summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended/shadow
AgeCommit message (Collapse)Author
6 daysrecipes: Update WORKDIR references to UNPACKDIRRichard Purdie
Since we want to be able to stop unpacking to WORKDIR, correct the WORKDIR references in recipe do_compile/do_install tasks to use UNPACKDIR in the appropraite places instead. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
6 daysrecipes: Update S = WORKDIR recipes to use ${S} correctlyRichard Purdie
Where recipes use S = ${WORKDIR}, ensure they are referencing ${S} correctly to access files as soon we want to stop doing this in WORKDIR at which point they would break unless corrected. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-04-23shadow: install manpagesDan McGregor
Install the manpages for shadow, and also make the conflicting manpages alternatives in util-linux. Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2024-04-16shadow: update 4.14.2 -> 4.15.0Alexander Kanavin
libcrack support was dropped. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-23shadow: don't install libattr.so.* when xattr not in DISTRO_FEATURESSam Van Den Berge
Fixes the following issue: install: cannot stat '.../recipe-sysroot-native/usr/lib/libattr.so.*': No such file or directory ... ERROR: Task (virtual:native:.../shadow_4.14.2.bb:do_install) failed with exit code '1' Signed-off-by: Sam Van Den Berge <sam.van.den.berge@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-19shadow: fix copydir operation with 'pseudo'Enrico Scholz
Calling 'useradd' through pseudo on (at least) Ubuntu 20 creates filesystem objects (.bashrc, .profile) with invalid attributes. It manifests as | tar: ./home/.../.bashrc: Unknown file type; file ignored or | Copying files into the device: __populate_fs: ignoring entry ".bashrc" | .bashrc: File not found by ext2_lookup while looking up ".bashrc" when building the image. This happens due to a bug in shadow which is caused by clobbering fstatat() results. Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-02-24meta: Remove some not needed CVE_STATUSSimone Weiß
CVE_STATUS was set for those components, but meanwhile databases are updated with corrected information, so setting the CVE_STATUS is not needed anymore. Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-02-09shadow: add a packageconfig for logind supportAlexander Kanavin
This was causing host contamination in particular, where libsystemd was installed on the host. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-01-21shadow: replace static linking with dynamic libraries in a custom location ↵Alexander Kanavin
and bundled with shadow Despite our efforts to make static linking work, there have been new reports of bizarre build failures: https://lists.openembedded.org/g/openembedded-core/message/194006 https://lists.openembedded.org/g/openembedded-core/message/193907 This commit changes back to dynamic linking, but places the libraries in a custom location, per RP's suggestion. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-01-12shadow: link executables statically for -native variantAlexander Kanavin
shadow 4.14.x adds a number of libraries it dynamically links with (md, bsd, attr). This causes troubles in setscene tasks where shadow executables are used (such as useradd), as pulling in the needed dynamic libraries needs unpleasant special-casing. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-01-12shadow: update 4.13 -> 4.14.2Alexander Kanavin
License-Update: formatting, spdx conversion Drop: 0001-Disable-use-of-syslog-for-sysroot.patch (issue fixed upstream) 0001-Fix-can-not-print-full-login.patch 0001-Overhaul-valid_field.patch CVE-2023-29383.patch (backports) libbsd is a new native dependency, as otherwise glibc >= 2.38 is needed. A similar fix is added to musl in order to define non-standard __BEGIN_DECLS/__END_DECLS. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-12-04shadow: Fix for CVE-2023-4641Xiangyu Chen
shadow-utils: possible password leak during passwd(1) change CVE: CVE-2023-4641 Upstream-Status: Backport [https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904] Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-22recipes: Drop remaining PR values from recipesRichard Purdie
We've been removing PR values from recipes at upgrade time for a while. In general anyone maintaining a binary distro would end up having to curate these themselves so the values in OE-Core aren't really that useful anymore. In many ways it makes sense to clear out the remaining ones (which are mostly for 'config' recipes that are unlikely to increase in PV) and leave a clean slate for anyone implementing a binary distro config. References are left in meta-selftest since the tests there do involve them and their removal upon upgrade. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-20shadow: fix patch Upstream-StatusMichael Opdenacker
Replace "Accepted" by "Backport" as specified on https://docs.yoctoproject.org/migration-guides/migration-3.2.html#miscellaneous-changes Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-21cve_check: convert CVE_CHECK_IGNORE to CVE_STATUSAndrej Valek
- Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Reviewed-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-07-19shadow-sysroot: add license informationEnrico Scholz
Recipe references 'login.defs' in LIC_FILES_CHKSUM. This causes some problems: - file does not contain a single word which is related with its license - changing this file (here: increasing SYS_UID_MIN) invalidates LIC_FILES_CHKSUM Add 'SPDX-License-Identifier' to the file and limit the checksum to this part. Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-27shadow: remove dependency on pam-plugin-lastlogAlexander Kanavin
This item has been deprecated in pam 1.5.3 and is no longer built by default: https://github.com/linux-pam/linux-pam/blob/master/NEWS Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-05-29Revert "python3/ruby/shadow: Revert add libxcrypt-native dependency"Richard Purdie
This reverts commit c6198e1b1c3e3a3413b6ff9f014b40114f1850db. This reverts commit 167c2c9f15c1bfe401c0512e420a76fa1379c012. This reverts commit 65532fc751dc00e5568e256166f7b259d3a3c06c. The dependencies should not be a -native in the target case. Revert these whilst the proper patch is worked out. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-05-28shadow: add libxcrypt-native dependencyMarkus Volk
crypt.h is otherwise taken from the host machine Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-04-20shadow: backport patch to fix CVE-2023-29383Xiangyu Chen
The fix of CVE-2023-29383.patch contains a bug that it rejects all characters that are not control ones, so backup another patch named "0001-Overhaul-valid_field.patch" from upstream to fix it. Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2023-04-03shadow: Fix can not print full login timeout messageSoumya
When we do not enter password during login, it is expected to display message "Login timed out after 60 seconds". But it prints only first few bytes(like "Login t") when write is immediately followed by exit. Fix - Calling exit from new handler provides enough time to display full message. Upstream-Status: Accepted [https://github.com/shadow-maint/shadow/commit/670cae834827a8f794e6f7464fa57790d911b63c] Signed-off-by: Soumya <soumya.sambu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-03-07shadow: ignore CVE-2016-15024Ross Burton
This recently got an updated CPE which matches this recipe, but the issue is related to an entirely different shadow project so ignore it. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-11-22shadow: update 4.12.3 -> 4.13Alexander Kanavin
Drop 0001-Drop-nsswitch.conf-message-when-not-in-place-eg.-musl.patch (issue fixed upstream) 0001-shadow-use-relaxed-usernames.patch (merged upstream) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-10-29shadow: update 4.12.1 -> 4.12.3Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-09-28meta: fix version checks in all github recipes using the github-releases classAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-21shadow-securetty: allow ttyS4 for amd-snowyowl-64Chen Qi
ttyS4 is also needed by some BSP such as amd-snowyowl-64. Let's allow it for convenience. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-02shadow: correct the pam patch statusAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-08-25shadow: Avoid nss warning/error with muslAndrei Gherzan
The libnss configuration file is only installed when glibc is used. The inexistence of it on a musl-based rootfs, will make shadow complain about it: Failed opening /etc/nsswitch.conf This is because shadow will try to use nsswich when dealing with subordinate IDs and the message is just a warning as the tool will still generate them correctly in subuid/subgid files. We drop this log message for class native to avoid an error when rootfs logs are checked ('Failed' will match the regex bitbake is using to check for rootfs generation errors). Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-25shadow: Enable subid supportAndrei Gherzan
shadow utils are used when creating users at image creation time. The useradd/usermod tools will only try to add a default configuration for subid files if they exist. Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-21shadow: update 4.11.1 -> 4.12.1Alexander Kanavin
Combine two username relaxing patches into one, rebase, and submit upstream. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-15shadow: Disable the use of syslog() for the native toolsPeter Kjellerstedt
An attempt to disable the use of syslog() was made in commit 8f181686 (shadow-native: Simplify and fix syslog disable patch). However, because the code checks if USE_SYSLOG is defined rather than checking if it evaluates to TRUE the patch did not work as intended. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-15shadow-native: Simplify and fix syslog disable patchRichard Purdie
Shadow is happily spamming the host syslog with messages and shouldn't be which suggests the patch isn't working. Redo it to work at the configure level which is simpler and hopefully more effective. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-21meta/scripts: Automated conversion of OE renamed variablesRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-20shadow: upgrade 4.10 -> 4.11.1Alexander Kanavin
License-Update: license clarified to BSD-3-Clause only Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-05shadow: upgrade 4.9 -> 4.10zhengruoqin
0001-Fix-out-of-tree-builds-with-respect-to-libsubid-incl.patch 0001-libmisc-fix-default-value-in-SHA_get_salt_rounds.patch 0001-libsubid-link-to-PAM-libraries.patch removed since they're included in 4.10 License-Update: Delete the space at the end of the sentence. Changelog: ========== * libsubid fixes * Rename the test program list_subid_ranges to getsubids, write a manpage, so distros can ship it. (Iker Pedrosa) * Add libeconf dep for new*idmap * Allow all group types with usermod -G * Avoid useradd generating empty subid range * Handle NULL pw_passwd * Fix default value SHA_get_salt_rounds * Use https where possible in README * Update content and format of README * Translation updates * Switch from xml2po to itstool in 'make dist' * Fix double frees * Add LOG_INIT configurable to useradd * Add CREATE_MAIL_SPOOL documentation * Create a security.md * Fix su never being SIGKILLd when trapping TERM * Fix wrong SELinux labels in several possible cases * Fix missing chmod in chadowtb_move * Handle malformed hushlogins entries * Fix groupdel segv when passwd does not exist * Fix covscan-found newgrp segfault * Remove trailing slash on hoedir * Fix passwd -l message - it does not change expirey * Fix SIGCHLD handling bugs in su and vipw * Remove special case for "" in usermod * Implement usermod -rG to remove a specific group * call pam_end() after fork in child path for su and login * useradd: In absence of /etc/passwd, assume 0 == root * lib: check NULL before freeing data * Fix pwck segfault Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-09-03shadow-sysroot: sync license with shadowRoss Burton
This recipe is just a single data file from shadow, but as we can't easily tell what license that specific file is under just copy the full license statement. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-09-01shadow: Use specific BSD license variantJoshua Watt
Make the license more accurate by specifying the specific variant of BSD license instead of the generic one. This helps with SPDX license attribution as "BSD" is not a valid SPDX license. Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-20shadow: add /etc/default/useraddYi Zhao
The shadow 4.9 stops shiping /etc/default/useradd[1] and uses built-in settings by default. Some settings are not consistent with previous shadow 4.8.1 in oe-core. e.g. The default shell is /bin/bash rather than /bin/sh. Per shadow 4.8.1 settings, add /etc/default/useradd back. [1] https://github.com/shadow-maint/shadow/commit/bbf4b79bc49fd1826eb41f6629669ef0b647267b Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-17shadow: fix default value in SHA_get_salt_rounds()Mingli Yu
Backport a patch [1] to fix chpasswd, gpasswd and passwd "hang" for several minutes (10-20min) at 100% cpu usage though they finally terminate successfully. [1] https://github.com/shadow-maint/shadow/issues/393 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-13shadow: add PACKAGECONFIG for audit and selinuxYi Zhao
Add PACKAGECONFIG for audit and selinux rather than disable them directly. This is useful for selinux distro feature. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-30shadow: update 4.8.1 -> 4.9Alexander Kanavin
Add a couple backports to fix builds. Drop 0002-Allow-for-setting-password-in-clear-text.patch; what it adds is horribly insecure and AB testing didn't reveal any regressions or use cases for it. Drop /etc/default/ tweaks as files are no longer installed there. Drop manpage alternatives as manpages are no longer installed. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-30Convert to new override syntaxRichard Purdie
This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-07shadow: generate alternative links for chfn and chshRoss Burton
These can be provided by util-linux, so add alternative links for them. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-06meta/recipes-extended: Add HOMEPAGE / DESCRIPTIONDorinda
Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-06shadow: whitelist CVE-2013-4235Purushottam Choudhary
This CVE is about TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees which had very low severity problem and marked as closed and won't fix. Therefore whitelisted CVE-2013-4235. Master, gatesgarth and dunfell all have shadow version 4.81. Hence, this is applicable for master, gatesgarth and dunfell. Link: https://bugzilla.redhat.com/show_bug.cgi?id=884658 Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-01-03shadow: Remove lastlog pam plugin on musl systemKhem Raj
lastlog needs logwtmp which musl does not provide Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06libtools-cross/shadow-sysroot: Use nopackages inheritRichard Purdie
When testing pseudo changes I realised these recipes have packaging tasks but don't generate packages. Drop the packages tasks for cleanliness. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-06-22shadow-sysroot: drop unused SRC_URI checksumsPaul Eggleton
This recipe only fetches local files, so there's no need for a checksum. These have been present for some time and nobody noticed. Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
2020-02-21shadow: upgrade 4.8 -> 4.8.1Wang Mingyu
0001-Do-not-check-for-validity-of-shell-executable.patch CVE-2019-19882.patch Removed since they are included in 4.8.1. Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-03shadow: Security Advisory - shadow - CVE-2019-19882Li Zhou
Backport patch from <https://github.com/shadow-maint/shadow/pull/199/ commits/66b7bc0dcfda12d7f58eba993bd02872cae1d713> to solve CVE-2019-19882. Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-08 19:50:34 +0000