1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
|
# Maintainer: David Runge <dvzrv@archlinux.org>
# Contributor: Dave Reisner <dreisner@archlinux.org>
# Contributor: Aaron Griffin <aaron@archlinux.org>
# SELinux Maintainer: Nicolas Iooss (nicolas <dot> iooss <at> m4x <dot> org)
# SELinux Contributor: Timothée Ravier <tim@siosm.fr>
# SELinux Contributor: Nicky726 <Nicky726@gmail.com>
# SELinux Contributor: Zezadas
#
# This PKGBUILD is maintained on https://github.com/archlinuxhardened/selinux.
# If you want to help keep it up to date, please open a Pull Request there.
pkgname=shadow-selinux
pkgver=4.15.0
pkgrel=1
pkgdesc="Password and account management tool suite with support for shadow files and PAM - SELinux support"
arch=(x86_64 aarch64)
url="https://github.com/shadow-maint/shadow"
license=(BSD-3-Clause)
groups=(selinux)
depends=(
glibc
'libsemanage>=3.2'
)
makedepends=(
acl
attr
audit
docbook-xsl
itstool
libcap
libxcrypt
libxslt
pam-selinux
)
backup=(
etc/default/useradd
etc/login.defs
etc/pam.d/chpasswd
etc/pam.d/groupmems
etc/pam.d/newusers
etc/pam.d/passwd
)
conflicts=("${pkgname/-selinux}" "selinux-${pkgname/-selinux}")
provides=("${pkgname/-selinux}=${pkgver}-${pkgrel}"
"selinux-${pkgname/-selinux}=${pkgver}-${pkgrel}")
options=(!emptydirs)
# NOTE: distribution patches are taken from https://gitlab.archlinux.org/archlinux/packaging/upstream/shadow/-/commits/4.14.6.arch1
source=(
$url/releases/download/$pkgver/${pkgname/-selinux}-$pkgver.tar.xz{,.asc}
0001-Disable-replaced-tools-their-man-pages-and-PAM-integ.patch
0002-Adapt-login.defs-for-PAM-and-util-linux.patch
0003-Add-Arch-Linux-defaults-for-login.defs.patch
shadow.{timer,service}
shadow.{sysusers,tmpfiles}
useradd.defaults
)
sha512sums=('88d72fb706f6792b460c14a9b1b42fe0b5962834ec3793f296cbc138807736b5ad73d3f802cda74db740a71545eb1c8ec47447c2250299eb730ed2b2674e2249'
'SKIP'
'0e1d95b28650d9bcb35a8e5cd2fe528376a58bc1293ac7bf827ea38cd9fd5797dab3c418e15e387414685d1cd22cbf59c93cdced8a15fe79e44055a92b733ff5'
'45344a1baa74d5305bc26c4d9153bee0a61a22bcd1ab81f5bb61be56f59583ddfbc8906ee756e4bf7053ee1ce7aa57699a1751160b8067a4a8d656f694e69003'
'2d930e62d5a50f32d580d09c9b2564f456b34a56f12a6720592fcd28aab0faee3d52330b63dc9f4a9ca1d8594d1fceb6dc4f6961e04f4c3f9e937ca45f97cc95'
'e4edf705dd04e088c6b561713eaa1afeb92f42ac13722bff037aede6ac5ad7d4d00828cfb677f7b1ff048db8b6788238c1ab6a71dfcfd3e02ef6cb78ae09a621'
'2c8689b52029f6aa27d75b8b05b0b36e2fc322cab40fdfbb50cdbe331f61bc84e8db20f012cf9af3de8c4e7fdb10c2d5a4925ca1ba3b70eb5627772b94da84b3'
'5afac4a96b599b0b8ed7be751e7160037c3beb191629928c6520bfd3f2adcd1c55c31029c92c2ff8543e6cd9e37e2cd515ba4e1789c6d66f9c93b4e7f209ee7a'
'97a6a57c07502e02669dc1a91bffc447dba7d98d208b798d80e07de0d2fdf9d23264453978d2d3d1ba6652ca1f2e22cdadc4309c7b311e83fa71b00ad144f877'
'706ba6e7fa8298475f2605a28daffef421c9fa8d269cbd5cbcf7f7cb795b40a24d52c20e8d0b73e29e6cd35cd7226b3e9738dc513703e87dde04c1d24087a69c')
b2sums=('1a7594c6f93d1c8cad8caa574cdcda60a48d7c001c9ad48e540b26763d9a1cd7fba9501a0a451a5a64889dd6c0cbcf4d026fc72a7ee5a3ee682931bfe7e1b391'
'SKIP'
'42474c557f9dff0a28b7e56b6feb2cfc88a81ba159afda407b718828277cb82195a94b871129781c898544297c91a92e5848f9c2a2736fabad03cdddfdf2a3dc'
'9986adb40974fb4bbbc5a64fa0ff5edbdaf5c2850f1643ffd3bb44e1dc0772c691ae19b2ac7fc3c019aae951c7b380948548205ab912e89a7d194c9eaf393e80'
'14a428c9ca883be5f0c6d9de7e89d4d02593fdf0ff23d172c02ffe9abd3ebb37c7aca58a407be2ffcacd890cce81289b04ad04bc0e4052fb58b0799faa090ae1'
'5cfc936555aa2b2e15f8830ff83764dad6e11a80e2a102c5f2bd3b7c83db22a5457a3afdd182e3648c9d7d5bca90fa550f59576d0ac47a11a31dfb636cb18f2b'
'a69191ab966f146c35e7e911e7e57c29fffd54436ea014aa8ffe0dd46aaf57c635d0a652b35916745c75d82b3fca7234366ea5f810b622e94730b45ec86f122c'
'511c4ad9f3be530dc17dd68f2a3387d748dcdb84192d35f296b88f82442224477e2a74b1841ec3f107b39a5c41c2d961480e396a48d0578f8fd5f65dbe8d9f04'
'd727923dc6ed02e90ef31f10b3427df50afbfe416bd03c6de0c341857d1bb33ab6168312bd4ba18d19d0653020fb332cbcfeeb24e668ae3916add9d01b89ccb4'
'f743922062494fe342036b3acb8b747429eb33b1a13aa150daa4bb71a84e9c570cfcc8527a5f846e3ea7020e6f23c0b10d78cf2ba8363eea0224e4c34ea10161')
validpgpkeys=(
66D0387DB85D320F8408166DB175CFA98F192AF2 # Serge Hallyn <sergeh@kernel.org>
A9348594CE31283A826FBDD8D57633D441E25BB5 # Alejandro Colomar <alx@kernel.org>
)
prepare() {
local filename
cd "${pkgname/-selinux}-$pkgver"
for filename in "${source[@]}"; do
if [[ "$filename" =~ \.patch$ ]]; then
printf "Applying patch %s\n" "${filename##*/}"
patch -Np1 -i "$srcdir/${filename##*/}"
fi
done
autoreconf -fiv
}
build() {
local configure_options=(
--bindir=/usr/bin
--disable-account-tools-setuid # no setuid for chgpasswd, chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod
--enable-man
--libdir=/usr/lib
--mandir=/usr/share/man
--prefix=/usr
--sbindir=/usr/bin
--sysconfdir=/etc
--with-audit
--with-fcaps # use capabilities instead of setuid for setuidmap and setgidmap
--with-group-name-max-length=32
--with-libpam # PAM integration for chpasswd, groupmems, newusers, passwd
--with-yescrypt
--without-bcrypt
--without-libbsd # shadow can use internal implementation for getting passphrase
--without-nscd # we do not ship nscd anymore
--with-selinux
--without-su # su is provided by util-linux
)
cd "${pkgname/-selinux}-$pkgver"
# add extra check, preventing accidental deletion of other user's home dirs when using `userdel -r <user with home in />`
export CFLAGS="$CFLAGS -DEXTRA_CHECK_HOME_DIR"
./configure "${configure_options[@]}"
# prevent excessive overlinking due to libtool
sed -i -e 's/ -shared / -Wl,-O1,--as-needed\0/g' libtool
make
}
package() {
depends+=(
acl libacl.so
attr libattr.so
audit libaudit.so
libxcrypt libcrypt.so
pam libpam.so libpam_misc.so
)
cd "${pkgname/-selinux}-$pkgver"
make DESTDIR="$pkgdir" install
make DESTDIR="$pkgdir" -C man install
# license
install -vDm 644 COPYING -t "$pkgdir/usr/share/licenses/$pkgname/"
# custom useradd(8) defaults (not provided by upstream)
install -vDm 600 ../useradd.defaults "$pkgdir/etc/default/useradd"
# systemd units
install -vDm 644 ../shadow.timer -t "$pkgdir/usr/lib/systemd/system/"
install -vDm 644 ../shadow.service -t "$pkgdir/usr/lib/systemd/system/"
install -vdm 755 "$pkgdir/usr/lib/systemd/system/timers.target.wants"
ln -s ../shadow.timer "$pkgdir/usr/lib/systemd/system/timers.target.wants/shadow.timer"
install -vDm 644 ../${pkgname/-selinux}.sysusers "$pkgdir/usr/lib/sysusers.d/${pkgname/-selinux}.conf"
install -vDm 644 ../${pkgname/-selinux}.tmpfiles "$pkgdir/usr/lib/tmpfiles.d/${pkgname/-selinux}.conf"
# adapt executables to match the modes used by tmpfiles.d, so that pacman does not complain:
chmod 750 "$pkgdir/usr/bin/groupmems"
}
|