* [PATCH 1/2] shadow: upgrade 4.19.4 -> 4.20.0
2026-08-03 5:18 [PATCH 0/2] shadow: upgrade to 4.20.0 Jaipaul Cheernam
@ 2026-08-03 5:18 ` Jaipaul Cheernam
2026-08-03 5:18 ` [PATCH 2/2] useradd.bbclass: drop groupmems from sysroot setup Jaipaul Cheernam
1 sibling, 0 replies; 3+ messages in thread
From: Jaipaul Cheernam @ 2026-08-03 5:18 UTC (permalink / raw)
To: openembedded-core; +Cc: Jaipaul Cheernam
Changelog: https://github.com/shadow-maint/shadow/releases/tag/4.20.0
Notable upstream changes:
- expiry(1): removed (deprecated in 4.19)
- groupmems(8): removed, use usermod(8) instead (deprecated in 4.19)
- logoutd(8): removed (deprecated in 4.19)
- PAM configs for setuid account tools removed (08f27babeb2c)
- login.defs(5): ENCRYPT_METHOD now defaults to SHA512
- Removed unused dependency on libattr
- New --disable-syslog configure option
Patches removed:
- prototypes.patch: patched src/expiry.c and src/logoutd.c which were
removed upstream in commits 2bb1b984 and eec97ce4.
- disable_syslog.patch: shadow now supports --disable-syslog configure
option natively. Added to EXTRA_OECONF for class-native instead.
- shadow-update-pam-conf.patch: the files it patched (chgpasswd,
groupadd, groupdel, groupmod, useradd, userdel, usermod) were removed
upstream in commit 08f27babeb2c. The remaining pam.d files in the
tarball are all overridden by the recipe's own PAM files.
Patches added:
- 0001-subid-Add-stdint.h-for-uintmax_t.patch: backport of upstream
commit ba4419c57b22 fixing missing <stdint.h> include causing build
failure in find_new_sub_uids.c and find_new_sub_gids.c.
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
...001-subid-Add-stdint.h-for-uintmax_t.patch | 43 +++++++
.../shadow/files/disable_syslog.patch | 23 ----
.../shadow/files/prototypes.patch | 38 ------
.../shadow/files/shadow-update-pam-conf.patch | 110 ------------------
.../{shadow_4.19.4.bb => shadow_4.20.0.bb} | 8 +-
5 files changed, 46 insertions(+), 176 deletions(-)
create mode 100644 meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch
delete mode 100644 meta/recipes-extended/shadow/files/disable_syslog.patch
delete mode 100644 meta/recipes-extended/shadow/files/prototypes.patch
delete mode 100644 meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
rename meta/recipes-extended/shadow/{shadow_4.19.4.bb => shadow_4.20.0.bb} (97%)
diff --git a/meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch b/meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch
new file mode 100644
index 0000000000..5679be0e61
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch
@@ -0,0 +1,43 @@
+From ba4419c57b222b0d34a2b933e7ee92914a51b596 Mon Sep 17 00:00:00 2001
+From: ojab <ojab@ojab.ru>
+Date: Wed, 29 Jul 2026 15:07:43 +0000
+Subject: [PATCH] subid: Add `<stdint.h>` for `uintmax_t`
+
+```
+find_new_sub_uids.c:80:27: error: 'uintmax_t' undeclared (first use in this function)
+find_new_sub_gids.c:80:27: error: 'uintmax_t' undeclared (first use in this function)
+```
+
+Fixes: 4d800cf2eb9e (2026-04-09; "subid: Add deterministic subid ranges")
+
+Upstream-Status: Backport [https://github.com/shadow-maint/shadow/commit/ba4419c57b222b0d34a2b933e7ee92914a51b596]
+Signed-off-by: ojab <ojab@ojab.ru>
+---
+ lib/find_new_sub_gids.c | 1 +
+ lib/find_new_sub_uids.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/lib/find_new_sub_gids.c b/lib/find_new_sub_gids.c
+index 3971ce922e..de514d6b09 100644
+--- a/lib/find_new_sub_gids.c
++++ b/lib/find_new_sub_gids.c
+@@ -8,6 +8,7 @@
+
+ #ifdef ENABLE_SUBIDS
+
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+
+diff --git a/lib/find_new_sub_uids.c b/lib/find_new_sub_uids.c
+index 65f6815467..f0b4328387 100644
+--- a/lib/find_new_sub_uids.c
++++ b/lib/find_new_sub_uids.c
+@@ -8,6 +8,7 @@
+
+ #ifdef ENABLE_SUBIDS
+
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+
diff --git a/meta/recipes-extended/shadow/files/disable_syslog.patch b/meta/recipes-extended/shadow/files/disable_syslog.patch
deleted file mode 100644
index 9f8ffcd379..0000000000
--- a/meta/recipes-extended/shadow/files/disable_syslog.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-When building images using shadow-native, we shouldn't be spamming the host's
-log with lots of syslog messages which aren't relavent. Disable syslog use
-in the native case.
-
-Upstream-Status: Inappropriate [upstream has accepted a better patch at https://github.com/shadow-maint/shadow/pull/1618]
-Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-Signed-off-by: Dmitry Sakhonchik <frezidok1@gmail.com>
-
-Index: shadow-4.17.2/lib/defines.h
-===================================================================
---- shadow-4.17.2.orig/lib/defines.h
-+++ shadow-4.17.2/lib/defines.h
-@@ -88,7 +88,9 @@
-
- /* cleaner than lots of #ifdefs everywhere - use this as follows:
- SYSLOG((LOG_CRIT, "user %s cracked root", user)); */
--#ifdef ENABLE_NLS
-+#if 1
-+#define SYSLOG(x)
-+#elif ENABLE_NLS
- /* Temporarily set LC_TIME to "C" to avoid strange dates in syslog.
- This is a workaround for a more general syslog(d) design problem -
- syslogd should log the current system time for each event, and not
diff --git a/meta/recipes-extended/shadow/files/prototypes.patch b/meta/recipes-extended/shadow/files/prototypes.patch
deleted file mode 100644
index dfdfc9b47a..0000000000
--- a/meta/recipes-extended/shadow/files/prototypes.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-Give unused function arguments names as GCC 10 will fail otherwise.
-
-This is a continuation of a PR that has been merged upstream[1] but
-this merged after expiry.c[2] and logout.c[3] were removed.
-
-[1] shadow cb0ec030 ("Fix build failure on hosts with gcc 10")
-[2] shadow 2bb1b984 ("*/: expiry(1): Remove program")
-[3] shadow eec97ce4 ("Remove unused `logoutd` utility")
-
-Upstream-Status: Inappropriate [code no longer exists upstream]
-Signed-off-by: Ross Burton <ross.burton@arm.com>
-
-diff --git a/src/expiry.c b/src/expiry.c
-index 8da89bd..0abf011 100644
---- a/src/expiry.c
-+++ b/src/expiry.c
-@@ -37,7 +37,7 @@ static void process_flags (int argc, char **argv);
- * catch_signals - signal catcher
- */
- static void
--catch_signals(int)
-+catch_signals(MAYBE_UNUSED int _1)
- {
- _exit (10);
- }
-diff --git a/src/logoutd.c b/src/logoutd.c
-index c87b75c..09a24b3 100644
---- a/src/logoutd.c
-+++ b/src/logoutd.c
-@@ -116,7 +116,7 @@ static void send_mesg_to_tty (int tty_fd)
- * off from the system.
- */
- int
--main(int argc, char *[])
-+main(int argc, char *argv[])
- {
- pid_t pid;
-
diff --git a/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch b/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
deleted file mode 100644
index 318e2665c2..0000000000
--- a/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From eb17cd91d8e4d76ee95de9c0c9f4938ba2e3e82a Mon Sep 17 00:00:00 2001
-From: Kang Kai <kai.kang@windriver.com>
-Date: Wed, 20 Jul 2011 19:18:14 +0800
-Subject: [PATCH] shadow: update pam related configure files
-
-The system-auth in the configure files is from Fedora which put all the 4 pam type rules
-in one file.
-In yocto it obey the way with Debian/Ubuntu, and the names are common-auth, common-account,
-common-password and common-session.
-So update them with oe way.
-
-See meta/recipes-extended/pam/libpam/pam.d/common-password
-
-Upstream-Status: Inappropriate [oe-core specific]
-
-Signed-off-by: Kang Kai <kai.kang@windriver.com>
----
- etc/pam.d/chgpasswd | 2 +-
- etc/pam.d/groupadd | 2 +-
- etc/pam.d/groupdel | 2 +-
- etc/pam.d/groupmems | 2 +-
- etc/pam.d/groupmod | 2 +-
- etc/pam.d/useradd | 2 +-
- etc/pam.d/userdel | 2 +-
- etc/pam.d/usermod | 2 +-
- 8 files changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/etc/pam.d/chgpasswd b/etc/pam.d/chgpasswd
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/chgpasswd
-+++ b/etc/pam.d/chgpasswd
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/groupadd b/etc/pam.d/groupadd
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupadd
-+++ b/etc/pam.d/groupadd
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/groupdel b/etc/pam.d/groupdel
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupdel
-+++ b/etc/pam.d/groupdel
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/groupmems b/etc/pam.d/groupmems
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupmems
-+++ b/etc/pam.d/groupmems
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/groupmod b/etc/pam.d/groupmod
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupmod
-+++ b/etc/pam.d/groupmod
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/useradd b/etc/pam.d/useradd
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/useradd
-+++ b/etc/pam.d/useradd
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/userdel b/etc/pam.d/userdel
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/userdel
-+++ b/etc/pam.d/userdel
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/usermod b/etc/pam.d/usermod
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/usermod
-+++ b/etc/pam.d/usermod
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
---
-2.43.0
-
diff --git a/meta/recipes-extended/shadow/shadow_4.19.4.bb b/meta/recipes-extended/shadow/shadow_4.20.0.bb
similarity index 97%
rename from meta/recipes-extended/shadow/shadow_4.19.4.bb
rename to meta/recipes-extended/shadow/shadow_4.20.0.bb
index d9ff20c22c..bb247cee9d 100644
--- a/meta/recipes-extended/shadow/shadow_4.19.4.bb
+++ b/meta/recipes-extended/shadow/shadow_4.20.0.bb
@@ -14,19 +14,17 @@ GITHUB_BASE_URI = "https://github.com/shadow-maint/shadow/releases"
SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BP}.tar.gz \
${@bb.utils.contains('PACKAGECONFIG', 'pam', '${PAM_SRC_URI}', '', d)} \
file://useradd \
- file://prototypes.patch \
+ file://0001-subid-Add-stdint.h-for-uintmax_t.patch \
"
SRC_URI:append:class-target = " \
file://login_defs_pam.sed \
- file://shadow-update-pam-conf.patch \
"
SRC_URI:append:class-native = " \
- file://disable_syslog.patch \
file://notallylog.patch \
"
-SRC_URI[sha256sum] = "ba7e9aed1c5420203ac549583d6e6f485a819ac7505af9c7cd8c13b2013210b8"
+SRC_URI[sha256sum] = "5e1eee2709a540ac07e4e5bb0d30f7b97d6ee1e3714ef527047fe2ffb5fdaa5c"
UPSTREAM_CHECK_REGEX = "releases/tag/v?(?P<pver>\d+(\.\d+)+)$"
# Additional Policy files for PAM
@@ -54,7 +52,7 @@ CACHED_CONFIGUREVARS += "ac_cv_lib_econf_econf_readDirs=no"
CFLAGS:append:libc-musl = " -DLIBBSD_OVERLAY"
NSCDOPT = ""
-NSCDOPT:class-native = "--without-nscd"
+NSCDOPT:class-native = "--without-nscd --disable-syslog"
NSCDOPT:class-nativesdk = "--without-nscd"
NSCDOPT:libc-glibc = "--with-nscd"
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH 2/2] useradd.bbclass: drop groupmems from sysroot setup
2026-08-03 5:18 [PATCH 0/2] shadow: upgrade to 4.20.0 Jaipaul Cheernam
2026-08-03 5:18 ` [PATCH 1/2] shadow: upgrade 4.19.4 -> 4.20.0 Jaipaul Cheernam
@ 2026-08-03 5:18 ` Jaipaul Cheernam
1 sibling, 0 replies; 3+ messages in thread
From: Jaipaul Cheernam @ 2026-08-03 5:18 UTC (permalink / raw)
To: openembedded-core; +Cc: Jaipaul Cheernam
groupmems was removed from shadow 4.20.0 [1]. The useradd class never
actually called the binary - perform_groupmems already uses usermod.
Drop it from the sysroot loop to silence the warnings.
[1] https://github.com/shadow-maint/shadow/pull/1601
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
meta/classes/useradd.bbclass | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/meta/classes/useradd.bbclass b/meta/classes/useradd.bbclass
index d6e1df2bd6..e9e835e1a2 100644
--- a/meta/classes/useradd.bbclass
+++ b/meta/classes/useradd.bbclass
@@ -131,10 +131,6 @@ usermod_sysroot() {
common_useradd_sysroot usermod
}
-groupmems_sysroot() {
- common_useradd_sysroot groupmems
-}
-
common_useradd_sysroot() {
# Pseudo may (do_prepare_recipe_sysroot) or may not (do_populate_sysroot_setscene) be running
# at this point so we're explicit about the environment so pseudo can load if
@@ -168,7 +164,6 @@ common_useradd_sysroot() {
groupadd) GROUPADD_PARAM="${@get_all_cmd_params(d, 'groupadd')}";;
useradd) USERADD_PARAM="${@get_all_cmd_params(d, 'useradd')}";;
usermod) USERMOD_PARAM="${@get_all_cmd_params(d, 'usermod')}";;
- groupmems) GROUPMEMS_PARAM="${@get_all_cmd_params(d, 'groupmems')}";;
esac
# Tell the system to use the environment vars
@@ -184,7 +179,7 @@ common_useradd_sysroot() {
EXTRA_STAGING_FIXMES += "PSEUDO_SYSROOT PSEUDO_LOCALSTATEDIR LOGFIFO"
python useradd_sysroot_sstate() {
- for cmd, sort_prefix in [("groupadd", "01"), ("useradd", "02"), ("usermod", "03"), ("groupmems", "04")]:
+ for cmd, sort_prefix in [("groupadd", "01"), ("useradd", "02"), ("usermod", "03")]:
scriptfile = None
task = d.getVar("BB_CURRENTTASK")
if task == "package_setscene":
^ permalink raw reply related [flat|nested] 3+ messages in thread