From: Tavis Ormandy Date: Sun, 6 Aug 2006 16:30:29 +0000 (+0000) Subject: clean gcc-bin from PATH. bug #136027 X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=9907762ce7c7c246a90fea23ba4ccca23c9fdf75;p=gentoo.git clean gcc-bin from PATH. bug #136027 Package-Manager: portage-2.0.51.22-r3 --- diff --git a/app-admin/sudo/ChangeLog b/app-admin/sudo/ChangeLog index ddfadf5f40c6..e1de2d59be4a 100644 --- a/app-admin/sudo/ChangeLog +++ b/app-admin/sudo/ChangeLog @@ -1,6 +1,11 @@ # ChangeLog for app-admin/sudo # Copyright 2002-2006 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.92 2006/04/27 09:17:10 antarus Exp $ +# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.93 2006/08/06 16:30:29 taviso Exp $ + +*sudo-1.6.8_p12-r1 (06 Aug 2006) + + 06 Aug 2006; Tavis Ormandy +sudo-1.6.8_p12-r1.ebuild: + clean gcc-bin from PATH. bug #136027 27 Apr 2006; Alec Warner files/digest-sudo-1.6.8_p9, files/digest-sudo-1.6.8_p9-r2, files/digest-sudo-1.6.8_p11, diff --git a/app-admin/sudo/Manifest b/app-admin/sudo/Manifest index 72d485e9a488..fa79e550c2c3 100644 --- a/app-admin/sudo/Manifest +++ b/app-admin/sudo/Manifest @@ -1,59 +1,17 @@ -AUX sudo 223 RMD160 4bc9a3e5d2dfd73bb1f14e5bad3b644ba80758d3 SHA1 fa6377c699ff2061c77cb87737fa2b4aaa8e8b9f SHA256 3f8dae2c663ed62bbe19e9b3e24f0e206fd1a4929bbafdff2e577e1aed9f2b58 size 223 -MD5 6c08a6d5527a45278ebc165df7f0031d files/sudo 223 -RMD160 4bc9a3e5d2dfd73bb1f14e5bad3b644ba80758d3 files/sudo 223 -SHA256 3f8dae2c663ed62bbe19e9b3e24f0e206fd1a4929bbafdff2e577e1aed9f2b58 files/sudo 223 -AUX sudo-1.6.8_p8-ldap-tls_cacert.diff 542 RMD160 cff54e31749796f732ce176b568797999325715e SHA1 3e7e493055998034d2b5a91160041e93d2246556 SHA256 2bc04b2b3ccd20f0ca545b74ca7ac68b708a1852af2fe2c620e78a92a45c2b23 size 542 -MD5 4a46750ff53c19dbfed39d894dd6ff4d files/sudo-1.6.8_p8-ldap-tls_cacert.diff 542 -RMD160 cff54e31749796f732ce176b568797999325715e files/sudo-1.6.8_p8-ldap-tls_cacert.diff 542 -SHA256 2bc04b2b3ccd20f0ca545b74ca7ac68b708a1852af2fe2c620e78a92a45c2b23 files/sudo-1.6.8_p8-ldap-tls_cacert.diff 542 -AUX sudo-ldap_timelimit.diff 2550 RMD160 b34a41e3fc4016ff182ed1800e0f1b0f82d3bfdf SHA1 c3c15eea9cf2e552010e27d0282246fa770d2fae SHA256 fc6eedb3435edbf5ccfcd5f62d8f31a78bf01afbb519c6b40bbe1329d82d6cea size 2550 -MD5 2a601951e4e5d6bdafc31b223737ddf5 files/sudo-ldap_timelimit.diff 2550 -RMD160 b34a41e3fc4016ff182ed1800e0f1b0f82d3bfdf files/sudo-ldap_timelimit.diff 2550 -SHA256 fc6eedb3435edbf5ccfcd5f62d8f31a78bf01afbb519c6b40bbe1329d82d6cea files/sudo-ldap_timelimit.diff 2550 -AUX sudo-skeychallengeargs.diff 567 RMD160 906ee43a7c2f21d1cf5130eac5c98ef0833154fd SHA1 b0efbedc72a1ed85c74ba10e343a68368e76c3e9 SHA256 dd2f4fdba26be6c3b4af15f3b6e18efa19375e1f9c579cdc2c76ee1adcce5e1d size 567 -MD5 0b50aabedf9bb326893b5f1c333e46b2 files/sudo-skeychallengeargs.diff 567 -RMD160 906ee43a7c2f21d1cf5130eac5c98ef0833154fd files/sudo-skeychallengeargs.diff 567 -SHA256 dd2f4fdba26be6c3b4af15f3b6e18efa19375e1f9c579cdc2c76ee1adcce5e1d files/sudo-skeychallengeargs.diff 567 -AUX sudoers 1645 RMD160 f8bf0fe8bd5d1f02cf62438871a1662ad40c9f6f SHA1 73faccf4baf8c136809b3f5c749997e2a16d5e6c SHA256 dfee348e1c5fc745656a24cb6f5e813a08e69e30a8ebf9b9a74a59cc36e5b7ea size 1645 -MD5 59acf8b0292a8e60b5277b5dc952cfc4 files/sudoers 1645 -RMD160 f8bf0fe8bd5d1f02cf62438871a1662ad40c9f6f files/sudoers 1645 -SHA256 dfee348e1c5fc745656a24cb6f5e813a08e69e30a8ebf9b9a74a59cc36e5b7ea files/sudoers 1645 -DIST sudo-1.6.8p11.tar.gz 585581 RMD160 e7f5f1fe19309272a029c753e50b569d487d57f6 SHA256 62727eb062c3d0fa3870f72fcbdaf596aa8f44f18eacc9e71fd200e87645d994 size 585581 -DIST sudo-1.6.8p12.tar.gz 585643 RMD160 d7ff9f18ca0973615258c2e975300b94567451d5 SHA256 56f7d86032538a4a98d90af3742903a09ba16d6db82b593e4a47605f87fa581a size 585643 -DIST sudo-1.6.8p9.tar.gz 585509 RMD160 c1c719504476ab9ac11e0421716d149120463e33 SHA256 68f5b3e4f5572d816cf4d23616432286da7ba96ac58c17fef23046f12c88f440 size 585509 -EBUILD sudo-1.6.8_p11.ebuild 6630 RMD160 23d824e5739dbd7c99bd567bdfe0b5c2c796d27e SHA1 8dc5b6f0786c785d789bb3d5636212fcbdf8cfd5 SHA256 97f6f74ef5d6d3a1a186ecea2906ac74617b2b7ab1a988eeaadda07877748502 size 6630 +MD5 5574c34c0d157ee03856a9d2c0cc2618 sudo-1.6.8_p9.ebuild 6039 +MD5 00f1341ced5d7899ede5f0b24f7bf59c sudo-1.6.8_p12-r1.ebuild 6600 MD5 e8bded4926bd49891b467c4f47a543bd sudo-1.6.8_p11.ebuild 6630 -RMD160 23d824e5739dbd7c99bd567bdfe0b5c2c796d27e sudo-1.6.8_p11.ebuild 6630 -SHA256 97f6f74ef5d6d3a1a186ecea2906ac74617b2b7ab1a988eeaadda07877748502 sudo-1.6.8_p11.ebuild 6630 -EBUILD sudo-1.6.8_p12.ebuild 6317 RMD160 7671a399e6f857848210cc6d2e55d02fb8c5ea04 SHA1 980b51b5d51d8dc0a1327792d13a7fa22b858cfe SHA256 6a9431c37268f62aca08d8140816e7841a96f71be28eb19c1619782bb8739fb5 size 6317 -MD5 a013f9b49f35837eeb31ed7654ac8542 sudo-1.6.8_p12.ebuild 6317 -RMD160 7671a399e6f857848210cc6d2e55d02fb8c5ea04 sudo-1.6.8_p12.ebuild 6317 -SHA256 6a9431c37268f62aca08d8140816e7841a96f71be28eb19c1619782bb8739fb5 sudo-1.6.8_p12.ebuild 6317 -EBUILD sudo-1.6.8_p9-r2.ebuild 6744 RMD160 622adfbb3f5a1a0db629b340f86ba6534f9a2019 SHA1 e0da67266bad7a3d5695c40813a36b219314be1b SHA256 864ee0e4ace78180be7f28888f967c497b93a84c9b691f3229806b562d92db53 size 6744 MD5 da0b502d6d0dd846ea363582e124b13d sudo-1.6.8_p9-r2.ebuild 6744 -RMD160 622adfbb3f5a1a0db629b340f86ba6534f9a2019 sudo-1.6.8_p9-r2.ebuild 6744 -SHA256 864ee0e4ace78180be7f28888f967c497b93a84c9b691f3229806b562d92db53 sudo-1.6.8_p9-r2.ebuild 6744 -EBUILD sudo-1.6.8_p9.ebuild 6039 RMD160 392ed3c7a54af888a573141b56399b148e760738 SHA1 98d24b20af3af4e849135cd0c7f416080790787f SHA256 ea3fe473a8945516030cf6f6f5fa548265fa8398d6ebe7015f77410f94e63c82 size 6039 -MD5 5574c34c0d157ee03856a9d2c0cc2618 sudo-1.6.8_p9.ebuild 6039 -RMD160 392ed3c7a54af888a573141b56399b148e760738 sudo-1.6.8_p9.ebuild 6039 -SHA256 ea3fe473a8945516030cf6f6f5fa548265fa8398d6ebe7015f77410f94e63c82 sudo-1.6.8_p9.ebuild 6039 -MISC ChangeLog 12321 RMD160 c094499c57f0b6668e1b4083c3cf0987a75c1b7a SHA1 b71897afbc4a6ef49a3a5f72badc6d395746ffb7 SHA256 79c5e7a97468140caa4d2b494f89f2b72091eaa8d890a29b8a25ad5281e221b5 size 12321 -MD5 0e7a81509faca3f27da1e1b3389d841b ChangeLog 12321 -RMD160 c094499c57f0b6668e1b4083c3cf0987a75c1b7a ChangeLog 12321 -SHA256 79c5e7a97468140caa4d2b494f89f2b72091eaa8d890a29b8a25ad5281e221b5 ChangeLog 12321 -MISC metadata.xml 561 RMD160 04a154038f02ff778d7f668490c262b240187904 SHA1 b02c76e80af1c07aed2293c90f1285edbef7de0b SHA256 d28efd1ec2116064d019539bebd0d6f8efbe7ed04c2ae5ddc99cbc8b6bef2495 size 561 +MD5 78a14890f8210e8ad5c9cd6f239fbaf5 ChangeLog 12470 MD5 4e3ab49065539b5aa4d3153261b5d687 metadata.xml 561 -RMD160 04a154038f02ff778d7f668490c262b240187904 metadata.xml 561 -SHA256 d28efd1ec2116064d019539bebd0d6f8efbe7ed04c2ae5ddc99cbc8b6bef2495 metadata.xml 561 +MD5 a013f9b49f35837eeb31ed7654ac8542 sudo-1.6.8_p12.ebuild 6317 +MD5 6c08a6d5527a45278ebc165df7f0031d files/sudo 223 +MD5 22f392e9685a8c5d5ef4667b7bb5d6ea files/digest-sudo-1.6.8_p9-r2 238 MD5 48ee541483ea602a42347d2f29879a68 files/digest-sudo-1.6.8_p11 241 -RMD160 36aee389af7e9835a5f34e5bec4916a63bbfdcd7 files/digest-sudo-1.6.8_p11 241 -SHA256 8a517f203317dd057fde477755fffca054cb666524ead9b1eea7aa7b3d6ffdc0 files/digest-sudo-1.6.8_p11 241 MD5 7b636eeeaa97990ecc5cd03fd171b207 files/digest-sudo-1.6.8_p12 241 -RMD160 33be8312a07a9e926e1bc227c922d6078b18de47 files/digest-sudo-1.6.8_p12 241 -SHA256 f3e327aa5ab8f92d8c3fd64df89d3d2cbde40e85e1d49873d03f105033755617 files/digest-sudo-1.6.8_p12 241 +MD5 2a601951e4e5d6bdafc31b223737ddf5 files/sudo-ldap_timelimit.diff 2550 +MD5 0b50aabedf9bb326893b5f1c333e46b2 files/sudo-skeychallengeargs.diff 567 +MD5 59acf8b0292a8e60b5277b5dc952cfc4 files/sudoers 1645 +MD5 373ed8a9aaca90a6c339c4749156a62c files/digest-sudo-1.6.8_p12-r1 65 +MD5 4a46750ff53c19dbfed39d894dd6ff4d files/sudo-1.6.8_p8-ldap-tls_cacert.diff 542 MD5 22f392e9685a8c5d5ef4667b7bb5d6ea files/digest-sudo-1.6.8_p9 238 -RMD160 0ee0d452db676cc2e3e21c2b18d5f2bfd0bd012c files/digest-sudo-1.6.8_p9 238 -SHA256 ffd8cbc37d836a37eb84dd49d7bc538df5a2a6b02972d5dd8f94d31496d109fa files/digest-sudo-1.6.8_p9 238 -MD5 22f392e9685a8c5d5ef4667b7bb5d6ea files/digest-sudo-1.6.8_p9-r2 238 -RMD160 0ee0d452db676cc2e3e21c2b18d5f2bfd0bd012c files/digest-sudo-1.6.8_p9-r2 238 -SHA256 ffd8cbc37d836a37eb84dd49d7bc538df5a2a6b02972d5dd8f94d31496d109fa files/digest-sudo-1.6.8_p9-r2 238 diff --git a/app-admin/sudo/files/digest-sudo-1.6.8_p12-r1 b/app-admin/sudo/files/digest-sudo-1.6.8_p12-r1 new file mode 100644 index 000000000000..b0063e9e1da9 --- /dev/null +++ b/app-admin/sudo/files/digest-sudo-1.6.8_p12-r1 @@ -0,0 +1 @@ +MD5 b29893c06192df6230dd5f340f3badf5 sudo-1.6.8p12.tar.gz 585643 diff --git a/app-admin/sudo/sudo-1.6.8_p12-r1.ebuild b/app-admin/sudo/sudo-1.6.8_p12-r1.ebuild new file mode 100644 index 000000000000..e6d6ede4e7f5 --- /dev/null +++ b/app-admin/sudo/sudo-1.6.8_p12-r1.ebuild @@ -0,0 +1,199 @@ +# Copyright 1999-2006 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.8_p12-r1.ebuild,v 1.1 2006/08/06 16:30:29 taviso Exp $ + +inherit eutils pam flag-o-matic + +# TODO: Fix support for krb4 and krb5 + +DESCRIPTION="Allows users or groups to run commands as other users" +HOMEPAGE="http://www.sudo.ws/" +SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${P/_/}.tar.gz" +LICENSE="Sudo" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd" +IUSE="pam skey offensive ldap selinux" + +DEPEND="pam? ( || ( virtual/pam sys-libs/pam ) ) + ldap? ( >=net-nds/openldap-2.1.30-r1 ) + skey? ( >=app-admin/skey-1.1.5-r1 ) + virtual/editor + virtual/mta" +RDEPEND="selinux? ( sec-policy/selinux-sudo ) + ldap? ( dev-lang/perl ) + ${DEPEND}" +DEPEND="${RDEPEND} sys-devel/bison" + +S=${WORKDIR}/${P/_/} + +src_unpack() { + unpack ${A}; cd ${S} + + # ldap failover patch + epatch ${FILESDIR}/${PN}-ldap_timelimit.diff + + # compatability fix. + epatch ${FILESDIR}/${PN}-skeychallengeargs.diff + + # make tls_cacert synonymous with tls_cacertfile. + epatch ${FILESDIR}/${PN}-1.6.8_p8-ldap-tls_cacert.diff + + # additional variables to disallow, should user disable env_reset. + + # NOTE: this is not a supported mode of operation, these variables + # are added to the blacklist as a convenience to administrators + # who fail to heed the warnings of allowing untrusted users + # to access sudo. + # + # there is *no possible way* to foresee all attack vectors in + # all possible applications that could potentially be used via + # sudo, these settings will just delay the inevitable. + # + # that said, I will accept suggestions for variables that can + # be misused in _common_ interpreters or libraries, such as + # perl, bash, python, ruby, etc., in the hope of dissuading + # a casual attacker. + + # XXX: perl should be using suid_perl. + # XXX: users can remove/add more via env_delete and env_check. + # XXX: = probably safe enough for most circumstances. + + einfo "Blacklisting common variables (env_delete)..." + sudo_bad_var 'PERLIO_DEBUG' # perl, write debug to file. + sudo_bad_var 'FPATH' # ksh, search path for functions. + sudo_bad_var 'NULLCMD' # zsh, command on null-redir. + sudo_bad_var 'READNULLCMD' # zsh, command on null-redir. +# sudo_bad_var 'TMPPREFIX' # zsh, prefix for tmp files. + sudo_bad_var 'GLOBIGNORE' # bash, glob paterns to ignore. + sudo_bad_var 'PYTHONHOME' # python, module search path. + sudo_bad_var 'PYTHONPATH' # python, search path. + sudo_bad_var 'PYTHONINSPECT' # python, allow inspection. + sudo_bad_var 'RUBYLIB' # ruby, lib load path. + sudo_bad_var 'RUBYOPT' # ruby, cl options. +# sudo_bad_var 'RUBYPATH' # ruby, script search path. + sudo_bad_var 'ZDOTDIR' # zsh, path to search for dotfiles. + einfo "...done." + + # prevent binaries from being stripped. + sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in +} + +src_compile() { + local line ROOTPATH + + # FIXME: secure_path is a compile time setting. using ROOTPATH + # is not perfect, env-update may invalidate this, but until it + # is available as a sudoers setting this will have to do. + einfo "Setting secure_path..." + + # why not use grep? variable might be expanded from other variables + # declared in that file. cannot just source the file, would override + # any variables already set. + eval `PS4= bash -x /etc/profile.env 2>&1 | \ + while read line; do + case $line in + ROOTPATH=*) echo $line; break;; + *) continue;; + esac + done` && einfo " Found ROOTPATH..." || \ + ewarn " Failed to find ROOTPATH, please report this." + + # remove any duplicate entries + ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}) + + # strip gcc path (bug #136027) + rmpath ROOTPATH '*/gcc-bin/*' + + einfo "...done." + + # XXX: --disable-path-info closes an info leak, but may be confusing. + # XXX: /bin/vi may not be available, make nano visudo's default. + econf --with-secure-path="${ROOTPATH}" \ + --with-editor=/bin/nano \ + --with-env-editor \ + $(use_with offensive insults) \ + $(use_with offensive all-insults) \ + $(use_with pam) \ + $(use_with skey) \ + $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \ + $(use_with ldap) || die + + # disallow lazy bindings + emake SUDO_LDFLAGS="$(bindnow-flags)" || die +} + +src_install() { + einstall || die + dodoc BUGS CHANGES HISTORY PORTING README RUNSON TODO \ + TROUBLESHOOTING UPGRADE sample.* + + if use ldap; then + dodoc README.LDAP + dosbin sudoers2ldif + + printf "# See ldap.conf(5) and README.LDAP for details\n" > ${T}/ldap.conf.sudo + printf "# This file should only be readable by root\n\n" >> ${T}/ldap.conf.sudo + printf "# supported directives: host, port, ssl, ldap_version\n" >> ${T}/ldap.conf.sudo + printf "# uri, binddn, bindpw, sudoers_base, sudoers_debug\n" >> ${T}/ldap.conf.sudo + printf "# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key}\n" >> ${T}/ldap.conf.sudo + + insinto /etc + doins ${T}/ldap.conf.sudo + fperms 0440 /etc/ldap.conf.sudo + fi + + if has_version virtual/pam; then + pamd_mimic_system sudo auth account password session + else + dopamd ${FILESDIR}/sudo + fi + + insinto /etc + doins ${FILESDIR}/sudoers + fperms 0440 /etc/sudoers +} + +# remove duplicate path entries from $1 +cleanpath() { + local i=1 x n IFS=: + local -a paths; paths=($1) + + for ((n=${#paths[*]}-1;i<=n;i++)); do + for ((x=0;x&2 + unset paths[i]; continue 2; } + done; # einfo " Adding ${paths[i]}..." 1>&2 + done; echo "${paths[*]}" +} + +# add $1 to default env_delete list. +sudo_bad_var() { + local target='env.c' marker='\*initial_badenv_table\[\]' + + ebegin " $1" + sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' ${S}/${target} + eend $? +} + +rmpath() { + declare e newpath oldpath=${!1} PATHvar=$1 thisp IFS=: + shift + for thisp in $oldpath; do + for e; do [[ $thisp == $e ]] && continue 2; done + newpath=$newpath:$thisp + done + eval $PATHvar='${newpath#:}' +} + +pkg_postinst() { + use skey && use pam && { + ewarn "sudo will not use skey authentication when compiled with" + ewarn "pam support." + ewarn "To allow users to authenticate with one time passwords," + ewarn "you should unset the pam USE flag for sudo." + } + use ldap && { + ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration." + } +}