[alexey-tikhonov]

Salt was generated before the chroot/prefix were applied, ignoring proper '/etc/login.defs' and using host's config instead.

[alexey-tikhonov]

Note it's in Draft because it was not yet tested.

[aborah-sudo]

1. Prepare minimal chroot

sudo mkdir -p /tmp/test-chroot/etc /tmp/test-chroot/root
echo "root:x:0:0:root:/root:/bin/bash" | sudo tee /tmp/test-chroot/etc/passwd
echo "root:!:19000:0:99999:7:::" | sudo tee /tmp/test-chroot/etc/shadow
echo "ENCRYPT_METHOD SHA512" | sudo tee /tmp/test-chroot/etc/login.defs

2. Check what the HOST uses (for contrast)

grep -E '^ENCRYPT_METHOD' /etc/login.defs

3. Run the PR binary with -R

echo "root:newpassword" | sudo ./src/chpasswd -R /tmp/test-chroot

4. Inspect the result

sudo cat /tmp/test-chroot/etc/shadow

=====================================================

root@ibm-p8-kvm-03-guest-02:/home/ilak/shadow# # Clean slate
sudo rm -rf /tmp/test-chroot
sudo mkdir -p /tmp/test-chroot/etc /tmp/test-chroot/root

Use SINGLE quotes so ! isn't history-expanded

echo 'root:x:0:0:root:/root:/bin/bash' | sudo tee /tmp/test-chroot/etc/passwd
echo 'root:!:19000:0:99999:7:::' | sudo tee /tmp/test-chroot/etc/shadow
echo 'ENCRYPT_METHOD SHA512' | sudo tee /tmp/test-chroot/etc/login.defs

Sanity check: files must exist and have content

sudo cat /tmp/test-chroot/etc/shadow
sudo cat /tmp/test-chroot/etc/login.defs
grep '^ENCRYPT_METHOD' /etc/login.defs # host: YESCRYPT

Run the PR binary (note ./src/)

echo 'root:newpassword' | sudo ./src/chpasswd -R /tmp/test-chroot

Inspect

sudo cat /tmp/test-chroot/etc/shadow
root:x:0:0:root:/root:/bin/bash
root:!:19000:0:99999:7:::
ENCRYPT_METHOD SHA512
root:!:19000:0:99999:7:::
ENCRYPT_METHOD SHA512
ENCRYPT_METHOD YESCRYPT
root:$6$8ZntiKE9/nIlbHeC$fvIealrePjGNMX1KH74drmeDgecbV3Bur0vNDXykX0O01hGeCpOW.Z1f7AF.925qPmMs7Aqn1bm5oIapsvaLu1:20768::99999:7:::
root@ibm-p8-kvm-03-guest-02:/home/ilak/shadow#

From above results:

Host /etc/login.defs: ENCRYPT_METHOD YESCRYPT
Chroot /etc/login.defs: ENCRYPT_METHOD SHA512
Result /etc/shadow: root:$6$8ZntiKE9... ← SHA512!

The hash starts with $6$, which is SHA512 — i.e. the algorithm specified in the chroot's login.defs, not the host's YESCRYPT ($y$). That means your compiled ./src/chpasswd applied the -R /tmp/test-chroot before generating the salt, so getdef_* read the chroot's configuration. That is exactly what PR #1797 fixes.

================================================

root@ibm-p8-kvm-03-guest-02:/home/ilak/shadow# # Reset chroot shadow
echo 'root:!:19000:0:99999:7:::' | sudo tee /tmp/test-chroot/etc/shadow

System binary (no fix)

echo 'root:newpassword' | sudo /usr/sbin/chpasswd -R /tmp/test-chroot

Inspect

sudo cat /tmp/test-chroot/etc/shadow
root:!:19000:0:99999:7:::
root:$y$j9T$i4q58uJ0Q2vZoiR4LIB0m.$nhUbBtG0OLukmhd/Ia5q.2/3fcBv7LEuLsxqAkLvcR1:20768:0:99999:7:::
root@ibm-p8-kvm-03-guest-02:/home/ilak/shadow#

./src/chpasswd (PR #1797) $6$8ZntiKE9... $6$ = SHA512 chroot (SHA512) Fix works
/usr/sbin/chpasswd (4.19.0, unfixed) $y$j9T$i4q58uJ0... $y$ = yescrypt host (YESCRYPT) Bug reproduced

[alejandro-colomar]

Thanks!

Reviewed-by: Alejandro Colomar <alx@kernel.org>