summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeLines
* lib/date_to_str.c: strftime(3) leaves the buffer undefined on failuredate2strAlejandro Colomar2023-11-16-27/+8
| | | | | | | | | | | | | | | | | | | | | strftime(3) makes no guarantees about the contents of the buffer if the formatted string wouldn't fit in the buffer. It simply returns 0, and it's the programmer's responsibility to do the right thing after that. Let's write the string "future" if there's an error, similar to what we do with gmtime(3)'s errors. Also, `buf[size - 1] = '\0';` didn't make sense. If the copy fits, strftime(3) guarantees to terminate with NUL. If it doesn't, the entire contents of buf are undefined, so adding a NUL at the end of the buffer would be dangerous: the string could contain anything, such as "gimme root access now". Remove that, now that we set the string to "future", as with gmtime(3) errors. This setting to '\0' comes from the times when we used strncpy(3) in the implementation, and should have been removed when I changed it to use strlcpy(3); however, I didn't check we didn't need it anymore. Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/date_to_str.c, configure.ac: Replace calls to strlcpy(3) by strtcpy(3)Alejandro Colomar2023-11-16-3/+3
| | | | Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/date_to_str.c: Add missing include <config.h>Alejandro Colomar2023-11-16-0/+2
| | | | Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/Makefile.am: Add missing source fileAlejandro Colomar2023-11-16-0/+1
| | | | Signed-off-by: Alejandro Colomar <alx@kernel.org>
* src/, lib/, tests/: Rename files defining strtcpy()Alejandro Colomar2023-11-16-20/+20
| | | | Signed-off-by: Alejandro Colomar <alx@kernel.org>
* src/, lib/, tests/: Rename STRLCPY() to STRTCPY()Alejandro Colomar2023-11-16-38/+38
| | | | | | It is a wrapper around STRTCPY(), so use a proper name. Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/strlcpy.[ch]: Implement strtcpy(3) to replace strlcpy_()Alejandro Colomar2023-11-16-11/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's been a very long and interesting discussion in linux-man@ and libc-alpha@, where we've discussed all the string-copying functions, their pros and cons, when should each be used and avoided, etc. Paul Eggert pointed out an important problem of strlcpy(3): it is vulnerable to DoS attacks if an attacker controls the length of the source string. And even if it doesn't control it, the function is dead slow (because its API forces it to calculate strlen(src)). We've agreed that the general solution for a truncating string-copying function is to write a wrapper over strnlen(3)+memcpy(3), which is limited to strnlen(src, sizeof(dst)). This is not vulnerable to DoS, and is very fast for all buffer sizes. string_copying(7) has been updated to reflect this, and provides a reference implementation for this wrapper function. This strtcpy(3) (t for truncation) wrapper happens to have the same API that our strlcpy_() function had, so replace it with the better implementation. We don't need to update callers nor tests, since the API is the same. A future commit will rename STRLCPY() to STRTCPY(), and replace remaining calls to strlcpy(3) by calls to this strtcpy(3). Link: <https://lore.kernel.org/linux-man/ZU4SDh-Se5gjPny5@debian/T/#mfb5a3fdeb35487dec6f8d9e3d8548bd0d92c4975/> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/strlcpy.[ch]: Fix return typeAlejandro Colomar2023-11-13-3/+7
| | | | | | To return an error code, we need ssize_t. Signed-off-by: Alejandro Colomar <alx@kernel.org>
* tests/unit/test_strlcpy.c: Test strlcpy_() and STRLCPY()Alejandro Colomar2023-11-13-0/+83
| | | | | | | | This test fails now, due to a bug: the return type of strlcpy_() is size_t, but it should be ssize_t. The next commit will pass the test, by fixing the bug. Signed-off-by: Alejandro Colomar <alx@kernel.org>
* Define SUBUID_FILE/SUBGID_FILEJoakim Tjernlund2023-11-13-5/+13
| | | | | | These where hard coded, make them definable like SHADOW_FILE Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
* CI: fix Fedora 39 buildIker Pedrosa2023-11-13-1/+1
| | | | | | | | | | | | | libbsd is unwanted in Fedora and RHEL, and the recently released Fedora 39 doesn't contain this dependency in the base image. shadow removed libbsd from its dependencies for Fedora 39, so let's build without it to avoid compilation errors. Resolves: https://github.com/shadow-maint/shadow/issues/839 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com> Reviewed-by: Alejandro Colomar <alx@kernel.org>
* lib/utmp.c: Don't check for NULL before free(3)Alejandro Colomar2023-10-29-4/+2
| | | | | | | free(NULL) is valid; there's no need to check for NULL. Simplify. Fixes: 5178f8c5afb6 ("utmp: call prepare_utmp() even if utent is NULL") Signed-off-by: Alejandro Colomar <alx@kernel.org>
* Add keys/ directory with public keys for maintainersSerge Hallyn2023-10-26-0/+2050
| | | | | | These can be used to verify releases. Signed-off-by: Serge Hallyn <serge@hallyn.com>
* man: document --prefix option in chage, chpasswd and passwdMichael Vetter2023-10-26-0/+45
| | | | | | | | Support for `--prefix` was added in https://github.com/shadow-maint/shadow/pull/714 and is available since shadow 4.14.0. Close https://github.com/shadow-maint/shadow/issues/822
* libmisc/copydir: do not forget errors from directory copyChristian Göttsche2023-10-21-46/+47
| | | | | | | | copydir.c:429:4: warning: Value stored to 'err' is never read [deadcode.DeadStores] Also reduce indentation by bailing out early. (cherry picked from commit d89f2fb06d1b81b56299f9d0bfe7a927a2282f19)
* Improve the login.defs unknown item error messageSerge Hallyn2023-10-20-7/+8
| | | | | | | | | | | | | | Closes #746 Only print the 'unknown item' message to syslog if we are actually parsing a login.defs. Prefix it with "shadow:" to make it clear in syslog where it came from. Also add the source filename to the console message. I'm not quite clear on the econf API, so not sure whether in that path we will end up actually having the path, or printing ''. Signed-off-by: Serge Hallyn <serge@hallyn.com>
* autogen.sh: Prepare CFLAGS before ./configureAlejandro Colomar2023-10-20-1/+5
| | | | | Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/: Add missing #include <config.h>Alejandro Colomar2023-10-20-0/+4
| | | | | Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* autogen.sh: CFLAGS: Add -Werror=implicit-function-declarationAlejandro Colomar2023-10-20-1/+1
| | | | | | | | | | | This is not just a style issue. This should be a hard error, and never compile. ISO C89 already had this feature as deprecated. ISO C99 removed this deprecated feature, for good reasons. If we compile ignoring this warning, shadow is not going to behave well. Cc: Sam James <sam@gentoo.org> Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/, src/: Use xasprintf() instead of its patternAlejandro Colomar2023-10-20-75/+50
| | | | | Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/, src/: Use asprintf(3) instead of strlen(3)+malloc(3)+snprintf(3)Alejandro Colomar2023-10-20-291/+191
| | | | | | | | | | | | | | | | | asprintf(3) is non-standard, but is provided by GNU, the BSDs, and musl. That makes it portable enough for us to use. This function is much simpler than the burdensome code for allocating the right size. Being simpler, it's thus safer. I took the opportunity to fix the style to my preferred one in the definitions of variables used in these calls, and also in the calls to free(3) with these pointers. That isn't gratuituous, but has a reason: it makes those appear in the diff for this patch, which helps review it. Oh, well, I had an excuse :) Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/copydir.c: Use goto to reduce a conditional branchAlejandro Colomar2023-10-20-17/+18
| | | | | Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* tests/unit/test_xasprintf.c: Test x[v]asprintf()Alejandro Colomar2023-10-20-1/+132
| | | | | | | | Link: <https://github.com/shadow-maint/shadow/pull/816> Suggested-by: Iker Pedrosa <ipedrosa@redhat.com> Acked-by: Andreas Schneider <https://github.com/cryptomilk> Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/sprintf.[ch]: Add x[v]asprintf()Alejandro Colomar2023-10-20-0/+76
| | | | | | | | As other x...() wrappers around functions that allocate, these wrappers are like [v]asprintf(3), but exit on failure. Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/copydir.c: Invert conditional to reduce nestingAlejandro Colomar2023-10-20-41/+40
| | | | | Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* Fix badname option to be singular just like useradd.Dimitri John Ledkov2023-10-16-2/+3
| | | | | | | | | Badnames still accepted, note that previously usage already stated singular form, whilst manpage and real one was plural only. Fixes: 45d6746219 ("src: correct "badname" option") Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
* Fix mixed-whitespaceDimitri John Ledkov2023-10-16-2/+2
| | | | Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
* Remove TODOIker Pedrosa2023-10-04-128/+1
| | | | | | | Sad to remove this file, but things are going on and it doesn't seem to be up to date. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* Remove shadow.spec.inIker Pedrosa2023-10-04-95/+1
| | | | | | | The file isn't up to date with the latest development, the last change was made 15 years ago, so I'm removing it. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* Remove .travis.ymlIker Pedrosa2023-10-04-52/+0
| | | | | | It isn't used anywhere so let's remove it. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* doc: remove WISHLISTIker Pedrosa2023-10-04-39/+1
| | | | | | | Another file that I remove with sadness. We were unable to complete the first item but we are working hard on it. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* doc: remove README.platformsIker Pedrosa2023-10-04-35/+1
| | | | | | | | I remove this file with sadness, as it contains data from old times. Unfortunately, this data is no longer relevant. The source code management tool will keep it in memory. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* doc: remove cracklib26.diffIker Pedrosa2023-10-04-341/+1
| | | | | | | Keeping a patch for a file no longer maintained is a bad idea, so I'm removing it. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* doc: remove console.c.spec.txtIker Pedrosa2023-10-04-37/+1
| | | | | | | | I guess we are keeping this for historical purposes more than anything else. If so, anybody can check the git history to recover the specification. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* contrib: remove udbachk.tgzIker Pedrosa2023-10-04-2/+1
| | | | | | | | Having source code in a compressed file doesn't seem like a good idea. I checked several distributions and they don't distribute this binary, so let's remove it. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* contrib: remove shadow-anonftp.patchIker Pedrosa2023-10-04-148/+1
| | | | | | | The patch is never applied upstream. If I were to take a gamble, I would even say that it throws an error when trying to patch. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* contrib: remove groupmems.sharIker Pedrosa2023-10-04-467/+1
| | | | | | | | Not sure what this file is exactly, but there's already a groupmems.c that should generate the binary responsible for managing the members of a user's primary group. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* contrib: remove atudelIker Pedrosa2023-10-04-62/+1
| | | | | | | AFAIK, it isn't included in any distribution and it isn't used internally in the project, so let's remove it. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* CI: remove .builds folderIker Pedrosa2023-10-04-123/+0
| | | | | | | We stopped using the CI relying on this folder and moved to Github's, so I'm removing these files. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* useradd: Set proper SELinux labels for def_usrtemplateJohannes Segitz2023-10-03-1/+1
| | | | | | Fixes: 74c17c716 ("Add support for skeleton files from /usr/etc/skel") Signed-off-by: Johannes Segitz <jsegitz@suse.com>
* doc: add unit testsIker Pedrosa2023-09-29-1/+17
| | | | | | | Brief description of the unit testing framework and how to create test cases with it. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* CI: build and run unit testsIker Pedrosa2023-09-29-5/+9
| | | | | | Run `make check` after the project is built in every runner. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* tests: happy path for active_sessions_count()Iker Pedrosa2023-09-29-1/+108
| | | | | | | | | | Simple test to check the recently implemented logind functionality. It also contains the changes to the build infrastructure, and the gitignore. Resolves: https://github.com/shadow-maint/shadow/issues/790 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* configure: add cmocka for unit testsIker Pedrosa2023-09-29-0/+5
| | | | | | Prepare the ground for unit tests. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* faillog: check for overflowsChristian Göttsche2023-09-29-87/+53
| | | | | | | Check for arithmetic overflows when computing offsets to avoid file corruptions for huge UIDs. Refactor the file lookup into a separate function.
* utmp: call prepare_utmp() even if utent is NULLIker Pedrosa2023-09-15-6/+5
| | | | | | | | | | update_utmp() should also return 0 when success. Fixes: 1f368e1c1838de9d476a36897d7c53394569de08 ("utmp: update `update_utmp()") Resolves: https://github.com/shadow-maint/shadow/issues/805 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* groupadd: Improve error message when opening group file fails.Vasil Velichkov2023-09-04-5/+5
| | | | | Both gr_open and sgr_open are using commonio_open function and when there is a failure this function sets errno accordingly.
* lib/mempcpy.[ch]: Remove our definition of mempcpy(3)Alejandro Colomar2023-09-04-60/+1
| | | | | | | It is provided by glibc, musl, and FreeBSD. Reported-by: Sam James <sam@gentoo.org> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/pwauth.c: Replace getpass(3) by agetpass()Alejandro Colomar2023-09-04-6/+10
| | | | | Closes: <https://github.com/shadow-maint/shadow/issues/797> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* lib/agetpass.h: Move prototypes to dedicated headerAlejandro Colomar2023-09-04-6/+29
| | | | Signed-off-by: Alejandro Colomar <alx@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-02 00:01:03 +0000