Version bump for security love #355207 by Paweł Hajdan jr.

Package-Manager: portage-2.2.0_alpha23/cvs/Linux x86_64

4 files changed, 226 insertions, 6 deletions

diff --git a/sys-apps/shadow/ChangeLog b/sys-apps/shadow/ChangeLog
index 7d6768ce2b7c..b1feed780a13 100644
--- a/sys-apps/shadow/ChangeLog
+++ b/sys-apps/shadow/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for sys-apps/shadow
-# Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/shadow/ChangeLog,v 1.253 2010/10/30 13:04:28 ssuominen Exp $
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/shadow/ChangeLog,v 1.254 2011/02/17 05:56:33 vapier Exp $
+
+*shadow-4.1.4.3 (17 Feb 2011)
+
+  17 Feb 2011; Mike Frysinger <vapier@gentoo.org> +shadow-4.1.4.3.ebuild,
+  +files/shadow-4.1.4.3-dup-install-targets.patch:
+  Version bump for security love #355207 by Paweł Hajdan jr.
 
   30 Oct 2010; Samuli Suominen <ssuominen@gentoo.org>
   shadow-4.1.4.2-r6.ebuild:
diff --git a/sys-apps/shadow/Manifest b/sys-apps/shadow/Manifest
index 57ffe1d9d3a8..79f7ec8f39ca 100644
--- a/sys-apps/shadow/Manifest
+++ b/sys-apps/shadow/Manifest
@@ -20,14 +20,17 @@ AUX shadow-4.1.4.2-env-reset-keep-locale.patch 436 RMD160 0acad89469885cc88937e2
 AUX shadow-4.1.4.2-fix-etc-gshadow-reading.patch 570 RMD160 80cbb45693ce4a1b19ced06819aa0488b72c3433 SHA1 1ce93a152cd17db37bd442da21e06d538cdea544 SHA256 091effa9c0336ffdc269d60a26af707b21ce849bdec7128baa21ce2bb5cba6b2
 AUX shadow-4.1.4.2-groupmod-pam-check.patch 689 RMD160 daa22dfce4b35d02951958fafdbac3816794bd63 SHA1 5823f38c0085b27e7e4327ab17ecc13563a43650 SHA256 ad60c0c26b70007750da034223eca38f1a98512fc80ce2fe40440e31a7585c52
 AUX shadow-4.1.4.2-su_no_sanitize_env.patch 315 RMD160 114abfb9ccc429342a83b8e919929c3818019718 SHA1 28ca6c0624c0fe5e4582ccca54e957ede125e96d SHA256 675098bb3dca4d8ac78e6c1c4ae7f513cb4017583b34b6b4d67611578bff8723
+AUX shadow-4.1.4.3-dup-install-targets.patch 695 RMD160 68c8ac6ea510b81559f93663123f5da56fde0ba9 SHA1 ec9b6880748047896a41f714edfdf35070693690 SHA256 8d8cebd032acb9f20a1ff99d8db2b95952ebb8a3592a7b1088364ed88cf70d11
 DIST shadow-4.1.4.2.tar.bz2 1790400 RMD160 8483dc5aefc52708199e09a7b2d6831f0a8e357b SHA1 43e29471057c671de51360b10e3ee2b419c78ffa SHA256 97987f6a7967a85e6aa0dba2a1d52db8bd69af5a717391de5693db768fb78990
+DIST shadow-4.1.4.3.tar.bz2 1804034 RMD160 0a38818054c40f4ca812da6b34aac5e2572c5d7c SHA1 ad9b85b5531ce8e68f4695efc4ac53ba7266269e SHA256 633f5bb4ea0c88c55f3642c97f9d25cbef74f82e0b4cf8d54e7ad6f9f9caa778
 EBUILD shadow-4.1.4.2-r6.ebuild 5375 RMD160 151b7dd298a1eca7b1a83f11347c659d22280597 SHA1 e20090a69c966ce4a208f5615403e1f2ce4ec11b SHA256 3517782694b7e273c8b5547ba126a99d788eb1fb450c23c4ce22b068948a0f31
-MISC ChangeLog 43206 RMD160 abd5db0f303dd3c3e432b30c9e12f8aea7e2a7b4 SHA1 42c15f3d0bcd84a713c98f32573c335df0b759b0 SHA256 e9b0b215140b538cf6363e080170a8a9e541058626aeae5d3c5162b71245cdc9
+EBUILD shadow-4.1.4.3.ebuild 5443 RMD160 bbf9069e65c3c5ade2e17a9b02d9c73b57d9e938 SHA1 b5aed656f1eaf8b35755ca3f331d2dd669eb8efd SHA256 9ccfb03c8be4505acd3e30121a3c47df3b072fc8239ae6bad79b2fd502e5f6d5
+MISC ChangeLog 43422 RMD160 60e1e4d6cb3855e8f6adee61dfb2bc5cdbf925cf SHA1 463c1f59a4fa74f39b90b97b0813e406fde4ad2e SHA256 7f47b1b4454169983d96e4b7bdec3921d88393a06a6527040402222e65ff4e85
 MISC metadata.xml 455 RMD160 362e8de9b1b405329950e77bb76397e8e6d80aae SHA1 f23fddf7e062594cc7ba32ee232dcb1c9b9bba34 SHA256 19a998c1a6a2bdc5baffc01ec9d3233f8032f0a9bab4666f56944e481e9dc5cc
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.17 (GNU/Linux)
 
-iF4EAREIAAYFAk1Q3wYACgkQaC/OocHi7JbNeAD/VNRKMgIj70wx259B8Nv/f5SZ
-TC/JSBoi52WWFfkIbvMA/jG/zE4qF1Kkw1IrqdXGquDoyrFxIwoJTPVSxoUZy5eo
-=TOCu
+iF4EAREIAAYFAk1cuJYACgkQaC/OocHi7JbG3wEAka2fDvx7ult2GfUwUW7sT9N0
+jdQeTyzH5BE8w/YZLYUA/1thH9Q8KOkJgnU6XKylGqOyJ0UYwoQEOX7jeiLWfShw
+=0Qpp
 -----END PGP SIGNATURE-----
diff --git a/sys-apps/shadow/files/shadow-4.1.4.3-dup-install-targets.patch b/sys-apps/shadow/files/shadow-4.1.4.3-dup-install-targets.patch
new file mode 100644
index 000000000000..6452d1721afc
--- /dev/null
+++ b/sys-apps/shadow/files/shadow-4.1.4.3-dup-install-targets.patch
@@ -0,0 +1,15 @@
+the Makefile.am manualy adds man_nopam to the install list, and then also
+optionally appends it which leads to the `install` error:
+	... will not overwrite just-created ...
+
+--- shadow-4.1.4.3/man/ru/Makefile.in
++++ shadow-4.1.4.3/man/ru/Makefile.in
+@@ -222,7 +222,7 @@
+ top_build_prefix = @top_build_prefix@
+ top_builddir = @top_builddir@
+ top_srcdir = @top_srcdir@
+-man_MANS = $(man_nopam) chage.1 chfn.1 chgpasswd.8 chpasswd.8 chsh.1 \
++man_MANS = chage.1 chfn.1 chgpasswd.8 chpasswd.8 chsh.1 \
+ 	expiry.1 faillog.5 faillog.8 getspnam.3 gpasswd.1 groupadd.8 \
+ 	groupdel.8 groupmems.8 groupmod.8 groups.1 grpck.8 grpconv.8 \
+ 	grpunconv.8 gshadow.5 lastlog.8 login.1 login.defs.5 logoutd.8 \
diff --git a/sys-apps/shadow/shadow-4.1.4.3.ebuild b/sys-apps/shadow/shadow-4.1.4.3.ebuild
new file mode 100644
index 000000000000..d94eae6e26b0
--- /dev/null
+++ b/sys-apps/shadow/shadow-4.1.4.3.ebuild
@@ -0,0 +1,196 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/shadow/shadow-4.1.4.3.ebuild,v 1.1 2011/02/17 05:56:33 vapier Exp $
+
+inherit eutils libtool toolchain-funcs pam multilib
+
+DESCRIPTION="Utilities to deal with user accounts"
+HOMEPAGE="http://shadow.pld.org.pl/ http://pkg-shadow.alioth.debian.org/"
+SRC_URI="ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow/shadow-${PV}.tar.bz2"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+IUSE="audit cracklib nls pam selinux skey"
+
+RDEPEND="audit? ( sys-process/audit )
+	cracklib? ( >=sys-libs/cracklib-2.7-r3 )
+	pam? ( virtual/pam )
+	!sys-apps/pam-login
+	!app-admin/nologin
+	skey? ( sys-auth/skey )
+	selinux? ( >=sys-libs/libselinux-1.28 )
+	nls? ( virtual/libintl )"
+DEPEND="${RDEPEND}
+	nls? ( sys-devel/gettext )"
+RDEPEND="${RDEPEND}
+	pam? ( >=sys-auth/pambase-20080219.1 )"
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	epatch "${FILESDIR}"/${PN}-4.1.4.3-dup-install-targets.patch
+	epatch "${FILESDIR}"/${PN}-4.1.4.2-env-reset-keep-locale.patch #283725
+	epatch "${FILESDIR}"/${PN}-4.1.3-dots-in-usernames.patch #22920
+	epatch "${FILESDIR}"/${PN}-4.1.4.2-groupmod-pam-check.patch #300790
+	epatch "${FILESDIR}"/${PN}-4.1.4.2-su_no_sanitize_env.patch #301957
+	epatch "${FILESDIR}"/${PN}-4.1.4.2-fix-etc-gshadow-reading.patch #327605
+	elibtoolize
+	epunt_cxx
+}
+
+src_compile() {
+	tc-is-cross-compiler && export ac_cv_func_setpgrp_void=yes
+	econf \
+		--without-group-name-max-length \
+		--enable-shared=no \
+		--enable-static=yes \
+		$(use_with audit) \
+		$(use_with cracklib libcrack) \
+		$(use_with pam libpam) \
+		$(use_with skey) \
+		$(use_with selinux) \
+		$(use_enable nls) \
+		$(use_with elibc_glibc nscd)
+	emake || die "compile problem"
+}
+
+set_login_opt() {
+	local comment="" opt=$1 val=$2
+	[[ -z ${val} ]] && comment="#"
+	sed -i -r \
+		-e "/^#?${opt}/s:.*:${comment}${opt} ${val}:" \
+		"${D}"/etc/login.defs
+	local res=$(grep "^${comment}${opt}" "${D}"/etc/login.defs)
+	einfo ${res:-Unable to find ${opt} in /etc/login.defs}
+}
+
+src_install() {
+	emake DESTDIR="${D}" suidperms=4711 install || die "install problem"
+
+	# Remove libshadow and libmisc; see bug 37725 and the following
+	# comment from shadow's README.linux:
+	#   Currently, libshadow.a is for internal use only, so if you see
+	#   -lshadow in a Makefile of some other package, it is safe to
+	#   remove it.
+	rm -f "${D}"/{,usr/}$(get_libdir)/lib{misc,shadow}.{a,la}
+
+	insinto /etc
+	# Using a securetty with devfs device names added
+	# (compat names kept for non-devfs compatibility)
+	insopts -m0600 ; doins "${FILESDIR}"/securetty
+	if ! use pam ; then
+		insopts -m0600
+		doins etc/login.access etc/limits
+	fi
+	# Output arch-specific cruft
+	local devs
+	case $(tc-arch) in
+		ppc*)  devs="hvc0 hvsi0 ttyPSC0";;
+		hppa)  devs="ttyB0";;
+		arm)   devs="ttyFB0";;
+		sh)    devs="ttySC0 ttySC1";;
+	esac
+	[[ -n ${devs} ]] && printf '%s\n' ${devs} >> "${D}"/etc/securetty
+
+	# needed for 'useradd -D'
+	insinto /etc/default
+	insopts -m0600
+	doins "${FILESDIR}"/default/useradd
+
+	# move passwd to / to help recover broke systems #64441
+	mv "${D}"/usr/bin/passwd "${D}"/bin/
+	dosym /bin/passwd /usr/bin/passwd
+
+	cd "${S}"
+	insinto /etc
+	insopts -m0644
+	newins etc/login.defs login.defs
+
+	if ! use pam ; then
+		set_login_opt MAIL_CHECK_ENAB no
+		set_login_opt SU_WHEEL_ONLY yes
+		set_login_opt CRACKLIB_DICTPATH /usr/$(get_libdir)/cracklib_dict
+		set_login_opt LOGIN_RETRIES 3
+		set_login_opt ENCRYPT_METHOD SHA512
+	else
+		dopamd "${FILESDIR}/pam.d-include/"{su,shadow}
+
+		newpamd "${FILESDIR}/login.pamd.3" login
+
+		for x in passwd chpasswd chgpasswd; do
+			newpamd "${FILESDIR}"/pam.d-include/passwd ${x} || die
+		done
+
+		for x in chage chsh chfn newusers \
+				 user{add,del,mod} group{add,del,mod} ; do
+			newpamd "${FILESDIR}"/pam.d-include/shadow ${x} || die
+		done
+
+		# comment out login.defs options that pam hates
+		local opt
+		for opt in \
+			CHFN_AUTH \
+			CRACKLIB_DICTPATH \
+			ENV_HZ \
+			ENVIRON_FILE \
+			FAILLOG_ENAB \
+			FTMP_FILE \
+			LASTLOG_ENAB \
+			MAIL_CHECK_ENAB \
+			MOTD_FILE \
+			NOLOGINS_FILE \
+			OBSCURE_CHECKS_ENAB \
+			PASS_ALWAYS_WARN \
+			PASS_CHANGE_TRIES \
+			PASS_MIN_LEN \
+			PORTTIME_CHECKS_ENAB \
+			QUOTAS_ENAB \
+			SU_WHEEL_ONLY
+		do
+			set_login_opt ${opt}
+		done
+
+		sed -i -f "${FILESDIR}"/login_defs_pam.sed \
+			"${D}"/etc/login.defs
+
+		# remove manpages that pam will install for us
+		# and/or don't apply when using pam
+		find "${D}"/usr/share/man \
+			'(' -name 'limits.5*' -o -name 'suauth.5*' ')' \
+			-exec rm {} +
+	fi
+
+	# Remove manpages that are handled by other packages
+	find "${D}"/usr/share/man \
+		'(' -name id.1 -o -name passwd.5 -o -name getspnam.3 ')' \
+		-exec rm {} +
+
+	cd "${S}"
+	dodoc ChangeLog NEWS TODO
+	newdoc README README.download
+	cd doc
+	dodoc HOWTO README* WISHLIST *.txt
+}
+
+pkg_preinst() {
+	rm -f "${ROOT}"/etc/pam.d/system-auth.new \
+		"${ROOT}/etc/login.defs.new"
+
+	use pam && pam_epam_expand "${D}"/etc/pam.d/login
+}
+
+pkg_postinst() {
+	# Enable shadow groups (we need ROOT=/ here, as grpconv only
+	# operate on / ...).
+	if [[ ${ROOT} == / && ! -f /etc/gshadow ]] ; then
+		if grpck -r 2>/dev/null ; then
+			grpconv
+		else
+			ewarn "Running 'grpck' returned errors.  Please run it by hand, and then"
+			ewarn "run 'grpconv' afterwards!"
+		fi
+	fi
+
+	einfo "The 'adduser' symlink to 'useradd' has been dropped."
+}