install: cope with a system that has no shadow group - #309
Merged
Merged
Conversation
`make install` put expiry setgid `shadow`, which is how Debian and Ubuntu ship it, and failed outright wherever that group does not exist: Fedora and Arch have none -- /etc/shadow there is readable by root alone -- and a packager's chroot may lack it whatever the target. The Arch packager had to sed the Makefile (#306), and the result, setgid to a group with no rights on the file, left expiry unable to read it for anyone but root. On those systems the GNU tool that reads /etc/shadow on a user's behalf, chage, is setuid root; that is the convention expiry now follows where the group is absent. It buys a user nothing more: expiry checks the real uid and reads that one line. SHADOW_GROUP names a group that goes by another name. The choice is made once, at make time, from getent, and the install summary says which layout was used. Verified in the debian image with the group (2755 root:shadow) and with SHADOW_GROUP pointing at a group that does not exist (4755 root), and in the fedora image, where `make install` now completes; under each layout `expiry -c` answers an unprivileged user.
This was referenced Sep 15, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #306.
make installputexpirysetgidshadow, which is how Debian and Ubuntu ship it, and failed outright wherever that group does not exist. Fedora and Arch have none:/etc/shadowthere is readable by root alone. A packager's chroot may lack the group whatever the target. The Arch packager had to sed the Makefile, and the result, setgid to a group with no rights on the file, leftexpiryunable to read it for anyone but root.Probed before choosing: Debian ships
expiryandchage2755 root:shadow; Fedora and Arch ship noexpiryat all and shipchage, the tool that reads/etc/shadowon a user's behalf, 4755 root. That is the conventionexpirynow follows where the group is absent. It buys a user nothing more, sinceexpirychecks the real uid and reads that one line.SHADOW_GROUP=names a group that goes by another name. The choice is made once, at make time, fromgetent, and the install summary says which layout was used.Verified in the debian image with the group (2755 root:shadow) and with
SHADOW_GROUPset to a group that does not exist (4755 root), and in the fedora image, wheremake installnow completes; under each layoutexpiry -canswers an unprivileged user with exit 0 on a fresh account.