sysmo-bts/generic-poky
9
0
Fork 0
Code Pull requests Releases Activity
generic-poky/meta/recipes-extended/shadow/files/allow-for-setting-password-in-clear-text.patch
José Bollo 39858da230 shadow: 'useradd' copies root's extended attributes 
The copy of extended attributes is interesting for
Smack systems because it allows to set the security
template of the user's home directories without
modifying the tools (useradd here). But the version
of useradd that copies the extended attributes doesn't
copy the extended attributes of the root. This can make
use of homes impossible! This patch corrects the issue
by copying the extended attributes of the root directory:
/home/user will get the extended attributes of /etc/skel.

The patch is submitted upstream (see
http://lists.alioth.debian.org/pipermail/pkg-shadow-commits/2017-March/003804.html)

The existing patch specific to open-embedded is updated:
  0001-useradd.c-create-parent-directories-when-necessary.patch

Also, attr are activated for native tools.
This is needed when users are created during image creation.

(From OE-Core rev: eed66e85af5ca6bbdd80cc3d5cf8453e8d8880bc)

Signed-off-by: José Bollo <jose.bollo@iot.bzh>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-17 16:53:05 +00:00

202 lines
9.2 KiB
Diff
Raw Blame History

Upstream-Status: Inappropriate [OE specific]
Allow for setting password in clear text.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
src/Makefile.am | 8 ++++----
src/groupadd.c | 8 +++++++-
src/groupmod.c | 8 +++++++-
src/useradd.c | 9 +++++++--
src/usermod.c | 8 +++++++-
5 files changed, 32 insertions(+), 9 deletions(-)
diff --git a/src/Makefile.am b/src/Makefile.am
index 25e288d..856b087 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -88,10 +88,10 @@ chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBSELINUX) $(LIBCRYPT)
chsh_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
chpasswd_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT)
gpasswd_LDADD = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT)
-groupadd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
+groupadd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT)
groupdel_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
groupmems_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX)
-groupmod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
+groupmod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT)
grpck_LDADD = $(LDADD) $(LIBSELINUX)
grpconv_LDADD = $(LDADD) $(LIBSELINUX)
grpunconv_LDADD = $(LDADD) $(LIBSELINUX)
@@ -111,9 +111,9 @@ su_SOURCES = \
suauth.c
su_LDADD = $(LDADD) $(LIBPAM) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
sulogin_LDADD = $(LDADD) $(LIBCRYPT)
-useradd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR)
+useradd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR) $(LIBCRYPT)
userdel_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE)
-usermod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR)
+usermod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR) $(LIBCRYPT)
vipw_LDADD = $(LDADD) $(LIBSELINUX)
install-am: all-am
diff --git a/src/groupadd.c b/src/groupadd.c
index f716f57..4e28c26 100644
--- a/src/groupadd.c
+++ b/src/groupadd.c
@@ -124,6 +124,7 @@ static /*@noreturn@*/void usage (int status)
(void) fputs (_(" -o, --non-unique allow to create groups with duplicate\n"
" (non-unique) GID\n"), usageout);
(void) fputs (_(" -p, --password PASSWORD use this encrypted password for the new group\n"), usageout);
+ (void) fputs (_(" -P, --clear-password PASSWORD use this clear password for the new group\n"), usageout);
(void) fputs (_(" -r, --system create a system account\n"), usageout);
(void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
(void) fputs ("\n", usageout);
@@ -387,12 +388,13 @@ static void process_flags (int argc, char **argv)
{"key", required_argument, NULL, 'K'},
{"non-unique", no_argument, NULL, 'o'},
{"password", required_argument, NULL, 'p'},
+ {"clear-password", required_argument, NULL, 'P'},
{"system", no_argument, NULL, 'r'},
{"root", required_argument, NULL, 'R'},
{NULL, 0, NULL, '\0'}
};
- while ((c = getopt_long (argc, argv, "fg:hK:op:rR:",
+ while ((c = getopt_long (argc, argv, "fg:hK:op:P:rR:",
long_options, NULL)) != -1) {
switch (c) {
case 'f':
@@ -444,6 +446,10 @@ static void process_flags (int argc, char **argv)
pflg = true;
group_passwd = optarg;
break;
+ case 'P':
+ pflg = true;
+ group_passwd = pw_encrypt (optarg, crypt_make_salt (NULL, NULL));
+ break;
case 'r':
rflg = true;
break;
diff --git a/src/groupmod.c b/src/groupmod.c
index d9d3807..68f49d1 100644
--- a/src/groupmod.c
+++ b/src/groupmod.c
@@ -127,6 +127,7 @@ static void usage (int status)
(void) fputs (_(" -o, --non-unique allow to use a duplicate (non-unique) GID\n"), usageout);
(void) fputs (_(" -p, --password PASSWORD change the password to this (encrypted)\n"
" PASSWORD\n"), usageout);
+ (void) fputs (_(" -P, --clear-password PASSWORD change the password to this clear PASSWORD\n"), usageout);
(void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
(void) fputs ("\n", usageout);
exit (status);
@@ -375,10 +376,11 @@ static void process_flags (int argc, char **argv)
{"new-name", required_argument, NULL, 'n'},
{"non-unique", no_argument, NULL, 'o'},
{"password", required_argument, NULL, 'p'},
+ {"clear-password", required_argument, NULL, 'P'},
{"root", required_argument, NULL, 'R'},
{NULL, 0, NULL, '\0'}
};
- while ((c = getopt_long (argc, argv, "g:hn:op:R:",
+ while ((c = getopt_long (argc, argv, "g:hn:op:P:R:",
long_options, NULL)) != -1) {
switch (c) {
case 'g':
@@ -405,6 +407,10 @@ static void process_flags (int argc, char **argv)
group_passwd = optarg;
pflg = true;
break;
+ case 'P':
+ group_passwd = pw_encrypt (optarg, crypt_make_salt (NULL, NULL));
+ pflg = true;
+ break;
case 'R': /* no-op, handled in process_root_flag () */
break;
default:
diff --git a/src/useradd.c b/src/useradd.c
index b3bd451..4416f90 100644
--- a/src/useradd.c
+++ b/src/useradd.c
@@ -776,6 +776,7 @@ static void usage (int status)
(void) fputs (_(" -o, --non-unique allow to create users with duplicate\n"
" (non-unique) UID\n"), usageout);
(void) fputs (_(" -p, --password PASSWORD encrypted password of the new account\n"), usageout);
+ (void) fputs (_(" -P, --clear-password PASSWORD clear password of the new account\n"), usageout);
(void) fputs (_(" -r, --system create a system account\n"), usageout);
(void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
(void) fputs (_(" -s, --shell SHELL login shell of the new account\n"), usageout);
@@ -1050,6 +1051,7 @@ static void process_flags (int argc, char **argv)
{"no-user-group", no_argument, NULL, 'N'},
{"non-unique", no_argument, NULL, 'o'},
{"password", required_argument, NULL, 'p'},
+ {"clear-password", required_argument, NULL, 'P'},
{"system", no_argument, NULL, 'r'},
{"root", required_argument, NULL, 'R'},
{"shell", required_argument, NULL, 's'},
@@ -1062,9 +1064,9 @@ static void process_flags (int argc, char **argv)
};
while ((c = getopt_long (argc, argv,
#ifdef WITH_SELINUX
- "b:c:d:De:f:g:G:hk:K:lmMNop:rR:s:u:UZ:",
+ "b:c:d:De:f:g:G:hk:K:lmMNop:P:rR:s:u:UZ:",
#else /* !WITH_SELINUX */
- "b:c:d:De:f:g:G:hk:K:lmMNop:rR:s:u:U",
+ "b:c:d:De:f:g:G:hk:K:lmMNop:P:rR:s:u:U",
#endif /* !WITH_SELINUX */
long_options, NULL)) != -1) {
switch (c) {
@@ -1230,6 +1232,9 @@ static void process_flags (int argc, char **argv)
}
user_pass = optarg;
break;
+ case 'P': /* set clear text password */
+ user_pass = pw_encrypt (optarg, crypt_make_salt (NULL, NULL));
+ break;
case 'r':
rflg = true;
break;
diff --git a/src/usermod.c b/src/usermod.c
index e7d4351..b79f7a3 100644
--- a/src/usermod.c
+++ b/src/usermod.c
@@ -419,6 +419,7 @@ static /*@noreturn@*/void usage (int status)
" new location (use only with -d)\n"), usageout);
(void) fputs (_(" -o, --non-unique allow using duplicate (non-unique) UID\n"), usageout);
(void) fputs (_(" -p, --password PASSWORD use encrypted password for the new password\n"), usageout);
+ (void) fputs (_(" -P, --clear-password PASSWORD use clear password for the new password\n"), usageout);
(void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
(void) fputs (_(" -s, --shell SHELL new login shell for the user account\n"), usageout);
(void) fputs (_(" -u, --uid UID new UID for the user account\n"), usageout);
@@ -996,6 +997,7 @@ static void process_flags (int argc, char **argv)
{"move-home", no_argument, NULL, 'm'},
{"non-unique", no_argument, NULL, 'o'},
{"password", required_argument, NULL, 'p'},
+ {"clear-password", required_argument, NULL, 'P'},
{"root", required_argument, NULL, 'R'},
{"shell", required_argument, NULL, 's'},
{"uid", required_argument, NULL, 'u'},
@@ -1012,7 +1014,7 @@ static void process_flags (int argc, char **argv)
{NULL, 0, NULL, '\0'}
};
while ((c = getopt_long (argc, argv,
- "ac:d:e:f:g:G:hl:Lmop:R:s:u:U"
+ "ac:d:e:f:g:G:hl:Lmop:P:R:s:u:U"
#ifdef ENABLE_SUBIDS
"v:w:V:W:"
#endif /* ENABLE_SUBIDS */
@@ -1112,6 +1114,10 @@ static void process_flags (int argc, char **argv)
user_pass = optarg;
pflg = true;
break;
+ case 'P':
+ user_pass = pw_encrypt (optarg, crypt_make_salt (NULL, NULL));
+ pflg = true;
+ break;
case 'R': /* no-op, handled in process_root_flag () */
break;
case 's':
--
1.7.9.5
View git blame Copy permalink