summaryrefslogtreecommitdiff
path: root/system/shadow
diff options
context:
space:
mode:
Diffstat (limited to 'system/shadow')
-rw-r--r--system/shadow/APKBUILD110
-rw-r--r--system/shadow/dots-in-usernames.patch11
-rw-r--r--system/shadow/login.pamd6
-rw-r--r--system/shadow/pam-useradd.patch9
-rw-r--r--system/shadow/useradd-usergroups.patch8
5 files changed, 144 insertions, 0 deletions
diff --git a/system/shadow/APKBUILD b/system/shadow/APKBUILD
new file mode 100644
index 000000000..13dc98d7a
--- /dev/null
+++ b/system/shadow/APKBUILD
@@ -0,0 +1,110 @@
+# Contributor: William Pitcock <nenolod@dereferenced.org>
+# Contributor: Jakub Jirutka <jakub@jirutka.cz>
+# Maintainer: Stuart Cardall <developer@it-offshore.co.uk>
+pkgname=shadow
+pkgver=4.5
+pkgrel=0
+pkgdesc="PAM-using login and passwd utilities (usermod, useradd, ...)"
+url="http://pkg-shadow.alioth.debian.org/"
+arch="all"
+license="GPL"
+depends=""
+makedepends="linux-pam-dev"
+subpackages="$pkgname-doc $pkgname-dbg $pkgname-uidmap"
+source="https://github.com/shadow-maint/shadow/releases/download/$pkgver/shadow-$pkgver.tar.xz
+ login.pamd
+ dots-in-usernames.patch
+ useradd-usergroups.patch
+ pam-useradd.patch
+ "
+# secfixes:
+# 4.5-r0:
+# - CVE-2017-12424
+# 4.2.1-r11:
+# - CVE-2017-2616
+# 4.2.1-r7:
+# - CVE-2016-6252
+
+options="suid"
+builddir="$srcdir/shadow-$pkgver"
+
+build() {
+ cd "$builddir"
+
+ ./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --target=$CTARGET \
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --mandir=/usr/share/man \
+ --infodir=/usr/share/info \
+ --localstatedir=/var \
+ --disable-nls \
+ --with-libpam \
+ --without-audit \
+ --without-selinux \
+ --without-acl \
+ --without-attr \
+ --without-tcb \
+ --without-nscd \
+ --without-group-name-max-length \
+ || return 1
+ make || return 1
+}
+
+check() {
+ cd "$builddir"
+ make check
+}
+
+package() {
+ cd "$builddir"
+
+ make DESTDIR="$pkgdir" install || return 1
+
+ # Do not install these pam.d files they are broken and outdated.
+ rm "$pkgdir"/etc/pam.d/* || return 1
+
+ # install some pam.d files based on a patched useradd
+ for pamf in groupadd groupdel groupmems groupmod \
+ useradd userdel usermod
+ do
+ install -m0644 etc/pam.d/useradd \
+ "$pkgdir/etc/pam.d/$pamf" || return 1
+ done
+ # nologin is provided by util-linux.
+ rm "$pkgdir"/sbin/nologin || return 1
+
+ # However, install our own for login.
+ cp "$srcdir"/login.pamd "$pkgdir"/etc/pam.d/login || return 1
+
+ # /etc/login.defs is not very useful - replace it with an *almost* blank file.
+ rm "$pkgdir"/etc/login.defs
+ echo "USERGROUPS_ENAB yes" > "$pkgdir"/etc/login.defs
+
+ # Avoid conflict with man-pages.
+ rm "$pkgdir"/usr/share/man/man3/getspnam.3* \
+ "$pkgdir"/usr/share/man/man5/passwd.5* || return 1
+}
+
+uidmap() {
+ pkgdesc="Utilities for using subordinate UIDs and GIDs"
+
+ mkdir -p "$subpkgdir"
+ cd "$subpkgdir"
+
+ mkdir -p usr/bin
+ mv "$pkgdir"/usr/bin/new*idmap usr/bin/ || return 1
+ chmod 4711 usr/bin/new*idmap || return 1
+
+ # Used e.g. for unprivileged LXC containers.
+ mkdir etc
+ touch etc/subuid etc/subgid
+}
+
+sha512sums="e57f8db54df23301c229d4be30d4cbb67efa1d1809cffcff79adc480b6019fb2b5fd09e112e82a3f00ad5a6b2994592adac93f70a631cf666b6f4723b61c87b5 shadow-4.5.tar.xz
+46a6f83f3698e101b58b8682852da749619412f75dfa85cecad03d0847f6c3dc452d984510db7094220e4570a0565b83b0556e16198ad894a3ec84b3e513d58d login.pamd
+745eea04c054226feba165b635dbb8570b8a04537d41e914400a4c54633c3a9cf350da0aabfec754fb8cf3e58fc1c8cf597b895506312f19469071760c11f31d dots-in-usernames.patch
+49f1d5ded82d2d479805c77d7cc6274c30233596e375b28306b31a33f8fbfc3611dbc77d606081b8300247908c267297dbb6c5d1a30d56095dda53c6a636fb56 useradd-usergroups.patch
+0b4587e263cb6be12fa5ae6bc3b3fc4d3696dae355bc67d085dc58c52ff96edb4d163b95db2092b8c2f3310839430cac03c7af356641b42e24ee4aa6410f5cf1 pam-useradd.patch"
diff --git a/system/shadow/dots-in-usernames.patch b/system/shadow/dots-in-usernames.patch
new file mode 100644
index 000000000..b684c9d02
--- /dev/null
+++ b/system/shadow/dots-in-usernames.patch
@@ -0,0 +1,11 @@
+--- shadow-4.1.3/libmisc/chkname.c
++++ shadow-4.1.3/libmisc/chkname.c
+@@ -66,6 +66,7 @@
+ ( ('0' <= *name) && ('9' >= *name) ) ||
+ ('_' == *name) ||
+ ('-' == *name) ||
++ ('.' == *name) ||
+ ( ('$' == *name) && ('\0' == *(name + 1)) )
+ )) {
+ return false;
+
diff --git a/system/shadow/login.pamd b/system/shadow/login.pamd
new file mode 100644
index 000000000..ad4555809
--- /dev/null
+++ b/system/shadow/login.pamd
@@ -0,0 +1,6 @@
+# /bin/login opens an interactive session.
+
+auth include base-auth
+account include base-account
+password include base-password
+session include base-session
diff --git a/system/shadow/pam-useradd.patch b/system/shadow/pam-useradd.patch
new file mode 100644
index 000000000..71a1bcd25
--- /dev/null
+++ b/system/shadow/pam-useradd.patch
@@ -0,0 +1,9 @@
+--- a/etc/pam.d/useradd
++++ b/etc/pam.d/useradd
+@@ -1,4 +1,4 @@
+ #%PAM-1.0
+ auth sufficient pam_rootok.so
+-account required pam_permit.so
+-password include system-auth
++account include base-account
++password include base-password
diff --git a/system/shadow/useradd-usergroups.patch b/system/shadow/useradd-usergroups.patch
new file mode 100644
index 000000000..adf297231
--- /dev/null
+++ b/system/shadow/useradd-usergroups.patch
@@ -0,0 +1,8 @@
+--- a/etc/useradd
++++ b/etc/useradd
+@@ -1,5 +1,4 @@
+ # useradd defaults file
+-GROUP=1000
+ HOME=/home
+ INACTIVE=-1
+ EXPIRE=