summaryrefslogtreecommitdiffstats
path: root/debian/patches/501_commonio_group_shadow
blob: 171382a4bd4733b3bcf67c43e12db9c3e8e35c76 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
Goal: save the [g]shadow files with the 'shadow' group and mode 0440

Fixes: #166793

--- a/lib/commonio.c
+++ b/lib/commonio.c
@@ -44,6 +44,7 @@
 #include <errno.h>
 #include <stdio.h>
 #include <signal.h>
+#include <grp.h>
 #include "nscd.h"
 #include "sssd.h"
 #ifdef WITH_TCB
@@ -986,12 +987,23 @@
 			goto fail;
 		}
 	} else {
+		struct group *grp;
 		/*
 		 * Default permissions for new [g]shadow files.
 		 */
 		sb.st_mode = db->st_mode;
 		sb.st_uid = db->st_uid;
 		sb.st_gid = db->st_gid;
+
+		/*
+		 * Try to retrieve the shadow's GID, and fall back to GID 0.
+		 */
+		if (sb.st_gid == 0) {
+			if ((grp = getgrnam("shadow")) != NULL)
+				sb.st_gid = grp->gr_gid;
+			else
+				sb.st_gid = 0;
+		}
 	}
 
 	snprintf (buf, sizeof buf, "%s+", db->filename);
--- a/lib/sgroupio.c
+++ b/lib/sgroupio.c
@@ -229,7 +229,7 @@
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
-	0400,                   /* st_mode */
+	0440,                   /* st_mode */
 	0,                      /* st_uid */
 	0,                      /* st_gid */
 	NULL,			/* head */
--- a/lib/shadowio.c
+++ b/lib/shadowio.c
@@ -105,7 +105,7 @@
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif				/* WITH_SELINUX */
-	0400,                   /* st_mode */
+	0440,                   /* st_mode */
 	0,                      /* st_uid */
 	0,                      /* st_gid */
 	NULL,			/* head */