openembedded-core.git/meta/recipes-extended/shadow/files, branch 2016-10 Mirror of openembedded-core shadow: use relaxed usernames 2016-09-16T14:15:32+00:00 Shan Hai shan.hai@windriver.com 2016-09-13T05:45:46+00:00 31c6c8150394de067085be5b0058037077860a8a The groupadd from shadow does not allow upper case group names, the same is true for the upstream shadow. But distributions like Debian/Ubuntu/CentOS has their own way to cope with this problem, this patch is picked up from CentOS release 7.0 to relax the usernames restrictions to allow the upper case group names, and the relaxation is POSIX compliant because POSIX indicate that usernames are composed of characters from the portable filename character set [A-Za-z0-9._-]. Signed-off-by: Shan Hai <shan.hai@windriver.com> Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
The groupadd from shadow does not allow upper case group names, the
same is true for the upstream shadow. But distributions like
Debian/Ubuntu/CentOS has their own way to cope with this problem,
this patch is picked up from CentOS release 7.0 to relax the usernames
restrictions to allow the upper case group names, and the relaxation is
POSIX compliant because POSIX indicate that usernames are composed of
characters from the portable filename character set [A-Za-z0-9._-].

Signed-off-by: Shan Hai <shan.hai@windriver.com>
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
shadow: Disable syslog for more commands 2016-04-15T05:57:47+00:00 Peter Kjellerstedt peter.kjellerstedt@axis.com 2016-04-14T11:36:39+00:00 0791ba7ea82444729a1a7d1b2443f633bcba2002 When building shadow-native, syslog was disabled for useradd and groupadd. This disables it also for groupdel, groupmems, groupmod, userdel and usermod (i.e., the use of syslog is now disabled for all commands supported by useradd_base.bbclass). Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
When building shadow-native, syslog was disabled for useradd and
groupadd. This disables it also for groupdel, groupmems, groupmod,
userdel and usermod (i.e., the use of syslog is now disabled for all
commands supported by useradd_base.bbclass).

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
shadow: fix `su' behaviour 2015-04-24T10:05:58+00:00 Chen Qi Qi.Chen@windriver.com 2015-04-21T09:30:46+00:00 6820f05dad0b4f9b9bbcf7c2a0af8c34f66199ae 0001-su.c-fix-to-exec-command-correctly.patch is removed. Below is the reason. This patch is introduced to solve the 'su: applet not found' problem when executing `su -l xxx -c env'. The patch references codes of previous release of shadow. However, this patch introduces bug#5359. So it's not correct. Let's first look at the root cause of 'su: applet not found' problem. This problem appears when /bin/sh is provided by busybox. When executing `su -l xxx -c env' command, the following function is invoked. execve("/bin/sh", ["-su", "-c", "env"], [/* 6 vars */]) Note that the argv[0] provided to new executable file (/bin/sh) is "-su". As /bin/sh is a symlink to /bin/busybox. It's /bin/busybox that is executed. In busybox's appletlib.c, it would examine argv[0], try to find an applet that has the same name, and then try to execute the main function of the applet. This logic results in `su' applet from busybox to be executed. However, we default to set 'BUSYBOX_SPLIT_SUID' to "1", so 'su' is not found. Further more, even if we set 'BUSYBOX_SPLIT_SUID' to "0", so that 'su' applet is found. The whole behaviour is still not correct. Because 'su' from shadow takes higher priority than that from busybox, so 'su' from busybox should never be executed on such system unless it's specified clearly by the end user. The logic of busybox's appletlib.c is totally correct from the point of busybox itself. It's an integration problem. To solve the above problem, this patch comment out SU_NAME in /etc/login.defs so that the final function executed in shadow's su is as below. execve("/bin/sh", ["-sh", "-c", "env"], [/* 6 vars */]) [YOCTO #5359] [YOCTO #7137] Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
0001-su.c-fix-to-exec-command-correctly.patch is removed. Below is the reason.
This patch is introduced to solve the 'su: applet not found' problem when
executing `su -l xxx -c env'. The patch references codes of previous release
of shadow. However, this patch introduces bug#5359. So it's not correct.

Let's first look at the root cause of 'su: applet not found' problem.
This problem appears when /bin/sh is provided by busybox.
When executing `su -l xxx -c env' command, the following function is invoked.
    execve("/bin/sh", ["-su", "-c", "env"], [/* 6 vars */])
Note that the argv[0] provided to new executable file (/bin/sh) is "-su".
As /bin/sh is a symlink to /bin/busybox. It's /bin/busybox that is executed.
In busybox's appletlib.c, it would examine argv[0], try to find an applet
that has the same name, and then try to execute the main function of the
applet. This logic results in `su' applet from busybox to be executed.
However, we default to set 'BUSYBOX_SPLIT_SUID' to "1", so 'su' is not found.
Further more, even if we set 'BUSYBOX_SPLIT_SUID' to "0", so that 'su' applet
is found. The whole behaviour is still not correct. Because 'su' from shadow
takes higher priority than that from busybox, so 'su' from busybox should never
be executed on such system unless it's specified clearly by the end user.
The logic of busybox's appletlib.c is totally correct from the point of busybox
itself. It's an integration problem.

To solve the above problem, this patch comment out SU_NAME in /etc/login.defs
so that the final function executed in shadow's su is as below.
    execve("/bin/sh", ["-sh", "-c", "env"], [/* 6 vars */])

[YOCTO #5359]
[YOCTO #7137]

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
shadow: securetty: Add Xilinx Zynq SoC 2015-01-28T21:22:21+00:00 Soren Brinkmann soren.brinkmann@xilinx.com 2015-01-08T22:59:43+00:00 82f5fd5f39b1c665098dd5ca567cbb2b5d955924 Add Zynq's console devices to securetty. Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
Add Zynq's console devices to securetty.

Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
shadow-securetty: add ttyAM[0-3] serial ports 2014-11-20T14:06:31+00:00 Javier Viguera javier.viguera@digi.com 2014-11-13T15:48:56+00:00 fa17b9ea435f5c49e3bea56524152b21d915d464 Old version of the ARM AMBA serial port driver creates those device nodes. Signed-off-by: Javier Viguera <javier.viguera@digi.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
Old version of the ARM AMBA serial port driver creates those device nodes.

Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
shadow: enable support for subordinate IDs 2014-11-04T10:20:34+00:00 Bogdan Purcareata bogdan.purcareata@freescale.com 2014-10-27T15:51:34+00:00 8548868c05e52700fd4712298b1705b8ec7ae446 The subordinate IDs support in pkg-shadow allows unprivileged users to manage a set of UIDs and GIDs. These subordinate IDs are specified by root, and can be further used by the unprivileged user they have been assigned to. This user can then create an e.g. user namespace, where he is allowed to manage his own set of users and group from the pool of subordinate IDs. More details can be found at http://lwn.net/Articles/533617/. Pull a required change from upstream in order to make shadow cross-compile with subordinate IDs support. Enable flag in recipe. Changes since v1: - update changelog Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
The subordinate IDs support in pkg-shadow allows unprivileged users to manage a
set of UIDs and GIDs. These subordinate IDs are specified by root, and can be
further used by the unprivileged user they have been assigned to. This user can
then create an e.g. user namespace, where he is allowed to manage his own set of
users and group from the pool of subordinate IDs. More details can be found at
http://lwn.net/Articles/533617/.

Pull a required change from upstream in order to make shadow cross-compile with
subordinate IDs support. Enable flag in recipe.

Changes since v1:
- update changelog

Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
shadow: Make useradd work correctly with --root again 2014-09-16T21:12:29+00:00 Peter Kjellerstedt peter.kjellerstedt@axis.com 2014-09-12T15:05:00+00:00 0af59a04135f067f0e01883defa77c6f714eab2e Even if useradd --root <root> is used it would still read login.defs before doing the chroot() and thus use the one provided by the host rather than the sysroot. (From OE-Core rev: b85917a4ebe636316fa7305017cd32a47b392039) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
Even if useradd --root <root> is used it would still read login.defs
before doing the chroot() and thus use the one provided by the host
rather than the sysroot.

(From OE-Core rev: b85917a4ebe636316fa7305017cd32a47b392039)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
shadow: add Qualcomm and STMicroelectronics SoCs 2014-09-10T10:29:50+00:00 Fathi Boudra fathi.boudra@linaro.org 2014-09-08T11:58:43+00:00 8c811541125fff75429d09249299add5ffe80912 Reported-by: Nicolas Dechesne <nicolas.dechesne@linaro.org> Reported-by: Peter Griffin <peter.griffin@linaro.org> Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
Reported-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Reported-by: Peter Griffin <peter.griffin@linaro.org>
Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
shadow-securetty: add freescale lpuart 2014-07-25T14:33:35+00:00 Stefan Agner stefan@agner.ch 2014-07-24T07:44:22+00:00 1732ea461f1d0afe254e36a8bfe84a6675a42e66 Add Freescale lpuart tty's (ttyLPx) to securetty. Freescale Vybrid devices running upstream kernel use this driver. Signed-off-by: Stefan Agner <stefan@agner.ch> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
Add Freescale lpuart tty's (ttyLPx) to securetty. Freescale Vybrid
devices running upstream kernel use this driver.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
shadow: fix the behavior of su 2014-07-23T20:44:21+00:00 Chen Qi Qi.Chen@windriver.com 2014-07-22T02:32:15+00:00 ab0115d1b8a0cb0b25bdb14fd2a3e6c6bb9a44f8 In systems where bash is not installed and /bin/sh is provided by busybox. Commands like `su -l -c '/home/root/test' xuser' would fail complaining the the 'su' applet could not be found. This patch references the old version of shadow to keep the behaviour the way it was in old version so that we would avoid the problem mentioned above. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
In systems where bash is not installed and /bin/sh is provided by
busybox. Commands like `su -l -c '/home/root/test' xuser' would fail
complaining the the 'su' applet could not be found.

This patch references the old version of shadow to keep the behaviour
the way it was in old version so that we would avoid the problem mentioned
above.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>