summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended/shadow
Commit message (Collapse)AuthorAgeFilesLines
* shadow: improve reproducibility by hard-coding shell pathMartin Hundebøll2018-12-051-0/+2
| | | | | | | | | | | | | | | | | | | | | The shadow configure script tries really hard to detect the running shell to make sure it doesn't do unsupported calls. On my system the shell is detected as /bin/sh, while a build in an ubuntu docker it resolves to /bin/bash. And since the shell path is baked into the target binaries through config.h, the build becomes inreproducible. Fix reproducibility by hard-coding the shell to be /bin/sh (From OE-Core rev: 5f4fe91cb6c21cd3ecd0b68d1c6b46a9530c7570) (From OE-Core rev: 83214b835cd82d5dddb47c418c4e7a20ac433f61) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: CVE-2018-7169Jagadeesh Krishnanjanappa2018-08-292-0/+187
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | newgidmap: enforce setgroups=deny if self-mapping a group This is necessary to match the kernel-side policy of "self-mapping in a user namespace is fine, but you cannot drop groups" -- a policy that was created in order to stop user namespaces from allowing trivial privilege escalation by dropping supplementary groups that were "blacklisted" from certain paths. This is the simplest fix for the underlying issue, and effectively makes it so that unless a user has a valid mapping set in /etc/subgid (which only administrators can modify) -- and they are currently trying to use that mapping -- then /proc/$pid/setgroups will be set to deny. This workaround is only partial, because ideally it should be possible to set an "allow_setgroups" or "deny_setgroups" flag in /etc/subgid to allow administrators to further restrict newgidmap(1). We also don't write anything in the "allow" case because "allow" is the default, and users may have already written "deny" even if they technically are allowed to use setgroups. And we don't write anything if the setgroups policy is already "deny". Ref: https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357 Fixes: CVE-2018-7169 Affects shadow <= 4.5 (From OE-Core rev: a875522540372a4fa6658885692e564dfd729f54) Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: fix CVE-2017-2616Andrej Valek2018-08-012-0/+65
| | | | | | | | | | | | (From OE-Core rev: 94a1e2794df15f0f2cb62ae030cd81e6c0798b1f) (From OE-Core rev: 8894c70ae5a44974f74434d251def3148818a866) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: update SRC_URI now Alioth is downRoss Burton2018-07-191-1/+3
| | | | | | | | | | | | | | | | | | | Alioth is dead so we can't use it for SRC_URI anymore. There is a shadow repository on GitHub which is the new upstream, but for some reason it is missing the 4.2.1 tag and tarball that we use. Also 4.2.1 was never uploaded into Debian itself, so we can't use their mirror network either. For now point SRC_URI at the Yocto Project source mirror and set UPSTREAM_CHECK_URI so that we get nagged to upgrade to 4.6. (From OE-Core rev: b3e246fef166030f327b5a852718ea907ada1759) (From OE-Core rev: cdc91a056e315bea71c3ac1a1ac4024d3214a99d) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: fix pam configs for chpasswd, newusersyadi.hu@windriver.com2018-07-022-0/+4
| | | | | | | | | | | | | | | | | | | | | Fix below errors while pam is enabled on target: root@qemux86:~# newusers newusers: PAM: Authentication failure root@qemux86:~# chpasswd chpasswd: PAM: Authentication failure The configs copied from "chgpasswd" which command works with pam. (From OE-Core rev: f6efc1dbd1f3a0f68ee731ff2b5a5d798ecf2cf8) (From OE-Core rev: 67a504e3bfa8272c0ced9caf98e38896c576e3b8) Signed-off-by: Hu <yadi.hu@windriver.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: update ownership and permission of /var/spool/mailKai Kang2018-07-021-1/+2
| | | | | | | | | | | | | | | | Update shadow to change ownership of /var/spool/mail from root:root to root:mail and permission from 0755 to 0775 just as in most popular distributions such as fedora and debian(It also set setgid bit in debian but we don't need it). (From OE-Core rev: b3ab5fe359c38cdd5cd86cb8ffe076d7a2baac18) (From OE-Core rev: a77eff19be1d5812999bf584364000440f218fbb) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nativesdk-glibc: Split glibc and libcrypt to use libxcrypt insteadRichard Purdie2018-04-071-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fedora28[1] has decided to go ahead and use libxcrypt to replace libcrypt from glibc despite the change not having merged into glibc upstream yet. This breaks the use of uninative in OE on fedora28 since binaries there are now using new symbols only found in libxcrypt. libxcrypt is meant to be backwards compatible with libcrypt but not the reverse. Since this will impact OE in the next release cycle, this changes nativesdk only to use this new model and adds libxcrypt to work in that case. This allows us to build a uninative which is compatible with fedora28 and previous other OSes. In order to work, recipes will now need to depend on virtual/crypt where they use libcrypt since its now a separate library and we can't depend on it from glibc to preseve backwards compatibility since glibc needs to build first. For now, only the problematic nativesdk recipes have been fixed up. For target use, the default provider remains glibc for now. Assuming this change is merged into upstream glibc, we will need to roll this change out for the target but we will do this in the next release cycle when we can better deal with the resulting bugs. [1] https://fedoraproject.org/wiki/Changes/Replace_glibc_libcrypt_with_libxcrypt Original patch from Charles-Antoine Couret <charles-antoine.couret@essensium.com>, tweaked by RP to add virtual provides, SkipRecipe for libxcrypt and other minor tweaks. (From OE-Core rev: c1573cb7faeb296fe7077a60d02443d5ed5bded0) Signed-off-by: Charles-Antoine Couret <charles-antoine.couret@essensium.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow.inc: run postinst only for targetMartin Jansa2018-03-251-1/+1
| | | | | | | | | | | | * fails for nativesdk-shadow with: pwconv: /etc/passwd.29063: No such file or directory pwconv: cannot lock /etc/passwd; try again later. (From OE-Core rev: c292945611d9f825051ac4938bb22a7d42fff994) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: fix CVE-2017-12424Chen Qi2017-08-182-0/+47
| | | | | | | | | | | | | | | | Backport a patch to fix CVE-2017-12424. In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Reference link: https://nvd.nist.gov/vuln/detail/CVE-2017-12424 CVE: CVE-2017-12424 (From OE-Core rev: 896495d4d2a9751e6e013a3498293b2443d7d809) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: Drop remnants of uclibc supportRichard Purdie2017-06-221-1/+0
| | | | | | | | | | | | | | uclibc support was removed a while ago and musl works much better. Start to remove the various overrides and patches related to uclibc which are no longer needed. uclibc support in a layer would still be possible. I have strong reasons to believe nobody is still using uclibc since patches are missing and I doubt the metadata even parses anymore. (From OE-Core rev: 653704e9cf325cb494eb23facca19e9f05132ffd) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* util-linux,shadow: Make 'nologin' alternative commandAmarnath Valluri2017-03-221-1/+2
| | | | | | | | | | | | Both shadow and util-linux packages provides 'nologin' binary in ${base_sbindir} and ${sbindir} respectively, this leads to conflict when 'usrmerge' feature is enabled, where ${sbindir} == ${base_sbindir}. Hance, handle this to alternative system to resolve the conflict. (From OE-Core rev: 07d6d0fb4dc689008bb0022d7d2ecc890c9159e5) Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: 'useradd' copies root's extended attributesJosé Bollo2017-03-174-7/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | The copy of extended attributes is interesting for Smack systems because it allows to set the security template of the user's home directories without modifying the tools (useradd here). But the version of useradd that copies the extended attributes doesn't copy the extended attributes of the root. This can make use of homes impossible! This patch corrects the issue by copying the extended attributes of the root directory: /home/user will get the extended attributes of /etc/skel. The patch is submitted upstream (see http://lists.alioth.debian.org/pipermail/pkg-shadow-commits/2017-March/003804.html) The existing patch specific to open-embedded is updated: 0001-useradd.c-create-parent-directories-when-necessary.patch Also, attr are activated for native tools. This is needed when users are created during image creation. (From OE-Core rev: eed66e85af5ca6bbdd80cc3d5cf8453e8d8880bc) Signed-off-by: José Bollo <jose.bollo@iot.bzh> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: use config 'attr' if distro has 'xattr'José Bollo2017-03-101-1/+2
| | | | | | | | | | | When DISTRO_FEATURES has 'xattr' the shadow package now automatically activates its config 'attr'. (From OE-Core rev: 860c941741ca57bdc6fdbb67ea3ad94bb8d08c16) Signed-off-by: José Bollo <jose.bollo@iot.bzh> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Make use of the new bb.utils.filter() functionPeter Kjellerstedt2017-03-011-1/+1
| | | | | | | (From OE-Core rev: 0a1427bf9aeeda6bee2cc0af8da4ea5fd90aef6f) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: Add PACKAGE_WRITE_DEPS for postinstJussi Kukkonen2017-01-201-1/+1
| | | | | | | | | pwconv and grpconv are used in the postinstall script. (From OE-Core rev: 5a59e292d1382ea6858f6ccb532e48a9f1f4bea6) Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: add nologin.8 to alternativesRoss Burton2016-11-061-1/+2
| | | | | | | | | | This manpage is also shipped in util-linux-doc as an alternative, so it needs to be managed as an alternative here too. (From OE-Core rev: 0c1e8e0939b39dcf6ea753b41da5ec9bc6ebb82a) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: use relaxed usernamesShan Hai2016-09-162-0/+101
| | | | | | | | | | | | | | | | | The groupadd from shadow does not allow upper case group names, the same is true for the upstream shadow. But distributions like Debian/Ubuntu/CentOS has their own way to cope with this problem, this patch is picked up from CentOS release 7.0 to relax the usernames restrictions to allow the upper case group names, and the relaxation is POSIX compliant because POSIX indicate that usernames are composed of characters from the portable filename character set [A-Za-z0-9._-]. (From OE-Core rev: 31c6c8150394de067085be5b0058037077860a8a) Signed-off-by: Shan Hai <shan.hai@windriver.com> Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: Fix rootfs creation errorsDai Caiyun2016-05-221-1/+2
| | | | | | | | | | | error: file /usr/share/man/man1/su.1 from install of shadow-doc-4.2.1 conflicts with file from package coreutils-doc-6.9-r5 (From OE-Core rev: 52d3d9e1ab0b510d93c4915baf2a85b9cc949205) Signed-off-by: Dai Caiyun <daicy.fnst@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow-sysroot: Use SYSROOT_DIRS to add dirs to stage in sysrootPeter Kjellerstedt2016-05-131-4/+2
| | | | | | (From OE-Core rev: 196e01cce6d76c72d8e76ad1441c1baed321c939) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: Disable syslog for more commandsPeter Kjellerstedt2016-04-153-36/+126
| | | | | | | | | | | | When building shadow-native, syslog was disabled for useradd and groupadd. This disables it also for groupdel, groupmems, groupmod, userdel and usermod (i.e., the use of syslog is now disabled for all commands supported by useradd_base.bbclass). (From OE-Core rev: 0791ba7ea82444729a1a7d1b2443f633bcba2002) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Update alternatives of man pagesKai Kang2015-07-081-1/+2
| | | | | | | | | | Update alternatives of man pages in several packages. (From OE-Core rev: 2cff20f423fb9e82b44c68504be605c223bd74fb) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: fix `su' behaviourChen Qi2015-04-242-26/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 0001-su.c-fix-to-exec-command-correctly.patch is removed. Below is the reason. This patch is introduced to solve the 'su: applet not found' problem when executing `su -l xxx -c env'. The patch references codes of previous release of shadow. However, this patch introduces bug#5359. So it's not correct. Let's first look at the root cause of 'su: applet not found' problem. This problem appears when /bin/sh is provided by busybox. When executing `su -l xxx -c env' command, the following function is invoked. execve("/bin/sh", ["-su", "-c", "env"], [/* 6 vars */]) Note that the argv[0] provided to new executable file (/bin/sh) is "-su". As /bin/sh is a symlink to /bin/busybox. It's /bin/busybox that is executed. In busybox's appletlib.c, it would examine argv[0], try to find an applet that has the same name, and then try to execute the main function of the applet. This logic results in `su' applet from busybox to be executed. However, we default to set 'BUSYBOX_SPLIT_SUID' to "1", so 'su' is not found. Further more, even if we set 'BUSYBOX_SPLIT_SUID' to "0", so that 'su' applet is found. The whole behaviour is still not correct. Because 'su' from shadow takes higher priority than that from busybox, so 'su' from busybox should never be executed on such system unless it's specified clearly by the end user. The logic of busybox's appletlib.c is totally correct from the point of busybox itself. It's an integration problem. To solve the above problem, this patch comment out SU_NAME in /etc/login.defs so that the final function executed in shadow's su is as below. execve("/bin/sh", ["-sh", "-c", "env"], [/* 6 vars */]) [YOCTO #5359] [YOCTO #7137] (From OE-Core rev: 6820f05dad0b4f9b9bbcf7c2a0af8c34f66199ae) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: split files needed for PAM use into separate packageMatt Madison2015-04-101-2/+17
| | | | | | | | | | | | The rootfs creator automatically removes shadow for read-only root filesystems, which breaks use of PAM plugins for login and other process identity management utilities. Package those programs and config files separately, so they don't get removed. (From OE-Core rev: a7d8eaef04c9dd6ede8d4efd8c4b776efbe3c767) Signed-off-by: Matt Madison <matt@madison.systems> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: add 'util-linux-sulogin' to RDEPENDSChen Qi2015-04-101-1/+2
| | | | | | | | | | | | | | | | | | | | | If shadow is installed, sulogin from busybox cannot work correctly because it still assumes that /etc/shadow is not there. This leads to the problem when booting into rescue mode in an image with shadow installed but not sulogin from util-linux. To fix this problem, we add 'util-linux-sulogin' to RDEPENDS of shadow. This runtime dependency is specific to OE, because we have to ensure that sulogin can work correctly and sulogin from busybox cannot because FEATURE_SHADOWPASSWORDS is not enabled by default. And we cannot enable it by default for busybox, because that would lead to utilities in busybox to assume the existence of /etc/shadow which is not always true in OE. [YOCTO #6698] (From OE-Core rev: 9b45b990d2fc870df556f05908dcb48b9ebcfc02) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: securetty: Add Xilinx Zynq SoCSoren Brinkmann2015-01-291-0/+4
| | | | | | | | | | Add Zynq's console devices to securetty. (From OE-Core rev: 82f5fd5f39b1c665098dd5ca567cbb2b5d955924) Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: set proper S valuePetter Mabäcker2015-01-231-0/+2
| | | | | | | | | | | | | | After removal of auto-creating S we must ensure that all recipes are using a proper value for S. Fix all recipes that only need to set S equals to WORKDIR. [YOCTO #5627] (From OE-Core rev: 9d220b1bfe4589736604dd5a7129e3699377d830) Signed-off-by: Petter Mabäcker <petter@technux.se> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: disable nscd feature when glibc is not built with spawn posix functionsBaptiste DURAND2014-12-191-0/+1
| | | | | | | | | | | | | | | | shadow package configure step fails with this log output : | checking location of faillog/lastlog/wtmp... (cached) /var/log | checking location of the passwd program... (cached) /usr/bin | checking for posix_spawn... no | configure: error: posix_spawn is needed for nscd support | Configure failed. The contents of all config.log files follows to aid debugging | ERROR: oe_runconf failed (From OE-Core rev: 3678e504cf81f45bd0b0ab315f9cc4da87a633b5) Signed-off-by: Baptiste DURAND <baptiste.durand@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow-securetty: add ttyAM[0-3] serial portsJavier Viguera2014-11-201-0/+4
| | | | | | | | | | Old version of the ARM AMBA serial port driver creates those device nodes. (From OE-Core rev: fa17b9ea435f5c49e3bea56524152b21d915d464) Signed-off-by: Javier Viguera <javier.viguera@digi.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* man-pages/shadow: resolve man pages conflictionHongxu Jia2014-11-041-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Invoke smart/rpm to install man-pages and shadow-doc, there is a build failure: ... |error: file /usr/share/man/man5/passwd.5 from install of shadow-doc-4.2.1-r0.0.core2_64 conflicts with file from package man-pages-3.70-r0.0.core2_64 |error: file /usr/share/man/man3/getspnam.3 from install of shadow-doc-4.2.1-r0.0.core2_64 conflicts with file from package man-pages-3.70-r0.0.core2_64 ... Use alternatives mechanism to fix it. As README in man-pages said: "Note that sometimes these pages are duplicates of pages also distributed in other packages. Be careful not to overwrite more up-to-date versions. So we set man-pages with lower priority. [YOCTO #6769] (From OE-Core rev: 32357da67fa640bc0c14048af1d7b8dbbe8e775e) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: enable support for subordinate IDsBogdan Purcareata2014-11-042-1/+43
| | | | | | | | | | | | | | | | | | | | | The subordinate IDs support in pkg-shadow allows unprivileged users to manage a set of UIDs and GIDs. These subordinate IDs are specified by root, and can be further used by the unprivileged user they have been assigned to. This user can then create an e.g. user namespace, where he is allowed to manage his own set of users and group from the pool of subordinate IDs. More details can be found at http://lwn.net/Articles/533617/. Pull a required change from upstream in order to make shadow cross-compile with subordinate IDs support. Enable flag in recipe. Changes since v1: - update changelog (From OE-Core rev: 8548868c05e52700fd4712298b1705b8ec7ae446) Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: Make useradd work correctly with --root againPeter Kjellerstedt2014-09-162-0/+47
| | | | | | | | | | | | | Even if useradd --root <root> is used it would still read login.defs before doing the chroot() and thus use the one provided by the host rather than the sysroot. (From OE-Core rev: b85917a4ebe636316fa7305017cd32a47b392039) (From OE-Core rev: 0af59a04135f067f0e01883defa77c6f714eab2e) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: add Qualcomm and STMicroelectronics SoCsFathi Boudra2014-09-101-0/+15
| | | | | | | | | | | Reported-by: Nicolas Dechesne <nicolas.dechesne@linaro.org> Reported-by: Peter Griffin <peter.griffin@linaro.org> (From OE-Core rev: 8c811541125fff75429d09249299add5ffe80912) Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow-securetty: add freescale lpuartStefan Agner2014-07-251-0/+8
| | | | | | | | | | | Add Freescale lpuart tty's (ttyLPx) to securetty. Freescale Vybrid devices running upstream kernel use this driver. (From OE-Core rev: 1732ea461f1d0afe254e36a8bfe84a6675a42e66) Signed-off-by: Stefan Agner <stefan@agner.ch> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: fix the behavior of suChen Qi2014-07-232-0/+26
| | | | | | | | | | | | | | | In systems where bash is not installed and /bin/sh is provided by busybox. Commands like `su -l -c '/home/root/test' xuser' would fail complaining the the 'su' applet could not be found. This patch references the old version of shadow to keep the behaviour the way it was in old version so that we would avoid the problem mentioned above. (From OE-Core rev: ab0115d1b8a0cb0b25bdb14fd2a3e6c6bb9a44f8) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: Add PACKAGECONFIG for acl/attrRichard Purdie2014-07-211-0/+2
| | | | | | | | Otherwise builds are not deterministic. (From OE-Core rev: 11e02c05da6945c24092ec06493cdafa2dcdbe0d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: upgrade from 4.1.4.3 to 4.2.1Chen Qi2014-07-1719-1936/+333
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upgrade shadow from 4.1.4.3 to 4.2.1. Changes during this upgrade are as following. 1. Remove the "merged" patches. These patches are either merged or the same functionality has been implemented upstream. add_root_cmd_groupmems.patch add_root_cmd_options.patch fix-etc-gshadow-reading.patch shadow-4.1.4.2-env-reset-keep-locale.patch shadow-4.1.4.2-groupmod-pam-check.patch shadow-4.1.4.2-su_no_sanitize_env.patch shadow.automake-1.11.patch shadow_fix_for_automake-1.12.patch useradd.patch 2. Remove the unneeded patch. The following patch has been removed because the logic in the related codes of the new version has been changed. In specific, the codes now can handle the 'NULL' return value. So there's no need for the following patch. slackware_fix_for_glib-2.17_crypt.patch 3. Teak the current patch to match the new version. allow-for-setting-password-in-clear-text.patch 4. Add a patch to fix compilation failure. usermod-fix-compilation-failure-with-subids-disabled.patch 5. Add a patch to fix the installation failure. fix-installation-failure-with-subids-disabled.patch 5. Add a patch to fix the failure at rootfs time if extrausers is inherited. commonio.c-fix-unexpected-open-failure-in-chroot-env.patch 6. Fix the bad section in the recipe. 7. Disable the new subids feature in the new version as it doesn't support cross compilation for now. 8. Modify the pkg_postinst to `exit 1' if the `pwconv' or `grpconv' fails. Also, fix the arguments to use '--root $D' instead of '--root=$D'. 9. Add a patch for shadow-native to create parent directories when necessary. 0001-useradd.c-create-parent-directories-when-necessary.patch (From OE-Core rev: b73e5cd51551556f9e6a4f7d9e7deec4d9d661bd) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Globally replace 'base_contains' calls with 'bb.utils.contains'Otavio Salvador2014-04-252-3/+3
| | | | | | | | | | | The base_contains is kept as a compatibility method and we ought to not use it in OE-Core so we can remove it from base metadata in future. (From OE-Core rev: d83b16dbf0862be387f84228710cb165c6d2b03b) Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: fix building systemd with useradd-staticids.bbclass enabledAndreas Müller2014-04-231-0/+1
| | | | | | | | | | | | | | groupadd: 'systemd-journal-gateway' is not a valid group name Without useradd-staticids enabled, group 'systemd-journal-gateway' is created by useradd and that seems not to care for GROUP_NAME_MAX_LENGTH which has 16 by default. (From OE-Core rev: 33c7892326de296cc6d143577be5b395ac887d91) Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: bump PRsMartin Jansa2014-03-052-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * resolves following warnings: WARNING: Use of PRINC 17 was detected in the recipe meta-openembedded/meta-systemd/recipes-core/systemd/systemd-machine-units_1.0.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe meta-openembedded/meta-gpe/recipes-support/fbreader/fbreader_0.12.10.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe meta-openembedded/meta-gpe/recipes-support/fbreader/fbreader_git.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe meta-openembedded/meta-multimedia/recipes-multimedia/sox/sox_14.4.0.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe meta-openembedded/meta-oe/recipes-multimedia/mplayer/mplayer-common.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe meta-smartphone/meta-android/recipes-bsp/chroot-script/chroot-script_1.0.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-connectivity/avahi/avahi-ui_0.6.31.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-connectivity/bind/bind_9.8.1.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-core/systemd/systemd-serialgetty.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-core/sysvinit/sysvinit-inittab_2.88dsf.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-extended/screen/screen_4.0.3.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-extended/shadow/shadow-securetty_4.1.4.3.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-extended/shadow/shadow_4.1.4.3.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-graphics/libsdl/libsdl_1.2.15.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-graphics/packagegroups/packagegroup-core-x11-xserver.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-kernel/modutils-initscripts/modutils-initscripts.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.25.bb (or one of its .bbappends) WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-support/libcap/libcap_2.22.bb (or one of its .bbappends) WARNING: Use of PRINC 11 was detected in the recipe openembedded-core/meta/recipes-bsp/keymaps/keymaps_1.0.bb (or one of its .bbappends) WARNING: Use of PRINC 11 was detected in the recipe openembedded-core/meta/recipes-core/systemd/systemd-compat-units.bb (or one of its .bbappends) WARNING: Use of PRINC 12 was detected in the recipe openembedded-core/meta/recipes-core/initscripts/initscripts_1.0.bb (or one of its .bbappends) WARNING: Use of PRINC 13 was detected in the recipe openembedded-core/meta/recipes-core/base-files/base-files_3.0.14.bb (or one of its .bbappends) WARNING: Use of PRINC 2 was detected in the recipe meta-openembedded/meta-oe/recipes-navigation/navit/navit_svn.bb (or one of its .bbappends) WARNING: Use of PRINC 2 was detected in the recipe meta-openembedded/meta-oe/recipes-support/lvm2/lvm2_2.02.97.bb (or one of its .bbappends) WARNING: Use of PRINC 2 was detected in the recipe openembedded-core/meta/recipes-connectivity/portmap/portmap_6.0.bb (or one of its .bbappends) WARNING: Use of PRINC 2 was detected in the recipe openembedded-core/meta/recipes-extended/pam/libpam_1.1.6.bb (or one of its .bbappends) WARNING: Use of PRINC 2 was detected in the recipe openembedded-core/meta/recipes-graphics/packagegroups/packagegroup-core-x11.bb (or one of its .bbappends) WARNING: Use of PRINC 3 was detected in the recipe meta-openembedded/meta-efl/recipes-efl/efl/entrance_svn.bb (or one of its .bbappends) WARNING: Use of PRINC 3 was detected in the recipe meta-openembedded/meta-oe/recipes-multimedia/mplayer/mplayer2_git.bb (or one of its .bbappends) WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-bsp/formfactor/formfactor_0.0.bb (or one of its .bbappends) WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-connectivity/avahi/avahi_0.6.31.bb (or one of its .bbappends) WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-connectivity/dhcp/dhcp_4.2.5-P1.bb (or one of its .bbappends) WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-core/init-ifupdown/init-ifupdown_1.0.bb (or one of its .bbappends) WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-graphics/xinput-calibrator/pointercal-xinput_0.0.bb (or one of its .bbappends) WARNING: Use of PRINC 5 was detected in the recipe meta-openembedded/meta-oe/recipes-core/meta/distro-feed-configs.bb (or one of its .bbappends) WARNING: Use of PRINC 5 was detected in the recipe openembedded-core/meta/recipes-connectivity/bluez/bluez4_4.101.bb (or one of its .bbappends) WARNING: Use of PRINC 6 was detected in the recipe openembedded-core/meta/recipes-core/packagegroups/packagegroup-base.bb (or one of its .bbappends) WARNING: Use of PRINC 6 was detected in the recipe openembedded-core/meta/recipes-core/packagegroups/packagegroup-core-boot.bb (or one of its .bbappends) WARNING: Use of PRINC 6 was detected in the recipe openembedded-core/meta/recipes-graphics/xorg-xserver/xserver-xf86-config_0.1.bb (or one of its .bbappends) WARNING: Use of PRINC 7 was detected in the recipe meta-openembedded/meta-oe/recipes-navigation/gpsd/gpsd_3.7.bb (or one of its .bbappends) WARNING: Use of PRINC 7 was detected in the recipe openembedded-core/meta/recipes-core/udev/udev-extraconf_1.0.bb (or one of its .bbappends) (From OE-Core rev: c6825ec6e92e20bb64a051d1576f363c16e98d68) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: set correct entries for pseudo terminals in /etc/securettyAndreas Müller2014-01-101-12/+4
| | | | | | | | | | | | | | | | | | | | | | | In commit 10cdd66fe800cffe3f2cbf5c95550b4f7902a311 Author: Ming Liu <ming.liu@windriver.com> Date: Thu Jul 18 10:04:22 2013 +0800 libpam: add a new 'nullok_secure' option support to pam_unix 'null_ok_secure' option was fixed. Since that commit 'su' stopped working in pseudo terminals (created in X environments) for root-accounts with empty password. Background: The PAM configuration for 'su' includes 'common-auth' which uses 'nullok_secure' option for pam_unix. (From OE-Core rev: d28eba07553020bf9bfb1419663c1d18ab36ab66) Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow-native: allow for setting password in clear textChen Qi2013-12-142-0/+209
| | | | | | | | | | | | | | | | | | | Allow user to set password in clear text. This is convenient when we're building out an image. This feature is mainly used by useradd.bbclass and extrausers.bbclass. This patch adds a new option '-P' to useradd, usermod, groupadd and groupmod commands provided by shadow-native. The shadow package on target and in SDK will not be affected. [YOCTO #5365] (From OE-Core rev: 31dee7946340bf0f1e94e4e714191d3d6ca3bf6a) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: change to use SHA512 password encryptionPaul Eggleton2013-12-131-0/+3
| | | | | | | | | | | | | | | | The default encryption method for shadow is DES, which limits passwords to 8 characters. Not only is this undesirable, it's also not how busybox works so we had different passwd/login length behaviour depending on whether shadow was installed in the image or not. Change it to SHA512 which is what most Linux distributions seem to be using currently. (SHA512 also matches up with how we are configuring PAM.) Fixes [YOCTO #5656]. (From OE-Core rev: a9e072f9f0da774411e07abf47dd4bd8c6d685d7) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: remove reference to locale env files from login and suQiang Chen2013-12-092-6/+0
| | | | | | | | | | | | | | | | | | | | | /etc/default/locale missing message appears when login and running su <user> qemu0 login[4189]: pam_env(login:session): Unable to open env file: /etc/default/locale: No such file or directory qemu0 login[4189]: pam_unix(login:session): session opened for user root by LOGIN(uid=0) qemu0 su[999]: pam_env(su:session): Unable to open env file: /etc/default/locale: No such file or directory qemu0 su[999]: pam_unix(su:session): session opened for user root by root(uid=0) This commit remove reference from pam.d/login and pam.d/su to /etc/default/locale env file to avoid the error messages as RHEL, fedora does. (From OE-Core rev: 010ffabfb8631bd4894cc3f1f6f0834f3279f30c) Signed-off-by: Qiang Chen <qiang.chen@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Don't set DESCRIPTION to the same value as SUMMARYPaul Eggleton2013-12-033-3/+0
| | | | | | | | | | | | Setting DESCRIPTION to the same value as SUMMARY doesn't do anything, since the value of DESCRIPTION will be derived from SUMMARY if not specified. (From OE-Core rev: e1e888585c84175580ad822d4a6c93f62e5ce16c) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: Add nativesdk to BBCLASSEXTENDDavid Nyström2013-09-262-1/+11
| | | | | | | | | | | | | | | | | | | | | | | This is a second in a series of patches to enable offline rootfs creation from a package repository. Some postinstall cmds are Yocto specific and needed to create a rootfs with pre and post install hooks successfully run, using only the toolchain tarball + a package repo. End goal is to create a sandbox where users of a Yocto based distribution can customize a rootfs from a package feed with their package manager of choice. With this patch, I can successfully create packagegroup-core-boot with only the toolchain tarball(OPKG). More fixes for a few postinstall hooks outside of packagegroup-core-boot will come next. (From OE-Core rev: f90e1a45a042468e4e9a0fc91b57c6dba6f7adc9) Signed-off-by: David Nyström <david.nystrom@enea.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: Turn shadow-native into a BBCLASSEXTENDRichard Purdie2013-09-243-108/+113
| | | | | | (From OE-Core rev: 44fafdb5eca1fc8766bf649bc78e770e1d18979d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: Move common code to shadow.incRichard Purdie2013-09-243-98/+61
| | | | | | (From OE-Core rev: ec64632d312a099c7c544af63b25e2defde0038e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: move su to /bin for lsb command check testHongxu Jia2013-09-171-1/+2
| | | | | | | | | | | | | | | In busybox, util-linux and shadow, su has been moved to /usr/bin/, but lsb cmdchk needs su in /bin. Move su to /bin could fix this issue. [YOCTO#5175] (From OE-Core rev: 464d274e45bb94d9990577d85aa5ad02eb5da99c) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: backport a patch to make newgrp workRoy.Li2013-08-222-0/+37
| | | | | | | | | | | | | Backport a Debian patch to fix the reading of the gshadow file in order to make newgrp work correctly. (From OE-Core rev: 3ef8db6217f7c40a9eb063d21ce6f25b16d88d53) Signed-off-by: Roy.Li <rongqing.li@windriver.com> [sgw - tweaked commit message] Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: Fix build when DISTRO_FEATURES contains pam, libc-cryptRichard Tollerton2013-08-031-0/+4
| | | | | | | | | | | shadow falsely assumes that if --enable-libpam is set, it doesn't need to link against libcrypt; this breaks chsh. (This same fix exists in Arch.) (From OE-Core rev: f68eccd67a3f9ed0d62e5ab75545891bd724daa3) Signed-off-by: Richard Tollerton <rich.tollerton@ni.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-23 09:20:50 +0000