[packages/shadow] Up to 4.18.0

arekm arekm at pld-linux.org
Sat Jun 28 14:12:50 CEST 2025


commit 84a38bc4729553276804ddf6f8191cf7e30c4bd0
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Sat Jun 28 14:12:37 2025 +0200

    Up to 4.18.0

 shadow-login.defs | 206 ++++++++++++++++++++++++++++++++++++++----------------
 shadow-pld.patch  |  50 ++++++-------
 shadow.spec       |  26 ++-----
 3 files changed, 175 insertions(+), 107 deletions(-)
---
diff --git a/shadow.spec b/shadow.spec
index b74e9e6..3d1753e 100644
--- a/shadow.spec
+++ b/shadow.spec
@@ -13,13 +13,13 @@ Summary(pl.UTF-8):	Narzędzia do obsługi mechanizmu ukrytych haseł
 Summary(pt_BR.UTF-8):	Utilitários para o arquivo de senhas Shadow
 Summary(tr.UTF-8):	Gölge parola dosyası araçları
 Name:		shadow
-Version:	4.13
-Release:        3
+Version:	4.18.0
+Release:	1
 Epoch:		1
 License:	BSD
 Group:		Applications/System
 Source0:	https://github.com/shadow-maint/shadow/releases/download/%{version}/%{name}-%{version}.tar.xz
-# Source0-md5:	b1ab01b5462ddcf43588374d57bec123
+# Source0-md5:	30ef46f54363db1d624587be68794ef2
 Source2:	%{name}-login.defs
 Source3:	%{name}.useradd
 Source10:	chage.pamd
@@ -193,15 +193,10 @@ cp -p %{SOURCE23} $RPM_BUILD_ROOT/etc/pam.d/usermod
 
 %{__rm} $RPM_BUILD_ROOT/{etc/pam.d,%{_bindir}}/login
 %{__rm} $RPM_BUILD_ROOT%{_mandir}/*/man1/su.1*
+%{__rm} $RPM_BUILD_ROOT%{_mandir}/*/man5/suauth.5*
 %{__rm} $RPM_BUILD_ROOT%{_mandir}/{,*/}man1/login.1*
 %{__rm} $RPM_BUILD_ROOT%{_mandir}/{,*/}man3/*.3*
 
-# packaged in SysVinit-tools
-%{__rm} $RPM_BUILD_ROOT%{_bindir}/lastlog
-%{__rm} $RPM_BUILD_ROOT%{_mandir}/{,*/}man8/lastlog.8*
-# packaged in coreutils
-%{__rm} $RPM_BUILD_ROOT%{_bindir}/groups
-%{__rm} $RPM_BUILD_ROOT%{_mandir}/{,*/}man1/groups.1*
 # packaged in util-linux
 %{__rm} $RPM_BUILD_ROOT%{_sbindir}/nologin
 %{__rm} $RPM_BUILD_ROOT%{_mandir}/{,*/}man*/nologin.8*
@@ -230,7 +225,7 @@ fi
 
 %files -f %{name}.lang
 %defattr(644,root,root,755)
-%doc ChangeLog NEWS TODO doc/{HOWTO,WISHLIST}
+%doc ChangeLog NEWS doc/{HOWTO,WISHLIST}
 %attr(640,root,root) %config %verify(not md5 mtime size) %{_sysconfdir}/default/useradd
 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/chage
 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/chfn
@@ -294,7 +289,6 @@ fi
 %{_mandir}/man5/login.defs.5*
 %{_mandir}/man5/passwd.5*
 %{_mandir}/man5/shadow.5*
-%{_mandir}/man5/suauth.5*
 %{_mandir}/man8/chgpasswd.8*
 %{_mandir}/man8/chpasswd.8*
 %{_mandir}/man8/faillog.8*
@@ -351,7 +345,6 @@ fi
 %lang(de) %{_mandir}/de/man5/login.defs.5*
 %lang(de) %{_mandir}/de/man5/passwd.5*
 %lang(de) %{_mandir}/de/man5/shadow.5*
-%lang(de) %{_mandir}/de/man5/suauth.5*
 %lang(de) %{_mandir}/de/man8/chgpasswd.8*
 %lang(de) %{_mandir}/de/man8/chpasswd.8*
 %lang(de) %{_mandir}/de/man8/faillog.8*
@@ -389,7 +382,6 @@ fi
 %lang(fr) %{_mandir}/fr/man5/login.defs.5*
 %lang(fr) %{_mandir}/fr/man5/passwd.5*
 %lang(fr) %{_mandir}/fr/man5/shadow.5*
-%lang(fr) %{_mandir}/fr/man5/suauth.5*
 %lang(fr) %{_mandir}/fr/man8/chgpasswd.8*
 %lang(fr) %{_mandir}/fr/man8/chpasswd.8*
 %lang(fr) %{_mandir}/fr/man8/faillog.8*
@@ -434,7 +426,6 @@ fi
 %lang(it) %{_mandir}/it/man5/login.defs.5*
 %lang(it) %{_mandir}/it/man5/passwd.5*
 %lang(it) %{_mandir}/it/man5/shadow.5*
-%lang(it) %{_mandir}/it/man5/suauth.5*
 %lang(it) %{_mandir}/it/man8/chgpasswd.8*
 %lang(it) %{_mandir}/it/man8/chpasswd.8*
 %lang(it) %{_mandir}/it/man8/faillog.8*
@@ -468,7 +459,6 @@ fi
 %lang(ja) %{_mandir}/ja/man5/login.defs.5*
 %lang(ja) %{_mandir}/ja/man5/passwd.5*
 %lang(ja) %{_mandir}/ja/man5/shadow.5*
-%lang(ja) %{_mandir}/ja/man5/suauth.5*
 %lang(ja) %{_mandir}/ja/man8/chpasswd.8*
 %lang(ja) %{_mandir}/ja/man8/faillog.8*
 %lang(ja) %{_mandir}/ja/man8/groupadd.8*
@@ -532,7 +522,6 @@ fi
 %lang(ru) %{_mandir}/ru/man5/login.defs.5*
 %lang(ru) %{_mandir}/ru/man5/passwd.5*
 %lang(ru) %{_mandir}/ru/man5/shadow.5*
-%lang(ru) %{_mandir}/ru/man5/suauth.5*
 %lang(ru) %{_mandir}/ru/man8/chgpasswd.8*
 %lang(ru) %{_mandir}/ru/man8/chpasswd.8*
 %lang(ru) %{_mandir}/ru/man8/faillog.8*
@@ -563,7 +552,6 @@ fi
 %lang(sv) %{_mandir}/sv/man5/faillog.5*
 %lang(sv) %{_mandir}/sv/man5/gshadow.5*
 %lang(sv) %{_mandir}/sv/man5/passwd.5*
-%lang(sv) %{_mandir}/sv/man5/suauth.5*
 %lang(sv) %{_mandir}/sv/man8/faillog.8*
 %lang(sv) %{_mandir}/sv/man8/groupadd.8*
 %lang(sv) %{_mandir}/sv/man8/groupdel.8*
@@ -601,7 +589,6 @@ fi
 %lang(uk) %{_mandir}/uk/man5/login.defs.5*
 %lang(uk) %{_mandir}/uk/man5/passwd.5*
 %lang(uk) %{_mandir}/uk/man5/shadow.5*
-%lang(uk) %{_mandir}/uk/man5/suauth.5*
 %lang(uk) %{_mandir}/uk/man8/chgpasswd.8*
 %lang(uk) %{_mandir}/uk/man8/chpasswd.8*
 %lang(uk) %{_mandir}/uk/man8/faillog.8*
@@ -636,7 +623,6 @@ fi
 %lang(zh_CN) %{_mandir}/zh_CN/man5/login.defs.5*
 %lang(zh_CN) %{_mandir}/zh_CN/man5/passwd.5*
 %lang(zh_CN) %{_mandir}/zh_CN/man5/shadow.5*
-%lang(zh_CN) %{_mandir}/zh_CN/man5/suauth.5*
 %lang(zh_CN) %{_mandir}/zh_CN/man8/chgpasswd.8*
 %lang(zh_CN) %{_mandir}/zh_CN/man8/chpasswd.8*
 %lang(zh_CN) %{_mandir}/zh_CN/man8/faillog.8*
@@ -684,5 +670,5 @@ fi
 %lang(fr) %{_mandir}/fr/man1/newuidmap.1*
 %lang(fr) %{_mandir}/fr/man5/subgid.5*
 %lang(fr) %{_mandir}/fr/man5/subuid.5*
-%ghost %{_libdir}/libsubid.so.4
+%ghost %{_libdir}/libsubid.so.5
 %attr(755,root,root) %{_libdir}/libsubid.so.*.*.*
diff --git a/shadow-login.defs b/shadow-login.defs
index 5cbd8a0..d1c1570 100644
--- a/shadow-login.defs
+++ b/shadow-login.defs
@@ -1,23 +1,23 @@
 #
 # /etc/login.defs - Configuration control definitions for the shadow package.
 #
-#	$Id: login.defs 3189 2010-03-26 11:53:06Z nekral-guest $
+#	$Id$
 #
 
 #
 # Delay in seconds before being allowed another attempt after a login failure
-# Note: When PAM is used, some modules may enfore a minimal delay (e.g.
-#       pam_unix enforces a 2s delay)
+# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
+#       pam_unix(8) enforces a 2s delay)
 #
 FAIL_DELAY		3
 
 #
-# Enable logging and display of /var/log/faillog login failure info.
+# Enable logging and display of /var/log/faillog login(1) failure info.
 #
 FAILLOG_ENAB		yes
 
 #
-# Enable display of unknown usernames when login failures are recorded.
+# Enable display of unknown usernames when login(1) failures are recorded.
 #
 LOG_UNKFAIL_ENAB	no
 
@@ -27,10 +27,19 @@ LOG_UNKFAIL_ENAB	no
 LOG_OK_LOGINS		no
 
 #
-# Enable logging and display of /var/log/lastlog login time info.
+# Enable logging and display of /var/log/lastlog login(1) time info.
 #
 LASTLOG_ENAB		yes
 
+#
+# Limit the highest user ID number for which the lastlog entries should
+# be updated.
+#
+# No LASTLOG_UID_MAX means that there is no user ID limit for writing
+# lastlog entries.
+#
+#LASTLOG_UID_MAX
+
 #
 # Enable checking and display of mailbox status upon login.
 #
@@ -50,13 +59,13 @@ OBSCURE_CHECKS_ENAB	yes
 PORTTIME_CHECKS_ENAB	yes
 
 #
-# Enable setting of ulimit, umask, and niceness from passwd gecos field.
+# Enable setting of ulimit, umask, and niceness from passwd(5) gecos field.
 #
 QUOTAS_ENAB		yes
 
 #
-# Enable "syslog" logging of su activity - in addition to sulog file logging.
-# SYSLOG_SG_ENAB does the same for newgrp and sg.
+# Enable "syslog" logging of su(1) activity - in addition to sulog file logging.
+# SYSLOG_SG_ENAB does the same for newgrp(1) and sg(1).
 #
 SYSLOG_SU_ENAB		yes
 SYSLOG_SG_ENAB		yes
@@ -64,13 +73,13 @@ SYSLOG_SG_ENAB		yes
 #
 # If defined, either full pathname of a file containing device names or
 # a ":" delimited list of device names.  Root logins will be allowed only
-# upon these devices.
+# from these devices.
 #
 CONSOLE		/etc/securetty
 #CONSOLE	console:tty01:tty02:tty03:tty04
 
 #
-# If defined, all su activity is logged to this file.
+# If defined, all su(1) activity is logged to this file.
 #
 #SULOG_FILE	/var/log/sulog
 
@@ -82,33 +91,33 @@ MOTD_FILE	/etc/motd
 #MOTD_FILE	/etc/motd:/usr/lib/news/news-motd
 
 #
-# If defined, this file will be output before each login prompt.
+# If defined, this file will be output before each login(1) prompt.
 #
 #ISSUE_FILE	/etc/issue
 
 #
 # If defined, file which maps tty line to TERM environment parameter.
-# Each line of the file is in a format something like "vt100  tty01".
+# Each line of the file is in a format similar to "vt100  tty01".
 #
 #TTYTYPE_FILE	/etc/ttytype
 
 #
-# If defined, login failures will be logged here in a utmp format.
-# last, when invoked as lastb, will read /var/log/btmp, so...
+# If defined, login(1) failures will be logged here in a utmp format.
+# last(1), when invoked as lastb(1), will read /var/log/btmp, so...
 #
 FTMP_FILE	/var/log/btmp
 
 #
-# If defined, name of file whose presence which will inhibit non-root
-# logins.  The contents of this file should be a message indicating
+# If defined, name of file whose presence will inhibit non-root
+# logins.  The content of this file should be a message indicating
 # why logins are inhibited.
 #
 NOLOGINS_FILE	/etc/nologin
 
 #
 # If defined, the command name to display when running "su -".  For
-# example, if this is defined as "su" then a "ps" will display the
-# command is "-su".  If not defined, then "ps" would display the
+# example, if this is defined as "su" then ps(1) will display the
+# command as "-su".  If not defined, then ps(1) will display the
 # name of the shell actually being run, e.g. something like "-sh".
 #
 SU_NAME		su
@@ -158,10 +167,10 @@ ENV_PATH	PATH=/bin:/usr/bin
 #	TTYGROUP	Login tty will be assigned this group ownership.
 #	TTYPERM		Login tty will be set to this permission.
 #
-# If you have a "write" program which is "setgid" to a special group
-# which owns the terminals, define TTYGROUP to the group number and
-# TTYPERM to 0620.  Otherwise leave TTYGROUP commented out and assign
-# TTYPERM to either 622 or 600.
+# If you have a write(1) program which is "setgid" to a special group
+# which owns the terminals, define TTYGROUP as the number of such group
+# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
+# set TTYPERM to either 622 or 600.
 #
 TTYGROUP	tty
 TTYPERM		0600
@@ -183,15 +192,20 @@ ERASECHAR	0177
 KILLCHAR	025
 #ULIMIT		2097152
 
-# Default initial "umask" value used by login on non-PAM enabled systems.
-# Default "umask" value for pam_umask on PAM enabled systems.
-# UMASK is also used by useradd and newusers to set the mode of new home
-# directories.
+# Default initial "umask" value used by login(1) on non-PAM enabled systems.
+# Default "umask" value for pam_umask(8) on PAM enabled systems.
+# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
+# home directories if HOME_MODE is not set.
 # 022 is the default value, but 027, or even 077, could be considered
-# better for privacy. There is no One True Answer here: each sysadmin
-# must make up her mind.
+# for increased privacy. There is no One True Answer here: each sysadmin
+# must make up their mind.
 UMASK		022
 
+# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
+# home directories.
+# If HOME_MODE is not set, the value of UMASK is used to create the mode.
+#HOME_MODE	0700
+
 #
 # Password aging controls:
 #
@@ -214,35 +228,38 @@ PASS_WARN_AGE	7
 SU_WHEEL_ONLY	no
 
 #
-# If compiled with cracklib support, where are the dictionaries
-#
-CRACKLIB_DICTPATH	/var/cache/cracklib/cracklib_dict
-
-#
-# Min/max values for automatic uid selection in useradd
+# Min/max values for automatic uid selection in useradd(8)
 #
 UID_MIN			 1000
 UID_MAX			60000
 # System accounts
 SYS_UID_MIN		  1
 SYS_UID_MAX		  999
+# Extra per user uids
+SUB_UID_MIN		   100000
+SUB_UID_MAX		600100000
+SUB_UID_COUNT		    65536
 
 #
-# Min/max values for automatic gid selection in groupadd
+# Min/max values for automatic gid selection in groupadd(8)
 #
 GID_MIN			 1000
 GID_MAX			60000
 # System accounts
 SYS_GID_MIN		  10
 SYS_GID_MAX		  999
+# Extra per user group ids
+SUB_GID_MIN		   100000
+SUB_GID_MAX		600100000
+SUB_GID_COUNT		    65536
 
 #
-# Max number of login retries if password is bad
+# Max number of login(1) retries if password is bad
 #
 LOGIN_RETRIES		5
 
 #
-# Max time in seconds for login
+# Max time in seconds for login(1)
 #
 LOGIN_TIMEOUT		180
 
@@ -264,16 +281,16 @@ PASS_ALWAYS_WARN	yes
 #PASS_MAX_LEN		8
 
 #
-# Require password before chfn/chsh can make any changes.
+# Require password before chfn(1)/chsh(1) can make any changes.
 #
 CHFN_AUTH		yes
 
 #
-# Which fields may be changed by regular users using chfn - use
+# Which fields may be changed by regular users using chfn(1) - use
 # any combination of letters "frwh" (full name, room number, work
 # phone, home phone).  If not defined, no changes are allowed.
 # For backward compatibility, "yes" = "rwh" and "no" = "frwh".
-# 
+#
 CHFN_RESTRICT		rwh
 
 #
@@ -294,16 +311,19 @@ CHFN_RESTRICT		rwh
 # Note: If you use PAM, it is recommended to use a value consistent with
 # the PAM modules configuration.
 #
-# This variable is deprecated. You should use ENCRYPT_METHOD.
+# This variable is deprecated. You should use ENCRYPT_METHOD instead.
 #
 #MD5_CRYPT_ENAB	no
 
 #
 # Only works if compiled with ENCRYPTMETHOD_SELECT defined:
-# If set to MD5 , MD5-based algorithm will be used for encrypting password
+# If set to MD5, MD5-based algorithm will be used for encrypting password
 # If set to SHA256, SHA256-based algorithm will be used for encrypting password
 # If set to SHA512, SHA512-based algorithm will be used for encrypting password
+# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
+# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
 # If set to DES, DES-based algorithm will be used for encrypting password (default)
+# MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
 # Overrides the MD5_CRYPT_ENAB option
 #
 # Note: If you use PAM, it is recommended to use a value consistent with
@@ -315,35 +335,72 @@ CHFN_RESTRICT		rwh
 # Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
 #
 # Define the number of SHA rounds.
-# With a lot of rounds, it is more difficult to brute forcing the password.
-# But note also that it more CPU resources will be needed to authenticate
-# users.
+# With a lot of rounds, it is more difficult to brute-force the password.
+# However, more CPU resources will be needed to authenticate users if
+# this value is increased.
 #
-# If not specified, the libc will choose the default number of rounds (5000).
-# The values must be inside the 1000-999999999 range.
+# If not specified, the libc will choose the default number of rounds (5000),
+# which is orders of magnitude too low for modern hardware.
+# The values must be within the 1000-999999999 range.
 # If only one of the MIN or MAX values is set, then this value will be used.
 # If MIN > MAX, the highest value will be used.
 #
-# SHA_CRYPT_MIN_ROUNDS 5000
-# SHA_CRYPT_MAX_ROUNDS 5000
+#SHA_CRYPT_MIN_ROUNDS 5000
+#SHA_CRYPT_MAX_ROUNDS 5000
+
+#
+# Only works if ENCRYPT_METHOD is set to BCRYPT.
+#
+# Define the number of BCRYPT rounds.
+# With a lot of rounds, it is more difficult to brute-force the password.
+# However, more CPU resources will be needed to authenticate users if
+# this value is increased.
+#
+# If not specified, 13 rounds will be attempted.
+# If only one of the MIN or MAX values is set, then this value will be used.
+# If MIN > MAX, the highest value will be used.
+#
+#BCRYPT_MIN_ROUNDS 13
+#BCRYPT_MAX_ROUNDS 13
+
+#
+# Only works if ENCRYPT_METHOD is set to YESCRYPT.
+#
+# Define the YESCRYPT cost factor.
+# With a higher cost factor, it is more difficult to brute-force the password.
+# However, more CPU time and more memory will be needed to authenticate users
+# if this value is increased.
+#
+# If not specified, a cost factor of 5 will be used.
+# The value must be within the 1-11 range.
+#
+#YESCRYPT_COST_FACTOR 5
 
 #
 # List of groups to add to the user's supplementary group set
-# when logging in on the console (as determined by the CONSOLE
+# when logging in from the console (as determined by the CONSOLE
 # setting).  Default is none.
 #
 # Use with caution - it is possible for users to gain permanent
-# access to these groups, even when not logged in on the console.
+# access to these groups, even when not logged in from the console.
 # How to do it is left as an exercise for the reader...
 #
 #CONSOLE_GROUPS		floppy:audio:cdrom
 
 #
 # Should login be allowed if we can't cd to the home directory?
-# Default in no.
+# Default is no.
 #
 DEFAULT_HOME	yes
 
+#
+# The pwck(8) utility emits a warning for any system account with a home
+# directory that does not exist.  Some system accounts intentionally do
+# not have a home directory.  Such accounts may have this string as
+# their home directory in /etc/passwd to avoid a spurious warning.
+#
+NONEXISTENT	/nonexistent
+
 #
 # If this file exists and is readable, login environment will be
 # read from it.  Every line should be in the form name=value.
@@ -362,14 +419,14 @@ ENVIRON_FILE	/etc/environment
 # (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is
 # the same as gid, and username is the same as the primary group name.
 #
-# This also enables userdel to remove user groups if no members exist.
+# This also enables userdel(8) to remove user groups if no members exist.
 #
 #USERGROUPS_ENAB yes
 
 #
-# If set to a non-nul number, the shadow utilities will make sure that
+# If set to a non-zero number, the shadow utilities will make sure that
 # groups never have more than this number of users on one line.
-# This permit to support split groups (groups split into multiple lines,
+# This permits to support split groups (groups split into multiple lines,
 # with the same group ID, to avoid limitation of the line length in the
 # group file).
 #
@@ -378,10 +435,39 @@ ENVIRON_FILE	/etc/environment
 #MAX_MEMBERS_PER_GROUP	0
 
 #
-# If useradd should create home directories for users by default (non
-# system users only)
-# This option is overridden with the -M or -m flags on the useradd command
-# line.
+# If useradd(8) should create home directories for users by default (non
+# system users only).
+# This option is overridden with the -M or -m flags on the useradd(8)
+# command-line.
 #
 #CREATE_HOME     yes
 
+#
+# Force use shadow, even if shadow passwd & shadow group files are
+# missing.
+#
+#FORCE_SHADOW    yes
+
+#
+# Allow newuidmap and newgidmap when running under an alternative
+# primary group.
+#
+#GRANT_AUX_GROUP_SUBIDS yes
+
+#
+# Prevents an empty password field to be interpreted as "no authentication
+# required".
+# Set to "yes" to prevent for all accounts
+# Set to "superuser" to prevent for UID 0 / root (default)
+# Set to "no" to not prevent for any account (dangerous, historical default)
+PREVENT_NO_AUTH yes
+
+#
+# Select the HMAC cryptography algorithm.
+# Used in pam_timestamp module to calculate the keyed-hash message
+# authentication code.
+#
+# Note: It is recommended to check hmac(3) to see the possible algorithms
+# that are available in your system.
+#
+#HMAC_CRYPTO_ALGO SHA512
diff --git a/shadow-pld.patch b/shadow-pld.patch
index 5017038..fdd1006 100644
--- a/shadow-pld.patch
+++ b/shadow-pld.patch
@@ -1,18 +1,18 @@
---- shadow-4.12.3/src/useradd.c~	2022-08-22 18:27:55.000000000 +0300
-+++ shadow-4.12.3/src/useradd.c	2022-08-22 18:27:58.336079332 +0300
-@@ -81,8 +81,8 @@
-  */
+--- shadow-4.18.0/src/useradd.c~	2025-06-24 22:28:01.000000000 +0200
++++ shadow-4.18.0/src/useradd.c	2025-06-28 13:54:04.917939997 +0200
+@@ -103,8 +103,8 @@ static const char Prog[] = "useradd";
  static gid_t def_group = 1000;
+ static const char *def_groups = "";
  static const char *def_gname = "other";
 -static const char *def_home = "/home";
 -static const char *def_shell = "/bin/bash";
 +static const char *def_home = "/home/users";
 +static const char *def_shell = "/sbin/nologin";
  static const char *def_template = SKEL_DIR;
+ static const char *def_usrtemplate = USRSKELDIR;
  static const char *def_create_mail_spool = "yes";
- static const char *def_log_init = "yes";
-@@ -89,7 +89,7 @@
- #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
+@@ -116,7 +116,7 @@ static const char *def_expire = "";
+ #define VALID(s)  (!strpbrk(s, ":\n"))
  
  static const char *user_name = "";
 -static const char *user_pass = "!";
@@ -20,29 +20,25 @@
  static uid_t user_id;
  static gid_t user_gid;
  static const char *user_comment = "";
---- shadow-4.5/libmisc/find_new_gid.c~	2017-01-29 22:37:22.000000000 +0200
-+++ shadow-4.5/libmisc/find_new_gid.c	2017-05-17 23:13:32.785253060 +0300
-@@ -61,8 +61,8 @@
- 		/* A requested ID is allowed to be below the autoselect range */
- 		*preferred_min = (gid_t) 1;
+--- shadow-4.18.0/lib/find_new_uid.c~	2025-06-24 22:28:01.000000000 +0200
++++ shadow-4.18.0/lib/find_new_uid.c	2025-06-28 13:55:01.552392578 +0200
+@@ -42,7 +42,7 @@ static int get_ranges (bool sys_user, ui
+ 		*preferred_min = (uid_t) 1;
  
--		/* Get the minimum ID range from login.defs or default to 101 */
--		*min_id = (gid_t) getdef_ulong ("SYS_GID_MIN", 101UL);
-+		/* Get the minimum ID range from login.defs or default to 10 */
-+		*min_id = (gid_t) getdef_ulong ("SYS_GID_MIN", 10UL);
+ 		/* Get the minimum ID range from login.defs or default to 101 */
+-		*min_id = getdef_ulong ("SYS_UID_MIN", 101UL);
++		*min_id = getdef_ulong ("SYS_UID_MIN", 1UL);
  
  		/*
- 		 * If SYS_GID_MAX is unspecified, we should assume it to be one
---- shadow-4.5/libmisc/find_new_uid.c~	2017-01-29 22:37:22.000000000 +0200
-+++ shadow-4.5/libmisc/find_new_uid.c	2017-05-17 23:10:38.366687971 +0300
-@@ -61,8 +61,8 @@
- 		/* A requested ID is allowed to be below the autoselect range */
- 		*preferred_min = (uid_t) 1;
+ 		 * If SYS_UID_MAX is unspecified, we should assume it to be one
+--- shadow-4.18.0/lib/find_new_gid.c~	2025-06-24 22:28:01.000000000 +0200
++++ shadow-4.18.0/lib/find_new_gid.c	2025-06-28 13:55:19.757492390 +0200
+@@ -42,7 +42,7 @@ static int get_ranges (bool sys_group, g
+ 		*preferred_min = (gid_t) 1;
  
--		/* Get the minimum ID range from login.defs or default to 101 */
--		*min_id = (uid_t) getdef_ulong ("SYS_UID_MIN", 101UL);
-+		/* Get the minimum ID range from login.defs or default to 1 */
-+		*min_id = (uid_t) getdef_ulong ("SYS_UID_MIN", 1UL);
+ 		/* Get the minimum ID range from login.defs or default to 101 */
+-		*min_id = getdef_ulong ("SYS_GID_MIN", 101UL);
++		*min_id = getdef_ulong ("SYS_GID_MIN", 10UL);
  
  		/*
- 		 * If SYS_UID_MAX is unspecified, we should assume it to be one
+ 		 * If SYS_GID_MAX is unspecified, we should assume it to be one
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/shadow.git/commitdiff/84a38bc4729553276804ddf6f8191cf7e30c4bd0



More information about the pld-cvs-commit mailing list