Re: [RFC] how to get some standing issues integrated

--Boundary-00=_TBP1ES1vbbQeIEl
Content-Type: multipart/signed; boundary="nextPart1700405.JrKiMmqemX";
	protocol="application/pgp-signature"; micalg=pgp-sha1
Content-Transfer-Encoding: 7bit

--nextPart1700405.JrKiMmqemX
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Tuesday 01 August 2006 06:26, Tomasz K=C5=82oczko wrote:
> On Tue, 18 Jul 2006, Mike Frysinger wrote:
> > so i have some patches that address:
> > - `./configure` on non-selinux always fails, need to use
> > --without-selinux
>
> There is no patch for this in attachments.

i didnt feel like rewriting it a 4th time ... wanted to figure out what=20
(conceptually) was wrong before i wasted more time writing a patch no one=20
would look at

attached now

> Probably you want disable this only because some non-glibc libc
> implementation do not provides netgroup support.

correct

> You must know netgroup it is not NIS specyfic feacture (on glibc it is fu=
lly
> supported even by files NSS module) so disable this id this way is
> incorrect.

ok, but netgroup is not in any spec ... it's a Sun extension that glibc pic=
ked=20
up, so now people assume it's ok to always use it

> Probably best way will be add check on autoconf level getgrnam()
> avalaibability and instead make this code USE_NIS dependent better will
> be use HAVE_GETGRNAM.

huh ?  i didnt disable getgrnam(), i disabled innetgr() ... getgrnam() is=20
IEEE/SUSV3 requirement, innetgr() is a an ugly extension

patch attached:
 - configure checks for innetgr
 - login_nopam.c utilizes HAVE_INNETGR

question though ... ive attached two versions as i'm not sure how you want =
to=20
handle the case where innetgr() does not exist but someone tried to login=20
with '@' in their username anyways ... always deny them or treat it like an=
y=20
other username ?

> > - fix usergroup behavior (-n/-g) in useradd
> > how do i go about getting these merged ?  i may have just missed the
> > relevant comments (in which case feel free to smack me), but i'm not
> > entirely sure what is objectionable about these :)
>
> This must be solved in other way. I don't want have -n switch.
> I have partially prepared fix for this but I'll commit this after release
> 4.0.18.

ok ... any hints as to what the "other way" is ?
=2Dmike

--nextPart1700405.JrKiMmqemX
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iQIVAwUARNTwUkFjO5/oN/WBAQKSJBAAxMdhwUvnt/WQDUhLutvNEiwo9C5Pc6he
Iid6wpMuCD/GE0QKB4406mEt5TSlMPHVdBfSPQkPAyOUsC1XpneupLDWb494WUju
wJI73NqPA/L7KyL43SXuhW6B59ufSguqsxq+V/+ljaR4oAEGFoyOVP2z/zPKteiT
z0UUzja+dgfOAVTpBofFr6+JRMQ9IEd37v8kiaIrCp1RyYGY4VKvZQgSt8ce9YrU
ewPIk8yGbmZkmgxr7s328vY3pWWgxzNWEPsCq/suDZ4U2nQss4fPbxpJzqHpmV+Y
iT1vhCMLP14ZBf5Z/Oy/C8OAY0jcsyoQqr064fqtNP9iUGHl9OUSlsNdu5+hCMeb
nwW0dzd/1KafRDd1UHfJ/LLs3t1Ej4qB8wHHeNohLVhvEprqRx4mvmebxVbTma2u
+ZTJSYwQ/PYU5WOvda1QRm/5uD/r1xf+GiJf/bGceMTGENnL6p0xXtCBd6o2mS8J
5BaWpfpx7TNSTQHc3D03RMfCZdEuI/d/+Hzy7K622GP1QYtBZkXyM6FhpNtI84VW
7m6jUIgScw41+el7MFS5sFL8FWbkteWEVRAFlHmUKeW65VVO/KUqn3mUs7U9RbMn
SGO1EqVkUGKjvXPoAx/l5rPhn6nl3NqEg3sc9+0pzuHgylkC7Xv+VDhVyPTqeaA1
VPY+g6nIok4=
=vorj
-----END PGP SIGNATURE-----

--nextPart1700405.JrKiMmqemX--

--Boundary-00=_TBP1ES1vbbQeIEl
Content-Type: text/x-diff; charset="utf-8";
	name="shadow-friendly-selinux.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
	filename="shadow-friendly-selinux.patch"

Index: configure.in
===================================================================
RCS file: /cvsroot/shadow/configure.in,v
retrieving revision 1.150
diff -u -p -r1.150 configure.in
--- configure.in	3 Aug 2006 10:14:05 -0000	1.150
+++ configure.in	5 Aug 2006 18:51:34 -0000
@@ -220,7 +220,7 @@ AC_ARG_WITH(libpam,
 	[with_libpam=$withval], [with_libpam=yes])
 AC_ARG_WITH(selinux,
 	[AC_HELP_STRING([--with-selinux], [use SELinux support @<:@default=autodetect@:>@])],
-	[with_selinux=$withval], [with_selinux=yes])
+	[with_selinux=$withval], [with_selinux=maybe])
 AC_ARG_WITH(skey,
 	[AC_HELP_STRING([--with-skey], [use S/Key support @<:@default=no@:>@])],
 	[with_skey=$withval], [with_skey=no])
@@ -282,15 +282,21 @@ if test "$with_libcrack" = "yes"; then
 		AC_DEFINE(HAVE_LIBCRACK_PW, 1, [Defined if it includes *Pw functions.]))
 fi
 
-if test "$with_selinux" = "yes"; then
+if test "$with_selinux" != "no" ; then
+	have_selinux="yes"
 	AC_CHECK_LIB(selinux, is_selinux_enabled,
 		[LIBSELINUX="-lselinux"
 		AC_SUBST(LIBSELINUX)
 		AC_CHECK_HEADERS(selinux/selinux.h, [],
-			[AC_MSG_ERROR([selinux/selinux.h is missing])])
+			[have_selinux="no"])
 		AC_DEFINE(WITH_SELINUX, 1, [Build shadow with SELinux support])
 		],
-		[AC_MSG_ERROR([libselinux not found])])
+		[have_selinux="no"])
+	if test "x$have_selinux$with_selinux" = "xnoyes" ; then
+		AC_MSG_ERROR([selinux support not found])
+	else
+		with_selinux="$have_selinux"
+	fi
 fi
 
 AC_SUBST(LIBPAM)

--Boundary-00=_TBP1ES1vbbQeIEl
Content-Type: text/x-diff; charset="utf-8"; name="shadow-no-innetgr.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
	filename="shadow-no-innetgr.patch"

Index: configure.in
===================================================================
RCS file: /cvsroot/shadow/configure.in,v
retrieving revision 1.150
diff -u -p -r1.150 configure.in
--- configure.in	3 Aug 2006 10:14:05 -0000	1.150
+++ configure.in	5 Aug 2006 19:19:10 -0000
@@ -32,11 +32,11 @@ AC_HEADER_SYS_WAIT
 AC_CHECK_HEADERS(errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
 	utmpx.h termios.h termio.h sgtty.h sys/ioctl.h syslog.h paths.h \
 	utime.h ulimit.h sys/resource.h gshadow.h shadow.h lastlog.h \
-	locale.h rpc/key_prot.h)
+	locale.h rpc/key_prot.h netdb.h)
 
 AC_CHECK_FUNCS(a64l fchmod fchown fsync getgroups gethostname getspnam \
 	gettimeofday getusershell getutent initgroups lchown lckpwdf lstat \
-	memcpy memset setgroups sigaction strchr updwtmp updwtmpx)
+	memcpy memset setgroups sigaction strchr updwtmp updwtmpx innetgr)
 AC_SYS_LARGEFILE
 
 dnl Checks for typedefs, structures, and compiler characteristics.
Index: src/login_nopam.c
===================================================================
RCS file: /cvsroot/shadow/src/login_nopam.c,v
retrieving revision 1.8
diff -u -p -r1.8 login_nopam.c
--- src/login_nopam.c	7 Sep 2005 15:00:45 -0000	1.8
+++ src/login_nopam.c	5 Aug 2006 19:19:10 -0000
@@ -37,7 +37,9 @@
 #include <stdio.h>
 #include <syslog.h>
 #include <ctype.h>
+#ifdef HAVE_NETDB_H
 #include <netdb.h>
+#endif
 #include <grp.h>
 #ifdef PRIMARY_GROUP_MATCH
 #include <pwd.h>
@@ -49,8 +51,6 @@
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>		/* for inet_ntoa() */
-extern struct group *getgrnam ();
-extern int innetgr ();
 
 #if !defined(MAXHOSTNAMELEN) || (MAXHOSTNAMELEN < 64)
 #undef MAXHOSTNAMELEN
@@ -178,6 +178,7 @@ static char *myhostname (void)
 	return (name);
 }
 
+#ifdef HAVE_INNETGR
 /* netgroup_match - match group against machine or user */
 static int
 netgroup_match (const char *group, const char *machine, const char *user)
@@ -193,6 +194,7 @@ netgroup_match (const char *group, const
 
 	return innetgr (group, machine, user, mydomain);
 }
+#endif
 
 /* user_match - match a username against one token */
 static int user_match (const char *tok, const char *string)
@@ -214,8 +216,10 @@ static int user_match (const char *tok, 
 		*at = 0;
 		return (user_match (tok, string)
 			&& from_match (at + 1, myhostname ()));
+#ifdef HAVE_INNETGR
 	} else if (tok[0] == '@') {	/* netgroup */
 		return (netgroup_match (tok + 1, (char *) 0, string));
+#endif
 	} else if (string_match (tok, string)) {	/* ALL or exact match */
 		return (YES);
 	} else if ((group = getgrnam (tok))) {	/* try group membership */
@@ -271,9 +275,12 @@ static int from_match (const char *tok, 
 	 * contain a "." character. If the token is a network number, return YES
 	 * if it matches the head of the string.
 	 */
+#ifdef HAVE_INNETGR
 	if (tok[0] == '@') {	/* netgroup */
 		return (netgroup_match (tok + 1, string, (char *) 0));
-	} else if (string_match (tok, string)) {	/* ALL or exact match */
+	} else
+#endif
+	if (string_match (tok, string)) {	/* ALL or exact match */
 		return (YES);
 	} else if (tok[0] == '.') {	/* domain: match last fields */
 		if ((str_len = strlen (string)) > (tok_len = strlen (tok))

--Boundary-00=_TBP1ES1vbbQeIEl
Content-Type: text/x-diff; charset="utf-8";
	name="shadow-no-innetgr-simpler.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
	filename="shadow-no-innetgr-simpler.patch"

Index: configure.in
===================================================================
RCS file: /cvsroot/shadow/configure.in,v
retrieving revision 1.150
diff -u -p -r1.150 configure.in
--- configure.in	3 Aug 2006 10:14:05 -0000	1.150
+++ configure.in	5 Aug 2006 19:21:51 -0000
@@ -32,11 +32,11 @@ AC_HEADER_SYS_WAIT
 AC_CHECK_HEADERS(errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
 	utmpx.h termios.h termio.h sgtty.h sys/ioctl.h syslog.h paths.h \
 	utime.h ulimit.h sys/resource.h gshadow.h shadow.h lastlog.h \
-	locale.h rpc/key_prot.h)
+	locale.h rpc/key_prot.h netdb.h)
 
 AC_CHECK_FUNCS(a64l fchmod fchown fsync getgroups gethostname getspnam \
 	gettimeofday getusershell getutent initgroups lchown lckpwdf lstat \
-	memcpy memset setgroups sigaction strchr updwtmp updwtmpx)
+	memcpy memset setgroups sigaction strchr updwtmp updwtmpx innetgr)
 AC_SYS_LARGEFILE
 
 dnl Checks for typedefs, structures, and compiler characteristics.
Index: src/login_nopam.c
===================================================================
RCS file: /cvsroot/shadow/src/login_nopam.c,v
retrieving revision 1.8
diff -u -p -r1.8 login_nopam.c
--- src/login_nopam.c	7 Sep 2005 15:00:45 -0000	1.8
+++ src/login_nopam.c	5 Aug 2006 19:21:51 -0000
@@ -37,7 +37,9 @@
 #include <stdio.h>
 #include <syslog.h>
 #include <ctype.h>
+#ifdef HAVE_NETDB_H
 #include <netdb.h>
+#endif
 #include <grp.h>
 #ifdef PRIMARY_GROUP_MATCH
 #include <pwd.h>
@@ -49,8 +51,6 @@
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>		/* for inet_ntoa() */
-extern struct group *getgrnam ();
-extern int innetgr ();
 
 #if !defined(MAXHOSTNAMELEN) || (MAXHOSTNAMELEN < 64)
 #undef MAXHOSTNAMELEN
@@ -182,6 +182,7 @@ static char *myhostname (void)
 static int
 netgroup_match (const char *group, const char *machine, const char *user)
 {
+#ifdef HAVE_INNETGR
 	static char *mydomain = 0;
 
 	if (mydomain == 0) {
@@ -192,6 +193,9 @@ netgroup_match (const char *group, const
 	}
 
 	return innetgr (group, machine, user, mydomain);
+#else
+	return (NO);
+#endif
 }
 
 /* user_match - match a username against one token */

--Boundary-00=_TBP1ES1vbbQeIEl
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline