diff options
| author | Andrew Bower <andrew@bower.uk> | 2025-10-29 16:20:30 +0000 |
|---|---|---|
| committer | git-ubuntu importer <ubuntu-devel-discuss@lists.ubuntu.com> | 2025-11-09 16:34:35 +0000 |
| commit | 1186a246c0e22a20f4f4a00db7b354cd8d8b27aa (patch) | |
| tree | a0ffdee1835699952abfac85c6c979e939fcf62a | |
| parent | 9d1548570d2ac225e28500c40f1fd5da1e9c285e (diff) | |
| parent | 84dc7209b77f93215ec02e5f0d1d2c89b31d2e95 (diff) | |
0.7.3-5.1 (patches applied)applied/0.7.3-5.1applied/ubuntu/stonking-develapplied/ubuntu/stonkingapplied/ubuntu/resolute-proposedapplied/ubuntu/resolute-develapplied/ubuntu/resoluteapplied/ubuntu/develapplied/debian/sid
Imported using git-ubuntu import.
| -rw-r--r-- | debian/.gitignore | 11 | ||||
| -rw-r--r-- | debian/changelog | 8 | ||||
| -rw-r--r-- | debian/patches/locked-user-suffix.patch | 61 | ||||
| -rw-r--r-- | debian/patches/series | 1 | ||||
| -rw-r--r-- | debian/tests/control | 1 | ||||
| -rwxr-xr-x | debian/tests/locked-user | 21 | ||||
| -rwxr-xr-x | sysusers | 18 |
7 files changed, 107 insertions, 14 deletions
diff --git a/debian/.gitignore b/debian/.gitignore deleted file mode 100644 index e3ff0b6..0000000 --- a/debian/.gitignore +++ /dev/null @@ -1,11 +0,0 @@ -.debhelper/* -debhelper-build-stamp -files -opensysusers.* -!opensysusers.init -!opensysusers.links -!opensysusers.lintian-overrides -!opensysusers.preinst -!opensysusers.postinst -opensysusers/* - diff --git a/debian/changelog b/debian/changelog index 8485b73..d31c632 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,11 @@ +opensysusers (0.7.3-5.1) unstable; urgency=medium + + * Non-maintainer upload. + * d/patches: support u! type (Closes: #1118619) + * d/tests: add locked-user test + + -- Andrew Bower <andrew@bower.uk> Wed, 29 Oct 2025 16:20:30 +0000 + opensysusers (0.7.3-5) unstable; urgency=medium * d/patches: fix uid:gid support (Closes: #1105010) diff --git a/debian/patches/locked-user-suffix.patch b/debian/patches/locked-user-suffix.patch new file mode 100644 index 0000000..e7dd00c --- /dev/null +++ b/debian/patches/locked-user-suffix.patch @@ -0,0 +1,61 @@ +From: Andrew Bower <andrew@bower.uk> +Date: Sun, 26 Oct 2025 16:36:25 +0000 +Subject: Handle locked user type suffix ('u!') + +Bug-Debian: https://bugs.debian.org/1118619 +Forwarded: https://github.com/cromerc/opensysusers/pull/10 + +--- + sysusers | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/sysusers b/sysusers +index 11e999f..8e7e02a 100755 +--- a/sysusers ++++ b/sysusers +@@ -22,7 +22,7 @@ add_group() { + } + + add_user() { +- # add_user <name> <uid> <gid> <gecos> <home> ++ # add_user <name> <uid> <gid> <gecos> <home> [locked]* + if ! id "$1" >/dev/null 2>&1; then + if [ "$2" = '-' ]; then + if [ "$3" = '-' ]; then +@@ -34,6 +34,12 @@ add_user() { + useradd --prefix "$root" -rc "$4" -u "$2" -g "$3" -d "$5" -s '/sbin/nologin' "$1" + fi + passwd --prefix "$root" -l "$1" >/dev/null 2>&1 ++ while [ $# -gt 5 ]; do ++ case "$6" in ++ locked) usermod --prefix "$root" -e 1 "$1" ;; ++ esac ++ shift ++ done + fi + } + +@@ -74,7 +80,8 @@ parse_string() { + + #eval "set -- $1" # do not use eval, see CVE-2021-40084 + set -- $1 +- type="$1" name="$2" id="$3" gecos="$4" home="$5" ++ suffix="${1#?}" ++ type="${1%%${suffix}}" name="$2" id="$3" gecos="$4" home="$5" + + # and now set the GECOS field without eval + if [ "${type}" = u ]; then +@@ -106,7 +113,12 @@ parse_string() { + # No specific gid, create group for this user + add_group "${name}" "${id}" + fi +- add_user "${name}" "${uid}" "${gid}" "${gecos}" "${home}" ++ case "${suffix}" in ++ '!') locked=1;; ++ '') ;; ++ *) warninvalid; return;; ++ esac ++ add_user "${name}" "${uid}" "${gid}" "${gecos}" "${home}" ${locked:+locked} + ;; + g) + case "${id}" in 65535|4294967295) warninvalid; return; esac diff --git a/debian/patches/series b/debian/patches/series index d0f35f6..e66ae27 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ fix-root-option.patch uid-gid-support.patch +locked-user-suffix.patch diff --git a/debian/tests/control b/debian/tests/control index 7556b1a..116149a 100644 --- a/debian/tests/control +++ b/debian/tests/control @@ -9,5 +9,6 @@ Restrictions: Tests: root, uid-gid, + locked-user, Depends: passwd, diff --git a/debian/tests/locked-user b/debian/tests/locked-user new file mode 100755 index 0000000..f437ce5 --- /dev/null +++ b/debian/tests/locked-user @@ -0,0 +1,21 @@ +#!/bin/sh + +set -euo pipefail + +test="${0##*/}" +testuser="opensysusers-test-$test" +CHROOTDIR="$AUTOPKGTEST_TMP/$test" + +mkdir -p "$CHROOTDIR/etc" +cp /etc/passwd /etc/group /etc/login.defs "$CHROOTDIR/etc" +touch "$CHROOTDIR/etc/shadow" + +if grep -q "$testuser" /etc/passwd +then + printf 'test user already exists\n' + exit 1 +fi + +PATH="$PATH:/usr/sbin" ./sysusers --root="$CHROOTDIR" --inline "u! $testuser - -" +grep -E "^$testuser:x:[0-9]+:[0-9]+:.*:/:(/usr)?/s?bin/nologin$" "$CHROOTDIR/etc/passwd" +grep -E "^$testuser:[^:]*:[0-9]+:[^:]*:[^:]*:[^:]*:[^:]*:1:" "$CHROOTDIR/etc/shadow" @@ -22,7 +22,7 @@ add_group() { } add_user() { - # add_user <name> <uid> <gid> <gecos> <home> + # add_user <name> <uid> <gid> <gecos> <home> [locked]* if ! id "$1" >/dev/null 2>&1; then if [ "$2" = '-' ]; then if [ "$3" = '-' ]; then @@ -34,6 +34,12 @@ add_user() { useradd --prefix "$root" -rc "$4" -u "$2" -g "$3" -d "$5" -s '/sbin/nologin' "$1" fi passwd --prefix "$root" -l "$1" >/dev/null 2>&1 + while [ $# -gt 5 ]; do + case "$6" in + locked) usermod --prefix "$root" -e 1 "$1" ;; + esac + shift + done fi } @@ -74,7 +80,8 @@ parse_string() { #eval "set -- $1" # do not use eval, see CVE-2021-40084 set -- $1 - type="$1" name="$2" id="$3" gecos="$4" home="$5" + suffix="${1#?}" + type="${1%%${suffix}}" name="$2" id="$3" gecos="$4" home="$5" # and now set the GECOS field without eval if [ "${type}" = u ]; then @@ -106,7 +113,12 @@ parse_string() { # No specific gid, create group for this user add_group "${name}" "${id}" fi - add_user "${name}" "${uid}" "${gid}" "${gecos}" "${home}" + case "${suffix}" in + '!') locked=1;; + '') ;; + *) warninvalid; return;; + esac + add_user "${name}" "${uid}" "${gid}" "${gecos}" "${home}" ${locked:+locked} ;; g) case "${id}" in 65535|4294967295) warninvalid; return; esac |