fix userdel in chroot (#1316168)
add useful chage -E example to chage manpage
This commit is contained in:
Tomas Mraz
parent
9659143d38
commit
8633999acf
|
|
@ -38,6 +38,20 @@ diff -up shadow-4.3.1/man/chage.1.xml.manfix shadow-4.3.1/man/chage.1.xml
|
|||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -119,6 +122,13 @@
|
||||
system again.
|
||||
</para>
|
||||
<para>
|
||||
+ For example the following can be used to set an account to expire
|
||||
+ in 180 days:
|
||||
+ </para>
|
||||
+ <programlisting>
|
||||
+ chage -E $(date -d +180days +%Y-%m-%d)
|
||||
+ </programlisting>
|
||||
+ <para>
|
||||
Passing the number <emphasis remap='I'>-1</emphasis> as the
|
||||
<replaceable>EXPIRE_DATE</replaceable> will remove an account
|
||||
expiration date.
|
||||
diff -up shadow-4.3.1/man/ja/man5/login.defs.5.manfix shadow-4.3.1/man/ja/man5/login.defs.5
|
||||
--- shadow-4.3.1/man/ja/man5/login.defs.5.manfix 2016-08-15 06:00:59.000000000 +0200
|
||||
+++ shadow-4.3.1/man/ja/man5/login.defs.5 2016-08-22 17:08:48.486332066 +0200
|
||||
|
|
|
|||
|
|
@ -0,0 +1,108 @@
|
|||
diff -up shadow-4.5/lib/selinux.c.userdel-chroot shadow-4.5/lib/selinux.c
|
||||
--- shadow-4.5/lib/selinux.c.userdel-chroot 2017-11-02 10:19:11.886588281 +0100
|
||||
+++ shadow-4.5/lib/selinux.c 2017-11-02 11:38:32.029906306 +0100
|
||||
@@ -75,7 +75,7 @@ int set_selinux_file_context (const char
|
||||
}
|
||||
return 0;
|
||||
error:
|
||||
- if (security_getenforce () != 0) {
|
||||
+ if (security_getenforce () > 0) {
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
@@ -95,7 +95,7 @@ int reset_selinux_file_context (void)
|
||||
selinux_checked = true;
|
||||
}
|
||||
if (selinux_enabled) {
|
||||
- if (setfscreatecon (NULL) != 0) {
|
||||
+ if (setfscreatecon (NULL) != 0 && security_getenforce () > 0) {
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
diff -up shadow-4.5/src/userdel.c.userdel-chroot shadow-4.5/src/userdel.c
|
||||
--- shadow-4.5/src/userdel.c.userdel-chroot 2017-11-02 10:19:11.899588578 +0100
|
||||
+++ shadow-4.5/src/userdel.c 2017-11-02 11:16:07.437048450 +0100
|
||||
@@ -96,6 +96,7 @@ static char *user_home;
|
||||
static bool fflg = false;
|
||||
static bool rflg = false;
|
||||
static bool Zflg = false;
|
||||
+static bool Rflg = false;
|
||||
|
||||
static bool is_shadow_pwd;
|
||||
|
||||
@@ -958,6 +959,7 @@ int main (int argc, char **argv)
|
||||
rflg = true;
|
||||
break;
|
||||
case 'R': /* no-op, handled in process_root_flag () */
|
||||
+ Rflg = true;
|
||||
break;
|
||||
#ifdef WITH_SELINUX
|
||||
case 'Z':
|
||||
@@ -1031,9 +1033,11 @@ int main (int argc, char **argv)
|
||||
* Start with a quick check to see if the user exists.
|
||||
*/
|
||||
user_name = argv[argc - 1];
|
||||
+ open_files ();
|
||||
+
|
||||
{
|
||||
- struct passwd *pwd;
|
||||
- pwd = getpwnam (user_name); /* local, no need for xgetpwnam */
|
||||
+ const struct passwd *pwd;
|
||||
+ pwd = pw_locate (user_name); /* we care only about local users */
|
||||
if (NULL == pwd) {
|
||||
fprintf (stderr, _("%s: user '%s' does not exist\n"),
|
||||
Prog, user_name);
|
||||
@@ -1043,7 +1047,7 @@ int main (int argc, char **argv)
|
||||
user_name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif /* WITH_AUDIT */
|
||||
- exit (E_NOTFOUND);
|
||||
+ fail_exit (E_NOTFOUND);
|
||||
}
|
||||
user_id = pwd->pw_uid;
|
||||
user_gid = pwd->pw_gid;
|
||||
@@ -1051,7 +1055,7 @@ int main (int argc, char **argv)
|
||||
}
|
||||
#ifdef WITH_TCB
|
||||
if (shadowtcb_set_user (user_name) == SHADOWTCB_FAILURE) {
|
||||
- exit (E_NOTFOUND);
|
||||
+ fail_exit (E_NOTFOUND);
|
||||
}
|
||||
#endif /* WITH_TCB */
|
||||
#ifdef USE_NIS
|
||||
@@ -1071,7 +1075,7 @@ int main (int argc, char **argv)
|
||||
_("%s: %s is the NIS master\n"),
|
||||
Prog, nis_master);
|
||||
}
|
||||
- exit (E_NOTFOUND);
|
||||
+ fail_exit (E_NOTFOUND);
|
||||
}
|
||||
#endif /* USE_NIS */
|
||||
/*
|
||||
@@ -1079,7 +1083,7 @@ int main (int argc, char **argv)
|
||||
* Note: This is a best effort basis. The user may log in between,
|
||||
* a cron job may be started on her behalf, etc.
|
||||
*/
|
||||
- if (user_busy (user_name, user_id) != 0) {
|
||||
+ if (!Rflg && user_busy (user_name, user_id) != 0) {
|
||||
if (!fflg) {
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_DEL_USER, Prog,
|
||||
@@ -1087,15 +1091,14 @@ int main (int argc, char **argv)
|
||||
user_name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif /* WITH_AUDIT */
|
||||
- exit (E_USER_BUSY);
|
||||
+ fail_exit (E_USER_BUSY);
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
- * Do the hard stuff - open the files, create the user entries,
|
||||
+ * Do the hard stuff - create the user entries,
|
||||
* create the home directory, then close and update the files.
|
||||
*/
|
||||
- open_files ();
|
||||
update_user ();
|
||||
update_groups ();
|
||||
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
Summary: Utilities for managing accounts and shadow password files
|
||||
Name: shadow-utils
|
||||
Version: 4.5
|
||||
Release: 5%{?dist}
|
||||
Release: 6%{?dist}
|
||||
Epoch: 2
|
||||
URL: http://pkg-shadow.alioth.debian.org/
|
||||
Source0: https://github.com/shadow-maint/shadow/releases/download/%{version}/shadow-%{version}.tar.xz
|
||||
|
|
@ -29,6 +29,7 @@ Patch24: shadow-4.2.1-no-lock-dos.patch
|
|||
Patch28: shadow-4.3.1-selinux-perms.patch
|
||||
Patch29: shadow-4.2.1-null-tm.patch
|
||||
Patch30: shadow-4.1.5.1-newgrp-grouplist.patch
|
||||
Patch31: shadow-4.5-userdel-chroot.patch
|
||||
|
||||
License: BSD and GPLv2+
|
||||
Group: System Environment/Base
|
||||
|
|
@ -78,6 +79,7 @@ are used for managing group accounts.
|
|||
%patch28 -p1 -b .selinux-perms
|
||||
%patch29 -p1 -b .null-tm
|
||||
%patch30 -p1 -b .grouplist
|
||||
%patch31 -p1 -b .userdel-chroot
|
||||
|
||||
iconv -f ISO88591 -t utf-8 doc/HOWTO > doc/HOWTO.utf8
|
||||
cp -f doc/HOWTO.utf8 doc/HOWTO
|
||||
|
|
@ -116,7 +118,6 @@ install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT/%{_sysconfdir}/default/useradd
|
|||
|
||||
|
||||
ln -s useradd $RPM_BUILD_ROOT%{_sbindir}/adduser
|
||||
#ln -s %{_mandir}/man8/useradd.8 $RPM_BUILD_ROOT/%{_mandir}/man8/adduser.8
|
||||
ln -s useradd.8 $RPM_BUILD_ROOT/%{_mandir}/man8/adduser.8
|
||||
for subdir in $RPM_BUILD_ROOT/%{_mandir}/{??,??_??,??_??.*}/man* ; do
|
||||
test -d $subdir && test -e $subdir/useradd.8 && echo ".so man8/useradd.8" > $subdir/adduser.8
|
||||
|
|
@ -234,6 +235,10 @@ rm -rf $RPM_BUILD_ROOT
|
|||
%{_mandir}/man8/vigr.8*
|
||||
|
||||
%changelog
|
||||
* Thu Nov 2 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-6
|
||||
- fix userdel in chroot (#1316168)
|
||||
- add useful chage -E example to chage manpage
|
||||
|
||||
* Fri Sep 15 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-5
|
||||
- do not allow "." and ".." user names
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue