diff --git a/SPECS/shadow/0002-openruyi-adapt-configs.patch b/SPECS/shadow/0002-openruyi-adapt-configs.patch deleted file mode 100644 index e9969af8de..0000000000 --- a/SPECS/shadow/0002-openruyi-adapt-configs.patch +++ /dev/null @@ -1,631 +0,0 @@ -diff --git a/etc/login.defs b/etc/login.defs -index 33622c2..797ca6b 100644 ---- a/etc/login.defs -+++ b/etc/login.defs -@@ -3,6 +3,8 @@ - # - # $Id$ - # -+# NOTE: This file is adapted for the use on Arch Linux! -+# Unsupported options due to the use of util-linux or PAM are removed. - - # - # Delay in seconds before being allowed another attempt after a login failure -@@ -11,26 +13,11 @@ - # - FAIL_DELAY 3 - --# --# Enable logging and display of /var/log/faillog login(1) failure info. --# --FAILLOG_ENAB yes -- - # - # Enable display of unknown usernames when login(1) failures are recorded. - # - LOG_UNKFAIL_ENAB no - --# --# Enable logging of successful logins --# --LOG_OK_LOGINS no -- --# --# Enable logging and display of /var/log/lastlog login(1) time info. --# --LASTLOG_ENAB yes -- - # - # Limit the highest user ID number for which the lastlog entries should - # be updated. -@@ -40,88 +27,13 @@ LASTLOG_ENAB yes - # - #LASTLOG_UID_MAX - --# --# Enable checking and display of mailbox status upon login. --# --# Disable if the shell startup files already check for mail --# ("mailx -e" or equivalent). --# --MAIL_CHECK_ENAB yes -- --# --# Enable additional checks upon password changes. --# --OBSCURE_CHECKS_ENAB yes -- --# --# Enable checking of time restrictions specified in /etc/porttime. --# --PORTTIME_CHECKS_ENAB yes -- --# --# Enable setting of ulimit, umask, and niceness from passwd(5) gecos field. --# --QUOTAS_ENAB yes -- --# --# Enable "syslog" logging of su(1) activity - in addition to sulog file logging. --# SYSLOG_SG_ENAB does the same for newgrp(1) and sg(1). --# --SYSLOG_SU_ENAB yes --SYSLOG_SG_ENAB yes -- --# --# If defined, either full pathname of a file containing device names or --# a ":" delimited list of device names. Root logins will be allowed only --# from these devices. --# --CONSOLE /etc/securetty --#CONSOLE console:tty01:tty02:tty03:tty04 -- --# --# If defined, all su(1) activity is logged to this file. --# --#SULOG_FILE /var/log/sulog -- - # - # If defined, ":" delimited list of "message of the day" files to - # be displayed upon login. - # --MOTD_FILE /etc/motd -+MOTD_FILE - #MOTD_FILE /etc/motd:/usr/lib/news/news-motd - --# --# If defined, this file will be output before each login(1) prompt. --# --#ISSUE_FILE /etc/issue -- --# --# If defined, file which maps tty line to TERM environment parameter. --# Each line of the file is in a format similar to "vt100 tty01". --# --#TTYTYPE_FILE /etc/ttytype -- --# --# If defined, login(1) failures will be logged here in a utmp format. --# last(1), when invoked as lastb(1), will read /var/log/btmp, so... --# --FTMP_FILE /var/log/btmp -- --# --# If defined, name of file whose presence will inhibit non-root --# logins. The content of this file should be a message indicating --# why logins are inhibited. --# --NOLOGINS_FILE /etc/nologin -- --# --# If defined, the command name to display when running "su -". For --# example, if this is defined as "su" then ps(1) will display the --# command as "-su". If not defined, then ps(1) will display the --# name of the shell actually being run, e.g. something like "-sh". --# --SU_NAME su -- - # - # *REQUIRED* - # Directory where mailboxes reside, _or_ name of file, relative to the -@@ -139,21 +51,6 @@ MAIL_DIR /var/spool/mail - HUSHLOGIN_FILE .hushlogin - #HUSHLOGIN_FILE /etc/hushlogins - --# --# If defined, either a TZ environment parameter spec or the --# fully-rooted pathname of a file containing such a spec. --# --#ENV_TZ TZ=CST6CDT --#ENV_TZ /etc/tzname -- --# --# If defined, an HZ environment parameter spec. --# --# for Linux/x86 --ENV_HZ HZ=100 --# For Linux/Alpha... --#ENV_HZ HZ=1024 -- - # - # *REQUIRED* The default PATH settings, for superuser and normal users. - # -@@ -175,23 +72,6 @@ ENV_PATH PATH=/bin:/usr/bin - TTYGROUP tty - TTYPERM 0600 - --# --# Login configuration initializations: --# --# ERASECHAR Terminal ERASE character ('\010' = backspace). --# KILLCHAR Terminal KILL character ('\025' = CTRL/U). --# ULIMIT Default "ulimit" value. --# --# The ERASECHAR and KILLCHAR are used only on System V machines. --# The ULIMIT is used only if the system supports it. --# (now it works with setrlimit too; ulimit is in 512-byte units) --# --# Prefix these values with "0" to get octal, "0x" to get hexadecimal. --# --ERASECHAR 0177 --KILLCHAR 025 --#ULIMIT 2097152 -- - # Default initial "umask" value used by login(1) on non-PAM enabled systems. - # Default "umask" value for pam_umask(8) on PAM enabled systems. - # UMASK is also used by useradd(8) and newusers(8) to set the mode for new -@@ -211,22 +91,12 @@ UMASK 022 - # - # PASS_MAX_DAYS Maximum number of days a password may be used. - # PASS_MIN_DAYS Minimum number of days allowed between password changes. --# PASS_MIN_LEN Minimum acceptable password length. - # PASS_WARN_AGE Number of days warning given before a password expires. - # - PASS_MAX_DAYS 99999 - PASS_MIN_DAYS 0 --PASS_MIN_LEN 5 - PASS_WARN_AGE 7 - --# --# If "yes", the user must be listed as a member of the first gid 0 group --# in /etc/group (called "root" on most Linux systems) to be able to "su" --# to uid 0 accounts. If the group doesn't exist or is empty, no one --# will be able to "su" to uid 0. --# --SU_WHEEL_ONLY no -- - # - # Min/max values for automatic uid selection in useradd(8) - # -@@ -263,28 +133,6 @@ LOGIN_RETRIES 5 - # - LOGIN_TIMEOUT 60 - --# --# Maximum number of attempts to change password if rejected (too easy) --# --PASS_CHANGE_TRIES 5 -- --# --# Warn about weak passwords (but still allow them) if you are root. --# --PASS_ALWAYS_WARN yes -- --# --# Number of significant characters in the password for crypt(). --# Default is 8, don't change unless your crypt() is better. --# Ignored if MD5_CRYPT_ENAB set to "yes". --# --#PASS_MAX_LEN 8 -- --# --# Require password before chfn(1)/chsh(1) can make any changes. --# --CHFN_AUTH yes -- - # - # Which fields may be changed by regular users using chfn(1) - use - # any combination of letters "frwh" (full name, room number, work -@@ -293,38 +141,13 @@ CHFN_AUTH yes - # - CHFN_RESTRICT rwh - --# --# Password prompt (%s will be replaced by user name). --# --# XXX - it doesn't work correctly yet, for now leave it commented out --# to use the default which is just "Password: ". --#LOGIN_STRING "%s's Password: " -- --# --# Only works if compiled with MD5_CRYPT defined: --# If set to "yes", new passwords will be encrypted using the MD5-based --# algorithm compatible with the one used by recent releases of FreeBSD. --# It supports passwords of unlimited length and longer salt strings. --# Set to "no" if you need to copy encrypted passwords to other systems --# which don't understand the new algorithm. Default is "no". --# --# Note: If you use PAM, it is recommended to use a value consistent with --# the PAM modules configuration. --# --# This variable is deprecated. You should use ENCRYPT_METHOD instead. --# --#MD5_CRYPT_ENAB no -- - # - # Only works if compiled with ENCRYPTMETHOD_SELECT defined: --# If set to MD5, MD5-based algorithm will be used for encrypting password - # If set to SHA256, SHA256-based algorithm will be used for encrypting password - # If set to SHA512, SHA512-based algorithm will be used for encrypting password --# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password - # If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password - # If set to DES, DES-based algorithm will be used for encrypting password (default) - # MD5 and DES should not be used for new hashes, see crypt(5) for recommendations. --# Overrides the MD5_CRYPT_ENAB option - # - # Note: If you use PAM, it is recommended to use a value consistent with - # the PAM modules configuration. -@@ -348,21 +171,6 @@ CHFN_RESTRICT rwh - #SHA_CRYPT_MIN_ROUNDS 5000 - #SHA_CRYPT_MAX_ROUNDS 5000 - --# --# Only works if ENCRYPT_METHOD is set to BCRYPT. --# --# Define the number of BCRYPT rounds. --# With a lot of rounds, it is more difficult to brute-force the password. --# However, more CPU resources will be needed to authenticate users if --# this value is increased. --# --# If not specified, 13 rounds will be attempted. --# If only one of the MIN or MAX values is set, then this value will be used. --# If MIN > MAX, the highest value will be used. --# --#BCRYPT_MIN_ROUNDS 13 --#BCRYPT_MAX_ROUNDS 13 -- - # - # Only works if ENCRYPT_METHOD is set to YESCRYPT. - # -@@ -376,17 +184,6 @@ CHFN_RESTRICT rwh - # - #YESCRYPT_COST_FACTOR 5 - --# --# List of groups to add to the user's supplementary group set --# when logging in from the console (as determined by the CONSOLE --# setting). Default is none. --# --# Use with caution - it is possible for users to gain permanent --# access to these groups, even when not logged in from the console. --# How to do it is left as an exercise for the reader... --# --#CONSOLE_GROUPS floppy:audio:cdrom -- - # - # Should login be allowed if we can't cd to the home directory? - # Default is no. -@@ -401,12 +198,6 @@ DEFAULT_HOME yes - # - NONEXISTENT /nonexistent - --# --# If this file exists and is readable, login environment will be --# read from it. Every line should be in the form name=value. --# --ENVIRON_FILE /etc/environment -- - # - # If defined, this command is run when removing a user. - # It should remove any at/cron/print jobs etc. owned by -@@ -454,14 +245,6 @@ USERGROUPS_ENAB yes - # - #GRANT_AUX_GROUP_SUBIDS yes - --# --# Prevents an empty password field to be interpreted as "no authentication --# required". --# Set to "yes" to prevent for all accounts --# Set to "superuser" to prevent for UID 0 / root (default) --# Set to "no" to not prevent for any account (dangerous, historical default) --PREVENT_NO_AUTH superuser -- - # - # Select the HMAC cryptography algorithm. - # Used in pam_timestamp module to calculate the keyed-hash message -diff --git a/man/login.defs.5.xml b/man/login.defs.5.xml -index 7263395..3bd382a 100644 ---- a/man/login.defs.5.xml -+++ b/man/login.defs.5.xml -@@ -5,72 +5,40 @@ - SPDX-FileCopyrightText: 2007 - 2009, Nicolas François - SPDX-License-Identifier: BSD-3-Clause - --> -- -- - -- -- -- - - - -- - - -- -- -- - -- -- -- - - - - -- -- -- - -- - - -- - -- - - -- - -- - -- -- -- -- - - - -- -- - -- -- -- - - - - -- - - - - -- - -- - - - -@@ -147,76 +115,44 @@ - The following configuration items are provided: - - -- &BCRYPT_MIN_ROUNDS; -- &CHFN_AUTH; - &CHFN_RESTRICT; -- &CHSH_AUTH; -- &CONSOLE; -- &CONSOLE_GROUPS; - &CREATE_HOME; - &DEFAULT_HOME; - &ENCRYPT_METHOD; -- &ENV_HZ; - &ENV_PATH; - &ENV_SUPATH; -- &ENV_TZ; -- &ENVIRON_FILE; -- &ERASECHAR; - &FAIL_DELAY; -- &FAILLOG_ENAB; -- &FAKE_SHELL; -- &FTMP_FILE; - &GID_MAX; - &HMAC_CRYPTO_ALGO; - &HOME_MODE; - &HUSHLOGIN_FILE; -- &ISSUE_FILE; -- &KILLCHAR; -- &LASTLOG_ENAB; - &LASTLOG_UID_MAX; -- &LOG_OK_LOGINS; - &LOG_UNKFAIL_ENAB; - &LOGIN_RETRIES; -- &LOGIN_STRING; - &LOGIN_TIMEOUT; -- &MAIL_CHECK_ENAB; - &MAIL_DIR; - &MAX_MEMBERS_PER_GROUP; -- &MD5_CRYPT_ENAB; - &MOTD_FILE; -- &NOLOGINS_FILE; - &NONEXISTENT; -- &OBSCURE_CHECKS_ENAB; -- &PASS_ALWAYS_WARN; -- &PASS_CHANGE_TRIES; - &PASS_MAX_DAYS; - &PASS_MIN_DAYS; - &PASS_WARN_AGE; -- -+ - , and - are only used at the - time of account creation. Any changes to these settings won't affect - existing accounts. - -- &PASS_MAX_LEN; -- &PORTTIME_CHECKS_ENAB; -- "AS_ENAB; - &SHA_CRYPT_MIN_ROUNDS; -- &SULOG_FILE; -- &SU_NAME; -- &SU_WHEEL_ONLY; - &SUB_GID_COUNT; - &SUB_UID_COUNT; - &SYS_GID_MAX; - &SYS_UID_MAX; - &SYSLOG_SG_ENAB; -- &SYSLOG_SU_ENAB; - &TCB_AUTH_GROUP; - &TCB_SYMLINKS; - &TTYGROUP; -- &TTYTYPE_FILE; - &UID_MAX; -- &ULIMIT; - &UMASK; - &USERDEL_CMD; - &USERGROUPS_ENAB; -@@ -255,7 +191,7 @@ - - BCRYPT_MAX_ROUNDS - BCRYPT_MIN_ROUNDS -- ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB -+ ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP - SHA_CRYPT_MAX_ROUNDS - SHA_CRYPT_MIN_ROUNDS - YESCRYPT_COST_FACTOR -@@ -280,7 +216,7 @@ - chsh - - -- CHSH_AUTH LOGIN_STRING -+ CHSH_AUTH - - - -@@ -292,7 +228,7 @@ - - BCRYPT_MAX_ROUNDS - BCRYPT_MIN_ROUNDS -- ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB -+ ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP - SHA_CRYPT_MAX_ROUNDS - SHA_CRYPT_MIN_ROUNDS - YESCRYPT_COST_FACTOR -@@ -351,35 +287,6 @@ - LASTLOG_UID_MAX - - -- -- login -- -- -- CONSOLE -- CONSOLE_GROUPS DEFAULT_HOME -- ENV_HZ ENV_PATH ENV_SUPATH -- ENV_TZ ENVIRON_FILE -- ERASECHAR FAIL_DELAY -- FAILLOG_ENAB -- FAKE_SHELL -- FTMP_FILE -- HUSHLOGIN_FILE -- ISSUE_FILE -- KILLCHAR -- LASTLOG_ENAB LASTLOG_UID_MAX -- LOGIN_RETRIES -- LOGIN_STRING -- LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB -- MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE -- MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB -- QUOTAS_ENAB -- TTYGROUP TTYPERM TTYTYPE_FILE -- ULIMIT UMASK -- USERGROUPS_ENAB -- -- -- -- - - newgrp / sg - -@@ -396,7 +303,7 @@ - BCRYPT_MIN_ROUNDS - ENCRYPT_METHOD - GID_MAX GID_MIN -- MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB -+ MAX_MEMBERS_PER_GROUP - HOME_MODE - PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE - SHA_CRYPT_MAX_ROUNDS -@@ -416,8 +323,7 @@ - - BCRYPT_MAX_ROUNDS - BCRYPT_MIN_ROUNDS -- ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB -- PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN -+ ENCRYPT_METHOD - SHA_CRYPT_MAX_ROUNDS - SHA_CRYPT_MIN_ROUNDS - YESCRYPT_COST_FACTOR -@@ -450,32 +356,6 @@ - - - -- -- su -- -- -- CONSOLE -- CONSOLE_GROUPS DEFAULT_HOME -- ENV_HZ ENVIRON_FILE -- ENV_PATH ENV_SUPATH -- ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB -- MAIL_DIR MAIL_FILE QUOTAS_ENAB -- SULOG_FILE SU_NAME -- SU_WHEEL_ONLY -- SYSLOG_SU_ENAB -- USERGROUPS_ENAB -- -- -- -- -- sulogin -- -- -- ENV_HZ -- ENV_TZ -- -- -- - - useradd - -@@ -504,24 +384,6 @@ - - - -- -- usermod -- -- -- LASTLOG_UID_MAX -- MAIL_DIR MAIL_FILE MAX_MEMBERS_PER_GROUP -- TCB_SYMLINKS USE_TCB -- -- -- -- -- vipw -- -- -- USE_TCB -- -- -- - - - diff --git a/SPECS/shadow/0001-openruyi-disable-conflicting-tools.patch b/SPECS/shadow/2000-openruyi-disable-conflicting-tools.patch similarity index 100% rename from SPECS/shadow/0001-openruyi-disable-conflicting-tools.patch rename to SPECS/shadow/2000-openruyi-disable-conflicting-tools.patch diff --git a/SPECS/shadow/2001-openruyi-adapt-configs.patch b/SPECS/shadow/2001-openruyi-adapt-configs.patch new file mode 100644 index 0000000000..b796eae5f3 --- /dev/null +++ b/SPECS/shadow/2001-openruyi-adapt-configs.patch @@ -0,0 +1,73 @@ +diff --git a/etc/login.defs b/etc/login.defs +--- a/etc/login.defs ++++ b/etc/login.defs +@@ -132,29 +132,6 @@ + # Max time in seconds for login(1) + # + LOGIN_TIMEOUT 60 +- +-# +-# Maximum number of attempts to change password if rejected (too easy) +-# +-PASS_CHANGE_TRIES 5 +- +-# +-# Warn about weak passwords (but still allow them) if you are root. +-# +-PASS_ALWAYS_WARN yes +- +-# +-# Number of significant characters in the password for crypt(). +-# Default is 8, don't change unless your crypt() is better. +-# Only used for DES encryption algorithm. +-# +-#PASS_MAX_LEN 8 +- +-# +-# Require password before chfn(1)/chsh(1) can make any changes. +-# +-CHFN_AUTH yes +- + # + # Which fields may be changed by regular users using chfn(1) - use + # any combination of letters "frwh" (full name, room number, work +@@ -162,39 +139,13 @@ + # For backward compatibility, "yes" = "rwh" and "no" = "frwh". + # + CHFN_RESTRICT rwh +- +-# +-# Password prompt (%s will be replaced by user name). +-# +-# XXX - it doesn't work correctly yet, for now leave it commented out +-# to use the default which is just "Password: ". +-#LOGIN_STRING "%s's Password: " +- +-# +-# Only works if compiled with MD5_CRYPT defined: +-# If set to "yes", new passwords will be encrypted using the MD5-based +-# algorithm compatible with the one used by recent releases of FreeBSD. +-# It supports passwords of unlimited length and longer salt strings. +-# Set to "no" if you need to copy encrypted passwords to other systems +-# which don't understand the new algorithm. Default is "no". +-# +-# Note: if you use PAM, it is recommended to use a value consistent with +-# the PAM modules configuration. +-# +-# This variable is deprecated. You should use ENCRYPT_METHOD instead. +-# +-#MD5_CRYPT_ENAB no +- + # + # Only works if compiled with ENCRYPTMETHOD_SELECT defined: +-# If set to MD5, MD5-based algorithm will be used for encrypting password + # If set to SHA256, SHA256-based algorithm will be used for encrypting password + # If set to SHA512, SHA512-based algorithm will be used for encrypting password +-# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password + # If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password + # If set to DES, DES-based algorithm will be used for encrypting password (default) + # MD5 and DES should not be used for new hashes, see crypt(5) for recommendations. +-# Overrides the MD5_CRYPT_ENAB option + # + # Note: if you use PAM, it is recommended to use a value consistent with + # the PAM modules configuration. diff --git a/SPECS/shadow/shadow.spec b/SPECS/shadow/shadow.spec index 38c5660382..88827b9025 100644 --- a/SPECS/shadow/shadow.spec +++ b/SPECS/shadow/shadow.spec @@ -8,23 +8,23 @@ %global includesubiddir %{_includedir}/shadow -Name: shadow -Version: 4.18.0 -Release: %autorelease -Summary: User and group account management utilities -License: BSD-3-Clause AND GPL-2.0-or-later -URL: https://github.com/shadow-maint/shadow -#!RemoteAsset -Source0: https://github.com/shadow-maint/shadow/releases/download/%{version}/%{name}-%{version}.tar.xz -Source1: useradd.defaults -Source2: login.defs -Source3: shadow.timer -Source4: shadow.service -Source5: passwd.service -BuildSystem: autotools - -Patch0: 0001-openruyi-disable-conflicting-tools.patch -Patch1: 0002-openruyi-adapt-configs.patch +Name: shadow +Version: 4.19.4 +Release: %autorelease +Summary: User and group account management utilities +License: BSD-3-Clause AND GPL-2.0-or-later +URL: https://github.com/shadow-maint/shadow +#!RemoteAsset: sha256:ce57a313e315a0a7cb04a8f50cc20753e994e487bbe9b78a2a824ca75cb486c0 +Source0: https://github.com/shadow-maint/shadow/releases/download/%{version}/%{name}-%{version}.tar.xz +Source1: useradd.defaults +Source2: login.defs +Source3: shadow.timer +Source4: shadow.service +Source5: passwd.service +BuildSystem: autotools + +Patch2000: 2000-openruyi-disable-conflicting-tools.patch +Patch2001: 2001-openruyi-adapt-configs.patch # Configure options for a modern, systemd-centric distro. BuildOption(conf): --enable-shadowgrp @@ -60,6 +60,7 @@ BuildRequires: pkgconfig(pam_misc) BuildRequires: pkgconfig(libselinux) BuildRequires: pkgconfig(libsemanage) BuildRequires: pkgconfig(libxcrypt) +BuildRequires: pkgconfig(libsystemd) Provides: shadow = %{version}-%{release} Provides: passwd @@ -199,4 +200,4 @@ install -Dm644 %{SOURCE4} %{buildroot}%{_unitdir}/shadow.service %{_libdir}/libsubid.so %changelog -%{?autochangelog} +%autochangelog