1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
Goal: save the [g]shadow files with the 'shadow' group and mode 0440
Fixes: #166793
Index: shadow-4.4/lib/commonio.c
===================================================================
--- shadow-4.4.orig/lib/commonio.c
+++ shadow-4.4/lib/commonio.c
@@ -44,6 +44,7 @@
#include <errno.h>
#include <stdio.h>
#include <signal.h>
+#include <grp.h>
#include "nscd.h"
#ifdef WITH_TCB
#include <tcb.h>
@@ -966,12 +967,23 @@ int commonio_close (struct commonio_db *
goto fail;
}
} else {
+ struct group *grp;
/*
* Default permissions for new [g]shadow files.
*/
sb.st_mode = db->st_mode;
sb.st_uid = db->st_uid;
sb.st_gid = db->st_gid;
+
+ /*
+ * Try to retrieve the shadow's GID, and fall back to GID 0.
+ */
+ if (sb.st_gid == 0) {
+ if ((grp = getgrnam("shadow")) != NULL)
+ sb.st_gid = grp->gr_gid;
+ else
+ sb.st_gid = 0;
+ }
}
snprintf (buf, sizeof buf, "%s+", db->filename);
Index: shadow-4.4/lib/sgroupio.c
===================================================================
--- shadow-4.4.orig/lib/sgroupio.c
+++ shadow-4.4/lib/sgroupio.c
@@ -228,7 +228,7 @@ static struct commonio_db gshadow_db = {
#ifdef WITH_SELINUX
NULL, /* scontext */
#endif
- 0400, /* st_mode */
+ 0440, /* st_mode */
0, /* st_uid */
0, /* st_gid */
NULL, /* head */
Index: shadow-4.4/lib/shadowio.c
===================================================================
--- shadow-4.4.orig/lib/shadowio.c
+++ shadow-4.4/lib/shadowio.c
@@ -104,7 +104,7 @@ static struct commonio_db shadow_db = {
#ifdef WITH_SELINUX
NULL, /* scontext */
#endif /* WITH_SELINUX */
- 0400, /* st_mode */
+ 0440, /* st_mode */
0, /* st_uid */
0, /* st_gid */
NULL, /* head */
|
