Release 4.17.3

Signed-off-by: Serge Hallyn <serge@hallyn.com>

chsh: do not warn about blank shell

Closes: <https://bugs.debian.org/876542>
Reported-by: 積丹尼 Dan Jacobson <jidanni@jidanni.org>
Signed-off-by: Chris Hofstaedtler <zeha@debian.org>
Reviewed-by: Alejandro Colomar <alx@kernel.org>

lib/: Use strisdigit() instead of its pattern

Note that the old code in

(1)  lib/strtoday.c:strtoday()
(2)  lib/subordinateio.c:append_uids()

was considering an empty string as if it were a number.
strisdigit() does not consider an empty string to be numeric.

I think it will not affect the behavior in either case, as they should
sooner or later result in an error somewhere.  And it seems (IMO)
surprising to treat empty strings as numeric strings, so let's not do
it.

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/ctype/strisascii/: strisdigit(): Add function

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/: Add comments expanding the letter-soup API names

Suggested-by: Serge Hallyn <serge@hallyn.com>
Cc: Chris Bazley <Chris.Bazley@arm.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/basename.c: Basename(): Use stprcspn() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strspn/, lib/, src/: stprspn(), strrspn_(): Split API into function and macro

This provides a safer and more consistent API.

We had the strrspn(3) function as it was for compatibility with Oracle
Solaris, but let's not repeat their mistake.  Nevertheless, name our
function strrspn_() with a trailing underscore, to differentiate it from
the one in Solaris, since it's slightly different.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strspn/, lib/, src/: Move *spn() APIs to separate subdir

This provides a better organization.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strchr/: strrcspn(), stprcspn(): Add function and macro

These APIs are to strrspn(), like strcspn() is to strspn().
They are like strcspn(3), but search from the end of the string.

The function is meant for internal use, and consistency with libc.
The macro is meant for normal use, since it returns a pointer,
which is what algorithms using this need.

See also strspn(3) and strcspn(3).

Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/useradd.c: Use !strcaseeq() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Use strcaseeq() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strcmp/: strcaseeq(): Add function

Signed-off-by: Alejandro Colomar <alx@kernel.org>

man/useradd.8.xml: Document new exit code 19 (E_BAD_NAME)

Link: <https://github.com/shadow-maint/shadow/issues/1103>
Link: <https://github.com/shadow-maint/shadow/pull/1141>
Signed-off-by: Marc 'Zugschlus' Haber <mh+githubvisible@zugschlus.de>
Cc: Chris Hofstaedtler <zeha@debian.org>
Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/useradd.c: E_BAD_NAME: Use a different error code for bad login names

Wrappers like adduser(8) want to do their own stuff if the login name is
bad.  For that, they need to be able to differentiate such an error.

Closes: <https://github.com/shadow-maint/shadow/issues/1103>
Suggested-by: Chris Hofstaedtler <zeha@debian.org>
Cc: Marc 'Zugschlus' Haber <mh+githubvisible@zugschlus.de>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/useradd.c: create_home(): Use !streq() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/chkname.c: is_valid_name(): Use streq() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac, lib/: Use __has_include(<gshadow.h>) instead of HAVE_GSHADOW_H

Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac: Remove unused AC_CHECK_HEADERS() checks

$ grep -rE 'HAVE_(UTMP)_H'
$ grep -rE 'HAVE_(TERMIO|SGTTY|SYS_IOCTL|PATHS)_H'
$ grep -rE 'HAVE_(LASTLOG|RPC_KEY_PROT|ACL_LIBACL)_H'
$ grep -rE 'HAVE_(ATTR_LIBATTR|ATTR_ERROR_CONTEXT)_H'
$

Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac, lib/: Use __has_include(<sys/capability.h>) instead of HAVE_SYS_CAPABILITY_H

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/idmapping.c: Unconditionally include <sys/prctl.h>

It's a widely available header.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Use __has_include(<security/openpam.h>) instead of HAVE_SECURITY_OPENPAM_H

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Use __has_include(<security/pam_misc.h>) instead of HAVE_SECURITY_PAM_MISC_H

Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac, lib/: Use __has_include(<sys/random.h>) instead of HAVE_SYS_RANDOM_H

Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac, lib/: Use __has_include(<crypt.h>) instead of HAVE_CRYPT_H

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: motd(): Report errors instead of exiting from library code

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/motd.c: motd(): Invert logic to reduce indentation

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/, doc/: Remove pw_auth()'s $3 as dead code

We don't read the parameter at all.  Remove it.

As a consequence, all the PW_* constants are also removed (as they are
now unused).

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/pwauth.*: PW_{ADD,CHANGE,DELETE,FTP,REXEC}: Remove dead code

These values aren't being set anywhere.

Reviewed-by: Sam James <sam@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/, doc/: Remove dead code

pw_auth()'s $4 was always being specified as NULL.  Remove the
parameter.  Instead, set a local variable to NULL at function entry, and
remove code that never runs (conditional on $4 != NULL).

Reviewed-by: Sam James <sam@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/vipw.c: Restore the original terminal pgrp after editing

This fixes a problem when the shell is not in monitor mode (job control
enabled) which resulted in the terminal pgrp being set to an invalid
value once vipw exited.

Fixes: 7eca1112fbd7 (2019-11-11; "Fix vipw not resuming correctly when suspended")
Closes: <https://github.com/shadow-maint/shadow/issues/1194>
Reported-by: <https://github.com/yonecle>
Tested-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Use agetgroups() instead of its pattern

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/shadow/grp/: agetgroups(): Add function

This encapsulates the logic for calling getgroups(3), which requires two
calls plus a malloc(3) call to do it correctly.

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac, lib/, src/: Use gid_t instead of GETGROUPS_T

Autoconf's NEWS file says

*** AC_FUNC_GETGROUPS and AC_TYPE_GETGROUPS no longer run test programs.
  These macros were testing for OS bugs that we believe are at least
  twenty years in the past.  Most operating systems are now trusted to
  provide an accurate prototype for getgroups in unistd.h, and to
  implement it as specified in POSIX.

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/adds.h: addslN(): Use QSORT() instead of its pattern

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/search/sort/: QSORT(): Add macro

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/addgrps.c: add_groups(): Remove arbitrary limit

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Rename variables

Since 'list' is used for a comma/colon-separated-value list, grouplist
is incorrect and inconsistent.  grouplist is not a list, but an array.
Use the more common convention of just using plural.  Also, use 'gids'
to distinguish it from other group representations.

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/addgrps.c: add_groups(): Reallocate at once

We can calculate an upper bound of the number of added groups by
counting the number of delimiters in the string (plus one for the
element after the last delimiter).  This avoids reallocating +1 in a
loop.

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strchr/: strchrscnt(): Add function

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/addgrps.c: add_groups(): Split variable to avoid sign-mismatch diagnostics

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Use LSEARCH() instead of its pattern

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/search/l/: LSEARCH(): Add macro

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Replace redundant checks by actual error handling

setgroups(2) already performs a test to check if the number of groups is
too large.  Don't do that ourselves, and also don't do it for every
iteration.  Just let setgroups(2) do it once.

Instead of our check, let's report errors from setgroups(2).

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Unconditionally call setgroups(2)

Call it regardless of having added any groups.  If the group list is the
same that getgroups(3) gave us, setgroups(3) will be a no-op, and it
simplifies the surrounding code, by removing the 'added' variable, and
allowing to call lsearch(3) instead of lfind(3).

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/addgrps.c: add_groups(): Simplify redundant code with a goto

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/addgrps.c: add_groups(): Allocate earlier

This will allow using lsearch(3).

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/addgrps.c: add_groups(): Remove useless cast

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Use LFIND() instead of open-coded search loops

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/search/l/: LFIND(): Add macro

The use of typeof() for the function pointer argument was suggested by
Jorenar.  This improves readability of these complex types.

Co-authored-by: Martin Uecker <uecker@tugraz.at>
Cc: Jorenar <dev@jorenar.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/search/cmp/, lib/, tests/: CMP(), cmp_*(): Add macro and functions

These macros are for use with bsearch(3),lfind(3),qsort(3).

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Simplify allocation of buffer

getgroups(0, NULL) returns the number of groups, so that we can allocate
at once.  This might fail if there's a race and the number of users
grows while we're allocating, but if that happens, failing is probably a
good thing to do.

There was some comment saying it doesn't work on some systems, but
according to gnulib, that's only NeXTstep 3.2, which we don't support.

Link: <https://www.gnu.org/software/gnulib/manual/html_node/getgroups.html>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Un-spageticize code

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Reduce scope of variables

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/gshadow_.h: Fix compatibility with libc's struct sgrp

The name of the first field was different.  Rename for compatiblity with
libc.

$ diff -wU10 \
<(grepc sgrp . | sed_rm_ccomments) \
<(grepc sgrp /usr/include/ | sed_rm_ccomments);
--- /dev/fd/63 2024-11-06 14:49:03.287204461 +0100
+++ /dev/fd/62 2024-11-06 14:49:03.287204461 +0100
@@ -1,6 +1,7 @@
-./lib/gshadow_.h:struct sgrp {
- char *sg_name;
+/usr/include/gshadow.h:struct sgrp
+  {
+    char *sg_namp;
char *sg_passwd;
char **sg_adm;
char **sg_mem;
 };

This originates from a typo in this project, which was later copied by
glibc, and so the typo was set in stone.  The typo was eventually fixed
in shadow, but glibc had already set the name in stone, so we should
just learn to live with it.

$ grep -rn -C3 sg_name ChangeLog
1607-
1608-2011-07-30  Nicolas François  <nicolas.francois@centraliens.net>
1609-
1610: * src/chgpasswd.c: Fix typo sp -> sg. sg_namp -> sg_name
1611- * src/chgpasswd.c: Always update the group file when SHADOWGRP is
1612- not enabled.
1613-

This is a scripted change:

$ find lib* src -type f \
| xargs sed -i 's/\<sg_name\>/sg_namp/g';

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac, lib/gshadow.c: Presume working shadow group support in libc

This check was testing a specific bug in a prehistoric libc version.
Red Hat 3 is long dead, and it doesn't make sense to test for that
specific bug.

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Include <gshadow.h> if it's available

The existing code was assuming that libc's <shadow.h> includes
<gshadow.h>.  That's not true.

alx@debian:~$ find /usr/include/shadow.h
/usr/include/shadow.h
alx@debian:~$ find /usr/include/gshadow.h
/usr/include/gshadow.h
alx@debian:~$ grep include.*gshadow /usr/include/shadow.h
alx@debian:~$

As a result, we were unconditionally including our own "gshadow_.h".

Fix that incorrect assumption, and do the following instead:

-  Include unconditionally our own "gshadow_.h".
-  Make our "gshadow_.h" include <gshadow.h> if it exists,
   and only provide the declarations otherwise.

While at it, fix the include guard to be consistent with the project.

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac, lib/: Assume initgroups(3) exists

It's available in every system I checked: glibc,musl,{Free,Net,Open}BSD.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac, lib/, src/: Assume setgroups(2) exists

It's available in every system I checked: glibc,musl,{Free,Net,Open}BSD.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Turn error counters into flags

If we are not interested in the amount of errors but only if errors
exist, use a flag instead of a counter. This eliminates the chance of
signed integer overflows and better reflects the meaning of variable.

Keeping variable name and basically copied from src/faillog.c.

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

doc: fix typo

src/gpasswd: Use correct preprocessor definition

Use PASS_MAX + 1 instead of BUFSIZ to clarify where this size comes
from. Technically, PASS_MAX is BUFSIZ - 1 so this is a no-op change.

Just make sure that the size of pass stays in sync with agetpass.

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

src/gpasswd: Clear password in more cases

If encryption of password fails, clear the memory before exiting.

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

lib/encrypt.c: Do not exit in error case

If crypt fails, pw_encrypt calls exit. This has the consequence that the
plaintext password is not cleared.

A valid password can fail if the underlying library does not support it.
One such example is SHA512, for which the password must not be longer
than 256 characters on musl. A password longer than this with glibc
works, so it is actually possible that a user, running passwd, tries to
enter the old password but the musl-based passwd binary simply exits.
Let passwd clear the password before exiting.

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

ci: add openSUSE Tumbleweed

Add an ansible task for openSUSE which will use the
configure options used by the official openSUSE package.

Signed-off-by: Michael Vetter <jubalh@iodoru.org>

man/useradd.8.xml: wfix

Closes: Debian Bug <https://bugs.debian.org/1005253>
Cc: Chris Hofstaedtler <zeha@debian.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/login_nopam.c: list_match(): Use iteration instead of recursion

The recursive nature of list_match() triggered regression during
refactoring.  In Linux-PAM, the same code exists which could lead to
stack overflow because <access.conf> could be arbitrarily long.

Use an iterative approach for easier refactoring, to support long
lines in the future and to stay in sync with Linux-PAM.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/login_nopam.c: list_match(): Remove local variable

Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/login_nopam.c: list_match(): Move code around

This is just a no-op refactor in preparation for the following commits.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/login_nopam.c: list_match(): '(match)' is always true here

Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/login_nopam.c: list_match(): Add superfluous else

This is just a no-op refactor in preparation for the following commits.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/login_nopam.c: list_match(): Refactor conditional

This is just a no-op refactor in preparation for the following commits.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

man/passwd.1.xml: -P disables PAM support

If passwd is called with -P, then PAM handling is disabled
(src/passwd.c line 749). The manual page claims that host files would
be used, which is not true.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

chage: Drop PAM support

The PAM support was only enabled with configure option
--enable-account-tools-setuid. The other account tools would use PAM
then to verify that the user is granted elevated permissions for
actions which normally only root can do.

In chage, however, any non-root user who does not specify the -l
command line option is denied access in check_perms. The check for
being root or not is done with getuid, so non-root users cannot
change user account's aging information in any possible way since
more than 18 years by now.

It's safe to say that nobody misses this non-existing feature. Biggest
benefit is to get chage out of the ACCT_TOOLS_SETUID group of tools.

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

src/newusers.c: Turn nusers into size_t

The nusers variable could, in theory, overflow and trigger an out of
boundary access if a huge amount of entries is added. Realistically,
this is not possible with current systems because way too much data
would be involved.

But let's better be safe than sorry and use correct data types.

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

src/: Make line number overflows less likely

Huge files could trigger signed integer overflows if enough lines are
within the file. Use intmax_t which is at least 64 bit to move this
event far into the future.

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

man/: Install suauth.5 only if feature exists

Support for /etc/suauth only exists if su is installed without
PAM support. If su is not installed (--without-su) or if PAM
support is enabled (default), do not install suauth.5 manual
page.

The SU_ACCESS preprocessor definition is used to decide if
feature exists or not. See links for more details.

Link: https://github.com/shadow-maint/shadow/blob/65723c3c4704fde4cc8c94299123d3eeca81aadf/src/su.c#L558-L581
Link: https://github.com/shadow-maint/shadow/blob/65723c3c4704fde4cc8c94299123d3eeca81aadf/configure.ac#L628-L654
Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

add and use a login.defs.test with CREATE_HOME set

I suspect this is not a big deal, and most distributions just ship their own
version verbatim like debian/login.defs. But if there is a distro - or even a
person - using this as is from upstream, then we dont' want to break them. So
let's undo this and use an etc/login.defs.test for the testing if needed.

Changelog: 01/13: move etc/login.defs.test to tests/system/etc/login.defs per
                  suggestion.

Signed-off-by: Serge Hallyn <serge@hallyn.com>

Revert "etc/login.defs: enable CREATE_HOME"

This reverts commit dcb6b0f4152c1507a137640fea42401a91f22e2c.

Reported-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Alejandro Colomar <alx@kernel.org>

CI: run system tests

Run the newly created system tests in CI and collect artifacts.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

etc/login.defs: enable CREATE_HOME

In order to have consistent behaviour among all distributions, the same
configuration needs to be shared. That is why we are going to use the
`etc/login.defs` file and enable CREATE_HOME so that the home dir is
created automatically. This is not the default configuration used in all
distributions, but it is the most common one.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

tests: basic group deletion

This is the transformation to Python of the test located in
`tests/grouptools/groupdel/01_groupdel_delete_group/groupdel.test`,
which checks that `groupdel` is able to delete a group.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

tests: change GID of a group

This is the transformation to Python of the test located in
`tests/grouptools/groupmod/01_groupmod_change_gid/groupmod.test`, which
checks that `groupmod` is able to change the GID of a group.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

tests: basic group creation

This is the transformation to Python of the test located in
`tests/grouptools/groupadd/02_groupadd_add_group_GID_MIN/groupadd.test`,
which checks that `groupadd` is able to create a new group.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

tests: delete user and homedir

This is the transformation to Python of the test located in
`tests/usertools/01/18_userdel_remove_homedir.test`, which checks that
`userdel` is able to delete a user and its homedir. The test checks that
the user, the group and the home folder don't exist.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

tests: rename user

This is the transformation to Python of the test located in
`tests/usertools/01/10_usermod_rename_user.test`, which checks that
`usermod` is able to rename a user. The test checks that the new user,
the group and home folder exists.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

tests: recreate deleted user

This is the transformation to Python of the test located in
`tests/usertools/01/02_useradd_recreate_deleted_user.test`, which checks
that `useradd` is able to create again a removed user.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

tests: basic user creation

This is the transformation to Python of the test located in
`tests/usertools/01/01_useradd_add_user.test`, which checks that
`useradd` is able to create a new user and its corresponding group and
home folder.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

tests: basic configuration

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

Tests: implement system test framework

As discussed at length, this is the implementation of the new system
tests framework for shadow. This is a proof of concept that contains the
key elements to be able to run basic user (i.e. useradd, usermod) and
group (i.e. usermod) tests. If you like the framework the rest of the
functionality will be added in the future.

Some useful facts:
* It is implemented in python
* It is based on pytest and pytest-mh
* It works on all the distributions that are part of our CI
* It can be run in the cloud (VM or container) as well as on-premises
* After the execution of each test the environment is cleaned up
* Logs and other artifacts for failed tests are collected
* It has a rich API that can be extended and extended to cover new
  functionalities

Closes: https://github.com/shadow-maint/shadow/issues/835
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

Release 4.17.2

Signed-off-by: Alejandro Colomar <alx@kernel.org>

man/, po/: Update Romanian translation

Add translation of manual pages, and update the translation of strings.

Bug-Debian: https://bugs.debian.org/1080487
[alx: fix typo: po => ro]
Reviewed-by: Alejandro Colomar <alx@kernel.org>

lib/: Set O_CLOEXEC for static FILE handles

With glibc we can use "e" in mode argument to set O_CLOEXEC on
opened files. The /etc/shadow and /etc/gshadow file handles should
be protected to make sure that they are never passed to child
processes by accident.

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

lib/: Use _exit in case of execv errors

Calling exit might trigger cleanup functions registered through
atexit. Since some programs use this mechanism, be extra cautious to
never release passwd/group locks too early.

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

Update French translation

Bug-Debian: https://bugs.debian.org/1076260

man: Add Portuguese translation

Bug-Debian: https://bugs.debian.org/968304

login: Fix no-pam authorization regression

The list_match function handles EXCEPT entries through recursive
calls. It calls itself with NULL, which was then passed to strtok so
parsing continued at current position.

Replacing strtok with strsep, this means that EXCEPT entries never
match, because strsep(NULL, ...) always returns NULL, i.e. the
code treats everything after EXCEPT as non-existing.

Fix this by passing current list pointer to recursive call.

Fixes: 90afe61003ef (2024-07-04; "lib/, src/: Use strsep(3) instead of strtok(3)")
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

lib/attr.h: use C23 attributes only with gcc >= 10

These are not available on earlier versions and builds break there.

Signed-off-by: Alexander Kanavin <alex@linutronix.de>

man/: Update link to Wikipedia to use HTTPS

The link to Wikipedia's article "Password strength" was added here in
2008 and Wikipedia went HTTPS-only 7 years later.

Link: <https://diff.wikimedia.org/2015/06/12/securing-wikimedia-sites-with-https/>

lib/chkname.c: login_name_max_size(): Put limits for LOGIN_NAME_MAX and sysconf(_SC_LOGIN_NAME_MAX)

GNU Hurd doesn't define LOGIN_NAME_MAX.  GNU Hurd recommends having no
system limits.  When a program needs a limit, because it needs to
validate user input, it is recommended that each program defines its own
limit macros.  The rationale is that this avoids hard-coded limits in
ABIs, which cannot be modified ever.

However, that doesn't mean that programs should have no limits at all.
We use this limit for validating user input, and so we shouldn't allow
anything just because the system doesn't want to set a limit.

So, when sysconf(2) returns -1, either due to an error or due to a claim
for no limits, we must fall back to the LOGIN_NAME_MAX value.  And if
the system doesn't define that value, we must define it ourselves (we're
more or less free to choose any value, so let's pick the one that glibc
provides nowadays).

Fixes: 6a1f45d932c8 (2024-02-04; "lib/chkname.c: Support unlimited user name lengths")
Closes: <https://github.com/shadow-maint/shadow/issues/1166>
Cc: Chris Hofstaedtler <zeha@debian.org>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/login_nopam.c: Fix compiler warnings

The function user_match actually modifies the string passed as its
first argument, so use char * instead of const char *.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>