Merge lp:ubuntu/utopic/shadow into lp:ubuntu/trusty/shadow

[Jeffrey Flaker]

Fixed spelling error in bug 1348873

[Daniel Holbach (dholbach)]

To get into a stable release, this will need to follow: https://wiki.ubuntu.com/StableReleaseUpdates

The changes below are also more than just a spelling fix.

review: Needs Information

Unmerged revisions

66. By Michael Terry on 2014-07-18

* debian/patches/1010_extrausers.patch:
  - Add support to passwd for libnss-extrausers by falling back to the
    /var/lib/extrausers/ locations if it exists when updating
    passwd or shadow.

65. By Stéphane Graber on 2014-05-02

* Merge from Debian unstable. Remaining changes:
   - debian/passwd.upstart: Add an upstrat job to clear locks on
     [shadow-]passwd/group. (LP: #523896).
   - Allow LXC devices (lxc/console, lxc/tty[1234]) that we'll start using
     in LXC with Precise.
   - debian/login.defs:
     + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG
       handling does not only apply to "former (pre-PAM) uses".
     + Update documentation of UMASK: Explain that USERGROUPS_ENAB
       will modify this default for UPGs. (Closes: #583971)
   - debian/{source_shadow.py,rules}: Add apport hook
   - debian/patches/495_stdout-encrypted-password: chpasswd can report
     password hashes on stdout (Debian bug 505640).
   - Install upstart job by-hand, instead of using dh_installinit to avoid
     dependency on upstart-job.
   - Pass noupdate to pam_motd call for /run/motd.dynamic, to avoid running
     /etc/update-motd.d/* scripts twice (LP: #1169558).
   - debian/patches/496_su_kill_process_group: Kill the child process group,
     rather than just the immediate child; this is needed now that su no
     longer starts a controlling terminal when not running an interactive
     shell (closes: #713979).
   - Add uidmap package based on upstream patches that introduce
     newuidmap/newgidmap as well as /etc/subuid and /etc/subgid. Additional
     updates on those to widen the default allocation to 65536 uids and gids
     and only assign ranges to non-system users.

64. By Stéphane Graber on 2014-05-02

releasing version 1:4.1.5.1-1.1ubuntu1

63. By Stéphane Graber on 2014-05-02

Merge from Debian unstable

=== modified file 'debian/changelog'
--- debian/changelog	2014-02-17 00:33:53 +0000
+++ debian/changelog	2014-08-31 02:23:26 +0000
@@ -1,3 +1,55 @@
+shadow (1:4.1.5.1-1.1ubuntu2) utopic; urgency=medium
+
+  * debian/patches/1010_extrausers.patch:
+    - Add support to passwd for libnss-extrausers by falling back to the
+      /var/lib/extrausers/ locations if it exists when updating
+      passwd or shadow.
+
+ -- Michael Terry <[e-mail]>  Fri, 18 Jul 2014 10:00:44 -0400
+
+shadow (1:4.1.5.1-1.1ubuntu1) utopic; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+     - debian/passwd.upstart: Add an upstrat job to clear locks on
+       [shadow-]passwd/group. (LP: #523896).
+     - Allow LXC devices (lxc/console, lxc/tty[1234]) that we'll start using
+       in LXC with Precise.
+     - debian/login.defs:
+       + Update documentation of USERGROUPS_ENAB: with pam_umask, the UPG
+         handling does not only apply to "former (pre-PAM) uses".
+       + Update documentation of UMASK: Explain that USERGROUPS_ENAB
+         will modify this default for UPGs. (Closes: #583971)
+     - debian/{source_shadow.py,rules}: Add apport hook
+     - debian/patches/495_stdout-encrypted-password: chpasswd can report
+       password hashes on stdout (Debian bug 505640).
+     - Install upstart job by-hand, instead of using dh_installinit to avoid
+       dependency on upstart-job.
+     - Pass noupdate to pam_motd call for /run/motd.dynamic, to avoid running
+       /etc/update-motd.d/* scripts twice (LP: #1169558).
+     - debian/patches/496_su_kill_process_group: Kill the child process group,
+       rather than just the immediate child; this is needed now that su no
+       longer starts a controlling terminal when not running an interactive
+       shell (closes: #713979).
+     - Add uidmap package based on upstream patches that introduce
+       newuidmap/newgidmap as well as /etc/subuid and /etc/subgid. Additional
+       updates on those to widen the default allocation to 65536 uids and gids
+       and only assign ranges to non-system users.
+
+ -- Stéphane Graber <[e-mail]>  Fri, 02 May 2014 15:17:15 -0400
+
+shadow (1:4.1.5.1-1.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+
+  [ Eric Dorland ]
+  * Switch to automake1.11. (Closes: #724434)
+
+  [ Samuel Thibault ]
+  * Enable the login package on hurd-any, but without /bin/login, still provided
+    by the hurd package. Closes: #737805.
+
+ -- Samuel Thibault <[e-mail]>  Sun, 16 Mar 2014 20:58:24 +0100
+
 shadow (1:4.1.5.1-1ubuntu9) trusty; urgency=medium
 
   * Set our subuid and subgid range to 65536 uids by default.

=== modified file 'debian/control'
--- debian/control	2013-06-28 11:31:51 +0000
+++ debian/control	2014-08-31 02:23:26 +0000
@@ -5,7 +5,7 @@
 XSBC-Original-Maintainer: Shadow package maintainers <[e-mail]>
 Standards-Version: 3.9.3
 Uploaders: Christian Perrier <[e-mail]>, Nicolas FRANCOIS (Nekral) <[e-mail]>
-Build-Depends: autoconf, automake1.9, libtool, gettext, libpam0g-dev, debhelper (>= 6.0.7~), quilt, dpkg-dev (>= 1.13.5), xsltproc, docbook-xsl, docbook-xml, libxml2-utils, cdbs, libselinux1-dev [linux-any], libsemanage1-dev [linux-any], gnome-doc-utils (>= 0.4.3)
+Build-Depends: autoconf, automake1.11, libtool, gettext, libpam0g-dev, debhelper (>= 6.0.7~), quilt, dpkg-dev (>= 1.13.5), xsltproc, docbook-xsl, docbook-xml, libxml2-utils, cdbs, libselinux1-dev [linux-any], libsemanage1-dev [linux-any], gnome-doc-utils (>= 0.4.3)
 Vcs-Svn: svn://svn.debian.org/svn/pkg-shadow/debian/trunk
 Vcs-Browser: http://svn.debian.org/viewsvn/pkg-shadow/debian/trunk
 Homepage: http://pkg-shadow.alioth.debian.org/
@@ -25,7 +25,8 @@
 Architecture: any
 Pre-Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-runtime, libpam-modules
 Conflicts: gnunet (<< 0.7.0c-2), amavisd-new (<<2.3.3-8), python-4suite (<< 0.99cvs20060405-1), backupninja (<< 0.9.3-5), echolot (<< 2.1.8-4)
-Replaces: manpages-de (<< 0.5-3), manpages-tr (<<1.0.5), manpages-zh (<<1.5.1-1)
+Breaks: coreutils (<< 8.21-1.1~) [hurd-any], passwd (<< 1:4.1.5.1-1.1~) [hurd-any], hurd (<< 1:0.5.git20140206~) [hurd-any]
+Replaces: manpages-de (<< 0.5-3), manpages-tr (<<1.0.5), manpages-zh (<<1.5.1-1), coreutils (<< 8.21-1.1~) [hurd-any], passwd (<< 1:4.1.5.1-1.1~) [hurd-any], hurd (<< 1:0.5.git20140206~) [hurd-any]
 Essential: yes
 Description: system login tools
  These tools are required to be able to login and use your system. The

=== added file 'debian/patches/1010_extrausers.patch'
--- debian/patches/1010_extrausers.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/1010_extrausers.patch	2014-08-31 02:23:26 +0000
@@ -0,0 +1,176 @@
+Description: Add support to passwd for updating libnss-extrausers locations
+Author: Michael Terry <[e-mail]>
+
+Index: shadow-4.1.5.1/lib/defines.h
+===================================================================
+--- shadow-4.1.5.1.orig/lib/defines.h
++++ shadow-4.1.5.1/lib/defines.h
+@@ -316,6 +316,14 @@ char *strchr (), *strrchr (), *strtok ()
+ #endif
+ #endif
+ 
++#ifndef EXTRAUSERS_PASSWD_FILE
++#define EXTRAUSERS_PASSWD_FILE "/var/lib/extrausers/passwd"
++#endif
++
++#ifndef EXTRAUSERS_SHADOW_FILE
++#define EXTRAUSERS_SHADOW_FILE "/var/lib/extrausers/shadow"
++#endif
++
+ #ifndef NULL
+ #define NULL ((void *) 0)
+ #endif
+Index: shadow-4.1.5.1/src/passwd.c
+===================================================================
+--- shadow-4.1.5.1.orig/src/passwd.c
++++ shadow-4.1.5.1/src/passwd.c
+@@ -544,8 +544,15 @@ static void update_noshadow (void)
+ {
+ 	const struct passwd *pw;
+ 	struct passwd *npw;
++	bool try_extrausers = strcmp (pw_dbname (), EXTRAUSERS_PASSWD_FILE) != 0 &&
++	                      access (EXTRAUSERS_PASSWD_FILE, F_OK) == 0;
+ 
+ 	if (pw_lock () == 0) {
++		if (try_extrausers) {
++			pw_setdbname (EXTRAUSERS_PASSWD_FILE);
++			update_noshadow ();
++			return;
++		}
+ 		(void) fprintf (stderr,
+ 		                _("%s: cannot lock %s; try again later.\n"),
+ 		                Prog, pw_dbname ());
+@@ -553,6 +560,20 @@ static void update_noshadow (void)
+ 	}
+ 	pw_locked = true;
+ 	if (pw_open (O_RDWR) == 0) {
++		if (try_extrausers) {
++			if (pw_unlock () == 0) {
++				(void) fprintf (stderr,
++				                _("%s: failed to unlock %s\n"),
++				                Prog, pw_dbname ());
++				SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ()));
++				/* continue */
++			}
++			pw_locked = false;
++
++			pw_setdbname (EXTRAUSERS_PASSWD_FILE);
++			update_noshadow ();
++			return;
++		}
+ 		(void) fprintf (stderr,
+ 		                _("%s: cannot open %s\n"),
+ 		                Prog, pw_dbname ());
+@@ -561,6 +582,21 @@ static void update_noshadow (void)
+ 	}
+ 	pw = pw_locate (name);
+ 	if (NULL == pw) {
++		if (try_extrausers) {
++			(void) pw_close ();
++			if (pw_unlock () == 0) {
++				(void) fprintf (stderr,
++				                _("%s: failed to unlock %s\n"),
++				                Prog, pw_dbname ());
++				SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ()));
++				/* continue */
++			}
++			pw_locked = false;
++
++			pw_setdbname (EXTRAUSERS_PASSWD_FILE);
++			update_noshadow ();
++			return;
++		}
+ 		(void) fprintf (stderr,
+ 		                _("%s: user '%s' does not exist in %s\n"),
+ 		                Prog, name, pw_dbname ());
+@@ -598,8 +634,15 @@ static void update_shadow (void)
+ {
+ 	const struct spwd *sp;
+ 	struct spwd *nsp;
++	bool try_extrausers = strcmp (spw_dbname (), EXTRAUSERS_SHADOW_FILE) != 0 &&
++	                      access (EXTRAUSERS_SHADOW_FILE, F_OK) == 0;
+ 
+ 	if (spw_lock () == 0) {
++		if (try_extrausers) {
++			spw_setdbname (EXTRAUSERS_SHADOW_FILE);
++			update_shadow ();
++			return;
++		}
+ 		(void) fprintf (stderr,
+ 		                _("%s: cannot lock %s; try again later.\n"),
+ 		                Prog, spw_dbname ());
+@@ -607,6 +650,20 @@ static void update_shadow (void)
+ 	}
+ 	spw_locked = true;
+ 	if (spw_open (O_RDWR) == 0) {
++		if (try_extrausers) {
++			if (spw_unlock () == 0) {
++				(void) fprintf (stderr,
++						        _("%s: failed to unlock %s\n"),
++						        Prog, spw_dbname ());
++				SYSLOG ((LOG_ERR, "failed to unlock %s", spw_dbname ()));
++				/* continue */
++			}
++			spw_locked = false;
++
++			spw_setdbname (EXTRAUSERS_SHADOW_FILE);
++			update_shadow ();
++			return;
++		}
+ 		(void) fprintf (stderr,
+ 		                _("%s: cannot open %s\n"),
+ 		                Prog, spw_dbname ());
+@@ -617,7 +674,9 @@ static void update_shadow (void)
+ 	if (NULL == sp) {
+ 		/* Try to update the password in /etc/passwd instead. */
+ 		(void) spw_close ();
+-		update_noshadow ();
++		if (!try_extrausers) {
++			update_noshadow ();
++		}
+ 		if (spw_unlock () == 0) {
+ 			(void) fprintf (stderr,
+ 			                _("%s: failed to unlock %s\n"),
+@@ -626,6 +685,10 @@ static void update_shadow (void)
+ 			/* continue */
+ 		}
+ 		spw_locked = false;
++		if (try_extrausers) {
++			spw_setdbname (EXTRAUSERS_SHADOW_FILE);
++			update_shadow ();
++		}
+ 		return;
+ 	}
+ 	nsp = __spw_dup (sp);
+Index: shadow-4.1.5.1/lib/commonio.c
+===================================================================
+--- shadow-4.1.5.1.orig/lib/commonio.c
++++ shadow-4.1.5.1/lib/commonio.c
+@@ -401,6 +401,7 @@ int commonio_lock_nowait (struct commoni
+ int commonio_lock (struct commonio_db *db)
+ {
+ #ifdef HAVE_LCKPWDF
++  if (strncmp(db->filename, "/etc/", 5) == 0) {
+ 	/*
+ 	 * only if the system libc has a real lckpwdf() - the one from
+ 	 * lockpw.c calls us and would cause infinite recursion!
+@@ -428,7 +429,9 @@ int commonio_lock (struct commonio_db *d
+ 
+ 	ulckpwdf ();
+ 	return 0;		/* failure */
+-#else				/* !HAVE_LCKPWDF */
++  } else /* strncmp(db->filename, "/etc/", 5) == 0 */
++#endif				/* HAVE_LCKPWDF */
++  {
+ 	int i;
+ 
+ 	/*
+@@ -456,7 +459,7 @@ int commonio_lock (struct commonio_db *d
+ 		}
+ 	}
+ 	return 0;		/* failure */
+-#endif				/* !HAVE_LCKPWDF */
++  }
+ }
+ 
+ static void dec_lock_count (void)

=== modified file 'debian/patches/series'
--- debian/patches/series	2014-02-17 00:33:42 +0000
+++ debian/patches/series	2014-08-31 02:23:26 +0000
@@ -35,3 +35,4 @@
 userns/16_add-argument-sanity-checking.patch
 496_su_kill_process_group
 1000_configure_userns
+1010_extrausers.patch

=== modified file 'debian/rules'
--- debian/rules	2014-01-12 17:28:26 +0000
+++ debian/rules	2014-08-31 02:23:26 +0000
@@ -3,11 +3,6 @@
 
 DEB_HOST_ARCH_OS := $(shell dpkg-architecture -qDEB_HOST_ARCH_OS)
 
-ifeq ($(DEB_HOST_ARCH_OS),hurd)
-# Do not build login on The Hurd
-override DEB_ARCH_PACKAGES=passwd
-endif
-
 # Enable PIE, BINDNOW, and possible future flags.
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 
@@ -21,9 +16,9 @@
 
 include /usr/share/cdbs/1/class/autotools.mk
 # Automatically update autoconf, etc.
-DEB_AUTO_UPDATE_ACLOCAL  = 1.9
-DEB_AUTO_UPDATE_AUTOCONF = 1.9
-DEB_AUTO_UPDATE_AUTOMAKE = 1.9
+DEB_AUTO_UPDATE_ACLOCAL  = 1.11
+DEB_AUTO_UPDATE_AUTOCONF = 1.11
+DEB_AUTO_UPDATE_AUTOMAKE = 1.11
 DEB_AUTO_UPDATE_LIBTOOL = pre
 
 # Adds extra options when calling the configure script:
@@ -37,6 +32,10 @@
 
 # Add extras to the install process:
 binary-install/login::
+ifeq ($(DEB_HOST_ARCH_OS),hurd)
+	# /bin/login is provided by the hurd package.
+	rm -f debian/login/bin/login
+endif
 	dh_installpam -p login
 	dh_installpam -p login --name=su
 	install -c -m 444 debian/login.defs debian/login/etc/login.defs
@@ -57,11 +56,6 @@
 	dh_installpam -p passwd --name=chsh
 	dh_installpam -p passwd --name=chpasswd
 	dh_installpam -p passwd --name=newusers
-ifeq ($(DEB_HOST_ARCH_OS),hurd)
-# login is not built on The Hurd, but some utilities of passwd depends on
-# /etc/login.defs.
-	install -c -m 444 debian/login.defs debian/passwd/etc/login.defs
-endif
 	install -c -m 644 debian/useradd.default debian/passwd/etc/default/useradd
 
 	## Ubuntu