# ChangeLog for app-admin/sudo
# Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.77 2005/09/21 09:28:25 taviso Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.78 2005/09/25 16:28:10 taviso Exp $
+
+ 25 Sep 2005; Tavis Ormandy <taviso@gentoo.org> files/sudo,
+ -files/sudo-1.6.7_p5-strip-bash-functions.diff, -files/sudo-1.6.8_p8,
+ -files/sudo-strip-bash-functions.diff, -files/sudo-strip-shellopts.diff,
+ -files/sudo_include, -sudo-1.6.7_p5-r2.ebuild, -sudo-1.6.7_p5-r5.ebuild,
+ -sudo-1.6.8_p9-r1.ebuild, sudo-1.6.8_p9-r2.ebuild, sudo-1.6.8_p9.ebuild:
+ remove stale patches, files, ebuilds, etc.
21 Sep 2005; Tavis Ormandy <taviso@gentoo.org> sudo-1.6.8_p9-r2.ebuild:
fix #106765, sudo requires owner does not have write permission.
-MD5 9eb89c67b32298a4af16098d4c499d34 sudo-1.6.8_p9.ebuild 6054
-MD5 1830dd653b9b5b92fa5cc86823e06d65 sudo-1.6.7_p5-r2.ebuild 1438
-MD5 7ec8076c273c0ad66f4e51c8e675730e sudo-1.6.8_p9-r1.ebuild 6317
-MD5 bf08cb2f2ee015df5cfc2bb918f0e3a0 sudo-1.6.8_p9-r2.ebuild 6745
-MD5 3624ab301ad01188533bdb47b52c5df4 ChangeLog 10337
-MD5 02caf6e86d5e08fd89baccd299a0ee3c sudo-1.6.7_p5-r5.ebuild 1508
+MD5 f7258273dc788f3949cfab7e9b8d1cd6 sudo-1.6.8_p9.ebuild 6039
+MD5 36e7b0c41a2e3dd2013ce681cd82c25a sudo-1.6.8_p9-r2.ebuild 6746
+MD5 c970b9adbcebad2c86cbde484aa09ae3 ChangeLog 10741
MD5 4e3ab49065539b5aa4d3153261b5d687 metadata.xml 561
-MD5 a5463236fbb98e4ee6b1a0faba8c9c52 files/sudo 135
-MD5 ea5d9d51e647a2dbd410d952019ff19b files/digest-sudo-1.6.7_p5-r2 64
-MD5 ea5d9d51e647a2dbd410d952019ff19b files/digest-sudo-1.6.7_p5-r5 64
-MD5 6c08a6d5527a45278ebc165df7f0031d files/sudo-1.6.8_p8 223
-MD5 375b1725c7c89570ce74eba2a96b767d files/digest-sudo-1.6.8_p9-r1 64
+MD5 6c08a6d5527a45278ebc165df7f0031d files/sudo 223
MD5 375b1725c7c89570ce74eba2a96b767d files/digest-sudo-1.6.8_p9-r2 64
MD5 2a601951e4e5d6bdafc31b223737ddf5 files/sudo-ldap_timelimit.diff 2550
MD5 0b50aabedf9bb326893b5f1c333e46b2 files/sudo-skeychallengeargs.diff 567
MD5 59acf8b0292a8e60b5277b5dc952cfc4 files/sudoers 1645
-MD5 b906eb71f7564707384cfa9fc80c1b5f files/sudo-1.6.7_p5-strip-bash-functions.diff 1101
-MD5 b1fc3dd8440dc02690820c01190106a3 files/sudo-strip-shellopts.diff 316
-MD5 774b75e759fe13c7334c523b1db8ab2e files/sudo_include 67
MD5 4a46750ff53c19dbfed39d894dd6ff4d files/sudo-1.6.8_p8-ldap-tls_cacert.diff 542
-MD5 4362800877ccb8e27de5437707d8a954 files/sudo-strip-bash-functions.diff 1335
MD5 375b1725c7c89570ce74eba2a96b767d files/digest-sudo-1.6.8_p9 64
+++ /dev/null
-MD5 55d503e5c35bf1ea83d38244e0242aaf sudo-1.6.7p5.tar.gz 349785
+++ /dev/null
-MD5 55d503e5c35bf1ea83d38244e0242aaf sudo-1.6.7p5.tar.gz 349785
+++ /dev/null
-MD5 6d0346abd16914956bc7ea4f17fc85fb sudo-1.6.8p9.tar.gz 585509
#%PAM-1.0
-auth required /lib/security/pam_stack.so service=system-auth
-auth required /lib/security/pam_nologin.so
+auth required pam_stack.so service=system-auth
+account required pam_stack.so service=system-auth
+password required pam_stack.so service=system-auth
+session required pam_stack.so service=system-auth
+++ /dev/null
-diff -ruN sudo-1.6.7p5/env.c sudo-1.6.7p5.new/env.c
---- sudo-1.6.7p5/env.c 2003-05-06 05:32:22.000000000 +0100
-+++ sudo-1.6.7p5.new/env.c 2004-11-11 23:27:47.659539072 +0000
-@@ -296,7 +296,14 @@
- /* Pull in vars we want to keep from the old environment. */
- for (ep = envp; *ep; ep++) {
- keepit = 0;
-- for (cur = def_list(I_ENV_KEEP); cur; cur = cur->next) {
-+
-+ /* Skip variables with values beginning with () (bash functions) */
-+ if ((cp = strchr(*ep, '=')) != NULL) {
-+ if (strncmp(cp, "=() ", 3) == 0)
-+ continue;
-+ }
-+
-+ for (cur = def_list(I_ENV_KEEP); cur; cur = cur->next) {
- len = strlen(cur->value);
- /* Deal with '*' wildcard */
- if (cur->value[len - 1] == '*') {
-@@ -370,6 +377,12 @@
- for (ep = envp; *ep; ep++) {
- okvar = 1;
-
-+ /* Skip variables with values beginning with () (bash functions) */
-+ if ((cp = strchr(*ep, '=')) != NULL) {
-+ if (strncmp(cp, "=() ", 3) == 0)
-+ continue;
-+ }
-+
- /* Skip anything listed in env_delete. */
- for (cur = def_list(I_ENV_DELETE); cur && okvar; cur = cur->next) {
- len = strlen(cur->value);
+++ /dev/null
-#%PAM-1.0
-
-auth required pam_stack.so service=system-auth
-account required pam_stack.so service=system-auth
-password required pam_stack.so service=system-auth
-session required pam_stack.so service=system-auth
+++ /dev/null
-Index: env.c
-===================================================================
-RCS file: /home/cvs/courtesan/sudo/env.c,v
-retrieving revision 1.42
-retrieving revision 1.43
-diff -u -r1.42 -r1.43
---- env.c 8 Sep 2004 15:57:49 -0000 1.42
-+++ env.c 11 Nov 2004 16:20:59 -0000 1.43
-@@ -52,7 +52,7 @@
- #include "sudo.h"
-
- #ifndef lint
--static const char rcsid[] = "$Sudo: env.c,v 1.42 2004/09/08 15:57:49 millert Exp $";
-+static const char rcsid[] = "$Sudo: env.c,v 1.43 2004/11/11 16:20:59 millert Exp $";
- #endif /* lint */
-
- /*
-@@ -323,6 +323,13 @@
- /* Pull in vars we want to keep from the old environment. */
- for (ep = envp; *ep; ep++) {
- keepit = 0;
-+
-+ /* Skip variables with values beginning with () (bash functions) */
-+ if ((cp = strchr(*ep, '=')) != NULL) {
-+ if (strncmp(cp, "=() ", 3) == 0)
-+ continue;
-+ }
-+
- for (cur = def_env_keep; cur; cur = cur->next) {
- len = strlen(cur->value);
- /* Deal with '*' wildcard */
-@@ -404,6 +411,12 @@
- */
- for (ep = envp; *ep; ep++) {
- okvar = 1;
-+
-+ /* Skip variables with values beginning with () (bash functions) */
-+ if ((cp = strchr(*ep, '=')) != NULL) {
-+ if (strncmp(cp, "=() ", 3) == 0)
-+ continue;
-+ }
-
- /* Skip anything listed in env_delete. */
- for (cur = def_env_delete; cur && okvar; cur = cur->next) {
+++ /dev/null
-diff -ruN sudo-1.6.8p8.orig/env.c sudo-1.6.8p8/env.c
---- sudo-1.6.8p8.orig/env.c 2005-02-06 15:37:01.000000000 +0000
-+++ sudo-1.6.8p8/env.c 2005-06-05 20:51:21.798064512 +0100
-@@ -124,6 +124,7 @@
- "TERMCAP", /* XXX - only if it starts with '/' */
- "ENV",
- "BASH_ENV",
-+ "SHELLOPTS",
- NULL
- };
-
+++ /dev/null
-#%PAM-1.0
-
-auth include system-auth
-auth required pam_nologin.so
-
+++ /dev/null
-# Copyright 1999-2005 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.7_p5-r2.ebuild,v 1.14 2005/05/20 12:37:53 flameeyes Exp $
-
-inherit eutils pam
-
-#
-# TODO: Fix support for krb4 and krb5
-#
-
-DESCRIPTION="Allows certain users/groups to run commands as root"
-HOMEPAGE="http://www.sudo.ws/"
-SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${P/_/}.tar.gz"
-
-LICENSE="Sudo"
-SLOT="0"
-KEYWORDS="alpha amd64 arm hppa ia64 mips ppc ppc64 s390 sparc x86"
-IUSE="pam skey"
-
-DEPEND="pam? ( >=sys-libs/pam-0.73-r1 )
- skey? ( >=app-admin/skey-1.1.5-r1 )"
-
-S=${WORKDIR}/${P/_/}
-
-src_unpack() {
- unpack ${A}
- use skey && epatch ${FILESDIR}/${PN}-skeychallengeargs.diff
- epatch ${FILESDIR}/${P}-strip-bash-functions.diff
-}
-
-src_compile() {
- econf \
- --with-all-insults \
- --disable-path-info \
- --with-env-editor \
- $(use_with pam) \
- $(use_with skey) \
- || die "econf failed"
- emake || die
-}
-
-src_install() {
- einstall || die
- dodoc BUGS CHANGES HISTORY PORTING README RUNSON TODO \
- TROUBLESHOOTING UPGRADE sample.*
- dopamd ${FILESDIR}/sudo
-
- insinto /etc
- doins ${FILESDIR}/sudoers
- fperms 0440 /etc/sudoers
-}
-
-pkg_postinst() {
- use skey && use pam && {
- ewarn "sudo will not use skey authentication when compiled with"
- ewarn "pam support. to allow users to authenticate with one time"
- ewarn "passwords, you should unset the pam USE flag for sudo."
- }
-}
+++ /dev/null
-# Copyright 1999-2005 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.7_p5-r5.ebuild,v 1.1 2005/06/08 12:39:48 flameeyes Exp $
-
-inherit eutils pam
-
-#
-# TODO: Fix support for krb4 and krb5
-#
-
-DESCRIPTION="Allows certain users/groups to run commands as root"
-HOMEPAGE="http://www.sudo.ws/"
-SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${P/_/}.tar.gz"
-
-LICENSE="Sudo"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
-IUSE="pam skey"
-
-DEPEND="pam? ( virtual/pam )
- skey? ( >=app-admin/skey-1.1.5-r1 )"
-
-S=${WORKDIR}/${P/_/}
-
-src_unpack() {
- unpack ${A}; cd ${S}
- use skey && epatch ${FILESDIR}/${PN}-skeychallengeargs.diff
- epatch ${FILESDIR}/${P}-strip-bash-functions.diff
- epatch ${FILESDIR}/${PN}-strip-shellopts.diff
-}
-
-src_compile() {
- econf \
- --with-all-insults \
- --disable-path-info \
- --with-env-editor \
- $(use_with pam) \
- $(use_with skey) \
- || die "econf failed"
- emake || die
-}
-
-src_install() {
- einstall || die
- dodoc BUGS CHANGES HISTORY PORTING README RUNSON TODO \
- TROUBLESHOOTING UPGRADE sample.*
-
- newpamd ${FILESDIR}/sudo_include sudo
-
- insinto /etc
- doins ${FILESDIR}/sudoers
- fperms 0440 /etc/sudoers
-}
-
-pkg_postinst() {
- use skey && use pam && {
- ewarn "sudo will not use skey authentication when compiled with"
- ewarn "pam support. to allow users to authenticate with one time"
- ewarn "passwords, you should unset the pam USE flag for sudo."
- }
-}
+++ /dev/null
-# Copyright 1999-2005 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.8_p9-r1.ebuild,v 1.3 2005/07/08 03:01:14 vapier Exp $
-
-inherit eutils pam
-
-# TODO: Fix support for krb4 and krb5
-
-DESCRIPTION="Allows users or groups to run commands as other users"
-HOMEPAGE="http://www.sudo.ws/"
-SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${P/_/}.tar.gz"
-LICENSE="Sudo"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
-IUSE="pam skey offensive ldap"
-
-DEPEND="pam? ( || ( virtual/pam sys-libs/pam ) )
- ldap? ( >=net-nds/openldap-2.1.30-r1 )
- skey? ( >=app-admin/skey-1.1.5-r1 )
- sys-devel/bison
- virtual/mta"
-RDEPEND="${DEPEND} ldap? ( dev-lang/perl )"
-
-S=${WORKDIR}/${P/_/}
-
-src_unpack() {
- unpack ${A}; cd ${S}
-
- # compatability fix.
- epatch ${FILESDIR}/${PN}-skeychallengeargs.diff
-
- # make tls_cacert synonymous with tls_cacertfile.
- epatch ${FILESDIR}/${PN}-1.6.8_p8-ldap-tls_cacert.diff
-
- # additional variables to disallow, should user disable env_reset.
-
- # NOTE: this is not a supported mode of operation, these variables
- # are added to the blacklist as a convenience to administrators
- # who fail to heed the warnings of allowing untrusted users
- # to access sudo.
- #
- # there is *no possible way* to foresee all attack vectors in
- # all possible applications that could potentially be used via
- # sudo, these settings will just delay the inevitable.
- #
- # that said, I will accept suggestions for variables that can
- # be misused in _common_ interpreters or libraries, such as
- # perl, bash, python, ruby, etc., in the hope of dissuading
- # a casual attacker.
-
- # XXX: perl should be using suid_perl.
- # XXX: users can remove/add more via env_delete and env_check.
- # XXX: <?> = probably safe enough for most circumstances.
-
- einfo "Blacklisting common variables (env_delete)..."
- sudo_bad_var 'SHELLOPTS' # bash, change shoptions.
- sudo_bad_var 'PERLIO_DEBUG' # perl, write debug to file.
- sudo_bad_var 'PERL5LIB' # perl, change search path.
- sudo_bad_var 'PERLLIB' # perl, change search path.
-# sudo_bad_var 'PERL_HASH_SEED' # perl, change seed. <?>
-# sudo_bad_var 'PERL_HASH_SEED_DEBUG' # perl, disclose seed. <?>
-# sudo_bad_var 'PERL_SIGNALS' # perl, use deferred signals. <?>
- sudo_bad_var 'FPATH' # ksh, search path for functions.
- sudo_bad_var 'PS4' # sh, in case set -x is used. <?>
- sudo_bad_var 'NULLCMD' # zsh, command on null-redir. <?>
- sudo_bad_var 'READNULLCMD' # zsh, command on null-redir. <?>
-# sudo_bad_var 'TMPPREFIX' # zsh, prefix for tmp files. <?>
- sudo_bad_var 'GLOBIGNORE' # bash, glob paterns to ignore. <?>
- sudo_bad_var 'PERL5OPT' # perl, set options.
- sudo_bad_var 'PYTHONHOME' # python, module search path.
- sudo_bad_var 'PYTHONPATH' # python, search path.
- sudo_bad_var 'PYTHONINSPECT' # python, allow inspection.
- sudo_bad_var 'RUBYLIB' # ruby, lib load path.
- sudo_bad_var 'RUBYOPT' # ruby, cl options.
-# sudo_bad_var 'RUBYPATH' # ruby, script search path. <?>
- sudo_bad_var 'ZDOTDIR' # zsh, path to search for dotfiles.
- einfo "...done."
-
- # prevent binaries from being stripped.
- sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in
-}
-
-src_compile() {
- local line ROOTPATH
-
- # FIXME: secure_path is a compile time setting. using ROOTPATH
- # is not perfect, env-update may invalidate this, but until it
- # is available as a sudoers setting this will have to do.
- einfo "Setting secure_path..."
-
- # why not use grep? variable might be expanded from other variables
- # declared in that file. cannot just source the file, would override
- # any variables already set.
- eval `PS4= bash -x /etc/profile.env 2>&1 | \
- while read line; do
- case $line in
- ROOTPATH=*) echo $line; break;;
- *) continue;;
- esac
- done` && einfo " Found ROOTPATH..." || \
- ewarn " Failed to find ROOTPATH, please report this."
-
- # remove any duplicate entries
- ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}})
-
- einfo "...done."
-
- # XXX: --disable-path-info closes an info leak, but may be confusing.
- # XXX: /bin/vi may not be available, make nano visudo's default.
- econf --with-secure-path="${ROOTPATH}" \
- --with-editor=/bin/nano \
- --with-env-editor \
- $(use_with offensive insults) \
- $(use_with offensive all-insults) \
- $(use_with pam) \
- $(use_with skey) \
- $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \
- $(use_with ldap) || die
-
- # disallow lazy bindings
- emake SUDO_LDFLAGS="-Wl,-z,now" || die
-}
-
-src_install() {
- einstall || die
- dodoc BUGS CHANGES HISTORY PORTING README RUNSON TODO \
- TROUBLESHOOTING UPGRADE sample.*
-
- if use ldap; then
- dodoc README.LDAP
- dosbin sudoers2ldif
-
- printf "# See ldap.conf(5) for details\n" > ${T}/ldap.conf.sudo
- printf "# This file should only be readable by root\n\n" >> ${T}/ldap.conf.sudo
-
- insinto /etc
- doins ${T}/ldap.conf.sudo
- fperms 0440 /etc/ldap.conf.sudo
- fi
-
- if has_version virtual/pam; then
- pamd_mimic_system sudo auth account password session
- else
- newpamd ${FILESDIR}/sudo-1.6.8_p8 sudo
- fi
-
- insinto /etc
- doins ${FILESDIR}/sudoers
- fperms 0640 /etc/sudoers
-}
-
-# remove duplicate path entries from $1
-cleanpath() {
- local i=1 x n IFS=:
- local -a paths; paths=($1)
-
- for ((n=${#paths[*]}-1;i<=n;i++)); do
- for ((x=0;x<i;x++)); do
- test "${paths[i]}" == "${paths[x]}" && {
- einfo " Duplicate entry ${paths[i]} removed..." 1>&2
- unset paths[i]; continue 2; }
- done; # einfo " Adding ${paths[i]}..." 1>&2
- done; echo "${paths[*]}"
-}
-
-# add $1 to default env_delete list.
-sudo_bad_var() {
- local target='env.c' marker='\*initial_badenv_table\[\]'
-
- ebegin " $1"
- sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' ${S}/${target}
- eend $?
-}
-
-pkg_postinst() {
- use skey && use pam && {
- ewarn "sudo will not use skey authentication when compiled with"
- ewarn "pam support."
- ewarn "To allow users to authenticate with one time passwords,"
- ewarn "you should unset the pam USE flag for sudo."
- }
- use ldap && {
- ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration."
- }
-}
# Copyright 1999-2005 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.8_p9-r2.ebuild,v 1.5 2005/09/21 09:28:25 taviso Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.8_p9-r2.ebuild,v 1.6 2005/09/25 16:28:10 taviso Exp $
inherit eutils pam
ldap? ( >=net-nds/openldap-2.1.30-r1 )
skey? ( >=app-admin/skey-1.1.5-r1 )
sys-devel/bison
+ virtual/editor
virtual/mta"
RDEPEND="selinux? ( sec-policy/selinux-sudo )
ldap? ( dev-lang/perl )
if has_version virtual/pam; then
pamd_mimic_system sudo auth account password session
else
- newpamd ${FILESDIR}/sudo-1.6.8_p8 sudo
+ dopamd ${FILESDIR}/sudo
fi
insinto /etc
# Copyright 1999-2005 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.8_p9.ebuild,v 1.18 2005/07/08 03:01:14 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.8_p9.ebuild,v 1.19 2005/09/25 16:28:10 taviso Exp $
inherit eutils pam
if has_version virtual/pam; then
pamd_mimic_system sudo auth account password session
else
- newpamd ${FILESDIR}/sudo-1.6.8_p8 sudo
+ dopamd ${FILESDIR}/sudo
fi
insinto /etc
projects / gentoo.git / commitdiff