Add Salsa-CI config

Import Debian changes 1:4.2-3+deb8u6
shadow (1:4.2-3+deb8u6) jessie-security; urgency=high . * Non-maintainer upload by the ELTS Security Team. * CVE-2023-4641: When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory. (Closes: #1051062) * CVE-2023-29383: It is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. (Closes: #1034482)
2025-04-15 16:48:03 +02:00 · 2025-04-15 15:51:43 +02:00 · 2025-04-15 13:59:27 +02:00 · 2025-04-15 13:57:33 +02:00 · 2017-02-26 11:37:09 +01:00 · 2017-02-26 11:36:51 +01:00
10205 changed files with 15554 additions and 391642 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -17,8 +17,6 @@ Makefile.in
 /ABOUT-NLS
 /aclocal.m4
 /autom4te.cache
-/compile
-/config.cache
 /config.guess
 /config.h
 /config.h.in
@@ -46,5 +44,4 @@ Makefile.in
 /po/stamp-po

 /shadow.spec
-/shadow-*.tar.*
 /libmisc/getdate.c
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,20 +0,0 @@
-sudo: false
-
-language: c
-
-compiler:
-  - gcc
-  - clang
-
-addons:
-  apt:
-    packages:
-      - autopoint
-      - xsltproc
-
-script:
- - ./autogen.sh --without-selinux --disable-man
- - grep ENABLE_ config.status
- - make
-
-# vim:et:ts=2:sw=2
--- a/81
+++ b/81
@@ -1,84 +1,3 @@
-2016-05-17  Serge Hallyn <serge@hallyn.com>
-
-	* Release 4.5
-
-2016-05-17  Serge Hallyn <serge@hallyn.com>
-
-	* Patch from Tobias Stoeckmann fixing regression in previous CVE fix
-	  preventing SIGTERM to su from being propagated to the job.
-	* Patch from Chris Lamb making sp_lstchg shadow field reproducible.
-	* Merge Russian translation updates from Yuri Kozlov
-	* Fix missing close of subuid file on error
-
-2016-02-23  Serge Hallyn <serge@hallyn.com>
-
-	* Merge patch by Tobias Stoeckmann <tobias@stoeckmann.org> to fix
-	  the equivalent of util-linux CVE-2017-2616.
-
-2016-02-08  Serge Hallyn <serge@hallyn.com>
-
-	* Update Kazakh translations
-	* Consult configuration before calculating subuids
-	* Remove misplaced semicolon
-
-2016-01-29  Serge Hallyn <serge@hallyn.com>
-
-	* Patch from Fedora to improve performance with SSSD, Winbind,
-	  or nss_ldap. (Tomas Mraz)
-	* Make sure knowndef_table is NULL-terminated.  (Bernhard Rosenkränzer)
-
-2016-12-21  Serge Hallyn <serge@hallyn.com>
-
-	* Drop leading underscore from _COMMONIO_H and _SHADOWIO_H
-	* Fix readability in usermod error messages.
-	* Reset user in tallylog
-	* Add audit support to su
-
-2016-12-02  Serge Hallyn <serge@hallyn.com>
-
-	* changes since 4.4
-	  - Use sizeof rather than hardcoding snprintf args
-	  - Fix useradd improper default loading
-	  - Update Vietnamese translations
-	  - Update Polish translations
-	  - Remove non-POSIX chmod option in Makefile
-	  - Fix suidubins assignments
-	  - Fix --add-subuids etc spelling in manpages
-	  - Audit homedir ownership change.
-	  - Print error on selinux file context update failure
-	  - Keep original file perms when creating a backup
-
-	* (henceforth we'll update Changelog with each commit
-	  and proper credit)
-
-2016-12-02  Serge Hallyn <serge@hallyn.com>
-
-	* Changes since 4.2.1:
-	  - Documentation, error report and translations updates
-	  - Replace path_max with 32
-	  - User namespace support fixes/updates including:
-	    - Correct sanity checks in newXidmap
-	    - Fix building without subuid support
-	    - Add /etc/subuid support for UID matching
-	    - Support subuid for nonlocal users
-	    - Default to 65536 subuid allocations
-	    - Respect -r
-	    - Check for range overflows
-	  - Add tests from svn tree
-	  - Use AC_CHECK_SIZEOF for uid_t size checks
-	  - Accomodate missing /etc and login.defs
-	  - Support FORCE_SHADOW
-	  - Be more robust in hostile environment
-	  - Allow removing a primary group
-	  - Clear passwords on __pw_dup errors
-	  - Memory leak fix in commonio_update and get_map_ranges
-	  - Fix resource leak in syslog_sg
-	  - Fix user busy error at userdel
-	  - Support set/clear lastlog record via lastlog command
-	  - Add --no-create-home as longopt for -M
-	  - Fix signal races
-	  - Reduce syslog priority of common usage events
-
 2013-08-25  Nicolas François  <nicolas.francois@centraliens.net>

 	* src/vipw.c: After waitpid(), use errno only if waitpid returned
--- a/Makefile.am
+++ b/Makefile.am
@@ -2,5 +2,7 @@

 EXTRA_DIST = NEWS README TODO shadow.spec.in

+AUTOMAKE_OPTIONS = 1.5 dist-bzip2 foreign
+
 SUBDIRS = po man libmisc lib src \
 	contrib doc etc
--- a/3
+++ b/3
@@ -117,6 +117,5 @@ Maintainers
 ===========

 Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
-Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
-Serge E. Hallyn <serge@hallyn.com> (2014-now)
+Nicolas François <nicolas.francois@centraliens.net> (2007-now)

--- a/configure.in
+++ b/configure.in
@@ -1,9 +1,6 @@
 dnl Process this file with autoconf to produce a configure script.
-AC_PREREQ([2.64])
-AC_INIT([shadow], [4.5], [pkg-shadow-devel@lists.alioth.debian.org], [],
-	[https://github.com/shadow-maint/shadow])
-AM_INIT_AUTOMAKE([1.11 foreign dist-xz])
-AM_SILENT_RULES([yes])
+AC_INIT
+AM_INIT_AUTOMAKE(shadow, 4.2)
 AC_CONFIG_HEADERS([config.h])

 dnl Some hacks...
@@ -338,10 +335,16 @@ if test "$enable_subids" != "no"; then
 	dnl
 	dnl FIXME: check if 32 bit UIDs/GIDs are supported by libc
 	dnl
-	AC_CHECK_SIZEOF([uid_t],, [#include "sys/types.h"])
-	AC_CHECK_SIZEOF([gid_t],, [#include "sys/types.h"])
+	AC_RUN_IFELSE([AC_LANG_SOURCE([
+#include <sys/types.h>
+int main(void) {
+	uid_t u;
+	gid_t g;
+	return (sizeof u < 4) || (sizeof g < 4);
+}
+	])], [id32bit="yes"], [id32bit="no"])

-	if test "$ac_cv_sizeof_uid_t" -ge 4 && test "$ac_cv_sizeof_gid_t" -ge 4; then
+	if test "x$id32bit" = "xyes"; then
 		AC_DEFINE(ENABLE_SUBIDS, 1, [Define to support the subordinate IDs.])
 		enable_subids="yes"
 	else
--- a/debian/README.source
+++ b/debian/README.source
@@ -1,4 +1,17 @@
-A testsuite is also available. Instruction on how to run this testsuite
-are available in tests/README
+This package uses quilt to patch the upstream source.
+
+You can find some info on how to generate the patched source, add a new
+modification, and remove an existing modification on:
+	/usr/share/doc/quilt/README.source
+
+================================================================================
+
+To package a new upstream release, you can use the Makefile:
+	svn://svn.debian.org/svn/pkg-shadow/debian/trunk/Makefile
+
+================================================================================
+
+A testsuite is also available. Instruction on how to run this testsuite
+are available on:
+	svn://svn.debian.org/svn/pkg-shadow/debian/trunk/tests/README

- -- Balint Reczey <rbalint@ubuntu.com>, Sat, 12 Aug 2017 18:46:44 -0400
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,175 +1,64 @@
-shadow (1:4.5-1.1+deb10u1) buster-security; urgency=medium
+shadow (1:4.2-3+deb8u6) jessie-security; urgency=high

-  * Non-maintainer upload by the ELTS Team.
-  * CVE-2018-7169: unprivileged user can drop supplementary groups
-  * CVE-2023-4641: gpasswd password leak
-  * CVE-2023-29383: chfn missing control character check
+  * Non-maintainer upload by the ELTS Security Team.
+  * CVE-2023-4641: When asking for a new password, shadow-utils asks the
+    password twice. If the password fails on the second attempt,
+    shadow-utils fails in cleaning the buffer used to store the first
+    entry. This may allow an attacker with enough access to retrieve the
+    password from the memory. (Closes: #1051062)
+  * CVE-2023-29383: It is possible to inject control characters into
+    fields provided to the SUID program chfn (change finger). Although it
+    is not possible to exploit this directly (e.g., adding a new user
+    fails because \n is in the block list), it is possible to misrepresent
+    the /etc/passwd file when viewed. (Closes: #1034482)

- -- Adrian Bunk <bunk@debian.org>  Sat, 26 Oct 2024 15:24:09 +0300
+ -- Sylvain Beucler <beuc@debian.org>  Tue, 15 Apr 2025 14:26:11 +0200
+  
+shadow (1:4.2-3+deb8u5) jessie-security; urgency=high

-shadow (1:4.5-1.1) unstable; urgency=medium
+  * Non-maintainer upload by the ELTS team.
+  * SECURITY UPDATE: Crash or buffer overflow
+    - debian/patches/CVE-2017-12424.patch: fix buffer overflow if
+      NULL line is present in db in lib/commonio.c.
+    - CVE-2017-12424
+  * SECURITY UPDATE: Access to privileged information
+    - debian/patches/CVE-2018-7169.patch: newgidmap:
+      enforce setgroups=deny if self-mapping a group in
+      src/newgidmap.c.
+    - CVE-2018-7169

-  * Non-maintainer upload (greetings from DebCamp/DebConf Taiwan).
-  * Stop shipping su and break old util-linux version. (See #833256)
-    - Breaks on old version to force lockstep upgrade, which should
-      really be a depends-new-version (and can be switched around
-      together with util-linux once the transition is finished).
-      Using Breaks/Depends the 'wrong' way around is to make apt
-      unpack things in the 'right' order (avoiding any gaps where
-      /bin/su is not available during the upgrade phase).
+ -- Utkarsh Gupta <utkarsh@ubuntu.com>  Tue, 01 Feb 2022 04:40:19 +0530

- -- Andreas Henriksson <andreas@fatal.se>  Fri, 27 Jul 2018 10:07:37 +0200
+shadow (1:4.2-3+deb8u4) jessie-security; urgency=high

-shadow (1:4.5-1) unstable; urgency=medium
-
-  * New upstream version 4.5
-    - Fix buffer overflow if NULL line is present in db (CVE-2017-12424)
-      (Closes: #756630)
-    - Make the sp_lstchg shadow field reproducible (Closes: #857803)
-    - Fix regression in useradd not loading defaults properly.
-      (Closes: #865762)
-  * Refresh patches
-  * Drop patches manipulating su argument concatenation:
-  * Cut redundant information from Debian-specific README files
-  * Revert adding pts/0 and pts/1 to securetty.
-    Adding pts/* defeats the purpose of securetty. Let containers add it if
-    needed as described in #830255.
-  * Use my @ubuntu.com email address in Maintainer field
-
- -- Balint Reczey <rbalint@ubuntu.com>  Wed, 27 Sep 2017 12:45:23 -0400
-
-shadow (1:4.4-4.1) unstable; urgency=high
-
-  * Non-maintainer upload.
+  * Non-maintainer upload by the Security Team.
  * Reset pid_child only if waitpid was successful.
    This is a regression fix for CVE-2017-2616. If su receives a signal like
    SIGTERM, it is not propagated to the child. (Closes: #862806)

- -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 17 May 2017 13:59:59 +0200
+ -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 17 May 2017 12:58:54 +0200

-shadow (1:4.4-4) unstable; urgency=high
+shadow (1:4.2-3+deb8u3) jessie-security; urgency=high

+  * Fix integer overflow in getulong.c (CVE-2016-6252) (Closes: #832170)
+  * Refresh patches
+  * Add myself to uploaders replacing Nicolas FRANCOIS (Nekral)
+
+ -- Balint Reczey <balint@balintreczey.hu>  Fri, 24 Feb 2017 00:57:31 +0100
+
+shadow (1:4.2-3+deb8u2) jessie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
  * su: properly clear child PID (CVE-2017-2616) (Closes: #855943)

- -- Balint Reczey <balint@balintreczey.hu>  Fri, 24 Feb 2017 01:33:25 +0100
+ -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 23 Feb 2017 17:21:08 +0100

-shadow (1:4.4-3) unstable; urgency=medium
-
-  [ Balint Reczey ]
-  * Clean up stale locks on boot (Closes: #478771)
-  * Sync motd handling with sshd.
-    Using patch from Ubuntu (Closes: #757148)
-
-  [ Stéphane Graber ]
-  * Add missing /etc/{subgid|subuid} in postinst
-
- -- Balint Reczey <balint@balintreczey.hu>  Wed, 25 Jan 2017 16:43:09 +0100
-
-shadow (1:4.4-2) unstable; urgency=medium
-
-  [ Balint Reczey ]
-  * Update homepage to new upstream
-  * Always use /bin/sh shell in the build (Closes: #817971)
-  * Replace user´s -> user's to make login.def file valid ASCII
-    (Closes: #850338)
-  * Update patch naming docmentation
-  * Fix typos in German man pages (Closes: #734609)
-  * Send 1000_configure_userns patch upstream
-  * Add call to pam_keyinit for login pam service.
-    This module is linux-any only, so copy what openssh has already done and
-    remove the call at build time for other architectures.
-    The call to this module is needed to have proper per-session kernel
-    keyring. (Closes: #734671)
-  * Add pts/0 and pts/1 to securetty (Closes: #830255)
-  * Add ttySAC* to securetty (Closes: #824391)
-  * Add ttySC[4-9] to securetty (Closes: #768020)
-
-  [ Laurent Bigonville ]
-  * Move pam_selinux open call higher in the session stack (Closes: #747313)
-
-  [ Christian Perrier ]
-  * Fix typos in login.pam (thanks to Jakub Wilk for reporting)
-    (Closes: #747115)
-  * Include groupmems(8) in the passwd package (Closes: #663117)
-
-  [ Frans Spiesschaert ]
-  * Dutch translation update (Closes: #772470)
-
-  [ Trần Ngọc Quân ]
-  * Update Vietnamese translation (Closes: #777107)
-
-  [ Miroslav Kuře ]
-  * Updated Czech translation. (Closes: #759113)
-
-  [ Holger Wansing ]
-  * Update for German man pages
-
-  [ Thomas Blein ]
-  * French manpage translation (Closes: #805182)
-
-  [ Lars Bahner ]
-  * Fix some spelling issues in the Norwegian translation (Closes: #800553)
-
- -- Balint Reczey <balint@balintreczey.hu>  Thu, 19 Jan 2017 18:22:49 +0100
-
-shadow (1:4.4-1) unstable; urgency=medium
-
-  [ Christian Perrier ]
-  * Imported Upstream version 4.2
-  * Debian patch: Fix typo in su.1.xml
-  * Configure userns
-  * Vietnamese translation update
-  * French translation update (Closes: #725793)
-  * German translation update
-  * Update NEWS file
-  * Issue a warning if no manpages have been generated
-  * Regenerate PO files
-  * Regenerate manpages PO files
-  * Imported Upstream version 4.2.1
-
-  [ Serge Hallyn ]
-  * Import new upstream
-  * Patch changes:
-    - Update 501_commonio_group_shadow to work with upstream changes
-    - Update 1010_vietnamese_translation
-    - Drop userns patches which are now all upstream
-
-  [ Balint Reczey ]
-  * Update debian/watch to use GitHub releases
-  * Imported Upstream version 4.4
-    - Fix incorrect integer handling (CVE-2016-6252) (Closes: #832170)
-  * Disable Vietnamese translation patch because it does not apply cleanly
-  * Bump debhelper compat level to 10
-  * ACK NMU by Samuel Thibault dropping the patch which is integrated
-    upstream
-  * Stop build-depending on build-essential dpkg-dev
-  * Tag login package as essential properly
-  * Adopt the package under the Shadow Team's umbrella (Closes: #801707)
-
- -- Balint Reczey <balint@balintreczey.hu>  Fri, 06 Jan 2017 16:19:18 +0100
-
-shadow (1:4.2-3.3) unstable; urgency=medium
-
-  * Non-maintainer upload.
-  * Apply upstream patch to fix build on hurd-i386. (Closes: #750480)
-
- -- Samuel Thibault <sthibault@debian.org>  Tue, 22 Nov 2016 18:31:28 +0000
-
-shadow (1:4.2-3.2) unstable; urgency=medium
-
-  * Non-maintainer upload.
-  * Use HTTPS in Vcs-Git.
-  * Stop using hardening-wrapper and instead use /usr/share/dpkg/buildflags.mk.
-    Closes: #836653
-
- -- Mattia Rizzolo <mattia@debian.org>  Sun, 18 Sep 2016 14:42:16 +0000
-
-shadow (1:4.2-3.1) unstable; urgency=medium
+shadow (1:4.2-3+deb8u1) jessie; urgency=medium

  * Non-maintainer upload.
  * Fix error handling in busy user detection. (Closes: #778287)

- -- Bastian Blank <bastian.blank@credativ.de>  Thu, 12 Nov 2015 14:33:33 +0000
+ -- Bastian Blank <bastian.blank@credativ.de>  Wed, 18 Nov 2015 08:07:09 +0000

 shadow (1:4.2-3) unstable; urgency=low

--- a/debian/compat
+++ b/debian/compat
@@ -1 +1 @@
-10
+6
--- a/debian/control
+++ b/debian/control
@@ -1,38 +1,21 @@
 Source: shadow
-Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
-Uploaders: Christian Perrier <bubulle@debian.org>,
-           Balint Reczey <rbalint@ubuntu.com>,
-           Serge Hallyn <serge@hallyn.com>
 Section: admin
 Priority: required
-Build-Depends: dh-autoreconf,
-               gettext,
-               libpam0g-dev,
-               debhelper (>= 10~),
-               quilt,
-               xsltproc,
-               docbook-xsl,
-               docbook-xml,
-               libxml2-utils,
-               cdbs,
-               libselinux1-dev [linux-any],
-               libsemanage1-dev [linux-any],
-               gnome-doc-utils,
-               bison,
-               libaudit-dev [linux-any]
+Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
 Standards-Version: 3.9.5
-Vcs-Browser: https://anonscm.debian.org/git/pkg-shadow/shadow.git
-Vcs-Git: https://anonscm.debian.org/git/pkg-shadow/shadow.git
-Homepage: https://github.com/shadow-maint/shadow
+Uploaders: Christian Perrier <bubulle@debian.org>,
+           Balint Reczey <balint@balintreczey.hu>
+Build-Depends: dh-autoreconf, gettext, libpam0g-dev, debhelper (>= 6.0.7~), quilt, dpkg-dev (>= 1.13.5), xsltproc, docbook-xsl, docbook-xml, libxml2-utils, cdbs, libselinux1-dev [linux-any], libsemanage1-dev [linux-any], gnome-doc-utils (>= 0.4.3), bison, libaudit-dev [linux-any]
+ ,hardening-wrapper
+Vcs-Git: git://anonscm.debian.org/git/pkg-shadow/shadow.git
+Vcs-Browser: http://anonscm.debian.org/gitweb/?p=pkg-shadow/shadow.git;a=summary
+Homepage: http://pkg-shadow.alioth.debian.org/

 Package: passwd
 Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-modules, debianutils (>= 2.15.2)
+Replaces: manpages-tr (<<1.0.5), manpages-zh (<<1.5.1-1)
 Multi-Arch: foreign
-Depends: ${shlibs:Depends},
-         ${misc:Depends},
-         libpam-modules
-Replaces: manpages-tr (<< 1.0.5),
-          manpages-zh (<< 1.5.1-1)
 Description: change and administer password and group data
 This package includes passwd, chsh, chfn, and many other programs to
 maintain password and group data.
@@ -41,26 +24,11 @@ Description: change and administer password and group data

 Package: login
 Architecture: any
+Pre-Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-runtime, libpam-modules (>= 1.1.8-1)
+Conflicts: gnunet (<< 0.7.0c-2), amavisd-new (<<2.3.3-8), python-4suite (<< 0.99cvs20060405-1), backupninja (<< 0.9.3-5), echolot (<< 2.1.8-4)
+Breaks: coreutils (<< 8.21~) [hurd-any], passwd (<< 1:4.1.5.1-2~) [hurd-any], hurd (<< 20140206~) [hurd-any]
+Replaces: manpages-de (<< 0.5-3), manpages-tr (<<1.0.5), manpages-zh (<<1.5.1-1), passwd (<< 1:4.1.5.1-2~) [hurd-any], coreutils (<< 8.21~) [hurd-any], hurd (<< 20140206~) [hurd-any]
 Essential: yes
-Pre-Depends: ${shlibs:Depends},
-             ${misc:Depends},
-             libpam-runtime,
-             libpam-modules (>= 1.1.8-1)
-Breaks: coreutils (<< 8.21~) [hurd-any],
-        passwd (<< 1:4.1.5.1-2~) [hurd-any],
-        hurd (<< 20140206~) [hurd-any],
-        util-linux (<< 2.32-0.2~)
-Conflicts: gnunet (<< 0.7.0c-2),
-           amavisd-new (<< 2.3.3-8),
-           python-4suite (<< 0.99cvs20060405-1),
-           backupninja (<< 0.9.3-5),
-           echolot (<< 2.1.8-4)
-Replaces: manpages-de (<< 0.5-3),
-          manpages-tr (<< 1.0.5),
-          manpages-zh (<< 1.5.1-1),
-          passwd (<< 1:4.1.5.1-2~) [hurd-any],
-          coreutils (<< 8.21~) [hurd-any],
-          hurd (<< 20140206~) [hurd-any]
 Description: system login tools
 These tools are required to be able to login and use your system. The
 login program invokes your user shell and enables command execution. The
@@ -69,10 +37,9 @@ Description: system login tools
 user ID (useful being able to execute commands as another user).

 Package: uidmap
-Architecture: any
 Priority: optional
-Depends: ${shlibs:Depends},
-         ${misc:Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Architecture: any
 Description: programs to help use subuids
 These programs help unprivileged users to create uid and gid mappings in
 user namespaces.
--- a/debian/login.defs
+++ b/debian/login.defs
@@ -214,7 +214,7 @@ DEFAULT_HOME	yes
 #USERDEL_CMD	/usr/sbin/userdel_local

 #
-# If set to yes, userdel will remove the user's group if it contains no
+# If set to yes, userdel will remove the user´s group if it contains no
 # more members, and useradd will create by default a group with the name
 # of the user.
 #
--- a/debian/login.install
+++ b/debian/login.install
@@ -2,6 +2,7 @@ usr/share/locale/*/LC_MESSAGES/shadow.mo
 usr/share/man/*/man1/login.1
 usr/share/man/*/man1/newgrp.1
 usr/share/man/*/man1/sg.1
+usr/share/man/*/man1/su.1
 usr/share/man/*/man5/faillog.5
 usr/share/man/*/man5/login.defs.5
 usr/share/man/*/man8/faillog.8
@@ -10,6 +11,7 @@ usr/share/man/*/man8/nologin.8
 usr/share/man/man1/login.1
 usr/share/man/man1/newgrp.1
 usr/share/man/man1/sg.1
+usr/share/man/man1/su.1
 usr/share/man/man5/faillog.5
 usr/share/man/man5/login.defs.5
 usr/share/man/man8/faillog.8
@@ -20,3 +22,4 @@ usr/bin/faillog
 usr/bin/lastlog
 usr/bin/newgrp
 bin/login
+bin/su
--- a/debian/login.pam
+++ b/debian/login.pam
@@ -35,23 +35,13 @@ auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die]
 # (Replaces the `NOLOGINS_FILE' option from login.defs)
 auth       requisite  pam_nologin.so

-# SELinux needs to be the first session rule. This ensures that any
-# lingering context has been cleared. Without this it is possible
+# SELinux needs to be the first session rule. This ensures that any 
+# lingering context has been cleared. Without out this it is possible 
 # that a module could execute code in the wrong domain.
 # When the module is present, "required" would be sufficient (When SELinux
 # is disabled, this returns success.)
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

-# Sets the loginuid process attribute
-session    required     pam_loginuid.so
-
-# SELinux needs to intervene at login time to ensure that the process
-# starts in the proper default security context. Only sessions which are
-# intended to run in the user's context should be run after this.
-session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
-# When the module is present, "required" would be sufficient (When SELinux
-# is disabled, this returns success.)
-
 # This module parses environment configuration file(s)
 # and also allows you to use an extended config
 # file /etc/security/pam_env.conf.
@@ -72,7 +62,7 @@ session       required   pam_env.so readenv=1 envfile=/etc/default/locale
 auth       optional   pam_group.so

 # Uncomment and edit /etc/security/time.conf if you need to set
-# time restraint on logins.
+# time restrainst on logins.
 # (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
 # as well as /etc/porttime)
 # account    requisite  pam_time.so
@@ -86,18 +76,16 @@ auth       optional   pam_group.so
 # (Replaces the use of /etc/limits in old login)
 session    required   pam_limits.so

-# Prints the last login info upon successful login
+# Prints the last login info upon succesful login
 # (Replaces the `LASTLOG_ENAB' option from login.defs)
 session    optional   pam_lastlog.so

-# Prints the message of the day upon successful login.
+# Prints the message of the day upon succesful login.
 # (Replaces the `MOTD_FILE' option in login.defs)
-# This includes a dynamically generated part from /run/motd.dynamic
-# and a static (admin-editable) part from /etc/motd.
-session    optional   pam_motd.so motd=/run/motd.dynamic
-session    optional   pam_motd.so noupdate
+session    optional   pam_exec.so type=open_session stdout /bin/uname -snrvm
+session    optional   pam_motd.so

-# Prints the status of the user's mailbox upon successful login
+# Prints the status of the user's mailbox upon succesful login
 # (Replaces the `MAIL_CHECK_ENAB' option from login.defs). 
 #
 # This also defines the MAIL environment variable
@@ -107,10 +95,17 @@ session    optional   pam_motd.so noupdate
 # See comments in /etc/login.defs
 session    optional   pam_mail.so standard

-# Create a new session keyring.
-session    optional   pam_keyinit.so force revoke
+# Sets the loginuid process attribute
+session    required     pam_loginuid.so

 # Standard Un*x account and session
@include common-account
@include common-session
@include common-password
+
+# SELinux needs to intervene at login time to ensure that the process
+# starts in the proper default security context. Only sessions which are
+# intended to run in the user's context should be run after this.
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
+# When the module is present, "required" would be sufficient (When SELinux
+# is disabled, this returns success.)
--- a/debian/login.postinst
+++ b/debian/login.postinst
@@ -16,26 +16,14 @@ then
 fi
 rm -f /etc/pam.d/login.pre-upgrade 2>/dev/null

-if [ "$1" = "configure" ]; then
+if [ "$1" = "configure" ] && [ "$2" = "" ]
+then
 	# Install faillog during initial installs only
-	if [ "$2" = "" ] && [ ! -f /var/log/faillog ] ; then
+	if [ ! -f /var/log/faillog ] ; then
 		touch /var/log/faillog
 		chown root:root /var/log/faillog
 		chmod 644 /var/log/faillog
 	fi
-
-	# Create subuid/subgid if missing
-	if [ ! -e /etc/subuid ]; then
-		touch /etc/subuid
-		chown root:root /etc/subuid
-		chmod 644 /etc/subuid
-	fi
-
-	if [ ! -e /etc/subgid ]; then
-		touch /etc/subgid
-		chown root:root /etc/subgid
-		chmod 644 /etc/subgid
-	fi
 fi

        # Create subuid/subgid if missing
--- a/debian/passwd.install
+++ b/debian/passwd.install
@@ -10,7 +10,6 @@ usr/sbin/cppw
 usr/sbin/groupadd
 usr/sbin/groupdel
 usr/sbin/groupmod
-usr/sbin/groupmems
 usr/sbin/grpck
 usr/sbin/grpconv
 usr/sbin/grpunconv
@@ -35,7 +34,6 @@ usr/share/man/*/man8/chpasswd.8
 usr/share/man/*/man8/groupadd.8
 usr/share/man/*/man8/groupdel.8
 usr/share/man/*/man8/groupmod.8
-usr/share/man/*/man8/groupmems.8
 usr/share/man/*/man8/grpck.8
 usr/share/man/*/man8/grpconv.8
 usr/share/man/*/man8/grpunconv.8
--- a/debian/passwd.tmpfile
+++ b/debian/passwd.tmpfile
@@ -1,8 +0,0 @@
-# If a password operation is in progress and we lose power, stale lockfiles
-# can be left behind.  Clear them on boot.
-r! /etc/gshadow.lock
-r! /etc/shadow.lock
-r! /etc/passwd.lock
-r! /etc/group.lock
-r! /etc/subuid.lock
-r! /etc/subgid.lock
--- a/debian/patches/0003-Added-control-character-check.patch
+++ b/debian/patches/0003-Added-control-character-check.patch
@@ -1,45 +0,0 @@
-From b42c60bc8f026b250810a75bafe865338d734ec3 Mon Sep 17 00:00:00 2001
-From: tomspiderlabs <128755403+tomspiderlabs@users.noreply.github.com>
-Date: Thu, 23 Mar 2023 23:39:38 +0000
-Subject: Added control character check
-
-Added control character check, returning -1 (to "err") if control characters are present.
---
- lib/fields.c | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/lib/fields.c b/lib/fields.c
-index 649fae17..b8f13ba7 100644
--- a/lib/fields.c
-+++ b/lib/fields.c
-@@ -44,9 +44,9 @@
-  *
-  * The supplied field is scanned for non-printable and other illegal
-  * characters.
- *  + -1 is returned if an illegal character is present.
- *  +  1 is returned if no illegal characters are present, but the field
- *       contains a non-printable character.
-+ *  + -1 is returned if an illegal or control character is present.
-+ *  +  1 is returned if no illegal or control characters are present,
-+ *       but the field contains a non-printable character.
-  *  +  0 is returned otherwise.
-  */
- int valid_field (const char *field, const char *illegal)
-@@ -68,10 +68,13 @@ int valid_field (const char *field, const char *illegal)
- 	}
- 
- 	if (0 == err) {
-		/* Search if there are some non-printable characters */
-+		/* Search if there are non-printable or control characters */
- 		for (cp = field; '\0' != *cp; cp++) {
- 			if (!isprint (*cp)) {
- 				err = 1;
-+			}
-+			if (!iscntrl (*cp)) {
-+				err = -1;
- 				break;
- 			}
- 		}
-- 
-2.30.2
-
--- a/debian/patches/0004-Overhaul-valid_field.patch
+++ b/debian/patches/0004-Overhaul-valid_field.patch
@@ -1,61 +0,0 @@
-From 261c9cd274f07361c304d3993e325fe29d4bad14 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
-Date: Fri, 31 Mar 2023 14:46:50 +0200
-Subject: Overhaul valid_field()
-
-e5905c4b ("Added control character check") introduced checking for
-control characters but had the logic inverted, so it rejects all
-characters that are not control ones.
-
-Cast the character to `unsigned char` before passing to the character
-checking functions to avoid UB.
-
-Use strpbrk(3) for the illegal character test and return early.
---
- lib/fields.c | 24 ++++++++++--------------
- 1 file changed, 10 insertions(+), 14 deletions(-)
-
-diff --git a/lib/fields.c b/lib/fields.c
-index b8f13ba7..191257e8 100644
--- a/lib/fields.c
-+++ b/lib/fields.c
-@@ -60,26 +60,22 @@ int valid_field (const char *field, const char *illegal)
- 
- 	/* For each character of field, search if it appears in the list
- 	 * of illegal characters. */
-+	if (illegal && NULL != strpbrk (field, illegal)) {
-+		return -1;
-+	}
-+
-+	/* Search if there are non-printable or control characters */
- 	for (cp = field; '\0' != *cp; cp++) {
-		if (strchr (illegal, *cp) != NULL) {
-+		unsigned char c = *cp;
-+		if (!isprint (c)) {
-+			err = 1;
-+		}
-+		if (iscntrl (c)) {
- 			err = -1;
- 			break;
- 		}
- 	}
- 
-	if (0 == err) {
-		/* Search if there are non-printable or control characters */
-		for (cp = field; '\0' != *cp; cp++) {
-			if (!isprint (*cp)) {
-				err = 1;
-			}
-			if (!iscntrl (*cp)) {
-				err = -1;
-				break;
-			}
-		}
-	}
-
- 	return err;
- }
- 
-- 
-2.30.2
-
--- a/debian/patches/008_login_log_failure_in_FTMP
+++ b/debian/patches/008_login_log_failure_in_FTMP
@@ -4,11 +4,11 @@ Notes:
 * I'm not sure login should add an entry in the FTMP file when PAM is used.
   (but nothing in /etc/login.defs indicates that the failure is not logged)

-Index: shadow-4.4/src/login.c
+Index: git/src/login.c
 ===================================================================
--- shadow-4.4.orig/src/login.c
-+++ shadow-4.4/src/login.c
-@@ -834,6 +834,24 @@ int main (int argc, char **argv)
+--- git.orig/src/login.c
+++ git/src/login.c
+@@ -831,6 +831,24 @@
 			(void) puts ("");
 			(void) puts (_("Login incorrect"));
 
@@ -33,19 +33,11 @@ Index: shadow-4.4/src/login.c
 			if (failcount >= retries) {
 				SYSLOG ((LOG_NOTICE,
 				         "TOO MANY LOGIN TRIES (%u)%s FOR '%s'",
-Index: shadow-4.4/lib/getdef.c
+Index: git/lib/getdef.c
 ===================================================================
--- shadow-4.4.orig/lib/getdef.c
-+++ shadow-4.4/lib/getdef.c
-@@ -57,7 +57,6 @@ struct itemdef {
- 	{"ENVIRON_FILE", NULL},			\
- 	{"ENV_TZ", NULL},			\
- 	{"FAILLOG_ENAB", NULL},			\
-	{"FTMP_FILE", NULL},			\
- 	{"ISSUE_FILE", NULL},			\
- 	{"LASTLOG_ENAB", NULL},			\
- 	{"LOGIN_STRING", NULL},			\
-@@ -88,6 +87,7 @@ static struct itemdef def_table[] = {
+--- git.orig/lib/getdef.c
+++ git/lib/getdef.c
+@@ -62,6 +62,7 @@
 	{"ERASECHAR", NULL},
 	{"FAIL_DELAY", NULL},
 	{"FAKE_SHELL", NULL},
@@ -53,3 +45,11 @@ Index: shadow-4.4/lib/getdef.c
 	{"GID_MAX", NULL},
 	{"GID_MIN", NULL},
 	{"HUSHLOGIN_FILE", NULL},
+@@ -109,7 +110,6 @@
+ 	{"ENVIRON_FILE", NULL},
+ 	{"ENV_TZ", NULL},
+ 	{"FAILLOG_ENAB", NULL},
+-	{"FTMP_FILE", NULL},
+ 	{"ISSUE_FILE", NULL},
+ 	{"LASTLOG_ENAB", NULL},
+ 	{"LOGIN_STRING", NULL},
--- a/debian/patches/1000_configure_userns
+++ b/debian/patches/1000_configure_userns
@@ -0,0 +1,93 @@
+=== modified file 'etc/login.defs'
+Index: git/etc/login.defs
+===================================================================
+--- git.orig/etc/login.defs
+++ git/etc/login.defs
+@@ -229,7 +229,7 @@
+ # Extra per user uids
+ SUB_UID_MIN		   100000
+ SUB_UID_MAX		600100000
+-SUB_UID_COUNT		    10000
+SUB_UID_COUNT		    65536
+ 
+ #
+ # Min/max values for automatic gid selection in groupadd(8)
+@@ -242,7 +242,7 @@
+ # Extra per user group ids
+ SUB_GID_MIN		   100000
+ SUB_GID_MAX		600100000
+-SUB_GID_COUNT		    10000
+SUB_GID_COUNT		    65536
+ 
+ #
+ # Max number of login(1) retries if password is bad
+Index: git/src/newusers.c
+===================================================================
+--- git.orig/src/newusers.c
+++ git/src/newusers.c
+@@ -988,8 +988,8 @@
+ 	is_shadow_grp = sgr_file_present ();
+ #endif
+ #ifdef ENABLE_SUBIDS
+-	is_sub_uid = sub_uid_file_present ();
+-	is_sub_gid = sub_gid_file_present ();
+	is_sub_uid = sub_uid_file_present () && !rflg;
+	is_sub_gid = sub_gid_file_present () && !rflg;
+ #endif				/* ENABLE_SUBIDS */
+ 
+ 	open_files ();
+Index: git/src/useradd.c
+===================================================================
+--- git.orig/src/useradd.c
+++ git/src/useradd.c
+@@ -1994,6 +1994,10 @@
+ #endif				/* USE_PAM */
+ #endif				/* ACCT_TOOLS_SETUID */
+ 
+	/* Needed for userns check */
+	uid_t uid_min = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
+	uid_t uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
+
+ 	/*
+ 	 * Get my name so that I can use it to report errors.
+ 	 */
+@@ -2023,8 +2027,10 @@
+ 	is_shadow_grp = sgr_file_present ();
+ #endif
+ #ifdef ENABLE_SUBIDS
+-	is_sub_uid = sub_uid_file_present ();
+-	is_sub_gid = sub_gid_file_present ();
+	is_sub_uid = sub_uid_file_present () && !rflg &&
+	    (!user_id || (user_id <= uid_max && user_id >= uid_min));
+	is_sub_gid = sub_gid_file_present () && !rflg &&
+	    (!user_id || (user_id <= uid_max && user_id >= uid_min));
+ #endif				/* ENABLE_SUBIDS */
+ 
+ 	get_defaults ();
+ 
+Index: git/libmisc/find_new_sub_uids.c
+===================================================================
+--- git.orig/libmisc/find_new_sub_uids.c
+++ git/libmisc/find_new_sub_uids.c
+@@ -58,7 +58,7 @@
+ 
+ 	min = getdef_ulong ("SUB_UID_MIN", 100000UL);
+ 	max = getdef_ulong ("SUB_UID_MAX", 600100000UL);
+-	count = getdef_ulong ("SUB_UID_COUNT", 10000);
+	count = getdef_ulong ("SUB_UID_COUNT", 65536);
+ 
+ 	if (min > max || count >= max || (min + count - 1) > max) {
+ 		(void) fprintf (stderr,
+Index: git/libmisc/find_new_sub_gids.c
+===================================================================
+--- git.orig/libmisc/find_new_sub_gids.c
+++ git/libmisc/find_new_sub_gids.c
+@@ -58,7 +58,7 @@
+ 
+ 	min = getdef_ulong ("SUB_GID_MIN", 100000UL);
+ 	max = getdef_ulong ("SUB_GID_MAX", 600100000UL);
+-	count = getdef_ulong ("SUB_GID_COUNT", 10000);
+	count = getdef_ulong ("SUB_GID_COUNT", 65536);
+ 
+ 	if (min > max || count >= max || (min + count - 1) > max) {
+ 		(void) fprintf (stderr,
--- a/debian/patches/1010_vietnamese_translation
+++ b/debian/patches/1010_vietnamese_translation
--- a/debian/patches/1020_fix_user_busy_errors
+++ b/debian/patches/1020_fix_user_busy_errors
@@ -0,0 +1,38 @@
+Description: Fix user_busy to not leave subuid open in case of error.
+Author: William Grant <wgrant@ubuntu.com>
+Bug: https://bugs.launchpad.net/ubuntu/vivid/+source/shadow/+bug/1436937
+
+Index: shadow-4.2/libmisc/user_busy.c
+===================================================================
+--- shadow-4.2.orig/libmisc/user_busy.c
+++ shadow-4.2/libmisc/user_busy.c
+@@ -175,6 +175,9 @@ static int user_busy_processes (const ch
+ 	if (stat ("/", &sbroot) != 0) {
+ 		perror ("stat (\"/\")");
+ 		(void) closedir (proc);
+#ifdef ENABLE_SUBIDS
+		sub_uid_close();
+#endif				/* ENABLE_SUBIDS */
+ 		return 0;
+ 	}
+ 
+@@ -212,6 +215,9 @@ static int user_busy_processes (const ch
+ 
+ 		if (check_status (name, tmp_d_name, uid) != 0) {
+ 			(void) closedir (proc);
+#ifdef ENABLE_SUBIDS
+			sub_uid_close();
+#endif				/* ENABLE_SUBIDS */
+ 			fprintf (stderr,
+ 			         _("%s: user %s is currently used by process %d\n"),
+ 			         Prog, name, pid);
+@@ -232,6 +238,9 @@ static int user_busy_processes (const ch
+ 				}
+ 				if (check_status (name, task_path+6, uid) != 0) {
+ 					(void) closedir (proc);
+#ifdef ENABLE_SUBIDS
+					sub_uid_close();
+#endif				/* ENABLE_SUBIDS */
+ 					fprintf (stderr,
+ 					         _("%s: user %s is currently used by process %d\n"),
+ 					         Prog, name, pid);
--- a/debian/patches/301-CVE-2017-2616-su-properly-clear-child-PID.patch
+++ b/debian/patches/301-CVE-2017-2616-su-properly-clear-child-PID.patch
@@ -0,0 +1,59 @@
+From 08fd4b69e84364677a10e519ccb25b71710ee686 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Thu, 23 Feb 2017 09:47:29 -0600
+Subject: [PATCH] su: properly clear child PID
+
+If su is compiled with PAM support, it is possible for any local user
+to send SIGKILL to other processes with root privileges. There are
+only two conditions. First, the user must be able to perform su with
+a successful login. This does NOT have to be the root user, even using
+su with the same id is enough, e.g. "su $(whoami)". Second, SIGKILL
+can only be sent to processes which were executed after the su process.
+It is not possible to send SIGKILL to processes which were already
+running. I consider this as a security vulnerability, because I was
+able to write a proof of concept which unlocked a screen saver of
+another user this way.
+---
+ src/su.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/src/su.c
+++ b/src/su.c
+@@ -363,20 +363,35 @@ static void prepare_pam_close_session (v
+ 				/* wake child when resumed */
+ 				kill (pid, SIGCONT);
+ 				stop = false;
+			} else {
+				pid_child = 0;
+ 			}
+ 		} while (!stop);
+ 	}
+ 
+-	if (0 != caught) {
+	if (0 != caught && 0 != pid_child) {
+ 		(void) fputs ("\n", stderr);
+ 		(void) fputs (_("Session terminated, terminating shell..."),
+ 		              stderr);
+ 		(void) kill (-pid_child, caught);
+ 
+ 		(void) signal (SIGALRM, kill_child);
+		(void) signal (SIGCHLD, catch_signals);
+ 		(void) alarm (2);
+ 
+-		(void) wait (&status);
+		sigemptyset (&ourset);
+		if ((sigaddset (&ourset, SIGALRM) != 0)
+		    || (sigprocmask (SIG_BLOCK, &ourset, NULL) != 0)) {
+			fprintf (stderr, _("%s: signal masking malfunction\n"), Prog);
+			kill_child (0);
+		} else {
+			while (0 == waitpid (pid_child, &status, WNOHANG)) {
+				sigsuspend (&ourset);
+			}
+			pid_child = 0;
+			(void) sigprocmask (SIG_UNBLOCK, &ourset, NULL);
+		}
+
+ 		(void) fputs (_(" ...terminated.\n"), stderr);
+ 	}
+ 
--- a/debian/patches/302-CVE-2016-6252-fix-integer-overflow.patch
+++ b/debian/patches/302-CVE-2016-6252-fix-integer-overflow.patch
@@ -0,0 +1,46 @@
+From 1d5a926cc2d6078d23a96222b1ef3e558724dad1 Mon Sep 17 00:00:00 2001
+From: Sebastian Krahmer <krahmer@suse.com>
+Date: Wed, 3 Aug 2016 11:51:07 -0500
+Subject: [PATCH] Simplify getulong
+
+Use strtoul to read an unsigned long, rather than reading
+a signed long long and casting it.
+
+https://bugzilla.suse.com/show_bug.cgi?id=979282
+---
+ lib/getulong.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/lib/getulong.c b/lib/getulong.c
+index 61579ca..08d2c1a 100644
+--- a/lib/getulong.c
+++ b/lib/getulong.c
+@@ -44,22 +44,19 @@
+  */
+ int getulong (const char *numstr, /*@out@*/unsigned long int *result)
+ {
+-	long long int val;
+	unsigned long int val;
+ 	char *endptr;
+ 
+ 	errno = 0;
+-	val = strtoll (numstr, &endptr, 0);
+	val = strtoul (numstr, &endptr, 0);
+ 	if (    ('\0' == *numstr)
+ 	     || ('\0' != *endptr)
+ 	     || (ERANGE == errno)
+-	     /*@+ignoresigns@*/
+-	     || (val != (unsigned long int)val)
+-	     /*@=ignoresigns@*/
+ 	   ) {
+ 		return 0;
+ 	}
+ 
+-	*result = (unsigned long int)val;
+	*result = val;
+ 	return 1;
+ }
+ 
+-- 
+2.1.4
+
--- a/debian/patches/303-Reset-pid_child-only-if-waitpid-was-successful.patch
+++ b/debian/patches/303-Reset-pid_child-only-if-waitpid-was-successful.patch
@@ -0,0 +1,29 @@
+From 7d82f203eeec881c584b2fa06539b39e82985d97 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Sun, 14 May 2017 17:58:10 +0200
+Subject: [PATCH] Reset pid_child only if waitpid was successful.
+
+Do not reset the pid_child to 0 if the child process is still
+running. This else-condition can be reached with pid being -1,
+therefore explicitly test this condition.
+
+This is a regression fix for CVE-2017-2616. If su receives a
+signal like SIGTERM, it is not propagated to the child.
+
+Reported-by: Radu Duta <raduduta@gmail.com>
+Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
+---
+ src/su.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/su.c
+++ b/src/su.c
+@@ -363,7 +363,7 @@ static void prepare_pam_close_session (v
+ 				/* wake child when resumed */
+ 				kill (pid, SIGCONT);
+ 				stop = false;
+-			} else {
+			} else if (   (pid_t)-1 != pid) {
+ 				pid_child = 0;
+ 			}
+ 		} while (!stop);
--- a/debian/patches/401_cppw_src.dpatch
+++ b/debian/patches/401_cppw_src.dpatch
@@ -5,8 +5,10 @@
 ## DP: Add cppw / cpgr

@DPATCH@
+Index: git/src/cppw.c
+===================================================================
 --- /dev/null
-+++ b/src/cppw.c
+++ git/src/cppw.c
@@ -0,0 +1,238 @@
 +/*
 +  cppw, cpgr  copy with locking given file over the password or group file
@@ -246,9 +248,11 @@
 +	return 0;
 +}
 +
--- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -30,6 +30,7 @@
+Index: git/src/Makefile.am
+===================================================================
+--- git.orig/src/Makefile.am
+++ git/src/Makefile.am
+@@ -29,6 +29,7 @@
 ubin_PROGRAMS += newgidmap newuidmap
 endif
 usbin_PROGRAMS = \
@@ -256,7 +260,7 @@
 	chgpasswd \
 	chpasswd \
 	groupadd \
-@@ -90,6 +91,7 @@
+@@ -87,6 +88,7 @@
 chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBSELINUX) $(LIBCRYPT)
 chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
 chpasswd_LDADD = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT)
@@ -264,8 +268,10 @@
 gpasswd_LDADD  = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT)
 groupadd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
 groupdel_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
--- a/po/POTFILES.in
-+++ b/po/POTFILES.in
+Index: git/po/POTFILES.in
+===================================================================
+--- git.orig/po/POTFILES.in
+++ git/po/POTFILES.in
@@ -85,6 +85,7 @@
 src/chgpasswd.c
 src/chpasswd.c
--- a/debian/patches/429_login_FAILLOG_ENAB
+++ b/debian/patches/429_login_FAILLOG_ENAB
@@ -7,11 +7,11 @@ Fixes: #192849
 Note: It could be removed if pam_tally could report the number of failures
      preceding a successful login.

-Index: shadow-4.4/src/login.c
+Index: git/src/login.c
 ===================================================================
--- shadow-4.4.orig/src/login.c
-+++ shadow-4.4/src/login.c
-@@ -131,9 +131,9 @@ static void update_utmp (const char *use
+--- git.orig/src/login.c
+++ git/src/login.c
+@@ -131,9 +131,9 @@
                          const char *host,
                          /*@null@*/const struct utmp *utent);
 
@@ -22,7 +22,7 @@ Index: shadow-4.4/src/login.c
 static void bad_time_notify (void);
 static void check_nologin (bool login_to_root);
 #else
-@@ -794,6 +794,9 @@ int main (int argc, char **argv)
+@@ -791,6 +791,9 @@
 				SYSLOG ((LOG_NOTICE,
 				         "TOO MANY LOGIN TRIES (%u)%s FOR '%s'",
 				         failcount, fromhost, failent_user));
@@ -32,7 +32,7 @@ Index: shadow-4.4/src/login.c
 				fprintf (stderr,
 				         _("Maximum number of tries exceeded (%u)\n"),
 				         failcount);
-@@ -811,6 +814,14 @@ int main (int argc, char **argv)
+@@ -808,6 +811,14 @@
 				         pam_strerror (pamh, retcode)));
 				failed = true;
 			}
@@ -47,7 +47,7 @@ Index: shadow-4.4/src/login.c
 
 			if (!failed) {
 				break;
-@@ -834,6 +845,10 @@ int main (int argc, char **argv)
+@@ -831,6 +842,10 @@
 			(void) puts ("");
 			(void) puts (_("Login incorrect"));
 
@@ -58,7 +58,7 @@ Index: shadow-4.4/src/login.c
 			if (getdef_str("FTMP_FILE") != NULL) {
 #ifdef USE_UTMPX
 				struct utmpx *failent =
-@@ -1288,6 +1303,7 @@ int main (int argc, char **argv)
+@@ -1285,6 +1300,7 @@
 		 */
 #ifndef USE_PAM
 		motd ();	/* print the message of the day */
@@ -66,7 +66,7 @@ Index: shadow-4.4/src/login.c
 		if (   getdef_bool ("FAILLOG_ENAB")
 		    && (0 != faillog.fail_cnt)) {
 			failprint (&faillog);
-@@ -1300,6 +1316,7 @@ int main (int argc, char **argv)
+@@ -1297,6 +1313,7 @@
 				         username, (int) faillog.fail_cnt));
 			}
 		}
@@ -74,11 +74,11 @@ Index: shadow-4.4/src/login.c
 		if (   getdef_bool ("LASTLOG_ENAB")
 		    && (ll.ll_time != 0)) {
 			time_t ll_time = ll.ll_time;
-Index: shadow-4.4/lib/getdef.c
+Index: git/lib/getdef.c
 ===================================================================
--- shadow-4.4.orig/lib/getdef.c
-+++ shadow-4.4/lib/getdef.c
-@@ -86,6 +86,7 @@ static struct itemdef def_table[] = {
+--- git.orig/lib/getdef.c
+++ git/lib/getdef.c
+@@ -61,6 +61,7 @@
 	{"ENV_SUPATH", NULL},
 	{"ERASECHAR", NULL},
 	{"FAIL_DELAY", NULL},
@@ -86,3 +86,11 @@ Index: shadow-4.4/lib/getdef.c
 	{"FAKE_SHELL", NULL},
 	{"FTMP_FILE", NULL},
 	{"GID_MAX", NULL},
+@@ -109,7 +110,6 @@
+ 	{"ENV_HZ", NULL},
+ 	{"ENVIRON_FILE", NULL},
+ 	{"ENV_TZ", NULL},
+-	{"FAILLOG_ENAB", NULL},
+ 	{"ISSUE_FILE", NULL},
+ 	{"LASTLOG_ENAB", NULL},
+ 	{"LOGIN_STRING", NULL},
--- a/debian/patches/463_login_delay_obeys_to_PAM
+++ b/debian/patches/463_login_delay_obeys_to_PAM
@@ -7,11 +7,11 @@ Status wrt upstream: Forwarded but not applied yet

 Note: If removed, FAIL_DELAY must be re-added to /etc/login.defs

-Index: shadow-4.4/src/login.c
+Index: git/src/login.c
 ===================================================================
--- shadow-4.4.orig/src/login.c
-+++ shadow-4.4/src/login.c
-@@ -525,7 +525,6 @@ int main (int argc, char **argv)
+--- git.orig/src/login.c
+++ git/src/login.c
+@@ -525,7 +525,6 @@
 #if defined(HAVE_STRFTIME) && !defined(USE_PAM)
 	char ptime[80];
 #endif
@@ -19,7 +19,7 @@ Index: shadow-4.4/src/login.c
 	unsigned int retries;
 	bool subroot = false;
 #ifndef USE_PAM
-@@ -546,6 +545,7 @@ int main (int argc, char **argv)
+@@ -545,6 +544,7 @@
 	pid_t child;
 	char *pam_user = NULL;
 #else
@@ -27,7 +27,7 @@ Index: shadow-4.4/src/login.c
 	struct spwd *spwd = NULL;
 #endif
 	/*
-@@ -708,7 +708,6 @@ int main (int argc, char **argv)
+@@ -705,7 +705,6 @@
 	}
 
 	environ = newenvp;	/* make new environment active */
@@ -35,7 +35,7 @@ Index: shadow-4.4/src/login.c
 	retries = getdef_unum ("LOGIN_RETRIES", RETRIES);
 
 #ifdef USE_PAM
-@@ -724,8 +723,7 @@ int main (int argc, char **argv)
+@@ -721,8 +720,7 @@
 
 	/*
 	 * hostname & tty are either set to NULL or their correct values,
@@ -45,7 +45,7 @@ Index: shadow-4.4/src/login.c
 	 *
 	 * PAM_RHOST and PAM_TTY are used for authentication, only use
 	 * information coming from login or from the caller (e.g. no utmp)
-@@ -734,10 +732,6 @@ int main (int argc, char **argv)
+@@ -731,10 +729,6 @@
 	PAM_FAIL_CHECK;
 	retcode = pam_set_item (pamh, PAM_TTY, tty);
 	PAM_FAIL_CHECK;
@@ -56,7 +56,7 @@ Index: shadow-4.4/src/login.c
 	/* if fflg, then the user has already been authenticated */
 	if (!fflg) {
 		unsigned int failcount = 0;
-@@ -778,12 +772,6 @@ int main (int argc, char **argv)
+@@ -775,12 +769,6 @@
 			bool failed = false;
 
 			failcount++;
@@ -69,7 +69,7 @@ Index: shadow-4.4/src/login.c
 
 			retcode = pam_authenticate (pamh, 0);
 
-@@ -1106,14 +1094,17 @@ int main (int argc, char **argv)
+@@ -1103,14 +1091,17 @@
 		free (username);
 		username = NULL;
 
@@ -87,11 +87,11 @@ Index: shadow-4.4/src/login.c
 
 		(void) puts (_("Login incorrect"));
 
-Index: shadow-4.4/lib/getdef.c
+Index: git/lib/getdef.c
 ===================================================================
--- shadow-4.4.orig/lib/getdef.c
-+++ shadow-4.4/lib/getdef.c
-@@ -85,7 +85,6 @@ static struct itemdef def_table[] = {
+--- git.orig/lib/getdef.c
+++ git/lib/getdef.c
+@@ -60,7 +60,6 @@
 	{"ENV_PATH", NULL},
 	{"ENV_SUPATH", NULL},
 	{"ERASECHAR", NULL},
@@ -99,3 +99,11 @@ Index: shadow-4.4/lib/getdef.c
 	{"FAILLOG_ENAB", NULL},
 	{"FAKE_SHELL", NULL},
 	{"FTMP_FILE", NULL},
+@@ -110,6 +109,7 @@
+ 	{"ENV_HZ", NULL},
+ 	{"ENVIRON_FILE", NULL},
+ 	{"ENV_TZ", NULL},
+	{"FAIL_DELAY", NULL},
+ 	{"ISSUE_FILE", NULL},
+ 	{"LASTLOG_ENAB", NULL},
+ 	{"LOGIN_STRING", NULL},
--- a/debian/patches/501_commonio_group_shadow
+++ b/debian/patches/501_commonio_group_shadow
@@ -2,8 +2,10 @@ Goal: save the [g]shadow files with the 'shadow' group and mode 0440

 Fixes: #166793

--- a/lib/commonio.c
-+++ b/lib/commonio.c
+Index: git/lib/commonio.c
+===================================================================
+--- git.orig/lib/commonio.c
+++ git/lib/commonio.c
@@ -44,6 +44,7 @@
 #include <errno.h>
 #include <stdio.h>
@@ -12,49 +14,26 @@ Fixes: #166793
 #include "nscd.h"
 #ifdef WITH_TCB
 #include <tcb.h>
-@@ -963,12 +964,23 @@
+@@ -966,13 +967,20 @@
 			goto fail;
 		}
 	} else {
 +		struct group *grp;
 		/*
 		 * Default permissions for new [g]shadow files.
+ 		 * (passwd and group always exist...)
 		 */
- 		sb.st_mode = db->st_mode;
- 		sb.st_uid = db->st_uid;
- 		sb.st_gid = db->st_gid;
-+
+-		sb.st_mode = 0400;
+		sb.st_mode = 0440;
+ 		sb.st_uid = 0;
+-		sb.st_gid = 0;
 +		/*
 +		 * Try to retrieve the shadow's GID, and fall back to GID 0.
 +		 */
-+		if (sb.st_gid == 0) {
-+			if ((grp = getgrnam("shadow")) != NULL)
-+				sb.st_gid = grp->gr_gid;
-+			else
-+				sb.st_gid = 0;
-+		}
+		if ((grp = getgrnam("shadow")) != NULL)
+			sb.st_gid = grp->gr_gid;
+		else
+			sb.st_gid = 0;
 	}
 
 	snprintf (buf, sizeof buf, "%s+", db->filename);
--- a/lib/sgroupio.c
-+++ b/lib/sgroupio.c
-@@ -229,7 +229,7 @@
- #ifdef WITH_SELINUX
- 	NULL,			/* scontext */
- #endif
-	0400,                   /* st_mode */
-+	0440,                   /* st_mode */
- 	0,                      /* st_uid */
- 	0,                      /* st_gid */
- 	NULL,			/* head */
--- a/lib/shadowio.c
-+++ b/lib/shadowio.c
-@@ -105,7 +105,7 @@
- #ifdef WITH_SELINUX
- 	NULL,			/* scontext */
- #endif				/* WITH_SELINUX */
-	0400,                   /* st_mode */
-+	0440,                   /* st_mode */
- 	0,                      /* st_uid */
- 	0,                      /* st_gid */
- 	NULL,			/* head */
--- a/debian/patches/508_nologin_in_usr_sbin
+++ b/debian/patches/508_nologin_in_usr_sbin
@@ -1,6 +1,8 @@
--- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -24,7 +24,6 @@
+Index: git/src/Makefile.am
+===================================================================
+--- git.orig/src/Makefile.am
+++ git/src/Makefile.am
+@@ -23,7 +23,6 @@
 # $prefix/bin and $prefix/sbin, no install-data hacks...)
 
 bin_PROGRAMS   = groups login su
@@ -8,7 +10,7 @@
 ubin_PROGRAMS  = faillog lastlog chage chfn chsh expiry gpasswd newgrp passwd
 if ENABLE_SUBIDS
 ubin_PROGRAMS += newgidmap newuidmap
-@@ -42,6 +41,7 @@
+@@ -41,6 +40,7 @@
 	grpunconv \
 	logoutd \
 	newusers \
--- a/debian/patches/523_su_arguments_are_concatenated
+++ b/debian/patches/523_su_arguments_are_concatenated
@@ -0,0 +1,48 @@
+Goal: Concatenate the non-su arguments and provide them to the shell with
+      the -c option
+Fixes: #317264
+       see also #276419
+
+Status wrt upstream: This is a Debian specific patch.
+
+Note: the fix of the man page is still missing.
+      (to be taken from the trunk)
+
+--- a/src/su.c
+++ b/src/su.c
+@@ -1167,6 +1167,35 @@
+ 			argv[0] = "-c";
+ 			argv[1] = command;
+ 		}
+		/* On Debian, the arguments are concatenated and the
+		 * resulting string is always given to the shell with its
+		 * -c option.
+		 */
+		{
+			char **parg;
+			unsigned int cmd_len = 0;
+			char *cmd = NULL;
+			if (strcmp(argv[0], "-c") != 0) {
+				argv--;
+				argv[0] = "-c";
+			}
+			/* Now argv[0] is always -c, and other arguments
+			 * can be concatenated
+			 */
+			cmd_len = 1; /* finale '\0' */
+			for (parg = &argv[1]; *parg; parg++) {
+				cmd_len += strlen (*parg) + 1;
+			}
+			cmd = (char *) xmalloc (sizeof (char) * cmd_len);
+			cmd[0] = '\0';
+			for (parg = &argv[1]; *parg; parg++) {
+				strcat (cmd, " ");
+				strcat (cmd, *parg);
+			}
+			cmd[cmd_len - 1] = '\0';
+			argv[1] = &cmd[1]; /* do not take first space */
+			argv[2] = NULL;
+		}
+ 		/*
+ 		 * Use the shell and create an argv
+ 		 * with the rest of the command line included.
--- a/debian/patches/523_su_arguments_are_no_more_concatenated_by_default
+++ b/debian/patches/523_su_arguments_are_no_more_concatenated_by_default
@@ -0,0 +1,50 @@
+Goal: Do not concatenate the additional arguments, and support an
+      environment variable to revert to the old Debian's su behavior.
+
+This patch needs the su_arguments_are_concatenated patch.
+
+This patch, and su_arguments_are_concatenated should be dropped after
+Etch.
+
+Status wrt upstream: This patch is Debian specific.
+
+--- a/src/su.c
+++ b/src/su.c
+@@ -104,6 +104,19 @@
+ /* If nonzero, change some environment vars to indicate the user su'd to. */
+ static bool change_environment = true;
+ 
+/*
+ * If nonzero, keep the old Debian behavior:
+ *   * concatenate all the arguments and provide them to the -c option of
+ *     the shell
+ *   * If there are some additional arguments, but no -c, add a -c
+ *     argument anyway
+ * Drawbacks:
+ *   * you can't provide options to the shell (other than -c)
+ *   * you can't rely on the argument count
+ * See http://bugs.debian.org/276419
+ */
+static int old_debian_behavior;
+
+ #ifdef USE_PAM
+ static pam_handle_t *pamh = NULL;
+ static int caught = 0;
+@@ -964,6 +977,8 @@
+ 	int ret;
+ #endif				/* USE_PAM */
+ 
+	old_debian_behavior = (getenv("SU_NO_SHELL_ARGS") != NULL);
+
+ 	(void) setlocale (LC_ALL, "");
+ 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
+ 	(void) textdomain (PACKAGE);
+@@ -1171,7 +1186,7 @@
+ 		 * resulting string is always given to the shell with its
+ 		 * -c option.
+ 		 */
+-		{
+		if (old_debian_behavior) {
+ 			char **parg;
+ 			unsigned int cmd_len = 0;
+ 			char *cmd = NULL;
--- a/debian/patches/542_useradd-O_option
+++ b/debian/patches/542_useradd-O_option
@@ -5,10 +5,12 @@ Note: useradd.8 needs to be regenerated.
 Status wrt upstream: not included as this is just specific 
                     backward compatibility for Debian

--- a/man/useradd.8.xml
-+++ b/man/useradd.8.xml
+Index: git/man/useradd.8.xml
+===================================================================
+--- git.orig/man/useradd.8.xml
+++ git/man/useradd.8.xml
@@ -329,6 +329,11 @@
- 	    databases are reset to avoid reusing the entry from a previously
+ 	    databases are resetted to avoid reusing the entry from a previously
 	    deleted user.
 	  </para>
 +          <para>
@@ -19,9 +21,11 @@ Status wrt upstream: not included as this is just specific
 	</listitem>
       </varlistentry>
       <varlistentry>
--- a/src/useradd.c
-+++ b/src/useradd.c
-@@ -1059,9 +1059,9 @@
+Index: git/src/useradd.c
+===================================================================
+--- git.orig/src/useradd.c
+++ git/src/useradd.c
+@@ -1056,9 +1056,9 @@
 		};
 		while ((c = getopt_long (argc, argv,
 #ifdef WITH_SELINUX
@@ -33,7 +37,7 @@ Status wrt upstream: not included as this is just specific
 #endif				/* !WITH_SELINUX */
 		                         long_options, NULL)) != -1) {
 			switch (c) {
-@@ -1184,6 +1184,7 @@
+@@ -1181,6 +1181,7 @@
 				kflg = true;
 				break;
 			case 'K':
--- a/debian/patches/CVE-2017-12424.patch
+++ b/debian/patches/CVE-2017-12424.patch
@@ -0,0 +1,37 @@
+From 954e3d2e7113e9ac06632aee3c69b8d818cc8952 Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <tmraz@fedoraproject.org>
+Date: Fri, 31 Mar 2017 16:25:06 +0200
+Subject: [PATCH] Fix buffer overflow if NULL line is present in db.
+
+If ptr->line == NULL for an entry, the first cycle will exit,
+but the second one will happily write past entries buffer.
+We actually do not want to exit the first cycle prematurely
+on ptr->line == NULL.
+Signed-off-by: Tomas Mraz <tmraz@fedoraproject.org>
+---
+ lib/commonio.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/lib/commonio.c
+++ b/lib/commonio.c
+@@ -755,16 +755,16 @@
+ 	for (ptr = db->head;
+ 	        (NULL != ptr)
+ #if KEEP_NIS_AT_END
+-	     && (NULL != ptr->line)
+-	     && (   ('+' != ptr->line[0])
+-	         && ('-' != ptr->line[0]))
+	     && ((NULL == ptr->line)
+	         || (('+' != ptr->line[0])
+	             && ('-' != ptr->line[0])))
+ #endif
+ 	     ;
+ 	     ptr = ptr->next) {
+ 		n++;
+ 	}
+ #if KEEP_NIS_AT_END
+-	if ((NULL != ptr) && (NULL != ptr->line)) {
+	if (NULL != ptr) {
+ 		nis = ptr;
+ 	}
+ #endif
--- a/debian/patches/0001-newgidmap-enforce-setgroups-deny-if-self-mapping-a-g.patch
+++ b/debian/patches/0001-newgidmap-enforce-setgroups-deny-if-self-mapping-a-g.patch
@@ -1,7 +1,7 @@
-From 11fc74ffc7172c587bbd2a6399defbd53eab97c6 Mon Sep 17 00:00:00 2001
+From fb28c99b8a66ff2605c5cb96abc0a4d975f92de0 Mon Sep 17 00:00:00 2001
 From: Aleksa Sarai <asarai@suse.de>
 Date: Thu, 15 Feb 2018 23:49:40 +1100
-Subject: newgidmap: enforce setgroups=deny if self-mapping a group
+Subject: [PATCH] newgidmap: enforce setgroups=deny if self-mapping a group

 This is necessary to match the kernel-side policy of "self-mapping in a
 user namespace is fine, but you cannot drop groups" -- a policy that was
@@ -26,12 +26,6 @@ Ref: https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
 Fixes: CVE-2018-7169
 Reported-by: Craig Furman <craig.furman89@gmail.com>
 Signed-off-by: Aleksa Sarai <asarai@suse.de>
---
- src/newgidmap.c | 89 ++++++++++++++++++++++++++++++++++++++++++++-----
- 1 file changed, 80 insertions(+), 9 deletions(-)
-
-diff --git a/src/newgidmap.c b/src/newgidmap.c
-index b1e33513..59a2e75c 100644
 --- a/src/newgidmap.c
 +++ b/src/newgidmap.c
@@ -46,32 +46,37 @@
@@ -54,14 +48,14 @@ index b1e33513..59a2e75c 100644
 		return true;
 +	}
 
-	/* Allow a process to map its own gid */
+-	/* Allow a process to map it's own gid */
 -	if ((range->count == 1) && (pw->pw_gid == range->lower))
 +	/* Allow a process to map its own gid. */
 +	if ((range->count == 1) && (pw->pw_gid == range->lower)) {
 +		/* noop -- if setgroups is enabled already we won't disable it. */
 		return true;
-+	}
 
+	}
 	return false;
 }
 
@@ -79,7 +73,7 @@ index b1e33513..59a2e75c 100644
 			fprintf(stderr, _( "%s: gid range [%lu-%lu) -> [%lu-%lu) not allowed\n"),
 				Prog,
 				mapping->upper,
-@@ -89,6 +94,70 @@ static void usage(void)
+@@ -89,6 +94,70 @@
 	exit(EXIT_FAILURE);
 }
 
@@ -150,7 +144,7 @@ index b1e33513..59a2e75c 100644
 /*
  * newgidmap - Set the gid_map for the specified process
  */
-@@ -103,6 +172,7 @@ int main(int argc, char **argv)
+@@ -103,6 +172,7 @@
 	struct stat st;
 	struct passwd *pw;
 	int written;
@@ -158,7 +152,7 @@ index b1e33513..59a2e75c 100644
 
 	Prog = Basename (argv[0]);
 
-@@ -145,7 +215,7 @@ int main(int argc, char **argv)
+@@ -144,7 +214,7 @@
 				(unsigned long) getuid ()));
 		return EXIT_FAILURE;
 	}
@@ -167,7 +161,7 @@ index b1e33513..59a2e75c 100644
 	/* Get the effective uid and effective gid of the target process */
 	if (fstat(proc_dir_fd, &st) < 0) {
 		fprintf(stderr, _("%s: Could not stat directory for target %u\n"),
-@@ -177,8 +247,9 @@ int main(int argc, char **argv)
+@@ -174,8 +244,9 @@
 	if (!mappings)
 		usage();
 
@@ -178,6 +172,3 @@ index b1e33513..59a2e75c 100644
 	write_mapping(proc_dir_fd, ranges, mappings, "gid_map");
 	sub_gid_close();
 
-- 
-2.30.2
-
--- a/debian/patches/CVE-2023-29383.patch
+++ b/debian/patches/CVE-2023-29383.patch
@@ -0,0 +1,83 @@
+Origin: https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d
+Origin: https://github.com/shadow-maint/shadow/commit/2eaea70111f65b16d55998386e4ceb4273c19eb4
+Reviewed-by: Sylvain Beucler <beuc@debian.org>
+Last-Update: 2025-04-15
+
+From e5905c4b84d4fb90aefcd96ee618411ebfac663d Mon Sep 17 00:00:00 2001
+From: tomspiderlabs <128755403+tomspiderlabs@users.noreply.github.com>
+Date: Thu, 23 Mar 2023 23:39:38 +0000
+Subject: [PATCH] Added control character check
+
+Added control character check, returning -1 (to "err") if control characters are present.
+---
+ lib/fields.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+From 2eaea70111f65b16d55998386e4ceb4273c19eb4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Fri, 31 Mar 2023 14:46:50 +0200
+Subject: [PATCH] Overhaul valid_field()
+
+e5905c4b ("Added control character check") introduced checking for
+control characters but had the logic inverted, so it rejects all
+characters that are not control ones.
+
+Cast the character to `unsigned char` before passing to the character
+checking functions to avoid UB.
+
+Use strpbrk(3) for the illegal character test and return early.
+---
+ lib/fields.c | 24 ++++++++++--------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+Index: shadow-4.2/lib/fields.c
+===================================================================
+--- shadow-4.2.orig/lib/fields.c
+++ shadow-4.2/lib/fields.c
+@@ -44,9 +44,9 @@
+  *
+  * The supplied field is scanned for non-printable and other illegal
+  * characters.
+- *  + -1 is returned if an illegal character is present.
+- *  +  1 is returned if no illegal characters are present, but the field
+- *       contains a non-printable character.
+ *  + -1 is returned if an illegal or control character is present.
+ *  +  1 is returned if no illegal or control characters are present,
+ *       but the field contains a non-printable character.
+  *  +  0 is returned otherwise.
+  */
+ int valid_field (const char *field, const char *illegal)
+@@ -60,23 +60,22 @@ int valid_field (const char *field, cons
+ 
+ 	/* For each character of field, search if it appears in the list
+ 	 * of illegal characters. */
+	if (illegal && NULL != strpbrk (field, illegal)) {
+		return -1;
+	}
+
+	/* Search if there are non-printable or control characters */
+ 	for (cp = field; '\0' != *cp; cp++) {
+-		if (strchr (illegal, *cp) != NULL) {
+		unsigned char c = *cp;
+		if (!isprint (c)) {
+			err = 1;
+		}
+		if (iscntrl (c)) {
+ 			err = -1;
+ 			break;
+ 		}
+ 	}
+ 
+-	if (0 == err) {
+-		/* Search if there are some non-printable characters */
+-		for (cp = field; '\0' != *cp; cp++) {
+-			if (!isprint (*cp)) {
+-				err = 1;
+-				break;
+-			}
+-		}
+-	}
+-
+ 	return err;
+ }
+ 
--- a/debian/patches/0002-gpasswd-1-Fix-password-leak.patch
+++ b/debian/patches/0002-gpasswd-1-Fix-password-leak.patch
@@ -1,7 +1,11 @@
-From cbfa2ff40ce629f55ddd67e3490c311dfcaa4462 Mon Sep 17 00:00:00 2001
+Origin: https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904
+Reviewed-by: Sylvain Beucler <beuc@debian.org>
+Last-Update: 2025-04-15
+
+From 65c88a43a23c2391dcc90c0abda3e839e9c57904 Mon Sep 17 00:00:00 2001
 From: Alejandro Colomar <alx@kernel.org>
 Date: Sat, 10 Jun 2023 16:20:05 +0200
-Subject: gpasswd(1): Fix password leak
+Subject: [PATCH] gpasswd(1): Fix password leak

 How to trigger this password leak?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -125,18 +129,15 @@ Signed-off-by: Alejandro Colomar <alx@kernel.org>
 src/gpasswd.c | 1 +
 1 file changed, 1 insertion(+)

-diff --git a/src/gpasswd.c b/src/gpasswd.c
-index c4a492b1..cbbd8068 100644
--- a/src/gpasswd.c
-+++ b/src/gpasswd.c
-@@ -917,6 +917,7 @@ static void change_passwd (struct group *gr)
- 		strzero (cp);
- 		cp = getpass (_("Re-enter new password: "));
+Index: shadow-4.2/src/gpasswd.c
+===================================================================
+--- shadow-4.2.orig/src/gpasswd.c
+++ shadow-4.2/src/gpasswd.c
+@@ -911,6 +911,7 @@ static void change_passwd (struct group
+ 	for (retries = 0; retries < RETRIES; retries++) {
+ 		cp = getpass (_("New Password: "));
 		if (NULL == cp) {
 +			memzero (pass, sizeof pass);
 			exit (1);
 		}
 
-- 
-2.30.2
-
--- a/debian/patches/README.patches
+++ b/debian/patches/README.patches
@@ -1,13 +1,22 @@
 Small intro to the system for numbering the patches here...

-The 00xx-... patches are forwarded to upstream's git repository
-
-The 0xx_... series of patches are patches isolated from the latest
+-The 0xx series of patches are patches isolated from the latest
 version of the shadow Debian package not using quilt in order to
 separate upstream from Debian-specific stuff.

 NO MORE PATCHES SHOULD BE ADDED IN THESE SERIES

+-The 1xx series are l10n patches to upstream 4.0.18.1. As upstream has
+ adopted Debian translations, it is very likely that these patches
+ will become useless when we will have synced with upstream
+
+-The 2xx series are patches for manual pages translations to upstream
+ 4.0.18.1.
+
+-The 3xx series are patches which have been temporarily applied to 
+ Debian's shadow while we *know* they have been applied upstream as well
+ These patches should NOT be kept when we will sync with upstream
+
 -The 4xx series are patches which have been applied to Debian's shadow
 and have NOT been accepted and/or applied upstream. These patches MUST be kept
 even after resynced with upstream
@@ -20,3 +29,43 @@ In short, while we are working towards synchronisation with upstream,
 our goal is to make 0xx patches disappear by moving them either to 3xx
 series (things already implemented upstream) or to 4xx series
 (Debian-specific patches).
+
+
+Short HOWTO for quilt
+=====================
+
+The quilt system can be assimilated to a Pile Of Patches management system.
+Patches live in debian/patches, the working directory is "."
+
+The basic commands are (abbreviation accepted):
+quilt push (asks to apply the next patch in the pile)
+quilt pop  (removes the current patch and go up in the pile)
+quilt refresh (take the current changes in tree onto the patch)
+
+When a file is changed by a patch, quilt saves it somewhere under .pc on
+application. This is how it can refresh it afterward (comparing the version
+in .pc and the one you currently have in your working dir).
+
+There are three common pitfalls with quilt:
+ - doing "quilt pop" without doing "quilt refresh". The version of current
+     dir is replaced with the version of the .pc dir. Your changes are lost.
+   Quilt wont let you do so, but you can force it with '-f' if you're fool.
+ - editing a file with is not in the patch yet. Quilt didn't do any previous
+     backup.
+   Use "quilt add" to add files to patches.
+   Set $EDITOR and use "quilt edit" to edit a file, and add it onto the
+     patch if needed.
+ - If you update your working directory, patches may not revert cleanly.
+   It is thus recommended to use "quilt pop -a" before updating with
+   "svn up".
+   If you forget (and run into trouble), you may want to remove the whole
+   shadow-?.?.? directory. If you use the makefile which is in the upper
+   directory (trunk/), shadow-?.?.?/debian/patches is a link to
+   debian/patches, so this dirctory does not contain any valuable info.
+
+The documentation is quite well done, I think. "quilt -h" will list you the
+commands. "quilt <cmd> -h" will give you some hints about it. "man quilt" is
+a reference documentation. /usr/share/doc/quilt/quilt.pdf.gz is a complete
+manual, with tutorial.
+
+
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,17 +4,42 @@

 503_shadowconfig.8
 008_login_log_failure_in_FTMP
+301-CVE-2017-2616-su-properly-clear-child-PID.patch
+302-CVE-2016-6252-fix-integer-overflow.patch
+303-Reset-pid_child-only-if-waitpid-was-successful.patch
 429_login_FAILLOG_ENAB
 401_cppw_src.dpatch
 # 402 should be merged in 401, but should be reviewed by SE Linux experts first
 402_cppw_selinux
 506_relaxed_usernames
 542_useradd-O_option
+501_commonio_group_shadow
 463_login_delay_obeys_to_PAM
+523_su_arguments_are_concatenated
+523_su_arguments_are_no_more_concatenated_by_default
 508_nologin_in_usr_sbin
 505_useradd_recommend_adduser
-501_commonio_group_shadow
-0001-newgidmap-enforce-setgroups-deny-if-self-mapping-a-g.patch
-0002-gpasswd-1-Fix-password-leak.patch
-0003-Added-control-character-check.patch
-0004-Overhaul-valid_field.patch
+#userns/01_userns_doc
+#userns/02_userns_doc_login.defs
+#userns/03_userns_implement_commonio_append
+#userns/04_userns_add_backend_support
+#userns/05_userns_implemend_find_new_sub_xids
+#userns/06_userns_userdel
+#userns/07_userns_useradd
+#userns/08_userns_detect_busy_subids
+#userns/09_userns_usermod
+#userns/10_userns_newusers
+#userns/11_userns_newxidmap
+#userns/12_userns_selinuxlibs
+#userns/13_subordinate_parse_static_buf
+#userns/14_fix_getopt
+#userns/manpagetypo
+#userns/16_add-argument-sanity-checking.patch
+1000_configure_userns
+1010_vietnamese_translation
+1020_fix_user_busy_errors
+CVE-2017-12424.patch
+CVE-2018-7169.patch
+
+CVE-2023-4641.patch
+CVE-2023-29383.patch
--- a/debian/patches/userns/01_userns_doc
+++ b/debian/patches/userns/01_userns_doc
@@ -0,0 +1,334 @@
+From ebiederm@xmission.com  Tue Jan 22 09:14:18 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id DAC33C80F4; Tue, 22 Jan 2013 09:14:18 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
+	autolearn=no version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id 274ACC80D1
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:14:14 +0000 (UTC)
+Received: from out01.mta.xmission.com ([166.70.13.231])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZuB-0006Xm-N5; Tue, 22 Jan 2013 02:12:31 -0700
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out01.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZuA-0005NR-BQ; Tue, 22 Jan 2013 02:12:30 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZu7-0004Pj-Ec; Tue, 22 Jan 2013 02:12:30 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:12:23 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <877gn5shs8.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX18YouPWtKNAX3LovSW2+p/ONbuCHMFEQpM=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 01/11] Documentation for /etc/subuid and /etc/subgid
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2071                                                  
+Status: RO
+Content-Length: 9835
+Lines: 286
+
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ man/Makefile.am  |    4 ++
+ man/subgid.5.xml |  120 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ man/subuid.5.xml |  120 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 244 insertions(+), 0 deletions(-)
+ create mode 100644 man/subgid.5.xml
+ create mode 100644 man/subuid.5.xml
+
+Index: shadow/man/Makefile.am
+===================================================================
+--- shadow.orig/man/Makefile.am	2013-02-01 15:26:14.428082026 -0600
+++ shadow/man/Makefile.am	2013-02-01 15:27:37.000000000 -0600
+@@ -43,6 +43,8 @@
+ 	man5/shadow.5 \
+ 	man1/su.1 \
+ 	man5/suauth.5 \
+	man5/subgid.5 \
+	man5/subuid.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+@@ -94,6 +96,8 @@
+ 	sg.1.xml \
+ 	su.1.xml \
+ 	suauth.5.xml \
+	subgid.5.xml \
+	subuid.5.xml \
+ 	useradd.8.xml \
+ 	userdel.8.xml \
+ 	usermod.8.xml \
+Index: shadow/man/subgid.5.xml
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ shadow/man/subgid.5.xml	2013-02-01 15:26:14.424082026 -0600
+@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+   Copyright (c) 2013 Eric W. Biederman
+   All rights reserved.
+  
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions
+   are met:
+   1. Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+   2. Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+   3. The name of the copyright holders or contributors may not be used to
+      endorse or promote products derived from this software without
+      specific prior written permission.
+  
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+<!-- SHADOW-CONFIG-HERE -->
+]>
+<refentry id='subgid.5'>
+  <refmeta>
+    <refentrytitle>subgid</refentrytitle>
+    <manvolnum>5</manvolnum>
+    <refmiscinfo class="sectdesc">File Formats and Conversions</refmiscinfo>
+    <refmiscinfo class="source">shadow-utils</refmiscinfo>
+    <refmiscinfo class="version">&SHADOW_UTILS_VERSION;</refmiscinfo>
+  </refmeta>
+  <refnamediv id='name'>
+    <refname>subgid</refname>
+    <refpurpose>the subordinate gid file</refpurpose>
+  </refnamediv>
+
+  <refsect1 id='description'>
+    <title>DESCRIPTION</title>
+    <para>
+      Each line in <filename>/etc/subgid</filename> contains
+      a user id and a range of suboridinate user ids that user
+      is allowed to use.
+
+      This is specified with three fields delimited by colons
+      (<quote>:</quote>).
+      These fields are:
+    </para>
+    <itemizedlist mark='bullet'>
+      <listitem>
+	<para>login name</para>
+      </listitem>
+      <listitem>
+	<para>numerical subordinate user ID</para>
+      </listitem>
+      <listitem>
+	<para>numerical subordinate user ID count</para>
+      </listitem>
+    </itemizedlist>
+
+    <para>
+      This file specifies the group IDs to be that each user may use
+      with the <command>newgidmap</command> command that ordinary users can use to
+      configure gid mapping in a user namespace.
+    </para>
+
+    <para>
+      Multiple ranges may be specified per user ID.
+    </para>
+
+  </refsect1>
+
+  <refsect1 id='files'>
+    <title>FILES</title>
+    <variablelist>
+      <varlistentry>
+	<term><filename>/etc/subgid</filename></term>
+	<listitem>
+	  <para>Per user subordinate group IDs.</para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term><filename>/etc/subgid-</filename></term>
+	<listitem>
+	  <para>Backup file for /etc/subgid.</para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1 id='see_also'>
+    <title>SEE ALSO</title>
+    <para>
+      <citerefentry>
+	<refentrytitle>subuid</refentrytitle><manvolnum>5</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>logindefs</refentrytitle><manvolnum>5</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>newuidmap</refentrytitle><manvolnum>1</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>newgidmap</refentrytitle><manvolnum>1</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>usermod</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>,
+    </para>
+  </refsect1>
+</refentry>
+Index: shadow/man/subuid.5.xml
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ shadow/man/subuid.5.xml	2013-02-01 15:26:14.424082026 -0600
+@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+   Copyright (c) 2013 Eric W. Biederman
+   All rights reserved.
+  
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions
+   are met:
+   1. Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+   2. Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+   3. The name of the copyright holders or contributors may not be used to
+      endorse or promote products derived from this software without
+      specific prior written permission.
+  
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+<!-- SHADOW-CONFIG-HERE -->
+]>
+<refentry id='subuid.5'>
+  <refmeta>
+    <refentrytitle>subuid</refentrytitle>
+    <manvolnum>5</manvolnum>
+    <refmiscinfo class="sectdesc">File Formats and Conversions</refmiscinfo>
+    <refmiscinfo class="source">shadow-utils</refmiscinfo>
+    <refmiscinfo class="version">&SHADOW_UTILS_VERSION;</refmiscinfo>
+  </refmeta>
+  <refnamediv id='name'>
+    <refname>subuid</refname>
+    <refpurpose>the subordinate uid file</refpurpose>
+  </refnamediv>
+
+  <refsect1 id='description'>
+    <title>DESCRIPTION</title>
+    <para>
+      Each line in <filename>/etc/subuid</filename> contains
+      a user id and a range of suboridinate user ids that user
+      is allowed to use.
+
+      This is specified with three fields delimited by colons
+      (<quote>:</quote>).
+      These fields are:
+    </para>
+    <itemizedlist mark='bullet'>
+      <listitem>
+	<para>login name</para>
+      </listitem>
+      <listitem>
+	<para>numerical subordinate user ID</para>
+      </listitem>
+      <listitem>
+	<para>numerical subordinate user ID count</para>
+      </listitem>
+    </itemizedlist>
+
+    <para>
+      This file specifies the user IDs to be that each user may use
+      with the <command>newuidmap</command> command that ordinary users can use to
+      configure uid mapping in a user namespace.
+    </para>
+
+    <para>
+      Multiple ranges may be specified per user ID.
+    </para>
+
+  </refsect1>
+
+  <refsect1 id='files'>
+    <title>FILES</title>
+    <variablelist>
+      <varlistentry>
+	<term><filename>/etc/subuid</filename></term>
+	<listitem>
+	  <para>Per user subordinate user IDs.</para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term><filename>/etc/subuid-</filename></term>
+	<listitem>
+	  <para>Backup file for /etc/subuid.</para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1 id='see_also'>
+    <title>SEE ALSO</title>
+    <para>
+      <citerefentry>
+	<refentrytitle>subgid</refentrytitle><manvolnum>5</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>logindefs</refentrytitle><manvolnum>5</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>newuidmap</refentrytitle><manvolnum>1</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>newgidmap</refentrytitle><manvolnum>1</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>usermod</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>,
+    </para>
+  </refsect1>
+</refentry>
--- a/debian/patches/userns/02_userns_doc_login.defs
+++ b/debian/patches/userns/02_userns_doc_login.defs
@@ -0,0 +1,218 @@
+From ebiederm@xmission.com  Tue Jan 22 09:14:55 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id 140DBC80F4; Tue, 22 Jan 2013 09:14:55 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
+	autolearn=no version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id 5D815C80D1
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:14:50 +0000 (UTC)
+Received: from out03.mta.xmission.com ([166.70.13.233])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZum-0006il-0f; Tue, 22 Jan 2013 02:13:08 -0700
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZul-0004GF-Id; Tue, 22 Jan 2013 02:13:07 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZuf-0004T0-MS; Tue, 22 Jan 2013 02:13:07 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:12:58 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <871uddshr9.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX19iYyOCEx6dl2v1Ya/KIGpixG5+3MVA1bY=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 02/11] login.defs.5: Document the new variables in login.defs
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2072                                                  
+Status: RO
+Content-Length: 7615
+Lines: 170
+
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ man/Makefile.am                    |    2 +
+ man/login.defs.5.xml               |    8 ++++++
+ man/login.defs.d/SUB_GID_COUNT.xml |   46 ++++++++++++++++++++++++++++++++++++
+ man/login.defs.d/SUB_UID_COUNT.xml |   46 ++++++++++++++++++++++++++++++++++++
+ 4 files changed, 102 insertions(+), 0 deletions(-)
+ create mode 100644 man/login.defs.d/SUB_GID_COUNT.xml
+ create mode 100644 man/login.defs.d/SUB_UID_COUNT.xml
+
+Index: shadow/man/Makefile.am
+===================================================================
+--- shadow.orig/man/Makefile.am	2013-02-01 15:27:51.048080390 -0600
+++ shadow/man/Makefile.am	2013-02-01 15:27:51.040080390 -0600
+@@ -163,6 +163,8 @@
+ 	USERDEL_CMD.xml \
+ 	USERGROUPS_ENAB.xml \
+ 	USE_TCB.xml \
+	SUB_GID_COUNT.xml \
+	SUB_UID_COUNT.xml \
+ 	SYS_GID_MAX.xml \
+ 	SYS_UID_MAX.xml
+ 
+Index: shadow/man/login.defs.5.xml
+===================================================================
+--- shadow.orig/man/login.defs.5.xml	2013-02-01 15:27:51.048080390 -0600
+++ shadow/man/login.defs.5.xml	2013-02-01 15:27:51.044080390 -0600
+@@ -78,6 +78,8 @@
+ <!ENTITY SULOG_FILE            SYSTEM "login.defs.d/SULOG_FILE.xml">
+ <!ENTITY SU_NAME               SYSTEM "login.defs.d/SU_NAME.xml">
+ <!ENTITY SU_WHEEL_ONLY         SYSTEM "login.defs.d/SU_WHEEL_ONLY.xml">
+<!ENTITY SUB_GID_COUNT         SYSTEM "login.defs.d/SUB_GID_COUNT.xml">
+<!ENTITY SUB_UID_COUNT         SYSTEM "login.defs.d/SUB_UID_COUNT.xml">
+ <!ENTITY SYS_GID_MAX           SYSTEM "login.defs.d/SYS_GID_MAX.xml">
+ <!ENTITY SYSLOG_SG_ENAB        SYSTEM "login.defs.d/SYSLOG_SG_ENAB.xml">
+ <!ENTITY SYSLOG_SU_ENAB        SYSTEM "login.defs.d/SYSLOG_SU_ENAB.xml">
+@@ -216,6 +218,8 @@
+       &SULOG_FILE;
+       &SU_NAME;
+       &SU_WHEEL_ONLY;
+      &SUB_GID_COUNT; <!-- documents also SUB_GID_MIN SUB_GID_MAX -->
+      &SUB_UID_COUNT; <!-- documents also SUB_UID_MIN SUB_UID_MAX -->
+       &SYS_GID_MAX; <!-- documents also SYS_GID_MIN -->
+       &SYS_UID_MAX; <!-- documents also SYS_UID_MIN -->
+       &SYSLOG_SG_ENAB;
+@@ -393,6 +397,8 @@
+ 	    PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE
+ 	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
+ 	    SHA_CRYPT_MIN_ROUNDS</phrase>
+	    SUB_GID_COUNT SUB_GID_MAX SUB_GID_MIN
+	    SUB_UID_COUNT SUB_UID_MAX SUB_UID_MIN
+ 	    SYS_GID_MAX SYS_GID_MIN SYS_UID_MAX SYS_UID_MIN UID_MAX UID_MIN
+ 	    UMASK
+ 	  </para>
+@@ -470,6 +476,8 @@
+ 	    GID_MAX GID_MIN
+ 	    MAIL_DIR MAX_MEMBERS_PER_GROUP
+ 	    PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE
+	    SUB_GID_COUNT SUB_GID_MAX SUB_GID_MIN
+	    SUB_UID_COUNT SUB_UID_MAX SUB_UID_MIN
+ 	    SYS_GID_MAX SYS_GID_MIN SYS_UID_MAX SYS_UID_MIN UID_MAX UID_MIN
+ 	    UMASK
+ 	    <phrase condition="tcb">TCB_AUTH_GROUP TCB_SYMLINK USE_TCB</phrase>
+Index: shadow/man/login.defs.d/SUB_GID_COUNT.xml
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ shadow/man/login.defs.d/SUB_GID_COUNT.xml	2013-02-01 15:27:51.044080390 -0600
+@@ -0,0 +1,46 @@
+<!--
+   Copyright (c) 2013, Eric W. Biederman
+   All rights reserved.
+  
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions
+   are met:
+   1. Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+   2. Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+   3. The name of the copyright holders or contributors may not be used to
+      endorse or promote products derived from this software without
+      specific prior written permission.
+  
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+<varlistentry>
+  <term><option>SUB_GID_MIN</option> (number)</term>
+  <term><option>SUB_GID_MAX</option> (number)</term>
+  <term><option>SUB_GID_COUNT</option> (number)</term>
+  <listitem>
+    <para>
+      The commands <command>useradd</command> and <command>newusers</command>
+      allocate <option>SUB_GID_COUNT</option> unused group IDs from the range
+      <option>SUB_GID_MIN</option> to <option>SUB_GID_MAX</option> for each
+      new user.
+    </para>
+    <para>
+      The default values for <option>SUB_GID_MAN</option>,
+      <option>SUB_GID_MIN</option>, <option>SUB_GID_COUNT</option>
+      are respectively 100000, 600100000 and 10000.
+    </para>
+  </listitem>
+</varlistentry>
+Index: shadow/man/login.defs.d/SUB_UID_COUNT.xml
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ shadow/man/login.defs.d/SUB_UID_COUNT.xml	2013-02-01 15:27:51.044080390 -0600
+@@ -0,0 +1,46 @@
+<!--
+   Copyright (c) 2013, Eric W. Biederman
+   All rights reserved.
+  
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions
+   are met:
+   1. Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+   2. Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+   3. The name of the copyright holders or contributors may not be used to
+      endorse or promote products derived from this software without
+      specific prior written permission.
+  
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+<varlistentry>
+  <term><option>SUB_UID_MIN</option> (number)</term>
+  <term><option>SUB_UID_MAX</option> (number)</term>
+  <term><option>SUB_UID_COUNT</option> (number)</term>
+  <listitem>
+    <para>
+      The commands <command>useradd</command> and <command>newusers</command>
+      allocate <option>SUB_UID_COUNT</option> unused user IDs from the range
+      <option>SUB_UID_MIN</option> to <option>SUB_UID_MAX</option> for each
+      new user.
+    </para>
+    <para>
+      The default values for <option>SUB_GID_MAN</option>,
+      <option>SUB_GID_MIN</option>, <option>SUB_GID_COUNT</option>
+      are respectively 100000, 600100000 and 10000.
+    </para>
+  </listitem>
+</varlistentry>
--- a/debian/patches/userns/03_userns_implement_commonio_append
+++ b/debian/patches/userns/03_userns_implement_commonio_append
@@ -0,0 +1,110 @@
+From ebiederm@xmission.com  Tue Jan 22 09:15:19 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id CAFA8C80F6; Tue, 22 Jan 2013 09:15:19 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
+	autolearn=no version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id 43FAEC80D1
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:15:15 +0000 (UTC)
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZvA-0006sA-Pq; Tue, 22 Jan 2013 02:13:32 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZv8-0004VI-Fi; Tue, 22 Jan 2013 02:13:32 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:13:26 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <87vcapr361.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX1++0A/mQBimfZkeNedO095IfnCYGQfIolI=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 03/11] Implement commonio_append.
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2073                                                  
+Status: RO
+Content-Length: 1874
+Lines: 65
+
+
+To support files that do not have a simple unique key implement
+commonio_append to allow new entries to be added.
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ lib/commonio.c |   30 ++++++++++++++++++++++++++++++
+ lib/commonio.h |    1 +
+ 2 files changed, 31 insertions(+), 0 deletions(-)
+
+Index: shadow/lib/commonio.c
+===================================================================
+--- shadow.orig/lib/commonio.c	2013-02-01 15:27:51.376080384 -0600
+++ shadow/lib/commonio.c	2013-02-01 15:27:51.368080384 -0600
+@@ -1121,6 +1121,36 @@
+ 	return 1;
+ }
+ 
+int commonio_append (struct commonio_db *db, const void *eptr)
+{
+	struct commonio_entry *p;
+	void *nentry;
+
+	if (!db->isopen || db->readonly) {
+		errno = EINVAL;
+		return 0;
+	}
+	nentry = db->ops->dup (eptr);
+	if (NULL == nentry) {
+		errno = ENOMEM;
+		return 0;
+	}
+	/* new entry */
+	p = (struct commonio_entry *) malloc (sizeof *p);
+	if (NULL == p) {
+		db->ops->free (nentry);
+		errno = ENOMEM;
+		return 0;
+	}
+
+	p->eptr = nentry;
+	p->line = NULL;
+	p->changed = true;
+	add_one_entry (db, p);
+
+	db->changed = true;
+	return 1;
+}
+ 
+ void commonio_del_entry (struct commonio_db *db, const struct commonio_entry *p)
+ {
+Index: shadow/lib/commonio.h
+===================================================================
+--- shadow.orig/lib/commonio.h	2013-02-01 15:27:51.376080384 -0600
+++ shadow/lib/commonio.h	2013-02-01 15:27:51.368080384 -0600
+@@ -146,6 +146,7 @@
+ extern int commonio_open (struct commonio_db *, int);
+ extern /*@observer@*/ /*@null@*/const void *commonio_locate (struct commonio_db *, const char *);
+ extern int commonio_update (struct commonio_db *, const void *);
+extern int commonio_append (struct commonio_db *, const void *);
+ extern int commonio_remove (struct commonio_db *, const char *);
+ extern int commonio_rewind (struct commonio_db *);
+ extern /*@observer@*/ /*@null@*/const void *commonio_next (struct commonio_db *);
--- a/debian/patches/userns/04_userns_add_backend_support
+++ b/debian/patches/userns/04_userns_add_backend_support
@@ -0,0 +1,685 @@
+From ebiederm@xmission.com  Tue Jan 22 09:16:29 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id AF9A9C80F4; Tue, 22 Jan 2013 09:16:29 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
+	autolearn=no version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id EDF70C80D1
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:16:24 +0000 (UTC)
+Received: from out01.mta.xmission.com ([166.70.13.231])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZwI-0007HS-Mn; Tue, 22 Jan 2013 02:14:42 -0700
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out01.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZwI-0005wP-8E; Tue, 22 Jan 2013 02:14:42 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZwE-0004bA-Mv; Tue, 22 Jan 2013 02:14:42 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:14:35 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <87liblr344.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX1/3QOlmT6VsAuzQbs/RJ/nb1IrpO++QYVA=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 04/11] Add backend support for suboridnate uids and gids
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2074                                                  
+Status: RO
+X-Status: A
+Content-Length: 15967
+Lines: 636
+
+
+These files list the set of subordinate uids and gids that users are allowed
+to use.   The expect use case is with the user namespace but other uses are
+allowed.
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ etc/login.defs      |    8 +
+ lib/Makefile.am     |    2 +
+ lib/getdef.c        |    6 +
+ lib/subordinateio.c |  512 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ lib/subordinateio.h |   38 ++++
+ 5 files changed, 566 insertions(+), 0 deletions(-)
+ create mode 100644 lib/subordinateio.c
+ create mode 100644 lib/subordinateio.h
+
+Index: shadow/etc/login.defs
+===================================================================
+--- shadow.orig/etc/login.defs	2013-02-01 15:27:51.684080379 -0600
+++ shadow/etc/login.defs	2013-02-01 15:27:51.676080379 -0600
+@@ -226,6 +226,10 @@
+ # System accounts
+ SYS_UID_MIN		  101
+ SYS_UID_MAX		  999
+# Extra per user uids
+SUB_UID_MIN		   100000
+SUB_UID_MAX		600100000
+SUB_UID_COUNT		    10000
+ 
+ #
+ # Min/max values for automatic gid selection in groupadd
+@@ -235,6 +239,10 @@
+ # System accounts
+ SYS_GID_MIN		  101
+ SYS_GID_MAX		  999
+# Extra per user group ids
+SUB_GID_MIN		   100000
+SUB_GID_MAX		600100000
+SUB_GID_COUNT		    10000
+ 
+ #
+ # Max number of login retries if password is bad
+Index: shadow/lib/Makefile.am
+===================================================================
+--- shadow.orig/lib/Makefile.am	2013-02-01 15:27:51.684080379 -0600
+++ shadow/lib/Makefile.am	2013-02-01 15:27:51.676080379 -0600
+@@ -39,6 +39,8 @@
+ 	pwio.c \
+ 	pwio.h \
+ 	pwmem.c \
+	subordinateio.h \
+	subordinateio.c \
+ 	selinux.c \
+ 	semanage.c \
+ 	sgetgrent.c \
+Index: shadow/lib/getdef.c
+===================================================================
+--- shadow.orig/lib/getdef.c	2013-02-01 15:27:51.684080379 -0600
+++ shadow/lib/getdef.c	2013-02-01 15:27:51.680080379 -0600
+@@ -82,6 +82,12 @@
+ 	{"SHA_CRYPT_MAX_ROUNDS", NULL},
+ 	{"SHA_CRYPT_MIN_ROUNDS", NULL},
+ #endif
+	{"SUB_GID_COUNT", NULL},
+	{"SUB_GID_MAX", NULL},
+	{"SUB_GID_MIN", NULL},
+	{"SUB_UID_COUNT", NULL},
+	{"SUB_UID_MAX", NULL},
+	{"SUB_UID_MIN", NULL},
+ 	{"SULOG_FILE", NULL},
+ 	{"SU_NAME", NULL},
+ 	{"SYS_GID_MAX", NULL},
+Index: shadow/lib/subordinateio.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ shadow/lib/subordinateio.c	2013-02-01 15:27:51.680080379 -0600
+@@ -0,0 +1,512 @@
+/*
+ * Copyright (c) 2012 - Eric Biederman
+ */
+
+#include <config.h>
+#include "prototypes.h"
+#include "defines.h"
+#include <stdio.h>
+#include "commonio.h"
+#include "subordinateio.h"
+
+struct subordinate_range {
+	const char *owner;
+	unsigned long start;
+	unsigned long count;
+};
+
+#define NFIELDS 3
+
+static /*@null@*/ /*@only@*/void *subordinate_dup (const void *ent)
+{
+	const struct subordinate_range *rangeent = ent;
+	struct subordinate_range *range;
+
+	range = (struct subordinate_range *) malloc (sizeof *range);
+	if (NULL == range) {
+		return NULL;
+	}
+	range->owner = strdup (rangeent->owner);
+	if (NULL == range->owner) {
+		free(range);
+		return NULL;
+	}
+	range->start = rangeent->start;
+	range->count = rangeent->count;
+
+	return range;
+}
+
+static void subordinate_free (/*@out@*/ /*@only@*/void *ent)
+{
+	struct subordinate_range *rangeent = ent;
+	
+	free ((void *)(rangeent->owner));
+	free (rangeent);
+}
+
+static void *subordinate_parse (const char *line)
+{
+	static struct subordinate_range range;
+	char rangebuf[1024];
+	int i;
+	char *cp;
+	char *fields[NFIELDS];
+
+	/*
+	 * Copy the string to a temporary buffer so the substrings can
+	 * be modified to be NULL terminated.
+	 */
+	if (strlen (line) >= sizeof rangebuf)
+		return NULL;	/* fail if too long */
+	strcpy (rangebuf, line);
+
+	/*
+	 * Save a pointer to the start of each colon separated
+	 * field.  The fields are converted into NUL terminated strings.
+	 */
+
+	for (cp = rangebuf, i = 0; (i < NFIELDS) && (NULL != cp); i++) {
+		fields[i] = cp;
+		while (('\0' != *cp) && (':' != *cp)) {
+			cp++;
+		}
+
+		if ('\0' != *cp) {
+			*cp = '\0';
+			cp++;
+		} else {
+			cp = NULL;
+		}
+	}
+
+	/*
+	 * There must be exactly NFIELDS colon separated fields or
+	 * the entry is invalid.  Also, fields must be non-blank.
+	 */
+	if (i != NFIELDS || *fields[0] == '\0' || *fields[1] == '\0' || *fields[2] == '\0')
+		return NULL;
+	range.owner = fields[0];
+	if (getulong (fields[1], &range.start) == 0)
+		return NULL;
+	if (getulong (fields[2], &range.count) == 0)
+		return NULL;
+
+	return &range;
+}
+
+static int subordinate_put (const void *ent, FILE * file)
+{
+	const struct subordinate_range *range = ent;
+
+	return fprintf(file, "%s:%lu:%lu\n",
+			       range->owner,
+			       range->start,
+			       range->count) < 0 ? -1  : 0;
+}
+
+static struct commonio_ops subordinate_ops = {
+	subordinate_dup,	/* dup */
+	subordinate_free,	/* free */
+	NULL,			/* getname */
+	subordinate_parse,	/* parse */
+	subordinate_put,	/* put */
+	fgets,			/* fgets */
+	fputs,			/* fputs */
+	NULL,			/* open_hook */
+	NULL,			/* close_hook */
+};
+
+static /*@observer@*/ /*@null*/const struct subordinate_range *subordinate_next(struct commonio_db *db)
+{
+	commonio_next (db);
+}
+
+static bool is_range_free(struct commonio_db *db, unsigned long start,
+			  unsigned long count)
+{
+	const struct subordinate_range *range;
+	unsigned long end = start + count - 1;
+
+	commonio_rewind(db);
+	while ((range = commonio_next(db)) != NULL) {
+		unsigned long first = range->start;
+		unsigned long last = first + range->count - 1;
+
+		if ((end >= first) && (start <= last))
+			return false;
+	}
+	return true;
+}
+
+static const bool range_exists(struct commonio_db *db, const char *owner)
+{
+	const struct subordinate_range *range;
+	commonio_rewind(db);
+	while ((range = commonio_next(db)) != NULL) {
+		unsigned long first = range->start;
+		unsigned long last = first + range->count - 1;
+
+		if (0 == strcmp(range->owner, owner))
+			return true;
+	}
+	return false;
+}
+
+static const struct subordinate_range *find_range(struct commonio_db *db,
+						  const char *owner, unsigned long val)
+{
+	const struct subordinate_range *range;
+	commonio_rewind(db);
+	while ((range = commonio_next(db)) != NULL) {
+		unsigned long first = range->start;
+		unsigned long last = first + range->count - 1;
+
+		if (0 != strcmp(range->owner, owner))
+			continue;
+
+		if ((val >= first) && (val <= last))
+			return range;
+	}
+	return NULL;
+}
+
+static bool have_range(struct commonio_db *db,
+		       const char *owner, unsigned long start, unsigned long count)
+{
+	const struct subordinate_range *range;
+	unsigned long end;
+
+	if (count == 0)
+		return false;
+
+	end = start + count - 1;
+	range = find_range (db, owner, start);
+	while (range) {
+		unsigned long last; 
+
+		last = range->start + range->count - 1;
+		if (last >= (start + count - 1))
+			return true;
+
+		count = end - last;
+		start = last + 1;
+		range = find_range(db, owner, start);
+	}
+	return false;
+}
+
+static int subordinate_range_cmp (const void *p1, const void *p2)
+{
+	struct subordinate_range *range1, *range2;
+
+	if ((*(struct commonio_entry **) p1)->eptr == NULL)
+		return 1;
+	if ((*(struct commonio_entry **) p2)->eptr == NULL)
+		return -1;
+
+	range1 = ((struct subordinate_range *) (*(struct commonio_entry **) p1)->eptr);
+	range2 = ((struct subordinate_range *) (*(struct commonio_entry **) p2)->eptr);
+
+	if (range1->start < range2->start)
+		return -1;
+	else if (range1->start > range2->start)
+		return 1;
+	else if (range1->count < range2->count)
+		return -1;
+	else if (range1->count > range2->count)
+		return 1;
+	else
+		return strcmp(range1->owner, range2->owner);
+}
+
+static unsigned long find_free_range(struct commonio_db *db,
+				     unsigned long min, unsigned long max,
+				     unsigned long count)
+{
+	const struct subordinate_range *range;
+	unsigned long low, high;
+
+	/* When given invalid parameters fail */
+	if ((count == 0) || (max <= min))
+		goto fail;
+
+	/* Sort by range than by owner */
+	commonio_sort (db, subordinate_range_cmp);
+	commonio_rewind(db);
+
+	low = min;
+	while ((range = commonio_next(db)) != NULL) {
+		unsigned long first = range->start;
+		unsigned long last = first + range->count - 1;
+
+		/* Find the top end of the hole before this range */
+		high = first;
+		if (high > max)
+			high = max;
+
+		/* Is the hole before this range large enough? */
+		if ((high > low) && (((high - low) + 1) >= count))
+			return low;
+
+		/* Compute the low end of the next hole */
+		if (low < (last + 1))
+			low = last + 1;
+		if (low > max)
+			goto fail;
+	}
+
+	/* Is the remaining unclaimed area large enough? */
+	if (((max - low) + 1) >= count)
+		return low;
+fail:
+	return ULONG_MAX;
+}
+
+static int add_range(struct commonio_db *db,
+	const char *owner, unsigned long start, unsigned long count)
+{
+	struct subordinate_range range;
+	range.owner = owner;
+	range.start = start;
+	range.count = count;
+
+	/* See if the range is already present */
+	if (have_range(db, owner, start, count))
+		return 1;
+
+	/* Oterwise append the range */
+	return commonio_append(db, &range);
+}
+
+static int remove_range(struct commonio_db *db,
+	const char *owner, unsigned long start, unsigned long count)
+{
+	struct commonio_entry *ent;
+	unsigned long end;
+
+	if (count == 0)
+		return 1;
+
+	end = start + count - 1;
+	for (ent = db->head; ent; ent = ent->next) {
+		struct subordinate_range *range = ent->eptr;
+		unsigned long first;
+		unsigned long last;
+
+		/* Skip unparsed entries */
+		if (!range)
+			continue;
+
+		first = range->start;
+		last = first + range->count - 1;
+
+		/* Skip entries with a different owner */
+		if (0 != strcmp(range->owner, owner))
+			continue;
+
+		/* Skip entries outside of the range to remove */
+		if ((end < first) || (start > last))
+			continue;
+
+		/* Is entry completely contained in the range to remove? */
+		if ((start <= first) && (end >= last)) {
+			commonio_del_entry (db, ent);
+		} 
+		/* Is just the start of the entry removed? */
+		else if ((start <= first) && (end < last)) {
+			range->start = end + 1;
+			range->count = (last - range->start) + 1;
+
+			ent->changed = true;
+		}
+		/* Is just the end of the entry removed? */
+		else if ((start > first) && (end >= last)) {
+			range->count = (start - range->start) + 1;
+
+			ent->changed = true;
+		}
+		/* The middle of the range is removed */
+		else {
+			struct subordinate_range tail;
+			tail.owner = range->owner;
+			tail.start = end + 1;
+			tail.count = (last - tail.start) + 1;
+
+			if (!commonio_append(db, &tail))
+				return 0;
+
+			range->count = (start - range->start) + 1;
+
+			ent->changed = true;
+		}
+	}
+
+	return 1;
+}
+
+static struct commonio_db subordinate_uid_db = {
+	"/etc/subuid",		/* filename */
+	&subordinate_ops,	/* ops */
+	NULL,			/* fp */
+#ifdef WITH_SELINUX
+	NULL,			/* scontext */
+#endif
+	NULL,			/* head */
+	NULL,			/* tail */
+	NULL,			/* cursor */
+	false,			/* changed */
+	false,			/* isopen */
+	false,			/* locked */
+	false			/* readonly */
+};
+
+int sub_uid_setdbname (const char *filename)
+{
+	return commonio_setname (&subordinate_uid_db, filename);
+}
+
+/*@observer@*/const char *sub_uid_dbname (void)
+{
+	return subordinate_uid_db.filename;
+}
+
+bool sub_uid_file_present (void)
+{
+	return commonio_present (&subordinate_uid_db);
+}
+
+int sub_uid_lock (void)
+{
+	return commonio_lock (&subordinate_uid_db);
+}
+
+int sub_uid_open (int mode)
+{
+	return commonio_open (&subordinate_uid_db, mode);
+}
+
+bool is_sub_uid_range_free(uid_t start, unsigned long count)
+{
+	return is_range_free (&subordinate_uid_db, start, count);
+}
+
+bool sub_uid_assigned(const char *owner)
+{
+	return range_exists (&subordinate_uid_db, owner);
+}
+
+bool have_sub_uids(const char *owner, uid_t start, unsigned long count)
+{
+	return have_range (&subordinate_uid_db, owner, start, count);
+}
+
+int sub_uid_add (const char *owner, uid_t start, unsigned long count)
+{
+	return add_range (&subordinate_uid_db, owner, start, count);
+}
+
+int sub_uid_remove (const char *owner, uid_t start, unsigned long count)
+{
+	return remove_range (&subordinate_uid_db, owner, start, count);
+}
+
+int sub_uid_close (void)
+{
+	return commonio_close (&subordinate_uid_db);
+}
+
+int sub_uid_unlock (void)
+{
+	return commonio_unlock (&subordinate_uid_db);
+}
+
+uid_t sub_uid_find_free_range(uid_t min, uid_t max, unsigned long count)
+{
+	unsigned long start;
+	start = find_free_range (&subordinate_uid_db, min, max, count);
+	return start == ULONG_MAX ? (uid_t) -1 : start;
+}
+
+static struct commonio_db subordinate_gid_db = {
+	"/etc/subgid",		/* filename */
+	&subordinate_ops,	/* ops */
+	NULL,			/* fp */
+#ifdef WITH_SELINUX
+	NULL,			/* scontext */
+#endif
+	NULL,			/* head */
+	NULL,			/* tail */
+	NULL,			/* cursor */
+	false,			/* changed */
+	false,			/* isopen */
+	false,			/* locked */
+	false			/* readonly */
+};
+
+int sub_gid_setdbname (const char *filename)
+{
+	return commonio_setname (&subordinate_gid_db, filename);
+}
+
+/*@observer@*/const char *sub_gid_dbname (void)
+{
+	return subordinate_gid_db.filename;
+}
+
+bool sub_gid_file_present (void)
+{
+	return commonio_present (&subordinate_gid_db);
+}
+
+int sub_gid_lock (void)
+{
+	return commonio_lock (&subordinate_gid_db);
+}
+
+int sub_gid_open (int mode)
+{
+	return commonio_open (&subordinate_gid_db, mode);
+}
+
+bool is_sub_gid_range_free(gid_t start, unsigned long count)
+{
+	return is_range_free (&subordinate_gid_db, start, count);
+}
+
+bool have_sub_gids(const char *owner, gid_t start, unsigned long count)
+{
+	return have_range(&subordinate_gid_db, owner, start, count);
+}
+
+bool sub_gid_assigned(const char *owner)
+{
+	return range_exists (&subordinate_gid_db, owner);
+}
+
+int sub_gid_add (const char *owner, gid_t start, unsigned long count)
+{
+	return add_range (&subordinate_gid_db, owner, start, count);
+}
+
+int sub_gid_remove (const char *owner, gid_t start, unsigned long count)
+{
+	return remove_range (&subordinate_gid_db, owner, start, count);
+}
+
+int sub_gid_close (void)
+{
+	return commonio_close (&subordinate_gid_db);
+}
+
+int sub_gid_unlock (void)
+{
+	return commonio_unlock (&subordinate_gid_db);
+}
+
+gid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count)
+{
+	unsigned long start;
+	start = find_free_range (&subordinate_gid_db, min, max, count);
+	return start == ULONG_MAX ? (gid_t) -1 : start;
+}
+Index: shadow/lib/subordinateio.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ shadow/lib/subordinateio.h	2013-02-01 15:27:51.680080379 -0600
+@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2012- Eric W. Biederman
+ */
+
+#ifndef _SUBORDINATEIO_H
+#define _SUBORDINATEIO_H
+
+#include <sys/types.h>
+
+extern int sub_uid_close(void);
+extern bool is_sub_uid_range_free(uid_t start, unsigned long count);
+extern bool have_sub_uids(const char *owner, uid_t start, unsigned long count);
+extern bool sub_uid_file_present (void);
+extern bool sub_uid_assigned(const char *owner);
+extern int sub_uid_lock (void);
+extern int sub_uid_setdbname (const char *filename);
+extern /*@observer@*/const char *sub_uid_dbname (void);
+extern int sub_uid_open (int mode);
+extern int sub_uid_unlock (void);
+extern int sub_uid_add (const char *owner, uid_t start, unsigned long count);
+extern int sub_uid_remove (const char *owner, uid_t start, unsigned long count);
+extern uid_t sub_uid_find_free_range(uid_t min, uid_t max, unsigned long count);
+
+extern int sub_gid_close(void);
+extern bool is_sub_gid_range_free(gid_t start, unsigned long count);
+extern bool have_sub_gids(const char *owner, gid_t start, unsigned long count);
+extern bool sub_gid_file_present (void);
+extern bool sub_gid_assigned(const char *owner);
+extern int sub_gid_lock (void);
+extern int sub_gid_setdbname (const char *filename);
+extern /*@observer@*/const char *sub_gid_dbname (void);
+extern int sub_gid_open (int mode);
+extern int sub_gid_unlock (void);
+extern int sub_gid_add (const char *owner, gid_t start, unsigned long count);
+extern int sub_gid_remove (const char *owner, gid_t start, unsigned long count);
+extern uid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count);
+
+#endif
--- a/debian/patches/userns/05_userns_implemend_find_new_sub_xids
+++ b/debian/patches/userns/05_userns_implemend_find_new_sub_xids
@@ -0,0 +1,283 @@
+From ebiederm@xmission.com  Tue Jan 22 09:17:02 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id 480ABC80F4; Tue, 22 Jan 2013 09:17:02 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
+	autolearn=no version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id 90ACFC80D1
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:16:57 +0000 (UTC)
+Received: from out01.mta.xmission.com ([166.70.13.231])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZwp-0007cg-9X; Tue, 22 Jan 2013 02:15:15 -0700
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out01.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZwo-0006DN-OT; Tue, 22 Jan 2013 02:15:14 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZwj-0004g0-9e; Tue, 22 Jan 2013 02:15:14 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:15:05 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <87fw1tr33a.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX19KHX5xUOkaLY5iIEqDVLxZKDTByyA0Xk8=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 05/11] Implement find_new_sub_uids find_new_sub_gids
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2075                                                  
+Status: RO
+Content-Length: 8108
+Lines: 235
+
+
+Functions for finding new subordinate uid and gids ranges for use
+with useradd.
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ lib/prototypes.h            |    9 ++++
+ libmisc/Makefile.am         |    2 +
+ libmisc/find_new_sub_gids.c |   87 +++++++++++++++++++++++++++++++++++++++++++
+ libmisc/find_new_sub_uids.c |   87 +++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 185 insertions(+), 0 deletions(-)
+ create mode 100644 libmisc/find_new_sub_gids.c
+ create mode 100644 libmisc/find_new_sub_uids.c
+
+Index: shadow/lib/prototypes.h
+===================================================================
+--- shadow.orig/lib/prototypes.h	2013-02-01 15:27:52.044080373 -0600
+++ shadow/lib/prototypes.h	2013-02-01 15:27:52.040080373 -0600
+@@ -149,6 +149,15 @@
+                          uid_t *uid,
+                          /*@null@*/uid_t const *preferred_uid);
+ 
+/* find_new_sub_gids.c */
+extern int find_new_sub_gids (const char *owner,
+			      gid_t *range_start, unsigned long *range_count);
+
+/* find_new_sub_uids.c */
+extern int find_new_sub_uids (const char *owner,
+			      uid_t *range_start, unsigned long *range_count);
+
+
+ /* get_gid.c */
+ extern int get_gid (const char *gidstr, gid_t *gid);
+ 
+Index: shadow/libmisc/Makefile.am
+===================================================================
+--- shadow.orig/libmisc/Makefile.am	2013-02-01 15:27:52.044080373 -0600
+++ shadow/libmisc/Makefile.am	2013-02-01 15:27:52.040080373 -0600
+@@ -25,6 +25,8 @@
+ 	failure.h \
+ 	find_new_gid.c \
+ 	find_new_uid.c \
+	find_new_sub_gids.c \
+	find_new_sub_uids.c \
+ 	getdate.h \
+ 	getdate.y \
+ 	getgr_nam_gid.c \
+Index: shadow/libmisc/find_new_sub_gids.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ shadow/libmisc/find_new_sub_gids.c	2013-02-01 15:27:52.040080373 -0600
+@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2012 Eric Biederman
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the copyright holders or contributors may not be used to
+ *    endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <config.h>
+
+#include <assert.h>
+#include <stdio.h>
+#include <errno.h>
+
+#include "prototypes.h"
+#include "subordinateio.h"
+#include "getdef.h"
+
+/*
+ * find_new_sub_gids - Find a new unused range of GIDs.
+ *
+ * If successful, find_new_sub_gids provides a range of unused
+ * user IDs in the [SUB_GID_MIN:SUB_GID_MAX] range.
+ * 
+ * Return 0 on success, -1 if no unused GIDs are available.
+ */
+int find_new_sub_gids (const char *owner,
+		       gid_t *range_start, unsigned long *range_count)
+{
+	unsigned long min, max;
+	unsigned long count;
+	gid_t start;
+
+	assert (range_start != NULL);
+	assert (range_count != NULL);
+
+	min = getdef_ulong ("SUB_GID_MIN", 100000UL);
+	max = getdef_ulong ("SUB_GID_MAX", 600100000UL);
+	count = getdef_ulong ("SUB_GID_COUNT", 10000);
+
+	/* Is there a preferred range that works? */
+	if ((*range_count != 0) &&
+	    (*range_start >= min) &&
+	    (((*range_start) + (*range_count) - 1) <= max) &&
+	    is_sub_gid_range_free(*range_start, *range_count)) {
+		return 0;
+	}
+
+	if (max < (min + count)) {
+		(void) fprintf (stderr,
+				_("%s: Invalid configuration: SUB_GID_MIN (%lu), SUB_GID_MAX (%lu)\n"),
+			Prog, min, max);
+		return -1;
+	}
+	start = sub_gid_find_free_range(min, max, count);
+	if (start == (gid_t)-1) {
+		fprintf (stderr,
+		         _("%s: Can't get unique secondary GID range\n"),
+		         Prog);
+		SYSLOG ((LOG_WARN, "no more available secondary GIDs on the system"));
+		return -1;
+	}
+	*range_start = start;
+	*range_count = count;
+	return 0;
+}
+
+Index: shadow/libmisc/find_new_sub_uids.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ shadow/libmisc/find_new_sub_uids.c	2013-02-01 15:27:52.040080373 -0600
+@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2012 Eric Biederman
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the copyright holders or contributors may not be used to
+ *    endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <config.h>
+
+#include <assert.h>
+#include <stdio.h>
+#include <errno.h>
+
+#include "prototypes.h"
+#include "subordinateio.h"
+#include "getdef.h"
+
+/*
+ * find_new_sub_uids - Find a new unused range of UIDs.
+ *
+ * If successful, find_new_sub_uids provides a range of unused
+ * user IDs in the [SUB_UID_MIN:SUB_UID_MAX] range.
+ * 
+ * Return 0 on success, -1 if no unused UIDs are available.
+ */
+int find_new_sub_uids (const char *owner,
+		       uid_t *range_start, unsigned long *range_count)
+{
+	unsigned long min, max;
+	unsigned long count;
+	uid_t start;
+
+	assert (range_start != NULL);
+	assert (range_count != NULL);
+
+	min = getdef_ulong ("SUB_UID_MIN", 100000UL);
+	max = getdef_ulong ("SUB_UID_MAX", 600100000UL);
+	count = getdef_ulong ("SUB_UID_COUNT", 10000);
+
+	/* Is there a preferred range that works? */
+	if ((*range_count != 0) &&
+	    (*range_start >= min) &&
+	    (((*range_start) + (*range_count) - 1) <= max) &&
+	    is_sub_uid_range_free(*range_start, *range_count)) {
+		return 0;
+	}
+
+	if (max < (min + count)) {
+		(void) fprintf (stderr,
+				_("%s: Invalid configuration: SUB_UID_MIN (%lu), SUB_UID_MAX (%lu)\n"),
+			Prog, min, max);
+		return -1;
+	}
+	start = sub_uid_find_free_range(min, max, count);
+	if (start == (uid_t)-1) {
+		fprintf (stderr,
+		         _("%s: Can't get unique secondary UID range\n"),
+		         Prog);
+		SYSLOG ((LOG_WARN, "no more available secondary UIDs on the system"));
+		return -1;
+	}
+	*range_start = start;
+	*range_count = count;
+	return 0;
+}
+
--- a/debian/patches/userns/06_userns_userdel
+++ b/debian/patches/userns/06_userns_userdel
@@ -0,0 +1,236 @@
+From ebiederm@xmission.com  Tue Jan 22 09:18:47 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id F2E6AC80F6; Tue, 22 Jan 2013 09:18:46 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
+	autolearn=no version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id 996B1C80D1
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:18:42 +0000 (UTC)
+Received: from out03.mta.xmission.com ([166.70.13.233])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZyW-0008Bi-3X; Tue, 22 Jan 2013 02:17:00 -0700
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZyU-0005NA-Qm; Tue, 22 Jan 2013 02:16:59 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZyQ-0004qs-T1; Tue, 22 Jan 2013 02:16:58 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:16:51 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <878v7lr30c.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX1/1l7dElNy9uNLAXx8eC28OMs/pxPM8NEo=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 06/11] userdel: Add support for removing subordinate user and group ids.
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2076                                        
+Status: O
+Content-Length: 5573
+Lines: 186
+
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ src/userdel.c |  115 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 files changed, 115 insertions(+), 0 deletions(-)
+
+Index: shadow/src/userdel.c
+===================================================================
+--- shadow.orig/src/userdel.c	2013-02-01 15:27:52.380080367 -0600
+++ shadow/src/userdel.c	2013-02-01 15:27:52.372080367 -0600
+@@ -65,6 +65,7 @@
+ #endif				/* WITH_TCB */
+ /*@-exitarg@*/
+ #include "exitcodes.h"
+#include "subordinateio.h"
+ 
+ /*
+  * exit status values
+@@ -75,6 +76,8 @@
+ #define E_GRP_UPDATE	10	/* can't update group file */
+ #define E_HOMEDIR	12	/* can't remove home directory */
+ #define E_SE_UPDATE	14	/* can't update SELinux user mapping */
+#define E_SUB_UID_UPDATE 16	/* can't update the subordinate uid file */
+#define E_SUB_GID_UPDATE 18	/* can't update the subordinate gid file */
+ 
+ /*
+  * Global variables
+@@ -96,9 +99,13 @@
+ static bool is_shadow_grp;
+ static bool sgr_locked = false;
+ #endif				/* SHADOWGRP */
+static bool is_sub_uid;
+static bool is_sub_gid;
+ static bool pw_locked  = false;
+ static bool gr_locked   = false;
+ static bool spw_locked  = false;
+static bool sub_uid_locked = false;
+static bool sub_gid_locked = false;
+ 
+ /* local function prototypes */
+ static void usage (int status);
+@@ -437,6 +444,34 @@
+ 		sgr_locked = false;
+ 	}
+ #endif				/* SHADOWGRP */
+
+	if (is_sub_uid) {
+		if (sub_uid_close () == 0) {
+			fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_uid_dbname ()));
+			fail_exit (E_SUB_UID_UPDATE);
+		}
+		if (sub_uid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
+			/* continue */
+		}
+		sub_uid_locked = false;
+	}
+
+	if (is_sub_gid) {
+		if (sub_gid_close () == 0) {
+			fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_gid_dbname ()));
+			fail_exit (E_SUB_GID_UPDATE);
+		}
+		if (sub_gid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
+			/* continue */
+		}
+		sub_gid_locked = false;
+	}
+ }
+ 
+ /*
+@@ -474,6 +509,20 @@
+ 		}
+ 	}
+ #endif				/* SHADOWGRP */
+	if (sub_uid_locked) {
+		if (sub_uid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
+			/* continue */
+		}
+	}
+	if (sub_gid_locked) {
+		if (sub_gid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
+			/* continue */
+		}
+	}
+ 
+ #ifdef WITH_AUDIT
+ 	audit_logger (AUDIT_DEL_USER, Prog,
+@@ -595,6 +644,58 @@
+ 		}
+ 	}
+ #endif				/* SHADOWGRP */
+	if (is_sub_uid) {
+		if (sub_uid_lock () == 0) {
+			fprintf (stderr,
+				_("%s: cannot lock %s; try again later.\n"),
+				Prog, sub_uid_dbname ());
+#ifdef WITH_AUDIT
+			audit_logger (AUDIT_DEL_USER, Prog,
+				"locking subordinate user file",
+				user_name, (unsigned int) user_id,
+				SHADOW_AUDIT_FAILURE);
+#endif				/* WITH_AUDIT */
+			fail_exit (E_SUB_UID_UPDATE);
+		}
+		sub_uid_locked = true;
+		if (sub_uid_open (O_RDWR) == 0) {
+			fprintf (stderr,
+				_("%s: cannot open %s\n"), Prog, sub_uid_dbname ());
+#ifdef WITH_AUDIT
+			audit_logger (AUDIT_DEL_USER, Prog,
+				"opening subordinate user file",
+				user_name, (unsigned int) user_id,
+				SHADOW_AUDIT_FAILURE);
+#endif				/* WITH_AUDIT */
+			fail_exit (E_SUB_UID_UPDATE);
+		}
+	}
+	if (is_sub_gid) {
+		if (sub_gid_lock () == 0) {
+			fprintf (stderr,
+				_("%s: cannot lock %s; try again later.\n"),
+				Prog, sub_gid_dbname ());
+#ifdef WITH_AUDIT
+			audit_logger (AUDIT_DEL_USER, Prog,
+				"locking subordinate group file",
+				user_name, (unsigned int) user_id,
+				SHADOW_AUDIT_FAILURE);
+#endif				/* WITH_AUDIT */
+			fail_exit (E_SUB_GID_UPDATE);
+		}
+		sub_gid_locked = true;
+		if (sub_gid_open (O_RDWR) == 0) {
+			fprintf (stderr,
+				_("%s: cannot open %s\n"), Prog, sub_gid_dbname ());
+#ifdef WITH_AUDIT
+			audit_logger (AUDIT_DEL_USER, Prog,
+				"opening subordinate group file",
+				user_name, (unsigned int) user_id,
+				SHADOW_AUDIT_FAILURE);
+#endif				/* WITH_AUDIT */
+			fail_exit (E_SUB_GID_UPDATE);
+		}
+	}
+ }
+ 
+ /*
+@@ -619,6 +720,18 @@
+ 		         Prog, user_name, spw_dbname ());
+ 		fail_exit (E_PW_UPDATE);
+ 	}
+	if (is_sub_uid && sub_uid_remove(user_name, 0, ULONG_MAX) == 0) {
+		fprintf (stderr,
+			_("%s: cannot remove entry %lu from %s\n"),
+			Prog, (unsigned long)user_id, sub_uid_dbname ());
+		fail_exit (E_SUB_UID_UPDATE);
+	}
+	if (is_sub_gid && sub_gid_remove(user_name, 0, ULONG_MAX) == 0) {
+		fprintf (stderr,
+			_("%s: cannot remove entry %lu from %s\n"),
+			Prog, (unsigned long)user_id, sub_gid_dbname ());
+		fail_exit (E_SUB_GID_UPDATE);
+	}
+ #ifdef WITH_AUDIT
+ 	audit_logger (AUDIT_DEL_USER, Prog,
+ 	              "deleting user entries",
+@@ -966,6 +1079,8 @@
+ #ifdef SHADOWGRP
+ 	is_shadow_grp = sgr_file_present ();
+ #endif				/* SHADOWGRP */
+	is_sub_uid = sub_uid_file_present ();
+	is_sub_gid = sub_gid_file_present ();
+ 
+ 	/*
+ 	 * Start with a quick check to see if the user exists.
--- a/debian/patches/userns/07_userns_useradd
+++ b/debian/patches/userns/07_userns_useradd
@@ -0,0 +1,285 @@
+From ebiederm@xmission.com  Tue Jan 22 09:19:29 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id 61652C80DB; Tue, 22 Jan 2013 09:19:29 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
+	autolearn=no version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id E0ABBC80F4
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:19:23 +0000 (UTC)
+Received: from out03.mta.xmission.com ([166.70.13.233])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZzB-0008QG-Kq; Tue, 22 Jan 2013 02:17:41 -0700
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZz7-0005Ui-1H; Tue, 22 Jan 2013 02:17:37 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZz4-0004tF-BP; Tue, 22 Jan 2013 02:17:36 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:17:30 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <8738xtr2z9.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX1/Jm5H2PcjgcLXEyKh9YL3DVs2WZBJhDB8=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 07/11] useradd: Add support for subordinate user identifiers
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2077                                                  
+Status: RO
+Content-Length: 6886
+Lines: 235
+
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ src/useradd.c |  141 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 files changed, 140 insertions(+), 1 deletions(-)
+
+Index: shadow/src/useradd.c
+===================================================================
+--- shadow.orig/src/useradd.c	2013-02-01 15:27:52.668080362 -0600
+++ shadow/src/useradd.c	2013-02-01 15:27:52.660080362 -0600
+@@ -65,6 +65,7 @@
+ #include "sgroupio.h"
+ #endif
+ #include "shadowio.h"
+#include "subordinateio.h"
+ #ifdef WITH_TCB
+ #include "tcbfuncs.h"
+ #endif
+@@ -121,12 +122,20 @@
+ static bool is_shadow_grp;
+ static bool sgr_locked = false;
+ #endif
+static bool is_sub_uid = false;
+static bool is_sub_gid = false;
+ static bool pw_locked = false;
+ static bool gr_locked = false;
+ static bool spw_locked = false;
+static bool sub_uid_locked = false;
+static bool sub_gid_locked = false;
+ static char **user_groups;	/* NULL-terminated list */
+ static long sys_ngroups;
+ static bool do_grp_update = false;	/* group files need to be updated */
+static uid_t sub_uid_start;	/* New subordinate uid range */
+static unsigned long sub_uid_count;
+static gid_t sub_gid_start;	/* New subordinate gid range */
+static unsigned long sub_gid_count;
+ 
+ static bool
+     bflg = false,		/* new default root of home directory */
+@@ -168,6 +177,8 @@
+ #define E_GRP_UPDATE	10	/* can't update group file */
+ #define E_HOMEDIR	12	/* can't create home directory */
+ #define E_SE_UPDATE	14	/* can't update SELinux user mapping */
+#define E_SUB_UID_UPDATE 16	/* can't update the subordinate uid file */
+#define E_SUB_GID_UPDATE 18	/* can't update the subordinate gid file */
+ 
+ #define DGROUP			"GROUP="
+ #define DHOME			"HOME="
+@@ -268,6 +279,32 @@
+ 		}
+ 	}
+ #endif
+	if (sub_uid_locked) {
+		if (sub_uid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
+#ifdef WITH_AUDIT
+			audit_logger (AUDIT_ADD_USER, Prog,
+			              "unlocking subodinate user file",
+			              user_name, AUDIT_NO_ID,
+			              SHADOW_AUDIT_FAILURE);
+#endif
+			/* continue */
+		}
+	}
+	if (sub_gid_locked) {
+		if (sub_gid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
+#ifdef WITH_AUDIT
+			audit_logger (AUDIT_ADD_USER, Prog,
+			              "unlocking subodinate group file",
+			              user_name, AUDIT_NO_ID,
+			              SHADOW_AUDIT_FAILURE);
+#endif
+			/* continue */
+		}
+	}
+ 
+ #ifdef WITH_AUDIT
+ 	audit_logger (AUDIT_ADD_USER, Prog,
+@@ -1379,6 +1416,18 @@
+ 		}
+ #endif
+ 	}
+	if (is_sub_uid  && (sub_uid_close () == 0)) {
+		fprintf (stderr,
+		         _("%s: failure while writing changes to %s\n"), Prog, sub_uid_dbname ());
+		SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_uid_dbname ()));
+		fail_exit (E_SUB_UID_UPDATE);
+	}
+	if (is_sub_gid  && (sub_gid_close () == 0)) {
+		fprintf (stderr,
+		         _("%s: failure while writing changes to %s\n"), Prog, sub_gid_dbname ());
+		SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_gid_dbname ()));
+		fail_exit (E_SUB_GID_UPDATE);
+	}
+ 	if (is_shadow_pwd) {
+ 		if (spw_unlock () == 0) {
+ 			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, spw_dbname ());
+@@ -1433,6 +1482,34 @@
+ 		sgr_locked = false;
+ 	}
+ #endif
+	if (is_sub_uid) {
+		if (sub_uid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
+#ifdef WITH_AUDIT
+			audit_logger (AUDIT_ADD_USER, Prog,
+				"unlocking subordinate user file",
+				user_name, AUDIT_NO_ID,
+				SHADOW_AUDIT_FAILURE);
+#endif
+			/* continue */
+		}
+		sub_uid_locked = false;
+	}
+	if (is_sub_gid) {
+		if (sub_gid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
+#ifdef WITH_AUDIT
+			audit_logger (AUDIT_ADD_USER, Prog,
+				"unlocking subordinate group file",
+				user_name, AUDIT_NO_ID,
+				SHADOW_AUDIT_FAILURE);
+#endif
+			/* continue */
+		}
+		sub_gid_locked = false;
+	}
+ }
+ 
+ /*
+@@ -1487,6 +1564,36 @@
+ 		}
+ 	}
+ #endif
+	if (is_sub_uid) {
+		if (sub_uid_lock () == 0) {
+			fprintf (stderr,
+			         _("%s: cannot lock %s; try again later.\n"),
+			         Prog, sub_uid_dbname ());
+			fail_exit (E_SUB_UID_UPDATE);
+		}
+		sub_uid_locked = true;
+		if (sub_uid_open (O_RDWR) == 0) {
+			fprintf (stderr,
+			         _("%s: cannot open %s\n"),
+			         Prog, sub_uid_dbname ());
+			fail_exit (E_SUB_UID_UPDATE);
+		}
+	}
+	if (is_sub_gid) {
+		if (sub_gid_lock () == 0) {
+			fprintf (stderr,
+			         _("%s: cannot lock %s; try again later.\n"),
+			         Prog, sub_gid_dbname ());
+			fail_exit (E_SUB_GID_UPDATE);
+		}
+		sub_gid_locked = true;
+		if (sub_gid_open (O_RDWR) == 0) {
+			fprintf (stderr,
+			         _("%s: cannot open %s\n"),
+			         Prog, sub_gid_dbname ());
+			fail_exit (E_SUB_GID_UPDATE);
+		}
+	}
+ }
+ 
+ static void open_shadow (void)
+@@ -1733,13 +1840,27 @@
+ #endif
+ 		fail_exit (E_PW_UPDATE);
+ 	}
+	if (is_sub_uid &&
+	    (sub_uid_add(user_name, sub_uid_start, sub_uid_count) == 0)) {
+		fprintf (stderr,
+		         _("%s: failed to prepare the new %s entry\n"),
+		         Prog, sub_uid_dbname ());
+		fail_exit (E_SUB_UID_UPDATE);
+	}
+	if (is_sub_gid &&
+	    (sub_gid_add(user_name, sub_gid_start, sub_gid_count) == 0)) {
+		fprintf (stderr,
+		         _("%s: failed to prepare the new %s entry\n"),
+		         Prog, sub_uid_dbname ());
+		fail_exit (E_SUB_GID_UPDATE);
+	}
+
+ #ifdef WITH_AUDIT
+ 	audit_logger (AUDIT_ADD_USER, Prog,
+ 	              "adding user",
+ 	              user_name, (unsigned int) user_id,
+ 	              SHADOW_AUDIT_SUCCESS);
+ #endif
+-
+ 	/*
+ 	 * Do any group file updates for this user.
+ 	 */
+@@ -1885,6 +2006,8 @@
+ #ifdef SHADOWGRP
+ 	is_shadow_grp = sgr_file_present ();
+ #endif
+	is_sub_uid = sub_uid_file_present ();
+	is_sub_gid = sub_gid_file_present ();
+ 
+ 	get_defaults ();
+ 
+@@ -2035,6 +2158,22 @@
+ 		grp_add ();
+ 	}
+ 
+	if (is_sub_uid) {
+		if (find_new_sub_uids(user_name, &sub_uid_start, &sub_uid_count) < 0) {
+			fprintf (stderr,
+				_("%s: can't find subordinate user range\n"),
+				Prog);
+			fail_exit(E_SUB_UID_UPDATE);
+		}
+	}
+	if (is_sub_gid) {
+		if (find_new_sub_gids(user_name, &sub_gid_start, &sub_gid_count) < 0) {
+			fprintf (stderr,
+				_("%s: can't find subordinate group range\n"),
+				Prog);
+			fail_exit(E_SUB_GID_UPDATE);
+		}
+	}
+ 	usr_update ();
+ 
+ 	if (mflg) {
--- a/debian/patches/userns/08_userns_detect_busy_subids
+++ b/debian/patches/userns/08_userns_detect_busy_subids
@@ -0,0 +1,133 @@
+From ebiederm@xmission.com  Tue Jan 22 09:19:49 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id E0EA3C80F4; Tue, 22 Jan 2013 09:19:49 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=-2.2 required=8.0 tests=BAD_ENC_HEADER,BAYES_00,
+	RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id 1A2C7C80D1
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:19:46 +0000 (UTC)
+Received: from out03.mta.xmission.com ([166.70.13.233])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZzX-00006D-G7; Tue, 22 Jan 2013 02:18:03 -0700
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZzV-0005Zh-Qq; Tue, 22 Jan 2013 02:18:02 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZzN-0004ul-H6; Tue, 22 Jan 2013 02:18:01 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:17:50 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <87y5flpoe9.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX1/ZWJZMWIVV2ekPIrRQjHLl4Oh/kdyWJUw=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 08/11] Add support for detecting busy subordinate user ids
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2078                                        
+Status: RO
+Content-Length: 2655
+Lines: 83
+
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ libmisc/user_busy.c |   18 +++++++++++++-----
+ 1 files changed, 13 insertions(+), 5 deletions(-)
+
+Index: shadow/libmisc/user_busy.c
+===================================================================
+--- shadow.orig/libmisc/user_busy.c	2013-02-01 15:27:52.952080357 -0600
+++ shadow/libmisc/user_busy.c	2013-02-01 15:27:52.948080357 -0600
+@@ -38,11 +38,13 @@
+ #include <stdio.h>
+ #include <sys/types.h>
+ #include <dirent.h>
+#include <fcntl.h>
+ #include "defines.h"
+ #include "prototypes.h"
+#include "subordinateio.h"
+ 
+ #ifdef __linux__
+-static int check_status (const char *sname, uid_t uid);
+static int check_status (const char *name, const char *sname, uid_t uid);
+ static int user_busy_processes (const char *name, uid_t uid);
+ #else				/* !__linux__ */
+ static int user_busy_utmp (const char *name);
+@@ -102,7 +104,7 @@
+ #endif				/* !__linux__ */
+ 
+ #ifdef __linux__
+-static int check_status (const char *sname, uid_t uid)
+static int check_status (const char *name, const char *sname, uid_t uid)
+ {
+ 	/* 40: /proc/xxxxxxxxxx/task/xxxxxxxxxx/status + \0 */
+ 	char status[40];
+@@ -125,7 +127,10 @@
+ 			            &ruid, &euid, &suid) == 3) {
+ 				if (   (ruid == (unsigned long) uid)
+ 				    || (euid == (unsigned long) uid)
+-				    || (suid == (unsigned long) uid)) {
+				    || (suid == (unsigned long) uid)
+				    || have_sub_uids(name, ruid, 1)
+				    || have_sub_uids(name, euid, 1)
+				    || have_sub_uids(name, suid, 1)) {
+ 					(void) fclose (sfile);
+ 					return 1;
+ 				}
+@@ -153,6 +158,8 @@
+ 	struct stat sbroot;
+ 	struct stat sbroot_process;
+ 
+	sub_uid_open (O_RDONLY);
+
+ 	proc = opendir ("/proc");
+ 	if (proc == NULL) {
+ 		perror ("opendir /proc");
+@@ -196,7 +203,7 @@
+ 			continue;
+ 		}
+ 
+-		if (check_status (tmp_d_name, uid) != 0) {
+		if (check_status (name, tmp_d_name, uid) != 0) {
+ 			(void) closedir (proc);
+ 			fprintf (stderr,
+ 			         _("%s: user %s is currently used by process %d\n"),
+@@ -216,7 +223,7 @@
+ 				if (tid == pid) {
+ 					continue;
+ 				}
+-				if (check_status (task_path+6, uid) != 0) {
+				if (check_status (name, task_path+6, uid) != 0) {
+ 					(void) closedir (proc);
+ 					fprintf (stderr,
+ 					         _("%s: user %s is currently used by process %d\n"),
+@@ -231,6 +238,7 @@
+ 	}
+ 
+ 	(void) closedir (proc);
+	sub_uid_close();
+ 	return 0;
+ }
+ #endif				/* __linux__ */
--- a/debian/patches/userns/09_userns_usermod
+++ b/debian/patches/userns/09_userns_usermod
@@ -0,0 +1,536 @@
+From ebiederm@xmission.com  Tue Jan 22 09:20:27 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id 8625BC80F4; Tue, 22 Jan 2013 09:20:27 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=0.1 required=8.0 tests=BAD_ENC_HEADER,BAYES_00
+	autolearn=no version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id 69CACC80D1
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:20:23 +0000 (UTC)
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1Txa08-0000JL-Uo; Tue, 22 Jan 2013 02:18:41 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1TxZzw-0004wm-8g; Tue, 22 Jan 2013 02:18:40 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:18:24 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <87sj5tpodb.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX1/EkNiL4owL54HOscHbdbK8RucFTofOBo8=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 09/11] usermod: Add support for subordinate uids and gids.
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2079                                        
+Status: O
+Content-Length: 15455
+Lines: 491
+
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ man/usermod.8.xml |   80 +++++++++++++++++
+ src/usermod.c     |  255 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 332 insertions(+), 3 deletions(-)
+
+Index: shadow/man/usermod.8.xml
+===================================================================
+--- shadow.orig/man/usermod.8.xml	2013-02-01 15:27:53.240080352 -0600
+++ shadow/man/usermod.8.xml	2013-02-01 15:27:53.232080353 -0600
+@@ -391,6 +391,86 @@
+       </varlistentry>
+       <varlistentry>
+ 	<term>
+	  <option>-v</option>, <option>--add-sub-uids</option>
+	  <replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>
+	</term>
+	<listitem>
+	  <para>
+	    Add a range of subordinate uids to the users account. 
+	  </para>
+	  <para>
+	    This option may be specified multiple times to add multiple ranges to a users account.
+	  </para>
+	  <para>
+	     No checks will be performed with regard to
+	     <option>SUB_UID_MIN</option>, <option>SUB_UID_MAX</option>, or
+	     <option>SUB_UID_COUNT</option> from /etc/login.defs.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  <option>-V</option>, <option>--del-sub-uids</option>
+	  <replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>
+	</term>
+	<listitem>
+	  <para>
+	    Remove a range of subordinate uids from the users account.
+	  </para>
+	  <para>
+	    This option may be specified multiple times to remove multiple ranges to a users account.
+	    When both <option>--del-sub-uids</option> and <option>--add-sub-uids</option> are specified
+	    remove of all subordinate uid ranges happens before any subordinate uid ranges are added.
+	  </para>
+	  <para>
+	     No checks will be performed with regard to
+	     <option>SUB_UID_MIN</option>, <option>SUB_UID_MAX</option>, or
+	     <option>SUB_UID_COUNT</option> from /etc/login.defs.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  <option>-w</option>, <option>--add-sub-gids</option>
+	  <replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>
+	</term>
+	<listitem>
+	  <para>
+	    Add a range of subordinate gids to the users account.
+	  </para>
+	  <para>
+	    This option may be specified multiple times to add multiple ranges to a users account.
+	  </para>
+	  <para>
+	     No checks will be performed with regard to
+	     <option>SUB_GID_MIN</option>, <option>SUB_GID_MAX</option>, or
+	     <option>SUB_GID_COUNT</option> from /etc/login.defs.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  <option>-W</option>, <option>--del-sub-gids</option>
+	  <replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>
+	</term>
+	<listitem>
+	  <para>
+	    Remove a range of subordinate gids from the users account.
+	  </para>
+	  <para>
+	    This option may be specified multiple times to remove multiple ranges to a users account.
+	    When both <option>--del-sub-gids</option> and <option>--add-sub-gids</option> are specified
+	    remove of all subordinate gid ranges happens before any subordinate gid ranges are added.
+	  </para>
+	  <para>
+	     No checks will be performed with regard to
+	     <option>SUB_GID_MIN</option>, <option>SUB_GID_MAX</option>, or
+	     <option>SUB_GID_COUNT</option> from /etc/login.defs.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+ 	  <option>-Z</option>, <option>--selinux-user</option>
+ 	  <replaceable>SEUSER</replaceable>
+ 	</term>
+Index: shadow/src/usermod.c
+===================================================================
+--- shadow.orig/src/usermod.c	2013-02-01 15:27:53.240080352 -0600
+++ shadow/src/usermod.c	2013-02-01 15:27:53.236080353 -0600
+@@ -63,6 +63,7 @@
+ #include "sgroupio.h"
+ #endif
+ #include "shadowio.h"
+#include "subordinateio.h"
+ #ifdef WITH_TCB
+ #include "tcbfuncs.h"
+ #endif
+@@ -86,6 +87,8 @@
+ /* #define E_NOSPACE	11	   insufficient space to move home dir */
+ #define E_HOMEDIR	12	/* unable to complete home dir move */
+ #define E_SE_UPDATE	13	/* can't update SELinux user mapping */
+#define E_SUB_UID_UPDATE 16	/* can't update the subordinate uid file */
+#define E_SUB_GID_UPDATE 18	/* can't update the subordinate gid file */
+ #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
+ /*
+  * Global variables
+@@ -133,7 +136,11 @@
+     Zflg = false,		/* new selinux user */
+ #endif
+     uflg = false,		/* specify new user ID */
+-    Uflg = false;		/* unlock the password */
+    Uflg = false,		/* unlock the password */
+    vflg = false,		/*    add subordinate uids */
+    Vflg = false,		/* delete subordinate uids */
+    wflg = false,		/*    add subordinate gids */
+    Wflg = false;		/* delete subordinate gids */
+ 
+ static bool is_shadow_pwd;
+ 
+@@ -141,12 +148,17 @@
+ static bool is_shadow_grp;
+ #endif
+ 
+static bool is_sub_uid = false;
+static bool is_sub_gid = false;
+
+ static bool pw_locked  = false;
+ static bool spw_locked = false;
+ static bool gr_locked  = false;
+ #ifdef SHADOWGRP
+ static bool sgr_locked = false;
+ #endif
+static bool sub_uid_locked = false;
+static bool sub_gid_locked = false;
+ 
+ 
+ /* local function prototypes */
+@@ -302,6 +314,69 @@
+ 	return 0;
+ }
+ 
+struct ulong_range
+{
+	unsigned long first;
+	unsigned long last;
+};
+
+static struct ulong_range getulong_range(const char *str)
+{
+	struct ulong_range result = { .first = ULONG_MAX, .last = 0 };
+	unsigned long long first, last;
+	char *pos;
+
+	errno = 0;
+	first = strtoll(str, &pos, 10);
+	if (('\0' == *str) || ('-' != *pos ) || (ERANGE == errno) ||
+	    (first != (unsigned long int)first))
+		goto out;
+
+	errno = 0;
+	last = strtoul(pos + 1, &pos, 10);
+	if (('\0' != *pos ) || (ERANGE == errno) ||
+	    (last != (unsigned long int)last))
+		goto out;
+
+	if (first > last)
+		goto out;
+
+	result.first = (unsigned long int)first;
+	result.last = (unsigned long int)last;
+out:
+	return result;
+	
+}
+
+struct ulong_range_list_entry {
+	struct ulong_range_list_entry *next;
+	struct ulong_range range;
+};
+
+static struct ulong_range_list_entry *add_sub_uids = NULL, *del_sub_uids = NULL;
+static struct ulong_range_list_entry *add_sub_gids = NULL, *del_sub_gids = NULL;
+
+static int prepend_range(const char *str, struct ulong_range_list_entry **head)
+{
+	struct ulong_range range;
+	struct ulong_range_list_entry *entry;
+	range = getulong_range(str);
+	if (range.first > range.last)
+		return 0;
+
+	entry = malloc(sizeof(*entry));
+	if (!entry) {
+		fprintf (stderr,
+			_("%s: failed to allocate memory: %s\n"),
+			Prog, strerror (errno));
+		return 0;
+	}
+	entry->next = *head;
+	entry->range = range;
+	*head = entry;
+	return 1;
+}
+
+ /*
+  * usage - display usage message and exit
+  */
+@@ -334,6 +409,10 @@
+ 	(void) fputs (_("  -s, --shell SHELL             new login shell for the user account\n"), usageout);
+ 	(void) fputs (_("  -u, --uid UID                 new UID for the user account\n"), usageout);
+ 	(void) fputs (_("  -U, --unlock                  unlock the user account\n"), usageout);
+	(void) fputs (_("  -v, --add-subuids FIRST-LAST  add range of subordinate uids\n"), usageout);
+	(void) fputs (_("  -V, --del-subuids FIRST-LAST  remvoe range of subordinate uids\n"), usageout);
+	(void) fputs (_("  -w, --add-subgids FIRST-LAST  add range of subordinate gids\n"), usageout);
+	(void) fputs (_("  -W, --del-subgids FIRST-LAST  remvoe range of subordinate gids\n"), usageout);
+ #ifdef WITH_SELINUX
+ 	(void) fputs (_("  -Z, --selinux-user SEUSER     new SELinux user mapping for the user account\n"), usageout);
+ #endif				/* WITH_SELINUX */
+@@ -590,6 +669,20 @@
+ 			/* continue */
+ 		}
+ 	}
+	if (sub_uid_locked) {
+		if (sub_uid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
+			/* continue */
+		}
+	}
+	if (sub_gid_locked) {
+		if (sub_gid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
+			/* continue */
+		}
+	}
+ 
+ #ifdef WITH_AUDIT
+ 	audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
+@@ -889,6 +982,10 @@
+ 			{"shell",        required_argument, NULL, 's'},
+ 			{"uid",          required_argument, NULL, 'u'},
+ 			{"unlock",       no_argument,       NULL, 'U'},
+			{"add-subuids",  required_argument, NULL, 'v'},
+			{"del-subuids",  required_argument, NULL, 'V'},
+ 			{"add-subgids",  required_argument, NULL, 'w'},
+ 			{"del-subgids",  required_argument, NULL, 'W'},
+ #ifdef WITH_SELINUX
+ 			{"selinux-user", required_argument, NULL, 'Z'},
+ #endif				/* WITH_SELINUX */
+@@ -1018,6 +1115,41 @@
+ 			case 'U':
+ 				Uflg = true;
+ 				break;
+			case 'v':
+				if (prepend_range (optarg, &add_sub_uids) == 0) {
+					fprintf (stderr,
+						_("%s: invalid subordinate uid range '%s'\n"),
+						Prog, optarg);
+					exit(E_BAD_ARG);
+				}
+				vflg = true;
+				break;
+			case 'V':
+				if (prepend_range (optarg, &del_sub_uids) == 0) {
+					fprintf (stderr,
+						_("%s: invalid subordinate uid range '%s'\n"),
+						Prog, optarg);
+					exit(E_BAD_ARG);
+				}
+				Vflg = true;
+				break;
+			case 'w':
+				if (prepend_range (optarg, &add_sub_gids) == 0) {
+					fprintf (stderr,
+						_("%s: invalid subordinate gid range '%s'\n"),
+						Prog, optarg);
+					exit(E_BAD_ARG);
+				}
+				wflg = true;
+			case 'W':
+				if (prepend_range (optarg, &del_sub_gids) == 0) {
+					fprintf (stderr,
+						_("%s: invalid subordinate gid range '%s'\n"),
+						Prog, optarg);
+					exit(E_BAD_ARG);
+				}
+				Wflg = true;
+				break;
+ #ifdef WITH_SELINUX
+ 			case 'Z':
+ 				if (is_selinux_enabled () > 0) {
+@@ -1170,6 +1302,7 @@
+ 
+ 	if (!(Uflg || uflg || sflg || pflg || mflg || Lflg ||
+ 	      lflg || Gflg || gflg || fflg || eflg || dflg || cflg
+	      || vflg || Vflg || wflg || Wflg
+ #ifdef WITH_SELINUX
+ 	      || Zflg
+ #endif				/* WITH_SELINUX */
+@@ -1200,6 +1333,7 @@
+ 		         Prog, (unsigned long) user_newid);
+ 		exit (E_UID_IN_USE);
+ 	}
+
+ }
+ 
+ /*
+@@ -1248,6 +1382,10 @@
+ 				         sgr_dbname ()));
+ 				fail_exit (E_GRP_UPDATE);
+ 			}
+		}
+#endif
+#ifdef SHADOWGRP
+		if (is_shadow_grp) {
+ 			if (sgr_unlock () == 0) {
+ 				fprintf (stderr,
+ 				         _("%s: failed to unlock %s\n"),
+@@ -1296,6 +1434,33 @@
+ 	sgr_locked = false;
+ #endif
+ 
+	if (vflg || Vflg) {
+		if (!is_sub_uid || (sub_uid_close () == 0)) {
+			fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_uid_dbname ()));
+			fail_exit (E_SUB_UID_UPDATE);
+		}
+		if (!is_sub_uid || (sub_uid_unlock () == 0)) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
+			/* continue */
+		}
+		sub_uid_locked = false;
+	}
+	if (wflg || Wflg) {
+		if (!is_sub_gid || (sub_gid_close () == 0)) {
+			fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_gid_dbname ()));
+			fail_exit (E_SUB_GID_UPDATE);
+		}
+		if (!is_sub_gid || (sub_gid_unlock () == 0)) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
+			/* continue */
+		}
+		sub_gid_locked = false;
+	}
+
+ 	/*
+ 	 * Close the DBM and/or flat files
+ 	 */
+@@ -1375,6 +1540,36 @@
+ 		}
+ #endif
+ 	}
+	if (vflg || Vflg) {
+		if (!is_sub_uid || (sub_uid_lock () == 0)) {
+			fprintf (stderr,
+			         _("%s: cannot lock %s; try again later.\n"),
+			         Prog, sub_uid_dbname ());
+			fail_exit (E_SUB_UID_UPDATE);
+		}
+		sub_uid_locked = true;
+		if (!is_sub_uid || (sub_uid_open (O_RDWR) == 0)) {
+			fprintf (stderr,
+			         _("%s: cannot open %s\n"),
+			         Prog, sub_uid_dbname ());
+			fail_exit (E_SUB_UID_UPDATE);
+		}
+	}
+	if (wflg || Wflg) {
+		if (!is_sub_gid || (sub_gid_lock () == 0)) {
+			fprintf (stderr,
+			         _("%s: cannot lock %s; try again later.\n"),
+			         Prog, sub_gid_dbname ());
+			fail_exit (E_SUB_GID_UPDATE);
+		}
+		sub_gid_locked = true;
+		if (!is_sub_gid || (sub_gid_open (O_RDWR) == 0)) {
+			fprintf (stderr,
+			         _("%s: cannot open %s\n"),
+			         Prog, sub_gid_dbname ());
+			fail_exit (E_SUB_GID_UPDATE);
+		}
+	}
+ }
+ 
+ /*
+@@ -1476,6 +1671,58 @@
+ 			fail_exit (E_PW_UPDATE);
+ 		}
+ 	}
+	if (Vflg) {
+		struct ulong_range_list_entry *ptr;
+		for (ptr = del_sub_uids; ptr != NULL; ptr = ptr->next) {
+			unsigned long count = ptr->range.last - ptr->range.first + 1;
+			if (sub_uid_remove(user_name, ptr->range.first, count) == 0) {
+				fprintf (stderr,
+					_("%s: failed to remove uid range %lu-%lu from '%s'\n"),
+					Prog, ptr->range.first, ptr->range.last, 
+					sub_uid_dbname ());
+				fail_exit (E_SUB_UID_UPDATE);
+			}
+		}
+	}
+	if (vflg) {
+		struct ulong_range_list_entry *ptr;
+		for (ptr = add_sub_uids; ptr != NULL; ptr = ptr->next) {
+			unsigned long count = ptr->range.last - ptr->range.first + 1;
+			if (sub_uid_add(user_name, ptr->range.first, count) == 0) {
+				fprintf (stderr,
+					_("%s: failed to add uid range %lu-%lu from '%s'\n"),
+					Prog, ptr->range.first, ptr->range.last, 
+					sub_uid_dbname ());
+				fail_exit (E_SUB_UID_UPDATE);
+			}
+		}
+	}
+	if (Wflg) {
+		struct ulong_range_list_entry *ptr;
+		for (ptr = del_sub_gids; ptr != NULL; ptr = ptr->next) {
+			unsigned long count = ptr->range.last - ptr->range.first + 1;
+			if (sub_gid_remove(user_name, ptr->range.first, count) == 0) {
+				fprintf (stderr,
+					_("%s: failed to remove gid range %lu-%lu from '%s'\n"),
+					Prog, ptr->range.first, ptr->range.last, 
+					sub_gid_dbname ());
+				fail_exit (E_SUB_GID_UPDATE);
+			}
+		}
+	}
+	if (wflg) {
+		struct ulong_range_list_entry *ptr;
+		for (ptr = add_sub_gids; ptr != NULL; ptr = ptr->next) {
+			unsigned long count = ptr->range.last - ptr->range.first + 1;
+			if (sub_gid_add(user_name, ptr->range.first, count) == 0) {
+				fprintf (stderr,
+					_("%s: failed to add gid range %lu-%lu from '%s'\n"),
+					Prog, ptr->range.first, ptr->range.last, 
+					sub_gid_dbname ());
+				fail_exit (E_SUB_GID_UPDATE);
+			}
+		}
+	}
+ }
+ 
+ /*
+@@ -1811,6 +2058,8 @@
+ #ifdef SHADOWGRP
+ 	is_shadow_grp = sgr_file_present ();
+ #endif
+	is_sub_uid = sub_uid_file_present ();
+	is_sub_gid = sub_gid_file_present ();
+ 
+ 	process_flags (argc, argv);
+ 
+@@ -1818,7 +2067,7 @@
+ 	 * The home directory, the username and the user's UID should not
+ 	 * be changed while the user is logged in.
+ 	 */
+-	if (   (uflg || lflg || dflg)
+	if (   (uflg || lflg || dflg || Vflg || Wflg)
+ 	    && (user_busy (user_name, user_id) != 0)) {
+ 		exit (E_USER_BUSY);
+ 	}
+@@ -1871,7 +2120,7 @@
+ 	 */
+ 	open_files ();
+ 	if (   cflg || dflg || eflg || fflg || gflg || Lflg || lflg || pflg
+-	    || sflg || uflg || Uflg) {
+	    || sflg || uflg || Uflg || vflg || Vflg || wflg || Wflg) {
+ 		usr_update ();
+ 	}
+ 	if (Gflg || lflg) {
--- a/debian/patches/userns/10_userns_newusers
+++ b/debian/patches/userns/10_userns_newusers
@@ -0,0 +1,256 @@
+From ebiederm@xmission.com  Tue Jan 22 09:21:21 2013
+Return-Path: <ebiederm@xmission.com>
+X-Original-To: serge@hallyn.com
+Delivered-To: serge@hallyn.com
+Received: by mail.hallyn.com (Postfix, from userid 5001)
+	id ADE59C80F5; Tue, 22 Jan 2013 09:21:21 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail
+X-Spam-Level: 
+X-Spam-Status: No, score=-2.2 required=8.0 tests=BAD_ENC_HEADER,BAYES_00,
+	RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1
+Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232])
+	(using TLSv1 with cipher AES256-SHA (256/256 bits))
+	(No client certificate requested)
+	by mail.hallyn.com (Postfix) with ESMTPS id D56AEC80DB
+	for <serge@hallyn.com>; Tue, 22 Jan 2013 09:21:17 +0000 (UTC)
+Received: from out03.mta.xmission.com ([166.70.13.233])
+	by out02.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1Txa11-0000bo-MQ; Tue, 22 Jan 2013 02:19:35 -0700
+Received: from in02.mta.xmission.com ([166.70.13.52])
+	by out03.mta.xmission.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1Txa11-0005wx-1p; Tue, 22 Jan 2013 02:19:35 -0700
+Received: from c-98-207-153-68.hsd1.ca.comcast.net ([98.207.153.68] helo=eric-ThinkPad-X220.xmission.com)
+	by in02.mta.xmission.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
+	(Exim 4.76)
+	(envelope-from <ebiederm@xmission.com>)
+	id 1Txa0y-000519-2O; Tue, 22 Jan 2013 02:19:34 -0700
+From: ebiederm@xmission.com (Eric W. Biederman)
+To: Nicolas =?utf-8?Q?Fran=C3=A7ois?= <nicolas.francois@centraliens.net>
+Cc: <Pkg-shadow-devel@lists.alioth.debian.org>,  Linux Containers <containers@lists.linux-foundation.org>,  "Michael Kerrisk \(man-pages\)" <mtk.manpages@gmail.com>,  "Serge E. Hallyn" <serge@hallyn.com>
+References: <87d2wxshu0.fsf@xmission.com>
+Date: Tue, 22 Jan 2013 01:19:28 -0800
+In-Reply-To: <87d2wxshu0.fsf@xmission.com> (Eric W. Biederman's message of
+	"Tue, 22 Jan 2013 01:11:19 -0800")
+Message-ID: <87k3r5pobj.fsf@xmission.com>
+User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux)
+MIME-Version: 1.0
+Content-Type: text/plain
+X-XM-AID: U2FsdGVkX1+qhualZ5pxk+DVqanIJA7JrJwlPXicL8c=
+X-SA-Exim-Connect-IP: 98.207.153.68
+X-SA-Exim-Mail-From: ebiederm@xmission.com
+Subject: [PATCH 10/11] newusers: Add support for assiging subordinate uids and gids.
+X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700)
+X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com)
+X-UID: 2080                                        
+Status: O
+Content-Length: 5597
+Lines: 206
+
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ src/newusers.c |  124 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 files changed, 124 insertions(+), 0 deletions(-)
+
+Index: shadow/src/newusers.c
+===================================================================
+--- shadow.orig/src/newusers.c	2013-02-01 15:27:53.548080347 -0600
+++ shadow/src/newusers.c	2013-02-01 15:27:53.540080347 -0600
+@@ -65,6 +65,7 @@
+ #include "pwio.h"
+ #include "sgroupio.h"
+ #include "shadowio.h"
+#include "subordinateio.h"
+ #include "chkname.h"
+ 
+ /*
+@@ -82,6 +83,8 @@
+ #endif				/* USE_SHA_CRYPT */
+ #endif				/* !USE_PAM */
+ 
+static bool is_sub_uid = false;
+static bool is_sub_gid = false;
+ static bool is_shadow;
+ #ifdef SHADOWGRP
+ static bool is_shadow_grp;
+@@ -90,6 +93,8 @@
+ static bool pw_locked = false;
+ static bool gr_locked = false;
+ static bool spw_locked = false;
+static bool sub_uid_locked = false;
+static bool sub_gid_locked = false;
+ 
+ /* local function prototypes */
+ static void usage (int status);
+@@ -178,6 +183,20 @@
+ 		}
+ 	}
+ #endif
+	if (sub_uid_locked) {
+		if (sub_uid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
+			/* continue */
+		}
+	}
+	if (sub_gid_locked) {
+		if (sub_gid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
+			/* continue */
+		}
+	}
+ 
+ 	exit (code);
+ }
+@@ -732,6 +751,24 @@
+ 		sgr_locked = true;
+ 	}
+ #endif
+	if (is_sub_uid) {
+		if (sub_uid_lock () == 0) {
+			fprintf (stderr,
+			         _("%s: cannot lock %s; try again later.\n"),
+			         Prog, sub_uid_dbname ());
+			fail_exit (EXIT_FAILURE);
+		}
+		sub_uid_locked = true;
+	}
+	if (is_sub_gid) {
+		if (sub_gid_lock () == 0) {
+			fprintf (stderr,
+			         _("%s: cannot lock %s; try again later.\n"),
+			         Prog, sub_gid_dbname ());
+			fail_exit (EXIT_FAILURE);
+		}
+		sub_gid_locked = true;
+	}
+ 
+ 	if (pw_open (O_RDWR) == 0) {
+ 		fprintf (stderr, _("%s: cannot open %s\n"), Prog, pw_dbname ());
+@@ -751,6 +788,22 @@
+ 		fail_exit (EXIT_FAILURE);
+ 	}
+ #endif
+	if (is_sub_uid) {
+		if (sub_uid_open (O_RDWR) == 0) {
+			fprintf (stderr,
+			         _("%s: cannot open %s\n"),
+			         Prog, sub_uid_dbname ());
+			fail_exit (EXIT_FAILURE);
+		}
+	}
+	if (is_sub_gid) {
+		if (sub_gid_open (O_RDWR) == 0) {
+			fprintf (stderr,
+			         _("%s: cannot open %s\n"),
+			         Prog, sub_gid_dbname ());
+			fail_exit (EXIT_FAILURE);
+		}
+	}
+ }
+ 
+ /*
+@@ -795,6 +848,19 @@
+ 		SYSLOG ((LOG_ERR, "failure while writing changes to %s", gr_dbname ()));
+ 		fail_exit (EXIT_FAILURE);
+ 	}
+	if (is_sub_uid  && (sub_uid_close () == 0)) {
+		fprintf (stderr,
+		         _("%s: failure while writing changes to %s\n"), Prog, sub_uid_dbname ());
+		SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_uid_dbname ()));
+		fail_exit (EXIT_FAILURE);
+	}
+	if (is_sub_gid  && (sub_gid_close () == 0)) {
+		fprintf (stderr,
+		         _("%s: failure while writing changes to %s\n"), Prog, sub_gid_dbname ());
+		SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_gid_dbname ()));
+		fail_exit (EXIT_FAILURE);
+	}
+
+ 	if (gr_unlock () == 0) {
+ 		fprintf (stderr,
+ 		         _("%s: failed to unlock %s\n"),
+@@ -823,6 +889,22 @@
+ 		sgr_locked = false;
+ 	}
+ #endif
+	if (is_sub_uid) {
+		if (sub_uid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
+			/* continue */
+		}
+		sub_uid_locked = false;
+	}
+	if (is_sub_gid) {
+		if (sub_gid_unlock () == 0) {
+			fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
+			SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
+			/* continue */
+		}
+		sub_gid_locked = false;
+	}
+ }
+ 
+ int main (int argc, char **argv)
+@@ -864,6 +946,8 @@
+ #ifdef SHADOWGRP
+ 	is_shadow_grp = sgr_file_present ();
+ #endif
+	is_sub_uid = sub_uid_file_present ();
+	is_sub_gid = sub_gid_file_present ();
+ 
+ 	open_files ();
+ 
+@@ -1044,6 +1128,46 @@
+ 			errors++;
+ 			continue;
+ 		}
+
+		/*
+		 * Add subordinate uids if the user does not have them.
+		 */
+		if (is_sub_uid && !sub_uid_assigned(fields[0])) {
+			uid_t sub_uid_start = 0;
+			unsigned long sub_uid_count = 0;
+			if (find_new_sub_uids(fields[0], &sub_uid_start, &sub_uid_count) == 0) {
+				if (sub_uid_add(fields[0], sub_uid_start, sub_uid_count) == 0) {
+					fprintf (stderr,
+						_("%s: failed to prepare new %s entry\n"),
+						Prog, sub_uid_dbname ());
+				}
+			} else {
+				fprintf (stderr,
+					_("%s: can't find subordinate user range\n"),
+					Prog);
+				errors++;
+			}
+		}
+	
+		/*
+		 * Add subordinate gids if the user does not have them.
+		 */
+		if (is_sub_gid && !sub_gid_assigned(fields[0])) {
+			gid_t sub_gid_start = 0;
+			unsigned long sub_gid_count = 0;
+			if (find_new_sub_gids(fields[0], &sub_gid_start, &sub_gid_count) == 0) {
+				if (sub_gid_add(fields[0], sub_gid_start, sub_gid_count) == 0) {
+					fprintf (stderr,
+						_("%s: failed to prepare new %s entry\n"),
+						Prog, sub_uid_dbname ());
+				}
+			} else {
+				fprintf (stderr,
+					_("%s: can't find subordinate group range\n"),
+					Prog);
+				errors++;
+			}
+		}
+ 	}
+ 
+ 	/*
--- a/debian/patches/userns/11_userns_newxidmap
+++ b/debian/patches/userns/11_userns_newxidmap
--- a/debian/patches/userns/12_userns_selinuxlibs
+++ b/debian/patches/userns/12_userns_selinuxlibs
@@ -0,0 +1,13 @@
+Index: shadow-4.1.5.1/src/Makefile.am
+===================================================================
+--- shadow-4.1.5.1.orig/src/Makefile.am	2013-02-04 11:56:40.485335430 -0600
+++ shadow-4.1.5.1/src/Makefile.am	2013-02-04 11:57:49.525334261 -0600
+@@ -80,6 +80,8 @@
+ endif
+ 
+ chage_LDADD    = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
+newuidmap_LDADD    = $(LDADD) $(LIBSELINUX)
+newgidmap_LDADD    = $(LDADD) $(LIBSELINUX)
+ chfn_LDADD     = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
+ chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBSELINUX) $(LIBCRYPT)
+ chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
--- a/debian/patches/userns/13_subordinate_parse_static_buf
+++ b/debian/patches/userns/13_subordinate_parse_static_buf
@@ -0,0 +1,23 @@
+Description: subordinateio: Fix subordinate_parse to have an internal static buffer
+ subordinate_parse is supposed to return a static structure that
+ represents one line in /etc/subuid or /etc/subgid.  I goofed and
+ failed to make the variable rangebuf that holds the username of
+ in the returned structure static.
+ .
+ Add this missing static specification.
+Author: <Eric W. Biederman" <ebiederm@xmission.com>
+Origin: upstream
+Forwarded: no
+Index: shadow-4.1.5.1/lib/subordinateio.c
+===================================================================
+--- shadow-4.1.5.1.orig/lib/subordinateio.c	2013-02-04 11:56:40.265335433 -0600
+++ shadow-4.1.5.1/lib/subordinateio.c	2013-02-04 12:32:46.653298752 -0600
+@@ -48,7 +48,7 @@
+ static void *subordinate_parse (const char *line)
+ {
+ 	static struct subordinate_range range;
+-	char rangebuf[1024];
+	static char rangebuf[1024];
+ 	int i;
+ 	char *cp;
+ 	char *fields[NFIELDS];
--- a/debian/patches/userns/14_fix_getopt
+++ b/debian/patches/userns/14_fix_getopt
@@ -0,0 +1,24 @@
+Index: shadow-userns/src/usermod.c
+===================================================================
+--- shadow-userns.orig/src/usermod.c	2013-02-05 16:35:10.608485591 +0000
+++ shadow-userns/src/usermod.c	2013-02-05 17:16:20.540485591 +0000
+@@ -993,9 +993,9 @@
+ 		};
+ 		while ((c = getopt_long (argc, argv,
+ #ifdef WITH_SELINUX
+-			                 "ac:d:e:f:g:G:hl:Lmop:R:s:u:UZ:",
+			                 "ac:d:e:f:g:G:hl:Lmop:R:s:u:UZ:v:w:V:W:",
+ #else				/* !WITH_SELINUX */
+-			                 "ac:d:e:f:g:G:hl:Lmop:R:s:u:U",
+			                 "ac:d:e:f:g:G:hl:Lmop:R:s:u:Uv:w:V:W:",
+ #endif				/* !WITH_SELINUX */
+ 			                 long_options, NULL)) != -1) {
+ 			switch (c) {
+@@ -1141,6 +1141,7 @@
+ 					exit(E_BAD_ARG);
+ 				}
+ 				wflg = true;
+                break;
+ 			case 'W':
+ 				if (prepend_range (optarg, &del_sub_gids) == 0) {
+ 					fprintf (stderr,
--- a/debian/patches/userns/16_add-argument-sanity-checking.patch
+++ b/debian/patches/userns/16_add-argument-sanity-checking.patch
@@ -0,0 +1,80 @@
+From df3c8c1f7f47ceff607595067458f1d8e53eaab8 Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serge.hallyn@ubuntu.com>
+Date: Fri, 21 Jun 2013 11:47:36 -0500
+Subject: [PATCH 1/1] userns: add argument sanity checking
+
+In find_new_sub_{u,g}ids, check for min, count and max values.
+
+In idmapping.c:get_map_ranges(), make sure that the value passed
+in for ranges did not overflow.  Couldn't happen with the current
+code, but this is a sanity check for any future potential mis-uses.
+
+Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
+---
+ libmisc/find_new_sub_gids.c |  8 ++++++++
+ libmisc/find_new_sub_uids.c |  8 ++++++++
+ libmisc/idmapping.c         | 10 ++++++++++
+ 3 files changed, 26 insertions(+)
+
+diff --git a/libmisc/find_new_sub_gids.c b/libmisc/find_new_sub_gids.c
+index 68046ac..fd44978 100644
+--- a/libmisc/find_new_sub_gids.c
+++ b/libmisc/find_new_sub_gids.c
+@@ -58,6 +58,14 @@ int find_new_sub_gids (const char *owner,
+ 	max = getdef_ulong ("SUB_GID_MAX", 600100000UL);
+ 	count = getdef_ulong ("SUB_GID_COUNT", 10000);
+ 
+	if (min >= max || count >= max || (min + count) >= max) {
+		(void) fprintf (stderr,
+				_("%s: Invalid configuration: SUB_GID_MIN (%lu),"
+				  " SUB_GID_MAX (%lu), SUB_GID_COUNT (%lu)\n"),
+			Prog, min, max, count);
+		return -1;
+	}
+
+ 	/* Is there a preferred range that works? */
+ 	if ((*range_count != 0) &&
+ 	    (*range_start >= min) &&
+diff --git a/libmisc/find_new_sub_uids.c b/libmisc/find_new_sub_uids.c
+index f1720f9..b608c59 100644
+--- a/libmisc/find_new_sub_uids.c
+++ b/libmisc/find_new_sub_uids.c
+@@ -58,6 +58,14 @@ int find_new_sub_uids (const char *owner,
+ 	max = getdef_ulong ("SUB_UID_MAX", 600100000UL);
+ 	count = getdef_ulong ("SUB_UID_COUNT", 10000);
+ 
+	if (min >= max || count >= max || (min + count) >= max) {
+		(void) fprintf (stderr,
+				_("%s: Invalid configuration: SUB_UID_MIN (%lu),"
+				  " SUB_UID_MAX (%lu), SUB_UID_COUNT (%lu)\n"),
+			Prog, min, max, count);
+		return -1;
+	}
+
+ 	/* Is there a preferred range that works? */
+ 	if ((*range_count != 0) &&
+ 	    (*range_start >= min) &&
+diff --git a/libmisc/idmapping.c b/libmisc/idmapping.c
+index cb9e898..4147796 100644
+--- a/libmisc/idmapping.c
+++ b/libmisc/idmapping.c
+@@ -41,6 +41,16 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)
+ 	struct map_range *mappings, *mapping;
+ 	int idx, argidx;
+ 
+	if (ranges < 0 || argc < 0) {
+		fprintf(stderr, "%s: error calculating number of arguments\n", Prog);
+		return NULL;
+	}
+
+	if (ranges != ((argc - 2) + 2) / 3) {
+		fprintf(stderr, "%s: ranges: %u is wrong for argc: %d\n", Prog, ranges, argc);
+		return NULL;
+	}
+
+ 	if ((ranges * 3) > argc) {
+ 		fprintf(stderr, "ranges: %u argc: %d\n",
+ 			ranges, argc);
+-- 
+1.8.1.2
+
--- a/debian/patches/userns/manpagetypo
+++ b/debian/patches/userns/manpagetypo
@@ -0,0 +1,26 @@
+Index: shadow/man/subgid.5.xml
+===================================================================
+--- shadow.orig/man/subgid.5.xml	2013-03-06 15:19:23.848386200 -0600
+++ shadow/man/subgid.5.xml	2013-03-06 15:19:51.240386816 -0600
+@@ -104,7 +104,7 @@
+ 	<refentrytitle>subuid</refentrytitle><manvolnum>5</manvolnum>
+       </citerefentry>,
+       <citerefentry>
+-	<refentrytitle>logindefs</refentrytitle><manvolnum>5</manvolnum>
+	<refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum>
+       </citerefentry>,
+       <citerefentry>
+ 	<refentrytitle>newuidmap</refentrytitle><manvolnum>1</manvolnum>
+Index: shadow/man/subuid.5.xml
+===================================================================
+--- shadow.orig/man/subuid.5.xml	2013-03-06 15:19:09.660385881 -0600
+++ shadow/man/subuid.5.xml	2013-03-06 15:19:44.956386675 -0600
+@@ -104,7 +104,7 @@
+ 	<refentrytitle>subgid</refentrytitle><manvolnum>5</manvolnum>
+       </citerefentry>,
+       <citerefentry>
+-	<refentrytitle>logindefs</refentrytitle><manvolnum>5</manvolnum>
+	<refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum>
+       </citerefentry>,
+       <citerefentry>
+ 	<refentrytitle>newuidmap</refentrytitle><manvolnum>1</manvolnum>
--- a/debian/rules
+++ b/debian/rules
@@ -3,10 +3,10 @@

 DEB_HOST_ARCH_OS := $(shell dpkg-architecture -qDEB_HOST_ARCH_OS)

+export DEB_BUILD_HARDENING=1
+
 # Enable PIE, BINDNOW, and possible future flags.
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
-DPKG_EXPORT_BUILDFLAGS = 1
-include /usr/share/dpkg/buildflags.mk

 # Call autoreconf since we need to regenerate all the autofoo files
 include /usr/share/cdbs/1/rules/autoreconf.mk
@@ -21,18 +21,7 @@ DEB_DESTDIR=$(CURDIR)/debian/tmp
 include /usr/share/cdbs/1/class/autotools.mk

 # Adds extra options when calling the configure script:
-DEB_CONFIGURE_EXTRA_FLAGS := --disable-shared \
-	--without-libcrack \
-	--mandir=/usr/share/man \
-	--with-libpam \
-	--enable-shadowgrp \
-	--enable-man \
-	--disable-account-tools-setuid \
-	--with-group-name-max-length=32 \
-	--without-acl \
-	--without-attr \
-	--without-tcb \
-	 SHELL=/bin/sh
+DEB_CONFIGURE_EXTRA_FLAGS := --disable-shared --without-libcrack --mandir=/usr/share/man --with-libpam --enable-shadowgrp --enable-man --disable-account-tools-setuid --with-group-name-max-length=32 --without-acl --without-attr --without-tcb
 ifneq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
  DEB_CONFIGURE_EXTRA_FLAGS += --host=$(DEB_HOST_GNU_TYPE)
 endif
@@ -45,11 +34,9 @@ binary-install/login::
 ifeq ($(DEB_HOST_ARCH_OS),hurd)
 	# /bin/login is provided by the hurd package.
 	rm -f debian/login/bin/login
-endif
-ifneq ($(DEB_HOST_ARCH_OS),linux)
-	sed -i 's/session    optional   pam_keyinit.so/# Linux only # session    optional   pam_keyinit.so/' debian/login.pam
 endif
 	dh_installpam -p login
+	dh_installpam -p login --name=su
 	install -c -m 444 debian/login.defs debian/login/etc/login.defs
 	install -c -m 444 debian/securetty.$(DEB_HOST_ARCH_OS) debian/login/etc/securetty
 	dh_lintian -p login
@@ -80,6 +67,7 @@ binary-predeb/uidmap::
 binary-predeb/login::
 	# No real need for login to be setuid root
 	# chmod u+s debian/login/bin/login
+	chmod u+s debian/login/bin/su
 	chmod u+s debian/login/usr/bin/newgrp

 binary-predeb/passwd::
@@ -91,6 +79,3 @@ binary-predeb/passwd::
 	chgrp shadow debian/passwd/usr/bin/expiry
 	chmod g+s debian/passwd/usr/bin/chage
 	chmod g+s debian/passwd/usr/bin/expiry
-
-clean::
-	sed -i 's/# Linux only # //' debian/login.pam
--- a/debian/salsa-ci.yml
+++ b/debian/salsa-ci.yml
@@ -0,0 +1,9 @@
+---
+# LTS/ELTS CI
+
+include:
+- https://salsa.debian.org/lts-team/pipeline/raw/master/recipes/jessie.yml
+
+# These didn't work before LTS, not attempting to fix after freeze
+#blhc:
+#  allow_failure: true
--- a/debian/securetty.linux
+++ b/debian/securetty.linux
@@ -211,12 +211,6 @@ ttySC0
 ttySC1
 ttySC2
 ttySC3
-ttySC4
-ttySC5
-ttySC6
-ttySC7
-ttySC8
-ttySC9

 # ARM "AMBA" serial ports
 ttyAM0
@@ -404,9 +398,3 @@ duart1

 # s390 and s390x ports in LPAR mode
 ttysclp0
-
-# ODROID XU4 serial console
-ttySAC0
-ttySAC1
-ttySAC2
-ttySAC3
--- a/debian/watch
+++ b/debian/watch
@@ -1,4 +1,3 @@
-version=4
-opts="filenamemangle=s%(?:.*?)?v?(\d[\d.]*)\.tar\.gz%shadow-$1.tar.gz%" \
-   https://github.com/shadow-maint/shadow/tags \
-   (?:.*?/)?v?(\d[\d.]*)\.tar\.gz debian uupdate
+version=3
+opts=pgpsigurlmangle=s/$/.sig/ http://pkg-shadow.alioth.debian.org/releases/shadow-(.*)\.tar\.xz \
+  debian  uupdate
--- a/etc/login.defs
+++ b/etc/login.defs
@@ -229,7 +229,7 @@ SYS_UID_MAX		  999
 # Extra per user uids
 SUB_UID_MIN		   100000
 SUB_UID_MAX		600100000
-SUB_UID_COUNT		    65536
+SUB_UID_COUNT		    10000

 #
 # Min/max values for automatic gid selection in groupadd(8)
@@ -242,7 +242,7 @@ SYS_GID_MAX		  999
 # Extra per user group ids
 SUB_GID_MIN		   100000
 SUB_GID_MAX		600100000
-SUB_GID_COUNT		    65536
+SUB_GID_COUNT		    10000

 #
 # Max number of login(1) retries if password is bad
@@ -393,8 +393,3 @@ USERGROUPS_ENAB yes
 #
 #CREATE_HOME     yes

-#
-# Force use shadow, even if shadow passwd & shadow group files are
-# missing.
-#
-#FORCE_SHADOW    yes
--- a/lib/commonio.c
+++ b/lib/commonio.c
@@ -301,12 +301,15 @@ static int create_backup (const char *backup, FILE * fp)
 	struct utimbuf ub;
 	FILE *bkfp;
 	int c;
+	mode_t mask;

 	if (fstat (fileno (fp), &sb) != 0) {
 		return -1;
 	}

-	bkfp = fopen_set_perms (backup, "w", &sb);
+	mask = umask (077);
+	bkfp = fopen (backup, "w");
+	(void) umask (mask);
 	if (NULL == bkfp) {
 		return -1;
 	}
@@ -751,16 +754,16 @@ commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *))
 	for (ptr = db->head;
 	        (NULL != ptr)
 #if KEEP_NIS_AT_END
-	     && ((NULL == ptr->line)
-	         || (('+' != ptr->line[0])
-	             && ('-' != ptr->line[0])))
+	     && (NULL != ptr->line)
+	     && (   ('+' != ptr->line[0])
+	         && ('-' != ptr->line[0]))
 #endif
 	     ;
 	     ptr = ptr->next) {
 		n++;
 	}
 #if KEEP_NIS_AT_END
-	if (NULL != ptr) {
+	if ((NULL != ptr) && (NULL != ptr->line)) {
 		nis = ptr;
 	}
 #endif
@@ -965,10 +968,11 @@ int commonio_close (struct commonio_db *db)
 	} else {
 		/*
 		 * Default permissions for new [g]shadow files.
+		 * (passwd and group always exist...)
 		 */
-		sb.st_mode = db->st_mode;
-		sb.st_uid = db->st_uid;
-		sb.st_gid = db->st_gid;
+		sb.st_mode = 0400;
+		sb.st_uid = 0;
+		sb.st_gid = 0;
 	}

 	snprintf (buf, sizeof buf, "%s+", db->filename);
@@ -1077,7 +1081,6 @@ int commonio_update (struct commonio_db *db, const void *eptr)
 	if (NULL != p) {
 		if (next_entry_by_name (db, p->next, db->ops->getname (eptr)) != NULL) {
 			fprintf (stderr, _("Multiple entries named '%s' in %s. Please fix this with pwck or grpck.\n"), db->ops->getname (eptr), db->filename);
-			db->ops->free (nentry);
 			return 0;
 		}
 		db->ops->free (p->eptr);
--- a/lib/commonio.h
+++ b/lib/commonio.h
@@ -31,8 +31,8 @@
 */

 /* $Id$ */
-#ifndef COMMONIO_H
-#define COMMONIO_H
+#ifndef _COMMONIO_H
+#define _COMMONIO_H

 #ifdef WITH_SELINUX
 #include <selinux/selinux.h>
@@ -123,12 +123,6 @@ struct commonio_db {
 #ifdef WITH_SELINUX
 	/*@null@*/security_context_t scontext;
 #endif
-	/*
-	 * Default permissions and owner for newly created data file.
-         */
-	mode_t st_mode;
-	uid_t st_uid;
-	gid_t st_gid;
 	/*
 	 * Head, tail, current position in linked list.
 	 */
--- a/lib/getdef.c
+++ b/lib/getdef.c
@@ -49,32 +49,6 @@ struct itemdef {
 	/*@null@*/char *value;		/* value given, or NULL if no value     */
 };

-#define PAMDEFS					\
-	{"CHFN_AUTH", NULL},			\
-	{"CHSH_AUTH", NULL},			\
-	{"CRACKLIB_DICTPATH", NULL},		\
-	{"ENV_HZ", NULL},			\
-	{"ENVIRON_FILE", NULL},			\
-	{"ENV_TZ", NULL},			\
-	{"FAILLOG_ENAB", NULL},			\
-	{"FTMP_FILE", NULL},			\
-	{"ISSUE_FILE", NULL},			\
-	{"LASTLOG_ENAB", NULL},			\
-	{"LOGIN_STRING", NULL},			\
-	{"MAIL_CHECK_ENAB", NULL},		\
-	{"MOTD_FILE", NULL},			\
-	{"NOLOGINS_FILE", NULL},		\
-	{"OBSCURE_CHECKS_ENAB", NULL},		\
-	{"PASS_ALWAYS_WARN", NULL},		\
-	{"PASS_CHANGE_TRIES", NULL},		\
-	{"PASS_MAX_LEN", NULL},			\
-	{"PASS_MIN_LEN", NULL},			\
-	{"PORTTIME_CHECKS_ENAB", NULL},		\
-	{"QUOTAS_ENAB", NULL},			\
-	{"SU_WHEEL_ONLY", NULL},		\
-	{"ULIMIT", NULL},
-
-
 #define NUMDEFS	(sizeof(def_table)/sizeof(def_table[0]))
 static struct itemdef def_table[] = {
 	{"CHFN_RESTRICT", NULL},
@@ -128,7 +102,29 @@ static struct itemdef def_table[] = {
 	{"USERDEL_CMD", NULL},
 	{"USERGROUPS_ENAB", NULL},
 #ifndef USE_PAM
-	PAMDEFS
+	{"CHFN_AUTH", NULL},
+	{"CHSH_AUTH", NULL},
+	{"CRACKLIB_DICTPATH", NULL},
+	{"ENV_HZ", NULL},
+	{"ENVIRON_FILE", NULL},
+	{"ENV_TZ", NULL},
+	{"FAILLOG_ENAB", NULL},
+	{"FTMP_FILE", NULL},
+	{"ISSUE_FILE", NULL},
+	{"LASTLOG_ENAB", NULL},
+	{"LOGIN_STRING", NULL},
+	{"MAIL_CHECK_ENAB", NULL},
+	{"MOTD_FILE", NULL},
+	{"NOLOGINS_FILE", NULL},
+	{"OBSCURE_CHECKS_ENAB", NULL},
+	{"PASS_ALWAYS_WARN", NULL},
+	{"PASS_CHANGE_TRIES", NULL},
+	{"PASS_MAX_LEN", NULL},
+	{"PASS_MIN_LEN", NULL},
+	{"PORTTIME_CHECKS_ENAB", NULL},
+	{"QUOTAS_ENAB", NULL},
+	{"SU_WHEEL_ONLY", NULL},
+	{"ULIMIT", NULL},
 #endif
 #ifdef USE_SYSLOG
 	{"SYSLOG_SG_ENAB", NULL},
@@ -138,15 +134,6 @@ static struct itemdef def_table[] = {
 	{"TCB_AUTH_GROUP", NULL},
 	{"TCB_SYMLINKS", NULL},
 	{"USE_TCB", NULL},
-#endif
-	{"FORCE_SHADOW", NULL},
-	{NULL, NULL}
-};
-
-#define NUMKNOWNDEFS	(sizeof(knowndef_table)/sizeof(knowndef_table[0]))
-static struct itemdef knowndef_table[] = {
-#ifdef USE_PAM
-	PAMDEFS
 #endif
 	{NULL, NULL}
 };
@@ -410,17 +397,10 @@ static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *name)
 	 * Item was never found.
 	 */

-	for (ptr = knowndef_table; NULL != ptr->name; ptr++) {
-		if (strcmp (ptr->name, name) == 0) {
-			goto out;
-		}
-	}
 	fprintf (stderr,
 	         _("configuration error - unknown item '%s' (notify administrator)\n"),
 	         name);
 	SYSLOG ((LOG_CRIT, "unknown configuration item `%s'", name));
-
-out:
 	return (struct itemdef *) NULL;
 }

@@ -436,26 +416,23 @@ static void def_load (void)
 	FILE *fp;
 	char buf[1024], *name, *value, *s;

-	/*
-	 * Set the initialized flag.
-	 * (do it early to prevent recursion in putdef_str())
-	 */
-	def_loaded = true;
-
 	/*
 	 * Open the configuration definitions file.
 	 */
 	fp = fopen (def_fname, "r");
 	if (NULL == fp) {
-		if (errno == ENOENT)
-			return;
-
 		int err = errno;
 		SYSLOG ((LOG_CRIT, "cannot open login definitions %s [%s]",
 		         def_fname, strerror (err)));
 		exit (EXIT_FAILURE);
 	}

+	/*
+	 * Set the initialized flag.
+	 * (do it early to prevent recursion in putdef_str())
+	 */
+	def_loaded = true;
+
 	/*
 	 * Go through all of the lines in the file.
 	 */
--- a/lib/getulong.c
+++ b/lib/getulong.c
@@ -44,19 +44,22 @@
 */
 int getulong (const char *numstr, /*@out@*/unsigned long int *result)
 {
-	unsigned long int val;
+	long long int val;
 	char *endptr;

 	errno = 0;
-	val = strtoul (numstr, &endptr, 0);
+	val = strtoll (numstr, &endptr, 0);
 	if (    ('\0' == *numstr)
 	     || ('\0' != *endptr)
 	     || (ERANGE == errno)
+	     /*@+ignoresigns@*/
+	     || (val != (unsigned long int)val)
+	     /*@=ignoresigns@*/
 	   ) {
 		return 0;
 	}

-	*result = val;
+	*result = (unsigned long int)val;
 	return 1;
 }

--- a/lib/groupio.c
+++ b/lib/groupio.c
@@ -130,9 +130,6 @@ static /*@owned@*/struct commonio_db group_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
-	0644,                   /* st_mode */
-	0,                      /* st_uid */
-	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
@@ -338,7 +335,8 @@ static /*@null@*/struct commonio_entry *merge_group_entries (
 		errno = ENOMEM;
 		return NULL;
 	}
-	snprintf(new_line, new_line_len + 1, "%s\n%s", gr1->line, gr2->line);
+	snprintf(new_line, new_line_len, "%s\n%s", gr1->line, gr2->line);
+	new_line[new_line_len] = '\0';

 	/* Concatenate the 2 list of members */
 	for (i=0; NULL != gptr1->gr_mem[i]; i++);
--- a/lib/groupmem.c
+++ b/lib/groupmem.c
@@ -55,14 +55,15 @@
 	gr->gr_name = strdup (grent->gr_name);
 	/*@=mustfreeonly@*/
 	if (NULL == gr->gr_name) {
-		gr_free(gr);
+		free(gr);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	gr->gr_passwd = strdup (grent->gr_passwd);
 	/*@=mustfreeonly@*/
 	if (NULL == gr->gr_passwd) {
-		gr_free(gr);
+		free(gr->gr_name);
+		free(gr);
 		return NULL;
 	}

@@ -72,13 +73,21 @@
 	gr->gr_mem = (char **) malloc ((i + 1) * sizeof (char *));
 	/*@=mustfreeonly@*/
 	if (NULL == gr->gr_mem) {
-		gr_free(gr);
+		free(gr->gr_passwd);
+		free(gr->gr_name);
+		free(gr);
 		return NULL;
 	}
 	for (i = 0; grent->gr_mem[i]; i++) {
 		gr->gr_mem[i] = strdup (grent->gr_mem[i]);
 		if (NULL == gr->gr_mem[i]) {
-			gr_free(gr);
+			int j;
+			for (j=0; j<i; j++)
+				free(gr->gr_mem[j]);
+			free(gr->gr_mem);
+			free(gr->gr_passwd);
+			free(gr->gr_name);
+			free(gr);
 			return NULL;
 		}
 	}
--- a/lib/prototypes.h
+++ b/lib/prototypes.h
@@ -179,9 +179,6 @@ extern int getrange (char *range,
                     unsigned long *min, bool *has_min,
                     unsigned long *max, bool *has_max);

-/* gettime.c */
-extern time_t gettime ();
-
 /* get_uid.c */
 extern int get_uid (const char *uidstr, uid_t *uid);

--- a/lib/pwio.c
+++ b/lib/pwio.c
@@ -105,9 +105,6 @@ static struct commonio_db passwd_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
-	0644,                   /* st_mode */
-	0,                      /* st_uid */
-	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
--- a/lib/pwmem.c
+++ b/lib/pwmem.c
@@ -56,35 +56,45 @@
 	pw->pw_name = strdup (pwent->pw_name);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_name) {
-		pw_free(pw);
+		free(pw);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	pw->pw_passwd = strdup (pwent->pw_passwd);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_passwd) {
-		pw_free(pw);
+		free(pw->pw_name);
+		free(pw);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	pw->pw_gecos = strdup (pwent->pw_gecos);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_gecos) {
-		pw_free(pw);
+		free(pw->pw_passwd);
+		free(pw->pw_name);
+		free(pw);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	pw->pw_dir = strdup (pwent->pw_dir);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_dir) {
-		pw_free(pw);
+		free(pw->pw_gecos);
+		free(pw->pw_passwd);
+		free(pw->pw_name);
+		free(pw);
 		return NULL;
 	}
 	/*@-mustfreeonly@*/
 	pw->pw_shell = strdup (pwent->pw_shell);
 	/*@=mustfreeonly@*/
 	if (NULL == pw->pw_shell) {
-		pw_free(pw);
+		free(pw->pw_dir);
+		free(pw->pw_gecos);
+		free(pw->pw_passwd);
+		free(pw->pw_name);
+		free(pw);
 		return NULL;
 	}

--- a/lib/sgroupio.c
+++ b/lib/sgroupio.c
@@ -40,7 +40,6 @@
 #include "prototypes.h"
 #include "defines.h"
 #include "commonio.h"
-#include "getdef.h"
 #include "sgroupio.h"

 /*@null@*/ /*@only@*/struct sgrp *__sgr_dup (const struct sgrp *sgent)
@@ -229,9 +228,6 @@ static struct commonio_db gshadow_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
-	0400,                   /* st_mode */
-	0,                      /* st_uid */
-	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
@@ -253,8 +249,6 @@ int sgr_setdbname (const char *filename)

 bool sgr_file_present (void)
 {
-	if (getdef_bool ("FORCE_SHADOW"))
-		return true;
 	return commonio_present (&gshadow_db);
 }

--- a/lib/shadowio.c
+++ b/lib/shadowio.c
@@ -40,7 +40,6 @@
 #include <shadow.h>
 #include <stdio.h>
 #include "commonio.h"
-#include "getdef.h"
 #include "shadowio.h"
 #ifdef WITH_TCB
 #include <tcb.h>
@@ -105,9 +104,6 @@ static struct commonio_db shadow_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif				/* WITH_SELINUX */
-	0400,                   /* st_mode */
-	0,                      /* st_uid */
-	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
@@ -129,8 +125,6 @@ int spw_setdbname (const char *filename)

 bool spw_file_present (void)
 {
-	if (getdef_bool ("FORCE_SHADOW"))
-		return true;
 	return commonio_present (&shadow_db);
 }

--- a/lib/shadowio.h
+++ b/lib/shadowio.h
@@ -31,8 +31,8 @@
 */

 /* $Id$ */
-#ifndef SHADOWIO_H
-#define SHADOWIO_H
+#ifndef _SHADOWIO_H
+#define _SHADOWIO_H

 #include "defines.h"

--- a/lib/subordinateio.c
+++ b/lib/subordinateio.c
@@ -11,8 +11,6 @@
 #include <stdio.h>
 #include "commonio.h"
 #include "subordinateio.h"
-#include <sys/types.h>
-#include <pwd.h>

 struct subordinate_range {
 	const char *owner;
@@ -191,15 +189,6 @@ static const struct subordinate_range *find_range(struct commonio_db *db,
 						  const char *owner, unsigned long val)
 {
 	const struct subordinate_range *range;
-
-	/*
-	 * Search for exact username/group specification
-	 *
-	 * This is the original method - go fast through the db, doing only
-	 * exact username/group string comparison. Therefore we leave it as-is
-	 * for the time being, in order to keep it equally fast as it was
-	 * before.
-	 */
 	commonio_rewind(db);
 	while ((range = commonio_next(db)) != NULL) {
 		unsigned long first = range->start;
@@ -211,76 +200,6 @@ static const struct subordinate_range *find_range(struct commonio_db *db,
 		if ((val >= first) && (val <= last))
 			return range;
 	}
-
-
-        /*
-         * We only do special handling for these two files
-         */
-        if ((0 != strcmp(db->filename, "/etc/subuid")) && (0 != strcmp(db->filename, "/etc/subgid")))
-                return NULL;
-
-        /*
-         * Search loop above did not produce any result. Let's rerun it,
-         * but this time try to matcha actual UIDs. The first entry that
-         * matches is considered a success.
-         * (It may be specified as literal UID or as another username which
-         * has the same UID as the username we are looking for.)
-         */
-        struct passwd *pwd;
-        uid_t          owner_uid;
-        char           owner_uid_string[33] = "";
-
-
-        /* Get UID of the username we are looking for */
-        pwd = getpwnam(owner);
-        if (NULL == pwd) {
-                /* Username not defined in /etc/passwd, or error occured during lookup */
-                return NULL;
-        }
-        owner_uid = pwd->pw_uid;
-        sprintf(owner_uid_string, "%lu", (unsigned long int)owner_uid);
-
-        commonio_rewind(db);
-        while ((range = commonio_next(db)) != NULL) {
-                unsigned long first = range->start;
-                unsigned long last = first + range->count - 1;
-
-                /* For performance reasons check range before using getpwnam() */
-                if ((val < first) || (val > last)) {
-                        continue;
-                }
-
-                /*
-                 * Range matches. Check if range owner is specified
-                 * as numeric UID and if it matches.
-                 */
-                if (0 == strcmp(range->owner, owner_uid_string)) {
-                        return range;
-                }
-
-                /*
-                 * Ok, this range owner is not specified as numeric UID
-                 * we are looking for. It may be specified as another
-                 * UID or as a literal username.
-                 *
-                 * If specified as another UID, the call to getpwnam()
-                 * will return NULL.
-                 *
-                 * If specified as literal username, we will get its
-                 * UID and compare that to UID we are looking for.
-                 */
-                const struct passwd *range_owner_pwd;
-
-                range_owner_pwd = getpwnam(range->owner);
-                if (NULL == range_owner_pwd) {
-                        continue;
-                }
-
-                if (owner_uid == range_owner_pwd->pw_uid) {
-                        return range;
-                }
-        }
-
 	return NULL;
 }

@@ -541,9 +460,6 @@ static struct commonio_db subordinate_uid_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
-	0644,                   /* st_mode */
-	0,                      /* st_uid */
-	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
@@ -622,9 +538,6 @@ static struct commonio_db subordinate_gid_db = {
 #ifdef WITH_SELINUX
 	NULL,			/* scontext */
 #endif
-	0644,                   /* st_mode */
-	0,                      /* st_uid */
-	0,                      /* st_gid */
 	NULL,			/* head */
 	NULL,			/* tail */
 	NULL,			/* cursor */
--- a/libmisc/Makefile.am
+++ b/libmisc/Makefile.am
@@ -1,7 +1,7 @@

 EXTRA_DIST = .indent.pro xgetXXbyYY.c

-AM_CPPFLAGS = -I$(top_srcdir)/lib
+INCLUDES = -I$(top_srcdir)/lib

 noinst_LIBRARIES = libmisc.a

@@ -31,7 +31,6 @@ libmisc_a_SOURCES = \
 	getdate.y \
 	getgr_nam_gid.c \
 	getrange.c \
-	gettime.c \
 	hushed.c \
 	idmapping.h \
 	idmapping.c \
--- a/libmisc/find_new_gid.c
+++ b/libmisc/find_new_gid.c
@@ -1,7 +1,6 @@
 /*
 * Copyright (c) 1991 - 1994, Julianne Frances Haugh
 * Copyright (c) 2008 - 2011, Nicolas François
- * Copyright (c) 2014, Red Hat, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -39,117 +38,6 @@
 #include "groupio.h"
 #include "getdef.h"

-/*
- * get_ranges - Get the minimum and maximum ID ranges for the search
- *
- * This function will return the minimum and maximum ranges for IDs
- *
- * 0: The function completed successfully
- * EINVAL: The provided ranges are impossible (such as maximum < minimum)
- *
- * preferred_min: The special-case minimum value for a specifically-
- * requested ID, which may be lower than the standard min_id
- */
-static int get_ranges (bool sys_group, gid_t *min_id, gid_t *max_id,
-		       gid_t *preferred_min)
-{
-	gid_t gid_def_max = 0;
-
-	if (sys_group) {
-		/* System groups */
-
-		/* A requested ID is allowed to be below the autoselect range */
-		*preferred_min = (gid_t) 1;
-
-		/* Get the minimum ID range from login.defs or default to 101 */
-		*min_id = (gid_t) getdef_ulong ("SYS_GID_MIN", 101UL);
-
-		/*
-		 * If SYS_GID_MAX is unspecified, we should assume it to be one
-		 * less than the GID_MIN (which is reserved for non-system accounts)
-		 */
-		gid_def_max = (gid_t) getdef_ulong ("GID_MIN", 1000UL) - 1;
-		*max_id = (gid_t) getdef_ulong ("SYS_GID_MAX",
-				(unsigned long) gid_def_max);
-
-		/* Check that the ranges make sense */
-		if (*max_id < *min_id) {
-			(void) fprintf (stderr,
-                            _("%s: Invalid configuration: SYS_GID_MIN (%lu), "
-                              "GID_MIN (%lu), SYS_GID_MAX (%lu)\n"),
-                            Prog, (unsigned long) *min_id,
-                            getdef_ulong ("GID_MIN", 1000UL),
-                            (unsigned long) *max_id);
-			return EINVAL;
-		}
-	} else {
-		/* Non-system groups */
-
-		/* Get the values from login.defs or use reasonable defaults */
-		*min_id = (gid_t) getdef_ulong ("GID_MIN", 1000UL);
-		*max_id = (gid_t) getdef_ulong ("GID_MAX", 60000UL);
-
-		/*
-		 * The preferred minimum should match the standard ID minimum
-		 * for non-system groups.
-		 */
-		*preferred_min = *min_id;
-
-		/* Check that the ranges make sense */
-		if (*max_id < *min_id) {
-			(void) fprintf (stderr,
-					_("%s: Invalid configuration: GID_MIN (%lu), "
-					  "GID_MAX (%lu)\n"),
-					Prog, (unsigned long) *min_id,
-					(unsigned long) *max_id);
-			return EINVAL;
-		}
-	}
-
-	return 0;
-}
-
-/*
- * check_gid - See if the requested GID is available
- *
- * On success, return 0
- * If the ID is in use, return EEXIST
- * If the ID is outside the range, return ERANGE
- * In other cases, return errno from getgrgid()
- */
-static int check_gid (const gid_t gid,
-		      const gid_t gid_min,
-		      const gid_t gid_max,
-		      bool *used_gids)
-{
-	/* First test that the preferred ID is in the range */
-	if (gid < gid_min || gid > gid_max) {
-		return ERANGE;
-	}
-
-	/*
-	 * Check whether we already detected this GID
-	 * using the gr_next() loop
-	 */
-	if (used_gids != NULL && used_gids[gid]) {
-		return EEXIST;
-	}
-	/* Check if the GID exists according to NSS */
-	errno = 0;
-	if (getgrgid (gid) != NULL) {
-		return EEXIST;
-	} else {
-		/* getgrgid() was NULL
-		 * we have to ignore errors as temporary
-		 * failures of remote user identity services
-		 * would completely block user/group creation
-		 */
-	}
-
-	/* If we've made it here, the GID must be available */
-	return 0;
-}
-
 /*
 * find_new_gid - Find a new unused GID.
 *
@@ -161,338 +49,161 @@ static int check_gid (const gid_t gid,
 * Return 0 on success, -1 if no unused GIDs are available.
 */
 int find_new_gid (bool sys_group,
-                 gid_t *gid,
-                 /*@null@*/gid_t const *preferred_gid)
+                  gid_t *gid,
+                  /*@null@*/gid_t const *preferred_gid)
 {
-	bool *used_gids;
 	const struct group *grp;
-	gid_t gid_min, gid_max, preferred_min;
-	gid_t group_id, id;
-	gid_t lowest_found, highest_found;
-	int result;
-	int nospam = 0;
+	gid_t gid_min, gid_max, group_id;
+	bool *used_gids;

-	assert(gid != NULL);
+	assert (gid != NULL);

-	/*
-	 * First, figure out what ID range is appropriate for
-	 * automatic assignment
-	 */
-	result = get_ranges (sys_group, &gid_min, &gid_max, &preferred_min);
-	if (result == EINVAL) {
-		return -1;
-	}
-
-	/* Check if the preferred GID is available */
-	if (preferred_gid) {
-		result = check_gid (*preferred_gid, preferred_min, gid_max, NULL);
-		if (result == 0) {
-			/*
-			 * Make sure the GID isn't queued for use already
-			 */
-			if (gr_locate_gid (*preferred_gid) == NULL) {
-				*gid = *preferred_gid;
-				return 0;
-			}
-			/*
-			 * gr_locate_gid() found the GID in an as-yet uncommitted
-			 * entry. We'll proceed below and auto-set a GID.
-			 */
-		} else if (result == EEXIST || result == ERANGE) {
-			/*
-			 * Continue on below. At this time, we won't
-			 * treat these two cases differently.
-			 */
-		} else {
-			/*
-			 * An unexpected error occurred. We should report
-			 * this and fail the group creation.
-			 * This differs from the automatic creation
-			 * behavior below, since if a specific GID was
-			 * requested and generated an error, the user is
-			 * more likely to want to stop and address the
-			 * issue.
-			 */
-			fprintf (stderr,
-				_("%s: Encountered error attempting to use "
-				  "preferred GID: %s\n"),
-				Prog, strerror (result));
+	if (!sys_group) {
+		gid_min = (gid_t) getdef_ulong ("GID_MIN", 1000UL);
+		gid_max = (gid_t) getdef_ulong ("GID_MAX", 60000UL);
+		if (gid_max < gid_min) {
+			(void) fprintf (stderr,
+			                _("%s: Invalid configuration: GID_MIN (%lu), GID_MAX (%lu)\n"),
+			                Prog, (unsigned long) gid_min, (unsigned long) gid_max);
+			return -1;
+		}
+	} else {
+		gid_min = (gid_t) getdef_ulong ("SYS_GID_MIN", 101UL);
+		gid_max = (gid_t) getdef_ulong ("GID_MIN", 1000UL) - 1;
+		gid_max = (gid_t) getdef_ulong ("SYS_GID_MAX", (unsigned long) gid_max);
+		if (gid_max < gid_min) {
+			(void) fprintf (stderr,
+			                _("%s: Invalid configuration: SYS_GID_MIN (%lu), GID_MIN (%lu), SYS_GID_MAX (%lu)\n"),
+			                Prog, (unsigned long) gid_min, getdef_ulong ("GID_MIN", 1000UL), (unsigned long) gid_max);
 			return -1;
 		}
 	}
-
-	/*
-	 * Search the entire group file,
-	 * looking for the next unused value.
-	 *
-	 * We first check the local database with gr_rewind/gr_next to find
-	 * all local values that are in use.
-	 *
-	 * We then compare the next free value to all databases (local and
-	 * remote) and iterate until we find a free one. If there are free
-	 * values beyond the lowest (system groups) or highest (non-system
-	 * groups), we will prefer those and avoid potentially reclaiming a
-	 * deleted group (which can be a security issue, since it may grant
-	 * access to files belonging to that former group).
-	 *
-	 * If there are no GIDs available at the end of the search, we will
-	 * have no choice but to iterate through the range looking for gaps.
-	 *
-	 */
-
-	/* Create an array to hold all of the discovered GIDs */
 	used_gids = malloc (sizeof (bool) * (gid_max +1));
 	if (NULL == used_gids) {
 		fprintf (stderr,
-			 _("%s: failed to allocate memory: %s\n"),
-			 Prog, strerror (errno));
+		         _("%s: failed to allocate memory: %s\n"),
+		         Prog, strerror (errno));
 		return -1;
 	}
 	memset (used_gids, false, sizeof (bool) * (gid_max + 1));

-	/* First look for the lowest and highest value in the local database */
-	(void) gr_rewind ();
-	highest_found = gid_min;
-	lowest_found = gid_max;
-	while ((grp = gr_next ()) != NULL) {
-		/*
-		 * Does this entry have a lower GID than the lowest we've found
-		 * so far?
-		 */
-		if ((grp->gr_gid <= lowest_found) && (grp->gr_gid >= gid_min)) {
-			lowest_found = grp->gr_gid - 1;
-		}
-
-		/*
-		 * Does this entry have a higher GID than the highest we've found
-		 * so far?
-		 */
-		if ((grp->gr_gid >= highest_found) && (grp->gr_gid <= gid_max)) {
-			highest_found = grp->gr_gid + 1;
-		}
-
-		/* create index of used GIDs */
-		if (grp->gr_gid >= gid_min
-			&& grp->gr_gid <= gid_max) {
-
-			used_gids[grp->gr_gid] = true;
-		}
+	if (   (NULL != preferred_gid)
+	    && (*preferred_gid >= gid_min)
+	    && (*preferred_gid <= gid_max)
+	    /* Check if the user exists according to NSS */
+	    && (getgrgid (*preferred_gid) == NULL)
+	    /* Check also the local database in case of uncommitted
+	     * changes */
+	    && (gr_locate_gid (*preferred_gid) == NULL)) {
+		*gid = *preferred_gid;
+		free (used_gids);
+		return 0;
 	}

+
+	/*
+	 * Search the entire group file,
+	 * looking for the largest unused value.
+	 *
+	 * We check the list of groups according to NSS (setgrent/getgrent),
+	 * but we also check the local database (gr_rewind/gr_next) in case
+	 * some groups were created but the changes were not committed yet.
+	 */
 	if (sys_group) {
-		/*
-		 * For system groups, we want to start from the
-		 * top of the range and work downwards.
+		gid_t id;
+		/* setgrent / getgrent / endgrent can be very slow with
+		 * LDAP configurations (and many accounts).
+		 * Since there is a limited amount of IDs to be tested
+		 * for system accounts, we just check the existence
+		 * of IDs with getgrgid.
 		 */
-
-		/*
-		 * At the conclusion of the gr_next() search, we will either
-		 * have a presumed-free GID or we will be at GID_MIN - 1.
-		 */
-		if (lowest_found < gid_min) {
-			/*
-			 * In this case, a GID is in use at GID_MIN.
-			 *
-			 * We will reset the search to GID_MAX and proceed down
-			 * through all the GIDs (skipping those we detected with
-			 * used_gids) for a free one. It is a known issue that
-			 * this may result in reusing a previously-deleted GID,
-			 * so administrators should be instructed to use this
-			 * auto-detection with care (and prefer to assign GIDs
-			 * explicitly).
-			 */
-			lowest_found = gid_max;
-		}
-
-		/* Search through all of the IDs in the range */
-		for (id = lowest_found; id >= gid_min; id--) {
-			result = check_gid (id, gid_min, gid_max, used_gids);
-			if (result == 0) {
-				/* This GID is available. Return it. */
-				*gid = id;
-				free (used_gids);
-				return 0;
-			} else if (result == EEXIST) {
-				/* This GID is in use, we'll continue to the next */
-			} else {
-				/*
-				 * An unexpected error occurred.
-				 *
-				 * Only report it the first time to avoid spamming
-				 * the logs
-				 *
-				 */
-				if (!nospam) {
-					fprintf (stderr,
-						_("%s: Can't get unique system GID (%s). "
-						  "Suppressing additional messages.\n"),
-						Prog, strerror (result));
-					SYSLOG ((LOG_ERR,
-						"Error checking available GIDs: %s",
-						strerror (result)));
-					nospam = 1;
-				}
-				/*
-				 * We will continue anyway. Hopefully a later GID
-				 * will work properly.
-				 */
+		group_id = gid_max;
+		for (id = gid_max; id >= gid_min; id--) {
+			if (getgrgid (id) != NULL) {
+				group_id = id - 1;
+				used_gids[id] = true;
 			}
 		}

-		/*
-		 * If we get all the way through the loop, try again from GID_MAX,
-		 * unless that was where we previously started. (NOTE: the worst-case
-		 * scenario here is that we will run through (GID_MAX - GID_MIN - 1)
-		 * cycles *again* if we fall into this case with lowest_found as
-		 * GID_MAX - 1, all groups in the range in use and maintained by
-		 * network services such as LDAP.)
-		 */
-		if (lowest_found != gid_max) {
-			for (id = gid_max; id >= gid_min; id--) {
-				result = check_gid (id, gid_min, gid_max, used_gids);
-				if (result == 0) {
-					/* This GID is available. Return it. */
-					*gid = id;
-					free (used_gids);
-					return 0;
-				} else if (result == EEXIST) {
-					/* This GID is in use, we'll continue to the next */
-				} else {
-					/*
-					 * An unexpected error occurred.
-					 *
-					 * Only report it the first time to avoid spamming
-					 * the logs
-					 *
-					 */
-					if (!nospam) {
-						fprintf (stderr,
-							_("%s: Can't get unique system GID (%s). "
-							  "Suppressing additional messages.\n"),
-							Prog, strerror (result));
-						SYSLOG ((LOG_ERR,
-							"Error checking available GIDs: %s",
-							strerror (result)));
-						nospam = 1;
-					}
-					/*
-					 * We will continue anyway. Hopefully a later GID
-					 * will work properly.
-					 */
-				}
+		(void) gr_rewind ();
+		while ((grp = gr_next ()) != NULL) {
+			if ((grp->gr_gid <= group_id) && (grp->gr_gid >= gid_min)) {
+				group_id = grp->gr_gid - 1;
+			}
+			/* create index of used GIDs */
+			if (grp->gr_gid <= gid_max) {
+				used_gids[grp->gr_gid] = true;
 			}
 		}
-	} else { /* !sys_group */
-		/*
-		 * For non-system groups, we want to start from the
-		 * bottom of the range and work upwards.
-		 */
-
-		/*
-		 * At the conclusion of the gr_next() search, we will either
-		 * have a presumed-free GID or we will be at GID_MAX + 1.
-		 */
-		if (highest_found > gid_max) {
-			/*
-			 * In this case, a GID is in use at GID_MAX.
-			 *
-			 * We will reset the search to GID_MIN and proceed up
-			 * through all the GIDs (skipping those we detected with
-			 * used_gids) for a free one. It is a known issue that
-			 * this may result in reusing a previously-deleted GID,
-			 * so administrators should be instructed to use this
-			 * auto-detection with care (and prefer to assign GIDs
-			 * explicitly).
-			 */
-			highest_found = gid_min;
-		}
-
-		/* Search through all of the IDs in the range */
-		for (id = highest_found; id <= gid_max; id++) {
-			result = check_gid (id, gid_min, gid_max, used_gids);
-			if (result == 0) {
-				/* This GID is available. Return it. */
-				*gid = id;
-				free (used_gids);
-				return 0;
-			} else if (result == EEXIST) {
-				/* This GID is in use, we'll continue to the next */
-			} else {
-				/*
-				 * An unexpected error occurred.
-				 *
-				 * Only report it the first time to avoid spamming
-				 * the logs
-				 *
-				 */
-				if (!nospam) {
-					fprintf (stderr,
-						_("%s: Can't get unique GID (%s). "
-						  "Suppressing additional messages.\n"),
-						Prog, strerror (result));
-					SYSLOG ((LOG_ERR,
-						"Error checking available GIDs: %s",
-						strerror (result)));
-					nospam = 1;
-				}
-				/*
-				 * We will continue anyway. Hopefully a later GID
-				 * will work properly.
-				 */
+	} else {
+		group_id = gid_min;
+		setgrent ();
+		while ((grp = getgrent ()) != NULL) {
+			if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
+				group_id = grp->gr_gid + 1;
+			}
+			/* create index of used GIDs */
+			if (grp->gr_gid <= gid_max) {
+				used_gids[grp->gr_gid] = true;
 			}
 		}
+		endgrent ();

-		/*
-		 * If we get all the way through the loop, try again from GID_MIN,
-		 * unless that was where we previously started. (NOTE: the worst-case
-		 * scenario here is that we will run through (GID_MAX - GID_MIN - 1)
-		 * cycles *again* if we fall into this case with highest_found as
-		 * GID_MIN + 1, all groups in the range in use and maintained by
-		 * network services such as LDAP.)
-		 */
-		if (highest_found != gid_min) {
-			for (id = gid_min; id <= gid_max; id++) {
-				result = check_gid (id, gid_min, gid_max, used_gids);
-				if (result == 0) {
-					/* This GID is available. Return it. */
-					*gid = id;
-					free (used_gids);
-					return 0;
-				} else if (result == EEXIST) {
-					/* This GID is in use, we'll continue to the next */
-				} else {
-					/*
-					 * An unexpected error occurred.
-					 *
-					 * Only report it the first time to avoid spamming
-					 * the logs
-					 *
-					 */
-					if (!nospam) {
-						fprintf (stderr,
-							_("%s: Can't get unique GID (%s). "
-							  "Suppressing additional messages.\n"),
-							Prog, strerror (result));
-						SYSLOG ((LOG_ERR,
-							"Error checking available GIDs: %s",
-							strerror (result)));
-						nospam = 1;
-					}
-					/*
-					 * We will continue anyway. Hopefully a later GID
-					 * will work properly.
-					 */
-				}
+		(void) gr_rewind ();
+		while ((grp = gr_next ()) != NULL) {
+			if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
+				group_id = grp->gr_gid + 1;
+			}
+			/* create index of used GIDs */
+			if (grp->gr_gid <= gid_max) {
+				used_gids[grp->gr_gid] = true;
+			}
+		}
+	}
+
+	/*
+	 * If a group (resp. system group) with GID equal to GID_MAX (resp.
+	 * GID_MIN) exists, the above algorithm will give us GID_MAX+1
+	 * (resp. GID_MIN-1) even if not unique. Search for the first free
+	 * GID starting with GID_MIN (resp. GID_MAX).
+	 */
+	if (sys_group) {
+		if (group_id < gid_min) {
+			for (group_id = gid_max; group_id >= gid_min; group_id--) {
+				if (false == used_gids[group_id]) {
+					break;
+				}
+			}
+			if (group_id < gid_min) {
+				fprintf (stderr,
+				         _("%s: Can't get unique system GID (no more available GIDs)\n"),
+				         Prog);
+				SYSLOG ((LOG_WARN,
+				         "no more available GID on the system"));
+				free (used_gids);
+				return -1;
+			}
+		}
+	} else {
+		if (group_id > gid_max) {
+			for (group_id = gid_min; group_id <= gid_max; group_id++) {
+				if (false == used_gids[group_id]) {
+					break;
+				}
+			}
+			if (group_id > gid_max) {
+				fprintf (stderr,
+				         _("%s: Can't get unique GID (no more available GIDs)\n"),
+				         Prog);
+				SYSLOG ((LOG_WARN, "no more available GID on the system"));
+				free (used_gids);
+				return -1;
 			}
 		}
 	}

-	/* The code reached here and found no available IDs in the range */
-	fprintf (stderr,
-		_("%s: Can't get unique GID (no more available GIDs)\n"),
-		Prog);
-	SYSLOG ((LOG_WARN, "no more available GIDs on the system"));
 	free (used_gids);
-	return -1;
+	*gid = group_id;
+	return 0;
 }

--- a/libmisc/find_new_sub_gids.c
+++ b/libmisc/find_new_sub_gids.c
@@ -58,7 +58,7 @@ int find_new_sub_gids (const char *owner,

 	min = getdef_ulong ("SUB_GID_MIN", 100000UL);
 	max = getdef_ulong ("SUB_GID_MAX", 600100000UL);
-	count = getdef_ulong ("SUB_GID_COUNT", 65536);
+	count = getdef_ulong ("SUB_GID_COUNT", 10000);

 	if (min > max || count >= max || (min + count - 1) > max) {
 		(void) fprintf (stderr,
--- a/libmisc/find_new_sub_uids.c
+++ b/libmisc/find_new_sub_uids.c
@@ -58,7 +58,7 @@ int find_new_sub_uids (const char *owner,

 	min = getdef_ulong ("SUB_UID_MIN", 100000UL);
 	max = getdef_ulong ("SUB_UID_MAX", 600100000UL);
-	count = getdef_ulong ("SUB_UID_COUNT", 65536);
+	count = getdef_ulong ("SUB_UID_COUNT", 10000);

 	if (min > max || count >= max || (min + count - 1) > max) {
 		(void) fprintf (stderr,
--- a/libmisc/find_new_uid.c
+++ b/libmisc/find_new_uid.c
@@ -1,7 +1,6 @@
 /*
 * Copyright (c) 1991 - 1994, Julianne Frances Haugh
 * Copyright (c) 2008 - 2011, Nicolas François
- * Copyright (c) 2014, Red Hat, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -39,117 +38,6 @@
 #include "pwio.h"
 #include "getdef.h"

-/*
- * get_ranges - Get the minimum and maximum ID ranges for the search
- *
- * This function will return the minimum and maximum ranges for IDs
- *
- * 0: The function completed successfully
- * EINVAL: The provided ranges are impossible (such as maximum < minimum)
- *
- * preferred_min: The special-case minimum value for a specifically-
- * requested ID, which may be lower than the standard min_id
- */
-static int get_ranges (bool sys_user, uid_t *min_id, uid_t *max_id,
-			uid_t *preferred_min)
-{
-	uid_t uid_def_max = 0;
-
-	if (sys_user) {
-		/* System users */
-
-		/* A requested ID is allowed to be below the autoselect range */
-		*preferred_min = (uid_t) 1;
-
-		/* Get the minimum ID range from login.defs or default to 101 */
-		*min_id = (uid_t) getdef_ulong ("SYS_UID_MIN", 101UL);
-
-		/*
-		 * If SYS_UID_MAX is unspecified, we should assume it to be one
-		 * less than the UID_MIN (which is reserved for non-system accounts)
-		 */
-		uid_def_max = (uid_t) getdef_ulong ("UID_MIN", 1000UL) - 1;
-		*max_id = (uid_t) getdef_ulong ("SYS_UID_MAX",
-				(unsigned long) uid_def_max);
-
-		/* Check that the ranges make sense */
-		if (*max_id < *min_id) {
-			(void) fprintf (stderr,
-                            _("%s: Invalid configuration: SYS_UID_MIN (%lu), "
-                              "UID_MIN (%lu), SYS_UID_MAX (%lu)\n"),
-                            Prog, (unsigned long) *min_id,
-                            getdef_ulong ("UID_MIN", 1000UL),
-                            (unsigned long) *max_id);
-			return EINVAL;
-		}
-	} else {
-		/* Non-system users */
-
-		/* Get the values from login.defs or use reasonable defaults */
-		*min_id = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
-		*max_id = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
-
-		/*
-		 * The preferred minimum should match the standard ID minimum
-		 * for non-system users.
-		 */
-		*preferred_min = *min_id;
-
-		/* Check that the ranges make sense */
-		if (*max_id < *min_id) {
-			(void) fprintf (stderr,
-					_("%s: Invalid configuration: UID_MIN (%lu), "
-					  "UID_MAX (%lu)\n"),
-					Prog, (unsigned long) *min_id,
-					(unsigned long) *max_id);
-			return EINVAL;
-		}
-	}
-
-	return 0;
-}
-
-/*
- * check_uid - See if the requested UID is available
- *
- * On success, return 0
- * If the ID is in use, return EEXIST
- * If the ID is outside the range, return ERANGE
- * In other cases, return errno from getpwuid()
- */
-static int check_uid(const uid_t uid,
-		     const uid_t uid_min,
-		     const uid_t uid_max,
-		     bool *used_uids)
-{
-	/* First test that the preferred ID is in the range */
-	if (uid < uid_min || uid > uid_max) {
-		return ERANGE;
-	}
-
-	/*
-	 * Check whether we already detected this UID
-	 * using the pw_next() loop
-	 */
-	if (used_uids != NULL && used_uids[uid]) {
-		return EEXIST;
-	}
-	/* Check if the UID exists according to NSS */
-	errno = 0;
-	if (getpwuid(uid) != NULL) {
-		return EEXIST;
-	} else {
-		/* getpwuid() was NULL
-		 * we have to ignore errors as temporary
-		 * failures of remote user identity services
-		 * would completely block user/group creation
-		 */
-	}
-
-	/* If we've made it here, the UID must be available */
-	return 0;
-}
-
 /*
 * find_new_uid - Find a new unused UID.
 *
@@ -160,339 +48,162 @@ static int check_uid(const uid_t uid,
 * 
 * Return 0 on success, -1 if no unused UIDs are available.
 */
-int find_new_uid(bool sys_user,
-                 uid_t *uid,
-                 /*@null@*/uid_t const *preferred_uid)
+int find_new_uid (bool sys_user,
+                  uid_t *uid,
+                  /*@null@*/uid_t const *preferred_uid)
 {
-	bool *used_uids;
 	const struct passwd *pwd;
-	uid_t uid_min, uid_max, preferred_min;
-	uid_t user_id, id;
-	uid_t lowest_found, highest_found;
-	int result;
-	int nospam = 0;
+	uid_t uid_min, uid_max, user_id;
+	bool *used_uids;

 	assert (uid != NULL);

-	/*
-	 * First, figure out what ID range is appropriate for
-	 * automatic assignment
-	 */
-	result = get_ranges (sys_user, &uid_min, &uid_max, &preferred_min);
-	if (result == EINVAL) {
-		return -1;
-	}
-
-	/* Check if the preferred UID is available */
-	if (preferred_uid) {
-		result = check_uid (*preferred_uid, preferred_min, uid_max, NULL);
-		if (result == 0) {
-			/*
-			 * Make sure the UID isn't queued for use already
-			 */
-			if (pw_locate_uid (*preferred_uid) == NULL) {
-				*uid = *preferred_uid;
-				return 0;
-			}
-			/*
-			 * pw_locate_uid() found the UID in an as-yet uncommitted
-			 * entry. We'll proceed below and auto-set an UID.
-			 */
-		} else if (result == EEXIST || result == ERANGE) {
-			/*
-			 * Continue on below. At this time, we won't
-			 * treat these two cases differently.
-			 */
-		} else {
-			/*
-			 * An unexpected error occurred. We should report
-			 * this and fail the user creation.
-			 * This differs from the automatic creation
-			 * behavior below, since if a specific UID was
-			 * requested and generated an error, the user is
-			 * more likely to want to stop and address the
-			 * issue.
-			 */
-			fprintf (stderr,
-				_("%s: Encountered error attempting to use "
-				  "preferred UID: %s\n"),
-				Prog, strerror (result));
+	if (!sys_user) {
+		uid_min = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
+		uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
+		if (uid_max < uid_min) {
+			(void) fprintf (stderr,
+			                _("%s: Invalid configuration: UID_MIN (%lu), UID_MAX (%lu)\n"),
+			                Prog, (unsigned long) uid_min, (unsigned long) uid_max);
+			return -1;
+		}
+	} else {
+		uid_min = (uid_t) getdef_ulong ("SYS_UID_MIN", 101UL);
+		uid_max = (uid_t) getdef_ulong ("UID_MIN", 1000UL) - 1;
+		uid_max = (uid_t) getdef_ulong ("SYS_UID_MAX", (unsigned long) uid_max);
+		if (uid_max < uid_min) {
+			(void) fprintf (stderr,
+			                _("%s: Invalid configuration: SYS_UID_MIN (%lu), UID_MIN (%lu), SYS_UID_MAX (%lu)\n"),
+			                Prog, (unsigned long) uid_min, getdef_ulong ("UID_MIN", 1000UL), (unsigned long) uid_max);
 			return -1;
 		}
 	}
-
-	/*
-	 * Search the entire passwd file,
-	 * looking for the next unused value.
-	 *
-	 * We first check the local database with pw_rewind/pw_next to find
-	 * all local values that are in use.
-	 *
-	 * We then compare the next free value to all databases (local and
-	 * remote) and iterate until we find a free one. If there are free
-	 * values beyond the lowest (system users) or highest (non-system
-	 * users), we will prefer those and avoid potentially reclaiming a
-	 * deleted user (which can be a security issue, since it may grant
-	 * access to files belonging to that former user).
-	 *
-	 * If there are no UIDs available at the end of the search, we will
-	 * have no choice but to iterate through the range looking for gaps.
-	 *
-	 */
-
-	/* Create an array to hold all of the discovered UIDs */
 	used_uids = malloc (sizeof (bool) * (uid_max +1));
 	if (NULL == used_uids) {
 		fprintf (stderr,
-			 _("%s: failed to allocate memory: %s\n"),
-			 Prog, strerror (errno));
+		         _("%s: failed to allocate memory: %s\n"),
+		         Prog, strerror (errno));
 		return -1;
 	}
 	memset (used_uids, false, sizeof (bool) * (uid_max + 1));

-	/* First look for the lowest and highest value in the local database */
-	(void) pw_rewind ();
-	highest_found = uid_min;
-	lowest_found = uid_max;
-	while ((pwd = pw_next ()) != NULL) {
-		/*
-		 * Does this entry have a lower UID than the lowest we've found
-		 * so far?
-		 */
-		if ((pwd->pw_uid <= lowest_found) && (pwd->pw_uid >= uid_min)) {
-			lowest_found = pwd->pw_uid - 1;
-		}
-
-		/*
-		 * Does this entry have a higher UID than the highest we've found
-		 * so far?
-		 */
-		if ((pwd->pw_uid >= highest_found) && (pwd->pw_uid <= uid_max)) {
-			highest_found = pwd->pw_uid + 1;
-		}
-
-		/* create index of used UIDs */
-		if (pwd->pw_uid >= uid_min
-			&& pwd->pw_uid <= uid_max) {
-
-			used_uids[pwd->pw_uid] = true;
-		}
+	if (   (NULL != preferred_uid)
+	    && (*preferred_uid >= uid_min)
+	    && (*preferred_uid <= uid_max)
+	    /* Check if the user exists according to NSS */
+	    && (getpwuid (*preferred_uid) == NULL)
+	    /* Check also the local database in case of uncommitted
+	     * changes */
+	    && (pw_locate_uid (*preferred_uid) == NULL)) {
+		*uid = *preferred_uid;
+		free (used_uids);
+		return 0;
 	}

+
+	/*
+	 * Search the entire password file,
+	 * looking for the largest unused value.
+	 *
+	 * We check the list of users according to NSS (setpwent/getpwent),
+	 * but we also check the local database (pw_rewind/pw_next) in case
+	 * some users were created but the changes were not committed yet.
+	 */
 	if (sys_user) {
-		/*
-		 * For system users, we want to start from the
-		 * top of the range and work downwards.
+		uid_t id;
+		/* setpwent / getpwent / endpwent can be very slow with
+		 * LDAP configurations (and many accounts).
+		 * Since there is a limited amount of IDs to be tested
+		 * for system accounts, we just check the existence
+		 * of IDs with getpwuid.
 		 */
-
-		/*
-		 * At the conclusion of the pw_next() search, we will either
-		 * have a presumed-free UID or we will be at UID_MIN - 1.
-		 */
-		if (lowest_found < uid_min) {
-			/*
-			 * In this case, an UID is in use at UID_MIN.
-			 *
-			 * We will reset the search to UID_MAX and proceed down
-			 * through all the UIDs (skipping those we detected with
-			 * used_uids) for a free one. It is a known issue that
-			 * this may result in reusing a previously-deleted UID,
-			 * so administrators should be instructed to use this
-			 * auto-detection with care (and prefer to assign UIDs
-			 * explicitly).
-			 */
-			lowest_found = uid_max;
-		}
-
-		/* Search through all of the IDs in the range */
-		for (id = lowest_found; id >= uid_min; id--) {
-			result = check_uid (id, uid_min, uid_max, used_uids);
-			if (result == 0) {
-				/* This UID is available. Return it. */
-				*uid = id;
-				free (used_uids);
-				return 0;
-			} else if (result == EEXIST) {
-				/* This UID is in use, we'll continue to the next */
-			} else {
-				/*
-				 * An unexpected error occurred.
-				 *
-				 * Only report it the first time to avoid spamming
-				 * the logs
-				 *
-				 */
-				if (!nospam) {
-					fprintf (stderr,
-						_("%s: Can't get unique system UID (%s). "
-						  "Suppressing additional messages.\n"),
-						Prog, strerror (result));
-					SYSLOG ((LOG_ERR,
-						"Error checking available UIDs: %s",
-						strerror (result)));
-					nospam = 1;
-				}
-				/*
-				 * We will continue anyway. Hopefully a later UID
-				 * will work properly.
-				 */
+		user_id = uid_max;
+		for (id = uid_max; id >= uid_min; id--) {
+			if (getpwuid (id) != NULL) {
+				user_id = id - 1;
+				used_uids[id] = true;
 			}
 		}

-		/*
-		 * If we get all the way through the loop, try again from UID_MAX,
-		 * unless that was where we previously started. (NOTE: the worst-case
-		 * scenario here is that we will run through (UID_MAX - UID_MIN - 1)
-		 * cycles *again* if we fall into this case with lowest_found as
-		 * UID_MAX - 1, all users in the range in use and maintained by
-		 * network services such as LDAP.)
-		 */
-		if (lowest_found != uid_max) {
-			for (id = uid_max; id >= uid_min; id--) {
-				result = check_uid (id, uid_min, uid_max, used_uids);
-				if (result == 0) {
-					/* This UID is available. Return it. */
-					*uid = id;
-					free (used_uids);
-					return 0;
-				} else if (result == EEXIST) {
-					/* This UID is in use, we'll continue to the next */
-				} else {
-					/*
-					 * An unexpected error occurred.
-					 *
-					 * Only report it the first time to avoid spamming
-					 * the logs
-					 *
-					 */
-					if (!nospam) {
-						fprintf (stderr,
-							_("%s: Can't get unique system UID (%s). "
-							  "Suppressing additional messages.\n"),
-							Prog, strerror (result));
-						SYSLOG((LOG_ERR,
-							"Error checking available UIDs: %s",
-							strerror (result)));
-						nospam = 1;
-					}
-					/*
-					 * We will continue anyway. Hopefully a later UID
-					 * will work properly.
-					 */
-				}
+		(void) pw_rewind ();
+		while ((pwd = pw_next ()) != NULL) {
+			if ((pwd->pw_uid <= user_id) && (pwd->pw_uid >= uid_min)) {
+				user_id = pwd->pw_uid - 1;
+			}
+			/* create index of used UIDs */
+			if (pwd->pw_uid <= uid_max) {
+				used_uids[pwd->pw_uid] = true;
 			}
 		}
-	} else { /* !sys_user */
-		/*
-		 * For non-system users, we want to start from the
-		 * bottom of the range and work upwards.
-		 */
-
-		/*
-		 * At the conclusion of the pw_next() search, we will either
-		 * have a presumed-free UID or we will be at UID_MAX + 1.
-		 */
-		if (highest_found > uid_max) {
-			/*
-			 * In this case, a UID is in use at UID_MAX.
-			 *
-			 * We will reset the search to UID_MIN and proceed up
-			 * through all the UIDs (skipping those we detected with
-			 * used_uids) for a free one. It is a known issue that
-			 * this may result in reusing a previously-deleted UID,
-			 * so administrators should be instructed to use this
-			 * auto-detection with care (and prefer to assign UIDs
-			 * explicitly).
-			 */
-			highest_found = uid_min;
-		}
-
-		/* Search through all of the IDs in the range */
-		for (id = highest_found; id <= uid_max; id++) {
-			result = check_uid (id, uid_min, uid_max, used_uids);
-			if (result == 0) {
-				/* This UID is available. Return it. */
-				*uid = id;
-				free (used_uids);
-				return 0;
-			} else if (result == EEXIST) {
-				/* This UID is in use, we'll continue to the next */
-			} else {
-				/*
-				 * An unexpected error occurred.
-				 *
-				 * Only report it the first time to avoid spamming
-				 * the logs
-				 *
-				 */
-				if (!nospam) {
-					fprintf (stderr,
-						_("%s: Can't get unique UID (%s). "
-						  "Suppressing additional messages.\n"),
-						Prog, strerror (result));
-					SYSLOG ((LOG_ERR,
-						"Error checking available UIDs: %s",
-						strerror (result)));
-					nospam = 1;
-				}
-				/*
-				 * We will continue anyway. Hopefully a later UID
-				 * will work properly.
-				 */
+	} else {
+		user_id = uid_min;
+		setpwent ();
+		while ((pwd = getpwent ()) != NULL) {
+			if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
+				user_id = pwd->pw_uid + 1;
+			}
+			/* create index of used UIDs */
+			if (pwd->pw_uid <= uid_max) {
+				used_uids[pwd->pw_uid] = true;
 			}
 		}
+		endpwent ();

-		/*
-		 * If we get all the way through the loop, try again from UID_MIN,
-		 * unless that was where we previously started. (NOTE: the worst-case
-		 * scenario here is that we will run through (UID_MAX - UID_MIN - 1)
-		 * cycles *again* if we fall into this case with highest_found as
-		 * UID_MIN + 1, all users in the range in use and maintained by
-		 * network services such as LDAP.)
-		 */
-		if (highest_found != uid_min) {
-			for (id = uid_min; id <= uid_max; id++) {
-				result = check_uid (id, uid_min, uid_max, used_uids);
-				if (result == 0) {
-					/* This UID is available. Return it. */
-					*uid = id;
-					free (used_uids);
-					return 0;
-				} else if (result == EEXIST) {
-					/* This UID is in use, we'll continue to the next */
-				} else {
-					/*
-					 * An unexpected error occurred.
-					 *
-					 * Only report it the first time to avoid spamming
-					 * the logs
-					 *
-					 */
-					if (!nospam) {
-						fprintf (stderr,
-							_("%s: Can't get unique UID (%s). "
-							  "Suppressing additional messages.\n"),
-							Prog, strerror (result));
-						SYSLOG ((LOG_ERR,
-							"Error checking available UIDs: %s",
-							strerror (result)));
-						nospam = 1;
-					}
-					/*
-					 * We will continue anyway. Hopefully a later UID
-					 * will work properly.
-					 */
-				}
+		(void) pw_rewind ();
+		while ((pwd = pw_next ()) != NULL) {
+			if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
+				user_id = pwd->pw_uid + 1;
+			}
+			/* create index of used UIDs */
+			if (pwd->pw_uid <= uid_max) {
+				used_uids[pwd->pw_uid] = true;
+			}
+		}
+	}
+
+	/*
+	 * If a user (resp. system user) with UID equal to UID_MAX (resp.
+	 * UID_MIN) exists, the above algorithm will give us UID_MAX+1
+	 * (resp. UID_MIN-1) even if not unique. Search for the first free
+	 * UID starting with UID_MIN (resp. UID_MAX).
+	 */
+	if (sys_user) {
+		if (user_id < uid_min) {
+			for (user_id = uid_max; user_id >= uid_min; user_id--) {
+				if (false == used_uids[user_id]) {
+					break;
+				}
+			}
+			if (user_id < uid_min ) {
+				fprintf (stderr,
+				         _("%s: Can't get unique system UID (no more available UIDs)\n"),
+				         Prog);
+				SYSLOG ((LOG_WARN,
+				         "no more available UID on the system"));
+				free (used_uids);
+				return -1;
+			}
+		}
+	} else {
+		if (user_id > uid_max) {
+			for (user_id = uid_min; user_id <= uid_max; user_id++) {
+				if (false == used_uids[user_id]) {
+					break;
+				}
+			}
+			if (user_id > uid_max) {
+				fprintf (stderr,
+				         _("%s: Can't get unique UID (no more available UIDs)\n"),
+				         Prog);
+				SYSLOG ((LOG_WARN, "no more available UID on the system"));
+				free (used_uids);
+				return -1;
 			}
 		}
 	}

-	/* The code reached here and found no available IDs in the range */
-	fprintf (stderr,
-		_("%s: Can't get unique UID (no more available UIDs)\n"),
-		Prog);
-	SYSLOG ((LOG_WARN, "no more available UIDs on the system"));
 	free (used_uids);
-	return -1;
+	*uid = user_id;
+	return 0;
 }

--- a/libmisc/gettime.c
+++ b/libmisc/gettime.c
@@ -1,89 +0,0 @@
-/*
- * Copyright (c) 2017, Chris Lamb
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the copyright holders or contributors may not be used to
- *    endorse or promote products derived from this software without
- *    specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
- * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <config.h>
-
-#ident "$Id$"
-
-#include <errno.h>
-#include <limits.h>
-#include <stdio.h>
-#include "defines.h"
-#include "prototypes.h"
-
-/*
- * gettime() returns the time as the number of seconds since the Epoch
- *
- * Like time(), gettime() returns the time as the number of seconds since the
- * Epoch, 1970-01-01 00:00:00 +0000 (UTC), except that if the SOURCE_DATE_EPOCH
- * environment variable is exported it will use that instead.
- */
-/*@observer@*/time_t gettime ()
-{
-	char *endptr;
-	char *source_date_epoch;
-	time_t fallback;
-	unsigned long long epoch;
-
-	fallback = time (NULL);
-	source_date_epoch = getenv ("SOURCE_DATE_EPOCH");
-
-	if (!source_date_epoch)
-		return fallback;
-
-	errno = 0;
-	epoch = strtoull (source_date_epoch, &endptr, 10);
-	if ((errno == ERANGE && (epoch == ULLONG_MAX || epoch == 0))
-			|| (errno != 0 && epoch == 0)) {
-		fprintf (stderr,
-			 _("Environment variable $SOURCE_DATE_EPOCH: strtoull: %s\n"),
-			 strerror(errno));
-	} else if (endptr == source_date_epoch) {
-		fprintf (stderr,
-			 _("Environment variable $SOURCE_DATE_EPOCH: No digits were found: %s\n"),
-			 endptr);
-	} else if (*endptr != '\0') {
-		fprintf (stderr,
-			 _("Environment variable $SOURCE_DATE_EPOCH: Trailing garbage: %s\n"),
-			 endptr);
-	} else if (epoch > ULONG_MAX) {
-		fprintf (stderr,
-			 _("Environment variable $SOURCE_DATE_EPOCH: value must be smaller than or equal to %lu but was found to be: %llu\n"),
-			 ULONG_MAX, epoch);
-	} else if (epoch > fallback) {
-		fprintf (stderr,
-			 _("Environment variable $SOURCE_DATE_EPOCH: value must be smaller than or equal to the current time (%lu) but was found to be: %llu\n"),
-			 fallback, epoch);
-	} else {
-		/* Valid */
-		return (time_t)epoch;
-	}
-
-	return fallback;
-}
--- a/libmisc/idmapping.c
+++ b/libmisc/idmapping.c
@@ -70,40 +70,13 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)

 	/* Gather up the ranges from the command line */
 	mapping = mappings;
-	for (idx = 0, argidx = 0; idx < ranges; idx++, argidx += 3, mapping++) {
-		if (!getulong(argv[argidx + 0], &mapping->upper)) {
-			free(mappings);
+	for (idx = 0; idx < ranges; idx++, argidx += 3, mapping++) {
+		if (!getulong(argv[argidx + 0], &mapping->upper))
 			return NULL;
-		}
-		if (!getulong(argv[argidx + 1], &mapping->lower)) {
-			free(mappings);
+		if (!getulong(argv[argidx + 1], &mapping->lower))
 			return NULL;
-		}
-		if (!getulong(argv[argidx + 2], &mapping->count)) {
-			free(mappings);
+		if (!getulong(argv[argidx + 2], &mapping->count))
 			return NULL;
-		}
-		if (ULONG_MAX - mapping->upper <= mapping->count || ULONG_MAX - mapping->lower <= mapping->count) {
-			fprintf(stderr, _( "%s: subuid overflow detected.\n"), Prog);
-			exit(EXIT_FAILURE);
-		}
-		if (mapping->upper > UINT_MAX ||
-			mapping->lower > UINT_MAX ||
-			mapping->count > UINT_MAX)  {
-			fprintf(stderr, _( "%s: subuid overflow detected.\n"), Prog);
-			exit(EXIT_FAILURE);
-		}
-		if (mapping->lower + mapping->count > UINT_MAX ||
-				mapping->upper + mapping->count > UINT_MAX) {
-			fprintf(stderr, _( "%s: subuid overflow detected.\n"), Prog);
-			exit(EXIT_FAILURE);
-		}
-		if (mapping->lower + mapping->count < mapping->lower ||
-				mapping->upper + mapping->count < mapping->upper) {
-			/* this one really shouldn't be possible given previous checks */
-			fprintf(stderr, _( "%s: subuid overflow detected.\n"), Prog);
-			exit(EXIT_FAILURE);
-		}
 	}
 	return mappings;
 }
--- a/libmisc/user_busy.c
+++ b/libmisc/user_busy.c
@@ -170,17 +170,11 @@ static int user_busy_processes (const char *name, uid_t uid)
 	proc = opendir ("/proc");
 	if (proc == NULL) {
 		perror ("opendir /proc");
-#ifdef ENABLE_SUBIDS
-		sub_uid_close();
-#endif
 		return 0;
 	}
 	if (stat ("/", &sbroot) != 0) {
 		perror ("stat (\"/\")");
 		(void) closedir (proc);
-#ifdef ENABLE_SUBIDS
-		sub_uid_close();
-#endif
 		return 0;
 	}

@@ -218,9 +212,6 @@ static int user_busy_processes (const char *name, uid_t uid)

 		if (check_status (name, tmp_d_name, uid) != 0) {
 			(void) closedir (proc);
-#ifdef ENABLE_SUBIDS
-			sub_uid_close();
-#endif
 			fprintf (stderr,
 			         _("%s: user %s is currently used by process %d\n"),
 			         Prog, name, pid);
@@ -241,9 +232,6 @@ static int user_busy_processes (const char *name, uid_t uid)
 				}
 				if (check_status (name, task_path+6, uid) != 0) {
 					(void) closedir (proc);
-#ifdef ENABLE_SUBIDS
-					sub_uid_close();
-#endif
 					fprintf (stderr,
 					         _("%s: user %s is currently used by process %d\n"),
 					         Prog, name, pid);
--- a/man/Makefile.am
+++ b/man/Makefile.am
@@ -215,4 +215,5 @@ $(man_MANS):
 	@echo "Error: you need to run configure with '--enable-man'"
 	@echo "       in order to regenerate man pages."
 	@echo ""
+	@false
 endif
--- a/man/chgpasswd.8.xml
+++ b/man/chgpasswd.8.xml
@@ -92,7 +92,7 @@
    <para>
      The default encryption algorithm can be defined for the system with
      the <option>ENCRYPT_METHOD</option> variable of <filename>/etc/login.defs</filename>,
-      and can be overwritten with the <option>-e</option>,
+      and can be overwiten with the <option>-e</option>,
      <option>-m</option>, or <option>-c</option> options.
    </para>
    <para>
--- a/man/chpasswd.8.xml
+++ b/man/chpasswd.8.xml
@@ -98,7 +98,7 @@
      The default encryption algorithm can be defined for the system with
      the <option>ENCRYPT_METHOD</option> or
      <option>MD5_CRYPT_ENAB</option> variables of
-      <filename>/etc/login.defs</filename>, and can be overwritten with the
+      <filename>/etc/login.defs</filename>, and can be overwitten with the
      <option>-e</option>, <option>-m</option>, or <option>-c</option>
      options.
    </para>
@@ -112,7 +112,7 @@
      <phrase condition="pam">Except when PAM is used to encrypt the
      passwords,</phrase> <command>chpasswd</command> first updates all the
      passwords in memory, and then commits all the changes to disk if no
-      errors occurred for any user.
+      errors occured for any user.
    </para>
    <para condition="pam">
      When PAM is used to encrypt the passwords (and update the passwords in
--- a/man/generate_mans.mak
+++ b/man/generate_mans.mak
@@ -42,11 +42,12 @@ man1/% man3/% man5/% man8/%: %.xml-config Makefile config.xml
 	            -nonet http://docbook.sourceforge.net/release/xsl/current/manpages/profile-docbook.xsl $<

 clean-local:
-	rm -rf man1 man3 man5 man8
+	for d in man1 man3 man5 man8; do [ -d $$d ] && rmdir $$d; done

 else
 $(man_MANS):
 	@echo you need to run configure with --enable-man to generate man pages
+	@false
 endif

 man8/grpconv.8 man8/grpunconv.8 man8/pwunconv.8: man8/pwconv.8
--- a/man/generate_translations.mak
+++ b/man/generate_translations.mak
@@ -14,6 +14,7 @@ include ../generate_mans.mak
 else
 $(man_MANS):
 	@echo you need to run configure with --enable-man to generate man pages
+	@false
 endif

 CLEANFILES = .xml2po.mo $(EXTRA_DIST) $(addsuffix .xml,$(EXTRA_DIST)) config.xml
--- a/man/groupmems.8.xml
+++ b/man/groupmems.8.xml
@@ -106,7 +106,7 @@
      <varlistentry>
 	<term><option>-a</option>, <option>--add</option>&nbsp;<replaceable>user_name</replaceable></term>
 	<listitem>
-	  <para>Add a user to the group membership list.</para>
+	  <para>Add an user to the group membership list.</para>
 	  <para condition="gshadow">
 	    If the <filename>/etc/gshadow</filename> file exist, and the
 	    group has no entry in the <filename>/etc/gshadow</filename>
--- a/man/gshadow.5.xml
+++ b/man/gshadow.5.xml
@@ -95,7 +95,7 @@
 	    group (but group members do not need the password).
 	  </para>
 	  <para>
-	    The password is used when a user who is not a member of the
+	    The password is used when an user who is not a member of the
 	    group wants to gain the permissions of this group (see
 	    <citerefentry><refentrytitle>newgrp</refentrytitle>
 	    <manvolnum>1</manvolnum></citerefentry>).
@@ -105,7 +105,7 @@
 	    can gain the group permissions.
 	  </para>
 	  <para>
-	    A password field which starts with an exclamation mark means
+	    A password field which starts with a exclamation mark means
 	    that the password is locked.  The remaining characters on the
 	    line represent the password field before the password was
 	    locked.
--- a/man/lastlog.8.xml
+++ b/man/lastlog.8.xml
@@ -103,17 +103,6 @@
 	  </para>
 	</listitem>
      </varlistentry>
-      <varlistentry>
-	<term>
-	  <option>-C</option>, <option>--clear</option>
-	</term>
-	<listitem>
-	  <para>
-	    Clear lastlog record of a user. This option can be used only together
-	    with <option>-u</option> (<option>--user</option>)).
-	  </para>
-	</listitem>
-      </varlistentry>
      <varlistentry>
 	<term>
 	  <option>-h</option>, <option>--help</option>
@@ -134,17 +123,6 @@
 	  </para>
 	</listitem>
      </varlistentry>
-      <varlistentry>
-	<term>
-	  <option>-S</option>, <option>--set</option>
-	</term>
-	<listitem>
-	  <para>
-	    Set lastlog record of a user to the current time. This option can be
-	    used only together with <option>-u</option> (<option>--user</option>)).
-	  </para>
-	</listitem>
-      </varlistentry>
      <varlistentry>
 	<term>
 	  <option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAYS</replaceable>
--- a/man/limits.5.xml
+++ b/man/limits.5.xml
@@ -108,7 +108,7 @@
      <listitem><para>A: max address space (KB)</para></listitem>
      <listitem><para>C: max core file size (KB)</para></listitem>
      <listitem><para>D: max data size (KB)</para></listitem>
-      <listitem><para>F: maximum file size (KB)</para></listitem>
+      <listitem><para>F: maximum filesize (KB)</para></listitem>
      <listitem><para>K: file creation mask, set by
 	<citerefentry>
 	  <refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum>
@@ -145,7 +145,7 @@
    <para>
      Be aware that after <emphasis remap='I'>username</emphasis> the rest
      of the line is considered a limit string, thus comments are not
-      allowed. An invalid limits string will be rejected (not considered) by
+      allowed. A invalid limits string will be rejected (not considered) by
      the <command>login</command> program.
    </para>

@@ -163,12 +163,12 @@
    </para>

    <para>
-      If more than one line with limits for a user exist, only the first line for
+      If more than one line with limits for an user exist, only the first line for
      this user will be considered.
    </para>

    <para>
-      If no lines are specified for a user, the last
+      If no lines are specified for an user, the last
      <replaceable>@group</replaceable> line matching a group whose the
      user is a member of will be considered, or the last line with
      default limits if no groups contain the user.
--- a/man/newgidmap.1.xml
+++ b/man/newgidmap.1.xml
@@ -61,6 +61,9 @@
 	<replaceable>count</replaceable>
      </arg>
      <arg choice='opt'>
+	<arg choice='plain'>
+	  <replaceable>pid</replaceable>
+	</arg>
 	<arg choice='plain'>
 	  <replaceable>gid</replaceable>
 	</arg>
@@ -80,10 +83,8 @@
  <refsect1 id='description'>
    <title>DESCRIPTION</title>
    <para>
-      The <command>newgidmap</command> sets <filename>/proc/[pid]/gid_map</filename> based on its
+      The <command>newgidmap</command> sets <filename>/proc/[pid]/gid_map</filename> based on it's
      command line arguments and the gids allowed in <filename>/etc/subgid</filename>.
-      Note that the root user is not exempted from the requirement for a valid
-      <filename>/etc/subgid</filename> entry.
    </para>

    <para>
@@ -93,7 +94,7 @@
 	  <term>gid</term>
 	  <listitem>
 	    <para>
-	      Beginning of the range of GIDs inside the user namespace.
+	      Begining of the range of GIDs inside the user namespace.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -101,7 +102,7 @@
 	  <term>lowergid</term>
 	  <listitem>
 	    <para>
-	      Beginning of the range of GIDs outside the user namespace.
+	      Begining of the range of GIDs outside the user namespace.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -145,7 +146,7 @@
      <varlistentry>
 	<term><filename>/etc/subgid</filename></term>
 	<listitem>
-	  <para>List of user's subordinate group IDs.</para>
+	  <para>List of users subordinate group IDs.</para>
 	</listitem>
      </varlistentry>
      <varlistentry>
--- a/man/newuidmap.1.xml
+++ b/man/newuidmap.1.xml
@@ -80,10 +80,8 @@
  <refsect1 id='description'>
    <title>DESCRIPTION</title>
    <para>
-      The <command>newuidmap</command> sets <filename>/proc/[pid]/uid_map</filename> based on its
+      The <command>newuidmap</command> sets <filename>/proc/[pid]/uid_map</filename> based on it's
      command line arguments and the uids allowed in <filename>/etc/subuid</filename>.
-      Note that the root user is not exempted from the requirement for a valid
-      <filename>/etc/subuid</filename> entry.
    </para>

    <para>
@@ -93,7 +91,7 @@
 	  <term>uid</term>
 	  <listitem>
 	    <para>
-	      Beginning of the range of UIDs inside the user namespace.
+	      Begining of the range of UIDs inside the user namespace.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -101,7 +99,7 @@
 	  <term>loweruid</term>
 	  <listitem>
 	    <para>
-	      Beginning of the range of UIDs outside the user namespace.
+	      Begining of the range of UIDs outside the user namespace.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -144,7 +142,7 @@
      <varlistentry>
 	<term><filename>/etc/subuid</filename></term>
 	<listitem>
-	  <para>List of user's subordinate user IDs.</para>
+	  <para>List of users subordinate user IDs.</para>
 	</listitem>
      </varlistentry>
      <varlistentry>
--- a/man/newusers.8.xml
+++ b/man/newusers.8.xml
@@ -115,7 +115,7 @@
 	  </para>
 	  <para>
 	    It can be the name of a new user or the name of an existing
-	    user (or a user created before by
+	    user (or an user created before by
 	    <command>newusers</command>).  In case of an existing user,
 	    the user's information will be changed, otherwise a new user
 	    will be created.
@@ -142,7 +142,7 @@
 	    This field is used to define the UID of the user.
 	  </para>
 	  <para>
-	    If the field is empty, a new (unused) UID will be defined
+	    If the field is empty, an new (unused) UID will be defined
 	    automatically by <command>newusers</command>.
 	  </para>
 	  <para>
@@ -151,7 +151,7 @@
 	  </para>
 	  <para>
 	    If this field contains the name of an existing user (or the
-	    name of a user created before by
+	    name of an user created before by
 	    <command>newusers</command>), the UID of the specified user
 	    will be used.
 	  </para>
--- a/man/nologin.8.xml
+++ b/man/nologin.8.xml
@@ -89,7 +89,7 @@
  <refsect1 id='history'>
    <title>HISTORY</title>
    <para>
-      The <command>nologin</command> command appeared in BSD 4.4.
+      The <command>nologin</command> command appearred in BSD 4.4.
    </para>
  </refsect1>
 </refentry>
--- a/man/passwd.1.xml
+++ b/man/passwd.1.xml
@@ -164,7 +164,7 @@
      </para>

      <para>
-	You can find advice on how to choose a strong password on
+	You can find advices on how to choose a strong password on
 	http://en.wikipedia.org/wiki/Password_strength
      </para>
    </refsect2>
--- a/man/po/da.po
+++ b/man/po/da.po
@@ -20,7 +20,7 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: shadow-man\n"
-"POT-Creation-Date: 2016-09-18 14:03-0500\n"
+"POT-Creation-Date: 2013-08-23 01:54+0200\n"
 "PO-Revision-Date: 2013-08-23 01:35+0200\n"
 "Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
 "Language-Team: Danish <debian-l10n-danish@lists.debian.org>\n"
@@ -68,15 +68,16 @@ msgstr ""
 #: useradd.8.xml:62(surname) suauth.5.xml:45(surname) su.1.xml:62(surname)
 #: sg.1.xml:46(surname) shadow.5.xml:45(surname) shadow.3.xml:45(surname)
 #: pwconv.8.xml:51(surname) pwck.8.xml:51(surname) porttime.5.xml:45(surname)
-#: passwd.5.xml:45(surname) passwd.1.xml:52(surname) newusers.8.xml:60(surname)
-#: newgrp.1.xml:46(surname) logoutd.8.xml:45(surname)
-#: login.defs.5.xml:110(surname) login.access.5.xml:46(surname)
-#: login.1.xml:78(surname) limits.5.xml:47(surname) lastlog.8.xml:46(surname)
-#: grpck.8.xml:46(surname) groups.1.xml:45(surname) groupmod.8.xml:46(surname)
+#: passwd.5.xml:45(surname) passwd.1.xml:52(surname)
+#: newusers.8.xml:60(surname) newgrp.1.xml:46(surname)
+#: logoutd.8.xml:45(surname) login.defs.5.xml:110(surname)
+#: login.access.5.xml:46(surname) login.1.xml:78(surname)
+#: limits.5.xml:47(surname) lastlog.8.xml:46(surname) grpck.8.xml:46(surname)
+#: groups.1.xml:45(surname) groupmod.8.xml:46(surname)
 #: groupmems.8.xml:49(surname) groupdel.8.xml:46(surname)
 #: groupadd.8.xml:48(surname) gpasswd.1.xml:50(surname)
-#: faillog.8.xml:45(surname) faillog.5.xml:45(surname) expiry.1.xml:49(surname)
-#: chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
+#: faillog.8.xml:45(surname) faillog.5.xml:45(surname)
+#: expiry.1.xml:49(surname) chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
 #: chgpasswd.8.xml:45(surname) chfn.1.xml:48(surname) chage.1.xml:46(surname)
 msgid "Kłoczko"
 msgstr ""
@@ -101,16 +102,17 @@ msgstr ""
 #: useradd.8.xml:64(contrib) suauth.5.xml:47(contrib) su.1.xml:64(contrib)
 #: sg.1.xml:48(contrib) shadow.5.xml:47(contrib) shadow.3.xml:47(contrib)
 #: pwconv.8.xml:53(contrib) pwck.8.xml:53(contrib) porttime.5.xml:47(contrib)
-#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib) newusers.8.xml:62(contrib)
-#: newgrp.1.xml:48(contrib) logoutd.8.xml:47(contrib)
-#: login.defs.5.xml:112(contrib) login.access.5.xml:48(contrib)
-#: login.1.xml:80(contrib) limits.5.xml:49(contrib) lastlog.8.xml:48(contrib)
-#: grpck.8.xml:48(contrib) groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
+#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib)
+#: newusers.8.xml:62(contrib) newgrp.1.xml:48(contrib)
+#: logoutd.8.xml:47(contrib) login.defs.5.xml:112(contrib)
+#: login.access.5.xml:48(contrib) login.1.xml:80(contrib)
+#: limits.5.xml:49(contrib) lastlog.8.xml:48(contrib) grpck.8.xml:48(contrib)
+#: groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
 #: groupmems.8.xml:51(contrib) groupdel.8.xml:48(contrib)
 #: groupadd.8.xml:50(contrib) gpasswd.1.xml:52(contrib)
-#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib) expiry.1.xml:51(contrib)
-#: chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib) chfn.1.xml:50(contrib)
-#: chage.1.xml:48(contrib)
+#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib)
+#: expiry.1.xml:51(contrib) chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib)
+#: chfn.1.xml:50(contrib) chage.1.xml:48(contrib)
 msgid "shadow-utils maintainer, 2000 - 2007"
 msgstr ""

@@ -144,13 +146,14 @@ msgstr ""
 #: newusers.8.xml:66(surname) newgrp.1.xml:52(surname)
 #: logoutd.8.xml:51(surname) login.defs.5.xml:116(surname)
 #: login.access.5.xml:52(surname) login.1.xml:84(surname)
-#: limits.5.xml:53(surname) lastlog.8.xml:52(surname) gshadow.5.xml:39(surname)
-#: grpck.8.xml:52(surname) groups.1.xml:51(surname) groupmod.8.xml:52(surname)
-#: groupmems.8.xml:55(surname) groupdel.8.xml:52(surname)
-#: groupadd.8.xml:54(surname) gpasswd.1.xml:56(surname)
-#: faillog.8.xml:51(surname) faillog.5.xml:51(surname) expiry.1.xml:55(surname)
-#: chsh.1.xml:54(surname) chpasswd.8.xml:55(surname)
-#: chgpasswd.8.xml:51(surname) chfn.1.xml:54(surname) chage.1.xml:52(surname)
+#: limits.5.xml:53(surname) lastlog.8.xml:52(surname)
+#: gshadow.5.xml:39(surname) grpck.8.xml:52(surname) groups.1.xml:51(surname)
+#: groupmod.8.xml:52(surname) groupmems.8.xml:55(surname)
+#: groupdel.8.xml:52(surname) groupadd.8.xml:54(surname)
+#: gpasswd.1.xml:56(surname) faillog.8.xml:51(surname)
+#: faillog.5.xml:51(surname) expiry.1.xml:55(surname) chsh.1.xml:54(surname)
+#: chpasswd.8.xml:55(surname) chgpasswd.8.xml:51(surname)
+#: chfn.1.xml:54(surname) chage.1.xml:52(surname)
 msgid "François"
 msgstr ""

@@ -179,13 +182,14 @@ msgstr ""
 #: newusers.8.xml:68(contrib) newgrp.1.xml:54(contrib)
 #: logoutd.8.xml:53(contrib) login.defs.5.xml:118(contrib)
 #: login.access.5.xml:54(contrib) login.1.xml:86(contrib)
-#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib) gshadow.5.xml:42(contrib)
-#: grpck.8.xml:54(contrib) groups.1.xml:53(contrib) groupmod.8.xml:54(contrib)
-#: groupmems.8.xml:57(contrib) groupdel.8.xml:54(contrib)
-#: groupadd.8.xml:56(contrib) gpasswd.1.xml:58(contrib)
-#: faillog.8.xml:53(contrib) faillog.5.xml:53(contrib) expiry.1.xml:57(contrib)
-#: chsh.1.xml:56(contrib) chpasswd.8.xml:57(contrib)
-#: chgpasswd.8.xml:53(contrib) chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
+#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib)
+#: gshadow.5.xml:42(contrib) grpck.8.xml:54(contrib) groups.1.xml:53(contrib)
+#: groupmod.8.xml:54(contrib) groupmems.8.xml:57(contrib)
+#: groupdel.8.xml:54(contrib) groupadd.8.xml:56(contrib)
+#: gpasswd.1.xml:58(contrib) faillog.8.xml:53(contrib)
+#: faillog.5.xml:53(contrib) expiry.1.xml:57(contrib) chsh.1.xml:56(contrib)
+#: chpasswd.8.xml:57(contrib) chgpasswd.8.xml:53(contrib)
+#: chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
 msgid "shadow-utils maintainer, 2007 - now"
 msgstr ""

@@ -257,13 +261,14 @@ msgstr ""
 #: useradd.8.xml:88(replaceable) useradd.8.xml:100(replaceable)
 #: su.1.xml:88(replaceable) pwconv.8.xml:81(replaceable)
 #: pwconv.8.xml:87(replaceable) pwconv.8.xml:93(replaceable)
-#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg) passwd.1.xml:79(replaceable)
-#: newusers.8.xml:87(replaceable) lastlog.8.xml:73(replaceable)
-#: grpck.8.xml:72(arg) groupmod.8.xml:73(replaceable)
-#: groupdel.8.xml:73(replaceable) groupadd.8.xml:75(replaceable)
-#: faillog.8.xml:72(replaceable) chsh.1.xml:75(replaceable)
-#: chpasswd.8.xml:76(replaceable) chgpasswd.8.xml:72(replaceable)
-#: chfn.1.xml:75(replaceable) chage.1.xml:72(replaceable)
+#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg)
+#: passwd.1.xml:79(replaceable) newusers.8.xml:87(replaceable)
+#: lastlog.8.xml:73(replaceable) grpck.8.xml:72(arg)
+#: groupmod.8.xml:73(replaceable) groupdel.8.xml:73(replaceable)
+#: groupadd.8.xml:75(replaceable) faillog.8.xml:72(replaceable)
+#: chsh.1.xml:75(replaceable) chpasswd.8.xml:76(replaceable)
+#: chgpasswd.8.xml:72(replaceable) chfn.1.xml:75(replaceable)
+#: chage.1.xml:72(replaceable)
 msgid "options"
 msgstr "tilvalg"

@@ -312,10 +317,11 @@ msgstr ""
 #: useradd.8.xml:124(title) su.1.xml:145(title) pwconv.8.xml:187(title)
 #: pwck.8.xml:176(title) passwd.1.xml:174(title) newusers.8.xml:265(title)
 #: login.1.xml:210(title) lastlog.8.xml:91(title) grpck.8.xml:147(title)
-#: groupmod.8.xml:89(title) groupmems.8.xml:100(title) groupdel.8.xml:88(title)
-#: groupadd.8.xml:93(title) gpasswd.1.xml:134(title) faillog.8.xml:89(title)
-#: expiry.1.xml:91(title) chsh.1.xml:95(title) chpasswd.8.xml:130(title)
-#: chgpasswd.8.xml:105(title) chfn.1.xml:111(title) chage.1.xml:91(title)
+#: groupmod.8.xml:89(title) groupmems.8.xml:100(title)
+#: groupdel.8.xml:88(title) groupadd.8.xml:93(title) gpasswd.1.xml:134(title)
+#: faillog.8.xml:89(title) expiry.1.xml:91(title) chsh.1.xml:95(title)
+#: chpasswd.8.xml:130(title) chgpasswd.8.xml:105(title) chfn.1.xml:111(title)
+#: chage.1.xml:91(title)
 msgid "OPTIONS"
 msgstr "TILVALG"

@@ -337,7 +343,7 @@ msgstr "Rediger gruppedatabase."

 #: vipw.8.xml:120(term) userdel.8.xml:123(term) useradd.8.xml:266(term)
 #: pwconv.8.xml:195(term) pwck.8.xml:186(term) passwd.1.xml:214(term)
-#: newusers.8.xml:283(term) lastlog.8.xml:118(term) grpck.8.xml:157(term)
+#: newusers.8.xml:283(term) lastlog.8.xml:107(term) grpck.8.xml:157(term)
 #: groupmod.8.xml:129(term) groupmems.8.xml:142(term) groupdel.8.xml:95(term)
 #: groupadd.8.xml:131(term) gpasswd.1.xml:173(term) faillog.8.xml:122(term)
 #: expiry.1.xml:112(term) chsh.1.xml:101(term) chpasswd.8.xml:171(term)
@@ -347,7 +353,7 @@ msgstr "<option>-h</option>, <option>--help</option>"

 #: vipw.8.xml:122(para) userdel.8.xml:125(para) useradd.8.xml:268(para)
 #: pwconv.8.xml:197(para) pwck.8.xml:188(para) passwd.1.xml:216(para)
-#: newusers.8.xml:285(para) lastlog.8.xml:122(para) grpck.8.xml:159(para)
+#: newusers.8.xml:285(para) lastlog.8.xml:111(para) grpck.8.xml:159(para)
 #: groupmod.8.xml:131(para) groupmems.8.xml:144(para) groupdel.8.xml:97(para)
 #: groupadd.8.xml:133(para) gpasswd.1.xml:175(para) faillog.8.xml:124(para)
 #: expiry.1.xml:114(para) chsh.1.xml:103(para) chpasswd.8.xml:173(para)
@@ -373,7 +379,7 @@ msgstr "Stille tilstand."

 #: vipw.8.xml:138(term) usermod.8.xml:311(term) userdel.8.xml:146(term)
 #: useradd.8.xml:445(term) pwconv.8.xml:201(term) pwck.8.xml:209(term)
-#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:126(term)
+#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:115(term)
 #: grpck.8.xml:173(term) groupmod.8.xml:178(term) groupmems.8.xml:165(term)
 #: groupdel.8.xml:101(term) groupadd.8.xml:204(term) faillog.8.xml:180(term)
 #: chsh.1.xml:107(term) chpasswd.8.xml:188(term) chgpasswd.8.xml:146(term)
@@ -387,7 +393,7 @@ msgstr ""

 #: vipw.8.xml:142(para) usermod.8.xml:315(para) userdel.8.xml:150(para)
 #: useradd.8.xml:449(para) pwconv.8.xml:205(para) pwck.8.xml:213(para)
-#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:130(para)
+#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:119(para)
 #: grpck.8.xml:177(para) groupmod.8.xml:182(para) groupmems.8.xml:169(para)
 #: groupdel.8.xml:105(para) groupadd.8.xml:208(para) gpasswd.1.xml:185(para)
 #: faillog.8.xml:184(para) chsh.1.xml:111(para) chpasswd.8.xml:192(para)
@@ -416,18 +422,18 @@ msgstr "<option>-u</option>, <option>--user</option>"
 msgid "Indicates which user's tcb shadow file to edit."
 msgstr "Indikerer hvilken brugers tcb-shadowfil at redigere."

-#: vipw.8.xml:165(title) usermod.8.xml:496(title) userdel.8.xml:171(title)
+#: vipw.8.xml:165(title) usermod.8.xml:497(title) userdel.8.xml:171(title)
 #: useradd.8.xml:647(title) su.1.xml:339(title) sg.1.xml:98(title)
 #: pwconv.8.xml:227(title) pwck.8.xml:252(title) passwd.1.xml:390(title)
 #: newusers.8.xml:362(title) newgrp.1.xml:109(title) login.1.xml:294(title)
 #: grpck.8.xml:209(title) groupmod.8.xml:193(title) groupmems.8.xml:199(title)
-#: groupdel.8.xml:128(title) groupadd.8.xml:219(title) gpasswd.1.xml:264(title)
-#: chsh.1.xml:154(title) chpasswd.8.xml:239(title) chgpasswd.8.xml:198(title)
-#: chfn.1.xml:193(title) chage.1.xml:244(title)
+#: groupdel.8.xml:128(title) groupadd.8.xml:219(title)
+#: gpasswd.1.xml:264(title) chsh.1.xml:154(title) chpasswd.8.xml:239(title)
+#: chgpasswd.8.xml:198(title) chfn.1.xml:193(title) chage.1.xml:244(title)
 msgid "CONFIGURATION"
 msgstr "KONFIGURATION"

-#: vipw.8.xml:166(para) usermod.8.xml:497(para) userdel.8.xml:172(para)
+#: vipw.8.xml:166(para) usermod.8.xml:498(para) userdel.8.xml:172(para)
 #: useradd.8.xml:648(para) su.1.xml:340(para) sg.1.xml:99(para)
 #: pwck.8.xml:253(para) passwd.1.xml:391(para) newusers.8.xml:363(para)
 #: newgrp.1.xml:110(para) login.1.xml:295(para) grpck.8.xml:210(para)
@@ -482,35 +488,37 @@ msgstr ""
 "Redigeringsprogram der skal bruges hvis <option>VISUAL</option> ikke er "
 "angivet."

-#: vipw.8.xml:195(title) usermod.8.xml:513(title) userdel.8.xml:188(title)
+#: vipw.8.xml:195(title) usermod.8.xml:514(title) userdel.8.xml:188(title)
 #: useradd.8.xml:675(title) suauth.5.xml:193(title) su.1.xml:367(title)
 #: sg.1.xml:110(title) shadow.5.xml:255(title) shadow.3.xml:226(title)
 #: pwconv.8.xml:250(title) pwck.8.xml:269(title) porttime.5.xml:130(title)
 #: passwd.5.xml:141(title) passwd.1.xml:408(title) newusers.8.xml:397(title)
 #: newgrp.1.xml:121(title) logoutd.8.xml:89(title)
-#: login.access.5.xml:121(title) login.1.xml:338(title) limits.5.xml:196(title)
-#: lastlog.8.xml:204(title) gshadow.5.xml:156(title) grpck.8.xml:221(title)
-#: groups.1.xml:100(title) groupmod.8.xml:205(title) groupmems.8.xml:211(title)
-#: groupdel.8.xml:140(title) groupadd.8.xml:233(title) gpasswd.1.xml:279(title)
-#: faillog.8.xml:243(title) faillog.5.xml:96(title) expiry.1.xml:121(title)
-#: chsh.1.xml:167(title) chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title)
-#: chfn.1.xml:207(title) chage.1.xml:256(title)
+#: login.access.5.xml:121(title) login.1.xml:338(title)
+#: limits.5.xml:196(title) lastlog.8.xml:182(title) gshadow.5.xml:156(title)
+#: grpck.8.xml:221(title) groups.1.xml:100(title) groupmod.8.xml:205(title)
+#: groupmems.8.xml:211(title) groupdel.8.xml:140(title)
+#: groupadd.8.xml:233(title) gpasswd.1.xml:279(title) faillog.8.xml:243(title)
+#: faillog.5.xml:96(title) expiry.1.xml:121(title) chsh.1.xml:167(title)
+#: chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title) chfn.1.xml:207(title)
+#: chage.1.xml:256(title)
 msgid "FILES"
 msgstr "FILER"

-#: vipw.8.xml:198(filename) usermod.8.xml:516(filename)
+#: vipw.8.xml:198(filename) usermod.8.xml:517(filename)
 #: userdel.8.xml:191(filename) useradd.8.xml:690(filename)
-#: sg.1.xml:125(filename) pwck.8.xml:272(filename) newusers.8.xml:412(filename)
-#: newgrp.1.xml:136(filename) gshadow.5.xml:159(filename)
-#: grpck.8.xml:224(filename) groups.1.xml:103(filename)
-#: groupmod.8.xml:208(filename) groupmems.8.xml:214(filename)
-#: groupdel.8.xml:143(filename) groupadd.8.xml:236(filename)
-#: gpasswd.1.xml:72(filename) gpasswd.1.xml:75(filename)
-#: gpasswd.1.xml:282(filename) chgpasswd.8.xml:216(filename)
+#: sg.1.xml:125(filename) pwck.8.xml:272(filename)
+#: newusers.8.xml:412(filename) newgrp.1.xml:136(filename)
+#: gshadow.5.xml:159(filename) grpck.8.xml:224(filename)
+#: groups.1.xml:103(filename) groupmod.8.xml:208(filename)
+#: groupmems.8.xml:214(filename) groupdel.8.xml:143(filename)
+#: groupadd.8.xml:236(filename) gpasswd.1.xml:72(filename)
+#: gpasswd.1.xml:75(filename) gpasswd.1.xml:282(filename)
+#: chgpasswd.8.xml:216(filename)
 msgid "/etc/group"
 msgstr "/etc/group"

-#: vipw.8.xml:200(para) usermod.8.xml:518(para) userdel.8.xml:193(para)
+#: vipw.8.xml:200(para) usermod.8.xml:519(para) userdel.8.xml:193(para)
 #: useradd.8.xml:692(para) sg.1.xml:127(para) pwck.8.xml:274(para)
 #: newusers.8.xml:414(para) newgrp.1.xml:138(para) gshadow.5.xml:161(para)
 #: grpck.8.xml:226(para) groups.1.xml:105(para) groupmod.8.xml:210(para)
@@ -519,7 +527,7 @@ msgstr "/etc/group"
 msgid "Group account information."
 msgstr "Information om gruppekonto."

-#: vipw.8.xml:204(filename) usermod.8.xml:522(filename)
+#: vipw.8.xml:204(filename) usermod.8.xml:523(filename)
 #: useradd.8.xml:696(filename) sg.1.xml:131(filename)
 #: newusers.8.xml:418(filename) newgrp.1.xml:142(filename)
 #: gshadow.5.xml:165(filename) grpck.8.xml:230(filename)
@@ -530,7 +538,7 @@ msgstr "Information om gruppekonto."
 msgid "/etc/gshadow"
 msgstr "/etc/gshadow"

-#: vipw.8.xml:206(para) usermod.8.xml:524(para) useradd.8.xml:698(para)
+#: vipw.8.xml:206(para) usermod.8.xml:525(para) useradd.8.xml:698(para)
 #: sg.1.xml:133(para) newusers.8.xml:420(para) newgrp.1.xml:144(para)
 #: gshadow.5.xml:167(para) grpck.8.xml:232(para) groupmod.8.xml:216(para)
 #: groupdel.8.xml:151(para) groupadd.8.xml:244(para) gpasswd.1.xml:290(para)
@@ -538,7 +546,7 @@ msgstr "/etc/gshadow"
 msgid "Secure group account information."
 msgstr "Information om sikret gruppekonto."

-#: vipw.8.xml:210(filename) usermod.8.xml:534(filename)
+#: vipw.8.xml:210(filename) usermod.8.xml:535(filename)
 #: userdel.8.xml:203(filename) useradd.8.xml:678(filename)
 #: su.1.xml:370(filename) sg.1.xml:113(filename) shadow.5.xml:258(filename)
 #: pwck.8.xml:278(filename) passwd.5.xml:144(filename)
@@ -551,7 +559,7 @@ msgstr "Information om sikret gruppekonto."
 msgid "/etc/passwd"
 msgstr "/etc/passwd"

-#: vipw.8.xml:212(para) usermod.8.xml:536(para) userdel.8.xml:205(para)
+#: vipw.8.xml:212(para) usermod.8.xml:537(para) userdel.8.xml:205(para)
 #: useradd.8.xml:680(para) su.1.xml:372(para) sg.1.xml:115(para)
 #: shadow.5.xml:260(para) pwck.8.xml:280(para) passwd.5.xml:146(para)
 #: passwd.1.xml:413(para) newusers.8.xml:402(para) newgrp.1.xml:126(para)
@@ -561,7 +569,7 @@ msgstr "/etc/passwd"
 msgid "User account information."
 msgstr "Information om brugerkonto."

-#: vipw.8.xml:216(filename) usermod.8.xml:540(filename)
+#: vipw.8.xml:216(filename) usermod.8.xml:541(filename)
 #: userdel.8.xml:209(filename) useradd.8.xml:684(filename)
 #: su.1.xml:376(filename) sg.1.xml:119(filename) shadow.5.xml:264(filename)
 #: shadow.3.xml:229(filename) pwck.8.xml:284(filename)
@@ -572,7 +580,7 @@ msgstr "Information om brugerkonto."
 msgid "/etc/shadow"
 msgstr "/etc/shadow"

-#: vipw.8.xml:218(para) usermod.8.xml:542(para) userdel.8.xml:211(para)
+#: vipw.8.xml:218(para) usermod.8.xml:543(para) userdel.8.xml:211(para)
 #: useradd.8.xml:686(para) su.1.xml:378(para) sg.1.xml:121(para)
 #: shadow.5.xml:266(para) shadow.3.xml:231(para) pwck.8.xml:286(para)
 #: passwd.1.xml:419(para) newusers.8.xml:408(para) newgrp.1.xml:132(para)
@@ -581,7 +589,7 @@ msgstr "/etc/shadow"
 msgid "Secure user account information."
 msgstr "Information om sikret brugerkonto."

-#: vipw.8.xml:225(title) usermod.8.xml:561(title) userdel.8.xml:308(title)
+#: vipw.8.xml:225(title) usermod.8.xml:562(title) userdel.8.xml:308(title)
 #: useradd.8.xml:804(title) suauth.5.xml:222(title) su.1.xml:438(title)
 #: sg.1.xml:140(title) shadow.5.xml:283(title) shadow.3.xml:238(title)
 #: pwconv.8.xml:262(title) pwck.8.xml:344(title) porttime.5.xml:142(title)
@@ -644,15 +652,15 @@ msgstr ""
 #: usermod.8.xml:46(surname) userdel.8.xml:46(surname)
 #: useradd.8.xml:57(surname) su.1.xml:57(surname) sg.1.xml:41(surname)
 #: shadow.5.xml:40(surname) shadow.3.xml:40(surname) pwck.8.xml:46(surname)
-#: porttime.5.xml:40(surname) passwd.5.xml:40(surname) passwd.1.xml:47(surname)
-#: newusers.8.xml:55(surname) newgrp.1.xml:41(surname)
-#: logoutd.8.xml:40(surname) login.defs.5.xml:105(surname)
-#: login.1.xml:73(surname) lastlog.8.xml:41(surname) grpck.8.xml:41(surname)
-#: groups.1.xml:40(surname) groupmod.8.xml:41(surname)
-#: groupdel.8.xml:41(surname) groupadd.8.xml:43(surname)
-#: faillog.8.xml:40(surname) faillog.5.xml:40(surname) expiry.1.xml:44(surname)
-#: chsh.1.xml:43(surname) chpasswd.8.xml:44(surname) chfn.1.xml:43(surname)
-#: chage.1.xml:41(surname)
+#: porttime.5.xml:40(surname) passwd.5.xml:40(surname)
+#: passwd.1.xml:47(surname) newusers.8.xml:55(surname)
+#: newgrp.1.xml:41(surname) logoutd.8.xml:40(surname)
+#: login.defs.5.xml:105(surname) login.1.xml:73(surname)
+#: lastlog.8.xml:41(surname) grpck.8.xml:41(surname) groups.1.xml:40(surname)
+#: groupmod.8.xml:41(surname) groupdel.8.xml:41(surname)
+#: groupadd.8.xml:43(surname) faillog.8.xml:40(surname)
+#: faillog.5.xml:40(surname) expiry.1.xml:44(surname) chsh.1.xml:43(surname)
+#: chpasswd.8.xml:44(surname) chfn.1.xml:43(surname) chage.1.xml:41(surname)
 msgid "Haugh"
 msgstr ""

@@ -1023,7 +1031,7 @@ msgstr ""
 #| "<option>-f</option>, <option>--inactive</option>&nbsp;"
 #| "<replaceable>INACTIVE</replaceable>"
 msgid ""
-"<option>-v</option>, <option>--add-subuids</option>&nbsp;"
+"<option>-v</option>, <option>--add-sub-uids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-f</option>, <option>--inactive</option>&nbsp;<replaceable>INAKTIV</"
@@ -1052,7 +1060,7 @@ msgstr ""
 #| "<option>-e</option>, <option>--expiredate</option>&nbsp;"
 #| "<replaceable>EXPIRE_DATE</replaceable>"
 msgid ""
-"<option>-V</option>, <option>--del-subuids</option>&nbsp;"
+"<option>-V</option>, <option>--del-sub-uids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-e</option>, <option>--expiredate</option>&nbsp;"
@@ -1065,8 +1073,8 @@ msgstr ""
 #: usermod.8.xml:409(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-subuids</option> and <option>--add-"
-"subuids</option> are specified, the removal of all subordinate uid ranges "
+"users account. When both <option>--del-sub-uids</option> and <option>--add-"
+"sub-uids</option> are specified, the removal of all subordinate uid ranges "
 "happens before any subordinate uid range is added."
 msgstr ""

@@ -1076,7 +1084,7 @@ msgstr ""
 #| "<option>-f</option>, <option>--inactive</option>&nbsp;"
 #| "<replaceable>INACTIVE</replaceable>"
 msgid ""
-"<option>-w</option>, <option>--add-subgids</option>&nbsp;"
+"<option>-w</option>, <option>--add-sub-gids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-f</option>, <option>--inactive</option>&nbsp;<replaceable>INAKTIV</"
@@ -1099,7 +1107,7 @@ msgstr ""
 #| "<option>-e</option>, <option>--expiredate</option>&nbsp;"
 #| "<replaceable>EXPIRE_DATE</replaceable>"
 msgid ""
-"<option>-W</option>, <option>--del-subgids</option>&nbsp;"
+"<option>-W</option>, <option>--del-sub-gids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-e</option>, <option>--expiredate</option>&nbsp;"
@@ -1112,8 +1120,8 @@ msgstr ""
 #: usermod.8.xml:447(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-subgids</option> and <option>--add-"
-"subgids</option> are specified, the removal of all subordinate gid ranges "
+"users account. When both <option>--del-sub-gids</option> and <option>--add-"
+"sub-gids</option> are specified, the removal of all subordinate gid ranges "
 "happens before any subordinate gid range is added."
 msgstr ""

@@ -1135,9 +1143,9 @@ msgstr ""

 #: usermod.8.xml:478(title) userdel.8.xml:281(title) useradd.8.xml:623(title)
 #: su.1.xml:331(title) shadow.3.xml:218(title) passwd.1.xml:372(title)
-#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:216(title)
-#: groupdel.8.xml:116(title) groupadd.8.xml:257(title) gpasswd.1.xml:252(title)
-#: faillog.8.xml:232(title) chpasswd.8.xml:231(title)
+#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:194(title)
+#: groupdel.8.xml:116(title) groupadd.8.xml:257(title)
+#: gpasswd.1.xml:252(title) faillog.8.xml:232(title) chpasswd.8.xml:231(title)
 #: chgpasswd.8.xml:186(title)
 msgid "CAVEATS"
 msgstr ""
@@ -1147,17 +1155,17 @@ msgid ""
 "You must make certain that the named user is not executing any processes "
 "when this command is being executed if the user's numerical user ID, the "
 "user's name, or the user's home directory is being changed. "
-"<command>usermod</command> checks this on Linux. On other platforms it only "
-"uses utmp to check if the user is logged in."
+"<command>usermod</command> checks this on Linux, but only check if the user "
+"is logged in according to utmp on other architectures."
 msgstr ""

-#: usermod.8.xml:486(para)
+#: usermod.8.xml:487(para)
 msgid ""
 "You must change the owner of any <command>crontab</command> files or "
 "<command>at</command> jobs manually."
 msgstr ""

-#: usermod.8.xml:490(para)
+#: usermod.8.xml:491(para)
 msgid "You must make any changes involving NIS on the NIS server."
 msgstr ""

@@ -1388,7 +1396,7 @@ msgid ""
 "algorithm: <placeholder-1/>"
 msgstr ""

-#: usermod.8.xml:528(filename) userdel.8.xml:197(filename)
+#: usermod.8.xml:529(filename) userdel.8.xml:197(filename)
 #: useradd.8.xml:726(filename) su.1.xml:382(filename)
 #: pwconv.8.xml:253(filename) passwd.1.xml:423(filename)
 #: newusers.8.xml:424(filename) login.access.5.xml:124(filename)
@@ -1399,7 +1407,7 @@ msgstr ""
 msgid "/etc/login.defs"
 msgstr ""

-#: usermod.8.xml:530(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
+#: usermod.8.xml:531(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
 #: su.1.xml:384(para) pwconv.8.xml:255(para) passwd.1.xml:425(para)
 #: newusers.8.xml:426(para) login.access.5.xml:126(para) login.1.xml:391(para)
 #: groupmod.8.xml:222(para) groupadd.8.xml:250(para) chsh.1.xml:184(para)
@@ -1407,31 +1415,31 @@ msgstr ""
 msgid "Shadow password suite configuration."
 msgstr ""

-#: usermod.8.xml:546(filename) userdel.8.xml:215(filename)
+#: usermod.8.xml:547(filename) userdel.8.xml:215(filename)
 #: useradd.8.xml:714(filename) newusers.8.xml:436(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subgid"
 msgstr "/etc/suauth"

-#: usermod.8.xml:548(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
+#: usermod.8.xml:549(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
 #: newusers.8.xml:438(para)
 msgid "Per user subordinate group IDs."
 msgstr ""

-#: usermod.8.xml:552(filename) userdel.8.xml:221(filename)
+#: usermod.8.xml:553(filename) userdel.8.xml:221(filename)
 #: useradd.8.xml:720(filename) newusers.8.xml:442(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subuid"
 msgstr "/etc/suauth"

-#: usermod.8.xml:554(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
+#: usermod.8.xml:555(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
 #: newusers.8.xml:444(para)
 msgid "Per user subordinate user IDs."
 msgstr ""

-#: usermod.8.xml:562(para)
+#: usermod.8.xml:563(para)
 #, fuzzy
 #| msgid ""
 #| "<citerefentry><refentrytitle>vi</refentrytitle><manvolnum>1</manvolnum></"
@@ -1645,8 +1653,9 @@ msgstr ""
 #: passwd.1.xml:449(replaceable) newgrp.1.xml:59(manvolnum)
 #: login.1.xml:91(manvolnum) grpck.8.xml:256(replaceable)
 #: groups.1.xml:58(manvolnum) gpasswd.1.xml:63(manvolnum)
-#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum) chfn.1.xml:61(manvolnum)
-#: chage.1.xml:59(manvolnum) chage.1.xml:289(replaceable)
+#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum)
+#: chfn.1.xml:61(manvolnum) chage.1.xml:59(manvolnum)
+#: chage.1.xml:289(replaceable)
 msgid "1"
 msgstr ""

@@ -1967,7 +1976,7 @@ msgid ""
 "<option>PASS_MAX_DAYS</option> and others). <placeholder-1/> Example: "
 "<option>-K</option>&nbsp;<replaceable>PASS_MAX_DAYS</"
 "replaceable>=<replaceable>-1</replaceable> can be used when creating system "
-"account to turn off password aging, even though system account has no "
+"account to turn off password ageing, even though system account has no "
 "password at all. Multiple <option>-K</option> options can be specified, e."
 "g.: <option>-K</option>&nbsp;<replaceable>UID_MIN</"
 "replaceable>=<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;"
@@ -1985,7 +1994,7 @@ msgstr ""
 #: useradd.8.xml:327(para)
 msgid ""
 "By default, the user's entries in the lastlog and faillog databases are "
-"reset to avoid reusing the entry from a previously deleted user."
+"resetted to avoid reusing the entry from a previously deleted user."
 msgstr ""

 #: useradd.8.xml:335(term)
@@ -2005,11 +2014,9 @@ msgid ""
 "is not enabled, no home directories are created."
 msgstr ""

-#: useradd.8.xml:353(term)
-#, fuzzy
-#| msgid "<option>-c</option>, <option>--crypt-method</option>"
-msgid "<option>-M</option>, <option>--no-create-home</option>"
-msgstr "<option>-c</option>, <option>--crypt-method</option>"
+#: useradd.8.xml:354(option)
+msgid "-M"
+msgstr ""

 #: useradd.8.xml:357(para)
 msgid ""
@@ -2074,10 +2081,10 @@ msgstr ""
 #: useradd.8.xml:434(para)
 msgid ""
 "Note that <command>useradd</command> will not create a home directory for "
-"such a user, regardless of the default setting in <filename>/etc/login.defs</"
-"filename> (<option>CREATE_HOME</option>). You have to specify the <option>-"
-"m</option> options if you want a home directory for a system account to be "
-"created."
+"such an user, regardless of the default setting in <filename>/etc/login."
+"defs</filename> (<option>CREATE_HOME</option>). You have to specify the "
+"<option>-m</option> options if you want a home directory for a system "
+"account to be created."
 msgstr ""

 #: useradd.8.xml:461(para)
@@ -2595,7 +2602,7 @@ msgstr ""
 #, no-wrap
 msgid ""
 "\n"
-"      1) the user su is targeting\n"
+"      1) the user su is targetting\n"
 "    "
 msgstr ""

@@ -2629,12 +2636,12 @@ msgstr ""
 #: suauth.5.xml:107(para)
 msgid ""
 "from-id is formatted the same as to-id except the extra word "
-"<emphasis>GROUP</emphasis> is recognized. <emphasis>ALL EXCEPT GROUP</"
+"<emphasis>GROUP</emphasis> is recognised. <emphasis>ALL EXCEPT GROUP</"
 "emphasis> is perfectly valid too. Following <emphasis>GROUP</emphasis> "
 "appears one or more group names, delimited by \",\". It is not sufficient to "
 "have primary group id of the relevant group, an entry in "
 "<citerefentry><refentrytitle>/etc/group</refentrytitle><manvolnum>5</"
-"manvolnum></citerefentry> is necessary."
+"manvolnum></citerefentry> is neccessary."
 msgstr ""

 #: suauth.5.xml:118(para)
@@ -2737,8 +2744,9 @@ msgid ""
 msgstr ""

 #: su.1.xml:58(contrib) shadow.5.xml:41(contrib) shadow.3.xml:41(contrib)
-#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib) passwd.1.xml:48(contrib)
-#: login.1.xml:74(contrib) faillog.8.xml:41(contrib) faillog.5.xml:41(contrib)
+#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib)
+#: passwd.1.xml:48(contrib) login.1.xml:74(contrib) faillog.8.xml:41(contrib)
+#: faillog.5.xml:41(contrib)
 msgid "Creation, 1989"
 msgstr ""

@@ -2837,7 +2845,7 @@ msgstr ""
 #: su.1.xml:158(para)
 msgid ""
 "The executed command will have no controlling terminal. This option cannot "
-"be used to execute interactive programs which need a controlling TTY."
+"be used to execute interractive programs which need a controlling TTY."
 msgstr ""

 #: su.1.xml:168(term)
@@ -3381,7 +3389,7 @@ msgstr ""

 #: shadow.5.xml:117(para) gshadow.5.xml:107(para)
 msgid ""
-"A password field which starts with an exclamation mark means that the "
+"A password field which starts with a exclamation mark means that the "
 "password is locked. The remaining characters on the line represent the "
 "password field before the password was locked."
 msgstr ""
@@ -3399,7 +3407,7 @@ msgstr ""
 #: shadow.5.xml:134(para)
 msgid ""
 "The value 0 has a special meaning, which is that the user should change her "
-"password the next time she will log in the system."
+"pasword the next time she will log in the system."
 msgstr ""

 #: shadow.5.xml:139(para)
@@ -3499,7 +3507,7 @@ msgstr ""
 #: shadow.5.xml:229(para)
 msgid ""
 "Note that an account expiration differs from a password expiration. In case "
-"of an account expiration, the user shall not be allowed to login. In case of "
+"of an acount expiration, the user shall not be allowed to login. In case of "
 "a password expiration, the user is not allowed to login using her password."
 msgstr ""

@@ -3760,15 +3768,18 @@ msgstr ""
 msgid "pwconv"
 msgstr ""

-#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command) login.defs.5.xml:438(term)
+#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command)
+#: login.defs.5.xml:438(term)
 msgid "pwunconv"
 msgstr ""

-#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command) login.defs.5.xml:340(term)
+#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command)
+#: login.defs.5.xml:340(term)
 msgid "grpconv"
 msgstr ""

-#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command) login.defs.5.xml:346(term)
+#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command)
+#: login.defs.5.xml:346(term)
 msgid "grpunconv"
 msgstr ""

@@ -3916,7 +3927,8 @@ msgstr ""

 #: pwck.8.xml:80(replaceable) passwd.5.xml:57(refentrytitle)
 #: passwd.5.xml:64(refname) passwd.1.xml:64(refentrytitle)
-#: passwd.1.xml:71(refname) passwd.1.xml:77(command) login.defs.5.xml:409(term)
+#: passwd.1.xml:71(refname) passwd.1.xml:77(command)
+#: login.defs.5.xml:409(term)
 msgid "passwd"
 msgstr ""

@@ -4059,7 +4071,7 @@ msgstr ""
 msgid ""
 "Note that when <option>USE_TCB</option> is enabled, you cannot specify an "
 "alternative <replaceable>shadow</replaceable> file. In future releases, this "
-"parameter could be replaced by an alternate TCB directory."
+"paramater could be replaced by an alternate TCB directory."
 msgstr ""

 #: pwck.8.xml:312(para)
@@ -4388,12 +4400,8 @@ msgid ""
 msgstr ""

 #: passwd.1.xml:166(para)
-#, fuzzy
-#| msgid ""
-#| "You can find advices on how to choose a strong password on http://en."
-#| "wikipedia.org/wiki/Password_strength"
 msgid ""
-"You can find advice on how to choose a strong password on http://en."
+"You can find advices on how to choose a strong password on http://en."
 "wikipedia.org/wiki/Password_strength"
 msgstr ""
 "Du kan finde råd om hvordan du vælger en god adgangskode på http://en."
@@ -4695,8 +4703,8 @@ msgstr "<option>PASS_MIN_LEN</option> (antal)"
 #: passwd.1.xml:35(para) login.defs.5.xml:35(para)
 msgid ""
 "Number of significant characters in the password for crypt(). "
-"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your "
-"crypt() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
+"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your crypt"
+"() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
 "<replaceable>yes</replaceable>."
 msgstr ""

@@ -4834,9 +4842,7 @@ msgid "HISTORY"
 msgstr "HISTORIK"

 #: nologin.8.xml:91(para)
-#, fuzzy
-#| msgid "The <command>nologin</command> command appearred in BSD 4.4."
-msgid "The <command>nologin</command> command appeared in BSD 4.4."
+msgid "The <command>nologin</command> command appearred in BSD 4.4."
 msgstr "Kommandoen <command>nologin</command> fremkom i BSD 4.4."

 #: newusers.8.xml:72(refentrytitle) newusers.8.xml:79(refname)
@@ -4875,19 +4881,11 @@ msgid "This is the name of the user."
 msgstr "Dette er navnet på brugeren."

 #: newusers.8.xml:116(para)
-#, fuzzy
-#| msgid ""
-#| "If this field contains the name of an existing user (or the name of an "
-#| "user created before by <command>newusers</command>), the UID of the "
-#| "specified user will be used."
 msgid ""
-"It can be the name of a new user or the name of an existing user (or a user "
+"It can be the name of a new user or the name of an existing user (or an user "
 "created before by <command>newusers</command>). In case of an existing user, "
 "the user's information will be changed, otherwise a new user will be created."
 msgstr ""
-"Hvis dette felt indeholder navnet på en eksisterende bruger (eller navnet på "
-"en bruger oprettet før af <command>newusers</command>), så vil UID'en for "
-"den angivne bruger blive brugt."

 #: newusers.8.xml:127(emphasis)
 msgid "pw_passwd"
@@ -4910,12 +4908,8 @@ msgid "This field is used to define the UID of the user."
 msgstr "Dette flet bruges til at definere UID for brugeren."

 #: newusers.8.xml:144(para)
-#, fuzzy
-#| msgid ""
-#| "If the field is empty, an new (unused) UID will be defined automatically "
-#| "by <command>newusers</command>."
 msgid ""
-"If the field is empty, a new (unused) UID will be defined automatically by "
+"If the field is empty, an new (unused) UID will be defined automatically by "
 "<command>newusers</command>."
 msgstr ""
 "Hvis feltet er tomt, vil en ny (ubrugt) UID blive defineret automatisk af "
@@ -4927,13 +4921,8 @@ msgstr ""
 "Hvis dette felt indeholer et tal, så vil dette tal blive brugt som UID'en."

 #: newusers.8.xml:152(para)
-#, fuzzy
-#| msgid ""
-#| "If this field contains the name of an existing user (or the name of an "
-#| "user created before by <command>newusers</command>), the UID of the "
-#| "specified user will be used."
 msgid ""
-"If this field contains the name of an existing user (or the name of a user "
+"If this field contains the name of an existing user (or the name of an user "
 "created before by <command>newusers</command>), the UID of the specified "
 "user will be used."
 msgstr ""
@@ -6192,9 +6181,7 @@ msgid "D: max data size (KB)"
 msgstr "D: Maks. datastørrelse (KB)"

 #: limits.5.xml:111(para)
-#, fuzzy
-#| msgid "F: maximum filesize (KB)"
-msgid "F: maximum file size (KB)"
+msgid "F: maximum filesize (KB)"
 msgstr "F: Maks filstørrelse (KB)"

 #: limits.5.xml:112(para)
@@ -6264,7 +6251,7 @@ msgstr ""
 #: limits.5.xml:145(para)
 msgid ""
 "Be aware that after <emphasis remap=\"I\">username</emphasis> the rest of "
-"the line is considered a limit string, thus comments are not allowed. An "
+"the line is considered a limit string, thus comments are not allowed. A "
 "invalid limits string will be rejected (not considered) by the "
 "<command>login</command> program."
 msgstr ""
@@ -6284,12 +6271,8 @@ msgid ""
 msgstr ""

 #: limits.5.xml:165(para)
-#, fuzzy
-#| msgid ""
-#| "If more than one line with limits for an user exist, only the first line "
-#| "for this user will be considered."
 msgid ""
-"If more than one line with limits for a user exist, only the first line for "
+"If more than one line with limits for an user exist, only the first line for "
 "this user will be considered."
 msgstr ""
 "Hvis mere end en linje med begrænsninger for en bruger findes, så vil kun "
@@ -6297,7 +6280,7 @@ msgstr ""

 #: limits.5.xml:170(para)
 msgid ""
-"If no lines are specified for a user, the last <replaceable>@group</"
+"If no lines are specified for an user, the last <replaceable>@group</"
 "replaceable> line matching a group whose the user is a member of will be "
 "considered, or the last line with default limits if no groups contain the "
 "user."
@@ -6368,53 +6351,29 @@ msgid ""
 "Print only lastlog records older than <emphasis remap=\"I\">DAYS</emphasis>."
 msgstr ""

-#: lastlog.8.xml:107(term)
-#, fuzzy
-#| msgid "<option>-u</option>, <option>--user</option>"
-msgid "<option>-C</option>, <option>--clear</option>"
-msgstr "<option>-u</option>, <option>--user</option>"
-
-#: lastlog.8.xml:111(para)
-msgid ""
-"Clear lastlog record of a user. This option can be used only together with "
-"<option>-u</option> (<option>--user</option>))."
-msgstr ""
-
-#: lastlog.8.xml:138(term)
-#, fuzzy
-#| msgid "<option>-u</option>, <option>--user</option>"
-msgid "<option>-S</option>, <option>--set</option>"
-msgstr "<option>-u</option>, <option>--user</option>"
-
-#: lastlog.8.xml:142(para)
-msgid ""
-"Set lastlog record of a user to the current time. This option can be used "
-"only together with <option>-u</option> (<option>--user</option>))."
-msgstr ""
-
-#: lastlog.8.xml:149(term) faillog.8.xml:192(term)
+#: lastlog.8.xml:127(term) faillog.8.xml:192(term)
 msgid ""
 "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAYS</"
 "replaceable>"
 msgstr ""

-#: lastlog.8.xml:153(para)
+#: lastlog.8.xml:131(para)
 msgid ""
 "Print the lastlog records more recent than <emphasis remap=\"I\">DAYS</"
 "emphasis>."
 msgstr ""

-#: lastlog.8.xml:160(term) faillog.8.xml:202(term)
+#: lastlog.8.xml:138(term) faillog.8.xml:202(term)
 msgid ""
 "<option>-u</option>, <option>--user</option>&nbsp;<replaceable>LOGIN</"
 "replaceable>|<replaceable>RANGE</replaceable>"
 msgstr ""

-#: lastlog.8.xml:164(para)
+#: lastlog.8.xml:142(para)
 msgid "Print the lastlog record of the specified user(s)."
 msgstr ""

-#: lastlog.8.xml:167(para) faillog.8.xml:211(para)
+#: lastlog.8.xml:145(para) faillog.8.xml:211(para)
 msgid ""
 "The users can be specified by a login name, a numerical user ID, or a "
 "<replaceable>RANGE</replaceable> of users. This <replaceable>RANGE</"
@@ -6423,24 +6382,24 @@ msgid ""
 "UID_MAX</replaceable>), or a min value (<replaceable>UID_MIN-</replaceable>)."
 msgstr ""

-#: lastlog.8.xml:179(para)
+#: lastlog.8.xml:157(para)
 msgid ""
 "If the user has never logged in the message <emphasis>** Never logged in**</"
 "emphasis> will be displayed instead of the port and time."
 msgstr ""

-#: lastlog.8.xml:184(para)
+#: lastlog.8.xml:162(para)
 msgid ""
 "Only the entries for the current users of the system will be displayed. "
 "Other entries may exist for users that were deleted previously."
 msgstr ""

-#: lastlog.8.xml:192(title) groups.1.xml:90(title) chsh.1.xml:140(title)
+#: lastlog.8.xml:170(title) groups.1.xml:90(title) chsh.1.xml:140(title)
 #: chage.1.xml:231(title)
 msgid "NOTE"
 msgstr ""

-#: lastlog.8.xml:193(para)
+#: lastlog.8.xml:171(para)
 msgid ""
 "The <filename>lastlog</filename> file is a database which contains info on "
 "the last login of each user. You should not rotate it. It is a sparse file, "
@@ -6450,15 +6409,15 @@ msgid ""
 "its real size with \"<command>ls -s</command>\"."
 msgstr ""

-#: lastlog.8.xml:207(filename)
+#: lastlog.8.xml:185(filename)
 msgid "/var/log/lastlog"
 msgstr "/var/log/lastlog"

-#: lastlog.8.xml:209(para)
+#: lastlog.8.xml:187(para)
 msgid "Database times of previous user logins."
 msgstr "Databasetider for tidligere brugerlogind."

-#: lastlog.8.xml:217(para)
+#: lastlog.8.xml:195(para)
 msgid ""
 "Large gaps in UID numbers will cause the lastlog program to run longer with "
 "no output to the screen (i.e. if in lastlog database there is no entries for "
@@ -6505,19 +6464,11 @@ msgid ""
 msgstr ""

 #: gshadow.5.xml:97(para)
-#, fuzzy
-#| msgid ""
-#| "The new value of the user's password file comment field. It is normally "
-#| "modified using the <citerefentry><refentrytitle>chfn</"
-#| "refentrytitle><manvolnum>1</manvolnum></citerefentry> utility."
 msgid ""
-"The password is used when a user who is not a member of the group wants to "
+"The password is used when an user who is not a member of the group wants to "
 "gain the permissions of this group (see <citerefentry><refentrytitle>newgrp</"
 "refentrytitle><manvolnum>1</manvolnum></citerefentry>)."
 msgstr ""
-"Den nye værdi for brugerens kommentar kommentarfelt i adgangskodefilen. Den "
-"ændres normalt med redskabet <citerefentry><refentrytitle>chfn</"
-"refentrytitle><manvolnum>1</manvolnum></citerefentry>."

 #: gshadow.5.xml:103(para)
 msgid ""
@@ -6916,9 +6867,7 @@ msgid ""
 msgstr ""

 #: groupmems.8.xml:109(para)
-#, fuzzy
-#| msgid "Add an user to the group membership list."
-msgid "Add a user to the group membership list."
+msgid "Add an user to the group membership list."
 msgstr "Tilføj en bruger til listen over gruppemedlemmer."

 #: groupmems.8.xml:110(para) groupmems.8.xml:126(para)
@@ -7684,7 +7633,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> or <option>MD5_CRYPT_ENAB</option> variables "
-"of <filename>/etc/login.defs</filename>, and can be overwritten with the "
+"of <filename>/etc/login.defs</filename>, and can be overwitten with the "
 "<option>-e</option>, <option>-m</option>, or <option>-c</option> options."
 msgstr ""

@@ -7699,7 +7648,7 @@ msgstr ""
 msgid ""
 "<phrase condition=\"pam\">Except when PAM is used to encrypt the passwords,</"
 "phrase><command>chpasswd</command> first updates all the passwords in "
-"memory, and then commits all the changes to disk if no errors occurred for "
+"memory, and then commits all the changes to disk if no errors occured for "
 "any user."
 msgstr ""

@@ -7829,7 +7778,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> variable of <filename>/etc/login.defs</"
-"filename>, and can be overwritten with the <option>-e</option>, <option>-m</"
+"filename>, and can be overwiten with the <option>-e</option>, <option>-m</"
 "option>, or <option>-c</option> options."
 msgstr ""

--- a/man/po/de.po
+++ b/man/po/de.po
--- a/man/po/fr.po
+++ b/man/po/fr.po
--- a/man/po/it.po
+++ b/man/po/it.po
--- a/man/po/pl.po
+++ b/man/po/pl.po
@@ -3,7 +3,7 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: man pages for shadow 4.0.16\n"
-"POT-Creation-Date: 2016-09-18 14:03-0500\n"
+"POT-Creation-Date: 2013-08-23 01:54+0200\n"
 "PO-Revision-Date: 2013-08-23 01:38+0200\n"
 "Last-Translator: Tomasz Kłoczko <kloczek@pld.org.pl>\n"
 "Language-Team: Polish <translation-team-pl@lists.sourceforge.net>\n"
@@ -51,15 +51,16 @@ msgstr ""
 #: useradd.8.xml:62(surname) suauth.5.xml:45(surname) su.1.xml:62(surname)
 #: sg.1.xml:46(surname) shadow.5.xml:45(surname) shadow.3.xml:45(surname)
 #: pwconv.8.xml:51(surname) pwck.8.xml:51(surname) porttime.5.xml:45(surname)
-#: passwd.5.xml:45(surname) passwd.1.xml:52(surname) newusers.8.xml:60(surname)
-#: newgrp.1.xml:46(surname) logoutd.8.xml:45(surname)
-#: login.defs.5.xml:110(surname) login.access.5.xml:46(surname)
-#: login.1.xml:78(surname) limits.5.xml:47(surname) lastlog.8.xml:46(surname)
-#: grpck.8.xml:46(surname) groups.1.xml:45(surname) groupmod.8.xml:46(surname)
+#: passwd.5.xml:45(surname) passwd.1.xml:52(surname)
+#: newusers.8.xml:60(surname) newgrp.1.xml:46(surname)
+#: logoutd.8.xml:45(surname) login.defs.5.xml:110(surname)
+#: login.access.5.xml:46(surname) login.1.xml:78(surname)
+#: limits.5.xml:47(surname) lastlog.8.xml:46(surname) grpck.8.xml:46(surname)
+#: groups.1.xml:45(surname) groupmod.8.xml:46(surname)
 #: groupmems.8.xml:49(surname) groupdel.8.xml:46(surname)
 #: groupadd.8.xml:48(surname) gpasswd.1.xml:50(surname)
-#: faillog.8.xml:45(surname) faillog.5.xml:45(surname) expiry.1.xml:49(surname)
-#: chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
+#: faillog.8.xml:45(surname) faillog.5.xml:45(surname)
+#: expiry.1.xml:49(surname) chsh.1.xml:48(surname) chpasswd.8.xml:49(surname)
 #: chgpasswd.8.xml:45(surname) chfn.1.xml:48(surname) chage.1.xml:46(surname)
 msgid "Kłoczko"
 msgstr ""
@@ -84,16 +85,17 @@ msgstr ""
 #: useradd.8.xml:64(contrib) suauth.5.xml:47(contrib) su.1.xml:64(contrib)
 #: sg.1.xml:48(contrib) shadow.5.xml:47(contrib) shadow.3.xml:47(contrib)
 #: pwconv.8.xml:53(contrib) pwck.8.xml:53(contrib) porttime.5.xml:47(contrib)
-#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib) newusers.8.xml:62(contrib)
-#: newgrp.1.xml:48(contrib) logoutd.8.xml:47(contrib)
-#: login.defs.5.xml:112(contrib) login.access.5.xml:48(contrib)
-#: login.1.xml:80(contrib) limits.5.xml:49(contrib) lastlog.8.xml:48(contrib)
-#: grpck.8.xml:48(contrib) groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
+#: passwd.5.xml:47(contrib) passwd.1.xml:54(contrib)
+#: newusers.8.xml:62(contrib) newgrp.1.xml:48(contrib)
+#: logoutd.8.xml:47(contrib) login.defs.5.xml:112(contrib)
+#: login.access.5.xml:48(contrib) login.1.xml:80(contrib)
+#: limits.5.xml:49(contrib) lastlog.8.xml:48(contrib) grpck.8.xml:48(contrib)
+#: groups.1.xml:47(contrib) groupmod.8.xml:48(contrib)
 #: groupmems.8.xml:51(contrib) groupdel.8.xml:48(contrib)
 #: groupadd.8.xml:50(contrib) gpasswd.1.xml:52(contrib)
-#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib) expiry.1.xml:51(contrib)
-#: chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib) chfn.1.xml:50(contrib)
-#: chage.1.xml:48(contrib)
+#: faillog.8.xml:47(contrib) faillog.5.xml:47(contrib)
+#: expiry.1.xml:51(contrib) chsh.1.xml:50(contrib) chpasswd.8.xml:51(contrib)
+#: chfn.1.xml:50(contrib) chage.1.xml:48(contrib)
 msgid "shadow-utils maintainer, 2000 - 2007"
 msgstr ""

@@ -127,13 +129,14 @@ msgstr ""
 #: newusers.8.xml:66(surname) newgrp.1.xml:52(surname)
 #: logoutd.8.xml:51(surname) login.defs.5.xml:116(surname)
 #: login.access.5.xml:52(surname) login.1.xml:84(surname)
-#: limits.5.xml:53(surname) lastlog.8.xml:52(surname) gshadow.5.xml:39(surname)
-#: grpck.8.xml:52(surname) groups.1.xml:51(surname) groupmod.8.xml:52(surname)
-#: groupmems.8.xml:55(surname) groupdel.8.xml:52(surname)
-#: groupadd.8.xml:54(surname) gpasswd.1.xml:56(surname)
-#: faillog.8.xml:51(surname) faillog.5.xml:51(surname) expiry.1.xml:55(surname)
-#: chsh.1.xml:54(surname) chpasswd.8.xml:55(surname)
-#: chgpasswd.8.xml:51(surname) chfn.1.xml:54(surname) chage.1.xml:52(surname)
+#: limits.5.xml:53(surname) lastlog.8.xml:52(surname)
+#: gshadow.5.xml:39(surname) grpck.8.xml:52(surname) groups.1.xml:51(surname)
+#: groupmod.8.xml:52(surname) groupmems.8.xml:55(surname)
+#: groupdel.8.xml:52(surname) groupadd.8.xml:54(surname)
+#: gpasswd.1.xml:56(surname) faillog.8.xml:51(surname)
+#: faillog.5.xml:51(surname) expiry.1.xml:55(surname) chsh.1.xml:54(surname)
+#: chpasswd.8.xml:55(surname) chgpasswd.8.xml:51(surname)
+#: chfn.1.xml:54(surname) chage.1.xml:52(surname)
 msgid "François"
 msgstr ""

@@ -162,13 +165,14 @@ msgstr ""
 #: newusers.8.xml:68(contrib) newgrp.1.xml:54(contrib)
 #: logoutd.8.xml:53(contrib) login.defs.5.xml:118(contrib)
 #: login.access.5.xml:54(contrib) login.1.xml:86(contrib)
-#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib) gshadow.5.xml:42(contrib)
-#: grpck.8.xml:54(contrib) groups.1.xml:53(contrib) groupmod.8.xml:54(contrib)
-#: groupmems.8.xml:57(contrib) groupdel.8.xml:54(contrib)
-#: groupadd.8.xml:56(contrib) gpasswd.1.xml:58(contrib)
-#: faillog.8.xml:53(contrib) faillog.5.xml:53(contrib) expiry.1.xml:57(contrib)
-#: chsh.1.xml:56(contrib) chpasswd.8.xml:57(contrib)
-#: chgpasswd.8.xml:53(contrib) chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
+#: limits.5.xml:55(contrib) lastlog.8.xml:54(contrib)
+#: gshadow.5.xml:42(contrib) grpck.8.xml:54(contrib) groups.1.xml:53(contrib)
+#: groupmod.8.xml:54(contrib) groupmems.8.xml:57(contrib)
+#: groupdel.8.xml:54(contrib) groupadd.8.xml:56(contrib)
+#: gpasswd.1.xml:58(contrib) faillog.8.xml:53(contrib)
+#: faillog.5.xml:53(contrib) expiry.1.xml:57(contrib) chsh.1.xml:56(contrib)
+#: chpasswd.8.xml:57(contrib) chgpasswd.8.xml:53(contrib)
+#: chfn.1.xml:56(contrib) chage.1.xml:54(contrib)
 msgid "shadow-utils maintainer, 2007 - now"
 msgstr ""

@@ -241,13 +245,14 @@ msgstr "edytuj plik haseł, grup lub ich wersji chronionych"
 #: useradd.8.xml:88(replaceable) useradd.8.xml:100(replaceable)
 #: su.1.xml:88(replaceable) pwconv.8.xml:81(replaceable)
 #: pwconv.8.xml:87(replaceable) pwconv.8.xml:93(replaceable)
-#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg) passwd.1.xml:79(replaceable)
-#: newusers.8.xml:87(replaceable) lastlog.8.xml:73(replaceable)
-#: grpck.8.xml:72(arg) groupmod.8.xml:73(replaceable)
-#: groupdel.8.xml:73(replaceable) groupadd.8.xml:75(replaceable)
-#: faillog.8.xml:72(replaceable) chsh.1.xml:75(replaceable)
-#: chpasswd.8.xml:76(replaceable) chgpasswd.8.xml:72(replaceable)
-#: chfn.1.xml:75(replaceable) chage.1.xml:72(replaceable)
+#: pwconv.8.xml:99(replaceable) pwck.8.xml:77(arg)
+#: passwd.1.xml:79(replaceable) newusers.8.xml:87(replaceable)
+#: lastlog.8.xml:73(replaceable) grpck.8.xml:72(arg)
+#: groupmod.8.xml:73(replaceable) groupdel.8.xml:73(replaceable)
+#: groupadd.8.xml:75(replaceable) faillog.8.xml:72(replaceable)
+#: chsh.1.xml:75(replaceable) chpasswd.8.xml:76(replaceable)
+#: chgpasswd.8.xml:72(replaceable) chfn.1.xml:75(replaceable)
+#: chage.1.xml:72(replaceable)
 msgid "options"
 msgstr "opcje"

@@ -297,10 +302,11 @@ msgstr ""
 #: useradd.8.xml:124(title) su.1.xml:145(title) pwconv.8.xml:187(title)
 #: pwck.8.xml:176(title) passwd.1.xml:174(title) newusers.8.xml:265(title)
 #: login.1.xml:210(title) lastlog.8.xml:91(title) grpck.8.xml:147(title)
-#: groupmod.8.xml:89(title) groupmems.8.xml:100(title) groupdel.8.xml:88(title)
-#: groupadd.8.xml:93(title) gpasswd.1.xml:134(title) faillog.8.xml:89(title)
-#: expiry.1.xml:91(title) chsh.1.xml:95(title) chpasswd.8.xml:130(title)
-#: chgpasswd.8.xml:105(title) chfn.1.xml:111(title) chage.1.xml:91(title)
+#: groupmod.8.xml:89(title) groupmems.8.xml:100(title)
+#: groupdel.8.xml:88(title) groupadd.8.xml:93(title) gpasswd.1.xml:134(title)
+#: faillog.8.xml:89(title) expiry.1.xml:91(title) chsh.1.xml:95(title)
+#: chpasswd.8.xml:130(title) chgpasswd.8.xml:105(title) chfn.1.xml:111(title)
+#: chage.1.xml:91(title)
 msgid "OPTIONS"
 msgstr "OPCJE"

@@ -323,7 +329,7 @@ msgstr "Edycja bazy grup."

 #: vipw.8.xml:120(term) userdel.8.xml:123(term) useradd.8.xml:266(term)
 #: pwconv.8.xml:195(term) pwck.8.xml:186(term) passwd.1.xml:214(term)
-#: newusers.8.xml:283(term) lastlog.8.xml:118(term) grpck.8.xml:157(term)
+#: newusers.8.xml:283(term) lastlog.8.xml:107(term) grpck.8.xml:157(term)
 #: groupmod.8.xml:129(term) groupmems.8.xml:142(term) groupdel.8.xml:95(term)
 #: groupadd.8.xml:131(term) gpasswd.1.xml:173(term) faillog.8.xml:122(term)
 #: expiry.1.xml:112(term) chsh.1.xml:101(term) chpasswd.8.xml:171(term)
@@ -333,7 +339,7 @@ msgstr "<option>-h</option>, <option>--help</option>"

 #: vipw.8.xml:122(para) userdel.8.xml:125(para) useradd.8.xml:268(para)
 #: pwconv.8.xml:197(para) pwck.8.xml:188(para) passwd.1.xml:216(para)
-#: newusers.8.xml:285(para) lastlog.8.xml:122(para) grpck.8.xml:159(para)
+#: newusers.8.xml:285(para) lastlog.8.xml:111(para) grpck.8.xml:159(para)
 #: groupmod.8.xml:131(para) groupmems.8.xml:144(para) groupdel.8.xml:97(para)
 #: groupadd.8.xml:133(para) gpasswd.1.xml:175(para) faillog.8.xml:124(para)
 #: expiry.1.xml:114(para) chsh.1.xml:103(para) chpasswd.8.xml:173(para)
@@ -359,7 +365,7 @@ msgstr "Cichy tryb pracy."

 #: vipw.8.xml:138(term) usermod.8.xml:311(term) userdel.8.xml:146(term)
 #: useradd.8.xml:445(term) pwconv.8.xml:201(term) pwck.8.xml:209(term)
-#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:126(term)
+#: passwd.1.xml:301(term) newusers.8.xml:308(term) lastlog.8.xml:115(term)
 #: grpck.8.xml:173(term) groupmod.8.xml:178(term) groupmems.8.xml:165(term)
 #: groupdel.8.xml:101(term) groupadd.8.xml:204(term) faillog.8.xml:180(term)
 #: chsh.1.xml:107(term) chpasswd.8.xml:188(term) chgpasswd.8.xml:146(term)
@@ -377,7 +383,7 @@ msgstr ""

 #: vipw.8.xml:142(para) usermod.8.xml:315(para) userdel.8.xml:150(para)
 #: useradd.8.xml:449(para) pwconv.8.xml:205(para) pwck.8.xml:213(para)
-#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:130(para)
+#: passwd.1.xml:305(para) newusers.8.xml:312(para) lastlog.8.xml:119(para)
 #: grpck.8.xml:177(para) groupmod.8.xml:182(para) groupmems.8.xml:169(para)
 #: groupdel.8.xml:105(para) groupadd.8.xml:208(para) gpasswd.1.xml:185(para)
 #: faillog.8.xml:184(para) chsh.1.xml:111(para) chpasswd.8.xml:192(para)
@@ -409,18 +415,18 @@ msgstr "<option>-q</option>, <option>--quiet</option>"
 msgid "Indicates which user's tcb shadow file to edit."
 msgstr ""

-#: vipw.8.xml:165(title) usermod.8.xml:496(title) userdel.8.xml:171(title)
+#: vipw.8.xml:165(title) usermod.8.xml:497(title) userdel.8.xml:171(title)
 #: useradd.8.xml:647(title) su.1.xml:339(title) sg.1.xml:98(title)
 #: pwconv.8.xml:227(title) pwck.8.xml:252(title) passwd.1.xml:390(title)
 #: newusers.8.xml:362(title) newgrp.1.xml:109(title) login.1.xml:294(title)
 #: grpck.8.xml:209(title) groupmod.8.xml:193(title) groupmems.8.xml:199(title)
-#: groupdel.8.xml:128(title) groupadd.8.xml:219(title) gpasswd.1.xml:264(title)
-#: chsh.1.xml:154(title) chpasswd.8.xml:239(title) chgpasswd.8.xml:198(title)
-#: chfn.1.xml:193(title) chage.1.xml:244(title)
+#: groupdel.8.xml:128(title) groupadd.8.xml:219(title)
+#: gpasswd.1.xml:264(title) chsh.1.xml:154(title) chpasswd.8.xml:239(title)
+#: chgpasswd.8.xml:198(title) chfn.1.xml:193(title) chage.1.xml:244(title)
 msgid "CONFIGURATION"
 msgstr ""

-#: vipw.8.xml:166(para) usermod.8.xml:497(para) userdel.8.xml:172(para)
+#: vipw.8.xml:166(para) usermod.8.xml:498(para) userdel.8.xml:172(para)
 #: useradd.8.xml:648(para) su.1.xml:340(para) sg.1.xml:99(para)
 #: pwck.8.xml:253(para) passwd.1.xml:391(para) newusers.8.xml:363(para)
 #: newgrp.1.xml:110(para) login.1.xml:295(para) grpck.8.xml:210(para)
@@ -473,35 +479,37 @@ msgstr ""
 msgid "Editor to be used if <option>VISUAL</option> is not set."
 msgstr ""

-#: vipw.8.xml:195(title) usermod.8.xml:513(title) userdel.8.xml:188(title)
+#: vipw.8.xml:195(title) usermod.8.xml:514(title) userdel.8.xml:188(title)
 #: useradd.8.xml:675(title) suauth.5.xml:193(title) su.1.xml:367(title)
 #: sg.1.xml:110(title) shadow.5.xml:255(title) shadow.3.xml:226(title)
 #: pwconv.8.xml:250(title) pwck.8.xml:269(title) porttime.5.xml:130(title)
 #: passwd.5.xml:141(title) passwd.1.xml:408(title) newusers.8.xml:397(title)
 #: newgrp.1.xml:121(title) logoutd.8.xml:89(title)
-#: login.access.5.xml:121(title) login.1.xml:338(title) limits.5.xml:196(title)
-#: lastlog.8.xml:204(title) gshadow.5.xml:156(title) grpck.8.xml:221(title)
-#: groups.1.xml:100(title) groupmod.8.xml:205(title) groupmems.8.xml:211(title)
-#: groupdel.8.xml:140(title) groupadd.8.xml:233(title) gpasswd.1.xml:279(title)
-#: faillog.8.xml:243(title) faillog.5.xml:96(title) expiry.1.xml:121(title)
-#: chsh.1.xml:167(title) chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title)
-#: chfn.1.xml:207(title) chage.1.xml:256(title)
+#: login.access.5.xml:121(title) login.1.xml:338(title)
+#: limits.5.xml:196(title) lastlog.8.xml:182(title) gshadow.5.xml:156(title)
+#: grpck.8.xml:221(title) groups.1.xml:100(title) groupmod.8.xml:205(title)
+#: groupmems.8.xml:211(title) groupdel.8.xml:140(title)
+#: groupadd.8.xml:233(title) gpasswd.1.xml:279(title) faillog.8.xml:243(title)
+#: faillog.5.xml:96(title) expiry.1.xml:121(title) chsh.1.xml:167(title)
+#: chpasswd.8.xml:255(title) chgpasswd.8.xml:213(title) chfn.1.xml:207(title)
+#: chage.1.xml:256(title)
 msgid "FILES"
 msgstr "PLIKI"

-#: vipw.8.xml:198(filename) usermod.8.xml:516(filename)
+#: vipw.8.xml:198(filename) usermod.8.xml:517(filename)
 #: userdel.8.xml:191(filename) useradd.8.xml:690(filename)
-#: sg.1.xml:125(filename) pwck.8.xml:272(filename) newusers.8.xml:412(filename)
-#: newgrp.1.xml:136(filename) gshadow.5.xml:159(filename)
-#: grpck.8.xml:224(filename) groups.1.xml:103(filename)
-#: groupmod.8.xml:208(filename) groupmems.8.xml:214(filename)
-#: groupdel.8.xml:143(filename) groupadd.8.xml:236(filename)
-#: gpasswd.1.xml:72(filename) gpasswd.1.xml:75(filename)
-#: gpasswd.1.xml:282(filename) chgpasswd.8.xml:216(filename)
+#: sg.1.xml:125(filename) pwck.8.xml:272(filename)
+#: newusers.8.xml:412(filename) newgrp.1.xml:136(filename)
+#: gshadow.5.xml:159(filename) grpck.8.xml:224(filename)
+#: groups.1.xml:103(filename) groupmod.8.xml:208(filename)
+#: groupmems.8.xml:214(filename) groupdel.8.xml:143(filename)
+#: groupadd.8.xml:236(filename) gpasswd.1.xml:72(filename)
+#: gpasswd.1.xml:75(filename) gpasswd.1.xml:282(filename)
+#: chgpasswd.8.xml:216(filename)
 msgid "/etc/group"
 msgstr "/etc/group"

-#: vipw.8.xml:200(para) usermod.8.xml:518(para) userdel.8.xml:193(para)
+#: vipw.8.xml:200(para) usermod.8.xml:519(para) userdel.8.xml:193(para)
 #: useradd.8.xml:692(para) sg.1.xml:127(para) pwck.8.xml:274(para)
 #: newusers.8.xml:414(para) newgrp.1.xml:138(para) gshadow.5.xml:161(para)
 #: grpck.8.xml:226(para) groups.1.xml:105(para) groupmod.8.xml:210(para)
@@ -510,7 +518,7 @@ msgstr "/etc/group"
 msgid "Group account information."
 msgstr "Informacje o grupach użytkowników."

-#: vipw.8.xml:204(filename) usermod.8.xml:522(filename)
+#: vipw.8.xml:204(filename) usermod.8.xml:523(filename)
 #: useradd.8.xml:696(filename) sg.1.xml:131(filename)
 #: newusers.8.xml:418(filename) newgrp.1.xml:142(filename)
 #: gshadow.5.xml:165(filename) grpck.8.xml:230(filename)
@@ -521,7 +529,7 @@ msgstr "Informacje o grupach użytkowników."
 msgid "/etc/gshadow"
 msgstr "/etc/gshadow"

-#: vipw.8.xml:206(para) usermod.8.xml:524(para) useradd.8.xml:698(para)
+#: vipw.8.xml:206(para) usermod.8.xml:525(para) useradd.8.xml:698(para)
 #: sg.1.xml:133(para) newusers.8.xml:420(para) newgrp.1.xml:144(para)
 #: gshadow.5.xml:167(para) grpck.8.xml:232(para) groupmod.8.xml:216(para)
 #: groupdel.8.xml:151(para) groupadd.8.xml:244(para) gpasswd.1.xml:290(para)
@@ -529,7 +537,7 @@ msgstr "/etc/gshadow"
 msgid "Secure group account information."
 msgstr "Informacje chronione o grupach użytkowników."

-#: vipw.8.xml:210(filename) usermod.8.xml:534(filename)
+#: vipw.8.xml:210(filename) usermod.8.xml:535(filename)
 #: userdel.8.xml:203(filename) useradd.8.xml:678(filename)
 #: su.1.xml:370(filename) sg.1.xml:113(filename) shadow.5.xml:258(filename)
 #: pwck.8.xml:278(filename) passwd.5.xml:144(filename)
@@ -542,7 +550,7 @@ msgstr "Informacje chronione o grupach użytkowników."
 msgid "/etc/passwd"
 msgstr "/etc/passwd"

-#: vipw.8.xml:212(para) usermod.8.xml:536(para) userdel.8.xml:205(para)
+#: vipw.8.xml:212(para) usermod.8.xml:537(para) userdel.8.xml:205(para)
 #: useradd.8.xml:680(para) su.1.xml:372(para) sg.1.xml:115(para)
 #: shadow.5.xml:260(para) pwck.8.xml:280(para) passwd.5.xml:146(para)
 #: passwd.1.xml:413(para) newusers.8.xml:402(para) newgrp.1.xml:126(para)
@@ -552,7 +560,7 @@ msgstr "/etc/passwd"
 msgid "User account information."
 msgstr "Informacja o kontach użytkowników."

-#: vipw.8.xml:216(filename) usermod.8.xml:540(filename)
+#: vipw.8.xml:216(filename) usermod.8.xml:541(filename)
 #: userdel.8.xml:209(filename) useradd.8.xml:684(filename)
 #: su.1.xml:376(filename) sg.1.xml:119(filename) shadow.5.xml:264(filename)
 #: shadow.3.xml:229(filename) pwck.8.xml:284(filename)
@@ -563,7 +571,7 @@ msgstr "Informacja o kontach użytkowników."
 msgid "/etc/shadow"
 msgstr "/etc/shadow"

-#: vipw.8.xml:218(para) usermod.8.xml:542(para) userdel.8.xml:211(para)
+#: vipw.8.xml:218(para) usermod.8.xml:543(para) userdel.8.xml:211(para)
 #: useradd.8.xml:686(para) su.1.xml:378(para) sg.1.xml:121(para)
 #: shadow.5.xml:266(para) shadow.3.xml:231(para) pwck.8.xml:286(para)
 #: passwd.1.xml:419(para) newusers.8.xml:408(para) newgrp.1.xml:132(para)
@@ -572,7 +580,7 @@ msgstr "/etc/shadow"
 msgid "Secure user account information."
 msgstr "Informacje chronione o użytkownikach."

-#: vipw.8.xml:225(title) usermod.8.xml:561(title) userdel.8.xml:308(title)
+#: vipw.8.xml:225(title) usermod.8.xml:562(title) userdel.8.xml:308(title)
 #: useradd.8.xml:804(title) suauth.5.xml:222(title) su.1.xml:438(title)
 #: sg.1.xml:140(title) shadow.5.xml:283(title) shadow.3.xml:238(title)
 #: pwconv.8.xml:262(title) pwck.8.xml:344(title) porttime.5.xml:142(title)
@@ -647,15 +655,15 @@ msgstr ""
 #: usermod.8.xml:46(surname) userdel.8.xml:46(surname)
 #: useradd.8.xml:57(surname) su.1.xml:57(surname) sg.1.xml:41(surname)
 #: shadow.5.xml:40(surname) shadow.3.xml:40(surname) pwck.8.xml:46(surname)
-#: porttime.5.xml:40(surname) passwd.5.xml:40(surname) passwd.1.xml:47(surname)
-#: newusers.8.xml:55(surname) newgrp.1.xml:41(surname)
-#: logoutd.8.xml:40(surname) login.defs.5.xml:105(surname)
-#: login.1.xml:73(surname) lastlog.8.xml:41(surname) grpck.8.xml:41(surname)
-#: groups.1.xml:40(surname) groupmod.8.xml:41(surname)
-#: groupdel.8.xml:41(surname) groupadd.8.xml:43(surname)
-#: faillog.8.xml:40(surname) faillog.5.xml:40(surname) expiry.1.xml:44(surname)
-#: chsh.1.xml:43(surname) chpasswd.8.xml:44(surname) chfn.1.xml:43(surname)
-#: chage.1.xml:41(surname)
+#: porttime.5.xml:40(surname) passwd.5.xml:40(surname)
+#: passwd.1.xml:47(surname) newusers.8.xml:55(surname)
+#: newgrp.1.xml:41(surname) logoutd.8.xml:40(surname)
+#: login.defs.5.xml:105(surname) login.1.xml:73(surname)
+#: lastlog.8.xml:41(surname) grpck.8.xml:41(surname) groups.1.xml:40(surname)
+#: groupmod.8.xml:41(surname) groupdel.8.xml:41(surname)
+#: groupadd.8.xml:43(surname) faillog.8.xml:40(surname)
+#: faillog.5.xml:40(surname) expiry.1.xml:44(surname) chsh.1.xml:43(surname)
+#: chpasswd.8.xml:44(surname) chfn.1.xml:43(surname) chage.1.xml:41(surname)
 msgid "Haugh"
 msgstr ""

@@ -1088,7 +1096,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-v</option>, <option>--add-subuids</option>&nbsp;"
+"<option>-v</option>, <option>--add-sub-uids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
@@ -1117,7 +1125,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-V</option>, <option>--del-subuids</option>&nbsp;"
+"<option>-V</option>, <option>--del-sub-uids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
@@ -1130,8 +1138,8 @@ msgstr ""
 #: usermod.8.xml:409(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-subuids</option> and <option>--add-"
-"subuids</option> are specified, the removal of all subordinate uid ranges "
+"users account. When both <option>--del-sub-uids</option> and <option>--add-"
+"sub-uids</option> are specified, the removal of all subordinate uid ranges "
 "happens before any subordinate uid range is added."
 msgstr ""

@@ -1141,7 +1149,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-w</option>, <option>--add-subgids</option>&nbsp;"
+"<option>-w</option>, <option>--add-sub-gids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
@@ -1164,7 +1172,7 @@ msgstr ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
 #| "replaceable>=<replaceable>VALUE</replaceable>"
 msgid ""
-"<option>-W</option>, <option>--del-subgids</option>&nbsp;"
+"<option>-W</option>, <option>--del-sub-gids</option>&nbsp;"
 "<replaceable>FIRST</replaceable>-<replaceable>LAST</replaceable>"
 msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
@@ -1177,8 +1185,8 @@ msgstr ""
 #: usermod.8.xml:447(para)
 msgid ""
 "This option may be specified multiple times to remove multiple ranges to a "
-"users account. When both <option>--del-subgids</option> and <option>--add-"
-"subgids</option> are specified, the removal of all subordinate gid ranges "
+"users account. When both <option>--del-sub-gids</option> and <option>--add-"
+"sub-gids</option> are specified, the removal of all subordinate gid ranges "
 "happens before any subordinate gid range is added."
 msgstr ""

@@ -1209,9 +1217,9 @@ msgstr ""

 #: usermod.8.xml:478(title) userdel.8.xml:281(title) useradd.8.xml:623(title)
 #: su.1.xml:331(title) shadow.3.xml:218(title) passwd.1.xml:372(title)
-#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:216(title)
-#: groupdel.8.xml:116(title) groupadd.8.xml:257(title) gpasswd.1.xml:252(title)
-#: faillog.8.xml:232(title) chpasswd.8.xml:231(title)
+#: newusers.8.xml:350(title) login.1.xml:260(title) lastlog.8.xml:194(title)
+#: groupdel.8.xml:116(title) groupadd.8.xml:257(title)
+#: gpasswd.1.xml:252(title) faillog.8.xml:232(title) chpasswd.8.xml:231(title)
 #: chgpasswd.8.xml:186(title)
 msgid "CAVEATS"
 msgstr "OSTRZEŻENIA"
@@ -1221,17 +1229,17 @@ msgid ""
 "You must make certain that the named user is not executing any processes "
 "when this command is being executed if the user's numerical user ID, the "
 "user's name, or the user's home directory is being changed. "
-"<command>usermod</command> checks this on Linux. On other platforms it only "
-"uses utmp to check if the user is logged in."
+"<command>usermod</command> checks this on Linux, but only check if the user "
+"is logged in according to utmp on other architectures."
 msgstr ""

-#: usermod.8.xml:486(para)
+#: usermod.8.xml:487(para)
 msgid ""
 "You must change the owner of any <command>crontab</command> files or "
 "<command>at</command> jobs manually."
 msgstr ""

-#: usermod.8.xml:490(para)
+#: usermod.8.xml:491(para)
 msgid "You must make any changes involving NIS on the NIS server."
 msgstr ""

@@ -1447,7 +1455,7 @@ msgid ""
 "algorithm: <placeholder-1/>"
 msgstr ""

-#: usermod.8.xml:528(filename) userdel.8.xml:197(filename)
+#: usermod.8.xml:529(filename) userdel.8.xml:197(filename)
 #: useradd.8.xml:726(filename) su.1.xml:382(filename)
 #: pwconv.8.xml:253(filename) passwd.1.xml:423(filename)
 #: newusers.8.xml:424(filename) login.access.5.xml:124(filename)
@@ -1458,7 +1466,7 @@ msgstr ""
 msgid "/etc/login.defs"
 msgstr "/etc/login.defs"

-#: usermod.8.xml:530(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
+#: usermod.8.xml:531(para) userdel.8.xml:199(para) useradd.8.xml:728(para)
 #: su.1.xml:384(para) pwconv.8.xml:255(para) passwd.1.xml:425(para)
 #: newusers.8.xml:426(para) login.access.5.xml:126(para) login.1.xml:391(para)
 #: groupmod.8.xml:222(para) groupadd.8.xml:250(para) chsh.1.xml:184(para)
@@ -1466,31 +1474,31 @@ msgstr "/etc/login.defs"
 msgid "Shadow password suite configuration."
 msgstr "Konfiguracja pakietu shadow."

-#: usermod.8.xml:546(filename) userdel.8.xml:215(filename)
+#: usermod.8.xml:547(filename) userdel.8.xml:215(filename)
 #: useradd.8.xml:714(filename) newusers.8.xml:436(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subgid"
 msgstr "/etc/suauth"

-#: usermod.8.xml:548(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
+#: usermod.8.xml:549(para) userdel.8.xml:217(para) useradd.8.xml:716(para)
 #: newusers.8.xml:438(para)
 msgid "Per user subordinate group IDs."
 msgstr ""

-#: usermod.8.xml:552(filename) userdel.8.xml:221(filename)
+#: usermod.8.xml:553(filename) userdel.8.xml:221(filename)
 #: useradd.8.xml:720(filename) newusers.8.xml:442(filename)
 #, fuzzy
 #| msgid "/etc/suauth"
 msgid "/etc/subuid"
 msgstr "/etc/suauth"

-#: usermod.8.xml:554(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
+#: usermod.8.xml:555(para) userdel.8.xml:223(para) useradd.8.xml:722(para)
 #: newusers.8.xml:444(para)
 msgid "Per user subordinate user IDs."
 msgstr ""

-#: usermod.8.xml:562(para)
+#: usermod.8.xml:563(para)
 #, fuzzy
 #| msgid ""
 #| "<citerefentry><refentrytitle>chfn</refentrytitle><manvolnum>1</"
@@ -1723,8 +1731,9 @@ msgstr "poprawne zakończenie działania programu"
 #: passwd.1.xml:449(replaceable) newgrp.1.xml:59(manvolnum)
 #: login.1.xml:91(manvolnum) grpck.8.xml:256(replaceable)
 #: groups.1.xml:58(manvolnum) gpasswd.1.xml:63(manvolnum)
-#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum) chfn.1.xml:61(manvolnum)
-#: chage.1.xml:59(manvolnum) chage.1.xml:289(replaceable)
+#: expiry.1.xml:62(manvolnum) chsh.1.xml:61(manvolnum)
+#: chfn.1.xml:61(manvolnum) chage.1.xml:59(manvolnum)
+#: chage.1.xml:289(replaceable)
 msgid "1"
 msgstr "1"

@@ -2090,7 +2099,7 @@ msgid ""
 "<option>PASS_MAX_DAYS</option> and others). <placeholder-1/> Example: "
 "<option>-K</option>&nbsp;<replaceable>PASS_MAX_DAYS</"
 "replaceable>=<replaceable>-1</replaceable> can be used when creating system "
-"account to turn off password aging, even though system account has no "
+"account to turn off password ageing, even though system account has no "
 "password at all. Multiple <option>-K</option> options can be specified, e."
 "g.: <option>-K</option>&nbsp;<replaceable>UID_MIN</"
 "replaceable>=<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;"
@@ -2110,7 +2119,7 @@ msgstr ""
 #: useradd.8.xml:327(para)
 msgid ""
 "By default, the user's entries in the lastlog and faillog databases are "
-"reset to avoid reusing the entry from a previously deleted user."
+"resetted to avoid reusing the entry from a previously deleted user."
 msgstr ""

 #: useradd.8.xml:335(term)
@@ -2130,11 +2139,11 @@ msgid ""
 "is not enabled, no home directories are created."
 msgstr ""

-#: useradd.8.xml:353(term)
+#: useradd.8.xml:354(option)
 #, fuzzy
-#| msgid "<option>-m</option>, <option>--create-home</option>"
-msgid "<option>-M</option>, <option>--no-create-home</option>"
-msgstr "<option>-m</option>, <option>--create-home</option>"
+#| msgid "-"
+msgid "-M"
+msgstr "-"

 #: useradd.8.xml:357(para)
 msgid ""
@@ -2209,10 +2218,10 @@ msgstr ""
 #: useradd.8.xml:434(para)
 msgid ""
 "Note that <command>useradd</command> will not create a home directory for "
-"such a user, regardless of the default setting in <filename>/etc/login.defs</"
-"filename> (<option>CREATE_HOME</option>). You have to specify the <option>-"
-"m</option> options if you want a home directory for a system account to be "
-"created."
+"such an user, regardless of the default setting in <filename>/etc/login."
+"defs</filename> (<option>CREATE_HOME</option>). You have to specify the "
+"<option>-m</option> options if you want a home directory for a system "
+"account to be created."
 msgstr ""

 #: useradd.8.xml:461(para)
@@ -2757,7 +2766,7 @@ msgstr ""
 #, no-wrap
 msgid ""
 "\n"
-"      1) the user su is targeting\n"
+"      1) the user su is targetting\n"
 "    "
 msgstr ""

@@ -2791,12 +2800,12 @@ msgstr ""
 #: suauth.5.xml:107(para)
 msgid ""
 "from-id is formatted the same as to-id except the extra word "
-"<emphasis>GROUP</emphasis> is recognized. <emphasis>ALL EXCEPT GROUP</"
+"<emphasis>GROUP</emphasis> is recognised. <emphasis>ALL EXCEPT GROUP</"
 "emphasis> is perfectly valid too. Following <emphasis>GROUP</emphasis> "
 "appears one or more group names, delimited by \",\". It is not sufficient to "
 "have primary group id of the relevant group, an entry in "
 "<citerefentry><refentrytitle>/etc/group</refentrytitle><manvolnum>5</"
-"manvolnum></citerefentry> is necessary."
+"manvolnum></citerefentry> is neccessary."
 msgstr ""

 #: suauth.5.xml:118(para)
@@ -2901,8 +2910,9 @@ msgstr ""
 "citerefentry>."

 #: su.1.xml:58(contrib) shadow.5.xml:41(contrib) shadow.3.xml:41(contrib)
-#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib) passwd.1.xml:48(contrib)
-#: login.1.xml:74(contrib) faillog.8.xml:41(contrib) faillog.5.xml:41(contrib)
+#: porttime.5.xml:41(contrib) passwd.5.xml:41(contrib)
+#: passwd.1.xml:48(contrib) login.1.xml:74(contrib) faillog.8.xml:41(contrib)
+#: faillog.5.xml:41(contrib)
 msgid "Creation, 1989"
 msgstr ""

@@ -2998,7 +3008,7 @@ msgstr ""
 #: su.1.xml:158(para)
 msgid ""
 "The executed command will have no controlling terminal. This option cannot "
-"be used to execute interactive programs which need a controlling TTY."
+"be used to execute interractive programs which need a controlling TTY."
 msgstr ""

 #: su.1.xml:168(term)
@@ -3602,7 +3612,7 @@ msgstr ""

 #: shadow.5.xml:117(para) gshadow.5.xml:107(para)
 msgid ""
-"A password field which starts with an exclamation mark means that the "
+"A password field which starts with a exclamation mark means that the "
 "password is locked. The remaining characters on the line represent the "
 "password field before the password was locked."
 msgstr ""
@@ -3620,7 +3630,7 @@ msgstr ""
 #: shadow.5.xml:134(para)
 msgid ""
 "The value 0 has a special meaning, which is that the user should change her "
-"password the next time she will log in the system."
+"pasword the next time she will log in the system."
 msgstr ""

 #: shadow.5.xml:139(para)
@@ -3722,7 +3732,7 @@ msgstr ""
 #: shadow.5.xml:229(para)
 msgid ""
 "Note that an account expiration differs from a password expiration. In case "
-"of an account expiration, the user shall not be allowed to login. In case of "
+"of an acount expiration, the user shall not be allowed to login. In case of "
 "a password expiration, the user is not allowed to login using her password."
 msgstr ""

@@ -4016,15 +4026,18 @@ msgstr ""
 msgid "pwconv"
 msgstr "pwconv"

-#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command) login.defs.5.xml:438(term)
+#: pwconv.8.xml:71(refname) pwconv.8.xml:85(command)
+#: login.defs.5.xml:438(term)
 msgid "pwunconv"
 msgstr "pwunconv"

-#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command) login.defs.5.xml:340(term)
+#: pwconv.8.xml:72(refname) pwconv.8.xml:91(command)
+#: login.defs.5.xml:340(term)
 msgid "grpconv"
 msgstr "grpconv"

-#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command) login.defs.5.xml:346(term)
+#: pwconv.8.xml:73(refname) pwconv.8.xml:97(command)
+#: login.defs.5.xml:346(term)
 msgid "grpunconv"
 msgstr "grpunconv"

@@ -4197,7 +4210,8 @@ msgstr ""

 #: pwck.8.xml:80(replaceable) passwd.5.xml:57(refentrytitle)
 #: passwd.5.xml:64(refname) passwd.1.xml:64(refentrytitle)
-#: passwd.1.xml:71(refname) passwd.1.xml:77(command) login.defs.5.xml:409(term)
+#: passwd.1.xml:71(refname) passwd.1.xml:77(command)
+#: login.defs.5.xml:409(term)
 msgid "passwd"
 msgstr "passwd"

@@ -4347,7 +4361,7 @@ msgstr ""
 msgid ""
 "Note that when <option>USE_TCB</option> is enabled, you cannot specify an "
 "alternative <replaceable>shadow</replaceable> file. In future releases, this "
-"parameter could be replaced by an alternate TCB directory."
+"paramater could be replaced by an alternate TCB directory."
 msgstr ""

 #: pwck.8.xml:312(para)
@@ -4741,7 +4755,7 @@ msgstr ""

 #: passwd.1.xml:166(para)
 msgid ""
-"You can find advice on how to choose a strong password on http://en."
+"You can find advices on how to choose a strong password on http://en."
 "wikipedia.org/wiki/Password_strength"
 msgstr ""

@@ -5053,8 +5067,8 @@ msgstr "PASS_MIN_DAYS (numer)"
 #: passwd.1.xml:35(para) login.defs.5.xml:35(para)
 msgid ""
 "Number of significant characters in the password for crypt(). "
-"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your "
-"crypt() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
+"<option>PASS_MAX_LEN</option> is 8 by default. Don't change unless your crypt"
+"() is better. This is ignored if <option>MD5_CRYPT_ENAB</option> set to "
 "<replaceable>yes</replaceable>."
 msgstr ""

@@ -5212,7 +5226,7 @@ msgid "HISTORY"
 msgstr ""

 #: nologin.8.xml:91(para)
-msgid "The <command>nologin</command> command appeared in BSD 4.4."
+msgid "The <command>nologin</command> command appearred in BSD 4.4."
 msgstr ""

 #: newusers.8.xml:72(refentrytitle) newusers.8.xml:79(refname)
@@ -5268,7 +5282,7 @@ msgstr ""

 #: newusers.8.xml:116(para)
 msgid ""
-"It can be the name of a new user or the name of an existing user (or a user "
+"It can be the name of a new user or the name of an existing user (or an user "
 "created before by <command>newusers</command>). In case of an existing user, "
 "the user's information will be changed, otherwise a new user will be created."
 msgstr ""
@@ -5296,7 +5310,7 @@ msgstr ""

 #: newusers.8.xml:144(para)
 msgid ""
-"If the field is empty, a new (unused) UID will be defined automatically by "
+"If the field is empty, an new (unused) UID will be defined automatically by "
 "<command>newusers</command>."
 msgstr ""

@@ -5306,7 +5320,7 @@ msgstr ""

 #: newusers.8.xml:152(para)
 msgid ""
-"If this field contains the name of an existing user (or the name of a user "
+"If this field contains the name of an existing user (or the name of an user "
 "created before by <command>newusers</command>), the UID of the specified "
 "user will be used."
 msgstr ""
@@ -6604,7 +6618,7 @@ msgid "D: max data size (KB)"
 msgstr ""

 #: limits.5.xml:111(para)
-msgid "F: maximum file size (KB)"
+msgid "F: maximum filesize (KB)"
 msgstr ""

 #: limits.5.xml:112(para)
@@ -6678,7 +6692,7 @@ msgstr ""
 #: limits.5.xml:145(para)
 msgid ""
 "Be aware that after <emphasis remap=\"I\">username</emphasis> the rest of "
-"the line is considered a limit string, thus comments are not allowed. An "
+"the line is considered a limit string, thus comments are not allowed. A "
 "invalid limits string will be rejected (not considered) by the "
 "<command>login</command> program."
 msgstr ""
@@ -6702,13 +6716,13 @@ msgstr ""

 #: limits.5.xml:165(para)
 msgid ""
-"If more than one line with limits for a user exist, only the first line for "
+"If more than one line with limits for an user exist, only the first line for "
 "this user will be considered."
 msgstr ""

 #: limits.5.xml:170(para)
 msgid ""
-"If no lines are specified for a user, the last <replaceable>@group</"
+"If no lines are specified for an user, the last <replaceable>@group</"
 "replaceable> line matching a group whose the user is a member of will be "
 "considered, or the last line with default limits if no groups contain the "
 "user."
@@ -6796,33 +6810,7 @@ msgstr ""
 "Wyświetlenie rekordów lastlog starszych niż zadana <emphasis remap=\"I"
 "\">DNI</emphasis>."

-#: lastlog.8.xml:107(term)
-#, fuzzy
-#| msgid "<option>-q</option>, <option>--quiet</option>"
-msgid "<option>-C</option>, <option>--clear</option>"
-msgstr "<option>-q</option>, <option>--quiet</option>"
-
-#: lastlog.8.xml:111(para)
-#, fuzzy
-#| msgid "<option>-m</option>, <option>--create-home</option>"
-msgid ""
-"Clear lastlog record of a user. This option can be used only together with "
-"<option>-u</option> (<option>--user</option>))."
-msgstr "<option>-m</option>, <option>--create-home</option>"
-
-#: lastlog.8.xml:138(term)
-#, fuzzy
-#| msgid "<option>-r</option>, <option>--reset</option>"
-msgid "<option>-S</option>, <option>--set</option>"
-msgstr "<option>-r</option>, <option>--reset</option>"
-
-#: lastlog.8.xml:142(para)
-msgid ""
-"Set lastlog record of a user to the current time. This option can be used "
-"only together with <option>-u</option> (<option>--user</option>))."
-msgstr ""
-
-#: lastlog.8.xml:149(term) faillog.8.xml:192(term)
+#: lastlog.8.xml:127(term) faillog.8.xml:192(term)
 msgid ""
 "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DAYS</"
 "replaceable>"
@@ -6830,7 +6818,7 @@ msgstr ""
 "<option>-t</option>, <option>--time</option>&nbsp;<replaceable>DNI</"
 "replaceable>"

-#: lastlog.8.xml:153(para)
+#: lastlog.8.xml:131(para)
 msgid ""
 "Print the lastlog records more recent than <emphasis remap=\"I\">DAYS</"
 "emphasis>."
@@ -6838,7 +6826,7 @@ msgstr ""
 "Wyświetlenie rekordów lastlog nie starszych niż zadana ilość <emphasis remap="
 "\"I\">DNI</emphasis>."

-#: lastlog.8.xml:160(term) faillog.8.xml:202(term)
+#: lastlog.8.xml:138(term) faillog.8.xml:202(term)
 #, fuzzy
 #| msgid ""
 #| "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KEY</"
@@ -6850,7 +6838,7 @@ msgstr ""
 "<option>-K</option>, <option>--key</option>&nbsp;<replaceable>KLUCZ</"
 "replaceable>=<replaceable>WARTOŚĆ</replaceable>"

-#: lastlog.8.xml:164(para)
+#: lastlog.8.xml:142(para)
 #, fuzzy
 #| msgid ""
 #| "Print the lastlog record for user with specified <emphasis remap=\"I"
@@ -6860,7 +6848,7 @@ msgstr ""
 "Wyświetlenie informacji o ostanim logowaniu dla użytkownika "
 "<replaceable>LOGIN</replaceable>."

-#: lastlog.8.xml:167(para) faillog.8.xml:211(para)
+#: lastlog.8.xml:145(para) faillog.8.xml:211(para)
 msgid ""
 "The users can be specified by a login name, a numerical user ID, or a "
 "<replaceable>RANGE</replaceable> of users. This <replaceable>RANGE</"
@@ -6869,7 +6857,7 @@ msgid ""
 "UID_MAX</replaceable>), or a min value (<replaceable>UID_MIN-</replaceable>)."
 msgstr ""

-#: lastlog.8.xml:179(para)
+#: lastlog.8.xml:157(para)
 msgid ""
 "If the user has never logged in the message <emphasis>** Never logged in**</"
 "emphasis> will be displayed instead of the port and time."
@@ -6878,18 +6866,18 @@ msgstr ""
 "logowania wyświetlany jest komunikat <emphasis>**Nigdy nie zalogowany**</"
 "emphasis> (użytkownik nigdy się nie logował)."

-#: lastlog.8.xml:184(para)
+#: lastlog.8.xml:162(para)
 msgid ""
 "Only the entries for the current users of the system will be displayed. "
 "Other entries may exist for users that were deleted previously."
 msgstr ""

-#: lastlog.8.xml:192(title) groups.1.xml:90(title) chsh.1.xml:140(title)
+#: lastlog.8.xml:170(title) groups.1.xml:90(title) chsh.1.xml:140(title)
 #: chage.1.xml:231(title)
 msgid "NOTE"
 msgstr "UWAGI"

-#: lastlog.8.xml:193(para)
+#: lastlog.8.xml:171(para)
 msgid ""
 "The <filename>lastlog</filename> file is a database which contains info on "
 "the last login of each user. You should not rotate it. It is a sparse file, "
@@ -6907,15 +6895,15 @@ msgstr ""
 "wartościami UID). Mozesz wyświetlić rzeczywisty rozmiar tego pliku używając "
 "polecenia \"<command>ls -s</command>\"."

-#: lastlog.8.xml:207(filename)
+#: lastlog.8.xml:185(filename)
 msgid "/var/log/lastlog"
 msgstr "/var/log/lastlog"

-#: lastlog.8.xml:209(para)
+#: lastlog.8.xml:187(para)
 msgid "Database times of previous user logins."
 msgstr "Baza danych ostatnich logowań użytkowników."

-#: lastlog.8.xml:217(para)
+#: lastlog.8.xml:195(para)
 msgid ""
 "Large gaps in UID numbers will cause the lastlog program to run longer with "
 "no output to the screen (i.e. if in lastlog database there is no entries for "
@@ -6976,7 +6964,7 @@ msgstr ""
 #| "modified using the <citerefentry><refentrytitle>chfn</"
 #| "refentrytitle><manvolnum>1</manvolnum></citerefentry> utility."
 msgid ""
-"The password is used when a user who is not a member of the group wants to "
+"The password is used when an user who is not a member of the group wants to "
 "gain the permissions of this group (see <citerefentry><refentrytitle>newgrp</"
 "refentrytitle><manvolnum>1</manvolnum></citerefentry>)."
 msgstr ""
@@ -7485,7 +7473,7 @@ msgstr ""
 "replaceable>"

 #: groupmems.8.xml:109(para)
-msgid "Add a user to the group membership list."
+msgid "Add an user to the group membership list."
 msgstr ""

 #: groupmems.8.xml:110(para) groupmems.8.xml:126(para)
@@ -8473,7 +8461,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> or <option>MD5_CRYPT_ENAB</option> variables "
-"of <filename>/etc/login.defs</filename>, and can be overwritten with the "
+"of <filename>/etc/login.defs</filename>, and can be overwitten with the "
 "<option>-e</option>, <option>-m</option>, or <option>-c</option> options."
 msgstr ""

@@ -8488,7 +8476,7 @@ msgstr ""
 msgid ""
 "<phrase condition=\"pam\">Except when PAM is used to encrypt the passwords,</"
 "phrase><command>chpasswd</command> first updates all the passwords in "
-"memory, and then commits all the changes to disk if no errors occurred for "
+"memory, and then commits all the changes to disk if no errors occured for "
 "any user."
 msgstr ""

@@ -8655,7 +8643,7 @@ msgstr ""
 msgid ""
 "The default encryption algorithm can be defined for the system with the "
 "<option>ENCRYPT_METHOD</option> variable of <filename>/etc/login.defs</"
-"filename>, and can be overwritten with the <option>-e</option>, <option>-m</"
+"filename>, and can be overwiten with the <option>-e</option>, <option>-m</"
 "option>, or <option>-c</option> options."
 msgstr ""

@@ -9040,11 +9028,6 @@ msgstr ""
 msgid "translator-credits"
 msgstr "Tomasz Kłoczko <kloczek@pld.org.pl>, 2006"

-#, fuzzy
-#~| msgid "-"
-#~ msgid "-M"
-#~ msgstr "-"
-
 #~ msgid ""
 #~ "<citerefentry><refentrytitle>chfn</refentrytitle><manvolnum>1</"
 #~ "manvolnum></citerefentry>, <citerefentry><refentrytitle>chsh</"
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Sylvain Beucler	45e2376c0b	Add Salsa-CI config	2025-04-15 16:48:03 +02:00
Sylvain Beucler	4069b87008	Import Debian changes 1:4.2-3+deb8u6 shadow (1:4.2-3+deb8u6) jessie-security; urgency=high . * Non-maintainer upload by the ELTS Security Team. * CVE-2023-4641: When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory. (Closes: #1051062) * CVE-2023-29383: It is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. (Closes: #1034482)	2025-04-15 15:51:43 +02:00
Utkarsh Gupta	8550bc7a3c	Import Debian changes 1:4.2-3+deb8u5 shadow (1:4.2-3+deb8u5) jessie-security; urgency=high . * Non-maintainer upload by the ELTS team. * SECURITY UPDATE: Crash or buffer overflow - debian/patches/CVE-2017-12424.patch: fix buffer overflow if NULL line is present in db in lib/commonio.c. - CVE-2017-12424 * SECURITY UPDATE: Access to privileged information - debian/patches/CVE-2018-7169.patch: newgidmap: enforce setgroups=deny if self-mapping a group in src/newgidmap.c. - CVE-2018-7169	2025-04-15 13:59:27 +02:00
Salvatore Bonaccorso	bd62b6b2fb	Import Debian changes 1:4.2-3+deb8u4 shadow (1:4.2-3+deb8u4) jessie-security; urgency=high . * Non-maintainer upload by the Security Team. * Reset pid_child only if waitpid was successful. This is a regression fix for CVE-2017-2616. If su receives a signal like SIGTERM, it is not propagated to the child. (Closes: #862806)	2025-04-15 13:57:33 +02:00
Balint Reczey	096c5f276b	Imported Debian patch 1:4.2-3+deb8u3	2017-02-26 11:37:09 +01:00
Salvatore Bonaccorso	ba9a0dec9d	Imported Debian patch 1:4.2-3+deb8u2	2017-02-26 11:36:51 +01:00
Balint Reczey	75e2a3b103	Update changelog	2017-02-24 00:58:22 +01:00
Balint Reczey	e5e623f4ca	Add myself to uploaders replacing Nicolas FRANCOIS (Nekral)	2017-02-24 00:57:02 +01:00
Balint Reczey	5fd2757d66	Update changelog	2017-02-24 00:51:09 +01:00
Balint Reczey	bef0d93006	Refresh patches	2017-02-24 00:49:51 +01:00
Balint Reczey	dd729b3572	Fix integer overflow in getulong.c (CVE-2016-6252) Closes: #832170	2017-02-24 00:41:23 +01:00
Salvatore Bonaccorso	1edacbf29a	su: properly clear child PID Closes: #855943	2017-02-24 00:27:53 +01:00
Bastian Blank	a784e094c4	Imported Debian patch 1:4.2-3+deb8u1	2017-02-24 00:16:58 +01:00
Christian Perrier	1f9119ef49	releasing version 1:4.2-3	2014-11-20 22:29:43 +01:00
Christian Perrier	654077fff8	Enforce hardened builds to workaround cdbs sometimes not building with hardening flags as in 1:4.2-2+b1 Thanks to Dr. Markus Waldeck for pointing the issue and Simon Ruderich For providing a working patch.	2014-11-19 21:51:16 +01:00