Go to file
Tobias Stoeckmann 08fd4b69e8 su: properly clear child PID
If su is compiled with PAM support, it is possible for any local user
to send SIGKILL to other processes with root privileges. There are
only two conditions. First, the user must be able to perform su with
a successful login. This does NOT have to be the root user, even using
su with the same id is enough, e.g. "su $(whoami)". Second, SIGKILL
can only be sent to processes which were executed after the su process.
It is not possible to send SIGKILL to processes which were already
running. I consider this as a security vulnerability, because I was
able to write a proof of concept which unlocked a screen saver of
another user this way.
2017-02-23 09:47:29 -06:00
contrib * contrib/adduser-old.c, contrib/adduser.c: Do not use the target 2009-03-07 16:32:11 +00:00
doc Removed DONE entry. 2009-04-10 22:35:19 +00:00
etc Tweak uid/gid map default configuration 2016-02-15 18:11:10 -05:00
lib Don't crash on bogus keys in login.defs if PAM is enabled 2017-01-29 14:47:24 -06:00
libmisc Make the group and user allocation more effective. 2017-01-29 14:37:21 -06:00
man Typos fix in german translation of man pages 2017-01-18 17:24:44 +01:00
po Update Kazakh translation 2017-02-08 16:40:53 -06:00
src su: properly clear child PID 2017-02-23 09:47:29 -06:00
tests Replace user´s -> user's to make login.def files valid ASCII instead of UTF-8 2017-01-18 16:54:51 +01:00
.gitignore ignore config.cache & dist files 2016-12-05 15:48:10 -05:00
.travis.yml run travis 2016-12-06 01:09:17 +02:00
acinclude.m4 [svn-upgrade] Integrating new upstream version, shadow (4.0.13) 2007-10-07 11:47:01 +00:00
autogen.sh * autogen.sh: Restore original autoreconf (see 2010-08-29's change 2011-02-12 14:57:37 +00:00
ChangeLog Update changelog 2017-02-11 09:03:56 -06:00
configure.ac enable silent build output by default 2016-12-05 16:02:55 -05:00
COPYING Added the subversion svn:keywords property (Id) for proper identification. 2007-11-10 23:46:11 +00:00
Makefile.am switch bz2 dist to xz 2016-12-05 15:57:34 -05:00
NEWS Add NEWS entries. 2013-08-04 23:29:06 +02:00
README Update README with current maintainer 2016-11-02 09:30:05 +01:00
shadow.spec.in * shadow.spec.in: Fix the source (new FTP). 2008-08-31 17:30:45 +00:00
TODO New entry for vipw. 2012-01-15 21:26:56 +00:00

Shadow SITES
============

Homepage
	http://pkg-shadow.alioth.debian.org/

FTP site
	ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow

SVN repository
	anonymous read only access: svn://svn.debian.org/pkg-shadow/upstream

SVN web interface
	http://svn.debian.org/wsvn/pkg-shadow/upstream
	or
	http://svn.debian.org/viewsvn/pkg-shadow/upstream

Mailing lists
	for general discuss: pkg-shadow-devel@lists.alioth.debian.org
	commit list: pkg-shadow-commits@lists.alioth.debian.org

Mailing lists subscription
	http://lists.alioth.debian.org/mailman/listinfo/pkg-shadow-devel
	http://lists.alioth.debian.org/mailman/listinfo/pkg-shadow-commits

Mailing lists archives:
	http://lists.alioth.debian.org/pipermail/pkg-shadow-devel/
	http://lists.alioth.debian.org/pipermail/pkg-shadow-commits/

S/Key support:
	Shadow can be built with S/Key support using the S/Key package from:

	http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libskey/
	or
	http://gentoo.osuosl.org/distfiles/skey-1.1.5.tar.bz2

Authors and contributors
========================

Thanks to at least the following people for sending patches, bug
reports and various comments.  This list may be incomplete, I received
a lot of mail...


Adam Rudnicki <adam@v-lo.krakow.pl>
Alan Curry <pacman@tardis.mars.net>
Alexander O. Yuriev <alex@bach.cis.temple.edu>
Algis Rudys <arudys@rice.edu>
Andreas Jaeger <aj@arthur.rhein-neckar.de>
Aniello Del Sorbo <anidel@edu-gw.dia.unisa.it>
Anton Gluck <gluc@midway.uchicago.edu>
Arkadiusz Miskiewicz <misiek@pld.org.pl>
Ben Collins <bcollins@debian.org>
Brian R. Gaeke <brg@dgate.org>
Calle Karlsson <ckn@kash.se>
Chip Rosenthal <chip@unicom.com>
Chris Evans <lady0110@sable.ox.ac.uk>
Cristian Gafton <gafton@sorosis.ro>
Dan Walsh <dwalsh@redhat.com>
Darcy Boese <possum@chardonnay.niagara.com>
Dave Hagewood <admin@arrowweb.com>
David A. Holland <dholland@hcs.harvard.edu>
David Frey <David.Frey@lugs.ch>
Ed Carp <ecarp@netcom.com>
Floody <flood@evcom.net>
Frank Denis <j@4u.net>
George Kraft IV <gk4@us.ibm.com>
Greg Mortensen <loki@world.std.com>
Guido van Rooij
Guy Maor <maor@debian.org>
Hrvoje Dogan <hdogan@bjesomar.srce.hr>
Jakub Hrozek <jhrozek@redhat.com>
Janos Farkas <chexum@bankinf.banki.hu>
Jay Soffian <jay@lw.net>
Jesse Thilo <Jesse.Thilo@pobox.com>
Joey Hess <joey@kite.ml.org>
John Adelsberger <jja@umr.edu>
Jonathan Hankins <jhankins@mailserv.homewood.k12.al.us>
Jon Lewis <jlewis@lewis.org>
Joshua Cowan <jcowan@hermit.reslife.okstate.edu>
Judd Bourgeois <shagboy@bluesky.net>
Juergen Heinzl <unicorn@noris.net>
Juha Virtanen <jiivee@iki.fi>
Julian Pidancet <julian.pidancet@gmail.com>
Julianne Frances Haugh <jockgrrl@ix.netcom.com>
Leonard N. Zubkoff <lnz@dandelion.com>
Luca Berra <bluca@www.polimi.it>
Lukáš Kuklínek <lkukline@redhat.com>
Lutz Schwalowsky <schwalow@mineralogie.uni-hamburg.de>
Marc Ewing <marc@redhat.com>
Martin Bene <mb@sime.com>
Martin Mares <mj@gts.cz>
Michael Meskes <meskes@topsystem.de>
Michael Talbot-Wilson <mike@calypso.bns.com.au>
Mike Frysinger <vapier@gentoo.org>
Mike Pakovic <mpakovic@users.southeast.net>
Nicolas François <nicolas.francois@centraliens.net>
Nikos Mavroyanopoulos <nmav@i-net.paiko.gr>
Pavel Machek <pavel@bug.ucw.cz>
Peter Vrabec <pvrabec@redhat.com>
Phillip Street
Rafał Maszkowski <rzm@icm.edu.pl>
Rani Chouha <ranibey@smartec.com>
Sami Kerola <kerolasa@rocketmail.com>
Scott Garman <scott.a.garman@intel.com>
Sebastian Rick Rijkers <srrijkers@gmail.com>
Seraphim Mellos <mellos@ceid.upatras.gr>
Shane Watts <shane@nexus.mlckew.edu.au>
Steve M. Robbins <steve@nyongwa.montreal.qc.ca>
Thorsten Kukuk <kukuk@suse.de>
Tim Hockin <thockin@eagle.ais.net>
Timo Karjalainen <timok@iki.fi>
Ulisses Alonso Camaro <ulisses@pusa.eleinf.uv.es>
Werner Fink <werner@suse.de>

Maintainers
===========

Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
Serge E. Hallyn <serge@hallyn.com> (2014-now)