linux/poky.git/meta/recipes-extended/shadow, branch uninative-2.2

shadow: update SRC_URI now Alioth is down

2018-06-27T12:55:21+00:00

Alioth is dead so we can't use it for SRC_URI anymore. There is a shadow repository on GitHub which is the new upstream, but for some reason it is missing the 4.2.1 tag and tarball that we use. Also 4.2.1 was never uploaded into Debian itself, so we can't use their mirror network either. For now point SRC_URI at the Yocto Project source mirror and set UPSTREAM_CHECK_URI so that we get nagged to upgrade to 4.6. (From OE-Core rev: b3e246fef166030f327b5a852718ea907ada1759) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

shadow: fix pam configs for chpasswd, newusers

2018-05-29T20:07:17+00:00

Fix below errors while pam is enabled on target: root@qemux86:~# newusers newusers: PAM: Authentication failure root@qemux86:~# chpasswd chpasswd: PAM: Authentication failure The configs copied from "chgpasswd" which command works with pam. (From OE-Core rev: f6efc1dbd1f3a0f68ee731ff2b5a5d798ecf2cf8) Signed-off-by: Hu Signed-off-by: Wenzong Fan Signed-off-by: Richard Purdie

shadow: update ownership and permission of /var/spool/mail

2018-05-29T20:07:17+00:00

Update shadow to change ownership of /var/spool/mail from root:root to root:mail and permission from 0755 to 0775 just as in most popular distributions such as fedora and debian(It also set setgid bit in debian but we don't need it). (From OE-Core rev: b3ab5fe359c38cdd5cd86cb8ffe076d7a2baac18) Signed-off-by: Kai Kang Signed-off-by: Richard Purdie

nativesdk-glibc: Split glibc and libcrypt to use libxcrypt instead

2018-04-07T21:34:45+00:00

Fedora28[1] has decided to go ahead and use libxcrypt to replace libcrypt from glibc despite the change not having merged into glibc upstream yet. This breaks the use of uninative in OE on fedora28 since binaries there are now using new symbols only found in libxcrypt. libxcrypt is meant to be backwards compatible with libcrypt but not the reverse. Since this will impact OE in the next release cycle, this changes nativesdk only to use this new model and adds libxcrypt to work in that case. This allows us to build a uninative which is compatible with fedora28 and previous other OSes. In order to work, recipes will now need to depend on virtual/crypt where they use libcrypt since its now a separate library and we can't depend on it from glibc to preseve backwards compatibility since glibc needs to build first. For now, only the problematic nativesdk recipes have been fixed up. For target use, the default provider remains glibc for now. Assuming this change is merged into upstream glibc, we will need to roll this change out for the target but we will do this in the next release cycle when we can better deal with the resulting bugs. [1] https://fedoraproject.org/wiki/Changes/Replace_glibc_libcrypt_with_libxcrypt Original patch from Charles-Antoine Couret , tweaked by RP to add virtual provides, SkipRecipe for libxcrypt and other minor tweaks. (From OE-Core rev: c1573cb7faeb296fe7077a60d02443d5ed5bded0) Signed-off-by: Charles-Antoine Couret Signed-off-by: Richard Purdie

shadow.inc: run postinst only for target

2018-03-25T08:40:42+00:00

* fails for nativesdk-shadow with: pwconv: /etc/passwd.29063: No such file or directory pwconv: cannot lock /etc/passwd; try again later. (From OE-Core rev: c292945611d9f825051ac4938bb22a7d42fff994) Signed-off-by: Martin Jansa Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

shadow: fix CVE-2017-12424

2017-08-18T09:40:26+00:00

Backport a patch to fix CVE-2017-12424. In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Reference link: https://nvd.nist.gov/vuln/detail/CVE-2017-12424 CVE: CVE-2017-12424 (From OE-Core rev: 896495d4d2a9751e6e013a3498293b2443d7d809) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie

meta: Drop remnants of uclibc support

2017-06-22T08:16:00+00:00

uclibc support was removed a while ago and musl works much better. Start to remove the various overrides and patches related to uclibc which are no longer needed. uclibc support in a layer would still be possible. I have strong reasons to believe nobody is still using uclibc since patches are missing and I doubt the metadata even parses anymore. (From OE-Core rev: 653704e9cf325cb494eb23facca19e9f05132ffd) Signed-off-by: Richard Purdie

util-linux,shadow: Make 'nologin' alternative command

2017-03-22T11:35:20+00:00

Both shadow and util-linux packages provides 'nologin' binary in ${base_sbindir} and ${sbindir} respectively, this leads to conflict when 'usrmerge' feature is enabled, where ${sbindir} == ${base_sbindir}. Hance, handle this to alternative system to resolve the conflict. (From OE-Core rev: 07d6d0fb4dc689008bb0022d7d2ecc890c9159e5) Signed-off-by: Amarnath Valluri Signed-off-by: Richard Purdie

shadow: 'useradd' copies root's extended attributes

2017-03-17T16:53:05+00:00

The copy of extended attributes is interesting for Smack systems because it allows to set the security template of the user's home directories without modifying the tools (useradd here). But the version of useradd that copies the extended attributes doesn't copy the extended attributes of the root. This can make use of homes impossible! This patch corrects the issue by copying the extended attributes of the root directory: /home/user will get the extended attributes of /etc/skel. The patch is submitted upstream (see http://lists.alioth.debian.org/pipermail/pkg-shadow-commits/2017-March/003804.html) The existing patch specific to open-embedded is updated: 0001-useradd.c-create-parent-directories-when-necessary.patch Also, attr are activated for native tools. This is needed when users are created during image creation. (From OE-Core rev: eed66e85af5ca6bbdd80cc3d5cf8453e8d8880bc) Signed-off-by: José Bollo Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

shadow: use config 'attr' if distro has 'xattr'

2017-03-10T14:50:10+00:00

When DISTRO_FEATURES has 'xattr' the shadow package now automatically activates its config 'attr'. (From OE-Core rev: 860c941741ca57bdc6fdbb67ea3ad94bb8d08c16) Signed-off-by: José Bollo Signed-off-by: Ross Burton Signed-off-by: Richard Purdie