app-admin/sudo/sudo-1.8.22-r2.ebuild

   1 # Copyright 1999-2018 Gentoo Foundation
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 EAPI=6
   5
   6 inherit eutils pam multilib libtool
   7
   8 MY_P=${P/_/}
   9 MY_P=${MY_P/beta/b}
  10
  11 uri_prefix=
  12 case ${P} in
  13         *_beta*|*_rc*) uri_prefix=beta/ ;;
  14 esac
  15
  16 DESCRIPTION="Allows users or groups to run commands as other users"
  17 HOMEPAGE="https://www.sudo.ws/"
  18 SRC_URI="https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz
  19         ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz"
  20
  21 # Basic license is ISC-style as-is, some files are released under
  22 # 3-clause BSD license
  23 LICENSE="ISC BSD"
  24 SLOT="0"
  25 if [[ ${PV} != *_beta* ]] && [[ ${PV} != *_rc* ]] ; then
  26         KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~x86-fbsd ~sparc-solaris"
  27 fi
  28 IUSE="gcrypt ldap nls pam offensive openssl sasl selinux +sendmail skey"
  29
  30 CDEPEND="
  31         gcrypt? ( dev-libs/libgcrypt:= )
  32         openssl? ( dev-libs/openssl:0= )
  33         pam? ( virtual/pam )
  34         sasl? ( dev-libs/cyrus-sasl )
  35         skey? ( >=sys-auth/skey-1.1.5-r1 )
  36         ldap? (
  37                 >=net-nds/openldap-2.1.30-r1
  38                 dev-libs/cyrus-sasl
  39         )
  40         sys-libs/zlib
  41 "
  42 RDEPEND="
  43         ${CDEPEND}
  44         selinux? ( sec-policy/selinux-sudo )
  45         ldap? ( dev-lang/perl )
  46         pam? ( sys-auth/pambase )
  47         >=app-misc/editor-wrapper-3
  48         virtual/editor
  49         sendmail? ( virtual/mta )
  50 "
  51 DEPEND="
  52         ${CDEPEND}
  53         sys-devel/bison
  54 "
  55
  56 S="${WORKDIR}/${MY_P}"
  57
  58 REQUIRED_USE="
  59         pam? ( !skey )
  60         skey? ( !pam )
  61         ?? ( gcrypt openssl )
  62 "
  63
  64 MAKEOPTS+=" SAMPLES="
  65
  66 src_prepare() {
  67         default
  68         elibtoolize
  69 }
  70
  71 set_rootpath() {
  72         # FIXME: secure_path is a compile time setting. using ROOTPATH
  73         # is not perfect, env-update may invalidate this, but until it
  74         # is available as a sudoers setting this will have to do.
  75         einfo "Setting secure_path ..."
  76
  77         # first extract the default ROOTPATH from build env
  78         ROOTPATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}")
  79         if [[ -z ${ROOTPATH} ]] ; then
  80                 ewarn " Failed to find ROOTPATH, please report this"
  81         fi
  82
  83         # then remove duplicate path entries
  84         cleanpath() {
  85                 local newpath thisp IFS=:
  86                 for thisp in $1 ; do
  87                         if [[ :${newpath}: != *:${thisp}:* ]] ; then
  88                                 newpath+=:$thisp
  89                         else
  90                                 einfo "   Duplicate entry ${thisp} removed..."
  91                         fi
  92                 done
  93                 ROOTPATH=${newpath#:}
  94         }
  95         cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}
  96
  97         # finally, strip gcc paths #136027
  98         rmpath() {
  99                 local e newpath thisp IFS=:
 100                 for thisp in ${ROOTPATH} ; do
 101                         for e ; do [[ $thisp == $e ]] && continue 2 ; done
 102                         newpath+=:$thisp
 103                 done
 104                 ROOTPATH=${newpath#:}
 105         }
 106         rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*'
 107
 108         einfo "... done"
 109 }
 110
 111 src_configure() {
 112         local ROOTPATH
 113         set_rootpath
 114
 115         # audit: somebody got to explain me how I can test this before I
 116         # enable it.. - Diego
 117         # plugindir: autoconf code is crappy and does not delay evaluation
 118         # until `make` time, so we have to use a full path here rather than
 119         # basing off other values.
 120         myeconfargs=(
 121                 --enable-zlib=system
 122                 --with-editor="${EPREFIX}"/usr/libexec/editor
 123                 --with-env-editor
 124                 --with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo
 125                 --with-rundir="${EPREFIX}"/var/run/sudo
 126                 --with-secure-path="${ROOTPATH}"
 127                 --with-vardir="${EPREFIX}"/var/db/sudo
 128                 --without-linux-audit
 129                 --without-opie
 130                 $(use_enable gcrypt)
 131                 $(use_enable nls)
 132                 $(use_enable openssl)
 133                 $(use_enable sasl)
 134                 $(use_with offensive insults)
 135                 $(use_with offensive all-insults)
 136                 $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo)
 137                 $(use_with ldap)
 138                 $(use_with pam)
 139                 $(use_with skey)
 140                 $(use_with selinux)
 141                 $(use_with sendmail)
 142         )
 143         econf "${myeconfargs[@]}"
 144 }
 145
 146 src_install() {
 147         default
 148
 149         if use ldap ; then
 150                 dodoc README.LDAP
 151                 dosbin plugins/sudoers/sudoers2ldif
 152
 153                 cat <<-EOF > "${T}"/ldap.conf.sudo
 154                 # See ldap.conf(5) and README.LDAP for details
 155                 # This file should only be readable by root
 156
 157                 # supported directives: host, port, ssl, ldap_version
 158                 # uri, binddn, bindpw, sudoers_base, sudoers_debug
 159                 # tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key}
 160                 EOF
 161
 162                 insinto /etc
 163                 doins "${T}"/ldap.conf.sudo
 164                 fperms 0440 /etc/ldap.conf.sudo
 165
 166                 insinto /etc/openldap/schema
 167                 newins doc/schema.OpenLDAP sudo.schema
 168         fi
 169
 170         pamd_mimic system-auth sudo auth account session
 171
 172         keepdir /var/db/sudo/lectured
 173         fperms 0700 /var/db/sudo/lectured
 174         fperms 0711 /var/db/sudo #652958
 175
 176         # Don't install into /var/run as that is a tmpfs most of the time
 177         # (bug #504854)
 178         rm -rf "${ED}"/var/run
 179 }
 180
 181 pkg_postinst() {
 182         #652958
 183         local sudo_db="${EROOT}/var/db/sudo"
 184         if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then
 185                 chmod 711 "${sudo_db}" || die
 186         fi
 187
 188         if use ldap ; then
 189                 ewarn
 190                 ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration."
 191                 ewarn
 192                 if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then
 193                         ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly"
 194                         ewarn "configured in /etc/nsswitch.conf."
 195                         ewarn
 196                         ewarn "To make use of LDAP, add this line to your /etc/nsswitch.conf:"
 197                         ewarn "  sudoers: ldap files"
 198                         ewarn
 199                 fi
 200         fi
 201         if use prefix ; then
 202                 ewarn
 203                 ewarn "To use sudo, you need to change file ownership and permissions"
 204                 ewarn "with root privileges, as follows:"
 205                 ewarn
 206                 ewarn "  # chown root:root ${EPREFIX}/usr/bin/sudo"
 207                 ewarn "  # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so"
 208                 ewarn "  # chown root:root ${EPREFIX}/etc/sudoers"
 209                 ewarn "  # chown root:root ${EPREFIX}/etc/sudoers.d"
 210                 ewarn "  # chown root:root ${EPREFIX}/var/db/sudo"
 211                 ewarn "  # chmod 4111 ${EPREFIX}/usr/bin/sudo"
 212                 ewarn
 213         fi
 214
 215         elog "To use the -A (askpass) option, you need to install a compatible"
 216         elog "password program from the following list. Starred packages will"
 217         elog "automatically register for the use with sudo (but will not force"
 218         elog "the -A option):"
 219         elog ""
 220         elog " [*] net-misc/ssh-askpass-fullscreen"
 221         elog "     net-misc/x11-ssh-askpass"
 222         elog ""
 223         elog "You can override the choice by setting the SUDO_ASKPASS environmnent"
 224         elog "variable to the program you want to use."
 225 }