Version bump, thanks to all the people in bug #186836 for their patience. This also...

Package-Manager: portage-2.1.4.4

diff --git a/app-admin/sudo/ChangeLog b/app-admin/sudo/ChangeLog
index 30077242261ec81bb170cc08e2cd49050bdee9ea..a3e3b1518163cbde5d5b8d926fb60cd70f97fd52 100644 (file)
--- a/app-admin/sudo/ChangeLog
+++ b/app-admin/sudo/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-admin/sudo
-# Copyright 2002-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.108 2007/12/25 15:31:10 phreak Exp $
+# Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.109 2008/02/12 10:14:16 flameeyes Exp $
+
+*sudo-1.6.9_p12 (12 Feb 2008)
+
+  12 Feb 2008; Diego Pettenò <flameeyes@gentoo.org> metadata.xml,
+  +sudo-1.6.9_p12.ebuild:
+  Version bump, thanks to all the people in bug #186836 for their patience.
+  This also fixes bug #209801.
 
   25 Dec 2007; Christian Heim <phreak@gentoo.org> metadata.xml:
   Removing taviso from metadata.xml as per #202471. Assigning to

diff --git a/app-admin/sudo/Manifest b/app-admin/sudo/Manifest
index 04c1f306e7eefdbf42d38654ae48854565c46417..0827dfc73b4d37ffe991e4b9f8c0bfa43a6f65d6 100644 (file)
--- a/app-admin/sudo/Manifest
+++ b/app-admin/sudo/Manifest
@@ -1,3 +1,6 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
 AUX sudo 223 RMD160 4bc9a3e5d2dfd73bb1f14e5bad3b644ba80758d3 SHA1 fa6377c699ff2061c77cb87737fa2b4aaa8e8b9f SHA256 3f8dae2c663ed62bbe19e9b3e24f0e206fd1a4929bbafdff2e577e1aed9f2b58
 AUX sudo-1.6.8_p8-ldap-tls_cacert.diff 542 RMD160 cff54e31749796f732ce176b568797999325715e SHA1 3e7e493055998034d2b5a91160041e93d2246556 SHA256 2bc04b2b3ccd20f0ca545b74ca7ac68b708a1852af2fe2c620e78a92a45c2b23
 AUX sudo-ldap_timelimit.diff 2550 RMD160 b34a41e3fc4016ff182ed1800e0f1b0f82d3bfdf SHA1 c3c15eea9cf2e552010e27d0282246fa770d2fae SHA256 fc6eedb3435edbf5ccfcd5f62d8f31a78bf01afbb519c6b40bbe1329d82d6cea
@@ -6,10 +9,19 @@ AUX sudoers 1612 RMD160 f61c372791112feecae7e0a762a9aa9f30285099 SHA1 b27d644dcd
 DIST sudo-1.6.8p11.tar.gz 585581 RMD160 e7f5f1fe19309272a029c753e50b569d487d57f6 SHA1 ff3dd0d72cf7ae2eb72018bdb1327193927f3b39 SHA256 62727eb062c3d0fa3870f72fcbdaf596aa8f44f18eacc9e71fd200e87645d994
 DIST sudo-1.6.8p12.tar.gz 585643 RMD160 d7ff9f18ca0973615258c2e975300b94567451d5 SHA1 a79631e9e1c0d0d3f2aa88ae685628e5fde61982 SHA256 56f7d86032538a4a98d90af3742903a09ba16d6db82b593e4a47605f87fa581a
 DIST sudo-1.6.8p9.tar.gz 585509 RMD160 c1c719504476ab9ac11e0421716d149120463e33 SHA1 f264d1ad9f197920f2e69614db7935b35ca51672 SHA256 68f5b3e4f5572d816cf4d23616432286da7ba96ac58c17fef23046f12c88f440
+DIST sudo-1.6.9p12.tar.gz 581936 RMD160 fe07ead5c328b35fc0c84946d71469f4620ddd06 SHA1 c2b07c68d2026fb3e7786b2c9a8fb0c519a830f8 SHA256 d25c7a04f0db65c4a4e587df337fb6c4bd5165155d7ab64e8b00a89f745dd4aa
 EBUILD sudo-1.6.8_p11.ebuild 6630 RMD160 23d824e5739dbd7c99bd567bdfe0b5c2c796d27e SHA1 8dc5b6f0786c785d789bb3d5636212fcbdf8cfd5 SHA256 97f6f74ef5d6d3a1a186ecea2906ac74617b2b7ab1a988eeaadda07877748502
 EBUILD sudo-1.6.8_p12-r1.ebuild 6641 RMD160 923cb131aa1fca212341ac98ca24db702b780c1a SHA1 232fff5abe32dab0ef19df233964769788170839 SHA256 df6495f14957cb7870dedd90e6c4728666cc04e47e844221918b1e2f609b4c11
 EBUILD sudo-1.6.8_p12.ebuild 6317 RMD160 7671a399e6f857848210cc6d2e55d02fb8c5ea04 SHA1 980b51b5d51d8dc0a1327792d13a7fa22b858cfe SHA256 6a9431c37268f62aca08d8140816e7841a96f71be28eb19c1619782bb8739fb5
 EBUILD sudo-1.6.8_p9-r2.ebuild 6744 RMD160 622adfbb3f5a1a0db629b340f86ba6534f9a2019 SHA1 e0da67266bad7a3d5695c40813a36b219314be1b SHA256 864ee0e4ace78180be7f28888f967c497b93a84c9b691f3229806b562d92db53
 EBUILD sudo-1.6.8_p9.ebuild 6039 RMD160 392ed3c7a54af888a573141b56399b148e760738 SHA1 98d24b20af3af4e849135cd0c7f416080790787f SHA256 ea3fe473a8945516030cf6f6f5fa548265fa8398d6ebe7015f77410f94e63c82
-MISC ChangeLog 14167 RMD160 d9153390114b3c7fb1cd5af25b707e9eaa9fb64d SHA1 73da580077ee4608465c74a7d6a9541cea6655b5 SHA256 605cf96b1fff64cc7b20656767520a77c451cd7002f6681cb94fa32db70b530b
-MISC metadata.xml 492 RMD160 ab5be0f823eb52f06851dfd2ae248d2bb2dc2e10 SHA1 54a31cbf188dda11542aab591eb5c5ffd1b86a04 SHA256 e91330e0d55ca861dc3a461974fc747982c778b379a7fd6deadec3fe8ee73812
+EBUILD sudo-1.6.9_p12.ebuild 6071 RMD160 b2a050069f318600984157d039e3c86f38f9b6aa SHA1 8ac14446ffc10d8c919a61b9235994f045480eb6 SHA256 b929c6eb65ecd38d08ba8682e25c7c7a94357a6fc8d7c5705b4471b3804635df
+MISC ChangeLog 14402 RMD160 110a0a010506249abb720c330e6ba46bef94bee5 SHA1 10f36e04e43903b78d9d738a8aa48d69d4fdf29b SHA256 c3a7ce2210dda4dd0dd0b0b45e16d62c48835b00c45e722ddd976664b494215d
+MISC metadata.xml 501 RMD160 74dd36daa51d7ad5ce1659f0279e1245cd1ef4bc SHA1 e447d21dc61ee4a6de8cc0f66aa28aa422d9990a SHA256 5f399b83a90977486ff92847caa884d16f8b71705fd0d2203acb35f56c9a6db6
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.7 (GNU/Linux)
+
+iD8DBQFHsXF+AiZjviIA2XgRApmpAJ0fnzfjfIn47EHuS4gWHvERzuwAtgCghoMp
+Kdo1Mss26EwGNU+NWI26QqM=
+=dM3P
+-----END PGP SIGNATURE-----

diff --git a/app-admin/sudo/metadata.xml b/app-admin/sudo/metadata.xml
index 1d63e61faeaa4b2f1e51c59838bc4ba55e033111..8fe21e239221595a8f841b5468a03e28c7b978eb 100644 (file)
--- a/app-admin/sudo/metadata.xml
+++ b/app-admin/sudo/metadata.xml
@@ -1,13 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-       <herd>no-herd</herd>
-       <maintainer>
-               <email>maintainer-needed@gentoo.org</email>
-       </maintainer>
-       <longdescription lang="en">
-               Sudo (superuser do) allows a system administrator to give certain users
-               (or groups of users) the ability to run some (or all) commands as root
-               or another user while logging the commands and arguments.
-       </longdescription>
+  <herd>no-herd</herd>
+  <maintainer>
+    <email>flameeyes@gentoo.org</email>
+  </maintainer>
+  <longdescription lang="en">
+    Sudo (superuser do) allows a system administrator to give certain
+    users (or groups of users) the ability to run some (or all)
+    commands as root or another user while logging the commands and
+    arguments.
+  </longdescription>
 </pkgmetadata>

diff --git a/app-admin/sudo/sudo-1.6.9_p12.ebuild b/app-admin/sudo/sudo-1.6.9_p12.ebuild
new file mode 100644 (file)
index 0000000..23d519e
--- /dev/null
+++ b/app-admin/sudo/sudo-1.6.9_p12.ebuild
@@ -0,0 +1,192 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.9_p12.ebuild,v 1.1 2008/02/12 10:14:16 flameeyes Exp $
+
+inherit eutils pam flag-o-matic
+
+DESCRIPTION="Allows users or groups to run commands as other users"
+HOMEPAGE="http://www.sudo.ws/"
+SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${P/_/}.tar.gz"
+LICENSE="Sudo"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd"
+IUSE="pam skey offensive ldap selinux"
+
+DEPEND="pam? ( virtual/pam )
+       ldap? ( >=net-nds/openldap-2.1.30-r1 )
+       skey? ( >=app-admin/skey-1.1.5-r1 )
+       virtual/editor
+       virtual/mta"
+RDEPEND="selinux? ( sec-policy/selinux-sudo )
+       ldap? ( dev-lang/perl )
+       ${DEPEND}"
+DEPEND="${RDEPEND} sys-devel/bison"
+
+S=${WORKDIR}/${P/_/}
+
+src_unpack() {
+       unpack ${A}; cd "${S}"
+
+       # compatability fix.
+       epatch "${FILESDIR}"/${PN}-skeychallengeargs.diff
+
+       # additional variables to disallow, should user disable env_reset.
+
+       # NOTE: this is not a supported mode of operation, these variables
+       #       are added to the blacklist as a convenience to administrators
+       #       who fail to heed the warnings of allowing untrusted users
+       #       to access sudo.
+       #
+       #       there is *no possible way* to foresee all attack vectors in
+       #       all possible applications that could potentially be used via
+       #       sudo, these settings will just delay the inevitable.
+       #
+       #       that said, I will accept suggestions for variables that can
+       #       be misused in _common_ interpreters or libraries, such as
+       #       perl, bash, python, ruby, etc., in the hope of dissuading
+       #       a casual attacker.
+
+       # XXX: perl should be using suid_perl.
+       # XXX: users can remove/add more via env_delete and env_check.
+       # XXX: <?> = probably safe enough for most circumstances.
+
+       einfo "Blacklisting common variables (env_delete)..."
+               sudo_bad_var 'PERLIO_DEBUG'   # perl, write debug to file.
+               sudo_bad_var 'FPATH'          # ksh, search path for functions.
+               sudo_bad_var 'NULLCMD'        # zsh, command on null-redir. <?>
+               sudo_bad_var 'READNULLCMD'    # zsh, command on null-redir. <?>
+               sudo_bad_var 'GLOBIGNORE'     # bash, glob paterns to ignore. <?>
+               sudo_bad_var 'PYTHONHOME'     # python, module search path.
+               sudo_bad_var 'PYTHONPATH'     # python, search path.
+               sudo_bad_var 'PYTHONINSPECT'  # python, allow inspection.
+               sudo_bad_var 'RUBYLIB'        # ruby, lib load path.
+               sudo_bad_var 'RUBYOPT'        # ruby, cl options.
+               sudo_bad_var 'ZDOTDIR'        # zsh, path to search for dotfiles.
+       einfo "...done."
+
+       # prevent binaries from being stripped.
+       sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in
+
+       # remove useless c++ checks
+       epunt_cxx
+}
+
+src_compile() {
+       local line ROOTPATH
+
+       # FIXME: secure_path is a compile time setting. using ROOTPATH
+       # is not perfect, env-update may invalidate this, but until it
+       # is available as a sudoers setting this will have to do.
+       einfo "Setting secure_path..."
+
+               # why not use grep? variable might be expanded from other variables
+               # declared in that file. cannot just source the file, would override
+               # any variables already set.
+               eval `PS4= bash -x /etc/profile.env 2>&1 | \
+                       while read line; do
+                               case $line in
+                                       ROOTPATH=*) echo $line; break;;
+                                       *) continue;;
+                               esac
+                       done`  && einfo "       Found ROOTPATH..." || \
+                               ewarn " Failed to find ROOTPATH, please report this."
+
+               # remove any duplicate entries
+               ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}})
+
+               # strip gcc path (bug #136027)
+               rmpath ROOTPATH '*/gcc-bin/*'
+
+       einfo "...done."
+
+       # disallow lazy bindings
+       append-ldflags $(bindnow-flags)
+
+       # XXX: --disable-path-info closes an info leak, but may be confusing.
+       # XXX: /bin/vi may not be available, make nano visudo's default.
+       econf --with-secure-path="${ROOTPATH}" \
+               --with-editor=/bin/nano \
+               --with-env-editor \
+               $(use_with offensive insults) \
+               $(use_with offensive all-insults) \
+               $(use_with pam) \
+               $(use_with skey) \
+               $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \
+               $(use_with ldap) || die
+
+       emake || die
+}
+
+src_install() {
+       einstall || die
+       dodoc BUGS CHANGES HISTORY PORTING README \
+               TROUBLESHOOTING UPGRADE sample.*
+
+       if use ldap; then
+               dodoc README.LDAP
+               dosbin sudoers2ldif
+
+               cat - > "${T}"/ldap.conf.sudo <<EOF
+# See ldap.conf(5) and README.LDAP for details\n"
+# This file should only be readable by root\n\n"
+# supported directives: host, port, ssl, ldap_version\n"
+# uri, binddn, bindpw, sudoers_base, sudoers_debug\n"
+# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key
+EOF
+
+               insinto /etc
+               doins "${T}"/ldap.conf.sudo
+               fperms 0440 /etc/ldap.conf.sudo
+       fi
+
+       pamd_mimic_system sudo auth account password session
+
+       insinto /etc
+       doins "${FILESDIR}"/sudoers
+       fperms 0440 /etc/sudoers
+}
+
+# remove duplicate path entries from $1
+cleanpath() {
+       local i=1 x n IFS=:
+       local -a paths; paths=($1)
+
+       for ((n=${#paths[*]}-1;i<=n;i++)); do
+               for ((x=0;x<i;x++)); do
+                       test "${paths[i]}" == "${paths[x]}" && {
+                               einfo " Duplicate entry ${paths[i]} removed..." 1>&2
+                               unset paths[i]; continue 2; }
+               done; # einfo " Adding ${paths[i]}..." 1>&2
+       done; echo "${paths[*]}"
+}
+
+# add $1 to default env_delete list.
+sudo_bad_var() {
+       local target='env.c' marker='\*initial_badenv_table\[\]'
+
+       ebegin "        $1"
+               sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' "${S}"/${target}
+       eend $?
+}
+
+rmpath() {
+       declare e newpath oldpath=${!1} PATHvar=$1 thisp IFS=:
+       shift
+       for thisp in $oldpath; do
+               for e; do [[ $thisp == $e ]] && continue 2; done
+               newpath=$newpath:$thisp
+       done
+       eval $PATHvar='${newpath#:}'
+}
+
+pkg_postinst() {
+       use skey && use pam && {
+               ewarn "sudo will not use skey authentication when compiled with"
+               ewarn "pam support."
+               ewarn "To allow users to authenticate with one time passwords,"
+               ewarn "you should unset the pam USE flag for sudo."
+       }
+       use ldap && {
+               ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration."
+       }
+}