ELA 1:4.5-1.1+deb10u1

Breaks on old version to force lockstep upgrade, which should
really be a depends-new-version (and can be switched around
together with util-linux once the transition is finished).
Using Breaks/Depends the 'wrong' way around is to make apt
unpack things in the 'right' order (avoiding any gaps where
/bin/su is not available during the upgrade phase).

.gitignore

@@ -17,6 +17,8 @@ Makefile.in
 /ABOUT-NLS
 /aclocal.m4
 /autom4te.cache
+/compile
+/config.cache
 /config.guess
 /config.h
 /config.h.in
@@ -44,4 +46,5 @@ Makefile.in
 /po/stamp-po
 
 /shadow.spec
+/shadow-*.tar.*
 /libmisc/getdate.c

.travis.yml

@@ -0,0 +1,20 @@
+sudo: false
+
+language: c
+
+compiler:
+  - gcc
+  - clang
+
+addons:
+  apt:
+    packages:
+      - autopoint
+      - xsltproc
+
+script:
+ - ./autogen.sh --without-selinux --disable-man
+ - grep ENABLE_ config.status
+ - make
+
+# vim:et:ts=2:sw=2

ChangeLog

@@ -1,3 +1,84 @@
+2016-05-17  Serge Hallyn <serge@hallyn.com>
+
+	* Release 4.5
+
+2016-05-17  Serge Hallyn <serge@hallyn.com>
+
+	* Patch from Tobias Stoeckmann fixing regression in previous CVE fix
+	  preventing SIGTERM to su from being propagated to the job.
+	* Patch from Chris Lamb making sp_lstchg shadow field reproducible.
+	* Merge Russian translation updates from Yuri Kozlov
+	* Fix missing close of subuid file on error
+
+2016-02-23  Serge Hallyn <serge@hallyn.com>
+
+	* Merge patch by Tobias Stoeckmann <tobias@stoeckmann.org> to fix
+	  the equivalent of util-linux CVE-2017-2616.
+
+2016-02-08  Serge Hallyn <serge@hallyn.com>
+
+	* Update Kazakh translations
+	* Consult configuration before calculating subuids
+	* Remove misplaced semicolon
+
+2016-01-29  Serge Hallyn <serge@hallyn.com>
+
+	* Patch from Fedora to improve performance with SSSD, Winbind,
+	  or nss_ldap. (Tomas Mraz)
+	* Make sure knowndef_table is NULL-terminated.  (Bernhard Rosenkränzer)
+
+2016-12-21  Serge Hallyn <serge@hallyn.com>
+
+	* Drop leading underscore from _COMMONIO_H and _SHADOWIO_H
+	* Fix readability in usermod error messages.
+	* Reset user in tallylog
+	* Add audit support to su
+
+2016-12-02  Serge Hallyn <serge@hallyn.com>
+
+	* changes since 4.4
+	  - Use sizeof rather than hardcoding snprintf args
+	  - Fix useradd improper default loading
+	  - Update Vietnamese translations
+	  - Update Polish translations
+	  - Remove non-POSIX chmod option in Makefile
+	  - Fix suidubins assignments
+	  - Fix --add-subuids etc spelling in manpages
+	  - Audit homedir ownership change.
+	  - Print error on selinux file context update failure
+	  - Keep original file perms when creating a backup
+
+	* (henceforth we'll update Changelog with each commit
+	  and proper credit)
+
+2016-12-02  Serge Hallyn <serge@hallyn.com>
+
+	* Changes since 4.2.1:
+	  - Documentation, error report and translations updates
+	  - Replace path_max with 32
+	  - User namespace support fixes/updates including:
+	    - Correct sanity checks in newXidmap
+	    - Fix building without subuid support
+	    - Add /etc/subuid support for UID matching
+	    - Support subuid for nonlocal users
+	    - Default to 65536 subuid allocations
+	    - Respect -r
+	    - Check for range overflows
+	  - Add tests from svn tree
+	  - Use AC_CHECK_SIZEOF for uid_t size checks
+	  - Accomodate missing /etc and login.defs
+	  - Support FORCE_SHADOW
+	  - Be more robust in hostile environment
+	  - Allow removing a primary group
+	  - Clear passwords on __pw_dup errors
+	  - Memory leak fix in commonio_update and get_map_ranges
+	  - Fix resource leak in syslog_sg
+	  - Fix user busy error at userdel
+	  - Support set/clear lastlog record via lastlog command
+	  - Add --no-create-home as longopt for -M
+	  - Fix signal races
+	  - Reduce syslog priority of common usage events
+
 2013-08-25  Nicolas François  <nicolas.francois@centraliens.net>
 
 	* src/vipw.c: After waitpid(), use errno only if waitpid returned

Makefile.am

@@ -2,7 +2,5 @@
 
 EXTRA_DIST = NEWS README TODO shadow.spec.in
 
-AUTOMAKE_OPTIONS = 1.5 dist-bzip2 foreign
-
 SUBDIRS = po man libmisc lib src \
 	contrib doc etc

README

@@ -117,5 +117,6 @@ Maintainers
 ===========
 
 Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
-Nicolas François <nicolas.francois@centraliens.net> (2007-now)
+Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
+Serge E. Hallyn <serge@hallyn.com> (2014-now)
 

configure.ac

@@ -1,6 +1,9 @@
 dnl Process this file with autoconf to produce a configure script.
-AC_INIT
-AM_INIT_AUTOMAKE(shadow, 4.2)
+AC_PREREQ([2.64])
+AC_INIT([shadow], [4.5], [pkg-shadow-devel@lists.alioth.debian.org], [],
+	[https://github.com/shadow-maint/shadow])
+AM_INIT_AUTOMAKE([1.11 foreign dist-xz])
+AM_SILENT_RULES([yes])
 AC_CONFIG_HEADERS([config.h])
 
 dnl Some hacks...
@@ -335,16 +338,10 @@ if test "$enable_subids" != "no"; then
 	dnl
 	dnl FIXME: check if 32 bit UIDs/GIDs are supported by libc
 	dnl
-	AC_RUN_IFELSE([AC_LANG_SOURCE([
-#include <sys/types.h>
-int main(void) {
-	uid_t u;
-	gid_t g;
-	return (sizeof u < 4) || (sizeof g < 4);
-}
-	])], [id32bit="yes"], [id32bit="no"])
+	AC_CHECK_SIZEOF([uid_t],, [#include "sys/types.h"])
+	AC_CHECK_SIZEOF([gid_t],, [#include "sys/types.h"])
 
-	if test "x$id32bit" = "xyes"; then
+	if test "$ac_cv_sizeof_uid_t" -ge 4 && test "$ac_cv_sizeof_gid_t" -ge 4; then
 		AC_DEFINE(ENABLE_SUBIDS, 1, [Define to support the subordinate IDs.])
 		enable_subids="yes"
 	else

debian/README.source

@@ -1,17 +1,4 @@
-This package uses quilt to patch the upstream source.
-
-You can find some info on how to generate the patched source, add a new
-modification, and remove an existing modification on:
-	/usr/share/doc/quilt/README.source
-
-================================================================================
-
-To package a new upstream release, you can use the Makefile:
-	svn://svn.debian.org/svn/pkg-shadow/debian/trunk/Makefile
-
-================================================================================
-
 A testsuite is also available. Instruction on how to run this testsuite
-are available on:
-	svn://svn.debian.org/svn/pkg-shadow/debian/trunk/tests/README
+are available in tests/README
 
+ -- Balint Reczey <rbalint@ubuntu.com>, Sat, 12 Aug 2017 18:46:44 -0400

debian/changelog

@@ -1,3 +1,218 @@
+shadow (1:4.5-1.1+deb10u1) buster-security; urgency=medium
+
+  * Non-maintainer upload by the ELTS Team.
+  * CVE-2018-7169: unprivileged user can drop supplementary groups
+  * CVE-2023-4641: gpasswd password leak
+  * CVE-2023-29383: chfn missing control character check
+
+ -- Adrian Bunk <bunk@debian.org>  Sat, 26 Oct 2024 15:24:09 +0300
+
+shadow (1:4.5-1.1) unstable; urgency=medium
+
+  * Non-maintainer upload (greetings from DebCamp/DebConf Taiwan).
+  * Stop shipping su and break old util-linux version. (See #833256)
+    - Breaks on old version to force lockstep upgrade, which should
+      really be a depends-new-version (and can be switched around
+      together with util-linux once the transition is finished).
+      Using Breaks/Depends the 'wrong' way around is to make apt
+      unpack things in the 'right' order (avoiding any gaps where
+      /bin/su is not available during the upgrade phase).
+
+ -- Andreas Henriksson <andreas@fatal.se>  Fri, 27 Jul 2018 10:07:37 +0200
+
+shadow (1:4.5-1) unstable; urgency=medium
+
+  * New upstream version 4.5
+    - Fix buffer overflow if NULL line is present in db (CVE-2017-12424)
+      (Closes: #756630)
+    - Make the sp_lstchg shadow field reproducible (Closes: #857803)
+    - Fix regression in useradd not loading defaults properly.
+      (Closes: #865762)
+  * Refresh patches
+  * Drop patches manipulating su argument concatenation:
+  * Cut redundant information from Debian-specific README files
+  * Revert adding pts/0 and pts/1 to securetty.
+    Adding pts/* defeats the purpose of securetty. Let containers add it if
+    needed as described in #830255.
+  * Use my @ubuntu.com email address in Maintainer field
+
+ -- Balint Reczey <rbalint@ubuntu.com>  Wed, 27 Sep 2017 12:45:23 -0400
+
+shadow (1:4.4-4.1) unstable; urgency=high
+
+  * Non-maintainer upload.
+  * Reset pid_child only if waitpid was successful.
+    This is a regression fix for CVE-2017-2616. If su receives a signal like
+    SIGTERM, it is not propagated to the child. (Closes: #862806)
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 17 May 2017 13:59:59 +0200
+
+shadow (1:4.4-4) unstable; urgency=high
+
+  * su: properly clear child PID (CVE-2017-2616) (Closes: #855943)
+
+ -- Balint Reczey <balint@balintreczey.hu>  Fri, 24 Feb 2017 01:33:25 +0100
+
+shadow (1:4.4-3) unstable; urgency=medium
+
+  [ Balint Reczey ]
+  * Clean up stale locks on boot (Closes: #478771)
+  * Sync motd handling with sshd.
+    Using patch from Ubuntu (Closes: #757148)
+
+  [ Stéphane Graber ]
+  * Add missing /etc/{subgid|subuid} in postinst
+
+ -- Balint Reczey <balint@balintreczey.hu>  Wed, 25 Jan 2017 16:43:09 +0100
+
+shadow (1:4.4-2) unstable; urgency=medium
+
+  [ Balint Reczey ]
+  * Update homepage to new upstream
+  * Always use /bin/sh shell in the build (Closes: #817971)
+  * Replace user´s -> user's to make login.def file valid ASCII
+    (Closes: #850338)
+  * Update patch naming docmentation
+  * Fix typos in German man pages (Closes: #734609)
+  * Send 1000_configure_userns patch upstream
+  * Add call to pam_keyinit for login pam service.
+    This module is linux-any only, so copy what openssh has already done and
+    remove the call at build time for other architectures.
+    The call to this module is needed to have proper per-session kernel
+    keyring. (Closes: #734671)
+  * Add pts/0 and pts/1 to securetty (Closes: #830255)
+  * Add ttySAC* to securetty (Closes: #824391)
+  * Add ttySC[4-9] to securetty (Closes: #768020)
+
+  [ Laurent Bigonville ]
+  * Move pam_selinux open call higher in the session stack (Closes: #747313)
+
+  [ Christian Perrier ]
+  * Fix typos in login.pam (thanks to Jakub Wilk for reporting)
+    (Closes: #747115)
+  * Include groupmems(8) in the passwd package (Closes: #663117)
+
+  [ Frans Spiesschaert ]
+  * Dutch translation update (Closes: #772470)
+
+  [ Trần Ngọc Quân ]
+  * Update Vietnamese translation (Closes: #777107)
+
+  [ Miroslav Kuře ]
+  * Updated Czech translation. (Closes: #759113)
+
+  [ Holger Wansing ]
+  * Update for German man pages
+
+  [ Thomas Blein ]
+  * French manpage translation (Closes: #805182)
+
+  [ Lars Bahner ]
+  * Fix some spelling issues in the Norwegian translation (Closes: #800553)
+
+ -- Balint Reczey <balint@balintreczey.hu>  Thu, 19 Jan 2017 18:22:49 +0100
+
+shadow (1:4.4-1) unstable; urgency=medium
+
+  [ Christian Perrier ]
+  * Imported Upstream version 4.2
+  * Debian patch: Fix typo in su.1.xml
+  * Configure userns
+  * Vietnamese translation update
+  * French translation update (Closes: #725793)
+  * German translation update
+  * Update NEWS file
+  * Issue a warning if no manpages have been generated
+  * Regenerate PO files
+  * Regenerate manpages PO files
+  * Imported Upstream version 4.2.1
+
+  [ Serge Hallyn ]
+  * Import new upstream
+  * Patch changes:
+    - Update 501_commonio_group_shadow to work with upstream changes
+    - Update 1010_vietnamese_translation
+    - Drop userns patches which are now all upstream
+
+  [ Balint Reczey ]
+  * Update debian/watch to use GitHub releases
+  * Imported Upstream version 4.4
+    - Fix incorrect integer handling (CVE-2016-6252) (Closes: #832170)
+  * Disable Vietnamese translation patch because it does not apply cleanly
+  * Bump debhelper compat level to 10
+  * ACK NMU by Samuel Thibault dropping the patch which is integrated
+    upstream
+  * Stop build-depending on build-essential dpkg-dev
+  * Tag login package as essential properly
+  * Adopt the package under the Shadow Team's umbrella (Closes: #801707)
+
+ -- Balint Reczey <balint@balintreczey.hu>  Fri, 06 Jan 2017 16:19:18 +0100
+
+shadow (1:4.2-3.3) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Apply upstream patch to fix build on hurd-i386. (Closes: #750480)
+
+ -- Samuel Thibault <sthibault@debian.org>  Tue, 22 Nov 2016 18:31:28 +0000
+
+shadow (1:4.2-3.2) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Use HTTPS in Vcs-Git.
+  * Stop using hardening-wrapper and instead use /usr/share/dpkg/buildflags.mk.
+    Closes: #836653
+
+ -- Mattia Rizzolo <mattia@debian.org>  Sun, 18 Sep 2016 14:42:16 +0000
+
+shadow (1:4.2-3.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Fix error handling in busy user detection. (Closes: #778287)
+
+ -- Bastian Blank <bastian.blank@credativ.de>  Thu, 12 Nov 2015 14:33:33 +0000
+
+shadow (1:4.2-3) unstable; urgency=low
+
+  * Enforce hardened builds to workaround cdbs sometimes not building
+    with hardening flags as in 1:4.2-2+b1
+    Thanks to Dr. Markus Waldeck for pointing the issue and Simon Ruderich
+    For providing a working patch.
+
+ -- Christian Perrier <bubulle@debian.org>  Wed, 19 Nov 2014 21:59:09 +0100
+
+shadow (1:4.2-2) unstable; urgency=low
+
+  * The "Soumaintrain" release
+  * The "Rigotte de Condrieu" release was 4.2-1
+  * Upload to unstable
+  * Last upload integrates the use of dh_autoreconf which has the same
+    effect then Eric Dorland's patch in 1:4.1.5.1-1.1 NMU to drop the
+    use of automake1.9. Closes: #724434
+
+  [ Samuel Thibault ]
+  * Enable the login package on hurd-any, but without /bin/login, still provided
+    by the hurd package. Closes: #737805.
+    This fix was accidentally forgotten in 1:4.2-1
+
+  [ Josh Triplett ]
+  * use the new pam_exec functionality from pam 1.1.8-1 to implement the
+    dynamic motd, rather than using /run/motd.dynamic from initscripts.
+    This will allow initscripts to drop /etc/init.d/motd.
+    Closes: #741129
+
+  [ Laurent Bigonville ]
+  * Enable libaudit support. Closes: #745774
+
+  [ Trần Ngọc Quân ]
+  * Vietnamese translation update.
+
+  [ Christian Perrier ]
+  * Add a lintian override for newuidmap and newgidmap setuid binaries
+  * Add upstream signing key as debian/upstream-signing-key.asc
+  * Check upstream signing key in debian/watch
+
+ -- Christian Perrier <bubulle@debian.org>  Sun, 04 May 2014 19:39:07 +0200
+
 shadow (1:4.2-1) experimental; urgency=low
 
   [ Nicolas FRANCOIS (Nekral) ]
@@ -59,6 +274,19 @@ shadow (1:4.2-1) experimental; urgency=low
 
  -- Christian Perrier <bubulle@debian.org>  Tue, 22 Apr 2014 09:01:42 +0200
 
+shadow (1:4.1.5.1-1.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+
+  [ Eric Dorland ]
+  * Switch to automake1.11. (Closes: #724434)
+
+  [ Samuel Thibault ]
+  * Enable the login package on hurd-any, but without /bin/login, still provided
+    by the hurd package. Closes: #737805.
+
+ -- Samuel Thibault <sthibault@debian.org>  Sun, 16 Mar 2014 20:58:24 +0100
+
 shadow (1:4.1.5.1-1) unstable; urgency=low
 
   * The "Gruyère" release.

debian/compat

@@ -1 +1 @@
-6
+10

debian/control

@@ -1,19 +1,38 @@
 Source: shadow
+Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Uploaders: Christian Perrier <bubulle@debian.org>,
+           Balint Reczey <rbalint@ubuntu.com>,
+           Serge Hallyn <serge@hallyn.com>
 Section: admin
 Priority: required
-Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Build-Depends: dh-autoreconf,
+               gettext,
+               libpam0g-dev,
+               debhelper (>= 10~),
+               quilt,
+               xsltproc,
+               docbook-xsl,
+               docbook-xml,
+               libxml2-utils,
+               cdbs,
+               libselinux1-dev [linux-any],
+               libsemanage1-dev [linux-any],
+               gnome-doc-utils,
+               bison,
+               libaudit-dev [linux-any]
 Standards-Version: 3.9.5
-Uploaders: Christian Perrier <bubulle@debian.org>, Nicolas FRANCOIS (Nekral) <nicolas.francois@centraliens.net>
-Build-Depends: dh-autoreconf, gettext, libpam0g-dev, debhelper (>= 6.0.7~), quilt, dpkg-dev (>= 1.13.5), xsltproc, docbook-xsl, docbook-xml, libxml2-utils, cdbs, libselinux1-dev [linux-any], libsemanage1-dev [linux-any], gnome-doc-utils (>= 0.4.3), bison
-Vcs-Git: git://anonscm.debian.org/git/pkg-shadow/shadow.git
-Vcs-Browser: http://anonscm.debian.org/gitweb/?p=pkg-shadow/shadow.git;a=summary
-Homepage: http://pkg-shadow.alioth.debian.org/
+Vcs-Browser: https://anonscm.debian.org/git/pkg-shadow/shadow.git
+Vcs-Git: https://anonscm.debian.org/git/pkg-shadow/shadow.git
+Homepage: https://github.com/shadow-maint/shadow
 
 Package: passwd
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-modules, debianutils (>= 2.15.2)
-Replaces: manpages-tr (<<1.0.5), manpages-zh (<<1.5.1-1)
 Multi-Arch: foreign
+Depends: ${shlibs:Depends},
+         ${misc:Depends},
+         libpam-modules
+Replaces: manpages-tr (<< 1.0.5),
+          manpages-zh (<< 1.5.1-1)
 Description: change and administer password and group data
  This package includes passwd, chsh, chfn, and many other programs to
  maintain password and group data.
@@ -22,10 +41,26 @@ Description: change and administer password and group data
 
 Package: login
 Architecture: any
-Pre-Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-runtime, libpam-modules
-Conflicts: gnunet (<< 0.7.0c-2), amavisd-new (<<2.3.3-8), python-4suite (<< 0.99cvs20060405-1), backupninja (<< 0.9.3-5), echolot (<< 2.1.8-4)
-Replaces: manpages-de (<< 0.5-3), manpages-tr (<<1.0.5), manpages-zh (<<1.5.1-1)
 Essential: yes
+Pre-Depends: ${shlibs:Depends},
+             ${misc:Depends},
+             libpam-runtime,
+             libpam-modules (>= 1.1.8-1)
+Breaks: coreutils (<< 8.21~) [hurd-any],
+        passwd (<< 1:4.1.5.1-2~) [hurd-any],
+        hurd (<< 20140206~) [hurd-any],
+        util-linux (<< 2.32-0.2~)
+Conflicts: gnunet (<< 0.7.0c-2),
+           amavisd-new (<< 2.3.3-8),
+           python-4suite (<< 0.99cvs20060405-1),
+           backupninja (<< 0.9.3-5),
+           echolot (<< 2.1.8-4)
+Replaces: manpages-de (<< 0.5-3),
+          manpages-tr (<< 1.0.5),
+          manpages-zh (<< 1.5.1-1),
+          passwd (<< 1:4.1.5.1-2~) [hurd-any],
+          coreutils (<< 8.21~) [hurd-any],
+          hurd (<< 20140206~) [hurd-any]
 Description: system login tools
  These tools are required to be able to login and use your system. The
  login program invokes your user shell and enables command execution. The
@@ -34,9 +69,10 @@ Description: system login tools
  user ID (useful being able to execute commands as another user).
 
 Package: uidmap
-Priority: optional
-Depends: ${shlibs:Depends}, ${misc:Depends}
 Architecture: any
+Priority: optional
+Depends: ${shlibs:Depends},
+         ${misc:Depends}
 Description: programs to help use subuids
  These programs help unprivileged users to create uid and gid mappings in
  user namespaces.

debian/login.defs

@@ -214,7 +214,7 @@ DEFAULT_HOME	yes
 #USERDEL_CMD	/usr/sbin/userdel_local
 
 #
-# If set to yes, userdel will remove the user´s group if it contains no
+# If set to yes, userdel will remove the user's group if it contains no
 # more members, and useradd will create by default a group with the name
 # of the user.
 #

debian/login.install

@@ -2,7 +2,6 @@ usr/share/locale/*/LC_MESSAGES/shadow.mo
 usr/share/man/*/man1/login.1
 usr/share/man/*/man1/newgrp.1
 usr/share/man/*/man1/sg.1
-usr/share/man/*/man1/su.1
 usr/share/man/*/man5/faillog.5
 usr/share/man/*/man5/login.defs.5
 usr/share/man/*/man8/faillog.8
@@ -11,7 +10,6 @@ usr/share/man/*/man8/nologin.8
 usr/share/man/man1/login.1
 usr/share/man/man1/newgrp.1
 usr/share/man/man1/sg.1
-usr/share/man/man1/su.1
 usr/share/man/man5/faillog.5
 usr/share/man/man5/login.defs.5
 usr/share/man/man8/faillog.8
@@ -22,4 +20,3 @@ usr/bin/faillog
 usr/bin/lastlog
 usr/bin/newgrp
 bin/login
-bin/su

debian/login.pam

@@ -35,13 +35,23 @@ auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die]
 # (Replaces the `NOLOGINS_FILE' option from login.defs)
 auth       requisite  pam_nologin.so
 
-# SELinux needs to be the first session rule. This ensures that any 
-# lingering context has been cleared. Without out this it is possible 
+# SELinux needs to be the first session rule. This ensures that any
+# lingering context has been cleared. Without this it is possible
 # that a module could execute code in the wrong domain.
 # When the module is present, "required" would be sufficient (When SELinux
 # is disabled, this returns success.)
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
 
+# Sets the loginuid process attribute
+session    required     pam_loginuid.so
+
+# SELinux needs to intervene at login time to ensure that the process
+# starts in the proper default security context. Only sessions which are
+# intended to run in the user's context should be run after this.
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
+# When the module is present, "required" would be sufficient (When SELinux
+# is disabled, this returns success.)
+
 # This module parses environment configuration file(s)
 # and also allows you to use an extended config
 # file /etc/security/pam_env.conf.
@@ -62,7 +72,7 @@ session       required   pam_env.so readenv=1 envfile=/etc/default/locale
 auth       optional   pam_group.so
 
 # Uncomment and edit /etc/security/time.conf if you need to set
-# time restrainst on logins.
+# time restraint on logins.
 # (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
 # as well as /etc/porttime)
 # account    requisite  pam_time.so
@@ -76,18 +86,18 @@ auth       optional   pam_group.so
 # (Replaces the use of /etc/limits in old login)
 session    required   pam_limits.so
 
-# Prints the last login info upon succesful login
+# Prints the last login info upon successful login
 # (Replaces the `LASTLOG_ENAB' option from login.defs)
 session    optional   pam_lastlog.so
 
-# Prints the message of the day upon succesful login.
+# Prints the message of the day upon successful login.
 # (Replaces the `MOTD_FILE' option in login.defs)
 # This includes a dynamically generated part from /run/motd.dynamic
 # and a static (admin-editable) part from /etc/motd.
-session    optional   pam_motd.so  motd=/run/motd.dynamic  noupdate
-session    optional   pam_motd.so
+session    optional   pam_motd.so motd=/run/motd.dynamic
+session    optional   pam_motd.so noupdate
 
-# Prints the status of the user's mailbox upon succesful login
+# Prints the status of the user's mailbox upon successful login
 # (Replaces the `MAIL_CHECK_ENAB' option from login.defs). 
 #
 # This also defines the MAIL environment variable
@@ -97,17 +107,10 @@ session    optional   pam_motd.so
 # See comments in /etc/login.defs
 session    optional   pam_mail.so standard
 
-# Sets the loginuid process attribute
-session    required     pam_loginuid.so
+# Create a new session keyring.
+session    optional   pam_keyinit.so force revoke
 
 # Standard Un*x account and session
 @include common-account
 @include common-session
 @include common-password
-
-# SELinux needs to intervene at login time to ensure that the process
-# starts in the proper default security context. Only sessions which are
-# intended to run in the user's context should be run after this.
-session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
-# When the module is present, "required" would be sufficient (When SELinux
-# is disabled, this returns success.)

debian/login.postinst

@@ -16,14 +16,26 @@ then
 fi
 rm -f /etc/pam.d/login.pre-upgrade 2>/dev/null
 
-if [ "$1" = "configure" ] && [ "$2" = "" ]
-then
+if [ "$1" = "configure" ]; then
 	# Install faillog during initial installs only
-	if [ ! -f /var/log/faillog ] ; then
+	if [ "$2" = "" ] && [ ! -f /var/log/faillog ] ; then
 		touch /var/log/faillog
 		chown root:root /var/log/faillog
 		chmod 644 /var/log/faillog
 	fi
+
+	# Create subuid/subgid if missing
+	if [ ! -e /etc/subuid ]; then
+		touch /etc/subuid
+		chown root:root /etc/subuid
+		chmod 644 /etc/subuid
+	fi
+
+	if [ ! -e /etc/subgid ]; then
+		touch /etc/subgid
+		chown root:root /etc/subgid
+		chmod 644 /etc/subgid
+	fi
 fi
 
         # Create subuid/subgid if missing

debian/passwd.install

@@ -10,6 +10,7 @@ usr/sbin/cppw
 usr/sbin/groupadd
 usr/sbin/groupdel
 usr/sbin/groupmod
+usr/sbin/groupmems
 usr/sbin/grpck
 usr/sbin/grpconv
 usr/sbin/grpunconv
@@ -34,6 +35,7 @@ usr/share/man/*/man8/chpasswd.8
 usr/share/man/*/man8/groupadd.8
 usr/share/man/*/man8/groupdel.8
 usr/share/man/*/man8/groupmod.8
+usr/share/man/*/man8/groupmems.8
 usr/share/man/*/man8/grpck.8
 usr/share/man/*/man8/grpconv.8
 usr/share/man/*/man8/grpunconv.8

debian/passwd.tmpfile

@@ -0,0 +1,8 @@
+# If a password operation is in progress and we lose power, stale lockfiles
+# can be left behind.  Clear them on boot.
+r! /etc/gshadow.lock
+r! /etc/shadow.lock
+r! /etc/passwd.lock
+r! /etc/group.lock
+r! /etc/subuid.lock
+r! /etc/subgid.lock

debian/patches/0001-newgidmap-enforce-setgroups-deny-if-self-mapping-a-g.patch

@@ -0,0 +1,183 @@
+From 11fc74ffc7172c587bbd2a6399defbd53eab97c6 Mon Sep 17 00:00:00 2001
+From: Aleksa Sarai <asarai@suse.de>
+Date: Thu, 15 Feb 2018 23:49:40 +1100
+Subject: newgidmap: enforce setgroups=deny if self-mapping a group
+
+This is necessary to match the kernel-side policy of "self-mapping in a
+user namespace is fine, but you cannot drop groups" -- a policy that was
+created in order to stop user namespaces from allowing trivial privilege
+escalation by dropping supplementary groups that were "blacklisted" from
+certain paths.
+
+This is the simplest fix for the underlying issue, and effectively makes
+it so that unless a user has a valid mapping set in /etc/subgid (which
+only administrators can modify) -- and they are currently trying to use
+that mapping -- then /proc/$pid/setgroups will be set to deny. This
+workaround is only partial, because ideally it should be possible to set
+an "allow_setgroups" or "deny_setgroups" flag in /etc/subgid to allow
+administrators to further restrict newgidmap(1).
+
+We also don't write anything in the "allow" case because "allow" is the
+default, and users may have already written "deny" even if they
+technically are allowed to use setgroups. And we don't write anything if
+the setgroups policy is already "deny".
+
+Ref: https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
+Fixes: CVE-2018-7169
+Reported-by: Craig Furman <craig.furman89@gmail.com>
+Signed-off-by: Aleksa Sarai <asarai@suse.de>
+---
+ src/newgidmap.c | 89 ++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 80 insertions(+), 9 deletions(-)
+
+diff --git a/src/newgidmap.c b/src/newgidmap.c
+index b1e33513..59a2e75c 100644
+--- a/src/newgidmap.c
++++ b/src/newgidmap.c
+@@ -46,32 +46,37 @@
+  */
+ const char *Prog;
+ 
+-static bool verify_range(struct passwd *pw, struct map_range *range)
++
++static bool verify_range(struct passwd *pw, struct map_range *range, bool *allow_setgroups)
+ {
+ 	/* An empty range is invalid */
+ 	if (range->count == 0)
+ 		return false;
+ 
+-	/* Test /etc/subgid */
+-	if (have_sub_gids(pw->pw_name, range->lower, range->count))
++	/* Test /etc/subgid. If the mapping is valid then we allow setgroups. */
++	if (have_sub_gids(pw->pw_name, range->lower, range->count)) {
++		*allow_setgroups = true;
+ 		return true;
++	}
+ 
+-	/* Allow a process to map its own gid */
+-	if ((range->count == 1) && (pw->pw_gid == range->lower))
++	/* Allow a process to map its own gid. */
++	if ((range->count == 1) && (pw->pw_gid == range->lower)) {
++		/* noop -- if setgroups is enabled already we won't disable it. */
+ 		return true;
++	}
+ 
+ 	return false;
+ }
+ 
+ static void verify_ranges(struct passwd *pw, int ranges,
+-	struct map_range *mappings)
++	struct map_range *mappings, bool *allow_setgroups)
+ {
+ 	struct map_range *mapping;
+ 	int idx;
+ 
+ 	mapping = mappings;
+ 	for (idx = 0; idx < ranges; idx++, mapping++) {
+-		if (!verify_range(pw, mapping)) {
++		if (!verify_range(pw, mapping, allow_setgroups)) {
+ 			fprintf(stderr, _( "%s: gid range [%lu-%lu) -> [%lu-%lu) not allowed\n"),
+ 				Prog,
+ 				mapping->upper,
+@@ -89,6 +94,70 @@ static void usage(void)
+ 	exit(EXIT_FAILURE);
+ }
+ 
++void write_setgroups(int proc_dir_fd, bool allow_setgroups)
++{
++	int setgroups_fd;
++	char *policy, policy_buffer[4096];
++
++	/*
++	 * Default is "deny", and any "allow" will out-rank a "deny". We don't
++	 * forcefully write an "allow" here because the process we are writing
++	 * mappings for may have already set themselves to "deny" (and "allow"
++	 * is the default anyway). So allow_setgroups == true is a noop.
++	 */
++	policy = "deny\n";
++	if (allow_setgroups)
++		return;
++
++	setgroups_fd = openat(proc_dir_fd, "setgroups", O_RDWR|O_CLOEXEC);
++	if (setgroups_fd < 0) {
++		/*
++		 * If it's an ENOENT then we are on too old a kernel for the setgroups
++		 * code to exist. Emit a warning and bail on this.
++		 */
++		if (ENOENT == errno) {
++			fprintf(stderr, _("%s: kernel doesn't support setgroups restrictions\n"), Prog);
++			goto out;
++		}
++		fprintf(stderr, _("%s: couldn't open process setgroups: %s\n"),
++			Prog,
++			strerror(errno));
++		exit(EXIT_FAILURE);
++	}
++
++	/*
++	 * Check whether the policy is already what we want. /proc/self/setgroups
++	 * is write-once, so attempting to write after it's already written to will
++	 * fail.
++	 */
++	if (read(setgroups_fd, policy_buffer, sizeof(policy_buffer)) < 0) {
++		fprintf(stderr, _("%s: failed to read setgroups: %s\n"),
++			Prog,
++			strerror(errno));
++		exit(EXIT_FAILURE);
++	}
++	if (!strncmp(policy_buffer, policy, strlen(policy)))
++		goto out;
++
++	/* Write the policy. */
++	if (lseek(setgroups_fd, 0, SEEK_SET) < 0) {
++		fprintf(stderr, _("%s: failed to seek setgroups: %s\n"),
++			Prog,
++			strerror(errno));
++		exit(EXIT_FAILURE);
++	}
++	if (dprintf(setgroups_fd, "%s", policy) < 0) {
++		fprintf(stderr, _("%s: failed to setgroups %s policy: %s\n"),
++			Prog,
++			policy,
++			strerror(errno));
++		exit(EXIT_FAILURE);
++	}
++
++out:
++	close(setgroups_fd);
++}
++
+ /*
+  * newgidmap - Set the gid_map for the specified process
+  */
+@@ -103,6 +172,7 @@ int main(int argc, char **argv)
+ 	struct stat st;
+ 	struct passwd *pw;
+ 	int written;
++	bool allow_setgroups = false;
+ 
+ 	Prog = Basename (argv[0]);
+ 
+@@ -145,7 +215,7 @@ int main(int argc, char **argv)
+ 				(unsigned long) getuid ()));
+ 		return EXIT_FAILURE;
+ 	}
+-	
++
+ 	/* Get the effective uid and effective gid of the target process */
+ 	if (fstat(proc_dir_fd, &st) < 0) {
+ 		fprintf(stderr, _("%s: Could not stat directory for target %u\n"),
+@@ -177,8 +247,9 @@ int main(int argc, char **argv)
+ 	if (!mappings)
+ 		usage();
+ 
+-	verify_ranges(pw, ranges, mappings);
++	verify_ranges(pw, ranges, mappings, &allow_setgroups);
+ 
++	write_setgroups(proc_dir_fd, allow_setgroups);
+ 	write_mapping(proc_dir_fd, ranges, mappings, "gid_map");
+ 	sub_gid_close();
+ 
+-- 
+2.30.2
+

debian/patches/0002-gpasswd-1-Fix-password-leak.patch

@@ -0,0 +1,142 @@
+From cbfa2ff40ce629f55ddd67e3490c311dfcaa4462 Mon Sep 17 00:00:00 2001
+From: Alejandro Colomar <alx@kernel.org>
+Date: Sat, 10 Jun 2023 16:20:05 +0200
+Subject: gpasswd(1): Fix password leak
+
+How to trigger this password leak?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+When gpasswd(1) asks for the new password, it asks twice (as is usual
+for confirming the new password).  Each of those 2 password prompts
+uses agetpass() to get the password.  If the second agetpass() fails,
+the first password, which has been copied into the 'static' buffer
+'pass' via STRFCPY(), wasn't being zeroed.
+
+agetpass() is defined in <./libmisc/agetpass.c> (around line 91), and
+can fail for any of the following reasons:
+
+-  malloc(3) or readpassphrase(3) failure.
+
+   These are going to be difficult to trigger.  Maybe getting the system
+   to the limits of memory utilization at that exact point, so that the
+   next malloc(3) gets ENOMEM, and possibly even the OOM is triggered.
+   About readpassphrase(3), ENFILE and EINTR seem the only plausible
+   ones, and EINTR probably requires privilege or being the same user;
+   but I wouldn't discard ENFILE so easily, if a process starts opening
+   files.
+
+-  The password is longer than PASS_MAX.
+
+   The is plausible with physical access.  However, at that point, a
+   keylogger will be a much simpler attack.
+
+And, the attacker must be able to know when the second password is being
+introduced, which is not going to be easy.
+
+How to read the password after the leak?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Provoking the leak yourself at the right point by entering a very long
+password is easy, and inspecting the process stack at that point should
+be doable.  Try to find some consistent patterns.
+
+Then, search for those patterns in free memory, right after the victim
+leaks their password.
+
+Once you get the leak, a program should read all the free memory
+searching for patterns that gpasswd(1) leaves nearby the leaked
+password.
+
+On 6/10/23 03:14, Seth Arnold wrote:
+> An attacker process wouldn't be able to use malloc(3) for this task.
+> There's a handful of tools available for userspace to allocate memory:
+>
+> -  brk / sbrk
+> -  mmap MAP_ANONYMOUS
+> -  mmap /dev/zero
+> -  mmap some other file
+> -  shm_open
+> -  shmget
+>
+> Most of these return only pages of zeros to a process.  Using mmap of an
+> existing file, you can get some of the contents of the file demand-loaded
+> into the memory space on the first use.
+>
+> The MAP_UNINITIALIZED flag only works if the kernel was compiled with
+> CONFIG_MMAP_ALLOW_UNINITIALIZED.  This is rare.
+>
+> malloc(3) doesn't zero memory, to our collective frustration, but all the
+> garbage in the allocations is from previous allocations in the current
+> process.  It isn't leftover from other processes.
+>
+> The avenues available for reading the memory:
+> -  /dev/mem and /dev/kmem (requires root, not available with Secure Boot)
+> -  /proc/pid/mem (requires ptrace privileges, mediated by YAMA)
+> -  ptrace (requires ptrace privileges, mediated by YAMA)
+> -  causing memory to be swapped to disk, and then inspecting the swap
+>
+> These all require a certain amount of privileges.
+
+How to fix it?
+~~~~~~~~~~~~~~
+
+memzero(), which internally calls explicit_bzero(3), or whatever
+alternative the system provides with a slightly different name, will
+make sure that the buffer is zeroed in memory, and optimizations are not
+allowed to impede this zeroing.
+
+This is not really 100% effective, since compilers may place copies of
+the string somewhere hidden in the stack.  Those copies won't get zeroed
+by explicit_bzero(3).  However, that's arguably a compiler bug, since
+compilers should make everything possible to avoid optimizing strings
+that are later passed to explicit_bzero(3).  But we all know that
+sometimes it's impossible to have perfect knowledge in the compiler, so
+this is plausible.  Nevertheless, there's nothing we can do against such
+issues, except minimizing the time such passwords are stored in plain
+text.
+
+Security concerns
+~~~~~~~~~~~~~~~~~
+
+We believe this isn't easy to exploit.  Nevertheless, and since the fix
+is trivial, this fix should probably be applied soon, and backported to
+all supported distributions, to prevent someone else having more
+imagination than us to find a way.
+
+Affected versions
+~~~~~~~~~~~~~~~~~
+
+All.  Bug introduced in shadow 19990709.  That's the second commit in
+the git history.
+
+Fixes: 45c6603cc86c ("[svn-upgrade] Integrating new upstream version, shadow (19990709)")
+Reported-by: Alejandro Colomar <alx@kernel.org>
+Cc: Serge Hallyn <serge@hallyn.com>
+Cc: Iker Pedrosa <ipedrosa@redhat.com>
+Cc: Seth Arnold <seth.arnold@canonical.com>
+Cc: Christian Brauner <christian@brauner.io>
+Cc: Balint Reczey <rbalint@debian.org>
+Cc: Sam James <sam@gentoo.org>
+Cc: David Runge <dvzrv@archlinux.org>
+Cc: Andreas Jaeger <aj@suse.de>
+Cc: <~hallyn/shadow@lists.sr.ht>
+Signed-off-by: Alejandro Colomar <alx@kernel.org>
+---
+ src/gpasswd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/gpasswd.c b/src/gpasswd.c
+index c4a492b1..cbbd8068 100644
+--- a/src/gpasswd.c
++++ b/src/gpasswd.c
+@@ -917,6 +917,7 @@ static void change_passwd (struct group *gr)
+ 		strzero (cp);
+ 		cp = getpass (_("Re-enter new password: "));
+ 		if (NULL == cp) {
++			memzero (pass, sizeof pass);
+ 			exit (1);
+ 		}
+ 
+-- 
+2.30.2
+

debian/patches/0003-Added-control-character-check.patch

@@ -0,0 +1,45 @@
+From b42c60bc8f026b250810a75bafe865338d734ec3 Mon Sep 17 00:00:00 2001
+From: tomspiderlabs <128755403+tomspiderlabs@users.noreply.github.com>
+Date: Thu, 23 Mar 2023 23:39:38 +0000
+Subject: Added control character check
+
+Added control character check, returning -1 (to "err") if control characters are present.
+---
+ lib/fields.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/lib/fields.c b/lib/fields.c
+index 649fae17..b8f13ba7 100644
+--- a/lib/fields.c
++++ b/lib/fields.c
+@@ -44,9 +44,9 @@
+  *
+  * The supplied field is scanned for non-printable and other illegal
+  * characters.
+- *  + -1 is returned if an illegal character is present.
+- *  +  1 is returned if no illegal characters are present, but the field
+- *       contains a non-printable character.
++ *  + -1 is returned if an illegal or control character is present.
++ *  +  1 is returned if no illegal or control characters are present,
++ *       but the field contains a non-printable character.
+  *  +  0 is returned otherwise.
+  */
+ int valid_field (const char *field, const char *illegal)
+@@ -68,10 +68,13 @@ int valid_field (const char *field, const char *illegal)
+ 	}
+ 
+ 	if (0 == err) {
+-		/* Search if there are some non-printable characters */
++		/* Search if there are non-printable or control characters */
+ 		for (cp = field; '\0' != *cp; cp++) {
+ 			if (!isprint (*cp)) {
+ 				err = 1;
++			}
++			if (!iscntrl (*cp)) {
++				err = -1;
+ 				break;
+ 			}
+ 		}
+-- 
+2.30.2
+

debian/patches/0004-Overhaul-valid_field.patch

@@ -0,0 +1,61 @@
+From 261c9cd274f07361c304d3993e325fe29d4bad14 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Fri, 31 Mar 2023 14:46:50 +0200
+Subject: Overhaul valid_field()
+
+e5905c4b ("Added control character check") introduced checking for
+control characters but had the logic inverted, so it rejects all
+characters that are not control ones.
+
+Cast the character to `unsigned char` before passing to the character
+checking functions to avoid UB.
+
+Use strpbrk(3) for the illegal character test and return early.
+---
+ lib/fields.c | 24 ++++++++++--------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/lib/fields.c b/lib/fields.c
+index b8f13ba7..191257e8 100644
+--- a/lib/fields.c
++++ b/lib/fields.c
+@@ -60,26 +60,22 @@ int valid_field (const char *field, const char *illegal)
+ 
+ 	/* For each character of field, search if it appears in the list
+ 	 * of illegal characters. */
++	if (illegal && NULL != strpbrk (field, illegal)) {
++		return -1;
++	}
++
++	/* Search if there are non-printable or control characters */
+ 	for (cp = field; '\0' != *cp; cp++) {
+-		if (strchr (illegal, *cp) != NULL) {
++		unsigned char c = *cp;
++		if (!isprint (c)) {
++			err = 1;
++		}
++		if (iscntrl (c)) {
+ 			err = -1;
+ 			break;
+ 		}
+ 	}
+ 
+-	if (0 == err) {
+-		/* Search if there are non-printable or control characters */
+-		for (cp = field; '\0' != *cp; cp++) {
+-			if (!isprint (*cp)) {
+-				err = 1;
+-			}
+-			if (!iscntrl (*cp)) {
+-				err = -1;
+-				break;
+-			}
+-		}
+-	}
+-
+ 	return err;
+ }
+ 
+-- 
+2.30.2
+

debian/patches/008_login_log_failure_in_FTMP

@@ -4,11 +4,11 @@ Notes:
  * I'm not sure login should add an entry in the FTMP file when PAM is used.
    (but nothing in /etc/login.defs indicates that the failure is not logged)
 
-Index: git/src/login.c
+Index: shadow-4.4/src/login.c
 ===================================================================
---- git.orig/src/login.c
-+++ git/src/login.c
-@@ -831,6 +831,24 @@
+--- shadow-4.4.orig/src/login.c
++++ shadow-4.4/src/login.c
+@@ -834,6 +834,24 @@ int main (int argc, char **argv)
  			(void) puts ("");
  			(void) puts (_("Login incorrect"));
  
@@ -33,11 +33,19 @@ Index: git/src/login.c
  			if (failcount >= retries) {
  				SYSLOG ((LOG_NOTICE,
  				         "TOO MANY LOGIN TRIES (%u)%s FOR '%s'",
-Index: git/lib/getdef.c
+Index: shadow-4.4/lib/getdef.c
 ===================================================================
---- git.orig/lib/getdef.c
-+++ git/lib/getdef.c
-@@ -62,6 +62,7 @@
+--- shadow-4.4.orig/lib/getdef.c
++++ shadow-4.4/lib/getdef.c
+@@ -57,7 +57,6 @@ struct itemdef {
+ 	{"ENVIRON_FILE", NULL},			\
+ 	{"ENV_TZ", NULL},			\
+ 	{"FAILLOG_ENAB", NULL},			\
+-	{"FTMP_FILE", NULL},			\
+ 	{"ISSUE_FILE", NULL},			\
+ 	{"LASTLOG_ENAB", NULL},			\
+ 	{"LOGIN_STRING", NULL},			\
+@@ -88,6 +87,7 @@ static struct itemdef def_table[] = {
  	{"ERASECHAR", NULL},
  	{"FAIL_DELAY", NULL},
  	{"FAKE_SHELL", NULL},
@@ -45,11 +53,3 @@ Index: git/lib/getdef.c
  	{"GID_MAX", NULL},
  	{"GID_MIN", NULL},
  	{"HUSHLOGIN_FILE", NULL},
-@@ -109,7 +110,6 @@
- 	{"ENVIRON_FILE", NULL},
- 	{"ENV_TZ", NULL},
- 	{"FAILLOG_ENAB", NULL},
--	{"FTMP_FILE", NULL},
- 	{"ISSUE_FILE", NULL},
- 	{"LASTLOG_ENAB", NULL},
- 	{"LOGIN_STRING", NULL},

debian/patches/1000_configure_userns

@@ -1,93 +0,0 @@
-=== modified file 'etc/login.defs'
-Index: git/etc/login.defs
-===================================================================
---- git.orig/etc/login.defs
-+++ git/etc/login.defs
-@@ -229,7 +229,7 @@
- # Extra per user uids
- SUB_UID_MIN		   100000
- SUB_UID_MAX		600100000
--SUB_UID_COUNT		    10000
-+SUB_UID_COUNT		    65536
- 
- #
- # Min/max values for automatic gid selection in groupadd(8)
-@@ -242,7 +242,7 @@
- # Extra per user group ids
- SUB_GID_MIN		   100000
- SUB_GID_MAX		600100000
--SUB_GID_COUNT		    10000
-+SUB_GID_COUNT		    65536
- 
- #
- # Max number of login(1) retries if password is bad
-Index: git/src/newusers.c
-===================================================================
---- git.orig/src/newusers.c
-+++ git/src/newusers.c
-@@ -988,8 +988,8 @@
- 	is_shadow_grp = sgr_file_present ();
- #endif
- #ifdef ENABLE_SUBIDS
--	is_sub_uid = sub_uid_file_present ();
--	is_sub_gid = sub_gid_file_present ();
-+	is_sub_uid = sub_uid_file_present () && !rflg;
-+	is_sub_gid = sub_gid_file_present () && !rflg;
- #endif				/* ENABLE_SUBIDS */
- 
- 	open_files ();
-Index: git/src/useradd.c
-===================================================================
---- git.orig/src/useradd.c
-+++ git/src/useradd.c
-@@ -1994,6 +1994,10 @@
- #endif				/* USE_PAM */
- #endif				/* ACCT_TOOLS_SETUID */
- 
-+	/* Needed for userns check */
-+	uid_t uid_min = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
-+	uid_t uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
-+
- 	/*
- 	 * Get my name so that I can use it to report errors.
- 	 */
-@@ -2023,8 +2027,10 @@
- 	is_shadow_grp = sgr_file_present ();
- #endif
- #ifdef ENABLE_SUBIDS
--	is_sub_uid = sub_uid_file_present ();
--	is_sub_gid = sub_gid_file_present ();
-+	is_sub_uid = sub_uid_file_present () && !rflg &&
-+	    (!user_id || (user_id <= uid_max && user_id >= uid_min));
-+	is_sub_gid = sub_gid_file_present () && !rflg &&
-+	    (!user_id || (user_id <= uid_max && user_id >= uid_min));
- #endif				/* ENABLE_SUBIDS */
- 
- 	get_defaults ();
- 
-Index: git/libmisc/find_new_sub_uids.c
-===================================================================
---- git.orig/libmisc/find_new_sub_uids.c
-+++ git/libmisc/find_new_sub_uids.c
-@@ -58,7 +58,7 @@
- 
- 	min = getdef_ulong ("SUB_UID_MIN", 100000UL);
- 	max = getdef_ulong ("SUB_UID_MAX", 600100000UL);
--	count = getdef_ulong ("SUB_UID_COUNT", 10000);
-+	count = getdef_ulong ("SUB_UID_COUNT", 65536);
- 
- 	if (min > max || count >= max || (min + count - 1) > max) {
- 		(void) fprintf (stderr,
-Index: git/libmisc/find_new_sub_gids.c
-===================================================================
---- git.orig/libmisc/find_new_sub_gids.c
-+++ git/libmisc/find_new_sub_gids.c
-@@ -58,7 +58,7 @@
- 
- 	min = getdef_ulong ("SUB_GID_MIN", 100000UL);
- 	max = getdef_ulong ("SUB_GID_MAX", 600100000UL);
--	count = getdef_ulong ("SUB_GID_COUNT", 10000);
-+	count = getdef_ulong ("SUB_GID_COUNT", 65536);
- 
- 	if (min > max || count >= max || (min + count - 1) > max) {
- 		(void) fprintf (stderr,

debian/patches/401_cppw_src.dpatch

@@ -5,10 +5,8 @@
 ## DP: Add cppw / cpgr
 
 @DPATCH@
-Index: git/src/cppw.c
-===================================================================
 --- /dev/null
-+++ git/src/cppw.c
++++ b/src/cppw.c
 @@ -0,0 +1,238 @@
 +/*
 +  cppw, cpgr  copy with locking given file over the password or group file
@@ -248,11 +246,9 @@ Index: git/src/cppw.c
 +	return 0;
 +}
 +
-Index: git/src/Makefile.am
-===================================================================
---- git.orig/src/Makefile.am
-+++ git/src/Makefile.am
-@@ -29,6 +29,7 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -30,6 +30,7 @@
  ubin_PROGRAMS += newgidmap newuidmap
  endif
  usbin_PROGRAMS = \
@@ -260,7 +256,7 @@ Index: git/src/Makefile.am
  	chgpasswd \
  	chpasswd \
  	groupadd \
-@@ -87,6 +88,7 @@
+@@ -90,6 +91,7 @@
  chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBSELINUX) $(LIBCRYPT)
  chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
  chpasswd_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT)
@@ -268,10 +264,8 @@ Index: git/src/Makefile.am
  gpasswd_LDADD  = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT)
  groupadd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
  groupdel_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
-Index: git/po/POTFILES.in
-===================================================================
---- git.orig/po/POTFILES.in
-+++ git/po/POTFILES.in
+--- a/po/POTFILES.in
++++ b/po/POTFILES.in
 @@ -85,6 +85,7 @@
  src/chgpasswd.c
  src/chpasswd.c

debian/patches/429_login_FAILLOG_ENAB

@@ -7,11 +7,11 @@ Fixes: #192849
 Note: It could be removed if pam_tally could report the number of failures
       preceding a successful login.
 
-Index: git/src/login.c
+Index: shadow-4.4/src/login.c
 ===================================================================
---- git.orig/src/login.c
-+++ git/src/login.c
-@@ -131,9 +131,9 @@
+--- shadow-4.4.orig/src/login.c
++++ shadow-4.4/src/login.c
+@@ -131,9 +131,9 @@ static void update_utmp (const char *use
                           const char *host,
                           /*@null@*/const struct utmp *utent);
  
@@ -22,7 +22,7 @@ Index: git/src/login.c
  static void bad_time_notify (void);
  static void check_nologin (bool login_to_root);
  #else
-@@ -791,6 +791,9 @@
+@@ -794,6 +794,9 @@ int main (int argc, char **argv)
  				SYSLOG ((LOG_NOTICE,
  				         "TOO MANY LOGIN TRIES (%u)%s FOR '%s'",
  				         failcount, fromhost, failent_user));
@@ -32,7 +32,7 @@ Index: git/src/login.c
  				fprintf (stderr,
  				         _("Maximum number of tries exceeded (%u)\n"),
  				         failcount);
-@@ -808,6 +811,14 @@
+@@ -811,6 +814,14 @@ int main (int argc, char **argv)
  				         pam_strerror (pamh, retcode)));
  				failed = true;
  			}
@@ -47,7 +47,7 @@ Index: git/src/login.c
  
  			if (!failed) {
  				break;
-@@ -831,6 +842,10 @@
+@@ -834,6 +845,10 @@ int main (int argc, char **argv)
  			(void) puts ("");
  			(void) puts (_("Login incorrect"));
  
@@ -58,7 +58,7 @@ Index: git/src/login.c
  			if (getdef_str("FTMP_FILE") != NULL) {
  #ifdef USE_UTMPX
  				struct utmpx *failent =
-@@ -1285,6 +1300,7 @@
+@@ -1288,6 +1303,7 @@ int main (int argc, char **argv)
  		 */
  #ifndef USE_PAM
  		motd ();	/* print the message of the day */
@@ -66,7 +66,7 @@ Index: git/src/login.c
  		if (   getdef_bool ("FAILLOG_ENAB")
  		    && (0 != faillog.fail_cnt)) {
  			failprint (&faillog);
-@@ -1297,6 +1313,7 @@
+@@ -1300,6 +1316,7 @@ int main (int argc, char **argv)
  				         username, (int) faillog.fail_cnt));
  			}
  		}
@@ -74,11 +74,11 @@ Index: git/src/login.c
  		if (   getdef_bool ("LASTLOG_ENAB")
  		    && (ll.ll_time != 0)) {
  			time_t ll_time = ll.ll_time;
-Index: git/lib/getdef.c
+Index: shadow-4.4/lib/getdef.c
 ===================================================================
---- git.orig/lib/getdef.c
-+++ git/lib/getdef.c
-@@ -61,6 +61,7 @@
+--- shadow-4.4.orig/lib/getdef.c
++++ shadow-4.4/lib/getdef.c
+@@ -86,6 +86,7 @@ static struct itemdef def_table[] = {
  	{"ENV_SUPATH", NULL},
  	{"ERASECHAR", NULL},
  	{"FAIL_DELAY", NULL},
@@ -86,11 +86,3 @@ Index: git/lib/getdef.c
  	{"FAKE_SHELL", NULL},
  	{"FTMP_FILE", NULL},
  	{"GID_MAX", NULL},
-@@ -109,7 +110,6 @@
- 	{"ENV_HZ", NULL},
- 	{"ENVIRON_FILE", NULL},
- 	{"ENV_TZ", NULL},
--	{"FAILLOG_ENAB", NULL},
- 	{"ISSUE_FILE", NULL},
- 	{"LASTLOG_ENAB", NULL},
- 	{"LOGIN_STRING", NULL},

debian/patches/463_login_delay_obeys_to_PAM

@@ -7,11 +7,11 @@ Status wrt upstream: Forwarded but not applied yet
 
 Note: If removed, FAIL_DELAY must be re-added to /etc/login.defs
 
-Index: git/src/login.c
+Index: shadow-4.4/src/login.c
 ===================================================================
---- git.orig/src/login.c
-+++ git/src/login.c
-@@ -525,7 +525,6 @@
+--- shadow-4.4.orig/src/login.c
++++ shadow-4.4/src/login.c
+@@ -525,7 +525,6 @@ int main (int argc, char **argv)
  #if defined(HAVE_STRFTIME) && !defined(USE_PAM)
  	char ptime[80];
  #endif
@@ -19,7 +19,7 @@ Index: git/src/login.c
  	unsigned int retries;
  	bool subroot = false;
  #ifndef USE_PAM
-@@ -545,6 +544,7 @@
+@@ -546,6 +545,7 @@ int main (int argc, char **argv)
  	pid_t child;
  	char *pam_user = NULL;
  #else
@@ -27,7 +27,7 @@ Index: git/src/login.c
  	struct spwd *spwd = NULL;
  #endif
  	/*
-@@ -705,7 +705,6 @@
+@@ -708,7 +708,6 @@ int main (int argc, char **argv)
  	}
  
  	environ = newenvp;	/* make new environment active */
@@ -35,7 +35,7 @@ Index: git/src/login.c
  	retries = getdef_unum ("LOGIN_RETRIES", RETRIES);
  
  #ifdef USE_PAM
-@@ -721,8 +720,7 @@
+@@ -724,8 +723,7 @@ int main (int argc, char **argv)
  
  	/*
  	 * hostname & tty are either set to NULL or their correct values,
@@ -45,7 +45,7 @@ Index: git/src/login.c
  	 *
  	 * PAM_RHOST and PAM_TTY are used for authentication, only use
  	 * information coming from login or from the caller (e.g. no utmp)
-@@ -731,10 +729,6 @@
+@@ -734,10 +732,6 @@ int main (int argc, char **argv)
  	PAM_FAIL_CHECK;
  	retcode = pam_set_item (pamh, PAM_TTY, tty);
  	PAM_FAIL_CHECK;
@@ -56,7 +56,7 @@ Index: git/src/login.c
  	/* if fflg, then the user has already been authenticated */
  	if (!fflg) {
  		unsigned int failcount = 0;
-@@ -775,12 +769,6 @@
+@@ -778,12 +772,6 @@ int main (int argc, char **argv)
  			bool failed = false;
  
  			failcount++;
@@ -69,7 +69,7 @@ Index: git/src/login.c
  
  			retcode = pam_authenticate (pamh, 0);
  
-@@ -1103,14 +1091,17 @@
+@@ -1106,14 +1094,17 @@ int main (int argc, char **argv)
  		free (username);
  		username = NULL;
  
@@ -87,11 +87,11 @@ Index: git/src/login.c
  
  		(void) puts (_("Login incorrect"));
  
-Index: git/lib/getdef.c
+Index: shadow-4.4/lib/getdef.c
 ===================================================================
---- git.orig/lib/getdef.c
-+++ git/lib/getdef.c
-@@ -60,7 +60,6 @@
+--- shadow-4.4.orig/lib/getdef.c
++++ shadow-4.4/lib/getdef.c
+@@ -85,7 +85,6 @@ static struct itemdef def_table[] = {
  	{"ENV_PATH", NULL},
  	{"ENV_SUPATH", NULL},
  	{"ERASECHAR", NULL},
@@ -99,11 +99,3 @@ Index: git/lib/getdef.c
  	{"FAILLOG_ENAB", NULL},
  	{"FAKE_SHELL", NULL},
  	{"FTMP_FILE", NULL},
-@@ -110,6 +109,7 @@
- 	{"ENV_HZ", NULL},
- 	{"ENVIRON_FILE", NULL},
- 	{"ENV_TZ", NULL},
-+	{"FAIL_DELAY", NULL},
- 	{"ISSUE_FILE", NULL},
- 	{"LASTLOG_ENAB", NULL},
- 	{"LOGIN_STRING", NULL},

debian/patches/501_commonio_group_shadow

@@ -2,10 +2,8 @@ Goal: save the [g]shadow files with the 'shadow' group and mode 0440
 
 Fixes: #166793
 
-Index: git/lib/commonio.c
-===================================================================
---- git.orig/lib/commonio.c
-+++ git/lib/commonio.c
+--- a/lib/commonio.c
++++ b/lib/commonio.c
 @@ -44,6 +44,7 @@
  #include <errno.h>
  #include <stdio.h>
@@ -14,26 +12,49 @@ Index: git/lib/commonio.c
  #include "nscd.h"
  #ifdef WITH_TCB
  #include <tcb.h>
-@@ -966,13 +967,20 @@
+@@ -963,12 +964,23 @@
  			goto fail;
  		}
  	} else {
 +		struct group *grp;
  		/*
  		 * Default permissions for new [g]shadow files.
- 		 * (passwd and group always exist...)
  		 */
--		sb.st_mode = 0400;
-+		sb.st_mode = 0440;
- 		sb.st_uid = 0;
--		sb.st_gid = 0;
+ 		sb.st_mode = db->st_mode;
+ 		sb.st_uid = db->st_uid;
+ 		sb.st_gid = db->st_gid;
++
 +		/*
 +		 * Try to retrieve the shadow's GID, and fall back to GID 0.
 +		 */
-+		if ((grp = getgrnam("shadow")) != NULL)
-+			sb.st_gid = grp->gr_gid;
-+		else
-+			sb.st_gid = 0;
++		if (sb.st_gid == 0) {
++			if ((grp = getgrnam("shadow")) != NULL)
++				sb.st_gid = grp->gr_gid;
++			else
++				sb.st_gid = 0;
++		}
  	}
  
  	snprintf (buf, sizeof buf, "%s+", db->filename);
+--- a/lib/sgroupio.c
++++ b/lib/sgroupio.c
+@@ -229,7 +229,7 @@
+ #ifdef WITH_SELINUX
+ 	NULL,			/* scontext */
+ #endif
+-	0400,                   /* st_mode */
++	0440,                   /* st_mode */
+ 	0,                      /* st_uid */
+ 	0,                      /* st_gid */
+ 	NULL,			/* head */
+--- a/lib/shadowio.c
++++ b/lib/shadowio.c
+@@ -105,7 +105,7 @@
+ #ifdef WITH_SELINUX
+ 	NULL,			/* scontext */
+ #endif				/* WITH_SELINUX */
+-	0400,                   /* st_mode */
++	0440,                   /* st_mode */
+ 	0,                      /* st_uid */
+ 	0,                      /* st_gid */
+ 	NULL,			/* head */

debian/patches/508_nologin_in_usr_sbin

@@ -1,8 +1,6 @@
-Index: git/src/Makefile.am
-===================================================================
---- git.orig/src/Makefile.am
-+++ git/src/Makefile.am
-@@ -23,7 +23,6 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -24,7 +24,6 @@
  # $prefix/bin and $prefix/sbin, no install-data hacks...)
  
  bin_PROGRAMS   = groups login su
@@ -10,7 +8,7 @@ Index: git/src/Makefile.am
  ubin_PROGRAMS  = faillog lastlog chage chfn chsh expiry gpasswd newgrp passwd
  if ENABLE_SUBIDS
  ubin_PROGRAMS += newgidmap newuidmap
-@@ -41,6 +40,7 @@
+@@ -42,6 +41,7 @@
  	grpunconv \
  	logoutd \
  	newusers \

debian/patches/523_su_arguments_are_concatenated

@@ -1,50 +0,0 @@
-Goal: Concatenate the non-su arguments and provide them to the shell with
-      the -c option
-Fixes: #317264
-       see also #276419
-
-Status wrt upstream: This is a Debian specific patch.
-
-Note: the fix of the man page is still missing.
-      (to be taken from the trunk)
-
-Index: git/src/su.c
-===================================================================
---- git.orig/src/su.c
-+++ git/src/su.c
-@@ -1152,6 +1152,35 @@
- 			argv[0] = "-c";
- 			argv[1] = command;
- 		}
-+		/* On Debian, the arguments are concatenated and the
-+		 * resulting string is always given to the shell with its
-+		 * -c option.
-+		 */
-+		{
-+			char **parg;
-+			unsigned int cmd_len = 0;
-+			char *cmd = NULL;
-+			if (strcmp(argv[0], "-c") != 0) {
-+				argv--;
-+				argv[0] = "-c";
-+			}
-+			/* Now argv[0] is always -c, and other arguments
-+			 * can be concatenated
-+			 */
-+			cmd_len = 1; /* finale '\0' */
-+			for (parg = &argv[1]; *parg; parg++) {
-+				cmd_len += strlen (*parg) + 1;
-+			}
-+			cmd = (char *) xmalloc (sizeof (char) * cmd_len);
-+			cmd[0] = '\0';
-+			for (parg = &argv[1]; *parg; parg++) {
-+				strcat (cmd, " ");
-+				strcat (cmd, *parg);
-+			}
-+			cmd[cmd_len - 1] = '\0';
-+			argv[1] = &cmd[1]; /* do not take first space */
-+			argv[2] = NULL;
-+		}
- 		/*
- 		 * Use the shell and create an argv
- 		 * with the rest of the command line included.

debian/patches/523_su_arguments_are_no_more_concatenated_by_default

@@ -1,52 +0,0 @@
-Goal: Do not concatenate the additional arguments, and support an
-      environment variable to revert to the old Debian's su behavior.
-
-This patch needs the su_arguments_are_concatenated patch.
-
-This patch, and su_arguments_are_concatenated should be dropped after
-Etch.
-
-Status wrt upstream: This patch is Debian specific.
-
-Index: git/src/su.c
-===================================================================
---- git.orig/src/su.c
-+++ git/src/su.c
-@@ -104,6 +104,19 @@
- /* If nonzero, change some environment vars to indicate the user su'd to. */
- static bool change_environment = true;
- 
-+/*
-+ * If nonzero, keep the old Debian behavior:
-+ *   * concatenate all the arguments and provide them to the -c option of
-+ *     the shell
-+ *   * If there are some additional arguments, but no -c, add a -c
-+ *     argument anyway
-+ * Drawbacks:
-+ *   * you can't provide options to the shell (other than -c)
-+ *   * you can't rely on the argument count
-+ * See http://bugs.debian.org/276419
-+ */
-+static int old_debian_behavior;
-+
- #ifdef USE_PAM
- static pam_handle_t *pamh = NULL;
- static int caught = 0;
-@@ -949,6 +962,8 @@
- 	int ret;
- #endif				/* USE_PAM */
- 
-+	old_debian_behavior = (getenv("SU_NO_SHELL_ARGS") != NULL);
-+
- 	(void) setlocale (LC_ALL, "");
- 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
- 	(void) textdomain (PACKAGE);
-@@ -1156,7 +1171,7 @@
- 		 * resulting string is always given to the shell with its
- 		 * -c option.
- 		 */
--		{
-+		if (old_debian_behavior) {
- 			char **parg;
- 			unsigned int cmd_len = 0;
- 			char *cmd = NULL;

debian/patches/542_useradd-O_option

@@ -5,12 +5,10 @@ Note: useradd.8 needs to be regenerated.
 Status wrt upstream: not included as this is just specific 
                      backward compatibility for Debian
 
-Index: git/man/useradd.8.xml
-===================================================================
---- git.orig/man/useradd.8.xml
-+++ git/man/useradd.8.xml
+--- a/man/useradd.8.xml
++++ b/man/useradd.8.xml
 @@ -329,6 +329,11 @@
- 	    databases are resetted to avoid reusing the entry from a previously
+ 	    databases are reset to avoid reusing the entry from a previously
  	    deleted user.
  	  </para>
 +          <para>
@@ -21,11 +19,9 @@ Index: git/man/useradd.8.xml
  	</listitem>
        </varlistentry>
        <varlistentry>
-Index: git/src/useradd.c
-===================================================================
---- git.orig/src/useradd.c
-+++ git/src/useradd.c
-@@ -1056,9 +1056,9 @@
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -1059,9 +1059,9 @@
  		};
  		while ((c = getopt_long (argc, argv,
  #ifdef WITH_SELINUX
@@ -37,7 +33,7 @@ Index: git/src/useradd.c
  #endif				/* !WITH_SELINUX */
  		                         long_options, NULL)) != -1) {
  			switch (c) {
-@@ -1181,6 +1181,7 @@
+@@ -1184,6 +1184,7 @@
  				kflg = true;
  				break;
  			case 'K':

debian/patches/README.patches

@@ -1,22 +1,13 @@
 Small intro to the system for numbering the patches here...
 
--The 0xx series of patches are patches isolated from the latest
+-The 00xx-... patches are forwarded to upstream's git repository
+
+-The 0xx_... series of patches are patches isolated from the latest
  version of the shadow Debian package not using quilt in order to
  separate upstream from Debian-specific stuff.
 
  NO MORE PATCHES SHOULD BE ADDED IN THESE SERIES
 
--The 1xx series are l10n patches to upstream 4.0.18.1. As upstream has
- adopted Debian translations, it is very likely that these patches
- will become useless when we will have synced with upstream
-
--The 2xx series are patches for manual pages translations to upstream
- 4.0.18.1.
-
--The 3xx series are patches which have been temporarily applied to 
- Debian's shadow while we *know* they have been applied upstream as well
- These patches should NOT be kept when we will sync with upstream
-
 -The 4xx series are patches which have been applied to Debian's shadow
  and have NOT been accepted and/or applied upstream. These patches MUST be kept
  even after resynced with upstream
@@ -29,43 +20,3 @@ In short, while we are working towards synchronisation with upstream,
 our goal is to make 0xx patches disappear by moving them either to 3xx
 series (things already implemented upstream) or to 4xx series
 (Debian-specific patches).
-
-
-Short HOWTO for quilt
-=====================
-
-The quilt system can be assimilated to a Pile Of Patches management system.
-Patches live in debian/patches, the working directory is "."
-
-The basic commands are (abbreviation accepted):
-quilt push (asks to apply the next patch in the pile)
-quilt pop  (removes the current patch and go up in the pile)
-quilt refresh (take the current changes in tree onto the patch)
-
-When a file is changed by a patch, quilt saves it somewhere under .pc on
-application. This is how it can refresh it afterward (comparing the version
-in .pc and the one you currently have in your working dir).
-
-There are three common pitfalls with quilt:
- - doing "quilt pop" without doing "quilt refresh". The version of current
-     dir is replaced with the version of the .pc dir. Your changes are lost.
-   Quilt wont let you do so, but you can force it with '-f' if you're fool.
- - editing a file with is not in the patch yet. Quilt didn't do any previous
-     backup.
-   Use "quilt add" to add files to patches.
-   Set $EDITOR and use "quilt edit" to edit a file, and add it onto the
-     patch if needed.
- - If you update your working directory, patches may not revert cleanly.
-   It is thus recommended to use "quilt pop -a" before updating with
-   "svn up".
-   If you forget (and run into trouble), you may want to remove the whole
-   shadow-?.?.? directory. If you use the makefile which is in the upper
-   directory (trunk/), shadow-?.?.?/debian/patches is a link to
-   debian/patches, so this dirctory does not contain any valuable info.
-
-The documentation is quite well done, I think. "quilt -h" will list you the
-commands. "quilt <cmd> -h" will give you some hints about it. "man quilt" is
-a reference documentation. /usr/share/doc/quilt/quilt.pdf.gz is a complete
-manual, with tutorial.
-
-

debian/patches/series

@@ -10,26 +10,11 @@
 402_cppw_selinux
 506_relaxed_usernames
 542_useradd-O_option
-501_commonio_group_shadow
 463_login_delay_obeys_to_PAM
-523_su_arguments_are_concatenated
-523_su_arguments_are_no_more_concatenated_by_default
 508_nologin_in_usr_sbin
 505_useradd_recommend_adduser
-#userns/01_userns_doc
-#userns/02_userns_doc_login.defs
-#userns/03_userns_implement_commonio_append
-#userns/04_userns_add_backend_support
-#userns/05_userns_implemend_find_new_sub_xids
-#userns/06_userns_userdel
-#userns/07_userns_useradd
-#userns/08_userns_detect_busy_subids
-#userns/09_userns_usermod
-#userns/10_userns_newusers
-#userns/11_userns_newxidmap
-#userns/12_userns_selinuxlibs
-#userns/13_subordinate_parse_static_buf
-#userns/14_fix_getopt
-#userns/manpagetypo
-#userns/16_add-argument-sanity-checking.patch
-1000_configure_userns
+501_commonio_group_shadow
+0001-newgidmap-enforce-setgroups-deny-if-self-mapping-a-g.patch
+0002-gpasswd-1-Fix-password-leak.patch
+0003-Added-control-character-check.patch
+0004-Overhaul-valid_field.patch

debian/patches/userns/01_userns_doc

@@ -1,334 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:14:18 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id DAC33C80F4; Tue, 22 Jan 2013 09:14:18 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
-	autolearn=no version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id 274ACC80D1
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:14:14 +0000 (UTC)
-Received: from out01.mta.xmission.com ([166.70.13.231])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZuB-0006Xm-N5; Tue, 22 Jan 2013 02:12:31 -0700
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out01.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZuA-0005NR-BQ; Tue, 22 Jan 2013 02:12:30 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZu7-0004Pj-Ec; Tue, 22 Jan 2013 02:12:30 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:12:23 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <877gn5shs8.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX18YouPWtKNAX3LovSW2+p/ONbuCHMFEQpM=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 01/11] Documentation for /etc/subuid and /etc/subgid
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2071                                                  
-Status: RO
-Content-Length: 9835
-Lines: 286
-
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- man/Makefile.am  |    4 ++
- man/subgid.5.xml |  120 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
- man/subuid.5.xml |  120 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 244 insertions(+), 0 deletions(-)
- create mode 100644 man/subgid.5.xml
- create mode 100644 man/subuid.5.xml
-
-Index: shadow/man/Makefile.am
-===================================================================
---- shadow.orig/man/Makefile.am	2013-02-01 15:26:14.428082026 -0600
-+++ shadow/man/Makefile.am	2013-02-01 15:27:37.000000000 -0600
-@@ -43,6 +43,8 @@
- 	man5/shadow.5 \
- 	man1/su.1 \
- 	man5/suauth.5 \
-+	man5/subgid.5 \
-+	man5/subuid.5 \
- 	man8/useradd.8 \
- 	man8/userdel.8 \
- 	man8/usermod.8 \
-@@ -94,6 +96,8 @@
- 	sg.1.xml \
- 	su.1.xml \
- 	suauth.5.xml \
-+	subgid.5.xml \
-+	subuid.5.xml \
- 	useradd.8.xml \
- 	userdel.8.xml \
- 	usermod.8.xml \
-Index: shadow/man/subgid.5.xml
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ shadow/man/subgid.5.xml	2013-02-01 15:26:14.424082026 -0600
-@@ -0,0 +1,120 @@
-+<?xml version="1.0" encoding="UTF-8"?>
-+<!--
-+   Copyright (c) 2013 Eric W. Biederman
-+   All rights reserved.
-+  
-+   Redistribution and use in source and binary forms, with or without
-+   modification, are permitted provided that the following conditions
-+   are met:
-+   1. Redistributions of source code must retain the above copyright
-+      notice, this list of conditions and the following disclaimer.
-+   2. Redistributions in binary form must reproduce the above copyright
-+      notice, this list of conditions and the following disclaimer in the
-+      documentation and/or other materials provided with the distribution.
-+   3. The name of the copyright holders or contributors may not be used to
-+      endorse or promote products derived from this software without
-+      specific prior written permission.
-+  
-+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
-+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+-->
-+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.5//EN"
-+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-+<!-- SHADOW-CONFIG-HERE -->
-+]>
-+<refentry id='subgid.5'>
-+  <refmeta>
-+    <refentrytitle>subgid</refentrytitle>
-+    <manvolnum>5</manvolnum>
-+    <refmiscinfo class="sectdesc">File Formats and Conversions</refmiscinfo>
-+    <refmiscinfo class="source">shadow-utils</refmiscinfo>
-+    <refmiscinfo class="version">&SHADOW_UTILS_VERSION;</refmiscinfo>
-+  </refmeta>
-+  <refnamediv id='name'>
-+    <refname>subgid</refname>
-+    <refpurpose>the subordinate gid file</refpurpose>
-+  </refnamediv>
-+
-+  <refsect1 id='description'>
-+    <title>DESCRIPTION</title>
-+    <para>
-+      Each line in <filename>/etc/subgid</filename> contains
-+      a user id and a range of suboridinate user ids that user
-+      is allowed to use.
-+
-+      This is specified with three fields delimited by colons
-+      (<quote>:</quote>).
-+      These fields are:
-+    </para>
-+    <itemizedlist mark='bullet'>
-+      <listitem>
-+	<para>login name</para>
-+      </listitem>
-+      <listitem>
-+	<para>numerical subordinate user ID</para>
-+      </listitem>
-+      <listitem>
-+	<para>numerical subordinate user ID count</para>
-+      </listitem>
-+    </itemizedlist>
-+
-+    <para>
-+      This file specifies the group IDs to be that each user may use
-+      with the <command>newgidmap</command> command that ordinary users can use to
-+      configure gid mapping in a user namespace.
-+    </para>
-+
-+    <para>
-+      Multiple ranges may be specified per user ID.
-+    </para>
-+
-+  </refsect1>
-+
-+  <refsect1 id='files'>
-+    <title>FILES</title>
-+    <variablelist>
-+      <varlistentry>
-+	<term><filename>/etc/subgid</filename></term>
-+	<listitem>
-+	  <para>Per user subordinate group IDs.</para>
-+	</listitem>
-+      </varlistentry>
-+      <varlistentry>
-+	<term><filename>/etc/subgid-</filename></term>
-+	<listitem>
-+	  <para>Backup file for /etc/subgid.</para>
-+	</listitem>
-+      </varlistentry>
-+    </variablelist>
-+  </refsect1>
-+
-+  <refsect1 id='see_also'>
-+    <title>SEE ALSO</title>
-+    <para>
-+      <citerefentry>
-+	<refentrytitle>subuid</refentrytitle><manvolnum>5</manvolnum>
-+      </citerefentry>,
-+      <citerefentry>
-+	<refentrytitle>logindefs</refentrytitle><manvolnum>5</manvolnum>
-+      </citerefentry>,
-+      <citerefentry>
-+	<refentrytitle>newuidmap</refentrytitle><manvolnum>1</manvolnum>
-+      </citerefentry>,
-+      <citerefentry>
-+	<refentrytitle>newgidmap</refentrytitle><manvolnum>1</manvolnum>
-+      </citerefentry>,
-+      <citerefentry>
-+	<refentrytitle>usermod</refentrytitle><manvolnum>8</manvolnum>
-+      </citerefentry>,
-+    </para>
-+  </refsect1>
-+</refentry>
-Index: shadow/man/subuid.5.xml
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ shadow/man/subuid.5.xml	2013-02-01 15:26:14.424082026 -0600
-@@ -0,0 +1,120 @@
-+<?xml version="1.0" encoding="UTF-8"?>
-+<!--
-+   Copyright (c) 2013 Eric W. Biederman
-+   All rights reserved.
-+  
-+   Redistribution and use in source and binary forms, with or without
-+   modification, are permitted provided that the following conditions
-+   are met:
-+   1. Redistributions of source code must retain the above copyright
-+      notice, this list of conditions and the following disclaimer.
-+   2. Redistributions in binary form must reproduce the above copyright
-+      notice, this list of conditions and the following disclaimer in the
-+      documentation and/or other materials provided with the distribution.
-+   3. The name of the copyright holders or contributors may not be used to
-+      endorse or promote products derived from this software without
-+      specific prior written permission.
-+  
-+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
-+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+-->
-+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.5//EN"
-+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-+<!-- SHADOW-CONFIG-HERE -->
-+]>
-+<refentry id='subuid.5'>
-+  <refmeta>
-+    <refentrytitle>subuid</refentrytitle>
-+    <manvolnum>5</manvolnum>
-+    <refmiscinfo class="sectdesc">File Formats and Conversions</refmiscinfo>
-+    <refmiscinfo class="source">shadow-utils</refmiscinfo>
-+    <refmiscinfo class="version">&SHADOW_UTILS_VERSION;</refmiscinfo>
-+  </refmeta>
-+  <refnamediv id='name'>
-+    <refname>subuid</refname>
-+    <refpurpose>the subordinate uid file</refpurpose>
-+  </refnamediv>
-+
-+  <refsect1 id='description'>
-+    <title>DESCRIPTION</title>
-+    <para>
-+      Each line in <filename>/etc/subuid</filename> contains
-+      a user id and a range of suboridinate user ids that user
-+      is allowed to use.
-+
-+      This is specified with three fields delimited by colons
-+      (<quote>:</quote>).
-+      These fields are:
-+    </para>
-+    <itemizedlist mark='bullet'>
-+      <listitem>
-+	<para>login name</para>
-+      </listitem>
-+      <listitem>
-+	<para>numerical subordinate user ID</para>
-+      </listitem>
-+      <listitem>
-+	<para>numerical subordinate user ID count</para>
-+      </listitem>
-+    </itemizedlist>
-+
-+    <para>
-+      This file specifies the user IDs to be that each user may use
-+      with the <command>newuidmap</command> command that ordinary users can use to
-+      configure uid mapping in a user namespace.
-+    </para>
-+
-+    <para>
-+      Multiple ranges may be specified per user ID.
-+    </para>
-+
-+  </refsect1>
-+
-+  <refsect1 id='files'>
-+    <title>FILES</title>
-+    <variablelist>
-+      <varlistentry>
-+	<term><filename>/etc/subuid</filename></term>
-+	<listitem>
-+	  <para>Per user subordinate user IDs.</para>
-+	</listitem>
-+      </varlistentry>
-+      <varlistentry>
-+	<term><filename>/etc/subuid-</filename></term>
-+	<listitem>
-+	  <para>Backup file for /etc/subuid.</para>
-+	</listitem>
-+      </varlistentry>
-+    </variablelist>
-+  </refsect1>
-+
-+  <refsect1 id='see_also'>
-+    <title>SEE ALSO</title>
-+    <para>
-+      <citerefentry>
-+	<refentrytitle>subgid</refentrytitle><manvolnum>5</manvolnum>
-+      </citerefentry>,
-+      <citerefentry>
-+	<refentrytitle>logindefs</refentrytitle><manvolnum>5</manvolnum>
-+      </citerefentry>,
-+      <citerefentry>
-+	<refentrytitle>newuidmap</refentrytitle><manvolnum>1</manvolnum>
-+      </citerefentry>,
-+      <citerefentry>
-+	<refentrytitle>newgidmap</refentrytitle><manvolnum>1</manvolnum>
-+      </citerefentry>,
-+      <citerefentry>
-+	<refentrytitle>usermod</refentrytitle><manvolnum>8</manvolnum>
-+      </citerefentry>,
-+    </para>
-+  </refsect1>
-+</refentry>

debian/patches/userns/02_userns_doc_login.defs

@@ -1,218 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:14:55 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id 140DBC80F4; Tue, 22 Jan 2013 09:14:55 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
-	autolearn=no version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id 5D815C80D1
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:14:50 +0000 (UTC)
-Received: from out03.mta.xmission.com ([166.70.13.233])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZum-0006il-0f; Tue, 22 Jan 2013 02:13:08 -0700
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZul-0004GF-Id; Tue, 22 Jan 2013 02:13:07 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZuf-0004T0-MS; Tue, 22 Jan 2013 02:13:07 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:12:58 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <871uddshr9.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX19iYyOCEx6dl2v1Ya/KIGpixG5+3MVA1bY=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 02/11] login.defs.5: Document the new variables in login.defs
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2072                                                  
-Status: RO
-Content-Length: 7615
-Lines: 170
-
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- man/Makefile.am                    |    2 +
- man/login.defs.5.xml               |    8 ++++++
- man/login.defs.d/SUB_GID_COUNT.xml |   46 ++++++++++++++++++++++++++++++++++++
- man/login.defs.d/SUB_UID_COUNT.xml |   46 ++++++++++++++++++++++++++++++++++++
- 4 files changed, 102 insertions(+), 0 deletions(-)
- create mode 100644 man/login.defs.d/SUB_GID_COUNT.xml
- create mode 100644 man/login.defs.d/SUB_UID_COUNT.xml
-
-Index: shadow/man/Makefile.am
-===================================================================
---- shadow.orig/man/Makefile.am	2013-02-01 15:27:51.048080390 -0600
-+++ shadow/man/Makefile.am	2013-02-01 15:27:51.040080390 -0600
-@@ -163,6 +163,8 @@
- 	USERDEL_CMD.xml \
- 	USERGROUPS_ENAB.xml \
- 	USE_TCB.xml \
-+	SUB_GID_COUNT.xml \
-+	SUB_UID_COUNT.xml \
- 	SYS_GID_MAX.xml \
- 	SYS_UID_MAX.xml
- 
-Index: shadow/man/login.defs.5.xml
-===================================================================
---- shadow.orig/man/login.defs.5.xml	2013-02-01 15:27:51.048080390 -0600
-+++ shadow/man/login.defs.5.xml	2013-02-01 15:27:51.044080390 -0600
-@@ -78,6 +78,8 @@
- <!ENTITY SULOG_FILE            SYSTEM "login.defs.d/SULOG_FILE.xml">
- <!ENTITY SU_NAME               SYSTEM "login.defs.d/SU_NAME.xml">
- <!ENTITY SU_WHEEL_ONLY         SYSTEM "login.defs.d/SU_WHEEL_ONLY.xml">
-+<!ENTITY SUB_GID_COUNT         SYSTEM "login.defs.d/SUB_GID_COUNT.xml">
-+<!ENTITY SUB_UID_COUNT         SYSTEM "login.defs.d/SUB_UID_COUNT.xml">
- <!ENTITY SYS_GID_MAX           SYSTEM "login.defs.d/SYS_GID_MAX.xml">
- <!ENTITY SYSLOG_SG_ENAB        SYSTEM "login.defs.d/SYSLOG_SG_ENAB.xml">
- <!ENTITY SYSLOG_SU_ENAB        SYSTEM "login.defs.d/SYSLOG_SU_ENAB.xml">
-@@ -216,6 +218,8 @@
-       &SULOG_FILE;
-       &SU_NAME;
-       &SU_WHEEL_ONLY;
-+      &SUB_GID_COUNT; <!-- documents also SUB_GID_MIN SUB_GID_MAX -->
-+      &SUB_UID_COUNT; <!-- documents also SUB_UID_MIN SUB_UID_MAX -->
-       &SYS_GID_MAX; <!-- documents also SYS_GID_MIN -->
-       &SYS_UID_MAX; <!-- documents also SYS_UID_MIN -->
-       &SYSLOG_SG_ENAB;
-@@ -393,6 +397,8 @@
- 	    PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE
- 	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
- 	    SHA_CRYPT_MIN_ROUNDS</phrase>
-+	    SUB_GID_COUNT SUB_GID_MAX SUB_GID_MIN
-+	    SUB_UID_COUNT SUB_UID_MAX SUB_UID_MIN
- 	    SYS_GID_MAX SYS_GID_MIN SYS_UID_MAX SYS_UID_MIN UID_MAX UID_MIN
- 	    UMASK
- 	  </para>
-@@ -470,6 +476,8 @@
- 	    GID_MAX GID_MIN
- 	    MAIL_DIR MAX_MEMBERS_PER_GROUP
- 	    PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE
-+	    SUB_GID_COUNT SUB_GID_MAX SUB_GID_MIN
-+	    SUB_UID_COUNT SUB_UID_MAX SUB_UID_MIN
- 	    SYS_GID_MAX SYS_GID_MIN SYS_UID_MAX SYS_UID_MIN UID_MAX UID_MIN
- 	    UMASK
- 	    <phrase condition="tcb">TCB_AUTH_GROUP TCB_SYMLINK USE_TCB</phrase>
-Index: shadow/man/login.defs.d/SUB_GID_COUNT.xml
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ shadow/man/login.defs.d/SUB_GID_COUNT.xml	2013-02-01 15:27:51.044080390 -0600
-@@ -0,0 +1,46 @@
-+<!--
-+   Copyright (c) 2013, Eric W. Biederman
-+   All rights reserved.
-+  
-+   Redistribution and use in source and binary forms, with or without
-+   modification, are permitted provided that the following conditions
-+   are met:
-+   1. Redistributions of source code must retain the above copyright
-+      notice, this list of conditions and the following disclaimer.
-+   2. Redistributions in binary form must reproduce the above copyright
-+      notice, this list of conditions and the following disclaimer in the
-+      documentation and/or other materials provided with the distribution.
-+   3. The name of the copyright holders or contributors may not be used to
-+      endorse or promote products derived from this software without
-+      specific prior written permission.
-+  
-+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
-+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+-->
-+<varlistentry>
-+  <term><option>SUB_GID_MIN</option> (number)</term>
-+  <term><option>SUB_GID_MAX</option> (number)</term>
-+  <term><option>SUB_GID_COUNT</option> (number)</term>
-+  <listitem>
-+    <para>
-+      The commands <command>useradd</command> and <command>newusers</command>
-+      allocate <option>SUB_GID_COUNT</option> unused group IDs from the range
-+      <option>SUB_GID_MIN</option> to <option>SUB_GID_MAX</option> for each
-+      new user.
-+    </para>
-+    <para>
-+      The default values for <option>SUB_GID_MAN</option>,
-+      <option>SUB_GID_MIN</option>, <option>SUB_GID_COUNT</option>
-+      are respectively 100000, 600100000 and 10000.
-+    </para>
-+  </listitem>
-+</varlistentry>
-Index: shadow/man/login.defs.d/SUB_UID_COUNT.xml
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ shadow/man/login.defs.d/SUB_UID_COUNT.xml	2013-02-01 15:27:51.044080390 -0600
-@@ -0,0 +1,46 @@
-+<!--
-+   Copyright (c) 2013, Eric W. Biederman
-+   All rights reserved.
-+  
-+   Redistribution and use in source and binary forms, with or without
-+   modification, are permitted provided that the following conditions
-+   are met:
-+   1. Redistributions of source code must retain the above copyright
-+      notice, this list of conditions and the following disclaimer.
-+   2. Redistributions in binary form must reproduce the above copyright
-+      notice, this list of conditions and the following disclaimer in the
-+      documentation and/or other materials provided with the distribution.
-+   3. The name of the copyright holders or contributors may not be used to
-+      endorse or promote products derived from this software without
-+      specific prior written permission.
-+  
-+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
-+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+-->
-+<varlistentry>
-+  <term><option>SUB_UID_MIN</option> (number)</term>
-+  <term><option>SUB_UID_MAX</option> (number)</term>
-+  <term><option>SUB_UID_COUNT</option> (number)</term>
-+  <listitem>
-+    <para>
-+      The commands <command>useradd</command> and <command>newusers</command>
-+      allocate <option>SUB_UID_COUNT</option> unused user IDs from the range
-+      <option>SUB_UID_MIN</option> to <option>SUB_UID_MAX</option> for each
-+      new user.
-+    </para>
-+    <para>
-+      The default values for <option>SUB_GID_MAN</option>,
-+      <option>SUB_GID_MIN</option>, <option>SUB_GID_COUNT</option>
-+      are respectively 100000, 600100000 and 10000.
-+    </para>
-+  </listitem>
-+</varlistentry>

debian/patches/userns/03_userns_implement_commonio_append

@@ -1,110 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:15:19 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id CAFA8C80F6; Tue, 22 Jan 2013 09:15:19 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
-	autolearn=no version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id 43FAEC80D1
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:15:15 +0000 (UTC)
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZvA-0006sA-Pq; Tue, 22 Jan 2013 02:13:32 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZv8-0004VI-Fi; Tue, 22 Jan 2013 02:13:32 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:13:26 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <87vcapr361.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX1++0A/mQBimfZkeNedO095IfnCYGQfIolI=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 03/11] Implement commonio_append.
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2073                                                  
-Status: RO
-Content-Length: 1874
-Lines: 65
-
-
-To support files that do not have a simple unique key implement
-commonio_append to allow new entries to be added.
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- lib/commonio.c |   30 ++++++++++++++++++++++++++++++
- lib/commonio.h |    1 +
- 2 files changed, 31 insertions(+), 0 deletions(-)
-
-Index: shadow/lib/commonio.c
-===================================================================
---- shadow.orig/lib/commonio.c	2013-02-01 15:27:51.376080384 -0600
-+++ shadow/lib/commonio.c	2013-02-01 15:27:51.368080384 -0600
-@@ -1121,6 +1121,36 @@
- 	return 1;
- }
- 
-+int commonio_append (struct commonio_db *db, const void *eptr)
-+{
-+	struct commonio_entry *p;
-+	void *nentry;
-+
-+	if (!db->isopen || db->readonly) {
-+		errno = EINVAL;
-+		return 0;
-+	}
-+	nentry = db->ops->dup (eptr);
-+	if (NULL == nentry) {
-+		errno = ENOMEM;
-+		return 0;
-+	}
-+	/* new entry */
-+	p = (struct commonio_entry *) malloc (sizeof *p);
-+	if (NULL == p) {
-+		db->ops->free (nentry);
-+		errno = ENOMEM;
-+		return 0;
-+	}
-+
-+	p->eptr = nentry;
-+	p->line = NULL;
-+	p->changed = true;
-+	add_one_entry (db, p);
-+
-+	db->changed = true;
-+	return 1;
-+}
- 
- void commonio_del_entry (struct commonio_db *db, const struct commonio_entry *p)
- {
-Index: shadow/lib/commonio.h
-===================================================================
---- shadow.orig/lib/commonio.h	2013-02-01 15:27:51.376080384 -0600
-+++ shadow/lib/commonio.h	2013-02-01 15:27:51.368080384 -0600
-@@ -146,6 +146,7 @@
- extern int commonio_open (struct commonio_db *, int);
- extern /*@observer@*/ /*@null@*/const void *commonio_locate (struct commonio_db *, const char *);
- extern int commonio_update (struct commonio_db *, const void *);
-+extern int commonio_append (struct commonio_db *, const void *);
- extern int commonio_remove (struct commonio_db *, const char *);
- extern int commonio_rewind (struct commonio_db *);
- extern /*@observer@*/ /*@null@*/const void *commonio_next (struct commonio_db *);

debian/patches/userns/04_userns_add_backend_support

@@ -1,685 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:16:29 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id AF9A9C80F4; Tue, 22 Jan 2013 09:16:29 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
-	autolearn=no version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id EDF70C80D1
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:16:24 +0000 (UTC)
-Received: from out01.mta.xmission.com ([166.70.13.231])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZwI-0007HS-Mn; Tue, 22 Jan 2013 02:14:42 -0700
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out01.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZwI-0005wP-8E; Tue, 22 Jan 2013 02:14:42 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZwE-0004bA-Mv; Tue, 22 Jan 2013 02:14:42 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:14:35 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <87liblr344.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX1/3QOlmT6VsAuzQbs/RJ/nb1IrpO++QYVA=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 04/11] Add backend support for suboridnate uids and gids
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2074                                                  
-Status: RO
-X-Status: A
-Content-Length: 15967
-Lines: 636
-
-
-These files list the set of subordinate uids and gids that users are allowed
-to use.   The expect use case is with the user namespace but other uses are
-allowed.
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- etc/login.defs      |    8 +
- lib/Makefile.am     |    2 +
- lib/getdef.c        |    6 +
- lib/subordinateio.c |  512 +++++++++++++++++++++++++++++++++++++++++++++++++++
- lib/subordinateio.h |   38 ++++
- 5 files changed, 566 insertions(+), 0 deletions(-)
- create mode 100644 lib/subordinateio.c
- create mode 100644 lib/subordinateio.h
-
-Index: shadow/etc/login.defs
-===================================================================
---- shadow.orig/etc/login.defs	2013-02-01 15:27:51.684080379 -0600
-+++ shadow/etc/login.defs	2013-02-01 15:27:51.676080379 -0600
-@@ -226,6 +226,10 @@
- # System accounts
- SYS_UID_MIN		  101
- SYS_UID_MAX		  999
-+# Extra per user uids
-+SUB_UID_MIN		   100000
-+SUB_UID_MAX		600100000
-+SUB_UID_COUNT		    10000
- 
- #
- # Min/max values for automatic gid selection in groupadd
-@@ -235,6 +239,10 @@
- # System accounts
- SYS_GID_MIN		  101
- SYS_GID_MAX		  999
-+# Extra per user group ids
-+SUB_GID_MIN		   100000
-+SUB_GID_MAX		600100000
-+SUB_GID_COUNT		    10000
- 
- #
- # Max number of login retries if password is bad
-Index: shadow/lib/Makefile.am
-===================================================================
---- shadow.orig/lib/Makefile.am	2013-02-01 15:27:51.684080379 -0600
-+++ shadow/lib/Makefile.am	2013-02-01 15:27:51.676080379 -0600
-@@ -39,6 +39,8 @@
- 	pwio.c \
- 	pwio.h \
- 	pwmem.c \
-+	subordinateio.h \
-+	subordinateio.c \
- 	selinux.c \
- 	semanage.c \
- 	sgetgrent.c \
-Index: shadow/lib/getdef.c
-===================================================================
---- shadow.orig/lib/getdef.c	2013-02-01 15:27:51.684080379 -0600
-+++ shadow/lib/getdef.c	2013-02-01 15:27:51.680080379 -0600
-@@ -82,6 +82,12 @@
- 	{"SHA_CRYPT_MAX_ROUNDS", NULL},
- 	{"SHA_CRYPT_MIN_ROUNDS", NULL},
- #endif
-+	{"SUB_GID_COUNT", NULL},
-+	{"SUB_GID_MAX", NULL},
-+	{"SUB_GID_MIN", NULL},
-+	{"SUB_UID_COUNT", NULL},
-+	{"SUB_UID_MAX", NULL},
-+	{"SUB_UID_MIN", NULL},
- 	{"SULOG_FILE", NULL},
- 	{"SU_NAME", NULL},
- 	{"SYS_GID_MAX", NULL},
-Index: shadow/lib/subordinateio.c
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ shadow/lib/subordinateio.c	2013-02-01 15:27:51.680080379 -0600
-@@ -0,0 +1,512 @@
-+/*
-+ * Copyright (c) 2012 - Eric Biederman
-+ */
-+
-+#include <config.h>
-+#include "prototypes.h"
-+#include "defines.h"
-+#include <stdio.h>
-+#include "commonio.h"
-+#include "subordinateio.h"
-+
-+struct subordinate_range {
-+	const char *owner;
-+	unsigned long start;
-+	unsigned long count;
-+};
-+
-+#define NFIELDS 3
-+
-+static /*@null@*/ /*@only@*/void *subordinate_dup (const void *ent)
-+{
-+	const struct subordinate_range *rangeent = ent;
-+	struct subordinate_range *range;
-+
-+	range = (struct subordinate_range *) malloc (sizeof *range);
-+	if (NULL == range) {
-+		return NULL;
-+	}
-+	range->owner = strdup (rangeent->owner);
-+	if (NULL == range->owner) {
-+		free(range);
-+		return NULL;
-+	}
-+	range->start = rangeent->start;
-+	range->count = rangeent->count;
-+
-+	return range;
-+}
-+
-+static void subordinate_free (/*@out@*/ /*@only@*/void *ent)
-+{
-+	struct subordinate_range *rangeent = ent;
-+	
-+	free ((void *)(rangeent->owner));
-+	free (rangeent);
-+}
-+
-+static void *subordinate_parse (const char *line)
-+{
-+	static struct subordinate_range range;
-+	char rangebuf[1024];
-+	int i;
-+	char *cp;
-+	char *fields[NFIELDS];
-+
-+	/*
-+	 * Copy the string to a temporary buffer so the substrings can
-+	 * be modified to be NULL terminated.
-+	 */
-+	if (strlen (line) >= sizeof rangebuf)
-+		return NULL;	/* fail if too long */
-+	strcpy (rangebuf, line);
-+
-+	/*
-+	 * Save a pointer to the start of each colon separated
-+	 * field.  The fields are converted into NUL terminated strings.
-+	 */
-+
-+	for (cp = rangebuf, i = 0; (i < NFIELDS) && (NULL != cp); i++) {
-+		fields[i] = cp;
-+		while (('\0' != *cp) && (':' != *cp)) {
-+			cp++;
-+		}
-+
-+		if ('\0' != *cp) {
-+			*cp = '\0';
-+			cp++;
-+		} else {
-+			cp = NULL;
-+		}
-+	}
-+
-+	/*
-+	 * There must be exactly NFIELDS colon separated fields or
-+	 * the entry is invalid.  Also, fields must be non-blank.
-+	 */
-+	if (i != NFIELDS || *fields[0] == '\0' || *fields[1] == '\0' || *fields[2] == '\0')
-+		return NULL;
-+	range.owner = fields[0];
-+	if (getulong (fields[1], &range.start) == 0)
-+		return NULL;
-+	if (getulong (fields[2], &range.count) == 0)
-+		return NULL;
-+
-+	return &range;
-+}
-+
-+static int subordinate_put (const void *ent, FILE * file)
-+{
-+	const struct subordinate_range *range = ent;
-+
-+	return fprintf(file, "%s:%lu:%lu\n",
-+			       range->owner,
-+			       range->start,
-+			       range->count) < 0 ? -1  : 0;
-+}
-+
-+static struct commonio_ops subordinate_ops = {
-+	subordinate_dup,	/* dup */
-+	subordinate_free,	/* free */
-+	NULL,			/* getname */
-+	subordinate_parse,	/* parse */
-+	subordinate_put,	/* put */
-+	fgets,			/* fgets */
-+	fputs,			/* fputs */
-+	NULL,			/* open_hook */
-+	NULL,			/* close_hook */
-+};
-+
-+static /*@observer@*/ /*@null*/const struct subordinate_range *subordinate_next(struct commonio_db *db)
-+{
-+	commonio_next (db);
-+}
-+
-+static bool is_range_free(struct commonio_db *db, unsigned long start,
-+			  unsigned long count)
-+{
-+	const struct subordinate_range *range;
-+	unsigned long end = start + count - 1;
-+
-+	commonio_rewind(db);
-+	while ((range = commonio_next(db)) != NULL) {
-+		unsigned long first = range->start;
-+		unsigned long last = first + range->count - 1;
-+
-+		if ((end >= first) && (start <= last))
-+			return false;
-+	}
-+	return true;
-+}
-+
-+static const bool range_exists(struct commonio_db *db, const char *owner)
-+{
-+	const struct subordinate_range *range;
-+	commonio_rewind(db);
-+	while ((range = commonio_next(db)) != NULL) {
-+		unsigned long first = range->start;
-+		unsigned long last = first + range->count - 1;
-+
-+		if (0 == strcmp(range->owner, owner))
-+			return true;
-+	}
-+	return false;
-+}
-+
-+static const struct subordinate_range *find_range(struct commonio_db *db,
-+						  const char *owner, unsigned long val)
-+{
-+	const struct subordinate_range *range;
-+	commonio_rewind(db);
-+	while ((range = commonio_next(db)) != NULL) {
-+		unsigned long first = range->start;
-+		unsigned long last = first + range->count - 1;
-+
-+		if (0 != strcmp(range->owner, owner))
-+			continue;
-+
-+		if ((val >= first) && (val <= last))
-+			return range;
-+	}
-+	return NULL;
-+}
-+
-+static bool have_range(struct commonio_db *db,
-+		       const char *owner, unsigned long start, unsigned long count)
-+{
-+	const struct subordinate_range *range;
-+	unsigned long end;
-+
-+	if (count == 0)
-+		return false;
-+
-+	end = start + count - 1;
-+	range = find_range (db, owner, start);
-+	while (range) {
-+		unsigned long last; 
-+
-+		last = range->start + range->count - 1;
-+		if (last >= (start + count - 1))
-+			return true;
-+
-+		count = end - last;
-+		start = last + 1;
-+		range = find_range(db, owner, start);
-+	}
-+	return false;
-+}
-+
-+static int subordinate_range_cmp (const void *p1, const void *p2)
-+{
-+	struct subordinate_range *range1, *range2;
-+
-+	if ((*(struct commonio_entry **) p1)->eptr == NULL)
-+		return 1;
-+	if ((*(struct commonio_entry **) p2)->eptr == NULL)
-+		return -1;
-+
-+	range1 = ((struct subordinate_range *) (*(struct commonio_entry **) p1)->eptr);
-+	range2 = ((struct subordinate_range *) (*(struct commonio_entry **) p2)->eptr);
-+
-+	if (range1->start < range2->start)
-+		return -1;
-+	else if (range1->start > range2->start)
-+		return 1;
-+	else if (range1->count < range2->count)
-+		return -1;
-+	else if (range1->count > range2->count)
-+		return 1;
-+	else
-+		return strcmp(range1->owner, range2->owner);
-+}
-+
-+static unsigned long find_free_range(struct commonio_db *db,
-+				     unsigned long min, unsigned long max,
-+				     unsigned long count)
-+{
-+	const struct subordinate_range *range;
-+	unsigned long low, high;
-+
-+	/* When given invalid parameters fail */
-+	if ((count == 0) || (max <= min))
-+		goto fail;
-+
-+	/* Sort by range than by owner */
-+	commonio_sort (db, subordinate_range_cmp);
-+	commonio_rewind(db);
-+
-+	low = min;
-+	while ((range = commonio_next(db)) != NULL) {
-+		unsigned long first = range->start;
-+		unsigned long last = first + range->count - 1;
-+
-+		/* Find the top end of the hole before this range */
-+		high = first;
-+		if (high > max)
-+			high = max;
-+
-+		/* Is the hole before this range large enough? */
-+		if ((high > low) && (((high - low) + 1) >= count))
-+			return low;
-+
-+		/* Compute the low end of the next hole */
-+		if (low < (last + 1))
-+			low = last + 1;
-+		if (low > max)
-+			goto fail;
-+	}
-+
-+	/* Is the remaining unclaimed area large enough? */
-+	if (((max - low) + 1) >= count)
-+		return low;
-+fail:
-+	return ULONG_MAX;
-+}
-+
-+static int add_range(struct commonio_db *db,
-+	const char *owner, unsigned long start, unsigned long count)
-+{
-+	struct subordinate_range range;
-+	range.owner = owner;
-+	range.start = start;
-+	range.count = count;
-+
-+	/* See if the range is already present */
-+	if (have_range(db, owner, start, count))
-+		return 1;
-+
-+	/* Oterwise append the range */
-+	return commonio_append(db, &range);
-+}
-+
-+static int remove_range(struct commonio_db *db,
-+	const char *owner, unsigned long start, unsigned long count)
-+{
-+	struct commonio_entry *ent;
-+	unsigned long end;
-+
-+	if (count == 0)
-+		return 1;
-+
-+	end = start + count - 1;
-+	for (ent = db->head; ent; ent = ent->next) {
-+		struct subordinate_range *range = ent->eptr;
-+		unsigned long first;
-+		unsigned long last;
-+
-+		/* Skip unparsed entries */
-+		if (!range)
-+			continue;
-+
-+		first = range->start;
-+		last = first + range->count - 1;
-+
-+		/* Skip entries with a different owner */
-+		if (0 != strcmp(range->owner, owner))
-+			continue;
-+
-+		/* Skip entries outside of the range to remove */
-+		if ((end < first) || (start > last))
-+			continue;
-+
-+		/* Is entry completely contained in the range to remove? */
-+		if ((start <= first) && (end >= last)) {
-+			commonio_del_entry (db, ent);
-+		} 
-+		/* Is just the start of the entry removed? */
-+		else if ((start <= first) && (end < last)) {
-+			range->start = end + 1;
-+			range->count = (last - range->start) + 1;
-+
-+			ent->changed = true;
-+		}
-+		/* Is just the end of the entry removed? */
-+		else if ((start > first) && (end >= last)) {
-+			range->count = (start - range->start) + 1;
-+
-+			ent->changed = true;
-+		}
-+		/* The middle of the range is removed */
-+		else {
-+			struct subordinate_range tail;
-+			tail.owner = range->owner;
-+			tail.start = end + 1;
-+			tail.count = (last - tail.start) + 1;
-+
-+			if (!commonio_append(db, &tail))
-+				return 0;
-+
-+			range->count = (start - range->start) + 1;
-+
-+			ent->changed = true;
-+		}
-+	}
-+
-+	return 1;
-+}
-+
-+static struct commonio_db subordinate_uid_db = {
-+	"/etc/subuid",		/* filename */
-+	&subordinate_ops,	/* ops */
-+	NULL,			/* fp */
-+#ifdef WITH_SELINUX
-+	NULL,			/* scontext */
-+#endif
-+	NULL,			/* head */
-+	NULL,			/* tail */
-+	NULL,			/* cursor */
-+	false,			/* changed */
-+	false,			/* isopen */
-+	false,			/* locked */
-+	false			/* readonly */
-+};
-+
-+int sub_uid_setdbname (const char *filename)
-+{
-+	return commonio_setname (&subordinate_uid_db, filename);
-+}
-+
-+/*@observer@*/const char *sub_uid_dbname (void)
-+{
-+	return subordinate_uid_db.filename;
-+}
-+
-+bool sub_uid_file_present (void)
-+{
-+	return commonio_present (&subordinate_uid_db);
-+}
-+
-+int sub_uid_lock (void)
-+{
-+	return commonio_lock (&subordinate_uid_db);
-+}
-+
-+int sub_uid_open (int mode)
-+{
-+	return commonio_open (&subordinate_uid_db, mode);
-+}
-+
-+bool is_sub_uid_range_free(uid_t start, unsigned long count)
-+{
-+	return is_range_free (&subordinate_uid_db, start, count);
-+}
-+
-+bool sub_uid_assigned(const char *owner)
-+{
-+	return range_exists (&subordinate_uid_db, owner);
-+}
-+
-+bool have_sub_uids(const char *owner, uid_t start, unsigned long count)
-+{
-+	return have_range (&subordinate_uid_db, owner, start, count);
-+}
-+
-+int sub_uid_add (const char *owner, uid_t start, unsigned long count)
-+{
-+	return add_range (&subordinate_uid_db, owner, start, count);
-+}
-+
-+int sub_uid_remove (const char *owner, uid_t start, unsigned long count)
-+{
-+	return remove_range (&subordinate_uid_db, owner, start, count);
-+}
-+
-+int sub_uid_close (void)
-+{
-+	return commonio_close (&subordinate_uid_db);
-+}
-+
-+int sub_uid_unlock (void)
-+{
-+	return commonio_unlock (&subordinate_uid_db);
-+}
-+
-+uid_t sub_uid_find_free_range(uid_t min, uid_t max, unsigned long count)
-+{
-+	unsigned long start;
-+	start = find_free_range (&subordinate_uid_db, min, max, count);
-+	return start == ULONG_MAX ? (uid_t) -1 : start;
-+}
-+
-+static struct commonio_db subordinate_gid_db = {
-+	"/etc/subgid",		/* filename */
-+	&subordinate_ops,	/* ops */
-+	NULL,			/* fp */
-+#ifdef WITH_SELINUX
-+	NULL,			/* scontext */
-+#endif
-+	NULL,			/* head */
-+	NULL,			/* tail */
-+	NULL,			/* cursor */
-+	false,			/* changed */
-+	false,			/* isopen */
-+	false,			/* locked */
-+	false			/* readonly */
-+};
-+
-+int sub_gid_setdbname (const char *filename)
-+{
-+	return commonio_setname (&subordinate_gid_db, filename);
-+}
-+
-+/*@observer@*/const char *sub_gid_dbname (void)
-+{
-+	return subordinate_gid_db.filename;
-+}
-+
-+bool sub_gid_file_present (void)
-+{
-+	return commonio_present (&subordinate_gid_db);
-+}
-+
-+int sub_gid_lock (void)
-+{
-+	return commonio_lock (&subordinate_gid_db);
-+}
-+
-+int sub_gid_open (int mode)
-+{
-+	return commonio_open (&subordinate_gid_db, mode);
-+}
-+
-+bool is_sub_gid_range_free(gid_t start, unsigned long count)
-+{
-+	return is_range_free (&subordinate_gid_db, start, count);
-+}
-+
-+bool have_sub_gids(const char *owner, gid_t start, unsigned long count)
-+{
-+	return have_range(&subordinate_gid_db, owner, start, count);
-+}
-+
-+bool sub_gid_assigned(const char *owner)
-+{
-+	return range_exists (&subordinate_gid_db, owner);
-+}
-+
-+int sub_gid_add (const char *owner, gid_t start, unsigned long count)
-+{
-+	return add_range (&subordinate_gid_db, owner, start, count);
-+}
-+
-+int sub_gid_remove (const char *owner, gid_t start, unsigned long count)
-+{
-+	return remove_range (&subordinate_gid_db, owner, start, count);
-+}
-+
-+int sub_gid_close (void)
-+{
-+	return commonio_close (&subordinate_gid_db);
-+}
-+
-+int sub_gid_unlock (void)
-+{
-+	return commonio_unlock (&subordinate_gid_db);
-+}
-+
-+gid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count)
-+{
-+	unsigned long start;
-+	start = find_free_range (&subordinate_gid_db, min, max, count);
-+	return start == ULONG_MAX ? (gid_t) -1 : start;
-+}
-Index: shadow/lib/subordinateio.h
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ shadow/lib/subordinateio.h	2013-02-01 15:27:51.680080379 -0600
-@@ -0,0 +1,38 @@
-+/*
-+ * Copyright (c) 2012- Eric W. Biederman
-+ */
-+
-+#ifndef _SUBORDINATEIO_H
-+#define _SUBORDINATEIO_H
-+
-+#include <sys/types.h>
-+
-+extern int sub_uid_close(void);
-+extern bool is_sub_uid_range_free(uid_t start, unsigned long count);
-+extern bool have_sub_uids(const char *owner, uid_t start, unsigned long count);
-+extern bool sub_uid_file_present (void);
-+extern bool sub_uid_assigned(const char *owner);
-+extern int sub_uid_lock (void);
-+extern int sub_uid_setdbname (const char *filename);
-+extern /*@observer@*/const char *sub_uid_dbname (void);
-+extern int sub_uid_open (int mode);
-+extern int sub_uid_unlock (void);
-+extern int sub_uid_add (const char *owner, uid_t start, unsigned long count);
-+extern int sub_uid_remove (const char *owner, uid_t start, unsigned long count);
-+extern uid_t sub_uid_find_free_range(uid_t min, uid_t max, unsigned long count);
-+
-+extern int sub_gid_close(void);
-+extern bool is_sub_gid_range_free(gid_t start, unsigned long count);
-+extern bool have_sub_gids(const char *owner, gid_t start, unsigned long count);
-+extern bool sub_gid_file_present (void);
-+extern bool sub_gid_assigned(const char *owner);
-+extern int sub_gid_lock (void);
-+extern int sub_gid_setdbname (const char *filename);
-+extern /*@observer@*/const char *sub_gid_dbname (void);
-+extern int sub_gid_open (int mode);
-+extern int sub_gid_unlock (void);
-+extern int sub_gid_add (const char *owner, gid_t start, unsigned long count);
-+extern int sub_gid_remove (const char *owner, gid_t start, unsigned long count);
-+extern uid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count);
-+
-+#endif

debian/patches/userns/05_userns_implemend_find_new_sub_xids

@@ -1,283 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:17:02 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id 480ABC80F4; Tue, 22 Jan 2013 09:17:02 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
-	autolearn=no version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id 90ACFC80D1
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:16:57 +0000 (UTC)
-Received: from out01.mta.xmission.com ([166.70.13.231])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZwp-0007cg-9X; Tue, 22 Jan 2013 02:15:15 -0700
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out01.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZwo-0006DN-OT; Tue, 22 Jan 2013 02:15:14 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZwj-0004g0-9e; Tue, 22 Jan 2013 02:15:14 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:15:05 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <87fw1tr33a.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX19KHX5xUOkaLY5iIEqDVLxZKDTByyA0Xk8=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 05/11] Implement find_new_sub_uids find_new_sub_gids
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2075                                                  
-Status: RO
-Content-Length: 8108
-Lines: 235
-
-
-Functions for finding new subordinate uid and gids ranges for use
-with useradd.
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- lib/prototypes.h            |    9 ++++
- libmisc/Makefile.am         |    2 +
- libmisc/find_new_sub_gids.c |   87 +++++++++++++++++++++++++++++++++++++++++++
- libmisc/find_new_sub_uids.c |   87 +++++++++++++++++++++++++++++++++++++++++++
- 4 files changed, 185 insertions(+), 0 deletions(-)
- create mode 100644 libmisc/find_new_sub_gids.c
- create mode 100644 libmisc/find_new_sub_uids.c
-
-Index: shadow/lib/prototypes.h
-===================================================================
---- shadow.orig/lib/prototypes.h	2013-02-01 15:27:52.044080373 -0600
-+++ shadow/lib/prototypes.h	2013-02-01 15:27:52.040080373 -0600
-@@ -149,6 +149,15 @@
-                          uid_t *uid,
-                          /*@null@*/uid_t const *preferred_uid);
- 
-+/* find_new_sub_gids.c */
-+extern int find_new_sub_gids (const char *owner,
-+			      gid_t *range_start, unsigned long *range_count);
-+
-+/* find_new_sub_uids.c */
-+extern int find_new_sub_uids (const char *owner,
-+			      uid_t *range_start, unsigned long *range_count);
-+
-+
- /* get_gid.c */
- extern int get_gid (const char *gidstr, gid_t *gid);
- 
-Index: shadow/libmisc/Makefile.am
-===================================================================
---- shadow.orig/libmisc/Makefile.am	2013-02-01 15:27:52.044080373 -0600
-+++ shadow/libmisc/Makefile.am	2013-02-01 15:27:52.040080373 -0600
-@@ -25,6 +25,8 @@
- 	failure.h \
- 	find_new_gid.c \
- 	find_new_uid.c \
-+	find_new_sub_gids.c \
-+	find_new_sub_uids.c \
- 	getdate.h \
- 	getdate.y \
- 	getgr_nam_gid.c \
-Index: shadow/libmisc/find_new_sub_gids.c
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ shadow/libmisc/find_new_sub_gids.c	2013-02-01 15:27:52.040080373 -0600
-@@ -0,0 +1,87 @@
-+/*
-+ * Copyright (c) 2012 Eric Biederman
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. The name of the copyright holders or contributors may not be used to
-+ *    endorse or promote products derived from this software without
-+ *    specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-+ * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
-+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include <config.h>
-+
-+#include <assert.h>
-+#include <stdio.h>
-+#include <errno.h>
-+
-+#include "prototypes.h"
-+#include "subordinateio.h"
-+#include "getdef.h"
-+
-+/*
-+ * find_new_sub_gids - Find a new unused range of GIDs.
-+ *
-+ * If successful, find_new_sub_gids provides a range of unused
-+ * user IDs in the [SUB_GID_MIN:SUB_GID_MAX] range.
-+ * 
-+ * Return 0 on success, -1 if no unused GIDs are available.
-+ */
-+int find_new_sub_gids (const char *owner,
-+		       gid_t *range_start, unsigned long *range_count)
-+{
-+	unsigned long min, max;
-+	unsigned long count;
-+	gid_t start;
-+
-+	assert (range_start != NULL);
-+	assert (range_count != NULL);
-+
-+	min = getdef_ulong ("SUB_GID_MIN", 100000UL);
-+	max = getdef_ulong ("SUB_GID_MAX", 600100000UL);
-+	count = getdef_ulong ("SUB_GID_COUNT", 10000);
-+
-+	/* Is there a preferred range that works? */
-+	if ((*range_count != 0) &&
-+	    (*range_start >= min) &&
-+	    (((*range_start) + (*range_count) - 1) <= max) &&
-+	    is_sub_gid_range_free(*range_start, *range_count)) {
-+		return 0;
-+	}
-+
-+	if (max < (min + count)) {
-+		(void) fprintf (stderr,
-+				_("%s: Invalid configuration: SUB_GID_MIN (%lu), SUB_GID_MAX (%lu)\n"),
-+			Prog, min, max);
-+		return -1;
-+	}
-+	start = sub_gid_find_free_range(min, max, count);
-+	if (start == (gid_t)-1) {
-+		fprintf (stderr,
-+		         _("%s: Can't get unique secondary GID range\n"),
-+		         Prog);
-+		SYSLOG ((LOG_WARN, "no more available secondary GIDs on the system"));
-+		return -1;
-+	}
-+	*range_start = start;
-+	*range_count = count;
-+	return 0;
-+}
-+
-Index: shadow/libmisc/find_new_sub_uids.c
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ shadow/libmisc/find_new_sub_uids.c	2013-02-01 15:27:52.040080373 -0600
-@@ -0,0 +1,87 @@
-+/*
-+ * Copyright (c) 2012 Eric Biederman
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. The name of the copyright holders or contributors may not be used to
-+ *    endorse or promote products derived from this software without
-+ *    specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-+ * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
-+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include <config.h>
-+
-+#include <assert.h>
-+#include <stdio.h>
-+#include <errno.h>
-+
-+#include "prototypes.h"
-+#include "subordinateio.h"
-+#include "getdef.h"
-+
-+/*
-+ * find_new_sub_uids - Find a new unused range of UIDs.
-+ *
-+ * If successful, find_new_sub_uids provides a range of unused
-+ * user IDs in the [SUB_UID_MIN:SUB_UID_MAX] range.
-+ * 
-+ * Return 0 on success, -1 if no unused UIDs are available.
-+ */
-+int find_new_sub_uids (const char *owner,
-+		       uid_t *range_start, unsigned long *range_count)
-+{
-+	unsigned long min, max;
-+	unsigned long count;
-+	uid_t start;
-+
-+	assert (range_start != NULL);
-+	assert (range_count != NULL);
-+
-+	min = getdef_ulong ("SUB_UID_MIN", 100000UL);
-+	max = getdef_ulong ("SUB_UID_MAX", 600100000UL);
-+	count = getdef_ulong ("SUB_UID_COUNT", 10000);
-+
-+	/* Is there a preferred range that works? */
-+	if ((*range_count != 0) &&
-+	    (*range_start >= min) &&
-+	    (((*range_start) + (*range_count) - 1) <= max) &&
-+	    is_sub_uid_range_free(*range_start, *range_count)) {
-+		return 0;
-+	}
-+
-+	if (max < (min + count)) {
-+		(void) fprintf (stderr,
-+				_("%s: Invalid configuration: SUB_UID_MIN (%lu), SUB_UID_MAX (%lu)\n"),
-+			Prog, min, max);
-+		return -1;
-+	}
-+	start = sub_uid_find_free_range(min, max, count);
-+	if (start == (uid_t)-1) {
-+		fprintf (stderr,
-+		         _("%s: Can't get unique secondary UID range\n"),
-+		         Prog);
-+		SYSLOG ((LOG_WARN, "no more available secondary UIDs on the system"));
-+		return -1;
-+	}
-+	*range_start = start;
-+	*range_count = count;
-+	return 0;
-+}
-+

debian/patches/userns/06_userns_userdel

@@ -1,236 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:18:47 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id F2E6AC80F6; Tue, 22 Jan 2013 09:18:46 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
-	autolearn=no version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id 996B1C80D1
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:18:42 +0000 (UTC)
-Received: from out03.mta.xmission.com ([166.70.13.233])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZyW-0008Bi-3X; Tue, 22 Jan 2013 02:17:00 -0700
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZyU-0005NA-Qm; Tue, 22 Jan 2013 02:16:59 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZyQ-0004qs-T1; Tue, 22 Jan 2013 02:16:58 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:16:51 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <878v7lr30c.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX1/1l7dElNy9uNLAXx8eC28OMs/pxPM8NEo=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 06/11] userdel: Add support for removing subordinate user and group ids.
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2076                                        
-Status: O
-Content-Length: 5573
-Lines: 186
-
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- src/userdel.c |  115 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 files changed, 115 insertions(+), 0 deletions(-)
-
-Index: shadow/src/userdel.c
-===================================================================
---- shadow.orig/src/userdel.c	2013-02-01 15:27:52.380080367 -0600
-+++ shadow/src/userdel.c	2013-02-01 15:27:52.372080367 -0600
-@@ -65,6 +65,7 @@
- #endif				/* WITH_TCB */
- /*@-exitarg@*/
- #include "exitcodes.h"
-+#include "subordinateio.h"
- 
- /*
-  * exit status values
-@@ -75,6 +76,8 @@
- #define E_GRP_UPDATE	10	/* can't update group file */
- #define E_HOMEDIR	12	/* can't remove home directory */
- #define E_SE_UPDATE	14	/* can't update SELinux user mapping */
-+#define E_SUB_UID_UPDATE 16	/* can't update the subordinate uid file */
-+#define E_SUB_GID_UPDATE 18	/* can't update the subordinate gid file */
- 
- /*
-  * Global variables
-@@ -96,9 +99,13 @@
- static bool is_shadow_grp;
- static bool sgr_locked = false;
- #endif				/* SHADOWGRP */
-+static bool is_sub_uid;
-+static bool is_sub_gid;
- static bool pw_locked  = false;
- static bool gr_locked   = false;
- static bool spw_locked  = false;
-+static bool sub_uid_locked = false;
-+static bool sub_gid_locked = false;
- 
- /* local function prototypes */
- static void usage (int status);
-@@ -437,6 +444,34 @@
- 		sgr_locked = false;
- 	}
- #endif				/* SHADOWGRP */
-+
-+	if (is_sub_uid) {
-+		if (sub_uid_close () == 0) {
-+			fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_uid_dbname ()));
-+			fail_exit (E_SUB_UID_UPDATE);
-+		}
-+		if (sub_uid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
-+			/* continue */
-+		}
-+		sub_uid_locked = false;
-+	}
-+
-+	if (is_sub_gid) {
-+		if (sub_gid_close () == 0) {
-+			fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_gid_dbname ()));
-+			fail_exit (E_SUB_GID_UPDATE);
-+		}
-+		if (sub_gid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
-+			/* continue */
-+		}
-+		sub_gid_locked = false;
-+	}
- }
- 
- /*
-@@ -474,6 +509,20 @@
- 		}
- 	}
- #endif				/* SHADOWGRP */
-+	if (sub_uid_locked) {
-+		if (sub_uid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
-+			/* continue */
-+		}
-+	}
-+	if (sub_gid_locked) {
-+		if (sub_gid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
-+			/* continue */
-+		}
-+	}
- 
- #ifdef WITH_AUDIT
- 	audit_logger (AUDIT_DEL_USER, Prog,
-@@ -595,6 +644,58 @@
- 		}
- 	}
- #endif				/* SHADOWGRP */
-+	if (is_sub_uid) {
-+		if (sub_uid_lock () == 0) {
-+			fprintf (stderr,
-+				_("%s: cannot lock %s; try again later.\n"),
-+				Prog, sub_uid_dbname ());
-+#ifdef WITH_AUDIT
-+			audit_logger (AUDIT_DEL_USER, Prog,
-+				"locking subordinate user file",
-+				user_name, (unsigned int) user_id,
-+				SHADOW_AUDIT_FAILURE);
-+#endif				/* WITH_AUDIT */
-+			fail_exit (E_SUB_UID_UPDATE);
-+		}
-+		sub_uid_locked = true;
-+		if (sub_uid_open (O_RDWR) == 0) {
-+			fprintf (stderr,
-+				_("%s: cannot open %s\n"), Prog, sub_uid_dbname ());
-+#ifdef WITH_AUDIT
-+			audit_logger (AUDIT_DEL_USER, Prog,
-+				"opening subordinate user file",
-+				user_name, (unsigned int) user_id,
-+				SHADOW_AUDIT_FAILURE);
-+#endif				/* WITH_AUDIT */
-+			fail_exit (E_SUB_UID_UPDATE);
-+		}
-+	}
-+	if (is_sub_gid) {
-+		if (sub_gid_lock () == 0) {
-+			fprintf (stderr,
-+				_("%s: cannot lock %s; try again later.\n"),
-+				Prog, sub_gid_dbname ());
-+#ifdef WITH_AUDIT
-+			audit_logger (AUDIT_DEL_USER, Prog,
-+				"locking subordinate group file",
-+				user_name, (unsigned int) user_id,
-+				SHADOW_AUDIT_FAILURE);
-+#endif				/* WITH_AUDIT */
-+			fail_exit (E_SUB_GID_UPDATE);
-+		}
-+		sub_gid_locked = true;
-+		if (sub_gid_open (O_RDWR) == 0) {
-+			fprintf (stderr,
-+				_("%s: cannot open %s\n"), Prog, sub_gid_dbname ());
-+#ifdef WITH_AUDIT
-+			audit_logger (AUDIT_DEL_USER, Prog,
-+				"opening subordinate group file",
-+				user_name, (unsigned int) user_id,
-+				SHADOW_AUDIT_FAILURE);
-+#endif				/* WITH_AUDIT */
-+			fail_exit (E_SUB_GID_UPDATE);
-+		}
-+	}
- }
- 
- /*
-@@ -619,6 +720,18 @@
- 		         Prog, user_name, spw_dbname ());
- 		fail_exit (E_PW_UPDATE);
- 	}
-+	if (is_sub_uid && sub_uid_remove(user_name, 0, ULONG_MAX) == 0) {
-+		fprintf (stderr,
-+			_("%s: cannot remove entry %lu from %s\n"),
-+			Prog, (unsigned long)user_id, sub_uid_dbname ());
-+		fail_exit (E_SUB_UID_UPDATE);
-+	}
-+	if (is_sub_gid && sub_gid_remove(user_name, 0, ULONG_MAX) == 0) {
-+		fprintf (stderr,
-+			_("%s: cannot remove entry %lu from %s\n"),
-+			Prog, (unsigned long)user_id, sub_gid_dbname ());
-+		fail_exit (E_SUB_GID_UPDATE);
-+	}
- #ifdef WITH_AUDIT
- 	audit_logger (AUDIT_DEL_USER, Prog,
- 	              "deleting user entries",
-@@ -966,6 +1079,8 @@
- #ifdef SHADOWGRP
- 	is_shadow_grp = sgr_file_present ();
- #endif				/* SHADOWGRP */
-+	is_sub_uid = sub_uid_file_present ();
-+	is_sub_gid = sub_gid_file_present ();
- 
- 	/*
- 	 * Start with a quick check to see if the user exists.

debian/patches/userns/07_userns_useradd

@@ -1,285 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:19:29 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id 61652C80DB; Tue, 22 Jan 2013 09:19:29 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
-	autolearn=no version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id E0ABBC80F4
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:19:23 +0000 (UTC)
-Received: from out03.mta.xmission.com ([166.70.13.233])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZzB-0008QG-Kq; Tue, 22 Jan 2013 02:17:41 -0700
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZz7-0005Ui-1H; Tue, 22 Jan 2013 02:17:37 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZz4-0004tF-BP; Tue, 22 Jan 2013 02:17:36 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:17:30 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <8738xtr2z9.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX1/Jm5H2PcjgcLXEyKh9YL3DVs2WZBJhDB8=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 07/11] useradd: Add support for subordinate user identifiers
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2077                                                  
-Status: RO
-Content-Length: 6886
-Lines: 235
-
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- src/useradd.c |  141 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
- 1 files changed, 140 insertions(+), 1 deletions(-)
-
-Index: shadow/src/useradd.c
-===================================================================
---- shadow.orig/src/useradd.c	2013-02-01 15:27:52.668080362 -0600
-+++ shadow/src/useradd.c	2013-02-01 15:27:52.660080362 -0600
-@@ -65,6 +65,7 @@
- #include "sgroupio.h"
- #endif
- #include "shadowio.h"
-+#include "subordinateio.h"
- #ifdef WITH_TCB
- #include "tcbfuncs.h"
- #endif
-@@ -121,12 +122,20 @@
- static bool is_shadow_grp;
- static bool sgr_locked = false;
- #endif
-+static bool is_sub_uid = false;
-+static bool is_sub_gid = false;
- static bool pw_locked = false;
- static bool gr_locked = false;
- static bool spw_locked = false;
-+static bool sub_uid_locked = false;
-+static bool sub_gid_locked = false;
- static char **user_groups;	/* NULL-terminated list */
- static long sys_ngroups;
- static bool do_grp_update = false;	/* group files need to be updated */
-+static uid_t sub_uid_start;	/* New subordinate uid range */
-+static unsigned long sub_uid_count;
-+static gid_t sub_gid_start;	/* New subordinate gid range */
-+static unsigned long sub_gid_count;
- 
- static bool
-     bflg = false,		/* new default root of home directory */
-@@ -168,6 +177,8 @@
- #define E_GRP_UPDATE	10	/* can't update group file */
- #define E_HOMEDIR	12	/* can't create home directory */
- #define E_SE_UPDATE	14	/* can't update SELinux user mapping */
-+#define E_SUB_UID_UPDATE 16	/* can't update the subordinate uid file */
-+#define E_SUB_GID_UPDATE 18	/* can't update the subordinate gid file */
- 
- #define DGROUP			"GROUP="
- #define DHOME			"HOME="
-@@ -268,6 +279,32 @@
- 		}
- 	}
- #endif
-+	if (sub_uid_locked) {
-+		if (sub_uid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
-+#ifdef WITH_AUDIT
-+			audit_logger (AUDIT_ADD_USER, Prog,
-+			              "unlocking subodinate user file",
-+			              user_name, AUDIT_NO_ID,
-+			              SHADOW_AUDIT_FAILURE);
-+#endif
-+			/* continue */
-+		}
-+	}
-+	if (sub_gid_locked) {
-+		if (sub_gid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
-+#ifdef WITH_AUDIT
-+			audit_logger (AUDIT_ADD_USER, Prog,
-+			              "unlocking subodinate group file",
-+			              user_name, AUDIT_NO_ID,
-+			              SHADOW_AUDIT_FAILURE);
-+#endif
-+			/* continue */
-+		}
-+	}
- 
- #ifdef WITH_AUDIT
- 	audit_logger (AUDIT_ADD_USER, Prog,
-@@ -1379,6 +1416,18 @@
- 		}
- #endif
- 	}
-+	if (is_sub_uid  && (sub_uid_close () == 0)) {
-+		fprintf (stderr,
-+		         _("%s: failure while writing changes to %s\n"), Prog, sub_uid_dbname ());
-+		SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_uid_dbname ()));
-+		fail_exit (E_SUB_UID_UPDATE);
-+	}
-+	if (is_sub_gid  && (sub_gid_close () == 0)) {
-+		fprintf (stderr,
-+		         _("%s: failure while writing changes to %s\n"), Prog, sub_gid_dbname ());
-+		SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_gid_dbname ()));
-+		fail_exit (E_SUB_GID_UPDATE);
-+	}
- 	if (is_shadow_pwd) {
- 		if (spw_unlock () == 0) {
- 			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, spw_dbname ());
-@@ -1433,6 +1482,34 @@
- 		sgr_locked = false;
- 	}
- #endif
-+	if (is_sub_uid) {
-+		if (sub_uid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
-+#ifdef WITH_AUDIT
-+			audit_logger (AUDIT_ADD_USER, Prog,
-+				"unlocking subordinate user file",
-+				user_name, AUDIT_NO_ID,
-+				SHADOW_AUDIT_FAILURE);
-+#endif
-+			/* continue */
-+		}
-+		sub_uid_locked = false;
-+	}
-+	if (is_sub_gid) {
-+		if (sub_gid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
-+#ifdef WITH_AUDIT
-+			audit_logger (AUDIT_ADD_USER, Prog,
-+				"unlocking subordinate group file",
-+				user_name, AUDIT_NO_ID,
-+				SHADOW_AUDIT_FAILURE);
-+#endif
-+			/* continue */
-+		}
-+		sub_gid_locked = false;
-+	}
- }
- 
- /*
-@@ -1487,6 +1564,36 @@
- 		}
- 	}
- #endif
-+	if (is_sub_uid) {
-+		if (sub_uid_lock () == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot lock %s; try again later.\n"),
-+			         Prog, sub_uid_dbname ());
-+			fail_exit (E_SUB_UID_UPDATE);
-+		}
-+		sub_uid_locked = true;
-+		if (sub_uid_open (O_RDWR) == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot open %s\n"),
-+			         Prog, sub_uid_dbname ());
-+			fail_exit (E_SUB_UID_UPDATE);
-+		}
-+	}
-+	if (is_sub_gid) {
-+		if (sub_gid_lock () == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot lock %s; try again later.\n"),
-+			         Prog, sub_gid_dbname ());
-+			fail_exit (E_SUB_GID_UPDATE);
-+		}
-+		sub_gid_locked = true;
-+		if (sub_gid_open (O_RDWR) == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot open %s\n"),
-+			         Prog, sub_gid_dbname ());
-+			fail_exit (E_SUB_GID_UPDATE);
-+		}
-+	}
- }
- 
- static void open_shadow (void)
-@@ -1733,13 +1840,27 @@
- #endif
- 		fail_exit (E_PW_UPDATE);
- 	}
-+	if (is_sub_uid &&
-+	    (sub_uid_add(user_name, sub_uid_start, sub_uid_count) == 0)) {
-+		fprintf (stderr,
-+		         _("%s: failed to prepare the new %s entry\n"),
-+		         Prog, sub_uid_dbname ());
-+		fail_exit (E_SUB_UID_UPDATE);
-+	}
-+	if (is_sub_gid &&
-+	    (sub_gid_add(user_name, sub_gid_start, sub_gid_count) == 0)) {
-+		fprintf (stderr,
-+		         _("%s: failed to prepare the new %s entry\n"),
-+		         Prog, sub_uid_dbname ());
-+		fail_exit (E_SUB_GID_UPDATE);
-+	}
-+
- #ifdef WITH_AUDIT
- 	audit_logger (AUDIT_ADD_USER, Prog,
- 	              "adding user",
- 	              user_name, (unsigned int) user_id,
- 	              SHADOW_AUDIT_SUCCESS);
- #endif
--
- 	/*
- 	 * Do any group file updates for this user.
- 	 */
-@@ -1885,6 +2006,8 @@
- #ifdef SHADOWGRP
- 	is_shadow_grp = sgr_file_present ();
- #endif
-+	is_sub_uid = sub_uid_file_present ();
-+	is_sub_gid = sub_gid_file_present ();
- 
- 	get_defaults ();
- 
-@@ -2035,6 +2158,22 @@
- 		grp_add ();
- 	}
- 
-+	if (is_sub_uid) {
-+		if (find_new_sub_uids(user_name, &sub_uid_start, &sub_uid_count) < 0) {
-+			fprintf (stderr,
-+				_("%s: can't find subordinate user range\n"),
-+				Prog);
-+			fail_exit(E_SUB_UID_UPDATE);
-+		}
-+	}
-+	if (is_sub_gid) {
-+		if (find_new_sub_gids(user_name, &sub_gid_start, &sub_gid_count) < 0) {
-+			fprintf (stderr,
-+				_("%s: can't find subordinate group range\n"),
-+				Prog);
-+			fail_exit(E_SUB_GID_UPDATE);
-+		}
-+	}
- 	usr_update ();
- 
- 	if (mflg) {

debian/patches/userns/08_userns_detect_busy_subids

@@ -1,133 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:19:49 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id E0EA3C80F4; Tue, 22 Jan 2013 09:19:49 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=-2.2 required=8.0 tests=BAD_ENC_HEADER,BAYES_00,
-	RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id 1A2C7C80D1
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:19:46 +0000 (UTC)
-Received: from out03.mta.xmission.com ([166.70.13.233])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZzX-00006D-G7; Tue, 22 Jan 2013 02:18:03 -0700
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZzV-0005Zh-Qq; Tue, 22 Jan 2013 02:18:02 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZzN-0004ul-H6; Tue, 22 Jan 2013 02:18:01 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:17:50 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <87y5flpoe9.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX1/ZWJZMWIVV2ekPIrRQjHLl4Oh/kdyWJUw=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 08/11] Add support for detecting busy subordinate user ids
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2078                                        
-Status: RO
-Content-Length: 2655
-Lines: 83
-
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- libmisc/user_busy.c |   18 +++++++++++++-----
- 1 files changed, 13 insertions(+), 5 deletions(-)
-
-Index: shadow/libmisc/user_busy.c
-===================================================================
---- shadow.orig/libmisc/user_busy.c	2013-02-01 15:27:52.952080357 -0600
-+++ shadow/libmisc/user_busy.c	2013-02-01 15:27:52.948080357 -0600
-@@ -38,11 +38,13 @@
- #include <stdio.h>
- #include <sys/types.h>
- #include <dirent.h>
-+#include <fcntl.h>
- #include "defines.h"
- #include "prototypes.h"
-+#include "subordinateio.h"
- 
- #ifdef __linux__
--static int check_status (const char *sname, uid_t uid);
-+static int check_status (const char *name, const char *sname, uid_t uid);
- static int user_busy_processes (const char *name, uid_t uid);
- #else				/* !__linux__ */
- static int user_busy_utmp (const char *name);
-@@ -102,7 +104,7 @@
- #endif				/* !__linux__ */
- 
- #ifdef __linux__
--static int check_status (const char *sname, uid_t uid)
-+static int check_status (const char *name, const char *sname, uid_t uid)
- {
- 	/* 40: /proc/xxxxxxxxxx/task/xxxxxxxxxx/status + \0 */
- 	char status[40];
-@@ -125,7 +127,10 @@
- 			            &ruid, &euid, &suid) == 3) {
- 				if (   (ruid == (unsigned long) uid)
- 				    || (euid == (unsigned long) uid)
--				    || (suid == (unsigned long) uid)) {
-+				    || (suid == (unsigned long) uid)
-+				    || have_sub_uids(name, ruid, 1)
-+				    || have_sub_uids(name, euid, 1)
-+				    || have_sub_uids(name, suid, 1)) {
- 					(void) fclose (sfile);
- 					return 1;
- 				}
-@@ -153,6 +158,8 @@
- 	struct stat sbroot;
- 	struct stat sbroot_process;
- 
-+	sub_uid_open (O_RDONLY);
-+
- 	proc = opendir ("/proc");
- 	if (proc == NULL) {
- 		perror ("opendir /proc");
-@@ -196,7 +203,7 @@
- 			continue;
- 		}
- 
--		if (check_status (tmp_d_name, uid) != 0) {
-+		if (check_status (name, tmp_d_name, uid) != 0) {
- 			(void) closedir (proc);
- 			fprintf (stderr,
- 			         _("%s: user %s is currently used by process %d\n"),
-@@ -216,7 +223,7 @@
- 				if (tid == pid) {
- 					continue;
- 				}
--				if (check_status (task_path+6, uid) != 0) {
-+				if (check_status (name, task_path+6, uid) != 0) {
- 					(void) closedir (proc);
- 					fprintf (stderr,
- 					         _("%s: user %s is currently used by process %d\n"),
-@@ -231,6 +238,7 @@
- 	}
- 
- 	(void) closedir (proc);
-+	sub_uid_close();
- 	return 0;
- }
- #endif				/* __linux__ */

debian/patches/userns/09_userns_usermod

@@ -1,536 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:20:27 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id 8625BC80F4; Tue, 22 Jan 2013 09:20:27 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
-	autolearn=no version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id 69CACC80D1
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:20:23 +0000 (UTC)
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1Txa08-0000JL-Uo; Tue, 22 Jan 2013 02:18:41 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1TxZzw-0004wm-8g; Tue, 22 Jan 2013 02:18:40 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:18:24 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <87sj5tpodb.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX1/EkNiL4owL54HOscHbdbK8RucFTofOBo8=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 09/11] usermod: Add support for subordinate uids and gids.
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2079                                        
-Status: O
-Content-Length: 15455
-Lines: 491
-
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- man/usermod.8.xml |   80 +++++++++++++++++
- src/usermod.c     |  255 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
- 2 files changed, 332 insertions(+), 3 deletions(-)
-
-Index: shadow/man/usermod.8.xml
-===================================================================
---- shadow.orig/man/usermod.8.xml	2013-02-01 15:27:53.240080352 -0600
-+++ shadow/man/usermod.8.xml	2013-02-01 15:27:53.232080353 -0600
-@@ -391,6 +391,86 @@
-       </varlistentry>
-       <varlistentry>
- 	<term>
-+	  <option>-v</option>, <option>--add-sub-uids</option>
-+	  <replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>
-+	</term>
-+	<listitem>
-+	  <para>
-+	    Add a range of subordinate uids to the users account. 
-+	  </para>
-+	  <para>
-+	    This option may be specified multiple times to add multiple ranges to a users account.
-+	  </para>
-+	  <para>
-+	     No checks will be performed with regard to
-+	     <option>SUB_UID_MIN</option>, <option>SUB_UID_MAX</option>, or
-+	     <option>SUB_UID_COUNT</option> from /etc/login.defs.
-+	  </para>
-+	</listitem>
-+      </varlistentry>
-+      <varlistentry>
-+	<term>
-+	  <option>-V</option>, <option>--del-sub-uids</option>
-+	  <replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>
-+	</term>
-+	<listitem>
-+	  <para>
-+	    Remove a range of subordinate uids from the users account.
-+	  </para>
-+	  <para>
-+	    This option may be specified multiple times to remove multiple ranges to a users account.
-+	    When both <option>--del-sub-uids</option> and <option>--add-sub-uids</option> are specified
-+	    remove of all subordinate uid ranges happens before any subordinate uid ranges are added.
-+	  </para>
-+	  <para>
-+	     No checks will be performed with regard to
-+	     <option>SUB_UID_MIN</option>, <option>SUB_UID_MAX</option>, or
-+	     <option>SUB_UID_COUNT</option> from /etc/login.defs.
-+	  </para>
-+	</listitem>
-+      </varlistentry>
-+      <varlistentry>
-+	<term>
-+	  <option>-w</option>, <option>--add-sub-gids</option>
-+	  <replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>
-+	</term>
-+	<listitem>
-+	  <para>
-+	    Add a range of subordinate gids to the users account.
-+	  </para>
-+	  <para>
-+	    This option may be specified multiple times to add multiple ranges to a users account.
-+	  </para>
-+	  <para>
-+	     No checks will be performed with regard to
-+	     <option>SUB_GID_MIN</option>, <option>SUB_GID_MAX</option>, or
-+	     <option>SUB_GID_COUNT</option> from /etc/login.defs.
-+	  </para>
-+	</listitem>
-+      </varlistentry>
-+      <varlistentry>
-+	<term>
-+	  <option>-W</option>, <option>--del-sub-gids</option>
-+	  <replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>
-+	</term>
-+	<listitem>
-+	  <para>
-+	    Remove a range of subordinate gids from the users account.
-+	  </para>
-+	  <para>
-+	    This option may be specified multiple times to remove multiple ranges to a users account.
-+	    When both <option>--del-sub-gids</option> and <option>--add-sub-gids</option> are specified
-+	    remove of all subordinate gid ranges happens before any subordinate gid ranges are added.
-+	  </para>
-+	  <para>
-+	     No checks will be performed with regard to
-+	     <option>SUB_GID_MIN</option>, <option>SUB_GID_MAX</option>, or
-+	     <option>SUB_GID_COUNT</option> from /etc/login.defs.
-+	  </para>
-+	</listitem>
-+      </varlistentry>
-+      <varlistentry>
-+	<term>
- 	  <option>-Z</option>, <option>--selinux-user</option>
- 	  <replaceable>SEUSER</replaceable>
- 	</term>
-Index: shadow/src/usermod.c
-===================================================================
---- shadow.orig/src/usermod.c	2013-02-01 15:27:53.240080352 -0600
-+++ shadow/src/usermod.c	2013-02-01 15:27:53.236080353 -0600
-@@ -63,6 +63,7 @@
- #include "sgroupio.h"
- #endif
- #include "shadowio.h"
-+#include "subordinateio.h"
- #ifdef WITH_TCB
- #include "tcbfuncs.h"
- #endif
-@@ -86,6 +87,8 @@
- /* #define E_NOSPACE	11	   insufficient space to move home dir */
- #define E_HOMEDIR	12	/* unable to complete home dir move */
- #define E_SE_UPDATE	13	/* can't update SELinux user mapping */
-+#define E_SUB_UID_UPDATE 16	/* can't update the subordinate uid file */
-+#define E_SUB_GID_UPDATE 18	/* can't update the subordinate gid file */
- #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
- /*
-  * Global variables
-@@ -133,7 +136,11 @@
-     Zflg = false,		/* new selinux user */
- #endif
-     uflg = false,		/* specify new user ID */
--    Uflg = false;		/* unlock the password */
-+    Uflg = false,		/* unlock the password */
-+    vflg = false,		/*    add subordinate uids */
-+    Vflg = false,		/* delete subordinate uids */
-+    wflg = false,		/*    add subordinate gids */
-+    Wflg = false;		/* delete subordinate gids */
- 
- static bool is_shadow_pwd;
- 
-@@ -141,12 +148,17 @@
- static bool is_shadow_grp;
- #endif
- 
-+static bool is_sub_uid = false;
-+static bool is_sub_gid = false;
-+
- static bool pw_locked  = false;
- static bool spw_locked = false;
- static bool gr_locked  = false;
- #ifdef SHADOWGRP
- static bool sgr_locked = false;
- #endif
-+static bool sub_uid_locked = false;
-+static bool sub_gid_locked = false;
- 
- 
- /* local function prototypes */
-@@ -302,6 +314,69 @@
- 	return 0;
- }
- 
-+struct ulong_range
-+{
-+	unsigned long first;
-+	unsigned long last;
-+};
-+
-+static struct ulong_range getulong_range(const char *str)
-+{
-+	struct ulong_range result = { .first = ULONG_MAX, .last = 0 };
-+	unsigned long long first, last;
-+	char *pos;
-+
-+	errno = 0;
-+	first = strtoll(str, &pos, 10);
-+	if (('\0' == *str) || ('-' != *pos ) || (ERANGE == errno) ||
-+	    (first != (unsigned long int)first))
-+		goto out;
-+
-+	errno = 0;
-+	last = strtoul(pos + 1, &pos, 10);
-+	if (('\0' != *pos ) || (ERANGE == errno) ||
-+	    (last != (unsigned long int)last))
-+		goto out;
-+
-+	if (first > last)
-+		goto out;
-+
-+	result.first = (unsigned long int)first;
-+	result.last = (unsigned long int)last;
-+out:
-+	return result;
-+	
-+}
-+
-+struct ulong_range_list_entry {
-+	struct ulong_range_list_entry *next;
-+	struct ulong_range range;
-+};
-+
-+static struct ulong_range_list_entry *add_sub_uids = NULL, *del_sub_uids = NULL;
-+static struct ulong_range_list_entry *add_sub_gids = NULL, *del_sub_gids = NULL;
-+
-+static int prepend_range(const char *str, struct ulong_range_list_entry **head)
-+{
-+	struct ulong_range range;
-+	struct ulong_range_list_entry *entry;
-+	range = getulong_range(str);
-+	if (range.first > range.last)
-+		return 0;
-+
-+	entry = malloc(sizeof(*entry));
-+	if (!entry) {
-+		fprintf (stderr,
-+			_("%s: failed to allocate memory: %s\n"),
-+			Prog, strerror (errno));
-+		return 0;
-+	}
-+	entry->next = *head;
-+	entry->range = range;
-+	*head = entry;
-+	return 1;
-+}
-+
- /*
-  * usage - display usage message and exit
-  */
-@@ -334,6 +409,10 @@
- 	(void) fputs (_("  -s, --shell SHELL             new login shell for the user account\n"), usageout);
- 	(void) fputs (_("  -u, --uid UID                 new UID for the user account\n"), usageout);
- 	(void) fputs (_("  -U, --unlock                  unlock the user account\n"), usageout);
-+	(void) fputs (_("  -v, --add-subuids FIRST-LAST  add range of subordinate uids\n"), usageout);
-+	(void) fputs (_("  -V, --del-subuids FIRST-LAST  remvoe range of subordinate uids\n"), usageout);
-+	(void) fputs (_("  -w, --add-subgids FIRST-LAST  add range of subordinate gids\n"), usageout);
-+	(void) fputs (_("  -W, --del-subgids FIRST-LAST  remvoe range of subordinate gids\n"), usageout);
- #ifdef WITH_SELINUX
- 	(void) fputs (_("  -Z, --selinux-user SEUSER     new SELinux user mapping for the user account\n"), usageout);
- #endif				/* WITH_SELINUX */
-@@ -590,6 +669,20 @@
- 			/* continue */
- 		}
- 	}
-+	if (sub_uid_locked) {
-+		if (sub_uid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
-+			/* continue */
-+		}
-+	}
-+	if (sub_gid_locked) {
-+		if (sub_gid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
-+			/* continue */
-+		}
-+	}
- 
- #ifdef WITH_AUDIT
- 	audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
-@@ -889,6 +982,10 @@
- 			{"shell",        required_argument, NULL, 's'},
- 			{"uid",          required_argument, NULL, 'u'},
- 			{"unlock",       no_argument,       NULL, 'U'},
-+			{"add-subuids",  required_argument, NULL, 'v'},
-+			{"del-subuids",  required_argument, NULL, 'V'},
-+ 			{"add-subgids",  required_argument, NULL, 'w'},
-+ 			{"del-subgids",  required_argument, NULL, 'W'},
- #ifdef WITH_SELINUX
- 			{"selinux-user", required_argument, NULL, 'Z'},
- #endif				/* WITH_SELINUX */
-@@ -1018,6 +1115,41 @@
- 			case 'U':
- 				Uflg = true;
- 				break;
-+			case 'v':
-+				if (prepend_range (optarg, &add_sub_uids) == 0) {
-+					fprintf (stderr,
-+						_("%s: invalid subordinate uid range '%s'\n"),
-+						Prog, optarg);
-+					exit(E_BAD_ARG);
-+				}
-+				vflg = true;
-+				break;
-+			case 'V':
-+				if (prepend_range (optarg, &del_sub_uids) == 0) {
-+					fprintf (stderr,
-+						_("%s: invalid subordinate uid range '%s'\n"),
-+						Prog, optarg);
-+					exit(E_BAD_ARG);
-+				}
-+				Vflg = true;
-+				break;
-+			case 'w':
-+				if (prepend_range (optarg, &add_sub_gids) == 0) {
-+					fprintf (stderr,
-+						_("%s: invalid subordinate gid range '%s'\n"),
-+						Prog, optarg);
-+					exit(E_BAD_ARG);
-+				}
-+				wflg = true;
-+			case 'W':
-+				if (prepend_range (optarg, &del_sub_gids) == 0) {
-+					fprintf (stderr,
-+						_("%s: invalid subordinate gid range '%s'\n"),
-+						Prog, optarg);
-+					exit(E_BAD_ARG);
-+				}
-+				Wflg = true;
-+				break;
- #ifdef WITH_SELINUX
- 			case 'Z':
- 				if (is_selinux_enabled () > 0) {
-@@ -1170,6 +1302,7 @@
- 
- 	if (!(Uflg || uflg || sflg || pflg || mflg || Lflg ||
- 	      lflg || Gflg || gflg || fflg || eflg || dflg || cflg
-+	      || vflg || Vflg || wflg || Wflg
- #ifdef WITH_SELINUX
- 	      || Zflg
- #endif				/* WITH_SELINUX */
-@@ -1200,6 +1333,7 @@
- 		         Prog, (unsigned long) user_newid);
- 		exit (E_UID_IN_USE);
- 	}
-+
- }
- 
- /*
-@@ -1248,6 +1382,10 @@
- 				         sgr_dbname ()));
- 				fail_exit (E_GRP_UPDATE);
- 			}
-+		}
-+#endif
-+#ifdef SHADOWGRP
-+		if (is_shadow_grp) {
- 			if (sgr_unlock () == 0) {
- 				fprintf (stderr,
- 				         _("%s: failed to unlock %s\n"),
-@@ -1296,6 +1434,33 @@
- 	sgr_locked = false;
- #endif
- 
-+	if (vflg || Vflg) {
-+		if (!is_sub_uid || (sub_uid_close () == 0)) {
-+			fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_uid_dbname ()));
-+			fail_exit (E_SUB_UID_UPDATE);
-+		}
-+		if (!is_sub_uid || (sub_uid_unlock () == 0)) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
-+			/* continue */
-+		}
-+		sub_uid_locked = false;
-+	}
-+	if (wflg || Wflg) {
-+		if (!is_sub_gid || (sub_gid_close () == 0)) {
-+			fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_gid_dbname ()));
-+			fail_exit (E_SUB_GID_UPDATE);
-+		}
-+		if (!is_sub_gid || (sub_gid_unlock () == 0)) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
-+			/* continue */
-+		}
-+		sub_gid_locked = false;
-+	}
-+
- 	/*
- 	 * Close the DBM and/or flat files
- 	 */
-@@ -1375,6 +1540,36 @@
- 		}
- #endif
- 	}
-+	if (vflg || Vflg) {
-+		if (!is_sub_uid || (sub_uid_lock () == 0)) {
-+			fprintf (stderr,
-+			         _("%s: cannot lock %s; try again later.\n"),
-+			         Prog, sub_uid_dbname ());
-+			fail_exit (E_SUB_UID_UPDATE);
-+		}
-+		sub_uid_locked = true;
-+		if (!is_sub_uid || (sub_uid_open (O_RDWR) == 0)) {
-+			fprintf (stderr,
-+			         _("%s: cannot open %s\n"),
-+			         Prog, sub_uid_dbname ());
-+			fail_exit (E_SUB_UID_UPDATE);
-+		}
-+	}
-+	if (wflg || Wflg) {
-+		if (!is_sub_gid || (sub_gid_lock () == 0)) {
-+			fprintf (stderr,
-+			         _("%s: cannot lock %s; try again later.\n"),
-+			         Prog, sub_gid_dbname ());
-+			fail_exit (E_SUB_GID_UPDATE);
-+		}
-+		sub_gid_locked = true;
-+		if (!is_sub_gid || (sub_gid_open (O_RDWR) == 0)) {
-+			fprintf (stderr,
-+			         _("%s: cannot open %s\n"),
-+			         Prog, sub_gid_dbname ());
-+			fail_exit (E_SUB_GID_UPDATE);
-+		}
-+	}
- }
- 
- /*
-@@ -1476,6 +1671,58 @@
- 			fail_exit (E_PW_UPDATE);
- 		}
- 	}
-+	if (Vflg) {
-+		struct ulong_range_list_entry *ptr;
-+		for (ptr = del_sub_uids; ptr != NULL; ptr = ptr->next) {
-+			unsigned long count = ptr->range.last - ptr->range.first + 1;
-+			if (sub_uid_remove(user_name, ptr->range.first, count) == 0) {
-+				fprintf (stderr,
-+					_("%s: failed to remove uid range %lu-%lu from '%s'\n"),
-+					Prog, ptr->range.first, ptr->range.last, 
-+					sub_uid_dbname ());
-+				fail_exit (E_SUB_UID_UPDATE);
-+			}
-+		}
-+	}
-+	if (vflg) {
-+		struct ulong_range_list_entry *ptr;
-+		for (ptr = add_sub_uids; ptr != NULL; ptr = ptr->next) {
-+			unsigned long count = ptr->range.last - ptr->range.first + 1;
-+			if (sub_uid_add(user_name, ptr->range.first, count) == 0) {
-+				fprintf (stderr,
-+					_("%s: failed to add uid range %lu-%lu from '%s'\n"),
-+					Prog, ptr->range.first, ptr->range.last, 
-+					sub_uid_dbname ());
-+				fail_exit (E_SUB_UID_UPDATE);
-+			}
-+		}
-+	}
-+	if (Wflg) {
-+		struct ulong_range_list_entry *ptr;
-+		for (ptr = del_sub_gids; ptr != NULL; ptr = ptr->next) {
-+			unsigned long count = ptr->range.last - ptr->range.first + 1;
-+			if (sub_gid_remove(user_name, ptr->range.first, count) == 0) {
-+				fprintf (stderr,
-+					_("%s: failed to remove gid range %lu-%lu from '%s'\n"),
-+					Prog, ptr->range.first, ptr->range.last, 
-+					sub_gid_dbname ());
-+				fail_exit (E_SUB_GID_UPDATE);
-+			}
-+		}
-+	}
-+	if (wflg) {
-+		struct ulong_range_list_entry *ptr;
-+		for (ptr = add_sub_gids; ptr != NULL; ptr = ptr->next) {
-+			unsigned long count = ptr->range.last - ptr->range.first + 1;
-+			if (sub_gid_add(user_name, ptr->range.first, count) == 0) {
-+				fprintf (stderr,
-+					_("%s: failed to add gid range %lu-%lu from '%s'\n"),
-+					Prog, ptr->range.first, ptr->range.last, 
-+					sub_gid_dbname ());
-+				fail_exit (E_SUB_GID_UPDATE);
-+			}
-+		}
-+	}
- }
- 
- /*
-@@ -1811,6 +2058,8 @@
- #ifdef SHADOWGRP
- 	is_shadow_grp = sgr_file_present ();
- #endif
-+	is_sub_uid = sub_uid_file_present ();
-+	is_sub_gid = sub_gid_file_present ();
- 
- 	process_flags (argc, argv);
- 
-@@ -1818,7 +2067,7 @@
- 	 * The home directory, the username and the user's UID should not
- 	 * be changed while the user is logged in.
- 	 */
--	if (   (uflg || lflg || dflg)
-+	if (   (uflg || lflg || dflg || Vflg || Wflg)
- 	    && (user_busy (user_name, user_id) != 0)) {
- 		exit (E_USER_BUSY);
- 	}
-@@ -1871,7 +2120,7 @@
- 	 */
- 	open_files ();
- 	if (   cflg || dflg || eflg || fflg || gflg || Lflg || lflg || pflg
--	    || sflg || uflg || Uflg) {
-+	    || sflg || uflg || Uflg || vflg || Vflg || wflg || Wflg) {
- 		usr_update ();
- 	}
- 	if (Gflg || lflg) {

debian/patches/userns/10_userns_newusers

@@ -1,256 +0,0 @@
-From ebiederm@xmission.com  Tue Jan 22 09:21:21 2013
-Return-Path: <ebiederm@xmission.com>
-X-Original-To: serge@hallyn.com
-Delivered-To: serge@hallyn.com
-Received: by mail.hallyn.com (Postfix, from userid 5001)
-	id ADE59C80F5; Tue, 22 Jan 2013 09:21:21 +0000 (UTC)
-X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
-X-Spam-Level: 
-X-Spam-Status: No, score=-2.2 required=8.0 tests=BAD_ENC_HEADER,BAYES_00,
-	RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1
-Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
-	(using TLSv1 with cipher AES256-SHA (256/256 bits))
-	(No client certificate requested)
-	by mail.hallyn.com (Postfix) with ESMTPS id D56AEC80DB
-	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:21:17 +0000 (UTC)
-Received: from out03.mta.xmission.com ([166.70.13.233])
-	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1Txa11-0000bo-MQ; Tue, 22 Jan 2013 02:19:35 -0700
-Received: from in02.mta.xmission.com ([166.70.13.52])
-	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1Txa11-0005wx-1p; Tue, 22 Jan 2013 02:19:35 -0700
-Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
-	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
-	(Exim 4.76)
-	(envelope-from <ebiederm@xmission.com>)
-	id 1Txa0y-000519-2O; Tue, 22 Jan 2013 02:19:34 -0700
-From: ebiederm@xmission.com (Eric W. Biederman)
-To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
-Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
-References: <87d2wxshu0.fsf@xmission.com>
-Date: Tue, 22 Jan 2013 01:19:28 -0800
-In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
-	"Tue, 22 Jan 2013 01:11:19 -0800")
-Message-ID: <87k3r5pobj.fsf@xmission.com>
-User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
-MIME-Version: 1.0
-Content-Type: text/plain
-X-XM-AID: U2FsdGVkX1+qhualZ5pxk+DVqanIJA7JrJwlPXicL8c=
-X-SA-Exim-Connect-IP: 98.207.153.68
-X-SA-Exim-Mail-From: ebiederm@xmission.com
-Subject: [PATCH 10/11] newusers: Add support for assiging subordinate uids and gids.
-X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
-X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
-X-UID: 2080                                        
-Status: O
-Content-Length: 5597
-Lines: 206
-
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- src/newusers.c |  124 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 files changed, 124 insertions(+), 0 deletions(-)
-
-Index: shadow/src/newusers.c
-===================================================================
---- shadow.orig/src/newusers.c	2013-02-01 15:27:53.548080347 -0600
-+++ shadow/src/newusers.c	2013-02-01 15:27:53.540080347 -0600
-@@ -65,6 +65,7 @@
- #include "pwio.h"
- #include "sgroupio.h"
- #include "shadowio.h"
-+#include "subordinateio.h"
- #include "chkname.h"
- 
- /*
-@@ -82,6 +83,8 @@
- #endif				/* USE_SHA_CRYPT */
- #endif				/* !USE_PAM */
- 
-+static bool is_sub_uid = false;
-+static bool is_sub_gid = false;
- static bool is_shadow;
- #ifdef SHADOWGRP
- static bool is_shadow_grp;
-@@ -90,6 +93,8 @@
- static bool pw_locked = false;
- static bool gr_locked = false;
- static bool spw_locked = false;
-+static bool sub_uid_locked = false;
-+static bool sub_gid_locked = false;
- 
- /* local function prototypes */
- static void usage (int status);
-@@ -178,6 +183,20 @@
- 		}
- 	}
- #endif
-+	if (sub_uid_locked) {
-+		if (sub_uid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
-+			/* continue */
-+		}
-+	}
-+	if (sub_gid_locked) {
-+		if (sub_gid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
-+			/* continue */
-+		}
-+	}
- 
- 	exit (code);
- }
-@@ -732,6 +751,24 @@
- 		sgr_locked = true;
- 	}
- #endif
-+	if (is_sub_uid) {
-+		if (sub_uid_lock () == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot lock %s; try again later.\n"),
-+			         Prog, sub_uid_dbname ());
-+			fail_exit (EXIT_FAILURE);
-+		}
-+		sub_uid_locked = true;
-+	}
-+	if (is_sub_gid) {
-+		if (sub_gid_lock () == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot lock %s; try again later.\n"),
-+			         Prog, sub_gid_dbname ());
-+			fail_exit (EXIT_FAILURE);
-+		}
-+		sub_gid_locked = true;
-+	}
- 
- 	if (pw_open (O_RDWR) == 0) {
- 		fprintf (stderr, _("%s: cannot open %s\n"), Prog, pw_dbname ());
-@@ -751,6 +788,22 @@
- 		fail_exit (EXIT_FAILURE);
- 	}
- #endif
-+	if (is_sub_uid) {
-+		if (sub_uid_open (O_RDWR) == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot open %s\n"),
-+			         Prog, sub_uid_dbname ());
-+			fail_exit (EXIT_FAILURE);
-+		}
-+	}
-+	if (is_sub_gid) {
-+		if (sub_gid_open (O_RDWR) == 0) {
-+			fprintf (stderr,
-+			         _("%s: cannot open %s\n"),
-+			         Prog, sub_gid_dbname ());
-+			fail_exit (EXIT_FAILURE);
-+		}
-+	}
- }
- 
- /*
-@@ -795,6 +848,19 @@
- 		SYSLOG ((LOG_ERR, "failure while writing changes to %s", gr_dbname ()));
- 		fail_exit (EXIT_FAILURE);
- 	}
-+	if (is_sub_uid  && (sub_uid_close () == 0)) {
-+		fprintf (stderr,
-+		         _("%s: failure while writing changes to %s\n"), Prog, sub_uid_dbname ());
-+		SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_uid_dbname ()));
-+		fail_exit (EXIT_FAILURE);
-+	}
-+	if (is_sub_gid  && (sub_gid_close () == 0)) {
-+		fprintf (stderr,
-+		         _("%s: failure while writing changes to %s\n"), Prog, sub_gid_dbname ());
-+		SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_gid_dbname ()));
-+		fail_exit (EXIT_FAILURE);
-+	}
-+
- 	if (gr_unlock () == 0) {
- 		fprintf (stderr,
- 		         _("%s: failed to unlock %s\n"),
-@@ -823,6 +889,22 @@
- 		sgr_locked = false;
- 	}
- #endif
-+	if (is_sub_uid) {
-+		if (sub_uid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
-+			/* continue */
-+		}
-+		sub_uid_locked = false;
-+	}
-+	if (is_sub_gid) {
-+		if (sub_gid_unlock () == 0) {
-+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
-+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
-+			/* continue */
-+		}
-+		sub_gid_locked = false;
-+	}
- }
- 
- int main (int argc, char **argv)
-@@ -864,6 +946,8 @@
- #ifdef SHADOWGRP
- 	is_shadow_grp = sgr_file_present ();
- #endif
-+	is_sub_uid = sub_uid_file_present ();
-+	is_sub_gid = sub_gid_file_present ();
- 
- 	open_files ();
- 
-@@ -1044,6 +1128,46 @@
- 			errors++;
- 			continue;
- 		}
-+
-+		/*
-+		 * Add subordinate uids if the user does not have them.
-+		 */
-+		if (is_sub_uid && !sub_uid_assigned(fields[0])) {
-+			uid_t sub_uid_start = 0;
-+			unsigned long sub_uid_count = 0;
-+			if (find_new_sub_uids(fields[0], &sub_uid_start, &sub_uid_count) == 0) {
-+				if (sub_uid_add(fields[0], sub_uid_start, sub_uid_count) == 0) {
-+					fprintf (stderr,
-+						_("%s: failed to prepare new %s entry\n"),
-+						Prog, sub_uid_dbname ());
-+				}
-+			} else {
-+				fprintf (stderr,
-+					_("%s: can't find subordinate user range\n"),
-+					Prog);
-+				errors++;
-+			}
-+		}
-+	
-+		/*
-+		 * Add subordinate gids if the user does not have them.
-+		 */
-+		if (is_sub_gid && !sub_gid_assigned(fields[0])) {
-+			gid_t sub_gid_start = 0;
-+			unsigned long sub_gid_count = 0;
-+			if (find_new_sub_gids(fields[0], &sub_gid_start, &sub_gid_count) == 0) {
-+				if (sub_gid_add(fields[0], sub_gid_start, sub_gid_count) == 0) {
-+					fprintf (stderr,
-+						_("%s: failed to prepare new %s entry\n"),
-+						Prog, sub_uid_dbname ());
-+				}
-+			} else {
-+				fprintf (stderr,
-+					_("%s: can't find subordinate group range\n"),
-+					Prog);
-+				errors++;
-+			}
-+		}
- 	}
- 
- 	/*

debian/patches/userns/12_userns_selinuxlibs

@@ -1,13 +0,0 @@
-Index: shadow-4.1.5.1/src/Makefile.am
-===================================================================
---- shadow-4.1.5.1.orig/src/Makefile.am	2013-02-04 11:56:40.485335430 -0600
-+++ shadow-4.1.5.1/src/Makefile.am	2013-02-04 11:57:49.525334261 -0600
-@@ -80,6 +80,8 @@
- endif
- 
- chage_LDADD    = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
-+newuidmap_LDADD    = $(LDADD) $(LIBSELINUX)
-+newgidmap_LDADD    = $(LDADD) $(LIBSELINUX)
- chfn_LDADD     = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
- chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBSELINUX) $(LIBCRYPT)
- chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)

debian/patches/userns/13_subordinate_parse_static_buf

@@ -1,23 +0,0 @@
-Description: subordinateio: Fix subordinate_parse to have an internal static buffer
- subordinate_parse is supposed to return a static structure that
- represents one line in /etc/subuid or /etc/subgid.  I goofed and
- failed to make the variable rangebuf that holds the username of
- in the returned structure static.
- .
- Add this missing static specification.
-Author: <Eric W. Biederman" <ebiederm@xmission.com>
-Origin: upstream
-Forwarded: no
-Index: shadow-4.1.5.1/lib/subordinateio.c
-===================================================================
---- shadow-4.1.5.1.orig/lib/subordinateio.c	2013-02-04 11:56:40.265335433 -0600
-+++ shadow-4.1.5.1/lib/subordinateio.c	2013-02-04 12:32:46.653298752 -0600
-@@ -48,7 +48,7 @@
- static void *subordinate_parse (const char *line)
- {
- 	static struct subordinate_range range;
--	char rangebuf[1024];
-+	static char rangebuf[1024];
- 	int i;
- 	char *cp;
- 	char *fields[NFIELDS];

debian/patches/userns/14_fix_getopt

@@ -1,24 +0,0 @@
-Index: shadow-userns/src/usermod.c
-===================================================================
---- shadow-userns.orig/src/usermod.c	2013-02-05 16:35:10.608485591 +0000
-+++ shadow-userns/src/usermod.c	2013-02-05 17:16:20.540485591 +0000
-@@ -993,9 +993,9 @@
- 		};
- 		while ((c = getopt_long (argc, argv,
- #ifdef WITH_SELINUX
--			                 "ac:d:e:f:g:G:hl:Lmop:R:s:u:UZ:",
-+			                 "ac:d:e:f:g:G:hl:Lmop:R:s:u:UZ:v:w:V:W:",
- #else				/* !WITH_SELINUX */
--			                 "ac:d:e:f:g:G:hl:Lmop:R:s:u:U",
-+			                 "ac:d:e:f:g:G:hl:Lmop:R:s:u:Uv:w:V:W:",
- #endif				/* !WITH_SELINUX */
- 			                 long_options, NULL)) != -1) {
- 			switch (c) {
-@@ -1141,6 +1141,7 @@
- 					exit(E_BAD_ARG);
- 				}
- 				wflg = true;
-+                break;
- 			case 'W':
- 				if (prepend_range (optarg, &del_sub_gids) == 0) {
- 					fprintf (stderr,

debian/patches/userns/16_add-argument-sanity-checking.patch

@@ -1,80 +0,0 @@
-From df3c8c1f7f47ceff607595067458f1d8e53eaab8 Mon Sep 17 00:00:00 2001
-From: Serge Hallyn <serge.hallyn@ubuntu.com>
-Date: Fri, 21 Jun 2013 11:47:36 -0500
-Subject: [PATCH 1/1] userns: add argument sanity checking
-
-In find_new_sub_{u,g}ids, check for min, count and max values.
-
-In idmapping.c:get_map_ranges(), make sure that the value passed
-in for ranges did not overflow.  Couldn't happen with the current
-code, but this is a sanity check for any future potential mis-uses.
-
-Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
----
- libmisc/find_new_sub_gids.c |  8 ++++++++
- libmisc/find_new_sub_uids.c |  8 ++++++++
- libmisc/idmapping.c         | 10 ++++++++++
- 3 files changed, 26 insertions(+)
-
-diff --git a/libmisc/find_new_sub_gids.c b/libmisc/find_new_sub_gids.c
-index 68046ac..fd44978 100644
---- a/libmisc/find_new_sub_gids.c
-+++ b/libmisc/find_new_sub_gids.c
-@@ -58,6 +58,14 @@ int find_new_sub_gids (const char *owner,
- 	max = getdef_ulong ("SUB_GID_MAX", 600100000UL);
- 	count = getdef_ulong ("SUB_GID_COUNT", 10000);
- 
-+	if (min >= max || count >= max || (min + count) >= max) {
-+		(void) fprintf (stderr,
-+				_("%s: Invalid configuration: SUB_GID_MIN (%lu),"
-+				  " SUB_GID_MAX (%lu), SUB_GID_COUNT (%lu)\n"),
-+			Prog, min, max, count);
-+		return -1;
-+	}
-+
- 	/* Is there a preferred range that works? */
- 	if ((*range_count != 0) &&
- 	    (*range_start >= min) &&
-diff --git a/libmisc/find_new_sub_uids.c b/libmisc/find_new_sub_uids.c
-index f1720f9..b608c59 100644
---- a/libmisc/find_new_sub_uids.c
-+++ b/libmisc/find_new_sub_uids.c
-@@ -58,6 +58,14 @@ int find_new_sub_uids (const char *owner,
- 	max = getdef_ulong ("SUB_UID_MAX", 600100000UL);
- 	count = getdef_ulong ("SUB_UID_COUNT", 10000);
- 
-+	if (min >= max || count >= max || (min + count) >= max) {
-+		(void) fprintf (stderr,
-+				_("%s: Invalid configuration: SUB_UID_MIN (%lu),"
-+				  " SUB_UID_MAX (%lu), SUB_UID_COUNT (%lu)\n"),
-+			Prog, min, max, count);
-+		return -1;
-+	}
-+
- 	/* Is there a preferred range that works? */
- 	if ((*range_count != 0) &&
- 	    (*range_start >= min) &&
-diff --git a/libmisc/idmapping.c b/libmisc/idmapping.c
-index cb9e898..4147796 100644
---- a/libmisc/idmapping.c
-+++ b/libmisc/idmapping.c
-@@ -41,6 +41,16 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)
- 	struct map_range *mappings, *mapping;
- 	int idx, argidx;
- 
-+	if (ranges < 0 || argc < 0) {
-+		fprintf(stderr, "%s: error calculating number of arguments\n", Prog);
-+		return NULL;
-+	}
-+
-+	if (ranges != ((argc - 2) + 2) / 3) {
-+		fprintf(stderr, "%s: ranges: %u is wrong for argc: %d\n", Prog, ranges, argc);
-+		return NULL;
-+	}
-+
- 	if ((ranges * 3) > argc) {
- 		fprintf(stderr, "ranges: %u argc: %d\n",
- 			ranges, argc);
--- 
-1.8.1.2
-

debian/patches/userns/manpagetypo

@@ -1,26 +0,0 @@
-Index: shadow/man/subgid.5.xml
-===================================================================
---- shadow.orig/man/subgid.5.xml	2013-03-06 15:19:23.848386200 -0600
-+++ shadow/man/subgid.5.xml	2013-03-06 15:19:51.240386816 -0600
-@@ -104,7 +104,7 @@
- 	<refentrytitle>subuid</refentrytitle><manvolnum>5</manvolnum>
-       </citerefentry>,
-       <citerefentry>
--	<refentrytitle>logindefs</refentrytitle><manvolnum>5</manvolnum>
-+	<refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum>
-       </citerefentry>,
-       <citerefentry>
- 	<refentrytitle>newuidmap</refentrytitle><manvolnum>1</manvolnum>
-Index: shadow/man/subuid.5.xml
-===================================================================
---- shadow.orig/man/subuid.5.xml	2013-03-06 15:19:09.660385881 -0600
-+++ shadow/man/subuid.5.xml	2013-03-06 15:19:44.956386675 -0600
-@@ -104,7 +104,7 @@
- 	<refentrytitle>subgid</refentrytitle><manvolnum>5</manvolnum>
-       </citerefentry>,
-       <citerefentry>
--	<refentrytitle>logindefs</refentrytitle><manvolnum>5</manvolnum>
-+	<refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum>
-       </citerefentry>,
-       <citerefentry>
- 	<refentrytitle>newuidmap</refentrytitle><manvolnum>1</manvolnum>

debian/rules

@@ -3,13 +3,10 @@
 
 DEB_HOST_ARCH_OS := $(shell dpkg-architecture -qDEB_HOST_ARCH_OS)
 
-ifeq ($(DEB_HOST_ARCH_OS),hurd)
-# Do not build login on The Hurd
-override DEB_ARCH_PACKAGES=passwd
-endif
-
 # Enable PIE, BINDNOW, and possible future flags.
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+DPKG_EXPORT_BUILDFLAGS = 1
+include /usr/share/dpkg/buildflags.mk
 
 # Call autoreconf since we need to regenerate all the autofoo files
 include /usr/share/cdbs/1/rules/autoreconf.mk
@@ -24,7 +21,18 @@ DEB_DESTDIR=$(CURDIR)/debian/tmp
 include /usr/share/cdbs/1/class/autotools.mk
 
 # Adds extra options when calling the configure script:
-DEB_CONFIGURE_EXTRA_FLAGS := --disable-shared --without-libcrack --without-audit --mandir=/usr/share/man --with-libpam --enable-shadowgrp --enable-man --disable-account-tools-setuid --with-group-name-max-length=32 --without-acl --without-attr --without-tcb
+DEB_CONFIGURE_EXTRA_FLAGS := --disable-shared \
+	--without-libcrack \
+	--mandir=/usr/share/man \
+	--with-libpam \
+	--enable-shadowgrp \
+	--enable-man \
+	--disable-account-tools-setuid \
+	--with-group-name-max-length=32 \
+	--without-acl \
+	--without-attr \
+	--without-tcb \
+	 SHELL=/bin/sh
 ifneq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
   DEB_CONFIGURE_EXTRA_FLAGS += --host=$(DEB_HOST_GNU_TYPE)
 endif
@@ -34,8 +42,14 @@ CFLAGS += -DDEFAULT_EDITOR=\\\"sensible-editor\\\"
 
 # Add extras to the install process:
 binary-install/login::
+ifeq ($(DEB_HOST_ARCH_OS),hurd)
+	# /bin/login is provided by the hurd package.
+	rm -f debian/login/bin/login
+endif
+ifneq ($(DEB_HOST_ARCH_OS),linux)
+	sed -i 's/session    optional   pam_keyinit.so/# Linux only # session    optional   pam_keyinit.so/' debian/login.pam
+endif
 	dh_installpam -p login
-	dh_installpam -p login --name=su
 	install -c -m 444 debian/login.defs debian/login/etc/login.defs
 	install -c -m 444 debian/securetty.$(DEB_HOST_ARCH_OS) debian/login/etc/securetty
 	dh_lintian -p login
@@ -52,11 +66,6 @@ binary-install/passwd::
 	dh_installpam -p passwd --name=chsh
 	dh_installpam -p passwd --name=chpasswd
 	dh_installpam -p passwd --name=newusers
-ifeq ($(DEB_HOST_ARCH_OS),hurd)
-# login is not built on The Hurd, but some utilities of passwd depends on
-# /etc/login.defs.
-	install -c -m 444 debian/login.defs debian/passwd/etc/login.defs
-endif
 	install -c -m 644 debian/useradd.default debian/passwd/etc/default/useradd
 	install -d debian/passwd/sbin
 	install -c -m 555 debian/shadowconfig.sh debian/passwd/sbin/shadowconfig
@@ -71,7 +80,6 @@ binary-predeb/uidmap::
 binary-predeb/login::
 	# No real need for login to be setuid root
 	# chmod u+s debian/login/bin/login
-	chmod u+s debian/login/bin/su
 	chmod u+s debian/login/usr/bin/newgrp
 
 binary-predeb/passwd::
@@ -83,3 +91,6 @@ binary-predeb/passwd::
 	chgrp shadow debian/passwd/usr/bin/expiry
 	chmod g+s debian/passwd/usr/bin/chage
 	chmod g+s debian/passwd/usr/bin/expiry
+
+clean::
+	sed -i 's/# Linux only # //' debian/login.pam

debian/securetty.linux

@@ -211,6 +211,12 @@ ttySC0
 ttySC1
 ttySC2
 ttySC3
+ttySC4
+ttySC5
+ttySC6
+ttySC7
+ttySC8
+ttySC9
 
 # ARM "AMBA" serial ports
 ttyAM0
@@ -398,3 +404,9 @@ duart1
 
 # s390 and s390x ports in LPAR mode
 ttysclp0
+
+# ODROID XU4 serial console
+ttySAC0
+ttySAC1
+ttySAC2
+ttySAC3

debian/uidmap.lintian-overrides

@@ -0,0 +1,2 @@
+uidmap: setuid-binary usr/bin/newgidmap 4755 root/root
+uidmap: setuid-binary usr/bin/newuidmap 4755 root/root

debian/watch

@@ -1,3 +1,4 @@
-version=3
-ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow/shadow-(.*)\.tar\.gz \
-  debian  uupdate
+version=4
+opts="filenamemangle=s%(?:.*?)?v?(\d[\d.]*)\.tar\.gz%shadow-$1.tar.gz%" \
+   https://github.com/shadow-maint/shadow/tags \
+   (?:.*?/)?v?(\d[\d.]*)\.tar\.gz debian uupdate

etc/login.defs

@@ -229,7 +229,7 @@ SYS_UID_MAX		  999
 # Extra per user uids
 SUB_UID_MIN		   100000
 SUB_UID_MAX		600100000
-SUB_UID_COUNT		    10000
+SUB_UID_COUNT		    65536
 
 #
 # Min/max values for automatic gid selection in groupadd(8)
@@ -242,7 +242,7 @@ SYS_GID_MAX		  999
 # Extra per user group ids
 SUB_GID_MIN		   100000
 SUB_GID_MAX		600100000
-SUB_GID_COUNT		    10000
+SUB_GID_COUNT		    65536
 
 #
 # Max number of login(1) retries if password is bad
@@ -393,3 +393,8 @@ USERGROUPS_ENAB yes
 #
 #CREATE_HOME     yes
 
+#
+# Force use shadow, even if shadow passwd & shadow group files are
+# missing.
+#
+#FORCE_SHADOW    yes

lib/commonio.c

@@ -301,15 +301,12 @@ static int create_backup (const char *backup, FILE * fp)
 	struct utimbuf ub;
 	FILE *bkfp;
 	int c;
-	mode_t mask;
 
 	if (fstat (fileno (fp), &sb) != 0) {
 		return -1;
 	}
 
-	mask = umask (077);
-	bkfp = fopen (backup, "w");
-	(void) umask (mask);
+	bkfp = fopen_set_perms (backup, "w", &sb);
 	if (NULL == bkfp) {
 		return -1;
 	}
@@ -754,16 +751,16 @@ commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *))
 	for (ptr = db->head;
 	        (NULL != ptr)
 #if KEEP_NIS_AT_END
-	     && (NULL != ptr->line)
-	     && (   ('+' != ptr->line[0])
-	         && ('-' != ptr->line[0]))
+	     && ((NULL == ptr->line)
+	         || (('+' != ptr->line[0])
+	             && ('-' != ptr->line[0])))
 #endif
 	     ;
 	     ptr = ptr->next) {
 		n++;
 	}
 #if KEEP_NIS_AT_END
-	if ((NULL != ptr) && (NULL != ptr->line)) {
+	if (NULL != ptr) {
 		nis = ptr;
 	}
 #endif
@@ -968,11 +965,10 @@ int commonio_close (struct commonio_db *db)
 	} else {
 		/*
 		 * Default permissions for new [g]shadow files.
-		 * (passwd and group always exist...)
 		 */
-		sb.st_mode = 0400;
-		sb.st_uid = 0;
-		sb.st_gid = 0;
+		sb.st_mode = db->st_mode;
+		sb.st_uid = db->st_uid;
+		sb.st_gid = db->st_gid;
 	}
 
 	snprintf (buf, sizeof buf, "%s+", db->filename);
@@ -1081,6 +1077,7 @@ int commonio_update (struct commonio_db *db, const void *eptr)
 	if (NULL != p) {
 		if (next_entry_by_name (db, p->next, db->ops->getname (eptr)) != NULL) {
 			fprintf (stderr, _("Multiple entries named '%s' in %s. Please fix this with pwck or grpck.\n"), db->ops->getname (eptr), db->filename);
+			db->ops->free (nentry);
 			return 0;
 		}
 		db->ops->free (p->eptr);

lib/commonio.h

@@ -31,8 +31,8 @@
  */
 
 /* $Id$ */
-#ifndef _COMMONIO_H
-#define _COMMONIO_H
+#ifndef COMMONIO_H
+#define COMMONIO_H
 
 #ifdef WITH_SELINUX
 #include <selinux/selinux.h>
@@ -123,6 +123,12 @@ struct commonio_db {
 #ifdef WITH_SELINUX
 	/*@null@*/security_context_t scontext;
 #endif
+	/*
+	 * Default permissions and owner for newly created data file.
+         */
+	mode_t st_mode;
+	uid_t st_uid;
+	gid_t st_gid;
 	/*
 	 * Head, tail, current position in linked list.
 	 */

lib/getdef.c

@@ -49,6 +49,32 @@ struct itemdef {
 	/*@null@*/char *value;		/* value given, or NULL if no value     */
 };
 
+#define PAMDEFS					\
+	{"CHFN_AUTH", NULL},			\
+	{"CHSH_AUTH", NULL},			\
+	{"CRACKLIB_DICTPATH", NULL},		\
+	{"ENV_HZ", NULL},			\
+	{"ENVIRON_FILE", NULL},			\
+	{"ENV_TZ", NULL},			\
+	{"FAILLOG_ENAB", NULL},			\
+	{"FTMP_FILE", NULL},			\
+	{"ISSUE_FILE", NULL},			\
+	{"LASTLOG_ENAB", NULL},			\
+	{"LOGIN_STRING", NULL},			\
+	{"MAIL_CHECK_ENAB", NULL},		\
+	{"MOTD_FILE", NULL},			\
+	{"NOLOGINS_FILE", NULL},		\
+	{"OBSCURE_CHECKS_ENAB", NULL},		\
+	{"PASS_ALWAYS_WARN", NULL},		\
+	{"PASS_CHANGE_TRIES", NULL},		\
+	{"PASS_MAX_LEN", NULL},			\
+	{"PASS_MIN_LEN", NULL},			\
+	{"PORTTIME_CHECKS_ENAB", NULL},		\
+	{"QUOTAS_ENAB", NULL},			\
+	{"SU_WHEEL_ONLY", NULL},		\
+	{"ULIMIT", NULL},
+
+
 #define NUMDEFS	(sizeof(def_table)/sizeof(def_table[0]))
 static struct itemdef def_table[] = {
 	{"CHFN_RESTRICT", NULL},
@@ -102,29 +128,7 @@ static struct itemdef def_table[] = {
 	{"USERDEL_CMD", NULL},
 	{"USERGROUPS_ENAB", NULL},
 #ifndef USE_PAM
-	{"CHFN_AUTH", NULL},
-	{"CHSH_AUTH", NULL},
-	{"CRACKLIB_DICTPATH", NULL},
-	{"ENV_HZ", NULL},
-	{"ENVIRON_FILE", NULL},
-	{"ENV_TZ", NULL},
-	{"FAILLOG_ENAB", NULL},
-	{"FTMP_FILE", NULL},
-	{"ISSUE_FILE", NULL},
-	{"LASTLOG_ENAB", NULL},
-	{"LOGIN_STRING", NULL},
-	{"MAIL_CHECK_ENAB", NULL},
-	{"MOTD_FILE", NULL},
-	{"NOLOGINS_FILE", NULL},
-	{"OBSCURE_CHECKS_ENAB", NULL},
-	{"PASS_ALWAYS_WARN", NULL},
-	{"PASS_CHANGE_TRIES", NULL},
-	{"PASS_MAX_LEN", NULL},
-	{"PASS_MIN_LEN", NULL},
-	{"PORTTIME_CHECKS_ENAB", NULL},
-	{"QUOTAS_ENAB", NULL},
-	{"SU_WHEEL_ONLY", NULL},
-	{"ULIMIT", NULL},
+	PAMDEFS
 #endif
 #ifdef USE_SYSLOG
 	{"SYSLOG_SG_ENAB", NULL},
@@ -134,6 +138,15 @@ static struct itemdef def_table[] = {
 	{"TCB_AUTH_GROUP", NULL},
 	{"TCB_SYMLINKS", NULL},
 	{"USE_TCB", NULL},
+#endif
+	{"FORCE_SHADOW", NULL},
+	{NULL, NULL}
+};
+
+#define NUMKNOWNDEFS	(sizeof(knowndef_table)/sizeof(knowndef_table[0]))
+static struct itemdef knowndef_table[] = {
+#ifdef USE_PAM
+	PAMDEFS
 #endif
 	{NULL, NULL}
 };
@@ -397,10 +410,17 @@ static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *name)
 	 * Item was never found.
 	 */
 
+	for (ptr = knowndef_table; NULL != ptr->name; ptr++) {
+		if (strcmp (ptr->name, name) == 0) {
+			goto out;
+		}
+	}
 	fprintf (stderr,
 	         _("configuration error - unknown item '%s' (notify administrator)\n"),
 	         name);
 	SYSLOG ((LOG_CRIT, "unknown configuration item `%s'", name));
+
+out:
 	return (struct itemdef *) NULL;
 }
 
@@ -416,23 +436,26 @@ static void def_load (void)
 	FILE *fp;
 	char buf[1024], *name, *value, *s;
 
+	/*
+	 * Set the initialized flag.
+	 * (do it early to prevent recursion in putdef_str())
+	 */
+	def_loaded = true;
+
 	/*
 	 * Open the configuration definitions file.
 	 */
 	fp = fopen (def_fname, "r");
 	if (NULL == fp) {
+		if (errno == ENOENT)
+			return;
+
 		int err = errno;
 		SYSLOG ((LOG_CRIT, "cannot open login definitions %s [%s]",
 		         def_fname, strerror (err)));
 		exit (EXIT_FAILURE);
 	}
 
-	/*
-	 * Set the initialized flag.
-	 * (do it early to prevent recursion in putdef_str())
-	 */
-	def_loaded = true;
-
 	/*
 	 * Go through all of the lines in the file.
 	 */

lib/getulong.c

@@ -44,22 +44,19 @@
  */
 int getulong (const char *numstr, /*@out@*/unsigned long int *result)
 {
-	long long int val;
+	unsigned long int val;
 	char *endptr;
 
 	errno = 0;
-	val = strtoll (numstr, &endptr, 0);
+	val = strtoul (numstr, &endptr, 0);
 	if (    ('\0' == *numstr)
 	     || ('\0' != *endptr)
 	     || (ERANGE == errno)
-	     /*@+ignoresigns@*/
-	     || (val != (unsigned long int)val)
-	     /*@=ignoresigns@*/
 	   ) {
 		return 0;
 	}
 
-	*result = (unsigned long int)val;
+	*result = val;
 	return 1;
 }
 

lib/groupio.c

@@ -130,6 +130,9 @@ static /*@owned@*/struct commonio_db group_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
+	0644,                   /* st_mode */
+	0,                      /* st_uid */
+	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
@@ -335,8 +338,7 @@ static /*@null@*/struct commonio_entry *merge_group_entries (
 		errno = ENOMEM;
 		return NULL;
 	}
-	snprintf(new_line, new_line_len, "%s\n%s", gr1->line, gr2->line);
-	new_line[new_line_len] = '\0';
+	snprintf(new_line, new_line_len + 1, "%s\n%s", gr1->line, gr2->line);
 
 	/* Concatenate the 2 list of members */
 	for (i=0; NULL != gptr1->gr_mem[i]; i++);

lib/groupmem.c

@@ -55,15 +55,14 @@
 	gr->gr_name = strdup (grent->gr_name);
 	/*@=mustfreeonly@*/
 	if (NULL == gr->gr_name) {
-		free(gr);
+		gr_free(gr);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	gr->gr_passwd = strdup (grent->gr_passwd);
 	/*@=mustfreeonly@*/
 	if (NULL == gr->gr_passwd) {
-		free(gr->gr_name);
-		free(gr);
+		gr_free(gr);
 		return NULL;
 	}
 
@@ -73,21 +72,13 @@
 	gr->gr_mem = (char **) malloc ((i + 1) * sizeof (char *));
 	/*@=mustfreeonly@*/
 	if (NULL == gr->gr_mem) {
-		free(gr->gr_passwd);
-		free(gr->gr_name);
-		free(gr);
+		gr_free(gr);
 		return NULL;
 	}
 	for (i = 0; grent->gr_mem[i]; i++) {
 		gr->gr_mem[i] = strdup (grent->gr_mem[i]);
 		if (NULL == gr->gr_mem[i]) {
-			int j;
-			for (j=0; j<i; j++)
-				free(gr->gr_mem[j]);
-			free(gr->gr_mem);
-			free(gr->gr_passwd);
-			free(gr->gr_name);
-			free(gr);
+			gr_free(gr);
 			return NULL;
 		}
 	}

lib/prototypes.h

@@ -179,6 +179,9 @@ extern int getrange (char *range,
                      unsigned long *min, bool *has_min,
                      unsigned long *max, bool *has_max);
 
+/* gettime.c */
+extern time_t gettime ();
+
 /* get_uid.c */
 extern int get_uid (const char *uidstr, uid_t *uid);
 

lib/pwio.c

@@ -105,6 +105,9 @@ static struct commonio_db passwd_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
+	0644,                   /* st_mode */
+	0,                      /* st_uid */
+	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */

lib/pwmem.c

@@ -56,45 +56,35 @@
 	pw->pw_name = strdup (pwent->pw_name);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_name) {
-		free(pw);
+		pw_free(pw);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	pw->pw_passwd = strdup (pwent->pw_passwd);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_passwd) {
-		free(pw->pw_name);
-		free(pw);
+		pw_free(pw);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	pw->pw_gecos = strdup (pwent->pw_gecos);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_gecos) {
-		free(pw->pw_passwd);
-		free(pw->pw_name);
-		free(pw);
+		pw_free(pw);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	pw->pw_dir = strdup (pwent->pw_dir);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_dir) {
-		free(pw->pw_gecos);
-		free(pw->pw_passwd);
-		free(pw->pw_name);
-		free(pw);
+		pw_free(pw);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	pw->pw_shell = strdup (pwent->pw_shell);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_shell) {
-		free(pw->pw_dir);
-		free(pw->pw_gecos);
-		free(pw->pw_passwd);
-		free(pw->pw_name);
-		free(pw);
+		pw_free(pw);
 		return NULL;
 	}
 

lib/sgroupio.c

@@ -40,6 +40,7 @@
 #include "prototypes.h"
 #include "defines.h"
 #include "commonio.h"
+#include "getdef.h"
 #include "sgroupio.h"
 
 /*@null@*/ /*@only@*/struct sgrp *__sgr_dup (const struct sgrp *sgent)
@@ -228,6 +229,9 @@ static struct commonio_db gshadow_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
+	0400,                   /* st_mode */
+	0,                      /* st_uid */
+	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
@@ -249,6 +253,8 @@ int sgr_setdbname (const char *filename)
 
 bool sgr_file_present (void)
 {
+	if (getdef_bool ("FORCE_SHADOW"))
+		return true;
 	return commonio_present (&gshadow_db);
 }
 

lib/shadowio.c

@@ -40,6 +40,7 @@
 #include <shadow.h>
 #include <stdio.h>
 #include "commonio.h"
+#include "getdef.h"
 #include "shadowio.h"
 #ifdef WITH_TCB
 #include <tcb.h>
@@ -104,6 +105,9 @@ static struct commonio_db shadow_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif				/* WITH_SELINUX */
+	0400,                   /* st_mode */
+	0,                      /* st_uid */
+	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
@@ -125,6 +129,8 @@ int spw_setdbname (const char *filename)
 
 bool spw_file_present (void)
 {
+	if (getdef_bool ("FORCE_SHADOW"))
+		return true;
 	return commonio_present (&shadow_db);
 }
 

lib/shadowio.h

@@ -31,8 +31,8 @@
  */
 
 /* $Id$ */
-#ifndef _SHADOWIO_H
-#define _SHADOWIO_H
+#ifndef SHADOWIO_H
+#define SHADOWIO_H
 
 #include "defines.h"
 

lib/subordinateio.c

@@ -11,6 +11,8 @@
 #include <stdio.h>
 #include "commonio.h"
 #include "subordinateio.h"
+#include <sys/types.h>
+#include <pwd.h>
 
 struct subordinate_range {
 	const char *owner;
@@ -189,6 +191,15 @@ static const struct subordinate_range *find_range(struct commonio_db *db,
 						  const char *owner, unsigned long val)
 {
 	const struct subordinate_range *range;
+
+	/*
+	 * Search for exact username/group specification
+	 *
+	 * This is the original method - go fast through the db, doing only
+	 * exact username/group string comparison. Therefore we leave it as-is
+	 * for the time being, in order to keep it equally fast as it was
+	 * before.
+	 */
 	commonio_rewind(db);
 	while ((range = commonio_next(db)) != NULL) {
 		unsigned long first = range->start;
@@ -200,6 +211,76 @@ static const struct subordinate_range *find_range(struct commonio_db *db,
 		if ((val >= first) && (val <= last))
 			return range;
 	}
+
+
+        /*
+         * We only do special handling for these two files
+         */
+        if ((0 != strcmp(db->filename, "/etc/subuid")) && (0 != strcmp(db->filename, "/etc/subgid")))
+                return NULL;
+
+        /*
+         * Search loop above did not produce any result. Let's rerun it,
+         * but this time try to matcha actual UIDs. The first entry that
+         * matches is considered a success.
+         * (It may be specified as literal UID or as another username which
+         * has the same UID as the username we are looking for.)
+         */
+        struct passwd *pwd;
+        uid_t          owner_uid;
+        char           owner_uid_string[33] = "";
+
+
+        /* Get UID of the username we are looking for */
+        pwd = getpwnam(owner);
+        if (NULL == pwd) {
+                /* Username not defined in /etc/passwd, or error occured during lookup */
+                return NULL;
+        }
+        owner_uid = pwd->pw_uid;
+        sprintf(owner_uid_string, "%lu", (unsigned long int)owner_uid);
+
+        commonio_rewind(db);
+        while ((range = commonio_next(db)) != NULL) {
+                unsigned long first = range->start;
+                unsigned long last = first + range->count - 1;
+
+                /* For performance reasons check range before using getpwnam() */
+                if ((val < first) || (val > last)) {
+                        continue;
+                }
+
+                /*
+                 * Range matches. Check if range owner is specified
+                 * as numeric UID and if it matches.
+                 */
+                if (0 == strcmp(range->owner, owner_uid_string)) {
+                        return range;
+                }
+
+                /*
+                 * Ok, this range owner is not specified as numeric UID
+                 * we are looking for. It may be specified as another
+                 * UID or as a literal username.
+                 *
+                 * If specified as another UID, the call to getpwnam()
+                 * will return NULL.
+                 *
+                 * If specified as literal username, we will get its
+                 * UID and compare that to UID we are looking for.
+                 */
+                const struct passwd *range_owner_pwd;
+
+                range_owner_pwd = getpwnam(range->owner);
+                if (NULL == range_owner_pwd) {
+                        continue;
+                }
+
+                if (owner_uid == range_owner_pwd->pw_uid) {
+                        return range;
+                }
+        }
+
 	return NULL;
 }
 
@@ -460,6 +541,9 @@ static struct commonio_db subordinate_uid_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
+	0644,                   /* st_mode */
+	0,                      /* st_uid */
+	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
@@ -538,6 +622,9 @@ static struct commonio_db subordinate_gid_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
+	0644,                   /* st_mode */
+	0,                      /* st_uid */
+	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */

libmisc/Makefile.am

@@ -1,7 +1,7 @@
 
 EXTRA_DIST = .indent.pro xgetXXbyYY.c
 
-INCLUDES = -I$(top_srcdir)/lib
+AM_CPPFLAGS = -I$(top_srcdir)/lib
 
 noinst_LIBRARIES = libmisc.a
 
@@ -31,6 +31,7 @@ libmisc_a_SOURCES = \
 	getdate.y \
 	getgr_nam_gid.c \
 	getrange.c \
+	gettime.c \
 	hushed.c \
 	idmapping.h \
 	idmapping.c \

libmisc/find_new_gid.c

@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 1991 - 1994, Julianne Frances Haugh
  * Copyright (c) 2008 - 2011, Nicolas François
+ * Copyright (c) 2014, Red Hat, Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -38,6 +39,117 @@
 #include "groupio.h"
 #include "getdef.h"
 
+/*
+ * get_ranges - Get the minimum and maximum ID ranges for the search
+ *
+ * This function will return the minimum and maximum ranges for IDs
+ *
+ * 0: The function completed successfully
+ * EINVAL: The provided ranges are impossible (such as maximum < minimum)
+ *
+ * preferred_min: The special-case minimum value for a specifically-
+ * requested ID, which may be lower than the standard min_id
+ */
+static int get_ranges (bool sys_group, gid_t *min_id, gid_t *max_id,
+		       gid_t *preferred_min)
+{
+	gid_t gid_def_max = 0;
+
+	if (sys_group) {
+		/* System groups */
+
+		/* A requested ID is allowed to be below the autoselect range */
+		*preferred_min = (gid_t) 1;
+
+		/* Get the minimum ID range from login.defs or default to 101 */
+		*min_id = (gid_t) getdef_ulong ("SYS_GID_MIN", 101UL);
+
+		/*
+		 * If SYS_GID_MAX is unspecified, we should assume it to be one
+		 * less than the GID_MIN (which is reserved for non-system accounts)
+		 */
+		gid_def_max = (gid_t) getdef_ulong ("GID_MIN", 1000UL) - 1;
+		*max_id = (gid_t) getdef_ulong ("SYS_GID_MAX",
+				(unsigned long) gid_def_max);
+
+		/* Check that the ranges make sense */
+		if (*max_id < *min_id) {
+			(void) fprintf (stderr,
+                            _("%s: Invalid configuration: SYS_GID_MIN (%lu), "
+                              "GID_MIN (%lu), SYS_GID_MAX (%lu)\n"),
+                            Prog, (unsigned long) *min_id,
+                            getdef_ulong ("GID_MIN", 1000UL),
+                            (unsigned long) *max_id);
+			return EINVAL;
+		}
+	} else {
+		/* Non-system groups */
+
+		/* Get the values from login.defs or use reasonable defaults */
+		*min_id = (gid_t) getdef_ulong ("GID_MIN", 1000UL);
+		*max_id = (gid_t) getdef_ulong ("GID_MAX", 60000UL);
+
+		/*
+		 * The preferred minimum should match the standard ID minimum
+		 * for non-system groups.
+		 */
+		*preferred_min = *min_id;
+
+		/* Check that the ranges make sense */
+		if (*max_id < *min_id) {
+			(void) fprintf (stderr,
+					_("%s: Invalid configuration: GID_MIN (%lu), "
+					  "GID_MAX (%lu)\n"),
+					Prog, (unsigned long) *min_id,
+					(unsigned long) *max_id);
+			return EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * check_gid - See if the requested GID is available
+ *
+ * On success, return 0
+ * If the ID is in use, return EEXIST
+ * If the ID is outside the range, return ERANGE
+ * In other cases, return errno from getgrgid()
+ */
+static int check_gid (const gid_t gid,
+		      const gid_t gid_min,
+		      const gid_t gid_max,
+		      bool *used_gids)
+{
+	/* First test that the preferred ID is in the range */
+	if (gid < gid_min || gid > gid_max) {
+		return ERANGE;
+	}
+
+	/*
+	 * Check whether we already detected this GID
+	 * using the gr_next() loop
+	 */
+	if (used_gids != NULL && used_gids[gid]) {
+		return EEXIST;
+	}
+	/* Check if the GID exists according to NSS */
+	errno = 0;
+	if (getgrgid (gid) != NULL) {
+		return EEXIST;
+	} else {
+		/* getgrgid() was NULL
+		 * we have to ignore errors as temporary
+		 * failures of remote user identity services
+		 * would completely block user/group creation
+		 */
+	}
+
+	/* If we've made it here, the GID must be available */
+	return 0;
+}
+
 /*
  * find_new_gid - Find a new unused GID.
  *
@@ -49,161 +161,338 @@
  * Return 0 on success, -1 if no unused GIDs are available.
  */
 int find_new_gid (bool sys_group,
-                  gid_t *gid,
-                  /*@null@*/gid_t const *preferred_gid)
+                 gid_t *gid,
+                 /*@null@*/gid_t const *preferred_gid)
 {
-	const struct group *grp;
-	gid_t gid_min, gid_max, group_id;
 	bool *used_gids;
+	const struct group *grp;
+	gid_t gid_min, gid_max, preferred_min;
+	gid_t group_id, id;
+	gid_t lowest_found, highest_found;
+	int result;
+	int nospam = 0;
 
-	assert (gid != NULL);
+	assert(gid != NULL);
 
-	if (!sys_group) {
-		gid_min = (gid_t) getdef_ulong ("GID_MIN", 1000UL);
-		gid_max = (gid_t) getdef_ulong ("GID_MAX", 60000UL);
-		if (gid_max < gid_min) {
-			(void) fprintf (stderr,
-			                _("%s: Invalid configuration: GID_MIN (%lu), GID_MAX (%lu)\n"),
-			                Prog, (unsigned long) gid_min, (unsigned long) gid_max);
-			return -1;
-		}
-	} else {
-		gid_min = (gid_t) getdef_ulong ("SYS_GID_MIN", 101UL);
-		gid_max = (gid_t) getdef_ulong ("GID_MIN", 1000UL) - 1;
-		gid_max = (gid_t) getdef_ulong ("SYS_GID_MAX", (unsigned long) gid_max);
-		if (gid_max < gid_min) {
-			(void) fprintf (stderr,
-			                _("%s: Invalid configuration: SYS_GID_MIN (%lu), GID_MIN (%lu), SYS_GID_MAX (%lu)\n"),
-			                Prog, (unsigned long) gid_min, getdef_ulong ("GID_MIN", 1000UL), (unsigned long) gid_max);
+	/*
+	 * First, figure out what ID range is appropriate for
+	 * automatic assignment
+	 */
+	result = get_ranges (sys_group, &gid_min, &gid_max, &preferred_min);
+	if (result == EINVAL) {
+		return -1;
+	}
+
+	/* Check if the preferred GID is available */
+	if (preferred_gid) {
+		result = check_gid (*preferred_gid, preferred_min, gid_max, NULL);
+		if (result == 0) {
+			/*
+			 * Make sure the GID isn't queued for use already
+			 */
+			if (gr_locate_gid (*preferred_gid) == NULL) {
+				*gid = *preferred_gid;
+				return 0;
+			}
+			/*
+			 * gr_locate_gid() found the GID in an as-yet uncommitted
+			 * entry. We'll proceed below and auto-set a GID.
+			 */
+		} else if (result == EEXIST || result == ERANGE) {
+			/*
+			 * Continue on below. At this time, we won't
+			 * treat these two cases differently.
+			 */
+		} else {
+			/*
+			 * An unexpected error occurred. We should report
+			 * this and fail the group creation.
+			 * This differs from the automatic creation
+			 * behavior below, since if a specific GID was
+			 * requested and generated an error, the user is
+			 * more likely to want to stop and address the
+			 * issue.
+			 */
+			fprintf (stderr,
+				_("%s: Encountered error attempting to use "
+				  "preferred GID: %s\n"),
+				Prog, strerror (result));
 			return -1;
 		}
 	}
+
+	/*
+	 * Search the entire group file,
+	 * looking for the next unused value.
+	 *
+	 * We first check the local database with gr_rewind/gr_next to find
+	 * all local values that are in use.
+	 *
+	 * We then compare the next free value to all databases (local and
+	 * remote) and iterate until we find a free one. If there are free
+	 * values beyond the lowest (system groups) or highest (non-system
+	 * groups), we will prefer those and avoid potentially reclaiming a
+	 * deleted group (which can be a security issue, since it may grant
+	 * access to files belonging to that former group).
+	 *
+	 * If there are no GIDs available at the end of the search, we will
+	 * have no choice but to iterate through the range looking for gaps.
+	 *
+	 */
+
+	/* Create an array to hold all of the discovered GIDs */
 	used_gids = malloc (sizeof (bool) * (gid_max +1));
 	if (NULL == used_gids) {
 		fprintf (stderr,
-		         _("%s: failed to allocate memory: %s\n"),
-		         Prog, strerror (errno));
+			 _("%s: failed to allocate memory: %s\n"),
+			 Prog, strerror (errno));
 		return -1;
 	}
 	memset (used_gids, false, sizeof (bool) * (gid_max + 1));
 
-	if (   (NULL != preferred_gid)
-	    && (*preferred_gid >= gid_min)
-	    && (*preferred_gid <= gid_max)
-	    /* Check if the user exists according to NSS */
-	    && (getgrgid (*preferred_gid) == NULL)
-	    /* Check also the local database in case of uncommitted
-	     * changes */
-	    && (gr_locate_gid (*preferred_gid) == NULL)) {
-		*gid = *preferred_gid;
-		free (used_gids);
-		return 0;
-	}
-
-
-	/*
-	 * Search the entire group file,
-	 * looking for the largest unused value.
-	 *
-	 * We check the list of groups according to NSS (setgrent/getgrent),
-	 * but we also check the local database (gr_rewind/gr_next) in case
-	 * some groups were created but the changes were not committed yet.
-	 */
-	if (sys_group) {
-		gid_t id;
-		/* setgrent / getgrent / endgrent can be very slow with
-		 * LDAP configurations (and many accounts).
-		 * Since there is a limited amount of IDs to be tested
-		 * for system accounts, we just check the existence
-		 * of IDs with getgrgid.
+	/* First look for the lowest and highest value in the local database */
+	(void) gr_rewind ();
+	highest_found = gid_min;
+	lowest_found = gid_max;
+	while ((grp = gr_next ()) != NULL) {
+		/*
+		 * Does this entry have a lower GID than the lowest we've found
+		 * so far?
 		 */
-		group_id = gid_max;
-		for (id = gid_max; id >= gid_min; id--) {
-			if (getgrgid (id) != NULL) {
-				group_id = id - 1;
-				used_gids[id] = true;
-			}
+		if ((grp->gr_gid <= lowest_found) && (grp->gr_gid >= gid_min)) {
+			lowest_found = grp->gr_gid - 1;
 		}
 
-		(void) gr_rewind ();
-		while ((grp = gr_next ()) != NULL) {
-			if ((grp->gr_gid <= group_id) && (grp->gr_gid >= gid_min)) {
-				group_id = grp->gr_gid - 1;
-			}
-			/* create index of used GIDs */
-			if (grp->gr_gid <= gid_max) {
-				used_gids[grp->gr_gid] = true;
-			}
+		/*
+		 * Does this entry have a higher GID than the highest we've found
+		 * so far?
+		 */
+		if ((grp->gr_gid >= highest_found) && (grp->gr_gid <= gid_max)) {
+			highest_found = grp->gr_gid + 1;
 		}
-	} else {
-		group_id = gid_min;
-		setgrent ();
-		while ((grp = getgrent ()) != NULL) {
-			if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
-				group_id = grp->gr_gid + 1;
-			}
-			/* create index of used GIDs */
-			if (grp->gr_gid <= gid_max) {
-				used_gids[grp->gr_gid] = true;
-			}
-		}
-		endgrent ();
 
-		(void) gr_rewind ();
-		while ((grp = gr_next ()) != NULL) {
-			if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
-				group_id = grp->gr_gid + 1;
-			}
-			/* create index of used GIDs */
-			if (grp->gr_gid <= gid_max) {
-				used_gids[grp->gr_gid] = true;
-			}
+		/* create index of used GIDs */
+		if (grp->gr_gid >= gid_min
+			&& grp->gr_gid <= gid_max) {
+
+			used_gids[grp->gr_gid] = true;
 		}
 	}
 
-	/*
-	 * If a group (resp. system group) with GID equal to GID_MAX (resp.
-	 * GID_MIN) exists, the above algorithm will give us GID_MAX+1
-	 * (resp. GID_MIN-1) even if not unique. Search for the first free
-	 * GID starting with GID_MIN (resp. GID_MAX).
-	 */
 	if (sys_group) {
-		if (group_id < gid_min) {
-			for (group_id = gid_max; group_id >= gid_min; group_id--) {
-				if (false == used_gids[group_id]) {
-					break;
-				}
-			}
-			if (group_id < gid_min) {
-				fprintf (stderr,
-				         _("%s: Can't get unique system GID (no more available GIDs)\n"),
-				         Prog);
-				SYSLOG ((LOG_WARN,
-				         "no more available GID on the system"));
+		/*
+		 * For system groups, we want to start from the
+		 * top of the range and work downwards.
+		 */
+
+		/*
+		 * At the conclusion of the gr_next() search, we will either
+		 * have a presumed-free GID or we will be at GID_MIN - 1.
+		 */
+		if (lowest_found < gid_min) {
+			/*
+			 * In this case, a GID is in use at GID_MIN.
+			 *
+			 * We will reset the search to GID_MAX and proceed down
+			 * through all the GIDs (skipping those we detected with
+			 * used_gids) for a free one. It is a known issue that
+			 * this may result in reusing a previously-deleted GID,
+			 * so administrators should be instructed to use this
+			 * auto-detection with care (and prefer to assign GIDs
+			 * explicitly).
+			 */
+			lowest_found = gid_max;
+		}
+
+		/* Search through all of the IDs in the range */
+		for (id = lowest_found; id >= gid_min; id--) {
+			result = check_gid (id, gid_min, gid_max, used_gids);
+			if (result == 0) {
+				/* This GID is available. Return it. */
+				*gid = id;
 				free (used_gids);
-				return -1;
+				return 0;
+			} else if (result == EEXIST) {
+				/* This GID is in use, we'll continue to the next */
+			} else {
+				/*
+				 * An unexpected error occurred.
+				 *
+				 * Only report it the first time to avoid spamming
+				 * the logs
+				 *
+				 */
+				if (!nospam) {
+					fprintf (stderr,
+						_("%s: Can't get unique system GID (%s). "
+						  "Suppressing additional messages.\n"),
+						Prog, strerror (result));
+					SYSLOG ((LOG_ERR,
+						"Error checking available GIDs: %s",
+						strerror (result)));
+					nospam = 1;
+				}
+				/*
+				 * We will continue anyway. Hopefully a later GID
+				 * will work properly.
+				 */
 			}
 		}
-	} else {
-		if (group_id > gid_max) {
-			for (group_id = gid_min; group_id <= gid_max; group_id++) {
-				if (false == used_gids[group_id]) {
-					break;
+
+		/*
+		 * If we get all the way through the loop, try again from GID_MAX,
+		 * unless that was where we previously started. (NOTE: the worst-case
+		 * scenario here is that we will run through (GID_MAX - GID_MIN - 1)
+		 * cycles *again* if we fall into this case with lowest_found as
+		 * GID_MAX - 1, all groups in the range in use and maintained by
+		 * network services such as LDAP.)
+		 */
+		if (lowest_found != gid_max) {
+			for (id = gid_max; id >= gid_min; id--) {
+				result = check_gid (id, gid_min, gid_max, used_gids);
+				if (result == 0) {
+					/* This GID is available. Return it. */
+					*gid = id;
+					free (used_gids);
+					return 0;
+				} else if (result == EEXIST) {
+					/* This GID is in use, we'll continue to the next */
+				} else {
+					/*
+					 * An unexpected error occurred.
+					 *
+					 * Only report it the first time to avoid spamming
+					 * the logs
+					 *
+					 */
+					if (!nospam) {
+						fprintf (stderr,
+							_("%s: Can't get unique system GID (%s). "
+							  "Suppressing additional messages.\n"),
+							Prog, strerror (result));
+						SYSLOG ((LOG_ERR,
+							"Error checking available GIDs: %s",
+							strerror (result)));
+						nospam = 1;
+					}
+					/*
+					 * We will continue anyway. Hopefully a later GID
+					 * will work properly.
+					 */
 				}
 			}
-			if (group_id > gid_max) {
-				fprintf (stderr,
-				         _("%s: Can't get unique GID (no more available GIDs)\n"),
-				         Prog);
-				SYSLOG ((LOG_WARN, "no more available GID on the system"));
+		}
+	} else { /* !sys_group */
+		/*
+		 * For non-system groups, we want to start from the
+		 * bottom of the range and work upwards.
+		 */
+
+		/*
+		 * At the conclusion of the gr_next() search, we will either
+		 * have a presumed-free GID or we will be at GID_MAX + 1.
+		 */
+		if (highest_found > gid_max) {
+			/*
+			 * In this case, a GID is in use at GID_MAX.
+			 *
+			 * We will reset the search to GID_MIN and proceed up
+			 * through all the GIDs (skipping those we detected with
+			 * used_gids) for a free one. It is a known issue that
+			 * this may result in reusing a previously-deleted GID,
+			 * so administrators should be instructed to use this
+			 * auto-detection with care (and prefer to assign GIDs
+			 * explicitly).
+			 */
+			highest_found = gid_min;
+		}
+
+		/* Search through all of the IDs in the range */
+		for (id = highest_found; id <= gid_max; id++) {
+			result = check_gid (id, gid_min, gid_max, used_gids);
+			if (result == 0) {
+				/* This GID is available. Return it. */
+				*gid = id;
 				free (used_gids);
-				return -1;
+				return 0;
+			} else if (result == EEXIST) {
+				/* This GID is in use, we'll continue to the next */
+			} else {
+				/*
+				 * An unexpected error occurred.
+				 *
+				 * Only report it the first time to avoid spamming
+				 * the logs
+				 *
+				 */
+				if (!nospam) {
+					fprintf (stderr,
+						_("%s: Can't get unique GID (%s). "
+						  "Suppressing additional messages.\n"),
+						Prog, strerror (result));
+					SYSLOG ((LOG_ERR,
+						"Error checking available GIDs: %s",
+						strerror (result)));
+					nospam = 1;
+				}
+				/*
+				 * We will continue anyway. Hopefully a later GID
+				 * will work properly.
+				 */
+			}
+		}
+
+		/*
+		 * If we get all the way through the loop, try again from GID_MIN,
+		 * unless that was where we previously started. (NOTE: the worst-case
+		 * scenario here is that we will run through (GID_MAX - GID_MIN - 1)
+		 * cycles *again* if we fall into this case with highest_found as
+		 * GID_MIN + 1, all groups in the range in use and maintained by
+		 * network services such as LDAP.)
+		 */
+		if (highest_found != gid_min) {
+			for (id = gid_min; id <= gid_max; id++) {
+				result = check_gid (id, gid_min, gid_max, used_gids);
+				if (result == 0) {
+					/* This GID is available. Return it. */
+					*gid = id;
+					free (used_gids);
+					return 0;
+				} else if (result == EEXIST) {
+					/* This GID is in use, we'll continue to the next */
+				} else {
+					/*
+					 * An unexpected error occurred.
+					 *
+					 * Only report it the first time to avoid spamming
+					 * the logs
+					 *
+					 */
+					if (!nospam) {
+						fprintf (stderr,
+							_("%s: Can't get unique GID (%s). "
+							  "Suppressing additional messages.\n"),
+							Prog, strerror (result));
+						SYSLOG ((LOG_ERR,
+							"Error checking available GIDs: %s",
+							strerror (result)));
+						nospam = 1;
+					}
+					/*
+					 * We will continue anyway. Hopefully a later GID
+					 * will work properly.
+					 */
+				}
 			}
 		}
 	}
 
+	/* The code reached here and found no available IDs in the range */
+	fprintf (stderr,
+		_("%s: Can't get unique GID (no more available GIDs)\n"),
+		Prog);
+	SYSLOG ((LOG_WARN, "no more available GIDs on the system"));
 	free (used_gids);
-	*gid = group_id;
-	return 0;
+	return -1;
 }
 

libmisc/find_new_sub_gids.c

@@ -58,7 +58,7 @@ int find_new_sub_gids (const char *owner,
 
 	min = getdef_ulong ("SUB_GID_MIN", 100000UL);
 	max = getdef_ulong ("SUB_GID_MAX", 600100000UL);
-	count = getdef_ulong ("SUB_GID_COUNT", 10000);
+	count = getdef_ulong ("SUB_GID_COUNT", 65536);
 
 	if (min > max || count >= max || (min + count - 1) > max) {
 		(void) fprintf (stderr,

libmisc/find_new_sub_uids.c

@@ -58,7 +58,7 @@ int find_new_sub_uids (const char *owner,
 
 	min = getdef_ulong ("SUB_UID_MIN", 100000UL);
 	max = getdef_ulong ("SUB_UID_MAX", 600100000UL);
-	count = getdef_ulong ("SUB_UID_COUNT", 10000);
+	count = getdef_ulong ("SUB_UID_COUNT", 65536);
 
 	if (min > max || count >= max || (min + count - 1) > max) {
 		(void) fprintf (stderr,

libmisc/find_new_uid.c

@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 1991 - 1994, Julianne Frances Haugh
  * Copyright (c) 2008 - 2011, Nicolas François
+ * Copyright (c) 2014, Red Hat, Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -38,6 +39,117 @@
 #include "pwio.h"
 #include "getdef.h"
 
+/*
+ * get_ranges - Get the minimum and maximum ID ranges for the search
+ *
+ * This function will return the minimum and maximum ranges for IDs
+ *
+ * 0: The function completed successfully
+ * EINVAL: The provided ranges are impossible (such as maximum < minimum)
+ *
+ * preferred_min: The special-case minimum value for a specifically-
+ * requested ID, which may be lower than the standard min_id
+ */
+static int get_ranges (bool sys_user, uid_t *min_id, uid_t *max_id,
+			uid_t *preferred_min)
+{
+	uid_t uid_def_max = 0;
+
+	if (sys_user) {
+		/* System users */
+
+		/* A requested ID is allowed to be below the autoselect range */
+		*preferred_min = (uid_t) 1;
+
+		/* Get the minimum ID range from login.defs or default to 101 */
+		*min_id = (uid_t) getdef_ulong ("SYS_UID_MIN", 101UL);
+
+		/*
+		 * If SYS_UID_MAX is unspecified, we should assume it to be one
+		 * less than the UID_MIN (which is reserved for non-system accounts)
+		 */
+		uid_def_max = (uid_t) getdef_ulong ("UID_MIN", 1000UL) - 1;
+		*max_id = (uid_t) getdef_ulong ("SYS_UID_MAX",
+				(unsigned long) uid_def_max);
+
+		/* Check that the ranges make sense */
+		if (*max_id < *min_id) {
+			(void) fprintf (stderr,
+                            _("%s: Invalid configuration: SYS_UID_MIN (%lu), "
+                              "UID_MIN (%lu), SYS_UID_MAX (%lu)\n"),
+                            Prog, (unsigned long) *min_id,
+                            getdef_ulong ("UID_MIN", 1000UL),
+                            (unsigned long) *max_id);
+			return EINVAL;
+		}
+	} else {
+		/* Non-system users */
+
+		/* Get the values from login.defs or use reasonable defaults */
+		*min_id = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
+		*max_id = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
+
+		/*
+		 * The preferred minimum should match the standard ID minimum
+		 * for non-system users.
+		 */
+		*preferred_min = *min_id;
+
+		/* Check that the ranges make sense */
+		if (*max_id < *min_id) {
+			(void) fprintf (stderr,
+					_("%s: Invalid configuration: UID_MIN (%lu), "
+					  "UID_MAX (%lu)\n"),
+					Prog, (unsigned long) *min_id,
+					(unsigned long) *max_id);
+			return EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * check_uid - See if the requested UID is available
+ *
+ * On success, return 0
+ * If the ID is in use, return EEXIST
+ * If the ID is outside the range, return ERANGE
+ * In other cases, return errno from getpwuid()
+ */
+static int check_uid(const uid_t uid,
+		     const uid_t uid_min,
+		     const uid_t uid_max,
+		     bool *used_uids)
+{
+	/* First test that the preferred ID is in the range */
+	if (uid < uid_min || uid > uid_max) {
+		return ERANGE;
+	}
+
+	/*
+	 * Check whether we already detected this UID
+	 * using the pw_next() loop
+	 */
+	if (used_uids != NULL && used_uids[uid]) {
+		return EEXIST;
+	}
+	/* Check if the UID exists according to NSS */
+	errno = 0;
+	if (getpwuid(uid) != NULL) {
+		return EEXIST;
+	} else {
+		/* getpwuid() was NULL
+		 * we have to ignore errors as temporary
+		 * failures of remote user identity services
+		 * would completely block user/group creation
+		 */
+	}
+
+	/* If we've made it here, the UID must be available */
+	return 0;
+}
+
 /*
  * find_new_uid - Find a new unused UID.
  *
@@ -48,162 +160,339 @@
  * 
  * Return 0 on success, -1 if no unused UIDs are available.
  */
-int find_new_uid (bool sys_user,
-                  uid_t *uid,
-                  /*@null@*/uid_t const *preferred_uid)
+int find_new_uid(bool sys_user,
+                 uid_t *uid,
+                 /*@null@*/uid_t const *preferred_uid)
 {
-	const struct passwd *pwd;
-	uid_t uid_min, uid_max, user_id;
 	bool *used_uids;
+	const struct passwd *pwd;
+	uid_t uid_min, uid_max, preferred_min;
+	uid_t user_id, id;
+	uid_t lowest_found, highest_found;
+	int result;
+	int nospam = 0;
 
 	assert (uid != NULL);
 
-	if (!sys_user) {
-		uid_min = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
-		uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
-		if (uid_max < uid_min) {
-			(void) fprintf (stderr,
-			                _("%s: Invalid configuration: UID_MIN (%lu), UID_MAX (%lu)\n"),
-			                Prog, (unsigned long) uid_min, (unsigned long) uid_max);
-			return -1;
-		}
-	} else {
-		uid_min = (uid_t) getdef_ulong ("SYS_UID_MIN", 101UL);
-		uid_max = (uid_t) getdef_ulong ("UID_MIN", 1000UL) - 1;
-		uid_max = (uid_t) getdef_ulong ("SYS_UID_MAX", (unsigned long) uid_max);
-		if (uid_max < uid_min) {
-			(void) fprintf (stderr,
-			                _("%s: Invalid configuration: SYS_UID_MIN (%lu), UID_MIN (%lu), SYS_UID_MAX (%lu)\n"),
-			                Prog, (unsigned long) uid_min, getdef_ulong ("UID_MIN", 1000UL), (unsigned long) uid_max);
+	/*
+	 * First, figure out what ID range is appropriate for
+	 * automatic assignment
+	 */
+	result = get_ranges (sys_user, &uid_min, &uid_max, &preferred_min);
+	if (result == EINVAL) {
+		return -1;
+	}
+
+	/* Check if the preferred UID is available */
+	if (preferred_uid) {
+		result = check_uid (*preferred_uid, preferred_min, uid_max, NULL);
+		if (result == 0) {
+			/*
+			 * Make sure the UID isn't queued for use already
+			 */
+			if (pw_locate_uid (*preferred_uid) == NULL) {
+				*uid = *preferred_uid;
+				return 0;
+			}
+			/*
+			 * pw_locate_uid() found the UID in an as-yet uncommitted
+			 * entry. We'll proceed below and auto-set an UID.
+			 */
+		} else if (result == EEXIST || result == ERANGE) {
+			/*
+			 * Continue on below. At this time, we won't
+			 * treat these two cases differently.
+			 */
+		} else {
+			/*
+			 * An unexpected error occurred. We should report
+			 * this and fail the user creation.
+			 * This differs from the automatic creation
+			 * behavior below, since if a specific UID was
+			 * requested and generated an error, the user is
+			 * more likely to want to stop and address the
+			 * issue.
+			 */
+			fprintf (stderr,
+				_("%s: Encountered error attempting to use "
+				  "preferred UID: %s\n"),
+				Prog, strerror (result));
 			return -1;
 		}
 	}
+
+	/*
+	 * Search the entire passwd file,
+	 * looking for the next unused value.
+	 *
+	 * We first check the local database with pw_rewind/pw_next to find
+	 * all local values that are in use.
+	 *
+	 * We then compare the next free value to all databases (local and
+	 * remote) and iterate until we find a free one. If there are free
+	 * values beyond the lowest (system users) or highest (non-system
+	 * users), we will prefer those and avoid potentially reclaiming a
+	 * deleted user (which can be a security issue, since it may grant
+	 * access to files belonging to that former user).
+	 *
+	 * If there are no UIDs available at the end of the search, we will
+	 * have no choice but to iterate through the range looking for gaps.
+	 *
+	 */
+
+	/* Create an array to hold all of the discovered UIDs */
 	used_uids = malloc (sizeof (bool) * (uid_max +1));
 	if (NULL == used_uids) {
 		fprintf (stderr,
-		         _("%s: failed to allocate memory: %s\n"),
-		         Prog, strerror (errno));
+			 _("%s: failed to allocate memory: %s\n"),
+			 Prog, strerror (errno));
 		return -1;
 	}
 	memset (used_uids, false, sizeof (bool) * (uid_max + 1));
 
-	if (   (NULL != preferred_uid)
-	    && (*preferred_uid >= uid_min)
-	    && (*preferred_uid <= uid_max)
-	    /* Check if the user exists according to NSS */
-	    && (getpwuid (*preferred_uid) == NULL)
-	    /* Check also the local database in case of uncommitted
-	     * changes */
-	    && (pw_locate_uid (*preferred_uid) == NULL)) {
-		*uid = *preferred_uid;
-		free (used_uids);
-		return 0;
-	}
-
-
-	/*
-	 * Search the entire password file,
-	 * looking for the largest unused value.
-	 *
-	 * We check the list of users according to NSS (setpwent/getpwent),
-	 * but we also check the local database (pw_rewind/pw_next) in case
-	 * some users were created but the changes were not committed yet.
-	 */
-	if (sys_user) {
-		uid_t id;
-		/* setpwent / getpwent / endpwent can be very slow with
-		 * LDAP configurations (and many accounts).
-		 * Since there is a limited amount of IDs to be tested
-		 * for system accounts, we just check the existence
-		 * of IDs with getpwuid.
+	/* First look for the lowest and highest value in the local database */
+	(void) pw_rewind ();
+	highest_found = uid_min;
+	lowest_found = uid_max;
+	while ((pwd = pw_next ()) != NULL) {
+		/*
+		 * Does this entry have a lower UID than the lowest we've found
+		 * so far?
 		 */
-		user_id = uid_max;
-		for (id = uid_max; id >= uid_min; id--) {
-			if (getpwuid (id) != NULL) {
-				user_id = id - 1;
-				used_uids[id] = true;
-			}
+		if ((pwd->pw_uid <= lowest_found) && (pwd->pw_uid >= uid_min)) {
+			lowest_found = pwd->pw_uid - 1;
 		}
 
-		(void) pw_rewind ();
-		while ((pwd = pw_next ()) != NULL) {
-			if ((pwd->pw_uid <= user_id) && (pwd->pw_uid >= uid_min)) {
-				user_id = pwd->pw_uid - 1;
-			}
-			/* create index of used UIDs */
-			if (pwd->pw_uid <= uid_max) {
-				used_uids[pwd->pw_uid] = true;
-			}
+		/*
+		 * Does this entry have a higher UID than the highest we've found
+		 * so far?
+		 */
+		if ((pwd->pw_uid >= highest_found) && (pwd->pw_uid <= uid_max)) {
+			highest_found = pwd->pw_uid + 1;
 		}
-	} else {
-		user_id = uid_min;
-		setpwent ();
-		while ((pwd = getpwent ()) != NULL) {
-			if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
-				user_id = pwd->pw_uid + 1;
-			}
-			/* create index of used UIDs */
-			if (pwd->pw_uid <= uid_max) {
-				used_uids[pwd->pw_uid] = true;
-			}
-		}
-		endpwent ();
 
-		(void) pw_rewind ();
-		while ((pwd = pw_next ()) != NULL) {
-			if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
-				user_id = pwd->pw_uid + 1;
-			}
-			/* create index of used UIDs */
-			if (pwd->pw_uid <= uid_max) {
-				used_uids[pwd->pw_uid] = true;
-			}
+		/* create index of used UIDs */
+		if (pwd->pw_uid >= uid_min
+			&& pwd->pw_uid <= uid_max) {
+
+			used_uids[pwd->pw_uid] = true;
 		}
 	}
 
-	/*
-	 * If a user (resp. system user) with UID equal to UID_MAX (resp.
-	 * UID_MIN) exists, the above algorithm will give us UID_MAX+1
-	 * (resp. UID_MIN-1) even if not unique. Search for the first free
-	 * UID starting with UID_MIN (resp. UID_MAX).
-	 */
 	if (sys_user) {
-		if (user_id < uid_min) {
-			for (user_id = uid_max; user_id >= uid_min; user_id--) {
-				if (false == used_uids[user_id]) {
-					break;
-				}
-			}
-			if (user_id < uid_min ) {
-				fprintf (stderr,
-				         _("%s: Can't get unique system UID (no more available UIDs)\n"),
-				         Prog);
-				SYSLOG ((LOG_WARN,
-				         "no more available UID on the system"));
+		/*
+		 * For system users, we want to start from the
+		 * top of the range and work downwards.
+		 */
+
+		/*
+		 * At the conclusion of the pw_next() search, we will either
+		 * have a presumed-free UID or we will be at UID_MIN - 1.
+		 */
+		if (lowest_found < uid_min) {
+			/*
+			 * In this case, an UID is in use at UID_MIN.
+			 *
+			 * We will reset the search to UID_MAX and proceed down
+			 * through all the UIDs (skipping those we detected with
+			 * used_uids) for a free one. It is a known issue that
+			 * this may result in reusing a previously-deleted UID,
+			 * so administrators should be instructed to use this
+			 * auto-detection with care (and prefer to assign UIDs
+			 * explicitly).
+			 */
+			lowest_found = uid_max;
+		}
+
+		/* Search through all of the IDs in the range */
+		for (id = lowest_found; id >= uid_min; id--) {
+			result = check_uid (id, uid_min, uid_max, used_uids);
+			if (result == 0) {
+				/* This UID is available. Return it. */
+				*uid = id;
 				free (used_uids);
-				return -1;
+				return 0;
+			} else if (result == EEXIST) {
+				/* This UID is in use, we'll continue to the next */
+			} else {
+				/*
+				 * An unexpected error occurred.
+				 *
+				 * Only report it the first time to avoid spamming
+				 * the logs
+				 *
+				 */
+				if (!nospam) {
+					fprintf (stderr,
+						_("%s: Can't get unique system UID (%s). "
+						  "Suppressing additional messages.\n"),
+						Prog, strerror (result));
+					SYSLOG ((LOG_ERR,
+						"Error checking available UIDs: %s",
+						strerror (result)));
+					nospam = 1;
+				}
+				/*
+				 * We will continue anyway. Hopefully a later UID
+				 * will work properly.
+				 */
 			}
 		}
-	} else {
-		if (user_id > uid_max) {
-			for (user_id = uid_min; user_id <= uid_max; user_id++) {
-				if (false == used_uids[user_id]) {
-					break;
+
+		/*
+		 * If we get all the way through the loop, try again from UID_MAX,
+		 * unless that was where we previously started. (NOTE: the worst-case
+		 * scenario here is that we will run through (UID_MAX - UID_MIN - 1)
+		 * cycles *again* if we fall into this case with lowest_found as
+		 * UID_MAX - 1, all users in the range in use and maintained by
+		 * network services such as LDAP.)
+		 */
+		if (lowest_found != uid_max) {
+			for (id = uid_max; id >= uid_min; id--) {
+				result = check_uid (id, uid_min, uid_max, used_uids);
+				if (result == 0) {
+					/* This UID is available. Return it. */
+					*uid = id;
+					free (used_uids);
+					return 0;
+				} else if (result == EEXIST) {
+					/* This UID is in use, we'll continue to the next */
+				} else {
+					/*
+					 * An unexpected error occurred.
+					 *
+					 * Only report it the first time to avoid spamming
+					 * the logs
+					 *
+					 */
+					if (!nospam) {
+						fprintf (stderr,
+							_("%s: Can't get unique system UID (%s). "
+							  "Suppressing additional messages.\n"),
+							Prog, strerror (result));
+						SYSLOG((LOG_ERR,
+							"Error checking available UIDs: %s",
+							strerror (result)));
+						nospam = 1;
+					}
+					/*
+					 * We will continue anyway. Hopefully a later UID
+					 * will work properly.
+					 */
 				}
 			}
-			if (user_id > uid_max) {
-				fprintf (stderr,
-				         _("%s: Can't get unique UID (no more available UIDs)\n"),
-				         Prog);
-				SYSLOG ((LOG_WARN, "no more available UID on the system"));
+		}
+	} else { /* !sys_user */
+		/*
+		 * For non-system users, we want to start from the
+		 * bottom of the range and work upwards.
+		 */
+
+		/*
+		 * At the conclusion of the pw_next() search, we will either
+		 * have a presumed-free UID or we will be at UID_MAX + 1.
+		 */
+		if (highest_found > uid_max) {
+			/*
+			 * In this case, a UID is in use at UID_MAX.
+			 *
+			 * We will reset the search to UID_MIN and proceed up
+			 * through all the UIDs (skipping those we detected with
+			 * used_uids) for a free one. It is a known issue that
+			 * this may result in reusing a previously-deleted UID,
+			 * so administrators should be instructed to use this
+			 * auto-detection with care (and prefer to assign UIDs
+			 * explicitly).
+			 */
+			highest_found = uid_min;
+		}
+
+		/* Search through all of the IDs in the range */
+		for (id = highest_found; id <= uid_max; id++) {
+			result = check_uid (id, uid_min, uid_max, used_uids);
+			if (result == 0) {
+				/* This UID is available. Return it. */
+				*uid = id;
 				free (used_uids);
-				return -1;
+				return 0;
+			} else if (result == EEXIST) {
+				/* This UID is in use, we'll continue to the next */
+			} else {
+				/*
+				 * An unexpected error occurred.
+				 *
+				 * Only report it the first time to avoid spamming
+				 * the logs
+				 *
+				 */
+				if (!nospam) {
+					fprintf (stderr,
+						_("%s: Can't get unique UID (%s). "
+						  "Suppressing additional messages.\n"),
+						Prog, strerror (result));
+					SYSLOG ((LOG_ERR,
+						"Error checking available UIDs: %s",
+						strerror (result)));
+					nospam = 1;
+				}
+				/*
+				 * We will continue anyway. Hopefully a later UID
+				 * will work properly.
+				 */
+			}
+		}
+
+		/*
+		 * If we get all the way through the loop, try again from UID_MIN,
+		 * unless that was where we previously started. (NOTE: the worst-case
+		 * scenario here is that we will run through (UID_MAX - UID_MIN - 1)
+		 * cycles *again* if we fall into this case with highest_found as
+		 * UID_MIN + 1, all users in the range in use and maintained by
+		 * network services such as LDAP.)
+		 */
+		if (highest_found != uid_min) {
+			for (id = uid_min; id <= uid_max; id++) {
+				result = check_uid (id, uid_min, uid_max, used_uids);
+				if (result == 0) {
+					/* This UID is available. Return it. */
+					*uid = id;
+					free (used_uids);
+					return 0;
+				} else if (result == EEXIST) {
+					/* This UID is in use, we'll continue to the next */
+				} else {
+					/*
+					 * An unexpected error occurred.
+					 *
+					 * Only report it the first time to avoid spamming
+					 * the logs
+					 *
+					 */
+					if (!nospam) {
+						fprintf (stderr,
+							_("%s: Can't get unique UID (%s). "
+							  "Suppressing additional messages.\n"),
+							Prog, strerror (result));
+						SYSLOG ((LOG_ERR,
+							"Error checking available UIDs: %s",
+							strerror (result)));
+						nospam = 1;
+					}
+					/*
+					 * We will continue anyway. Hopefully a later UID
+					 * will work properly.
+					 */
+				}
 			}
 		}
 	}
 
+	/* The code reached here and found no available IDs in the range */
+	fprintf (stderr,
+		_("%s: Can't get unique UID (no more available UIDs)\n"),
+		Prog);
+	SYSLOG ((LOG_WARN, "no more available UIDs on the system"));
 	free (used_uids);
-	*uid = user_id;
-	return 0;
+	return -1;
 }
 

libmisc/gettime.c

@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2017, Chris Lamb
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the copyright holders or contributors may not be used to
+ *    endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <config.h>
+
+#ident "$Id$"
+
+#include <errno.h>
+#include <limits.h>
+#include <stdio.h>
+#include "defines.h"
+#include "prototypes.h"
+
+/*
+ * gettime() returns the time as the number of seconds since the Epoch
+ *
+ * Like time(), gettime() returns the time as the number of seconds since the
+ * Epoch, 1970-01-01 00:00:00 +0000 (UTC), except that if the SOURCE_DATE_EPOCH
+ * environment variable is exported it will use that instead.
+ */
+/*@observer@*/time_t gettime ()
+{
+	char *endptr;
+	char *source_date_epoch;
+	time_t fallback;
+	unsigned long long epoch;
+
+	fallback = time (NULL);
+	source_date_epoch = getenv ("SOURCE_DATE_EPOCH");
+
+	if (!source_date_epoch)
+		return fallback;
+
+	errno = 0;
+	epoch = strtoull (source_date_epoch, &endptr, 10);
+	if ((errno == ERANGE && (epoch == ULLONG_MAX || epoch == 0))
+			|| (errno != 0 && epoch == 0)) {
+		fprintf (stderr,
+			 _("Environment variable $SOURCE_DATE_EPOCH: strtoull: %s\n"),
+			 strerror(errno));
+	} else if (endptr == source_date_epoch) {
+		fprintf (stderr,
+			 _("Environment variable $SOURCE_DATE_EPOCH: No digits were found: %s\n"),
+			 endptr);
+	} else if (*endptr != '\0') {
+		fprintf (stderr,
+			 _("Environment variable $SOURCE_DATE_EPOCH: Trailing garbage: %s\n"),
+			 endptr);
+	} else if (epoch > ULONG_MAX) {
+		fprintf (stderr,
+			 _("Environment variable $SOURCE_DATE_EPOCH: value must be smaller than or equal to %lu but was found to be: %llu\n"),
+			 ULONG_MAX, epoch);
+	} else if (epoch > fallback) {
+		fprintf (stderr,
+			 _("Environment variable $SOURCE_DATE_EPOCH: value must be smaller than or equal to the current time (%lu) but was found to be: %llu\n"),
+			 fallback, epoch);
+	} else {
+		/* Valid */
+		return (time_t)epoch;
+	}
+
+	return fallback;
+}

libmisc/idmapping.c

@@ -70,13 +70,40 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)
 
 	/* Gather up the ranges from the command line */
 	mapping = mappings;
-	for (idx = 0; idx < ranges; idx++, argidx += 3, mapping++) {
-		if (!getulong(argv[argidx + 0], &mapping->upper))
+	for (idx = 0, argidx = 0; idx < ranges; idx++, argidx += 3, mapping++) {
+		if (!getulong(argv[argidx + 0], &mapping->upper)) {
+			free(mappings);
 			return NULL;
-		if (!getulong(argv[argidx + 1], &mapping->lower))
+		}
+		if (!getulong(argv[argidx + 1], &mapping->lower)) {
+			free(mappings);
 			return NULL;
-		if (!getulong(argv[argidx + 2], &mapping->count))
+		}
+		if (!getulong(argv[argidx + 2], &mapping->count)) {
+			free(mappings);
 			return NULL;
+		}
+		if (ULONG_MAX - mapping->upper <= mapping->count || ULONG_MAX - mapping->lower <= mapping->count) {
+			fprintf(stderr, _( "%s: subuid overflow detected.\n"), Prog);
+			exit(EXIT_FAILURE);
+		}
+		if (mapping->upper > UINT_MAX ||
+			mapping->lower > UINT_MAX ||
+			mapping->count > UINT_MAX)  {
+			fprintf(stderr, _( "%s: subuid overflow detected.\n"), Prog);
+			exit(EXIT_FAILURE);
+		}
+		if (mapping->lower + mapping->count > UINT_MAX ||
+				mapping->upper + mapping->count > UINT_MAX) {
+			fprintf(stderr, _( "%s: subuid overflow detected.\n"), Prog);
+			exit(EXIT_FAILURE);
+		}
+		if (mapping->lower + mapping->count < mapping->lower ||
+				mapping->upper + mapping->count < mapping->upper) {
+			/* this one really shouldn't be possible given previous checks */
+			fprintf(stderr, _( "%s: subuid overflow detected.\n"), Prog);
+			exit(EXIT_FAILURE);
+		}
 	}
 	return mappings;
 }

libmisc/user_busy.c

@@ -170,11 +170,17 @@ static int user_busy_processes (const char *name, uid_t uid)
 	proc = opendir ("/proc");
 	if (proc == NULL) {
 		perror ("opendir /proc");
+#ifdef ENABLE_SUBIDS
+		sub_uid_close();
+#endif
 		return 0;
 	}
 	if (stat ("/", &sbroot) != 0) {
 		perror ("stat (\"/\")");
 		(void) closedir (proc);
+#ifdef ENABLE_SUBIDS
+		sub_uid_close();
+#endif
 		return 0;
 	}
 
@@ -212,6 +218,9 @@ static int user_busy_processes (const char *name, uid_t uid)
 
 		if (check_status (name, tmp_d_name, uid) != 0) {
 			(void) closedir (proc);
+#ifdef ENABLE_SUBIDS
+			sub_uid_close();
+#endif
 			fprintf (stderr,
 			         _("%s: user %s is currently used by process %d\n"),
 			         Prog, name, pid);
@@ -232,6 +241,9 @@ static int user_busy_processes (const char *name, uid_t uid)
 				}
 				if (check_status (name, task_path+6, uid) != 0) {
 					(void) closedir (proc);
+#ifdef ENABLE_SUBIDS
+					sub_uid_close();
+#endif
 					fprintf (stderr,
 					         _("%s: user %s is currently used by process %d\n"),
 					         Prog, name, pid);

man/Makefile.am

@@ -215,5 +215,4 @@ $(man_MANS):
 	@echo "Error: you need to run configure with '--enable-man'"
 	@echo "       in order to regenerate man pages."
 	@echo ""
-	@false
 endif

man/chgpasswd.8.xml

@@ -92,7 +92,7 @@
     <para>
       The default encryption algorithm can be defined for the system with
       the <option>ENCRYPT_METHOD</option> variable of <filename>/etc/login.defs</filename>,
-      and can be overwiten with the <option>-e</option>,
+      and can be overwritten with the <option>-e</option>,
       <option>-m</option>, or <option>-c</option> options.
     </para>
     <para>

man/chpasswd.8.xml

@@ -98,7 +98,7 @@
       The default encryption algorithm can be defined for the system with
       the <option>ENCRYPT_METHOD</option> or
       <option>MD5_CRYPT_ENAB</option> variables of
-      <filename>/etc/login.defs</filename>, and can be overwitten with the
+      <filename>/etc/login.defs</filename>, and can be overwritten with the
       <option>-e</option>, <option>-m</option>, or <option>-c</option>
       options.
     </para>
@@ -112,7 +112,7 @@
       <phrase condition="pam">Except when PAM is used to encrypt the
       passwords,</phrase> <command>chpasswd</command> first updates all the
       passwords in memory, and then commits all the changes to disk if no
-      errors occured for any user.
+      errors occurred for any user.
     </para>
     <para condition="pam">
       When PAM is used to encrypt the passwords (and update the passwords in

man/generate_mans.mak

@@ -42,12 +42,11 @@ man1/% man3/% man5/% man8/%: %.xml-config Makefile config.xml
 	            -nonet http://docbook.sourceforge.net/release/xsl/current/manpages/profile-docbook.xsl $<
 
 clean-local:
-	for d in man1 man3 man5 man8; do [ -d $$d ] && rmdir $$d; done
+	rm -rf man1 man3 man5 man8
 
 else
 $(man_MANS):
 	@echo you need to run configure with --enable-man to generate man pages
-	@false
 endif
 
 man8/grpconv.8 man8/grpunconv.8 man8/pwunconv.8: man8/pwconv.8

man/generate_translations.mak

@@ -14,7 +14,6 @@ include ../generate_mans.mak
 else
 $(man_MANS):
 	@echo you need to run configure with --enable-man to generate man pages
-	@false
 endif
 
 CLEANFILES = .xml2po.mo $(EXTRA_DIST) $(addsuffix .xml,$(EXTRA_DIST)) config.xml

man/groupmems.8.xml

@@ -106,7 +106,7 @@
       <varlistentry>
 	<term><option>-a</option>, <option>--add</option>&nbsp;<replaceable>user_name</replaceable></term>
 	<listitem>
-	  <para>Add an user to the group membership list.</para>
+	  <para>Add a user to the group membership list.</para>
 	  <para condition="gshadow">
 	    If the <filename>/etc/gshadow</filename> file exist, and the
 	    group has no entry in the <filename>/etc/gshadow</filename>

man/gshadow.5.xml

@@ -95,7 +95,7 @@
 	    group (but group members do not need the password).
 	  </para>
 	  <para>
-	    The password is used when an user who is not a member of the
+	    The password is used when a user who is not a member of the
 	    group wants to gain the permissions of this group (see
 	    <citerefentry><refentrytitle>newgrp</refentrytitle>
 	    <manvolnum>1</manvolnum></citerefentry>).
@@ -105,7 +105,7 @@
 	    can gain the group permissions.
 	  </para>
 	  <para>
-	    A password field which starts with a exclamation mark means
+	    A password field which starts with an exclamation mark means
 	    that the password is locked.  The remaining characters on the
 	    line represent the password field before the password was
 	    locked.

man/lastlog.8.xml

@@ -103,6 +103,17 @@
 	  </para>
 	</listitem>
       </varlistentry>
+      <varlistentry>
+	<term>
+	  <option>-C</option>, <option>--clear</option>
+	</term>
+	<listitem>
+	  <para>
+	    Clear lastlog record of a user. This option can be used only together
+	    with <option>-u</option> (<option>--user</option>)).
+	  </para>
+	</listitem>
+      </varlistentry>
       <varlistentry>
 	<term>
 	  <option>-h</option>, <option>--help</option>
@@ -123,6 +134,17 @@
 	  </para>
 	</listitem>
       </varlistentry>
+      <varlistentry>
+	<term>
+	  <option>-S</option>, <option>--set</option>
+	</term>
+	<listitem>
+	  <para>
+	    Set lastlog record of a user to the current time. This option can be
+	    used only together with <option>-u</option> (<option>--user</option>)).
+	  </para>
+	</listitem>
+      </varlistentry>
       <varlistentry>
 	<term>
 	  <option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAYS</replaceable>

man/limits.5.xml

@@ -108,7 +108,7 @@
       <listitem><para>A: max address space (KB)</para></listitem>
       <listitem><para>C: max core file size (KB)</para></listitem>
       <listitem><para>D: max data size (KB)</para></listitem>
-      <listitem><para>F: maximum filesize (KB)</para></listitem>
+      <listitem><para>F: maximum file size (KB)</para></listitem>
       <listitem><para>K: file creation mask, set by
 	<citerefentry>
 	  <refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum>
@@ -145,7 +145,7 @@
     <para>
       Be aware that after <emphasis remap='I'>username</emphasis> the rest
       of the line is considered a limit string, thus comments are not
-      allowed. A invalid limits string will be rejected (not considered) by
+      allowed. An invalid limits string will be rejected (not considered) by
       the <command>login</command> program.
     </para>
 
@@ -163,12 +163,12 @@
     </para>
 
     <para>
-      If more than one line with limits for an user exist, only the first line for
+      If more than one line with limits for a user exist, only the first line for
       this user will be considered.
     </para>
 
     <para>
-      If no lines are specified for an user, the last
+      If no lines are specified for a user, the last
       <replaceable>@group</replaceable> line matching a group whose the
       user is a member of will be considered, or the last line with
       default limits if no groups contain the user.

man/newgidmap.1.xml

@@ -61,9 +61,6 @@
 	<replaceable>count</replaceable>
       </arg>
       <arg choice='opt'>
-	<arg choice='plain'>
-	  <replaceable>pid</replaceable>
-	</arg>
 	<arg choice='plain'>
 	  <replaceable>gid</replaceable>
 	</arg>
@@ -83,8 +80,10 @@
   <refsect1 id='description'>
     <title>DESCRIPTION</title>
     <para>
-      The <command>newgidmap</command> sets <filename>/proc/[pid]/gid_map</filename> based on it's
+      The <command>newgidmap</command> sets <filename>/proc/[pid]/gid_map</filename> based on its
       command line arguments and the gids allowed in <filename>/etc/subgid</filename>.
+      Note that the root user is not exempted from the requirement for a valid
+      <filename>/etc/subgid</filename> entry.
     </para>
 
     <para>
@@ -94,7 +93,7 @@
 	  <term>gid</term>
 	  <listitem>
 	    <para>
-	      Begining of the range of GIDs inside the user namespace.
+	      Beginning of the range of GIDs inside the user namespace.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -102,7 +101,7 @@
 	  <term>lowergid</term>
 	  <listitem>
 	    <para>
-	      Begining of the range of GIDs outside the user namespace.
+	      Beginning of the range of GIDs outside the user namespace.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -146,7 +145,7 @@
       <varlistentry>
 	<term><filename>/etc/subgid</filename></term>
 	<listitem>
-	  <para>List of users subordinate group IDs.</para>
+	  <para>List of user's subordinate group IDs.</para>
 	</listitem>
       </varlistentry>
       <varlistentry>

man/newuidmap.1.xml

@@ -80,8 +80,10 @@
   <refsect1 id='description'>
     <title>DESCRIPTION</title>
     <para>
-      The <command>newuidmap</command> sets <filename>/proc/[pid]/uid_map</filename> based on it's
+      The <command>newuidmap</command> sets <filename>/proc/[pid]/uid_map</filename> based on its
       command line arguments and the uids allowed in <filename>/etc/subuid</filename>.
+      Note that the root user is not exempted from the requirement for a valid
+      <filename>/etc/subuid</filename> entry.
     </para>
 
     <para>
@@ -91,7 +93,7 @@
 	  <term>uid</term>
 	  <listitem>
 	    <para>
-	      Begining of the range of UIDs inside the user namespace.
+	      Beginning of the range of UIDs inside the user namespace.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -99,7 +101,7 @@
 	  <term>loweruid</term>
 	  <listitem>
 	    <para>
-	      Begining of the range of UIDs outside the user namespace.
+	      Beginning of the range of UIDs outside the user namespace.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -142,7 +144,7 @@
       <varlistentry>
 	<term><filename>/etc/subuid</filename></term>
 	<listitem>
-	  <para>List of users subordinate user IDs.</para>
+	  <para>List of user's subordinate user IDs.</para>
 	</listitem>
       </varlistentry>
       <varlistentry>

man/newusers.8.xml

@@ -115,7 +115,7 @@
 	  </para>
 	  <para>
 	    It can be the name of a new user or the name of an existing
-	    user (or an user created before by
+	    user (or a user created before by
 	    <command>newusers</command>).  In case of an existing user,
 	    the user's information will be changed, otherwise a new user
 	    will be created.
@@ -142,7 +142,7 @@
 	    This field is used to define the UID of the user.
 	  </para>
 	  <para>
-	    If the field is empty, an new (unused) UID will be defined
+	    If the field is empty, a new (unused) UID will be defined
 	    automatically by <command>newusers</command>.
 	  </para>
 	  <para>
@@ -151,7 +151,7 @@
 	  </para>
 	  <para>
 	    If this field contains the name of an existing user (or the
-	    name of an user created before by
+	    name of a user created before by
 	    <command>newusers</command>), the UID of the specified user
 	    will be used.
 	  </para>

man/nologin.8.xml

@@ -89,7 +89,7 @@
   <refsect1 id='history'>
     <title>HISTORY</title>
     <para>
-      The <command>nologin</command> command appearred in BSD 4.4.
+      The <command>nologin</command> command appeared in BSD 4.4.
     </para>
   </refsect1>
 </refentry>

man/passwd.1.xml

@@ -164,7 +164,7 @@
       </para>
 
       <para>
-	You can find advices on how to choose a strong password on
+	You can find advice on how to choose a strong password on
 	http://en.wikipedia.org/wiki/Password_strength
       </para>
     </refsect2>

man/po/da.po

@@ -20,7 +20,7 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: shadow-man\n"
-"POT-Creation-Date: 2013-08-23 01:54+0200\n"
+"POT-Creation-Date: 2016-09-18 14:03-0500\n"
 "PO-Revision-Date: 2013-08-23 01:35+0200\n"
 "Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
 "Language-Team: Danish <debian-l10n-danish@lists.debian.org>\n"
@@ -68,16 +68,15 @@ msgstr ""
 #: useradd.8.xml:62(surname) suauth.5.xml:45(surname) su.1.xml:62(surname)
 #: sg.1.xml:46(surname) shadow.5.xml:45(surname) shadow.3.xml:45(surname)
 #: pwconv.8.xml:51(surname) pwck.8.xml:51(surname) porttime.5.xml:45(surname)
-#: passwd.5.xml:45(surname) passwd.1.xml:52(surname)
-#: newusers.8.xml:60(surname) newgrp.1.xml:46(surname)
-#: logoutd.8.xml:45(surname) login.defs.5.xml:110(surname)
-#: login.access.5.xml:46(surname) login.1.xml:78(surname)
-#: limits.5.xml:47(surname) lastlog.8.xml:46(surname) grpck.8.xml:46(surname)
-#: groups.1.xml:45(surname) groupmod.8.xml:46(surname)
+#: passwd.5.xml:45(surname) passwd.1.xml:52(surname) newusers.8.xml:60(surname)
+#: newgrp.1.xml:46(surname) logoutd.8.xml:45(surname)
+#: login.defs.5.xml:110(surname) login.access.5.xml:46(surname)
+#: login.1.xml:78(surname) limits.5.xml:47(surname) lastlog.8.xml:46(surname)
+#: grpck.8.xml:46(surname) groups.1.xml:45(surname) groupmod.8.xml:46(surname)
 #: groupmems.8.xml:49(surname) groupdel.8.xml:46(surname)
 #: groupadd.8.xml:48(surname) gpasswd.1.xml:50(surname)
-#: faillog.8.xml:45(surname) faillog.5.xml:45(surname)
-#: expiry.1.xml:49(surname) chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
+#: faillog.8.xml:45(surname) faillog.5.xml:45(surname) expiry.1.xml:49(surname)
+#: chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
 #: chgpasswd.8.xml:45(surname) chfn.1.xml:48(surname) chage.1.xml:46(surname)
 msgid "Kłoczko"
 msgstr ""
@@ -102,17 +101,16 @@ msgstr ""
 #: useradd.8.xml:64(contrib) suauth.5.xml:47(contrib) su.1.xml:64(contrib)
 #: sg.1.xml:48(contrib) shadow.5.xml:47(contrib) shadow.3.xml:47(contrib)
 #: pwconv.8.xml:53(contrib) pwck.8.xml:53(contrib) porttime.5.xml:47(contrib)
-#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib)
-#: newusers.8.xml:62(contrib) newgrp.1.xml:48(contrib)
-#: logoutd.8.xml:47(contrib) login.defs.5.xml:112(contrib)
-#: login.access.5.xml:48(contrib) login.1.xml:80(contrib)
-#: limits.5.xml:49(contrib) lastlog.8.xml:48(contrib) grpck.8.xml:48(contrib)
-#: groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
+#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib) newusers.8.xml:62(contrib)
+#: newgrp.1.xml:48(contrib) logoutd.8.xml:47(contrib)
+#: login.defs.5.xml:112(contrib) login.access.5.xml:48(contrib)
+#: login.1.xml:80(contrib) limits.5.xml:49(contrib) lastlog.8.xml:48(contrib)
+#: grpck.8.xml:48(contrib) groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
 #: groupmems.8.xml:51(contrib) groupdel.8.xml:48(contrib)
 #: groupadd.8.xml:50(contrib) gpasswd.1.xml:52(contrib)
-#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib)
-#: expiry.1.xml:51(contrib) chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib)
-#: chfn.1.xml:50(contrib) chage.1.xml:48(contrib)
+#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib) expiry.1.xml:51(contrib)
+#: chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib) chfn.1.xml:50(contrib)
+#: chage.1.xml:48(contrib)
 msgid "shadow-utils maintainer, 2000 - 2007"
 msgstr ""
 
@@ -146,14 +144,13 @@ msgstr ""
 #: newusers.8.xml:66(surname) newgrp.1.xml:52(surname)
 #: logoutd.8.xml:51(surname) login.defs.5.xml:116(surname)
 #: login.access.5.xml:52(surname) login.1.xml:84(surname)
-#: limits.5.xml:53(surname) lastlog.8.xml:52(surname)
-#: gshadow.5.xml:39(surname) grpck.8.xml:52(surname) groups.1.xml:51(surname)
-#: groupmod.8.xml:52(surname) groupmems.8.xml:55(surname)
-#: groupdel.8.xml:52(surname) groupadd.8.xml:54(surname)
-#: gpasswd.1.xml:56(surname) faillog.8.xml:51(surname)
-#: faillog.5.xml:51(surname) expiry.1.xml:55(surname) chsh.1.xml:54(surname)
-#: chpasswd.8.xml:55(surname) chgpasswd.8.xml:51(surname)
-#: chfn.1.xml:54(surname) chage.1.xml:52(surname)
+#: limits.5.xml:53(surname) lastlog.8.xml:52(surname) gshadow.5.xml:39(surname)
+#: grpck.8.xml:52(surname) groups.1.xml:51(surname) groupmod.8.xml:52(surname)
+#: groupmems.8.xml:55(surname) groupdel.8.xml:52(surname)
+#: groupadd.8.xml:54(surname) gpasswd.1.xml:56(surname)
+#: faillog.8.xml:51(surname) faillog.5.xml:51(surname) expiry.1.xml:55(surname)
+#: chsh.1.xml:54(surname) chpasswd.8.xml:55(surname)
+#: chgpasswd.8.xml:51(surname) chfn.1.xml:54(surname) chage.1.xml:52(surname)
 msgid "François"
 msgstr ""
 
@@ -182,14 +179,13 @@ msgstr ""
 #: newusers.8.xml:68(contrib) newgrp.1.xml:54(contrib)
 #: logoutd.8.xml:53(contrib) login.defs.5.xml:118(contrib)
 #: login.access.5.xml:54(contrib) login.1.xml:86(contrib)
-#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib)
-#: gshadow.5.xml:42(contrib) grpck.8.xml:54(contrib) groups.1.xml:53(contrib)
-#: groupmod.8.xml:54(contrib) groupmems.8.xml:57(contrib)
-#: groupdel.8.xml:54(contrib) groupadd.8.xml:56(contrib)
-#: gpasswd.1.xml:58(contrib) faillog.8.xml:53(contrib)
-#: faillog.5.xml:53(contrib) expiry.1.xml:57(contrib) chsh.1.xml:56(contrib)
-#: chpasswd.8.xml:57(contrib) chgpasswd.8.xml:53(contrib)
-#: chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
+#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib) gshadow.5.xml:42(contrib)
+#: grpck.8.xml:54(contrib) groups.1.xml:53(contrib) groupmod.8.xml:54(contrib)
+#: groupmems.8.xml:57(contrib) groupdel.8.xml:54(contrib)
+#: groupadd.8.xml:56(contrib) gpasswd.1.xml:58(contrib)
+#: faillog.8.xml:53(contrib) faillog.5.xml:53(contrib) expiry.1.xml:57(contrib)
+#: chsh.1.xml:56(contrib) chpasswd.8.xml:57(contrib)
+#: chgpasswd.8.xml:53(contrib) chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
 msgid "shadow-utils maintainer, 2007 - now"
 msgstr ""
 
@@ -261,14 +257,13 @@ msgstr ""
 #: useradd.8.xml:88(replaceable) useradd.8.xml:100(replaceable)
 #: su.1.xml:88(replaceable) pwconv.8.xml:81(replaceable)
 #: pwconv.8.xml:87(replaceable) pwconv.8.xml:93(replaceable)
-#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg)
-#: passwd.1.xml:79(replaceable) newusers.8.xml:87(replaceable)
-#: lastlog.8.xml:73(replaceable) grpck.8.xml:72(arg)
-#: groupmod.8.xml:73(replaceable) groupdel.8.xml:73(replaceable)
-#: groupadd.8.xml:75(replaceable) faillog.8.xml:72(replaceable)
-#: chsh.1.xml:75(replaceable) chpasswd.8.xml:76(replaceable)
-#: chgpasswd.8.xml:72(replaceable) chfn.1.xml:75(replaceable)
-#: chage.1.xml:72(replaceable)
+#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg) passwd.1.xml:79(replaceable)
+#: newusers.8.xml:87(replaceable) lastlog.8.xml:73(replaceable)
+#: grpck.8.xml:72(arg) groupmod.8.xml:73(replaceable)
+#: groupdel.8.xml:73(replaceable) groupadd.8.xml:75(replaceable)
+#: faillog.8.xml:72(replaceable) chsh.1.xml:75(replaceable)
+#: chpasswd.8.xml:76(replaceable) chgpasswd.8.xml:72(replaceable)
+#: chfn.1.xml:75(replaceable) chage.1.xml:72(replaceable)
 msgid "options"
 msgstr "tilvalg"
 
@@ -317,11 +312,10 @@ msgstr ""
 #: useradd.8.xml:124(title) su.1.xml:145(title) pwconv.8.xml:187(title)
 #: pwck.8.xml:176(title) passwd.1.xml:174(title) newusers.8.xml:265(title)
 #: login.1.xml:210(title) lastlog.8.xml:91(title) grpck.8.xml:147(title)
-#: groupmod.8.xml:89(title) groupmems.8.xml:100(title)
-#: groupdel.8.xml:88(title) groupadd.8.xml:93(title) gpasswd.1.xml:134(title)
-#: faillog.8.xml:89(title) expiry.1.xml:91(title) chsh.1.xml:95(title)
-#: chpasswd.8.xml:130(title) chgpasswd.8.xml:105(title) chfn.1.xml:111(title)
-#: chage.1.xml:91(title)
+#: groupmod.8.xml:89(title) groupmems.8.xml:100(title) groupdel.8.xml:88(title)
+#: groupadd.8.xml:93(title) gpasswd.1.xml:134(title) faillog.8.xml:89(title)
+#: expiry.1.xml:91(title) chsh.1.xml:95(title) chpasswd.8.xml:130(title)
+#: chgpasswd.8.xml:105(title) chfn.1.xml:111(title) chage.1.xml:91(title)
 msgid "OPTIONS"
 msgstr "TILVALG"
 
@@ -343,7 +337,7 @@ msgstr "Rediger gruppedatabase."
 
 #: vipw.8.xml:120(term) userdel.8.xml:123(term) useradd.8.xml:266(term)
 #: pwconv.8.xml:195(term) pwck.8.xml:186(term) passwd.1.xml:214(term)
-#: newusers.8.xml:283(term) lastlog.8.xml:107(term) grpck.8.xml:157(term)
+#: newusers.8.xml:283(term) lastlog.8.xml:118(term) grpck.8.xml:157(term)
 #: groupmod.8.xml:129(term) groupmems.8.xml:142(term) groupdel.8.xml:95(term)
 #: groupadd.8.xml:131(term) gpasswd.1.xml:173(term) faillog.8.xml:122(term)
 #: expiry.1.xml:112(term) chsh.1.xml:101(term) chpasswd.8.xml:171(term)
@@ -353,7 +347,7 @@ msgstr "<option>-h</option>, <option>--help</option>"
 
 #: vipw.8.xml:122(para) userdel.8.xml:125(para) useradd.8.xml:268(para)
 #: pwconv.8.xml:197(para) pwck.8.xml:188(para) passwd.1.xml:216(para)
-#: newusers.8.xml:285(para) lastlog.8.xml:111(para) grpck.8.xml:159(para)
+#: newusers.8.xml:285(para) lastlog.8.xml:122(para) grpck.8.xml:159(para)
 #: groupmod.8.xml:131(para) groupmems.8.xml:144(para) groupdel.8.xml:97(para)
 #: groupadd.8.xml:133(para) gpasswd.1.xml:175(para) faillog.8.xml:124(para)
 #: expiry.1.xml:114(para) chsh.1.xml:103(para) chpasswd.8.xml:173(para)
@@ -379,7 +373,7 @@ msgstr "Stille tilstand."
 
 #: vipw.8.xml:138(term) usermod.8.xml:311(term) userdel.8.xml:146(term)
 #: useradd.8.xml:445(term) pwconv.8.xml:201(term) pwck.8.xml:209(term)
-#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:115(term)
+#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:126(term)
 #: grpck.8.xml:173(term) groupmod.8.xml:178(term) groupmems.8.xml:165(term)
 #: groupdel.8.xml:101(term) groupadd.8.xml:204(term) faillog.8.xml:180(term)
 #: chsh.1.xml:107(term) chpasswd.8.xml:188(term) chgpasswd.8.xml:146(term)
@@ -393,7 +387,7 @@ msgstr ""
 
 #: vipw.8.xml:142(para) usermod.8.xml:315(para) userdel.8.xml:150(para)
 #: useradd.8.xml:449(para) pwconv.8.xml:205(para) pwck.8.xml:213(para)
-#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:119(para)
+#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:130(para)
 #: grpck.8.xml:177(para) groupmod.8.xml:182(para) groupmems.8.xml:169(para)
 #: groupdel.8.xml:105(para) groupadd.8.xml:208(para) gpasswd.1.xml:185(para)
 #: faillog.8.xml:184(para) chsh.1.xml:111(para) chpasswd.8.xml:192(para)
@@ -422,18 +416,18 @@ msgstr "<option>-u</option>, <option>--user</option>"
 msgid "Indicates which user's tcb shadow file to edit."
 msgstr "Indikerer hvilken brugers tcb-shadowfil at redigere."
 
-#: vipw.8.xml:165(title) usermod.8.xml:497(title) userdel.8.xml:171(title)
+#: vipw.8.xml:165(title) usermod.8.xml:496(title) userdel.8.xml:171(title)
 #: useradd.8.xml:647(title) su.1.xml:339(title) sg.1.xml:98(title)
 #: pwconv.8.xml:227(title) pwck.8.xml:252(title) passwd.1.xml:390(title)
 #: newusers.8.xml:362(title) newgrp.1.xml:109(title) login.1.xml:294(title)
 #: grpck.8.xml:209(title) groupmod.8.xml:193(title) groupmems.8.xml:199(title)
-#: groupdel.8.xml:128(title) groupadd.8.xml:219(title)
-#: gpasswd.1.xml:264(title) chsh.1.xml:154(title) chpasswd.8.xml:239(title)
-#: chgpasswd.8.xml:198(title) chfn.1.xml:193(title) chage.1.xml:244(title)
+#: groupdel.8.xml:128(title) groupadd.8.xml:219(title) gpasswd.1.xml:264(title)
+#: chsh.1.xml:154(title) chpasswd.8.xml:239(title) chgpasswd.8.xml:198(title)
+#: chfn.1.xml:193(title) chage.1.xml:244(title)
 msgid "CONFIGURATION"
 msgstr "KONFIGURATION"
 
-#: vipw.8.xml:166(para) usermod.8.xml:498(para) userdel.8.xml:172(para)
+#: vipw.8.xml:166(para) usermod.8.xml:497(para) userdel.8.xml:172(para)
 #: useradd.8.xml:648(para) su.1.xml:340(para) sg.1.xml:99(para)
 #: pwck.8.xml:253(para) passwd.1.xml:391(para) newusers.8.xml:363(para)
 #: newgrp.1.xml:110(para) login.1.xml:295(para) grpck.8.xml:210(para)
@@ -488,37 +482,35 @@ msgstr ""
 "Redigeringsprogram der skal bruges hvis <option>VISUAL</option> ikke er "
 "angivet."
 
-#: vipw.8.xml:195(title) usermod.8.xml:514(title) userdel.8.xml:188(title)
+#: vipw.8.xml:195(title) usermod.8.xml:513(title) userdel.8.xml:188(title)
 #: useradd.8.xml:675(title) suauth.5.xml:193(title) su.1.xml:367(title)
 #: sg.1.xml:110(title) shadow.5.xml:255(title) shadow.3.xml:226(title)
 #: pwconv.8.xml:250(title) pwck.8.xml:269(title) porttime.5.xml:130(title)
 #: passwd.5.xml:141(title) passwd.1.xml:408(title) newusers.8.xml:397(title)
 #: newgrp.1.xml:121(title) logoutd.8.xml:89(title)
-#: login.access.5.xml:121(title) login.1.xml:338(title)
-#: limits.5.xml:196(title) lastlog.8.xml:182(title) gshadow.5.xml:156(title)
-#: grpck.8.xml:221(title) groups.1.xml:100(title) groupmod.8.xml:205(title)
-#: groupmems.8.xml:211(title) groupdel.8.xml:140(title)
-#: groupadd.8.xml:233(title) gpasswd.1.xml:279(title) faillog.8.xml:243(title)
-#: faillog.5.xml:96(title) expiry.1.xml:121(title) chsh.1.xml:167(title)
-#: chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title) chfn.1.xml:207(title)
-#: chage.1.xml:256(title)
+#: login.access.5.xml:121(title) login.1.xml:338(title) limits.5.xml:196(title)
+#: lastlog.8.xml:204(title) gshadow.5.xml:156(title) grpck.8.xml:221(title)
+#: groups.1.xml:100(title) groupmod.8.xml:205(title) groupmems.8.xml:211(title)
+#: groupdel.8.xml:140(title) groupadd.8.xml:233(title) gpasswd.1.xml:279(title)
+#: faillog.8.xml:243(title) faillog.5.xml:96(title) expiry.1.xml:121(title)
+#: chsh.1.xml:167(title) chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title)
+#: chfn.1.xml:207(title) chage.1.xml:256(title)
 msgid "FILES"
 msgstr "FILER"
 
-#: vipw.8.xml:198(filename) usermod.8.xml:517(filename)
+#: vipw.8.xml:198(filename) usermod.8.xml:516(filename)
 #: userdel.8.xml:191(filename) useradd.8.xml:690(filename)
-#: sg.1.xml:125(filename) pwck.8.xml:272(filename)
-#: newusers.8.xml:412(filename) newgrp.1.xml:136(filename)
-#: gshadow.5.xml:159(filename) grpck.8.xml:224(filename)
-#: groups.1.xml:103(filename) groupmod.8.xml:208(filename)
-#: groupmems.8.xml:214(filename) groupdel.8.xml:143(filename)
-#: groupadd.8.xml:236(filename) gpasswd.1.xml:72(filename)
-#: gpasswd.1.xml:75(filename) gpasswd.1.xml:282(filename)
-#: chgpasswd.8.xml:216(filename)
+#: sg.1.xml:125(filename) pwck.8.xml:272(filename) newusers.8.xml:412(filename)
+#: newgrp.1.xml:136(filename) gshadow.5.xml:159(filename)
+#: grpck.8.xml:224(filename) groups.1.xml:103(filename)
+#: groupmod.8.xml:208(filename) groupmems.8.xml:214(filename)
+#: groupdel.8.xml:143(filename) groupadd.8.xml:236(filename)
+#: gpasswd.1.xml:72(filename) gpasswd.1.xml:75(filename)
+#: gpasswd.1.xml:282(filename) chgpasswd.8.xml:216(filename)
 msgid "/etc/group"
 msgstr "/etc/group"
 
-#: vipw.8.xml:200(para) usermod.8.xml:519(para) userdel.8.xml:193(para)
+#: vipw.8.xml:200(para) usermod.8.xml:518(para) userdel.8.xml:193(para)
 #: useradd.8.xml:692(para) sg.1.xml:127(para) pwck.8.xml:274(para)
 #: newusers.8.xml:414(para) newgrp.1.xml:138(para) gshadow.5.xml:161(para)
 #: grpck.8.xml:226(para) groups.1.xml:105(para) groupmod.8.xml:210(para)
@@ -527,7 +519,7 @@ msgstr "/etc/group"
 msgid "Group account information."
 msgstr "Information om gruppekonto."
 
-#: vipw.8.xml:204(filename) usermod.8.xml:523(filename)
+#: vipw.8.xml:204(filename) usermod.8.xml:522(filename)
 #: useradd.8.xml:696(filename) sg.1.xml:131(filename)
 #: newusers.8.xml:418(filename) newgrp.1.xml:142(filename)
 #: gshadow.5.xml:165(filename) grpck.8.xml:230(filename)
@@ -538,7 +530,7 @@ msgstr "Information om gruppekonto."
 msgid "/etc/gshadow"
 msgstr "/etc/gshadow"
 
-#: vipw.8.xml:206(para) usermod.8.xml:525(para) useradd.8.xml:698(para)
+#: vipw.8.xml:206(para) usermod.8.xml:524(para) useradd.8.xml:698(para)
 #: sg.1.xml:133(para) newusers.8.xml:420(para) newgrp.1.xml:144(para)
 #: gshadow.5.xml:167(para) grpck.8.xml:232(para) groupmod.8.xml:216(para)
 #: groupdel.8.xml:151(para) groupadd.8.xml:244(para) gpasswd.1.xml:290(para)
@@ -546,7 +538,7 @@ msgstr "/etc/gshadow"
 msgid "Secure group account information."
 msgstr "Information om sikret gruppekonto."
 
-#: vipw.8.xml:210(filename) usermod.8.xml:535(filename)
+#: vipw.8.xml:210(filename) usermod.8.xml:534(filename)
 #: userdel.8.xml:203(filename) useradd.8.xml:678(filename)
 #: su.1.xml:370(filename) sg.1.xml:113(filename) shadow.5.xml:258(filename)
 #: pwck.8.xml:278(filename) passwd.5.xml:144(filename)
@@ -559,7 +551,7 @@ msgstr "Information om sikret gruppekonto."
 msgid "/etc/passwd"
 msgstr "/etc/passwd"
 
-#: vipw.8.xml:212(para) usermod.8.xml:537(para) userdel.8.xml:205(para)
+#: vipw.8.xml:212(para) usermod.8.xml:536(para) userdel.8.xml:205(para)
 #: useradd.8.xml:680(para) su.1.xml:372(para) sg.1.xml:115(para)
 #: shadow.5.xml:260(para) pwck.8.xml:280(para) passwd.5.xml:146(para)
 #: passwd.1.xml:413(para) newusers.8.xml:402(para) newgrp.1.xml:126(para)
@@ -569,7 +561,7 @@ msgstr "/etc/passwd"
 msgid "User account information."
 msgstr "Information om brugerkonto."
 
-#: vipw.8.xml:216(filename) usermod.8.xml:541(filename)
+#: vipw.8.xml:216(filename) usermod.8.xml:540(filename)
 #: userdel.8.xml:209(filename) useradd.8.xml:684(filename)
 #: su.1.xml:376(filename) sg.1.xml:119(filename) shadow.5.xml:264(filename)
 #: shadow.3.xml:229(filename) pwck.8.xml:284(filename)
@@ -580,7 +572,7 @@ msgstr "Information om brugerkonto."
 msgid "/etc/shadow"
 msgstr "/etc/shadow"
 
-#: vipw.8.xml:218(para) usermod.8.xml:543(para) userdel.8.xml:211(para)
+#: vipw.8.xml:218(para) usermod.8.xml:542(para) userdel.8.xml:211(para)
 #: useradd.8.xml:686(para) su.1.xml:378(para) sg.1.xml:121(para)
 #: shadow.5.xml:266(para) shadow.3.xml:231(para) pwck.8.xml:286(para)
 #: passwd.1.xml:419(para) newusers.8.xml:408(para) newgrp.1.xml:132(para)
@@ -589,7 +581,7 @@ msgstr "/etc/shadow"
 msgid "Secure user account information."
 msgstr "Information om sikret brugerkonto."
 
-#: vipw.8.xml:225(title) usermod.8.xml:562(title) userdel.8.xml:308(title)
+#: vipw.8.xml:225(title) usermod.8.xml:561(title) userdel.8.xml:308(title)
 #: useradd.8.xml:804(title) suauth.5.xml:222(title) su.1.xml:438(title)
 #: sg.1.xml:140(title) shadow.5.xml:283(title) shadow.3.xml:238(title)
 #: pwconv.8.xml:262(title) pwck.8.xml:344(title) porttime.5.xml:142(title)
@@ -652,15 +644,15 @@ msgstr ""
 #: usermod.8.xml:46(surname) userdel.8.xml:46(surname)
 #: useradd.8.xml:57(surname) su.1.xml:57(surname) sg.1.xml:41(surname)
 #: shadow.5.xml:40(surname) shadow.3.xml:40(surname) pwck.8.xml:46(surname)
-#: porttime.5.xml:40(surname) passwd.5.xml:40(surname)
-#: passwd.1.xml:47(surname) newusers.8.xml:55(surname)
-#: newgrp.1.xml:41(surname) logoutd.8.xml:40(surname)
-#: login.defs.5.xml:105(surname) login.1.xml:73(surname)
-#: lastlog.8.xml:41(surname) grpck.8.xml:41(surname) groups.1.xml:40(surname)
-#: groupmod.8.xml:41(surname) groupdel.8.xml:41(surname)
-#: groupadd.8.xml:43(surname) faillog.8.xml:40(surname)
-#: faillog.5.xml:40(surname) expiry.1.xml:44(surname) chsh.1.xml:43(surname)
-#: chpasswd.8.xml:44(surname) chfn.1.xml:43(surname) chage.1.xml:41(surname)
+#: porttime.5.xml:40(surname) passwd.5.xml:40(surname) passwd.1.xml:47(surname)
+#: newusers.8.xml:55(surname) newgrp.1.xml:41(surname)
+#: logoutd.8.xml:40(surname) login.defs.5.xml:105(surname)
+#: login.1.xml:73(surname) lastlog.8.xml:41(surname) grpck.8.xml:41(surname)
+#: groups.1.xml:40(surname) groupmod.8.xml:41(surname)
+#: groupdel.8.xml:41(surname) groupadd.8.xml:43(surname)
+#: faillog.8.xml:40(surname) faillog.5.xml:40(surname) expiry.1.xml:44(surname)
+#: chsh.1.xml:43(surname) chpasswd.8.xml:44(surname) chfn.1.xml:43(surname)
+#: chage.1.xml:41(surname)
 msgid "Haugh"
 msgstr ""
 
@@ -1031,7 +1023,7 @@ msgstr ""
 #| "<option>-f</option>, <option>--inactive</option>&nbsp;"
 #| "<replaceable>INACTIVE</replaceable>"
 msgid ""
-"<option>-v</option>, <option>--add-sub-uids</option>&nbsp;"
+"<option>-v</option>, <option>--add-subuids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-f</option>, <option>--inactive</option>&nbsp;<replaceable>INAKTIV</"
@@ -1060,7 +1052,7 @@ msgstr ""
 #| "<option>-e</option>, <option>--expiredate</option>&nbsp;"
 #| "<replaceable>EXPIRE_DATE</replaceable>"
 msgid ""
-"<option>-V</option>, <option>--del-sub-uids</option>&nbsp;"
+"<option>-V</option>, <option>--del-subuids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-e</option>, <option>--expiredate</option>&nbsp;"
@@ -1073,8 +1065,8 @@ msgstr ""
 #: usermod.8.xml:409(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-sub-uids</option> and <option>--add-"
-"sub-uids</option> are specified, the removal of all subordinate uid ranges "
+"users account. When both <option>--del-subuids</option> and <option>--add-"
+"subuids</option> are specified, the removal of all subordinate uid ranges "
 "happens before any subordinate uid range is added."
 msgstr ""
 
@@ -1084,7 +1076,7 @@ msgstr ""
 #| "<option>-f</option>, <option>--inactive</option>&nbsp;"
 #| "<replaceable>INACTIVE</replaceable>"
 msgid ""
-"<option>-w</option>, <option>--add-sub-gids</option>&nbsp;"
+"<option>-w</option>, <option>--add-subgids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-f</option>, <option>--inactive</option>&nbsp;<replaceable>INAKTIV</"
@@ -1107,7 +1099,7 @@ msgstr ""
 #| "<option>-e</option>, <option>--expiredate</option>&nbsp;"
 #| "<replaceable>EXPIRE_DATE</replaceable>"
 msgid ""
-"<option>-W</option>, <option>--del-sub-gids</option>&nbsp;"
+"<option>-W</option>, <option>--del-subgids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-e</option>, <option>--expiredate</option>&nbsp;"
@@ -1120,8 +1112,8 @@ msgstr ""
 #: usermod.8.xml:447(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-sub-gids</option> and <option>--add-"
-"sub-gids</option> are specified, the removal of all subordinate gid ranges "
+"users account. When both <option>--del-subgids</option> and <option>--add-"
+"subgids</option> are specified, the removal of all subordinate gid ranges "
 "happens before any subordinate gid range is added."
 msgstr ""
 
@@ -1143,9 +1135,9 @@ msgstr ""
 
 #: usermod.8.xml:478(title) userdel.8.xml:281(title) useradd.8.xml:623(title)
 #: su.1.xml:331(title) shadow.3.xml:218(title) passwd.1.xml:372(title)
-#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:194(title)
-#: groupdel.8.xml:116(title) groupadd.8.xml:257(title)
-#: gpasswd.1.xml:252(title) faillog.8.xml:232(title) chpasswd.8.xml:231(title)
+#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:216(title)
+#: groupdel.8.xml:116(title) groupadd.8.xml:257(title) gpasswd.1.xml:252(title)
+#: faillog.8.xml:232(title) chpasswd.8.xml:231(title)
 #: chgpasswd.8.xml:186(title)
 msgid "CAVEATS"
 msgstr ""
@@ -1155,17 +1147,17 @@ msgid ""
 "You must make certain that the named user is not executing any processes "
 "when this command is being executed if the user's numerical user ID, the "
 "user's name, or the user's home directory is being changed. "
-"<command>usermod</command> checks this on Linux, but only check if the user "
-"is logged in according to utmp on other architectures."
+"<command>usermod</command> checks this on Linux. On other platforms it only "
+"uses utmp to check if the user is logged in."
 msgstr ""
 
-#: usermod.8.xml:487(para)
+#: usermod.8.xml:486(para)
 msgid ""
 "You must change the owner of any <command>crontab</command> files or "
 "<command>at</command> jobs manually."
 msgstr ""
 
-#: usermod.8.xml:491(para)
+#: usermod.8.xml:490(para)
 msgid "You must make any changes involving NIS on the NIS server."
 msgstr ""
 
@@ -1396,7 +1388,7 @@ msgid ""
 "algorithm: <placeholder-1/>"
 msgstr ""
 
-#: usermod.8.xml:529(filename) userdel.8.xml:197(filename)
+#: usermod.8.xml:528(filename) userdel.8.xml:197(filename)
 #: useradd.8.xml:726(filename) su.1.xml:382(filename)
 #: pwconv.8.xml:253(filename) passwd.1.xml:423(filename)
 #: newusers.8.xml:424(filename) login.access.5.xml:124(filename)
@@ -1407,7 +1399,7 @@ msgstr ""
 msgid "/etc/login.defs"
 msgstr ""
 
-#: usermod.8.xml:531(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
+#: usermod.8.xml:530(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
 #: su.1.xml:384(para) pwconv.8.xml:255(para) passwd.1.xml:425(para)
 #: newusers.8.xml:426(para) login.access.5.xml:126(para) login.1.xml:391(para)
 #: groupmod.8.xml:222(para) groupadd.8.xml:250(para) chsh.1.xml:184(para)
@@ -1415,31 +1407,31 @@ msgstr ""
 msgid "Shadow password suite configuration."
 msgstr ""
 
-#: usermod.8.xml:547(filename) userdel.8.xml:215(filename)
+#: usermod.8.xml:546(filename) userdel.8.xml:215(filename)
 #: useradd.8.xml:714(filename) newusers.8.xml:436(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subgid"
 msgstr "/etc/suauth"
 
-#: usermod.8.xml:549(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
+#: usermod.8.xml:548(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
 #: newusers.8.xml:438(para)
 msgid "Per user subordinate group IDs."
 msgstr ""
 
-#: usermod.8.xml:553(filename) userdel.8.xml:221(filename)
+#: usermod.8.xml:552(filename) userdel.8.xml:221(filename)
 #: useradd.8.xml:720(filename) newusers.8.xml:442(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subuid"
 msgstr "/etc/suauth"
 
-#: usermod.8.xml:555(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
+#: usermod.8.xml:554(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
 #: newusers.8.xml:444(para)
 msgid "Per user subordinate user IDs."
 msgstr ""
 
-#: usermod.8.xml:563(para)
+#: usermod.8.xml:562(para)
 #, fuzzy
 #| msgid ""
 #| "<citerefentry><refentrytitle>vi</refentrytitle><manvolnum>1</manvolnum></"
@@ -1653,9 +1645,8 @@ msgstr ""
 #: passwd.1.xml:449(replaceable) newgrp.1.xml:59(manvolnum)
 #: login.1.xml:91(manvolnum) grpck.8.xml:256(replaceable)
 #: groups.1.xml:58(manvolnum) gpasswd.1.xml:63(manvolnum)
-#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum)
-#: chfn.1.xml:61(manvolnum) chage.1.xml:59(manvolnum)
-#: chage.1.xml:289(replaceable)
+#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum) chfn.1.xml:61(manvolnum)
+#: chage.1.xml:59(manvolnum) chage.1.xml:289(replaceable)
 msgid "1"
 msgstr ""
 
@@ -1976,7 +1967,7 @@ msgid ""
 "<option>PASS_MAX_DAYS</option> and others). <placeholder-1/> Example: "
 "<option>-K</option>&nbsp;<replaceable>PASS_MAX_DAYS</"
 "replaceable>=<replaceable>-1</replaceable> can be used when creating system "
-"account to turn off password ageing, even though system account has no "
+"account to turn off password aging, even though system account has no "
 "password at all. Multiple <option>-K</option> options can be specified, e."
 "g.: <option>-K</option>&nbsp;<replaceable>UID_MIN</"
 "replaceable>=<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;"
@@ -1994,7 +1985,7 @@ msgstr ""
 #: useradd.8.xml:327(para)
 msgid ""
 "By default, the user's entries in the lastlog and faillog databases are "
-"resetted to avoid reusing the entry from a previously deleted user."
+"reset to avoid reusing the entry from a previously deleted user."
 msgstr ""
 
 #: useradd.8.xml:335(term)
@@ -2014,9 +2005,11 @@ msgid ""
 "is not enabled, no home directories are created."
 msgstr ""
 
-#: useradd.8.xml:354(option)
-msgid "-M"
-msgstr ""
+#: useradd.8.xml:353(term)
+#, fuzzy
+#| msgid "<option>-c</option>, <option>--crypt-method</option>"
+msgid "<option>-M</option>, <option>--no-create-home</option>"
+msgstr "<option>-c</option>, <option>--crypt-method</option>"
 
 #: useradd.8.xml:357(para)
 msgid ""
@@ -2081,10 +2074,10 @@ msgstr ""
 #: useradd.8.xml:434(para)
 msgid ""
 "Note that <command>useradd</command> will not create a home directory for "
-"such an user, regardless of the default setting in <filename>/etc/login."
-"defs</filename> (<option>CREATE_HOME</option>). You have to specify the "
-"<option>-m</option> options if you want a home directory for a system "
-"account to be created."
+"such a user, regardless of the default setting in <filename>/etc/login.defs</"
+"filename> (<option>CREATE_HOME</option>). You have to specify the <option>-"
+"m</option> options if you want a home directory for a system account to be "
+"created."
 msgstr ""
 
 #: useradd.8.xml:461(para)
@@ -2602,7 +2595,7 @@ msgstr ""
 #, no-wrap
 msgid ""
 "\n"
-"      1) the user su is targetting\n"
+"      1) the user su is targeting\n"
 "    "
 msgstr ""
 
@@ -2636,12 +2629,12 @@ msgstr ""
 #: suauth.5.xml:107(para)
 msgid ""
 "from-id is formatted the same as to-id except the extra word "
-"<emphasis>GROUP</emphasis> is recognised. <emphasis>ALL EXCEPT GROUP</"
+"<emphasis>GROUP</emphasis> is recognized. <emphasis>ALL EXCEPT GROUP</"
 "emphasis> is perfectly valid too. Following <emphasis>GROUP</emphasis> "
 "appears one or more group names, delimited by \",\". It is not sufficient to "
 "have primary group id of the relevant group, an entry in "
 "<citerefentry><refentrytitle>/etc/group</refentrytitle><manvolnum>5</"
-"manvolnum></citerefentry> is neccessary."
+"manvolnum></citerefentry> is necessary."
 msgstr ""
 
 #: suauth.5.xml:118(para)
@@ -2744,9 +2737,8 @@ msgid ""
 msgstr ""
 
 #: su.1.xml:58(contrib) shadow.5.xml:41(contrib) shadow.3.xml:41(contrib)
-#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib)
-#: passwd.1.xml:48(contrib) login.1.xml:74(contrib) faillog.8.xml:41(contrib)
-#: faillog.5.xml:41(contrib)
+#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib) passwd.1.xml:48(contrib)
+#: login.1.xml:74(contrib) faillog.8.xml:41(contrib) faillog.5.xml:41(contrib)
 msgid "Creation, 1989"
 msgstr ""
 
@@ -2845,7 +2837,7 @@ msgstr ""
 #: su.1.xml:158(para)
 msgid ""
 "The executed command will have no controlling terminal. This option cannot "
-"be used to execute interractive programs which need a controlling TTY."
+"be used to execute interactive programs which need a controlling TTY."
 msgstr ""
 
 #: su.1.xml:168(term)
@@ -3389,7 +3381,7 @@ msgstr ""
 
 #: shadow.5.xml:117(para) gshadow.5.xml:107(para)
 msgid ""
-"A password field which starts with a exclamation mark means that the "
+"A password field which starts with an exclamation mark means that the "
 "password is locked. The remaining characters on the line represent the "
 "password field before the password was locked."
 msgstr ""
@@ -3407,7 +3399,7 @@ msgstr ""
 #: shadow.5.xml:134(para)
 msgid ""
 "The value 0 has a special meaning, which is that the user should change her "
-"pasword the next time she will log in the system."
+"password the next time she will log in the system."
 msgstr ""
 
 #: shadow.5.xml:139(para)
@@ -3507,7 +3499,7 @@ msgstr ""
 #: shadow.5.xml:229(para)
 msgid ""
 "Note that an account expiration differs from a password expiration. In case "
-"of an acount expiration, the user shall not be allowed to login. In case of "
+"of an account expiration, the user shall not be allowed to login. In case of "
 "a password expiration, the user is not allowed to login using her password."
 msgstr ""
 
@@ -3768,18 +3760,15 @@ msgstr ""
 msgid "pwconv"
 msgstr ""
 
-#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command)
-#: login.defs.5.xml:438(term)
+#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command) login.defs.5.xml:438(term)
 msgid "pwunconv"
 msgstr ""
 
-#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command)
-#: login.defs.5.xml:340(term)
+#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command) login.defs.5.xml:340(term)
 msgid "grpconv"
 msgstr ""
 
-#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command)
-#: login.defs.5.xml:346(term)
+#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command) login.defs.5.xml:346(term)
 msgid "grpunconv"
 msgstr ""
 
@@ -3927,8 +3916,7 @@ msgstr ""
 
 #: pwck.8.xml:80(replaceable) passwd.5.xml:57(refentrytitle)
 #: passwd.5.xml:64(refname) passwd.1.xml:64(refentrytitle)
-#: passwd.1.xml:71(refname) passwd.1.xml:77(command)
-#: login.defs.5.xml:409(term)
+#: passwd.1.xml:71(refname) passwd.1.xml:77(command) login.defs.5.xml:409(term)
 msgid "passwd"
 msgstr ""
 
@@ -4071,7 +4059,7 @@ msgstr ""
 msgid ""
 "Note that when <option>USE_TCB</option> is enabled, you cannot specify an "
 "alternative <replaceable>shadow</replaceable> file. In future releases, this "
-"paramater could be replaced by an alternate TCB directory."
+"parameter could be replaced by an alternate TCB directory."
 msgstr ""
 
 #: pwck.8.xml:312(para)
@@ -4400,8 +4388,12 @@ msgid ""
 msgstr ""
 
 #: passwd.1.xml:166(para)
+#, fuzzy
+#| msgid ""
+#| "You can find advices on how to choose a strong password on http://en."
+#| "wikipedia.org/wiki/Password_strength"
 msgid ""
-"You can find advices on how to choose a strong password on http://en."
+"You can find advice on how to choose a strong password on http://en."
 "wikipedia.org/wiki/Password_strength"
 msgstr ""
 "Du kan finde råd om hvordan du vælger en god adgangskode på http://en."
@@ -4703,8 +4695,8 @@ msgstr "<option>PASS_MIN_LEN</option> (antal)"
 #: passwd.1.xml:35(para) login.defs.5.xml:35(para)
 msgid ""
 "Number of significant characters in the password for crypt(). "
-"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your crypt"
-"() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
+"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your "
+"crypt() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
 "<replaceable>yes</replaceable>."
 msgstr ""
 
@@ -4842,7 +4834,9 @@ msgid "HISTORY"
 msgstr "HISTORIK"
 
 #: nologin.8.xml:91(para)
-msgid "The <command>nologin</command> command appearred in BSD 4.4."
+#, fuzzy
+#| msgid "The <command>nologin</command> command appearred in BSD 4.4."
+msgid "The <command>nologin</command> command appeared in BSD 4.4."
 msgstr "Kommandoen <command>nologin</command> fremkom i BSD 4.4."
 
 #: newusers.8.xml:72(refentrytitle) newusers.8.xml:79(refname)
@@ -4881,11 +4875,19 @@ msgid "This is the name of the user."
 msgstr "Dette er navnet på brugeren."
 
 #: newusers.8.xml:116(para)
+#, fuzzy
+#| msgid ""
+#| "If this field contains the name of an existing user (or the name of an "
+#| "user created before by <command>newusers</command>), the UID of the "
+#| "specified user will be used."
 msgid ""
-"It can be the name of a new user or the name of an existing user (or an user "
+"It can be the name of a new user or the name of an existing user (or a user "
 "created before by <command>newusers</command>). In case of an existing user, "
 "the user's information will be changed, otherwise a new user will be created."
 msgstr ""
+"Hvis dette felt indeholder navnet på en eksisterende bruger (eller navnet på "
+"en bruger oprettet før af <command>newusers</command>), så vil UID'en for "
+"den angivne bruger blive brugt."
 
 #: newusers.8.xml:127(emphasis)
 msgid "pw_passwd"
@@ -4908,8 +4910,12 @@ msgid "This field is used to define the UID of the user."
 msgstr "Dette flet bruges til at definere UID for brugeren."
 
 #: newusers.8.xml:144(para)
+#, fuzzy
+#| msgid ""
+#| "If the field is empty, an new (unused) UID will be defined automatically "
+#| "by <command>newusers</command>."
 msgid ""
-"If the field is empty, an new (unused) UID will be defined automatically by "
+"If the field is empty, a new (unused) UID will be defined automatically by "
 "<command>newusers</command>."
 msgstr ""
 "Hvis feltet er tomt, vil en ny (ubrugt) UID blive defineret automatisk af "
@@ -4921,8 +4927,13 @@ msgstr ""
 "Hvis dette felt indeholer et tal, så vil dette tal blive brugt som UID'en."
 
 #: newusers.8.xml:152(para)
+#, fuzzy
+#| msgid ""
+#| "If this field contains the name of an existing user (or the name of an "
+#| "user created before by <command>newusers</command>), the UID of the "
+#| "specified user will be used."
 msgid ""
-"If this field contains the name of an existing user (or the name of an user "
+"If this field contains the name of an existing user (or the name of a user "
 "created before by <command>newusers</command>), the UID of the specified "
 "user will be used."
 msgstr ""
@@ -6181,7 +6192,9 @@ msgid "D: max data size (KB)"
 msgstr "D: Maks. datastørrelse (KB)"
 
 #: limits.5.xml:111(para)
-msgid "F: maximum filesize (KB)"
+#, fuzzy
+#| msgid "F: maximum filesize (KB)"
+msgid "F: maximum file size (KB)"
 msgstr "F: Maks filstørrelse (KB)"
 
 #: limits.5.xml:112(para)
@@ -6251,7 +6264,7 @@ msgstr ""
 #: limits.5.xml:145(para)
 msgid ""
 "Be aware that after <emphasis remap=\"I\">username</emphasis> the rest of "
-"the line is considered a limit string, thus comments are not allowed. A "
+"the line is considered a limit string, thus comments are not allowed. An "
 "invalid limits string will be rejected (not considered) by the "
 "<command>login</command> program."
 msgstr ""
@@ -6271,8 +6284,12 @@ msgid ""
 msgstr ""
 
 #: limits.5.xml:165(para)
+#, fuzzy
+#| msgid ""
+#| "If more than one line with limits for an user exist, only the first line "
+#| "for this user will be considered."
 msgid ""
-"If more than one line with limits for an user exist, only the first line for "
+"If more than one line with limits for a user exist, only the first line for "
 "this user will be considered."
 msgstr ""
 "Hvis mere end en linje med begrænsninger for en bruger findes, så vil kun "
@@ -6280,7 +6297,7 @@ msgstr ""
 
 #: limits.5.xml:170(para)
 msgid ""
-"If no lines are specified for an user, the last <replaceable>@group</"
+"If no lines are specified for a user, the last <replaceable>@group</"
 "replaceable> line matching a group whose the user is a member of will be "
 "considered, or the last line with default limits if no groups contain the "
 "user."
@@ -6351,29 +6368,53 @@ msgid ""
 "Print only lastlog records older than <emphasis remap=\"I\">DAYS</emphasis>."
 msgstr ""
 
-#: lastlog.8.xml:127(term) faillog.8.xml:192(term)
+#: lastlog.8.xml:107(term)
+#, fuzzy
+#| msgid "<option>-u</option>, <option>--user</option>"
+msgid "<option>-C</option>, <option>--clear</option>"
+msgstr "<option>-u</option>, <option>--user</option>"
+
+#: lastlog.8.xml:111(para)
+msgid ""
+"Clear lastlog record of a user. This option can be used only together with "
+"<option>-u</option> (<option>--user</option>))."
+msgstr ""
+
+#: lastlog.8.xml:138(term)
+#, fuzzy
+#| msgid "<option>-u</option>, <option>--user</option>"
+msgid "<option>-S</option>, <option>--set</option>"
+msgstr "<option>-u</option>, <option>--user</option>"
+
+#: lastlog.8.xml:142(para)
+msgid ""
+"Set lastlog record of a user to the current time. This option can be used "
+"only together with <option>-u</option> (<option>--user</option>))."
+msgstr ""
+
+#: lastlog.8.xml:149(term) faillog.8.xml:192(term)
 msgid ""
 "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAYS</"
 "replaceable>"
 msgstr ""
 
-#: lastlog.8.xml:131(para)
+#: lastlog.8.xml:153(para)
 msgid ""
 "Print the lastlog records more recent than <emphasis remap=\"I\">DAYS</"
 "emphasis>."
 msgstr ""
 
-#: lastlog.8.xml:138(term) faillog.8.xml:202(term)
+#: lastlog.8.xml:160(term) faillog.8.xml:202(term)
 msgid ""
 "<option>-u</option>, <option>--user</option>&nbsp;<replaceable>LOGIN</"
 "replaceable>|<replaceable>RANGE</replaceable>"
 msgstr ""
 
-#: lastlog.8.xml:142(para)
+#: lastlog.8.xml:164(para)
 msgid "Print the lastlog record of the specified user(s)."
 msgstr ""
 
-#: lastlog.8.xml:145(para) faillog.8.xml:211(para)
+#: lastlog.8.xml:167(para) faillog.8.xml:211(para)
 msgid ""
 "The users can be specified by a login name, a numerical user ID, or a "
 "<replaceable>RANGE</replaceable> of users. This <replaceable>RANGE</"
@@ -6382,24 +6423,24 @@ msgid ""
 "UID_MAX</replaceable>), or a min value (<replaceable>UID_MIN-</replaceable>)."
 msgstr ""
 
-#: lastlog.8.xml:157(para)
+#: lastlog.8.xml:179(para)
 msgid ""
 "If the user has never logged in the message <emphasis>** Never logged in**</"
 "emphasis> will be displayed instead of the port and time."
 msgstr ""
 
-#: lastlog.8.xml:162(para)
+#: lastlog.8.xml:184(para)
 msgid ""
 "Only the entries for the current users of the system will be displayed. "
 "Other entries may exist for users that were deleted previously."
 msgstr ""
 
-#: lastlog.8.xml:170(title) groups.1.xml:90(title) chsh.1.xml:140(title)
+#: lastlog.8.xml:192(title) groups.1.xml:90(title) chsh.1.xml:140(title)
 #: chage.1.xml:231(title)
 msgid "NOTE"
 msgstr ""
 
-#: lastlog.8.xml:171(para)
+#: lastlog.8.xml:193(para)
 msgid ""
 "The <filename>lastlog</filename> file is a database which contains info on "
 "the last login of each user. You should not rotate it. It is a sparse file, "
@@ -6409,15 +6450,15 @@ msgid ""
 "its real size with \"<command>ls -s</command>\"."
 msgstr ""
 
-#: lastlog.8.xml:185(filename)
+#: lastlog.8.xml:207(filename)
 msgid "/var/log/lastlog"
 msgstr "/var/log/lastlog"
 
-#: lastlog.8.xml:187(para)
+#: lastlog.8.xml:209(para)
 msgid "Database times of previous user logins."
 msgstr "Databasetider for tidligere brugerlogind."
 
-#: lastlog.8.xml:195(para)
+#: lastlog.8.xml:217(para)
 msgid ""
 "Large gaps in UID numbers will cause the lastlog program to run longer with "
 "no output to the screen (i.e. if in lastlog database there is no entries for "
@@ -6464,11 +6505,19 @@ msgid ""
 msgstr ""
 
 #: gshadow.5.xml:97(para)
+#, fuzzy
+#| msgid ""
+#| "The new value of the user's password file comment field. It is normally "
+#| "modified using the <citerefentry><refentrytitle>chfn</"
+#| "refentrytitle><manvolnum>1</manvolnum></citerefentry> utility."
 msgid ""
-"The password is used when an user who is not a member of the group wants to "
+"The password is used when a user who is not a member of the group wants to "
 "gain the permissions of this group (see <citerefentry><refentrytitle>newgrp</"
 "refentrytitle><manvolnum>1</manvolnum></citerefentry>)."
 msgstr ""
+"Den nye værdi for brugerens kommentar kommentarfelt i adgangskodefilen. Den "
+"ændres normalt med redskabet <citerefentry><refentrytitle>chfn</"
+"refentrytitle><manvolnum>1</manvolnum></citerefentry>."
 
 #: gshadow.5.xml:103(para)
 msgid ""
@@ -6867,7 +6916,9 @@ msgid ""
 msgstr ""
 
 #: groupmems.8.xml:109(para)
-msgid "Add an user to the group membership list."
+#, fuzzy
+#| msgid "Add an user to the group membership list."
+msgid "Add a user to the group membership list."
 msgstr "Tilføj en bruger til listen over gruppemedlemmer."
 
 #: groupmems.8.xml:110(para) groupmems.8.xml:126(para)
@@ -7633,7 +7684,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> or <option>MD5_CRYPT_ENAB</option> variables "
-"of <filename>/etc/login.defs</filename>, and can be overwitten with the "
+"of <filename>/etc/login.defs</filename>, and can be overwritten with the "
 "<option>-e</option>, <option>-m</option>, or <option>-c</option> options."
 msgstr ""
 
@@ -7648,7 +7699,7 @@ msgstr ""
 msgid ""
 "<phrase condition=\"pam\">Except when PAM is used to encrypt the passwords,</"
 "phrase><command>chpasswd</command> first updates all the passwords in "
-"memory, and then commits all the changes to disk if no errors occured for "
+"memory, and then commits all the changes to disk if no errors occurred for "
 "any user."
 msgstr ""
 
@@ -7778,7 +7829,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> variable of <filename>/etc/login.defs</"
-"filename>, and can be overwiten with the <option>-e</option>, <option>-m</"
+"filename>, and can be overwritten with the <option>-e</option>, <option>-m</"
 "option>, or <option>-c</option> options."
 msgstr ""
 

man/po/pl.po

@@ -3,7 +3,7 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: man pages for shadow 4.0.16\n"
-"POT-Creation-Date: 2013-08-23 01:54+0200\n"
+"POT-Creation-Date: 2016-09-18 14:03-0500\n"
 "PO-Revision-Date: 2013-08-23 01:38+0200\n"
 "Last-Translator: Tomasz Kłoczko <kloczek@pld.org.pl>\n"
 "Language-Team: Polish <translation-team-pl@lists.sourceforge.net>\n"
@@ -51,16 +51,15 @@ msgstr ""
 #: useradd.8.xml:62(surname) suauth.5.xml:45(surname) su.1.xml:62(surname)
 #: sg.1.xml:46(surname) shadow.5.xml:45(surname) shadow.3.xml:45(surname)
 #: pwconv.8.xml:51(surname) pwck.8.xml:51(surname) porttime.5.xml:45(surname)
-#: passwd.5.xml:45(surname) passwd.1.xml:52(surname)
-#: newusers.8.xml:60(surname) newgrp.1.xml:46(surname)
-#: logoutd.8.xml:45(surname) login.defs.5.xml:110(surname)
-#: login.access.5.xml:46(surname) login.1.xml:78(surname)
-#: limits.5.xml:47(surname) lastlog.8.xml:46(surname) grpck.8.xml:46(surname)
-#: groups.1.xml:45(surname) groupmod.8.xml:46(surname)
+#: passwd.5.xml:45(surname) passwd.1.xml:52(surname) newusers.8.xml:60(surname)
+#: newgrp.1.xml:46(surname) logoutd.8.xml:45(surname)
+#: login.defs.5.xml:110(surname) login.access.5.xml:46(surname)
+#: login.1.xml:78(surname) limits.5.xml:47(surname) lastlog.8.xml:46(surname)
+#: grpck.8.xml:46(surname) groups.1.xml:45(surname) groupmod.8.xml:46(surname)
 #: groupmems.8.xml:49(surname) groupdel.8.xml:46(surname)
 #: groupadd.8.xml:48(surname) gpasswd.1.xml:50(surname)
-#: faillog.8.xml:45(surname) faillog.5.xml:45(surname)
-#: expiry.1.xml:49(surname) chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
+#: faillog.8.xml:45(surname) faillog.5.xml:45(surname) expiry.1.xml:49(surname)
+#: chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
 #: chgpasswd.8.xml:45(surname) chfn.1.xml:48(surname) chage.1.xml:46(surname)
 msgid "Kłoczko"
 msgstr ""
@@ -85,17 +84,16 @@ msgstr ""
 #: useradd.8.xml:64(contrib) suauth.5.xml:47(contrib) su.1.xml:64(contrib)
 #: sg.1.xml:48(contrib) shadow.5.xml:47(contrib) shadow.3.xml:47(contrib)
 #: pwconv.8.xml:53(contrib) pwck.8.xml:53(contrib) porttime.5.xml:47(contrib)
-#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib)
-#: newusers.8.xml:62(contrib) newgrp.1.xml:48(contrib)
-#: logoutd.8.xml:47(contrib) login.defs.5.xml:112(contrib)
-#: login.access.5.xml:48(contrib) login.1.xml:80(contrib)
-#: limits.5.xml:49(contrib) lastlog.8.xml:48(contrib) grpck.8.xml:48(contrib)
-#: groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
+#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib) newusers.8.xml:62(contrib)
+#: newgrp.1.xml:48(contrib) logoutd.8.xml:47(contrib)
+#: login.defs.5.xml:112(contrib) login.access.5.xml:48(contrib)
+#: login.1.xml:80(contrib) limits.5.xml:49(contrib) lastlog.8.xml:48(contrib)
+#: grpck.8.xml:48(contrib) groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
 #: groupmems.8.xml:51(contrib) groupdel.8.xml:48(contrib)
 #: groupadd.8.xml:50(contrib) gpasswd.1.xml:52(contrib)
-#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib)
-#: expiry.1.xml:51(contrib) chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib)
-#: chfn.1.xml:50(contrib) chage.1.xml:48(contrib)
+#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib) expiry.1.xml:51(contrib)
+#: chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib) chfn.1.xml:50(contrib)
+#: chage.1.xml:48(contrib)
 msgid "shadow-utils maintainer, 2000 - 2007"
 msgstr ""
 
@@ -129,14 +127,13 @@ msgstr ""
 #: newusers.8.xml:66(surname) newgrp.1.xml:52(surname)
 #: logoutd.8.xml:51(surname) login.defs.5.xml:116(surname)
 #: login.access.5.xml:52(surname) login.1.xml:84(surname)
-#: limits.5.xml:53(surname) lastlog.8.xml:52(surname)
-#: gshadow.5.xml:39(surname) grpck.8.xml:52(surname) groups.1.xml:51(surname)
-#: groupmod.8.xml:52(surname) groupmems.8.xml:55(surname)
-#: groupdel.8.xml:52(surname) groupadd.8.xml:54(surname)
-#: gpasswd.1.xml:56(surname) faillog.8.xml:51(surname)
-#: faillog.5.xml:51(surname) expiry.1.xml:55(surname) chsh.1.xml:54(surname)
-#: chpasswd.8.xml:55(surname) chgpasswd.8.xml:51(surname)
-#: chfn.1.xml:54(surname) chage.1.xml:52(surname)
+#: limits.5.xml:53(surname) lastlog.8.xml:52(surname) gshadow.5.xml:39(surname)
+#: grpck.8.xml:52(surname) groups.1.xml:51(surname) groupmod.8.xml:52(surname)
+#: groupmems.8.xml:55(surname) groupdel.8.xml:52(surname)
+#: groupadd.8.xml:54(surname) gpasswd.1.xml:56(surname)
+#: faillog.8.xml:51(surname) faillog.5.xml:51(surname) expiry.1.xml:55(surname)
+#: chsh.1.xml:54(surname) chpasswd.8.xml:55(surname)
+#: chgpasswd.8.xml:51(surname) chfn.1.xml:54(surname) chage.1.xml:52(surname)
 msgid "François"
 msgstr ""
 
@@ -165,14 +162,13 @@ msgstr ""
 #: newusers.8.xml:68(contrib) newgrp.1.xml:54(contrib)
 #: logoutd.8.xml:53(contrib) login.defs.5.xml:118(contrib)
 #: login.access.5.xml:54(contrib) login.1.xml:86(contrib)
-#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib)
-#: gshadow.5.xml:42(contrib) grpck.8.xml:54(contrib) groups.1.xml:53(contrib)
-#: groupmod.8.xml:54(contrib) groupmems.8.xml:57(contrib)
-#: groupdel.8.xml:54(contrib) groupadd.8.xml:56(contrib)
-#: gpasswd.1.xml:58(contrib) faillog.8.xml:53(contrib)
-#: faillog.5.xml:53(contrib) expiry.1.xml:57(contrib) chsh.1.xml:56(contrib)
-#: chpasswd.8.xml:57(contrib) chgpasswd.8.xml:53(contrib)
-#: chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
+#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib) gshadow.5.xml:42(contrib)
+#: grpck.8.xml:54(contrib) groups.1.xml:53(contrib) groupmod.8.xml:54(contrib)
+#: groupmems.8.xml:57(contrib) groupdel.8.xml:54(contrib)
+#: groupadd.8.xml:56(contrib) gpasswd.1.xml:58(contrib)
+#: faillog.8.xml:53(contrib) faillog.5.xml:53(contrib) expiry.1.xml:57(contrib)
+#: chsh.1.xml:56(contrib) chpasswd.8.xml:57(contrib)
+#: chgpasswd.8.xml:53(contrib) chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
 msgid "shadow-utils maintainer, 2007 - now"
 msgstr ""
 
@@ -245,14 +241,13 @@ msgstr "edytuj plik haseł, grup lub ich wersji chronionych"
 #: useradd.8.xml:88(replaceable) useradd.8.xml:100(replaceable)
 #: su.1.xml:88(replaceable) pwconv.8.xml:81(replaceable)
 #: pwconv.8.xml:87(replaceable) pwconv.8.xml:93(replaceable)
-#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg)
-#: passwd.1.xml:79(replaceable) newusers.8.xml:87(replaceable)
-#: lastlog.8.xml:73(replaceable) grpck.8.xml:72(arg)
-#: groupmod.8.xml:73(replaceable) groupdel.8.xml:73(replaceable)
-#: groupadd.8.xml:75(replaceable) faillog.8.xml:72(replaceable)
-#: chsh.1.xml:75(replaceable) chpasswd.8.xml:76(replaceable)
-#: chgpasswd.8.xml:72(replaceable) chfn.1.xml:75(replaceable)
-#: chage.1.xml:72(replaceable)
+#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg) passwd.1.xml:79(replaceable)
+#: newusers.8.xml:87(replaceable) lastlog.8.xml:73(replaceable)
+#: grpck.8.xml:72(arg) groupmod.8.xml:73(replaceable)
+#: groupdel.8.xml:73(replaceable) groupadd.8.xml:75(replaceable)
+#: faillog.8.xml:72(replaceable) chsh.1.xml:75(replaceable)
+#: chpasswd.8.xml:76(replaceable) chgpasswd.8.xml:72(replaceable)
+#: chfn.1.xml:75(replaceable) chage.1.xml:72(replaceable)
 msgid "options"
 msgstr "opcje"
 
@@ -302,11 +297,10 @@ msgstr ""
 #: useradd.8.xml:124(title) su.1.xml:145(title) pwconv.8.xml:187(title)
 #: pwck.8.xml:176(title) passwd.1.xml:174(title) newusers.8.xml:265(title)
 #: login.1.xml:210(title) lastlog.8.xml:91(title) grpck.8.xml:147(title)
-#: groupmod.8.xml:89(title) groupmems.8.xml:100(title)
-#: groupdel.8.xml:88(title) groupadd.8.xml:93(title) gpasswd.1.xml:134(title)
-#: faillog.8.xml:89(title) expiry.1.xml:91(title) chsh.1.xml:95(title)
-#: chpasswd.8.xml:130(title) chgpasswd.8.xml:105(title) chfn.1.xml:111(title)
-#: chage.1.xml:91(title)
+#: groupmod.8.xml:89(title) groupmems.8.xml:100(title) groupdel.8.xml:88(title)
+#: groupadd.8.xml:93(title) gpasswd.1.xml:134(title) faillog.8.xml:89(title)
+#: expiry.1.xml:91(title) chsh.1.xml:95(title) chpasswd.8.xml:130(title)
+#: chgpasswd.8.xml:105(title) chfn.1.xml:111(title) chage.1.xml:91(title)
 msgid "OPTIONS"
 msgstr "OPCJE"
 
@@ -329,7 +323,7 @@ msgstr "Edycja bazy grup."
 
 #: vipw.8.xml:120(term) userdel.8.xml:123(term) useradd.8.xml:266(term)
 #: pwconv.8.xml:195(term) pwck.8.xml:186(term) passwd.1.xml:214(term)
-#: newusers.8.xml:283(term) lastlog.8.xml:107(term) grpck.8.xml:157(term)
+#: newusers.8.xml:283(term) lastlog.8.xml:118(term) grpck.8.xml:157(term)
 #: groupmod.8.xml:129(term) groupmems.8.xml:142(term) groupdel.8.xml:95(term)
 #: groupadd.8.xml:131(term) gpasswd.1.xml:173(term) faillog.8.xml:122(term)
 #: expiry.1.xml:112(term) chsh.1.xml:101(term) chpasswd.8.xml:171(term)
@@ -339,7 +333,7 @@ msgstr "<option>-h</option>, <option>--help</option>"
 
 #: vipw.8.xml:122(para) userdel.8.xml:125(para) useradd.8.xml:268(para)
 #: pwconv.8.xml:197(para) pwck.8.xml:188(para) passwd.1.xml:216(para)
-#: newusers.8.xml:285(para) lastlog.8.xml:111(para) grpck.8.xml:159(para)
+#: newusers.8.xml:285(para) lastlog.8.xml:122(para) grpck.8.xml:159(para)
 #: groupmod.8.xml:131(para) groupmems.8.xml:144(para) groupdel.8.xml:97(para)
 #: groupadd.8.xml:133(para) gpasswd.1.xml:175(para) faillog.8.xml:124(para)
 #: expiry.1.xml:114(para) chsh.1.xml:103(para) chpasswd.8.xml:173(para)
@@ -365,7 +359,7 @@ msgstr "Cichy tryb pracy."
 
 #: vipw.8.xml:138(term) usermod.8.xml:311(term) userdel.8.xml:146(term)
 #: useradd.8.xml:445(term) pwconv.8.xml:201(term) pwck.8.xml:209(term)
-#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:115(term)
+#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:126(term)
 #: grpck.8.xml:173(term) groupmod.8.xml:178(term) groupmems.8.xml:165(term)
 #: groupdel.8.xml:101(term) groupadd.8.xml:204(term) faillog.8.xml:180(term)
 #: chsh.1.xml:107(term) chpasswd.8.xml:188(term) chgpasswd.8.xml:146(term)
@@ -383,7 +377,7 @@ msgstr ""
 
 #: vipw.8.xml:142(para) usermod.8.xml:315(para) userdel.8.xml:150(para)
 #: useradd.8.xml:449(para) pwconv.8.xml:205(para) pwck.8.xml:213(para)
-#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:119(para)
+#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:130(para)
 #: grpck.8.xml:177(para) groupmod.8.xml:182(para) groupmems.8.xml:169(para)
 #: groupdel.8.xml:105(para) groupadd.8.xml:208(para) gpasswd.1.xml:185(para)
 #: faillog.8.xml:184(para) chsh.1.xml:111(para) chpasswd.8.xml:192(para)
@@ -415,18 +409,18 @@ msgstr "<option>-q</option>, <option>--quiet</option>"
 msgid "Indicates which user's tcb shadow file to edit."
 msgstr ""
 
-#: vipw.8.xml:165(title) usermod.8.xml:497(title) userdel.8.xml:171(title)
+#: vipw.8.xml:165(title) usermod.8.xml:496(title) userdel.8.xml:171(title)
 #: useradd.8.xml:647(title) su.1.xml:339(title) sg.1.xml:98(title)
 #: pwconv.8.xml:227(title) pwck.8.xml:252(title) passwd.1.xml:390(title)
 #: newusers.8.xml:362(title) newgrp.1.xml:109(title) login.1.xml:294(title)
 #: grpck.8.xml:209(title) groupmod.8.xml:193(title) groupmems.8.xml:199(title)
-#: groupdel.8.xml:128(title) groupadd.8.xml:219(title)
-#: gpasswd.1.xml:264(title) chsh.1.xml:154(title) chpasswd.8.xml:239(title)
-#: chgpasswd.8.xml:198(title) chfn.1.xml:193(title) chage.1.xml:244(title)
+#: groupdel.8.xml:128(title) groupadd.8.xml:219(title) gpasswd.1.xml:264(title)
+#: chsh.1.xml:154(title) chpasswd.8.xml:239(title) chgpasswd.8.xml:198(title)
+#: chfn.1.xml:193(title) chage.1.xml:244(title)
 msgid "CONFIGURATION"
 msgstr ""
 
-#: vipw.8.xml:166(para) usermod.8.xml:498(para) userdel.8.xml:172(para)
+#: vipw.8.xml:166(para) usermod.8.xml:497(para) userdel.8.xml:172(para)
 #: useradd.8.xml:648(para) su.1.xml:340(para) sg.1.xml:99(para)
 #: pwck.8.xml:253(para) passwd.1.xml:391(para) newusers.8.xml:363(para)
 #: newgrp.1.xml:110(para) login.1.xml:295(para) grpck.8.xml:210(para)
@@ -479,37 +473,35 @@ msgstr ""
 msgid "Editor to be used if <option>VISUAL</option> is not set."
 msgstr ""
 
-#: vipw.8.xml:195(title) usermod.8.xml:514(title) userdel.8.xml:188(title)
+#: vipw.8.xml:195(title) usermod.8.xml:513(title) userdel.8.xml:188(title)
 #: useradd.8.xml:675(title) suauth.5.xml:193(title) su.1.xml:367(title)
 #: sg.1.xml:110(title) shadow.5.xml:255(title) shadow.3.xml:226(title)
 #: pwconv.8.xml:250(title) pwck.8.xml:269(title) porttime.5.xml:130(title)
 #: passwd.5.xml:141(title) passwd.1.xml:408(title) newusers.8.xml:397(title)
 #: newgrp.1.xml:121(title) logoutd.8.xml:89(title)
-#: login.access.5.xml:121(title) login.1.xml:338(title)
-#: limits.5.xml:196(title) lastlog.8.xml:182(title) gshadow.5.xml:156(title)
-#: grpck.8.xml:221(title) groups.1.xml:100(title) groupmod.8.xml:205(title)
-#: groupmems.8.xml:211(title) groupdel.8.xml:140(title)
-#: groupadd.8.xml:233(title) gpasswd.1.xml:279(title) faillog.8.xml:243(title)
-#: faillog.5.xml:96(title) expiry.1.xml:121(title) chsh.1.xml:167(title)
-#: chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title) chfn.1.xml:207(title)
-#: chage.1.xml:256(title)
+#: login.access.5.xml:121(title) login.1.xml:338(title) limits.5.xml:196(title)
+#: lastlog.8.xml:204(title) gshadow.5.xml:156(title) grpck.8.xml:221(title)
+#: groups.1.xml:100(title) groupmod.8.xml:205(title) groupmems.8.xml:211(title)
+#: groupdel.8.xml:140(title) groupadd.8.xml:233(title) gpasswd.1.xml:279(title)
+#: faillog.8.xml:243(title) faillog.5.xml:96(title) expiry.1.xml:121(title)
+#: chsh.1.xml:167(title) chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title)
+#: chfn.1.xml:207(title) chage.1.xml:256(title)
 msgid "FILES"
 msgstr "PLIKI"
 
-#: vipw.8.xml:198(filename) usermod.8.xml:517(filename)
+#: vipw.8.xml:198(filename) usermod.8.xml:516(filename)
 #: userdel.8.xml:191(filename) useradd.8.xml:690(filename)
-#: sg.1.xml:125(filename) pwck.8.xml:272(filename)
-#: newusers.8.xml:412(filename) newgrp.1.xml:136(filename)
-#: gshadow.5.xml:159(filename) grpck.8.xml:224(filename)
-#: groups.1.xml:103(filename) groupmod.8.xml:208(filename)
-#: groupmems.8.xml:214(filename) groupdel.8.xml:143(filename)
-#: groupadd.8.xml:236(filename) gpasswd.1.xml:72(filename)
-#: gpasswd.1.xml:75(filename) gpasswd.1.xml:282(filename)
-#: chgpasswd.8.xml:216(filename)
+#: sg.1.xml:125(filename) pwck.8.xml:272(filename) newusers.8.xml:412(filename)
+#: newgrp.1.xml:136(filename) gshadow.5.xml:159(filename)
+#: grpck.8.xml:224(filename) groups.1.xml:103(filename)
+#: groupmod.8.xml:208(filename) groupmems.8.xml:214(filename)
+#: groupdel.8.xml:143(filename) groupadd.8.xml:236(filename)
+#: gpasswd.1.xml:72(filename) gpasswd.1.xml:75(filename)
+#: gpasswd.1.xml:282(filename) chgpasswd.8.xml:216(filename)
 msgid "/etc/group"
 msgstr "/etc/group"
 
-#: vipw.8.xml:200(para) usermod.8.xml:519(para) userdel.8.xml:193(para)
+#: vipw.8.xml:200(para) usermod.8.xml:518(para) userdel.8.xml:193(para)
 #: useradd.8.xml:692(para) sg.1.xml:127(para) pwck.8.xml:274(para)
 #: newusers.8.xml:414(para) newgrp.1.xml:138(para) gshadow.5.xml:161(para)
 #: grpck.8.xml:226(para) groups.1.xml:105(para) groupmod.8.xml:210(para)
@@ -518,7 +510,7 @@ msgstr "/etc/group"
 msgid "Group account information."
 msgstr "Informacje o grupach użytkowników."
 
-#: vipw.8.xml:204(filename) usermod.8.xml:523(filename)
+#: vipw.8.xml:204(filename) usermod.8.xml:522(filename)
 #: useradd.8.xml:696(filename) sg.1.xml:131(filename)
 #: newusers.8.xml:418(filename) newgrp.1.xml:142(filename)
 #: gshadow.5.xml:165(filename) grpck.8.xml:230(filename)
@@ -529,7 +521,7 @@ msgstr "Informacje o grupach użytkowników."
 msgid "/etc/gshadow"
 msgstr "/etc/gshadow"
 
-#: vipw.8.xml:206(para) usermod.8.xml:525(para) useradd.8.xml:698(para)
+#: vipw.8.xml:206(para) usermod.8.xml:524(para) useradd.8.xml:698(para)
 #: sg.1.xml:133(para) newusers.8.xml:420(para) newgrp.1.xml:144(para)
 #: gshadow.5.xml:167(para) grpck.8.xml:232(para) groupmod.8.xml:216(para)
 #: groupdel.8.xml:151(para) groupadd.8.xml:244(para) gpasswd.1.xml:290(para)
@@ -537,7 +529,7 @@ msgstr "/etc/gshadow"
 msgid "Secure group account information."
 msgstr "Informacje chronione o grupach użytkowników."
 
-#: vipw.8.xml:210(filename) usermod.8.xml:535(filename)
+#: vipw.8.xml:210(filename) usermod.8.xml:534(filename)
 #: userdel.8.xml:203(filename) useradd.8.xml:678(filename)
 #: su.1.xml:370(filename) sg.1.xml:113(filename) shadow.5.xml:258(filename)
 #: pwck.8.xml:278(filename) passwd.5.xml:144(filename)
@@ -550,7 +542,7 @@ msgstr "Informacje chronione o grupach użytkowników."
 msgid "/etc/passwd"
 msgstr "/etc/passwd"
 
-#: vipw.8.xml:212(para) usermod.8.xml:537(para) userdel.8.xml:205(para)
+#: vipw.8.xml:212(para) usermod.8.xml:536(para) userdel.8.xml:205(para)
 #: useradd.8.xml:680(para) su.1.xml:372(para) sg.1.xml:115(para)
 #: shadow.5.xml:260(para) pwck.8.xml:280(para) passwd.5.xml:146(para)
 #: passwd.1.xml:413(para) newusers.8.xml:402(para) newgrp.1.xml:126(para)
@@ -560,7 +552,7 @@ msgstr "/etc/passwd"
 msgid "User account information."
 msgstr "Informacja o kontach użytkowników."
 
-#: vipw.8.xml:216(filename) usermod.8.xml:541(filename)
+#: vipw.8.xml:216(filename) usermod.8.xml:540(filename)
 #: userdel.8.xml:209(filename) useradd.8.xml:684(filename)
 #: su.1.xml:376(filename) sg.1.xml:119(filename) shadow.5.xml:264(filename)
 #: shadow.3.xml:229(filename) pwck.8.xml:284(filename)
@@ -571,7 +563,7 @@ msgstr "Informacja o kontach użytkowników."
 msgid "/etc/shadow"
 msgstr "/etc/shadow"
 
-#: vipw.8.xml:218(para) usermod.8.xml:543(para) userdel.8.xml:211(para)
+#: vipw.8.xml:218(para) usermod.8.xml:542(para) userdel.8.xml:211(para)
 #: useradd.8.xml:686(para) su.1.xml:378(para) sg.1.xml:121(para)
 #: shadow.5.xml:266(para) shadow.3.xml:231(para) pwck.8.xml:286(para)
 #: passwd.1.xml:419(para) newusers.8.xml:408(para) newgrp.1.xml:132(para)
@@ -580,7 +572,7 @@ msgstr "/etc/shadow"
 msgid "Secure user account information."
 msgstr "Informacje chronione o użytkownikach."
 
-#: vipw.8.xml:225(title) usermod.8.xml:562(title) userdel.8.xml:308(title)
+#: vipw.8.xml:225(title) usermod.8.xml:561(title) userdel.8.xml:308(title)
 #: useradd.8.xml:804(title) suauth.5.xml:222(title) su.1.xml:438(title)
 #: sg.1.xml:140(title) shadow.5.xml:283(title) shadow.3.xml:238(title)
 #: pwconv.8.xml:262(title) pwck.8.xml:344(title) porttime.5.xml:142(title)
@@ -655,15 +647,15 @@ msgstr ""
 #: usermod.8.xml:46(surname) userdel.8.xml:46(surname)
 #: useradd.8.xml:57(surname) su.1.xml:57(surname) sg.1.xml:41(surname)
 #: shadow.5.xml:40(surname) shadow.3.xml:40(surname) pwck.8.xml:46(surname)
-#: porttime.5.xml:40(surname) passwd.5.xml:40(surname)
-#: passwd.1.xml:47(surname) newusers.8.xml:55(surname)
-#: newgrp.1.xml:41(surname) logoutd.8.xml:40(surname)
-#: login.defs.5.xml:105(surname) login.1.xml:73(surname)
-#: lastlog.8.xml:41(surname) grpck.8.xml:41(surname) groups.1.xml:40(surname)
-#: groupmod.8.xml:41(surname) groupdel.8.xml:41(surname)
-#: groupadd.8.xml:43(surname) faillog.8.xml:40(surname)
-#: faillog.5.xml:40(surname) expiry.1.xml:44(surname) chsh.1.xml:43(surname)
-#: chpasswd.8.xml:44(surname) chfn.1.xml:43(surname) chage.1.xml:41(surname)
+#: porttime.5.xml:40(surname) passwd.5.xml:40(surname) passwd.1.xml:47(surname)
+#: newusers.8.xml:55(surname) newgrp.1.xml:41(surname)
+#: logoutd.8.xml:40(surname) login.defs.5.xml:105(surname)
+#: login.1.xml:73(surname) lastlog.8.xml:41(surname) grpck.8.xml:41(surname)
+#: groups.1.xml:40(surname) groupmod.8.xml:41(surname)
+#: groupdel.8.xml:41(surname) groupadd.8.xml:43(surname)
+#: faillog.8.xml:40(surname) faillog.5.xml:40(surname) expiry.1.xml:44(surname)
+#: chsh.1.xml:43(surname) chpasswd.8.xml:44(surname) chfn.1.xml:43(surname)
+#: chage.1.xml:41(surname)
 msgid "Haugh"
 msgstr ""
 
@@ -1096,7 +1088,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-v</option>, <option>--add-sub-uids</option>&nbsp;"
+"<option>-v</option>, <option>--add-subuids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
@@ -1125,7 +1117,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-V</option>, <option>--del-sub-uids</option>&nbsp;"
+"<option>-V</option>, <option>--del-subuids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
@@ -1138,8 +1130,8 @@ msgstr ""
 #: usermod.8.xml:409(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-sub-uids</option> and <option>--add-"
-"sub-uids</option> are specified, the removal of all subordinate uid ranges "
+"users account. When both <option>--del-subuids</option> and <option>--add-"
+"subuids</option> are specified, the removal of all subordinate uid ranges "
 "happens before any subordinate uid range is added."
 msgstr ""
 
@@ -1149,7 +1141,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-w</option>, <option>--add-sub-gids</option>&nbsp;"
+"<option>-w</option>, <option>--add-subgids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
@@ -1172,7 +1164,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-W</option>, <option>--del-sub-gids</option>&nbsp;"
+"<option>-W</option>, <option>--del-subgids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
@@ -1185,8 +1177,8 @@ msgstr ""
 #: usermod.8.xml:447(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-sub-gids</option> and <option>--add-"
-"sub-gids</option> are specified, the removal of all subordinate gid ranges "
+"users account. When both <option>--del-subgids</option> and <option>--add-"
+"subgids</option> are specified, the removal of all subordinate gid ranges "
 "happens before any subordinate gid range is added."
 msgstr ""
 
@@ -1217,9 +1209,9 @@ msgstr ""
 
 #: usermod.8.xml:478(title) userdel.8.xml:281(title) useradd.8.xml:623(title)
 #: su.1.xml:331(title) shadow.3.xml:218(title) passwd.1.xml:372(title)
-#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:194(title)
-#: groupdel.8.xml:116(title) groupadd.8.xml:257(title)
-#: gpasswd.1.xml:252(title) faillog.8.xml:232(title) chpasswd.8.xml:231(title)
+#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:216(title)
+#: groupdel.8.xml:116(title) groupadd.8.xml:257(title) gpasswd.1.xml:252(title)
+#: faillog.8.xml:232(title) chpasswd.8.xml:231(title)
 #: chgpasswd.8.xml:186(title)
 msgid "CAVEATS"
 msgstr "OSTRZEŻENIA"
@@ -1229,17 +1221,17 @@ msgid ""
 "You must make certain that the named user is not executing any processes "
 "when this command is being executed if the user's numerical user ID, the "
 "user's name, or the user's home directory is being changed. "
-"<command>usermod</command> checks this on Linux, but only check if the user "
-"is logged in according to utmp on other architectures."
+"<command>usermod</command> checks this on Linux. On other platforms it only "
+"uses utmp to check if the user is logged in."
 msgstr ""
 
-#: usermod.8.xml:487(para)
+#: usermod.8.xml:486(para)
 msgid ""
 "You must change the owner of any <command>crontab</command> files or "
 "<command>at</command> jobs manually."
 msgstr ""
 
-#: usermod.8.xml:491(para)
+#: usermod.8.xml:490(para)
 msgid "You must make any changes involving NIS on the NIS server."
 msgstr ""
 
@@ -1455,7 +1447,7 @@ msgid ""
 "algorithm: <placeholder-1/>"
 msgstr ""
 
-#: usermod.8.xml:529(filename) userdel.8.xml:197(filename)
+#: usermod.8.xml:528(filename) userdel.8.xml:197(filename)
 #: useradd.8.xml:726(filename) su.1.xml:382(filename)
 #: pwconv.8.xml:253(filename) passwd.1.xml:423(filename)
 #: newusers.8.xml:424(filename) login.access.5.xml:124(filename)
@@ -1466,7 +1458,7 @@ msgstr ""
 msgid "/etc/login.defs"
 msgstr "/etc/login.defs"
 
-#: usermod.8.xml:531(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
+#: usermod.8.xml:530(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
 #: su.1.xml:384(para) pwconv.8.xml:255(para) passwd.1.xml:425(para)
 #: newusers.8.xml:426(para) login.access.5.xml:126(para) login.1.xml:391(para)
 #: groupmod.8.xml:222(para) groupadd.8.xml:250(para) chsh.1.xml:184(para)
@@ -1474,31 +1466,31 @@ msgstr "/etc/login.defs"
 msgid "Shadow password suite configuration."
 msgstr "Konfiguracja pakietu shadow."
 
-#: usermod.8.xml:547(filename) userdel.8.xml:215(filename)
+#: usermod.8.xml:546(filename) userdel.8.xml:215(filename)
 #: useradd.8.xml:714(filename) newusers.8.xml:436(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subgid"
 msgstr "/etc/suauth"
 
-#: usermod.8.xml:549(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
+#: usermod.8.xml:548(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
 #: newusers.8.xml:438(para)
 msgid "Per user subordinate group IDs."
 msgstr ""
 
-#: usermod.8.xml:553(filename) userdel.8.xml:221(filename)
+#: usermod.8.xml:552(filename) userdel.8.xml:221(filename)
 #: useradd.8.xml:720(filename) newusers.8.xml:442(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subuid"
 msgstr "/etc/suauth"
 
-#: usermod.8.xml:555(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
+#: usermod.8.xml:554(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
 #: newusers.8.xml:444(para)
 msgid "Per user subordinate user IDs."
 msgstr ""
 
-#: usermod.8.xml:563(para)
+#: usermod.8.xml:562(para)
 #, fuzzy
 #| msgid ""
 #| "<citerefentry><refentrytitle>chfn</refentrytitle><manvolnum>1</"
@@ -1731,9 +1723,8 @@ msgstr "poprawne zakończenie działania programu"
 #: passwd.1.xml:449(replaceable) newgrp.1.xml:59(manvolnum)
 #: login.1.xml:91(manvolnum) grpck.8.xml:256(replaceable)
 #: groups.1.xml:58(manvolnum) gpasswd.1.xml:63(manvolnum)
-#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum)
-#: chfn.1.xml:61(manvolnum) chage.1.xml:59(manvolnum)
-#: chage.1.xml:289(replaceable)
+#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum) chfn.1.xml:61(manvolnum)
+#: chage.1.xml:59(manvolnum) chage.1.xml:289(replaceable)
 msgid "1"
 msgstr "1"
 
@@ -2099,7 +2090,7 @@ msgid ""
 "<option>PASS_MAX_DAYS</option> and others). <placeholder-1/> Example: "
 "<option>-K</option>&nbsp;<replaceable>PASS_MAX_DAYS</"
 "replaceable>=<replaceable>-1</replaceable> can be used when creating system "
-"account to turn off password ageing, even though system account has no "
+"account to turn off password aging, even though system account has no "
 "password at all. Multiple <option>-K</option> options can be specified, e."
 "g.: <option>-K</option>&nbsp;<replaceable>UID_MIN</"
 "replaceable>=<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;"
@@ -2119,7 +2110,7 @@ msgstr ""
 #: useradd.8.xml:327(para)
 msgid ""
 "By default, the user's entries in the lastlog and faillog databases are "
-"resetted to avoid reusing the entry from a previously deleted user."
+"reset to avoid reusing the entry from a previously deleted user."
 msgstr ""
 
 #: useradd.8.xml:335(term)
@@ -2139,11 +2130,11 @@ msgid ""
 "is not enabled, no home directories are created."
 msgstr ""
 
-#: useradd.8.xml:354(option)
+#: useradd.8.xml:353(term)
 #, fuzzy
-#| msgid "-"
-msgid "-M"
-msgstr "-"
+#| msgid "<option>-m</option>, <option>--create-home</option>"
+msgid "<option>-M</option>, <option>--no-create-home</option>"
+msgstr "<option>-m</option>, <option>--create-home</option>"
 
 #: useradd.8.xml:357(para)
 msgid ""
@@ -2218,10 +2209,10 @@ msgstr ""
 #: useradd.8.xml:434(para)
 msgid ""
 "Note that <command>useradd</command> will not create a home directory for "
-"such an user, regardless of the default setting in <filename>/etc/login."
-"defs</filename> (<option>CREATE_HOME</option>). You have to specify the "
-"<option>-m</option> options if you want a home directory for a system "
-"account to be created."
+"such a user, regardless of the default setting in <filename>/etc/login.defs</"
+"filename> (<option>CREATE_HOME</option>). You have to specify the <option>-"
+"m</option> options if you want a home directory for a system account to be "
+"created."
 msgstr ""
 
 #: useradd.8.xml:461(para)
@@ -2766,7 +2757,7 @@ msgstr ""
 #, no-wrap
 msgid ""
 "\n"
-"      1) the user su is targetting\n"
+"      1) the user su is targeting\n"
 "    "
 msgstr ""
 
@@ -2800,12 +2791,12 @@ msgstr ""
 #: suauth.5.xml:107(para)
 msgid ""
 "from-id is formatted the same as to-id except the extra word "
-"<emphasis>GROUP</emphasis> is recognised. <emphasis>ALL EXCEPT GROUP</"
+"<emphasis>GROUP</emphasis> is recognized. <emphasis>ALL EXCEPT GROUP</"
 "emphasis> is perfectly valid too. Following <emphasis>GROUP</emphasis> "
 "appears one or more group names, delimited by \",\". It is not sufficient to "
 "have primary group id of the relevant group, an entry in "
 "<citerefentry><refentrytitle>/etc/group</refentrytitle><manvolnum>5</"
-"manvolnum></citerefentry> is neccessary."
+"manvolnum></citerefentry> is necessary."
 msgstr ""
 
 #: suauth.5.xml:118(para)
@@ -2910,9 +2901,8 @@ msgstr ""
 "citerefentry>."
 
 #: su.1.xml:58(contrib) shadow.5.xml:41(contrib) shadow.3.xml:41(contrib)
-#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib)
-#: passwd.1.xml:48(contrib) login.1.xml:74(contrib) faillog.8.xml:41(contrib)
-#: faillog.5.xml:41(contrib)
+#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib) passwd.1.xml:48(contrib)
+#: login.1.xml:74(contrib) faillog.8.xml:41(contrib) faillog.5.xml:41(contrib)
 msgid "Creation, 1989"
 msgstr ""
 
@@ -3008,7 +2998,7 @@ msgstr ""
 #: su.1.xml:158(para)
 msgid ""
 "The executed command will have no controlling terminal. This option cannot "
-"be used to execute interractive programs which need a controlling TTY."
+"be used to execute interactive programs which need a controlling TTY."
 msgstr ""
 
 #: su.1.xml:168(term)
@@ -3612,7 +3602,7 @@ msgstr ""
 
 #: shadow.5.xml:117(para) gshadow.5.xml:107(para)
 msgid ""
-"A password field which starts with a exclamation mark means that the "
+"A password field which starts with an exclamation mark means that the "
 "password is locked. The remaining characters on the line represent the "
 "password field before the password was locked."
 msgstr ""
@@ -3630,7 +3620,7 @@ msgstr ""
 #: shadow.5.xml:134(para)
 msgid ""
 "The value 0 has a special meaning, which is that the user should change her "
-"pasword the next time she will log in the system."
+"password the next time she will log in the system."
 msgstr ""
 
 #: shadow.5.xml:139(para)
@@ -3732,7 +3722,7 @@ msgstr ""
 #: shadow.5.xml:229(para)
 msgid ""
 "Note that an account expiration differs from a password expiration. In case "
-"of an acount expiration, the user shall not be allowed to login. In case of "
+"of an account expiration, the user shall not be allowed to login. In case of "
 "a password expiration, the user is not allowed to login using her password."
 msgstr ""
 
@@ -4026,18 +4016,15 @@ msgstr ""
 msgid "pwconv"
 msgstr "pwconv"
 
-#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command)
-#: login.defs.5.xml:438(term)
+#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command) login.defs.5.xml:438(term)
 msgid "pwunconv"
 msgstr "pwunconv"
 
-#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command)
-#: login.defs.5.xml:340(term)
+#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command) login.defs.5.xml:340(term)
 msgid "grpconv"
 msgstr "grpconv"
 
-#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command)
-#: login.defs.5.xml:346(term)
+#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command) login.defs.5.xml:346(term)
 msgid "grpunconv"
 msgstr "grpunconv"
 
@@ -4210,8 +4197,7 @@ msgstr ""
 
 #: pwck.8.xml:80(replaceable) passwd.5.xml:57(refentrytitle)
 #: passwd.5.xml:64(refname) passwd.1.xml:64(refentrytitle)
-#: passwd.1.xml:71(refname) passwd.1.xml:77(command)
-#: login.defs.5.xml:409(term)
+#: passwd.1.xml:71(refname) passwd.1.xml:77(command) login.defs.5.xml:409(term)
 msgid "passwd"
 msgstr "passwd"
 
@@ -4361,7 +4347,7 @@ msgstr ""
 msgid ""
 "Note that when <option>USE_TCB</option> is enabled, you cannot specify an "
 "alternative <replaceable>shadow</replaceable> file. In future releases, this "
-"paramater could be replaced by an alternate TCB directory."
+"parameter could be replaced by an alternate TCB directory."
 msgstr ""
 
 #: pwck.8.xml:312(para)
@@ -4755,7 +4741,7 @@ msgstr ""
 
 #: passwd.1.xml:166(para)
 msgid ""
-"You can find advices on how to choose a strong password on http://en."
+"You can find advice on how to choose a strong password on http://en."
 "wikipedia.org/wiki/Password_strength"
 msgstr ""
 
@@ -5067,8 +5053,8 @@ msgstr "PASS_MIN_DAYS (numer)"
 #: passwd.1.xml:35(para) login.defs.5.xml:35(para)
 msgid ""
 "Number of significant characters in the password for crypt(). "
-"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your crypt"
-"() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
+"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your "
+"crypt() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
 "<replaceable>yes</replaceable>."
 msgstr ""
 
@@ -5226,7 +5212,7 @@ msgid "HISTORY"
 msgstr ""
 
 #: nologin.8.xml:91(para)
-msgid "The <command>nologin</command> command appearred in BSD 4.4."
+msgid "The <command>nologin</command> command appeared in BSD 4.4."
 msgstr ""
 
 #: newusers.8.xml:72(refentrytitle) newusers.8.xml:79(refname)
@@ -5282,7 +5268,7 @@ msgstr ""
 
 #: newusers.8.xml:116(para)
 msgid ""
-"It can be the name of a new user or the name of an existing user (or an user "
+"It can be the name of a new user or the name of an existing user (or a user "
 "created before by <command>newusers</command>). In case of an existing user, "
 "the user's information will be changed, otherwise a new user will be created."
 msgstr ""
@@ -5310,7 +5296,7 @@ msgstr ""
 
 #: newusers.8.xml:144(para)
 msgid ""
-"If the field is empty, an new (unused) UID will be defined automatically by "
+"If the field is empty, a new (unused) UID will be defined automatically by "
 "<command>newusers</command>."
 msgstr ""
 
@@ -5320,7 +5306,7 @@ msgstr ""
 
 #: newusers.8.xml:152(para)
 msgid ""
-"If this field contains the name of an existing user (or the name of an user "
+"If this field contains the name of an existing user (or the name of a user "
 "created before by <command>newusers</command>), the UID of the specified "
 "user will be used."
 msgstr ""
@@ -6618,7 +6604,7 @@ msgid "D: max data size (KB)"
 msgstr ""
 
 #: limits.5.xml:111(para)
-msgid "F: maximum filesize (KB)"
+msgid "F: maximum file size (KB)"
 msgstr ""
 
 #: limits.5.xml:112(para)
@@ -6692,7 +6678,7 @@ msgstr ""
 #: limits.5.xml:145(para)
 msgid ""
 "Be aware that after <emphasis remap=\"I\">username</emphasis> the rest of "
-"the line is considered a limit string, thus comments are not allowed. A "
+"the line is considered a limit string, thus comments are not allowed. An "
 "invalid limits string will be rejected (not considered) by the "
 "<command>login</command> program."
 msgstr ""
@@ -6716,13 +6702,13 @@ msgstr ""
 
 #: limits.5.xml:165(para)
 msgid ""
-"If more than one line with limits for an user exist, only the first line for "
+"If more than one line with limits for a user exist, only the first line for "
 "this user will be considered."
 msgstr ""
 
 #: limits.5.xml:170(para)
 msgid ""
-"If no lines are specified for an user, the last <replaceable>@group</"
+"If no lines are specified for a user, the last <replaceable>@group</"
 "replaceable> line matching a group whose the user is a member of will be "
 "considered, or the last line with default limits if no groups contain the "
 "user."
@@ -6810,7 +6796,33 @@ msgstr ""
 "Wyświetlenie rekordów lastlog starszych niż zadana <emphasis remap=\"I"
 "\">DNI</emphasis>."
 
-#: lastlog.8.xml:127(term) faillog.8.xml:192(term)
+#: lastlog.8.xml:107(term)
+#, fuzzy
+#| msgid "<option>-q</option>, <option>--quiet</option>"
+msgid "<option>-C</option>, <option>--clear</option>"
+msgstr "<option>-q</option>, <option>--quiet</option>"
+
+#: lastlog.8.xml:111(para)
+#, fuzzy
+#| msgid "<option>-m</option>, <option>--create-home</option>"
+msgid ""
+"Clear lastlog record of a user. This option can be used only together with "
+"<option>-u</option> (<option>--user</option>))."
+msgstr "<option>-m</option>, <option>--create-home</option>"
+
+#: lastlog.8.xml:138(term)
+#, fuzzy
+#| msgid "<option>-r</option>, <option>--reset</option>"
+msgid "<option>-S</option>, <option>--set</option>"
+msgstr "<option>-r</option>, <option>--reset</option>"
+
+#: lastlog.8.xml:142(para)
+msgid ""
+"Set lastlog record of a user to the current time. This option can be used "
+"only together with <option>-u</option> (<option>--user</option>))."
+msgstr ""
+
+#: lastlog.8.xml:149(term) faillog.8.xml:192(term)
 msgid ""
 "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAYS</"
 "replaceable>"
@@ -6818,7 +6830,7 @@ msgstr ""
 "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DNI</"
 "replaceable>"
 
-#: lastlog.8.xml:131(para)
+#: lastlog.8.xml:153(para)
 msgid ""
 "Print the lastlog records more recent than <emphasis remap=\"I\">DAYS</"
 "emphasis>."
@@ -6826,7 +6838,7 @@ msgstr ""
 "Wyświetlenie rekordów lastlog nie starszych niż zadana ilość <emphasis remap="
 "\"I\">DNI</emphasis>."
 
-#: lastlog.8.xml:138(term) faillog.8.xml:202(term)
+#: lastlog.8.xml:160(term) faillog.8.xml:202(term)
 #, fuzzy
 #| msgid ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
@@ -6838,7 +6850,7 @@ msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
 "replaceable>=<replaceable>WARTOŚĆ</replaceable>"
 
-#: lastlog.8.xml:142(para)
+#: lastlog.8.xml:164(para)
 #, fuzzy
 #| msgid ""
 #| "Print the lastlog record for user with specified <emphasis remap=\"I"
@@ -6848,7 +6860,7 @@ msgstr ""
 "Wyświetlenie informacji o ostanim logowaniu dla użytkownika "
 "<replaceable>LOGIN</replaceable>."
 
-#: lastlog.8.xml:145(para) faillog.8.xml:211(para)
+#: lastlog.8.xml:167(para) faillog.8.xml:211(para)
 msgid ""
 "The users can be specified by a login name, a numerical user ID, or a "
 "<replaceable>RANGE</replaceable> of users. This <replaceable>RANGE</"
@@ -6857,7 +6869,7 @@ msgid ""
 "UID_MAX</replaceable>), or a min value (<replaceable>UID_MIN-</replaceable>)."
 msgstr ""
 
-#: lastlog.8.xml:157(para)
+#: lastlog.8.xml:179(para)
 msgid ""
 "If the user has never logged in the message <emphasis>** Never logged in**</"
 "emphasis> will be displayed instead of the port and time."
@@ -6866,18 +6878,18 @@ msgstr ""
 "logowania wyświetlany jest komunikat <emphasis>**Nigdy nie zalogowany**</"
 "emphasis> (użytkownik nigdy się nie logował)."
 
-#: lastlog.8.xml:162(para)
+#: lastlog.8.xml:184(para)
 msgid ""
 "Only the entries for the current users of the system will be displayed. "
 "Other entries may exist for users that were deleted previously."
 msgstr ""
 
-#: lastlog.8.xml:170(title) groups.1.xml:90(title) chsh.1.xml:140(title)
+#: lastlog.8.xml:192(title) groups.1.xml:90(title) chsh.1.xml:140(title)
 #: chage.1.xml:231(title)
 msgid "NOTE"
 msgstr "UWAGI"
 
-#: lastlog.8.xml:171(para)
+#: lastlog.8.xml:193(para)
 msgid ""
 "The <filename>lastlog</filename> file is a database which contains info on "
 "the last login of each user. You should not rotate it. It is a sparse file, "
@@ -6895,15 +6907,15 @@ msgstr ""
 "wartościami UID). Mozesz wyświetlić rzeczywisty rozmiar tego pliku używając "
 "polecenia \"<command>ls -s</command>\"."
 
-#: lastlog.8.xml:185(filename)
+#: lastlog.8.xml:207(filename)
 msgid "/var/log/lastlog"
 msgstr "/var/log/lastlog"
 
-#: lastlog.8.xml:187(para)
+#: lastlog.8.xml:209(para)
 msgid "Database times of previous user logins."
 msgstr "Baza danych ostatnich logowań użytkowników."
 
-#: lastlog.8.xml:195(para)
+#: lastlog.8.xml:217(para)
 msgid ""
 "Large gaps in UID numbers will cause the lastlog program to run longer with "
 "no output to the screen (i.e. if in lastlog database there is no entries for "
@@ -6964,7 +6976,7 @@ msgstr ""
 #| "modified using the <citerefentry><refentrytitle>chfn</"
 #| "refentrytitle><manvolnum>1</manvolnum></citerefentry> utility."
 msgid ""
-"The password is used when an user who is not a member of the group wants to "
+"The password is used when a user who is not a member of the group wants to "
 "gain the permissions of this group (see <citerefentry><refentrytitle>newgrp</"
 "refentrytitle><manvolnum>1</manvolnum></citerefentry>)."
 msgstr ""
@@ -7473,7 +7485,7 @@ msgstr ""
 "replaceable>"
 
 #: groupmems.8.xml:109(para)
-msgid "Add an user to the group membership list."
+msgid "Add a user to the group membership list."
 msgstr ""
 
 #: groupmems.8.xml:110(para) groupmems.8.xml:126(para)
@@ -8461,7 +8473,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> or <option>MD5_CRYPT_ENAB</option> variables "
-"of <filename>/etc/login.defs</filename>, and can be overwitten with the "
+"of <filename>/etc/login.defs</filename>, and can be overwritten with the "
 "<option>-e</option>, <option>-m</option>, or <option>-c</option> options."
 msgstr ""
 
@@ -8476,7 +8488,7 @@ msgstr ""
 msgid ""
 "<phrase condition=\"pam\">Except when PAM is used to encrypt the passwords,</"
 "phrase><command>chpasswd</command> first updates all the passwords in "
-"memory, and then commits all the changes to disk if no errors occured for "
+"memory, and then commits all the changes to disk if no errors occurred for "
 "any user."
 msgstr ""
 
@@ -8643,7 +8655,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> variable of <filename>/etc/login.defs</"
-"filename>, and can be overwiten with the <option>-e</option>, <option>-m</"
+"filename>, and can be overwritten with the <option>-e</option>, <option>-m</"
 "option>, or <option>-c</option> options."
 msgstr ""
 
@@ -9028,6 +9040,11 @@ msgstr ""
 msgid "translator-credits"
 msgstr "Tomasz Kłoczko <kloczek@pld.org.pl>, 2006"
 
+#, fuzzy
+#~| msgid "-"
+#~ msgid "-M"
+#~ msgstr "-"
+
 #~ msgid ""
 #~ "<citerefentry><refentrytitle>chfn</refentrytitle><manvolnum>1</"
 #~ "manvolnum></citerefentry>, <citerefentry><refentrytitle>chsh</"

man/po/shadow-man-pages.pot

@@ -1,7 +1,7 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
-"POT-Creation-Date: 2013-08-23 01:54+0200\n"
+"POT-Creation-Date: 2016-09-18 14:03-0500\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -105,11 +105,11 @@ msgstr ""
 msgid "Edit group database."
 msgstr ""
 
-#: vipw.8.xml:120(term) userdel.8.xml:123(term) useradd.8.xml:266(term) pwconv.8.xml:195(term) pwck.8.xml:186(term) passwd.1.xml:214(term) newusers.8.xml:283(term) lastlog.8.xml:107(term) grpck.8.xml:157(term) groupmod.8.xml:129(term) groupmems.8.xml:142(term) groupdel.8.xml:95(term) groupadd.8.xml:131(term) gpasswd.1.xml:173(term) faillog.8.xml:122(term) expiry.1.xml:112(term) chsh.1.xml:101(term) chpasswd.8.xml:171(term) chgpasswd.8.xml:131(term) chage.1.xml:129(term)
+#: vipw.8.xml:120(term) userdel.8.xml:123(term) useradd.8.xml:266(term) pwconv.8.xml:195(term) pwck.8.xml:186(term) passwd.1.xml:214(term) newusers.8.xml:283(term) lastlog.8.xml:118(term) grpck.8.xml:157(term) groupmod.8.xml:129(term) groupmems.8.xml:142(term) groupdel.8.xml:95(term) groupadd.8.xml:131(term) gpasswd.1.xml:173(term) faillog.8.xml:122(term) expiry.1.xml:112(term) chsh.1.xml:101(term) chpasswd.8.xml:171(term) chgpasswd.8.xml:131(term) chage.1.xml:129(term)
 msgid "<option>-h</option>, <option>--help</option>"
 msgstr ""
 
-#: vipw.8.xml:122(para) userdel.8.xml:125(para) useradd.8.xml:268(para) pwconv.8.xml:197(para) pwck.8.xml:188(para) passwd.1.xml:216(para) newusers.8.xml:285(para) lastlog.8.xml:111(para) grpck.8.xml:159(para) groupmod.8.xml:131(para) groupmems.8.xml:144(para) groupdel.8.xml:97(para) groupadd.8.xml:133(para) gpasswd.1.xml:175(para) faillog.8.xml:124(para) expiry.1.xml:114(para) chsh.1.xml:103(para) chpasswd.8.xml:173(para) chgpasswd.8.xml:133(para) chfn.1.xml:169(para) chage.1.xml:131(para)
+#: vipw.8.xml:122(para) userdel.8.xml:125(para) useradd.8.xml:268(para) pwconv.8.xml:197(para) pwck.8.xml:188(para) passwd.1.xml:216(para) newusers.8.xml:285(para) lastlog.8.xml:122(para) grpck.8.xml:159(para) groupmod.8.xml:131(para) groupmems.8.xml:144(para) groupdel.8.xml:97(para) groupadd.8.xml:133(para) gpasswd.1.xml:175(para) faillog.8.xml:124(para) expiry.1.xml:114(para) chsh.1.xml:103(para) chpasswd.8.xml:173(para) chgpasswd.8.xml:133(para) chfn.1.xml:169(para) chage.1.xml:131(para)
 msgid "Display help message and exit."
 msgstr ""
 
@@ -129,11 +129,11 @@ msgstr ""
 msgid "Quiet mode."
 msgstr ""
 
-#: vipw.8.xml:138(term) usermod.8.xml:311(term) userdel.8.xml:146(term) useradd.8.xml:445(term) pwconv.8.xml:201(term) pwck.8.xml:209(term) passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:115(term) grpck.8.xml:173(term) groupmod.8.xml:178(term) groupmems.8.xml:165(term) groupdel.8.xml:101(term) groupadd.8.xml:204(term) faillog.8.xml:180(term) chsh.1.xml:107(term) chpasswd.8.xml:188(term) chgpasswd.8.xml:146(term) chfn.1.xml:153(term) chage.1.xml:197(term)
+#: vipw.8.xml:138(term) usermod.8.xml:311(term) userdel.8.xml:146(term) useradd.8.xml:445(term) pwconv.8.xml:201(term) pwck.8.xml:209(term) passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:126(term) grpck.8.xml:173(term) groupmod.8.xml:178(term) groupmems.8.xml:165(term) groupdel.8.xml:101(term) groupadd.8.xml:204(term) faillog.8.xml:180(term) chsh.1.xml:107(term) chpasswd.8.xml:188(term) chgpasswd.8.xml:146(term) chfn.1.xml:153(term) chage.1.xml:197(term)
 msgid "<option>-R</option>, <option>--root</option>&nbsp;<replaceable>CHROOT_DIR</replaceable>"
 msgstr ""
 
-#: vipw.8.xml:142(para) usermod.8.xml:315(para) userdel.8.xml:150(para) useradd.8.xml:449(para) pwconv.8.xml:205(para) pwck.8.xml:213(para) passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:119(para) grpck.8.xml:177(para) groupmod.8.xml:182(para) groupmems.8.xml:169(para) groupdel.8.xml:105(para) groupadd.8.xml:208(para) gpasswd.1.xml:185(para) faillog.8.xml:184(para) chsh.1.xml:111(para) chpasswd.8.xml:192(para) chgpasswd.8.xml:150(para) chfn.1.xml:157(para) chage.1.xml:201(para)
+#: vipw.8.xml:142(para) usermod.8.xml:315(para) userdel.8.xml:150(para) useradd.8.xml:449(para) pwconv.8.xml:205(para) pwck.8.xml:213(para) passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:130(para) grpck.8.xml:177(para) groupmod.8.xml:182(para) groupmems.8.xml:169(para) groupdel.8.xml:105(para) groupadd.8.xml:208(para) gpasswd.1.xml:185(para) faillog.8.xml:184(para) chsh.1.xml:111(para) chpasswd.8.xml:192(para) chgpasswd.8.xml:150(para) chfn.1.xml:157(para) chage.1.xml:201(para)
 msgid "Apply changes in the <replaceable>CHROOT_DIR</replaceable> directory and use the configuration files from the <replaceable>CHROOT_DIR</replaceable> directory."
 msgstr ""
 
@@ -153,11 +153,11 @@ msgstr ""
 msgid "Indicates which user's tcb shadow file to edit."
 msgstr ""
 
-#: vipw.8.xml:165(title) usermod.8.xml:497(title) userdel.8.xml:171(title) useradd.8.xml:647(title) su.1.xml:339(title) sg.1.xml:98(title) pwconv.8.xml:227(title) pwck.8.xml:252(title) passwd.1.xml:390(title) newusers.8.xml:362(title) newgrp.1.xml:109(title) login.1.xml:294(title) grpck.8.xml:209(title) groupmod.8.xml:193(title) groupmems.8.xml:199(title) groupdel.8.xml:128(title) groupadd.8.xml:219(title) gpasswd.1.xml:264(title) chsh.1.xml:154(title) chpasswd.8.xml:239(title) chgpasswd.8.xml:198(title) chfn.1.xml:193(title) chage.1.xml:244(title)
+#: vipw.8.xml:165(title) usermod.8.xml:496(title) userdel.8.xml:171(title) useradd.8.xml:647(title) su.1.xml:339(title) sg.1.xml:98(title) pwconv.8.xml:227(title) pwck.8.xml:252(title) passwd.1.xml:390(title) newusers.8.xml:362(title) newgrp.1.xml:109(title) login.1.xml:294(title) grpck.8.xml:209(title) groupmod.8.xml:193(title) groupmems.8.xml:199(title) groupdel.8.xml:128(title) groupadd.8.xml:219(title) gpasswd.1.xml:264(title) chsh.1.xml:154(title) chpasswd.8.xml:239(title) chgpasswd.8.xml:198(title) chfn.1.xml:193(title) chage.1.xml:244(title)
 msgid "CONFIGURATION"
 msgstr ""
 
-#: vipw.8.xml:166(para) usermod.8.xml:498(para) userdel.8.xml:172(para) useradd.8.xml:648(para) su.1.xml:340(para) sg.1.xml:99(para) pwck.8.xml:253(para) passwd.1.xml:391(para) newusers.8.xml:363(para) newgrp.1.xml:110(para) login.1.xml:295(para) grpck.8.xml:210(para) groupmod.8.xml:194(para) groupmems.8.xml:200(para) groupdel.8.xml:129(para) groupadd.8.xml:220(para) gpasswd.1.xml:265(para) chsh.1.xml:155(para) chpasswd.8.xml:240(para) chgpasswd.8.xml:199(para) chfn.1.xml:194(para) chage.1.xml:245(para)
+#: vipw.8.xml:166(para) usermod.8.xml:497(para) userdel.8.xml:172(para) useradd.8.xml:648(para) su.1.xml:340(para) sg.1.xml:99(para) pwck.8.xml:253(para) passwd.1.xml:391(para) newusers.8.xml:363(para) newgrp.1.xml:110(para) login.1.xml:295(para) grpck.8.xml:210(para) groupmod.8.xml:194(para) groupmems.8.xml:200(para) groupdel.8.xml:129(para) groupadd.8.xml:220(para) gpasswd.1.xml:265(para) chsh.1.xml:155(para) chpasswd.8.xml:240(para) chgpasswd.8.xml:199(para) chfn.1.xml:194(para) chage.1.xml:245(para)
 msgid "The following configuration variables in <filename>/etc/login.defs</filename> change the behavior of this tool:"
 msgstr ""
 
@@ -189,43 +189,43 @@ msgstr ""
 msgid "Editor to be used if <option>VISUAL</option> is not set."
 msgstr ""
 
-#: vipw.8.xml:195(title) usermod.8.xml:514(title) userdel.8.xml:188(title) useradd.8.xml:675(title) suauth.5.xml:193(title) su.1.xml:367(title) sg.1.xml:110(title) shadow.5.xml:255(title) shadow.3.xml:226(title) pwconv.8.xml:250(title) pwck.8.xml:269(title) porttime.5.xml:130(title) passwd.5.xml:141(title) passwd.1.xml:408(title) newusers.8.xml:397(title) newgrp.1.xml:121(title) logoutd.8.xml:89(title) login.access.5.xml:121(title) login.1.xml:338(title) limits.5.xml:196(title) lastlog.8.xml:182(title) gshadow.5.xml:156(title) grpck.8.xml:221(title) groups.1.xml:100(title) groupmod.8.xml:205(title) groupmems.8.xml:211(title) groupdel.8.xml:140(title) groupadd.8.xml:233(title) gpasswd.1.xml:279(title) faillog.8.xml:243(title) faillog.5.xml:96(title) expiry.1.xml:121(title) chsh.1.xml:167(title) chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title) chfn.1.xml:207(title) chage.1.xml:256(title)
+#: vipw.8.xml:195(title) usermod.8.xml:513(title) userdel.8.xml:188(title) useradd.8.xml:675(title) suauth.5.xml:193(title) su.1.xml:367(title) sg.1.xml:110(title) shadow.5.xml:255(title) shadow.3.xml:226(title) pwconv.8.xml:250(title) pwck.8.xml:269(title) porttime.5.xml:130(title) passwd.5.xml:141(title) passwd.1.xml:408(title) newusers.8.xml:397(title) newgrp.1.xml:121(title) logoutd.8.xml:89(title) login.access.5.xml:121(title) login.1.xml:338(title) limits.5.xml:196(title) lastlog.8.xml:204(title) gshadow.5.xml:156(title) grpck.8.xml:221(title) groups.1.xml:100(title) groupmod.8.xml:205(title) groupmems.8.xml:211(title) groupdel.8.xml:140(title) groupadd.8.xml:233(title) gpasswd.1.xml:279(title) faillog.8.xml:243(title) faillog.5.xml:96(title) expiry.1.xml:121(title) chsh.1.xml:167(title) chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title) chfn.1.xml:207(title) chage.1.xml:256(title)
 msgid "FILES"
 msgstr ""
 
-#: vipw.8.xml:198(filename) usermod.8.xml:517(filename) userdel.8.xml:191(filename) useradd.8.xml:690(filename) sg.1.xml:125(filename) pwck.8.xml:272(filename) newusers.8.xml:412(filename) newgrp.1.xml:136(filename) gshadow.5.xml:159(filename) grpck.8.xml:224(filename) groups.1.xml:103(filename) groupmod.8.xml:208(filename) groupmems.8.xml:214(filename) groupdel.8.xml:143(filename) groupadd.8.xml:236(filename) gpasswd.1.xml:72(filename) gpasswd.1.xml:75(filename) gpasswd.1.xml:282(filename) chgpasswd.8.xml:216(filename)
+#: vipw.8.xml:198(filename) usermod.8.xml:516(filename) userdel.8.xml:191(filename) useradd.8.xml:690(filename) sg.1.xml:125(filename) pwck.8.xml:272(filename) newusers.8.xml:412(filename) newgrp.1.xml:136(filename) gshadow.5.xml:159(filename) grpck.8.xml:224(filename) groups.1.xml:103(filename) groupmod.8.xml:208(filename) groupmems.8.xml:214(filename) groupdel.8.xml:143(filename) groupadd.8.xml:236(filename) gpasswd.1.xml:72(filename) gpasswd.1.xml:75(filename) gpasswd.1.xml:282(filename) chgpasswd.8.xml:216(filename)
 msgid "/etc/group"
 msgstr ""
 
-#: vipw.8.xml:200(para) usermod.8.xml:519(para) userdel.8.xml:193(para) useradd.8.xml:692(para) sg.1.xml:127(para) pwck.8.xml:274(para) newusers.8.xml:414(para) newgrp.1.xml:138(para) gshadow.5.xml:161(para) grpck.8.xml:226(para) groups.1.xml:105(para) groupmod.8.xml:210(para) groupmems.8.xml:216(para) groupdel.8.xml:145(para) groupadd.8.xml:238(para) gpasswd.1.xml:284(para) chgpasswd.8.xml:218(para)
+#: vipw.8.xml:200(para) usermod.8.xml:518(para) userdel.8.xml:193(para) useradd.8.xml:692(para) sg.1.xml:127(para) pwck.8.xml:274(para) newusers.8.xml:414(para) newgrp.1.xml:138(para) gshadow.5.xml:161(para) grpck.8.xml:226(para) groups.1.xml:105(para) groupmod.8.xml:210(para) groupmems.8.xml:216(para) groupdel.8.xml:145(para) groupadd.8.xml:238(para) gpasswd.1.xml:284(para) chgpasswd.8.xml:218(para)
 msgid "Group account information."
 msgstr ""
 
-#: vipw.8.xml:204(filename) usermod.8.xml:523(filename) useradd.8.xml:696(filename) sg.1.xml:131(filename) newusers.8.xml:418(filename) newgrp.1.xml:142(filename) gshadow.5.xml:165(filename) grpck.8.xml:230(filename) groupmod.8.xml:214(filename) groupmems.8.xml:220(filename) groupdel.8.xml:149(filename) groupadd.8.xml:242(filename) gpasswd.1.xml:76(filename) gpasswd.1.xml:288(filename) chgpasswd.8.xml:222(filename)
+#: vipw.8.xml:204(filename) usermod.8.xml:522(filename) useradd.8.xml:696(filename) sg.1.xml:131(filename) newusers.8.xml:418(filename) newgrp.1.xml:142(filename) gshadow.5.xml:165(filename) grpck.8.xml:230(filename) groupmod.8.xml:214(filename) groupmems.8.xml:220(filename) groupdel.8.xml:149(filename) groupadd.8.xml:242(filename) gpasswd.1.xml:76(filename) gpasswd.1.xml:288(filename) chgpasswd.8.xml:222(filename)
 msgid "/etc/gshadow"
 msgstr ""
 
-#: vipw.8.xml:206(para) usermod.8.xml:525(para) useradd.8.xml:698(para) sg.1.xml:133(para) newusers.8.xml:420(para) newgrp.1.xml:144(para) gshadow.5.xml:167(para) grpck.8.xml:232(para) groupmod.8.xml:216(para) groupdel.8.xml:151(para) groupadd.8.xml:244(para) gpasswd.1.xml:290(para) chgpasswd.8.xml:224(para)
+#: vipw.8.xml:206(para) usermod.8.xml:524(para) useradd.8.xml:698(para) sg.1.xml:133(para) newusers.8.xml:420(para) newgrp.1.xml:144(para) gshadow.5.xml:167(para) grpck.8.xml:232(para) groupmod.8.xml:216(para) groupdel.8.xml:151(para) groupadd.8.xml:244(para) gpasswd.1.xml:290(para) chgpasswd.8.xml:224(para)
 msgid "Secure group account information."
 msgstr ""
 
-#: vipw.8.xml:210(filename) usermod.8.xml:535(filename) userdel.8.xml:203(filename) useradd.8.xml:678(filename) su.1.xml:370(filename) sg.1.xml:113(filename) shadow.5.xml:258(filename) pwck.8.xml:278(filename) passwd.5.xml:144(filename) passwd.1.xml:411(filename) newusers.8.xml:400(filename) newgrp.1.xml:124(filename) login.1.xml:353(filename) grpck.8.xml:236(filename) groupmod.8.xml:226(filename) expiry.1.xml:124(filename) chsh.1.xml:170(filename) chpasswd.8.xml:258(filename) chfn.1.xml:216(filename) chage.1.xml:260(filename)
+#: vipw.8.xml:210(filename) usermod.8.xml:534(filename) userdel.8.xml:203(filename) useradd.8.xml:678(filename) su.1.xml:370(filename) sg.1.xml:113(filename) shadow.5.xml:258(filename) pwck.8.xml:278(filename) passwd.5.xml:144(filename) passwd.1.xml:411(filename) newusers.8.xml:400(filename) newgrp.1.xml:124(filename) login.1.xml:353(filename) grpck.8.xml:236(filename) groupmod.8.xml:226(filename) expiry.1.xml:124(filename) chsh.1.xml:170(filename) chpasswd.8.xml:258(filename) chfn.1.xml:216(filename) chage.1.xml:260(filename)
 msgid "/etc/passwd"
 msgstr ""
 
-#: vipw.8.xml:212(para) usermod.8.xml:537(para) userdel.8.xml:205(para) useradd.8.xml:680(para) su.1.xml:372(para) sg.1.xml:115(para) shadow.5.xml:260(para) pwck.8.xml:280(para) passwd.5.xml:146(para) passwd.1.xml:413(para) newusers.8.xml:402(para) newgrp.1.xml:126(para) login.1.xml:355(para) grpck.8.xml:238(para) groupmod.8.xml:228(para) expiry.1.xml:126(para) chsh.1.xml:172(para) chpasswd.8.xml:260(para) chfn.1.xml:218(para) chage.1.xml:263(para)
+#: vipw.8.xml:212(para) usermod.8.xml:536(para) userdel.8.xml:205(para) useradd.8.xml:680(para) su.1.xml:372(para) sg.1.xml:115(para) shadow.5.xml:260(para) pwck.8.xml:280(para) passwd.5.xml:146(para) passwd.1.xml:413(para) newusers.8.xml:402(para) newgrp.1.xml:126(para) login.1.xml:355(para) grpck.8.xml:238(para) groupmod.8.xml:228(para) expiry.1.xml:126(para) chsh.1.xml:172(para) chpasswd.8.xml:260(para) chfn.1.xml:218(para) chage.1.xml:263(para)
 msgid "User account information."
 msgstr ""
 
-#: vipw.8.xml:216(filename) usermod.8.xml:541(filename) userdel.8.xml:209(filename) useradd.8.xml:684(filename) su.1.xml:376(filename) sg.1.xml:119(filename) shadow.5.xml:264(filename) shadow.3.xml:229(filename) pwck.8.xml:284(filename) passwd.5.xml:150(filename) passwd.1.xml:417(filename) newusers.8.xml:406(filename) newgrp.1.xml:130(filename) login.1.xml:359(filename) expiry.1.xml:130(filename) chpasswd.8.xml:264(filename) chage.1.xml:268(filename)
+#: vipw.8.xml:216(filename) usermod.8.xml:540(filename) userdel.8.xml:209(filename) useradd.8.xml:684(filename) su.1.xml:376(filename) sg.1.xml:119(filename) shadow.5.xml:264(filename) shadow.3.xml:229(filename) pwck.8.xml:284(filename) passwd.5.xml:150(filename) passwd.1.xml:417(filename) newusers.8.xml:406(filename) newgrp.1.xml:130(filename) login.1.xml:359(filename) expiry.1.xml:130(filename) chpasswd.8.xml:264(filename) chage.1.xml:268(filename)
 msgid "/etc/shadow"
 msgstr ""
 
-#: vipw.8.xml:218(para) usermod.8.xml:543(para) userdel.8.xml:211(para) useradd.8.xml:686(para) su.1.xml:378(para) sg.1.xml:121(para) shadow.5.xml:266(para) shadow.3.xml:231(para) pwck.8.xml:286(para) passwd.1.xml:419(para) newusers.8.xml:408(para) newgrp.1.xml:132(para) login.1.xml:361(para) expiry.1.xml:132(para) chpasswd.8.xml:266(para) chage.1.xml:271(para)
+#: vipw.8.xml:218(para) usermod.8.xml:542(para) userdel.8.xml:211(para) useradd.8.xml:686(para) su.1.xml:378(para) sg.1.xml:121(para) shadow.5.xml:266(para) shadow.3.xml:231(para) pwck.8.xml:286(para) passwd.1.xml:419(para) newusers.8.xml:408(para) newgrp.1.xml:132(para) login.1.xml:361(para) expiry.1.xml:132(para) chpasswd.8.xml:266(para) chage.1.xml:271(para)
 msgid "Secure user account information."
 msgstr ""
 
-#: vipw.8.xml:225(title) usermod.8.xml:562(title) userdel.8.xml:308(title) useradd.8.xml:804(title) suauth.5.xml:222(title) su.1.xml:438(title) sg.1.xml:140(title) shadow.5.xml:283(title) shadow.3.xml:238(title) pwconv.8.xml:262(title) pwck.8.xml:344(title) porttime.5.xml:142(title) passwd.5.xml:169(title) passwd.1.xml:489(title) nologin.8.xml:78(title) newusers.8.xml:451(title) newgrp.1.xml:151(title) login.defs.5.xml:534(title) login.access.5.xml:133(title) login.1.xml:398(title) limits.5.xml:206(title) gshadow.5.xml:174(title) grpck.8.xml:290(title) groups.1.xml:112(title) groupmod.8.xml:286(title) groupmems.8.xml:229(title) groupdel.8.xml:197(title) groupadd.8.xml:324(title) gpasswd.1.xml:297(title) faillog.8.xml:255(title) faillog.5.xml:108(title) expiry.1.xml:139(title) chsh.1.xml:191(title) chpasswd.8.xml:285(title) chgpasswd.8.xml:237(title) chfn.1.xml:225(title) chage.1.xml:311(title)
+#: vipw.8.xml:225(title) usermod.8.xml:561(title) userdel.8.xml:308(title) useradd.8.xml:804(title) suauth.5.xml:222(title) su.1.xml:438(title) sg.1.xml:140(title) shadow.5.xml:283(title) shadow.3.xml:238(title) pwconv.8.xml:262(title) pwck.8.xml:344(title) porttime.5.xml:142(title) passwd.5.xml:169(title) passwd.1.xml:489(title) nologin.8.xml:78(title) newusers.8.xml:451(title) newgrp.1.xml:151(title) login.defs.5.xml:534(title) login.access.5.xml:133(title) login.1.xml:398(title) limits.5.xml:206(title) gshadow.5.xml:174(title) grpck.8.xml:290(title) groups.1.xml:112(title) groupmod.8.xml:286(title) groupmems.8.xml:229(title) groupdel.8.xml:197(title) groupadd.8.xml:324(title) gpasswd.1.xml:297(title) faillog.8.xml:255(title) faillog.5.xml:108(title) expiry.1.xml:139(title) chsh.1.xml:191(title) chpasswd.8.xml:285(title) chgpasswd.8.xml:237(title) chfn.1.xml:225(title) chage.1.xml:311(title)
 msgid "SEE ALSO"
 msgstr ""
 
@@ -458,7 +458,7 @@ msgid "Note: if you wish to unlock the account (not only access with a password)
 msgstr ""
 
 #: usermod.8.xml:384(term)
-msgid "<option>-v</option>, <option>--add-sub-uids</option>&nbsp;<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
+msgid "<option>-v</option>, <option>--add-subuids</option>&nbsp;<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 
 #: usermod.8.xml:388(para)
@@ -474,7 +474,7 @@ msgid "No checks will be performed with regard to <option>SUB_UID_MIN</option>,
 msgstr ""
 
 #: usermod.8.xml:402(term)
-msgid "<option>-V</option>, <option>--del-sub-uids</option>&nbsp;<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
+msgid "<option>-V</option>, <option>--del-subuids</option>&nbsp;<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 
 #: usermod.8.xml:406(para)
@@ -482,11 +482,11 @@ msgid "Remove a range of subordinate uids from the user's account."
 msgstr ""
 
 #: usermod.8.xml:409(para)
-msgid "This option may be specified multiple times to remove multiple ranges to a users account. When both <option>--del-sub-uids</option> and <option>--add-sub-uids</option> are specified, the removal of all subordinate uid ranges happens before any subordinate uid range is added."
+msgid "This option may be specified multiple times to remove multiple ranges to a users account. When both <option>--del-subuids</option> and <option>--add-subuids</option> are specified, the removal of all subordinate uid ranges happens before any subordinate uid range is added."
 msgstr ""
 
 #: usermod.8.xml:422(term)
-msgid "<option>-w</option>, <option>--add-sub-gids</option>&nbsp;<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
+msgid "<option>-w</option>, <option>--add-subgids</option>&nbsp;<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 
 #: usermod.8.xml:426(para)
@@ -498,7 +498,7 @@ msgid "No checks will be performed with regard to <option>SUB_GID_MIN</option>,
 msgstr ""
 
 #: usermod.8.xml:440(term)
-msgid "<option>-W</option>, <option>--del-sub-gids</option>&nbsp;<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
+msgid "<option>-W</option>, <option>--del-subgids</option>&nbsp;<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 
 #: usermod.8.xml:444(para)
@@ -506,7 +506,7 @@ msgid "Remove a range of subordinate gids from the user's account."
 msgstr ""
 
 #: usermod.8.xml:447(para)
-msgid "This option may be specified multiple times to remove multiple ranges to a users account. When both <option>--del-sub-gids</option> and <option>--add-sub-gids</option> are specified, the removal of all subordinate gid ranges happens before any subordinate gid range is added."
+msgid "This option may be specified multiple times to remove multiple ranges to a users account. When both <option>--del-subgids</option> and <option>--add-subgids</option> are specified, the removal of all subordinate gid ranges happens before any subordinate gid range is added."
 msgstr ""
 
 #: usermod.8.xml:460(term) useradd.8.xml:506(term)
@@ -521,19 +521,19 @@ msgstr ""
 msgid "A blank <replaceable>SEUSER</replaceable> will remove the SELinux user mapping for user <replaceable>LOGIN</replaceable> (if any)."
 msgstr ""
 
-#: usermod.8.xml:478(title) userdel.8.xml:281(title) useradd.8.xml:623(title) su.1.xml:331(title) shadow.3.xml:218(title) passwd.1.xml:372(title) newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:194(title) groupdel.8.xml:116(title) groupadd.8.xml:257(title) gpasswd.1.xml:252(title) faillog.8.xml:232(title) chpasswd.8.xml:231(title) chgpasswd.8.xml:186(title)
+#: usermod.8.xml:478(title) userdel.8.xml:281(title) useradd.8.xml:623(title) su.1.xml:331(title) shadow.3.xml:218(title) passwd.1.xml:372(title) newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:216(title) groupdel.8.xml:116(title) groupadd.8.xml:257(title) gpasswd.1.xml:252(title) faillog.8.xml:232(title) chpasswd.8.xml:231(title) chgpasswd.8.xml:186(title)
 msgid "CAVEATS"
 msgstr ""
 
 #: usermod.8.xml:479(para)
-msgid "You must make certain that the named user is not executing any processes when this command is being executed if the user's numerical user ID, the user's name, or the user's home directory is being changed. <command>usermod</command> checks this on Linux, but only check if the user is logged in according to utmp on other architectures."
+msgid "You must make certain that the named user is not executing any processes when this command is being executed if the user's numerical user ID, the user's name, or the user's home directory is being changed. <command>usermod</command> checks this on Linux. On other platforms it only uses utmp to check if the user is logged in."
 msgstr ""
 
-#: usermod.8.xml:487(para)
+#: usermod.8.xml:486(para)
 msgid "You must change the owner of any <command>crontab</command> files or <command>at</command> jobs manually."
 msgstr ""
 
-#: usermod.8.xml:491(para)
+#: usermod.8.xml:490(para)
 msgid "You must make any changes involving NIS on the NIS server."
 msgstr ""
 
@@ -641,31 +641,31 @@ msgstr ""
 msgid "If <replaceable>yes</replaceable>, the location of the user tcb directory to be created will not be automatically set to /etc/tcb/user, but will be computed depending on the UID of the user, according to the following algorithm: <placeholder-1/>"
 msgstr ""
 
-#: usermod.8.xml:529(filename) userdel.8.xml:197(filename) useradd.8.xml:726(filename) su.1.xml:382(filename) pwconv.8.xml:253(filename) passwd.1.xml:423(filename) newusers.8.xml:424(filename) login.access.5.xml:124(filename) login.1.xml:389(filename) groupmod.8.xml:220(filename) groupadd.8.xml:248(filename) chsh.1.xml:182(filename) chpasswd.8.xml:270(filename) chgpasswd.8.xml:228(filename) chfn.1.xml:210(filename)
+#: usermod.8.xml:528(filename) userdel.8.xml:197(filename) useradd.8.xml:726(filename) su.1.xml:382(filename) pwconv.8.xml:253(filename) passwd.1.xml:423(filename) newusers.8.xml:424(filename) login.access.5.xml:124(filename) login.1.xml:389(filename) groupmod.8.xml:220(filename) groupadd.8.xml:248(filename) chsh.1.xml:182(filename) chpasswd.8.xml:270(filename) chgpasswd.8.xml:228(filename) chfn.1.xml:210(filename)
 msgid "/etc/login.defs"
 msgstr ""
 
-#: usermod.8.xml:531(para) userdel.8.xml:199(para) useradd.8.xml:728(para) su.1.xml:384(para) pwconv.8.xml:255(para) passwd.1.xml:425(para) newusers.8.xml:426(para) login.access.5.xml:126(para) login.1.xml:391(para) groupmod.8.xml:222(para) groupadd.8.xml:250(para) chsh.1.xml:184(para) chpasswd.8.xml:272(para) chgpasswd.8.xml:230(para) chfn.1.xml:212(para)
+#: usermod.8.xml:530(para) userdel.8.xml:199(para) useradd.8.xml:728(para) su.1.xml:384(para) pwconv.8.xml:255(para) passwd.1.xml:425(para) newusers.8.xml:426(para) login.access.5.xml:126(para) login.1.xml:391(para) groupmod.8.xml:222(para) groupadd.8.xml:250(para) chsh.1.xml:184(para) chpasswd.8.xml:272(para) chgpasswd.8.xml:230(para) chfn.1.xml:212(para)
 msgid "Shadow password suite configuration."
 msgstr ""
 
-#: usermod.8.xml:547(filename) userdel.8.xml:215(filename) useradd.8.xml:714(filename) newusers.8.xml:436(filename)
+#: usermod.8.xml:546(filename) userdel.8.xml:215(filename) useradd.8.xml:714(filename) newusers.8.xml:436(filename)
 msgid "/etc/subgid"
 msgstr ""
 
-#: usermod.8.xml:549(para) userdel.8.xml:217(para) useradd.8.xml:716(para) newusers.8.xml:438(para)
+#: usermod.8.xml:548(para) userdel.8.xml:217(para) useradd.8.xml:716(para) newusers.8.xml:438(para)
 msgid "Per user subordinate group IDs."
 msgstr ""
 
-#: usermod.8.xml:553(filename) userdel.8.xml:221(filename) useradd.8.xml:720(filename) newusers.8.xml:442(filename)
+#: usermod.8.xml:552(filename) userdel.8.xml:221(filename) useradd.8.xml:720(filename) newusers.8.xml:442(filename)
 msgid "/etc/subuid"
 msgstr ""
 
-#: usermod.8.xml:555(para) userdel.8.xml:223(para) useradd.8.xml:722(para) newusers.8.xml:444(para)
+#: usermod.8.xml:554(para) userdel.8.xml:223(para) useradd.8.xml:722(para) newusers.8.xml:444(para)
 msgid "Per user subordinate user IDs."
 msgstr ""
 
-#: usermod.8.xml:563(para)
+#: usermod.8.xml:562(para)
 msgid "<citerefentry><refentrytitle>chfn</refentrytitle><manvolnum>1</manvolnum></citerefentry>, <citerefentry><refentrytitle>chsh</refentrytitle><manvolnum>1</manvolnum></citerefentry>, <citerefentry><refentrytitle>passwd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, <citerefentry><refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum></citerefentry>, <citerefentry><refentrytitle>gpasswd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, <citerefentry><refentrytitle>groupadd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, <citerefentry><refentrytitle>groupdel</refentrytitle><manvolnum>8</manvolnum></citerefentry>, <citerefentry><refentrytitle>groupmod</refentrytitle><manvolnum>8</manvolnum></citerefentry>, <citerefentry><refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum></citerefentry>, <phrase condition=\"subids\"><citerefentry><refentrytitle>subgid</refentrytitle><manvolnum>5</manvolnum></citerefentry>, <citerefentry><refentrytitle>subuid</refentrytitle><manvolnum>5</manvolnum></citerefentry>, </phrase><citerefentry><refentrytitle>useradd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, <citerefentry><refentrytitle>userdel</refentrytitle><manvolnum>8</manvolnum></citerefentry>."
 msgstr ""
 
@@ -935,7 +935,7 @@ msgid "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</replac
 msgstr ""
 
 #: useradd.8.xml:301(para)
-msgid "Overrides <filename>/etc/login.defs</filename> defaults (<option>UID_MIN</option>, <option>UID_MAX</option>, <option>UMASK</option>, <option>PASS_MAX_DAYS</option> and others). <placeholder-1/> Example: <option>-K</option>&nbsp;<replaceable>PASS_MAX_DAYS</replaceable>=<replaceable>-1</replaceable> can be used when creating system account to turn off password ageing, even though system account has no password at all. Multiple <option>-K</option> options can be specified, e.g.: <option>-K</option>&nbsp;<replaceable>UID_MIN</replaceable>=<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;<replaceable>UID_MAX</replaceable>=<replaceable>499</replaceable>"
+msgid "Overrides <filename>/etc/login.defs</filename> defaults (<option>UID_MIN</option>, <option>UID_MAX</option>, <option>UMASK</option>, <option>PASS_MAX_DAYS</option> and others). <placeholder-1/> Example: <option>-K</option>&nbsp;<replaceable>PASS_MAX_DAYS</replaceable>=<replaceable>-1</replaceable> can be used when creating system account to turn off password aging, even though system account has no password at all. Multiple <option>-K</option> options can be specified, e.g.: <option>-K</option>&nbsp;<replaceable>UID_MIN</replaceable>=<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;<replaceable>UID_MAX</replaceable>=<replaceable>499</replaceable>"
 msgstr ""
 
 #: useradd.8.xml:322(term)
@@ -947,7 +947,7 @@ msgid "Do not add the user to the lastlog and faillog databases."
 msgstr ""
 
 #: useradd.8.xml:327(para)
-msgid "By default, the user's entries in the lastlog and faillog databases are resetted to avoid reusing the entry from a previously deleted user."
+msgid "By default, the user's entries in the lastlog and faillog databases are reset to avoid reusing the entry from a previously deleted user."
 msgstr ""
 
 #: useradd.8.xml:335(term)
@@ -962,8 +962,8 @@ msgstr ""
 msgid "By default, if this option is not specified and <option>CREATE_HOME</option> is not enabled, no home directories are created."
 msgstr ""
 
-#: useradd.8.xml:354(option)
-msgid "-M"
+#: useradd.8.xml:353(term)
+msgid "<option>-M</option>, <option>--no-create-home</option>"
 msgstr ""
 
 #: useradd.8.xml:357(para)
@@ -1007,7 +1007,7 @@ msgid "System users will be created with no aging information in <filename>/etc/
 msgstr ""
 
 #: useradd.8.xml:434(para)
-msgid "Note that <command>useradd</command> will not create a home directory for such an user, regardless of the default setting in <filename>/etc/login.defs</filename> (<option>CREATE_HOME</option>). You have to specify the <option>-m</option> options if you want a home directory for a system account to be created."
+msgid "Note that <command>useradd</command> will not create a home directory for such a user, regardless of the default setting in <filename>/etc/login.defs</filename> (<option>CREATE_HOME</option>). You have to specify the <option>-m</option> options if you want a home directory for a system account to be created."
 msgstr ""
 
 #: useradd.8.xml:461(para)
@@ -1329,7 +1329,7 @@ msgstr ""
 #. .RS
 #: suauth.5.xml:83(literallayout)
 #, no-wrap
-msgid "\n      1) the user su is targetting\n    "
+msgid "\n      1) the user su is targeting\n    "
 msgstr ""
 
 #. .fi
@@ -1351,7 +1351,7 @@ msgid "Where to-id is either the word <emphasis>ALL</emphasis>, a list of userna
 msgstr ""
 
 #: suauth.5.xml:107(para)
-msgid "from-id is formatted the same as to-id except the extra word <emphasis>GROUP</emphasis> is recognised. <emphasis>ALL EXCEPT GROUP</emphasis> is perfectly valid too. Following <emphasis>GROUP</emphasis> appears one or more group names, delimited by \",\". It is not sufficient to have primary group id of the relevant group, an entry in <citerefentry><refentrytitle>/etc/group</refentrytitle><manvolnum>5</manvolnum></citerefentry> is neccessary."
+msgid "from-id is formatted the same as to-id except the extra word <emphasis>GROUP</emphasis> is recognized. <emphasis>ALL EXCEPT GROUP</emphasis> is perfectly valid too. Following <emphasis>GROUP</emphasis> appears one or more group names, delimited by \",\". It is not sufficient to have primary group id of the relevant group, an entry in <citerefentry><refentrytitle>/etc/group</refentrytitle><manvolnum>5</manvolnum></citerefentry> is necessary."
 msgstr ""
 
 #: suauth.5.xml:118(para)
@@ -1472,7 +1472,7 @@ msgid "Specify a command that will be invoked by the shell using its <option>-c<
 msgstr ""
 
 #: su.1.xml:158(para)
-msgid "The executed command will have no controlling terminal. This option cannot be used to execute interractive programs which need a controlling TTY."
+msgid "The executed command will have no controlling terminal. This option cannot be used to execute interactive programs which need a controlling TTY."
 msgstr ""
 
 #: su.1.xml:168(term)
@@ -1854,7 +1854,7 @@ msgid "This field may be empty, in which case no passwords are required to authe
 msgstr ""
 
 #: shadow.5.xml:117(para) gshadow.5.xml:107(para)
-msgid "A password field which starts with a exclamation mark means that the password is locked. The remaining characters on the line represent the password field before the password was locked."
+msgid "A password field which starts with an exclamation mark means that the password is locked. The remaining characters on the line represent the password field before the password was locked."
 msgstr ""
 
 #: shadow.5.xml:127(emphasis)
@@ -1866,7 +1866,7 @@ msgid "The date of the last password change, expressed as the number of days sin
 msgstr ""
 
 #: shadow.5.xml:134(para)
-msgid "The value 0 has a special meaning, which is that the user should change her pasword the next time she will log in the system."
+msgid "The value 0 has a special meaning, which is that the user should change her password the next time she will log in the system."
 msgstr ""
 
 #: shadow.5.xml:139(para)
@@ -1942,7 +1942,7 @@ msgid "The date of expiration of the account, expressed as the number of days si
 msgstr ""
 
 #: shadow.5.xml:229(para)
-msgid "Note that an account expiration differs from a password expiration. In case of an acount expiration, the user shall not be allowed to login. In case of a password expiration, the user is not allowed to login using her password."
+msgid "Note that an account expiration differs from a password expiration. In case of an account expiration, the user shall not be allowed to login. In case of a password expiration, the user is not allowed to login using her password."
 msgstr ""
 
 #: shadow.5.xml:235(para)
@@ -2331,7 +2331,7 @@ msgid "By default, <command>pwck</command> operates on the files <filename>/etc/
 msgstr ""
 
 #: pwck.8.xml:243(para)
-msgid "Note that when <option>USE_TCB</option> is enabled, you cannot specify an alternative <replaceable>shadow</replaceable> file. In future releases, this paramater could be replaced by an alternate TCB directory."
+msgid "Note that when <option>USE_TCB</option> is enabled, you cannot specify an alternative <replaceable>shadow</replaceable> file. In future releases, this parameter could be replaced by an alternate TCB directory."
 msgstr ""
 
 #: pwck.8.xml:312(para)
@@ -2544,7 +2544,7 @@ msgid "Compromises in password security normally result from careless password s
 msgstr ""
 
 #: passwd.1.xml:166(para)
-msgid "You can find advices on how to choose a strong password on http://en.wikipedia.org/wiki/Password_strength"
+msgid "You can find advice on how to choose a strong password on http://en.wikipedia.org/wiki/Password_strength"
 msgstr ""
 
 #: passwd.1.xml:175(para)
@@ -2832,7 +2832,7 @@ msgid "HISTORY"
 msgstr ""
 
 #: nologin.8.xml:91(para)
-msgid "The <command>nologin</command> command appearred in BSD 4.4."
+msgid "The <command>nologin</command> command appeared in BSD 4.4."
 msgstr ""
 
 #: newusers.8.xml:72(refentrytitle) newusers.8.xml:79(refname) newusers.8.xml:85(command) login.defs.5.xml:391(term)
@@ -2864,7 +2864,7 @@ msgid "This is the name of the user."
 msgstr ""
 
 #: newusers.8.xml:116(para)
-msgid "It can be the name of a new user or the name of an existing user (or an user created before by <command>newusers</command>). In case of an existing user, the user's information will be changed, otherwise a new user will be created."
+msgid "It can be the name of a new user or the name of an existing user (or a user created before by <command>newusers</command>). In case of an existing user, the user's information will be changed, otherwise a new user will be created."
 msgstr ""
 
 #: newusers.8.xml:127(emphasis)
@@ -2884,7 +2884,7 @@ msgid "This field is used to define the UID of the user."
 msgstr ""
 
 #: newusers.8.xml:144(para)
-msgid "If the field is empty, an new (unused) UID will be defined automatically by <command>newusers</command>."
+msgid "If the field is empty, a new (unused) UID will be defined automatically by <command>newusers</command>."
 msgstr ""
 
 #: newusers.8.xml:148(para)
@@ -2892,7 +2892,7 @@ msgid "If this field contains a number, this number will be used as the UID."
 msgstr ""
 
 #: newusers.8.xml:152(para)
-msgid "If this field contains the name of an existing user (or the name of an user created before by <command>newusers</command>), the UID of the specified user will be used."
+msgid "If this field contains the name of an existing user (or the name of a user created before by <command>newusers</command>), the UID of the specified user will be used."
 msgstr ""
 
 #: newusers.8.xml:158(para)
@@ -3704,7 +3704,7 @@ msgid "D: max data size (KB)"
 msgstr ""
 
 #: limits.5.xml:111(para)
-msgid "F: maximum filesize (KB)"
+msgid "F: maximum file size (KB)"
 msgstr ""
 
 #: limits.5.xml:112(para)
@@ -3761,7 +3761,7 @@ msgid "\n      username L2D2048N5\n      username L2 D2048 N5\n    "
 msgstr ""
 
 #: limits.5.xml:145(para)
-msgid "Be aware that after <emphasis remap=\"I\">username</emphasis> the rest of the line is considered a limit string, thus comments are not allowed. A invalid limits string will be rejected (not considered) by the <command>login</command> program."
+msgid "Be aware that after <emphasis remap=\"I\">username</emphasis> the rest of the line is considered a limit string, thus comments are not allowed. An invalid limits string will be rejected (not considered) by the <command>login</command> program."
 msgstr ""
 
 #: limits.5.xml:152(para)
@@ -3773,11 +3773,11 @@ msgid "The limits specified in the form \"<replaceable>@group</replaceable>\" ap
 msgstr ""
 
 #: limits.5.xml:165(para)
-msgid "If more than one line with limits for an user exist, only the first line for this user will be considered."
+msgid "If more than one line with limits for a user exist, only the first line for this user will be considered."
 msgstr ""
 
 #: limits.5.xml:170(para)
-msgid "If no lines are specified for an user, the last <replaceable>@group</replaceable> line matching a group whose the user is a member of will be considered, or the last line with default limits if no groups contain the user."
+msgid "If no lines are specified for a user, the last <replaceable>@group</replaceable> line matching a group whose the user is a member of will be considered, or the last line with default limits if no groups contain the user."
 msgstr ""
 
 #: limits.5.xml:177(para)
@@ -3824,51 +3824,67 @@ msgstr ""
 msgid "Print only lastlog records older than <emphasis remap=\"I\">DAYS</emphasis>."
 msgstr ""
 
-#: lastlog.8.xml:127(term) faillog.8.xml:192(term)
-msgid "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAYS</replaceable>"
+#: lastlog.8.xml:107(term)
+msgid "<option>-C</option>, <option>--clear</option>"
 msgstr ""
 
-#: lastlog.8.xml:131(para)
-msgid "Print the lastlog records more recent than <emphasis remap=\"I\">DAYS</emphasis>."
+#: lastlog.8.xml:111(para)
+msgid "Clear lastlog record of a user. This option can be used only together with <option>-u</option> (<option>--user</option>))."
 msgstr ""
 
-#: lastlog.8.xml:138(term) faillog.8.xml:202(term)
-msgid "<option>-u</option>, <option>--user</option>&nbsp;<replaceable>LOGIN</replaceable>|<replaceable>RANGE</replaceable>"
+#: lastlog.8.xml:138(term)
+msgid "<option>-S</option>, <option>--set</option>"
 msgstr ""
 
 #: lastlog.8.xml:142(para)
+msgid "Set lastlog record of a user to the current time. This option can be used only together with <option>-u</option> (<option>--user</option>))."
+msgstr ""
+
+#: lastlog.8.xml:149(term) faillog.8.xml:192(term)
+msgid "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAYS</replaceable>"
+msgstr ""
+
+#: lastlog.8.xml:153(para)
+msgid "Print the lastlog records more recent than <emphasis remap=\"I\">DAYS</emphasis>."
+msgstr ""
+
+#: lastlog.8.xml:160(term) faillog.8.xml:202(term)
+msgid "<option>-u</option>, <option>--user</option>&nbsp;<replaceable>LOGIN</replaceable>|<replaceable>RANGE</replaceable>"
+msgstr ""
+
+#: lastlog.8.xml:164(para)
 msgid "Print the lastlog record of the specified user(s)."
 msgstr ""
 
-#: lastlog.8.xml:145(para) faillog.8.xml:211(para)
+#: lastlog.8.xml:167(para) faillog.8.xml:211(para)
 msgid "The users can be specified by a login name, a numerical user ID, or a <replaceable>RANGE</replaceable> of users. This <replaceable>RANGE</replaceable> of users can be specified with a min and max values (<replaceable>UID_MIN-UID_MAX</replaceable>), a max value (<replaceable>-UID_MAX</replaceable>), or a min value (<replaceable>UID_MIN-</replaceable>)."
 msgstr ""
 
-#: lastlog.8.xml:157(para)
+#: lastlog.8.xml:179(para)
 msgid "If the user has never logged in the message <emphasis>** Never logged in**</emphasis> will be displayed instead of the port and time."
 msgstr ""
 
-#: lastlog.8.xml:162(para)
+#: lastlog.8.xml:184(para)
 msgid "Only the entries for the current users of the system will be displayed. Other entries may exist for users that were deleted previously."
 msgstr ""
 
-#: lastlog.8.xml:170(title) groups.1.xml:90(title) chsh.1.xml:140(title) chage.1.xml:231(title)
+#: lastlog.8.xml:192(title) groups.1.xml:90(title) chsh.1.xml:140(title) chage.1.xml:231(title)
 msgid "NOTE"
 msgstr ""
 
-#: lastlog.8.xml:171(para)
+#: lastlog.8.xml:193(para)
 msgid "The <filename>lastlog</filename> file is a database which contains info on the last login of each user. You should not rotate it. It is a sparse file, so its size on the disk is usually much smaller than the one shown by \"<command>ls -l</command>\" (which can indicate a really big file if you have in <filename>passwd</filename> users with a high UID). You can display its real size with \"<command>ls -s</command>\"."
 msgstr ""
 
-#: lastlog.8.xml:185(filename)
+#: lastlog.8.xml:207(filename)
 msgid "/var/log/lastlog"
 msgstr ""
 
-#: lastlog.8.xml:187(para)
+#: lastlog.8.xml:209(para)
 msgid "Database times of previous user logins."
 msgstr ""
 
-#: lastlog.8.xml:195(para)
+#: lastlog.8.xml:217(para)
 msgid "Large gaps in UID numbers will cause the lastlog program to run longer with no output to the screen (i.e. if in lastlog database there is no entries for users with UID between 170 and 800 lastlog will appear to hang as it processes entries with UIDs 171-799)."
 msgstr ""
 
@@ -3905,7 +3921,7 @@ msgid "If the password field contains some string that is not a valid result of
 msgstr ""
 
 #: gshadow.5.xml:97(para)
-msgid "The password is used when an user who is not a member of the group wants to gain the permissions of this group (see <citerefentry><refentrytitle>newgrp</refentrytitle><manvolnum>1</manvolnum></citerefentry>)."
+msgid "The password is used when a user who is not a member of the group wants to gain the permissions of this group (see <citerefentry><refentrytitle>newgrp</refentrytitle><manvolnum>1</manvolnum></citerefentry>)."
 msgstr ""
 
 #: gshadow.5.xml:103(para)
@@ -4169,7 +4185,7 @@ msgid "<option>-a</option>, <option>--add</option>&nbsp;<replaceable>user_name</
 msgstr ""
 
 #: groupmems.8.xml:109(para)
-msgid "Add an user to the group membership list."
+msgid "Add a user to the group membership list."
 msgstr ""
 
 #: groupmems.8.xml:110(para) groupmems.8.xml:126(para) groupmems.8.xml:157(para)
@@ -4663,7 +4679,7 @@ msgid "By default the passwords must be supplied in clear-text, and are encrypte
 msgstr ""
 
 #: chpasswd.8.xml:97(para)
-msgid "The default encryption algorithm can be defined for the system with the <option>ENCRYPT_METHOD</option> or <option>MD5_CRYPT_ENAB</option> variables of <filename>/etc/login.defs</filename>, and can be overwitten with the <option>-e</option>, <option>-m</option>, or <option>-c</option> options."
+msgid "The default encryption algorithm can be defined for the system with the <option>ENCRYPT_METHOD</option> or <option>MD5_CRYPT_ENAB</option> variables of <filename>/etc/login.defs</filename>, and can be overwritten with the <option>-e</option>, <option>-m</option>, or <option>-c</option> options."
 msgstr ""
 
 #: chpasswd.8.xml:105(para)
@@ -4671,7 +4687,7 @@ msgid "By default, passwords are encrypted by PAM, but (even if not recommended)
 msgstr ""
 
 #: chpasswd.8.xml:111(para)
-msgid "<phrase condition=\"pam\">Except when PAM is used to encrypt the passwords,</phrase><command>chpasswd</command> first updates all the passwords in memory, and then commits all the changes to disk if no errors occured for any user."
+msgid "<phrase condition=\"pam\">Except when PAM is used to encrypt the passwords,</phrase><command>chpasswd</command> first updates all the passwords in memory, and then commits all the changes to disk if no errors occurred for any user."
 msgstr ""
 
 #: chpasswd.8.xml:117(para)
@@ -4763,7 +4779,7 @@ msgid "By default the supplied password must be in clear-text, and is encrypted
 msgstr ""
 
 #: chgpasswd.8.xml:92(para)
-msgid "The default encryption algorithm can be defined for the system with the <option>ENCRYPT_METHOD</option> variable of <filename>/etc/login.defs</filename>, and can be overwiten with the <option>-e</option>, <option>-m</option>, or <option>-c</option> options."
+msgid "The default encryption algorithm can be defined for the system with the <option>ENCRYPT_METHOD</option> variable of <filename>/etc/login.defs</filename>, and can be overwritten with the <option>-e</option>, <option>-m</option>, or <option>-c</option> options."
 msgstr ""
 
 #: chgpasswd.8.xml:106(para)

man/po/sv.po

@@ -1,7 +1,7 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: man pages for shadow 4.0.18\n"
-"POT-Creation-Date: 2013-08-23 01:54+0200\n"
+"POT-Creation-Date: 2016-09-18 14:03-0500\n"
 "PO-Revision-Date: 2013-08-23 01:41+0200\n"
 "Last-Translator: Daniel Nylander <po@danielnylander.se>\n"
 "Language-Team: Swedish <debian-l10n-swedish@lists.debian.org>\n"
@@ -49,16 +49,15 @@ msgstr ""
 #: useradd.8.xml:62(surname) suauth.5.xml:45(surname) su.1.xml:62(surname)
 #: sg.1.xml:46(surname) shadow.5.xml:45(surname) shadow.3.xml:45(surname)
 #: pwconv.8.xml:51(surname) pwck.8.xml:51(surname) porttime.5.xml:45(surname)
-#: passwd.5.xml:45(surname) passwd.1.xml:52(surname)
-#: newusers.8.xml:60(surname) newgrp.1.xml:46(surname)
-#: logoutd.8.xml:45(surname) login.defs.5.xml:110(surname)
-#: login.access.5.xml:46(surname) login.1.xml:78(surname)
-#: limits.5.xml:47(surname) lastlog.8.xml:46(surname) grpck.8.xml:46(surname)
-#: groups.1.xml:45(surname) groupmod.8.xml:46(surname)
+#: passwd.5.xml:45(surname) passwd.1.xml:52(surname) newusers.8.xml:60(surname)
+#: newgrp.1.xml:46(surname) logoutd.8.xml:45(surname)
+#: login.defs.5.xml:110(surname) login.access.5.xml:46(surname)
+#: login.1.xml:78(surname) limits.5.xml:47(surname) lastlog.8.xml:46(surname)
+#: grpck.8.xml:46(surname) groups.1.xml:45(surname) groupmod.8.xml:46(surname)
 #: groupmems.8.xml:49(surname) groupdel.8.xml:46(surname)
 #: groupadd.8.xml:48(surname) gpasswd.1.xml:50(surname)
-#: faillog.8.xml:45(surname) faillog.5.xml:45(surname)
-#: expiry.1.xml:49(surname) chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
+#: faillog.8.xml:45(surname) faillog.5.xml:45(surname) expiry.1.xml:49(surname)
+#: chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
 #: chgpasswd.8.xml:45(surname) chfn.1.xml:48(surname) chage.1.xml:46(surname)
 msgid "Kłoczko"
 msgstr ""
@@ -83,17 +82,16 @@ msgstr ""
 #: useradd.8.xml:64(contrib) suauth.5.xml:47(contrib) su.1.xml:64(contrib)
 #: sg.1.xml:48(contrib) shadow.5.xml:47(contrib) shadow.3.xml:47(contrib)
 #: pwconv.8.xml:53(contrib) pwck.8.xml:53(contrib) porttime.5.xml:47(contrib)
-#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib)
-#: newusers.8.xml:62(contrib) newgrp.1.xml:48(contrib)
-#: logoutd.8.xml:47(contrib) login.defs.5.xml:112(contrib)
-#: login.access.5.xml:48(contrib) login.1.xml:80(contrib)
-#: limits.5.xml:49(contrib) lastlog.8.xml:48(contrib) grpck.8.xml:48(contrib)
-#: groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
+#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib) newusers.8.xml:62(contrib)
+#: newgrp.1.xml:48(contrib) logoutd.8.xml:47(contrib)
+#: login.defs.5.xml:112(contrib) login.access.5.xml:48(contrib)
+#: login.1.xml:80(contrib) limits.5.xml:49(contrib) lastlog.8.xml:48(contrib)
+#: grpck.8.xml:48(contrib) groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
 #: groupmems.8.xml:51(contrib) groupdel.8.xml:48(contrib)
 #: groupadd.8.xml:50(contrib) gpasswd.1.xml:52(contrib)
-#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib)
-#: expiry.1.xml:51(contrib) chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib)
-#: chfn.1.xml:50(contrib) chage.1.xml:48(contrib)
+#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib) expiry.1.xml:51(contrib)
+#: chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib) chfn.1.xml:50(contrib)
+#: chage.1.xml:48(contrib)
 msgid "shadow-utils maintainer, 2000 - 2007"
 msgstr ""
 
@@ -127,14 +125,13 @@ msgstr ""
 #: newusers.8.xml:66(surname) newgrp.1.xml:52(surname)
 #: logoutd.8.xml:51(surname) login.defs.5.xml:116(surname)
 #: login.access.5.xml:52(surname) login.1.xml:84(surname)
-#: limits.5.xml:53(surname) lastlog.8.xml:52(surname)
-#: gshadow.5.xml:39(surname) grpck.8.xml:52(surname) groups.1.xml:51(surname)
-#: groupmod.8.xml:52(surname) groupmems.8.xml:55(surname)
-#: groupdel.8.xml:52(surname) groupadd.8.xml:54(surname)
-#: gpasswd.1.xml:56(surname) faillog.8.xml:51(surname)
-#: faillog.5.xml:51(surname) expiry.1.xml:55(surname) chsh.1.xml:54(surname)
-#: chpasswd.8.xml:55(surname) chgpasswd.8.xml:51(surname)
-#: chfn.1.xml:54(surname) chage.1.xml:52(surname)
+#: limits.5.xml:53(surname) lastlog.8.xml:52(surname) gshadow.5.xml:39(surname)
+#: grpck.8.xml:52(surname) groups.1.xml:51(surname) groupmod.8.xml:52(surname)
+#: groupmems.8.xml:55(surname) groupdel.8.xml:52(surname)
+#: groupadd.8.xml:54(surname) gpasswd.1.xml:56(surname)
+#: faillog.8.xml:51(surname) faillog.5.xml:51(surname) expiry.1.xml:55(surname)
+#: chsh.1.xml:54(surname) chpasswd.8.xml:55(surname)
+#: chgpasswd.8.xml:51(surname) chfn.1.xml:54(surname) chage.1.xml:52(surname)
 msgid "François"
 msgstr ""
 
@@ -163,14 +160,13 @@ msgstr ""
 #: newusers.8.xml:68(contrib) newgrp.1.xml:54(contrib)
 #: logoutd.8.xml:53(contrib) login.defs.5.xml:118(contrib)
 #: login.access.5.xml:54(contrib) login.1.xml:86(contrib)
-#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib)
-#: gshadow.5.xml:42(contrib) grpck.8.xml:54(contrib) groups.1.xml:53(contrib)
-#: groupmod.8.xml:54(contrib) groupmems.8.xml:57(contrib)
-#: groupdel.8.xml:54(contrib) groupadd.8.xml:56(contrib)
-#: gpasswd.1.xml:58(contrib) faillog.8.xml:53(contrib)
-#: faillog.5.xml:53(contrib) expiry.1.xml:57(contrib) chsh.1.xml:56(contrib)
-#: chpasswd.8.xml:57(contrib) chgpasswd.8.xml:53(contrib)
-#: chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
+#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib) gshadow.5.xml:42(contrib)
+#: grpck.8.xml:54(contrib) groups.1.xml:53(contrib) groupmod.8.xml:54(contrib)
+#: groupmems.8.xml:57(contrib) groupdel.8.xml:54(contrib)
+#: groupadd.8.xml:56(contrib) gpasswd.1.xml:58(contrib)
+#: faillog.8.xml:53(contrib) faillog.5.xml:53(contrib) expiry.1.xml:57(contrib)
+#: chsh.1.xml:56(contrib) chpasswd.8.xml:57(contrib)
+#: chgpasswd.8.xml:53(contrib) chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
 msgid "shadow-utils maintainer, 2007 - now"
 msgstr ""
 
@@ -248,14 +244,13 @@ msgstr "redigera lösenordet, grupp, skugglösenord eller skuggruppfil"
 #: useradd.8.xml:88(replaceable) useradd.8.xml:100(replaceable)
 #: su.1.xml:88(replaceable) pwconv.8.xml:81(replaceable)
 #: pwconv.8.xml:87(replaceable) pwconv.8.xml:93(replaceable)
-#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg)
-#: passwd.1.xml:79(replaceable) newusers.8.xml:87(replaceable)
-#: lastlog.8.xml:73(replaceable) grpck.8.xml:72(arg)
-#: groupmod.8.xml:73(replaceable) groupdel.8.xml:73(replaceable)
-#: groupadd.8.xml:75(replaceable) faillog.8.xml:72(replaceable)
-#: chsh.1.xml:75(replaceable) chpasswd.8.xml:76(replaceable)
-#: chgpasswd.8.xml:72(replaceable) chfn.1.xml:75(replaceable)
-#: chage.1.xml:72(replaceable)
+#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg) passwd.1.xml:79(replaceable)
+#: newusers.8.xml:87(replaceable) lastlog.8.xml:73(replaceable)
+#: grpck.8.xml:72(arg) groupmod.8.xml:73(replaceable)
+#: groupdel.8.xml:73(replaceable) groupadd.8.xml:75(replaceable)
+#: faillog.8.xml:72(replaceable) chsh.1.xml:75(replaceable)
+#: chpasswd.8.xml:76(replaceable) chgpasswd.8.xml:72(replaceable)
+#: chfn.1.xml:75(replaceable) chage.1.xml:72(replaceable)
 msgid "options"
 msgstr "flaggor"
 
@@ -305,11 +300,10 @@ msgstr ""
 #: useradd.8.xml:124(title) su.1.xml:145(title) pwconv.8.xml:187(title)
 #: pwck.8.xml:176(title) passwd.1.xml:174(title) newusers.8.xml:265(title)
 #: login.1.xml:210(title) lastlog.8.xml:91(title) grpck.8.xml:147(title)
-#: groupmod.8.xml:89(title) groupmems.8.xml:100(title)
-#: groupdel.8.xml:88(title) groupadd.8.xml:93(title) gpasswd.1.xml:134(title)
-#: faillog.8.xml:89(title) expiry.1.xml:91(title) chsh.1.xml:95(title)
-#: chpasswd.8.xml:130(title) chgpasswd.8.xml:105(title) chfn.1.xml:111(title)
-#: chage.1.xml:91(title)
+#: groupmod.8.xml:89(title) groupmems.8.xml:100(title) groupdel.8.xml:88(title)
+#: groupadd.8.xml:93(title) gpasswd.1.xml:134(title) faillog.8.xml:89(title)
+#: expiry.1.xml:91(title) chsh.1.xml:95(title) chpasswd.8.xml:130(title)
+#: chgpasswd.8.xml:105(title) chfn.1.xml:111(title) chage.1.xml:91(title)
 msgid "OPTIONS"
 msgstr "FLAGGOR"
 
@@ -331,7 +325,7 @@ msgstr "Redigera gruppdatabasen."
 
 #: vipw.8.xml:120(term) userdel.8.xml:123(term) useradd.8.xml:266(term)
 #: pwconv.8.xml:195(term) pwck.8.xml:186(term) passwd.1.xml:214(term)
-#: newusers.8.xml:283(term) lastlog.8.xml:107(term) grpck.8.xml:157(term)
+#: newusers.8.xml:283(term) lastlog.8.xml:118(term) grpck.8.xml:157(term)
 #: groupmod.8.xml:129(term) groupmems.8.xml:142(term) groupdel.8.xml:95(term)
 #: groupadd.8.xml:131(term) gpasswd.1.xml:173(term) faillog.8.xml:122(term)
 #: expiry.1.xml:112(term) chsh.1.xml:101(term) chpasswd.8.xml:171(term)
@@ -341,7 +335,7 @@ msgstr "<option>-h</option>, <option>--help</option>"
 
 #: vipw.8.xml:122(para) userdel.8.xml:125(para) useradd.8.xml:268(para)
 #: pwconv.8.xml:197(para) pwck.8.xml:188(para) passwd.1.xml:216(para)
-#: newusers.8.xml:285(para) lastlog.8.xml:111(para) grpck.8.xml:159(para)
+#: newusers.8.xml:285(para) lastlog.8.xml:122(para) grpck.8.xml:159(para)
 #: groupmod.8.xml:131(para) groupmems.8.xml:144(para) groupdel.8.xml:97(para)
 #: groupadd.8.xml:133(para) gpasswd.1.xml:175(para) faillog.8.xml:124(para)
 #: expiry.1.xml:114(para) chsh.1.xml:103(para) chpasswd.8.xml:173(para)
@@ -367,7 +361,7 @@ msgstr "Tyst läge."
 
 #: vipw.8.xml:138(term) usermod.8.xml:311(term) userdel.8.xml:146(term)
 #: useradd.8.xml:445(term) pwconv.8.xml:201(term) pwck.8.xml:209(term)
-#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:115(term)
+#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:126(term)
 #: grpck.8.xml:173(term) groupmod.8.xml:178(term) groupmems.8.xml:165(term)
 #: groupdel.8.xml:101(term) groupadd.8.xml:204(term) faillog.8.xml:180(term)
 #: chsh.1.xml:107(term) chpasswd.8.xml:188(term) chgpasswd.8.xml:146(term)
@@ -385,7 +379,7 @@ msgstr ""
 
 #: vipw.8.xml:142(para) usermod.8.xml:315(para) userdel.8.xml:150(para)
 #: useradd.8.xml:449(para) pwconv.8.xml:205(para) pwck.8.xml:213(para)
-#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:119(para)
+#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:130(para)
 #: grpck.8.xml:177(para) groupmod.8.xml:182(para) groupmems.8.xml:169(para)
 #: groupdel.8.xml:105(para) groupadd.8.xml:208(para) gpasswd.1.xml:185(para)
 #: faillog.8.xml:184(para) chsh.1.xml:111(para) chpasswd.8.xml:192(para)
@@ -414,18 +408,18 @@ msgstr "<option>-q</option>, <option>--quiet</option>"
 msgid "Indicates which user's tcb shadow file to edit."
 msgstr ""
 
-#: vipw.8.xml:165(title) usermod.8.xml:497(title) userdel.8.xml:171(title)
+#: vipw.8.xml:165(title) usermod.8.xml:496(title) userdel.8.xml:171(title)
 #: useradd.8.xml:647(title) su.1.xml:339(title) sg.1.xml:98(title)
 #: pwconv.8.xml:227(title) pwck.8.xml:252(title) passwd.1.xml:390(title)
 #: newusers.8.xml:362(title) newgrp.1.xml:109(title) login.1.xml:294(title)
 #: grpck.8.xml:209(title) groupmod.8.xml:193(title) groupmems.8.xml:199(title)
-#: groupdel.8.xml:128(title) groupadd.8.xml:219(title)
-#: gpasswd.1.xml:264(title) chsh.1.xml:154(title) chpasswd.8.xml:239(title)
-#: chgpasswd.8.xml:198(title) chfn.1.xml:193(title) chage.1.xml:244(title)
+#: groupdel.8.xml:128(title) groupadd.8.xml:219(title) gpasswd.1.xml:264(title)
+#: chsh.1.xml:154(title) chpasswd.8.xml:239(title) chgpasswd.8.xml:198(title)
+#: chfn.1.xml:193(title) chage.1.xml:244(title)
 msgid "CONFIGURATION"
 msgstr ""
 
-#: vipw.8.xml:166(para) usermod.8.xml:498(para) userdel.8.xml:172(para)
+#: vipw.8.xml:166(para) usermod.8.xml:497(para) userdel.8.xml:172(para)
 #: useradd.8.xml:648(para) su.1.xml:340(para) sg.1.xml:99(para)
 #: pwck.8.xml:253(para) passwd.1.xml:391(para) newusers.8.xml:363(para)
 #: newgrp.1.xml:110(para) login.1.xml:295(para) grpck.8.xml:210(para)
@@ -483,37 +477,35 @@ msgstr "HISTORIK"
 msgid "Editor to be used if <option>VISUAL</option> is not set."
 msgstr ""
 
-#: vipw.8.xml:195(title) usermod.8.xml:514(title) userdel.8.xml:188(title)
+#: vipw.8.xml:195(title) usermod.8.xml:513(title) userdel.8.xml:188(title)
 #: useradd.8.xml:675(title) suauth.5.xml:193(title) su.1.xml:367(title)
 #: sg.1.xml:110(title) shadow.5.xml:255(title) shadow.3.xml:226(title)
 #: pwconv.8.xml:250(title) pwck.8.xml:269(title) porttime.5.xml:130(title)
 #: passwd.5.xml:141(title) passwd.1.xml:408(title) newusers.8.xml:397(title)
 #: newgrp.1.xml:121(title) logoutd.8.xml:89(title)
-#: login.access.5.xml:121(title) login.1.xml:338(title)
-#: limits.5.xml:196(title) lastlog.8.xml:182(title) gshadow.5.xml:156(title)
-#: grpck.8.xml:221(title) groups.1.xml:100(title) groupmod.8.xml:205(title)
-#: groupmems.8.xml:211(title) groupdel.8.xml:140(title)
-#: groupadd.8.xml:233(title) gpasswd.1.xml:279(title) faillog.8.xml:243(title)
-#: faillog.5.xml:96(title) expiry.1.xml:121(title) chsh.1.xml:167(title)
-#: chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title) chfn.1.xml:207(title)
-#: chage.1.xml:256(title)
+#: login.access.5.xml:121(title) login.1.xml:338(title) limits.5.xml:196(title)
+#: lastlog.8.xml:204(title) gshadow.5.xml:156(title) grpck.8.xml:221(title)
+#: groups.1.xml:100(title) groupmod.8.xml:205(title) groupmems.8.xml:211(title)
+#: groupdel.8.xml:140(title) groupadd.8.xml:233(title) gpasswd.1.xml:279(title)
+#: faillog.8.xml:243(title) faillog.5.xml:96(title) expiry.1.xml:121(title)
+#: chsh.1.xml:167(title) chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title)
+#: chfn.1.xml:207(title) chage.1.xml:256(title)
 msgid "FILES"
 msgstr "FILER"
 
-#: vipw.8.xml:198(filename) usermod.8.xml:517(filename)
+#: vipw.8.xml:198(filename) usermod.8.xml:516(filename)
 #: userdel.8.xml:191(filename) useradd.8.xml:690(filename)
-#: sg.1.xml:125(filename) pwck.8.xml:272(filename)
-#: newusers.8.xml:412(filename) newgrp.1.xml:136(filename)
-#: gshadow.5.xml:159(filename) grpck.8.xml:224(filename)
-#: groups.1.xml:103(filename) groupmod.8.xml:208(filename)
-#: groupmems.8.xml:214(filename) groupdel.8.xml:143(filename)
-#: groupadd.8.xml:236(filename) gpasswd.1.xml:72(filename)
-#: gpasswd.1.xml:75(filename) gpasswd.1.xml:282(filename)
-#: chgpasswd.8.xml:216(filename)
+#: sg.1.xml:125(filename) pwck.8.xml:272(filename) newusers.8.xml:412(filename)
+#: newgrp.1.xml:136(filename) gshadow.5.xml:159(filename)
+#: grpck.8.xml:224(filename) groups.1.xml:103(filename)
+#: groupmod.8.xml:208(filename) groupmems.8.xml:214(filename)
+#: groupdel.8.xml:143(filename) groupadd.8.xml:236(filename)
+#: gpasswd.1.xml:72(filename) gpasswd.1.xml:75(filename)
+#: gpasswd.1.xml:282(filename) chgpasswd.8.xml:216(filename)
 msgid "/etc/group"
 msgstr "/etc/group"
 
-#: vipw.8.xml:200(para) usermod.8.xml:519(para) userdel.8.xml:193(para)
+#: vipw.8.xml:200(para) usermod.8.xml:518(para) userdel.8.xml:193(para)
 #: useradd.8.xml:692(para) sg.1.xml:127(para) pwck.8.xml:274(para)
 #: newusers.8.xml:414(para) newgrp.1.xml:138(para) gshadow.5.xml:161(para)
 #: grpck.8.xml:226(para) groups.1.xml:105(para) groupmod.8.xml:210(para)
@@ -522,7 +514,7 @@ msgstr "/etc/group"
 msgid "Group account information."
 msgstr "Gruppkontoinformation."
 
-#: vipw.8.xml:204(filename) usermod.8.xml:523(filename)
+#: vipw.8.xml:204(filename) usermod.8.xml:522(filename)
 #: useradd.8.xml:696(filename) sg.1.xml:131(filename)
 #: newusers.8.xml:418(filename) newgrp.1.xml:142(filename)
 #: gshadow.5.xml:165(filename) grpck.8.xml:230(filename)
@@ -533,7 +525,7 @@ msgstr "Gruppkontoinformation."
 msgid "/etc/gshadow"
 msgstr "/etc/gshadow"
 
-#: vipw.8.xml:206(para) usermod.8.xml:525(para) useradd.8.xml:698(para)
+#: vipw.8.xml:206(para) usermod.8.xml:524(para) useradd.8.xml:698(para)
 #: sg.1.xml:133(para) newusers.8.xml:420(para) newgrp.1.xml:144(para)
 #: gshadow.5.xml:167(para) grpck.8.xml:232(para) groupmod.8.xml:216(para)
 #: groupdel.8.xml:151(para) groupadd.8.xml:244(para) gpasswd.1.xml:290(para)
@@ -541,7 +533,7 @@ msgstr "/etc/gshadow"
 msgid "Secure group account information."
 msgstr "Säker gruppkontoinformation."
 
-#: vipw.8.xml:210(filename) usermod.8.xml:535(filename)
+#: vipw.8.xml:210(filename) usermod.8.xml:534(filename)
 #: userdel.8.xml:203(filename) useradd.8.xml:678(filename)
 #: su.1.xml:370(filename) sg.1.xml:113(filename) shadow.5.xml:258(filename)
 #: pwck.8.xml:278(filename) passwd.5.xml:144(filename)
@@ -554,7 +546,7 @@ msgstr "Säker gruppkontoinformation."
 msgid "/etc/passwd"
 msgstr "/etc/passwd"
 
-#: vipw.8.xml:212(para) usermod.8.xml:537(para) userdel.8.xml:205(para)
+#: vipw.8.xml:212(para) usermod.8.xml:536(para) userdel.8.xml:205(para)
 #: useradd.8.xml:680(para) su.1.xml:372(para) sg.1.xml:115(para)
 #: shadow.5.xml:260(para) pwck.8.xml:280(para) passwd.5.xml:146(para)
 #: passwd.1.xml:413(para) newusers.8.xml:402(para) newgrp.1.xml:126(para)
@@ -564,7 +556,7 @@ msgstr "/etc/passwd"
 msgid "User account information."
 msgstr "Användarkontoinformation."
 
-#: vipw.8.xml:216(filename) usermod.8.xml:541(filename)
+#: vipw.8.xml:216(filename) usermod.8.xml:540(filename)
 #: userdel.8.xml:209(filename) useradd.8.xml:684(filename)
 #: su.1.xml:376(filename) sg.1.xml:119(filename) shadow.5.xml:264(filename)
 #: shadow.3.xml:229(filename) pwck.8.xml:284(filename)
@@ -575,7 +567,7 @@ msgstr "Användarkontoinformation."
 msgid "/etc/shadow"
 msgstr "/etc/shadow"
 
-#: vipw.8.xml:218(para) usermod.8.xml:543(para) userdel.8.xml:211(para)
+#: vipw.8.xml:218(para) usermod.8.xml:542(para) userdel.8.xml:211(para)
 #: useradd.8.xml:686(para) su.1.xml:378(para) sg.1.xml:121(para)
 #: shadow.5.xml:266(para) shadow.3.xml:231(para) pwck.8.xml:286(para)
 #: passwd.1.xml:419(para) newusers.8.xml:408(para) newgrp.1.xml:132(para)
@@ -584,7 +576,7 @@ msgstr "/etc/shadow"
 msgid "Secure user account information."
 msgstr "Säker användarkontoinformation."
 
-#: vipw.8.xml:225(title) usermod.8.xml:562(title) userdel.8.xml:308(title)
+#: vipw.8.xml:225(title) usermod.8.xml:561(title) userdel.8.xml:308(title)
 #: useradd.8.xml:804(title) suauth.5.xml:222(title) su.1.xml:438(title)
 #: sg.1.xml:140(title) shadow.5.xml:283(title) shadow.3.xml:238(title)
 #: pwconv.8.xml:262(title) pwck.8.xml:344(title) porttime.5.xml:142(title)
@@ -659,15 +651,15 @@ msgstr ""
 #: usermod.8.xml:46(surname) userdel.8.xml:46(surname)
 #: useradd.8.xml:57(surname) su.1.xml:57(surname) sg.1.xml:41(surname)
 #: shadow.5.xml:40(surname) shadow.3.xml:40(surname) pwck.8.xml:46(surname)
-#: porttime.5.xml:40(surname) passwd.5.xml:40(surname)
-#: passwd.1.xml:47(surname) newusers.8.xml:55(surname)
-#: newgrp.1.xml:41(surname) logoutd.8.xml:40(surname)
-#: login.defs.5.xml:105(surname) login.1.xml:73(surname)
-#: lastlog.8.xml:41(surname) grpck.8.xml:41(surname) groups.1.xml:40(surname)
-#: groupmod.8.xml:41(surname) groupdel.8.xml:41(surname)
-#: groupadd.8.xml:43(surname) faillog.8.xml:40(surname)
-#: faillog.5.xml:40(surname) expiry.1.xml:44(surname) chsh.1.xml:43(surname)
-#: chpasswd.8.xml:44(surname) chfn.1.xml:43(surname) chage.1.xml:41(surname)
+#: porttime.5.xml:40(surname) passwd.5.xml:40(surname) passwd.1.xml:47(surname)
+#: newusers.8.xml:55(surname) newgrp.1.xml:41(surname)
+#: logoutd.8.xml:40(surname) login.defs.5.xml:105(surname)
+#: login.1.xml:73(surname) lastlog.8.xml:41(surname) grpck.8.xml:41(surname)
+#: groups.1.xml:40(surname) groupmod.8.xml:41(surname)
+#: groupdel.8.xml:41(surname) groupadd.8.xml:43(surname)
+#: faillog.8.xml:40(surname) faillog.5.xml:40(surname) expiry.1.xml:44(surname)
+#: chsh.1.xml:43(surname) chpasswd.8.xml:44(surname) chfn.1.xml:43(surname)
+#: chage.1.xml:41(surname)
 msgid "Haugh"
 msgstr ""
 
@@ -1070,7 +1062,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-v</option>, <option>--add-sub-uids</option>&nbsp;"
+"<option>-v</option>, <option>--add-subuids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>NYCKEL</"
@@ -1099,7 +1091,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-V</option>, <option>--del-sub-uids</option>&nbsp;"
+"<option>-V</option>, <option>--del-subuids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>NYCKEL</"
@@ -1112,8 +1104,8 @@ msgstr ""
 #: usermod.8.xml:409(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-sub-uids</option> and <option>--add-"
-"sub-uids</option> are specified, the removal of all subordinate uid ranges "
+"users account. When both <option>--del-subuids</option> and <option>--add-"
+"subuids</option> are specified, the removal of all subordinate uid ranges "
 "happens before any subordinate uid range is added."
 msgstr ""
 
@@ -1123,7 +1115,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-w</option>, <option>--add-sub-gids</option>&nbsp;"
+"<option>-w</option>, <option>--add-subgids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>NYCKEL</"
@@ -1146,7 +1138,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-W</option>, <option>--del-sub-gids</option>&nbsp;"
+"<option>-W</option>, <option>--del-subgids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>NYCKEL</"
@@ -1159,8 +1151,8 @@ msgstr ""
 #: usermod.8.xml:447(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-sub-gids</option> and <option>--add-"
-"sub-gids</option> are specified, the removal of all subordinate gid ranges "
+"users account. When both <option>--del-subgids</option> and <option>--add-"
+"subgids</option> are specified, the removal of all subordinate gid ranges "
 "happens before any subordinate gid range is added."
 msgstr ""
 
@@ -1188,9 +1180,9 @@ msgstr ""
 
 #: usermod.8.xml:478(title) userdel.8.xml:281(title) useradd.8.xml:623(title)
 #: su.1.xml:331(title) shadow.3.xml:218(title) passwd.1.xml:372(title)
-#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:194(title)
-#: groupdel.8.xml:116(title) groupadd.8.xml:257(title)
-#: gpasswd.1.xml:252(title) faillog.8.xml:232(title) chpasswd.8.xml:231(title)
+#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:216(title)
+#: groupdel.8.xml:116(title) groupadd.8.xml:257(title) gpasswd.1.xml:252(title)
+#: faillog.8.xml:232(title) chpasswd.8.xml:231(title)
 #: chgpasswd.8.xml:186(title)
 msgid "CAVEATS"
 msgstr "TÄNK PÅ"
@@ -1200,17 +1192,17 @@ msgid ""
 "You must make certain that the named user is not executing any processes "
 "when this command is being executed if the user's numerical user ID, the "
 "user's name, or the user's home directory is being changed. "
-"<command>usermod</command> checks this on Linux, but only check if the user "
-"is logged in according to utmp on other architectures."
+"<command>usermod</command> checks this on Linux. On other platforms it only "
+"uses utmp to check if the user is logged in."
 msgstr ""
 
-#: usermod.8.xml:487(para)
+#: usermod.8.xml:486(para)
 msgid ""
 "You must change the owner of any <command>crontab</command> files or "
 "<command>at</command> jobs manually."
 msgstr ""
 
-#: usermod.8.xml:491(para)
+#: usermod.8.xml:490(para)
 msgid "You must make any changes involving NIS on the NIS server."
 msgstr ""
 
@@ -1429,7 +1421,7 @@ msgid ""
 "algorithm: <placeholder-1/>"
 msgstr ""
 
-#: usermod.8.xml:529(filename) userdel.8.xml:197(filename)
+#: usermod.8.xml:528(filename) userdel.8.xml:197(filename)
 #: useradd.8.xml:726(filename) su.1.xml:382(filename)
 #: pwconv.8.xml:253(filename) passwd.1.xml:423(filename)
 #: newusers.8.xml:424(filename) login.access.5.xml:124(filename)
@@ -1440,7 +1432,7 @@ msgstr ""
 msgid "/etc/login.defs"
 msgstr "/etc/login.defs"
 
-#: usermod.8.xml:531(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
+#: usermod.8.xml:530(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
 #: su.1.xml:384(para) pwconv.8.xml:255(para) passwd.1.xml:425(para)
 #: newusers.8.xml:426(para) login.access.5.xml:126(para) login.1.xml:391(para)
 #: groupmod.8.xml:222(para) groupadd.8.xml:250(para) chsh.1.xml:184(para)
@@ -1448,31 +1440,31 @@ msgstr "/etc/login.defs"
 msgid "Shadow password suite configuration."
 msgstr ""
 
-#: usermod.8.xml:547(filename) userdel.8.xml:215(filename)
+#: usermod.8.xml:546(filename) userdel.8.xml:215(filename)
 #: useradd.8.xml:714(filename) newusers.8.xml:436(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subgid"
 msgstr "/etc/suauth"
 
-#: usermod.8.xml:549(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
+#: usermod.8.xml:548(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
 #: newusers.8.xml:438(para)
 msgid "Per user subordinate group IDs."
 msgstr ""
 
-#: usermod.8.xml:553(filename) userdel.8.xml:221(filename)
+#: usermod.8.xml:552(filename) userdel.8.xml:221(filename)
 #: useradd.8.xml:720(filename) newusers.8.xml:442(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subuid"
 msgstr "/etc/suauth"
 
-#: usermod.8.xml:555(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
+#: usermod.8.xml:554(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
 #: newusers.8.xml:444(para)
 msgid "Per user subordinate user IDs."
 msgstr ""
 
-#: usermod.8.xml:563(para)
+#: usermod.8.xml:562(para)
 #, fuzzy
 #| msgid ""
 #| "<citerefentry><refentrytitle>chfn</refentrytitle><manvolnum>1</"
@@ -1708,9 +1700,8 @@ msgstr "lyckad"
 #: passwd.1.xml:449(replaceable) newgrp.1.xml:59(manvolnum)
 #: login.1.xml:91(manvolnum) grpck.8.xml:256(replaceable)
 #: groups.1.xml:58(manvolnum) gpasswd.1.xml:63(manvolnum)
-#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum)
-#: chfn.1.xml:61(manvolnum) chage.1.xml:59(manvolnum)
-#: chage.1.xml:289(replaceable)
+#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum) chfn.1.xml:61(manvolnum)
+#: chage.1.xml:59(manvolnum) chage.1.xml:289(replaceable)
 msgid "1"
 msgstr "1"
 
@@ -2072,7 +2063,7 @@ msgid ""
 "<option>PASS_MAX_DAYS</option> and others). <placeholder-1/> Example: "
 "<option>-K</option>&nbsp;<replaceable>PASS_MAX_DAYS</"
 "replaceable>=<replaceable>-1</replaceable> can be used when creating system "
-"account to turn off password ageing, even though system account has no "
+"account to turn off password aging, even though system account has no "
 "password at all. Multiple <option>-K</option> options can be specified, e."
 "g.: <option>-K</option>&nbsp;<replaceable>UID_MIN</"
 "replaceable>=<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;"
@@ -2101,7 +2092,7 @@ msgstr ""
 #: useradd.8.xml:327(para)
 msgid ""
 "By default, the user's entries in the lastlog and faillog databases are "
-"resetted to avoid reusing the entry from a previously deleted user."
+"reset to avoid reusing the entry from a previously deleted user."
 msgstr ""
 
 #: useradd.8.xml:335(term)
@@ -2121,11 +2112,11 @@ msgid ""
 "is not enabled, no home directories are created."
 msgstr ""
 
-#: useradd.8.xml:354(option)
+#: useradd.8.xml:353(term)
 #, fuzzy
-#| msgid "-"
-msgid "-M"
-msgstr "-"
+#| msgid "<option>-m</option>, <option>--create-home</option>"
+msgid "<option>-M</option>, <option>--no-create-home</option>"
+msgstr "<option>-m</option>, <option>--create-home</option>"
 
 #: useradd.8.xml:357(para)
 msgid ""
@@ -2204,10 +2195,10 @@ msgstr ""
 #: useradd.8.xml:434(para)
 msgid ""
 "Note that <command>useradd</command> will not create a home directory for "
-"such an user, regardless of the default setting in <filename>/etc/login."
-"defs</filename> (<option>CREATE_HOME</option>). You have to specify the "
-"<option>-m</option> options if you want a home directory for a system "
-"account to be created."
+"such a user, regardless of the default setting in <filename>/etc/login.defs</"
+"filename> (<option>CREATE_HOME</option>). You have to specify the <option>-"
+"m</option> options if you want a home directory for a system account to be "
+"created."
 msgstr ""
 
 #: useradd.8.xml:461(para)
@@ -2764,7 +2755,7 @@ msgstr ""
 #, no-wrap
 msgid ""
 "\n"
-"      1) the user su is targetting\n"
+"      1) the user su is targeting\n"
 "    "
 msgstr ""
 
@@ -2809,14 +2800,23 @@ msgstr ""
 "emphasis> följt av en lista med användarnamn separerade med \",\""
 
 #: suauth.5.xml:107(para)
+#, fuzzy
+#| msgid ""
+#| "from-id is formatted the same as to-id except the extra word "
+#| "<emphasis>GROUP</emphasis> is recognised. <emphasis>ALL EXCEPT GROUP</"
+#| "emphasis> is perfectly valid too. Following <emphasis>GROUP</emphasis> "
+#| "appears one or more group names, delimited by \",\". It is not sufficient "
+#| "to have primary group id of the relevant group, an entry in "
+#| "<citerefentry><refentrytitle>/etc/group</refentrytitle><manvolnum>5</"
+#| "manvolnum></citerefentry> is neccessary."
 msgid ""
 "from-id is formatted the same as to-id except the extra word "
-"<emphasis>GROUP</emphasis> is recognised. <emphasis>ALL EXCEPT GROUP</"
+"<emphasis>GROUP</emphasis> is recognized. <emphasis>ALL EXCEPT GROUP</"
 "emphasis> is perfectly valid too. Following <emphasis>GROUP</emphasis> "
 "appears one or more group names, delimited by \",\". It is not sufficient to "
 "have primary group id of the relevant group, an entry in "
 "<citerefentry><refentrytitle>/etc/group</refentrytitle><manvolnum>5</"
-"manvolnum></citerefentry> is neccessary."
+"manvolnum></citerefentry> is necessary."
 msgstr ""
 "från-id är formaterad på samma sätt som till-id förutom att det extra ordet "
 "<emphasis>GROUP</emphasis> känns igen. <emphasis>ALL EXCEPT GROUP</emphasis> "
@@ -2954,9 +2954,8 @@ msgstr ""
 "citerefentry>."
 
 #: su.1.xml:58(contrib) shadow.5.xml:41(contrib) shadow.3.xml:41(contrib)
-#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib)
-#: passwd.1.xml:48(contrib) login.1.xml:74(contrib) faillog.8.xml:41(contrib)
-#: faillog.5.xml:41(contrib)
+#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib) passwd.1.xml:48(contrib)
+#: login.1.xml:74(contrib) faillog.8.xml:41(contrib) faillog.5.xml:41(contrib)
 msgid "Creation, 1989"
 msgstr ""
 
@@ -3065,7 +3064,7 @@ msgstr "Ange ett kommando som ska startas av skalet med <option>-c</option>."
 #: su.1.xml:158(para)
 msgid ""
 "The executed command will have no controlling terminal. This option cannot "
-"be used to execute interractive programs which need a controlling TTY."
+"be used to execute interactive programs which need a controlling TTY."
 msgstr ""
 
 #: su.1.xml:168(term)
@@ -3709,7 +3708,7 @@ msgstr ""
 
 #: shadow.5.xml:117(para) gshadow.5.xml:107(para)
 msgid ""
-"A password field which starts with a exclamation mark means that the "
+"A password field which starts with an exclamation mark means that the "
 "password is locked. The remaining characters on the line represent the "
 "password field before the password was locked."
 msgstr ""
@@ -3729,7 +3728,7 @@ msgstr ""
 #: shadow.5.xml:134(para)
 msgid ""
 "The value 0 has a special meaning, which is that the user should change her "
-"pasword the next time she will log in the system."
+"password the next time she will log in the system."
 msgstr ""
 
 #: shadow.5.xml:139(para)
@@ -3843,7 +3842,7 @@ msgstr ""
 #: shadow.5.xml:229(para)
 msgid ""
 "Note that an account expiration differs from a password expiration. In case "
-"of an acount expiration, the user shall not be allowed to login. In case of "
+"of an account expiration, the user shall not be allowed to login. In case of "
 "a password expiration, the user is not allowed to login using her password."
 msgstr ""
 
@@ -4141,18 +4140,15 @@ msgstr ""
 msgid "pwconv"
 msgstr "pwconv"
 
-#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command)
-#: login.defs.5.xml:438(term)
+#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command) login.defs.5.xml:438(term)
 msgid "pwunconv"
 msgstr "pwunconv"
 
-#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command)
-#: login.defs.5.xml:340(term)
+#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command) login.defs.5.xml:340(term)
 msgid "grpconv"
 msgstr "grpconv"
 
-#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command)
-#: login.defs.5.xml:346(term)
+#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command) login.defs.5.xml:346(term)
 msgid "grpunconv"
 msgstr "grpunconv"
 
@@ -4324,8 +4320,7 @@ msgstr "validera integriteten för lösenordsfiler"
 
 #: pwck.8.xml:80(replaceable) passwd.5.xml:57(refentrytitle)
 #: passwd.5.xml:64(refname) passwd.1.xml:64(refentrytitle)
-#: passwd.1.xml:71(refname) passwd.1.xml:77(command)
-#: login.defs.5.xml:409(term)
+#: passwd.1.xml:71(refname) passwd.1.xml:77(command) login.defs.5.xml:409(term)
 msgid "passwd"
 msgstr "passwd"
 
@@ -4485,7 +4480,7 @@ msgstr ""
 msgid ""
 "Note that when <option>USE_TCB</option> is enabled, you cannot specify an "
 "alternative <replaceable>shadow</replaceable> file. In future releases, this "
-"paramater could be replaced by an alternate TCB directory."
+"parameter could be replaced by an alternate TCB directory."
 msgstr ""
 
 #: pwck.8.xml:312(para)
@@ -4934,7 +4929,7 @@ msgstr ""
 
 #: passwd.1.xml:166(para)
 msgid ""
-"You can find advices on how to choose a strong password on http://en."
+"You can find advice on how to choose a strong password on http://en."
 "wikipedia.org/wiki/Password_strength"
 msgstr ""
 
@@ -5305,8 +5300,8 @@ msgstr "PASS_MIN_DAYS (nummer)"
 #: passwd.1.xml:35(para) login.defs.5.xml:35(para)
 msgid ""
 "Number of significant characters in the password for crypt(). "
-"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your crypt"
-"() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
+"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your "
+"crypt() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
 "<replaceable>yes</replaceable>."
 msgstr ""
 
@@ -5478,7 +5473,7 @@ msgstr "HISTORIK"
 #: nologin.8.xml:91(para)
 #, fuzzy
 #| msgid "The <command>nologin</command> command appeared in BSD 4.4."
-msgid "The <command>nologin</command> command appearred in BSD 4.4."
+msgid "The <command>nologin</command> command appeared in BSD 4.4."
 msgstr "Kommandot <command>nologin</command> dök upp i BSD 4.4."
 
 #: newusers.8.xml:72(refentrytitle) newusers.8.xml:79(refname)
@@ -5520,7 +5515,7 @@ msgstr ""
 
 #: newusers.8.xml:116(para)
 msgid ""
-"It can be the name of a new user or the name of an existing user (or an user "
+"It can be the name of a new user or the name of an existing user (or a user "
 "created before by <command>newusers</command>). In case of an existing user, "
 "the user's information will be changed, otherwise a new user will be created."
 msgstr ""
@@ -5549,7 +5544,7 @@ msgstr ""
 
 #: newusers.8.xml:144(para)
 msgid ""
-"If the field is empty, an new (unused) UID will be defined automatically by "
+"If the field is empty, a new (unused) UID will be defined automatically by "
 "<command>newusers</command>."
 msgstr ""
 
@@ -5559,7 +5554,7 @@ msgstr ""
 
 #: newusers.8.xml:152(para)
 msgid ""
-"If this field contains the name of an existing user (or the name of an user "
+"If this field contains the name of an existing user (or the name of a user "
 "created before by <command>newusers</command>), the UID of the specified "
 "user will be used."
 msgstr ""
@@ -6860,7 +6855,9 @@ msgid "D: max data size (KB)"
 msgstr "D: maximal datastorlek (KB)"
 
 #: limits.5.xml:111(para)
-msgid "F: maximum filesize (KB)"
+#, fuzzy
+#| msgid "F: maximum filesize (KB)"
+msgid "F: maximum file size (KB)"
 msgstr "F: maximal filstorlek (KB)"
 
 #: limits.5.xml:112(para)
@@ -6936,7 +6933,7 @@ msgstr ""
 #: limits.5.xml:145(para)
 msgid ""
 "Be aware that after <emphasis remap=\"I\">username</emphasis> the rest of "
-"the line is considered a limit string, thus comments are not allowed. A "
+"the line is considered a limit string, thus comments are not allowed. An "
 "invalid limits string will be rejected (not considered) by the "
 "<command>login</command> program."
 msgstr ""
@@ -6957,13 +6954,13 @@ msgstr ""
 
 #: limits.5.xml:165(para)
 msgid ""
-"If more than one line with limits for an user exist, only the first line for "
+"If more than one line with limits for a user exist, only the first line for "
 "this user will be considered."
 msgstr ""
 
 #: limits.5.xml:170(para)
 msgid ""
-"If no lines are specified for an user, the last <replaceable>@group</"
+"If no lines are specified for a user, the last <replaceable>@group</"
 "replaceable> line matching a group whose the user is a member of will be "
 "considered, or the last line with default limits if no groups contain the "
 "user."
@@ -7041,7 +7038,33 @@ msgid ""
 "Print only lastlog records older than <emphasis remap=\"I\">DAYS</emphasis>."
 msgstr ""
 
-#: lastlog.8.xml:127(term) faillog.8.xml:192(term)
+#: lastlog.8.xml:107(term)
+#, fuzzy
+#| msgid "<option>-q</option>, <option>--quiet</option>"
+msgid "<option>-C</option>, <option>--clear</option>"
+msgstr "<option>-q</option>, <option>--quiet</option>"
+
+#: lastlog.8.xml:111(para)
+#, fuzzy
+#| msgid "<option>-m</option>, <option>--create-home</option>"
+msgid ""
+"Clear lastlog record of a user. This option can be used only together with "
+"<option>-u</option> (<option>--user</option>))."
+msgstr "<option>-m</option>, <option>--create-home</option>"
+
+#: lastlog.8.xml:138(term)
+#, fuzzy
+#| msgid "<option>-r</option>, <option>--reset</option>"
+msgid "<option>-S</option>, <option>--set</option>"
+msgstr "<option>-r</option>, <option>--reset</option>"
+
+#: lastlog.8.xml:142(para)
+msgid ""
+"Set lastlog record of a user to the current time. This option can be used "
+"only together with <option>-u</option> (<option>--user</option>))."
+msgstr ""
+
+#: lastlog.8.xml:149(term) faillog.8.xml:192(term)
 msgid ""
 "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAYS</"
 "replaceable>"
@@ -7049,13 +7072,13 @@ msgstr ""
 "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAGAR</"
 "replaceable>"
 
-#: lastlog.8.xml:131(para)
+#: lastlog.8.xml:153(para)
 msgid ""
 "Print the lastlog records more recent than <emphasis remap=\"I\">DAYS</"
 "emphasis>."
 msgstr ""
 
-#: lastlog.8.xml:138(term) faillog.8.xml:202(term)
+#: lastlog.8.xml:160(term) faillog.8.xml:202(term)
 #, fuzzy
 #| msgid ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
@@ -7067,11 +7090,11 @@ msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>NYCKEL</"
 "replaceable>=<replaceable>VÄRDE</replaceable>"
 
-#: lastlog.8.xml:142(para)
+#: lastlog.8.xml:164(para)
 msgid "Print the lastlog record of the specified user(s)."
 msgstr ""
 
-#: lastlog.8.xml:145(para) faillog.8.xml:211(para)
+#: lastlog.8.xml:167(para) faillog.8.xml:211(para)
 msgid ""
 "The users can be specified by a login name, a numerical user ID, or a "
 "<replaceable>RANGE</replaceable> of users. This <replaceable>RANGE</"
@@ -7080,24 +7103,24 @@ msgid ""
 "UID_MAX</replaceable>), or a min value (<replaceable>UID_MIN-</replaceable>)."
 msgstr ""
 
-#: lastlog.8.xml:157(para)
+#: lastlog.8.xml:179(para)
 msgid ""
 "If the user has never logged in the message <emphasis>** Never logged in**</"
 "emphasis> will be displayed instead of the port and time."
 msgstr ""
 
-#: lastlog.8.xml:162(para)
+#: lastlog.8.xml:184(para)
 msgid ""
 "Only the entries for the current users of the system will be displayed. "
 "Other entries may exist for users that were deleted previously."
 msgstr ""
 
-#: lastlog.8.xml:170(title) groups.1.xml:90(title) chsh.1.xml:140(title)
+#: lastlog.8.xml:192(title) groups.1.xml:90(title) chsh.1.xml:140(title)
 #: chage.1.xml:231(title)
 msgid "NOTE"
 msgstr "NOTERA"
 
-#: lastlog.8.xml:171(para)
+#: lastlog.8.xml:193(para)
 msgid ""
 "The <filename>lastlog</filename> file is a database which contains info on "
 "the last login of each user. You should not rotate it. It is a sparse file, "
@@ -7107,15 +7130,15 @@ msgid ""
 "its real size with \"<command>ls -s</command>\"."
 msgstr ""
 
-#: lastlog.8.xml:185(filename)
+#: lastlog.8.xml:207(filename)
 msgid "/var/log/lastlog"
 msgstr "/var/log/lastlog"
 
-#: lastlog.8.xml:187(para)
+#: lastlog.8.xml:209(para)
 msgid "Database times of previous user logins."
 msgstr "Databastider för tidigare användarinloggningar."
 
-#: lastlog.8.xml:195(para)
+#: lastlog.8.xml:217(para)
 msgid ""
 "Large gaps in UID numbers will cause the lastlog program to run longer with "
 "no output to the screen (i.e. if in lastlog database there is no entries for "
@@ -7179,7 +7202,7 @@ msgstr ""
 #| "modified using the <citerefentry><refentrytitle>chfn</"
 #| "refentrytitle><manvolnum>1</manvolnum></citerefentry> utility."
 msgid ""
-"The password is used when an user who is not a member of the group wants to "
+"The password is used when a user who is not a member of the group wants to "
 "gain the permissions of this group (see <citerefentry><refentrytitle>newgrp</"
 "refentrytitle><manvolnum>1</manvolnum></citerefentry>)."
 msgstr ""
@@ -7683,7 +7706,7 @@ msgstr ""
 #: groupmems.8.xml:109(para)
 #, fuzzy
 #| msgid "Add a new user to the group membership list."
-msgid "Add an user to the group membership list."
+msgid "Add a user to the group membership list."
 msgstr "Lägg till en ny användare till gruppens medlemslista."
 
 #: groupmems.8.xml:110(para) groupmems.8.xml:126(para)
@@ -8682,7 +8705,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> or <option>MD5_CRYPT_ENAB</option> variables "
-"of <filename>/etc/login.defs</filename>, and can be overwitten with the "
+"of <filename>/etc/login.defs</filename>, and can be overwritten with the "
 "<option>-e</option>, <option>-m</option>, or <option>-c</option> options."
 msgstr ""
 
@@ -8697,7 +8720,7 @@ msgstr ""
 msgid ""
 "<phrase condition=\"pam\">Except when PAM is used to encrypt the passwords,</"
 "phrase><command>chpasswd</command> first updates all the passwords in "
-"memory, and then commits all the changes to disk if no errors occured for "
+"memory, and then commits all the changes to disk if no errors occurred for "
 "any user."
 msgstr ""
 
@@ -8861,7 +8884,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> variable of <filename>/etc/login.defs</"
-"filename>, and can be overwiten with the <option>-e</option>, <option>-m</"
+"filename>, and can be overwritten with the <option>-e</option>, <option>-m</"
 "option>, or <option>-c</option> options."
 msgstr ""
 
@@ -9207,6 +9230,11 @@ msgstr ""
 msgid "translator-credits"
 msgstr "Daniel Nylander <po@danielnylander.se>, 2006."
 
+#, fuzzy
+#~| msgid "-"
+#~ msgid "-M"
+#~ msgstr "-"
+
 #~ msgid ""
 #~ "<citerefentry><refentrytitle>chfn</refentrytitle><manvolnum>1</"
 #~ "manvolnum></citerefentry>, <citerefentry><refentrytitle>chsh</"

man/pwck.8.xml

@@ -243,7 +243,7 @@
     <para condition="tcb">
       Note that when <option>USE_TCB</option> is enabled, you cannot
       specify an alternative <replaceable>shadow</replaceable> file. In
-      future releases, this paramater could be replaced by an alternate
+      future releases, this parameter could be replaced by an alternate
       TCB directory.
     </para>
   </refsect1>

man/shadow.5.xml

@@ -115,7 +115,7 @@
 	    any access at all if the password field is empty.
 	  </para>
 	  <para>
-	    A password field which starts with a exclamation mark means
+	    A password field which starts with an exclamation mark means
 	    that the password is locked.  The remaining characters on the
 	    line represent the password field before the password was
 	    locked.
@@ -133,7 +133,7 @@
 	  </para>
 	  <para>
 	    The value 0 has a special meaning, which is that the user
-	    should change her pasword the next time she will log in the
+	    should change her password the next time she will log in the
 	    system.
 	  </para>
 	  <para>
@@ -228,7 +228,7 @@
 	  </para>
 	  <para>
 	    Note that an account expiration differs from a password
-	    expiration.  In case of an acount expiration, the user shall
+	    expiration.  In case of an account expiration, the user shall
 	    not be allowed to login.  In case of a password expiration,
 	    the user is not allowed to login using her password.
 	  </para>