project-lakitu/sys-apps/shadow/files/shadow-4.11.1-goodname.patch

From b10c130c348211bcae85d740a5dd92613f167e64 Mon Sep 17 00:00:00 2001
From: Edward Hyunkoo Jee <edjee@google.com>
Date: Thu, 29 Oct 2020 05:37:58 -0400
Subject: [PATCH] relax the constraints on usernames

From https://chromium.googlesource.com/chromiumos/overlays/board-overlays/+/ea27e37b7fc66202d2d05b3ddd631a8c14aa8eda/overlay-lakitu/sys-apps/shadow/files/shadow-4.2.1-goodname.patch
---
 libmisc/chkname.c  | 36 +++++++++++++++++++++++++++---------
 man/groupadd.8.xml |  6 ------
 man/useradd.8.xml  |  6 ------
 3 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/libmisc/chkname.c b/libmisc/chkname.c
index bdd1e72a..a8631731 100644
--- a/libmisc/chkname.c
+++ b/libmisc/chkname.c
@@ -55,26 +55,44 @@ static bool is_valid_name (const char *name)
 	}
 
 	/*
-	 * User/group names must match [a-z_][a-z0-9_-]*[$]
+	 * User/group names must match gnu e-regex:
+	 *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
+	 *
+	 * as a non-POSIX, extension, allow "$" as the last char for
+	 * sake of Samba 3.x "add machine script"
+	 *
+	 * Also do not allow fully numeric names or just "." or "..".
 	 */
+	int numeric;
 
-	if (('\0' == *name) ||
-	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
+	if ('\0' == *name ||
+	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
+			      '\0' == name[1])) ||
+	    !((*name >= 'a' && *name <= 'z') ||
+	      (*name >= 'A' && *name <= 'Z') ||
+	      (*name >= '0' && *name <= '9') ||
+	      *name == '_' ||
+	      *name == '.')) {
 		return false;
 	}
 
+	numeric = isdigit(*name);
+
 	while ('\0' != *++name) {
-		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
-		      ( ('0' <= *name) && ('9' >= *name) ) ||
-		      ('_' == *name) ||
-		      ('-' == *name) ||
-		      ( ('$' == *name) && ('\0' == *(name + 1)) )
+		if (!((*name >= 'a' && *name <= 'z') ||
+		      (*name >= 'A' && *name <= 'Z') ||
+		      (*name >= '0' && *name <= '9') ||
+		      *name == '_' ||
+		      *name == '.' ||
+		      *name == '-' ||
+		      (*name == '$' && name[1] == '\0')
 		     )) {
 			return false;
 		}
+		numeric &= isdigit(*name);
 	}
 
-	return true;
+	return !numeric;
 }
 
 bool is_valid_user_name (const char *name)
-- 
2.29.1.341.ge80a0c044ae-goog