8 files changed, 65 insertions, 77 deletions

diff --git a/meta/recipes-extended/shadow/files/0001-lib-copydir-copy_entry-use-temporary-stat-buffer.patch b/meta/recipes-extended/shadow/files/0001-lib-copydir-copy_entry-use-temporary-stat-buffer.patch
deleted file mode 100644
index 2e5503bfd4..0000000000
--- a/meta/recipes-extended/shadow/files/0001-lib-copydir-copy_entry-use-temporary-stat-buffer.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From af4b8cb780587aa736692a3baa76b60474f19c5d Mon Sep 17 00:00:00 2001
-From: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
-Date: Mon, 18 Mar 2024 12:14:21 +0100
-Subject: [PATCH] lib/copydir:copy_entry(): use temporary stat buffer
-
-There are no guarantees that fstatat() does not clobber the stat
-buffer on errors.
-
-Use a temporary buffer so that the following code sees correct
-attributes of the source entry.
-
-Upstream-Status: Submitted [https://github.com/shadow-maint/shadow/pull/974]
-
-Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
----
- lib/copydir.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/lib/copydir.c
-+++ b/lib/copydir.c
-@@ -400,6 +400,7 @@ static int copy_entry (const struct path
- {
-        int err = 0;
-        struct stat sb;
-+       struct stat tmp_sb;
-        struct link_name *lp;
-        struct timespec mt[2];
- 
-@@ -423,7 +424,7 @@ static int copy_entry (const struct path
-        * If the destination already exists do nothing.
-        * This is after the copy_dir above to still iterate into subdirectories.
-        */
--       if (fstatat(dst->dirfd, dst->name, &sb, AT_SYMLINK_NOFOLLOW) != -1) {
-+       if (fstatat(dst->dirfd, dst->name, &tmp_sb, AT_SYMLINK_NOFOLLOW) != -1) {
-                return err;
-        }
- 
diff --git a/meta/recipes-extended/shadow/files/commonio.c-fix-unexpected-open-failure-in-chroot-env.patch b/meta/recipes-extended/shadow/files/commonio.c-fix-unexpected-open-failure-in-chroot-env.patch
index cd99aad135..699269ed64 100644
--- a/meta/recipes-extended/shadow/files/commonio.c-fix-unexpected-open-failure-in-chroot-env.patch
+++ b/meta/recipes-extended/shadow/files/commonio.c-fix-unexpected-open-failure-in-chroot-env.patch
@@ -1,4 +1,4 @@
-From f512071dd3a4c29d4bf048c5a89c4ba9160e37b1 Mon Sep 17 00:00:00 2001
+From f7b765c022e4cad9140ac44712885c66e149abdc Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Thu, 17 Jul 2014 15:53:34 +0800
 Subject: [PATCH] commonio.c-fix-unexpected-open-failure-in-chroot-env
@@ -20,10 +20,10 @@ Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
  1 file changed, 12 insertions(+), 4 deletions(-)
 
 diff --git a/lib/commonio.c b/lib/commonio.c
-index 01a26c9..82b2868 100644
+index 4d83e83..9ee0e13 100644
 --- a/lib/commonio.c
 +++ b/lib/commonio.c
-@@ -601,10 +601,18 @@ int commonio_open (struct commonio_db *db, int mode)
+@@ -604,10 +604,18 @@ int commonio_open (struct commonio_db *db, int mode)
         db->cursor = NULL;
         db->changed = false;
  
diff --git a/meta/recipes-extended/shadow/files/disable_syslog.patch b/meta/recipes-extended/shadow/files/disable_syslog.patch
new file mode 100644
index 0000000000..7299a8e61c
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/disable_syslog.patch
@@ -0,0 +1,22 @@
+When building images using shadow-native, we shouldn't be spamming the host's
+log with lots of syslog messages which aren't relavent. Disable syslog use
+in the native case.
+
+Upstream-Status: Inappropriate [Would upstream accept a configure option?]
+Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
+
+Index: shadow-4.17.2/lib/defines.h
+===================================================================
+--- shadow-4.17.2.orig/lib/defines.h
++++ shadow-4.17.2/lib/defines.h
+@@ -88,7 +88,9 @@
+ 
+ /* cleaner than lots of #ifdefs everywhere - use this as follows:
+    SYSLOG((LOG_CRIT, "user %s cracked root", user)); */
+-#ifdef ENABLE_NLS
++#if 1
++#define SYSLOG(x)
++#elif ENABLE_NLS
+ /* Temporarily set LC_TIME to "C" to avoid strange dates in syslog.
+    This is a workaround for a more general syslog(d) design problem -
+    syslogd should log the current system time for each event, and not
diff --git a/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch b/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
index 1eacb8a53f..318e2665c2 100644
--- a/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
+++ b/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
@@ -1,4 +1,4 @@
-From 38882ab288fd4d2cc2e45dff222ae3412c8fe357 Mon Sep 17 00:00:00 2001
+From eb17cd91d8e4d76ee95de9c0c9f4938ba2e3e82a Mon Sep 17 00:00:00 2001
 From: Kang Kai <kai.kang@windriver.com>
 Date: Wed, 20 Jul 2011 19:18:14 +0800
 Subject: [PATCH] shadow: update pam related configure files
@@ -15,7 +15,6 @@ Upstream-Status: Inappropriate [oe-core specific]
 
 Signed-off-by: Kang Kai <kai.kang@windriver.com>
 ---
- etc/pam.d/chage     | 2 +-
  etc/pam.d/chgpasswd | 2 +-
  etc/pam.d/groupadd  | 2 +-
  etc/pam.d/groupdel  | 2 +-
@@ -24,18 +23,8 @@ Signed-off-by: Kang Kai <kai.kang@windriver.com>
  etc/pam.d/useradd   | 2 +-
  etc/pam.d/userdel   | 2 +-
  etc/pam.d/usermod   | 2 +-
- 9 files changed, 9 insertions(+), 9 deletions(-)
+ 8 files changed, 8 insertions(+), 8 deletions(-)
 
-diff --git a/etc/pam.d/chage b/etc/pam.d/chage
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/chage
-+++ b/etc/pam.d/chage
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth           sufficient      pam_rootok.so
- account                required        pam_permit.so
--password       include         system-auth
-+password       include         common-password
 diff --git a/etc/pam.d/chgpasswd b/etc/pam.d/chgpasswd
 index 8f49f5c..b1f365d 100644
 --- a/etc/pam.d/chgpasswd
@@ -116,3 +105,6 @@ index 8f49f5c..b1f365d 100644
  account                required        pam_permit.so
 -password       include         system-auth
 +password       include         common-password
+-- 
+2.43.0
+
diff --git a/meta/recipes-extended/shadow/shadow-securetty_4.6.bb b/meta/recipes-extended/shadow/shadow-securetty_4.6.bb
index fe51ea1874..e94e1caf22 100644
--- a/meta/recipes-extended/shadow/shadow-securetty_4.6.bb
+++ b/meta/recipes-extended/shadow/shadow-securetty_4.6.bb
@@ -5,10 +5,9 @@ LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384
 
 INHIBIT_DEFAULT_DEPS = "1"
 
-
 SRC_URI = "file://securetty"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 # Since SERIAL_CONSOLES is likely to be set from the machine configuration
 PACKAGE_ARCH = "${MACHINE_ARCH}"
@@ -17,7 +16,7 @@ do_install () {
         # Ensure we add a suitable securetty file to the package that has
         # most common embedded TTYs defined.
         install -d ${D}${sysconfdir}
-        install -m 0400 ${WORKDIR}/securetty ${D}${sysconfdir}/securetty
+        install -m 0400 ${S}/securetty ${D}${sysconfdir}/securetty
         if [ ! -z "${SERIAL_CONSOLES}" ]; then
                 # Our SERIAL_CONSOLES contains a baud rate and sometimes extra
                 # options as well. The following pearl :) takes that and converts
diff --git a/meta/recipes-extended/shadow/shadow-sysroot_4.6.bb b/meta/recipes-extended/shadow/shadow-sysroot_4.6.bb
index 00ab58b38c..d66ef1e6a4 100644
--- a/meta/recipes-extended/shadow/shadow-sysroot_4.6.bb
+++ b/meta/recipes-extended/shadow/shadow-sysroot_4.6.bb
@@ -7,13 +7,12 @@ LIC_FILES_CHKSUM = "file://login.defs_shadow-sysroot;endline=1;md5=ceddfb61608e4
 
 DEPENDS = "base-passwd"
 
-
 # The sole purpose of this recipe is to provide the /etc/login.defs
 # file for the target sysroot - needed so the shadow-native utilities
 # can add custom users/groups for recipes that use inherit useradd.
 SRC_URI = "file://login.defs_shadow-sysroot"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
         install -d ${D}${sysconfdir}
diff --git a/meta/recipes-extended/shadow/shadow_4.15.0.bb b/meta/recipes-extended/shadow/shadow_4.15.0.bb
deleted file mode 100644
index e57676c1da..0000000000
--- a/meta/recipes-extended/shadow/shadow_4.15.0.bb
+++ /dev/null
@@ -1,10 +0,0 @@
-require shadow.inc
-
-# Build falsely assumes that if --enable-libpam is set, we don't need to link against
-# libcrypt. This breaks chsh.
-BUILD_LDFLAGS:append:class-target = " ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '-lcrypt', '', d)}"
-
-BBCLASSEXTEND = "native nativesdk"
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=884658
-CVE_STATUS[CVE-2013-4235] = "upstream-wontfix: Severity is low and marked as closed and won't fix."
diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow_4.18.0.bb
index 7b9763d6db..6842a46dd7 100644
--- a/meta/recipes-extended/shadow/shadow.inc
+++ b/meta/recipes-extended/shadow/shadow_4.18.0.bb
@@ -12,7 +12,6 @@ DEPENDS = "virtual/crypt"
 
 GITHUB_BASE_URI = "https://github.com/shadow-maint/shadow/releases"
 SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BP}.tar.gz \
-           file://0001-lib-copydir-copy_entry-use-temporary-stat-buffer.patch \
            ${@bb.utils.contains('PACKAGECONFIG', 'pam', '${PAM_SRC_URI}', '', d)} \
            file://useradd \
            "
@@ -24,8 +23,10 @@ SRC_URI:append:class-target = " \
 
 SRC_URI:append:class-native = " \
            file://commonio.c-fix-unexpected-open-failure-in-chroot-env.patch \
+           file://disable_syslog.patch \
            "
-SRC_URI[sha256sum] = "377fe0d7c1a0aa5e3514c08fdf5ddc70c9dcbb391678c2134445ed97326bcc26"
+SRC_URI[sha256sum] = "ae486ce4c0bce55c42d76d8478e428c41586f1da2f89fbf5228243fb4d849db4"
+UPSTREAM_CHECK_REGEX = "releases/tag/v?(?P<pver>\d+(\.\d+)+)$"
 
 # Additional Policy files for PAM
 PAM_SRC_URI = "file://pam.d/chfn \
@@ -38,7 +39,7 @@ PAM_SRC_URI = "file://pam.d/chfn \
 
 inherit autotools gettext github-releases pkgconfig
 
-export CONFIG_SHELL="/bin/sh"
+export CONFIG_SHELL = "/bin/sh"
 
 EXTRA_OECONF += " \
                  --with-group-name-max-length=24 \
@@ -111,7 +112,7 @@ do_install() {
         sed -i 's/^#ENCRYPT_METHOD.*$/ENCRYPT_METHOD SHA512/' ${D}${sysconfdir}/login.defs
 
         install -d ${D}${sysconfdir}/default
-        install -m 0644 ${WORKDIR}/useradd ${D}${sysconfdir}/default
+        install -m 0644 ${UNPACKDIR}/useradd ${D}${sysconfdir}/default
 }
 
 do_install:append() {
@@ -121,11 +122,11 @@ do_install:append() {
         install -m 0775 -d ${D}${localstatedir}/spool/mail
         chown root:mail ${D}${localstatedir}/spool/mail
 
-        if [ -e ${WORKDIR}/pam.d ]; then
+        if [ -e ${UNPACKDIR}/pam.d ]; then
                 install -d ${D}${sysconfdir}/pam.d/
-                install -m 0644 ${WORKDIR}/pam.d/* ${D}${sysconfdir}/pam.d/
+                install -m 0644 ${UNPACKDIR}/pam.d/* ${D}${sysconfdir}/pam.d/
                 # Remove defaults that are not used when supporting PAM.
-                sed -i -f ${WORKDIR}/login_defs_pam.sed ${D}${sysconfdir}/login.defs
+                sed -i -f ${UNPACKDIR}/login_defs_pam.sed ${D}${sysconfdir}/login.defs
         fi
 
         install -d ${D}${sbindir} ${D}${base_sbindir} ${D}${base_bindir}
@@ -168,13 +169,20 @@ do_install:append:class-native() {
 SYSROOT_DIRS:append:class-native = " ${STAGING_DIR_NATIVE}/lib-shadow-deps/"
 INSANE_SKIP:${PN}:class-native = "already-stripped"
 
+do_install:append:class-nativesdk() {
+        oe_runmake -C ${B}/man DESTDIR="${D}" sbindir="${base_sbindir}" usbindir="${sbindir}" install-man
+}
+
+do_install:append:class-target() {
+        oe_runmake -C ${B}/man DESTDIR="${D}" sbindir="${base_sbindir}" usbindir="${sbindir}" install-man
+}
+
 PACKAGES =+ "${PN}-base"
 FILES:${PN}-base = "\
     ${base_bindir}/login.shadow \
     ${base_bindir}/su.shadow \
     ${bindir}/sg \
     ${bindir}/newgrp.shadow \
-    ${bindir}/groups.shadow \
     ${sysconfdir}/pam.d/login \
     ${sysconfdir}/pam.d/su \
     ${sysconfdir}/login.defs \
@@ -193,7 +201,13 @@ ALTERNATIVE_LINK_NAME[vipw] = "${base_sbindir}/vipw"
 ALTERNATIVE_LINK_NAME[vigr] = "${base_sbindir}/vigr"
 ALTERNATIVE_LINK_NAME[nologin] = "${base_sbindir}/nologin"
 
-ALTERNATIVE:${PN}-base = "newgrp groups login su"
+ALTERNATIVE:${PN}-doc = "chfn.1 chsh.1 su.1 nologin.8"
+ALTERNATIVE_LINK_NAME[chfn.1] = "${mandir}/man1/chfn.1"
+ALTERNATIVE_LINK_NAME[chsh.1] = "${mandir}/man1/chsh.1"
+ALTERNATIVE_LINK_NAME[su.1] = "${mandir}/man1/su.1"
+ALTERNATIVE_LINK_NAME[nologin.8] = "${mandir}/man8/nologin.8"
+
+ALTERNATIVE:${PN}-base = "newgrp login su"
 ALTERNATIVE_LINK_NAME[login] = "${base_bindir}/login"
 ALTERNATIVE_LINK_NAME[su] = "${base_bindir}/su"
 
@@ -208,3 +222,12 @@ pkg_postinst:${PN}:class-target () {
         pwconv $rootarg || exit 1
         grpconv $rootarg || exit 1
 }
+
+# Build falsely assumes that if --enable-libpam is set, we don't need to link against
+# libcrypt. This breaks chsh.
+BUILD_LDFLAGS:append:class-target = " ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '-lcrypt', '', d)}"
+
+BBCLASSEXTEND = "native nativesdk"
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=884658
+CVE_STATUS[CVE-2013-4235] = "upstream-wontfix: Severity is low and marked as closed and won't fix."