Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to stable-0.6 grimoire by Jeremy Blosser (c948aedf8359c94d10a4fbb068c88a0d2089a660)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Jeremy Blosser <scm AT mail.sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to stable-0.6 grimoire by Jeremy Blosser (c948aedf8359c94d10a4fbb068c88a0d2089a660)
  • Date: Wed, 7 Feb 2007 15:24:44 -0600

GIT changes to stable-0.6 grimoire by Jeremy Blosser
<jblosser-smgl AT firinn.org>:

security/shadow/CONFIGURE | 22
+++++++++-
security/shadow/DETAILS | 2
security/shadow/FINAL | 8 ++-
security/shadow/HISTORY | 22
+++++++++-
security/shadow/PRE_REMOVE | 9
+++-
security/shadow/REPAIR^acad95bdda57e3a157ee57a47035a0d5^PRE_REMOVE | 8 +++
6 files changed, 61 insertions(+), 10 deletions(-)

New commits:
commit c948aedf8359c94d10a4fbb068c88a0d2089a660
Author: Jeremy Blosser <jblosser-smgl AT firinn.org>
Commit: Jeremy Blosser <jblosser-smgl AT firinn.org>

shadow: Don't try to chk non-existant files.

commit 44352185225127bf27796dbfb1ce506d34ba3d5f
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Jeremy Blosser <jblosser-smgl AT firinn.org>

shadow: making the query about restoring shadows an extra one-timer, as
Jeremy suggested

commit 63c08b4f7eae33e2e74c435fd8081c9aa50378a6
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Jeremy Blosser <jblosser-smgl AT firinn.org>

shadow: fixing the unpleasant result of saying n to the account files
conversion but still having pwunconv in PRE_REMOVE

diff --git a/security/shadow/CONFIGURE b/security/shadow/CONFIGURE
index 6c97b30..b2b6f03 100755
--- a/security/shadow/CONFIGURE
+++ b/security/shadow/CONFIGURE
@@ -1,18 +1,36 @@
-config_query SHADOW_CONV "Attempt to convert/fix accounts (with installed
shadow utils)" n &&
-if [[ "$SHADOW_CONV" == y ]]; then
+# There's a bug introduced by the solution of bug 8834:
+# if you said "n" to $SHADOW_CONV, you ended up with the state pw/grpunconv
+# left on dispelling old shadow.
+# Introducing the temporary SHADOW_RECONV to support fixing that situation.
+
+if [[ "$SHADOW_CONV" == n ]] && [[ -z "$SHADOW_RECONV" ]]; then
+ message "Checking passwd for shadowness (there could have been an unwanted
run of pwunconv/grpunconv, see bug #8834)." &&
+ if ! grep -q '^root:x:' "$INSTALL_ROOT/etc/passwd"; then
+ message "${PROBLEM_COLOR}Your passwd file contains password hashes,
resuggesting conversion to shadow." &&
+ message "${MESSAGE_COLOR}You can still say n to the upcoming query but
make sure to run pwconv / grpconv yourself if you want existing passwords
shadowed." &&
+ config_query SHADOW_RECONV "One-time query: convert/fix accounts (with
installed shadow utils) this time" n
+ fi
+else
+ config_query SHADOW_CONV "Attempt to convert/fix accounts (with installed
shadow utils)" n
+fi &&
+if [[ "$SHADOW_CONV" == y ]] || [[ "$SHADOW_RECONV" == y ]]; then
message "OK, checking your user and group accounts" &&
+ if [ -f "$INSTALL_ROOT/etc/gshadow" ]; then
grpck -r "$INSTALL_ROOT/etc/group" "$INSTALL_ROOT/etc/gshadow" ||
{
message "there are problems with group... runinng grpck
interactively" &&
grpck "$INSTALL_ROOT/etc/group" "$INSTALL_ROOT/etc/gshadow"
}
+ fi
+ if [ -f "$INSTALL_ROOT/etc/shadow" ]; then
pwck -q -r "$INSTALL_ROOT/etc/passwd" "$INSTALL_ROOT/etc/shadow" ||
{
message "there are problems with passwd... runinng grpck
interactively" &&
grpck "$INSTALL_ROOT/etc/passwd" "$INSTALL_ROOT/etc/shadow"
}
+ fi
fi
# the tools give negative return even after successfully fixing stuff
true
diff --git a/security/shadow/DETAILS b/security/shadow/DETAILS
index 223eace..797de76 100755
--- a/security/shadow/DETAILS
+++ b/security/shadow/DETAILS
@@ -7,7 +7,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL
WEB_SITE=http://shadow.pld.org.pl/
ENTERED=20050303
PATCHLEVEL=3
- SECURITY_PATCH=1
+ SECURITY_PATCH=2
KEYWORDS="security password"
SHORT="Shadow password file utilities"

diff --git a/security/shadow/FINAL b/security/shadow/FINAL
index eca5bd2..87461c7 100755
--- a/security/shadow/FINAL
+++ b/security/shadow/FINAL
@@ -1,6 +1,8 @@
-if [ "$SHADOW_CONV" == y ]; then
+if [ "$SHADOW_CONV" == y ] || [ "$SHADOW_RECONV" == "y" ]; then
#Create or update necessary files for shadow
- message "running pwconv and grpconv" &&
+ message "${MESSAGE_COLOR}running pwconv and grpconv" &&
${INSTALL_ROOT}/usr/sbin/pwconv &&
${INSTALL_ROOT}/usr/sbin/grpconv
-fi
+fi &&
+# mark it off
+SHADOW_RECONV=x
diff --git a/security/shadow/HISTORY b/security/shadow/HISTORY
index 1e09e8e..4fd7db3 100644
--- a/security/shadow/HISTORY
+++ b/security/shadow/HISTORY
@@ -1,3 +1,21 @@
+2007-02-07 Jeremy Blosser <jblosser-smgl AT firinn.org>
+ * CONFIGURE: Also don't bother trying to check files that aren't there
+ and are going to fail. May not be the best fix but for now it
avoids
+ scary errors when we say we're trying to repair things.
+
+2007-02-07 Thomas Orgis <sobukus AT sourcemage.org>
+ * CONFIGURE,FINAL: integrated Jeremy's suggestion of making the
+ emergency query a one-timer
+ * DETAILS: patchlevel (security level is the same as before)
+
+2007-02-06 Thomas Orgis <sobukus AT sourcemage.org>
+ * CONFIGURE,PRE_REMOVE, REPAIR^...^PRE_REMOVE, FINAL: I made the
pwconv
+ optional, but there still was unconditional pwunconv in
+ PRE_REMOVE - now the mess had to be cleaned up: no pwunconv, ever!
+ (see bug 8834)
+ * DETAILS: SECURITY_PATCH++ as there can be a state of password hashes
+ in passwd files
+
2007-01-22 Thomas Orgis <sobukus AT sourcemage.org>
* CONFIGURE: default the answer to "n" by default, making the account
modification opt-in as it should be
@@ -9,8 +27,8 @@
2007-01-20 Thomas Orgis <sobukus AT sourcemage.org>
* pam.d/su: move that to coreutils as the su binary comes from
there now
- * DETAILS: a patchlevel can't hurt for having changed install
- footprint
+ * DETAILS: a patchlevel can't hurt for having changed install
+ footprint

2006-07-15 Flavien Bridault <vlaaad AT sourcemage.org>
* BUILD: do not install default /etc/pam.d/* files from the tarball
diff --git a/security/shadow/PRE_REMOVE b/security/shadow/PRE_REMOVE
index 58e91bd..580de53 100755
--- a/security/shadow/PRE_REMOVE
+++ b/security/shadow/PRE_REMOVE
@@ -1,3 +1,8 @@
+message "I will NOT put your passwords back into passwd/group!" &&
+message "You'd need to run pwunconv/grpunconv before dispel for having a
workable system without shadow."
+# do not do this unasked and on every upgrade cast
+# you normally never dispel shadow for good unless you are
+# curious to see what happens...
#Restore /etc/passwd when dispelling shadow
-${INSTALL_ROOT}/usr/sbin/pwunconv &&
-${INSTALL_ROOT}/usr/sbin/grpunconv
+#${INSTALL_ROOT}/usr/sbin/pwunconv &&
+#${INSTALL_ROOT}/usr/sbin/grpunconv
diff --git
a/security/shadow/REPAIR^acad95bdda57e3a157ee57a47035a0d5^PRE_REMOVE
b/security/shadow/REPAIR^acad95bdda57e3a157ee57a47035a0d5^PRE_REMOVE
new file mode 100755
index 0000000..580de53
--- /dev/null
+++ b/security/shadow/REPAIR^acad95bdda57e3a157ee57a47035a0d5^PRE_REMOVE
@@ -0,0 +1,8 @@
+message "I will NOT put your passwords back into passwd/group!" &&
+message "You'd need to run pwunconv/grpunconv before dispel for having a
workable system without shadow."
+# do not do this unasked and on every upgrade cast
+# you normally never dispel shadow for good unless you are
+# curious to see what happens...
+#Restore /etc/passwd when dispelling shadow
+#${INSTALL_ROOT}/usr/sbin/pwunconv &&
+#${INSTALL_ROOT}/usr/sbin/grpunconv



  • [SM-Commit] GIT changes to stable-0.6 grimoire by Jeremy Blosser (c948aedf8359c94d10a4fbb068c88a0d2089a660), Jeremy Blosser, 02/07/2007

Archive powered by MHonArc 2.6.24.

Top of Page