Date: Sunday, October 16, 2022 @ 19:56:15 Author: dvzrv Revision: 458271
archrelease: copy trunk to testing-x86_64 Added: shadow/repos/testing-x86_64/ shadow/repos/testing-x86_64/PKGBUILD (from rev 458270, shadow/trunk/PKGBUILD) shadow/repos/testing-x86_64/chgpasswd (from rev 458270, shadow/trunk/chgpasswd) shadow/repos/testing-x86_64/chpasswd (from rev 458270, shadow/trunk/chpasswd) shadow/repos/testing-x86_64/defaults.pam (from rev 458270, shadow/trunk/defaults.pam) shadow/repos/testing-x86_64/keys/ shadow/repos/testing-x86_64/newusers (from rev 458270, shadow/trunk/newusers) shadow/repos/testing-x86_64/passwd (from rev 458270, shadow/trunk/passwd) shadow/repos/testing-x86_64/shadow-4.11.1-login.defs.patch (from rev 458270, shadow/trunk/shadow-4.11.1-login.defs.patch) shadow/repos/testing-x86_64/shadow.install (from rev 458270, shadow/trunk/shadow.install) shadow/repos/testing-x86_64/shadow.service (from rev 458270, shadow/trunk/shadow.service) shadow/repos/testing-x86_64/shadow.timer (from rev 458270, shadow/trunk/shadow.timer) shadow/repos/testing-x86_64/useradd.defaults (from rev 458270, shadow/trunk/useradd.defaults) --------------------------------+ PKGBUILD | 149 +++++++++++++++++++++++++ chgpasswd | 4 chpasswd | 6 + defaults.pam | 6 + newusers | 6 + passwd | 4 shadow-4.11.1-login.defs.patch | 230 +++++++++++++++++++++++++++++++++++++++ shadow.install | 22 +++ shadow.service | 11 + shadow.timer | 7 + useradd.defaults | 9 + 11 files changed, 454 insertions(+) Copied: shadow/repos/testing-x86_64/PKGBUILD (from rev 458270, shadow/trunk/PKGBUILD) =================================================================== --- testing-x86_64/PKGBUILD (rev 0) +++ testing-x86_64/PKGBUILD 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,149 @@ +# Maintainer: David Runge <dv...@archlinux.org> +# Contributor: Dave Reisner <dreis...@archlinux.org> +# Contributor: Aaron Griffin <aa...@archlinux.org> + +pkgname=shadow +pkgver=4.11.1 +pkgrel=2 +pkgdesc="Password and account management tool suite with support for shadow files and PAM" +arch=('x86_64') +url='https://github.com/shadow-maint/shadow' +license=('BSD') +# libcap-ng needed by install scriptlet for 'filecap' +depends=( + 'acl' 'libacl.so' + 'attr' 'libattr.so' + 'audit' 'libaudit.so' + 'glibc' + 'libcap-ng' + 'libxcrypt' 'libcrypt.so' + 'pam' 'libpam.so' 'libpam_misc.so' +) +backup=( + etc/default/useradd + etc/login.defs + etc/pam.d/{chage,{,ch,chg}passwd,group{add,del,mems,mod},newusers,shadow,user{add,del,mod}} +) +options=(debug '!emptydirs') +install=shadow.install +source=( + "https://github.com/shadow-maint/shadow/releases/download/v$pkgver/shadow-$pkgver.tar.xz"{,.asc} + chgpasswd + chpasswd + defaults.pam + newusers + passwd + shadow.{timer,service} + useradd.defaults + $pkgname-4.11.1-login.defs.patch +) +sha512sums=('12fbe4d6ac929ad3c21525ed0f1026b5b678ccec9762f2ec7e611d9c180934def506325f2835fb750dd30af035b592f827ff151cd6e4c805aaaf8e01425c279f' + 'SKIP' + 'aef316f283a0ba0387afd5bd049b20d748dcfe8aebc5f5ea1ce1308167d6a578ae7d0007a5ed4d9862de7d377851edd2c8771e1fb1076262468078c2c76e42fc' + 'dc75dfeafa901f9988176b82ef9db5d927dfe687a72ca36ca13ba3e7ac1b0c8055db1104373f2a7ac463e156f079cbc1f0a9f5e6e16b9f74153eb63dcb8f96df' + '41c856d893c4157b158d79341fe2b1892be463e17f7a007f1c17397b5625c1d2d5671bc0b37879064ae715a918fb9b05c32d18d1aaa64284cddd8ecbda9b2434' + 'dc75dfeafa901f9988176b82ef9db5d927dfe687a72ca36ca13ba3e7ac1b0c8055db1104373f2a7ac463e156f079cbc1f0a9f5e6e16b9f74153eb63dcb8f96df' + '4fb7474ea9dedf86e4c65bf18f503a6d8c00d477a7c32be3cfdfd026bd62ef866d009c50e5a2dc2101bea332c5697bc1e0d55225f39c83252860f5b9b7461aeb' + 'e4edf705dd04e088c6b561713eaa1afeb92f42ac13722bff037aede6ac5ad7d4d00828cfb677f7b1ff048db8b6788238c1ab6a71dfcfd3e02ef6cb78ae09a621' + '67a49415f676a443f81021bfa29d198462008da1224086f8c549b19c2fd21514ca3302d5ac23edec28b9c724fef921596586423ebe41e852ebfbe7216af727e6' + 'b681401895de553674cfc7f51809565db03cb4351f85b492460d09abfd703e73c41ba1dfd708964e0f6ea356dc9c929818c62e7d740d55fb795a2e9b7de271fc' + 'fab778c3afe0f78272de01396968f0f0c40ec8469d12a121e1a53f1d8b4af046a441291ca8020b5cfd5f91b776e6e0f39b63c3dcedf36b25b8b85c9e1ad59715') +b2sums=('d459a1e0ffb342b6b455caf65e6af60b32eee72d4a9b1ab126485fb4632503a42061d3f0b960554c8155af6dc0564c585335b27aecca6538b394a0d58d927588' + 'SKIP' + '31e74eebedf8cb6e5ade36096b4399892d7091b9dce4645fde591f64802dc8befd73ae8019e78f8d326a605b224c7828694d21788bd6073db43c41cf5a9c2805' + '1518839dbfe12f2f55190976de808515f93eb8c06f1570f02780a5ce8c237e0be43aa7cd0fbbe4c88af1f641586e4d3cf122896d97c7594ef72991e1801ee666' + '5fde901d7d29995523cf261de973cc053265f37cf8fecc5511ccfff35a6ef4308f8cf36dc94e37c8b7604694ffa6ab87331c9b533b3538c6f7d7d911c9f94d19' + '1518839dbfe12f2f55190976de808515f93eb8c06f1570f02780a5ce8c237e0be43aa7cd0fbbe4c88af1f641586e4d3cf122896d97c7594ef72991e1801ee666' + '5b4e20609d38dcec82eae66acdfb7d45288574e7bf9684fa0f66bc0fb1c45cd78ee503d04a5084e28755fb7a1c6cea95854c93b33d76ab20964f45420c68403c' + '5cfc936555aa2b2e15f8830ff83764dad6e11a80e2a102c5f2bd3b7c83db22a5457a3afdd182e3648c9d7d5bca90fa550f59576d0ac47a11a31dfb636cb18f2b' + '4a9cb6fe6658f2182655d42761d9d669654c6f0e891610e1b7fd256ce32a561f05e71daf8e473d98f16f5ee9d16d46a097a2d0de42eac58b4ce3be1525a74856' + '75738ba7705fe4f8c22d07bff738a5c2c3bc0fd44d9aaca170cb4e6e7bb3f1e05f729f6decfaa4dec8a037e09fdea83b3500aaa8d6693fd4ae20d7fb0ede420e' + 'a03644975fa0720ffba26578b84d0ef06ad31b7eeb1e80e3c5e6cb1e9bde32bfc455754e81bac060fba070169fa39b7dd1631058b4290cbdafe2bf99d1d3e76f') +validpgpkeys=('66D0387DB85D320F8408166DB175CFA98F192AF2') # Serge Hallyn <ser...@kernel.org> + +prepare() { + # comment options that are taken over by util-linux and apply defaults + patch -Np1 -d "$pkgname-$pkgver" -i ../$pkgname-4.11.1-login.defs.patch +} + +build() { + cd "$pkgname-$pkgver" + + ./configure \ + --prefix=/usr \ + --bindir=/usr/bin \ + --sbindir=/usr/bin \ + --libdir=/usr/lib \ + --mandir=/usr/share/man \ + --sysconfdir=/etc \ + --disable-account-tools-setuid \ + --with-fcaps \ + --with-libpam \ + --with-group-name-max-length=32 \ + --with-audit \ + --with-bcrypt \ + --with-yescrypt \ + --without-selinux \ + --without-su + + # prevent excessive overlinking due to libtool + sed -i -e 's/ -shared / -Wl,-O1,--as-needed\0/g' libtool + make +} + +package() { + cd "$pkgname-$pkgver" + + make DESTDIR="$pkgdir" install + make DESTDIR="$pkgdir" -C man install + + # license + install -vDm 644 COPYING -t "$pkgdir/usr/share/licenses/$pkgname/" + + # useradd defaults + install -vDm 600 "../useradd.defaults" "$pkgdir/etc/default/useradd" + + # systemd units + install -vDm 644 "../shadow.timer" -t "$pkgdir/usr/lib/systemd/system/" + install -vDm 644 "../shadow.service" -t "$pkgdir/usr/lib/systemd/system/" + install -vdm 755 "$pkgdir/usr/lib/systemd/system/timers.target.wants" + ln -s ../shadow.timer "$pkgdir/usr/lib/systemd/system/timers.target.wants/shadow.timer" + + # PAM config - custom + rm "$pkgdir/etc/pam.d"/* + install -vDm 644 ../{passwd,chgpasswd,chpasswd,newusers} -t "$pkgdir/etc/pam.d/" + + # PAM config - from tarball + install -vDm 644 etc/pam.d/groupmems -t "$pkgdir/etc/pam.d/" + + # we use the 'useradd' PAM file for other similar utilities + for file in chage group{add,del,mod} shadow user{add,del,mod}; do + install -vDm 644 "../defaults.pam" "$pkgdir/etc/pam.d/$file" + done + + # Remove evil/broken tools + rm -v "$pkgdir"/usr/sbin/logoutd + + # Remove utilities provided by util-linux + rm -v "$pkgdir"/usr/{bin/{login,chsh,chfn,sg,nologin},sbin/{vipw,vigr}} + + # but we keep newgrp, as sg is really an alias to it + mv -v "$pkgdir"/usr/bin/{newgrp,sg} + + # ...and their many man pages + find "$pkgdir"/usr/share/man \ + '(' -name 'chsh.1' -o \ + -name 'chfn.1' -o \ + -name 'su.1' -o \ + -name 'logoutd.8' -o \ + -name 'login.1' -o \ + -name 'nologin.8' -o \ + -name 'vipw.8' -o \ + -name 'vigr.8' -o \ + -name 'newgrp.1' ')' \ + -delete + + # move everything else to /usr/bin, because this isn't handled by ./configure + mv -v "$pkgdir"/usr/sbin/* "$pkgdir"/usr/bin + rmdir -v "$pkgdir/usr/sbin" +} Copied: shadow/repos/testing-x86_64/chgpasswd (from rev 458270, shadow/trunk/chgpasswd) =================================================================== --- testing-x86_64/chgpasswd (rev 0) +++ testing-x86_64/chgpasswd 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,4 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +account required pam_permit.so +password include system-auth Copied: shadow/repos/testing-x86_64/chpasswd (from rev 458270, shadow/trunk/chpasswd) =================================================================== --- testing-x86_64/chpasswd (rev 0) +++ testing-x86_64/chpasswd 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,6 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +auth required pam_unix.so +account required pam_unix.so +session required pam_unix.so +password required pam_unix.so sha512 shadow Copied: shadow/repos/testing-x86_64/defaults.pam (from rev 458270, shadow/trunk/defaults.pam) =================================================================== --- testing-x86_64/defaults.pam (rev 0) +++ testing-x86_64/defaults.pam 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,6 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +auth required pam_unix.so +account required pam_unix.so +session required pam_unix.so +password required pam_permit.so Copied: shadow/repos/testing-x86_64/newusers (from rev 458270, shadow/trunk/newusers) =================================================================== --- testing-x86_64/newusers (rev 0) +++ testing-x86_64/newusers 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,6 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +auth required pam_unix.so +account required pam_unix.so +session required pam_unix.so +password required pam_unix.so sha512 shadow Copied: shadow/repos/testing-x86_64/passwd (from rev 458270, shadow/trunk/passwd) =================================================================== --- testing-x86_64/passwd (rev 0) +++ testing-x86_64/passwd 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,4 @@ +#%PAM-1.0 +#password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3 +#password required pam_unix.so sha512 shadow use_authtok +password required pam_unix.so sha512 shadow nullok Copied: shadow/repos/testing-x86_64/shadow-4.11.1-login.defs.patch (from rev 458270, shadow/trunk/shadow-4.11.1-login.defs.patch) =================================================================== --- testing-x86_64/shadow-4.11.1-login.defs.patch (rev 0) +++ testing-x86_64/shadow-4.11.1-login.defs.patch 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,230 @@ +diff --git i/etc/login.defs w/etc/login.defs +index 114dbcd9..1315e546 100644 +--- i/etc/login.defs ++++ w/etc/login.defs +@@ -3,6 +3,8 @@ + # + # $Id$ + # ++# This file is adapted for the use on Arch Linux. ++# Options overlapping with tooling from util-linux are commented. + + # + # Delay in seconds before being allowed another attempt after a login failure +@@ -14,7 +16,7 @@ FAIL_DELAY 3 + # + # Enable logging and display of /var/log/faillog login(1) failure info. + # +-FAILLOG_ENAB yes ++# FAILLOG_ENAB yes + + # + # Enable display of unknown usernames when login(1) failures are recorded. +@@ -24,12 +26,12 @@ LOG_UNKFAIL_ENAB no + # + # Enable logging of successful logins + # +-LOG_OK_LOGINS no ++# LOG_OK_LOGINS no + + # + # Enable logging and display of /var/log/lastlog login(1) time info. + # +-LASTLOG_ENAB yes ++# LASTLOG_ENAB yes + + # + # Limit the highest user ID number for which the lastlog entries should +@@ -46,28 +48,28 @@ LASTLOG_ENAB yes + # Disable if the shell startup files already check for mail + # ("mailx -e" or equivalent). + # +-MAIL_CHECK_ENAB yes ++# MAIL_CHECK_ENAB yes + + # + # Enable additional checks upon password changes. + # +-OBSCURE_CHECKS_ENAB yes ++# OBSCURE_CHECKS_ENAB yes + + # + # Enable checking of time restrictions specified in /etc/porttime. + # +-PORTTIME_CHECKS_ENAB yes ++# PORTTIME_CHECKS_ENAB yes + + # + # Enable setting of ulimit, umask, and niceness from passwd(5) gecos field. + # +-QUOTAS_ENAB yes ++# QUOTAS_ENAB yes + + # + # Enable "syslog" logging of su(1) activity - in addition to sulog file logging. + # SYSLOG_SG_ENAB does the same for newgrp(1) and sg(1). + # +-SYSLOG_SU_ENAB yes ++# SYSLOG_SU_ENAB yes + SYSLOG_SG_ENAB yes + + # +@@ -87,7 +89,7 @@ CONSOLE /etc/securetty + # If defined, ":" delimited list of "message of the day" files to + # be displayed upon login. + # +-MOTD_FILE /etc/motd ++MOTD_FILE + #MOTD_FILE /etc/motd:/usr/lib/news/news-motd + + # +@@ -105,14 +107,14 @@ MOTD_FILE /etc/motd + # If defined, login(1) failures will be logged here in a utmp format. + # last(1), when invoked as lastb(1), will read /var/log/btmp, so... + # +-FTMP_FILE /var/log/btmp ++# FTMP_FILE /var/log/btmp + + # + # If defined, name of file whose presence will inhibit non-root + # logins. The content of this file should be a message indicating + # why logins are inhibited. + # +-NOLOGINS_FILE /etc/nologin ++# NOLOGINS_FILE /etc/nologin + + # + # If defined, the command name to display when running "su -". For +@@ -120,7 +122,7 @@ NOLOGINS_FILE /etc/nologin + # command as "-su". If not defined, then ps(1) will display the + # name of the shell actually being run, e.g. something like "-sh". + # +-SU_NAME su ++# SU_NAME su + + # + # *REQUIRED* +@@ -150,7 +152,7 @@ HUSHLOGIN_FILE .hushlogin + # If defined, an HZ environment parameter spec. + # + # for Linux/x86 +-ENV_HZ HZ=100 ++# ENV_HZ HZ=100 + # For Linux/Alpha... + #ENV_HZ HZ=1024 + +@@ -158,8 +160,8 @@ ENV_HZ HZ=100 + # *REQUIRED* The default PATH settings, for superuser and normal users. + # + # (they are minimal, add the rest in the shell startup files) +-ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin +-ENV_PATH PATH=/bin:/usr/bin ++ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/bin ++ENV_PATH PATH=/usr/local/sbin:/usr/local/bin:/usr/bin + + # + # Terminal permissions +@@ -188,8 +190,8 @@ TTYPERM 0600 + # + # Prefix these values with "0" to get octal, "0x" to get hexadecimal. + # +-ERASECHAR 0177 +-KILLCHAR 025 ++# ERASECHAR 0177 ++# KILLCHAR 025 + #ULIMIT 2097152 + + # Default initial "umask" value used by login(1) on non-PAM enabled systems. +@@ -216,7 +218,7 @@ UMASK 022 + # + PASS_MAX_DAYS 99999 + PASS_MIN_DAYS 0 +-PASS_MIN_LEN 5 ++# PASS_MIN_LEN 5 + PASS_WARN_AGE 7 + + # +@@ -225,12 +227,12 @@ PASS_WARN_AGE 7 + # to uid 0 accounts. If the group doesn't exist or is empty, no one + # will be able to "su" to uid 0. + # +-SU_WHEEL_ONLY no ++# SU_WHEEL_ONLY no + + # + # If compiled with cracklib support, sets the path to the dictionaries + # +-CRACKLIB_DICTPATH /var/cache/cracklib/cracklib_dict ++# CRACKLIB_DICTPATH /var/cache/cracklib/cracklib_dict + + # + # Min/max values for automatic uid selection in useradd(8) +@@ -238,7 +240,7 @@ CRACKLIB_DICTPATH /var/cache/cracklib/cracklib_dict + UID_MIN 1000 + UID_MAX 60000 + # System accounts +-SYS_UID_MIN 101 ++SYS_UID_MIN 500 + SYS_UID_MAX 999 + # Extra per user uids + SUB_UID_MIN 100000 +@@ -251,7 +253,7 @@ SUB_UID_COUNT 65536 + GID_MIN 1000 + GID_MAX 60000 + # System accounts +-SYS_GID_MIN 101 ++SYS_GID_MIN 500 + SYS_GID_MAX 999 + # Extra per user group ids + SUB_GID_MIN 100000 +@@ -271,12 +273,12 @@ LOGIN_TIMEOUT 60 + # + # Maximum number of attempts to change password if rejected (too easy) + # +-PASS_CHANGE_TRIES 5 ++# PASS_CHANGE_TRIES 5 + + # + # Warn about weak passwords (but still allow them) if you are root. + # +-PASS_ALWAYS_WARN yes ++# PASS_ALWAYS_WARN yes + + # + # Number of significant characters in the password for crypt(). +@@ -288,7 +290,7 @@ PASS_ALWAYS_WARN yes + # + # Require password before chfn(1)/chsh(1) can make any changes. + # +-CHFN_AUTH yes ++# CHFN_AUTH yes + + # + # Which fields may be changed by regular users using chfn(1) - use +@@ -334,7 +336,7 @@ CHFN_RESTRICT rwh + # Note: If you use PAM, it is recommended to use a value consistent with + # the PAM modules configuration. + # +-#ENCRYPT_METHOD DES ++ENCRYPT_METHOD SHA512 + + # + # Only works if ENCRYPT_METHOD is set to SHA256 or SHA512. +@@ -410,7 +412,7 @@ NONEXISTENT /nonexistent + # If this file exists and is readable, login environment will be + # read from it. Every line should be in the form name=value. + # +-ENVIRON_FILE /etc/environment ++# ENVIRON_FILE /etc/environment + + # + # If defined, this command is run when removing a user. +@@ -465,7 +467,7 @@ USERGROUPS_ENAB yes + # Set to "yes" to prevent for all accounts + # Set to "superuser" to prevent for UID 0 / root (default) + # Set to "no" to not prevent for any account (dangerous, historical default) +-PREVENT_NO_AUTH superuser ++# PREVENT_NO_AUTH superuser + + # + # Select the HMAC cryptography algorithm. Copied: shadow/repos/testing-x86_64/shadow.install (from rev 458270, shadow/trunk/shadow.install) =================================================================== --- testing-x86_64/shadow.install (rev 0) +++ testing-x86_64/shadow.install 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,22 @@ +setcaps() { + _setcap() { + if filecap "$1" "$2"; then + chmod -s "$1" + fi + } + + # shadow ships these as setuid, but if we can apply file caps, use those instead. + # 'filecap' insists on absolute paths + _setcap /usr/bin/newuidmap setuid + _setcap /usr/bin/newgidmap setgid +} + +post_install() { + setcaps +} + +post_upgrade() { + setcaps +} + +# vim:set ts=2 sw=2 et: Copied: shadow/repos/testing-x86_64/shadow.service (from rev 458270, shadow/trunk/shadow.service) =================================================================== --- testing-x86_64/shadow.service (rev 0) +++ testing-x86_64/shadow.service 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,11 @@ +[Unit] +Description=Verify integrity of password and group files +After=systemd-sysusers.service + +[Service] +Type=simple +# Always run both checks, but fail the service if either fails +ExecStart=/bin/sh -c '/usr/bin/pwck -r || r=1; /usr/bin/grpck -r && exit $r' +Nice=19 +IOSchedulingClass=best-effort +IOSchedulingPriority=7 Copied: shadow/repos/testing-x86_64/shadow.timer (from rev 458270, shadow/trunk/shadow.timer) =================================================================== --- testing-x86_64/shadow.timer (rev 0) +++ testing-x86_64/shadow.timer 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,7 @@ +[Unit] +Description=Daily verification of password and group files + +[Timer] +OnCalendar=daily +AccuracySec=12h +Persistent=true Copied: shadow/repos/testing-x86_64/useradd.defaults (from rev 458270, shadow/trunk/useradd.defaults) =================================================================== --- testing-x86_64/useradd.defaults (rev 0) +++ testing-x86_64/useradd.defaults 2022-10-16 19:56:15 UTC (rev 458271) @@ -0,0 +1,9 @@ +# useradd defaults file for ArchLinux +# original changes by TomK +GROUP=users +HOME=/home +INACTIVE=-1 +EXPIRE= +SHELL=/bin/bash +SKEL=/etc/skel +CREATE_MAIL_SPOOL=no