deleted file mode 100644

@@ -1,74 +0,0 @@

-diff -ruN shadow-4.2.1/libmisc/idmapping.c shadow-4.2.1.new/libmisc/idmapping.c

-+++ shadow-4.2.1.new/libmisc/idmapping.c	2016-07-19 10:55:49.339097323 +0200

-@@ -77,6 +77,11 @@

- 			return NULL;

- 		if (!getulong(argv[argidx + 2], &mapping->count))

- 			return NULL;

-+

-+		if (ULONG_MAX - mapping->upper <= mapping->count || ULONG_MAX - mapping->lower <= mapping->count) {

-+			fprintf(stderr, _( "%s: subuid overflow detected.\n"), Prog);

-+			exit(EXIT_FAILURE);

-+		}

- 	}

- 	return mappings;

- }

-diff -ruN shadow-4.2.1/libmisc/myname.c shadow-4.2.1.new/libmisc/myname.c

-+++ shadow-4.2.1.new/libmisc/myname.c	2016-07-19 10:14:49.298852058 +0200

-@@ -44,25 +44,13 @@

- /*@null@*/ /*@only@*/struct passwd *get_my_pwent (void)

- {

- 	struct passwd *pw;

--	const char *cp = getlogin ();

- 	uid_t ruid = getuid ();

- 

--	/*

--	 * Try getlogin() first - if it fails or returns a non-existent

--	 * username, or a username which doesn't match the real UID, fall

--	 * back to getpwuid(getuid()).  This should work reasonably with

--	 * usernames longer than the utmp limit (8 characters), as well as

--	 * shared UIDs - but not both at the same time...

-+	/* Do not use getlogin(). Its not suitable for suid binaries.

- 	 *

- 	 * XXX - when running from su, will return the current user (not

- 	 * the original user, like getlogin() does).  Does this matter?

- 	 */

--	if ((NULL != cp) && ('\0' != *cp)) {

--		pw = xgetpwnam (cp);

--		if ((NULL != pw) && (pw->pw_uid == ruid)) {

--			return pw;

--		}

--	}

- 

- 	return xgetpwuid (ruid);

- }

-

-diff -ruN shadow-4.2.1/lib/getulong.c shadow-4.2.1.new/lib/getulong.c

-+++ shadow-4.2.1.new/lib/getulong.c	2016-07-19 10:36:14.476785123 +0200

-@@ -44,22 +44,19 @@

-  */

- int getulong (const char *numstr, /*@out@*/unsigned long int *result)

- {

--	long long int val;

-+	unsigned long int val;

- 	char *endptr;

- 

- 	errno = 0;

--	val = strtoll (numstr, &endptr, 0);

-+	val = strtoul (numstr, &endptr, 0);

- 	if (    ('\0' == *numstr)

- 	     || ('\0' != *endptr)

- 	     || (ERANGE == errno)

--	     /*@+ignoresigns@*/

--	     || (val != (unsigned long int)val)

--	     /*@=ignoresigns@*/

- 	   ) {

- 		return 0;

- 	}

- 

--	*result = (unsigned long int)val;

-+	*result = val;

- 	return 1;

- }

deleted file mode 100644

@@ -1,39 +0,0 @@

-From 954e3d2e7113e9ac06632aee3c69b8d818cc8952 Mon Sep 17 00:00:00 2001

-From: Tomas Mraz <tmraz@fedoraproject.org>

-Date: Fri, 31 Mar 2017 16:25:06 +0200

-Subject: [PATCH] Fix buffer overflow if NULL line is present in db.

-

-If ptr->line == NULL for an entry, the first cycle will exit,

-but the second one will happily write past entries buffer.

-We actually do not want to exit the first cycle prematurely

-on ptr->line == NULL.

-Signed-off-by: Tomas Mraz <tmraz@fedoraproject.org>

- lib/commonio.c | 8 ++++----

- 1 file changed, 4 insertions(+), 4 deletions(-)

-

-diff --git a/lib/commonio.c b/lib/commonio.c

-index b10da06a..31edbaaf 100644

-+++ b/lib/commonio.c

-@@ -751,16 +751,16 @@ commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *))

- 	for (ptr = db->head;

- 	        (NULL != ptr)

- #if KEEP_NIS_AT_END

--	     && (NULL != ptr->line)

--	     && (   ('+' != ptr->line[0])

--	         && ('-' != ptr->line[0]))

-+	     && ((NULL == ptr->line)

-+	         || (('+' != ptr->line[0])

-+	             && ('-' != ptr->line[0])))

- #endif

- 	     ;

- 	     ptr = ptr->next) {

- 		n++;

- 	}

- #if KEEP_NIS_AT_END

--	if ((NULL != ptr) && (NULL != ptr->line)) {

-+	if (NULL != ptr) {

- 		nis = ptr;

- 	}

- #endif

deleted file mode 100644

@@ -1,135 +0,0 @@

-+++ b/src/newgidmap.c	2018-07-31 06:03:36.578802898 +0530

-@@ -46,32 +46,36 @@

-  */

- const char *Prog;

- 

--static bool verify_range(struct passwd *pw, struct map_range *range)

-+static bool verify_range(struct passwd *pw, struct map_range *range, bool *allow_setgroups)

- {

- 	/* An empty range is invalid */

- 	if (range->count == 0)

- 		return false;

- 

--	/* Test /etc/subgid */

--	if (have_sub_gids(pw->pw_name, range->lower, range->count))

-+	/* Test /etc/subgid. If the mapping is valid then we allow setgroups. */

-+	if (have_sub_gids(pw->pw_name, range->lower, range->count)) {

-+		*allow_setgroups = true;

- 		return true;

-+	}

- 

- 	/* Allow a process to map it's own gid */

--	if ((range->count == 1) && (pw->pw_gid == range->lower))

-+	if ((range->count == 1) && (pw->pw_gid == range->lower)) {

-+		/* noop -- if setgroups is enabled already we won't disable it. */

- 		return true;

-+	}

- 

- 	return false;

- }

- 

- static void verify_ranges(struct passwd *pw, int ranges,

--	struct map_range *mappings)

-+	struct map_range *mappings, bool *allow_setgroups)

- {

- 	struct map_range *mapping;

- 	int idx;

- 

- 	mapping = mappings;

- 	for (idx = 0; idx < ranges; idx++, mapping++) {

--		if (!verify_range(pw, mapping)) {

-+		if (!verify_range(pw, mapping, allow_setgroups)) {

- 			fprintf(stderr, _( "%s: gid range [%lu-%lu) -> [%lu-%lu) not allowed\n"),

- 				Prog,

- 				mapping->upper,

-@@ -83,6 +87,70 @@ static void verify_ranges(struct passwd

- 	}

- }

- 

-+void write_setgroups(int proc_dir_fd, bool allow_setgroups)

-+{

-+	int setgroups_fd;

-+	char *policy, policy_buffer[4096];

-+

-+	/*

-+	 * Default is "deny", and any "allow" will out-rank a "deny". We don't

-+	 * forcefully write an "allow" here because the process we are writing

-+	 * mappings for may have already set themselves to "deny" (and "allow"

-+	 * is the default anyway). So allow_setgroups == true is a noop.

-+	 */

-+	policy = "deny\n";

-+	if (allow_setgroups)

-+		return;

-+

-+	setgroups_fd = openat(proc_dir_fd, "setgroups", O_RDWR|O_CLOEXEC);

-+	if (setgroups_fd < 0) {

-+		/*

-+		 * If it's an ENOENT then we are on too old a kernel for the setgroups

-+		 * code to exist. Emit a warning and bail on this.

-+		 */

-+		if (ENOENT == errno) {

-+			fprintf(stderr, _("%s: kernel doesn't support setgroups restrictions\n"), Prog);

-+			goto out;

-+		}

-+		fprintf(stderr, _("%s: couldn't open process setgroups: %s\n"),

-+			Prog,

-+			strerror(errno));

-+		exit(EXIT_FAILURE);

-+	}

-+

-+	/*

-+	 * Check whether the policy is already what we want. /proc/self/setgroups

-+	 * is write-once, so attempting to write after it's already written to will

-+	 * fail.

-+	 */

-+	if (read(setgroups_fd, policy_buffer, sizeof(policy_buffer)) < 0) {

-+		fprintf(stderr, _("%s: failed to read setgroups: %s\n"),

-+			Prog,

-+			strerror(errno));

-+		exit(EXIT_FAILURE);

-+	}

-+	if (!strncmp(policy_buffer, policy, strlen(policy)))

-+		goto out;

-+

-+	/* Write the policy. */

-+	if (lseek(setgroups_fd, 0, SEEK_SET) < 0) {

-+		fprintf(stderr, _("%s: failed to seek setgroups: %s\n"),

-+			Prog,

-+			strerror(errno));

-+		exit(EXIT_FAILURE);

-+	}

-+	if (dprintf(setgroups_fd, "%s", policy) < 0) {

-+		fprintf(stderr, _("%s: failed to setgroups %s policy: %s\n"),

-+			Prog,

-+			policy,

-+			strerror(errno));

-+		exit(EXIT_FAILURE);

-+	}

-+

-+out:

-+	close(setgroups_fd);

-+}

-+

- static void usage(void)

- {

- 	fprintf(stderr, _("usage: %s <pid> <gid> <lowergid> <count> [ <gid> <lowergid> <count> ] ... \n"), Prog);

-@@ -103,6 +171,7 @@ int main(int argc, char **argv)

- 	struct stat st;

- 	struct passwd *pw;

- 	int written;

-+	bool allow_setgroups = false;

- 

- 	Prog = Basename (argv[0]);

- 

-@@ -174,8 +243,9 @@ int main(int argc, char **argv)

- 	if (!mappings)

- 		usage();

- 

--	verify_ranges(pw, ranges, mappings);

-+	verify_ranges(pw, ranges, mappings, &allow_setgroups);

- 

-+	write_setgroups(proc_dir_fd, allow_setgroups);

- 	write_mapping(proc_dir_fd, ranges, mappings, "gid_map");

- 	sub_gid_close();

- 

@@ -1,14 +1,14 @@

 Summary:	Programs for handling passwords in a secure way

 Name:		shadow

-Version:	4.2.1

-Release:	13%{?dist}

-URL:		http://pkg-shadow.alioth.debian.org/

+Version:	4.6

+Release:	1%{?dist}

+URL:		https://github.com/shadow-maint/

 License:	BSD

 Group:		Applications/System

 Vendor:		VMware, Inc.

 Distribution:	Photon

-Source0:	http://pkg-shadow.alioth.debian.org/releases/%{name}-%{version}.tar.xz

-%define sha1 shadow=0917cbadd4ce0c7c36670e5ecd37bbed92e6d82d

+Source0:	https://github.com/shadow-maint/shadow/releases/download/%{version}/%{name}-%{version}.tar.xz

+%define sha1 shadow=0b84eb1010fda5edca2a9d1733f9480200e02de6

 Source1:        chage

 Source2:        chpasswd

 Source3:        login

@@ -21,9 +21,6 @@ Source9:        system-auth

 Source10:       system-password

 Source11:       system-session

 Patch0: chkname-allowcase.patch

-Patch1: shadow-4.2.1-CVE-2016-6252-fix.patch

-Patch2: shadow-4.2.1-CVE-2017-12424.patch

-Patch3: shadow-4.2.1-CVE-2018-7169.patch

 BuildRequires: 	cracklib

 BuildRequires: 	cracklib-devel

 Requires:   	cracklib

@@ -37,9 +34,6 @@ in a secure way.

 %prep

 %setup -q -n %{name}-%{version}

 %patch0 -p1

-%patch1 -p1

-%patch2 -p1

-%patch3 -p1

 sed -i 's/groups$(EXEEXT) //' src/Makefile.in

 find man -name Makefile.in -exec sed -i 's/groups\.1 / /' {} \;

 sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD SHA512@' \

@@ -124,6 +118,8 @@ done

 %{_mandir}/*/*

 %config(noreplace) %{_sysconfdir}/pam.d/*

 %changelog

+*   Fri Jan 19 2019 Srinidhi Rao <srinidhir@vmware.com> 4.6-1

+-   Upgrading the version to 4.6.

 *   Mon Jul 30 2018 Tapas Kundu <tkundu@vmware.com> 4.2.1-13

 -   Added fix for CVE-2018-7169.

 *   Fri Apr 20 2018 Alexey Makhalov <amakhalov@vmware.com> 4.2.1-12