/files/pam.d/passwd b/meta/recipes-extended/shadow/files/pam.d/passwd
new file mode 100644
index 0000000000..f534992435
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/pam.d/passwd
@@ -0,0 +1,5 @@
1#
2# The PAM configuration file for the Shadow `passwd' service
3#
4
5password include common-password
diff --git a/meta/recipes-extended/shadow/files/pam.d/su b/meta/recipes-extended/shadow/files/pam.d/su
new file mode 100644
index 0000000000..8d590a32e6
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/pam.d/su
@@ -0,0 +1,57 @@
1#
2# The PAM configuration file for the Shadow `su' service
3#
4
5# This allows root to su without passwords (normal operation)
6auth sufficient pam_rootok.so
7
8# Uncomment this to force users to be a member of group root
9# before they can use `su'. You can also add "group=foo"
10# to the end of this line if you want to use a group other
11# than the default "root" (but this may have side effect of
12# denying "root" user, unless she's a member of "foo" or explicitly
13# permitted earlier by e.g. "sufficient pam_rootok.so").
14# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
15# auth required pam_wheel.so
16
17# Uncomment this if you want wheel members to be able to
18# su without a password.
19# auth sufficient pam_wheel.so trust
20
21# Uncomment this if you want members of a specific group to not
22# be allowed to use su at all.
23# auth required pam_wheel.so deny group=nosu
24
25# Uncomment and edit /etc/security/time.conf if you need to set
26# time restrainst on su usage.
27# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
28# as well as /etc/porttime)
29# account requisite pam_time.so
30
31# This module parses environment configuration file(s)
32# and also allows you to use an extended config
33# file /etc/security/pam_env.conf.
34#
35# parsing /etc/environment needs "readenv=1"
36session required pam_env.so readenv=1
37
38# Defines the MAIL environment variable
39# However, userdel also needs MAIL_DIR and MAIL_FILE variables
40# in /etc/login.defs to make sure that removing a user
41# also removes the user's mail spool file.
42# See comments in /etc/login.defs
43#
44# "nopen" stands to avoid reporting new mail when su'ing to another user
45session optional pam_mail.so nopen
46
47# Sets up user limits, please uncomment and read /etc/security/limits.conf
48# to enable this functionality.
49# (Replaces the use of /etc/limits in old login)
50# session required pam_limits.so
51
52# The standard Unix authentication modules, used with
53# NIS (man nsswitch) as well as normal /etc/passwd and
54# /etc/shadow entries.
55auth include common-auth
56account include common-account
57session include common-session
diff --git a/meta/recipes-extended/shadow/files/securetty b/meta/recipes-extended/shadow/files/securetty
new file mode 100644
index 0000000000..ecc246f799
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/securetty
@@ -0,0 +1,234 @@
1# /etc/securetty: list of terminals on which root is allowed to login.
2# See securetty(5) and login(1).
3console
4
5# Standard serial ports
6ttyS0
7ttyS1
8ttyS2
9ttyS3
10
11# ARM AMBA SoCs
12ttyAM0
13ttyAM1
14ttyAM2
15ttyAM3
16ttyAMA0
17ttyAMA1
18ttyAMA2
19ttyAMA3
20
21# QCOM Socs
22ttyHSL0
23ttyHSL1
24ttyHSL2
25ttyHSL3
26ttyMSM0
27ttyMSM1
28ttyMSM2
29
30# Samsung ARM SoCs
31ttySAC0
32ttySAC1
33ttySAC2
34ttySAC3
35
36# STM SoCs
37ttyAS0
38ttyAS1
39ttyAS2
40ttyAS3
41
42# TI OMAP SoCs
43ttyO0
44ttyO1
45ttyO2
46ttyO3
47
48# USB dongles
49ttyUSB0
50ttyUSB1
51ttyUSB2
52
53# USB serial gadget
54ttyGS0
55
56# PowerMac
57ttyPZ0
58ttyPZ1
59ttyPZ2
60ttyPZ3
61
62# Embedded MPC platforms
63ttyPSC0
64ttyPSC1
65ttyPSC2
66ttyPSC3
67ttyPSC4
68ttyPSC5
69
70# PA-RISC mux ports
71ttyB0
72ttyB1
73
74# Standard hypervisor virtual console
75hvc0
76
77# Oldstyle Xen console
78xvc0
79
80# Standard consoles
81tty1
82tty2
83tty3
84tty4
85tty5
86tty6
87tty7
88tty8
89tty9
90tty10
91tty11
92tty12
93tty13
94tty14
95tty15
96tty16
97tty17
98tty18
99tty19
100tty20
101tty21
102tty22
103tty23
104tty24
105tty25
106tty26
107tty27
108tty28
109tty29
110tty30
111tty31
112tty32
113tty33
114tty34
115tty35
116tty36
117tty37
118tty38
119tty39
120tty40
121tty41
122tty42
123tty43
124tty44
125tty45
126tty46
127tty47
128tty48
129tty49
130tty50
131tty51
132tty52
133tty53
134tty54
135tty55
136tty56
137tty57
138tty58
139tty59
140tty60
141tty61
142tty62
143tty63
144
145# Local X displays (allows empty passwords with pam_unix's nullok_secure)
146pts/0
147pts/1
148pts/2
149pts/3
150
151# Embedded Freescale i.MX ports
152ttymxc0
153ttymxc1
154ttymxc2
155ttymxc3
156ttymxc4
157ttymxc5
158
159# Freescale lpuart ports
160ttyLP0
161ttyLP1
162ttyLP2
163ttyLP3
164ttyLP4
165ttyLP5
166
167# Standard serial ports, with devfs
168tts/0
169tts/1
170
171# Standard consoles, with devfs
172vc/1
173vc/2
174vc/3
175vc/4
176vc/5
177vc/6
178vc/7
179vc/8
180vc/9
181vc/10
182vc/11
183vc/12
184vc/13
185vc/14
186vc/15
187vc/16
188vc/17
189vc/18
190vc/19
191vc/20
192vc/21
193vc/22
194vc/23
195vc/24
196vc/25
197vc/26
198vc/27
199vc/28
200vc/29
201vc/30
202vc/31
203vc/32
204vc/33
205vc/34
206vc/35
207vc/36
208vc/37
209vc/38
210vc/39
211vc/40
212vc/41
213vc/42
214vc/43
215vc/44
216vc/45
217vc/46
218vc/47
219vc/48
220vc/49
221vc/50
222vc/51
223vc/52
224vc/53
225vc/54
226vc/55
227vc/56
228vc/57
229vc/58
230vc/59
231vc/60
232vc/61
233vc/62
234vc/63
diff --git a/meta/recipes-extended/shadow/files/shadow-4.1.3-dots-in-usernames.patch b/meta/recipes-extended/shadow/files/shadow-4.1.3-dots-in-usernames.patch
new file mode 100644
index 0000000000..a7bb0a9290
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/shadow-4.1.3-dots-in-usernames.patch
@@ -0,0 +1,27 @@
1# commit message copied from openembedded:
2# commit 246c80637b135f3a113d319b163422f98174ee6c
3# Author: Khem Raj <raj.khem@gmail.com>
4# Date: Wed Jun 9 13:37:03 2010 -0700
5#
6# shadow-4.1.4.2: Add patches to support dots in login id.
7#
8# Signed-off-by: Khem Raj <raj.khem@gmail.com>
9#
10# comment added by Kevin Tian <kevin.tian@intel.com>, 2010-08-11
11
12Upstream-Status: Pending
13
14Signed-off-by: Scott Garman <scott.a.garman@intel.com>
15
16Index: shadow-4.1.4.2/libmisc/chkname.c
17===================================================================
18--- shadow-4.1.4.2.orig/libmisc/chkname.c 2009-04-28 12:14:04.000000000 -0700
19+++ shadow-4.1.4.2/libmisc/chkname.c 2010-06-03 17:43:20.638973857 -0700
20@@ -61,6 +61,7 @@ static bool is_valid_name (const char *n
21 ( ('0' <= *name) && ('9' >= *name) ) ||
22 ('_' == *name) ||
23 ('-' == *name) ||
24+ ('.' == *name) ||
25 ( ('$' == *name) && ('\0' == *(name + 1)) )
26 )) {
27 return false;
diff --git a/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch b/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
new file mode 100644
index 0000000000..15f8044fa2
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
@@ -0,0 +1,91 @@
1The system-auth in the configure files is from Fedora which put all the 4 pam type rules
2in one file.
3In yocto it obey the way with Debian/Ubuntu, and the names are common-auth, common-account,
4common-password and common-session.
5So update them with oe way.
6
7Upstream-Status: Pending
8
9Signed-off-by: Kang Kai <kai.kang@windriver.com>
10
11diff -Nur shadow-4.1.4.3/etc/pam.d.orig/chage shadow-4.1.4.3/etc/pam.d/chage
12--- shadow-4.1.4.3/etc/pam.d.orig/chage 2011-07-20 19:02:27.384844958 +0800
13+++ shadow-4.1.4.3/etc/pam.d/chage 2011-07-20 19:03:08.964844958 +0800
14@@ -1,4 +1,4 @@
15 #%PAM-1.0
16 auth sufficient pam_rootok.so
17 account required pam_permit.so
18-password include system-auth
19+password include common-password
20diff -Nur shadow-4.1.4.3/etc/pam.d.orig/chgpasswd shadow-4.1.4.3/etc/pam.d/chgpasswd
21--- shadow-4.1.4.3/etc/pam.d.orig/chgpasswd 2011-07-20 19:02:27.384844958 +0800
22+++ shadow-4.1.4.3/etc/pam.d/chgpasswd 2011-07-20 19:03:26.544844958 +0800
23@@ -1,4 +1,4 @@
24 #%PAM-1.0
25 auth sufficient pam_rootok.so
26 account required pam_permit.so
27-password include system-auth
28+password include common-password
29diff -Nur shadow-4.1.4.3/etc/pam.d.orig/groupadd shadow-4.1.4.3/etc/pam.d/groupadd
30--- shadow-4.1.4.3/etc/pam.d.orig/groupadd 2011-07-20 19:02:27.384844958 +0800
31+++ shadow-4.1.4.3/etc/pam.d/groupadd 2011-07-20 19:04:08.124844958 +0800
32@@ -1,4 +1,4 @@
33 #%PAM-1.0
34 auth sufficient pam_rootok.so
35 account required pam_permit.so
36-password include system-auth
37+password include common-password
38diff -Nur shadow-4.1.4.3/etc/pam.d.orig/groupdel shadow-4.1.4.3/etc/pam.d/groupdel
39--- shadow-4.1.4.3/etc/pam.d.orig/groupdel 2011-07-20 19:02:27.384844958 +0800
40+++ shadow-4.1.4.3/etc/pam.d/groupdel 2011-07-20 19:04:26.114844958 +0800
41@@ -1,4 +1,4 @@
42 #%PAM-1.0
43 auth sufficient pam_rootok.so
44 account required pam_permit.so
45-password include system-auth
46+password include common-password
47diff -Nur shadow-4.1.4.3/etc/pam.d.orig/groupmems shadow-4.1.4.3/etc/pam.d/groupmems
48--- shadow-4.1.4.3/etc/pam.d.orig/groupmems 2011-07-20 19:02:27.384844958 +0800
49+++ shadow-4.1.4.3/etc/pam.d/groupmems 2011-07-20 19:04:35.074844958 +0800
50@@ -1,4 +1,4 @@
51 #%PAM-1.0
52 auth sufficient pam_rootok.so
53 account required pam_permit.so
54-password include system-auth
55+password include common-password
56diff -Nur shadow-4.1.4.3/etc/pam.d.orig/groupmod shadow-4.1.4.3/etc/pam.d/groupmod
57--- shadow-4.1.4.3/etc/pam.d.orig/groupmod 2011-07-20 19:02:27.384844958 +0800
58+++ shadow-4.1.4.3/etc/pam.d/groupmod 2011-07-20 19:04:44.864844958 +0800
59@@ -1,4 +1,4 @@
60 #%PAM-1.0
61 auth sufficient pam_rootok.so
62 account required pam_permit.so
63-password include system-auth
64+password include common-password
65diff -Nur shadow-4.1.4.3/etc/pam.d.orig/useradd shadow-4.1.4.3/etc/pam.d/useradd
66--- shadow-4.1.4.3/etc/pam.d.orig/useradd 2011-07-20 19:02:27.384844958 +0800
67+++ shadow-4.1.4.3/etc/pam.d/useradd 2011-07-20 19:07:26.244844958 +0800
68@@ -1,4 +1,4 @@
69 #%PAM-1.0
70 auth sufficient pam_rootok.so
71 account required pam_permit.so
72-password include system-auth
73+password include common-password
74diff -Nur shadow-4.1.4.3/etc/pam.d.orig/userdel shadow-4.1.4.3/etc/pam.d/userdel
75--- shadow-4.1.4.3/etc/pam.d.orig/userdel 2011-07-20 19:02:27.384844958 +0800
76+++ shadow-4.1.4.3/etc/pam.d/userdel 2011-07-20 19:07:35.734844958 +0800
77@@ -1,4 +1,4 @@
78 #%PAM-1.0
79 auth sufficient pam_rootok.so
80 account required pam_permit.so
81-password include system-auth
82+password include common-password
83diff -Nur shadow-4.1.4.3/etc/pam.d.orig/usermod shadow-4.1.4.3/etc/pam.d/usermod
84--- shadow-4.1.4.3/etc/pam.d.orig/usermod 2011-07-20 19:02:27.384844958 +0800
85+++ shadow-4.1.4.3/etc/pam.d/usermod 2011-07-20 19:07:42.024844958 +0800
86@@ -1,4 +1,4 @@
87 #%PAM-1.0
88 auth sufficient pam_rootok.so
89 account required pam_permit.so
90-password include system-auth
91+password include common-password
diff --git a/meta/recipes-extended/shadow/files/usermod-fix-compilation-failure-with-subids-disabled.patch b/meta/recipes-extended/shadow/files/usermod-fix-compilation-failure-with-subids-disabled.patch
new file mode 100644
index 0000000000..37dc153fca
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/usermod-fix-compilation-failure-with-subids-disabled.patch
@@ -0,0 +1,33 @@
1Upstream-Status: Pending
2
3usermod: fix compilation failure with subids disabled
4
5Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
6---
7 src/usermod.c | 3 ++-
8 1 file changed, 2 insertions(+), 1 deletion(-)
9
10diff --git a/src/usermod.c b/src/usermod.c
11index e7d4351..685b50a 100644
12--- a/src/usermod.c
13+++ b/src/usermod.c
14@@ -1360,7 +1360,7 @@ static void process_flags (int argc, char **argv)
15 Prog, (unsigned long) user_newid);
16 exit (E_UID_IN_USE);
17 }
18-
19+#ifdef ENABLE_SUBIDS
20 if ( (vflg || Vflg)
21 && !is_sub_uid) {
22 fprintf (stderr,
23@@ -1376,6 +1376,7 @@ static void process_flags (int argc, char **argv)
24 Prog, sub_gid_dbname (), "-w", "-W");
25 exit (E_USAGE);
26 }
27+#endif
28 }
29
30 /*
31--
321.7.9.5
33
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-04-27 05:24:54 +0000