Merge ~skia/ubuntu/+source/adduser:skia/merge_3.137ubuntu2_3.152 into ubuntu/+source/adduser:debian/sid

[Skia]

Build is in this PPA: https://launchpad.net/~hyask/+archive/ubuntu/shadow-merge-2098865/+packages

autopkgtest:
  - adduser/3.152ubuntu1~skiappa2, shadow/1:4.17.4-2ubuntu1~skiappa1
    + ✅ adduser on questing for amd64 @ 26.05.25 13:27:28
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-hyask-shadow-merge-2098865/questing/amd64/a/adduser/20250526_132728_3f9cc@/log.gz
    + ✅ adduser on questing for arm64 @ 26.05.25 14:54:41
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-hyask-shadow-merge-2098865/questing/arm64/a/adduser/20250526_145441_456c4@/log.gz
    + ✅ adduser on questing for armhf @ 26.05.25 14:51:15
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-hyask-shadow-merge-2098865/questing/armhf/a/adduser/20250526_145115_9f5e4@/log.gz
    + ✅ adduser on questing for i386 @ 26.05.25 14:49:38
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-hyask-shadow-merge-2098865/questing/i386/a/adduser/20250526_144938_0daf5@/log.gz
    + ✅ adduser on questing for ppc64el @ 26.05.25 16:29:33
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-hyask-shadow-merge-2098865/questing/ppc64el/a/adduser/20250526_162933_d952c@/log.gz
    + s390x is facing infrastructure issues right now

[Sebastien Bacher (seb128)]

Thanks, it's looking good, I only have a few minor nitpicks where we should follow Debian and update the syntax to stop using "&".

review: Needs Fixing

[Skia (skia)]

Fair enough. I must admit my perl isn't fluent at all, and as soon as I had a code that worked, I didn't push through to actually question it further, so thanks a lot for spotting that and making me look up some details on that ampersand syntax. :-)
I've updated this branch, and uploaded version 3.152ubuntu1~skiappa4 to my PPA for testing.

[Skia (skia)]

Looking good so far

  - adduser/3.152ubuntu1~skiappa4
    + ✅ adduser on questing for amd64 @ 06.06.25 14:33:43
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-hyask-shadow-merge-2098865/questing/amd64/a/adduser/20250606_143343_c3ec0@/log.gz
    + ✅ adduser on questing for arm64 @ 06.06.25 14:36:53
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-hyask-shadow-merge-2098865/questing/arm64/a/adduser/20250606_143653_df66b@/log.gz
    + ✅ adduser on questing for armhf @ 06.06.25 14:36:49
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-hyask-shadow-merge-2098865/questing/armhf/a/adduser/20250606_143649_881b1@/log.gz
    + ✅ adduser on questing for i386 @ 06.06.25 14:34:26
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-hyask-shadow-merge-2098865/questing/i386/a/adduser/20250606_143426_a0aa6@/log.gz
    + s390x still running
    + ppc64el still running
    + riscv64 still running

[Sebastien Bacher (seb128)]

Thanks! Uploaded now

review: Approve

[Sebastien Bacher (seb128)]

It migrated to questing now so it can be marked as merged by someone who has rights

[Skia (skia)]

Done, thanks for the review and sponsor!

diff --git a/AdduserCommon.pm b/AdduserCommon.pm
index dbf3905..e71f9f7 100644
--- a/AdduserCommon.pm
+++ b/AdduserCommon.pm
@@ -464,8 +464,8 @@ sub preseed_config {
         grouphomes => "no",
         letterhomes => "no",
         quotauser => "",
-        dir_mode => "0700",
-        sys_dir_mode => "0755",
+        dir_mode => "0750",
+        sys_dir_mode => "0750",
         setgid_home => "no",
         no_del_paths => "^/bin\$ ^/boot\$ ^/dev\$ ^/etc\$ ^/initrd ^/lib ^/lost+found\$ ^/media\$ ^/mnt\$ ^/opt\$ ^/proc\$ ^/root\$ ^/run\$ ^/sbin\$ ^/srv\$ ^/sys\$ ^/tmp\$ ^/usr\$ ^/var\$ ^/vmlinu",
         name_regex     => def_name_regex,
@@ -474,6 +474,7 @@ sub preseed_config {
         skel_ignore_regex => "\.(dpkg|ucf)-(old|new|dist)\$",
         extra_groups => "users",
         add_extra_groups => 0,
+        use_extrausers => 0,
         uid_pool => "",
         gid_pool => "",
         reserve_uid_pool => "yes",
diff --git a/adduser b/adduser
index c0e8796..0f10c49 100755
--- a/adduser
+++ b/adduser
@@ -112,6 +112,7 @@ my $disabled_login = 0;		# leave the new account disabled?
 
 our @configfiles;
 our @defaults = undef;
+our $encrypt_home = undef;
 our $found_group_opt = undef;
 our $found_sys_opt = undef;
 our $ingroup_name = undef;
@@ -126,6 +127,7 @@ our $new_uid = undef;
 our $no_create_home = undef;
 our $special_home = undef;
 our $special_shell = undef;
+our $use_extrausers = 0;
 our $add_extra_groups;
 our $add_extra_groups_old;
 
@@ -168,6 +170,8 @@ GetOptions(
     'logmsglevel=s' => \$logmsglevel,
     'disabled-login' => sub { $disabled_login = 1; $ask_passwd = 0 },
     'disabled-password' => sub { $ask_passwd = 0 },
+    'encrypt-home' => \$encrypt_home,
+    'extrausers' => \$use_extrausers,
     'firstgid=i' => \$new_firstgid,
     'firstuid=i' => \$new_firstuid,
     'force-badname' => sub { $name_check_level = 1 unless $name_check_level },
@@ -332,6 +336,11 @@ if ($found_group_opt) {
     }
 }
 
+my $ecryptfs_setup_private;
+if (defined($encrypt_home)) {
+    $ecryptfs_setup_private = which('ecryptfs-setup-private');
+}
+
 
 # read the uid and gid pool
 if ($config{"uid_pool"}) {
@@ -477,7 +486,12 @@ if ($action eq "addsysgroup") {
 
     log_info( mtx("Adding group `%s' (GID %d) ..."), $new_name, $gid_option);
     my $groupadd = which('groupadd');
-    my $ga_ret = systemcall_useradd($name_check_level, $groupadd, '-g', $gid_option, $new_name);
+    my $ga_ret;
+    if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+        $ga_ret = systemcall_useradd($name_check_level, $groupadd, '--extrausers', '-g', $gid_option, $new_name);
+    } else {
+        $ga_ret = systemcall_useradd($name_check_level, $groupadd, '-g', $gid_option, $new_name);
+    }
     if( $ga_ret == RET_INVALID_NAME_FROM_USERADD ) {
         $returnvalue = RET_INVALID_NAME_FROM_USERADD;
     }
@@ -522,7 +536,12 @@ if ($action eq "addgroup") {
 
     log_info( mtx("Adding group `%s' (GID %d) ..."), $new_name, $gid_option);
     my $groupadd = which('groupadd');
-    my $ga_ret = systemcall_useradd($name_check_level, $groupadd, '-g', $gid_option, $new_name);
+    my $ga_ret;
+    if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+        $ga_ret = systemcall_useradd($name_check_level, $groupadd, '--extrausers', '-g', $gid_option, $new_name);
+    } else {
+        $ga_ret = systemcall_useradd($name_check_level, $groupadd, '-g', $gid_option, $new_name);
+    }
     if( $ga_ret == RET_INVALID_NAME_FROM_USERADD ) {
         $returnvalue = RET_INVALID_NAME_FROM_USERADD;
     }
@@ -553,7 +572,11 @@ if ($action eq 'addusertogroup') {
     log_info( mtx("Adding user `%s' to group `%s' ..."), $existing_user, $existing_group );
 
     acquire_lock();
-    systemcall('/usr/sbin/usermod', '-a', '-G', $existing_group, $existing_user);
+    if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+        systemcall('/usr/sbin/usermod', '--extrausers', '-a', '-G', $existing_group, $existing_user);
+    } else {
+        systemcall('/usr/sbin/usermod', '-a', '-G', $existing_group, $existing_user);
+    }
     release_lock();
 
     exit( $returnvalue );
@@ -640,7 +663,12 @@ if ($action eq "addsysuser") {
         log_info( mtx("Adding new group `%s' (GID %d) ..."), $new_name, $gid_option );
         $undogroup = $new_name;
         my $groupadd = which('groupadd');
-        my $ga_ret = systemcall_useradd($name_check_level, $groupadd, '-g', $gid_option, $new_name);
+        my $ga_ret;
+        if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+            $ga_ret = systemcall_useradd($name_check_level, $groupadd, '--extrausers', '-g', $gid_option, $new_name);
+        } else {
+            $ga_ret = systemcall_useradd($name_check_level, $groupadd, '-g', $gid_option, $new_name);
+        }
         if( $ga_ret == RET_INVALID_NAME_FROM_USERADD ) {
             $returnvalue = RET_INVALID_NAME_FROM_USERADD;
         }
@@ -664,16 +692,30 @@ if ($action eq "addsysuser") {
     $undouser = $new_name;
 
     my $useradd = which('useradd');
-    my $ua_ret = systemcall_useradd($name_check_level, 
-        $useradd,
-        '-r',
-        '-K', sprintf('SYS_UID_MIN=%d', $new_firstuid || $config{'first_system_uid'}),
-        '-K', sprintf('SYS_UID_MAX=%d', $new_lastuid || $config{'last_system_uid'}),
-        '-d', $home_dir,
-        '-g', $ingroup_name,
-        '-s', $shell,
-        '-u', $new_uid,
-        $new_name);
+    my $ua_ret;
+    if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+        $ua_ret = systemcall_useradd($name_check_level,
+            $useradd, '--extrausers',
+            '-r',
+            '-K', sprintf('SYS_UID_MIN=%d', $new_firstuid || $config{'first_system_uid'}),
+            '-K', sprintf('SYS_UID_MAX=%d', $new_lastuid || $config{'last_system_uid'}),
+            '-d', $home_dir,
+            '-g', $ingroup_name,
+            '-s', $shell,
+            '-u', $new_uid,
+            $new_name);
+    } else {
+        $ua_ret = systemcall_useradd($name_check_level,
+            $useradd,
+            '-r',
+            '-K', sprintf('SYS_UID_MIN=%d', $new_firstuid || $config{'first_system_uid'}),
+            '-K', sprintf('SYS_UID_MAX=%d', $new_lastuid || $config{'last_system_uid'}),
+            '-d', $home_dir,
+            '-g', $ingroup_name,
+            '-s', $shell,
+            '-u', $new_uid,
+            $new_name);
+    }
     if( $ua_ret == RET_INVALID_NAME_FROM_USERADD ) {
         $returnvalue = RET_INVALID_NAME_FROM_USERADD;
     }
@@ -880,10 +922,18 @@ if ($action eq "adduser") {
         my $ret;
         if( defined( $primary_gid ) ) {
            log_info( mtx("Adding new group `%s' (%d) ..."), $new_name, $primary_gid);
-           $ret = systemcall_useradd($name_check_level, $groupadd, '-g', $primary_gid, $new_name);
+           if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+               $ret = systemcall_useradd($name_check_level, $groupadd, '--extrausers', '-g', $primary_gid, $new_name);
+            } else {
+               $ret = systemcall_useradd($name_check_level, $groupadd, '-g', $primary_gid, $new_name);
+            }
         } else {
            log_info( mtx("Adding new group `%s' (new group ID) ..."), $new_name);
-           $ret = systemcall_useradd($name_check_level, $groupadd, $new_name);
+           if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+               $ret = systemcall_useradd($name_check_level, $groupadd, '--extrausers', $new_name);
+           } else {
+               $ret = systemcall_useradd($name_check_level, $groupadd, $new_name);
+           }
            $primary_gid = egetgrnam($new_name);
            log_info( mtx("new group '%s' created with GID %d"), $new_name, $primary_gid );
         }
@@ -915,13 +965,24 @@ if ($action eq "adduser") {
     log_debug( "creating new user %s with home_dir %s and shell %s", $new_name, $home_dir, $shell );
     $undouser = $new_name;
     my $useradd = which('useradd');
-    my $ret = systemcall_useradd($name_check_level,
-        $useradd,
-        '-d', $home_dir,
-        '-g', $primary_gid,
-        '-s', $shell,
-        '-u', $new_uid,
-        $new_name);
+    my $ret;
+    if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+        $ret = systemcall_useradd($name_check_level,
+            $useradd, '--extrausers',
+            '-d', $home_dir,
+            '-g', $primary_gid,
+            '-s', $shell,
+            '-u', $new_uid,
+            $new_name);
+    } else {
+        $ret = systemcall_useradd($name_check_level,
+            $useradd,
+            '-d', $home_dir,
+            '-g', $primary_gid,
+            '-s', $shell,
+            '-u', $new_uid,
+            $new_name);
+    }
     if( $ret == RET_INVALID_NAME_FROM_USERADD ) {
         $returnvalue = RET_INVALID_NAME_FROM_USERADD;
     }
@@ -983,7 +1044,11 @@ if ($action eq "adduser") {
         my $yesexpr = langinfo(YESEXPR());
         CHFN: for (;;) {
             my $chfn = &which('chfn');
-            systemcall($chfn, $new_name);
+            if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+                systemcall($chfn, '--extrausers', $new_name);
+            } else {
+                systemcall($chfn, $new_name);
+            }
             # Translators: [y/N] has to be replaced by values defined in your
             # locale.  You can see by running "locale yesexpr" which regular
             # expression will be checked to find positive answer.
@@ -1018,9 +1083,15 @@ if ($action eq "adduser") {
 
             log_info( mtx("Adding user `%s' to group `%s' ..."), $new_name, $newgrp );
             my $gpasswd = &which('gpasswd');
-            systemcall($gpasswd, '-M',
-                        join(',', get_group_members($newgrp), $new_name),
-                        $newgrp);
+            if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+                systemcall($gpasswd, '--extrausers', '-M',
+                            join(',', get_group_members($newgrp), $new_name),
+                            $newgrp);
+            } else {
+                systemcall($gpasswd, '-M',
+                            join(',', get_group_members($newgrp), $new_name),
+                            $newgrp);
+            }
         }
     }
 
@@ -1085,6 +1156,10 @@ sub create_homedir {
            log_err( gtx("Couldn't create home directory `%s': %s."), $home_dir, $!);
            &cleanup();
         }
+        if ($action eq "adduser") {
+            # Mute the command
+            system('sh' => ( '-c' => '"$@" >/dev/null 2>&1', '--', '/usr/sbin/zsysctl', 'userdata', 'create', $new_name, $home_dir,));
+        }
         if( !chown($new_uid, $primary_gid, $home_dir) ) {
             log_err("chown %s:%s %s: %s", $new_uid, $primary_gid, $home_dir, $!);
             &cleanup();
@@ -1095,6 +1170,11 @@ sub create_homedir {
             &cleanup();
         }
 
+        if (defined($encrypt_home)) {
+            printf gtx("Setting up encryption ...\n") if $verbose;
+            systemcall($ecryptfs_setup_private, '-b', '-u', $new_name);
+        }
+
         if ($config{"skel"} && $copy_skeleton) {
             log_info( mtx("Copying files from `%s' ..."), $config{skel} );
             my $findpipe;
@@ -1113,6 +1193,10 @@ sub create_homedir {
             }
             close ($findpipe);
         }
+
+        if (defined($encrypt_home)) {
+            systemcall("/bin/umount", $home_dir);
+        }
     }
 }
 
@@ -1488,7 +1572,11 @@ sub ch_comment {
     # untaint unconditionally. our call to system() is safe, so
     # we leave the check to usermod
     if ($comment =~ qr/^([^\x00-\x1F\x7F:]*)$/ ) {
-        systemcall($usermod, '-c', $1, $name);
+        if ( ($use_extrausers) || ($config{"use_extrausers"}) ) {
+            log_fatal("Calling usermod with --extrausers is unsupported. Please raise a bug if you want to see this fixed.")
+        } else {
+            systemcall($usermod, '-c', $1, $name);
+        }
     } else {
         log_fatal("unconditional sanitize of comment failed. This should not happen.");
     }
@@ -1553,38 +1641,38 @@ sub usage {
     printf( gtx(
 "adduser [--uid id] [--firstuid id] [--lastuid id]
         [--gid id] [--firstgid id] [--lastgid id] [--ingroup group]
-        [--add-extra-groups] [--shell shell]
+        [--add-extra-groups] [--encrypt-home] [--shell shell]
         [--comment comment] [--home dir] [--no-create-home]
         [--allow-all-names] [--allow-bad-names]
         [--disabled-password] [--disabled-login]
-        [--conf file] [--quiet] [--verbose] [--debug]
+        [--conf file] [--extrausers] [--quiet] [--verbose] [--debug]
         user
     Add a regular user
 
 adduser --system
         [--uid id] [--group] [--ingroup group] [--gid id]
         [--shell shell] [--comment comment] [--home dir] [--no-create-home]
-        [--conf file] [--quiet] [--verbose] [--debug]
+        [--conf file] [--extrausers] [--quiet] [--verbose] [--debug]
         user
    Add a system user
 
 adduser --group
         [--gid ID] [--firstgid id] [--lastgid id]
-        [--conf file] [--quiet] [--verbose] [--debug]
+        [--conf file] [--extrausers] [--quiet] [--verbose] [--debug]
         group
 addgroup
         [--gid ID] [--firstgid id] [--lastgid id]
-        [--conf file] [--quiet] [--verbose] [--debug]
+        [--conf file] [--extrausers] [--quiet] [--verbose] [--debug]
         group
    Add a user group
 
 addgroup --system
         [--gid id]
-        [--conf file] [--quiet] [--verbose] [--debug]
+        [--conf file] [--extrausers] [--quiet] [--verbose] [--debug]
         group
    Add a system group
 
-adduser USER GROUP
+adduser [--extrausers] USER GROUP
    Add an existing user to an existing group\n") );
 }
 
@@ -1606,7 +1694,7 @@ sub get_dir_mode
       : $config{"dir_mode"};
 
     if(!defined($mode) || ! ($mode =~ /[0-7]{3}/ || $mode =~ /[0-7]{4}/)) {
-        $mode = ($found_sys_opt) ? "755" : "0700";
+        $mode = ($found_sys_opt) ? "750" : "0750";
     }
 
     if($setgid && (length($mode) == 3 || $mode =~ /^[0-1|4-5][0-7]{3}$/)) {
diff --git a/adduser.conf b/adduser.conf
index ff82f9e..ab8901b 100644
--- a/adduser.conf
+++ b/adduser.conf
@@ -69,12 +69,12 @@
 #USERS_GROUP=users
 
 # The permissions mode for home directories of non-system users.
-# Default: DIR_MODE=0700
-#DIR_MODE=0700
+# Default: DIR_MODE=0750
+#DIR_MODE=0750
 
 # The permissions mode for home directories of system users.
-# Default: SYS_DIR_MODE=0755
-#SYS_DIR_MODE=0755
+# Default: SYS_DIR_MODE=0750
+#SYS_DIR_MODE=0750
 
 # If set to a nonempty value, new users will have quotas copied
 # from that user with `edquota -p QUOTAUSER newuser'
@@ -114,3 +114,5 @@
 # Default: ADD_EXTRA_GROUPS=0
 #ADD_EXTRA_GROUPS=0
 
+# use extrausers by default
+#USE_EXTRAUSERS=1
diff --git a/debian/changelog b/debian/changelog
index d712e18..8f0ab49 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,34 @@
+adduser (3.152ubuntu1) questing; urgency=medium
+
+  * Merge with Debian unstable (LP: #2111568).
+    Note: This is the first merge done with git-ubuntu. Please upload
+    appropriately to keep the rich history with all commits being split.
+    Remaining changes:
+    - Add support for encrypting home directories (MR: !87):
+      This feature got a non-trivial refresh after some refactor upstream.
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: suggest ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+    - extrausers support for adduser and gpasswd (LP #1323732)
+      One feature got dropped in the rebase: updating a user comment with
+      --extrausers is now unsupported as the mechanism has changed in Debian,
+      and usermod doesn't support --extrausers. An error is raised instead if we
+      hit the situation.
+    - Add support for ZFS home directories (LP #1873263)
+    - Enable private home directories by default (LP #48734)
+    - Set DIR_MODE=0750 and SYS_DIR_MODE=0750 in the default adduser.conf
+    Dropped changes:
+    - AdduserCommon.pm, adduser.conf: Change default SYS_NAME_REGEX to allow
+      uppercase letters in the names of system users.
+      Debian now does that by default.
+    - Fix testsuite against newer shadow username restrictions
+      (LP 2077862, Closes: #1077804)
+      Debian fixed the testsuite.
+
+ -- Florent 'Skia' Jacquet <[e-mail]>  Fri, 23 May 2025 12:19:31 +0200
+
 adduser (3.152) unstable; urgency=medium
 
   * only do very basic sanitization for comment.
@@ -275,6 +306,40 @@ adduser (3.138) experimental; urgency=medium
 
  -- Marc Haber <[e-mail]>  Fri, 01 Nov 2024 19:19:54 +0100
 
+adduser (3.137ubuntu2) oracular; urgency=medium
+
+  * Fix testsuite against newer shadow username restrictions
+    (LP: #2077862, Closes: #1077804)
+
+ -- Simon Chopin <[e-mail]>  Mon, 26 Aug 2024 19:00:25 +0200
+
+adduser (3.137ubuntu1) mantic; urgency=medium
+
+  * Merge from Debian unstable (LP: #2026199). Remaining changes:
+    - Add support for encrypting home directories (MR: !87):
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: suggest ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+    - extrausers support for adduser and gpasswd (LP: #1323732)
+    - Add support for ZFS home directories (LP: #1873263)
+    - Enable private home directories by default (LP: #48734)
+      + Set DIR_MODE=0750 and SYS_DIR_MODE=0750 in the default adduser.conf
+    - AdduserCommon.pm, adduser.conf: Change default SYS_NAME_REGEX to allow
+      uppercase letters in the names of system users.
+  * d/t/ecryptfs: test cases for adduser and deluser with --encrypt-home
+  * Removed changes (superseded by Debian):
+    - Fixed failing autopkgtests (MR: !89):
+      + d/t/f/adduser_system.t: Smart increment of test uid to next available
+        value.
+      + d/t/f/firstlastuidgid.t: Smart increment of test uid and gid values to
+        next available value.
+      + d/t/f/firstlastuidgid.t: Changed S4L test group first and last uid
+        values to 3xx instead of 4xx to comply with SYS_UID_MAX.
+
+ -- Mateus Rodrigues de Morais <[e-mail]>  Wed, 05 Jul 2023 14:42:39 -0300
+
 adduser (3.137) unstable; urgency=medium
 
   * get along without perl-modules. Closes: #1039709
@@ -320,6 +385,32 @@ adduser (3.135) experimental; urgency=medium
 
  -- Marc Haber <[e-mail]>  Sat, 24 Jun 2023 15:22:08 +0200
 
+adduser (3.134ubuntu1) mantic; urgency=medium
+
+  * Merge from Debian unstable (LP: #2021498). Remaining changes:
+    - Add support for encrypting home directories (MR: !87):
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: suggest ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+    - extrausers support for adduser and gpasswd (LP: #1323732)
+    - Add support for ZFS home directories (LP: #1873263)
+    - Enable private home directories by default (LP: #48734)
+      + Set DIR_MODE=0750 and SYS_DIR_MODE=0750 in the default adduser.conf
+    - AdduserCommon.pm, adduser.conf: Change default SYS_NAME_REGEX to allow
+      uppercase letters in the names of system users.
+  * d/t/ecryptfs: test cases for adduser and deluser with --encrypt-home
+  * Fixed failing autopkgtests (MR: !89):
+    - d/t/f/adduser_system.t: Smart increment of test uid to next available
+      value.
+    - d/t/f/firstlastuidgid.t: Smart increment of test uid and gid values to
+      next available value.
+    - d/t/f/firstlastuidgid.t: Changed S4L test group first and last uid
+      values to 3xx instead of 4xx to comply with SYS_UID_MAX.
+
+ -- Mateus Rodrigues de Morais <[e-mail]>  Wed, 21 Jun 2023 16:38:18 +0200
+
 adduser (3.134) unstable; urgency=medium
 
   * Revert "mark adduser as Protected:yes"
@@ -435,6 +526,30 @@ adduser (3.130) unstable; urgency=low
 
  -- Marc Haber <[e-mail]>  Sun, 25 Dec 2022 17:11:31 +0100
 
+adduser (3.129ubuntu1) lunar; urgency=medium
+
+  * Merge from Debian unstable (LP: #1873519, #1977710). Remaining changes:
+    - Add support for encrypting home directories:
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: suggest ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+    - extrausers support for adduser and gpasswd (LP: #1323732)
+    - Add support for ZFS home directories (LP: #1873263)
+    - Enable private home directories by default (LP: #48734)
+      + Set DIR_MODE=0750 and SYS_DIR_MODE=0750 in the default adduser.conf
+   * Rename NAME_REGEX_SYSTEM to SYS_NAME_REGEX
+     - AdduserCommon.pm, adduser.conf: Change default SYS_NAME_REGEX to allow
+       uppercase letters in the names of system users.
+   * Removed changes (superseded by Debian):
+    - AdduserCommon.pm, adduser, adduser.8, adduser.conf.5: Allow uppercase
+      letters in the names of system users. This is done by having a separate
+      NAME_REGEX_SYSTEM configuration setting which applies when --system is
+      specified.
+
+ -- Benjamin Drung <[e-mail]>  Mon, 28 Nov 2022 15:34:26 +0100
+
 adduser (3.129) unstable; urgency=medium
 
   * improve parameter interpretation for adduser.
@@ -600,6 +715,30 @@ adduser (3.122) unstable; urgency=low
 
  -- Marc Haber <[e-mail]>  Wed, 13 Jul 2022 20:30:00 +0200
 
+adduser (3.121ubuntu1) kinetic; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - AdduserCommon.pm, adduser, adduser.8, adduser.conf.5: Allow uppercase
+      letters in the names of system users. This is done by having a separate
+      NAME_REGEX_SYSTEM configuration setting which applies when --system is
+      specified. (Soren Hansen)
+    - Add support for encrypting home directories:
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: suggest ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+    - extrausers support for adduser and gpasswd.
+    - Add support for ZFS home directories (LP: #1873263)
+    - Enable private home directories by default (LP: #48734)
+      + Set DIR_MODE=0750 in the default adduser.conf
+      + Change the description and default value to select private home
+        directories by default in debconf template
+      + Change the DIR_MODE when private home directories is configured via
+        debconf from 0751 to 0750 to ensure files are truly private
+
+ -- Benjamin Drung <[e-mail]>  Tue, 17 May 2022 12:26:42 +0200
+
 adduser (3.121) unstable; urgency=medium
 
   * translators: The templates in this package version are fuzzed.
@@ -693,6 +832,57 @@ adduser (3.119) unstable; urgency=medium
 
  -- Marc Haber <[e-mail]>  Thu, 03 Mar 2022 11:36:10 +0100
 
+adduser (3.118ubuntu5) hirsute; urgency=medium
+
+  * Enable private home directories by default (LP: #48734)
+    - Set DIR_MODE=0750 in the default adduser.conf
+    - Change the description and default value to select private home
+      directories by default in debconf template
+    - Change the DIR_MODE when private home directories is configured via
+      debconf from 0751 to 0750 to ensure files are truly private
+
+ -- Alex Murray <[e-mail]>  Wed, 06 Jan 2021 16:46:50 +1030
+
+adduser (3.118ubuntu4) hirsute; urgency=medium
+
+  [ Marcus Tomlinson ]
+  * Drop support for extrausers in deluser, not available yet.
+
+ -- Dimitri John Ledkov <[e-mail]>  Thu, 10 Dec 2020 16:53:10 +0000
+
+adduser (3.118ubuntu3) hirsute; urgency=medium
+
+  [ Marcus Tomlinson ]
+  * Add support for extrausers in gpasswd
+
+ -- Dimitri John Ledkov <[e-mail]>  Wed, 02 Dec 2020 10:16:44 +0000
+
+adduser (3.118ubuntu2) focal; urgency=medium
+
+  * Add support for ZFS home directories:
+    - Home directories are created as ZFS dataset if zsysctl is installed. If
+      the command is not installed or fails, the user will be created as usual
+      without a dedicated dataset (LP: #1873263)
+
+ -- Jean-Baptiste Lallement <[e-mail]>  Thu, 16 Apr 2020 16:12:53 +0200
+
+adduser (3.118ubuntu1) disco; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - AdduserCommon.pm, adduser, adduser.8, adduser.conf.5: Allow uppercase
+      letters in the names of system users. This is done by having a separate
+      NAME_REGEX_SYSTEM configuration setting which applies when --system is
+      specified. (Soren Hansen)
+    - Add support for encrypting home directories:
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: suggest ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+    - extrausers support for adduser.
+
+ -- Steve Langasek <[e-mail]>  Fri, 01 Feb 2019 12:01:22 -0800
+
 adduser (3.118) unstable; urgency=low
 
   * Team upload
@@ -717,6 +907,23 @@ adduser (3.118) unstable; urgency=low
 
  -- Afif Elghraoui <[e-mail]>  Sat, 15 Sep 2018 15:12:39 -0400
 
+adduser (3.117ubuntu1) cosmic; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - AdduserCommon.pm, adduser, adduser.8, adduser.conf.5: Allow uppercase
+      letters in the names of system users. This is done by having a separate
+      NAME_REGEX_SYSTEM configuration setting which applies when --system is
+      specified. (Soren Hansen)
+    - Add support for encrypting home directories:
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: suggest ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+    - extrausers support for adduser.
+
+ -- Steve Langasek <[e-mail]>  Mon, 14 May 2018 22:18:11 -0700
+
 adduser (3.117) unstable; urgency=medium
 
   [ Marc Haber ]
@@ -729,6 +936,27 @@ adduser (3.117) unstable; urgency=medium
 
  -- Marc Haber <[e-mail]>  Fri, 02 Feb 2018 17:42:15 +0100
 
+adduser (3.116ubuntu1) bionic; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - AdduserCommon.pm, adduser, adduser.8, adduser.conf.5: Allow uppercase
+      letters in the names of system users. This is done by having a separate
+      NAME_REGEX_SYSTEM configuration setting which applies when --system is
+      specified. (Soren Hansen)
+    - Add support for encrypting home directories:
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: suggest ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+    - extrausers support for adduser.
+  * Dropped changes, included in Debian:
+    - Add autopkgtest.
+    - testsuite/runsuite.sh: Add the testsuite directory to @INC, so it can
+      find the tests.
+
+ -- Steve Langasek <[e-mail]>  Tue, 05 Dec 2017 08:57:20 -0800
+
 adduser (3.116) unstable; urgency=medium
 
   * Advise installation of 'perl' rather than 'perl-modules'
@@ -824,6 +1052,52 @@ adduser (3.114) unstable; urgency=medium
 
  -- Niels Thykier <[e-mail]>  Sat, 12 Mar 2016 15:53:58 +0000
 
+adduser (3.113+nmu3ubuntu5) zesty; urgency=medium
+
+  * testsuite/runsuite.sh: Add the testsuite directory to @INC, so it can find
+    the tests.
+
+ -- Iain Lane <[e-mail]>  Mon, 31 Oct 2016 14:53:46 +0000
+
+adduser (3.113+nmu3ubuntu4) wily; urgency=medium
+
+  * extrausers support for adduser (LP: #1323732)
+
+ -- Sergio Schvezov <[e-mail]>  Fri, 26 Jun 2015 17:34:29 -0300
+
+adduser (3.113+nmu3ubuntu3) trusty; urgency=low
+
+  * Add autopkgtest. (LP: #1246331)
+
+ -- Jean-Baptiste Lallement <[e-mail]>  Wed, 30 Oct 2013 14:51:16 +0100
+
+adduser (3.113+nmu3ubuntu2) saucy; urgency=low
+
+  * Move ecryptfs-utils from recommends, to suggests. (LP: #1188108)
+    Adduser has moved from required to minimal set, and thus started to
+    pull ecryptfs-utils and cryptsetup into minimal installs, which is an
+    undesired effect.
+
+ -- Dmitrijs Ledkovs <[e-mail]>  Fri, 07 Jun 2013 11:24:08 +0100
+
+adduser (3.113+nmu3ubuntu1) raring; urgency=low
+
+  * Merge from Debian unstable, remaining changes:
+    - AdduserCommon.pm, adduser, adduser.8, adduser.conf.5: Allow uppercase
+      letters in the names of system users. This is done by having a separate
+      NAME_REGEX_SYSTEM configuration setting which applies when --system is
+      specified. (Soren Hansen)
+    - Add support for encrypting home directories:
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: recommend ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+  * Dropped changes, included in Debian:
+    - Mark adduser Multi-Arch: foreign.
+
+ -- Steve Langasek <[e-mail]>  Wed, 24 Oct 2012 17:07:33 -0700
+
 adduser (3.113+nmu3) unstable; urgency=low
 
   * Non-maintainer upload.
@@ -841,6 +1115,23 @@ adduser (3.113+nmu2) unstable; urgency=low
 
  -- Bastian Blank <[e-mail]>  Mon, 14 May 2012 13:47:27 +0000
 
+adduser (3.113+nmu1ubuntu1) quantal; urgency=low
+
+  * Merge from Debian unstable, remaining changes:
+    - AdduserCommon.pm, adduser, adduser.8, adduser.conf.5: Allow uppercase
+      letters in the names of system users. This is done by having a separate
+      NAME_REGEX_SYSTEM configuration setting which applies when --system is
+      specified. (Soren Hansen)
+    - Add support for encrypting home directories:
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: recommend ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+    - Mark adduser Multi-Arch: foreign.
+
+ -- Steve Langasek <[e-mail]>  Mon, 30 Apr 2012 22:52:15 -0700
+
 adduser (3.113+nmu1) unstable; urgency=low
 
   * Non-maintainer upload.
@@ -854,6 +1145,34 @@ adduser (3.113+nmu1) unstable; urgency=low
 
  -- Christian Perrier <[e-mail]>  Sat, 21 Jan 2012 09:00:03 +0100
 
+adduser (3.113ubuntu2) precise; urgency=low
+
+  * Fix a typo in the usage info for NAME_REGEX_SYSTEM.
+
+ -- Steve Langasek <[e-mail]>  Wed, 19 Oct 2011 14:52:33 -0700
+
+adduser (3.113ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing, cleaning up a mess of missing translations
+    due to previous .po file mismerging.
+  * Remaining changes:
+    - AdduserCommon.pm, adduser, adduser.8, adduser.conf.5: Allow uppercase
+      letters in the names of system users. This is done by having a separate
+      NAME_REGEX_SYSTEM configuration setting which applies when --system is
+      specified. (Soren Hansen)
+    - Add support for encrypting home directories:
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: recommend ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+  * Dropped changes, included in Debian:
+    - deluser: added missing linebreak at line 338
+    - deluser: Remove symlinks to directories with rm, not rmdir
+  * Mark adduser Multi-Arch: foreign.
+
+ -- Steve Langasek <[e-mail]>  Wed, 19 Oct 2011 14:34:19 -0700
+
 adduser (3.113) unstable; urgency=low
 
   * Warning to STDERR (closes: #561864)
@@ -910,6 +1229,51 @@ adduser (3.112+nmu2) unstable; urgency=low
 
  -- David Prévot <[e-mail]>  Sun, 21 Nov 2010 17:13:00 -0400
 
+adduser (3.112+nmu1ubuntu5) natty; urgency=low
+
+  * debian/control: fix an often-duplicated bug, which causes apt to try
+    and remove ecryptfs-utils, even though it is in use; have adduser
+    recommend, rather than suggest ecryptfs-utils, LP: #653628
+
+ -- Dustin Kirkland <[e-mail]>  Wed, 09 Mar 2011 11:16:13 +0000
+
+adduser (3.112+nmu1ubuntu4) natty; urgency=low
+
+  * And fix a typo in the last patch.
+
+ -- Matthias Klose <[e-mail]>  Thu, 06 Jan 2011 22:05:54 +0100
+
+adduser (3.112+nmu1ubuntu3) natty; urgency=low
+
+  * deluser: Remove symlinks to directories with rm, not rmdir (Jim Cheetham).
+    LP: #34299.
+
+ -- Matthias Klose <[e-mail]>  Thu, 06 Jan 2011 21:48:21 +0100
+
+adduser (3.112+nmu1ubuntu2) natty; urgency=low
+
+  * deluser: added missing linebreak at line 338 (LP: #613204)
+    thanks to [e-mail] and Mohamed Amine IL Idrissi for the
+    patch
+
+ -- Oliver Grawert <[e-mail]>  Tue, 23 Nov 2010 12:40:28 +0100
+
+adduser (3.112+nmu1ubuntu1) natty; urgency=low
+
+  * Merge with Debian unstable. Remaining Ubuntu changes:
+    - AdduserCommon.pm, adduser, adduser.8, adduser.conf.5: Allow uppercase
+      letters in the names of system users. This is done by having a separate
+      NAME_REGEX_SYSTEM configuration setting which applies when --system is
+      specified. (Soren Hansen)
+    - Add support for encrypting home directories:
+      + adduser: Add --encrypt-home option, which calls ecryptfs-setup-private
+        for the hard work.
+      + doc/adduser.8: document the --encrypt-home option
+      + debian/control: suggest ecryptfs-utils >= 67-1
+      + deluser: remove all of /var/lib/ecryptfs/$user with --remove-home
+
+ -- Martin Pitt <[e-mail]>  Tue, 12 Oct 2010 15:47:22 +0200
+
 adduser (3.112+nmu1) unstable; urgency=low
 
   * Non-maintainer upload.
diff --git a/debian/control b/debian/control
index 8d6c306..063492e 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: adduser
 Section: admin
 Priority: important
-Maintainer: Debian Adduser Developers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Adduser Developers <[e-mail]>
 Uploaders: Marc Haber <[e-mail]>
 Standards-Version: 4.7.2
 Build-Depends: debhelper-compat (= 13), po4a
@@ -15,7 +16,7 @@ Architecture: all
 Multi-Arch: foreign
 Pre-Depends: ${misc:Pre-Depends}
 Depends: passwd (>= 1:4.17.2-5), ${misc:Depends}
-Suggests: liblocale-gettext-perl, perl, cron, quota
+Suggests: liblocale-gettext-perl, perl, cron, quota, ecryptfs-utils (>= 67-1)
 Description: add and remove users and groups
  This package includes the 'adduser' and 'deluser' commands for creating
  and removing users.
diff --git a/debian/preinst b/debian/preinst
index 174f298..9e43355 100755
--- a/debian/preinst
+++ b/debian/preinst
@@ -30,6 +30,8 @@ create_adduser_conf() {
     ab6adcf4067d7d50ef45cc93ca3a8c54b7ab3e7748420434ad846e8d6e6c34d2ae10d576029d3e1e501f7a743951aed3876c8f3d0e03a918410fa3c9d82460e2 \
     b26329cba15b817a79d19c542c49a3e34b7535ffbd60057df7aca2b7027a1ad8db0cdecfd5c00c40d60f50e8b7e2e1675d8401696cf8933a5530e31e430a6675 \
     a91cdf6bf59602a7c7dbb745bca1b4d374035026dd89aa62eb9edea8ffcdff4a764a2274770de81687291d57cf9fbc0f0eb495451460c2b44229cebcecd9d870 \
+    9276d943d595d49f28f391688ab1973b2235a90dcf42cd383ee7a0e7b819fd8c232ec9d7e5da0c2b8a822a8d8f0eba230e88acde34015a4881ca2499b7809cb4 \
+    b9eb41be93cf85fba8f716d4683e6171b39a068b61a4fe4bfb5b1be93400000e8fb24b151ecaf4a88487802c24ac7aec72100fa6fd1926fa49fed9862d45deee \
     d8502b9daf3a3a486ca563a15f2bb03a25eb9247d201d15a4640088626c660a03416b62217f59c37aa94050317243b8979fd46d99e081f555eb7f8adf325a7f8"
   else
     # old version already has adduser.conf as a dpkg-conffile, nothing to do.
@@ -48,16 +50,16 @@ create_adduser_conf() {
       printf "cannot move unchanged adduser.conf to adduser.conf.update-old. You can continue after answering the dpkg configuration file question.\n"
     else
       DIR_MODE="$(< /etc/adduser.conf sed -n '/^\(DIR_MODE=\)/{s///;p;q;}')"
-      DIR_MODE="${DIR_MODE:-0700}"
-      if [ "$DIR_MODE" != "0700" ] && [ "$DIR_MODE" != "0755" ]; then
+      DIR_MODE="${DIR_MODE:-0750}"
+      if [ "$DIR_MODE" != "0750" ] && [ "$DIR_MODE" != "0755" ]; then
 	# We reach this point of control if the local file is identical to what
-	# we have shipped AND DIR_MODE is neither set to 0700 and 0755. This must
+	# we have shipped AND DIR_MODE is neither set to 0750 and 0755. This must
 	# be a local change, therefore a dpkg prompt is expected.
-        printf "DIR_MODE default has changed from %s to 0700. You can continue after answering the dpkg configuration file question.\n" "${DIR_MODE}"
+        printf "DIR_MODE default has changed from %s to 0750. You can continue after answering the dpkg configuration file question.\n" "${DIR_MODE}"
       else
 	# We reach this point of control if the local file is identical to what
-	# we have shipped AND DIR_MODE is either set to 0700 or  0755. If it is
-	# 0700, then our change is already what the user has configured before
+	# we have shipped AND DIR_MODE is either set to 0750 or  0755. If it is
+	# 0750, then our change is already what the user has configured before
 	# (no prompt needed). If it is 0755, the user never changed the default,
 	# hence we are policy compliant to overwrite our unchanged default with
 	# the new one (no prompt needed as well).
diff --git a/debian/tests/control b/debian/tests/control
index 9e680e7..bda1887 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -3,6 +3,10 @@ Depends: adduser, cron, perl, login
 Restrictions: needs-root
 Features: test-name=package-test-suite
 
+Test-Command: /usr/bin/prove -v debian/tests/ecryptfs
+Depends: cron, ecryptfs-utils, kmod, perl
+Restrictions: allow-stderr isolation-machine needs-root
+
 Test-Command: cd testsuite/ && ./runsuite.sh
 Depends: adduser, cron, perl, login
 Restrictions: allow-stderr breaks-testbed needs-root
diff --git a/debian/tests/ecryptfs/encrypt_home.t b/debian/tests/ecryptfs/encrypt_home.t
new file mode 100755
index 0000000..7b560c5
--- /dev/null
+++ b/debian/tests/ecryptfs/encrypt_home.t
@@ -0,0 +1,31 @@
+#! /usr/bin/perl -Idebian/tests/lib
+
+use diagnostics;
+use strict;
+use warnings;
+
+use AdduserTestsCommon;
+
+# enable ecryptfs kernel module
+system('/sbin/modprobe', 'ecryptfs');
+
+my $test_user="foocrypt";
+
+assert_user_does_not_exist($test_user);
+
+assert_command_success('/usr/sbin/adduser', '--encrypt-home', '--disabled-password', '--comment', '""', $test_user);
+
+assert_user_exists($test_user);
+assert_group_exists($test_user);
+assert_group_membership_exists($test_user, $test_user);
+
+# test for ecryptfs files stored in $HOME
+assert_path_exists("/home/$test_user/.ecryptfs");
+assert_path_exists("/home/$test_user/.Private");
+# and not stored in $HOME
+assert_path_exists("/home/.ecryptfs/$test_user");
+
+assert_command_success('/usr/sbin/deluser', '--remove-home', $test_user);
+assert_user_does_not_exist($test_user);
+assert_path_does_not_exist("/home/$test_user");
+assert_path_does_not_exist("/home/.ecryptfs/$test_user");
diff --git a/debian/tests/f/homedir_modes.t b/debian/tests/f/homedir_modes.t
index c7daa66..134e709 100755
--- a/debian/tests/f/homedir_modes.t
+++ b/debian/tests/f/homedir_modes.t
@@ -16,7 +16,7 @@ my @modes = ("750","2751","3333","55555","8888","wtF??");
 
 my $user = $user_prefix . "default";
 my $home = "/home/$user";
-my $mode = "755";
+my $mode = "750";
 
 assert_user_does_not_exist($user);
 assert_path_does_not_exist($home);
@@ -51,7 +51,7 @@ foreach (@modes) {
   if (mode_is_valid($mode)) {
     assert_path_has_mode($home, $mode);
   } else {
-    my $def_mode = "755";
+    my $def_mode = "750";
     assert_path_has_mode($home, $def_mode, $mode);
   }
   remove_tree($home);
diff --git a/deluser b/deluser
index 2673f22..c823acb 100755
--- a/deluser
+++ b/deluser
@@ -344,8 +344,26 @@ if($action eq "deluser") {
                     if(-d $name);
             } # sub home_match
 
+            # collect ecryptfs config files not stored in $HOME
+            sub ecryptfs_match {
+                my $name = sanitize_string( $File::Find::name, pathre );
+                if ( $name !~ m[^/var/lib/ecryptfs/\Q$user] &&  $name !~ m[^/home/\.ecryptfs/\Q$user]) {
+                    $File::Find::prune=1;
+                    return;
+                }
+                push(@files, $name)
+                    if(-f $name || -l $name);
+                push(@dirs, $name)
+                    if(-d $name);
+            } # sub ecryptfs_match
+
             File::Find::find({wanted => \&home_match, untaint => 1, no_chdir => 1}, $pw_homedir)
                 if(-d "$pw_homedir");
+            if(-d "/var/lib/ecryptfs/$user") {
+                File::Find::find({wanted => \&ecryptfs_match, untaint => 1, no_chdir => 1}, "/var/lib/ecryptfs/$user");
+            } elsif (-d "/home/.ecryptfs/$user") {
+                File::Find::find({wanted => \&ecryptfs_match, untaint => 1, no_chdir => 1}, "/home/.ecryptfs/$user");
+            }
             push(@files, "/var/mail/$user")
                 if(-e "/var/mail/$user");
         }
diff --git a/doc/adduser.8 b/doc/adduser.8
index 52d22e3..e19a589 100644
--- a/doc/adduser.8
+++ b/doc/adduser.8
@@ -26,6 +26,7 @@ adduser, addgroup \- add or manipulate users or groups
 .OP \-\-debug
 .OP \-\-disabled\-login
 .OP \-\-disabled\-password
+.OP \-\-encrypt\-home
 .OP \-\-firstgid id
 .OP \-\-firstuid id
 .OP \-\-gid id
@@ -214,6 +215,11 @@ might be pre-determined with the \fBUID_POOL\fP and \fBGID_POOL\fP option,
 documented in
 .BR adduser.conf (5).
 
+To set up an encrypted home directory for the new user, add the
+.B \-\-encrypt\-home
+option.  For more information, refer to the \-b option of
+.B ecryptfs-setup-private(1).
+
 .SS "Add a system user"
 If called with one non-option argument and the \fB\-\-system\fP option,
 \fBadduser\fP will add a
@@ -380,7 +386,10 @@ These are the deprecated forms of \fB\-\-allow\-bad\-names\fR.
 They will be removed
 during the release cycle of Debian 13.
 .TP
-.BI \-\-gid " GID"
+.B \-\-extrausers
+Uses extra users as the database.
+.TP
+.BI \-\-gid " GID "
 When creating a group,
 this option sets the group ID number of the new group to \fIGID\fP.
 When creating a user,