remove redundant patches

2020-02-21 16:25:46 +08:00 · 2020-02-21 16:25:46 +08:00 · 22ae2f3caf
commit 22ae2f3caf
parent 595190e27c
25 changed files with 7 additions and 4111 deletions
--- a/Fix-some-issues-found-in-Coverity-scan.patch
+++ b/Fix-some-issues-found-in-Coverity-scan.patch
@ -1,67 +0,0 @@
 From fb97da1ce1606f7a2f7c897f5441d1d04020f402 Mon Sep 17 00:00:00 2001
 From: Tomas Mraz <tmraz@fedoraproject.org>
 Date: Wed, 10 Oct 2018 12:22:04 +0200
 Subject: [PATCH 10/19] Fix some issues found in Coverity scan.
 ---
 lib/commonio.c    | 4 +---
 lib/spawn.c       | 2 +-
 libmisc/console.c | 5 +++--
 3 files changed, 5 insertions(+), 6 deletions(-)
 --- shadow-4.6/lib/commonio.c	2019-02-12 00:00:00.000000000 +0000
 +++ shadow-4.6-new/lib/commonio.c	2019-02-12 00:00:00.000000000 +0000
@@ -384,7 +384,7 @@
 	char* lock = NULL;
 	size_t lock_file_len;
 	size_t file_len;
 -	int err;
 +        int err = 0;
 	if (db->locked) {
 		return 1;
@@ -393,12 +393,10 @@
 	lock_file_len = strlen(db->filename) + 6; /* sizeof ".lock" */
 	file = (char*)malloc(file_len);
 	if(file == NULL) {
 -		err = ENOMEM;
 		goto cleanup_ENOMEM;
 	}
 	lock = (char*)malloc(lock_file_len);
 	if(lock == NULL) {
 -		err = ENOMEM;
 		goto cleanup_ENOMEM;
 	}
 	snprintf (file, file_len, "%s%s.%lu",
 --- shadow-4.6/lib/spawn.c	2019-02-12 00:00:00.000000000 +0000
 +++ shadow-4.6-new/lib/spawn.c	2019-02-12 00:00:00.000000000 +0000
@@ -69,7 +69,7 @@
 	do {
 		wpid = waitpid (pid, status, 0);
 	} while (   ((pid_t)-1 == wpid && errno == EINTR)
 -	         || (wpid != pid));
 +                || ((pid_t)-1 != wpid && wpid != pid));
 	if ((pid_t)-1 == wpid) {
 		fprintf (stderr, "%s: waitpid (status: %d): %s\n",
 --- shadow-4.6/libmisc/console.c	2019-02-12 00:00:00.000000000 +0000
 +++ shadow-4.6-new/libmisc/console.c	2019-02-12 00:00:00.000000000 +0000
@@ -50,7 +50,7 @@
 static bool is_listed (const char *cfgin, const char *tty, bool def)
 {
 	FILE *fp;
 -	char buf[200], *s;
 +	char buf[1024], *s;
 	const char *cons;
 	/*
@@ -70,7 +70,8 @@
 	if (*cons != '/') {
 		char *pbuf;
 -		strcpy (buf, cons);
 +		strncpy (buf, cons, sizeof (buf));
 +                buf[sizeof (buf) - 1] = '\0';
 		pbuf = &buf[0];
 		while ((s = strtok (pbuf, ":")) != NULL) {
 			if (strcmp (s, tty) == 0) {
--- a/Fix-the-default-mentioned-in-man-page-for-SUB_UID-GI.patch
+++ b/Fix-the-default-mentioned-in-man-page-for-SUB_UID-GI.patch
@ -1,40 +0,0 @@
 From ebad423023b753b970f491afc7a0df179d151a81 Mon Sep 17 00:00:00 2001
 From: Tomas Mraz <tmraz@fedoraproject.org>
 Date: Thu, 31 Jan 2019 13:30:59 +0100
 Subject: [PATCH 18/19] Fix the default mentioned in man page for
 SUB_UID/GID_COUNT variables.
 ---
 man/login.defs.d/SUB_GID_COUNT.xml | 2 +-
 man/login.defs.d/SUB_UID_COUNT.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/man/login.defs.d/SUB_GID_COUNT.xml b/man/login.defs.d/SUB_GID_COUNT.xml
 index 01ace007..93fe7421 100644
 --- a/man/login.defs.d/SUB_GID_COUNT.xml
 +++ b/man/login.defs.d/SUB_GID_COUNT.xml
@@ -42,7 +42,7 @@
     <para>
       The default values for <option>SUB_GID_MIN</option>,
       <option>SUB_GID_MAX</option>, <option>SUB_GID_COUNT</option>
 -      are respectively 100000, 600100000 and 10000.
 +      are respectively 100000, 600100000 and 65536.
     </para>
   </listitem>
 </varlistentry>
 diff --git a/man/login.defs.d/SUB_UID_COUNT.xml b/man/login.defs.d/SUB_UID_COUNT.xml
 index 5ad812f7..516417b7 100644
 --- a/man/login.defs.d/SUB_UID_COUNT.xml
 +++ b/man/login.defs.d/SUB_UID_COUNT.xml
@@ -42,7 +42,7 @@
     <para>
       The default values for <option>SUB_UID_MIN</option>,
       <option>SUB_UID_MAX</option>, <option>SUB_UID_COUNT</option>
 -      are respectively 100000, 600100000 and 10000.
 +      are respectively 100000, 600100000 and 65536.
     </para>
   </listitem>
 </varlistentry>
 -- 
 2.19.1
--- a/Log-UID-in-nologin.patch
+++ b/Log-UID-in-nologin.patch
@ -1,46 +0,0 @@
 From 4be18d32991e73c460ca59c43384f75419602a35 Mon Sep 17 00:00:00 2001
 From: Vladimir Ivanov <ivlad@nxadi.com>
 Date: Fri, 3 Aug 2018 09:44:16 +0800
 Subject: [PATCH 08/19] Log UID in nologin
 Sometimes getlogin() may fail, e.g., in a chroot() environment or due to NSS
 misconfiguration. Loggin UID allows for investigation and troubleshooting in
 such situation.
 ---
 src/nologin.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
 diff --git a/src/nologin.c b/src/nologin.c
 index 7fe8a6a2..98989d26 100644
 --- a/src/nologin.c
 +++ b/src/nologin.c
@@ -24,7 +24,6 @@
  * SUCH DAMAGE.
  */
 -#include <config.h>
 #ident "$Id$"
@@ -36,6 +35,7 @@
 int main (void)
 {
 	const char *user, *tty;
 +	uid_t uid;
 	tty = ttyname (0);
 	if (NULL == tty) {
@@ -45,8 +45,9 @@ int main (void)
 	if (NULL == user) {
 		user = "UNKNOWN";
 	}
 +	uid = getuid (); /* getuid() is always successful */
 	openlog ("nologin", LOG_CONS, LOG_AUTH);
 -	syslog (LOG_CRIT, "Attempted login by %s on %s", user, tty);
 +	syslog (LOG_CRIT, "Attempted login by %s (UID: %d) on %s", user, uid, tty);
 	closelog ();
 	printf ("%s", "This account is currently not available.\n");
 -- 
 2.19.1
--- a/shadow-4.1.5.1-default-range.patch
+++ b/shadow-4.1.5.1-default-range.patch
@ -1,36 +0,0 @@
 Index: shadow-4.5/lib/semanage.c
 ===================================================================
 --- shadow-4.5.orig/lib/semanage.c
 +++ shadow-4.5/lib/semanage.c
@@ -143,6 +143,7 @@ static int semanage_user_mod (semanage_h
 		goto done;
 	}
 +#if 0
 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
 	if (ret != 0) {
 		fprintf (stderr,
@@ -150,6 +151,7 @@ static int semanage_user_mod (semanage_h
 		ret = 1;
 		goto done;
 	}
 +#endif
 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
 	if (ret != 0) {
@@ -200,6 +202,7 @@ static int semanage_user_add (semanage_h
 		goto done;
 	}
 +#if 0
 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
 	if (ret != 0) {
 		fprintf (stderr,
@@ -208,6 +211,7 @@ static int semanage_user_add (semanage_h
 		ret = 1;
 		goto done;
 	}
 +#endif
 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
 	if (ret != 0) {
--- a/shadow-4.1.5.1-info-parent-dir.patch
+++ b/shadow-4.1.5.1-info-parent-dir.patch
@ -1,21 +0,0 @@
 Index: shadow-4.5/man/newusers.8.xml
 ===================================================================
 --- shadow-4.5.orig/man/newusers.8.xml
 +++ shadow-4.5/man/newusers.8.xml
@@ -218,7 +218,15 @@
 	  <para>
 	    If this field does not specify an existing directory, the
 	    specified directory is created, with ownership set to the
 -	    user being created or updated and its primary group.
 +	    user being created or updated and its primary group. Note 
 +            that newusers does not create parent directories of the new 
 +            user's home directory. The newusers command will fail to 
 +            create the home directory if the parent directories do not 
 +            exist, and will send a message to stderr informing the user 
 +            of the failure. The newusers command will not halt or return 
 +            a failure to the calling shell if it fails to create the home 
 +            directory, it will continue to process the batch of new users 
 +            specified.
 	  </para>
 	  <para>
 	    If the home directory of an existing user is changed,
--- a/shadow-4.1.5.1-logmsg.patch
+++ b/shadow-4.1.5.1-logmsg.patch
@ -1,13 +0,0 @@
 Index: shadow-4.5/src/useradd.c
 ===================================================================
 --- shadow-4.5.orig/src/useradd.c
 +++ shadow-4.5/src/useradd.c
@@ -323,7 +323,7 @@ static void fail_exit (int code)
 	              user_name, AUDIT_NO_ID,
 	              SHADOW_AUDIT_FAILURE);
 #endif
 -	SYSLOG ((LOG_INFO, "failed adding user '%s', data deleted", user_name));
 +	SYSLOG ((LOG_INFO, "failed adding user '%s', exit code: %d", user_name, code));
 	exit (code);
 }
--- a/shadow-4.1.5.1-userdel-helpfix.patch
+++ b/shadow-4.1.5.1-userdel-helpfix.patch
@ -1,16 +0,0 @@
 Index: shadow-4.5/src/userdel.c
 ===================================================================
 --- shadow-4.5.orig/src/userdel.c
 +++ shadow-4.5/src/userdel.c
@@ -143,8 +143,9 @@ static void usage (int status)
 	                  "\n"
 	                  "Options:\n"),
 	                Prog);
 -	(void) fputs (_("  -f, --force                   force removal of files,\n"
 -	                "                                even if not owned by user\n"),
 +	(void) fputs (_("  -f, --force                   force some actions that would fail otherwise\n"
 +			"                                e.g. removal of user still logged in\n"
 +			"                                or files, even if not owned by the user\n"),
 	              usageout);
 	(void) fputs (_("  -h, --help                    display this help message and exit\n"), usageout);
 	(void) fputs (_("  -r, --remove                  remove home directory and mail spool\n"), usageout);
--- a/shadow-4.2.1-date-parsing.patch
+++ b/shadow-4.2.1-date-parsing.patch
@ -1,69 +0,0 @@
 Index: shadow-4.5/libmisc/getdate.y
 ===================================================================
 --- shadow-4.5.orig/libmisc/getdate.y
 +++ shadow-4.5/libmisc/getdate.y
@@ -152,6 +152,7 @@ static int	yyHaveDay;
 static int	yyHaveRel;
 static int	yyHaveTime;
 static int	yyHaveZone;
 +static int      yyHaveYear;
 static int	yyTimezone;
 static int	yyDay;
 static int	yyHour;
@@ -293,18 +294,21 @@ date	: tUNUMBER '/' tUNUMBER {
 	      yyDay = $3;
 	      yyYear = $5;
 	    }
 +	    yyHaveYear++;
 	}
 	| tUNUMBER tSNUMBER tSNUMBER {
 	    /* ISO 8601 format.  yyyy-mm-dd.  */
 	    yyYear = $1;
 	    yyMonth = -$2;
 	    yyDay = -$3;
 +	    yyHaveYear++;
 	}
 	| tUNUMBER tMONTH tSNUMBER {
 	    /* e.g. 17-JUN-1992.  */
 	    yyDay = $1;
 	    yyMonth = $2;
 	    yyYear = -$3;
 +	    yyHaveYear++;
 	}
 	| tMONTH tUNUMBER {
 	    yyMonth = $1;
@@ -314,6 +318,7 @@ date	: tUNUMBER '/' tUNUMBER {
 	    yyMonth = $1;
 	    yyDay = $2;
 	    yyYear = $4;
 +	    yyHaveYear++;
 	}
 	| tUNUMBER tMONTH {
 	    yyMonth = $2;
@@ -323,6 +328,7 @@ date	: tUNUMBER '/' tUNUMBER {
 	    yyMonth = $2;
 	    yyDay = $1;
 	    yyYear = $3;
 +	    yyHaveYear++;
 	}
 	;
@@ -395,7 +401,8 @@ relunit	: tUNUMBER tYEAR_UNIT {
 number	: tUNUMBER
           {
 -	    if ((yyHaveTime != 0) && (yyHaveDate != 0) && (yyHaveRel == 0))
 +	    if ((yyHaveTime != 0 || $1 >= 100) && !yyHaveYear
 +		&& (yyHaveDate != 0) && (yyHaveRel == 0))
 	      yyYear = $1;
 	    else
 	      {
@@ -802,7 +809,7 @@ yylex (void)
 	  return LookupWord (buff);
 	}
       if (c != '(')
 -	return *yyInput++;
 +	return (unsigned char)*yyInput++;
       Count = 0;
       do
 	{
--- a/shadow-4.2.1-no-lock-dos.patch
+++ b/shadow-4.2.1-no-lock-dos.patch
@ -1,16 +0,0 @@
 Index: shadow-4.5/lib/commonio.c
 ===================================================================
 --- shadow-4.5.orig/lib/commonio.c
 +++ shadow-4.5/lib/commonio.c
@@ -140,7 +140,10 @@ static int do_lock_file (const char *fil
 	int retval;
 	char buf[32];
 -	fd = open (file, O_CREAT | O_EXCL | O_WRONLY, 0600);
 +	/* We depend here on the fact, that the file name is pid-specific.
 +	 * So no O_EXCL here and no DoS.
 +	 */
 +	fd = open (file, O_CREAT | O_TRUNC | O_WRONLY, 0600);
 	if (-1 == fd) {
 		if (log) {
 			(void) fprintf (stderr,
--- a/shadow-4.2.1-null-tm.patch
+++ b/shadow-4.2.1-null-tm.patch
@ -1,91 +0,0 @@
 Index: shadow-4.5/src/faillog.c
 ===================================================================
 --- shadow-4.5.orig/src/faillog.c
 +++ shadow-4.5/src/faillog.c
@@ -163,10 +163,14 @@ static void print_one (/*@null@*/const s
 	}
 	tm = localtime (&fl.fail_time);
 +	if (tm == NULL) {
 +		cp = "(unknown)";
 +	} else {
 #ifdef HAVE_STRFTIME
 -	strftime (ptime, sizeof (ptime), "%D %H:%M:%S %z", tm);
 -	cp = ptime;
 +		strftime (ptime, sizeof (ptime), "%D %H:%M:%S %z", tm);
 +		cp = ptime;
 #endif
 +	}
 	printf ("%-9s   %5d    %5d   ",
 	        pw->pw_name, fl.fail_cnt, fl.fail_max);
 	/* FIXME: cp is not defined ifndef HAVE_STRFTIME */
 Index: shadow-4.5/src/chage.c
 ===================================================================
 --- shadow-4.5.orig/src/chage.c
 +++ shadow-4.5/src/chage.c
@@ -168,6 +168,10 @@ static void date_to_str (char *buf, size
 	struct tm *tp;
 	tp = gmtime (&date);
 +	if (tp == NULL) {
 +		(void) snprintf (buf, maxsize, "(unknown)");
 +		return;
 +	}
 #ifdef HAVE_STRFTIME
 	(void) strftime (buf, maxsize, "%Y-%m-%d", tp);
 #else
 Index: shadow-4.5/src/lastlog.c
 ===================================================================
 --- shadow-4.5.orig/src/lastlog.c
 +++ shadow-4.5/src/lastlog.c
@@ -158,13 +158,17 @@ static void print_one (/*@null@*/const s
 	ll_time = ll.ll_time;
 	tm = localtime (&ll_time);
 +	if (tm == NULL) {
 +		cp = "(unknown)";
 +	} else {
 #ifdef HAVE_STRFTIME
 -	strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
 -	cp = ptime;
 +		strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
 +		cp = ptime;
 #else
 -	cp = asctime (tm);
 -	cp[24] = '\0';
 +		cp = asctime (tm);
 +		cp[24] = '\0';
 #endif
 +	}
 	if (ll.ll_time == (time_t) 0) {
 		cp = _("**Never logged in**\0");
 Index: shadow-4.5/src/passwd.c
 ===================================================================
 --- shadow-4.5.orig/src/passwd.c
 +++ shadow-4.5/src/passwd.c
@@ -455,6 +455,9 @@ static /*@observer@*/const char *date_to
 	struct tm *tm;
 	tm = gmtime (&t);
 +	if (tm == NULL) {
 +		return "(unknown)";
 +	}
 #ifdef HAVE_STRFTIME
 	(void) strftime (buf, sizeof buf, "%m/%d/%Y", tm);
 #else				/* !HAVE_STRFTIME */
 Index: shadow-4.5/src/usermod.c
 ===================================================================
 --- shadow-4.5.orig/src/usermod.c
 +++ shadow-4.5/src/usermod.c
@@ -210,6 +210,10 @@ static void date_to_str (/*@unique@*//*@
 	} else {
 		time_t t = (time_t) date;
 		tp = gmtime (&t);
 +		if (tp == NULL) {
 +			strncpy (buf, "unknown", maxsize);
 +			return;
 +		}
 #ifdef HAVE_STRFTIME
 		strftime (buf, maxsize, "%Y-%m-%d", tp);
 #else
--- a/shadow-4.3.1-manfix.patch
+++ b/shadow-4.3.1-manfix.patch
@ -1,266 +0,0 @@
 Index: shadow-4.5/man/groupmems.8.xml
 ===================================================================
 --- shadow-4.5.orig/man/groupmems.8.xml
 +++ shadow-4.5/man/groupmems.8.xml
@@ -179,20 +179,10 @@
   <refsect1 id='setup'>
     <title>SETUP</title>
     <para>
 -      The <command>groupmems</command> executable should be in mode
 -      <literal>2770</literal> as user <emphasis>root</emphasis> and in group
 -      <emphasis>groups</emphasis>. The system administrator can add users to
 -      group <emphasis>groups</emphasis> to allow or disallow them using the
 -      <command>groupmems</command> utility to manage their own group
 -      membership list.
 +      In this operating system the <command>groupmems</command> executable
 +      is not setuid and regular users cannot use it to manipulate
 +      the membership of their own group.
     </para>
 -
 -    <programlisting>
 -	$ groupadd -r groups
 -	$ chmod 2770 groupmems
 -	$ chown root.groups groupmems
 -	$ groupmems -g groups -a gk4
 -    </programlisting>
   </refsect1>
   <refsect1 id='configuration'>
 Index: shadow-4.5/man/chage.1.xml
 ===================================================================
 --- shadow-4.5.orig/man/chage.1.xml
 +++ shadow-4.5/man/chage.1.xml
@@ -102,6 +102,9 @@
 	    Set the number of days since January 1st, 1970 when the password
 	    was last changed. The date may also be expressed in the format
 	    YYYY-MM-DD (or the format more commonly used in your area).
 +	    If the <replaceable>LAST_DAY</replaceable> is set to
 +	    <emphasis>0</emphasis> the user is forced to change his password
 +	    on the next log on.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -119,6 +122,13 @@
 	    system again.
 	  </para>
 	  <para>
 +	    For example the following can be used to set an account to expire
 +	    in 180 days:
 +	  </para>
 +	  <programlisting>
 +	    chage -E $(date -d +180days +%Y-%m-%d)
 +	  </programlisting>
 +	  <para>
 	    Passing the number <emphasis remap='I'>-1</emphasis> as the
 	    <replaceable>EXPIRE_DATE</replaceable> will remove an account
 	    expiration date.
 Index: shadow-4.5/man/ja/man5/login.defs.5
 ===================================================================
 --- shadow-4.5.orig/man/ja/man5/login.defs.5
 +++ shadow-4.5/man/ja/man5/login.defs.5
@@ -147,10 +147,6 @@ PASS_MAX_DAYS, PASS_MIN_DAYS, PASS_WARN_
 shadow パスワード機能のどのプログラムが
 どのパラメータを使用するかを示したものである。
 .na
 -.IP chfn 12
 -CHFN_AUTH CHFN_RESTRICT
 -.IP chsh 12
 -CHFN_AUTH
 .IP groupadd 12
 GID_MAX GID_MIN
 .IP newusers 12
 Index: shadow-4.5/man/login.defs.5.xml
 ===================================================================
 --- shadow-4.5.orig/man/login.defs.5.xml
 +++ shadow-4.5/man/login.defs.5.xml
@@ -162,6 +162,17 @@
       long numeric parameters is machine-dependent.
     </para>
 +    <para>
 +      Please note that the parameters in this configuration file control the
 +      behavior of the tools from the shadow-utils component. None of these
 +      tools uses the PAM mechanism, and the utilities that use PAM (such as the
 +      passwd command) should be configured elsewhere. The only values that
 +      affect PAM modules are <emphasis>ENCRYPT_METHOD</emphasis> and <emphasis>SHA_CRYPT_MAX_ROUNDS</emphasis>
 +      for pam_unix module, <emphasis>FAIL_DELAY</emphasis> for pam_faildelay module,
 +      and <emphasis>UMASK</emphasis> for pam_umask module. Refer to
 +      pam(8) for more information.
 +    </para>
 +
     <para>The following configuration items are provided:</para>
     <variablelist remap='IP'>
@@ -252,16 +263,6 @@
 	</listitem>
       </varlistentry>
       <varlistentry>
 -	<term>chfn</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CHFN_AUTH</phrase>
 -	    CHFN_RESTRICT
 -	    <phrase condition="no_pam">LOGIN_STRING</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
 -      <varlistentry>
 	<term>chgpasswd</term>
 	<listitem>
 	  <para>
@@ -282,14 +283,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
 -      <varlistentry condition="no_pam">
 -	<term>chsh</term>
 -	<listitem>
 -	  <para>
 -	    CHSH_AUTH LOGIN_STRING
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <!-- expiry: no variables (CONSOLE_GROUPS linked, but not used) -->
       <!-- faillog: no variables -->
       <varlistentry>
@@ -350,34 +343,6 @@
 	  <para>LASTLOG_UID_MAX</para>
 	</listitem>
       </varlistentry>
 -      <varlistentry>
 -	<term>login</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CONSOLE</phrase>
 -	    CONSOLE_GROUPS DEFAULT_HOME
 -	    <phrase condition="no_pam">ENV_HZ ENV_PATH ENV_SUPATH
 -	    ENV_TZ ENVIRON_FILE</phrase>
 -	    ERASECHAR FAIL_DELAY
 -	    <phrase condition="no_pam">FAILLOG_ENAB</phrase>
 -	    FAKE_SHELL
 -	    <phrase condition="no_pam">FTMP_FILE</phrase>
 -	    HUSHLOGIN_FILE
 -	    <phrase condition="no_pam">ISSUE_FILE</phrase>
 -	    KILLCHAR
 -	    <phrase condition="no_pam">LASTLOG_ENAB LASTLOG_UID_MAX</phrase>
 -	    LOGIN_RETRIES
 -	    <phrase condition="no_pam">LOGIN_STRING</phrase>
 -	    LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB
 -	    <phrase condition="no_pam">MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE
 -	    MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB
 -	    QUOTAS_ENAB</phrase>
 -	    TTYGROUP TTYPERM TTYTYPE_FILE
 -	    <phrase condition="no_pam">ULIMIT UMASK</phrase>
 -	    USERGROUPS_ENAB
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <!-- logoutd: no variables -->
       <varlistentry>
 	<term>newgrp / sg</term>
@@ -405,17 +370,6 @@
 	</listitem>
       </varlistentry>
       <!-- nologin: no variables -->
 -      <varlistentry condition="no_pam">
 -	<term>passwd</term>
 -	<listitem>
 -	  <para>
 -	    ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB
 -	    PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN
 -	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
 -	    SHA_CRYPT_MIN_ROUNDS</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <varlistentry>
 	<term>pwck</term>
 	<listitem>
@@ -442,32 +396,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
 -      <varlistentry>
 -	<term>su</term>
 -	<listitem>
 -	  <para>
 -	    <phrase condition="no_pam">CONSOLE</phrase>
 -	    CONSOLE_GROUPS DEFAULT_HOME
 -	    <phrase condition="no_pam">ENV_HZ ENVIRON_FILE</phrase>
 -	    ENV_PATH ENV_SUPATH
 -	    <phrase condition="no_pam">ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB
 -	    MAIL_DIR MAIL_FILE QUOTAS_ENAB</phrase>
 -	    SULOG_FILE SU_NAME
 -	    <phrase condition="no_pam">SU_WHEEL_ONLY</phrase>
 -	    SYSLOG_SU_ENAB
 -	    <phrase condition="no_pam">USERGROUPS_ENAB</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
 -      <varlistentry>
 -	<term>sulogin</term>
 -	<listitem>
 -	  <para>
 -	    ENV_HZ
 -	    <phrase condition="no_pam">ENV_TZ</phrase>
 -	  </para>
 -	</listitem>
 -      </varlistentry>
       <varlistentry>
 	<term>useradd</term>
 	<listitem>
 Index: shadow-4.5/man/shadow.5.xml
 ===================================================================
 --- shadow-4.5.orig/man/shadow.5.xml
 +++ shadow-4.5/man/shadow.5.xml
@@ -208,8 +208,8 @@
 	  </para>
 	  <para>
 	    After expiration of the password and this expiration period is
 -	    elapsed, no login is possible using the current user's
 -	    password.  The user should contact her administrator.
 +	    elapsed, no login is possible for the user.
 +	    The user should contact her administrator.
 	  </para>
 	  <para>
 	    An empty field means that there are no enforcement of an
 Index: shadow-4.5/man/useradd.8.xml
 ===================================================================
 --- shadow-4.5.orig/man/useradd.8.xml
 +++ shadow-4.5/man/useradd.8.xml
@@ -347,6 +347,11 @@
 	    <option>CREATE_HOME</option> is not enabled, no home
 	    directories are created.
 	  </para>
 +	  <para>
 +	    The directory where the user's home directory is created must
 +	    exist and have proper SELinux context and permissions. Otherwise
 +	    the user's home directory cannot be created or accessed.
 +	  </para>
 	</listitem>
       </varlistentry>
       <varlistentry>
 Index: shadow-4.5/man/usermod.8.xml
 ===================================================================
 --- shadow-4.5.orig/man/usermod.8.xml
 +++ shadow-4.5/man/usermod.8.xml
@@ -132,7 +132,8 @@
 	    If the <option>-m</option>
 	    option is given, the contents of the current home directory will
 	    be moved to the new home directory, which is created if it does
 -	    not already exist.
 +	    not already exist. If the current home directory does not exist
 +	    the new home directory will not be created.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -256,7 +257,8 @@
 	<listitem>
 	  <para>
 	    Move the content of the user's home directory to the new
 -	    location.
 +	    location. If the current home directory does not exist
 +	    the new home directory will not be created.
 	  </para>
 	  <para>
 	    This option is only valid in combination with the
--- a/shadow-4.3.1-selinux-perms.patch
+++ b/shadow-4.3.1-selinux-perms.patch
@ -1,277 +0,0 @@
 Index: shadow-4.5/src/chgpasswd.c
 ===================================================================
 --- shadow-4.5.orig/src/chgpasswd.c
 +++ shadow-4.5/src/chgpasswd.c
@@ -39,6 +39,13 @@
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
 +#ifdef WITH_SELINUX
 +#include <selinux/selinux.h>
 +#include <selinux/avc.h>
 +#endif
 +#ifdef WITH_LIBAUDIT
 +#include <libaudit.h>
 +#endif
 #ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 #include "pam_defs.h"
@@ -76,6 +83,9 @@ static bool sgr_locked = false;
 #endif
 static bool gr_locked = false;
 +/* The name of the caller */
 +static char *myname = NULL;
 +
 /* local function prototypes */
 static void fail_exit (int code);
 static /*@noreturn@*/void usage (int status);
@@ -300,6 +310,63 @@ static void check_perms (void)
 #endif				/* ACCT_TOOLS_SETUID */
 }
 +#ifdef WITH_SELINUX
 +static int
 +log_callback (int type, const char *fmt, ...)
 +{
 +    int audit_fd;
 +    va_list ap;
 +
 +    va_start(ap, fmt);
 +#ifdef WITH_AUDIT
 +    audit_fd = audit_open();
 +
 +    if (audit_fd >= 0) {
 +	char *buf;
 +
 +	if (vasprintf (&buf, fmt, ap) < 0)
 +		goto ret;
 +	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
 +				   NULL, 0);
 +	audit_close(audit_fd);
 +	free(buf);
 +	goto ret;
 +    }
 +
 +#endif
 +    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
 +ret:
 +    va_end(ap);
 +    return 0;
 +}
 +
 +static void
 +selinux_check_root (void)
 +{
 +    int status = -1;
 +    security_context_t user_context;
 +    union selinux_callback old_callback;
 +
 +    if (is_selinux_enabled() < 1)
 +	return;
 +
 +    old_callback = selinux_get_callback(SELINUX_CB_LOG);
 +    /* setup callbacks */
 +    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
 +    if ((status = getprevcon(&user_context)) < 0) {
 +	selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +	exit(1);
 +    }
 +
 +    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
 +
 +    selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +    freecon(user_context);
 +    if (status != 0 && security_getenforce() != 0)
 +	exit(1);
 +}
 +#endif
 +
 /*
  * open_files - lock and open the group databases
  */
@@ -393,6 +460,7 @@ int main (int argc, char **argv)
 	const struct group *gr;
 	struct group newgr;
 +	struct passwd *pw = NULL;
 	int errors = 0;
 	int line = 0;
@@ -408,8 +476,33 @@ int main (int argc, char **argv)
 	OPENLOG ("chgpasswd");
 +#ifdef WITH_AUDIT
 +	audit_help_open ();
 +#endif
 +
 +	/*
 +	 * Determine the name of the user that invoked this command. This
 +	 * is really hit or miss because there are so many ways that command
 +	 * can be executed and so many ways to trip up the routines that
 +	 * report the user name.
 +	 */
 +	pw = get_my_pwent ();
 +	if (NULL == pw) {
 +		fprintf (stderr, _("%s: Cannot determine your user name.\n"),
 +		         Prog);
 +		SYSLOG ((LOG_WARN,
 +		         "Cannot determine the user name of the caller (UID %lu)",
 +		         (unsigned long) getuid ()));
 +		exit (E_NOPERM);
 +	}
 +	myname = xstrdup (pw->pw_name);
 +
 	check_perms ();
 +#ifdef WITH_SELINUX
 +	selinux_check_root ();
 +#endif
 +
 #ifdef SHADOWGRP
 	is_shadow_grp = sgr_file_present ();
 #endif
@@ -536,6 +629,15 @@ int main (int argc, char **argv)
 			newgr.gr_passwd = cp;
 		}
 +#ifdef WITH_AUDIT
 +		{
 +
 +			audit_logger_with_group (AUDIT_GRP_CHAUTHTOK, Prog,
 +		              "change-password",
 +		              myname, AUDIT_NO_ID, gr->gr_name,
 +		              SHADOW_AUDIT_SUCCESS);
 +		}
 +#endif
 		/* 
 		 * The updated group file entry is then put back and will
 		 * be written to the group file later, after all the
 Index: shadow-4.5/src/chpasswd.c
 ===================================================================
 --- shadow-4.5.orig/src/chpasswd.c
 +++ shadow-4.5/src/chpasswd.c
@@ -39,6 +39,13 @@
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
 +#ifdef WITH_SELINUX
 +#include <selinux/selinux.h>
 +#include <selinux/avc.h>
 +#endif
 +#ifdef WITH_LIBAUDIT
 +#include <libaudit.h>
 +#endif
 #ifdef USE_PAM
 #include "pam_defs.h"
 #endif				/* USE_PAM */
@@ -297,6 +304,63 @@ static void check_perms (void)
 #endif				/* USE_PAM */
 }
 +#ifdef WITH_SELINUX
 +static int
 +log_callback (int type, const char *fmt, ...)
 +{
 +    int audit_fd;
 +    va_list ap;
 +
 +    va_start(ap, fmt);
 +#ifdef WITH_AUDIT
 +    audit_fd = audit_open();
 +
 +    if (audit_fd >= 0) {
 +	char *buf;
 +
 +	if (vasprintf (&buf, fmt, ap) < 0)
 +		goto ret;
 +	audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
 +				   NULL, 0);
 +	audit_close(audit_fd);
 +	free(buf);
 +	goto ret;
 +    }
 +
 +#endif
 +    vsyslog (LOG_USER | LOG_INFO, fmt, ap);
 +ret:
 +    va_end(ap);
 +    return 0;
 +}
 +
 +static void
 +selinux_check_root (void)
 +{
 +    int status = -1;
 +    security_context_t user_context;
 +    union selinux_callback old_callback;
 +
 +    if (is_selinux_enabled() < 1)
 +	return;
 +
 +    old_callback = selinux_get_callback(SELINUX_CB_LOG);
 +    /* setup callbacks */
 +    selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
 +    if ((status = getprevcon(&user_context)) < 0) {
 +	selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +	exit(1);
 +    }
 +
 +    status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
 +
 +    selinux_set_callback(SELINUX_CB_LOG, old_callback);
 +    freecon(user_context);
 +    if (status != 0 && security_getenforce() != 0)
 +	exit(1);
 +}
 +#endif
 +
 /*
  * open_files - lock and open the password databases
  */
@@ -405,8 +469,16 @@ int main (int argc, char **argv)
 	OPENLOG ("chpasswd");
 +#ifdef WITH_AUDIT
 +	audit_help_open ();
 +#endif
 +
 	check_perms ();
 +#ifdef WITH_SELINUX
 +	selinux_check_root ();
 +#endif
 +
 #ifdef USE_PAM
 	if (!use_pam)
 #endif				/* USE_PAM */
@@ -566,6 +638,11 @@ int main (int argc, char **argv)
 			newpw.pw_passwd = cp;
 		}
 +#ifdef WITH_AUDIT
 +		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
 +		              "updating-password",
 +		              pw->pw_name, (unsigned int) pw->pw_uid, 1);
 +#endif
 		/* 
 		 * The updated password file entry is then put back and will
 		 * be written to the password file later, after all the
 Index: shadow-4.5/src/Makefile.am
 ===================================================================
 --- shadow-4.5.orig/src/Makefile.am
 +++ shadow-4.5/src/Makefile.am
@@ -91,9 +91,9 @@ chage_LDADD    = $(LDADD) $(LIBPAM_SUID)
 newuidmap_LDADD    = $(LDADD) $(LIBSELINUX) $(LIBCAP)
 newgidmap_LDADD    = $(LDADD) $(LIBSELINUX) $(LIBCAP)
 chfn_LDADD     = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
 -chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBSELINUX) $(LIBCRYPT)
 +chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBSELINUX) $(LIBAUDIT) $(LIBCRYPT)
 chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
 -chpasswd_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT)
 +chpasswd_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBAUDIT) $(LIBCRYPT)
 gpasswd_LDADD  = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT)
 groupadd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
 groupdel_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
--- a/shadow-4.5-crypt_h.patch
+++ b/shadow-4.5-crypt_h.patch
@ -1,37 +0,0 @@
 Index: shadow-4.5/configure.ac
 ===================================================================
 --- shadow-4.5.orig/configure.ac
 +++ shadow-4.5/configure.ac
@@ -36,7 +36,7 @@ AC_HEADER_STDC
 	utmpx.h termios.h termio.h sgtty.h sys/ioctl.h syslog.h paths.h \
 	utime.h ulimit.h sys/capability.h sys/resource.h gshadow.h lastlog.h \
 	locale.h rpc/key_prot.h netdb.h acl/libacl.h attr/libattr.h \
 -	attr/error_context.h)
 +	attr/error_context.h crypt.h)
 dnl shadow now uses the libc's shadow implementation
 AC_CHECK_HEADER([shadow.h],,[AC_MSG_ERROR([You need a libc with shadow.h])])
 Index: shadow-4.5/lib/defines.h
 ===================================================================
 --- shadow-4.5.orig/lib/defines.h
 +++ shadow-4.5/lib/defines.h
@@ -4,6 +4,8 @@
 #ifndef _DEFINES_H_
 #define _DEFINES_H_
 +#include "config.h"
 +
 #if HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
@@ -94,6 +96,10 @@ char *strchr (), *strrchr (), *strtok ()
 # include <unistd.h>
 #endif
 +#if HAVE_CRYPT_H
 +# include <crypt.h>		/* crypt(3) may be defined in here */
 +#endif
 +
 #if TIME_WITH_SYS_TIME
 # include <sys/time.h>
 # include <time.h>
--- a/shadow-4.5-long-entry.patch
+++ b/shadow-4.5-long-entry.patch
@ -1,84 +0,0 @@
 diff -up shadow-4.5/lib/defines.h.long-entry shadow-4.5/lib/defines.h
 --- shadow-4.5/lib/defines.h.long-entry	2014-09-01 16:36:40.000000000 +0200
 +++ shadow-4.5/lib/defines.h	2018-04-20 11:53:07.419308212 +0200
@@ -382,4 +382,7 @@ extern char *strerror ();
 #  define shadow_getenv(name) getenv(name)
 #endif
 +/* Maximum length of passwd entry */
 +#define PASSWD_ENTRY_MAX_LENGTH 32768
 +
 #endif				/* _DEFINES_H_ */
 diff -up shadow-4.5/lib/pwio.c.long-entry shadow-4.5/lib/pwio.c
 --- shadow-4.5/lib/pwio.c.long-entry	2015-11-17 17:45:15.000000000 +0100
 +++ shadow-4.5/lib/pwio.c	2018-04-20 12:10:24.400837235 +0200
@@ -79,7 +79,10 @@ static int passwd_put (const void *ent,
 	    || (pw->pw_gid == (gid_t)-1)
 	    || (valid_field (pw->pw_gecos, ":\n") == -1)
 	    || (valid_field (pw->pw_dir, ":\n") == -1)
 -	    || (valid_field (pw->pw_shell, ":\n") == -1)) {
 +	    || (valid_field (pw->pw_shell, ":\n") == -1)
 +	    || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
 +	        strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
 +	        strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
 		return -1;
 	}
 diff -up shadow-4.5/lib/sgetpwent.c.long-entry shadow-4.5/lib/sgetpwent.c
 --- shadow-4.5/lib/sgetpwent.c.long-entry	2014-09-01 16:36:40.000000000 +0200
 +++ shadow-4.5/lib/sgetpwent.c	2018-04-20 12:16:31.911513808 +0200
@@ -57,7 +57,7 @@
 struct passwd *sgetpwent (const char *buf)
 {
 	static struct passwd pwent;
 -	static char pwdbuf[1024];
 +	static char pwdbuf[PASSWD_ENTRY_MAX_LENGTH];
 	register int i;
 	register char *cp;
 	char *fields[NFIELDS];
@@ -67,8 +67,10 @@ struct passwd *sgetpwent (const char *bu
 	 * the password structure remain valid.
 	 */
 -	if (strlen (buf) >= sizeof pwdbuf)
 +	if (strlen (buf) >= sizeof pwdbuf) {
 +		fprintf (stderr, "Too long passwd entry encountered, file corruption?\n");
 		return 0;	/* fail if too long */
 +	}
 	strcpy (pwdbuf, buf);
 	/*
 diff -up shadow-4.5/lib/sgetspent.c.long-entry shadow-4.5/lib/sgetspent.c
 --- shadow-4.5/lib/sgetspent.c.long-entry	2014-09-01 16:36:40.000000000 +0200
 +++ shadow-4.5/lib/sgetspent.c	2018-04-20 12:16:54.505056257 +0200
@@ -48,7 +48,7 @@
  */
 struct spwd *sgetspent (const char *string)
 {
 -	static char spwbuf[1024];
 +	static char spwbuf[PASSWD_ENTRY_MAX_LENGTH];
 	static struct spwd spwd;
 	char *fields[FIELDS];
 	char *cp;
@@ -61,6 +61,7 @@ struct spwd *sgetspent (const char *stri
 	 */
 	if (strlen (string) >= sizeof spwbuf) {
 +		fprintf (stderr, "Too long shadow entry encountered, file corruption?\n");
 		return 0;	/* fail if too long */
 	}
 	strcpy (spwbuf, string);
 diff -up shadow-4.5/lib/shadowio.c.long-entry shadow-4.5/lib/shadowio.c
 --- shadow-4.5/lib/shadowio.c.long-entry	2016-12-07 06:30:41.000000001 +0100
 +++ shadow-4.5/lib/shadowio.c	2018-04-20 12:12:03.292171667 +0200
@@ -79,7 +79,9 @@ static int shadow_put (const void *ent,
 	if (   (NULL == sp)
 	    || (valid_field (sp->sp_namp, ":\n") == -1)
 -	    || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
 +	    || (valid_field (sp->sp_pwdp, ":\n") == -1)
 +	    || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
 +	        1000 > PASSWD_ENTRY_MAX_LENGTH)) {
 		return -1;
 	}
--- a/shadow-4.5-usermod-unlock.patch
+++ b/shadow-4.5-usermod-unlock.patch
@ -1,64 +0,0 @@
 Index: shadow-4.5/src/usermod.c
 ===================================================================
 --- shadow-4.5.orig/src/usermod.c
 +++ shadow-4.5/src/usermod.c
@@ -455,14 +455,17 @@ static char *new_pw_passwd (char *pw_pas
 		strcat (buf, pw_pass);
 		pw_pass = buf;
 	} else if (Uflg && pw_pass[0] == '!') {
 -		char *s;
 +		char *s = pw_pass;
 -		if (pw_pass[1] == '\0') {
 +		while ('!' == *s)
 +			++s;
 +
 +		if (*s == '\0') {
 			fprintf (stderr,
 			         _("%s: unlocking the user's password would result in a passwordless account.\n"
 			           "You should set a password with usermod -p to unlock this user's password.\n"),
 			         Prog);
 -			return pw_pass;
 +			return NULL;
 		}
 #ifdef WITH_AUDIT
@@ -471,12 +474,15 @@ static char *new_pw_passwd (char *pw_pas
 		              user_newname, (unsigned int) user_newid, 1);
 #endif
 		SYSLOG ((LOG_INFO, "unlock user '%s' password", user_newname));
 -		s = pw_pass;
 -		while ('\0' != *s) {
 -			*s = *(s + 1);
 -			s++;
 -		}
 +		memmove (pw_pass, s, strlen (s) + 1);
 	} else if (pflg) {
 +		if (strchr (user_pass, ':') != NULL) {
 +			fprintf (stderr,
 +			         _("%s: The password field cannot contain a colon character.\n"),
 +			         Prog);
 +			return NULL;
 +
 +		}
 #ifdef WITH_AUDIT
 		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
 		              "updating-password",
@@ -525,6 +531,8 @@ static void new_pwent (struct passwd *pw
 	if (   (!is_shadow_pwd)
 	    || (strcmp (pwent->pw_passwd, SHADOW_PASSWD_STRING) != 0)) {
 		pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd);
 +		if (pwent->pw_passwd == NULL)
 +			fail_exit (E_PW_UPDATE);
 	}
 	if (uflg) {
@@ -639,6 +647,8 @@ static void new_spent (struct spwd *spen
 	 *  + aging has been requested
 	 */
 	spent->sp_pwdp = new_pw_passwd (spent->sp_pwdp);
 +	if (spent->sp_pwdp == NULL)
 +		fail_exit(E_PW_UPDATE);
 	if (pflg) {
 		spent->sp_lstchg = (long) gettime () / SCALE;
--- a/shadow-4.6-audit-update.patch
+++ b/shadow-4.6-audit-update.patch
--- a/shadow-4.6-getenforce.patch
+++ b/shadow-4.6-getenforce.patch
@ -1,21 +0,0 @@
 diff -up shadow-4.6/lib/selinux.c.getenforce shadow-4.6/lib/selinux.c
 --- shadow-4.6/lib/selinux.c.getenforce	2018-05-28 15:10:15.870315221 +0200
 +++ shadow-4.6/lib/selinux.c	2018-05-28 15:10:15.894315731 +0200
@@ -75,7 +75,7 @@ int set_selinux_file_context (const char
 	}
 	return 0;
     error:
 -	if (security_getenforce () != 0) {
 +	if (security_getenforce () > 0) {
 		return 1;
 	}
 	return 0;
@@ -95,7 +95,7 @@ int reset_selinux_file_context (void)
 		selinux_checked = true;
 	}
 	if (selinux_enabled) {
 -		if (setfscreatecon (NULL) != 0) {
 +		if (setfscreatecon (NULL) != 0 && security_getenforce () > 0) {
 			return 1;
 		}
 	}
--- a/shadow-4.6-move-home.patch
+++ b/shadow-4.6-move-home.patch
@ -1,15 +0,0 @@
 diff -up shadow-4.6/src/usermod.c.move-home shadow-4.6/src/usermod.c
 --- shadow-4.6/src/usermod.c.move-home	2018-05-28 14:59:05.594076665 +0200
 +++ shadow-4.6/src/usermod.c	2018-05-28 15:00:28.479837392 +0200
@@ -1845,6 +1845,11 @@ static void move_home (void)
 			         Prog, prefix_user_home, prefix_user_newhome);
 			fail_exit (E_HOMEDIR);
 		}
 +	} else {
 +		fprintf (stderr,
 +		         _("%s: The previous home directory (%s) does "
 +		           "not exist or is inaccessible. Move cannot be completed.\n"),
 +		         Prog, prefix_user_home);
 	}
 }
--- a/shadow-4.6-orig-context.patch
+++ b/shadow-4.6-orig-context.patch
@ -1,128 +0,0 @@
 diff -up shadow-4.6/lib/commonio.c.orig-context shadow-4.6/lib/commonio.c
 --- shadow-4.6/lib/commonio.c.orig-context	2018-04-29 18:42:37.000000000 +0200
 +++ shadow-4.6/lib/commonio.c	2018-05-28 14:56:37.287929667 +0200
@@ -961,7 +961,7 @@ int commonio_close (struct commonio_db *
 		snprintf (buf, sizeof buf, "%s-", db->filename);
 #ifdef WITH_SELINUX
 -		if (set_selinux_file_context (buf) != 0) {
 +		if (set_selinux_file_context (buf, db->filename) != 0) {
 			errors++;
 		}
 #endif
@@ -994,7 +994,7 @@ int commonio_close (struct commonio_db *
 	snprintf (buf, sizeof buf, "%s+", db->filename);
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (buf) != 0) {
 +	if (set_selinux_file_context (buf, db->filename) != 0) {
 		errors++;
 	}
 #endif
 diff -up shadow-4.6/libmisc/copydir.c.orig-context shadow-4.6/libmisc/copydir.c
 --- shadow-4.6/libmisc/copydir.c.orig-context	2018-04-29 18:42:37.000000000 +0200
 +++ shadow-4.6/libmisc/copydir.c	2018-05-28 14:56:37.287929667 +0200
@@ -484,7 +484,7 @@ static int copy_dir (const char *src, co
 	 */
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (dst) != 0) {
 +	if (set_selinux_file_context (dst, NULL) != 0) {
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
@@ -605,7 +605,7 @@ static int copy_symlink (const char *src
 	}
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (dst) != 0) {
 +	if (set_selinux_file_context (dst, NULL) != 0) {
 		free (oldlink);
 		return -1;
 	}
@@ -684,7 +684,7 @@ static int copy_special (const char *src
 	int err = 0;
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (dst) != 0) {
 +	if (set_selinux_file_context (dst, NULL) != 0) {
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
@@ -744,7 +744,7 @@ static int copy_file (const char *src, c
 		return -1;
 	}
 #ifdef WITH_SELINUX
 -	if (set_selinux_file_context (dst) != 0) {
 +	if (set_selinux_file_context (dst, NULL) != 0) {
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
 diff -up shadow-4.6/lib/prototypes.h.orig-context shadow-4.6/lib/prototypes.h
 --- shadow-4.6/lib/prototypes.h.orig-context	2018-04-29 18:42:37.000000000 +0200
 +++ shadow-4.6/lib/prototypes.h	2018-05-28 14:56:37.287929667 +0200
@@ -326,7 +326,7 @@ extern /*@observer@*/const char *crypt_m
 /* selinux.c */
 #ifdef WITH_SELINUX
 -extern int set_selinux_file_context (const char *dst_name);
 +extern int set_selinux_file_context (const char *dst_name, const char *orig_name);
 extern int reset_selinux_file_context (void);
 #endif
 diff -up shadow-4.6/lib/selinux.c.orig-context shadow-4.6/lib/selinux.c
 --- shadow-4.6/lib/selinux.c.orig-context	2018-04-29 18:42:37.000000000 +0200
 +++ shadow-4.6/lib/selinux.c	2018-05-28 14:56:37.287929667 +0200
@@ -50,7 +50,7 @@ static bool selinux_enabled;
  *	Callers may have to Reset SELinux to create files with default
  *	contexts with reset_selinux_file_context
  */
 -int set_selinux_file_context (const char *dst_name)
 +int set_selinux_file_context (const char *dst_name, const char *orig_name)
 {
 	/*@null@*/security_context_t scontext = NULL;
@@ -62,19 +62,23 @@ int set_selinux_file_context (const char
 	if (selinux_enabled) {
 		/* Get the default security context for this file */
 		if (matchpathcon (dst_name, 0, &scontext) < 0) {
 -			if (security_getenforce () != 0) {
 -				return 1;
 -			}
 +			/* We could not get the default, copy the original */
 +			if (orig_name == NULL)
 +				goto error;
 +			if (getfilecon (orig_name, &scontext) < 0)
 +				goto error;
 		}
 		/* Set the security context for the next created file */
 -		if (setfscreatecon (scontext) < 0) {
 -			if (security_getenforce () != 0) {
 -				return 1;
 -			}
 -		}
 +		if (setfscreatecon (scontext) < 0)
 +			goto error;
 		freecon (scontext);
 	}
 	return 0;
 +    error:
 +	if (security_getenforce () != 0) {
 +		return 1;
 +	}
 +	return 0;
 }
 /*
 diff -up shadow-4.6/src/useradd.c.orig-context shadow-4.6/src/useradd.c
 --- shadow-4.6/src/useradd.c.orig-context	2018-05-28 14:56:37.288929688 +0200
 +++ shadow-4.6/src/useradd.c	2018-05-28 14:58:02.242730903 +0200
@@ -2020,7 +2020,7 @@ static void create_home (void)
 		++bhome;
 #ifdef WITH_SELINUX
 -		if (set_selinux_file_context (prefix_user_home) != 0) {
 +		if (set_selinux_file_context (prefix_user_home, NULL) != 0) {
 			fprintf (stderr,
 			         _("%s: cannot set SELinux context for home directory %s\n"),
 			         Prog, user_home);
--- a/shadow-4.6-redhat.patch
+++ b/shadow-4.6-redhat.patch
@ -1,41 +0,0 @@
 diff -up shadow-4.6/src/useradd.c.redhat shadow-4.6/src/useradd.c
 --- shadow-4.6/src/useradd.c.redhat	2018-04-29 18:42:37.000000000 +0200
 +++ shadow-4.6/src/useradd.c	2018-05-28 13:37:16.695651258 +0200
@@ -98,7 +98,7 @@ const char *Prog;
 static gid_t def_group = 100;
 static const char *def_gname = "other";
 static const char *def_home = "/home";
 -static const char *def_shell = "";
 +static const char *def_shell = "/sbin/nologin";
 static const char *def_template = SKEL_DIR;
 static const char *def_create_mail_spool = "no";
@@ -108,7 +108,7 @@ static const char *def_expire = "";
 #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
 static const char *user_name = "";
 -static const char *user_pass = "!";
 +static const char *user_pass = "!!";
 static uid_t user_id;
 static gid_t user_gid;
 static const char *user_comment = "";
@@ -1114,9 +1114,9 @@ static void process_flags (int argc, cha
 		};
 		while ((c = getopt_long (argc, argv,
 #ifdef WITH_SELINUX
 -		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:UZ:",
 +		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:UZ:",
 #else				/* !WITH_SELINUX */
 -		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:U",
 +		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:P:s:u:U",
 #endif				/* !WITH_SELINUX */
 		                         long_options, NULL)) != -1) {
 			switch (c) {
@@ -1267,6 +1267,7 @@ static void process_flags (int argc, cha
 			case 'M':
 				Mflg = true;
 				break;
 +			case 'n':
 			case 'N':
 				Nflg = true;
 				break;
--- a/shadow-4.6-selinux.patch
+++ b/shadow-4.6-selinux.patch
@ -1,117 +0,0 @@
 diff -up shadow-4.6/lib/semanage.c.selinux shadow-4.6/lib/semanage.c
 --- shadow-4.6/lib/semanage.c.selinux	2018-04-29 18:42:37.000000000 +0200
 +++ shadow-4.6/lib/semanage.c	2018-05-28 13:38:20.551008911 +0200
@@ -294,6 +294,9 @@ int set_seuser (const char *login_name,
 	ret = 0;
 +        /* drop obsolete matchpathcon cache */
 +        matchpathcon_fini();
 +
 done:
 	semanage_seuser_key_free (key);
 	semanage_handle_destroy (handle);
@@ -369,6 +372,10 @@ int del_seuser (const char *login_name)
 	}
 	ret = 0;
 +
 +        /* drop obsolete matchpathcon cache */
 +        matchpathcon_fini();
 +
 done:
 	semanage_handle_destroy (handle);
 	return ret;
 diff -up shadow-4.6/src/useradd.c.selinux shadow-4.6/src/useradd.c
 --- shadow-4.6/src/useradd.c.selinux	2018-05-28 13:43:30.996748997 +0200
 +++ shadow-4.6/src/useradd.c	2018-05-28 13:44:04.645486199 +0200
@@ -2120,6 +2120,7 @@ static void create_mail (void)
  */
 int main (int argc, char **argv)
 {
 +	int rv = E_SUCCESS;
 #ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
 	pam_handle_t *pamh = NULL;
@@ -2342,27 +2343,12 @@ int main (int argc, char **argv)
 	usr_update ();
 -	if (mflg) {
 -		create_home ();
 -		if (home_added) {
 -			copy_tree (def_template, prefix_user_home, false, false,
 -			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
 -		} else {
 -			fprintf (stderr,
 -			         _("%s: warning: the home directory already exists.\n"
 -			           "Not copying any file from skel directory into it.\n"),
 -			         Prog);
 -		}
 -
 -	}
 -
 -	/* Do not create mail directory for system accounts */
 -	if (!rflg) {
 -		create_mail ();
 -	}
 -
 	close_files ();
 +	nscd_flush_cache ("passwd");
 +	nscd_flush_cache ("group");
 +	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
 +
 	/*
 	 * tallylog_reset needs to be able to lookup
 	 * a valid existing user name,
@@ -2373,8 +2358,9 @@ int main (int argc, char **argv)
 	}
 #ifdef WITH_SELINUX
 -	if (Zflg) {
 -		if (set_seuser (user_name, user_selinux) != 0) {
 +	if (Zflg && *user_selinux) {
 +		if (is_selinux_enabled () > 0) {
 +		    if (set_seuser (user_name, user_selinux) != 0) {
 			fprintf (stderr,
 			         _("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
 			         Prog, user_name, user_selinux);
@@ -2383,15 +2369,31 @@ int main (int argc, char **argv)
 			              "adding SELinux user mapping",
 			              user_name, (unsigned int) user_id, 0);
 #endif				/* WITH_AUDIT */
 -			fail_exit (E_SE_UPDATE);
 +			rv = E_SE_UPDATE;
 +		    }
 		}
 	}
 -#endif				/* WITH_SELINUX */
 +#endif
 -	nscd_flush_cache ("passwd");
 -	nscd_flush_cache ("group");
 -	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
 +	if (mflg) {
 +		create_home ();
 +		if (home_added) {
 +			copy_tree (def_template, prefix_user_home, false, true,
 +			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
 +		} else {
 +			fprintf (stderr,
 +			         _("%s: warning: the home directory already exists.\n"
 +			           "Not copying any file from skel directory into it.\n"),
 +			         Prog);
 +		}
 +
 +	}
 +
 +	/* Do not create mail directory for system accounts */
 +	if (!rflg) {
 +		create_mail ();
 +	}
 -	return E_SUCCESS;
 +	return rv;
 }
--- a/shadow-4.6-usermod-crash.patch
+++ b/shadow-4.6-usermod-crash.patch
@ -1,42 +0,0 @@
 diff -up shadow-4.6/libmisc/prefix_flag.c.usermod-crash shadow-4.6/libmisc/prefix_flag.c
 --- shadow-4.6/libmisc/prefix_flag.c.usermod-crash	2018-04-29 18:42:37.000000000 +0200
 +++ shadow-4.6/libmisc/prefix_flag.c	2018-05-28 15:14:10.642302440 +0200
@@ -319,6 +319,7 @@ extern struct group *prefix_getgr_nam_gi
 {
 	long long int gid;
 	char *endptr;
 +	struct group *g;
 	if (NULL == grname) {
 		return NULL;
@@ -333,7 +334,8 @@ extern struct group *prefix_getgr_nam_gi
 	    	&& (gid == (gid_t)gid)) {
 			return prefix_getgrgid ((gid_t) gid);
 		}
 -		return prefix_getgrnam (grname);
 +		g = prefix_getgrnam (grname);
 +		return g ? __gr_dup(g) : NULL;
 	}
 	else
 		return getgr_nam_gid(grname);
 diff -up shadow-4.6/src/usermod.c.usermod-crash shadow-4.6/src/usermod.c
 --- shadow-4.6/src/usermod.c.usermod-crash	2018-05-28 15:12:37.920332763 +0200
 +++ shadow-4.6/src/usermod.c	2018-05-28 15:15:50.337422470 +0200
@@ -1276,11 +1276,13 @@ static void process_flags (int argc, cha
 		prefix_user_home = xmalloc(len);
 		wlen = snprintf(prefix_user_home, len, "%s/%s", prefix, user_home);
 		assert (wlen == (int) len -1);
 +		if (user_newhome) {
 +			len = strlen(prefix) + strlen(user_newhome) + 2;
 +			prefix_user_newhome = xmalloc(len);
 +			wlen = snprintf(prefix_user_newhome, len, "%s/%s", prefix, user_newhome);
 +			assert (wlen == (int) len -1);
 +		}
 -		len = strlen(prefix) + strlen(user_newhome) + 2;
 -		prefix_user_newhome = xmalloc(len);
 -		wlen = snprintf(prefix_user_newhome, len, "%s/%s", prefix, user_newhome);
 -		assert (wlen == (int) len -1);
 	}
 	else {
 		prefix_user_home = user_home;
--- a/shadow.spec
+++ b/shadow.spec
@ -1,6 +1,6 @@
 Name: shadow
 Version: 4.7
-Release: 7
+Release: 8
 Epoch: 2
 License: BSD and GPLv2+
 Summary: Tools for managing accounts and shadow password files
@ -14,9 +14,9 @@ Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
 # fix unknown item 'LASTLOG_MAX_UID'
 Patch1:    usermod.c-Fix-invalid-variable-name.patch
 Patch2:    shadow-4.5-goodname.patch
-Patch9000: shadow-4.1.5.1-var-lock.patch
+Patch3:    shadow-4.1.5.1-var-lock.patch
-Patch9001: shadow-utils-fix-lock-file-residue.patch
+Patch4:    shadow-utils-fix-lock-file-residue.patch
-Patch9002: shadow-utils-fix-invalid-path.patch
+Patch5:    shadow-utils-fix-invalid-path.patch
 BuildRequires: gcc, libselinux-devel, audit-libs-devel, libsemanage-devel
 BuildRequires: libacl-devel, libattr-devel
@ -165,6 +165,9 @@ done
 %{_mandir}/*/*
 %changelog
 * Fri Feb 21 2020 openEuler Buildteam <buildteam@openEuler.org> - 2:4.7-8
 - Remove redundant patches
 * Thu Feb 6 2020 openEuler Buildteam <buildteam@openEuler.org> - 2:4.7-7
 - User name can start with an upper case letter
--- a/su.c-run-pam_getenvlist-after-setup_env.patch
+++ b/su.c-run-pam_getenvlist-after-setup_env.patch
@ -1,79 +0,0 @@
 From 89b96cb85cbd86a3f07a47e5e6826f7c5a69e3d5 Mon Sep 17 00:00:00 2001
 From: Michael Vogt <mvo@ubuntu.com>
 Date: Mon, 25 Jun 2018 16:00:17 +0200
 Subject: [PATCH 07/19] su.c: run pam_getenvlist() after setup_env
 When "su -l" is used the behaviour is described as similar to
 a direct login. However login.c is doing a setup_env(pw) and then a
 pam_getenvlist() in this scenario. But su.c is doing it the other
 way around. Which means that the value of PATH from /etc/environment
 is overriden. I think this is a bug because:
 The man-page claims that "-l": "provides an environment similar
 to what the user would expect had the user logged in directly."
 And login.c is using the PATH from /etc/environment.
 This will fix:
 https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/984390
 ---
 src/su.c | 35 +++++++++++++++--------------------
 1 file changed, 15 insertions(+), 20 deletions(-)
 diff --git a/src/su.c b/src/su.c
 index 685f7bb0..fc0e826f 100644
 --- a/src/su.c
 +++ b/src/su.c
@@ -913,27 +913,7 @@ static void set_environment (struct passwd *pw)
 		addenv ("IFS= \t\n", NULL);	/* ... instead, set a safe IFS */
 	}
 -#ifdef USE_PAM
 -	/* we need to setup the environment *after* pam_open_session(),
 -	 * else the UID is changed before stuff like pam_xauth could
 -	 * run, and we cannot access /etc/shadow and co
 -	 */
 -	environ = newenvp;	/* make new environment active */
 -
 -	if (change_environment) {
 -		/* update environment with all pam set variables */
 -		char **envcp = pam_getenvlist (pamh);
 -		if (NULL != envcp) {
 -			while (NULL != *envcp) {
 -				addenv (*envcp, NULL);
 -				envcp++;
 -			}
 -		}
 -	}
 -
 -#else				/* !USE_PAM */
 	environ = newenvp;	/* make new environment active */
 -#endif				/* !USE_PAM */
 	if (change_environment) {
 		if (fakelogin) {
@@ -948,6 +928,21 @@ static void set_environment (struct passwd *pw)
 			addenv ("LOGNAME", pw->pw_name);
 			addenv ("SHELL", shellstr);
 		}
 +
 +#ifdef USE_PAM
 +	        /* we need to setup the environment *after* pam_open_session(),
 +                 * else the UID is changed before stuff like pam_xauth could
 +                 * run, and we cannot access /etc/shadow and co
 +                 */
 +		/* update environment with all pam set variables */
 +		char **envcp = pam_getenvlist (pamh);
 +		if (NULL != envcp) {
 +			while (NULL != *envcp) {
 +				addenv (*envcp, NULL);
 +				envcp++;
 +			}
 +		}
 +#endif				/* !USE_PAM */
 	}
 }
 -- 
 2.19.1
--- a/useradd-fix-segfault-trying-to-overwrite-const-data-.patch
+++ b/useradd-fix-segfault-trying-to-overwrite-const-data-.patch
@ -1,174 +0,0 @@
 From 10e388efc2c786d1ec4ed007891bfefa8826b6fd Mon Sep 17 00:00:00 2001
 From: Tomas Mraz <tmraz@fedoraproject.org>
 Date: Fri, 12 Oct 2018 10:14:02 +0200
 Subject: [PATCH 11/19] useradd: fix segfault trying to overwrite const data
 with mkstemp
 Also fix memory leaks in error paths.
 ---
 src/useradd.c | 56 +++++++++++++++++++++++++++++++++------------------
 1 file changed, 36 insertions(+), 20 deletions(-)
 diff --git a/src/useradd.c b/src/useradd.c
 index ca90f076..85fe0ddf 100644
 --- a/src/useradd.c
 +++ b/src/useradd.c
@@ -343,7 +343,7 @@ static void fail_exit (int code)
 static void get_defaults (void)
 {
 	FILE *fp;
 -	char* default_file = USER_DEFAULTS_FILE;
 +	char *default_file = USER_DEFAULTS_FILE;
 	char buf[1024];
 	char *cp;
@@ -353,6 +353,8 @@ static void get_defaults (void)
 		len = strlen(prefix) + strlen(USER_DEFAULTS_FILE) + 2;
 		default_file = malloc(len);
 +                if (default_file == NULL)
 +                       return;
 		wlen = snprintf(default_file, len, "%s/%s", prefix, USER_DEFAULTS_FILE);
 		assert (wlen == (int) len -1);
 	}
@@ -363,7 +365,7 @@ static void get_defaults (void)
 	fp = fopen (default_file, "r");
 	if (NULL == fp) {
 -		return;
 +		goto getdef_err;
 	}
 	/*
@@ -474,7 +476,7 @@ static void get_defaults (void)
 		}
 	}
 	(void) fclose (fp);
 -
 +     getdef_err:
 	if(prefix[0]) {
 		free(default_file);
 	}
@@ -509,8 +511,8 @@ static int set_defaults (void)
 	FILE *ifp;
 	FILE *ofp;
 	char buf[1024];
 -	char* new_file = NEW_USER_FILE;
 -	char* default_file = USER_DEFAULTS_FILE;
 +	char *new_file = NULL;
 +	char *default_file = USER_DEFAULTS_FILE;
 	char *cp;
 	int ofd;
 	int wlen;
@@ -521,17 +523,30 @@ static int set_defaults (void)
 	bool out_shell = false;
 	bool out_skel = false;
 	bool out_create_mail_spool = false;
 +	size_t len;
 +	int ret = -1;
 -	if(prefix[0]) {
 -		size_t len;
 -		len = strlen(prefix) + strlen(NEW_USER_FILE) + 2;
 -		new_file = malloc(len);
 -		wlen = snprintf(new_file, len, "%s/%s", prefix, NEW_USER_FILE);
 -		assert (wlen == (int) len -1);
 +	len = strlen(prefix) + strlen(NEW_USER_FILE) + 2;
 +	new_file = malloc(len);
 +        if (new_file == NULL) {
 +		fprintf (stderr,
 +		         _("%s: cannot create new defaults file: %s\n"),
 +		         Prog, strerror(errno));
 +		return -1;
 +        }
 +	wlen = snprintf(new_file, len, "%s%s%s", prefix, prefix[0]?"/":"", NEW_USER_FILE);
 +	assert (wlen <= (int) len -1);
 +	if(prefix[0]) {
 		len = strlen(prefix) + strlen(USER_DEFAULTS_FILE) + 2;
 		default_file = malloc(len);
 +		if (default_file == NULL) {
 +			fprintf (stderr,
 +			         _("%s: cannot create new defaults file: %s\n"),
 +			         Prog, strerror(errno));
 +			goto setdef_err;
 +		}
 		wlen = snprintf(default_file, len, "%s/%s", prefix, USER_DEFAULTS_FILE);
 		assert (wlen == (int) len -1);
 	}
@@ -544,7 +559,7 @@ static int set_defaults (void)
 		fprintf (stderr,
 		         _("%s: cannot create new defaults file\n"),
 		         Prog);
 -		return -1;
 +		goto setdef_err;
 	}
 	ofp = fdopen (ofd, "w");
@@ -552,7 +567,7 @@ static int set_defaults (void)
 		fprintf (stderr,
 		         _("%s: cannot open new defaults file\n"),
 		         Prog);
 -		return -1;
 +		goto setdef_err;
 	}
 	/*
@@ -579,7 +594,7 @@ static int set_defaults (void)
 				         _("%s: line too long in %s: %s..."),
 				         Prog, default_file, buf);
 				(void) fclose (ifp);
 -				return -1;
 +				goto setdef_err;
 			}
 		}
@@ -643,7 +658,7 @@ static int set_defaults (void)
 	    || (fsync (fileno (ofp)) != 0)
 	    || (fclose (ofp) != 0)) {
 		unlink (new_file);
 -		return -1;
 +		goto setdef_err;
 	}
 	/*
@@ -658,7 +673,7 @@ static int set_defaults (void)
 		         _("%s: Cannot create backup file (%s): %s\n"),
 		         Prog, buf, strerror (err));
 		unlink (new_file);
 -		return -1;
 +		goto setdef_err;
 	}
 	/*
@@ -669,7 +684,7 @@ static int set_defaults (void)
 		fprintf (stderr,
 		         _("%s: rename: %s: %s\n"),
 		         Prog, new_file, strerror (err));
 -		return -1;
 +		goto setdef_err;
 	}
 #ifdef WITH_AUDIT
 	audit_logger (AUDIT_USYS_CONFIG, Prog,
@@ -683,13 +698,14 @@ static int set_defaults (void)
 	         (unsigned int) def_group, def_home, def_shell,
 	         def_inactive, def_expire, def_template,
 	         def_create_mail_spool));
 -
 +	ret = 0;
 +    setdef_err:
 +	free(new_file);
 	if(prefix[0]) {
 -		free(new_file);
 		free(default_file);
 	}
 -	return 0;
 +	return ret;
 }
 /*
 -- 
 2.19.1