From patchwork Sat Aug 8 10:34:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10125 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hHHWb1zmMz3wp9 for ; Sat, 08 Aug 2026 10:36:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hHHWR0dZnz7Lx for ; Sat, 08 Aug 2026 10:36:51 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hHHT85d5lz37Bj for ; Sat, 08 Aug 2026 10:34:52 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hHHT62Bmsz2xPV for ; Sat, 08 Aug 2026 10:34:50 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hHHSy0ym0z2cJ; Sat, 08 Aug 2026 10:34:42 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1786185282; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hB1kYc++P89RgepNIa836ruxpVQfVhWoQ1NM7+HTr3A=; b=LiXnsq6vyPhHx7OWRYLeYpBtNW8asHnWmVqtg48QPdD3W3+4EnirZVXZG28u6nF5jf459V dlOuol3tU4jxGhCQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1786185282; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hB1kYc++P89RgepNIa836ruxpVQfVhWoQ1NM7+HTr3A=; b=XAS0R6JktWg5F0cMPitWGh4OmSY07U7u1wJsFYnj4Kg2NuiFF5Ucflj5668opgjbWp2pBD PNUp53fIrFu1tv0kJjX3Nj2bbD5VVq39hDYiR06EZTf+GK9dB6lyJXAxkfci7vYjo/YZCS j9ZuQFtkpt+DAaxLVJc+ZKhS9tuxw97lHo/PzszQ3JFIg8SzG1YfuDUrsc8eeeoPlV6AGu EE/TLrbz8i/cvnRFyO5ZbIMEz7tWBtQEo2cCdRREnlkISlZn2UJC+/KR2L7oD5+cyJKBRz FunjNT4YpE8DFzEdV/sx5ugOm6UZYlayD6ndRAMVGkfoj3f77l502y7tBfa3Mw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] shadow: Update to version 4.20.0 Date: Sat, 8 Aug 2026 12:34:15 +0200 Message-ID: <20260808103415.3443313-4-adolf.belka@ipfire.org> In-Reply-To: <20260808103415.3443313-1-adolf.belka@ipfire.org> References: <20260808103415.3443313-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 4.18.0 to 4.20.0 - Update of rootfile - Addition of patch to fix a build error. This patch will be integrated into the next tarball release. - Checked the sobump but no dependencies found. - Changelog 4.20.0 Removals: The following programs and features were deprecated in 4.19 (Herve) or earlier, and have been removed in 4.20. expiry(1) (deprecated in 4.19) See #1481 and #1432. login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19) See #1456. login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19) See #1457. login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around) See #1455. shadow(5): .sp_min (deprecated in 4.19) See #1482. This also includes the following removals: chage(1): -m,--mindays (also the interactive version) passwd(1): -n,--mindays login.defs(5): PASS_MIN_DAYS This feature is considered a vulnerability, and was removed without replacement. Programs will now fail when any of those flags or variable are specified. This is intentional, and should help identify any scripts that rely on these. groupmems(8) (deprecated in 4.19) See #1343 and #1601. Use usermod(8) instead. logoutd(8) (deprecated in 4.19) See #999 and #1344. Defaults: The following default values were changed. login.defs(5): Remove defaults for password expiration (PASS_MAX_DAYS, PASS_WARN_AGE) See #1428. login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES) See #1278 and #1454. Users should still explicitly specify it, since other programs that read login.defs(5) may still default to DES. Features The following features that were optional in 4.19 are now unconditionally supported in 4.20. SHA256, SHA512 See #1278 and #1452. Regressions Some regressions have been introduced (as side effects of bug fixes) and they're here to stay. Users must adapt. #1704 su(1) as root can be dangerous because of an ioctl (TIOCSTI), and if that ioctl is not disabled, su(1) will now fail and report an error. #1706 usermod(8) doesn't produce any effects if it fails to unlock a password because there was no password. Previously, this was just a warning, and thus produced effects. Dependencies: We've removed an unused dependency (libattr). See #1473. Deprecations No new deprecations since 4.19. However, we maintain the deprecations from then. Here's a reminder of deprecated features that have not been removed yet (they will eventually be removed): Password aging: chage(1): -I,--inactive (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): .sp_lstchg: Restrict to just the values 0 and empty. .sp_max .sp_warn .sp_inact 4.19.4 Regression fixes: - Build with GCC 10 and older. 4.19.3 Regression fixes: - chpasswd(8): - Don't reject hashes containing backslashes or 'n' characters (affected SHA-256, SHA-512, MD5). 4.19.2 Regression fixes: - usermod(8): - Revert an incorrect commit. See and . 4.19.1 Regression fixes: - chpasswd(8): - Don't reject leading '!' in password hashes or a hash consisting of "*". These were accidentally rejected in 4.19.0. See and . - Accept a passwordless account ("" or "!"). See and . 4.19.0 Breaking changes: Remove support for escaped newlines in configuration files. It never worked correctly. b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()") Some user names and group names are too dangerous and are rejected, even with --badname. 25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names") Future breaking changes: SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See #1452. Support: Several years ago, there were talks about deprecating su(1) and login(1), back when this project was maintained as part of Debian. However, nothing was clearly stated, and there were doubts about the status of these programs. Let's clarify them now. Our implementations of su(1) and login(1) are fully supported, and we don't have any plans to remove them. They are NOT deprecated. See #464. Deprecations: groupmems(8) The program will be removed in a future release. See #1343. logoutd(8) The program will be removed in the next release. See #999, and #1344. DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See #1456 MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See #1457 login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See #1455. login.defs(5): PASS_MAX_LEN This feature is ignored except for DES. Once DES is removed, it makes no sense keeping it. It may be removed in a future release. Password aging Scientific research shows that periodic password expiration leads to predictable password patterns, and that even in a theoretical scenario where that wouldn't happen the gains in security are mathematically negligible. https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf Modern security standards, such as NIST SP 800-63B-4 in the USA, prohibit periodic password expiration. https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver https://pages.nist.gov/800-63-FAQ/#q-b05 https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry To align with these, we're deprecating the ability to periodically expire passwords. The specifics and long-term roadmap are currently being discussed, and we invite feedback from users, particularly from those in regulated environments. See #1432. This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact We recognize that many users operate in environments with regulatory or contractual requirements that still mandate password aging. To minimize disruption, these features will remain functional for a significant period. However, we encourage administrators to review their internal policies, talk to their regulators if appropriate, and participate in the roadmap discussion linked above. Signed-off-by: Adolf Belka --- config/rootfiles/common/shadow | 7 ++---- lfs/shadow | 10 +++++---- ...ow-4.20.0_Add_stdint.h_for_uintmax_t.patch | 22 +++++++++++++++++++ 3 files changed, 30 insertions(+), 9 deletions(-) create mode 100644 src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch diff --git a/config/rootfiles/common/shadow b/config/rootfiles/common/shadow index d25da8957..170568306 100644 --- a/config/rootfiles/common/shadow +++ b/config/rootfiles/common/shadow @@ -11,13 +11,12 @@ etc/shadow #etc/shadow- #lib/libsubid.la #lib/libsubid.so -lib/libsubid.so.5 -lib/libsubid.so.5.0.0 +lib/libsubid.so.6 +lib/libsubid.so.6.0.0 sbin/nologin #usr/bin/chage #usr/bin/chfn #usr/bin/chsh -#usr/bin/expiry #usr/bin/faillog #usr/bin/gpasswd #usr/bin/newgidmap @@ -31,12 +30,10 @@ sbin/nologin usr/sbin/chpasswd usr/sbin/groupadd usr/sbin/groupdel -usr/sbin/groupmems usr/sbin/groupmod #usr/sbin/grpck usr/sbin/grpconv #usr/sbin/grpunconv -#usr/sbin/logoutd #usr/sbin/newusers #usr/sbin/pwck usr/sbin/pwconv diff --git a/lfs/shadow b/lfs/shadow index f0e23408a..f1a021910 100644 --- a/lfs/shadow +++ b/lfs/shadow @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.18.0 +VER = 4.20.0 THISAPP = shadow-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f165f8cdf017ed5875fbea3ece01d44f988bc85ee039186b5cd8d5cb07d666d501065ad9746abf80c2d31661b0cc687a2bc375e286a5805fa168f6826724e82e +$(DL_FILE)_BLAKE2 = 8224edc692d6016da26e54aa43405029b4bebcbc7a73a9a56f1ee3bdcf7c7a3af6b90d8fc134182fc26c6b7b8f2afc4f54c2f6e6748760b8928284aa77374a15 install : $(TARGET) @@ -70,6 +70,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch cd $(DIR_APP) && find man -name Makefile.in -exec sed -i 's/getspnam\.3 / /' {} \; cd $(DIR_APP) && find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \; $(UPDATE_AUTOMAKE) @@ -84,7 +85,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --with-group-name-max-length=32 \ --without-libbsd \ --without-bcrypt \ - --without-nscd + --without-nscd \ + --disable-logind cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch b/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch new file mode 100644 index 000000000..e07e7db74 --- /dev/null +++ b/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch @@ -0,0 +1,22 @@ +diff -Naur shadow-4.20.0.orig/lib/find_new_sub_gids.c shadow-4.20.0/lib/find_new_sub_gids.c +--- shadow-4.20.0.orig/lib/find_new_sub_gids.c 2026-08-07 18:55:36.246967805 +0200 ++++ shadow-4.20.0/lib/find_new_sub_gids.c 2026-08-07 22:41:35.771731696 +0200 +@@ -8,6 +8,7 @@ + + #ifdef ENABLE_SUBIDS + ++#include + #include + #include + +diff -Naur shadow-4.20.0.orig/lib/find_new_sub_uids.c shadow-4.20.0/lib/find_new_sub_uids.c +--- shadow-4.20.0.orig/lib/find_new_sub_uids.c 2026-08-07 18:56:37.619956630 +0200 ++++ shadow-4.20.0/lib/find_new_sub_uids.c 2026-08-07 22:41:52.640184987 +0200 +@@ -8,6 +8,7 @@ + + #ifdef ENABLE_SUBIDS + ++#include + #include + #include +