app-admin/sudo/sudo-9999.ebuild

   1 # Copyright 1999-2017 Gentoo Foundation
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 EAPI=6
   5
   6 inherit eutils pam multilib libtool
   7 if [[ ${PV} == "9999" ]] ; then
   8         EHG_REPO_URI="http://www.sudo.ws/repos/sudo"
   9         inherit mercurial
  10 fi
  11
  12 MY_P=${P/_/}
  13 MY_P=${MY_P/beta/b}
  14
  15 uri_prefix=
  16 case ${P} in
  17         *_beta*|*_rc*) uri_prefix=beta/ ;;
  18 esac
  19
  20 DESCRIPTION="Allows users or groups to run commands as other users"
  21 HOMEPAGE="http://www.sudo.ws/"
  22 if [[ ${PV} != "9999" ]] ; then
  23         SRC_URI="http://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz
  24                 ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz"
  25         if [[ ${PV} != *_beta* ]] && [[ ${PV} != *_rc* ]] ; then
  26                 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~sparc-solaris"
  27         fi
  28 fi
  29
  30 # Basic license is ISC-style as-is, some files are released under
  31 # 3-clause BSD license
  32 LICENSE="ISC BSD"
  33 SLOT="0"
  34 IUSE="gcrypt ldap nls openssl offensive pam selinux skey +sendmail"
  35
  36 CDEPEND="
  37         sys-libs/zlib
  38         ldap? (
  39                 >=net-nds/openldap-2.1.30-r1
  40                 dev-libs/cyrus-sasl
  41         )
  42         gcrypt? ( dev-libs/libgcrypt:= )
  43         openssl? ( dev-libs/openssl:0= )
  44         pam? ( virtual/pam )
  45         skey? ( >=sys-auth/skey-1.1.5-r1 )
  46 "
  47 RDEPEND="
  48         ${CDEPEND}
  49         >=app-misc/editor-wrapper-3
  50         virtual/editor
  51         ldap? ( dev-lang/perl )
  52         pam? ( sys-auth/pambase )
  53         selinux? ( sec-policy/selinux-sudo )
  54         sendmail? ( virtual/mta )
  55 "
  56 DEPEND="
  57         ${CDEPEND}
  58         sys-devel/bison
  59 "
  60
  61 S="${WORKDIR}/${MY_P}"
  62
  63 REQUIRED_USE="
  64         pam? ( !skey )
  65         skey? ( !pam )
  66         ?? ( gcrypt openssl )
  67 "
  68
  69 MAKEOPTS+=" SAMPLES="
  70
  71 src_prepare() {
  72         default
  73         elibtoolize
  74 }
  75
  76 set_rootpath() {
  77         # FIXME: secure_path is a compile time setting. using ROOTPATH
  78         # is not perfect, env-update may invalidate this, but until it
  79         # is available as a sudoers setting this will have to do.
  80         einfo "Setting secure_path ..."
  81
  82         # first extract the default ROOTPATH from build env
  83         ROOTPATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}")
  84         if [[ -z ${ROOTPATH} ]] ; then
  85                 ewarn " Failed to find ROOTPATH, please report this"
  86         fi
  87
  88         # then remove duplicate path entries
  89         cleanpath() {
  90                 local newpath thisp IFS=:
  91                 for thisp in $1 ; do
  92                         if [[ :${newpath}: != *:${thisp}:* ]] ; then
  93                                 newpath+=:$thisp
  94                         else
  95                                 einfo "   Duplicate entry ${thisp} removed..."
  96                         fi
  97                 done
  98                 ROOTPATH=${newpath#:}
  99         }
 100         cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}
 101
 102         # finally, strip gcc paths #136027
 103         rmpath() {
 104                 local e newpath thisp IFS=:
 105                 for thisp in ${ROOTPATH} ; do
 106                         for e ; do [[ $thisp == $e ]] && continue 2 ; done
 107                         newpath+=:$thisp
 108                 done
 109                 ROOTPATH=${newpath#:}
 110         }
 111         rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*'
 112
 113         einfo "... done"
 114 }
 115
 116 src_configure() {
 117         local ROOTPATH
 118         set_rootpath
 119
 120         # audit: somebody got to explain me how I can test this before I
 121         # enable it.. - Diego
 122         # plugindir: autoconf code is crappy and does not delay evaluation
 123         # until `make` time, so we have to use a full path here rather than
 124         # basing off other values.
 125         myeconfargs=(
 126                 --enable-zlib=system
 127                 --with-editor="${EPREFIX}"/usr/libexec/editor
 128                 --with-env-editor
 129                 --with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo
 130                 --with-rundir="${EPREFIX}"/var/run/sudo
 131                 --with-secure-path="${ROOTPATH}"
 132                 --with-vardir="${EPREFIX}"/var/db/sudo
 133                 --without-linux-audit
 134                 --without-opie
 135                 $(use_enable gcrypt)
 136                 $(use_enable nls)
 137                 $(use_enable openssl)
 138                 $(use_with offensive insults)
 139                 $(use_with offensive all-insults)
 140                 $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo)
 141                 $(use_with ldap)
 142                 $(use_with pam)
 143                 $(use_with skey)
 144                 $(use_with selinux)
 145                 $(use_with sendmail)
 146         )
 147         econf "${myeconfargs[@]}"
 148 }
 149
 150 src_install() {
 151         default
 152
 153         if use ldap ; then
 154                 dodoc README.LDAP
 155                 dosbin plugins/sudoers/sudoers2ldif
 156
 157                 cat <<-EOF > "${T}"/ldap.conf.sudo
 158                 # See ldap.conf(5) and README.LDAP for details
 159                 # This file should only be readable by root
 160
 161                 # supported directives: host, port, ssl, ldap_version
 162                 # uri, binddn, bindpw, sudoers_base, sudoers_debug
 163                 # tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key}
 164                 EOF
 165
 166                 insinto /etc
 167                 doins "${T}"/ldap.conf.sudo
 168                 fperms 0440 /etc/ldap.conf.sudo
 169
 170                 insinto /etc/openldap/schema
 171                 newins doc/schema.OpenLDAP sudo.schema
 172         fi
 173
 174         pamd_mimic system-auth sudo auth account session
 175
 176         keepdir /var/db/sudo
 177         fperms 0700 /var/db/sudo
 178
 179         # Don't install into /var/run as that is a tmpfs most of the time
 180         # (bug #504854)
 181         rm -rf "${D}"/var/run
 182 }
 183
 184 pkg_postinst() {
 185         if use ldap ; then
 186                 ewarn
 187                 ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration."
 188                 ewarn
 189                 if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then
 190                         ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly"
 191                         ewarn "configured in /etc/nsswitch.conf."
 192                         ewarn
 193                         ewarn "To make use of LDAP, add this line to your /etc/nsswitch.conf:"
 194                         ewarn "  sudoers: ldap files"
 195                         ewarn
 196                 fi
 197         fi
 198         if use prefix ; then
 199                 ewarn
 200                 ewarn "To use sudo, you need to change file ownership and permissions"
 201                 ewarn "with root privileges, as follows:"
 202                 ewarn
 203                 ewarn "  # chown root:root ${EPREFIX}/usr/bin/sudo"
 204                 ewarn "  # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so"
 205                 ewarn "  # chown root:root ${EPREFIX}/etc/sudoers"
 206                 ewarn "  # chown root:root ${EPREFIX}/etc/sudoers.d"
 207                 ewarn "  # chown root:root ${EPREFIX}/var/db/sudo"
 208                 ewarn "  # chmod 4111 ${EPREFIX}/usr/bin/sudo"
 209                 ewarn
 210         fi
 211
 212         elog "To use the -A (askpass) option, you need to install a compatible"
 213         elog "password program from the following list. Starred packages will"
 214         elog "automatically register for the use with sudo (but will not force"
 215         elog "the -A option):"
 216         elog ""
 217         elog " [*] net-misc/ssh-askpass-fullscreen"
 218         elog "     net-misc/x11-ssh-askpass"
 219         elog ""
 220         elog "You can override the choice by setting the SUDO_ASKPASS environmnent"
 221         elog "variable to the program you want to use."
 222 }