Release 4.13

Signed-off-by: Serge Hallyn <serge@hallyn.com>

.builds/fedora.yml

@@ -0,0 +1,31 @@
+image: fedora/latest
+packages:
+  - autoconf
+  - automake
+  - byacc
+  - expect
+  - findutils
+  - gettext
+  - gettext-devel
+  - git
+  - libselinux-devel
+  - libsemanage-devel
+  - libtool
+  - libxslt
+sources:
+  - https://github.com/shadow-maint/shadow
+tasks:
+  - build: |
+      cd shadow
+      ./autogen.sh --with-selinux --enable-man
+      grep ENABLE_ config.status
+  - tasks: |
+      cd shadow
+      cat /proc/self/uid_map
+      cat /proc/self/status
+      make
+      make DESTDIR=/tmp/shadow-inst install
+      sudo make install
+      #TODO - fix up the tests.  Let's merge what's here now as it
+      #at least tests build.
+      #(cd tests; sudo ./run_some || { cat testsuite.log; false; })

.builds/ubuntu-jammy.yml

@@ -1,4 +1,4 @@
-image: ubuntu/21.10
+image: ubuntu/22.04
 packages:
   - automake
   - autopoint

.github/actions/install-dependencies/action.yml

@@ -0,0 +1,12 @@
+name: 'Install dependencies'
+description: 'Install dependencies to build shadow-utils'
+runs:
+  using: "composite"
+  steps:
+  - shell: bash
+    run: |
+      sudo apt-get update -y
+      sudo apt-get install -y ubuntu-dev-tools
+      sudo sed -Ei 's/^# deb-src /deb-src /' /etc/apt/sources.list
+      sudo apt-get update -y
+      sudo apt-get -y build-dep shadow

.github/workflows/static-code-analysis.yml

@@ -0,0 +1,60 @@
+name: "Static code analysis"
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    # Everyday at midnight
+    - cron: '0 0 * * *'
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    - name: Install dependencies
+      id: dependencies
+      uses: ./.github/actions/install-dependencies
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: cpp
+        queries: +security-and-quality
+
+    - name: Configure shadow-utils
+      run: ./autogen.sh --without-selinux --disable-man
+
+    - name: Build shadow-utils
+      run: |
+        PROCESSORS=$(/usr/bin/getconf _NPROCESSORS_ONLN)
+        make -j$PROCESSORS
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+
+  differential-shellcheck:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      # Doc: https://github.com/redhat-plumbers-in-action/differential-shellcheck#usage
+      - name: Differential ShellCheck
+        uses: redhat-plumbers-in-action/differential-shellcheck@v3
+        with:
+          severity: warning
+          token: ${{ secrets.GITHUB_TOKEN }}

AUTHORS.md

@@ -3,87 +3,87 @@ reports and various comments. This list may be incomplete, I received
 a lot of mail...
 
 # Maintainers
-Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
+* Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
-Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
+* Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
-Serge E. Hallyn <serge@hallyn.com> (2014-now)
+* Serge E. Hallyn <serge@hallyn.com> (2014-now)
-Christian Brauner <christian@brauner.io> (2019-now)
+* Christian Brauner <christian@brauner.io> (2019-now)
+* Iker Pedrosa <ipedrosa@redhat.com> (2022-now)
 
 # Authors and contributors
-Adam Rudnicki <adam@v-lo.krakow.pl>
+* Adam Rudnicki <adam@v-lo.krakow.pl>
-Alan Curry <pacman@tardis.mars.net>
+* Alan Curry <pacman@tardis.mars.net>
-Aleksa Sarai <cyphar@cyphar.com>
+* Aleksa Sarai <cyphar@cyphar.com>
-Alexander O. Yuriev <alex@bach.cis.temple.edu>
+* Alexander O. Yuriev <alex@bach.cis.temple.edu>
-Algis Rudys <arudys@rice.edu>
+* Algis Rudys <arudys@rice.edu>
-Andreas Jaeger <aj@arthur.rhein-neckar.de>
+* Andreas Jaeger <aj@arthur.rhein-neckar.de>
-Andy Zaugg <andy.zaugg@gmail.com>
+* Andy Zaugg <andy.zaugg@gmail.com>
-Aniello Del Sorbo <anidel@edu-gw.dia.unisa.it>
+* Aniello Del Sorbo <anidel@edu-gw.dia.unisa.it>
-Anton Gluck <gluc@midway.uchicago.edu>
+* Anton Gluck <gluc@midway.uchicago.edu>
-Arkadiusz Miskiewicz <misiek@pld.org.pl>
+* Arkadiusz Miskiewicz <misiek@pld.org.pl>
-Ben Collins <bcollins@debian.org>
+* Ben Collins <bcollins@debian.org>
-Brian R. Gaeke <brg@dgate.org>
+* Brian R. Gaeke <brg@dgate.org>
-Calle Karlsson <ckn@kash.se>
+* Calle Karlsson <ckn@kash.se>
-Chip Rosenthal <chip@unicom.com>
+* Chip Rosenthal <chip@unicom.com>
-Chris Evans <lady0110@sable.ox.ac.uk>
+* Chris Evans <lady0110@sable.ox.ac.uk>
-Chris Lamb <chris@chris-lamb.co.uk>
+* Chris Lamb <chris@chris-lamb.co.uk>
-Cristian Gafton <gafton@sorosis.ro>
+* Cristian Gafton <gafton@sorosis.ro>
-Dan Walsh <dwalsh@redhat.com>
+* Dan Walsh <dwalsh@redhat.com>
-Darcy Boese <possum@chardonnay.niagara.com>
+* Darcy Boese <possum@chardonnay.niagara.com>
-Dave Hagewood <admin@arrowweb.com>
+* Dave Hagewood <admin@arrowweb.com>
-David A. Holland <dholland@hcs.harvard.edu>
+* David A. Holland <dholland@hcs.harvard.edu>
-David Frey <David.Frey@lugs.ch>
+* David Frey <David.Frey@lugs.ch>
-Ed Carp <ecarp@netcom.com>
+* Ed Carp <ecarp@netcom.com>
-Ed Neville <ed@s5h.net>
+* Ed Neville <ed@s5h.net>
-Eric W. Biederman" <ebiederm@xmission.com>
+* Eric W. Biederman" <ebiederm@xmission.com>
-Floody <flood@evcom.net>
+* Floody <flood@evcom.net>
-Frank Denis <j@4u.net>
+* Frank Denis <j@4u.net>
-George Kraft IV <gk4@us.ibm.com>
+* George Kraft IV <gk4@us.ibm.com>
-Greg Mortensen <loki@world.std.com>
+* Greg Mortensen <loki@world.std.com>
-Guido van Rooij
+* Guido van Rooij
-Guy Maor <maor@debian.org>
+* Guy Maor <maor@debian.org>
-Hrvoje Dogan <hdogan@bjesomar.srce.hr>
+* Hrvoje Dogan <hdogan@bjesomar.srce.hr>
-Iker Pedrosa <ipedrosa@redhat.com>
+* Jakub Hrozek <jhrozek@redhat.com>
-Jakub Hrozek <jhrozek@redhat.com>
+* Janos Farkas <chexum@bankinf.banki.hu>
-Janos Farkas <chexum@bankinf.banki.hu>
+* Jason Franklin <jason.franklin@quoininc.com>
-Jason Franklin <jason.franklin@quoininc.com>
+* Jay Soffian <jay@lw.net>
-Jay Soffian <jay@lw.net>
+* Jesse Thilo <Jesse.Thilo@pobox.com>
-Jesse Thilo <Jesse.Thilo@pobox.com>
+* Joey Hess <joey@kite.ml.org>
-Joey Hess <joey@kite.ml.org>
+* John Adelsberger <jja@umr.edu>
-John Adelsberger <jja@umr.edu>
+* Jonathan Hankins <jhankins@mailserv.homewood.k12.al.us>
-Jonathan Hankins <jhankins@mailserv.homewood.k12.al.us>
+* Jon Lewis <jlewis@lewis.org>
-Jon Lewis <jlewis@lewis.org>
+* Joshua Cowan <jcowan@hermit.reslife.okstate.edu>
-Joshua Cowan <jcowan@hermit.reslife.okstate.edu>
+* Judd Bourgeois <shagboy@bluesky.net>
-Judd Bourgeois <shagboy@bluesky.net>
+* Juergen Heinzl <unicorn@noris.net>
-Juergen Heinzl <unicorn@noris.net>
+* Juha Virtanen <jiivee@iki.fi>
-Juha Virtanen <jiivee@iki.fi>
+* Julian Pidancet <julian.pidancet@gmail.com>
-Julian Pidancet <julian.pidancet@gmail.com>
+* Julianne Frances Haugh <julie78787@gmail.com>
-Julianne Frances Haugh <julie78787@gmail.com>
+* Leonard N. Zubkoff <lnz@dandelion.com>
-Leonard N. Zubkoff <lnz@dandelion.com>
+* Luca Berra <bluca@www.polimi.it>
-Luca Berra <bluca@www.polimi.it>
+* Lukáš Kuklínek <lkukline@redhat.com>
-Lukáš Kuklínek <lkukline@redhat.com>
+* Lutz Schwalowsky <schwalow@mineralogie.uni-hamburg.de>
-Lutz Schwalowsky <schwalow@mineralogie.uni-hamburg.de>
+* Marc Ewing <marc@redhat.com>
-Marc Ewing <marc@redhat.com>
+* Martin Bene <mb@sime.com>
-Martin Bene <mb@sime.com>
+* Martin Mares <mj@gts.cz>
-Martin Mares <mj@gts.cz>
+* Michael Meskes <meskes@topsystem.de>
-Michael Meskes <meskes@topsystem.de>
+* Michael Talbot-Wilson <mike@calypso.bns.com.au>
-Michael Talbot-Wilson <mike@calypso.bns.com.au>
+* Michael Vetter <jubalh@iodoru.org>
-Michael Vetter <jubalh@iodoru.org>
+* Mike Frysinger <vapier@gentoo.org>
-Mike Frysinger <vapier@gentoo.org>
+* Mike Pakovic <mpakovic@users.southeast.net>
-Mike Pakovic <mpakovic@users.southeast.net>
+* Nicolas François <nicolas.francois@centraliens.net>
-Nicolas François <nicolas.francois@centraliens.net>
+* Nikos Mavroyanopoulos <nmav@i-net.paiko.gr>
-Nikos Mavroyanopoulos <nmav@i-net.paiko.gr>
+* Pavel Machek <pavel@bug.ucw.cz>
-Pavel Machek <pavel@bug.ucw.cz>
+* Peter Vrabec <pvrabec@redhat.com>
-Peter Vrabec <pvrabec@redhat.com>
+* Phillip Street
-Phillip Street
+* Rafał Maszkowski <rzm@icm.edu.pl>
-Rafał Maszkowski <rzm@icm.edu.pl>
+* Rani Chouha <ranibey@smartec.com>
-Rani Chouha <ranibey@smartec.com>
+* Sami Kerola <kerolasa@rocketmail.com>
-Sami Kerola <kerolasa@rocketmail.com>
+* Scott Garman <scott.a.garman@intel.com>
-Scott Garman <scott.a.garman@intel.com>
+* Sebastian Rick Rijkers <srrijkers@gmail.com>
-Sebastian Rick Rijkers <srrijkers@gmail.com>
+* Seraphim Mellos <mellos@ceid.upatras.gr>
-Seraphim Mellos <mellos@ceid.upatras.gr>
+* Shane Watts <shane@nexus.mlckew.edu.au>
-Shane Watts <shane@nexus.mlckew.edu.au>
+* Steve M. Robbins <steve@nyongwa.montreal.qc.ca>
-Steve M. Robbins <steve@nyongwa.montreal.qc.ca>
+* Thorsten Kukuk <kukuk@suse.de>
-Thorsten Kukuk <kukuk@suse.de>
+* Tim Hockin <thockin@eagle.ais.net>
-Tim Hockin <thockin@eagle.ais.net>
+* Timo Karjalainen <timok@iki.fi>
-Timo Karjalainen <timok@iki.fi>
+* Ulisses Alonso Camaro <ulisses@pusa.eleinf.uv.es>
-Ulisses Alonso Camaro <ulisses@pusa.eleinf.uv.es>
+* Werner Fink <werner@suse.de>
-Werner Fink <werner@suse.de>

ChangeLog

@@ -1,3 +1,101 @@
+2022-11-08  Serge Hallyn <serge@hallyn.com>
+
+	* useradd.8: fix default group ID (Tim Biermann)
+	* Revert drop of subid_init() (Serge Hallyn)
+	* Georgian translation (NorwayFun)
+	* useradd: Avoid taking unneeded space: do not reset non-existent data
+	  in lastlog (David Kalnischkies)
+	* relax username restrictions (Alexander Kanavin)
+	* selinux: check MLS enabled before setting serange (genBTC)
+	* copy_tree: use fchmodat instead of chmod (Samanta Navarro)
+	* copy_tree: don't block on FIFOs (Samanta Navarro)
+	* add shell linter (Jan Macku)
+	* copy_tree: carefully treat permissions (Samanta Navarro)
+	* lib/commonio: make lock failures more detailed (Luca BRUNO)
+	* lib: use strzero and memzero where applicable (Christian Göttsche)
+	* Update Dutch translation (Frans Spiesschaert)
+	* Don't test for NULL before calling free (Alex Colomar)
+	* Use libc MAX() and MIN() (Alejandro Colomar)
+	* chage: Fix regression in print_date (Xiami)
+	* usermod: report error if homedir does not exist (Iker Pedrosa)
+	* libmisc: minimum id check for system accounts (Iker Pedrosa)
+	* fix usermod -rG x y wrongly adding a group (xyz)
+	* man: add missing space in useradd.8.xml (Iker Pedrosa)
+	* lastlog: check for localtime() return value (Iker Pedrosa)
+	* Raise limit for passwd and shadow entry length (Iker Pedrosa)
+	* Remove adduser-old.c (Alejandro Colomar)
+	* useradd: Fix buffer overflow when using a prefix (David Michael)
+	* Don't warn when failed to open /etc/nsswitch.conf (Serge Hallyn)
+
+2022-08-15  Serge Hallyn <serge@hallyn.com>
+
+	* Address CVE-2013-4235 (TOCTTOU when copying directories)
+	  (Christian Göttsche)
+
+2022-08-15  Serge Hallyn <serge@hallyn.com>
+
+	* Fix uk manpages
+
+2022-08-08  Serge Hallyn <serge@hallyn.com>
+
+	* Add absolute path hint to --root (Celeste Liu)
+	* Various cleanups (Christian Göttsche)
+	* Fix Ubuntu release used in CI tests (Jeremy Whiting)
+	* add -F options to useradd (and tests) (Masatake YAMATO)
+	* useradd manpage updates (Masatake YAMATO and Alexander Zhang))
+	* Check for ownerid (not just username) in subid ranges (Iker Pedrosa)
+
+2022-07-04  Serge Hallyn <serge@hallyn.com>
+
+	* Declare file local functions static (Christian Göttsche)
+	* Use strict prototypes (Christian Göttsche)
+	* Do not drop const qualifier for Basename (Christian Göttsche)
+	* Constify various pointers (Christian Göttsche)
+	* Don't return uninitialized memory (Christian Göttsche)
+	* Don't let compiler optimize away memory cleaning (Christian Göttsche)
+	* Remove many obsolete compatibility checks  and defines (Alejandro Colomar)
+	* Modify ID range check in useradd (Iker Pedrosa)
+	* Use "extern "C"" to make libsubid easier to use from C++ (Alois Wohlschlager)
+	* French translation updates (bubu)
+	* Fix s/with-pam/with-libpam/ (serge)
+	* Spanish translation updates (Fernando)
+	* French translation fixes (Balint Reczey)
+	* Default max group name length to 32 (Jami Kettunen)
+	* Fix PAM service files without-selinux (Ali Riza KESKIN)
+	* Improve manpages (Markus Hiereth)
+	  - groupadd, useradd, usermod
+	  - groups and id
+	  - pwck
+	* Add fedora to CI builds (Iker Pedrosa)
+	* Fix condition under which pw_dir check happens (Ed Neville)
+	* logoutd: switch to strncat (Steve Grubb)
+	* AUTHORS: improve markdown output (Iker Pedrosa)
+	* Handle ERANGE errors correctly (Niko)
+	* Check for fopen NULL return (juyin)
+	* Split get_salt() into its own fn juyin)
+	* Get salt before chroot to ensure /dev/urandom. (juyin)
+	* Chpasswd code cleanup (juyin)
+	* Work around git safe.directory enforcement (serge)
+	* Alphabetize order in usermod help (Matheus Marques)
+	* Erase password copy on error branches (Christian Göttsche)
+	* Suggest using --badname if needed (Iker Pedrosa)
+	* Update translation files (Iker Pedrosa)
+	* Correct badnames option to badname (Iker Pedrosa)
+	* configure: replace obsolete autoconf macros (Christian Göttsche)
+	* tests: replace egrep with grep -E (Sam James)
+	* Update Ukrainian translations (Yuri Chornoivan)
+	* Cleanups (Iker Pedrosa)
+	  - Remove redeclared variable
+	  - Remove commented out code and FIXMEs
+	  - Add header guards
+	  - Initialize local variables
+	* CI updates (Iker Pedrosa)
+	  - Create github workflow to install dependencies
+	  - Enable CodeQL
+	  - Update actions version
+	* libmisc: use /dev/urandom as fallback if other methods fail (Xi Ruoyao)
+
+
 2022-01-02  Serge Hallyn <serge@hallyn.com>
 
 	* build: include lib/shadowlog_internal.h in dist tarballs (Sam James)

acinclude.m4

@@ -6,7 +6,7 @@ AC_DEFUN([JH_PATH_XML_CATALOG],
 [
   # check for the presence of the XML catalog
   AC_ARG_WITH([xml-catalog],
-              AC_HELP_STRING([--with-xml-catalog=CATALOG],
+              AS_HELP_STRING([--with-xml-catalog=CATALOG],
                              [path to xml catalog to use]),,
               [with_xml_catalog=/etc/xml/catalog])
   jh_found_xmlcatalog=true

configure.ac

@@ -4,7 +4,7 @@ m4_define([libsubid_abi_major], 4)
 m4_define([libsubid_abi_minor], 0)
 m4_define([libsubid_abi_micro], 0)
 m4_define([libsubid_abi], [libsubid_abi_major.libsubid_abi_minor.libsubid_abi_micro])
-AC_INIT([shadow], [4.11.1], [pkg-shadow-devel@lists.alioth.debian.org], [],
+AC_INIT([shadow], [4.13], [pkg-shadow-devel@lists.alioth.debian.org], [],
 	[https://github.com/shadow-maint/shadow])
 AM_INIT_AUTOMAKE([1.11 foreign dist-xz])
 AC_CONFIG_MACRO_DIRS([m4])
@@ -20,26 +20,22 @@ dnl Some hacks...
 test "$prefix" = "NONE" && prefix="/usr"
 test "$prefix" = "/usr" && exec_prefix=""
 
-AC_GNU_SOURCE
+AC_USE_SYSTEM_EXTENSIONS
 
-AM_ENABLE_STATIC
+AC_ENABLE_STATIC
-AM_ENABLE_SHARED
+AC_ENABLE_SHARED
 
 AM_MAINTAINER_MODE
 
 dnl Checks for programs.
 AC_PROG_CC
-AC_ISC_POSIX
 AC_PROG_LN_S
 AC_PROG_YACC
-AM_PROG_LIBTOOL
+LT_INIT
 
 dnl Checks for libraries.
 
 dnl Checks for header files.
-AC_HEADER_DIRENT
-AC_HEADER_STDC
-AC_HEADER_SYS_WAIT
 AC_HEADER_STDBOOL
 
 AC_CHECK_HEADERS(crypt.h errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
@@ -52,26 +48,18 @@ dnl shadow now uses the libc's shadow implementation
 AC_CHECK_HEADER([shadow.h],,[AC_MSG_ERROR([You need a libc with shadow.h])])
 
 AC_CHECK_FUNCS(arc4random_buf l64a fchmod fchown fsync futimes \
-	gethostname getentropy getrandom getspnam gettimeofday getusershell \
+	getentropy getrandom getspnam getusershell \
-	getutent initgroups lchown lckpwdf lstat lutimes \
+	getutent initgroups lckpwdf lutimes \
-	setgroups sigaction strchr updwtmp updwtmpx innetgr getpwnam_r \
+	setgroups updwtmp updwtmpx innetgr getpwnam_r \
-	getpwuid_r getgrnam_r getgrgid_r getspnam_r getaddrinfo ruserok \
+	getpwuid_r getgrnam_r getgrgid_r getspnam_r \
-	dlopen)
+	memset_s explicit_bzero)
 AC_SYS_LARGEFILE
 
 dnl Checks for typedefs, structures, and compiler characteristics.
-AC_C_CONST
-AC_TYPE_UID_T
-AC_TYPE_OFF_T
-AC_TYPE_PID_T
-AC_TYPE_MODE_T
-AC_HEADER_STAT
-AC_CHECK_MEMBERS([struct stat.st_rdev])
 AC_CHECK_MEMBERS([struct stat.st_atim])
 AC_CHECK_MEMBERS([struct stat.st_atimensec])
 AC_CHECK_MEMBERS([struct stat.st_mtim])
 AC_CHECK_MEMBERS([struct stat.st_mtimensec])
-AC_HEADER_TIME
 AC_STRUCT_TM
 
 AC_CHECK_MEMBERS([struct utmp.ut_type,
@@ -113,7 +101,6 @@ fi
 
 dnl Checks for library functions.
 AC_TYPE_GETGROUPS
-AC_TYPE_SIGNAL
 AC_FUNC_UTIME_NULL
 AC_REPLACE_FUNCS(mkdir putgrent putpwent putspent rename rmdir)
 AC_REPLACE_FUNCS(sgetgrent sgetpwent sgetspent)
@@ -211,7 +198,7 @@ if test "$ac_cv_func_ruserok" = "yes"; then
 fi
 
 AC_ARG_ENABLE(shadowgrp,
-	[AC_HELP_STRING([--enable-shadowgrp], [enable shadow group support @<:@default=yes@:>@])],
+	[AS_HELP_STRING([--enable-shadowgrp], [enable shadow group support @<:@default=yes@:>@])],
 	[case "${enableval}" in
 	 yes) enable_shadowgrp="yes" ;;
 	  no) enable_shadowgrp="no" ;;
@@ -221,15 +208,15 @@ AC_ARG_ENABLE(shadowgrp,
 )
 
 AC_ARG_ENABLE(man,
-	[AC_HELP_STRING([--enable-man],
+	[AS_HELP_STRING([--enable-man],
 		[regenerate roff man pages from Docbook @<:@default=no@:>@])],
 	[enable_man="${enableval}"],
 	[enable_man="no"]
 )
 
 AC_ARG_ENABLE(account-tools-setuid,
-	[AC_HELP_STRING([--enable-account-tools-setuid],
+	[AS_HELP_STRING([--enable-account-tools-setuid],
-		[Install the user and group management tools setuid and authenticate the callers. This requires --with-pam.])],
+		[Install the user and group management tools setuid and authenticate the callers. This requires --with-libpam.])],
 	[case "${enableval}" in
 	 yes) enable_acct_tools_setuid="yes" ;;
 	  no) enable_acct_tools_setuid="no" ;;
@@ -240,7 +227,7 @@ AC_ARG_ENABLE(account-tools-setuid,
 )
 
 AC_ARG_ENABLE(utmpx,
-	[AC_HELP_STRING([--enable-utmpx],
+	[AS_HELP_STRING([--enable-utmpx],
 	                [enable loggin in utmpx / wtmpx @<:@default=no@:>@])],
 	[case "${enableval}" in
 	 yes) enable_utmpx="yes" ;;
@@ -251,65 +238,65 @@ AC_ARG_ENABLE(utmpx,
 )
 
 AC_ARG_ENABLE(subordinate-ids,
-	[AC_HELP_STRING([--enable-subordinate-ids],
+	[AS_HELP_STRING([--enable-subordinate-ids],
 		[support subordinate ids @<:@default=yes@:>@])],
 	[enable_subids="${enableval}"],
 	[enable_subids="maybe"]
 )
 
 AC_ARG_WITH(audit,
-	[AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
+	[AS_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
 	[with_audit=$withval], [with_audit=maybe])
 AC_ARG_WITH(libpam,
-	[AC_HELP_STRING([--with-libpam], [use libpam for PAM support @<:@default=yes if found@:>@])],
+	[AS_HELP_STRING([--with-libpam], [use libpam for PAM support @<:@default=yes if found@:>@])],
 	[with_libpam=$withval], [with_libpam=maybe])
 AC_ARG_WITH(btrfs,
-	[AC_HELP_STRING([--with-btrfs], [add BtrFS support @<:@default=yes if found@:>@])],
+	[AS_HELP_STRING([--with-btrfs], [add BtrFS support @<:@default=yes if found@:>@])],
 	[with_btrfs=$withval], [with_btrfs=maybe])
 AC_ARG_WITH(selinux,
-	[AC_HELP_STRING([--with-selinux], [use SELinux support @<:@default=yes if found@:>@])],
+	[AS_HELP_STRING([--with-selinux], [use SELinux support @<:@default=yes if found@:>@])],
 	[with_selinux=$withval], [with_selinux=maybe])
 AC_ARG_WITH(acl,
-	[AC_HELP_STRING([--with-acl], [use ACL support @<:@default=yes if found@:>@])],
+	[AS_HELP_STRING([--with-acl], [use ACL support @<:@default=yes if found@:>@])],
 	[with_acl=$withval], [with_acl=maybe])
 AC_ARG_WITH(attr,
-	[AC_HELP_STRING([--with-attr], [use Extended Attribute support @<:@default=yes if found@:>@])],
+	[AS_HELP_STRING([--with-attr], [use Extended Attribute support @<:@default=yes if found@:>@])],
 	[with_attr=$withval], [with_attr=maybe])
 AC_ARG_WITH(skey,
-	[AC_HELP_STRING([--with-skey], [use S/Key support @<:@default=no@:>@])],
+	[AS_HELP_STRING([--with-skey], [use S/Key support @<:@default=no@:>@])],
 	[with_skey=$withval], [with_skey=no])
 AC_ARG_WITH(tcb,
-	[AC_HELP_STRING([--with-tcb], [use tcb support (incomplete) @<:@default=yes if found@:>@])],
+	[AS_HELP_STRING([--with-tcb], [use tcb support (incomplete) @<:@default=yes if found@:>@])],
 	[with_tcb=$withval], [with_tcb=maybe])
 AC_ARG_WITH(libcrack,
-	[AC_HELP_STRING([--with-libcrack], [use libcrack @<:@default=no@:>@])],
+	[AS_HELP_STRING([--with-libcrack], [use libcrack @<:@default=no@:>@])],
 	[with_libcrack=$withval], [with_libcrack=no])
 AC_ARG_WITH(sha-crypt,
-	[AC_HELP_STRING([--with-sha-crypt], [allow the SHA256 and SHA512 password encryption algorithms @<:@default=yes@:>@])],
+	[AS_HELP_STRING([--with-sha-crypt], [allow the SHA256 and SHA512 password encryption algorithms @<:@default=yes@:>@])],
 	[with_sha_crypt=$withval], [with_sha_crypt=yes])
 AC_ARG_WITH(bcrypt,
-	[AC_HELP_STRING([--with-bcrypt], [allow the bcrypt password encryption algorithm @<:@default=no@:>@])],
+	[AS_HELP_STRING([--with-bcrypt], [allow the bcrypt password encryption algorithm @<:@default=no@:>@])],
 	[with_bcrypt=$withval], [with_bcrypt=no])
 AC_ARG_WITH(yescrypt,
-	[AC_HELP_STRING([--with-yescrypt], [allow the yescrypt password encryption algorithm @<:@default=no@:>@])],
+	[AS_HELP_STRING([--with-yescrypt], [allow the yescrypt password encryption algorithm @<:@default=no@:>@])],
 	[with_yescrypt=$withval], [with_yescrypt=no])
 AC_ARG_WITH(nscd,
-	[AC_HELP_STRING([--with-nscd], [enable support for nscd @<:@default=yes@:>@])],
+	[AS_HELP_STRING([--with-nscd], [enable support for nscd @<:@default=yes@:>@])],
 	[with_nscd=$withval], [with_nscd=yes])
 AC_ARG_WITH(sssd,
-	[AC_HELP_STRING([--with-sssd], [enable support for flushing sssd caches @<:@default=yes@:>@])],
+	[AS_HELP_STRING([--with-sssd], [enable support for flushing sssd caches @<:@default=yes@:>@])],
 	[with_sssd=$withval], [with_sssd=yes])
 AC_ARG_WITH(group-name-max-length,
-	[AC_HELP_STRING([--with-group-name-max-length], [set max group name length @<:@default=16@:>@])],
+	[AS_HELP_STRING([--with-group-name-max-length], [set max group name length @<:@default=32@:>@])],
 	[with_group_name_max_length=$withval], [with_group_name_max_length=yes])
 AC_ARG_WITH(su,
-	[AC_HELP_STRING([--with-su], [build and install su program and man page @<:@default=yes@:>@])],
+	[AS_HELP_STRING([--with-su], [build and install su program and man page @<:@default=yes@:>@])],
 	[with_su=$withval], [with_su=yes])
 
 if test "$with_group_name_max_length" = "no" ; then
 	with_group_name_max_length=0
 elif test "$with_group_name_max_length" = "yes" ; then
-	with_group_name_max_length=16
+	with_group_name_max_length=32
 fi
 AC_DEFINE_UNQUOTED(GROUP_NAME_MAX_LENGTH, $with_group_name_max_length, [max group name length])
 AC_SUBST(GROUP_NAME_MAX_LENGTH)
@@ -669,7 +656,7 @@ AM_CONDITIONAL(ACCT_TOOLS_SETUID, test "x$enable_acct_tools_setuid" = "xyes")
 
 
 AC_ARG_WITH(fcaps,
-	[AC_HELP_STRING([--with-fcaps], [use file capabilities instead of suid binaries for newuidmap/newgidmap @<:@default=no@:>@])],
+	[AS_HELP_STRING([--with-fcaps], [use file capabilities instead of suid binaries for newuidmap/newgidmap @<:@default=no@:>@])],
 	[with_fcaps=$withval], [with_fcaps=no])
 AM_CONDITIONAL(FCAPS, test "x$with_fcaps" = "xyes")
 
@@ -687,12 +674,12 @@ if test "$with_skey" = "yes"; then
 	AC_CHECK_LIB(skey, skeychallenge, [LIBSKEY=-lskey],
 		[AC_MSG_ERROR([liskey missing. You can download S/Key source code from http://rsync1.it.gentoo.org/gentoo/distfiles/skey-1.1.5.tar.bz2])])
 	AC_DEFINE(SKEY, 1, [Define to support S/Key logins.])
-	AC_TRY_COMPILE([
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 		#include <stdio.h>
 		#include <skey.h>
-	],[
+	]], [[
 		skeychallenge((void*)0, (void*)0, (void*)0, 0);
-	],[AC_DEFINE(SKEY_BSD_STYLE, 1, [Define to support newer BSD S/Key API])])
+	]])],[AC_DEFINE(SKEY_BSD_STYLE, 1, [Define to support newer BSD S/Key API])],[])
 fi
 
 if test "$enable_utmpx" = "yes"; then
@@ -706,7 +693,7 @@ fi
 
 AC_DEFINE_UNQUOTED(SHELL, ["$SHELL"], [The default shell.])
 
-AM_GNU_GETTEXT_VERSION(0.16)
+AM_GNU_GETTEXT_VERSION([0.19])
 AM_GNU_GETTEXT([external], [need-ngettext])
 AM_CONDITIONAL(USE_NLS, test "x$USE_NLS" = "xyes")
 
@@ -733,6 +720,7 @@ AC_CONFIG_FILES([
 	man/ru/Makefile
 	man/sv/Makefile
 	man/tr/Makefile
+	man/uk/Makefile
 	man/zh_CN/Makefile
 	man/zh_TW/Makefile
 	libmisc/Makefile

contrib/Makefile.am

@@ -1,6 +1,6 @@
 # This is a dummy Makefile.am to get automake work flawlessly,
 # and also cooperate to make a distribution for `make dist'
 
-EXTRA_DIST = README adduser.c adduser-old.c adduser.sh adduser2.sh \
+EXTRA_DIST = README adduser.c adduser.sh adduser2.sh \
  atudel groupmems.shar pwdauth.c shadow-anonftp.patch \
  udbachk.tgz

contrib/adduser-old.c

@@ -1,300 +0,0 @@
-/****
-** 03/17/96
-** hacked a bit more, removed unused code, cleaned up for gcc -Wall.
-** --marekm
-**
-** 02/26/96
-** modified to call shadow utils (useradd,chage,passwd) on shadowed
-** systems - Cristian Gafton, gafton@sorosis.ro
-**
-** 6/27/95
-** shadow-adduser 1.4:
-**
-** now it copies the /etc/skel dir into the person's dir,
-** makes the mail folders, changed some defaults and made a 'make
-** install' just for the hell of it.
-**
-** Greg Gallagher
-** CIN.Net
-**
-** 1/28/95
-** shadow-adduser 1.3:
-**
-** Basically a bug-fix on my additions in 1.2.  Thanks to Terry Stewart
-** (stew@texas.net) for pointing out one of the many idiotic bugs I introduced.
-** It was such a stupid bug that I would have never seen it myself.
-**
-**                                Brandon
-*****
-** 01/27/95
-**
-** shadow-adduser 1.2:
-** I took the C source from adduser-shadow (credits are below) and made
-** it a little more worthwhile.  Many small changes... Here's
-** the ones I can remember:
-**
-** Removed support for non-shadowed systems (if you don't have shadow,
-**     use the original adduser, don't get this shadow version!)
-** Added support for the correct /etc/shadow fields (Min days before
-**     password change, max days before password change, Warning days,
-**     and how many days from expiry date does the account go invalid)
-**     The previous version just left all of those fields blank.
-**     There is still one field left (expiry date for the account, period)
-**     which I have left blank because I do not use it and didn't want to
-**     spend any more time on this.  I'm sure someone will put it in and
-**     tack another plethora of credits on here. :)
-** Added in the password date field, which should always reflect the last
-**     date the password was changed, for expiry purposes.  "passwd" always
-**     updates this field, so the adduser program should set it up right
-**     initially (or a user could keep thier initial password forever ;)
-**     The number is in days since Jan 1st, 1970.
-**
-**                       Have fun with it, and someone please make
-**                       a real version(this is still just a hack)
-**                       for us all to use (and Email it to me???)
-**
-**                               Brandon
-**                                  photon@usis.com
-**
-*****
-** adduser 1.0: add a new user account (For systems not using shadow)
-** With a nice little interface and a will to do all the work for you.
-**
-** Craig Hagan
-** hagan@opine.cs.umass.edu
-**
-** Modified to really work, look clean, and find unused uid by Chris Cappuccio
-** chris@slinky.cs.umass.edu
-**
-*****
-**
-** 01/19/95
-**
-** FURTHER modifications to enable shadow passwd support (kludged, but
-** no more so than the original)  by Dan Crowson - dcrowson@mo.net
-**
-** Search on DAN for all changes...
-**
-*****
-**
-** cc -O -o adduser adduser.c
-** Use gcc if you have it... (political reasons beyond my control) (chris)
-**
-** I've gotten this program to work with success under Linux (without
-** shadow) and SunOS 4.1.3. I would assume it should work pretty well
-** on any system that uses no shadow. (chris)
-**
-** If you have no crypt() then try
-** cc -DNO_CRYPT -O -o adduser adduser.c xfdes.c
-** I'm not sure how login operates with no crypt()... I guess
-** the same way we're doing it here.
-*/
-
-#include <pwd.h>
-#include <grp.h>
-#include <ctype.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <time.h>
-#include <sys/types.h>
-#include <sys/timeb.h>
-#include <sys/time.h>
-#include <sys/stat.h>
-
-#define DEFAULT_SHELL	"/bin/bash"  /* because BASH is your friend */
-#define DEFAULT_HOME	"/home"
-#define USERADD_PATH	"/usr/sbin/useradd"
-#define CHAGE_PATH	"/usr/sbin/chage"
-#define PASSWD_PATH	"/usr/bin/passwd"
-#define DEFAULT_GROUP	100
-
-#define DEFAULT_MAX_PASS 60
-#define DEFAULT_WARN_PASS 10
-/* if you use this feature, you will get a lot of complaints from users
-   who rarely use their accounts :)  (something like 3 months would be
-   more reasonable)  --marekm */
-#define DEFAULT_USER_DIE /* 10 */ 0
-
-void main()
-{
-	char foo[32];
-	char uname[9],person[32],dir[32],shell[32];
-	unsigned int group,min_pass,max_pass,warn_pass,user_die;
-	/* the group and uid of the new user */
-	int bad=0,done=0,correct=0,gets_warning=0;
-	char cmd[255];
-	struct group *grp;
-
-	/* flags, in order:
-	* bad to see if the username is in /etc/passwd, or if strange stuff has
-	* been typed if the user might be put in group 0
-	* done allows the program to exit when a user has been added
-	* correct loops until a password is found that isn't in /etc/passwd
-	* gets_warning allows the fflush to be skipped for the first gets
-	* so that output is still legible
-	*/
-
-	/* The real program starts HERE! */
-
-	if(geteuid()!=0)
-	{
-		printf("It seems you don't have access to add a new user.  Try\n");
-		printf("logging in as root or su root to gain super-user access.\n");
-		exit(1);
-	}
-
-	/* Sanity checks
-	*/
-
-	if (!(grp=getgrgid(DEFAULT_GROUP))){
-		printf("Error: the default group %d does not exist on this system!\n",
-				DEFAULT_GROUP);
-		printf("adduser must be recompiled.\n");
-		exit(1);
-	};
-
-	while(!correct) {		/* loop until a "good" uname is chosen */
-		while(!done) {
-			printf("\nLogin to add (^C to quit): ");
-			if(gets_warning)	/* if the warning was already shown */
-				fflush(stdout);	/* fflush stdout, otherwise set the flag */
-			else
-				gets_warning=1;
-
-			gets(uname);
-			if(!strlen(uname)) {
-				printf("Empty input.\n");
-				done=0;
-				continue;
-			};
-
-			/* what I saw here before made me think maybe I was running DOS */
-			/* might this be a solution? (chris) */
-			if (getpwnam(uname) != NULL) {
-				printf("That name is in use, choose another.\n");
-				done=0;
-			} else
-				done=1;
-		}; /* done, we have a valid new user name */
-
-		/* all set, get the rest of the stuff */
-		printf("\nEditing information for new user [%s]\n",uname);
-
-		printf("\nFull Name [%s]: ",uname);
-		gets(person);
-		if (!strlen(person)) {
-			bzero(person,sizeof(person));
-			strcpy(person,uname);
-		};
-
-		do {
-			bad=0;
-			printf("GID [%d]: ",DEFAULT_GROUP);
-			gets(foo);
-			if (!strlen(foo))
-				group=DEFAULT_GROUP;
-			else
-				if (isdigit (*foo)) {
-					group = atoi(foo);
-					if (! (grp = getgrgid (group))) {
-						printf("unknown gid %s\n",foo);
-						group=DEFAULT_GROUP;
-						bad=1;
-					};
-			} else
-				if ((grp = getgrnam (foo)))
-					group = grp->gr_gid;
-				else {
-					printf("unknown group %s\n",foo);
-					group=DEFAULT_GROUP;
-					bad=1;
-				}
-			if (group==0){	/* You're not allowed to make root group users! */
-				printf("Creation of root group users not allowed (must be done by hand)\n");
-				group=DEFAULT_GROUP;
-				bad=1;
-			};
-		} while(bad);
-
-
-		fflush(stdin);
-
-		printf("\nIf home dir ends with a / then [%s] will be appended to it\n",uname);
-		printf("Home Directory [%s/%s]: ",DEFAULT_HOME,uname);
-		fflush(stdout);
-		gets(dir);
-		if (!strlen(dir)) { /* hit return */
-			sprintf(dir,"%s/%s",DEFAULT_HOME,uname);
-			fflush(stdin);
-		} else
-			if (dir[strlen(dir)-1]=='/')
-				sprintf(dir+strlen(dir),"%s",uname);
-
-		printf("\nShell [%s]: ",DEFAULT_SHELL);
-		fflush(stdout);
-		gets(shell);
-		if (!strlen(shell))
-			sprintf(shell,"%s",DEFAULT_SHELL);
-
-		printf("\nMin. Password Change Days [0]: ");
-		gets(foo);
-		min_pass=atoi(foo);
-
-		printf("Max. Password Change Days [%d]: ",DEFAULT_MAX_PASS);
-		gets(foo);
-		if (strlen(foo) > 1)
-			max_pass = atoi(foo);
-		else
-			max_pass = DEFAULT_MAX_PASS;
-
-		printf("Password Warning Days [%d]: ",DEFAULT_WARN_PASS);
-		gets(foo);
-		warn_pass = atoi(foo);
-		if (warn_pass==0)
-			warn_pass = DEFAULT_WARN_PASS;
-
-		printf("Days after Password Expiry for Account Locking [%d]: ",DEFAULT_USER_DIE);
-		gets(foo);
-		user_die = atoi(foo);
-		if (user_die == 0)
-			user_die = DEFAULT_USER_DIE;
-
-		printf("\nInformation for new user [%s] [%s]:\n",uname,person);
-		printf("Home directory: [%s] Shell: [%s]\n",dir,shell);
-		printf("GID: [%d]\n",group);
-		printf("MinPass: [%d] MaxPass: [%d] WarnPass: [%d] UserExpire: [%d]\n",
-				min_pass,max_pass,warn_pass,user_die);
-		printf("\nIs this correct? [y/N]: ");
-		fflush(stdout);
-		gets(foo);
-
-		done=bad=correct=(foo[0]=='y'||foo[0]=='Y');
-
-		if(bad!=1)
-			printf("\nUser [%s] not added\n",uname);
-    }
-
-	bzero(cmd,sizeof(cmd));
-	sprintf(cmd,"%s -g %d -d %s -s %s -c \"%s\" -m -k /etc/skel %s",
-			USERADD_PATH,group,dir,shell,person,uname);
-	printf("Calling useradd to add new user:\n%s\n",cmd);
-	if(system(cmd)){
-		printf("User add failed!\n");
-		exit(errno);
-	};
-	bzero(cmd,sizeof(cmd));
-	sprintf(cmd,"%s -m %d -M %d -W %d -I %d %s", CHAGE_PATH,
-			min_pass,max_pass,warn_pass,user_die,uname);
-	printf("%s\n",cmd);
-	if(system(cmd)){
-		printf("There was an error setting password expire values\n");
-		exit(errno);
-	};
-	bzero(cmd,sizeof(cmd));
-	sprintf(cmd,"%s %s",PASSWD_PATH,uname);
-	system(cmd);
-	printf("\nDone.\n");
-}
-

etc/pam.d/login

@@ -4,8 +4,8 @@ auth		include		system-auth
 account		required	pam_nologin.so
 account		include		system-auth
 password	include		system-auth
-session		required	pam_selinux.so close
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
 session		include		system-auth
 session		required	pam_loginuid.so
 session		optional	pam_console.so
-session		required	pam_selinux.so open
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

etc/pam.d/su

@@ -7,7 +7,7 @@ auth		required	pam_wheel.so use_uid
 auth		include		system-auth
 account		include		system-auth
 password	include		system-auth
-session		required	pam_selinux.so close
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
 session		include		system-auth
-session		required	pam_selinux.so open multiple
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
 session		optional	pam_xauth.so

lib/commonio.c

@@ -32,7 +32,7 @@
 
 /* local function prototypes */
 static int lrename (const char *, const char *);
-static int check_link_count (const char *file);
+static int check_link_count (const char *file, bool log);
 static int do_lock_file (const char *file, const char *lock, bool log);
 static /*@null@*/ /*@dependent@*/FILE *fopen_set_perms (
 	const char *name,
@@ -65,7 +65,6 @@ int lrename (const char *old, const char *new)
 	int res;
 	char *r = NULL;
 
-#if defined(S_ISLNK)
 #ifndef __GLIBC__
 	char resolved_path[PATH_MAX];
 #endif				/* !__GLIBC__ */
@@ -82,28 +81,35 @@ int lrename (const char *old, const char *new)
 			new = r;
 		}
 	}
-#endif				/* S_ISLNK */
 
 	res = rename (old, new);
 
 #ifdef __GLIBC__
-	if (NULL != r) {
+	free (r);
-		free (r);
-	}
 #endif				/* __GLIBC__ */
 
 	return res;
 }
 
-static int check_link_count (const char *file)
+static int check_link_count (const char *file, bool log)
 {
 	struct stat sb;
 
 	if (stat (file, &sb) != 0) {
+		if (log) {
+			(void) fprintf (shadow_logfd,
+			                "%s: %s file stat error: %s\n",
+			                shadow_progname, file, strerror (errno));
+		}
 		return 0;
 	}
 
 	if (sb.st_nlink != 2) {
+		if (log) {
+			(void) fprintf (shadow_logfd,
+			                "%s: %s: lock file already used (nlink: %u)\n",
+			                shadow_progname, file, sb.st_nlink);
+		}
 		return 0;
 	}
 
@@ -155,12 +161,7 @@ static int do_lock_file (const char *file, const char *lock, bool log)
 	close (fd);
 
 	if (link (file, lock) == 0) {
-		retval = check_link_count (file);
+		retval = check_link_count (file, log);
-		if ((0==retval) && log) {
-			(void) fprintf (shadow_logfd,
-			                "%s: %s: lock file already used\n",
-			                shadow_progname, file);
-		}
 		unlink (file);
 		return retval;
 	}
@@ -221,12 +222,7 @@ static int do_lock_file (const char *file, const char *lock, bool log)
 
 	retval = 0;
 	if (link (file, lock) == 0) {
-		retval = check_link_count (file);
+		retval = check_link_count (file, log);
-		if ((0==retval) && log) {
-			(void) fprintf (shadow_logfd,
-			                "%s: %s: lock file already used\n",
-			                shadow_progname, file);
-		}
 	} else {
 		if (log) {
 			(void) fprintf (shadow_logfd,
@@ -339,9 +335,7 @@ static void free_linked_list (struct commonio_db *db)
 		p = db->head;
 		db->head = p->next;
 
-		if (NULL != p->line) {
+		free (p->line);
-			free (p->line);
-		}
 
 		if (NULL != p->eptr) {
 			db->ops->free (p->eptr);
@@ -397,10 +391,8 @@ int commonio_lock_nowait (struct commonio_db *db, bool log)
 		err = 1;
 	}
 cleanup_ENOMEM:
-	if (file)
+	free(file);
-		free(file);
+	free(lock);
-	if (lock)
-		free(lock);
 	return err;
 }
 
@@ -1202,9 +1194,7 @@ int commonio_remove (struct commonio_db *db, const char *name)
 
 	commonio_del_entry (db, p);
 
-	if (NULL != p->line) {
+	free (p->line);
-		free (p->line);
-	}
 
 	if (NULL != p->eptr) {
 		db->ops->free (p->eptr);

lib/defines.h

@@ -22,8 +22,6 @@ typedef unsigned char _Bool;
 # define __bool_true_false_are_defined 1
 #endif
 
-#define ISDIGIT_LOCALE(c) (IN_CTYPE_DOMAIN (c) && isdigit (c))
-
 /* Take care of NLS matters.  */
 #ifdef S_SPLINT_S
 extern char *setlocale(int categories, const char *locale);
@@ -61,16 +59,8 @@ extern char * textdomain (const char * domainname);
 #endif
 #endif
 
-#if STDC_HEADERS
+#include <stdlib.h>
-# include <stdlib.h>
+#include <string.h>
-# include <string.h>
-#else				/* not STDC_HEADERS */
-# ifndef HAVE_STRCHR
-#  define strchr index
-#  define strrchr rindex
-# endif
-char *strchr (), *strrchr (), *strtok ();
-#endif				/* not STDC_HEADERS */
 
 #if HAVE_ERRNO_H
 # include <errno.h>
@@ -78,15 +68,7 @@ char *strchr (), *strrchr (), *strtok ();
 
 #include <sys/stat.h>
 #include <sys/types.h>
-#if HAVE_SYS_WAIT_H
+#include <sys/wait.h>
-# include <sys/wait.h>
-#endif
-#ifndef WEXITSTATUS
-# define WEXITSTATUS(stat_val) ((unsigned)(stat_val) >> 8)
-#endif
-#ifndef WIFEXITED
-# define WIFEXITED(stat_val) (((stat_val) & 255) == 0)
-#endif
 
 #if HAVE_UNISTD_H
 # include <unistd.h>
@@ -100,35 +82,26 @@ char *strchr (), *strrchr (), *strtok ();
 # include <crypt.h>
 #endif
 
-#if TIME_WITH_SYS_TIME
+#include <sys/time.h>
-# include <sys/time.h>
+#include <time.h>
-# include <time.h>
+
-#else				/* not TIME_WITH_SYS_TIME */
+#ifdef HAVE_MEMSET_S
-# if HAVE_SYS_TIME_H
+# define memzero(ptr, size) memset_s((ptr), 0, (size))
-#  include <sys/time.h>
+#elif defined HAVE_EXPLICIT_BZERO	/* !HAVE_MEMSET_S */
-# else
+# define memzero(ptr, size) explicit_bzero((ptr), (size))
-#  include <time.h>
+#else					/* !HAVE_MEMSET_S && HAVE_EXPLICIT_BZERO */
-# endif
+static inline void memzero(void *ptr, size_t size)
-#endif				/* not TIME_WITH_SYS_TIME */
+{
+	volatile unsigned char * volatile p = ptr;
+	while (size--) {
+		*p++ = '\0';
+	}
+}
+#endif					/* !HAVE_MEMSET_S && !HAVE_EXPLICIT_BZERO */
 
-#define memzero(ptr, size) memset((void *)(ptr), 0, (size))
 #define strzero(s) memzero(s, strlen(s))	/* warning: evaluates twice */
 
-#ifdef HAVE_DIRENT_H		/* DIR_SYSV */
+#include <dirent.h>
-# include <dirent.h>
-# define DIRECT dirent
-#else
-# ifdef HAVE_SYS_NDIR_H		/* DIR_XENIX */
-#  include <sys/ndir.h>
-# endif
-# ifdef HAVE_SYS_DIR_H		/* DIR_??? */
-#  include <sys/dir.h>
-# endif
-# ifdef HAVE_NDIR_H		/* DIR_BSD */
-#  include <ndir.h>
-# endif
-# define DIRECT direct
-#endif
 
 /*
  * Possible cases:
@@ -232,30 +205,6 @@ char *strchr (), *strrchr (), *strtok ();
 # define SEEK_END 2
 #endif
 
-#ifdef STAT_MACROS_BROKEN
-# define S_ISDIR(x) ((x) & S_IFMT) == S_IFDIR)
-# define S_ISREG(x) ((x) & S_IFMT) == S_IFREG)
-# ifdef S_IFLNK
-#  define S_ISLNK(x) ((x) & S_IFMT) == S_IFLNK)
-# endif
-#endif
-
-#ifndef S_ISLNK
-#define S_ISLNK(x) (0)
-#endif
-
-#if HAVE_LCHOWN
-#define LCHOWN lchown
-#else
-#define LCHOWN chown
-#endif
-
-#if HAVE_LSTAT
-#define LSTAT lstat
-#else
-#define LSTAT stat
-#endif
-
 #if HAVE_TERMIOS_H
 # include <termios.h>
 # define STTY(fd, termio) tcsetattr(fd, TCSANOW, termio)
@@ -355,16 +304,10 @@ extern char *strerror ();
 /* To be used for verified unused parameters */
 #if defined(__GNUC__) && !defined(__STRICT_ANSI__)
 # define unused __attribute__((unused))
+# define format_attr(type, index, check) __attribute__((format (type, index, check)))
 #else
 # define unused
-#endif
+# define format_attr(type, index, check)
-
-/* ! Arguments evaluated twice ! */
-#ifndef MIN
-#define MIN(a,b) (((a) < (b)) ? (a) : (b))
-#endif
-#ifndef MAX
-#define MAX(x,y) (((x) > (y)) ? (x) : (y))
 #endif
 
 /* Maximum length of usernames */
@@ -384,6 +327,9 @@ extern char *strerror ();
 # endif
 #endif
 
+/* Maximum length of passwd entry */
+#define PASSWD_ENTRY_MAX_LENGTH 32768
+
 #ifdef HAVE_SECURE_GETENV
 #  define shadow_getenv(name) secure_getenv(name)
 # else

lib/getdef.c

@@ -345,7 +345,6 @@ unsigned long getdef_ulong (const char *item, unsigned long dflt)
 	}
 
 	if (getulong (d->value, &val) == 0) {
-		/* FIXME: we should have a getulong */
 		fprintf (shadow_logfd,
 		         _("configuration error - cannot parse %s value: '%s'"),
 		         item, d->value);
@@ -389,10 +388,7 @@ int putdef_str (const char *name, const char *value)
 		return -1;
 	}
 
-	if (NULL != d->value) {
+	free (d->value);
-		free (d->value);
-	}
-
 	d->value = cp;
 	return 0;
 }

lib/groupio.c

@@ -418,9 +418,7 @@ static int split_groups (unsigned int max_members)
 		/* Shift all the members */
 		/* The number of members in new_gptr will be check later */
 		for (i = 0; NULL != new_gptr->gr_mem[i + max_members]; i++) {
-			if (NULL != new_gptr->gr_mem[i]) {
+			free (new_gptr->gr_mem[i]);
-				free (new_gptr->gr_mem[i]);
-			}
 			new_gptr->gr_mem[i] = new_gptr->gr_mem[i + max_members];
 			new_gptr->gr_mem[i + max_members] = NULL;
 		}

lib/groupmem.c

@@ -80,7 +80,7 @@ void gr_free (/*@out@*/ /*@only@*/struct group *grent)
 {
 	free (grent->gr_name);
 	if (NULL != grent->gr_passwd) {
-		memzero (grent->gr_passwd, strlen (grent->gr_passwd));
+		strzero (grent->gr_passwd);
 		free (grent->gr_passwd);
 	}
 	gr_free_members(grent);

lib/nss.c

@@ -9,6 +9,7 @@
 #include "prototypes.h"
 #include "../libsubid/subid.h"
 #include "shadowlog_internal.h"
+#include "shadowlog.h"
 
 #define NSSWITCH "/etc/nsswitch.conf"
 
@@ -29,7 +30,7 @@ bool nss_is_initialized() {
 	return atomic_load(&nss_init_completed);
 }
 
-void nss_exit() {
+static void nss_exit(void) {
 	if (nss_is_initialized() && subid_nss) {
 		dlclose(subid_nss->handle);
 		free(subid_nss);
@@ -38,10 +39,11 @@ void nss_exit() {
 }
 
 // nsswitch_path is an argument only to support testing.
-void nss_init(char *nsswitch_path) {
+void nss_init(const char *nsswitch_path) {
 	FILE *nssfp = NULL;
 	char *line = NULL, *p, *token, *saveptr;
 	size_t len = 0;
+	FILE *shadow_logfd = log_get_logfd();
 
 	if (atomic_flag_test_and_set(&nss_init_started)) {
 		// Another thread has started nss_init, wait for it to complete
@@ -57,7 +59,6 @@ void nss_init(char *nsswitch_path) {
 	//   subid:	files
 	nssfp = fopen(nsswitch_path, "r");
 	if (!nssfp) {
-		fprintf(shadow_logfd, "Failed opening %s: %m", nsswitch_path);
 		atomic_store(&nss_init_completed, true);
 		return;
 	}

lib/prototypes.h

@@ -159,12 +159,12 @@ extern int getlong (const char *numstr, /*@out@*/long int *result);
 extern int get_pid (const char *pidstr, pid_t *pid);
 
 /* getrange */
-extern int getrange (char *range,
+extern int getrange (const char *range,
                      unsigned long *min, bool *has_min,
                      unsigned long *max, bool *has_max);
 
 /* gettime.c */
-extern time_t gettime ();
+extern time_t gettime (void);
 
 /* get_uid.c */
 extern int get_uid (const char *uidstr, uid_t *uid);
@@ -242,8 +242,8 @@ extern /*@null@*//*@only@*/struct passwd *get_my_pwent (void);
 
 /* nss.c */
 #include <libsubid/subid.h>
-extern void nss_init(char *nsswitch_path);
+extern void nss_init(const char *nsswitch_path);
-extern bool nss_is_initialized();
+extern bool nss_is_initialized(void);
 
 struct subid_nss_ops {
 	/*
@@ -293,7 +293,7 @@ struct subid_nss_ops {
 	void *handle;
 };
 
-extern struct subid_nss_ops *get_subid_nss_handle();
+extern struct subid_nss_ops *get_subid_nss_handle(void);
 
 
 /* pam_pass_non_interactive.c */
@@ -324,12 +324,12 @@ extern struct passwd *prefix_getpwuid(uid_t uid);
 extern struct passwd *prefix_getpwnam(const char* name);
 extern struct spwd *prefix_getspnam(const char* name);
 extern struct group *prefix_getgr_nam_gid(const char *grname);
-extern void prefix_setpwent();
+extern void prefix_setpwent(void);
-extern struct passwd* prefix_getpwent();
+extern struct passwd* prefix_getpwent(void);
-extern void prefix_endpwent();
+extern void prefix_endpwent(void);
-extern void prefix_setgrent();
+extern void prefix_setgrent(void);
-extern struct group* prefix_getgrent();
+extern struct group* prefix_getgrent(void);
-extern void prefix_endgrent();
+extern void prefix_endgrent(void);
 
 /* pwd2spwd.c */
 #ifndef USE_PAM
@@ -480,10 +480,9 @@ extern int setutmpx (struct utmpx *utx);
 extern bool valid (const char *, const struct passwd *);
 
 /* xmalloc.c */
-extern /*@maynotreturn@*/ /*@only@*//*@out@*//*@notnull@*/char *xmalloc (size_t size)
+extern /*@maynotreturn@*/ /*@only@*//*@out@*//*@notnull@*/void *xmalloc (size_t size)
   /*@ensures MaxSet(result) == (size - 1); @*/;
 extern /*@maynotreturn@*/ /*@only@*//*@notnull@*/char *xstrdup (const char *);
-extern void xfree(void *ap);
 
 /* xgetpwnam.c */
 extern /*@null@*/ /*@only@*/struct passwd *xgetpwnam (const char *);

lib/pwauth.h

@@ -11,6 +11,9 @@
  *	$Id$
  */
 
+#ifndef _PWAUTH_H
+#define _PWAUTH_H
+
 #ifndef USE_PAM
 int pw_auth (const char *cipher,
              const char *user,
@@ -41,3 +44,5 @@ int pw_auth (const char *cipher,
 #define	PW_RLOGIN	202
 #define	PW_FTP		203
 #define	PW_REXEC	204
+
+#endif /* _PWAUTH_H */

lib/pwio.c

@@ -56,7 +56,10 @@ static int passwd_put (const void *ent, FILE * file)
 	    || (pw->pw_gid == (gid_t)-1)
 	    || (valid_field (pw->pw_gecos, ":\n") == -1)
 	    || (valid_field (pw->pw_dir, ":\n") == -1)
-	    || (valid_field (pw->pw_shell, ":\n") == -1)) {
+	    || (valid_field (pw->pw_shell, ":\n") == -1)
+	    || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
+	        strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
+	        strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
 		return -1;
 	}
 

lib/pwmem.c

@@ -73,7 +73,7 @@ void pw_free (/*@out@*/ /*@only@*/struct passwd *pwent)
 	if (pwent != NULL) {
 		free (pwent->pw_name);
 		if (pwent->pw_passwd) {
-			memzero (pwent->pw_passwd, strlen (pwent->pw_passwd));
+			strzero (pwent->pw_passwd);
 			free (pwent->pw_passwd);
 		}
 		free (pwent->pw_gecos);

lib/run_part.c

@@ -8,9 +8,10 @@
 #include <sys/wait.h>
 #include <unistd.h>
 #include <lib/prototypes.h>
+#include "run_part.h"
 #include "shadowlog_internal.h"
 
-int run_part (char *script_path, char *name, char *action)
+int run_part (char *script_path, const char *name, const char *action)
 {
 	int pid;
 	int wait_status;
@@ -39,15 +40,15 @@ int run_part (char *script_path, char *name, char *action)
 	return (1);
 }
 
-int run_parts (char *directory, char *name, char *action)
+int run_parts (const char *directory, const char *name, const char *action)
 {
 	struct dirent **namelist;
 	int scanlist;
 	int n;
-	int execute_result;
+	int execute_result = 0;
 
 	scanlist = scandir (directory, &namelist, 0, alphasort);
-	if (scanlist<0) {
+	if (scanlist<=0) {
 		return (0);
 	}
 

lib/run_part.h

@@ -1,2 +1,7 @@
-int run_part (char *script_path, char *name, char *action);
+#ifndef _RUN_PART_H
-int run_parts (char *directory, char *name, char *action);
+#define _RUN_PART_H
+
+int run_part (char *script_path, const char *name, const char *action);
+int run_parts (const char *directory, const char *name, const char *action);
+
+#endif /* _RUN_PART_H */

lib/selinux.c

@@ -109,7 +109,7 @@ int reset_selinux_file_context (void)
 /*
  *  Log callback for libselinux internal error reporting.
  */
-__attribute__((__format__ (printf, 2, 3)))
+format_attr(printf, 2, 3)
 static int selinux_log_cb (int type, const char *fmt, ...) {
 	va_list ap;
 	char *buf;

lib/semanage.c

@@ -27,6 +27,7 @@
 #endif
 
 
+format_attr(printf, 3, 4)
 static void semanage_error_callback (unused void *varg,
                                      semanage_handle_t *handle,
                                      const char *fmt, ...)
@@ -121,12 +122,14 @@ static int semanage_user_mod (semanage_handle_t *handle,
 		goto done;
 	}
 
-	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
+	if (semanage_mls_enabled(handle)) {
-	if (ret != 0) {
+		ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
-		fprintf (shadow_logfd,
+		if (ret != 0) {
-		         _("Could not set serange for %s\n"), login_name);
+			fprintf (shadow_logfd,
-		ret = 1;
+			         _("Could not set serange for %s\n"), login_name);
-		goto done;
+			ret = 1;
+			goto done;
+		}
 	}
 
 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
@@ -178,13 +181,14 @@ static int semanage_user_add (semanage_handle_t *handle,
 		goto done;
 	}
 
-	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
+	if (semanage_mls_enabled(handle)) {
-	if (ret != 0) {
+		ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
-		fprintf (shadow_logfd,
+		if (ret != 0) {
-		         _("Could not set serange for %s\n"),
+			fprintf (shadow_logfd,
-		         login_name);
+			         _("Could not set serange for %s\n"), login_name);
-		ret = 1;
+			ret = 1;
-		goto done;
+			goto done;
+		}
 	}
 
 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);

lib/sgetgrent.c

@@ -54,8 +54,7 @@ static char **list (char *s)
 				rbuf = malloc (size * sizeof (char *));
 			}
 			if (!rbuf) {
-				if (members)
+				free (members);
-					free (members);
 				members = 0;
 				size = 0;
 				return (char **) 0;
@@ -89,8 +88,7 @@ struct group *sgetgrent (const char *buf)
 	if (strlen (buf) + 1 > size) {
 		/* no need to use realloc() here - just free it and
 		   allocate a larger block */
-		if (grpbuf)
+		free (grpbuf);
-			free (grpbuf);
 		size = strlen (buf) + 1000;	/* at least: strlen(buf) + 1 */
 		grpbuf = malloc (size);
 		if (!grpbuf) {

lib/sgetpwent.c

@@ -16,6 +16,7 @@
 #include <stdio.h>
 #include <pwd.h>
 #include "prototypes.h"
+#include "shadowlog_internal.h"
 
 #define	NFIELDS	7
 
@@ -34,9 +35,9 @@
 struct passwd *sgetpwent (const char *buf)
 {
 	static struct passwd pwent;
-	static char pwdbuf[1024];
+	static char pwdbuf[PASSWD_ENTRY_MAX_LENGTH];
-	register int i;
+	int i;
-	register char *cp;
+	char *cp;
 	char *fields[NFIELDS];
 
 	/*
@@ -44,8 +45,12 @@ struct passwd *sgetpwent (const char *buf)
 	 * the password structure remain valid.
 	 */
 
-	if (strlen (buf) >= sizeof pwdbuf)
+	if (strlen (buf) >= sizeof pwdbuf) {
+		fprintf (shadow_logfd,
+		         "%s: Too long passwd entry encountered, file corruption?\n",
+		         shadow_progname);
 		return 0;	/* fail if too long */
+	}
 	strcpy (pwdbuf, buf);
 
 	/*

lib/sgetspent.c

@@ -16,6 +16,7 @@
 
 #include <sys/types.h>
 #include "prototypes.h"
+#include "shadowlog_internal.h"
 #include "defines.h"
 #include <stdio.h>
 #define	FIELDS	9
@@ -25,7 +26,7 @@
  */
 struct spwd *sgetspent (const char *string)
 {
-	static char spwbuf[1024];
+	static char spwbuf[PASSWD_ENTRY_MAX_LENGTH];
 	static struct spwd spwd;
 	char *fields[FIELDS];
 	char *cp;
@@ -37,6 +38,9 @@ struct spwd *sgetspent (const char *string)
 	 */
 
 	if (strlen (string) >= sizeof spwbuf) {
+		fprintf (shadow_logfd,
+		         "%s: Too long passwd entry encountered, file corruption?\n",
+		         shadow_progname);
 		return 0;	/* fail if too long */
 	}
 	strcpy (spwbuf, string);
@@ -171,8 +175,7 @@ struct spwd *sgetspent (const char *string)
 
 	if (fields[8][0] == '\0') {
 		spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
-	} else if (getlong (fields[8], &spwd.sp_flag) == 0) {
+	} else if (getulong (fields[8], &spwd.sp_flag) == 0) {
-		/* FIXME: add a getulong function */
 		return 0;
 	}
 

lib/sgroupio.c

@@ -128,7 +128,7 @@ void sgr_free (/*@out@*/ /*@only@*/struct sgrp *sgent)
 	size_t i;
 	free (sgent->sg_name);
 	if (NULL != sgent->sg_passwd) {
-		memzero (sgent->sg_passwd, strlen (sgent->sg_passwd));
+		strzero (sgent->sg_passwd);
 		free (sgent->sg_passwd);
 	}
 	for (i = 0; NULL != sgent->sg_adm[i]; i++) {

lib/shadow.c

@@ -305,8 +305,7 @@ static struct spwd *my_sgetspent (const char *string)
 	if (fields[8][0] == '\0') {
 		spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
 	} else {
-		if (getlong (fields[8], &spwd.sp_flag) == 0) {
+		if (getulong (fields[8], &spwd.sp_flag) == 0) {
-			/* FIXME: add a getulong function */
 #ifdef	USE_NIS
 			if (nis_used) {
 				spwd.sp_flag = SHADOW_SP_FLAG_UNSET;

lib/shadowio.c

@@ -56,7 +56,9 @@ static int shadow_put (const void *ent, FILE * file)
 
 	if (   (NULL == sp)
 	    || (valid_field (sp->sp_namp, ":\n") == -1)
-	    || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
+	    || (valid_field (sp->sp_pwdp, ":\n") == -1)
+	    || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
+	        1000 > PASSWD_ENTRY_MAX_LENGTH)) {
 		return -1;
 	}
 

lib/shadowlog.h

@@ -36,6 +36,5 @@ extern void log_set_progname(const char *);
 extern const char *log_get_progname(void);
 extern void log_set_logfd(FILE *fd);
 extern FILE *log_get_logfd(void);
-extern void log_dolog(char *, ...);
 
 #endif

lib/shadowlog_internal.h

@@ -1,2 +1,7 @@
+#ifndef _SHADOWLOG_INTERNAL_H
+#define _SHADOWLOG_INTERNAL_H
+
 extern const char *shadow_progname; /* Program name showed in error messages */
 extern FILE *shadow_logfd;  /* file descripter to which error messages are printed */
+
+#endif /* _SHADOWLOG_INTERNAL_H */

lib/shadowmem.c

@@ -59,7 +59,7 @@ void spw_free (/*@out@*/ /*@only@*/struct spwd *spent)
 	if (spent != NULL) {
 		free (spent->sp_namp);
 		if (NULL != spent->sp_pwdp) {
-			memzero (spent->sp_pwdp, strlen (spent->sp_pwdp));
+			strzero (spent->sp_pwdp);
 			free (spent->sp_pwdp);
 		}
 		free (spent);

lib/subordinateio.c

@@ -17,6 +17,8 @@
 #include <ctype.h>
 #include <fcntl.h>
 
+#define ID_SIZE 31
+
 /*
  * subordinate_dup: create a duplicate range
  *
@@ -155,7 +157,7 @@ static struct commonio_ops subordinate_ops = {
  *
  * Returns true if @owner owns any subuid ranges, false otherwise.
  */
-static const bool range_exists(struct commonio_db *db, const char *owner)
+static bool range_exists(struct commonio_db *db, const char *owner)
 {
 	const struct subordinate_range *range;
 	commonio_rewind(db);
@@ -745,6 +747,40 @@ gid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count)
 	return start == ULONG_MAX ? (gid_t) -1 : start;
 }
 
+static bool get_owner_id(const char *owner, enum subid_type id_type, char *id)
+{
+	struct passwd *pw;
+	struct group *gr;
+	int ret = 0;
+
+	switch (id_type) {
+	case ID_TYPE_UID:
+		pw = getpwnam(owner);
+		if (pw == NULL) {
+			return false;
+		}
+		ret = snprintf(id, ID_SIZE, "%u", pw->pw_uid);
+		if (ret < 0 || ret >= ID_SIZE) {
+			return false;
+		}
+		break;
+	case ID_TYPE_GID:
+		gr = getgrnam(owner);
+		if (gr == NULL) {
+			return false;
+		}
+		ret = snprintf(id, ID_SIZE, "%u", gr->gr_gid);
+		if (ret < 0 || ret >= ID_SIZE) {
+			return false;
+		}
+		break;
+	default:
+		return false;
+	}
+
+	return true;
+}
+
 /*
  * int list_owner_ranges(const char *owner, enum subid_type id_type, struct subordinate_range ***ranges)
  *
@@ -770,6 +806,8 @@ int list_owner_ranges(const char *owner, enum subid_type id_type, struct subid_r
 	enum subid_status status;
 	int count = 0;
 	struct subid_nss_ops *h;
+	char id[ID_SIZE];
+	bool have_owner_id;
 
 	*in_ranges = NULL;
 
@@ -798,6 +836,8 @@ int list_owner_ranges(const char *owner, enum subid_type id_type, struct subid_r
 		return -1;
 	}
 
+	have_owner_id = get_owner_id(owner, id_type, id);
+
 	commonio_rewind(db);
 	while ((range = commonio_next(db)) != NULL) {
 		if (0 == strcmp(range->owner, owner)) {
@@ -808,6 +848,16 @@ int list_owner_ranges(const char *owner, enum subid_type id_type, struct subid_r
 				goto out;
 			}
 		}
+
+		// Let's also compare with the ID
+		if (have_owner_id == true && 0 == strcmp(range->owner, id)) {
+			if (!append_range(&ranges, range, count++)) {
+				free(ranges);
+				ranges = NULL;
+				count = -1;
+				goto out;
+			}
+		}
 	}
 
 out:

lib/tcbfuncs.c

@@ -380,9 +380,7 @@ shadowtcb_status shadowtcb_set_user (const char* name)
 		return SHADOWTCB_SUCCESS;
 	}
 
-	if (NULL != stored_tcb_user) {
+	free (stored_tcb_user);
-		free (stored_tcb_user);
-	}
 
 	stored_tcb_user = strdup (name);
 	if (NULL == stored_tcb_user) {

libmisc/btrfs.c

@@ -14,7 +14,7 @@ static bool path_exists(const char *p)
 
 static const char *btrfs_cmd(void)
 {
-	const char *btrfs_paths[] = {"/sbin/btrfs",
+	const char *const btrfs_paths[] = {"/sbin/btrfs",
 		"/bin/btrfs", "/usr/sbin/btrfs", "/usr/bin/btrfs", NULL};
 	const char *p;
 	int i;

libmisc/chkname.c

@@ -32,26 +32,44 @@ static bool is_valid_name (const char *name)
 	}
 
 	/*
-	 * User/group names must match [a-z_][a-z0-9_-]*[$]
+         * User/group names must match gnu e-regex:
-	 */
+         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
+         *
+         * as a non-POSIX, extension, allow "$" as the last char for
+         * sake of Samba 3.x "add machine script"
+         *
+         * Also do not allow fully numeric names or just "." or "..".
+         */
+	int numeric;
 
-	if (('\0' == *name) ||
+	if ('\0' == *name ||
-	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
+	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
+			      '\0' == name[1])) ||
+	    !((*name >= 'a' && *name <= 'z') ||
+	      (*name >= 'A' && *name <= 'Z') ||
+	      (*name >= '0' && *name <= '9') ||
+	      *name == '_' ||
+	      *name == '.')) {
 		return false;
 	}
 
+	numeric = isdigit(*name);
+
 	while ('\0' != *++name) {
-		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
+		if (!((*name >= 'a' && *name <= 'z') ||
-		      ( ('0' <= *name) && ('9' >= *name) ) ||
+		      (*name >= 'A' && *name <= 'Z') ||
-		      ('_' == *name) ||
+		      (*name >= '0' && *name <= '9') ||
-		      ('-' == *name) ||
+		      *name == '_' ||
-		      ( ('$' == *name) && ('\0' == *(name + 1)) )
+		      *name == '.' ||
+		      *name == '-' ||
+		      (*name == '$' && name[1] == '\0')
 		     )) {
 			return false;
 		}
+		numeric &= isdigit(*name);
 	}
 
-	return true;
+	return !numeric;
 }
 
 bool is_valid_user_name (const char *name)

libmisc/chowndir.c

@@ -17,6 +17,112 @@
 #include "defines.h"
 #include <fcntl.h>
 #include <stdio.h>
+#include <unistd.h>
+
+static int chown_tree_at (int at_fd,
+                const char *path,
+                uid_t old_uid,
+                uid_t new_uid,
+                gid_t old_gid,
+                gid_t new_gid)
+{
+	DIR *dir;
+	const struct dirent *ent;
+	struct stat dir_sb;
+	int dir_fd, rc = 0;
+
+	dir_fd = openat (at_fd, path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+	if (dir_fd < 0) {
+		return -1;
+	}
+
+	dir = fdopendir (dir_fd);
+	if (!dir) {
+		(void) close (dir_fd);
+		return -1;
+	}
+
+	/*
+	 * Open the directory and read each entry.  Every entry is tested
+	 * to see if it is a directory, and if so this routine is called
+	 * recursively.  If not, it is checked to see if an ownership
+	 * shall be changed.
+	 */
+	while ((ent = readdir (dir))) {
+		uid_t tmpuid = (uid_t) -1;
+		gid_t tmpgid = (gid_t) -1;
+		struct stat ent_sb;
+
+		/*
+		 * Skip the "." and ".." entries
+		 */
+		if (   (strcmp (ent->d_name, ".") == 0)
+		    || (strcmp (ent->d_name, "..") == 0)) {
+			continue;
+		}
+
+		rc = fstatat (dirfd(dir), ent->d_name, &ent_sb, AT_SYMLINK_NOFOLLOW);
+		if (rc < 0) {
+			break;
+		}
+
+		if (S_ISDIR (ent_sb.st_mode)) {
+			/*
+			 * Do the entire subdirectory.
+			 */
+			rc = chown_tree_at (dirfd(dir), ent->d_name, old_uid, new_uid, old_gid, new_gid);
+			if (0 != rc) {
+				break;
+			}
+		}
+
+		/*
+		 * By default, the IDs are not changed (-1).
+		 *
+		 * If the file is not owned by the user, the owner is not
+		 * changed.
+		 *
+		 * If the file is not group-owned by the group, the
+		 * group-owner is not changed.
+		 */
+		if (((uid_t) -1 == old_uid) || (ent_sb.st_uid == old_uid)) {
+			tmpuid = new_uid;
+		}
+		if (((gid_t) -1 == old_gid) || (ent_sb.st_gid == old_gid)) {
+			tmpgid = new_gid;
+		}
+		if (((uid_t) -1 != tmpuid) || ((gid_t) -1 != tmpgid)) {
+			rc = fchownat (dirfd(dir), ent->d_name, tmpuid, tmpgid, AT_SYMLINK_NOFOLLOW);
+			if (0 != rc) {
+				break;
+			}
+		}
+	}
+
+	/*
+	 * Now do the root of the tree
+	 */
+	if ((0 == rc) && (fstat (dirfd(dir), &dir_sb) == 0)) {
+		uid_t tmpuid = (uid_t) -1;
+		gid_t tmpgid = (gid_t) -1;
+		if (((uid_t) -1 == old_uid) || (dir_sb.st_uid == old_uid)) {
+			tmpuid = new_uid;
+		}
+		if (((gid_t) -1 == old_gid) || (dir_sb.st_gid == old_gid)) {
+			tmpgid = new_gid;
+		}
+		if (((uid_t) -1 != tmpuid) || ((gid_t) -1 != tmpgid)) {
+			rc = fchown (dirfd(dir), tmpuid, tmpgid);
+		}
+	} else {
+		rc = -1;
+	}
+
+	(void) closedir (dir);
+
+	return rc;
+}
+
 /*
  * chown_tree - change ownership of files in a directory tree
  *
@@ -36,143 +142,5 @@ int chown_tree (const char *root,
                 gid_t old_gid,
                 gid_t new_gid)
 {
-	char *new_name;
+	return chown_tree_at (AT_FDCWD, root, old_uid, new_uid, old_gid, new_gid);
-	size_t new_name_len;
-	int rc = 0;
-	struct DIRECT *ent;
-	struct stat sb;
-	DIR *dir;
-
-	new_name = malloc (1024);
-	if (NULL == new_name) {
-		return -1;
-	}
-	new_name_len = 1024;
-
-	/*
-	 * Make certain the directory exists.  This routine is called
-	 * directly by the invoker, or recursively.
-	 */
-
-	if (access (root, F_OK) != 0) {
-		free (new_name);
-		return -1;
-	}
-
-	/*
-	 * Open the directory and read each entry.  Every entry is tested
-	 * to see if it is a directory, and if so this routine is called
-	 * recursively.  If not, it is checked to see if an ownership
-	 * shall be changed.
-	 */
-
-	dir = opendir (root);
-	if (NULL == dir) {
-		free (new_name);
-		return -1;
-	}
-
-	while ((ent = readdir (dir))) {
-		size_t ent_name_len;
-		uid_t tmpuid = (uid_t) -1;
-		gid_t tmpgid = (gid_t) -1;
-
-		/*
-		 * Skip the "." and ".." entries
-		 */
-
-		if (   (strcmp (ent->d_name, ".") == 0)
-		    || (strcmp (ent->d_name, "..") == 0)) {
-			continue;
-		}
-
-		/*
-		 * Make the filename for both the source and the
-		 * destination files.
-		 */
-
-		ent_name_len = strlen (root) + strlen (ent->d_name) + 2;
-		if (ent_name_len > new_name_len) {
-			/*@only@*/char *tmp = realloc (new_name, ent_name_len);
-			if (NULL == tmp) {
-				rc = -1;
-				break;
-			}
-			new_name = tmp;
-			new_name_len = ent_name_len;
-		}
-
-		(void) snprintf (new_name, new_name_len, "%s/%s", root, ent->d_name);
-
-		/* Don't follow symbolic links! */
-		if (LSTAT (new_name, &sb) == -1) {
-			continue;
-		}
-
-		if (S_ISDIR (sb.st_mode) && !S_ISLNK (sb.st_mode)) {
-
-			/*
-			 * Do the entire subdirectory.
-			 */
-
-			rc = chown_tree (new_name, old_uid, new_uid,
-			                 old_gid, new_gid);
-			if (0 != rc) {
-				break;
-			}
-		}
-#ifndef HAVE_LCHOWN
-		/* don't use chown (follows symbolic links!) */
-		if (S_ISLNK (sb.st_mode)) {
-			continue;
-		}
-#endif
-		/*
-		 * By default, the IDs are not changed (-1).
-		 *
-		 * If the file is not owned by the user, the owner is not
-		 * changed.
-		 *
-		 * If the file is not group-owned by the group, the
-		 * group-owner is not changed.
-		 */
-		if (((uid_t) -1 == old_uid) || (sb.st_uid == old_uid)) {
-			tmpuid = new_uid;
-		}
-		if (((gid_t) -1 == old_gid) || (sb.st_gid == old_gid)) {
-			tmpgid = new_gid;
-		}
-		if (((uid_t) -1 != tmpuid) || ((gid_t) -1 != tmpgid)) {
-			rc = LCHOWN (new_name, tmpuid, tmpgid);
-			if (0 != rc) {
-				break;
-			}
-		}
-	}
-
-	free (new_name);
-	(void) closedir (dir);
-
-	/*
-	 * Now do the root of the tree
-	 */
-
-	if ((0 == rc) && (stat (root, &sb) == 0)) {
-		uid_t tmpuid = (uid_t) -1;
-		gid_t tmpgid = (gid_t) -1;
-		if (((uid_t) -1 == old_uid) || (sb.st_uid == old_uid)) {
-			tmpuid = new_uid;
-		}
-		if (((gid_t) -1 == old_gid) || (sb.st_gid == old_gid)) {
-			tmpgid = new_gid;
-		}
-		if (((uid_t) -1 != tmpuid) || ((gid_t) -1 != tmpgid)) {
-			rc = LCHOWN (root, tmpuid, tmpgid);
-		}
-	} else {
-		rc = -1;
-	}
-
-	return rc;
 }
-

libmisc/console.c

@@ -16,9 +16,6 @@
 
 #ident "$Id$"
 
-/* local function prototypes */
-static bool is_listed (const char *cfgin, const char *tty, bool def);
-
 /*
  * This is now rather generic function which decides if "tty" is listed
  * under "cfgin" in config (directly or indirectly). Fallback to default if

libmisc/copydir.c

@@ -47,42 +47,43 @@ struct link_name {
 };
 static /*@exposed@*/struct link_name *links;
 
-static int copy_entry (const char *src, const char *dst,
+struct path_info {
+	const char *full_path;
+	int dirfd;
+	const char *name;
+};
+
+static int copy_entry (const struct path_info *src, const struct path_info *dst,
                        bool reset_selinux,
                        uid_t old_uid, uid_t new_uid,
                        gid_t old_gid, gid_t new_gid);
-static int copy_dir (const char *src, const char *dst,
+static int copy_dir (const struct path_info *src, const struct path_info *dst,
                      bool reset_selinux,
-                     const struct stat *statp, const struct timeval mt[],
+                     const struct stat *statp, const struct timespec mt[],
                      uid_t old_uid, uid_t new_uid,
                      gid_t old_gid, gid_t new_gid);
-#ifdef	S_IFLNK
 static /*@null@*/char *readlink_malloc (const char *filename);
-static int copy_symlink (const char *src, const char *dst,
+static int copy_symlink (const struct path_info *src, const struct path_info *dst,
                          unused bool reset_selinux,
-                         const struct stat *statp, const struct timeval mt[],
+                         const struct stat *statp, const struct timespec mt[],
                          uid_t old_uid, uid_t new_uid,
                          gid_t old_gid, gid_t new_gid);
-#endif				/* S_IFLNK */
+static int copy_hardlink (const struct path_info *dst,
-static int copy_hardlink (const char *dst,
                           unused bool reset_selinux,
                           struct link_name *lp);
-static int copy_special (const char *src, const char *dst,
+static int copy_special (const struct path_info *src, const struct path_info *dst,
                          bool reset_selinux,
-                         const struct stat *statp, const struct timeval mt[],
+                         const struct stat *statp, const struct timespec mt[],
                          uid_t old_uid, uid_t new_uid,
                          gid_t old_gid, gid_t new_gid);
-static int copy_file (const char *src, const char *dst,
+static int copy_file (const struct path_info *src, const struct path_info *dst,
                       bool reset_selinux,
-                      const struct stat *statp, const struct timeval mt[],
+                      const struct stat *statp, const struct timespec mt[],
                       uid_t old_uid, uid_t new_uid,
                       gid_t old_gid, gid_t new_gid);
-static int chown_if_needed (const char *dst, const struct stat *statp,
+static int chownat_if_needed (const struct path_info *dst, const struct stat *statp,
                             uid_t old_uid, uid_t new_uid,
                             gid_t old_gid, gid_t new_gid);
-static int lchown_if_needed (const char *dst, const struct stat *statp,
-                             uid_t old_uid, uid_t new_uid,
-                             gid_t old_gid, gid_t new_gid);
 static int fchown_if_needed (int fdst, const struct stat *statp,
                              uid_t old_uid, uid_t new_uid,
                              gid_t old_gid, gid_t new_gid);
@@ -91,7 +92,8 @@ static int fchown_if_needed (int fdst, const struct stat *statp,
 /*
  * error_acl - format the error messages for the ACL and EQ libraries.
  */
-static void error_acl (struct error_context *ctx, const char *fmt, ...)
+format_attr(printf, 2, 3)
+static void error_acl (unused struct error_context *ctx, const char *fmt, ...)
 {
 	va_list ap;
 	FILE *shadow_logfd = log_get_logfd();
@@ -113,10 +115,61 @@ static void error_acl (struct error_context *ctx, const char *fmt, ...)
 }
 
 static struct error_context ctx = {
-	error_acl
+	error_acl, NULL, NULL
 };
 #endif				/* WITH_ACL || WITH_ATTR */
 
+#ifdef WITH_ACL
+static int perm_copy_path(const struct path_info *src,
+						  const struct path_info *dst,
+						  struct error_context *errctx)
+{
+	int src_fd, dst_fd, ret;
+
+	src_fd = openat(src->dirfd, src->name, O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC);
+	if (src_fd < 0) {
+		return -1;
+	}
+
+	dst_fd = openat(dst->dirfd, dst->name, O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC);
+	if (dst_fd < 0) {
+		(void) close (src_fd);
+		return -1;
+	}
+
+	ret = perm_copy_fd(src->full_path, src_fd, dst->full_path, dst_fd, errctx);
+	(void) close (src_fd);
+	(void) close (dst_fd);
+	return ret;
+}
+#endif				/* WITH_ACL */
+
+#ifdef WITH_ATTR
+static int attr_copy_path(const struct path_info *src,
+						  const struct path_info *dst,
+						  int (*callback) (const char *, struct error_context *),
+						  struct error_context *errctx)
+{
+	int src_fd, dst_fd, ret;
+
+	src_fd = openat(src->dirfd, src->name, O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC);
+	if (src_fd < 0) {
+		return -1;
+	}
+
+	dst_fd = openat(dst->dirfd, dst->name, O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC);
+	if (dst_fd < 0) {
+		(void) close (src_fd);
+		return -1;
+	}
+
+	ret = attr_copy_fd(src->full_path, src_fd, dst->full_path, dst_fd, callback, errctx);
+	(void) close (src_fd);
+	(void) close (dst_fd);
+	return ret;
+}
+#endif				/* WITH_ATTR */
+
 /*
  * remove_link - delete a link from the linked list
  */
@@ -189,51 +242,36 @@ static /*@exposed@*/ /*@null@*/struct link_name *check_link (const char *name, c
 	return NULL;
 }
 
-/*
+static int copy_tree_impl (const struct path_info *src, const struct path_info *dst,
- * copy_tree - copy files in a directory tree
- *
- *	copy_tree() walks a directory tree and copies ordinary files
- *	as it goes.
- *
- *	When reset_selinux is enabled, extended attributes (and thus
- *	SELinux attributes) are not copied.
- *
- *	old_uid and new_uid are used to set the ownership of the copied
- *	files. Unless old_uid is set to -1, only the files owned by
- *	old_uid have their ownership changed to new_uid. In addition, if
- *	new_uid is set to -1, no ownership will be changed.
- *
- *	The same logic applies for the group-ownership and
- *	old_gid/new_gid.
- */
-int copy_tree (const char *src_root, const char *dst_root,
                bool copy_root, bool reset_selinux,
                uid_t old_uid, uid_t new_uid,
                gid_t old_gid, gid_t new_gid)
 {
-	int err = 0;
+	int dst_fd, src_fd, err = 0;
 	bool set_orig = false;
-	struct DIRECT *ent;
+	const struct dirent *ent;
 	DIR *dir;
 
 	if (copy_root) {
 		struct stat sb;
-		if (access (dst_root, F_OK) == 0) {
+
+		if (   fstatat (dst->dirfd, dst->name, &sb, 0) == 0
+		    || errno != ENOENT) {
 			return -1;
 		}
 
-		if (LSTAT (src_root, &sb) == -1) {
+		if (fstatat (src->dirfd, src->name, &sb, AT_SYMLINK_NOFOLLOW) == -1) {
 			return -1;
 		}
 
 		if (!S_ISDIR (sb.st_mode)) {
 			fprintf (log_get_logfd(),
 			         "%s: %s is not a directory",
-			         log_get_progname(), src_root);
+			         log_get_progname(), src->full_path);
 			return -1;
 		}
 
-		return copy_entry (src_root, dst_root, reset_selinux,
+		return copy_entry (src, dst, reset_selinux,
 		                   old_uid, new_uid, old_gid, new_gid);
 	}
 
@@ -243,8 +281,14 @@ int copy_tree (const char *src_root, const char *dst_root,
 	 * target is created.  It assumes the target directory exists.
 	 */
 
-	if (   (access (src_root, F_OK) != 0)
+	src_fd = openat (src->dirfd, src->name, O_DIRECTORY | O_RDONLY | O_NOFOLLOW | O_CLOEXEC);
-	    || (access (dst_root, F_OK) != 0)) {
+	if (src_fd < 0) {
+		return -1;
+	}
+
+	dst_fd = openat (dst->dirfd, dst->name, O_DIRECTORY | O_RDONLY | O_NOFOLLOW | O_CLOEXEC);
+	if (dst_fd < 0) {
+		(void) close (src_fd);
 		return -1;
 	}
 
@@ -255,14 +299,16 @@ int copy_tree (const char *src_root, const char *dst_root,
 	 * regular files (and directories ...) are copied, and no file
 	 * is made set-ID.
 	 */
-	dir = opendir (src_root);
+	dir = fdopendir (src_fd);
 	if (NULL == dir) {
+		(void) close (src_fd);
+		(void) close (dst_fd);
 		return -1;
 	}
 
 	if (src_orig == NULL) {
-		src_orig = src_root;
+		src_orig = src->full_path;
-		dst_orig = dst_root;
+		dst_orig = dst->full_path;
 		set_orig = true;
 	}
 	while ((0 == err) && (ent = readdir (dir)) != NULL) {
@@ -275,8 +321,8 @@ int copy_tree (const char *src_root, const char *dst_root,
 			char *dst_name;
 			size_t src_len = strlen (ent->d_name) + 2;
 			size_t dst_len = strlen (ent->d_name) + 2;
-			src_len += strlen (src_root);
+			src_len += strlen (src->full_path);
-			dst_len += strlen (dst_root);
+			dst_len += strlen (dst->full_path);
 
 			src_name = (char *) malloc (src_len);
 			dst_name = (char *) malloc (dst_len);
@@ -288,25 +334,32 @@ int copy_tree (const char *src_root, const char *dst_root,
 				 * Build the filename for both the source and
 				 * the destination files.
 				 */
-				(void) snprintf (src_name, src_len, "%s/%s",
+				struct path_info src_entry, dst_entry;
-				                 src_root, ent->d_name);
-				(void) snprintf (dst_name, dst_len, "%s/%s",
-				                 dst_root, ent->d_name);
 
-				err = copy_entry (src_name, dst_name,
+				(void) snprintf (src_name, src_len, "%s/%s",
+				                 src->full_path, ent->d_name);
+				(void) snprintf (dst_name, dst_len, "%s/%s",
+				                 dst->full_path, ent->d_name);
+
+				src_entry.full_path = src_name;
+				src_entry.dirfd = dirfd(dir);
+				src_entry.name = ent->d_name;
+
+				dst_entry.full_path = dst_name;
+				dst_entry.dirfd = dst_fd;
+				dst_entry.name = ent->d_name;
+
+				err = copy_entry (&src_entry, &dst_entry,
 				                  reset_selinux,
 				                  old_uid, new_uid,
 				                  old_gid, new_gid);
 			}
-			if (NULL != src_name) {
+			free (src_name);
-				free (src_name);
+			free (dst_name);
-			}
-			if (NULL != dst_name) {
-				free (dst_name);
-			}
 		}
 	}
 	(void) closedir (dir);
+	(void) close (dst_fd);
 
 	if (set_orig) {
 		src_orig = NULL;
@@ -353,7 +406,7 @@ int copy_tree (const char *src_root, const char *dst_root,
  *	old_gid) will be modified, unless old_uid (resp. old_gid) is set
  *	to -1.
  */
-static int copy_entry (const char *src, const char *dst,
+static int copy_entry (const struct path_info *src, const struct path_info *dst,
                        bool reset_selinux,
                        uid_t old_uid, uid_t new_uid,
                        gid_t old_gid, gid_t new_gid)
@@ -361,32 +414,32 @@ static int copy_entry (const char *src, const char *dst,
 	int err = 0;
 	struct stat sb;
 	struct link_name *lp;
-	struct timeval mt[2];
+	struct timespec mt[2];
 
-	if (LSTAT (src, &sb) == -1) {
+	if (fstatat(src->dirfd, src->name, &sb, AT_SYMLINK_NOFOLLOW) == -1) {
 		/* If we cannot stat the file, do not care. */
 	} else {
 #ifdef HAVE_STRUCT_STAT_ST_ATIM
 		mt[0].tv_sec  = sb.st_atim.tv_sec;
-		mt[0].tv_usec = sb.st_atim.tv_nsec / 1000;
+		mt[0].tv_nsec = sb.st_atim.tv_nsec;
 #else				/* !HAVE_STRUCT_STAT_ST_ATIM */
 		mt[0].tv_sec  = sb.st_atime;
 # ifdef HAVE_STRUCT_STAT_ST_ATIMENSEC
-		mt[0].tv_usec = sb.st_atimensec / 1000;
+		mt[0].tv_nsec = sb.st_atimensec;
 # else				/* !HAVE_STRUCT_STAT_ST_ATIMENSEC */
-		mt[0].tv_usec = 0;
+		mt[0].tv_nsec = 0;
 # endif				/* !HAVE_STRUCT_STAT_ST_ATIMENSEC */
 #endif				/* !HAVE_STRUCT_STAT_ST_ATIM */
 
 #ifdef HAVE_STRUCT_STAT_ST_MTIM
 		mt[1].tv_sec  = sb.st_mtim.tv_sec;
-		mt[1].tv_usec = sb.st_mtim.tv_nsec / 1000;
+		mt[1].tv_nsec = sb.st_mtim.tv_nsec;
 #else				/* !HAVE_STRUCT_STAT_ST_MTIM */
 		mt[1].tv_sec  = sb.st_mtime;
 # ifdef HAVE_STRUCT_STAT_ST_MTIMENSEC
-		mt[1].tv_usec = sb.st_mtimensec / 1000;
+		mt[1].tv_nsec = sb.st_mtimensec;
 # else				/* !HAVE_STRUCT_STAT_ST_MTIMENSEC */
-		mt[1].tv_usec = 0;
+		mt[1].tv_nsec = 0;
 # endif				/* !HAVE_STRUCT_STAT_ST_MTIMENSEC */
 #endif				/* !HAVE_STRUCT_STAT_ST_MTIM */
 
@@ -395,7 +448,6 @@ static int copy_entry (const char *src, const char *dst,
 			                old_uid, new_uid, old_gid, new_gid);
 		}
 
-#ifdef	S_IFLNK
 		/*
 		 * Copy any symbolic links
 		 */
@@ -404,13 +456,12 @@ static int copy_entry (const char *src, const char *dst,
 			err = copy_symlink (src, dst, reset_selinux, &sb, mt,
 			                    old_uid, new_uid, old_gid, new_gid);
 		}
-#endif				/* S_IFLNK */
 
 		/*
 		 * See if this is a previously copied link
 		 */
 
-		else if ((lp = check_link (src, &sb)) != NULL) {
+		else if ((lp = check_link (src->full_path, &sb)) != NULL) {
 			err = copy_hardlink (dst, reset_selinux, lp);
 		}
 
@@ -449,9 +500,9 @@ static int copy_entry (const char *src, const char *dst,
  *
  *	Return 0 on success, -1 on error.
  */
-static int copy_dir (const char *src, const char *dst,
+static int copy_dir (const struct path_info *src, const struct path_info *dst,
                      bool reset_selinux,
-                     const struct stat *statp, const struct timeval mt[],
+                     const struct stat *statp, const struct timespec mt[],
                      uid_t old_uid, uid_t new_uid,
                      gid_t old_gid, gid_t new_gid)
 {
@@ -463,19 +514,18 @@ static int copy_dir (const char *src, const char *dst,
 	 */
 
 #ifdef WITH_SELINUX
-	if (set_selinux_file_context (dst, S_IFDIR) != 0) {
+	if (set_selinux_file_context (dst->full_path, S_IFDIR) != 0) {
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
-	if (   (mkdir (dst, statp->st_mode) != 0)
+	if (   (mkdirat (dst->dirfd, dst->name, 0700) != 0)
-	    || (chown_if_needed (dst, statp,
+	    || (chownat_if_needed (dst, statp,
 	                         old_uid, new_uid, old_gid, new_gid) != 0)
+	    || (fchmodat (dst->dirfd, dst->name, statp->st_mode & 07777, AT_SYMLINK_NOFOLLOW) != 0)
 #ifdef WITH_ACL
-	    || (   (perm_copy_file (src, dst, &ctx) != 0)
+	    || (   (perm_copy_path (src, dst, &ctx) != 0)
 	        && (errno != 0))
-#else				/* !WITH_ACL */
+#endif				/* WITH_ACL */
-	    || (chmod (dst, statp->st_mode) != 0)
-#endif				/* !WITH_ACL */
 #ifdef WITH_ATTR
 	/*
 	 * If the third parameter is NULL, all extended attributes
@@ -485,19 +535,18 @@ static int copy_dir (const char *src, const char *dst,
 	 * additional logic so that no unexpected permissions result.
 	 */
 	    || (   !reset_selinux
-	        && (attr_copy_file (src, dst, NULL, &ctx) != 0)
+	        && (attr_copy_path (src, dst, NULL, &ctx) != 0)
 	        && (errno != 0))
 #endif				/* WITH_ATTR */
-	    || (copy_tree (src, dst, false, reset_selinux,
+	    || (copy_tree_impl (src, dst, false, reset_selinux,
 	                   old_uid, new_uid, old_gid, new_gid) != 0)
-	    || (utimes (dst, mt) != 0)) {
+	    || (utimensat (dst->dirfd, dst->name, mt, AT_SYMLINK_NOFOLLOW) != 0)) {
 		err = -1;
 	}
 
 	return err;
 }
 
-#ifdef	S_IFLNK
 /*
  * readlink_malloc - wrapper for readlink
  *
@@ -544,9 +593,9 @@ static /*@null@*/char *readlink_malloc (const char *filename)
  *
  *	Return 0 on success, -1 on error.
  */
-static int copy_symlink (const char *src, const char *dst,
+static int copy_symlink (const struct path_info *src, const struct path_info *dst,
                          unused bool reset_selinux,
-                         const struct stat *statp, const struct timeval mt[],
+                         const struct stat *statp, const struct timespec mt[],
                          uid_t old_uid, uid_t new_uid,
                          gid_t old_gid, gid_t new_gid)
 {
@@ -564,7 +613,7 @@ static int copy_symlink (const char *src, const char *dst,
 	 * destination directory name.
 	 */
 
-	oldlink = readlink_malloc (src);
+	oldlink = readlink_malloc (src->full_path);
 	if (NULL == oldlink) {
 		return -1;
 	}
@@ -584,13 +633,13 @@ static int copy_symlink (const char *src, const char *dst,
 	}
 
 #ifdef WITH_SELINUX
-	if (set_selinux_file_context (dst, S_IFLNK) != 0) {
+	if (set_selinux_file_context (dst->full_path, S_IFLNK) != 0) {
 		free (oldlink);
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
-	if (   (symlink (oldlink, dst) != 0)
+	if (   (symlinkat (oldlink, dst->dirfd, dst->name) != 0)
-	    || (lchown_if_needed (dst, statp,
+	    || (chownat_if_needed (dst, statp,
 	                          old_uid, new_uid, old_gid, new_gid) != 0)) {
 		/* FIXME: there are no modes on symlinks, right?
 		 *        ACL could be copied, but this would be much more
@@ -604,18 +653,12 @@ static int copy_symlink (const char *src, const char *dst,
 	}
 	free (oldlink);
 
-#ifdef HAVE_LUTIMES
+	if (utimensat (dst->dirfd, dst->name, mt, AT_SYMLINK_NOFOLLOW) != 0) {
-	/* 2007-10-18: We don't care about
+		return -1;
-	 *  exit status of lutimes because
+	}
-	 *  it returns ENOSYS on many system
-	 *  - not implemented
-	 */
-	(void) lutimes (dst, mt);
-#endif				/* HAVE_LUTIMES */
 
 	return 0;
 }
-#endif				/* S_IFLNK */
 
 /*
  * copy_hardlink - copy a hardlink
@@ -624,13 +667,13 @@ static int copy_symlink (const char *src, const char *dst,
  *
  *	Return 0 on success, -1 on error.
  */
-static int copy_hardlink (const char *dst,
+static int copy_hardlink (const struct path_info *dst,
                           unused bool reset_selinux,
                           struct link_name *lp)
 {
 	/* FIXME: selinux, ACL, Extended Attributes needed? */
 
-	if (link (lp->ln_name, dst) != 0) {
+	if (linkat (AT_FDCWD, lp->ln_name, dst->dirfd, dst->name, 0) != 0) {
 		return -1;
 	}
 
@@ -654,29 +697,28 @@ static int copy_hardlink (const char *dst,
  *
  *	Return 0 on success, -1 on error.
  */
-static int copy_special (const char *src, const char *dst,
+static int copy_special (const struct path_info *src, const struct path_info *dst,
                          bool reset_selinux,
-                         const struct stat *statp, const struct timeval mt[],
+                         const struct stat *statp, const struct timespec mt[],
                          uid_t old_uid, uid_t new_uid,
                          gid_t old_gid, gid_t new_gid)
 {
 	int err = 0;
 
 #ifdef WITH_SELINUX
-	if (set_selinux_file_context (dst, statp->st_mode & S_IFMT) != 0) {
+	if (set_selinux_file_context (dst->full_path, statp->st_mode & S_IFMT) != 0) {
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
 
-	if (   (mknod (dst, statp->st_mode & ~07777, statp->st_rdev) != 0)
+	if (   (mknodat (dst->dirfd, dst->name, statp->st_mode & ~07777U, statp->st_rdev) != 0)
-	    || (chown_if_needed (dst, statp,
+	    || (chownat_if_needed (dst, statp,
 	                         old_uid, new_uid, old_gid, new_gid) != 0)
+	    || (fchmodat (dst->dirfd, dst->name, statp->st_mode & 07777, AT_SYMLINK_NOFOLLOW) != 0)
 #ifdef WITH_ACL
-	    || (   (perm_copy_file (src, dst, &ctx) != 0)
+	    || (   (perm_copy_path (src, dst, &ctx) != 0)
 	        && (errno != 0))
-#else				/* !WITH_ACL */
+#endif				/* WITH_ACL */
-	    || (chmod (dst, statp->st_mode & 07777) != 0)
-#endif				/* !WITH_ACL */
 #ifdef WITH_ATTR
 	/*
 	 * If the third parameter is NULL, all extended attributes
@@ -686,16 +728,52 @@ static int copy_special (const char *src, const char *dst,
 	 * additional logic so that no unexpected permissions result.
 	 */
 	    || (   !reset_selinux
-	        && (attr_copy_file (src, dst, NULL, &ctx) != 0)
+	        && (attr_copy_path (src, dst, NULL, &ctx) != 0)
 	        && (errno != 0))
 #endif				/* WITH_ATTR */
-	    || (utimes (dst, mt) != 0)) {
+		|| (utimensat (dst->dirfd, dst->name, mt, AT_SYMLINK_NOFOLLOW) != 0)) {
 		err = -1;
 	}
 
 	return err;
 }
 
+/*
+ * full_write - write entire buffer
+ *
+ * Write up to count bytes from the buffer starting at buf to the
+ * file referred to by the file descriptor fd.
+ * Retry in case of a short write.
+ *
+ * Returns the number of bytes written on success, -1 on error.
+ */
+static ssize_t full_write(int fd, const void *buf, size_t count) {
+	ssize_t written = 0;
+
+	while (count > 0) {
+		ssize_t res;
+
+		res = write(fd, buf, count);
+		if (res < 0) {
+			if (errno == EINTR) {
+				continue;
+			}
+
+			return res;
+		}
+
+		if (res == 0) {
+			break;
+		}
+
+		written += res;
+		buf = (const unsigned char*)buf + res;
+		count -= (size_t)res;
+	}
+
+	return written;
+}
+
 /*
  * copy_file - copy a file
  *
@@ -706,38 +784,35 @@ static int copy_special (const char *src, const char *dst,
  *
  *	Return 0 on success, -1 on error.
  */
-static int copy_file (const char *src, const char *dst,
+static int copy_file (const struct path_info *src, const struct path_info *dst,
                       bool reset_selinux,
-                      const struct stat *statp, const struct timeval mt[],
+                      const struct stat *statp, const struct timespec mt[],
                       uid_t old_uid, uid_t new_uid,
                       gid_t old_gid, gid_t new_gid)
 {
 	int err = 0;
 	int ifd;
 	int ofd;
-	char buf[1024];
-	ssize_t cnt;
 
-	ifd = open (src, O_RDONLY|O_NOFOLLOW);
+	ifd = openat (src->dirfd, src->name, O_RDONLY|O_NOFOLLOW|O_CLOEXEC);
 	if (ifd < 0) {
 		return -1;
 	}
 #ifdef WITH_SELINUX
-	if (set_selinux_file_context (dst, S_IFREG) != 0) {
+	if (set_selinux_file_context (dst->full_path, S_IFREG) != 0) {
 		(void) close (ifd);
 		return -1;
 	}
 #endif				/* WITH_SELINUX */
-	ofd = open (dst, O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, statp->st_mode & 07777);
+	ofd = openat (dst->dirfd, dst->name, O_WRONLY | O_CREAT | O_EXCL | O_TRUNC | O_NOFOLLOW | O_CLOEXEC, 0600);
 	if (   (ofd < 0)
 	    || (fchown_if_needed (ofd, statp,
 	                          old_uid, new_uid, old_gid, new_gid) != 0)
-#ifdef WITH_ACL
-	    || (   (perm_copy_fd (src, ifd, dst, ofd, &ctx) != 0)
-	        && (errno != 0))
-#else				/* !WITH_ACL */
 	    || (fchmod (ofd, statp->st_mode & 07777) != 0)
-#endif				/* !WITH_ACL */
+#ifdef WITH_ACL
+	    || (   (perm_copy_fd (src->full_path, ifd, dst->full_path, ofd, &ctx) != 0)
+	        && (errno != 0))
+#endif				/* WITH_ACL */
 #ifdef WITH_ATTR
 	/*
 	 * If the third parameter is NULL, all extended attributes
@@ -747,7 +822,7 @@ static int copy_file (const char *src, const char *dst,
 	 * additional logic so that no unexpected permissions result.
 	 */
 	    || (   !reset_selinux
-	        && (attr_copy_fd (src, ifd, dst, ofd, NULL, &ctx) != 0)
+	        && (attr_copy_fd (src->full_path, ifd, dst->full_path, ofd, NULL, &ctx) != 0)
 	        && (errno != 0))
 #endif				/* WITH_ATTR */
 	   ) {
@@ -758,8 +833,24 @@ static int copy_file (const char *src, const char *dst,
 		return -1;
 	}
 
-	while ((cnt = read (ifd, buf, sizeof buf)) > 0) {
+	while (true) {
-		if (write (ofd, buf, (size_t)cnt) != cnt) {
+		char buf[8192];
+		ssize_t cnt;
+
+		cnt = read (ifd, buf, sizeof buf);
+		if (cnt < 0) {
+			if (errno == EINTR) {
+				continue;
+			}
+			(void) close (ofd);
+			(void) close (ifd);
+			return -1;
+		}
+		if (cnt == 0) {
+			break;
+		}
+
+		if (full_write (ofd, buf, (size_t)cnt) < 0) {
 			(void) close (ofd);
 			(void) close (ifd);
 			return -1;
@@ -767,23 +858,13 @@ static int copy_file (const char *src, const char *dst,
 	}
 
 	(void) close (ifd);
-
-#ifdef HAVE_FUTIMES
-	if (futimes (ofd, mt) != 0) {
-		(void) close (ofd);
-		return -1;
-	}
-#endif				/* HAVE_FUTIMES */
-
 	if (close (ofd) != 0) {
 		return -1;
 	}
 
-#ifndef HAVE_FUTIMES
+	if (utimensat (dst->dirfd, dst->name, mt, AT_SYMLINK_NOFOLLOW) != 0) {
-	if (utimes(dst, mt) != 0) {
 		return -1;
 	}
-#endif				/* !HAVE_FUTIMES */
 
 	return err;
 }
@@ -818,7 +899,70 @@ static int chown_function ## _if_needed (type_dst dst,                 \
 	return chown_function (dst, tmpuid, tmpgid);                   \
 }
 
-def_chown_if_needed (chown, const char *)
-def_chown_if_needed (lchown, const char *)
 def_chown_if_needed (fchown, int)
 
+static int chownat_if_needed (const struct path_info *dst,
+							  const struct stat *statp,
+                              uid_t old_uid, uid_t new_uid,
+                              gid_t old_gid, gid_t new_gid)
+{
+	uid_t tmpuid = (uid_t) -1;
+	gid_t tmpgid = (gid_t) -1;
+
+	/* Use new_uid if old_uid is set to -1 or if the file was
+	 * owned by the user. */
+	if (((uid_t) -1 == old_uid) || (statp->st_uid == old_uid)) {
+		tmpuid = new_uid;
+	}
+	/* Otherwise, or if new_uid was set to -1, we keep the same
+	 * owner. */
+	if ((uid_t) -1 == tmpuid) {
+		tmpuid = statp->st_uid;
+	}
+
+	if (((gid_t) -1 == old_gid) || (statp->st_gid == old_gid)) {
+		tmpgid = new_gid;
+	}
+	if ((gid_t) -1 == tmpgid) {
+		tmpgid = statp->st_gid;
+	}
+
+	return fchownat (dst->dirfd, dst->name, tmpuid, tmpgid, AT_SYMLINK_NOFOLLOW);
+}
+
+/*
+ * copy_tree - copy files in a directory tree
+ *
+ *	copy_tree() walks a directory tree and copies ordinary files
+ *	as it goes.
+ *
+ *	When reset_selinux is enabled, extended attributes (and thus
+ *	SELinux attributes) are not copied.
+ *
+ *	old_uid and new_uid are used to set the ownership of the copied
+ *	files. Unless old_uid is set to -1, only the files owned by
+ *	old_uid have their ownership changed to new_uid. In addition, if
+ *	new_uid is set to -1, no ownership will be changed.
+ *
+ *	The same logic applies for the group-ownership and
+ *	old_gid/new_gid.
+ */
+int copy_tree (const char *src_root, const char *dst_root,
+               bool copy_root, bool reset_selinux,
+               uid_t old_uid, uid_t new_uid,
+               gid_t old_gid, gid_t new_gid)
+{
+	const struct path_info src = {
+		.full_path = src_root,
+		.dirfd = AT_FDCWD,
+		.name = src_root
+	};
+	const struct path_info dst = {
+		.full_path = dst_root,
+		.dirfd = AT_FDCWD,
+		.name = dst_root
+	};
+
+	return copy_tree_impl(&src, &dst, copy_root, reset_selinux,
+						  old_uid, new_uid, old_gid, new_gid);
+}

libmisc/env.c

@@ -28,7 +28,7 @@ size_t newenvc = 0;
 /*@null@*/char **newenvp = NULL;
 extern char **environ;
 
-static const char *forbid[] = {
+static const char *const forbid[] = {
 	"_RLD_=",
 	"BASH_ENV=",		/* GNU creeping featurism strikes again... */
 	"ENV=",
@@ -47,7 +47,7 @@ static const char *forbid[] = {
 
 /* these are allowed, but with no slashes inside
    (to work around security problems in GNU gettext) */
-static const char *noslash[] = {
+static const char *const noslash[] = {
 	"LANG=",
 	"LANGUAGE=",
 	"LC_",			/* anything with the LC_ prefix */
@@ -185,7 +185,7 @@ void set_env (int argc, char *const *argv)
 			noname++;
 			addenv (variable, *argv);
 		} else {
-			const char **p;
+			const char *const *p;
 
 			for (p = forbid; NULL != *p; p++) {
 				if (strncmp (*argv, *p, strlen (*p)) == 0) {
@@ -218,7 +218,7 @@ void set_env (int argc, char *const *argv)
 void sanitize_env (void)
 {
 	char **envp = environ;
-	const char **bad;
+	const char *const *bad;
 	char **cur;
 	char **move;
 

libmisc/find_new_gid.c

@@ -60,6 +60,13 @@ static int get_ranges (bool sys_group, gid_t *min_id, gid_t *max_id,
                             (unsigned long) *max_id);
 			return EINVAL;
 		}
+		/*
+		 * Zero is reserved for root and the allocation algorithm does not
+		 * work right with it.
+		 */
+		if (*min_id == 0) {
+			*min_id = (gid_t) 1;
+		}
 	} else {
 		/* Non-system groups */
 
@@ -98,7 +105,7 @@ static int get_ranges (bool sys_group, gid_t *min_id, gid_t *max_id,
 static int check_gid (const gid_t gid,
 		      const gid_t gid_min,
 		      const gid_t gid_max,
-		      bool *used_gids)
+		      const bool *used_gids)
 {
 	/* First test that the preferred ID is in the range */
 	if (gid < gid_min || gid > gid_max) {

libmisc/find_new_uid.c

@@ -60,6 +60,13 @@ static int get_ranges (bool sys_user, uid_t *min_id, uid_t *max_id,
                             (unsigned long) *max_id);
 			return EINVAL;
 		}
+		/*
+		 * Zero is reserved for root and the allocation algorithm does not
+		 * work right with it.
+		 */
+		if (*min_id == 0) {
+			*min_id = (uid_t) 1;
+		}
 	} else {
 		/* Non-system users */
 
@@ -98,7 +105,7 @@ static int get_ranges (bool sys_user, uid_t *min_id, uid_t *max_id,
 static int check_uid(const uid_t uid,
 		     const uid_t uid_min,
 		     const uid_t uid_max,
-		     bool *used_uids)
+		     const bool *used_uids)
 {
 	/* First test that the preferred ID is in the range */
 	if (uid < uid_min || uid > uid_max) {

libmisc/getdate.y

@@ -31,32 +31,9 @@
 #include <ctype.h>
 #include <time.h>
 
-#if defined (STDC_HEADERS) || (!defined (isascii) && !defined (HAVE_ISASCII))
-# define IN_CTYPE_DOMAIN(c) 1
-#else
-# define IN_CTYPE_DOMAIN(c) isascii(c)
-#endif
-
-#define ISSPACE(c) (IN_CTYPE_DOMAIN (c) && isspace (c))
-#define ISALPHA(c) (IN_CTYPE_DOMAIN (c) && isalpha (c))
-#define ISUPPER(c) (IN_CTYPE_DOMAIN (c) && isupper (c))
-#define ISDIGIT_LOCALE(c) (IN_CTYPE_DOMAIN (c) && isdigit (c))
-
-/* ISDIGIT differs from ISDIGIT_LOCALE, as follows:
-   - Its arg may be any int or unsigned int; it need not be an unsigned char.
-   - It's guaranteed to evaluate its argument exactly once.
-   - It's typically faster.
-   Posix 1003.2-1992 section 2.5.2.1 page 50 lines 1556-1558 says that
-   only '0' through '9' are digits.  Prefer ISDIGIT to ISDIGIT_LOCALE unless
-   it's important to use the locale's definition of `digit' even when the
-   host does not conform to Posix.  */
-#define ISDIGIT(c) ((unsigned) (c) - '0' <= 9)
-
 #include "getdate.h"
 
-#if defined (STDC_HEADERS)
+#include <string.h>
-# include <string.h>
-#endif
 
 /* Some old versions of bison generate parsers that use bcopy.
    That loses on systems that don't provide the function, so we have
@@ -651,7 +628,7 @@ static int LookupWord (char *buff)
 
   /* Make it lowercase. */
   for (p = buff; '\0' != *p; p++)
-    if (ISUPPER (*p))
+    if (isupper (*p))
       *p = tolower (*p);
 
   if (strcmp (buff, "am") == 0 || strcmp (buff, "a.m.") == 0)
@@ -732,7 +709,7 @@ static int LookupWord (char *buff)
       }
 
   /* Military timezones. */
-  if (buff[1] == '\0' && ISALPHA (*buff))
+  if (buff[1] == '\0' && isalpha (*buff))
     {
       for (tp = MilitaryTable; tp->name; tp++)
 	if (strcmp (buff, tp->name) == 0)
@@ -771,30 +748,30 @@ yylex (void)
 
   for (;;)
     {
-      while (ISSPACE (*yyInput))
+      while (isspace (*yyInput))
 	yyInput++;
 
-      if (ISDIGIT (c = *yyInput) || c == '-' || c == '+')
+      if (isdigit (c = *yyInput) || c == '-' || c == '+')
 	{
 	  if (c == '-' || c == '+')
 	    {
 	      sign = c == '-' ? -1 : 1;
-	      if (!ISDIGIT (*++yyInput))
+	      if (!isdigit (*++yyInput))
 		/* skip the '-' sign */
 		continue;
 	    }
 	  else
 	    sign = 0;
-	  for (yylval.Number = 0; ISDIGIT (c = *yyInput++);)
+	  for (yylval.Number = 0; isdigit (c = *yyInput++);)
 	    yylval.Number = 10 * yylval.Number + c - '0';
 	  yyInput--;
 	  if (sign < 0)
 	    yylval.Number = -yylval.Number;
 	  return (0 != sign) ? tSNUMBER : tUNUMBER;
 	}
-      if (ISALPHA (c))
+      if (isalpha (c))
 	{
-	  for (p = buff; (c = *yyInput++, ISALPHA (c)) || c == '.';)
+	  for (p = buff; (c = *yyInput++, isalpha (c)) || c == '.';)
 	    if (p < &buff[sizeof buff - 1])
 	      *p++ = c;
 	  *p = '\0';

libmisc/getrange.c

@@ -25,7 +25,7 @@
  * If the range is valid, getrange returns 1.
  * If the range is not valid, getrange returns 0.
  */
-int getrange (char *range,
+int getrange (const char *range,
               unsigned long *min, bool *has_min,
               unsigned long *max, bool *has_max)
 {

libmisc/idmapping.c

@@ -102,10 +102,10 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)
 #define ULONG_DIGITS ((((sizeof(unsigned long) * CHAR_BIT) + 9)/10)*3)
 
 #if HAVE_SYS_CAPABILITY_H
-static inline bool maps_lower_root(int cap, int ranges, struct map_range *mappings)
+static inline bool maps_lower_root(int cap, int ranges, const struct map_range *mappings)
 {
 	int idx;
-	struct map_range *mapping;
+	const struct map_range *mapping;
 
 	if (cap != CAP_SETUID)
 		return false;
@@ -135,11 +135,11 @@ static inline bool maps_lower_root(int cap, int ranges, struct map_range *mappin
  * when the root user calls the new{g,u}idmap binary for an unprivileged user.
  * If this is wanted: use file capabilities!
  */
-void write_mapping(int proc_dir_fd, int ranges, struct map_range *mappings,
+void write_mapping(int proc_dir_fd, int ranges, const struct map_range *mappings,
 	const char *map_file, uid_t ruid)
 {
 	int idx;
-	struct map_range *mapping;
+	const struct map_range *mapping;
 	size_t bufsize;
 	char *buf, *pos;
 	int fd;

libmisc/idmapping.h

@@ -7,6 +7,8 @@
 #ifndef _IDMAPPING_H_
 #define _IDMAPPING_H_
 
+#include <sys/types.h>
+
 struct map_range {
 	unsigned long upper; /* first ID inside the namespace */
 	unsigned long lower; /* first ID outside the namespace */
@@ -15,9 +17,7 @@ struct map_range {
 
 extern struct map_range *get_map_ranges(int ranges, int argc, char **argv);
 extern void write_mapping(int proc_dir_fd, int ranges,
-	struct map_range *mappings, const char *map_file, uid_t ruid);
+	const struct map_range *mappings, const char *map_file, uid_t ruid);
-
-extern void nss_init(char *nsswitch_path);
 
 #endif /* _ID_MAPPING_H_ */
 

libmisc/loginprompt.c

@@ -41,9 +41,9 @@ void login_prompt (const char *prompt, char *name, int namesize)
 	int i;
 	FILE *fp;
 
-	RETSIGTYPE (*sigquit) (int);
+	sighandler_t sigquit;
 #ifdef	SIGTSTP
-	RETSIGTYPE (*sigtstp) (int);
+	sighandler_t sigtstp;
 #endif
 
 	/*

libmisc/motd.c

@@ -28,7 +28,7 @@ void motd (void)
 	char *motdlist;
 	const char *motdfile;
 	char *mb;
-	register int c;
+	int c;
 
 	motdfile = getdef_str ("MOTD_FILE");
 	if (NULL == motdfile) {

libmisc/pam_pass_non_interactive.c

@@ -22,7 +22,7 @@ static int ni_conv (int num_msg,
                     const struct pam_message **msg,
                     struct pam_response **resp,
                     unused void *appdata_ptr);
-static struct pam_conv non_interactive_pam_conv = {
+static const struct pam_conv non_interactive_pam_conv = {
 	ni_conv,
 	NULL
 };

libmisc/prefix_flag.c

@@ -248,7 +248,7 @@ extern struct spwd *prefix_getspnam(const char* name)
 	}
 }
 
-extern void prefix_setpwent()
+extern void prefix_setpwent(void)
 {
 	if (!passwd_db_file) {
 		setpwent();
@@ -261,7 +261,7 @@ extern void prefix_setpwent()
 	if (!fp_pwent)
 		return;
 }
-extern struct passwd* prefix_getpwent()
+extern struct passwd* prefix_getpwent(void)
 {
 	if (!passwd_db_file) {
 		return getpwent();
@@ -271,7 +271,7 @@ extern struct passwd* prefix_getpwent()
 	}
 	return fgetpwent(fp_pwent);
 }
-extern void prefix_endpwent()
+extern void prefix_endpwent(void)
 {
 	if (!passwd_db_file) {
 		endpwent();
@@ -282,7 +282,7 @@ extern void prefix_endpwent()
 	fp_pwent = NULL;
 }
 
-extern void prefix_setgrent()
+extern void prefix_setgrent(void)
 {
 	if (!group_db_file) {
 		setgrent();
@@ -295,14 +295,14 @@ extern void prefix_setgrent()
 	if (!fp_grent)
 		return;
 }
-extern struct group* prefix_getgrent()
+extern struct group* prefix_getgrent(void)
 {
 	if (!group_db_file) {
 		return getgrent();
 	}
 	return fgetgrent(fp_grent);
 }
-extern void prefix_endgrent()
+extern void prefix_endgrent(void)
 {
 	if (!group_db_file) {
 		endgrent();

libmisc/remove_tree.c

@@ -11,6 +11,7 @@
 
 #ident "$Id$"
 
+#include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -21,6 +22,72 @@
 #include "prototypes.h"
 #include "defines.h"
 
+static int remove_tree_at (int at_fd, const char *path, bool remove_root)
+{
+	DIR *dir;
+	const struct dirent *ent;
+	int dir_fd, rc = 0;
+
+	dir_fd = openat (at_fd, path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+	if (dir_fd < 0) {
+		return -1;
+	}
+
+	dir = fdopendir (dir_fd);
+	if (!dir) {
+		(void) close (dir_fd);
+		return -1;
+	}
+
+	/*
+	 * Open the source directory and delete each entry.
+	 */
+	while ((ent = readdir (dir))) {
+		struct stat ent_sb;
+
+		/*
+		 * Skip the "." and ".." entries
+		 */
+		if (strcmp (ent->d_name, ".") == 0 ||
+		    strcmp (ent->d_name, "..") == 0) {
+			continue;
+		}
+
+		rc = fstatat (dirfd(dir), ent->d_name, &ent_sb, AT_SYMLINK_NOFOLLOW);
+		if (rc < 0) {
+			break;
+		}
+
+		if (S_ISDIR (ent_sb.st_mode)) {
+			/*
+			 * Recursively delete this directory.
+			 */
+			if (remove_tree_at (dirfd(dir), ent->d_name, true) != 0) {
+				rc = -1;
+				break;
+			}
+		} else {
+			/*
+			 * Delete the file.
+			 */
+			if (unlinkat (dirfd(dir), ent->d_name, 0) != 0) {
+				rc = -1;
+				break;
+			}
+		}
+	}
+
+	(void) closedir (dir);
+
+	if (remove_root && (0 == rc)) {
+		if (unlinkat (at_fd, path, AT_REMOVEDIR) != 0) {
+			rc = -1;
+		}
+	}
+
+	return rc;
+}
+
 /*
  * remove_tree - delete a directory tree
  *
@@ -28,83 +95,7 @@
  *	and directories.
  *	At the end, it deletes the root directory itself.
  */
-
 int remove_tree (const char *root, bool remove_root)
 {
-	char *new_name = NULL;
+	return remove_tree_at (AT_FDCWD, root, remove_root);
-	int err = 0;
-	struct DIRECT *ent;
-	struct stat sb;
-	DIR *dir;
-
-	/*
-	 * Open the source directory and read each entry.  Every file
-	 * entry in the directory is copied with the UID and GID set
-	 * to the provided values.  As an added security feature only
-	 * regular files (and directories ...) are copied, and no file
-	 * is made set-ID.
-	 */
-	dir = opendir (root);
-	if (NULL == dir) {
-		return -1;
-	}
-
-	while ((ent = readdir (dir))) {
-		size_t new_len = strlen (root) + strlen (ent->d_name) + 2;
-
-		/*
-		 * Skip the "." and ".." entries
-		 */
-
-		if (strcmp (ent->d_name, ".") == 0 ||
-		    strcmp (ent->d_name, "..") == 0) {
-			continue;
-		}
-
-		/*
-		 * Make the filename for the current entry.
-		 */
-
-		free (new_name);
-		new_name = (char *) malloc (new_len);
-		if (NULL == new_name) {
-			err = -1;
-			break;
-		}
-		(void) snprintf (new_name, new_len, "%s/%s", root, ent->d_name);
-		if (LSTAT (new_name, &sb) == -1) {
-			continue;
-		}
-
-		if (S_ISDIR (sb.st_mode)) {
-			/*
-			 * Recursively delete this directory.
-			 */
-			if (remove_tree (new_name, true) != 0) {
-				err = -1;
-				break;
-			}
-		} else {
-			/*
-			 * Delete the file.
-			 */
-			if (unlink (new_name) != 0) {
-				err = -1;
-				break;
-			}
-		}
-	}
-	if (NULL != new_name) {
-		free (new_name);
-	}
-	(void) closedir (dir);
-
-	if (remove_root && (0 == err)) {
-		if (rmdir (root) != 0) {
-			err = -1;
-		}
-	}
-
-	return err;
 }
-

libmisc/root_flag.c

@@ -79,7 +79,7 @@ static void change_root (const char* newroot)
 
 	if ('/' != newroot[0]) {
 		fprintf (log_get_logfd(),
-		         _("%s: invalid chroot path '%s'\n"),
+		         _("%s: invalid chroot path '%s', only absolute paths are supported.\n"),
 		         log_get_progname(), newroot);
 		exit (E_BAD_ARG);
 	}

libmisc/salt.c

@@ -99,15 +99,15 @@ static /*@observer@*/const char *gensalt (size_t salt_size);
 static long shadow_random (long min, long max);
 #endif /* USE_SHA_CRYPT || USE_BCRYPT */
 #ifdef USE_SHA_CRYPT
-static /*@observer@*/const unsigned long SHA_get_salt_rounds (/*@null@*/int *prefered_rounds);
+static /*@observer@*/unsigned long SHA_get_salt_rounds (/*@null@*/const int *prefered_rounds);
 static /*@observer@*/void SHA_salt_rounds_to_buf (char *buf, unsigned long rounds);
 #endif /* USE_SHA_CRYPT */
 #ifdef USE_BCRYPT
-static /*@observer@*/const unsigned long BCRYPT_get_salt_rounds (/*@null@*/int *prefered_rounds);
+static /*@observer@*/unsigned long BCRYPT_get_salt_rounds (/*@null@*/const int *prefered_rounds);
 static /*@observer@*/void BCRYPT_salt_rounds_to_buf (char *buf, unsigned long rounds);
 #endif /* USE_BCRYPT */
 #ifdef USE_YESCRYPT
-static /*@observer@*/const unsigned long YESCRYPT_get_salt_cost (/*@null@*/int *prefered_cost);
+static /*@observer@*/unsigned long YESCRYPT_get_salt_cost (/*@null@*/const int *prefered_cost);
 static /*@observer@*/void YESCRYPT_salt_cost_to_buf (char *buf, unsigned long cost);
 #endif /* USE_YESCRYPT */
 
@@ -156,26 +156,28 @@ static long read_random_bytes (void)
 	/* arc4random_buf, if it exists, can never fail.  */
 	arc4random_buf (&randval, sizeof (randval));
 	goto end;
+#endif
 
-#elif defined(HAVE_GETENTROPY)
+#ifdef HAVE_GETENTROPY
 	/* getentropy may exist but lack kernel support.  */
-	if (getentropy (&randval, sizeof (randval))) {
+	if (getentropy (&randval, sizeof (randval)) == 0) {
-		goto fail;
+		goto end;
 	}
+#endif
 
-	goto end;
+#ifdef HAVE_GETRANDOM
-
-#elif defined(HAVE_GETRANDOM)
 	/* Likewise getrandom.  */
-	if ((size_t) getrandom (&randval, sizeof (randval), 0) != sizeof (randval)) {
+	if ((size_t) getrandom (&randval, sizeof (randval), 0) == sizeof (randval)) {
+		goto end;
+	}
+#endif
+
+	/* Use /dev/urandom as a last resort.  */
+	FILE *f = fopen ("/dev/urandom", "r");
+	if (NULL == f) {
 		goto fail;
 	}
 
-	goto end;
-
-#else
-	FILE *f = fopen ("/dev/urandom", "r");
-
 	if (fread (&randval, sizeof (randval), 1, f) != 1) {
 		fclose(f);
 		goto fail;
@@ -183,7 +185,6 @@ static long read_random_bytes (void)
 
 	fclose(f);
 	goto end;
-#endif
 
 fail:
 	fprintf (log_get_logfd(),
@@ -220,7 +221,7 @@ static long shadow_random (long min, long max)
 
 #ifdef USE_SHA_CRYPT
 /* Return the the rounds number for the SHA crypt methods. */
-static /*@observer@*/const unsigned long SHA_get_salt_rounds (/*@null@*/int *prefered_rounds)
+static /*@observer@*/unsigned long SHA_get_salt_rounds (/*@null@*/const int *prefered_rounds)
 {
 	unsigned long rounds;
 
@@ -294,7 +295,7 @@ static /*@observer@*/void SHA_salt_rounds_to_buf (char *buf, unsigned long round
 
 #ifdef USE_BCRYPT
 /* Return the the rounds number for the BCRYPT method. */
-static /*@observer@*/const unsigned long BCRYPT_get_salt_rounds (/*@null@*/int *prefered_rounds)
+static /*@observer@*/unsigned long BCRYPT_get_salt_rounds (/*@null@*/const int *prefered_rounds)
 {
 	unsigned long rounds;
 
@@ -338,9 +339,10 @@ static /*@observer@*/const unsigned long BCRYPT_get_salt_rounds (/*@null@*/int *
 	/*
 	 * Use 19 as an upper bound for now,
 	 * because musl doesn't allow rounds >= 20.
+	 * If musl ever supports > 20 rounds,
+	 * rounds should be set to B_ROUNDS_MAX.
 	 */
 	if (rounds > 19) {
-		/* rounds = B_ROUNDS_MAX; */
 		rounds = 19;
 	}
 #endif /* USE_XCRYPT_GENSALT */
@@ -372,7 +374,7 @@ static /*@observer@*/void BCRYPT_salt_rounds_to_buf (char *buf, unsigned long ro
 
 #ifdef USE_YESCRYPT
 /* Return the the cost number for the YESCRYPT method. */
-static /*@observer@*/const unsigned long YESCRYPT_get_salt_cost (/*@null@*/int *prefered_cost)
+static /*@observer@*/unsigned long YESCRYPT_get_salt_cost (/*@null@*/const int *prefered_cost)
 {
 	unsigned long cost;
 

libmisc/shell.c

@@ -45,7 +45,7 @@ int shell (const char *file, /*@null@*/const char *arg, char *const envp[])
 	 * don't want to tell us what it is themselves.
 	 */
 	if (arg == (char *) 0) {
-		(void) snprintf (arg0, sizeof arg0, "-%s", Basename ((char *) file));
+		(void) snprintf (arg0, sizeof arg0, "-%s", Basename (file));
 		arg0[sizeof arg0 - 1] = '\0';
 		arg = arg0;
 	}

libmisc/strtoday.c

@@ -96,7 +96,7 @@ long strtoday (const char *str)
  * for now we allow just one format, but we can define more later
  * (we try them all until one succeeds).  --marekm
  */
-static char *date_formats[] = {
+static const char *const date_formats[] = {
 	"%Y-%m-%d",
 	(char *) 0
 };
@@ -106,12 +106,12 @@ static char *date_formats[] = {
  * current month, and the cumulative number of days in the preceding
  * months.  they are declared so that january is 1, not 0.
  */
-static short days[13] = { 0,
+static const short days[13] = { 0,
 	31, 28, 31, 30, 31, 30,	/* JAN - JUN */
 	31, 31, 30, 31, 30, 31
 };				/* JUL - DEC */
 
-static short juldays[13] = { 0,
+static const short juldays[13] = { 0,
 	0, 31, 59, 90, 120, 151,	/* JAN - JUN */
 	181, 212, 243, 273, 304, 334
 };				/* JUL - DEC */
@@ -129,7 +129,7 @@ long strtoday (const char *str)
 {
 #ifdef HAVE_STRPTIME
 	struct tm tp;
-	char *const *fmt;
+	const char *const *fmt;
 	char *cp;
 	time_t result;
 

libmisc/utmp.c

@@ -19,6 +19,7 @@
 #endif
 
 #include <assert.h>
+#include <sys/param.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netdb.h>

libmisc/xgetXXbyYY.c

@@ -66,7 +66,6 @@
 			         "x" STRINGIZE(FUNCTION_NAME));
 			exit (13);
 		}
-		errno = 0;
 		status = REENTRANT_NAME(ARG_NAME, result, buffer,
 		                        length, &resbuf);
 		if ((0 == status) && (resbuf == result)) {
@@ -78,7 +77,7 @@
 			return ret_result;
 		}
 
-		if (ERANGE != errno) {
+		if (ERANGE != status) {
 			free (buffer);
 			free (result);
 			return NULL;

libmisc/xmalloc.c

@@ -26,11 +26,11 @@
 #include "prototypes.h"
 #include "shadowlog.h"
 
-/*@maynotreturn@*/ /*@only@*//*@out@*//*@notnull@*/char *xmalloc (size_t size)
+/*@maynotreturn@*/ /*@only@*//*@out@*//*@notnull@*/void *xmalloc (size_t size)
 {
-	char *ptr;
+	void *ptr;
 
-	ptr = (char *) malloc (size);
+	ptr = malloc (size);
 	if (NULL == ptr) {
 		(void) fprintf (log_get_logfd(),
 		                _("%s: failed to allocate memory: %s\n"),
@@ -44,10 +44,3 @@
 {
 	return strcpy (xmalloc (strlen (str) + 1), str);
 }
-
-void xfree(void *ap)
-{
-	if (ap) {
-		free(ap);
-	}
-}

libsubid/subid.h.in

@@ -35,6 +35,10 @@ enum subid_status {
 	SUBID_STATUS_ERROR = 3,
 };
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /*
  * subid_init: initialize libsubid
  *
@@ -151,5 +155,9 @@ bool subid_ungrant_uid_range(struct subordinate_range *range);
  */
 bool subid_ungrant_gid_range(struct subordinate_range *range);
 
+#ifdef __cplusplus
+}
+#endif
+
 #define SUBID_NFIELDS 3
 #endif

man/Makefile.am

@@ -1,7 +1,7 @@
 
 # subdirectories for translated manual pages
 if USE_NLS
-SUBDIRS = po cs da de es fi fr hu id it ja ko pl pt_BR ru sv tr zh_CN zh_TW
+SUBDIRS = po cs da de es fi fr hu id it ja ko pl pt_BR ru sv tr uk zh_CN zh_TW
 else
 SUBDIRS =
 endif

man/chage.1.xml

@@ -194,6 +194,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/chfn.1.xml

@@ -134,6 +134,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/chgpasswd.8.xml

@@ -127,6 +127,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/chpasswd.8.xml

@@ -169,6 +169,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/chsh.1.xml

@@ -88,6 +88,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/faillog.8.xml

@@ -161,6 +161,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/gpasswd.1.xml

@@ -162,6 +162,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/groupadd.8.xml

@@ -48,10 +48,10 @@
     <cmdsynopsis>
       <command>groupadd</command>
       <arg choice='opt'>
-	<replaceable>options</replaceable>
+	<replaceable>OPTIONS</replaceable>
       </arg>
       <arg choice='plain'>
-	<replaceable>group</replaceable>
+	<replaceable>NEWGROUP</replaceable>
       </arg>
     </cmdsynopsis>
   </refsynopsisdiv>
@@ -63,6 +63,17 @@
       values from the system. The new group will be entered into the system
       files as needed.
     </para>
+     <para>
+       Groupnames may contain only lower and upper case letters, digits,
+       underscores, or dashes. They can end with a dollar sign.
+
+       Dashes are not allowed at the beginning of the groupname.
+       Fully numeric groupnames and groupnames . or .. are
+       also disallowed.
+     </para>
+     <para>
+       Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
+     </para>
   </refsect1>
 
   <refsect1 id='options'>
@@ -91,8 +102,8 @@
 	  <option>-g</option>, <option>--gid</option>&nbsp;<replaceable>GID</replaceable>
 	</term>
 	<listitem>
-	  <para>The numerical value of the group's ID. This value must be
+	  <para>The numerical value of the group's ID. <replaceable>GID</replaceable> 
-	    unique, unless the <option>-o</option> option is used. The value
+	    must be unique, unless the <option>-o</option> option is used. The value
 	    must be non-negative. The default is to use the smallest ID
 	    value greater than or equal to <option>GID_MIN</option> and
 	    greater than every other group.
@@ -135,7 +146,10 @@
 	</term>
 	<listitem>
 	  <para>
-	    This option permits to add a group with a non-unique GID.
+	    permits the creation of a group with an already used
+	    numerical ID. As a result, for this
+	    <replaceable>GID</replaceable>, the mapping towards group
+	    <replaceable>NEWGROUP</replaceable> may not be unique.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -145,10 +159,16 @@
 	</term>
 	<listitem>
 	  <para>
-	    The encrypted password, as returned by <citerefentry>
+	    defines an initial password for the group account. PASSWORD is expected to
-	    <refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum>
+            be encrypted, as returned by <citerefentry><refentrytitle>crypt
-	    </citerefentry>. The default is to disable the password.
+            </refentrytitle><manvolnum>3</manvolnum></citerefentry>. 
 	  </para>
+	  <para>
+            Without this option, the group account will be locked and
+            with no password defined, i.e. a single exclamation mark
+            in the respective field of ths system account file 
+            <filename>/etc/group</filename> or <filename>/etc/gshadow</filename>.
+          </para>
 	  <para>
 	    <emphasis role="bold">Note:</emphasis> This option is not
 	    recommended because the password (or encrypted password) will
@@ -185,6 +205,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -194,14 +215,12 @@
 	</term>
 	<listitem>
 	  <para>
-	    Apply changes in the <replaceable>PREFIX_DIR</replaceable>
+	    Apply changes to configuration files under the root filesystem
-	    directory and use the configuration files from the
+	    found under the directory <replaceable>PREFIX_DIR</replaceable>.
-	    <replaceable>PREFIX_DIR</replaceable> directory.
+	    This option does not chroot and is intended for preparing a cross-compilation
-		This option does not chroot and is intended for preparing 
+	    target.  Some limitations: NIS and LDAP users/groups are
-		a cross-compilation target.
+	    not verified.  PAM authentication is using the host files.
-		Some limitations: NIS and LDAP users/groups are not verified.
+	    No SELINUX support.
-		PAM authentication is using the host files.
-		No SELINUX support.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -264,15 +283,6 @@
 
    <refsect1 id='caveats'>
      <title>CAVEATS</title>
-     <para>
-       Groupnames must start with a lower case letter or an underscore,
-       followed by lower case letters, digits, underscores, or dashes.
-       They can end with a dollar sign.
-       In regular expression terms: [a-z_][a-z0-9_-]*[$]?
-     </para>
-     <para>
-       Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
-     </para>
      <para>
        You may not add a NIS or LDAP group. This must be performed on the
        corresponding server.

man/groupdel.8.xml

@@ -93,6 +93,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/groupmems.8.xml

@@ -146,6 +146,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/groupmod.8.xml

@@ -168,6 +168,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/groups.1.xml

@@ -56,16 +56,17 @@
       The <command>groups</command> command displays the current group names
       or ID values. If the value does not have a corresponding entry in
       <filename>/etc/group</filename>, the value will be displayed as the
-      numerical group value. The optional <emphasis
+      numerical group value. The optional <replaceable>user</replaceable>
-      remap='I'>user</emphasis> parameter will display the groups for the
+      parameter will display the groups for the named user.
-      named <emphasis remap='I'>user</emphasis>.
     </para>
   </refsect1>
 
   <refsect1 id='note'>
     <title>NOTE</title>
     <para>
-      Systems which do not support concurrent group sets will have the
+      Systems which do not support supplementary groups (see <citerefentry>
+	<refentrytitle>initgroups</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>) will have the
       information from <filename>/etc/group</filename> reported. The user
       must use <command>newgrp</command> or <command>sg</command> to change
       his current real and effective group ID.
@@ -98,6 +99,9 @@
       </citerefentry>,
       <citerefentry>
 	<refentrytitle>getuid</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>initgroups</refentrytitle><manvolnum>3</manvolnum>
       </citerefentry>.
     </para>
   </refsect1>

man/grpck.8.xml

@@ -153,6 +153,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/id.1.xml

@@ -55,8 +55,9 @@
       have a corresponding entry in <filename>/etc/passwd</filename> or
       <filename>/etc/group</filename>, the value will be displayed without
       the corresponding name. The optional <option>-a</option> flag will
-      display the group set on systems which support multiple concurrent
+      display the group set on systems which support supplementary groups
-      group membership.
+      (see <citerefentry><refentrytitle>initgroups</refentrytitle>
+      <manvolnum>3</manvolnum></citerefentry>).
     </para>
   </refsect1>
 
@@ -89,6 +90,9 @@
       </citerefentry>,
       <citerefentry>
 	<refentrytitle>getuid</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>initgroups</refentrytitle><manvolnum>3</manvolnum>
       </citerefentry>
     </para>
   </refsect1>

man/lastlog.8.xml

@@ -76,7 +76,7 @@
 	</term>
 	<listitem>
 	  <para>
-	    Print only lastlog records older than <emphasis remap='I'>DAYS</emphasis>.
+	    Print only lastlog records older than <replaceable>DAYS</replaceable>.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -108,6 +108,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -129,7 +130,7 @@
 	<listitem>
 	  <para>
 	    Print the lastlog records more recent than
-	    <emphasis remap='I'>DAYS</emphasis>.
+	    <replaceable>DAYS</replaceable>.
 	  </para>
 	</listitem>
       </varlistentry>

man/newusers.8.xml

@@ -310,6 +310,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/passwd.1.xml

@@ -282,6 +282,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/po/LINGUAS

@@ -1,6 +1,6 @@
 # LINGUAS
 
-LINGUAS = da de fr it pl ru sv zh_CN
+LINGUAS = da de fr it pl ru sv uk zh_CN
 
 # These variables are generated based on the LINGUAS list
 POFILES = $(patsubst %,$(srcdir)/%.po,$(LINGUAS))

man/pwck.8.xml

@@ -45,7 +45,7 @@
   </refmeta>
   <refnamediv id='name'>
     <refname>pwck</refname>
-    <refpurpose>verify integrity of password files</refpurpose>
+    <refpurpose>verify the integrity of password files</refpurpose>
   </refnamediv>
   <!-- body begins here -->
   <refsynopsisdiv id='synopsis'>
@@ -54,11 +54,11 @@
       <arg choice='opt'>options</arg>
       <arg choice='opt'>
 	<arg choice='plain'>
-	  <replaceable>passwd</replaceable>
+	  <replaceable>PASSWORDFILE</replaceable>
 	</arg>
 	<arg choice='opt'>
 	  <arg choice='plain'>
-	    <replaceable>shadow</replaceable>
+	    <replaceable>SHADOWFILE</replaceable>
 	  </arg>
 	</arg>
       </arg>
@@ -102,9 +102,9 @@
     </itemizedlist>
 
     <para>
-      <filename>shadow</filename> checks are enabled when a second file
+      Checks for shadowed password information are enabled when the second
-      parameter is specified or when <filename>/etc/shadow</filename>
+      file parameter <replaceable>SHADOWFILE</replaceable> is specified or
-      exists on the system.
+      when <filename>/etc/shadow</filename> exists on the system.
     </para>
     <para>
       These checks are the following:
@@ -136,7 +136,7 @@
       prompted to delete the entire line. If the user does not answer
       affirmatively, all further checks are bypassed. An entry with a
       duplicated user name is prompted for deletion, but the remaining
-      checks will still be made. All other errors are warning and the user
+      checks will still be made. All other errors are warnings and the user
       is encouraged to run the <command>usermod</command> command to correct
       the error.
     </para>
@@ -201,6 +201,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/pwconv.8.xml

@@ -182,6 +182,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/uk/Makefile.am

@@ -0,0 +1,65 @@
+
+mandir = @mandir@/uk
+
+man_MANS = \
+	man1/chage.1 \
+	man1/chfn.1 \
+	man8/chgpasswd.8 \
+	man8/chpasswd.8 \
+	man1/chsh.1 \
+	man1/expiry.1 \
+	man5/faillog.5 \
+	man8/faillog.8 \
+	man3/getspnam.3 \
+	man1/gpasswd.1 \
+	man8/groupadd.8 \
+	man8/groupdel.8 \
+	man8/groupmems.8 \
+	man8/groupmod.8 \
+	man1/groups.1 \
+	man8/grpck.8 \
+	man8/grpconv.8 \
+	man8/grpunconv.8 \
+	man5/gshadow.5 \
+	man8/lastlog.8 \
+	man1/login.1 \
+	man5/login.defs.5 \
+	man8/logoutd.8 \
+	man1/newgrp.1 \
+	man8/newusers.8 \
+	man8/nologin.8 \
+	man1/passwd.1 \
+	man5/passwd.5 \
+	man8/pwck.8 \
+	man8/pwconv.8 \
+	man8/pwunconv.8 \
+	man1/sg.1 \
+	man3/shadow.3 \
+	man5/shadow.5 \
+	man1/su.1 \
+	man5/suauth.5 \
+	man8/useradd.8 \
+	man8/userdel.8 \
+	man8/usermod.8 \
+	man8/vigr.8 \
+	man8/vipw.8
+
+man_nopam = \
+	man5/login.access.5 \
+	man5/porttime.5
+
+if !USE_PAM
+man_MANS += $(man_nopam)
+endif
+
+EXTRA_DIST = \
+	$(man_MANS) \
+	man1/id.1 \
+	man8/sulogin.8
+
+if USE_PAM
+EXTRA_DIST += $(man_nopam)
+endif
+
+include ../generate_translations.mak
+

man/useradd.8.xml

@@ -119,11 +119,11 @@
 	</term>
 	<listitem>
 	  <para>
-	    The default base directory for the system if <option>-d</option>&nbsp;<replaceable>HOME_DIR</replaceable> is not specified.
+	    The default base directory for the system if
-	    <replaceable>BASE_DIR</replaceable> is
+	    <option>-d</option>&nbsp;<replaceable>HOME_DIR</replaceable>
-	    concatenated with the account name to define the home directory. 
+	    is not specified.  <replaceable>BASE_DIR</replaceable> is
-	    If the <option>-m</option> option is not used,
+	    concatenated with the account name to define the home
-	    <replaceable>BASE_DIR</replaceable> must exist.
+	    directory.
 	  </para>
 	  <para>
 	    If this option is not specified, <command>useradd</command>
@@ -141,7 +141,7 @@
 	<listitem>
 	  <para>
 	    Any text string. It is generally a short description of the
-	    login, and is currently used as the field for the user's full
+	    account, and is currently used as the field for the user's full
 	    name.
 	  </para>
 	</listitem>
@@ -153,14 +153,14 @@
 	<listitem>
 	  <para>
 	    The new user will be created using
-	    <replaceable>HOME_DIR</replaceable> as the value for the user's
+	    <replaceable>HOME_DIR</replaceable> as the value for the
-	    login directory. The default is to append the
+	    user's login directory. The default is to append the
 	    <replaceable>LOGIN</replaceable> name to
-	    <replaceable>BASE_DIR</replaceable> and use that as the login
+	    <replaceable>BASE_DIR</replaceable> and use that as the
-	    directory name.  If the directory
+	    login directory name.  If the directory
-	    <replaceable>HOME_DIR</replaceable> does not exist, then it
+	    <replaceable>HOME_DIR</replaceable> does not exist, then
-	    will be created unless the <option>-M</option> option is
+	    it will be created unless the <option>-M</option> option
-	    specified.
+	    is specified.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -197,10 +197,13 @@
 	</term>
 	<listitem>
 	  <para>
-	    The number of days after a password expires until the account is
+            defines the number of days after the password exceeded its maximum
-	    permanently disabled. A value of 0 disables the account as soon
+            age where the user is expected to replace this password. The value
-	    as the password has expired, and a value of -1 disables the
+            is stored in the shadow password file. An input of 0 will disable an
-	    feature.
+            expired password with no delay. An input of -1 will blank the
+            respective field in the shadow password file. See <citerefentry>
+	    <refentrytitle>shadow</refentrytitle><manvolnum>5</manvolnum>
+            </citerefentry>for more information.
 	  </para>
 	  <para>
 	    If not specified, <command>useradd</command> will use the
@@ -210,13 +213,25 @@
 	  </para>
 	</listitem>
       </varlistentry>
+      <varlistentry>
+	<term>
+	  <option>-F</option>, <option>--add-subids-for-system</option>
+	</term>
+	<listitem>
+	  <para>
+	    Update <filename>/etc/subuid</filename> and <filename>
+	    /etc/subgid</filename> even when creating a system account
+	    with <option>-r</option> option.
+	  </para>
+	</listitem>
+      </varlistentry>
       <varlistentry>
 	<term>
 	  <option>-g</option>, <option>--gid</option>&nbsp;<replaceable>GROUP</replaceable>
 	</term>
 	<listitem>
 	  <para>
-	    The group name or number of the user's initial login group. The
+	    The name or the number of the user's primary group. The
 	    group name must exist. A group number must refer to an already
 	    existing group.
 	  </para>
@@ -233,7 +248,7 @@
 	    command line), useradd will set the primary group of the new
 	    user to the value specified by the <option>GROUP</option>
 	    variable in <filename>/etc/default/useradd</filename>, or
-	    100 by default.
+	    1000 by default.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -293,14 +308,17 @@
 	    (<option>UID_MIN</option>, <option>UID_MAX</option>,
 	    <option>UMASK</option>, <option>PASS_MAX_DAYS</option>
 	    and others).
-	  <para>
 	  </para>
-	    Example: <option>-K</option>&nbsp;<replaceable>PASS_MAX_DAYS</replaceable>=<replaceable>-1</replaceable>
+	  <para>
-	    can be used when creating system account to turn off password
+	    Example:
-	    aging, even though system account has no password at all.
+	    <option>-K</option>&nbsp;<replaceable>PASS_MAX_DAYS
-	    Multiple <option>-K</option> options can be specified, e.g.:
+	    </replaceable>=<replaceable>-1</replaceable> can be used
-	    <option>-K</option>&nbsp;<replaceable>UID_MIN</replaceable>=<replaceable>100</replaceable>&nbsp;
+	    when creating an account to turn off password aging.
-	    <option>-K</option>&nbsp;<replaceable>UID_MAX</replaceable>=<replaceable>499</replaceable>
+	    Multiple <option>-K</option> options can be specified,
+	    e.g.:
+	    <option>-K</option>&nbsp;<replaceable>UID_MIN</replaceable>
+	    =<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;
+	    <replaceable>UID_MAX</replaceable>=<replaceable>499</replaceable>
 	  </para>
 	  <!--para>
 	    Note: <option>-K</option>&nbsp;<replaceable>UID_MIN</replaceable>=<replaceable>10</replaceable>,<replaceable>UID_MAX</replaceable>=<replaceable>499</replaceable>
@@ -356,7 +374,7 @@
 	</term>
 	<listitem>
 	  <para>
-	    Do no create the user's home directory, even if the system
+	    Do not create the user's home directory, even if the system
 	    wide setting from <filename>/etc/login.defs</filename>
 	    (<option>CREATE_HOME</option>) is set to
 	    <replaceable>yes</replaceable>.
@@ -387,10 +405,18 @@
 	  <option>-o</option>, <option>--non-unique</option>
 	</term>
 	<listitem>
-	  <para>Allow the creation of a user account with a duplicate (non-unique) UID.</para>
+	  <para>
+	    allows the creation of an account with an already existing
+	    UID.
+	  </para>
 	  <para>
 	    This option is only valid in combination with the
-	    <option>-u</option> option.
+	    <option>-u</option> option. As a user identity
+	    serves as
+	    key to map between users on one hand and permissions, file
+	    ownerships and other aspects that determine the system's
+	    behavior on the other hand, more than one login name
+	    will access the account of the given UID.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -400,13 +426,23 @@
 	</term>
 	<listitem>
 	  <para>
-	    The encrypted password, as returned by <citerefentry>
+	    defines an initial password for the account. PASSWORD is expected to
-	    <refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum>
+	    be encrypted, as returned by <citerefentry><refentrytitle>crypt
-	    </citerefentry>. The default is to disable the password.
+	    </refentrytitle><manvolnum>3</manvolnum></citerefentry>. Within a
+	    shell script, this option allows to create efficiently
+	    batches of users.
 	  </para>
 	  <para>
-	    <emphasis role="bold">Note:</emphasis> This option is not
+            Without this option, the new account will be locked and
-	    recommended because the password (or encrypted password) will
+            with no password defined, i.e. a single exclamation mark
+            in the respective field of
+            <filename>/etc/shadow</filename>. This is a state where the
+            user won't be able to access the account or to define a
+            password himself.
+	  </para>
+	  <para>
+	    <emphasis role="bold">Note:</emphasis>Avoid this option on the command  
+	     line because the password (or encrypted password) will
 	    be visible by users listing the processes.
 	  </para>
 	  <para>
@@ -440,6 +476,12 @@
 	    <option>-m</option> options if you want a home directory for a
 	    system account to be created.
 	  </para>
+	  <para>
+	    Note that this option will not update <filename>/etc/subuid
+	    </filename> and <filename>/etc/subgid</filename>. You have to
+	    specify the <option>-F</option> options if you want to update
+	    the files for a system account to be created.
+	  </para>
 	</listitem>
       </varlistentry>
       <varlistentry>
@@ -451,6 +493,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -460,14 +503,12 @@
 	</term>
 	<listitem>
 	  <para>
-	    Apply changes in the <replaceable>PREFIX_DIR</replaceable>
+	    Apply changes to configuration files under the root filesystem
-	    directory and use the configuration files from the
+	    found under the directory <replaceable>PREFIX_DIR</replaceable>.
-	    <replaceable>PREFIX_DIR</replaceable> directory.
+	    This option does not chroot and is intended for preparing a cross-compilation
-		This option does not chroot and is intended for preparing 
+	    target.  Some limitations: NIS and LDAP users/groups are
-		a cross-compilation target.
+	    not verified.  PAM authentication is using the host files.
-		Some limitations: NIS and LDAP users/groups are not verified.
+	    No SELINUX support.
-		PAM authentication is using the host files.
-		No SELINUX support.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -477,11 +518,11 @@
 	</term>
 	<listitem>
 	  <para>
-	    The name of the user's login shell. The default is to leave this
+            sets the path to the user's login shell. Without this option,
-	    field blank, which causes the system to select the default login
+            the system will use the <option>SHELL</option> variable specified
-	    shell specified by the <option>SHELL</option> variable in
+	    in <filename>/etc/default/useradd</filename>, or, if that is as
-	    <filename>/etc/default/useradd</filename>, or an empty string
+	    well not set, the field for the login shell in <filename>/etc/passwd
-	    by default.
+	    </filename> remains empty.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -526,9 +567,11 @@
 	</term>
 	<listitem>
 	  <para>
-	    The SELinux user for the user's login. The default is to leave this
+	    defines the SELinux user for the new account. Without this
-	    field blank, which causes the system to select the default SELinux
+	    option, a SELinux uses the default user. Note that the
-	    user.
+	    shadow system doesn't store the selinux-user, it uses
+	    <citerefentry><refentrytitle>semanage</refentrytitle>
+	    <manvolnum>8</manvolnum></citerefentry> for that.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -550,7 +593,7 @@
 	  </term>
 	  <listitem>
 	    <para>
-	      The path prefix for a new user's home directory. The
+	      sets the path prefix for a new user's home directory. The
 	      user's name will be affixed to the end of
 	      <replaceable>BASE_DIR</replaceable> to form the new user's
 	      home directory name, if the <option>-d</option> option is not used
@@ -567,7 +610,7 @@
 	    <option>-e</option>, <option>--expiredate</option>&nbsp;<replaceable>EXPIRE_DATE</replaceable>
 	  </term>
 	  <listitem>
-	    <para>The date on which the user account is disabled.</para>
+	    <para>sets the date on which newly created user accounts are disabled.</para>
 	    <para>
 	      This option sets the <option>EXPIRE</option> variable in
 	      <filename>/etc/default/useradd</filename>.
@@ -580,8 +623,10 @@
 	  </term>
 	  <listitem>
 	    <para>
-	      The number of days after a password has expired before the
+              defines the number of days after the password exceeded its maximum
-	      account will be disabled.
+              age where the user is expected to replace this password. See <citerefentry>
+	      <refentrytitle>shadow</refentrytitle><manvolnum>5</manvolnum>
+              </citerefentry>for more information.
 	    </para>
 	    <para>
 	      This option sets the <option>INACTIVE</option> variable in
@@ -594,13 +639,9 @@
 	    <option>-g</option>, <option>--gid</option>&nbsp;<replaceable>GROUP</replaceable>
 	  </term>
 	  <listitem>
-	    <para>
+	    <para>sets the default primary group for newly created users,
-	      The group name or ID for a new user's initial group (when
+	      accepting group names or a numerical group ID. The named
-	      the <option>-N/--no-user-group</option> is used or when the
+	      group must exist, and the GID must have an
-	      <option>USERGROUPS_ENAB</option> variable is set to
-	      <replaceable>no</replaceable> in
-	      <filename>/etc/login.defs</filename>). The named
-	      group must exist, and a numerical group ID must have an
 	      existing entry.
 	    </para>
 	    <para>
@@ -615,7 +656,7 @@
 	  </term>
 	  <listitem>
 	    <para>
-	      The name of a new user's login shell.
+	      defines the default login shell for new users.
 	    </para>
 	    <para>
 	      This option sets the <option>SHELL</option> variable in
@@ -651,10 +692,14 @@
     </para>
 
     <para>
-      Usernames must start with a lower case letter or an underscore,
+      Usernames may contain only lower and upper case letters, digits,
-      followed by lower case letters, digits, underscores, or dashes.
+      underscores, or dashes. They can end with a dollar sign.
-      They can end with a dollar sign.
+
-      In regular expression terms: [a-z_][a-z0-9_-]*[$]?
+      Dashes are not allowed at the beginning of the username.
+      Fully numeric usernames and usernames . or .. are
+      also disallowed. It is not recommended to use usernames beginning
+      with . character as their home directories will be hidden in
+      the <command>ls</command> output.
     </para>
     <para>
       Usernames may only be up to 32 characters long.
@@ -801,7 +846,7 @@
 	<varlistentry>
 	  <term><replaceable>9</replaceable></term>
 	  <listitem>
-	    <para>username already in use</para>
+	    <para>username or group name already in use</para>
 	  </listitem>
 	</varlistentry>
 	<varlistentry>

man/userdel.8.xml

@@ -127,6 +127,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

man/usermod.8.xml

@@ -62,7 +62,7 @@
     <title>DESCRIPTION</title>
     <para>
       The <command>usermod</command> command modifies the system account
-      files to reflect the changes that are specified on the command line.
+      files.
     </para>
   </refsect1>
 
@@ -86,7 +86,7 @@
       </varlistentry>
       <varlistentry>
 	<term>
-	  <option>-b</option>, <option>--badnames</option>
+	  <option>-b</option>, <option>--badname</option>
 	</term>
 	<listitem>
 	  <para>
@@ -100,8 +100,8 @@
 	</term>
 	<listitem>
 	  <para>
-	    The new value of the user's password file comment field. It is
+	    update the comment field of the user in <filename>/etc/passwd
-	    normally modified using the <citerefentry>
+	    </filename>, which is normally modified using the <citerefentry>
 	    <refentrytitle>chfn</refentrytitle><manvolnum>1</manvolnum>
 	    </citerefentry> utility.
 	  </para>
@@ -130,12 +130,15 @@
 	</term>
 	<listitem>
 	  <para>
-	    The date on which the user account will be disabled. The date is
+            The date on which the user account will be disabled. The
-	    specified in the format <emphasis remap='I'>YYYY-MM-DD</emphasis>.
+            date is specified in the format 
+            <emphasis remap="I">YYYY-MM-DD</emphasis>. Integers as input are
+            interpreted as days after 1970-01-01.
 	  </para>
 	  <para>
-	    An empty <replaceable>EXPIRE_DATE</replaceable> argument will
+	    An input of -1 or an empty string will blank the account
-	    disable the expiration of the account.
+	    expiration field in the shadow password file. The account
+	    will remain available with no date limit.
 	  </para>
 	  <para>
 	    This option requires a <filename>/etc/shadow</filename> file.
@@ -150,13 +153,14 @@
 	</term>
 	<listitem>
 	  <para>
-	    The number of days after a password expires until the account is
+	    defines the number of days after the password exceeded its maximum
-	    permanently disabled.
+	    age during which the user may still login by immediately replacing
-	  </para>
+	    the password. This grace period before the account becomes inactive
-	  <para>
+	    is stored in the shadow password file. An input of 0 will disable an
-	    A value of 0 disables the account as soon
+	    expired password with no delay. An input of -1 will blank the
-	    as the password has expired, and a value of -1 disables the
+	    respective field in the shadow password file. See <citerefentry>
-	    feature.
+	    <refentrytitle>shadow</refentrytitle><manvolnum>5</manvolnum>
+	    </citerefentry> for more information.
 	  </para>
 	  <para>
 	    This option requires a <filename>/etc/shadow</filename> file.
@@ -171,7 +175,7 @@
 	</term>
 	<listitem>
 	  <para>
-	    The group name or number of the user's new initial login group.
+	    The name or numerical ID of the user's new primary group.
 	    The group must exist.
 	  </para>
 	  <para>
@@ -198,9 +202,7 @@
 	  <para>
 	    A list of supplementary groups which the user is also a member
 	    of. Each group is separated from the next by a comma, with no
-	    intervening whitespace. The groups are subject to the same
+	    intervening whitespace. The groups must exist.
-	    restrictions as the group given with the <option>-g</option>
-	    option.
 	  </para>
 	  <para>
 	    If the user is currently a member of a group which is
@@ -249,7 +251,7 @@
 	</term>
 	<listitem>
 	  <para>
-	    Move the content of the user's home directory to the new
+	    moves the content of the user's home directory to the new
 	    location. If the current home directory does not exist
 	    the new home directory will not be created.
 	  </para>
@@ -270,9 +272,17 @@
 	</term>
 	<listitem>
 	  <para>
-	    When used with the <option>-u</option> option, this option
 	    allows to change the user ID to a non-unique value.
 	  </para>
+	  <para>
+            This option is only valid in combination with the
+            <option>-u</option> option. As a user identity
+            serves as
+            key to map between users on one hand and permissions, file
+            ownerships and other aspects that determine the system's
+            behavior on the other hand, more than one login name
+            will access the account of the given UID.
+	  </para>
 	</listitem>
       </varlistentry>
       <varlistentry>
@@ -281,13 +291,13 @@
 	</term>
 	<listitem>
 	  <para>
-	    The encrypted password, as returned by <citerefentry>
+            defines a new password for the user. PASSWORD is expected to
-	    <refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum>
+            be encrypted, as returned by <citerefentry><refentrytitle>crypt
-	    </citerefentry>.
+            </refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 	  </para>
 	  <para>
-	    <emphasis role="bold">Note:</emphasis> This option is not
+	    <emphasis role="bold">Note:</emphasis> Avoid this option on the  
-	    recommended because the password (or encrypted password) will
+	    command  line because the password (or encrypted password) will
 	    be visible by users listing the processes.
 	  </para>
 	  <para condition="pam">
@@ -322,6 +332,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -331,14 +342,13 @@
 	</term>
 	<listitem>
 	  <para>
-	    Apply changes in the <replaceable>PREFIX_DIR</replaceable>
+             Apply changes within the directory tree starting with
-	    directory and use the configuration files from the
+             <replaceable>PREFIX_DIR</replaceable> and use as well the
-	    <replaceable>PREFIX_DIR</replaceable> directory.
+             configuration files located there.  This option does not
-		This option does not chroot and is intended for preparing 
+             chroot and is intended for preparing a cross-compilation
-		a cross-compilation target.
+             target.  Some limitations: NIS and LDAP users/groups are
-		Some limitations: NIS and LDAP users/groups are not verified.
+             not verified.  PAM authentication is using the host
-		PAM authentication is using the host files.
+             files.  No SELINUX support.
-		No SELINUX support.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -348,8 +358,9 @@
 	</term>
 	<listitem>
 	  <para>
-	    The path of the user's new login shell. Setting this field to
+	    changes the user's login shell. An empty string for SHELL blanks the
-	    blank causes the system to select the default login shell.
+	    field in <filename>/etc/passwd</filename> and logs the user into the
+	    system's default shell.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -359,7 +370,7 @@
 	</term>
 	<listitem>
 	  <para>
-	    The new numerical value of the user's ID.
+	    The new value of the user's ID.
 	  </para>
 	  <para>
 	    This value must be unique,
@@ -418,7 +429,7 @@
 	    Add a range of subordinate uids to the user's account. 
 	  </para>
 	  <para>
-	    This option may be specified multiple times to add multiple ranges to a users account.
+	    This option may be specified multiple times to add multiple ranges to a user's account.
 	  </para>
 	  <para>
 	     No checks will be performed with regard to
@@ -436,7 +447,7 @@
 	    Remove a range of subordinate uids from the user's account.
 	  </para>
 	  <para>
-	    This option may be specified multiple times to remove multiple ranges to a users account.
+	    This option may be specified multiple times to remove multiple ranges to a user's account.
 	    When both <option>--del-subuids</option> and <option>--add-subuids</option> are specified,
 	    the removal of all subordinate uid ranges happens before any subordinate uid range is added.
 	  </para>
@@ -456,7 +467,7 @@
 	    Add a range of subordinate gids to the user's account.
 	  </para>
 	  <para>
-	    This option may be specified multiple times to add multiple ranges to a users account.
+	    This option may be specified multiple times to add multiple ranges to a user's account.
 	  </para>
 	  <para>
 	     No checks will be performed with regard to
@@ -474,7 +485,7 @@
 	    Remove a range of subordinate gids from the user's account.
 	  </para>
 	  <para>
-	    This option may be specified multiple times to remove multiple ranges to a users account.
+	    This option may be specified multiple times to remove multiple ranges to a user's account.
 	    When both <option>--del-subgids</option> and <option>--add-subgids</option> are specified,
 	    the removal of all subordinate gid ranges happens before any subordinate gid range is added.
 	  </para>
@@ -491,12 +502,11 @@
 	</term>
 	<listitem>
 	  <para>
-	    The new SELinux user for the user's login.
+            defines the SELinux user to be mapped with
-	  </para>
+            <replaceable>LOGIN</replaceable>.  An empty string ("")
-	  <para>
+            will remove the respective entry (if any). Note that the
-	    A blank <replaceable>SEUSER</replaceable> will remove the
+            shadow system doesn't store the selinux-user, it uses
-	    SELinux user mapping for user <replaceable>LOGIN</replaceable>
+            semanage(8) for that.
-	    (if any).
 	  </para>
 	</listitem>
       </varlistentry>
@@ -510,7 +520,8 @@
       not executing any processes when this command is being executed if the
       user's numerical user ID, the user's name, or the user's home
       directory is being changed. <command>usermod</command> checks this
-      on Linux. On other platforms it only uses utmp to check if the user is logged in.
+      on Linux. On other operating systems it only uses utmp to check if 
+      the user is logged in.
     </para>
     <para>
       You must change the owner of any <command>crontab</command> files or
@@ -545,43 +556,43 @@
       <varlistentry>
 	<term><filename>/etc/group</filename></term>
 	<listitem>
-	  <para>Group account information.</para>
+	  <para>Group account information</para>
 	</listitem>
       </varlistentry>
       <varlistentry condition="gshadow">
 	<term><filename>/etc/gshadow</filename></term>
 	<listitem>
-	  <para>Secure group account information.</para>
+	  <para>Secure group account informatio.</para>
 	</listitem>
       </varlistentry>
       <varlistentry>
 	<term><filename>/etc/login.defs</filename></term>
 	<listitem>
-	  <para>Shadow password suite configuration.</para>
+	  <para>Shadow password suite configuration</para>
 	</listitem>
       </varlistentry>
       <varlistentry>
 	<term><filename>/etc/passwd</filename></term>
 	<listitem>
-	  <para>User account information.</para>
+	  <para>User account information</para>
 	</listitem>
       </varlistentry>
       <varlistentry>
 	<term><filename>/etc/shadow</filename></term>
 	<listitem>
-	  <para>Secure user account information.</para>
+	  <para>Secure user account information</para>
 	</listitem>
       </varlistentry>
       <varlistentry condition="subids">
 	<term><filename>/etc/subgid</filename></term>
 	<listitem>
-	  <para>Per user subordinate group IDs.</para>
+	  <para>Per user subordinate group IDs</para>
 	</listitem>
       </varlistentry>
       <varlistentry condition="subids">
 	<term><filename>/etc/subuid</filename></term>
 	<listitem>
-	  <para>Per user subordinate user IDs.</para>
+	  <para>Per user subordinate user IDs</para>
 	</listitem>
       </varlistentry>
     </variablelist>

man/vipw.8.xml

@@ -119,6 +119,7 @@
 	    Apply changes in the <replaceable>CHROOT_DIR</replaceable>
 	    directory and use the configuration files from the
 	    <replaceable>CHROOT_DIR</replaceable> directory.
+	    Only absolute paths are supported.
 	  </para>
 	</listitem>
       </varlistentry>

po/LINGUAS

@@ -15,6 +15,7 @@ hu
 id
 it
 ja
+ka
 kk
 km
 ko

po/bs.po

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: shadow\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2004-05-09 12:03+0100\n"
 "Last-Translator: Safir Šećerović <sapphire@linux.org.ba>\n"
 "Language-Team: Bosnian <lokal@lugbih.org>\n"
@@ -14,8 +14,8 @@ msgstr ""
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n"
+"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && "
-"%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+"n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
 
 #, c-format
 msgid ""
@@ -505,7 +505,7 @@ msgid "%s: failed to drop privileges (%s)\n"
 msgstr ""
 
 #, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "nepoznata grupa: %s\n"
 
 #, fuzzy, c-format
@@ -1370,9 +1370,6 @@ msgstr "%s: nepoznat član %s\n"
 msgid "Usage: id [-a]\n"
 msgstr ""
 
-msgid "Usage: id\n"
-msgstr ""
-
 msgid " groups="
 msgstr ""
 
@@ -1525,10 +1522,6 @@ msgstr ""
 msgid "Last login: %s on %s"
 msgstr ""
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr ""
-
 #, c-format
 msgid " from %.*s"
 msgstr ""
@@ -1624,7 +1617,7 @@ msgid ""
 "st_uid:%lu, gid:%lu pw_gid:%lu st_gid:%lu\n"
 msgstr ""
 
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr ""
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1639,7 +1632,7 @@ msgid "%s: invalid user ID '%s'\n"
 msgstr ""
 
 #, c-format
-msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr ""
 
 #, c-format
@@ -1787,6 +1780,10 @@ msgstr ""
 msgid "The password for %s cannot be changed yet.\n"
 msgstr ""
 
+#, c-format
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr ""
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -1818,10 +1815,6 @@ msgstr ""
 msgid "%s: password changed.\n"
 msgstr "Šifra:"
 
-#, fuzzy, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "Upozorenje o isteku šifre"
-
 #, c-format
 msgid ""
 "Usage: %s [options] [passwd]\n"
@@ -1851,7 +1844,7 @@ msgid "duplicate password entry"
 msgstr ""
 
 #, c-format
-msgid "invalid user name '%s'\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
 msgstr ""
 
 #, c-format
@@ -1930,6 +1923,10 @@ msgstr ""
 msgid "Please enter your OWN password as authentication.\n"
 msgstr ""
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr ""
+
 #, fuzzy, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: nepoznat član %s\n"
@@ -1938,10 +1935,6 @@ msgstr "%s: nepoznat član %s\n"
 msgid "%s: signal malfunction\n"
 msgstr ""
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr ""
-
 msgid "Session terminated, terminating shell..."
 msgstr ""
 
@@ -2056,6 +2049,10 @@ msgstr ""
 msgid "%s: cannot create new defaults file: %s\n"
 msgstr "nepoznata grupa: %s\n"
 
+#, fuzzy, c-format
+msgid "%s: cannot create directory for defaults file\n"
+msgstr "nepoznata grupa: %s\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr ""
@@ -2097,7 +2094,7 @@ msgid ""
 "Options:\n"
 msgstr ""
 
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr ""
 
 msgid ""
@@ -2224,10 +2221,6 @@ msgstr ""
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr ""
 
-#, c-format
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr ""
-
 #, fuzzy, c-format
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
 msgstr "nepoznata grupa: %s\n"
@@ -2315,9 +2308,7 @@ msgid "Setting mailbox file permissions"
 msgstr ""
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2359,13 +2350,13 @@ msgid "%s: can't create subordinate group IDs\n"
 msgstr "nepoznata grupa: %s\n"
 
 #, c-format
-msgid ""
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-"%s: warning: the home directory %s already exists.\n"
-"%s: Not copying any file from skel directory into it.\n"
 msgstr ""
 
 #, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgid ""
+"%s: warning: the home directory %s already exists.\n"
+"%s: Not copying any file from skel directory into it.\n"
 msgstr ""
 
 msgid ""
@@ -2452,6 +2443,12 @@ msgstr ""
 msgid "%s: warning: the user name %s to SELinux user mapping removal failed.\n"
 msgstr ""
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr ""
 
@@ -2474,12 +2471,6 @@ msgstr ""
 msgid "  -G, --groups GROUPS           new list of supplementary GROUPS\n"
 msgstr ""
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr ""
 
@@ -2499,6 +2490,13 @@ msgid ""
 "  -p, --password PASSWORD       use encrypted password for the new password\n"
 msgstr ""
 
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr ""
 
@@ -2548,6 +2546,10 @@ msgstr "nepoznata grupa: %s\n"
 msgid "%s: no options\n"
 msgstr "%s: nepoznat član %s\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr ""
@@ -2707,6 +2709,10 @@ msgstr ""
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr ""
 
+#, fuzzy, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "Upozorenje o isteku šifre"
+
 #, fuzzy
 #~ msgid "Password set to expire."
 #~ msgstr "Vaša šifra je istekla."

po/ca.po

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: shadow 4.0.18\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2012-01-22 18:25+0100\n"
 "Last-Translator: Innocent De Marchi <tangram.peces@gmail.com>\n"
 "Language-Team: Catalan <debian-l10n-catalan@lists.debian.org>\n"
@@ -551,8 +551,9 @@ msgstr "%s: l'opció '%s' requereix un argument\n"
 msgid "%s: failed to drop privileges (%s)\n"
 msgstr "%s: ha fallat la rebaixa de privilegis (%s)\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+#| msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "%s: camí «chroot» incorrecta  «%s»\n"
 
 #, c-format
@@ -1555,9 +1556,6 @@ msgstr "%s: no es pot eliminar %s\n"
 msgid "Usage: id [-a]\n"
 msgstr "Forma d'ús: id [-a]\n"
 
-msgid "Usage: id\n"
-msgstr "Forma d'ús: id\n"
-
 msgid " groups="
 msgstr " grups="
 
@@ -1731,10 +1729,6 @@ msgstr "Avís: accés reactivat després d'un bloqueig temporal."
 msgid "Last login: %s on %s"
 msgstr "Últim accés: %s a %s"
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr "Última accés: %.19s a %s"
-
 #, c-format
 msgid " from %.*s"
 msgstr " des de %.*s"
@@ -1839,7 +1833,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -q, --quiet                   quiet mode\n"
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr "  -q, --quiet                   mode silenciós\n"
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1853,8 +1847,9 @@ msgstr "%s: el grup «%s» és un grup «shadow», però no existeix a /etc/grou
 msgid "%s: invalid user ID '%s'\n"
 msgstr "%s: l'ID d'usuari «%s» no és vàlid\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr "%s: el nom d'usuari «%s» no és vàlid\n"
 
 #, c-format
@@ -2030,6 +2025,11 @@ msgstr "No es pot canviar la contrasenya de %s.\n"
 msgid "The password for %s cannot be changed yet.\n"
 msgstr "Encara no es pot canviar la contrasenya de %s.\n"
 
+#, fuzzy, c-format
+#| msgid "%s: shadow passwords required for -e\n"
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr "%s: les contrasenyes ombra són requerides per a «-e»\n"
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -2066,10 +2066,6 @@ msgstr "No s'ha canviat la contrasenya per a %s.\n"
 msgid "%s: password changed.\n"
 msgstr "%s:  S'ha canviat la contrasenya.\n"
 
-#, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "%s: la informació de caducitat de la contrasenya ha canviat.\n"
-
 # NOTE: passwd is a file (/etc/passwd)
 #, c-format
 msgid ""
@@ -2106,9 +2102,10 @@ msgstr "l'entrada del fitxer de contrasenyes no és vàlida"
 msgid "duplicate password entry"
 msgstr "l'entrada de contrasenya està duplicada"
 
-#, c-format
+#, fuzzy, c-format
-msgid "invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
-msgstr "el nom d'usuari «%s» no és vàlid\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
+msgstr "%s: el nom d'usuari «%s» no és vàlid\n"
 
 #, c-format
 msgid "invalid user ID '%lu'\n"
@@ -2188,6 +2185,10 @@ msgstr "S'ha evitat l'autenticació de contrasenya.\n"
 msgid "Please enter your OWN password as authentication.\n"
 msgstr "Si us plau introduïu la VOSTRA contrasenya com a autenticació.\n"
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr "%s: el senyal emmascara un error\n"
+
 #, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: no es pot blocar el «shell» de l'usuari\n"
@@ -2196,10 +2197,6 @@ msgstr "%s: no es pot blocar el «shell» de l'usuari\n"
 msgid "%s: signal malfunction\n"
 msgstr "%s: senyal de mal funcionament\n"
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr "%s: el senyal emmascara un error\n"
-
 msgid "Session terminated, terminating shell..."
 msgstr "Sessió acabada, finalitzant el «shell»..."
 
@@ -2345,6 +2342,11 @@ msgstr "%s: la configuració %s a %s serà ignorada\n"
 msgid "%s: cannot create new defaults file: %s\n"
 msgstr "%s: no es pot crear un fitxer nou de preferències predeterminades\n"
 
+#, fuzzy, c-format
+#| msgid "%s: cannot create new defaults file\n"
+msgid "%s: cannot create directory for defaults file\n"
+msgstr "%s: no es pot crear un fitxer nou de preferències predeterminades\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr "%s: no es pot crear un fitxer nou de preferències predeterminades\n"
@@ -2394,7 +2396,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -s, --shadow                  edit shadow or gshadow database\n"
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr ""
 "  -s, --shadow                  edita la base de dades «shadow» o «gshadow»\n"
 
@@ -2546,11 +2548,6 @@ msgstr "%s: no es pot reescriure el fitxer de contrasenyes\n"
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr "%s: -Z requereix nucli «SELinux» habilitat\n"
 
-#, fuzzy, c-format
-#| msgid "%s: invalid user name '%s'\n"
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr "%s: el nom d'usuari «%s» no és vàlid\n"
-
 #, fuzzy, c-format
 #| msgid "%s: failed to reset the faillog entry of UID %lu: %s\n"
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
@@ -2664,9 +2661,7 @@ msgid "Setting mailbox file permissions"
 msgstr "S'estan establint els permisos de la bústia de correu"
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2709,6 +2704,11 @@ msgstr "%s: no es pot generar l'usuari\n"
 msgid "%s: can't create subordinate group IDs\n"
 msgstr "%s: no es pot generar el grup\n"
 
+#, c-format
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgstr ""
+"%s: avís: falla el nom d'usuari %s a %s a l'assignació d'usuaris «SELinux».\n"
+
 #, fuzzy, c-format
 #| msgid ""
 #| "%s: warning: the home directory already exists.\n"
@@ -2720,11 +2720,6 @@ msgstr ""
 "%s: avís: el directori personal ja existeix.\n"
 "No s'hi copiarà cap fitxer del directori skel.\n"
 
-#, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-msgstr ""
-"%s: avís: falla el nom d'usuari %s a %s a l'assignació d'usuaris «SELinux».\n"
-
 #, fuzzy
 #| msgid ""
 #| "  -f, --force                   force removal of files,\n"
@@ -2829,6 +2824,15 @@ msgstr ""
 "%s: avís: ha fallat l'eliminació del nom d'usuari %s de l'assignació "
 "d'usuaris SELinux.\n"
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  afegeix l'usuari als GRUPS addicionals\n"
+"                                llistats amb la opció -G sense eliminar-los\n"
+"                                d'altres grups\n"
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr "  -c, --comment COMENTARI       nou valor per al camp GECOS\n"
 
@@ -2859,15 +2863,6 @@ msgstr ""
 msgid "  -G, --groups GROUPS           new list of supplementary GROUPS\n"
 msgstr "  -G, --groups GRUPS            llista de GRUPS addicionals\n"
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-"  -a, --append                  afegeix l'usuari als GRUPS addicionals\n"
-"                                llistats amb la opció -G sense eliminar-los\n"
-"                                d'altres grups\n"
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr "  -l, --login NEW_LOGIN         nou nom d'usuari\n"
 
@@ -2891,6 +2886,23 @@ msgstr ""
 "  -p, --password CONTRASENYA    usa contrasenya xifrada per a la nova\n"
 "                                contrasenya\n"
 
+#, fuzzy
+#| msgid ""
+#| "  -a, --append                  append the user to the supplemental "
+#| "GROUPS\n"
+#| "                                mentioned by the -G option without "
+#| "removing\n"
+#| "                                the user from other groups\n"
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  afegeix l'usuari als GRUPS addicionals\n"
+"                                llistats amb la opció -G sense eliminar-los\n"
+"                                d'altres grups\n"
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr "  -u, --uid UID                 nou UID per al compte d'usuari\n"
 
@@ -2946,6 +2958,10 @@ msgstr "%s: la data «%s» no és vàlida\n"
 msgid "%s: no options\n"
 msgstr "%s: sense opcions\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr "%s: els indicadors -L, -p, i -U són exclusius\n"
@@ -3119,6 +3135,25 @@ msgstr "%s: no es pot restaurar %s: %s (els seus canvis estan a %s)\n"
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr "%s: no es pot trobar el directori «tcb» per %s\n"
 
+#~ msgid "Usage: id\n"
+#~ msgstr "Forma d'ús: id\n"
+
+#, c-format
+#~ msgid "Last login: %.19s on %s"
+#~ msgstr "Última accés: %.19s a %s"
+
+#, c-format
+#~ msgid "%s: invalid user name '%s'\n"
+#~ msgstr "%s: el nom d'usuari «%s» no és vàlid\n"
+
+#, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "%s: la informació de caducitat de la contrasenya ha canviat.\n"
+
+#, c-format
+#~ msgid "invalid user name '%s'\n"
+#~ msgstr "el nom d'usuari «%s» no és vàlid\n"
+
 #~ msgid "Username         Port     From             Latest"
 #~ msgstr "Usuari           Port     Des de           Últim"
 

po/cs.po

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: shadow 4.2\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2014-08-24 15:07+0200\n"
 "Last-Translator: Miroslav Kure <kurem@debian.cz>\n"
 "Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
@@ -14,8 +14,8 @@ msgstr ""
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=3; plural=n%10==1 && n%100!=11 ? 0 : n%10>=2 && n"
+"Plural-Forms: nplurals=3; plural=n%10==1 && n%100!=11 ? 0 : n%10>=2 && "
-"%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;\n"
+"n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;\n"
 
 #, c-format
 msgid ""
@@ -535,8 +535,9 @@ msgstr "%s: volba „%s“ vyžaduje argument\n"
 msgid "%s: failed to drop privileges (%s)\n"
 msgstr "%s: selhalo odevzdání privilegií (%s)\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+#| msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "%s: neplatná cesta k chrootu „%s“\n"
 
 #, c-format
@@ -1493,9 +1494,6 @@ msgstr "%s: nelze smazat %s\n"
 msgid "Usage: id [-a]\n"
 msgstr "Použití: id [-a]\n"
 
-msgid "Usage: id\n"
-msgstr "Použití: id\n"
-
 msgid " groups="
 msgstr " skupiny="
 
@@ -1666,10 +1664,6 @@ msgstr "Varování: po dočasném zákazu je přihlašování opět povoleno."
 msgid "Last login: %s on %s"
 msgstr "Poslední přihlášení: %s na %s"
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr "Poslední přihlášení: %.19s na %s"
-
 #, c-format
 msgid " from %.*s"
 msgstr " z %.*s"
@@ -1776,7 +1770,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -q, --quiet                   quiet mode\n"
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr "  -q, --quiet                   tichý režim\n"
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1790,8 +1784,9 @@ msgstr "%s: skupina „%s“ je stínovou skupinou, ale neexistuje v /etc/group\
 msgid "%s: invalid user ID '%s'\n"
 msgstr "%s: chybné uživatelské ID „%s“\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr "%s: chybné uživatelské jméno „%s“\n"
 
 #, c-format
@@ -1955,6 +1950,11 @@ msgstr "Heslo uživatele %s nelze změnit.\n"
 msgid "The password for %s cannot be changed yet.\n"
 msgstr "Heslo uživatele %s nelze zatím změnit.\n"
 
+#, fuzzy, c-format
+#| msgid "%s: shadow passwords required for -e\n"
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr "%s: přepínač -e vyžaduje stínová hesla\n"
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -1990,10 +1990,6 @@ msgstr "Heslo uživatele %s nebylo změněno.\n"
 msgid "%s: password changed.\n"
 msgstr "%s: heslo bylo změněno.\n"
 
-#, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "%s: informace o vypršení platnosti hesla byly změněny.\n"
-
 #, c-format
 msgid ""
 "Usage: %s [options] [passwd]\n"
@@ -2028,9 +2024,10 @@ msgstr "chybná položka v souboru s hesly"
 msgid "duplicate password entry"
 msgstr "duplikovaná položka v souboru s hesly"
 
-#, c-format
+#, fuzzy, c-format
-msgid "invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
-msgstr "chybné uživatelské jméno „%s“\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
+msgstr "%s: chybné uživatelské jméno „%s“\n"
 
 #, c-format
 msgid "invalid user ID '%lu'\n"
@@ -2110,6 +2107,10 @@ msgstr "Ověřování heslem vynecháno.\n"
 msgid "Please enter your OWN password as authentication.\n"
 msgstr "Pro ověření zadejte VAŠE vlastní heslo.\n"
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr "%s: chyba maskování signálu\n"
+
 #, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: Nelze rozdvojit uživatelský shell\n"
@@ -2118,10 +2119,6 @@ msgstr "%s: Nelze rozdvojit uživatelský shell\n"
 msgid "%s: signal malfunction\n"
 msgstr "%s: chyba signálu\n"
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr "%s: chyba maskování signálu\n"
-
 msgid "Session terminated, terminating shell..."
 msgstr "Sezení skončeno, ukončuji shell..."
 
@@ -2266,6 +2263,11 @@ msgstr "%s: nastavení %s v %s bude ignorováno\n"
 msgid "%s: cannot create new defaults file: %s\n"
 msgstr "%s: nelze vytvořit nový soubor s výchozími hodnotami\n"
 
+#, fuzzy, c-format
+#| msgid "%s: cannot create new defaults file\n"
+msgid "%s: cannot create directory for defaults file\n"
+msgstr "%s: nelze vytvořit nový soubor s výchozími hodnotami\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr "%s: nelze vytvořit nový soubor s výchozími hodnotami\n"
@@ -2315,7 +2317,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -s, --shadow                  edit shadow or gshadow database\n"
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr "  -s, --shadow                  upraví databázi shadow nebo gshadow\n"
 
 msgid ""
@@ -2463,11 +2465,6 @@ msgstr "%s: soubor s hesly nelze přepsat\n"
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr "%s: -Z vyžaduje jádro s povoleným SELinuxem\n"
 
-#, fuzzy, c-format
-#| msgid "%s: invalid user name '%s'\n"
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr "%s: chybné uživatelské jméno „%s“\n"
-
 #, fuzzy, c-format
 #| msgid "%s: failed to reset the faillog entry of UID %lu: %s\n"
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
@@ -2570,9 +2567,7 @@ msgid "Setting mailbox file permissions"
 msgstr "Nastavuji oprávnění k poštovní schránce"
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2615,6 +2610,11 @@ msgstr "%s: nelze vytvořit podřízená uživatelská ID\n"
 msgid "%s: can't create subordinate group IDs\n"
 msgstr "%s: nelze vytvořit podřízená skupinová ID\n"
 
+#, c-format
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgstr ""
+"%s: varování: mapování uživatele %s na uživatele SELinuxu %s selhalo.\n"
+
 #, fuzzy, c-format
 #| msgid ""
 #| "%s: warning: the home directory already exists.\n"
@@ -2626,11 +2626,6 @@ msgstr ""
 "%s: varování: domovský adresář již existuje.\n"
 "Nekopíruji do něj žádné soubory z adresáře skel.\n"
 
-#, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-msgstr ""
-"%s: varování: mapování uživatele %s na uživatele SELinuxu %s selhalo.\n"
-
 #, fuzzy
 #| msgid ""
 #| "  -f, --force                   force removal of files,\n"
@@ -2731,6 +2726,14 @@ msgstr ""
 "%s: varování: odstranění mapování uživatele %s na SELinuxového uživatele "
 "selhalo.\n"
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  přidá uživatele do dalších SKUPIN zadaných\n"
+"                                volbou -G; neruší členství v ostatních sk.\n"
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr "  -c, --comment KOMENTÁŘ        nová hodnota pole GECOS\n"
 
@@ -2758,14 +2761,6 @@ msgstr ""
 "  -G, --groups SKUPINY          nový seznam dodatečných skupin, do kterých\n"
 "                                má účet patřit\n"
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-"  -a, --append                  přidá uživatele do dalších SKUPIN zadaných\n"
-"                                volbou -G; neruší členství v ostatních sk.\n"
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr "  -l, --login NOVÝ_ÚČET         nová hodnota přihlašovacího jména\n"
 
@@ -2789,6 +2784,22 @@ msgid ""
 "  -p, --password PASSWORD       use encrypted password for the new password\n"
 msgstr "  -p, --password HESLO          použije nové zašifrované heslo\n"
 
+#, fuzzy
+#| msgid ""
+#| "  -a, --append                  append the user to the supplemental "
+#| "GROUPS\n"
+#| "                                mentioned by the -G option without "
+#| "removing\n"
+#| "                                the user from other groups\n"
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  přidá uživatele do dalších SKUPIN zadaných\n"
+"                                volbou -G; neruší členství v ostatních sk.\n"
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr "  -u, --uid UID                 nové UID pro uživatelský účet\n"
 
@@ -2843,6 +2854,10 @@ msgstr "%s: neplatný rozsah podřízených gid „%s“\n"
 msgid "%s: no options\n"
 msgstr "%s: žádné volby\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr "%s: přepínače -L, -p a -U se navzájem vylučují\n"
@@ -3013,6 +3028,25 @@ msgstr "%s: %s nelze obnovit: %s (změny jsou v %s)\n"
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr "%s: nepodařilo se nalézt tcb adresář uživatele %s\n"
 
+#~ msgid "Usage: id\n"
+#~ msgstr "Použití: id\n"
+
+#, c-format
+#~ msgid "Last login: %.19s on %s"
+#~ msgstr "Poslední přihlášení: %.19s na %s"
+
+#, c-format
+#~ msgid "%s: invalid user name '%s'\n"
+#~ msgstr "%s: chybné uživatelské jméno „%s“\n"
+
+#, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "%s: informace o vypršení platnosti hesla byly změněny.\n"
+
+#, c-format
+#~ msgid "invalid user name '%s'\n"
+#~ msgstr "chybné uživatelské jméno „%s“\n"
+
 #~ msgid "Username         Port     From             Latest"
 #~ msgstr "Uživatel         Port     Z                Naposledy"
 

po/da.po

@@ -20,11 +20,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: shadow\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2012-01-26 23:57+0100\n"
 "Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
 "Language-Team: Danish <debian-l10n-danish@lists.debian.org>\n"
-"Language: \n"
+"Language: da\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
@@ -552,8 +552,9 @@ msgstr "%s: tilvalg »%s« kræver et argument\n"
 msgid "%s: failed to drop privileges (%s)\n"
 msgstr "%s: Kunne ikke afgive rettigheder (%s)\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+#| msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "%s: Ugyldig chroot-sti »%s«\n"
 
 #, c-format
@@ -1524,9 +1525,6 @@ msgstr "%s: Kan ikke slette %s\n"
 msgid "Usage: id [-a]\n"
 msgstr "Brug: id [-a]\n"
 
-msgid "Usage: id\n"
-msgstr "Brug: id\n"
-
 msgid " groups="
 msgstr " grupper="
 
@@ -1696,10 +1694,6 @@ msgstr "Advarsel: Logind genetableret efter midlertidig udelukkelse."
 msgid "Last login: %s on %s"
 msgstr "Sidst logget på: %s på %s"
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr "Sidst logget på: %.19s på %s"
-
 #, c-format
 msgid " from %.*s"
 msgstr " fra %.*s"
@@ -1803,7 +1797,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -q, --quiet                   quiet mode\n"
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr "  -q, --quiet                   tavs tilstand\n"
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1817,8 +1811,9 @@ msgstr "%s: gruppe »%s« er en skyggegruppe, men findes ikke i /etc/group\n"
 msgid "%s: invalid user ID '%s'\n"
 msgstr "%s: Ugyldigt bruger-id »%s«\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr "%s: Ugyldigt brugernavn »%s«\n"
 
 #, c-format
@@ -1986,6 +1981,11 @@ msgstr "Adgangskoden for %s kan ikke ændres.\n"
 msgid "The password for %s cannot be changed yet.\n"
 msgstr "Adgangskoden for %s kan endnu ikke ændres.\n"
 
+#, fuzzy, c-format
+#| msgid "%s: shadow passwords required for -e\n"
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr "%s: Der kræves skyggeadgangskoder for -e\n"
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -2021,10 +2021,6 @@ msgstr "Adgangskoden for %s er uændret.\n"
 msgid "%s: password changed.\n"
 msgstr "%s: Adgangskode ændret.\n"
 
-#, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "%s: Information om udløb af adgangskode blev ændret.\n"
-
 #, c-format
 msgid ""
 "Usage: %s [options] [passwd]\n"
@@ -2058,9 +2054,10 @@ msgstr "ugyldig linje i adgangskodepunkt"
 msgid "duplicate password entry"
 msgstr "adgangskodepunkt er en dublet"
 
-#, c-format
+#, fuzzy, c-format
-msgid "invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
-msgstr "ugyldigt brugernavn »%s«\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
+msgstr "%s: Ugyldigt brugernavn »%s«\n"
 
 #, c-format
 msgid "invalid user ID '%lu'\n"
@@ -2140,6 +2137,10 @@ msgstr "Gik uden om adgangskodegodkendelse.\n"
 msgid "Please enter your OWN password as authentication.\n"
 msgstr "Angiv din EGEN adgangskode som godkendelse.\n"
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr "%s: Forkert signalmasking\n"
+
 #, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: Kan ikke forgrene brugerskal\n"
@@ -2148,10 +2149,6 @@ msgstr "%s: Kan ikke forgrene brugerskal\n"
 msgid "%s: signal malfunction\n"
 msgstr "%s: Forkert signal\n"
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr "%s: Forkert signalmasking\n"
-
 msgid "Session terminated, terminating shell..."
 msgstr "Session termineret, terminerer skal..."
 
@@ -2296,6 +2293,11 @@ msgstr "%s: Konfigurationen %s i %s vil blive ignoreret\n"
 msgid "%s: cannot create new defaults file: %s\n"
 msgstr "%s: Kan ikke oprette ny standardværdifil\n"
 
+#, fuzzy, c-format
+#| msgid "%s: cannot create new defaults file\n"
+msgid "%s: cannot create directory for defaults file\n"
+msgstr "%s: Kan ikke oprette ny standardværdifil\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr "%s: Kan ikke oprette ny standardværdifil\n"
@@ -2345,7 +2347,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -s, --shadow                  edit shadow or gshadow database\n"
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr ""
 "  -s, --shadow                  rediger skygge- eller gskyggedatabase\n"
 
@@ -2496,11 +2498,6 @@ msgstr ""
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr "%s: -Z kræver SELinux-aktiveret kerne\n"
 
-#, fuzzy, c-format
-#| msgid "%s: invalid user name '%s'\n"
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr "%s: Ugyldigt brugernavn »%s«\n"
-
 #, fuzzy, c-format
 #| msgid "%s: failed to reset the faillog entry of UID %lu: %s\n"
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
@@ -2603,9 +2600,7 @@ msgid "Setting mailbox file permissions"
 msgstr "Indstiller postboksfilens rettigheder"
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2648,6 +2643,11 @@ msgstr "%s: Kan ikke oprette bruger\n"
 msgid "%s: can't create subordinate group IDs\n"
 msgstr "%s: Kan ikke oprette gruppe\n"
 
+#, c-format
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgstr ""
+"%s: Advarsel: Brugernavnet %s til %s SELinux-brugerkortlægning mislykkedes.\n"
+
 #, fuzzy, c-format
 #| msgid ""
 #| "%s: warning: the home directory already exists.\n"
@@ -2659,11 +2659,6 @@ msgstr ""
 "%s: Advarsel: Hjemmemappen findes allerede.\n"
 "Kopierer ikke nogen filer til den fra skelet-mappen.\n"
 
-#, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-msgstr ""
-"%s: Advarsel: Brugernavnet %s til %s SELinux-brugerkortlægning mislykkedes.\n"
-
 #, fuzzy
 #| msgid ""
 #| "  -f, --force                   force removal of files,\n"
@@ -2764,6 +2759,17 @@ msgstr ""
 "%s: Advarsel: Brugernavnet %s for fjernelse af SELinux-brugerkortlægning "
 "mislykkedes.\n"
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  tilføj brugeren til de supplementære "
+"GRUPPER\n"
+"                                nævnt af tilvalget -G uden at fjerne "
+"personen\n"
+"                                fra andre grupper\n"
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr "  -c, --comment KOMMENTAR       ny værdi til GECOS-feltet\n"
 
@@ -2791,17 +2797,6 @@ msgstr ""
 msgid "  -G, --groups GROUPS           new list of supplementary GROUPS\n"
 msgstr "  -G, --groups GRUPPER          ny liste med supplerende grupper\n"
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-"  -a, --append                  tilføj brugeren til de supplementære "
-"GRUPPER\n"
-"                                nævnt af tilvalget -G uden at fjerne "
-"personen\n"
-"                                fra andre grupper\n"
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr "  -l, --login NYT_LOGIND        ny værdi til logindnavnet\n"
 
@@ -2827,6 +2822,25 @@ msgstr ""
 "  -p, --password ADGANGSKODE    brug krypteret adgangskode til den nye\n"
 "                                adgangskode\n"
 
+#, fuzzy
+#| msgid ""
+#| "  -a, --append                  append the user to the supplemental "
+#| "GROUPS\n"
+#| "                                mentioned by the -G option without "
+#| "removing\n"
+#| "                                the user from other groups\n"
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  tilføj brugeren til de supplementære "
+"GRUPPER\n"
+"                                nævnt af tilvalget -G uden at fjerne "
+"personen\n"
+"                                fra andre grupper\n"
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr "  -u, --uid UID                 ny UID til brugerkontoen\n"
 
@@ -2882,6 +2896,10 @@ msgstr "%s: Ugyldig dato »%s«\n"
 msgid "%s: no options\n"
 msgstr "%s: Ingen tilvalg\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr "%s: Flagene -L, -p og -U udelukker hinanden\n"
@@ -3050,5 +3068,24 @@ msgstr "%s: Kan ikke gendanne %s: %s (dine ændringer er i %s)\n"
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr "%s: Kunne ikke finde tcb-mappe for %s\n"
 
+#~ msgid "Usage: id\n"
+#~ msgstr "Brug: id\n"
+
+#, c-format
+#~ msgid "Last login: %.19s on %s"
+#~ msgstr "Sidst logget på: %.19s på %s"
+
+#, c-format
+#~ msgid "%s: invalid user name '%s'\n"
+#~ msgstr "%s: Ugyldigt brugernavn »%s«\n"
+
+#, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "%s: Information om udløb af adgangskode blev ændret.\n"
+
+#, c-format
+#~ msgid "invalid user name '%s'\n"
+#~ msgstr "ugyldigt brugernavn »%s«\n"
+
 #~ msgid "Username         Port     From             Latest"
 #~ msgstr "Brugernavn       Port     Fra              Seneste"

po/de.po

@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: shadow 4.2-2\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2020-09-22 15:10+0200\n"
 "Last-Translator: Björn Esser <besser82@fedoraproject.org>\n"
 "Language-Team: German <debian-l10n-german@lists.debian.org>\n"
@@ -549,8 +549,9 @@ msgstr "%s: Option »%s« erfordert ein Argument\n"
 msgid "%s: failed to drop privileges (%s)\n"
 msgstr "%s: Fehler beim Entfernen der Privilegien (%s)\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+#| msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "%s: Ungültiger chroot-Pfad »%s«\n"
 
 #, c-format
@@ -583,9 +584,9 @@ msgid ""
 "ENCRYPT_METHOD and the corresponding configuration for your selected hash "
 "method.\n"
 msgstr ""
-"Kann kein Salt für das Präfix \"%s\" generieren. Bitte die Einstellungen "
+"Kann kein Salt für das Präfix \"%s\" generieren. Bitte die Einstellungen für "
-"für ENCRYPT_METHOD und den zugehörigen Konfigurationen der gewählten "
+"ENCRYPT_METHOD und den zugehörigen Konfigurationen der gewählten Hash-"
-"Hash-Methode überprüfen.\n"
+"Methode überprüfen.\n"
 
 #, c-format
 msgid "Unable to cd to '%s'\n"
@@ -1553,9 +1554,6 @@ msgstr "%s: %s kann nicht gelöscht werden.\n"
 msgid "Usage: id [-a]\n"
 msgstr "Aufruf: id [-a]\n"
 
-msgid "Usage: id\n"
-msgstr "Aufruf: id\n"
-
 msgid " groups="
 msgstr " Gruppen="
 
@@ -1732,10 +1730,6 @@ msgstr "Warnung: Login nach temporärer Sperre reaktiviert."
 msgid "Last login: %s on %s"
 msgstr "Letztes Login: %s auf %s"
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr "Letztes Login: %.19s auf %s"
-
 #, c-format
 msgid " from %.*s"
 msgstr " von %.*s"
@@ -1839,7 +1833,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -q, --quiet                   quiet mode\n"
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr "  -q, --quiet                   Nicht so geschwätzig verhalten\n"
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1854,8 +1848,9 @@ msgstr ""
 msgid "%s: invalid user ID '%s'\n"
 msgstr "%s: Ungültige Benutzer-ID »%s«\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr "%s: Ungültiger Benutzername »%s«\n"
 
 #, c-format
@@ -2028,6 +2023,11 @@ msgstr "Das Passwort für %s kann nicht geändert werden.\n"
 msgid "The password for %s cannot be changed yet.\n"
 msgstr "Das Passwort für %s kann noch nicht geändert werden.\n"
 
+#, fuzzy, c-format
+#| msgid "%s: shadow passwords required for -e\n"
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr "%s: shadow-Passwörter für -e erforderlich\n"
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -2064,10 +2064,6 @@ msgstr "Das Passwort für %s wurde nicht geändert.\n"
 msgid "%s: password changed.\n"
 msgstr "%s: Passwort geändert.\n"
 
-#, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "%s: Passwortablauf-Informationen geändert.\n"
-
 #, c-format
 msgid ""
 "Usage: %s [options] [passwd]\n"
@@ -2102,9 +2098,10 @@ msgstr "Ungültiger Eintrag in Passwortdatei"
 msgid "duplicate password entry"
 msgstr "Doppelter Passworteintrag"
 
-#, c-format
+#, fuzzy, c-format
-msgid "invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
-msgstr "Ungültiger Benutzername »%s«\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
+msgstr "%s: Ungültiger Benutzername »%s«\n"
 
 #, c-format
 msgid "invalid user ID '%lu'\n"
@@ -2184,6 +2181,10 @@ msgstr "Passwort-Authentifizierung umgangen.\n"
 msgid "Please enter your OWN password as authentication.\n"
 msgstr "Bitte geben Sie Ihr EIGENES Passwort als Authentifizierung ein.\n"
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr "%s: Signalmaskierungs-Fehlfunktion\n"
+
 #, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: Prozessaufspaltung (fork) für Benutzer-Shell nicht möglich\n"
@@ -2192,10 +2193,6 @@ msgstr "%s: Prozessaufspaltung (fork) für Benutzer-Shell nicht möglich\n"
 msgid "%s: signal malfunction\n"
 msgstr "%s: Signal-Fehlfunktion\n"
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr "%s: Signalmaskierungs-Fehlfunktion\n"
-
 msgid "Session terminated, terminating shell..."
 msgstr "Sitzung abgebrochen, Shell wird beendet ..."
 
@@ -2340,6 +2337,11 @@ msgstr "%s: die %s-Konfiguration in %s wird ignoriert.\n"
 msgid "%s: cannot create new defaults file: %s\n"
 msgstr "%s: Neue defaults-Datei kann nicht erzeugt werden.\n"
 
+#, fuzzy, c-format
+#| msgid "%s: cannot create new defaults file\n"
+msgid "%s: cannot create directory for defaults file\n"
+msgstr "%s: Neue defaults-Datei kann nicht erzeugt werden.\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr "%s: Neue defaults-Datei kann nicht erzeugt werden.\n"
@@ -2389,7 +2391,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -s, --shadow                  edit shadow or gshadow database\n"
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr ""
 "  -s, --shadow                  shadow- oder gshadow-Datenbank editieren\n"
 
@@ -2552,11 +2554,6 @@ msgstr ""
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr "%s: -Z erfordert einen Kernel, in dem SELinux aktiviert ist.\n"
 
-#, fuzzy, c-format
-#| msgid "%s: invalid user name '%s'\n"
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr "%s: Ungültiger Benutzername »%s«\n"
-
 #, fuzzy, c-format
 #| msgid "%s: failed to reset the faillog entry of UID %lu: %s\n"
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
@@ -2659,9 +2656,7 @@ msgid "Setting mailbox file permissions"
 msgstr "Zugriffsrechte der Mailboxdatei werden gesetzt"
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2704,6 +2699,12 @@ msgstr "%s: Benutzer kann nicht erstellt werden\n"
 msgid "%s: can't create subordinate group IDs\n"
 msgstr "%s: Gruppe kann nicht erzeugt werden\n"
 
+#, c-format
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgstr ""
+"%s: Warnung: Die SELinux-Benutzer-Zuordnung des Benutzernamens %s zu %s ist\n"
+"fehlgeschlagen.\n"
+
 #, fuzzy, c-format
 #| msgid ""
 #| "%s: warning: the home directory already exists.\n"
@@ -2715,12 +2716,6 @@ msgstr ""
 "%s: Warnung: Das Home-Verzeichnis existiert bereits.\n"
 "Es werden keine Dateien vom skel-Verzeichnis dorthin kopiert.\n"
 
-#, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-msgstr ""
-"%s: Warnung: Die SELinux-Benutzer-Zuordnung des Benutzernamens %s zu %s ist\n"
-"fehlgeschlagen.\n"
-
 #, fuzzy
 #| msgid ""
 #| "  -f, --force                   force removal of files,\n"
@@ -2827,6 +2822,17 @@ msgstr ""
 "%s: Warnung: Die Löschung der SELinux-Benutzer-Zuordnung für Benutzername %s "
 "ist fehlgeschlagen.\n"
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  Benutzer zu zusätzlichen Gruppen "
+"hinzufügen,\n"
+"                                die mit der Option -G angegeben werden, "
+"ohne\n"
+"                                ihn dabei aus anderen Gruppen zu entfernen\n"
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr "  -c, --comment KOMMENTAR       Neuer KOMMENTAR im GECOS-Feld\n"
 
@@ -2854,17 +2860,6 @@ msgstr ""
 msgid "  -G, --groups GROUPS           new list of supplementary GROUPS\n"
 msgstr "  -G, --groups GRUPPEN          Neue Liste zusätzlicher GRUPPEN\n"
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-"  -a, --append                  Benutzer zu zusätzlichen Gruppen "
-"hinzufügen,\n"
-"                                die mit der Option -G angegeben werden, "
-"ohne\n"
-"                                ihn dabei aus anderen Gruppen zu entfernen\n"
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr ""
 "  -l, --login NEUER_NAME        Neuer Wert für den Namen des "
@@ -2892,6 +2887,25 @@ msgstr ""
 "  -p, --password PASSWORD       Ein verschlüsseltes Passwort als neues\n"
 "                                Passwort verwenden\n"
 
+#, fuzzy
+#| msgid ""
+#| "  -a, --append                  append the user to the supplemental "
+#| "GROUPS\n"
+#| "                                mentioned by the -G option without "
+#| "removing\n"
+#| "                                the user from other groups\n"
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  Benutzer zu zusätzlichen Gruppen "
+"hinzufügen,\n"
+"                                die mit der Option -G angegeben werden, "
+"ohne\n"
+"                                ihn dabei aus anderen Gruppen zu entfernen\n"
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr "  -u, --uid UID                 Neue UID des Benutzerzugangs\n"
 
@@ -2947,6 +2961,10 @@ msgstr "%s: Ungültiges Datum »%s«\n"
 msgid "%s: no options\n"
 msgstr "%s: keine Optionen\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr "%s: -L, -p und -U können nur exklusiv genutzt werden.\n"
@@ -3121,5 +3139,24 @@ msgstr ""
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr "%s: tcb-Verzeichnis für %s konnte nicht gefunden werden\n"
 
+#~ msgid "Usage: id\n"
+#~ msgstr "Aufruf: id\n"
+
+#, c-format
+#~ msgid "Last login: %.19s on %s"
+#~ msgstr "Letztes Login: %.19s auf %s"
+
+#, c-format
+#~ msgid "%s: invalid user name '%s'\n"
+#~ msgstr "%s: Ungültiger Benutzername »%s«\n"
+
+#, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "%s: Passwortablauf-Informationen geändert.\n"
+
+#, c-format
+#~ msgid "invalid user name '%s'\n"
+#~ msgstr "Ungültiger Benutzername »%s«\n"
+
 #~ msgid "Username         Port     From             Latest"
 #~ msgstr "Benutzername     Port     Von              Letzter"

po/dz.po

@@ -7,11 +7,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: shadow 4.0.17\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2006-06-01 15:28+0530\n"
 "Last-Translator: Jurmey Rabgay <jur_gay@yahoo.com>\n"
 "Language-Team: dzongkha <pgeyleg@dit.gov.bt>\n"
-"Language: \n"
+"Language: dz\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
@@ -520,7 +520,7 @@ msgid "%s: failed to drop privileges (%s)\n"
 msgstr "%s: ཁེ་དབང་(%s)ཚུ་བཀོག་ནིའི་འཐུས་ཤོར་བྱུང་ཡོདཔ།\n"
 
 #, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "%s: ནུས་མེད་ཀྱི་ ཁྱིམ་གྱི་བརྒྱུད་འཕྲིན་: '%s'\n"
 
 #, fuzzy, c-format
@@ -1386,9 +1386,6 @@ msgstr "%s: ཡིག་སྣོད་ %sའདི་ དུས་མཐུན
 msgid "Usage: id [-a]\n"
 msgstr "ལག་ལེནཔ་:id [-a]\n"
 
-msgid "Usage: id\n"
-msgstr "ལག་ལེན་པ་: id\n"
-
 msgid " groups="
 msgstr "སྡེ་ཚན་="
 
@@ -1551,10 +1548,6 @@ msgstr "ཉེན་བརྡ་:གནས་སྐབས་ལྡེ་མི
 msgid "Last login: %s on %s"
 msgstr "མཇུག་གི་ནང་བསྐྱོད་: %s གུ་ %s"
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr "མཇུག་གི་ནང་བསྐྱོད་: %.19s གུ་ %s"
-
 #, c-format
 msgid " from %.*s"
 msgstr " %.*sལས།"
@@ -1654,7 +1647,7 @@ msgid ""
 "st_uid:%lu, gid:%lu pw_gid:%lu st_gid:%lu\n"
 msgstr ""
 
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr ""
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1668,8 +1661,9 @@ msgstr "%s: སྡེ་ཚན་ %sམེད།\n"
 msgid "%s: invalid user ID '%s'\n"
 msgstr "%s: ནུས་མེད་ལག་ལེན་པའི་མིང་ '%s'།\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr "%s: ནུས་མེད་ལག་ལེན་པའི་མིང་ '%s'།\n"
 
 #, c-format
@@ -1818,6 +1812,11 @@ msgstr "%sགི་དོན་ལུ་ ཆོག་ཡིག་སོར་མ
 msgid "The password for %s cannot be changed yet.\n"
 msgstr "%sགི་དོན་ལུ་ ཆོག་ཡིག་སོར་མི་ཚུགས།\n"
 
+#, fuzzy, c-format
+#| msgid "%s: shadow passwords required for -e\n"
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr "%s: -e ལུ་དགོས་མཁོ་ཡོད་པའི་གྱིབ་མའི་ཆོག་ཡིག་ཚུ།\n"
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -1849,10 +1848,6 @@ msgstr " %sགི་དོན་ལུ་ ཆོག་ཡིག་འདི་
 msgid "%s: password changed.\n"
 msgstr "ཆོག་ཡིག་སོར་ཡོདཔ།"
 
-#, fuzzy, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "ཆོག་ཡིག་དུས་ཡོལ་ཉེན་བརྡ།"
-
 #, fuzzy, c-format
 msgid ""
 "Usage: %s [options] [passwd]\n"
@@ -1880,9 +1875,10 @@ msgstr "ནུས་མེད་ཀྱི་ཆོག་ཡིག་ཡིག་
 msgid "duplicate password entry"
 msgstr "ཆོག་ཡིག་ཐོ་བཀོད་རྫུན་མ།"
 
-#, c-format
+#, fuzzy, c-format
-msgid "invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
-msgstr "ནུས་མེད་ལག་ལེན་པའི་མིང་ '%s'\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
+msgstr "%s: ནུས་མེད་ལག་ལེན་པའི་མིང་ '%s'།\n"
 
 #, fuzzy, c-format
 msgid "invalid user ID '%lu'\n"
@@ -1960,6 +1956,10 @@ msgstr "ཆོག་ཡིག་བདེན་བཤད་ཟུར་ལས་
 msgid "Please enter your OWN password as authentication.\n"
 msgstr "ཁྱོད་རའི་ཆོག་ཡིག་འདི་ བདེན་བཤད་སྦེ་བཙུགས།\n"
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr ""
+
 #, fuzzy, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: ཡིག་སྣོད་ %sའདི་ ལྡེ་མིག་བརྐྱབ་མི་ཚུགས།\n"
@@ -1968,10 +1968,6 @@ msgstr "%s: ཡིག་སྣོད་ %sའདི་ ལྡེ་མིག་
 msgid "%s: signal malfunction\n"
 msgstr ""
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr ""
-
 msgid "Session terminated, terminating shell..."
 msgstr ""
 
@@ -2102,6 +2098,11 @@ msgstr ""
 msgid "%s: cannot create new defaults file: %s\n"
 msgstr "%s: སྔོན་སྒྲིག་ཡིག་སྣོད་གསརཔ་ གསར་བསྐྲུན་འབད་མི་ཚུགས།\n"
 
+#, fuzzy, c-format
+#| msgid "%s: cannot create new defaults file\n"
+msgid "%s: cannot create directory for defaults file\n"
+msgstr "%s: སྔོན་སྒྲིག་ཡིག་སྣོད་གསརཔ་ གསར་བསྐྲུན་འབད་མི་ཚུགས།\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr "%s: སྔོན་སྒྲིག་ཡིག་སྣོད་གསརཔ་ གསར་བསྐྲུན་འབད་མི་ཚུགས།\n"
@@ -2143,7 +2144,7 @@ msgid ""
 "Options:\n"
 msgstr "ལག་ལེན་: %s [ཨིན་པུཊི་]\n"
 
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr ""
 
 msgid ""
@@ -2271,11 +2272,6 @@ msgstr "%s: ཆོག་ཡིག་ཡིག་སྣོད་འདི་ ལ
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr ""
 
-#, fuzzy, c-format
-#| msgid "%s: invalid user name '%s'\n"
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr "%s: ནུས་མེད་ལག་ལེན་པའི་མིང་ '%s'།\n"
-
 #, fuzzy, c-format
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
 msgstr "%s: སྣོད་ཐོ་ %s གསར་བསྐྲུན་འབད་མི་ཚུགས།\n"
@@ -2366,9 +2362,7 @@ msgid "Setting mailbox file permissions"
 msgstr "ཡིག་སྒྲོམ་ཡིག་སྣོད་གྱི་གནང་བ་ གཞི་སྒྲིག་འབད་དོ།"
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2411,6 +2405,10 @@ msgstr "%s: %sགསར་བསྐྲུན་འབད་མི་ཚུགས
 msgid "%s: can't create subordinate group IDs\n"
 msgstr "%s: %sགསར་བསྐྲུན་འབད་མི་ཚུགས།\n"
 
+#, c-format
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgstr ""
+
 #, fuzzy, c-format
 #| msgid ""
 #| "%s: warning: the home directory already exists.\n"
@@ -2422,10 +2420,6 @@ msgstr ""
 "%s: ཉེན་བརྡ་:ཁྱིམ་གྱི་སྣོད་ཐོ་འདི་ཧེ་མ་ལས་རང་ཡོདཔ་ཨིན།\n"
 "འདི་ནང་ལུ་ སི་ཀེལ་སྣོད་ཐོ་ནང་ལས་ ཡིག་སྣོད་ག་ཅི་ཡང་འདྲ་བཤུས་མ་བརྐྱབ་ནི།\n"
 
-#, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-msgstr ""
-
 msgid ""
 "  -f, --force                   force some actions that would fail "
 "otherwise\n"
@@ -2512,6 +2506,12 @@ msgstr "%s: སྣོད་ཐོ་%s རྩ་བསྐྲད་གཏང་
 msgid "%s: warning: the user name %s to SELinux user mapping removal failed.\n"
 msgstr ""
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr ""
 
@@ -2534,12 +2534,6 @@ msgstr ""
 msgid "  -G, --groups GROUPS           new list of supplementary GROUPS\n"
 msgstr ""
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr ""
 
@@ -2559,6 +2553,13 @@ msgid ""
 "  -p, --password PASSWORD       use encrypted password for the new password\n"
 msgstr ""
 
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr ""
 
@@ -2608,6 +2609,10 @@ msgstr "%s: ནུས་མེད་ཚེས་གྲངས་  '%s'།\n"
 msgid "%s: no options\n"
 msgstr "%s: ཡིག་སྣོད་%s ཁ་ཕྱེ་མི་ཚུགས།\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr ""
@@ -2779,6 +2784,25 @@ msgstr "%s: %sསོར་ཆུད་འབད་མ་ཚུགས་: %s (ཁ
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr "%s: ནུས་མེད་གཞི་རྟེན་སྣོད་ཐོ་'%s'།\n"
 
+#~ msgid "Usage: id\n"
+#~ msgstr "ལག་ལེན་པ་: id\n"
+
+#, c-format
+#~ msgid "Last login: %.19s on %s"
+#~ msgstr "མཇུག་གི་ནང་བསྐྱོད་: %.19s གུ་ %s"
+
+#, c-format
+#~ msgid "%s: invalid user name '%s'\n"
+#~ msgstr "%s: ནུས་མེད་ལག་ལེན་པའི་མིང་ '%s'།\n"
+
+#, fuzzy, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "ཆོག་ཡིག་དུས་ཡོལ་ཉེན་བརྡ།"
+
+#, c-format
+#~ msgid "invalid user name '%s'\n"
+#~ msgstr "ནུས་མེད་ལག་ལེན་པའི་མིང་ '%s'\n"
+
 #~ msgid "Username         Port     From             Latest"
 #~ msgstr "ལག་ལེན་པའི་མིང་         འདྲེན་ལམ་     ལས་             མཇུག་མཐའ།"
 
@@ -2982,8 +3006,8 @@ msgstr "%s: ནུས་མེད་གཞི་རྟེན་སྣོད་
 #~ "\t\t\t\t གི་ཤུལ་མར་ ནུས་མེད་སྦེ་གཞི་སྒྲིག་འབད།\n"
 #~ "  -l, --lock\t\t\t མིང་བཏགས་ཡོད་པའི་རྩིས་ཐོ་ ལྡེ་མིག་རྐྱབས།\n"
 #~ "  -n, --mindays MIN_DAYS\t ཆོག་ཡིག་ \n"
-#~ "\t\t\t\tའདི་ MIN_DAYSལུ་མ་བསྒྱུར་བའི་ཧེ་མ་ ཉིན་གྲངས་ཉུང་མཐའ་གཞི་སྒྲིག་འབད།  -q, --quiet"
+#~ "\t\t\t\tའདི་ MIN_DAYSལུ་མ་བསྒྱུར་བའི་ཧེ་མ་ ཉིན་གྲངས་ཉུང་མཐའ་གཞི་སྒྲིག་འབད།  -q, --"
-#~ "\t\t\t ཁུ་སིམ་སིམ་གྱི་ཐབས་ལམ།\n"
+#~ "quiet\t\t\t ཁུ་སིམ་སིམ་གྱི་ཐབས་ལམ།\n"
 #~ "  -r, --repository REPOSITORY\t  REPOSITORYམཛོད་གནས་ནང་ལུ་ ཆོག་ཡིག་སོར།\n"
 #~ "  -s, --status\t\t\t མིང་བཏགས་ཡོད་པའི་རྩིས་ཐོའི་གུ་ ཆོག་ཡིག་སྙན་ཞུ་འབད།\n"
 #~ "  -u, --unlock\t\t\t མིང་བཏགས་ཡོད་པའི་རྩིས་ཐོ་འདི་ ལྡེ་མིག་ཕྱེ།\n"

po/el.po

@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: shadow_po_el\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2012-01-21 00:22+0200\n"
 "Last-Translator: Thomas Vasileiou <thomas-v@wildmail.com>\n"
 "Language-Team: Greek <debian-l10n-greek@lists.debian.org>\n"
@@ -552,8 +552,9 @@ msgstr "%s: η επιλογή '%s' απαιτεί μία τιμή\n"
 msgid "%s: failed to drop privileges (%s)\n"
 msgstr "%s: αποτυχία απόρριψης προνομίων (%s)\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+#| msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "%s: διαδρομή chroot μη έγκυρη '%s'\n"
 
 #, c-format
@@ -1553,9 +1554,6 @@ msgstr "%s: αδυναμία διαγραφής του %s\n"
 msgid "Usage: id [-a]\n"
 msgstr "Χρήση: id [-a]\n"
 
-msgid "Usage: id\n"
-msgstr "Χρήση: id\n"
-
 msgid " groups="
 msgstr " ομάδες="
 
@@ -1732,10 +1730,6 @@ msgstr ""
 msgid "Last login: %s on %s"
 msgstr "Τελευταία είσοδος: %s στο %s"
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr "Τελευταία είσοδος: %.19s στο %s"
-
 #, c-format
 msgid " from %.*s"
 msgstr " από %.*s"
@@ -1840,7 +1834,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -q, --quiet                   quiet mode\n"
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr "  -q, --quiet                   σιωπηλή λειτουργία\n"
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1855,8 +1849,9 @@ msgstr ""
 msgid "%s: invalid user ID '%s'\n"
 msgstr "%s: μη έγκυρο ID χρήστη '%s'\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr "%s: μη έγκυρο όνομα χρήστη '%s'\n"
 
 #, c-format
@@ -2040,6 +2035,11 @@ msgstr "Το συνθηματικό για τον %s δεν μπορεί να α
 msgid "The password for %s cannot be changed yet.\n"
 msgstr "Το συνθηματικό για το χρήστη %s δεν μπορεί να αλλάξει.\n"
 
+#, fuzzy, c-format
+#| msgid "%s: shadow passwords required for -e\n"
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr "%s: σκιώδη συνθηματικά απαιτούνται για το -e\n"
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -2078,10 +2078,6 @@ msgstr "Το συνθηματικό για τον %s δεν άλλαξε.\n"
 msgid "%s: password changed.\n"
 msgstr "%s: το συνθηματικό άλλαξε.\n"
 
-#, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "%s: αλλαγή πληροφοριών λήξης συνθηματικού.\n"
-
 #, c-format
 msgid ""
 "Usage: %s [options] [passwd]\n"
@@ -2118,9 +2114,10 @@ msgstr "Μη έγκυρη καταχώρηση στο αρχείο συνθημ
 msgid "duplicate password entry"
 msgstr "διπλότυπη καταχώριση στο αρχείο συνθηματικών"
 
-#, c-format
+#, fuzzy, c-format
-msgid "invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
-msgstr "Μη έγκυρο όνομα χρήστη '%s'\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
+msgstr "%s: μη έγκυρο όνομα χρήστη '%s'\n"
 
 #, c-format
 msgid "invalid user ID '%lu'\n"
@@ -2201,6 +2198,10 @@ msgstr "Παράκαμψη εξακρίβωσης με συνθηματικό.\n
 msgid "Please enter your OWN password as authentication.\n"
 msgstr "Παρακαλώ εισάγετε το ΔΙΚΟ σας συνθηματικό για εξακρίβωση.\n"
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr "%s: δυσλειτουργία μασκαρίσμος του σήματος\n"
+
 #, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: αδυναμία διχάλωσης του φλοιού του χρήστη\n"
@@ -2209,10 +2210,6 @@ msgstr "%s: αδυναμία διχάλωσης του φλοιού του χρ
 msgid "%s: signal malfunction\n"
 msgstr "%s: δυσλειτουργία σήματος\n"
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr "%s: δυσλειτουργία μασκαρίσμος του σήματος\n"
-
 msgid "Session terminated, terminating shell..."
 msgstr "Συνεδρία τερματίστηκε, τερματισμός φλοιού..."
 
@@ -2358,6 +2355,11 @@ msgstr "%s: η %s διαμόρφωση στο %s θα αγνοηθεί\n"
 msgid "%s: cannot create new defaults file: %s\n"
 msgstr "%s: αδυναμία δημιουργίας νέου αρχείου προκαθορισμένων ρυθμίσεων\n"
 
+#, fuzzy, c-format
+#| msgid "%s: cannot create new defaults file\n"
+msgid "%s: cannot create directory for defaults file\n"
+msgstr "%s: αδυναμία δημιουργίας νέου αρχείου προκαθορισμένων ρυθμίσεων\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr "%s: αδυναμία δημιουργίας νέου αρχείου προκαθορισμένων ρυθμίσεων\n"
@@ -2407,7 +2409,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -s, --shadow                  edit shadow or gshadow database\n"
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr ""
 "  -s, --shadow                  επεξεργασία βάσης δεδομένων shadow ή "
 "gshadow\n"
@@ -2565,11 +2567,6 @@ msgstr "%s: αδυναμία επανεγγραφής του αρχείου συ
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr "%s: -Z απαιτεί πυρήνα με ενεργοποιημένο το SELinux\n"
 
-#, fuzzy, c-format
-#| msgid "%s: invalid user name '%s'\n"
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr "%s: μη έγκυρο όνομα χρήστη '%s'\n"
-
 #, fuzzy, c-format
 #| msgid "%s: failed to reset the faillog entry of UID %lu: %s\n"
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
@@ -2671,9 +2668,7 @@ msgid "Setting mailbox file permissions"
 msgstr "Ρύθμιση αδειών του αρχείου mailbox"
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2716,6 +2711,12 @@ msgstr "%s: αδυναμία δημιουργίας του χρήστη\n"
 msgid "%s: can't create subordinate group IDs\n"
 msgstr "%s: αδυναμία δημιουργίας ομάδας\n"
 
+#, c-format
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgstr ""
+"%s: προειδοποίηση: απέτυχε η προσθήκη του χρήστη %s  στην χαρτογράφηση "
+"SELinux %s.\n"
+
 #, fuzzy, c-format
 #| msgid ""
 #| "%s: warning: the home directory already exists.\n"
@@ -2727,12 +2728,6 @@ msgstr ""
 "%s: προειδοποίηση: ο αρχικός κατάλογος χρήστη υπάρχει ήδη.\n"
 "Δεν έγινε αντιγραφή σε αυτό οποιουδήποτε καταλόγου skel.\n"
 
-#, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-msgstr ""
-"%s: προειδοποίηση: απέτυχε η προσθήκη του χρήστη %s  στην χαρτογράφηση "
-"SELinux %s.\n"
-
 #, fuzzy
 #| msgid ""
 #| "  -f, --force                   force removal of files,\n"
@@ -2838,6 +2833,16 @@ msgstr ""
 "%s: προειδοποίηση: η απομάκρυνση του ονόματος χρήστη %s από την χαρτογράφηση "
 "χρηστών του SELinux απέτυχε.\n"
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  προσθήκη του χρήστη στις συμπληρωματικές "
+"ΟΜΑΔΕΣ\n"
+"                                που προσδιορίζονται από την επιλογή -G, \n"
+"                                χωρίς να διαγράφεται από τις άλλες ομάδες\n"
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr "  -c, --comment ΣΧΟΛΙΟ         νέα τιμή του πεδίου GECOS\n"
 
@@ -2869,16 +2874,6 @@ msgid "  -G, --groups GROUPS           new list of supplementary GROUPS\n"
 msgstr ""
 "  -G, --groups ΟΜΑΔΕΣ           νέα λίστα με τις συμπληρωματικές ΟΜΑΔΕΣ\n"
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-"  -a, --append                  προσθήκη του χρήστη στις συμπληρωματικές "
-"ΟΜΑΔΕΣ\n"
-"                                που προσδιορίζονται από την επιλογή -G, \n"
-"                                χωρίς να διαγράφεται από τις άλλες ομάδες\n"
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr "  -l, --login ΝΕΟ_ΟΝΟΜΑ        νέο όνομα χρήστη\n"
 
@@ -2904,6 +2899,24 @@ msgstr ""
 "  -p, --password ΣΥΝΘΗΜΑΤΙΚΟ       χρήση κρυπτογραφημένου συνθηματικού ως "
 "νέο συνθηματικό\n"
 
+#, fuzzy
+#| msgid ""
+#| "  -a, --append                  append the user to the supplemental "
+#| "GROUPS\n"
+#| "                                mentioned by the -G option without "
+#| "removing\n"
+#| "                                the user from other groups\n"
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  προσθήκη του χρήστη στις συμπληρωματικές "
+"ΟΜΑΔΕΣ\n"
+"                                που προσδιορίζονται από την επιλογή -G, \n"
+"                                χωρίς να διαγράφεται από τις άλλες ομάδες\n"
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr "  -u, --uid UID                 νέο UID για το λογαριασμό του χρήστη\n"
 
@@ -2960,6 +2973,10 @@ msgstr "%s: Μη έγκυρη ημερομηνία '%s'\n"
 msgid "%s: no options\n"
 msgstr "%s: χωρίς επιλογές\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr "%s: οι σημαίες -L, -p, και -U είναι αποκλειστικές\n"
@@ -3136,6 +3153,25 @@ msgstr "%s: αδυναμία επαναφοράς %s: %s (οι αλλαγές ε
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr "%s: αποτυχία εύρεσης καταλόγου tcb %s\n"
 
+#~ msgid "Usage: id\n"
+#~ msgstr "Χρήση: id\n"
+
+#, c-format
+#~ msgid "Last login: %.19s on %s"
+#~ msgstr "Τελευταία είσοδος: %.19s στο %s"
+
+#, c-format
+#~ msgid "%s: invalid user name '%s'\n"
+#~ msgstr "%s: μη έγκυρο όνομα χρήστη '%s'\n"
+
+#, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "%s: αλλαγή πληροφοριών λήξης συνθηματικού.\n"
+
+#, c-format
+#~ msgid "invalid user name '%s'\n"
+#~ msgstr "Μη έγκυρο όνομα χρήστη '%s'\n"
+
 #~ msgid "Username         Port     From             Latest"
 #~ msgstr "Όνομα_Χρήστη     Θύρα     Από              Τελευταία"
 

po/es.po

@@ -32,7 +32,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: shadow 4.1.4.2\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2011-11-23 23:56+0100\n"
 "Last-Translator: Francisco Javier Cuadrado <fcocuadrado@gmail.com>\n"
 "Language-Team: Debian l10n Spanish <debian-l10n-spanish@lists.debian.org>\n"
@@ -572,7 +572,7 @@ msgid "%s: failed to drop privileges (%s)\n"
 msgstr "%s: se produjo un fallo al desprenderse de los privilegios (%s)\n"
 
 #, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "%s: teléfono de casa incorrecto: «%s»\n"
 
 #, fuzzy, c-format
@@ -654,13 +654,14 @@ msgid ""
 "  -d, --lastday LAST_DAY        set date of last password change to "
 "LAST_DAY\n"
 msgstr ""
-"  -d, --lastday ÚLTIMO_DÍA      establece el día del último cambio de la\n"
+"  -d, --lastday ÚLTIMO_DÍA      establece a ÚLTIMO_DÍA el día del último\n"
-"                                contraseña a ÚLTIMO_DÍA\n"
+"                                cambio de la contraseña\n"
 
 msgid ""
 "  -E, --expiredate EXPIRE_DATE  set account expiration date to EXPIRE_DATE\n"
 msgstr ""
-"  -E, --expiredate FECHA_CAD    establece la fecha de caducidad a FECHA_CAD\n"
+"  -E, --expiredate FECHA_CAD    establece a FECHA_CAD la fecha de "
+"expiración\n"
 
 msgid "  -h, --help                    display this help message and exit\n"
 msgstr ""
@@ -687,25 +688,29 @@ msgid ""
 "  -m, --mindays MIN_DAYS        set minimum number of days before password\n"
 "                                change to MIN_DAYS\n"
 msgstr ""
-"  -m, --mindays DÍAS_MIN        establece el número mínimo de días antes de\n"
+"  -m, --mindays DÍAS_MIN        establece a DÍAS_MIN el número mínimo de "
-"                                cambiar la contraseña a DÍAS_MIN\n"
+"días\n"
+"                                antes de cambiar la contraseña\n"
 
 #, fuzzy
 msgid ""
 "  -M, --maxdays MAX_DAYS        set maximum number of days before password\n"
 "                                change to MAX_DAYS\n"
 msgstr ""
-"  -M, --maxdays DÍAS_MAX        establece el número máximo de días antes de\n"
+"  -M, --maxdays DÍAS_MAX        establece a DÍAS_MAX el número máximo de "
-"                                cambiar la contraseña a DÍAS_MAX\n"
+"días\n"
+"                                antes de cambiar la contraseña\n"
 
 msgid "  -R, --root CHROOT_DIR         directory to chroot into\n"
 msgstr ""
+"  -R, --root DIR_CHROOT         establece DIR_CHROOT como el directorio\n"
+"                                al cual hacer chroot\n"
 
 msgid ""
 "  -W, --warndays WARN_DAYS      set expiration warning days to WARN_DAYS\n"
 msgstr ""
-"  -W, --warndays DÍAS_AVISO     establece los días de aviso de expiración a\n"
+"  -W, --warndays DÍAS_AVISO     establece a DÍAS_AVISO los días de aviso\n"
-"                                DÍAS_AVISO\n"
+"                                de expiración\n"
 
 msgid "Enter the new value, or press ENTER for the default"
 msgstr ""
@@ -1058,15 +1063,14 @@ msgid ""
 "  -l, --lock-secs SEC           after failed login lock account for SEC "
 "seconds\n"
 msgstr ""
-"  -l, --lock-secs SEG           después de fallar al acceder la cuenta se\n"
+"  -l, --lock-secs SEG           después de fallar al acceder a la cuenta\n"
-"                                bloqueará después de SEG segundos\n"
+"                                esta se bloqueará por SEG segundos\n"
 
 msgid ""
 "  -m, --maximum MAX             set maximum failed login counters to MAX\n"
 msgstr ""
-"  -m, --maximum MAX             establece el máximo número de accesos "
+"  -m, --maximum MAX             establece a MAX el máximo número de accesos\n"
-"fallidos\n"
+"                                fallidos\n"
-"                                a MAX\n"
 
 msgid "  -r, --reset                   reset the counters of login failures\n"
 msgstr ""
@@ -1548,9 +1552,6 @@ msgstr "%s: no se pudo borrar %s\n"
 msgid "Usage: id [-a]\n"
 msgstr "Modo de uso: id [-a]\n"
 
-msgid "Usage: id\n"
-msgstr "Modo de uso: id\n"
-
 msgid " groups="
 msgstr "grupos="
 
@@ -1725,10 +1726,6 @@ msgstr "Aviso: acceso restablecido después de un cierre temporal."
 msgid "Last login: %s on %s"
 msgstr "Último acceso: %s en %s"
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr "Último acceso: %.19s en %s"
-
 #, c-format
 msgid " from %.*s"
 msgstr " desde %.*s"
@@ -1833,7 +1830,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -q, --quiet                   quiet mode\n"
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr "  -q, --quiet                   modo silencioso\n"
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1847,8 +1844,9 @@ msgstr "%s: el grupo «%s» es un grupo oculto, pero no existe en «/etc/group»
 msgid "%s: invalid user ID '%s'\n"
 msgstr "%s: identificador de usuario «%s» incorrecto\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr "%s: nombre de usuario «%s» incorrecto\n"
 
 #, c-format
@@ -1932,8 +1930,8 @@ msgid ""
 "  -i, --inactive INACTIVE       set password inactive after expiration\n"
 "                                to INACTIVE\n"
 msgstr ""
-"  -i, --inactive INACTIVO       establece la contraseña inactiva después de\n"
+"  -i, --inactive INACTIVO       establece la contraseña a INACTIVO después\n"
-"                                caducar a INACTIVO\n"
+"                                de caducar\n"
 
 msgid ""
 "  -l, --lock                    lock the password of the named account\n"
@@ -1971,15 +1969,16 @@ msgstr ""
 msgid ""
 "  -w, --warndays WARN_DAYS      set expiration warning days to WARN_DAYS\n"
 msgstr ""
-"  -w, --warndays DÍAS_AVISO     establece el aviso de caducidad a "
+"  -w, --warndays DÍAS_AVISO     establece a DÍAS_AVISO los días de aviso\n"
-"DÍAS_AVISO\n"
+"                                de expiración\n"
 
 msgid ""
 "  -x, --maxdays MAX_DAYS        set maximum number of days before password\n"
 "                                change to MAX_DAYS\n"
 msgstr ""
-"  -x, --maxdays DÍAS_MAX        establece el número máximo de días antes de\n"
+"  -x, --maxdays DÍAS_MAX        establece a DÍAS_MAX el número máximo de "
-"                                cambiar la contraseña a DÍAS_MAX\n"
+"días\n"
+"                                antes de cambiar la contraseña\n"
 
 msgid "Old password: "
 msgstr "Contraseña antigua: "
@@ -2025,6 +2024,11 @@ msgstr "No se puede cambiar la contraseña para %s.\n"
 msgid "The password for %s cannot be changed yet.\n"
 msgstr "Todavía no se puede cambiar la contraseña de %s.\n"
 
+#, fuzzy, c-format
+#| msgid "%s: shadow passwords required for -e\n"
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr "%s: se requieren contraseñas de shadow para -e\n"
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -2060,10 +2064,6 @@ msgstr "La contraseña para %s no se ha modificado.\n"
 msgid "%s: password changed.\n"
 msgstr "%s: contraseña cambiada.\n"
 
-#, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "%s: información de caducidad de la contraseña cambiada.\n"
-
 #, fuzzy, c-format
 msgid ""
 "Usage: %s [options] [passwd]\n"
@@ -2100,9 +2100,10 @@ msgstr "entrada del fichero de contraseñas incorrecta"
 msgid "duplicate password entry"
 msgstr "entrada de contraseña duplicada"
 
-#, c-format
+#, fuzzy, c-format
-msgid "invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
-msgstr "nombre de usuario «%s» incorrecto\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
+msgstr "%s: nombre de usuario «%s» incorrecto\n"
 
 #, c-format
 msgid "invalid user ID '%lu'\n"
@@ -2183,6 +2184,10 @@ msgstr "Autenticación de contraseña evitada.\n"
 msgid "Please enter your OWN password as authentication.\n"
 msgstr "Por favor, introduzca su PROPIA contraseña como autenticación.\n"
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr "%s: funcionamiento incorrecto del enmascaramiento de la señal\n"
+
 #, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: no se pudo realizar el «fork» de la consola del usuario\n"
@@ -2191,10 +2196,6 @@ msgstr "%s: no se pudo realizar el «fork» de la consola del usuario\n"
 msgid "%s: signal malfunction\n"
 msgstr "%s: funcionamiento incorrecto de la señal\n"
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr "%s: funcionamiento incorrecto del enmascaramiento de la señal\n"
-
 msgid "Session terminated, terminating shell..."
 msgstr "Sesión finalizada, parando la consola ..."
 
@@ -2342,6 +2343,12 @@ msgid "%s: cannot create new defaults file: %s\n"
 msgstr ""
 "%s: no se puede crear un nuevo fichero de preferencias predeterminadas\n"
 
+#, fuzzy, c-format
+#| msgid "%s: cannot create new defaults file\n"
+msgid "%s: cannot create directory for defaults file\n"
+msgstr ""
+"%s: no se puede crear un nuevo fichero de preferencias predeterminadas\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr ""
@@ -2393,7 +2400,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -s, --shadow                  edit shadow or gshadow database\n"
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr ""
 "  -s, --shadow                  edita la base de datos shadow o gshadow\n"
 
@@ -2554,11 +2561,6 @@ msgstr "%s: no se puede reescribir el fichero de contraseñas\n"
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr "%s: -Z necesita que el núcleo tenga activado SELinux\n"
 
-#, fuzzy, c-format
-#| msgid "%s: invalid user name '%s'\n"
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr "%s: nombre de usuario «%s» incorrecto\n"
-
 #, fuzzy, c-format
 #| msgid "%s: failed to reset the faillog entry of UID %lu: %s\n"
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
@@ -2667,9 +2669,7 @@ msgid "Setting mailbox file permissions"
 msgstr "Estableciendo los permisos del fichero del buzón de correo"
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2711,6 +2711,12 @@ msgstr "%s: no se pudo crear el usuario\n"
 msgid "%s: can't create subordinate group IDs\n"
 msgstr "%s: no se puede crear el grupo\n"
 
+#, c-format
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgstr ""
+"%s: aviso: no se pudo relacionar el nombre del usuario %s con el usuario %s "
+"de SELinux.\n"
+
 #, fuzzy, c-format
 #| msgid ""
 #| "%s: warning: the home directory already exists.\n"
@@ -2722,12 +2728,6 @@ msgstr ""
 "%s: aviso: el directorio personal ya existe.\n"
 "No se va a copiar ningún fichero del directorio «skel» en él.\n"
 
-#, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-msgstr ""
-"%s: aviso: no se pudo relacionar el nombre del usuario %s con el usuario %s "
-"de SELinux.\n"
-
 #, fuzzy
 #| msgid ""
 #| "  -f, --force                   force removal of files,\n"
@@ -2829,6 +2829,12 @@ msgstr ""
 "%s: aviso: no se pudo relacionar el nombre del usuario %s con el usuario %s "
 "de SELinux.\n"
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr "  -c, --comment COMENTARIO      nuevo valor del campo GECOS\n"
 
@@ -2858,12 +2864,6 @@ msgstr ""
 msgid "  -G, --groups GROUPS           new list of supplementary GROUPS\n"
 msgstr "  -G, --groups GRUPOS           lista de grupos suplementarios\n"
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr "  -l, --login NOMBRE            nuevo nombre para el usuario\n"
 
@@ -2889,6 +2889,19 @@ msgstr ""
 "  -p, --password CONTRASEÑA     usar la contraseña cifrada para la nueva "
 "cuenta\n"
 
+#, fuzzy
+#| msgid ""
+#| "  -f, --force                   force removal of files,\n"
+#| "                                even if not owned by user\n"
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -f, --force                   forzar la eliminación de los ficheros,\n"
+"                                incluso si no pertenecen al usuario\n"
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr ""
 "  -u, --uid UID                 fuerza el uso del UID para la nueva cuenta\n"
@@ -2946,6 +2959,10 @@ msgstr "%s: fecha «%s» incorrecta\n"
 msgid "%s: no options\n"
 msgstr "%s: no se pudo abrir %s\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr "%s: las opciones -L, -p y -U son exclusivas\n"
@@ -3119,6 +3136,25 @@ msgstr "%s: no se puede restaurar %s: %s (sus cambios están en %s)\n"
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr "%s: se produjo un fallo al buscar el directorio tcb de %s\n"
 
+#~ msgid "Usage: id\n"
+#~ msgstr "Modo de uso: id\n"
+
+#, c-format
+#~ msgid "Last login: %.19s on %s"
+#~ msgstr "Último acceso: %.19s en %s"
+
+#, c-format
+#~ msgid "%s: invalid user name '%s'\n"
+#~ msgstr "%s: nombre de usuario «%s» incorrecto\n"
+
+#, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "%s: información de caducidad de la contraseña cambiada.\n"
+
+#, c-format
+#~ msgid "invalid user name '%s'\n"
+#~ msgstr "nombre de usuario «%s» incorrecto\n"
+
 #~ msgid "Username         Port     From             Latest"
 #~ msgstr "Nombre           Puerto   De               Último"
 

po/eu.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: eu\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2011-11-26 19:42+0100\n"
 "Last-Translator: Piarres Beobide <pi@beobide.net>\n"
 "Language-Team: Euskara <debian-l10n-eu@lists.debian.org>\n"
@@ -526,7 +526,7 @@ msgid "%s: failed to drop privileges (%s)\n"
 msgstr "%s: huts baimenak kentzerakoan (%s)\n"
 
 #, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "%s: etxeko tlf baliogabea: '%s'\n"
 
 #, fuzzy, c-format
@@ -1491,9 +1491,6 @@ msgstr "%s: ezin da %s ezabatu\n"
 msgid "Usage: id [-a]\n"
 msgstr "Erabilera: id [-a]\n"
 
-msgid "Usage: id\n"
-msgstr "Erabilera: id\n"
-
 msgid " groups="
 msgstr " taldeak="
 
@@ -1670,10 +1667,6 @@ msgstr ""
 msgid "Last login: %s on %s"
 msgstr "Azken saio-hasiera: %s %s(e)n"
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr "Azken saio-hasiera: %.19s  %s(e)n"
-
 #, c-format
 msgid " from %.*s"
 msgstr " %.*s(e)tik"
@@ -1775,7 +1768,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -q, --quiet                   quiet mode\n"
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr "  -q, --quiet                   ixilik modua\n"
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1789,8 +1782,9 @@ msgstr "%s: '%s' taldea itzalpeko talde bat da, baina ez dago /etc/group-en\n"
 msgid "%s: invalid user ID '%s'\n"
 msgstr "%s: '%s' erabiltzaile ID baliogabea\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr "%s: '%s' erabiltzaile-izen baliogabea\n"
 
 #, c-format
@@ -1962,6 +1956,11 @@ msgstr "%s(r)en pasahitzak ezin dira aldatu.\n"
 msgid "The password for %s cannot be changed yet.\n"
 msgstr "%s(r)en pasahitza ezin dira aldatu oraindik.\n"
 
+#, fuzzy, c-format
+#| msgid "%s: shadow passwords required for -e\n"
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr "%s: -e itzalpeko pasahitza eskatzen du\n"
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -1997,10 +1996,6 @@ msgstr "%s(r)en pasahitza aldatu gabe dago.\n"
 msgid "%s: password changed.\n"
 msgstr "%s: pasahitza aldatuta.\n"
 
-#, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "%s: pasahitz iraungitzea informazioa aldatua.\n"
-
 #, fuzzy, c-format
 msgid ""
 "Usage: %s [options] [passwd]\n"
@@ -2035,9 +2030,10 @@ msgstr "Baliogabeko pasahitzen fitxategiko sarrera"
 msgid "duplicate password entry"
 msgstr "bikoiztutako pasahitz sarrera"
 
-#, c-format
+#, fuzzy, c-format
-msgid "invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
-msgstr "%s erabiltzaile-izen baliogabea\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
+msgstr "%s: '%s' erabiltzaile-izen baliogabea\n"
 
 #, c-format
 msgid "invalid user ID '%lu'\n"
@@ -2117,6 +2113,10 @@ msgstr "Pasahitz autentifikazioa saltatuta.\n"
 msgid "Please enter your OWN password as authentication.\n"
 msgstr "Sartu zure pasahitz PROPIOA autentifikazio gisa.\n"
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr ""
+
 #, fuzzy, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: Ezin da Erabiltzaile izena zehaztu.\n"
@@ -2125,10 +2125,6 @@ msgstr "%s: Ezin da Erabiltzaile izena zehaztu.\n"
 msgid "%s: signal malfunction\n"
 msgstr ""
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr ""
-
 msgid "Session terminated, terminating shell..."
 msgstr ""
 
@@ -2273,6 +2269,11 @@ msgstr "%s: %s konfigurazioa %s-n dagoena alde batetara utziko da\n"
 msgid "%s: cannot create new defaults file: %s\n"
 msgstr "%s: ezin da lehenespen fitxategi berria sortu\n"
 
+#, fuzzy, c-format
+#| msgid "%s: cannot create new defaults file\n"
+msgid "%s: cannot create directory for defaults file\n"
+msgstr "%s: ezin da lehenespen fitxategi berria sortu\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr "%s: ezin da lehenespen fitxategi berria sortu\n"
@@ -2322,7 +2323,7 @@ msgstr ""
 
 #, fuzzy
 #| msgid "  -s, --shadow                  edit shadow or gshadow database\n"
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr "  -s, --shadow                  shadow edo gshadow datubasea editatu\n"
 
 #, fuzzy
@@ -2454,11 +2455,6 @@ msgstr ""
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr "%s: -Z-ek  SELinux gaituriko kernel bat behar du\n"
 
-#, fuzzy, c-format
-#| msgid "%s: invalid user name '%s'\n"
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr "%s: '%s' erabiltzaile-izen baliogabea\n"
-
 #, fuzzy, c-format
 #| msgid "%s: failed to reset the faillog entry of UID %lu: %s\n"
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
@@ -2559,9 +2555,7 @@ msgid "Setting mailbox file permissions"
 msgstr "Postakutxa fitxategi baimenak ezartzen"
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2603,6 +2597,12 @@ msgstr "%s: ezin da erabiltzailea sortu\n"
 msgid "%s: can't create subordinate group IDs\n"
 msgstr "%s: ezin da taldea sortu\n"
 
+#, c-format
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgstr ""
+"%s: abisua: %s erabiltzaile izena %s SELinux erabiltzailera mapatzean huts "
+"egin du.\n"
+
 #, fuzzy, c-format
 #| msgid ""
 #| "%s: warning: the home directory already exists.\n"
@@ -2614,12 +2614,6 @@ msgstr ""
 "%s: abisua: etxe direktorioa badago dagoeneko.\n"
 "Ez da bertara skel direktorioko fitxategirik kopiatuko.\n"
 
-#, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-msgstr ""
-"%s: abisua: %s erabiltzaile izena %s SELinux erabiltzailera mapatzean huts "
-"egin du.\n"
-
 #, fuzzy
 #| msgid ""
 #| "  -f, --force                   force removal of files,\n"
@@ -2719,6 +2713,15 @@ msgstr ""
 "%s: abisua: %s erabiltzaile izena %s SELinux erabiltzailera mapatzean huts "
 "egin du.\n"
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  gehitu erabiltzailea -G aukerak zehaztutako "
+"talde\n"
+"                                gehigarrietara beste taldeetatik kendu gabe\n"
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr "  -c, --comment IRUZKINA         GECOS eremuaren balio berria\n"
 
@@ -2749,15 +2752,6 @@ msgstr ""
 "  -G, --groups TALDEAK          erabiltzaile kontu berriaren talde\n"
 "                                gehigarriak bistarazi\n"
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-"  -a, --append                  gehitu erabiltzailea -G aukerak zehaztutako "
-"talde\n"
-"                                gehigarrietara beste taldeetatik kendu gabe\n"
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr "  -l, --login IZENA             saio hasiera izenaren balio berria\n"
 
@@ -2783,6 +2777,23 @@ msgstr ""
 "  -p, --password PASAHITZA      Enkriptaturiko pasahitza erabili pasahitz\n"
 "                                berriarentzat\n"
 
+#, fuzzy
+#| msgid ""
+#| "  -a, --append                  append the user to the supplemental "
+#| "GROUPS\n"
+#| "                                mentioned by the -G option without "
+#| "removing\n"
+#| "                                the user from other groups\n"
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+"  -a, --append                  gehitu erabiltzailea -G aukerak zehaztutako "
+"talde\n"
+"                                gehigarrietara beste taldeetatik kendu gabe\n"
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr "  -u, --uid UID                 erabiltzaile kontuaren UID berria\n"
 
@@ -2839,6 +2850,10 @@ msgstr "%s: '%s' data baliogabea\n"
 msgid "%s: no options\n"
 msgstr "%s: ezin da %s ireki\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr "%s: -L, -p, eta -U banderak esklusiboak dira\n"
@@ -3012,6 +3027,25 @@ msgstr "%s: ezin da %s leheneratu: %s (zure aldaketak %s(e)n daude)\n"
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr "%s: oinarrizko '%s' direktorio baliogabea\n"
 
+#~ msgid "Usage: id\n"
+#~ msgstr "Erabilera: id\n"
+
+#, c-format
+#~ msgid "Last login: %.19s on %s"
+#~ msgstr "Azken saio-hasiera: %.19s  %s(e)n"
+
+#, c-format
+#~ msgid "%s: invalid user name '%s'\n"
+#~ msgstr "%s: '%s' erabiltzaile-izen baliogabea\n"
+
+#, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "%s: pasahitz iraungitzea informazioa aldatua.\n"
+
+#, c-format
+#~ msgid "invalid user name '%s'\n"
+#~ msgstr "%s erabiltzaile-izen baliogabea\n"
+
 #~ msgid "Username         Port     From             Latest"
 #~ msgstr "Erabiltzaile-izena        Ataka      Nondik           Azkena"
 

po/fi.po

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: shadow 4.0.18.1\n"
 "Report-Msgid-Bugs-To: pkg-shadow-devel@lists.alioth.debian.org\n"
-"POT-Creation-Date: 2021-07-04 12:20+0200\n"
+"POT-Creation-Date: 2022-07-27 22:49+0800\n"
 "PO-Revision-Date: 2007-11-24 22:54+0100\n"
 "Last-Translator: Tommi Vainikainen <thv+debian@iki.fi>\n"
 "Language-Team: Finnish <debian-l10n-finnish@lists.debian.org>\n"
@@ -516,7 +516,7 @@ msgid "%s: failed to drop privileges (%s)\n"
 msgstr "%s: Oikeuksien pudottaminen epäonnistui (%s)\n"
 
 #, fuzzy, c-format
-msgid "%s: invalid chroot path '%s'\n"
+msgid "%s: invalid chroot path '%s', only absolute paths are supported.\n"
 msgstr "%s: virheellinen kotipuhelin: \"%s\"\n"
 
 #, fuzzy, c-format
@@ -1382,9 +1382,6 @@ msgstr "%s: tiedostoa %s ei voi päivittää\n"
 msgid "Usage: id [-a]\n"
 msgstr "Käyttö: id [-a]\n"
 
-msgid "Usage: id\n"
-msgstr "Käyttö: id\n"
-
 msgid " groups="
 msgstr " ryhmät="
 
@@ -1547,10 +1544,6 @@ msgstr ""
 msgid "Last login: %s on %s"
 msgstr "Edellinen kirjautuminen: %s päätteellä %s"
 
-#, c-format
-msgid "Last login: %.19s on %s"
-msgstr "Edellinen kirjautuminen: %.19s päätteellä %s"
-
 #, c-format
 msgid " from %.*s"
 msgstr " osoitteesta %.*s"
@@ -1650,7 +1643,7 @@ msgid ""
 "st_uid:%lu, gid:%lu pw_gid:%lu st_gid:%lu\n"
 msgstr ""
 
-msgid "  -b, --badnames                allow bad names\n"
+msgid "  -b, --badname                 allow bad names\n"
 msgstr ""
 
 msgid "  -r, --system                  create system accounts\n"
@@ -1664,8 +1657,9 @@ msgstr "%s: ryhmää %s ei ole olemassa\n"
 msgid "%s: invalid user ID '%s'\n"
 msgstr "%s: virheellinen käyttäjätunnus \"%s\"\n"
 
-#, c-format
+#, fuzzy, c-format
-msgid "%s: invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
+msgid "%s: invalid user name '%s': use --badname to ignore\n"
 msgstr "%s: virheellinen käyttäjätunnus \"%s\"\n"
 
 #, c-format
@@ -1817,6 +1811,11 @@ msgstr "Käyttäjän %s salasanaa ei voi vaihtaa.\n"
 msgid "The password for %s cannot be changed yet.\n"
 msgstr "Käyttäjän %s salasanaa ei voi vaihtaa.\n"
 
+#, fuzzy, c-format
+#| msgid "%s: shadow passwords required for -e\n"
+msgid "%s: malformed password data obtained for user %s\n"
+msgstr "%s: varjosalasanat vaaditaan valitsimelle -e\n"
+
 #, c-format
 msgid ""
 "%s: unlocking the password would result in a passwordless account.\n"
@@ -1848,10 +1847,6 @@ msgstr "Käyttäjän %s salasanaa ei vaihdettu.\n"
 msgid "%s: password changed.\n"
 msgstr "Salasana vaihdettu."
 
-#, fuzzy, c-format
-msgid "%s: password expiry information changed.\n"
-msgstr "Salasanan vanhenemisvaroitus"
-
 #, fuzzy, c-format
 msgid ""
 "Usage: %s [options] [passwd]\n"
@@ -1879,9 +1874,10 @@ msgstr "virheellinen sanasanatiedostotietue"
 msgid "duplicate password entry"
 msgstr "kaksinkertainen salasanatietue"
 
-#, c-format
+#, fuzzy, c-format
-msgid "invalid user name '%s'\n"
+#| msgid "%s: invalid user name '%s'\n"
-msgstr "virheellinen käyttäjätunnus \"%s\"\n"
+msgid "invalid user name '%s': use --badname to ignore\n"
+msgstr "%s: virheellinen käyttäjätunnus \"%s\"\n"
 
 #, fuzzy, c-format
 msgid "invalid user ID '%lu'\n"
@@ -1959,6 +1955,10 @@ msgstr "Salasanatodennus ohitettu.\n"
 msgid "Please enter your OWN password as authentication.\n"
 msgstr "Syötä OMA salasanasi todennukseksi.\n"
 
+#, c-format
+msgid "%s: signal masking malfunction\n"
+msgstr ""
+
 #, fuzzy, c-format
 msgid "%s: Cannot fork user shell\n"
 msgstr "%s: tiedostoa %s ei voi lukita\n"
@@ -1967,10 +1967,6 @@ msgstr "%s: tiedostoa %s ei voi lukita\n"
 msgid "%s: signal malfunction\n"
 msgstr ""
 
-#, c-format
-msgid "%s: signal masking malfunction\n"
-msgstr ""
-
 msgid "Session terminated, terminating shell..."
 msgstr ""
 
@@ -2115,6 +2111,11 @@ msgstr ""
 msgid "%s: cannot create new defaults file: %s\n"
 msgstr "%s: uutta defaults-tiedostoa ei voi luoda\n"
 
+#, fuzzy, c-format
+#| msgid "%s: cannot create new defaults file\n"
+msgid "%s: cannot create directory for defaults file\n"
+msgstr "%s: uutta defaults-tiedostoa ei voi luoda\n"
+
 #, c-format
 msgid "%s: cannot create new defaults file\n"
 msgstr "%s: uutta defaults-tiedostoa ei voi luoda\n"
@@ -2157,7 +2158,7 @@ msgid ""
 "Options:\n"
 msgstr "Käyttö: %s [syöte]\n"
 
-msgid "      --badnames                do not check for bad names\n"
+msgid "      --badname                 do not check for bad names\n"
 msgstr ""
 
 msgid ""
@@ -2285,11 +2286,6 @@ msgstr "%s: salasanatiedostoa ei voi uudelleenkirjoittaa\n"
 msgid "%s: -Z requires SELinux enabled kernel\n"
 msgstr ""
 
-#, fuzzy, c-format
-#| msgid "%s: invalid user name '%s'\n"
-msgid "%s: invalid user name '%s': use --badname to ignore\n"
-msgstr "%s: virheellinen käyttäjätunnus \"%s\"\n"
-
 #, fuzzy, c-format
 msgid "%s: failed to open the faillog file for UID %lu: %s\n"
 msgstr "%s: hakemistoa %s ei voi luoda\n"
@@ -2381,9 +2377,7 @@ msgid "Setting mailbox file permissions"
 msgstr "Asetetaan postilaatikkotiedoston oikeudet"
 
 #, c-format
-msgid ""
+msgid "%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"
-"%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d "
-"range.\n"
 msgstr ""
 
 #, c-format
@@ -2426,6 +2420,10 @@ msgstr "%s: tiedostoa %s ei voi luoda\n"
 msgid "%s: can't create subordinate group IDs\n"
 msgstr "%s: tiedostoa %s ei voi luoda\n"
 
+#, c-format
+msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
+msgstr ""
+
 #, fuzzy, c-format
 #| msgid ""
 #| "%s: warning: the home directory already exists.\n"
@@ -2437,10 +2435,6 @@ msgstr ""
 "%s: varoitus: kotihakemisto on jo olemassa.\n"
 "Ei kopioida yhtään tiedostoa sinne skel-hakemistosta.\n"
 
-#, c-format
-msgid "%s: warning: the user name %s to %s SELinux user mapping failed.\n"
-msgstr ""
-
 msgid ""
 "  -f, --force                   force some actions that would fail "
 "otherwise\n"
@@ -2529,6 +2523,12 @@ msgstr "%s: virhe poistettaessa hakemistoa %s\n"
 msgid "%s: warning: the user name %s to SELinux user mapping removal failed.\n"
 msgstr ""
 
+msgid ""
+"  -a, --append                  append the user to the supplemental GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+
 msgid "  -c, --comment COMMENT         new value of the GECOS field\n"
 msgstr ""
 
@@ -2551,12 +2551,6 @@ msgstr ""
 msgid "  -G, --groups GROUPS           new list of supplementary GROUPS\n"
 msgstr ""
 
-msgid ""
-"  -a, --append                  append the user to the supplemental GROUPS\n"
-"                                mentioned by the -G option without removing\n"
-"                                the user from other groups\n"
-msgstr ""
-
 msgid "  -l, --login NEW_LOGIN         new value of the login name\n"
 msgstr ""
 
@@ -2576,6 +2570,13 @@ msgid ""
 "  -p, --password PASSWORD       use encrypted password for the new password\n"
 msgstr ""
 
+msgid ""
+"  -r, --remove                  remove the user from only the supplemental "
+"GROUPS\n"
+"                                mentioned by the -G option without removing\n"
+"                                the user from other groups\n"
+msgstr ""
+
 msgid "  -u, --uid UID                 new UID for the user account\n"
 msgstr ""
 
@@ -2625,6 +2626,10 @@ msgstr "%s: virheellinen päiväys \"%s\"\n"
 msgid "%s: no options\n"
 msgstr "%s: tiedostoa %s ei voi lukita\n"
 
+#, c-format
+msgid "%s: %s and %s are mutually exclusive flags\n"
+msgstr ""
+
 #, c-format
 msgid "%s: the -L, -p, and -U flags are exclusive\n"
 msgstr ""
@@ -2797,6 +2802,25 @@ msgstr ""
 msgid "%s: failed to find tcb directory for %s\n"
 msgstr "%s: virheellinen perushakemisto \"%s\"\n"
 
+#~ msgid "Usage: id\n"
+#~ msgstr "Käyttö: id\n"
+
+#, c-format
+#~ msgid "Last login: %.19s on %s"
+#~ msgstr "Edellinen kirjautuminen: %.19s päätteellä %s"
+
+#, c-format
+#~ msgid "%s: invalid user name '%s'\n"
+#~ msgstr "%s: virheellinen käyttäjätunnus \"%s\"\n"
+
+#, fuzzy, c-format
+#~ msgid "%s: password expiry information changed.\n"
+#~ msgstr "Salasanan vanhenemisvaroitus"
+
+#, c-format
+#~ msgid "invalid user name '%s'\n"
+#~ msgstr "virheellinen käyttäjätunnus \"%s\"\n"
+
 #~ msgid "Username         Port     From             Latest"
 #~ msgstr "Käyttäjä         Portti   Mistä            Viimeksi"