app-admin/sudo/sudo-9999.ebuild

   1 # Copyright 1999-2015 Gentoo Foundation
   2 # Distributed under the terms of the GNU General Public License v2
   3 # $Id$
   4
   5 EAPI=5
   6
   7 inherit eutils pam multilib libtool
   8 if [[ ${PV} == "9999" ]] ; then
   9         EHG_REPO_URI="http://www.sudo.ws/repos/sudo"
  10         inherit mercurial
  11 fi
  12
  13 MY_P=${P/_/}
  14 MY_P=${MY_P/beta/b}
  15
  16 uri_prefix=
  17 case ${P} in
  18 *_beta*|*_rc*) uri_prefix=beta/ ;;
  19 esac
  20
  21 DESCRIPTION="Allows users or groups to run commands as other users"
  22 HOMEPAGE="http://www.sudo.ws/"
  23 if [[ ${PV} != "9999" ]] ; then
  24         SRC_URI="http://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz
  25                 ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz"
  26         KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~sparc-solaris"
  27 fi
  28
  29 # Basic license is ISC-style as-is, some files are released under
  30 # 3-clause BSD license
  31 LICENSE="ISC BSD"
  32 SLOT="0"
  33 IUSE="ldap nls pam offensive selinux skey +sendmail"
  34
  35 DEPEND="pam? ( virtual/pam )
  36         skey? ( >=sys-auth/skey-1.1.5-r1 )
  37         ldap? (
  38                 >=net-nds/openldap-2.1.30-r1
  39                 dev-libs/cyrus-sasl
  40         )
  41         sys-libs/zlib"
  42 RDEPEND="${DEPEND}
  43         selinux? ( sec-policy/selinux-sudo )
  44         ldap? ( dev-lang/perl )
  45         pam? ( sys-auth/pambase )
  46         >=app-misc/editor-wrapper-3
  47         virtual/editor
  48         sendmail? ( virtual/mta )"
  49 DEPEND="${DEPEND}
  50         sys-devel/bison"
  51
  52 S=${WORKDIR}/${MY_P}
  53
  54 REQUIRED_USE="pam? ( !skey ) skey? ( !pam )"
  55
  56 MAKEOPTS+=" SAMPLES="
  57
  58 src_prepare() {
  59         elibtoolize
  60 }
  61
  62 set_rootpath() {
  63         # FIXME: secure_path is a compile time setting. using ROOTPATH
  64         # is not perfect, env-update may invalidate this, but until it
  65         # is available as a sudoers setting this will have to do.
  66         einfo "Setting secure_path ..."
  67
  68         # first extract the default ROOTPATH from build env
  69         ROOTPATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}")
  70         if [[ -z ${ROOTPATH} ]] ; then
  71                 ewarn " Failed to find ROOTPATH, please report this"
  72         fi
  73
  74         # then remove duplicate path entries
  75         cleanpath() {
  76                 local newpath thisp IFS=:
  77                 for thisp in $1 ; do
  78                         if [[ :${newpath}: != *:${thisp}:* ]] ; then
  79                                 newpath+=:$thisp
  80                         else
  81                                 einfo "   Duplicate entry ${thisp} removed..."
  82                         fi
  83                 done
  84                 ROOTPATH=${newpath#:}
  85         }
  86         cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}
  87
  88         # finally, strip gcc paths #136027
  89         rmpath() {
  90                 local e newpath thisp IFS=:
  91                 for thisp in ${ROOTPATH} ; do
  92                         for e ; do [[ $thisp == $e ]] && continue 2 ; done
  93                         newpath+=:$thisp
  94                 done
  95                 ROOTPATH=${newpath#:}
  96         }
  97         rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*'
  98
  99         einfo "... done"
 100 }
 101
 102 src_configure() {
 103         local ROOTPATH
 104         set_rootpath
 105
 106         # audit: somebody got to explain me how I can test this before I
 107         # enable it.. - Diego
 108         # plugindir: autoconf code is crappy and does not delay evaluation
 109         # until `make` time, so we have to use a full path here rather than
 110         # basing off other values.
 111         econf \
 112                 --enable-zlib=system \
 113                 --with-secure-path="${ROOTPATH}" \
 114                 --with-editor="${EPREFIX}"/usr/libexec/editor \
 115                 --with-env-editor \
 116                 $(use_with offensive insults) \
 117                 $(use_with offensive all-insults) \
 118                 $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \
 119                 $(use_with ldap) \
 120                 $(use_enable nls) \
 121                 $(use_with pam) \
 122                 $(use_with skey) \
 123                 $(use_with selinux) \
 124                 $(use_with sendmail) \
 125                 --without-opie \
 126                 --without-linux-audit \
 127                 --with-rundir="${EPREFIX}"/var/run/sudo \
 128                 --with-vardir="${EPREFIX}"/var/db/sudo \
 129                 --with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo \
 130                 --docdir="${EPREFIX}"/usr/share/doc/${PF}
 131 }
 132
 133 src_install() {
 134         default
 135
 136         if use ldap ; then
 137                 dodoc README.LDAP doc/schema.OpenLDAP
 138                 dosbin plugins/sudoers/sudoers2ldif
 139
 140                 cat <<-EOF > "${T}"/ldap.conf.sudo
 141                 # See ldap.conf(5) and README.LDAP for details
 142                 # This file should only be readable by root
 143
 144                 # supported directives: host, port, ssl, ldap_version
 145                 # uri, binddn, bindpw, sudoers_base, sudoers_debug
 146                 # tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key
 147                 EOF
 148
 149                 insinto /etc
 150                 doins "${T}"/ldap.conf.sudo
 151                 fperms 0440 /etc/ldap.conf.sudo
 152         fi
 153
 154         pamd_mimic system-auth sudo auth account session
 155
 156         keepdir /var/db/sudo
 157         fperms 0700 /var/db/sudo
 158
 159         # Don't install into /var/run as that is a tmpfs most of the time
 160         # (bug #504854)
 161         rm -rf "${D}"/var/run
 162 }
 163
 164 pkg_postinst() {
 165         if use ldap ; then
 166                 ewarn
 167                 ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration."
 168                 ewarn
 169                 if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then
 170                         ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly"
 171                         ewarn "configured in /etc/nsswitch.conf."
 172                         ewarn
 173                         ewarn "To make use of LDAP, add this line to your /etc/nsswitch.conf:"
 174                         ewarn "  sudoers: ldap files"
 175                         ewarn
 176                 fi
 177         fi
 178         if use prefix ; then
 179                 ewarn
 180                 ewarn "To use sudo, you need to change file ownership and permissions"
 181                 ewarn "with root privileges, as follows:"
 182                 ewarn
 183                 ewarn "  # chown root:root ${EPREFIX}/usr/bin/sudo"
 184                 ewarn "  # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so"
 185                 ewarn "  # chown root:root ${EPREFIX}/etc/sudoers"
 186                 ewarn "  # chown root:root ${EPREFIX}/etc/sudoers.d"
 187                 ewarn "  # chown root:root ${EPREFIX}/var/db/sudo"
 188                 ewarn "  # chmod 4111 ${EPREFIX}/usr/bin/sudo"
 189                 ewarn
 190         fi
 191
 192         elog "To use the -A (askpass) option, you need to install a compatible"
 193         elog "password program from the following list. Starred packages will"
 194         elog "automatically register for the use with sudo (but will not force"
 195         elog "the -A option):"
 196         elog ""
 197         elog " [*] net-misc/ssh-askpass-fullscreen"
 198         elog "     net-misc/x11-ssh-askpass"
 199         elog ""
 200         elog "You can override the choice by setting the SUDO_ASKPASS environmnent"
 201         elog "variable to the program you want to use."
 202 }