Repository navigation
Conversation
When -p is used on a group whose /etc/group password field is "x" but which has no /etc/gshadow entry, grp_update() synthesizes a gshadow entry. cb85f90 made it borrow grp.gr_mem instead of duplicating it, to fix a leak. However, gr_update() runs before sgr_update() and replaces the old group entry through commonio_update(), which frees it together with its member list. sgr_update() then reads the dangling pointer in __sgr_dup(): Invalid read of size 8 at __sgr_dup (sgroupio.c:84) by gshadow_dup (sgroupio.c:124) by commonio_update (commonio.c:1004) by sgr_update (sgroupio.c:263) by grp_update (groupmod.c:316) Address 0x4c7cc00 is 0 bytes inside a block of size 8 free'd by gr_free_members (groupmem.c:77) by gr_free (groupmem.c:89) by group_free (groupio.c:49) by commonio_update (commonio.c:1016) by gr_update (groupio.c:168) by grp_update (groupmod.c:297) With members in the group this is a SIGSEGV rather than a stale read. Restore dup_list() and track the owned copy with sgrp_is_new so that it is released in every path: when a member list is given, the copy is either freed before being replaced (-U) or kept as is (-a -U) instead of being duplicated once more; otherwise it is freed after sgr_update() has consumed it. Fixes: cb85f90 (2026-07-29; "fix: src/groupmod.c: borrow gr_mem in new gshadow-entry branch") Closes: <shadow-maint#1760> Co-developed-by: Nikolai Kostrigin <nickel@altlinux.org> Signed-off-by: Artem Semenov <savoptik@altlinux.org> Signed-off-by: Nikolai Kostrigin <nickel@altlinux.org>
This is Python transformation of bash test located in `tests/grouptools/groupmod/10_groupmod_set_password_no_gshadow_group/groupmod.test` which checks that `groupmod` command can set the password for group with no corresponding gshadow entry. Signed-off-by: Akshay Sakure <asakure@redhat.com>
This is Python transformation of bash test located in `tests/grouptools/groupmod/11_groupmod_set_password_no_gshadow_file/groupmod.test` which checks that `groupmod` command can set the password for group when /etc/gshadow file doesn't exist. Signed-off-by: Akshay Sakure <asakure@redhat.com>
asakure
force-pushed
the
system_tests_groupmod_10_11
branch
from
October 23, 2026 18:37
5555318 to
6fb914f
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add system tests for groupmod in test_groupmod.py for
existing bash tests with numbering 10, 11.