shadow/shadow-4.5-goodname.patch

From a386a250712771e44e2020060e6a3ca690f72129 Mon Sep 17 00:00:00 2001
From: "guiyao" <guiyao@huawei.com>
Date: Wed, 15 Apr 2020 15:18:25 -0400
Subject: [PATCH] shadow: shadow-4.5-goodname

backport patch and do some modify for new code
---
 libmisc/chkname.c  | 40 +++++++++++++++++++++++++++++-----------
 man/groupadd.8.xml | 10 ++++++----
 man/useradd.8.xml  | 12 ++++++++----
 3 files changed, 43 insertions(+), 19 deletions(-)

diff --git a/libmisc/chkname.c b/libmisc/chkname.c
index bdd1e72..957c966 100644
--- a/libmisc/chkname.c
+++ b/libmisc/chkname.c
@@ -55,26 +55,44 @@ static bool is_valid_name (const char *name)
 	}
 
 	/*
-	 * User/group names must match [a-z_][a-z0-9_-]*[$]
-	 */
+         * User/group names must match gnu e-regex:
+         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
+         *
+         * as a non-POSIX, extension, allow "$" as the last char for
+         * sake of Samba 3.x "add machine script"
+         *
+         * Also do not allow fully numeric names or just "." or "..".
+         */
+	int numeric;
 
-	if (('\0' == *name) ||
-	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
+	if ('\0' == *name ||
+		('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
+				'\0' == name[1])) ||
+		!((*name >= 'a' && *name <= 'z') ||
+		  (*name >= 'A' && *name <= 'Z') ||
+		  (*name >= '0' && *name <= '9') ||
+		  *name == '_' ||
+		  *name == '.')) {
 		return false;
 	}
 
+	numeric = isdigit(*name);
+
 	while ('\0' != *++name) {
-		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
-		      ( ('0' <= *name) && ('9' >= *name) ) ||
-		      ('_' == *name) ||
-		      ('-' == *name) ||
-		      ( ('$' == *name) && ('\0' == *(name + 1)) )
-		     )) {
+		if (!((*name >= 'a' && *name <= 'z') ||
+			 (*name >= 'A' && *name <= 'Z') ||
+			 (*name >= '0' && *name <= '9') ||
+			 *name == '_' ||
+			 *name == '.' ||
+			 *name == '-' ||
+			 (*name == '$' && name[1] == '\0')
+			)) {
 			return false;
 		}
+		numeric &= isdigit(*name);
 	}
 
-	return true;
+	return !numeric;
 }
 
 bool is_valid_user_name (const char *name)
diff --git a/man/groupadd.8.xml b/man/groupadd.8.xml
index 1e58f09..47a4c95 100644
--- a/man/groupadd.8.xml
+++ b/man/groupadd.8.xml
@@ -273,10 +273,12 @@
    <refsect1 id='caveats'>
      <title>CAVEATS</title>
      <para>
-       Groupnames must start with a lower case letter or an underscore,
-       followed by lower case letters, digits, underscores, or dashes.
-       They can end with a dollar sign.
-       In regular expression terms: [a-z_][a-z0-9_-]*[$]?
+       Groupnames may contain only lower and upper case letters, digits,
+       underscores, or dashes. They can end with a dollar sign.
+
+       Dashes are not allowed at the beginning of the groupname.
+       Fully numeric groupnames and groupnames . or .. are
+       also disallowed.
      </para>
      <para>
        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
diff --git a/man/useradd.8.xml b/man/useradd.8.xml
index 03612ce..4e9e0dc 100644
--- a/man/useradd.8.xml
+++ b/man/useradd.8.xml
@@ -662,10 +662,14 @@
     </para>
 
     <para>
-      Usernames must start with a lower case letter or an underscore,
-      followed by lower case letters, digits, underscores, or dashes.
-      They can end with a dollar sign.
-      In regular expression terms: [a-z_][a-z0-9_-]*[$]?
+      Usernames may contain only lower and upper case letters, digits,
+      underscores, or dashes. They can end with a dollar sign.
+
+      Dashes are not allowed at the beginning of the username.
+      Fully numeric usernames and usernames . or .. are
+      also disallowed. It is not recommended to use usernames beginning
+      with . character as their home directories will be hidden in
+      the <command>ls</command> output.
     </para>
     <para>
       Usernames may only be up to 32 characters long.
-- 
1.8.3.1