From 2ea08026b6f1fdba4604c8d663a64c783a638977 Mon Sep 17 00:00:00 2001 From: Meulengracht Date: Wed, 21 Oct 2026 18:03:12 +0200 Subject: [PATCH 1/2] hooks/010-fixup-permissions.chroot: set correct group and setgid on unix_chkpwd --- hooks/010-fixup-permissions.chroot | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hooks/010-fixup-permissions.chroot b/hooks/010-fixup-permissions.chroot index 82680563..776af839 100755 --- a/hooks/010-fixup-permissions.chroot +++ b/hooks/010-fixup-permissions.chroot @@ -11,3 +11,7 @@ chmod 4754 usr/lib/dbus-1.0/dbus-daemon-launch-helper # this matches the expected setup on resolute chown root:shadow etc/shadow etc/gshadow chmod 640 etc/shadow etc/gshadow + +# Same for the unix_chkpwd script, match group and setgid +chown root:shadow usr/sbin/unix_chkpwd +chmod 2755 usr/sbin/unix_chkpwd From cf5be9981efd279ea0e679ae5b097396ad937d83 Mon Sep 17 00:00:00 2001 From: Meulengracht Date: Wed, 21 Oct 2026 18:05:54 +0200 Subject: [PATCH 2/2] hook-tests/060-verify-file-permissions.test: cover usr/sbin/unix_chkpwd --- hook-tests/060-verify-file-permissions.test | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hook-tests/060-verify-file-permissions.test b/hook-tests/060-verify-file-permissions.test index 5a752cca..f6a4202a 100755 --- a/hook-tests/060-verify-file-permissions.test +++ b/hook-tests/060-verify-file-permissions.test @@ -23,3 +23,12 @@ for SHADOW in etc/shadow etc/gshadow var/lib/extrausers/shadow var/lib/extrauser exit 1 fi done + +# Verify permissions on usr/sbin/unix_chkpwd +PERMISSIONS="$(stat -c "%a %g %u" usr/sbin/unix_chkpwd)" +if [ "$PERMISSIONS" != "2755 42 0" ]; then + echo "The permissions of usr/sbin/unix_chkpwd are incorrect." + echo "Expected: 2755 42 0" + echo "Actual: $PERMISSIONS" + exit 1 +fi