From 7386485609e5778469e9516c3e5621cdacfa0b86 Mon Sep 17 00:00:00 2001
From: Ali Riza KESKIN <aliriza.keskin@pardus.org.tr>
Date: Fri, 8 May 2026 17:59:52 +0300
Subject: [PATCH] suidless su added. su removed from shadow

---
 sys/apps/shadow/shadow.sysconf |  3 ---
 sys/apps/shadow/ympbuild       | 12 ++++++------
 sys/auth/suidless-su/ympbuild  | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 9 deletions(-)
 create mode 100644 sys/auth/suidless-su/ympbuild

diff --git a/sys/apps/shadow/shadow.sysconf b/sys/apps/shadow/shadow.sysconf
index d6941078..19642a2d 100644
--- a/sys/apps/shadow/shadow.sysconf
+++ b/sys/apps/shadow/shadow.sysconf
@@ -21,6 +21,3 @@ if [ "$current" != "$last" ] ; then
     date +%s -r /etc/pam.d/system-auth.d/ > /var/lib/ymp/sysconf/shadow/update.date
 fi
 
-if ! ls -la /usr/bin/su | grep "^...s" >/dev/null ; then
-    chmod 4755 /usr/bin/su
-fi
\ No newline at end of file
diff --git a/sys/apps/shadow/ympbuild b/sys/apps/shadow/ympbuild
index 0285549b..13bc0193 100644
--- a/sys/apps/shadow/ympbuild
+++ b/sys/apps/shadow/ympbuild
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 name='shadow'
-release='3'
-version='4.18.0'
+release='4'
+version='4.19.4'
 url='https://github.com/shadow-maint/shadow/releases'
 description='Password and account management tool suite with support for shadow files and PAM'
 email='aliriza.keskin@pardus.org.tr'
@@ -13,7 +13,7 @@ source=("https://github.com/shadow-maint/shadow/releases/download/$version/shado
         "system-auth")
 depends=(pam libxcrypt acl attr)
 makedepends=( )
-sha256sums=('add4604d3bc410344433122a819ee4154b79dd8316a56298c60417e637c07608'
+sha256sums=('ce57a313e315a0a7cb04a8f50cc20753e994e487bbe9b78a2a824ca75cb486c0'
          'SKIP'
          'SKIP'
          'SKIP')
@@ -37,9 +37,11 @@ setup(){
         --without-group-name-max-length \
         --without-selinux \
         --without-libbsd \
+        --without-su \
         --with-yescrypt \
         --without-bcrypt \
-        --disable-nls
+        --disable-nls \
+        --disable-logind
 }
 
 build(){
@@ -53,7 +55,5 @@ package(){
     install -vDm 600 ../useradd.defaults "${DESTDIR}/etc/default/useradd"
     install -vDm 600 ../system-auth "${DESTDIR}/etc/pam.d/system-auth.d/50-shadow"
     install -vDm 755 ../shadow.sysconf ${DESTDIR}/etc/sysconf.d/shadow
-    mkdir -p $DESTDIR/etc/suid.d
-    echo "/usr/bin/su" > $DESTDIR/etc/suid.d/shadow
 }
 
diff --git a/sys/auth/suidless-su/ympbuild b/sys/auth/suidless-su/ympbuild
new file mode 100644
index 00000000..07a4cba3
--- /dev/null
+++ b/sys/auth/suidless-su/ympbuild
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+name='suidless-su'
+release='1'
+version='1.0.0'
+url='https://gitlab.com/turkmen-linux/devel/sources/suidless-su'
+description='su command replacement. No suid bit required.'
+email='aliriza.keskin@pardus.org.tr'
+maintainer='aliriza'
+license=('GPLv3')
+source=("https://gitlab.com/turkmen-linux/devel/sources/suidless-su/-/archive/$version/suidless-su-$version.tar.gz")
+depends=()
+makedepends=()
+sha256sums=('9509c98796197e8d44e397d8198080313080010581a6038be4692b951a007864')
+group=(sys.auth)
+uses=()
+arch=('x86_64')
+
+cd $name-$version
+
+setup () {
+    meson setup build \
+      --prefix=/usr
+}
+
+build () {
+    ninja -C build $jobs
+}
+
+package () {
+    ninja -C build install $jobs
+}
+