Re: [gentoo-embedded] emerge --root : users not created

[P. Levine]

Attached is, hopefully, the final version of the chroot patch for
shadow.  In it, I've included chroot support for all relevant utilities.

Given that most of the utilities that use PAM do so for authentication
only, instead of disabling it when used with the --chroot flag,  I've
moved the relevant code to run before chroot is called.  It appears less
dependent on where it is called than I had first suspected.

The exception to this is passwd, chpasswd, and newusers which use PAM to
do the actual password encryption.  I've altered these to fall back to
using shadow functions (the default when not compiled with PAM support)
while using --chroot.  I'll admit it looks a little ugly, but it doesn't
seem like it can be helped.  I have tested these, and they work fine
(though before using the --chroot flag,  ideally, $ROOT/etc/login.defs
file should define the same encryption method as
$ROOT/etc/pam.d/system-auth).

Instead of having a whole lot of "if (chroot_flg)" tests scattered
throughout the source files, I've instead made ample use of the
"--wrap=" ldflag to wrap calls to pertinent libc functions into a
wrapper that checks if the chroot flag is set (still have to use the
"if (chroot_flg)" tests in passwd, chpasswd, and newusers, though).

Having examined how selinux is used in shadow, I had to disable its use
in useradd, userdel, and usermod when using chroot.  It calls on execve
after alteration of the database files, which as far as i can tell,
would fail.  And even if it was hacked to succeed, it would likely
either alter the build system or fail after trying load cross-compiled
libs.  In any event,  --chroot with selinux could only benefit a selinux
system cross-compiling a selinux system.

I've tested all related utilities with various arguments and found them
all functional, with and without the --chroot flag.

-- Peter Levine