From 3b2065d554ac511a2b0536159654fb8382f46015 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Mon, 20 Aug 2007 12:11:21 +0000
Subject: [PATCH 001/199] - upgrade to upstream release

---
 .cvsignore                                    |   2 +-
 sources                                       |   2 +-
 sudo-1.6.8p12-env-reset.patch                 |  17 -
 sudo-1.6.8p12-getgrouplist.patch              |  61 --
 sudo-1.6.8p12-ipv6.patch                      | 611 ------------------
 sudo-1.6.8p12-requiretty.patch                |  15 -
 sudo-1.6.8p8-pam-sess.patch                   |  32 -
 sudo-1.6.9p4-getgrouplist.patch               |  61 ++
 ...am-login.patch => sudo-1.6.9p4-login.patch | 162 ++---
 sudo.spec                                     |  38 +-
 10 files changed, 160 insertions(+), 841 deletions(-)
 delete mode 100644 sudo-1.6.8p12-env-reset.patch
 delete mode 100644 sudo-1.6.8p12-getgrouplist.patch
 delete mode 100644 sudo-1.6.8p12-ipv6.patch
 delete mode 100644 sudo-1.6.8p12-requiretty.patch
 delete mode 100644 sudo-1.6.8p8-pam-sess.patch
 create mode 100644 sudo-1.6.9p4-getgrouplist.patch
 rename sudo-1.6.8p12-pam-login.patch => sudo-1.6.9p4-login.patch (56%)

diff --git a/.cvsignore b/.cvsignore
index 5dec609..d497c72 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
-sudo-1.6.8p12.tar.gz
+sudo-1.6.9p4.tar.gz
 sudo-1.6.8p12-sudoers
diff --git a/sources b/sources
index e15700e..48eb9d9 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-b29893c06192df6230dd5f340f3badf5  sudo-1.6.8p12.tar.gz
+5439d24b48db69d2b6b42e97b47fdfd6  sudo-1.6.9p4.tar.gz
 3dad7cdd28925f9bdf387510961f8e9f  sudo-1.6.8p12-sudoers
diff --git a/sudo-1.6.8p12-env-reset.patch b/sudo-1.6.8p12-env-reset.patch
deleted file mode 100644
index 2bf6195..0000000
--- a/sudo-1.6.8p12-env-reset.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- sudo-1.6.8p12/sudoers.env_reset	2006-02-08 16:58:15.000000000 +0100
-+++ sudo-1.6.8p12/sudoers	2006-02-08 16:59:02.000000000 +0100
-@@ -13,6 +13,14 @@
- 
- # Defaults specification
- 
-+Defaults    env_reset
-+Defaults    env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
-+                        LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
-+                        LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
-+                        LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
-+                        LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
-+                        _XKB_CHARSET"
-+
- # Runas alias specification
- 
- # User privilege specification
diff --git a/sudo-1.6.8p12-getgrouplist.patch b/sudo-1.6.8p12-getgrouplist.patch
deleted file mode 100644
index 998bf15..0000000
--- a/sudo-1.6.8p12-getgrouplist.patch
+++ /dev/null
@@ -1,61 +0,0 @@
---- sudo-1.6.8p12/configure.in.getgrouplist	2007-04-12 10:16:12.000000000 +0200
-+++ sudo-1.6.8p12/configure.in	2007-04-12 10:18:16.000000000 +0200
-@@ -1694,7 +1694,7 @@
- dnl Function checks
- dnl
- AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
--	       strftime setrlimit initgroups fstat gettimeofday)
-+	       strftime setrlimit initgroups getgrouplist fstat gettimeofday)
- AC_CHECK_FUNCS(seteuid, , [AC_DEFINE(NO_SAVED_IDS)])
- if test -z "$SKIP_SETRESUID"; then
-     AC_CHECK_FUNCS(setresuid, [SKIP_SETREUID=yes])
---- sudo-1.6.8p12/configure.getgrouplist	2005-10-28 02:48:25.000000000 +0200
-+++ sudo-1.6.8p12/configure	2007-04-12 10:18:16.000000000 +0200
-@@ -24677,7 +24677,7 @@
- 
- 
- for ac_func in strchr strrchr memchr memcpy memset sysconf tzset \
--	       strftime setrlimit initgroups fstat gettimeofday
-+	       strftime setrlimit initgroups getgrouplist fstat gettimeofday
- do
- as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
- echo "$as_me:$LINENO: checking for $ac_func" >&5
---- sudo-1.6.8p12/check.c.getgrouplist	2005-03-25 02:55:31.000000000 +0100
-+++ sudo-1.6.8p12/check.c	2007-04-12 10:18:16.000000000 +0200
-@@ -299,6 +299,24 @@
- 	    return(TRUE);
-     }
- 
-+#ifdef HAVE_GETGROUPLIST
-+    {
-+	gid_t *grouplist, grouptmp;
-+	int n_groups, i;
-+	n_groups = 1;
-+	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
-+	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
-+	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
-+		for (i = 0; i < n_groups; i++)
-+		    if (grouplist[i] == grp->gr_gid) {
-+			free(grouplist);
-+			return(TRUE);
-+		    }
-+	    free(grouplist);
-+	}
-+    }
-+#endif
-+
-     return(FALSE);
- }
- 
---- sudo-1.6.8p12/config.h.in.getgrouplist	2007-04-12 10:16:12.000000000 +0200
-+++ sudo-1.6.8p12/config.h.in	2007-04-12 10:18:16.000000000 +0200
-@@ -122,6 +122,9 @@
- /* Define to 1 if you have the `getdomainname' function. */
- #undef HAVE_GETDOMAINNAME
- 
-+/* Define to 1 if you have the `getgrouplist' function. */
-+#undef HAVE_GETGROUPLIST
-+
- /* Define to 1 if you have the `getifaddrs' function. */
- #undef HAVE_GETIFADDRS
- 
diff --git a/sudo-1.6.8p12-ipv6.patch b/sudo-1.6.8p12-ipv6.patch
deleted file mode 100644
index bf0ec83..0000000
--- a/sudo-1.6.8p12-ipv6.patch
+++ /dev/null
@@ -1,611 +0,0 @@
---- sudo-1.6.8p12/Makefile.in.ipv6	2005-11-08 19:21:58.000000000 +0100
-+++ sudo-1.6.8p12/Makefile.in	2006-07-16 23:33:58.000000000 +0200
-@@ -187,14 +187,14 @@
- @DEV@PARSESRCS = sudo.tab.h sudo.tab.c lex.yy.c def_data.c def_data.h
- 
- # Uncomment the following if you intend to modify parse.yacc
--@DEV@sudo.tab.c sudo.tab.h: parse.yacc
--@DEV@	rm -f sudo.tab.h sudo.tab.c
--@DEV@	$(YACC) -d -b sudo $(srcdir)/parse.yacc
-+sudo.tab.c sudo.tab.h: parse.yacc
-+	rm -f sudo.tab.h sudo.tab.c
-+	$(YACC) -d -b sudo $(srcdir)/parse.yacc
- 
- # Uncomment the following if you intend to modify parse.lex
--@DEV@lex.yy.c: parse.lex
--@DEV@	rm -f lex.yy.c
--@DEV@	$(LEX) $(srcdir)/parse.lex
-+lex.yy.c: parse.lex
-+	rm -f lex.yy.c
-+	$(LEX) $(srcdir)/parse.lex
- 
- # Uncomment the following if you intend to modify def_data.in
- @DEV@def_data.h def_data.c: def_data.in
---- sudo-1.6.8p12/visudo.c.ipv6	2004-11-25 18:32:40.000000000 +0100
-+++ sudo-1.6.8p12/visudo.c	2006-07-16 23:33:58.000000000 +0200
-@@ -87,6 +87,7 @@
- static int check_syntax		__P((int));
- int command_matches		__P((char *, char *));
- int addr_matches		__P((char *));
-+int addr6_matches		__P((char *));
- int hostname_matches		__P((char *, char *, char *));
- int netgr_matches		__P((char *, char *, char *, char *));
- int usergr_matches		__P((char *, char *, struct passwd *));
-@@ -515,6 +516,12 @@
-     return(TRUE);
- }
- 
-+int addr6_matches(n)
-+    char *n;
-+{
-+    return(TRUE);
-+}
-+
- int
- hostname_matches(s, l, p)
-     char *s, *l, *p;
---- sudo-1.6.8p12/parse.lex.ipv6	2004-05-17 22:51:13.000000000 +0200
-+++ sudo-1.6.8p12/parse.lex	2006-07-16 23:33:58.000000000 +0200
-@@ -84,6 +84,29 @@
- 
- OCTET			(1?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5])
- DOTTEDQUAD		{OCTET}(\.{OCTET}){3}
-+
-+IPV6_8HEX               ([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}
-+
-+IPV6_COMP0              :(:[0-9A-Fa-f]{1,4}){1,7}
-+IPV6_COMP1              ([0-9A-Fa-f]{1,4}){1}:(:[0-9A-Fa-f]{1,4}){0,6}
-+IPV6_COMP2              ([0-9A-Fa-f]{1,4}){2}:(:[0-9A-Fa-f]{1,4}){0,5}
-+IPV6_COMP3              ([0-9A-Fa-f]{1,4}){3}:(:[0-9A-Fa-f]{1,4}){0,4}
-+IPV6_COMP4		([0-9A-Fa-f]{1,4}){4}:(:[0-9A-Fa-f]{1,4}){0,3}
-+IPV6_COMP5              ([0-9A-Fa-f]{1,4}){5}:(:[0-9A-Fa-f]{1,4}){0,2}
-+IPV6_COMP6              ([0-9A-Fa-f]{1,4}){6}:(:[0-9A-Fa-f]{1,4}){0,1}
-+IPV6_COMPHEX            {IPV6_COMP0}|{IPV6_COMP1}|{IPV6_COMP2}|{IPV6_COMP3}|{IPV6_COMP4}|{IPV6_COMP5}|{IPV6_COMP6}
-+
-+IPV6_6H4D               [0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4}){5}{DOTTEDQUAD}
-+
-+IPV6_COMP6H4D0          ([0-9A-Fa-f]{1,4}){1}:(:[0-9A-Fa-f]{1,4}){1,4}:{DOTTEDQUAD}
-+IPV6_COMP6H4D1          ([0-9A-Fa-f]{1,4}){2}:(:[0-9A-Fa-f]{1,4}){1,3}:{DOTTEDQUAD}
-+IPV6_COMP6H4D2          ([0-9A-Fa-f]{1,4}){3}:(:[0-9A-Fa-f]{1,4}){1,2}:{DOTTEDQUAD}
-+IPV6_COMP6H4D3          ([0-9A-Fa-f]{1,4}){4}:(:[0-9A-Fa-f]{1,4}){1}:{DOTTEDQUAD}
-+IPV6_COMP6H4D           {IPV6_COMP6H4D0}|{IPV6_COMP6H4D1}|{IPV6_COMP6H4D2}|{IPV6_COMP6H4D3}
-+
-+IPV6ADDR                {IPV6_8HEX}|{IPV6_COMPHEX}|{IPV6_6H4D}|{IPV6_COMP6H4D}
-+IPV6PREFIX		[1-9]|[1-9][0-9]|10[0-9]|11[0-9]|12[0-8]
-+
- HOSTNAME		[[:alnum:]_-]+
- WORD			([^#>@!=:,\(\) \t\n\\]|\\[^\n])+
- ENVAR			([^#!=, \t\n\\]|\\[^\n])([^#=, \t\n\\]|\\[^\n])*
-@@ -253,6 +276,11 @@
- 			    LEXTRACE("NTWKADDR ");
- 			    return(NTWKADDR);
- 			}
-+{IPV6ADDR}(\/{IPV6PREFIX})? {
-+			    fill(yytext, yyleng);
-+                            LEXTRACE("NTWKADDR6 ");
-+                            return(NTWKADDR6);
-+			}
- 
- <INITIAL>\(		{
- 				BEGIN GOTRUNAS;
---- sudo-1.6.8p12/ldap.c.ipv6	2006-07-16 23:45:35.000000000 +0200
-+++ sudo-1.6.8p12/ldap.c	2006-07-16 23:59:56.000000000 +0200
-@@ -160,6 +160,7 @@
-     if (
-          !strcasecmp(*p,"ALL") ||
-          addr_matches(*p) ||
-+         addr6_matches(*p) ||
-          netgr_matches(*p,user_host,user_shost,NULL) ||
-          !hostname_matches(user_shost,user_host,*p)
-        )
---- sudo-1.6.8p12/parse.h.ipv6	2005-06-19 20:58:19.000000000 +0200
-+++ sudo-1.6.8p12/parse.h	2006-07-16 23:33:58.000000000 +0200
-@@ -93,6 +93,7 @@
-  * Prototypes
-  */
- int addr_matches	__P((char *));
-+int addr6_matches	__P((char *));
- int command_matches	__P((char *, char *));
- int hostname_matches	__P((char *, char *, char *));
- int netgr_matches	__P((char *, char *, char *, char *));
---- sudo-1.6.8p12/interfaces.h.ipv6	2004-02-13 22:36:43.000000000 +0100
-+++ sudo-1.6.8p12/interfaces.h	2006-07-16 23:33:58.000000000 +0200
-@@ -27,8 +27,11 @@
-  * IP address and netmask pairs for checking against local interfaces.
-  */
- struct interface {
--    struct in_addr addr;
-+    struct in_addr addr;	/* IPv4 */
-     struct in_addr netmask;
-+    struct in6_addr addr6;	/* IPv6 */
-+    struct in6_addr netmask6;
-+    sa_family_t sa_family;	/* AF_INET ? AF_INET6 */
- };
- 
- /*
---- sudo-1.6.8p12/parse.c.ipv6	2005-06-19 22:03:24.000000000 +0200
-+++ sudo-1.6.8p12/parse.c	2006-07-16 23:57:20.000000000 +0200
-@@ -370,38 +370,134 @@
-     int i;
-     char *m;
-     struct in_addr addr, mask;
-+    struct addrinfo hints, *ai;
-+
-+    memset(&hints, '\0', sizeof(hints));
-+    hints.ai_flags = AI_ADDRCONFIG | AI_NUMERICHOST;
-+    hints.ai_family = AF_INET;
- 
-     /* If there's an explicit netmask, use it. */
-     if ((m = strchr(n, '/'))) {
-+
- 	*m++ = '\0';
--	addr.s_addr = inet_addr(n);
-+	if (getaddrinfo(n, NULL, &hints, &ai)!=0)
-+	    return(FALSE);
-+	memcpy(&addr.s_addr, &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
-+		  sizeof(struct in_addr));
-+	freeaddrinfo(ai);
-+
- 	if (strchr(m, '.'))
--	    mask.s_addr = inet_addr(m);
--	else {
--	    i = 32 - atoi(m);
--	    mask.s_addr = 0xffffffff;
--	    mask.s_addr >>= i;
--	    mask.s_addr <<= i;
--	    mask.s_addr = htonl(mask.s_addr);
-+	{
-+	    if (getaddrinfo(m, NULL, &hints, &ai)!=0)
-+		return(FALSE);
-+	    memcpy(&mask.s_addr,    /* IPv4 netmask from dotted quad */
-+			&((struct sockaddr_in *)ai->ai_addr)->sin_addr,
-+			sizeof(struct in_addr));
- 	}
-+       	else
-+       	{
-+       	    i = 32 - atoi(m);	/* IPv4 netmask from CIDR */
-+       	    mask.s_addr = 0xffffffff;
-+       	    mask.s_addr >>= i;
-+            mask.s_addr <<= i;
-+       	    mask.s_addr = htonl(mask.s_addr);
-+       	}
-+
- 	*(m - 1) = '/';
- 
--	for (i = 0; i < num_interfaces; i++)
--	    if ((interfaces[i].addr.s_addr & mask.s_addr) == addr.s_addr)
--		return(TRUE);
-+	for (i = 0; i <  num_interfaces; ++i)
-+	    if (interfaces[i].sa_family == AF_INET)	/* IPv4 intf. only */
-+		if ((interfaces[i].addr.s_addr & mask.s_addr) == addr.s_addr)
-+		    return (TRUE);
-     } else {
--	addr.s_addr = inet_addr(n);
-+	if (getaddrinfo(n, NULL, &hints, &ai)!=0)
-+	    return(FALSE);
-+        memcpy(&addr.s_addr, &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
-+                  sizeof(struct in_addr));
-+	freeaddrinfo(ai);
- 
- 	for (i = 0; i < num_interfaces; i++)
--	    if (interfaces[i].addr.s_addr == addr.s_addr ||
--		(interfaces[i].addr.s_addr & interfaces[i].netmask.s_addr)
--		== addr.s_addr)
--		return(TRUE);
-+	    if (interfaces[i].sa_family == AF_INET)     /* IPv4 intf. only */
-+	        if (interfaces[i].addr.s_addr == addr.s_addr ||
-+	            (interfaces[i].addr.s_addr & interfaces[i].netmask.s_addr)
-+			 == addr.s_addr)
-+		    return(TRUE);
-     }
- 
-     return(FALSE);
- }
- 
-+int
-+addr6_matches(n)
-+char *n;
-+{
-+    int i, j;
-+    uint32_t msk[4] = {0, 0, 0, 0};	/* 32x4 */
-+    uint32_t addr[4], i_msk[4], i_addr[4];
-+    char *m;
-+    struct addrinfo hints, *ai;
-+
-+    memset(&hints, '\0', sizeof(hints));
-+    hints.ai_flags = AI_ADDRCONFIG | AI_NUMERICHOST;
-+    hints.ai_family = AF_INET6;
-+	
-+    /* we have IPv6 prefix */
-+    if ((m = strchr(n, '/'))) {
-+	*m++ = '\0';
-+	if (getaddrinfo(n, NULL, &hints, &ai)!=0)
-+            return(FALSE);
-+	memcpy(&addr, &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr, 16);
-+	freeaddrinfo(ai);
-+
-+	for (i=0; i < (atoi(m)/32); ++i)
-+	    msk[i] = 0xffffffff;
-+	if (atoi(m)<128 && (atoi(m) % 32))
-+	{
-+	    msk[atoi(m)/32] = 0xffffffff;
-+	    msk[atoi(m)/32] >>= ( 32 - (atoi(m) % 32) );
-+	    msk[atoi(m)/32] <<= ( 32 - (atoi(m) % 32) );
-+	}
-+	for (i=0; i<4; ++i)
-+	    msk[i] = htonl(msk[i]);
-+	
-+	*(m - 1) = '/';
-+	
-+	for (i=0; i < num_interfaces; i++)
-+	    if (interfaces[i].sa_family == AF_INET6)	/* compare only IPv6 intf. */
-+	    {
-+		/* nasty */
-+	        memcpy(&i_addr, &interfaces[i].addr6, 16);
-+		if ( ((i_addr[0] & msk[0]) == addr[0]) &&
-+		     ((i_addr[1] & msk[1]) == addr[1]) &&
-+		     ((i_addr[2] & msk[2]) == addr[2]) &&
-+		     ((i_addr[3] & msk[3]) == addr[3]))
-+		    return(TRUE);
-+	    }	     
-+    } else {
-+        if (getaddrinfo(n, NULL, &hints, &ai)!=0)
-+	    return(FALSE);
-+        memcpy(&addr, &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr, 16);
-+        freeaddrinfo(ai);
-+
-+	for (i=0; i < num_interfaces; ++i)
-+	    if (interfaces[i].sa_family == AF_INET6) /* IPv6 intf. only */
-+	    {
-+	        memcpy(&i_addr, &interfaces[i].addr6, 16);
-+		if ((i_addr[0] == addr[0]) && (i_addr[1] == addr[1]) &&
-+		    (i_addr[2] == addr[2]) && (i_addr[3] == addr[3]))
-+		    return(TRUE); /* found my own address in sudoers */
-+
-+		memcpy(&i_msk, &interfaces[i].netmask6, 16);
-+		if (((i_addr[0]&i_msk[0]) == addr[0]) &&
-+		    ((i_addr[1]&i_msk[1]) == addr[1]) &&
-+		    ((i_addr[2]&i_msk[2]) == addr[2]) &&
-+		    ((i_addr[3]&i_msk[3]) == addr[3]))
-+		    return(TRUE); /* found my netw. address in sudoers */
-+	    }
-+    }
-+    return(FALSE);
-+}
-+
- /*
-  * Returns 0 if the hostname matches the pattern and non-zero otherwise.
-  */
---- sudo-1.6.8p12/sudo.c.ipv6	2006-07-16 23:33:58.000000000 +0200
-+++ sudo-1.6.8p12/sudo.c	2006-07-16 23:33:58.000000000 +0200
-@@ -1007,24 +1007,34 @@
- void
- set_fqdn()
- {
--    struct hostent *hp;
-+    struct addrinfo hints, *ai;
-     char *p;
- 
--    if (!(hp = gethostbyname(user_host))) {
--	log_error(MSG_ONLY|NO_EXIT,
--	    "unable to lookup %s via gethostbyname()", user_host);
--    } else {
--	if (user_shost != user_host)
-+    memset(&hints, '\0', sizeof(hints));
-+    hints.ai_flags = AI_ADDRCONFIG;
-+    
-+    if (getaddrinfo(user_host, NULL, &hints, &ai) != 0)
-+    {
-+        log_error(MSG_ONLY|NO_EXIT,
-+		"unable to lookup %s via gethostbyname()", user_host);
-+    }
-+    else
-+    {
-+	char h_name[NI_MAXHOST];
-+
-+        if (user_host != user_host)
- 	    free(user_shost);
-+
-+	getnameinfo(ai->ai_addr, ai->ai_addrlen, h_name, sizeof(h_name), NULL, 0, 0);
- 	free(user_host);
--	user_host = estrdup(hp->h_name);
-+	user_host = estrdup(h_name);
-     }
-     if ((p = strchr(user_host, '.'))) {
--	*p = '\0';
--	user_shost = estrdup(user_host);
--	*p = '.';
-+        *p = '\0';
-+        user_shost = estrdup(user_host);
-+        *p = '.';
-     } else {
--	user_shost = user_host;
-+        user_shost = user_host;
-     }
- }
- 
---- sudo-1.6.8p12/parse.yacc.ipv6	2005-06-19 20:24:32.000000000 +0200
-+++ sudo-1.6.8p12/parse.yacc	2006-07-16 23:33:58.000000000 +0200
-@@ -250,6 +250,7 @@
- %token <tok>	 RUNASALIAS		/* Runas_Alias keyword */
- %token <tok>	 ':' '=' ',' '!' '+' '-' /* union member tokens */
- %token <tok>	 ERROR
-+%token <string>  NTWKADDR6		/* IPv6 address */
- 
- /*
-  * NOTE: these are not true booleans as there are actually 4 possible values:
-@@ -395,6 +396,13 @@
- 				$$ = NOMATCH;
- 			    free($1);
- 			}
-+		|	NTWKADDR6 {
-+			    if (addr6_matches($1))
-+				$$ = TRUE;
-+			    else
-+				$$ = NOMATCH;
-+			    free($1);
-+			}
- 		|	NETGROUP {
- 			    if (netgr_matches($1, user_host, user_shost, NULL))
- 				$$ = TRUE;
---- sudo-1.6.8p12/testsudoers.c.ipv6	2004-08-02 20:44:58.000000000 +0200
-+++ sudo-1.6.8p12/testsudoers.c	2006-07-17 00:03:50.000000000 +0200
-@@ -175,6 +175,10 @@
-     }
- }
- 
-+/*
-+ * Returns TRUE if "n" is one of our ip addresses or if
-+ * "n" is a network that we are on, else returns FALSE.
-+ */
- int
- addr_matches(n)
-     char *n;
-@@ -182,39 +186,136 @@
-     int i;
-     char *m;
-     struct in_addr addr, mask;
-+    struct addrinfo hints, *ai;
-+
-+    memset(&hints, '\0', sizeof(hints));
-+    hints.ai_flags = AI_ADDRCONFIG | AI_NUMERICHOST;
-+    hints.ai_family = AF_INET;
- 
-     /* If there's an explicit netmask, use it. */
-     if ((m = strchr(n, '/'))) {
--	*m++ = '\0';
--	addr.s_addr = inet_addr(n);
--	if (strchr(m, '.'))
--	    mask.s_addr = inet_addr(m);
--	else {
--	    i = 32 - atoi(m);
--	    mask.s_addr = 0xffffffff;
--	    mask.s_addr >>= i;
--	    mask.s_addr <<= i;
--	    mask.s_addr = htonl(mask.s_addr);
--	}
--	*(m - 1) = '/';
- 
--	for (i = 0; i < num_interfaces; i++)
--	    if ((interfaces[i].addr.s_addr & mask.s_addr) == addr.s_addr)
--		return(TRUE);
-+        *m++ = '\0';
-+        if (getaddrinfo(n, NULL, &hints, &ai)!=0)
-+	    return(FALSE);
-+        memcpy(&addr.s_addr, &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
-+                  sizeof(struct in_addr));
-+        freeaddrinfo(ai);
-+
-+        if (strchr(m, '.'))
-+        {
-+            if (getaddrinfo(m, NULL, &hints, &ai)!=0)
-+		return(FALSE);
-+            memcpy(&mask.s_addr,    /* IPv4 netmask from dotted quad */
-+                        &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
-+                        sizeof(struct in_addr));
-+        }
-+        else
-+        {
-+            i = 32 - atoi(m);   /* IPv4 netmask from CIDR */
-+            mask.s_addr = 0xffffffff;
-+            mask.s_addr >>= i;
-+            mask.s_addr <<= i;
-+            mask.s_addr = htonl(mask.s_addr);
-+        }
-+
-+        *(m - 1) = '/';
-+
-+        for (i = 0; i <  num_interfaces; ++i)
-+            if (interfaces[i].sa_family == AF_INET)     /* IPv4 intf. only */
-+                if ((interfaces[i].addr.s_addr & mask.s_addr) == addr.s_addr)
-+                    return(TRUE);
-     } else {
--	addr.s_addr = inet_addr(n);
--
--	for (i = 0; i < num_interfaces; i++)
--	    if (interfaces[i].addr.s_addr == addr.s_addr ||
--		(interfaces[i].addr.s_addr & interfaces[i].netmask.s_addr)
--		== addr.s_addr)
--		return(TRUE);
-+        if (getaddrinfo(n, NULL, &hints, &ai)!=0)
-+	    return(FALSE);
-+        memcpy(&addr.s_addr, &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
-+                  sizeof(struct in_addr));
-+        freeaddrinfo(ai);
-+
-+        for (i = 0; i < num_interfaces; i++)
-+            if (interfaces[i].sa_family == AF_INET)     /* IPv4 intf. only */
-+                if (interfaces[i].addr.s_addr == addr.s_addr ||
-+                    (interfaces[i].addr.s_addr & interfaces[i].netmask.s_addr)
-+                         == addr.s_addr)
-+                    return(TRUE);
-     }
- 
-     return(FALSE);
- }
- 
- int
-+addr6_matches(n)
-+char *n;
-+{
-+    int i, j;
-+    uint32_t msk[4] = {0, 0, 0, 0};     /* 32x4 */
-+    uint32_t addr[4], i_msk[4], i_addr[4];
-+    char *m;
-+    struct addrinfo hints, *ai;
-+
-+    memset(&hints, '\0', sizeof(hints));
-+    hints.ai_flags = AI_ADDRCONFIG | AI_NUMERICHOST;
-+    hints.ai_family = AF_INET6;
-+
-+    /* we have IPv6 prefix */
-+    if ((m = strchr(n, '/'))) {
-+        *m++ = '\0';
-+        if (getaddrinfo(n, NULL, &hints, &ai)!=0)
-+	    return(FALSE);
-+        memcpy(&addr, &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr, 16);
-+        freeaddrinfo(ai);
-+
-+        for (i=0; i < (atoi(m)/32); ++i)
-+            msk[i] = 0xffffffff;
-+        if (atoi(m)<128 && (atoi(m) % 32))
-+        {
-+            msk[atoi(m)/32] = 0xffffffff;
-+            msk[atoi(m)/32] >>= ( 32 - (atoi(m) % 32) );
-+            msk[atoi(m)/32] <<= ( 32 - (atoi(m) % 32) );
-+        }
-+        for (i=0; i<4; ++i)
-+            msk[i] = htonl(msk[i]);
-+
-+        *(m - 1) = '/';
-+
-+        for (i=0; i < num_interfaces; i++)
-+            if (interfaces[i].sa_family == AF_INET6)    /* compare only IPv6 intf. */
-+            {
-+                /* nasty */
-+                memcpy(&i_addr, &interfaces[i].addr6, 16);
-+                if ( ((i_addr[0] & msk[0]) == addr[0]) &&
-+                     ((i_addr[1] & msk[1]) == addr[1]) &&
-+                     ((i_addr[2] & msk[2]) == addr[2]) &&
-+                     ((i_addr[3] & msk[3]) == addr[3]))
-+                    return (TRUE);
-+            }
-+    } else {
-+        if (getaddrinfo(n, NULL, &hints, &ai)!=0)
-+	    return(FALSE);
-+        memcpy(&addr, &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr, 16);
-+        freeaddrinfo(ai);
-+
-+        for (i=0; i < num_interfaces; ++i)
-+            if (interfaces[i].sa_family == AF_INET6) /* IPv6 intf. only */
-+            {
-+                memcpy(&i_addr, &interfaces[i].addr6, 16);
-+                if ((i_addr[0] == addr[0]) && (i_addr[1] == addr[1]) &&
-+                    (i_addr[2] == addr[2]) && (i_addr[3] == addr[3]))
-+                    return (TRUE); /* found my own address in sudoers */
-+
-+                memcpy(&i_msk, &interfaces[i].netmask6, 16);
-+                if (((i_addr[0]&i_msk[0]) == addr[0]) &&
-+                    ((i_addr[1]&i_msk[1]) == addr[1]) &&
-+                    ((i_addr[2]&i_msk[2]) == addr[2]) &&
-+                    ((i_addr[3]&i_msk[3]) == addr[3]))
-+                    return (TRUE); /* found my netw. address in sudoers */
-+            }
-+    }
-+    return(FALSE);
-+}
-+
-+
-+int
- hostname_matches(shost, lhost, pattern)
-     char *shost;
-     char *lhost;
---- sudo-1.6.8p12/interfaces.c.ipv6	2004-02-13 22:36:43.000000000 +0100
-+++ sudo-1.6.8p12/interfaces.c	2006-07-16 23:33:58.000000000 +0200
-@@ -102,7 +102,7 @@
- load_interfaces()
- {
-     struct ifaddrs *ifa, *ifaddrs;
--    /* XXX - sockaddr_in6 sin6; */
-+    struct sockaddr_in6 *sin6;
-     struct sockaddr_in *sin;
-     int i;
- 
-@@ -117,12 +117,15 @@
- 	    continue;
- 
- 	switch(ifa->ifa_addr->sa_family) {
--	    /* XXX - AF_INET6 */
- 	    case AF_INET:
- 		num_interfaces++;
- 		break;
-+	    case AF_INET6:
-+		num_interfaces++;
-+		break;
- 	}
-     }
-+
-     if (num_interfaces == 0)
- 	return;
-     interfaces =
-@@ -136,8 +139,8 @@
- 		continue;
- 
- 	switch(ifa->ifa_addr->sa_family) {
--	    /* XXX - AF_INET6 */
- 	    case AF_INET:
-+		interfaces[i].sa_family = AF_INET;
- 		sin = (struct sockaddr_in *)ifa->ifa_addr;
- 		memcpy(&interfaces[i].addr, &sin->sin_addr,
- 		    sizeof(struct in_addr));
-@@ -146,6 +149,16 @@
- 		    sizeof(struct in_addr));
- 		i++;
- 		break;
-+	    case AF_INET6:
-+		interfaces[i].sa_family = AF_INET6;
-+		sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
-+		memcpy(&interfaces[i].addr6, &sin6->sin6_addr,
-+		    sizeof(struct in6_addr));
-+		sin6 = (struct sockaddr_in6 *)ifa->ifa_netmask;
-+                memcpy(&interfaces[i].netmask6, &sin6->sin6_addr,
-+                    sizeof(struct in6_addr));	
-+		i++;
-+		break;
- 	}
-     }
- #ifdef HAVE_FREEIFADDRS
-@@ -306,10 +319,30 @@
- void
- dump_interfaces()
- {
--    int i;
-+    int i, j, ip6_prefix=0; 	/* for counting IPv6 prefix length (in bits!!) */
-+    uint8_t u6_addr8[16]; 	/* for storing IPv6 netmask */
- 
-     puts("Local IP address and netmask pairs:");
-     for (i = 0; i < num_interfaces; i++)
--	printf("\t%s / 0x%x\n", inet_ntoa(interfaces[i].addr),
--	    (unsigned int)ntohl(interfaces[i].netmask.s_addr));
-+    {
-+	char name[NI_MAXHOST], netmask[NI_MAXHOST];
-+	ip6_prefix=0;
-+	
-+	switch (interfaces[i].sa_family)
-+	{
-+	    case AF_INET:
-+		inet_ntop(AF_INET, &interfaces[i].addr, name, NI_MAXHOST);
-+		inet_ntop(AF_INET, &interfaces[i].netmask, netmask, NI_MAXHOST);
-+		printf("\t%s / %s\n", name, netmask);
-+		break;
-+	    case AF_INET6:
-+		inet_ntop(AF_INET6, &interfaces[i].addr6, name, NI_MAXHOST);
-+		memcpy(u6_addr8, &interfaces[i].netmask6, 16);
-+		for (j=0; j<16; ++j) 
-+		    if (u6_addr8[j] == 255)		/* 255 == 0xff */
-+			 ip6_prefix=ip6_prefix+8;	/* eight bits */
-+		printf("\t%s / %d\n", name, ip6_prefix);
-+		break;
-+	}
-+    }
- }
diff --git a/sudo-1.6.8p12-requiretty.patch b/sudo-1.6.8p12-requiretty.patch
deleted file mode 100644
index 475e5b6..0000000
--- a/sudo-1.6.8p12-requiretty.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- sudo-1.6.8p12/sudoers.tty	2006-05-29 15:10:30.000000000 +0200
-+++ sudo-1.6.8p12/sudoers	2006-05-29 15:17:03.000000000 +0200
-@@ -13,6 +13,12 @@
- 
- # Defaults specification
- 
-+#
-+# Disable "ssh hostname sudo <cmd>", because it will show the password in clear. 
-+#         You have to run "ssh -t hostname sudo <cmd>".
-+#
-+Defaults    requiretty
-+
- Defaults    env_reset
- Defaults    env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
-                         LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
diff --git a/sudo-1.6.8p8-pam-sess.patch b/sudo-1.6.8p8-pam-sess.patch
deleted file mode 100644
index e8ce9c1..0000000
--- a/sudo-1.6.8p8-pam-sess.patch
+++ /dev/null
@@ -1,32 +0,0 @@
---- sudo-1.6.8p8/auth/pam.c.sess	2005-05-24 16:38:35.976866872 +0200
-+++ sudo-1.6.8p8/auth/pam.c	2005-05-24 16:39:50.061604280 +0200
-@@ -175,6 +175,8 @@
- pam_prep_user(pw)
-     struct passwd *pw;
- {
-+    int error;
-+
-     if (pamh == NULL)
- 	pam_init(pw, NULL, NULL);
- 
-@@ -195,6 +197,20 @@
-      */
-     (void) pam_setcred(pamh, PAM_ESTABLISH_CRED);
- 
-+    /*
-+     * That's enough initialize PAM session in this function, because
-+     * sudo calls it before exec()
-+     */
-+    if ((error = pam_open_session(pamh, 0))!=PAM_SUCCESS) {
-+	    pam_end(pamh, error);
-+	    return(AUTH_FAILURE);
-+    }
-+    /*
-+     * For example settings from pam_limits are persistent after pam_session_close() and
-+     * it's probably more clean call pam_close_session() than omit it.
-+     */
-+    pam_close_session(pamh, 0);
-+   
-     if (pam_end(pamh, PAM_SUCCESS | PAM_DATA_SILENT) == PAM_SUCCESS)
- 	return(AUTH_SUCCESS);
-     else
diff --git a/sudo-1.6.9p4-getgrouplist.patch b/sudo-1.6.9p4-getgrouplist.patch
new file mode 100644
index 0000000..43b5a4e
--- /dev/null
+++ b/sudo-1.6.9p4-getgrouplist.patch
@@ -0,0 +1,61 @@
+--- sudo-1.6.9p4/configure.in.getgrouplist	2007-08-20 11:41:32.000000000 +0200
++++ sudo-1.6.9p4/configure.in	2007-08-20 13:24:30.000000000 +0200
+@@ -1677,7 +1677,7 @@
+ dnl
+ AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
+ 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
+-	       setlocale getaddrinfo)
++	       setlocale getaddrinfo getgrouplist)
+ if test -z "$SKIP_SETRESUID"; then
+     AC_CHECK_FUNCS(setresuid, [SKIP_SETREUID=yes])
+ fi
+--- sudo-1.6.9p4/configure.getgrouplist	2007-08-15 15:23:44.000000000 +0200
++++ sudo-1.6.9p4/configure	2007-08-20 13:26:25.000000000 +0200
+@@ -14235,7 +14235,7 @@
+ 
+ for ac_func in strchr strrchr memchr memcpy memset sysconf tzset \
+ 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
+-	       setlocale getaddrinfo
++	       setlocale getaddrinfo getgrouplist
+ do
+ as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+ echo "$as_me:$LINENO: checking for $ac_func" >&5
+--- sudo-1.6.9p4/check.c.getgrouplist	2007-07-06 21:52:13.000000000 +0200
++++ sudo-1.6.9p4/check.c	2007-08-20 13:21:10.000000000 +0200
+@@ -308,6 +308,24 @@
+ 	    return(TRUE);
+     }
+ 
++#ifdef HAVE_GETGROUPLIST
++    {
++	gid_t *grouplist, grouptmp;
++	int n_groups, i;
++	n_groups = 1;
++	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
++	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
++	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
++		for (i = 0; i < n_groups; i++)
++		    if (grouplist[i] == grp->gr_gid) {
++			free(grouplist);
++			return(TRUE);
++		    }
++	    free(grouplist);
++	}
++    }
++#endif
++
+     return(FALSE);
+ }
+ 
+--- sudo-1.6.9p4/config.h.in.getgrouplist	2007-08-20 11:41:32.000000000 +0200
++++ sudo-1.6.9p4/config.h.in	2007-08-20 13:21:10.000000000 +0200
+@@ -140,6 +140,9 @@
+ /* Define to 1 if you have the `getgroups' function. */
+ #undef HAVE_GETGROUPS
+ 
++/* Define to 1 if you have the `getgrouplist' function. */
++#undef HAVE_GETGROUPLIST
++
+ /* Define to 1 if you have the `getifaddrs' function. */
+ #undef HAVE_GETIFADDRS
+ 
diff --git a/sudo-1.6.8p12-pam-login.patch b/sudo-1.6.9p4-login.patch
similarity index 56%
rename from sudo-1.6.8p12-pam-login.patch
rename to sudo-1.6.9p4-login.patch
index acd62e4..9ebfd6b 100644
--- a/sudo-1.6.8p12-pam-login.patch
+++ b/sudo-1.6.9p4-login.patch
@@ -1,6 +1,56 @@
---- sudo-1.6.8p12/configure.in.login	2006-07-16 15:25:33.000000000 +0200
-+++ sudo-1.6.8p12/configure.in	2006-07-16 15:49:08.000000000 +0200
-@@ -357,6 +357,17 @@
+--- sudo-1.6.9p4/auth/pam.c.login	2007-07-22 14:14:53.000000000 +0200
++++ sudo-1.6.9p4/auth/pam.c	2007-08-20 11:08:33.000000000 +0200
+@@ -89,7 +89,12 @@
+     if (auth != NULL)
+ 	auth->data = (VOID *) &pam_status;
+     pam_conv.conv = sudo_conv;
+-    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
++#ifdef HAVE_PAM_LOGIN
++    if (ISSET(sudo_mode, MODE_LOGIN_SHELL))
++	    pam_status = pam_start("sudo-i", pw->pw_name, &pam_conv, &pamh);
++    else
++#endif
++	    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
+     if (pam_status != PAM_SUCCESS) {
+ 	log_error(USE_ERRNO|NO_EXIT|NO_MAIL, "unable to initialize PAM");
+ 	return(AUTH_FATAL);
+--- sudo-1.6.9p4/config.h.in.login	2007-08-15 15:22:19.000000000 +0200
++++ sudo-1.6.9p4/config.h.in	2007-08-20 11:08:34.000000000 +0200
+@@ -266,6 +266,9 @@
+ /* Define to 1 if you use PAM authentication. */
+ #undef HAVE_PAM
+ 
++/* Define to 1 if you use specific PAM session for sodo -i. */
++#undef HAVE_PAM_LOGIN
++
+ /* Define to 1 if you have the <pam/pam_appl.h> header file. */
+ #undef HAVE_PAM_PAM_APPL_H
+ 
+--- sudo-1.6.9p4/env.c.login	2007-07-31 20:04:31.000000000 +0200
++++ sudo-1.6.9p4/env.c	2007-08-20 11:24:48.000000000 +0200
+@@ -104,7 +104,7 @@
+ /*
+  * Prototypes
+  */
+-char **rebuild_env		__P((char **, int, int));
++char **rebuild_env              __P((char **, int));
+ static void insert_env		__P((char *, struct environment *, int));
+ static char *format_env		__P((char *, ...));
+ 
+@@ -391,9 +391,8 @@
+  * Also adds sudo-specific variables (SUDO_*).
+  */
+ char **
+-rebuild_env(envp, sudo_mode, noexec)
++rebuild_env(envp, noexec)
+     char **envp;
+-    int sudo_mode;
+     int noexec;
+ {
+     char **ep, *cp, *ps1;
+--- sudo-1.6.9p4/configure.in.login	2007-08-15 15:48:51.000000000 +0200
++++ sudo-1.6.9p4/configure.in	2007-08-20 11:08:33.000000000 +0200
+@@ -351,6 +351,17 @@
  		;;
  esac])
  
@@ -18,99 +68,49 @@
  AC_ARG_WITH(AFS, [  --with-AFS              enable AFS support],
  [case $with_AFS in
      yes)	AC_DEFINE(HAVE_AFS)
---- sudo-1.6.8p12/sudo.c.login	2006-07-16 15:39:26.000000000 +0200
-+++ sudo-1.6.8p12/sudo.c	2006-07-16 15:41:42.000000000 +0200
-@@ -109,7 +109,7 @@
+--- sudo-1.6.9p4/sudo.h.login	2007-07-06 16:14:34.000000000 +0200
++++ sudo-1.6.9p4/sudo.h	2007-08-20 11:33:45.000000000 +0200
+@@ -268,6 +268,7 @@
+ extern FILE *sudoers_fp;
+ extern int tgetpass_flags;
+ extern uid_t timestamp_uid;
++extern int sudo_mode;
+ #endif
+ #ifndef errno
+ extern int errno;
+--- sudo-1.6.9p4/sudo.c.login	2007-08-15 15:48:56.000000000 +0200
++++ sudo-1.6.9p4/sudo.c	2007-08-20 11:34:07.000000000 +0200
+@@ -122,7 +122,7 @@
  static struct passwd *get_authpw	__P((void));
- extern int sudo_edit			__P((int, char **));
+ extern int sudo_edit			__P((int, char **, char **));
  extern void list_matches		__P((void));
 -extern char **rebuild_env		__P((char **, int, int));
-+extern char **rebuild_env		__P((char **, int));
- extern char **zero_env			__P((char **));
++extern char **rebuild_env               __P((char **, int));
+ extern void validate_env_vars		__P((struct list_member *));
+ extern char **insert_env_vars		__P((char **, struct list_member *));
  extern struct passwd *sudo_getpwnam	__P((const char *));
- extern struct passwd *sudo_getpwuid	__P((uid_t));
-@@ -140,6 +140,7 @@
+@@ -153,6 +153,7 @@
+ char *login_style;
  #endif /* HAVE_BSD_AUTH_H */
  sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp, saved_sa_chld;
- void (*set_perms) __P((int));
 +int sudo_mode;
  
  
  int
-@@ -151,7 +152,6 @@
+@@ -164,7 +165,6 @@
      int validated;
      int fd;
      int cmnd_status;
 -    int sudo_mode;
      int pwflag;
-     char **new_environ;
      sigaction_t sa;
-@@ -368,7 +368,7 @@
+     extern int printmatches;
+@@ -347,7 +347,7 @@
+ 	def_env_reset = FALSE;
  
-     /* Build a new environment that avoids any nasty bits if we have a cmnd. */
-     if (ISSET(sudo_mode, MODE_RUN))
--	new_environ = rebuild_env(envp, sudo_mode, ISSET(validated, FLAG_NOEXEC));
-+	new_environ = rebuild_env(envp, ISSET(validated, FLAG_NOEXEC));
-     else
- 	new_environ = envp;
- 
---- sudo-1.6.8p12/auth/pam.c.login	2006-07-16 15:41:59.000000000 +0200
-+++ sudo-1.6.8p12/auth/pam.c	2006-07-16 15:45:15.000000000 +0200
-@@ -89,7 +89,12 @@
-     if (auth != NULL)
- 	auth->data = (VOID *) &pam_status;
-     pam_conv.conv = sudo_conv;
--    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
-+#ifdef HAVE_PAM_LOGIN
-+    if (ISSET(sudo_mode, MODE_LOGIN_SHELL))
-+	    pam_status = pam_start("sudo-i", pw->pw_name, &pam_conv, &pamh);
-+    else
-+#endif
-+	    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
-     if (pam_status != PAM_SUCCESS) {
- 	log_error(USE_ERRNO|NO_EXIT|NO_MAIL, "unable to initialize PAM");
- 	return(AUTH_FATAL);
---- sudo-1.6.8p12/env.c.login	2006-07-16 15:40:14.000000000 +0200
-+++ sudo-1.6.8p12/env.c	2006-07-16 15:57:19.000000000 +0200
-@@ -77,7 +77,7 @@
- /*
-  * Prototypes
-  */
--char **rebuild_env		__P((char **, int, int));
-+char **rebuild_env		__P((char **, int));
- char **zero_env			__P((char **));
- static void insert_env		__P((char *, int));
- static char *format_env		__P((char *, ...));
-@@ -321,9 +321,8 @@
-  * Also adds sudo-specific variables (SUDO_*).
-  */
- char **
--rebuild_env(envp, sudo_mode, noexec)
-+rebuild_env(envp, noexec)
-     char **envp;
--    int sudo_mode;
-     int noexec;
- {
-     char **ep, *cp, *ps1;
---- sudo-1.6.8p12/sudo.h.login	2006-07-16 15:59:08.000000000 +0200
-+++ sudo-1.6.8p12/sudo.h	2006-07-16 15:59:38.000000000 +0200
-@@ -251,6 +251,7 @@
- extern FILE *sudoers_fp;
- extern int tgetpass_flags;
- extern uid_t timestamp_uid;
-+extern int sudo_mode;
- 
- extern void (*set_perms) __P((int));
- #endif
---- sudo-1.6.8p12/config.h.in.login	2006-07-16 15:32:09.000000000 +0200
-+++ sudo-1.6.8p12/config.h.in	2006-07-16 15:32:56.000000000 +0200
-@@ -230,6 +230,9 @@
- /* Define to 1 if you use PAM authentication. */
- #undef HAVE_PAM
- 
-+/* Define to 1 if you use specific PAM session for sodo -i. */
-+#undef HAVE_PAM_LOGIN
-+
- /* Define to 1 if you have the <pam/pam_appl.h> header file. */
- #undef HAVE_PAM_PAM_APPL_H
+     /* Build a new environment that avoids any nasty bits. */
+-    environ = rebuild_env(environ, sudo_mode, ISSET(validated, FLAG_NOEXEC));
++    environ = rebuild_env(envp, ISSET(validated, FLAG_NOEXEC));
  
+     /* Fill in passwd struct based on user we are authenticating as.  */
+     auth_pw = get_authpw();
diff --git a/sudo.spec b/sudo.spec
index 93a01be..ab68822 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.6.8p12
-Release: 14%{?dist}
+Version: 1.6.9p4
+Release: 1%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -16,19 +16,12 @@ BuildRequires: openldap-devel
 BuildRequires: flex
 BuildRequires: bison
 
-# 154511 - sudo does not use limits.conf
-Patch2: sudo-1.6.8p8-pam-sess.patch
 # don't strip
-Patch3: sudo-1.6.7p5-strip.patch
-# Default sudoers: reset env.
-Patch4: sudo-1.6.8p12-env-reset.patch
-# Default sudoers; require tty (#190062)
-Patch5: sudo-1.6.8p12-requiretty.patch
-# Use specific PAM session for sudo -i (#198755)
-Patch6: sudo-1.6.8p12-pam-login.patch
-# IPv6 support
-Patch7: sudo-1.6.8p12-ipv6.patch
-Patch8: sudo-1.6.8p12-getgrouplist.patch
+Patch1: sudo-1.6.7p5-strip.patch
+# use specific PAM session for sudo -i (#198755)
+Patch2: sudo-1.6.9p4-login.patch
+# the rest, see changelog
+Patch3: sudo-1.6.9p4-getgrouplist.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -43,13 +36,9 @@ on many different machines.
 
 %prep
 %setup -q
-%patch2 -p1 -b .sess
-%patch3 -p1 -b .strip
-%patch4 -p1 -b .env_reset
-%patch5 -p1 -b .tty
-%patch6 -p1 -b .login
-%patch7 -p1 -b .ipv6
-%patch8 -p1 -b .getgrouplist
+%patch1 -p1 -b .strip
+%patch2 -p1 -b .login
+%patch3 -p1 -b .getgrouplist
 
 %build
 %ifarch s390 s390x
@@ -75,6 +64,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE -DHAVE_PAM_LOGIN" LDFLAGS="-pie"
         --with-ignore-dot \
         --with-tty-tickets \
         --with-ldap
+#	--without-kerb5 \
+#	--without-kerb4
 make
 
 %install
@@ -110,7 +101,7 @@ rm -rf $RPM_BUILD_ROOT
 
 %files
 %defattr(-,root,root)
-%doc BUGS CHANGES HISTORY LICENSE README RUNSON TODO TROUBLESHOOTING UPGRADE *.pod
+%doc BUGS CHANGES HISTORY LICENSE README TODO TROUBLESHOOTING UPGRADE *.pod
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %config(noreplace) /etc/pam.d/sudo
 %config(noreplace) /etc/pam.d/sudo-i
@@ -129,6 +120,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Mon Aug 20 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-1
+- upgrade to upstream release
+
 * Thu Apr 12 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-14
 - also use getgrouplist() to determine group membership (#235915)
 

From e25038bfb0c755b36db765e1aaf02ded61980975 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Thu, 30 Aug 2007 16:21:58 +0000
Subject: [PATCH 002/199] fix autotools stuff and add audit support

---
 sudo-1.6.9p4-audit.patch              | 398 ++++++++++++++++++++++++++
 sudo-1.6.9p4-autotoolsRecursion.patch |  41 +++
 sudo-1.6.9p4-getgrouplist.patch       |  24 +-
 sudo-1.6.9p4-getprpwnam.patch         |  12 +
 sudo-1.6.9p4-login.patch              |  14 +-
 sudo.spec                             |  21 +-
 6 files changed, 469 insertions(+), 41 deletions(-)
 create mode 100644 sudo-1.6.9p4-audit.patch
 create mode 100644 sudo-1.6.9p4-autotoolsRecursion.patch
 create mode 100644 sudo-1.6.9p4-getprpwnam.patch

diff --git a/sudo-1.6.9p4-audit.patch b/sudo-1.6.9p4-audit.patch
new file mode 100644
index 0000000..6775ef7
--- /dev/null
+++ b/sudo-1.6.9p4-audit.patch
@@ -0,0 +1,398 @@
+diff -up sudo-1.6.9p4/audit_help.c.audit sudo-1.6.9p4/audit_help.c
+--- sudo-1.6.9p4/audit_help.c.audit	2007-08-30 20:06:30.000000000 +0400
++++ sudo-1.6.9p4/audit_help.c	2007-08-30 20:06:30.000000000 +0400
+@@ -0,0 +1,81 @@
++/*
++ *  Audit helper functions used throughout sudo
++ *
++ *  Copyright (C) 2007, Red Hat, Inc.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
++ *    may be used to endorse or promote products derived from this software
++ *    without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ */
++
++#include <config.h>
++
++#ifdef WITH_AUDIT
++
++#include <stdlib.h>
++#include <syslog.h>
++#include <stdarg.h>
++#include <libaudit.h>
++#include <errno.h>
++#include <stdio.h>
++
++int audit_fd;
++
++void audit_help_open (void)
++{
++	audit_fd = audit_open ();
++	if (audit_fd < 0) {
++        	/* You get these only when the kernel doesn't have
++                 * audit compiled in. */
++		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
++		    errno == EAFNOSUPPORT)
++			return;
++		fprintf (stderr, "Cannot open audit interface - aborting.\n");
++		exit (1);
++	}
++}
++
++/*
++ * This function will log a message to the audit system using a predefined
++ * message format. Parameter usage is as follows:
++ *
++ * type - type of message: AUDIT_USER_CMD
++ * command - the command being logged
++ * result - 1 is "success" and 0 is "failed"
++ *
++ */
++void audit_logger (int type, const char *command, int result)
++{
++	int err;
++
++	if (audit_fd < 0)
++		return;
++	else {
++		err = audit_log_user_command (audit_fd, type, command, NULL, result);
++		if( err <= 0 )
++			perror("audit_log_user_command()");
++	}
++}
++
++#endif                         /* WITH_AUDIT */
++
+diff -up sudo-1.6.9p4/Makefile.in.audit sudo-1.6.9p4/Makefile.in
+--- sudo-1.6.9p4/Makefile.in.audit	2007-08-15 18:16:57.000000000 +0400
++++ sudo-1.6.9p4/Makefile.in	2007-08-30 20:06:30.000000000 +0400
+@@ -118,11 +118,13 @@ HDRS = compat.h def_data.h defaults.h in
+ 
+ AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
+ 
++AUDIT_OBJS = audit_help.o 
++
+ PARSEOBJS = sudo.tab.o lex.yy.o alloc.o defaults.o
+ 
+ SUDOBJS = check.o env.o getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
+ 	  interfaces.o logging.o parse.o set_perms.o sudo.o sudo_edit.o \
+-	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS)
++	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS) $(AUDIT_OBJS)
+ 
+ VISUDOBJS = visudo.o fileops.o gettime.o goodpath.o find_path.o $(PARSEOBJS)
+ 
+@@ -273,6 +275,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
+ sia.o: $(authdir)/sia.c $(AUTHDEP)
+ 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
+ 
++audit_help.o: audit_help.c sudo.h
++	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
++
+ sudo.man.in: $(srcdir)/sudo.pod
+ 	@rm -f $(srcdir)/$@
+ 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e 1d -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" >> $@ )
+diff -up sudo-1.6.9p4/sudo.h.audit sudo-1.6.9p4/sudo.h
+--- sudo-1.6.9p4/sudo.h.audit	2007-08-30 20:06:30.000000000 +0400
++++ sudo-1.6.9p4/sudo.h	2007-08-30 20:06:30.000000000 +0400
+@@ -23,6 +23,8 @@
+ #ifndef _SUDO_SUDO_H
+ #define _SUDO_SUDO_H
+ 
++#include <config.h>
++
+ #include <pathnames.h>
+ #include <limits.h>
+ #include "compat.h"
+@@ -274,4 +276,10 @@ extern int sudo_mode;
+ extern int errno;
+ #endif
+ 
++#ifdef WITH_AUDIT
++extern int audit_fd;
++extern void audit_help_open (void);
++extern void audit_logger (int, const char *, int);
++#endif
++
+ #endif /* _SUDO_SUDO_H */
+diff -up sudo-1.6.9p4/sudo.c.audit sudo-1.6.9p4/sudo.c
+--- sudo-1.6.9p4/sudo.c.audit	2007-08-30 20:06:30.000000000 +0400
++++ sudo-1.6.9p4/sudo.c	2007-08-30 20:18:26.000000000 +0400
+@@ -97,6 +97,10 @@
+ # include <sys/task.h>
+ #endif
+ 
++#ifdef WITH_AUDIT
++#include <libaudit.h>
++#endif
++
+ #include "sudo.h"
+ #include "interfaces.h"
+ #include "version.h"
+@@ -292,6 +296,10 @@ main(argc, argv, envp)
+     if (safe_cmnd == NULL)
+ 	safe_cmnd = estrdup(user_cmnd);
+ 
++#if defined(WITH_AUDIT)
++    audit_help_open ();
++#endif
++
+     /*
+      * Look up the timestamp dir owner if one is specified.
+      */
+@@ -302,9 +310,13 @@ main(argc, argv, envp)
+ 	    pw = getpwuid(atoi(def_timestampowner + 1));
+ 	else
+ 	    pw = getpwnam(def_timestampowner);
+-	if (!pw)
++	if (!pw) {
++#if defined(WITH_AUDIT)
++	    audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
++#endif
+ 	    log_error(0, "timestamp owner (%s): No such user",
+ 		def_timestampowner);
++        }
+ 	timestamp_uid = pw->pw_uid;
+     }
+ 
+@@ -314,15 +326,22 @@ main(argc, argv, envp)
+ 	exit(0);
+     }
+ 
+-    if (ISSET(validated, VALIDATE_ERROR))
++    if (ISSET(validated, VALIDATE_ERROR)) {
++#if defined(WITH_AUDIT)
++        audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
++#endif
+ 	log_error(0, "parse error in %s near line %d", _PATH_SUDOERS,
+ 	    errorlineno);
++    }
+ 
+     /* Is root even allowed to run sudo? */
+     if (user_uid == 0 && !def_root_sudo) {
+ 	(void) fprintf(stderr,
+ 	    "Sorry, %s has been configured to not allow root to run it.\n",
+ 	    getprogname());
++#if defined(WITH_AUDIT)
++        audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
++#endif
+ 	exit(1);
+     }
+ 
+@@ -336,8 +355,12 @@ main(argc, argv, envp)
+ 
+     /* Bail if a tty is required and we don't have one.  */
+     if (def_requiretty) {
+-	if ((fd = open(_PATH_TTY, O_RDWR|O_NOCTTY)) == -1)
++	if ((fd = open(_PATH_TTY, O_RDWR|O_NOCTTY)) == -1) {
++#if defined(WITH_AUDIT)
++	    audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
++#endif
+ 	    log_error(NO_MAIL, "sorry, you must have a tty to run sudo");
++        }
+ 	else
+ 	    (void) close(fd);
+     }
+@@ -370,17 +393,27 @@ main(argc, argv, envp)
+ 	/* Finally tell the user if the command did not exist. */
+ 	if (cmnd_status == NOT_FOUND_DOT) {
+ 	    warnx("ignoring `%s' found in '.'\nUse `sudo ./%s' if this is the `%s' you wish to run.", user_cmnd, user_cmnd, user_cmnd);
++#if defined(WITH_AUDIT)
++	    audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
++#endif
+ 	    exit(1);
+ 	} else if (cmnd_status == NOT_FOUND) {
+ 	    warnx("%s: command not found", user_cmnd);
++#if defined(WITH_AUDIT)
++	    audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
++#endif
+ 	    exit(1);
+ 	}
+ 
+ 	/* If user specified env vars make sure sudoers allows it. */
+ 	if (ISSET(sudo_mode, MODE_RUN) && !ISSET(validated, FLAG_SETENV)) {
+-	    if (ISSET(sudo_mode, MODE_PRESERVE_ENV))
++	    if (ISSET(sudo_mode, MODE_PRESERVE_ENV)) {
++#if defined(WITH_AUDIT)
++	        audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
++#endif
+ 		log_error(NO_MAIL,
+ 		    "sorry, you are not allowed to preserve the environment");
++            }
+ 	    else
+ 		validate_env_vars(sudo_user.env_vars);
+ 	}
+@@ -439,11 +472,23 @@ main(argc, argv, envp)
+ 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
+ 	(void) sigaction(SIGCHLD, &saved_sa_chld, NULL);
+ 
++	if (access(safe_cmnd, X_OK) != 0) {
++                warn ("unable to execute %s", safe_cmnd); 
++#ifdef WITH_AUDIT	
++		audit_logger(AUDIT_USER_CMD,  safe_cmnd, 0);
++#endif
++		exit(127);
++	}
++#ifdef WITH_AUDIT	
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, 1);
++#endif
++
+ #ifndef PROFILING
+ 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0)
+ 	    exit(0);
+-	else
++	else {
+ 	    execve(safe_cmnd, NewArgv, environ);
++	}
+ #else
+ 	exit(0);
+ #endif /* PROFILING */
+@@ -456,6 +501,9 @@ main(argc, argv, envp)
+ 	    NewArgv[1] = safe_cmnd;
+ 	    execve(_PATH_BSHELL, NewArgv, environ);
+ 	}
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, 0);
++#endif
+ 	warn("unable to execute %s", safe_cmnd);
+ 	exit(127);
+     } else if (ISSET(validated, FLAG_NO_USER) || (validated & FLAG_NO_HOST)) {
+diff -up sudo-1.6.9p4/configure.in.audit sudo-1.6.9p4/configure.in
+--- sudo-1.6.9p4/configure.in.audit	2007-08-30 20:06:30.000000000 +0400
++++ sudo-1.6.9p4/configure.in	2007-08-30 20:06:30.000000000 +0400
+@@ -150,6 +150,10 @@ dnl
+ dnl Options for --with
+ dnl
+ 
++AC_ARG_WITH(audit,
++        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
++        [with_audit=$withval], [with_audit=yes])
++
+ AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
+ [case $with_CC in
+     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
+@@ -1579,6 +1583,25 @@ dnl
+ : ${mansectsu='8'}
+ : ${mansectform='5'}
+ 
++
++AC_SUBST(LIBAUDIT)
++if test "$with_audit" = "yes"; then
++	# See if we have the audit library
++        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
++        if test "$audit_header" = "yes"; then
++                AC_CHECK_LIB(audit, audit_log_user_command,
++                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
++                        LIBAUDIT="-laudit"])
++        fi
++	# See if we have the libcap library
++	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
++	if test "$cap_header" = "yes"; then
++		AC_CHECK_LIB(cap, cap_init,
++			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
++			SUDO_LIBS="${SUDO_LIBS} -lcap"])
++	fi
++fi
++
+ dnl
+ dnl Add in any libpaths or libraries specified via configure
+ dnl
+diff -up sudo-1.6.9p4/set_perms.c.audit sudo-1.6.9p4/set_perms.c
+--- sudo-1.6.9p4/set_perms.c.audit	2007-07-06 18:16:22.000000000 +0400
++++ sudo-1.6.9p4/set_perms.c	2007-08-30 20:06:30.000000000 +0400
+@@ -53,6 +53,10 @@
+ #ifdef HAVE_LOGIN_CAP_H
+ # include <login_cap.h>
+ #endif
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++# include <sys/prctl.h>
++# include <sys/capability.h>
++#endif
+ 
+ #include "sudo.h"
+ 
+@@ -101,22 +105,55 @@ set_perms(perm)
+ 				if (setresuid(user_uid, user_uid, user_uid))
+ 				    err(1, "setresuid(user_uid, user_uid, user_uid)");
+ 			      	break;
+-				
++
++        case PERM_FULL_RUNAS:
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++                                { /* BEGIN CAP BLOCK */
++                                cap_t new_caps;
++                                cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
++ 
++                                if (runas_pw->pw_uid != ROOT_UID) {
++                                    new_caps = cap_init ();
++                                    if (!new_caps)
++                                        err(1, "Error initing capabilities, aborting.\n");
++                                    
++                                    if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
++                                       cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
++                                         err(1, "Error setting capabilities, aborting\n");   
++                                    }
++                                                                
++                                    if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0))
++                                        err(1, "Error setting KEEPCAPS, aborting\n");
++                                }
++#endif                          
++                                /* headed for exec(), assume euid == ROOT_UID */                                      
++                                runas_setup ();
++                                if (setresuid(def_stay_setuid ? 
++                                    user_uid : runas_pw->pw_uid,
++                                    runas_pw->pw_uid, runas_pw->pw_uid))
++                                    err(1, "unable to change to runas uid");
++
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++                                if (runas_pw->pw_uid != ROOT_UID) {
++                                    if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0)
++                                        err(1, "Error resetting KEEPCAPS, aborting\n");
++                                
++                                    if (cap_set_proc(new_caps))
++                                        err(1, "Error dropping capabilities, aborting\n");
++                            
++                                    if (cap_free (new_caps))
++                                        err(1, "Error freeing caps\n");                        
++                                }
++	                        } /* END CAP BLOCK */
++#endif
++	                         break;
++
+ 	case PERM_RUNAS:
+ 				(void) setresgid(-1, runas_pw->pw_gid, -1);
+ 				if (setresuid(-1, runas_pw->pw_uid, -1))
+ 				    err(1, "unable to change to runas uid");
+ 			      	break;
+ 
+-	case PERM_FULL_RUNAS:
+-				/* headed for exec(), assume euid == ROOT_UID */
+-				runas_setup();
+-				if (setresuid(def_stay_setuid ?
+-				    user_uid : runas_pw->pw_uid,
+-				    runas_pw->pw_uid, runas_pw->pw_uid))
+-				    err(1, "unable to change to runas uid");
+-				break;
+-
+ 	case PERM_SUDOERS:
+ 				/* assume euid == ROOT_UID, ruid == user */
+ 				if (setresgid(-1, SUDOERS_GID, -1))
diff --git a/sudo-1.6.9p4-autotoolsRecursion.patch b/sudo-1.6.9p4-autotoolsRecursion.patch
new file mode 100644
index 0000000..09e862d
--- /dev/null
+++ b/sudo-1.6.9p4-autotoolsRecursion.patch
@@ -0,0 +1,41 @@
+diff -up sudo-1.6.9p4/acsite.m4.autotoolsRecursion sudo-1.6.9p4/acsite.m4
+--- sudo-1.6.9p4/acsite.m4.autotoolsRecursion	2007-08-27 12:33:37.000000000 +0400
++++ sudo-1.6.9p4/acsite.m4	2007-08-27 12:33:52.000000000 +0400
+@@ -6319,19 +6319,32 @@ m4_define([lt_join],
+ ])
+ 
+ 
++# lt_car(LIST)
++# lt_cdr(LIST)
++# ------------
++# Manipulate m4 lists.
++# These macros are necessary as long as will still need to support
++# Autoconf-2.59 which quotes differently.
++m4_define([lt_car], [[$1]])
++m4_define([lt_cdr],
++[m4_if([$#], 0, [m4_fatal([$0: cannot be called without arguments])],
++       [$#], 1, [],
++       [m4_dquote(m4_shift($@))])])
++
++
+ # lt_combine(SEP, PREFIX-LIST, INFIX, SUFFIX1, [SUFFIX2...])
+ # ----------------------------------------------------------
+ # Produce a SEP delimited list of all paired combinations of elements of
+ # PREFIX-LIST with SUFFIX1 through SUFFIXn.  Each element of the list
+ # has the form PREFIXmINFIXSUFFIXn.
+ m4_define([lt_combine],
+-[m4_if([$2], [[]], [],
+-       [lt_join(m4_quote(m4_default([$1], [, ])),
+-		_$0([$1], m4_car($2)[$3], m4_shiftn(3, $@)),
+-		$0([$1], m4_cdr($2), m4_shiftn(2, $@)))])])
++[m4_if([$2], [], [],
++       [lt_join(m4_quote(m4_default([$1], [[, ]])),
++		_$0([$1], lt_car($2)[$3], m4_shiftn(3, $@)),
++		$0([$1], lt_cdr($2), m4_shiftn(2, $@)))])])
+ m4_define([_lt_combine],
+ [m4_if([$3], [], [],
+-       [lt_join(m4_quote(m4_default([$1], [, ])),
++       [lt_join(m4_quote(m4_default([$1], [[, ]])),
+ 		[$2$3],
+ 		$0([$1], [$2], m4_shiftn(3, $@)))])[]dnl
+ ])
diff --git a/sudo-1.6.9p4-getgrouplist.patch b/sudo-1.6.9p4-getgrouplist.patch
index 43b5a4e..78a988e 100644
--- a/sudo-1.6.9p4-getgrouplist.patch
+++ b/sudo-1.6.9p4-getgrouplist.patch
@@ -9,17 +9,6 @@
  if test -z "$SKIP_SETRESUID"; then
      AC_CHECK_FUNCS(setresuid, [SKIP_SETREUID=yes])
  fi
---- sudo-1.6.9p4/configure.getgrouplist	2007-08-15 15:23:44.000000000 +0200
-+++ sudo-1.6.9p4/configure	2007-08-20 13:26:25.000000000 +0200
-@@ -14235,7 +14235,7 @@
- 
- for ac_func in strchr strrchr memchr memcpy memset sysconf tzset \
- 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
--	       setlocale getaddrinfo
-+	       setlocale getaddrinfo getgrouplist
- do
- as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
- echo "$as_me:$LINENO: checking for $ac_func" >&5
 --- sudo-1.6.9p4/check.c.getgrouplist	2007-07-06 21:52:13.000000000 +0200
 +++ sudo-1.6.9p4/check.c	2007-08-20 13:21:10.000000000 +0200
 @@ -308,6 +308,24 @@
@@ -47,15 +36,4 @@
      return(FALSE);
  }
  
---- sudo-1.6.9p4/config.h.in.getgrouplist	2007-08-20 11:41:32.000000000 +0200
-+++ sudo-1.6.9p4/config.h.in	2007-08-20 13:21:10.000000000 +0200
-@@ -140,6 +140,9 @@
- /* Define to 1 if you have the `getgroups' function. */
- #undef HAVE_GETGROUPS
- 
-+/* Define to 1 if you have the `getgrouplist' function. */
-+#undef HAVE_GETGROUPLIST
-+
- /* Define to 1 if you have the `getifaddrs' function. */
- #undef HAVE_GETIFADDRS
- 
+
diff --git a/sudo-1.6.9p4-getprpwnam.patch b/sudo-1.6.9p4-getprpwnam.patch
new file mode 100644
index 0000000..f99b6d9
--- /dev/null
+++ b/sudo-1.6.9p4-getprpwnam.patch
@@ -0,0 +1,12 @@
+diff -up sudo-1.6.9p4/configure.in.getprpwnam sudo-1.6.9p4/configure.in
+--- sudo-1.6.9p4/configure.in.getprpwnam	2007-08-27 13:24:54.000000000 +0400
++++ sudo-1.6.9p4/configure.in	2007-08-27 13:25:48.000000000 +0400
+@@ -1975,7 +1975,7 @@ if test "$CHECKSHADOW" = "true"; then
+     AC_CHECK_FUNCS(getspnam, [CHECKSHADOW="false"], [AC_CHECK_LIB(gen, getspnam, AC_DEFINE(HAVE_GETSPNAM) [SUDO_LIBS="${SUDO_LIBS} -lgen"; LIBS="${LIBS} -lgen"])])
+ fi
+ if test "$CHECKSHADOW" = "true"; then
+-    AC_CHECK_FUNC(getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) [CHECKSHADOW="false"; SECUREWARE=1], AC_CHECK_LIB(sec, getprpwnam, AC_DEFINE(HAVE_GETPRPWNAM) [CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lsec"; LIBS="${LIBS} -lsec"], AC_CHECK_LIB(security, getprpwnam, AC_DEFINE(HAVE_GETPRPWNAM) [CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lsecurity"; LIBS="${LIBS} -lsecurity"], AC_CHECK_LIB(prot, getprpwnam, AC_DEFINE(HAVE_GETPRPWNAM) [CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lprot"; LIBS="${LIBS} -lprot"])))])
++    AC_CHECK_FUNC(getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) CHECKSHADOW="false"; SECUREWARE=1], [AC_CHECK_LIB(sec, getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lsec"; LIBS="${LIBS} -lsec"], [AC_CHECK_LIB(security, getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lsecurity"; LIBS="${LIBS} -lsecurity"], [AC_CHECK_LIB(prot, getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lprot"; LIBS="${LIBS} -lprot"])])])])
+ fi
+ if test -n "$SECUREWARE"; then
+     AC_CHECK_FUNCS(bigcrypt set_auth_parameters initprivs)
diff --git a/sudo-1.6.9p4-login.patch b/sudo-1.6.9p4-login.patch
index 9ebfd6b..1c62966 100644
--- a/sudo-1.6.9p4-login.patch
+++ b/sudo-1.6.9p4-login.patch
@@ -14,18 +14,6 @@
      if (pam_status != PAM_SUCCESS) {
  	log_error(USE_ERRNO|NO_EXIT|NO_MAIL, "unable to initialize PAM");
  	return(AUTH_FATAL);
---- sudo-1.6.9p4/config.h.in.login	2007-08-15 15:22:19.000000000 +0200
-+++ sudo-1.6.9p4/config.h.in	2007-08-20 11:08:34.000000000 +0200
-@@ -266,6 +266,9 @@
- /* Define to 1 if you use PAM authentication. */
- #undef HAVE_PAM
- 
-+/* Define to 1 if you use specific PAM session for sodo -i. */
-+#undef HAVE_PAM_LOGIN
-+
- /* Define to 1 if you have the <pam/pam_appl.h> header file. */
- #undef HAVE_PAM_PAM_APPL_H
- 
 --- sudo-1.6.9p4/env.c.login	2007-07-31 20:04:31.000000000 +0200
 +++ sudo-1.6.9p4/env.c	2007-08-20 11:24:48.000000000 +0200
 @@ -104,7 +104,7 @@
@@ -56,7 +44,7 @@
  
 +AC_ARG_WITH(pam-login, [  --with-pam-login              enable specific PAM session for sudo -i],
 +[case $with_pam_login in
-+    yes)	AC_DEFINE(HAVE_PAM_LOGIN)
++    yes)	AC_DEFINE([HAVE_PAM_LOGIN], [], ["Define to 1 if you use specific PAM session for sodo -i."])	
 +		AC_MSG_CHECKING(whether to use PAM login)
 +		AC_MSG_RESULT(yes)
 +		;;
diff --git a/sudo.spec b/sudo.spec
index ab68822..1953d12 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p4
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -15,6 +15,8 @@ BuildRequires: groff
 BuildRequires: openldap-devel
 BuildRequires: flex
 BuildRequires: bison
+BuildRequires: automake autoconf libtool
+BuildRequires: audit-libs-devel libcap-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
@@ -22,6 +24,9 @@ Patch1: sudo-1.6.7p5-strip.patch
 Patch2: sudo-1.6.9p4-login.patch
 # the rest, see changelog
 Patch3: sudo-1.6.9p4-getgrouplist.patch
+Patch4: sudo-1.6.9p4-autotoolsRecursion.patch
+Patch5: sudo-1.6.9p4-getprpwnam.patch
+Patch6: sudo-1.6.9p4-audit.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -39,6 +44,11 @@ on many different machines.
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .login
 %patch3 -p1 -b .getgrouplist
+%patch4 -p1 -b .autotoolsRecursion
+%patch5 -p1 -b .getprpwnam
+%patch6 -p1 -b .audit
+
+autoreconf
 
 %build
 %ifarch s390 s390x
@@ -47,10 +57,7 @@ F_PIE=-fPIE
 F_PIE=-fpie
 %endif
 
-# Note: there is a problem rebuild the ./configure script (for pam-login patch),
-# so we use -DHAVE_PAM_LOGIN rather than --with-pam-login...
-# (it's workaround that should be fixed)
-export CFLAGS="$RPM_OPT_FLAGS $F_PIE -DHAVE_PAM_LOGIN" LDFLAGS="-pie"
+export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
 
 %configure \
         --prefix=%{_prefix} \
@@ -59,6 +66,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE -DHAVE_PAM_LOGIN" LDFLAGS="-pie"
         --with-logging=syslog \
         --with-logfac=authpriv \
         --with-pam \
+	--with-pam-login \
         --with-editor=/bin/vi \
         --with-env-editor \
         --with-ignore-dot \
@@ -120,6 +128,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Thu Aug 30 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-2
+- fix autotools stuff and add audit support
+
 * Mon Aug 20 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-1
 - upgrade to upstream release
 

From 0f785efb048a7c32b6b0c009454cd2e86d2edb3a Mon Sep 17 00:00:00 2001
From: Bill Nottingham <notting@fedoraproject.org>
Date: Mon, 15 Oct 2007 19:24:45 +0000
Subject: [PATCH 003/199] makefile update to properly grab makefile.common

---
 Makefile | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index ee06314..19b4f18 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,21 @@
 # Makefile for source rpm: sudo
-# $Id$
+# $Id: Makefile,v 1.1 2004/09/09 12:46:19 cvsdist Exp $
 NAME := sudo
 SPECFILE = $(firstword $(wildcard *.spec))
 
-include ../common/Makefile.common
+define find-makefile-common
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+endef
+
+MAKEFILE_COMMON := $(shell $(find-makefile-common))
+
+ifeq ($(MAKEFILE_COMMON),)
+# attempt a checkout
+define checkout-makefile-common
+test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
+endef
+
+MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
+endif
+
+include $(MAKEFILE_COMMON)

From 75b6ccbe62dd080084235f30b2d387d6c1fdb07b Mon Sep 17 00:00:00 2001
From: Jesse Keating <jkeating@fedoraproject.org>
Date: Wed, 5 Dec 2007 19:29:30 +0000
Subject: [PATCH 004/199] - Rebuild for openssl bump

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 1953d12..e262f66 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p4
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -128,6 +128,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-3
+ - Rebuild for openssl bump
+
 * Thu Aug 30 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-2
 - fix autotools stuff and add audit support
 

From ebba253fbc46755d9d81e450711a8b3c3f140649 Mon Sep 17 00:00:00 2001
From: Jesse Keating <jkeating@fedoraproject.org>
Date: Wed, 5 Dec 2007 22:17:51 +0000
Subject: [PATCH 005/199] - Rebuild for deps

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index e262f66..ad2a404 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p4
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -128,6 +128,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-4
+ - Rebuild for deps
+
 * Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-3
  - Rebuild for openssl bump
 

From bb69e9d4366f66d8160589d6f9dfd6b82051316d Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Mon, 7 Jan 2008 18:31:40 +0000
Subject: [PATCH 006/199] fix 401201: sudo complains: audit_log_user_command():
 Connection refused

---
 sudo-1.6.9p4-audit.patch |  9 ++++++---
 sudo.spec                | 10 +++++++---
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/sudo-1.6.9p4-audit.patch b/sudo-1.6.9p4-audit.patch
index 6775ef7..148c2a6 100644
--- a/sudo-1.6.9p4-audit.patch
+++ b/sudo-1.6.9p4-audit.patch
@@ -75,9 +75,12 @@ diff -up sudo-1.6.9p4/audit_help.c.audit sudo-1.6.9p4/audit_help.c
 +	if (audit_fd < 0)
 +		return;
 +	else {
-+		err = audit_log_user_command (audit_fd, type, command, NULL, result);
-+		if( err <= 0 )
-+			perror("audit_log_user_command()");
++               err = audit_log_user_command (audit_fd, type, command, NULL, result);
++               /* The kernel supports auditing and we had
++                  enough privilege to write to the socket. */
++               if( err <= 0 && !(errno == EPERM && getuid() != 0) ) {
++                       perror("audit_log_user_command()");
++               }
 +	}
 +}
 +
diff --git a/sudo.spec b/sudo.spec
index ad2a404..951af42 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p4
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -128,11 +128,15 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Mon Jan 07 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-5
+- fix complains about audit_log_user_command(): Connection 
+  refused (#401201)
+
 * Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-4
- - Rebuild for deps
+- Rebuild for deps
 
 * Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-3
- - Rebuild for openssl bump
+- Rebuild for openssl bump
 
 * Thu Aug 30 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-2
 - fix autotools stuff and add audit support

From ac1c9e779332f85fc4c8047d0ee9cad21b44006e Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Mon, 7 Jan 2008 18:58:09 +0000
Subject: [PATCH 007/199] fix sudo-1.6.9p4-audit.patch

---
 sudo-1.6.9p4-audit.patch | 438 ++++++++++++++++++++-------------------
 1 file changed, 221 insertions(+), 217 deletions(-)

diff --git a/sudo-1.6.9p4-audit.patch b/sudo-1.6.9p4-audit.patch
index 148c2a6..0459b55 100644
--- a/sudo-1.6.9p4-audit.patch
+++ b/sudo-1.6.9p4-audit.patch
@@ -1,145 +1,86 @@
-diff -up sudo-1.6.9p4/audit_help.c.audit sudo-1.6.9p4/audit_help.c
---- sudo-1.6.9p4/audit_help.c.audit	2007-08-30 20:06:30.000000000 +0400
-+++ sudo-1.6.9p4/audit_help.c	2007-08-30 20:06:30.000000000 +0400
-@@ -0,0 +1,81 @@
-+/*
-+ *  Audit helper functions used throughout sudo
-+ *
-+ *  Copyright (C) 2007, Red Hat, Inc.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
-+ *    may be used to endorse or promote products derived from this software
-+ *    without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+
-+#include <config.h>
-+
-+#ifdef WITH_AUDIT
-+
-+#include <stdlib.h>
-+#include <syslog.h>
-+#include <stdarg.h>
-+#include <libaudit.h>
-+#include <errno.h>
-+#include <stdio.h>
-+
-+int audit_fd;
-+
-+void audit_help_open (void)
-+{
-+	audit_fd = audit_open ();
-+	if (audit_fd < 0) {
-+        	/* You get these only when the kernel doesn't have
-+                 * audit compiled in. */
-+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
-+		    errno == EAFNOSUPPORT)
-+			return;
-+		fprintf (stderr, "Cannot open audit interface - aborting.\n");
-+		exit (1);
-+	}
-+}
-+
-+/*
-+ * This function will log a message to the audit system using a predefined
-+ * message format. Parameter usage is as follows:
-+ *
-+ * type - type of message: AUDIT_USER_CMD
-+ * command - the command being logged
-+ * result - 1 is "success" and 0 is "failed"
-+ *
-+ */
-+void audit_logger (int type, const char *command, int result)
-+{
-+	int err;
-+
-+	if (audit_fd < 0)
-+		return;
-+	else {
-+               err = audit_log_user_command (audit_fd, type, command, NULL, result);
-+               /* The kernel supports auditing and we had
-+                  enough privilege to write to the socket. */
-+               if( err <= 0 && !(errno == EPERM && getuid() != 0) ) {
-+                       perror("audit_log_user_command()");
-+               }
-+	}
-+}
-+
-+#endif                         /* WITH_AUDIT */
-+
-diff -up sudo-1.6.9p4/Makefile.in.audit sudo-1.6.9p4/Makefile.in
---- sudo-1.6.9p4/Makefile.in.audit	2007-08-15 18:16:57.000000000 +0400
-+++ sudo-1.6.9p4/Makefile.in	2007-08-30 20:06:30.000000000 +0400
-@@ -118,11 +118,13 @@ HDRS = compat.h def_data.h defaults.h in
- 
- AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
- 
-+AUDIT_OBJS = audit_help.o 
-+
- PARSEOBJS = sudo.tab.o lex.yy.o alloc.o defaults.o
- 
- SUDOBJS = check.o env.o getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
- 	  interfaces.o logging.o parse.o set_perms.o sudo.o sudo_edit.o \
--	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS)
-+	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS) $(AUDIT_OBJS)
- 
- VISUDOBJS = visudo.o fileops.o gettime.o goodpath.o find_path.o $(PARSEOBJS)
- 
-@@ -273,6 +275,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
- sia.o: $(authdir)/sia.c $(AUTHDEP)
- 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
- 
-+audit_help.o: audit_help.c sudo.h
-+	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
-+
- sudo.man.in: $(srcdir)/sudo.pod
- 	@rm -f $(srcdir)/$@
- 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e 1d -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" >> $@ )
-diff -up sudo-1.6.9p4/sudo.h.audit sudo-1.6.9p4/sudo.h
---- sudo-1.6.9p4/sudo.h.audit	2007-08-30 20:06:30.000000000 +0400
-+++ sudo-1.6.9p4/sudo.h	2007-08-30 20:06:30.000000000 +0400
-@@ -23,6 +23,8 @@
- #ifndef _SUDO_SUDO_H
- #define _SUDO_SUDO_H
- 
-+#include <config.h>
-+
- #include <pathnames.h>
- #include <limits.h>
- #include "compat.h"
-@@ -274,4 +276,10 @@ extern int sudo_mode;
- extern int errno;
+diff -up sudo-1.6.9p4/set_perms.c.audit sudo-1.6.9p4/set_perms.c
+--- sudo-1.6.9p4/set_perms.c.audit	2007-07-06 16:16:22.000000000 +0200
++++ sudo-1.6.9p4/set_perms.c	2008-01-07 19:52:41.000000000 +0100
+@@ -53,6 +53,10 @@
+ #ifdef HAVE_LOGIN_CAP_H
+ # include <login_cap.h>
  #endif
- 
-+#ifdef WITH_AUDIT
-+extern int audit_fd;
-+extern void audit_help_open (void);
-+extern void audit_logger (int, const char *, int);
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++# include <sys/prctl.h>
++# include <sys/capability.h>
 +#endif
+ 
+ #include "sudo.h"
+ 
+@@ -101,22 +105,55 @@ set_perms(perm)
+ 				if (setresuid(user_uid, user_uid, user_uid))
+ 				    err(1, "setresuid(user_uid, user_uid, user_uid)");
+ 			      	break;
+-				
 +
- #endif /* _SUDO_SUDO_H */
++        case PERM_FULL_RUNAS:
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++                                { /* BEGIN CAP BLOCK */
++                                cap_t new_caps;
++                                cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
++ 
++                                if (runas_pw->pw_uid != ROOT_UID) {
++                                    new_caps = cap_init ();
++                                    if (!new_caps)
++                                        err(1, "Error initing capabilities, aborting.\n");
++                                    
++                                    if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
++                                       cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
++                                         err(1, "Error setting capabilities, aborting\n");   
++                                    }
++                                                                
++                                    if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0))
++                                        err(1, "Error setting KEEPCAPS, aborting\n");
++                                }
++#endif                          
++                                /* headed for exec(), assume euid == ROOT_UID */                                      
++                                runas_setup ();
++                                if (setresuid(def_stay_setuid ? 
++                                    user_uid : runas_pw->pw_uid,
++                                    runas_pw->pw_uid, runas_pw->pw_uid))
++                                    err(1, "unable to change to runas uid");
++
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++                                if (runas_pw->pw_uid != ROOT_UID) {
++                                    if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0)
++                                        err(1, "Error resetting KEEPCAPS, aborting\n");
++                                
++                                    if (cap_set_proc(new_caps))
++                                        err(1, "Error dropping capabilities, aborting\n");
++                            
++                                    if (cap_free (new_caps))
++                                        err(1, "Error freeing caps\n");                        
++                                }
++	                        } /* END CAP BLOCK */
++#endif
++	                         break;
++
+ 	case PERM_RUNAS:
+ 				(void) setresgid(-1, runas_pw->pw_gid, -1);
+ 				if (setresuid(-1, runas_pw->pw_uid, -1))
+ 				    err(1, "unable to change to runas uid");
+ 			      	break;
+ 
+-	case PERM_FULL_RUNAS:
+-				/* headed for exec(), assume euid == ROOT_UID */
+-				runas_setup();
+-				if (setresuid(def_stay_setuid ?
+-				    user_uid : runas_pw->pw_uid,
+-				    runas_pw->pw_uid, runas_pw->pw_uid))
+-				    err(1, "unable to change to runas uid");
+-				break;
+-
+ 	case PERM_SUDOERS:
+ 				/* assume euid == ROOT_UID, ruid == user */
+ 				if (setresgid(-1, SUDOERS_GID, -1))
 diff -up sudo-1.6.9p4/sudo.c.audit sudo-1.6.9p4/sudo.c
---- sudo-1.6.9p4/sudo.c.audit	2007-08-30 20:06:30.000000000 +0400
-+++ sudo-1.6.9p4/sudo.c	2007-08-30 20:18:26.000000000 +0400
+--- sudo-1.6.9p4/sudo.c.audit	2008-01-07 19:52:41.000000000 +0100
++++ sudo-1.6.9p4/sudo.c	2008-01-07 19:52:41.000000000 +0100
 @@ -97,6 +97,10 @@
  # include <sys/task.h>
  #endif
@@ -280,8 +221,8 @@ diff -up sudo-1.6.9p4/sudo.c.audit sudo-1.6.9p4/sudo.c
  	exit(127);
      } else if (ISSET(validated, FLAG_NO_USER) || (validated & FLAG_NO_HOST)) {
 diff -up sudo-1.6.9p4/configure.in.audit sudo-1.6.9p4/configure.in
---- sudo-1.6.9p4/configure.in.audit	2007-08-30 20:06:30.000000000 +0400
-+++ sudo-1.6.9p4/configure.in	2007-08-30 20:06:30.000000000 +0400
+--- sudo-1.6.9p4/configure.in.audit	2008-01-07 19:52:41.000000000 +0100
++++ sudo-1.6.9p4/configure.in	2008-01-07 19:52:41.000000000 +0100
 @@ -150,6 +150,10 @@ dnl
  dnl Options for --with
  dnl
@@ -319,83 +260,146 @@ diff -up sudo-1.6.9p4/configure.in.audit sudo-1.6.9p4/configure.in
  dnl
  dnl Add in any libpaths or libraries specified via configure
  dnl
-diff -up sudo-1.6.9p4/set_perms.c.audit sudo-1.6.9p4/set_perms.c
---- sudo-1.6.9p4/set_perms.c.audit	2007-07-06 18:16:22.000000000 +0400
-+++ sudo-1.6.9p4/set_perms.c	2007-08-30 20:06:30.000000000 +0400
-@@ -53,6 +53,10 @@
- #ifdef HAVE_LOGIN_CAP_H
- # include <login_cap.h>
+diff -up /dev/null sudo-1.6.9p4/audit_help.c
+--- /dev/null	2008-01-04 00:33:16.572612675 +0100
++++ sudo-1.6.9p4/audit_help.c	2008-01-07 19:55:40.000000000 +0100
+@@ -0,0 +1,88 @@
++/*
++ *  Audit helper functions used throughout sudo
++ *
++ *  Copyright (C) 2007, Red Hat, Inc.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
++ *    may be used to endorse or promote products derived from this software
++ *    without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ */
++
++#include <config.h>
++
++#ifdef WITH_AUDIT
++
++#include <stdlib.h>
++#include <syslog.h>
++#include <stdarg.h>
++#include <libaudit.h>
++#include <errno.h>
++#include <stdio.h>
++#include <unistd.h>
++#include <sys/types.h>
++
++int audit_fd;
++
++void audit_help_open (void)
++{
++	audit_fd = audit_open ();
++	if (audit_fd < 0) {
++        	/* You get these only when the kernel doesn't have
++                 * audit compiled in. */
++		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
++		    errno == EAFNOSUPPORT)
++			return;
++		fprintf (stderr, "Cannot open audit interface - aborting.\n");
++		exit (1);
++	}
++}
++
++/*
++ * This function will log a message to the audit system using a predefined
++ * message format. Parameter usage is as follows:
++ *
++ * type - type of message: AUDIT_USER_CMD
++ * command - the command being logged
++ * result - 1 is "success" and 0 is "failed"
++ *
++ */
++void audit_logger (int type, const char *command, int result)
++{
++	int err;
++
++	if (audit_fd < 0)
++		return;
++	else {
++               err = audit_log_user_command (audit_fd, type, command, NULL, result);
++               /* The kernel supports auditing and we had
++                  enough privilege to write to the socket. */
++               if( err <= 0 && !(errno == EPERM && getuid() != 0) ) {
++                       perror("audit_log_user_command()");
++               }
++	}
++}
++
++
++#endif                         /* WITH_AUDIT */
++
++
+diff -up sudo-1.6.9p4/Makefile.in.audit sudo-1.6.9p4/Makefile.in
+--- sudo-1.6.9p4/Makefile.in.audit	2007-08-15 16:16:57.000000000 +0200
++++ sudo-1.6.9p4/Makefile.in	2008-01-07 19:52:41.000000000 +0100
+@@ -118,11 +118,13 @@ HDRS = compat.h def_data.h defaults.h in
+ 
+ AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
+ 
++AUDIT_OBJS = audit_help.o 
++
+ PARSEOBJS = sudo.tab.o lex.yy.o alloc.o defaults.o
+ 
+ SUDOBJS = check.o env.o getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
+ 	  interfaces.o logging.o parse.o set_perms.o sudo.o sudo_edit.o \
+-	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS)
++	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS) $(AUDIT_OBJS)
+ 
+ VISUDOBJS = visudo.o fileops.o gettime.o goodpath.o find_path.o $(PARSEOBJS)
+ 
+@@ -273,6 +275,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
+ sia.o: $(authdir)/sia.c $(AUTHDEP)
+ 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
+ 
++audit_help.o: audit_help.c sudo.h
++	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
++
+ sudo.man.in: $(srcdir)/sudo.pod
+ 	@rm -f $(srcdir)/$@
+ 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e 1d -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" >> $@ )
+diff -up sudo-1.6.9p4/sudo.h.audit sudo-1.6.9p4/sudo.h
+--- sudo-1.6.9p4/sudo.h.audit	2008-01-07 19:52:41.000000000 +0100
++++ sudo-1.6.9p4/sudo.h	2008-01-07 19:52:41.000000000 +0100
+@@ -23,6 +23,8 @@
+ #ifndef _SUDO_SUDO_H
+ #define _SUDO_SUDO_H
+ 
++#include <config.h>
++
+ #include <pathnames.h>
+ #include <limits.h>
+ #include "compat.h"
+@@ -274,4 +276,10 @@ extern int sudo_mode;
+ extern int errno;
  #endif
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+# include <sys/prctl.h>
-+# include <sys/capability.h>
+ 
++#ifdef WITH_AUDIT
++extern int audit_fd;
++extern void audit_help_open (void);
++extern void audit_logger (int, const char *, int);
 +#endif
- 
- #include "sudo.h"
- 
-@@ -101,22 +105,55 @@ set_perms(perm)
- 				if (setresuid(user_uid, user_uid, user_uid))
- 				    err(1, "setresuid(user_uid, user_uid, user_uid)");
- 			      	break;
--				
 +
-+        case PERM_FULL_RUNAS:
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+                                { /* BEGIN CAP BLOCK */
-+                                cap_t new_caps;
-+                                cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
-+ 
-+                                if (runas_pw->pw_uid != ROOT_UID) {
-+                                    new_caps = cap_init ();
-+                                    if (!new_caps)
-+                                        err(1, "Error initing capabilities, aborting.\n");
-+                                    
-+                                    if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
-+                                       cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
-+                                         err(1, "Error setting capabilities, aborting\n");   
-+                                    }
-+                                                                
-+                                    if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0))
-+                                        err(1, "Error setting KEEPCAPS, aborting\n");
-+                                }
-+#endif                          
-+                                /* headed for exec(), assume euid == ROOT_UID */                                      
-+                                runas_setup ();
-+                                if (setresuid(def_stay_setuid ? 
-+                                    user_uid : runas_pw->pw_uid,
-+                                    runas_pw->pw_uid, runas_pw->pw_uid))
-+                                    err(1, "unable to change to runas uid");
-+
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+                                if (runas_pw->pw_uid != ROOT_UID) {
-+                                    if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0)
-+                                        err(1, "Error resetting KEEPCAPS, aborting\n");
-+                                
-+                                    if (cap_set_proc(new_caps))
-+                                        err(1, "Error dropping capabilities, aborting\n");
-+                            
-+                                    if (cap_free (new_caps))
-+                                        err(1, "Error freeing caps\n");                        
-+                                }
-+	                        } /* END CAP BLOCK */
-+#endif
-+	                         break;
-+
- 	case PERM_RUNAS:
- 				(void) setresgid(-1, runas_pw->pw_gid, -1);
- 				if (setresuid(-1, runas_pw->pw_uid, -1))
- 				    err(1, "unable to change to runas uid");
- 			      	break;
- 
--	case PERM_FULL_RUNAS:
--				/* headed for exec(), assume euid == ROOT_UID */
--				runas_setup();
--				if (setresuid(def_stay_setuid ?
--				    user_uid : runas_pw->pw_uid,
--				    runas_pw->pw_uid, runas_pw->pw_uid))
--				    err(1, "unable to change to runas uid");
--				break;
--
- 	case PERM_SUDOERS:
- 				/* assume euid == ROOT_UID, ruid == user */
- 				if (setresgid(-1, SUDOERS_GID, -1))
+ #endif /* _SUDO_SUDO_H */

From eb965f41520bc48aecc709e8ca285680c7428fa4 Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <ausil@fedoraproject.org>
Date: Mon, 4 Feb 2008 08:30:14 +0000
Subject: [PATCH 008/199] add sparc64 to the list of arches that need -fPIE

---
 sudo.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 951af42..c29eea1 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p4
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -51,7 +51,7 @@ on many different machines.
 autoreconf
 
 %build
-%ifarch s390 s390x
+%ifarch s390 s390x sparc64
 F_PIE=-fPIE
 %else
 F_PIE=-fpie
@@ -128,6 +128,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Mon Feb 02 2008 Dennis Gilmore <dennis@ausil.us> 1.6.9p4-6
+- sparc64 needs to be in the -fPIE list with s390
+
 * Mon Jan 07 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-5
 - fix complains about audit_log_user_command(): Connection 
   refused (#401201)

From 6dfc39bc613b98d76c76d4bd5dc3a557d8ff51fa Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Wed, 6 Feb 2008 12:43:43 +0000
Subject: [PATCH 009/199] - upgrade to the latest upstream release - add
 selinux support

---
 .cvsignore                            |   2 +-
 sources                               |   2 +-
 sudo-1.6.9p12-noPam.patch             |  12 +
 sudo-1.6.9p12-selinux.patch           | 672 ++++++++++++++++++++++++++
 sudo-1.6.9p4-audit.patch              | 144 +++---
 sudo-1.6.9p4-autotoolsRecursion.patch |  41 --
 sudo-1.6.9p4-getprpwnam.patch         |  12 -
 sudo.spec                             |  20 +-
 8 files changed, 764 insertions(+), 141 deletions(-)
 create mode 100644 sudo-1.6.9p12-noPam.patch
 create mode 100644 sudo-1.6.9p12-selinux.patch
 delete mode 100644 sudo-1.6.9p4-autotoolsRecursion.patch
 delete mode 100644 sudo-1.6.9p4-getprpwnam.patch

diff --git a/.cvsignore b/.cvsignore
index d497c72..b062bed 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
-sudo-1.6.9p4.tar.gz
 sudo-1.6.8p12-sudoers
+sudo-1.6.9p12.tar.gz
diff --git a/sources b/sources
index 48eb9d9..033787a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-5439d24b48db69d2b6b42e97b47fdfd6  sudo-1.6.9p4.tar.gz
 3dad7cdd28925f9bdf387510961f8e9f  sudo-1.6.8p12-sudoers
+a5795c292e5c64dd9f7bcba8c1c712c9  sudo-1.6.9p12.tar.gz
diff --git a/sudo-1.6.9p12-noPam.patch b/sudo-1.6.9p12-noPam.patch
new file mode 100644
index 0000000..c57e171
--- /dev/null
+++ b/sudo-1.6.9p12-noPam.patch
@@ -0,0 +1,12 @@
+diff -up sudo-1.6.9p12/configure.in.noPam sudo-1.6.9p12/configure.in
+--- sudo-1.6.9p12/configure.in.noPam	2008-02-05 13:52:07.000000000 +0100
++++ sudo-1.6.9p12/configure.in	2008-02-05 13:52:25.000000000 +0100
+@@ -1842,7 +1842,7 @@ if test ${with_pam-"no"} != "no"; then
+ 		yes)	AC_MSG_RESULT(yes)
+ 			;;
+ 		no)		AC_MSG_RESULT(no)
+-			    AC_DEFINE(NO_PAM_SESSION)
++			    AC_DEFINE([NO_PAM_SESSION], [], [PAM session support disabled])
+ 			    ;;
+ 		*)		AC_MSG_RESULT(no)
+ 			    AC_MSG_WARN([Ignoring unknown argument to --enable-pam-session: $enableval])
diff --git a/sudo-1.6.9p12-selinux.patch b/sudo-1.6.9p12-selinux.patch
new file mode 100644
index 0000000..aecd865
--- /dev/null
+++ b/sudo-1.6.9p12-selinux.patch
@@ -0,0 +1,672 @@
+diff -up /dev/null sudo-1.6.9p12/sesh.c
+--- /dev/null	2008-02-05 17:16:01.642928004 +0100
++++ sudo-1.6.9p12/sesh.c	2008-02-06 13:06:50.000000000 +0100
+@@ -0,0 +1,46 @@
++#include <stdio.h>
++#include <unistd.h>
++#include <limits.h>
++#include <sys/types.h>
++#include <sys/wait.h>
++#include <errno.h>
++
++main (int argc, char **argv) {
++  char buf[PATH_MAX];
++  pid_t pid;
++  if ( argc < 2 ) {
++    fprintf(stderr,"%s: Requires at least one argument\n", argv[0]);
++    exit(-1);
++  }
++
++  if ((pid = fork()) < 0) {
++    snprintf(buf, sizeof(buf), "%s: Couldn't fork",argv[0]);
++    perror(buf);
++    exit(-1);
++  } else if (pid > 0) {
++    /* Parent */
++    int status;
++    int ret;
++
++    do {
++      if ((ret = waitpid(pid, &status, 0)) < 0 && errno == EINTR)
++        continue;
++      else if (ret < 0) {
++        perror("waitpid failed");
++        exit(1);
++      }
++    } while (0);
++
++    if (WIFEXITED(status))
++      exit(WEXITSTATUS(status));
++    else
++      exit(1);
++  } else {
++    /* Child */
++    execv(argv[1], &argv[1]);
++
++    snprintf(buf, sizeof(buf), "%s: Error execing %s", argv[0], argv[1]);
++    perror(buf);
++    exit(-1);
++  }
++}
+diff -up sudo-1.6.9p12/configure.in.selinux sudo-1.6.9p12/configure.in
+--- sudo-1.6.9p12/configure.in.selinux	2008-02-06 12:45:07.000000000 +0100
++++ sudo-1.6.9p12/configure.in	2008-02-06 13:06:50.000000000 +0100
+@@ -102,7 +102,7 @@ dnl
+ dnl Initial values for Makefile variables listed above
+ dnl May be overridden by environment variables..
+ dnl
+-PROGS="sudo visudo"
++PROGS="sudo visudo sesh"
+ : ${MANTYPE='man'}
+ : ${mansrcdir='.'}
+ : ${SUDOERS_MODE='0440'}
+diff -up /dev/null sudo-1.6.9p12/selinux.c
+--- /dev/null	2008-02-05 17:16:01.642928004 +0100
++++ sudo-1.6.9p12/selinux.c	2008-02-06 13:06:50.000000000 +0100
+@@ -0,0 +1,425 @@
++/*
++ * Copyright (c) 2008 Dan Walsh <dwalsh@redhat.com>
++ *
++ * Borrowed heavily from newrole source code
++ * Authors:
++ *      Anthony Colatrella
++ *	Tim Fraser
++ *	Steve Grubb <sgrubb@redhat.com>
++ *	Darrel Goeddel <DGoeddel@trustedcs.com>
++ *	Michael Thompson <mcthomps@us.ibm.com>
++ *	Dan Walsh <dwalsh@redhat.com>
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ *
++ */
++#ifdef WITH_SELINUX
++#include <config.h>
++#include <sys/types.h>
++#include <stdio.h>
++#ifdef STDC_HEADERS
++# include <stdlib.h>
++# include <stddef.h>
++#else
++# ifdef HAVE_STDLIB_H
++#  include <stdlib.h>
++# endif
++#endif /* STDC_HEADERS */
++#ifdef HAVE_STRING_H
++# if defined(HAVE_MEMORY_H) && !defined(STDC_HEADERS)
++#  include <memory.h>
++# endif
++# include <string.h>
++#else
++# ifdef HAVE_STRINGS_H
++#  include <strings.h>
++# endif
++#endif /* HAVE_STRING_H */
++#ifdef HAVE_UNISTD_H
++# include <unistd.h>
++#endif /* HAVE_UNISTD_H */
++#include <errno.h>
++#include <fcntl.h>
++#include <signal.h>
++
++#ifdef WITH_AUDIT
++#include <libaudit.h>
++#endif
++
++#include "sudo.h"
++
++#include <sys/wait.h>
++
++#ifdef USE_AUDIT
++#include <libaudit.h>
++#endif
++
++#include <selinux/flask.h>             /* for SECCLASS_CHR_FILE */
++#include <selinux/selinux.h>           /* for is_selinux_enabled() */
++#include <selinux/context.h>           /* for context-mangling functions */
++#include <selinux/get_default_type.h>
++#include <selinux/get_context_list.h>
++
++/**
++ * This function attempts to revert the relabeling done to the tty.
++ * fd   - referencing the opened ttyn
++ * ttyn - name of tty to restore
++ * tty_context     - original context of the tty
++ * new_tty_context - context tty was relabeled to
++ *
++ * Returns zero on success, non-zero otherwise
++ */
++static int restore_tty_label(int fd, const char *ttyn,
++			     security_context_t tty_context,
++			     security_context_t new_tty_context)
++{
++	int rc = 0;
++	security_context_t chk_tty_context = NULL;
++
++	if (!ttyn)
++		goto skip_relabel;
++
++	if (!new_tty_context)
++		goto skip_relabel;
++
++	/* Verify that the tty still has the context set by newrole. */
++	if ((rc = fgetfilecon(fd, &chk_tty_context)) < 0) {
++		fprintf(stderr, "Could not fgetfilecon %s.\n", ttyn);
++		goto skip_relabel;
++	}
++
++	if ((rc = strcmp(chk_tty_context, new_tty_context))) {
++		fprintf(stderr, "%s changed labels.\n", ttyn);
++		goto skip_relabel;
++	}
++
++	if ((rc = fsetfilecon(fd, tty_context)) < 0)
++		fprintf(stderr,
++			"Warning! Could not restore context for %s\n", ttyn);
++      skip_relabel:
++	freecon(chk_tty_context);
++	return rc;
++}
++
++/**
++ * This function attempts to relabel the tty. If this function fails, then
++ * the fd is closed, the contexts are free'd and -1 is returned. On success,
++ * a valid fd is returned and tty_context and new_tty_context are set.
++ *
++ * This function will not fail if it can not relabel the tty when selinux is
++ * in permissive mode.
++ */
++static int relabel_tty(const char *ttyn, security_context_t new_context,
++		       security_context_t * tty_context,
++		       security_context_t * new_tty_context)
++{
++	int fd;
++	int enforcing = security_getenforce();
++	security_context_t tty_con = NULL;
++	security_context_t new_tty_con = NULL;
++
++	if (!ttyn)
++		return 0;
++
++	if (enforcing < 0) {
++		fprintf(stderr, "Could not determine enforcing mode.\n");
++		return -1;
++	}
++
++	/* Re-open TTY descriptor */
++	fd = open(ttyn, O_RDWR | O_NONBLOCK);
++	if (fd < 0) {
++		fprintf(stderr, "Error!  Could not open %s.\n", ttyn);
++		return fd;
++	}
++	fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
++
++	if (fgetfilecon(fd, &tty_con) < 0) {
++		fprintf(stderr, "%s!  Could not get current context "
++				  "for %s, not relabeling tty.\n",
++			enforcing ? "Error" : "Warning", ttyn);
++		if (enforcing)
++			goto close_fd;
++	}
++
++	if (tty_con &&
++	    (security_compute_relabel(new_context, tty_con,
++				      SECCLASS_CHR_FILE, &new_tty_con) < 0)) {
++		fprintf(stderr, "%s!  Could not get new context for %s, "
++				  "not relabeling tty.\n",
++			enforcing ? "Error" : "Warning", ttyn);
++		if (enforcing)
++			goto close_fd;
++	}
++
++	if (new_tty_con)
++		if (fsetfilecon(fd, new_tty_con) < 0) {
++			fprintf(stderr,
++				"%s!  Could not set new context for %s\n",
++				enforcing ? "Error" : "Warning", ttyn);
++			freecon(new_tty_con);
++			new_tty_con = NULL;
++			if (enforcing)
++				goto close_fd;
++		}
++
++	*tty_context = tty_con;
++	*new_tty_context = new_tty_con;
++	return fd;
++
++      close_fd:
++	freecon(tty_con);
++	close(fd);
++	return -1;
++}
++
++security_context_t get_exec_context(security_context_t old_context, char *role_s, char *type_s) {
++
++  /* our target security ID ("sid") */
++  security_context_t new_context=NULL; 
++
++  /* manipulatable form of context_s */
++  context_t context;                 
++  
++  if( !role_s ) {
++    fprintf(stderr,"You must specify a role.\n");
++    return NULL;
++  }
++	  
++  
++  /*
++   * Get the SID and context of the caller, and extract
++   * the username from the context.  Don't rely on the Linux
++   * uid information - it isn't trustworthy.
++   */
++  
++  /* 
++   * Create a context structure so that we extract and modify 
++   * components easily. 
++   */
++  context=context_new(old_context);
++  
++  /*
++   *
++   * Step 3:  Construct a new SID based on our old SID and the
++   *          arguments specified on the command line.
++   *
++   */
++  
++  /* The first step in constructing a new SID for the new shell we  *
++   * plan to exec is to take our old context in `context' as a   *
++   * starting point, and modify it according to the options the user *
++   * specified on the command line.                                  */
++
++  /* If the user specified a new role on the command line (if `role_s'   *
++   * is set), then replace the old role in `context' with this new role. */
++  if( !type_s ) {
++    if( get_default_type(role_s,&type_s) )
++      {
++        fprintf(stderr,"Couldn't get default type.\n");
++	goto err;
++      }
++    }
++    
++  if( context_role_set(context,role_s)) {
++    fprintf(stderr,"failed to set new role %s\n",role_s);
++    goto err;
++  }
++    
++  /* If the user specified a new type on the command line (if `type_s'   *
++   * is set), then replace the old type in `context' with this new type. */
++  if( type_s ) {
++    if( context_type_set(context,type_s)) {
++      fprintf(stderr,"failed to set new type %s\n",type_s);
++      goto err;
++    }
++  } /* if user specified new type */
++    
++  /* The second step in creating the new SID is to convert our modified *
++   * `context' structure back to a context string and then to a SID.    */
++    
++  /* Make `context_s' point to a string version of the new `context'.  */
++  if( !(new_context=strdup(context_str(context)))) {
++    fprintf(stderr,"failed to convert new context to string\n" );
++    goto err;
++  }
++
++  if (security_check_context(new_context) < 0) {
++    fprintf(stderr, "%s is not a valid context\n", new_context);
++    goto err;
++  }
++
++#ifdef DEBUG
++  printf("Your new context is %s\n",new_context);
++#endif
++
++  context_free(context);
++  return new_context;
++
++ err:
++  context_free(context);
++  freecon(new_context);
++  return NULL;
++
++}
++
++void selinux_exec(char *role_s, char *type_s, char *safe_cmd, int NewArgc, char **NewArgv, char **environ){ 
++  pid_t childPid = 0;
++  int ttyfd = -1;
++  /* our original securiy ID ("old_context") */
++  security_context_t old_context=NULL;	
++
++  /* security context to change to while running command*/
++  security_context_t new_tty_context=NULL; 
++  /* current security context of tty */
++  security_context_t tty_context=NULL;  
++
++  char *ttyn = NULL;	/* tty path */
++  
++  /* our target security ID ("sid") */
++  security_context_t new_context=NULL;
++  /* Put the caller's SID into `old_context'. */
++  if (getprevcon(&old_context)) {
++    fprintf(stderr,"failed to get old_context.\n");
++    exit(-1);
++  }
++  
++#ifdef DEBUG
++  printf( "Your old context was %s\n", old_context );
++#endif
++  new_context=get_exec_context(old_context, role_s,type_s);
++  if (! new_context) {
++	  fprintf(stderr, "Could not set exec context to %s.\n", new_context);
++	  exit(-1);
++  }
++  
++  ttyn = ttyname(STDIN_FILENO);
++  if (!ttyn || *ttyn == '\0') {
++	  fprintf(stderr,
++		  "Warning!  Could not retrieve tty information.\n");
++  }
++  
++  ttyfd = relabel_tty(ttyn, new_context, &tty_context, &new_tty_context);
++  if (ttyfd < 0) {
++	  fprintf(stderr, "Could not setup tty context for %s.\n", new_context);
++	  exit(-1);
++  }
++
++#ifdef DEBUG
++  printf("Your old tty context is %s\n",tty_context);
++  printf("Your new tty context is %s\n",new_tty_context);
++#endif
++
++
++  childPid = fork();
++  if (childPid < 0) {
++	  /* fork failed, no child to worry about */
++	  int errsv = errno;
++	  fprintf(stderr, "newrole: failure forking: %s",
++		  strerror(errsv));
++	  if (restore_tty_label(ttyfd, ttyn, tty_context, new_tty_context))
++		  fprintf(stderr, "Unable to restore tty label...\n");
++	  if (close(ttyfd))
++		  fprintf(stderr, "Failed to close tty properly\n");
++	  goto err;
++  } else if (childPid) {
++	  /* PARENT
++	   * It doesn't make senes to exit early on errors at this point,
++	   * since we are doing cleanup which needs to be done.
++	   * We can exit with a bad rc though
++	   */
++	  pid_t pid;
++	  int exit_code = 0;
++	  int status;
++	  
++	  do {
++		  pid = wait(&status);
++	  } while (pid < 0 && errno == EINTR);
++	  
++	  /* Preserve child exit status, unless there is another error. */
++	  if (WIFEXITED(status))
++		  exit_code = WEXITSTATUS(status);
++	  
++	  if (restore_tty_label(ttyfd, ttyn, tty_context, new_tty_context)) {
++		  fprintf(stderr, "Unable to restore tty label...\n");
++		  exit_code = -1;
++	  }
++	  freecon(tty_context);
++	  freecon(new_tty_context);
++	  if (close(ttyfd)) {
++		  fprintf(stderr, "Failed to close tty properly\n");
++		  exit_code = -1;
++	  }
++	  exit(exit_code);
++  }
++  /* CHILD */
++  /* Close the tty and reopen descriptors 0 through 2 */
++  if (ttyn) {
++    if (close(ttyfd) || close(0) || close(1) || close(2)) {
++	    fprintf(stderr, "Could not close descriptors.\n");
++	    goto err;
++    }
++    ttyfd = open(ttyn, O_RDONLY | O_NONBLOCK);
++    if (ttyfd != 0)
++	    goto err;
++    fcntl(ttyfd, F_SETFL, fcntl(ttyfd, F_GETFL, 0) & ~O_NONBLOCK);
++    ttyfd = open(ttyn, O_RDWR | O_NONBLOCK);
++    if (ttyfd != 1)
++	    goto err;
++    fcntl(ttyfd, F_SETFL, fcntl(ttyfd, F_GETFL, 0) & ~O_NONBLOCK);
++    ttyfd = open(ttyn, O_RDWR | O_NONBLOCK);
++    if (ttyfd != 2)
++	    goto err;
++    fcntl(ttyfd, F_SETFL, fcntl(ttyfd, F_GETFL, 0) & ~O_NONBLOCK);
++  }
++  if (setexeccon(new_context)) {
++	  fprintf(stderr, "Could not set exec context to %s.\n",
++		  new_context);
++	  goto err;
++  }
++
++#ifdef USE_AUDIT
++  if (send_audit_message(1, old_context, new_context, ttyn)) 
++    goto err;
++#endif
++
++  {
++    /* 
++       SELinux will only not transition properly with the following
++       code.  Basically if the user chooses to use a different security
++       context.  We need to start the selinux shell, before executing 
++       the command.  This way the process transition will happen 
++       correctly. For example if they user wants to run rpm from 
++       sysadm_r.  Sudo will exec the /usr/sbin/sesh followed by the 
++       specified command.*/
++     char **dst, **src = NewArgv+1;
++     NewArgv = (char **) emalloc2((++NewArgc + 1), sizeof(char *));
++     NewArgv[0] = estrdup("/usr/sbin/sesh");
++     NewArgv[1] = safe_cmd;
++     safe_cmd = estrdup("/usr/sbin/sesh");
++     /* copy the args from Argv */
++     for (dst = NewArgv + 2; (*dst = *src) != NULL; ++src, ++dst)
++	     ;
++  }
++  freecon(old_context);
++  freecon(new_context);
++
++  execve(safe_cmd, NewArgv, environ);	/* run the command */
++  
++  perror("failed to exec shell\n");
++ err:
++  freecon(old_context);
++  freecon(new_context);
++  exit(-1);
++}
++#endif /* WITH_SELINUX */
+diff -up sudo-1.6.9p12/Makefile.in.selinux sudo-1.6.9p12/Makefile.in
+--- sudo-1.6.9p12/Makefile.in.selinux	2008-02-06 12:45:07.000000000 +0100
++++ sudo-1.6.9p12/Makefile.in	2008-02-06 13:08:50.000000000 +0100
+@@ -43,7 +43,8 @@ INSTALL = $(SHELL) $(srcdir)/install-sh 
+ # Libraries
+ LIBS = @LIBS@
+ NET_LIBS = @NET_LIBS@
+-SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS)
++SELINUX_LIBS = -lselinux
++SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS) $(SELINUX_LIBS)
+ 
+ # C preprocessor flags
+ CPPFLAGS = -I. -I$(srcdir) @CPPFLAGS@
+@@ -91,7 +92,7 @@ sudoers_gid = @SUDOERS_GID@
+ sudoers_mode = @SUDOERS_MODE@
+ 
+ # Pass in paths and uid/gid + OS dependent defined
+-DEFS = @OSDEFS@ -D_PATH_SUDOERS=\"$(sudoersdir)/sudoers\" -D_PATH_SUDOERS_TMP=\"$(sudoersdir)/sudoers.tmp\" -DSUDOERS_UID=$(sudoers_uid) -DSUDOERS_GID=$(sudoers_gid) -DSUDOERS_MODE=$(sudoers_mode)
++DEFS = @OSDEFS@ -D_PATH_SUDOERS=\"$(sudoersdir)/sudoers\" -D_PATH_SUDOERS_TMP=\"$(sudoersdir)/sudoers.tmp\" -DSUDOERS_UID=$(sudoers_uid) -DSUDOERS_GID=$(sudoers_gid) -DSUDOERS_MODE=$(sudoers_mode) -DWITH_SELINUX
+ 
+ #### End of system configuration section. ####
+ 
+@@ -105,7 +106,7 @@ SRCS = alloc.c alloca.c check.c closefro
+        logging.c memrchr.c mkstemp.c parse.c parse.lex parse.yacc set_perms.c \
+        sigaction.c snprintf.c strcasecmp.c strerror.c strlcat.c strlcpy.c \
+        sudo.c sudo_noexec.c sudo.tab.c sudo_edit.c testsudoers.c tgetpass.c \
+-       utimes.c visudo.c zero_bytes.c $(AUTH_SRCS)
++       utimes.c visudo.c zero_bytes.c $(AUTH_SRCS) selinux.c sesh.c
+ 
+ AUTH_SRCS = auth/afs.c auth/aix_auth.c auth/bsdauth.c auth/dce.c auth/fwtk.c \
+ 	    auth/kerb4.c auth/kerb5.c auth/pam.c auth/passwd.c auth/rfc1938.c \
+@@ -124,11 +125,13 @@ AUDIT_OBJS = audit_help.o 
+ PARSEOBJS = sudo.tab.o lex.yy.o alloc.o defaults.o
+ 
+ SUDOBJS = check.o env.o getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
+-	  interfaces.o logging.o parse.o set_perms.o sudo.o sudo_edit.o \
++	  interfaces.o logging.o parse.o set_perms.o sudo.o selinux.o sudo_edit.o \
+ 	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS) $(AUDIT_OBJS)
+ 
+ VISUDOBJS = visudo.o fileops.o gettime.o goodpath.o find_path.o $(PARSEOBJS)
+ 
++SESH_OBJS = sesh.o
++
+ TESTOBJS = interfaces.o testsudoers.o $(PARSEOBJS)
+ 
+ LIBOBJS = @LIBOBJS@ @ALLOCA@
+@@ -149,7 +152,7 @@ DISTFILES = $(SRCS) $(HDRS) BUGS CHANGES
+ BINFILES= BUGS CHANGES HISTORY LICENSE README TROUBLESHOOTING \
+ 	  UPGRADE install-sh mkinstalldirs sample.syslog.conf sample.sudoers \
+ 	  sudo sudo.cat sudo.man sudo.pod sudoers sudoers.cat sudoers.man \
+-	  sudoers.pod visudo visudo.cat visudo.man visudo.pod
++	  sudoers.pod visudo visudo.cat visudo.man visudo.pod sesh
+ 
+ BINSPECIAL= INSTALL.binary Makefile.binary libtool
+ 
+@@ -181,6 +184,9 @@ sudo: $(SUDOBJS) $(LIBOBJS)
+ visudo: $(VISUDOBJS) $(LIBOBJS)
+ 	$(CC) -o $@ $(VISUDOBJS) $(LIBOBJS) $(LDFLAGS) $(LIBS) $(NET_LIBS)
+ 
++sesh: $(SESH_OBJS) 
++	$(CC) -o $@ $(SESH_OBJS) $(LDFLAGS) $(LIBS)
++
+ testsudoers: $(TESTOBJS) $(LIBOBJS)
+ 	$(CC) -o $@ $(TESTOBJS) $(LIBOBJS) $(LDFLAGS) $(LIBS) $(NET_LIBS)
+ 
+@@ -222,6 +228,7 @@ logging.o: logging.c $(SUDODEP)
+ set_perms.o: set_perms.c $(SUDODEP)
+ tgetpass.o: tgetpass.c $(SUDODEP)
+ visudo.o: visudo.c $(SUDODEP) version.h
++sesh.o: sesh.c 
+ sudo.o: sudo.c $(SUDODEP) interfaces.h version.h
+ interfaces.o: interfaces.c $(SUDODEP) interfaces.h
+ testsudoers.o: testsudoers.c $(SUDODEP) parse.h interfaces.h
+@@ -320,6 +327,7 @@ install-binaries: $(PROGS)
+ 	ln $(DESTDIR)$(sudodir)/sudo $(DESTDIR)$(sudodir)/sudoedit
+ 
+ 	$(INSTALL) -O $(install_uid) -G $(install_gid) -M 0111 -s visudo $(DESTDIR)$(visudodir)/visudo
++	$(INSTALL) -O $(install_uid) -G $(install_gid) -M 0111 -s sesh $(DESTDIR)$(visudodir)/sesh
+ 
+ install-noexec: sudo_noexec.la
+ 	$(LIBTOOL) --mode=install $(INSTALL) sudo_noexec.la $(DESTDIR)$(noexecdir)
+diff -up sudo-1.6.9p12/sudo.c.selinux sudo-1.6.9p12/sudo.c
+--- sudo-1.6.9p12/sudo.c.selinux	2008-02-06 12:45:07.000000000 +0100
++++ sudo-1.6.9p12/sudo.c	2008-02-06 13:06:50.000000000 +0100
+@@ -101,6 +101,14 @@
+ #include <libaudit.h>
+ #endif
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++static char *role_s = NULL;                  /* role spec'd by user in argv[] */
++static char *type_s = NULL;                  /* type spec'd by user in argv[] */
++extern void selinux_exec(char *role_s, char *type_s, char *safe_cmnd, int NewArgc, char **NewArgv, char **environ);
++
++#endif
++
+ #include "sudo.h"
+ #include "interfaces.h"
+ #include "version.h"
+@@ -487,6 +495,12 @@ main(argc, argv, envp)
+ 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0)
+ 	    exit(0);
+ 	else {
++#ifdef WITH_SELINUX
++	    if( is_selinux_enabled() >0 && role_s) {
++		    selinux_exec(role_s, type_s, safe_cmnd, NewArgc, NewArgv, environ);	/* run the command */
++		    exit(-1);
++	    } 
++#endif
+ 	    execve(safe_cmnd, NewArgv, environ);
+ 	}
+ #else
+@@ -817,6 +831,30 @@ parse_args(argc, argv)
+ 		    NewArgv++;
+ 		    break;
+ #endif
++#ifdef WITH_SELINUX
++	    case 'r':
++		/* Must have an associated SELinux role. */
++		if (NewArgv[1] == NULL)
++		    usage(1);
++
++		role_s = NewArgv[1];
++
++		/* Shift Argv over and adjust Argc. */
++		NewArgc--;
++		NewArgv++;
++		break;
++	    case 't':
++		/* Must have an associated SELinux type. */
++		if (NewArgv[1] == NULL)
++		    usage(1);
++
++		type_s = NewArgv[1];
++
++		/* Shift Argv over and adjust Argc. */
++		NewArgc--;
++		NewArgv++;
++		break;
++#endif
+ #ifdef HAVE_LOGIN_CAP_H
+ 		case 'c':
+ 		    /* Must have an associated login class. */
+@@ -1318,6 +1356,9 @@ usage(exit_val)
+ #ifdef HAVE_BSD_AUTH_H
+ 	" [-a auth_type]",
+ #endif
++#ifdef WITH_SELINUX
++	" [-r role] [-t type] ",
++#endif
+ #ifdef HAVE_LOGIN_CAP_H
+ 	" [-c class|-]",
+ #endif
+diff -up sudo-1.6.9p12/sudo.man.in.selinux sudo-1.6.9p12/sudo.man.in
+--- sudo-1.6.9p12/sudo.man.in.selinux	2008-01-14 13:22:57.000000000 +0100
++++ sudo-1.6.9p12/sudo.man.in	2008-02-06 13:06:50.000000000 +0100
+@@ -159,6 +159,7 @@ sudo, sudoedit \- execute a command as a
+ .PP
+ \&\fBsudo\fR [\fB\-bEHPS\fR] [\fB\-a\fR\ \fIauth_type\fR]
+ [\fB\-c\fR\ \fIclass\fR|\fI\-\fR] [\fB\-p\fR\ \fIprompt\fR] [\fB\-u\fR\ \fIusername\fR|\fI#uid\fR]
++[\fB\-r\fR \fIrole\fR ] [\fB\-t\fR \fItype\fR ]
+ [\fB\s-1VAR\s0\fR=\fIvalue\fR] {\fB\-i\fR\ |\ \fB\-s\fR\ |\ \fIcommand\fR}
+ .PP
+ \&\fBsudoedit\fR [\fB\-S\fR] [\fB\-a\fR\ \fIauth_type\fR] [\fB\-c\fR\ \fIclass\fR|\fI\-\fR]
+@@ -323,6 +324,16 @@ preserve the invoking user's group vecto
+ \&\fBsudo\fR will initialize the group vector to the list of groups the
+ target user is in.  The real and effective group IDs, however, are
+ still set to match the target user.
++.IP "\-r" 4
++.IX Item "-r"
++The \fB\-r\fR (\fRrole\fR) option causes the new (SELinux) security context to have the role specified by
++\fIROLE\fR.
++.IP "\-t" 4
++.IX Item "-t" 
++The \fB\-t\fR (\fRtype\fR) option causes the new (SELinux) security context to have the have the type (domain)
++specified by
++\fITYPE\fR.
++If no type is specified, the default type is derived from the specified role.
+ .IP "\-p" 4
+ .IX Item "-p"
+ The \fB\-p\fR (\fIprompt\fR) option allows you to override the default
diff --git a/sudo-1.6.9p4-audit.patch b/sudo-1.6.9p4-audit.patch
index 0459b55..158dee0 100644
--- a/sudo-1.6.9p4-audit.patch
+++ b/sudo-1.6.9p4-audit.patch
@@ -1,6 +1,6 @@
-diff -up sudo-1.6.9p4/set_perms.c.audit sudo-1.6.9p4/set_perms.c
---- sudo-1.6.9p4/set_perms.c.audit	2007-07-06 16:16:22.000000000 +0200
-+++ sudo-1.6.9p4/set_perms.c	2008-01-07 19:52:41.000000000 +0100
+diff -up sudo-1.6.9p12/set_perms.c.audit sudo-1.6.9p12/set_perms.c
+--- sudo-1.6.9p12/set_perms.c.audit	2007-11-28 00:41:23.000000000 +0100
++++ sudo-1.6.9p12/set_perms.c	2008-02-05 14:09:29.000000000 +0100
 @@ -53,6 +53,10 @@
  #ifdef HAVE_LOGIN_CAP_H
  # include <login_cap.h>
@@ -12,61 +12,10 @@ diff -up sudo-1.6.9p4/set_perms.c.audit sudo-1.6.9p4/set_perms.c
  
  #include "sudo.h"
  
-@@ -101,22 +105,55 @@ set_perms(perm)
- 				if (setresuid(user_uid, user_uid, user_uid))
- 				    err(1, "setresuid(user_uid, user_uid, user_uid)");
- 			      	break;
--				
-+
-+        case PERM_FULL_RUNAS:
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+                                { /* BEGIN CAP BLOCK */
-+                                cap_t new_caps;
-+                                cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
-+ 
-+                                if (runas_pw->pw_uid != ROOT_UID) {
-+                                    new_caps = cap_init ();
-+                                    if (!new_caps)
-+                                        err(1, "Error initing capabilities, aborting.\n");
-+                                    
-+                                    if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
-+                                       cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
-+                                         err(1, "Error setting capabilities, aborting\n");   
-+                                    }
-+                                                                
-+                                    if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0))
-+                                        err(1, "Error setting KEEPCAPS, aborting\n");
-+                                }
-+#endif                          
-+                                /* headed for exec(), assume euid == ROOT_UID */                                      
-+                                runas_setup ();
-+                                if (setresuid(def_stay_setuid ? 
-+                                    user_uid : runas_pw->pw_uid,
-+                                    runas_pw->pw_uid, runas_pw->pw_uid))
-+                                    err(1, "unable to change to runas uid");
-+
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+                                if (runas_pw->pw_uid != ROOT_UID) {
-+                                    if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0)
-+                                        err(1, "Error resetting KEEPCAPS, aborting\n");
-+                                
-+                                    if (cap_set_proc(new_caps))
-+                                        err(1, "Error dropping capabilities, aborting\n");
-+                            
-+                                    if (cap_free (new_caps))
-+                                        err(1, "Error freeing caps\n");                        
-+                                }
-+	                        } /* END CAP BLOCK */
-+#endif
-+	                         break;
-+
- 	case PERM_RUNAS:
- 				(void) setresgid(-1, runas_pw->pw_gid, -1);
- 				if (setresuid(-1, runas_pw->pw_uid, -1))
- 				    err(1, "unable to change to runas uid");
+@@ -119,13 +123,46 @@ set_perms(perm)
  			      	break;
  
--	case PERM_FULL_RUNAS:
+ 	case PERM_FULL_RUNAS:
 -				/* headed for exec(), assume euid == ROOT_UID */
 -				runas_setup();
 -				if (setresuid(def_stay_setuid ?
@@ -74,13 +23,52 @@ diff -up sudo-1.6.9p4/set_perms.c.audit sudo-1.6.9p4/set_perms.c
 -				    runas_pw->pw_uid, runas_pw->pw_uid))
 -				    err(1, "unable to change to runas uid");
 -				break;
--
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++                                { /* BEGIN CAP BLOCK */
++                                 cap_t new_caps;
++                                 cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
++
++                                 if (runas_pw->pw_uid != ROOT_UID) {
++                                     new_caps = cap_init ();
++                                     if (!new_caps)
++                                         err(1, "Error initing capabilities, aborting.\n");
++
++                                     if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
++                                        cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
++                                          err(1, "Error setting capabilities, aborting\n");
++                                     }
++
++                                     if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0))
++                                         err(1, "Error setting KEEPCAPS, aborting\n");
++                                 }
++#endif
++                                /* headed for exec(), assume euid == ROOT_UID */
++                                 runas_setup ();
++                                 if (setresuid(def_stay_setuid ?
++                                     user_uid : runas_pw->pw_uid,
++                                     runas_pw->pw_uid, runas_pw->pw_uid))
++                                     err(1, "unable to change to runas uid");
++
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++                                 if (runas_pw->pw_uid != ROOT_UID) {
++                                     if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0)
++                                         err(1, "Error resetting KEEPCAPS, aborting\n");
++
++                                     if (cap_set_proc(new_caps))
++                                         err(1, "Error dropping capabilities, aborting\n");
++
++                                     if (cap_free (new_caps))
++                                         err(1, "Error freeing caps\n");
++                                 }
++                                } /* END CAP BLOCK */
++#endif
++                                break;
+ 
  	case PERM_SUDOERS:
  				/* assume euid == ROOT_UID, ruid == user */
- 				if (setresgid(-1, SUDOERS_GID, -1))
-diff -up sudo-1.6.9p4/sudo.c.audit sudo-1.6.9p4/sudo.c
---- sudo-1.6.9p4/sudo.c.audit	2008-01-07 19:52:41.000000000 +0100
-+++ sudo-1.6.9p4/sudo.c	2008-01-07 19:52:41.000000000 +0100
+diff -up sudo-1.6.9p12/sudo.c.audit sudo-1.6.9p12/sudo.c
+--- sudo-1.6.9p12/sudo.c.audit	2008-02-05 13:57:21.000000000 +0100
++++ sudo-1.6.9p12/sudo.c	2008-02-05 13:57:21.000000000 +0100
 @@ -97,6 +97,10 @@
  # include <sys/task.h>
  #endif
@@ -220,10 +208,10 @@ diff -up sudo-1.6.9p4/sudo.c.audit sudo-1.6.9p4/sudo.c
  	warn("unable to execute %s", safe_cmnd);
  	exit(127);
      } else if (ISSET(validated, FLAG_NO_USER) || (validated & FLAG_NO_HOST)) {
-diff -up sudo-1.6.9p4/configure.in.audit sudo-1.6.9p4/configure.in
---- sudo-1.6.9p4/configure.in.audit	2008-01-07 19:52:41.000000000 +0100
-+++ sudo-1.6.9p4/configure.in	2008-01-07 19:52:41.000000000 +0100
-@@ -150,6 +150,10 @@ dnl
+diff -up sudo-1.6.9p12/configure.in.audit sudo-1.6.9p12/configure.in
+--- sudo-1.6.9p12/configure.in.audit	2008-02-05 13:57:21.000000000 +0100
++++ sudo-1.6.9p12/configure.in	2008-02-05 13:57:21.000000000 +0100
+@@ -154,6 +154,10 @@ dnl
  dnl Options for --with
  dnl
  
@@ -234,7 +222,7 @@ diff -up sudo-1.6.9p4/configure.in.audit sudo-1.6.9p4/configure.in
  AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
  [case $with_CC in
      yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
-@@ -1579,6 +1583,25 @@ dnl
+@@ -1588,6 +1592,25 @@ dnl
  : ${mansectsu='8'}
  : ${mansectform='5'}
  
@@ -260,9 +248,9 @@ diff -up sudo-1.6.9p4/configure.in.audit sudo-1.6.9p4/configure.in
  dnl
  dnl Add in any libpaths or libraries specified via configure
  dnl
-diff -up /dev/null sudo-1.6.9p4/audit_help.c
---- /dev/null	2008-01-04 00:33:16.572612675 +0100
-+++ sudo-1.6.9p4/audit_help.c	2008-01-07 19:55:40.000000000 +0100
+diff -up /dev/null sudo-1.6.9p12/audit_help.c
+--- /dev/null	2008-02-05 11:01:55.583821645 +0100
++++ sudo-1.6.9p12/audit_help.c	2008-02-05 13:57:21.000000000 +0100
 @@ -0,0 +1,88 @@
 +/*
 + *  Audit helper functions used throughout sudo
@@ -352,10 +340,10 @@ diff -up /dev/null sudo-1.6.9p4/audit_help.c
 +#endif                         /* WITH_AUDIT */
 +
 +
-diff -up sudo-1.6.9p4/Makefile.in.audit sudo-1.6.9p4/Makefile.in
---- sudo-1.6.9p4/Makefile.in.audit	2007-08-15 16:16:57.000000000 +0200
-+++ sudo-1.6.9p4/Makefile.in	2008-01-07 19:52:41.000000000 +0100
-@@ -118,11 +118,13 @@ HDRS = compat.h def_data.h defaults.h in
+diff -up sudo-1.6.9p12/Makefile.in.audit sudo-1.6.9p12/Makefile.in
+--- sudo-1.6.9p12/Makefile.in.audit	2008-01-14 13:22:57.000000000 +0100
++++ sudo-1.6.9p12/Makefile.in	2008-02-05 13:57:21.000000000 +0100
+@@ -119,11 +119,13 @@ HDRS = compat.h def_data.h defaults.h in
  
  AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
  
@@ -370,7 +358,7 @@ diff -up sudo-1.6.9p4/Makefile.in.audit sudo-1.6.9p4/Makefile.in
  
  VISUDOBJS = visudo.o fileops.o gettime.o goodpath.o find_path.o $(PARSEOBJS)
  
-@@ -273,6 +275,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
+@@ -274,6 +276,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
  sia.o: $(authdir)/sia.c $(AUTHDEP)
  	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
  
@@ -380,9 +368,9 @@ diff -up sudo-1.6.9p4/Makefile.in.audit sudo-1.6.9p4/Makefile.in
  sudo.man.in: $(srcdir)/sudo.pod
  	@rm -f $(srcdir)/$@
  	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e 1d -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" >> $@ )
-diff -up sudo-1.6.9p4/sudo.h.audit sudo-1.6.9p4/sudo.h
---- sudo-1.6.9p4/sudo.h.audit	2008-01-07 19:52:41.000000000 +0100
-+++ sudo-1.6.9p4/sudo.h	2008-01-07 19:52:41.000000000 +0100
+diff -up sudo-1.6.9p12/sudo.h.audit sudo-1.6.9p12/sudo.h
+--- sudo-1.6.9p12/sudo.h.audit	2008-02-05 13:57:21.000000000 +0100
++++ sudo-1.6.9p12/sudo.h	2008-02-05 13:57:21.000000000 +0100
 @@ -23,6 +23,8 @@
  #ifndef _SUDO_SUDO_H
  #define _SUDO_SUDO_H
@@ -392,7 +380,7 @@ diff -up sudo-1.6.9p4/sudo.h.audit sudo-1.6.9p4/sudo.h
  #include <pathnames.h>
  #include <limits.h>
  #include "compat.h"
-@@ -274,4 +276,10 @@ extern int sudo_mode;
+@@ -278,4 +280,10 @@ extern int sudo_mode;
  extern int errno;
  #endif
  
diff --git a/sudo-1.6.9p4-autotoolsRecursion.patch b/sudo-1.6.9p4-autotoolsRecursion.patch
deleted file mode 100644
index 09e862d..0000000
--- a/sudo-1.6.9p4-autotoolsRecursion.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-diff -up sudo-1.6.9p4/acsite.m4.autotoolsRecursion sudo-1.6.9p4/acsite.m4
---- sudo-1.6.9p4/acsite.m4.autotoolsRecursion	2007-08-27 12:33:37.000000000 +0400
-+++ sudo-1.6.9p4/acsite.m4	2007-08-27 12:33:52.000000000 +0400
-@@ -6319,19 +6319,32 @@ m4_define([lt_join],
- ])
- 
- 
-+# lt_car(LIST)
-+# lt_cdr(LIST)
-+# ------------
-+# Manipulate m4 lists.
-+# These macros are necessary as long as will still need to support
-+# Autoconf-2.59 which quotes differently.
-+m4_define([lt_car], [[$1]])
-+m4_define([lt_cdr],
-+[m4_if([$#], 0, [m4_fatal([$0: cannot be called without arguments])],
-+       [$#], 1, [],
-+       [m4_dquote(m4_shift($@))])])
-+
-+
- # lt_combine(SEP, PREFIX-LIST, INFIX, SUFFIX1, [SUFFIX2...])
- # ----------------------------------------------------------
- # Produce a SEP delimited list of all paired combinations of elements of
- # PREFIX-LIST with SUFFIX1 through SUFFIXn.  Each element of the list
- # has the form PREFIXmINFIXSUFFIXn.
- m4_define([lt_combine],
--[m4_if([$2], [[]], [],
--       [lt_join(m4_quote(m4_default([$1], [, ])),
--		_$0([$1], m4_car($2)[$3], m4_shiftn(3, $@)),
--		$0([$1], m4_cdr($2), m4_shiftn(2, $@)))])])
-+[m4_if([$2], [], [],
-+       [lt_join(m4_quote(m4_default([$1], [[, ]])),
-+		_$0([$1], lt_car($2)[$3], m4_shiftn(3, $@)),
-+		$0([$1], lt_cdr($2), m4_shiftn(2, $@)))])])
- m4_define([_lt_combine],
- [m4_if([$3], [], [],
--       [lt_join(m4_quote(m4_default([$1], [, ])),
-+       [lt_join(m4_quote(m4_default([$1], [[, ]])),
- 		[$2$3],
- 		$0([$1], [$2], m4_shiftn(3, $@)))])[]dnl
- ])
diff --git a/sudo-1.6.9p4-getprpwnam.patch b/sudo-1.6.9p4-getprpwnam.patch
deleted file mode 100644
index f99b6d9..0000000
--- a/sudo-1.6.9p4-getprpwnam.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up sudo-1.6.9p4/configure.in.getprpwnam sudo-1.6.9p4/configure.in
---- sudo-1.6.9p4/configure.in.getprpwnam	2007-08-27 13:24:54.000000000 +0400
-+++ sudo-1.6.9p4/configure.in	2007-08-27 13:25:48.000000000 +0400
-@@ -1975,7 +1975,7 @@ if test "$CHECKSHADOW" = "true"; then
-     AC_CHECK_FUNCS(getspnam, [CHECKSHADOW="false"], [AC_CHECK_LIB(gen, getspnam, AC_DEFINE(HAVE_GETSPNAM) [SUDO_LIBS="${SUDO_LIBS} -lgen"; LIBS="${LIBS} -lgen"])])
- fi
- if test "$CHECKSHADOW" = "true"; then
--    AC_CHECK_FUNC(getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) [CHECKSHADOW="false"; SECUREWARE=1], AC_CHECK_LIB(sec, getprpwnam, AC_DEFINE(HAVE_GETPRPWNAM) [CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lsec"; LIBS="${LIBS} -lsec"], AC_CHECK_LIB(security, getprpwnam, AC_DEFINE(HAVE_GETPRPWNAM) [CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lsecurity"; LIBS="${LIBS} -lsecurity"], AC_CHECK_LIB(prot, getprpwnam, AC_DEFINE(HAVE_GETPRPWNAM) [CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lprot"; LIBS="${LIBS} -lprot"])))])
-+    AC_CHECK_FUNC(getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) CHECKSHADOW="false"; SECUREWARE=1], [AC_CHECK_LIB(sec, getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lsec"; LIBS="${LIBS} -lsec"], [AC_CHECK_LIB(security, getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lsecurity"; LIBS="${LIBS} -lsecurity"], [AC_CHECK_LIB(prot, getprpwnam, [AC_DEFINE(HAVE_GETPRPWNAM) CHECKSHADOW="false"; SECUREWARE=1; SUDO_LIBS="${SUDO_LIBS} -lprot"; LIBS="${LIBS} -lprot"])])])])
- fi
- if test -n "$SECUREWARE"; then
-     AC_CHECK_FUNCS(bigcrypt set_auth_parameters initprivs)
diff --git a/sudo.spec b/sudo.spec
index c29eea1..5525b39 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.6.9p4
-Release: 6%{?dist}
+Version: 1.6.9p12
+Release: 1%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -24,9 +24,9 @@ Patch1: sudo-1.6.7p5-strip.patch
 Patch2: sudo-1.6.9p4-login.patch
 # the rest, see changelog
 Patch3: sudo-1.6.9p4-getgrouplist.patch
-Patch4: sudo-1.6.9p4-autotoolsRecursion.patch
-Patch5: sudo-1.6.9p4-getprpwnam.patch
-Patch6: sudo-1.6.9p4-audit.patch
+Patch4: sudo-1.6.9p12-noPam.patch
+Patch5: sudo-1.6.9p4-audit.patch
+Patch6: sudo-1.6.9p12-selinux.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -44,9 +44,9 @@ on many different machines.
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .login
 %patch3 -p1 -b .getgrouplist
-%patch4 -p1 -b .autotoolsRecursion
-%patch5 -p1 -b .getprpwnam
-%patch6 -p1 -b .audit
+%patch4 -p1 -b .noPam
+%patch5 -p1 -b .audit
+%patch6 -p1 -b .selinux
 
 autoreconf
 
@@ -128,6 +128,10 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Feb 06 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p12-1
+- upgrade to the latest upstream release
+- add selinux support
+
 * Mon Feb 02 2008 Dennis Gilmore <dennis@ausil.us> 1.6.9p4-6
 - sparc64 needs to be in the -fPIE list with s390
 

From 2c73738be1943f3ade403d258173cc6443848a3e Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Wed, 6 Feb 2008 13:05:56 +0000
Subject: [PATCH 010/199] add buildrequires

---
 sudo.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sudo.spec b/sudo.spec
index 5525b39..a491e24 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -17,6 +17,7 @@ BuildRequires: flex
 BuildRequires: bison
 BuildRequires: automake autoconf libtool
 BuildRequires: audit-libs-devel libcap-devel
+BuildRequires: libselinux-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch

From 659ffd61f2193248e8fc8562f998ee1b680cce0e Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Wed, 6 Feb 2008 13:29:36 +0000
Subject: [PATCH 011/199] fix files section

---
 sudo.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sudo.spec b/sudo.spec
index a491e24..e6b4454 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -118,6 +118,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(4111,root,root) %{_bindir}/sudo
 %attr(4111,root,root) %{_bindir}/sudoedit
 %attr(0755,root,root) %{_sbindir}/visudo
+%attr(0755,root,root) %{_sbindir}/sesh
 %{_libexecdir}/sudo_noexec.*
 %{_mandir}/man5/sudoers.5*
 %{_mandir}/man8/sudo.8*

From 7769b8ecbc2b73aa72939eb9da876ed4e6318b81 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Wed, 6 Feb 2008 13:39:49 +0000
Subject: [PATCH 012/199] spec file fix

---
 sudo.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index e6b4454..b460ec2 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -110,7 +110,7 @@ rm -rf $RPM_BUILD_ROOT
 
 %files
 %defattr(-,root,root)
-%doc BUGS CHANGES HISTORY LICENSE README TODO TROUBLESHOOTING UPGRADE *.pod
+%doc BUGS CHANGES HISTORY LICENSE README TROUBLESHOOTING UPGRADE *.pod
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %config(noreplace) /etc/pam.d/sudo
 %config(noreplace) /etc/pam.d/sudo-i

From 0fe071d2e4ae56adb320b9cfe71f41026fe76435 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Thu, 21 Feb 2008 15:10:42 +0000
Subject: [PATCH 013/199] upgrade

---
 .cvsignore                                    |   2 +-
 sources                                       |   4 +-
 sudo-1.6.8p12-sudoers                         |  11 +-
 sudo-1.6.9p12-selinux.patch                   | 672 ------------------
 ...4-audit.patch => sudo-1.6.9p13-audit.patch | 127 ++--
 sudo.spec                                     |  14 +-
 6 files changed, 94 insertions(+), 736 deletions(-)
 delete mode 100644 sudo-1.6.9p12-selinux.patch
 rename sudo-1.6.9p4-audit.patch => sudo-1.6.9p13-audit.patch (77%)

diff --git a/.cvsignore b/.cvsignore
index b062bed..c1b4a48 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
 sudo-1.6.8p12-sudoers
-sudo-1.6.9p12.tar.gz
+sudo-1.6.9p13.tar.gz
diff --git a/sources b/sources
index 033787a..da4c36a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-3dad7cdd28925f9bdf387510961f8e9f  sudo-1.6.8p12-sudoers
-a5795c292e5c64dd9f7bcba8c1c712c9  sudo-1.6.9p12.tar.gz
+573c851f2a204f1cdbbdb657015fc6ef  sudo-1.6.8p12-sudoers
+7e9d3e7780c632469ffe88fcc4a6b1ca  sudo-1.6.9p13.tar.gz
diff --git a/sudo-1.6.8p12-sudoers b/sudo-1.6.8p12-sudoers
index bd2d94b..2e7ef76 100644
--- a/sudo-1.6.8p12-sudoers
+++ b/sudo-1.6.8p12-sudoers
@@ -56,12 +56,11 @@ Cmnd_Alias DRIVERS = /sbin/modprobe
 Defaults    requiretty
 
 Defaults    env_reset
-Defaults    env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
-                        LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
-                        LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
-                        LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
-                        LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
-                        _XKB_CHARSET XAUTHORITY"
+Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
+Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
+Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
+Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
+Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
 
 ## Next comes the main part: which users can run what software on 
 ## which machines (the sudoers file can be shared between multiple
diff --git a/sudo-1.6.9p12-selinux.patch b/sudo-1.6.9p12-selinux.patch
deleted file mode 100644
index aecd865..0000000
--- a/sudo-1.6.9p12-selinux.patch
+++ /dev/null
@@ -1,672 +0,0 @@
-diff -up /dev/null sudo-1.6.9p12/sesh.c
---- /dev/null	2008-02-05 17:16:01.642928004 +0100
-+++ sudo-1.6.9p12/sesh.c	2008-02-06 13:06:50.000000000 +0100
-@@ -0,0 +1,46 @@
-+#include <stdio.h>
-+#include <unistd.h>
-+#include <limits.h>
-+#include <sys/types.h>
-+#include <sys/wait.h>
-+#include <errno.h>
-+
-+main (int argc, char **argv) {
-+  char buf[PATH_MAX];
-+  pid_t pid;
-+  if ( argc < 2 ) {
-+    fprintf(stderr,"%s: Requires at least one argument\n", argv[0]);
-+    exit(-1);
-+  }
-+
-+  if ((pid = fork()) < 0) {
-+    snprintf(buf, sizeof(buf), "%s: Couldn't fork",argv[0]);
-+    perror(buf);
-+    exit(-1);
-+  } else if (pid > 0) {
-+    /* Parent */
-+    int status;
-+    int ret;
-+
-+    do {
-+      if ((ret = waitpid(pid, &status, 0)) < 0 && errno == EINTR)
-+        continue;
-+      else if (ret < 0) {
-+        perror("waitpid failed");
-+        exit(1);
-+      }
-+    } while (0);
-+
-+    if (WIFEXITED(status))
-+      exit(WEXITSTATUS(status));
-+    else
-+      exit(1);
-+  } else {
-+    /* Child */
-+    execv(argv[1], &argv[1]);
-+
-+    snprintf(buf, sizeof(buf), "%s: Error execing %s", argv[0], argv[1]);
-+    perror(buf);
-+    exit(-1);
-+  }
-+}
-diff -up sudo-1.6.9p12/configure.in.selinux sudo-1.6.9p12/configure.in
---- sudo-1.6.9p12/configure.in.selinux	2008-02-06 12:45:07.000000000 +0100
-+++ sudo-1.6.9p12/configure.in	2008-02-06 13:06:50.000000000 +0100
-@@ -102,7 +102,7 @@ dnl
- dnl Initial values for Makefile variables listed above
- dnl May be overridden by environment variables..
- dnl
--PROGS="sudo visudo"
-+PROGS="sudo visudo sesh"
- : ${MANTYPE='man'}
- : ${mansrcdir='.'}
- : ${SUDOERS_MODE='0440'}
-diff -up /dev/null sudo-1.6.9p12/selinux.c
---- /dev/null	2008-02-05 17:16:01.642928004 +0100
-+++ sudo-1.6.9p12/selinux.c	2008-02-06 13:06:50.000000000 +0100
-@@ -0,0 +1,425 @@
-+/*
-+ * Copyright (c) 2008 Dan Walsh <dwalsh@redhat.com>
-+ *
-+ * Borrowed heavily from newrole source code
-+ * Authors:
-+ *      Anthony Colatrella
-+ *	Tim Fraser
-+ *	Steve Grubb <sgrubb@redhat.com>
-+ *	Darrel Goeddel <DGoeddel@trustedcs.com>
-+ *	Michael Thompson <mcthomps@us.ibm.com>
-+ *	Dan Walsh <dwalsh@redhat.com>
-+ *
-+ * Permission to use, copy, modify, and distribute this software for any
-+ * purpose with or without fee is hereby granted, provided that the above
-+ * copyright notice and this permission notice appear in all copies.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+ *
-+ */
-+#ifdef WITH_SELINUX
-+#include <config.h>
-+#include <sys/types.h>
-+#include <stdio.h>
-+#ifdef STDC_HEADERS
-+# include <stdlib.h>
-+# include <stddef.h>
-+#else
-+# ifdef HAVE_STDLIB_H
-+#  include <stdlib.h>
-+# endif
-+#endif /* STDC_HEADERS */
-+#ifdef HAVE_STRING_H
-+# if defined(HAVE_MEMORY_H) && !defined(STDC_HEADERS)
-+#  include <memory.h>
-+# endif
-+# include <string.h>
-+#else
-+# ifdef HAVE_STRINGS_H
-+#  include <strings.h>
-+# endif
-+#endif /* HAVE_STRING_H */
-+#ifdef HAVE_UNISTD_H
-+# include <unistd.h>
-+#endif /* HAVE_UNISTD_H */
-+#include <errno.h>
-+#include <fcntl.h>
-+#include <signal.h>
-+
-+#ifdef WITH_AUDIT
-+#include <libaudit.h>
-+#endif
-+
-+#include "sudo.h"
-+
-+#include <sys/wait.h>
-+
-+#ifdef USE_AUDIT
-+#include <libaudit.h>
-+#endif
-+
-+#include <selinux/flask.h>             /* for SECCLASS_CHR_FILE */
-+#include <selinux/selinux.h>           /* for is_selinux_enabled() */
-+#include <selinux/context.h>           /* for context-mangling functions */
-+#include <selinux/get_default_type.h>
-+#include <selinux/get_context_list.h>
-+
-+/**
-+ * This function attempts to revert the relabeling done to the tty.
-+ * fd   - referencing the opened ttyn
-+ * ttyn - name of tty to restore
-+ * tty_context     - original context of the tty
-+ * new_tty_context - context tty was relabeled to
-+ *
-+ * Returns zero on success, non-zero otherwise
-+ */
-+static int restore_tty_label(int fd, const char *ttyn,
-+			     security_context_t tty_context,
-+			     security_context_t new_tty_context)
-+{
-+	int rc = 0;
-+	security_context_t chk_tty_context = NULL;
-+
-+	if (!ttyn)
-+		goto skip_relabel;
-+
-+	if (!new_tty_context)
-+		goto skip_relabel;
-+
-+	/* Verify that the tty still has the context set by newrole. */
-+	if ((rc = fgetfilecon(fd, &chk_tty_context)) < 0) {
-+		fprintf(stderr, "Could not fgetfilecon %s.\n", ttyn);
-+		goto skip_relabel;
-+	}
-+
-+	if ((rc = strcmp(chk_tty_context, new_tty_context))) {
-+		fprintf(stderr, "%s changed labels.\n", ttyn);
-+		goto skip_relabel;
-+	}
-+
-+	if ((rc = fsetfilecon(fd, tty_context)) < 0)
-+		fprintf(stderr,
-+			"Warning! Could not restore context for %s\n", ttyn);
-+      skip_relabel:
-+	freecon(chk_tty_context);
-+	return rc;
-+}
-+
-+/**
-+ * This function attempts to relabel the tty. If this function fails, then
-+ * the fd is closed, the contexts are free'd and -1 is returned. On success,
-+ * a valid fd is returned and tty_context and new_tty_context are set.
-+ *
-+ * This function will not fail if it can not relabel the tty when selinux is
-+ * in permissive mode.
-+ */
-+static int relabel_tty(const char *ttyn, security_context_t new_context,
-+		       security_context_t * tty_context,
-+		       security_context_t * new_tty_context)
-+{
-+	int fd;
-+	int enforcing = security_getenforce();
-+	security_context_t tty_con = NULL;
-+	security_context_t new_tty_con = NULL;
-+
-+	if (!ttyn)
-+		return 0;
-+
-+	if (enforcing < 0) {
-+		fprintf(stderr, "Could not determine enforcing mode.\n");
-+		return -1;
-+	}
-+
-+	/* Re-open TTY descriptor */
-+	fd = open(ttyn, O_RDWR | O_NONBLOCK);
-+	if (fd < 0) {
-+		fprintf(stderr, "Error!  Could not open %s.\n", ttyn);
-+		return fd;
-+	}
-+	fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
-+
-+	if (fgetfilecon(fd, &tty_con) < 0) {
-+		fprintf(stderr, "%s!  Could not get current context "
-+				  "for %s, not relabeling tty.\n",
-+			enforcing ? "Error" : "Warning", ttyn);
-+		if (enforcing)
-+			goto close_fd;
-+	}
-+
-+	if (tty_con &&
-+	    (security_compute_relabel(new_context, tty_con,
-+				      SECCLASS_CHR_FILE, &new_tty_con) < 0)) {
-+		fprintf(stderr, "%s!  Could not get new context for %s, "
-+				  "not relabeling tty.\n",
-+			enforcing ? "Error" : "Warning", ttyn);
-+		if (enforcing)
-+			goto close_fd;
-+	}
-+
-+	if (new_tty_con)
-+		if (fsetfilecon(fd, new_tty_con) < 0) {
-+			fprintf(stderr,
-+				"%s!  Could not set new context for %s\n",
-+				enforcing ? "Error" : "Warning", ttyn);
-+			freecon(new_tty_con);
-+			new_tty_con = NULL;
-+			if (enforcing)
-+				goto close_fd;
-+		}
-+
-+	*tty_context = tty_con;
-+	*new_tty_context = new_tty_con;
-+	return fd;
-+
-+      close_fd:
-+	freecon(tty_con);
-+	close(fd);
-+	return -1;
-+}
-+
-+security_context_t get_exec_context(security_context_t old_context, char *role_s, char *type_s) {
-+
-+  /* our target security ID ("sid") */
-+  security_context_t new_context=NULL; 
-+
-+  /* manipulatable form of context_s */
-+  context_t context;                 
-+  
-+  if( !role_s ) {
-+    fprintf(stderr,"You must specify a role.\n");
-+    return NULL;
-+  }
-+	  
-+  
-+  /*
-+   * Get the SID and context of the caller, and extract
-+   * the username from the context.  Don't rely on the Linux
-+   * uid information - it isn't trustworthy.
-+   */
-+  
-+  /* 
-+   * Create a context structure so that we extract and modify 
-+   * components easily. 
-+   */
-+  context=context_new(old_context);
-+  
-+  /*
-+   *
-+   * Step 3:  Construct a new SID based on our old SID and the
-+   *          arguments specified on the command line.
-+   *
-+   */
-+  
-+  /* The first step in constructing a new SID for the new shell we  *
-+   * plan to exec is to take our old context in `context' as a   *
-+   * starting point, and modify it according to the options the user *
-+   * specified on the command line.                                  */
-+
-+  /* If the user specified a new role on the command line (if `role_s'   *
-+   * is set), then replace the old role in `context' with this new role. */
-+  if( !type_s ) {
-+    if( get_default_type(role_s,&type_s) )
-+      {
-+        fprintf(stderr,"Couldn't get default type.\n");
-+	goto err;
-+      }
-+    }
-+    
-+  if( context_role_set(context,role_s)) {
-+    fprintf(stderr,"failed to set new role %s\n",role_s);
-+    goto err;
-+  }
-+    
-+  /* If the user specified a new type on the command line (if `type_s'   *
-+   * is set), then replace the old type in `context' with this new type. */
-+  if( type_s ) {
-+    if( context_type_set(context,type_s)) {
-+      fprintf(stderr,"failed to set new type %s\n",type_s);
-+      goto err;
-+    }
-+  } /* if user specified new type */
-+    
-+  /* The second step in creating the new SID is to convert our modified *
-+   * `context' structure back to a context string and then to a SID.    */
-+    
-+  /* Make `context_s' point to a string version of the new `context'.  */
-+  if( !(new_context=strdup(context_str(context)))) {
-+    fprintf(stderr,"failed to convert new context to string\n" );
-+    goto err;
-+  }
-+
-+  if (security_check_context(new_context) < 0) {
-+    fprintf(stderr, "%s is not a valid context\n", new_context);
-+    goto err;
-+  }
-+
-+#ifdef DEBUG
-+  printf("Your new context is %s\n",new_context);
-+#endif
-+
-+  context_free(context);
-+  return new_context;
-+
-+ err:
-+  context_free(context);
-+  freecon(new_context);
-+  return NULL;
-+
-+}
-+
-+void selinux_exec(char *role_s, char *type_s, char *safe_cmd, int NewArgc, char **NewArgv, char **environ){ 
-+  pid_t childPid = 0;
-+  int ttyfd = -1;
-+  /* our original securiy ID ("old_context") */
-+  security_context_t old_context=NULL;	
-+
-+  /* security context to change to while running command*/
-+  security_context_t new_tty_context=NULL; 
-+  /* current security context of tty */
-+  security_context_t tty_context=NULL;  
-+
-+  char *ttyn = NULL;	/* tty path */
-+  
-+  /* our target security ID ("sid") */
-+  security_context_t new_context=NULL;
-+  /* Put the caller's SID into `old_context'. */
-+  if (getprevcon(&old_context)) {
-+    fprintf(stderr,"failed to get old_context.\n");
-+    exit(-1);
-+  }
-+  
-+#ifdef DEBUG
-+  printf( "Your old context was %s\n", old_context );
-+#endif
-+  new_context=get_exec_context(old_context, role_s,type_s);
-+  if (! new_context) {
-+	  fprintf(stderr, "Could not set exec context to %s.\n", new_context);
-+	  exit(-1);
-+  }
-+  
-+  ttyn = ttyname(STDIN_FILENO);
-+  if (!ttyn || *ttyn == '\0') {
-+	  fprintf(stderr,
-+		  "Warning!  Could not retrieve tty information.\n");
-+  }
-+  
-+  ttyfd = relabel_tty(ttyn, new_context, &tty_context, &new_tty_context);
-+  if (ttyfd < 0) {
-+	  fprintf(stderr, "Could not setup tty context for %s.\n", new_context);
-+	  exit(-1);
-+  }
-+
-+#ifdef DEBUG
-+  printf("Your old tty context is %s\n",tty_context);
-+  printf("Your new tty context is %s\n",new_tty_context);
-+#endif
-+
-+
-+  childPid = fork();
-+  if (childPid < 0) {
-+	  /* fork failed, no child to worry about */
-+	  int errsv = errno;
-+	  fprintf(stderr, "newrole: failure forking: %s",
-+		  strerror(errsv));
-+	  if (restore_tty_label(ttyfd, ttyn, tty_context, new_tty_context))
-+		  fprintf(stderr, "Unable to restore tty label...\n");
-+	  if (close(ttyfd))
-+		  fprintf(stderr, "Failed to close tty properly\n");
-+	  goto err;
-+  } else if (childPid) {
-+	  /* PARENT
-+	   * It doesn't make senes to exit early on errors at this point,
-+	   * since we are doing cleanup which needs to be done.
-+	   * We can exit with a bad rc though
-+	   */
-+	  pid_t pid;
-+	  int exit_code = 0;
-+	  int status;
-+	  
-+	  do {
-+		  pid = wait(&status);
-+	  } while (pid < 0 && errno == EINTR);
-+	  
-+	  /* Preserve child exit status, unless there is another error. */
-+	  if (WIFEXITED(status))
-+		  exit_code = WEXITSTATUS(status);
-+	  
-+	  if (restore_tty_label(ttyfd, ttyn, tty_context, new_tty_context)) {
-+		  fprintf(stderr, "Unable to restore tty label...\n");
-+		  exit_code = -1;
-+	  }
-+	  freecon(tty_context);
-+	  freecon(new_tty_context);
-+	  if (close(ttyfd)) {
-+		  fprintf(stderr, "Failed to close tty properly\n");
-+		  exit_code = -1;
-+	  }
-+	  exit(exit_code);
-+  }
-+  /* CHILD */
-+  /* Close the tty and reopen descriptors 0 through 2 */
-+  if (ttyn) {
-+    if (close(ttyfd) || close(0) || close(1) || close(2)) {
-+	    fprintf(stderr, "Could not close descriptors.\n");
-+	    goto err;
-+    }
-+    ttyfd = open(ttyn, O_RDONLY | O_NONBLOCK);
-+    if (ttyfd != 0)
-+	    goto err;
-+    fcntl(ttyfd, F_SETFL, fcntl(ttyfd, F_GETFL, 0) & ~O_NONBLOCK);
-+    ttyfd = open(ttyn, O_RDWR | O_NONBLOCK);
-+    if (ttyfd != 1)
-+	    goto err;
-+    fcntl(ttyfd, F_SETFL, fcntl(ttyfd, F_GETFL, 0) & ~O_NONBLOCK);
-+    ttyfd = open(ttyn, O_RDWR | O_NONBLOCK);
-+    if (ttyfd != 2)
-+	    goto err;
-+    fcntl(ttyfd, F_SETFL, fcntl(ttyfd, F_GETFL, 0) & ~O_NONBLOCK);
-+  }
-+  if (setexeccon(new_context)) {
-+	  fprintf(stderr, "Could not set exec context to %s.\n",
-+		  new_context);
-+	  goto err;
-+  }
-+
-+#ifdef USE_AUDIT
-+  if (send_audit_message(1, old_context, new_context, ttyn)) 
-+    goto err;
-+#endif
-+
-+  {
-+    /* 
-+       SELinux will only not transition properly with the following
-+       code.  Basically if the user chooses to use a different security
-+       context.  We need to start the selinux shell, before executing 
-+       the command.  This way the process transition will happen 
-+       correctly. For example if they user wants to run rpm from 
-+       sysadm_r.  Sudo will exec the /usr/sbin/sesh followed by the 
-+       specified command.*/
-+     char **dst, **src = NewArgv+1;
-+     NewArgv = (char **) emalloc2((++NewArgc + 1), sizeof(char *));
-+     NewArgv[0] = estrdup("/usr/sbin/sesh");
-+     NewArgv[1] = safe_cmd;
-+     safe_cmd = estrdup("/usr/sbin/sesh");
-+     /* copy the args from Argv */
-+     for (dst = NewArgv + 2; (*dst = *src) != NULL; ++src, ++dst)
-+	     ;
-+  }
-+  freecon(old_context);
-+  freecon(new_context);
-+
-+  execve(safe_cmd, NewArgv, environ);	/* run the command */
-+  
-+  perror("failed to exec shell\n");
-+ err:
-+  freecon(old_context);
-+  freecon(new_context);
-+  exit(-1);
-+}
-+#endif /* WITH_SELINUX */
-diff -up sudo-1.6.9p12/Makefile.in.selinux sudo-1.6.9p12/Makefile.in
---- sudo-1.6.9p12/Makefile.in.selinux	2008-02-06 12:45:07.000000000 +0100
-+++ sudo-1.6.9p12/Makefile.in	2008-02-06 13:08:50.000000000 +0100
-@@ -43,7 +43,8 @@ INSTALL = $(SHELL) $(srcdir)/install-sh 
- # Libraries
- LIBS = @LIBS@
- NET_LIBS = @NET_LIBS@
--SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS)
-+SELINUX_LIBS = -lselinux
-+SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS) $(SELINUX_LIBS)
- 
- # C preprocessor flags
- CPPFLAGS = -I. -I$(srcdir) @CPPFLAGS@
-@@ -91,7 +92,7 @@ sudoers_gid = @SUDOERS_GID@
- sudoers_mode = @SUDOERS_MODE@
- 
- # Pass in paths and uid/gid + OS dependent defined
--DEFS = @OSDEFS@ -D_PATH_SUDOERS=\"$(sudoersdir)/sudoers\" -D_PATH_SUDOERS_TMP=\"$(sudoersdir)/sudoers.tmp\" -DSUDOERS_UID=$(sudoers_uid) -DSUDOERS_GID=$(sudoers_gid) -DSUDOERS_MODE=$(sudoers_mode)
-+DEFS = @OSDEFS@ -D_PATH_SUDOERS=\"$(sudoersdir)/sudoers\" -D_PATH_SUDOERS_TMP=\"$(sudoersdir)/sudoers.tmp\" -DSUDOERS_UID=$(sudoers_uid) -DSUDOERS_GID=$(sudoers_gid) -DSUDOERS_MODE=$(sudoers_mode) -DWITH_SELINUX
- 
- #### End of system configuration section. ####
- 
-@@ -105,7 +106,7 @@ SRCS = alloc.c alloca.c check.c closefro
-        logging.c memrchr.c mkstemp.c parse.c parse.lex parse.yacc set_perms.c \
-        sigaction.c snprintf.c strcasecmp.c strerror.c strlcat.c strlcpy.c \
-        sudo.c sudo_noexec.c sudo.tab.c sudo_edit.c testsudoers.c tgetpass.c \
--       utimes.c visudo.c zero_bytes.c $(AUTH_SRCS)
-+       utimes.c visudo.c zero_bytes.c $(AUTH_SRCS) selinux.c sesh.c
- 
- AUTH_SRCS = auth/afs.c auth/aix_auth.c auth/bsdauth.c auth/dce.c auth/fwtk.c \
- 	    auth/kerb4.c auth/kerb5.c auth/pam.c auth/passwd.c auth/rfc1938.c \
-@@ -124,11 +125,13 @@ AUDIT_OBJS = audit_help.o 
- PARSEOBJS = sudo.tab.o lex.yy.o alloc.o defaults.o
- 
- SUDOBJS = check.o env.o getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
--	  interfaces.o logging.o parse.o set_perms.o sudo.o sudo_edit.o \
-+	  interfaces.o logging.o parse.o set_perms.o sudo.o selinux.o sudo_edit.o \
- 	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS) $(AUDIT_OBJS)
- 
- VISUDOBJS = visudo.o fileops.o gettime.o goodpath.o find_path.o $(PARSEOBJS)
- 
-+SESH_OBJS = sesh.o
-+
- TESTOBJS = interfaces.o testsudoers.o $(PARSEOBJS)
- 
- LIBOBJS = @LIBOBJS@ @ALLOCA@
-@@ -149,7 +152,7 @@ DISTFILES = $(SRCS) $(HDRS) BUGS CHANGES
- BINFILES= BUGS CHANGES HISTORY LICENSE README TROUBLESHOOTING \
- 	  UPGRADE install-sh mkinstalldirs sample.syslog.conf sample.sudoers \
- 	  sudo sudo.cat sudo.man sudo.pod sudoers sudoers.cat sudoers.man \
--	  sudoers.pod visudo visudo.cat visudo.man visudo.pod
-+	  sudoers.pod visudo visudo.cat visudo.man visudo.pod sesh
- 
- BINSPECIAL= INSTALL.binary Makefile.binary libtool
- 
-@@ -181,6 +184,9 @@ sudo: $(SUDOBJS) $(LIBOBJS)
- visudo: $(VISUDOBJS) $(LIBOBJS)
- 	$(CC) -o $@ $(VISUDOBJS) $(LIBOBJS) $(LDFLAGS) $(LIBS) $(NET_LIBS)
- 
-+sesh: $(SESH_OBJS) 
-+	$(CC) -o $@ $(SESH_OBJS) $(LDFLAGS) $(LIBS)
-+
- testsudoers: $(TESTOBJS) $(LIBOBJS)
- 	$(CC) -o $@ $(TESTOBJS) $(LIBOBJS) $(LDFLAGS) $(LIBS) $(NET_LIBS)
- 
-@@ -222,6 +228,7 @@ logging.o: logging.c $(SUDODEP)
- set_perms.o: set_perms.c $(SUDODEP)
- tgetpass.o: tgetpass.c $(SUDODEP)
- visudo.o: visudo.c $(SUDODEP) version.h
-+sesh.o: sesh.c 
- sudo.o: sudo.c $(SUDODEP) interfaces.h version.h
- interfaces.o: interfaces.c $(SUDODEP) interfaces.h
- testsudoers.o: testsudoers.c $(SUDODEP) parse.h interfaces.h
-@@ -320,6 +327,7 @@ install-binaries: $(PROGS)
- 	ln $(DESTDIR)$(sudodir)/sudo $(DESTDIR)$(sudodir)/sudoedit
- 
- 	$(INSTALL) -O $(install_uid) -G $(install_gid) -M 0111 -s visudo $(DESTDIR)$(visudodir)/visudo
-+	$(INSTALL) -O $(install_uid) -G $(install_gid) -M 0111 -s sesh $(DESTDIR)$(visudodir)/sesh
- 
- install-noexec: sudo_noexec.la
- 	$(LIBTOOL) --mode=install $(INSTALL) sudo_noexec.la $(DESTDIR)$(noexecdir)
-diff -up sudo-1.6.9p12/sudo.c.selinux sudo-1.6.9p12/sudo.c
---- sudo-1.6.9p12/sudo.c.selinux	2008-02-06 12:45:07.000000000 +0100
-+++ sudo-1.6.9p12/sudo.c	2008-02-06 13:06:50.000000000 +0100
-@@ -101,6 +101,14 @@
- #include <libaudit.h>
- #endif
- 
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+static char *role_s = NULL;                  /* role spec'd by user in argv[] */
-+static char *type_s = NULL;                  /* type spec'd by user in argv[] */
-+extern void selinux_exec(char *role_s, char *type_s, char *safe_cmnd, int NewArgc, char **NewArgv, char **environ);
-+
-+#endif
-+
- #include "sudo.h"
- #include "interfaces.h"
- #include "version.h"
-@@ -487,6 +495,12 @@ main(argc, argv, envp)
- 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0)
- 	    exit(0);
- 	else {
-+#ifdef WITH_SELINUX
-+	    if( is_selinux_enabled() >0 && role_s) {
-+		    selinux_exec(role_s, type_s, safe_cmnd, NewArgc, NewArgv, environ);	/* run the command */
-+		    exit(-1);
-+	    } 
-+#endif
- 	    execve(safe_cmnd, NewArgv, environ);
- 	}
- #else
-@@ -817,6 +831,30 @@ parse_args(argc, argv)
- 		    NewArgv++;
- 		    break;
- #endif
-+#ifdef WITH_SELINUX
-+	    case 'r':
-+		/* Must have an associated SELinux role. */
-+		if (NewArgv[1] == NULL)
-+		    usage(1);
-+
-+		role_s = NewArgv[1];
-+
-+		/* Shift Argv over and adjust Argc. */
-+		NewArgc--;
-+		NewArgv++;
-+		break;
-+	    case 't':
-+		/* Must have an associated SELinux type. */
-+		if (NewArgv[1] == NULL)
-+		    usage(1);
-+
-+		type_s = NewArgv[1];
-+
-+		/* Shift Argv over and adjust Argc. */
-+		NewArgc--;
-+		NewArgv++;
-+		break;
-+#endif
- #ifdef HAVE_LOGIN_CAP_H
- 		case 'c':
- 		    /* Must have an associated login class. */
-@@ -1318,6 +1356,9 @@ usage(exit_val)
- #ifdef HAVE_BSD_AUTH_H
- 	" [-a auth_type]",
- #endif
-+#ifdef WITH_SELINUX
-+	" [-r role] [-t type] ",
-+#endif
- #ifdef HAVE_LOGIN_CAP_H
- 	" [-c class|-]",
- #endif
-diff -up sudo-1.6.9p12/sudo.man.in.selinux sudo-1.6.9p12/sudo.man.in
---- sudo-1.6.9p12/sudo.man.in.selinux	2008-01-14 13:22:57.000000000 +0100
-+++ sudo-1.6.9p12/sudo.man.in	2008-02-06 13:06:50.000000000 +0100
-@@ -159,6 +159,7 @@ sudo, sudoedit \- execute a command as a
- .PP
- \&\fBsudo\fR [\fB\-bEHPS\fR] [\fB\-a\fR\ \fIauth_type\fR]
- [\fB\-c\fR\ \fIclass\fR|\fI\-\fR] [\fB\-p\fR\ \fIprompt\fR] [\fB\-u\fR\ \fIusername\fR|\fI#uid\fR]
-+[\fB\-r\fR \fIrole\fR ] [\fB\-t\fR \fItype\fR ]
- [\fB\s-1VAR\s0\fR=\fIvalue\fR] {\fB\-i\fR\ |\ \fB\-s\fR\ |\ \fIcommand\fR}
- .PP
- \&\fBsudoedit\fR [\fB\-S\fR] [\fB\-a\fR\ \fIauth_type\fR] [\fB\-c\fR\ \fIclass\fR|\fI\-\fR]
-@@ -323,6 +324,16 @@ preserve the invoking user's group vecto
- \&\fBsudo\fR will initialize the group vector to the list of groups the
- target user is in.  The real and effective group IDs, however, are
- still set to match the target user.
-+.IP "\-r" 4
-+.IX Item "-r"
-+The \fB\-r\fR (\fRrole\fR) option causes the new (SELinux) security context to have the role specified by
-+\fIROLE\fR.
-+.IP "\-t" 4
-+.IX Item "-t" 
-+The \fB\-t\fR (\fRtype\fR) option causes the new (SELinux) security context to have the have the type (domain)
-+specified by
-+\fITYPE\fR.
-+If no type is specified, the default type is derived from the specified role.
- .IP "\-p" 4
- .IX Item "-p"
- The \fB\-p\fR (\fIprompt\fR) option allows you to override the default
diff --git a/sudo-1.6.9p4-audit.patch b/sudo-1.6.9p13-audit.patch
similarity index 77%
rename from sudo-1.6.9p4-audit.patch
rename to sudo-1.6.9p13-audit.patch
index 158dee0..eef7ac3 100644
--- a/sudo-1.6.9p4-audit.patch
+++ b/sudo-1.6.9p13-audit.patch
@@ -1,6 +1,6 @@
-diff -up sudo-1.6.9p12/set_perms.c.audit sudo-1.6.9p12/set_perms.c
---- sudo-1.6.9p12/set_perms.c.audit	2007-11-28 00:41:23.000000000 +0100
-+++ sudo-1.6.9p12/set_perms.c	2008-02-05 14:09:29.000000000 +0100
+diff -up sudo-1.6.9p13/set_perms.c.audit sudo-1.6.9p13/set_perms.c
+--- sudo-1.6.9p13/set_perms.c.audit	2007-11-28 00:41:23.000000000 +0100
++++ sudo-1.6.9p13/set_perms.c	2008-02-21 14:03:02.000000000 +0100
 @@ -53,6 +53,10 @@
  #ifdef HAVE_LOGIN_CAP_H
  # include <login_cap.h>
@@ -66,11 +66,11 @@ diff -up sudo-1.6.9p12/set_perms.c.audit sudo-1.6.9p12/set_perms.c
  
  	case PERM_SUDOERS:
  				/* assume euid == ROOT_UID, ruid == user */
-diff -up sudo-1.6.9p12/sudo.c.audit sudo-1.6.9p12/sudo.c
---- sudo-1.6.9p12/sudo.c.audit	2008-02-05 13:57:21.000000000 +0100
-+++ sudo-1.6.9p12/sudo.c	2008-02-05 13:57:21.000000000 +0100
-@@ -97,6 +97,10 @@
- # include <sys/task.h>
+diff -up sudo-1.6.9p13/sudo.c.audit sudo-1.6.9p13/sudo.c
+--- sudo-1.6.9p13/sudo.c.audit	2008-02-21 14:03:02.000000000 +0100
++++ sudo-1.6.9p13/sudo.c	2008-02-21 14:03:02.000000000 +0100
+@@ -100,6 +100,10 @@
+ # include <selinux/selinux.h>
  #endif
  
 +#ifdef WITH_AUDIT
@@ -80,7 +80,7 @@ diff -up sudo-1.6.9p12/sudo.c.audit sudo-1.6.9p12/sudo.c
  #include "sudo.h"
  #include "interfaces.h"
  #include "version.h"
-@@ -292,6 +296,10 @@ main(argc, argv, envp)
+@@ -295,6 +299,10 @@ main(argc, argv, envp)
      if (safe_cmnd == NULL)
  	safe_cmnd = estrdup(user_cmnd);
  
@@ -91,7 +91,7 @@ diff -up sudo-1.6.9p12/sudo.c.audit sudo-1.6.9p12/sudo.c
      /*
       * Look up the timestamp dir owner if one is specified.
       */
-@@ -302,9 +310,13 @@ main(argc, argv, envp)
+@@ -305,9 +313,13 @@ main(argc, argv, envp)
  	    pw = getpwuid(atoi(def_timestampowner + 1));
  	else
  	    pw = getpwnam(def_timestampowner);
@@ -106,7 +106,7 @@ diff -up sudo-1.6.9p12/sudo.c.audit sudo-1.6.9p12/sudo.c
  	timestamp_uid = pw->pw_uid;
      }
  
-@@ -314,15 +326,22 @@ main(argc, argv, envp)
+@@ -317,15 +329,22 @@ main(argc, argv, envp)
  	exit(0);
      }
  
@@ -130,7 +130,7 @@ diff -up sudo-1.6.9p12/sudo.c.audit sudo-1.6.9p12/sudo.c
  	exit(1);
      }
  
-@@ -336,8 +355,12 @@ main(argc, argv, envp)
+@@ -339,8 +358,12 @@ main(argc, argv, envp)
  
      /* Bail if a tty is required and we don't have one.  */
      if (def_requiretty) {
@@ -144,7 +144,7 @@ diff -up sudo-1.6.9p12/sudo.c.audit sudo-1.6.9p12/sudo.c
  	else
  	    (void) close(fd);
      }
-@@ -370,17 +393,27 @@ main(argc, argv, envp)
+@@ -373,17 +396,27 @@ main(argc, argv, envp)
  	/* Finally tell the user if the command did not exist. */
  	if (cmnd_status == NOT_FOUND_DOT) {
  	    warnx("ignoring `%s' found in '.'\nUse `sudo ./%s' if this is the `%s' you wish to run.", user_cmnd, user_cmnd, user_cmnd);
@@ -173,32 +173,25 @@ diff -up sudo-1.6.9p12/sudo.c.audit sudo-1.6.9p12/sudo.c
  	    else
  		validate_env_vars(sudo_user.env_vars);
  	}
-@@ -439,11 +472,23 @@ main(argc, argv, envp)
+@@ -442,6 +475,17 @@ main(argc, argv, envp)
  	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
  	(void) sigaction(SIGCHLD, &saved_sa_chld, NULL);
  
-+	if (access(safe_cmnd, X_OK) != 0) {
-+                warn ("unable to execute %s", safe_cmnd); 
-+#ifdef WITH_AUDIT	
-+		audit_logger(AUDIT_USER_CMD,  safe_cmnd, 0);
++        if (access(safe_cmnd, X_OK) != 0) {
++                 warn ("unable to execute %s", safe_cmnd);
++#ifdef WITH_AUDIT
++                audit_logger(AUDIT_USER_CMD,  safe_cmnd, 0);
 +#endif
-+		exit(127);
-+	}
-+#ifdef WITH_AUDIT	
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, 1);
++                exit(127);
++        }
++#ifdef WITH_AUDIT
++        audit_logger(AUDIT_USER_CMD,  safe_cmnd, 1);
 +#endif
 +
  #ifndef PROFILING
  	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0)
  	    exit(0);
--	else
-+	else {
- 	    execve(safe_cmnd, NewArgv, environ);
-+	}
- #else
- 	exit(0);
- #endif /* PROFILING */
-@@ -456,6 +501,9 @@ main(argc, argv, envp)
+@@ -465,6 +509,9 @@ main(argc, argv, envp)
  	    NewArgv[1] = safe_cmnd;
  	    execve(_PATH_BSHELL, NewArgv, environ);
  	}
@@ -208,10 +201,10 @@ diff -up sudo-1.6.9p12/sudo.c.audit sudo-1.6.9p12/sudo.c
  	warn("unable to execute %s", safe_cmnd);
  	exit(127);
      } else if (ISSET(validated, FLAG_NO_USER) || (validated & FLAG_NO_HOST)) {
-diff -up sudo-1.6.9p12/configure.in.audit sudo-1.6.9p12/configure.in
---- sudo-1.6.9p12/configure.in.audit	2008-02-05 13:57:21.000000000 +0100
-+++ sudo-1.6.9p12/configure.in	2008-02-05 13:57:21.000000000 +0100
-@@ -154,6 +154,10 @@ dnl
+diff -up sudo-1.6.9p13/configure.in.audit sudo-1.6.9p13/configure.in
+--- sudo-1.6.9p13/configure.in.audit	2008-02-21 14:03:02.000000000 +0100
++++ sudo-1.6.9p13/configure.in	2008-02-21 14:03:02.000000000 +0100
+@@ -166,6 +166,10 @@ dnl
  dnl Options for --with
  dnl
  
@@ -222,7 +215,7 @@ diff -up sudo-1.6.9p12/configure.in.audit sudo-1.6.9p12/configure.in
  AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
  [case $with_CC in
      yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
-@@ -1588,6 +1592,25 @@ dnl
+@@ -1614,6 +1618,25 @@ dnl
  : ${mansectsu='8'}
  : ${mansectform='5'}
  
@@ -248,10 +241,10 @@ diff -up sudo-1.6.9p12/configure.in.audit sudo-1.6.9p12/configure.in
  dnl
  dnl Add in any libpaths or libraries specified via configure
  dnl
-diff -up /dev/null sudo-1.6.9p12/audit_help.c
---- /dev/null	2008-02-05 11:01:55.583821645 +0100
-+++ sudo-1.6.9p12/audit_help.c	2008-02-05 13:57:21.000000000 +0100
-@@ -0,0 +1,88 @@
+diff -up /dev/null sudo-1.6.9p13/audit_help.c
+--- /dev/null	2008-02-05 17:16:01.642928004 +0100
++++ sudo-1.6.9p13/audit_help.c	2008-02-21 14:20:56.000000000 +0100
+@@ -0,0 +1,124 @@
 +/*
 + *  Audit helper functions used throughout sudo
 + *
@@ -295,6 +288,10 @@ diff -up /dev/null sudo-1.6.9p12/audit_help.c
 +#include <unistd.h>
 +#include <sys/types.h>
 +
++#ifdef HAVE_SELINUX
++#include <selinux/selinux.h>
++#endif
++
 +int audit_fd;
 +
 +void audit_help_open (void)
@@ -336,14 +333,46 @@ diff -up /dev/null sudo-1.6.9p12/audit_help.c
 +	}
 +}
 +
++#ifdef HAVE_SELINUX
++int send_audit_message(int success, security_context_t old_context,
++                       security_context_t new_context, const char *ttyn)
++{
++        char *msg = NULL;
++        int rc;
++
++        if (audit_fd < 0)
++                return -1;
++
++        if (asprintf(&msg, "newrole: old-context=%s new-context=%s",
++                     old_context ? old_context : "?",
++                     new_context ? new_context : "?") < 0) {
++                fprintf(stderr, "Error allocating memory.\n");
++                rc = -1;
++                goto out;
++        }
++
++        rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
++                                    msg, NULL, NULL, ttyn, success);
++        if (rc <= 0) {
++                fprintf(stderr, "Error sending audit message.\n");
++                rc = -1;
++                goto out;
++        }
++        rc = 0;
++
++        out:
++         free(msg);
++         return rc;
++}
++#endif
 +
 +#endif                         /* WITH_AUDIT */
 +
 +
-diff -up sudo-1.6.9p12/Makefile.in.audit sudo-1.6.9p12/Makefile.in
---- sudo-1.6.9p12/Makefile.in.audit	2008-01-14 13:22:57.000000000 +0100
-+++ sudo-1.6.9p12/Makefile.in	2008-02-05 13:57:21.000000000 +0100
-@@ -119,11 +119,13 @@ HDRS = compat.h def_data.h defaults.h in
+diff -up sudo-1.6.9p13/Makefile.in.audit sudo-1.6.9p13/Makefile.in
+--- sudo-1.6.9p13/Makefile.in.audit	2008-02-19 19:13:10.000000000 +0100
++++ sudo-1.6.9p13/Makefile.in	2008-02-21 14:03:02.000000000 +0100
+@@ -120,11 +120,13 @@ HDRS = compat.h def_data.h defaults.h in
  
  AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
  
@@ -358,7 +387,7 @@ diff -up sudo-1.6.9p12/Makefile.in.audit sudo-1.6.9p12/Makefile.in
  
  VISUDOBJS = visudo.o fileops.o gettime.o goodpath.o find_path.o $(PARSEOBJS)
  
-@@ -274,6 +276,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
+@@ -276,6 +278,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
  sia.o: $(authdir)/sia.c $(AUTHDEP)
  	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
  
@@ -367,10 +396,10 @@ diff -up sudo-1.6.9p12/Makefile.in.audit sudo-1.6.9p12/Makefile.in
 +
  sudo.man.in: $(srcdir)/sudo.pod
  	@rm -f $(srcdir)/$@
- 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e 1d -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" >> $@ )
-diff -up sudo-1.6.9p12/sudo.h.audit sudo-1.6.9p12/sudo.h
---- sudo-1.6.9p12/sudo.h.audit	2008-02-05 13:57:21.000000000 +0100
-+++ sudo-1.6.9p12/sudo.h	2008-02-05 13:57:21.000000000 +0100
+ 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
+diff -up sudo-1.6.9p13/sudo.h.audit sudo-1.6.9p13/sudo.h
+--- sudo-1.6.9p13/sudo.h.audit	2008-02-21 14:03:02.000000000 +0100
++++ sudo-1.6.9p13/sudo.h	2008-02-21 14:03:02.000000000 +0100
 @@ -23,6 +23,8 @@
  #ifndef _SUDO_SUDO_H
  #define _SUDO_SUDO_H
@@ -380,7 +409,7 @@ diff -up sudo-1.6.9p12/sudo.h.audit sudo-1.6.9p12/sudo.h
  #include <pathnames.h>
  #include <limits.h>
  #include "compat.h"
-@@ -278,4 +280,10 @@ extern int sudo_mode;
+@@ -287,4 +289,10 @@ extern int sudo_mode;
  extern int errno;
  #endif
  
diff --git a/sudo.spec b/sudo.spec
index b460ec2..d45b69b 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.6.9p12
+Version: 1.6.9p13
 Release: 1%{?dist}
 License: BSD
 Group: Applications/System
@@ -26,8 +26,7 @@ Patch2: sudo-1.6.9p4-login.patch
 # the rest, see changelog
 Patch3: sudo-1.6.9p4-getgrouplist.patch
 Patch4: sudo-1.6.9p12-noPam.patch
-Patch5: sudo-1.6.9p4-audit.patch
-Patch6: sudo-1.6.9p12-selinux.patch
+Patch5: sudo-1.6.9p13-audit.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -47,7 +46,6 @@ on many different machines.
 %patch3 -p1 -b .getgrouplist
 %patch4 -p1 -b .noPam
 %patch5 -p1 -b .audit
-%patch6 -p1 -b .selinux
 
 autoreconf
 
@@ -72,7 +70,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-env-editor \
         --with-ignore-dot \
         --with-tty-tickets \
-        --with-ldap
+        --with-ldap \
+	--with-selinux
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -118,7 +117,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(4111,root,root) %{_bindir}/sudo
 %attr(4111,root,root) %{_bindir}/sudoedit
 %attr(0755,root,root) %{_sbindir}/visudo
-%attr(0755,root,root) %{_sbindir}/sesh
+%attr(0755,root,root) %{_libexecdir}/sesh
 %{_libexecdir}/sudo_noexec.*
 %{_mandir}/man5/sudoers.5*
 %{_mandir}/man8/sudo.8*
@@ -130,6 +129,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Thu Feb 21 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-1
+- upgrade to the latest upstream release
+
 * Wed Feb 06 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p12-1
 - upgrade to the latest upstream release
 - add selinux support

From 83dd2f48347868deb5d40622356ac6009b6f3d77 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Tue, 4 Mar 2008 10:28:10 +0000
Subject: [PATCH 014/199] audit support improvement

---
 sudo-1.6.9p13-audit.patch | 161 +++++++++++++-------------------------
 sudo.spec                 |   5 +-
 2 files changed, 60 insertions(+), 106 deletions(-)

diff --git a/sudo-1.6.9p13-audit.patch b/sudo-1.6.9p13-audit.patch
index eef7ac3..909d8a7 100644
--- a/sudo-1.6.9p13-audit.patch
+++ b/sudo-1.6.9p13-audit.patch
@@ -1,6 +1,6 @@
 diff -up sudo-1.6.9p13/set_perms.c.audit sudo-1.6.9p13/set_perms.c
 --- sudo-1.6.9p13/set_perms.c.audit	2007-11-28 00:41:23.000000000 +0100
-+++ sudo-1.6.9p13/set_perms.c	2008-02-21 14:03:02.000000000 +0100
++++ sudo-1.6.9p13/set_perms.c	2008-03-04 11:18:45.000000000 +0100
 @@ -53,6 +53,10 @@
  #ifdef HAVE_LOGIN_CAP_H
  # include <login_cap.h>
@@ -67,8 +67,8 @@ diff -up sudo-1.6.9p13/set_perms.c.audit sudo-1.6.9p13/set_perms.c
  	case PERM_SUDOERS:
  				/* assume euid == ROOT_UID, ruid == user */
 diff -up sudo-1.6.9p13/sudo.c.audit sudo-1.6.9p13/sudo.c
---- sudo-1.6.9p13/sudo.c.audit	2008-02-21 14:03:02.000000000 +0100
-+++ sudo-1.6.9p13/sudo.c	2008-02-21 14:03:02.000000000 +0100
+--- sudo-1.6.9p13/sudo.c.audit	2008-03-04 11:18:45.000000000 +0100
++++ sudo-1.6.9p13/sudo.c	2008-03-04 11:21:54.000000000 +0100
 @@ -100,6 +100,10 @@
  # include <selinux/selinux.h>
  #endif
@@ -91,119 +91,54 @@ diff -up sudo-1.6.9p13/sudo.c.audit sudo-1.6.9p13/sudo.c
      /*
       * Look up the timestamp dir owner if one is specified.
       */
-@@ -305,9 +313,13 @@ main(argc, argv, envp)
- 	    pw = getpwuid(atoi(def_timestampowner + 1));
- 	else
- 	    pw = getpwnam(def_timestampowner);
--	if (!pw)
-+	if (!pw) {
-+#if defined(WITH_AUDIT)
-+	    audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
-+#endif
- 	    log_error(0, "timestamp owner (%s): No such user",
- 		def_timestampowner);
-+        }
- 	timestamp_uid = pw->pw_uid;
-     }
- 
-@@ -317,15 +329,22 @@ main(argc, argv, envp)
- 	exit(0);
-     }
- 
--    if (ISSET(validated, VALIDATE_ERROR))
-+    if (ISSET(validated, VALIDATE_ERROR)) {
-+#if defined(WITH_AUDIT)
-+        audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
-+#endif
- 	log_error(0, "parse error in %s near line %d", _PATH_SUDOERS,
- 	    errorlineno);
-+    }
- 
-     /* Is root even allowed to run sudo? */
-     if (user_uid == 0 && !def_root_sudo) {
- 	(void) fprintf(stderr,
- 	    "Sorry, %s has been configured to not allow root to run it.\n",
- 	    getprogname());
-+#if defined(WITH_AUDIT)
-+        audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
-+#endif
- 	exit(1);
-     }
- 
-@@ -339,8 +358,12 @@ main(argc, argv, envp)
- 
-     /* Bail if a tty is required and we don't have one.  */
-     if (def_requiretty) {
--	if ((fd = open(_PATH_TTY, O_RDWR|O_NOCTTY)) == -1)
-+	if ((fd = open(_PATH_TTY, O_RDWR|O_NOCTTY)) == -1) {
-+#if defined(WITH_AUDIT)
-+	    audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
-+#endif
- 	    log_error(NO_MAIL, "sorry, you must have a tty to run sudo");
-+        }
- 	else
- 	    (void) close(fd);
-     }
-@@ -373,17 +396,27 @@ main(argc, argv, envp)
- 	/* Finally tell the user if the command did not exist. */
- 	if (cmnd_status == NOT_FOUND_DOT) {
- 	    warnx("ignoring `%s' found in '.'\nUse `sudo ./%s' if this is the `%s' you wish to run.", user_cmnd, user_cmnd, user_cmnd);
-+#if defined(WITH_AUDIT)
-+	    audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
-+#endif
- 	    exit(1);
- 	} else if (cmnd_status == NOT_FOUND) {
- 	    warnx("%s: command not found", user_cmnd);
-+#if defined(WITH_AUDIT)
-+	    audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
-+#endif
- 	    exit(1);
- 	}
- 
- 	/* If user specified env vars make sure sudoers allows it. */
- 	if (ISSET(sudo_mode, MODE_RUN) && !ISSET(validated, FLAG_SETENV)) {
--	    if (ISSET(sudo_mode, MODE_PRESERVE_ENV))
-+	    if (ISSET(sudo_mode, MODE_PRESERVE_ENV)) {
-+#if defined(WITH_AUDIT)
-+	        audit_logger(AUDIT_USER_CMD,  user_cmnd, 0);
-+#endif
- 		log_error(NO_MAIL,
- 		    "sorry, you are not allowed to preserve the environment");
-+            }
- 	    else
- 		validate_env_vars(sudo_user.env_vars);
- 	}
-@@ -442,6 +475,17 @@ main(argc, argv, envp)
+@@ -442,6 +450,17 @@ main(argc, argv, envp)
  	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
  	(void) sigaction(SIGCHLD, &saved_sa_chld, NULL);
  
 +        if (access(safe_cmnd, X_OK) != 0) {
 +                 warn ("unable to execute %s", safe_cmnd);
 +#ifdef WITH_AUDIT
-+                audit_logger(AUDIT_USER_CMD,  safe_cmnd, 0);
++                audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
 +#endif
 +                exit(127);
 +        }
 +#ifdef WITH_AUDIT
-+        audit_logger(AUDIT_USER_CMD,  safe_cmnd, 1);
++        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
 +#endif
 +
  #ifndef PROFILING
  	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0)
  	    exit(0);
-@@ -465,6 +509,9 @@ main(argc, argv, envp)
+@@ -465,10 +484,16 @@ main(argc, argv, envp)
  	    NewArgv[1] = safe_cmnd;
  	    execve(_PATH_BSHELL, NewArgv, environ);
  	}
 +#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, 0);
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
 +#endif
  	warn("unable to execute %s", safe_cmnd);
  	exit(127);
      } else if (ISSET(validated, FLAG_NO_USER) || (validated & FLAG_NO_HOST)) {
+ 	log_auth(validated, 1);
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     } else if (ISSET(validated, VALIDATE_NOT_OK)) {
+ 	if (def_path_info) {
+@@ -489,6 +514,9 @@ main(argc, argv, envp)
+ 	    /* Just tell the user they are not allowed to run foo. */
+ 	    log_auth(validated, 1);
+ 	}
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     } else {
+ 	/* should never get here */
 diff -up sudo-1.6.9p13/configure.in.audit sudo-1.6.9p13/configure.in
---- sudo-1.6.9p13/configure.in.audit	2008-02-21 14:03:02.000000000 +0100
-+++ sudo-1.6.9p13/configure.in	2008-02-21 14:03:02.000000000 +0100
+--- sudo-1.6.9p13/configure.in.audit	2008-03-04 11:18:45.000000000 +0100
++++ sudo-1.6.9p13/configure.in	2008-03-04 11:18:45.000000000 +0100
 @@ -166,6 +166,10 @@ dnl
  dnl Options for --with
  dnl
@@ -243,8 +178,8 @@ diff -up sudo-1.6.9p13/configure.in.audit sudo-1.6.9p13/configure.in
  dnl
 diff -up /dev/null sudo-1.6.9p13/audit_help.c
 --- /dev/null	2008-02-05 17:16:01.642928004 +0100
-+++ sudo-1.6.9p13/audit_help.c	2008-02-21 14:20:56.000000000 +0100
-@@ -0,0 +1,124 @@
++++ sudo-1.6.9p13/audit_help.c	2008-03-04 11:21:15.000000000 +0100
+@@ -0,0 +1,140 @@
 +/*
 + *  Audit helper functions used throughout sudo
 + *
@@ -285,6 +220,7 @@ diff -up /dev/null sudo-1.6.9p13/audit_help.c
 +#include <libaudit.h>
 +#include <errno.h>
 +#include <stdio.h>
++#include <string.h>
 +#include <unistd.h>
 +#include <sys/types.h>
 +
@@ -314,22 +250,36 @@ diff -up /dev/null sudo-1.6.9p13/audit_help.c
 + *
 + * type - type of message: AUDIT_USER_CMD
 + * command - the command being logged
++ * params - parames of the command
 + * result - 1 is "success" and 0 is "failed"
 + *
 + */
-+void audit_logger (int type, const char *command, int result)
++void audit_logger (int type, const char *command, const char *params, int result)
 +{
 +	int err;
++	char *msg;
 +
-+	if (audit_fd < 0)
++	if( audit_fd < 0 )
 +		return;
 +	else {
-+               err = audit_log_user_command (audit_fd, type, command, NULL, result);
-+               /* The kernel supports auditing and we had
++
++		if( params ) 
++	                err = asprintf(&msg, "%s %s", command, params);
++		else 
++	                err = asprintf(&msg, "%s", command);
++                if (err < 0) {
++                        fprintf (stderr, "Memory allocation for audit message wasn’t possible.\n");
++                        return;
++                }
++		
++		err = audit_log_user_command (audit_fd, type, msg, NULL, result);
++               /* The kernel supports auditing and we had 
 +                  enough privilege to write to the socket. */
-+               if( err <= 0 && !(errno == EPERM && getuid() != 0) ) {
-+                       perror("audit_log_user_command()");
-+               }
++		if( err <= 0 && !(errno == EPERM && getuid() != 0) ) {
++			perror("audit_log_user_command()");
++		}
++
++		free(msg);
 +	}
 +}
 +
@@ -353,6 +303,7 @@ diff -up /dev/null sudo-1.6.9p13/audit_help.c
 +
 +        rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
 +                                    msg, NULL, NULL, ttyn, success);
++
 +        if (rc <= 0) {
 +                fprintf(stderr, "Error sending audit message.\n");
 +                rc = -1;
@@ -371,7 +322,7 @@ diff -up /dev/null sudo-1.6.9p13/audit_help.c
 +
 diff -up sudo-1.6.9p13/Makefile.in.audit sudo-1.6.9p13/Makefile.in
 --- sudo-1.6.9p13/Makefile.in.audit	2008-02-19 19:13:10.000000000 +0100
-+++ sudo-1.6.9p13/Makefile.in	2008-02-21 14:03:02.000000000 +0100
++++ sudo-1.6.9p13/Makefile.in	2008-03-04 11:18:45.000000000 +0100
 @@ -120,11 +120,13 @@ HDRS = compat.h def_data.h defaults.h in
  
  AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
@@ -398,8 +349,8 @@ diff -up sudo-1.6.9p13/Makefile.in.audit sudo-1.6.9p13/Makefile.in
  	@rm -f $(srcdir)/$@
  	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
 diff -up sudo-1.6.9p13/sudo.h.audit sudo-1.6.9p13/sudo.h
---- sudo-1.6.9p13/sudo.h.audit	2008-02-21 14:03:02.000000000 +0100
-+++ sudo-1.6.9p13/sudo.h	2008-02-21 14:03:02.000000000 +0100
+--- sudo-1.6.9p13/sudo.h.audit	2008-03-04 11:18:45.000000000 +0100
++++ sudo-1.6.9p13/sudo.h	2008-03-04 11:18:45.000000000 +0100
 @@ -23,6 +23,8 @@
  #ifndef _SUDO_SUDO_H
  #define _SUDO_SUDO_H
@@ -416,7 +367,7 @@ diff -up sudo-1.6.9p13/sudo.h.audit sudo-1.6.9p13/sudo.h
 +#ifdef WITH_AUDIT
 +extern int audit_fd;
 +extern void audit_help_open (void);
-+extern void audit_logger (int, const char *, int);
++extern void audit_logger (int, const char *, const char *, int);
 +#endif
 +
  #endif /* _SUDO_SUDO_H */
diff --git a/sudo.spec b/sudo.spec
index d45b69b..e41ea43 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p13
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -129,6 +129,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Tue Mar 04 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-2
+- audit support improvement
+
 * Thu Feb 21 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-1
 - upgrade to the latest upstream release
 

From 475a962dfef96da0fb4195bc8d9aa24d82effed7 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Thu, 13 Mar 2008 08:50:25 +0000
Subject: [PATCH 015/199] include [sudo] in password prompt

---
 sudo.spec | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index e41ea43..976f367 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p13
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -71,7 +71,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-ignore-dot \
         --with-tty-tickets \
         --with-ldap \
-	--with-selinux
+	--with-selinux \
+	--with-passprompt="[sudo] password for %p: "
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -129,6 +130,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Thu Mar 13 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-3
+- include [sudo] in password prompt (#437092)
+
 * Tue Mar 04 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-2
 - audit support improvement
 

From 80df5ff713b357e5fd336ca1cbd70e4367768c13 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Mon, 31 Mar 2008 14:08:45 +0000
Subject: [PATCH 016/199] include ldap files in rpm package (#439506)

---
 sudo.spec | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 976f367..e5a23bf 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p13
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -110,7 +110,8 @@ rm -rf $RPM_BUILD_ROOT
 
 %files
 %defattr(-,root,root)
-%doc BUGS CHANGES HISTORY LICENSE README TROUBLESHOOTING UPGRADE *.pod
+%doc BUGS CHANGES HISTORY LICENSE README* TROUBLESHOOTING UPGRADE
+%doc *.pod schema.* sudoers2ldif sample.*
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %config(noreplace) /etc/pam.d/sudo
 %config(noreplace) /etc/pam.d/sudo-i
@@ -130,6 +131,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Mon Mar 31 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-4
+- include ldap files in rpm package (#439506)
+
 * Thu Mar 13 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-3
 - include [sudo] in password prompt (#437092)
 

From e94854c07937f8ccca02f47c267a0ea911e8d99a Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Mon, 5 May 2008 11:53:04 +0000
Subject: [PATCH 017/199] fix path to updatedb in /etc/sudoers (#445103)

---
 sources               | 2 +-
 sudo-1.6.8p12-sudoers | 2 +-
 sudo.spec             | 5 ++++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/sources b/sources
index da4c36a..46a9122 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-573c851f2a204f1cdbbdb657015fc6ef  sudo-1.6.8p12-sudoers
 7e9d3e7780c632469ffe88fcc4a6b1ca  sudo-1.6.9p13.tar.gz
+f9b28fbbb09ec22ca543c758db44d2cd  sudo-1.6.8p12-sudoers
diff --git a/sudo-1.6.8p12-sudoers b/sudo-1.6.8p12-sudoers
index 2e7ef76..ed74e42 100644
--- a/sudo-1.6.8p12-sudoers
+++ b/sudo-1.6.8p12-sudoers
@@ -33,7 +33,7 @@ Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
 Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
 
 ## Updating the locate database
-Cmnd_Alias LOCATE = /usr/sbin/updatedb
+Cmnd_Alias LOCATE = /usr/bin/updatedb
 
 ## Storage
 Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
diff --git a/sudo.spec b/sudo.spec
index e5a23bf..ec14d74 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p13
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -131,6 +131,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Mon May 05 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-5
+- fix path to updatedb in /etc/sudoers (#445103)
+
 * Mon Mar 31 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-4
 - include ldap files in rpm package (#439506)
 

From 2981ba32e02b2b31975d95be44d67f35815ccc73 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Tue, 13 May 2008 12:42:02 +0000
Subject: [PATCH 018/199] - compiled with secure path (#80215)

---
 sudo.spec | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index ec14d74..79022dd 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p13
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -72,7 +72,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-tty-tickets \
         --with-ldap \
 	--with-selinux \
-	--with-passprompt="[sudo] password for %p: "
+	--with-passprompt="[sudo] password for %p: " \
+	--with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin"
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -131,6 +132,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Tue May 13 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-6
+- compiled with secure path (#80215)
+
 * Mon May 05 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-5
 - fix path to updatedb in /etc/sudoers (#445103)
 

From 05534ca1d29257ab529d5b225ca663f8f2a255c8 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Wed, 18 Jun 2008 09:52:34 +0000
Subject: [PATCH 019/199] build with newer autoconf-2.62 (#449614)

---
 sudo.spec | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 79022dd..80ab46a 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p13
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -47,9 +47,10 @@ on many different machines.
 %patch4 -p1 -b .noPam
 %patch5 -p1 -b .audit
 
-autoreconf
-
 %build
+#hande newer autoconf
+rm acsite.m4 && mv aclocal.m4 acinclude.m4 && autoreconf
+
 %ifarch s390 s390x sparc64
 F_PIE=-fPIE
 %else
@@ -132,6 +133,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Jun 18 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-7
+- build with newer autoconf-2.62 (#449614)
+
 * Tue May 13 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-6
 - compiled with secure path (#80215)
 

From f6d08872ccb01d75ab442b261eaad31bf11e9e31 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Fri, 4 Jul 2008 14:13:33 +0000
Subject: [PATCH 020/199] upgrade

---
 sudo-1.6.9p4-getgrouplist.patch | 21 ++++++++-------
 sudo-1.6.9p4-login.patch        | 48 ++++++++++++++++++---------------
 sudo.spec                       |  7 +++--
 3 files changed, 43 insertions(+), 33 deletions(-)

diff --git a/sudo-1.6.9p4-getgrouplist.patch b/sudo-1.6.9p4-getgrouplist.patch
index 78a988e..4dbac19 100644
--- a/sudo-1.6.9p4-getgrouplist.patch
+++ b/sudo-1.6.9p4-getgrouplist.patch
@@ -1,17 +1,19 @@
---- sudo-1.6.9p4/configure.in.getgrouplist	2007-08-20 11:41:32.000000000 +0200
-+++ sudo-1.6.9p4/configure.in	2007-08-20 13:24:30.000000000 +0200
-@@ -1677,7 +1677,7 @@
- dnl
+diff -up sudo-1.6.9p17/configure.in.getgrouplist sudo-1.6.9p17/configure.in
+--- sudo-1.6.9p17/configure.in.getgrouplist	2008-07-04 16:07:42.000000000 +0200
++++ sudo-1.6.9p17/configure.in	2008-07-04 16:09:29.000000000 +0200
+@@ -1720,7 +1720,7 @@ dnl
+ AC_FUNC_GETGROUPS
  AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
  	       strftime setrlimit initgroups getgroups fstat gettimeofday \
--	       setlocale getaddrinfo)
-+	       setlocale getaddrinfo getgrouplist)
+-	       setlocale getaddrinfo setsid)
++	       setlocale getaddrinfo setsid getgrouplist)
  if test -z "$SKIP_SETRESUID"; then
      AC_CHECK_FUNCS(setresuid, [SKIP_SETREUID=yes])
  fi
---- sudo-1.6.9p4/check.c.getgrouplist	2007-07-06 21:52:13.000000000 +0200
-+++ sudo-1.6.9p4/check.c	2007-08-20 13:21:10.000000000 +0200
-@@ -308,6 +308,24 @@
+diff -up sudo-1.6.9p17/check.c.getgrouplist sudo-1.6.9p17/check.c
+--- sudo-1.6.9p17/check.c.getgrouplist	2008-01-06 00:59:42.000000000 +0100
++++ sudo-1.6.9p17/check.c	2008-07-04 16:08:40.000000000 +0200
+@@ -330,6 +330,24 @@ user_is_exempt()
  	    return(TRUE);
      }
  
@@ -36,4 +38,3 @@
      return(FALSE);
  }
  
-
diff --git a/sudo-1.6.9p4-login.patch b/sudo-1.6.9p4-login.patch
index 1c62966..962b74a 100644
--- a/sudo-1.6.9p4-login.patch
+++ b/sudo-1.6.9p4-login.patch
@@ -1,6 +1,7 @@
---- sudo-1.6.9p4/auth/pam.c.login	2007-07-22 14:14:53.000000000 +0200
-+++ sudo-1.6.9p4/auth/pam.c	2007-08-20 11:08:33.000000000 +0200
-@@ -89,7 +89,12 @@
+diff -up sudo-1.6.9p17/auth/pam.c.login sudo-1.6.9p17/auth/pam.c
+--- sudo-1.6.9p17/auth/pam.c.login	2008-02-22 21:19:45.000000000 +0100
++++ sudo-1.6.9p17/auth/pam.c	2008-07-04 15:34:17.000000000 +0200
+@@ -98,7 +98,12 @@ pam_init(pw, promptp, auth)
      if (auth != NULL)
  	auth->data = (VOID *) &pam_status;
      pam_conv.conv = sudo_conv;
@@ -14,9 +15,10 @@
      if (pam_status != PAM_SUCCESS) {
  	log_error(USE_ERRNO|NO_EXIT|NO_MAIL, "unable to initialize PAM");
  	return(AUTH_FATAL);
---- sudo-1.6.9p4/env.c.login	2007-07-31 20:04:31.000000000 +0200
-+++ sudo-1.6.9p4/env.c	2007-08-20 11:24:48.000000000 +0200
-@@ -104,7 +104,7 @@
+diff -up sudo-1.6.9p17/env.c.login sudo-1.6.9p17/env.c
+--- sudo-1.6.9p17/env.c.login	2008-06-21 21:04:07.000000000 +0200
++++ sudo-1.6.9p17/env.c	2008-07-04 15:34:17.000000000 +0200
+@@ -104,7 +104,7 @@ struct environment {
  /*
   * Prototypes
   */
@@ -25,7 +27,7 @@
  static void insert_env		__P((char *, struct environment *, int));
  static char *format_env		__P((char *, ...));
  
-@@ -391,9 +391,8 @@
+@@ -392,9 +392,8 @@ matches_env_keep(var)
   * Also adds sudo-specific variables (SUDO_*).
   */
  char **
@@ -36,9 +38,10 @@
      int noexec;
  {
      char **ep, *cp, *ps1;
---- sudo-1.6.9p4/configure.in.login	2007-08-15 15:48:51.000000000 +0200
-+++ sudo-1.6.9p4/configure.in	2007-08-20 11:08:33.000000000 +0200
-@@ -351,6 +351,17 @@
+diff -up sudo-1.6.9p17/configure.in.login sudo-1.6.9p17/configure.in
+--- sudo-1.6.9p17/configure.in.login	2008-06-22 22:23:56.000000000 +0200
++++ sudo-1.6.9p17/configure.in	2008-07-04 15:34:17.000000000 +0200
+@@ -366,6 +366,17 @@ AC_ARG_WITH(pam, [  --with-pam          
  		;;
  esac])
  
@@ -56,9 +59,10 @@
  AC_ARG_WITH(AFS, [  --with-AFS              enable AFS support],
  [case $with_AFS in
      yes)	AC_DEFINE(HAVE_AFS)
---- sudo-1.6.9p4/sudo.h.login	2007-07-06 16:14:34.000000000 +0200
-+++ sudo-1.6.9p4/sudo.h	2007-08-20 11:33:45.000000000 +0200
-@@ -268,6 +268,7 @@
+diff -up sudo-1.6.9p17/sudo.h.login sudo-1.6.9p17/sudo.h
+--- sudo-1.6.9p17/sudo.h.login	2008-02-09 15:44:48.000000000 +0100
++++ sudo-1.6.9p17/sudo.h	2008-07-04 15:34:17.000000000 +0200
+@@ -281,6 +281,7 @@ extern struct passwd *auth_pw;
  extern FILE *sudoers_fp;
  extern int tgetpass_flags;
  extern uid_t timestamp_uid;
@@ -66,9 +70,10 @@
  #endif
  #ifndef errno
  extern int errno;
---- sudo-1.6.9p4/sudo.c.login	2007-08-15 15:48:56.000000000 +0200
-+++ sudo-1.6.9p4/sudo.c	2007-08-20 11:34:07.000000000 +0200
-@@ -122,7 +122,7 @@
+diff -up sudo-1.6.9p17/sudo.c.login sudo-1.6.9p17/sudo.c
+--- sudo-1.6.9p17/sudo.c.login	2008-06-21 21:04:07.000000000 +0200
++++ sudo-1.6.9p17/sudo.c	2008-07-04 16:01:43.000000000 +0200
+@@ -125,7 +125,7 @@ static void usage_excl			__P((int));
  static struct passwd *get_authpw	__P((void));
  extern int sudo_edit			__P((int, char **, char **));
  extern void list_matches		__P((void));
@@ -77,15 +82,16 @@
  extern void validate_env_vars		__P((struct list_member *));
  extern char **insert_env_vars		__P((char **, struct list_member *));
  extern struct passwd *sudo_getpwnam	__P((const char *));
-@@ -153,6 +153,7 @@
+@@ -156,7 +156,7 @@ login_cap_t *lc;
  char *login_style;
  #endif /* HAVE_BSD_AUTH_H */
- sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp, saved_sa_chld;
+ sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp;
+-
 +int sudo_mode;
  
- 
  int
-@@ -164,7 +165,6 @@
+ main(argc, argv, envp)
+@@ -167,7 +167,6 @@ main(argc, argv, envp)
      int validated;
      int fd;
      int cmnd_status;
@@ -93,7 +99,7 @@
      int pwflag;
      sigaction_t sa;
      extern int printmatches;
-@@ -347,7 +347,7 @@
+@@ -345,7 +344,7 @@ main(argc, argv, envp)
  	def_env_reset = FALSE;
  
      /* Build a new environment that avoids any nasty bits. */
diff --git a/sudo.spec b/sudo.spec
index 80ab46a..2c063ee 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.6.9p13
-Release: 7%{?dist}
+Version: 1.6.9p17
+Release: 1%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -133,6 +133,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Fri Jul 04 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-1
+- upgrade
+
 * Wed Jun 18 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-7
 - build with newer autoconf-2.62 (#449614)
 

From 5d9121aa3f9536417aa9c273045c39978033e68f Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Fri, 4 Jul 2008 14:31:15 +0000
Subject: [PATCH 021/199] upload new sources

---
 .cvsignore | 2 +-
 sources    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.cvsignore b/.cvsignore
index c1b4a48..839a561 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
+sudo-1.6.9p17.tar.gz
 sudo-1.6.8p12-sudoers
-sudo-1.6.9p13.tar.gz
diff --git a/sources b/sources
index 46a9122..b92574f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-7e9d3e7780c632469ffe88fcc4a6b1ca  sudo-1.6.9p13.tar.gz
+60daf18f28e2c1eb7641c4408e244110  sudo-1.6.9p17.tar.gz
 f9b28fbbb09ec22ca543c758db44d2cd  sudo-1.6.8p12-sudoers

From 5922acb08943b793b85bfb2e6a79745f8aa6bbc2 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Tue, 2 Sep 2008 13:56:42 +0000
Subject: [PATCH 022/199] - adjust audit patch, do not scream when kernel is
 compiled without audit     netlink support (#401201

---
 sudo-1.6.9p13-audit.patch | 380 +++++++++++++++++++-------------------
 sudo.spec                 |   6 +-
 2 files changed, 195 insertions(+), 191 deletions(-)

diff --git a/sudo-1.6.9p13-audit.patch b/sudo-1.6.9p13-audit.patch
index 909d8a7..d8937e2 100644
--- a/sudo-1.6.9p13-audit.patch
+++ b/sudo-1.6.9p13-audit.patch
@@ -1,184 +1,6 @@
-diff -up sudo-1.6.9p13/set_perms.c.audit sudo-1.6.9p13/set_perms.c
---- sudo-1.6.9p13/set_perms.c.audit	2007-11-28 00:41:23.000000000 +0100
-+++ sudo-1.6.9p13/set_perms.c	2008-03-04 11:18:45.000000000 +0100
-@@ -53,6 +53,10 @@
- #ifdef HAVE_LOGIN_CAP_H
- # include <login_cap.h>
- #endif
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+# include <sys/prctl.h>
-+# include <sys/capability.h>
-+#endif
- 
- #include "sudo.h"
- 
-@@ -119,13 +123,46 @@ set_perms(perm)
- 			      	break;
- 
- 	case PERM_FULL_RUNAS:
--				/* headed for exec(), assume euid == ROOT_UID */
--				runas_setup();
--				if (setresuid(def_stay_setuid ?
--				    user_uid : runas_pw->pw_uid,
--				    runas_pw->pw_uid, runas_pw->pw_uid))
--				    err(1, "unable to change to runas uid");
--				break;
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+                                { /* BEGIN CAP BLOCK */
-+                                 cap_t new_caps;
-+                                 cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
-+
-+                                 if (runas_pw->pw_uid != ROOT_UID) {
-+                                     new_caps = cap_init ();
-+                                     if (!new_caps)
-+                                         err(1, "Error initing capabilities, aborting.\n");
-+
-+                                     if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
-+                                        cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
-+                                          err(1, "Error setting capabilities, aborting\n");
-+                                     }
-+
-+                                     if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0))
-+                                         err(1, "Error setting KEEPCAPS, aborting\n");
-+                                 }
-+#endif
-+                                /* headed for exec(), assume euid == ROOT_UID */
-+                                 runas_setup ();
-+                                 if (setresuid(def_stay_setuid ?
-+                                     user_uid : runas_pw->pw_uid,
-+                                     runas_pw->pw_uid, runas_pw->pw_uid))
-+                                     err(1, "unable to change to runas uid");
-+
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+                                 if (runas_pw->pw_uid != ROOT_UID) {
-+                                     if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0)
-+                                         err(1, "Error resetting KEEPCAPS, aborting\n");
-+
-+                                     if (cap_set_proc(new_caps))
-+                                         err(1, "Error dropping capabilities, aborting\n");
-+
-+                                     if (cap_free (new_caps))
-+                                         err(1, "Error freeing caps\n");
-+                                 }
-+                                } /* END CAP BLOCK */
-+#endif
-+                                break;
- 
- 	case PERM_SUDOERS:
- 				/* assume euid == ROOT_UID, ruid == user */
-diff -up sudo-1.6.9p13/sudo.c.audit sudo-1.6.9p13/sudo.c
---- sudo-1.6.9p13/sudo.c.audit	2008-03-04 11:18:45.000000000 +0100
-+++ sudo-1.6.9p13/sudo.c	2008-03-04 11:21:54.000000000 +0100
-@@ -100,6 +100,10 @@
- # include <selinux/selinux.h>
- #endif
- 
-+#ifdef WITH_AUDIT
-+#include <libaudit.h>
-+#endif
-+
- #include "sudo.h"
- #include "interfaces.h"
- #include "version.h"
-@@ -295,6 +299,10 @@ main(argc, argv, envp)
-     if (safe_cmnd == NULL)
- 	safe_cmnd = estrdup(user_cmnd);
- 
-+#if defined(WITH_AUDIT)
-+    audit_help_open ();
-+#endif
-+
-     /*
-      * Look up the timestamp dir owner if one is specified.
-      */
-@@ -442,6 +450,17 @@ main(argc, argv, envp)
- 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
- 	(void) sigaction(SIGCHLD, &saved_sa_chld, NULL);
- 
-+        if (access(safe_cmnd, X_OK) != 0) {
-+                 warn ("unable to execute %s", safe_cmnd);
-+#ifdef WITH_AUDIT
-+                audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
-+                exit(127);
-+        }
-+#ifdef WITH_AUDIT
-+        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
-+#endif
-+
- #ifndef PROFILING
- 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0)
- 	    exit(0);
-@@ -465,10 +484,16 @@ main(argc, argv, envp)
- 	    NewArgv[1] = safe_cmnd;
- 	    execve(_PATH_BSHELL, NewArgv, environ);
- 	}
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	warn("unable to execute %s", safe_cmnd);
- 	exit(127);
-     } else if (ISSET(validated, FLAG_NO_USER) || (validated & FLAG_NO_HOST)) {
- 	log_auth(validated, 1);
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     } else if (ISSET(validated, VALIDATE_NOT_OK)) {
- 	if (def_path_info) {
-@@ -489,6 +514,9 @@ main(argc, argv, envp)
- 	    /* Just tell the user they are not allowed to run foo. */
- 	    log_auth(validated, 1);
- 	}
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     } else {
- 	/* should never get here */
-diff -up sudo-1.6.9p13/configure.in.audit sudo-1.6.9p13/configure.in
---- sudo-1.6.9p13/configure.in.audit	2008-03-04 11:18:45.000000000 +0100
-+++ sudo-1.6.9p13/configure.in	2008-03-04 11:18:45.000000000 +0100
-@@ -166,6 +166,10 @@ dnl
- dnl Options for --with
- dnl
- 
-+AC_ARG_WITH(audit,
-+        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
-+        [with_audit=$withval], [with_audit=yes])
-+
- AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
- [case $with_CC in
-     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
-@@ -1614,6 +1618,25 @@ dnl
- : ${mansectsu='8'}
- : ${mansectform='5'}
- 
-+
-+AC_SUBST(LIBAUDIT)
-+if test "$with_audit" = "yes"; then
-+	# See if we have the audit library
-+        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
-+        if test "$audit_header" = "yes"; then
-+                AC_CHECK_LIB(audit, audit_log_user_command,
-+                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
-+                        LIBAUDIT="-laudit"])
-+        fi
-+	# See if we have the libcap library
-+	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
-+	if test "$cap_header" = "yes"; then
-+		AC_CHECK_LIB(cap, cap_init,
-+			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
-+			SUDO_LIBS="${SUDO_LIBS} -lcap"])
-+	fi
-+fi
-+
- dnl
- dnl Add in any libpaths or libraries specified via configure
- dnl
-diff -up /dev/null sudo-1.6.9p13/audit_help.c
---- /dev/null	2008-02-05 17:16:01.642928004 +0100
-+++ sudo-1.6.9p13/audit_help.c	2008-03-04 11:21:15.000000000 +0100
+diff -up /dev/null sudo-1.6.9p17/audit_help.c
+--- /dev/null	2008-08-23 21:55:45.734000982 +0200
++++ sudo-1.6.9p17/audit_help.c	2008-09-02 15:49:38.000000000 +0200
 @@ -0,0 +1,140 @@
 +/*
 + *  Audit helper functions used throughout sudo
@@ -275,7 +97,7 @@ diff -up /dev/null sudo-1.6.9p13/audit_help.c
 +		err = audit_log_user_command (audit_fd, type, msg, NULL, result);
 +               /* The kernel supports auditing and we had 
 +                  enough privilege to write to the socket. */
-+		if( err <= 0 && !(errno == EPERM && getuid() != 0) ) {
++		if( err <= 0 && !((errno == EPERM && getuid() > 0) || errno == ECONNREFUSED ) ) {
 +			perror("audit_log_user_command()");
 +		}
 +
@@ -320,10 +142,50 @@ diff -up /dev/null sudo-1.6.9p13/audit_help.c
 +#endif                         /* WITH_AUDIT */
 +
 +
-diff -up sudo-1.6.9p13/Makefile.in.audit sudo-1.6.9p13/Makefile.in
---- sudo-1.6.9p13/Makefile.in.audit	2008-02-19 19:13:10.000000000 +0100
-+++ sudo-1.6.9p13/Makefile.in	2008-03-04 11:18:45.000000000 +0100
-@@ -120,11 +120,13 @@ HDRS = compat.h def_data.h defaults.h in
+diff -up sudo-1.6.9p17/configure.in.audit sudo-1.6.9p17/configure.in
+--- sudo-1.6.9p17/configure.in.audit	2008-09-02 15:48:46.000000000 +0200
++++ sudo-1.6.9p17/configure.in	2008-09-02 15:48:46.000000000 +0200
+@@ -167,6 +167,10 @@ dnl
+ dnl Options for --with
+ dnl
+ 
++AC_ARG_WITH(audit,
++        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
++        [with_audit=$withval], [with_audit=yes])
++
+ AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
+ [case $with_CC in
+     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
+@@ -1616,6 +1620,25 @@ dnl
+ : ${mansectsu='8'}
+ : ${mansectform='5'}
+ 
++
++AC_SUBST(LIBAUDIT)
++if test "$with_audit" = "yes"; then
++	# See if we have the audit library
++        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
++        if test "$audit_header" = "yes"; then
++                AC_CHECK_LIB(audit, audit_log_user_command,
++                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
++                        LIBAUDIT="-laudit"])
++        fi
++	# See if we have the libcap library
++	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
++	if test "$cap_header" = "yes"; then
++		AC_CHECK_LIB(cap, cap_init,
++			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
++			SUDO_LIBS="${SUDO_LIBS} -lcap"])
++	fi
++fi
++
+ dnl
+ dnl Add in any libpaths or libraries specified via configure
+ dnl
+diff -up sudo-1.6.9p17/Makefile.in.audit sudo-1.6.9p17/Makefile.in
+--- sudo-1.6.9p17/Makefile.in.audit	2008-06-22 22:29:03.000000000 +0200
++++ sudo-1.6.9p17/Makefile.in	2008-09-02 15:48:46.000000000 +0200
+@@ -121,11 +121,13 @@ HDRS = compat.h def_data.h defaults.h in
  
  AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
  
@@ -338,7 +200,7 @@ diff -up sudo-1.6.9p13/Makefile.in.audit sudo-1.6.9p13/Makefile.in
  
  VISUDOBJS = visudo.o fileops.o gettime.o goodpath.o find_path.o $(PARSEOBJS)
  
-@@ -276,6 +278,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
+@@ -277,6 +279,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
  sia.o: $(authdir)/sia.c $(AUTHDEP)
  	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
  
@@ -348,9 +210,147 @@ diff -up sudo-1.6.9p13/Makefile.in.audit sudo-1.6.9p13/Makefile.in
  sudo.man.in: $(srcdir)/sudo.pod
  	@rm -f $(srcdir)/$@
  	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
-diff -up sudo-1.6.9p13/sudo.h.audit sudo-1.6.9p13/sudo.h
---- sudo-1.6.9p13/sudo.h.audit	2008-03-04 11:18:45.000000000 +0100
-+++ sudo-1.6.9p13/sudo.h	2008-03-04 11:18:45.000000000 +0100
+diff -up sudo-1.6.9p17/set_perms.c.audit sudo-1.6.9p17/set_perms.c
+--- sudo-1.6.9p17/set_perms.c.audit	2007-11-28 00:41:23.000000000 +0100
++++ sudo-1.6.9p17/set_perms.c	2008-09-02 15:48:46.000000000 +0200
+@@ -53,6 +53,10 @@
+ #ifdef HAVE_LOGIN_CAP_H
+ # include <login_cap.h>
+ #endif
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++# include <sys/prctl.h>
++# include <sys/capability.h>
++#endif
+ 
+ #include "sudo.h"
+ 
+@@ -119,13 +123,46 @@ set_perms(perm)
+ 			      	break;
+ 
+ 	case PERM_FULL_RUNAS:
+-				/* headed for exec(), assume euid == ROOT_UID */
+-				runas_setup();
+-				if (setresuid(def_stay_setuid ?
+-				    user_uid : runas_pw->pw_uid,
+-				    runas_pw->pw_uid, runas_pw->pw_uid))
+-				    err(1, "unable to change to runas uid");
+-				break;
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++                                { /* BEGIN CAP BLOCK */
++                                 cap_t new_caps;
++                                 cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
++
++                                 if (runas_pw->pw_uid != ROOT_UID) {
++                                     new_caps = cap_init ();
++                                     if (!new_caps)
++                                         err(1, "Error initing capabilities, aborting.\n");
++
++                                     if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
++                                        cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
++                                          err(1, "Error setting capabilities, aborting\n");
++                                     }
++
++                                     if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0))
++                                         err(1, "Error setting KEEPCAPS, aborting\n");
++                                 }
++#endif
++                                /* headed for exec(), assume euid == ROOT_UID */
++                                 runas_setup ();
++                                 if (setresuid(def_stay_setuid ?
++                                     user_uid : runas_pw->pw_uid,
++                                     runas_pw->pw_uid, runas_pw->pw_uid))
++                                     err(1, "unable to change to runas uid");
++
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++                                 if (runas_pw->pw_uid != ROOT_UID) {
++                                     if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0)
++                                         err(1, "Error resetting KEEPCAPS, aborting\n");
++
++                                     if (cap_set_proc(new_caps))
++                                         err(1, "Error dropping capabilities, aborting\n");
++
++                                     if (cap_free (new_caps))
++                                         err(1, "Error freeing caps\n");
++                                 }
++                                } /* END CAP BLOCK */
++#endif
++                                break;
+ 
+ 	case PERM_SUDOERS:
+ 				/* assume euid == ROOT_UID, ruid == user */
+diff -up sudo-1.6.9p17/sudo.c.audit sudo-1.6.9p17/sudo.c
+--- sudo-1.6.9p17/sudo.c.audit	2008-09-02 15:48:46.000000000 +0200
++++ sudo-1.6.9p17/sudo.c	2008-09-02 15:48:46.000000000 +0200
+@@ -100,6 +100,10 @@
+ # include <selinux/selinux.h>
+ #endif
+ 
++#ifdef WITH_AUDIT
++#include <libaudit.h>
++#endif
++
+ #include "sudo.h"
+ #include "interfaces.h"
+ #include "version.h"
+@@ -289,6 +293,10 @@ main(argc, argv, envp)
+     if (safe_cmnd == NULL)
+ 	safe_cmnd = estrdup(user_cmnd);
+ 
++#if defined(WITH_AUDIT)
++    audit_help_open ();
++#endif
++
+     /*
+      * Look up the timestamp dir owner if one is specified.
+      */
+@@ -435,6 +443,17 @@ main(argc, argv, envp)
+ 	(void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
+ 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
+ 
++        if (access(safe_cmnd, X_OK) != 0) {
++                 warn ("unable to execute %s", safe_cmnd);
++#ifdef WITH_AUDIT
++                audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
++                exit(127);
++        }
++#ifdef WITH_AUDIT
++        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
++#endif
++
+ #ifndef PROFILING
+ 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0)
+ 	    exit(0);
+@@ -458,10 +477,16 @@ main(argc, argv, envp)
+ 	    NewArgv[1] = safe_cmnd;
+ 	    execve(_PATH_BSHELL, NewArgv, environ);
+ 	}
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	warn("unable to execute %s", safe_cmnd);
+ 	exit(127);
+     } else if (ISSET(validated, FLAG_NO_USER) || (validated & FLAG_NO_HOST)) {
+ 	log_auth(validated, 1);
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     } else if (ISSET(validated, VALIDATE_NOT_OK)) {
+ 	if (def_path_info) {
+@@ -482,6 +507,9 @@ main(argc, argv, envp)
+ 	    /* Just tell the user they are not allowed to run foo. */
+ 	    log_auth(validated, 1);
+ 	}
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     } else {
+ 	/* should never get here */
+diff -up sudo-1.6.9p17/sudo.h.audit sudo-1.6.9p17/sudo.h
+--- sudo-1.6.9p17/sudo.h.audit	2008-09-02 15:48:46.000000000 +0200
++++ sudo-1.6.9p17/sudo.h	2008-09-02 15:48:46.000000000 +0200
 @@ -23,6 +23,8 @@
  #ifndef _SUDO_SUDO_H
  #define _SUDO_SUDO_H
diff --git a/sudo.spec b/sudo.spec
index 2c063ee..1e803ec 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p17
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -133,6 +133,10 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Tue Sep 02 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
+- adjust audit patch, do not scream when kernel is
+  compiled without audit netlink support (#401201)
+
 * Fri Jul 04 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-1
 - upgrade
 

From 83eef97412adffd77f09e843a47b5a11bdf6b896 Mon Sep 17 00:00:00 2001
From: Peter Vrabec <pvrabec@fedoraproject.org>
Date: Wed, 3 Sep 2008 08:59:59 +0000
Subject: [PATCH 023/199] spec file fix

---
 sudo.spec | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 1e803ec..366a702 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -81,7 +81,6 @@ make
 
 %install
 rm -rf $RPM_BUILD_ROOT
-mkdir $RPM_BUILD_ROOT
 make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
 chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* 
 install -p -d -m 700 $RPM_BUILD_ROOT/var/run/sudo

From eca3e72bb00e3831f6e8ae46607404db254bf2cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Tue, 13 Jan 2009 17:09:02 +0000
Subject: [PATCH 024/199] - build with sendmail installed - added
 /usr/local/bin to secure-path

---
 sudo.spec | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 366a702..f937856 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p17
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -18,6 +18,7 @@ BuildRequires: bison
 BuildRequires: automake autoconf libtool
 BuildRequires: audit-libs-devel libcap-devel
 BuildRequires: libselinux-devel
+BuildRequires: sendmail
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
@@ -74,7 +75,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-ldap \
 	--with-selinux \
 	--with-passprompt="[sudo] password for %p: " \
-	--with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin"
+	--with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin"
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -132,6 +133,10 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Tue Jan 13 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-3
+- build with sendmail installed
+- Added /usr/local/bin to secure-path
+
 * Tue Sep 02 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
 - adjust audit patch, do not scream when kernel is
   compiled without audit netlink support (#401201)

From aefbd0093d860a689574c1ea584b95cb384979f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Tue, 24 Feb 2009 15:24:58 +0000
Subject: [PATCH 025/199] - fixed building with new libtool - fix for incorrect
 handling of groups in Runas_User - added /usr/local/sbin to secure-path

---
 sudo-1.6.9p17-Makefile.patch | 12 ++++++++++++
 sudo-1.6.9p17-runas.patch    | 23 +++++++++++++++++++++++
 sudo.spec                    | 15 ++++++++++++---
 3 files changed, 47 insertions(+), 3 deletions(-)
 create mode 100644 sudo-1.6.9p17-Makefile.patch
 create mode 100644 sudo-1.6.9p17-runas.patch

diff --git a/sudo-1.6.9p17-Makefile.patch b/sudo-1.6.9p17-Makefile.patch
new file mode 100644
index 0000000..ce8b241
--- /dev/null
+++ b/sudo-1.6.9p17-Makefile.patch
@@ -0,0 +1,12 @@
+diff -up sudo-1.6.9p17/Makefile.in.modfix sudo-1.6.9p17/Makefile.in
+--- sudo-1.6.9p17/Makefile.in.modfix	2009-02-24 04:31:34.000000000 +0100
++++ sudo-1.6.9p17/Makefile.in	2009-02-24 04:31:17.000000000 +0100
+@@ -190,7 +190,7 @@ sudo_noexec.lo: $(srcdir)/sudo_noexec.c
+ 	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(srcdir)/sudo_noexec.c
+ 
+ sudo_noexec.la: sudo_noexec.lo
+-	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -o $@ sudo_noexec.lo -avoid-version -rpath $(noexecdir)
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -o $@ sudo_noexec.lo -module -avoid-version -rpath $(noexecdir)
+ 
+ # Uncomment the following if you want "make distclean" to clean the parser
+ @DEV@PARSESRCS = sudo.tab.h sudo.tab.c lex.yy.c def_data.c def_data.h
diff --git a/sudo-1.6.9p17-runas.patch b/sudo-1.6.9p17-runas.patch
new file mode 100644
index 0000000..273e21d
--- /dev/null
+++ b/sudo-1.6.9p17-runas.patch
@@ -0,0 +1,23 @@
+Index: parse.c
+===================================================================
+RCS file: /home/cvs/courtesan/sudo/parse.c,v
+retrieving revision 1.160.2.21
+diff -u -r1.160.2.21 parse.c
+--- parse.c	2 Nov 2008 14:35:53 -0000	1.160.2.21
++++ parse.c	23 Jan 2009 19:16:55 -0000
+@@ -651,9 +651,11 @@
+     /*
+      * If the user has a supplementary group vector, check it first.
+      */
+-    for (i = 0; i < user_ngroups; i++) {
+-	if (grp->gr_gid == user_groups[i])
+-	    return(TRUE);
++    if (strcmp(user, user_name) == 0) {
++	for (i = 0; i < user_ngroups; i++) {
++	    if (grp->gr_gid == user_groups[i])
++		return(TRUE);
++	}
+     }
+     if (grp->gr_mem != NULL) {
+ 	for (cur = grp->gr_mem; *cur; cur++) {
+
diff --git a/sudo.spec b/sudo.spec
index f937856..c22d7df 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p17
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -28,6 +28,8 @@ Patch2: sudo-1.6.9p4-login.patch
 Patch3: sudo-1.6.9p4-getgrouplist.patch
 Patch4: sudo-1.6.9p12-noPam.patch
 Patch5: sudo-1.6.9p13-audit.patch
+Patch6: sudo-1.6.9p17-Makefile.patch
+Patch7: sudo-1.6.9p17-runas.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -47,10 +49,12 @@ on many different machines.
 %patch3 -p1 -b .getgrouplist
 %patch4 -p1 -b .noPam
 %patch5 -p1 -b .audit
+%patch6 -p1 -b .Makefile
+%patch7 -p0 -b .runas
 
 %build
 #hande newer autoconf
-rm acsite.m4 && mv aclocal.m4 acinclude.m4 && autoreconf
+libtoolize --force && acsite.m4 && mv aclocal.m4 acinclude.m4 && autoreconf
 
 %ifarch s390 s390x sparc64
 F_PIE=-fPIE
@@ -75,7 +79,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-ldap \
 	--with-selinux \
 	--with-passprompt="[sudo] password for %p: " \
-	--with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin"
+	--with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -133,6 +137,11 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Tue Feb 24 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-4
+- fixed building with new libtool
+- fix for incorrect handling of groups in Runas_User
+- added /usr/local/sbin to secure-path
+
 * Tue Jan 13 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-3
 - build with sendmail installed
 - Added /usr/local/bin to secure-path

From 8e0d152bd4344415ba23e1735a4d1c0dca95793d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Tue, 24 Feb 2009 15:34:40 +0000
Subject: [PATCH 026/199] typo

---
 sudo.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index c22d7df..8a5842b 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -54,7 +54,7 @@ on many different machines.
 
 %build
 #hande newer autoconf
-libtoolize --force && acsite.m4 && mv aclocal.m4 acinclude.m4 && autoreconf
+libtoolize --force && rm acsite.m4 && mv aclocal.m4 acinclude.m4 && autoreconf
 
 %ifarch s390 s390x sparc64
 F_PIE=-fPIE

From 9b190fb143dc950e7760e97eff66b8661dfbcef2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Tue, 24 Feb 2009 15:43:30 +0000
Subject: [PATCH 027/199] I hope this is the last commit today...

---
 sudo.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 8a5842b..f8eee77 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p17
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -137,7 +137,7 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
-* Tue Feb 24 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-4
+* Tue Feb 24 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-5
 - fixed building with new libtool
 - fix for incorrect handling of groups in Runas_User
 - added /usr/local/sbin to secure-path

From db5280d0ecd35ad15dea72f58e1315c3f255dcea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Tue, 24 Feb 2009 15:49:07 +0000
Subject: [PATCH 028/199] Can't use -5, trying -6

---
 sudo.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index f8eee77..565d373 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.6.9p17
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -137,7 +137,7 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
-* Tue Feb 24 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-5
+* Tue Feb 24 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
 - fixed building with new libtool
 - fix for incorrect handling of groups in Runas_User
 - added /usr/local/sbin to secure-path

From 6a836e9aac386e93f2c9724260e7547cb7b622c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Mon, 22 Jun 2009 14:27:32 +0000
Subject: [PATCH 029/199] - updated sudo to version 1.7.1 - fixed small bug in
 configure.in (sudo-1.7.1-conffix.patch) - reverted the value of secure-path
 configure option

---
 .cvsignore                    |   2 +-
 sources                       |   2 +-
 sudo-1.7.1-audit.patch        | 389 ++++++++++++++++++++++++++++++++++
 sudo-1.7.1-conffix.patch      |  12 ++
 sudo-1.7.1-envdebug.patch     |  12 ++
 sudo-1.7.1-getgrouplist.patch |  40 ++++
 sudo-1.7.1-libtool.patch      |  12 ++
 sudo-1.7.1-login.patch        | 111 ++++++++++
 sudo.spec                     |  34 +--
 9 files changed, 597 insertions(+), 17 deletions(-)
 create mode 100644 sudo-1.7.1-audit.patch
 create mode 100644 sudo-1.7.1-conffix.patch
 create mode 100644 sudo-1.7.1-envdebug.patch
 create mode 100644 sudo-1.7.1-getgrouplist.patch
 create mode 100644 sudo-1.7.1-libtool.patch
 create mode 100644 sudo-1.7.1-login.patch

diff --git a/.cvsignore b/.cvsignore
index 839a561..fd44cc4 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
-sudo-1.6.9p17.tar.gz
+sudo-1.7.1.tar.gz
 sudo-1.6.8p12-sudoers
diff --git a/sources b/sources
index b92574f..8075fb8 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-60daf18f28e2c1eb7641c4408e244110  sudo-1.6.9p17.tar.gz
+af672524b2c854a67612bf4c743f58b8  sudo-1.7.1.tar.gz
 f9b28fbbb09ec22ca543c758db44d2cd  sudo-1.6.8p12-sudoers
diff --git a/sudo-1.7.1-audit.patch b/sudo-1.7.1-audit.patch
new file mode 100644
index 0000000..65bb51c
--- /dev/null
+++ b/sudo-1.7.1-audit.patch
@@ -0,0 +1,389 @@
+diff -up /dev/null sudo-1.7.1/audit_help.c
+--- /dev/null	2009-06-19 12:23:43.376002420 +0200
++++ sudo-1.7.1/audit_help.c	2009-06-22 14:24:48.000000000 +0200
+@@ -0,0 +1,136 @@
++/*
++ *  Audit helper functions used throughout sudo
++ *
++ *  Copyright (C) 2007, Red Hat, Inc.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
++ *    may be used to endorse or promote products derived from this software
++ *    without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ */
++
++#include <config.h>
++
++#ifdef WITH_AUDIT
++#include <stdlib.h>
++#include <syslog.h>
++#include <stdarg.h>
++#include <libaudit.h>
++#include <errno.h>
++#include <stdio.h>
++#include <string.h>
++#include <unistd.h>
++#include <sys/types.h>
++
++#ifdef HAVE_SELINUX
++#include <selinux/selinux.h>
++#endif
++
++int audit_fd;
++
++void audit_help_open (void)
++{
++	audit_fd = audit_open ();
++	if (audit_fd < 0) {
++        	/* You get these only when the kernel doesn't have
++                 * audit compiled in. */
++		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
++		    errno == EAFNOSUPPORT)
++			return;
++		fprintf (stderr, "Cannot open audit interface - aborting.\n");
++		exit (1);
++	}
++}
++
++/*
++ * This function will log a message to the audit system using a predefined
++ * message format. Parameter usage is as follows:
++ *
++ * type - type of message: AUDIT_USER_CMD
++ * command - the command being logged
++ * params - parames of the command
++ * result - 1 is "success" and 0 is "failed"
++ *
++ */
++void audit_logger (int type, const char *command, const char *params, int result)
++{
++	int err;
++	char *msg;
++
++	if( audit_fd < 0 )
++		return;
++	else {
++
++		if( params ) 
++	                err = asprintf(&msg, "%s %s", command, params);
++		else 
++	                err = asprintf(&msg, "%s", command);
++                if (err < 0) {
++                        fprintf (stderr, "Memory allocation for audit message wasn’t possible.\n");
++                        return;
++                }
++		
++		err = audit_log_user_command (audit_fd, type, msg, NULL, result);
++               /* The kernel supports auditing and we had 
++                  enough privilege to write to the socket. */
++		if( err <= 0 && !((errno == EPERM && getuid() > 0) || errno == ECONNREFUSED ) ) {
++			perror("audit_log_user_command()");
++		}
++
++		free(msg);
++	}
++}
++
++#ifdef HAVE_SELINUX
++int send_audit_message(int success, security_context_t old_context,
++                       security_context_t new_context, const char *ttyn)
++{
++        char *msg = NULL;
++        int rc;
++
++        if (audit_fd < 0)
++                return -1;
++
++        if (asprintf(&msg, "newrole: old-context=%s new-context=%s",
++                     old_context ? old_context : "?",
++                     new_context ? new_context : "?") < 0) {
++                fprintf(stderr, "Error allocating memory.\n");
++                rc = -1;
++                goto out;
++        }
++
++        rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
++                                    msg, NULL, NULL, ttyn, success);
++
++        if (rc <= 0) {
++                fprintf(stderr, "Error sending audit message.\n");
++                rc = -1;
++                goto out;
++        }
++        rc = 0;
++
++        out:
++         free(msg);
++         return rc;
++}
++#endif
++#endif                         /* WITH_AUDIT */
+diff -up sudo-1.7.1/configure.in.audit sudo-1.7.1/configure.in
+--- sudo-1.7.1/configure.in.audit	2009-06-22 14:24:48.000000000 +0200
++++ sudo-1.7.1/configure.in	2009-06-22 14:26:42.000000000 +0200
+@@ -179,6 +179,10 @@ dnl
+ dnl Options for --with
+ dnl
+ 
++AC_ARG_WITH(audit,
++        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
++        [with_audit=$withval], [with_audit=yes])
++
+ AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
+ [case $with_CC in
+     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
+@@ -1706,6 +1710,24 @@ dnl
+ : ${mansectsu='8'}
+ : ${mansectform='5'}
+ 
++AC_SUBST(LIBAUDIT)
++if test "$with_audit" = "yes"; then
++	# See if we have the audit library
++        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
++        if test "$audit_header" = "yes"; then
++                AC_CHECK_LIB(audit, audit_log_user_command,
++                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
++                        LIBAUDIT="-laudit"])
++        fi
++	# See if we have the libcap library
++	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
++	if test "$cap_header" = "yes"; then
++		AC_CHECK_LIB(cap, cap_init,
++			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
++			SUDO_LIBS="${SUDO_LIBS} -lcap"])
++	fi
++fi
++
+ dnl
+ dnl Add in any libpaths or libraries specified via configure
+ dnl
+diff -up sudo-1.7.1/Makefile.in.audit sudo-1.7.1/Makefile.in
+--- sudo-1.7.1/Makefile.in.audit	2009-06-22 14:24:48.000000000 +0200
++++ sudo-1.7.1/Makefile.in	2009-06-22 14:24:48.000000000 +0200
+@@ -125,6 +125,8 @@ HDRS = bsm_audit.h compat.h def_data.h d
+ 
+ AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
+ 
++AUDIT_OBJS = audit_help.o
++
+ # Note: gram.o must come first here
+ COMMON_OBJS = gram.o alias.o alloc.o defaults.o error.o list.o match.o \
+ 	      toke.o redblack.o zero_bytes.o
+@@ -132,7 +134,7 @@ COMMON_OBJS = gram.o alias.o alloc.o def
+ SUDO_OBJS = $(COMMON_OBJS) $(AUTH_OBJS) @SUDO_OBJS@ audit.o check.o env.o \
+ 	    getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
+ 	    interfaces.o lbuf.o logging.o parse.o pwutil.o set_perms.o \
+-	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o
++	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o $(AUDIT_OBJS)
+ 
+ VISUDO_OBJS = $(COMMON_OBJS) visudo.o fileops.o gettime.o goodpath.o \
+ 	      find_path.o pwutil.o
+@@ -361,6 +363,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
+ sia.o: $(authdir)/sia.c $(AUTHDEP)
+ 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
+ 
++audit_help.o: audit_help.c sudo.h
++	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
++
+ sudo.man.in: $(srcdir)/sudo.pod
+ 	@rm -f $(srcdir)/$@
+ 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
+diff -up sudo-1.7.1/set_perms.c.audit sudo-1.7.1/set_perms.c
+--- sudo-1.7.1/set_perms.c.audit	2008-03-06 18:19:56.000000000 +0100
++++ sudo-1.7.1/set_perms.c	2009-06-22 14:24:48.000000000 +0200
+@@ -48,6 +48,10 @@
+ #ifdef HAVE_LOGIN_CAP_H
+ # include <login_cap.h>
+ #endif
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++# include <sys/prctl.h>
++# include <sys/capability.h>
++#endif
+ 
+ #include "sudo.h"
+ 
+@@ -126,16 +130,59 @@ set_perms(perm)
+ 			      	break;
+ 
+ 	case PERM_FULL_RUNAS:
+-				/* headed for exec(), assume euid == ROOT_UID */
+-				runas_setup();
+-				if (setresuid(def_stay_setuid ?
+-				    user_uid : runas_pw->pw_uid,
+-				    runas_pw->pw_uid, runas_pw->pw_uid)) {
+-				    errstr = "unable to change to runas uid";
+-				    goto bad;
+-				}
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++	                     { /* BEGIN CAP BLOCK */
++				  cap_t new_caps;
++				  cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
++				  
++				  if (runas_pw->pw_uid != ROOT_UID) {
++				       new_caps = cap_init ();
++				       if (!new_caps) {
++					    errstr = "Error initing capabilities, aborting.\n";
++					    goto bad;
++				       }
++				       
++				       if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
++					  cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
++					    errstr = "Error setting capabilities, aborting\n";
++					    goto bad;
++				       }
++				       
++				       if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
++					    errstr = "Error setting KEEPCAPS, aborting\n";
++					    goto bad;
++				       }
++				  }
++#endif
++				  /* headed for exec(), assume euid == ROOT_UID */
++				  runas_setup();
++				  if (setresuid(def_stay_setuid ?
++						user_uid : runas_pw->pw_uid,
++						runas_pw->pw_uid, runas_pw->pw_uid)) {
++				       errstr = "unable to change to runas uid";
++				       goto bad;
++				  }
++				  
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++				  if (runas_pw->pw_uid != ROOT_UID) {
++				       if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0) {
++					    errstr = "Error resetting KEEPCAPS, aborting\n";
++					    goto bad;
++				       }
++				       
++				       if (cap_set_proc(new_caps)) {
++					    errstr = "Error dropping capabilities, aborting\n";
++					    goto bad;
++				       }
++				       
++				       if (cap_free (new_caps)) {
++					    errstr = "Error freeing caps\n";
++					    goto bad;
++				       }
++				  }
++                                } /* END CAP BLOCK */
++#endif
+ 				break;
+-
+ 	case PERM_SUDOERS:
+ 				/* assume euid == ROOT_UID, ruid == user */
+ 				if (setresgid(-1, SUDOERS_GID, -1))
+diff -up sudo-1.7.1/sudo.c.audit sudo-1.7.1/sudo.c
+--- sudo-1.7.1/sudo.c.audit	2009-06-22 14:24:48.000000000 +0200
++++ sudo-1.7.1/sudo.c	2009-06-22 14:24:48.000000000 +0200
+@@ -95,6 +95,10 @@
+ # include <selinux/selinux.h>
+ #endif
+ 
++#ifdef WITH_AUDIT
++#include <libaudit.h>
++#endif
++
+ #include <sudo_usage.h>
+ #include "sudo.h"
+ #include "lbuf.h"
+@@ -360,6 +364,10 @@ main(argc, argv, envp)
+     if (safe_cmnd == NULL)
+ 	safe_cmnd = estrdup(user_cmnd);
+ 
++#if defined(WITH_AUDIT)
++    audit_help_open ();
++#endif
++    
+ #ifdef HAVE_SETLOCALE
+     setlocale(LC_ALL, "");
+ #endif
+@@ -521,7 +529,18 @@ main(argc, argv, envp)
+ 	(void) sigaction(SIGINT, &saved_sa_int, NULL);
+ 	(void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
+ 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
+-
++	
++        if (access(safe_cmnd, X_OK) != 0) {
++		warn ("unable to execute %s", safe_cmnd);
++#ifdef WITH_AUDIT
++		audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
++		exit(127);
++        }
++#ifdef WITH_AUDIT
++        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
++#endif
++	
+ 	/* Close the password and group files and free up memory. */
+ 	sudo_endpwent();
+ 	sudo_endgrent();
+@@ -554,11 +573,17 @@ main(argc, argv, envp)
+ 	    NewArgv[1] = safe_cmnd;
+ 	    execv(_PATH_BSHELL, NewArgv);
+ 	}
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	warning("unable to execute %s", safe_cmnd);
+ 	exit(127);
+     } else if (ISSET(validated, FLAG_NO_USER | FLAG_NO_HOST)) {
+ 	audit_failure(NewArgv, "No user or host");
+ 	log_denial(validated, 1);
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     } else {
+ 	if (def_path_info) {
+@@ -580,6 +605,9 @@ main(argc, argv, envp)
+ 	    log_denial(validated, 1);
+ 	}
+ 	audit_failure(NewArgv, "validation failure");
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     }
+     exit(0);	/* not reached */
+diff -up sudo-1.7.1/sudo.h.audit sudo-1.7.1/sudo.h
+--- sudo-1.7.1/sudo.h.audit	2009-06-22 14:24:48.000000000 +0200
++++ sudo-1.7.1/sudo.h	2009-06-22 14:24:48.000000000 +0200
+@@ -24,6 +24,8 @@
+ #ifndef _SUDO_SUDO_H
+ #define _SUDO_SUDO_H
+ 
++#include <config.h>
++
+ #include <pathnames.h>
+ #include <limits.h>
+ #include "compat.h"
+@@ -338,4 +340,10 @@ extern int sudo_mode;
+ extern int errno;
+ #endif
+ 
++#ifdef WITH_AUDIT
++extern int audit_fd;
++extern void audit_help_open (void);
++extern void audit_logger (int, const char *, const char *, int);
++#endif
++
+ #endif /* _SUDO_SUDO_H */
diff --git a/sudo-1.7.1-conffix.patch b/sudo-1.7.1-conffix.patch
new file mode 100644
index 0000000..1d71d12
--- /dev/null
+++ b/sudo-1.7.1-conffix.patch
@@ -0,0 +1,12 @@
+diff -up sudo-1.7.1/configure.in.conffix sudo-1.7.1/configure.in
+--- sudo-1.7.1/configure.in.conffix	2009-06-22 15:45:51.000000000 +0200
++++ sudo-1.7.1/configure.in	2009-06-22 15:45:30.000000000 +0200
+@@ -2473,7 +2473,7 @@ if test ${with_ldap-'no'} != "no"; then
+     AC_MSG_RESULT([yes])
+     AC_DEFINE(HAVE_LBER_H)])
+ 
+-    AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], [AC_CHECK_FUNCS(ldap_sasl_interactive_bind_s), [break]])
++    AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], [AC_CHECK_FUNCS(ldap_sasl_interactive_bind_s)], [break])
+     AC_CHECK_HEADERS([ldap_ssl.h] [mps/ldap_ssl.h], [break], [], [#include <ldap.h>])
+     AC_CHECK_FUNCS(ldap_initialize ldap_start_tls_s ldapssl_init ldapssl_set_strength ldap_search_ext_s ldap_unbind_ext_s ldap_str2dn ldap_create ldap_sasl_bind_s ldap_ssl_client_init ldap_start_tls_s_np)
+ 
diff --git a/sudo-1.7.1-envdebug.patch b/sudo-1.7.1-envdebug.patch
new file mode 100644
index 0000000..446ada1
--- /dev/null
+++ b/sudo-1.7.1-envdebug.patch
@@ -0,0 +1,12 @@
+diff -up sudo-1.7.1/configure.in.envdebug sudo-1.7.1/configure.in
+--- sudo-1.7.1/configure.in.envdebug	2009-05-02 21:25:56.000000000 +0200
++++ sudo-1.7.1/configure.in	2009-05-02 21:27:17.000000000 +0200
+@@ -1192,7 +1192,7 @@ AC_ARG_ENABLE(env_debug,
+ [  --enable-env-debug      Whether to enable environment debugging.],
+ [ case "$enableval" in
+     yes)	AC_MSG_RESULT(yes)
+-		AC_DEFINE(ENV_DEBUG)
++		AC_DEFINE(ENV_DEBUG, [], [Environment debugging.])
+ 		;;
+     no)		AC_MSG_RESULT(no)
+ 		;;
diff --git a/sudo-1.7.1-getgrouplist.patch b/sudo-1.7.1-getgrouplist.patch
new file mode 100644
index 0000000..42cc3fc
--- /dev/null
+++ b/sudo-1.7.1-getgrouplist.patch
@@ -0,0 +1,40 @@
+diff -up sudo-1.7.1/check.c.getgrouplist sudo-1.7.1/check.c
+--- sudo-1.7.1/check.c.getgrouplist	2009-05-02 21:48:17.000000000 +0200
++++ sudo-1.7.1/check.c	2009-05-02 21:49:04.000000000 +0200
+@@ -353,6 +353,24 @@ user_is_exempt()
+ 	    return(TRUE);
+     }
+ 
++#ifdef HAVE_GETGROUPLIST
++    {
++	gid_t *grouplist, grouptmp;
++	int n_groups, i;
++	n_groups = 1;
++	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
++	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
++	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
++		for (i = 0; i < n_groups; i++)
++		    if (grouplist[i] == grp->gr_gid) {
++			free(grouplist);
++			return(TRUE);
++		    }
++	    free(grouplist);
++	}
++    }
++#endif
++
+     return(FALSE);
+ }
+ 
+diff -up sudo-1.7.1/configure.in.getgrouplist sudo-1.7.1/configure.in
+--- sudo-1.7.1/configure.in.getgrouplist	2009-05-02 21:48:13.000000000 +0200
++++ sudo-1.7.1/configure.in	2009-05-02 21:50:05.000000000 +0200
+@@ -1809,7 +1809,7 @@ dnl
+ AC_FUNC_GETGROUPS
+ AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
+ 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
+-	       setlocale getaddrinfo setsid setenv)
++	       setlocale getaddrinfo setsid setenv getgrouplist)
+ AC_CHECK_FUNCS(unsetenv, SUDO_FUNC_UNSETENV_VOID)
+ SUDO_FUNC_PUTENV_CONST
+ if test -z "$SKIP_SETRESUID"; then
diff --git a/sudo-1.7.1-libtool.patch b/sudo-1.7.1-libtool.patch
new file mode 100644
index 0000000..4082953
--- /dev/null
+++ b/sudo-1.7.1-libtool.patch
@@ -0,0 +1,12 @@
+diff -up sudo-1.7.1/Makefile.in.libtool sudo-1.7.1/Makefile.in
+--- sudo-1.7.1/Makefile.in.libtool	2009-05-02 21:35:55.000000000 +0200
++++ sudo-1.7.1/Makefile.in	2009-05-02 21:36:04.000000000 +0200
+@@ -198,7 +198,7 @@ sudo_noexec.lo: $(srcdir)/sudo_noexec.c
+ 	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(srcdir)/sudo_noexec.c
+ 
+ sudo_noexec.la: sudo_noexec.lo
+-	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -o $@ sudo_noexec.lo -avoid-version -rpath $(noexecdir)
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -o $@ sudo_noexec.lo -module -avoid-version -rpath $(noexecdir)
+ 
+ # Uncomment the following if you want "make distclean" to clean the parser
+ @DEV@GENERATED = gram.h gram.c toke.c def_data.c def_data.h
diff --git a/sudo-1.7.1-login.patch b/sudo-1.7.1-login.patch
new file mode 100644
index 0000000..03a6fd3
--- /dev/null
+++ b/sudo-1.7.1-login.patch
@@ -0,0 +1,111 @@
+diff -up sudo-1.7.1/auth/pam.c.login sudo-1.7.1/auth/pam.c
+--- sudo-1.7.1/auth/pam.c.login	2009-05-02 21:01:17.000000000 +0200
++++ sudo-1.7.1/auth/pam.c	2009-05-02 21:07:42.000000000 +0200
+@@ -100,7 +100,13 @@ pam_init(pw, promptp, auth)
+     if (auth != NULL)
+ 	auth->data = (void *) &pam_status;
+     pam_conv.conv = sudo_conv;
+-    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
++#ifdef HAVE_PAM_LOGIN
++    if (ISSET(sudo_mode, MODE_LOGIN_SHELL))
++	    pam_status = pam_start("sudo-i", pw->pw_name, &pam_conv, &pamh);
++    else
++#endif
++	    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
++
+     if (pam_status != PAM_SUCCESS) {
+ 	log_error(USE_ERRNO|NO_EXIT|NO_MAIL, "unable to initialize PAM");
+ 	return(AUTH_FATAL);
+diff -up sudo-1.7.1/configure.in.login sudo-1.7.1/configure.in
+--- sudo-1.7.1/configure.in.login	2009-05-02 21:01:33.000000000 +0200
++++ sudo-1.7.1/configure.in	2009-05-02 21:13:59.000000000 +0200
+@@ -393,6 +393,17 @@ AC_ARG_WITH(pam, [  --with-pam          
+ 		;;
+ esac])
+ 
++AC_ARG_WITH(pam-login, [  --with-pam-login              enable specific PAM session for sudo -i],
++[case $with_pam_login in
++    yes)	AC_DEFINE([HAVE_PAM_LOGIN], [], ["Define to 1 if you use specific PAM session for sodo -i."])	
++		AC_MSG_CHECKING(whether to use PAM login)
++		AC_MSG_RESULT(yes)
++		;;
++    no)		;;
++    *)		AC_MSG_ERROR(["--with-pam-login does not take an argument."])
++		;;
++esac])
++
+ AC_ARG_WITH(AFS, [  --with-AFS              enable AFS support],
+ [case $with_AFS in
+     yes)	AC_DEFINE(HAVE_AFS)
+diff -up sudo-1.7.1/env.c.login sudo-1.7.1/env.c
+--- sudo-1.7.1/env.c.login	2009-05-02 21:01:24.000000000 +0200
++++ sudo-1.7.1/env.c	2009-05-02 21:12:28.000000000 +0200
+@@ -101,7 +101,7 @@ struct environment {
+ /*
+  * Prototypes
+  */
+-void rebuild_env		__P((int, int));
++void rebuild_env		__P((int));
+ static void sudo_setenv		__P((const char *, const char *, int));
+ static void sudo_putenv		__P((char *, int, int));
+ 
+@@ -550,8 +550,7 @@ matches_env_keep(var)
+  * Also adds sudo-specific variables (SUDO_*).
+  */
+ void
+-rebuild_env(sudo_mode, noexec)
+-    int sudo_mode;
++rebuild_env(noexec)
+     int noexec;
+ {
+     char **old_envp, **ep, *cp, *ps1;
+diff -up sudo-1.7.1/sudo.c.login sudo-1.7.1/sudo.c
+--- sudo-1.7.1/sudo.c.login	2009-05-02 21:01:49.000000000 +0200
++++ sudo-1.7.1/sudo.c	2009-05-02 21:18:18.000000000 +0200
+@@ -123,7 +123,7 @@ static void usage_excl			__P((int))
+ 					    __attribute__((__noreturn__));
+ static struct passwd *get_authpw	__P((void));
+ extern int sudo_edit			__P((int, char **, char **));
+-extern void rebuild_env			__P((int, int));
++extern void rebuild_env			__P((int));
+ void validate_env_vars			__P((struct list_member *));
+ void insert_env_vars			__P((struct list_member *));
+ 
+@@ -154,6 +154,8 @@ login_cap_t *lc;
+ char *login_style;
+ #endif /* HAVE_BSD_AUTH_H */
+ sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp;
++
++int sudo_mode;
+ static char *runas_user;
+ static char *runas_group;
+ static struct sudo_nss_list *snl;
+@@ -169,7 +171,7 @@ main(argc, argv, envp)
+     char **envp;
+ {
+     int sources = 0, validated;
+-    int fd, cmnd_status, sudo_mode, pwflag, rc = 0;
++    int fd, cmnd_status, pwflag, rc = 0;
+     sigaction_t sa;
+     struct sudo_nss *nss;
+ #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
+@@ -408,7 +410,7 @@ main(argc, argv, envp)
+ 	def_env_reset = FALSE;
+ 
+     /* Build a new environment that avoids any nasty bits. */
+-    rebuild_env(sudo_mode, def_noexec);
++    rebuild_env(def_noexec);
+ 
+     /* Fill in passwd struct based on user we are authenticating as.  */
+     auth_pw = get_authpw();
+diff -up sudo-1.7.1/sudo.h.login sudo-1.7.1/sudo.h
+--- sudo-1.7.1/sudo.h.login	2009-05-02 21:01:42.000000000 +0200
++++ sudo-1.7.1/sudo.h	2009-05-02 21:14:58.000000000 +0200
+@@ -332,6 +332,7 @@ extern struct passwd *auth_pw, *list_pw;
+ extern int tgetpass_flags;
+ extern int long_list;
+ extern uid_t timestamp_uid;
++extern int sudo_mode;
+ #endif
+ #ifndef errno
+ extern int errno;
diff --git a/sudo.spec b/sudo.spec
index 565d373..6611274 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.6.9p17
-Release: 6%{?dist}
+Version: 1.7.1
+Release: 1%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -23,13 +23,13 @@ BuildRequires: sendmail
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
 # use specific PAM session for sudo -i (#198755)
-Patch2: sudo-1.6.9p4-login.patch
+Patch2: sudo-1.7.1-login.patch
 # the rest, see changelog
-Patch3: sudo-1.6.9p4-getgrouplist.patch
-Patch4: sudo-1.6.9p12-noPam.patch
-Patch5: sudo-1.6.9p13-audit.patch
-Patch6: sudo-1.6.9p17-Makefile.patch
-Patch7: sudo-1.6.9p17-runas.patch
+Patch3: sudo-1.7.1-envdebug.patch
+Patch4: sudo-1.7.1-libtool.patch
+Patch5: sudo-1.7.1-getgrouplist.patch
+Patch6: sudo-1.7.1-audit.patch
+Patch7: sudo-1.7.1-conffix.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -46,11 +46,11 @@ on many different machines.
 %setup -q
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .login
-%patch3 -p1 -b .getgrouplist
-%patch4 -p1 -b .noPam
-%patch5 -p1 -b .audit
-%patch6 -p1 -b .Makefile
-%patch7 -p0 -b .runas
+%patch3 -p1 -b .envdebug
+%patch4 -p1 -b .libtool
+%patch5 -p1 -b .getgrouplist
+%patch6 -p1 -b .audit
+%patch7 -p1 -b .conffix
 
 %build
 #hande newer autoconf
@@ -79,7 +79,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-ldap \
 	--with-selinux \
 	--with-passprompt="[sudo] password for %p: " \
-	--with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
+	--with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin"
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -116,7 +116,7 @@ rm -rf $RPM_BUILD_ROOT
 
 %files
 %defattr(-,root,root)
-%doc BUGS CHANGES HISTORY LICENSE README* TROUBLESHOOTING UPGRADE
+%doc ChangeLog WHATSNEW HISTORY LICENSE README* TROUBLESHOOTING UPGRADE
 %doc *.pod schema.* sudoers2ldif sample.*
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %config(noreplace) /etc/pam.d/sudo
@@ -137,6 +137,10 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Mon Jun 22 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-1
+- updated sudo to version 1.7.1
+- fixed small bug in configure.in (sudo-1.7.1-conffix.patch)
+
 * Tue Feb 24 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
 - fixed building with new libtool
 - fix for incorrect handling of groups in Runas_User

From 0b7f70f9e14a2ea18d45e479c9b114eceb1a8c55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Thu, 9 Jul 2009 13:29:34 +0000
Subject: [PATCH 030/199] - moved the closefrom() call before audit_help_open()
 - epoch number sync

---
 sudo-1.7.1-auditfix.patch | 48 +++++++++++++++++++++++++++++++++++++++
 sudo.spec                 |  8 ++++++-
 2 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 sudo-1.7.1-auditfix.patch

diff --git a/sudo-1.7.1-auditfix.patch b/sudo-1.7.1-auditfix.patch
new file mode 100644
index 0000000..a1e8892
--- /dev/null
+++ b/sudo-1.7.1-auditfix.patch
@@ -0,0 +1,48 @@
+diff -up sudo-1.7.1/audit_help.c.auditfix sudo-1.7.1/audit_help.c
+--- sudo-1.7.1/audit_help.c.auditfix	2009-07-09 15:05:14.000000000 +0200
++++ sudo-1.7.1/audit_help.c	2009-07-09 15:04:33.000000000 +0200
+@@ -45,7 +45,7 @@
+ #include <selinux/selinux.h>
+ #endif
+ 
+-int audit_fd;
++int audit_fd = -1;
+ 
+ void audit_help_open (void)
+ {
+diff -up sudo-1.7.1/sudo.c.auditfix sudo-1.7.1/sudo.c
+--- sudo-1.7.1/sudo.c.auditfix	2009-07-09 14:35:50.000000000 +0200
++++ sudo-1.7.1/sudo.c	2009-07-09 15:02:41.000000000 +0200
+@@ -363,10 +363,6 @@ main(argc, argv, envp)
+     }
+     if (safe_cmnd == NULL)
+ 	safe_cmnd = estrdup(user_cmnd);
+-
+-#if defined(WITH_AUDIT)
+-    audit_help_open ();
+-#endif
+     
+ #ifdef HAVE_SETLOCALE
+     setlocale(LC_ALL, "");
+@@ -529,7 +525,12 @@ main(argc, argv, envp)
+ 	(void) sigaction(SIGINT, &saved_sa_int, NULL);
+ 	(void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
+ 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
++
++	closefrom(def_closefrom + 1);
+ 	
++#if defined(WITH_AUDIT)
++        audit_help_open ();
++#endif
+         if (access(safe_cmnd, X_OK) != 0) {
+ 		warn ("unable to execute %s", safe_cmnd);
+ #ifdef WITH_AUDIT
+@@ -545,8 +546,6 @@ main(argc, argv, envp)
+ 	sudo_endpwent();
+ 	sudo_endgrent();
+ 
+-	closefrom(def_closefrom + 1);
+-
+ #ifndef PROFILING
+ 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0) {
+ 	    syslog(LOG_AUTH|LOG_ERR, "fork");
diff --git a/sudo.spec b/sudo.spec
index 6611274..f7526b5 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.1
-Release: 1%{?dist}
+Release: 4%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -30,6 +30,7 @@ Patch4: sudo-1.7.1-libtool.patch
 Patch5: sudo-1.7.1-getgrouplist.patch
 Patch6: sudo-1.7.1-audit.patch
 Patch7: sudo-1.7.1-conffix.patch
+Patch8: sudo-1.7.1-auditfix.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -51,6 +52,7 @@ on many different machines.
 %patch5 -p1 -b .getgrouplist
 %patch6 -p1 -b .audit
 %patch7 -p1 -b .conffix
+%patch8 -p1 -b .auditfix
 
 %build
 #hande newer autoconf
@@ -137,6 +139,10 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Thu Jul 09 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
+- moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
+- epoch number sync
+
 * Mon Jun 22 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-1
 - updated sudo to version 1.7.1
 - fixed small bug in configure.in (sudo-1.7.1-conffix.patch)

From bf223ad0163f253524f6473ff1239688d7249665 Mon Sep 17 00:00:00 2001
From: Jesse Keating <jkeating@fedoraproject.org>
Date: Mon, 27 Jul 2009 04:58:19 +0000
Subject: [PATCH 031/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index f7526b5..4e81799 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.1
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -139,6 +139,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.1-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
 * Thu Jul 09 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
 - moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
 - epoch number sync

From 9bc07b3b72162da72dc761e798131e7b836dee9a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Thu, 20 Aug 2009 12:38:43 +0000
Subject: [PATCH 032/199] moved secure_path from compile-time option to sudoers
 file (#517428)

---
 sudo-1.7.1-sudoers | 95 ++++++++++++++++++++++++++++++++++++++++++++++
 sudo.spec          | 10 +++--
 2 files changed, 101 insertions(+), 4 deletions(-)
 create mode 100644 sudo-1.7.1-sudoers

diff --git a/sudo-1.7.1-sudoers b/sudo-1.7.1-sudoers
new file mode 100644
index 0000000..6388725
--- /dev/null
+++ b/sudo-1.7.1-sudoers
@@ -0,0 +1,95 @@
+## Sudoers allows particular users to run various commands as
+## the root user, without needing the root password.
+##
+## Examples are provided at the bottom of the file for collections
+## of related commands, which can then be delegated out to particular
+## users or groups.
+## 
+## This file must be edited with the 'visudo' command.
+
+## Host Aliases
+## Groups of machines. You may prefer to use hostnames (perhaps using 
+## wildcards for entire domains) or IP addresses instead.
+# Host_Alias     FILESERVERS = fs1, fs2
+# Host_Alias     MAILSERVERS = smtp, smtp2
+
+## User Aliases
+## These aren't often necessary, as you can use regular groups
+## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
+## rather than USERALIAS
+# User_Alias ADMINS = jsmith, mikem
+
+
+## Command Aliases
+## These are groups of related commands...
+
+## Networking
+Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
+
+## Installation and management of software
+Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
+
+## Services
+Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
+
+## Updating the locate database
+Cmnd_Alias LOCATE = /usr/bin/updatedb
+
+## Storage
+Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
+
+## Delegating permissions
+Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 
+
+## Processes
+Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
+
+## Drivers
+Cmnd_Alias DRIVERS = /sbin/modprobe
+
+# Defaults specification
+
+#
+# Disable "ssh hostname sudo <cmd>", because it will show the password in clear. 
+#         You have to run "ssh -t hostname sudo <cmd>".
+#
+Defaults    requiretty
+
+Defaults    env_reset
+Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
+Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
+Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
+Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
+Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
+
+Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
+
+## Next comes the main part: which users can run what software on 
+## which machines (the sudoers file can be shared between multiple
+## systems).
+## Syntax:
+##
+## 	user	MACHINE=COMMANDS
+##
+## The COMMANDS section may have other options added to it.
+##
+## Allow root to run any commands anywhere 
+root	ALL=(ALL) 	ALL
+
+## Allows members of the 'sys' group to run networking, software, 
+## service management apps and more.
+# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
+
+## Allows people in group wheel to run all commands
+# %wheel	ALL=(ALL)	ALL
+
+## Same thing without a password
+# %wheel	ALL=(ALL)	NOPASSWD: ALL
+
+## Allows members of the users group to mount and unmount the 
+## cdrom as root
+# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
+
+## Allows members of the users group to shutdown this system
+# %users  localhost=/sbin/shutdown -h now
+
diff --git a/sudo.spec b/sudo.spec
index 4e81799..c9b4112 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,12 +1,12 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.1
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
 Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
-Source1: sudo-1.6.8p12-sudoers
+Source1: sudo-1.7.1-sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth, vim-minimal
 
@@ -80,8 +80,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-tty-tickets \
         --with-ldap \
 	--with-selinux \
-	--with-passprompt="[sudo] password for %p: " \
-	--with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin"
+	--with-passprompt="[sudo] password for %p: "
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -139,6 +138,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Thu Aug 20 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-6
+- moved secure_path from compile-time option to sudoers file (#517428)
+
 * Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.1-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
 

From 1c09726f736c5c75e9ee593c211c0a64f4a0af43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Thu, 20 Aug 2009 12:46:32 +0000
Subject: [PATCH 033/199] new sources

---
 .cvsignore | 2 +-
 sources    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.cvsignore b/.cvsignore
index fd44cc4..bff227b 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
 sudo-1.7.1.tar.gz
-sudo-1.6.8p12-sudoers
+sudo-1.7.1-sudoers
diff --git a/sources b/sources
index 8075fb8..cf209ec 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 af672524b2c854a67612bf4c743f58b8  sudo-1.7.1.tar.gz
-f9b28fbbb09ec22ca543c758db44d2cd  sudo-1.6.8p12-sudoers
+02d6d836b41e3049fc33d56cef2e6c4e  sudo-1.7.1-sudoers

From ea73fb27c7a3ef0189cf8a495b9357a6934e0ac1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Thu, 20 Aug 2009 13:01:46 +0000
Subject: [PATCH 034/199] cleanup

---
 sudo-1.6.8p12-sudoers           |  93 --------
 sudo-1.6.9p12-noPam.patch       |  12 -
 sudo-1.6.9p13-audit.patch       | 373 --------------------------------
 sudo-1.6.9p17-Makefile.patch    |  12 -
 sudo-1.6.9p17-runas.patch       |  23 --
 sudo-1.6.9p4-getgrouplist.patch |  40 ----
 sudo-1.6.9p4-login.patch        | 110 ----------
 sudo-1.7.1-sudoers              |  95 --------
 sudo.spec                       |   2 +-
 9 files changed, 1 insertion(+), 759 deletions(-)
 delete mode 100644 sudo-1.6.8p12-sudoers
 delete mode 100644 sudo-1.6.9p12-noPam.patch
 delete mode 100644 sudo-1.6.9p13-audit.patch
 delete mode 100644 sudo-1.6.9p17-Makefile.patch
 delete mode 100644 sudo-1.6.9p17-runas.patch
 delete mode 100644 sudo-1.6.9p4-getgrouplist.patch
 delete mode 100644 sudo-1.6.9p4-login.patch
 delete mode 100644 sudo-1.7.1-sudoers

diff --git a/sudo-1.6.8p12-sudoers b/sudo-1.6.8p12-sudoers
deleted file mode 100644
index ed74e42..0000000
--- a/sudo-1.6.8p12-sudoers
+++ /dev/null
@@ -1,93 +0,0 @@
-## Sudoers allows particular users to run various commands as
-## the root user, without needing the root password.
-##
-## Examples are provided at the bottom of the file for collections
-## of related commands, which can then be delegated out to particular
-## users or groups.
-## 
-## This file must be edited with the 'visudo' command.
-
-## Host Aliases
-## Groups of machines. You may prefer to use hostnames (perhaps using 
-## wildcards for entire domains) or IP addresses instead.
-# Host_Alias     FILESERVERS = fs1, fs2
-# Host_Alias     MAILSERVERS = smtp, smtp2
-
-## User Aliases
-## These aren't often necessary, as you can use regular groups
-## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
-## rather than USERALIAS
-# User_Alias ADMINS = jsmith, mikem
-
-
-## Command Aliases
-## These are groups of related commands...
-
-## Networking
-Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
-
-## Installation and management of software
-Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
-
-## Services
-Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
-
-## Updating the locate database
-Cmnd_Alias LOCATE = /usr/bin/updatedb
-
-## Storage
-Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
-
-## Delegating permissions
-Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 
-
-## Processes
-Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
-
-## Drivers
-Cmnd_Alias DRIVERS = /sbin/modprobe
-
-# Defaults specification
-
-#
-# Disable "ssh hostname sudo <cmd>", because it will show the password in clear. 
-#         You have to run "ssh -t hostname sudo <cmd>".
-#
-Defaults    requiretty
-
-Defaults    env_reset
-Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
-Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
-Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
-Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
-Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
-
-## Next comes the main part: which users can run what software on 
-## which machines (the sudoers file can be shared between multiple
-## systems).
-## Syntax:
-##
-## 	user	MACHINE=COMMANDS
-##
-## The COMMANDS section may have other options added to it.
-##
-## Allow root to run any commands anywhere 
-root	ALL=(ALL) 	ALL
-
-## Allows members of the 'sys' group to run networking, software, 
-## service management apps and more.
-# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
-
-## Allows people in group wheel to run all commands
-# %wheel	ALL=(ALL)	ALL
-
-## Same thing without a password
-# %wheel	ALL=(ALL)	NOPASSWD: ALL
-
-## Allows members of the users group to mount and unmount the 
-## cdrom as root
-# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
-
-## Allows members of the users group to shutdown this system
-# %users  localhost=/sbin/shutdown -h now
-
diff --git a/sudo-1.6.9p12-noPam.patch b/sudo-1.6.9p12-noPam.patch
deleted file mode 100644
index c57e171..0000000
--- a/sudo-1.6.9p12-noPam.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up sudo-1.6.9p12/configure.in.noPam sudo-1.6.9p12/configure.in
---- sudo-1.6.9p12/configure.in.noPam	2008-02-05 13:52:07.000000000 +0100
-+++ sudo-1.6.9p12/configure.in	2008-02-05 13:52:25.000000000 +0100
-@@ -1842,7 +1842,7 @@ if test ${with_pam-"no"} != "no"; then
- 		yes)	AC_MSG_RESULT(yes)
- 			;;
- 		no)		AC_MSG_RESULT(no)
--			    AC_DEFINE(NO_PAM_SESSION)
-+			    AC_DEFINE([NO_PAM_SESSION], [], [PAM session support disabled])
- 			    ;;
- 		*)		AC_MSG_RESULT(no)
- 			    AC_MSG_WARN([Ignoring unknown argument to --enable-pam-session: $enableval])
diff --git a/sudo-1.6.9p13-audit.patch b/sudo-1.6.9p13-audit.patch
deleted file mode 100644
index d8937e2..0000000
--- a/sudo-1.6.9p13-audit.patch
+++ /dev/null
@@ -1,373 +0,0 @@
-diff -up /dev/null sudo-1.6.9p17/audit_help.c
---- /dev/null	2008-08-23 21:55:45.734000982 +0200
-+++ sudo-1.6.9p17/audit_help.c	2008-09-02 15:49:38.000000000 +0200
-@@ -0,0 +1,140 @@
-+/*
-+ *  Audit helper functions used throughout sudo
-+ *
-+ *  Copyright (C) 2007, Red Hat, Inc.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
-+ *    may be used to endorse or promote products derived from this software
-+ *    without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+
-+#include <config.h>
-+
-+#ifdef WITH_AUDIT
-+
-+#include <stdlib.h>
-+#include <syslog.h>
-+#include <stdarg.h>
-+#include <libaudit.h>
-+#include <errno.h>
-+#include <stdio.h>
-+#include <string.h>
-+#include <unistd.h>
-+#include <sys/types.h>
-+
-+#ifdef HAVE_SELINUX
-+#include <selinux/selinux.h>
-+#endif
-+
-+int audit_fd;
-+
-+void audit_help_open (void)
-+{
-+	audit_fd = audit_open ();
-+	if (audit_fd < 0) {
-+        	/* You get these only when the kernel doesn't have
-+                 * audit compiled in. */
-+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
-+		    errno == EAFNOSUPPORT)
-+			return;
-+		fprintf (stderr, "Cannot open audit interface - aborting.\n");
-+		exit (1);
-+	}
-+}
-+
-+/*
-+ * This function will log a message to the audit system using a predefined
-+ * message format. Parameter usage is as follows:
-+ *
-+ * type - type of message: AUDIT_USER_CMD
-+ * command - the command being logged
-+ * params - parames of the command
-+ * result - 1 is "success" and 0 is "failed"
-+ *
-+ */
-+void audit_logger (int type, const char *command, const char *params, int result)
-+{
-+	int err;
-+	char *msg;
-+
-+	if( audit_fd < 0 )
-+		return;
-+	else {
-+
-+		if( params ) 
-+	                err = asprintf(&msg, "%s %s", command, params);
-+		else 
-+	                err = asprintf(&msg, "%s", command);
-+                if (err < 0) {
-+                        fprintf (stderr, "Memory allocation for audit message wasn’t possible.\n");
-+                        return;
-+                }
-+		
-+		err = audit_log_user_command (audit_fd, type, msg, NULL, result);
-+               /* The kernel supports auditing and we had 
-+                  enough privilege to write to the socket. */
-+		if( err <= 0 && !((errno == EPERM && getuid() > 0) || errno == ECONNREFUSED ) ) {
-+			perror("audit_log_user_command()");
-+		}
-+
-+		free(msg);
-+	}
-+}
-+
-+#ifdef HAVE_SELINUX
-+int send_audit_message(int success, security_context_t old_context,
-+                       security_context_t new_context, const char *ttyn)
-+{
-+        char *msg = NULL;
-+        int rc;
-+
-+        if (audit_fd < 0)
-+                return -1;
-+
-+        if (asprintf(&msg, "newrole: old-context=%s new-context=%s",
-+                     old_context ? old_context : "?",
-+                     new_context ? new_context : "?") < 0) {
-+                fprintf(stderr, "Error allocating memory.\n");
-+                rc = -1;
-+                goto out;
-+        }
-+
-+        rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
-+                                    msg, NULL, NULL, ttyn, success);
-+
-+        if (rc <= 0) {
-+                fprintf(stderr, "Error sending audit message.\n");
-+                rc = -1;
-+                goto out;
-+        }
-+        rc = 0;
-+
-+        out:
-+         free(msg);
-+         return rc;
-+}
-+#endif
-+
-+#endif                         /* WITH_AUDIT */
-+
-+
-diff -up sudo-1.6.9p17/configure.in.audit sudo-1.6.9p17/configure.in
---- sudo-1.6.9p17/configure.in.audit	2008-09-02 15:48:46.000000000 +0200
-+++ sudo-1.6.9p17/configure.in	2008-09-02 15:48:46.000000000 +0200
-@@ -167,6 +167,10 @@ dnl
- dnl Options for --with
- dnl
- 
-+AC_ARG_WITH(audit,
-+        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
-+        [with_audit=$withval], [with_audit=yes])
-+
- AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
- [case $with_CC in
-     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
-@@ -1616,6 +1620,25 @@ dnl
- : ${mansectsu='8'}
- : ${mansectform='5'}
- 
-+
-+AC_SUBST(LIBAUDIT)
-+if test "$with_audit" = "yes"; then
-+	# See if we have the audit library
-+        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
-+        if test "$audit_header" = "yes"; then
-+                AC_CHECK_LIB(audit, audit_log_user_command,
-+                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
-+                        LIBAUDIT="-laudit"])
-+        fi
-+	# See if we have the libcap library
-+	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
-+	if test "$cap_header" = "yes"; then
-+		AC_CHECK_LIB(cap, cap_init,
-+			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
-+			SUDO_LIBS="${SUDO_LIBS} -lcap"])
-+	fi
-+fi
-+
- dnl
- dnl Add in any libpaths or libraries specified via configure
- dnl
-diff -up sudo-1.6.9p17/Makefile.in.audit sudo-1.6.9p17/Makefile.in
---- sudo-1.6.9p17/Makefile.in.audit	2008-06-22 22:29:03.000000000 +0200
-+++ sudo-1.6.9p17/Makefile.in	2008-09-02 15:48:46.000000000 +0200
-@@ -121,11 +121,13 @@ HDRS = compat.h def_data.h defaults.h in
- 
- AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
- 
-+AUDIT_OBJS = audit_help.o 
-+
- PARSEOBJS = sudo.tab.o lex.yy.o alloc.o defaults.o
- 
- SUDOBJS = check.o env.o getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
- 	  interfaces.o logging.o parse.o set_perms.o sudo.o sudo_edit.o \
--	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS)
-+	  tgetpass.o zero_bytes.o @SUDO_OBJS@ $(AUTH_OBJS) $(PARSEOBJS) $(AUDIT_OBJS)
- 
- VISUDOBJS = visudo.o fileops.o gettime.o goodpath.o find_path.o $(PARSEOBJS)
- 
-@@ -277,6 +279,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
- sia.o: $(authdir)/sia.c $(AUTHDEP)
- 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
- 
-+audit_help.o: audit_help.c sudo.h
-+	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
-+
- sudo.man.in: $(srcdir)/sudo.pod
- 	@rm -f $(srcdir)/$@
- 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
-diff -up sudo-1.6.9p17/set_perms.c.audit sudo-1.6.9p17/set_perms.c
---- sudo-1.6.9p17/set_perms.c.audit	2007-11-28 00:41:23.000000000 +0100
-+++ sudo-1.6.9p17/set_perms.c	2008-09-02 15:48:46.000000000 +0200
-@@ -53,6 +53,10 @@
- #ifdef HAVE_LOGIN_CAP_H
- # include <login_cap.h>
- #endif
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+# include <sys/prctl.h>
-+# include <sys/capability.h>
-+#endif
- 
- #include "sudo.h"
- 
-@@ -119,13 +123,46 @@ set_perms(perm)
- 			      	break;
- 
- 	case PERM_FULL_RUNAS:
--				/* headed for exec(), assume euid == ROOT_UID */
--				runas_setup();
--				if (setresuid(def_stay_setuid ?
--				    user_uid : runas_pw->pw_uid,
--				    runas_pw->pw_uid, runas_pw->pw_uid))
--				    err(1, "unable to change to runas uid");
--				break;
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+                                { /* BEGIN CAP BLOCK */
-+                                 cap_t new_caps;
-+                                 cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
-+
-+                                 if (runas_pw->pw_uid != ROOT_UID) {
-+                                     new_caps = cap_init ();
-+                                     if (!new_caps)
-+                                         err(1, "Error initing capabilities, aborting.\n");
-+
-+                                     if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
-+                                        cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
-+                                          err(1, "Error setting capabilities, aborting\n");
-+                                     }
-+
-+                                     if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0))
-+                                         err(1, "Error setting KEEPCAPS, aborting\n");
-+                                 }
-+#endif
-+                                /* headed for exec(), assume euid == ROOT_UID */
-+                                 runas_setup ();
-+                                 if (setresuid(def_stay_setuid ?
-+                                     user_uid : runas_pw->pw_uid,
-+                                     runas_pw->pw_uid, runas_pw->pw_uid))
-+                                     err(1, "unable to change to runas uid");
-+
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+                                 if (runas_pw->pw_uid != ROOT_UID) {
-+                                     if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0)
-+                                         err(1, "Error resetting KEEPCAPS, aborting\n");
-+
-+                                     if (cap_set_proc(new_caps))
-+                                         err(1, "Error dropping capabilities, aborting\n");
-+
-+                                     if (cap_free (new_caps))
-+                                         err(1, "Error freeing caps\n");
-+                                 }
-+                                } /* END CAP BLOCK */
-+#endif
-+                                break;
- 
- 	case PERM_SUDOERS:
- 				/* assume euid == ROOT_UID, ruid == user */
-diff -up sudo-1.6.9p17/sudo.c.audit sudo-1.6.9p17/sudo.c
---- sudo-1.6.9p17/sudo.c.audit	2008-09-02 15:48:46.000000000 +0200
-+++ sudo-1.6.9p17/sudo.c	2008-09-02 15:48:46.000000000 +0200
-@@ -100,6 +100,10 @@
- # include <selinux/selinux.h>
- #endif
- 
-+#ifdef WITH_AUDIT
-+#include <libaudit.h>
-+#endif
-+
- #include "sudo.h"
- #include "interfaces.h"
- #include "version.h"
-@@ -289,6 +293,10 @@ main(argc, argv, envp)
-     if (safe_cmnd == NULL)
- 	safe_cmnd = estrdup(user_cmnd);
- 
-+#if defined(WITH_AUDIT)
-+    audit_help_open ();
-+#endif
-+
-     /*
-      * Look up the timestamp dir owner if one is specified.
-      */
-@@ -435,6 +443,17 @@ main(argc, argv, envp)
- 	(void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
- 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
- 
-+        if (access(safe_cmnd, X_OK) != 0) {
-+                 warn ("unable to execute %s", safe_cmnd);
-+#ifdef WITH_AUDIT
-+                audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
-+                exit(127);
-+        }
-+#ifdef WITH_AUDIT
-+        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
-+#endif
-+
- #ifndef PROFILING
- 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0)
- 	    exit(0);
-@@ -458,10 +477,16 @@ main(argc, argv, envp)
- 	    NewArgv[1] = safe_cmnd;
- 	    execve(_PATH_BSHELL, NewArgv, environ);
- 	}
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	warn("unable to execute %s", safe_cmnd);
- 	exit(127);
-     } else if (ISSET(validated, FLAG_NO_USER) || (validated & FLAG_NO_HOST)) {
- 	log_auth(validated, 1);
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     } else if (ISSET(validated, VALIDATE_NOT_OK)) {
- 	if (def_path_info) {
-@@ -482,6 +507,9 @@ main(argc, argv, envp)
- 	    /* Just tell the user they are not allowed to run foo. */
- 	    log_auth(validated, 1);
- 	}
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     } else {
- 	/* should never get here */
-diff -up sudo-1.6.9p17/sudo.h.audit sudo-1.6.9p17/sudo.h
---- sudo-1.6.9p17/sudo.h.audit	2008-09-02 15:48:46.000000000 +0200
-+++ sudo-1.6.9p17/sudo.h	2008-09-02 15:48:46.000000000 +0200
-@@ -23,6 +23,8 @@
- #ifndef _SUDO_SUDO_H
- #define _SUDO_SUDO_H
- 
-+#include <config.h>
-+
- #include <pathnames.h>
- #include <limits.h>
- #include "compat.h"
-@@ -287,4 +289,10 @@ extern int sudo_mode;
- extern int errno;
- #endif
- 
-+#ifdef WITH_AUDIT
-+extern int audit_fd;
-+extern void audit_help_open (void);
-+extern void audit_logger (int, const char *, const char *, int);
-+#endif
-+
- #endif /* _SUDO_SUDO_H */
diff --git a/sudo-1.6.9p17-Makefile.patch b/sudo-1.6.9p17-Makefile.patch
deleted file mode 100644
index ce8b241..0000000
--- a/sudo-1.6.9p17-Makefile.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up sudo-1.6.9p17/Makefile.in.modfix sudo-1.6.9p17/Makefile.in
---- sudo-1.6.9p17/Makefile.in.modfix	2009-02-24 04:31:34.000000000 +0100
-+++ sudo-1.6.9p17/Makefile.in	2009-02-24 04:31:17.000000000 +0100
-@@ -190,7 +190,7 @@ sudo_noexec.lo: $(srcdir)/sudo_noexec.c
- 	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(srcdir)/sudo_noexec.c
- 
- sudo_noexec.la: sudo_noexec.lo
--	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -o $@ sudo_noexec.lo -avoid-version -rpath $(noexecdir)
-+	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -o $@ sudo_noexec.lo -module -avoid-version -rpath $(noexecdir)
- 
- # Uncomment the following if you want "make distclean" to clean the parser
- @DEV@PARSESRCS = sudo.tab.h sudo.tab.c lex.yy.c def_data.c def_data.h
diff --git a/sudo-1.6.9p17-runas.patch b/sudo-1.6.9p17-runas.patch
deleted file mode 100644
index 273e21d..0000000
--- a/sudo-1.6.9p17-runas.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-Index: parse.c
-===================================================================
-RCS file: /home/cvs/courtesan/sudo/parse.c,v
-retrieving revision 1.160.2.21
-diff -u -r1.160.2.21 parse.c
---- parse.c	2 Nov 2008 14:35:53 -0000	1.160.2.21
-+++ parse.c	23 Jan 2009 19:16:55 -0000
-@@ -651,9 +651,11 @@
-     /*
-      * If the user has a supplementary group vector, check it first.
-      */
--    for (i = 0; i < user_ngroups; i++) {
--	if (grp->gr_gid == user_groups[i])
--	    return(TRUE);
-+    if (strcmp(user, user_name) == 0) {
-+	for (i = 0; i < user_ngroups; i++) {
-+	    if (grp->gr_gid == user_groups[i])
-+		return(TRUE);
-+	}
-     }
-     if (grp->gr_mem != NULL) {
- 	for (cur = grp->gr_mem; *cur; cur++) {
-
diff --git a/sudo-1.6.9p4-getgrouplist.patch b/sudo-1.6.9p4-getgrouplist.patch
deleted file mode 100644
index 4dbac19..0000000
--- a/sudo-1.6.9p4-getgrouplist.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff -up sudo-1.6.9p17/configure.in.getgrouplist sudo-1.6.9p17/configure.in
---- sudo-1.6.9p17/configure.in.getgrouplist	2008-07-04 16:07:42.000000000 +0200
-+++ sudo-1.6.9p17/configure.in	2008-07-04 16:09:29.000000000 +0200
-@@ -1720,7 +1720,7 @@ dnl
- AC_FUNC_GETGROUPS
- AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
- 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
--	       setlocale getaddrinfo setsid)
-+	       setlocale getaddrinfo setsid getgrouplist)
- if test -z "$SKIP_SETRESUID"; then
-     AC_CHECK_FUNCS(setresuid, [SKIP_SETREUID=yes])
- fi
-diff -up sudo-1.6.9p17/check.c.getgrouplist sudo-1.6.9p17/check.c
---- sudo-1.6.9p17/check.c.getgrouplist	2008-01-06 00:59:42.000000000 +0100
-+++ sudo-1.6.9p17/check.c	2008-07-04 16:08:40.000000000 +0200
-@@ -330,6 +330,24 @@ user_is_exempt()
- 	    return(TRUE);
-     }
- 
-+#ifdef HAVE_GETGROUPLIST
-+    {
-+	gid_t *grouplist, grouptmp;
-+	int n_groups, i;
-+	n_groups = 1;
-+	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
-+	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
-+	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
-+		for (i = 0; i < n_groups; i++)
-+		    if (grouplist[i] == grp->gr_gid) {
-+			free(grouplist);
-+			return(TRUE);
-+		    }
-+	    free(grouplist);
-+	}
-+    }
-+#endif
-+
-     return(FALSE);
- }
- 
diff --git a/sudo-1.6.9p4-login.patch b/sudo-1.6.9p4-login.patch
deleted file mode 100644
index 962b74a..0000000
--- a/sudo-1.6.9p4-login.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-diff -up sudo-1.6.9p17/auth/pam.c.login sudo-1.6.9p17/auth/pam.c
---- sudo-1.6.9p17/auth/pam.c.login	2008-02-22 21:19:45.000000000 +0100
-+++ sudo-1.6.9p17/auth/pam.c	2008-07-04 15:34:17.000000000 +0200
-@@ -98,7 +98,12 @@ pam_init(pw, promptp, auth)
-     if (auth != NULL)
- 	auth->data = (VOID *) &pam_status;
-     pam_conv.conv = sudo_conv;
--    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
-+#ifdef HAVE_PAM_LOGIN
-+    if (ISSET(sudo_mode, MODE_LOGIN_SHELL))
-+	    pam_status = pam_start("sudo-i", pw->pw_name, &pam_conv, &pamh);
-+    else
-+#endif
-+	    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
-     if (pam_status != PAM_SUCCESS) {
- 	log_error(USE_ERRNO|NO_EXIT|NO_MAIL, "unable to initialize PAM");
- 	return(AUTH_FATAL);
-diff -up sudo-1.6.9p17/env.c.login sudo-1.6.9p17/env.c
---- sudo-1.6.9p17/env.c.login	2008-06-21 21:04:07.000000000 +0200
-+++ sudo-1.6.9p17/env.c	2008-07-04 15:34:17.000000000 +0200
-@@ -104,7 +104,7 @@ struct environment {
- /*
-  * Prototypes
-  */
--char **rebuild_env		__P((char **, int, int));
-+char **rebuild_env              __P((char **, int));
- static void insert_env		__P((char *, struct environment *, int));
- static char *format_env		__P((char *, ...));
- 
-@@ -392,9 +392,8 @@ matches_env_keep(var)
-  * Also adds sudo-specific variables (SUDO_*).
-  */
- char **
--rebuild_env(envp, sudo_mode, noexec)
-+rebuild_env(envp, noexec)
-     char **envp;
--    int sudo_mode;
-     int noexec;
- {
-     char **ep, *cp, *ps1;
-diff -up sudo-1.6.9p17/configure.in.login sudo-1.6.9p17/configure.in
---- sudo-1.6.9p17/configure.in.login	2008-06-22 22:23:56.000000000 +0200
-+++ sudo-1.6.9p17/configure.in	2008-07-04 15:34:17.000000000 +0200
-@@ -366,6 +366,17 @@ AC_ARG_WITH(pam, [  --with-pam          
- 		;;
- esac])
- 
-+AC_ARG_WITH(pam-login, [  --with-pam-login              enable specific PAM session for sudo -i],
-+[case $with_pam_login in
-+    yes)	AC_DEFINE([HAVE_PAM_LOGIN], [], ["Define to 1 if you use specific PAM session for sodo -i."])	
-+		AC_MSG_CHECKING(whether to use PAM login)
-+		AC_MSG_RESULT(yes)
-+		;;
-+    no)		;;
-+    *)		AC_MSG_ERROR(["--with-pam-login does not take an argument."])
-+		;;
-+esac])
-+
- AC_ARG_WITH(AFS, [  --with-AFS              enable AFS support],
- [case $with_AFS in
-     yes)	AC_DEFINE(HAVE_AFS)
-diff -up sudo-1.6.9p17/sudo.h.login sudo-1.6.9p17/sudo.h
---- sudo-1.6.9p17/sudo.h.login	2008-02-09 15:44:48.000000000 +0100
-+++ sudo-1.6.9p17/sudo.h	2008-07-04 15:34:17.000000000 +0200
-@@ -281,6 +281,7 @@ extern struct passwd *auth_pw;
- extern FILE *sudoers_fp;
- extern int tgetpass_flags;
- extern uid_t timestamp_uid;
-+extern int sudo_mode;
- #endif
- #ifndef errno
- extern int errno;
-diff -up sudo-1.6.9p17/sudo.c.login sudo-1.6.9p17/sudo.c
---- sudo-1.6.9p17/sudo.c.login	2008-06-21 21:04:07.000000000 +0200
-+++ sudo-1.6.9p17/sudo.c	2008-07-04 16:01:43.000000000 +0200
-@@ -125,7 +125,7 @@ static void usage_excl			__P((int));
- static struct passwd *get_authpw	__P((void));
- extern int sudo_edit			__P((int, char **, char **));
- extern void list_matches		__P((void));
--extern char **rebuild_env		__P((char **, int, int));
-+extern char **rebuild_env               __P((char **, int));
- extern void validate_env_vars		__P((struct list_member *));
- extern char **insert_env_vars		__P((char **, struct list_member *));
- extern struct passwd *sudo_getpwnam	__P((const char *));
-@@ -156,7 +156,7 @@ login_cap_t *lc;
- char *login_style;
- #endif /* HAVE_BSD_AUTH_H */
- sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp;
--
-+int sudo_mode;
- 
- int
- main(argc, argv, envp)
-@@ -167,7 +167,6 @@ main(argc, argv, envp)
-     int validated;
-     int fd;
-     int cmnd_status;
--    int sudo_mode;
-     int pwflag;
-     sigaction_t sa;
-     extern int printmatches;
-@@ -345,7 +344,7 @@ main(argc, argv, envp)
- 	def_env_reset = FALSE;
- 
-     /* Build a new environment that avoids any nasty bits. */
--    environ = rebuild_env(environ, sudo_mode, ISSET(validated, FLAG_NOEXEC));
-+    environ = rebuild_env(envp, ISSET(validated, FLAG_NOEXEC));
- 
-     /* Fill in passwd struct based on user we are authenticating as.  */
-     auth_pw = get_authpw();
diff --git a/sudo-1.7.1-sudoers b/sudo-1.7.1-sudoers
deleted file mode 100644
index 6388725..0000000
--- a/sudo-1.7.1-sudoers
+++ /dev/null
@@ -1,95 +0,0 @@
-## Sudoers allows particular users to run various commands as
-## the root user, without needing the root password.
-##
-## Examples are provided at the bottom of the file for collections
-## of related commands, which can then be delegated out to particular
-## users or groups.
-## 
-## This file must be edited with the 'visudo' command.
-
-## Host Aliases
-## Groups of machines. You may prefer to use hostnames (perhaps using 
-## wildcards for entire domains) or IP addresses instead.
-# Host_Alias     FILESERVERS = fs1, fs2
-# Host_Alias     MAILSERVERS = smtp, smtp2
-
-## User Aliases
-## These aren't often necessary, as you can use regular groups
-## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
-## rather than USERALIAS
-# User_Alias ADMINS = jsmith, mikem
-
-
-## Command Aliases
-## These are groups of related commands...
-
-## Networking
-Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
-
-## Installation and management of software
-Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
-
-## Services
-Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
-
-## Updating the locate database
-Cmnd_Alias LOCATE = /usr/bin/updatedb
-
-## Storage
-Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
-
-## Delegating permissions
-Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 
-
-## Processes
-Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
-
-## Drivers
-Cmnd_Alias DRIVERS = /sbin/modprobe
-
-# Defaults specification
-
-#
-# Disable "ssh hostname sudo <cmd>", because it will show the password in clear. 
-#         You have to run "ssh -t hostname sudo <cmd>".
-#
-Defaults    requiretty
-
-Defaults    env_reset
-Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
-Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
-Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
-Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
-Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
-
-Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
-
-## Next comes the main part: which users can run what software on 
-## which machines (the sudoers file can be shared between multiple
-## systems).
-## Syntax:
-##
-## 	user	MACHINE=COMMANDS
-##
-## The COMMANDS section may have other options added to it.
-##
-## Allow root to run any commands anywhere 
-root	ALL=(ALL) 	ALL
-
-## Allows members of the 'sys' group to run networking, software, 
-## service management apps and more.
-# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
-
-## Allows people in group wheel to run all commands
-# %wheel	ALL=(ALL)	ALL
-
-## Same thing without a password
-# %wheel	ALL=(ALL)	NOPASSWD: ALL
-
-## Allows members of the users group to mount and unmount the 
-## cdrom as root
-# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
-
-## Allows members of the users group to shutdown this system
-# %users  localhost=/sbin/shutdown -h now
-
diff --git a/sudo.spec b/sudo.spec
index c9b4112..277d432 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -55,7 +55,7 @@ on many different machines.
 %patch8 -p1 -b .auditfix
 
 %build
-#hande newer autoconf
+# handle newer autoconf
 libtoolize --force && rm acsite.m4 && mv aclocal.m4 acinclude.m4 && autoreconf
 
 %ifarch s390 s390x sparc64

From 4e2470df23c68354cddd520b7e863cf7c65b331b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Mr=C3=A1z?= <tmraz@fedoraproject.org>
Date: Fri, 21 Aug 2009 11:19:03 +0000
Subject: [PATCH 035/199] - rebuilt with new audit

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 277d432..f1befa6 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.1
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -138,6 +138,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.7.1-7
+- rebuilt with new audit
+
 * Thu Aug 20 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-6
 - moved secure_path from compile-time option to sudoers file (#517428)
 

From 1362d08ffc87f896b06b605f64021c33ad08445f Mon Sep 17 00:00:00 2001
From: Bill Nottingham <notting@fedoraproject.org>
Date: Wed, 25 Nov 2009 23:15:39 +0000
Subject: [PATCH 036/199] Fix typo that causes a failure to update the common
 directory. (releng     #2781)

---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 19b4f18..45ef6e6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,10 +1,10 @@
 # Makefile for source rpm: sudo
-# $Id: Makefile,v 1.1 2004/09/09 12:46:19 cvsdist Exp $
+# $Id: Makefile,v 1.2 2007/10/15 19:24:45 notting Exp $
 NAME := sudo
 SPECFILE = $(firstword $(wildcard *.spec))
 
 define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
 endef
 
 MAKEFILE_COMMON := $(shell $(find-makefile-common))

From 7a4ce764b3d9d2d9e6bca00d61d5a2d9e236746e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Thu, 7 Jan 2010 15:24:53 +0000
Subject: [PATCH 037/199] - new upstream version 1.7.2p2-1 - commented out
 unused aliases in sudoers to make visudo happy (#550239)

---
 .cvsignore                  |   4 +-
 sources                     |   4 +-
 sudo-1.7.2p1-audit.patch    | 400 ++++++++++++++++++++++++++++++++++++
 sudo-1.7.2p1-envdebug.patch |  12 ++
 sudo-1.7.2p1-login.patch    | 111 ++++++++++
 sudo.spec                   |  24 ++-
 6 files changed, 540 insertions(+), 15 deletions(-)
 create mode 100644 sudo-1.7.2p1-audit.patch
 create mode 100644 sudo-1.7.2p1-envdebug.patch
 create mode 100644 sudo-1.7.2p1-login.patch

diff --git a/.cvsignore b/.cvsignore
index bff227b..71023ee 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
-sudo-1.7.1.tar.gz
-sudo-1.7.1-sudoers
+sudo-1.7.2p2.tar.gz
+sudo-1.7.2p2-sudoers
diff --git a/sources b/sources
index cf209ec..e07075a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-af672524b2c854a67612bf4c743f58b8  sudo-1.7.1.tar.gz
-02d6d836b41e3049fc33d56cef2e6c4e  sudo-1.7.1-sudoers
+2a19cf1ab4afc94fe19d0d0899d4cd45  sudo-1.7.2p2.tar.gz
+23f2ea124749102bcb3c404ee09dc521  sudo-1.7.2p2-sudoers
diff --git a/sudo-1.7.2p1-audit.patch b/sudo-1.7.2p1-audit.patch
new file mode 100644
index 0000000..409aa5b
--- /dev/null
+++ b/sudo-1.7.2p1-audit.patch
@@ -0,0 +1,400 @@
+diff -up /dev/null sudo-1.7.2p1/audit_help.c
+--- /dev/null	2009-09-09 14:57:12.384002457 +0200
++++ sudo-1.7.2p1/audit_help.c	2009-10-30 12:25:49.000000000 +0100
+@@ -0,0 +1,136 @@
++/*
++ *  Audit helper functions used throughout sudo
++ *
++ *  Copyright (C) 2007, Red Hat, Inc.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
++ *    may be used to endorse or promote products derived from this software
++ *    without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ */
++
++#include <config.h>
++
++#ifdef WITH_AUDIT
++#include <stdlib.h>
++#include <syslog.h>
++#include <stdarg.h>
++#include <libaudit.h>
++#include <errno.h>
++#include <stdio.h>
++#include <string.h>
++#include <unistd.h>
++#include <sys/types.h>
++
++#ifdef HAVE_SELINUX
++#include <selinux/selinux.h>
++#endif
++
++int audit_fd = -1;
++
++void audit_help_open (void)
++{
++	audit_fd = audit_open ();
++	if (audit_fd < 0) {
++        	/* You get these only when the kernel doesn't have
++                 * audit compiled in. */
++		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
++		    errno == EAFNOSUPPORT)
++			return;
++		fprintf (stderr, "Cannot open audit interface - aborting.\n");
++		exit (1);
++	}
++}
++
++/*
++ * This function will log a message to the audit system using a predefined
++ * message format. Parameter usage is as follows:
++ *
++ * type - type of message: AUDIT_USER_CMD
++ * command - the command being logged
++ * params - parames of the command
++ * result - 1 is "success" and 0 is "failed"
++ *
++ */
++void audit_logger (int type, const char *command, const char *params, int result)
++{
++	int err;
++	char *msg;
++
++	if( audit_fd < 0 )
++		return;
++	else {
++
++		if( params ) 
++	                err = asprintf(&msg, "%s %s", command, params);
++		else 
++	                err = asprintf(&msg, "%s", command);
++                if (err < 0) {
++                        fprintf (stderr, "Memory allocation for audit message wasn’t possible.\n");
++                        return;
++                }
++		
++		err = audit_log_user_command (audit_fd, type, msg, NULL, result);
++               /* The kernel supports auditing and we had 
++                  enough privilege to write to the socket. */
++		if( err <= 0 && !((errno == EPERM && getuid() > 0) || errno == ECONNREFUSED ) ) {
++			perror("audit_log_user_command()");
++		}
++
++		free(msg);
++	}
++}
++
++#ifdef HAVE_SELINUX
++int send_audit_message(int success, security_context_t old_context,
++                       security_context_t new_context, const char *ttyn)
++{
++        char *msg = NULL;
++        int rc;
++
++        if (audit_fd < 0)
++                return -1;
++
++        if (asprintf(&msg, "newrole: old-context=%s new-context=%s",
++                     old_context ? old_context : "?",
++                     new_context ? new_context : "?") < 0) {
++                fprintf(stderr, "Error allocating memory.\n");
++                rc = -1;
++                goto out;
++        }
++
++        rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
++                                    msg, NULL, NULL, ttyn, success);
++
++        if (rc <= 0) {
++                fprintf(stderr, "Error sending audit message.\n");
++                rc = -1;
++                goto out;
++        }
++        rc = 0;
++
++        out:
++         free(msg);
++         return rc;
++}
++#endif
++#endif                         /* WITH_AUDIT */
+diff -up sudo-1.7.2p1/configure.in.audit sudo-1.7.2p1/configure.in
+--- sudo-1.7.2p1/configure.in.audit	2009-10-30 12:25:49.000000000 +0100
++++ sudo-1.7.2p1/configure.in	2009-10-30 12:25:49.000000000 +0100
+@@ -180,6 +180,10 @@ dnl
+ dnl Options for --with
+ dnl
+ 
++AC_ARG_WITH(audit,
++        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
++        [with_audit=$withval], [with_audit=yes])
++
+ AC_ARG_WITH(CC, [AS_HELP_STRING([--with-CC], [C compiler to use])],
+ [case $with_CC in
+     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
+@@ -1743,6 +1747,24 @@ dnl
+ : ${mansectsu='8'}
+ : ${mansectform='5'}
+ 
++AC_SUBST(LIBAUDIT)
++if test "$with_audit" = "yes"; then
++	# See if we have the audit library
++        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
++        if test "$audit_header" = "yes"; then
++                AC_CHECK_LIB(audit, audit_log_user_command,
++                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
++                        LIBAUDIT="-laudit"])
++        fi
++	# See if we have the libcap library
++	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
++	if test "$cap_header" = "yes"; then
++		AC_CHECK_LIB(cap, cap_init,
++			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
++			SUDO_LIBS="${SUDO_LIBS} -lcap"])
++	fi
++fi
++
+ dnl
+ dnl Add in any libpaths or libraries specified via configure
+ dnl
+diff -up sudo-1.7.2p1/Makefile.in.audit sudo-1.7.2p1/Makefile.in
+--- sudo-1.7.2p1/Makefile.in.audit	2009-10-30 12:25:49.000000000 +0100
++++ sudo-1.7.2p1/Makefile.in	2009-10-30 12:25:49.000000000 +0100
+@@ -125,6 +125,8 @@ HDRS = bsm_audit.h compat.h def_data.h d
+ 
+ AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
+ 
++AUDIT_OBJS = audit_help.o
++
+ # Note: gram.o must come first here
+ COMMON_OBJS = gram.o alias.o alloc.o defaults.o error.o list.o match.o \
+ 	      toke.o redblack.o zero_bytes.o @NONUNIX_GROUPS_IMPL@
+@@ -132,7 +134,7 @@ COMMON_OBJS = gram.o alias.o alloc.o def
+ SUDO_OBJS = $(COMMON_OBJS) $(AUTH_OBJS) @SUDO_OBJS@ audit.o check.o env.o \
+ 	    getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
+ 	    interfaces.o lbuf.o logging.o parse.o pwutil.o set_perms.o \
+-	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o
++	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o $(AUDIT_OBJS)
+ 
+ VISUDO_OBJS = $(COMMON_OBJS) visudo.o fileops.o gettime.o goodpath.o \
+ 	      find_path.o pwutil.o
+@@ -363,6 +365,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
+ sia.o: $(authdir)/sia.c $(AUTHDEP)
+ 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
+ 
++audit_help.o: audit_help.c sudo.h
++	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
++
+ sudo.man.in: $(srcdir)/sudo.pod
+ 	@rm -f $(srcdir)/$@
+ 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
+diff -up sudo-1.7.2p1/set_perms.c.audit sudo-1.7.2p1/set_perms.c
+--- sudo-1.7.2p1/set_perms.c.audit	2009-06-25 14:44:33.000000000 +0200
++++ sudo-1.7.2p1/set_perms.c	2009-10-30 12:32:03.000000000 +0100
+@@ -48,6 +48,10 @@
+ #ifdef HAVE_LOGIN_CAP_H
+ # include <login_cap.h>
+ #endif
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++# include <sys/prctl.h>
++# include <sys/capability.h>
++#endif
+ 
+ #include "sudo.h"
+ 
+@@ -130,16 +134,59 @@ set_perms(perm)
+ 			      	break;
+ 
+ 	case PERM_FULL_RUNAS:
+-				/* headed for exec(), assume euid == ROOT_UID */
+-				runas_setup();
+-				if (setresuid(def_stay_setuid ?
+-				    user_uid : runas_pw->pw_uid,
+-				    runas_pw->pw_uid, runas_pw->pw_uid)) {
+-				    errstr = "unable to change to runas uid";
+-				    goto bad;
+-				}
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++	                     { /* BEGIN CAP BLOCK */
++				  cap_t new_caps;
++				  cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
++				  
++				  if (runas_pw->pw_uid != ROOT_UID) {
++				       new_caps = cap_init ();
++				       if (!new_caps) {
++					    errstr = "Error initing capabilities, aborting.\n";
++					    goto bad;
++				       }
++				       
++				       if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
++					  cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
++					    errstr = "Error setting capabilities, aborting\n";
++					    goto bad;
++				       }
++				       
++				       if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
++					    errstr = "Error setting KEEPCAPS, aborting\n";
++					    goto bad;
++				       }
++				  }
++#endif
++				  /* headed for exec(), assume euid == ROOT_UID */
++				  runas_setup();
++				  if (setresuid(def_stay_setuid ?
++						user_uid : runas_pw->pw_uid,
++						runas_pw->pw_uid, runas_pw->pw_uid)) {
++				       errstr = "unable to change to runas uid";
++				       goto bad;
++				  }
++				  
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++				  if (runas_pw->pw_uid != ROOT_UID) {
++				       if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0) {
++					    errstr = "Error resetting KEEPCAPS, aborting\n";
++					    goto bad;
++				       }
++				       
++				       if (cap_set_proc(new_caps)) {
++					    errstr = "Error dropping capabilities, aborting\n";
++					    goto bad;
++				       }
++				       
++				       if (cap_free (new_caps)) {
++					    errstr = "Error freeing caps\n";
++					    goto bad;
++				       }
++				  }
++                                } /* END CAP BLOCK */
++#endif
+ 				break;
+-
+ 	case PERM_SUDOERS:
+ 				/* assume euid == ROOT_UID, ruid == user */
+ 				if (setresgid(-1, SUDOERS_GID, -1))
+diff -up sudo-1.7.2p1/sudo.c.audit sudo-1.7.2p1/sudo.c
+--- sudo-1.7.2p1/sudo.c.audit	2009-10-30 12:25:49.000000000 +0100
++++ sudo-1.7.2p1/sudo.c	2009-10-30 12:25:49.000000000 +0100
+@@ -95,6 +95,10 @@
+ # include <selinux/selinux.h>
+ #endif
+ 
++#ifdef WITH_AUDIT
++#include <libaudit.h>
++#endif
++
+ #include <sudo_usage.h>
+ #include "sudo.h"
+ #include "lbuf.h"
+@@ -372,7 +376,7 @@ main(argc, argv, envp)
+ 
+     if (safe_cmnd == NULL)
+ 	safe_cmnd = estrdup(user_cmnd);
+-
++    
+ #ifdef HAVE_SETLOCALE
+     setlocale(LC_ALL, "");
+ #endif
+@@ -538,12 +542,26 @@ main(argc, argv, envp)
+ 	(void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
+ 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
+ 
++	closefrom(def_closefrom + 1);
++	
++#if defined(WITH_AUDIT)
++        audit_help_open ();
++#endif
++        if (access(safe_cmnd, X_OK) != 0) {
++		warn ("unable to execute %s", safe_cmnd);
++#ifdef WITH_AUDIT
++		audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
++		exit(127);
++        }
++#ifdef WITH_AUDIT
++        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
++#endif
++	
+ 	/* Close the password and group files and free up memory. */
+ 	sudo_endpwent();
+ 	sudo_endgrent();
+ 
+-	closefrom(def_closefrom + 1);
+-
+ #ifndef PROFILING
+ 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0) {
+ 	    syslog(LOG_AUTH|LOG_ERR, "fork");
+@@ -568,11 +586,17 @@ main(argc, argv, envp)
+ 	    NewArgv[1] = safe_cmnd;
+ 	    execv(_PATH_BSHELL, NewArgv);
+ 	}
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	warning("unable to execute %s", safe_cmnd);
+ 	exit(127);
+     } else if (ISSET(validated, FLAG_NO_USER | FLAG_NO_HOST)) {
+ 	audit_failure(NewArgv, "No user or host");
+ 	log_denial(validated, 1);
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     } else {
+ 	if (def_path_info) {
+@@ -594,6 +618,9 @@ main(argc, argv, envp)
+ 	    log_denial(validated, 1);
+ 	}
+ 	audit_failure(NewArgv, "validation failure");
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     }
+     exit(0);	/* not reached */
+diff -up sudo-1.7.2p1/sudo.h.audit sudo-1.7.2p1/sudo.h
+--- sudo-1.7.2p1/sudo.h.audit	2009-10-30 12:25:49.000000000 +0100
++++ sudo-1.7.2p1/sudo.h	2009-10-30 12:39:16.000000000 +0100
+@@ -24,6 +24,8 @@
+ #ifndef _SUDO_SUDO_H
+ #define _SUDO_SUDO_H
+ 
++#include <config.h>
++
+ #include <pathnames.h>
+ #include <limits.h>
+ #include "compat.h"
+@@ -340,4 +342,14 @@ extern int sudo_mode;
+ extern int errno;
+ #endif
+ 
++#ifdef WITH_AUDIT
++extern int audit_fd;
++extern void audit_help_open (void);
++extern void audit_logger (int, const char *, const char *, int);
++#ifdef HAVE_SELINUX
++# include <selinux/selinux.h>
++extern int send_audit_message(int, security_context_t, security_context_t, const char *);
++#endif /* HAVE_SELINUX */
++#endif /* WITH_AUDIT */
++
+ #endif /* _SUDO_SUDO_H */
diff --git a/sudo-1.7.2p1-envdebug.patch b/sudo-1.7.2p1-envdebug.patch
new file mode 100644
index 0000000..e189c98
--- /dev/null
+++ b/sudo-1.7.2p1-envdebug.patch
@@ -0,0 +1,12 @@
+diff -up sudo-1.7.2p1/configure.in.envdebug sudo-1.7.2p1/configure.in
+--- sudo-1.7.2p1/configure.in.envdebug	2009-10-30 12:18:09.000000000 +0100
++++ sudo-1.7.2p1/configure.in	2009-10-30 12:19:01.000000000 +0100
+@@ -1214,7 +1214,7 @@ AC_ARG_ENABLE(env_debug,
+ [AS_HELP_STRING([--enable-env-debug], [Whether to enable environment debugging.])],
+ [ case "$enableval" in
+     yes)	AC_MSG_RESULT(yes)
+-		AC_DEFINE(ENV_DEBUG)
++		AC_DEFINE(ENV_DEBUG, [], [Environment debugging.])
+ 		;;
+     no)		AC_MSG_RESULT(no)
+ 		;;
diff --git a/sudo-1.7.2p1-login.patch b/sudo-1.7.2p1-login.patch
new file mode 100644
index 0000000..aeb0cf6
--- /dev/null
+++ b/sudo-1.7.2p1-login.patch
@@ -0,0 +1,111 @@
+diff -up sudo-1.7.2p1/auth/pam.c.login sudo-1.7.2p1/auth/pam.c
+--- sudo-1.7.2p1/auth/pam.c.login	2009-05-25 14:02:42.000000000 +0200
++++ sudo-1.7.2p1/auth/pam.c	2009-10-30 12:15:48.000000000 +0100
+@@ -100,7 +100,13 @@ pam_init(pw, promptp, auth)
+     if (auth != NULL)
+ 	auth->data = (void *) &pam_status;
+     pam_conv.conv = sudo_conv;
+-    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
++#ifdef HAVE_PAM_LOGIN
++    if (ISSET(sudo_mode, MODE_LOGIN_SHELL))
++	    pam_status = pam_start("sudo-i", pw->pw_name, &pam_conv, &pamh);
++    else
++#endif
++	    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
++
+     if (pam_status != PAM_SUCCESS) {
+ 	log_error(USE_ERRNO|NO_EXIT|NO_MAIL, "unable to initialize PAM");
+ 	return(AUTH_FATAL);
+diff -up sudo-1.7.2p1/configure.in.login sudo-1.7.2p1/configure.in
+--- sudo-1.7.2p1/configure.in.login	2009-07-20 15:34:37.000000000 +0200
++++ sudo-1.7.2p1/configure.in	2009-10-30 12:16:24.000000000 +0100
+@@ -394,6 +394,17 @@ AC_ARG_WITH(pam, [AS_HELP_STRING([--with
+ 		;;
+ esac])
+ 
++AC_ARG_WITH(pam-login, [  --with-pam-login              enable specific PAM session for sudo -i],
++[case $with_pam_login in
++    yes)      AC_DEFINE([HAVE_PAM_LOGIN], [], ["Define to 1 if you use specific PAM session for sodo -i."])
++              AC_MSG_CHECKING(whether to use PAM login)
++              AC_MSG_RESULT(yes)
++              ;;
++    no)               ;;
++    *)                AC_MSG_ERROR(["--with-pam-login does not take an argument."])
++              ;;
++esac])
++
+ AC_ARG_WITH(AFS, [AS_HELP_STRING([--with-AFS], [enable AFS support])],
+ [case $with_AFS in
+     yes)	AC_DEFINE(HAVE_AFS)
+diff -up sudo-1.7.2p1/env.c.login sudo-1.7.2p1/env.c
+--- sudo-1.7.2p1/env.c.login	2009-06-23 20:24:42.000000000 +0200
++++ sudo-1.7.2p1/env.c	2009-10-30 12:15:48.000000000 +0100
+@@ -102,7 +102,7 @@ struct environment {
+ /*
+  * Prototypes
+  */
+-void rebuild_env		__P((int, int));
++void rebuild_env		__P((int));
+ static void sudo_setenv		__P((const char *, const char *, int));
+ static void sudo_putenv		__P((char *, int, int));
+ 
+@@ -562,8 +562,7 @@ matches_env_keep(var)
+  * Also adds sudo-specific variables (SUDO_*).
+  */
+ void
+-rebuild_env(sudo_mode, noexec)
+-    int sudo_mode;
++rebuild_env(noexec)
+     int noexec;
+ {
+     char **old_envp, **ep, *cp, *ps1;
+diff -up sudo-1.7.2p1/sudo.c.login sudo-1.7.2p1/sudo.c
+--- sudo-1.7.2p1/sudo.c.login	2009-05-27 02:49:07.000000000 +0200
++++ sudo-1.7.2p1/sudo.c	2009-10-30 12:15:48.000000000 +0100
+@@ -126,7 +126,7 @@ static void usage_excl			__P((int))
+ 					    __attribute__((__noreturn__));
+ static struct passwd *get_authpw	__P((void));
+ extern int sudo_edit			__P((int, char **, char **));
+-extern void rebuild_env			__P((int, int));
++extern void rebuild_env			__P((int));
+ void validate_env_vars			__P((struct list_member *));
+ void insert_env_vars			__P((struct list_member *));
+ 
+@@ -157,6 +157,8 @@ login_cap_t *lc;
+ char *login_style;
+ #endif /* HAVE_BSD_AUTH_H */
+ sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp;
++
++int sudo_mode;
+ static char *runas_user;
+ static char *runas_group;
+ static struct sudo_nss_list *snl;
+@@ -172,7 +174,7 @@ main(argc, argv, envp)
+     char **envp;
+ {
+     int sources = 0, validated;
+-    int fd, cmnd_status, sudo_mode, pwflag, rc = 0;
++    int fd, cmnd_status, pwflag, rc = 0;
+     sigaction_t sa;
+     struct sudo_nss *nss;
+ #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
+@@ -421,7 +423,7 @@ main(argc, argv, envp)
+ 	def_env_reset = FALSE;
+ 
+     /* Build a new environment that avoids any nasty bits. */
+-    rebuild_env(sudo_mode, def_noexec);
++    rebuild_env(def_noexec);
+ 
+     /* Fill in passwd struct based on user we are authenticating as.  */
+     auth_pw = get_authpw();
+diff -up sudo-1.7.2p1/sudo.h.login sudo-1.7.2p1/sudo.h
+--- sudo-1.7.2p1/sudo.h.login	2009-05-25 14:02:41.000000000 +0200
++++ sudo-1.7.2p1/sudo.h	2009-10-30 12:15:48.000000000 +0100
+@@ -334,6 +334,7 @@ extern struct passwd *auth_pw, *list_pw;
+ extern int tgetpass_flags;
+ extern int long_list;
+ extern uid_t timestamp_uid;
++extern int sudo_mode;
+ #endif
+ #ifndef errno
+ extern int errno;
diff --git a/sudo.spec b/sudo.spec
index f1befa6..257983c 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,12 +1,12 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.7.1
-Release: 7%{?dist}
+Version: 1.7.2p2
+Release: 1%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
 Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
-Source1: sudo-1.7.1-sudoers
+Source1: sudo-1.7.2p2-sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth, vim-minimal
 
@@ -23,14 +23,14 @@ BuildRequires: sendmail
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
 # use specific PAM session for sudo -i (#198755)
-Patch2: sudo-1.7.1-login.patch
-# the rest, see changelog
-Patch3: sudo-1.7.1-envdebug.patch
+Patch2: sudo-1.7.2p1-login.patch
+# configure.in fix
+Patch3: sudo-1.7.2p1-envdebug.patch
 Patch4: sudo-1.7.1-libtool.patch
+# getgrouplist() to determine group membership (#235915)
 Patch5: sudo-1.7.1-getgrouplist.patch
-Patch6: sudo-1.7.1-audit.patch
-Patch7: sudo-1.7.1-conffix.patch
-Patch8: sudo-1.7.1-auditfix.patch
+# audit support improvement
+Patch6: sudo-1.7.2p1-audit.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -51,8 +51,6 @@ on many different machines.
 %patch4 -p1 -b .libtool
 %patch5 -p1 -b .getgrouplist
 %patch6 -p1 -b .audit
-%patch7 -p1 -b .conffix
-%patch8 -p1 -b .auditfix
 
 %build
 # handle newer autoconf
@@ -138,6 +136,10 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Thu Jan 07 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
+- new upstream version 1.7.2p2-1
+- commented out unused aliases in sudoers to make visudo happy (#550239)
+
 * Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.7.1-7
 - rebuilt with new audit
 

From a9a317e7d0362731d8fa16b9a485d2178af98583 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Tue, 12 Jan 2010 13:17:31 +0000
Subject: [PATCH 038/199] - Add /etc/sudoers.d dir and use it in default config
 (#551470). - Drop *.pod man page duplicates from docs.

---
 sources   |  2 +-
 sudo.spec | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/sources b/sources
index e07075a..4d64f5c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 2a19cf1ab4afc94fe19d0d0899d4cd45  sudo-1.7.2p2.tar.gz
-23f2ea124749102bcb3c404ee09dc521  sudo-1.7.2p2-sudoers
+d657d8d55ecdf88a2d11da73ac5662a4  sudo-1.7.2p2-sudoers
diff --git a/sudo.spec b/sudo.spec
index 257983c..805d490 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.2p2
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -88,6 +88,7 @@ rm -rf $RPM_BUILD_ROOT
 make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
 chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* 
 install -p -d -m 700 $RPM_BUILD_ROOT/var/run/sudo
+install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
 
 mkdir -p $RPM_BUILD_ROOT/etc/pam.d
@@ -116,8 +117,9 @@ rm -rf $RPM_BUILD_ROOT
 %files
 %defattr(-,root,root)
 %doc ChangeLog WHATSNEW HISTORY LICENSE README* TROUBLESHOOTING UPGRADE
-%doc *.pod schema.* sudoers2ldif sample.*
+%doc sudoers.ldap.pod schema.* sudoers2ldif sample.*
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
+%attr(0750,root,root) %dir /etc/sudoers.d/
 %config(noreplace) /etc/pam.d/sudo
 %config(noreplace) /etc/pam.d/sudo-i
 %dir /var/run/sudo
@@ -136,6 +138,10 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Fri Jan  8 2010 Ville Skyttä <ville.skytta@iki.fi> - 1.7.2p2-2
+- Add /etc/sudoers.d dir and use it in default config (#551470).
+- Drop *.pod man page duplicates from docs.
+
 * Thu Jan 07 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
 - new upstream version 1.7.2p2-1
 - commented out unused aliases in sudoers to make visudo happy (#550239)

From 46cc5da5fe4012ef78de6ec4c6d81bb528a0011b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Wed, 10 Feb 2010 12:38:59 +0000
Subject: [PATCH 039/199] - fixed segfault when #include directive is used in
 cycles (#561336)

---
 sudo-1.7.2p2-loopsegv3.patch | 33 +++++++++++++++++++++++++++++++++
 sudo.spec                    |  8 +++++++-
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 sudo-1.7.2p2-loopsegv3.patch

diff --git a/sudo-1.7.2p2-loopsegv3.patch b/sudo-1.7.2p2-loopsegv3.patch
new file mode 100644
index 0000000..e6953bb
--- /dev/null
+++ b/sudo-1.7.2p2-loopsegv3.patch
@@ -0,0 +1,33 @@
+diff -up sudo-1.7.2p2/toke.c.loop sudo-1.7.2p2/toke.c
+--- sudo-1.7.2p2/toke.c.loop	2010-02-09 12:48:33.000000000 +0100
++++ sudo-1.7.2p2/toke.c	2010-02-09 16:54:17.000000000 +0100
+@@ -3461,7 +3461,7 @@ init_lexer()
+ 	    efree(pl);
+ 	}
+ 	efree(istack[idepth].path);
+-	if (!istack[idepth].keepopen)
++	if (idepth && !istack[idepth].keepopen)
+ 	    fclose(istack[idepth].bs->yy_input_file);
+ 	yy_delete_buffer(istack[idepth].bs);
+     }
+@@ -3486,7 +3486,7 @@ _push_include(path, isdir)
+ 	}
+ 	istacksize += SUDOERS_STACK_INCREMENT;
+ 	istack = (struct include_stack *) realloc(istack,
+-	    sizeof(istack) * istacksize);
++	    sizeof(*istack) * istacksize);
+ 	if (istack == NULL) {
+ 	    yyerror("unable to allocate memory");
+ 	    return(FALSE);
+diff -up sudo-1.7.2p2/toke.l.loop sudo-1.7.2p2/toke.l
+--- sudo-1.7.2p2/toke.l.loop	2010-02-09 12:48:30.000000000 +0100
++++ sudo-1.7.2p2/toke.l	2010-02-09 13:18:27.000000000 +0100
+@@ -869,7 +869,7 @@ _push_include(path, isdir)
+ 	}
+ 	istacksize += SUDOERS_STACK_INCREMENT;
+ 	istack = (struct include_stack *) realloc(istack,
+-	    sizeof(istack) * istacksize);
++	    sizeof(*istack) * istacksize);
+ 	if (istack == NULL) {
+ 	    yyerror("unable to allocate memory");
+ 	    return(FALSE);
diff --git a/sudo.spec b/sudo.spec
index 805d490..464a33e 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.2p2
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -31,6 +31,8 @@ Patch4: sudo-1.7.1-libtool.patch
 Patch5: sudo-1.7.1-getgrouplist.patch
 # audit support improvement
 Patch6: sudo-1.7.2p1-audit.patch
+# segfault when #include directive is used in cycles (#561336)
+Patch7: sudo-1.7.2p2-loopsegv3.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -51,6 +53,7 @@ on many different machines.
 %patch4 -p1 -b .libtool
 %patch5 -p1 -b .getgrouplist
 %patch6 -p1 -b .audit
+%patch7 -p1 -b .loopsegv3
 
 %build
 # handle newer autoconf
@@ -138,6 +141,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Feb 10 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-3
+- fixed segfault when #include directive is used in cycles (#561336)
+
 * Fri Jan  8 2010 Ville Skyttä <ville.skytta@iki.fi> - 1.7.2p2-2
 - Add /etc/sudoers.d dir and use it in default config (#551470).
 - Drop *.pod man page duplicates from docs.

From 8e5b1df1b92a4d2aa0d721421d810000431143df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Wed, 10 Feb 2010 15:52:05 +0000
Subject: [PATCH 040/199] - audit related Makefile.in and configure.in
 corrections - added --with-audit configure option - removed call to
 libtoolize

---
 sudo-1.7.2p2-libaudit.patch | 32 ++++++++++++++++++++++++++++++++
 sudo.spec                   | 17 ++++++++++++++---
 2 files changed, 46 insertions(+), 3 deletions(-)
 create mode 100644 sudo-1.7.2p2-libaudit.patch

diff --git a/sudo-1.7.2p2-libaudit.patch b/sudo-1.7.2p2-libaudit.patch
new file mode 100644
index 0000000..3f1af38
--- /dev/null
+++ b/sudo-1.7.2p2-libaudit.patch
@@ -0,0 +1,32 @@
+diff -up sudo-1.7.2p2/configure.in.libaudit sudo-1.7.2p2/configure.in
+--- sudo-1.7.2p2/configure.in.libaudit	2010-02-10 16:21:26.000000000 +0100
++++ sudo-1.7.2p2/configure.in	2010-02-10 16:21:26.000000000 +0100
+@@ -1752,7 +1752,6 @@ dnl
+ : ${mansectsu='8'}
+ : ${mansectform='5'}
+ 
+-AC_SUBST(LIBAUDIT)
+ if test "$with_audit" = "yes"; then
+ 	# See if we have the audit library
+         AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
+@@ -1770,6 +1769,8 @@ if test "$with_audit" = "yes"; then
+ 	fi
+ fi
+ 
++AC_SUBST(LIBAUDIT)
++
+ dnl
+ dnl Add in any libpaths or libraries specified via configure
+ dnl
+diff -up sudo-1.7.2p2/Makefile.in.libaudit sudo-1.7.2p2/Makefile.in
+--- sudo-1.7.2p2/Makefile.in.libaudit	2010-02-10 16:26:06.000000000 +0100
++++ sudo-1.7.2p2/Makefile.in	2010-02-10 16:26:40.000000000 +0100
+@@ -44,7 +44,7 @@ INSTALL = $(SHELL) $(srcdir)/install-sh 
+ # Libraries
+ LIBS = @LIBS@
+ NET_LIBS = @NET_LIBS@
+-SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS)
++SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ @LIBAUDIT@ $(LIBS) $(NET_LIBS)
+ 
+ # C preprocessor flags
+ CPPFLAGS = -I. -I$(srcdir) @CPPFLAGS@
diff --git a/sudo.spec b/sudo.spec
index 464a33e..aa6b460 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.2p2
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -33,6 +33,8 @@ Patch5: sudo-1.7.1-getgrouplist.patch
 Patch6: sudo-1.7.2p1-audit.patch
 # segfault when #include directive is used in cycles (#561336)
 Patch7: sudo-1.7.2p2-loopsegv3.patch
+# audit related Makefile.in and configure.in corrections
+Patch8: sudo-1.7.2p2-libaudit.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -54,10 +56,13 @@ on many different machines.
 %patch5 -p1 -b .getgrouplist
 %patch6 -p1 -b .audit
 %patch7 -p1 -b .loopsegv3
+%patch8 -p1 -b .libaudit
 
 %build
 # handle newer autoconf
-libtoolize --force && rm acsite.m4 && mv aclocal.m4 acinclude.m4 && autoreconf
+rm acsite.m4
+mv aclocal.m4 acinclude.m4
+autoreconf -fv --install
 
 %ifarch s390 s390x sparc64
 F_PIE=-fPIE
@@ -81,7 +86,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-tty-tickets \
         --with-ldap \
 	--with-selinux \
-	--with-passprompt="[sudo] password for %p: "
+	--with-passprompt="[sudo] password for %p: " \
+	--with-audit
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -141,6 +147,11 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Feb 10 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-4
+- audit related Makefile.in and configure.in corrections
+- added --with-audit configure option
+- removed call to libtoolize
+
 * Wed Feb 10 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-3
 - fixed segfault when #include directive is used in cycles (#561336)
 

From 0d6a144061635f33ed462a4a59fa54c98029cb97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Tue, 16 Feb 2010 22:27:13 +0000
Subject: [PATCH 041/199] - fixed no valid sudoers sources found (#558875)

---
 sudo-1.7.2p2-emptyincldir.patch | 38 +++++++++++++++++++++++++++++++++
 sudo.spec                       |  8 ++++++-
 2 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 sudo-1.7.2p2-emptyincldir.patch

diff --git a/sudo-1.7.2p2-emptyincldir.patch b/sudo-1.7.2p2-emptyincldir.patch
new file mode 100644
index 0000000..fbab43e
--- /dev/null
+++ b/sudo-1.7.2p2-emptyincldir.patch
@@ -0,0 +1,38 @@
+diff -up sudo-1.7.2p2/toke.c.empty sudo-1.7.2p2/toke.c
+--- sudo-1.7.2p2/toke.c.empty	2010-02-16 23:13:23.000000000 +0100
++++ sudo-1.7.2p2/toke.c	2010-02-16 23:17:57.000000000 +0100
+@@ -1421,6 +1421,7 @@ __unused static const char rcsid[] = "$S
+ #endif /* lint */
+ 
+ extern YYSTYPE yylval;
++extern int parse_error;
+ int sudolineno = 1;
+ char *sudoers;
+ static int sawspace = 0;
+@@ -1880,7 +1881,7 @@ YY_RULE_SETUP
+ 			    LEXTRACE("INCLUDEDIR\n");
+ 
+ 			    /* Push current buffer and switch to include file */
+-			    if (!push_includedir(path))
++			    if (!push_includedir(path) && parse_error)
+ 				yyterminate();
+ 			}
+ 	YY_BREAK
+@@ -3369,7 +3370,7 @@ switch_dir(stack, dirpath)
+ 
+     if (!(dir = opendir(dirpath))) {
+ 	yyerror(dirpath);
+-	return(FALSE);
++	return(NULL);
+     }
+     while ((dent = readdir(dir))) {
+ 	/* Ignore files that end in '~' or have a '.' in them. */
+@@ -3494,7 +3495,7 @@ _push_include(path, isdir)
+     }
+     if (isdir) {
+ 	if (!(path = switch_dir(&istack[idepth], path))) {
+-	    yyerror(path);
++            /* yyerror(path); */
+ 	    return(FALSE);
+ 	}
+ 	if ((fp = open_sudoers(path, FALSE, &keepopen)) == NULL) {
diff --git a/sudo.spec b/sudo.spec
index aa6b460..f5efbd6 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.2p2
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -35,6 +35,8 @@ Patch6: sudo-1.7.2p1-audit.patch
 Patch7: sudo-1.7.2p2-loopsegv3.patch
 # audit related Makefile.in and configure.in corrections
 Patch8: sudo-1.7.2p2-libaudit.patch
+# no valid sudoers sources found (#558875)
+Patch9: sudo-1.7.2p2-emptyincldir.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -57,6 +59,7 @@ on many different machines.
 %patch6 -p1 -b .audit
 %patch7 -p1 -b .loopsegv3
 %patch8 -p1 -b .libaudit
+%patch9 -p1 -b .emptyincldir
 
 %build
 # handle newer autoconf
@@ -147,6 +150,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Tue Feb 16 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-5
+- fixed no valid sudoers sources found (#558875)
+
 * Wed Feb 10 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-4
 - audit related Makefile.in and configure.in corrections
 - added --with-audit configure option

From cd64307f4c73e0bc23e2d6294d1ff585d4537a51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Mon, 1 Mar 2010 11:54:07 +0000
Subject: [PATCH 042/199] update to new upstream version

---
 sudo-1.7.2p4-getgrouplist.patch | 40 +++++++++++++++++++++++++++++++++
 sudo.spec                       | 19 +++++++---------
 2 files changed, 48 insertions(+), 11 deletions(-)
 create mode 100644 sudo-1.7.2p4-getgrouplist.patch

diff --git a/sudo-1.7.2p4-getgrouplist.patch b/sudo-1.7.2p4-getgrouplist.patch
new file mode 100644
index 0000000..454b35b
--- /dev/null
+++ b/sudo-1.7.2p4-getgrouplist.patch
@@ -0,0 +1,40 @@
+diff -up sudo-1.7.2p4/check.c.getgrouplist sudo-1.7.2p4/check.c
+--- sudo-1.7.2p4/check.c.getgrouplist	2009-05-25 14:02:41.000000000 +0200
++++ sudo-1.7.2p4/check.c	2010-03-01 11:27:38.000000000 +0100
+@@ -353,6 +353,24 @@ user_is_exempt()
+ 	    return(TRUE);
+     }
+ 
++#ifdef HAVE_GETGROUPLIST
++    {
++	gid_t *grouplist, grouptmp;
++	int n_groups, i;
++	n_groups = 1;
++	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
++	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
++	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
++		for (i = 0; i < n_groups; i++)
++		    if (grouplist[i] == grp->gr_gid) {
++			free(grouplist);
++			return(TRUE);
++		    }
++	    free(grouplist);
++	}
++    }
++#endif
++
+     return(FALSE);
+ }
+ 
+diff -up sudo-1.7.2p4/configure.in.getgrouplist sudo-1.7.2p4/configure.in
+--- sudo-1.7.2p4/configure.in.getgrouplist	2010-03-01 11:27:38.000000000 +0100
++++ sudo-1.7.2p4/configure.in	2010-03-01 11:29:45.000000000 +0100
+@@ -1852,7 +1852,7 @@ dnl
+ AC_FUNC_GETGROUPS
+ AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
+ 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
+-	       setlocale getaddrinfo setsid setenv setrlimit64)
++	       setlocale getaddrinfo setsid setenv setrlimit64 getgrouplist)
+ AC_CHECK_FUNCS(unsetenv, SUDO_FUNC_UNSETENV_VOID)
+ SUDO_FUNC_PUTENV_CONST
+ if test -z "$SKIP_SETRESUID"; then
diff --git a/sudo.spec b/sudo.spec
index f5efbd6..feefc97 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.7.2p2
-Release: 5%{?dist}
+Version: 1.7.2p5
+Release: 1%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -28,15 +28,11 @@ Patch2: sudo-1.7.2p1-login.patch
 Patch3: sudo-1.7.2p1-envdebug.patch
 Patch4: sudo-1.7.1-libtool.patch
 # getgrouplist() to determine group membership (#235915)
-Patch5: sudo-1.7.1-getgrouplist.patch
+Patch5: sudo-1.7.2p4-getgrouplist.patch
 # audit support improvement
 Patch6: sudo-1.7.2p1-audit.patch
-# segfault when #include directive is used in cycles (#561336)
-Patch7: sudo-1.7.2p2-loopsegv3.patch
 # audit related Makefile.in and configure.in corrections
-Patch8: sudo-1.7.2p2-libaudit.patch
-# no valid sudoers sources found (#558875)
-Patch9: sudo-1.7.2p2-emptyincldir.patch
+Patch7: sudo-1.7.2p2-libaudit.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -57,9 +53,7 @@ on many different machines.
 %patch4 -p1 -b .libtool
 %patch5 -p1 -b .getgrouplist
 %patch6 -p1 -b .audit
-%patch7 -p1 -b .loopsegv3
-%patch8 -p1 -b .libaudit
-%patch9 -p1 -b .emptyincldir
+%patch7 -p1 -b .libaudit
 
 %build
 # handle newer autoconf
@@ -150,6 +144,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Mon Mar  1 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p5-1
+- update to new upstream version
+
 * Tue Feb 16 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-5
 - fixed no valid sudoers sources found (#558875)
 

From d3f6d25f139f2151352c69b53a24da74216f9ccd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Mon, 1 Mar 2010 11:59:20 +0000
Subject: [PATCH 043/199] forgot to update sources...

---
 .cvsignore | 2 +-
 sources    | 2 +-
 sudo.spec  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.cvsignore b/.cvsignore
index 71023ee..a82ba2c 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
-sudo-1.7.2p2.tar.gz
+sudo-1.7.2p5.tar.gz
 sudo-1.7.2p2-sudoers
diff --git a/sources b/sources
index 4d64f5c..90e961f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-2a19cf1ab4afc94fe19d0d0899d4cd45  sudo-1.7.2p2.tar.gz
+398f584e831bd75b3c0179e28368c2a3  sudo-1.7.2p5.tar.gz
 d657d8d55ecdf88a2d11da73ac5662a4  sudo-1.7.2p2-sudoers
diff --git a/sudo.spec b/sudo.spec
index feefc97..7016fa3 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.2p5
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -144,7 +144,7 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
-* Mon Mar  1 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p5-1
+* Mon Mar  1 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p5-2
 - update to new upstream version
 
 * Tue Feb 16 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-5

From ac43db578335cd38151e1422585967101e1211aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Wed, 14 Apr 2010 13:49:58 +0000
Subject: [PATCH 044/199] - update to new upstream version - merged .audit and
 .libaudit patch - added sudoers.ldap.5* to files

---
 .cvsignore               |   2 +-
 sources                  |   2 +-
 sudo-1.7.2p6-audit.patch | 401 +++++++++++++++++++++++++++++++++++++++
 sudo.spec                |  15 +-
 4 files changed, 412 insertions(+), 8 deletions(-)
 create mode 100644 sudo-1.7.2p6-audit.patch

diff --git a/.cvsignore b/.cvsignore
index a82ba2c..79d1947 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
-sudo-1.7.2p5.tar.gz
+sudo-1.7.2p6.tar.gz
 sudo-1.7.2p2-sudoers
diff --git a/sources b/sources
index 90e961f..e8d3499 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-398f584e831bd75b3c0179e28368c2a3  sudo-1.7.2p5.tar.gz
+c4f1a43e8ba94f6bf06d2211442148c4  sudo-1.7.2p6.tar.gz
 d657d8d55ecdf88a2d11da73ac5662a4  sudo-1.7.2p2-sudoers
diff --git a/sudo-1.7.2p6-audit.patch b/sudo-1.7.2p6-audit.patch
new file mode 100644
index 0000000..75b9675
--- /dev/null
+++ b/sudo-1.7.2p6-audit.patch
@@ -0,0 +1,401 @@
+diff -up /dev/null sudo-1.7.2p6/audit_help.c
+--- /dev/null	2010-03-17 15:58:02.830002615 +0100
++++ sudo-1.7.2p6/audit_help.c	2010-04-14 15:25:49.000000000 +0200
+@@ -0,0 +1,136 @@
++/*
++ *  Audit helper functions used throughout sudo
++ *
++ *  Copyright (C) 2007, Red Hat, Inc.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
++ *    may be used to endorse or promote products derived from this software
++ *    without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ */
++
++#include <config.h>
++
++#ifdef WITH_AUDIT
++#include <stdlib.h>
++#include <syslog.h>
++#include <stdarg.h>
++#include <libaudit.h>
++#include <errno.h>
++#include <stdio.h>
++#include <string.h>
++#include <unistd.h>
++#include <sys/types.h>
++
++#ifdef HAVE_SELINUX
++#include <selinux/selinux.h>
++#endif
++
++int audit_fd = -1;
++
++void audit_help_open (void)
++{
++	audit_fd = audit_open ();
++	if (audit_fd < 0) {
++        	/* You get these only when the kernel doesn't have
++                 * audit compiled in. */
++		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
++		    errno == EAFNOSUPPORT)
++			return;
++		fprintf (stderr, "Cannot open audit interface - aborting.\n");
++		exit (1);
++	}
++}
++
++/*
++ * This function will log a message to the audit system using a predefined
++ * message format. Parameter usage is as follows:
++ *
++ * type - type of message: AUDIT_USER_CMD
++ * command - the command being logged
++ * params - parames of the command
++ * result - 1 is "success" and 0 is "failed"
++ *
++ */
++void audit_logger (int type, const char *command, const char *params, int result)
++{
++	int err;
++	char *msg;
++
++	if( audit_fd < 0 )
++		return;
++	else {
++
++		if( params ) 
++	                err = asprintf(&msg, "%s %s", command, params);
++		else 
++	                err = asprintf(&msg, "%s", command);
++                if (err < 0) {
++                        fprintf (stderr, "Memory allocation for audit message wasn’t possible.\n");
++                        return;
++                }
++		
++		err = audit_log_user_command (audit_fd, type, msg, NULL, result);
++               /* The kernel supports auditing and we had 
++                  enough privilege to write to the socket. */
++		if( err <= 0 && !((errno == EPERM && getuid() > 0) || errno == ECONNREFUSED ) ) {
++			perror("audit_log_user_command()");
++		}
++
++		free(msg);
++	}
++}
++
++#ifdef HAVE_SELINUX
++int send_audit_message(int success, security_context_t old_context,
++                       security_context_t new_context, const char *ttyn)
++{
++        char *msg = NULL;
++        int rc;
++
++        if (audit_fd < 0)
++                return -1;
++
++        if (asprintf(&msg, "newrole: old-context=%s new-context=%s",
++                     old_context ? old_context : "?",
++                     new_context ? new_context : "?") < 0) {
++                fprintf(stderr, "Error allocating memory.\n");
++                rc = -1;
++                goto out;
++        }
++
++        rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
++                                    msg, NULL, NULL, ttyn, success);
++
++        if (rc <= 0) {
++                fprintf(stderr, "Error sending audit message.\n");
++                rc = -1;
++                goto out;
++        }
++        rc = 0;
++
++        out:
++         free(msg);
++         return rc;
++}
++#endif
++#endif                         /* WITH_AUDIT */
+diff -up sudo-1.7.2p6/configure.in.audit sudo-1.7.2p6/configure.in
+--- sudo-1.7.2p6/configure.in.audit	2010-04-14 15:25:49.000000000 +0200
++++ sudo-1.7.2p6/configure.in	2010-04-14 15:25:49.000000000 +0200
+@@ -181,6 +181,10 @@ dnl
+ dnl Options for --with
+ dnl
+ 
++AC_ARG_WITH(audit,
++        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
++        [with_audit=$withval], [with_audit=yes])
++
+ AC_ARG_WITH(CC, [AS_HELP_STRING([--with-CC], [C compiler to use])],
+ [case $with_CC in
+     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
+@@ -1747,6 +1751,24 @@ dnl
+ : ${mansectsu='8'}
+ : ${mansectform='5'}
+ 
++
++if test "$with_audit" = "yes"; then
++	# See if we have the audit library
++        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
++        if test "$audit_header" = "yes"; then
++                AC_CHECK_LIB(audit, audit_log_user_command,
++                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
++                        LIBAUDIT="-laudit"])
++        fi
++	# See if we have the libcap library
++	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
++	if test "$cap_header" = "yes"; then
++		AC_CHECK_LIB(cap, cap_init,
++			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
++			SUDO_LIBS="${SUDO_LIBS} -lcap"])
++	fi
++fi
++AC_SUBST(LIBAUDIT)
+ dnl
+ dnl Add in any libpaths or libraries specified via configure
+ dnl
+diff -up sudo-1.7.2p6/Makefile.in.audit sudo-1.7.2p6/Makefile.in
+--- sudo-1.7.2p6/Makefile.in.audit	2010-04-14 15:25:49.000000000 +0200
++++ sudo-1.7.2p6/Makefile.in	2010-04-14 15:25:49.000000000 +0200
+@@ -44,7 +44,7 @@ INSTALL = $(SHELL) $(srcdir)/install-sh 
+ # Libraries
+ LIBS = @LIBS@
+ NET_LIBS = @NET_LIBS@
+-SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS)
++SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ @LIBAUDIT@ $(LIBS) $(NET_LIBS)
+ 
+ # C preprocessor flags
+ CPPFLAGS = -I. -I$(srcdir) @CPPFLAGS@
+@@ -123,6 +123,8 @@ HDRS = bsm_audit.h compat.h def_data.h d
+ 
+ AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
+ 
++AUDIT_OBJS = audit_help.o
++
+ # Note: gram.o must come first here
+ COMMON_OBJS = gram.o alias.o alloc.o defaults.o error.o list.o match.o \
+ 	      toke.o redblack.o zero_bytes.o @NONUNIX_GROUPS_IMPL@
+@@ -130,7 +132,7 @@ COMMON_OBJS = gram.o alias.o alloc.o def
+ SUDO_OBJS = $(COMMON_OBJS) $(AUTH_OBJS) @SUDO_OBJS@ audit.o check.o env.o \
+ 	    getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
+ 	    interfaces.o lbuf.o logging.o parse.o pwutil.o set_perms.o \
+-	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o
++	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o $(AUDIT_OBJS)
+ 
+ VISUDO_OBJS = $(COMMON_OBJS) visudo.o fileops.o gettime.o goodpath.o \
+ 	      find_path.o pwutil.o
+@@ -361,6 +363,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
+ sia.o: $(authdir)/sia.c $(AUTHDEP)
+ 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
+ 
++audit_help.o: audit_help.c sudo.h
++	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
++
+ sudo.man.in: $(srcdir)/sudo.pod
+ 	@rm -f $(srcdir)/$@
+ 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
+diff -up sudo-1.7.2p6/set_perms.c.audit sudo-1.7.2p6/set_perms.c
+--- sudo-1.7.2p6/set_perms.c.audit	2010-04-09 12:12:02.000000000 +0200
++++ sudo-1.7.2p6/set_perms.c	2010-04-14 15:25:49.000000000 +0200
+@@ -48,6 +48,10 @@
+ #ifdef HAVE_LOGIN_CAP_H
+ # include <login_cap.h>
+ #endif
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++# include <sys/prctl.h>
++# include <sys/capability.h>
++#endif
+ 
+ #include "sudo.h"
+ 
+@@ -126,16 +130,59 @@ set_perms(perm)
+ 			      	break;
+ 
+ 	case PERM_FULL_RUNAS:
+-				/* headed for exec(), assume euid == ROOT_UID */
+-				runas_setup();
+-				if (setresuid(def_stay_setuid ?
+-				    user_uid : runas_pw->pw_uid,
+-				    runas_pw->pw_uid, runas_pw->pw_uid)) {
+-				    errstr = "unable to change to runas uid";
+-				    goto bad;
+-				}
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++	                     { /* BEGIN CAP BLOCK */
++				  cap_t new_caps;
++				  cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
++				  
++				  if (runas_pw->pw_uid != ROOT_UID) {
++				       new_caps = cap_init ();
++				       if (!new_caps) {
++					    errstr = "Error initing capabilities, aborting.\n";
++					    goto bad;
++				       }
++				       
++				       if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
++					  cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
++					    errstr = "Error setting capabilities, aborting\n";
++					    goto bad;
++				       }
++				       
++				       if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
++					    errstr = "Error setting KEEPCAPS, aborting\n";
++					    goto bad;
++				       }
++				  }
++#endif
++				  /* headed for exec(), assume euid == ROOT_UID */
++				  runas_setup();
++				  if (setresuid(def_stay_setuid ?
++						user_uid : runas_pw->pw_uid,
++						runas_pw->pw_uid, runas_pw->pw_uid)) {
++				       errstr = "unable to change to runas uid";
++				       goto bad;
++				  }
++				  
++#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
++				  if (runas_pw->pw_uid != ROOT_UID) {
++				       if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0) {
++					    errstr = "Error resetting KEEPCAPS, aborting\n";
++					    goto bad;
++				       }
++				       
++				       if (cap_set_proc(new_caps)) {
++					    errstr = "Error dropping capabilities, aborting\n";
++					    goto bad;
++				       }
++				       
++				       if (cap_free (new_caps)) {
++					    errstr = "Error freeing caps\n";
++					    goto bad;
++				       }
++				  }
++                                } /* END CAP BLOCK */
++#endif
+ 				break;
+-
+ 	case PERM_SUDOERS:
+ 				/* assume euid == ROOT_UID, ruid == user */
+ 				if (setresgid(-1, SUDOERS_GID, -1))
+diff -up sudo-1.7.2p6/sudo.c.audit sudo-1.7.2p6/sudo.c
+--- sudo-1.7.2p6/sudo.c.audit	2010-04-14 15:25:49.000000000 +0200
++++ sudo-1.7.2p6/sudo.c	2010-04-14 15:31:47.000000000 +0200
+@@ -95,6 +95,10 @@
+ # include <selinux/selinux.h>
+ #endif
+ 
++#ifdef WITH_AUDIT
++#include <libaudit.h>
++#endif
++
+ #include <sudo_usage.h>
+ #include "sudo.h"
+ #include "lbuf.h"
+@@ -368,7 +372,7 @@ main(argc, argv, envp)
+ 
+     if (safe_cmnd == NULL)
+ 	safe_cmnd = estrdup(user_cmnd);
+-
++    
+ #ifdef HAVE_SETLOCALE
+     setlocale(LC_ALL, "");
+ #endif
+@@ -540,6 +544,20 @@ main(argc, argv, envp)
+ 
+ 	closefrom(def_closefrom);
+ 
++#if defined(WITH_AUDIT)
++        audit_help_open ();
++#endif
++        if (access(safe_cmnd, X_OK) != 0) {
++                warn ("unable to execute %s", safe_cmnd);
++#ifdef WITH_AUDIT
++ 		audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
++ 		exit(127);
++        }
++#ifdef WITH_AUDIT
++        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
++#endif
++        
+ #ifndef PROFILING
+ 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0) {
+ 	    syslog(LOG_AUTH|LOG_ERR, "fork");
+@@ -564,11 +582,17 @@ main(argc, argv, envp)
+ 	    NewArgv[1] = safe_cmnd;
+ 	    execv(_PATH_BSHELL, NewArgv);
+ 	}
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	warning("unable to execute %s", safe_cmnd);
+ 	exit(127);
+     } else if (ISSET(validated, FLAG_NO_USER | FLAG_NO_HOST)) {
+ 	audit_failure(NewArgv, "No user or host");
+ 	log_denial(validated, 1);
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     } else {
+ 	if (def_path_info) {
+@@ -590,6 +614,9 @@ main(argc, argv, envp)
+ 	    log_denial(validated, 1);
+ 	}
+ 	audit_failure(NewArgv, "validation failure");
++#ifdef WITH_AUDIT
++	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
++#endif
+ 	exit(1);
+     }
+     exit(0);	/* not reached */
+diff -up sudo-1.7.2p6/sudo.h.audit sudo-1.7.2p6/sudo.h
+--- sudo-1.7.2p6/sudo.h.audit	2010-04-14 15:25:49.000000000 +0200
++++ sudo-1.7.2p6/sudo.h	2010-04-14 15:25:49.000000000 +0200
+@@ -22,6 +22,8 @@
+ #ifndef _SUDO_SUDO_H
+ #define _SUDO_SUDO_H
+ 
++#include <config.h>
++
+ #include <pathnames.h>
+ #include <limits.h>
+ #include "compat.h"
+@@ -338,4 +340,14 @@ extern int sudo_mode;
+ extern int errno;
+ #endif
+ 
++#ifdef WITH_AUDIT
++extern int audit_fd;
++extern void audit_help_open (void);
++extern void audit_logger (int, const char *, const char *, int);
++#ifdef HAVE_SELINUX
++# include <selinux/selinux.h>
++extern int send_audit_message(int, security_context_t, security_context_t, const char *);
++#endif /* HAVE_SELINUX */
++#endif /* WITH_AUDIT */
++
+ #endif /* _SUDO_SUDO_H */
diff --git a/sudo.spec b/sudo.spec
index 7016fa3..4f6090f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.7.2p5
-Release: 2%{?dist}
+Version: 1.7.2p6
+Release: 1%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -30,9 +30,7 @@ Patch4: sudo-1.7.1-libtool.patch
 # getgrouplist() to determine group membership (#235915)
 Patch5: sudo-1.7.2p4-getgrouplist.patch
 # audit support improvement
-Patch6: sudo-1.7.2p1-audit.patch
-# audit related Makefile.in and configure.in corrections
-Patch7: sudo-1.7.2p2-libaudit.patch
+Patch6: sudo-1.7.2p6-audit.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -53,7 +51,6 @@ on many different machines.
 %patch4 -p1 -b .libtool
 %patch5 -p1 -b .getgrouplist
 %patch6 -p1 -b .audit
-%patch7 -p1 -b .libaudit
 
 %build
 # handle newer autoconf
@@ -135,6 +132,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0755,root,root) %{_libexecdir}/sesh
 %{_libexecdir}/sudo_noexec.*
 %{_mandir}/man5/sudoers.5*
+%{_mandir}/man5/sudoers.ldap.5*
 %{_mandir}/man8/sudo.8*
 %{_mandir}/man8/sudoedit.8*
 %{_mandir}/man8/visudo.8*
@@ -144,6 +142,11 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Apr 14 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-1
+- update to new upstream version
+- merged .audit and .libaudit patch
+- added sudoers.ldap.5* to files
+
 * Mon Mar  1 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p5-2
 - update to new upstream version
 

From 4933b8941dba8ad0d3e1c8f7a848f84446056f54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <mildew@fedoraproject.org>
Date: Wed, 2 Jun 2010 09:06:33 +0000
Subject: [PATCH 045/199] - added patch that fixes insufficient environment
 sanitization issue     (#598154)

---
 sudo-1.7.2p2-envsanitize.patch | 83 ++++++++++++++++++++++++++++++++++
 sudo.spec                      |  8 +++-
 2 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 sudo-1.7.2p2-envsanitize.patch

diff --git a/sudo-1.7.2p2-envsanitize.patch b/sudo-1.7.2p2-envsanitize.patch
new file mode 100644
index 0000000..37dc38c
--- /dev/null
+++ b/sudo-1.7.2p2-envsanitize.patch
@@ -0,0 +1,83 @@
+diff -up sudo-1.7.2p2/env.c.orig sudo-1.7.2p2/env.c
+--- sudo-1.7.2p2/env.c.orig	2010-06-01 13:19:54.000000000 +0200
++++ sudo-1.7.2p2/env.c	2010-06-01 13:26:22.000000000 +0200
+@@ -321,7 +321,7 @@ int
+ unsetenv(var)
+     const char *var;
+ {
+-    char **ep;
++    char **ep = env.envp;
+     size_t len;
+ 
+     if (strchr(var, '=') != NULL) {
+@@ -359,13 +359,15 @@ unsetenv(var)
+     }
+ 
+     len = strlen(var);
+-    for (ep = env.envp; *ep; ep++) {
++    while (*ep != NULL) {
+ 	if (strncmp(var, *ep, len) == 0 && (*ep)[len] == '=') {
+ 	    /* Found it; shift remainder + NULL over by one and update len. */
+ 	    memmove(ep, ep + 1,
+ 		(env.env_len - (ep - env.envp)) * sizeof(char *));
+ 	    env.env_len--;
+-	    break;
++	    /* Keep going, could be multiple instances of the var. */
++	} else {
++	    ep++;
+ 	}
+     }
+ #ifndef UNSETENV_VOID
+@@ -433,6 +435,7 @@ sudo_putenv(str, dupcheck, overwrite)
+ {
+     char **ep;
+     size_t len;
++    int found = FALSE;
+ 
+     /* Make sure there is room for the new entry plus a NULL. */
+     if (env.env_len + 2 > env.env_size) {
+@@ -451,20 +454,34 @@ sudo_putenv(str, dupcheck, overwrite)
+ #endif
+ 
+     if (dupcheck) {
+-	    len = (strchr(str, '=') - str) + 1;
+-	    for (ep = env.envp; *ep; ep++) {
++	len = (strchr(str, '=') - str) + 1;
++	for (ep = env.envp; !found && *ep != NULL; ep++) {
++	    if (strncmp(str, *ep, len) == 0) {
++		if (overwrite)
++		    *ep = str;
++		found = TRUE;
++	    }
++	}
++	/* Prune out duplicate variables. */
++	if (found && overwrite) {
++	    while (*ep != NULL) {
+ 		if (strncmp(str, *ep, len) == 0) {
+-		    if (overwrite)
+-			*ep = str;
+-		    return;
++		    memmove(ep, ep + 1,
++			(env.env_len - (ep - env.envp)) * sizeof(char *));
++		    env.env_len--;
++		} else {
++		    ep++;
+ 		}
+ 	    }
+-    } else
+-	ep = env.envp + env.env_len;
++	}
++    }
+ 
+-    env.env_len++;
+-    *ep++ = str;
+-    *ep = NULL;
++    if (!found) {
++	ep = env.envp + env.env_len;
++	env.env_len++;
++	*ep++ = str;
++	*ep = NULL;
++    }
+ }
+ 
+ /*
diff --git a/sudo.spec b/sudo.spec
index 4f6090f..c234515 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.2p6
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: BSD
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -31,6 +31,8 @@ Patch4: sudo-1.7.1-libtool.patch
 Patch5: sudo-1.7.2p4-getgrouplist.patch
 # audit support improvement
 Patch6: sudo-1.7.2p6-audit.patch
+# insufficient environment sanitization issue (#598154)
+Patch7: sudo-1.7.2p2-envsanitize.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -51,6 +53,7 @@ on many different machines.
 %patch4 -p1 -b .libtool
 %patch5 -p1 -b .getgrouplist
 %patch6 -p1 -b .audit
+%patch7 -p1 -b .envsanitize
 
 %build
 # handle newer autoconf
@@ -142,6 +145,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Jun  2 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-2
+- added patch that fixes insufficient environment sanitization issue (#598154)
+
 * Wed Apr 14 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-1
 - update to new upstream version
 - merged .audit and .libaudit patch

From c9cd6fce711b02ce6f602b737e870ea5d8cf287f Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <rel-eng@lists.fedoraproject.org>
Date: Thu, 29 Jul 2010 13:19:36 +0000
Subject: [PATCH 046/199] dist-git conversion

---
 .cvsignore => .gitignore |  0
 Makefile                 | 21 ---------------------
 2 files changed, 21 deletions(-)
 rename .cvsignore => .gitignore (100%)
 delete mode 100644 Makefile

diff --git a/.cvsignore b/.gitignore
similarity index 100%
rename from .cvsignore
rename to .gitignore
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 45ef6e6..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: sudo
-# $Id: Makefile,v 1.2 2007/10/15 19:24:45 notting Exp $
-NAME := sudo
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attempt a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

From 520e07da9c0f76146fcbc90b2c5b8954efb9d737 Mon Sep 17 00:00:00 2001
From: dnk <dnk@dhcp-29-221.brq.redhat.com>
Date: Tue, 7 Sep 2010 16:28:31 +0200
Subject: [PATCH 047/199] - update to new upstream version - new command
 available: sudoreplay - use native audit support - corrected license field
 value: BSD -> ISC

---
 .gitignore                      |  2 +
 sources                         |  2 +-
 sudo-1.7.4p3-m4path.patch       | 17 +++++++++
 sudo-1.7.4p3-sudolist.patch     | 67 +++++++++++++++++++++++++++++++++
 sudo-1.7.4p4-getgrouplist.patch | 39 +++++++++++++++++++
 sudo.spec                       | 45 ++++++++++++----------
 6 files changed, 151 insertions(+), 21 deletions(-)
 create mode 100644 sudo-1.7.4p3-m4path.patch
 create mode 100644 sudo-1.7.4p3-sudolist.patch
 create mode 100644 sudo-1.7.4p4-getgrouplist.patch

diff --git a/.gitignore b/.gitignore
index 79d1947..caa2d6c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 sudo-1.7.2p6.tar.gz
 sudo-1.7.2p2-sudoers
+/sudo-1.7.4p4.tar.gz
+/sudo-1.7.2p2-sudoers
diff --git a/sources b/sources
index e8d3499..e748005 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-c4f1a43e8ba94f6bf06d2211442148c4  sudo-1.7.2p6.tar.gz
+55d9906535d70a1de347cd3d3550ee87  sudo-1.7.4p4.tar.gz
 d657d8d55ecdf88a2d11da73ac5662a4  sudo-1.7.2p2-sudoers
diff --git a/sudo-1.7.4p3-m4path.patch b/sudo-1.7.4p3-m4path.patch
new file mode 100644
index 0000000..b1f8e1b
--- /dev/null
+++ b/sudo-1.7.4p3-m4path.patch
@@ -0,0 +1,17 @@
+diff -up sudo-1.7.4p3/aclocal.m4.m4path sudo-1.7.4p3/aclocal.m4
+--- sudo-1.7.4p3/aclocal.m4.m4path	2010-09-07 13:11:59.095198365 +0200
++++ sudo-1.7.4p3/aclocal.m4	2010-09-07 13:12:25.718209211 +0200
+@@ -368,8 +368,8 @@ EOF
+ dnl
+ dnl Pull in libtool macros
+ dnl
+-m4_include([libtool.m4])
+-m4_include([ltoptions.m4])
+-m4_include([ltsugar.m4])
+-m4_include([ltversion.m4])
+-m4_include([lt~obsolete.m4])
++m4_include([m4/libtool.m4])
++m4_include([m4/ltoptions.m4])
++m4_include([m4/ltsugar.m4])
++m4_include([m4/ltversion.m4])
++m4_include([m4/lt~obsolete.m4])
diff --git a/sudo-1.7.4p3-sudolist.patch b/sudo-1.7.4p3-sudolist.patch
new file mode 100644
index 0000000..e75b445
--- /dev/null
+++ b/sudo-1.7.4p3-sudolist.patch
@@ -0,0 +1,67 @@
+diff -up sudo-1.7.4p3/parse.c.orig sudo-1.7.4p3/parse.c
+--- sudo-1.7.4p3/parse.c.orig	2010-09-07 15:00:12.728260953 +0200
++++ sudo-1.7.4p3/parse.c	2010-09-07 15:00:38.950188803 +0200
+@@ -158,8 +158,8 @@ sudo_file_lookup(nss, validated, pwflag)
+ 
+     /*
+      * Only check the actual command if pwflag is not set.
+-     * It is set for the "validate", "list" and "kill" pseudo-commands.
+-     * Always check the host and user.
++     * It is set for the "sudovalidate", "sudolist" and "sudokill"
++     * pseudo-commands. Always check the host and user.
+      */
+     if (pwflag) {
+ 	int nopass;
+diff -up sudo-1.7.4p3/sudo.c.orig sudo-1.7.4p3/sudo.c
+--- sudo-1.7.4p3/sudo.c.orig	2010-09-07 14:57:08.201198517 +0200
++++ sudo-1.7.4p3/sudo.c	2010-09-07 14:55:47.208260545 +0200
+@@ -232,7 +232,7 @@ main(argc, argv, envp)
+ 
+     pwflag = 0;
+     if (ISSET(sudo_mode, MODE_SHELL))
+-	user_cmnd = "shell";
++	user_cmnd = "sudoshell";
+     else if (ISSET(sudo_mode, MODE_EDIT))
+ 	user_cmnd = "sudoedit";
+     else {
+@@ -245,12 +245,12 @@ main(argc, argv, envp)
+ 		break;
+ 	    case MODE_VALIDATE:
+ 	    case MODE_VALIDATE|MODE_INVALIDATE:
+-		user_cmnd = "validate";
++		user_cmnd = "sudovalidate";
+ 		pwflag = I_VERIFYPW;
+ 		break;
+ 	    case MODE_KILL:
+ 	    case MODE_INVALIDATE:
+-		user_cmnd = "kill";
++		user_cmnd = "sudokill";
+ 		pwflag = -1;
+ 		break;
+ 	    case MODE_LISTDEFS:
+@@ -259,7 +259,7 @@ main(argc, argv, envp)
+ 		break;
+ 	    case MODE_LIST:
+ 	    case MODE_LIST|MODE_INVALIDATE:
+-		user_cmnd = "list";
++		user_cmnd = "sudolist";
+ 		pwflag = I_LISTPW;
+ 		break;
+ 	    case MODE_CHECK:
+@@ -701,13 +701,13 @@ init_vars(envp)
+ 	set_perms(PERM_ROOT);
+ 
+     /*
+-     * If we were given the '-e', '-i' or '-s' options we need to redo
++     * If we were given the '-e', '-i', '-l' or '-s' options we need to redo
+      * NewArgv and NewArgc.
+      */
+-    if (ISSET(sudo_mode, MODE_EDIT)) {
++    if (ISSET(sudo_mode, MODE_EDIT|MODE_LIST)) {
+ 	NewArgv--;
+ 	NewArgc++;
+-	NewArgv[0] = "sudoedit";
++	NewArgv[0] = user_cmnd;
+     } else if (ISSET(sudo_mode, MODE_SHELL)) {
+ 	char **av;
+ 
diff --git a/sudo-1.7.4p4-getgrouplist.patch b/sudo-1.7.4p4-getgrouplist.patch
new file mode 100644
index 0000000..dd584e7
--- /dev/null
+++ b/sudo-1.7.4p4-getgrouplist.patch
@@ -0,0 +1,39 @@
+diff -up sudo-1.7.4p4/configure.in.getgrouplist sudo-1.7.4p4/configure.in
+--- sudo-1.7.4p4/configure.in.getgrouplist	2010-09-07 15:53:38.400260828 +0200
++++ sudo-1.7.4p4/configure.in	2010-09-07 15:54:48.751188374 +0200
+@@ -1913,7 +1913,7 @@ AC_FUNC_GETGROUPS
+ AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
+ 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
+ 	       regcomp setlocale getaddrinfo setenv vhangup \
+-	       mbr_check_membership setrlimit64)
++	       mbr_check_membership setrlimit64 getgrouplist)
+ AC_CHECK_FUNCS(getline, [], [
+     AC_LIBOBJ(getline)
+     AC_CHECK_FUNCS(fgetln)
+diff -up sudo-1.7.4p4/pwutil.c.getgrouplist sudo-1.7.4p4/pwutil.c
+--- sudo-1.7.4p4/pwutil.c.getgrouplist	2010-09-07 15:53:26.816198477 +0200
++++ sudo-1.7.4p4/pwutil.c	2010-09-07 15:54:16.990188543 +0200
+@@ -628,5 +628,23 @@ user_in_group(pw, group)
+     }
+ #endif /* HAVE_MBR_CHECK_MEMBERSHIP */
+ 
++#ifdef HAVE_GETGROUPLIST
++    {
++	gid_t *grouplist, grouptmp;
++	int n_groups, i;
++	n_groups = 1;
++	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
++	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
++	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
++		for (i = 0; i < n_groups; i++)
++		    if (grouplist[i] == grp->gr_gid) {
++			free(grouplist);
++			return(TRUE);
++		    }
++	    free(grouplist);
++	}
++    }
++#endif /* HAVE_GETGROUPLIST */
++
+     return(FALSE);
+ }
diff --git a/sudo.spec b/sudo.spec
index c234515..abb7a27 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,8 +1,8 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.7.2p6
-Release: 2%{?dist}
-License: BSD
+Version: 1.7.4p4
+Release: 1%{?dist}
+License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
 Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
@@ -22,17 +22,14 @@ BuildRequires: sendmail
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
-# use specific PAM session for sudo -i (#198755)
-Patch2: sudo-1.7.2p1-login.patch
 # configure.in fix
-Patch3: sudo-1.7.2p1-envdebug.patch
-Patch4: sudo-1.7.1-libtool.patch
+Patch2: sudo-1.7.2p1-envdebug.patch
+# add m4/ to paths in aclocal.m4
+Patch3: sudo-1.7.4p3-m4path.patch
+# don't emalloc(0)
+Patch4: sudo-1.7.4p3-sudolist.patch
 # getgrouplist() to determine group membership (#235915)
-Patch5: sudo-1.7.2p4-getgrouplist.patch
-# audit support improvement
-Patch6: sudo-1.7.2p6-audit.patch
-# insufficient environment sanitization issue (#598154)
-Patch7: sudo-1.7.2p2-envsanitize.patch
+Patch5: sudo-1.7.4p4-getgrouplist.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -47,17 +44,16 @@ on many different machines.
 
 %prep
 %setup -q
+
 %patch1 -p1 -b .strip
-%patch2 -p1 -b .login
-%patch3 -p1 -b .envdebug
-%patch4 -p1 -b .libtool
+%patch2 -p1 -b .envdebug
+%patch3 -p1 -b .m4path
+%patch4 -p1 -b .sudolist
 %patch5 -p1 -b .getgrouplist
-%patch6 -p1 -b .audit
-%patch7 -p1 -b .envsanitize
 
 %build
 # handle newer autoconf
-rm acsite.m4
+rm -f acsite.m4
 mv aclocal.m4 acinclude.m4
 autoreconf -fv --install
 
@@ -73,6 +69,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --prefix=%{_prefix} \
         --sbindir=%{_sbindir} \
         --libdir=%{_libdir} \
+	--docdir=%{_datadir}/doc/%{name}-%{version} \
         --with-logging=syslog \
         --with-logfac=authpriv \
         --with-pam \
@@ -84,7 +81,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-ldap \
 	--with-selinux \
 	--with-passprompt="[sudo] password for %p: " \
-	--with-audit
+	--with-linux-audit
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -122,7 +119,7 @@ rm -rf $RPM_BUILD_ROOT
 
 %files
 %defattr(-,root,root)
-%doc ChangeLog WHATSNEW HISTORY LICENSE README* TROUBLESHOOTING UPGRADE
+%doc ChangeLog NEWS HISTORY LICENSE README* TROUBLESHOOTING UPGRADE
 %doc sudoers.ldap.pod schema.* sudoers2ldif sample.*
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %attr(0750,root,root) %dir /etc/sudoers.d/
@@ -131,6 +128,7 @@ rm -rf $RPM_BUILD_ROOT
 %dir /var/run/sudo
 %attr(4111,root,root) %{_bindir}/sudo
 %attr(4111,root,root) %{_bindir}/sudoedit
+%attr(0111,root,root) %{_bindir}/sudoreplay
 %attr(0755,root,root) %{_sbindir}/visudo
 %attr(0755,root,root) %{_libexecdir}/sesh
 %{_libexecdir}/sudo_noexec.*
@@ -138,6 +136,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man5/sudoers.ldap.5*
 %{_mandir}/man8/sudo.8*
 %{_mandir}/man8/sudoedit.8*
+%{_mandir}/man8/sudoreplay.8*
 %{_mandir}/man8/visudo.8*
 
 # Make sure permissions are ok even if we're updating
@@ -145,6 +144,12 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Tue Sep  7 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-1
+- update to new upstream version
+- new command available: sudoreplay
+- use native audit support
+- corrected license field value: BSD -> ISC
+
 * Wed Jun  2 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-2
 - added patch that fixes insufficient environment sanitization issue (#598154)
 

From e273750ee7729424a8da661f49e585f07872bf77 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 7 Sep 2010 16:49:47 +0200
Subject: [PATCH 048/199] - sudo now uses /var/db/sudo for timestamps

---
 sudo.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index abb7a27..431ce2d 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.4p4
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -125,7 +125,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0750,root,root) %dir /etc/sudoers.d/
 %config(noreplace) /etc/pam.d/sudo
 %config(noreplace) /etc/pam.d/sudo-i
-%dir /var/run/sudo
+%dir /var/db/sudo
 %attr(4111,root,root) %{_bindir}/sudo
 %attr(4111,root,root) %{_bindir}/sudoedit
 %attr(0111,root,root) %{_bindir}/sudoreplay
@@ -144,6 +144,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Tue Sep  7 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-2
+- sudo now uses /var/db/sudo for timestamps
+
 * Tue Sep  7 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-1
 - update to new upstream version
 - new command available: sudoreplay

From 574273529d222e07642266f15db19c10737b84e0 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 7 Sep 2010 17:19:29 +0200
Subject: [PATCH 049/199] Cleanup

---
 sudo-1.7.1-audit.patch          | 389 -------------------------------
 sudo-1.7.1-auditfix.patch       |  48 ----
 sudo-1.7.1-conffix.patch        |  12 -
 sudo-1.7.1-envdebug.patch       |  12 -
 sudo-1.7.1-getgrouplist.patch   |  40 ----
 sudo-1.7.1-libtool.patch        |  12 -
 sudo-1.7.1-login.patch          | 111 ---------
 sudo-1.7.2p1-audit.patch        | 400 -------------------------------
 sudo-1.7.2p1-login.patch        | 111 ---------
 sudo-1.7.2p2-emptyincldir.patch |  38 ---
 sudo-1.7.2p2-envsanitize.patch  |  83 -------
 sudo-1.7.2p2-libaudit.patch     |  32 ---
 sudo-1.7.2p2-loopsegv3.patch    |  33 ---
 sudo-1.7.2p4-getgrouplist.patch |  40 ----
 sudo-1.7.2p6-audit.patch        | 401 --------------------------------
 15 files changed, 1762 deletions(-)
 delete mode 100644 sudo-1.7.1-audit.patch
 delete mode 100644 sudo-1.7.1-auditfix.patch
 delete mode 100644 sudo-1.7.1-conffix.patch
 delete mode 100644 sudo-1.7.1-envdebug.patch
 delete mode 100644 sudo-1.7.1-getgrouplist.patch
 delete mode 100644 sudo-1.7.1-libtool.patch
 delete mode 100644 sudo-1.7.1-login.patch
 delete mode 100644 sudo-1.7.2p1-audit.patch
 delete mode 100644 sudo-1.7.2p1-login.patch
 delete mode 100644 sudo-1.7.2p2-emptyincldir.patch
 delete mode 100644 sudo-1.7.2p2-envsanitize.patch
 delete mode 100644 sudo-1.7.2p2-libaudit.patch
 delete mode 100644 sudo-1.7.2p2-loopsegv3.patch
 delete mode 100644 sudo-1.7.2p4-getgrouplist.patch
 delete mode 100644 sudo-1.7.2p6-audit.patch

diff --git a/sudo-1.7.1-audit.patch b/sudo-1.7.1-audit.patch
deleted file mode 100644
index 65bb51c..0000000
--- a/sudo-1.7.1-audit.patch
+++ /dev/null
@@ -1,389 +0,0 @@
-diff -up /dev/null sudo-1.7.1/audit_help.c
---- /dev/null	2009-06-19 12:23:43.376002420 +0200
-+++ sudo-1.7.1/audit_help.c	2009-06-22 14:24:48.000000000 +0200
-@@ -0,0 +1,136 @@
-+/*
-+ *  Audit helper functions used throughout sudo
-+ *
-+ *  Copyright (C) 2007, Red Hat, Inc.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
-+ *    may be used to endorse or promote products derived from this software
-+ *    without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+
-+#include <config.h>
-+
-+#ifdef WITH_AUDIT
-+#include <stdlib.h>
-+#include <syslog.h>
-+#include <stdarg.h>
-+#include <libaudit.h>
-+#include <errno.h>
-+#include <stdio.h>
-+#include <string.h>
-+#include <unistd.h>
-+#include <sys/types.h>
-+
-+#ifdef HAVE_SELINUX
-+#include <selinux/selinux.h>
-+#endif
-+
-+int audit_fd;
-+
-+void audit_help_open (void)
-+{
-+	audit_fd = audit_open ();
-+	if (audit_fd < 0) {
-+        	/* You get these only when the kernel doesn't have
-+                 * audit compiled in. */
-+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
-+		    errno == EAFNOSUPPORT)
-+			return;
-+		fprintf (stderr, "Cannot open audit interface - aborting.\n");
-+		exit (1);
-+	}
-+}
-+
-+/*
-+ * This function will log a message to the audit system using a predefined
-+ * message format. Parameter usage is as follows:
-+ *
-+ * type - type of message: AUDIT_USER_CMD
-+ * command - the command being logged
-+ * params - parames of the command
-+ * result - 1 is "success" and 0 is "failed"
-+ *
-+ */
-+void audit_logger (int type, const char *command, const char *params, int result)
-+{
-+	int err;
-+	char *msg;
-+
-+	if( audit_fd < 0 )
-+		return;
-+	else {
-+
-+		if( params ) 
-+	                err = asprintf(&msg, "%s %s", command, params);
-+		else 
-+	                err = asprintf(&msg, "%s", command);
-+                if (err < 0) {
-+                        fprintf (stderr, "Memory allocation for audit message wasn’t possible.\n");
-+                        return;
-+                }
-+		
-+		err = audit_log_user_command (audit_fd, type, msg, NULL, result);
-+               /* The kernel supports auditing and we had 
-+                  enough privilege to write to the socket. */
-+		if( err <= 0 && !((errno == EPERM && getuid() > 0) || errno == ECONNREFUSED ) ) {
-+			perror("audit_log_user_command()");
-+		}
-+
-+		free(msg);
-+	}
-+}
-+
-+#ifdef HAVE_SELINUX
-+int send_audit_message(int success, security_context_t old_context,
-+                       security_context_t new_context, const char *ttyn)
-+{
-+        char *msg = NULL;
-+        int rc;
-+
-+        if (audit_fd < 0)
-+                return -1;
-+
-+        if (asprintf(&msg, "newrole: old-context=%s new-context=%s",
-+                     old_context ? old_context : "?",
-+                     new_context ? new_context : "?") < 0) {
-+                fprintf(stderr, "Error allocating memory.\n");
-+                rc = -1;
-+                goto out;
-+        }
-+
-+        rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
-+                                    msg, NULL, NULL, ttyn, success);
-+
-+        if (rc <= 0) {
-+                fprintf(stderr, "Error sending audit message.\n");
-+                rc = -1;
-+                goto out;
-+        }
-+        rc = 0;
-+
-+        out:
-+         free(msg);
-+         return rc;
-+}
-+#endif
-+#endif                         /* WITH_AUDIT */
-diff -up sudo-1.7.1/configure.in.audit sudo-1.7.1/configure.in
---- sudo-1.7.1/configure.in.audit	2009-06-22 14:24:48.000000000 +0200
-+++ sudo-1.7.1/configure.in	2009-06-22 14:26:42.000000000 +0200
-@@ -179,6 +179,10 @@ dnl
- dnl Options for --with
- dnl
- 
-+AC_ARG_WITH(audit,
-+        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
-+        [with_audit=$withval], [with_audit=yes])
-+
- AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
- [case $with_CC in
-     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
-@@ -1706,6 +1710,24 @@ dnl
- : ${mansectsu='8'}
- : ${mansectform='5'}
- 
-+AC_SUBST(LIBAUDIT)
-+if test "$with_audit" = "yes"; then
-+	# See if we have the audit library
-+        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
-+        if test "$audit_header" = "yes"; then
-+                AC_CHECK_LIB(audit, audit_log_user_command,
-+                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
-+                        LIBAUDIT="-laudit"])
-+        fi
-+	# See if we have the libcap library
-+	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
-+	if test "$cap_header" = "yes"; then
-+		AC_CHECK_LIB(cap, cap_init,
-+			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
-+			SUDO_LIBS="${SUDO_LIBS} -lcap"])
-+	fi
-+fi
-+
- dnl
- dnl Add in any libpaths or libraries specified via configure
- dnl
-diff -up sudo-1.7.1/Makefile.in.audit sudo-1.7.1/Makefile.in
---- sudo-1.7.1/Makefile.in.audit	2009-06-22 14:24:48.000000000 +0200
-+++ sudo-1.7.1/Makefile.in	2009-06-22 14:24:48.000000000 +0200
-@@ -125,6 +125,8 @@ HDRS = bsm_audit.h compat.h def_data.h d
- 
- AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
- 
-+AUDIT_OBJS = audit_help.o
-+
- # Note: gram.o must come first here
- COMMON_OBJS = gram.o alias.o alloc.o defaults.o error.o list.o match.o \
- 	      toke.o redblack.o zero_bytes.o
-@@ -132,7 +134,7 @@ COMMON_OBJS = gram.o alias.o alloc.o def
- SUDO_OBJS = $(COMMON_OBJS) $(AUTH_OBJS) @SUDO_OBJS@ audit.o check.o env.o \
- 	    getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
- 	    interfaces.o lbuf.o logging.o parse.o pwutil.o set_perms.o \
--	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o
-+	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o $(AUDIT_OBJS)
- 
- VISUDO_OBJS = $(COMMON_OBJS) visudo.o fileops.o gettime.o goodpath.o \
- 	      find_path.o pwutil.o
-@@ -361,6 +363,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
- sia.o: $(authdir)/sia.c $(AUTHDEP)
- 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
- 
-+audit_help.o: audit_help.c sudo.h
-+	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
-+
- sudo.man.in: $(srcdir)/sudo.pod
- 	@rm -f $(srcdir)/$@
- 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
-diff -up sudo-1.7.1/set_perms.c.audit sudo-1.7.1/set_perms.c
---- sudo-1.7.1/set_perms.c.audit	2008-03-06 18:19:56.000000000 +0100
-+++ sudo-1.7.1/set_perms.c	2009-06-22 14:24:48.000000000 +0200
-@@ -48,6 +48,10 @@
- #ifdef HAVE_LOGIN_CAP_H
- # include <login_cap.h>
- #endif
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+# include <sys/prctl.h>
-+# include <sys/capability.h>
-+#endif
- 
- #include "sudo.h"
- 
-@@ -126,16 +130,59 @@ set_perms(perm)
- 			      	break;
- 
- 	case PERM_FULL_RUNAS:
--				/* headed for exec(), assume euid == ROOT_UID */
--				runas_setup();
--				if (setresuid(def_stay_setuid ?
--				    user_uid : runas_pw->pw_uid,
--				    runas_pw->pw_uid, runas_pw->pw_uid)) {
--				    errstr = "unable to change to runas uid";
--				    goto bad;
--				}
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+	                     { /* BEGIN CAP BLOCK */
-+				  cap_t new_caps;
-+				  cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
-+				  
-+				  if (runas_pw->pw_uid != ROOT_UID) {
-+				       new_caps = cap_init ();
-+				       if (!new_caps) {
-+					    errstr = "Error initing capabilities, aborting.\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
-+					  cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
-+					    errstr = "Error setting capabilities, aborting\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
-+					    errstr = "Error setting KEEPCAPS, aborting\n";
-+					    goto bad;
-+				       }
-+				  }
-+#endif
-+				  /* headed for exec(), assume euid == ROOT_UID */
-+				  runas_setup();
-+				  if (setresuid(def_stay_setuid ?
-+						user_uid : runas_pw->pw_uid,
-+						runas_pw->pw_uid, runas_pw->pw_uid)) {
-+				       errstr = "unable to change to runas uid";
-+				       goto bad;
-+				  }
-+				  
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+				  if (runas_pw->pw_uid != ROOT_UID) {
-+				       if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0) {
-+					    errstr = "Error resetting KEEPCAPS, aborting\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if (cap_set_proc(new_caps)) {
-+					    errstr = "Error dropping capabilities, aborting\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if (cap_free (new_caps)) {
-+					    errstr = "Error freeing caps\n";
-+					    goto bad;
-+				       }
-+				  }
-+                                } /* END CAP BLOCK */
-+#endif
- 				break;
--
- 	case PERM_SUDOERS:
- 				/* assume euid == ROOT_UID, ruid == user */
- 				if (setresgid(-1, SUDOERS_GID, -1))
-diff -up sudo-1.7.1/sudo.c.audit sudo-1.7.1/sudo.c
---- sudo-1.7.1/sudo.c.audit	2009-06-22 14:24:48.000000000 +0200
-+++ sudo-1.7.1/sudo.c	2009-06-22 14:24:48.000000000 +0200
-@@ -95,6 +95,10 @@
- # include <selinux/selinux.h>
- #endif
- 
-+#ifdef WITH_AUDIT
-+#include <libaudit.h>
-+#endif
-+
- #include <sudo_usage.h>
- #include "sudo.h"
- #include "lbuf.h"
-@@ -360,6 +364,10 @@ main(argc, argv, envp)
-     if (safe_cmnd == NULL)
- 	safe_cmnd = estrdup(user_cmnd);
- 
-+#if defined(WITH_AUDIT)
-+    audit_help_open ();
-+#endif
-+    
- #ifdef HAVE_SETLOCALE
-     setlocale(LC_ALL, "");
- #endif
-@@ -521,7 +529,18 @@ main(argc, argv, envp)
- 	(void) sigaction(SIGINT, &saved_sa_int, NULL);
- 	(void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
- 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
--
-+	
-+        if (access(safe_cmnd, X_OK) != 0) {
-+		warn ("unable to execute %s", safe_cmnd);
-+#ifdef WITH_AUDIT
-+		audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
-+		exit(127);
-+        }
-+#ifdef WITH_AUDIT
-+        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
-+#endif
-+	
- 	/* Close the password and group files and free up memory. */
- 	sudo_endpwent();
- 	sudo_endgrent();
-@@ -554,11 +573,17 @@ main(argc, argv, envp)
- 	    NewArgv[1] = safe_cmnd;
- 	    execv(_PATH_BSHELL, NewArgv);
- 	}
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	warning("unable to execute %s", safe_cmnd);
- 	exit(127);
-     } else if (ISSET(validated, FLAG_NO_USER | FLAG_NO_HOST)) {
- 	audit_failure(NewArgv, "No user or host");
- 	log_denial(validated, 1);
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     } else {
- 	if (def_path_info) {
-@@ -580,6 +605,9 @@ main(argc, argv, envp)
- 	    log_denial(validated, 1);
- 	}
- 	audit_failure(NewArgv, "validation failure");
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     }
-     exit(0);	/* not reached */
-diff -up sudo-1.7.1/sudo.h.audit sudo-1.7.1/sudo.h
---- sudo-1.7.1/sudo.h.audit	2009-06-22 14:24:48.000000000 +0200
-+++ sudo-1.7.1/sudo.h	2009-06-22 14:24:48.000000000 +0200
-@@ -24,6 +24,8 @@
- #ifndef _SUDO_SUDO_H
- #define _SUDO_SUDO_H
- 
-+#include <config.h>
-+
- #include <pathnames.h>
- #include <limits.h>
- #include "compat.h"
-@@ -338,4 +340,10 @@ extern int sudo_mode;
- extern int errno;
- #endif
- 
-+#ifdef WITH_AUDIT
-+extern int audit_fd;
-+extern void audit_help_open (void);
-+extern void audit_logger (int, const char *, const char *, int);
-+#endif
-+
- #endif /* _SUDO_SUDO_H */
diff --git a/sudo-1.7.1-auditfix.patch b/sudo-1.7.1-auditfix.patch
deleted file mode 100644
index a1e8892..0000000
--- a/sudo-1.7.1-auditfix.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff -up sudo-1.7.1/audit_help.c.auditfix sudo-1.7.1/audit_help.c
---- sudo-1.7.1/audit_help.c.auditfix	2009-07-09 15:05:14.000000000 +0200
-+++ sudo-1.7.1/audit_help.c	2009-07-09 15:04:33.000000000 +0200
-@@ -45,7 +45,7 @@
- #include <selinux/selinux.h>
- #endif
- 
--int audit_fd;
-+int audit_fd = -1;
- 
- void audit_help_open (void)
- {
-diff -up sudo-1.7.1/sudo.c.auditfix sudo-1.7.1/sudo.c
---- sudo-1.7.1/sudo.c.auditfix	2009-07-09 14:35:50.000000000 +0200
-+++ sudo-1.7.1/sudo.c	2009-07-09 15:02:41.000000000 +0200
-@@ -363,10 +363,6 @@ main(argc, argv, envp)
-     }
-     if (safe_cmnd == NULL)
- 	safe_cmnd = estrdup(user_cmnd);
--
--#if defined(WITH_AUDIT)
--    audit_help_open ();
--#endif
-     
- #ifdef HAVE_SETLOCALE
-     setlocale(LC_ALL, "");
-@@ -529,7 +525,12 @@ main(argc, argv, envp)
- 	(void) sigaction(SIGINT, &saved_sa_int, NULL);
- 	(void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
- 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
-+
-+	closefrom(def_closefrom + 1);
- 	
-+#if defined(WITH_AUDIT)
-+        audit_help_open ();
-+#endif
-         if (access(safe_cmnd, X_OK) != 0) {
- 		warn ("unable to execute %s", safe_cmnd);
- #ifdef WITH_AUDIT
-@@ -545,8 +546,6 @@ main(argc, argv, envp)
- 	sudo_endpwent();
- 	sudo_endgrent();
- 
--	closefrom(def_closefrom + 1);
--
- #ifndef PROFILING
- 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0) {
- 	    syslog(LOG_AUTH|LOG_ERR, "fork");
diff --git a/sudo-1.7.1-conffix.patch b/sudo-1.7.1-conffix.patch
deleted file mode 100644
index 1d71d12..0000000
--- a/sudo-1.7.1-conffix.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up sudo-1.7.1/configure.in.conffix sudo-1.7.1/configure.in
---- sudo-1.7.1/configure.in.conffix	2009-06-22 15:45:51.000000000 +0200
-+++ sudo-1.7.1/configure.in	2009-06-22 15:45:30.000000000 +0200
-@@ -2473,7 +2473,7 @@ if test ${with_ldap-'no'} != "no"; then
-     AC_MSG_RESULT([yes])
-     AC_DEFINE(HAVE_LBER_H)])
- 
--    AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], [AC_CHECK_FUNCS(ldap_sasl_interactive_bind_s), [break]])
-+    AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], [AC_CHECK_FUNCS(ldap_sasl_interactive_bind_s)], [break])
-     AC_CHECK_HEADERS([ldap_ssl.h] [mps/ldap_ssl.h], [break], [], [#include <ldap.h>])
-     AC_CHECK_FUNCS(ldap_initialize ldap_start_tls_s ldapssl_init ldapssl_set_strength ldap_search_ext_s ldap_unbind_ext_s ldap_str2dn ldap_create ldap_sasl_bind_s ldap_ssl_client_init ldap_start_tls_s_np)
- 
diff --git a/sudo-1.7.1-envdebug.patch b/sudo-1.7.1-envdebug.patch
deleted file mode 100644
index 446ada1..0000000
--- a/sudo-1.7.1-envdebug.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up sudo-1.7.1/configure.in.envdebug sudo-1.7.1/configure.in
---- sudo-1.7.1/configure.in.envdebug	2009-05-02 21:25:56.000000000 +0200
-+++ sudo-1.7.1/configure.in	2009-05-02 21:27:17.000000000 +0200
-@@ -1192,7 +1192,7 @@ AC_ARG_ENABLE(env_debug,
- [  --enable-env-debug      Whether to enable environment debugging.],
- [ case "$enableval" in
-     yes)	AC_MSG_RESULT(yes)
--		AC_DEFINE(ENV_DEBUG)
-+		AC_DEFINE(ENV_DEBUG, [], [Environment debugging.])
- 		;;
-     no)		AC_MSG_RESULT(no)
- 		;;
diff --git a/sudo-1.7.1-getgrouplist.patch b/sudo-1.7.1-getgrouplist.patch
deleted file mode 100644
index 42cc3fc..0000000
--- a/sudo-1.7.1-getgrouplist.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff -up sudo-1.7.1/check.c.getgrouplist sudo-1.7.1/check.c
---- sudo-1.7.1/check.c.getgrouplist	2009-05-02 21:48:17.000000000 +0200
-+++ sudo-1.7.1/check.c	2009-05-02 21:49:04.000000000 +0200
-@@ -353,6 +353,24 @@ user_is_exempt()
- 	    return(TRUE);
-     }
- 
-+#ifdef HAVE_GETGROUPLIST
-+    {
-+	gid_t *grouplist, grouptmp;
-+	int n_groups, i;
-+	n_groups = 1;
-+	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
-+	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
-+	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
-+		for (i = 0; i < n_groups; i++)
-+		    if (grouplist[i] == grp->gr_gid) {
-+			free(grouplist);
-+			return(TRUE);
-+		    }
-+	    free(grouplist);
-+	}
-+    }
-+#endif
-+
-     return(FALSE);
- }
- 
-diff -up sudo-1.7.1/configure.in.getgrouplist sudo-1.7.1/configure.in
---- sudo-1.7.1/configure.in.getgrouplist	2009-05-02 21:48:13.000000000 +0200
-+++ sudo-1.7.1/configure.in	2009-05-02 21:50:05.000000000 +0200
-@@ -1809,7 +1809,7 @@ dnl
- AC_FUNC_GETGROUPS
- AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
- 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
--	       setlocale getaddrinfo setsid setenv)
-+	       setlocale getaddrinfo setsid setenv getgrouplist)
- AC_CHECK_FUNCS(unsetenv, SUDO_FUNC_UNSETENV_VOID)
- SUDO_FUNC_PUTENV_CONST
- if test -z "$SKIP_SETRESUID"; then
diff --git a/sudo-1.7.1-libtool.patch b/sudo-1.7.1-libtool.patch
deleted file mode 100644
index 4082953..0000000
--- a/sudo-1.7.1-libtool.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up sudo-1.7.1/Makefile.in.libtool sudo-1.7.1/Makefile.in
---- sudo-1.7.1/Makefile.in.libtool	2009-05-02 21:35:55.000000000 +0200
-+++ sudo-1.7.1/Makefile.in	2009-05-02 21:36:04.000000000 +0200
-@@ -198,7 +198,7 @@ sudo_noexec.lo: $(srcdir)/sudo_noexec.c
- 	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(srcdir)/sudo_noexec.c
- 
- sudo_noexec.la: sudo_noexec.lo
--	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -o $@ sudo_noexec.lo -avoid-version -rpath $(noexecdir)
-+	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -o $@ sudo_noexec.lo -module -avoid-version -rpath $(noexecdir)
- 
- # Uncomment the following if you want "make distclean" to clean the parser
- @DEV@GENERATED = gram.h gram.c toke.c def_data.c def_data.h
diff --git a/sudo-1.7.1-login.patch b/sudo-1.7.1-login.patch
deleted file mode 100644
index 03a6fd3..0000000
--- a/sudo-1.7.1-login.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-diff -up sudo-1.7.1/auth/pam.c.login sudo-1.7.1/auth/pam.c
---- sudo-1.7.1/auth/pam.c.login	2009-05-02 21:01:17.000000000 +0200
-+++ sudo-1.7.1/auth/pam.c	2009-05-02 21:07:42.000000000 +0200
-@@ -100,7 +100,13 @@ pam_init(pw, promptp, auth)
-     if (auth != NULL)
- 	auth->data = (void *) &pam_status;
-     pam_conv.conv = sudo_conv;
--    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
-+#ifdef HAVE_PAM_LOGIN
-+    if (ISSET(sudo_mode, MODE_LOGIN_SHELL))
-+	    pam_status = pam_start("sudo-i", pw->pw_name, &pam_conv, &pamh);
-+    else
-+#endif
-+	    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
-+
-     if (pam_status != PAM_SUCCESS) {
- 	log_error(USE_ERRNO|NO_EXIT|NO_MAIL, "unable to initialize PAM");
- 	return(AUTH_FATAL);
-diff -up sudo-1.7.1/configure.in.login sudo-1.7.1/configure.in
---- sudo-1.7.1/configure.in.login	2009-05-02 21:01:33.000000000 +0200
-+++ sudo-1.7.1/configure.in	2009-05-02 21:13:59.000000000 +0200
-@@ -393,6 +393,17 @@ AC_ARG_WITH(pam, [  --with-pam          
- 		;;
- esac])
- 
-+AC_ARG_WITH(pam-login, [  --with-pam-login              enable specific PAM session for sudo -i],
-+[case $with_pam_login in
-+    yes)	AC_DEFINE([HAVE_PAM_LOGIN], [], ["Define to 1 if you use specific PAM session for sodo -i."])	
-+		AC_MSG_CHECKING(whether to use PAM login)
-+		AC_MSG_RESULT(yes)
-+		;;
-+    no)		;;
-+    *)		AC_MSG_ERROR(["--with-pam-login does not take an argument."])
-+		;;
-+esac])
-+
- AC_ARG_WITH(AFS, [  --with-AFS              enable AFS support],
- [case $with_AFS in
-     yes)	AC_DEFINE(HAVE_AFS)
-diff -up sudo-1.7.1/env.c.login sudo-1.7.1/env.c
---- sudo-1.7.1/env.c.login	2009-05-02 21:01:24.000000000 +0200
-+++ sudo-1.7.1/env.c	2009-05-02 21:12:28.000000000 +0200
-@@ -101,7 +101,7 @@ struct environment {
- /*
-  * Prototypes
-  */
--void rebuild_env		__P((int, int));
-+void rebuild_env		__P((int));
- static void sudo_setenv		__P((const char *, const char *, int));
- static void sudo_putenv		__P((char *, int, int));
- 
-@@ -550,8 +550,7 @@ matches_env_keep(var)
-  * Also adds sudo-specific variables (SUDO_*).
-  */
- void
--rebuild_env(sudo_mode, noexec)
--    int sudo_mode;
-+rebuild_env(noexec)
-     int noexec;
- {
-     char **old_envp, **ep, *cp, *ps1;
-diff -up sudo-1.7.1/sudo.c.login sudo-1.7.1/sudo.c
---- sudo-1.7.1/sudo.c.login	2009-05-02 21:01:49.000000000 +0200
-+++ sudo-1.7.1/sudo.c	2009-05-02 21:18:18.000000000 +0200
-@@ -123,7 +123,7 @@ static void usage_excl			__P((int))
- 					    __attribute__((__noreturn__));
- static struct passwd *get_authpw	__P((void));
- extern int sudo_edit			__P((int, char **, char **));
--extern void rebuild_env			__P((int, int));
-+extern void rebuild_env			__P((int));
- void validate_env_vars			__P((struct list_member *));
- void insert_env_vars			__P((struct list_member *));
- 
-@@ -154,6 +154,8 @@ login_cap_t *lc;
- char *login_style;
- #endif /* HAVE_BSD_AUTH_H */
- sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp;
-+
-+int sudo_mode;
- static char *runas_user;
- static char *runas_group;
- static struct sudo_nss_list *snl;
-@@ -169,7 +171,7 @@ main(argc, argv, envp)
-     char **envp;
- {
-     int sources = 0, validated;
--    int fd, cmnd_status, sudo_mode, pwflag, rc = 0;
-+    int fd, cmnd_status, pwflag, rc = 0;
-     sigaction_t sa;
-     struct sudo_nss *nss;
- #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
-@@ -408,7 +410,7 @@ main(argc, argv, envp)
- 	def_env_reset = FALSE;
- 
-     /* Build a new environment that avoids any nasty bits. */
--    rebuild_env(sudo_mode, def_noexec);
-+    rebuild_env(def_noexec);
- 
-     /* Fill in passwd struct based on user we are authenticating as.  */
-     auth_pw = get_authpw();
-diff -up sudo-1.7.1/sudo.h.login sudo-1.7.1/sudo.h
---- sudo-1.7.1/sudo.h.login	2009-05-02 21:01:42.000000000 +0200
-+++ sudo-1.7.1/sudo.h	2009-05-02 21:14:58.000000000 +0200
-@@ -332,6 +332,7 @@ extern struct passwd *auth_pw, *list_pw;
- extern int tgetpass_flags;
- extern int long_list;
- extern uid_t timestamp_uid;
-+extern int sudo_mode;
- #endif
- #ifndef errno
- extern int errno;
diff --git a/sudo-1.7.2p1-audit.patch b/sudo-1.7.2p1-audit.patch
deleted file mode 100644
index 409aa5b..0000000
--- a/sudo-1.7.2p1-audit.patch
+++ /dev/null
@@ -1,400 +0,0 @@
-diff -up /dev/null sudo-1.7.2p1/audit_help.c
---- /dev/null	2009-09-09 14:57:12.384002457 +0200
-+++ sudo-1.7.2p1/audit_help.c	2009-10-30 12:25:49.000000000 +0100
-@@ -0,0 +1,136 @@
-+/*
-+ *  Audit helper functions used throughout sudo
-+ *
-+ *  Copyright (C) 2007, Red Hat, Inc.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
-+ *    may be used to endorse or promote products derived from this software
-+ *    without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+
-+#include <config.h>
-+
-+#ifdef WITH_AUDIT
-+#include <stdlib.h>
-+#include <syslog.h>
-+#include <stdarg.h>
-+#include <libaudit.h>
-+#include <errno.h>
-+#include <stdio.h>
-+#include <string.h>
-+#include <unistd.h>
-+#include <sys/types.h>
-+
-+#ifdef HAVE_SELINUX
-+#include <selinux/selinux.h>
-+#endif
-+
-+int audit_fd = -1;
-+
-+void audit_help_open (void)
-+{
-+	audit_fd = audit_open ();
-+	if (audit_fd < 0) {
-+        	/* You get these only when the kernel doesn't have
-+                 * audit compiled in. */
-+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
-+		    errno == EAFNOSUPPORT)
-+			return;
-+		fprintf (stderr, "Cannot open audit interface - aborting.\n");
-+		exit (1);
-+	}
-+}
-+
-+/*
-+ * This function will log a message to the audit system using a predefined
-+ * message format. Parameter usage is as follows:
-+ *
-+ * type - type of message: AUDIT_USER_CMD
-+ * command - the command being logged
-+ * params - parames of the command
-+ * result - 1 is "success" and 0 is "failed"
-+ *
-+ */
-+void audit_logger (int type, const char *command, const char *params, int result)
-+{
-+	int err;
-+	char *msg;
-+
-+	if( audit_fd < 0 )
-+		return;
-+	else {
-+
-+		if( params ) 
-+	                err = asprintf(&msg, "%s %s", command, params);
-+		else 
-+	                err = asprintf(&msg, "%s", command);
-+                if (err < 0) {
-+                        fprintf (stderr, "Memory allocation for audit message wasn’t possible.\n");
-+                        return;
-+                }
-+		
-+		err = audit_log_user_command (audit_fd, type, msg, NULL, result);
-+               /* The kernel supports auditing and we had 
-+                  enough privilege to write to the socket. */
-+		if( err <= 0 && !((errno == EPERM && getuid() > 0) || errno == ECONNREFUSED ) ) {
-+			perror("audit_log_user_command()");
-+		}
-+
-+		free(msg);
-+	}
-+}
-+
-+#ifdef HAVE_SELINUX
-+int send_audit_message(int success, security_context_t old_context,
-+                       security_context_t new_context, const char *ttyn)
-+{
-+        char *msg = NULL;
-+        int rc;
-+
-+        if (audit_fd < 0)
-+                return -1;
-+
-+        if (asprintf(&msg, "newrole: old-context=%s new-context=%s",
-+                     old_context ? old_context : "?",
-+                     new_context ? new_context : "?") < 0) {
-+                fprintf(stderr, "Error allocating memory.\n");
-+                rc = -1;
-+                goto out;
-+        }
-+
-+        rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
-+                                    msg, NULL, NULL, ttyn, success);
-+
-+        if (rc <= 0) {
-+                fprintf(stderr, "Error sending audit message.\n");
-+                rc = -1;
-+                goto out;
-+        }
-+        rc = 0;
-+
-+        out:
-+         free(msg);
-+         return rc;
-+}
-+#endif
-+#endif                         /* WITH_AUDIT */
-diff -up sudo-1.7.2p1/configure.in.audit sudo-1.7.2p1/configure.in
---- sudo-1.7.2p1/configure.in.audit	2009-10-30 12:25:49.000000000 +0100
-+++ sudo-1.7.2p1/configure.in	2009-10-30 12:25:49.000000000 +0100
-@@ -180,6 +180,10 @@ dnl
- dnl Options for --with
- dnl
- 
-+AC_ARG_WITH(audit,
-+        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
-+        [with_audit=$withval], [with_audit=yes])
-+
- AC_ARG_WITH(CC, [AS_HELP_STRING([--with-CC], [C compiler to use])],
- [case $with_CC in
-     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
-@@ -1743,6 +1747,24 @@ dnl
- : ${mansectsu='8'}
- : ${mansectform='5'}
- 
-+AC_SUBST(LIBAUDIT)
-+if test "$with_audit" = "yes"; then
-+	# See if we have the audit library
-+        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
-+        if test "$audit_header" = "yes"; then
-+                AC_CHECK_LIB(audit, audit_log_user_command,
-+                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
-+                        LIBAUDIT="-laudit"])
-+        fi
-+	# See if we have the libcap library
-+	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
-+	if test "$cap_header" = "yes"; then
-+		AC_CHECK_LIB(cap, cap_init,
-+			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
-+			SUDO_LIBS="${SUDO_LIBS} -lcap"])
-+	fi
-+fi
-+
- dnl
- dnl Add in any libpaths or libraries specified via configure
- dnl
-diff -up sudo-1.7.2p1/Makefile.in.audit sudo-1.7.2p1/Makefile.in
---- sudo-1.7.2p1/Makefile.in.audit	2009-10-30 12:25:49.000000000 +0100
-+++ sudo-1.7.2p1/Makefile.in	2009-10-30 12:25:49.000000000 +0100
-@@ -125,6 +125,8 @@ HDRS = bsm_audit.h compat.h def_data.h d
- 
- AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
- 
-+AUDIT_OBJS = audit_help.o
-+
- # Note: gram.o must come first here
- COMMON_OBJS = gram.o alias.o alloc.o defaults.o error.o list.o match.o \
- 	      toke.o redblack.o zero_bytes.o @NONUNIX_GROUPS_IMPL@
-@@ -132,7 +134,7 @@ COMMON_OBJS = gram.o alias.o alloc.o def
- SUDO_OBJS = $(COMMON_OBJS) $(AUTH_OBJS) @SUDO_OBJS@ audit.o check.o env.o \
- 	    getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
- 	    interfaces.o lbuf.o logging.o parse.o pwutil.o set_perms.o \
--	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o
-+	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o $(AUDIT_OBJS)
- 
- VISUDO_OBJS = $(COMMON_OBJS) visudo.o fileops.o gettime.o goodpath.o \
- 	      find_path.o pwutil.o
-@@ -363,6 +365,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
- sia.o: $(authdir)/sia.c $(AUTHDEP)
- 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
- 
-+audit_help.o: audit_help.c sudo.h
-+	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
-+
- sudo.man.in: $(srcdir)/sudo.pod
- 	@rm -f $(srcdir)/$@
- 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
-diff -up sudo-1.7.2p1/set_perms.c.audit sudo-1.7.2p1/set_perms.c
---- sudo-1.7.2p1/set_perms.c.audit	2009-06-25 14:44:33.000000000 +0200
-+++ sudo-1.7.2p1/set_perms.c	2009-10-30 12:32:03.000000000 +0100
-@@ -48,6 +48,10 @@
- #ifdef HAVE_LOGIN_CAP_H
- # include <login_cap.h>
- #endif
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+# include <sys/prctl.h>
-+# include <sys/capability.h>
-+#endif
- 
- #include "sudo.h"
- 
-@@ -130,16 +134,59 @@ set_perms(perm)
- 			      	break;
- 
- 	case PERM_FULL_RUNAS:
--				/* headed for exec(), assume euid == ROOT_UID */
--				runas_setup();
--				if (setresuid(def_stay_setuid ?
--				    user_uid : runas_pw->pw_uid,
--				    runas_pw->pw_uid, runas_pw->pw_uid)) {
--				    errstr = "unable to change to runas uid";
--				    goto bad;
--				}
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+	                     { /* BEGIN CAP BLOCK */
-+				  cap_t new_caps;
-+				  cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
-+				  
-+				  if (runas_pw->pw_uid != ROOT_UID) {
-+				       new_caps = cap_init ();
-+				       if (!new_caps) {
-+					    errstr = "Error initing capabilities, aborting.\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
-+					  cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
-+					    errstr = "Error setting capabilities, aborting\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
-+					    errstr = "Error setting KEEPCAPS, aborting\n";
-+					    goto bad;
-+				       }
-+				  }
-+#endif
-+				  /* headed for exec(), assume euid == ROOT_UID */
-+				  runas_setup();
-+				  if (setresuid(def_stay_setuid ?
-+						user_uid : runas_pw->pw_uid,
-+						runas_pw->pw_uid, runas_pw->pw_uid)) {
-+				       errstr = "unable to change to runas uid";
-+				       goto bad;
-+				  }
-+				  
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+				  if (runas_pw->pw_uid != ROOT_UID) {
-+				       if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0) {
-+					    errstr = "Error resetting KEEPCAPS, aborting\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if (cap_set_proc(new_caps)) {
-+					    errstr = "Error dropping capabilities, aborting\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if (cap_free (new_caps)) {
-+					    errstr = "Error freeing caps\n";
-+					    goto bad;
-+				       }
-+				  }
-+                                } /* END CAP BLOCK */
-+#endif
- 				break;
--
- 	case PERM_SUDOERS:
- 				/* assume euid == ROOT_UID, ruid == user */
- 				if (setresgid(-1, SUDOERS_GID, -1))
-diff -up sudo-1.7.2p1/sudo.c.audit sudo-1.7.2p1/sudo.c
---- sudo-1.7.2p1/sudo.c.audit	2009-10-30 12:25:49.000000000 +0100
-+++ sudo-1.7.2p1/sudo.c	2009-10-30 12:25:49.000000000 +0100
-@@ -95,6 +95,10 @@
- # include <selinux/selinux.h>
- #endif
- 
-+#ifdef WITH_AUDIT
-+#include <libaudit.h>
-+#endif
-+
- #include <sudo_usage.h>
- #include "sudo.h"
- #include "lbuf.h"
-@@ -372,7 +376,7 @@ main(argc, argv, envp)
- 
-     if (safe_cmnd == NULL)
- 	safe_cmnd = estrdup(user_cmnd);
--
-+    
- #ifdef HAVE_SETLOCALE
-     setlocale(LC_ALL, "");
- #endif
-@@ -538,12 +542,26 @@ main(argc, argv, envp)
- 	(void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
- 	(void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
- 
-+	closefrom(def_closefrom + 1);
-+	
-+#if defined(WITH_AUDIT)
-+        audit_help_open ();
-+#endif
-+        if (access(safe_cmnd, X_OK) != 0) {
-+		warn ("unable to execute %s", safe_cmnd);
-+#ifdef WITH_AUDIT
-+		audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
-+		exit(127);
-+        }
-+#ifdef WITH_AUDIT
-+        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
-+#endif
-+	
- 	/* Close the password and group files and free up memory. */
- 	sudo_endpwent();
- 	sudo_endgrent();
- 
--	closefrom(def_closefrom + 1);
--
- #ifndef PROFILING
- 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0) {
- 	    syslog(LOG_AUTH|LOG_ERR, "fork");
-@@ -568,11 +586,17 @@ main(argc, argv, envp)
- 	    NewArgv[1] = safe_cmnd;
- 	    execv(_PATH_BSHELL, NewArgv);
- 	}
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	warning("unable to execute %s", safe_cmnd);
- 	exit(127);
-     } else if (ISSET(validated, FLAG_NO_USER | FLAG_NO_HOST)) {
- 	audit_failure(NewArgv, "No user or host");
- 	log_denial(validated, 1);
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     } else {
- 	if (def_path_info) {
-@@ -594,6 +618,9 @@ main(argc, argv, envp)
- 	    log_denial(validated, 1);
- 	}
- 	audit_failure(NewArgv, "validation failure");
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     }
-     exit(0);	/* not reached */
-diff -up sudo-1.7.2p1/sudo.h.audit sudo-1.7.2p1/sudo.h
---- sudo-1.7.2p1/sudo.h.audit	2009-10-30 12:25:49.000000000 +0100
-+++ sudo-1.7.2p1/sudo.h	2009-10-30 12:39:16.000000000 +0100
-@@ -24,6 +24,8 @@
- #ifndef _SUDO_SUDO_H
- #define _SUDO_SUDO_H
- 
-+#include <config.h>
-+
- #include <pathnames.h>
- #include <limits.h>
- #include "compat.h"
-@@ -340,4 +342,14 @@ extern int sudo_mode;
- extern int errno;
- #endif
- 
-+#ifdef WITH_AUDIT
-+extern int audit_fd;
-+extern void audit_help_open (void);
-+extern void audit_logger (int, const char *, const char *, int);
-+#ifdef HAVE_SELINUX
-+# include <selinux/selinux.h>
-+extern int send_audit_message(int, security_context_t, security_context_t, const char *);
-+#endif /* HAVE_SELINUX */
-+#endif /* WITH_AUDIT */
-+
- #endif /* _SUDO_SUDO_H */
diff --git a/sudo-1.7.2p1-login.patch b/sudo-1.7.2p1-login.patch
deleted file mode 100644
index aeb0cf6..0000000
--- a/sudo-1.7.2p1-login.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-diff -up sudo-1.7.2p1/auth/pam.c.login sudo-1.7.2p1/auth/pam.c
---- sudo-1.7.2p1/auth/pam.c.login	2009-05-25 14:02:42.000000000 +0200
-+++ sudo-1.7.2p1/auth/pam.c	2009-10-30 12:15:48.000000000 +0100
-@@ -100,7 +100,13 @@ pam_init(pw, promptp, auth)
-     if (auth != NULL)
- 	auth->data = (void *) &pam_status;
-     pam_conv.conv = sudo_conv;
--    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
-+#ifdef HAVE_PAM_LOGIN
-+    if (ISSET(sudo_mode, MODE_LOGIN_SHELL))
-+	    pam_status = pam_start("sudo-i", pw->pw_name, &pam_conv, &pamh);
-+    else
-+#endif
-+	    pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
-+
-     if (pam_status != PAM_SUCCESS) {
- 	log_error(USE_ERRNO|NO_EXIT|NO_MAIL, "unable to initialize PAM");
- 	return(AUTH_FATAL);
-diff -up sudo-1.7.2p1/configure.in.login sudo-1.7.2p1/configure.in
---- sudo-1.7.2p1/configure.in.login	2009-07-20 15:34:37.000000000 +0200
-+++ sudo-1.7.2p1/configure.in	2009-10-30 12:16:24.000000000 +0100
-@@ -394,6 +394,17 @@ AC_ARG_WITH(pam, [AS_HELP_STRING([--with
- 		;;
- esac])
- 
-+AC_ARG_WITH(pam-login, [  --with-pam-login              enable specific PAM session for sudo -i],
-+[case $with_pam_login in
-+    yes)      AC_DEFINE([HAVE_PAM_LOGIN], [], ["Define to 1 if you use specific PAM session for sodo -i."])
-+              AC_MSG_CHECKING(whether to use PAM login)
-+              AC_MSG_RESULT(yes)
-+              ;;
-+    no)               ;;
-+    *)                AC_MSG_ERROR(["--with-pam-login does not take an argument."])
-+              ;;
-+esac])
-+
- AC_ARG_WITH(AFS, [AS_HELP_STRING([--with-AFS], [enable AFS support])],
- [case $with_AFS in
-     yes)	AC_DEFINE(HAVE_AFS)
-diff -up sudo-1.7.2p1/env.c.login sudo-1.7.2p1/env.c
---- sudo-1.7.2p1/env.c.login	2009-06-23 20:24:42.000000000 +0200
-+++ sudo-1.7.2p1/env.c	2009-10-30 12:15:48.000000000 +0100
-@@ -102,7 +102,7 @@ struct environment {
- /*
-  * Prototypes
-  */
--void rebuild_env		__P((int, int));
-+void rebuild_env		__P((int));
- static void sudo_setenv		__P((const char *, const char *, int));
- static void sudo_putenv		__P((char *, int, int));
- 
-@@ -562,8 +562,7 @@ matches_env_keep(var)
-  * Also adds sudo-specific variables (SUDO_*).
-  */
- void
--rebuild_env(sudo_mode, noexec)
--    int sudo_mode;
-+rebuild_env(noexec)
-     int noexec;
- {
-     char **old_envp, **ep, *cp, *ps1;
-diff -up sudo-1.7.2p1/sudo.c.login sudo-1.7.2p1/sudo.c
---- sudo-1.7.2p1/sudo.c.login	2009-05-27 02:49:07.000000000 +0200
-+++ sudo-1.7.2p1/sudo.c	2009-10-30 12:15:48.000000000 +0100
-@@ -126,7 +126,7 @@ static void usage_excl			__P((int))
- 					    __attribute__((__noreturn__));
- static struct passwd *get_authpw	__P((void));
- extern int sudo_edit			__P((int, char **, char **));
--extern void rebuild_env			__P((int, int));
-+extern void rebuild_env			__P((int));
- void validate_env_vars			__P((struct list_member *));
- void insert_env_vars			__P((struct list_member *));
- 
-@@ -157,6 +157,8 @@ login_cap_t *lc;
- char *login_style;
- #endif /* HAVE_BSD_AUTH_H */
- sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp;
-+
-+int sudo_mode;
- static char *runas_user;
- static char *runas_group;
- static struct sudo_nss_list *snl;
-@@ -172,7 +174,7 @@ main(argc, argv, envp)
-     char **envp;
- {
-     int sources = 0, validated;
--    int fd, cmnd_status, sudo_mode, pwflag, rc = 0;
-+    int fd, cmnd_status, pwflag, rc = 0;
-     sigaction_t sa;
-     struct sudo_nss *nss;
- #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
-@@ -421,7 +423,7 @@ main(argc, argv, envp)
- 	def_env_reset = FALSE;
- 
-     /* Build a new environment that avoids any nasty bits. */
--    rebuild_env(sudo_mode, def_noexec);
-+    rebuild_env(def_noexec);
- 
-     /* Fill in passwd struct based on user we are authenticating as.  */
-     auth_pw = get_authpw();
-diff -up sudo-1.7.2p1/sudo.h.login sudo-1.7.2p1/sudo.h
---- sudo-1.7.2p1/sudo.h.login	2009-05-25 14:02:41.000000000 +0200
-+++ sudo-1.7.2p1/sudo.h	2009-10-30 12:15:48.000000000 +0100
-@@ -334,6 +334,7 @@ extern struct passwd *auth_pw, *list_pw;
- extern int tgetpass_flags;
- extern int long_list;
- extern uid_t timestamp_uid;
-+extern int sudo_mode;
- #endif
- #ifndef errno
- extern int errno;
diff --git a/sudo-1.7.2p2-emptyincldir.patch b/sudo-1.7.2p2-emptyincldir.patch
deleted file mode 100644
index fbab43e..0000000
--- a/sudo-1.7.2p2-emptyincldir.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-diff -up sudo-1.7.2p2/toke.c.empty sudo-1.7.2p2/toke.c
---- sudo-1.7.2p2/toke.c.empty	2010-02-16 23:13:23.000000000 +0100
-+++ sudo-1.7.2p2/toke.c	2010-02-16 23:17:57.000000000 +0100
-@@ -1421,6 +1421,7 @@ __unused static const char rcsid[] = "$S
- #endif /* lint */
- 
- extern YYSTYPE yylval;
-+extern int parse_error;
- int sudolineno = 1;
- char *sudoers;
- static int sawspace = 0;
-@@ -1880,7 +1881,7 @@ YY_RULE_SETUP
- 			    LEXTRACE("INCLUDEDIR\n");
- 
- 			    /* Push current buffer and switch to include file */
--			    if (!push_includedir(path))
-+			    if (!push_includedir(path) && parse_error)
- 				yyterminate();
- 			}
- 	YY_BREAK
-@@ -3369,7 +3370,7 @@ switch_dir(stack, dirpath)
- 
-     if (!(dir = opendir(dirpath))) {
- 	yyerror(dirpath);
--	return(FALSE);
-+	return(NULL);
-     }
-     while ((dent = readdir(dir))) {
- 	/* Ignore files that end in '~' or have a '.' in them. */
-@@ -3494,7 +3495,7 @@ _push_include(path, isdir)
-     }
-     if (isdir) {
- 	if (!(path = switch_dir(&istack[idepth], path))) {
--	    yyerror(path);
-+            /* yyerror(path); */
- 	    return(FALSE);
- 	}
- 	if ((fp = open_sudoers(path, FALSE, &keepopen)) == NULL) {
diff --git a/sudo-1.7.2p2-envsanitize.patch b/sudo-1.7.2p2-envsanitize.patch
deleted file mode 100644
index 37dc38c..0000000
--- a/sudo-1.7.2p2-envsanitize.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-diff -up sudo-1.7.2p2/env.c.orig sudo-1.7.2p2/env.c
---- sudo-1.7.2p2/env.c.orig	2010-06-01 13:19:54.000000000 +0200
-+++ sudo-1.7.2p2/env.c	2010-06-01 13:26:22.000000000 +0200
-@@ -321,7 +321,7 @@ int
- unsetenv(var)
-     const char *var;
- {
--    char **ep;
-+    char **ep = env.envp;
-     size_t len;
- 
-     if (strchr(var, '=') != NULL) {
-@@ -359,13 +359,15 @@ unsetenv(var)
-     }
- 
-     len = strlen(var);
--    for (ep = env.envp; *ep; ep++) {
-+    while (*ep != NULL) {
- 	if (strncmp(var, *ep, len) == 0 && (*ep)[len] == '=') {
- 	    /* Found it; shift remainder + NULL over by one and update len. */
- 	    memmove(ep, ep + 1,
- 		(env.env_len - (ep - env.envp)) * sizeof(char *));
- 	    env.env_len--;
--	    break;
-+	    /* Keep going, could be multiple instances of the var. */
-+	} else {
-+	    ep++;
- 	}
-     }
- #ifndef UNSETENV_VOID
-@@ -433,6 +435,7 @@ sudo_putenv(str, dupcheck, overwrite)
- {
-     char **ep;
-     size_t len;
-+    int found = FALSE;
- 
-     /* Make sure there is room for the new entry plus a NULL. */
-     if (env.env_len + 2 > env.env_size) {
-@@ -451,20 +454,34 @@ sudo_putenv(str, dupcheck, overwrite)
- #endif
- 
-     if (dupcheck) {
--	    len = (strchr(str, '=') - str) + 1;
--	    for (ep = env.envp; *ep; ep++) {
-+	len = (strchr(str, '=') - str) + 1;
-+	for (ep = env.envp; !found && *ep != NULL; ep++) {
-+	    if (strncmp(str, *ep, len) == 0) {
-+		if (overwrite)
-+		    *ep = str;
-+		found = TRUE;
-+	    }
-+	}
-+	/* Prune out duplicate variables. */
-+	if (found && overwrite) {
-+	    while (*ep != NULL) {
- 		if (strncmp(str, *ep, len) == 0) {
--		    if (overwrite)
--			*ep = str;
--		    return;
-+		    memmove(ep, ep + 1,
-+			(env.env_len - (ep - env.envp)) * sizeof(char *));
-+		    env.env_len--;
-+		} else {
-+		    ep++;
- 		}
- 	    }
--    } else
--	ep = env.envp + env.env_len;
-+	}
-+    }
- 
--    env.env_len++;
--    *ep++ = str;
--    *ep = NULL;
-+    if (!found) {
-+	ep = env.envp + env.env_len;
-+	env.env_len++;
-+	*ep++ = str;
-+	*ep = NULL;
-+    }
- }
- 
- /*
diff --git a/sudo-1.7.2p2-libaudit.patch b/sudo-1.7.2p2-libaudit.patch
deleted file mode 100644
index 3f1af38..0000000
--- a/sudo-1.7.2p2-libaudit.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-diff -up sudo-1.7.2p2/configure.in.libaudit sudo-1.7.2p2/configure.in
---- sudo-1.7.2p2/configure.in.libaudit	2010-02-10 16:21:26.000000000 +0100
-+++ sudo-1.7.2p2/configure.in	2010-02-10 16:21:26.000000000 +0100
-@@ -1752,7 +1752,6 @@ dnl
- : ${mansectsu='8'}
- : ${mansectform='5'}
- 
--AC_SUBST(LIBAUDIT)
- if test "$with_audit" = "yes"; then
- 	# See if we have the audit library
-         AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
-@@ -1770,6 +1769,8 @@ if test "$with_audit" = "yes"; then
- 	fi
- fi
- 
-+AC_SUBST(LIBAUDIT)
-+
- dnl
- dnl Add in any libpaths or libraries specified via configure
- dnl
-diff -up sudo-1.7.2p2/Makefile.in.libaudit sudo-1.7.2p2/Makefile.in
---- sudo-1.7.2p2/Makefile.in.libaudit	2010-02-10 16:26:06.000000000 +0100
-+++ sudo-1.7.2p2/Makefile.in	2010-02-10 16:26:40.000000000 +0100
-@@ -44,7 +44,7 @@ INSTALL = $(SHELL) $(srcdir)/install-sh 
- # Libraries
- LIBS = @LIBS@
- NET_LIBS = @NET_LIBS@
--SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS)
-+SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ @LIBAUDIT@ $(LIBS) $(NET_LIBS)
- 
- # C preprocessor flags
- CPPFLAGS = -I. -I$(srcdir) @CPPFLAGS@
diff --git a/sudo-1.7.2p2-loopsegv3.patch b/sudo-1.7.2p2-loopsegv3.patch
deleted file mode 100644
index e6953bb..0000000
--- a/sudo-1.7.2p2-loopsegv3.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-diff -up sudo-1.7.2p2/toke.c.loop sudo-1.7.2p2/toke.c
---- sudo-1.7.2p2/toke.c.loop	2010-02-09 12:48:33.000000000 +0100
-+++ sudo-1.7.2p2/toke.c	2010-02-09 16:54:17.000000000 +0100
-@@ -3461,7 +3461,7 @@ init_lexer()
- 	    efree(pl);
- 	}
- 	efree(istack[idepth].path);
--	if (!istack[idepth].keepopen)
-+	if (idepth && !istack[idepth].keepopen)
- 	    fclose(istack[idepth].bs->yy_input_file);
- 	yy_delete_buffer(istack[idepth].bs);
-     }
-@@ -3486,7 +3486,7 @@ _push_include(path, isdir)
- 	}
- 	istacksize += SUDOERS_STACK_INCREMENT;
- 	istack = (struct include_stack *) realloc(istack,
--	    sizeof(istack) * istacksize);
-+	    sizeof(*istack) * istacksize);
- 	if (istack == NULL) {
- 	    yyerror("unable to allocate memory");
- 	    return(FALSE);
-diff -up sudo-1.7.2p2/toke.l.loop sudo-1.7.2p2/toke.l
---- sudo-1.7.2p2/toke.l.loop	2010-02-09 12:48:30.000000000 +0100
-+++ sudo-1.7.2p2/toke.l	2010-02-09 13:18:27.000000000 +0100
-@@ -869,7 +869,7 @@ _push_include(path, isdir)
- 	}
- 	istacksize += SUDOERS_STACK_INCREMENT;
- 	istack = (struct include_stack *) realloc(istack,
--	    sizeof(istack) * istacksize);
-+	    sizeof(*istack) * istacksize);
- 	if (istack == NULL) {
- 	    yyerror("unable to allocate memory");
- 	    return(FALSE);
diff --git a/sudo-1.7.2p4-getgrouplist.patch b/sudo-1.7.2p4-getgrouplist.patch
deleted file mode 100644
index 454b35b..0000000
--- a/sudo-1.7.2p4-getgrouplist.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff -up sudo-1.7.2p4/check.c.getgrouplist sudo-1.7.2p4/check.c
---- sudo-1.7.2p4/check.c.getgrouplist	2009-05-25 14:02:41.000000000 +0200
-+++ sudo-1.7.2p4/check.c	2010-03-01 11:27:38.000000000 +0100
-@@ -353,6 +353,24 @@ user_is_exempt()
- 	    return(TRUE);
-     }
- 
-+#ifdef HAVE_GETGROUPLIST
-+    {
-+	gid_t *grouplist, grouptmp;
-+	int n_groups, i;
-+	n_groups = 1;
-+	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
-+	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
-+	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
-+		for (i = 0; i < n_groups; i++)
-+		    if (grouplist[i] == grp->gr_gid) {
-+			free(grouplist);
-+			return(TRUE);
-+		    }
-+	    free(grouplist);
-+	}
-+    }
-+#endif
-+
-     return(FALSE);
- }
- 
-diff -up sudo-1.7.2p4/configure.in.getgrouplist sudo-1.7.2p4/configure.in
---- sudo-1.7.2p4/configure.in.getgrouplist	2010-03-01 11:27:38.000000000 +0100
-+++ sudo-1.7.2p4/configure.in	2010-03-01 11:29:45.000000000 +0100
-@@ -1852,7 +1852,7 @@ dnl
- AC_FUNC_GETGROUPS
- AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
- 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
--	       setlocale getaddrinfo setsid setenv setrlimit64)
-+	       setlocale getaddrinfo setsid setenv setrlimit64 getgrouplist)
- AC_CHECK_FUNCS(unsetenv, SUDO_FUNC_UNSETENV_VOID)
- SUDO_FUNC_PUTENV_CONST
- if test -z "$SKIP_SETRESUID"; then
diff --git a/sudo-1.7.2p6-audit.patch b/sudo-1.7.2p6-audit.patch
deleted file mode 100644
index 75b9675..0000000
--- a/sudo-1.7.2p6-audit.patch
+++ /dev/null
@@ -1,401 +0,0 @@
-diff -up /dev/null sudo-1.7.2p6/audit_help.c
---- /dev/null	2010-03-17 15:58:02.830002615 +0100
-+++ sudo-1.7.2p6/audit_help.c	2010-04-14 15:25:49.000000000 +0200
-@@ -0,0 +1,136 @@
-+/*
-+ *  Audit helper functions used throughout sudo
-+ *
-+ *  Copyright (C) 2007, Red Hat, Inc.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
-+ *    may be used to endorse or promote products derived from this software
-+ *    without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+
-+#include <config.h>
-+
-+#ifdef WITH_AUDIT
-+#include <stdlib.h>
-+#include <syslog.h>
-+#include <stdarg.h>
-+#include <libaudit.h>
-+#include <errno.h>
-+#include <stdio.h>
-+#include <string.h>
-+#include <unistd.h>
-+#include <sys/types.h>
-+
-+#ifdef HAVE_SELINUX
-+#include <selinux/selinux.h>
-+#endif
-+
-+int audit_fd = -1;
-+
-+void audit_help_open (void)
-+{
-+	audit_fd = audit_open ();
-+	if (audit_fd < 0) {
-+        	/* You get these only when the kernel doesn't have
-+                 * audit compiled in. */
-+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
-+		    errno == EAFNOSUPPORT)
-+			return;
-+		fprintf (stderr, "Cannot open audit interface - aborting.\n");
-+		exit (1);
-+	}
-+}
-+
-+/*
-+ * This function will log a message to the audit system using a predefined
-+ * message format. Parameter usage is as follows:
-+ *
-+ * type - type of message: AUDIT_USER_CMD
-+ * command - the command being logged
-+ * params - parames of the command
-+ * result - 1 is "success" and 0 is "failed"
-+ *
-+ */
-+void audit_logger (int type, const char *command, const char *params, int result)
-+{
-+	int err;
-+	char *msg;
-+
-+	if( audit_fd < 0 )
-+		return;
-+	else {
-+
-+		if( params ) 
-+	                err = asprintf(&msg, "%s %s", command, params);
-+		else 
-+	                err = asprintf(&msg, "%s", command);
-+                if (err < 0) {
-+                        fprintf (stderr, "Memory allocation for audit message wasn’t possible.\n");
-+                        return;
-+                }
-+		
-+		err = audit_log_user_command (audit_fd, type, msg, NULL, result);
-+               /* The kernel supports auditing and we had 
-+                  enough privilege to write to the socket. */
-+		if( err <= 0 && !((errno == EPERM && getuid() > 0) || errno == ECONNREFUSED ) ) {
-+			perror("audit_log_user_command()");
-+		}
-+
-+		free(msg);
-+	}
-+}
-+
-+#ifdef HAVE_SELINUX
-+int send_audit_message(int success, security_context_t old_context,
-+                       security_context_t new_context, const char *ttyn)
-+{
-+        char *msg = NULL;
-+        int rc;
-+
-+        if (audit_fd < 0)
-+                return -1;
-+
-+        if (asprintf(&msg, "newrole: old-context=%s new-context=%s",
-+                     old_context ? old_context : "?",
-+                     new_context ? new_context : "?") < 0) {
-+                fprintf(stderr, "Error allocating memory.\n");
-+                rc = -1;
-+                goto out;
-+        }
-+
-+        rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
-+                                    msg, NULL, NULL, ttyn, success);
-+
-+        if (rc <= 0) {
-+                fprintf(stderr, "Error sending audit message.\n");
-+                rc = -1;
-+                goto out;
-+        }
-+        rc = 0;
-+
-+        out:
-+         free(msg);
-+         return rc;
-+}
-+#endif
-+#endif                         /* WITH_AUDIT */
-diff -up sudo-1.7.2p6/configure.in.audit sudo-1.7.2p6/configure.in
---- sudo-1.7.2p6/configure.in.audit	2010-04-14 15:25:49.000000000 +0200
-+++ sudo-1.7.2p6/configure.in	2010-04-14 15:25:49.000000000 +0200
-@@ -181,6 +181,10 @@ dnl
- dnl Options for --with
- dnl
- 
-+AC_ARG_WITH(audit,
-+        [AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
-+        [with_audit=$withval], [with_audit=yes])
-+
- AC_ARG_WITH(CC, [AS_HELP_STRING([--with-CC], [C compiler to use])],
- [case $with_CC in
-     yes)	AC_MSG_ERROR(["must give --with-CC an argument."])
-@@ -1747,6 +1751,24 @@ dnl
- : ${mansectsu='8'}
- : ${mansectform='5'}
- 
-+
-+if test "$with_audit" = "yes"; then
-+	# See if we have the audit library
-+        AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
-+        if test "$audit_header" = "yes"; then
-+                AC_CHECK_LIB(audit, audit_log_user_command,
-+                        [AC_DEFINE(WITH_AUDIT, 1, [Define if you want to enable Audit messages])
-+                        LIBAUDIT="-laudit"])
-+        fi
-+	# See if we have the libcap library
-+	AC_CHECK_HEADERS(sys/capability.h sys/prctl.h, [cap_header="yes"], [cap_header="no"])
-+	if test "$cap_header" = "yes"; then
-+		AC_CHECK_LIB(cap, cap_init,
-+			[AC_DEFINE(HAVE_LIBCAP, 1, [SELinux libcap support])
-+			SUDO_LIBS="${SUDO_LIBS} -lcap"])
-+	fi
-+fi
-+AC_SUBST(LIBAUDIT)
- dnl
- dnl Add in any libpaths or libraries specified via configure
- dnl
-diff -up sudo-1.7.2p6/Makefile.in.audit sudo-1.7.2p6/Makefile.in
---- sudo-1.7.2p6/Makefile.in.audit	2010-04-14 15:25:49.000000000 +0200
-+++ sudo-1.7.2p6/Makefile.in	2010-04-14 15:25:49.000000000 +0200
-@@ -44,7 +44,7 @@ INSTALL = $(SHELL) $(srcdir)/install-sh 
- # Libraries
- LIBS = @LIBS@
- NET_LIBS = @NET_LIBS@
--SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS)
-+SUDO_LIBS = @SUDO_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ @LIBAUDIT@ $(LIBS) $(NET_LIBS)
- 
- # C preprocessor flags
- CPPFLAGS = -I. -I$(srcdir) @CPPFLAGS@
-@@ -123,6 +123,8 @@ HDRS = bsm_audit.h compat.h def_data.h d
- 
- AUTH_OBJS = sudo_auth.o @AUTH_OBJS@
- 
-+AUDIT_OBJS = audit_help.o
-+
- # Note: gram.o must come first here
- COMMON_OBJS = gram.o alias.o alloc.o defaults.o error.o list.o match.o \
- 	      toke.o redblack.o zero_bytes.o @NONUNIX_GROUPS_IMPL@
-@@ -130,7 +132,7 @@ COMMON_OBJS = gram.o alias.o alloc.o def
- SUDO_OBJS = $(COMMON_OBJS) $(AUTH_OBJS) @SUDO_OBJS@ audit.o check.o env.o \
- 	    getspwuid.o gettime.o goodpath.o fileops.o find_path.o \
- 	    interfaces.o lbuf.o logging.o parse.o pwutil.o set_perms.o \
--	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o
-+	    sudo.o sudo_edit.o sudo_nss.o term.o tgetpass.o $(AUDIT_OBJS)
- 
- VISUDO_OBJS = $(COMMON_OBJS) visudo.o fileops.o gettime.o goodpath.o \
- 	      find_path.o pwutil.o
-@@ -361,6 +363,9 @@ securid5.o: $(authdir)/securid5.c $(AUTH
- sia.o: $(authdir)/sia.c $(AUTHDEP)
- 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
- 
-+audit_help.o: audit_help.c sudo.h
-+	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(LIBADUIT) $(srcdir)/audit_help.c
-+
- sudo.man.in: $(srcdir)/sudo.pod
- 	@rm -f $(srcdir)/$@
- 	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
-diff -up sudo-1.7.2p6/set_perms.c.audit sudo-1.7.2p6/set_perms.c
---- sudo-1.7.2p6/set_perms.c.audit	2010-04-09 12:12:02.000000000 +0200
-+++ sudo-1.7.2p6/set_perms.c	2010-04-14 15:25:49.000000000 +0200
-@@ -48,6 +48,10 @@
- #ifdef HAVE_LOGIN_CAP_H
- # include <login_cap.h>
- #endif
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+# include <sys/prctl.h>
-+# include <sys/capability.h>
-+#endif
- 
- #include "sudo.h"
- 
-@@ -126,16 +130,59 @@ set_perms(perm)
- 			      	break;
- 
- 	case PERM_FULL_RUNAS:
--				/* headed for exec(), assume euid == ROOT_UID */
--				runas_setup();
--				if (setresuid(def_stay_setuid ?
--				    user_uid : runas_pw->pw_uid,
--				    runas_pw->pw_uid, runas_pw->pw_uid)) {
--				    errstr = "unable to change to runas uid";
--				    goto bad;
--				}
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+	                     { /* BEGIN CAP BLOCK */
-+				  cap_t new_caps;
-+				  cap_value_t cap_list[] = { CAP_AUDIT_WRITE };
-+				  
-+				  if (runas_pw->pw_uid != ROOT_UID) {
-+				       new_caps = cap_init ();
-+				       if (!new_caps) {
-+					    errstr = "Error initing capabilities, aborting.\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if(cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET) ||
-+					  cap_set_flag(new_caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET)) {
-+					    errstr = "Error setting capabilities, aborting\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
-+					    errstr = "Error setting KEEPCAPS, aborting\n";
-+					    goto bad;
-+				       }
-+				  }
-+#endif
-+				  /* headed for exec(), assume euid == ROOT_UID */
-+				  runas_setup();
-+				  if (setresuid(def_stay_setuid ?
-+						user_uid : runas_pw->pw_uid,
-+						runas_pw->pw_uid, runas_pw->pw_uid)) {
-+				       errstr = "unable to change to runas uid";
-+				       goto bad;
-+				  }
-+				  
-+#if defined(WITH_AUDIT) && defined(HAVE_LIBCAP)
-+				  if (runas_pw->pw_uid != ROOT_UID) {
-+				       if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0) {
-+					    errstr = "Error resetting KEEPCAPS, aborting\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if (cap_set_proc(new_caps)) {
-+					    errstr = "Error dropping capabilities, aborting\n";
-+					    goto bad;
-+				       }
-+				       
-+				       if (cap_free (new_caps)) {
-+					    errstr = "Error freeing caps\n";
-+					    goto bad;
-+				       }
-+				  }
-+                                } /* END CAP BLOCK */
-+#endif
- 				break;
--
- 	case PERM_SUDOERS:
- 				/* assume euid == ROOT_UID, ruid == user */
- 				if (setresgid(-1, SUDOERS_GID, -1))
-diff -up sudo-1.7.2p6/sudo.c.audit sudo-1.7.2p6/sudo.c
---- sudo-1.7.2p6/sudo.c.audit	2010-04-14 15:25:49.000000000 +0200
-+++ sudo-1.7.2p6/sudo.c	2010-04-14 15:31:47.000000000 +0200
-@@ -95,6 +95,10 @@
- # include <selinux/selinux.h>
- #endif
- 
-+#ifdef WITH_AUDIT
-+#include <libaudit.h>
-+#endif
-+
- #include <sudo_usage.h>
- #include "sudo.h"
- #include "lbuf.h"
-@@ -368,7 +372,7 @@ main(argc, argv, envp)
- 
-     if (safe_cmnd == NULL)
- 	safe_cmnd = estrdup(user_cmnd);
--
-+    
- #ifdef HAVE_SETLOCALE
-     setlocale(LC_ALL, "");
- #endif
-@@ -540,6 +544,20 @@ main(argc, argv, envp)
- 
- 	closefrom(def_closefrom);
- 
-+#if defined(WITH_AUDIT)
-+        audit_help_open ();
-+#endif
-+        if (access(safe_cmnd, X_OK) != 0) {
-+                warn ("unable to execute %s", safe_cmnd);
-+#ifdef WITH_AUDIT
-+ 		audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
-+ 		exit(127);
-+        }
-+#ifdef WITH_AUDIT
-+        audit_logger(AUDIT_USER_CMD, safe_cmnd, user_args, 1);
-+#endif
-+        
- #ifndef PROFILING
- 	if (ISSET(sudo_mode, MODE_BACKGROUND) && fork() > 0) {
- 	    syslog(LOG_AUTH|LOG_ERR, "fork");
-@@ -564,11 +582,17 @@ main(argc, argv, envp)
- 	    NewArgv[1] = safe_cmnd;
- 	    execv(_PATH_BSHELL, NewArgv);
- 	}
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	warning("unable to execute %s", safe_cmnd);
- 	exit(127);
-     } else if (ISSET(validated, FLAG_NO_USER | FLAG_NO_HOST)) {
- 	audit_failure(NewArgv, "No user or host");
- 	log_denial(validated, 1);
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     } else {
- 	if (def_path_info) {
-@@ -590,6 +614,9 @@ main(argc, argv, envp)
- 	    log_denial(validated, 1);
- 	}
- 	audit_failure(NewArgv, "validation failure");
-+#ifdef WITH_AUDIT
-+	audit_logger(AUDIT_USER_CMD,  safe_cmnd, user_args, 0);
-+#endif
- 	exit(1);
-     }
-     exit(0);	/* not reached */
-diff -up sudo-1.7.2p6/sudo.h.audit sudo-1.7.2p6/sudo.h
---- sudo-1.7.2p6/sudo.h.audit	2010-04-14 15:25:49.000000000 +0200
-+++ sudo-1.7.2p6/sudo.h	2010-04-14 15:25:49.000000000 +0200
-@@ -22,6 +22,8 @@
- #ifndef _SUDO_SUDO_H
- #define _SUDO_SUDO_H
- 
-+#include <config.h>
-+
- #include <pathnames.h>
- #include <limits.h>
- #include "compat.h"
-@@ -338,4 +340,14 @@ extern int sudo_mode;
- extern int errno;
- #endif
- 
-+#ifdef WITH_AUDIT
-+extern int audit_fd;
-+extern void audit_help_open (void);
-+extern void audit_logger (int, const char *, const char *, int);
-+#ifdef HAVE_SELINUX
-+# include <selinux/selinux.h>
-+extern int send_audit_message(int, security_context_t, security_context_t, const char *);
-+#endif /* HAVE_SELINUX */
-+#endif /* WITH_AUDIT */
-+
- #endif /* _SUDO_SUDO_H */

From 9714d256ce40f1cb43b7c49e7d622f1c27e48860 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Mon, 20 Sep 2010 08:38:07 +0200
Subject: [PATCH 050/199] - added patch for #635250 - /var/run/sudo ->
 /var/db/sudo in .spec

---
 sudo-1.7.4p4-sudoi.patch | 57 ++++++++++++++++++++++++++++++++++++++++
 sudo.spec                | 11 ++++++--
 2 files changed, 66 insertions(+), 2 deletions(-)
 create mode 100644 sudo-1.7.4p4-sudoi.patch

diff --git a/sudo-1.7.4p4-sudoi.patch b/sudo-1.7.4p4-sudoi.patch
new file mode 100644
index 0000000..52b8d85
--- /dev/null
+++ b/sudo-1.7.4p4-sudoi.patch
@@ -0,0 +1,57 @@
+--- env.c	Wed Aug 18 15:27:03 2010
++++ env.c	Tue Sep 14 11:41:50 2010
+@@ -608,10 +608,16 @@
+ #ifdef ENV_DEBUG
+     memset(env.envp, 0, env.env_size * sizeof(char *));
+ #endif
+-    if (def_env_reset || ISSET(sudo_mode, MODE_LOGIN_SHELL)) {
+-	/* Reset HOME based on target user unless keeping old value. */
+-	reset_home = TRUE;
+ 
++    /* Reset HOME based on target user if configured to. */
++    if (ISSET(sudo_mode, MODE_RUN)) {
++	if (def_always_set_home ||
++	    ISSET(sudo_mode, MODE_RESET_HOME | MODE_LOGIN_SHELL) || 
++	    (ISSET(sudo_mode, MODE_SHELL) && def_set_home))
++	    reset_home = TRUE;
++    }
++
++    if (def_env_reset || ISSET(sudo_mode, MODE_LOGIN_SHELL)) {
+ 	/* Pull in vars we want to keep from the old environment. */
+ 	for (ep = old_envp; *ep; ep++) {
+ 	    int keepit;
+@@ -696,6 +702,11 @@
+ 	    if (!ISSET(didvar, DID_USERNAME))
+ 		sudo_setenv("USERNAME", user_name, FALSE);
+ 	}
++
++	/* If we didn't keep HOME, reset it based on target user. */
++	if (!ISSET(didvar, KEPT_HOME))
++	    reset_home = TRUE;
++
+ 	/*
+ 	 * Set MAIL to target user in -i mode or if MAIL is not preserved
+ 	 * from user's environment.
+@@ -709,13 +720,6 @@
+ 	    sudo_putenv(cp, ISSET(didvar, DID_MAIL), TRUE);
+ 	}
+     } else {
+-	/* Reset HOME based on target user if configured to. */
+-	if (ISSET(sudo_mode, MODE_RUN)) {
+-	    if (def_always_set_home || ISSET(sudo_mode, MODE_RESET_HOME) || 
+-		(ISSET(sudo_mode, MODE_SHELL) && def_set_home))
+-		reset_home = TRUE;
+-	}
+-
+ 	/*
+ 	 * Copy environ entries as long as they don't match env_delete or
+ 	 * env_check.
+@@ -765,7 +769,7 @@
+     }
+ 
+     /* Set $HOME to target user if not preserving user's value. */
+-    if (reset_home && !ISSET(didvar, KEPT_HOME))
++    if (reset_home)
+ 	sudo_setenv("HOME", runas_pw->pw_dir, TRUE);
+ 
+     /* Provide default values for $TERM and $PATH if they are not set. */
diff --git a/sudo.spec b/sudo.spec
index 431ce2d..5419701 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.4p4
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -30,6 +30,8 @@ Patch3: sudo-1.7.4p3-m4path.patch
 Patch4: sudo-1.7.4p3-sudolist.patch
 # getgrouplist() to determine group membership (#235915)
 Patch5: sudo-1.7.4p4-getgrouplist.patch
+# reset HOME when using the `-i' option (#635250)
+Patch6: sudo-1.7.4p4-sudoi.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -50,6 +52,7 @@ on many different machines.
 %patch3 -p1 -b .m4path
 %patch4 -p1 -b .sudolist
 %patch5 -p1 -b .getgrouplist
+%patch6 -p0 -b .sudoi
 
 %build
 # handle newer autoconf
@@ -90,7 +93,7 @@ make
 rm -rf $RPM_BUILD_ROOT
 make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
 chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* 
-install -p -d -m 700 $RPM_BUILD_ROOT/var/run/sudo
+install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
 
@@ -144,6 +147,10 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Mon Sep 20 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-3
+- added patch for #635250
+- /var/run/sudo -> /var/db/sudo in .spec
+
 * Tue Sep  7 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-2
 - sudo now uses /var/db/sudo for timestamps
 

From ecddd163e2bc4108c09d6759577099cae76c7c24 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Wed, 29 Sep 2010 10:26:02 +0200
Subject: [PATCH 051/199] - added upstream patch to fix rhbz#638345

---
 sudo-1.7.4p4-auditconn.patch | 15 +++++++++++++++
 sudo.spec                    |  8 +++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 sudo-1.7.4p4-auditconn.patch

diff --git a/sudo-1.7.4p4-auditconn.patch b/sudo-1.7.4p4-auditconn.patch
new file mode 100644
index 0000000..c04b15f
--- /dev/null
+++ b/sudo-1.7.4p4-auditconn.patch
@@ -0,0 +1,15 @@
+diff -r 9a328aa25c53 -r a686884684ca linux_audit.c
+--- a/linux_audit.c	Fri Sep 17 12:13:17 2010 -0400
++++ b/linux_audit.c	Tue Sep 21 07:56:36 2010 -0400
+@@ -81,9 +81,9 @@
+     }
+     *--cp = '\0';
+ 
+-    /* Log command, ignoring EPERM on error. */
++    /* Log command, ignoring ECONNREFUSED on error. */
+     rc = audit_log_user_command(au_fd, AUDIT_USER_CMD, command, NULL, result);
+-    if (rc <= 0)
++    if (rc <= 0 && errno != ECONNREFUSED)
+ 	warning("unable to send audit message");
+ 
+     efree(command);
diff --git a/sudo.spec b/sudo.spec
index 5419701..8f6d88f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.4p4
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -32,6 +32,8 @@ Patch4: sudo-1.7.4p3-sudolist.patch
 Patch5: sudo-1.7.4p4-getgrouplist.patch
 # reset HOME when using the `-i' option (#635250)
 Patch6: sudo-1.7.4p4-sudoi.patch
+# Ignore ECONREFUSED from audit_log_user_command()
+Patch7: sudo-1.7.4p4-auditconn.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -53,6 +55,7 @@ on many different machines.
 %patch4 -p1 -b .sudolist
 %patch5 -p1 -b .getgrouplist
 %patch6 -p0 -b .sudoi
+%patch7 -p1 -b .auditconn
 
 %build
 # handle newer autoconf
@@ -147,6 +150,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Sep 29 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-4
+- added upstream patch to fix rhbz#638345
+
 * Mon Sep 20 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-3
 - added patch for #635250
 - /var/run/sudo -> /var/db/sudo in .spec

From d12db8125338e040c7b2e2acae1f8961ca19719c Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 30 Nov 2010 12:16:25 +0100
Subject: [PATCH 052/199] - anybody in the wheel group has now root access
 (using password) (rhbz#656873) - sync configuration paths with the nss_ldap
 package (rhbz#652687)

---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 10 ++++++++--
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index caa2d6c..807abc9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ sudo-1.7.2p6.tar.gz
 sudo-1.7.2p2-sudoers
 /sudo-1.7.4p4.tar.gz
 /sudo-1.7.2p2-sudoers
+/sudo-1.7.4p4-sudoers
diff --git a/sources b/sources
index e748005..96e1461 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 55d9906535d70a1de347cd3d3550ee87  sudo-1.7.4p4.tar.gz
-d657d8d55ecdf88a2d11da73ac5662a4  sudo-1.7.2p2-sudoers
+56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers
diff --git a/sudo.spec b/sudo.spec
index 8f6d88f..d090d90 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,12 +1,12 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.4p4
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
 Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
-Source1: sudo-1.7.2p2-sudoers
+Source1: sudo-1.7.4p4-sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth, vim-minimal
 
@@ -85,6 +85,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
         --with-ignore-dot \
         --with-tty-tickets \
         --with-ldap \
+	--with-ldap-conf-file="%{_sysconfdir}/nss_ldap.conf" \
+	--with-ldap-secret-file="%{_sysconfdir}/nss_ldap.secret" \
 	--with-selinux \
 	--with-passprompt="[sudo] password for %p: " \
 	--with-linux-audit
@@ -150,6 +152,10 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Tue Nov 30 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-5
+- anybody in the wheel group has now root access (using password) (rhbz#656873)
+- sync configuration paths with the nss_ldap package (rhbz#652687)
+
 * Wed Sep 29 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-4
 - added upstream patch to fix rhbz#638345
 

From 92c68ba9263438b270c0837fc112424d591dc782 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Mon, 17 Jan 2011 11:23:52 +0100
Subject: [PATCH 053/199] - rebase to 1.7.4p5 - fixed
 sudo-1.7.4p4-getgrouplist.patch - fixes CVE-2011-0008, CVE-2011-0010

---
 .gitignore                                    |  1 +
 sources                                       |  2 +-
 sudo-1.7.4p3-sudolist.patch                   | 67 -------------------
 sudo-1.7.4p4-auditconn.patch                  | 15 -----
 ...h => sudo-1.7.4p4-getgrouplist-fixed.patch | 13 ++--
 sudo.spec                                     | 26 +++----
 6 files changed, 23 insertions(+), 101 deletions(-)
 delete mode 100644 sudo-1.7.4p3-sudolist.patch
 delete mode 100644 sudo-1.7.4p4-auditconn.patch
 rename sudo-1.7.4p4-getgrouplist.patch => sudo-1.7.4p4-getgrouplist-fixed.patch (72%)

diff --git a/.gitignore b/.gitignore
index 807abc9..7770bdb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.7.4p4.tar.gz
 /sudo-1.7.2p2-sudoers
 /sudo-1.7.4p4-sudoers
+/sudo-1.7.4p5.tar.gz
diff --git a/sources b/sources
index 96e1461..c05bae3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-55d9906535d70a1de347cd3d3550ee87  sudo-1.7.4p4.tar.gz
+4c8105507363371dea89ceb7c92187dd  sudo-1.7.4p5.tar.gz
 56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers
diff --git a/sudo-1.7.4p3-sudolist.patch b/sudo-1.7.4p3-sudolist.patch
deleted file mode 100644
index e75b445..0000000
--- a/sudo-1.7.4p3-sudolist.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-diff -up sudo-1.7.4p3/parse.c.orig sudo-1.7.4p3/parse.c
---- sudo-1.7.4p3/parse.c.orig	2010-09-07 15:00:12.728260953 +0200
-+++ sudo-1.7.4p3/parse.c	2010-09-07 15:00:38.950188803 +0200
-@@ -158,8 +158,8 @@ sudo_file_lookup(nss, validated, pwflag)
- 
-     /*
-      * Only check the actual command if pwflag is not set.
--     * It is set for the "validate", "list" and "kill" pseudo-commands.
--     * Always check the host and user.
-+     * It is set for the "sudovalidate", "sudolist" and "sudokill"
-+     * pseudo-commands. Always check the host and user.
-      */
-     if (pwflag) {
- 	int nopass;
-diff -up sudo-1.7.4p3/sudo.c.orig sudo-1.7.4p3/sudo.c
---- sudo-1.7.4p3/sudo.c.orig	2010-09-07 14:57:08.201198517 +0200
-+++ sudo-1.7.4p3/sudo.c	2010-09-07 14:55:47.208260545 +0200
-@@ -232,7 +232,7 @@ main(argc, argv, envp)
- 
-     pwflag = 0;
-     if (ISSET(sudo_mode, MODE_SHELL))
--	user_cmnd = "shell";
-+	user_cmnd = "sudoshell";
-     else if (ISSET(sudo_mode, MODE_EDIT))
- 	user_cmnd = "sudoedit";
-     else {
-@@ -245,12 +245,12 @@ main(argc, argv, envp)
- 		break;
- 	    case MODE_VALIDATE:
- 	    case MODE_VALIDATE|MODE_INVALIDATE:
--		user_cmnd = "validate";
-+		user_cmnd = "sudovalidate";
- 		pwflag = I_VERIFYPW;
- 		break;
- 	    case MODE_KILL:
- 	    case MODE_INVALIDATE:
--		user_cmnd = "kill";
-+		user_cmnd = "sudokill";
- 		pwflag = -1;
- 		break;
- 	    case MODE_LISTDEFS:
-@@ -259,7 +259,7 @@ main(argc, argv, envp)
- 		break;
- 	    case MODE_LIST:
- 	    case MODE_LIST|MODE_INVALIDATE:
--		user_cmnd = "list";
-+		user_cmnd = "sudolist";
- 		pwflag = I_LISTPW;
- 		break;
- 	    case MODE_CHECK:
-@@ -701,13 +701,13 @@ init_vars(envp)
- 	set_perms(PERM_ROOT);
- 
-     /*
--     * If we were given the '-e', '-i' or '-s' options we need to redo
-+     * If we were given the '-e', '-i', '-l' or '-s' options we need to redo
-      * NewArgv and NewArgc.
-      */
--    if (ISSET(sudo_mode, MODE_EDIT)) {
-+    if (ISSET(sudo_mode, MODE_EDIT|MODE_LIST)) {
- 	NewArgv--;
- 	NewArgc++;
--	NewArgv[0] = "sudoedit";
-+	NewArgv[0] = user_cmnd;
-     } else if (ISSET(sudo_mode, MODE_SHELL)) {
- 	char **av;
- 
diff --git a/sudo-1.7.4p4-auditconn.patch b/sudo-1.7.4p4-auditconn.patch
deleted file mode 100644
index c04b15f..0000000
--- a/sudo-1.7.4p4-auditconn.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff -r 9a328aa25c53 -r a686884684ca linux_audit.c
---- a/linux_audit.c	Fri Sep 17 12:13:17 2010 -0400
-+++ b/linux_audit.c	Tue Sep 21 07:56:36 2010 -0400
-@@ -81,9 +81,9 @@
-     }
-     *--cp = '\0';
- 
--    /* Log command, ignoring EPERM on error. */
-+    /* Log command, ignoring ECONNREFUSED on error. */
-     rc = audit_log_user_command(au_fd, AUDIT_USER_CMD, command, NULL, result);
--    if (rc <= 0)
-+    if (rc <= 0 && errno != ECONNREFUSED)
- 	warning("unable to send audit message");
- 
-     efree(command);
diff --git a/sudo-1.7.4p4-getgrouplist.patch b/sudo-1.7.4p4-getgrouplist-fixed.patch
similarity index 72%
rename from sudo-1.7.4p4-getgrouplist.patch
rename to sudo-1.7.4p4-getgrouplist-fixed.patch
index dd584e7..7d4fa21 100644
--- a/sudo-1.7.4p4-getgrouplist.patch
+++ b/sudo-1.7.4p4-getgrouplist-fixed.patch
@@ -1,6 +1,6 @@
 diff -up sudo-1.7.4p4/configure.in.getgrouplist sudo-1.7.4p4/configure.in
---- sudo-1.7.4p4/configure.in.getgrouplist	2010-09-07 15:53:38.400260828 +0200
-+++ sudo-1.7.4p4/configure.in	2010-09-07 15:54:48.751188374 +0200
+--- sudo-1.7.4p4/configure.in.getgrouplist	2011-01-11 10:45:49.170262147 +0100
++++ sudo-1.7.4p4/configure.in	2011-01-11 10:45:49.176261407 +0100
 @@ -1913,7 +1913,7 @@ AC_FUNC_GETGROUPS
  AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
  	       strftime setrlimit initgroups getgroups fstat gettimeofday \
@@ -11,17 +11,20 @@ diff -up sudo-1.7.4p4/configure.in.getgrouplist sudo-1.7.4p4/configure.in
      AC_LIBOBJ(getline)
      AC_CHECK_FUNCS(fgetln)
 diff -up sudo-1.7.4p4/pwutil.c.getgrouplist sudo-1.7.4p4/pwutil.c
---- sudo-1.7.4p4/pwutil.c.getgrouplist	2010-09-07 15:53:26.816198477 +0200
-+++ sudo-1.7.4p4/pwutil.c	2010-09-07 15:54:16.990188543 +0200
-@@ -628,5 +628,23 @@ user_in_group(pw, group)
+--- sudo-1.7.4p4/pwutil.c.getgrouplist	2010-08-06 15:44:30.000000000 +0200
++++ sudo-1.7.4p4/pwutil.c	2011-01-11 11:42:16.771282451 +0100
+@@ -628,5 +628,26 @@ user_in_group(pw, group)
      }
  #endif /* HAVE_MBR_CHECK_MEMBERSHIP */
  
 +#ifdef HAVE_GETGROUPLIST
++    if (user_ngroups >= 0 &&
++	strcmp(pw->pw_name, list_pw ? list_pw->pw_name : user_name) == 0)
 +    {
 +	gid_t *grouplist, grouptmp;
 +	int n_groups, i;
 +	n_groups = 1;
++
 +	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
 +	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
 +	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
diff --git a/sudo.spec b/sudo.spec
index d090d90..06acb1f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.7.4p4
-Release: 5%{?dist}
+Version: 1.7.4p5
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -26,14 +26,11 @@ Patch1: sudo-1.6.7p5-strip.patch
 Patch2: sudo-1.7.2p1-envdebug.patch
 # add m4/ to paths in aclocal.m4
 Patch3: sudo-1.7.4p3-m4path.patch
-# don't emalloc(0)
-Patch4: sudo-1.7.4p3-sudolist.patch
 # getgrouplist() to determine group membership (#235915)
-Patch5: sudo-1.7.4p4-getgrouplist.patch
+# - version with CVE-2009-0034 fixed
+Patch4: sudo-1.7.4p4-getgrouplist-fixed.patch
 # reset HOME when using the `-i' option (#635250)
-Patch6: sudo-1.7.4p4-sudoi.patch
-# Ignore ECONREFUSED from audit_log_user_command()
-Patch7: sudo-1.7.4p4-auditconn.patch
+Patch5: sudo-1.7.4p4-sudoi.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -52,10 +49,8 @@ on many different machines.
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .envdebug
 %patch3 -p1 -b .m4path
-%patch4 -p1 -b .sudolist
-%patch5 -p1 -b .getgrouplist
-%patch6 -p0 -b .sudoi
-%patch7 -p1 -b .auditconn
+%patch4 -p1 -b .getgrouplist
+%patch5 -p0 -b .sudoi
 
 %build
 # handle newer autoconf
@@ -128,7 +123,7 @@ rm -rf $RPM_BUILD_ROOT
 %files
 %defattr(-,root,root)
 %doc ChangeLog NEWS HISTORY LICENSE README* TROUBLESHOOTING UPGRADE
-%doc sudoers.ldap.pod schema.* sudoers2ldif sample.*
+%doc schema.* sudoers2ldif sample.*
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %attr(0750,root,root) %dir /etc/sudoers.d/
 %config(noreplace) /etc/pam.d/sudo
@@ -152,6 +147,11 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Mon Jan 17 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-1
+- rebase to 1.7.4p5
+- fixed sudo-1.7.4p4-getgrouplist.patch
+- fixes CVE-2011-0008, CVE-2011-0010
+
 * Tue Nov 30 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-5
 - anybody in the wheel group has now root access (using password) (rhbz#656873)
 - sync configuration paths with the nss_ldap package (rhbz#652687)

From 142eb81e35dbae84119c2baff15b0333e571608f Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Mon, 17 Jan 2011 11:39:16 +0100
Subject: [PATCH 054/199] Corrected sudo.spec

---
 sudo.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 06acb1f..9878858 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -49,7 +49,7 @@ on many different machines.
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .envdebug
 %patch3 -p1 -b .m4path
-%patch4 -p1 -b .getgrouplist
+%patch4 -p1 -b .getgrouplist-fixed
 %patch5 -p0 -b .sudoi
 
 %build

From e5db21ffd8c19d779999a61bf2257378dab3edcb Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Mon, 17 Jan 2011 11:40:57 +0100
Subject: [PATCH 055/199] bump release number

---
 sudo.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 9878858..5f236d9 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.4p5
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -147,7 +147,7 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
-* Mon Jan 17 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-1
+* Mon Jan 17 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-2
 - rebase to 1.7.4p5
 - fixed sudo-1.7.4p4-getgrouplist.patch
 - fixes CVE-2011-0008, CVE-2011-0010

From ed2333e15c63dde10e4033d859558a81ef221843 Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Wed, 9 Feb 2011 10:29:16 -0600
Subject: [PATCH 056/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 5f236d9..070c5a1 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.4p5
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -147,6 +147,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.4p5-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
 * Mon Jan 17 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-2
 - rebase to 1.7.4p5
 - fixed sudo-1.7.4p4-getgrouplist.patch

From c973b40001ae3ce9ef4cd008a4ba795e9e814e47 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Fri, 3 Jun 2011 15:01:00 +0200
Subject: [PATCH 057/199] build with RELPRO

---
 sudo.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 070c5a1..cca9415 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.4p5
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -64,7 +64,7 @@ F_PIE=-fPIE
 F_PIE=-fpie
 %endif
 
-export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
+export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
 
 %configure \
         --prefix=%{_prefix} \
@@ -147,6 +147,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Fri Jun  3 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-4
+- build with RELPRO
+
 * Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.4p5-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
 

From 269d3c7dcea2138d59c17ad1d51e7338a9dd4a00 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 12 Jul 2011 13:20:39 +0200
Subject: [PATCH 058/199] rebase to 1.8.1p2 removed .sudoi patch fixed typo:
 RELPRO -> RELRO added -devel subpackage for the sudo_plugin.h header file use
 default ldap configuration files again

---
 .gitignore                            |  1 +
 sources                               |  2 +-
 sudo-1.7.4p4-getgrouplist-fixed.patch | 42 --------------------
 sudo-1.7.4p4-sudoi.patch              | 57 ---------------------------
 sudo-1.8.1p2-getgrouplist.patch       | 44 +++++++++++++++++++++
 sudo.spec                             | 46 ++++++++++++++-------
 6 files changed, 77 insertions(+), 115 deletions(-)
 delete mode 100644 sudo-1.7.4p4-getgrouplist-fixed.patch
 delete mode 100644 sudo-1.7.4p4-sudoi.patch
 create mode 100644 sudo-1.8.1p2-getgrouplist.patch

diff --git a/.gitignore b/.gitignore
index 7770bdb..352f8f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.7.2p2-sudoers
 /sudo-1.7.4p4-sudoers
 /sudo-1.7.4p5.tar.gz
+/sudo-1.8.1p2.tar.gz
diff --git a/sources b/sources
index c05bae3..a86ed7d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-4c8105507363371dea89ceb7c92187dd  sudo-1.7.4p5.tar.gz
+e8330f0e63b0ecb2e12b5c76922818cc  sudo-1.8.1p2.tar.gz
 56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers
diff --git a/sudo-1.7.4p4-getgrouplist-fixed.patch b/sudo-1.7.4p4-getgrouplist-fixed.patch
deleted file mode 100644
index 7d4fa21..0000000
--- a/sudo-1.7.4p4-getgrouplist-fixed.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-diff -up sudo-1.7.4p4/configure.in.getgrouplist sudo-1.7.4p4/configure.in
---- sudo-1.7.4p4/configure.in.getgrouplist	2011-01-11 10:45:49.170262147 +0100
-+++ sudo-1.7.4p4/configure.in	2011-01-11 10:45:49.176261407 +0100
-@@ -1913,7 +1913,7 @@ AC_FUNC_GETGROUPS
- AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
- 	       strftime setrlimit initgroups getgroups fstat gettimeofday \
- 	       regcomp setlocale getaddrinfo setenv vhangup \
--	       mbr_check_membership setrlimit64)
-+	       mbr_check_membership setrlimit64 getgrouplist)
- AC_CHECK_FUNCS(getline, [], [
-     AC_LIBOBJ(getline)
-     AC_CHECK_FUNCS(fgetln)
-diff -up sudo-1.7.4p4/pwutil.c.getgrouplist sudo-1.7.4p4/pwutil.c
---- sudo-1.7.4p4/pwutil.c.getgrouplist	2010-08-06 15:44:30.000000000 +0200
-+++ sudo-1.7.4p4/pwutil.c	2011-01-11 11:42:16.771282451 +0100
-@@ -628,5 +628,26 @@ user_in_group(pw, group)
-     }
- #endif /* HAVE_MBR_CHECK_MEMBERSHIP */
- 
-+#ifdef HAVE_GETGROUPLIST
-+    if (user_ngroups >= 0 &&
-+	strcmp(pw->pw_name, list_pw ? list_pw->pw_name : user_name) == 0)
-+    {
-+	gid_t *grouplist, grouptmp;
-+	int n_groups, i;
-+	n_groups = 1;
-+
-+	if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
-+	    grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
-+	    if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
-+		for (i = 0; i < n_groups; i++)
-+		    if (grouplist[i] == grp->gr_gid) {
-+			free(grouplist);
-+			return(TRUE);
-+		    }
-+	    free(grouplist);
-+	}
-+    }
-+#endif /* HAVE_GETGROUPLIST */
-+
-     return(FALSE);
- }
diff --git a/sudo-1.7.4p4-sudoi.patch b/sudo-1.7.4p4-sudoi.patch
deleted file mode 100644
index 52b8d85..0000000
--- a/sudo-1.7.4p4-sudoi.patch
+++ /dev/null
@@ -1,57 +0,0 @@
---- env.c	Wed Aug 18 15:27:03 2010
-+++ env.c	Tue Sep 14 11:41:50 2010
-@@ -608,10 +608,16 @@
- #ifdef ENV_DEBUG
-     memset(env.envp, 0, env.env_size * sizeof(char *));
- #endif
--    if (def_env_reset || ISSET(sudo_mode, MODE_LOGIN_SHELL)) {
--	/* Reset HOME based on target user unless keeping old value. */
--	reset_home = TRUE;
- 
-+    /* Reset HOME based on target user if configured to. */
-+    if (ISSET(sudo_mode, MODE_RUN)) {
-+	if (def_always_set_home ||
-+	    ISSET(sudo_mode, MODE_RESET_HOME | MODE_LOGIN_SHELL) || 
-+	    (ISSET(sudo_mode, MODE_SHELL) && def_set_home))
-+	    reset_home = TRUE;
-+    }
-+
-+    if (def_env_reset || ISSET(sudo_mode, MODE_LOGIN_SHELL)) {
- 	/* Pull in vars we want to keep from the old environment. */
- 	for (ep = old_envp; *ep; ep++) {
- 	    int keepit;
-@@ -696,6 +702,11 @@
- 	    if (!ISSET(didvar, DID_USERNAME))
- 		sudo_setenv("USERNAME", user_name, FALSE);
- 	}
-+
-+	/* If we didn't keep HOME, reset it based on target user. */
-+	if (!ISSET(didvar, KEPT_HOME))
-+	    reset_home = TRUE;
-+
- 	/*
- 	 * Set MAIL to target user in -i mode or if MAIL is not preserved
- 	 * from user's environment.
-@@ -709,13 +720,6 @@
- 	    sudo_putenv(cp, ISSET(didvar, DID_MAIL), TRUE);
- 	}
-     } else {
--	/* Reset HOME based on target user if configured to. */
--	if (ISSET(sudo_mode, MODE_RUN)) {
--	    if (def_always_set_home || ISSET(sudo_mode, MODE_RESET_HOME) || 
--		(ISSET(sudo_mode, MODE_SHELL) && def_set_home))
--		reset_home = TRUE;
--	}
--
- 	/*
- 	 * Copy environ entries as long as they don't match env_delete or
- 	 * env_check.
-@@ -765,7 +769,7 @@
-     }
- 
-     /* Set $HOME to target user if not preserving user's value. */
--    if (reset_home && !ISSET(didvar, KEPT_HOME))
-+    if (reset_home)
- 	sudo_setenv("HOME", runas_pw->pw_dir, TRUE);
- 
-     /* Provide default values for $TERM and $PATH if they are not set. */
diff --git a/sudo-1.8.1p2-getgrouplist.patch b/sudo-1.8.1p2-getgrouplist.patch
new file mode 100644
index 0000000..6ccfe5e
--- /dev/null
+++ b/sudo-1.8.1p2-getgrouplist.patch
@@ -0,0 +1,44 @@
+diff -up sudo-1.8.1p2/configure.in.getgrouplist sudo-1.8.1p2/configure.in
+--- sudo-1.8.1p2/configure.in.getgrouplist	2011-07-12 12:13:29.562597933 +0200
++++ sudo-1.8.1p2/configure.in	2011-07-12 12:15:27.116597851 +0200
+@@ -2007,7 +2007,7 @@ dnl
+ AC_FUNC_GETGROUPS
+ AC_CHECK_FUNCS(strrchr sysconf tzset strftime initgroups getgroups fstat \
+ 	       regcomp setlocale nl_langinfo getaddrinfo mbr_check_membership \
+-	       setrlimit64 sysctl)
++	       setrlimit64 sysctl getgrouplist)
+ AC_CHECK_FUNCS(getline, [], [
+     AC_LIBOBJ(getline)
+     AC_CHECK_FUNCS(fgetln)
+diff -up sudo-1.8.1p2/plugins/sudoers/pwutil.c.getgrouplist sudo-1.8.1p2/plugins/sudoers/pwutil.c
+--- sudo-1.8.1p2/plugins/sudoers/pwutil.c.getgrouplist	2011-07-12 12:13:17.346597942 +0200
++++ sudo-1.8.1p2/plugins/sudoers/pwutil.c	2011-07-12 12:19:02.171597700 +0200
+@@ -711,6 +711,28 @@ user_in_group(struct passwd *pw, const c
+     }
+ #endif /* HAVE_MBR_CHECK_MEMBERSHIP */
+ 
++#ifdef HAVE_GETGROUPLIST
++    if (user_ngroups >= 0 &&
++       strcmp(pw->pw_name, list_pw ? list_pw->pw_name : user_name) == 0)
++    {
++       gid_t *grouplist, grouptmp;
++       int n_groups, i;
++       n_groups = 1;
++
++       if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
++           grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
++           if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
++               for (i = 0; i < n_groups; i++)
++                   if (grouplist[i] == grp->gr_gid) {
++                       free(grouplist);
++                       retval = TRUE;
++                       goto done;
++                   }
++           free(grouplist);
++       }
++    }
++#endif /* HAVE_GETGROUPLIST */
++
+ done:
+     if (grp != NULL)
+ 	gr_delref(grp);
diff --git a/sudo.spec b/sudo.spec
index cca9415..147c24a 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.7.4p5
-Release: 4%{?dist}
+Version: 1.8.1p2
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -28,9 +28,7 @@ Patch2: sudo-1.7.2p1-envdebug.patch
 Patch3: sudo-1.7.4p3-m4path.patch
 # getgrouplist() to determine group membership (#235915)
 # - version with CVE-2009-0034 fixed
-Patch4: sudo-1.7.4p4-getgrouplist-fixed.patch
-# reset HOME when using the `-i' option (#635250)
-Patch5: sudo-1.7.4p4-sudoi.patch
+Patch4: sudo-1.8.1p2-getgrouplist.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -43,19 +41,24 @@ audit trail of who did what), a configurable timeout of the sudo
 command, and the ability to use the same configuration file (sudoers)
 on many different machines.
 
+%package        devel
+Summary:        Development files for %{name}
+Group:          Development/Libraries
+Requires:       %{name} = %{version}-%{release}
+
+%description    devel
+The %{name}-devel package contains header files developing sudo
+plugins that use %{name}.
+
 %prep
 %setup -q
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .envdebug
 %patch3 -p1 -b .m4path
-%patch4 -p1 -b .getgrouplist-fixed
-%patch5 -p0 -b .sudoi
+%patch4 -p1 -b .getgrouplist
 
 %build
-# handle newer autoconf
-rm -f acsite.m4
-mv aclocal.m4 acinclude.m4
 autoreconf -fv --install
 
 %ifarch s390 s390x sparc64
@@ -80,8 +83,6 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --with-ignore-dot \
         --with-tty-tickets \
         --with-ldap \
-	--with-ldap-conf-file="%{_sysconfdir}/nss_ldap.conf" \
-	--with-ldap-secret-file="%{_sysconfdir}/nss_ldap.secret" \
 	--with-selinux \
 	--with-passprompt="[sudo] password for %p: " \
 	--with-linux-audit
@@ -122,8 +123,9 @@ rm -rf $RPM_BUILD_ROOT
 
 %files
 %defattr(-,root,root)
-%doc ChangeLog NEWS HISTORY LICENSE README* TROUBLESHOOTING UPGRADE
-%doc schema.* sudoers2ldif sample.*
+%doc ChangeLog NEWS README* MANIFEST
+%doc doc/HISTORY doc/LICENSE doc/TROUBLESHOOTING doc/UPGRADE
+%doc doc/schema.* plugins/sudoers/sudoers2ldif doc/sample.*
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %attr(0750,root,root) %dir /etc/sudoers.d/
 %config(noreplace) /etc/pam.d/sudo
@@ -135,6 +137,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0755,root,root) %{_sbindir}/visudo
 %attr(0755,root,root) %{_libexecdir}/sesh
 %{_libexecdir}/sudo_noexec.*
+%{_libexecdir}/sudoers.*
 %{_mandir}/man5/sudoers.5*
 %{_mandir}/man5/sudoers.ldap.5*
 %{_mandir}/man8/sudo.8*
@@ -146,9 +149,22 @@ rm -rf $RPM_BUILD_ROOT
 %post
 /bin/chmod 0440 /etc/sudoers || :
 
+%files devel
+%defattr(-,root,root,-)
+%doc plugins/{sample,sample_group}
+%{_includedir}/sudo_plugin.h
+%{_mandir}/man8/sudo_plugin.8*
+
 %changelog
+* Tue Jul 12 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
+- rebase to 1.8.1p2
+- removed .sudoi patch
+- fixed typo: RELPRO -> RELRO
+- added -devel subpackage for the sudo_plugin.h header file
+- use default ldap configuration files again
+
 * Fri Jun  3 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-4
-- build with RELPRO
+- build with RELRO
 
 * Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.4p5-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

From 911d5c1fe92c65fd0e9806ba3d737f4c683aebaa Mon Sep 17 00:00:00 2001
From: Peter Robinson <pbrobinson@gmail.com>
Date: Wed, 7 Sep 2011 09:48:26 +0100
Subject: [PATCH 059/199] Remove execute bit from sample script in docs so we
 don't pull in perl

---
 sudo.spec | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 147c24a..3653a74 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.1p2
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -58,6 +58,9 @@ plugins that use %{name}.
 %patch3 -p1 -b .m4path
 %patch4 -p1 -b .getgrouplist
 
+# Remove execute permission on this script so we don't pull in perl deps
+chmod -x plugins/sudoers/sudoers2ldif
+
 %build
 autoreconf -fv --install
 
@@ -156,6 +159,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Wed Sep  7 2011 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.1p2-2
+- Remove execute bit from sample script in docs so we don't pull in perl
+
 * Tue Jul 12 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
 - rebase to 1.8.1p2
 - removed .sudoi patch

From 0894814a99a26d68792613f63f0d2f57fd8b4fc6 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 10 Nov 2011 10:22:56 +0100
Subject: [PATCH 060/199] update to 1.8.3p1 disable output word wrapping if the
 output is piped

---
 .gitignore                |  1 +
 sources                   |  2 +-
 sudo-1.8.3-pipelist.patch | 28 ++++++++++++++++++++++++++++
 sudo.spec                 | 26 +++++++++++++++++++-------
 4 files changed, 49 insertions(+), 8 deletions(-)
 create mode 100644 sudo-1.8.3-pipelist.patch

diff --git a/.gitignore b/.gitignore
index 352f8f8..754758f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.7.4p4-sudoers
 /sudo-1.7.4p5.tar.gz
 /sudo-1.8.1p2.tar.gz
+/sudo-1.8.3p1.tar.gz
diff --git a/sources b/sources
index a86ed7d..d108a9e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-e8330f0e63b0ecb2e12b5c76922818cc  sudo-1.8.1p2.tar.gz
+7becc572fa97f94cf721a2ee8299c45b  sudo-1.8.3p1.tar.gz
 56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers
diff --git a/sudo-1.8.3-pipelist.patch b/sudo-1.8.3-pipelist.patch
new file mode 100644
index 0000000..e976f0e
--- /dev/null
+++ b/sudo-1.8.3-pipelist.patch
@@ -0,0 +1,28 @@
+diff -up sudo-1.8.3/src/ttysize.c.pipelist sudo-1.8.3/src/ttysize.c
+--- sudo-1.8.3/src/ttysize.c.pipelist	2011-10-21 15:01:26.000000000 +0200
++++ sudo-1.8.3/src/ttysize.c	2011-10-26 02:09:39.582790562 +0200
+@@ -20,6 +20,7 @@
+ 
+ #include <sys/types.h>
+ #include <sys/ioctl.h>
++#include <sys/stat.h>
+ #include <stdio.h>
+ #ifdef STDC_HEADERS
+ # include <stdlib.h>
+@@ -48,6 +49,16 @@ void
+ get_ttysize(int *rowp, int *colp)
+ {
+     char *p;
++    struct stat st;
++
++    if (fstat(STDOUT_FILENO, &st) == 0) {
++	 if (S_ISFIFO(st.st_mode)) {
++	   *rowp = 0;
++	   *colp = 0;
++	   return;
++	 }
++    }
++
+ #ifdef TIOCGWINSZ
+     struct winsize wsize;
+ 
diff --git a/sudo.spec b/sudo.spec
index 3653a74..75f1384 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.1p2
-Release: 2%{?dist}
+Version: 1.8.3p1
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -19,6 +19,7 @@ BuildRequires: automake autoconf libtool
 BuildRequires: audit-libs-devel libcap-devel
 BuildRequires: libselinux-devel
 BuildRequires: sendmail
+BuildRequires: gettext
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
@@ -26,9 +27,8 @@ Patch1: sudo-1.6.7p5-strip.patch
 Patch2: sudo-1.7.2p1-envdebug.patch
 # add m4/ to paths in aclocal.m4
 Patch3: sudo-1.7.4p3-m4path.patch
-# getgrouplist() to determine group membership (#235915)
-# - version with CVE-2009-0034 fixed
-Patch4: sudo-1.8.1p2-getgrouplist.patch
+# disable word wrapping if the ouput is piped
+Patch4: sudo-1.8.3-pipelist.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -56,7 +56,7 @@ plugins that use %{name}.
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .envdebug
 %patch3 -p1 -b .m4path
-%patch4 -p1 -b .getgrouplist
+%patch4 -p1 -b .pipelist
 
 # Remove execute permission on this script so we don't pull in perl deps
 chmod -x plugins/sudoers/sudoers2ldif
@@ -96,11 +96,18 @@ make
 %install
 rm -rf $RPM_BUILD_ROOT
 make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
+
 chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* 
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
 
+%find_lang sudo
+%find_lang sudoers
+
+cat sudo.lang sudoers.lang > sudo_all.lang
+rm sudo.lang sudoers.lang
+
 mkdir -p $RPM_BUILD_ROOT/etc/pam.d
 cat > $RPM_BUILD_ROOT/etc/pam.d/sudo << EOF
 #%PAM-1.0
@@ -124,7 +131,7 @@ EOF
 %clean 
 rm -rf $RPM_BUILD_ROOT
 
-%files
+%files -f sudo_all.lang
 %defattr(-,root,root)
 %doc ChangeLog NEWS README* MANIFEST
 %doc doc/HISTORY doc/LICENSE doc/TROUBLESHOOTING doc/UPGRADE
@@ -148,6 +155,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudoreplay.8*
 %{_mandir}/man8/visudo.8*
 
+
 # Make sure permissions are ok even if we're updating
 %post
 /bin/chmod 0440 /etc/sudoers || :
@@ -159,6 +167,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Tue Nov 10 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-1
+- update to 1.8.3p1
+- disable output word wrapping if the output is piped 
+
 * Wed Sep  7 2011 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.1p2-2
 - Remove execute bit from sample script in docs so we don't pull in perl
 

From 6a1e504d6b099cd09dd7473fc72c0f18078192b3 Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Fri, 13 Jan 2012 22:32:29 -0600
Subject: [PATCH 061/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 75f1384..215f4e3 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.3p1
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -167,6 +167,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.3p1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
 * Tue Nov 10 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-1
 - update to 1.8.3p1
 - disable output word wrapping if the output is piped 

From 2c51203bb4651f7af42f5d2b30efc7c14ecc8a43 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 26 Jan 2012 15:36:37 +0100
Subject: [PATCH 062/199] added patch for CVE-2012-0809

---
 sudo-1.8.3p1-CVE-2012-0809.patch | 23 +++++++++++++++++++++++
 sudo.spec                        |  8 +++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 sudo-1.8.3p1-CVE-2012-0809.patch

diff --git a/sudo-1.8.3p1-CVE-2012-0809.patch b/sudo-1.8.3p1-CVE-2012-0809.patch
new file mode 100644
index 0000000..8010808
--- /dev/null
+++ b/sudo-1.8.3p1-CVE-2012-0809.patch
@@ -0,0 +1,23 @@
+--- sudo-1.8.3p1/src/sudo.c	Fri Oct 21 09:01:26 2011
++++ sudo-1.8.3p1/src/sudo.c	Tue Jan 24 15:59:03 2012
+@@ -1208,15 +1208,15 @@ 
+ sudo_debug(int level, const char *fmt, ...)
+ {
+     va_list ap;
+-    char *fmt2;
++    char *buf;
+ 
+     if (level > debug_level)
+ 	return;
+ 
+-    /* Backet fmt with program name and a newline to make it a single write */
+-    easprintf(&fmt2, "%s: %s\n", getprogname(), fmt);
++    /* Bracket fmt with program name and a newline to make it a single write */
+     va_start(ap, fmt);
+-    vfprintf(stderr, fmt2, ap);
++    evasprintf(&buf, fmt, ap);
+     va_end(ap);
+-    efree(fmt2);
++    fprintf(stderr, "%s: %s\n", getprogname(), buf);
++    efree(buf);
+ }
diff --git a/sudo.spec b/sudo.spec
index 215f4e3..9724ad1 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.3p1
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -29,6 +29,8 @@ Patch2: sudo-1.7.2p1-envdebug.patch
 Patch3: sudo-1.7.4p3-m4path.patch
 # disable word wrapping if the ouput is piped
 Patch4: sudo-1.8.3-pipelist.patch
+# CVE-2012-0809
+Patch5: sudo-1.8.3p1-CVE-2012-0809.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -57,6 +59,7 @@ plugins that use %{name}.
 %patch2 -p1 -b .envdebug
 %patch3 -p1 -b .m4path
 %patch4 -p1 -b .pipelist
+%patch5 -p1 -b .CVE-2012-0809
 
 # Remove execute permission on this script so we don't pull in perl deps
 chmod -x plugins/sudoers/sudoers2ldif
@@ -167,6 +170,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Thu Jan 26 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-3
+- added patch for CVE-2012-0809
+
 * Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.3p1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
 

From d4159888614139b8a003f5472be8696112ac8d5a Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 7 Feb 2012 12:25:11 +0100
Subject: [PATCH 063/199] added SSSD support

---
 sudo-1.8.3p1-sssd-support.patch | 1288 +++++++++++++++++++++++++++++++
 sudo.spec                       |   12 +-
 2 files changed, 1298 insertions(+), 2 deletions(-)
 create mode 100644 sudo-1.8.3p1-sssd-support.patch

diff --git a/sudo-1.8.3p1-sssd-support.patch b/sudo-1.8.3p1-sssd-support.patch
new file mode 100644
index 0000000..ee1b68a
--- /dev/null
+++ b/sudo-1.8.3p1-sssd-support.patch
@@ -0,0 +1,1288 @@
+diff -up sudo-1.8.3p1/configure.in.sssd-support sudo-1.8.3p1/configure.in
+--- sudo-1.8.3p1/configure.in.sssd-support	2012-01-11 19:27:02.604019550 +0100
++++ sudo-1.8.3p1/configure.in	2012-01-12 16:28:48.031171923 +0100
+@@ -275,6 +275,22 @@ AC_ARG_WITH(linux-audit, [AS_HELP_STRING
+ 		;;
+ esac])
+ 
++dnl
++dnl Handle SSSD support.
++dnl
++AC_ARG_WITH(sssd, [AS_HELP_STRING([--with-sssd], [enable SSSD support])],
++[case $with_sssd in
++    yes)
++		SUDO_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
++		SUDOERS_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
++		SUDOERS_OBJS="${SUDOERS_OBJS} sssd.lo"
++		AC_DEFINE(HAVE_SSSD)
++		;;
++    no)		;;
++    *)		AC_MSG_ERROR(["--with-sssd does not take an argument."])
++		;;
++esac])
++
+ AC_ARG_WITH(incpath, [AS_HELP_STRING([--with-incpath], [additional places to look for include files])],
+ [case $with_incpath in
+     yes)	AC_MSG_ERROR(["must give --with-incpath an argument."])
+@@ -3157,6 +3173,7 @@ AH_TEMPLATE(HAVE_LBER_H, [Define to 1 if
+ AH_TEMPLATE(HAVE_LDAP, [Define to 1 if you use LDAP for sudoers.])
+ AH_TEMPLATE(HAVE_LIBINTL_H, [Define to 1 if you have the <libintl.h> header file.])
+ AH_TEMPLATE(HAVE_LINUX_AUDIT, [Define to 1 to enable Linux audit support.])
++AH_TEMPLATE(HAVE_SSSD, [Define to 1 to enable SSSD support.])
+ AH_TEMPLATE(HAVE_OPIE, [Define to 1 if you use NRL OPIE.])
+ AH_TEMPLATE(HAVE_PAM, [Define to 1 if you use PAM authentication.])
+ AH_TEMPLATE(HAVE_PAM_LOGIN, [Define to 1 if you use a specific PAM session for sudo -i.])
+diff -up sudo-1.8.3p1/plugins/sudoers/Makefile.in.sssd-support sudo-1.8.3p1/plugins/sudoers/Makefile.in
+--- sudo-1.8.3p1/plugins/sudoers/Makefile.in.sssd-support	2012-01-11 19:27:23.016032415 +0100
++++ sudo-1.8.3p1/plugins/sudoers/Makefile.in	2012-01-12 16:35:00.527406716 +0100
+@@ -530,6 +530,10 @@ linux_audit.lo: $(srcdir)/linux_audit.c 
+                 $(incdir)/missing.h $(incdir)/error.h $(incdir)/alloc.h \
+                 $(incdir)/gettext.h $(srcdir)/linux_audit.h
+ 	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(srcdir)/linux_audit.c
++sssd.lo: $(srcdir)/sssd.c $(top_builddir)/config.h \
++          $(incdir)/missing.h $(incdir)/error.h $(incdir)/alloc.h \
++          $(incdir)/gettext.h
++	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(srcdir)/sssd.c
+ logging.lo: $(srcdir)/logging.c $(top_builddir)/config.h $(srcdir)/sudoers.h \
+             $(top_builddir)/pathnames.h $(incdir)/missing.h $(incdir)/error.h \
+             $(incdir)/alloc.h $(incdir)/list.h $(incdir)/fileops.h \
+diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/sudoers/sssd.c
+--- sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support	2012-01-19 13:41:51.885154296 +0100
++++ sudo-1.8.3p1/plugins/sudoers/sssd.c	2012-02-07 12:22:37.641156963 +0100
+@@ -0,0 +1,1157 @@
++/*
++ * Copyright (c) 2003-2011 Todd C. Miller <Todd.Miller@courtesan.com>
++ * Copyright (c) 2011 Daniel Kopecek <dkopecek@redhat.com>
++ *
++ * This code is derived from software contributed by Aaron Spangler.
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <config.h>
++
++#include <sys/types.h>
++#include <sys/time.h>
++#include <sys/param.h>
++#include <sys/stat.h>
++#include <stdio.h>
++#ifdef STDC_HEADERS
++# include <stdlib.h>
++# include <stddef.h>
++#else
++# ifdef HAVE_STDLIB_H
++#  include <stdlib.h>
++# endif
++#endif /* STDC_HEADERS */
++#ifdef HAVE_STRING_H
++# include <string.h>
++#endif /* HAVE_STRING_H */
++#ifdef HAVE_STRINGS_H
++# include <strings.h>
++#endif /* HAVE_STRINGS_H */
++#ifdef HAVE_UNISTD_H
++# include <unistd.h>
++#endif /* HAVE_UNISTD_H */
++#if TIME_WITH_SYS_TIME
++# include <time.h>
++#endif
++#include <ctype.h>
++#include <pwd.h>
++#include <grp.h>
++
++#include <sss_sudo.h>
++#include <errno.h>
++
++#include "sudoers.h"
++#include "parse.h"
++#include "lbuf.h"
++
++extern int debug_level;
++#define __sssd_debug debug_level
++
++#define	DPRINTF(level, fmt, ...) if (__sssd_debug >= (level)) warningx("%s:%d: "fmt, __PRETTY_FUNCTION__, __LINE__, ##__VA_ARGS__)
++
++/* sudo_nss implementation */
++static int sudo_sssd_open(struct sudo_nss *nss);
++static int sudo_sssd_close(struct sudo_nss *nss);
++static int sudo_sssd_parse(struct sudo_nss *nss);
++static void sudo_sssd_parse_options(struct sss_rule *rule);
++static int sudo_sssd_setdefs(struct sudo_nss *nss);
++static int sudo_sssd_lookup(struct sudo_nss *nss, int ret, int pwflag);
++static int sudo_sssd_display_cmnd(struct sudo_nss *nss, struct passwd *pw);
++static int sudo_sssd_display_defaults(struct sudo_nss *nss, struct passwd *pw,
++				      struct lbuf *lbuf);
++
++static int sudo_sssd_display_bound_defaults(struct sudo_nss *nss,
++					    struct passwd *pw, struct lbuf *lbuf);
++
++static int sudo_sssd_display_privs(struct sudo_nss *nss, struct passwd *pw,
++				   struct lbuf *lbuf);
++
++
++static struct sss_result *sudo_sssd_result_get(struct sudo_nss *nss,
++					       struct passwd *pw,
++					       uint32_t *state);
++
++static void sudo_sssd_attrcpy(struct sss_attr *dst, const struct sss_attr *src)
++{
++     int i;
++
++     DPRINTF(3, "dst=%p, src=%p", dst, src);
++     DPRINTF(2, "emalloc: cnt=%d", src->num_values);
++
++     dst->name = strdup(src->name);
++     dst->num_values = src->num_values;
++     dst->values = emalloc(sizeof(char *) * dst->num_values);
++
++     for (i = 0; i < dst->num_values; ++i)
++	  dst->values[i] = strdup(src->values[i]);
++
++     return;
++}
++
++static void sudo_sssd_rulecpy(struct sss_rule *dst, const struct sss_rule *src)
++{
++     int i;
++
++     DPRINTF(3, "dst=%p, src=%p", dst, src);
++     DPRINTF(2, "emalloc: cnt=%d", src->num_attrs);
++
++     dst->num_attrs = src->num_attrs;
++     dst->attrs = emalloc(sizeof(struct sss_attr) * dst->num_attrs);
++
++     for (i = 0; i < dst->num_attrs; ++i) {
++	  sudo_sssd_attrcpy(dst->attrs + i,
++			    src->attrs + i);
++     }
++}
++
++#define _SUDO_SSS_FILTER_INCLUDE 0
++#define _SUDO_SSS_FILTER_EXCLUDE 1
++
++#define _SUDO_SSS_STATE_HOSTMATCH 0x01
++#define _SUDO_SSS_STATE_USERMATCH 0x02
++
++static struct sss_result *sudo_sssd_filter_result(struct sss_result *in_res, int (*filterp)(struct sss_rule *, void *), int act, void *filterp_arg)
++{
++     struct sss_result *out_res;
++     int i, l, r;
++
++     DPRINTF(3, "in_res=%p, count=%u, act=%s",
++	     in_res, in_res->num_rules, act == _SUDO_SSS_FILTER_EXCLUDE ? "EXCLUDE" : "INCLUDE");
++
++     if (in_res == NULL)
++	  return NULL;
++
++     DPRINTF(3, "emalloc: cnt=%d", in_res->num_rules);
++
++     out_res = emalloc(sizeof(struct sss_result));
++     out_res->rules = in_res->num_rules > 0 ? emalloc(sizeof(struct sss_rule) * in_res->num_rules) : NULL;
++     out_res->num_rules = 0;
++
++     for (i = l = 0; i < in_res->num_rules; ++i) {
++	  r = filterp(in_res->rules + i, filterp_arg);
++
++	  if (( r && act == _SUDO_SSS_FILTER_INCLUDE) ||
++	      (!r && act == _SUDO_SSS_FILTER_EXCLUDE))
++	  {
++	       DPRINTF(3, "COPY (%s): %p[%u] => %p[%u] (= %p)",
++		       act == _SUDO_SSS_FILTER_EXCLUDE ? "not excluded" : "included",
++		       in_res->rules, i, out_res->rules, l, in_res->rules + i);
++
++	       sudo_sssd_rulecpy(out_res->rules + l, in_res->rules + i);
++	       ++l;
++	  }
++     }
++
++     if (l < in_res->num_rules) {
++	  DPRINTF(3, "reallocating result: %p (count: %u -> %u)", out_res->rules, in_res->num_rules, l);
++	  out_res->rules = realloc(out_res->rules, sizeof(struct sss_rule) * l);
++     }
++
++     out_res->num_rules = l;
++
++     return out_res;
++}
++
++struct sudo_sssd_handle {
++     char *username;
++     struct sss_result *result;
++     struct group_list *grlist;
++};
++
++struct sudo_nss sudo_nss_sssd = {
++    &sudo_nss_sssd,
++    NULL,
++    sudo_sssd_open,
++    sudo_sssd_close,
++    sudo_sssd_parse,
++    sudo_sssd_setdefs,
++    sudo_sssd_lookup,
++    sudo_sssd_display_cmnd,
++    sudo_sssd_display_defaults,
++    sudo_sssd_display_bound_defaults,
++    sudo_sssd_display_privs
++};
++
++
++/* sudo_nss implementation */
++// ok
++static int sudo_sssd_open(struct sudo_nss *nss)
++{
++     struct sudo_sssd_handle *handle;
++
++     /* Create a handle container. */
++     handle = emalloc(sizeof(struct sudo_sssd_handle));
++     handle->result = NULL;
++     handle->username = NULL;
++     handle->grlist = NULL;
++     nss->handle = handle;
++
++     DPRINTF(3, "handle=%p", handle);
++
++     return 0;
++}
++
++// ok
++static int sudo_sssd_close(struct sudo_nss *nss)
++{
++     efree(nss->handle);
++     return 0;
++}
++
++// ok
++static int sudo_sssd_parse(struct sudo_nss *nss)
++{
++     return 0;
++}
++
++static int sudo_sssd_setdefs(struct sudo_nss *nss)
++{
++     struct sudo_sssd_handle *handle = nss->handle;
++
++     struct sss_result *sres;
++     struct sss_rule *rule;
++     uint32_t serr;
++     int i;
++
++     if (handle == NULL)
++	  return -1;
++
++     DPRINTF(1, "Looking for cn=defaults");
++
++     if (sss_sudo_send_recv_defaults(&serr, &sres) != 0) {
++	  DPRINTF(2, "sss_sudo_send_recv_defaults: != 0, serr=%u", serr);
++	  return -1;
++     }
++
++     for (i = 0; i < sres->num_rules; ++i) {
++	  DPRINTF(1, "Parsing cn=defaults, %d/%d", i, sres->num_rules);
++	  rule = sres->rules + i;
++	  sudo_sssd_parse_options(rule);
++     }
++
++     sss_sudo_free_result(sres);
++
++     DPRINTF(1, "Looking for cn=defaults... end");
++
++     return 0;
++}
++
++static int
++sudo_sssd_check_runas_user(struct sss_rule *rule)
++{
++     char **v_arr = NULL;
++     char *val;
++     int ret = FALSE, i;
++
++     if (!runas_pw)
++	  return UNSPEC;
++
++
++     /* get the runas user from the entry */
++     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &v_arr)) 
++     {
++     case 0:
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result. Trying old style (sudoRunAs)");
++
++	  /* try old style */
++	  switch (sss_sudo_get_values(rule, "sudoRunAs", &v_arr))
++	  {
++	  case 0:
++	       break;
++	  case ENOENT:
++	       DPRINTF(2, "No result. Matching against runas_default");
++	       /*
++		* If there are no runas entries, match runas_default against
++		* what the user specified on the command line.
++		*/
++	       return !strcasecmp(runas_pw->pw_name, def_runas_default);
++	  default:
++	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
++	       return UNSPEC;
++	  }
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
++	  return UNSPEC;
++     }
++
++     /*
++      * BUG:
++      * 
++      * if runas is not specified on the command line, the only information
++      * as to which user to run as is in the runas_default option.  We should
++      * check to see if we have the local option present.  Unfortunately we
++      * don't parse these options until after this routine says yes or no.
++      * The query has already returned, so we could peek at the attribute
++      * values here though.
++      * 
++      * For now just require users to always use -u option unless its set
++      * in the global defaults. This behaviour is no different than the global
++      * /etc/sudoers.
++      * 
++      * Sigh - maybe add this feature later
++      */
++
++     /* walk through values returned, looking for a match */
++     for (i = 0; v_arr[i] != NULL && !ret; ++i) {
++	  val = v_arr[i];
++
++	  DPRINTF(3, "val[%d]=%s", i, val);
++
++	  switch (val[0]) {
++	  case '+':
++	       DPRINTF(3, "netgr_");
++	       if (netgr_matches(val, NULL, NULL, runas_pw->pw_name)) {
++		    DPRINTF(3, "=> match");
++		    ret = TRUE;
++	       }
++	       break;
++	  case '%':
++	       DPRINTF(3, "usergr_");
++	       if (usergr_matches(val, runas_pw->pw_name, runas_pw)) {
++		    DPRINTF(3, "=> match");
++		    ret = TRUE;
++	       }
++	       break;
++	  case 'A':
++	       if (strcmp(val, "ALL") == 0) {
++		    DPRINTF(3, "ALL => match");
++		    ret = TRUE;
++		    break;
++	       }
++	       /* FALLTHROUGH */
++	       DPRINTF(3, "FALLTHROUGH");
++	  default:
++	       if (strcasecmp(val, runas_pw->pw_name) == 0) {
++		    DPRINTF(3, "%s == %s (pw_name) => match", val, runas_pw->pw_name);
++		    ret = TRUE;
++	       }
++	       break;
++	  }
++
++	  DPRINTF(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
++     }
++
++     sss_sudo_free_values(v_arr); /* cleanup */
++
++     return ret;
++}
++
++static int
++sudo_sssd_check_runas_group(struct sss_rule *rule)
++{
++     char **v_arr = NULL;
++     char *val;
++     int ret = FALSE, i;
++
++     /* runas_gr is only set if the user specified the -g flag */
++     if (!runas_gr)
++	  return UNSPEC;
++
++     /* get the values from the entry */
++     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &v_arr))
++     {
++     case 0:
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  return FALSE;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
++	  return UNSPEC;
++     }
++
++     /* walk through values returned, looking for a match */
++     for (i = 0; v_arr[i] != NULL; ++i) {
++	  val = v_arr[i];
++	  DPRINTF(3, "val[%d]=%s", i, val);
++
++	  if (strcmp(val, "ALL") == 0 || group_matches(val, runas_gr))
++	       ret = TRUE;
++
++	  DPRINTF(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
++     }
++
++     sss_sudo_free_values(v_arr);
++
++     return ret;
++}
++
++/*
++ * Walk through search results and return TRUE if we have a runas match,
++ * else FALSE.  RunAs info is optional.
++ */
++static int
++sudo_sssd_check_runas(struct sss_rule *rule)
++{
++    int ret;
++
++    if (rule == NULL)
++	 return FALSE;
++
++    ret = sudo_sssd_check_runas_user(rule) != FALSE &&
++	 sudo_sssd_check_runas_group(rule) != FALSE;
++
++    return ret;
++}
++
++static int sudo_sssd_check_host(struct sss_rule *rule)
++{
++    char **v_arr, *val;
++    int ret = FALSE, i;
++
++    if (rule == NULL)
++	 return ret;
++
++    /* get the values from the rule */
++    switch (sss_sudo_get_values(rule, "sudoHost", &v_arr))
++    {
++    case 0:
++	 break;
++    case ENOENT:
++	 DPRINTF(2, "No result.");
++	 return FALSE;
++    default:
++	 DPRINTF(2, "sss_sudo_get_values(sudoHost): != 0");
++	 return ret;
++    }
++
++    /* walk through values */
++    for (i = 0; v_arr[i] != NULL; ++i) {
++	 val = v_arr[i];
++	 DPRINTF(3, "val[%d]=%s", i, val);
++
++	 /* match any or address or netgroup or hostname */
++	 if (!strcmp(val, "ALL") || addr_matches(val) ||
++	     netgr_matches(val, user_host, user_shost, NULL) ||
++	     hostname_matches(user_shost, user_host, val))
++	      ret = TRUE;
++
++	 DPRINTF(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
++    }
++
++    sss_sudo_free_values(v_arr);
++
++    return ret;
++}
++
++static int sudo_sssd_result_filterp(struct sss_rule *rule, void *unused)
++{
++     (void)unused;
++
++     if (sudo_sssd_check_host(rule))
++	  return 1;
++     else
++	  return 0;
++}
++
++static struct sss_result *sudo_sssd_result_get(struct sudo_nss *nss,
++					       struct passwd *pw,
++					       uint32_t *state)
++{
++     struct sudo_sssd_handle *handle = nss->handle;
++     struct sss_result *u_sres, *f_sres;
++     uint32_t serr = 0, ret;
++
++     DPRINTF(1, "pw_name=%s", pw->pw_name);
++
++     u_sres = f_sres = NULL;
++
++     switch (ret = sss_sudo_send_recv(pw->pw_name, &serr, &u_sres))
++     {
++     case 0:
++	  switch (serr) {
++	  case 0:
++	       if (u_sres != NULL) {
++		    if (state != NULL) {
++			 DPRINTF(3, "state |= USERMATCH");
++			 *state |= _SUDO_SSS_STATE_USERMATCH;
++		    }
++		    DPRINTF(2, "Received %u rule(s)", u_sres->num_rules);
++	       } else {
++		    DPRINTF(2, "Internal error: u_sres == NULL && serr == 0");
++		    return NULL;
++	       }
++	       break;
++	  case ENOENT:
++	       DPRINTF(2, "No result.");
++	  default:
++	       DPRINTF(2, "serr=%u\n", serr);
++	       return NULL;
++	  }
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
++	  return NULL;
++     }
++
++     f_sres = sudo_sssd_filter_result(u_sres, sudo_sssd_result_filterp, _SUDO_SSS_FILTER_INCLUDE, NULL);
++
++     if (f_sres != NULL)
++	  if (f_sres->num_rules > 0)
++	       if (state != NULL) {
++		    DPRINTF(3, "state |= HOSTMATCH");
++		    *state |= _SUDO_SSS_STATE_HOSTMATCH;
++	       }
++
++     DPRINTF(3, "u_sres=(%p, %u) => f_sres=(%p, %u)",
++	     u_sres, u_sres->num_rules, f_sres, f_sres->num_rules);
++
++     sss_sudo_free_result(u_sres);
++
++     /* Store everything in the sudo_nss handle. */
++     handle->result = NULL;
++
++     if (handle->username != NULL) {
++	  DPRINTF(3, "Freeing previously stored username");
++	  efree(handle->username);
++     }
++
++     handle->username = estrdup(pw->pw_name);
++     handle->grlist = user_group_list;
++
++     return f_sres;
++}
++
++/*
++ * Search for boolean "option" in sudoOption.
++ * Returns TRUE if found and allowed, FALSE if negated, else UNSPEC.
++ */
++static int
++sudo_sssd_check_bool(struct sss_rule *rule, char *option)
++{
++     char ch, *var, **v_arr = NULL;
++     int i, ret = UNSPEC;
++
++     if (rule == NULL)
++	  return ret;
++
++     switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++     {
++     case 0:
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  return ret;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values: != 0");
++	  return ret;
++     }
++
++     /* walk through options */
++     for (i = 0; v_arr[i] != NULL; ++i) {
++	  var = v_arr[i];
++	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", var);
++
++	  if ((ch = *var) == '!')
++	       var++;
++	  if (strcmp(var, option) == 0)
++	       ret = (ch != '!');
++     }
++
++     sss_sudo_free_values(v_arr);
++
++     return ret;
++}
++
++/*
++ * Walk through search results and return TRUE if we have a command match,
++ * FALSE if disallowed and UNSPEC if not matched.
++ */
++static int
++sudo_sssd_check_command(struct sss_rule *rule, int *setenv_implied)
++{
++     char **v_arr = NULL, *val;
++     char *allowed_cmnd, *allowed_args;
++     int i, foundbang, ret = UNSPEC;
++
++     if (rule == NULL)
++	  return ret;
++
++     switch (sss_sudo_get_values(rule, "sudoCommand", &v_arr))
++     {
++     case 0:
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  return ret;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values: != 0");
++	  return ret;
++     }
++
++     for (i = 0; v_arr[i] != NULL && ret != FALSE; ++i) {
++	  val = v_arr[i];
++
++	  DPRINTF(3, "val[%d]=%s", i, val);
++
++	  /* Match against ALL ? */
++	  if (!strcmp(val, "ALL")) {
++	       ret = TRUE;
++	       if (setenv_implied != NULL)
++		    *setenv_implied = TRUE;
++	       DPRINTF(2, "sssd/ldap sudoCommand '%s' ... MATCH!", val);
++	       continue;
++	  }
++
++	  /* check for !command */
++	  if (*val == '!') {
++	       foundbang = TRUE;
++	       allowed_cmnd = estrdup(1 + val);	/* !command */
++	  } else {
++	       foundbang = FALSE;
++	       allowed_cmnd = estrdup(val);	/* command */
++	  }
++
++	  /* split optional args away from command */
++	  allowed_args = strchr(allowed_cmnd, ' ');
++	  if (allowed_args)
++	       *allowed_args++ = '\0';
++
++	  /* check the command like normal */
++	  if (command_matches(allowed_cmnd, allowed_args)) {
++	       /*
++		* If allowed (no bang) set ret but keep on checking.
++		* If disallowed (bang), exit loop.
++		*/
++	       ret = foundbang ? FALSE : TRUE;
++	  }
++
++	  DPRINTF(2, "sssd/ldap sudoCommand '%s' ... %s", val, ret == TRUE ? "MATCH!" : "not");
++	  efree(allowed_cmnd);	/* cleanup */
++     }
++
++     sss_sudo_free_values(v_arr); /* more cleanup */
++
++     return ret;
++}
++
++static void
++sudo_sssd_parse_options(struct sss_rule *rule)
++{
++     int i;
++     char op, *v, *val;
++     char **v_arr = NULL;
++
++     if (rule == NULL)
++	  return;
++
++     switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++     {
++     case 0:
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  return;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
++	  return;
++     }
++
++     /* walk through options */
++     for (i = 0; v_arr[i] != NULL; i++) {
++	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", v_arr[i]);
++	  v = estrdup(v_arr[i]);
++
++	  /* check for equals sign past first char */
++	  val = strchr(v, '=');
++	  if (val > v) {
++	       *val++ = '\0';	/* split on = and truncate var */
++	       op = *(val - 2);	/* peek for += or -= cases */
++	       if (op == '+' || op == '-') {
++		    *(val - 2) = '\0';	/* found, remove extra char */
++		    /* case var+=val or var-=val */
++		    set_default(v, val, (int) op);
++	       } else {
++		    /* case var=val */
++		    set_default(v, val, TRUE);
++	       }
++	  } else if (*v == '!') {
++	       /* case !var Boolean False */
++	       set_default(v + 1, NULL, FALSE);
++	  } else {
++	       /* case var Boolean True */
++	       set_default(v, NULL, TRUE);
++	  }
++	  efree(v);
++     }
++
++     sss_sudo_free_values(v_arr);
++}
++
++static int sudo_sssd_lookup(struct sudo_nss *nss, int ret, int pwflag)
++{
++    int rc, setenv_implied;
++
++    struct sss_result *sres = NULL;
++    struct sss_rule   *rule;
++    uint32_t i, state = 0;
++
++    /* Fetch list of sudoRole entries that match user and host. */
++    sres = sudo_sssd_result_get(nss, sudo_user.pw, &state);
++
++    /*
++     * The following queries are only determine whether or not a
++     * password is required, so the order of the entries doesn't matter.
++     */
++    if (pwflag) {
++	int doauth = UNSPEC;
++	int matched = UNSPEC;
++	enum def_tuple pwcheck = 
++	    (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
++
++	DPRINTF(2, "perform search for pwflag %d", pwflag);
++	if (sres != NULL) {
++	     for (i = 0; i < sres->num_rules; i++) {
++		  rule = sres->rules + i;
++		  if ((pwcheck == any && doauth != FALSE) ||
++		      (pwcheck == all && doauth == FALSE)) {
++		       doauth = sudo_sssd_check_bool(rule, "authenticate");
++		  }
++		  /* Only check the command when listing another user. */
++		  if (user_uid == 0 || list_pw == NULL ||
++		      user_uid == list_pw->pw_uid ||
++		      sudo_sssd_check_command(rule, NULL)) {
++		       matched = TRUE;
++		       break;
++		  }
++	     }
++	}
++	if (matched || user_uid == 0) {
++	    SET(ret, VALIDATE_OK);
++	    CLR(ret, VALIDATE_NOT_OK);
++	    if (def_authenticate) {
++		switch (pwcheck) {
++		    case always:
++			SET(ret, FLAG_CHECK_USER);
++			break;
++		    case all:
++		    case any:
++			if (doauth == FALSE)
++			    def_authenticate = FALSE;
++			break;
++		    case never:
++			def_authenticate = FALSE;
++			break;
++		    default:
++			break;
++		}
++	    }
++	}
++	goto done;
++    }
++
++    DPRINTF(1, "searching SSSD/LDAP for sudoers entries");
++
++    setenv_implied = FALSE;
++    if (sres != NULL) {
++	 for (i = 0; i < sres->num_rules; i++) {
++	      rule = sres->rules + i;
++	      if (!sudo_sssd_check_runas(rule))
++		   continue;
++	      rc = sudo_sssd_check_command(rule, &setenv_implied);
++	      if (rc != UNSPEC) {
++		   /* We have a match. */
++		   DPRINTF(1, "Command %sallowed", rc == TRUE ? "" : "NOT ");
++		   if (rc == TRUE) {
++			DPRINTF(3, "SSSD rule: %p", rule);
++			/* Apply entry-specific options. */
++			if (setenv_implied)
++			     def_setenv = TRUE;
++			sudo_sssd_parse_options(rule);
++#ifdef HAVE_SELINUX
++			/* Set role and type if not specified on command line. */
++			if (user_role == NULL)
++			     user_role = def_role;
++			if (user_type == NULL)
++			     user_type = def_type;
++#endif /* HAVE_SELINUX */
++			SET(ret, VALIDATE_OK);
++			CLR(ret, VALIDATE_NOT_OK);
++		   } else {
++			SET(ret, VALIDATE_NOT_OK);
++			CLR(ret, VALIDATE_OK);
++		   }
++		   break;
++	      }
++	 }
++    }
++done:
++    DPRINTF(1, "Done with LDAP searches");
++
++    if (!ISSET(ret, VALIDATE_OK)) {
++	/* No matching entries. */
++	if (pwflag && list_pw == NULL)
++	    SET(ret, FLAG_NO_CHECK);
++    }
++
++    if (state & _SUDO_SSS_STATE_USERMATCH)
++	 CLR(ret, FLAG_NO_USER);
++    if (state & _SUDO_SSS_STATE_HOSTMATCH)
++	 CLR(ret, FLAG_NO_HOST);
++
++    DPRINTF(3, "sudo_sssd_lookup(%d)=0x%02x", pwflag, ret);
++
++    return ret;
++}
++
++static int sudo_sssd_display_cmnd(struct sudo_nss *nss, struct passwd *pw)
++{
++     struct sudo_sssd_handle *handle = nss->handle;
++     struct sss_result *sres = NULL;
++     struct sss_rule *rule;
++     int i, found = FALSE;
++
++     if (handle == NULL)
++	  goto done;
++
++     /*
++      * The sudo_sssd_result_get() function returns all nodes that match
++      * the user and the host.
++      */
++     DPRINTF(1, "sssd/ldap search for command list");
++     sres = sudo_sssd_result_get(nss, pw, NULL);
++
++     if (sres == NULL)
++	  goto done;
++
++     for (i = 0; i < sres->num_rules; i++) {
++	  rule = sres->rules + i;
++	  if (sudo_sssd_check_command(rule, NULL) &&
++	      sudo_sssd_check_runas(rule)) {
++	       found = TRUE;
++	       goto done;
++	  }
++     }
++
++done:
++     if (found)
++	  printf("%s%s%s\n", safe_cmnd ? safe_cmnd : user_cmnd,
++		 user_args ? " " : "", user_args ? user_args : "");
++
++     if (sres != NULL)
++	  sss_sudo_free_result(sres);
++
++     return !found;
++}
++
++static int sudo_sssd_display_defaults(struct sudo_nss *nss, struct passwd *pw,
++				      struct lbuf *lbuf)
++{
++     struct sudo_sssd_handle *handle = nss->handle;
++
++     struct sss_rule *rule;
++     struct sss_result *sres = NULL;
++
++     uint32_t serr = 0;
++
++     char *prefix, *val, **v_arr = NULL;
++     int count = 0, i, j;
++
++     if (handle == NULL)
++	  goto done;
++
++     if (sss_sudo_send_recv_defaults(&serr, &sres) != 0) {
++	  DPRINTF(2, "sss_sudo_send_recv_defaults: !=0, serr=%u", serr);
++	  goto done;
++     }
++
++     for (i = 0; i < sres->num_rules; ++i) {
++	  rule = sres->rules + i;
++
++	  switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++	  {
++	  case 0:
++	       break;
++	  case ENOENT:
++	       DPRINTF(2, "No result.");
++	       continue;
++	  default:
++	       DPRINTF(2, "sss_sudo_get_values: != 0");
++	       continue;
++	  }
++
++	  if (lbuf->len == 0 || isspace((unsigned char)lbuf->buf[lbuf->len - 1]))
++	       prefix = "    ";
++	  else
++	       prefix = ", ";
++
++	  for (j = 0; v_arr[j] != NULL; ++j) {
++	       val = v_arr[j];
++	       lbuf_append(lbuf, "%s%s", prefix, val);
++	       prefix = ", ";
++	       count++;
++	  }
++	  
++	  sss_sudo_free_values(v_arr);
++	  v_arr = NULL;
++     }
++
++     sss_sudo_free_result(sres);
++done:
++     return count;
++}
++
++// ok
++static int sudo_sssd_display_bound_defaults(struct sudo_nss *nss,
++					    struct passwd *pw, struct lbuf *lbuf)
++{
++     return 0;
++}
++
++static int sudo_sssd_display_entry_long(struct sss_rule *rule, struct lbuf *lbuf)
++{
++     char **v_arr = NULL;
++     int count = 0, i;
++
++#if 0 /* do we need this? */
++     char *rdn;
++     /* extract the dn, only show the first rdn */
++     rdn = sudo_ldap_get_first_rdn(ld, entry);
++     if (rdn != NULL)
++	  lbuf_append(lbuf, _("\nLDAP Role: %s\n"), rdn);
++     else
++	  lbuf_append(lbuf, _("\nLDAP Role: UNKNOWN\n"));
++     if (rdn)
++	  ldap_memfree(rdn);
++#endif
++
++     /* get the RunAsUser Values from the entry */
++     lbuf_append(lbuf, "    RunAsUsers: ");
++     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &v_arr))
++     {
++     case 0:
++	  for (i = 0; v_arr[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
++	  sss_sudo_free_values(v_arr);
++	  break;
++     case ENOENT:
++	  switch (sss_sudo_get_values(rule, "sudoRunAs", &v_arr))
++	  {
++	  case 0:
++	       for (i = 0; v_arr[i] != NULL; ++i)
++		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
++	       sss_sudo_free_values(v_arr);
++	       break;
++	  case ENOENT:
++	       DPRINTF(2, "No result.");
++	       lbuf_append(lbuf, "%s", def_runas_default);
++	       break;
++	  default:
++	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
++	       return count;
++	  }
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
++	  return count;
++     }
++     lbuf_append(lbuf, "\n");
++
++     /* get the RunAsGroup Values from the entry */
++     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &v_arr))
++     {
++     case 0:
++	  lbuf_append(lbuf, "    RunAsGroups: ");
++	  for (i = 0; v_arr[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
++	  sss_sudo_free_values(v_arr);
++	  lbuf_append(lbuf, "\n");
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
++	  return count;
++     }
++
++
++     /* get the Option Values from the entry */
++     switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++     {
++     case 0:
++	  lbuf_append(lbuf, "    Options: ");
++	  for (i = 0; v_arr[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
++	  sss_sudo_free_values(v_arr);
++	  lbuf_append(lbuf, "\n");
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
++	  return count;
++     }
++
++     /* Get the command values from the entry. */
++     switch (sss_sudo_get_values(rule, "sudoCommand", &v_arr)) {
++     case 0:
++	  lbuf_append(lbuf, _("    Commands:\n"));
++	  for (i = 0; v_arr[i] != NULL; ++i) {
++	       lbuf_append(lbuf, "\t%s\n", v_arr[i]);
++	       count++;
++	  }
++	  sss_sudo_free_values(v_arr);
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
++	  return count;
++     }
++
++     return count;
++}
++
++static int sudo_sssd_display_entry_short(struct sss_rule *rule, struct lbuf *lbuf)
++{
++     char **v_arr = NULL;
++     int count = 0, i;
++
++     lbuf_append(lbuf, "    (");
++
++     /* get the RunAsUser Values from the entry */
++     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &v_arr))
++     {
++     case 0:
++	  for (i = 0; v_arr[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
++	  sss_sudo_free_values(v_arr);
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result. Trying old style (sudoRunAs).");
++	  /* try old style */
++	  switch (sss_sudo_get_values(rule, "sudoRunAs", &v_arr))
++	  {
++	  case 0:
++	       for (i = 0; v_arr[i] != NULL; ++i)
++		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
++	       sss_sudo_free_values(v_arr);
++	       break;
++	  case ENOENT:
++	       DPRINTF(2, "No result.");
++	       lbuf_append(lbuf, "%s", def_runas_default);
++	       break;
++	  default:
++	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
++	       return count;
++	  }
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
++	  return count;
++     }
++
++     /* get the RunAsGroup Values from the entry */
++     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &v_arr))
++     {
++     case 0:
++	  lbuf_append(lbuf, " : ");
++	  for (i = 0; v_arr[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
++	  sss_sudo_free_values(v_arr);
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
++	  return count;
++     }
++
++     lbuf_append(lbuf, ") ");
++
++     /* get the Option Values from the entry */
++     switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++     {
++     case 0:
++	  for (i = 0; v_arr[i] != NULL; ++i) {
++	       char *cp = v_arr[i];
++	       if (*cp == '!')
++		    cp++;
++	       if (strcmp(cp, "authenticate") == 0)
++		    lbuf_append(lbuf, v_arr[i][0] == '!' ?
++				"NOPASSWD: " : "PASSWD: ");
++	       else if (strcmp(cp, "noexec") == 0)
++		    lbuf_append(lbuf, v_arr[i][0] == '!' ?
++				"EXEC: " : "NOEXEC: ");
++	       else if (strcmp(cp, "setenv") == 0)
++		    lbuf_append(lbuf, v_arr[i][0] == '!' ?
++				"NOSETENV: " : "SETENV: ");
++	  }
++
++	  sss_sudo_free_values(v_arr);
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
++	  return count;
++     }
++
++     /* get the Command Values from the entry */
++     switch (sss_sudo_get_values(rule, "sudoCommand", &v_arr)) {
++     case 0:
++	  for (i = 0; v_arr[i] != NULL; ++i) {
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
++	       count++;
++	  }
++	  sss_sudo_free_values(v_arr);
++	  break;
++     case ENOENT:
++	  DPRINTF(2, "No result.");
++	  break;
++     default:
++	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
++	  return count;
++     }
++     lbuf_append(lbuf, "\n");
++
++     return count;
++}
++
++static int sudo_sssd_display_privs(struct sudo_nss *nss, struct passwd *pw,
++				   struct lbuf *lbuf)
++{
++     struct sss_result *sres = NULL;
++     struct sss_rule *rule;
++     unsigned int i, count = 0;
++
++     DPRINTF(2, "sssd/ldap search for command list");
++
++     sres = sudo_sssd_result_get(nss, pw, NULL);
++
++     if (sres == NULL)
++	  return count;
++
++     /* Display all matching entries. */
++     for (i = 0; i < sres->num_rules; ++i) {
++	  rule = sres->rules + i;
++	  if (long_list)
++	       count += sudo_sssd_display_entry_long(rule, lbuf);
++	  else
++	       count += sudo_sssd_display_entry_short(rule, lbuf);
++     }
++
++     if (sres != NULL)
++	  sss_sudo_free_result(sres);
++
++     return count;
++}
+diff -up sudo-1.8.3p1/plugins/sudoers/sudo_nss.c.sssd-support sudo-1.8.3p1/plugins/sudoers/sudo_nss.c
+--- sudo-1.8.3p1/plugins/sudoers/sudo_nss.c.sssd-support	2012-01-18 18:21:10.155151843 +0100
++++ sudo-1.8.3p1/plugins/sudoers/sudo_nss.c	2012-01-18 18:29:40.366473444 +0100
+@@ -47,8 +47,11 @@ extern struct sudo_nss sudo_nss_file;
+ #ifdef HAVE_LDAP
+ extern struct sudo_nss sudo_nss_ldap;
+ #endif
++#ifdef HAVE_SSSD
++extern struct sudo_nss sudo_nss_sssd;
++#endif
+ 
+-#if defined(HAVE_LDAP) && defined(_PATH_NSSWITCH_CONF)
++#if (defined(HAVE_SSSD) || defined(HAVE_LDAP)) && defined(_PATH_NSSWITCH_CONF)
+ /*
+  * Read in /etc/nsswitch.conf
+  * Returns a tail queue of matches.
+@@ -60,6 +63,7 @@ sudo_read_nss(void)
+     char *cp;
+     int saw_files = FALSE;
+     int saw_ldap = FALSE;
++    int saw_sssd = FALSE;
+     int got_match = FALSE;
+     static struct sudo_nss_list snl;
+ 
+@@ -80,9 +84,16 @@ sudo_read_nss(void)
+ 	    if (strcasecmp(cp, "files") == 0 && !saw_files) {
+ 		tq_append(&snl, &sudo_nss_file);
+ 		got_match = TRUE;
++#if defined(HAVE_LDAP)
+ 	    } else if (strcasecmp(cp, "ldap") == 0 && !saw_ldap) {
+ 		tq_append(&snl, &sudo_nss_ldap);
+ 		got_match = TRUE;
++#endif
++#if defined(HAVE_SSSD)
++	    } else if (strcasecmp(cp, "sss") == 0 && !saw_sssd) {
++		tq_append(&snl, &sudo_nss_sssd);
++		got_match = TRUE;
++#endif
+ 	    } else if (strcasecmp(cp, "[NOTFOUND=return]") == 0 && got_match) {
+ 		/* NOTFOUND affects the most recent entry */
+ 		tq_last(&snl)->ret_if_notfound = TRUE;
+@@ -105,7 +116,7 @@ nomatch:
+ 
+ #else /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
+ 
+-# if defined(HAVE_LDAP) && defined(_PATH_NETSVC_CONF)
++# if (defined(HAVE_SSSD) || defined(HAVE_LDAP)) && defined(_PATH_NETSVC_CONF)
+ 
+ /*
+  * Read in /etc/netsvc.conf (like nsswitch.conf on AIX)
+@@ -118,6 +129,7 @@ sudo_read_nss(void)
+     char *cp, *ep;
+     int saw_files = FALSE;
+     int saw_ldap = FALSE;
++    int saw_sssd = FALSE;
+     int got_match = FALSE;
+     static struct sudo_nss_list snl;
+ 
+@@ -149,11 +161,20 @@ sudo_read_nss(void)
+ 		tq_append(&snl, &sudo_nss_file);
+ 		got_match = TRUE;
+ 		ep = &cp[5];
++#if defined(HAVE_LDAP)
+ 	    } else if (!saw_ldap && strncasecmp(cp, "ldap", 4) == 0 &&
+ 		(isspace((unsigned char)cp[4]) || cp[4] == '\0')) {
+ 		tq_append(&snl, &sudo_nss_ldap);
+ 		got_match = TRUE;
+ 		ep = &cp[4];
++#endif
++#if defined(HAVE_SSSD)
++	    } else if (!saw_sssd && strncasecmp(cp, "sss", 3) == 0 &&
++		(isspace((unsigned char)cp[3]) || cp[3] == '\0')) {
++		tq_append(&snl, &sudo_nss_sssd);
++		got_match = TRUE;
++		ep = &cp[3];
++#endif
+ 	    } else {
+ 		got_match = FALSE;
+ 	    }
diff --git a/sudo.spec b/sudo.spec
index 9724ad1..16ee6cf 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.3p1
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -20,6 +20,7 @@ BuildRequires: audit-libs-devel libcap-devel
 BuildRequires: libselinux-devel
 BuildRequires: sendmail
 BuildRequires: gettext
+BuildRequires: libsss_sudo-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
@@ -31,6 +32,8 @@ Patch3: sudo-1.7.4p3-m4path.patch
 Patch4: sudo-1.8.3-pipelist.patch
 # CVE-2012-0809
 Patch5: sudo-1.8.3p1-CVE-2012-0809.patch
+# SSSD support
+Patch6: sudo-1.8.3p1-sssd-support.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -60,6 +63,7 @@ plugins that use %{name}.
 %patch3 -p1 -b .m4path
 %patch4 -p1 -b .pipelist
 %patch5 -p1 -b .CVE-2012-0809
+%patch6 -p1 -b .sssd-support
 
 # Remove execute permission on this script so we don't pull in perl deps
 chmod -x plugins/sudoers/sudoers2ldif
@@ -91,7 +95,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --with-ldap \
 	--with-selinux \
 	--with-passprompt="[sudo] password for %p: " \
-	--with-linux-audit
+	--with-linux-audit	  \
+	--with-sssd
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -170,6 +175,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Tue Feb  7 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-4
+- added SSSD support
+
 * Thu Jan 26 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-3
 - added patch for CVE-2012-0809
 

From b27e499e8f566fc0d910e5b9de2be0a53f0b6c31 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Wed, 22 Feb 2012 11:27:43 +0100
Subject: [PATCH 064/199] SSSD patch update

---
 sudo-1.8.3p1-sssd-support.patch | 72 ++++++++++++++++-----------------
 sudo.spec                       |  5 ++-
 2 files changed, 40 insertions(+), 37 deletions(-)

diff --git a/sudo-1.8.3p1-sssd-support.patch b/sudo-1.8.3p1-sssd-support.patch
index ee1b68a..73af16b 100644
--- a/sudo-1.8.3p1-sssd-support.patch
+++ b/sudo-1.8.3p1-sssd-support.patch
@@ -48,7 +48,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/Makefile.in.sssd-support sudo-1.8.3p1/plug
              $(incdir)/alloc.h $(incdir)/list.h $(incdir)/fileops.h \
 diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/sudoers/sssd.c
 --- sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support	2012-01-19 13:41:51.885154296 +0100
-+++ sudo-1.8.3p1/plugins/sudoers/sssd.c	2012-02-07 12:22:37.641156963 +0100
++++ sudo-1.8.3p1/plugins/sudoers/sssd.c	2012-02-17 09:38:27.195588846 +0100
 @@ -0,0 +1,1157 @@
 +/*
 + * Copyright (c) 2003-2011 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -116,7 +116,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +static int sudo_sssd_open(struct sudo_nss *nss);
 +static int sudo_sssd_close(struct sudo_nss *nss);
 +static int sudo_sssd_parse(struct sudo_nss *nss);
-+static void sudo_sssd_parse_options(struct sss_rule *rule);
++static void sudo_sssd_parse_options(struct sss_sudo_rule *rule);
 +static int sudo_sssd_setdefs(struct sudo_nss *nss);
 +static int sudo_sssd_lookup(struct sudo_nss *nss, int ret, int pwflag);
 +static int sudo_sssd_display_cmnd(struct sudo_nss *nss, struct passwd *pw);
@@ -130,11 +130,11 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +				   struct lbuf *lbuf);
 +
 +
-+static struct sss_result *sudo_sssd_result_get(struct sudo_nss *nss,
++static struct sss_sudo_result *sudo_sssd_result_get(struct sudo_nss *nss,
 +					       struct passwd *pw,
 +					       uint32_t *state);
 +
-+static void sudo_sssd_attrcpy(struct sss_attr *dst, const struct sss_attr *src)
++static void sudo_sssd_attrcpy(struct sss_sudo_attr *dst, const struct sss_sudo_attr *src)
 +{
 +     int i;
 +
@@ -151,7 +151,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +     return;
 +}
 +
-+static void sudo_sssd_rulecpy(struct sss_rule *dst, const struct sss_rule *src)
++static void sudo_sssd_rulecpy(struct sss_sudo_rule *dst, const struct sss_sudo_rule *src)
 +{
 +     int i;
 +
@@ -159,7 +159,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +     DPRINTF(2, "emalloc: cnt=%d", src->num_attrs);
 +
 +     dst->num_attrs = src->num_attrs;
-+     dst->attrs = emalloc(sizeof(struct sss_attr) * dst->num_attrs);
++     dst->attrs = emalloc(sizeof(struct sss_sudo_attr) * dst->num_attrs);
 +
 +     for (i = 0; i < dst->num_attrs; ++i) {
 +	  sudo_sssd_attrcpy(dst->attrs + i,
@@ -173,9 +173,9 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +#define _SUDO_SSS_STATE_HOSTMATCH 0x01
 +#define _SUDO_SSS_STATE_USERMATCH 0x02
 +
-+static struct sss_result *sudo_sssd_filter_result(struct sss_result *in_res, int (*filterp)(struct sss_rule *, void *), int act, void *filterp_arg)
++static struct sss_sudo_result *sudo_sssd_filter_result(struct sss_sudo_result *in_res, int (*filterp)(struct sss_sudo_rule *, void *), int act, void *filterp_arg)
 +{
-+     struct sss_result *out_res;
++     struct sss_sudo_result *out_res;
 +     int i, l, r;
 +
 +     DPRINTF(3, "in_res=%p, count=%u, act=%s",
@@ -186,8 +186,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +
 +     DPRINTF(3, "emalloc: cnt=%d", in_res->num_rules);
 +
-+     out_res = emalloc(sizeof(struct sss_result));
-+     out_res->rules = in_res->num_rules > 0 ? emalloc(sizeof(struct sss_rule) * in_res->num_rules) : NULL;
++     out_res = emalloc(sizeof(struct sss_sudo_result));
++     out_res->rules = in_res->num_rules > 0 ? emalloc(sizeof(struct sss_sudo_rule) * in_res->num_rules) : NULL;
 +     out_res->num_rules = 0;
 +
 +     for (i = l = 0; i < in_res->num_rules; ++i) {
@@ -207,7 +207,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +
 +     if (l < in_res->num_rules) {
 +	  DPRINTF(3, "reallocating result: %p (count: %u -> %u)", out_res->rules, in_res->num_rules, l);
-+	  out_res->rules = realloc(out_res->rules, sizeof(struct sss_rule) * l);
++	  out_res->rules = realloc(out_res->rules, sizeof(struct sss_sudo_rule) * l);
 +     }
 +
 +     out_res->num_rules = l;
@@ -217,7 +217,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +
 +struct sudo_sssd_handle {
 +     char *username;
-+     struct sss_result *result;
++     struct sss_sudo_result *result;
 +     struct group_list *grlist;
 +};
 +
@@ -271,8 +271,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +{
 +     struct sudo_sssd_handle *handle = nss->handle;
 +
-+     struct sss_result *sres;
-+     struct sss_rule *rule;
++     struct sss_sudo_result *sres;
++     struct sss_sudo_rule *rule;
 +     uint32_t serr;
 +     int i;
 +
@@ -300,7 +300,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +}
 +
 +static int
-+sudo_sssd_check_runas_user(struct sss_rule *rule)
++sudo_sssd_check_runas_user(struct sss_sudo_rule *rule)
 +{
 +     char **v_arr = NULL;
 +     char *val;
@@ -403,7 +403,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +}
 +
 +static int
-+sudo_sssd_check_runas_group(struct sss_rule *rule)
++sudo_sssd_check_runas_group(struct sss_sudo_rule *rule)
 +{
 +     char **v_arr = NULL;
 +     char *val;
@@ -447,7 +447,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 + * else FALSE.  RunAs info is optional.
 + */
 +static int
-+sudo_sssd_check_runas(struct sss_rule *rule)
++sudo_sssd_check_runas(struct sss_sudo_rule *rule)
 +{
 +    int ret;
 +
@@ -460,7 +460,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +    return ret;
 +}
 +
-+static int sudo_sssd_check_host(struct sss_rule *rule)
++static int sudo_sssd_check_host(struct sss_sudo_rule *rule)
 +{
 +    char **v_arr, *val;
 +    int ret = FALSE, i;
@@ -500,7 +500,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +    return ret;
 +}
 +
-+static int sudo_sssd_result_filterp(struct sss_rule *rule, void *unused)
++static int sudo_sssd_result_filterp(struct sss_sudo_rule *rule, void *unused)
 +{
 +     (void)unused;
 +
@@ -510,12 +510,12 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  return 0;
 +}
 +
-+static struct sss_result *sudo_sssd_result_get(struct sudo_nss *nss,
++static struct sss_sudo_result *sudo_sssd_result_get(struct sudo_nss *nss,
 +					       struct passwd *pw,
 +					       uint32_t *state)
 +{
 +     struct sudo_sssd_handle *handle = nss->handle;
-+     struct sss_result *u_sres, *f_sres;
++     struct sss_sudo_result *u_sres, *f_sres;
 +     uint32_t serr = 0, ret;
 +
 +     DPRINTF(1, "pw_name=%s", pw->pw_name);
@@ -583,7 +583,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 + * Returns TRUE if found and allowed, FALSE if negated, else UNSPEC.
 + */
 +static int
-+sudo_sssd_check_bool(struct sss_rule *rule, char *option)
++sudo_sssd_check_bool(struct sss_sudo_rule *rule, char *option)
 +{
 +     char ch, *var, **v_arr = NULL;
 +     int i, ret = UNSPEC;
@@ -624,7 +624,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 + * FALSE if disallowed and UNSPEC if not matched.
 + */
 +static int
-+sudo_sssd_check_command(struct sss_rule *rule, int *setenv_implied)
++sudo_sssd_check_command(struct sss_sudo_rule *rule, int *setenv_implied)
 +{
 +     char **v_arr = NULL, *val;
 +     char *allowed_cmnd, *allowed_args;
@@ -641,7 +641,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  DPRINTF(2, "No result.");
 +	  return ret;
 +     default:
-+	  DPRINTF(2, "sss_sudo_get_values: != 0");
++	  DPRINTF(2, "sss_sudo_sudo_get_values: != 0");
 +	  return ret;
 +     }
 +
@@ -692,7 +692,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +}
 +
 +static void
-+sudo_sssd_parse_options(struct sss_rule *rule)
++sudo_sssd_parse_options(struct sss_sudo_rule *rule)
 +{
 +     int i;
 +     char op, *v, *val;
@@ -748,8 +748,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +{
 +    int rc, setenv_implied;
 +
-+    struct sss_result *sres = NULL;
-+    struct sss_rule   *rule;
++    struct sss_sudo_result *sres = NULL;
++    struct sss_sudo_rule   *rule;
 +    uint32_t i, state = 0;
 +
 +    /* Fetch list of sudoRole entries that match user and host. */
@@ -863,8 +863,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +static int sudo_sssd_display_cmnd(struct sudo_nss *nss, struct passwd *pw)
 +{
 +     struct sudo_sssd_handle *handle = nss->handle;
-+     struct sss_result *sres = NULL;
-+     struct sss_rule *rule;
++     struct sss_sudo_result *sres = NULL;
++     struct sss_sudo_rule *rule;
 +     int i, found = FALSE;
 +
 +     if (handle == NULL)
@@ -895,7 +895,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +		 user_args ? " " : "", user_args ? user_args : "");
 +
 +     if (sres != NULL)
-+	  sss_sudo_free_result(sres);
++	  sss_sudo_sudo_free_result(sres);
 +
 +     return !found;
 +}
@@ -905,8 +905,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +{
 +     struct sudo_sssd_handle *handle = nss->handle;
 +
-+     struct sss_rule *rule;
-+     struct sss_result *sres = NULL;
++     struct sss_sudo_rule *rule;
++     struct sss_sudo_result *sres = NULL;
 +
 +     uint32_t serr = 0;
 +
@@ -964,7 +964,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +     return 0;
 +}
 +
-+static int sudo_sssd_display_entry_long(struct sss_rule *rule, struct lbuf *lbuf)
++static int sudo_sssd_display_entry_long(struct sss_sudo_rule *rule, struct lbuf *lbuf)
 +{
 +     char **v_arr = NULL;
 +     int count = 0, i;
@@ -1071,7 +1071,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +     return count;
 +}
 +
-+static int sudo_sssd_display_entry_short(struct sss_rule *rule, struct lbuf *lbuf)
++static int sudo_sssd_display_entry_short(struct sss_sudo_rule *rule, struct lbuf *lbuf)
 +{
 +     char **v_arr = NULL;
 +     int count = 0, i;
@@ -1182,8 +1182,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +static int sudo_sssd_display_privs(struct sudo_nss *nss, struct passwd *pw,
 +				   struct lbuf *lbuf)
 +{
-+     struct sss_result *sres = NULL;
-+     struct sss_rule *rule;
++     struct sss_sudo_result *sres = NULL;
++     struct sss_sudo_rule *rule;
 +     unsigned int i, count = 0;
 +
 +     DPRINTF(2, "sssd/ldap search for command list");
diff --git a/sudo.spec b/sudo.spec
index 16ee6cf..9c36d16 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.3p1
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -175,6 +175,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Wed Feb 22 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-5
+- SSSD patch update
+
 * Tue Feb  7 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-4
 - added SSSD support
 

From 6b548c85a833a64702647ba94f3f19a1eb3b9f90 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Wed, 29 Feb 2012 10:20:33 +0100
Subject: [PATCH 065/199] fixed problems with undefined symbols (rhbz#798517)

---
 sudo-1.8.3p1-sssd-support.patch | 6 +++---
 sudo.spec                       | 5 ++++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/sudo-1.8.3p1-sssd-support.patch b/sudo-1.8.3p1-sssd-support.patch
index 73af16b..7e510bc 100644
--- a/sudo-1.8.3p1-sssd-support.patch
+++ b/sudo-1.8.3p1-sssd-support.patch
@@ -48,7 +48,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/Makefile.in.sssd-support sudo-1.8.3p1/plug
              $(incdir)/alloc.h $(incdir)/list.h $(incdir)/fileops.h \
 diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/sudoers/sssd.c
 --- sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support	2012-01-19 13:41:51.885154296 +0100
-+++ sudo-1.8.3p1/plugins/sudoers/sssd.c	2012-02-17 09:38:27.195588846 +0100
++++ sudo-1.8.3p1/plugins/sudoers/sssd.c	2012-02-29 10:05:49.169875120 +0100
 @@ -0,0 +1,1157 @@
 +/*
 + * Copyright (c) 2003-2011 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -641,7 +641,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  DPRINTF(2, "No result.");
 +	  return ret;
 +     default:
-+	  DPRINTF(2, "sss_sudo_sudo_get_values: != 0");
++	  DPRINTF(2, "sss_sudo_get_values: != 0");
 +	  return ret;
 +     }
 +
@@ -895,7 +895,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +		 user_args ? " " : "", user_args ? user_args : "");
 +
 +     if (sres != NULL)
-+	  sss_sudo_sudo_free_result(sres);
++	  sss_sudo_free_result(sres);
 +
 +     return !found;
 +}
diff --git a/sudo.spec b/sudo.spec
index 9c36d16..6754250 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.3p1
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -175,6 +175,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Wed Fed 29 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-6
+- fixed problems with undefined symbols (rhbz#798517)
+
 * Wed Feb 22 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-5
 - SSSD patch update
 

From 74fe5b93c487793211fff95d45a283819877074e Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Wed, 29 Feb 2012 10:21:41 +0100
Subject: [PATCH 066/199] Fixed a typo in the spec file

---
 sudo.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 6754250..444c68d 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -175,7 +175,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
-* Wed Fed 29 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-6
+* Wed Feb 29 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-6
 - fixed problems with undefined symbols (rhbz#798517)
 
 * Wed Feb 22 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-5

From 86c7e6867befb1f96d245d483819f0a7b6441ecd Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 17 May 2012 12:51:44 +0200
Subject: [PATCH 067/199] update to 1.8.5

- fixed CVE-2012-2337
- temporarily disabled SSSD support
---
 sudo-1.8.1p2-getgrouplist.patch               |  44 -
 sudo-1.8.3-pipelist.patch                     |  28 -
 sudo-1.8.3p1-CVE-2012-0809.patch              |  23 -
 sudo-1.8.5-pipelist.patch                     |  29 +
 ...ort.patch => sudo-1.8.5-sssd-support.patch | 837 +++++++++---------
 sudo.spec                                     |  26 +-
 6 files changed, 480 insertions(+), 507 deletions(-)
 delete mode 100644 sudo-1.8.1p2-getgrouplist.patch
 delete mode 100644 sudo-1.8.3-pipelist.patch
 delete mode 100644 sudo-1.8.3p1-CVE-2012-0809.patch
 create mode 100644 sudo-1.8.5-pipelist.patch
 rename sudo-1.8.3p1-sssd-support.patch => sudo-1.8.5-sssd-support.patch (52%)

diff --git a/sudo-1.8.1p2-getgrouplist.patch b/sudo-1.8.1p2-getgrouplist.patch
deleted file mode 100644
index 6ccfe5e..0000000
--- a/sudo-1.8.1p2-getgrouplist.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff -up sudo-1.8.1p2/configure.in.getgrouplist sudo-1.8.1p2/configure.in
---- sudo-1.8.1p2/configure.in.getgrouplist	2011-07-12 12:13:29.562597933 +0200
-+++ sudo-1.8.1p2/configure.in	2011-07-12 12:15:27.116597851 +0200
-@@ -2007,7 +2007,7 @@ dnl
- AC_FUNC_GETGROUPS
- AC_CHECK_FUNCS(strrchr sysconf tzset strftime initgroups getgroups fstat \
- 	       regcomp setlocale nl_langinfo getaddrinfo mbr_check_membership \
--	       setrlimit64 sysctl)
-+	       setrlimit64 sysctl getgrouplist)
- AC_CHECK_FUNCS(getline, [], [
-     AC_LIBOBJ(getline)
-     AC_CHECK_FUNCS(fgetln)
-diff -up sudo-1.8.1p2/plugins/sudoers/pwutil.c.getgrouplist sudo-1.8.1p2/plugins/sudoers/pwutil.c
---- sudo-1.8.1p2/plugins/sudoers/pwutil.c.getgrouplist	2011-07-12 12:13:17.346597942 +0200
-+++ sudo-1.8.1p2/plugins/sudoers/pwutil.c	2011-07-12 12:19:02.171597700 +0200
-@@ -711,6 +711,28 @@ user_in_group(struct passwd *pw, const c
-     }
- #endif /* HAVE_MBR_CHECK_MEMBERSHIP */
- 
-+#ifdef HAVE_GETGROUPLIST
-+    if (user_ngroups >= 0 &&
-+       strcmp(pw->pw_name, list_pw ? list_pw->pw_name : user_name) == 0)
-+    {
-+       gid_t *grouplist, grouptmp;
-+       int n_groups, i;
-+       n_groups = 1;
-+
-+       if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
-+           grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
-+           if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
-+               for (i = 0; i < n_groups; i++)
-+                   if (grouplist[i] == grp->gr_gid) {
-+                       free(grouplist);
-+                       retval = TRUE;
-+                       goto done;
-+                   }
-+           free(grouplist);
-+       }
-+    }
-+#endif /* HAVE_GETGROUPLIST */
-+
- done:
-     if (grp != NULL)
- 	gr_delref(grp);
diff --git a/sudo-1.8.3-pipelist.patch b/sudo-1.8.3-pipelist.patch
deleted file mode 100644
index e976f0e..0000000
--- a/sudo-1.8.3-pipelist.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff -up sudo-1.8.3/src/ttysize.c.pipelist sudo-1.8.3/src/ttysize.c
---- sudo-1.8.3/src/ttysize.c.pipelist	2011-10-21 15:01:26.000000000 +0200
-+++ sudo-1.8.3/src/ttysize.c	2011-10-26 02:09:39.582790562 +0200
-@@ -20,6 +20,7 @@
- 
- #include <sys/types.h>
- #include <sys/ioctl.h>
-+#include <sys/stat.h>
- #include <stdio.h>
- #ifdef STDC_HEADERS
- # include <stdlib.h>
-@@ -48,6 +49,16 @@ void
- get_ttysize(int *rowp, int *colp)
- {
-     char *p;
-+    struct stat st;
-+
-+    if (fstat(STDOUT_FILENO, &st) == 0) {
-+	 if (S_ISFIFO(st.st_mode)) {
-+	   *rowp = 0;
-+	   *colp = 0;
-+	   return;
-+	 }
-+    }
-+
- #ifdef TIOCGWINSZ
-     struct winsize wsize;
- 
diff --git a/sudo-1.8.3p1-CVE-2012-0809.patch b/sudo-1.8.3p1-CVE-2012-0809.patch
deleted file mode 100644
index 8010808..0000000
--- a/sudo-1.8.3p1-CVE-2012-0809.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- sudo-1.8.3p1/src/sudo.c	Fri Oct 21 09:01:26 2011
-+++ sudo-1.8.3p1/src/sudo.c	Tue Jan 24 15:59:03 2012
-@@ -1208,15 +1208,15 @@ 
- sudo_debug(int level, const char *fmt, ...)
- {
-     va_list ap;
--    char *fmt2;
-+    char *buf;
- 
-     if (level > debug_level)
- 	return;
- 
--    /* Backet fmt with program name and a newline to make it a single write */
--    easprintf(&fmt2, "%s: %s\n", getprogname(), fmt);
-+    /* Bracket fmt with program name and a newline to make it a single write */
-     va_start(ap, fmt);
--    vfprintf(stderr, fmt2, ap);
-+    evasprintf(&buf, fmt, ap);
-     va_end(ap);
--    efree(fmt2);
-+    fprintf(stderr, "%s: %s\n", getprogname(), buf);
-+    efree(buf);
- }
diff --git a/sudo-1.8.5-pipelist.patch b/sudo-1.8.5-pipelist.patch
new file mode 100644
index 0000000..ba587fa
--- /dev/null
+++ b/sudo-1.8.5-pipelist.patch
@@ -0,0 +1,29 @@
+diff -up sudo-1.8.5rc5/common/ttysize.c.pipelist sudo-1.8.5rc5/common/ttysize.c
+--- sudo-1.8.5rc5/common/ttysize.c.pipelist	2012-04-06 21:43:19.000000000 +0200
++++ sudo-1.8.5rc5/common/ttysize.c	2012-05-16 13:03:17.184034854 +0200
+@@ -20,6 +20,7 @@
+ 
+ #include <sys/types.h>
+ #include <sys/ioctl.h>
++#include <sys/stat.h>
+ #include <stdio.h>
+ #ifdef STDC_HEADERS
+ # include <stdlib.h>
+@@ -71,8 +72,17 @@ get_ttysize_ioctl(int *rowp, int *colp)
+ void
+ get_ttysize(int *rowp, int *colp)
+ {
++    struct stat st;
+     debug_decl(fork_cmnd, SUDO_DEBUG_EXEC)
+ 
++    if (fstat(STDOUT_FILENO, &st) == 0) {
++	 if (S_ISFIFO(st.st_mode)) {
++	   *rowp = 0;
++	   *colp = 0;
++	   return;
++	 }
++    }
++
+     if (get_ttysize_ioctl(rowp, colp) == -1) {
+ 	char *p;
+ 
diff --git a/sudo-1.8.3p1-sssd-support.patch b/sudo-1.8.5-sssd-support.patch
similarity index 52%
rename from sudo-1.8.3p1-sssd-support.patch
rename to sudo-1.8.5-sssd-support.patch
index 7e510bc..78602af 100644
--- a/sudo-1.8.3p1-sssd-support.patch
+++ b/sudo-1.8.5-sssd-support.patch
@@ -1,7 +1,7 @@
-diff -up sudo-1.8.3p1/configure.in.sssd-support sudo-1.8.3p1/configure.in
---- sudo-1.8.3p1/configure.in.sssd-support	2012-01-11 19:27:02.604019550 +0100
-+++ sudo-1.8.3p1/configure.in	2012-01-12 16:28:48.031171923 +0100
-@@ -275,6 +275,22 @@ AC_ARG_WITH(linux-audit, [AS_HELP_STRING
+diff -up sudo-1.8.5/configure.in.sssd-support sudo-1.8.5/configure.in
+--- sudo-1.8.5/configure.in.sssd-support	2012-05-17 10:30:40.796975447 +0200
++++ sudo-1.8.5/configure.in	2012-05-17 10:30:40.813975145 +0200
+@@ -284,6 +284,22 @@ AC_ARG_WITH(linux-audit, [AS_HELP_STRING
  		;;
  esac])
  
@@ -24,7 +24,7 @@ diff -up sudo-1.8.3p1/configure.in.sssd-support sudo-1.8.3p1/configure.in
  AC_ARG_WITH(incpath, [AS_HELP_STRING([--with-incpath], [additional places to look for include files])],
  [case $with_incpath in
      yes)	AC_MSG_ERROR(["must give --with-incpath an argument."])
-@@ -3157,6 +3173,7 @@ AH_TEMPLATE(HAVE_LBER_H, [Define to 1 if
+@@ -3331,6 +3347,7 @@ AH_TEMPLATE(HAVE_LBER_H, [Define to 1 if
  AH_TEMPLATE(HAVE_LDAP, [Define to 1 if you use LDAP for sudoers.])
  AH_TEMPLATE(HAVE_LIBINTL_H, [Define to 1 if you have the <libintl.h> header file.])
  AH_TEMPLATE(HAVE_LINUX_AUDIT, [Define to 1 to enable Linux audit support.])
@@ -32,24 +32,24 @@ diff -up sudo-1.8.3p1/configure.in.sssd-support sudo-1.8.3p1/configure.in
  AH_TEMPLATE(HAVE_OPIE, [Define to 1 if you use NRL OPIE.])
  AH_TEMPLATE(HAVE_PAM, [Define to 1 if you use PAM authentication.])
  AH_TEMPLATE(HAVE_PAM_LOGIN, [Define to 1 if you use a specific PAM session for sudo -i.])
-diff -up sudo-1.8.3p1/plugins/sudoers/Makefile.in.sssd-support sudo-1.8.3p1/plugins/sudoers/Makefile.in
---- sudo-1.8.3p1/plugins/sudoers/Makefile.in.sssd-support	2012-01-11 19:27:23.016032415 +0100
-+++ sudo-1.8.3p1/plugins/sudoers/Makefile.in	2012-01-12 16:35:00.527406716 +0100
-@@ -530,6 +530,10 @@ linux_audit.lo: $(srcdir)/linux_audit.c 
-                 $(incdir)/missing.h $(incdir)/error.h $(incdir)/alloc.h \
-                 $(incdir)/gettext.h $(srcdir)/linux_audit.h
+diff -up sudo-1.8.5/plugins/sudoers/Makefile.in.sssd-support sudo-1.8.5/plugins/sudoers/Makefile.in
+--- sudo-1.8.5/plugins/sudoers/Makefile.in.sssd-support	2012-05-15 18:22:02.000000000 +0200
++++ sudo-1.8.5/plugins/sudoers/Makefile.in	2012-05-17 10:30:40.815975110 +0200
+@@ -574,6 +574,10 @@ linux_audit.lo: $(srcdir)/linux_audit.c
+                 $(incdir)/gettext.h $(incdir)/sudo_debug.h \
+                 $(srcdir)/linux_audit.h
  	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(srcdir)/linux_audit.c
 +sssd.lo: $(srcdir)/sssd.c $(top_builddir)/config.h \
-+          $(incdir)/missing.h $(incdir)/error.h $(incdir)/alloc.h \
-+          $(incdir)/gettext.h
++         $(incdir)/missing.h $(incdir)/error.h $(incdir)/alloc.h \
++         $(incdir)/gettext.h
 +	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(srcdir)/sssd.c
  logging.lo: $(srcdir)/logging.c $(top_builddir)/config.h $(srcdir)/sudoers.h \
-             $(top_builddir)/pathnames.h $(incdir)/missing.h $(incdir)/error.h \
-             $(incdir)/alloc.h $(incdir)/list.h $(incdir)/fileops.h \
-diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/sudoers/sssd.c
---- sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support	2012-01-19 13:41:51.885154296 +0100
-+++ sudo-1.8.3p1/plugins/sudoers/sssd.c	2012-02-29 10:05:49.169875120 +0100
-@@ -0,0 +1,1157 @@
+             $(top_srcdir)/compat/stdbool.h $(top_builddir)/pathnames.h \
+             $(incdir)/missing.h $(incdir)/error.h $(incdir)/alloc.h \
+diff -up sudo-1.8.5/plugins/sudoers/sssd.c.sssd-support sudo-1.8.5/plugins/sudoers/sssd.c
+--- sudo-1.8.5/plugins/sudoers/sssd.c.sssd-support	2012-05-17 10:30:40.817975074 +0200
++++ sudo-1.8.5/plugins/sudoers/sssd.c	2012-05-17 10:58:10.775036464 +0200
+@@ -0,0 +1,1194 @@
 +/*
 + * Copyright (c) 2003-2011 Todd C. Miller <Todd.Miller@courtesan.com>
 + * Copyright (c) 2011 Daniel Kopecek <dkopecek@redhat.com>
@@ -106,6 +106,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +#include "sudoers.h"
 +#include "parse.h"
 +#include "lbuf.h"
++#include "sudo_debug.h"
 +
 +extern int debug_level;
 +#define __sssd_debug debug_level
@@ -113,30 +114,31 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +#define	DPRINTF(level, fmt, ...) if (__sssd_debug >= (level)) warningx("%s:%d: "fmt, __PRETTY_FUNCTION__, __LINE__, ##__VA_ARGS__)
 +
 +/* sudo_nss implementation */
-+static int sudo_sssd_open(struct sudo_nss *nss);
-+static int sudo_sssd_close(struct sudo_nss *nss);
-+static int sudo_sssd_parse(struct sudo_nss *nss);
-+static void sudo_sssd_parse_options(struct sss_sudo_rule *rule);
-+static int sudo_sssd_setdefs(struct sudo_nss *nss);
-+static int sudo_sssd_lookup(struct sudo_nss *nss, int ret, int pwflag);
-+static int sudo_sssd_display_cmnd(struct sudo_nss *nss, struct passwd *pw);
-+static int sudo_sssd_display_defaults(struct sudo_nss *nss, struct passwd *pw,
++static int sudo_sss_open(struct sudo_nss *nss);
++static int sudo_sss_close(struct sudo_nss *nss);
++static int sudo_sss_parse(struct sudo_nss *nss);
++static void sudo_sss_parse_options(struct sss_sudo_rule *rule);
++static int sudo_sss_setdefs(struct sudo_nss *nss);
++static int sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag);
++static int sudo_sss_display_cmnd(struct sudo_nss *nss, struct passwd *pw);
++static int sudo_sss_display_defaults(struct sudo_nss *nss, struct passwd *pw,
 +				      struct lbuf *lbuf);
 +
-+static int sudo_sssd_display_bound_defaults(struct sudo_nss *nss,
++static int sudo_sss_display_bound_defaults(struct sudo_nss *nss,
 +					    struct passwd *pw, struct lbuf *lbuf);
 +
-+static int sudo_sssd_display_privs(struct sudo_nss *nss, struct passwd *pw,
++static int sudo_sss_display_privs(struct sudo_nss *nss, struct passwd *pw,
 +				   struct lbuf *lbuf);
 +
 +
-+static struct sss_sudo_result *sudo_sssd_result_get(struct sudo_nss *nss,
++static struct sss_sudo_result *sudo_sss_result_get(struct sudo_nss *nss,
 +					       struct passwd *pw,
 +					       uint32_t *state);
 +
-+static void sudo_sssd_attrcpy(struct sss_sudo_attr *dst, const struct sss_sudo_attr *src)
++static void sudo_sss_attrcpy(struct sss_sudo_attr *dst, const struct sss_sudo_attr *src)
 +{
 +     int i;
++     debug_decl(sudo_sss_attrcpy, SUDO_DEBUG_LDAP)
 +
 +     DPRINTF(3, "dst=%p, src=%p", dst, src);
 +     DPRINTF(2, "emalloc: cnt=%d", src->num_values);
@@ -148,13 +150,14 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +     for (i = 0; i < dst->num_values; ++i)
 +	  dst->values[i] = strdup(src->values[i]);
 +
-+     return;
++     debug_return;
 +}
 +
-+static void sudo_sssd_rulecpy(struct sss_sudo_rule *dst, const struct sss_sudo_rule *src)
++static void sudo_sss_rulecpy(struct sss_sudo_rule *dst, const struct sss_sudo_rule *src)
 +{
 +     int i;
-+
++     debug_decl(sudo_sss_rulecpy, SUDO_DEBUG_LDAP)
++     
 +     DPRINTF(3, "dst=%p, src=%p", dst, src);
 +     DPRINTF(2, "emalloc: cnt=%d", src->num_attrs);
 +
@@ -162,9 +165,11 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +     dst->attrs = emalloc(sizeof(struct sss_sudo_attr) * dst->num_attrs);
 +
 +     for (i = 0; i < dst->num_attrs; ++i) {
-+	  sudo_sssd_attrcpy(dst->attrs + i,
++	  sudo_sss_attrcpy(dst->attrs + i,
 +			    src->attrs + i);
 +     }
++
++     debug_return;
 +}
 +
 +#define _SUDO_SSS_FILTER_INCLUDE 0
@@ -173,16 +178,17 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +#define _SUDO_SSS_STATE_HOSTMATCH 0x01
 +#define _SUDO_SSS_STATE_USERMATCH 0x02
 +
-+static struct sss_sudo_result *sudo_sssd_filter_result(struct sss_sudo_result *in_res, int (*filterp)(struct sss_sudo_rule *, void *), int act, void *filterp_arg)
++static struct sss_sudo_result *sudo_sss_filter_result(struct sss_sudo_result *in_res, int (*filterp)(struct sss_sudo_rule *, void *), int act, void *filterp_arg)
 +{
 +     struct sss_sudo_result *out_res;
 +     int i, l, r;
++     debug_decl(sudo_sss_filter_result, SUDO_DEBUG_LDAP)
 +
 +     DPRINTF(3, "in_res=%p, count=%u, act=%s",
 +	     in_res, in_res->num_rules, act == _SUDO_SSS_FILTER_EXCLUDE ? "EXCLUDE" : "INCLUDE");
 +
 +     if (in_res == NULL)
-+	  return NULL;
++       debug_return_ptr(NULL);
 +
 +     DPRINTF(3, "emalloc: cnt=%d", in_res->num_rules);
 +
@@ -200,7 +206,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +		       act == _SUDO_SSS_FILTER_EXCLUDE ? "not excluded" : "included",
 +		       in_res->rules, i, out_res->rules, l, in_res->rules + i);
 +
-+	       sudo_sssd_rulecpy(out_res->rules + l, in_res->rules + i);
++	       sudo_sss_rulecpy(out_res->rules + l, in_res->rules + i);
 +	       ++l;
 +	  }
 +     }
@@ -212,106 +218,125 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +
 +     out_res->num_rules = l;
 +
-+     return out_res;
++     debug_return_ptr(out_res);
 +}
 +
-+struct sudo_sssd_handle {
-+     char *username;
-+     struct sss_sudo_result *result;
-+     struct group_list *grlist;
++struct sudo_sss_handle {
++     char *domainname;
++     struct passwd *pw;
 +};
 +
-+struct sudo_nss sudo_nss_sssd = {
-+    &sudo_nss_sssd,
++struct sudo_nss sudo_nss_sss = {
++    &sudo_nss_sss,
 +    NULL,
-+    sudo_sssd_open,
-+    sudo_sssd_close,
-+    sudo_sssd_parse,
-+    sudo_sssd_setdefs,
-+    sudo_sssd_lookup,
-+    sudo_sssd_display_cmnd,
-+    sudo_sssd_display_defaults,
-+    sudo_sssd_display_bound_defaults,
-+    sudo_sssd_display_privs
++    sudo_sss_open,
++    sudo_sss_close,
++    sudo_sss_parse,
++    sudo_sss_setdefs,
++    sudo_sss_lookup,
++    sudo_sss_display_cmnd,
++    sudo_sss_display_defaults,
++    sudo_sss_display_bound_defaults,
++    sudo_sss_display_privs
 +};
 +
-+
 +/* sudo_nss implementation */
 +// ok
-+static int sudo_sssd_open(struct sudo_nss *nss)
++static int sudo_sss_open(struct sudo_nss *nss)
 +{
-+     struct sudo_sssd_handle *handle;
++     struct sudo_sss_handle *handle;
++     debug_decl(sudo_sss_open, SUDO_DEBUG_LDAP);
 +
 +     /* Create a handle container. */
-+     handle = emalloc(sizeof(struct sudo_sssd_handle));
-+     handle->result = NULL;
-+     handle->username = NULL;
-+     handle->grlist = NULL;
++     handle = emalloc(sizeof(struct sudo_sss_handle));
++     handle->domainname = NULL;
++     handle->pw = sudo_user.pw;
 +     nss->handle = handle;
 +
 +     DPRINTF(3, "handle=%p", handle);
 +
-+     return 0;
++     debug_return_int(0);
 +}
 +
 +// ok
-+static int sudo_sssd_close(struct sudo_nss *nss)
++static int sudo_sss_close(struct sudo_nss *nss)
 +{
++     debug_decl(sudo_sss_close, SUDO_DEBUG_LDAP);
 +     efree(nss->handle);
-+     return 0;
++     debug_return_int(0);
 +}
 +
 +// ok
-+static int sudo_sssd_parse(struct sudo_nss *nss)
++static int sudo_sss_parse(struct sudo_nss *nss)
 +{
-+     return 0;
++     debug_decl(sudo_sss_parse, SUDO_DEBUG_LDAP);
++     debug_return_int(0);
 +}
 +
-+static int sudo_sssd_setdefs(struct sudo_nss *nss)
++static int sudo_sss_setdefs(struct sudo_nss *nss)
 +{
-+     struct sudo_sssd_handle *handle = nss->handle;
++     struct sudo_sss_handle *handle = nss->handle;
 +
-+     struct sss_sudo_result *sres;
-+     struct sss_sudo_rule *rule;
-+     uint32_t serr;
++     struct sss_sudo_result *sss_result;
++     struct sss_sudo_rule   *sss_rule;
++     uint32_t sss_error;
 +     int i;
++     debug_decl(sudo_sss_setdefs, SUDO_DEBUG_LDAP);
 +
 +     if (handle == NULL)
-+	  return -1;
++	  debug_return_int(-1);
 +
 +     DPRINTF(1, "Looking for cn=defaults");
 +
-+     if (sss_sudo_send_recv_defaults(&serr, &sres) != 0) {
-+	  DPRINTF(2, "sss_sudo_send_recv_defaults: != 0, serr=%u", serr);
-+	  return -1;
++     if (sss_sudo_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
++				     &sss_error, &handle->domainname,
++				     &sss_result) != 0)
++     {
++	  DPRINTF(2, "sss_sudo_send_recv_defaults: != 0, sss_error=%u", sss_error);
++	  debug_return_int(-1);
 +     }
 +
-+     for (i = 0; i < sres->num_rules; ++i) {
-+	  DPRINTF(1, "Parsing cn=defaults, %d/%d", i, sres->num_rules);
-+	  rule = sres->rules + i;
-+	  sudo_sssd_parse_options(rule);
++     for (i = 0; i < sss_result->num_rules; ++i) {
++	  DPRINTF(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
++	  sss_rule = sss_result->rules + i;
++	  sudo_sss_parse_options(sss_rule);
 +     }
 +
-+     sss_sudo_free_result(sres);
++     sss_sudo_free_result(sss_result);
++     debug_return_int(0);
++}
 +
-+     DPRINTF(1, "Looking for cn=defaults... end");
++static int sudo_sss_checkpw(struct sudo_nss *nss, struct passwd *pw)
++{
++     struct sudo_sss_handle *handle = nss->handle;
++     debug_decl(sudo_sss_checkpw, SUDO_DEBUG_LDAP);
 +
-+     return 0;
++     if (pw->pw_name != handle->pw->pw_name ||
++	 pw->pw_uid  != handle->pw->pw_uid)
++     {
++	  DPRINTF(1, "Requested name or uid don't match the initial once, reinitializing...");
++	  handle->pw = pw;
++
++	  if (sudo_sss_setdefs(nss) != 0)
++	       debug_return_int(-1);
++     }
++
++     debug_return_int(0);
 +}
 +
 +static int
-+sudo_sssd_check_runas_user(struct sss_sudo_rule *rule)
++sudo_sss_check_runas_user(struct sss_sudo_rule *sss_rule)
 +{
-+     char **v_arr = NULL;
++     char **val_array = NULL;
 +     char *val;
-+     int ret = FALSE, i;
++     int ret = false, i;
++     debug_decl(sudo_sss_check_runas_user, SUDO_DEBUG_LDAP);
 +
 +     if (!runas_pw)
-+	  return UNSPEC;
-+
++	  debug_return_int(UNSPEC);
 +
 +     /* get the runas user from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &v_arr)) 
++     switch (sss_sudo_get_values(sss_rule, "sudoRunAsUser", &val_array)) 
 +     {
 +     case 0:
 +	  break;
@@ -319,7 +344,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  DPRINTF(2, "No result. Trying old style (sudoRunAs)");
 +
 +	  /* try old style */
-+	  switch (sss_sudo_get_values(rule, "sudoRunAs", &v_arr))
++	  switch (sss_sudo_get_values(sss_rule, "sudoRunAs", &val_array))
 +	  {
 +	  case 0:
 +	       break;
@@ -332,12 +357,12 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	       return !strcasecmp(runas_pw->pw_name, def_runas_default);
 +	  default:
 +	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       return UNSPEC;
++	       debug_return_int(UNSPEC);
 +	  }
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  return UNSPEC;
++	  debug_return_int(UNSPEC);
 +     }
 +
 +     /*
@@ -358,8 +383,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +      */
 +
 +     /* walk through values returned, looking for a match */
-+     for (i = 0; v_arr[i] != NULL && !ret; ++i) {
-+	  val = v_arr[i];
++     for (i = 0; val_array[i] != NULL && !ret; ++i) {
++	  val = val_array[i];
 +
 +	  DPRINTF(3, "val[%d]=%s", i, val);
 +
@@ -368,20 +393,20 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	       DPRINTF(3, "netgr_");
 +	       if (netgr_matches(val, NULL, NULL, runas_pw->pw_name)) {
 +		    DPRINTF(3, "=> match");
-+		    ret = TRUE;
++		    ret = true;
 +	       }
 +	       break;
 +	  case '%':
 +	       DPRINTF(3, "usergr_");
 +	       if (usergr_matches(val, runas_pw->pw_name, runas_pw)) {
 +		    DPRINTF(3, "=> match");
-+		    ret = TRUE;
++		    ret = true;
 +	       }
 +	       break;
 +	  case 'A':
 +	       if (strcmp(val, "ALL") == 0) {
 +		    DPRINTF(3, "ALL => match");
-+		    ret = TRUE;
++		    ret = true;
 +		    break;
 +	       }
 +	       /* FALLTHROUGH */
@@ -389,7 +414,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  default:
 +	       if (strcasecmp(val, runas_pw->pw_name) == 0) {
 +		    DPRINTF(3, "%s == %s (pw_name) => match", val, runas_pw->pw_name);
-+		    ret = TRUE;
++		    ret = true;
 +	       }
 +	       break;
 +	  }
@@ -397,215 +422,214 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  DPRINTF(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
 +     }
 +
-+     sss_sudo_free_values(v_arr); /* cleanup */
++     sss_sudo_free_values(val_array); /* cleanup */
 +
-+     return ret;
++     debug_return_int(ret);
 +}
 +
 +static int
-+sudo_sssd_check_runas_group(struct sss_sudo_rule *rule)
++sudo_sss_check_runas_group(struct sss_sudo_rule *rule)
 +{
-+     char **v_arr = NULL;
++     char **val_array = NULL;
 +     char *val;
-+     int ret = FALSE, i;
++     int ret = false, i;
++     debug_decl(sudo_sss_check_runas_group, SUDO_DEBUG_LDAP);
 +
 +     /* runas_gr is only set if the user specified the -g flag */
 +     if (!runas_gr)
-+	  return UNSPEC;
++	  debug_return_int(UNSPEC);
 +
 +     /* get the values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
 +     {
 +     case 0:
 +	  break;
 +     case ENOENT:
 +	  DPRINTF(2, "No result.");
-+	  return FALSE;
++	  debug_return_int(false);
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  return UNSPEC;
++	  debug_return_int(UNSPEC);
 +     }
 +
 +     /* walk through values returned, looking for a match */
-+     for (i = 0; v_arr[i] != NULL; ++i) {
-+	  val = v_arr[i];
++     for (i = 0; val_array[i] != NULL; ++i) {
++	  val = val_array[i];
 +	  DPRINTF(3, "val[%d]=%s", i, val);
 +
 +	  if (strcmp(val, "ALL") == 0 || group_matches(val, runas_gr))
-+	       ret = TRUE;
++	       ret = true;
 +
 +	  DPRINTF(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
 +     }
 +
-+     sss_sudo_free_values(v_arr);
++     sss_sudo_free_values(val_array);
 +
-+     return ret;
++     debug_return_int(ret);
 +}
 +
 +/*
-+ * Walk through search results and return TRUE if we have a runas match,
-+ * else FALSE.  RunAs info is optional.
++ * Walk through search results and return true if we have a runas match,
++ * else false.  RunAs info is optional.
 + */
 +static int
-+sudo_sssd_check_runas(struct sss_sudo_rule *rule)
++sudo_sss_check_runas(struct sss_sudo_rule *rule)
 +{
 +    int ret;
++    debug_decl(sudo_sss_check_runas, SUDO_DEBUG_LDAP);
 +
 +    if (rule == NULL)
-+	 return FALSE;
++	 debug_return_int(false);
 +
-+    ret = sudo_sssd_check_runas_user(rule) != FALSE &&
-+	 sudo_sssd_check_runas_group(rule) != FALSE;
++    ret = sudo_sss_check_runas_user(rule) != false &&
++	 sudo_sss_check_runas_group(rule) != false;
 +
-+    return ret;
++    debug_return_int(ret);
 +}
 +
-+static int sudo_sssd_check_host(struct sss_sudo_rule *rule)
++static int sudo_sss_check_host(struct sss_sudo_rule *rule)
 +{
-+    char **v_arr, *val;
-+    int ret = FALSE, i;
++    char **val_array, *val;
++    int ret = false, i;
++    debug_decl(sudo_sss_check_host, SUDO_DEBUG_LDAP);
 +
 +    if (rule == NULL)
-+	 return ret;
++	 debug_return_int(ret);
 +
 +    /* get the values from the rule */
-+    switch (sss_sudo_get_values(rule, "sudoHost", &v_arr))
++    switch (sss_sudo_get_values(rule, "sudoHost", &val_array))
 +    {
 +    case 0:
 +	 break;
 +    case ENOENT:
 +	 DPRINTF(2, "No result.");
-+	 return FALSE;
++	 debug_return_int(false);
 +    default:
 +	 DPRINTF(2, "sss_sudo_get_values(sudoHost): != 0");
-+	 return ret;
++	 debug_return_int(ret);
 +    }
 +
 +    /* walk through values */
-+    for (i = 0; v_arr[i] != NULL; ++i) {
-+	 val = v_arr[i];
++    for (i = 0; val_array[i] != NULL; ++i) {
++	 val = val_array[i];
 +	 DPRINTF(3, "val[%d]=%s", i, val);
 +
 +	 /* match any or address or netgroup or hostname */
 +	 if (!strcmp(val, "ALL") || addr_matches(val) ||
 +	     netgr_matches(val, user_host, user_shost, NULL) ||
 +	     hostname_matches(user_shost, user_host, val))
-+	      ret = TRUE;
++	      ret = true;
 +
 +	 DPRINTF(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
 +    }
 +
-+    sss_sudo_free_values(v_arr);
++    sss_sudo_free_values(val_array);
 +
-+    return ret;
++    debug_return_int(ret);
 +}
 +
-+static int sudo_sssd_result_filterp(struct sss_sudo_rule *rule, void *unused)
++static int sudo_sss_result_filterp(struct sss_sudo_rule *rule, void *unused)
 +{
 +     (void)unused;
++     debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_LDAP);
 +
-+     if (sudo_sssd_check_host(rule))
-+	  return 1;
++     if (sudo_sss_check_host(rule))
++	  debug_return_int(1);
 +     else
-+	  return 0;
++	  debug_return_int(0);
 +}
 +
-+static struct sss_sudo_result *sudo_sssd_result_get(struct sudo_nss *nss,
-+					       struct passwd *pw,
-+					       uint32_t *state)
++static struct sss_sudo_result *sudo_sss_result_get(struct sudo_nss *nss, struct passwd *pw, uint32_t *state)
 +{
-+     struct sudo_sssd_handle *handle = nss->handle;
-+     struct sss_sudo_result *u_sres, *f_sres;
-+     uint32_t serr = 0, ret;
++     struct sudo_sss_handle *handle = nss->handle;
++     struct sss_sudo_result *u_sss_result, *f_sss_result;
++     uint32_t sss_error = 0, ret;
++     debug_decl(sudo_sss_result_get, SUDO_DEBUG_LDAP);
 +
-+     DPRINTF(1, "pw_name=%s", pw->pw_name);
++     if (sudo_sss_checkpw(nss, pw) != 0)
++	  debug_return_ptr(NULL);
 +
-+     u_sres = f_sres = NULL;
++     DPRINTF(1, "  username=%s", handle->pw->pw_name);
++     DPRINTF(1, "domainname=%s", handle->domainname);
 +
-+     switch (ret = sss_sudo_send_recv(pw->pw_name, &serr, &u_sres))
++     u_sss_result = f_sss_result = NULL;
++
++     switch (ret = sss_sudo_send_recv(handle->pw->pw_uid, handle->pw->pw_name,
++				      handle->domainname, &sss_error, &u_sss_result))
 +     {
 +     case 0:
-+	  switch (serr) {
++	  switch (sss_error) {
 +	  case 0:
-+	       if (u_sres != NULL) {
++	       if (u_sss_result != NULL) {
 +		    if (state != NULL) {
 +			 DPRINTF(3, "state |= USERMATCH");
 +			 *state |= _SUDO_SSS_STATE_USERMATCH;
 +		    }
-+		    DPRINTF(2, "Received %u rule(s)", u_sres->num_rules);
++		    DPRINTF(2, "Received %u rule(s)", u_sss_result->num_rules);
 +	       } else {
-+		    DPRINTF(2, "Internal error: u_sres == NULL && serr == 0");
-+		    return NULL;
++		    DPRINTF(2, "Internal error: u_sss_result == NULL && sss_error == 0");
++		    debug_return_ptr(NULL);
 +	       }
 +	       break;
 +	  case ENOENT:
 +	       DPRINTF(2, "No result.");
 +	  default:
-+	       DPRINTF(2, "serr=%u\n", serr);
-+	       return NULL;
++	       DPRINTF(2, "sss_error=%u\n", sss_error);
++	       debug_return_ptr(NULL);
 +	  }
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
-+	  return NULL;
++	  debug_return_ptr(NULL);
 +     }
 +
-+     f_sres = sudo_sssd_filter_result(u_sres, sudo_sssd_result_filterp, _SUDO_SSS_FILTER_INCLUDE, NULL);
++     f_sss_result = sudo_sss_filter_result(u_sss_result, sudo_sss_result_filterp,
++					   _SUDO_SSS_FILTER_INCLUDE, NULL);
 +
-+     if (f_sres != NULL)
-+	  if (f_sres->num_rules > 0)
++     if (f_sss_result != NULL)
++	  if (f_sss_result->num_rules > 0)
 +	       if (state != NULL) {
 +		    DPRINTF(3, "state |= HOSTMATCH");
 +		    *state |= _SUDO_SSS_STATE_HOSTMATCH;
 +	       }
 +
-+     DPRINTF(3, "u_sres=(%p, %u) => f_sres=(%p, %u)",
-+	     u_sres, u_sres->num_rules, f_sres, f_sres->num_rules);
++     DPRINTF(3, "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)",
++	     u_sss_result, u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
 +
-+     sss_sudo_free_result(u_sres);
++     sss_sudo_free_result(u_sss_result);
 +
-+     /* Store everything in the sudo_nss handle. */
-+     handle->result = NULL;
-+
-+     if (handle->username != NULL) {
-+	  DPRINTF(3, "Freeing previously stored username");
-+	  efree(handle->username);
-+     }
-+
-+     handle->username = estrdup(pw->pw_name);
-+     handle->grlist = user_group_list;
-+
-+     return f_sres;
++     debug_return_ptr(f_sss_result);
 +}
 +
 +/*
 + * Search for boolean "option" in sudoOption.
-+ * Returns TRUE if found and allowed, FALSE if negated, else UNSPEC.
++ * Returns true if found and allowed, false if negated, else UNSPEC.
 + */
 +static int
-+sudo_sssd_check_bool(struct sss_sudo_rule *rule, char *option)
++sudo_sss_check_bool(struct sss_sudo_rule *rule, char *option)
 +{
-+     char ch, *var, **v_arr = NULL;
++     char ch, *var, **val_array = NULL;
 +     int i, ret = UNSPEC;
++     debug_decl(sudo_sss_check_bool, SUDO_DEBUG_LDAP);
 +
 +     if (rule == NULL)
-+	  return ret;
++	  debug_return_int(ret);
 +
-+     switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
 +     {
 +     case 0:
 +	  break;
 +     case ENOENT:
 +	  DPRINTF(2, "No result.");
-+	  return ret;
++	  debug_return_int(ret);
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values: != 0");
-+	  return ret;
++	  debug_return_int(ret);
 +     }
 +
 +     /* walk through options */
-+     for (i = 0; v_arr[i] != NULL; ++i) {
-+	  var = v_arr[i];
++     for (i = 0; val_array[i] != NULL; ++i) {
++	  var = val_array[i];
 +	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", var);
 +
 +	  if ((ch = *var) == '!')
@@ -614,57 +638,58 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	       ret = (ch != '!');
 +     }
 +
-+     sss_sudo_free_values(v_arr);
++     sss_sudo_free_values(val_array);
 +
-+     return ret;
++     debug_return_int(ret);
 +}
 +
 +/*
-+ * Walk through search results and return TRUE if we have a command match,
-+ * FALSE if disallowed and UNSPEC if not matched.
++ * Walk through search results and return true if we have a command match,
++ * false if disallowed and UNSPEC if not matched.
 + */
 +static int
-+sudo_sssd_check_command(struct sss_sudo_rule *rule, int *setenv_implied)
++sudo_sss_check_command(struct sss_sudo_rule *rule, int *setenv_implied)
 +{
-+     char **v_arr = NULL, *val;
++     char **val_array = NULL, *val;
 +     char *allowed_cmnd, *allowed_args;
 +     int i, foundbang, ret = UNSPEC;
++     debug_decl(sudo_sss_check_command, SUDO_DEBUG_LDAP);
 +
 +     if (rule == NULL)
-+	  return ret;
++	  debug_return_int(ret);
 +
-+     switch (sss_sudo_get_values(rule, "sudoCommand", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array))
 +     {
 +     case 0:
 +	  break;
 +     case ENOENT:
 +	  DPRINTF(2, "No result.");
-+	  return ret;
++	  debug_return_int(ret);
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values: != 0");
-+	  return ret;
++	  debug_return_int(ret);
 +     }
 +
-+     for (i = 0; v_arr[i] != NULL && ret != FALSE; ++i) {
-+	  val = v_arr[i];
++     for (i = 0; val_array[i] != NULL && ret != false; ++i) {
++	  val = val_array[i];
 +
 +	  DPRINTF(3, "val[%d]=%s", i, val);
 +
 +	  /* Match against ALL ? */
 +	  if (!strcmp(val, "ALL")) {
-+	       ret = TRUE;
++	       ret = true;
 +	       if (setenv_implied != NULL)
-+		    *setenv_implied = TRUE;
++		    *setenv_implied = true;
 +	       DPRINTF(2, "sssd/ldap sudoCommand '%s' ... MATCH!", val);
 +	       continue;
 +	  }
 +
 +	  /* check for !command */
 +	  if (*val == '!') {
-+	       foundbang = TRUE;
++	       foundbang = true;
 +	       allowed_cmnd = estrdup(1 + val);	/* !command */
 +	  } else {
-+	       foundbang = FALSE;
++	       foundbang = false;
 +	       allowed_cmnd = estrdup(val);	/* command */
 +	  }
 +
@@ -679,44 +704,45 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +		* If allowed (no bang) set ret but keep on checking.
 +		* If disallowed (bang), exit loop.
 +		*/
-+	       ret = foundbang ? FALSE : TRUE;
++	       ret = foundbang ? false : true;
 +	  }
 +
-+	  DPRINTF(2, "sssd/ldap sudoCommand '%s' ... %s", val, ret == TRUE ? "MATCH!" : "not");
++	  DPRINTF(2, "sssd/ldap sudoCommand '%s' ... %s", val, ret == true ? "MATCH!" : "not");
 +	  efree(allowed_cmnd);	/* cleanup */
 +     }
 +
-+     sss_sudo_free_values(v_arr); /* more cleanup */
++     sss_sudo_free_values(val_array); /* more cleanup */
 +
-+     return ret;
++     debug_return_int(ret);
 +}
 +
 +static void
-+sudo_sssd_parse_options(struct sss_sudo_rule *rule)
++sudo_sss_parse_options(struct sss_sudo_rule *rule)
 +{
 +     int i;
 +     char op, *v, *val;
-+     char **v_arr = NULL;
++     char **val_array = NULL;
++     debug_decl(sudo_sss_parse_options, SUDO_DEBUG_LDAP);
 +
 +     if (rule == NULL)
-+	  return;
++	  debug_return;
 +
-+     switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
 +     {
 +     case 0:
 +	  break;
 +     case ENOENT:
 +	  DPRINTF(2, "No result.");
-+	  return;
++	  debug_return;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  return;
++	  debug_return;
 +     }
 +
 +     /* walk through options */
-+     for (i = 0; v_arr[i] != NULL; i++) {
-+	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", v_arr[i]);
-+	  v = estrdup(v_arr[i]);
++     for (i = 0; val_array[i] != NULL; i++) {
++	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", val_array[i]);
++	  v = estrdup(val_array[i]);
 +
 +	  /* check for equals sign past first char */
 +	  val = strchr(v, '=');
@@ -729,31 +755,33 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +		    set_default(v, val, (int) op);
 +	       } else {
 +		    /* case var=val */
-+		    set_default(v, val, TRUE);
++		    set_default(v, val, true);
 +	       }
 +	  } else if (*v == '!') {
 +	       /* case !var Boolean False */
-+	       set_default(v + 1, NULL, FALSE);
++	       set_default(v + 1, NULL, false);
 +	  } else {
 +	       /* case var Boolean True */
-+	       set_default(v, NULL, TRUE);
++	       set_default(v, NULL, true);
 +	  }
 +	  efree(v);
 +     }
 +
-+     sss_sudo_free_values(v_arr);
++     sss_sudo_free_values(val_array);
++     debug_return;
 +}
 +
-+static int sudo_sssd_lookup(struct sudo_nss *nss, int ret, int pwflag)
++static int sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag)
 +{
 +    int rc, setenv_implied;
 +
-+    struct sss_sudo_result *sres = NULL;
++    struct sss_sudo_result *sss_result = NULL;
 +    struct sss_sudo_rule   *rule;
 +    uint32_t i, state = 0;
++    debug_decl(sudo_sss_lookup, SUDO_DEBUG_LDAP);
 +
 +    /* Fetch list of sudoRole entries that match user and host. */
-+    sres = sudo_sssd_result_get(nss, sudo_user.pw, &state);
++    sss_result = sudo_sss_result_get(nss, sudo_user.pw, &state);
 +
 +    /*
 +     * The following queries are only determine whether or not a
@@ -766,18 +794,18 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	    (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
 +
 +	DPRINTF(2, "perform search for pwflag %d", pwflag);
-+	if (sres != NULL) {
-+	     for (i = 0; i < sres->num_rules; i++) {
-+		  rule = sres->rules + i;
-+		  if ((pwcheck == any && doauth != FALSE) ||
-+		      (pwcheck == all && doauth == FALSE)) {
-+		       doauth = sudo_sssd_check_bool(rule, "authenticate");
++	if (sss_result != NULL) {
++	     for (i = 0; i < sss_result->num_rules; i++) {
++		  rule = sss_result->rules + i;
++		  if ((pwcheck == any && doauth != false) ||
++		      (pwcheck == all && doauth == false)) {
++		       doauth = sudo_sss_check_bool(rule, "authenticate");
 +		  }
 +		  /* Only check the command when listing another user. */
 +		  if (user_uid == 0 || list_pw == NULL ||
 +		      user_uid == list_pw->pw_uid ||
-+		      sudo_sssd_check_command(rule, NULL)) {
-+		       matched = TRUE;
++		      sudo_sss_check_command(rule, NULL)) {
++		       matched = true;
 +		       break;
 +		  }
 +	     }
@@ -792,11 +820,11 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +			break;
 +		    case all:
 +		    case any:
-+			if (doauth == FALSE)
-+			    def_authenticate = FALSE;
++			if (doauth == false)
++			    def_authenticate = false;
 +			break;
 +		    case never:
-+			def_authenticate = FALSE;
++			def_authenticate = false;
 +			break;
 +		    default:
 +			break;
@@ -808,22 +836,22 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +
 +    DPRINTF(1, "searching SSSD/LDAP for sudoers entries");
 +
-+    setenv_implied = FALSE;
-+    if (sres != NULL) {
-+	 for (i = 0; i < sres->num_rules; i++) {
-+	      rule = sres->rules + i;
-+	      if (!sudo_sssd_check_runas(rule))
++    setenv_implied = false;
++    if (sss_result != NULL) {
++	 for (i = 0; i < sss_result->num_rules; i++) {
++	      rule = sss_result->rules + i;
++	      if (!sudo_sss_check_runas(rule))
 +		   continue;
-+	      rc = sudo_sssd_check_command(rule, &setenv_implied);
++	      rc = sudo_sss_check_command(rule, &setenv_implied);
 +	      if (rc != UNSPEC) {
 +		   /* We have a match. */
-+		   DPRINTF(1, "Command %sallowed", rc == TRUE ? "" : "NOT ");
-+		   if (rc == TRUE) {
++		   DPRINTF(1, "Command %sallowed", rc == true ? "" : "NOT ");
++		   if (rc == true) {
 +			DPRINTF(3, "SSSD rule: %p", rule);
 +			/* Apply entry-specific options. */
 +			if (setenv_implied)
-+			     def_setenv = TRUE;
-+			sudo_sssd_parse_options(rule);
++			     def_setenv = true;
++			sudo_sss_parse_options(rule);
 +#ifdef HAVE_SELINUX
 +			/* Set role and type if not specified on command line. */
 +			if (user_role == NULL)
@@ -855,36 +883,40 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +    if (state & _SUDO_SSS_STATE_HOSTMATCH)
 +	 CLR(ret, FLAG_NO_HOST);
 +
-+    DPRINTF(3, "sudo_sssd_lookup(%d)=0x%02x", pwflag, ret);
++    DPRINTF(3, "sudo_sss_lookup(%d)=0x%02x", pwflag, ret);
 +
-+    return ret;
++    debug_return_int(ret);
 +}
 +
-+static int sudo_sssd_display_cmnd(struct sudo_nss *nss, struct passwd *pw)
++static int sudo_sss_display_cmnd(struct sudo_nss *nss, struct passwd *pw)
 +{
-+     struct sudo_sssd_handle *handle = nss->handle;
-+     struct sss_sudo_result *sres = NULL;
++     struct sudo_sss_handle *handle = nss->handle;
++     struct sss_sudo_result *sss_result = NULL;
 +     struct sss_sudo_rule *rule;
-+     int i, found = FALSE;
++     int i, found = false;
++     debug_decl(sudo_sss_display_cmnd, SUDO_DEBUG_LDAP);
 +
 +     if (handle == NULL)
 +	  goto done;
 +
++     if (sudo_sss_checkpw(nss, pw) != 0)
++	  debug_return_int(-1);
++
 +     /*
-+      * The sudo_sssd_result_get() function returns all nodes that match
++      * The sudo_sss_result_get() function returns all nodes that match
 +      * the user and the host.
 +      */
 +     DPRINTF(1, "sssd/ldap search for command list");
-+     sres = sudo_sssd_result_get(nss, pw, NULL);
++     sss_result = sudo_sss_result_get(nss, pw, NULL);
 +
-+     if (sres == NULL)
++     if (sss_result == NULL)
 +	  goto done;
 +
-+     for (i = 0; i < sres->num_rules; i++) {
-+	  rule = sres->rules + i;
-+	  if (sudo_sssd_check_command(rule, NULL) &&
-+	      sudo_sssd_check_runas(rule)) {
-+	       found = TRUE;
++     for (i = 0; i < sss_result->num_rules; i++) {
++	  rule = sss_result->rules + i;
++	  if (sudo_sss_check_command(rule, NULL) &&
++	      sudo_sss_check_runas(rule)) {
++	       found = true;
 +	       goto done;
 +	  }
 +     }
@@ -894,37 +926,44 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  printf("%s%s%s\n", safe_cmnd ? safe_cmnd : user_cmnd,
 +		 user_args ? " " : "", user_args ? user_args : "");
 +
-+     if (sres != NULL)
-+	  sss_sudo_free_result(sres);
++     if (sss_result != NULL)
++	  sss_sudo_free_result(sss_result);
 +
-+     return !found;
++     debug_return_int(!found);
 +}
 +
-+static int sudo_sssd_display_defaults(struct sudo_nss *nss, struct passwd *pw,
++static int sudo_sss_display_defaults(struct sudo_nss *nss, struct passwd *pw,
 +				      struct lbuf *lbuf)
 +{
-+     struct sudo_sssd_handle *handle = nss->handle;
++     struct sudo_sss_handle *handle = nss->handle;
 +
 +     struct sss_sudo_rule *rule;
-+     struct sss_sudo_result *sres = NULL;
++     struct sss_sudo_result *sss_result = NULL;
 +
-+     uint32_t serr = 0;
++     uint32_t sss_error = 0;
 +
-+     char *prefix, *val, **v_arr = NULL;
++     char *prefix, *val, **val_array = NULL;
 +     int count = 0, i, j;
 +
++     debug_decl(sudo_sss_display_defaults, SUDO_DEBUG_LDAP);
++
 +     if (handle == NULL)
 +	  goto done;
 +
-+     if (sss_sudo_send_recv_defaults(&serr, &sres) != 0) {
-+	  DPRINTF(2, "sss_sudo_send_recv_defaults: !=0, serr=%u", serr);
++     if (sss_sudo_send_recv_defaults(pw->pw_uid, pw->pw_name,
++				     &sss_error, &handle->domainname,
++				     &sss_result) != 0)
++     {
++	  DPRINTF(2, "sss_sudo_send_recv_defaults: !=0, sss_error=%u", sss_error);
 +	  goto done;
 +     }
 +
-+     for (i = 0; i < sres->num_rules; ++i) {
-+	  rule = sres->rules + i;
++     handle->pw = pw;
 +
-+	  switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++     for (i = 0; i < sss_result->num_rules; ++i) {
++	  rule = sss_result->rules + i;
++
++	  switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
 +	  {
 +	  case 0:
 +	       break;
@@ -941,62 +980,52 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  else
 +	       prefix = ", ";
 +
-+	  for (j = 0; v_arr[j] != NULL; ++j) {
-+	       val = v_arr[j];
++	  for (j = 0; val_array[j] != NULL; ++j) {
++	       val = val_array[j];
 +	       lbuf_append(lbuf, "%s%s", prefix, val);
 +	       prefix = ", ";
 +	       count++;
 +	  }
 +	  
-+	  sss_sudo_free_values(v_arr);
-+	  v_arr = NULL;
++	  sss_sudo_free_values(val_array);
++	  val_array = NULL;
 +     }
 +
-+     sss_sudo_free_result(sres);
++     sss_sudo_free_result(sss_result);
 +done:
-+     return count;
++     debug_return_int(count);
 +}
 +
 +// ok
-+static int sudo_sssd_display_bound_defaults(struct sudo_nss *nss,
++static int sudo_sss_display_bound_defaults(struct sudo_nss *nss,
 +					    struct passwd *pw, struct lbuf *lbuf)
 +{
-+     return 0;
++     debug_decl(sudo_sss_display_bound_defaults, SUDO_DEBUG_LDAP);
++     debug_return_int(0);
 +}
 +
-+static int sudo_sssd_display_entry_long(struct sss_sudo_rule *rule, struct lbuf *lbuf)
++static int sudo_sss_display_entry_long(struct sss_sudo_rule *rule, struct lbuf *lbuf)
 +{
-+     char **v_arr = NULL;
++     char **val_array = NULL;
 +     int count = 0, i;
-+
-+#if 0 /* do we need this? */
-+     char *rdn;
-+     /* extract the dn, only show the first rdn */
-+     rdn = sudo_ldap_get_first_rdn(ld, entry);
-+     if (rdn != NULL)
-+	  lbuf_append(lbuf, _("\nLDAP Role: %s\n"), rdn);
-+     else
-+	  lbuf_append(lbuf, _("\nLDAP Role: UNKNOWN\n"));
-+     if (rdn)
-+	  ldap_memfree(rdn);
-+#endif
++     debug_decl(sudo_sss_display_entry_long, SUDO_DEBUG_LDAP);
 +
 +     /* get the RunAsUser Values from the entry */
 +     lbuf_append(lbuf, "    RunAsUsers: ");
-+     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
 +     {
 +     case 0:
-+	  for (i = 0; v_arr[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
-+	  sss_sudo_free_values(v_arr);
++	  for (i = 0; val_array[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
++	  sss_sudo_free_values(val_array);
 +	  break;
 +     case ENOENT:
-+	  switch (sss_sudo_get_values(rule, "sudoRunAs", &v_arr))
++	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
 +	  {
 +	  case 0:
-+	       for (i = 0; v_arr[i] != NULL; ++i)
-+		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
-+	       sss_sudo_free_values(v_arr);
++	       for (i = 0; val_array[i] != NULL; ++i)
++		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
++	       sss_sudo_free_values(val_array);
 +	       break;
 +	  case ENOENT:
 +	       DPRINTF(2, "No result.");
@@ -1004,23 +1033,23 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	       break;
 +	  default:
 +	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       return count;
++	       debug_return_int(count);
 +	  }
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  return count;
++	  debug_return_int(count);
 +     }
 +     lbuf_append(lbuf, "\n");
 +
 +     /* get the RunAsGroup Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
 +     {
 +     case 0:
 +	  lbuf_append(lbuf, "    RunAsGroups: ");
-+	  for (i = 0; v_arr[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
-+	  sss_sudo_free_values(v_arr);
++	  for (i = 0; val_array[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
++	  sss_sudo_free_values(val_array);
 +	  lbuf_append(lbuf, "\n");
 +	  break;
 +     case ENOENT:
@@ -1028,18 +1057,17 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  return count;
++	  debug_return_int(count);
 +     }
 +
-+
 +     /* get the Option Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
 +     {
 +     case 0:
 +	  lbuf_append(lbuf, "    Options: ");
-+	  for (i = 0; v_arr[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
-+	  sss_sudo_free_values(v_arr);
++	  for (i = 0; val_array[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
++	  sss_sudo_free_values(val_array);
 +	  lbuf_append(lbuf, "\n");
 +	  break;
 +     case ENOENT:
@@ -1047,54 +1075,55 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  return count;
++	  debug_return_int(count);
 +     }
 +
 +     /* Get the command values from the entry. */
-+     switch (sss_sudo_get_values(rule, "sudoCommand", &v_arr)) {
++     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
 +     case 0:
 +	  lbuf_append(lbuf, _("    Commands:\n"));
-+	  for (i = 0; v_arr[i] != NULL; ++i) {
-+	       lbuf_append(lbuf, "\t%s\n", v_arr[i]);
++	  for (i = 0; val_array[i] != NULL; ++i) {
++	       lbuf_append(lbuf, "\t%s\n", val_array[i]);
 +	       count++;
 +	  }
-+	  sss_sudo_free_values(v_arr);
++	  sss_sudo_free_values(val_array);
 +	  break;
 +     case ENOENT:
 +	  DPRINTF(2, "No result.");
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
-+	  return count;
++	  debug_return_int(count);
 +     }
 +
-+     return count;
++     debug_return_int(count);
 +}
 +
-+static int sudo_sssd_display_entry_short(struct sss_sudo_rule *rule, struct lbuf *lbuf)
++static int sudo_sss_display_entry_short(struct sss_sudo_rule *rule, struct lbuf *lbuf)
 +{
-+     char **v_arr = NULL;
++     char **val_array = NULL;
 +     int count = 0, i;
++     debug_decl(sudo_sss_display_entry_short, SUDO_DEBUG_LDAP);
 +
 +     lbuf_append(lbuf, "    (");
 +
 +     /* get the RunAsUser Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
 +     {
 +     case 0:
-+	  for (i = 0; v_arr[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
-+	  sss_sudo_free_values(v_arr);
++	  for (i = 0; val_array[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
++	  sss_sudo_free_values(val_array);
 +	  break;
 +     case ENOENT:
 +	  DPRINTF(2, "No result. Trying old style (sudoRunAs).");
 +	  /* try old style */
-+	  switch (sss_sudo_get_values(rule, "sudoRunAs", &v_arr))
++	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
 +	  {
 +	  case 0:
-+	       for (i = 0; v_arr[i] != NULL; ++i)
-+		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
-+	       sss_sudo_free_values(v_arr);
++	       for (i = 0; val_array[i] != NULL; ++i)
++		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
++	       sss_sudo_free_values(val_array);
 +	       break;
 +	  case ENOENT:
 +	       DPRINTF(2, "No result.");
@@ -1102,120 +1131,128 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s
 +	       break;
 +	  default:
 +	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       return count;
++	       debug_return_int(count);
 +	  }
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  return count;
++	  debug_return_int(count);
 +     }
 +
 +     /* get the RunAsGroup Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
 +     {
 +     case 0:
 +	  lbuf_append(lbuf, " : ");
-+	  for (i = 0; v_arr[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
-+	  sss_sudo_free_values(v_arr);
++	  for (i = 0; val_array[i] != NULL; ++i)
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
++	  sss_sudo_free_values(val_array);
 +	  break;
 +     case ENOENT:
 +	  DPRINTF(2, "No result.");
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  return count;
++	  debug_return_int(count);
 +     }
 +
 +     lbuf_append(lbuf, ") ");
 +
 +     /* get the Option Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoOption", &v_arr))
++     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
 +     {
 +     case 0:
-+	  for (i = 0; v_arr[i] != NULL; ++i) {
-+	       char *cp = v_arr[i];
++	  for (i = 0; val_array[i] != NULL; ++i) {
++	       char *cp = val_array[i];
 +	       if (*cp == '!')
 +		    cp++;
 +	       if (strcmp(cp, "authenticate") == 0)
-+		    lbuf_append(lbuf, v_arr[i][0] == '!' ?
++		    lbuf_append(lbuf, val_array[i][0] == '!' ?
 +				"NOPASSWD: " : "PASSWD: ");
 +	       else if (strcmp(cp, "noexec") == 0)
-+		    lbuf_append(lbuf, v_arr[i][0] == '!' ?
++		    lbuf_append(lbuf, val_array[i][0] == '!' ?
 +				"EXEC: " : "NOEXEC: ");
 +	       else if (strcmp(cp, "setenv") == 0)
-+		    lbuf_append(lbuf, v_arr[i][0] == '!' ?
++		    lbuf_append(lbuf, val_array[i][0] == '!' ?
 +				"NOSETENV: " : "SETENV: ");
 +	  }
 +
-+	  sss_sudo_free_values(v_arr);
++	  sss_sudo_free_values(val_array);
 +	  break;
 +     case ENOENT:
 +	  DPRINTF(2, "No result.");
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  return count;
++	  debug_return_int(count);
 +     }
 +
 +     /* get the Command Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoCommand", &v_arr)) {
++     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
 +     case 0:
-+	  for (i = 0; v_arr[i] != NULL; ++i) {
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", v_arr[i]);
++	  for (i = 0; val_array[i] != NULL; ++i) {
++	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
 +	       count++;
 +	  }
-+	  sss_sudo_free_values(v_arr);
++	  sss_sudo_free_values(val_array);
 +	  break;
 +     case ENOENT:
 +	  DPRINTF(2, "No result.");
 +	  break;
 +     default:
 +	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
-+	  return count;
++	  debug_return_int(count);
 +     }
 +     lbuf_append(lbuf, "\n");
 +
-+     return count;
++     debug_return_int(count);
 +}
 +
-+static int sudo_sssd_display_privs(struct sudo_nss *nss, struct passwd *pw,
++static int sudo_sss_display_privs(struct sudo_nss *nss, struct passwd *pw,
 +				   struct lbuf *lbuf)
 +{
-+     struct sss_sudo_result *sres = NULL;
++     struct sudo_sss_handle *handle = nss->handle;
++
++     struct sss_sudo_result *sss_result = NULL;
 +     struct sss_sudo_rule *rule;
 +     unsigned int i, count = 0;
++     debug_decl(sudo_sss_display_privs, SUDO_DEBUG_LDAP);
++
++     if (handle == NULL)
++	  debug_return_int(-1);
++     if (sudo_sss_checkpw(nss, pw) != 0)
++	  debug_return_int(-1);
 +
 +     DPRINTF(2, "sssd/ldap search for command list");
 +
-+     sres = sudo_sssd_result_get(nss, pw, NULL);
++     sss_result = sudo_sss_result_get(nss, pw, NULL);
 +
-+     if (sres == NULL)
-+	  return count;
++     if (sss_result == NULL)
++	  debug_return_int(count);
 +
 +     /* Display all matching entries. */
-+     for (i = 0; i < sres->num_rules; ++i) {
-+	  rule = sres->rules + i;
++     for (i = 0; i < sss_result->num_rules; ++i) {
++	  rule = sss_result->rules + i;
 +	  if (long_list)
-+	       count += sudo_sssd_display_entry_long(rule, lbuf);
++	       count += sudo_sss_display_entry_long(rule, lbuf);
 +	  else
-+	       count += sudo_sssd_display_entry_short(rule, lbuf);
++	       count += sudo_sss_display_entry_short(rule, lbuf);
 +     }
 +
-+     if (sres != NULL)
-+	  sss_sudo_free_result(sres);
++     if (sss_result != NULL)
++	  sss_sudo_free_result(sss_result);
 +
-+     return count;
++     debug_return_int(count);
 +}
-diff -up sudo-1.8.3p1/plugins/sudoers/sudo_nss.c.sssd-support sudo-1.8.3p1/plugins/sudoers/sudo_nss.c
---- sudo-1.8.3p1/plugins/sudoers/sudo_nss.c.sssd-support	2012-01-18 18:21:10.155151843 +0100
-+++ sudo-1.8.3p1/plugins/sudoers/sudo_nss.c	2012-01-18 18:29:40.366473444 +0100
+diff -up sudo-1.8.5/plugins/sudoers/sudo_nss.c.sssd-support sudo-1.8.5/plugins/sudoers/sudo_nss.c
+--- sudo-1.8.5/plugins/sudoers/sudo_nss.c.sssd-support	2012-03-12 19:02:14.000000000 +0100
++++ sudo-1.8.5/plugins/sudoers/sudo_nss.c	2012-05-17 10:30:40.819975039 +0200
 @@ -47,8 +47,11 @@ extern struct sudo_nss sudo_nss_file;
  #ifdef HAVE_LDAP
  extern struct sudo_nss sudo_nss_ldap;
  #endif
 +#ifdef HAVE_SSSD
-+extern struct sudo_nss sudo_nss_sssd;
++extern struct sudo_nss sudo_nss_sss;
 +#endif
  
 -#if defined(HAVE_LDAP) && defined(_PATH_NSSWITCH_CONF)
@@ -1223,32 +1260,29 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sudo_nss.c.sssd-support sudo-1.8.3p1/plugi
  /*
   * Read in /etc/nsswitch.conf
   * Returns a tail queue of matches.
-@@ -60,6 +63,7 @@ sudo_read_nss(void)
+@@ -58,6 +61,9 @@ sudo_read_nss(void)
+ {
+     FILE *fp;
      char *cp;
-     int saw_files = FALSE;
-     int saw_ldap = FALSE;
-+    int saw_sssd = FALSE;
-     int got_match = FALSE;
-     static struct sudo_nss_list snl;
- 
-@@ -80,9 +84,16 @@ sudo_read_nss(void)
- 	    if (strcasecmp(cp, "files") == 0 && !saw_files) {
- 		tq_append(&snl, &sudo_nss_file);
- 		got_match = TRUE;
-+#if defined(HAVE_LDAP)
++#if defined(HAVE_SSSD)
++    bool saw_sss = false;
++#endif
+     bool saw_files = false;
+     bool saw_ldap = false;
+     bool got_match = false;
+@@ -84,6 +90,11 @@ sudo_read_nss(void)
  	    } else if (strcasecmp(cp, "ldap") == 0 && !saw_ldap) {
  		tq_append(&snl, &sudo_nss_ldap);
- 		got_match = TRUE;
-+#endif
+ 		got_match = true;
 +#if defined(HAVE_SSSD)
-+	    } else if (strcasecmp(cp, "sss") == 0 && !saw_sssd) {
-+		tq_append(&snl, &sudo_nss_sssd);
-+		got_match = TRUE;
++	    } else if (strcasecmp(cp, "sss") == 0 && !saw_sss) {
++		tq_append(&snl, &sudo_nss_sss);
++		got_match = true;
 +#endif
  	    } else if (strcasecmp(cp, "[NOTFOUND=return]") == 0 && got_match) {
  		/* NOTFOUND affects the most recent entry */
- 		tq_last(&snl)->ret_if_notfound = TRUE;
-@@ -105,7 +116,7 @@ nomatch:
+ 		tq_last(&snl)->ret_if_notfound = true;
+@@ -106,7 +117,7 @@ nomatch:
  
  #else /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
  
@@ -1257,32 +1291,37 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sudo_nss.c.sssd-support sudo-1.8.3p1/plugi
  
  /*
   * Read in /etc/netsvc.conf (like nsswitch.conf on AIX)
-@@ -118,6 +129,7 @@ sudo_read_nss(void)
+@@ -117,6 +128,9 @@ sudo_read_nss(void)
+ {
+     FILE *fp;
      char *cp, *ep;
-     int saw_files = FALSE;
-     int saw_ldap = FALSE;
-+    int saw_sssd = FALSE;
-     int got_match = FALSE;
-     static struct sudo_nss_list snl;
- 
-@@ -149,11 +161,20 @@ sudo_read_nss(void)
- 		tq_append(&snl, &sudo_nss_file);
- 		got_match = TRUE;
- 		ep = &cp[5];
-+#if defined(HAVE_LDAP)
- 	    } else if (!saw_ldap && strncasecmp(cp, "ldap", 4) == 0 &&
- 		(isspace((unsigned char)cp[4]) || cp[4] == '\0')) {
- 		tq_append(&snl, &sudo_nss_ldap);
- 		got_match = TRUE;
- 		ep = &cp[4];
-+#endif
 +#if defined(HAVE_SSSD)
-+	    } else if (!saw_sssd && strncasecmp(cp, "sss", 3) == 0 &&
++    bool saw_sss = false;
++#endif
+     bool saw_files = false;
+     bool saw_ldap = false;
+     bool got_match = false;
+@@ -156,6 +170,13 @@ sudo_read_nss(void)
+ 		tq_append(&snl, &sudo_nss_ldap);
+ 		got_match = true;
+ 		ep = &cp[4];
++#if defined(HAVE_SSSD)
++	    } else if (!saw_sss && strncasecmp(cp, "sss", 3) == 0 &&
 +		(isspace((unsigned char)cp[3]) || cp[3] == '\0')) {
-+		tq_append(&snl, &sudo_nss_sssd);
-+		got_match = TRUE;
++		tq_append(&snl, &sudo_nss_sss);
++		got_match = true;
 +		ep = &cp[3];
 +#endif
  	    } else {
- 		got_match = FALSE;
+ 		got_match = false;
  	    }
+@@ -195,6 +216,9 @@ sudo_read_nss(void)
+     static struct sudo_nss_list snl;
+     debug_decl(sudo_read_nss, SUDO_DEBUG_NSS)
+ 
++#  ifdef HAVE_SSSD
++    tq_append(&snl, &sudo_nss_sss);
++#  endif
+ #  ifdef HAVE_LDAP
+     tq_append(&snl, &sudo_nss_ldap);
+ #  endif
diff --git a/sudo.spec b/sudo.spec
index 444c68d..858b309 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.3p1
-Release: 6%{?dist}
+Version: 1.8.5
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -29,11 +29,9 @@ Patch2: sudo-1.7.2p1-envdebug.patch
 # add m4/ to paths in aclocal.m4
 Patch3: sudo-1.7.4p3-m4path.patch
 # disable word wrapping if the ouput is piped
-Patch4: sudo-1.8.3-pipelist.patch
-# CVE-2012-0809
-Patch5: sudo-1.8.3p1-CVE-2012-0809.patch
+Patch4: sudo-1.8.5-pipelist.patch
 # SSSD support
-Patch6: sudo-1.8.3p1-sssd-support.patch
+Patch5: sudo-1.8.5-sssd-support.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -62,8 +60,7 @@ plugins that use %{name}.
 %patch2 -p1 -b .envdebug
 %patch3 -p1 -b .m4path
 %patch4 -p1 -b .pipelist
-%patch5 -p1 -b .CVE-2012-0809
-%patch6 -p1 -b .sssd-support
+%patch5 -p1 -b .sssd-support
 
 # Remove execute permission on this script so we don't pull in perl deps
 chmod -x plugins/sudoers/sudoers2ldif
@@ -95,8 +92,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --with-ldap \
 	--with-selinux \
 	--with-passprompt="[sudo] password for %p: " \
-	--with-linux-audit	  \
-	--with-sssd
+	--with-linux-audit
+#	--with-sssd
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -141,9 +138,6 @@ rm -rf $RPM_BUILD_ROOT
 
 %files -f sudo_all.lang
 %defattr(-,root,root)
-%doc ChangeLog NEWS README* MANIFEST
-%doc doc/HISTORY doc/LICENSE doc/TROUBLESHOOTING doc/UPGRADE
-%doc doc/schema.* plugins/sudoers/sudoers2ldif doc/sample.*
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %attr(0750,root,root) %dir /etc/sudoers.d/
 %config(noreplace) /etc/pam.d/sudo
@@ -162,6 +156,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudoedit.8*
 %{_mandir}/man8/sudoreplay.8*
 %{_mandir}/man8/visudo.8*
+%{_docdir}/sudo-%{version}/*
 
 
 # Make sure permissions are ok even if we're updating
@@ -175,6 +170,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Thu May 17 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-1
+- update to 1.8.5
+- fixed CVE-2012-2337
+- temporarily disabled SSSD support 
+
 * Wed Feb 29 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-6
 - fixed problems with undefined symbols (rhbz#798517)
 

From a03aed0f1061527a5c9b048dae92d8d2ddd6fd7b Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 17 May 2012 14:20:22 +0200
Subject: [PATCH 068/199] Updated sources

---
 .gitignore | 1 +
 sources    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 754758f..e51036a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.7.4p5.tar.gz
 /sudo-1.8.1p2.tar.gz
 /sudo-1.8.3p1.tar.gz
+/sudo-1.8.5.tar.gz
diff --git a/sources b/sources
index d108a9e..667632d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-7becc572fa97f94cf721a2ee8299c45b  sudo-1.8.3p1.tar.gz
+8d5a664bba74b19ca0b40db1d90f2cee  sudo-1.8.5.tar.gz
 56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers

From 94079dc775e7e28344208d8207f1541803eabdcf Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Sat, 21 Jul 2012 16:34:41 -0500
Subject: [PATCH 069/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 858b309..5e69b52 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.5
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -170,6 +170,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
 * Thu May 17 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-1
 - update to 1.8.5
 - fixed CVE-2012-2337

From 0247beae7174b0706e270dc3e94005ee94e0ba06 Mon Sep 17 00:00:00 2001
From: Bill Nottingham <notting@redhat.com>
Date: Tue, 24 Jul 2012 14:48:31 -0400
Subject: [PATCH 070/199] Flip sudoers2ldif bit after make install, since it
 was making it executable again.

---
 sudo.spec | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 5e69b52..8132bf4 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.5
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -62,8 +62,6 @@ plugins that use %{name}.
 %patch4 -p1 -b .pipelist
 %patch5 -p1 -b .sssd-support
 
-# Remove execute permission on this script so we don't pull in perl deps
-chmod -x plugins/sudoers/sudoers2ldif
 
 %build
 autoreconf -fv --install
@@ -107,6 +105,9 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
 
+# Remove execute permission on this script so we don't pull in perl deps
+chmod -x $RPM_BUILD_ROOT%{_docdir}/sudo-*/sudoers2ldif
+
 %find_lang sudo
 %find_lang sudoers
 
@@ -170,6 +171,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Tue Jul 24 2012 Bill Nottingham <notting@redhat.com> - 1.8.5-3
+- flip sudoers2ldif executable bit after make install, not in setup
+
 * Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.5-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
 

From 049d9661dd94152389ae93e60e0a2a8e31937fbc Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 26 Jul 2012 09:32:44 +0200
Subject: [PATCH 071/199] added patches that fix & improve SSSD support (thanks
 to pbrezina@redhat.com)

- re-enabled SSSD support
- removed libsss_sudo dependency
---
 sudo-1.8.5-add-sssd-debug-subsystem.patch     | 290 ++++++
 ...1.8.5-remove-source-when-open-failed.patch |  33 +
 sudo-1.8.5-sssd-dlopen-lib.patch              | 905 ++++++++++++++++++
 ...-1.8.5-sssd-handle-sss_ret-correctly.patch |  43 +
 sudo-1.8.5-sssd-use-sudo_debug_printf.patch   | 600 ++++++++++++
 sudo.spec                                     |  29 +-
 6 files changed, 1895 insertions(+), 5 deletions(-)
 create mode 100644 sudo-1.8.5-add-sssd-debug-subsystem.patch
 create mode 100644 sudo-1.8.5-remove-source-when-open-failed.patch
 create mode 100644 sudo-1.8.5-sssd-dlopen-lib.patch
 create mode 100644 sudo-1.8.5-sssd-handle-sss_ret-correctly.patch
 create mode 100644 sudo-1.8.5-sssd-use-sudo_debug_printf.patch

diff --git a/sudo-1.8.5-add-sssd-debug-subsystem.patch b/sudo-1.8.5-add-sssd-debug-subsystem.patch
new file mode 100644
index 0000000..2af83c3
--- /dev/null
+++ b/sudo-1.8.5-add-sssd-debug-subsystem.patch
@@ -0,0 +1,290 @@
+diff -rup original/common/sudo_debug.c new/common/sudo_debug.c
+--- original/common/sudo_debug.c	2012-05-15 18:22:01.000000000 +0200
++++ new/common/sudo_debug.c	2012-07-17 10:24:05.389397245 +0200
+@@ -101,6 +101,7 @@ const char *const sudo_debug_subsystems[
+     "perms",
+     "plugin",
+     "hooks",
++    "sssd",
+     NULL
+ };
+ 
+diff -rup original/include/sudo_debug.h new/include/sudo_debug.h
+--- original/include/sudo_debug.h	2012-05-15 18:22:02.000000000 +0200
++++ new/include/sudo_debug.h	2012-07-17 10:49:43.470809390 +0200
+@@ -71,6 +71,7 @@
+ #define SUDO_DEBUG_PERMS	(23<<6)	/* uid/gid swapping functions */
+ #define SUDO_DEBUG_PLUGIN	(24<<6)	/* main plugin functions */
+ #define SUDO_DEBUG_HOOKS	(25<<6)	/* hook functions */
++#define SUDO_DEBUG_SSSD		(26<<6) /* sudoers SSSD */
+ #define SUDO_DEBUG_ALL		0xfff0	/* all subsystems */
+ 
+ /* Flag to include string version of errno in debug info. */
+diff -rup original/plugins/sudoers/sssd.c new/plugins/sudoers/sssd.c
+--- original/plugins/sudoers/sssd.c	2012-07-17 10:13:42.366133003 +0200
++++ new/plugins/sudoers/sssd.c	2012-07-17 10:24:05.383397175 +0200
+@@ -86,7 +86,7 @@ static struct sss_sudo_result *sudo_sss_
+ static void sudo_sss_attrcpy(struct sss_sudo_attr *dst, const struct sss_sudo_attr *src)
+ {
+      int i;
+-     debug_decl(sudo_sss_attrcpy, SUDO_DEBUG_LDAP)
++     debug_decl(sudo_sss_attrcpy, SUDO_DEBUG_SSSD)
+ 
+      DPRINTF(3, "dst=%p, src=%p", dst, src);
+      DPRINTF(2, "emalloc: cnt=%d", src->num_values);
+@@ -104,8 +104,8 @@ static void sudo_sss_attrcpy(struct sss_
+ static void sudo_sss_rulecpy(struct sss_sudo_rule *dst, const struct sss_sudo_rule *src)
+ {
+      int i;
+-     debug_decl(sudo_sss_rulecpy, SUDO_DEBUG_LDAP)
+-     
++     debug_decl(sudo_sss_rulecpy, SUDO_DEBUG_SSSD)
++
+      DPRINTF(3, "dst=%p, src=%p", dst, src);
+      DPRINTF(2, "emalloc: cnt=%d", src->num_attrs);
+ 
+@@ -130,7 +130,7 @@ static struct sss_sudo_result *sudo_sss_
+ {
+      struct sss_sudo_result *out_res;
+      int i, l, r;
+-     debug_decl(sudo_sss_filter_result, SUDO_DEBUG_LDAP)
++     debug_decl(sudo_sss_filter_result, SUDO_DEBUG_SSSD)
+ 
+      DPRINTF(3, "in_res=%p, count=%u, act=%s",
+ 	     in_res, in_res->num_rules, act == _SUDO_SSS_FILTER_EXCLUDE ? "EXCLUDE" : "INCLUDE");
+@@ -193,7 +193,7 @@ struct sudo_nss sudo_nss_sss = {
+ static int sudo_sss_open(struct sudo_nss *nss)
+ {
+      struct sudo_sss_handle *handle;
+-     debug_decl(sudo_sss_open, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_open, SUDO_DEBUG_SSSD);
+ 
+      /* Create a handle container. */
+      handle = emalloc(sizeof(struct sudo_sss_handle));
+@@ -209,7 +209,7 @@ static int sudo_sss_open(struct sudo_nss
+ // ok
+ static int sudo_sss_close(struct sudo_nss *nss)
+ {
+-     debug_decl(sudo_sss_close, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD);
+      efree(nss->handle);
+      debug_return_int(0);
+ }
+@@ -217,7 +217,7 @@ static int sudo_sss_close(struct sudo_ns
+ // ok
+ static int sudo_sss_parse(struct sudo_nss *nss)
+ {
+-     debug_decl(sudo_sss_parse, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_parse, SUDO_DEBUG_SSSD);
+      debug_return_int(0);
+ }
+ 
+@@ -229,7 +229,7 @@ static int sudo_sss_setdefs(struct sudo_
+      struct sss_sudo_rule   *sss_rule;
+      uint32_t sss_error;
+      int i;
+-     debug_decl(sudo_sss_setdefs, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_setdefs, SUDO_DEBUG_SSSD);
+ 
+      if (handle == NULL)
+ 	  debug_return_int(-1);
+@@ -257,7 +257,7 @@ static int sudo_sss_setdefs(struct sudo_
+ static int sudo_sss_checkpw(struct sudo_nss *nss, struct passwd *pw)
+ {
+      struct sudo_sss_handle *handle = nss->handle;
+-     debug_decl(sudo_sss_checkpw, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_checkpw, SUDO_DEBUG_SSSD);
+ 
+      if (pw->pw_name != handle->pw->pw_name ||
+ 	 pw->pw_uid  != handle->pw->pw_uid)
+@@ -278,13 +278,13 @@ sudo_sss_check_runas_user(struct sss_sud
+      char **val_array = NULL;
+      char *val;
+      int ret = false, i;
+-     debug_decl(sudo_sss_check_runas_user, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_check_runas_user, SUDO_DEBUG_SSSD);
+ 
+      if (!runas_pw)
+ 	  debug_return_int(UNSPEC);
+ 
+      /* get the runas user from the entry */
+-     switch (sss_sudo_get_values(sss_rule, "sudoRunAsUser", &val_array)) 
++     switch (sss_sudo_get_values(sss_rule, "sudoRunAsUser", &val_array))
+      {
+      case 0:
+ 	  break;
+@@ -315,18 +315,18 @@ sudo_sss_check_runas_user(struct sss_sud
+ 
+      /*
+       * BUG:
+-      * 
++      *
+       * if runas is not specified on the command line, the only information
+       * as to which user to run as is in the runas_default option.  We should
+       * check to see if we have the local option present.  Unfortunately we
+       * don't parse these options until after this routine says yes or no.
+       * The query has already returned, so we could peek at the attribute
+       * values here though.
+-      * 
++      *
+       * For now just require users to always use -u option unless its set
+       * in the global defaults. This behaviour is no different than the global
+       * /etc/sudoers.
+-      * 
++      *
+       * Sigh - maybe add this feature later
+       */
+ 
+@@ -381,7 +381,7 @@ sudo_sss_check_runas_group(struct sss_su
+      char **val_array = NULL;
+      char *val;
+      int ret = false, i;
+-     debug_decl(sudo_sss_check_runas_group, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_check_runas_group, SUDO_DEBUG_SSSD);
+ 
+      /* runas_gr is only set if the user specified the -g flag */
+      if (!runas_gr)
+@@ -424,7 +424,7 @@ static int
+ sudo_sss_check_runas(struct sss_sudo_rule *rule)
+ {
+     int ret;
+-    debug_decl(sudo_sss_check_runas, SUDO_DEBUG_LDAP);
++    debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD);
+ 
+     if (rule == NULL)
+ 	 debug_return_int(false);
+@@ -439,7 +439,7 @@ static int sudo_sss_check_host(struct ss
+ {
+     char **val_array, *val;
+     int ret = false, i;
+-    debug_decl(sudo_sss_check_host, SUDO_DEBUG_LDAP);
++    debug_decl(sudo_sss_check_host, SUDO_DEBUG_SSSD);
+ 
+     if (rule == NULL)
+ 	 debug_return_int(ret);
+@@ -479,7 +479,7 @@ static int sudo_sss_check_host(struct ss
+ static int sudo_sss_result_filterp(struct sss_sudo_rule *rule, void *unused)
+ {
+      (void)unused;
+-     debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD);
+ 
+      if (sudo_sss_check_host(rule))
+ 	  debug_return_int(1);
+@@ -492,7 +492,7 @@ static struct sss_sudo_result *sudo_sss_
+      struct sudo_sss_handle *handle = nss->handle;
+      struct sss_sudo_result *u_sss_result, *f_sss_result;
+      uint32_t sss_error = 0, ret;
+-     debug_decl(sudo_sss_result_get, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_result_get, SUDO_DEBUG_SSSD);
+ 
+      if (sudo_sss_checkpw(nss, pw) != 0)
+ 	  debug_return_ptr(NULL);
+@@ -558,7 +558,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
+ {
+      char ch, *var, **val_array = NULL;
+      int i, ret = UNSPEC;
+-     debug_decl(sudo_sss_check_bool, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_check_bool, SUDO_DEBUG_SSSD);
+ 
+      if (rule == NULL)
+ 	  debug_return_int(ret);
+@@ -601,7 +601,7 @@ sudo_sss_check_command(struct sss_sudo_r
+      char **val_array = NULL, *val;
+      char *allowed_cmnd, *allowed_args;
+      int i, foundbang, ret = UNSPEC;
+-     debug_decl(sudo_sss_check_command, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_check_command, SUDO_DEBUG_SSSD);
+ 
+      if (rule == NULL)
+ 	  debug_return_int(ret);
+@@ -670,7 +670,7 @@ sudo_sss_parse_options(struct sss_sudo_r
+      int i;
+      char op, *v, *val;
+      char **val_array = NULL;
+-     debug_decl(sudo_sss_parse_options, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_parse_options, SUDO_DEBUG_SSSD);
+ 
+      if (rule == NULL)
+ 	  debug_return;
+@@ -726,7 +726,7 @@ static int sudo_sss_lookup(struct sudo_n
+     struct sss_sudo_result *sss_result = NULL;
+     struct sss_sudo_rule   *rule;
+     uint32_t i, state = 0;
+-    debug_decl(sudo_sss_lookup, SUDO_DEBUG_LDAP);
++    debug_decl(sudo_sss_lookup, SUDO_DEBUG_SSSD);
+ 
+     /* Fetch list of sudoRole entries that match user and host. */
+     sss_result = sudo_sss_result_get(nss, sudo_user.pw, &state);
+@@ -738,7 +738,7 @@ static int sudo_sss_lookup(struct sudo_n
+     if (pwflag) {
+ 	int doauth = UNSPEC;
+ 	int matched = UNSPEC;
+-	enum def_tuple pwcheck = 
++	enum def_tuple pwcheck =
+ 	    (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
+ 
+ 	DPRINTF(2, "perform search for pwflag %d", pwflag);
+@@ -842,7 +842,7 @@ static int sudo_sss_display_cmnd(struct 
+      struct sss_sudo_result *sss_result = NULL;
+      struct sss_sudo_rule *rule;
+      int i, found = false;
+-     debug_decl(sudo_sss_display_cmnd, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_display_cmnd, SUDO_DEBUG_SSSD);
+ 
+      if (handle == NULL)
+ 	  goto done;
+@@ -893,7 +893,7 @@ static int sudo_sss_display_defaults(str
+      char *prefix, *val, **val_array = NULL;
+      int count = 0, i, j;
+ 
+-     debug_decl(sudo_sss_display_defaults, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_display_defaults, SUDO_DEBUG_SSSD);
+ 
+      if (handle == NULL)
+ 	  goto done;
+@@ -934,7 +934,7 @@ static int sudo_sss_display_defaults(str
+ 	       prefix = ", ";
+ 	       count++;
+ 	  }
+-	  
++
+ 	  sss_sudo_free_values(val_array);
+ 	  val_array = NULL;
+      }
+@@ -948,7 +948,7 @@ done:
+ static int sudo_sss_display_bound_defaults(struct sudo_nss *nss,
+ 					    struct passwd *pw, struct lbuf *lbuf)
+ {
+-     debug_decl(sudo_sss_display_bound_defaults, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_display_bound_defaults, SUDO_DEBUG_SSSD);
+      debug_return_int(0);
+ }
+ 
+@@ -956,7 +956,7 @@ static int sudo_sss_display_entry_long(s
+ {
+      char **val_array = NULL;
+      int count = 0, i;
+-     debug_decl(sudo_sss_display_entry_long, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_display_entry_long, SUDO_DEBUG_SSSD);
+ 
+      /* get the RunAsUser Values from the entry */
+      lbuf_append(lbuf, "    RunAsUsers: ");
+@@ -1051,7 +1051,7 @@ static int sudo_sss_display_entry_short(
+ {
+      char **val_array = NULL;
+      int count = 0, i;
+-     debug_decl(sudo_sss_display_entry_short, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_display_entry_short, SUDO_DEBUG_SSSD);
+ 
+      lbuf_append(lbuf, "    (");
+ 
+@@ -1164,7 +1164,7 @@ static int sudo_sss_display_privs(struct
+      struct sss_sudo_result *sss_result = NULL;
+      struct sss_sudo_rule *rule;
+      unsigned int i, count = 0;
+-     debug_decl(sudo_sss_display_privs, SUDO_DEBUG_LDAP);
++     debug_decl(sudo_sss_display_privs, SUDO_DEBUG_SSSD);
+ 
+      if (handle == NULL)
+ 	  debug_return_int(-1);
diff --git a/sudo-1.8.5-remove-source-when-open-failed.patch b/sudo-1.8.5-remove-source-when-open-failed.patch
new file mode 100644
index 0000000..0267f39
--- /dev/null
+++ b/sudo-1.8.5-remove-source-when-open-failed.patch
@@ -0,0 +1,33 @@
+diff -rup original/plugins/sudoers/sudoers.c new/plugins/sudoers/sudoers.c
+--- original/plugins/sudoers/sudoers.c	2012-07-19 12:13:31.292479203 +0200
++++ new/plugins/sudoers/sudoers.c	2012-07-19 12:14:02.898844521 +0200
+@@ -145,6 +145,7 @@ sudoers_policy_open(unsigned int version
+     volatile int sources = 0;
+     sigaction_t sa;
+     struct sudo_nss *nss;
++    struct sudo_nss *nss_next;
+     debug_decl(sudoers_policy_open, SUDO_DEBUG_PLUGIN)
+ 
+     sudo_version = version;
+@@ -201,12 +202,15 @@ sudoers_policy_open(unsigned int version
+     set_perms(PERM_ROOT);
+ 
+     /* Open and parse sudoers, set global defaults */
+-    tq_foreach_fwd(snl, nss) {
+-	if (nss->open(nss) == 0 && nss->parse(nss) == 0) {
+-	    sources++;
+-	    if (nss->setdefs(nss) != 0)
+-		log_error(NO_STDERR, _("problem with defaults entries"));
+-	}
++    for (nss = snl->first; nss != NULL; nss = nss_next) {
++        nss_next = nss->next;
++        if (nss->open(nss) == 0 && nss->parse(nss) == 0) {
++            sources++;
++            if (nss->setdefs(nss) != 0)
++                log_error(NO_STDERR, _("problem with defaults entries"));
++        } else {
++            tq_remove(snl, nss);
++        }
+     }
+     if (sources == 0) {
+ 	warningx(_("no valid sudoers sources found, quitting"));
diff --git a/sudo-1.8.5-sssd-dlopen-lib.patch b/sudo-1.8.5-sssd-dlopen-lib.patch
new file mode 100644
index 0000000..e9b1914
--- /dev/null
+++ b/sudo-1.8.5-sssd-dlopen-lib.patch
@@ -0,0 +1,905 @@
+diff -rup original/configure.in new/configure.in
+--- original/configure.in	2012-07-19 12:13:15.872301022 +0200
++++ new/configure.in	2012-07-23 11:31:42.821466529 +0200
+@@ -101,6 +101,7 @@ AC_SUBST([root_sudo])
+ AC_SUBST([path_info])
+ AC_SUBST([ldap_conf])
+ AC_SUBST([ldap_secret])
++AC_SUBST([sssd_lib])
+ AC_SUBST([nsswitch_conf])
+ AC_SUBST([netsvc_conf])
+ AC_SUBST([secure_path])
+@@ -290,8 +291,6 @@ dnl
+ AC_ARG_WITH(sssd, [AS_HELP_STRING([--with-sssd], [enable SSSD support])],
+ [case $with_sssd in
+     yes)
+-		SUDO_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
+-		SUDOERS_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
+ 		SUDOERS_OBJS="${SUDOERS_OBJS} sssd.lo"
+ 		AC_DEFINE(HAVE_SSSD)
+ 		;;
+@@ -300,6 +299,11 @@ AC_ARG_WITH(sssd, [AS_HELP_STRING([--wit
+ 		;;
+ esac])
+ 
++AC_ARG_WITH(sssd-lib, [AS_HELP_STRING([--with-sssd-lib], [path to the SSSD library])])
++sssd_lib="\"LIBDIR\""
++test -n "$with_sssd_lib" && sssd_lib="$with_sssd_lib"
++SUDO_DEFINE_UNQUOTED(_PATH_SSSD_LIB, "$sssd_lib", [Path to the SSSD library])
++
+ AC_ARG_WITH(incpath, [AS_HELP_STRING([--with-incpath], [additional places to look for include files])],
+ [case $with_incpath in
+     yes)	AC_MSG_ERROR(["must give --with-incpath an argument."])
+diff -rup original/pathnames.h.in new/pathnames.h.in
+--- original/pathnames.h.in	2012-07-19 12:13:15.779299949 +0200
++++ new/pathnames.h.in	2012-07-19 15:58:49.454653685 +0200
+@@ -157,6 +157,10 @@
+ #undef	_PATH_LDAP_SECRET
+ #endif /* _PATH_LDAP_SECRET */
+ 
++#ifndef _PATH_SSSD_LIB
++#undef  _PATH_SSSD_LIB
++#endif /* _PATH_SSSD_LIB */
++
+ #ifndef _PATH_NSSWITCH_CONF
+ #undef	_PATH_NSSWITCH_CONF
+ #endif /* _PATH_NSSWITCH_CONF */
+diff -rup original/plugins/sudoers/Makefile.in new/plugins/sudoers/Makefile.in
+--- original/plugins/sudoers/Makefile.in	2012-07-19 12:13:15.756299680 +0200
++++ new/plugins/sudoers/Makefile.in	2012-07-23 11:31:56.084610531 +0200
+@@ -32,6 +32,7 @@ top_srcdir = @top_srcdir@
+ incdir = $(top_srcdir)/include
+ docdir = @docdir@
+ timedir = @timedir@
++libdir = @libdir@
+ 
+ # Compiler & tools to use
+ CC = @CC@
+@@ -51,7 +52,7 @@ SUDOERS_LIBS = @SUDOERS_LIBS@ @AFS_LIBS@
+ REPLAY_LIBS = @REPLAY_LIBS@ @ZLIB@
+ 
+ # C preprocessor flags
+-CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(devdir) -I$(srcdir) -I$(top_srcdir) @CPPFLAGS@
++CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(devdir) -I$(srcdir) -I$(top_srcdir) -DLIBDIR=\"$(libdir)\" @CPPFLAGS@
+ 
+ # Usually -O and/or -g
+ CFLAGS = @CFLAGS@
+diff -rup original/plugins/sudoers/sssd.c new/plugins/sudoers/sssd.c
+--- original/plugins/sudoers/sssd.c	2012-07-19 12:13:15.667298652 +0200
++++ new/plugins/sudoers/sssd.c	2012-07-23 11:32:04.260699269 +0200
+@@ -44,23 +44,70 @@
+ #if TIME_WITH_SYS_TIME
+ # include <time.h>
+ #endif
++#ifdef HAVE_DLOPEN
++# include <dlfcn.h>
++#else
++# include "compat/dlfcn.h"
++#endif
+ #include <ctype.h>
+ #include <pwd.h>
+ #include <grp.h>
+ 
+-#include <sss_sudo.h>
+ #include <errno.h>
++#include <stdint.h>
+ 
+ #include "sudoers.h"
+ #include "parse.h"
+ #include "lbuf.h"
+ #include "sudo_debug.h"
+ 
++/* SSSD <--> SUDO interface - do not change */
++struct sss_sudo_attr {
++    char *name;
++    char **values;
++    unsigned int num_values;
++};
++
++struct sss_sudo_rule {
++    unsigned int num_attrs;
++    struct sss_sudo_attr *attrs;
++};
++
++struct sss_sudo_result {
++    unsigned int num_rules;
++    struct sss_sudo_rule *rules;
++};
++
++typedef int  (*sss_sudo_send_recv_t)(uid_t, const char*, const char*,
++                                     uint32_t*, struct sss_sudo_result**);
++
++typedef int  (*sss_sudo_send_recv_defaults_t)(uid_t, const char*, uint32_t*,
++                                              char**, struct sss_sudo_result**);
++
++typedef void (*sss_sudo_free_result_t)(struct sss_sudo_result*);
++
++typedef int  (*sss_sudo_get_values_t)(struct sss_sudo_rule*, const char*,
++                                      char***);
++
++typedef void (*sss_sudo_free_values_t)(char**);
++
+ /* sudo_nss implementation */
++
++struct sudo_sss_handle {
++     char *domainname;
++     struct passwd *pw;
++     void *ssslib;
++     sss_sudo_send_recv_t fn_send_recv;
++     sss_sudo_send_recv_defaults_t fn_send_recv_defaults;
++     sss_sudo_free_result_t fn_free_result;
++     sss_sudo_get_values_t fn_get_values;
++     sss_sudo_free_values_t fn_free_values;
++};
++
+ static int sudo_sss_open(struct sudo_nss *nss);
+ static int sudo_sss_close(struct sudo_nss *nss);
+ static int sudo_sss_parse(struct sudo_nss *nss);
+-static void sudo_sss_parse_options(struct sss_sudo_rule *rule);
++static void sudo_sss_parse_options(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule);
+ static int sudo_sss_setdefs(struct sudo_nss *nss);
+ static int sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag);
+ static int sudo_sss_display_cmnd(struct sudo_nss *nss, struct passwd *pw);
+@@ -121,7 +168,7 @@ static void sudo_sss_rulecpy(struct sss_
+ #define _SUDO_SSS_STATE_HOSTMATCH 0x01
+ #define _SUDO_SSS_STATE_USERMATCH 0x02
+ 
+-static struct sss_sudo_result *sudo_sss_filter_result(struct sss_sudo_result *in_res, int (*filterp)(struct sss_sudo_rule *, void *), int act, void *filterp_arg)
++static struct sss_sudo_result *sudo_sss_filter_result(struct sudo_sss_handle *handle, struct sss_sudo_result *in_res, int (*filterp)(struct sudo_sss_handle *, struct sss_sudo_rule *, void *), int act, void *filterp_arg)
+ {
+      struct sss_sudo_result *out_res;
+      int i, l, r;
+@@ -140,7 +187,7 @@ static struct sss_sudo_result *sudo_sss_
+      out_res->num_rules = 0;
+ 
+      for (i = l = 0; i < in_res->num_rules; ++i) {
+-	  r = filterp(in_res->rules + i, filterp_arg);
++	  r = filterp(handle, in_res->rules + i, filterp_arg);
+ 
+ 	  if (( r && act == _SUDO_SSS_FILTER_INCLUDE) ||
+ 	      (!r && act == _SUDO_SSS_FILTER_EXCLUDE))
+@@ -164,11 +211,6 @@ static struct sss_sudo_result *sudo_sss_
+      debug_return_ptr(out_res);
+ }
+ 
+-struct sudo_sss_handle {
+-     char *domainname;
+-     struct passwd *pw;
+-};
+-
+ struct sudo_nss sudo_nss_sss = {
+     &sudo_nss_sss,
+     NULL,
+@@ -188,10 +230,50 @@ struct sudo_nss sudo_nss_sss = {
+ static int sudo_sss_open(struct sudo_nss *nss)
+ {
+      struct sudo_sss_handle *handle;
++     static const char path[] = _PATH_SSSD_LIB"/libsss_sudo.so";
+      debug_decl(sudo_sss_open, SUDO_DEBUG_SSSD);
+ 
+      /* Create a handle container. */
+      handle = emalloc(sizeof(struct sudo_sss_handle));
++
++     /* Load symbols */
++     handle->ssslib = dlopen(path, RTLD_LAZY);
++     if (handle->ssslib == NULL) {
++         warningx(_("Unable to dlopen %s: %s"), path, dlerror());
++         warningx(_("Unable to initialize SSS source. Is SSSD installed on your machine?"));
++         debug_return_int(EFAULT);
++     }
++
++     handle->fn_send_recv = dlsym(handle->ssslib, "sss_sudo_send_recv");
++     if (handle->fn_send_recv == NULL) {
++         warningx(_("unable to find symbol \"sss_sudo_send_recv\" in %s"), path);
++         debug_return_int(EFAULT);
++     }
++
++     handle->fn_send_recv_defaults = dlsym(handle->ssslib, "sss_sudo_send_recv_defaults");
++     if (handle->fn_send_recv_defaults == NULL) {
++         warningx(_("unable to find symbol \"sss_sudo_send_recv_defaults\" in %s"), path);
++         debug_return_int(EFAULT);
++     }
++
++     handle->fn_free_result = dlsym(handle->ssslib, "sss_sudo_free_result");
++     if (handle->fn_free_result == NULL) {
++         warningx(_("unable to find symbol \"sss_sudo_free_result\" in %s"), path);
++         debug_return_int(EFAULT);
++     }
++
++     handle->fn_get_values = dlsym(handle->ssslib, "sss_sudo_get_values");
++     if (handle->fn_get_values == NULL) {
++         warningx(_("unable to find symbol \"sss_sudo_get_values\" in %s"), path);
++         debug_return_int(EFAULT);
++     }
++
++     handle->fn_free_values = dlsym(handle->ssslib, "sss_sudo_free_values");
++     if (handle->fn_free_values == NULL) {
++         warningx(_("unable to find symbol \"sss_sudo_free_values\" in %s"), path);
++         debug_return_int(EFAULT);
++     }
++
+      handle->domainname = NULL;
+      handle->pw = sudo_user.pw;
+      nss->handle = handle;
+@@ -204,7 +286,14 @@ static int sudo_sss_open(struct sudo_nss
+ // ok
+ static int sudo_sss_close(struct sudo_nss *nss)
+ {
++     struct sudo_sss_handle *handle;
+      debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD);
++
++     if (nss && nss->handle) {
++         handle = nss->handle;
++         dlclose(handle->ssslib);
++     }
++
+      efree(nss->handle);
+      debug_return_int(0);
+ }
+@@ -231,11 +320,11 @@ static int sudo_sss_setdefs(struct sudo_
+ 
+      sudo_debug_printf(1, "Looking for cn=defaults");
+ 
+-     if (sss_sudo_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
++     if (handle->fn_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
+ 				     &sss_error, &handle->domainname,
+ 				     &sss_result) != 0)
+      {
+-	  sudo_debug_printf(2, "sss_sudo_send_recv_defaults: != 0, sss_error=%u", sss_error);
++	  sudo_debug_printf(2, "handle->fn_send_recv_defaults: != 0, sss_error=%u", sss_error);
+ 	  debug_return_int(-1);
+      }
+ 
+@@ -250,10 +339,10 @@ static int sudo_sss_setdefs(struct sudo_
+      for (i = 0; i < sss_result->num_rules; ++i) {
+ 	  sudo_debug_printf(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
+ 	  sss_rule = sss_result->rules + i;
+-	  sudo_sss_parse_options(sss_rule);
++	  sudo_sss_parse_options(handle, sss_rule);
+      }
+ 
+-     sss_sudo_free_result(sss_result);
++     handle->fn_free_result(sss_result);
+      debug_return_int(0);
+ }
+ 
+@@ -276,7 +365,7 @@ static int sudo_sss_checkpw(struct sudo_
+ }
+ 
+ static int
+-sudo_sss_check_runas_user(struct sss_sudo_rule *sss_rule)
++sudo_sss_check_runas_user(struct sudo_sss_handle *handle, struct sss_sudo_rule *sss_rule)
+ {
+      char **val_array = NULL;
+      char *val;
+@@ -287,7 +376,7 @@ sudo_sss_check_runas_user(struct sss_sud
+ 	  debug_return_int(UNSPEC);
+ 
+      /* get the runas user from the entry */
+-     switch (sss_sudo_get_values(sss_rule, "sudoRunAsUser", &val_array))
++     switch (handle->fn_get_values(sss_rule, "sudoRunAsUser", &val_array))
+      {
+      case 0:
+ 	  break;
+@@ -295,7 +384,7 @@ sudo_sss_check_runas_user(struct sss_sud
+ 	  sudo_debug_printf(2, "No result. Trying old style (sudoRunAs)");
+ 
+ 	  /* try old style */
+-	  switch (sss_sudo_get_values(sss_rule, "sudoRunAs", &val_array))
++	  switch (handle->fn_get_values(sss_rule, "sudoRunAs", &val_array))
+ 	  {
+ 	  case 0:
+ 	       break;
+@@ -307,12 +396,12 @@ sudo_sss_check_runas_user(struct sss_sud
+ 		*/
+ 	       return !strcasecmp(runas_pw->pw_name, def_runas_default);
+ 	  default:
+-	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
++	       sudo_debug_printf(2, "handle->fn_get_values(sudoRunAs): != 0");
+ 	       debug_return_int(UNSPEC);
+ 	  }
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsUser): != 0");
+ 	  debug_return_int(UNSPEC);
+      }
+ 
+@@ -373,13 +462,13 @@ sudo_sss_check_runas_user(struct sss_sud
+ 	  sudo_debug_printf(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
+      }
+ 
+-     sss_sudo_free_values(val_array); /* cleanup */
++     handle->fn_free_values(val_array); /* cleanup */
+ 
+      debug_return_int(ret);
+ }
+ 
+ static int
+-sudo_sss_check_runas_group(struct sss_sudo_rule *rule)
++sudo_sss_check_runas_group(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
+ {
+      char **val_array = NULL;
+      char *val;
+@@ -391,7 +480,7 @@ sudo_sss_check_runas_group(struct sss_su
+ 	  debug_return_int(UNSPEC);
+ 
+      /* get the values from the entry */
+-     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
++     switch (handle->fn_get_values(rule, "sudoRunAsGroup", &val_array))
+      {
+      case 0:
+ 	  break;
+@@ -399,7 +488,7 @@ sudo_sss_check_runas_group(struct sss_su
+ 	  sudo_debug_printf(2, "No result.");
+ 	  debug_return_int(false);
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsGroup): != 0");
+ 	  debug_return_int(UNSPEC);
+      }
+ 
+@@ -414,7 +503,7 @@ sudo_sss_check_runas_group(struct sss_su
+ 	  sudo_debug_printf(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
+      }
+ 
+-     sss_sudo_free_values(val_array);
++     handle->fn_free_values(val_array);
+ 
+      debug_return_int(ret);
+ }
+@@ -424,7 +513,7 @@ sudo_sss_check_runas_group(struct sss_su
+  * else false.  RunAs info is optional.
+  */
+ static int
+-sudo_sss_check_runas(struct sss_sudo_rule *rule)
++sudo_sss_check_runas(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
+ {
+     int ret;
+     debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD);
+@@ -432,13 +521,13 @@ sudo_sss_check_runas(struct sss_sudo_rul
+     if (rule == NULL)
+ 	 debug_return_int(false);
+ 
+-    ret = sudo_sss_check_runas_user(rule) != false &&
+-	 sudo_sss_check_runas_group(rule) != false;
++    ret = sudo_sss_check_runas_user(handle, rule) != false &&
++	 sudo_sss_check_runas_group(handle, rule) != false;
+ 
+     debug_return_int(ret);
+ }
+ 
+-static int sudo_sss_check_host(struct sss_sudo_rule *rule)
++static int sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
+ {
+     char **val_array, *val;
+     int ret = false, i;
+@@ -448,7 +537,7 @@ static int sudo_sss_check_host(struct ss
+ 	 debug_return_int(ret);
+ 
+     /* get the values from the rule */
+-    switch (sss_sudo_get_values(rule, "sudoHost", &val_array))
++    switch (handle->fn_get_values(rule, "sudoHost", &val_array))
+     {
+     case 0:
+ 	 break;
+@@ -456,7 +545,7 @@ static int sudo_sss_check_host(struct ss
+ 	 sudo_debug_printf(2, "No result.");
+ 	 debug_return_int(false);
+     default:
+-	 sudo_debug_printf(2, "sss_sudo_get_values(sudoHost): != 0");
++	 sudo_debug_printf(2, "handle->fn_get_values(sudoHost): != 0");
+ 	 debug_return_int(ret);
+     }
+ 
+@@ -474,17 +563,17 @@ static int sudo_sss_check_host(struct ss
+ 	 sudo_debug_printf(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
+     }
+ 
+-    sss_sudo_free_values(val_array);
++    handle->fn_free_values(val_array);
+ 
+     debug_return_int(ret);
+ }
+ 
+-static int sudo_sss_result_filterp(struct sss_sudo_rule *rule, void *unused)
++static int sudo_sss_result_filterp(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, void *unused)
+ {
+      (void)unused;
+      debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD);
+ 
+-     if (sudo_sss_check_host(rule))
++     if (sudo_sss_check_host(handle, rule))
+ 	  debug_return_int(1);
+      else
+ 	  debug_return_int(0);
+@@ -505,7 +594,7 @@ static struct sss_sudo_result *sudo_sss_
+ 
+      u_sss_result = f_sss_result = NULL;
+ 
+-     switch (ret = sss_sudo_send_recv(handle->pw->pw_uid, handle->pw->pw_name,
++     switch (ret = handle->fn_send_recv(handle->pw->pw_uid, handle->pw->pw_name,
+ 				      handle->domainname, &sss_error, &u_sss_result))
+      {
+      case 0:
+@@ -530,11 +619,11 @@ static struct sss_sudo_result *sudo_sss_
+ 	  }
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
++	  sudo_debug_printf(2, "handle->fn_send_recv: != 0: ret=%d", ret);
+ 	  debug_return_ptr(NULL);
+      }
+ 
+-     f_sss_result = sudo_sss_filter_result(u_sss_result, sudo_sss_result_filterp,
++     f_sss_result = sudo_sss_filter_result(handle, u_sss_result, sudo_sss_result_filterp,
+ 					   _SUDO_SSS_FILTER_INCLUDE, NULL);
+ 
+      if (f_sss_result != NULL)
+@@ -547,7 +636,7 @@ static struct sss_sudo_result *sudo_sss_
+      sudo_debug_printf(3, "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)",
+ 	     u_sss_result, u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
+ 
+-     sss_sudo_free_result(u_sss_result);
++     handle->fn_free_result(u_sss_result);
+ 
+      debug_return_ptr(f_sss_result);
+ }
+@@ -557,7 +646,7 @@ static struct sss_sudo_result *sudo_sss_
+  * Returns true if found and allowed, false if negated, else UNSPEC.
+  */
+ static int
+-sudo_sss_check_bool(struct sss_sudo_rule *rule, char *option)
++sudo_sss_check_bool(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, char *option)
+ {
+      char ch, *var, **val_array = NULL;
+      int i, ret = UNSPEC;
+@@ -566,7 +655,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
+      if (rule == NULL)
+ 	  debug_return_int(ret);
+ 
+-     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
++     switch (handle->fn_get_values(rule, "sudoOption", &val_array))
+      {
+      case 0:
+ 	  break;
+@@ -574,7 +663,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
+ 	  sudo_debug_printf(2, "No result.");
+ 	  debug_return_int(ret);
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values: != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values: != 0");
+ 	  debug_return_int(ret);
+      }
+ 
+@@ -589,7 +678,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
+ 	       ret = (ch != '!');
+      }
+ 
+-     sss_sudo_free_values(val_array);
++     handle->fn_free_values(val_array);
+ 
+      debug_return_int(ret);
+ }
+@@ -599,7 +688,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
+  * false if disallowed and UNSPEC if not matched.
+  */
+ static int
+-sudo_sss_check_command(struct sss_sudo_rule *rule, int *setenv_implied)
++sudo_sss_check_command(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, int *setenv_implied)
+ {
+      char **val_array = NULL, *val;
+      char *allowed_cmnd, *allowed_args;
+@@ -609,7 +698,7 @@ sudo_sss_check_command(struct sss_sudo_r
+      if (rule == NULL)
+ 	  debug_return_int(ret);
+ 
+-     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array))
++     switch (handle->fn_get_values(rule, "sudoCommand", &val_array))
+      {
+      case 0:
+ 	  break;
+@@ -617,7 +706,7 @@ sudo_sss_check_command(struct sss_sudo_r
+ 	  sudo_debug_printf(2, "No result.");
+ 	  debug_return_int(ret);
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values: != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values: != 0");
+ 	  debug_return_int(ret);
+      }
+ 
+@@ -662,13 +751,13 @@ sudo_sss_check_command(struct sss_sudo_r
+ 	  efree(allowed_cmnd);	/* cleanup */
+      }
+ 
+-     sss_sudo_free_values(val_array); /* more cleanup */
++     handle->fn_free_values(val_array); /* more cleanup */
+ 
+      debug_return_int(ret);
+ }
+ 
+ static void
+-sudo_sss_parse_options(struct sss_sudo_rule *rule)
++sudo_sss_parse_options(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
+ {
+      int i;
+      char op, *v, *val;
+@@ -678,7 +767,7 @@ sudo_sss_parse_options(struct sss_sudo_r
+      if (rule == NULL)
+ 	  debug_return;
+ 
+-     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
++     switch (handle->fn_get_values(rule, "sudoOption", &val_array))
+      {
+      case 0:
+ 	  break;
+@@ -686,7 +775,7 @@ sudo_sss_parse_options(struct sss_sudo_r
+ 	  sudo_debug_printf(2, "No result.");
+ 	  debug_return;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoOption): != 0");
+ 	  debug_return;
+      }
+ 
+@@ -718,7 +807,7 @@ sudo_sss_parse_options(struct sss_sudo_r
+ 	  efree(v);
+      }
+ 
+-     sss_sudo_free_values(val_array);
++     handle->fn_free_values(val_array);
+      debug_return;
+ }
+ 
+@@ -726,6 +815,7 @@ static int sudo_sss_lookup(struct sudo_n
+ {
+     int rc, setenv_implied;
+ 
++    struct sudo_sss_handle *handle = nss->handle;
+     struct sss_sudo_result *sss_result = NULL;
+     struct sss_sudo_rule   *rule;
+     uint32_t i, state = 0;
+@@ -750,12 +840,12 @@ static int sudo_sss_lookup(struct sudo_n
+ 		  rule = sss_result->rules + i;
+ 		  if ((pwcheck == any && doauth != false) ||
+ 		      (pwcheck == all && doauth == false)) {
+-		       doauth = sudo_sss_check_bool(rule, "authenticate");
++		       doauth = sudo_sss_check_bool(handle, rule, "authenticate");
+ 		  }
+ 		  /* Only check the command when listing another user. */
+ 		  if (user_uid == 0 || list_pw == NULL ||
+ 		      user_uid == list_pw->pw_uid ||
+-		      sudo_sss_check_command(rule, NULL)) {
++		      sudo_sss_check_command(handle, rule, NULL)) {
+ 		       matched = true;
+ 		       break;
+ 		  }
+@@ -791,9 +881,9 @@ static int sudo_sss_lookup(struct sudo_n
+     if (sss_result != NULL) {
+ 	 for (i = 0; i < sss_result->num_rules; i++) {
+ 	      rule = sss_result->rules + i;
+-	      if (!sudo_sss_check_runas(rule))
++	      if (!sudo_sss_check_runas(handle, rule))
+ 		   continue;
+-	      rc = sudo_sss_check_command(rule, &setenv_implied);
++	      rc = sudo_sss_check_command(handle, rule, &setenv_implied);
+ 	      if (rc != UNSPEC) {
+ 		   /* We have a match. */
+ 		   sudo_debug_printf(1, "Command %sallowed", rc == true ? "" : "NOT ");
+@@ -802,7 +892,7 @@ static int sudo_sss_lookup(struct sudo_n
+ 			/* Apply entry-specific options. */
+ 			if (setenv_implied)
+ 			     def_setenv = true;
+-			sudo_sss_parse_options(rule);
++			sudo_sss_parse_options(handle, rule);
+ #ifdef HAVE_SELINUX
+ 			/* Set role and type if not specified on command line. */
+ 			if (user_role == NULL)
+@@ -865,8 +955,8 @@ static int sudo_sss_display_cmnd(struct 
+ 
+      for (i = 0; i < sss_result->num_rules; i++) {
+ 	  rule = sss_result->rules + i;
+-	  if (sudo_sss_check_command(rule, NULL) &&
+-	      sudo_sss_check_runas(rule)) {
++	  if (sudo_sss_check_command(handle, rule, NULL) &&
++	      sudo_sss_check_runas(handle, rule)) {
+ 	       found = true;
+ 	       goto done;
+ 	  }
+@@ -878,7 +968,7 @@ done:
+ 		 user_args ? " " : "", user_args ? user_args : "");
+ 
+      if (sss_result != NULL)
+-	  sss_sudo_free_result(sss_result);
++	  handle->fn_free_result(sss_result);
+ 
+      debug_return_int(!found);
+ }
+@@ -901,11 +991,11 @@ static int sudo_sss_display_defaults(str
+      if (handle == NULL)
+ 	  goto done;
+ 
+-     if (sss_sudo_send_recv_defaults(pw->pw_uid, pw->pw_name,
++     if (handle->fn_send_recv_defaults(pw->pw_uid, pw->pw_name,
+ 				     &sss_error, &handle->domainname,
+ 				     &sss_result) != 0)
+      {
+-	  sudo_debug_printf(2, "sss_sudo_send_recv_defaults: !=0, sss_error=%u", sss_error);
++	  sudo_debug_printf(2, "handle->fn_send_recv_defaults: !=0, sss_error=%u", sss_error);
+ 	  goto done;
+      }
+ 
+@@ -922,7 +1012,7 @@ static int sudo_sss_display_defaults(str
+      for (i = 0; i < sss_result->num_rules; ++i) {
+ 	  rule = sss_result->rules + i;
+ 
+-	  switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
++	  switch (handle->fn_get_values(rule, "sudoOption", &val_array))
+ 	  {
+ 	  case 0:
+ 	       break;
+@@ -930,7 +1020,7 @@ static int sudo_sss_display_defaults(str
+ 	       sudo_debug_printf(2, "No result.");
+ 	       continue;
+ 	  default:
+-	       sudo_debug_printf(2, "sss_sudo_get_values: != 0");
++	       sudo_debug_printf(2, "handle->fn_get_values: != 0");
+ 	       continue;
+ 	  }
+ 
+@@ -946,11 +1036,11 @@ static int sudo_sss_display_defaults(str
+ 	       count++;
+ 	  }
+ 
+-	  sss_sudo_free_values(val_array);
++	  handle->fn_free_values(val_array);
+ 	  val_array = NULL;
+      }
+ 
+-     sss_sudo_free_result(sss_result);
++     handle->fn_free_result(sss_result);
+ done:
+      debug_return_int(count);
+ }
+@@ -963,7 +1053,7 @@ static int sudo_sss_display_bound_defaul
+      debug_return_int(0);
+ }
+ 
+-static int sudo_sss_display_entry_long(struct sss_sudo_rule *rule, struct lbuf *lbuf)
++static int sudo_sss_display_entry_long(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, struct lbuf *lbuf)
+ {
+      char **val_array = NULL;
+      int count = 0, i;
+@@ -971,94 +1061,94 @@ static int sudo_sss_display_entry_long(s
+ 
+      /* get the RunAsUser Values from the entry */
+      lbuf_append(lbuf, "    RunAsUsers: ");
+-     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
++     switch (handle->fn_get_values(rule, "sudoRunAsUser", &val_array))
+      {
+      case 0:
+ 	  for (i = 0; val_array[i] != NULL; ++i)
+ 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
+-	  sss_sudo_free_values(val_array);
++	  handle->fn_free_values(val_array);
+ 	  break;
+      case ENOENT:
+-	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
++	  switch (handle->fn_get_values(rule, "sudoRunAs", &val_array))
+ 	  {
+ 	  case 0:
+ 	       for (i = 0; val_array[i] != NULL; ++i)
+ 		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
+-	       sss_sudo_free_values(val_array);
++	       handle->fn_free_values(val_array);
+ 	       break;
+ 	  case ENOENT:
+ 	       sudo_debug_printf(2, "No result.");
+ 	       lbuf_append(lbuf, "%s", def_runas_default);
+ 	       break;
+ 	  default:
+-	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
++	       sudo_debug_printf(2, "handle->fn_get_values(sudoRunAs): != 0");
+ 	       debug_return_int(count);
+ 	  }
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsUser): != 0");
+ 	  debug_return_int(count);
+      }
+      lbuf_append(lbuf, "\n");
+ 
+      /* get the RunAsGroup Values from the entry */
+-     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
++     switch (handle->fn_get_values(rule, "sudoRunAsGroup", &val_array))
+      {
+      case 0:
+ 	  lbuf_append(lbuf, "    RunAsGroups: ");
+ 	  for (i = 0; val_array[i] != NULL; ++i)
+ 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
+-	  sss_sudo_free_values(val_array);
++	  handle->fn_free_values(val_array);
+ 	  lbuf_append(lbuf, "\n");
+ 	  break;
+      case ENOENT:
+ 	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsGroup): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+      /* get the Option Values from the entry */
+-     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
++     switch (handle->fn_get_values(rule, "sudoOption", &val_array))
+      {
+      case 0:
+ 	  lbuf_append(lbuf, "    Options: ");
+ 	  for (i = 0; val_array[i] != NULL; ++i)
+ 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
+-	  sss_sudo_free_values(val_array);
++	  handle->fn_free_values(val_array);
+ 	  lbuf_append(lbuf, "\n");
+ 	  break;
+      case ENOENT:
+ 	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoOption): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+      /* Get the command values from the entry. */
+-     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
++     switch (handle->fn_get_values(rule, "sudoCommand", &val_array)) {
+      case 0:
+ 	  lbuf_append(lbuf, _("    Commands:\n"));
+ 	  for (i = 0; val_array[i] != NULL; ++i) {
+ 	       lbuf_append(lbuf, "\t%s\n", val_array[i]);
+ 	       count++;
+ 	  }
+-	  sss_sudo_free_values(val_array);
++	  handle->fn_free_values(val_array);
+ 	  break;
+      case ENOENT:
+ 	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoCommand): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+      debug_return_int(count);
+ }
+ 
+-static int sudo_sss_display_entry_short(struct sss_sudo_rule *rule, struct lbuf *lbuf)
++static int sudo_sss_display_entry_short(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, struct lbuf *lbuf)
+ {
+      char **val_array = NULL;
+      int count = 0, i;
+@@ -1067,58 +1157,58 @@ static int sudo_sss_display_entry_short(
+      lbuf_append(lbuf, "    (");
+ 
+      /* get the RunAsUser Values from the entry */
+-     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
++     switch (handle->fn_get_values(rule, "sudoRunAsUser", &val_array))
+      {
+      case 0:
+ 	  for (i = 0; val_array[i] != NULL; ++i)
+ 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
+-	  sss_sudo_free_values(val_array);
++	  handle->fn_free_values(val_array);
+ 	  break;
+      case ENOENT:
+ 	  sudo_debug_printf(2, "No result. Trying old style (sudoRunAs).");
+ 	  /* try old style */
+-	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
++	  switch (handle->fn_get_values(rule, "sudoRunAs", &val_array))
+ 	  {
+ 	  case 0:
+ 	       for (i = 0; val_array[i] != NULL; ++i)
+ 		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
+-	       sss_sudo_free_values(val_array);
++	       handle->fn_free_values(val_array);
+ 	       break;
+ 	  case ENOENT:
+ 	       sudo_debug_printf(2, "No result.");
+ 	       lbuf_append(lbuf, "%s", def_runas_default);
+ 	       break;
+ 	  default:
+-	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
++	       sudo_debug_printf(2, "handle->fn_get_values(sudoRunAs): != 0");
+ 	       debug_return_int(count);
+ 	  }
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsUser): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+      /* get the RunAsGroup Values from the entry */
+-     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
++     switch (handle->fn_get_values(rule, "sudoRunAsGroup", &val_array))
+      {
+      case 0:
+ 	  lbuf_append(lbuf, " : ");
+ 	  for (i = 0; val_array[i] != NULL; ++i)
+ 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
+-	  sss_sudo_free_values(val_array);
++	  handle->fn_free_values(val_array);
+ 	  break;
+      case ENOENT:
+ 	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsGroup): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+      lbuf_append(lbuf, ") ");
+ 
+      /* get the Option Values from the entry */
+-     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
++     switch (handle->fn_get_values(rule, "sudoOption", &val_array))
+      {
+      case 0:
+ 	  for (i = 0; val_array[i] != NULL; ++i) {
+@@ -1136,30 +1226,30 @@ static int sudo_sss_display_entry_short(
+ 				"NOSETENV: " : "SETENV: ");
+ 	  }
+ 
+-	  sss_sudo_free_values(val_array);
++	  handle->fn_free_values(val_array);
+ 	  break;
+      case ENOENT:
+ 	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoOption): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+      /* get the Command Values from the entry */
+-     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
++     switch (handle->fn_get_values(rule, "sudoCommand", &val_array)) {
+      case 0:
+ 	  for (i = 0; val_array[i] != NULL; ++i) {
+ 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
+ 	       count++;
+ 	  }
+-	  sss_sudo_free_values(val_array);
++	  handle->fn_free_values(val_array);
+ 	  break;
+      case ENOENT:
+ 	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
++	  sudo_debug_printf(2, "handle->fn_get_values(sudoCommand): != 0");
+ 	  debug_return_int(count);
+      }
+      lbuf_append(lbuf, "\n");
+@@ -1193,13 +1283,13 @@ static int sudo_sss_display_privs(struct
+      for (i = 0; i < sss_result->num_rules; ++i) {
+ 	  rule = sss_result->rules + i;
+ 	  if (long_list)
+-	       count += sudo_sss_display_entry_long(rule, lbuf);
++	       count += sudo_sss_display_entry_long(handle, rule, lbuf);
+ 	  else
+-	       count += sudo_sss_display_entry_short(rule, lbuf);
++	       count += sudo_sss_display_entry_short(handle, rule, lbuf);
+      }
+ 
+      if (sss_result != NULL)
+-	  sss_sudo_free_result(sss_result);
++	  handle->fn_free_result(sss_result);
+ 
+      debug_return_int(count);
+ }
diff --git a/sudo-1.8.5-sssd-handle-sss_ret-correctly.patch b/sudo-1.8.5-sssd-handle-sss_ret-correctly.patch
new file mode 100644
index 0000000..b03592a
--- /dev/null
+++ b/sudo-1.8.5-sssd-handle-sss_ret-correctly.patch
@@ -0,0 +1,43 @@
+diff -rup original/plugins/sudoers/sssd.c new/plugins/sudoers/sssd.c
+--- original/plugins/sudoers/sssd.c	2012-07-18 13:17:53.026208728 +0200
++++ new/plugins/sudoers/sssd.c	2012-07-18 13:35:59.780623153 +0200
+@@ -239,6 +239,14 @@ static int sudo_sss_setdefs(struct sudo_
+ 	  debug_return_int(-1);
+      }
+ 
++     if (sss_error == ENOENT) {
++         sudo_debug_printf(2, "The user was not found in SSSD.");
++         debug_return_int(-1);
++     } else if(sss_error != 0) {
++         sudo_debug_printf(2, "sss_error=%u\n", sss_error);
++         debug_return_int(-1);
++     }
++
+      for (i = 0; i < sss_result->num_rules; ++i) {
+ 	  sudo_debug_printf(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
+ 	  sss_rule = sss_result->rules + i;
+@@ -515,7 +523,7 @@ static struct sss_sudo_result *sudo_sss_
+ 	       }
+ 	       break;
+ 	  case ENOENT:
+-	       sudo_debug_printf(2, "No result.");
++	       sudo_debug_printf(2, "The user was not found in SSSD.");
+ 	  default:
+ 	       sudo_debug_printf(2, "sss_error=%u\n", sss_error);
+ 	       debug_return_ptr(NULL);
+@@ -901,6 +909,14 @@ static int sudo_sss_display_defaults(str
+ 	  goto done;
+      }
+ 
++     if (sss_error == ENOENT) {
++         sudo_debug_printf(2, "The user was not found in SSSD.");
++         goto done;
++     } else if(sss_error != 0) {
++         sudo_debug_printf(2, "sss_error=%u\n", sss_error);
++         goto done;
++     }
++
+      handle->pw = pw;
+ 
+      for (i = 0; i < sss_result->num_rules; ++i) {
+
diff --git a/sudo-1.8.5-sssd-use-sudo_debug_printf.patch b/sudo-1.8.5-sssd-use-sudo_debug_printf.patch
new file mode 100644
index 0000000..25ac0ad
--- /dev/null
+++ b/sudo-1.8.5-sssd-use-sudo_debug_printf.patch
@@ -0,0 +1,600 @@
+diff -rup original/plugins/sudoers/sssd.c new/plugins/sudoers/sssd.c
+--- original/plugins/sudoers/sssd.c	2012-07-17 10:50:20.110201384 +0200
++++ new/plugins/sudoers/sssd.c	2012-07-17 11:09:31.213626613 +0200
+@@ -56,11 +56,6 @@
+ #include "lbuf.h"
+ #include "sudo_debug.h"
+ 
+-extern int debug_level;
+-#define __sssd_debug debug_level
+-
+-#define	DPRINTF(level, fmt, ...) if (__sssd_debug >= (level)) warningx("%s:%d: "fmt, __PRETTY_FUNCTION__, __LINE__, ##__VA_ARGS__)
+-
+ /* sudo_nss implementation */
+ static int sudo_sss_open(struct sudo_nss *nss);
+ static int sudo_sss_close(struct sudo_nss *nss);
+@@ -88,8 +83,8 @@ static void sudo_sss_attrcpy(struct sss_
+      int i;
+      debug_decl(sudo_sss_attrcpy, SUDO_DEBUG_SSSD)
+ 
+-     DPRINTF(3, "dst=%p, src=%p", dst, src);
+-     DPRINTF(2, "emalloc: cnt=%d", src->num_values);
++     sudo_debug_printf(3, "dst=%p, src=%p", dst, src);
++     sudo_debug_printf(2, "emalloc: cnt=%d", src->num_values);
+ 
+      dst->name = strdup(src->name);
+      dst->num_values = src->num_values;
+@@ -106,8 +101,8 @@ static void sudo_sss_rulecpy(struct sss_
+      int i;
+      debug_decl(sudo_sss_rulecpy, SUDO_DEBUG_SSSD)
+ 
+-     DPRINTF(3, "dst=%p, src=%p", dst, src);
+-     DPRINTF(2, "emalloc: cnt=%d", src->num_attrs);
++     sudo_debug_printf(3, "dst=%p, src=%p", dst, src);
++     sudo_debug_printf(2, "emalloc: cnt=%d", src->num_attrs);
+ 
+      dst->num_attrs = src->num_attrs;
+      dst->attrs = emalloc(sizeof(struct sss_sudo_attr) * dst->num_attrs);
+@@ -132,13 +127,13 @@ static struct sss_sudo_result *sudo_sss_
+      int i, l, r;
+      debug_decl(sudo_sss_filter_result, SUDO_DEBUG_SSSD)
+ 
+-     DPRINTF(3, "in_res=%p, count=%u, act=%s",
++     sudo_debug_printf(3, "in_res=%p, count=%u, act=%s",
+ 	     in_res, in_res->num_rules, act == _SUDO_SSS_FILTER_EXCLUDE ? "EXCLUDE" : "INCLUDE");
+ 
+      if (in_res == NULL)
+        debug_return_ptr(NULL);
+ 
+-     DPRINTF(3, "emalloc: cnt=%d", in_res->num_rules);
++     sudo_debug_printf(3, "emalloc: cnt=%d", in_res->num_rules);
+ 
+      out_res = emalloc(sizeof(struct sss_sudo_result));
+      out_res->rules = in_res->num_rules > 0 ? emalloc(sizeof(struct sss_sudo_rule) * in_res->num_rules) : NULL;
+@@ -150,7 +145,7 @@ static struct sss_sudo_result *sudo_sss_
+ 	  if (( r && act == _SUDO_SSS_FILTER_INCLUDE) ||
+ 	      (!r && act == _SUDO_SSS_FILTER_EXCLUDE))
+ 	  {
+-	       DPRINTF(3, "COPY (%s): %p[%u] => %p[%u] (= %p)",
++	       sudo_debug_printf(3, "COPY (%s): %p[%u] => %p[%u] (= %p)",
+ 		       act == _SUDO_SSS_FILTER_EXCLUDE ? "not excluded" : "included",
+ 		       in_res->rules, i, out_res->rules, l, in_res->rules + i);
+ 
+@@ -160,7 +155,7 @@ static struct sss_sudo_result *sudo_sss_
+      }
+ 
+      if (l < in_res->num_rules) {
+-	  DPRINTF(3, "reallocating result: %p (count: %u -> %u)", out_res->rules, in_res->num_rules, l);
++	  sudo_debug_printf(3, "reallocating result: %p (count: %u -> %u)", out_res->rules, in_res->num_rules, l);
+ 	  out_res->rules = realloc(out_res->rules, sizeof(struct sss_sudo_rule) * l);
+      }
+ 
+@@ -201,7 +196,7 @@ static int sudo_sss_open(struct sudo_nss
+      handle->pw = sudo_user.pw;
+      nss->handle = handle;
+ 
+-     DPRINTF(3, "handle=%p", handle);
++     sudo_debug_printf(3, "handle=%p", handle);
+ 
+      debug_return_int(0);
+ }
+@@ -234,18 +229,18 @@ static int sudo_sss_setdefs(struct sudo_
+      if (handle == NULL)
+ 	  debug_return_int(-1);
+ 
+-     DPRINTF(1, "Looking for cn=defaults");
++     sudo_debug_printf(1, "Looking for cn=defaults");
+ 
+      if (sss_sudo_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
+ 				     &sss_error, &handle->domainname,
+ 				     &sss_result) != 0)
+      {
+-	  DPRINTF(2, "sss_sudo_send_recv_defaults: != 0, sss_error=%u", sss_error);
++	  sudo_debug_printf(2, "sss_sudo_send_recv_defaults: != 0, sss_error=%u", sss_error);
+ 	  debug_return_int(-1);
+      }
+ 
+      for (i = 0; i < sss_result->num_rules; ++i) {
+-	  DPRINTF(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
++	  sudo_debug_printf(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
+ 	  sss_rule = sss_result->rules + i;
+ 	  sudo_sss_parse_options(sss_rule);
+      }
+@@ -262,7 +257,7 @@ static int sudo_sss_checkpw(struct sudo_
+      if (pw->pw_name != handle->pw->pw_name ||
+ 	 pw->pw_uid  != handle->pw->pw_uid)
+      {
+-	  DPRINTF(1, "Requested name or uid don't match the initial once, reinitializing...");
++	  sudo_debug_printf(1, "Requested name or uid don't match the initial once, reinitializing...");
+ 	  handle->pw = pw;
+ 
+ 	  if (sudo_sss_setdefs(nss) != 0)
+@@ -289,7 +284,7 @@ sudo_sss_check_runas_user(struct sss_sud
+      case 0:
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result. Trying old style (sudoRunAs)");
++	  sudo_debug_printf(2, "No result. Trying old style (sudoRunAs)");
+ 
+ 	  /* try old style */
+ 	  switch (sss_sudo_get_values(sss_rule, "sudoRunAs", &val_array))
+@@ -297,19 +292,19 @@ sudo_sss_check_runas_user(struct sss_sud
+ 	  case 0:
+ 	       break;
+ 	  case ENOENT:
+-	       DPRINTF(2, "No result. Matching against runas_default");
++	       sudo_debug_printf(2, "No result. Matching against runas_default");
+ 	       /*
+ 		* If there are no runas entries, match runas_default against
+ 		* what the user specified on the command line.
+ 		*/
+ 	       return !strcasecmp(runas_pw->pw_name, def_runas_default);
+ 	  default:
+-	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
++	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
+ 	       debug_return_int(UNSPEC);
+ 	  }
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
+ 	  debug_return_int(UNSPEC);
+      }
+ 
+@@ -334,40 +329,40 @@ sudo_sss_check_runas_user(struct sss_sud
+      for (i = 0; val_array[i] != NULL && !ret; ++i) {
+ 	  val = val_array[i];
+ 
+-	  DPRINTF(3, "val[%d]=%s", i, val);
++	  sudo_debug_printf(3, "val[%d]=%s", i, val);
+ 
+ 	  switch (val[0]) {
+ 	  case '+':
+-	       DPRINTF(3, "netgr_");
++	       sudo_debug_printf(3, "netgr_");
+ 	       if (netgr_matches(val, NULL, NULL, runas_pw->pw_name)) {
+-		    DPRINTF(3, "=> match");
++		    sudo_debug_printf(3, "=> match");
+ 		    ret = true;
+ 	       }
+ 	       break;
+ 	  case '%':
+-	       DPRINTF(3, "usergr_");
++	       sudo_debug_printf(3, "usergr_");
+ 	       if (usergr_matches(val, runas_pw->pw_name, runas_pw)) {
+-		    DPRINTF(3, "=> match");
++		    sudo_debug_printf(3, "=> match");
+ 		    ret = true;
+ 	       }
+ 	       break;
+ 	  case 'A':
+ 	       if (strcmp(val, "ALL") == 0) {
+-		    DPRINTF(3, "ALL => match");
++		    sudo_debug_printf(3, "ALL => match");
+ 		    ret = true;
+ 		    break;
+ 	       }
+ 	       /* FALLTHROUGH */
+-	       DPRINTF(3, "FALLTHROUGH");
++	       sudo_debug_printf(3, "FALLTHROUGH");
+ 	  default:
+ 	       if (strcasecmp(val, runas_pw->pw_name) == 0) {
+-		    DPRINTF(3, "%s == %s (pw_name) => match", val, runas_pw->pw_name);
++		    sudo_debug_printf(3, "%s == %s (pw_name) => match", val, runas_pw->pw_name);
+ 		    ret = true;
+ 	       }
+ 	       break;
+ 	  }
+ 
+-	  DPRINTF(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
++	  sudo_debug_printf(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
+      }
+ 
+      sss_sudo_free_values(val_array); /* cleanup */
+@@ -393,22 +388,22 @@ sudo_sss_check_runas_group(struct sss_su
+      case 0:
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  debug_return_int(false);
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
+ 	  debug_return_int(UNSPEC);
+      }
+ 
+      /* walk through values returned, looking for a match */
+      for (i = 0; val_array[i] != NULL; ++i) {
+ 	  val = val_array[i];
+-	  DPRINTF(3, "val[%d]=%s", i, val);
++	  sudo_debug_printf(3, "val[%d]=%s", i, val);
+ 
+ 	  if (strcmp(val, "ALL") == 0 || group_matches(val, runas_gr))
+ 	       ret = true;
+ 
+-	  DPRINTF(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
++	  sudo_debug_printf(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
+      }
+ 
+      sss_sudo_free_values(val_array);
+@@ -450,17 +445,17 @@ static int sudo_sss_check_host(struct ss
+     case 0:
+ 	 break;
+     case ENOENT:
+-	 DPRINTF(2, "No result.");
++	 sudo_debug_printf(2, "No result.");
+ 	 debug_return_int(false);
+     default:
+-	 DPRINTF(2, "sss_sudo_get_values(sudoHost): != 0");
++	 sudo_debug_printf(2, "sss_sudo_get_values(sudoHost): != 0");
+ 	 debug_return_int(ret);
+     }
+ 
+     /* walk through values */
+     for (i = 0; val_array[i] != NULL; ++i) {
+ 	 val = val_array[i];
+-	 DPRINTF(3, "val[%d]=%s", i, val);
++	 sudo_debug_printf(3, "val[%d]=%s", i, val);
+ 
+ 	 /* match any or address or netgroup or hostname */
+ 	 if (!strcmp(val, "ALL") || addr_matches(val) ||
+@@ -468,7 +463,7 @@ static int sudo_sss_check_host(struct ss
+ 	     hostname_matches(user_shost, user_host, val))
+ 	      ret = true;
+ 
+-	 DPRINTF(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
++	 sudo_debug_printf(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
+     }
+ 
+     sss_sudo_free_values(val_array);
+@@ -497,8 +492,8 @@ static struct sss_sudo_result *sudo_sss_
+      if (sudo_sss_checkpw(nss, pw) != 0)
+ 	  debug_return_ptr(NULL);
+ 
+-     DPRINTF(1, "  username=%s", handle->pw->pw_name);
+-     DPRINTF(1, "domainname=%s", handle->domainname);
++     sudo_debug_printf(1, "  username=%s", handle->pw->pw_name);
++     sudo_debug_printf(1, "domainname=%s", handle->domainname);
+ 
+      u_sss_result = f_sss_result = NULL;
+ 
+@@ -510,24 +505,24 @@ static struct sss_sudo_result *sudo_sss_
+ 	  case 0:
+ 	       if (u_sss_result != NULL) {
+ 		    if (state != NULL) {
+-			 DPRINTF(3, "state |= USERMATCH");
++			 sudo_debug_printf(3, "state |= USERMATCH");
+ 			 *state |= _SUDO_SSS_STATE_USERMATCH;
+ 		    }
+-		    DPRINTF(2, "Received %u rule(s)", u_sss_result->num_rules);
++		    sudo_debug_printf(2, "Received %u rule(s)", u_sss_result->num_rules);
+ 	       } else {
+-		    DPRINTF(2, "Internal error: u_sss_result == NULL && sss_error == 0");
++		    sudo_debug_printf(2, "Internal error: u_sss_result == NULL && sss_error == 0");
+ 		    debug_return_ptr(NULL);
+ 	       }
+ 	       break;
+ 	  case ENOENT:
+-	       DPRINTF(2, "No result.");
++	       sudo_debug_printf(2, "No result.");
+ 	  default:
+-	       DPRINTF(2, "sss_error=%u\n", sss_error);
++	       sudo_debug_printf(2, "sss_error=%u\n", sss_error);
+ 	       debug_return_ptr(NULL);
+ 	  }
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
++	  sudo_debug_printf(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
+ 	  debug_return_ptr(NULL);
+      }
+ 
+@@ -537,11 +532,11 @@ static struct sss_sudo_result *sudo_sss_
+      if (f_sss_result != NULL)
+ 	  if (f_sss_result->num_rules > 0)
+ 	       if (state != NULL) {
+-		    DPRINTF(3, "state |= HOSTMATCH");
++		    sudo_debug_printf(3, "state |= HOSTMATCH");
+ 		    *state |= _SUDO_SSS_STATE_HOSTMATCH;
+ 	       }
+ 
+-     DPRINTF(3, "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)",
++     sudo_debug_printf(3, "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)",
+ 	     u_sss_result, u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
+ 
+      sss_sudo_free_result(u_sss_result);
+@@ -568,17 +563,17 @@ sudo_sss_check_bool(struct sss_sudo_rule
+      case 0:
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  debug_return_int(ret);
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values: != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values: != 0");
+ 	  debug_return_int(ret);
+      }
+ 
+      /* walk through options */
+      for (i = 0; val_array[i] != NULL; ++i) {
+ 	  var = val_array[i];
+-	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", var);
++	  sudo_debug_printf(2, "sssd/ldap sudoOption: '%s'", var);
+ 
+ 	  if ((ch = *var) == '!')
+ 	       var++;
+@@ -611,24 +606,24 @@ sudo_sss_check_command(struct sss_sudo_r
+      case 0:
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  debug_return_int(ret);
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values: != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values: != 0");
+ 	  debug_return_int(ret);
+      }
+ 
+      for (i = 0; val_array[i] != NULL && ret != false; ++i) {
+ 	  val = val_array[i];
+ 
+-	  DPRINTF(3, "val[%d]=%s", i, val);
++	  sudo_debug_printf(3, "val[%d]=%s", i, val);
+ 
+ 	  /* Match against ALL ? */
+ 	  if (!strcmp(val, "ALL")) {
+ 	       ret = true;
+ 	       if (setenv_implied != NULL)
+ 		    *setenv_implied = true;
+-	       DPRINTF(2, "sssd/ldap sudoCommand '%s' ... MATCH!", val);
++	       sudo_debug_printf(2, "sssd/ldap sudoCommand '%s' ... MATCH!", val);
+ 	       continue;
+ 	  }
+ 
+@@ -655,7 +650,7 @@ sudo_sss_check_command(struct sss_sudo_r
+ 	       ret = foundbang ? false : true;
+ 	  }
+ 
+-	  DPRINTF(2, "sssd/ldap sudoCommand '%s' ... %s", val, ret == true ? "MATCH!" : "not");
++	  sudo_debug_printf(2, "sssd/ldap sudoCommand '%s' ... %s", val, ret == true ? "MATCH!" : "not");
+ 	  efree(allowed_cmnd);	/* cleanup */
+      }
+ 
+@@ -680,16 +675,16 @@ sudo_sss_parse_options(struct sss_sudo_r
+      case 0:
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  debug_return;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
+ 	  debug_return;
+      }
+ 
+      /* walk through options */
+      for (i = 0; val_array[i] != NULL; i++) {
+-	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", val_array[i]);
++	  sudo_debug_printf(2, "sssd/ldap sudoOption: '%s'", val_array[i]);
+ 	  v = estrdup(val_array[i]);
+ 
+ 	  /* check for equals sign past first char */
+@@ -741,7 +736,7 @@ static int sudo_sss_lookup(struct sudo_n
+ 	enum def_tuple pwcheck =
+ 	    (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
+ 
+-	DPRINTF(2, "perform search for pwflag %d", pwflag);
++	sudo_debug_printf(2, "perform search for pwflag %d", pwflag);
+ 	if (sss_result != NULL) {
+ 	     for (i = 0; i < sss_result->num_rules; i++) {
+ 		  rule = sss_result->rules + i;
+@@ -782,7 +777,7 @@ static int sudo_sss_lookup(struct sudo_n
+ 	goto done;
+     }
+ 
+-    DPRINTF(1, "searching SSSD/LDAP for sudoers entries");
++    sudo_debug_printf(1, "searching SSSD/LDAP for sudoers entries");
+ 
+     setenv_implied = false;
+     if (sss_result != NULL) {
+@@ -793,9 +788,9 @@ static int sudo_sss_lookup(struct sudo_n
+ 	      rc = sudo_sss_check_command(rule, &setenv_implied);
+ 	      if (rc != UNSPEC) {
+ 		   /* We have a match. */
+-		   DPRINTF(1, "Command %sallowed", rc == true ? "" : "NOT ");
++		   sudo_debug_printf(1, "Command %sallowed", rc == true ? "" : "NOT ");
+ 		   if (rc == true) {
+-			DPRINTF(3, "SSSD rule: %p", rule);
++			sudo_debug_printf(3, "SSSD rule: %p", rule);
+ 			/* Apply entry-specific options. */
+ 			if (setenv_implied)
+ 			     def_setenv = true;
+@@ -818,7 +813,7 @@ static int sudo_sss_lookup(struct sudo_n
+ 	 }
+     }
+ done:
+-    DPRINTF(1, "Done with LDAP searches");
++    sudo_debug_printf(1, "Done with LDAP searches");
+ 
+     if (!ISSET(ret, VALIDATE_OK)) {
+ 	/* No matching entries. */
+@@ -831,7 +826,7 @@ done:
+     if (state & _SUDO_SSS_STATE_HOSTMATCH)
+ 	 CLR(ret, FLAG_NO_HOST);
+ 
+-    DPRINTF(3, "sudo_sss_lookup(%d)=0x%02x", pwflag, ret);
++    sudo_debug_printf(3, "sudo_sss_lookup(%d)=0x%02x", pwflag, ret);
+ 
+     debug_return_int(ret);
+ }
+@@ -854,7 +849,7 @@ static int sudo_sss_display_cmnd(struct 
+       * The sudo_sss_result_get() function returns all nodes that match
+       * the user and the host.
+       */
+-     DPRINTF(1, "sssd/ldap search for command list");
++     sudo_debug_printf(1, "sssd/ldap search for command list");
+      sss_result = sudo_sss_result_get(nss, pw, NULL);
+ 
+      if (sss_result == NULL)
+@@ -902,7 +897,7 @@ static int sudo_sss_display_defaults(str
+ 				     &sss_error, &handle->domainname,
+ 				     &sss_result) != 0)
+      {
+-	  DPRINTF(2, "sss_sudo_send_recv_defaults: !=0, sss_error=%u", sss_error);
++	  sudo_debug_printf(2, "sss_sudo_send_recv_defaults: !=0, sss_error=%u", sss_error);
+ 	  goto done;
+      }
+ 
+@@ -916,10 +911,10 @@ static int sudo_sss_display_defaults(str
+ 	  case 0:
+ 	       break;
+ 	  case ENOENT:
+-	       DPRINTF(2, "No result.");
++	       sudo_debug_printf(2, "No result.");
+ 	       continue;
+ 	  default:
+-	       DPRINTF(2, "sss_sudo_get_values: != 0");
++	       sudo_debug_printf(2, "sss_sudo_get_values: != 0");
+ 	       continue;
+ 	  }
+ 
+@@ -976,16 +971,16 @@ static int sudo_sss_display_entry_long(s
+ 	       sss_sudo_free_values(val_array);
+ 	       break;
+ 	  case ENOENT:
+-	       DPRINTF(2, "No result.");
++	       sudo_debug_printf(2, "No result.");
+ 	       lbuf_append(lbuf, "%s", def_runas_default);
+ 	       break;
+ 	  default:
+-	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
++	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
+ 	       debug_return_int(count);
+ 	  }
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
+ 	  debug_return_int(count);
+      }
+      lbuf_append(lbuf, "\n");
+@@ -1001,10 +996,10 @@ static int sudo_sss_display_entry_long(s
+ 	  lbuf_append(lbuf, "\n");
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+@@ -1019,10 +1014,10 @@ static int sudo_sss_display_entry_long(s
+ 	  lbuf_append(lbuf, "\n");
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+@@ -1037,10 +1032,10 @@ static int sudo_sss_display_entry_long(s
+ 	  sss_sudo_free_values(val_array);
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+@@ -1064,7 +1059,7 @@ static int sudo_sss_display_entry_short(
+ 	  sss_sudo_free_values(val_array);
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result. Trying old style (sudoRunAs).");
++	  sudo_debug_printf(2, "No result. Trying old style (sudoRunAs).");
+ 	  /* try old style */
+ 	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
+ 	  {
+@@ -1074,16 +1069,16 @@ static int sudo_sss_display_entry_short(
+ 	       sss_sudo_free_values(val_array);
+ 	       break;
+ 	  case ENOENT:
+-	       DPRINTF(2, "No result.");
++	       sudo_debug_printf(2, "No result.");
+ 	       lbuf_append(lbuf, "%s", def_runas_default);
+ 	       break;
+ 	  default:
+-	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
++	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
+ 	       debug_return_int(count);
+ 	  }
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+@@ -1097,10 +1092,10 @@ static int sudo_sss_display_entry_short(
+ 	  sss_sudo_free_values(val_array);
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+@@ -1128,10 +1123,10 @@ static int sudo_sss_display_entry_short(
+ 	  sss_sudo_free_values(val_array);
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
+ 	  debug_return_int(count);
+      }
+ 
+@@ -1145,10 +1140,10 @@ static int sudo_sss_display_entry_short(
+ 	  sss_sudo_free_values(val_array);
+ 	  break;
+      case ENOENT:
+-	  DPRINTF(2, "No result.");
++	  sudo_debug_printf(2, "No result.");
+ 	  break;
+      default:
+-	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
++	  sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
+ 	  debug_return_int(count);
+      }
+      lbuf_append(lbuf, "\n");
+@@ -1171,7 +1166,7 @@ static int sudo_sss_display_privs(struct
+      if (sudo_sss_checkpw(nss, pw) != 0)
+ 	  debug_return_int(-1);
+ 
+-     DPRINTF(2, "sssd/ldap search for command list");
++     sudo_debug_printf(2, "sssd/ldap search for command list");
+ 
+      sss_result = sudo_sss_result_get(nss, pw, NULL);
+ 
diff --git a/sudo.spec b/sudo.spec
index 8132bf4..3e5df6b 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.5
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -20,7 +20,6 @@ BuildRequires: audit-libs-devel libcap-devel
 BuildRequires: libselinux-devel
 BuildRequires: sendmail
 BuildRequires: gettext
-BuildRequires: libsss_sudo-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
@@ -32,6 +31,17 @@ Patch3: sudo-1.7.4p3-m4path.patch
 Patch4: sudo-1.8.5-pipelist.patch
 # SSSD support
 Patch5: sudo-1.8.5-sssd-support.patch
+# Add SSSD debug subsystem
+Patch6: sudo-1.8.5-add-sssd-debug-subsystem.patch
+# Use sudo_debug_printf instead of DPRINTF in sssd.c
+Patch7: sudo-1.8.5-sssd-use-sudo_debug_printf.patch
+# Handle sss_ret correctly in sssd.c to avoid segfault
+# when user is not found in sssd
+Patch8: sudo-1.8.5-sssd-handle-sss_ret-correctly.patch
+# dlopen libsss_sudo
+Patch9: sudo-1.8.5-sssd-dlopen-lib.patch
+# remove source when nss->open() fails
+Patch10: sudo-1.8.5-remove-source-when-open-failed.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -61,7 +71,11 @@ plugins that use %{name}.
 %patch3 -p1 -b .m4path
 %patch4 -p1 -b .pipelist
 %patch5 -p1 -b .sssd-support
-
+%patch6 -p1
+%patch7 -p1
+%patch8 -p1
+%patch9 -p1
+%patch10 -p1
 
 %build
 autoreconf -fv --install
@@ -90,8 +104,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --with-ldap \
 	--with-selinux \
 	--with-passprompt="[sudo] password for %p: " \
-	--with-linux-audit
-#	--with-sssd
+	--with-linux-audit \
+	--with-sssd
 #	--without-kerb5 \
 #	--without-kerb4
 make
@@ -171,6 +185,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Thu Jul 26 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-4
+- added patches that fix & improve SSSD support (thanks to pbrezina@redhat.com)
+- re-enabled SSSD support
+- removed libsss_sudo dependency
+
 * Tue Jul 24 2012 Bill Nottingham <notting@redhat.com> - 1.8.5-3
 - flip sudoers2ldif executable bit after make install, not in setup
 

From 41b07d49de3a09549d90fd1d87dc45d9bcf27d1b Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 6 Sep 2012 14:41:27 +0200
Subject: [PATCH 072/199] Update to 1.8.6

 - dropped SSSD patches as they are now part of the upstream source code
 - use the upstream version of -pipelist patch
---
 .gitignore                                    |    1 +
 sources                                       |    2 +-
 sudo-1.8.5-add-sssd-debug-subsystem.patch     |  290 ----
 sudo-1.8.5-pipelist.patch                     |   29 -
 ...1.8.5-remove-source-when-open-failed.patch |   33 -
 sudo-1.8.5-sssd-dlopen-lib.patch              |  905 -----------
 ...-1.8.5-sssd-handle-sss_ret-correctly.patch |   43 -
 sudo-1.8.5-sssd-support.patch                 | 1327 -----------------
 sudo-1.8.5-sssd-use-sudo_debug_printf.patch   |  600 --------
 sudo-1.8.6-pipelist.patch                     |   31 +
 sudo.spec                                     |   35 +-
 11 files changed, 41 insertions(+), 3255 deletions(-)
 delete mode 100644 sudo-1.8.5-add-sssd-debug-subsystem.patch
 delete mode 100644 sudo-1.8.5-pipelist.patch
 delete mode 100644 sudo-1.8.5-remove-source-when-open-failed.patch
 delete mode 100644 sudo-1.8.5-sssd-dlopen-lib.patch
 delete mode 100644 sudo-1.8.5-sssd-handle-sss_ret-correctly.patch
 delete mode 100644 sudo-1.8.5-sssd-support.patch
 delete mode 100644 sudo-1.8.5-sssd-use-sudo_debug_printf.patch
 create mode 100644 sudo-1.8.6-pipelist.patch

diff --git a/.gitignore b/.gitignore
index e51036a..fd1f95d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.1p2.tar.gz
 /sudo-1.8.3p1.tar.gz
 /sudo-1.8.5.tar.gz
+/sudo-1.8.6.tar.gz
diff --git a/sources b/sources
index 667632d..0f34a68 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-8d5a664bba74b19ca0b40db1d90f2cee  sudo-1.8.5.tar.gz
+3d400e84c3a1e2164171db8d54b11aab  sudo-1.8.6.tar.gz
 56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers
diff --git a/sudo-1.8.5-add-sssd-debug-subsystem.patch b/sudo-1.8.5-add-sssd-debug-subsystem.patch
deleted file mode 100644
index 2af83c3..0000000
--- a/sudo-1.8.5-add-sssd-debug-subsystem.patch
+++ /dev/null
@@ -1,290 +0,0 @@
-diff -rup original/common/sudo_debug.c new/common/sudo_debug.c
---- original/common/sudo_debug.c	2012-05-15 18:22:01.000000000 +0200
-+++ new/common/sudo_debug.c	2012-07-17 10:24:05.389397245 +0200
-@@ -101,6 +101,7 @@ const char *const sudo_debug_subsystems[
-     "perms",
-     "plugin",
-     "hooks",
-+    "sssd",
-     NULL
- };
- 
-diff -rup original/include/sudo_debug.h new/include/sudo_debug.h
---- original/include/sudo_debug.h	2012-05-15 18:22:02.000000000 +0200
-+++ new/include/sudo_debug.h	2012-07-17 10:49:43.470809390 +0200
-@@ -71,6 +71,7 @@
- #define SUDO_DEBUG_PERMS	(23<<6)	/* uid/gid swapping functions */
- #define SUDO_DEBUG_PLUGIN	(24<<6)	/* main plugin functions */
- #define SUDO_DEBUG_HOOKS	(25<<6)	/* hook functions */
-+#define SUDO_DEBUG_SSSD		(26<<6) /* sudoers SSSD */
- #define SUDO_DEBUG_ALL		0xfff0	/* all subsystems */
- 
- /* Flag to include string version of errno in debug info. */
-diff -rup original/plugins/sudoers/sssd.c new/plugins/sudoers/sssd.c
---- original/plugins/sudoers/sssd.c	2012-07-17 10:13:42.366133003 +0200
-+++ new/plugins/sudoers/sssd.c	2012-07-17 10:24:05.383397175 +0200
-@@ -86,7 +86,7 @@ static struct sss_sudo_result *sudo_sss_
- static void sudo_sss_attrcpy(struct sss_sudo_attr *dst, const struct sss_sudo_attr *src)
- {
-      int i;
--     debug_decl(sudo_sss_attrcpy, SUDO_DEBUG_LDAP)
-+     debug_decl(sudo_sss_attrcpy, SUDO_DEBUG_SSSD)
- 
-      DPRINTF(3, "dst=%p, src=%p", dst, src);
-      DPRINTF(2, "emalloc: cnt=%d", src->num_values);
-@@ -104,8 +104,8 @@ static void sudo_sss_attrcpy(struct sss_
- static void sudo_sss_rulecpy(struct sss_sudo_rule *dst, const struct sss_sudo_rule *src)
- {
-      int i;
--     debug_decl(sudo_sss_rulecpy, SUDO_DEBUG_LDAP)
--     
-+     debug_decl(sudo_sss_rulecpy, SUDO_DEBUG_SSSD)
-+
-      DPRINTF(3, "dst=%p, src=%p", dst, src);
-      DPRINTF(2, "emalloc: cnt=%d", src->num_attrs);
- 
-@@ -130,7 +130,7 @@ static struct sss_sudo_result *sudo_sss_
- {
-      struct sss_sudo_result *out_res;
-      int i, l, r;
--     debug_decl(sudo_sss_filter_result, SUDO_DEBUG_LDAP)
-+     debug_decl(sudo_sss_filter_result, SUDO_DEBUG_SSSD)
- 
-      DPRINTF(3, "in_res=%p, count=%u, act=%s",
- 	     in_res, in_res->num_rules, act == _SUDO_SSS_FILTER_EXCLUDE ? "EXCLUDE" : "INCLUDE");
-@@ -193,7 +193,7 @@ struct sudo_nss sudo_nss_sss = {
- static int sudo_sss_open(struct sudo_nss *nss)
- {
-      struct sudo_sss_handle *handle;
--     debug_decl(sudo_sss_open, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_open, SUDO_DEBUG_SSSD);
- 
-      /* Create a handle container. */
-      handle = emalloc(sizeof(struct sudo_sss_handle));
-@@ -209,7 +209,7 @@ static int sudo_sss_open(struct sudo_nss
- // ok
- static int sudo_sss_close(struct sudo_nss *nss)
- {
--     debug_decl(sudo_sss_close, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD);
-      efree(nss->handle);
-      debug_return_int(0);
- }
-@@ -217,7 +217,7 @@ static int sudo_sss_close(struct sudo_ns
- // ok
- static int sudo_sss_parse(struct sudo_nss *nss)
- {
--     debug_decl(sudo_sss_parse, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_parse, SUDO_DEBUG_SSSD);
-      debug_return_int(0);
- }
- 
-@@ -229,7 +229,7 @@ static int sudo_sss_setdefs(struct sudo_
-      struct sss_sudo_rule   *sss_rule;
-      uint32_t sss_error;
-      int i;
--     debug_decl(sudo_sss_setdefs, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_setdefs, SUDO_DEBUG_SSSD);
- 
-      if (handle == NULL)
- 	  debug_return_int(-1);
-@@ -257,7 +257,7 @@ static int sudo_sss_setdefs(struct sudo_
- static int sudo_sss_checkpw(struct sudo_nss *nss, struct passwd *pw)
- {
-      struct sudo_sss_handle *handle = nss->handle;
--     debug_decl(sudo_sss_checkpw, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_checkpw, SUDO_DEBUG_SSSD);
- 
-      if (pw->pw_name != handle->pw->pw_name ||
- 	 pw->pw_uid  != handle->pw->pw_uid)
-@@ -278,13 +278,13 @@ sudo_sss_check_runas_user(struct sss_sud
-      char **val_array = NULL;
-      char *val;
-      int ret = false, i;
--     debug_decl(sudo_sss_check_runas_user, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_check_runas_user, SUDO_DEBUG_SSSD);
- 
-      if (!runas_pw)
- 	  debug_return_int(UNSPEC);
- 
-      /* get the runas user from the entry */
--     switch (sss_sudo_get_values(sss_rule, "sudoRunAsUser", &val_array)) 
-+     switch (sss_sudo_get_values(sss_rule, "sudoRunAsUser", &val_array))
-      {
-      case 0:
- 	  break;
-@@ -315,18 +315,18 @@ sudo_sss_check_runas_user(struct sss_sud
- 
-      /*
-       * BUG:
--      * 
-+      *
-       * if runas is not specified on the command line, the only information
-       * as to which user to run as is in the runas_default option.  We should
-       * check to see if we have the local option present.  Unfortunately we
-       * don't parse these options until after this routine says yes or no.
-       * The query has already returned, so we could peek at the attribute
-       * values here though.
--      * 
-+      *
-       * For now just require users to always use -u option unless its set
-       * in the global defaults. This behaviour is no different than the global
-       * /etc/sudoers.
--      * 
-+      *
-       * Sigh - maybe add this feature later
-       */
- 
-@@ -381,7 +381,7 @@ sudo_sss_check_runas_group(struct sss_su
-      char **val_array = NULL;
-      char *val;
-      int ret = false, i;
--     debug_decl(sudo_sss_check_runas_group, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_check_runas_group, SUDO_DEBUG_SSSD);
- 
-      /* runas_gr is only set if the user specified the -g flag */
-      if (!runas_gr)
-@@ -424,7 +424,7 @@ static int
- sudo_sss_check_runas(struct sss_sudo_rule *rule)
- {
-     int ret;
--    debug_decl(sudo_sss_check_runas, SUDO_DEBUG_LDAP);
-+    debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD);
- 
-     if (rule == NULL)
- 	 debug_return_int(false);
-@@ -439,7 +439,7 @@ static int sudo_sss_check_host(struct ss
- {
-     char **val_array, *val;
-     int ret = false, i;
--    debug_decl(sudo_sss_check_host, SUDO_DEBUG_LDAP);
-+    debug_decl(sudo_sss_check_host, SUDO_DEBUG_SSSD);
- 
-     if (rule == NULL)
- 	 debug_return_int(ret);
-@@ -479,7 +479,7 @@ static int sudo_sss_check_host(struct ss
- static int sudo_sss_result_filterp(struct sss_sudo_rule *rule, void *unused)
- {
-      (void)unused;
--     debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD);
- 
-      if (sudo_sss_check_host(rule))
- 	  debug_return_int(1);
-@@ -492,7 +492,7 @@ static struct sss_sudo_result *sudo_sss_
-      struct sudo_sss_handle *handle = nss->handle;
-      struct sss_sudo_result *u_sss_result, *f_sss_result;
-      uint32_t sss_error = 0, ret;
--     debug_decl(sudo_sss_result_get, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_result_get, SUDO_DEBUG_SSSD);
- 
-      if (sudo_sss_checkpw(nss, pw) != 0)
- 	  debug_return_ptr(NULL);
-@@ -558,7 +558,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
- {
-      char ch, *var, **val_array = NULL;
-      int i, ret = UNSPEC;
--     debug_decl(sudo_sss_check_bool, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_check_bool, SUDO_DEBUG_SSSD);
- 
-      if (rule == NULL)
- 	  debug_return_int(ret);
-@@ -601,7 +601,7 @@ sudo_sss_check_command(struct sss_sudo_r
-      char **val_array = NULL, *val;
-      char *allowed_cmnd, *allowed_args;
-      int i, foundbang, ret = UNSPEC;
--     debug_decl(sudo_sss_check_command, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_check_command, SUDO_DEBUG_SSSD);
- 
-      if (rule == NULL)
- 	  debug_return_int(ret);
-@@ -670,7 +670,7 @@ sudo_sss_parse_options(struct sss_sudo_r
-      int i;
-      char op, *v, *val;
-      char **val_array = NULL;
--     debug_decl(sudo_sss_parse_options, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_parse_options, SUDO_DEBUG_SSSD);
- 
-      if (rule == NULL)
- 	  debug_return;
-@@ -726,7 +726,7 @@ static int sudo_sss_lookup(struct sudo_n
-     struct sss_sudo_result *sss_result = NULL;
-     struct sss_sudo_rule   *rule;
-     uint32_t i, state = 0;
--    debug_decl(sudo_sss_lookup, SUDO_DEBUG_LDAP);
-+    debug_decl(sudo_sss_lookup, SUDO_DEBUG_SSSD);
- 
-     /* Fetch list of sudoRole entries that match user and host. */
-     sss_result = sudo_sss_result_get(nss, sudo_user.pw, &state);
-@@ -738,7 +738,7 @@ static int sudo_sss_lookup(struct sudo_n
-     if (pwflag) {
- 	int doauth = UNSPEC;
- 	int matched = UNSPEC;
--	enum def_tuple pwcheck = 
-+	enum def_tuple pwcheck =
- 	    (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
- 
- 	DPRINTF(2, "perform search for pwflag %d", pwflag);
-@@ -842,7 +842,7 @@ static int sudo_sss_display_cmnd(struct 
-      struct sss_sudo_result *sss_result = NULL;
-      struct sss_sudo_rule *rule;
-      int i, found = false;
--     debug_decl(sudo_sss_display_cmnd, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_display_cmnd, SUDO_DEBUG_SSSD);
- 
-      if (handle == NULL)
- 	  goto done;
-@@ -893,7 +893,7 @@ static int sudo_sss_display_defaults(str
-      char *prefix, *val, **val_array = NULL;
-      int count = 0, i, j;
- 
--     debug_decl(sudo_sss_display_defaults, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_display_defaults, SUDO_DEBUG_SSSD);
- 
-      if (handle == NULL)
- 	  goto done;
-@@ -934,7 +934,7 @@ static int sudo_sss_display_defaults(str
- 	       prefix = ", ";
- 	       count++;
- 	  }
--	  
-+
- 	  sss_sudo_free_values(val_array);
- 	  val_array = NULL;
-      }
-@@ -948,7 +948,7 @@ done:
- static int sudo_sss_display_bound_defaults(struct sudo_nss *nss,
- 					    struct passwd *pw, struct lbuf *lbuf)
- {
--     debug_decl(sudo_sss_display_bound_defaults, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_display_bound_defaults, SUDO_DEBUG_SSSD);
-      debug_return_int(0);
- }
- 
-@@ -956,7 +956,7 @@ static int sudo_sss_display_entry_long(s
- {
-      char **val_array = NULL;
-      int count = 0, i;
--     debug_decl(sudo_sss_display_entry_long, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_display_entry_long, SUDO_DEBUG_SSSD);
- 
-      /* get the RunAsUser Values from the entry */
-      lbuf_append(lbuf, "    RunAsUsers: ");
-@@ -1051,7 +1051,7 @@ static int sudo_sss_display_entry_short(
- {
-      char **val_array = NULL;
-      int count = 0, i;
--     debug_decl(sudo_sss_display_entry_short, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_display_entry_short, SUDO_DEBUG_SSSD);
- 
-      lbuf_append(lbuf, "    (");
- 
-@@ -1164,7 +1164,7 @@ static int sudo_sss_display_privs(struct
-      struct sss_sudo_result *sss_result = NULL;
-      struct sss_sudo_rule *rule;
-      unsigned int i, count = 0;
--     debug_decl(sudo_sss_display_privs, SUDO_DEBUG_LDAP);
-+     debug_decl(sudo_sss_display_privs, SUDO_DEBUG_SSSD);
- 
-      if (handle == NULL)
- 	  debug_return_int(-1);
diff --git a/sudo-1.8.5-pipelist.patch b/sudo-1.8.5-pipelist.patch
deleted file mode 100644
index ba587fa..0000000
--- a/sudo-1.8.5-pipelist.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff -up sudo-1.8.5rc5/common/ttysize.c.pipelist sudo-1.8.5rc5/common/ttysize.c
---- sudo-1.8.5rc5/common/ttysize.c.pipelist	2012-04-06 21:43:19.000000000 +0200
-+++ sudo-1.8.5rc5/common/ttysize.c	2012-05-16 13:03:17.184034854 +0200
-@@ -20,6 +20,7 @@
- 
- #include <sys/types.h>
- #include <sys/ioctl.h>
-+#include <sys/stat.h>
- #include <stdio.h>
- #ifdef STDC_HEADERS
- # include <stdlib.h>
-@@ -71,8 +72,17 @@ get_ttysize_ioctl(int *rowp, int *colp)
- void
- get_ttysize(int *rowp, int *colp)
- {
-+    struct stat st;
-     debug_decl(fork_cmnd, SUDO_DEBUG_EXEC)
- 
-+    if (fstat(STDOUT_FILENO, &st) == 0) {
-+	 if (S_ISFIFO(st.st_mode)) {
-+	   *rowp = 0;
-+	   *colp = 0;
-+	   return;
-+	 }
-+    }
-+
-     if (get_ttysize_ioctl(rowp, colp) == -1) {
- 	char *p;
- 
diff --git a/sudo-1.8.5-remove-source-when-open-failed.patch b/sudo-1.8.5-remove-source-when-open-failed.patch
deleted file mode 100644
index 0267f39..0000000
--- a/sudo-1.8.5-remove-source-when-open-failed.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-diff -rup original/plugins/sudoers/sudoers.c new/plugins/sudoers/sudoers.c
---- original/plugins/sudoers/sudoers.c	2012-07-19 12:13:31.292479203 +0200
-+++ new/plugins/sudoers/sudoers.c	2012-07-19 12:14:02.898844521 +0200
-@@ -145,6 +145,7 @@ sudoers_policy_open(unsigned int version
-     volatile int sources = 0;
-     sigaction_t sa;
-     struct sudo_nss *nss;
-+    struct sudo_nss *nss_next;
-     debug_decl(sudoers_policy_open, SUDO_DEBUG_PLUGIN)
- 
-     sudo_version = version;
-@@ -201,12 +202,15 @@ sudoers_policy_open(unsigned int version
-     set_perms(PERM_ROOT);
- 
-     /* Open and parse sudoers, set global defaults */
--    tq_foreach_fwd(snl, nss) {
--	if (nss->open(nss) == 0 && nss->parse(nss) == 0) {
--	    sources++;
--	    if (nss->setdefs(nss) != 0)
--		log_error(NO_STDERR, _("problem with defaults entries"));
--	}
-+    for (nss = snl->first; nss != NULL; nss = nss_next) {
-+        nss_next = nss->next;
-+        if (nss->open(nss) == 0 && nss->parse(nss) == 0) {
-+            sources++;
-+            if (nss->setdefs(nss) != 0)
-+                log_error(NO_STDERR, _("problem with defaults entries"));
-+        } else {
-+            tq_remove(snl, nss);
-+        }
-     }
-     if (sources == 0) {
- 	warningx(_("no valid sudoers sources found, quitting"));
diff --git a/sudo-1.8.5-sssd-dlopen-lib.patch b/sudo-1.8.5-sssd-dlopen-lib.patch
deleted file mode 100644
index e9b1914..0000000
--- a/sudo-1.8.5-sssd-dlopen-lib.patch
+++ /dev/null
@@ -1,905 +0,0 @@
-diff -rup original/configure.in new/configure.in
---- original/configure.in	2012-07-19 12:13:15.872301022 +0200
-+++ new/configure.in	2012-07-23 11:31:42.821466529 +0200
-@@ -101,6 +101,7 @@ AC_SUBST([root_sudo])
- AC_SUBST([path_info])
- AC_SUBST([ldap_conf])
- AC_SUBST([ldap_secret])
-+AC_SUBST([sssd_lib])
- AC_SUBST([nsswitch_conf])
- AC_SUBST([netsvc_conf])
- AC_SUBST([secure_path])
-@@ -290,8 +291,6 @@ dnl
- AC_ARG_WITH(sssd, [AS_HELP_STRING([--with-sssd], [enable SSSD support])],
- [case $with_sssd in
-     yes)
--		SUDO_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
--		SUDOERS_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
- 		SUDOERS_OBJS="${SUDOERS_OBJS} sssd.lo"
- 		AC_DEFINE(HAVE_SSSD)
- 		;;
-@@ -300,6 +299,11 @@ AC_ARG_WITH(sssd, [AS_HELP_STRING([--wit
- 		;;
- esac])
- 
-+AC_ARG_WITH(sssd-lib, [AS_HELP_STRING([--with-sssd-lib], [path to the SSSD library])])
-+sssd_lib="\"LIBDIR\""
-+test -n "$with_sssd_lib" && sssd_lib="$with_sssd_lib"
-+SUDO_DEFINE_UNQUOTED(_PATH_SSSD_LIB, "$sssd_lib", [Path to the SSSD library])
-+
- AC_ARG_WITH(incpath, [AS_HELP_STRING([--with-incpath], [additional places to look for include files])],
- [case $with_incpath in
-     yes)	AC_MSG_ERROR(["must give --with-incpath an argument."])
-diff -rup original/pathnames.h.in new/pathnames.h.in
---- original/pathnames.h.in	2012-07-19 12:13:15.779299949 +0200
-+++ new/pathnames.h.in	2012-07-19 15:58:49.454653685 +0200
-@@ -157,6 +157,10 @@
- #undef	_PATH_LDAP_SECRET
- #endif /* _PATH_LDAP_SECRET */
- 
-+#ifndef _PATH_SSSD_LIB
-+#undef  _PATH_SSSD_LIB
-+#endif /* _PATH_SSSD_LIB */
-+
- #ifndef _PATH_NSSWITCH_CONF
- #undef	_PATH_NSSWITCH_CONF
- #endif /* _PATH_NSSWITCH_CONF */
-diff -rup original/plugins/sudoers/Makefile.in new/plugins/sudoers/Makefile.in
---- original/plugins/sudoers/Makefile.in	2012-07-19 12:13:15.756299680 +0200
-+++ new/plugins/sudoers/Makefile.in	2012-07-23 11:31:56.084610531 +0200
-@@ -32,6 +32,7 @@ top_srcdir = @top_srcdir@
- incdir = $(top_srcdir)/include
- docdir = @docdir@
- timedir = @timedir@
-+libdir = @libdir@
- 
- # Compiler & tools to use
- CC = @CC@
-@@ -51,7 +52,7 @@ SUDOERS_LIBS = @SUDOERS_LIBS@ @AFS_LIBS@
- REPLAY_LIBS = @REPLAY_LIBS@ @ZLIB@
- 
- # C preprocessor flags
--CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(devdir) -I$(srcdir) -I$(top_srcdir) @CPPFLAGS@
-+CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(devdir) -I$(srcdir) -I$(top_srcdir) -DLIBDIR=\"$(libdir)\" @CPPFLAGS@
- 
- # Usually -O and/or -g
- CFLAGS = @CFLAGS@
-diff -rup original/plugins/sudoers/sssd.c new/plugins/sudoers/sssd.c
---- original/plugins/sudoers/sssd.c	2012-07-19 12:13:15.667298652 +0200
-+++ new/plugins/sudoers/sssd.c	2012-07-23 11:32:04.260699269 +0200
-@@ -44,23 +44,70 @@
- #if TIME_WITH_SYS_TIME
- # include <time.h>
- #endif
-+#ifdef HAVE_DLOPEN
-+# include <dlfcn.h>
-+#else
-+# include "compat/dlfcn.h"
-+#endif
- #include <ctype.h>
- #include <pwd.h>
- #include <grp.h>
- 
--#include <sss_sudo.h>
- #include <errno.h>
-+#include <stdint.h>
- 
- #include "sudoers.h"
- #include "parse.h"
- #include "lbuf.h"
- #include "sudo_debug.h"
- 
-+/* SSSD <--> SUDO interface - do not change */
-+struct sss_sudo_attr {
-+    char *name;
-+    char **values;
-+    unsigned int num_values;
-+};
-+
-+struct sss_sudo_rule {
-+    unsigned int num_attrs;
-+    struct sss_sudo_attr *attrs;
-+};
-+
-+struct sss_sudo_result {
-+    unsigned int num_rules;
-+    struct sss_sudo_rule *rules;
-+};
-+
-+typedef int  (*sss_sudo_send_recv_t)(uid_t, const char*, const char*,
-+                                     uint32_t*, struct sss_sudo_result**);
-+
-+typedef int  (*sss_sudo_send_recv_defaults_t)(uid_t, const char*, uint32_t*,
-+                                              char**, struct sss_sudo_result**);
-+
-+typedef void (*sss_sudo_free_result_t)(struct sss_sudo_result*);
-+
-+typedef int  (*sss_sudo_get_values_t)(struct sss_sudo_rule*, const char*,
-+                                      char***);
-+
-+typedef void (*sss_sudo_free_values_t)(char**);
-+
- /* sudo_nss implementation */
-+
-+struct sudo_sss_handle {
-+     char *domainname;
-+     struct passwd *pw;
-+     void *ssslib;
-+     sss_sudo_send_recv_t fn_send_recv;
-+     sss_sudo_send_recv_defaults_t fn_send_recv_defaults;
-+     sss_sudo_free_result_t fn_free_result;
-+     sss_sudo_get_values_t fn_get_values;
-+     sss_sudo_free_values_t fn_free_values;
-+};
-+
- static int sudo_sss_open(struct sudo_nss *nss);
- static int sudo_sss_close(struct sudo_nss *nss);
- static int sudo_sss_parse(struct sudo_nss *nss);
--static void sudo_sss_parse_options(struct sss_sudo_rule *rule);
-+static void sudo_sss_parse_options(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule);
- static int sudo_sss_setdefs(struct sudo_nss *nss);
- static int sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag);
- static int sudo_sss_display_cmnd(struct sudo_nss *nss, struct passwd *pw);
-@@ -121,7 +168,7 @@ static void sudo_sss_rulecpy(struct sss_
- #define _SUDO_SSS_STATE_HOSTMATCH 0x01
- #define _SUDO_SSS_STATE_USERMATCH 0x02
- 
--static struct sss_sudo_result *sudo_sss_filter_result(struct sss_sudo_result *in_res, int (*filterp)(struct sss_sudo_rule *, void *), int act, void *filterp_arg)
-+static struct sss_sudo_result *sudo_sss_filter_result(struct sudo_sss_handle *handle, struct sss_sudo_result *in_res, int (*filterp)(struct sudo_sss_handle *, struct sss_sudo_rule *, void *), int act, void *filterp_arg)
- {
-      struct sss_sudo_result *out_res;
-      int i, l, r;
-@@ -140,7 +187,7 @@ static struct sss_sudo_result *sudo_sss_
-      out_res->num_rules = 0;
- 
-      for (i = l = 0; i < in_res->num_rules; ++i) {
--	  r = filterp(in_res->rules + i, filterp_arg);
-+	  r = filterp(handle, in_res->rules + i, filterp_arg);
- 
- 	  if (( r && act == _SUDO_SSS_FILTER_INCLUDE) ||
- 	      (!r && act == _SUDO_SSS_FILTER_EXCLUDE))
-@@ -164,11 +211,6 @@ static struct sss_sudo_result *sudo_sss_
-      debug_return_ptr(out_res);
- }
- 
--struct sudo_sss_handle {
--     char *domainname;
--     struct passwd *pw;
--};
--
- struct sudo_nss sudo_nss_sss = {
-     &sudo_nss_sss,
-     NULL,
-@@ -188,10 +230,50 @@ struct sudo_nss sudo_nss_sss = {
- static int sudo_sss_open(struct sudo_nss *nss)
- {
-      struct sudo_sss_handle *handle;
-+     static const char path[] = _PATH_SSSD_LIB"/libsss_sudo.so";
-      debug_decl(sudo_sss_open, SUDO_DEBUG_SSSD);
- 
-      /* Create a handle container. */
-      handle = emalloc(sizeof(struct sudo_sss_handle));
-+
-+     /* Load symbols */
-+     handle->ssslib = dlopen(path, RTLD_LAZY);
-+     if (handle->ssslib == NULL) {
-+         warningx(_("Unable to dlopen %s: %s"), path, dlerror());
-+         warningx(_("Unable to initialize SSS source. Is SSSD installed on your machine?"));
-+         debug_return_int(EFAULT);
-+     }
-+
-+     handle->fn_send_recv = dlsym(handle->ssslib, "sss_sudo_send_recv");
-+     if (handle->fn_send_recv == NULL) {
-+         warningx(_("unable to find symbol \"sss_sudo_send_recv\" in %s"), path);
-+         debug_return_int(EFAULT);
-+     }
-+
-+     handle->fn_send_recv_defaults = dlsym(handle->ssslib, "sss_sudo_send_recv_defaults");
-+     if (handle->fn_send_recv_defaults == NULL) {
-+         warningx(_("unable to find symbol \"sss_sudo_send_recv_defaults\" in %s"), path);
-+         debug_return_int(EFAULT);
-+     }
-+
-+     handle->fn_free_result = dlsym(handle->ssslib, "sss_sudo_free_result");
-+     if (handle->fn_free_result == NULL) {
-+         warningx(_("unable to find symbol \"sss_sudo_free_result\" in %s"), path);
-+         debug_return_int(EFAULT);
-+     }
-+
-+     handle->fn_get_values = dlsym(handle->ssslib, "sss_sudo_get_values");
-+     if (handle->fn_get_values == NULL) {
-+         warningx(_("unable to find symbol \"sss_sudo_get_values\" in %s"), path);
-+         debug_return_int(EFAULT);
-+     }
-+
-+     handle->fn_free_values = dlsym(handle->ssslib, "sss_sudo_free_values");
-+     if (handle->fn_free_values == NULL) {
-+         warningx(_("unable to find symbol \"sss_sudo_free_values\" in %s"), path);
-+         debug_return_int(EFAULT);
-+     }
-+
-      handle->domainname = NULL;
-      handle->pw = sudo_user.pw;
-      nss->handle = handle;
-@@ -204,7 +286,14 @@ static int sudo_sss_open(struct sudo_nss
- // ok
- static int sudo_sss_close(struct sudo_nss *nss)
- {
-+     struct sudo_sss_handle *handle;
-      debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD);
-+
-+     if (nss && nss->handle) {
-+         handle = nss->handle;
-+         dlclose(handle->ssslib);
-+     }
-+
-      efree(nss->handle);
-      debug_return_int(0);
- }
-@@ -231,11 +320,11 @@ static int sudo_sss_setdefs(struct sudo_
- 
-      sudo_debug_printf(1, "Looking for cn=defaults");
- 
--     if (sss_sudo_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
-+     if (handle->fn_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
- 				     &sss_error, &handle->domainname,
- 				     &sss_result) != 0)
-      {
--	  sudo_debug_printf(2, "sss_sudo_send_recv_defaults: != 0, sss_error=%u", sss_error);
-+	  sudo_debug_printf(2, "handle->fn_send_recv_defaults: != 0, sss_error=%u", sss_error);
- 	  debug_return_int(-1);
-      }
- 
-@@ -250,10 +339,10 @@ static int sudo_sss_setdefs(struct sudo_
-      for (i = 0; i < sss_result->num_rules; ++i) {
- 	  sudo_debug_printf(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
- 	  sss_rule = sss_result->rules + i;
--	  sudo_sss_parse_options(sss_rule);
-+	  sudo_sss_parse_options(handle, sss_rule);
-      }
- 
--     sss_sudo_free_result(sss_result);
-+     handle->fn_free_result(sss_result);
-      debug_return_int(0);
- }
- 
-@@ -276,7 +365,7 @@ static int sudo_sss_checkpw(struct sudo_
- }
- 
- static int
--sudo_sss_check_runas_user(struct sss_sudo_rule *sss_rule)
-+sudo_sss_check_runas_user(struct sudo_sss_handle *handle, struct sss_sudo_rule *sss_rule)
- {
-      char **val_array = NULL;
-      char *val;
-@@ -287,7 +376,7 @@ sudo_sss_check_runas_user(struct sss_sud
- 	  debug_return_int(UNSPEC);
- 
-      /* get the runas user from the entry */
--     switch (sss_sudo_get_values(sss_rule, "sudoRunAsUser", &val_array))
-+     switch (handle->fn_get_values(sss_rule, "sudoRunAsUser", &val_array))
-      {
-      case 0:
- 	  break;
-@@ -295,7 +384,7 @@ sudo_sss_check_runas_user(struct sss_sud
- 	  sudo_debug_printf(2, "No result. Trying old style (sudoRunAs)");
- 
- 	  /* try old style */
--	  switch (sss_sudo_get_values(sss_rule, "sudoRunAs", &val_array))
-+	  switch (handle->fn_get_values(sss_rule, "sudoRunAs", &val_array))
- 	  {
- 	  case 0:
- 	       break;
-@@ -307,12 +396,12 @@ sudo_sss_check_runas_user(struct sss_sud
- 		*/
- 	       return !strcasecmp(runas_pw->pw_name, def_runas_default);
- 	  default:
--	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       sudo_debug_printf(2, "handle->fn_get_values(sudoRunAs): != 0");
- 	       debug_return_int(UNSPEC);
- 	  }
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsUser): != 0");
- 	  debug_return_int(UNSPEC);
-      }
- 
-@@ -373,13 +462,13 @@ sudo_sss_check_runas_user(struct sss_sud
- 	  sudo_debug_printf(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
-      }
- 
--     sss_sudo_free_values(val_array); /* cleanup */
-+     handle->fn_free_values(val_array); /* cleanup */
- 
-      debug_return_int(ret);
- }
- 
- static int
--sudo_sss_check_runas_group(struct sss_sudo_rule *rule)
-+sudo_sss_check_runas_group(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
- {
-      char **val_array = NULL;
-      char *val;
-@@ -391,7 +480,7 @@ sudo_sss_check_runas_group(struct sss_su
- 	  debug_return_int(UNSPEC);
- 
-      /* get the values from the entry */
--     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoRunAsGroup", &val_array))
-      {
-      case 0:
- 	  break;
-@@ -399,7 +488,7 @@ sudo_sss_check_runas_group(struct sss_su
- 	  sudo_debug_printf(2, "No result.");
- 	  debug_return_int(false);
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsGroup): != 0");
- 	  debug_return_int(UNSPEC);
-      }
- 
-@@ -414,7 +503,7 @@ sudo_sss_check_runas_group(struct sss_su
- 	  sudo_debug_printf(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
-      }
- 
--     sss_sudo_free_values(val_array);
-+     handle->fn_free_values(val_array);
- 
-      debug_return_int(ret);
- }
-@@ -424,7 +513,7 @@ sudo_sss_check_runas_group(struct sss_su
-  * else false.  RunAs info is optional.
-  */
- static int
--sudo_sss_check_runas(struct sss_sudo_rule *rule)
-+sudo_sss_check_runas(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
- {
-     int ret;
-     debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD);
-@@ -432,13 +521,13 @@ sudo_sss_check_runas(struct sss_sudo_rul
-     if (rule == NULL)
- 	 debug_return_int(false);
- 
--    ret = sudo_sss_check_runas_user(rule) != false &&
--	 sudo_sss_check_runas_group(rule) != false;
-+    ret = sudo_sss_check_runas_user(handle, rule) != false &&
-+	 sudo_sss_check_runas_group(handle, rule) != false;
- 
-     debug_return_int(ret);
- }
- 
--static int sudo_sss_check_host(struct sss_sudo_rule *rule)
-+static int sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
- {
-     char **val_array, *val;
-     int ret = false, i;
-@@ -448,7 +537,7 @@ static int sudo_sss_check_host(struct ss
- 	 debug_return_int(ret);
- 
-     /* get the values from the rule */
--    switch (sss_sudo_get_values(rule, "sudoHost", &val_array))
-+    switch (handle->fn_get_values(rule, "sudoHost", &val_array))
-     {
-     case 0:
- 	 break;
-@@ -456,7 +545,7 @@ static int sudo_sss_check_host(struct ss
- 	 sudo_debug_printf(2, "No result.");
- 	 debug_return_int(false);
-     default:
--	 sudo_debug_printf(2, "sss_sudo_get_values(sudoHost): != 0");
-+	 sudo_debug_printf(2, "handle->fn_get_values(sudoHost): != 0");
- 	 debug_return_int(ret);
-     }
- 
-@@ -474,17 +563,17 @@ static int sudo_sss_check_host(struct ss
- 	 sudo_debug_printf(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
-     }
- 
--    sss_sudo_free_values(val_array);
-+    handle->fn_free_values(val_array);
- 
-     debug_return_int(ret);
- }
- 
--static int sudo_sss_result_filterp(struct sss_sudo_rule *rule, void *unused)
-+static int sudo_sss_result_filterp(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, void *unused)
- {
-      (void)unused;
-      debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD);
- 
--     if (sudo_sss_check_host(rule))
-+     if (sudo_sss_check_host(handle, rule))
- 	  debug_return_int(1);
-      else
- 	  debug_return_int(0);
-@@ -505,7 +594,7 @@ static struct sss_sudo_result *sudo_sss_
- 
-      u_sss_result = f_sss_result = NULL;
- 
--     switch (ret = sss_sudo_send_recv(handle->pw->pw_uid, handle->pw->pw_name,
-+     switch (ret = handle->fn_send_recv(handle->pw->pw_uid, handle->pw->pw_name,
- 				      handle->domainname, &sss_error, &u_sss_result))
-      {
-      case 0:
-@@ -530,11 +619,11 @@ static struct sss_sudo_result *sudo_sss_
- 	  }
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
-+	  sudo_debug_printf(2, "handle->fn_send_recv: != 0: ret=%d", ret);
- 	  debug_return_ptr(NULL);
-      }
- 
--     f_sss_result = sudo_sss_filter_result(u_sss_result, sudo_sss_result_filterp,
-+     f_sss_result = sudo_sss_filter_result(handle, u_sss_result, sudo_sss_result_filterp,
- 					   _SUDO_SSS_FILTER_INCLUDE, NULL);
- 
-      if (f_sss_result != NULL)
-@@ -547,7 +636,7 @@ static struct sss_sudo_result *sudo_sss_
-      sudo_debug_printf(3, "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)",
- 	     u_sss_result, u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
- 
--     sss_sudo_free_result(u_sss_result);
-+     handle->fn_free_result(u_sss_result);
- 
-      debug_return_ptr(f_sss_result);
- }
-@@ -557,7 +646,7 @@ static struct sss_sudo_result *sudo_sss_
-  * Returns true if found and allowed, false if negated, else UNSPEC.
-  */
- static int
--sudo_sss_check_bool(struct sss_sudo_rule *rule, char *option)
-+sudo_sss_check_bool(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, char *option)
- {
-      char ch, *var, **val_array = NULL;
-      int i, ret = UNSPEC;
-@@ -566,7 +655,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
-      if (rule == NULL)
- 	  debug_return_int(ret);
- 
--     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoOption", &val_array))
-      {
-      case 0:
- 	  break;
-@@ -574,7 +663,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
- 	  sudo_debug_printf(2, "No result.");
- 	  debug_return_int(ret);
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values: != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values: != 0");
- 	  debug_return_int(ret);
-      }
- 
-@@ -589,7 +678,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
- 	       ret = (ch != '!');
-      }
- 
--     sss_sudo_free_values(val_array);
-+     handle->fn_free_values(val_array);
- 
-      debug_return_int(ret);
- }
-@@ -599,7 +688,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
-  * false if disallowed and UNSPEC if not matched.
-  */
- static int
--sudo_sss_check_command(struct sss_sudo_rule *rule, int *setenv_implied)
-+sudo_sss_check_command(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, int *setenv_implied)
- {
-      char **val_array = NULL, *val;
-      char *allowed_cmnd, *allowed_args;
-@@ -609,7 +698,7 @@ sudo_sss_check_command(struct sss_sudo_r
-      if (rule == NULL)
- 	  debug_return_int(ret);
- 
--     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoCommand", &val_array))
-      {
-      case 0:
- 	  break;
-@@ -617,7 +706,7 @@ sudo_sss_check_command(struct sss_sudo_r
- 	  sudo_debug_printf(2, "No result.");
- 	  debug_return_int(ret);
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values: != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values: != 0");
- 	  debug_return_int(ret);
-      }
- 
-@@ -662,13 +751,13 @@ sudo_sss_check_command(struct sss_sudo_r
- 	  efree(allowed_cmnd);	/* cleanup */
-      }
- 
--     sss_sudo_free_values(val_array); /* more cleanup */
-+     handle->fn_free_values(val_array); /* more cleanup */
- 
-      debug_return_int(ret);
- }
- 
- static void
--sudo_sss_parse_options(struct sss_sudo_rule *rule)
-+sudo_sss_parse_options(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
- {
-      int i;
-      char op, *v, *val;
-@@ -678,7 +767,7 @@ sudo_sss_parse_options(struct sss_sudo_r
-      if (rule == NULL)
- 	  debug_return;
- 
--     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoOption", &val_array))
-      {
-      case 0:
- 	  break;
-@@ -686,7 +775,7 @@ sudo_sss_parse_options(struct sss_sudo_r
- 	  sudo_debug_printf(2, "No result.");
- 	  debug_return;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoOption): != 0");
- 	  debug_return;
-      }
- 
-@@ -718,7 +807,7 @@ sudo_sss_parse_options(struct sss_sudo_r
- 	  efree(v);
-      }
- 
--     sss_sudo_free_values(val_array);
-+     handle->fn_free_values(val_array);
-      debug_return;
- }
- 
-@@ -726,6 +815,7 @@ static int sudo_sss_lookup(struct sudo_n
- {
-     int rc, setenv_implied;
- 
-+    struct sudo_sss_handle *handle = nss->handle;
-     struct sss_sudo_result *sss_result = NULL;
-     struct sss_sudo_rule   *rule;
-     uint32_t i, state = 0;
-@@ -750,12 +840,12 @@ static int sudo_sss_lookup(struct sudo_n
- 		  rule = sss_result->rules + i;
- 		  if ((pwcheck == any && doauth != false) ||
- 		      (pwcheck == all && doauth == false)) {
--		       doauth = sudo_sss_check_bool(rule, "authenticate");
-+		       doauth = sudo_sss_check_bool(handle, rule, "authenticate");
- 		  }
- 		  /* Only check the command when listing another user. */
- 		  if (user_uid == 0 || list_pw == NULL ||
- 		      user_uid == list_pw->pw_uid ||
--		      sudo_sss_check_command(rule, NULL)) {
-+		      sudo_sss_check_command(handle, rule, NULL)) {
- 		       matched = true;
- 		       break;
- 		  }
-@@ -791,9 +881,9 @@ static int sudo_sss_lookup(struct sudo_n
-     if (sss_result != NULL) {
- 	 for (i = 0; i < sss_result->num_rules; i++) {
- 	      rule = sss_result->rules + i;
--	      if (!sudo_sss_check_runas(rule))
-+	      if (!sudo_sss_check_runas(handle, rule))
- 		   continue;
--	      rc = sudo_sss_check_command(rule, &setenv_implied);
-+	      rc = sudo_sss_check_command(handle, rule, &setenv_implied);
- 	      if (rc != UNSPEC) {
- 		   /* We have a match. */
- 		   sudo_debug_printf(1, "Command %sallowed", rc == true ? "" : "NOT ");
-@@ -802,7 +892,7 @@ static int sudo_sss_lookup(struct sudo_n
- 			/* Apply entry-specific options. */
- 			if (setenv_implied)
- 			     def_setenv = true;
--			sudo_sss_parse_options(rule);
-+			sudo_sss_parse_options(handle, rule);
- #ifdef HAVE_SELINUX
- 			/* Set role and type if not specified on command line. */
- 			if (user_role == NULL)
-@@ -865,8 +955,8 @@ static int sudo_sss_display_cmnd(struct 
- 
-      for (i = 0; i < sss_result->num_rules; i++) {
- 	  rule = sss_result->rules + i;
--	  if (sudo_sss_check_command(rule, NULL) &&
--	      sudo_sss_check_runas(rule)) {
-+	  if (sudo_sss_check_command(handle, rule, NULL) &&
-+	      sudo_sss_check_runas(handle, rule)) {
- 	       found = true;
- 	       goto done;
- 	  }
-@@ -878,7 +968,7 @@ done:
- 		 user_args ? " " : "", user_args ? user_args : "");
- 
-      if (sss_result != NULL)
--	  sss_sudo_free_result(sss_result);
-+	  handle->fn_free_result(sss_result);
- 
-      debug_return_int(!found);
- }
-@@ -901,11 +991,11 @@ static int sudo_sss_display_defaults(str
-      if (handle == NULL)
- 	  goto done;
- 
--     if (sss_sudo_send_recv_defaults(pw->pw_uid, pw->pw_name,
-+     if (handle->fn_send_recv_defaults(pw->pw_uid, pw->pw_name,
- 				     &sss_error, &handle->domainname,
- 				     &sss_result) != 0)
-      {
--	  sudo_debug_printf(2, "sss_sudo_send_recv_defaults: !=0, sss_error=%u", sss_error);
-+	  sudo_debug_printf(2, "handle->fn_send_recv_defaults: !=0, sss_error=%u", sss_error);
- 	  goto done;
-      }
- 
-@@ -922,7 +1012,7 @@ static int sudo_sss_display_defaults(str
-      for (i = 0; i < sss_result->num_rules; ++i) {
- 	  rule = sss_result->rules + i;
- 
--	  switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+	  switch (handle->fn_get_values(rule, "sudoOption", &val_array))
- 	  {
- 	  case 0:
- 	       break;
-@@ -930,7 +1020,7 @@ static int sudo_sss_display_defaults(str
- 	       sudo_debug_printf(2, "No result.");
- 	       continue;
- 	  default:
--	       sudo_debug_printf(2, "sss_sudo_get_values: != 0");
-+	       sudo_debug_printf(2, "handle->fn_get_values: != 0");
- 	       continue;
- 	  }
- 
-@@ -946,11 +1036,11 @@ static int sudo_sss_display_defaults(str
- 	       count++;
- 	  }
- 
--	  sss_sudo_free_values(val_array);
-+	  handle->fn_free_values(val_array);
- 	  val_array = NULL;
-      }
- 
--     sss_sudo_free_result(sss_result);
-+     handle->fn_free_result(sss_result);
- done:
-      debug_return_int(count);
- }
-@@ -963,7 +1053,7 @@ static int sudo_sss_display_bound_defaul
-      debug_return_int(0);
- }
- 
--static int sudo_sss_display_entry_long(struct sss_sudo_rule *rule, struct lbuf *lbuf)
-+static int sudo_sss_display_entry_long(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, struct lbuf *lbuf)
- {
-      char **val_array = NULL;
-      int count = 0, i;
-@@ -971,94 +1061,94 @@ static int sudo_sss_display_entry_long(s
- 
-      /* get the RunAsUser Values from the entry */
-      lbuf_append(lbuf, "    RunAsUsers: ");
--     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoRunAsUser", &val_array))
-      {
-      case 0:
- 	  for (i = 0; val_array[i] != NULL; ++i)
- 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
--	  sss_sudo_free_values(val_array);
-+	  handle->fn_free_values(val_array);
- 	  break;
-      case ENOENT:
--	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
-+	  switch (handle->fn_get_values(rule, "sudoRunAs", &val_array))
- 	  {
- 	  case 0:
- 	       for (i = 0; val_array[i] != NULL; ++i)
- 		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
--	       sss_sudo_free_values(val_array);
-+	       handle->fn_free_values(val_array);
- 	       break;
- 	  case ENOENT:
- 	       sudo_debug_printf(2, "No result.");
- 	       lbuf_append(lbuf, "%s", def_runas_default);
- 	       break;
- 	  default:
--	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       sudo_debug_printf(2, "handle->fn_get_values(sudoRunAs): != 0");
- 	       debug_return_int(count);
- 	  }
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsUser): != 0");
- 	  debug_return_int(count);
-      }
-      lbuf_append(lbuf, "\n");
- 
-      /* get the RunAsGroup Values from the entry */
--     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoRunAsGroup", &val_array))
-      {
-      case 0:
- 	  lbuf_append(lbuf, "    RunAsGroups: ");
- 	  for (i = 0; val_array[i] != NULL; ++i)
- 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
--	  sss_sudo_free_values(val_array);
-+	  handle->fn_free_values(val_array);
- 	  lbuf_append(lbuf, "\n");
- 	  break;
-      case ENOENT:
- 	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsGroup): != 0");
- 	  debug_return_int(count);
-      }
- 
-      /* get the Option Values from the entry */
--     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoOption", &val_array))
-      {
-      case 0:
- 	  lbuf_append(lbuf, "    Options: ");
- 	  for (i = 0; val_array[i] != NULL; ++i)
- 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
--	  sss_sudo_free_values(val_array);
-+	  handle->fn_free_values(val_array);
- 	  lbuf_append(lbuf, "\n");
- 	  break;
-      case ENOENT:
- 	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoOption): != 0");
- 	  debug_return_int(count);
-      }
- 
-      /* Get the command values from the entry. */
--     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
-+     switch (handle->fn_get_values(rule, "sudoCommand", &val_array)) {
-      case 0:
- 	  lbuf_append(lbuf, _("    Commands:\n"));
- 	  for (i = 0; val_array[i] != NULL; ++i) {
- 	       lbuf_append(lbuf, "\t%s\n", val_array[i]);
- 	       count++;
- 	  }
--	  sss_sudo_free_values(val_array);
-+	  handle->fn_free_values(val_array);
- 	  break;
-      case ENOENT:
- 	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoCommand): != 0");
- 	  debug_return_int(count);
-      }
- 
-      debug_return_int(count);
- }
- 
--static int sudo_sss_display_entry_short(struct sss_sudo_rule *rule, struct lbuf *lbuf)
-+static int sudo_sss_display_entry_short(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, struct lbuf *lbuf)
- {
-      char **val_array = NULL;
-      int count = 0, i;
-@@ -1067,58 +1157,58 @@ static int sudo_sss_display_entry_short(
-      lbuf_append(lbuf, "    (");
- 
-      /* get the RunAsUser Values from the entry */
--     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoRunAsUser", &val_array))
-      {
-      case 0:
- 	  for (i = 0; val_array[i] != NULL; ++i)
- 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
--	  sss_sudo_free_values(val_array);
-+	  handle->fn_free_values(val_array);
- 	  break;
-      case ENOENT:
- 	  sudo_debug_printf(2, "No result. Trying old style (sudoRunAs).");
- 	  /* try old style */
--	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
-+	  switch (handle->fn_get_values(rule, "sudoRunAs", &val_array))
- 	  {
- 	  case 0:
- 	       for (i = 0; val_array[i] != NULL; ++i)
- 		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
--	       sss_sudo_free_values(val_array);
-+	       handle->fn_free_values(val_array);
- 	       break;
- 	  case ENOENT:
- 	       sudo_debug_printf(2, "No result.");
- 	       lbuf_append(lbuf, "%s", def_runas_default);
- 	       break;
- 	  default:
--	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       sudo_debug_printf(2, "handle->fn_get_values(sudoRunAs): != 0");
- 	       debug_return_int(count);
- 	  }
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsUser): != 0");
- 	  debug_return_int(count);
-      }
- 
-      /* get the RunAsGroup Values from the entry */
--     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoRunAsGroup", &val_array))
-      {
-      case 0:
- 	  lbuf_append(lbuf, " : ");
- 	  for (i = 0; val_array[i] != NULL; ++i)
- 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
--	  sss_sudo_free_values(val_array);
-+	  handle->fn_free_values(val_array);
- 	  break;
-      case ENOENT:
- 	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsGroup): != 0");
- 	  debug_return_int(count);
-      }
- 
-      lbuf_append(lbuf, ") ");
- 
-      /* get the Option Values from the entry */
--     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+     switch (handle->fn_get_values(rule, "sudoOption", &val_array))
-      {
-      case 0:
- 	  for (i = 0; val_array[i] != NULL; ++i) {
-@@ -1136,30 +1226,30 @@ static int sudo_sss_display_entry_short(
- 				"NOSETENV: " : "SETENV: ");
- 	  }
- 
--	  sss_sudo_free_values(val_array);
-+	  handle->fn_free_values(val_array);
- 	  break;
-      case ENOENT:
- 	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoOption): != 0");
- 	  debug_return_int(count);
-      }
- 
-      /* get the Command Values from the entry */
--     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
-+     switch (handle->fn_get_values(rule, "sudoCommand", &val_array)) {
-      case 0:
- 	  for (i = 0; val_array[i] != NULL; ++i) {
- 	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
- 	       count++;
- 	  }
--	  sss_sudo_free_values(val_array);
-+	  handle->fn_free_values(val_array);
- 	  break;
-      case ENOENT:
- 	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
-+	  sudo_debug_printf(2, "handle->fn_get_values(sudoCommand): != 0");
- 	  debug_return_int(count);
-      }
-      lbuf_append(lbuf, "\n");
-@@ -1193,13 +1283,13 @@ static int sudo_sss_display_privs(struct
-      for (i = 0; i < sss_result->num_rules; ++i) {
- 	  rule = sss_result->rules + i;
- 	  if (long_list)
--	       count += sudo_sss_display_entry_long(rule, lbuf);
-+	       count += sudo_sss_display_entry_long(handle, rule, lbuf);
- 	  else
--	       count += sudo_sss_display_entry_short(rule, lbuf);
-+	       count += sudo_sss_display_entry_short(handle, rule, lbuf);
-      }
- 
-      if (sss_result != NULL)
--	  sss_sudo_free_result(sss_result);
-+	  handle->fn_free_result(sss_result);
- 
-      debug_return_int(count);
- }
diff --git a/sudo-1.8.5-sssd-handle-sss_ret-correctly.patch b/sudo-1.8.5-sssd-handle-sss_ret-correctly.patch
deleted file mode 100644
index b03592a..0000000
--- a/sudo-1.8.5-sssd-handle-sss_ret-correctly.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-diff -rup original/plugins/sudoers/sssd.c new/plugins/sudoers/sssd.c
---- original/plugins/sudoers/sssd.c	2012-07-18 13:17:53.026208728 +0200
-+++ new/plugins/sudoers/sssd.c	2012-07-18 13:35:59.780623153 +0200
-@@ -239,6 +239,14 @@ static int sudo_sss_setdefs(struct sudo_
- 	  debug_return_int(-1);
-      }
- 
-+     if (sss_error == ENOENT) {
-+         sudo_debug_printf(2, "The user was not found in SSSD.");
-+         debug_return_int(-1);
-+     } else if(sss_error != 0) {
-+         sudo_debug_printf(2, "sss_error=%u\n", sss_error);
-+         debug_return_int(-1);
-+     }
-+
-      for (i = 0; i < sss_result->num_rules; ++i) {
- 	  sudo_debug_printf(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
- 	  sss_rule = sss_result->rules + i;
-@@ -515,7 +523,7 @@ static struct sss_sudo_result *sudo_sss_
- 	       }
- 	       break;
- 	  case ENOENT:
--	       sudo_debug_printf(2, "No result.");
-+	       sudo_debug_printf(2, "The user was not found in SSSD.");
- 	  default:
- 	       sudo_debug_printf(2, "sss_error=%u\n", sss_error);
- 	       debug_return_ptr(NULL);
-@@ -901,6 +909,14 @@ static int sudo_sss_display_defaults(str
- 	  goto done;
-      }
- 
-+     if (sss_error == ENOENT) {
-+         sudo_debug_printf(2, "The user was not found in SSSD.");
-+         goto done;
-+     } else if(sss_error != 0) {
-+         sudo_debug_printf(2, "sss_error=%u\n", sss_error);
-+         goto done;
-+     }
-+
-      handle->pw = pw;
- 
-      for (i = 0; i < sss_result->num_rules; ++i) {
-
diff --git a/sudo-1.8.5-sssd-support.patch b/sudo-1.8.5-sssd-support.patch
deleted file mode 100644
index 78602af..0000000
--- a/sudo-1.8.5-sssd-support.patch
+++ /dev/null
@@ -1,1327 +0,0 @@
-diff -up sudo-1.8.5/configure.in.sssd-support sudo-1.8.5/configure.in
---- sudo-1.8.5/configure.in.sssd-support	2012-05-17 10:30:40.796975447 +0200
-+++ sudo-1.8.5/configure.in	2012-05-17 10:30:40.813975145 +0200
-@@ -284,6 +284,22 @@ AC_ARG_WITH(linux-audit, [AS_HELP_STRING
- 		;;
- esac])
- 
-+dnl
-+dnl Handle SSSD support.
-+dnl
-+AC_ARG_WITH(sssd, [AS_HELP_STRING([--with-sssd], [enable SSSD support])],
-+[case $with_sssd in
-+    yes)
-+		SUDO_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
-+		SUDOERS_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
-+		SUDOERS_OBJS="${SUDOERS_OBJS} sssd.lo"
-+		AC_DEFINE(HAVE_SSSD)
-+		;;
-+    no)		;;
-+    *)		AC_MSG_ERROR(["--with-sssd does not take an argument."])
-+		;;
-+esac])
-+
- AC_ARG_WITH(incpath, [AS_HELP_STRING([--with-incpath], [additional places to look for include files])],
- [case $with_incpath in
-     yes)	AC_MSG_ERROR(["must give --with-incpath an argument."])
-@@ -3331,6 +3347,7 @@ AH_TEMPLATE(HAVE_LBER_H, [Define to 1 if
- AH_TEMPLATE(HAVE_LDAP, [Define to 1 if you use LDAP for sudoers.])
- AH_TEMPLATE(HAVE_LIBINTL_H, [Define to 1 if you have the <libintl.h> header file.])
- AH_TEMPLATE(HAVE_LINUX_AUDIT, [Define to 1 to enable Linux audit support.])
-+AH_TEMPLATE(HAVE_SSSD, [Define to 1 to enable SSSD support.])
- AH_TEMPLATE(HAVE_OPIE, [Define to 1 if you use NRL OPIE.])
- AH_TEMPLATE(HAVE_PAM, [Define to 1 if you use PAM authentication.])
- AH_TEMPLATE(HAVE_PAM_LOGIN, [Define to 1 if you use a specific PAM session for sudo -i.])
-diff -up sudo-1.8.5/plugins/sudoers/Makefile.in.sssd-support sudo-1.8.5/plugins/sudoers/Makefile.in
---- sudo-1.8.5/plugins/sudoers/Makefile.in.sssd-support	2012-05-15 18:22:02.000000000 +0200
-+++ sudo-1.8.5/plugins/sudoers/Makefile.in	2012-05-17 10:30:40.815975110 +0200
-@@ -574,6 +574,10 @@ linux_audit.lo: $(srcdir)/linux_audit.c
-                 $(incdir)/gettext.h $(incdir)/sudo_debug.h \
-                 $(srcdir)/linux_audit.h
- 	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(srcdir)/linux_audit.c
-+sssd.lo: $(srcdir)/sssd.c $(top_builddir)/config.h \
-+         $(incdir)/missing.h $(incdir)/error.h $(incdir)/alloc.h \
-+         $(incdir)/gettext.h
-+	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(srcdir)/sssd.c
- logging.lo: $(srcdir)/logging.c $(top_builddir)/config.h $(srcdir)/sudoers.h \
-             $(top_srcdir)/compat/stdbool.h $(top_builddir)/pathnames.h \
-             $(incdir)/missing.h $(incdir)/error.h $(incdir)/alloc.h \
-diff -up sudo-1.8.5/plugins/sudoers/sssd.c.sssd-support sudo-1.8.5/plugins/sudoers/sssd.c
---- sudo-1.8.5/plugins/sudoers/sssd.c.sssd-support	2012-05-17 10:30:40.817975074 +0200
-+++ sudo-1.8.5/plugins/sudoers/sssd.c	2012-05-17 10:58:10.775036464 +0200
-@@ -0,0 +1,1194 @@
-+/*
-+ * Copyright (c) 2003-2011 Todd C. Miller <Todd.Miller@courtesan.com>
-+ * Copyright (c) 2011 Daniel Kopecek <dkopecek@redhat.com>
-+ *
-+ * This code is derived from software contributed by Aaron Spangler.
-+ *
-+ * Permission to use, copy, modify, and distribute this software for any
-+ * purpose with or without fee is hereby granted, provided that the above
-+ * copyright notice and this permission notice appear in all copies.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+ */
-+
-+#include <config.h>
-+
-+#include <sys/types.h>
-+#include <sys/time.h>
-+#include <sys/param.h>
-+#include <sys/stat.h>
-+#include <stdio.h>
-+#ifdef STDC_HEADERS
-+# include <stdlib.h>
-+# include <stddef.h>
-+#else
-+# ifdef HAVE_STDLIB_H
-+#  include <stdlib.h>
-+# endif
-+#endif /* STDC_HEADERS */
-+#ifdef HAVE_STRING_H
-+# include <string.h>
-+#endif /* HAVE_STRING_H */
-+#ifdef HAVE_STRINGS_H
-+# include <strings.h>
-+#endif /* HAVE_STRINGS_H */
-+#ifdef HAVE_UNISTD_H
-+# include <unistd.h>
-+#endif /* HAVE_UNISTD_H */
-+#if TIME_WITH_SYS_TIME
-+# include <time.h>
-+#endif
-+#include <ctype.h>
-+#include <pwd.h>
-+#include <grp.h>
-+
-+#include <sss_sudo.h>
-+#include <errno.h>
-+
-+#include "sudoers.h"
-+#include "parse.h"
-+#include "lbuf.h"
-+#include "sudo_debug.h"
-+
-+extern int debug_level;
-+#define __sssd_debug debug_level
-+
-+#define	DPRINTF(level, fmt, ...) if (__sssd_debug >= (level)) warningx("%s:%d: "fmt, __PRETTY_FUNCTION__, __LINE__, ##__VA_ARGS__)
-+
-+/* sudo_nss implementation */
-+static int sudo_sss_open(struct sudo_nss *nss);
-+static int sudo_sss_close(struct sudo_nss *nss);
-+static int sudo_sss_parse(struct sudo_nss *nss);
-+static void sudo_sss_parse_options(struct sss_sudo_rule *rule);
-+static int sudo_sss_setdefs(struct sudo_nss *nss);
-+static int sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag);
-+static int sudo_sss_display_cmnd(struct sudo_nss *nss, struct passwd *pw);
-+static int sudo_sss_display_defaults(struct sudo_nss *nss, struct passwd *pw,
-+				      struct lbuf *lbuf);
-+
-+static int sudo_sss_display_bound_defaults(struct sudo_nss *nss,
-+					    struct passwd *pw, struct lbuf *lbuf);
-+
-+static int sudo_sss_display_privs(struct sudo_nss *nss, struct passwd *pw,
-+				   struct lbuf *lbuf);
-+
-+
-+static struct sss_sudo_result *sudo_sss_result_get(struct sudo_nss *nss,
-+					       struct passwd *pw,
-+					       uint32_t *state);
-+
-+static void sudo_sss_attrcpy(struct sss_sudo_attr *dst, const struct sss_sudo_attr *src)
-+{
-+     int i;
-+     debug_decl(sudo_sss_attrcpy, SUDO_DEBUG_LDAP)
-+
-+     DPRINTF(3, "dst=%p, src=%p", dst, src);
-+     DPRINTF(2, "emalloc: cnt=%d", src->num_values);
-+
-+     dst->name = strdup(src->name);
-+     dst->num_values = src->num_values;
-+     dst->values = emalloc(sizeof(char *) * dst->num_values);
-+
-+     for (i = 0; i < dst->num_values; ++i)
-+	  dst->values[i] = strdup(src->values[i]);
-+
-+     debug_return;
-+}
-+
-+static void sudo_sss_rulecpy(struct sss_sudo_rule *dst, const struct sss_sudo_rule *src)
-+{
-+     int i;
-+     debug_decl(sudo_sss_rulecpy, SUDO_DEBUG_LDAP)
-+     
-+     DPRINTF(3, "dst=%p, src=%p", dst, src);
-+     DPRINTF(2, "emalloc: cnt=%d", src->num_attrs);
-+
-+     dst->num_attrs = src->num_attrs;
-+     dst->attrs = emalloc(sizeof(struct sss_sudo_attr) * dst->num_attrs);
-+
-+     for (i = 0; i < dst->num_attrs; ++i) {
-+	  sudo_sss_attrcpy(dst->attrs + i,
-+			    src->attrs + i);
-+     }
-+
-+     debug_return;
-+}
-+
-+#define _SUDO_SSS_FILTER_INCLUDE 0
-+#define _SUDO_SSS_FILTER_EXCLUDE 1
-+
-+#define _SUDO_SSS_STATE_HOSTMATCH 0x01
-+#define _SUDO_SSS_STATE_USERMATCH 0x02
-+
-+static struct sss_sudo_result *sudo_sss_filter_result(struct sss_sudo_result *in_res, int (*filterp)(struct sss_sudo_rule *, void *), int act, void *filterp_arg)
-+{
-+     struct sss_sudo_result *out_res;
-+     int i, l, r;
-+     debug_decl(sudo_sss_filter_result, SUDO_DEBUG_LDAP)
-+
-+     DPRINTF(3, "in_res=%p, count=%u, act=%s",
-+	     in_res, in_res->num_rules, act == _SUDO_SSS_FILTER_EXCLUDE ? "EXCLUDE" : "INCLUDE");
-+
-+     if (in_res == NULL)
-+       debug_return_ptr(NULL);
-+
-+     DPRINTF(3, "emalloc: cnt=%d", in_res->num_rules);
-+
-+     out_res = emalloc(sizeof(struct sss_sudo_result));
-+     out_res->rules = in_res->num_rules > 0 ? emalloc(sizeof(struct sss_sudo_rule) * in_res->num_rules) : NULL;
-+     out_res->num_rules = 0;
-+
-+     for (i = l = 0; i < in_res->num_rules; ++i) {
-+	  r = filterp(in_res->rules + i, filterp_arg);
-+
-+	  if (( r && act == _SUDO_SSS_FILTER_INCLUDE) ||
-+	      (!r && act == _SUDO_SSS_FILTER_EXCLUDE))
-+	  {
-+	       DPRINTF(3, "COPY (%s): %p[%u] => %p[%u] (= %p)",
-+		       act == _SUDO_SSS_FILTER_EXCLUDE ? "not excluded" : "included",
-+		       in_res->rules, i, out_res->rules, l, in_res->rules + i);
-+
-+	       sudo_sss_rulecpy(out_res->rules + l, in_res->rules + i);
-+	       ++l;
-+	  }
-+     }
-+
-+     if (l < in_res->num_rules) {
-+	  DPRINTF(3, "reallocating result: %p (count: %u -> %u)", out_res->rules, in_res->num_rules, l);
-+	  out_res->rules = realloc(out_res->rules, sizeof(struct sss_sudo_rule) * l);
-+     }
-+
-+     out_res->num_rules = l;
-+
-+     debug_return_ptr(out_res);
-+}
-+
-+struct sudo_sss_handle {
-+     char *domainname;
-+     struct passwd *pw;
-+};
-+
-+struct sudo_nss sudo_nss_sss = {
-+    &sudo_nss_sss,
-+    NULL,
-+    sudo_sss_open,
-+    sudo_sss_close,
-+    sudo_sss_parse,
-+    sudo_sss_setdefs,
-+    sudo_sss_lookup,
-+    sudo_sss_display_cmnd,
-+    sudo_sss_display_defaults,
-+    sudo_sss_display_bound_defaults,
-+    sudo_sss_display_privs
-+};
-+
-+/* sudo_nss implementation */
-+// ok
-+static int sudo_sss_open(struct sudo_nss *nss)
-+{
-+     struct sudo_sss_handle *handle;
-+     debug_decl(sudo_sss_open, SUDO_DEBUG_LDAP);
-+
-+     /* Create a handle container. */
-+     handle = emalloc(sizeof(struct sudo_sss_handle));
-+     handle->domainname = NULL;
-+     handle->pw = sudo_user.pw;
-+     nss->handle = handle;
-+
-+     DPRINTF(3, "handle=%p", handle);
-+
-+     debug_return_int(0);
-+}
-+
-+// ok
-+static int sudo_sss_close(struct sudo_nss *nss)
-+{
-+     debug_decl(sudo_sss_close, SUDO_DEBUG_LDAP);
-+     efree(nss->handle);
-+     debug_return_int(0);
-+}
-+
-+// ok
-+static int sudo_sss_parse(struct sudo_nss *nss)
-+{
-+     debug_decl(sudo_sss_parse, SUDO_DEBUG_LDAP);
-+     debug_return_int(0);
-+}
-+
-+static int sudo_sss_setdefs(struct sudo_nss *nss)
-+{
-+     struct sudo_sss_handle *handle = nss->handle;
-+
-+     struct sss_sudo_result *sss_result;
-+     struct sss_sudo_rule   *sss_rule;
-+     uint32_t sss_error;
-+     int i;
-+     debug_decl(sudo_sss_setdefs, SUDO_DEBUG_LDAP);
-+
-+     if (handle == NULL)
-+	  debug_return_int(-1);
-+
-+     DPRINTF(1, "Looking for cn=defaults");
-+
-+     if (sss_sudo_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
-+				     &sss_error, &handle->domainname,
-+				     &sss_result) != 0)
-+     {
-+	  DPRINTF(2, "sss_sudo_send_recv_defaults: != 0, sss_error=%u", sss_error);
-+	  debug_return_int(-1);
-+     }
-+
-+     for (i = 0; i < sss_result->num_rules; ++i) {
-+	  DPRINTF(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
-+	  sss_rule = sss_result->rules + i;
-+	  sudo_sss_parse_options(sss_rule);
-+     }
-+
-+     sss_sudo_free_result(sss_result);
-+     debug_return_int(0);
-+}
-+
-+static int sudo_sss_checkpw(struct sudo_nss *nss, struct passwd *pw)
-+{
-+     struct sudo_sss_handle *handle = nss->handle;
-+     debug_decl(sudo_sss_checkpw, SUDO_DEBUG_LDAP);
-+
-+     if (pw->pw_name != handle->pw->pw_name ||
-+	 pw->pw_uid  != handle->pw->pw_uid)
-+     {
-+	  DPRINTF(1, "Requested name or uid don't match the initial once, reinitializing...");
-+	  handle->pw = pw;
-+
-+	  if (sudo_sss_setdefs(nss) != 0)
-+	       debug_return_int(-1);
-+     }
-+
-+     debug_return_int(0);
-+}
-+
-+static int
-+sudo_sss_check_runas_user(struct sss_sudo_rule *sss_rule)
-+{
-+     char **val_array = NULL;
-+     char *val;
-+     int ret = false, i;
-+     debug_decl(sudo_sss_check_runas_user, SUDO_DEBUG_LDAP);
-+
-+     if (!runas_pw)
-+	  debug_return_int(UNSPEC);
-+
-+     /* get the runas user from the entry */
-+     switch (sss_sudo_get_values(sss_rule, "sudoRunAsUser", &val_array)) 
-+     {
-+     case 0:
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result. Trying old style (sudoRunAs)");
-+
-+	  /* try old style */
-+	  switch (sss_sudo_get_values(sss_rule, "sudoRunAs", &val_array))
-+	  {
-+	  case 0:
-+	       break;
-+	  case ENOENT:
-+	       DPRINTF(2, "No result. Matching against runas_default");
-+	       /*
-+		* If there are no runas entries, match runas_default against
-+		* what the user specified on the command line.
-+		*/
-+	       return !strcasecmp(runas_pw->pw_name, def_runas_default);
-+	  default:
-+	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       debug_return_int(UNSPEC);
-+	  }
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  debug_return_int(UNSPEC);
-+     }
-+
-+     /*
-+      * BUG:
-+      * 
-+      * if runas is not specified on the command line, the only information
-+      * as to which user to run as is in the runas_default option.  We should
-+      * check to see if we have the local option present.  Unfortunately we
-+      * don't parse these options until after this routine says yes or no.
-+      * The query has already returned, so we could peek at the attribute
-+      * values here though.
-+      * 
-+      * For now just require users to always use -u option unless its set
-+      * in the global defaults. This behaviour is no different than the global
-+      * /etc/sudoers.
-+      * 
-+      * Sigh - maybe add this feature later
-+      */
-+
-+     /* walk through values returned, looking for a match */
-+     for (i = 0; val_array[i] != NULL && !ret; ++i) {
-+	  val = val_array[i];
-+
-+	  DPRINTF(3, "val[%d]=%s", i, val);
-+
-+	  switch (val[0]) {
-+	  case '+':
-+	       DPRINTF(3, "netgr_");
-+	       if (netgr_matches(val, NULL, NULL, runas_pw->pw_name)) {
-+		    DPRINTF(3, "=> match");
-+		    ret = true;
-+	       }
-+	       break;
-+	  case '%':
-+	       DPRINTF(3, "usergr_");
-+	       if (usergr_matches(val, runas_pw->pw_name, runas_pw)) {
-+		    DPRINTF(3, "=> match");
-+		    ret = true;
-+	       }
-+	       break;
-+	  case 'A':
-+	       if (strcmp(val, "ALL") == 0) {
-+		    DPRINTF(3, "ALL => match");
-+		    ret = true;
-+		    break;
-+	       }
-+	       /* FALLTHROUGH */
-+	       DPRINTF(3, "FALLTHROUGH");
-+	  default:
-+	       if (strcasecmp(val, runas_pw->pw_name) == 0) {
-+		    DPRINTF(3, "%s == %s (pw_name) => match", val, runas_pw->pw_name);
-+		    ret = true;
-+	       }
-+	       break;
-+	  }
-+
-+	  DPRINTF(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
-+     }
-+
-+     sss_sudo_free_values(val_array); /* cleanup */
-+
-+     debug_return_int(ret);
-+}
-+
-+static int
-+sudo_sss_check_runas_group(struct sss_sudo_rule *rule)
-+{
-+     char **val_array = NULL;
-+     char *val;
-+     int ret = false, i;
-+     debug_decl(sudo_sss_check_runas_group, SUDO_DEBUG_LDAP);
-+
-+     /* runas_gr is only set if the user specified the -g flag */
-+     if (!runas_gr)
-+	  debug_return_int(UNSPEC);
-+
-+     /* get the values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
-+     {
-+     case 0:
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  debug_return_int(false);
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  debug_return_int(UNSPEC);
-+     }
-+
-+     /* walk through values returned, looking for a match */
-+     for (i = 0; val_array[i] != NULL; ++i) {
-+	  val = val_array[i];
-+	  DPRINTF(3, "val[%d]=%s", i, val);
-+
-+	  if (strcmp(val, "ALL") == 0 || group_matches(val, runas_gr))
-+	       ret = true;
-+
-+	  DPRINTF(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
-+     }
-+
-+     sss_sudo_free_values(val_array);
-+
-+     debug_return_int(ret);
-+}
-+
-+/*
-+ * Walk through search results and return true if we have a runas match,
-+ * else false.  RunAs info is optional.
-+ */
-+static int
-+sudo_sss_check_runas(struct sss_sudo_rule *rule)
-+{
-+    int ret;
-+    debug_decl(sudo_sss_check_runas, SUDO_DEBUG_LDAP);
-+
-+    if (rule == NULL)
-+	 debug_return_int(false);
-+
-+    ret = sudo_sss_check_runas_user(rule) != false &&
-+	 sudo_sss_check_runas_group(rule) != false;
-+
-+    debug_return_int(ret);
-+}
-+
-+static int sudo_sss_check_host(struct sss_sudo_rule *rule)
-+{
-+    char **val_array, *val;
-+    int ret = false, i;
-+    debug_decl(sudo_sss_check_host, SUDO_DEBUG_LDAP);
-+
-+    if (rule == NULL)
-+	 debug_return_int(ret);
-+
-+    /* get the values from the rule */
-+    switch (sss_sudo_get_values(rule, "sudoHost", &val_array))
-+    {
-+    case 0:
-+	 break;
-+    case ENOENT:
-+	 DPRINTF(2, "No result.");
-+	 debug_return_int(false);
-+    default:
-+	 DPRINTF(2, "sss_sudo_get_values(sudoHost): != 0");
-+	 debug_return_int(ret);
-+    }
-+
-+    /* walk through values */
-+    for (i = 0; val_array[i] != NULL; ++i) {
-+	 val = val_array[i];
-+	 DPRINTF(3, "val[%d]=%s", i, val);
-+
-+	 /* match any or address or netgroup or hostname */
-+	 if (!strcmp(val, "ALL") || addr_matches(val) ||
-+	     netgr_matches(val, user_host, user_shost, NULL) ||
-+	     hostname_matches(user_shost, user_host, val))
-+	      ret = true;
-+
-+	 DPRINTF(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
-+    }
-+
-+    sss_sudo_free_values(val_array);
-+
-+    debug_return_int(ret);
-+}
-+
-+static int sudo_sss_result_filterp(struct sss_sudo_rule *rule, void *unused)
-+{
-+     (void)unused;
-+     debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_LDAP);
-+
-+     if (sudo_sss_check_host(rule))
-+	  debug_return_int(1);
-+     else
-+	  debug_return_int(0);
-+}
-+
-+static struct sss_sudo_result *sudo_sss_result_get(struct sudo_nss *nss, struct passwd *pw, uint32_t *state)
-+{
-+     struct sudo_sss_handle *handle = nss->handle;
-+     struct sss_sudo_result *u_sss_result, *f_sss_result;
-+     uint32_t sss_error = 0, ret;
-+     debug_decl(sudo_sss_result_get, SUDO_DEBUG_LDAP);
-+
-+     if (sudo_sss_checkpw(nss, pw) != 0)
-+	  debug_return_ptr(NULL);
-+
-+     DPRINTF(1, "  username=%s", handle->pw->pw_name);
-+     DPRINTF(1, "domainname=%s", handle->domainname);
-+
-+     u_sss_result = f_sss_result = NULL;
-+
-+     switch (ret = sss_sudo_send_recv(handle->pw->pw_uid, handle->pw->pw_name,
-+				      handle->domainname, &sss_error, &u_sss_result))
-+     {
-+     case 0:
-+	  switch (sss_error) {
-+	  case 0:
-+	       if (u_sss_result != NULL) {
-+		    if (state != NULL) {
-+			 DPRINTF(3, "state |= USERMATCH");
-+			 *state |= _SUDO_SSS_STATE_USERMATCH;
-+		    }
-+		    DPRINTF(2, "Received %u rule(s)", u_sss_result->num_rules);
-+	       } else {
-+		    DPRINTF(2, "Internal error: u_sss_result == NULL && sss_error == 0");
-+		    debug_return_ptr(NULL);
-+	       }
-+	       break;
-+	  case ENOENT:
-+	       DPRINTF(2, "No result.");
-+	  default:
-+	       DPRINTF(2, "sss_error=%u\n", sss_error);
-+	       debug_return_ptr(NULL);
-+	  }
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
-+	  debug_return_ptr(NULL);
-+     }
-+
-+     f_sss_result = sudo_sss_filter_result(u_sss_result, sudo_sss_result_filterp,
-+					   _SUDO_SSS_FILTER_INCLUDE, NULL);
-+
-+     if (f_sss_result != NULL)
-+	  if (f_sss_result->num_rules > 0)
-+	       if (state != NULL) {
-+		    DPRINTF(3, "state |= HOSTMATCH");
-+		    *state |= _SUDO_SSS_STATE_HOSTMATCH;
-+	       }
-+
-+     DPRINTF(3, "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)",
-+	     u_sss_result, u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
-+
-+     sss_sudo_free_result(u_sss_result);
-+
-+     debug_return_ptr(f_sss_result);
-+}
-+
-+/*
-+ * Search for boolean "option" in sudoOption.
-+ * Returns true if found and allowed, false if negated, else UNSPEC.
-+ */
-+static int
-+sudo_sss_check_bool(struct sss_sudo_rule *rule, char *option)
-+{
-+     char ch, *var, **val_array = NULL;
-+     int i, ret = UNSPEC;
-+     debug_decl(sudo_sss_check_bool, SUDO_DEBUG_LDAP);
-+
-+     if (rule == NULL)
-+	  debug_return_int(ret);
-+
-+     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+     {
-+     case 0:
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  debug_return_int(ret);
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values: != 0");
-+	  debug_return_int(ret);
-+     }
-+
-+     /* walk through options */
-+     for (i = 0; val_array[i] != NULL; ++i) {
-+	  var = val_array[i];
-+	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", var);
-+
-+	  if ((ch = *var) == '!')
-+	       var++;
-+	  if (strcmp(var, option) == 0)
-+	       ret = (ch != '!');
-+     }
-+
-+     sss_sudo_free_values(val_array);
-+
-+     debug_return_int(ret);
-+}
-+
-+/*
-+ * Walk through search results and return true if we have a command match,
-+ * false if disallowed and UNSPEC if not matched.
-+ */
-+static int
-+sudo_sss_check_command(struct sss_sudo_rule *rule, int *setenv_implied)
-+{
-+     char **val_array = NULL, *val;
-+     char *allowed_cmnd, *allowed_args;
-+     int i, foundbang, ret = UNSPEC;
-+     debug_decl(sudo_sss_check_command, SUDO_DEBUG_LDAP);
-+
-+     if (rule == NULL)
-+	  debug_return_int(ret);
-+
-+     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array))
-+     {
-+     case 0:
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  debug_return_int(ret);
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values: != 0");
-+	  debug_return_int(ret);
-+     }
-+
-+     for (i = 0; val_array[i] != NULL && ret != false; ++i) {
-+	  val = val_array[i];
-+
-+	  DPRINTF(3, "val[%d]=%s", i, val);
-+
-+	  /* Match against ALL ? */
-+	  if (!strcmp(val, "ALL")) {
-+	       ret = true;
-+	       if (setenv_implied != NULL)
-+		    *setenv_implied = true;
-+	       DPRINTF(2, "sssd/ldap sudoCommand '%s' ... MATCH!", val);
-+	       continue;
-+	  }
-+
-+	  /* check for !command */
-+	  if (*val == '!') {
-+	       foundbang = true;
-+	       allowed_cmnd = estrdup(1 + val);	/* !command */
-+	  } else {
-+	       foundbang = false;
-+	       allowed_cmnd = estrdup(val);	/* command */
-+	  }
-+
-+	  /* split optional args away from command */
-+	  allowed_args = strchr(allowed_cmnd, ' ');
-+	  if (allowed_args)
-+	       *allowed_args++ = '\0';
-+
-+	  /* check the command like normal */
-+	  if (command_matches(allowed_cmnd, allowed_args)) {
-+	       /*
-+		* If allowed (no bang) set ret but keep on checking.
-+		* If disallowed (bang), exit loop.
-+		*/
-+	       ret = foundbang ? false : true;
-+	  }
-+
-+	  DPRINTF(2, "sssd/ldap sudoCommand '%s' ... %s", val, ret == true ? "MATCH!" : "not");
-+	  efree(allowed_cmnd);	/* cleanup */
-+     }
-+
-+     sss_sudo_free_values(val_array); /* more cleanup */
-+
-+     debug_return_int(ret);
-+}
-+
-+static void
-+sudo_sss_parse_options(struct sss_sudo_rule *rule)
-+{
-+     int i;
-+     char op, *v, *val;
-+     char **val_array = NULL;
-+     debug_decl(sudo_sss_parse_options, SUDO_DEBUG_LDAP);
-+
-+     if (rule == NULL)
-+	  debug_return;
-+
-+     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+     {
-+     case 0:
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  debug_return;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  debug_return;
-+     }
-+
-+     /* walk through options */
-+     for (i = 0; val_array[i] != NULL; i++) {
-+	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", val_array[i]);
-+	  v = estrdup(val_array[i]);
-+
-+	  /* check for equals sign past first char */
-+	  val = strchr(v, '=');
-+	  if (val > v) {
-+	       *val++ = '\0';	/* split on = and truncate var */
-+	       op = *(val - 2);	/* peek for += or -= cases */
-+	       if (op == '+' || op == '-') {
-+		    *(val - 2) = '\0';	/* found, remove extra char */
-+		    /* case var+=val or var-=val */
-+		    set_default(v, val, (int) op);
-+	       } else {
-+		    /* case var=val */
-+		    set_default(v, val, true);
-+	       }
-+	  } else if (*v == '!') {
-+	       /* case !var Boolean False */
-+	       set_default(v + 1, NULL, false);
-+	  } else {
-+	       /* case var Boolean True */
-+	       set_default(v, NULL, true);
-+	  }
-+	  efree(v);
-+     }
-+
-+     sss_sudo_free_values(val_array);
-+     debug_return;
-+}
-+
-+static int sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag)
-+{
-+    int rc, setenv_implied;
-+
-+    struct sss_sudo_result *sss_result = NULL;
-+    struct sss_sudo_rule   *rule;
-+    uint32_t i, state = 0;
-+    debug_decl(sudo_sss_lookup, SUDO_DEBUG_LDAP);
-+
-+    /* Fetch list of sudoRole entries that match user and host. */
-+    sss_result = sudo_sss_result_get(nss, sudo_user.pw, &state);
-+
-+    /*
-+     * The following queries are only determine whether or not a
-+     * password is required, so the order of the entries doesn't matter.
-+     */
-+    if (pwflag) {
-+	int doauth = UNSPEC;
-+	int matched = UNSPEC;
-+	enum def_tuple pwcheck = 
-+	    (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
-+
-+	DPRINTF(2, "perform search for pwflag %d", pwflag);
-+	if (sss_result != NULL) {
-+	     for (i = 0; i < sss_result->num_rules; i++) {
-+		  rule = sss_result->rules + i;
-+		  if ((pwcheck == any && doauth != false) ||
-+		      (pwcheck == all && doauth == false)) {
-+		       doauth = sudo_sss_check_bool(rule, "authenticate");
-+		  }
-+		  /* Only check the command when listing another user. */
-+		  if (user_uid == 0 || list_pw == NULL ||
-+		      user_uid == list_pw->pw_uid ||
-+		      sudo_sss_check_command(rule, NULL)) {
-+		       matched = true;
-+		       break;
-+		  }
-+	     }
-+	}
-+	if (matched || user_uid == 0) {
-+	    SET(ret, VALIDATE_OK);
-+	    CLR(ret, VALIDATE_NOT_OK);
-+	    if (def_authenticate) {
-+		switch (pwcheck) {
-+		    case always:
-+			SET(ret, FLAG_CHECK_USER);
-+			break;
-+		    case all:
-+		    case any:
-+			if (doauth == false)
-+			    def_authenticate = false;
-+			break;
-+		    case never:
-+			def_authenticate = false;
-+			break;
-+		    default:
-+			break;
-+		}
-+	    }
-+	}
-+	goto done;
-+    }
-+
-+    DPRINTF(1, "searching SSSD/LDAP for sudoers entries");
-+
-+    setenv_implied = false;
-+    if (sss_result != NULL) {
-+	 for (i = 0; i < sss_result->num_rules; i++) {
-+	      rule = sss_result->rules + i;
-+	      if (!sudo_sss_check_runas(rule))
-+		   continue;
-+	      rc = sudo_sss_check_command(rule, &setenv_implied);
-+	      if (rc != UNSPEC) {
-+		   /* We have a match. */
-+		   DPRINTF(1, "Command %sallowed", rc == true ? "" : "NOT ");
-+		   if (rc == true) {
-+			DPRINTF(3, "SSSD rule: %p", rule);
-+			/* Apply entry-specific options. */
-+			if (setenv_implied)
-+			     def_setenv = true;
-+			sudo_sss_parse_options(rule);
-+#ifdef HAVE_SELINUX
-+			/* Set role and type if not specified on command line. */
-+			if (user_role == NULL)
-+			     user_role = def_role;
-+			if (user_type == NULL)
-+			     user_type = def_type;
-+#endif /* HAVE_SELINUX */
-+			SET(ret, VALIDATE_OK);
-+			CLR(ret, VALIDATE_NOT_OK);
-+		   } else {
-+			SET(ret, VALIDATE_NOT_OK);
-+			CLR(ret, VALIDATE_OK);
-+		   }
-+		   break;
-+	      }
-+	 }
-+    }
-+done:
-+    DPRINTF(1, "Done with LDAP searches");
-+
-+    if (!ISSET(ret, VALIDATE_OK)) {
-+	/* No matching entries. */
-+	if (pwflag && list_pw == NULL)
-+	    SET(ret, FLAG_NO_CHECK);
-+    }
-+
-+    if (state & _SUDO_SSS_STATE_USERMATCH)
-+	 CLR(ret, FLAG_NO_USER);
-+    if (state & _SUDO_SSS_STATE_HOSTMATCH)
-+	 CLR(ret, FLAG_NO_HOST);
-+
-+    DPRINTF(3, "sudo_sss_lookup(%d)=0x%02x", pwflag, ret);
-+
-+    debug_return_int(ret);
-+}
-+
-+static int sudo_sss_display_cmnd(struct sudo_nss *nss, struct passwd *pw)
-+{
-+     struct sudo_sss_handle *handle = nss->handle;
-+     struct sss_sudo_result *sss_result = NULL;
-+     struct sss_sudo_rule *rule;
-+     int i, found = false;
-+     debug_decl(sudo_sss_display_cmnd, SUDO_DEBUG_LDAP);
-+
-+     if (handle == NULL)
-+	  goto done;
-+
-+     if (sudo_sss_checkpw(nss, pw) != 0)
-+	  debug_return_int(-1);
-+
-+     /*
-+      * The sudo_sss_result_get() function returns all nodes that match
-+      * the user and the host.
-+      */
-+     DPRINTF(1, "sssd/ldap search for command list");
-+     sss_result = sudo_sss_result_get(nss, pw, NULL);
-+
-+     if (sss_result == NULL)
-+	  goto done;
-+
-+     for (i = 0; i < sss_result->num_rules; i++) {
-+	  rule = sss_result->rules + i;
-+	  if (sudo_sss_check_command(rule, NULL) &&
-+	      sudo_sss_check_runas(rule)) {
-+	       found = true;
-+	       goto done;
-+	  }
-+     }
-+
-+done:
-+     if (found)
-+	  printf("%s%s%s\n", safe_cmnd ? safe_cmnd : user_cmnd,
-+		 user_args ? " " : "", user_args ? user_args : "");
-+
-+     if (sss_result != NULL)
-+	  sss_sudo_free_result(sss_result);
-+
-+     debug_return_int(!found);
-+}
-+
-+static int sudo_sss_display_defaults(struct sudo_nss *nss, struct passwd *pw,
-+				      struct lbuf *lbuf)
-+{
-+     struct sudo_sss_handle *handle = nss->handle;
-+
-+     struct sss_sudo_rule *rule;
-+     struct sss_sudo_result *sss_result = NULL;
-+
-+     uint32_t sss_error = 0;
-+
-+     char *prefix, *val, **val_array = NULL;
-+     int count = 0, i, j;
-+
-+     debug_decl(sudo_sss_display_defaults, SUDO_DEBUG_LDAP);
-+
-+     if (handle == NULL)
-+	  goto done;
-+
-+     if (sss_sudo_send_recv_defaults(pw->pw_uid, pw->pw_name,
-+				     &sss_error, &handle->domainname,
-+				     &sss_result) != 0)
-+     {
-+	  DPRINTF(2, "sss_sudo_send_recv_defaults: !=0, sss_error=%u", sss_error);
-+	  goto done;
-+     }
-+
-+     handle->pw = pw;
-+
-+     for (i = 0; i < sss_result->num_rules; ++i) {
-+	  rule = sss_result->rules + i;
-+
-+	  switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+	  {
-+	  case 0:
-+	       break;
-+	  case ENOENT:
-+	       DPRINTF(2, "No result.");
-+	       continue;
-+	  default:
-+	       DPRINTF(2, "sss_sudo_get_values: != 0");
-+	       continue;
-+	  }
-+
-+	  if (lbuf->len == 0 || isspace((unsigned char)lbuf->buf[lbuf->len - 1]))
-+	       prefix = "    ";
-+	  else
-+	       prefix = ", ";
-+
-+	  for (j = 0; val_array[j] != NULL; ++j) {
-+	       val = val_array[j];
-+	       lbuf_append(lbuf, "%s%s", prefix, val);
-+	       prefix = ", ";
-+	       count++;
-+	  }
-+	  
-+	  sss_sudo_free_values(val_array);
-+	  val_array = NULL;
-+     }
-+
-+     sss_sudo_free_result(sss_result);
-+done:
-+     debug_return_int(count);
-+}
-+
-+// ok
-+static int sudo_sss_display_bound_defaults(struct sudo_nss *nss,
-+					    struct passwd *pw, struct lbuf *lbuf)
-+{
-+     debug_decl(sudo_sss_display_bound_defaults, SUDO_DEBUG_LDAP);
-+     debug_return_int(0);
-+}
-+
-+static int sudo_sss_display_entry_long(struct sss_sudo_rule *rule, struct lbuf *lbuf)
-+{
-+     char **val_array = NULL;
-+     int count = 0, i;
-+     debug_decl(sudo_sss_display_entry_long, SUDO_DEBUG_LDAP);
-+
-+     /* get the RunAsUser Values from the entry */
-+     lbuf_append(lbuf, "    RunAsUsers: ");
-+     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
-+     {
-+     case 0:
-+	  for (i = 0; val_array[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
-+	  sss_sudo_free_values(val_array);
-+	  break;
-+     case ENOENT:
-+	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
-+	  {
-+	  case 0:
-+	       for (i = 0; val_array[i] != NULL; ++i)
-+		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
-+	       sss_sudo_free_values(val_array);
-+	       break;
-+	  case ENOENT:
-+	       DPRINTF(2, "No result.");
-+	       lbuf_append(lbuf, "%s", def_runas_default);
-+	       break;
-+	  default:
-+	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       debug_return_int(count);
-+	  }
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  debug_return_int(count);
-+     }
-+     lbuf_append(lbuf, "\n");
-+
-+     /* get the RunAsGroup Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
-+     {
-+     case 0:
-+	  lbuf_append(lbuf, "    RunAsGroups: ");
-+	  for (i = 0; val_array[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
-+	  sss_sudo_free_values(val_array);
-+	  lbuf_append(lbuf, "\n");
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  debug_return_int(count);
-+     }
-+
-+     /* get the Option Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+     {
-+     case 0:
-+	  lbuf_append(lbuf, "    Options: ");
-+	  for (i = 0; val_array[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
-+	  sss_sudo_free_values(val_array);
-+	  lbuf_append(lbuf, "\n");
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  debug_return_int(count);
-+     }
-+
-+     /* Get the command values from the entry. */
-+     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
-+     case 0:
-+	  lbuf_append(lbuf, _("    Commands:\n"));
-+	  for (i = 0; val_array[i] != NULL; ++i) {
-+	       lbuf_append(lbuf, "\t%s\n", val_array[i]);
-+	       count++;
-+	  }
-+	  sss_sudo_free_values(val_array);
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
-+	  debug_return_int(count);
-+     }
-+
-+     debug_return_int(count);
-+}
-+
-+static int sudo_sss_display_entry_short(struct sss_sudo_rule *rule, struct lbuf *lbuf)
-+{
-+     char **val_array = NULL;
-+     int count = 0, i;
-+     debug_decl(sudo_sss_display_entry_short, SUDO_DEBUG_LDAP);
-+
-+     lbuf_append(lbuf, "    (");
-+
-+     /* get the RunAsUser Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
-+     {
-+     case 0:
-+	  for (i = 0; val_array[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
-+	  sss_sudo_free_values(val_array);
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result. Trying old style (sudoRunAs).");
-+	  /* try old style */
-+	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
-+	  {
-+	  case 0:
-+	       for (i = 0; val_array[i] != NULL; ++i)
-+		    lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
-+	       sss_sudo_free_values(val_array);
-+	       break;
-+	  case ENOENT:
-+	       DPRINTF(2, "No result.");
-+	       lbuf_append(lbuf, "%s", def_runas_default);
-+	       break;
-+	  default:
-+	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       debug_return_int(count);
-+	  }
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  debug_return_int(count);
-+     }
-+
-+     /* get the RunAsGroup Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
-+     {
-+     case 0:
-+	  lbuf_append(lbuf, " : ");
-+	  for (i = 0; val_array[i] != NULL; ++i)
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
-+	  sss_sudo_free_values(val_array);
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  debug_return_int(count);
-+     }
-+
-+     lbuf_append(lbuf, ") ");
-+
-+     /* get the Option Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
-+     {
-+     case 0:
-+	  for (i = 0; val_array[i] != NULL; ++i) {
-+	       char *cp = val_array[i];
-+	       if (*cp == '!')
-+		    cp++;
-+	       if (strcmp(cp, "authenticate") == 0)
-+		    lbuf_append(lbuf, val_array[i][0] == '!' ?
-+				"NOPASSWD: " : "PASSWD: ");
-+	       else if (strcmp(cp, "noexec") == 0)
-+		    lbuf_append(lbuf, val_array[i][0] == '!' ?
-+				"EXEC: " : "NOEXEC: ");
-+	       else if (strcmp(cp, "setenv") == 0)
-+		    lbuf_append(lbuf, val_array[i][0] == '!' ?
-+				"NOSETENV: " : "SETENV: ");
-+	  }
-+
-+	  sss_sudo_free_values(val_array);
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  debug_return_int(count);
-+     }
-+
-+     /* get the Command Values from the entry */
-+     switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
-+     case 0:
-+	  for (i = 0; val_array[i] != NULL; ++i) {
-+	       lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
-+	       count++;
-+	  }
-+	  sss_sudo_free_values(val_array);
-+	  break;
-+     case ENOENT:
-+	  DPRINTF(2, "No result.");
-+	  break;
-+     default:
-+	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
-+	  debug_return_int(count);
-+     }
-+     lbuf_append(lbuf, "\n");
-+
-+     debug_return_int(count);
-+}
-+
-+static int sudo_sss_display_privs(struct sudo_nss *nss, struct passwd *pw,
-+				   struct lbuf *lbuf)
-+{
-+     struct sudo_sss_handle *handle = nss->handle;
-+
-+     struct sss_sudo_result *sss_result = NULL;
-+     struct sss_sudo_rule *rule;
-+     unsigned int i, count = 0;
-+     debug_decl(sudo_sss_display_privs, SUDO_DEBUG_LDAP);
-+
-+     if (handle == NULL)
-+	  debug_return_int(-1);
-+     if (sudo_sss_checkpw(nss, pw) != 0)
-+	  debug_return_int(-1);
-+
-+     DPRINTF(2, "sssd/ldap search for command list");
-+
-+     sss_result = sudo_sss_result_get(nss, pw, NULL);
-+
-+     if (sss_result == NULL)
-+	  debug_return_int(count);
-+
-+     /* Display all matching entries. */
-+     for (i = 0; i < sss_result->num_rules; ++i) {
-+	  rule = sss_result->rules + i;
-+	  if (long_list)
-+	       count += sudo_sss_display_entry_long(rule, lbuf);
-+	  else
-+	       count += sudo_sss_display_entry_short(rule, lbuf);
-+     }
-+
-+     if (sss_result != NULL)
-+	  sss_sudo_free_result(sss_result);
-+
-+     debug_return_int(count);
-+}
-diff -up sudo-1.8.5/plugins/sudoers/sudo_nss.c.sssd-support sudo-1.8.5/plugins/sudoers/sudo_nss.c
---- sudo-1.8.5/plugins/sudoers/sudo_nss.c.sssd-support	2012-03-12 19:02:14.000000000 +0100
-+++ sudo-1.8.5/plugins/sudoers/sudo_nss.c	2012-05-17 10:30:40.819975039 +0200
-@@ -47,8 +47,11 @@ extern struct sudo_nss sudo_nss_file;
- #ifdef HAVE_LDAP
- extern struct sudo_nss sudo_nss_ldap;
- #endif
-+#ifdef HAVE_SSSD
-+extern struct sudo_nss sudo_nss_sss;
-+#endif
- 
--#if defined(HAVE_LDAP) && defined(_PATH_NSSWITCH_CONF)
-+#if (defined(HAVE_SSSD) || defined(HAVE_LDAP)) && defined(_PATH_NSSWITCH_CONF)
- /*
-  * Read in /etc/nsswitch.conf
-  * Returns a tail queue of matches.
-@@ -58,6 +61,9 @@ sudo_read_nss(void)
- {
-     FILE *fp;
-     char *cp;
-+#if defined(HAVE_SSSD)
-+    bool saw_sss = false;
-+#endif
-     bool saw_files = false;
-     bool saw_ldap = false;
-     bool got_match = false;
-@@ -84,6 +90,11 @@ sudo_read_nss(void)
- 	    } else if (strcasecmp(cp, "ldap") == 0 && !saw_ldap) {
- 		tq_append(&snl, &sudo_nss_ldap);
- 		got_match = true;
-+#if defined(HAVE_SSSD)
-+	    } else if (strcasecmp(cp, "sss") == 0 && !saw_sss) {
-+		tq_append(&snl, &sudo_nss_sss);
-+		got_match = true;
-+#endif
- 	    } else if (strcasecmp(cp, "[NOTFOUND=return]") == 0 && got_match) {
- 		/* NOTFOUND affects the most recent entry */
- 		tq_last(&snl)->ret_if_notfound = true;
-@@ -106,7 +117,7 @@ nomatch:
- 
- #else /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
- 
--# if defined(HAVE_LDAP) && defined(_PATH_NETSVC_CONF)
-+# if (defined(HAVE_SSSD) || defined(HAVE_LDAP)) && defined(_PATH_NETSVC_CONF)
- 
- /*
-  * Read in /etc/netsvc.conf (like nsswitch.conf on AIX)
-@@ -117,6 +128,9 @@ sudo_read_nss(void)
- {
-     FILE *fp;
-     char *cp, *ep;
-+#if defined(HAVE_SSSD)
-+    bool saw_sss = false;
-+#endif
-     bool saw_files = false;
-     bool saw_ldap = false;
-     bool got_match = false;
-@@ -156,6 +170,13 @@ sudo_read_nss(void)
- 		tq_append(&snl, &sudo_nss_ldap);
- 		got_match = true;
- 		ep = &cp[4];
-+#if defined(HAVE_SSSD)
-+	    } else if (!saw_sss && strncasecmp(cp, "sss", 3) == 0 &&
-+		(isspace((unsigned char)cp[3]) || cp[3] == '\0')) {
-+		tq_append(&snl, &sudo_nss_sss);
-+		got_match = true;
-+		ep = &cp[3];
-+#endif
- 	    } else {
- 		got_match = false;
- 	    }
-@@ -195,6 +216,9 @@ sudo_read_nss(void)
-     static struct sudo_nss_list snl;
-     debug_decl(sudo_read_nss, SUDO_DEBUG_NSS)
- 
-+#  ifdef HAVE_SSSD
-+    tq_append(&snl, &sudo_nss_sss);
-+#  endif
- #  ifdef HAVE_LDAP
-     tq_append(&snl, &sudo_nss_ldap);
- #  endif
diff --git a/sudo-1.8.5-sssd-use-sudo_debug_printf.patch b/sudo-1.8.5-sssd-use-sudo_debug_printf.patch
deleted file mode 100644
index 25ac0ad..0000000
--- a/sudo-1.8.5-sssd-use-sudo_debug_printf.patch
+++ /dev/null
@@ -1,600 +0,0 @@
-diff -rup original/plugins/sudoers/sssd.c new/plugins/sudoers/sssd.c
---- original/plugins/sudoers/sssd.c	2012-07-17 10:50:20.110201384 +0200
-+++ new/plugins/sudoers/sssd.c	2012-07-17 11:09:31.213626613 +0200
-@@ -56,11 +56,6 @@
- #include "lbuf.h"
- #include "sudo_debug.h"
- 
--extern int debug_level;
--#define __sssd_debug debug_level
--
--#define	DPRINTF(level, fmt, ...) if (__sssd_debug >= (level)) warningx("%s:%d: "fmt, __PRETTY_FUNCTION__, __LINE__, ##__VA_ARGS__)
--
- /* sudo_nss implementation */
- static int sudo_sss_open(struct sudo_nss *nss);
- static int sudo_sss_close(struct sudo_nss *nss);
-@@ -88,8 +83,8 @@ static void sudo_sss_attrcpy(struct sss_
-      int i;
-      debug_decl(sudo_sss_attrcpy, SUDO_DEBUG_SSSD)
- 
--     DPRINTF(3, "dst=%p, src=%p", dst, src);
--     DPRINTF(2, "emalloc: cnt=%d", src->num_values);
-+     sudo_debug_printf(3, "dst=%p, src=%p", dst, src);
-+     sudo_debug_printf(2, "emalloc: cnt=%d", src->num_values);
- 
-      dst->name = strdup(src->name);
-      dst->num_values = src->num_values;
-@@ -106,8 +101,8 @@ static void sudo_sss_rulecpy(struct sss_
-      int i;
-      debug_decl(sudo_sss_rulecpy, SUDO_DEBUG_SSSD)
- 
--     DPRINTF(3, "dst=%p, src=%p", dst, src);
--     DPRINTF(2, "emalloc: cnt=%d", src->num_attrs);
-+     sudo_debug_printf(3, "dst=%p, src=%p", dst, src);
-+     sudo_debug_printf(2, "emalloc: cnt=%d", src->num_attrs);
- 
-      dst->num_attrs = src->num_attrs;
-      dst->attrs = emalloc(sizeof(struct sss_sudo_attr) * dst->num_attrs);
-@@ -132,13 +127,13 @@ static struct sss_sudo_result *sudo_sss_
-      int i, l, r;
-      debug_decl(sudo_sss_filter_result, SUDO_DEBUG_SSSD)
- 
--     DPRINTF(3, "in_res=%p, count=%u, act=%s",
-+     sudo_debug_printf(3, "in_res=%p, count=%u, act=%s",
- 	     in_res, in_res->num_rules, act == _SUDO_SSS_FILTER_EXCLUDE ? "EXCLUDE" : "INCLUDE");
- 
-      if (in_res == NULL)
-        debug_return_ptr(NULL);
- 
--     DPRINTF(3, "emalloc: cnt=%d", in_res->num_rules);
-+     sudo_debug_printf(3, "emalloc: cnt=%d", in_res->num_rules);
- 
-      out_res = emalloc(sizeof(struct sss_sudo_result));
-      out_res->rules = in_res->num_rules > 0 ? emalloc(sizeof(struct sss_sudo_rule) * in_res->num_rules) : NULL;
-@@ -150,7 +145,7 @@ static struct sss_sudo_result *sudo_sss_
- 	  if (( r && act == _SUDO_SSS_FILTER_INCLUDE) ||
- 	      (!r && act == _SUDO_SSS_FILTER_EXCLUDE))
- 	  {
--	       DPRINTF(3, "COPY (%s): %p[%u] => %p[%u] (= %p)",
-+	       sudo_debug_printf(3, "COPY (%s): %p[%u] => %p[%u] (= %p)",
- 		       act == _SUDO_SSS_FILTER_EXCLUDE ? "not excluded" : "included",
- 		       in_res->rules, i, out_res->rules, l, in_res->rules + i);
- 
-@@ -160,7 +155,7 @@ static struct sss_sudo_result *sudo_sss_
-      }
- 
-      if (l < in_res->num_rules) {
--	  DPRINTF(3, "reallocating result: %p (count: %u -> %u)", out_res->rules, in_res->num_rules, l);
-+	  sudo_debug_printf(3, "reallocating result: %p (count: %u -> %u)", out_res->rules, in_res->num_rules, l);
- 	  out_res->rules = realloc(out_res->rules, sizeof(struct sss_sudo_rule) * l);
-      }
- 
-@@ -201,7 +196,7 @@ static int sudo_sss_open(struct sudo_nss
-      handle->pw = sudo_user.pw;
-      nss->handle = handle;
- 
--     DPRINTF(3, "handle=%p", handle);
-+     sudo_debug_printf(3, "handle=%p", handle);
- 
-      debug_return_int(0);
- }
-@@ -234,18 +229,18 @@ static int sudo_sss_setdefs(struct sudo_
-      if (handle == NULL)
- 	  debug_return_int(-1);
- 
--     DPRINTF(1, "Looking for cn=defaults");
-+     sudo_debug_printf(1, "Looking for cn=defaults");
- 
-      if (sss_sudo_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
- 				     &sss_error, &handle->domainname,
- 				     &sss_result) != 0)
-      {
--	  DPRINTF(2, "sss_sudo_send_recv_defaults: != 0, sss_error=%u", sss_error);
-+	  sudo_debug_printf(2, "sss_sudo_send_recv_defaults: != 0, sss_error=%u", sss_error);
- 	  debug_return_int(-1);
-      }
- 
-      for (i = 0; i < sss_result->num_rules; ++i) {
--	  DPRINTF(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
-+	  sudo_debug_printf(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
- 	  sss_rule = sss_result->rules + i;
- 	  sudo_sss_parse_options(sss_rule);
-      }
-@@ -262,7 +257,7 @@ static int sudo_sss_checkpw(struct sudo_
-      if (pw->pw_name != handle->pw->pw_name ||
- 	 pw->pw_uid  != handle->pw->pw_uid)
-      {
--	  DPRINTF(1, "Requested name or uid don't match the initial once, reinitializing...");
-+	  sudo_debug_printf(1, "Requested name or uid don't match the initial once, reinitializing...");
- 	  handle->pw = pw;
- 
- 	  if (sudo_sss_setdefs(nss) != 0)
-@@ -289,7 +284,7 @@ sudo_sss_check_runas_user(struct sss_sud
-      case 0:
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result. Trying old style (sudoRunAs)");
-+	  sudo_debug_printf(2, "No result. Trying old style (sudoRunAs)");
- 
- 	  /* try old style */
- 	  switch (sss_sudo_get_values(sss_rule, "sudoRunAs", &val_array))
-@@ -297,19 +292,19 @@ sudo_sss_check_runas_user(struct sss_sud
- 	  case 0:
- 	       break;
- 	  case ENOENT:
--	       DPRINTF(2, "No result. Matching against runas_default");
-+	       sudo_debug_printf(2, "No result. Matching against runas_default");
- 	       /*
- 		* If there are no runas entries, match runas_default against
- 		* what the user specified on the command line.
- 		*/
- 	       return !strcasecmp(runas_pw->pw_name, def_runas_default);
- 	  default:
--	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
- 	       debug_return_int(UNSPEC);
- 	  }
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
- 	  debug_return_int(UNSPEC);
-      }
- 
-@@ -334,40 +329,40 @@ sudo_sss_check_runas_user(struct sss_sud
-      for (i = 0; val_array[i] != NULL && !ret; ++i) {
- 	  val = val_array[i];
- 
--	  DPRINTF(3, "val[%d]=%s", i, val);
-+	  sudo_debug_printf(3, "val[%d]=%s", i, val);
- 
- 	  switch (val[0]) {
- 	  case '+':
--	       DPRINTF(3, "netgr_");
-+	       sudo_debug_printf(3, "netgr_");
- 	       if (netgr_matches(val, NULL, NULL, runas_pw->pw_name)) {
--		    DPRINTF(3, "=> match");
-+		    sudo_debug_printf(3, "=> match");
- 		    ret = true;
- 	       }
- 	       break;
- 	  case '%':
--	       DPRINTF(3, "usergr_");
-+	       sudo_debug_printf(3, "usergr_");
- 	       if (usergr_matches(val, runas_pw->pw_name, runas_pw)) {
--		    DPRINTF(3, "=> match");
-+		    sudo_debug_printf(3, "=> match");
- 		    ret = true;
- 	       }
- 	       break;
- 	  case 'A':
- 	       if (strcmp(val, "ALL") == 0) {
--		    DPRINTF(3, "ALL => match");
-+		    sudo_debug_printf(3, "ALL => match");
- 		    ret = true;
- 		    break;
- 	       }
- 	       /* FALLTHROUGH */
--	       DPRINTF(3, "FALLTHROUGH");
-+	       sudo_debug_printf(3, "FALLTHROUGH");
- 	  default:
- 	       if (strcasecmp(val, runas_pw->pw_name) == 0) {
--		    DPRINTF(3, "%s == %s (pw_name) => match", val, runas_pw->pw_name);
-+		    sudo_debug_printf(3, "%s == %s (pw_name) => match", val, runas_pw->pw_name);
- 		    ret = true;
- 	       }
- 	       break;
- 	  }
- 
--	  DPRINTF(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
-+	  sudo_debug_printf(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
-      }
- 
-      sss_sudo_free_values(val_array); /* cleanup */
-@@ -393,22 +388,22 @@ sudo_sss_check_runas_group(struct sss_su
-      case 0:
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  debug_return_int(false);
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
- 	  debug_return_int(UNSPEC);
-      }
- 
-      /* walk through values returned, looking for a match */
-      for (i = 0; val_array[i] != NULL; ++i) {
- 	  val = val_array[i];
--	  DPRINTF(3, "val[%d]=%s", i, val);
-+	  sudo_debug_printf(3, "val[%d]=%s", i, val);
- 
- 	  if (strcmp(val, "ALL") == 0 || group_matches(val, runas_gr))
- 	       ret = true;
- 
--	  DPRINTF(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
-+	  sudo_debug_printf(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
-      }
- 
-      sss_sudo_free_values(val_array);
-@@ -450,17 +445,17 @@ static int sudo_sss_check_host(struct ss
-     case 0:
- 	 break;
-     case ENOENT:
--	 DPRINTF(2, "No result.");
-+	 sudo_debug_printf(2, "No result.");
- 	 debug_return_int(false);
-     default:
--	 DPRINTF(2, "sss_sudo_get_values(sudoHost): != 0");
-+	 sudo_debug_printf(2, "sss_sudo_get_values(sudoHost): != 0");
- 	 debug_return_int(ret);
-     }
- 
-     /* walk through values */
-     for (i = 0; val_array[i] != NULL; ++i) {
- 	 val = val_array[i];
--	 DPRINTF(3, "val[%d]=%s", i, val);
-+	 sudo_debug_printf(3, "val[%d]=%s", i, val);
- 
- 	 /* match any or address or netgroup or hostname */
- 	 if (!strcmp(val, "ALL") || addr_matches(val) ||
-@@ -468,7 +463,7 @@ static int sudo_sss_check_host(struct ss
- 	     hostname_matches(user_shost, user_host, val))
- 	      ret = true;
- 
--	 DPRINTF(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
-+	 sudo_debug_printf(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
-     }
- 
-     sss_sudo_free_values(val_array);
-@@ -497,8 +492,8 @@ static struct sss_sudo_result *sudo_sss_
-      if (sudo_sss_checkpw(nss, pw) != 0)
- 	  debug_return_ptr(NULL);
- 
--     DPRINTF(1, "  username=%s", handle->pw->pw_name);
--     DPRINTF(1, "domainname=%s", handle->domainname);
-+     sudo_debug_printf(1, "  username=%s", handle->pw->pw_name);
-+     sudo_debug_printf(1, "domainname=%s", handle->domainname);
- 
-      u_sss_result = f_sss_result = NULL;
- 
-@@ -510,24 +505,24 @@ static struct sss_sudo_result *sudo_sss_
- 	  case 0:
- 	       if (u_sss_result != NULL) {
- 		    if (state != NULL) {
--			 DPRINTF(3, "state |= USERMATCH");
-+			 sudo_debug_printf(3, "state |= USERMATCH");
- 			 *state |= _SUDO_SSS_STATE_USERMATCH;
- 		    }
--		    DPRINTF(2, "Received %u rule(s)", u_sss_result->num_rules);
-+		    sudo_debug_printf(2, "Received %u rule(s)", u_sss_result->num_rules);
- 	       } else {
--		    DPRINTF(2, "Internal error: u_sss_result == NULL && sss_error == 0");
-+		    sudo_debug_printf(2, "Internal error: u_sss_result == NULL && sss_error == 0");
- 		    debug_return_ptr(NULL);
- 	       }
- 	       break;
- 	  case ENOENT:
--	       DPRINTF(2, "No result.");
-+	       sudo_debug_printf(2, "No result.");
- 	  default:
--	       DPRINTF(2, "sss_error=%u\n", sss_error);
-+	       sudo_debug_printf(2, "sss_error=%u\n", sss_error);
- 	       debug_return_ptr(NULL);
- 	  }
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
-+	  sudo_debug_printf(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
- 	  debug_return_ptr(NULL);
-      }
- 
-@@ -537,11 +532,11 @@ static struct sss_sudo_result *sudo_sss_
-      if (f_sss_result != NULL)
- 	  if (f_sss_result->num_rules > 0)
- 	       if (state != NULL) {
--		    DPRINTF(3, "state |= HOSTMATCH");
-+		    sudo_debug_printf(3, "state |= HOSTMATCH");
- 		    *state |= _SUDO_SSS_STATE_HOSTMATCH;
- 	       }
- 
--     DPRINTF(3, "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)",
-+     sudo_debug_printf(3, "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)",
- 	     u_sss_result, u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
- 
-      sss_sudo_free_result(u_sss_result);
-@@ -568,17 +563,17 @@ sudo_sss_check_bool(struct sss_sudo_rule
-      case 0:
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  debug_return_int(ret);
-      default:
--	  DPRINTF(2, "sss_sudo_get_values: != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values: != 0");
- 	  debug_return_int(ret);
-      }
- 
-      /* walk through options */
-      for (i = 0; val_array[i] != NULL; ++i) {
- 	  var = val_array[i];
--	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", var);
-+	  sudo_debug_printf(2, "sssd/ldap sudoOption: '%s'", var);
- 
- 	  if ((ch = *var) == '!')
- 	       var++;
-@@ -611,24 +606,24 @@ sudo_sss_check_command(struct sss_sudo_r
-      case 0:
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  debug_return_int(ret);
-      default:
--	  DPRINTF(2, "sss_sudo_get_values: != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values: != 0");
- 	  debug_return_int(ret);
-      }
- 
-      for (i = 0; val_array[i] != NULL && ret != false; ++i) {
- 	  val = val_array[i];
- 
--	  DPRINTF(3, "val[%d]=%s", i, val);
-+	  sudo_debug_printf(3, "val[%d]=%s", i, val);
- 
- 	  /* Match against ALL ? */
- 	  if (!strcmp(val, "ALL")) {
- 	       ret = true;
- 	       if (setenv_implied != NULL)
- 		    *setenv_implied = true;
--	       DPRINTF(2, "sssd/ldap sudoCommand '%s' ... MATCH!", val);
-+	       sudo_debug_printf(2, "sssd/ldap sudoCommand '%s' ... MATCH!", val);
- 	       continue;
- 	  }
- 
-@@ -655,7 +650,7 @@ sudo_sss_check_command(struct sss_sudo_r
- 	       ret = foundbang ? false : true;
- 	  }
- 
--	  DPRINTF(2, "sssd/ldap sudoCommand '%s' ... %s", val, ret == true ? "MATCH!" : "not");
-+	  sudo_debug_printf(2, "sssd/ldap sudoCommand '%s' ... %s", val, ret == true ? "MATCH!" : "not");
- 	  efree(allowed_cmnd);	/* cleanup */
-      }
- 
-@@ -680,16 +675,16 @@ sudo_sss_parse_options(struct sss_sudo_r
-      case 0:
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  debug_return;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
- 	  debug_return;
-      }
- 
-      /* walk through options */
-      for (i = 0; val_array[i] != NULL; i++) {
--	  DPRINTF(2, "sssd/ldap sudoOption: '%s'", val_array[i]);
-+	  sudo_debug_printf(2, "sssd/ldap sudoOption: '%s'", val_array[i]);
- 	  v = estrdup(val_array[i]);
- 
- 	  /* check for equals sign past first char */
-@@ -741,7 +736,7 @@ static int sudo_sss_lookup(struct sudo_n
- 	enum def_tuple pwcheck =
- 	    (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
- 
--	DPRINTF(2, "perform search for pwflag %d", pwflag);
-+	sudo_debug_printf(2, "perform search for pwflag %d", pwflag);
- 	if (sss_result != NULL) {
- 	     for (i = 0; i < sss_result->num_rules; i++) {
- 		  rule = sss_result->rules + i;
-@@ -782,7 +777,7 @@ static int sudo_sss_lookup(struct sudo_n
- 	goto done;
-     }
- 
--    DPRINTF(1, "searching SSSD/LDAP for sudoers entries");
-+    sudo_debug_printf(1, "searching SSSD/LDAP for sudoers entries");
- 
-     setenv_implied = false;
-     if (sss_result != NULL) {
-@@ -793,9 +788,9 @@ static int sudo_sss_lookup(struct sudo_n
- 	      rc = sudo_sss_check_command(rule, &setenv_implied);
- 	      if (rc != UNSPEC) {
- 		   /* We have a match. */
--		   DPRINTF(1, "Command %sallowed", rc == true ? "" : "NOT ");
-+		   sudo_debug_printf(1, "Command %sallowed", rc == true ? "" : "NOT ");
- 		   if (rc == true) {
--			DPRINTF(3, "SSSD rule: %p", rule);
-+			sudo_debug_printf(3, "SSSD rule: %p", rule);
- 			/* Apply entry-specific options. */
- 			if (setenv_implied)
- 			     def_setenv = true;
-@@ -818,7 +813,7 @@ static int sudo_sss_lookup(struct sudo_n
- 	 }
-     }
- done:
--    DPRINTF(1, "Done with LDAP searches");
-+    sudo_debug_printf(1, "Done with LDAP searches");
- 
-     if (!ISSET(ret, VALIDATE_OK)) {
- 	/* No matching entries. */
-@@ -831,7 +826,7 @@ done:
-     if (state & _SUDO_SSS_STATE_HOSTMATCH)
- 	 CLR(ret, FLAG_NO_HOST);
- 
--    DPRINTF(3, "sudo_sss_lookup(%d)=0x%02x", pwflag, ret);
-+    sudo_debug_printf(3, "sudo_sss_lookup(%d)=0x%02x", pwflag, ret);
- 
-     debug_return_int(ret);
- }
-@@ -854,7 +849,7 @@ static int sudo_sss_display_cmnd(struct 
-       * The sudo_sss_result_get() function returns all nodes that match
-       * the user and the host.
-       */
--     DPRINTF(1, "sssd/ldap search for command list");
-+     sudo_debug_printf(1, "sssd/ldap search for command list");
-      sss_result = sudo_sss_result_get(nss, pw, NULL);
- 
-      if (sss_result == NULL)
-@@ -902,7 +897,7 @@ static int sudo_sss_display_defaults(str
- 				     &sss_error, &handle->domainname,
- 				     &sss_result) != 0)
-      {
--	  DPRINTF(2, "sss_sudo_send_recv_defaults: !=0, sss_error=%u", sss_error);
-+	  sudo_debug_printf(2, "sss_sudo_send_recv_defaults: !=0, sss_error=%u", sss_error);
- 	  goto done;
-      }
- 
-@@ -916,10 +911,10 @@ static int sudo_sss_display_defaults(str
- 	  case 0:
- 	       break;
- 	  case ENOENT:
--	       DPRINTF(2, "No result.");
-+	       sudo_debug_printf(2, "No result.");
- 	       continue;
- 	  default:
--	       DPRINTF(2, "sss_sudo_get_values: != 0");
-+	       sudo_debug_printf(2, "sss_sudo_get_values: != 0");
- 	       continue;
- 	  }
- 
-@@ -976,16 +971,16 @@ static int sudo_sss_display_entry_long(s
- 	       sss_sudo_free_values(val_array);
- 	       break;
- 	  case ENOENT:
--	       DPRINTF(2, "No result.");
-+	       sudo_debug_printf(2, "No result.");
- 	       lbuf_append(lbuf, "%s", def_runas_default);
- 	       break;
- 	  default:
--	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
- 	       debug_return_int(count);
- 	  }
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
- 	  debug_return_int(count);
-      }
-      lbuf_append(lbuf, "\n");
-@@ -1001,10 +996,10 @@ static int sudo_sss_display_entry_long(s
- 	  lbuf_append(lbuf, "\n");
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
- 	  debug_return_int(count);
-      }
- 
-@@ -1019,10 +1014,10 @@ static int sudo_sss_display_entry_long(s
- 	  lbuf_append(lbuf, "\n");
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
- 	  debug_return_int(count);
-      }
- 
-@@ -1037,10 +1032,10 @@ static int sudo_sss_display_entry_long(s
- 	  sss_sudo_free_values(val_array);
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
- 	  debug_return_int(count);
-      }
- 
-@@ -1064,7 +1059,7 @@ static int sudo_sss_display_entry_short(
- 	  sss_sudo_free_values(val_array);
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result. Trying old style (sudoRunAs).");
-+	  sudo_debug_printf(2, "No result. Trying old style (sudoRunAs).");
- 	  /* try old style */
- 	  switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
- 	  {
-@@ -1074,16 +1069,16 @@ static int sudo_sss_display_entry_short(
- 	       sss_sudo_free_values(val_array);
- 	       break;
- 	  case ENOENT:
--	       DPRINTF(2, "No result.");
-+	       sudo_debug_printf(2, "No result.");
- 	       lbuf_append(lbuf, "%s", def_runas_default);
- 	       break;
- 	  default:
--	       DPRINTF(2, "sss_sudo_get_values(sudoRunAs): != 0");
-+	       sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
- 	       debug_return_int(count);
- 	  }
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
- 	  debug_return_int(count);
-      }
- 
-@@ -1097,10 +1092,10 @@ static int sudo_sss_display_entry_short(
- 	  sss_sudo_free_values(val_array);
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
- 	  debug_return_int(count);
-      }
- 
-@@ -1128,10 +1123,10 @@ static int sudo_sss_display_entry_short(
- 	  sss_sudo_free_values(val_array);
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoOption): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
- 	  debug_return_int(count);
-      }
- 
-@@ -1145,10 +1140,10 @@ static int sudo_sss_display_entry_short(
- 	  sss_sudo_free_values(val_array);
- 	  break;
-      case ENOENT:
--	  DPRINTF(2, "No result.");
-+	  sudo_debug_printf(2, "No result.");
- 	  break;
-      default:
--	  DPRINTF(2, "sss_sudo_get_values(sudoCommand): != 0");
-+	  sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
- 	  debug_return_int(count);
-      }
-      lbuf_append(lbuf, "\n");
-@@ -1171,7 +1166,7 @@ static int sudo_sss_display_privs(struct
-      if (sudo_sss_checkpw(nss, pw) != 0)
- 	  debug_return_int(-1);
- 
--     DPRINTF(2, "sssd/ldap search for command list");
-+     sudo_debug_printf(2, "sssd/ldap search for command list");
- 
-      sss_result = sudo_sss_result_get(nss, pw, NULL);
- 
diff --git a/sudo-1.8.6-pipelist.patch b/sudo-1.8.6-pipelist.patch
new file mode 100644
index 0000000..87c5337
--- /dev/null
+++ b/sudo-1.8.6-pipelist.patch
@@ -0,0 +1,31 @@
+diff -up sudo-1.8.6/plugins/sudoers/sudo_nss.c.pipelist sudo-1.8.6/plugins/sudoers/sudo_nss.c
+--- sudo-1.8.6/plugins/sudoers/sudo_nss.c.pipelist	2012-09-06 14:27:34.467290727 +0200
++++ sudo-1.8.6/plugins/sudoers/sudo_nss.c	2012-09-06 14:27:39.877315395 +0200
+@@ -18,6 +18,8 @@
+ 
+ #include <sys/types.h>
+ #include <sys/param.h>
++#include <sys/stat.h>
++
+ #include <stdio.h>
+ #ifdef STDC_HEADERS
+ # include <stdlib.h>
+@@ -257,11 +259,15 @@ display_privs(struct sudo_nss_list *snl,
+ {
+     struct sudo_nss *nss;
+     struct lbuf defs, privs;
+-    int count, olen;
++    struct stat sb;
++    int cols, count, olen;
+     debug_decl(display_privs, SUDO_DEBUG_NSS)
+ 
+-    lbuf_init(&defs, output, 4, NULL, sudo_user.cols);
+-    lbuf_init(&privs, output, 4, NULL, sudo_user.cols);
++    cols = sudo_user.cols;
++    if (fstat(STDOUT_FILENO, &sb) == 0 && S_ISFIFO(sb.st_mode))
++	cols = 0;
++    lbuf_init(&defs, output, 4, NULL, cols);
++    lbuf_init(&privs, output, 4, NULL, cols);
+ 
+     /* Display defaults from all sources. */
+     lbuf_append(&defs, _("Matching Defaults entries for %s on this host:\n"),
diff --git a/sudo.spec b/sudo.spec
index 3e5df6b..5a7f3a3 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.5
-Release: 4%{?dist}
+Version: 1.8.6
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -25,23 +25,8 @@ BuildRequires: gettext
 Patch1: sudo-1.6.7p5-strip.patch
 # configure.in fix
 Patch2: sudo-1.7.2p1-envdebug.patch
-# add m4/ to paths in aclocal.m4
-Patch3: sudo-1.7.4p3-m4path.patch
 # disable word wrapping if the ouput is piped
-Patch4: sudo-1.8.5-pipelist.patch
-# SSSD support
-Patch5: sudo-1.8.5-sssd-support.patch
-# Add SSSD debug subsystem
-Patch6: sudo-1.8.5-add-sssd-debug-subsystem.patch
-# Use sudo_debug_printf instead of DPRINTF in sssd.c
-Patch7: sudo-1.8.5-sssd-use-sudo_debug_printf.patch
-# Handle sss_ret correctly in sssd.c to avoid segfault
-# when user is not found in sssd
-Patch8: sudo-1.8.5-sssd-handle-sss_ret-correctly.patch
-# dlopen libsss_sudo
-Patch9: sudo-1.8.5-sssd-dlopen-lib.patch
-# remove source when nss->open() fails
-Patch10: sudo-1.8.5-remove-source-when-open-failed.patch
+Patch3: sudo-1.8.6-pipelist.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -68,17 +53,10 @@ plugins that use %{name}.
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .envdebug
-%patch3 -p1 -b .m4path
-%patch4 -p1 -b .pipelist
-%patch5 -p1 -b .sssd-support
-%patch6 -p1
-%patch7 -p1
-%patch8 -p1
-%patch9 -p1
-%patch10 -p1
+%patch3 -p1 -b .pipelist
 
 %build
-autoreconf -fv --install
+autoreconf -I m4 -fv --install
 
 %ifarch s390 s390x sparc64
 F_PIE=-fPIE
@@ -185,6 +163,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Thu Sep  6 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6-1
+- update to 1.8.6
+
 * Thu Jul 26 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-4
 - added patches that fix & improve SSSD support (thanks to pbrezina@redhat.com)
 - re-enabled SSSD support

From a9963cd1b9f925ab99fd2e81bbbdc70e9ad33358 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 25 Sep 2012 12:37:55 +0200
Subject: [PATCH 073/199] update to 1.8.6p3

- drop -pipelist patch (fixed in upstream)
---
 .gitignore                |  1 +
 sources                   |  2 +-
 sudo-1.8.6-pipelist.patch | 31 -------------------------------
 sudo.spec                 |  9 +++++----
 4 files changed, 7 insertions(+), 36 deletions(-)
 delete mode 100644 sudo-1.8.6-pipelist.patch

diff --git a/.gitignore b/.gitignore
index fd1f95d..82092b4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.3p1.tar.gz
 /sudo-1.8.5.tar.gz
 /sudo-1.8.6.tar.gz
+/sudo-1.8.6p3.tar.gz
diff --git a/sources b/sources
index 0f34a68..10ec75c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-3d400e84c3a1e2164171db8d54b11aab  sudo-1.8.6.tar.gz
 56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers
+a7b5c39a904721956eccddd30689250f  sudo-1.8.6p3.tar.gz
diff --git a/sudo-1.8.6-pipelist.patch b/sudo-1.8.6-pipelist.patch
deleted file mode 100644
index 87c5337..0000000
--- a/sudo-1.8.6-pipelist.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff -up sudo-1.8.6/plugins/sudoers/sudo_nss.c.pipelist sudo-1.8.6/plugins/sudoers/sudo_nss.c
---- sudo-1.8.6/plugins/sudoers/sudo_nss.c.pipelist	2012-09-06 14:27:34.467290727 +0200
-+++ sudo-1.8.6/plugins/sudoers/sudo_nss.c	2012-09-06 14:27:39.877315395 +0200
-@@ -18,6 +18,8 @@
- 
- #include <sys/types.h>
- #include <sys/param.h>
-+#include <sys/stat.h>
-+
- #include <stdio.h>
- #ifdef STDC_HEADERS
- # include <stdlib.h>
-@@ -257,11 +259,15 @@ display_privs(struct sudo_nss_list *snl,
- {
-     struct sudo_nss *nss;
-     struct lbuf defs, privs;
--    int count, olen;
-+    struct stat sb;
-+    int cols, count, olen;
-     debug_decl(display_privs, SUDO_DEBUG_NSS)
- 
--    lbuf_init(&defs, output, 4, NULL, sudo_user.cols);
--    lbuf_init(&privs, output, 4, NULL, sudo_user.cols);
-+    cols = sudo_user.cols;
-+    if (fstat(STDOUT_FILENO, &sb) == 0 && S_ISFIFO(sb.st_mode))
-+	cols = 0;
-+    lbuf_init(&defs, output, 4, NULL, cols);
-+    lbuf_init(&privs, output, 4, NULL, cols);
- 
-     /* Display defaults from all sources. */
-     lbuf_append(&defs, _("Matching Defaults entries for %s on this host:\n"),
diff --git a/sudo.spec b/sudo.spec
index 5a7f3a3..61ff912 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.6
+Version: 1.8.6p3
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
@@ -25,8 +25,6 @@ BuildRequires: gettext
 Patch1: sudo-1.6.7p5-strip.patch
 # configure.in fix
 Patch2: sudo-1.7.2p1-envdebug.patch
-# disable word wrapping if the ouput is piped
-Patch3: sudo-1.8.6-pipelist.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -53,7 +51,6 @@ plugins that use %{name}.
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .envdebug
-%patch3 -p1 -b .pipelist
 
 %build
 autoreconf -I m4 -fv --install
@@ -163,6 +160,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Tue Sep 25 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-1
+- update to 1.8.6p3
+- drop -pipelist patch (fixed in upstream)
+
 * Thu Sep  6 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6-1
 - update to 1.8.6
 

From bbce9a9922ab153094871f4f4f7d84a60d3c4768 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Mon, 12 Nov 2012 13:16:34 +0100
Subject: [PATCH 074/199] Fixed upstream regression and removed arch specific
 files

 - added upstream patch for a regression
 - don't include arch specific files in the -devel subpackage
 - ship only one sample plugin in the -devel subpackage
---
 sudo-1.8.6p3-noauthwarn-regression.patch | 77 ++++++++++++++++++++++++
 sudo.spec                                | 14 ++++-
 2 files changed, 89 insertions(+), 2 deletions(-)
 create mode 100644 sudo-1.8.6p3-noauthwarn-regression.patch

diff --git a/sudo-1.8.6p3-noauthwarn-regression.patch b/sudo-1.8.6p3-noauthwarn-regression.patch
new file mode 100644
index 0000000..da8525a
--- /dev/null
+++ b/sudo-1.8.6p3-noauthwarn-regression.patch
@@ -0,0 +1,77 @@
+diff -up sudo-1.8.6p3/plugins/sudoers/audit.c.orig sudo-1.8.6p3/plugins/sudoers/audit.c
+--- sudo-1.8.6p3/plugins/sudoers/audit.c.orig	2012-11-07 13:04:55.424637797 +0100
++++ sudo-1.8.6p3/plugins/sudoers/audit.c	2012-11-07 13:06:53.705032954 +0100
+@@ -26,6 +26,11 @@
+ #  include <stdlib.h>
+ # endif
+ #endif /* STDC_HEADERS */
++#ifdef HAVE_STDBOOL_H
++# include <stdbool.h>
++#else
++# include "compat/stdbool.h"
++#endif /* HAVE_STDBOOL_H */
+ #include <stdarg.h>
+ 
+ #include "missing.h"
+diff -up sudo-1.8.6p3/plugins/sudoers/logging.c.orig sudo-1.8.6p3/plugins/sudoers/logging.c
+--- sudo-1.8.6p3/plugins/sudoers/logging.c.orig	2012-11-07 13:04:55.424637797 +0100
++++ sudo-1.8.6p3/plugins/sudoers/logging.c	2012-11-07 13:06:53.705032954 +0100
+@@ -247,14 +247,20 @@ do_logfile(char *msg)
+ }
+ 
+ /*
+- * Log and mail the denial message, optionally informing the user.
++ * Log, audit and mail the denial message, optionally informing the user.
+  */
+-static void
++void
+ log_denial(int status, bool inform_user)
+ {
+     char *logline, *message;
+     debug_decl(log_denial, SUDO_DEBUG_LOGGING)
+ 
++    /* Handle auditing first. */
++    if (ISSET(status, FLAG_NO_USER | FLAG_NO_HOST))
++	audit_failure(NewArgv, _("No user or host"));
++    else
++	audit_failure(NewArgv, _("validation failure"));
++
+     /* Set error message. */
+     if (ISSET(status, FLAG_NO_USER))
+ 	message = _("user NOT in sudoers");
+@@ -312,12 +318,6 @@ log_failure(int status, int flags)
+     debug_decl(log_failure, SUDO_DEBUG_LOGGING)
+     bool inform_user = true;
+ 
+-    /* Handle auditing first. */
+-    if (ISSET(status, FLAG_NO_USER | FLAG_NO_HOST))
+-	audit_failure(NewArgv, _("No user or host"));
+-    else
+-	audit_failure(NewArgv, _("validation failure"));
+-
+     /* The user doesn't always get to see the log message (path info). */
+     if (!ISSET(status, FLAG_NO_USER | FLAG_NO_HOST) && def_path_info &&
+ 	(flags == NOT_FOUND_DOT || flags == NOT_FOUND))
+diff -up sudo-1.8.6p3/plugins/sudoers/logging.h.orig sudo-1.8.6p3/plugins/sudoers/logging.h
+--- sudo-1.8.6p3/plugins/sudoers/logging.h.orig	2012-11-07 13:04:55.425637802 +0100
++++ sudo-1.8.6p3/plugins/sudoers/logging.h	2012-11-07 13:06:53.706032965 +0100
+@@ -56,6 +56,7 @@ void audit_success(char *exec_args[]);
+ void audit_failure(char *exec_args[], char const *const fmt, ...);
+ void log_allowed(int status);
+ void log_auth_failure(int status, int tries);
++void log_denial(int status, bool inform_user);
+ void log_failure(int status, int flags);
+ void log_error(int flags, const char *fmt, ...) __printflike(2, 3);
+ void log_fatal(int flags, const char *fmt, ...) __printflike(2, 3) __attribute__((__noreturn__));
+diff -up sudo-1.8.6p3/plugins/sudoers/sudoers.c.orig sudo-1.8.6p3/plugins/sudoers/sudoers.c
+--- sudo-1.8.6p3/plugins/sudoers/sudoers.c.orig	2012-11-07 13:04:55.425637802 +0100
++++ sudo-1.8.6p3/plugins/sudoers/sudoers.c	2012-11-07 13:06:53.706032965 +0100
+@@ -466,7 +466,7 @@ sudoers_policy_main(int argc, char * con
+     rval = check_user(validated, sudo_mode);
+     if (rval != true) {
+ 	if (!ISSET(validated, VALIDATE_OK))
+-	    log_failure(validated, cmnd_status);
++	    log_denial(validated, false);
+ 	goto done;
+     }
+ 
diff --git a/sudo.spec b/sudo.spec
index 61ff912..6c6cd1d 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.6p3
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -25,6 +25,10 @@ BuildRequires: gettext
 Patch1: sudo-1.6.7p5-strip.patch
 # configure.in fix
 Patch2: sudo-1.7.2p1-envdebug.patch
+# Do not inform the user that the command was not permitted by the policy
+# if they do not successfully authenticate. This is a regression introduced
+# in sudo 1.8.6.
+Patch3: sudo-1.8.6p3-noauthwarn-regression.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -51,6 +55,7 @@ plugins that use %{name}.
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .envdebug
+%patch3 -p1 -b .noauthwarn-regression
 
 %build
 autoreconf -I m4 -fv --install
@@ -155,11 +160,16 @@ rm -rf $RPM_BUILD_ROOT
 
 %files devel
 %defattr(-,root,root,-)
-%doc plugins/{sample,sample_group}
+%doc plugins/sample/sample_plugin.c
 %{_includedir}/sudo_plugin.h
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Mon Nov 12 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
+- added upstream patch for a regression
+- don't include arch specific files in the -devel subpackage
+- ship only one sample plugin in the -devel subpackage
+
 * Tue Sep 25 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-1
 - update to 1.8.6p3
 - drop -pipelist patch (fixed in upstream)

From d201380f8e96fe5d3ef09837252253015452c886 Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Thu, 14 Feb 2013 18:45:08 -0600
Subject: [PATCH 075/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 6c6cd1d..200c41e 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.6p3
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -165,6 +165,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Fri Feb 15 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.6p3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
 * Mon Nov 12 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
 - added upstream patch for a regression
 - don't include arch specific files in the -devel subpackage

From 392812324b12038a6404ea2d389632a2bfdaf337 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 28 Feb 2013 13:19:12 +0100
Subject: [PATCH 076/199] update to 1.8.6p7

- fixes CVE-2013-1775 and CVE-2013-1776
- fixed several packaging issues (thanks to ville.skytta@iki.fi)
  - build with system zlib.
  - let rpmbuild strip libexecdir/*.so.
  - own the %{_docdir}/sudo-* dir.
  - fix some rpmlint warnings (spaces vs tabs, unescaped macros).
  - fix bogus %changelog dates.
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 57 +++++++++++++++++++++++++++++++-----------------------
 3 files changed, 35 insertions(+), 25 deletions(-)

diff --git a/.gitignore b/.gitignore
index 82092b4..44949ff 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.5.tar.gz
 /sudo-1.8.6.tar.gz
 /sudo-1.8.6p3.tar.gz
+/sudo-1.8.6p7.tar.gz
diff --git a/sources b/sources
index 10ec75c..95bc198 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers
-a7b5c39a904721956eccddd30689250f  sudo-1.8.6p3.tar.gz
+126abfa2e841139e774d4c67d80f0e5b  sudo-1.8.6p7.tar.gz
diff --git a/sudo.spec b/sudo.spec
index 200c41e..871b86c 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.6p3
-Release: 3%{?dist}
+Version: 1.8.6p7
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -20,15 +20,12 @@ BuildRequires: audit-libs-devel libcap-devel
 BuildRequires: libselinux-devel
 BuildRequires: sendmail
 BuildRequires: gettext
+BuildRequires: zlib-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
 # configure.in fix
 Patch2: sudo-1.7.2p1-envdebug.patch
-# Do not inform the user that the command was not permitted by the policy
-# if they do not successfully authenticate. This is a regression introduced
-# in sudo 1.8.6.
-Patch3: sudo-1.8.6p3-noauthwarn-regression.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -55,7 +52,6 @@ plugins that use %{name}.
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .envdebug
-%patch3 -p1 -b .noauthwarn-regression
 
 %build
 autoreconf -I m4 -fv --install
@@ -72,22 +68,22 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --prefix=%{_prefix} \
         --sbindir=%{_sbindir} \
         --libdir=%{_libdir} \
-	--docdir=%{_datadir}/doc/%{name}-%{version} \
+        --docdir=%{_datadir}/doc/%{name}-%{version} \
         --with-logging=syslog \
         --with-logfac=authpriv \
         --with-pam \
-	--with-pam-login \
+        --with-pam-login \
         --with-editor=/bin/vi \
         --with-env-editor \
         --with-ignore-dot \
         --with-tty-tickets \
         --with-ldap \
-	--with-selinux \
-	--with-passprompt="[sudo] password for %p: " \
-	--with-linux-audit \
-	--with-sssd
-#	--without-kerb5 \
-#	--without-kerb4
+        --with-selinux \
+        --with-passprompt="[sudo] password for %p: " \
+        --with-linux-audit \
+        --with-sssd
+#       --without-kerb5 \
+#       --without-kerb4
 make
 
 %install
@@ -99,6 +95,8 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
 
+chmod +x $RPM_BUILD_ROOT%{_libexecdir}/*.so # for stripping, reset in %%files
+
 # Remove execute permission on this script so we don't pull in perl deps
 chmod -x $RPM_BUILD_ROOT%{_docdir}/sudo-*/sudoers2ldif
 
@@ -110,7 +108,7 @@ rm sudo.lang sudoers.lang
 
 mkdir -p $RPM_BUILD_ROOT/etc/pam.d
 cat > $RPM_BUILD_ROOT/etc/pam.d/sudo << EOF
-#%PAM-1.0
+#%%PAM-1.0
 auth       include      system-auth
 account    include      system-auth
 password   include      system-auth
@@ -119,7 +117,7 @@ session    required     pam_limits.so
 EOF
 
 cat > $RPM_BUILD_ROOT/etc/pam.d/sudo-i << EOF
-#%PAM-1.0
+#%%PAM-1.0
 auth       include      sudo
 account    include      sudo
 password   include      sudo
@@ -128,7 +126,7 @@ session    required     pam_limits.so
 EOF
 
 
-%clean 
+%clean
 rm -rf $RPM_BUILD_ROOT
 
 %files -f sudo_all.lang
@@ -143,14 +141,15 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0111,root,root) %{_bindir}/sudoreplay
 %attr(0755,root,root) %{_sbindir}/visudo
 %attr(0755,root,root) %{_libexecdir}/sesh
-%{_libexecdir}/sudo_noexec.*
-%{_libexecdir}/sudoers.*
+%attr(0644,root,root) %{_libexecdir}/sudo_noexec.so
+%attr(0644,root,root) %{_libexecdir}/sudoers.so
 %{_mandir}/man5/sudoers.5*
 %{_mandir}/man5/sudoers.ldap.5*
 %{_mandir}/man8/sudo.8*
 %{_mandir}/man8/sudoedit.8*
 %{_mandir}/man8/sudoreplay.8*
 %{_mandir}/man8/visudo.8*
+%dir %{_docdir}/sudo-%{version}
 %{_docdir}/sudo-%{version}/*
 
 
@@ -165,6 +164,16 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Thu Feb 28 2013 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-1
+- update to 1.8.6p7
+- fixes CVE-2013-1775 and CVE-2013-1776
+- fixed several packaging issues (thanks to ville.skytta@iki.fi)
+  - build with system zlib.
+  - let rpmbuild strip libexecdir/*.so.
+  - own the %%{_docdir}/sudo-* dir.
+  - fix some rpmlint warnings (spaces vs tabs, unescaped macros).
+  - fix bogus %%changelog dates.
+
 * Fri Feb 15 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.6p3-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
 
@@ -211,7 +220,7 @@ rm -rf $RPM_BUILD_ROOT
 * Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.3p1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
 
-* Tue Nov 10 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-1
+* Thu Nov 10 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-1
 - update to 1.8.3p1
 - disable output word wrapping if the output is piped 
 
@@ -344,7 +353,7 @@ rm -rf $RPM_BUILD_ROOT
 - upgrade to the latest upstream release
 - add selinux support
 
-* Mon Feb 02 2008 Dennis Gilmore <dennis@ausil.us> 1.6.9p4-6
+* Mon Feb 04 2008 Dennis Gilmore <dennis@ausil.us> 1.6.9p4-6
 - sparc64 needs to be in the -fPIE list with s390
 
 * Mon Jan 07 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-5
@@ -470,7 +479,7 @@ rm -rf $RPM_BUILD_ROOT
 * Thu Apr  1 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-25
 - fixed spec file: sesh in file section with selinux flag (#119682)
 
-* Thu Mar 30 2004 Colin Walters <walters@redhat.com> 1.6.7p5-24
+* Tue Mar 30 2004 Colin Walters <walters@redhat.com> 1.6.7p5-24
 - Enhance sesh.c to fork/exec children itself, to avoid
   having sudo reap all domains.
 - Only reinstall default signal handlers immediately before
@@ -632,7 +641,7 @@ rm -rf $RPM_BUILD_ROOT
 * Tue Oct 27 1998 Preston Brown <pbrown@redhat.com>
 - fixed so it doesn't find /usr/bin/vi first, but instead /bin/vi (always installed)
 
-* Fri Oct 08 1998 Michael Maher <mike@redhat.com>
+* Thu Oct 08 1998 Michael Maher <mike@redhat.com>
 - built package for 5.2 
 
 * Mon May 18 1998 Michael Maher <mike@redhat.com>

From d656fea4807885f0f76512efc650ead85a9b9331 Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Sun, 4 Aug 2013 10:56:56 -0500
Subject: [PATCH 077/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 871b86c..f12c88a 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.6p7
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -164,6 +164,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.6p7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
 * Thu Feb 28 2013 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-1
 - update to 1.8.6p7
 - fixes CVE-2013-1775 and CVE-2013-1776

From 42f0c7e7264a4e8ba2e6c9f41db71584c036376f Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 1 Oct 2013 00:05:52 +0200
Subject: [PATCH 078/199] Removed unused patches

---
 sudo-1.7.4p3-m4path.patch                | 17 ------
 sudo-1.8.6p3-noauthwarn-regression.patch | 77 ------------------------
 2 files changed, 94 deletions(-)
 delete mode 100644 sudo-1.7.4p3-m4path.patch
 delete mode 100644 sudo-1.8.6p3-noauthwarn-regression.patch

diff --git a/sudo-1.7.4p3-m4path.patch b/sudo-1.7.4p3-m4path.patch
deleted file mode 100644
index b1f8e1b..0000000
--- a/sudo-1.7.4p3-m4path.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff -up sudo-1.7.4p3/aclocal.m4.m4path sudo-1.7.4p3/aclocal.m4
---- sudo-1.7.4p3/aclocal.m4.m4path	2010-09-07 13:11:59.095198365 +0200
-+++ sudo-1.7.4p3/aclocal.m4	2010-09-07 13:12:25.718209211 +0200
-@@ -368,8 +368,8 @@ EOF
- dnl
- dnl Pull in libtool macros
- dnl
--m4_include([libtool.m4])
--m4_include([ltoptions.m4])
--m4_include([ltsugar.m4])
--m4_include([ltversion.m4])
--m4_include([lt~obsolete.m4])
-+m4_include([m4/libtool.m4])
-+m4_include([m4/ltoptions.m4])
-+m4_include([m4/ltsugar.m4])
-+m4_include([m4/ltversion.m4])
-+m4_include([m4/lt~obsolete.m4])
diff --git a/sudo-1.8.6p3-noauthwarn-regression.patch b/sudo-1.8.6p3-noauthwarn-regression.patch
deleted file mode 100644
index da8525a..0000000
--- a/sudo-1.8.6p3-noauthwarn-regression.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-diff -up sudo-1.8.6p3/plugins/sudoers/audit.c.orig sudo-1.8.6p3/plugins/sudoers/audit.c
---- sudo-1.8.6p3/plugins/sudoers/audit.c.orig	2012-11-07 13:04:55.424637797 +0100
-+++ sudo-1.8.6p3/plugins/sudoers/audit.c	2012-11-07 13:06:53.705032954 +0100
-@@ -26,6 +26,11 @@
- #  include <stdlib.h>
- # endif
- #endif /* STDC_HEADERS */
-+#ifdef HAVE_STDBOOL_H
-+# include <stdbool.h>
-+#else
-+# include "compat/stdbool.h"
-+#endif /* HAVE_STDBOOL_H */
- #include <stdarg.h>
- 
- #include "missing.h"
-diff -up sudo-1.8.6p3/plugins/sudoers/logging.c.orig sudo-1.8.6p3/plugins/sudoers/logging.c
---- sudo-1.8.6p3/plugins/sudoers/logging.c.orig	2012-11-07 13:04:55.424637797 +0100
-+++ sudo-1.8.6p3/plugins/sudoers/logging.c	2012-11-07 13:06:53.705032954 +0100
-@@ -247,14 +247,20 @@ do_logfile(char *msg)
- }
- 
- /*
-- * Log and mail the denial message, optionally informing the user.
-+ * Log, audit and mail the denial message, optionally informing the user.
-  */
--static void
-+void
- log_denial(int status, bool inform_user)
- {
-     char *logline, *message;
-     debug_decl(log_denial, SUDO_DEBUG_LOGGING)
- 
-+    /* Handle auditing first. */
-+    if (ISSET(status, FLAG_NO_USER | FLAG_NO_HOST))
-+	audit_failure(NewArgv, _("No user or host"));
-+    else
-+	audit_failure(NewArgv, _("validation failure"));
-+
-     /* Set error message. */
-     if (ISSET(status, FLAG_NO_USER))
- 	message = _("user NOT in sudoers");
-@@ -312,12 +318,6 @@ log_failure(int status, int flags)
-     debug_decl(log_failure, SUDO_DEBUG_LOGGING)
-     bool inform_user = true;
- 
--    /* Handle auditing first. */
--    if (ISSET(status, FLAG_NO_USER | FLAG_NO_HOST))
--	audit_failure(NewArgv, _("No user or host"));
--    else
--	audit_failure(NewArgv, _("validation failure"));
--
-     /* The user doesn't always get to see the log message (path info). */
-     if (!ISSET(status, FLAG_NO_USER | FLAG_NO_HOST) && def_path_info &&
- 	(flags == NOT_FOUND_DOT || flags == NOT_FOUND))
-diff -up sudo-1.8.6p3/plugins/sudoers/logging.h.orig sudo-1.8.6p3/plugins/sudoers/logging.h
---- sudo-1.8.6p3/plugins/sudoers/logging.h.orig	2012-11-07 13:04:55.425637802 +0100
-+++ sudo-1.8.6p3/plugins/sudoers/logging.h	2012-11-07 13:06:53.706032965 +0100
-@@ -56,6 +56,7 @@ void audit_success(char *exec_args[]);
- void audit_failure(char *exec_args[], char const *const fmt, ...);
- void log_allowed(int status);
- void log_auth_failure(int status, int tries);
-+void log_denial(int status, bool inform_user);
- void log_failure(int status, int flags);
- void log_error(int flags, const char *fmt, ...) __printflike(2, 3);
- void log_fatal(int flags, const char *fmt, ...) __printflike(2, 3) __attribute__((__noreturn__));
-diff -up sudo-1.8.6p3/plugins/sudoers/sudoers.c.orig sudo-1.8.6p3/plugins/sudoers/sudoers.c
---- sudo-1.8.6p3/plugins/sudoers/sudoers.c.orig	2012-11-07 13:04:55.425637802 +0100
-+++ sudo-1.8.6p3/plugins/sudoers/sudoers.c	2012-11-07 13:06:53.706032965 +0100
-@@ -466,7 +466,7 @@ sudoers_policy_main(int argc, char * con
-     rval = check_user(validated, sudo_mode);
-     if (rval != true) {
- 	if (!ISSET(validated, VALIDATE_OK))
--	    log_failure(validated, cmnd_status);
-+	    log_denial(validated, false);
- 	goto done;
-     }
- 

From 8729726fc17c029678991ffe5f8dc339a5740fcf Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 1 Oct 2013 00:09:16 +0200
Subject: [PATCH 079/199] update to 1.8.8

- major changes & fixes:
  - LDAP SASL support now works properly with Kerberos
  - root may no longer change its SELinux role without entering a password
  - user messages are now always displayed in the user's locale, even when
    the same message is being logged or mailed in a different locale.
  - log files created by sudo now explicitly have the group set to group
    ID 0 rather than relying on BSD group semantics
  - sudo now stores its libexec files in a sudo subdirectory instead of in
    libexec itself
  - system_group and group_file sudoers group provider plugins are now
    installed by default
  - the paths to ldap.conf and ldap.secret may now be specified as arguments
    to the sudoers plugin in the sudo.conf file
  - ...and many new features and settings. See the upstream ChangeLog for the
    full list.
- several sssd support fixes
- added patch to make uid/gid specification parsing more strict (don't accept
  an invalid number as uid/gid)
- use the _pkgdocdir macro
  (see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs)
- fixed several bugs found by the clang static analyzer
- added %post dependency on chmod
---
 .gitignore                    |   1 +
 sources                       |   2 +-
 sudo-1.8.8-clangbugs.patch    |  60 +++++++++++++++++
 sudo-1.8.8-sssdfixes.patch    | 119 ++++++++++++++++++++++++++++++++++
 sudo-1.8.8-strictuidgid.patch |  53 +++++++++++++++
 sudo.spec                     |  58 ++++++++++++++---
 6 files changed, 282 insertions(+), 11 deletions(-)
 create mode 100644 sudo-1.8.8-clangbugs.patch
 create mode 100644 sudo-1.8.8-sssdfixes.patch
 create mode 100644 sudo-1.8.8-strictuidgid.patch

diff --git a/.gitignore b/.gitignore
index 44949ff..420d45e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.6.tar.gz
 /sudo-1.8.6p3.tar.gz
 /sudo-1.8.6p7.tar.gz
+/sudo-1.8.8.tar.gz
diff --git a/sources b/sources
index 95bc198..97b27b4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers
-126abfa2e841139e774d4c67d80f0e5b  sudo-1.8.6p7.tar.gz
+fc4f074090afd56d9ff4ff4e97321971  sudo-1.8.8.tar.gz
diff --git a/sudo-1.8.8-clangbugs.patch b/sudo-1.8.8-clangbugs.patch
new file mode 100644
index 0000000..9d4f1cb
--- /dev/null
+++ b/sudo-1.8.8-clangbugs.patch
@@ -0,0 +1,60 @@
+diff -up sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs sudo-1.8.8/plugins/sudoers/auth/pam.c
+--- sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs	2013-09-30 23:41:07.899529555 +0200
++++ sudo-1.8.8/plugins/sudoers/auth/pam.c	2013-09-30 23:41:58.988707761 +0200
+@@ -246,6 +246,7 @@ sudo_pam_begin_session(struct passwd *pw
+ 	    (void) pam_end(pamh, *pam_status | PAM_DATA_SILENT);
+ 	    pamh = NULL;
+ 	    status = AUTH_FAILURE;
++	    goto done;
+ 	}
+     }
+ 
+diff -up sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs sudo-1.8.8/plugins/sudoers/sssd.c
+--- sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs	2013-09-30 23:44:20.404200629 +0200
++++ sudo-1.8.8/plugins/sudoers/sssd.c	2013-09-30 23:49:05.998194738 +0200
+@@ -310,11 +310,10 @@ static int sudo_sss_close(struct sudo_ns
+     debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD);
+ 
+     if (nss && nss->handle) {
+-	handle = nss->handle;
+-	dlclose(handle->ssslib);
++	    handle = nss->handle;
++	    dlclose(handle->ssslib);
++	    efree(nss->handle);
+     }
+-
+-    efree(nss->handle);
+     debug_return_int(0);
+ }
+ 
+@@ -705,17 +704,21 @@ sudo_sss_result_get(struct sudo_nss *nss
+ 	sudo_sss_result_filterp, _SUDO_SSS_FILTER_INCLUDE, NULL);
+ 
+     if (f_sss_result != NULL) {
+-	if (f_sss_result->num_rules > 0) {
+-	    if (state != NULL) {
+-		sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH");
+-		*state |= _SUDO_SSS_STATE_HOSTMATCH;
++	    if (f_sss_result->num_rules > 0) {
++		    if (state != NULL) {
++			    sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH");
++			    *state |= _SUDO_SSS_STATE_HOSTMATCH;
++		    }
+ 	    }
+-	}
+-    }
+ 
+-    sudo_debug_printf(SUDO_DEBUG_DEBUG,
+-	"u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result,
+-	u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
++	    sudo_debug_printf(SUDO_DEBUG_DEBUG,
++	                      "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result,
++	                      u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
++    } else {
++	    sudo_debug_printf(SUDO_DEBUG_DEBUG,
++	                      "u_sss_result=(%p, %u) => f_sss_result=NULL",
++	                      u_sss_result, u_sss_result->num_rules);
++    }
+ 
+     handle->fn_free_result(u_sss_result);
+ 
diff --git a/sudo-1.8.8-sssdfixes.patch b/sudo-1.8.8-sssdfixes.patch
new file mode 100644
index 0000000..31edde6
--- /dev/null
+++ b/sudo-1.8.8-sssdfixes.patch
@@ -0,0 +1,119 @@
+diff -up sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes sudo-1.8.8/plugins/sudoers/sssd.c
+--- sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes	2013-09-30 23:18:49.641913457 +0200
++++ sudo-1.8.8/plugins/sudoers/sssd.c	2013-09-30 23:25:54.819376696 +0200
+@@ -534,30 +534,31 @@ sudo_sss_check_runas_group(struct sudo_s
+  * Walk through search results and return true if we have a runas match,
+  * else false.  RunAs info is optional.
+  */
+-static int
++static bool
+ sudo_sss_check_runas(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
+ {
+-    int ret;
++    bool ret;
+     debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD);
+ 
+     if (rule == NULL)
+-	 debug_return_int(false);
++	 debug_return_bool(false);
+ 
+     ret = sudo_sss_check_runas_user(handle, rule) != false &&
+ 	 sudo_sss_check_runas_group(handle, rule) != false;
+ 
+-    debug_return_int(ret);
++    debug_return_bool(ret);
+ }
+ 
+-static int
++static bool
+ sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
+ {
+     char **val_array, *val;
+-    int ret = false, i;
++    bool ret = false;
++    int i;
+     debug_decl(sudo_sss_check_host, SUDO_DEBUG_SSSD);
+ 
+     if (rule == NULL)
+-	debug_return_int(ret);
++	debug_return_bool(ret);
+ 
+     /* get the values from the rule */
+     switch (handle->fn_get_values(rule, "sudoHost", &val_array))
+@@ -566,10 +567,10 @@ sudo_sss_check_host(struct sudo_sss_hand
+ 	break;
+     case ENOENT:
+ 	sudo_debug_printf(SUDO_DEBUG_INFO, "No result.");
+-	debug_return_int(false);
++	debug_return_bool(false);
+     default:
+ 	sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoHost): != 0");
+-	debug_return_int(ret);
++	debug_return_bool(ret);
+     }
+ 
+     /* walk through values */
+@@ -589,7 +590,52 @@ sudo_sss_check_host(struct sudo_sss_hand
+ 
+     handle->fn_free_values(val_array);
+ 
+-    debug_return_int(ret);
++    debug_return_bool(ret);
++}
++
++/*
++ * Look for netgroup specifcations in the sudoUser attribute and
++ * if found, filter according to netgroup membership.
++ *  returns:
++ *   true -> netgroup spec found && negroup member
++ *  false -> netgroup spec found && not a meber of netgroup
++ *   true -> netgroup spec not found (filtered by SSSD already, netgroups are an exception)
++ */
++bool sudo_sss_filter_user_netgroup(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
++{
++	bool ret = false, netgroup_spec_found = false;
++	char **val_array, *val;
++	int i;
++	debug_decl(sudo_sss_check_user_netgroup, SUDO_DEBUG_SSSD);
++
++	if (!handle || !rule)
++		debug_return_bool(ret);
++
++	switch (handle->fn_get_values(rule, "sudoUser", &val_array)) {
++		case 0:
++			break;
++		case ENOENT:
++			sudo_debug_printf(SUDO_DEBUG_INFO, "No result.");
++			debug_return_bool(ret);
++		default:
++			sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoUser): != 0");
++			debug_return_bool(ret);
++	}
++
++	for (i = 0; val_array[i] != NULL && !ret; ++i) {
++		val = val_array[i];
++		if (*val == '+') {
++			netgroup_spec_found = true;
++		}
++		sudo_debug_printf(SUDO_DEBUG_DEBUG, "val[%d]=%s", i, val);
++		if (strcmp(val, "ALL") == 0 || netgr_matches(val, NULL, NULL, user_name)) {
++			ret = true;
++			sudo_debug_printf(SUDO_DEBUG_DIAG,
++			                  "sssd/ldap sudoUser '%s' ... MATCH! (%s)", val, user_name);
++		}
++	}
++	handle->fn_free_values(val_array);
++	debug_return_bool(netgroup_spec_found ? ret : true);
+ }
+ 
+ static int
+@@ -599,7 +645,8 @@ sudo_sss_result_filterp(struct sudo_sss_
+     (void)unused;
+     debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD);
+ 
+-    if (sudo_sss_check_host(handle, rule))
++    if (sudo_sss_check_host(handle, rule) &&
++        sudo_sss_filter_user_netgroup(handle, rule))
+ 	debug_return_int(1);
+     else
+ 	debug_return_int(0);
diff --git a/sudo-1.8.8-strictuidgid.patch b/sudo-1.8.8-strictuidgid.patch
new file mode 100644
index 0000000..ebb14ff
--- /dev/null
+++ b/sudo-1.8.8-strictuidgid.patch
@@ -0,0 +1,53 @@
+diff -up sudo-1.8.8/plugins/sudoers/match.c.strictuidgid sudo-1.8.8/plugins/sudoers/match.c
+--- sudo-1.8.8/plugins/sudoers/match.c.strictuidgid	2013-09-30 23:30:12.359263967 +0200
++++ sudo-1.8.8/plugins/sudoers/match.c	2013-09-30 23:31:04.335443002 +0200
+@@ -777,14 +777,16 @@ hostname_matches(char *shost, char *lhos
+ bool
+ userpw_matches(char *sudoers_user, char *user, struct passwd *pw)
+ {
+-    debug_decl(userpw_matches, SUDO_DEBUG_MATCH)
+-
+-    if (pw != NULL && *sudoers_user == '#') {
+-	uid_t uid = (uid_t) atoi(sudoers_user + 1);
+-	if (uid == pw->pw_uid)
+-	    debug_return_bool(true);
+-    }
+-    debug_return_bool(strcmp(sudoers_user, user) == 0);
++	debug_decl(userpw_matches, SUDO_DEBUG_MATCH)
++	if (pw != NULL && *sudoers_user == '#') {
++		char *end = NULL;
++		uid_t uid = (uid_t) strtol(sudoers_user + 1, &end, 10);
++		if (end != NULL && (sudoers_user[1] != '\0' && *end == '\0')) {
++			if (uid == pw->pw_uid)
++				debug_return_bool(true);
++		}
++	}
++	debug_return_bool(strcmp(sudoers_user, user) == 0);
+ }
+ 
+ /*
+@@ -794,14 +796,16 @@ userpw_matches(char *sudoers_user, char
+ bool
+ group_matches(char *sudoers_group, struct group *gr)
+ {
+-    debug_decl(group_matches, SUDO_DEBUG_MATCH)
+-
+-    if (*sudoers_group == '#') {
+-	gid_t gid = (gid_t) atoi(sudoers_group + 1);
+-	if (gid == gr->gr_gid)
+-	    debug_return_bool(true);
+-    }
+-    debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0);
++	debug_decl(group_matches, SUDO_DEBUG_MATCH)
++	if (*sudoers_group == '#') {
++		char *end = NULL;
++		gid_t gid = (gid_t) strtol(sudoers_group + 1, &end, 10);
++		if (end != NULL && (sudoers_group[1] != '\0' && *end == '\0')) {
++			if (gid == gr->gr_gid)
++				debug_return_bool(true);
++		}
++	}
++	debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0);
+ }
+ 
+ /*
diff --git a/sudo.spec b/sudo.spec
index f12c88a..aefcc1e 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.6p7
-Release: 2%{?dist}
+Version: 1.8.8
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -9,6 +9,7 @@ Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
 Source1: sudo-1.7.4p4-sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth, vim-minimal
+Requires(post): /bin/chmod
 
 BuildRequires: pam-devel
 BuildRequires: groff
@@ -26,6 +27,12 @@ BuildRequires: zlib-devel
 Patch1: sudo-1.6.7p5-strip.patch
 # configure.in fix
 Patch2: sudo-1.7.2p1-envdebug.patch
+# Fix several issues in the sssd code
+Patch3: sudo-1.8.8-sssdfixes.patch
+# Don't accept invalid number in uid/gid specifications
+Patch4: sudo-1.8.8-strictuidgid.patch
+# Fix several issues found by the clang static analyzer
+Patch5: sudo-1.8.8-clangbugs.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -52,6 +59,9 @@ plugins that use %{name}.
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .envdebug
+%patch3 -p1 -b .sssdfixes
+%patch4 -p1 -b .strictuidgid
+%patch5 -p1 -b .clangbugs
 
 %build
 autoreconf -I m4 -fv --install
@@ -68,7 +78,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --prefix=%{_prefix} \
         --sbindir=%{_sbindir} \
         --libdir=%{_libdir} \
-        --docdir=%{_datadir}/doc/%{name}-%{version} \
+        --docdir=%{_pkgdocdir} \
         --with-logging=syslog \
         --with-logfac=authpriv \
         --with-pam \
@@ -95,10 +105,10 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
 
-chmod +x $RPM_BUILD_ROOT%{_libexecdir}/*.so # for stripping, reset in %%files
+chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%files
 
 # Remove execute permission on this script so we don't pull in perl deps
-chmod -x $RPM_BUILD_ROOT%{_docdir}/sudo-*/sudoers2ldif
+chmod -x $RPM_BUILD_ROOT%{_pkgdocdir}/sudoers2ldif
 
 %find_lang sudo
 %find_lang sudoers
@@ -140,17 +150,20 @@ rm -rf $RPM_BUILD_ROOT
 %attr(4111,root,root) %{_bindir}/sudoedit
 %attr(0111,root,root) %{_bindir}/sudoreplay
 %attr(0755,root,root) %{_sbindir}/visudo
-%attr(0755,root,root) %{_libexecdir}/sesh
-%attr(0644,root,root) %{_libexecdir}/sudo_noexec.so
-%attr(0644,root,root) %{_libexecdir}/sudoers.so
+%attr(0755,root,root) %{_libexecdir}/sudo/sesh
+%attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so
+%attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
+%attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
+%attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
 %{_mandir}/man5/sudoers.5*
 %{_mandir}/man5/sudoers.ldap.5*
+%{_mandir}/man5/sudo.conf.5*
 %{_mandir}/man8/sudo.8*
 %{_mandir}/man8/sudoedit.8*
 %{_mandir}/man8/sudoreplay.8*
 %{_mandir}/man8/visudo.8*
-%dir %{_docdir}/sudo-%{version}
-%{_docdir}/sudo-%{version}/*
+%dir %{_pkgdocdir}/
+%{_pkgdocdir}/*
 
 
 # Make sure permissions are ok even if we're updating
@@ -164,6 +177,31 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Mon Sep 30 2013 Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-1
+- update to 1.8.8
+- major changes & fixes:
+  - LDAP SASL support now works properly with Kerberos
+  - root may no longer change its SELinux role without entering a password
+  - user messages are now always displayed in the user's locale, even when
+    the same message is being logged or mailed in a different locale.
+  - log files created by sudo now explicitly have the group set to group
+    ID 0 rather than relying on BSD group semantics
+  - sudo now stores its libexec files in a sudo subdirectory instead of in
+    libexec itself
+  - system_group and group_file sudoers group provider plugins are now
+    installed by default
+  - the paths to ldap.conf and ldap.secret may now be specified as arguments
+    to the sudoers plugin in the sudo.conf file
+  - ...and many new features and settings. See the upstream ChangeLog for the
+    full list.
+- several sssd support fixes
+- added patch to make uid/gid specification parsing more strict (don't accept
+  an invalid number as uid/gid)
+- use the _pkgdocdir macro
+  (see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs)
+- fixed several bugs found by the clang static analyzer
+- added %%post dependency on chmod
+
 * Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.6p7-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
 

From 0477581f3c17c928f4644a1cf1e58021aee2706b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Skytt=C3=A4?= <ville.skytta@iki.fi>
Date: Sat, 25 Jan 2014 20:15:33 +0200
Subject: [PATCH 080/199] Own the %{_libexecdir}/sudo dir.

---
 sudo.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index aefcc1e..e027284 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.8
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -150,6 +150,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(4111,root,root) %{_bindir}/sudoedit
 %attr(0111,root,root) %{_bindir}/sudoreplay
 %attr(0755,root,root) %{_sbindir}/visudo
+%dir %{_libexecdir}/sudo
 %attr(0755,root,root) %{_libexecdir}/sudo/sesh
 %attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
@@ -177,6 +178,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sat Jan 25 2014 Ville Skyttä <ville.skytta@iki.fi> - 1.8.8-2
+- Own the %%{_libexecdir}/sudo dir.
+
 * Mon Sep 30 2013 Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-1
 - update to 1.8.8
 - major changes & fixes:

From fbec0ab1c9a550b8ed524641756f48f810d4e9cd Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Wed, 12 Mar 2014 12:29:34 +0100
Subject: [PATCH 081/199] Minor update

  - remove bundled copy of zlib before compilation
  - drop the requiretty Defaults setting from sudoers
---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 8 +++++++-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 420d45e..77602a6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.6p3.tar.gz
 /sudo-1.8.6p7.tar.gz
 /sudo-1.8.8.tar.gz
+/sudo-1.8.8-sudoers
diff --git a/sources b/sources
index 97b27b4..a2d9920 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-56f74aed3a7b32f2b01a34d65ac86f85  sudo-1.7.4p4-sudoers
 fc4f074090afd56d9ff4ff4e97321971  sudo-1.8.8.tar.gz
+775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers
diff --git a/sudo.spec b/sudo.spec
index e027284..988dc57 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.8
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -64,6 +64,8 @@ plugins that use %{name}.
 %patch5 -p1 -b .clangbugs
 
 %build
+# Remove bundled copy of zlib
+rm -rf zlib/
 autoreconf -I m4 -fv --install
 
 %ifarch s390 s390x sparc64
@@ -178,6 +180,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Mon Mar 10 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-3
+- remove bundled copy of zlib before compilation
+- drop the requiretty Defaults setting from sudoers
+
 * Sat Jan 25 2014 Ville Skyttä <ville.skytta@iki.fi> - 1.8.8-2
 - Own the %%{_libexecdir}/sudo dir.
 

From cdc45918d3664daf93b3de924d073ec9f7a59bfd Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Wed, 12 Mar 2014 12:44:37 +0100
Subject: [PATCH 082/199] Update sudoers source in the spec

---
 sudo.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 988dc57..bab3560 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -6,7 +6,7 @@ License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
 Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
-Source1: sudo-1.7.4p4-sudoers
+Source1: sudo-1.8.8-sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth, vim-minimal
 Requires(post): /bin/chmod

From 824a03a3b14f1127b7f5649765f2ae40a418e834 Mon Sep 17 00:00:00 2001
From: Peter Robinson <pbrobinson@gmail.com>
Date: Sun, 1 Jun 2014 00:24:08 +0100
Subject: [PATCH 083/199] Drop ChangeLog, we ship NEWS

---
 sudo.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index bab3560..c2b73ad 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.8
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -167,6 +167,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/visudo.8*
 %dir %{_pkgdocdir}/
 %{_pkgdocdir}/*
+%exclude %{_pkgdocdir}/ChangeLog
 
 
 # Make sure permissions are ok even if we're updating
@@ -180,6 +181,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sat May 31 2014 Peter Robinson <pbrobinson@fedoraproject.org> 1.8.8-4
+- Drop ChangeLog, we ship NEWS
+
 * Mon Mar 10 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-3
 - remove bundled copy of zlib before compilation
 - drop the requiretty Defaults setting from sudoers

From ed48f93a75be9010ac564f669471f020bd2ae097 Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Sun, 8 Jun 2014 02:26:52 -0500
Subject: [PATCH 084/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index c2b73ad..13f0c4a 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.8
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -181,6 +181,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.8-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
 * Sat May 31 2014 Peter Robinson <pbrobinson@fedoraproject.org> 1.8.8-4
 - Drop ChangeLog, we ship NEWS
 

From 8f687c7bef24755bb5b417a6e8c341ff2185e043 Mon Sep 17 00:00:00 2001
From: Tom Callaway <spot@fedoraproject.org>
Date: Tue, 5 Aug 2014 11:04:25 -0400
Subject: [PATCH 085/199] fix license handling

---
 sudo.spec | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 13f0c4a..b777e28 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.8
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -112,6 +112,9 @@ chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%fil
 # Remove execute permission on this script so we don't pull in perl deps
 chmod -x $RPM_BUILD_ROOT%{_pkgdocdir}/sudoers2ldif
 
+# Don't package LICENSE as a doc
+rm -rf $RPM_BUILD_ROOT%{_pkgdocdir}/LICENSE
+
 %find_lang sudo
 %find_lang sudoers
 
@@ -167,6 +170,8 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/visudo.8*
 %dir %{_pkgdocdir}/
 %{_pkgdocdir}/*
+%{!?_licensedir:%global license %%doc}
+%license doc/LICENSE
 %exclude %{_pkgdocdir}/ChangeLog
 
 
@@ -181,6 +186,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Tue Aug  5 2014 Tom Callaway <spot@fedoraproject.org> - 1.8.8-6
+- fix license handling
+
 * Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.8-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
 

From 71fccff3026f96242a665d9632c381583ab7cda6 Mon Sep 17 00:00:00 2001
From: Peter Robinson <pbrobinson@fedoraproject.org>
Date: Mon, 18 Aug 2014 04:03:38 +0000
Subject: [PATCH 086/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index b777e28..132e1f2 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.8
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -186,6 +186,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Mon Aug 18 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.8-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
 * Tue Aug  5 2014 Tom Callaway <spot@fedoraproject.org> - 1.8.8-6
 - fix license handling
 

From a5f9360d9a834c8995e7ec07feac039ad79e56b7 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 30 Sep 2014 15:45:25 +0200
Subject: [PATCH 087/199] update to 1.8.11

- major changes & fixes:
  - when running a command in the background, sudo will now forward
    SIGINFO to the command
  - the passwords in ldap.conf and ldap.secret may now be encoded in base64.
  - SELinux role changes are now audited. For sudoedit, we now audit
    the actual editor being run, instead of just the sudoedit command.
  - it is now possible to match an environment variable's value as well as
    its name using env_keep and env_check
  - new files created via sudoedit as a non-root user now have the proper group id
  - sudoedit now works correctly in conjunction with sudo's SELinux RBAC support
  - it is now possible to disable network interface probing in sudo.conf by
    changing the value of the probe_interfaces setting
  - when listing a user's privileges (sudo -l), the sudoers plugin will now prompt
    for the user's password even if the targetpw, rootpw or runaspw options are set.
  - the new use_netgroups sudoers option can be used to explicitly enable or disable
    netgroups support
  - visudo can now export a sudoers file in JSON format using the new -x flag
- added patch to read ldap.conf more closely to nss_ldap
- require /usr/bin/vi instead of vim-minimal
- include pam.d/system-auth in PAM session phase from pam.d/sudo
- include pam.d/sudo in PAM session phase from pam.d/sudo-i
---
 sudo-1.8.11b4-ldapconfpatch.patch | 54 +++++++++++++++++++++++++++++++
 sudo.spec                         | 53 +++++++++++++++++++-----------
 2 files changed, 89 insertions(+), 18 deletions(-)
 create mode 100644 sudo-1.8.11b4-ldapconfpatch.patch

diff --git a/sudo-1.8.11b4-ldapconfpatch.patch b/sudo-1.8.11b4-ldapconfpatch.patch
new file mode 100644
index 0000000..c7e9937
--- /dev/null
+++ b/sudo-1.8.11b4-ldapconfpatch.patch
@@ -0,0 +1,54 @@
+diff -up sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.11b4/plugins/sudoers/ldap.c
+--- sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch	2014-07-22 22:52:34.000000000 +0200
++++ sudo-1.8.11b4/plugins/sudoers/ldap.c	2014-09-15 11:22:11.122094452 +0200
+@@ -1550,6 +1550,33 @@ sudo_check_krb5_ccname(const char *ccnam
+ }
+ #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */
+ 
++/*
++ * Read a line of input, remove whole line comments and strip off leading
++ * and trailing spaces.  Returns static storage that is reused.
++ */
++static char *
++sudo_ldap_parseln(fp)
++    FILE *fp;
++{
++    size_t len;
++    char *cp = NULL;
++    static char buf[LINE_MAX];
++
++    if (fgets(buf, sizeof(buf), fp) != NULL) {
++	/* Remove comments */
++	if (*buf == '#')
++	    *buf = '\0';
++
++	/* Trim leading and trailing whitespace/newline */
++	len = strlen(buf);
++	while (len > 0 && isspace((unsigned char)buf[len - 1]))
++	    buf[--len] = '\0';
++	for (cp = buf; isblank(*cp); cp++)
++	    continue;
++    }
++    return(cp);
++}
++
+ static bool
+ sudo_ldap_read_config(void)
+ {
+@@ -1575,7 +1602,7 @@ sudo_ldap_read_config(void)
+     if ((fp = fopen(path_ldap_conf, "r")) == NULL)
+ 	debug_return_bool(false);
+ 
+-    while (sudo_parseln(&line, &linesize, NULL, fp) != -1) {
++    while ((line = sudo_ldap_parseln(fp)) != NULL) {
+ 	if (*line == '\0')
+ 	    continue;		/* skip empty line */
+ 
+@@ -1595,7 +1622,6 @@ sudo_ldap_read_config(void)
+ 	if (!sudo_ldap_parse_keyword(keyword, value, ldap_conf_global))
+ 	    sudo_ldap_parse_keyword(keyword, value, ldap_conf_conn);
+     }
+-    free(line);
+     fclose(fp);
+ 
+     if (!ldap_conf.host)
diff --git a/sudo.spec b/sudo.spec
index 132e1f2..2da6fe3 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,14 +1,15 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.8
-Release: 7%{?dist}
+Version: 1.8.11
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
 Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
 Source1: sudo-1.8.8-sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-Requires: /etc/pam.d/system-auth, vim-minimal
+Requires: /etc/pam.d/system-auth
+Requires: /usr/bin/vi
 Requires(post): /bin/chmod
 
 BuildRequires: pam-devel
@@ -25,14 +26,8 @@ BuildRequires: zlib-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
-# configure.in fix
-Patch2: sudo-1.7.2p1-envdebug.patch
-# Fix several issues in the sssd code
-Patch3: sudo-1.8.8-sssdfixes.patch
-# Don't accept invalid number in uid/gid specifications
-Patch4: sudo-1.8.8-strictuidgid.patch
-# Fix several issues found by the clang static analyzer
-Patch5: sudo-1.8.8-clangbugs.patch
+# Patch to read ldap.conf more closely to nss_ldap
+Patch2: sudo-1.8.11b4-ldapconfpatch.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -58,10 +53,7 @@ plugins that use %{name}.
 %setup -q
 
 %patch1 -p1 -b .strip
-%patch2 -p1 -b .envdebug
-%patch3 -p1 -b .sssdfixes
-%patch4 -p1 -b .strictuidgid
-%patch5 -p1 -b .clangbugs
+%patch2 -p1 -b .ldapconfpatch
 
 %build
 # Remove bundled copy of zlib
@@ -129,6 +121,7 @@ account    include      system-auth
 password   include      system-auth
 session    optional     pam_keyinit.so revoke
 session    required     pam_limits.so
+session    include      system-auth
 EOF
 
 cat > $RPM_BUILD_ROOT/etc/pam.d/sudo-i << EOF
@@ -137,7 +130,7 @@ auth       include      sudo
 account    include      sudo
 password   include      sudo
 session    optional     pam_keyinit.so force revoke
-session    required     pam_limits.so
+session    include      sudo
 EOF
 
 
@@ -161,6 +154,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
+%attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.*
 %{_mandir}/man5/sudoers.5*
 %{_mandir}/man5/sudoers.ldap.5*
 %{_mandir}/man5/sudo.conf.5*
@@ -184,10 +178,33 @@ rm -rf $RPM_BUILD_ROOT
 %doc plugins/sample/sample_plugin.c
 %{_includedir}/sudo_plugin.h
 %{_mandir}/man8/sudo_plugin.8*
+%attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so
+%attr(0644,root,root) %{_libexecdir}/sudo/*.la
 
 %changelog
-* Mon Aug 18 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.8-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+* Tue Sep 30 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.11-1
+- update to 1.8.11
+- major changes & fixes:
+  - when running a command in the background, sudo will now forward
+    SIGINFO to the command
+  - the passwords in ldap.conf and ldap.secret may now be encoded in base64. 
+  - SELinux role changes are now audited. For sudoedit, we now audit
+    the actual editor being run, instead of just the sudoedit command. 
+  - it is now possible to match an environment variable's value as well as
+    its name using env_keep and env_check
+  - new files created via sudoedit as a non-root user now have the proper group id
+  - sudoedit now works correctly in conjunction with sudo's SELinux RBAC support
+  - it is now possible to disable network interface probing in sudo.conf by
+    changing the value of the probe_interfaces setting
+  - when listing a user's privileges (sudo -l), the sudoers plugin will now prompt
+    for the user's password even if the targetpw, rootpw or runaspw options are set.
+  - the new use_netgroups sudoers option can be used to explicitly enable or disable
+    netgroups support
+  - visudo can now export a sudoers file in JSON format using the new -x flag
+- added patch to read ldap.conf more closely to nss_ldap
+- require /usr/bin/vi instead of vim-minimal
+- include pam.d/system-auth in PAM session phase from pam.d/sudo
+- include pam.d/sudo in PAM session phase from pam.d/sudo-i
 
 * Tue Aug  5 2014 Tom Callaway <spot@fedoraproject.org> - 1.8.8-6
 - fix license handling

From eb43a57277bafe267b6f7d8360bdfee6ecb9b21e Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 30 Sep 2014 15:51:09 +0200
Subject: [PATCH 088/199] Added the sudo-1.8.11.tar.gz tarball


From af463d53b21a5c9eb314127d36ff0604412ca176 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 30 Sep 2014 15:57:08 +0200
Subject: [PATCH 089/199] Added the sudo-1.8.11 tarball -- now for real

---
 .gitignore | 1 +
 sources    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 77602a6..869dbfe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.6p7.tar.gz
 /sudo-1.8.8.tar.gz
 /sudo-1.8.8-sudoers
+/sudo-1.8.11.tar.gz
diff --git a/sources b/sources
index a2d9920..deff375 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-fc4f074090afd56d9ff4ff4e97321971  sudo-1.8.8.tar.gz
+9a642cf6aca5375f8569a2961f44d0f3  sudo-1.8.11.tar.gz
 775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers

From 7719973d9ba22a15548ec95c3fcbad3c8f76c7ae Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Mon, 3 Nov 2014 13:23:04 +0100
Subject: [PATCH 090/199] update to 1.8.11p2

- added patch to fix upstream bug #671 -- exiting immediately
  when audit is disabled
---
 .gitignore                   |  1 +
 sources                      |  2 +-
 sudo-1.8.11p2-auditfix.patch | 17 +++++++++++++++++
 sudo.spec                    | 10 +++++++++-
 4 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 sudo-1.8.11p2-auditfix.patch

diff --git a/.gitignore b/.gitignore
index 869dbfe..b8a25f7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.8.tar.gz
 /sudo-1.8.8-sudoers
 /sudo-1.8.11.tar.gz
+/sudo-1.8.11p2.tar.gz
diff --git a/sources b/sources
index deff375..4762a29 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-9a642cf6aca5375f8569a2961f44d0f3  sudo-1.8.11.tar.gz
 775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers
+84012b4871b6c775c957cd310d5bad87  sudo-1.8.11p2.tar.gz
diff --git a/sudo-1.8.11p2-auditfix.patch b/sudo-1.8.11p2-auditfix.patch
new file mode 100644
index 0000000..963ef4e
--- /dev/null
+++ b/sudo-1.8.11p2-auditfix.patch
@@ -0,0 +1,17 @@
+diff -up sudo-1.8.11p2/plugins/sudoers/linux_audit.c.auditfix sudo-1.8.11p2/plugins/sudoers/linux_audit.c
+--- sudo-1.8.11p2/plugins/sudoers/linux_audit.c.auditfix	2014-11-03 12:44:53.674230966 +0100
++++ sudo-1.8.11p2/plugins/sudoers/linux_audit.c	2014-11-03 12:45:13.407021599 +0100
+@@ -57,10 +57,10 @@ linux_audit_open(void)
+     au_fd = audit_open();
+     if (au_fd == -1) {
+ 	/* Kernel may not have audit support. */
+-	if (errno != EINVAL && errno != EPROTONOSUPPORT && errno != EAFNOSUPPORT) {
+-	    sudo_warn(U_("unable to open audit system"));
++	if (errno == EINVAL || errno == EPROTONOSUPPORT || errno == EAFNOSUPPORT)
+ 	    au_fd = AUDIT_NOT_CONFIGURED;
+-	}
++	else
++	    sudo_warn(U_("unable to open audit system"));
+     } else {
+ 	(void)fcntl(au_fd, F_SETFD, FD_CLOEXEC);
+     }
diff --git a/sudo.spec b/sudo.spec
index 2da6fe3..f915365 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.11
+Version: 1.8.11p2
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
@@ -28,6 +28,8 @@ BuildRequires: zlib-devel
 Patch1: sudo-1.6.7p5-strip.patch
 # Patch to read ldap.conf more closely to nss_ldap
 Patch2: sudo-1.8.11b4-ldapconfpatch.patch
+# Don't exit if audit is not supported by the kernel
+Patch3: sudo-1.8.11p2-auditfix.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -54,6 +56,7 @@ plugins that use %{name}.
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .ldapconfpatch
+%patch3 -p1 -b .auditfix
 
 %build
 # Remove bundled copy of zlib
@@ -182,6 +185,11 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0644,root,root) %{_libexecdir}/sudo/*.la
 
 %changelog
+* Mon Nov  3 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.11p2-1
+- update to 1.8.11p2
+- added patch to fix upstream bug #671 -- exiting immediately
+  when audit is disabled
+
 * Tue Sep 30 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.11-1
 - update to 1.8.11
 - major changes & fixes:

From 200fa940281096a87ced976baeae173eeca4e391 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Wed, 18 Feb 2015 10:32:39 +0100
Subject: [PATCH 091/199] update to 1.8.12

- fixes CVE-2014-9680
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 12 ++++++++----
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index b8a25f7..31c82be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.8-sudoers
 /sudo-1.8.11.tar.gz
 /sudo-1.8.11p2.tar.gz
+/sudo-1.8.12.tar.gz
diff --git a/sources b/sources
index 4762a29..4bfc811 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers
-84012b4871b6c775c957cd310d5bad87  sudo-1.8.11p2.tar.gz
+87558f3a55c62bc9244b19594f103ffa  sudo-1.8.12.tar.gz
diff --git a/sudo.spec b/sudo.spec
index f915365..8630d4b 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.11p2
+Version: 1.8.12
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
@@ -28,8 +28,6 @@ BuildRequires: zlib-devel
 Patch1: sudo-1.6.7p5-strip.patch
 # Patch to read ldap.conf more closely to nss_ldap
 Patch2: sudo-1.8.11b4-ldapconfpatch.patch
-# Don't exit if audit is not supported by the kernel
-Patch3: sudo-1.8.11p2-auditfix.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -56,7 +54,6 @@ plugins that use %{name}.
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .ldapconfpatch
-%patch3 -p1 -b .auditfix
 
 %build
 # Remove bundled copy of zlib
@@ -110,6 +107,9 @@ chmod -x $RPM_BUILD_ROOT%{_pkgdocdir}/sudoers2ldif
 # Don't package LICENSE as a doc
 rm -rf $RPM_BUILD_ROOT%{_pkgdocdir}/LICENSE
 
+# Remove examples; Examples can be found in man pages too.
+rm -rf $RPM_BUILD_ROOT%{_datadir}/examples/sudo
+
 %find_lang sudo
 %find_lang sudoers
 
@@ -185,6 +185,10 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0644,root,root) %{_libexecdir}/sudo/*.la
 
 %changelog
+* Wed Feb 18 2015 Daniel Kopecek <dkopecek@redhat.com> - 1.8.12
+- update to 1.8.12
+- fixes CVE-2014-9680
+
 * Mon Nov  3 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.11p2-1
 - update to 1.8.11p2
 - added patch to fix upstream bug #671 -- exiting immediately

From fb968d2c85a42141f7047c9a8fb51a9d92c7af82 Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Fri, 19 Jun 2015 01:55:23 +0000
Subject: [PATCH 092/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 8630d4b..03a8249 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.12
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -185,6 +185,9 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0644,root,root) %{_libexecdir}/sudo/*.la
 
 %changelog
+* Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.12-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
 * Wed Feb 18 2015 Daniel Kopecek <dkopecek@redhat.com> - 1.8.12
 - update to 1.8.12
 - fixes CVE-2014-9680

From 9047d526fd928bfad3a09855f88a2ee7da9b76dc Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Fri, 10 Jul 2015 15:28:28 +0200
Subject: [PATCH 093/199] Update to 1.8.14b4

- Add own %{_tmpfilesdir}/sudo.conf
---
 .gitignore                                    |  1 +
 sources                                       |  2 +-
 ...patch => sudo-1.8.14b3-ldapconfpatch.patch | 15 +++++++------
 sudo.spec                                     | 22 +++++++++++++------
 4 files changed, 25 insertions(+), 15 deletions(-)
 rename sudo-1.8.11b4-ldapconfpatch.patch => sudo-1.8.14b3-ldapconfpatch.patch (71%)

diff --git a/.gitignore b/.gitignore
index 31c82be..6120554 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.11.tar.gz
 /sudo-1.8.11p2.tar.gz
 /sudo-1.8.12.tar.gz
+/sudo-1.8.14b4.tar.gz
diff --git a/sources b/sources
index 4bfc811..da9c27d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
+3d4f5c159a562c39c66c7f3aaef3c5b3  sudo-1.8.14b4.tar.gz
 775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers
-87558f3a55c62bc9244b19594f103ffa  sudo-1.8.12.tar.gz
diff --git a/sudo-1.8.11b4-ldapconfpatch.patch b/sudo-1.8.14b3-ldapconfpatch.patch
similarity index 71%
rename from sudo-1.8.11b4-ldapconfpatch.patch
rename to sudo-1.8.14b3-ldapconfpatch.patch
index c7e9937..f42d487 100644
--- a/sudo-1.8.11b4-ldapconfpatch.patch
+++ b/sudo-1.8.14b3-ldapconfpatch.patch
@@ -1,7 +1,7 @@
-diff -up sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.11b4/plugins/sudoers/ldap.c
---- sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch	2014-07-22 22:52:34.000000000 +0200
-+++ sudo-1.8.11b4/plugins/sudoers/ldap.c	2014-09-15 11:22:11.122094452 +0200
-@@ -1550,6 +1550,33 @@ sudo_check_krb5_ccname(const char *ccnam
+diff -up sudo-1.8.14b3/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.14b3/plugins/sudoers/ldap.c
+--- sudo-1.8.14b3/plugins/sudoers/ldap.c.ldapconfpatch	2015-07-07 18:51:11.000000000 +0200
++++ sudo-1.8.14b3/plugins/sudoers/ldap.c	2015-07-09 11:03:25.686645581 +0200
+@@ -1922,6 +1922,33 @@ sudo_check_krb5_ccname(const char *ccnam
  }
  #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */
  
@@ -35,7 +35,7 @@ diff -up sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.11b4/plugin
  static bool
  sudo_ldap_read_config(void)
  {
-@@ -1575,7 +1602,7 @@ sudo_ldap_read_config(void)
+@@ -1955,7 +1982,7 @@ sudo_ldap_read_config(void)
      if ((fp = fopen(path_ldap_conf, "r")) == NULL)
  	debug_return_bool(false);
  
@@ -44,11 +44,12 @@ diff -up sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.11b4/plugin
  	if (*line == '\0')
  	    continue;		/* skip empty line */
  
-@@ -1595,7 +1622,6 @@ sudo_ldap_read_config(void)
+@@ -1975,7 +2002,7 @@ sudo_ldap_read_config(void)
  	if (!sudo_ldap_parse_keyword(keyword, value, ldap_conf_global))
  	    sudo_ldap_parse_keyword(keyword, value, ldap_conf_conn);
      }
 -    free(line);
++
      fclose(fp);
  
-     if (!ldap_conf.host)
+     if (!ldap_conf.host) {
diff --git a/sudo.spec b/sudo.spec
index 03a8249..ec1f861 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.12
-Release: 2%{?dist}
+Version: 1.8.14b4
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -27,7 +27,7 @@ BuildRequires: zlib-devel
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
 # Patch to read ldap.conf more closely to nss_ldap
-Patch2: sudo-1.8.11b4-ldapconfpatch.patch
+Patch2: sudo-1.8.14b3-ldapconfpatch.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -110,6 +110,9 @@ rm -rf $RPM_BUILD_ROOT%{_pkgdocdir}/LICENSE
 # Remove examples; Examples can be found in man pages too.
 rm -rf $RPM_BUILD_ROOT%{_datadir}/examples/sudo
 
+#Remove all .la files
+find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
+
 %find_lang sudo
 %find_lang sudoers
 
@@ -146,9 +149,10 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0750,root,root) %dir /etc/sudoers.d/
 %config(noreplace) /etc/pam.d/sudo
 %config(noreplace) /etc/pam.d/sudo-i
+%attr(0644,root,root) %{_tmpfilesdir}/sudo.conf
 %dir /var/db/sudo
 %attr(4111,root,root) %{_bindir}/sudo
-%attr(4111,root,root) %{_bindir}/sudoedit
+%{_bindir}/sudoedit
 %attr(0111,root,root) %{_bindir}/sudoreplay
 %attr(0755,root,root) %{_sbindir}/visudo
 %dir %{_libexecdir}/sudo
@@ -157,7 +161,8 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
-%attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.*
+%attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
+%{_libexecdir}/sudo/libsudo_util.so.?
 %{_mandir}/man5/sudoers.5*
 %{_mandir}/man5/sudoers.ldap.5*
 %{_mandir}/man5/sudo.conf.5*
@@ -181,10 +186,13 @@ rm -rf $RPM_BUILD_ROOT
 %doc plugins/sample/sample_plugin.c
 %{_includedir}/sudo_plugin.h
 %{_mandir}/man8/sudo_plugin.8*
-%attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so
-%attr(0644,root,root) %{_libexecdir}/sudo/*.la
+%{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Fri Jul 10 2015 Radovan Sroka <rsroka@redhat.com> - 1.8.14b4-1
+- Update to 1.8.14b4
+- Add own %%{_tmpfilesdir}/sudo.conf
+
 * Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.12-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
 

From af884a422e62e6085afa39c4990d7398376f3e23 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Tue, 14 Jul 2015 13:46:08 +0200
Subject: [PATCH 094/199] Add patch3 sudo.1.8.14b4-passexpire.patch that makes
 change in documentation about timestamp_time

Resolves: rhbz#1162070
---
 sudo-1.8.14b4-docpassexpire.patch | 38 +++++++++++++++++++++++++++++++
 sudo.spec                         | 10 +++++++-
 2 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 sudo-1.8.14b4-docpassexpire.patch

diff --git a/sudo-1.8.14b4-docpassexpire.patch b/sudo-1.8.14b4-docpassexpire.patch
new file mode 100644
index 0000000..cb7fe8a
--- /dev/null
+++ b/sudo-1.8.14b4-docpassexpire.patch
@@ -0,0 +1,38 @@
+diff -up sudo-1.8.14b4/doc/sudoers.cat.docpassexpire sudo-1.8.14b4/doc/sudoers.cat
+--- sudo-1.8.14b4/doc/sudoers.cat.docpassexpire	2015-06-09 00:47:07.000000000 +0200
++++ sudo-1.8.14b4/doc/sudoers.cat	2015-07-14 13:11:11.116000185 +0200
+@@ -1328,8 +1328,8 @@ SSUUDDOOEERRSS OOPPTTIIOONN
+                        fractional component if minute granularity is
+                        insufficient, for example 2.5.  The default is 5.  Set
+                        this to 0 to always prompt for a password.  If set to a
+-                       value less than 0 the user's time stamp will never
+-                       expire.  This can be used to allow users to create or
++                       value less than 0 the user's time stamp will not
++                       expire until reboot.  This can be used to allow users to create or
+                        delete their own time stamps via ``sudo -v'' and ``sudo
+                        -k'' respectively.
+ 
+diff -up sudo-1.8.14b4/doc/sudoers.man.in.docpassexpire sudo-1.8.14b4/doc/sudoers.man.in
+--- sudo-1.8.14b4/doc/sudoers.man.in.docpassexpire	2015-07-14 13:11:11.116000185 +0200
++++ sudo-1.8.14b4/doc/sudoers.man.in	2015-07-14 13:14:17.261222481 +0200
+@@ -2822,7 +2822,7 @@ Set this to
+ to always prompt for a password.
+ If set to a value less than
+ \fR0\fR
+-the user's time stamp will never expire.
++the user's time stamp will not expire until reboot.
+ This can be used to allow users to create or delete their own time stamps via
+ \(Lq\fRsudo -v\fR\(Rq
+ and
+diff -up sudo-1.8.14b4/doc/sudoers.mdoc.in.docpassexpire sudo-1.8.14b4/doc/sudoers.mdoc.in
+--- sudo-1.8.14b4/doc/sudoers.mdoc.in.docpassexpire	2015-04-07 18:15:50.000000000 +0200
++++ sudo-1.8.14b4/doc/sudoers.mdoc.in	2015-07-14 13:11:11.117000176 +0200
+@@ -2647,7 +2647,7 @@ Set this to
+ to always prompt for a password.
+ If set to a value less than
+ .Li 0
+-the user's time stamp will never expire.
++the user's time stamp will not expire until reboot.
+ This can be used to allow users to create or delete their own time stamps via
+ .Dq Li sudo -v
+ and
diff --git a/sudo.spec b/sudo.spec
index ec1f861..491ab6b 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.14b4
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -28,6 +28,9 @@ BuildRequires: zlib-devel
 Patch1: sudo-1.6.7p5-strip.patch
 # Patch to read ldap.conf more closely to nss_ldap
 Patch2: sudo-1.8.14b3-ldapconfpatch.patch
+# Patch makes changes in documentation bz:1162070
+Patch3: sudo-1.8.14b4-docpassexpire.patch
+
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -54,6 +57,7 @@ plugins that use %{name}.
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .ldapconfpatch
+%patch3 -p1 -b .docpassexpire
 
 %build
 # Remove bundled copy of zlib
@@ -189,6 +193,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Tue Jul 14 2015 Radovan Sroka <rsroka@redhat.com> 1.8.12-2
+- add patch3 sudo.1.8.14b4-passexpire.patch that makes change in documentation about timestamp_time
+- Resolves: rhbz#1162070
+
 * Fri Jul 10 2015 Radovan Sroka <rsroka@redhat.com> - 1.8.14b4-1
 - Update to 1.8.14b4
 - Add own %%{_tmpfilesdir}/sudo.conf

From febf08760cf30ec54d4c6c96e1f3fb05a083d547 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Tue, 21 Jul 2015 09:49:22 +0200
Subject: [PATCH 095/199] update to 1.8.14p1

---
 .gitignore                                          |  1 +
 sources                                             |  2 +-
 ...xpire.patch => sudo-1.8.14p1-docpassexpire.patch |  0
 ...patch.patch => sudo-1.8.14p1-ldapconfpatch.patch |  0
 sudo.spec                                           | 13 +++++++++----
 5 files changed, 11 insertions(+), 5 deletions(-)
 rename sudo-1.8.14b4-docpassexpire.patch => sudo-1.8.14p1-docpassexpire.patch (100%)
 rename sudo-1.8.14b3-ldapconfpatch.patch => sudo-1.8.14p1-ldapconfpatch.patch (100%)

diff --git a/.gitignore b/.gitignore
index 6120554..dfb0477 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.11p2.tar.gz
 /sudo-1.8.12.tar.gz
 /sudo-1.8.14b4.tar.gz
+/sudo-1.8.14p1.tar.gz
diff --git a/sources b/sources
index da9c27d..88b4cbe 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-3d4f5c159a562c39c66c7f3aaef3c5b3  sudo-1.8.14b4.tar.gz
+7d6f623d3f9cd921dcec73f6c157345f  sudo-1.8.14p1.tar.gz
 775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers
diff --git a/sudo-1.8.14b4-docpassexpire.patch b/sudo-1.8.14p1-docpassexpire.patch
similarity index 100%
rename from sudo-1.8.14b4-docpassexpire.patch
rename to sudo-1.8.14p1-docpassexpire.patch
diff --git a/sudo-1.8.14b3-ldapconfpatch.patch b/sudo-1.8.14p1-ldapconfpatch.patch
similarity index 100%
rename from sudo-1.8.14b3-ldapconfpatch.patch
rename to sudo-1.8.14p1-ldapconfpatch.patch
diff --git a/sudo.spec b/sudo.spec
index 491ab6b..0cc3cb2 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.14b4
-Release: 2%{?dist}
+Version: 1.8.14p1
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -27,9 +27,9 @@ BuildRequires: zlib-devel
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
 # Patch to read ldap.conf more closely to nss_ldap
-Patch2: sudo-1.8.14b3-ldapconfpatch.patch
+Patch2: sudo-1.8.14p1-ldapconfpatch.patch
 # Patch makes changes in documentation bz:1162070
-Patch3: sudo-1.8.14b4-docpassexpire.patch
+Patch3: sudo-1.8.14p1-docpassexpire.patch
 
 
 %description
@@ -193,6 +193,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Mon Jul 20 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p1-1
+- update to 1.8.14p1-1
+- rebase sudo-1.8.14b3-ldapconfpatch.patch -> sudo-1.8.14p1-ldapconfpatch.patch
+- rebase sudo-1.8.14b4-docpassexpire.patch -> sudo-1.8.14p1-docpassexpire.patch
+
 * Tue Jul 14 2015 Radovan Sroka <rsroka@redhat.com> 1.8.12-2
 - add patch3 sudo.1.8.14b4-passexpire.patch that makes change in documentation about timestamp_time
 - Resolves: rhbz#1162070

From 09c50775bbd5e8c6dde3d320aa90298ae1b36f16 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 27 Jul 2015 10:24:04 +0200
Subject: [PATCH 096/199] Update to 1.8.14p3

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 5 ++++-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index dfb0477..4eadd32 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.12.tar.gz
 /sudo-1.8.14b4.tar.gz
 /sudo-1.8.14p1.tar.gz
+/sudo-1.8.14p3.tar.gz
diff --git a/sources b/sources
index 88b4cbe..c91139d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-7d6f623d3f9cd921dcec73f6c157345f  sudo-1.8.14p1.tar.gz
 775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers
+93dbd1e47c136179ff1b01494c1c0e75  sudo-1.8.14p3.tar.gz
diff --git a/sudo.spec b/sudo.spec
index 0cc3cb2..1694a4a 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.14p1
+Version: 1.8.14p3
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
@@ -193,6 +193,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Mon Jul 27 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-1
+- update to 1.8.14p3
+
 * Mon Jul 20 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p1-1
 - update to 1.8.14p1-1
 - rebase sudo-1.8.14b3-ldapconfpatch.patch -> sudo-1.8.14p1-ldapconfpatch.patch

From c1ed913d7158d641f07c75760960789361880838 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 17 Aug 2015 15:29:15 +0200
Subject: [PATCH 097/199] Fix coverity scan outputs

- add patch that resolves initialization problem before call sudo_strsplit
- add patch that resolves deadcode in visudo.c
---
 sudo-1.8.14p3-deadcode_visudo_c.patch |  40 +++++++++
 sudo-1.8.14p3-extra_while.patch       |  24 +++++
 sudo-1.8.14p3-initialization.patch    | 122 ++++++++++++++++++++++++++
 sudo.spec                             |  16 +++-
 4 files changed, 200 insertions(+), 2 deletions(-)
 create mode 100644 sudo-1.8.14p3-deadcode_visudo_c.patch
 create mode 100644 sudo-1.8.14p3-extra_while.patch
 create mode 100644 sudo-1.8.14p3-initialization.patch

diff --git a/sudo-1.8.14p3-deadcode_visudo_c.patch b/sudo-1.8.14p3-deadcode_visudo_c.patch
new file mode 100644
index 0000000..19a55e1
--- /dev/null
+++ b/sudo-1.8.14p3-deadcode_visudo_c.patch
@@ -0,0 +1,40 @@
+diff -up ./plugins/sudoers/visudo.c.deadcode ./plugins/sudoers/visudo.c
+--- ./plugins/sudoers/visudo.c.deadcode	2015-08-24 09:54:59.216956064 +0200
++++ ./plugins/sudoers/visudo.c	2015-08-24 09:59:50.831547773 +0200
+@@ -415,12 +415,10 @@ edit_sudoers(struct sudoersfile *sp, cha
+     int tfd;				/* sudoers temp file descriptor */
+     bool modified;			/* was the file modified? */
+     int ac;				/* argument count */
+-    char buf[4096];			/* buffer used for copying files */
+     char linestr[64];			/* string version of lineno */
+     struct timespec ts, times[2];	/* time before and after edit */
+     struct timespec orig_mtim;		/* starting mtime of sudoers file */
+     off_t orig_size;			/* starting size of sudoers file */
+-    ssize_t nread;			/* number of bytes read */
+     struct stat sb;			/* stat buffer */
+     bool rval = false;			/* return value */
+     debug_decl(edit_sudoers, SUDOERS_DEBUG_UTIL)
+@@ -440,15 +438,19 @@ edit_sudoers(struct sudoersfile *sp, cha
+ 
+ 	/* Copy sp->path -> sp->tpath and reset the mtime. */
+ 	if (orig_size != 0) {
++	    char buf[4096], lastch = '\0';
++	    ssize_t nread;
+ 	    (void) lseek(sp->fd, (off_t)0, SEEK_SET);
+-	    while ((nread = read(sp->fd, buf, sizeof(buf))) > 0)
++	    while ((nread = read(sp->fd, buf, sizeof(buf))) > 0){
+ 		if (write(tfd, buf, nread) != nread)
+ 		    sudo_fatal(U_("write error"));
++		lastch = buf[nread - 1];
++	    }
+ 
+ 	    /* Add missing newline at EOF if needed. */
+-	    if (nread > 0 && buf[nread - 1] != '\n') {
+-		buf[0] = '\n';
+-		if (write(tfd, buf, 1) != 1)
++	    if (lastch != '\n') {
++		lastch = '\n';
++		if (write(tfd, &lastch, 1) != 1)    
+ 		    sudo_fatal(U_("write error"));
+ 	    }
+ 	}
diff --git a/sudo-1.8.14p3-extra_while.patch b/sudo-1.8.14p3-extra_while.patch
new file mode 100644
index 0000000..c7ff83e
--- /dev/null
+++ b/sudo-1.8.14p3-extra_while.patch
@@ -0,0 +1,24 @@
+diff -up ./plugins/sudoers/sudoers.c.extra_while ./plugins/sudoers/sudoers.c
+--- ./plugins/sudoers/sudoers.c.extra_while	2015-08-24 10:06:01.262987605 +0200
++++ ./plugins/sudoers/sudoers.c	2015-08-24 10:07:16.557919240 +0200
+@@ -1214,7 +1214,7 @@ find_editor(int nfiles, char **files, in
+ 		files, argc_out, argv_out, NULL);
+ 	    if (editor_path == NULL && errno != ENOENT)
+ 		debug_return_str(NULL);
+-	} while (ep != NULL && editor_path == NULL);
++	}
+     }
+     if (!editor_path) {
+ 	audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
+diff -up ./plugins/sudoers/visudo.c.extra_while ./plugins/sudoers/visudo.c
+--- ./plugins/sudoers/visudo.c.extra_while	2015-08-24 10:07:34.602902856 +0200
++++ ./plugins/sudoers/visudo.c	2015-08-24 10:08:27.750854600 +0200
+@@ -332,7 +332,7 @@ get_editor(int *editor_argc, char ***edi
+ 		editor_argc, editor_argv, whitelist);
+ 	    if (editor_path == NULL && errno != ENOENT)
+ 		debug_return_str(NULL);
+-	} while (ep != NULL && editor_path == NULL);
++    	}
+     }
+     if (editor_path == NULL)
+ 	sudo_fatalx(U_("no editor found (editor path = %s)"), def_editor);
diff --git a/sudo-1.8.14p3-initialization.patch b/sudo-1.8.14p3-initialization.patch
new file mode 100644
index 0000000..75da7fd
--- /dev/null
+++ b/sudo-1.8.14p3-initialization.patch
@@ -0,0 +1,122 @@
+diff -up ./lib/util/strsplit.c.initialization ./lib/util/strsplit.c
+--- ./lib/util/strsplit.c.initialization	2015-07-22 14:22:49.000000000 +0200
++++ ./lib/util/strsplit.c	2015-08-18 13:28:28.141319501 +0200
+@@ -37,6 +37,10 @@ sudo_strsplit_v1(const char *str, const
+     const char *cp, *s;
+     debug_decl(sudo_strsplit, SUDO_DEBUG_UTIL)
+ 
++    /* exclusion of two NULLs at the same time */
++    if (str == NULL && *last == NULL)
++	debug_return_ptr(NULL);	
++
+     /* If no str specified, use last ptr (if any). */
+     if (str == NULL)
+ 	str = *last;
+diff -up ./lib/util/sudo_conf.c.initialization ./lib/util/sudo_conf.c
+--- ./lib/util/sudo_conf.c.initialization	2015-07-22 14:22:49.000000000 +0200
++++ ./lib/util/sudo_conf.c	2015-08-18 13:28:28.142319494 +0200
+@@ -161,7 +161,7 @@ static int
+ parse_path(const char *entry, const char *conf_file, unsigned int lineno)
+ {
+     const char *entry_end = entry + strlen(entry);
+-    const char *ep, *name, *path;
++    const char *ep = NULL, *name, *path;
+     struct sudo_conf_path_table *cur;
+     size_t namelen;
+     debug_decl(parse_path, SUDO_DEBUG_UTIL)
+@@ -208,7 +208,7 @@ parse_debug(const char *entry, const cha
+ {
+     struct sudo_conf_debug *debug_spec;
+     struct sudo_debug_file *debug_file = NULL;
+-    const char *ep, *path, *progname, *flags;
++    const char *ep = NULL, *path, *progname, *flags;
+     const char *entry_end = entry + strlen(entry);
+     size_t pathlen, prognamelen;
+     debug_decl(parse_debug, SUDO_DEBUG_UTIL)
+@@ -278,7 +278,7 @@ static int
+ parse_plugin(const char *entry, const char *conf_file, unsigned int lineno)
+ {
+     struct plugin_info *info = NULL;
+-    const char *ep, *path, *symbol;
++    const char *ep = NULL, *path, *symbol;
+     const char *entry_end = entry + strlen(entry);
+     char **options = NULL;
+     size_t pathlen, symlen;
+diff -up ./plugins/sudoers/editor.c.initialization ./plugins/sudoers/editor.c
+--- ./plugins/sudoers/editor.c.initialization	2015-07-22 14:22:49.000000000 +0200
++++ ./plugins/sudoers/editor.c	2015-08-18 13:28:28.142319494 +0200
+@@ -45,7 +45,7 @@ resolve_editor(const char *ed, size_t ed
+     int *argc_out, char ***argv_out, char * const *whitelist)
+ {
+     char **nargv, *editor, *editor_path = NULL;
+-    const char *cp, *ep, *tmp;
++    const char *cp, *ep = NULL, *tmp;
+     const char *edend = ed + edlen;
+     struct stat user_editor_sb;
+     int nargc;
+diff -up ./plugins/sudoers/interfaces.c.initialization ./plugins/sudoers/interfaces.c
+--- ./plugins/sudoers/interfaces.c.initialization	2015-07-22 14:22:50.000000000 +0200
++++ ./plugins/sudoers/interfaces.c	2015-08-18 13:28:28.142319494 +0200
+@@ -109,7 +109,7 @@ get_interfaces(void)
+ void
+ dump_interfaces(const char *ai)
+ {
+-    const char *cp, *ep;
++    const char *cp, *ep = NULL;
+     const char *ai_end = ai + strlen(ai);
+     debug_decl(set_interfaces, SUDOERS_DEBUG_NETIF)
+ 
+diff -up ./plugins/sudoers/sudoers.c.initialization ./plugins/sudoers/sudoers.c
+--- ./plugins/sudoers/sudoers.c.initialization	2015-07-22 14:22:50.000000000 +0200
++++ ./plugins/sudoers/sudoers.c	2015-08-18 13:28:28.142319494 +0200
+@@ -1186,7 +1186,7 @@ sudoers_cleanup(void)
+ static char *
+ find_editor(int nfiles, char **files, int *argc_out, char ***argv_out)
+ {
+-    const char *cp, *ep, *editor = NULL;
++    const char *cp, *ep = NULL, *editor = NULL;
+     char *editor_path = NULL, **ev, *ev0[4];
+     debug_decl(find_editor, SUDOERS_DEBUG_PLUGIN)
+ 
+diff -up ./plugins/sudoers/sudoreplay.c.initialization ./plugins/sudoers/sudoreplay.c
+--- ./plugins/sudoers/sudoreplay.c.initialization	2015-07-22 14:22:49.000000000 +0200
++++ ./plugins/sudoers/sudoreplay.c	2015-08-18 13:39:53.776411920 +0200
+@@ -189,7 +189,7 @@ main(int argc, char *argv[])
+     int ch, idx, plen, exitcode = 0, rows = 0, cols = 0;
+     bool def_filter = true, listonly = false;
+     const char *decimal, *id, *user = NULL, *pattern = NULL, *tty = NULL;
+-    char *cp, *ep, path[PATH_MAX];
++    char *cp, *ep = NULL, path[PATH_MAX];
+     struct log_info *li;
+     double max_wait = 0;
+     debug_decl(main, SUDO_DEBUG_MAIN)
+@@ -225,6 +225,8 @@ main(int argc, char *argv[])
+ 	    /* Set the replay filter. */
+ 	    def_filter = false;
+ 	    for (cp = strtok_r(optarg, ",", &ep); cp; cp = strtok_r(NULL, ",", &ep)) {
++		if (ep == NULL)
++		    sudo_fatalx(U_("invalid filter option: %s"), optarg);
+ 		if (strcmp(cp, "stdout") == 0)
+ 		    io_log_files[IOFD_STDOUT].enabled = true;
+ 		else if (strcmp(cp, "stderr") == 0)
+diff -up ./plugins/sudoers/visudo.c.initialization ./plugins/sudoers/visudo.c
+--- ./plugins/sudoers/visudo.c.initialization	2015-07-22 14:22:50.000000000 +0200
++++ ./plugins/sudoers/visudo.c	2015-08-18 13:28:28.142319494 +0200
+@@ -287,7 +287,7 @@ get_editor(int *editor_argc, char ***edi
+ 
+     /* Build up editor whitelist from def_editor unless env_editor is set. */
+     if (!def_env_editor) {
+-	const char *cp, *ep;
++	const char *cp, *ep =  NULL;
+ 	const char *def_editor_end = def_editor + strlen(def_editor);
+ 
+ 	/* Count number of entries in whitelist and split into a list. */
+@@ -325,7 +325,7 @@ get_editor(int *editor_argc, char ***edi
+     if (editor_path == NULL) {
+ 	/* def_editor could be a path, split it up, avoiding strtok() */
+ 	const char *def_editor_end = def_editor + strlen(def_editor);
+-	const char *cp, *ep;
++	const char *cp, *ep = NULL;
+ 	for (cp = sudo_strsplit(def_editor, def_editor_end, ":", &ep);
+ 	    cp != NULL; cp = sudo_strsplit(NULL, def_editor_end, ":", &ep)) {
+ 	    editor_path = resolve_editor(cp, (size_t)(ep - cp), 2, files,
diff --git a/sudo.spec b/sudo.spec
index 1694a4a..be971ac 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.14p3
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -30,7 +30,11 @@ Patch1: sudo-1.6.7p5-strip.patch
 Patch2: sudo-1.8.14p1-ldapconfpatch.patch
 # Patch makes changes in documentation bz:1162070
 Patch3: sudo-1.8.14p1-docpassexpire.patch
-
+# Patch initialize variable before executing sudo_strsplit
+Patch4: sudo-1.8.14p3-initialization.patch
+# Patch resolves deadcode in visudo.c from coverity scan.
+Patch5: sudo-1.8.14p3-deadcode_visudo_c.patch
+Patch6: sudo-1.8.14p3-extra_while.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -58,6 +62,9 @@ plugins that use %{name}.
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .ldapconfpatch
 %patch3 -p1 -b .docpassexpire
+%patch4 -p1 -b .initialization
+%patch5 -p1 -b .deadcode
+%patch6 -p1 -b .extra_while
 
 %build
 # Remove bundled copy of zlib
@@ -193,6 +200,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-2
+- add patch that resolves initialization problem before sudo_strsplit call
+- add patch that resolves deadcode in visudo.c 
+- add patch that removes extra while in visudo.c and sudoers.c
+
 * Mon Jul 27 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-1
 - update to 1.8.14p3
 

From 2c03b0a9fd42c5bef1f17c8a0cd81a290f4238d1 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 24 Aug 2015 14:14:56 +0200
Subject: [PATCH 098/199] Enable upstream test suite

---
 sudo.spec | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index be971ac..5b65663 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.14p3
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -101,6 +101,9 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
 #       --without-kerb4
 make
 
+%check
+make check
+
 %install
 rm -rf $RPM_BUILD_ROOT
 make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
@@ -200,6 +203,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-3
+- enable upstream test suite
+
 * Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-2
 - add patch that resolves initialization problem before sudo_strsplit call
 - add patch that resolves deadcode in visudo.c 

From 2306938c7f56d8e99494475ceb451f5a164a2cde Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 5 Nov 2015 09:50:31 +0100
Subject: [PATCH 099/199] update to 1.8.15

- fixes CVE-2015-5602
---
 .gitignore                            |  1 +
 sources                               |  2 +-
 sudo-1.8.14p3-deadcode_visudo_c.patch | 40 ---------------------------
 sudo-1.8.14p3-extra_while.patch       | 24 ----------------
 sudo.spec                             | 13 ++++-----
 5 files changed, 8 insertions(+), 72 deletions(-)
 delete mode 100644 sudo-1.8.14p3-deadcode_visudo_c.patch
 delete mode 100644 sudo-1.8.14p3-extra_while.patch

diff --git a/.gitignore b/.gitignore
index 4eadd32..2f6d35c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.14b4.tar.gz
 /sudo-1.8.14p1.tar.gz
 /sudo-1.8.14p3.tar.gz
+/sudo-1.8.15.tar.gz
diff --git a/sources b/sources
index c91139d..a565d42 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers
-93dbd1e47c136179ff1b01494c1c0e75  sudo-1.8.14p3.tar.gz
+7cf6b9b76d0478a572432bed481dd7b5  sudo-1.8.15.tar.gz
diff --git a/sudo-1.8.14p3-deadcode_visudo_c.patch b/sudo-1.8.14p3-deadcode_visudo_c.patch
deleted file mode 100644
index 19a55e1..0000000
--- a/sudo-1.8.14p3-deadcode_visudo_c.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff -up ./plugins/sudoers/visudo.c.deadcode ./plugins/sudoers/visudo.c
---- ./plugins/sudoers/visudo.c.deadcode	2015-08-24 09:54:59.216956064 +0200
-+++ ./plugins/sudoers/visudo.c	2015-08-24 09:59:50.831547773 +0200
-@@ -415,12 +415,10 @@ edit_sudoers(struct sudoersfile *sp, cha
-     int tfd;				/* sudoers temp file descriptor */
-     bool modified;			/* was the file modified? */
-     int ac;				/* argument count */
--    char buf[4096];			/* buffer used for copying files */
-     char linestr[64];			/* string version of lineno */
-     struct timespec ts, times[2];	/* time before and after edit */
-     struct timespec orig_mtim;		/* starting mtime of sudoers file */
-     off_t orig_size;			/* starting size of sudoers file */
--    ssize_t nread;			/* number of bytes read */
-     struct stat sb;			/* stat buffer */
-     bool rval = false;			/* return value */
-     debug_decl(edit_sudoers, SUDOERS_DEBUG_UTIL)
-@@ -440,15 +438,19 @@ edit_sudoers(struct sudoersfile *sp, cha
- 
- 	/* Copy sp->path -> sp->tpath and reset the mtime. */
- 	if (orig_size != 0) {
-+	    char buf[4096], lastch = '\0';
-+	    ssize_t nread;
- 	    (void) lseek(sp->fd, (off_t)0, SEEK_SET);
--	    while ((nread = read(sp->fd, buf, sizeof(buf))) > 0)
-+	    while ((nread = read(sp->fd, buf, sizeof(buf))) > 0){
- 		if (write(tfd, buf, nread) != nread)
- 		    sudo_fatal(U_("write error"));
-+		lastch = buf[nread - 1];
-+	    }
- 
- 	    /* Add missing newline at EOF if needed. */
--	    if (nread > 0 && buf[nread - 1] != '\n') {
--		buf[0] = '\n';
--		if (write(tfd, buf, 1) != 1)
-+	    if (lastch != '\n') {
-+		lastch = '\n';
-+		if (write(tfd, &lastch, 1) != 1)    
- 		    sudo_fatal(U_("write error"));
- 	    }
- 	}
diff --git a/sudo-1.8.14p3-extra_while.patch b/sudo-1.8.14p3-extra_while.patch
deleted file mode 100644
index c7ff83e..0000000
--- a/sudo-1.8.14p3-extra_while.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff -up ./plugins/sudoers/sudoers.c.extra_while ./plugins/sudoers/sudoers.c
---- ./plugins/sudoers/sudoers.c.extra_while	2015-08-24 10:06:01.262987605 +0200
-+++ ./plugins/sudoers/sudoers.c	2015-08-24 10:07:16.557919240 +0200
-@@ -1214,7 +1214,7 @@ find_editor(int nfiles, char **files, in
- 		files, argc_out, argv_out, NULL);
- 	    if (editor_path == NULL && errno != ENOENT)
- 		debug_return_str(NULL);
--	} while (ep != NULL && editor_path == NULL);
-+	}
-     }
-     if (!editor_path) {
- 	audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
-diff -up ./plugins/sudoers/visudo.c.extra_while ./plugins/sudoers/visudo.c
---- ./plugins/sudoers/visudo.c.extra_while	2015-08-24 10:07:34.602902856 +0200
-+++ ./plugins/sudoers/visudo.c	2015-08-24 10:08:27.750854600 +0200
-@@ -332,7 +332,7 @@ get_editor(int *editor_argc, char ***edi
- 		editor_argc, editor_argv, whitelist);
- 	    if (editor_path == NULL && errno != ENOENT)
- 		debug_return_str(NULL);
--	} while (ep != NULL && editor_path == NULL);
-+    	}
-     }
-     if (editor_path == NULL)
- 	sudo_fatalx(U_("no editor found (editor path = %s)"), def_editor);
diff --git a/sudo.spec b/sudo.spec
index 5b65663..924a899 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.14p3
-Release: 3%{?dist}
+Version: 1.8.15
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -32,9 +32,6 @@ Patch2: sudo-1.8.14p1-ldapconfpatch.patch
 Patch3: sudo-1.8.14p1-docpassexpire.patch
 # Patch initialize variable before executing sudo_strsplit
 Patch4: sudo-1.8.14p3-initialization.patch
-# Patch resolves deadcode in visudo.c from coverity scan.
-Patch5: sudo-1.8.14p3-deadcode_visudo_c.patch
-Patch6: sudo-1.8.14p3-extra_while.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -63,8 +60,6 @@ plugins that use %{name}.
 %patch2 -p1 -b .ldapconfpatch
 %patch3 -p1 -b .docpassexpire
 %patch4 -p1 -b .initialization
-%patch5 -p1 -b .deadcode
-%patch6 -p1 -b .extra_while
 
 %build
 # Remove bundled copy of zlib
@@ -203,6 +198,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Thu Nov  5 2015 Daniel Kopecek <dkopecek@redhat.com> 1.8.15-1
+- update to 1.8.15
+- fixes CVE-2015-5602
+
 * Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-3
 - enable upstream test suite
 

From 8ef2445bcd48156d35e535f31c298d945eca115d Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 5 Feb 2016 00:48:28 +0000
Subject: [PATCH 100/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 924a899..dc02960 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.15
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -198,6 +198,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.15-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
 * Thu Nov  5 2015 Daniel Kopecek <dkopecek@redhat.com> 1.8.15-1
 - update to 1.8.15
 - fixes CVE-2015-5602

From df8acf06e9289b5eb548c471b1f03ae98658b975 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 5 Apr 2016 12:52:51 +0200
Subject: [PATCH 101/199] update to 1.8.16

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 7 +++++--
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 2f6d35c..d5d6c38 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,4 @@ sudo-1.7.2p2-sudoers
 /sudo-1.8.14p1.tar.gz
 /sudo-1.8.14p3.tar.gz
 /sudo-1.8.15.tar.gz
+/sudo-1.8.16.tar.gz
diff --git a/sources b/sources
index a565d42..fbe3514 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
+a977449587dc857e129bb20555b46af4  sudo-1.8.16.tar.gz
 775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers
-7cf6b9b76d0478a572432bed481dd7b5  sudo-1.8.15.tar.gz
diff --git a/sudo.spec b/sudo.spec
index dc02960..7f54c1f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.15
-Release: 2%{?dist}
+Version: 1.8.16
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -198,6 +198,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Mon Apr 04 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-1
+- update to 1.8.16
+
 * Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.15-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
 

From c0063cebde36c95e2d7b0aabb2ebc4f83475e789 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 12 May 2016 09:33:11 +0200
Subject: [PATCH 102/199] fixed invalid sesh argument array construction

---
 sudo-1.8.16-seshargsfix.patch | 41 +++++++++++++++++++++++++++++++++++
 sudo.spec                     |  8 ++++++-
 2 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 sudo-1.8.16-seshargsfix.patch

diff --git a/sudo-1.8.16-seshargsfix.patch b/sudo-1.8.16-seshargsfix.patch
new file mode 100644
index 0000000..43418bc
--- /dev/null
+++ b/sudo-1.8.16-seshargsfix.patch
@@ -0,0 +1,41 @@
+diff -up sudo-1.8.16/src/selinux.c.seshargsfix sudo-1.8.16/src/selinux.c
+--- sudo-1.8.16/src/selinux.c.seshargsfix	2016-03-17 17:13:10.000000000 +0100
++++ sudo-1.8.16/src/selinux.c	2016-05-12 09:29:14.687014460 +0200
+@@ -378,7 +378,7 @@ selinux_execve(int fd, const char *path,
+ {
+     char **nargv;
+     const char *sesh;
+-    int argc, serrno;
++    int argc, nargc, serrno;
+     debug_decl(selinux_execve, SUDO_DEBUG_SELINUX)
+ 
+     sesh = sudo_conf_sesh_path();
+@@ -409,9 +409,7 @@ selinux_execve(int fd, const char *path,
+      */
+     for (argc = 0; argv[argc] != NULL; argc++)
+ 	continue;
+-    if (fd != -1)
+-	argc++;
+-    nargv = reallocarray(NULL, argc + 2, sizeof(char *));
++    nargv = reallocarray(NULL, argc + 3, sizeof(char *));
+     if (nargv == NULL) {
+ 	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
+ 	debug_return;
+@@ -420,13 +418,13 @@ selinux_execve(int fd, const char *path,
+ 	nargv[0] = *argv[0] == '-' ? "-sesh-noexec" : "sesh-noexec";
+     else
+ 	nargv[0] = *argv[0] == '-' ? "-sesh" : "sesh";
+-    argc = 1;
+-    if (fd != -1 && asprintf(&nargv[argc++], "--execfd=%d", fd) == -1) {
++    nargc = 1;
++    if (fd != -1 && asprintf(&nargv[nargc++], "--execfd=%d", fd) == -1) {
+ 	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
+ 	debug_return;
+     }
+-    nargv[argc] = (char *)path;
+-    memcpy(&nargv[argc + 1], &argv[argc], argc * sizeof(char *)); /* copies NULL */
++    nargv[nargc++] = (char *)path;
++    memcpy(&nargv[nargc], &argv[argc], argc * sizeof(char *)); /* copies NULL */
+ 
+     /* sesh will handle noexec for us. */
+     sudo_execve(-1, sesh, nargv, envp, false);
diff --git a/sudo.spec b/sudo.spec
index 7f54c1f..3b7ffdb 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.16
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -32,6 +32,8 @@ Patch2: sudo-1.8.14p1-ldapconfpatch.patch
 Patch3: sudo-1.8.14p1-docpassexpire.patch
 # Patch initialize variable before executing sudo_strsplit
 Patch4: sudo-1.8.14p3-initialization.patch
+# 1328735 - Weird sudo issue that seems to be selinux related
+Patch5: sudo-1.8.16-seshargsfix.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -60,6 +62,7 @@ plugins that use %{name}.
 %patch2 -p1 -b .ldapconfpatch
 %patch3 -p1 -b .docpassexpire
 %patch4 -p1 -b .initialization
+%patch5 -p1 -b .seshargsfix
 
 %build
 # Remove bundled copy of zlib
@@ -198,6 +201,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Thu May 12 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-2
+- fixed invalid sesh argument array construction
+
 * Mon Apr 04 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-1
 - update to 1.8.16
 

From 333fe38779954fac76c08e681613c717032f81e9 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Fri, 13 May 2016 11:28:06 +0200
Subject: [PATCH 103/199] fixed upstream patch for rhbz#1328735

---
 sudo-1.8.16-seshargsfix.patch | 4 ++--
 sudo.spec                     | 5 ++++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/sudo-1.8.16-seshargsfix.patch b/sudo-1.8.16-seshargsfix.patch
index 43418bc..725fe75 100644
--- a/sudo-1.8.16-seshargsfix.patch
+++ b/sudo-1.8.16-seshargsfix.patch
@@ -1,6 +1,6 @@
 diff -up sudo-1.8.16/src/selinux.c.seshargsfix sudo-1.8.16/src/selinux.c
 --- sudo-1.8.16/src/selinux.c.seshargsfix	2016-03-17 17:13:10.000000000 +0100
-+++ sudo-1.8.16/src/selinux.c	2016-05-12 09:29:14.687014460 +0200
++++ sudo-1.8.16/src/selinux.c	2016-05-13 11:14:04.628296996 +0200
 @@ -378,7 +378,7 @@ selinux_execve(int fd, const char *path,
  {
      char **nargv;
@@ -35,7 +35,7 @@ diff -up sudo-1.8.16/src/selinux.c.seshargsfix sudo-1.8.16/src/selinux.c
 -    nargv[argc] = (char *)path;
 -    memcpy(&nargv[argc + 1], &argv[argc], argc * sizeof(char *)); /* copies NULL */
 +    nargv[nargc++] = (char *)path;
-+    memcpy(&nargv[nargc], &argv[argc], argc * sizeof(char *)); /* copies NULL */
++    memcpy(&nargv[nargc], &argv[1], argc * sizeof(char *)); /* copies NULL */
  
      /* sesh will handle noexec for us. */
      sudo_execve(-1, sesh, nargv, envp, false);
diff --git a/sudo.spec b/sudo.spec
index 3b7ffdb..c79d71a 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.16
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -201,6 +201,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Fri May 13 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-3
+- fixed upstream patch for rhbz#1328735
+
 * Thu May 12 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-2
 - fixed invalid sesh argument array construction
 

From ffcdc7d6302750951b888f0b15be2242b738dbfd Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 31 May 2016 12:22:54 +0200
Subject: [PATCH 104/199] Track the default sudoers file in git

---
 .gitignore | 21 ------------
 sources    |  1 -
 sudo.spec  |  2 +-
 sudoers    | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 97 insertions(+), 23 deletions(-)
 create mode 100644 sudoers

diff --git a/.gitignore b/.gitignore
index d5d6c38..f68bf75 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,22 +1 @@
-sudo-1.7.2p6.tar.gz
-sudo-1.7.2p2-sudoers
-/sudo-1.7.4p4.tar.gz
-/sudo-1.7.2p2-sudoers
-/sudo-1.7.4p4-sudoers
-/sudo-1.7.4p5.tar.gz
-/sudo-1.8.1p2.tar.gz
-/sudo-1.8.3p1.tar.gz
-/sudo-1.8.5.tar.gz
-/sudo-1.8.6.tar.gz
-/sudo-1.8.6p3.tar.gz
-/sudo-1.8.6p7.tar.gz
-/sudo-1.8.8.tar.gz
-/sudo-1.8.8-sudoers
-/sudo-1.8.11.tar.gz
-/sudo-1.8.11p2.tar.gz
-/sudo-1.8.12.tar.gz
-/sudo-1.8.14b4.tar.gz
-/sudo-1.8.14p1.tar.gz
-/sudo-1.8.14p3.tar.gz
-/sudo-1.8.15.tar.gz
 /sudo-1.8.16.tar.gz
diff --git a/sources b/sources
index fbe3514..41f39d1 100644
--- a/sources
+++ b/sources
@@ -1,2 +1 @@
 a977449587dc857e129bb20555b46af4  sudo-1.8.16.tar.gz
-775b863cdff3a2ee2a26c2d53b51aff5  sudo-1.8.8-sudoers
diff --git a/sudo.spec b/sudo.spec
index c79d71a..c0be7f3 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -6,7 +6,7 @@ License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
 Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
-Source1: sudo-1.8.8-sudoers
+Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth
 Requires: /usr/bin/vi
diff --git a/sudoers b/sudoers
new file mode 100644
index 0000000..be6332f
--- /dev/null
+++ b/sudoers
@@ -0,0 +1,96 @@
+## Sudoers allows particular users to run various commands as
+## the root user, without needing the root password.
+##
+## Examples are provided at the bottom of the file for collections
+## of related commands, which can then be delegated out to particular
+## users or groups.
+## 
+## This file must be edited with the 'visudo' command.
+
+## Host Aliases
+## Groups of machines. You may prefer to use hostnames (perhaps using 
+## wildcards for entire domains) or IP addresses instead.
+# Host_Alias     FILESERVERS = fs1, fs2
+# Host_Alias     MAILSERVERS = smtp, smtp2
+
+## User Aliases
+## These aren't often necessary, as you can use regular groups
+## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
+## rather than USERALIAS
+# User_Alias ADMINS = jsmith, mikem
+
+
+## Command Aliases
+## These are groups of related commands...
+
+## Networking
+# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
+
+## Installation and management of software
+# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
+
+## Services
+# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
+
+## Updating the locate database
+# Cmnd_Alias LOCATE = /usr/bin/updatedb
+
+## Storage
+# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
+
+## Delegating permissions
+# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 
+
+## Processes
+# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
+
+## Drivers
+# Cmnd_Alias DRIVERS = /sbin/modprobe
+
+# Defaults specification
+
+#
+# Refuse to run if unable to disable echo on the tty.
+#
+Defaults   !visiblepw
+
+Defaults    env_reset
+Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
+Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
+Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
+Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
+Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
+
+Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
+
+## Next comes the main part: which users can run what software on 
+## which machines (the sudoers file can be shared between multiple
+## systems).
+## Syntax:
+##
+## 	user	MACHINE=COMMANDS
+##
+## The COMMANDS section may have other options added to it.
+##
+## Allow root to run any commands anywhere 
+root	ALL=(ALL) 	ALL
+
+## Allows members of the 'sys' group to run networking, software, 
+## service management apps and more.
+# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
+
+## Allows people in group wheel to run all commands
+%wheel	ALL=(ALL)	ALL
+
+## Same thing without a password
+# %wheel	ALL=(ALL)	NOPASSWD: ALL
+
+## Allows members of the users group to mount and unmount the 
+## cdrom as root
+# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
+
+## Allows members of the users group to shutdown this system
+# %users  localhost=/sbin/shutdown -h now
+
+## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
+#includedir /etc/sudoers.d

From d3ea02b0f5beaed895802c0982fa0244a114a665 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Tue, 31 May 2016 14:17:26 +0200
Subject: [PATCH 105/199] removed INPUTRC from env_keep to prevent a possible
 info leak

  Resolves: rhbz#1340701
---
 sudo.spec | 6 +++++-
 sudoers   | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index c0be7f3..d86bffe 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.16
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -201,6 +201,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Tue May 31 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-4
+- removed INPUTRC from env_keep to prevent a possible info leak
+  Resolves: rhbz#1340701
+
 * Fri May 13 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-3
 - fixed upstream patch for rhbz#1328735
 
diff --git a/sudoers b/sudoers
index be6332f..bc4d793 100644
--- a/sudoers
+++ b/sudoers
@@ -55,7 +55,7 @@
 Defaults   !visiblepw
 
 Defaults    env_reset
-Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
+Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
 Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
 Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
 Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"

From 932e467d11e64ff654cadaf7d80a90593c0291b4 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <mildew@fedoraproject.org>
Date: Fri, 24 Jun 2016 16:22:57 +0200
Subject: [PATCH 106/199] update to 1.8.17p1

- install the /var/db/sudo/lectured
  Resolves: rhbz#1321414
---
 .gitignore                         |   1 +
 sources                            |   2 +-
 sudo-1.7.2p1-envdebug.patch        |  12 ---
 sudo-1.8.11p2-auditfix.patch       |  17 ----
 sudo-1.8.14p1-docpassexpire.patch  |  38 ---------
 sudo-1.8.14p3-initialization.patch | 122 -----------------------------
 sudo-1.8.16-seshargsfix.patch      |  41 ----------
 sudo-1.8.8-clangbugs.patch         |  60 --------------
 sudo-1.8.8-sssdfixes.patch         | 119 ----------------------------
 sudo-1.8.8-strictuidgid.patch      |  53 -------------
 sudo.spec                          |  20 +++--
 11 files changed, 11 insertions(+), 474 deletions(-)
 delete mode 100644 sudo-1.7.2p1-envdebug.patch
 delete mode 100644 sudo-1.8.11p2-auditfix.patch
 delete mode 100644 sudo-1.8.14p1-docpassexpire.patch
 delete mode 100644 sudo-1.8.14p3-initialization.patch
 delete mode 100644 sudo-1.8.16-seshargsfix.patch
 delete mode 100644 sudo-1.8.8-clangbugs.patch
 delete mode 100644 sudo-1.8.8-sssdfixes.patch
 delete mode 100644 sudo-1.8.8-strictuidgid.patch

diff --git a/.gitignore b/.gitignore
index f68bf75..04f884a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 /sudo-1.8.16.tar.gz
+/sudo-1.8.17p1.tar.gz
diff --git a/sources b/sources
index 41f39d1..9534406 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-a977449587dc857e129bb20555b46af4  sudo-1.8.16.tar.gz
+50a840a688ceb6fa3ab24fc0adf4fa23  sudo-1.8.17p1.tar.gz
diff --git a/sudo-1.7.2p1-envdebug.patch b/sudo-1.7.2p1-envdebug.patch
deleted file mode 100644
index e189c98..0000000
--- a/sudo-1.7.2p1-envdebug.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up sudo-1.7.2p1/configure.in.envdebug sudo-1.7.2p1/configure.in
---- sudo-1.7.2p1/configure.in.envdebug	2009-10-30 12:18:09.000000000 +0100
-+++ sudo-1.7.2p1/configure.in	2009-10-30 12:19:01.000000000 +0100
-@@ -1214,7 +1214,7 @@ AC_ARG_ENABLE(env_debug,
- [AS_HELP_STRING([--enable-env-debug], [Whether to enable environment debugging.])],
- [ case "$enableval" in
-     yes)	AC_MSG_RESULT(yes)
--		AC_DEFINE(ENV_DEBUG)
-+		AC_DEFINE(ENV_DEBUG, [], [Environment debugging.])
- 		;;
-     no)		AC_MSG_RESULT(no)
- 		;;
diff --git a/sudo-1.8.11p2-auditfix.patch b/sudo-1.8.11p2-auditfix.patch
deleted file mode 100644
index 963ef4e..0000000
--- a/sudo-1.8.11p2-auditfix.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff -up sudo-1.8.11p2/plugins/sudoers/linux_audit.c.auditfix sudo-1.8.11p2/plugins/sudoers/linux_audit.c
---- sudo-1.8.11p2/plugins/sudoers/linux_audit.c.auditfix	2014-11-03 12:44:53.674230966 +0100
-+++ sudo-1.8.11p2/plugins/sudoers/linux_audit.c	2014-11-03 12:45:13.407021599 +0100
-@@ -57,10 +57,10 @@ linux_audit_open(void)
-     au_fd = audit_open();
-     if (au_fd == -1) {
- 	/* Kernel may not have audit support. */
--	if (errno != EINVAL && errno != EPROTONOSUPPORT && errno != EAFNOSUPPORT) {
--	    sudo_warn(U_("unable to open audit system"));
-+	if (errno == EINVAL || errno == EPROTONOSUPPORT || errno == EAFNOSUPPORT)
- 	    au_fd = AUDIT_NOT_CONFIGURED;
--	}
-+	else
-+	    sudo_warn(U_("unable to open audit system"));
-     } else {
- 	(void)fcntl(au_fd, F_SETFD, FD_CLOEXEC);
-     }
diff --git a/sudo-1.8.14p1-docpassexpire.patch b/sudo-1.8.14p1-docpassexpire.patch
deleted file mode 100644
index cb7fe8a..0000000
--- a/sudo-1.8.14p1-docpassexpire.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-diff -up sudo-1.8.14b4/doc/sudoers.cat.docpassexpire sudo-1.8.14b4/doc/sudoers.cat
---- sudo-1.8.14b4/doc/sudoers.cat.docpassexpire	2015-06-09 00:47:07.000000000 +0200
-+++ sudo-1.8.14b4/doc/sudoers.cat	2015-07-14 13:11:11.116000185 +0200
-@@ -1328,8 +1328,8 @@ SSUUDDOOEERRSS OOPPTTIIOONN
-                        fractional component if minute granularity is
-                        insufficient, for example 2.5.  The default is 5.  Set
-                        this to 0 to always prompt for a password.  If set to a
--                       value less than 0 the user's time stamp will never
--                       expire.  This can be used to allow users to create or
-+                       value less than 0 the user's time stamp will not
-+                       expire until reboot.  This can be used to allow users to create or
-                        delete their own time stamps via ``sudo -v'' and ``sudo
-                        -k'' respectively.
- 
-diff -up sudo-1.8.14b4/doc/sudoers.man.in.docpassexpire sudo-1.8.14b4/doc/sudoers.man.in
---- sudo-1.8.14b4/doc/sudoers.man.in.docpassexpire	2015-07-14 13:11:11.116000185 +0200
-+++ sudo-1.8.14b4/doc/sudoers.man.in	2015-07-14 13:14:17.261222481 +0200
-@@ -2822,7 +2822,7 @@ Set this to
- to always prompt for a password.
- If set to a value less than
- \fR0\fR
--the user's time stamp will never expire.
-+the user's time stamp will not expire until reboot.
- This can be used to allow users to create or delete their own time stamps via
- \(Lq\fRsudo -v\fR\(Rq
- and
-diff -up sudo-1.8.14b4/doc/sudoers.mdoc.in.docpassexpire sudo-1.8.14b4/doc/sudoers.mdoc.in
---- sudo-1.8.14b4/doc/sudoers.mdoc.in.docpassexpire	2015-04-07 18:15:50.000000000 +0200
-+++ sudo-1.8.14b4/doc/sudoers.mdoc.in	2015-07-14 13:11:11.117000176 +0200
-@@ -2647,7 +2647,7 @@ Set this to
- to always prompt for a password.
- If set to a value less than
- .Li 0
--the user's time stamp will never expire.
-+the user's time stamp will not expire until reboot.
- This can be used to allow users to create or delete their own time stamps via
- .Dq Li sudo -v
- and
diff --git a/sudo-1.8.14p3-initialization.patch b/sudo-1.8.14p3-initialization.patch
deleted file mode 100644
index 75da7fd..0000000
--- a/sudo-1.8.14p3-initialization.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-diff -up ./lib/util/strsplit.c.initialization ./lib/util/strsplit.c
---- ./lib/util/strsplit.c.initialization	2015-07-22 14:22:49.000000000 +0200
-+++ ./lib/util/strsplit.c	2015-08-18 13:28:28.141319501 +0200
-@@ -37,6 +37,10 @@ sudo_strsplit_v1(const char *str, const
-     const char *cp, *s;
-     debug_decl(sudo_strsplit, SUDO_DEBUG_UTIL)
- 
-+    /* exclusion of two NULLs at the same time */
-+    if (str == NULL && *last == NULL)
-+	debug_return_ptr(NULL);	
-+
-     /* If no str specified, use last ptr (if any). */
-     if (str == NULL)
- 	str = *last;
-diff -up ./lib/util/sudo_conf.c.initialization ./lib/util/sudo_conf.c
---- ./lib/util/sudo_conf.c.initialization	2015-07-22 14:22:49.000000000 +0200
-+++ ./lib/util/sudo_conf.c	2015-08-18 13:28:28.142319494 +0200
-@@ -161,7 +161,7 @@ static int
- parse_path(const char *entry, const char *conf_file, unsigned int lineno)
- {
-     const char *entry_end = entry + strlen(entry);
--    const char *ep, *name, *path;
-+    const char *ep = NULL, *name, *path;
-     struct sudo_conf_path_table *cur;
-     size_t namelen;
-     debug_decl(parse_path, SUDO_DEBUG_UTIL)
-@@ -208,7 +208,7 @@ parse_debug(const char *entry, const cha
- {
-     struct sudo_conf_debug *debug_spec;
-     struct sudo_debug_file *debug_file = NULL;
--    const char *ep, *path, *progname, *flags;
-+    const char *ep = NULL, *path, *progname, *flags;
-     const char *entry_end = entry + strlen(entry);
-     size_t pathlen, prognamelen;
-     debug_decl(parse_debug, SUDO_DEBUG_UTIL)
-@@ -278,7 +278,7 @@ static int
- parse_plugin(const char *entry, const char *conf_file, unsigned int lineno)
- {
-     struct plugin_info *info = NULL;
--    const char *ep, *path, *symbol;
-+    const char *ep = NULL, *path, *symbol;
-     const char *entry_end = entry + strlen(entry);
-     char **options = NULL;
-     size_t pathlen, symlen;
-diff -up ./plugins/sudoers/editor.c.initialization ./plugins/sudoers/editor.c
---- ./plugins/sudoers/editor.c.initialization	2015-07-22 14:22:49.000000000 +0200
-+++ ./plugins/sudoers/editor.c	2015-08-18 13:28:28.142319494 +0200
-@@ -45,7 +45,7 @@ resolve_editor(const char *ed, size_t ed
-     int *argc_out, char ***argv_out, char * const *whitelist)
- {
-     char **nargv, *editor, *editor_path = NULL;
--    const char *cp, *ep, *tmp;
-+    const char *cp, *ep = NULL, *tmp;
-     const char *edend = ed + edlen;
-     struct stat user_editor_sb;
-     int nargc;
-diff -up ./plugins/sudoers/interfaces.c.initialization ./plugins/sudoers/interfaces.c
---- ./plugins/sudoers/interfaces.c.initialization	2015-07-22 14:22:50.000000000 +0200
-+++ ./plugins/sudoers/interfaces.c	2015-08-18 13:28:28.142319494 +0200
-@@ -109,7 +109,7 @@ get_interfaces(void)
- void
- dump_interfaces(const char *ai)
- {
--    const char *cp, *ep;
-+    const char *cp, *ep = NULL;
-     const char *ai_end = ai + strlen(ai);
-     debug_decl(set_interfaces, SUDOERS_DEBUG_NETIF)
- 
-diff -up ./plugins/sudoers/sudoers.c.initialization ./plugins/sudoers/sudoers.c
---- ./plugins/sudoers/sudoers.c.initialization	2015-07-22 14:22:50.000000000 +0200
-+++ ./plugins/sudoers/sudoers.c	2015-08-18 13:28:28.142319494 +0200
-@@ -1186,7 +1186,7 @@ sudoers_cleanup(void)
- static char *
- find_editor(int nfiles, char **files, int *argc_out, char ***argv_out)
- {
--    const char *cp, *ep, *editor = NULL;
-+    const char *cp, *ep = NULL, *editor = NULL;
-     char *editor_path = NULL, **ev, *ev0[4];
-     debug_decl(find_editor, SUDOERS_DEBUG_PLUGIN)
- 
-diff -up ./plugins/sudoers/sudoreplay.c.initialization ./plugins/sudoers/sudoreplay.c
---- ./plugins/sudoers/sudoreplay.c.initialization	2015-07-22 14:22:49.000000000 +0200
-+++ ./plugins/sudoers/sudoreplay.c	2015-08-18 13:39:53.776411920 +0200
-@@ -189,7 +189,7 @@ main(int argc, char *argv[])
-     int ch, idx, plen, exitcode = 0, rows = 0, cols = 0;
-     bool def_filter = true, listonly = false;
-     const char *decimal, *id, *user = NULL, *pattern = NULL, *tty = NULL;
--    char *cp, *ep, path[PATH_MAX];
-+    char *cp, *ep = NULL, path[PATH_MAX];
-     struct log_info *li;
-     double max_wait = 0;
-     debug_decl(main, SUDO_DEBUG_MAIN)
-@@ -225,6 +225,8 @@ main(int argc, char *argv[])
- 	    /* Set the replay filter. */
- 	    def_filter = false;
- 	    for (cp = strtok_r(optarg, ",", &ep); cp; cp = strtok_r(NULL, ",", &ep)) {
-+		if (ep == NULL)
-+		    sudo_fatalx(U_("invalid filter option: %s"), optarg);
- 		if (strcmp(cp, "stdout") == 0)
- 		    io_log_files[IOFD_STDOUT].enabled = true;
- 		else if (strcmp(cp, "stderr") == 0)
-diff -up ./plugins/sudoers/visudo.c.initialization ./plugins/sudoers/visudo.c
---- ./plugins/sudoers/visudo.c.initialization	2015-07-22 14:22:50.000000000 +0200
-+++ ./plugins/sudoers/visudo.c	2015-08-18 13:28:28.142319494 +0200
-@@ -287,7 +287,7 @@ get_editor(int *editor_argc, char ***edi
- 
-     /* Build up editor whitelist from def_editor unless env_editor is set. */
-     if (!def_env_editor) {
--	const char *cp, *ep;
-+	const char *cp, *ep =  NULL;
- 	const char *def_editor_end = def_editor + strlen(def_editor);
- 
- 	/* Count number of entries in whitelist and split into a list. */
-@@ -325,7 +325,7 @@ get_editor(int *editor_argc, char ***edi
-     if (editor_path == NULL) {
- 	/* def_editor could be a path, split it up, avoiding strtok() */
- 	const char *def_editor_end = def_editor + strlen(def_editor);
--	const char *cp, *ep;
-+	const char *cp, *ep = NULL;
- 	for (cp = sudo_strsplit(def_editor, def_editor_end, ":", &ep);
- 	    cp != NULL; cp = sudo_strsplit(NULL, def_editor_end, ":", &ep)) {
- 	    editor_path = resolve_editor(cp, (size_t)(ep - cp), 2, files,
diff --git a/sudo-1.8.16-seshargsfix.patch b/sudo-1.8.16-seshargsfix.patch
deleted file mode 100644
index 725fe75..0000000
--- a/sudo-1.8.16-seshargsfix.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-diff -up sudo-1.8.16/src/selinux.c.seshargsfix sudo-1.8.16/src/selinux.c
---- sudo-1.8.16/src/selinux.c.seshargsfix	2016-03-17 17:13:10.000000000 +0100
-+++ sudo-1.8.16/src/selinux.c	2016-05-13 11:14:04.628296996 +0200
-@@ -378,7 +378,7 @@ selinux_execve(int fd, const char *path,
- {
-     char **nargv;
-     const char *sesh;
--    int argc, serrno;
-+    int argc, nargc, serrno;
-     debug_decl(selinux_execve, SUDO_DEBUG_SELINUX)
- 
-     sesh = sudo_conf_sesh_path();
-@@ -409,9 +409,7 @@ selinux_execve(int fd, const char *path,
-      */
-     for (argc = 0; argv[argc] != NULL; argc++)
- 	continue;
--    if (fd != -1)
--	argc++;
--    nargv = reallocarray(NULL, argc + 2, sizeof(char *));
-+    nargv = reallocarray(NULL, argc + 3, sizeof(char *));
-     if (nargv == NULL) {
- 	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
- 	debug_return;
-@@ -420,13 +418,13 @@ selinux_execve(int fd, const char *path,
- 	nargv[0] = *argv[0] == '-' ? "-sesh-noexec" : "sesh-noexec";
-     else
- 	nargv[0] = *argv[0] == '-' ? "-sesh" : "sesh";
--    argc = 1;
--    if (fd != -1 && asprintf(&nargv[argc++], "--execfd=%d", fd) == -1) {
-+    nargc = 1;
-+    if (fd != -1 && asprintf(&nargv[nargc++], "--execfd=%d", fd) == -1) {
- 	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
- 	debug_return;
-     }
--    nargv[argc] = (char *)path;
--    memcpy(&nargv[argc + 1], &argv[argc], argc * sizeof(char *)); /* copies NULL */
-+    nargv[nargc++] = (char *)path;
-+    memcpy(&nargv[nargc], &argv[1], argc * sizeof(char *)); /* copies NULL */
- 
-     /* sesh will handle noexec for us. */
-     sudo_execve(-1, sesh, nargv, envp, false);
diff --git a/sudo-1.8.8-clangbugs.patch b/sudo-1.8.8-clangbugs.patch
deleted file mode 100644
index 9d4f1cb..0000000
--- a/sudo-1.8.8-clangbugs.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-diff -up sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs sudo-1.8.8/plugins/sudoers/auth/pam.c
---- sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs	2013-09-30 23:41:07.899529555 +0200
-+++ sudo-1.8.8/plugins/sudoers/auth/pam.c	2013-09-30 23:41:58.988707761 +0200
-@@ -246,6 +246,7 @@ sudo_pam_begin_session(struct passwd *pw
- 	    (void) pam_end(pamh, *pam_status | PAM_DATA_SILENT);
- 	    pamh = NULL;
- 	    status = AUTH_FAILURE;
-+	    goto done;
- 	}
-     }
- 
-diff -up sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs sudo-1.8.8/plugins/sudoers/sssd.c
---- sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs	2013-09-30 23:44:20.404200629 +0200
-+++ sudo-1.8.8/plugins/sudoers/sssd.c	2013-09-30 23:49:05.998194738 +0200
-@@ -310,11 +310,10 @@ static int sudo_sss_close(struct sudo_ns
-     debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD);
- 
-     if (nss && nss->handle) {
--	handle = nss->handle;
--	dlclose(handle->ssslib);
-+	    handle = nss->handle;
-+	    dlclose(handle->ssslib);
-+	    efree(nss->handle);
-     }
--
--    efree(nss->handle);
-     debug_return_int(0);
- }
- 
-@@ -705,17 +704,21 @@ sudo_sss_result_get(struct sudo_nss *nss
- 	sudo_sss_result_filterp, _SUDO_SSS_FILTER_INCLUDE, NULL);
- 
-     if (f_sss_result != NULL) {
--	if (f_sss_result->num_rules > 0) {
--	    if (state != NULL) {
--		sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH");
--		*state |= _SUDO_SSS_STATE_HOSTMATCH;
-+	    if (f_sss_result->num_rules > 0) {
-+		    if (state != NULL) {
-+			    sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH");
-+			    *state |= _SUDO_SSS_STATE_HOSTMATCH;
-+		    }
- 	    }
--	}
--    }
- 
--    sudo_debug_printf(SUDO_DEBUG_DEBUG,
--	"u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result,
--	u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
-+	    sudo_debug_printf(SUDO_DEBUG_DEBUG,
-+	                      "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result,
-+	                      u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
-+    } else {
-+	    sudo_debug_printf(SUDO_DEBUG_DEBUG,
-+	                      "u_sss_result=(%p, %u) => f_sss_result=NULL",
-+	                      u_sss_result, u_sss_result->num_rules);
-+    }
- 
-     handle->fn_free_result(u_sss_result);
- 
diff --git a/sudo-1.8.8-sssdfixes.patch b/sudo-1.8.8-sssdfixes.patch
deleted file mode 100644
index 31edde6..0000000
--- a/sudo-1.8.8-sssdfixes.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-diff -up sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes sudo-1.8.8/plugins/sudoers/sssd.c
---- sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes	2013-09-30 23:18:49.641913457 +0200
-+++ sudo-1.8.8/plugins/sudoers/sssd.c	2013-09-30 23:25:54.819376696 +0200
-@@ -534,30 +534,31 @@ sudo_sss_check_runas_group(struct sudo_s
-  * Walk through search results and return true if we have a runas match,
-  * else false.  RunAs info is optional.
-  */
--static int
-+static bool
- sudo_sss_check_runas(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
- {
--    int ret;
-+    bool ret;
-     debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD);
- 
-     if (rule == NULL)
--	 debug_return_int(false);
-+	 debug_return_bool(false);
- 
-     ret = sudo_sss_check_runas_user(handle, rule) != false &&
- 	 sudo_sss_check_runas_group(handle, rule) != false;
- 
--    debug_return_int(ret);
-+    debug_return_bool(ret);
- }
- 
--static int
-+static bool
- sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
- {
-     char **val_array, *val;
--    int ret = false, i;
-+    bool ret = false;
-+    int i;
-     debug_decl(sudo_sss_check_host, SUDO_DEBUG_SSSD);
- 
-     if (rule == NULL)
--	debug_return_int(ret);
-+	debug_return_bool(ret);
- 
-     /* get the values from the rule */
-     switch (handle->fn_get_values(rule, "sudoHost", &val_array))
-@@ -566,10 +567,10 @@ sudo_sss_check_host(struct sudo_sss_hand
- 	break;
-     case ENOENT:
- 	sudo_debug_printf(SUDO_DEBUG_INFO, "No result.");
--	debug_return_int(false);
-+	debug_return_bool(false);
-     default:
- 	sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoHost): != 0");
--	debug_return_int(ret);
-+	debug_return_bool(ret);
-     }
- 
-     /* walk through values */
-@@ -589,7 +590,52 @@ sudo_sss_check_host(struct sudo_sss_hand
- 
-     handle->fn_free_values(val_array);
- 
--    debug_return_int(ret);
-+    debug_return_bool(ret);
-+}
-+
-+/*
-+ * Look for netgroup specifcations in the sudoUser attribute and
-+ * if found, filter according to netgroup membership.
-+ *  returns:
-+ *   true -> netgroup spec found && negroup member
-+ *  false -> netgroup spec found && not a meber of netgroup
-+ *   true -> netgroup spec not found (filtered by SSSD already, netgroups are an exception)
-+ */
-+bool sudo_sss_filter_user_netgroup(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
-+{
-+	bool ret = false, netgroup_spec_found = false;
-+	char **val_array, *val;
-+	int i;
-+	debug_decl(sudo_sss_check_user_netgroup, SUDO_DEBUG_SSSD);
-+
-+	if (!handle || !rule)
-+		debug_return_bool(ret);
-+
-+	switch (handle->fn_get_values(rule, "sudoUser", &val_array)) {
-+		case 0:
-+			break;
-+		case ENOENT:
-+			sudo_debug_printf(SUDO_DEBUG_INFO, "No result.");
-+			debug_return_bool(ret);
-+		default:
-+			sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoUser): != 0");
-+			debug_return_bool(ret);
-+	}
-+
-+	for (i = 0; val_array[i] != NULL && !ret; ++i) {
-+		val = val_array[i];
-+		if (*val == '+') {
-+			netgroup_spec_found = true;
-+		}
-+		sudo_debug_printf(SUDO_DEBUG_DEBUG, "val[%d]=%s", i, val);
-+		if (strcmp(val, "ALL") == 0 || netgr_matches(val, NULL, NULL, user_name)) {
-+			ret = true;
-+			sudo_debug_printf(SUDO_DEBUG_DIAG,
-+			                  "sssd/ldap sudoUser '%s' ... MATCH! (%s)", val, user_name);
-+		}
-+	}
-+	handle->fn_free_values(val_array);
-+	debug_return_bool(netgroup_spec_found ? ret : true);
- }
- 
- static int
-@@ -599,7 +645,8 @@ sudo_sss_result_filterp(struct sudo_sss_
-     (void)unused;
-     debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD);
- 
--    if (sudo_sss_check_host(handle, rule))
-+    if (sudo_sss_check_host(handle, rule) &&
-+        sudo_sss_filter_user_netgroup(handle, rule))
- 	debug_return_int(1);
-     else
- 	debug_return_int(0);
diff --git a/sudo-1.8.8-strictuidgid.patch b/sudo-1.8.8-strictuidgid.patch
deleted file mode 100644
index ebb14ff..0000000
--- a/sudo-1.8.8-strictuidgid.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff -up sudo-1.8.8/plugins/sudoers/match.c.strictuidgid sudo-1.8.8/plugins/sudoers/match.c
---- sudo-1.8.8/plugins/sudoers/match.c.strictuidgid	2013-09-30 23:30:12.359263967 +0200
-+++ sudo-1.8.8/plugins/sudoers/match.c	2013-09-30 23:31:04.335443002 +0200
-@@ -777,14 +777,16 @@ hostname_matches(char *shost, char *lhos
- bool
- userpw_matches(char *sudoers_user, char *user, struct passwd *pw)
- {
--    debug_decl(userpw_matches, SUDO_DEBUG_MATCH)
--
--    if (pw != NULL && *sudoers_user == '#') {
--	uid_t uid = (uid_t) atoi(sudoers_user + 1);
--	if (uid == pw->pw_uid)
--	    debug_return_bool(true);
--    }
--    debug_return_bool(strcmp(sudoers_user, user) == 0);
-+	debug_decl(userpw_matches, SUDO_DEBUG_MATCH)
-+	if (pw != NULL && *sudoers_user == '#') {
-+		char *end = NULL;
-+		uid_t uid = (uid_t) strtol(sudoers_user + 1, &end, 10);
-+		if (end != NULL && (sudoers_user[1] != '\0' && *end == '\0')) {
-+			if (uid == pw->pw_uid)
-+				debug_return_bool(true);
-+		}
-+	}
-+	debug_return_bool(strcmp(sudoers_user, user) == 0);
- }
- 
- /*
-@@ -794,14 +796,16 @@ userpw_matches(char *sudoers_user, char
- bool
- group_matches(char *sudoers_group, struct group *gr)
- {
--    debug_decl(group_matches, SUDO_DEBUG_MATCH)
--
--    if (*sudoers_group == '#') {
--	gid_t gid = (gid_t) atoi(sudoers_group + 1);
--	if (gid == gr->gr_gid)
--	    debug_return_bool(true);
--    }
--    debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0);
-+	debug_decl(group_matches, SUDO_DEBUG_MATCH)
-+	if (*sudoers_group == '#') {
-+		char *end = NULL;
-+		gid_t gid = (gid_t) strtol(sudoers_group + 1, &end, 10);
-+		if (end != NULL && (sudoers_group[1] != '\0' && *end == '\0')) {
-+			if (gid == gr->gr_gid)
-+				debug_return_bool(true);
-+		}
-+	}
-+	debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0);
- }
- 
- /*
diff --git a/sudo.spec b/sudo.spec
index d86bffe..b0a0802 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.16
-Release: 4%{?dist}
+Version: 1.8.17p1
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -28,12 +28,6 @@ BuildRequires: zlib-devel
 Patch1: sudo-1.6.7p5-strip.patch
 # Patch to read ldap.conf more closely to nss_ldap
 Patch2: sudo-1.8.14p1-ldapconfpatch.patch
-# Patch makes changes in documentation bz:1162070
-Patch3: sudo-1.8.14p1-docpassexpire.patch
-# Patch initialize variable before executing sudo_strsplit
-Patch4: sudo-1.8.14p3-initialization.patch
-# 1328735 - Weird sudo issue that seems to be selinux related
-Patch5: sudo-1.8.16-seshargsfix.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -60,9 +54,6 @@ plugins that use %{name}.
 
 %patch1 -p1 -b .strip
 %patch2 -p1 -b .ldapconfpatch
-%patch3 -p1 -b .docpassexpire
-%patch4 -p1 -b .initialization
-%patch5 -p1 -b .seshargsfix
 
 %build
 # Remove bundled copy of zlib
@@ -108,6 +99,7 @@ make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` s
 
 chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* 
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
+install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
 
@@ -163,6 +155,7 @@ rm -rf $RPM_BUILD_ROOT
 %config(noreplace) /etc/pam.d/sudo-i
 %attr(0644,root,root) %{_tmpfilesdir}/sudo.conf
 %dir /var/db/sudo
+%dir /var/db/sudo/lectured
 %attr(4111,root,root) %{_bindir}/sudo
 %{_bindir}/sudoedit
 %attr(0111,root,root) %{_bindir}/sudoreplay
@@ -201,6 +194,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Fri Jun 24 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.17p1-1
+- update to 1.8.17p1
+- install the /var/db/sudo/lectured
+  Resolves: rhbz#1321414
+
 * Tue May 31 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-4
 - removed INPUTRC from env_keep to prevent a possible info leak
   Resolves: rhbz#1340701

From 3859d5ec51fde9b2d2f6db975ebd597ca71e258f Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Fri, 26 Aug 2016 14:05:06 +0200
Subject: [PATCH 107/199] update to 1.8.18b2

- added --disable-root-mailer as configure option
  Resolves: rhbz#1324091
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 10 ++++++++--
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 04f884a..b244735 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /sudo-1.8.16.tar.gz
 /sudo-1.8.17p1.tar.gz
+/sudo-1.8.18b2.tar.gz
diff --git a/sources b/sources
index 9534406..05f1211 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-50a840a688ceb6fa3ab24fc0adf4fa23  sudo-1.8.17p1.tar.gz
+17c7ccada7659cb5877ede799d459540  sudo-1.8.18b2.tar.gz
diff --git a/sudo.spec b/sudo.spec
index b0a0802..950a36e 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,11 +1,11 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.17p1
+Version: 1.8.18b2
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
-Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
+Source0: http://www.courtesan.com/sudo/dist/beta/sudo-%{version}.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth
@@ -73,6 +73,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --sbindir=%{_sbindir} \
         --libdir=%{_libdir} \
         --docdir=%{_pkgdocdir} \
+        --disable-root-mailer \
         --with-logging=syslog \
         --with-logfac=authpriv \
         --with-pam \
@@ -194,6 +195,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Fri Aug 26 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18b2-1
+- update to 1.8.18b2
+- added --disable-root-mailer as configure option
+  Resolves: rhbz#1324091
+
 * Fri Jun 24 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.17p1-1
 - update to 1.8.17p1
 - install the /var/db/sudo/lectured

From 4884b56d12386cb902e5860635692b852066e585 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Wed, 14 Sep 2016 15:01:50 +0200
Subject: [PATCH 108/199] update to 1.8.18rc2

 - dropped sudo-1.8.14p1-ldapconfpatch.patch
   upstreamed --> https://www.sudo.ws/pipermail/sudo-workers/2016-September/001006.html
---
 .gitignore                        |  1 +
 sources                           |  2 +-
 sudo-1.8.14p1-ldapconfpatch.patch | 55 -------------------------------
 sudo.spec                         | 10 +++---
 4 files changed, 8 insertions(+), 60 deletions(-)
 delete mode 100644 sudo-1.8.14p1-ldapconfpatch.patch

diff --git a/.gitignore b/.gitignore
index b244735..859a847 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /sudo-1.8.16.tar.gz
 /sudo-1.8.17p1.tar.gz
 /sudo-1.8.18b2.tar.gz
+/sudo-1.8.18rc2.tar.gz
diff --git a/sources b/sources
index 05f1211..6538083 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-17c7ccada7659cb5877ede799d459540  sudo-1.8.18b2.tar.gz
+8944dc81070487cbabd7dcf717f2928a  sudo-1.8.18rc2.tar.gz
diff --git a/sudo-1.8.14p1-ldapconfpatch.patch b/sudo-1.8.14p1-ldapconfpatch.patch
deleted file mode 100644
index f42d487..0000000
--- a/sudo-1.8.14p1-ldapconfpatch.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-diff -up sudo-1.8.14b3/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.14b3/plugins/sudoers/ldap.c
---- sudo-1.8.14b3/plugins/sudoers/ldap.c.ldapconfpatch	2015-07-07 18:51:11.000000000 +0200
-+++ sudo-1.8.14b3/plugins/sudoers/ldap.c	2015-07-09 11:03:25.686645581 +0200
-@@ -1922,6 +1922,33 @@ sudo_check_krb5_ccname(const char *ccnam
- }
- #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */
- 
-+/*
-+ * Read a line of input, remove whole line comments and strip off leading
-+ * and trailing spaces.  Returns static storage that is reused.
-+ */
-+static char *
-+sudo_ldap_parseln(fp)
-+    FILE *fp;
-+{
-+    size_t len;
-+    char *cp = NULL;
-+    static char buf[LINE_MAX];
-+
-+    if (fgets(buf, sizeof(buf), fp) != NULL) {
-+	/* Remove comments */
-+	if (*buf == '#')
-+	    *buf = '\0';
-+
-+	/* Trim leading and trailing whitespace/newline */
-+	len = strlen(buf);
-+	while (len > 0 && isspace((unsigned char)buf[len - 1]))
-+	    buf[--len] = '\0';
-+	for (cp = buf; isblank(*cp); cp++)
-+	    continue;
-+    }
-+    return(cp);
-+}
-+
- static bool
- sudo_ldap_read_config(void)
- {
-@@ -1955,7 +1982,7 @@ sudo_ldap_read_config(void)
-     if ((fp = fopen(path_ldap_conf, "r")) == NULL)
- 	debug_return_bool(false);
- 
--    while (sudo_parseln(&line, &linesize, NULL, fp) != -1) {
-+    while ((line = sudo_ldap_parseln(fp)) != NULL) {
- 	if (*line == '\0')
- 	    continue;		/* skip empty line */
- 
-@@ -1975,7 +2002,7 @@ sudo_ldap_read_config(void)
- 	if (!sudo_ldap_parse_keyword(keyword, value, ldap_conf_global))
- 	    sudo_ldap_parse_keyword(keyword, value, ldap_conf_conn);
-     }
--    free(line);
-+
-     fclose(fp);
- 
-     if (!ldap_conf.host) {
diff --git a/sudo.spec b/sudo.spec
index 950a36e..9e27dd6 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.18b2
+Version: 1.8.18rc2
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
@@ -26,8 +26,6 @@ BuildRequires: zlib-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
-# Patch to read ldap.conf more closely to nss_ldap
-Patch2: sudo-1.8.14p1-ldapconfpatch.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -53,7 +51,6 @@ plugins that use %{name}.
 %setup -q
 
 %patch1 -p1 -b .strip
-%patch2 -p1 -b .ldapconfpatch
 
 %build
 # Remove bundled copy of zlib
@@ -195,6 +192,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Wed Sep 14 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18rc2-1
+- update to 1.8.18rc2
+- dropped sudo-1.8.14p1-ldapconfpatch.patch
+  upstreamed --> https://www.sudo.ws/pipermail/sudo-workers/2016-September/001006.html
+
 * Fri Aug 26 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18b2-1
 - update to 1.8.18b2
 - added --disable-root-mailer as configure option

From bc3371c40d90d0c0ccb1642681e69a64c9f92d98 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Fri, 16 Sep 2016 09:20:46 +0200
Subject: [PATCH 109/199] update to 1.8.18rc4

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 5 ++++-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 859a847..d2748f3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 /sudo-1.8.17p1.tar.gz
 /sudo-1.8.18b2.tar.gz
 /sudo-1.8.18rc2.tar.gz
+/sudo-1.8.18rc4.tar.gz
diff --git a/sources b/sources
index 6538083..5d7a3cc 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-8944dc81070487cbabd7dcf717f2928a  sudo-1.8.18rc2.tar.gz
+85190c2f382444e1a1032d5fea5bc161  sudo-1.8.18rc4.tar.gz
diff --git a/sudo.spec b/sudo.spec
index 9e27dd6..c9ea62d 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.18rc2
+Version: 1.8.18rc4
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
@@ -192,6 +192,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Fri Sep 16 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18rc4-1
+- update to 1.8.18rc4
+
 * Wed Sep 14 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18rc2-1
 - update to 1.8.18rc2
 - dropped sudo-1.8.14p1-ldapconfpatch.patch

From 68760bc5c7e30ccbf7ea8661a5bbc2932e216b4b Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Wed, 21 Sep 2016 16:40:11 +0200
Subject: [PATCH 110/199] update to 1.8.18

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 5 ++++-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index d2748f3..20ced3c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 /sudo-1.8.18b2.tar.gz
 /sudo-1.8.18rc2.tar.gz
 /sudo-1.8.18rc4.tar.gz
+/sudo-1.8.18.tar.gz
diff --git a/sources b/sources
index 5d7a3cc..9410aa8 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-85190c2f382444e1a1032d5fea5bc161  sudo-1.8.18rc4.tar.gz
+c1201904fd9144ea5e7cd9496fcbbc64  sudo-1.8.18.tar.gz
diff --git a/sudo.spec b/sudo.spec
index c9ea62d..ed46310 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.18rc4
+Version: 1.8.18
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
@@ -192,6 +192,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Wed Sep 21 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18-1
+- update to 1.8.18
+
 * Fri Sep 16 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18rc4-1
 - update to 1.8.18rc4
 

From a4bd4c5ee78e2eded5dce3fb11f8a3dde41cfa6f Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Wed, 21 Sep 2016 17:26:49 +0200
Subject: [PATCH 111/199] Minor update

- fix source link
---
 sudo.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index ed46310..efc5d91 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -5,7 +5,7 @@ Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
-Source0: http://www.courtesan.com/sudo/dist/beta/sudo-%{version}.tar.gz
+Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth

From ab266a825d5030d89c1cb0607edabcb71cca0244 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Fri, 23 Sep 2016 16:11:19 +0200
Subject: [PATCH 112/199] "update" to 1.8.19-0.1.20160923git90e4538

- this commit changes only version, nothing else
- we were not able to update from rc and beta versions to stable
  one in fedora rawhide
- so this is a new snapshot package which resolves it
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 18 ++++++++++++++----
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index 20ced3c..3870b99 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@
 /sudo-1.8.18rc2.tar.gz
 /sudo-1.8.18rc4.tar.gz
 /sudo-1.8.18.tar.gz
+/sudo-90e4538c001fbe1b791a11d6a2c37607472fafe5.tar.gz
diff --git a/sources b/sources
index 9410aa8..4b507e5 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-c1201904fd9144ea5e7cd9496fcbbc64  sudo-1.8.18.tar.gz
+d4cd80c6adc3224b31213bac2795d1b5  sudo-90e4538c001fbe1b791a11d6a2c37607472fafe5.tar.gz
diff --git a/sudo.spec b/sudo.spec
index efc5d91..5d3ab15 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,11 +1,17 @@
+%global gitdate         20160923
+%global gittag          90e4538c001fbe1b791a11d6a2c37607472fafe5
+%global shorttag        %(c=%{gittag}; echo ${c:0:7})
+%global user            millert
+%global debug_package   %{nil}
+
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.18
-Release: 1%{?dist}
+Version: 1.8.19
+Release: 0.1.%{gitdate}git%{shorttag}%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
-Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz
+Source0: https://github.com/%{user}/%{name}/archive/%{name}-%{gittag}.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth
@@ -48,7 +54,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q
+%setup -q -n %{name}-%{gittag}
 
 %patch1 -p1 -b .strip
 
@@ -192,6 +198,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Fri Sep 23 2016 Radovan Sroka <rsroka@redhat.com> 1.8.19-0.1.20160923git90e4538
+- we were not able to update from rc and beta versions to stable one
+- so this is a new snapshot package which resolves it
+
 * Wed Sep 21 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18-1
 - update to 1.8.18
 

From e07c54ccee1c3ed78c96da2ae98f38b28b2c4792 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <mildew@fedoraproject.org>
Date: Tue, 8 Nov 2016 12:46:14 +0100
Subject: [PATCH 113/199] update to latest development version

- fixes CVE-2016-7076
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 10 +++++++---
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 3870b99..36cf175 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@
 /sudo-1.8.18rc4.tar.gz
 /sudo-1.8.18.tar.gz
 /sudo-90e4538c001fbe1b791a11d6a2c37607472fafe5.tar.gz
+/sudo-738c3cbf3e8400bf4a5aeab8966427ff6d630cd2.tar.gz
diff --git a/sources b/sources
index 4b507e5..7bef850 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-d4cd80c6adc3224b31213bac2795d1b5  sudo-90e4538c001fbe1b791a11d6a2c37607472fafe5.tar.gz
+b8b37a13d321c83ab9162be577d51091  sudo-738c3cbf3e8400bf4a5aeab8966427ff6d630cd2.tar.gz
diff --git a/sudo.spec b/sudo.spec
index 5d3ab15..ddaed1f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,5 +1,5 @@
-%global gitdate         20160923
-%global gittag          90e4538c001fbe1b791a11d6a2c37607472fafe5
+%global gitdate         20161108
+%global gittag          738c3cbf3e8400bf4a5aeab8966427ff6d630cd2
 %global shorttag        %(c=%{gittag}; echo ${c:0:7})
 %global user            millert
 %global debug_package   %{nil}
@@ -7,7 +7,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.19
-Release: 0.1.%{gitdate}git%{shorttag}%{?dist}
+Release: 0.2.%{gitdate}git%{shorttag}%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -198,6 +198,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Tue Nov 08 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.19-0.2.20161108git738c3cb
+- update to latest development version
+- fixes CVE-2016-7076
+
 * Fri Sep 23 2016 Radovan Sroka <rsroka@redhat.com> 1.8.19-0.1.20160923git90e4538
 - we were not able to update from rc and beta versions to stable one
 - so this is a new snapshot package which resolves it

From 4a9e2fc28e241c447c7a0607369b893f088051a3 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 11 Feb 2017 14:05:57 +0000
Subject: [PATCH 114/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index ddaed1f..2a218dd 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -7,7 +7,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.19
-Release: 0.2.%{gitdate}git%{shorttag}%{?dist}
+Release: 0.3.%{gitdate}git%{shorttag}%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -198,6 +198,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.19-0.3.20161108git738c3cb
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
 * Tue Nov 08 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.19-0.2.20161108git738c3cb
 - update to latest development version
 - fixes CVE-2016-7076

From e05aa772e6a9475196aefa2a7c37d43551efd6e8 Mon Sep 17 00:00:00 2001
From: Tomas Sykora <tosykora@redhat.com>
Date: Mon, 13 Feb 2017 12:49:39 +0100
Subject: [PATCH 115/199] update to 1.8.19p2

---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 14 +++++++-------
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/.gitignore b/.gitignore
index 36cf175..c46f74c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@
 /sudo-1.8.18.tar.gz
 /sudo-90e4538c001fbe1b791a11d6a2c37607472fafe5.tar.gz
 /sudo-738c3cbf3e8400bf4a5aeab8966427ff6d630cd2.tar.gz
+/sudo-1.8.19p2.tar.gz
diff --git a/sources b/sources
index 7bef850..a3d7225 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-b8b37a13d321c83ab9162be577d51091  sudo-738c3cbf3e8400bf4a5aeab8966427ff6d630cd2.tar.gz
+SHA512 (sudo-1.8.19p2.tar.gz) = 21c83403e7ff219a273b2c4873be0d858997558ca150bc8239379a9dfcc587fdd7c0c49cdf4cdc27dfd6dd45f9f089fa034b58bfcee07dceb4a481542251b3fc
diff --git a/sudo.spec b/sudo.spec
index 2a218dd..0c9ec0f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,17 +1,14 @@
-%global gitdate         20161108
-%global gittag          738c3cbf3e8400bf4a5aeab8966427ff6d630cd2
-%global shorttag        %(c=%{gittag}; echo ${c:0:7})
 %global user            millert
 %global debug_package   %{nil}
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.19
-Release: 0.3.%{gitdate}git%{shorttag}%{?dist}
+Version: 1.8.19p2
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
-Source0: https://github.com/%{user}/%{name}/archive/%{name}-%{gittag}.tar.gz
+Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth
@@ -54,7 +51,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q -n %{name}-%{gittag}
+%setup -q
 
 %patch1 -p1 -b .strip
 
@@ -198,6 +195,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Mon Feb 13 2017 Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-2
+- update to 1.8.19p2
+
 * Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.19-0.3.20161108git738c3cb
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 

From e43103946cdaf5cd1ea0b6260d4a7e3b0c3f2994 Mon Sep 17 00:00:00 2001
From: Jiri Vymazal <jvymazal@redhat.com>
Date: Fri, 7 Apr 2017 16:01:56 +0200
Subject: [PATCH 116/199] * Fri Apr 07 2017 Jiri Vymazal <jvymazal@redhat.com>
 - 1.8.20-0.1.b1 - update to latest development version 1.8.20b1 - added sudo
 to dnf/yum protected packages   Resolves: rhbz#1418756

---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 22 +++++++++++++++++-----
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index c46f74c..55616ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@
 /sudo-90e4538c001fbe1b791a11d6a2c37607472fafe5.tar.gz
 /sudo-738c3cbf3e8400bf4a5aeab8966427ff6d630cd2.tar.gz
 /sudo-1.8.19p2.tar.gz
+/sudo-1.8.20b1.tar.gz
diff --git a/sources b/sources
index a3d7225..718bdfe 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.19p2.tar.gz) = 21c83403e7ff219a273b2c4873be0d858997558ca150bc8239379a9dfcc587fdd7c0c49cdf4cdc27dfd6dd45f9f089fa034b58bfcee07dceb4a481542251b3fc
+SHA512 (sudo-1.8.20b1.tar.gz) = 8fd9a8d74883b83a4302c0e6e9980773d73c592be69e5246fcab097ae293c299b886a6f83d714bf1638d366f1bc0f00436e291c4f18611049a92f39bdd892e37
diff --git a/sudo.spec b/sudo.spec
index 0c9ec0f..6007ab0 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,12 +3,12 @@
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.19p2
-Release: 1%{?dist}
+Version: 1.8.20
+Release: 0.1.b1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
+Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b1.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth
@@ -51,7 +51,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q
+%setup -q -n sudo-1.8.20b1
 
 %patch1 -p1 -b .strip
 
@@ -103,6 +103,12 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
+#add sudo to protected packages
+install -p -d -m 755 $RPM_BUILD_ROOT/etc/yum/protected.d/
+touch sudo.conf
+echo sudo > sudo.conf
+install -p -c -m 0644 sudo.conf $RPM_BUILD_ROOT/etc/yum/protected.d/
+rm -f sudo.conf
 
 chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%files
 
@@ -155,6 +161,7 @@ rm -rf $RPM_BUILD_ROOT
 %config(noreplace) /etc/pam.d/sudo
 %config(noreplace) /etc/pam.d/sudo-i
 %attr(0644,root,root) %{_tmpfilesdir}/sudo.conf
+%attr(0644,root,root) /etc/yum/protected.d/sudo.conf
 %dir /var/db/sudo
 %dir /var/db/sudo/lectured
 %attr(4111,root,root) %{_bindir}/sudo
@@ -195,7 +202,12 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
-* Mon Feb 13 2017 Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-2
+* Fri Apr 07 2017 Jiri Vymazal <jvymazal@redhat.com> - 1.8.20-0.1.b1
+- update to latest development version 1.8.20b1
+- added sudo to dnf/yum protected packages
+  Resolves: rhbz#1418756
+
+* Mon Feb 13 2017 Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-1
 - update to 1.8.19p2
 
 * Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.19-0.3.20161108git738c3cb

From ababf7ba8fe0bbb273f5998bf943d394832ae817 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <dkopecek@redhat.com>
Date: Wed, 31 May 2017 09:05:44 +0200
Subject: [PATCH 117/199] update to 1.8.20p1 fixes CVE-2017-1000367   Resolves:
 rhbz#1456884

---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 17 ++++++++++++-----
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 55616ea..0b04d27 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@
 /sudo-738c3cbf3e8400bf4a5aeab8966427ff6d630cd2.tar.gz
 /sudo-1.8.19p2.tar.gz
 /sudo-1.8.20b1.tar.gz
+/sudo-1.8.20p1.tar.gz
diff --git a/sources b/sources
index 718bdfe..4921bf3 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.20b1.tar.gz) = 8fd9a8d74883b83a4302c0e6e9980773d73c592be69e5246fcab097ae293c299b886a6f83d714bf1638d366f1bc0f00436e291c4f18611049a92f39bdd892e37
+SHA512 (sudo-1.8.20p1.tar.gz) = b7d4c07a550da917029e31d15e734d9462f3565ee43eb5f6fd19463b54a2fa3f444381f0999d6d1ba643b65832056dd9177dad4452fa9f87f2542c223b13f258
diff --git a/sudo.spec b/sudo.spec
index 6007ab0..a96a40f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,14 +1,13 @@
 %global user            millert
-%global debug_package   %{nil}
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.20
-Release: 0.1.b1%{?dist}
+Version: 1.8.20p1
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b1.tar.gz
+Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: /etc/pam.d/system-auth
@@ -51,7 +50,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q -n sudo-1.8.20b1
+%setup -q
 
 %patch1 -p1 -b .strip
 
@@ -124,6 +123,9 @@ rm -rf $RPM_BUILD_ROOT%{_datadir}/examples/sudo
 #Remove all .la files
 find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 
+# Remove sudoers.dist
+rm -f $RPM_BUILD_ROOT%{_sysconfdir}/sudoers.dist
+
 %find_lang sudo
 %find_lang sudoers
 
@@ -202,6 +204,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Wed May 31 2017 Daniel Kopecek <dkopecek@redhat.com> 1.8.20p1-1
+- update to 1.8.20p1
+- fixes CVE-2017-1000367
+  Resolves: rhbz#1456884
+
 * Fri Apr 07 2017 Jiri Vymazal <jvymazal@redhat.com> - 1.8.20-0.1.b1
 - update to latest development version 1.8.20b1
 - added sudo to dnf/yum protected packages

From e0f60ff106ad117f99adaedbcf6cafed8182d060 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <dkopecek@redhat.com>
Date: Thu, 1 Jun 2017 12:33:48 +0200
Subject: [PATCH 118/199] update to 1.8.20p2

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 5 ++++-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 0b04d27..4f59932 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@
 /sudo-1.8.19p2.tar.gz
 /sudo-1.8.20b1.tar.gz
 /sudo-1.8.20p1.tar.gz
+/sudo-1.8.20p2.tar.gz
diff --git a/sources b/sources
index 4921bf3..21e6b4a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.20p1.tar.gz) = b7d4c07a550da917029e31d15e734d9462f3565ee43eb5f6fd19463b54a2fa3f444381f0999d6d1ba643b65832056dd9177dad4452fa9f87f2542c223b13f258
+SHA512 (sudo-1.8.20p2.tar.gz) = 8bf67e687f7a84605fdef8d547b5cd661141b6c8fd25820c33c7e37e97ca7f21f564c3bae691f8a8cd08df7d80338e36a8f06bb5086cc104509d71d6ab1bceda
diff --git a/sudo.spec b/sudo.spec
index a96a40f..d294619 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -2,7 +2,7 @@
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.20p1
+Version: 1.8.20p2
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
@@ -204,6 +204,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Thu Jun 01 2017 Daniel Kopecek <dkopecek@redhat.com> 1.8.20p2-1
+- update to 1.8.20p2
+
 * Wed May 31 2017 Daniel Kopecek <dkopecek@redhat.com> 1.8.20p1-1
 - update to 1.8.20p1
 - fixes CVE-2017-1000367

From 7769b86dd9fb2f6928a11a25cc7f8d511d084f1f Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 27 Jul 2017 19:27:35 +0000
Subject: [PATCH 119/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index d294619..bb2c39d 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,7 +3,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.20p2
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -204,6 +204,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.20p2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
 * Thu Jun 01 2017 Daniel Kopecek <dkopecek@redhat.com> 1.8.20p2-1
 - update to 1.8.20p2
 

From 185e4548cafc93742da1c198470537998fa87325 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 3 Aug 2017 08:56:24 +0000
Subject: [PATCH 120/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index bb2c39d..e02eb5a 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,7 +3,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.20p2
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -204,6 +204,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.20p2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
 * Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.20p2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
 

From 3e6b39b18504cd49db16af4725d5799ab177ab23 Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Wed, 6 Sep 2017 12:53:03 -0400
Subject: [PATCH 121/199] Replace file-based requirements with package-level
 ones: - /etc/pam.d/system-auth to 'pam' - /bin/chmod to 'coreutils' (bug
 #1488934) - /usr/bin/vi to vim-minimal - ... and make vim-minimal
 "recommends" instead of "requires", because   other editors can be
 configured.

---
 sudo.spec | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index e02eb5a..95ebbcb 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,16 +3,16 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.20p2
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-Requires: /etc/pam.d/system-auth
-Requires: /usr/bin/vi
-Requires(post): /bin/chmod
+Requires: pam
+Recommends: vim-minimal
+Requires(post): coreutils
 
 BuildRequires: pam-devel
 BuildRequires: groff
@@ -204,6 +204,14 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Wed Sep 06 2017 Matthew Miller <mattdm@fedoraproject.org> - 1.8.20p2-4
+- replace file-based requirements with package-level ones:
+- /etc/pam.d/system-auth to 'pam'
+- /bin/chmod to 'coreutils' (bug #1488934)
+- /usr/bin/vi to vim-minimal
+- ... and make vim-minimal "recommends" instead of "requires", because
+  other editors can be configured.
+
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.20p2-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 

From 0c12737f71b2afa76592619e8427e0873f55abc4 Mon Sep 17 00:00:00 2001
From: Marek Tamaskovic <tamaskovic.marek@gmail.com>
Date: Fri, 29 Sep 2017 15:43:08 +0200
Subject: [PATCH 122/199] Update to sudo-1.8.21p2

Fix changelog
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 10 +++++++---
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 4f59932..63000a2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,4 @@
 /sudo-1.8.20b1.tar.gz
 /sudo-1.8.20p1.tar.gz
 /sudo-1.8.20p2.tar.gz
+/sudo-1.8.21p2.tar.gz
diff --git a/sources b/sources
index 21e6b4a..a15d86f 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.20p2.tar.gz) = 8bf67e687f7a84605fdef8d547b5cd661141b6c8fd25820c33c7e37e97ca7f21f564c3bae691f8a8cd08df7d80338e36a8f06bb5086cc104509d71d6ab1bceda
+SHA512 (sudo-1.8.21p2.tar.gz) = f04bbff54ad74ba73c078e15c75d2f41332d4912078ed66157ba7346b7fff914bd0747460cb4cd0c472af2d3b344fa72f5c62c95169df68a9cac74d7245c720c
diff --git a/sudo.spec b/sudo.spec
index 95ebbcb..0e3f504 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -2,8 +2,8 @@
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.20p2
-Release: 4%{?dist}
+Version: 1.8.21p2
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -178,6 +178,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
 %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
 %{_libexecdir}/sudo/libsudo_util.so.?
+%{_libexecdir}/sudo/libsudo_util.so
 %{_mandir}/man5/sudoers.5*
 %{_mandir}/man5/sudoers.ldap.5*
 %{_mandir}/man5/sudo.conf.5*
@@ -201,9 +202,12 @@ rm -rf $RPM_BUILD_ROOT
 %doc plugins/sample/sample_plugin.c
 %{_includedir}/sudo_plugin.h
 %{_mandir}/man8/sudo_plugin.8*
-%{_libexecdir}/sudo/libsudo_util.so
 
 %changelog
+* Thu Sep 21 2017 Marek Tamaskovic <mtamasko@redhat.com> - 1.8.21p2-1
+- update to 1.8.21p2
+- Moved libsudo_util.so from the -devel sub-package to main package (1481225) 
+
 * Wed Sep 06 2017 Matthew Miller <mattdm@fedoraproject.org> - 1.8.20p2-4
 - replace file-based requirements with package-level ones:
 - /etc/pam.d/system-auth to 'pam'

From 60f7afa183b0e85ab4659dff3e12c359ea4734cc Mon Sep 17 00:00:00 2001
From: Rachel Sibley <rasibley@redhat.com>
Date: Thu, 5 Oct 2017 15:32:54 -0400
Subject: [PATCH 123/199] Initial commit for downstream tests using standard
 test interface

---
 tests/fully-qualified-hostnames/Makefile      |  71 ++
 tests/fully-qualified-hostnames/PURPOSE       |   3 +
 tests/fully-qualified-hostnames/runtest.sh    | 106 ++
 tests/fully-qualified-hostnames/ssh-sudo.exp  |  20 +
 tests/run-as/Makefile                         |  68 ++
 tests/run-as/PURPOSE                          |   3 +
 .../distribution/Library/Cleanup/Makefile     |  59 ++
 .../distribution/Library/Cleanup/lib.sh       | 314 ++++++
 .../Library/ConditionalPhases/Makefile        |  59 ++
 .../Library/ConditionalPhases/lib.sh          | 166 ++++
 .../run-as/distribution/Library/Log/Makefile  |  48 +
 tests/run-as/distribution/Library/Log/lib.sh  | 637 ++++++++++++
 .../run-as/distribution/Library/opts/Makefile |  48 +
 tests/run-as/distribution/Library/opts/lib.sh | 338 +++++++
 .../run-as/distribution/Library/tcf/Makefile  |  60 ++
 tests/run-as/distribution/Library/tcf/lib.sh  | 903 ++++++++++++++++++
 .../distribution/Library/testUser/Makefile    |  60 ++
 .../distribution/Library/testUser/lib.sh      | 234 +++++
 tests/run-as/runtest.sh                       | 163 ++++
 tests/sudoers-options-sanity-test/Makefile    |  67 ++
 tests/sudoers-options-sanity-test/PURPOSE     |   3 +
 .../distribution/Library/Cleanup/Makefile     |  59 ++
 .../distribution/Library/Cleanup/lib.sh       | 314 ++++++
 .../Library/ConditionalPhases/Makefile        |  59 ++
 .../Library/ConditionalPhases/lib.sh          | 166 ++++
 .../distribution/Library/Log/Makefile         |  48 +
 .../distribution/Library/Log/lib.sh           | 637 ++++++++++++
 .../distribution/Library/opts/Makefile        |  48 +
 .../distribution/Library/opts/lib.sh          | 338 +++++++
 .../distribution/Library/tcf/Makefile         |  60 ++
 .../distribution/Library/tcf/lib.sh           | 903 ++++++++++++++++++
 .../distribution/Library/testUser/Makefile    |  60 ++
 .../distribution/Library/testUser/lib.sh      | 234 +++++
 tests/sudoers-options-sanity-test/runtest.sh  | 379 ++++++++
 tests/tests.yml                               |  53 +
 .../Makefile                                  |  70 ++
 .../PURPOSE                                   |   3 +
 .../runtest.sh                                |  80 ++
 tests/use_pty-option/Makefile                 |  72 ++
 tests/use_pty-option/PURPOSE                  |   4 +
 tests/use_pty-option/forker.sh                |   5 +
 tests/use_pty-option/runtest.sh               |  76 ++
 tests/use_pty-option/ssh-sudo.exp             |  20 +
 43 files changed, 7118 insertions(+)
 create mode 100644 tests/fully-qualified-hostnames/Makefile
 create mode 100644 tests/fully-qualified-hostnames/PURPOSE
 create mode 100755 tests/fully-qualified-hostnames/runtest.sh
 create mode 100755 tests/fully-qualified-hostnames/ssh-sudo.exp
 create mode 100644 tests/run-as/Makefile
 create mode 100644 tests/run-as/PURPOSE
 create mode 100644 tests/run-as/distribution/Library/Cleanup/Makefile
 create mode 100644 tests/run-as/distribution/Library/Cleanup/lib.sh
 create mode 100644 tests/run-as/distribution/Library/ConditionalPhases/Makefile
 create mode 100644 tests/run-as/distribution/Library/ConditionalPhases/lib.sh
 create mode 100644 tests/run-as/distribution/Library/Log/Makefile
 create mode 100644 tests/run-as/distribution/Library/Log/lib.sh
 create mode 100644 tests/run-as/distribution/Library/opts/Makefile
 create mode 100644 tests/run-as/distribution/Library/opts/lib.sh
 create mode 100644 tests/run-as/distribution/Library/tcf/Makefile
 create mode 100644 tests/run-as/distribution/Library/tcf/lib.sh
 create mode 100644 tests/run-as/distribution/Library/testUser/Makefile
 create mode 100644 tests/run-as/distribution/Library/testUser/lib.sh
 create mode 100755 tests/run-as/runtest.sh
 create mode 100644 tests/sudoers-options-sanity-test/Makefile
 create mode 100644 tests/sudoers-options-sanity-test/PURPOSE
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/Cleanup/Makefile
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/Cleanup/lib.sh
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/ConditionalPhases/Makefile
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/ConditionalPhases/lib.sh
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/Log/Makefile
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/Log/lib.sh
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/opts/Makefile
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/opts/lib.sh
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/tcf/Makefile
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/tcf/lib.sh
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/testUser/Makefile
 create mode 100644 tests/sudoers-options-sanity-test/distribution/Library/testUser/lib.sh
 create mode 100755 tests/sudoers-options-sanity-test/runtest.sh
 create mode 100644 tests/tests.yml
 create mode 100644 tests/upstream-testsuite-execution-and-rebuild-test/Makefile
 create mode 100644 tests/upstream-testsuite-execution-and-rebuild-test/PURPOSE
 create mode 100755 tests/upstream-testsuite-execution-and-rebuild-test/runtest.sh
 create mode 100644 tests/use_pty-option/Makefile
 create mode 100644 tests/use_pty-option/PURPOSE
 create mode 100644 tests/use_pty-option/forker.sh
 create mode 100755 tests/use_pty-option/runtest.sh
 create mode 100755 tests/use_pty-option/ssh-sudo.exp

diff --git a/tests/fully-qualified-hostnames/Makefile b/tests/fully-qualified-hostnames/Makefile
new file mode 100644
index 0000000..101e635
--- /dev/null
+++ b/tests/fully-qualified-hostnames/Makefile
@@ -0,0 +1,71 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/sudo/Sanity/fully-qualified-hostnames
+#   Description: checks if sudo works correctly when FQDN is used in /etc/sudoers
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2011 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/sudo/Sanity/fully-qualified-hostnames
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh-sudo.exp
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+	chmod a+x ssh-sudo.exp
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     checks if sudo works correctly when FQDN is used in /etc/sudoers" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          sudo" >> $(METADATA)
+	@echo "Requires:        sudo" >> $(METADATA)
+	@echo "Requires:        sed" >> $(METADATA)
+	@echo "Requires:        grep" >> $(METADATA)
+	@echo "Requires:        mktemp" >> $(METADATA)
+	@echo "Requires:        openssh-server" >> $(METADATA)
+	@echo "Requires:        openssh-clients" >> $(METADATA)
+	@echo "Requires:        expect" >> $(METADATA)
+	@echo "Requires:        shadow-utils" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+
+	rhts-lint $(METADATA)
+
diff --git a/tests/fully-qualified-hostnames/PURPOSE b/tests/fully-qualified-hostnames/PURPOSE
new file mode 100644
index 0000000..c27b508
--- /dev/null
+++ b/tests/fully-qualified-hostnames/PURPOSE
@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/sudo/Sanity/fully-qualified-hostnames
+Description: checks if sudo works correctly when FQDN is used in /etc/sudoers
+Author: Milos Malik <mmalik@redhat.com>
diff --git a/tests/fully-qualified-hostnames/runtest.sh b/tests/fully-qualified-hostnames/runtest.sh
new file mode 100755
index 0000000..db3a893
--- /dev/null
+++ b/tests/fully-qualified-hostnames/runtest.sh
@@ -0,0 +1,106 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/sudo/Sanity/fully-qualified-hostnames
+#   Description: checks if sudo works correctly when FQDN is used in /etc/sudoers
+#   Author: Milos Malik <mmalik@redhat.com>
+#   Edit: Ales "alich" Marecek <amarecek@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2011 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/bin/rhts-environment.sh
+. /usr/share/beakerlib/beakerlib.sh
+
+PACKAGE="sudo"
+USER_NAME="user${RANDOM}"
+USER_SECRET="s3kr3T${RANDOM}"
+CONFIG_FILE="/etc/sudoers"
+OUTPUT_FILE="sudo.log"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm ${PACKAGE}
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "cp ssh-sudo.exp ${TmpDir}" 0 "Copying expect file"
+        rlRun "pushd $TmpDir"
+        OUTPUT_FILE="${TmpDir}/${OUTPUT_FILE}"
+        rlFileBackup ${CONFIG_FILE} ~/.ssh
+        id ${USER_NAME} && userdel -r ${USER_NAME}
+        rlRun "useradd ${USER_NAME}"
+        rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+        rlRun "sed -i 's/^.*requiretty.*$//' ${CONFIG_FILE}"
+        rlRun "sed -i 's/^.*lecture.*$//' ${CONFIG_FILE}"
+        rlRun "echo \"Defaults !requiretty, !lecture\" >> ${CONFIG_FILE}"
+        rlRun "echo \"${USER_NAME} ${HOSTNAME} = (root) `which id`\" >> ${CONFIG_FILE}"
+        rlRun "> ~/.ssh/known_hosts"
+    rlPhaseEnd
+
+    if rlIsRHEL 5; then
+    rlPhaseStartTest
+        rlRun "strings `which sudo` | grep fqdn"
+    rlPhaseEnd
+    fi
+
+    if echo ${HOSTNAME} | grep -q '^localhost'; then
+    rlPhaseStartTest
+        rlLogInfo "skipping fqdn option enabled tests, cannot run with local-only host name ${HOSTNAME}"
+    rlPhaseEnd
+    else
+    rlPhaseStartTest "fqdn option is enabled, command is valid"
+        rlRun "sed -i 's/^.*fqdn.*$//' ${CONFIG_FILE}"
+        rlRun "echo \"Defaults fqdn\" >> ${CONFIG_FILE}"
+        rlRun "./ssh-sudo.exp ${USER_NAME} ${USER_SECRET} localhost id 2>&1 | tee ${OUTPUT_FILE}"
+        rlAssertGrep "uid=0.*gid=0.*groups=0" ${OUTPUT_FILE}
+    rlPhaseEnd
+
+    rlPhaseStartTest "fqdn option is enabled, command is invalid"
+        rlRun "sed -i 's/^.*fqdn.*$//' ${CONFIG_FILE}"
+        rlRun "echo \"Defaults fqdn\" >> ${CONFIG_FILE}"
+        rlRun "./ssh-sudo.exp ${USER_NAME} ${USER_SECRET} localhost w 2>&1 | tee ${OUTPUT_FILE}"
+        rlAssertGrep "user.*is not allowed to execute" ${OUTPUT_FILE}
+    rlPhaseEnd
+    fi
+
+    rlPhaseStartTest "fqdn option is disabled, command is valid"
+        rlRun "sed -i 's/^.*fqdn.*$//' ${CONFIG_FILE}"
+        rlRun "echo \"Defaults !fqdn\" >> ${CONFIG_FILE}"
+        rlRun "./ssh-sudo.exp ${USER_NAME} ${USER_SECRET} localhost id 2>&1 | tee ${OUTPUT_FILE}"
+        rlAssertGrep "uid=0.*gid=0.*groups=0" ${OUTPUT_FILE}
+    rlPhaseEnd
+
+    rlPhaseStartTest "fqdn option is disabled, command is invalid"
+        rlRun "sed -i 's/^.*fqdn.*$//' ${CONFIG_FILE}"
+        rlRun "echo \"Defaults !fqdn\" >> ${CONFIG_FILE}"
+        rlRun "./ssh-sudo.exp ${USER_NAME} ${USER_SECRET} localhost w 2>&1 | tee ${OUTPUT_FILE}"
+        rlAssertGrep "user.*is not allowed to execute" ${OUTPUT_FILE}
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "userdel -rf ${USER_NAME}"
+        rlFileRestore
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
diff --git a/tests/fully-qualified-hostnames/ssh-sudo.exp b/tests/fully-qualified-hostnames/ssh-sudo.exp
new file mode 100755
index 0000000..44863e4
--- /dev/null
+++ b/tests/fully-qualified-hostnames/ssh-sudo.exp
@@ -0,0 +1,20 @@
+#!/usr/bin/expect -f
+# usage:
+# ./ssh-sudo.exp username password hostname command
+set username [lrange $argv 0 0]
+set password [lrange $argv 1 1]
+set hostname [lrange $argv 2 2]
+set command  [lrange $argv 3 3]
+set timeout 5
+spawn ssh -t $username@$hostname sudo $command
+expect "*yes/no*" {
+    send -- "yes\r"
+}
+expect "*assword*" {
+    send -- "$password\r"
+}
+expect "*assword*" {
+    send -- "$password\r"
+}
+expect eof
+
diff --git a/tests/run-as/Makefile b/tests/run-as/Makefile
new file mode 100644
index 0000000..411464b
--- /dev/null
+++ b/tests/run-as/Makefile
@@ -0,0 +1,68 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/sudo/Sanity/run-as
+#   Description: Test feature 'run as'. This means -u, -g options.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2017 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/sudo/Sanity/run-as
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Test feature 'run as'. This means -u, -g options." >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          sudo" >> $(METADATA)
+	@echo "Requires:        sudo" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/tcf)" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/Cleanup)" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/testUser)" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/ConditionalPhases)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/run-as/PURPOSE b/tests/run-as/PURPOSE
new file mode 100644
index 0000000..387bc5b
--- /dev/null
+++ b/tests/run-as/PURPOSE
@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/sudo/Sanity/run-as
+Description: Test feature 'run as'. This means -u, -g options.
+Author: Dalibor Pospisil <dapospis@redhat.com>
diff --git a/tests/run-as/distribution/Library/Cleanup/Makefile b/tests/run-as/distribution/Library/Cleanup/Makefile
new file mode 100644
index 0000000..3e5a8e1
--- /dev/null
+++ b/tests/run-as/distribution/Library/Cleanup/Makefile
@@ -0,0 +1,59 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/Cleanup
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/Cleanup
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Provides function to define cleanup stack which can do its work at any time of the test run." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "Provides:        library(distribution/Cleanup)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/run-as/distribution/Library/Cleanup/lib.sh b/tests/run-as/distribution/Library/Cleanup/lib.sh
new file mode 100644
index 0000000..c66d21c
--- /dev/null
+++ b/tests/run-as/distribution/Library/Cleanup/lib.sh
@@ -0,0 +1,314 @@
+#!/bin/bash
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = Cleanup
+#   library-version = 9
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_Cleanup_LIB_VERSION=9
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library Cleanup
+
+=head1 DESCRIPTION
+
+This file contains functions which provides cleanup stack functionality.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/Cleanup and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/Cleanup)" >> $(METADATA)
+
+B<Code example>
+
+	rlJournalStart
+	  rlPhaseStartSetup
+	    rlImport 'distribution/Cleanup'
+	    tmp=$(mktemp)
+	    CleanupRegister "
+	      rlLog 'Removing data'
+	      rlRun \"rm -f ${tmp}\"
+	    "
+	    rlLog 'Creating some data'
+	    rlRun "echo 'asdfalkjh' > $tmp"
+
+	    CleanupRegister "
+	      rlLog 'just something to demonstrate unregistering'
+	    "
+	    ID1=$CleanupRegisterID
+	    CleanupUnregister $ID1
+
+	    CleanupRegister "
+	      rlLog 'just something to demonstrate partial cleanup'
+	    "
+	    ID2=$CleanupRegisterID
+	    CleanupRegister "rlLog 'cleanup some more things'"
+	    # cleanup everything upto ID2
+	    CleanupDo $ID2
+
+	    CleanupRegister --mark "
+	      rlLog 'yet another something to demonstrate partial cleanup using internal ID saving'
+	    "
+	    CleanupRegister "rlLog 'cleanup some more things'"
+	    # cleanup everything upto last mark
+	    CleanupDo --mark
+	  rlPhaseEnd
+
+	  rlPhaseStartCleanup
+	    CleanupDo
+	  rlPhaseEnd
+
+	  rlJournalPrintText
+	rlJournalEnd
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library Cleanup v$__INTERNAL_Cleanup_LIB_VERSION... "
+
+__INTERNAL_Cleanup_stack_file="$BEAKERLIB_DIR/Cleanup_stack"
+touch "$__INTERNAL_Cleanup_stack_file"
+chmod ug+rw "$__INTERNAL_Cleanup_stack_file"
+
+# CleanupRegister ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# CleanupRegister [--mark] CLEANUP_CODE
+#   --mark  - also mark this position
+CleanupRegister() {
+  local mark=0
+  [[ "$1" == "--mark" ]] && {
+    mark=1
+    shift
+  }
+  if ! CleanupGetStack; then
+    rlLogError "cannot continue, could not get cleanup stack"
+    return 1
+  fi
+  CleanupRegisterID="${RANDOM}$(date +"%s%N")"
+  echo -n "Registering cleanup ID=$CleanupRegisterID" >&2
+  if [[ $mark -eq 1 ]]; then
+    __INTERNAL_CleanupMark=( "$CleanupRegisterID" "${__INTERNAL_CleanupMark[@]}" )
+    echo -n " with mark" >&2
+  fi
+  echo " '$1'" >&2
+  rlLogDebug "prepending '$1'"
+  local ID_tag="# ID='$CleanupRegisterID'"
+  __INTERNAL_Cleanup_stack="$ID_tag
+$1
+$ID_tag
+$__INTERNAL_Cleanup_stack"
+  if ! CleanupSetStack "$__INTERNAL_Cleanup_stack"; then
+    rlLogError "an error occured while registering the cleanup '$1'"
+    return 1
+  fi
+  return 0
+}; # end of CleanupRegister }}}
+
+
+# __INTERNAL_Cleanup_get_stack_part ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# 1: ID
+#    -ID    - everything upto the ID
+# 2: ''     - return ID only
+#    'rest' - return exact oposit
+__INTERNAL_Cleanup_get_stack_part() {
+  rlLogDebug "__INTERNAL_Cleanup_get_stack_part(): $* begin"
+  local ID="$1"
+  local n='1 0 1'
+  local stack=''
+  [[ "${ID:0:1}" == "-" ]] && {
+    ID="${ID:1}"
+    n='0 0 1'
+  }
+  [[ "$2" == "rest" ]] && {
+    n="$(echo "${n//0/2}")"
+    n="$(echo "${n//1/0}")"
+    n="$(echo "${n//2/1}")"
+  }
+  n=($n)
+  [[ -n "$DEBUG" ]] && rlLogDebug "$(set | grep ^n=)"
+  local ID_tag="# ID='$ID'"
+  while IFS= read -r line; do
+
+    [[ "$line" == "$ID_tag" ]] && {
+      n=( "${n[@]:1}" )
+      continue
+    }
+    if [[ $n -eq 0 ]]; then
+      stack="$stack
+$line"
+    fi
+  done < <(echo "$__INTERNAL_Cleanup_stack")
+  rlLogDebug "__INTERNAL_Cleanup_get_stack_part(): cleanup stack part is '${stack:1}'"
+  echo "${stack:1}"
+  rlLogDebug "__INTERNAL_Cleanup_get_stack_part(): $* end"
+}; # end of __INTERNAL_Cleanup_get_stack_part }}}
+
+# CleanupUnregister ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupUnregister() {
+  local ID="$1"
+  rlLog "Unregistering cleanup ID='$ID'"
+  if ! CleanupGetStack; then
+    rlLogError "cannot continue, could not get cleanup stack"
+    return 1
+  fi
+  rlLogDebug "removing ID='$ID'"
+  if ! CleanupSetStack "$(__INTERNAL_Cleanup_get_stack_part "$ID" 'rest')"; then
+    rlLogError "an error occured while registering the cleanup '$1'"
+    return 1
+  fi
+  return 0
+}; # end of CleanupUnregister }}}
+
+
+# CleanupMark ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_CleanupMark=()
+CleanupMark() {
+  echo -n "Setting cleanup mark" >&2
+  CleanupRegister --mark '' 2>/dev/null
+  local res=$?
+  echo " ID='$CleanupRegisterID'" >&2
+  return $res
+}; # end of CleanupMark }}}
+
+
+# CleanupDo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# 1: ''   - cleanup all
+#    ID   - cleanup ID only
+#    -ID  - cleanup all upto ID, including
+#    mark - cleanup all unto last mark, including
+CleanupDo() {
+  local ID="$1"
+  if ! CleanupGetStack; then
+    rlLogError "cannot continue, could not get cleanup stack"
+    return 1
+  fi
+  local res tmp newstack=''
+  tmp="$(mktemp)"
+  if [[ "$ID" == "mark" || "$ID" == "--mark" ]]; then
+    echo "execute cleanup upto mark='$__INTERNAL_CleanupMark'" >&2
+    __INTERNAL_Cleanup_get_stack_part "-$__INTERNAL_CleanupMark" | grep -v "^# ID='" > "$tmp"
+    newstack="$(__INTERNAL_Cleanup_get_stack_part "-$__INTERNAL_CleanupMark" 'rest')"
+    __INTERNAL_CleanupMark=("${__INTERNAL_CleanupMark[@]:1}")
+  elif [[ -n "$ID" ]]; then
+    echo "execute cleanup for ID='$ID'" >&2
+    __INTERNAL_Cleanup_get_stack_part "$ID" | grep -v "^# ID='" > "$tmp"
+    newstack="$(__INTERNAL_Cleanup_get_stack_part "$ID" 'rest')"
+  else
+    CleanupTrapUnhook
+    trap "echo 'temporarily blocking ctrl+c until cleanup is done' >&2" SIGINT
+    cat "$__INTERNAL_Cleanup_stack_file" | grep -v "^# ID='" > "$tmp"
+    echo "execute whole cleanup stack" >&2
+  fi
+  . "$tmp"
+  res=$?
+  [[ $res -ne 0 ]] && {
+    echo "cleanup code:" >&2
+    cat -n "$tmp" >&2
+  }
+  rm -f "$tmp"
+  echo "cleanup execution done" >&2
+  if [[ -z "$ID" ]]; then 
+    trap - SIGINT
+  fi
+  if ! CleanupSetStack "$newstack"; then
+    rlLogError "an error occured while cleaning the stack"
+    return 1
+  fi
+  return $res
+}; # end of CleanupDo }}}
+
+
+# CleanupGetStack ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupGetStack() {
+  rlLogDebug "getting cleanup stack"
+  if [[ -r "$__INTERNAL_Cleanup_stack_file" ]]; then
+    if __INTERNAL_Cleanup_stack="$(cat "$__INTERNAL_Cleanup_stack_file")"; then
+      rlLogDebug "cleanup stack is '$__INTERNAL_Cleanup_stack'"
+      return 0
+    fi
+  fi
+  rlLogError "could not load cleanup stack"
+  return 1
+}; # end of CleanupGetStack }}}
+
+
+# CleanupSetStack ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupSetStack() {
+  rlLogDebug "setting cleanup stack to '$1'"
+  __INTERNAL_Cleanup_stack="$1"
+  if echo "$__INTERNAL_Cleanup_stack" > "$__INTERNAL_Cleanup_stack_file"; then
+    rlLogDebug "cleanup stack is now '$__INTERNAL_Cleanup_stack'"
+    return 0
+  fi
+  rlLogError "could not set cleanup stack"
+  return 1
+}; # end of CleanupSetStack }}}
+
+
+__INTERNAL_Cleanup_signals=''
+__INTERNAL_Cleanup_trap_code='rlJournalStart; rlPhaseStartCleanup; CleanupDo; rlPhaseEnd; rlJournalPrintText; rlJournalEnd; exit'
+# CleanupTrapHook ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupTrapHook() {
+  rlLog "register cleanup trap"
+  __INTERNAL_Cleanup_signals="${1:-"SIGHUP SIGINT SIGTERM EXIT"}"
+  eval "trap \"${__INTERNAL_Cleanup_trap_code}\" $__INTERNAL_Cleanup_signals"
+}; # end of CleanupTrapHook }}}
+
+
+# CleanupTrapUnhook ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupTrapUnhook() {
+  if [[ -n "$__INTERNAL_Cleanup_signals" ]]; then
+    rlLog "unregister cleanup trap"
+    eval trap - $__INTERNAL_Cleanup_signals
+    __INTERNAL_Cleanup_signals=''
+  fi
+}; # end of CleanupTrapUnhook }}}
+
+
+# CleanupLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupLibraryLoaded() {
+  CleanupTrapHook
+}; # end of CleanupLibraryLoaded }}}
+
+
+echo "done."
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
diff --git a/tests/run-as/distribution/Library/ConditionalPhases/Makefile b/tests/run-as/distribution/Library/ConditionalPhases/Makefile
new file mode 100644
index 0000000..f017bcb
--- /dev/null
+++ b/tests/run-as/distribution/Library/ConditionalPhases/Makefile
@@ -0,0 +1,59 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/ConditionalPhases
+#   Description: Implements conditional phases.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/ConditionalPhases
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Implements conditional phases." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "Provides:        library(distribution/ConditionalPhases)" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/run-as/distribution/Library/ConditionalPhases/lib.sh b/tests/run-as/distribution/Library/ConditionalPhases/lib.sh
new file mode 100644
index 0000000..39024d1
--- /dev/null
+++ b/tests/run-as/distribution/Library/ConditionalPhases/lib.sh
@@ -0,0 +1,166 @@
+#!/bin/bash
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = ConditionalPhases
+#   library-version = 2
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_ConditionalPhases_LIB_VERSION=2
+__INTERNAL_ConditionalPhases_LIB_NAME='distribution/ConditionalPhases'
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library distribution/condpahses
+
+=head1 DESCRIPTION
+
+Implements conditional phases to eficiently select test phases to be execute
+using white and black lists.
+
+To use this functionality you need to import library
+distribution/ConditionalPhases and add following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/ConditionalPhases)" >> $(METADATA)
+
+=head1 USAGE
+
+=head2 Conditional phases
+
+Each test phase can be conditionally skipped based on a bash regular expression
+given in CONDITIONAL_PHASES_BL and/or CONDITIONAL_PHASES_WL variables.
+
+=over
+
+=item CONDITIONAL_PHASES_BL
+
+It is a black list. If match phase name the respective phase should be skipped.
+
+=item CONDITIONAL_PHASES_WL
+
+It is a white list. If does B<not> match phase name the respective phase should
+be skipped excluding phases contatning 'setup' or 'cleanup' in its name. Names
+'setup' and 'cleanup' are matched case insenitively.
+
+=back
+
+Actual skipping has to be done in the test case itself by using return code of
+functions I<rlPhaseStart>, I<rlPhaseStartSetup>, I<rlPhaseStartTest>, and
+I<rlPhaseStartCleanup>.
+
+Example:
+
+    rlPhaseStartTest "phase name" && {
+      ...
+    rlPhaseEnd; }
+
+Evaluation of the phase relevancy works as follows:
+    1. If CONDITIONAL_PHASES_BL is non-empty and matches phase name => return 2.
+    2. If phase name contains word 'setup' or 'cleanup' or CONDITIONAL_PHASES_WL
+       is empty => return 0.
+    3. If CONDITIONAL_PHASES_WL is non-empty and matches phase name => return 0
+       otherwise return 1.
+
+Normaly Setup and Cleanup phases are not skipped unless hey are B<explicitly>
+black-listed.
+
+To make the test work properly with conditional phases it is necessary to
+surround phase code with curly brackets and make it conditionally executed
+based on rlPhaseStart* function's exit code the same way as it is demostrated in
+the example above. To make the process easy you can use following command:
+
+    sed 's/rlPhaseStart[^{]*$/& \&\& {/;s/rlPhaseEnd[^}]*$/&; }/'
+
+This code can be embedded in Makefile by modifying build target to following
+form:
+
+    build: $(BUILT_FILES)
+    	grep -Eq 'rlPhase(Start[^{]*|End[^}]*)$' runtest.sh && sed -i 's/rlPhaseStart[^{]*$/& \&\& {/;s/rlPhaseEnd[^}]*$/&; }/' testrun.sh
+    	test -x runtest.sh || chmod a+x runtest.sh
+
+
+=cut
+#'
+echo -n "loading library $__INTERNAL_ConditionalPhases_LIB_NAME v$__INTERNAL_ConditionalPhases_LIB_VERSION... "
+
+
+# ConditionalPhasesLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+ConditionalPhasesLibraryLoaded() {
+  if [[ -n "$CONDITIONAL_PHASES_BL" || -n "$CONDITIONAL_PHASES_WL" ]]; then
+    __INTERNAL_ConditionalPhases_eval() {
+      # check phases black-list
+      [[ -n "$CONDITIONAL_PHASES_BL" && "$1" =~ $CONDITIONAL_PHASES_BL ]] && {
+        rlLogWarning "phase '$1' should be skipped as it is defined in \$CONDITIONAL_PHASES_BL='$CONDITIONAL_PHASES_BL'"
+        return 2
+      }
+      # always execute Setup, Cleanup and if no PHASES (white-list) specified
+      [[ "$1" =~ $(echo "\<[Ss][Ee][Tt][Uu][Pp]\>") || "$1" =~ $(echo "\<[Cc][Ll][Ee][Aa][Nn][Uu][Pp]\>") ]] && {
+        rlLogInfo "phase '$1' will be executed as 'setup' and 'cleanup' phases are allowed by default, these can be black-listed"
+        return 0
+      }
+      [[ -z "$CONDITIONAL_PHASES_WL" ]] && {
+        rlLogInfo "phase '$1' will be executed as there is no rule for it"
+        return 0
+      }
+      [[ "$1" =~ $CONDITIONAL_PHASES_WL ]] && {
+        rlLogInfo "phase '$1' will be executed as it is defined in \$CONDITIONAL_PHASES_WL='$CONDITIONAL_PHASES_WL'"
+        return 0
+      } || {
+        rlLogWarning "phase '$1' should be skipped as it is not defined in \$CONDITIONAL_PHASES_WL='$CONDITIONAL_PHASES_WL'"
+        return 1
+      }
+    }
+
+    rlLogInfo "replacing rlPhaseStart by modified function with conditional phases implemented"
+    :; rlPhaseStart() {
+        if [ "x$1" = "xFAIL" -o "x$1" = "xWARN" ] ; then
+            __INTERNAL_ConditionalPhases_eval "$2" && \
+            rljAddPhase "$1" "$2"
+            return $?
+        else
+            rlLogError "rlPhaseStart: Unknown phase type: $1"
+            return 1
+        fi
+    }
+  else
+    rlLogInfo "Neither CONDITIONAL_PHASES_WL nor CONDITIONAL_PHASES_BL is defined, not applying modifications"
+  fi
+}; # end of ConditionalPhasesLibraryLoaded }}}
+
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
+echo 'done.'
diff --git a/tests/run-as/distribution/Library/Log/Makefile b/tests/run-as/distribution/Library/Log/Makefile
new file mode 100644
index 0000000..3cf0e65
--- /dev/null
+++ b/tests/run-as/distribution/Library/Log/Makefile
@@ -0,0 +1,48 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/Log
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/Log
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Provides yet another logging facility that does not rely on beakerlib while it can integrate with it." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/opts)" >> $(METADATA)
+	@echo "Provides:        library(distribution/Log)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/run-as/distribution/Library/Log/lib.sh b/tests/run-as/distribution/Library/Log/lib.sh
new file mode 100644
index 0000000..ac1db3d
--- /dev/null
+++ b/tests/run-as/distribution/Library/Log/lib.sh
@@ -0,0 +1,637 @@
+#!/bin/bash
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = Log
+#   library-version = 11
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_Log_LIB_VERSION=11
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library Log
+
+=head1 DESCRIPTION
+
+This library provide logging capability which does not rely on beakerlib so it
+can be used standalone.
+
+If it is used within beakerlib it automatically bypass all messages to the
+beakerlib.
+
+Also this library provide journaling feature so the summary can be printed out
+at the end.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/Log and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/Log)" >> $(METADATA)
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library Log v$__INTERNAL_Log_LIB_VERSION... "
+
+
+__INTERNAL_Log_prefix=''
+__INTERNAL_Log_prefix2=''
+__INTERNAL_Log_postfix=''
+__INTERNAL_Log_default_level=3
+__INTERNAL_Log_level=$__INTERNAL_Log_default_level
+LogSetDebugLevel() {
+  if [[ -n "$1" ]]; then 
+    if [[ "$1" =~ ^[0-9]+$ ]]; then 
+      let __INTERNAL_Log_level=$__INTERNAL_Log_default_level+$1;
+    else
+      __INTERNAL_Log_level=255
+    fi
+  else
+    __INTERNAL_Log_level=$__INTERNAL_Log_default_level
+  fi
+}
+LogSetDebugLevel "$DEBUG"
+let __INTERNAL_Log_level_LOG=0
+let __INTERNAL_Log_level_FATAL=0
+let __INTERNAL_Log_level_ERROR=1
+let __INTERNAL_Log_level_WARNING=2
+let __INTERNAL_Log_level_INFO=3
+let __INTERNAL_Log_level_DEBUG=4
+let __INTERNAL_Log_level_MORE=5
+let __INTERNAL_Log_level_MORE_=$__INTERNAL_Log_level_MORE+1
+let __INTERNAL_Log_level_MORE__=$__INTERNAL_Log_level_MORE_+1
+let __INTERNAL_Log_level_MORE___=$__INTERNAL_Log_level_MORE__+1
+
+# Log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+Log() {
+  LogMore___ -f "begin '$*'"
+  local pri=$2 message="${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+  if [[ -n "$pri" ]]; then
+    LogPrintMessage "$pri" "$message"
+    LogjAddMessage "$pri" "$message"
+  else
+    LogPrintMessage "$(date +%H:%M:%S)" "$message"
+    LogjAddMessage "INFO" "$message"
+  fi
+  LogMore___ -f "end"
+  return 0
+}; # end of Log }}}
+
+
+__INTERNAL_Log_condition() {
+  cat <<EOF
+  __INTERNAL_Log_level_do=$1
+  if [[ \$__INTERNAL_Log_level -ge \$__INTERNAL_Log_level_do ]]; then
+    [[ -z "$2" ]] && return 1
+  else
+    return 0
+  fi
+EOF
+}
+
+
+# LogInfo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogInfo() {
+  __INTERNAL_LogPrio='INFO'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_INFO  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='INFO'
+  Log "$1" $__INTERNAL_LogPrio
+  LogMore___ -f "end"
+  return 0
+}; # end of LogInfo }}}
+
+
+# LogWarn ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogWarn() {
+  __INTERNAL_LogPrio='WARNING'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_WARNING  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='WARNING'
+  Log "$1" $__INTERNAL_LogPrio
+  LogMore___ -f "end"
+  return 0
+}; # end of LogWarn }}}
+
+
+# LogWarning ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogWarning() {
+  __INTERNAL_LogPrio='WARNING'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_WARNING  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='WARNING'
+  Log "$1" $__INTERNAL_LogPrio
+  LogMore___ -f "end"
+  return 0
+}; # end of LogWarning }}}
+
+
+# LogError ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogError() {
+  __INTERNAL_LogPrio='ERROR'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_ERROR  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='ERROR'
+  Log "$1" $__INTERNAL_LogPrio
+  LogMore___ -f "end"
+  return 0
+}; # end of LogError }}}
+
+
+# LogFatal ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogFatal() {
+  __INTERNAL_LogPrio='FATAL'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_FATAL  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='FATAL'
+  Log "$1" $__INTERNAL_LogPrio
+  exit 255
+  LogMore___ -f "end"
+}; # end of LogFatal }}}
+
+
+# LogPASS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogPASS() {
+  LogMore___ -f "begin '$*'"
+  Log "$1" PASS
+  LogMore___ -f "end"
+  return 0
+}
+LogPass() {
+  LogPASS "$@"
+}; # end of LogPASS }}}
+
+
+# LogFAIL ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogFAIL() {
+  LogMore___ -f "begin '$*'"
+  Log "$1" FAIL
+  LogMore___ -f "end"
+  return 0
+}
+LogFail() {
+  LogFAIL "$@"
+}; # end of LogFAIL }}}
+
+
+# LogDo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogDo() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    local tmp=${BASH_REMATCH[1]:-1}
+    pref="${FUNCNAME[$tmp]}(): "
+  }
+  LogPrintMessage "$__INTERNAL_LogPrio" "${__INTERNAL_Log_prefix}${pref}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+  return 0
+}; # end of LogDo }}}
+
+
+# LogDebug ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogDebug() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  __INTERNAL_Log_level_do=${2:-$__INTERNAL_Log_level_DEBUG}
+  __INTERNAL_LogPrio='DEBUG'
+  [[ $__INTERNAL_Log_level_do -ge $__INTERNAL_Log_level_MORE ]] && __INTERNAL_LogPrio="${__INTERNAL_LogPrio}:$(($__INTERNAL_Log_level_do-$__INTERNAL_Log_level_DEBUG+1))"
+  eval "$(__INTERNAL_Log_condition \${2:-\$__INTERNAL_Log_level_DEBUG}  \"\$1\")"
+  LogDo $pref "$1"
+  return 0
+}; # end of LogDebug }}}
+
+
+# LogMore ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogMore() {
+  # log if DEBUG does not containg a number
+  # or the number is greater or equal to 2
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" ${2:-$__INTERNAL_Log_level_MORE}
+}; # end of LogMore }}}
+
+
+# LogMore_ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogMore_() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE_
+}; # end of LogMore_ }}}
+
+
+# LogMore__ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogMore__() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE__
+}; # end of LogMore__ }}}
+
+
+# LogMore___ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogMore___() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE___
+}; # end of LogMore___ }}}
+
+
+# LogMoreLow ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogMoreLow_Obs=''
+LogMoreLow() {
+  [[ -z "$__INTERNAL_LogMoreLow_Obs" ]] && {
+    LogMore_ -f "LogMoreLow is obsoleted by LogMore_"
+    __INTERNAL_LogMoreLow_Obs=1
+  }
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE_
+}; # end of LogMoreLow }}}
+
+
+# LogMoreMed ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogMoreMed_Obs=''
+LogMoreMed() {
+  [[ -z "$__INTERNAL_LogMoreMed_Obs" ]] && {
+    LogMore__ -f "LogMoreMed is obsoleted by LogMore__"
+    __INTERNAL_LogMoreMed_Obs=1
+  }
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE__
+}; # end of LogMoreMed }}}
+
+
+# LogMoreHigh ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogMoreHigh_Obs=''
+LogMoreHigh() {
+  [[ -z "$__INTERNAL_LogMoreHigh_Obs" ]] && {
+    LogMore___ -f "LogMoreHigh is obsoleted by LogMore___"
+    __INTERNAL_LogMoreHigh_Obs=1
+  }
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE___
+}; # end of LogMoreHigh }}}
+
+
+# LogjAddMessage ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogjAddMessage() {
+  LogMore__ -f "begin '$*'"
+  __INTERNAL_Log_journal=("${__INTERNAL_Log_journal[@]}" "$1" "$2")
+  LogMore__ -f "end"
+  true;
+}; # end of LogjAddMessage }}}
+
+# __INTERNAL_LogCenterText ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogCenterText() {
+  local spaces='                                                                              '
+  # strip colors
+  local log_pri_strip=$(echo -en "$1" | sed -r "s:\x1B\[[0-9;]*[mK]::g")
+  local log_pri_strip_count=${#log_pri_strip}
+  local left_spaces=$(( ($2 - $log_pri_strip_count) / 2 ))
+  local right_spaces=$(( $2 - $log_pri_strip_count - $left_spaces ))
+  echo -en "${spaces:0:$left_spaces}${1}${spaces:0:$right_spaces}"
+}; # end of __INTERNAL_LogCenterText }}}
+
+
+# LogPrintMessage ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogPrintMessage() {
+  echo -e ":: [$(__INTERNAL_LogCenterText "$1" 10)] :: $2" >&2
+  return 0
+}; # end of LogPrintMessage }}}
+
+
+# LogReport ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 LogReport
+
+Prints final report similar to breakerlib's rlJournalPrintText. This is useful
+mainly if you use TCF without beakerlib.
+
+    LogReport
+
+=cut
+#'
+
+LogReport() {
+  echo -e "\n ====== Summary report begin ======"
+  local a p l i
+  for i in $(seq 0 2 $((${#__INTERNAL_Log_journal[@]}-1)) ); do
+    LogPrintMessage "${__INTERNAL_Log_journal[$i]}" "${__INTERNAL_Log_journal[$((++i))]}"
+  done
+  echo " ======= Summary report end ======="
+  __INTERNAL_Log_journal=()
+}; # end of LogReport }}}
+
+
+# LogFile ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogFile() {
+  LogMore__ -f "begin '$*'"
+  local prio=''
+  [[ $# -ge 3 ]] && {
+    optsBegin
+    optsAdd 'prio|tag|p|t' --mandatory
+    optsDone; eval "${optsCode}"
+  }
+  cat $1 | while IFS= read line; do
+    Log "$line" "${prio:-$2}"
+  done
+  LogMore__ -f "end"
+}; #}}}
+
+
+# LogText ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogText() {
+  LogMore__ -f "begin '$*'"
+  local prio=''
+  [[ $# -ge 3 ]] && {
+    optsBegin
+    optsAdd 'prio|tag|p|t' --mandatory
+    optsDone; eval "${optsCode}"
+  }
+  {
+    if [[ "$1" == "-" ]]; then
+      cat -
+    else
+      echo "$1"
+    fi
+  } | while IFS= read line; do
+    Log "$line" "${prio:-$2}"
+  done
+  LogMore__ -f "end"
+}; #}}}
+
+
+# LogStrippedDiff ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogStrippedDiff() {
+  LogMore__ -f "begin '$*'"
+  local prio=''
+  [[ $# -ge 3 ]] && {
+    optsBegin
+    optsAdd 'prio|tag|p|t' --mandatory
+    optsDone; eval "${optsCode}"
+  }
+  {
+    if [[ -n "$2" ]]; then
+      diff -U0 "$1" "$2"
+    else
+      cat $1
+    fi
+  } | grep -v -e '^@@ ' -e '^--- ' -e '^+++ ' | while IFS= read line; do
+    Log "$line" "$prio"
+  done
+  LogMore__ -f "end"
+}; #}}}
+
+
+# LogRun ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogRun() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogMore
+  local dolog=$?
+  [[ $dolog -eq 0 ]] || {
+    local param params blacklist="[[:space:]]|>|<|\|"
+    [[ "${#@}" -eq 1 ]] && params="$1" || {
+      for param in "$@"; do
+        if [[ "$param" =~ $blacklist ]]; then
+          params="$params \"${param//\"/\\\"}\""
+        else
+          params="$params $param"
+        fi
+      done
+      params="${params:1}"
+    }
+    LogDo $pref "executing >>>>> ${params} <<<<<"
+  }
+  eval "$@"
+  ret=$?
+  [[ $dolog -eq 0 ]] || LogMore $pref "execution >>>>> ${params} <<<<< returned '$ret'"
+  return $ret
+}; # end of LogRun }}}
+
+
+# LogDebugNext ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogDebugNext() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}))"
+  }
+  LogDebug '' ${1:-$__INTERNAL_Log_level_DEBUG} || {
+    __INTERNAL_Log_DEBUGING=0
+    trap "
+      __INTERNAL_Log_DEBUGING_res=\$?
+      let __INTERNAL_Log_DEBUGING++
+      if [[ \$__INTERNAL_Log_DEBUGING -eq 1 ]]; then
+        __INTERNAL_Log_DEBUGING_cmd=\"\$BASH_COMMAND\"
+        LogDebug $pref \"executing >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<<\" ${1:-$__INTERNAL_Log_level_DEBUG}
+      else
+        trap - DEBUG
+        LogDebug $pref \"execution >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<< returned \$__INTERNAL_Log_DEBUGING_res\" ${1:-$__INTERNAL_Log_level_DEBUG}
+      fi" DEBUG 
+  }
+}; # end of LogDebugNext }}}
+
+
+# LogMoreNext ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogMoreNext() {
+  LogMore || {
+    local pref=''
+    [[ "$1" =~ ^-f([0-9]*) ]] && {
+      shift
+      pref="-f$((${BASH_REMATCH[1]:-1}))"
+    }
+    LogDebugNext $pref  ${1:-$__INTERNAL_Log_level_MORE}
+  }
+}; # end of LogMoreNext }}}
+LogNext() {
+  LogMoreNext "$@"
+}
+
+
+# LogDebugOn ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogDebugOn() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}))"
+  }
+  LogDebug '' ${1:-$__INTERNAL_Log_level_DEBUG} || {
+    trap "
+      __INTERNAL_Log_DEBUGING_res=\$?
+      let __INTERNAL_Log_DEBUGING++
+      if [[ -z \"\$__INTERNAL_Log_DEBUGING_cmd\" ]]; then
+        __INTERNAL_Log_DEBUGING_cmd=\"\$BASH_COMMAND\"
+        LogDebug $pref \"executing >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<<\" ${1:-$__INTERNAL_Log_level_DEBUG}
+      else
+        LogDebug $pref \"execution >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<< returned \$__INTERNAL_Log_DEBUGING_res\" ${1:-$__INTERNAL_Log_level_DEBUG}
+        __INTERNAL_Log_DEBUGING_cmd=\"\$BASH_COMMAND\"
+        if [[ \"\$__INTERNAL_Log_DEBUGING_cmd\" =~ LogDebugOff ]]; then
+          trap - DEBUG
+        else
+          LogDebug $pref \"executing >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<<\" ${1:-$__INTERNAL_Log_level_DEBUG}
+        fi
+      fi" DEBUG 
+  }
+}; # end of LogDebugOn }}}
+
+
+# LogMoreOn ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogMoreOn() {
+  LogMore || {
+    local pref=''
+    [[ "$1" =~ ^-f([0-9]*) ]] && {
+      shift
+      pref="-f$((${BASH_REMATCH[1]:-1}))"
+    }
+    LogDebugOn $pref ${1:-$__INTERNAL_Log_level_MORE}
+  }
+}; # end of LogMoreOn }}}
+
+
+# LogDebugOff ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogDebugOff() {
+  __INTERNAL_Log_DEBUGING_cmd=''
+}; # end of LogDebugOff }}}
+
+
+# LogVar ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogVar() {
+  [[ -n "$DEBUG" ]] && {
+    echo -n 'eval '
+    while [[ -n "$1" ]]; do
+      echo -n "LogDebug -f \"\$(set | grep -P '^$1=')\";"
+      shift
+    done
+  }
+}; # end of LogVar }}}
+
+
+# __INTERNAL_LogRedirectToBeakerlib ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogRedirectToBeakerlib() {
+  echo -e "\nrunning inside the beakerlib - redirect own logging functions to beakerlib ones"
+  true; LogjAddMessage() {
+    LogMore___ -f "begin $*"
+    rljAddMessage "$2" "$1"
+    LogMore___ -f "end $*"
+  }
+  true; Log() {
+    LogMore___ -f "begin $*"
+    case ${2} in
+      INFO)
+        LogjAddMessage "INFO" "$1"
+        LogPrintMessage "$2" "${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+        ;;
+      BEGIN)
+        LogjAddMessage "INFO" "$*:"
+        LogPrintMessage "$2" "${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+        ;;
+      WARNING|WARN|ERROR|FATAL)
+        LogjAddMessage "WARNING" "$1"
+        LogPrintMessage "$2" "${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+        ;;
+      SKIP|SKIPPING)
+        LogjAddMessage "WARNING" "$*:"
+        LogPrintMessage "$2" "${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+        ;;
+      FAIL)
+        rlFail "$*"
+        return $?
+        ;;
+      PASS)
+        rlPass "$*"
+        return $?
+        ;;
+      *)
+        rlLog "$*"
+        ;;
+    esac
+    LogMore___ -f "end $*"
+    return 0;
+  }
+}
+# end of __INTERNAL_LogRedirectToBeakerlib }}}
+
+
+# LogLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogLibraryLoaded() {
+  declare -F rlDie > /dev/null && __INTERNAL_LogRedirectToBeakerlib
+  return 0
+}; # end of LogLibraryLoaded }}}
+
+
+echo "done."
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
diff --git a/tests/run-as/distribution/Library/opts/Makefile b/tests/run-as/distribution/Library/opts/Makefile
new file mode 100644
index 0000000..389fe25
--- /dev/null
+++ b/tests/run-as/distribution/Library/opts/Makefile
@@ -0,0 +1,48 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/opts
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/opts
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Provides simple way for defining script's or function's options including help" >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/Log)" >> $(METADATA)
+	@echo "Provides:        library(distribution/opts)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/run-as/distribution/Library/opts/lib.sh b/tests/run-as/distribution/Library/opts/lib.sh
new file mode 100644
index 0000000..180f7ba
--- /dev/null
+++ b/tests/run-as/distribution/Library/opts/lib.sh
@@ -0,0 +1,338 @@
+#!/bin/bash
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = opts
+#   library-version = 4
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_opts_LIB_VERSION=4
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library opts
+
+=head1 DESCRIPTION
+
+This library provides simple way for defining script's or function's option
+agruments including help.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/opts and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/opts)" >> $(METADATA)
+
+B<Code example>
+
+	testfunction() {
+	  optsBegin -h "Usage: $0 [options]
+	
+	  options:
+	"
+	  optsAdd 'flag1' --flag
+	  optsAdd 'optional1|o' --optional
+	  optsAdd 'Optional2|O' "echo opt \$1" --optional --long --var-name opt
+	  optsAdd 'mandatory1|m' "echo man \$1" --mandatory
+	  optsDone; eval "${optsCode}"
+	  echo "$optional1"
+	  echo "$opt"
+	  echo "$mandatory1"
+	}
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library opts v$__INTERNAL_opts_LIB_VERSION... "
+
+# optsAdd ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsAdd() {
+  LogMoreMed -f "begin '$*'"
+  local GETOPT=$(getopt -q -o fomv:d:lh:l -l flag,opt,optional,mandatory,varname:,default:,local,help:,long -- "$@")
+  eval set -- "$GETOPT"
+  local type='f' var_name var_name_set default help long
+  while [[ -n "$@" ]]; do
+    case $1 in
+    --)
+      shift; break
+      ;;
+    -h|--help)
+      shift
+      help="$1"
+      ;;
+    -l|--long)
+      long=1
+      ;;
+    -d|--default)
+      shift
+      default="$1"
+      ;;
+    -v|--varname|--var-name)
+      shift
+      var_name="$1"
+      var_name_set=1
+      ;;
+    -f|--flag)
+      type='f'
+      ;;
+    -o|--opt|--optional)
+      type='o'
+      ;;
+    -m|--mandatory)
+      type='m'
+      ;;
+    *)
+      echo "unknown option '$1'"
+      return 1
+      ;;
+    esac
+    shift;
+  done
+  [ -z "$var_name" ] && {
+    var_name=$(echo -n "$1" | cut -d '|' -f 1 | sed -e 's/-//g;s/^[0-9]/_\0/')
+    LogMoreHigh -f "constructing variable name '$var_name'"
+  }
+  local opts='' opts_help='' optsi=''
+  for optsi in $(echo -n "$1" | tr '|' ' '); do
+    if [[ ${#optsi} -ge 2 || $long -eq 1 ]]; then 
+      opts="$opts|--$optsi"
+      opts_help="$opts_help|--$optsi[=ARG]"
+      __INTERNAL_opts_long="${__INTERNAL_opts_long},${optsi}"
+      LogMoreHigh -f "adding long option '$optsi'"
+      case $type in
+      m)
+        __INTERNAL_opts_long="${__INTERNAL_opts_long}:"
+        ;;
+      o)
+        __INTERNAL_opts_long="${__INTERNAL_opts_long}::"
+        ;;
+      esac
+    else
+      opts="$opts|-$optsi"
+      opts_help="$opts_help|-${optsi}[ARG]"
+      __INTERNAL_opts_short="${__INTERNAL_opts_short}${optsi}"
+      LogMoreHigh -f "adding short option '$optsi'"
+      case $type in
+      m)
+        __INTERNAL_opts_short="${__INTERNAL_opts_short}:"
+        ;;
+      o)
+        __INTERNAL_opts_short="${__INTERNAL_opts_short}::"
+        ;;
+      esac
+    fi
+  done
+  optsCode="${optsCode}
+  ${opts:1})
+    optsPresent=\"\${optsPresent}$var_name \""
+  LogMoreHigh -f "adding code for processing option '${opts:1}'"
+  __INTERNAL_opts_init_var="$__INTERNAL_opts_init_var
+${__INTERNAL_opts_local}$var_name=()"
+  __INTERNAL_opts_default="$__INTERNAL_opts_default
+[[ \"\$optsPresent\" =~ \$(echo \"\<${var_name}\>\") ]] || ${__INTERNAL_opts_local}$var_name='$default'"
+  case $type in
+  f)
+    [[ -z "$2" || -n "$var_name_set" ]] && {
+      local val=1
+      [[ -n "$default" ]] && val=''
+      optsCode="$optsCode
+    $var_name+=( '$val' )"
+    }
+    __INTERNAL_opts_help="${__INTERNAL_opts_help}
+  ${opts:1}"
+    ;;
+  o|m)
+    optsCode="$optsCode
+    shift"
+    [[ -z "$2" || -n "$var_name_set"  ]] && optsCode="$optsCode
+    $var_name+=( \"\$1\" )"
+    if [[ "$type" == "o" ]]; then
+      __INTERNAL_opts_help="${__INTERNAL_opts_help}
+  ${opts_help:1}"
+    else
+      __INTERNAL_opts_help="${__INTERNAL_opts_help}
+  ${opts:1} ARG"
+    fi
+    ;;
+  esac
+  [[ -n "$2" ]] && {
+  optsCode="$optsCode
+    $2"
+  }
+  optsCode="$optsCode
+    ;;"
+
+  __INTERNAL_opts_help="${__INTERNAL_opts_help}${help:+
+      $help
+}"
+  LogMoreMed -f "end"
+}; # end of optsAdd }}}
+
+
+# optsBegin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsBegin() {
+  LogMoreMed -f "begin '$*'"
+  optsCode=''
+  optsPresent=' '
+  __INTERNAL_opts_short='.'
+  __INTERNAL_opts_long='help'
+  __INTERNAL_opts_help=''
+  __INTERNAL_opts_local=''
+  __INTERNAL_opts_default=''
+  __INTERNAL_opts_init_var=''
+  [[ "${FUNCNAME[1]}" != "main" ]] && __INTERNAL_opts_local='local '
+  while [[ -n "$1" ]]; do
+    case $1 in
+    --)
+      shift; break
+      ;;
+    -h|--help)
+      shift
+      __INTERNAL_opts_help="$1"
+      ;;
+    *)
+      echo "unknown option '$1'"
+      return 1
+      ;;
+    esac
+    shift;
+  done
+  LogMoreMed -f "end"
+}; # end of optsBegin }}}
+
+
+# optsDone ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsDone() {
+  LogMoreMed -f "begin '$*'"
+  optsCode="${__INTERNAL_opts_local}GETOPT=\$(getopt -o ${__INTERNAL_opts_short} -l ${__INTERNAL_opts_long} -- \"\$@\")
+[[ \$? -ne 0 ]] && {
+  echo 'Exiting'
+  return 1 >& /dev/null
+  exit 1
+}
+eval set -- \"\$GETOPT\"
+${__INTERNAL_opts_init_var:1}
+while [[ -n \"\$1\" ]]; do
+  case \$1 in
+  --)
+    shift; break
+    ;;
+${optsCode}
+
+  --help)
+    echo \"\$__INTERNAL_opts_help\"
+    return >& /dev/null
+    exit
+    ;;
+  *)
+    echo \"unknown option '\$1'\"
+    return 1 >& /dev/null
+    exit 1
+  ;;
+  esac
+  shift
+done
+${__INTERNAL_opts_default:1}
+unset optsCode __INTERNAL_opts_help __INTERNAL_opts_short __INTERNAL_opts_long __INTERNAL_opts_default __INTERNAL_opts_init_var __INTERNAL_opts_local
+"
+  if ! echo "$optsCode" | grep -q -- '--help$'; then
+    __INTERNAL_opts_help="$__INTERNAL_opts_help
+  --help
+      Show this help."
+  fi
+  LogMoreHigh -f "optsCode:\n$optsCode"
+  LogMoreMed -f "end"
+}; # end of optsDone }}}
+
+
+# optsSelfCheck ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsSelfCheck() {
+  optsBegin -h "Usage: $0 [options]
+
+  options:
+"
+#  optsAdd 'help' -f 'echo help'
+  optsAdd 'flag' -f 'echo f'
+  optsAdd 'optional|o' -o "echo opt \$1"
+  optsAdd 'Optional|O' -o "echo opt \$1" --long
+  optsAdd 'mandatory|m' -m "echo man \$1"
+  optsDone
+  
+  echo "${optsCode}"
+  
+  echo ...
+  
+  eval "${optsCode}"
+  
+  echo ...
+  
+  fce() {
+    optsBegin -h "Usage: $0 [options]
+
+  options:
+"
+  #  optsAdd 'help' -f 'echo help'
+    optsAdd 'flag' -f
+    optsAdd 'optional|o' -o "echo opt \$1"
+    optsAdd 'Optional|O' -o "echo opt \$1" --long
+    optsAdd 'mandatory|m' -m "echo man \$1"
+    optsDone
+    echo "${optsCode}"
+    
+    echo ...
+    
+    eval "${optsCode}"
+    
+    echo ...
+  }
+  
+  echo -e 'test for opts in function\n========================='
+  fce --help
+}; # end of optsSelfCheck }}}
+
+
+# optsLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsLibraryLoaded() {
+  return 0
+}; # end of LogLibraryLoaded }}}
+
+
+echo "done."
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
diff --git a/tests/run-as/distribution/Library/tcf/Makefile b/tests/run-as/distribution/Library/tcf/Makefile
new file mode 100644
index 0000000..2566969
--- /dev/null
+++ b/tests/run-as/distribution/Library/tcf/Makefile
@@ -0,0 +1,60 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/tcf
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/tcf
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Block style coding with ability of skipping parts." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/Log)" >> $(METADATA)
+	@echo "Provides:        library(distribution/tcf)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/run-as/distribution/Library/tcf/lib.sh b/tests/run-as/distribution/Library/tcf/lib.sh
new file mode 100644
index 0000000..561b0ff
--- /dev/null
+++ b/tests/run-as/distribution/Library/tcf/lib.sh
@@ -0,0 +1,903 @@
+#!/bin/bash
+# try-check-final.sh
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = tcf
+#   library-version = 14
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_tcf_LIB_VERSION=14
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library Try-Check-Final
+
+=head1 DESCRIPTION
+
+This file contains functions which gives user the ability to define blocks of
+code where some of the blocks can be automatically skipped if some of preceeding
+blocks failed.
+
+ATTENTION
+This plugin modifies some beakerlib functions! If you suspect that it breakes
+some functionality set the environment variable TCF_NOHACK to nonempty value.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/tcf and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/tcf)" >> $(METADATA)
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library try-check-final v$__INTERNAL_tcf_LIB_VERSION... "
+
+
+let __INTERNAL_tcf_DEBUG_LEVEL_LOW=3
+let __INTERNAL_tcf_DEBUG_LEVEL_MED=$__INTERNAL_tcf_DEBUG_LEVEL_LOW+1
+let __INTERNAL_tcf_DEBUG_LEVEL_HIGH=$__INTERNAL_tcf_DEBUG_LEVEL_LOW+2
+
+# global variables {{{
+__INTERNAL_tcf_result=0
+__INTERNAL_tcf_result_file="${BEAKERLIB_DIR:-"/var/tmp"}/tcf.result"
+echo -n "$__INTERNAL_tcf_result" > "$__INTERNAL_tcf_result_file"
+__INTERNAL_tcf_current_level_data=()
+__INTERNAL_tcf_current_level_val=0
+__INTERNAL_tcf_journal=()
+#}}}
+
+
+# __INTERNAL_tcf_colorize ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_colorize() {
+  local a
+  case $1 in
+    PASS)
+      a="${__INTERNAL_tcf_color_green}${1}${__INTERNAL_tcf_color_reset}"
+      ;;
+    FAIL)
+      a="${__INTERNAL_tcf_color_red}${1}${__INTERNAL_tcf_color_reset}"
+      ;;
+    SKIPPING|WARNING)
+      a="${__INTERNAL_tcf_color_yellow}${1}${__INTERNAL_tcf_color_reset}"
+      ;;
+    BEGIN|INFO)
+      a="${__INTERNAL_tcf_color_blue}${1}${__INTERNAL_tcf_color_reset}"
+      ;;
+    *)
+      a=$1
+  esac
+  echo -n "$a"
+}; # end of __INTERNAL_tcf_colorize }}}
+
+
+# __INTERNAL_tcf_colors_setup ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_colors_setup(){
+  T="$TERM"
+  [[ -t 1 ]] || T=""
+  [[ -t 2 ]] || T=""
+  [[ "$1" == "--force" ]] && T="xterm"
+  case $T in
+    xterm|screen)
+      __INTERNAL_tcf_color_black="\e[0;30m"
+      __INTERNAL_tcf_color_dark_gray="\e[1;30m"
+      __INTERNAL_tcf_color_blue="\e[0;34m"
+      __INTERNAL_tcf_color_light_blue="\e[1;34m"
+      __INTERNAL_tcf_color_green="\e[0;32m"
+      __INTERNAL_tcf_color_light_green="\e[1;32m"
+      __INTERNAL_tcf_color_cyan="\e[0;36m"
+      __INTERNAL_tcf_color_light_cyan="\e[1;36m"
+      __INTERNAL_tcf_color_red="\e[0;31m"
+      __INTERNAL_tcf_color_light_red="\e[1;31m"
+      __INTERNAL_tcf_color_purple="\e[0;35m"
+      __INTERNAL_tcf_color_light_purple="\e[1;35m"
+      __INTERNAL_tcf_color_brown="\e[0;33m"
+      __INTERNAL_tcf_color_yellow="\e[1;33m"
+      __INTERNAL_tcf_color_light_gray="\e[0;37m"
+      __INTERNAL_tcf_color_white="\e[1;37m"
+      __INTERNAL_tcf_color_reset="\e[00m"
+      ;;
+    * )
+      __INTERNAL_tcf_color_black=""
+      __INTERNAL_tcf_color_dark_gray=""
+      __INTERNAL_tcf_color_blue=""
+      __INTERNAL_tcf_color_light_blue=""
+      __INTERNAL_tcf_color_green=""
+      __INTERNAL_tcf_color_light_green=""
+      __INTERNAL_tcf_color_cyan=""
+      __INTERNAL_tcf_color_light_cyan=""
+      __INTERNAL_tcf_color_red=""
+      __INTERNAL_tcf_color_light_red=""
+      __INTERNAL_tcf_color_purple=""
+      __INTERNAL_tcf_color_light_purple=""
+      __INTERNAL_tcf_color_brown=""
+      __INTERNAL_tcf_color_yellow=""
+      __INTERNAL_tcf_color_light_gray=""
+      __INTERNAL_tcf_color_white=""
+      __INTERNAL_tcf_color_reset=""
+      ;;
+  esac
+}; # end of __INTERNAL_tcf_colors_setup
+__INTERNAL_tcf_colors_setup; # }}}
+
+
+# __INTERNAL_tcf_copy_function ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_copy_function() {
+    declare -F $1 > /dev/null || return 1
+    eval "$(echo -n "${2}() "; declare -f ${1} | tail -n +2)"
+}; # end of __INTERNAL_tcf_copy_function }}}
+
+
+# __INTERNAL_tcf_addE2R ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_addE2R() {
+  __INTERNAL_tcf_copy_function $1 TCF_orig_$1
+  eval "${1}() { TCF_orig_${1} \"\$@\"; tcfE2R; }"
+}; # end of __INTERNAL_tcf_addE2R }}}
+
+
+# __INTERNAL_tcf_insertE2R ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_insertE2R() {
+  __INTERNAL_tcf_copy_function $1 TCF_orig_$1
+  eval "$(echo -n "${1}() "; declare -f ${1} | tail -n +2 | sed -e 's/\(.*__INTERNAL_ConditionalAssert.*\)/\1\ntcfE2R;/')"
+}; # end of __INTERNAL_tcf_insertE2R }}}
+
+
+# __INTERNAL_tcf_get_current_level ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_get_current_level() {
+  local l=$__INTERNAL_tcf_current_level_val
+  if [[ $1 ]]; then
+    l=$(($l+$1))
+  fi
+  local i
+  for i in $(seq 1 $(($l*2)) ); do echo -n " "; done
+  return $l
+}; # end of __INTERNAL_tcf_get_current_level }}}
+
+
+# __INTERNAL_tcf_incr_current_level ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_incr_current_level() {
+  let __INTERNAL_tcf_current_level_val++
+  __INTERNAL_Log_prefix=$(__INTERNAL_tcf_get_current_level)
+}; # end of __INTERNAL_tcf_incr_current_level }}}
+
+
+# __INTERNAL_tcf_decr_current_level ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_decr_current_level() {
+  let __INTERNAL_tcf_current_level_val--
+  __INTERNAL_Log_prefix=$(__INTERNAL_tcf_get_current_level)
+}; # end of __INTERNAL_tcf_decr_current_level }}}
+
+
+# __INTERNAL_tcf_do_hack ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_do_hack() {
+   LogDebug "TCF_NOHACK='$TCF_NOHACK'"
+   if [[ -z "$TCF_NOHACK" ]]; then
+    tcfChk "Apply TCF beakerlib hacks" && {
+      rlLog "  injecting tcf hacks into the beakerlib functions"
+      echo -n "patching rlLog"
+      local rlL=$(declare -f rlLog | sed -e 's|\] ::|\0${__INTERNAL_Log_prefix}|;s|$3 $1"|${3:+"$3 "}$1"|')
+      eval "$rlL"
+
+      echo -n ", rljAddTest"
+      __INTERNAL_tcf_copy_function rljAddTest __INTERNAL_tcf_orig_rljAddTest
+      true; rljAddTest() {
+        local a="${__INTERNAL_Log_prefix}$1"; shift
+        [[ "$1" != "FAIL" ]]; tcfE2R
+        __INTERNAL_tcf_journal=("${__INTERNAL_tcf_journal[@]}" "$1" "$a")
+        __INTERNAL_tcf_orig_rljAddTest "$a" "$@"
+      }
+      echo -n ", rljAddMessage"
+      __INTERNAL_tcf_copy_function rljAddMessage __INTERNAL_tcf_orig_rljAddMessage
+      true; rljAddMessage() {
+        local a="${__INTERNAL_Log_prefix}$1"; shift
+        __INTERNAL_tcf_journal=("${__INTERNAL_tcf_journal[@]}" "$1" "$a")
+        __INTERNAL_tcf_orig_rljAddMessage "$a" "$@"
+      }
+      echo -n ", __INTERNAL_LogAndJournalFail"
+      __INTERNAL_tcf_copy_function __INTERNAL_LogAndJournalFail __INTERNAL_tcf_orig___INTERNAL_LogAndJournalFail
+      true; __INTERNAL_LogAndJournalFail() {
+        tcfNOK
+        __INTERNAL_tcf_orig___INTERNAL_LogAndJournalFail "$@"
+      }
+      echo "."
+    tcfFin --no-assert --ignore; }
+  else
+    Log "skip hacking beakerlib functions"
+  fi
+}; # end of __INTERNAL_tcf_do_hack }}}
+
+
+# __INTERNAL_tcf_kill_old_plugin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_kill_old_plugin() {
+    tcfChk "Get rid of the old TCF implementation. removing" && {
+      local comma='' i
+      for i in Try Chk Fin E2R RES OK NOK NEG TCFcheckFinal TCFreport; do
+        echo -n "${comma}rl$i"
+        unset -f rl$i
+        comma=', '
+      done
+      echo '.'
+    tcfFin --no-assert; }
+}; # end of __INTERNAL_tcf_kill_old_plugin }}}
+
+
+: <<'=cut'
+=pod
+
+=head2 Block functions
+
+=cut
+
+# __INTERNAL_tcf_parse_params ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_parse_params() {
+  local GETOPT=$(getopt -q -o if: -l ignore,no-assert,fail-tag: -- "$@")
+  eval set -- "$GETOPT"
+  echo "local ignore noass title fail_tag"
+  echo "[ -z \"\$ignore\" ] && ignore=0"
+  echo "[ -z \"\$noass\" ] && noass=0"
+  echo "[ -z \"\$fail_tag\" ] && fail_tag='FAIL'"
+  while [[ -n "$@" ]]; do
+    case $1 in
+    --)
+      shift; break
+      ;;
+    --ignore|-i)
+      echo "ignore=1"
+      echo "noass=1"
+      ;;
+    --no-assert|-n)
+      echo "noass=1"
+      ;;
+    --fail-tag|-f)
+      shift
+      echo "fail_tag='$1'"
+      ;;
+    *)
+      echo "unknown option $1"
+      return 1
+      ;;
+    esac
+    shift;
+  done
+  [[ -n "$1" ]] && echo "title=\"${1}\""
+  echo "eval set -- \"$(echo "$GETOPT" | sed -e 's/.*-- //')\""
+}; # end of __INTERNAL_tcf_parse_params }}}
+
+
+# tcfTry ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfTry
+
+Starting function of block which will be skipped if an error has been detected
+by tcfFin function occurent before.
+
+    tcfTry ["title"] [-i|--ignore] [--no-assert] [--fail-tag TAG] && {
+      <some code>
+    tcfFin; }
+
+If title is omitted than noting is printed out so no error will be reported (no
+Assert is executed) thus at least the very top level tcfTry should have title.
+
+tcfTry and tcfChk blocks are stackable so you can organize them into a hierarchy
+structure.
+
+Note that tcfFin has to be used otherwise the overall result will not be
+accurate.
+
+=over
+
+=item title
+
+Text which will be displayed and logged at the beginning and the end (in tcfFin
+function) of the block.
+
+=item -i, --ignore
+
+Do not propagate the actual result to the higher level result.
+
+=item -n, --no-assert
+
+Do not log error into the journal.
+
+=item -f, --fail-tag TAG
+
+If the result of the block is FAIL, use TAG instead ie. INFO or WARNING.
+
+=back
+
+Returns 1 if and error occured before, otherwise returns 0.
+
+=cut
+
+tcfTry() {
+  LogMoreLow -f "begin '$*'"
+  local vars=$(__INTERNAL_tcf_parse_params "$@") || { Log "$vars" FAIL; return 1; }
+  LogMoreMed -f "vars:\n$vars"
+  LogMoreLow -f "evaluating options start"
+  eval "$vars"
+  LogMoreLow -f "evaluating options end"
+  local incr=
+  local pp="SKIPPING"
+  tcfRES; # to set __INTERNAL_tcf_result
+  LogMoreLow -f "result was $__INTERNAL_tcf_result"
+  if [[ $__INTERNAL_tcf_result -eq 0 ]]; then
+    __INTERNAL_tcf_current_level_data=("$__INTERNAL_tcf_result" "$vars" "${__INTERNAL_tcf_current_level_data[@]}")
+    pp="BEGIN"
+    incr=1
+  fi
+  if [[ -n "$title" ]]; then
+    Log "$title" "$pp"
+    [[ -n "$incr" ]] && {
+      LogMoreLow -f "increment indentation level"
+      __INTERNAL_tcf_incr_current_level
+    }
+  fi
+  LogMoreLow -f "end"
+  return $__INTERNAL_tcf_result
+}; # end of tcfTry }}}
+
+
+# tcfChk ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfChk
+
+Starting function of block which will be always executed.
+
+    tcfChk ["title"] [-i|--ignore] [--no-assert] [--fail-tag TAG] && {
+      <some code>
+    tcfFin; }
+
+If title is omitted than noting is printed out so no error will be reported (no
+Assert is executed) thus at least the very top level tcfChk should have title.
+
+tcfTry and tcfChk blocks are stackable so you can organize them into a hierarchy
+structure.
+
+Note that tcfFin has to be used otherwise the overall result will not be
+accurate.
+
+For details about arguments see tcfTry.
+
+Returns 0.
+
+=cut
+
+tcfChk() {
+  LogMoreLow -f "begin '$*'"
+  tcfRES; # to set __INTERNAL_tcf_result
+  local res=$__INTERNAL_tcf_result
+  tcfRES 0
+  tcfTry "$@"
+  __INTERNAL_tcf_current_level_data[0]=$res
+  LogMoreLow -f "end"
+  return $__INTERNAL_tcf_result
+}; # end of tcfChk }}}
+
+
+# tcfFin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfFin
+
+Ending function of block. It does some evaluation of previous local and global
+results and puts it into the global result.
+
+    tcfTry ["title"] && {
+      <some code>
+    tcfFin [-i|--ignore] [--no-assert] [--fail-tag TAG]; }
+
+Local result is actualy exit code of the last command int the body.
+
+Global result is an internal varibale hodning previous local results.
+Respectively last error or 0.
+
+For details about arguments see tcfTry.
+
+Returns local result of the preceeding block.
+
+=cut
+
+tcfFin() {
+  local RES=$?
+  LogMoreLow -f "begin '$*'"
+  LogMoreMed -f "previous exit code was '$RES'"
+  local vars=$(__INTERNAL_tcf_parse_params "$@") || { Log "$vars" FAIL; return 1; }
+  LogMoreMed -f "vars:\n$vars"
+  LogMoreLow -f "evaluating options start"
+  eval "$vars"
+  LogMoreLow -f "evaluating options end"
+  tcfRES; # to set __INTERNAL_tcf_result
+  [[ $RES -ne 0 ]] && tcfRES $RES
+  RES=$__INTERNAL_tcf_result
+  LogMoreMed -f "overall result is '$RES'"
+  LogMoreMed -f "data:\n${__INTERNAL_tcf_current_level_data[1]}"
+  LogMoreLow -f "evaluating data start"
+  eval "${__INTERNAL_tcf_current_level_data[1]}"
+  LogMoreLow -f "evaluating data end"
+  if [[ -n "$title" ]]; then
+    __INTERNAL_tcf_decr_current_level
+    if [[ $ignore -eq 1 ]]; then
+      RES=0
+      [[ $__INTERNAL_tcf_result -ne 0 ]] && title="$title - ignored"
+    fi
+    if [[ $noass -eq 0 ]]; then
+      tcfAssert0 "$title" $__INTERNAL_tcf_result "$fail_tag"
+    else
+      if [[ $__INTERNAL_tcf_result -eq 0 ]]; then
+        local pp="PASS"
+        LogInfo "$title - $pp"
+      else
+        local pp="${fail_tag:-FAIL}"
+        LogWarn "$title - $pp"
+      fi
+    fi
+  fi
+  if [[ $__INTERNAL_tcf_result -eq 0 || $ignore -eq 1 ]]; then
+    tcfRES ${__INTERNAL_tcf_current_level_data[0]}
+  fi
+  local i
+  for i in 0 1; do unset __INTERNAL_tcf_current_level_data[$i]; done
+  __INTERNAL_tcf_current_level_data=("${__INTERNAL_tcf_current_level_data[@]}")
+  LogMoreLow -f "end"
+  return $RES
+}; # end of tcfFin }}}
+
+: <<'=cut'
+=pod
+
+=head2 Functions for manipulation with the results
+
+=cut
+
+
+# tcfRES ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfRES
+
+Sets and return the global result.
+
+    tcfRES [-p|--print] [number]
+
+=over
+
+=item -p --print
+
+Also print the result value.
+
+=item number
+
+If present the global result is set to this value.
+
+=back
+
+Returns global result.
+
+=cut
+
+tcfRES() {
+  local p=0
+  while [[ -n "$1" ]]; do
+    case $1 in
+    --print|-p)
+      p=1
+      ;;
+    *)
+      break
+      ;;
+    esac
+    shift
+  done
+  if [[ -n "$1" ]]; then
+    __INTERNAL_tcf_result=$1
+    echo -n "$__INTERNAL_tcf_result" > "$__INTERNAL_tcf_result_file"
+  else
+    __INTERNAL_tcf_result="$(cat "$__INTERNAL_tcf_result_file")"
+  fi
+  [[ $p -eq 1 ]] && echo $__INTERNAL_tcf_result
+  return $__INTERNAL_tcf_result
+}; # end of tcfRES }}}
+
+
+# tcfOK ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfOK
+
+Sets the global result to 0.
+
+    tcfOK
+
+Returns global result.
+
+=cut
+
+tcfOK() {
+  tcfRES 0
+}; # end of tcfOK }}}
+
+
+# tcfNOK ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfNOK
+
+Sets the global result to 1 or given number.
+
+    tcfNOK [number]
+
+=over
+
+=item number
+
+If present the global result is set to this value.
+
+=back
+
+Returns global result.
+
+=cut
+
+tcfNOK() {
+  if [[ -n "$1" ]]; then
+    [[ $1 -eq 0 ]] && echo "You have requested result '0'. You should use tcfOK instead."
+    tcfRES $1
+  else
+    tcfRES 1
+  fi
+}; # end of tcfNOK }}}
+
+
+# tcfE2R ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfE2R
+
+Converts exit code of previous command to local result if the exit code is not 0
+(zero).
+
+    <some command>
+    tcfE2R [number]
+
+=over
+
+=item number
+
+If present use it instead of exit code.
+
+=back
+
+Returns original exit code or given number.
+
+=cut
+
+tcfE2R() {
+  local res=$?
+  [[ -n "$1" ]] && res=$1
+  [[ $res -ne 0 ]] && tcfRES $res
+  return $res
+}; # end of tcfE2R }}}
+
+
+: <<'=cut'
+=pod
+
+=head2 Functions for manipulation with the exit codes
+
+=cut
+
+
+# tcfNEG ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfNEG
+
+Negates exit code of previous command.
+
+    <some command>
+    tcfNEG
+
+Returns 1 if original exit code was 0, otherwise returns 0.
+
+=cut
+
+tcfNEG() {
+  [[ $? -eq 0 ]] && return 1 || return 0
+}; # end of tcfNEG }}}
+
+
+# tcfRun ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfRun
+
+Simmilar to rlRun but it also annouces the beginnign of the command.
+
+    tcfRun [--fail-tag|-f TAG] command [exp_result [title]]
+    
+Moreover if 'command not found' appears on STDERR it should produce WARNING.
+    
+=over
+
+=item command
+
+Command to execute.
+
+=item exp_result
+
+Specification of expect resutl.
+
+It can be a list of values or intervals or * for any result. Also negation (!) can be used.
+
+ Example:
+
+    <=2,7,10-12,>252,!254 means following values 0,1,2,7,10,11,12,253,255
+
+=item title
+
+Text which will be displayed and logged at the beginning and the end of command execution.
+
+=item --fail-tag | -f
+
+If the command fails use TAG instead of FAIL.
+
+=back
+
+Returns exit code of the executed command.
+
+=cut
+
+tcfRun() {
+  LogMore_ -f "begin      $*"
+  optsBegin
+  optsAdd 'fail-tag|f' --mandatory
+  optsAdd 'timeout' --optional 'timeout="${1:-10}"'
+  optsAdd 'kill-timeout|kt' --mandatory --default 5
+  optsAdd 'signal' --mandatory --default TERM
+  optsAdd 'check-code' --mandatory --default 'kill -0 $cmdpid >&/dev/null'
+  optsAdd 'kill-code' --mandatory --default '/bin/kill -$signal -- $cmdpid'
+  optsAdd 'allow-skip|as' --flag
+  optsAdd 'no-assert|n' --flag
+  optsDone; eval "${optsCode}"
+  LogMore_ -f "after opts $*"
+  [[ -z "$allowskip" ]] && tcfChk
+    local orig_expecode="${2:-0}"
+    local expecode="$orig_expecode"
+    [[ "$expecode" == "*" ]] && expecode="0-255"
+    local command="$1"
+    local comment="Running command '$command'"
+    [[ -n "$3" ]] && comment="$3"
+    [[ -n "$expecode" ]] && {
+      expecode=$(echo "$expecode" | tr ',-' '\n ' | sed -e 's/^!=/!/;s/^=//;s/^<=\(.\+\)$/0 \1/;s/^>=\(.\+\)$/\1 255/;s/^<\(.\+\)$/0 \$(( \1 - 1 ))/;s/^>\(.\+\)$/\$(( \1 + 1 )) 255/' | while read line; do [[ "$line" =~ ^[^\ ]+$ ]] && echo "$line" || eval seq $line; done; )
+      tcfE2R
+      LogMoreLow -f "orig_expecode='$orig_expecode'" 
+      LogMoreLow -f "expecode='$expecode'" 
+    }
+    tcfTry ${noassert:+--no-assert} "$comment" && {
+      local errout=$(mktemp)
+      LogMoreLow -f "executing '$command'"
+      if [[ "$optsPresent" =~ $(echo "\<timeout\>") ]]; then
+        LogDebug -f "using watchdog feature"
+        local ec="$(mktemp)"
+        eval "$command; echo $? > $ec 2> >(tee $errout)" &
+        local cmdpid=$!
+        local time_start=$(date +%s)
+        local timeout_t=$(( $time_start + $timeout ))
+        while true; do
+          if ! eval "$checkcode"; then
+             Log "command finished in $(($(date +%s) - $time_start )) seconds"
+             local res="$(cat $ec)"
+             break
+          elif [[ $(date +%s) -ge $timeout_t ]]; then
+            echo
+            Log "command is still running, sending $signal signal"
+            eval "$killcode"
+            tcfNOK 255
+            echo 255 > $ec
+            let timeout_t+=killtimeout
+            signal=KILL
+          fi
+          sleep 0.1
+        done
+        rm -f $ec
+      else
+        eval "$command" 2> >(tee $errout)
+        local res=$?
+      fi
+      LogMoreLow -f "got '$res'" 
+      local resmatch=$(echo "$expecode" | grep "^\!\?${res}$")
+      LogMoreLow -f "resmatch='$resmatch'" 
+      [[ -n "$resmatch" && ! "$resmatch" =~ '!' ]]
+      if tcfE2R; then
+        ! grep -iq "command not found" $errout || { failtag='WARNING'; tcfNOK; }
+      else
+        Log "Expected result was '$orig_expecode', got '$res'!"
+      fi
+    tcfFin ${failtag:+--fail-tag "$failtag"}; }
+    rm -f $errout
+  [[ -z "$allowskip" ]] && tcfFin
+  LogMore_ -f "end $*"
+  return $res
+}; # end of tcfRun }}}
+
+
+: <<'=cut'
+=pod
+
+=head2 Functions for logging
+
+=cut
+
+
+# tcfAssert0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+tcfAssert0() {
+  LogMoreLow -f "begin '$*'"
+  local RES="${3:-FAIL}"
+  [[ $2 -eq 0 ]] && RES='PASS'
+  Log "$1" $RES
+  LogMoreLow -f "end"
+}; # end of tcfAssert0 }}}
+
+
+# tcfCheckFinal ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfCheckFinal
+
+Check that all tcfTry / tcfChk functions have been close by tcfFin.
+
+    tcfCheckFinal
+
+=cut
+
+tcfCheckFinal() {
+  tcfAssert0 "Check that TCF block cache is empty" ${#__INTERNAL_tcf_current_level_data[@]}
+  tcfAssert0 "Check that TCF current level is 0" $__INTERNAL_tcf_current_level_val
+}; # end of tcfCheckFinal }}}
+
+
+echo "done."
+
+: <<'=cut'
+=pod
+
+=head2 Self check functions
+
+=cut
+
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+# tcfSelfCheck {{{
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+: <<'=cut'
+=pod
+
+=head3 tcfSelfCheck
+
+Does some basic functionality tests.
+
+    tcfSelfCheck
+
+The function is called also by the following command:
+
+    ./lib.sh selfcheck
+
+=cut
+
+
+tcfSelfCheck() {
+  tcfChk "check 1" &&{
+    tcfTry "try 1.1 - true" &&{
+      true
+    tcfFin;}
+    tcfTry "try 1.2 - false" &&{
+      false
+    tcfFin;}
+    tcfTry "try 1.3 - true" &&{
+      true
+    tcfFin;}
+  tcfFin;}
+  tcfChk "check 2" &&{
+    tcfTry "try 2.1 - true" &&{
+      true
+    tcfFin;}
+    tcfTry "try 2.2 - true - ignore" &&{
+      true
+    tcfFin -i;}
+    tcfTry "try 2.3 - true" &&{
+      true
+    tcfFin;}
+  tcfFin;}
+  tcfChk "check 3" &&{
+    tcfTry "try 3.1 - true" &&{
+      true
+    tcfFin;}
+    tcfTry "try 3.2 - false - ignore" &&{
+      false
+    tcfFin -i;}
+    tcfTry "try 3.3 - true" &&{
+      true
+    tcfFin;}
+  tcfFin;}
+  tcfCheckFinal
+  tcfAssert0 "Overall result" $(tcfRES -p)
+  LogReport
+}
+if [[ "$1" == "selfcheck" ]]; then
+  tcfSelfCheck
+fi; # end of tcfSelfCheck }}}
+
+
+# tcfLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+tcfLibraryLoaded() {
+  rlImport distribution/Log
+  declare -F rlDie > /dev/null && {
+    #rlJournalStart
+    #rlPhaseStartSetup "TCF"
+    echo -e "\nrunning inside the beakerlib - using rlAssert0"
+    true; tcfAssert0() {
+      local text="$1"
+      [[ "$3" != "FAIL" && "$3" != "PASS" ]] && text="$text - $3"
+      __INTERNAL_ConditionalAssert "$text" "$2"
+    }
+    __INTERNAL_tcf_do_hack
+    #rlPhaseEnd
+    #rlJournalEnd
+  };
+  if declare -F rlE2R >& /dev/null; then
+    __INTERNAL_tcf_kill_old_plugin
+  fi
+  true
+}; # end of tcfLibraryLoaded }}}
+
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
+
diff --git a/tests/run-as/distribution/Library/testUser/Makefile b/tests/run-as/distribution/Library/testUser/Makefile
new file mode 100644
index 0000000..037162e
--- /dev/null
+++ b/tests/run-as/distribution/Library/testUser/Makefile
@@ -0,0 +1,60 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/testUser
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/testUser
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Setup/cleanup standard testing user." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/Log)" >> $(METADATA)
+	@echo "Provides:        library(distribution/testUser)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/run-as/distribution/Library/testUser/lib.sh b/tests/run-as/distribution/Library/testUser/lib.sh
new file mode 100644
index 0000000..24da7a6
--- /dev/null
+++ b/tests/run-as/distribution/Library/testUser/lib.sh
@@ -0,0 +1,234 @@
+#!/bin/bash
+# try-check-final.sh
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = testUser
+#   library-version = 7
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library testUser
+
+=head1 DESCRIPTION
+
+This library provide s function for maintaining testing users.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/testUser and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/testUser)" >> $(METADATA)
+
+=head1 VARIABLES
+
+=over
+
+=item testUser
+
+Array of testing user login names.
+
+=item testUserPasswd
+
+Array of testing users passwords.
+
+=item testUserUID
+
+Array of testing users UIDs.
+
+=item testUserGID
+
+Array of testing users primary GIDs.
+
+=item testUserGroup
+
+Array of testing users primary group names.
+
+=item testUserGIDs
+
+Array of space separated testing users all GIDs.
+
+=item testUserGroups
+
+Array of space separated testing users all group names.
+
+=item testUserGecos
+
+Array of testing users gecos fields.
+
+=item testUserHomeDir
+
+Array of testing users home directories.
+
+=item testUserShell
+
+Array of testing users default shells.
+
+=back
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library testUser... "
+
+: <<'=cut'
+=pod
+
+=head3 testUserSetup, testUserCleanup
+
+Creates/removes testing user(s).
+
+    rlPhaseStartSetup
+        testUserSetup [NUM]
+    rlPhaseEnd
+    
+    rlPhaseStartCleanup
+        testUserCleanup
+    rlPhaseEnd
+
+=over
+
+=item NUM
+
+Optional number of user to be created. If not specified one user is created.
+
+=back
+
+Returns 0 if success.
+
+=cut
+
+
+testUserSetup() {
+  # parameter dictates how many users should be created, defaults to 1
+  local res=0
+  local count_created=0
+  local count_wanted=${1:-"1"}
+  local index=0
+  (( $count_wanted < 1 )) && return 1
+
+  while (( $count_created != $count_wanted ));do
+    let index++
+    local newUser="testuser${index}"
+    local newUserPasswd="redhat"
+    id "$newUser" &> /dev/null && continue # if user with the name exists, try again
+
+    # create
+    useradd -m $newUser >&2 || ((res++))
+    echo "$newUserPasswd" | passwd --stdin $newUser || ((res++))
+
+    # save the users array
+    testUser+=($newUser)
+    testUserPasswd+=($newUserPasswd)
+    set | grep "^testUser=" > $__INTERNAL_testUser_users_file
+    set | grep "^testUserPasswd=" >> $__INTERNAL_testUser_users_file
+    ((count_created++))
+  done
+  __INTERNAL_testUserRefillInfo || ((res++))
+
+  echo ${res}
+  [[ $res -eq 0 ]]
+}
+
+
+__INTERNAL_testUserRefillInfo() {
+  local res=0
+  local user
+  testUserUID=()
+  testUserGID=()
+  testUserGroup=()
+  testUserGIDs=()
+  testUserGroups=()
+  testUserGecos=()
+  testUserHomeDir=()
+  testUserShell=()
+
+  for user in ${testUser[@]}; do
+    local ent_passwd=$(getent passwd ${user}) || ((res++))
+    local users_id="$(id ${user})" || ((res++))
+    # testUser is filled during user creation - already present
+    # testUserPasswd is saved same way as testUser - already present
+    testUserUID+=("$(echo "$ent_passwd" | cut -d ':' -f 3)")
+    testUserGID+=("$(echo "$ent_passwd" | cut -d ':' -f 4)")
+    testUserGroup+=("$(echo "$users_id" | sed -r 's/.*gid=(\S+).*/\1/;s/[[:digit:]]+\(//g;s/\)//g;s/,/ /g')")
+    testUserGIDs+=("$(echo "$users_id" | sed -r 's/.*groups=(\S+).*/\1/;s/\([^\)]+\)//g;s/\)//g;s/,/ /g')")
+    testUserGroups+=("$(echo "$users_id" | sed -r 's/.*groups=(\S+).*/\1/;s/[[:digit:]]+\(//g;s/\)//g;s/,/ /g')")
+    testUserGecos+=("$(echo "$ent_passwd" | cut -d ':' -f 5)")
+    testUserHomeDir+=("$(echo "$ent_passwd" | cut -d ':' -f 6)")
+    testUserShell+=("$(echo "$ent_passwd" | cut -d ':' -f 7)")
+  done
+
+  echo ${res}
+  [[ $res -eq 0 ]]
+}
+
+
+testUserCleanup() {
+  local res=0
+  for user in ${testUser[@]}; do
+    userdel -rf "$user" >&2 || ((res++))
+  done
+  unset testUser
+  __INTERNAL_testUserRefillInfo
+  rm -f $__INTERNAL_testUser_users_file >&2 || ((res++))
+
+  echo ${res}
+  [[ $res -eq 0 ]]
+}
+
+
+
+# testUserLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+testUserLibraryLoaded() {
+  local res=0
+  # necessary init steps
+  __INTERNAL_testUser_users_file="$BEAKERLIB_DIR/users"
+
+  # try to fill in users array with previous data
+  [[ -f ${__INTERNAL_testUser_users_file} ]] && . ${__INTERNAL_testUser_users_file} >&2
+  __INTERNAL_testUserRefillInfo >&2 || ((res++))
+
+  [[ $res -eq 0 ]]
+}; # end of testUserLibraryLoaded }}}
+
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
+echo "done."
+
diff --git a/tests/run-as/runtest.sh b/tests/run-as/runtest.sh
new file mode 100755
index 0000000..13fcd5b
--- /dev/null
+++ b/tests/run-as/runtest.sh
@@ -0,0 +1,163 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/sudo/Sanity/run-as
+#   Description: Test feature 'run as'. This means -u, -g options.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2017 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1151, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="sudo"
+
+rlJournalStart && {
+  rlPhaseStartSetup && {
+    [[ -z "$BEAKERLIB_LIBRARY_PATH" ]] && BEAKERLIB_LIBRARY_PATH="`dirname "$(readlink -f "$0")"`"
+    rlRun "rlImport --all" 0 "Import libraries" || rlDie "cannot continue"
+    tcfRun "rlCheckMakefileRequires"
+    rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+    CleanupRegister "rlRun 'rm -r $TmpDir' 0 'Removing tmp directory'"
+    CleanupRegister 'rlRun "popd"'
+    rlRun "pushd $TmpDir"
+    CleanupRegister 'tcfRun "testUserCleanup"'
+    tcfRun "testUserSetup 5"
+    CleanupRegister 'rlRun "rlFileRestore"'
+    rlRun "rlFileBackup --clean /etc/sudoers.d"
+    cat > /etc/sudoers.d/testing << EOF
+      Defaults !requiretty
+      $testUser   ALL = (ALL:ALL) NOPASSWD: ALL
+      ${testUser[1]}   ALL = ( ${testUser[0]} ) NOPASSWD: ALL
+      ${testUser[2]}   ALL = ( ${testUser[0]}, ${testUser[1]} ) NOPASSWD: ALL
+      ${testUser[3]}   ALL = ( : ${testUserGroup[1]}, ${testUser[0]} ) NOPASSWD: ALL
+      ${testUser[4]}   ALL = ( ${testUser[0]} : ${testUserGroup[2]} ) NOPASSWD: ALL
+EOF
+    rlRun "cat /etc/sudoers.d/testing"
+  rlPhaseEnd; }
+
+  CMD='bash -c "ps -o user:15,group:15,ruser:15,rgroup:15,args --ppid $$"'
+  
+  tcfTry "Tests" --no-assert && {
+    test() {
+      local who="$1" as="$2" as_grp="$3" exp_res="$4"
+      if [[ -z "$exp_res" || "$exp_res" == "0" ]]; then
+        rlRun -s "su -l $who -c 'sudo ${as:+-u $as} ${as_grp:+-g $as_grp} $CMD'"
+        [[ -n "$as_grp" && -z "$as" ]] && as="$who"
+        as="${as:-root}"
+        as_grp="${as_grp:-$as}"
+        rlAssertGrep "$as\s+$as_grp\s+$as\s+$as_grp\s+" $rlRun_LOG -Eq
+        rm -f $rlRun_LOG
+      else
+        rlRun -s "su -l $who -c 'sudo ${as:+-u $as} ${as_grp:+-g $as_grp} $CMD'" 1
+        [[ -n "$as_grp" && -z "$as" ]] && as="$who"
+        as="${as:-root}"
+        as_grp="${as_grp:-$as}"
+        rlAssertNotGrep "$as\s+$as_grp\s+$as\s+$as_grp\s+" $rlRun_LOG -Eq
+        rm -f $rlRun_LOG
+      fi
+    }
+    rlPhaseStartTest "run as a default user" && {
+      tcfChk "Test phase" && {
+        tcfChk "$testUser can run as all" && {
+          test $testUser "" "" "" 0
+        tcfFin; }
+        tcfChk "${testUser[1]} cannot run as anyone" && {
+          test ${testUser[1]} "" "" 1
+        tcfFin; }
+        tcfChk "${testUser[2]} cannot run as anyone" && {
+          test ${testUser[2]} "" "" 1
+        tcfFin; }
+      tcfFin; }
+    rlPhaseEnd; }
+
+    rlPhaseStartTest "run as a user (-u)" && {
+      tcfChk "Test phase" && {
+        tcfChk "$testUser can run as all" && {
+          test $testUser "root" "" 0
+          test $testUser "${testUser[1]}" "" 0
+          test $testUser "${testUser[2]}" "" 0
+        tcfFin; }
+        tcfChk "${testUser[1]} can run as $testUser" && {
+          test ${testUser[1]} "root" "" 1
+          test ${testUser[1]} "${testUser[0]}" "" 0
+          test ${testUser[1]} "${testUser[2]}" "" 1
+        tcfFin; }
+        tcfChk "${testUser[2]} can run as $testUser and ${testUser[1]}" && {
+          test ${testUser[2]} "root" "" 1
+          test ${testUser[2]} "${testUser[0]}" "" 0
+          test ${testUser[2]} "${testUser[1]}" "" 0
+        tcfFin; }
+      tcfFin; }
+    rlPhaseEnd; }
+
+    rlPhaseStartTest "run as a group (-g)" && {
+      tcfChk "Test phase" && {
+        tcfChk "$testUser can run as all" && {
+          test $testUser "" "root" 0
+          test $testUser "" "${testUserGroup[1]}" 0
+          test $testUser "" "${testUserGroup[2]}" 0
+        tcfFin; }
+        tcfChk "${testUser[4]} can run as ${testUserGroup[2]}" && {
+          test ${testUser[4]} "" "root" 1
+          test ${testUser[4]} "" "${testUserGroup[0]}" 1
+          test ${testUser[4]} "" "${testUserGroup[2]}" 0
+        tcfFin; }
+        #tcfChk "${testUser[2]} can run as ${testUserGroup[1]}" && {
+        #  test ${testUser[2]} "" "root" 1
+        #  test ${testUser[2]} "" "${testUserGroup[1]}" 1
+        #  test ${testUser[2]} "" "${testUserGroup[2]}" 1
+        #tcfFin; }
+        #tcfChk "${testUser[3]}" && {
+        #  test ${testUser[2]} "" "root" 1
+        #  test ${testUser[2]} "" "${testUserGroup[1]}" 0
+        #  test ${testUser[2]} "" "${testUserGroup[2]}" 0
+        #tcfFin; }
+      tcfFin; }
+    rlPhaseEnd; }
+
+      rlPhaseStartTest "run as both user (-u) and group (-g)" && {
+      tcfChk "Test phase" && {
+        tcfChk "$testUser can run as all" && {
+          test $testUser "${testUser[1]}" "root" 0
+          test $testUser "${testUser[2]}" "${testUserGroup[1]}" 0
+          test $testUser "${testUser[1]}" "${testUserGroup[2]}" 0
+        tcfFin; }
+        tcfChk "${testUser[4]} can run as ${testUser[0]} ${testUserGroup[2]}" && {
+          test ${testUser[4]} "${testUser[0]}" "root" 1
+          test ${testUser[4]} "${testUser[0]}" "${testUserGroup[0]}" 0
+          #test ${testUser[4]} "${testUser[0]}" "${testUserGroup[4]}" 0
+          test ${testUser[4]} "${testUser[4]}" "${testUserGroup[4]}" 0
+          test ${testUser[4]} "${testUser[0]}" "${testUserGroup[3]}" 1
+          test ${testUser[4]} "${testUser[0]}" "${testUserGroup[2]}" 0
+        tcfFin; }
+      tcfFin; }
+    rlPhaseEnd; }
+  tcfFin; }
+
+  rlPhaseStartCleanup && {
+    CleanupDo
+    tcfCheckFinal
+  rlPhaseEnd; }
+  rlJournalPrintText
+rlJournalEnd; }
diff --git a/tests/sudoers-options-sanity-test/Makefile b/tests/sudoers-options-sanity-test/Makefile
new file mode 100644
index 0000000..cc8a3bd
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/Makefile
@@ -0,0 +1,67 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/sudo/Sanity/sudoers-options-sanity-test
+#   Description: This sanity test checks pre-defined (some are commented) options (examples) in sudoers file.
+#   Author: Ales Marecek <amarecek@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/sudo/Sanity/sudoers-options-sanity-test
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Ales Marecek <amarecek@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/tcf)" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/Cleanup)" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/ConditionalPhases)" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/testUser)" >> $(METADATA)
+	@echo "Description:     This sanity test checks pre-defined (some are commented) options (examples) in sudoers file." >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        30m" >> $(METADATA)
+	@echo "RunFor:          sudo" >> $(METADATA)
+	@echo "Requires:        sudo grep coreutils" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/sudoers-options-sanity-test/PURPOSE b/tests/sudoers-options-sanity-test/PURPOSE
new file mode 100644
index 0000000..3bff2f9
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/PURPOSE
@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/sudo/Sanity/sudoers-options-sanity-test
+Description: This sanity test checks pre-defined (some are commented) options (examples) in sudoers file.
+Author: Ales Marecek <amarecek@redhat.com>
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/Cleanup/Makefile b/tests/sudoers-options-sanity-test/distribution/Library/Cleanup/Makefile
new file mode 100644
index 0000000..3e5a8e1
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/Cleanup/Makefile
@@ -0,0 +1,59 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/Cleanup
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/Cleanup
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Provides function to define cleanup stack which can do its work at any time of the test run." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "Provides:        library(distribution/Cleanup)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/Cleanup/lib.sh b/tests/sudoers-options-sanity-test/distribution/Library/Cleanup/lib.sh
new file mode 100644
index 0000000..c66d21c
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/Cleanup/lib.sh
@@ -0,0 +1,314 @@
+#!/bin/bash
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = Cleanup
+#   library-version = 9
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_Cleanup_LIB_VERSION=9
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library Cleanup
+
+=head1 DESCRIPTION
+
+This file contains functions which provides cleanup stack functionality.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/Cleanup and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/Cleanup)" >> $(METADATA)
+
+B<Code example>
+
+	rlJournalStart
+	  rlPhaseStartSetup
+	    rlImport 'distribution/Cleanup'
+	    tmp=$(mktemp)
+	    CleanupRegister "
+	      rlLog 'Removing data'
+	      rlRun \"rm -f ${tmp}\"
+	    "
+	    rlLog 'Creating some data'
+	    rlRun "echo 'asdfalkjh' > $tmp"
+
+	    CleanupRegister "
+	      rlLog 'just something to demonstrate unregistering'
+	    "
+	    ID1=$CleanupRegisterID
+	    CleanupUnregister $ID1
+
+	    CleanupRegister "
+	      rlLog 'just something to demonstrate partial cleanup'
+	    "
+	    ID2=$CleanupRegisterID
+	    CleanupRegister "rlLog 'cleanup some more things'"
+	    # cleanup everything upto ID2
+	    CleanupDo $ID2
+
+	    CleanupRegister --mark "
+	      rlLog 'yet another something to demonstrate partial cleanup using internal ID saving'
+	    "
+	    CleanupRegister "rlLog 'cleanup some more things'"
+	    # cleanup everything upto last mark
+	    CleanupDo --mark
+	  rlPhaseEnd
+
+	  rlPhaseStartCleanup
+	    CleanupDo
+	  rlPhaseEnd
+
+	  rlJournalPrintText
+	rlJournalEnd
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library Cleanup v$__INTERNAL_Cleanup_LIB_VERSION... "
+
+__INTERNAL_Cleanup_stack_file="$BEAKERLIB_DIR/Cleanup_stack"
+touch "$__INTERNAL_Cleanup_stack_file"
+chmod ug+rw "$__INTERNAL_Cleanup_stack_file"
+
+# CleanupRegister ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# CleanupRegister [--mark] CLEANUP_CODE
+#   --mark  - also mark this position
+CleanupRegister() {
+  local mark=0
+  [[ "$1" == "--mark" ]] && {
+    mark=1
+    shift
+  }
+  if ! CleanupGetStack; then
+    rlLogError "cannot continue, could not get cleanup stack"
+    return 1
+  fi
+  CleanupRegisterID="${RANDOM}$(date +"%s%N")"
+  echo -n "Registering cleanup ID=$CleanupRegisterID" >&2
+  if [[ $mark -eq 1 ]]; then
+    __INTERNAL_CleanupMark=( "$CleanupRegisterID" "${__INTERNAL_CleanupMark[@]}" )
+    echo -n " with mark" >&2
+  fi
+  echo " '$1'" >&2
+  rlLogDebug "prepending '$1'"
+  local ID_tag="# ID='$CleanupRegisterID'"
+  __INTERNAL_Cleanup_stack="$ID_tag
+$1
+$ID_tag
+$__INTERNAL_Cleanup_stack"
+  if ! CleanupSetStack "$__INTERNAL_Cleanup_stack"; then
+    rlLogError "an error occured while registering the cleanup '$1'"
+    return 1
+  fi
+  return 0
+}; # end of CleanupRegister }}}
+
+
+# __INTERNAL_Cleanup_get_stack_part ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# 1: ID
+#    -ID    - everything upto the ID
+# 2: ''     - return ID only
+#    'rest' - return exact oposit
+__INTERNAL_Cleanup_get_stack_part() {
+  rlLogDebug "__INTERNAL_Cleanup_get_stack_part(): $* begin"
+  local ID="$1"
+  local n='1 0 1'
+  local stack=''
+  [[ "${ID:0:1}" == "-" ]] && {
+    ID="${ID:1}"
+    n='0 0 1'
+  }
+  [[ "$2" == "rest" ]] && {
+    n="$(echo "${n//0/2}")"
+    n="$(echo "${n//1/0}")"
+    n="$(echo "${n//2/1}")"
+  }
+  n=($n)
+  [[ -n "$DEBUG" ]] && rlLogDebug "$(set | grep ^n=)"
+  local ID_tag="# ID='$ID'"
+  while IFS= read -r line; do
+
+    [[ "$line" == "$ID_tag" ]] && {
+      n=( "${n[@]:1}" )
+      continue
+    }
+    if [[ $n -eq 0 ]]; then
+      stack="$stack
+$line"
+    fi
+  done < <(echo "$__INTERNAL_Cleanup_stack")
+  rlLogDebug "__INTERNAL_Cleanup_get_stack_part(): cleanup stack part is '${stack:1}'"
+  echo "${stack:1}"
+  rlLogDebug "__INTERNAL_Cleanup_get_stack_part(): $* end"
+}; # end of __INTERNAL_Cleanup_get_stack_part }}}
+
+# CleanupUnregister ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupUnregister() {
+  local ID="$1"
+  rlLog "Unregistering cleanup ID='$ID'"
+  if ! CleanupGetStack; then
+    rlLogError "cannot continue, could not get cleanup stack"
+    return 1
+  fi
+  rlLogDebug "removing ID='$ID'"
+  if ! CleanupSetStack "$(__INTERNAL_Cleanup_get_stack_part "$ID" 'rest')"; then
+    rlLogError "an error occured while registering the cleanup '$1'"
+    return 1
+  fi
+  return 0
+}; # end of CleanupUnregister }}}
+
+
+# CleanupMark ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_CleanupMark=()
+CleanupMark() {
+  echo -n "Setting cleanup mark" >&2
+  CleanupRegister --mark '' 2>/dev/null
+  local res=$?
+  echo " ID='$CleanupRegisterID'" >&2
+  return $res
+}; # end of CleanupMark }}}
+
+
+# CleanupDo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# 1: ''   - cleanup all
+#    ID   - cleanup ID only
+#    -ID  - cleanup all upto ID, including
+#    mark - cleanup all unto last mark, including
+CleanupDo() {
+  local ID="$1"
+  if ! CleanupGetStack; then
+    rlLogError "cannot continue, could not get cleanup stack"
+    return 1
+  fi
+  local res tmp newstack=''
+  tmp="$(mktemp)"
+  if [[ "$ID" == "mark" || "$ID" == "--mark" ]]; then
+    echo "execute cleanup upto mark='$__INTERNAL_CleanupMark'" >&2
+    __INTERNAL_Cleanup_get_stack_part "-$__INTERNAL_CleanupMark" | grep -v "^# ID='" > "$tmp"
+    newstack="$(__INTERNAL_Cleanup_get_stack_part "-$__INTERNAL_CleanupMark" 'rest')"
+    __INTERNAL_CleanupMark=("${__INTERNAL_CleanupMark[@]:1}")
+  elif [[ -n "$ID" ]]; then
+    echo "execute cleanup for ID='$ID'" >&2
+    __INTERNAL_Cleanup_get_stack_part "$ID" | grep -v "^# ID='" > "$tmp"
+    newstack="$(__INTERNAL_Cleanup_get_stack_part "$ID" 'rest')"
+  else
+    CleanupTrapUnhook
+    trap "echo 'temporarily blocking ctrl+c until cleanup is done' >&2" SIGINT
+    cat "$__INTERNAL_Cleanup_stack_file" | grep -v "^# ID='" > "$tmp"
+    echo "execute whole cleanup stack" >&2
+  fi
+  . "$tmp"
+  res=$?
+  [[ $res -ne 0 ]] && {
+    echo "cleanup code:" >&2
+    cat -n "$tmp" >&2
+  }
+  rm -f "$tmp"
+  echo "cleanup execution done" >&2
+  if [[ -z "$ID" ]]; then 
+    trap - SIGINT
+  fi
+  if ! CleanupSetStack "$newstack"; then
+    rlLogError "an error occured while cleaning the stack"
+    return 1
+  fi
+  return $res
+}; # end of CleanupDo }}}
+
+
+# CleanupGetStack ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupGetStack() {
+  rlLogDebug "getting cleanup stack"
+  if [[ -r "$__INTERNAL_Cleanup_stack_file" ]]; then
+    if __INTERNAL_Cleanup_stack="$(cat "$__INTERNAL_Cleanup_stack_file")"; then
+      rlLogDebug "cleanup stack is '$__INTERNAL_Cleanup_stack'"
+      return 0
+    fi
+  fi
+  rlLogError "could not load cleanup stack"
+  return 1
+}; # end of CleanupGetStack }}}
+
+
+# CleanupSetStack ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupSetStack() {
+  rlLogDebug "setting cleanup stack to '$1'"
+  __INTERNAL_Cleanup_stack="$1"
+  if echo "$__INTERNAL_Cleanup_stack" > "$__INTERNAL_Cleanup_stack_file"; then
+    rlLogDebug "cleanup stack is now '$__INTERNAL_Cleanup_stack'"
+    return 0
+  fi
+  rlLogError "could not set cleanup stack"
+  return 1
+}; # end of CleanupSetStack }}}
+
+
+__INTERNAL_Cleanup_signals=''
+__INTERNAL_Cleanup_trap_code='rlJournalStart; rlPhaseStartCleanup; CleanupDo; rlPhaseEnd; rlJournalPrintText; rlJournalEnd; exit'
+# CleanupTrapHook ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupTrapHook() {
+  rlLog "register cleanup trap"
+  __INTERNAL_Cleanup_signals="${1:-"SIGHUP SIGINT SIGTERM EXIT"}"
+  eval "trap \"${__INTERNAL_Cleanup_trap_code}\" $__INTERNAL_Cleanup_signals"
+}; # end of CleanupTrapHook }}}
+
+
+# CleanupTrapUnhook ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupTrapUnhook() {
+  if [[ -n "$__INTERNAL_Cleanup_signals" ]]; then
+    rlLog "unregister cleanup trap"
+    eval trap - $__INTERNAL_Cleanup_signals
+    __INTERNAL_Cleanup_signals=''
+  fi
+}; # end of CleanupTrapUnhook }}}
+
+
+# CleanupLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+CleanupLibraryLoaded() {
+  CleanupTrapHook
+}; # end of CleanupLibraryLoaded }}}
+
+
+echo "done."
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/ConditionalPhases/Makefile b/tests/sudoers-options-sanity-test/distribution/Library/ConditionalPhases/Makefile
new file mode 100644
index 0000000..f017bcb
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/ConditionalPhases/Makefile
@@ -0,0 +1,59 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/ConditionalPhases
+#   Description: Implements conditional phases.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/ConditionalPhases
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Implements conditional phases." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "Provides:        library(distribution/ConditionalPhases)" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/ConditionalPhases/lib.sh b/tests/sudoers-options-sanity-test/distribution/Library/ConditionalPhases/lib.sh
new file mode 100644
index 0000000..39024d1
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/ConditionalPhases/lib.sh
@@ -0,0 +1,166 @@
+#!/bin/bash
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = ConditionalPhases
+#   library-version = 2
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_ConditionalPhases_LIB_VERSION=2
+__INTERNAL_ConditionalPhases_LIB_NAME='distribution/ConditionalPhases'
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library distribution/condpahses
+
+=head1 DESCRIPTION
+
+Implements conditional phases to eficiently select test phases to be execute
+using white and black lists.
+
+To use this functionality you need to import library
+distribution/ConditionalPhases and add following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/ConditionalPhases)" >> $(METADATA)
+
+=head1 USAGE
+
+=head2 Conditional phases
+
+Each test phase can be conditionally skipped based on a bash regular expression
+given in CONDITIONAL_PHASES_BL and/or CONDITIONAL_PHASES_WL variables.
+
+=over
+
+=item CONDITIONAL_PHASES_BL
+
+It is a black list. If match phase name the respective phase should be skipped.
+
+=item CONDITIONAL_PHASES_WL
+
+It is a white list. If does B<not> match phase name the respective phase should
+be skipped excluding phases contatning 'setup' or 'cleanup' in its name. Names
+'setup' and 'cleanup' are matched case insenitively.
+
+=back
+
+Actual skipping has to be done in the test case itself by using return code of
+functions I<rlPhaseStart>, I<rlPhaseStartSetup>, I<rlPhaseStartTest>, and
+I<rlPhaseStartCleanup>.
+
+Example:
+
+    rlPhaseStartTest "phase name" && {
+      ...
+    rlPhaseEnd; }
+
+Evaluation of the phase relevancy works as follows:
+    1. If CONDITIONAL_PHASES_BL is non-empty and matches phase name => return 2.
+    2. If phase name contains word 'setup' or 'cleanup' or CONDITIONAL_PHASES_WL
+       is empty => return 0.
+    3. If CONDITIONAL_PHASES_WL is non-empty and matches phase name => return 0
+       otherwise return 1.
+
+Normaly Setup and Cleanup phases are not skipped unless hey are B<explicitly>
+black-listed.
+
+To make the test work properly with conditional phases it is necessary to
+surround phase code with curly brackets and make it conditionally executed
+based on rlPhaseStart* function's exit code the same way as it is demostrated in
+the example above. To make the process easy you can use following command:
+
+    sed 's/rlPhaseStart[^{]*$/& \&\& {/;s/rlPhaseEnd[^}]*$/&; }/'
+
+This code can be embedded in Makefile by modifying build target to following
+form:
+
+    build: $(BUILT_FILES)
+    	grep -Eq 'rlPhase(Start[^{]*|End[^}]*)$' runtest.sh && sed -i 's/rlPhaseStart[^{]*$/& \&\& {/;s/rlPhaseEnd[^}]*$/&; }/' testrun.sh
+    	test -x runtest.sh || chmod a+x runtest.sh
+
+
+=cut
+#'
+echo -n "loading library $__INTERNAL_ConditionalPhases_LIB_NAME v$__INTERNAL_ConditionalPhases_LIB_VERSION... "
+
+
+# ConditionalPhasesLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+ConditionalPhasesLibraryLoaded() {
+  if [[ -n "$CONDITIONAL_PHASES_BL" || -n "$CONDITIONAL_PHASES_WL" ]]; then
+    __INTERNAL_ConditionalPhases_eval() {
+      # check phases black-list
+      [[ -n "$CONDITIONAL_PHASES_BL" && "$1" =~ $CONDITIONAL_PHASES_BL ]] && {
+        rlLogWarning "phase '$1' should be skipped as it is defined in \$CONDITIONAL_PHASES_BL='$CONDITIONAL_PHASES_BL'"
+        return 2
+      }
+      # always execute Setup, Cleanup and if no PHASES (white-list) specified
+      [[ "$1" =~ $(echo "\<[Ss][Ee][Tt][Uu][Pp]\>") || "$1" =~ $(echo "\<[Cc][Ll][Ee][Aa][Nn][Uu][Pp]\>") ]] && {
+        rlLogInfo "phase '$1' will be executed as 'setup' and 'cleanup' phases are allowed by default, these can be black-listed"
+        return 0
+      }
+      [[ -z "$CONDITIONAL_PHASES_WL" ]] && {
+        rlLogInfo "phase '$1' will be executed as there is no rule for it"
+        return 0
+      }
+      [[ "$1" =~ $CONDITIONAL_PHASES_WL ]] && {
+        rlLogInfo "phase '$1' will be executed as it is defined in \$CONDITIONAL_PHASES_WL='$CONDITIONAL_PHASES_WL'"
+        return 0
+      } || {
+        rlLogWarning "phase '$1' should be skipped as it is not defined in \$CONDITIONAL_PHASES_WL='$CONDITIONAL_PHASES_WL'"
+        return 1
+      }
+    }
+
+    rlLogInfo "replacing rlPhaseStart by modified function with conditional phases implemented"
+    :; rlPhaseStart() {
+        if [ "x$1" = "xFAIL" -o "x$1" = "xWARN" ] ; then
+            __INTERNAL_ConditionalPhases_eval "$2" && \
+            rljAddPhase "$1" "$2"
+            return $?
+        else
+            rlLogError "rlPhaseStart: Unknown phase type: $1"
+            return 1
+        fi
+    }
+  else
+    rlLogInfo "Neither CONDITIONAL_PHASES_WL nor CONDITIONAL_PHASES_BL is defined, not applying modifications"
+  fi
+}; # end of ConditionalPhasesLibraryLoaded }}}
+
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
+echo 'done.'
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/Log/Makefile b/tests/sudoers-options-sanity-test/distribution/Library/Log/Makefile
new file mode 100644
index 0000000..3cf0e65
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/Log/Makefile
@@ -0,0 +1,48 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/Log
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/Log
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Provides yet another logging facility that does not rely on beakerlib while it can integrate with it." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/opts)" >> $(METADATA)
+	@echo "Provides:        library(distribution/Log)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/Log/lib.sh b/tests/sudoers-options-sanity-test/distribution/Library/Log/lib.sh
new file mode 100644
index 0000000..ac1db3d
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/Log/lib.sh
@@ -0,0 +1,637 @@
+#!/bin/bash
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = Log
+#   library-version = 11
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_Log_LIB_VERSION=11
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library Log
+
+=head1 DESCRIPTION
+
+This library provide logging capability which does not rely on beakerlib so it
+can be used standalone.
+
+If it is used within beakerlib it automatically bypass all messages to the
+beakerlib.
+
+Also this library provide journaling feature so the summary can be printed out
+at the end.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/Log and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/Log)" >> $(METADATA)
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library Log v$__INTERNAL_Log_LIB_VERSION... "
+
+
+__INTERNAL_Log_prefix=''
+__INTERNAL_Log_prefix2=''
+__INTERNAL_Log_postfix=''
+__INTERNAL_Log_default_level=3
+__INTERNAL_Log_level=$__INTERNAL_Log_default_level
+LogSetDebugLevel() {
+  if [[ -n "$1" ]]; then 
+    if [[ "$1" =~ ^[0-9]+$ ]]; then 
+      let __INTERNAL_Log_level=$__INTERNAL_Log_default_level+$1;
+    else
+      __INTERNAL_Log_level=255
+    fi
+  else
+    __INTERNAL_Log_level=$__INTERNAL_Log_default_level
+  fi
+}
+LogSetDebugLevel "$DEBUG"
+let __INTERNAL_Log_level_LOG=0
+let __INTERNAL_Log_level_FATAL=0
+let __INTERNAL_Log_level_ERROR=1
+let __INTERNAL_Log_level_WARNING=2
+let __INTERNAL_Log_level_INFO=3
+let __INTERNAL_Log_level_DEBUG=4
+let __INTERNAL_Log_level_MORE=5
+let __INTERNAL_Log_level_MORE_=$__INTERNAL_Log_level_MORE+1
+let __INTERNAL_Log_level_MORE__=$__INTERNAL_Log_level_MORE_+1
+let __INTERNAL_Log_level_MORE___=$__INTERNAL_Log_level_MORE__+1
+
+# Log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+Log() {
+  LogMore___ -f "begin '$*'"
+  local pri=$2 message="${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+  if [[ -n "$pri" ]]; then
+    LogPrintMessage "$pri" "$message"
+    LogjAddMessage "$pri" "$message"
+  else
+    LogPrintMessage "$(date +%H:%M:%S)" "$message"
+    LogjAddMessage "INFO" "$message"
+  fi
+  LogMore___ -f "end"
+  return 0
+}; # end of Log }}}
+
+
+__INTERNAL_Log_condition() {
+  cat <<EOF
+  __INTERNAL_Log_level_do=$1
+  if [[ \$__INTERNAL_Log_level -ge \$__INTERNAL_Log_level_do ]]; then
+    [[ -z "$2" ]] && return 1
+  else
+    return 0
+  fi
+EOF
+}
+
+
+# LogInfo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogInfo() {
+  __INTERNAL_LogPrio='INFO'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_INFO  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='INFO'
+  Log "$1" $__INTERNAL_LogPrio
+  LogMore___ -f "end"
+  return 0
+}; # end of LogInfo }}}
+
+
+# LogWarn ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogWarn() {
+  __INTERNAL_LogPrio='WARNING'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_WARNING  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='WARNING'
+  Log "$1" $__INTERNAL_LogPrio
+  LogMore___ -f "end"
+  return 0
+}; # end of LogWarn }}}
+
+
+# LogWarning ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogWarning() {
+  __INTERNAL_LogPrio='WARNING'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_WARNING  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='WARNING'
+  Log "$1" $__INTERNAL_LogPrio
+  LogMore___ -f "end"
+  return 0
+}; # end of LogWarning }}}
+
+
+# LogError ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogError() {
+  __INTERNAL_LogPrio='ERROR'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_ERROR  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='ERROR'
+  Log "$1" $__INTERNAL_LogPrio
+  LogMore___ -f "end"
+  return 0
+}; # end of LogError }}}
+
+
+# LogFatal ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogFatal() {
+  __INTERNAL_LogPrio='FATAL'
+  eval "$(__INTERNAL_Log_condition \$__INTERNAL_Log_level_FATAL  \"\$1\")"
+  LogMore___ -f "begin '$*'"
+  __INTERNAL_LogPrio='FATAL'
+  Log "$1" $__INTERNAL_LogPrio
+  exit 255
+  LogMore___ -f "end"
+}; # end of LogFatal }}}
+
+
+# LogPASS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogPASS() {
+  LogMore___ -f "begin '$*'"
+  Log "$1" PASS
+  LogMore___ -f "end"
+  return 0
+}
+LogPass() {
+  LogPASS "$@"
+}; # end of LogPASS }}}
+
+
+# LogFAIL ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogFAIL() {
+  LogMore___ -f "begin '$*'"
+  Log "$1" FAIL
+  LogMore___ -f "end"
+  return 0
+}
+LogFail() {
+  LogFAIL "$@"
+}; # end of LogFAIL }}}
+
+
+# LogDo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogDo() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    local tmp=${BASH_REMATCH[1]:-1}
+    pref="${FUNCNAME[$tmp]}(): "
+  }
+  LogPrintMessage "$__INTERNAL_LogPrio" "${__INTERNAL_Log_prefix}${pref}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+  return 0
+}; # end of LogDo }}}
+
+
+# LogDebug ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogDebug() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  __INTERNAL_Log_level_do=${2:-$__INTERNAL_Log_level_DEBUG}
+  __INTERNAL_LogPrio='DEBUG'
+  [[ $__INTERNAL_Log_level_do -ge $__INTERNAL_Log_level_MORE ]] && __INTERNAL_LogPrio="${__INTERNAL_LogPrio}:$(($__INTERNAL_Log_level_do-$__INTERNAL_Log_level_DEBUG+1))"
+  eval "$(__INTERNAL_Log_condition \${2:-\$__INTERNAL_Log_level_DEBUG}  \"\$1\")"
+  LogDo $pref "$1"
+  return 0
+}; # end of LogDebug }}}
+
+
+# LogMore ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogMore() {
+  # log if DEBUG does not containg a number
+  # or the number is greater or equal to 2
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" ${2:-$__INTERNAL_Log_level_MORE}
+}; # end of LogMore }}}
+
+
+# LogMore_ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogMore_() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE_
+}; # end of LogMore_ }}}
+
+
+# LogMore__ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogMore__() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE__
+}; # end of LogMore__ }}}
+
+
+# LogMore___ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogMore___() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE___
+}; # end of LogMore___ }}}
+
+
+# LogMoreLow ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogMoreLow_Obs=''
+LogMoreLow() {
+  [[ -z "$__INTERNAL_LogMoreLow_Obs" ]] && {
+    LogMore_ -f "LogMoreLow is obsoleted by LogMore_"
+    __INTERNAL_LogMoreLow_Obs=1
+  }
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE_
+}; # end of LogMoreLow }}}
+
+
+# LogMoreMed ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogMoreMed_Obs=''
+LogMoreMed() {
+  [[ -z "$__INTERNAL_LogMoreMed_Obs" ]] && {
+    LogMore__ -f "LogMoreMed is obsoleted by LogMore__"
+    __INTERNAL_LogMoreMed_Obs=1
+  }
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE__
+}; # end of LogMoreMed }}}
+
+
+# LogMoreHigh ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogMoreHigh_Obs=''
+LogMoreHigh() {
+  [[ -z "$__INTERNAL_LogMoreHigh_Obs" ]] && {
+    LogMore___ -f "LogMoreHigh is obsoleted by LogMore___"
+    __INTERNAL_LogMoreHigh_Obs=1
+  }
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogDebug $pref "$1" $__INTERNAL_Log_level_MORE___
+}; # end of LogMoreHigh }}}
+
+
+# LogjAddMessage ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogjAddMessage() {
+  LogMore__ -f "begin '$*'"
+  __INTERNAL_Log_journal=("${__INTERNAL_Log_journal[@]}" "$1" "$2")
+  LogMore__ -f "end"
+  true;
+}; # end of LogjAddMessage }}}
+
+# __INTERNAL_LogCenterText ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogCenterText() {
+  local spaces='                                                                              '
+  # strip colors
+  local log_pri_strip=$(echo -en "$1" | sed -r "s:\x1B\[[0-9;]*[mK]::g")
+  local log_pri_strip_count=${#log_pri_strip}
+  local left_spaces=$(( ($2 - $log_pri_strip_count) / 2 ))
+  local right_spaces=$(( $2 - $log_pri_strip_count - $left_spaces ))
+  echo -en "${spaces:0:$left_spaces}${1}${spaces:0:$right_spaces}"
+}; # end of __INTERNAL_LogCenterText }}}
+
+
+# LogPrintMessage ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogPrintMessage() {
+  echo -e ":: [$(__INTERNAL_LogCenterText "$1" 10)] :: $2" >&2
+  return 0
+}; # end of LogPrintMessage }}}
+
+
+# LogReport ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 LogReport
+
+Prints final report similar to breakerlib's rlJournalPrintText. This is useful
+mainly if you use TCF without beakerlib.
+
+    LogReport
+
+=cut
+#'
+
+LogReport() {
+  echo -e "\n ====== Summary report begin ======"
+  local a p l i
+  for i in $(seq 0 2 $((${#__INTERNAL_Log_journal[@]}-1)) ); do
+    LogPrintMessage "${__INTERNAL_Log_journal[$i]}" "${__INTERNAL_Log_journal[$((++i))]}"
+  done
+  echo " ======= Summary report end ======="
+  __INTERNAL_Log_journal=()
+}; # end of LogReport }}}
+
+
+# LogFile ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogFile() {
+  LogMore__ -f "begin '$*'"
+  local prio=''
+  [[ $# -ge 3 ]] && {
+    optsBegin
+    optsAdd 'prio|tag|p|t' --mandatory
+    optsDone; eval "${optsCode}"
+  }
+  cat $1 | while IFS= read line; do
+    Log "$line" "${prio:-$2}"
+  done
+  LogMore__ -f "end"
+}; #}}}
+
+
+# LogText ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogText() {
+  LogMore__ -f "begin '$*'"
+  local prio=''
+  [[ $# -ge 3 ]] && {
+    optsBegin
+    optsAdd 'prio|tag|p|t' --mandatory
+    optsDone; eval "${optsCode}"
+  }
+  {
+    if [[ "$1" == "-" ]]; then
+      cat -
+    else
+      echo "$1"
+    fi
+  } | while IFS= read line; do
+    Log "$line" "${prio:-$2}"
+  done
+  LogMore__ -f "end"
+}; #}}}
+
+
+# LogStrippedDiff ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogStrippedDiff() {
+  LogMore__ -f "begin '$*'"
+  local prio=''
+  [[ $# -ge 3 ]] && {
+    optsBegin
+    optsAdd 'prio|tag|p|t' --mandatory
+    optsDone; eval "${optsCode}"
+  }
+  {
+    if [[ -n "$2" ]]; then
+      diff -U0 "$1" "$2"
+    else
+      cat $1
+    fi
+  } | grep -v -e '^@@ ' -e '^--- ' -e '^+++ ' | while IFS= read line; do
+    Log "$line" "$prio"
+  done
+  LogMore__ -f "end"
+}; #}}}
+
+
+# LogRun ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogRun() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}+1))"
+  }
+  LogMore
+  local dolog=$?
+  [[ $dolog -eq 0 ]] || {
+    local param params blacklist="[[:space:]]|>|<|\|"
+    [[ "${#@}" -eq 1 ]] && params="$1" || {
+      for param in "$@"; do
+        if [[ "$param" =~ $blacklist ]]; then
+          params="$params \"${param//\"/\\\"}\""
+        else
+          params="$params $param"
+        fi
+      done
+      params="${params:1}"
+    }
+    LogDo $pref "executing >>>>> ${params} <<<<<"
+  }
+  eval "$@"
+  ret=$?
+  [[ $dolog -eq 0 ]] || LogMore $pref "execution >>>>> ${params} <<<<< returned '$ret'"
+  return $ret
+}; # end of LogRun }}}
+
+
+# LogDebugNext ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogDebugNext() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}))"
+  }
+  LogDebug '' ${1:-$__INTERNAL_Log_level_DEBUG} || {
+    __INTERNAL_Log_DEBUGING=0
+    trap "
+      __INTERNAL_Log_DEBUGING_res=\$?
+      let __INTERNAL_Log_DEBUGING++
+      if [[ \$__INTERNAL_Log_DEBUGING -eq 1 ]]; then
+        __INTERNAL_Log_DEBUGING_cmd=\"\$BASH_COMMAND\"
+        LogDebug $pref \"executing >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<<\" ${1:-$__INTERNAL_Log_level_DEBUG}
+      else
+        trap - DEBUG
+        LogDebug $pref \"execution >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<< returned \$__INTERNAL_Log_DEBUGING_res\" ${1:-$__INTERNAL_Log_level_DEBUG}
+      fi" DEBUG 
+  }
+}; # end of LogDebugNext }}}
+
+
+# LogMoreNext ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogMoreNext() {
+  LogMore || {
+    local pref=''
+    [[ "$1" =~ ^-f([0-9]*) ]] && {
+      shift
+      pref="-f$((${BASH_REMATCH[1]:-1}))"
+    }
+    LogDebugNext $pref  ${1:-$__INTERNAL_Log_level_MORE}
+  }
+}; # end of LogMoreNext }}}
+LogNext() {
+  LogMoreNext "$@"
+}
+
+
+# LogDebugOn ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogDebugOn() {
+  local pref=''
+  [[ "$1" =~ ^-f([0-9]*) ]] && {
+    shift
+    pref="-f$((${BASH_REMATCH[1]:-1}))"
+  }
+  LogDebug '' ${1:-$__INTERNAL_Log_level_DEBUG} || {
+    trap "
+      __INTERNAL_Log_DEBUGING_res=\$?
+      let __INTERNAL_Log_DEBUGING++
+      if [[ -z \"\$__INTERNAL_Log_DEBUGING_cmd\" ]]; then
+        __INTERNAL_Log_DEBUGING_cmd=\"\$BASH_COMMAND\"
+        LogDebug $pref \"executing >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<<\" ${1:-$__INTERNAL_Log_level_DEBUG}
+      else
+        LogDebug $pref \"execution >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<< returned \$__INTERNAL_Log_DEBUGING_res\" ${1:-$__INTERNAL_Log_level_DEBUG}
+        __INTERNAL_Log_DEBUGING_cmd=\"\$BASH_COMMAND\"
+        if [[ \"\$__INTERNAL_Log_DEBUGING_cmd\" =~ LogDebugOff ]]; then
+          trap - DEBUG
+        else
+          LogDebug $pref \"executing >>>>> \$__INTERNAL_Log_DEBUGING_cmd <<<<<\" ${1:-$__INTERNAL_Log_level_DEBUG}
+        fi
+      fi" DEBUG 
+  }
+}; # end of LogDebugOn }}}
+
+
+# LogMoreOn ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogMoreOn() {
+  LogMore || {
+    local pref=''
+    [[ "$1" =~ ^-f([0-9]*) ]] && {
+      shift
+      pref="-f$((${BASH_REMATCH[1]:-1}))"
+    }
+    LogDebugOn $pref ${1:-$__INTERNAL_Log_level_MORE}
+  }
+}; # end of LogMoreOn }}}
+
+
+# LogDebugOff ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+# log info about execution to Debug level
+LogDebugOff() {
+  __INTERNAL_Log_DEBUGING_cmd=''
+}; # end of LogDebugOff }}}
+
+
+# LogVar ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogVar() {
+  [[ -n "$DEBUG" ]] && {
+    echo -n 'eval '
+    while [[ -n "$1" ]]; do
+      echo -n "LogDebug -f \"\$(set | grep -P '^$1=')\";"
+      shift
+    done
+  }
+}; # end of LogVar }}}
+
+
+# __INTERNAL_LogRedirectToBeakerlib ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_LogRedirectToBeakerlib() {
+  echo -e "\nrunning inside the beakerlib - redirect own logging functions to beakerlib ones"
+  true; LogjAddMessage() {
+    LogMore___ -f "begin $*"
+    rljAddMessage "$2" "$1"
+    LogMore___ -f "end $*"
+  }
+  true; Log() {
+    LogMore___ -f "begin $*"
+    case ${2} in
+      INFO)
+        LogjAddMessage "INFO" "$1"
+        LogPrintMessage "$2" "${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+        ;;
+      BEGIN)
+        LogjAddMessage "INFO" "$*:"
+        LogPrintMessage "$2" "${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+        ;;
+      WARNING|WARN|ERROR|FATAL)
+        LogjAddMessage "WARNING" "$1"
+        LogPrintMessage "$2" "${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+        ;;
+      SKIP|SKIPPING)
+        LogjAddMessage "WARNING" "$*:"
+        LogPrintMessage "$2" "${__INTERNAL_Log_prefix}${__INTERNAL_Log_prefix2}${1}${__INTERNAL_Log_postfix}"
+        ;;
+      FAIL)
+        rlFail "$*"
+        return $?
+        ;;
+      PASS)
+        rlPass "$*"
+        return $?
+        ;;
+      *)
+        rlLog "$*"
+        ;;
+    esac
+    LogMore___ -f "end $*"
+    return 0;
+  }
+}
+# end of __INTERNAL_LogRedirectToBeakerlib }}}
+
+
+# LogLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+LogLibraryLoaded() {
+  declare -F rlDie > /dev/null && __INTERNAL_LogRedirectToBeakerlib
+  return 0
+}; # end of LogLibraryLoaded }}}
+
+
+echo "done."
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/opts/Makefile b/tests/sudoers-options-sanity-test/distribution/Library/opts/Makefile
new file mode 100644
index 0000000..389fe25
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/opts/Makefile
@@ -0,0 +1,48 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/opts
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/opts
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Provides simple way for defining script's or function's options including help" >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/Log)" >> $(METADATA)
+	@echo "Provides:        library(distribution/opts)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/opts/lib.sh b/tests/sudoers-options-sanity-test/distribution/Library/opts/lib.sh
new file mode 100644
index 0000000..180f7ba
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/opts/lib.sh
@@ -0,0 +1,338 @@
+#!/bin/bash
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = opts
+#   library-version = 4
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_opts_LIB_VERSION=4
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library opts
+
+=head1 DESCRIPTION
+
+This library provides simple way for defining script's or function's option
+agruments including help.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/opts and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/opts)" >> $(METADATA)
+
+B<Code example>
+
+	testfunction() {
+	  optsBegin -h "Usage: $0 [options]
+	
+	  options:
+	"
+	  optsAdd 'flag1' --flag
+	  optsAdd 'optional1|o' --optional
+	  optsAdd 'Optional2|O' "echo opt \$1" --optional --long --var-name opt
+	  optsAdd 'mandatory1|m' "echo man \$1" --mandatory
+	  optsDone; eval "${optsCode}"
+	  echo "$optional1"
+	  echo "$opt"
+	  echo "$mandatory1"
+	}
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library opts v$__INTERNAL_opts_LIB_VERSION... "
+
+# optsAdd ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsAdd() {
+  LogMoreMed -f "begin '$*'"
+  local GETOPT=$(getopt -q -o fomv:d:lh:l -l flag,opt,optional,mandatory,varname:,default:,local,help:,long -- "$@")
+  eval set -- "$GETOPT"
+  local type='f' var_name var_name_set default help long
+  while [[ -n "$@" ]]; do
+    case $1 in
+    --)
+      shift; break
+      ;;
+    -h|--help)
+      shift
+      help="$1"
+      ;;
+    -l|--long)
+      long=1
+      ;;
+    -d|--default)
+      shift
+      default="$1"
+      ;;
+    -v|--varname|--var-name)
+      shift
+      var_name="$1"
+      var_name_set=1
+      ;;
+    -f|--flag)
+      type='f'
+      ;;
+    -o|--opt|--optional)
+      type='o'
+      ;;
+    -m|--mandatory)
+      type='m'
+      ;;
+    *)
+      echo "unknown option '$1'"
+      return 1
+      ;;
+    esac
+    shift;
+  done
+  [ -z "$var_name" ] && {
+    var_name=$(echo -n "$1" | cut -d '|' -f 1 | sed -e 's/-//g;s/^[0-9]/_\0/')
+    LogMoreHigh -f "constructing variable name '$var_name'"
+  }
+  local opts='' opts_help='' optsi=''
+  for optsi in $(echo -n "$1" | tr '|' ' '); do
+    if [[ ${#optsi} -ge 2 || $long -eq 1 ]]; then 
+      opts="$opts|--$optsi"
+      opts_help="$opts_help|--$optsi[=ARG]"
+      __INTERNAL_opts_long="${__INTERNAL_opts_long},${optsi}"
+      LogMoreHigh -f "adding long option '$optsi'"
+      case $type in
+      m)
+        __INTERNAL_opts_long="${__INTERNAL_opts_long}:"
+        ;;
+      o)
+        __INTERNAL_opts_long="${__INTERNAL_opts_long}::"
+        ;;
+      esac
+    else
+      opts="$opts|-$optsi"
+      opts_help="$opts_help|-${optsi}[ARG]"
+      __INTERNAL_opts_short="${__INTERNAL_opts_short}${optsi}"
+      LogMoreHigh -f "adding short option '$optsi'"
+      case $type in
+      m)
+        __INTERNAL_opts_short="${__INTERNAL_opts_short}:"
+        ;;
+      o)
+        __INTERNAL_opts_short="${__INTERNAL_opts_short}::"
+        ;;
+      esac
+    fi
+  done
+  optsCode="${optsCode}
+  ${opts:1})
+    optsPresent=\"\${optsPresent}$var_name \""
+  LogMoreHigh -f "adding code for processing option '${opts:1}'"
+  __INTERNAL_opts_init_var="$__INTERNAL_opts_init_var
+${__INTERNAL_opts_local}$var_name=()"
+  __INTERNAL_opts_default="$__INTERNAL_opts_default
+[[ \"\$optsPresent\" =~ \$(echo \"\<${var_name}\>\") ]] || ${__INTERNAL_opts_local}$var_name='$default'"
+  case $type in
+  f)
+    [[ -z "$2" || -n "$var_name_set" ]] && {
+      local val=1
+      [[ -n "$default" ]] && val=''
+      optsCode="$optsCode
+    $var_name+=( '$val' )"
+    }
+    __INTERNAL_opts_help="${__INTERNAL_opts_help}
+  ${opts:1}"
+    ;;
+  o|m)
+    optsCode="$optsCode
+    shift"
+    [[ -z "$2" || -n "$var_name_set"  ]] && optsCode="$optsCode
+    $var_name+=( \"\$1\" )"
+    if [[ "$type" == "o" ]]; then
+      __INTERNAL_opts_help="${__INTERNAL_opts_help}
+  ${opts_help:1}"
+    else
+      __INTERNAL_opts_help="${__INTERNAL_opts_help}
+  ${opts:1} ARG"
+    fi
+    ;;
+  esac
+  [[ -n "$2" ]] && {
+  optsCode="$optsCode
+    $2"
+  }
+  optsCode="$optsCode
+    ;;"
+
+  __INTERNAL_opts_help="${__INTERNAL_opts_help}${help:+
+      $help
+}"
+  LogMoreMed -f "end"
+}; # end of optsAdd }}}
+
+
+# optsBegin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsBegin() {
+  LogMoreMed -f "begin '$*'"
+  optsCode=''
+  optsPresent=' '
+  __INTERNAL_opts_short='.'
+  __INTERNAL_opts_long='help'
+  __INTERNAL_opts_help=''
+  __INTERNAL_opts_local=''
+  __INTERNAL_opts_default=''
+  __INTERNAL_opts_init_var=''
+  [[ "${FUNCNAME[1]}" != "main" ]] && __INTERNAL_opts_local='local '
+  while [[ -n "$1" ]]; do
+    case $1 in
+    --)
+      shift; break
+      ;;
+    -h|--help)
+      shift
+      __INTERNAL_opts_help="$1"
+      ;;
+    *)
+      echo "unknown option '$1'"
+      return 1
+      ;;
+    esac
+    shift;
+  done
+  LogMoreMed -f "end"
+}; # end of optsBegin }}}
+
+
+# optsDone ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsDone() {
+  LogMoreMed -f "begin '$*'"
+  optsCode="${__INTERNAL_opts_local}GETOPT=\$(getopt -o ${__INTERNAL_opts_short} -l ${__INTERNAL_opts_long} -- \"\$@\")
+[[ \$? -ne 0 ]] && {
+  echo 'Exiting'
+  return 1 >& /dev/null
+  exit 1
+}
+eval set -- \"\$GETOPT\"
+${__INTERNAL_opts_init_var:1}
+while [[ -n \"\$1\" ]]; do
+  case \$1 in
+  --)
+    shift; break
+    ;;
+${optsCode}
+
+  --help)
+    echo \"\$__INTERNAL_opts_help\"
+    return >& /dev/null
+    exit
+    ;;
+  *)
+    echo \"unknown option '\$1'\"
+    return 1 >& /dev/null
+    exit 1
+  ;;
+  esac
+  shift
+done
+${__INTERNAL_opts_default:1}
+unset optsCode __INTERNAL_opts_help __INTERNAL_opts_short __INTERNAL_opts_long __INTERNAL_opts_default __INTERNAL_opts_init_var __INTERNAL_opts_local
+"
+  if ! echo "$optsCode" | grep -q -- '--help$'; then
+    __INTERNAL_opts_help="$__INTERNAL_opts_help
+  --help
+      Show this help."
+  fi
+  LogMoreHigh -f "optsCode:\n$optsCode"
+  LogMoreMed -f "end"
+}; # end of optsDone }}}
+
+
+# optsSelfCheck ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsSelfCheck() {
+  optsBegin -h "Usage: $0 [options]
+
+  options:
+"
+#  optsAdd 'help' -f 'echo help'
+  optsAdd 'flag' -f 'echo f'
+  optsAdd 'optional|o' -o "echo opt \$1"
+  optsAdd 'Optional|O' -o "echo opt \$1" --long
+  optsAdd 'mandatory|m' -m "echo man \$1"
+  optsDone
+  
+  echo "${optsCode}"
+  
+  echo ...
+  
+  eval "${optsCode}"
+  
+  echo ...
+  
+  fce() {
+    optsBegin -h "Usage: $0 [options]
+
+  options:
+"
+  #  optsAdd 'help' -f 'echo help'
+    optsAdd 'flag' -f
+    optsAdd 'optional|o' -o "echo opt \$1"
+    optsAdd 'Optional|O' -o "echo opt \$1" --long
+    optsAdd 'mandatory|m' -m "echo man \$1"
+    optsDone
+    echo "${optsCode}"
+    
+    echo ...
+    
+    eval "${optsCode}"
+    
+    echo ...
+  }
+  
+  echo -e 'test for opts in function\n========================='
+  fce --help
+}; # end of optsSelfCheck }}}
+
+
+# optsLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+optsLibraryLoaded() {
+  return 0
+}; # end of LogLibraryLoaded }}}
+
+
+echo "done."
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/tcf/Makefile b/tests/sudoers-options-sanity-test/distribution/Library/tcf/Makefile
new file mode 100644
index 0000000..2566969
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/tcf/Makefile
@@ -0,0 +1,60 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/tcf
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/tcf
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Block style coding with ability of skipping parts." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/Log)" >> $(METADATA)
+	@echo "Provides:        library(distribution/tcf)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/tcf/lib.sh b/tests/sudoers-options-sanity-test/distribution/Library/tcf/lib.sh
new file mode 100644
index 0000000..561b0ff
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/tcf/lib.sh
@@ -0,0 +1,903 @@
+#!/bin/bash
+# try-check-final.sh
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = tcf
+#   library-version = 14
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+__INTERNAL_tcf_LIB_VERSION=14
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library Try-Check-Final
+
+=head1 DESCRIPTION
+
+This file contains functions which gives user the ability to define blocks of
+code where some of the blocks can be automatically skipped if some of preceeding
+blocks failed.
+
+ATTENTION
+This plugin modifies some beakerlib functions! If you suspect that it breakes
+some functionality set the environment variable TCF_NOHACK to nonempty value.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/tcf and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/tcf)" >> $(METADATA)
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library try-check-final v$__INTERNAL_tcf_LIB_VERSION... "
+
+
+let __INTERNAL_tcf_DEBUG_LEVEL_LOW=3
+let __INTERNAL_tcf_DEBUG_LEVEL_MED=$__INTERNAL_tcf_DEBUG_LEVEL_LOW+1
+let __INTERNAL_tcf_DEBUG_LEVEL_HIGH=$__INTERNAL_tcf_DEBUG_LEVEL_LOW+2
+
+# global variables {{{
+__INTERNAL_tcf_result=0
+__INTERNAL_tcf_result_file="${BEAKERLIB_DIR:-"/var/tmp"}/tcf.result"
+echo -n "$__INTERNAL_tcf_result" > "$__INTERNAL_tcf_result_file"
+__INTERNAL_tcf_current_level_data=()
+__INTERNAL_tcf_current_level_val=0
+__INTERNAL_tcf_journal=()
+#}}}
+
+
+# __INTERNAL_tcf_colorize ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_colorize() {
+  local a
+  case $1 in
+    PASS)
+      a="${__INTERNAL_tcf_color_green}${1}${__INTERNAL_tcf_color_reset}"
+      ;;
+    FAIL)
+      a="${__INTERNAL_tcf_color_red}${1}${__INTERNAL_tcf_color_reset}"
+      ;;
+    SKIPPING|WARNING)
+      a="${__INTERNAL_tcf_color_yellow}${1}${__INTERNAL_tcf_color_reset}"
+      ;;
+    BEGIN|INFO)
+      a="${__INTERNAL_tcf_color_blue}${1}${__INTERNAL_tcf_color_reset}"
+      ;;
+    *)
+      a=$1
+  esac
+  echo -n "$a"
+}; # end of __INTERNAL_tcf_colorize }}}
+
+
+# __INTERNAL_tcf_colors_setup ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_colors_setup(){
+  T="$TERM"
+  [[ -t 1 ]] || T=""
+  [[ -t 2 ]] || T=""
+  [[ "$1" == "--force" ]] && T="xterm"
+  case $T in
+    xterm|screen)
+      __INTERNAL_tcf_color_black="\e[0;30m"
+      __INTERNAL_tcf_color_dark_gray="\e[1;30m"
+      __INTERNAL_tcf_color_blue="\e[0;34m"
+      __INTERNAL_tcf_color_light_blue="\e[1;34m"
+      __INTERNAL_tcf_color_green="\e[0;32m"
+      __INTERNAL_tcf_color_light_green="\e[1;32m"
+      __INTERNAL_tcf_color_cyan="\e[0;36m"
+      __INTERNAL_tcf_color_light_cyan="\e[1;36m"
+      __INTERNAL_tcf_color_red="\e[0;31m"
+      __INTERNAL_tcf_color_light_red="\e[1;31m"
+      __INTERNAL_tcf_color_purple="\e[0;35m"
+      __INTERNAL_tcf_color_light_purple="\e[1;35m"
+      __INTERNAL_tcf_color_brown="\e[0;33m"
+      __INTERNAL_tcf_color_yellow="\e[1;33m"
+      __INTERNAL_tcf_color_light_gray="\e[0;37m"
+      __INTERNAL_tcf_color_white="\e[1;37m"
+      __INTERNAL_tcf_color_reset="\e[00m"
+      ;;
+    * )
+      __INTERNAL_tcf_color_black=""
+      __INTERNAL_tcf_color_dark_gray=""
+      __INTERNAL_tcf_color_blue=""
+      __INTERNAL_tcf_color_light_blue=""
+      __INTERNAL_tcf_color_green=""
+      __INTERNAL_tcf_color_light_green=""
+      __INTERNAL_tcf_color_cyan=""
+      __INTERNAL_tcf_color_light_cyan=""
+      __INTERNAL_tcf_color_red=""
+      __INTERNAL_tcf_color_light_red=""
+      __INTERNAL_tcf_color_purple=""
+      __INTERNAL_tcf_color_light_purple=""
+      __INTERNAL_tcf_color_brown=""
+      __INTERNAL_tcf_color_yellow=""
+      __INTERNAL_tcf_color_light_gray=""
+      __INTERNAL_tcf_color_white=""
+      __INTERNAL_tcf_color_reset=""
+      ;;
+  esac
+}; # end of __INTERNAL_tcf_colors_setup
+__INTERNAL_tcf_colors_setup; # }}}
+
+
+# __INTERNAL_tcf_copy_function ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_copy_function() {
+    declare -F $1 > /dev/null || return 1
+    eval "$(echo -n "${2}() "; declare -f ${1} | tail -n +2)"
+}; # end of __INTERNAL_tcf_copy_function }}}
+
+
+# __INTERNAL_tcf_addE2R ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_addE2R() {
+  __INTERNAL_tcf_copy_function $1 TCF_orig_$1
+  eval "${1}() { TCF_orig_${1} \"\$@\"; tcfE2R; }"
+}; # end of __INTERNAL_tcf_addE2R }}}
+
+
+# __INTERNAL_tcf_insertE2R ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_insertE2R() {
+  __INTERNAL_tcf_copy_function $1 TCF_orig_$1
+  eval "$(echo -n "${1}() "; declare -f ${1} | tail -n +2 | sed -e 's/\(.*__INTERNAL_ConditionalAssert.*\)/\1\ntcfE2R;/')"
+}; # end of __INTERNAL_tcf_insertE2R }}}
+
+
+# __INTERNAL_tcf_get_current_level ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_get_current_level() {
+  local l=$__INTERNAL_tcf_current_level_val
+  if [[ $1 ]]; then
+    l=$(($l+$1))
+  fi
+  local i
+  for i in $(seq 1 $(($l*2)) ); do echo -n " "; done
+  return $l
+}; # end of __INTERNAL_tcf_get_current_level }}}
+
+
+# __INTERNAL_tcf_incr_current_level ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_incr_current_level() {
+  let __INTERNAL_tcf_current_level_val++
+  __INTERNAL_Log_prefix=$(__INTERNAL_tcf_get_current_level)
+}; # end of __INTERNAL_tcf_incr_current_level }}}
+
+
+# __INTERNAL_tcf_decr_current_level ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_decr_current_level() {
+  let __INTERNAL_tcf_current_level_val--
+  __INTERNAL_Log_prefix=$(__INTERNAL_tcf_get_current_level)
+}; # end of __INTERNAL_tcf_decr_current_level }}}
+
+
+# __INTERNAL_tcf_do_hack ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_do_hack() {
+   LogDebug "TCF_NOHACK='$TCF_NOHACK'"
+   if [[ -z "$TCF_NOHACK" ]]; then
+    tcfChk "Apply TCF beakerlib hacks" && {
+      rlLog "  injecting tcf hacks into the beakerlib functions"
+      echo -n "patching rlLog"
+      local rlL=$(declare -f rlLog | sed -e 's|\] ::|\0${__INTERNAL_Log_prefix}|;s|$3 $1"|${3:+"$3 "}$1"|')
+      eval "$rlL"
+
+      echo -n ", rljAddTest"
+      __INTERNAL_tcf_copy_function rljAddTest __INTERNAL_tcf_orig_rljAddTest
+      true; rljAddTest() {
+        local a="${__INTERNAL_Log_prefix}$1"; shift
+        [[ "$1" != "FAIL" ]]; tcfE2R
+        __INTERNAL_tcf_journal=("${__INTERNAL_tcf_journal[@]}" "$1" "$a")
+        __INTERNAL_tcf_orig_rljAddTest "$a" "$@"
+      }
+      echo -n ", rljAddMessage"
+      __INTERNAL_tcf_copy_function rljAddMessage __INTERNAL_tcf_orig_rljAddMessage
+      true; rljAddMessage() {
+        local a="${__INTERNAL_Log_prefix}$1"; shift
+        __INTERNAL_tcf_journal=("${__INTERNAL_tcf_journal[@]}" "$1" "$a")
+        __INTERNAL_tcf_orig_rljAddMessage "$a" "$@"
+      }
+      echo -n ", __INTERNAL_LogAndJournalFail"
+      __INTERNAL_tcf_copy_function __INTERNAL_LogAndJournalFail __INTERNAL_tcf_orig___INTERNAL_LogAndJournalFail
+      true; __INTERNAL_LogAndJournalFail() {
+        tcfNOK
+        __INTERNAL_tcf_orig___INTERNAL_LogAndJournalFail "$@"
+      }
+      echo "."
+    tcfFin --no-assert --ignore; }
+  else
+    Log "skip hacking beakerlib functions"
+  fi
+}; # end of __INTERNAL_tcf_do_hack }}}
+
+
+# __INTERNAL_tcf_kill_old_plugin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_kill_old_plugin() {
+    tcfChk "Get rid of the old TCF implementation. removing" && {
+      local comma='' i
+      for i in Try Chk Fin E2R RES OK NOK NEG TCFcheckFinal TCFreport; do
+        echo -n "${comma}rl$i"
+        unset -f rl$i
+        comma=', '
+      done
+      echo '.'
+    tcfFin --no-assert; }
+}; # end of __INTERNAL_tcf_kill_old_plugin }}}
+
+
+: <<'=cut'
+=pod
+
+=head2 Block functions
+
+=cut
+
+# __INTERNAL_tcf_parse_params ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+__INTERNAL_tcf_parse_params() {
+  local GETOPT=$(getopt -q -o if: -l ignore,no-assert,fail-tag: -- "$@")
+  eval set -- "$GETOPT"
+  echo "local ignore noass title fail_tag"
+  echo "[ -z \"\$ignore\" ] && ignore=0"
+  echo "[ -z \"\$noass\" ] && noass=0"
+  echo "[ -z \"\$fail_tag\" ] && fail_tag='FAIL'"
+  while [[ -n "$@" ]]; do
+    case $1 in
+    --)
+      shift; break
+      ;;
+    --ignore|-i)
+      echo "ignore=1"
+      echo "noass=1"
+      ;;
+    --no-assert|-n)
+      echo "noass=1"
+      ;;
+    --fail-tag|-f)
+      shift
+      echo "fail_tag='$1'"
+      ;;
+    *)
+      echo "unknown option $1"
+      return 1
+      ;;
+    esac
+    shift;
+  done
+  [[ -n "$1" ]] && echo "title=\"${1}\""
+  echo "eval set -- \"$(echo "$GETOPT" | sed -e 's/.*-- //')\""
+}; # end of __INTERNAL_tcf_parse_params }}}
+
+
+# tcfTry ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfTry
+
+Starting function of block which will be skipped if an error has been detected
+by tcfFin function occurent before.
+
+    tcfTry ["title"] [-i|--ignore] [--no-assert] [--fail-tag TAG] && {
+      <some code>
+    tcfFin; }
+
+If title is omitted than noting is printed out so no error will be reported (no
+Assert is executed) thus at least the very top level tcfTry should have title.
+
+tcfTry and tcfChk blocks are stackable so you can organize them into a hierarchy
+structure.
+
+Note that tcfFin has to be used otherwise the overall result will not be
+accurate.
+
+=over
+
+=item title
+
+Text which will be displayed and logged at the beginning and the end (in tcfFin
+function) of the block.
+
+=item -i, --ignore
+
+Do not propagate the actual result to the higher level result.
+
+=item -n, --no-assert
+
+Do not log error into the journal.
+
+=item -f, --fail-tag TAG
+
+If the result of the block is FAIL, use TAG instead ie. INFO or WARNING.
+
+=back
+
+Returns 1 if and error occured before, otherwise returns 0.
+
+=cut
+
+tcfTry() {
+  LogMoreLow -f "begin '$*'"
+  local vars=$(__INTERNAL_tcf_parse_params "$@") || { Log "$vars" FAIL; return 1; }
+  LogMoreMed -f "vars:\n$vars"
+  LogMoreLow -f "evaluating options start"
+  eval "$vars"
+  LogMoreLow -f "evaluating options end"
+  local incr=
+  local pp="SKIPPING"
+  tcfRES; # to set __INTERNAL_tcf_result
+  LogMoreLow -f "result was $__INTERNAL_tcf_result"
+  if [[ $__INTERNAL_tcf_result -eq 0 ]]; then
+    __INTERNAL_tcf_current_level_data=("$__INTERNAL_tcf_result" "$vars" "${__INTERNAL_tcf_current_level_data[@]}")
+    pp="BEGIN"
+    incr=1
+  fi
+  if [[ -n "$title" ]]; then
+    Log "$title" "$pp"
+    [[ -n "$incr" ]] && {
+      LogMoreLow -f "increment indentation level"
+      __INTERNAL_tcf_incr_current_level
+    }
+  fi
+  LogMoreLow -f "end"
+  return $__INTERNAL_tcf_result
+}; # end of tcfTry }}}
+
+
+# tcfChk ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfChk
+
+Starting function of block which will be always executed.
+
+    tcfChk ["title"] [-i|--ignore] [--no-assert] [--fail-tag TAG] && {
+      <some code>
+    tcfFin; }
+
+If title is omitted than noting is printed out so no error will be reported (no
+Assert is executed) thus at least the very top level tcfChk should have title.
+
+tcfTry and tcfChk blocks are stackable so you can organize them into a hierarchy
+structure.
+
+Note that tcfFin has to be used otherwise the overall result will not be
+accurate.
+
+For details about arguments see tcfTry.
+
+Returns 0.
+
+=cut
+
+tcfChk() {
+  LogMoreLow -f "begin '$*'"
+  tcfRES; # to set __INTERNAL_tcf_result
+  local res=$__INTERNAL_tcf_result
+  tcfRES 0
+  tcfTry "$@"
+  __INTERNAL_tcf_current_level_data[0]=$res
+  LogMoreLow -f "end"
+  return $__INTERNAL_tcf_result
+}; # end of tcfChk }}}
+
+
+# tcfFin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfFin
+
+Ending function of block. It does some evaluation of previous local and global
+results and puts it into the global result.
+
+    tcfTry ["title"] && {
+      <some code>
+    tcfFin [-i|--ignore] [--no-assert] [--fail-tag TAG]; }
+
+Local result is actualy exit code of the last command int the body.
+
+Global result is an internal varibale hodning previous local results.
+Respectively last error or 0.
+
+For details about arguments see tcfTry.
+
+Returns local result of the preceeding block.
+
+=cut
+
+tcfFin() {
+  local RES=$?
+  LogMoreLow -f "begin '$*'"
+  LogMoreMed -f "previous exit code was '$RES'"
+  local vars=$(__INTERNAL_tcf_parse_params "$@") || { Log "$vars" FAIL; return 1; }
+  LogMoreMed -f "vars:\n$vars"
+  LogMoreLow -f "evaluating options start"
+  eval "$vars"
+  LogMoreLow -f "evaluating options end"
+  tcfRES; # to set __INTERNAL_tcf_result
+  [[ $RES -ne 0 ]] && tcfRES $RES
+  RES=$__INTERNAL_tcf_result
+  LogMoreMed -f "overall result is '$RES'"
+  LogMoreMed -f "data:\n${__INTERNAL_tcf_current_level_data[1]}"
+  LogMoreLow -f "evaluating data start"
+  eval "${__INTERNAL_tcf_current_level_data[1]}"
+  LogMoreLow -f "evaluating data end"
+  if [[ -n "$title" ]]; then
+    __INTERNAL_tcf_decr_current_level
+    if [[ $ignore -eq 1 ]]; then
+      RES=0
+      [[ $__INTERNAL_tcf_result -ne 0 ]] && title="$title - ignored"
+    fi
+    if [[ $noass -eq 0 ]]; then
+      tcfAssert0 "$title" $__INTERNAL_tcf_result "$fail_tag"
+    else
+      if [[ $__INTERNAL_tcf_result -eq 0 ]]; then
+        local pp="PASS"
+        LogInfo "$title - $pp"
+      else
+        local pp="${fail_tag:-FAIL}"
+        LogWarn "$title - $pp"
+      fi
+    fi
+  fi
+  if [[ $__INTERNAL_tcf_result -eq 0 || $ignore -eq 1 ]]; then
+    tcfRES ${__INTERNAL_tcf_current_level_data[0]}
+  fi
+  local i
+  for i in 0 1; do unset __INTERNAL_tcf_current_level_data[$i]; done
+  __INTERNAL_tcf_current_level_data=("${__INTERNAL_tcf_current_level_data[@]}")
+  LogMoreLow -f "end"
+  return $RES
+}; # end of tcfFin }}}
+
+: <<'=cut'
+=pod
+
+=head2 Functions for manipulation with the results
+
+=cut
+
+
+# tcfRES ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfRES
+
+Sets and return the global result.
+
+    tcfRES [-p|--print] [number]
+
+=over
+
+=item -p --print
+
+Also print the result value.
+
+=item number
+
+If present the global result is set to this value.
+
+=back
+
+Returns global result.
+
+=cut
+
+tcfRES() {
+  local p=0
+  while [[ -n "$1" ]]; do
+    case $1 in
+    --print|-p)
+      p=1
+      ;;
+    *)
+      break
+      ;;
+    esac
+    shift
+  done
+  if [[ -n "$1" ]]; then
+    __INTERNAL_tcf_result=$1
+    echo -n "$__INTERNAL_tcf_result" > "$__INTERNAL_tcf_result_file"
+  else
+    __INTERNAL_tcf_result="$(cat "$__INTERNAL_tcf_result_file")"
+  fi
+  [[ $p -eq 1 ]] && echo $__INTERNAL_tcf_result
+  return $__INTERNAL_tcf_result
+}; # end of tcfRES }}}
+
+
+# tcfOK ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfOK
+
+Sets the global result to 0.
+
+    tcfOK
+
+Returns global result.
+
+=cut
+
+tcfOK() {
+  tcfRES 0
+}; # end of tcfOK }}}
+
+
+# tcfNOK ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfNOK
+
+Sets the global result to 1 or given number.
+
+    tcfNOK [number]
+
+=over
+
+=item number
+
+If present the global result is set to this value.
+
+=back
+
+Returns global result.
+
+=cut
+
+tcfNOK() {
+  if [[ -n "$1" ]]; then
+    [[ $1 -eq 0 ]] && echo "You have requested result '0'. You should use tcfOK instead."
+    tcfRES $1
+  else
+    tcfRES 1
+  fi
+}; # end of tcfNOK }}}
+
+
+# tcfE2R ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfE2R
+
+Converts exit code of previous command to local result if the exit code is not 0
+(zero).
+
+    <some command>
+    tcfE2R [number]
+
+=over
+
+=item number
+
+If present use it instead of exit code.
+
+=back
+
+Returns original exit code or given number.
+
+=cut
+
+tcfE2R() {
+  local res=$?
+  [[ -n "$1" ]] && res=$1
+  [[ $res -ne 0 ]] && tcfRES $res
+  return $res
+}; # end of tcfE2R }}}
+
+
+: <<'=cut'
+=pod
+
+=head2 Functions for manipulation with the exit codes
+
+=cut
+
+
+# tcfNEG ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfNEG
+
+Negates exit code of previous command.
+
+    <some command>
+    tcfNEG
+
+Returns 1 if original exit code was 0, otherwise returns 0.
+
+=cut
+
+tcfNEG() {
+  [[ $? -eq 0 ]] && return 1 || return 0
+}; # end of tcfNEG }}}
+
+
+# tcfRun ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfRun
+
+Simmilar to rlRun but it also annouces the beginnign of the command.
+
+    tcfRun [--fail-tag|-f TAG] command [exp_result [title]]
+    
+Moreover if 'command not found' appears on STDERR it should produce WARNING.
+    
+=over
+
+=item command
+
+Command to execute.
+
+=item exp_result
+
+Specification of expect resutl.
+
+It can be a list of values or intervals or * for any result. Also negation (!) can be used.
+
+ Example:
+
+    <=2,7,10-12,>252,!254 means following values 0,1,2,7,10,11,12,253,255
+
+=item title
+
+Text which will be displayed and logged at the beginning and the end of command execution.
+
+=item --fail-tag | -f
+
+If the command fails use TAG instead of FAIL.
+
+=back
+
+Returns exit code of the executed command.
+
+=cut
+
+tcfRun() {
+  LogMore_ -f "begin      $*"
+  optsBegin
+  optsAdd 'fail-tag|f' --mandatory
+  optsAdd 'timeout' --optional 'timeout="${1:-10}"'
+  optsAdd 'kill-timeout|kt' --mandatory --default 5
+  optsAdd 'signal' --mandatory --default TERM
+  optsAdd 'check-code' --mandatory --default 'kill -0 $cmdpid >&/dev/null'
+  optsAdd 'kill-code' --mandatory --default '/bin/kill -$signal -- $cmdpid'
+  optsAdd 'allow-skip|as' --flag
+  optsAdd 'no-assert|n' --flag
+  optsDone; eval "${optsCode}"
+  LogMore_ -f "after opts $*"
+  [[ -z "$allowskip" ]] && tcfChk
+    local orig_expecode="${2:-0}"
+    local expecode="$orig_expecode"
+    [[ "$expecode" == "*" ]] && expecode="0-255"
+    local command="$1"
+    local comment="Running command '$command'"
+    [[ -n "$3" ]] && comment="$3"
+    [[ -n "$expecode" ]] && {
+      expecode=$(echo "$expecode" | tr ',-' '\n ' | sed -e 's/^!=/!/;s/^=//;s/^<=\(.\+\)$/0 \1/;s/^>=\(.\+\)$/\1 255/;s/^<\(.\+\)$/0 \$(( \1 - 1 ))/;s/^>\(.\+\)$/\$(( \1 + 1 )) 255/' | while read line; do [[ "$line" =~ ^[^\ ]+$ ]] && echo "$line" || eval seq $line; done; )
+      tcfE2R
+      LogMoreLow -f "orig_expecode='$orig_expecode'" 
+      LogMoreLow -f "expecode='$expecode'" 
+    }
+    tcfTry ${noassert:+--no-assert} "$comment" && {
+      local errout=$(mktemp)
+      LogMoreLow -f "executing '$command'"
+      if [[ "$optsPresent" =~ $(echo "\<timeout\>") ]]; then
+        LogDebug -f "using watchdog feature"
+        local ec="$(mktemp)"
+        eval "$command; echo $? > $ec 2> >(tee $errout)" &
+        local cmdpid=$!
+        local time_start=$(date +%s)
+        local timeout_t=$(( $time_start + $timeout ))
+        while true; do
+          if ! eval "$checkcode"; then
+             Log "command finished in $(($(date +%s) - $time_start )) seconds"
+             local res="$(cat $ec)"
+             break
+          elif [[ $(date +%s) -ge $timeout_t ]]; then
+            echo
+            Log "command is still running, sending $signal signal"
+            eval "$killcode"
+            tcfNOK 255
+            echo 255 > $ec
+            let timeout_t+=killtimeout
+            signal=KILL
+          fi
+          sleep 0.1
+        done
+        rm -f $ec
+      else
+        eval "$command" 2> >(tee $errout)
+        local res=$?
+      fi
+      LogMoreLow -f "got '$res'" 
+      local resmatch=$(echo "$expecode" | grep "^\!\?${res}$")
+      LogMoreLow -f "resmatch='$resmatch'" 
+      [[ -n "$resmatch" && ! "$resmatch" =~ '!' ]]
+      if tcfE2R; then
+        ! grep -iq "command not found" $errout || { failtag='WARNING'; tcfNOK; }
+      else
+        Log "Expected result was '$orig_expecode', got '$res'!"
+      fi
+    tcfFin ${failtag:+--fail-tag "$failtag"}; }
+    rm -f $errout
+  [[ -z "$allowskip" ]] && tcfFin
+  LogMore_ -f "end $*"
+  return $res
+}; # end of tcfRun }}}
+
+
+: <<'=cut'
+=pod
+
+=head2 Functions for logging
+
+=cut
+
+
+# tcfAssert0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+tcfAssert0() {
+  LogMoreLow -f "begin '$*'"
+  local RES="${3:-FAIL}"
+  [[ $2 -eq 0 ]] && RES='PASS'
+  Log "$1" $RES
+  LogMoreLow -f "end"
+}; # end of tcfAssert0 }}}
+
+
+# tcfCheckFinal ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+: <<'=cut'
+=pod
+
+=head3 tcfCheckFinal
+
+Check that all tcfTry / tcfChk functions have been close by tcfFin.
+
+    tcfCheckFinal
+
+=cut
+
+tcfCheckFinal() {
+  tcfAssert0 "Check that TCF block cache is empty" ${#__INTERNAL_tcf_current_level_data[@]}
+  tcfAssert0 "Check that TCF current level is 0" $__INTERNAL_tcf_current_level_val
+}; # end of tcfCheckFinal }}}
+
+
+echo "done."
+
+: <<'=cut'
+=pod
+
+=head2 Self check functions
+
+=cut
+
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+# tcfSelfCheck {{{
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+: <<'=cut'
+=pod
+
+=head3 tcfSelfCheck
+
+Does some basic functionality tests.
+
+    tcfSelfCheck
+
+The function is called also by the following command:
+
+    ./lib.sh selfcheck
+
+=cut
+
+
+tcfSelfCheck() {
+  tcfChk "check 1" &&{
+    tcfTry "try 1.1 - true" &&{
+      true
+    tcfFin;}
+    tcfTry "try 1.2 - false" &&{
+      false
+    tcfFin;}
+    tcfTry "try 1.3 - true" &&{
+      true
+    tcfFin;}
+  tcfFin;}
+  tcfChk "check 2" &&{
+    tcfTry "try 2.1 - true" &&{
+      true
+    tcfFin;}
+    tcfTry "try 2.2 - true - ignore" &&{
+      true
+    tcfFin -i;}
+    tcfTry "try 2.3 - true" &&{
+      true
+    tcfFin;}
+  tcfFin;}
+  tcfChk "check 3" &&{
+    tcfTry "try 3.1 - true" &&{
+      true
+    tcfFin;}
+    tcfTry "try 3.2 - false - ignore" &&{
+      false
+    tcfFin -i;}
+    tcfTry "try 3.3 - true" &&{
+      true
+    tcfFin;}
+  tcfFin;}
+  tcfCheckFinal
+  tcfAssert0 "Overall result" $(tcfRES -p)
+  LogReport
+}
+if [[ "$1" == "selfcheck" ]]; then
+  tcfSelfCheck
+fi; # end of tcfSelfCheck }}}
+
+
+# tcfLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+tcfLibraryLoaded() {
+  rlImport distribution/Log
+  declare -F rlDie > /dev/null && {
+    #rlJournalStart
+    #rlPhaseStartSetup "TCF"
+    echo -e "\nrunning inside the beakerlib - using rlAssert0"
+    true; tcfAssert0() {
+      local text="$1"
+      [[ "$3" != "FAIL" && "$3" != "PASS" ]] && text="$text - $3"
+      __INTERNAL_ConditionalAssert "$text" "$2"
+    }
+    __INTERNAL_tcf_do_hack
+    #rlPhaseEnd
+    #rlJournalEnd
+  };
+  if declare -F rlE2R >& /dev/null; then
+    __INTERNAL_tcf_kill_old_plugin
+  fi
+  true
+}; # end of tcfLibraryLoaded }}}
+
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
+
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/testUser/Makefile b/tests/sudoers-options-sanity-test/distribution/Library/testUser/Makefile
new file mode 100644
index 0000000..037162e
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/testUser/Makefile
@@ -0,0 +1,60 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /distribution/Library/testUser
+#   Description: Block style coding with ability of skipping parts.
+#   Author: Dalibor Pospisil <dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/distribution/Library/testUser
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) lib.sh Makefile
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Dalibor Pospisil <dapospis@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Setup/cleanup standard testing user." >> $(METADATA)
+	@echo "Type:            Library" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/Log)" >> $(METADATA)
+	@echo "Provides:        library(distribution/testUser)" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/sudoers-options-sanity-test/distribution/Library/testUser/lib.sh b/tests/sudoers-options-sanity-test/distribution/Library/testUser/lib.sh
new file mode 100644
index 0000000..24da7a6
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/distribution/Library/testUser/lib.sh
@@ -0,0 +1,234 @@
+#!/bin/bash
+# try-check-final.sh
+# Authors: 	Dalibor Pospíšil	<dapospis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = testUser
+#   library-version = 7
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+: <<'=cut'
+=pod
+
+=head1 NAME
+
+BeakerLib library testUser
+
+=head1 DESCRIPTION
+
+This library provide s function for maintaining testing users.
+
+=head1 USAGE
+
+To use this functionality you need to import library distribution/testUser and add
+following line to Makefile.
+
+	@echo "RhtsRequires:    library(distribution/testUser)" >> $(METADATA)
+
+=head1 VARIABLES
+
+=over
+
+=item testUser
+
+Array of testing user login names.
+
+=item testUserPasswd
+
+Array of testing users passwords.
+
+=item testUserUID
+
+Array of testing users UIDs.
+
+=item testUserGID
+
+Array of testing users primary GIDs.
+
+=item testUserGroup
+
+Array of testing users primary group names.
+
+=item testUserGIDs
+
+Array of space separated testing users all GIDs.
+
+=item testUserGroups
+
+Array of space separated testing users all group names.
+
+=item testUserGecos
+
+Array of testing users gecos fields.
+
+=item testUserHomeDir
+
+Array of testing users home directories.
+
+=item testUserShell
+
+Array of testing users default shells.
+
+=back
+
+=head1 FUNCTIONS
+
+=cut
+
+echo -n "loading library testUser... "
+
+: <<'=cut'
+=pod
+
+=head3 testUserSetup, testUserCleanup
+
+Creates/removes testing user(s).
+
+    rlPhaseStartSetup
+        testUserSetup [NUM]
+    rlPhaseEnd
+    
+    rlPhaseStartCleanup
+        testUserCleanup
+    rlPhaseEnd
+
+=over
+
+=item NUM
+
+Optional number of user to be created. If not specified one user is created.
+
+=back
+
+Returns 0 if success.
+
+=cut
+
+
+testUserSetup() {
+  # parameter dictates how many users should be created, defaults to 1
+  local res=0
+  local count_created=0
+  local count_wanted=${1:-"1"}
+  local index=0
+  (( $count_wanted < 1 )) && return 1
+
+  while (( $count_created != $count_wanted ));do
+    let index++
+    local newUser="testuser${index}"
+    local newUserPasswd="redhat"
+    id "$newUser" &> /dev/null && continue # if user with the name exists, try again
+
+    # create
+    useradd -m $newUser >&2 || ((res++))
+    echo "$newUserPasswd" | passwd --stdin $newUser || ((res++))
+
+    # save the users array
+    testUser+=($newUser)
+    testUserPasswd+=($newUserPasswd)
+    set | grep "^testUser=" > $__INTERNAL_testUser_users_file
+    set | grep "^testUserPasswd=" >> $__INTERNAL_testUser_users_file
+    ((count_created++))
+  done
+  __INTERNAL_testUserRefillInfo || ((res++))
+
+  echo ${res}
+  [[ $res -eq 0 ]]
+}
+
+
+__INTERNAL_testUserRefillInfo() {
+  local res=0
+  local user
+  testUserUID=()
+  testUserGID=()
+  testUserGroup=()
+  testUserGIDs=()
+  testUserGroups=()
+  testUserGecos=()
+  testUserHomeDir=()
+  testUserShell=()
+
+  for user in ${testUser[@]}; do
+    local ent_passwd=$(getent passwd ${user}) || ((res++))
+    local users_id="$(id ${user})" || ((res++))
+    # testUser is filled during user creation - already present
+    # testUserPasswd is saved same way as testUser - already present
+    testUserUID+=("$(echo "$ent_passwd" | cut -d ':' -f 3)")
+    testUserGID+=("$(echo "$ent_passwd" | cut -d ':' -f 4)")
+    testUserGroup+=("$(echo "$users_id" | sed -r 's/.*gid=(\S+).*/\1/;s/[[:digit:]]+\(//g;s/\)//g;s/,/ /g')")
+    testUserGIDs+=("$(echo "$users_id" | sed -r 's/.*groups=(\S+).*/\1/;s/\([^\)]+\)//g;s/\)//g;s/,/ /g')")
+    testUserGroups+=("$(echo "$users_id" | sed -r 's/.*groups=(\S+).*/\1/;s/[[:digit:]]+\(//g;s/\)//g;s/,/ /g')")
+    testUserGecos+=("$(echo "$ent_passwd" | cut -d ':' -f 5)")
+    testUserHomeDir+=("$(echo "$ent_passwd" | cut -d ':' -f 6)")
+    testUserShell+=("$(echo "$ent_passwd" | cut -d ':' -f 7)")
+  done
+
+  echo ${res}
+  [[ $res -eq 0 ]]
+}
+
+
+testUserCleanup() {
+  local res=0
+  for user in ${testUser[@]}; do
+    userdel -rf "$user" >&2 || ((res++))
+  done
+  unset testUser
+  __INTERNAL_testUserRefillInfo
+  rm -f $__INTERNAL_testUser_users_file >&2 || ((res++))
+
+  echo ${res}
+  [[ $res -eq 0 ]]
+}
+
+
+
+# testUserLibraryLoaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ {{{
+testUserLibraryLoaded() {
+  local res=0
+  # necessary init steps
+  __INTERNAL_testUser_users_file="$BEAKERLIB_DIR/users"
+
+  # try to fill in users array with previous data
+  [[ -f ${__INTERNAL_testUser_users_file} ]] && . ${__INTERNAL_testUser_users_file} >&2
+  __INTERNAL_testUserRefillInfo >&2 || ((res++))
+
+  [[ $res -eq 0 ]]
+}; # end of testUserLibraryLoaded }}}
+
+
+: <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Dalibor Pospisil <dapospis@redhat.com>
+
+=back
+
+=cut
+
+echo "done."
+
diff --git a/tests/sudoers-options-sanity-test/runtest.sh b/tests/sudoers-options-sanity-test/runtest.sh
new file mode 100755
index 0000000..b24299f
--- /dev/null
+++ b/tests/sudoers-options-sanity-test/runtest.sh
@@ -0,0 +1,379 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/sudo/Sanity/sudoers-options-sanity-test
+#   Description: This sanity test checks pre-defined (some are commented) options (examples) in sudoers file.
+#   Author: Ales Marecek <amarecek@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart && {
+  rlPhaseStartSetup && {
+    [[ -z "$BEAKERLIB_LIBRARY_PATH" ]] && BEAKERLIB_LIBRARY_PATH="$(dirname "$(readlink -f "$0")")"
+    rlRun "rlImport --all" 0 "Import libraries" || rlDie "cannot continue"
+    tcfTry "Setup phase" && {
+      tcfRun "rlCheckMakefileRequires"
+      rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+      CleanupRegister "rlRun 'rm -r $TmpDir' 0 'Removing tmp directory'"
+      CleanupRegister 'rlRun "popd"'
+      rlRun "pushd $TmpDir"
+      CleanupRegister 'rlRun "rlFileRestore"'
+      rlRun "rlFileBackup --clean /etc/sudoers"
+      rpm -V sudo | grep /etc/sudoers && {
+        # we need clean config file that is shipped with package
+        rlRun "rm -rf /etc/sudoers"
+        rlRun "yum -y reinstall sudo" 0 "Reinstalling '${PACKAGE}' package"
+      }; :
+      CleanupRegister 'rlRun "testUserCleanup"'
+      rlRun "testUserSetup 2"
+    tcfFin; }
+  rlPhaseEnd; }
+
+  tcfTry "Tests" --no-assert && {
+    rlPhaseStartTest "Active options test - active sudo settings" && {
+      if ( rlIsRHEL 6 && rlIsRHEL '>=6.8' ) || ( rlIsRHEL 7 && rlIsRHEL '>=7.3' ); then
+        _OPTIONS=("!visiblepw" "always_set_home" "env_reset")
+      elif rlIsRHEL; then
+        _OPTIONS=("requiretty" "!visiblepw" "always_set_home" "env_reset")
+      else
+        if rlIsFedora 20; then
+          _OPTIONS=("requiretty" "env_reset")
+        else
+          _OPTIONS=("!visiblepw" "env_reset")
+        fi
+      fi
+      for _OPTION in ${_OPTIONS[@]}; do
+        rlRun "grep '^Defaults\s\+${_OPTION}' /etc/sudoers" 0 "Test: '${_OPTION}' check"
+      done
+    rlPhaseEnd; }
+
+    rlPhaseStartTest "Active options test - Evironment" && {
+        for _OPTION in DISPLAY HOSTNAME USERNAME LC_COLLATE LC_MESSAGES LC_TIME LC_ALL XAUTHORITY; do
+                rlRun "cat /etc/sudoers | grep '^Defaults\s\+env_keep' | grep '${_OPTION}'" 0 "Test: '${_OPTION}' check"
+        done
+        rlRun "grep '^Defaults\s\+secure_path\s\+=\s\+/sbin:/bin:/usr/sbin:/usr/bin' /etc/sudoers" 0 "Test: 'secure_path' check"
+    rlPhaseEnd; }
+
+    rlPhaseStartTest "Commented options test - examples" && {
+        for _OPTION in "Host_Alias" "Cmnd_Alias" "User_Alias"; do
+                rlRun "grep \"^#.*${_OPTION}.*\" /etc/sudoers" 0 "Test: '${_OPTION}' check"
+        done
+    rlPhaseEnd; }
+
+    rlPhaseStartTest "pam_service and pam_login_service" && {
+        CleanupRegister --mark 'rlRun "rlFileRestore --namespace pam_service"'
+        rlRun "rlFileBackup --namespace pam_service --clean /etc/pam.d/ /etc/sudoers"
+        rlRun "cat /etc/pam.d/sudo > /etc/pam.d/sudo2"
+        rlRun "cat /etc/pam.d/sudo-i > /etc/pam.d/sudo2-i"
+        rlRun "sed -i '/session.*pam_echo/d' /etc/pam.d/sudo"
+        rlRun "sed -i '/session.*pam_echo/d' /etc/pam.d/sudo-i"
+        rlRun "echo -e 'session\toptional\tpam_echo.so %%sudo pam_service' >> /etc/pam.d/sudo"
+        rlRun "echo -e 'session\toptional\tpam_echo.so %%sudo-i pam_login_service' >> /etc/pam.d/sudo-i"
+        rlRun "echo -e 'session\toptional\tpam_echo.so %%sudo2 pam_service' >> /etc/pam.d/sudo2"
+        rlRun "echo -e 'session\toptional\tpam_echo.so %%sudo2-i pam_login_service' >> /etc/pam.d/sudo2-i"
+        sudoers_file="$(cat /etc/sudoers)"
+        rlRun -s "sudo id"
+        rlAssertGrep '^%sudo pam_service' $rlRun_LOG
+        rm -f $rlRun_LOG
+        rlRun -s "sudo -i id"
+        rlAssertGrep '^%sudo-i pam_login_service' $rlRun_LOG
+        rm -f $rlRun_LOG
+        tcfChk "change pam service name" && {
+          echo "Defaults pam_service=sudo2" > /etc/sudoers
+          echo "Defaults pam_login_service=sudo2-i" >> /etc/sudoers
+          echo "$sudoers_file" >> /etc/sudoers
+        tcfFin; }
+        rlRun -s "sudo id"
+        rlAssertGrep '^%sudo2 pam_service' $rlRun_LOG
+        rm -f $rlRun_LOG
+        rlRun -s "sudo -i id"
+        rlAssertGrep '^%sudo2-i pam_login_service' $rlRun_LOG
+        rm -f $rlRun_LOG
+        CleanupDo --mark
+    rlPhaseEnd; }
+
+    rlPhaseStartTest "User and Group settings" && {
+        rlRun "grep '^root\s\+ALL=(ALL)\s\+ALL' /etc/sudoers" 0 "Test: 'root' user check"
+        # specific "%wheel" command in RHEL-7 - allowing "wheel" group for super-trooper admin-needs by Anaconda
+        rlIsRHEL 4 5 6
+        [ $? -eq 0 ] && rlRun "grep '^#.*%wheel\s\+ALL=(ALL)\s\+ALL' /etc/sudoers" 0 "Test: 'wheel' (commented) group check" || rlRun "grep '^%wheel\s\+ALL=(ALL)\s\+ALL' /etc/sudoers" 0 "Test: 'wheel' group check"
+        rlRun "grep '^#.*%sys' /etc/sudoers" 0 "Test: 'sys' (commented) group check"
+    rlPhaseEnd; }
+    
+    ! rlIsRHEL '<6' && rlPhaseStartTest 'env_check' && {
+      tcfChk "env_check" && {
+        tcfChk "setup phase" && {
+          rlRun "cat /etc/sudoers > sudoers"
+          CleanupRegister "
+            rlRun 'cat sudoers > /etc/sudoers'
+            rlRun \"export TZ='${TZ}'\"
+          "
+          clean_sudoers=$CleanupRegisterID
+          rlRun "echo 'Defaults env_check += \"TZ\"' >> /etc/sudoers"
+          rlRun "echo 'Defaults env_keep += \"TZ\"' >> /etc/sudoers"
+          rlRun "echo 'Defaults !authenticate' >> /etc/sudoers"
+          rlRun "sed -ri 's/(Defaults\s+)(requiretty)/\1!\2/' /etc/sudoers"
+          rlRun "cat -n /etc/sudoers | tr '\t' ' ' | grep -Pv '^ +[0-9]+ +(#|$)'"
+        tcfFin; }
+        tcfTry "test" && {
+          tcfChk "test allowed values" && {
+            for TZ in AB America/New_York /usr/share/zoneinfo/America/New_York; do
+              rlRun "export TZ='$TZ'"
+              rlRun -s "env"
+              rlAssertGrep "^TZ=$TZ" $rlRun_LOG
+              rm -f $rlRun_LOG
+              rlRun -s "sudo env"
+              rlAssertGrep "^TZ=$TZ" $rlRun_LOG
+              rm -f $rlRun_LOG
+            done
+          tcfFin; }
+          tcfChk "test wrong values" && {
+            for TZ in "A B" \
+                      /etc/hosts \
+                      /usr/share/zoneinfo/../zoneinfo/America/New_York \
+                      1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 \
+                      ; do
+              rlRun "export TZ='$TZ'"
+              rlRun -s "env"
+              rlAssertGrep "^TZ=$TZ" $rlRun_LOG
+              rm -f $rlRun_LOG
+              rlRun -s "sudo env"
+              rlAssertNotGrep "^TZ=$TZ" $rlRun_LOG
+              rm -f $rlRun_LOG
+            done
+          tcfFin; }
+        tcfFin; }
+        tcfChk "cleanup phase" && {
+          CleanupDo $clean_sudoers
+        tcfFin; }
+      tcfFin; }
+    rlPhaseEnd; }
+
+    rlPhaseStartTest "test, requiretty" && {
+      tcfChk && {
+        tcfChk "setup" && {
+          CleanupRegister --mark 'rlRun "rlFileRestore --namespace requiretty"'
+          rlRun "rlFileBackup --clean --namespace requiretty /etc/sudoers"
+          rlRun "echo '$testUser ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers"
+        tcfFin; }
+
+        tcfTry && {
+          tcfChk "test, requiretty" && {
+            rlRun "sed -i '/requiretty/d' /etc/sudoers"
+            rlRun "echo 'Defaults    requiretty' >> /etc/sudoers"
+            rlRun -s "nohup su -l -c 'sudo id' $testUser > /dev/stdout" 1
+            rlAssertGrep 'you must have a tty' $rlRun_LOG
+            rm -f $rlRun_LOG
+          tcfFin; }
+
+          tcfChk "test, !requiretty" && {
+            rlRun "sed -i '/requiretty/d' /etc/sudoers"
+            rlRun "echo 'Defaults    !requiretty' >> /etc/sudoers"
+            rlRun "nohup su -l -c 'sudo id' $testUser > /dev/stdout"
+          tcfFin; }
+        tcfFin; }
+
+        tcfChk "cleanup" && {
+          CleanupDo --mark
+        tcfFin; }
+      tcfFin; }
+    rlPhaseEnd; }
+    
+   if ! rlIsRHEL '<7.4'; then
+    rlPhaseStartTest "test, iolog" && {
+      tcfChk && {
+        iolog_config() {
+          rlLog "create config"
+          cat > /etc/sudoers.d/iolog <<EOF
+Defaults     !requiretty, iolog_dir=/var/log/sudo-io/%{user}
+$1
+$testUser    ALL = (ALL) NOPASSWD: LOG_INPUT: LOG_OUTPUT: ALL
+EOF
+        }
+        tcfChk "setup" && {
+          CleanupRegister --mark 'rlRun "rlFileRestore --namespace iolog"'
+          rlRun "rlFileBackup --clean --namespace iolog /etc/sudoers.d/iolog"
+          rlRun "rm -rf /var/log/sudo-io"
+        tcfFin; }
+
+        tcfTry "test" && {
+          tcfChk "test, basic test" && {
+            rlRun "rm -rf /var/log/sudo-io"
+            iolog_config
+            rlRun "su -c 'sudo /bin/ls /' - $testUser" 0
+            rlRun -s "ls -laR /var/log/sudo-io"
+            rlAssertGrep "drwx------.+root root\s+.*$testUser" $rlRun_LOG -Eq
+            rm -f $rlRun_LOG
+          tcfFin; }
+
+          tcfChk "test, user test" && {
+            rlRun "rm -rf /var/log/sudo-io"
+            iolog_config "Defaults iolog_user=$testUser"
+            rlRun "su -c 'sudo /bin/ls /' - $testUser" 0
+            rlRun -s "ls -laR /var/log/sudo-io"
+            rlAssertGrep "drwx------.+$testUser $testUserGroup\s+.*$testUser" $rlRun_LOG -Eq
+            rm -f $rlRun_LOG
+          tcfFin; }
+
+          tcfChk "test, group test" && {
+            rlRun "rm -rf /var/log/sudo-io"
+            iolog_config "Defaults iolog_group=$testUserGroup"
+            rlRun "su -c 'sudo /bin/ls /' - $testUser" 0
+            rlRun -s "ls -laR /var/log/sudo-io"
+            rlAssertGrep "drwx------.+root $testUserGroup\s+.*$testUser" $rlRun_LOG -Eq
+            rm -f $rlRun_LOG
+          tcfFin; }
+
+          tcfChk "test, mode test" && {
+            rlRun "rm -rf /var/log/sudo-io"
+            iolog_config "Defaults iolog_mode=770"
+            rlRun "su -c 'sudo /bin/ls /' - $testUser" 0
+            rlRun -s "ls -laR /var/log/sudo-io"
+            rlAssertGrep "drwxrwx---.+root root\s+.*$testUser" $rlRun_LOG -Eq
+            rm -f $rlRun_LOG
+          tcfFin; }
+        tcfFin; }
+
+        tcfChk "cleanup" && {
+          CleanupDo --mark
+        tcfFin; }
+      tcfFin; }
+    rlPhaseEnd; }
+
+    rlPhaseStartTest "test, MAIL, NOMAIL" && {
+      tcfChk && {
+        create_config() {
+          rlLog "create config"
+          cat > /etc/sudoers.d/test <<EOF
+Defaults !requiretty, mailto=emailto@domain.com
+${1:+"Defaults $1"}
+$testUser    ALL = (ALL) NOPASSWD: $2 ALL
+${testUser[1]}    ALL = (ALL) NOPASSWD: ALL
+EOF
+        }
+        clean_mail_queue() {
+          which postsuper >& /dev/null && {
+            postsuper -d ALL
+          }
+          [[ -e /var/spool/mqueue/ ]] && [[ -n "$(ls -1 /var/spool/mqueue/)" ]] && {
+            rm -rf /var/spool/mqueue/*
+          }
+          [[ -e /var/spool/clientmqueue/ ]] && [[ -n "$(ls -1 /var/spool/clientmqueue/)" ]] && {
+            rm -rf /var/spool/clientmqueue/*
+          }
+          [[ -e /var/spool/postfix/maildrop/ ]] && [[ -n "$(ls -1 /var/spool/postfix/maildrop/)" ]] && {
+            rm -rf /var/spool/postfix/maildrop/*
+          }
+        }
+        get_last_mail_log() {
+          sleep 1
+          tail -n +$(($last_line_num + 1)) /var/log/maillog | grep -iv 'connection timed out' > last_mail.log
+          mailq >> last_mail.log
+          mailq -Ac >> last_mail.log
+          rlRun "cat last_mail.log" 0-255
+          clean_mail_queue
+          last_line_num=`cat /var/log/maillog | wc -l`
+        }
+        tcfChk "setup" && {
+          CleanupRegister --mark 'rlRun "rlFileRestore --namespace MAIL"'
+          rlRun "rlFileBackup --clean --namespace MAIL /etc/sudoers.d/test"
+          clean_mail_queue
+          get_last_mail_log
+        tcfFin; }
+
+        tcfTry "test" && {
+
+          tcfChk "test, mail_always test" && {
+            create_config mail_always
+            rlRun "su -c 'sudo /bin/ls /' - $testUser" 0
+            get_last_mail_log
+            rlAssertGrep 'emailto@domain.com' last_mail.log -iq
+          tcfFin; }
+
+          tcfChk "test, NOMAIL test" && {
+            create_config mail_always NOMAIL:
+            last_line_num=`cat /var/log/maillog | wc -l`
+            rlRun "su -c 'sudo /bin/ls /' - $testUser" 0
+            get_last_mail_log
+            rlAssertNotGrep 'emailto@domain.com' last_mail.log -iq
+            rlRun "su -c 'sudo /bin/ls /' - ${testUser[1]}" 0
+            get_last_mail_log
+            rlAssertGrep 'emailto@domain.com' last_mail.log -iq
+          tcfFin; }
+
+          tcfChk "test, MAIL test" && {
+            create_config '' MAIL:
+            last_line_num=`cat /var/log/maillog | wc -l`
+            rlRun "su -c 'sudo /bin/ls /' - $testUser" 0
+            get_last_mail_log
+            rlAssertGrep 'emailto@domain.com' last_mail.log -iq
+            rlRun "su -c 'sudo /bin/ls /' - ${testUser[1]}" 0
+            get_last_mail_log
+            rlAssertNotGrep 'emailto@domain.com' last_mail.log -iq
+          tcfFin; }
+
+        tcfFin; }
+
+        tcfChk "cleanup" && {
+          CleanupDo --mark
+        tcfFin; }
+      tcfFin; }
+    rlPhaseEnd; }
+
+    rlPhaseStartTest "test mute unknown defaults" && {
+      CleanupRegister --mark 'rlRun "rlFileRestore --namespace mute_unknown"'
+      rlRun "rlFileBackup --clean --namespace mute_unknown /etc/sudoers.d/test"
+      cat > /etc/sudoers.d/test <<EOF
+Defaults     blahblah
+$testUser    ALL = (ALL) NOPASSWD: ALL
+EOF
+      rlRun -s "su -c 'sudo id' - $testUser" 0
+      rlAssertGrep 'uid=0(root)' $rlRun_LOG
+      rlAssertGrep 'unknown defaults entry.*blahblah' $rlRun_LOG
+      rm -f $rlRun_LOG
+      cat > /etc/sudoers.d/test <<EOF
+Defaults     blahblah
+Defaults     ignore_unknown_defaults
+$testUser    ALL = (ALL) NOPASSWD: ALL
+EOF
+      rlRun -s "su -c 'sudo id' - $testUser" 0
+      rlAssertGrep 'uid=0(root)' $rlRun_LOG
+      rlAssertNotGrep 'unknown' $rlRun_LOG
+      rm -f $rlRun_LOG
+      CleanupDo --mark
+    rlPhaseEnd; }
+  fi
+  tcfFin; }
+
+  rlPhaseStartCleanup && {
+    tcfChk "Cleanup phase" && {
+      CleanupDo
+    tcfFin; }
+    tcfCheckFinal
+  rlPhaseEnd; }
+
+  rlJournalPrintText
+rlJournalEnd; }
diff --git a/tests/tests.yml b/tests/tests.yml
new file mode 100644
index 0000000..6247063
--- /dev/null
+++ b/tests/tests.yml
@@ -0,0 +1,53 @@
+---
+- hosts: localhost
+  tags: [ always ]
+  tasks:
+  - set_fact:
+      our_required_packages:
+      - sudo
+      - passwd          # sudoers-options-sanity-test needs passwd command
+      - postfix         # sudoers-options-sanity-test needs mailq command
+      - wget            # upstream-testsuite-execution-and-rebuild-test needs wget command
+      - yum-utils       # upstream-testsuite-execution-and-rebuild-test needs yum-builddep command
+      - rpm-build       # upstream-testsuite-execution-and-rebuild-test needs rpmbuild command
+      - openssh-clients # use_pty-option needs ssh command
+      - expect          # use_pty-option needs expect command
+      - procps          # run-as needs ps command
+
+- hosts: localhost
+  tags:
+  - classic
+  roles:
+  - role: standard-test-beakerlib
+    tests:
+    - sudoers-options-sanity-test
+    - upstream-testsuite-execution-and-rebuild-test
+    #- use_pty-option    # test logic is currently broken; maintainer is looking into it
+    - run-as
+    - fully-qualified-hostnames
+    required_packages: "{{ our_required_packages }}"
+
+- hosts: localhost
+  tags:
+  - container
+  roles:
+  - role: standard-test-beakerlib
+    tests:
+    - sudoers-options-sanity-test
+    - upstream-testsuite-execution-and-rebuild-test
+    #- use_pty-option   # cannot run (needs sshd configured and running)
+    - run-as
+    #- fully-qualified-hostnames   # cannot run (needs sshd configured and running)
+    required_packages: "{{ our_required_packages }}"
+
+- hosts: localhost
+  tags:
+  - atomic
+  roles:
+  - role: standard-test-beakerlib
+    tests:
+    - run-as
+# - sudoers-options-sanity-test      # cannot run (needs to re-install package)
+# - upstream-testsuite-execution-and-rebuild-test    # cannot run (needs compiler suite)
+# - use_pty-option   # cannot run (needs expect)
+# - fully-qualified-hostnames   # cannot run (needs expect)
diff --git a/tests/upstream-testsuite-execution-and-rebuild-test/Makefile b/tests/upstream-testsuite-execution-and-rebuild-test/Makefile
new file mode 100644
index 0000000..c64c5b7
--- /dev/null
+++ b/tests/upstream-testsuite-execution-and-rebuild-test/Makefile
@@ -0,0 +1,70 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/sudo/Sanity/upstream-testsuite-execution-and-rebuild-test
+#   Description: This test rebuild sudo source rpm and checks that rebuild is OK. The second - main - part is about upstream testsuite execution.
+#   Author: Ales Marecek <amarecek@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/sudo/Sanity/upstream-testsuite-execution-and-rebuild-test
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Ales Marecek <amarecek@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     This test rebuild sudo source rpm and checks that rebuild is OK. The second - main - part is about upstream testsuite execution." >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        15m" >> $(METADATA)
+	@echo "RunFor:          sudo" >> $(METADATA)
+	@echo "Requires:        sudo" >> $(METADATA)
+	@echo "Requires:        sed" >> $(METADATA)
+	@echo "Requires:        grep" >> $(METADATA)
+	@echo "Requires:        rpm-build" >> $(METADATA)
+	@echo "Requires:        yum-utils" >> $(METADATA)
+	@echo "Requires:        make" >> $(METADATA)
+	@echo "Requires:        libcap-devel" >> $(METADATA)
+	@echo "Requires:        audit-libs-devel" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/upstream-testsuite-execution-and-rebuild-test/PURPOSE b/tests/upstream-testsuite-execution-and-rebuild-test/PURPOSE
new file mode 100644
index 0000000..26ca2b6
--- /dev/null
+++ b/tests/upstream-testsuite-execution-and-rebuild-test/PURPOSE
@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/sudo/Sanity/upstream-testsuite-execution-and-rebuild-test
+Description: This test rebuild sudo source rpm and checks that rebuild is OK. The second - main - part is about upstream testsuite execution.
+Author: Ales Marecek <amarecek@redhat.com>
diff --git a/tests/upstream-testsuite-execution-and-rebuild-test/runtest.sh b/tests/upstream-testsuite-execution-and-rebuild-test/runtest.sh
new file mode 100755
index 0000000..8748a8c
--- /dev/null
+++ b/tests/upstream-testsuite-execution-and-rebuild-test/runtest.sh
@@ -0,0 +1,80 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/sudo/Sanity/upstream-testsuite-execution-and-rebuild-test
+#   Description: This test rebuild sudo source rpm and checks that rebuild is OK. The second - main - part is about upstream testsuite execution.
+#   Author: Ales Marecek <amarecek@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="sudo"
+_SPEC_DIR="$(rpm --eval=%_specdir)"
+_BUILD_DIR="$(rpm --eval=%_builddir)"
+_LOG_REBUILD_F="${PACKAGE}-rebuild.log"
+_LOG_TESTSUITE_F="${PACKAGE}-testsuite.log"
+
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+	# Source package is needed for code inspection
+	rlFetchSrcForInstalled "${PACKAGE}" || yumdownloader --source "${PACKAGE}"
+    rlRun "find . -size 0 -delete" 0 "Remove empty src.rpm-s"
+	rlRun "yum-builddep -y --nogpgcheck ${PACKAGE}-*.src.rpm" 0 "Installing build dependencies"
+	[ -d ${_BUILD_DIR} ] && rlRun "rm -rf ${_BUILD_DIR}/*" 0 "Cleaning build directory"
+	rlRun "rpm -ivh ${PACKAGE}-*.src.rpm" 0 "Installing source rpm"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+	rlRun "QA_RPATHS=0x0002 rpmbuild -ba ${_SPEC_DIR}/${PACKAGE}.spec" 0 "Test: Rebuild of source '${PACKAGE}' package"
+	rlGetPhaseState
+	if [ $? -eq 0 ]; then
+		cd ${_BUILD_DIR}/${PACKAGE}-*
+		rlRun -s "make check" 0 "Test: Upstream testsuite"
+		cd ${TmpDir}
+		while read -r I; do
+		    if [[ "$I" =~ $(echo '([^:]+): .+ tests run, .+ errors, (.*)% success rate') ]]; then
+		        [[ "${BASH_REMATCH[2]}" == "100" ]]
+		        rlAssert0 "Test: Checking tests of '${BASH_REMATCH[1]}'" $?
+		    elif [[ "$I" =~ $(echo "([^:]+): .+ tests passed; (.+)/.+ tests failed") ]]; then
+		        [[ "${BASH_REMATCH[2]}" == "0" ]]
+		        rlAssert0 "Test: Checking tests of '${BASH_REMATCH[1]}'" $?
+		    fi
+		done < $rlRun_LOG
+		rm -f $rlRun_LOG
+	else
+		rlFail "Skipping testsuite part because rebuild part failed."
+	fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/tests/use_pty-option/Makefile b/tests/use_pty-option/Makefile
new file mode 100644
index 0000000..e0cb676
--- /dev/null
+++ b/tests/use_pty-option/Makefile
@@ -0,0 +1,72 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/sudo/Sanity/use_pty-option
+#   Description: checks if use_pty option in /etc/sudoers works as expected
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2011 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/sudo/Sanity/use_pty-option
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE forker.sh ssh-sudo.exp
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+	chmod a+x ssh-sudo.exp
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     checks if use_pty option in /etc/sudoers works as expected" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          sudo" >> $(METADATA)
+	@echo "Requires:        sudo" >> $(METADATA)
+	@echo "Requires:        iputils" >> $(METADATA)
+	@echo "Requires:        sed" >> $(METADATA)
+	@echo "Requires:        grep" >> $(METADATA)
+	@echo "Requires:        mktemp" >> $(METADATA)
+	@echo "Requires:        openssh-server" >> $(METADATA)
+	@echo "Requires:        openssh-clients" >> $(METADATA)
+	@echo "Requires:        expect" >> $(METADATA)
+	@echo "Requires:        shadow-utils" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+
+	rhts-lint $(METADATA)
+
diff --git a/tests/use_pty-option/PURPOSE b/tests/use_pty-option/PURPOSE
new file mode 100644
index 0000000..ecc2748
--- /dev/null
+++ b/tests/use_pty-option/PURPOSE
@@ -0,0 +1,4 @@
+PURPOSE of /CoreOS/sudo/Sanity/use_pty-option
+Description: checks if use_pty option in /etc/sudoers works as expected
+Author: Milos Malik <mmalik@redhat.com>
+
diff --git a/tests/use_pty-option/forker.sh b/tests/use_pty-option/forker.sh
new file mode 100644
index 0000000..0eecf07
--- /dev/null
+++ b/tests/use_pty-option/forker.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+for i in `seq 1 10`; do
+    ( ping -c 10 -q www.redhat.com & )
+done
+
diff --git a/tests/use_pty-option/runtest.sh b/tests/use_pty-option/runtest.sh
new file mode 100755
index 0000000..054d752
--- /dev/null
+++ b/tests/use_pty-option/runtest.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/sudo/Sanity/use_pty-option
+#   Description: checks if use_pty option in /etc/sudoers works as expected
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2011 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/bin/rhts-environment.sh
+. /usr/share/beakerlib/beakerlib.sh
+
+PACKAGE="sudo"
+USER_NAME="user${RANDOM}"
+USER_SECRET="s3kr3T${RANDOM}"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm ${PACKAGE}
+        OUTPUT_FILE=`mktemp`
+        rlFileBackup /etc/sudoers
+        rlFileBackup --clean ~/.ssh
+
+        rlRun "useradd ${USER_NAME}"
+        rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+        rlRun "cp ./forker.sh /home/${USER_NAME}/"
+        rlRun "chown ${USER_NAME}:${USER_NAME} /home/${USER_NAME}/forker.sh"
+        rlRun "chmod u+x /home/${USER_NAME}/forker.sh"
+        rlRun "echo \"${USER_NAME} ALL = NOPASSWD: /home/${USER_NAME}/forker.sh\" >> /etc/sudoers"
+        rlRun "sed -i 's/^.*requiretty.*$//' /etc/sudoers"
+        rlRun "echo \"Defaults !requiretty\" >> /etc/sudoers"
+        rlRun "> ~/.ssh/known_hosts"
+    rlPhaseEnd
+
+    rlPhaseStartTest "use_pty option is enabled"
+        rlRun "sed -i 's/^.*use_pty.*$//' /etc/sudoers"
+        rlRun "echo \"Defaults use_pty\" >> /etc/sudoers"
+        rlRun "./ssh-sudo.exp ${USER_NAME} ${USER_SECRET} localhost ./forker.sh 2>&1 | tee ${OUTPUT_FILE}"
+        rlAssertNotGrep "ping statistics" ${OUTPUT_FILE}
+    rlPhaseEnd
+
+    rlPhaseStartTest "use_pty option is disabled"
+        rlRun "sed -i 's/^.*use_pty.*$//' /etc/sudoers"
+        rlRun "echo \"Defaults !use_pty\" >> /etc/sudoers"
+        rlRun "./ssh-sudo.exp ${USER_NAME} ${USER_SECRET} localhost ./forker.sh 2>&1 | tee ${OUTPUT_FILE}"
+        rlAssertGrep "ping statistics" ${OUTPUT_FILE}
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "userdel -rf ${USER_NAME}"
+        rlFileRestore
+        rm -f ${OUTPUT_FILE}
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
diff --git a/tests/use_pty-option/ssh-sudo.exp b/tests/use_pty-option/ssh-sudo.exp
new file mode 100755
index 0000000..afbac4c
--- /dev/null
+++ b/tests/use_pty-option/ssh-sudo.exp
@@ -0,0 +1,20 @@
+#!/usr/bin/expect -f
+# usage:
+# ./ssh-sudo.exp username password hostname command
+set username [lrange $argv 0 0]
+set password [lrange $argv 1 1]
+set hostname [lrange $argv 2 2]
+set command  [lrange $argv 3 3]
+set timeout 15
+spawn ssh $username@$hostname sudo $command
+expect "*yes/no*" {
+    send -- "yes\r"
+}
+expect "*assword*" {
+    send -- "$password\r"
+}
+expect "*assword*" {
+    send -- "$password\r"
+}
+expect eof
+

From ddbf4e5ddd54baf1171de317b779288b93509bfa Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Thu, 14 Dec 2017 12:08:51 +0100
Subject: [PATCH 124/199] Update to 1.8.22b1

- Added /usr/local/sbin and /usr/local/bin to secure path
  rhbz#1166185
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 12 ++++++++----
 sudoers    |  2 +-
 4 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 63000a2..ae4cd94 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,4 @@
 /sudo-1.8.20p1.tar.gz
 /sudo-1.8.20p2.tar.gz
 /sudo-1.8.21p2.tar.gz
+/sudo-1.8.22b1.tar.gz
diff --git a/sources b/sources
index a15d86f..f20f88b 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.21p2.tar.gz) = f04bbff54ad74ba73c078e15c75d2f41332d4912078ed66157ba7346b7fff914bd0747460cb4cd0c472af2d3b344fa72f5c62c95169df68a9cac74d7245c720c
+SHA512 (sudo-1.8.22b1.tar.gz) = 2289e0203898feccb31529899230b7e1f5e634af5e71d252628dc9a6f1bc73257f3b44d0068f1cba244cc33fa677538c327fcd291537811ac57fd4b65dc5a4ea
diff --git a/sudo.spec b/sudo.spec
index 0e3f504..9e7bdf6 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -2,12 +2,12 @@
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.21p2
-Release: 1%{?dist}
+Version: 1.8.22
+Release: 0.1.b1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
+Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b1.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: pam
@@ -50,7 +50,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q
+%setup -q -n sudo-1.8.22b1
 
 %patch1 -p1 -b .strip
 
@@ -204,6 +204,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Thu Dec 14 2017 Radovan Sroka <rsroka@redhat.com> - 1.8.22b1-1
+- update to 1.8.22b1
+- Added /usr/local/sbin and /usr/local/bin to secure path rhbz#1166185
+
 * Thu Sep 21 2017 Marek Tamaskovic <mtamasko@redhat.com> - 1.8.21p2-1
 - update to 1.8.21p2
 - Moved libsudo_util.so from the -devel sub-package to main package (1481225) 
diff --git a/sudoers b/sudoers
index bc4d793..17afb17 100644
--- a/sudoers
+++ b/sudoers
@@ -61,7 +61,7 @@ Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES
 Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
 Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
 
-Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
+Defaults    secure_path = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 ## Next comes the main part: which users can run what software on 
 ## which machines (the sudoers file can be shared between multiple

From 29adaddcb8dee31af57d698fe20dfb84ff6ba7c6 Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Thu, 14 Dec 2017 10:36:14 -0500
Subject: [PATCH 125/199] Drop legacy %post chmod /etc/sudoers

The RPM permissions have been set at `0440` for a long, long time.  This
`%post` invocation dates beyond the import from CVS in 2004.  Further,
this change will actually *undo* local admin changes to use e.g. `0600`
or something if they want to harden it further.

This is similar to: https://src.fedoraproject.org/rpms/nfs-utils/pull-request/1
I'm just making this change as it shows up as error spew when doing
`rpm-ostree compose tree`.
---
 sudo.spec | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 9e7bdf6..304096f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -192,11 +192,6 @@ rm -rf $RPM_BUILD_ROOT
 %license doc/LICENSE
 %exclude %{_pkgdocdir}/ChangeLog
 
-
-# Make sure permissions are ok even if we're updating
-%post
-/bin/chmod 0440 /etc/sudoers || :
-
 %files devel
 %defattr(-,root,root,-)
 %doc plugins/sample/sample_plugin.c

From 41ef6145c08c27f7e1146fbce71bb0052f8273cd Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 9 Feb 2018 17:52:13 +0000
Subject: [PATCH 126/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 9e7bdf6..e98e499 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,7 +3,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.22
-Release: 0.1.b1%{?dist}
+Release: 0.2.b1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -204,6 +204,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.22-0.2.b1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
 * Thu Dec 14 2017 Radovan Sroka <rsroka@redhat.com> - 1.8.22b1-1
 - update to 1.8.22b1
 - Added /usr/local/sbin and /usr/local/bin to secure path rhbz#1166185

From 9bb27fa63d90d5fcefa2cab81adf9f6e4603ec16 Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Wed, 14 Feb 2018 08:52:13 +0100
Subject: [PATCH 127/199] Remove %clean section

None of currently supported distributions need that.
Last one was EL5 which is EOL for a while.

Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
---
 sudo.spec | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index e98e499..a1b5c57 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -153,9 +153,6 @@ session    include      sudo
 EOF
 
 
-%clean
-rm -rf $RPM_BUILD_ROOT
-
 %files -f sudo_all.lang
 %defattr(-,root,root)
 %attr(0440,root,root) %config(noreplace) /etc/sudoers

From 81b76510d4b722fe399c2db0ab4618a1f5437cbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <dkopecek@redhat.com>
Date: Wed, 18 Apr 2018 12:54:42 +0200
Subject: [PATCH 128/199] update to 1.8.23b3

---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 17 ++++++++++-------
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.gitignore b/.gitignore
index ae4cd94..06c8c3f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,4 @@
 /sudo-1.8.20p2.tar.gz
 /sudo-1.8.21p2.tar.gz
 /sudo-1.8.22b1.tar.gz
+/sudo-1.8.23b3.tar.gz
diff --git a/sources b/sources
index f20f88b..bba3c71 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.22b1.tar.gz) = 2289e0203898feccb31529899230b7e1f5e634af5e71d252628dc9a6f1bc73257f3b44d0068f1cba244cc33fa677538c327fcd291537811ac57fd4b65dc5a4ea
+SHA512 (sudo-1.8.23b3.tar.gz) = ee1b93f5729e1000c13519ef716b22399884b029f4b1ce79420f8a1fe71b5456c37a475c6217397717d383d8bcb3896637673cc11bf7610d29a2c7cf798c1de4
diff --git a/sudo.spec b/sudo.spec
index a1b5c57..37a4bea 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -2,12 +2,12 @@
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.22
-Release: 0.2.b1%{?dist}
+Version: 1.8.23
+Release: 0.1.b3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b1.tar.gz
+Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b3.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: pam
@@ -50,7 +50,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q -n sudo-1.8.22b1
+%setup -q -n sudo-1.8.23b3
 
 %patch1 -p1 -b .strip
 
@@ -111,9 +111,6 @@ rm -f sudo.conf
 
 chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%files
 
-# Remove execute permission on this script so we don't pull in perl deps
-chmod -x $RPM_BUILD_ROOT%{_pkgdocdir}/sudoers2ldif
-
 # Don't package LICENSE as a doc
 rm -rf $RPM_BUILD_ROOT%{_pkgdocdir}/LICENSE
 
@@ -167,6 +164,7 @@ EOF
 %{_bindir}/sudoedit
 %attr(0111,root,root) %{_bindir}/sudoreplay
 %attr(0755,root,root) %{_sbindir}/visudo
+%{_bindir}/cvtsudoers
 %dir %{_libexecdir}/sudo
 %attr(0755,root,root) %{_libexecdir}/sudo/sesh
 %attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so
@@ -183,6 +181,8 @@ EOF
 %{_mandir}/man8/sudoedit.8*
 %{_mandir}/man8/sudoreplay.8*
 %{_mandir}/man8/visudo.8*
+%{_mandir}/man1/cvtsudoers.1.gz
+%{_mandir}/man5/sudoers_timestamp.5.gz
 %dir %{_pkgdocdir}/
 %{_pkgdocdir}/*
 %{!?_licensedir:%global license %%doc}
@@ -201,6 +201,9 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Wed Apr 18 2018 Daniel Kopecek <dkopecek@redhat.com> - 1.8.23-0.1.b3
+- update to 1.8.23b3
+
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.22-0.2.b1
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 

From 9d54237c1d47532b9bef9257d489de9b59a4ac90 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <dkopecek@redhat.com>
Date: Wed, 9 May 2018 13:48:35 +0200
Subject: [PATCH 129/199] update to 1.8.23

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 9 ++++++---
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 06c8c3f..aeb7960 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@
 /sudo-1.8.21p2.tar.gz
 /sudo-1.8.22b1.tar.gz
 /sudo-1.8.23b3.tar.gz
+/sudo-1.8.23.tar.gz
diff --git a/sources b/sources
index bba3c71..1aac8dc 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.23b3.tar.gz) = ee1b93f5729e1000c13519ef716b22399884b029f4b1ce79420f8a1fe71b5456c37a475c6217397717d383d8bcb3896637673cc11bf7610d29a2c7cf798c1de4
+SHA512 (sudo-1.8.23.tar.gz) = a9d61850a4857bfd075547a13efb13b054e4736e3ebe3c8a98a90a090b1d9b9688354ec9725fc99d1d256999b6f9c6ae6215ce9770fcdebd7f24731107b48342
diff --git a/sudo.spec b/sudo.spec
index 37a4bea..fe6c25b 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,11 +3,11 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.23
-Release: 0.1.b3%{?dist}
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b3.tar.gz
+Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: pam
@@ -50,7 +50,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q -n sudo-1.8.23b3
+%setup -q
 
 %patch1 -p1 -b .strip
 
@@ -201,6 +201,9 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Wed May 09 2018 Daniel Kopecek <dkopecek@redhat.com> - 1.8.23-1
+- update to 1.8.23
+
 * Wed Apr 18 2018 Daniel Kopecek <dkopecek@redhat.com> - 1.8.23-0.1.b3
 - update to 1.8.23b3
 

From 126b2225b3ad239a20c4a65b104493253ec0d09f Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Tue, 3 Jul 2018 16:12:49 -0400
Subject: [PATCH 130/199] defattr no longer needed
 https://fedoraproject.org/wiki/Packaging:Guidelines#File_Permissions

---
 sudo.spec | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index fe6c25b..000a261 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,7 +3,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.23
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -151,7 +151,6 @@ EOF
 
 
 %files -f sudo_all.lang
-%defattr(-,root,root)
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %attr(0750,root,root) %dir /etc/sudoers.d/
 %config(noreplace) /etc/pam.d/sudo
@@ -195,12 +194,14 @@ EOF
 /bin/chmod 0440 /etc/sudoers || :
 
 %files devel
-%defattr(-,root,root,-)
 %doc plugins/sample/sample_plugin.c
 %{_includedir}/sudo_plugin.h
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Tue Jul 03 2018 Matthew Miller <mattdm@fedoraproject.org> - 1.8.23-2
+- remove defattr, as default is now sane
+
 * Wed May 09 2018 Daniel Kopecek <dkopecek@redhat.com> - 1.8.23-1
 - update to 1.8.23
 

From 5d1426712a2adc8b3330e84f21bc3a3a72c902ce Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 14 Jul 2018 06:51:35 +0000
Subject: [PATCH 131/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 000a261..434b5be 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,7 +3,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.23
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -199,6 +199,9 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.23-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
 * Tue Jul 03 2018 Matthew Miller <mattdm@fedoraproject.org> - 1.8.23-2
 - remove defattr, as default is now sane
 

From 4f41fcf52f2c0fc1485d4b6d7e5ef4f476824a6a Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 10 Sep 2018 13:08:04 +0200
Subject: [PATCH 132/199] Rebase sudo to latest stable version

- install /etc/dnf/protected.d/sudo instead of /etc/yum/protected.d/sudo (1626968)
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 14 +++++++++-----
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index aeb7960..f0d2b79 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,4 @@
 /sudo-1.8.22b1.tar.gz
 /sudo-1.8.23b3.tar.gz
 /sudo-1.8.23.tar.gz
+/sudo-1.8.25.tar.gz
diff --git a/sources b/sources
index 1aac8dc..aa1032a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.23.tar.gz) = a9d61850a4857bfd075547a13efb13b054e4736e3ebe3c8a98a90a090b1d9b9688354ec9725fc99d1d256999b6f9c6ae6215ce9770fcdebd7f24731107b48342
+SHA512 (sudo-1.8.25.tar.gz) = f3f0c9e315484e5ba2d535f41ab722881343b1fa299f75cfad456bd41a555d80080369677e62626307df792aeabc29ba450e6f0b9c284ea2cfb8dc5e3568f46d
diff --git a/sudo.spec b/sudo.spec
index 434b5be..566efd7 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -2,8 +2,8 @@
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.23
-Release: 3%{?dist}
+Version: 1.8.25
+Release: 1%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -103,10 +103,10 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
 #add sudo to protected packages
-install -p -d -m 755 $RPM_BUILD_ROOT/etc/yum/protected.d/
+install -p -d -m 755 $RPM_BUILD_ROOT/etc/dnf/protected.d/
 touch sudo.conf
 echo sudo > sudo.conf
-install -p -c -m 0644 sudo.conf $RPM_BUILD_ROOT/etc/yum/protected.d/
+install -p -c -m 0644 sudo.conf $RPM_BUILD_ROOT/etc/dnf/protected.d/
 rm -f sudo.conf
 
 chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%files
@@ -156,7 +156,7 @@ EOF
 %config(noreplace) /etc/pam.d/sudo
 %config(noreplace) /etc/pam.d/sudo-i
 %attr(0644,root,root) %{_tmpfilesdir}/sudo.conf
-%attr(0644,root,root) /etc/yum/protected.d/sudo.conf
+%attr(0644,root,root) /etc/dnf/protected.d/sudo.conf
 %dir /var/db/sudo
 %dir /var/db/sudo/lectured
 %attr(4111,root,root) %{_bindir}/sudo
@@ -199,6 +199,10 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Mon Sep 10 2018 Radovan Sroka <rsroka@redhat.com> 1.8.25-1
+- rebase sudo to latest stawble version
+- install /etc/dnf/protected.d/sudo instead of /etc/yum/protected.d/sudo (1626968)
+
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.23-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 

From 44df529c9604cace879b3ec84f32ac4c3caea652 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 1 Oct 2018 12:55:58 +0200
Subject: [PATCH 133/199] Rebase sudo to 1.8.25p1

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 5 ++++-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index f0d2b79..5199bbf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@
 /sudo-1.8.23b3.tar.gz
 /sudo-1.8.23.tar.gz
 /sudo-1.8.25.tar.gz
+/sudo-1.8.25p1.tar.gz
diff --git a/sources b/sources
index aa1032a..4a345d9 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.25.tar.gz) = f3f0c9e315484e5ba2d535f41ab722881343b1fa299f75cfad456bd41a555d80080369677e62626307df792aeabc29ba450e6f0b9c284ea2cfb8dc5e3568f46d
+SHA512 (sudo-1.8.25p1.tar.gz) = b1445be688d3c1dd7efbdfab68977a7a9b6fd6887191dc99ca717117eec0a550492642556cd55ca5873d054ddc5ccc2b87b2c34602e1ffc729ab6fbc4e523a72
diff --git a/sudo.spec b/sudo.spec
index 566efd7..5baa011 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -2,7 +2,7 @@
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.25
+Version: 1.8.25p1
 Release: 1%{?dist}
 License: ISC
 Group: Applications/System
@@ -199,6 +199,9 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Mon Oct 01 2018 Radovan Sroka <rsroka@redhat.com> 1.8.25p1-1
+- rebase sudo to 1.8.25p1
+
 * Mon Sep 10 2018 Radovan Sroka <rsroka@redhat.com> 1.8.25-1
 - rebase sudo to latest stawble version
 - install /etc/dnf/protected.d/sudo instead of /etc/yum/protected.d/sudo (1626968)

From 977357a694bb88b27d185f5ddfd1765188c164f3 Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Mon, 28 Jan 2019 20:18:26 +0100
Subject: [PATCH 134/199] Remove obsolete Group tag

References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag
---
 sudo.spec | 2 --
 1 file changed, 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 5baa011..8992984 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -5,7 +5,6 @@ Name: sudo
 Version: 1.8.25p1
 Release: 1%{?dist}
 License: ISC
-Group: Applications/System
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
@@ -42,7 +41,6 @@ on many different machines.
 
 %package        devel
 Summary:        Development files for %{name}
-Group:          Development/Libraries
 Requires:       %{name} = %{version}-%{release}
 
 %description    devel

From 9bdb7bba3be1f42d2488e3f7aa1b0a6c37fb9936 Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Tue, 29 Jan 2019 05:36:33 +0100
Subject: [PATCH 135/199] Remove obsolete BuildRoot tag

Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
---
 sudo.spec | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 8992984..70d6ff1 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -8,7 +8,6 @@ License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
-Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: pam
 Recommends: vim-minimal
 Requires(post): coreutils

From bd4c63f292a8a8849a839f93aa6e9b362e63ea6f Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sun, 3 Feb 2019 08:47:43 +0000
Subject: [PATCH 136/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 70d6ff1..cc9a70a 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,7 +3,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.25p1
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
@@ -196,6 +196,9 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.25p1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
 * Mon Oct 01 2018 Radovan Sroka <rsroka@redhat.com> 1.8.25p1-1
 - rebase sudo to 1.8.25p1
 

From 906c92082e96954c7c06becd9e5f2dcf0d9a797a Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 11 Mar 2019 12:32:44 +0100
Subject: [PATCH 137/199] Rebase sudo to 1.8.27

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 7 +++++--
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 5199bbf..96963ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,4 @@
 /sudo-1.8.23.tar.gz
 /sudo-1.8.25.tar.gz
 /sudo-1.8.25p1.tar.gz
+/sudo-1.8.27.tar.gz
diff --git a/sources b/sources
index 4a345d9..c04905d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.25p1.tar.gz) = b1445be688d3c1dd7efbdfab68977a7a9b6fd6887191dc99ca717117eec0a550492642556cd55ca5873d054ddc5ccc2b87b2c34602e1ffc729ab6fbc4e523a72
+SHA512 (sudo-1.8.27.tar.gz) = 0480def650ab880ab9e6c51c606a06897fd638f0381e99c038f5aa47d064aaa2fb35b73eee7f86e73185e18d5dbb8b6ba49c616b1785a1edb2dd6d7b2fa4fcac
diff --git a/sudo.spec b/sudo.spec
index cc9a70a..f7c56fc 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -2,8 +2,8 @@
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.25p1
-Release: 2%{?dist}
+Version: 1.8.27
+Release: 1%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
@@ -196,6 +196,9 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Mon Mar 11 2019 Radovan Sroka <rsroka@redhat.com> 1.8.27-1
+- rebase sudo to 1.8.27
+
 * Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.25p1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 

From 5ee35457d5f1286465c683f6fd8c6e15c18c41e9 Mon Sep 17 00:00:00 2001
From: Marek Tamaskovic <mtamasko@redhat.com>
Date: Sun, 31 Mar 2019 11:53:51 +0200
Subject: [PATCH 138/199] Edit sudoers resolves rhbz#1676925

---
 sudo.spec | 6 +++++-
 sudoers   | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index f7c56fc..19e1e61 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,7 +3,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.27
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
@@ -196,6 +196,10 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sun Mar 31 2019 Marek Tamaskovic <mtamasko@redhat.com> 1.8.27-2
+- resolves rhbz#1676925
+- Removed PS1, PS2 from sudoers 
+
 * Mon Mar 11 2019 Radovan Sroka <rsroka@redhat.com> 1.8.27-1
 - rebase sudo to 1.8.27
 
diff --git a/sudoers b/sudoers
index 17afb17..9d57af5 100644
--- a/sudoers
+++ b/sudoers
@@ -56,7 +56,7 @@ Defaults   !visiblepw
 
 Defaults    env_reset
 Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
-Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
+Defaults    env_keep += "MAIL QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
 Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
 Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
 Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

From 14fb2d74323e2b35d0d6f4a6511eb873550af4d6 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 27 Jul 2019 00:22:59 +0000
Subject: [PATCH 139/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 19e1e61..2970bf7 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,7 +3,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.27
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
@@ -196,6 +196,9 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.27-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
 * Sun Mar 31 2019 Marek Tamaskovic <mtamasko@redhat.com> 1.8.27-2
 - resolves rhbz#1676925
 - Removed PS1, PS2 from sudoers 

From 4e850fe0545246403704ad94fe3968cfed0aa487 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Tue, 15 Oct 2019 13:55:07 +0200
Subject: [PATCH 140/199] Rebase to 1.8.28

  Resolves: rhbz#1761533

- set always_set_home by default
  Resolves: rhbz#1728687

- Sync sudoers options from rhel8 to fedora
  Resolves: rhbz#1761781

- CVE-2019-14287
  Resolves: rhbz#1761584
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 16 ++++++++++++----
 sudoers    | 28 ++++++++++++++++++++++++++--
 4 files changed, 40 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index 96963ea..7cafc1c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,4 @@
 /sudo-1.8.25.tar.gz
 /sudo-1.8.25p1.tar.gz
 /sudo-1.8.27.tar.gz
+/sudo-1.8.28.tar.gz
diff --git a/sources b/sources
index c04905d..68032d5 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.27.tar.gz) = 0480def650ab880ab9e6c51c606a06897fd638f0381e99c038f5aa47d064aaa2fb35b73eee7f86e73185e18d5dbb8b6ba49c616b1785a1edb2dd6d7b2fa4fcac
+SHA512 (sudo-1.8.28.tar.gz) = 09e589cdfd18d7c43b0859a0e11c008b3cb995ae4f8c89c717c5242db9e5696361eb574ebe74a0b5316afffb3a8037f7a7f3c249176e8ed9caffeb4cd860ddc7
diff --git a/sudo.spec b/sudo.spec
index 4a1682a..f8b8822 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,9 +1,7 @@
-%global user            millert
-
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.27
-Release: 3%{?dist}
+Version: 1.8.28
+Release: 1%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
@@ -191,6 +189,16 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Tue Oct 15 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.28-1
+- rebase to 1.8.28
+Resolves: rhbz#1761533
+- set always_set_home by default
+Resolves: rhbz#1728687
+- Sync sudoers options from rhel8 to fedora
+Resolves: rhbz#1761781
+- CVE-2019-14287
+Resolves: rhbz#1761584
+
 * Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.27-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 
diff --git a/sudoers b/sudoers
index 9d57af5..e68d56c 100644
--- a/sudoers
+++ b/sudoers
@@ -30,7 +30,7 @@
 # Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
 
 ## Services
-# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
+# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable
 
 ## Updating the locate database
 # Cmnd_Alias LOCATE = /usr/bin/updatedb
@@ -54,13 +54,37 @@
 #
 Defaults   !visiblepw
 
+#
+# Preserving HOME has security implications since many programs
+# use it when searching for configuration files. Note that HOME
+# is already set when the the env_reset option is enabled, so
+# this option is only effective for configurations where either
+# env_reset is disabled or HOME is present in the env_keep list.
+#
+Defaults    always_set_home
+Defaults    match_group_by_gid
+
+# Prior to version 1.8.15, groups listed in sudoers that were not
+# found in the system group database were passed to the group
+# plugin, if any. Starting with 1.8.15, only groups of the form
+# %:group are resolved via the group plugin by default.
+# We enable always_query_group_plugin to restore old behavior.
+# Disable this option for new behavior.
+Defaults    always_query_group_plugin
+
 Defaults    env_reset
 Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
-Defaults    env_keep += "MAIL QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
+Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
 Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
 Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
 Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
 
+#
+# Adding HOME to env_keep may enable a user to run unrestricted
+# commands via sudo.
+#
+# Defaults   env_keep += "HOME"
+
 Defaults    secure_path = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 ## Next comes the main part: which users can run what software on 

From cd84c5542cc481dd382f50720572fd350462c0e1 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Tue, 15 Oct 2019 14:05:33 +0200
Subject: [PATCH 141/199] Remove PS1 and PS2 from env_keep

This was removed with in rhel8 -> fedora sync
---
 sudoers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudoers b/sudoers
index e68d56c..29775ad 100644
--- a/sudoers
+++ b/sudoers
@@ -74,7 +74,7 @@ Defaults    always_query_group_plugin
 
 Defaults    env_reset
 Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
-Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
+Defaults    env_keep += "MAIL QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
 Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
 Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
 Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

From aebc79494c9dc133d0f7c64173330ec5f9bcff4e Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Tue, 22 Oct 2019 14:18:07 +0200
Subject: [PATCH 142/199] Rebase to 1.8.28p1

  Resolves: rhbz#176235
---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 6 +++++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 7cafc1c..990cfee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,4 @@
 /sudo-1.8.25p1.tar.gz
 /sudo-1.8.27.tar.gz
 /sudo-1.8.28.tar.gz
+/sudo-1.8.28p1.tar.gz
diff --git a/sources b/sources
index 68032d5..e2745d3 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.28.tar.gz) = 09e589cdfd18d7c43b0859a0e11c008b3cb995ae4f8c89c717c5242db9e5696361eb574ebe74a0b5316afffb3a8037f7a7f3c249176e8ed9caffeb4cd860ddc7
+SHA512 (sudo-1.8.28p1.tar.gz) = bda3de34c15fbb68fc29759542295560ccc1562b419d03709cea51613937e9b92ba689c79c3ef4858aeea90d3d1a4dc0148225b11b22cf82395ae1bad8cb1734
diff --git a/sudo.spec b/sudo.spec
index f8b8822..5069365 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.28
+Version: 1.8.28p1
 Release: 1%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
@@ -189,6 +189,10 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Tue Oct 22 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
+- rebase to 1.8.28p1
+Resolves: rhbz#1762350
+
 * Tue Oct 15 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.28-1
 - rebase to 1.8.28
 Resolves: rhbz#1761533

From 514d3fed7f0bb14fda33f27452187846e8f13993 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 11 Nov 2019 15:57:10 +0100
Subject: [PATCH 143/199] Rebase to 1.8.29

Resolves: rhbz#1766233
---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 6 +++++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 990cfee..cac4495 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,4 @@
 /sudo-1.8.27.tar.gz
 /sudo-1.8.28.tar.gz
 /sudo-1.8.28p1.tar.gz
+/sudo-1.8.29.tar.gz
diff --git a/sources b/sources
index e2745d3..d6aec86 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.28p1.tar.gz) = bda3de34c15fbb68fc29759542295560ccc1562b419d03709cea51613937e9b92ba689c79c3ef4858aeea90d3d1a4dc0148225b11b22cf82395ae1bad8cb1734
+SHA512 (sudo-1.8.29.tar.gz) = ea780922b2afb47df4df4b533fb355fd916cb18a6bfd13c7ca36a25b03ef585d805648c6fa85692bea363b1f83664ac3bc622f99bcd149b3a86f70522eb4d340
diff --git a/sudo.spec b/sudo.spec
index 5069365..c264151 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.28p1
+Version: 1.8.29
 Release: 1%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
@@ -189,6 +189,10 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Mon Nov 11 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.29-1
+- rebase to 1.8.29
+Resolves: rhbz#1766233
+
 * Tue Oct 22 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
 - rebase to 1.8.28p1
 Resolves: rhbz#1762350

From 709fe6b2d887ef4d00f101b75bfe11d317d6eb52 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 31 Jan 2020 00:29:35 +0000
Subject: [PATCH 144/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index c264151..f929cc0 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.8.29
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
@@ -189,6 +189,9 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.29-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
 * Mon Nov 11 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.29-1
 - rebase to 1.8.29
 Resolves: rhbz#1766233

From 19b1d360de3b019307554190e9b54824b6818a00 Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Tue, 3 Mar 2020 12:48:10 +0100
Subject: [PATCH 145/199] Update to latest development version 1.9.0b1

---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 32 ++++++++++++++++++++++++++++----
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index cac4495..0afd98f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,4 @@
 /sudo-1.8.28.tar.gz
 /sudo-1.8.28p1.tar.gz
 /sudo-1.8.29.tar.gz
+/sudo-1.9.0b1.tar.gz
diff --git a/sources b/sources
index d6aec86..0811552 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.8.29.tar.gz) = ea780922b2afb47df4df4b533fb355fd916cb18a6bfd13c7ca36a25b03ef585d805648c6fa85692bea363b1f83664ac3bc622f99bcd149b3a86f70522eb4d340
+SHA512 (sudo-1.9.0b1.tar.gz) = 7459d398514b54c6898a3eaebca141f39af661cda51c007e068bea1cc1860df1bc66ea13c752da8f6bf3d574ba92e337874b20279e1400cfea99982a469f5435
diff --git a/sudo.spec b/sudo.spec
index f929cc0..149038d 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,10 +1,10 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.8.29
-Release: 2%{?dist}
+Version: 1.9.0
+Release: 0.1.b1%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
+Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b1.tar.gz
 Source1: sudoers
 Requires: pam
 Recommends: vim-minimal
@@ -45,7 +45,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q
+%setup -q -n sudo-1.9.0b1
 
 %patch1 -p1 -b .strip
 
@@ -152,6 +152,7 @@ EOF
 %config(noreplace) /etc/pam.d/sudo-i
 %attr(0644,root,root) %{_tmpfilesdir}/sudo.conf
 %attr(0644,root,root) /etc/dnf/protected.d/sudo.conf
+%attr(0644,root,root) /etc/sudo.conf
 %dir /var/db/sudo
 %dir /var/db/sudo/lectured
 %attr(4111,root,root) %{_bindir}/sudo
@@ -160,6 +161,8 @@ EOF
 %attr(0755,root,root) %{_sbindir}/visudo
 %{_bindir}/cvtsudoers
 %dir %{_libexecdir}/sudo
+%attr(0755,root,root) %{_sbindir}/sudo_logsrvd
+%attr(0755,root,root) %{_sbindir}/sudo_sendlog
 %attr(0755,root,root) %{_libexecdir}/sudo/sesh
 %attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
@@ -177,6 +180,11 @@ EOF
 %{_mandir}/man8/visudo.8*
 %{_mandir}/man1/cvtsudoers.1.gz
 %{_mandir}/man5/sudoers_timestamp.5.gz
+%{_mandir}/man5/sudo_logsrv.proto.5.gz
+%{_mandir}/man5/sudo_logsrvd.conf.5.gz
+%{_mandir}/man8/sudo_logsrvd.8.gz
+%{_mandir}/man8/sudo_plugin_python.8.gz
+%{_mandir}/man8/sudo_sendlog.8.gz
 %dir %{_pkgdocdir}/
 %{_pkgdocdir}/*
 %{!?_licensedir:%global license %%doc}
@@ -189,6 +197,22 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Mon Feb 24 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b1
+- update to latest development version 1.9.0b1
+- added sudo_logsrvd and sudo_sendlog to files and their appropriate man pages
+Resolves: rhbz#1787823
+- Stack based buffer overflow in when pwfeedback is enabled
+Resolves: rhbz#1796945
+- fixes: CVE-2019-18634 
+- By using ! character in the shadow file instead of a password hash can access to a run as all sudoer account
+Resolves: rhbz#1786709
+- fixes CVE-2019-19234
+- attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user
+Resolves: rhbz#1786705
+- fixes CVE-2019-19232
+- setrlimit(RLIMIT_CORE): Operation not permitted warning message fix
+Resolves: rhbz#1773148
+
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.29-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 

From 94269e7c2044623024151e5ca41dfdb6cc35233f Mon Sep 17 00:00:00 2001
From: Jens Petersen <petersen@redhat.com>
Date: Tue, 24 Mar 2020 17:24:41 +0800
Subject: [PATCH 146/199] update to 1.9.0b4

---
 sudo.spec | 49 ++++++++++++++++++++++++++++---------------------
 1 file changed, 28 insertions(+), 21 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 149038d..b55d7a7 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,14 +1,16 @@
+%global patchlevel b4
+%global upstream_version %{version}%{patchlevel}
+
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.0
-Release: 0.1.b1%{?dist}
+Release: 0.1.%{patchlevel}%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b1.tar.gz
+Source0: https://www.sudo.ws/dist/beta/%{name}-%{upstream_version}.tar.gz
 Source1: sudoers
 Requires: pam
 Recommends: vim-minimal
-Requires(post): coreutils
 
 BuildRequires: pam-devel
 BuildRequires: groff
@@ -45,7 +47,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q -n sudo-1.9.0b1
+%setup -q -n %{name}-%{upstream_version}
 
 %patch1 -p1 -b .strip
 
@@ -92,7 +94,7 @@ make check
 rm -rf $RPM_BUILD_ROOT
 make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
 
-chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* 
+chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/*
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
@@ -166,7 +168,9 @@ EOF
 %attr(0755,root,root) %{_libexecdir}/sudo/sesh
 %attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
+%attr(0644,root,root) %{_libexecdir}/sudo/audit_json.so
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
+%attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
 %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
 %{_libexecdir}/sudo/libsudo_util.so.?
@@ -197,13 +201,17 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Tue Mar 24 2020 Jens Petersen <petersen@redhat.com> - 1.9.0-0.1.b4
+- update to 1.9.0 beta4
+- https://www.sudo.ws/pipermail/sudo-workers/2020-March/001279.html
+
 * Mon Feb 24 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b1
 - update to latest development version 1.9.0b1
 - added sudo_logsrvd and sudo_sendlog to files and their appropriate man pages
 Resolves: rhbz#1787823
 - Stack based buffer overflow in when pwfeedback is enabled
 Resolves: rhbz#1796945
-- fixes: CVE-2019-18634 
+- fixes: CVE-2019-18634
 - By using ! character in the shadow file instead of a password hash can access to a run as all sudoer account
 Resolves: rhbz#1786709
 - fixes CVE-2019-19234
@@ -239,7 +247,7 @@ Resolves: rhbz#1761584
 
 * Sun Mar 31 2019 Marek Tamaskovic <mtamasko@redhat.com> 1.8.27-2
 - resolves rhbz#1676925
-- Removed PS1, PS2 from sudoers 
+- Removed PS1, PS2 from sudoers
 
 * Mon Mar 11 2019 Radovan Sroka <rsroka@redhat.com> 1.8.27-1
 - rebase sudo to 1.8.27
@@ -275,7 +283,7 @@ Resolves: rhbz#1761584
 
 * Thu Sep 21 2017 Marek Tamaskovic <mtamasko@redhat.com> - 1.8.21p2-1
 - update to 1.8.21p2
-- Moved libsudo_util.so from the -devel sub-package to main package (1481225) 
+- Moved libsudo_util.so from the -devel sub-package to main package (1481225)
 
 * Wed Sep 06 2017 Matthew Miller <mattdm@fedoraproject.org> - 1.8.20p2-4
 - replace file-based requirements with package-level ones:
@@ -364,7 +372,7 @@ Resolves: rhbz#1761584
 
 * Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-2
 - add patch that resolves initialization problem before sudo_strsplit call
-- add patch that resolves deadcode in visudo.c 
+- add patch that resolves deadcode in visudo.c
 - add patch that removes extra while in visudo.c and sudoers.c
 
 * Mon Jul 27 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-1
@@ -400,9 +408,9 @@ Resolves: rhbz#1761584
 - major changes & fixes:
   - when running a command in the background, sudo will now forward
     SIGINFO to the command
-  - the passwords in ldap.conf and ldap.secret may now be encoded in base64. 
+  - the passwords in ldap.conf and ldap.secret may now be encoded in base64.
   - SELinux role changes are now audited. For sudoedit, we now audit
-    the actual editor being run, instead of just the sudoedit command. 
+    the actual editor being run, instead of just the sudoedit command.
   - it is now possible to match an environment variable's value as well as
     its name using env_keep and env_check
   - new files created via sudoedit as a non-root user now have the proper group id
@@ -502,7 +510,7 @@ Resolves: rhbz#1761584
 * Thu May 17 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-1
 - update to 1.8.5
 - fixed CVE-2012-2337
-- temporarily disabled SSSD support 
+- temporarily disabled SSSD support
 
 * Wed Feb 29 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-6
 - fixed problems with undefined symbols (rhbz#798517)
@@ -521,7 +529,7 @@ Resolves: rhbz#1761584
 
 * Thu Nov 10 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-1
 - update to 1.8.3p1
-- disable output word wrapping if the output is piped 
+- disable output word wrapping if the output is piped
 
 * Wed Sep  7 2011 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.1p2-2
 - Remove execute bit from sample script in docs so we don't pull in perl
@@ -656,7 +664,7 @@ Resolves: rhbz#1761584
 - sparc64 needs to be in the -fPIE list with s390
 
 * Mon Jan 07 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-5
-- fix complains about audit_log_user_command(): Connection 
+- fix complains about audit_log_user_command(): Connection
   refused (#401201)
 
 * Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-4
@@ -758,7 +766,7 @@ Resolves: rhbz#1761584
 - rebuild
 
 * Mon Oct  4 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-30.1
-- added missing BuildRequires for libselinux-devel (#132883) 
+- added missing BuildRequires for libselinux-devel (#132883)
 
 * Wed Sep 29 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-30
 - Fix missing param error in sesh
@@ -785,7 +793,7 @@ Resolves: rhbz#1761584
   exec of child with SELinux patch
 
 * Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-23
-- change to default to sysadm_r 
+- change to default to sysadm_r
 - Fix tty handling
 
 * Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-22
@@ -793,7 +801,7 @@ Resolves: rhbz#1761584
 - replace /bin/bash -c with /bin/sesh
 
 * Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-21
-- Hard code to use "/bin/bash -c" for selinux 
+- Hard code to use "/bin/bash -c" for selinux
 
 * Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-20
 - Eliminate closing and reopening of terminals, to match su.
@@ -818,7 +826,7 @@ Resolves: rhbz#1761584
 - Fix is_selinux_enabled call
 
 * Tue Jan 13 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-13
-- Clean up patch on failure 
+- Clean up patch on failure
 
 * Tue Jan 6 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-12
 - Remove sudo.te for now.
@@ -941,7 +949,7 @@ Resolves: rhbz#1761584
 - fixed so it doesn't find /usr/bin/vi first, but instead /bin/vi (always installed)
 
 * Thu Oct 08 1998 Michael Maher <mike@redhat.com>
-- built package for 5.2 
+- built package for 5.2
 
 * Mon May 18 1998 Michael Maher <mike@redhat.com>
 - updated SPEC file
@@ -953,10 +961,9 @@ Resolves: rhbz#1761584
 - built for glibc, no problems
 
 * Fri Apr 25 1997 Michael Fulbright <msf@redhat.com>
-- Fixed for 4.2 PowerTools 
+- Fixed for 4.2 PowerTools
 - Still need to be pamified
 - Still need to move stmp file to /var/log
 
 * Mon Feb 17 1997 Michael Fulbright <msf@redhat.com>
 - First version for PowerCD.
-

From bb269d08fa5b3d7d47e25cf5fd706d5ca7a6685d Mon Sep 17 00:00:00 2001
From: alakatos <alakatos@redhat.com>
Date: Wed, 25 Mar 2020 16:10:12 +0100
Subject: [PATCH 147/199] Revert "update to 1.9.0b4"

This reverts commit 94269e7c2044623024151e5ca41dfdb6cc35233f.
---
 sudo.spec | 49 +++++++++++++++++++++----------------------------
 1 file changed, 21 insertions(+), 28 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index b55d7a7..149038d 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,16 +1,14 @@
-%global patchlevel b4
-%global upstream_version %{version}%{patchlevel}
-
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.0
-Release: 0.1.%{patchlevel}%{?dist}
+Release: 0.1.b1%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/beta/%{name}-%{upstream_version}.tar.gz
+Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b1.tar.gz
 Source1: sudoers
 Requires: pam
 Recommends: vim-minimal
+Requires(post): coreutils
 
 BuildRequires: pam-devel
 BuildRequires: groff
@@ -47,7 +45,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q -n %{name}-%{upstream_version}
+%setup -q -n sudo-1.9.0b1
 
 %patch1 -p1 -b .strip
 
@@ -94,7 +92,7 @@ make check
 rm -rf $RPM_BUILD_ROOT
 make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
 
-chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/*
+chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* 
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
@@ -168,9 +166,7 @@ EOF
 %attr(0755,root,root) %{_libexecdir}/sudo/sesh
 %attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
-%attr(0644,root,root) %{_libexecdir}/sudo/audit_json.so
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
-%attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
 %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
 %{_libexecdir}/sudo/libsudo_util.so.?
@@ -201,17 +197,13 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
-* Tue Mar 24 2020 Jens Petersen <petersen@redhat.com> - 1.9.0-0.1.b4
-- update to 1.9.0 beta4
-- https://www.sudo.ws/pipermail/sudo-workers/2020-March/001279.html
-
 * Mon Feb 24 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b1
 - update to latest development version 1.9.0b1
 - added sudo_logsrvd and sudo_sendlog to files and their appropriate man pages
 Resolves: rhbz#1787823
 - Stack based buffer overflow in when pwfeedback is enabled
 Resolves: rhbz#1796945
-- fixes: CVE-2019-18634
+- fixes: CVE-2019-18634 
 - By using ! character in the shadow file instead of a password hash can access to a run as all sudoer account
 Resolves: rhbz#1786709
 - fixes CVE-2019-19234
@@ -247,7 +239,7 @@ Resolves: rhbz#1761584
 
 * Sun Mar 31 2019 Marek Tamaskovic <mtamasko@redhat.com> 1.8.27-2
 - resolves rhbz#1676925
-- Removed PS1, PS2 from sudoers
+- Removed PS1, PS2 from sudoers 
 
 * Mon Mar 11 2019 Radovan Sroka <rsroka@redhat.com> 1.8.27-1
 - rebase sudo to 1.8.27
@@ -283,7 +275,7 @@ Resolves: rhbz#1761584
 
 * Thu Sep 21 2017 Marek Tamaskovic <mtamasko@redhat.com> - 1.8.21p2-1
 - update to 1.8.21p2
-- Moved libsudo_util.so from the -devel sub-package to main package (1481225)
+- Moved libsudo_util.so from the -devel sub-package to main package (1481225) 
 
 * Wed Sep 06 2017 Matthew Miller <mattdm@fedoraproject.org> - 1.8.20p2-4
 - replace file-based requirements with package-level ones:
@@ -372,7 +364,7 @@ Resolves: rhbz#1761584
 
 * Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-2
 - add patch that resolves initialization problem before sudo_strsplit call
-- add patch that resolves deadcode in visudo.c
+- add patch that resolves deadcode in visudo.c 
 - add patch that removes extra while in visudo.c and sudoers.c
 
 * Mon Jul 27 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-1
@@ -408,9 +400,9 @@ Resolves: rhbz#1761584
 - major changes & fixes:
   - when running a command in the background, sudo will now forward
     SIGINFO to the command
-  - the passwords in ldap.conf and ldap.secret may now be encoded in base64.
+  - the passwords in ldap.conf and ldap.secret may now be encoded in base64. 
   - SELinux role changes are now audited. For sudoedit, we now audit
-    the actual editor being run, instead of just the sudoedit command.
+    the actual editor being run, instead of just the sudoedit command. 
   - it is now possible to match an environment variable's value as well as
     its name using env_keep and env_check
   - new files created via sudoedit as a non-root user now have the proper group id
@@ -510,7 +502,7 @@ Resolves: rhbz#1761584
 * Thu May 17 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-1
 - update to 1.8.5
 - fixed CVE-2012-2337
-- temporarily disabled SSSD support
+- temporarily disabled SSSD support 
 
 * Wed Feb 29 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-6
 - fixed problems with undefined symbols (rhbz#798517)
@@ -529,7 +521,7 @@ Resolves: rhbz#1761584
 
 * Thu Nov 10 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-1
 - update to 1.8.3p1
-- disable output word wrapping if the output is piped
+- disable output word wrapping if the output is piped 
 
 * Wed Sep  7 2011 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.1p2-2
 - Remove execute bit from sample script in docs so we don't pull in perl
@@ -664,7 +656,7 @@ Resolves: rhbz#1761584
 - sparc64 needs to be in the -fPIE list with s390
 
 * Mon Jan 07 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-5
-- fix complains about audit_log_user_command(): Connection
+- fix complains about audit_log_user_command(): Connection 
   refused (#401201)
 
 * Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-4
@@ -766,7 +758,7 @@ Resolves: rhbz#1761584
 - rebuild
 
 * Mon Oct  4 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-30.1
-- added missing BuildRequires for libselinux-devel (#132883)
+- added missing BuildRequires for libselinux-devel (#132883) 
 
 * Wed Sep 29 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-30
 - Fix missing param error in sesh
@@ -793,7 +785,7 @@ Resolves: rhbz#1761584
   exec of child with SELinux patch
 
 * Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-23
-- change to default to sysadm_r
+- change to default to sysadm_r 
 - Fix tty handling
 
 * Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-22
@@ -801,7 +793,7 @@ Resolves: rhbz#1761584
 - replace /bin/bash -c with /bin/sesh
 
 * Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-21
-- Hard code to use "/bin/bash -c" for selinux
+- Hard code to use "/bin/bash -c" for selinux 
 
 * Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-20
 - Eliminate closing and reopening of terminals, to match su.
@@ -826,7 +818,7 @@ Resolves: rhbz#1761584
 - Fix is_selinux_enabled call
 
 * Tue Jan 13 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-13
-- Clean up patch on failure
+- Clean up patch on failure 
 
 * Tue Jan 6 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-12
 - Remove sudo.te for now.
@@ -949,7 +941,7 @@ Resolves: rhbz#1761584
 - fixed so it doesn't find /usr/bin/vi first, but instead /bin/vi (always installed)
 
 * Thu Oct 08 1998 Michael Maher <mike@redhat.com>
-- built package for 5.2
+- built package for 5.2 
 
 * Mon May 18 1998 Michael Maher <mike@redhat.com>
 - updated SPEC file
@@ -961,9 +953,10 @@ Resolves: rhbz#1761584
 - built for glibc, no problems
 
 * Fri Apr 25 1997 Michael Fulbright <msf@redhat.com>
-- Fixed for 4.2 PowerTools
+- Fixed for 4.2 PowerTools 
 - Still need to be pamified
 - Still need to move stmp file to /var/log
 
 * Mon Feb 17 1997 Michael Fulbright <msf@redhat.com>
 - First version for PowerCD.
+

From 8fc22fffbc522c3baf214250a8814a9c28513e56 Mon Sep 17 00:00:00 2001
From: alakatos <alakatos@redhat.com>
Date: Wed, 25 Mar 2020 16:47:47 +0100
Subject: [PATCH 148/199] Update to latest development version 1.9.0b4

Resolves: rhbz#1816593
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 15 ++++++++++++---
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 0afd98f..4aa0b81 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,4 @@
 /sudo-1.8.28p1.tar.gz
 /sudo-1.8.29.tar.gz
 /sudo-1.9.0b1.tar.gz
+/sudo-1.9.0b4.tar.gz
diff --git a/sources b/sources
index 0811552..e6aeaa0 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.0b1.tar.gz) = 7459d398514b54c6898a3eaebca141f39af661cda51c007e068bea1cc1860df1bc66ea13c752da8f6bf3d574ba92e337874b20279e1400cfea99982a469f5435
+SHA512 (sudo-1.9.0b4.tar.gz) = 8f9da58ebb53d751746e8b271d9089a98cbbeb6e82691c3905c5ac11255bc70c7f467c0097d8dab2980fd94ffb8c438d03326f1bc98f0b580ec6e5b06227f559
diff --git a/sudo.spec b/sudo.spec
index 149038d..34f0d33 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,10 +1,13 @@
+%global patchlevel b4
+%global upstream_version %{version}%{patchlevel}
+
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.0
-Release: 0.1.b1%{?dist}
+Release: 0.1.%{patchlevel}%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/beta/%{name}-%{version}b1.tar.gz
+Source0: https://www.sudo.ws/dist/beta/%{name}-%{upstream_version}.tar.gz
 Source1: sudoers
 Requires: pam
 Recommends: vim-minimal
@@ -45,7 +48,7 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q -n sudo-1.9.0b1
+%setup -q -n %{name}-%{upstream_version}
 
 %patch1 -p1 -b .strip
 
@@ -166,7 +169,9 @@ EOF
 %attr(0755,root,root) %{_libexecdir}/sudo/sesh
 %attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
+%attr(0644,root,root) %{_libexecdir}/sudo/audit_json.so
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
+%attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
 %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
 %{_libexecdir}/sudo/libsudo_util.so.?
@@ -197,6 +202,10 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Wed Mar 25 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b4
+- update to latest development version 1.9.0b4
+Resolves: rhbz#1816593
+
 * Mon Feb 24 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b1
 - update to latest development version 1.9.0b1
 - added sudo_logsrvd and sudo_sendlog to files and their appropriate man pages

From 5d1ef1f39f1a21269e9f81cb0f143afb10b0fb6a Mon Sep 17 00:00:00 2001
From: Jens Petersen <petersen@redhat.com>
Date: Thu, 26 Mar 2020 18:53:05 +0800
Subject: [PATCH 149/199] remove trailing whitespaces

---
 sudo.spec | 33 ++++++++++++++++-----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 34f0d33..613bf89 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -95,7 +95,7 @@ make check
 rm -rf $RPM_BUILD_ROOT
 make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
 
-chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* 
+chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/*
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
@@ -212,7 +212,7 @@ Resolves: rhbz#1816593
 Resolves: rhbz#1787823
 - Stack based buffer overflow in when pwfeedback is enabled
 Resolves: rhbz#1796945
-- fixes: CVE-2019-18634 
+- fixes: CVE-2019-18634
 - By using ! character in the shadow file instead of a password hash can access to a run as all sudoer account
 Resolves: rhbz#1786709
 - fixes CVE-2019-19234
@@ -248,7 +248,7 @@ Resolves: rhbz#1761584
 
 * Sun Mar 31 2019 Marek Tamaskovic <mtamasko@redhat.com> 1.8.27-2
 - resolves rhbz#1676925
-- Removed PS1, PS2 from sudoers 
+- Removed PS1, PS2 from sudoers
 
 * Mon Mar 11 2019 Radovan Sroka <rsroka@redhat.com> 1.8.27-1
 - rebase sudo to 1.8.27
@@ -284,7 +284,7 @@ Resolves: rhbz#1761584
 
 * Thu Sep 21 2017 Marek Tamaskovic <mtamasko@redhat.com> - 1.8.21p2-1
 - update to 1.8.21p2
-- Moved libsudo_util.so from the -devel sub-package to main package (1481225) 
+- Moved libsudo_util.so from the -devel sub-package to main package (1481225)
 
 * Wed Sep 06 2017 Matthew Miller <mattdm@fedoraproject.org> - 1.8.20p2-4
 - replace file-based requirements with package-level ones:
@@ -373,7 +373,7 @@ Resolves: rhbz#1761584
 
 * Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-2
 - add patch that resolves initialization problem before sudo_strsplit call
-- add patch that resolves deadcode in visudo.c 
+- add patch that resolves deadcode in visudo.c
 - add patch that removes extra while in visudo.c and sudoers.c
 
 * Mon Jul 27 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-1
@@ -409,9 +409,9 @@ Resolves: rhbz#1761584
 - major changes & fixes:
   - when running a command in the background, sudo will now forward
     SIGINFO to the command
-  - the passwords in ldap.conf and ldap.secret may now be encoded in base64. 
+  - the passwords in ldap.conf and ldap.secret may now be encoded in base64.
   - SELinux role changes are now audited. For sudoedit, we now audit
-    the actual editor being run, instead of just the sudoedit command. 
+    the actual editor being run, instead of just the sudoedit command.
   - it is now possible to match an environment variable's value as well as
     its name using env_keep and env_check
   - new files created via sudoedit as a non-root user now have the proper group id
@@ -511,7 +511,7 @@ Resolves: rhbz#1761584
 * Thu May 17 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-1
 - update to 1.8.5
 - fixed CVE-2012-2337
-- temporarily disabled SSSD support 
+- temporarily disabled SSSD support
 
 * Wed Feb 29 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-6
 - fixed problems with undefined symbols (rhbz#798517)
@@ -530,7 +530,7 @@ Resolves: rhbz#1761584
 
 * Thu Nov 10 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-1
 - update to 1.8.3p1
-- disable output word wrapping if the output is piped 
+- disable output word wrapping if the output is piped
 
 * Wed Sep  7 2011 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.1p2-2
 - Remove execute bit from sample script in docs so we don't pull in perl
@@ -665,7 +665,7 @@ Resolves: rhbz#1761584
 - sparc64 needs to be in the -fPIE list with s390
 
 * Mon Jan 07 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-5
-- fix complains about audit_log_user_command(): Connection 
+- fix complains about audit_log_user_command(): Connection
   refused (#401201)
 
 * Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-4
@@ -767,7 +767,7 @@ Resolves: rhbz#1761584
 - rebuild
 
 * Mon Oct  4 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-30.1
-- added missing BuildRequires for libselinux-devel (#132883) 
+- added missing BuildRequires for libselinux-devel (#132883)
 
 * Wed Sep 29 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-30
 - Fix missing param error in sesh
@@ -794,7 +794,7 @@ Resolves: rhbz#1761584
   exec of child with SELinux patch
 
 * Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-23
-- change to default to sysadm_r 
+- change to default to sysadm_r
 - Fix tty handling
 
 * Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-22
@@ -802,7 +802,7 @@ Resolves: rhbz#1761584
 - replace /bin/bash -c with /bin/sesh
 
 * Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-21
-- Hard code to use "/bin/bash -c" for selinux 
+- Hard code to use "/bin/bash -c" for selinux
 
 * Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-20
 - Eliminate closing and reopening of terminals, to match su.
@@ -827,7 +827,7 @@ Resolves: rhbz#1761584
 - Fix is_selinux_enabled call
 
 * Tue Jan 13 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-13
-- Clean up patch on failure 
+- Clean up patch on failure
 
 * Tue Jan 6 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-12
 - Remove sudo.te for now.
@@ -950,7 +950,7 @@ Resolves: rhbz#1761584
 - fixed so it doesn't find /usr/bin/vi first, but instead /bin/vi (always installed)
 
 * Thu Oct 08 1998 Michael Maher <mike@redhat.com>
-- built package for 5.2 
+- built package for 5.2
 
 * Mon May 18 1998 Michael Maher <mike@redhat.com>
 - updated SPEC file
@@ -962,10 +962,9 @@ Resolves: rhbz#1761584
 - built for glibc, no problems
 
 * Fri Apr 25 1997 Michael Fulbright <msf@redhat.com>
-- Fixed for 4.2 PowerTools 
+- Fixed for 4.2 PowerTools
 - Still need to be pamified
 - Still need to move stmp file to /var/log
 
 * Mon Feb 17 1997 Michael Fulbright <msf@redhat.com>
 - First version for PowerCD.
-

From 72a557140c58070edcc5a7382baa7758d98f3c94 Mon Sep 17 00:00:00 2001
From: Jens Petersen <petersen@redhat.com>
Date: Thu, 26 Mar 2020 18:53:44 +0800
Subject: [PATCH 150/199] upstream patch for setrlimit(RLIMIT_CORE) rootless
 container warnings (#1773148)

---
 sudo-1.9-RLIMIT_CORE.patch | 149 +++++++++++++++++++++++++++++++++++++
 sudo.spec                  |   7 +-
 2 files changed, 154 insertions(+), 2 deletions(-)
 create mode 100644 sudo-1.9-RLIMIT_CORE.patch

diff --git a/sudo-1.9-RLIMIT_CORE.patch b/sudo-1.9-RLIMIT_CORE.patch
new file mode 100644
index 0000000..28027c4
--- /dev/null
+++ b/sudo-1.9-RLIMIT_CORE.patch
@@ -0,0 +1,149 @@
+ changeset 12288:1064b906ca68
+
+Ignore a failure to restore the RLIMIT_CORE resource limit.
+Linux containers don't allow RLIMIT_CORE to be set back to RLIM_INFINITY
+if we set the limit to zero, even for root.  This is not a problem
+outside the container.
+author 	Todd C. Miller <Todd.Miller@sudo.ws>
+date 	Sat, 14 Mar 2020 11:13:55 -0600
+parents 	72ca06a294b4
+children 	40629e6fd692
+files 	src/limits.c
+diffstat 	1 files changed, 61 insertions(+), 10 deletions(-) [+]
+line wrap: on
+ line diff
+
+--- a/src/limits.c	Thu Mar 12 17:39:56 2020 -0600
++++ b/src/limits.c	Sat Mar 14 11:13:55 2020 -0600
+@@ -114,13 +114,21 @@
+
+     if (getrlimit(RLIMIT_CORE, &corelimit) == -1)
+ 	sudo_warn("getrlimit(RLIMIT_CORE)");
++    sudo_debug_printf(SUDO_DEBUG_INFO, "RLIMIT_CORE [%lld, %lld] -> [0, 0]",
++	(long long)corelimit.rlim_cur, (long long)corelimit.rlim_max);
+     if (setrlimit(RLIMIT_CORE, &rl) == -1)
+ 	sudo_warn("setrlimit(RLIMIT_CORE)");
+ #ifdef __linux__
+     /* On Linux, also set PR_SET_DUMPABLE to zero (reset by execve). */
+-    if ((dumpflag = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) == -1)
++    if ((dumpflag = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) == -1) {
++	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
++	    "prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)");
+ 	dumpflag = 0;
+-    (void) prctl(PR_SET_DUMPABLE, 0, 0, 0, 0);
++    }
++    if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) == -1) {
++	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
++	    "prctl(PR_SET_DUMPABLE, %d, 0, 0, 0)", dumpflag);
++    }
+ #endif /* __linux__ */
+     coredump_disabled = true;
+
+@@ -136,10 +144,20 @@
+     debug_decl(restore_coredump, SUDO_DEBUG_UTIL);
+
+     if (coredump_disabled) {
+-	if (setrlimit(RLIMIT_CORE, &corelimit) == -1)
+-	    sudo_warn("setrlimit(RLIMIT_CORE)");
++	/*
++	 * Linux containers don't allow RLIMIT_CORE to be set back to
++	 * RLIM_INFINITY if we set the limit to zero, even for root.
++	 */
++	if (setrlimit(RLIMIT_CORE, &corelimit) == -1) {
++	    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
++		"setrlimit(RLIMIT_CORE, [%lld, %lld])",
++		(long long)corelimit.rlim_cur, (long long)corelimit.rlim_max);
++	}
+ #ifdef __linux__
+-	(void) prctl(PR_SET_DUMPABLE, dumpflag, 0, 0, 0);
++	if (prctl(PR_SET_DUMPABLE, dumpflag, 0, 0, 0) == -1) {
++	    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
++		"prctl(PR_SET_DUMPABLE, %d, 0, 0, 0)", dumpflag);
++	}
+ #endif /* __linux__ */
+     }
+     debug_return;
+@@ -162,8 +180,14 @@
+
+     if (getrlimit(RLIMIT_NPROC, &nproclimit) != 0)
+ 	sudo_warn("getrlimit(RLIMIT_NPROC)");
++    sudo_debug_printf(SUDO_DEBUG_INFO, "RLIMIT_NPROC [%lld, %lld] -> [inf, inf]",
++	(long long)nproclimit.rlim_cur, (long long)nproclimit.rlim_max);
+     if (setrlimit(RLIMIT_NPROC, &rl) == -1) {
+ 	rl.rlim_cur = rl.rlim_max = nproclimit.rlim_max;
++	sudo_debug_printf(SUDO_DEBUG_INFO,
++	    "RLIMIT_NPROC [%lld, %lld] -> [%lld, %lld]",
++	    (long long)nproclimit.rlim_cur, (long long)nproclimit.rlim_max,
++	    (long long)rl.rlim_cur, (long long)rl.rlim_max);
+ 	if (setrlimit(RLIMIT_NPROC, &rl) != 0)
+ 	    sudo_warn("setrlimit(RLIMIT_NPROC)");
+     }
+@@ -180,8 +204,11 @@
+ #ifdef __linux__
+     debug_decl(restore_nproc, SUDO_DEBUG_UTIL);
+
+-    if (setrlimit(RLIMIT_NPROC, &nproclimit) != 0)
+-	sudo_warn("setrlimit(RLIMIT_NPROC)");
++    if (setrlimit(RLIMIT_NPROC, &nproclimit) != 0) {
++	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
++	    "setrlimit(RLIMIT_NPROC, [%lld, %lld])",
++	    (long long)nproclimit.rlim_cur, (long long)nproclimit.rlim_max);
++    }
+
+     debug_return;
+ #endif /* __linux__ */
+@@ -203,6 +230,11 @@
+ 	struct saved_limit *lim = &saved_limits[idx];
+ 	if (getrlimit(lim->resource, &lim->oldlimit) == -1)
+ 	    continue;
++	sudo_debug_printf(SUDO_DEBUG_INFO,
++	    "getrlimit(lim->name) -> [%lld, %lld]",
++	    (long long)lim->oldlimit.rlim_cur,
++	    (long long)lim->oldlimit.rlim_max);
++
+ 	lim->saved = true;
+ 	if (lim->newlimit.rlim_cur != RLIM_INFINITY) {
+ 	    /* Don't reduce the soft resource limit. */
+@@ -217,13 +249,28 @@
+ 		lim->newlimit.rlim_max = lim->oldlimit.rlim_max;
+ 	}
+ 	if ((rc = setrlimit(lim->resource, &lim->newlimit)) == -1) {
+-	    if (lim->fallback != NULL)
+-		rc = setrlimit(lim->resource, lim->fallback);
++	    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
++		"setrlimit(%s, [%lld, %lld])", lim->name,
++		(long long)lim->newlimit.rlim_cur,
++		(long long)lim->newlimit.rlim_max);
++	    if (lim->fallback != NULL) {
++		if ((rc = setrlimit(lim->resource, lim->fallback)) == -1) {
++		    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
++			"setrlimit(%s, [%lld, %lld])", lim->name,
++			(long long)lim->fallback->rlim_cur,
++			(long long)lim->fallback->rlim_max);
++		}
++	    }
+ 	    if (rc == -1) {
+ 		/* Try setting new rlim_cur to old rlim_max. */
+ 		lim->newlimit.rlim_cur = lim->oldlimit.rlim_max;
+ 		lim->newlimit.rlim_max = lim->oldlimit.rlim_max;
+-		rc = setrlimit(lim->resource, &lim->newlimit);
++		if ((rc = setrlimit(lim->resource, &lim->newlimit)) == -1) {
++		    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
++			"setrlimit(%s, [%lld, %lld])", lim->name,
++			(long long)lim->newlimit.rlim_cur,
++			(long long)lim->newlimit.rlim_max);
++		}
+ 	    }
+ 	    if (rc == -1)
+ 		sudo_warn("setrlimit(%s)", lim->name);
+@@ -254,6 +301,10 @@
+ 		if (rc != -1 || errno != EINVAL)
+ 		    break;
+
++		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
++		    "setrlimit(%s, [%lld, %lld])", lim->name,
++		    (long long)rl.rlim_cur, (long long)rl.rlim_max);
++
+ 		/*
+ 		 * Soft limit could be lower than current resource usage.
+ 		 * This can be an issue on NetBSD with RLIMIT_STACK and ASLR.
diff --git a/sudo.spec b/sudo.spec
index 613bf89..bac08cd 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -27,6 +27,8 @@ BuildRequires: zlib-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
+# https://www.sudo.ws/repos/sudo/rev/1064b906ca68
+Patch2: sudo-1.9-RLIMIT_CORE.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -51,6 +53,7 @@ plugins that use %{name}.
 %setup -q -n %{name}-%{upstream_version}
 
 %patch1 -p1 -b .strip
+%patch2 -p1 -b .orig
 
 %build
 # Remove bundled copy of zlib
@@ -205,6 +208,8 @@ EOF
 * Wed Mar 25 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b4
 - update to latest development version 1.9.0b4
 Resolves: rhbz#1816593
+- setrlimit(RLIMIT_CORE): Operation not permitted warning message fix
+Resolves: rhbz#1773148
 
 * Mon Feb 24 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b1
 - update to latest development version 1.9.0b1
@@ -219,8 +224,6 @@ Resolves: rhbz#1786709
 - attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user
 Resolves: rhbz#1786705
 - fixes CVE-2019-19232
-- setrlimit(RLIMIT_CORE): Operation not permitted warning message fix
-Resolves: rhbz#1773148
 
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.29-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

From 306df891f5c3e911a02ad4d8d11e4e524f807efc Mon Sep 17 00:00:00 2001
From: alakatos <alakatos@redhat.com>
Date: Fri, 10 Jul 2020 09:44:22 +0200
Subject: [PATCH 151/199] Rebase to 1.9.1 Resolves: rhbz#1848788 - fix rpmlint
 warnings Resolves: rhbz#1817139

---
 .gitignore                 |   1 +
 sources                    |   2 +-
 sudo-1.9-RLIMIT_CORE.patch | 149 -------------------------------------
 sudo.rpmlintrc             |  16 ++++
 sudo.spec                  |  26 ++++---
 5 files changed, 32 insertions(+), 162 deletions(-)
 delete mode 100644 sudo-1.9-RLIMIT_CORE.patch
 create mode 100644 sudo.rpmlintrc

diff --git a/.gitignore b/.gitignore
index 4aa0b81..e7db9cd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,4 @@
 /sudo-1.8.29.tar.gz
 /sudo-1.9.0b1.tar.gz
 /sudo-1.9.0b4.tar.gz
+/sudo-1.9.1.tar.gz
diff --git a/sources b/sources
index e6aeaa0..35fc51b 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.0b4.tar.gz) = 8f9da58ebb53d751746e8b271d9089a98cbbeb6e82691c3905c5ac11255bc70c7f467c0097d8dab2980fd94ffb8c438d03326f1bc98f0b580ec6e5b06227f559
+SHA512 (sudo-1.9.1.tar.gz) = 7994c7d8f020188eda51787bb5f6fe7668518cc89b711e7840470db7e5bac1219490ffccc73854fecb14ceb3ffaf0fc605f3438c87b83f27921ea3626365105c
diff --git a/sudo-1.9-RLIMIT_CORE.patch b/sudo-1.9-RLIMIT_CORE.patch
deleted file mode 100644
index 28027c4..0000000
--- a/sudo-1.9-RLIMIT_CORE.patch
+++ /dev/null
@@ -1,149 +0,0 @@
- changeset 12288:1064b906ca68
-
-Ignore a failure to restore the RLIMIT_CORE resource limit.
-Linux containers don't allow RLIMIT_CORE to be set back to RLIM_INFINITY
-if we set the limit to zero, even for root.  This is not a problem
-outside the container.
-author 	Todd C. Miller <Todd.Miller@sudo.ws>
-date 	Sat, 14 Mar 2020 11:13:55 -0600
-parents 	72ca06a294b4
-children 	40629e6fd692
-files 	src/limits.c
-diffstat 	1 files changed, 61 insertions(+), 10 deletions(-) [+]
-line wrap: on
- line diff
-
---- a/src/limits.c	Thu Mar 12 17:39:56 2020 -0600
-+++ b/src/limits.c	Sat Mar 14 11:13:55 2020 -0600
-@@ -114,13 +114,21 @@
-
-     if (getrlimit(RLIMIT_CORE, &corelimit) == -1)
- 	sudo_warn("getrlimit(RLIMIT_CORE)");
-+    sudo_debug_printf(SUDO_DEBUG_INFO, "RLIMIT_CORE [%lld, %lld] -> [0, 0]",
-+	(long long)corelimit.rlim_cur, (long long)corelimit.rlim_max);
-     if (setrlimit(RLIMIT_CORE, &rl) == -1)
- 	sudo_warn("setrlimit(RLIMIT_CORE)");
- #ifdef __linux__
-     /* On Linux, also set PR_SET_DUMPABLE to zero (reset by execve). */
--    if ((dumpflag = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) == -1)
-+    if ((dumpflag = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) == -1) {
-+	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
-+	    "prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)");
- 	dumpflag = 0;
--    (void) prctl(PR_SET_DUMPABLE, 0, 0, 0, 0);
-+    }
-+    if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) == -1) {
-+	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
-+	    "prctl(PR_SET_DUMPABLE, %d, 0, 0, 0)", dumpflag);
-+    }
- #endif /* __linux__ */
-     coredump_disabled = true;
-
-@@ -136,10 +144,20 @@
-     debug_decl(restore_coredump, SUDO_DEBUG_UTIL);
-
-     if (coredump_disabled) {
--	if (setrlimit(RLIMIT_CORE, &corelimit) == -1)
--	    sudo_warn("setrlimit(RLIMIT_CORE)");
-+	/*
-+	 * Linux containers don't allow RLIMIT_CORE to be set back to
-+	 * RLIM_INFINITY if we set the limit to zero, even for root.
-+	 */
-+	if (setrlimit(RLIMIT_CORE, &corelimit) == -1) {
-+	    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
-+		"setrlimit(RLIMIT_CORE, [%lld, %lld])",
-+		(long long)corelimit.rlim_cur, (long long)corelimit.rlim_max);
-+	}
- #ifdef __linux__
--	(void) prctl(PR_SET_DUMPABLE, dumpflag, 0, 0, 0);
-+	if (prctl(PR_SET_DUMPABLE, dumpflag, 0, 0, 0) == -1) {
-+	    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
-+		"prctl(PR_SET_DUMPABLE, %d, 0, 0, 0)", dumpflag);
-+	}
- #endif /* __linux__ */
-     }
-     debug_return;
-@@ -162,8 +180,14 @@
-
-     if (getrlimit(RLIMIT_NPROC, &nproclimit) != 0)
- 	sudo_warn("getrlimit(RLIMIT_NPROC)");
-+    sudo_debug_printf(SUDO_DEBUG_INFO, "RLIMIT_NPROC [%lld, %lld] -> [inf, inf]",
-+	(long long)nproclimit.rlim_cur, (long long)nproclimit.rlim_max);
-     if (setrlimit(RLIMIT_NPROC, &rl) == -1) {
- 	rl.rlim_cur = rl.rlim_max = nproclimit.rlim_max;
-+	sudo_debug_printf(SUDO_DEBUG_INFO,
-+	    "RLIMIT_NPROC [%lld, %lld] -> [%lld, %lld]",
-+	    (long long)nproclimit.rlim_cur, (long long)nproclimit.rlim_max,
-+	    (long long)rl.rlim_cur, (long long)rl.rlim_max);
- 	if (setrlimit(RLIMIT_NPROC, &rl) != 0)
- 	    sudo_warn("setrlimit(RLIMIT_NPROC)");
-     }
-@@ -180,8 +204,11 @@
- #ifdef __linux__
-     debug_decl(restore_nproc, SUDO_DEBUG_UTIL);
-
--    if (setrlimit(RLIMIT_NPROC, &nproclimit) != 0)
--	sudo_warn("setrlimit(RLIMIT_NPROC)");
-+    if (setrlimit(RLIMIT_NPROC, &nproclimit) != 0) {
-+	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
-+	    "setrlimit(RLIMIT_NPROC, [%lld, %lld])",
-+	    (long long)nproclimit.rlim_cur, (long long)nproclimit.rlim_max);
-+    }
-
-     debug_return;
- #endif /* __linux__ */
-@@ -203,6 +230,11 @@
- 	struct saved_limit *lim = &saved_limits[idx];
- 	if (getrlimit(lim->resource, &lim->oldlimit) == -1)
- 	    continue;
-+	sudo_debug_printf(SUDO_DEBUG_INFO,
-+	    "getrlimit(lim->name) -> [%lld, %lld]",
-+	    (long long)lim->oldlimit.rlim_cur,
-+	    (long long)lim->oldlimit.rlim_max);
-+
- 	lim->saved = true;
- 	if (lim->newlimit.rlim_cur != RLIM_INFINITY) {
- 	    /* Don't reduce the soft resource limit. */
-@@ -217,13 +249,28 @@
- 		lim->newlimit.rlim_max = lim->oldlimit.rlim_max;
- 	}
- 	if ((rc = setrlimit(lim->resource, &lim->newlimit)) == -1) {
--	    if (lim->fallback != NULL)
--		rc = setrlimit(lim->resource, lim->fallback);
-+	    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
-+		"setrlimit(%s, [%lld, %lld])", lim->name,
-+		(long long)lim->newlimit.rlim_cur,
-+		(long long)lim->newlimit.rlim_max);
-+	    if (lim->fallback != NULL) {
-+		if ((rc = setrlimit(lim->resource, lim->fallback)) == -1) {
-+		    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
-+			"setrlimit(%s, [%lld, %lld])", lim->name,
-+			(long long)lim->fallback->rlim_cur,
-+			(long long)lim->fallback->rlim_max);
-+		}
-+	    }
- 	    if (rc == -1) {
- 		/* Try setting new rlim_cur to old rlim_max. */
- 		lim->newlimit.rlim_cur = lim->oldlimit.rlim_max;
- 		lim->newlimit.rlim_max = lim->oldlimit.rlim_max;
--		rc = setrlimit(lim->resource, &lim->newlimit);
-+		if ((rc = setrlimit(lim->resource, &lim->newlimit)) == -1) {
-+		    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
-+			"setrlimit(%s, [%lld, %lld])", lim->name,
-+			(long long)lim->newlimit.rlim_cur,
-+			(long long)lim->newlimit.rlim_max);
-+		}
- 	    }
- 	    if (rc == -1)
- 		sudo_warn("setrlimit(%s)", lim->name);
-@@ -254,6 +301,10 @@
- 		if (rc != -1 || errno != EINVAL)
- 		    break;
-
-+		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
-+		    "setrlimit(%s, [%lld, %lld])", lim->name,
-+		    (long long)rl.rlim_cur, (long long)rl.rlim_max);
-+
- 		/*
- 		 * Soft limit could be lower than current resource usage.
- 		 * This can be an issue on NetBSD with RLIMIT_STACK and ASLR.
diff --git a/sudo.rpmlintrc b/sudo.rpmlintrc
new file mode 100644
index 0000000..d7c57d7
--- /dev/null
+++ b/sudo.rpmlintrc
@@ -0,0 +1,16 @@
+# Sudo allows restricted root access for specified users. In other words,
+# it is a special package, which requires special permissions on on some
+# of the installed files.
+addFilter("missing-call-to-setgroups-before-setuid (/usr/bin/sudo|/usr/bin/sudoreplay|/usr/sbin/sudo_logsrvd|/usr/sbin/sudo_sendlog|/usr/libexec/sudo/sudoers.so|)$")
+
+addFilter("non-readable (/etc/sudo.conf|/etc/sudo_logsrvd.conf|/etc/sudoers|/usr/bin/sudoreplay) .*$")
+
+addFilter("non-standard-dir-perm (/etc/sudoers.d|/var/db/sudo|/var/db/sudo/lectured) .*$")
+
+addFilter("setuid-binary /usr/bin/sudo .*$")
+
+addFilter("non-standard-executable-perm (/usr/bin/sudo|/usr/bin/sudoreplay) .*$")
+
+addFilter("wrong-file-end-of-line-encoding /usr/share/doc/sudo/schema.ActiveDirectory$")
+
+addFilter("non-standard-dir-in-var db$")
diff --git a/sudo.spec b/sudo.spec
index bac08cd..af5f14d 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,13 +1,10 @@
-%global patchlevel b4
-%global upstream_version %{version}%{patchlevel}
-
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.0
-Release: 0.1.%{patchlevel}%{?dist}
+Version: 1.9.1
+Release: 1%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/beta/%{name}-%{upstream_version}.tar.gz
+Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
 Requires: pam
 Recommends: vim-minimal
@@ -27,8 +24,6 @@ BuildRequires: zlib-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
-# https://www.sudo.ws/repos/sudo/rev/1064b906ca68
-Patch2: sudo-1.9-RLIMIT_CORE.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -50,10 +45,9 @@ The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
 %prep
-%setup -q -n %{name}-%{upstream_version}
+%setup -q
 
 %patch1 -p1 -b .strip
-%patch2 -p1 -b .orig
 
 %build
 # Remove bundled copy of zlib
@@ -152,13 +146,15 @@ EOF
 
 
 %files -f sudo_all.lang
+%defattr(-,root,root)
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %attr(0750,root,root) %dir /etc/sudoers.d/
 %config(noreplace) /etc/pam.d/sudo
 %config(noreplace) /etc/pam.d/sudo-i
 %attr(0644,root,root) %{_tmpfilesdir}/sudo.conf
-%attr(0644,root,root) /etc/dnf/protected.d/sudo.conf
-%attr(0644,root,root) /etc/sudo.conf
+%attr(0644,root,root) %config(noreplace) /etc/dnf/protected.d/sudo.conf
+%attr(0640,root,root) %config(noreplace) /etc/sudo.conf
+%attr(0640,root,root) %config(noreplace) /etc/sudo_logsrvd.conf
 %dir /var/db/sudo
 %dir /var/db/sudo/lectured
 %attr(4111,root,root) %{_bindir}/sudo
@@ -205,6 +201,12 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Wed Jul 08 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.1-1
+- rebase to 1.9.1
+Resolves: rhbz#1848788
+- fix rpmlint errors
+Resolves: rhbz#1817139
+
 * Wed Mar 25 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b4
 - update to latest development version 1.9.0b4
 Resolves: rhbz#1816593

From c5932df566ecf6acb9f85b8d71964ee41f7c2937 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 29 Jul 2020 11:37:20 +0000
Subject: [PATCH 152/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index af5f14d..560e0ef 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
@@ -201,6 +201,9 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
 * Wed Jul 08 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.1-1
 - rebase to 1.9.1
 Resolves: rhbz#1848788

From 845456e9a79f728323f9f6d8927c5ac7f1481ed4 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 1 Aug 2020 09:14:45 +0000
Subject: [PATCH 153/199] - Second attempt - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 sudo.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 560e0ef..7381722 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.1
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
@@ -201,6 +201,10 @@ EOF
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.1-3
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
 * Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 

From 35c555c44a10f64ddf2ce568ccbe4e219034d893 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Tue, 15 Sep 2020 16:49:29 +0200
Subject: [PATCH 154/199] Rebase to 1.9.2

Resolves: rhbz#1859577

- added logsrvd subpackage
- added openssl-devel buildrequires
Resolves: rhbz#1860653
- fixed sudo runstatedir path
- it was generated as /sudo instead of /run/sudo
Resolves: rhbz#1868215
- added /var/lib/snapd/snap/bin to secure_path variable
Resolves: rhbz#1691996

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 .gitignore                  |  1 +
 configure-runstatedir.patch | 43 ++++++++++++++++++++++++++++++++++
 sources                     |  2 +-
 sudo.spec                   | 46 +++++++++++++++++++++++++++++--------
 sudoers                     |  2 +-
 5 files changed, 83 insertions(+), 11 deletions(-)
 create mode 100644 configure-runstatedir.patch

diff --git a/.gitignore b/.gitignore
index e7db9cd..4c5f1eb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,4 @@
 /sudo-1.9.0b1.tar.gz
 /sudo-1.9.0b4.tar.gz
 /sudo-1.9.1.tar.gz
+/sudo-1.9.2.tar.gz
diff --git a/configure-runstatedir.patch b/configure-runstatedir.patch
new file mode 100644
index 0000000..980e767
--- /dev/null
+++ b/configure-runstatedir.patch
@@ -0,0 +1,43 @@
+From 0d7a041f18c5016abb78b74f3cfa505797e704ee Mon Sep 17 00:00:00 2001
+From: Evan Anderson <evan@eaanderson.com>
+Date: Sun, 6 Sep 2020 14:30:54 -0500
+Subject: [PATCH] configure: Fix runstatedir handling for distros that do not
+ support it
+
+runstatedir was added in yet-to-be released autoconf 2.70. Some distros
+are shipping this addition in their autoconf packages, but others, such as Fedora,
+are not. This causes the rundir variable to be set incorrectly if the configure script
+is regenerated with an unpatched autoconf since the runstatedir variable set is deleted
+after regeneration. This change works around that problem by checking that runstatedir
+is non-empty before potentially using it to set the rundir variable
+---
+ configure  | 2 +-
+ m4/sudo.m4 | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/configure b/configure
+index 0f6ceb16c..2e0838e01 100755
+--- a/configure
++++ b/configure
+@@ -26718,7 +26718,7 @@ EOF
+ $as_echo_n "checking for sudo run dir location... " >&6; }
+ if test -n "$with_rundir"; then
+     rundir="$with_rundir"
+-elif test "$runstatedir" != '${localstatedir}/run'; then
++elif test -n "$runstatedir" && test "$runstatedir" != '${localstatedir}/run'; then
+     rundir="$runstatedir/sudo"
+ else
+     # No --with-rundir or --runstatedir specified
+diff --git a/m4/sudo.m4 b/m4/sudo.m4
+index a5a972b3c..b3a40b208 100644
+--- a/m4/sudo.m4
++++ b/m4/sudo.m4
+@@ -120,7 +120,7 @@ dnl
+ AC_DEFUN([SUDO_RUNDIR], [AC_MSG_CHECKING(for sudo run dir location)
+ if test -n "$with_rundir"; then
+     rundir="$with_rundir"
+-elif test "$runstatedir" != '${localstatedir}/run'; then
++elif test -n "$runstatedir" && test "$runstatedir" != '${localstatedir}/run'; then
+     rundir="$runstatedir/sudo"
+ else
+     # No --with-rundir or --runstatedir specified
diff --git a/sources b/sources
index 35fc51b..5185f4c 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.1.tar.gz) = 7994c7d8f020188eda51787bb5f6fe7668518cc89b711e7840470db7e5bac1219490ffccc73854fecb14ceb3ffaf0fc605f3438c87b83f27921ea3626365105c
+SHA512 (sudo-1.9.2.tar.gz) = 20afdf2604b1c93395157382b24f225cd1ff88d3a892362e2d69fecd240c4e7171f05032c08be1778cd1dea6e460025e4241f57272fac0ea3550e220b6d73d21
diff --git a/sudo.spec b/sudo.spec
index 7381722..050f34a 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.1
-Release: 3%{?dist}
+Version: 1.9.2
+Release: 1%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
 Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
@@ -24,6 +24,7 @@ BuildRequires: zlib-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
+Patch2: configure-runstatedir.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -44,10 +45,22 @@ Requires:       %{name} = %{version}-%{release}
 The %{name}-devel package contains header files developing sudo
 plugins that use %{name}.
 
+
+%package        logsrvd
+Summary:        High-performance log server for %{name}
+Requires:       %{name} = %{version}-%{release}
+BuildRequires:  openssl-devel
+
+
+%description    logsrvd
+%{name}-logsrvd is a high-performance log server that accepts event and I/O logs from sudo.
+It can be used to implement centralized logging of sudo logs.
+
 %prep
 %setup -q
 
 %patch1 -p1 -b .strip
+%patch2 -p1 -b .runstatedir
 
 %build
 # Remove bundled copy of zlib
@@ -67,6 +80,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --sbindir=%{_sbindir} \
         --libdir=%{_libdir} \
         --docdir=%{_pkgdocdir} \
+	--enable-openssl \
         --disable-root-mailer \
         --with-logging=syslog \
         --with-logfac=authpriv \
@@ -154,7 +168,6 @@ EOF
 %attr(0644,root,root) %{_tmpfilesdir}/sudo.conf
 %attr(0644,root,root) %config(noreplace) /etc/dnf/protected.d/sudo.conf
 %attr(0640,root,root) %config(noreplace) /etc/sudo.conf
-%attr(0640,root,root) %config(noreplace) /etc/sudo_logsrvd.conf
 %dir /var/db/sudo
 %dir /var/db/sudo/lectured
 %attr(4111,root,root) %{_bindir}/sudo
@@ -163,8 +176,6 @@ EOF
 %attr(0755,root,root) %{_sbindir}/visudo
 %{_bindir}/cvtsudoers
 %dir %{_libexecdir}/sudo
-%attr(0755,root,root) %{_sbindir}/sudo_logsrvd
-%attr(0755,root,root) %{_sbindir}/sudo_sendlog
 %attr(0755,root,root) %{_libexecdir}/sudo/sesh
 %attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
@@ -184,11 +195,7 @@ EOF
 %{_mandir}/man8/visudo.8*
 %{_mandir}/man1/cvtsudoers.1.gz
 %{_mandir}/man5/sudoers_timestamp.5.gz
-%{_mandir}/man5/sudo_logsrv.proto.5.gz
-%{_mandir}/man5/sudo_logsrvd.conf.5.gz
-%{_mandir}/man8/sudo_logsrvd.8.gz
 %{_mandir}/man8/sudo_plugin_python.8.gz
-%{_mandir}/man8/sudo_sendlog.8.gz
 %dir %{_pkgdocdir}/
 %{_pkgdocdir}/*
 %{!?_licensedir:%global license %%doc}
@@ -200,7 +207,28 @@ EOF
 %{_includedir}/sudo_plugin.h
 %{_mandir}/man8/sudo_plugin.8*
 
+%files logsrvd
+%attr(0640,root,root) %config(noreplace) /etc/sudo_logsrvd.conf
+%attr(0755,root,root) %{_sbindir}/sudo_logsrvd
+%attr(0755,root,root) %{_sbindir}/sudo_sendlog
+%{_mandir}/man5/sudo_logsrv.proto.5.gz
+%{_mandir}/man5/sudo_logsrvd.conf.5.gz
+%{_mandir}/man8/sudo_logsrvd.8.gz
+%{_mandir}/man8/sudo_sendlog.8.gz
+
 %changelog
+* Tue Sep 15 2020 Radovan Sroka <rsroka@redhat.com> - 1.9.2-1
+- rebase to 1.9.2
+Resolves: rhbz#1859577
+- added logsrvd subpackage
+- added openssl-devel buildrequires
+Resolves: rhbz#1860653
+- fixed sudo runstatedir path
+- it was generated as /sudo instead of /run/sudo
+Resolves: rhbz#1868215
+- added /var/lib/snapd/snap/bin to secure_path variable
+Resolves: rhbz#1691996
+
 * Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.1-3
 - Second attempt - Rebuilt for
   https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
diff --git a/sudoers b/sudoers
index 29775ad..5f621a8 100644
--- a/sudoers
+++ b/sudoers
@@ -85,7 +85,7 @@ Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY
 #
 # Defaults   env_keep += "HOME"
 
-Defaults    secure_path = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+Defaults    secure_path = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/var/lib/snapd/snap/bin
 
 ## Next comes the main part: which users can run what software on 
 ## which machines (the sudoers file can be shared between multiple

From 68203ed1a2fac7aff1b57189e8c217db89e5fe4a Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 5 Oct 2020 13:34:24 +0200
Subject: [PATCH 155/199] Rebase to 1.9.3p1

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 .gitignore                  |  1 +
 configure-runstatedir.patch | 43 -------------------------------------
 sources                     |  2 +-
 sudo.spec                   | 12 ++++++++---
 4 files changed, 11 insertions(+), 47 deletions(-)
 delete mode 100644 configure-runstatedir.patch

diff --git a/.gitignore b/.gitignore
index 4c5f1eb..cbf6389 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,4 @@
 /sudo-1.9.0b4.tar.gz
 /sudo-1.9.1.tar.gz
 /sudo-1.9.2.tar.gz
+/sudo-1.9.3p1.tar.gz
diff --git a/configure-runstatedir.patch b/configure-runstatedir.patch
deleted file mode 100644
index 980e767..0000000
--- a/configure-runstatedir.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 0d7a041f18c5016abb78b74f3cfa505797e704ee Mon Sep 17 00:00:00 2001
-From: Evan Anderson <evan@eaanderson.com>
-Date: Sun, 6 Sep 2020 14:30:54 -0500
-Subject: [PATCH] configure: Fix runstatedir handling for distros that do not
- support it
-
-runstatedir was added in yet-to-be released autoconf 2.70. Some distros
-are shipping this addition in their autoconf packages, but others, such as Fedora,
-are not. This causes the rundir variable to be set incorrectly if the configure script
-is regenerated with an unpatched autoconf since the runstatedir variable set is deleted
-after regeneration. This change works around that problem by checking that runstatedir
-is non-empty before potentially using it to set the rundir variable
----
- configure  | 2 +-
- m4/sudo.m4 | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/configure b/configure
-index 0f6ceb16c..2e0838e01 100755
---- a/configure
-+++ b/configure
-@@ -26718,7 +26718,7 @@ EOF
- $as_echo_n "checking for sudo run dir location... " >&6; }
- if test -n "$with_rundir"; then
-     rundir="$with_rundir"
--elif test "$runstatedir" != '${localstatedir}/run'; then
-+elif test -n "$runstatedir" && test "$runstatedir" != '${localstatedir}/run'; then
-     rundir="$runstatedir/sudo"
- else
-     # No --with-rundir or --runstatedir specified
-diff --git a/m4/sudo.m4 b/m4/sudo.m4
-index a5a972b3c..b3a40b208 100644
---- a/m4/sudo.m4
-+++ b/m4/sudo.m4
-@@ -120,7 +120,7 @@ dnl
- AC_DEFUN([SUDO_RUNDIR], [AC_MSG_CHECKING(for sudo run dir location)
- if test -n "$with_rundir"; then
-     rundir="$with_rundir"
--elif test "$runstatedir" != '${localstatedir}/run'; then
-+elif test -n "$runstatedir" && test "$runstatedir" != '${localstatedir}/run'; then
-     rundir="$runstatedir/sudo"
- else
-     # No --with-rundir or --runstatedir specified
diff --git a/sources b/sources
index 5185f4c..2a74432 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.2.tar.gz) = 20afdf2604b1c93395157382b24f225cd1ff88d3a892362e2d69fecd240c4e7171f05032c08be1778cd1dea6e460025e4241f57272fac0ea3550e220b6d73d21
+SHA512 (sudo-1.9.3p1.tar.gz) = 3ad13fd03e5b371fd6bf7909731ffc11431d2182a744b654f7e5d4b810e47955d49bc78f551afe13ec56acbce694139c33a15bc022cea41b17af5496b8b7f89f
diff --git a/sudo.spec b/sudo.spec
index 050f34a..0089dfe 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.2
+Version: 1.9.3p1
 Release: 1%{?dist}
 License: ISC
 URL: http://www.courtesan.com/sudo/
@@ -21,10 +21,10 @@ BuildRequires: libselinux-devel
 BuildRequires: sendmail
 BuildRequires: gettext
 BuildRequires: zlib-devel
+BuildRequires: python3-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
-Patch2: configure-runstatedir.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -60,7 +60,6 @@ It can be used to implement centralized logging of sudo logs.
 %setup -q
 
 %patch1 -p1 -b .strip
-%patch2 -p1 -b .runstatedir
 
 %build
 # Remove bundled copy of zlib
@@ -93,6 +92,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --with-ldap \
         --with-selinux \
         --with-passprompt="[sudo] password for %p: " \
+	--enable-python \
         --with-linux-audit \
         --with-sssd
 #       --without-kerb5 \
@@ -181,6 +181,7 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
 %attr(0644,root,root) %{_libexecdir}/sudo/audit_json.so
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
+%attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
 %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
@@ -217,6 +218,11 @@ EOF
 %{_mandir}/man8/sudo_sendlog.8.gz
 
 %changelog
+* Mon Oct 05 2020 Radovan Sroka <rsroka@redhat.com> - 1.9.3p1-1
+- rebase to 1.9.3p1
+- enable python modules
+Resolves: rhbz#1881112
+
 * Tue Sep 15 2020 Radovan Sroka <rsroka@redhat.com> - 1.9.2-1
 - rebase to 1.9.2
 Resolves: rhbz#1859577

From 47a5b50ae2e3559901b5d2068a6e27b9f1219644 Mon Sep 17 00:00:00 2001
From: Michel Alexandre Salim <salimma@fedoraproject.org>
Date: Thu, 3 Dec 2020 16:09:48 -0800
Subject: [PATCH 156/199] Update sudo URL

http://www.courtesan.com/sudo/ redirects to https://www.sudo.ws/sudo/ (which is identical to https://www.sudo.ws).

The latter is also the website referenced in the tarball's README.

Signed-off-by: Michel Alexandre Salim <salimma@fedoraproject.org>
---
 sudo.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 0089dfe..156d1b8 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,8 +3,8 @@ Name: sudo
 Version: 1.9.3p1
 Release: 1%{?dist}
 License: ISC
-URL: http://www.courtesan.com/sudo/
-Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz
+URL: https://www.sudo.ws
+Source0: %{url}/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
 Requires: pam
 Recommends: vim-minimal

From f6041d82cfc1be91f4fb7895b9a1bd4fb649f094 Mon Sep 17 00:00:00 2001
From: Tom Stellard <tstellar@redhat.com>
Date: Fri, 8 Jan 2021 22:03:13 +0000
Subject: [PATCH 157/199] Add BuildRequires: make

https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot
---
 sudo.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sudo.spec b/sudo.spec
index 156d1b8..4fde64f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -10,6 +10,7 @@ Requires: pam
 Recommends: vim-minimal
 Requires(post): coreutils
 
+BuildRequires: make
 BuildRequires: pam-devel
 BuildRequires: groff
 BuildRequires: openldap-devel

From e30e387ccfdc7d03e9dbbff6cbf746352b30d52d Mon Sep 17 00:00:00 2001
From: Jonathan Lebon <jonathan@jlebon.com>
Date: Wed, 13 Jan 2021 13:51:24 -0500
Subject: [PATCH 158/199] Split out -python-plugin subpackage

This will allow environments where Python is not desirable to still make
use of sudo, such as Fedora CoreOS and other variants which value
minimalism.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1909299
---
 sudo.spec | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 4fde64f..78843a0 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,13 +1,14 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.3p1
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
 Requires: pam
 Recommends: vim-minimal
+Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release}
 Requires(post): coreutils
 
 BuildRequires: make
@@ -22,7 +23,6 @@ BuildRequires: libselinux-devel
 BuildRequires: sendmail
 BuildRequires: gettext
 BuildRequires: zlib-devel
-BuildRequires: python3-devel
 
 # don't strip
 Patch1: sudo-1.6.7p5-strip.patch
@@ -57,6 +57,15 @@ BuildRequires:  openssl-devel
 %{name}-logsrvd is a high-performance log server that accepts event and I/O logs from sudo.
 It can be used to implement centralized logging of sudo logs.
 
+%package        python-plugin
+Summary:        Python plugin for %{name}
+Requires:       %{name} = %{version}-%{release}
+BuildRequires:  python3-devel
+
+
+%description    python-plugin
+%{name}-python-plugin allows using sudo plugins written in Python.
+
 %prep
 %setup -q
 
@@ -182,7 +191,6 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
 %attr(0644,root,root) %{_libexecdir}/sudo/audit_json.so
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
-%attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
 %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
@@ -197,7 +205,6 @@ EOF
 %{_mandir}/man8/visudo.8*
 %{_mandir}/man1/cvtsudoers.1.gz
 %{_mandir}/man5/sudoers_timestamp.5.gz
-%{_mandir}/man8/sudo_plugin_python.8.gz
 %dir %{_pkgdocdir}/
 %{_pkgdocdir}/*
 %{!?_licensedir:%global license %%doc}
@@ -218,7 +225,15 @@ EOF
 %{_mandir}/man8/sudo_logsrvd.8.gz
 %{_mandir}/man8/sudo_sendlog.8.gz
 
+%files python-plugin
+%{_mandir}/man8/sudo_plugin_python.8.gz
+%attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
+
 %changelog
+* Wed Jan 13 2021 Jonathan Lebon <jonathan@jlebon.com> - 1.9.3p1-2
+- split out Python modules into separate subpackage
+Resolves: rhbz#1909299
+
 * Mon Oct 05 2020 Radovan Sroka <rsroka@redhat.com> - 1.9.3p1-1
 - rebase to 1.9.3p1
 - enable python modules

From a0dc0e6d59bb356662e4bd11a804d109619a2a45 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 18 Jan 2021 21:07:57 +0100
Subject: [PATCH 159/199] Rebase to 1.9.5p1

Resolves: rhbz#1902758

- fixed double free in sss_to_sudoers
Resolves: rhbz#1885874
- fixed CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
Resolves: rhbz#1915055
- fixed CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
Resolves: rhbz#1915054

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 14 ++++++++++++--
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index cbf6389..9ea49f6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,3 +25,4 @@
 /sudo-1.9.1.tar.gz
 /sudo-1.9.2.tar.gz
 /sudo-1.9.3p1.tar.gz
+/sudo-1.9.5p1.tar.gz
diff --git a/sources b/sources
index 2a74432..9d9c821 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.3p1.tar.gz) = 3ad13fd03e5b371fd6bf7909731ffc11431d2182a744b654f7e5d4b810e47955d49bc78f551afe13ec56acbce694139c33a15bc022cea41b17af5496b8b7f89f
+SHA512 (sudo-1.9.5p1.tar.gz) = 0168f0b61a6c2d2f60a92b5b4d3c3254aed4116decabac3821d9ac2fd7f74bb7b019e35bb8955335315b3b00ddf4e4acd82540df0addc1d9bf4f44b60447a878
diff --git a/sudo.spec b/sudo.spec
index 78843a0..779cfc9 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.3p1
-Release: 2%{?dist}
+Version: 1.9.5p1
+Release: 1%{?dist}
 License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}.tar.gz
@@ -230,6 +230,16 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 
 %changelog
+* Mon Jan 18 2021 Radovan Sroka <rsroka@redhat.com> - 1.9.5p1-1
+- rebase to 1.9.5p1
+Resolves: rhbz#1902758
+- fixed double free in sss_to_sudoers
+Resolves: rhbz#1885874
+- fixed CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
+Resolves: rhbz#1915055
+- fixed CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
+Resolves: rhbz#1915054
+
 * Wed Jan 13 2021 Jonathan Lebon <jonathan@jlebon.com> - 1.9.3p1-2
 - split out Python modules into separate subpackage
 Resolves: rhbz#1909299

From 36f24bedc668548d167e5236825983c1155bdc6a Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Tue, 26 Jan 2021 14:00:13 -0500
Subject: [PATCH 160/199] update to 1.9.5p2 to address bug 1920618 -
 CVE-2021-3156 sudo: Heap buffer overflow in argument parsing

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 6 +++++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9ea49f6..eb540df 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,4 @@
 /sudo-1.9.2.tar.gz
 /sudo-1.9.3p1.tar.gz
 /sudo-1.9.5p1.tar.gz
+/sudo-1.9.5p2.tar.gz
diff --git a/sources b/sources
index 9d9c821..e39bcb4 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.5p1.tar.gz) = 0168f0b61a6c2d2f60a92b5b4d3c3254aed4116decabac3821d9ac2fd7f74bb7b019e35bb8955335315b3b00ddf4e4acd82540df0addc1d9bf4f44b60447a878
+SHA512 (sudo-1.9.5p2.tar.gz) = f0fe914963c31a6f8ab6c86847ff6cdd125bd5a839b27f46dcae03963f4fc413b3d4cca54c1979feb825c8479b44c7df0642c07345c941eecf6f9f1e03ea0e27
diff --git a/sudo.spec b/sudo.spec
index 779cfc9..ed546f3 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.5p1
+Version: 1.9.5p2
 Release: 1%{?dist}
 License: ISC
 URL: https://www.sudo.ws
@@ -230,6 +230,10 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 
 %changelog
+* Tue Jan 26 2021 Matthew Miller <mattdm@fedoraproject.org> - 1.9.5p2-1
+- rebase to 1.9.5p2
+Resolves: 1920618
+
 * Mon Jan 18 2021 Radovan Sroka <rsroka@redhat.com> - 1.9.5p1-1
 - rebase to 1.9.5p1
 Resolves: rhbz#1902758

From 571662fc2efb75cca738d11d48fe95bf6a86a483 Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Tue, 26 Jan 2021 14:52:06 -0500
Subject: [PATCH 161/199] update rhbz entries in changelog

---
 sudo.spec | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index ed546f3..446b638 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -232,7 +232,9 @@ EOF
 %changelog
 * Tue Jan 26 2021 Matthew Miller <mattdm@fedoraproject.org> - 1.9.5p2-1
 - rebase to 1.9.5p2
-Resolves: 1920618
+Resolves: rhbz#1920611
+- fixed CVE-2021-3156 sudo: Heap buffer overflow in argument parsing
+Resolves: rhbz#1920618
 
 * Mon Jan 18 2021 Radovan Sroka <rsroka@redhat.com> - 1.9.5p1-1
 - rebase to 1.9.5p1

From 5590a6628da4a613e991c45f576e95729bd33568 Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Fri, 4 Jun 2021 21:15:47 +0200
Subject: [PATCH 162/199] Rebuilt for Python 3.10

---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 446b638..421a2a8 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.5p2
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}.tar.gz
@@ -230,6 +230,9 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 
 %changelog
+* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 1.9.5p2-2
+- Rebuilt for Python 3.10
+
 * Tue Jan 26 2021 Matthew Miller <mattdm@fedoraproject.org> - 1.9.5p2-1
 - rebase to 1.9.5p2
 Resolves: rhbz#1920611

From e9983f0902856ed85921077d5493e5afa8ce2a20 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 23 Jul 2021 18:25:32 +0000
Subject: [PATCH 163/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 sudo.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 421a2a8..e1e3e6e 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.5p2
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}.tar.gz
@@ -230,6 +230,9 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 
 %changelog
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.5p2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
 * Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 1.9.5p2-2
 - Rebuilt for Python 3.10
 

From d8c0683b917be33ef9d9440b20ef9ba92204f4ff Mon Sep 17 00:00:00 2001
From: Peter Czanik <peter@czanik.hu>
Date: Thu, 5 Aug 2021 08:25:56 +0200
Subject: [PATCH 164/199] - update to 1.9.7p2 - follow up path change in strip
 patch - added --enable-zlib=system configure parameter, so sudo uses system
 zlib,   autoconf is no more needed

Signed-off-by: Peter Czanik <peter@czanik.hu>
---
 sudo-1.6.7p5-strip.patch |  4 ++--
 sudo.spec                | 16 ++++++++++++----
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/sudo-1.6.7p5-strip.patch b/sudo-1.6.7p5-strip.patch
index f9e2faa..f690659 100644
--- a/sudo-1.6.7p5-strip.patch
+++ b/sudo-1.6.7p5-strip.patch
@@ -1,5 +1,5 @@
---- sudo-1.6.7p5/install-sh.strip	2005-07-21 14:28:25.000000000 +0200
-+++ sudo-1.6.7p5/install-sh	2005-07-21 14:29:18.000000000 +0200
+--- sudo-1.6.7p5/scripts/install-sh.strip	2005-07-21 14:28:25.000000000 +0200
++++ sudo-1.6.7p5/scripts/install-sh	2005-07-21 14:29:18.000000000 +0200
 @@ -138,7 +138,7 @@
  	fi
  	;;
diff --git a/sudo.spec b/sudo.spec
index e1e3e6e..ceb4c24 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.5p2
-Release: 3%{?dist}
+Version: 1.9.7p2
+Release: 1%{?dist}
 License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}.tar.gz
@@ -17,7 +17,8 @@ BuildRequires: groff
 BuildRequires: openldap-devel
 BuildRequires: flex
 BuildRequires: bison
-BuildRequires: automake autoconf libtool
+# BuildRequires: automake autoconf libtool
+BuildRequires: libtool
 BuildRequires: audit-libs-devel libcap-devel
 BuildRequires: libselinux-devel
 BuildRequires: sendmail
@@ -74,7 +75,7 @@ BuildRequires:  python3-devel
 %build
 # Remove bundled copy of zlib
 rm -rf zlib/
-autoreconf -I m4 -fv --install
+#autoreconf -I m4 -fv --install
 
 %ifarch s390 s390x sparc64
 F_PIE=-fPIE
@@ -103,6 +104,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --with-selinux \
         --with-passprompt="[sudo] password for %p: " \
 	--enable-python \
+	--enable-zlib=system \
         --with-linux-audit \
         --with-sssd
 #       --without-kerb5 \
@@ -230,6 +232,12 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 
 %changelog
+* Fri Jul 30 2021 Peter Czanik <peter@czanik.hu> - 1.9.7p2-1
+- update to 1.9.7p2
+- follow up path change in strip patch
+- added --enable-zlib=system configure parameter, so sudo uses system zlib,
+  autoconf is no more needed
+
 * Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.5p2-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 

From dd1363faa35f510c1556d506257c06ae7a83bce9 Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Sat, 7 Aug 2021 12:43:08 -0400
Subject: [PATCH 165/199] update sources file for previous PR

---
 sources | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sources b/sources
index e39bcb4..3bae7ed 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.5p2.tar.gz) = f0fe914963c31a6f8ab6c86847ff6cdd125bd5a839b27f46dcae03963f4fc413b3d4cca54c1979feb825c8479b44c7df0642c07345c941eecf6f9f1e03ea0e27
+SHA512 (sudo-1.9.7p2.tar.gz) = 39184127122014d0d1d194d455644191009835ffdcc0efda3a99028fe346ca3ff6b15341016f85029556e9f1f9deeaf83b52160effc47d1a5713affb36b99386

From 442af28d89abad6b461155b5d38dfacaf68cba99 Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Sat, 7 Aug 2021 12:49:06 -0400
Subject: [PATCH 166/199] - drop obsolete requirement for post script that
 doesn't exist anymore   (thanks @scfc) - remove commented-out lines from
 prior PR

---
 sudo.spec | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index ceb4c24..d2e2cd9 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.7p2
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}.tar.gz
@@ -9,7 +9,6 @@ Source1: sudoers
 Requires: pam
 Recommends: vim-minimal
 Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release}
-Requires(post): coreutils
 
 BuildRequires: make
 BuildRequires: pam-devel
@@ -17,7 +16,6 @@ BuildRequires: groff
 BuildRequires: openldap-devel
 BuildRequires: flex
 BuildRequires: bison
-# BuildRequires: automake autoconf libtool
 BuildRequires: libtool
 BuildRequires: audit-libs-devel libcap-devel
 BuildRequires: libselinux-devel
@@ -75,7 +73,6 @@ BuildRequires:  python3-devel
 %build
 # Remove bundled copy of zlib
 rm -rf zlib/
-#autoreconf -I m4 -fv --install
 
 %ifarch s390 s390x sparc64
 F_PIE=-fPIE
@@ -232,6 +229,11 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 
 %changelog
+* Sat Aug  7 2021 Matthew Miller <mattdm@fedoraproject.org> - 1.9.7p2-2 
+- drop obsolete requirement for post script that doesn't exist anymore 
+  (thanks @scfc)
+- remove commented-out lines from prior PR
+
 * Fri Jul 30 2021 Peter Czanik <peter@czanik.hu> - 1.9.7p2-1
 - update to 1.9.7p2
 - follow up path change in strip patch

From f02ed1c65ea5e8e513344d1b251e0dcdd8188ac0 Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Wed, 25 Aug 2021 11:03:18 -0400
Subject: [PATCH 167/199] enable rpmautospec
 (https://docs.pagure.org/Fedora-Infra.rpmautospec/)

---
 changelog | 833 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 sudo.spec | 836 +-----------------------------------------------------
 2 files changed, 835 insertions(+), 834 deletions(-)
 create mode 100644 changelog

diff --git a/changelog b/changelog
new file mode 100644
index 0000000..2345722
--- /dev/null
+++ b/changelog
@@ -0,0 +1,833 @@
+* Sat Aug  7 2021 Matthew Miller <mattdm@fedoraproject.org> - 1.9.7p2-2 
+- drop obsolete requirement for post script that doesn't exist anymore 
+  (thanks @scfc)
+- remove commented-out lines from prior PR
+
+* Fri Jul 30 2021 Peter Czanik <peter@czanik.hu> - 1.9.7p2-1
+- update to 1.9.7p2
+- follow up path change in strip patch
+- added --enable-zlib=system configure parameter, so sudo uses system zlib,
+  autoconf is no more needed
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.5p2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 1.9.5p2-2
+- Rebuilt for Python 3.10
+
+* Tue Jan 26 2021 Matthew Miller <mattdm@fedoraproject.org> - 1.9.5p2-1
+- rebase to 1.9.5p2
+Resolves: rhbz#1920611
+- fixed CVE-2021-3156 sudo: Heap buffer overflow in argument parsing
+Resolves: rhbz#1920618
+
+* Mon Jan 18 2021 Radovan Sroka <rsroka@redhat.com> - 1.9.5p1-1
+- rebase to 1.9.5p1
+Resolves: rhbz#1902758
+- fixed double free in sss_to_sudoers
+Resolves: rhbz#1885874
+- fixed CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
+Resolves: rhbz#1915055
+- fixed CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
+Resolves: rhbz#1915054
+
+* Wed Jan 13 2021 Jonathan Lebon <jonathan@jlebon.com> - 1.9.3p1-2
+- split out Python modules into separate subpackage
+Resolves: rhbz#1909299
+
+* Mon Oct 05 2020 Radovan Sroka <rsroka@redhat.com> - 1.9.3p1-1
+- rebase to 1.9.3p1
+- enable python modules
+Resolves: rhbz#1881112
+
+* Tue Sep 15 2020 Radovan Sroka <rsroka@redhat.com> - 1.9.2-1
+- rebase to 1.9.2
+Resolves: rhbz#1859577
+- added logsrvd subpackage
+- added openssl-devel buildrequires
+Resolves: rhbz#1860653
+- fixed sudo runstatedir path
+- it was generated as /sudo instead of /run/sudo
+Resolves: rhbz#1868215
+- added /var/lib/snapd/snap/bin to secure_path variable
+Resolves: rhbz#1691996
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.1-3
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jul 08 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.1-1
+- rebase to 1.9.1
+Resolves: rhbz#1848788
+- fix rpmlint errors
+Resolves: rhbz#1817139
+
+* Wed Mar 25 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b4
+- update to latest development version 1.9.0b4
+Resolves: rhbz#1816593
+- setrlimit(RLIMIT_CORE): Operation not permitted warning message fix
+Resolves: rhbz#1773148
+
+* Mon Feb 24 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b1
+- update to latest development version 1.9.0b1
+- added sudo_logsrvd and sudo_sendlog to files and their appropriate man pages
+Resolves: rhbz#1787823
+- Stack based buffer overflow in when pwfeedback is enabled
+Resolves: rhbz#1796945
+- fixes: CVE-2019-18634
+- By using ! character in the shadow file instead of a password hash can access to a run as all sudoer account
+Resolves: rhbz#1786709
+- fixes CVE-2019-19234
+- attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user
+Resolves: rhbz#1786705
+- fixes CVE-2019-19232
+
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.29-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Mon Nov 11 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.29-1
+- rebase to 1.8.29
+Resolves: rhbz#1766233
+
+* Tue Oct 22 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
+- rebase to 1.8.28p1
+Resolves: rhbz#1762350
+
+* Tue Oct 15 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.28-1
+- rebase to 1.8.28
+Resolves: rhbz#1761533
+- set always_set_home by default
+Resolves: rhbz#1728687
+- Sync sudoers options from rhel8 to fedora
+Resolves: rhbz#1761781
+- CVE-2019-14287
+Resolves: rhbz#1761584
+
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.27-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sun Mar 31 2019 Marek Tamaskovic <mtamasko@redhat.com> 1.8.27-2
+- resolves rhbz#1676925
+- Removed PS1, PS2 from sudoers
+
+* Mon Mar 11 2019 Radovan Sroka <rsroka@redhat.com> 1.8.27-1
+- rebase sudo to 1.8.27
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.25p1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Mon Oct 01 2018 Radovan Sroka <rsroka@redhat.com> 1.8.25p1-1
+- rebase sudo to 1.8.25p1
+
+* Mon Sep 10 2018 Radovan Sroka <rsroka@redhat.com> 1.8.25-1
+- rebase sudo to latest stawble version
+- install /etc/dnf/protected.d/sudo instead of /etc/yum/protected.d/sudo (1626968)
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.23-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Tue Jul 03 2018 Matthew Miller <mattdm@fedoraproject.org> - 1.8.23-2
+- remove defattr, as default is now sane
+
+* Wed May 09 2018 Daniel Kopecek <dkopecek@redhat.com> - 1.8.23-1
+- update to 1.8.23
+
+* Wed Apr 18 2018 Daniel Kopecek <dkopecek@redhat.com> - 1.8.23-0.1.b3
+- update to 1.8.23b3
+
+* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.22-0.2.b1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Thu Dec 14 2017 Radovan Sroka <rsroka@redhat.com> - 1.8.22b1-1
+- update to 1.8.22b1
+- Added /usr/local/sbin and /usr/local/bin to secure path rhbz#1166185
+
+* Thu Sep 21 2017 Marek Tamaskovic <mtamasko@redhat.com> - 1.8.21p2-1
+- update to 1.8.21p2
+- Moved libsudo_util.so from the -devel sub-package to main package (1481225)
+
+* Wed Sep 06 2017 Matthew Miller <mattdm@fedoraproject.org> - 1.8.20p2-4
+- replace file-based requirements with package-level ones:
+- /etc/pam.d/system-auth to 'pam'
+- /bin/chmod to 'coreutils' (bug #1488934)
+- /usr/bin/vi to vim-minimal
+- ... and make vim-minimal "recommends" instead of "requires", because
+  other editors can be configured.
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.20p2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.20p2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Thu Jun 01 2017 Daniel Kopecek <dkopecek@redhat.com> 1.8.20p2-1
+- update to 1.8.20p2
+
+* Wed May 31 2017 Daniel Kopecek <dkopecek@redhat.com> 1.8.20p1-1
+- update to 1.8.20p1
+- fixes CVE-2017-1000367
+  Resolves: rhbz#1456884
+
+* Fri Apr 07 2017 Jiri Vymazal <jvymazal@redhat.com> - 1.8.20-0.1.b1
+- update to latest development version 1.8.20b1
+- added sudo to dnf/yum protected packages
+  Resolves: rhbz#1418756
+
+* Mon Feb 13 2017 Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-1
+- update to 1.8.19p2
+
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.19-0.3.20161108git738c3cb
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Tue Nov 08 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.19-0.2.20161108git738c3cb
+- update to latest development version
+- fixes CVE-2016-7076
+
+* Fri Sep 23 2016 Radovan Sroka <rsroka@redhat.com> 1.8.19-0.1.20160923git90e4538
+- we were not able to update from rc and beta versions to stable one
+- so this is a new snapshot package which resolves it
+
+* Wed Sep 21 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18-1
+- update to 1.8.18
+
+* Fri Sep 16 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18rc4-1
+- update to 1.8.18rc4
+
+* Wed Sep 14 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18rc2-1
+- update to 1.8.18rc2
+- dropped sudo-1.8.14p1-ldapconfpatch.patch
+  upstreamed --> https://www.sudo.ws/pipermail/sudo-workers/2016-September/001006.html
+
+* Fri Aug 26 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18b2-1
+- update to 1.8.18b2
+- added --disable-root-mailer as configure option
+  Resolves: rhbz#1324091
+
+* Fri Jun 24 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.17p1-1
+- update to 1.8.17p1
+- install the /var/db/sudo/lectured
+  Resolves: rhbz#1321414
+
+* Tue May 31 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-4
+- removed INPUTRC from env_keep to prevent a possible info leak
+  Resolves: rhbz#1340701
+
+* Fri May 13 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-3
+- fixed upstream patch for rhbz#1328735
+
+* Thu May 12 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-2
+- fixed invalid sesh argument array construction
+
+* Mon Apr 04 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-1
+- update to 1.8.16
+
+* Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.15-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Thu Nov  5 2015 Daniel Kopecek <dkopecek@redhat.com> 1.8.15-1
+- update to 1.8.15
+- fixes CVE-2015-5602
+
+* Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-3
+- enable upstream test suite
+
+* Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-2
+- add patch that resolves initialization problem before sudo_strsplit call
+- add patch that resolves deadcode in visudo.c
+- add patch that removes extra while in visudo.c and sudoers.c
+
+* Mon Jul 27 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-1
+- update to 1.8.14p3
+
+* Mon Jul 20 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p1-1
+- update to 1.8.14p1-1
+- rebase sudo-1.8.14b3-ldapconfpatch.patch -> sudo-1.8.14p1-ldapconfpatch.patch
+- rebase sudo-1.8.14b4-docpassexpire.patch -> sudo-1.8.14p1-docpassexpire.patch
+
+* Tue Jul 14 2015 Radovan Sroka <rsroka@redhat.com> 1.8.12-2
+- add patch3 sudo.1.8.14b4-passexpire.patch that makes change in documentation about timestamp_time
+- Resolves: rhbz#1162070
+
+* Fri Jul 10 2015 Radovan Sroka <rsroka@redhat.com> - 1.8.14b4-1
+- Update to 1.8.14b4
+- Add own %%{_tmpfilesdir}/sudo.conf
+
+* Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.12-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Wed Feb 18 2015 Daniel Kopecek <dkopecek@redhat.com> - 1.8.12
+- update to 1.8.12
+- fixes CVE-2014-9680
+
+* Mon Nov  3 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.11p2-1
+- update to 1.8.11p2
+- added patch to fix upstream bug #671 -- exiting immediately
+  when audit is disabled
+
+* Tue Sep 30 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.11-1
+- update to 1.8.11
+- major changes & fixes:
+  - when running a command in the background, sudo will now forward
+    SIGINFO to the command
+  - the passwords in ldap.conf and ldap.secret may now be encoded in base64.
+  - SELinux role changes are now audited. For sudoedit, we now audit
+    the actual editor being run, instead of just the sudoedit command.
+  - it is now possible to match an environment variable's value as well as
+    its name using env_keep and env_check
+  - new files created via sudoedit as a non-root user now have the proper group id
+  - sudoedit now works correctly in conjunction with sudo's SELinux RBAC support
+  - it is now possible to disable network interface probing in sudo.conf by
+    changing the value of the probe_interfaces setting
+  - when listing a user's privileges (sudo -l), the sudoers plugin will now prompt
+    for the user's password even if the targetpw, rootpw or runaspw options are set.
+  - the new use_netgroups sudoers option can be used to explicitly enable or disable
+    netgroups support
+  - visudo can now export a sudoers file in JSON format using the new -x flag
+- added patch to read ldap.conf more closely to nss_ldap
+- require /usr/bin/vi instead of vim-minimal
+- include pam.d/system-auth in PAM session phase from pam.d/sudo
+- include pam.d/sudo in PAM session phase from pam.d/sudo-i
+
+* Tue Aug  5 2014 Tom Callaway <spot@fedoraproject.org> - 1.8.8-6
+- fix license handling
+
+* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.8-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Sat May 31 2014 Peter Robinson <pbrobinson@fedoraproject.org> 1.8.8-4
+- Drop ChangeLog, we ship NEWS
+
+* Mon Mar 10 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-3
+- remove bundled copy of zlib before compilation
+- drop the requiretty Defaults setting from sudoers
+
+* Sat Jan 25 2014 Ville Skyttä <ville.skytta@iki.fi> - 1.8.8-2
+- Own the %%{_libexecdir}/sudo dir.
+
+* Mon Sep 30 2013 Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-1
+- update to 1.8.8
+- major changes & fixes:
+  - LDAP SASL support now works properly with Kerberos
+  - root may no longer change its SELinux role without entering a password
+  - user messages are now always displayed in the user's locale, even when
+    the same message is being logged or mailed in a different locale.
+  - log files created by sudo now explicitly have the group set to group
+    ID 0 rather than relying on BSD group semantics
+  - sudo now stores its libexec files in a sudo subdirectory instead of in
+    libexec itself
+  - system_group and group_file sudoers group provider plugins are now
+    installed by default
+  - the paths to ldap.conf and ldap.secret may now be specified as arguments
+    to the sudoers plugin in the sudo.conf file
+  - ...and many new features and settings. See the upstream ChangeLog for the
+    full list.
+- several sssd support fixes
+- added patch to make uid/gid specification parsing more strict (don't accept
+  an invalid number as uid/gid)
+- use the _pkgdocdir macro
+  (see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs)
+- fixed several bugs found by the clang static analyzer
+- added %%post dependency on chmod
+
+* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.6p7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Thu Feb 28 2013 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-1
+- update to 1.8.6p7
+- fixes CVE-2013-1775 and CVE-2013-1776
+- fixed several packaging issues (thanks to ville.skytta@iki.fi)
+  - build with system zlib.
+  - let rpmbuild strip libexecdir/*.so.
+  - own the %%{_docdir}/sudo-* dir.
+  - fix some rpmlint warnings (spaces vs tabs, unescaped macros).
+  - fix bogus %%changelog dates.
+
+* Fri Feb 15 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.6p3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Mon Nov 12 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
+- added upstream patch for a regression
+- don't include arch specific files in the -devel subpackage
+- ship only one sample plugin in the -devel subpackage
+
+* Tue Sep 25 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-1
+- update to 1.8.6p3
+- drop -pipelist patch (fixed in upstream)
+
+* Thu Sep  6 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6-1
+- update to 1.8.6
+
+* Thu Jul 26 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-4
+- added patches that fix & improve SSSD support (thanks to pbrezina@redhat.com)
+- re-enabled SSSD support
+- removed libsss_sudo dependency
+
+* Tue Jul 24 2012 Bill Nottingham <notting@redhat.com> - 1.8.5-3
+- flip sudoers2ldif executable bit after make install, not in setup
+
+* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Thu May 17 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-1
+- update to 1.8.5
+- fixed CVE-2012-2337
+- temporarily disabled SSSD support
+
+* Wed Feb 29 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-6
+- fixed problems with undefined symbols (rhbz#798517)
+
+* Wed Feb 22 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-5
+- SSSD patch update
+
+* Tue Feb  7 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-4
+- added SSSD support
+
+* Thu Jan 26 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-3
+- added patch for CVE-2012-0809
+
+* Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.3p1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Thu Nov 10 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-1
+- update to 1.8.3p1
+- disable output word wrapping if the output is piped
+
+* Wed Sep  7 2011 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.1p2-2
+- Remove execute bit from sample script in docs so we don't pull in perl
+
+* Tue Jul 12 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
+- rebase to 1.8.1p2
+- removed .sudoi patch
+- fixed typo: RELPRO -> RELRO
+- added -devel subpackage for the sudo_plugin.h header file
+- use default ldap configuration files again
+
+* Fri Jun  3 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-4
+- build with RELRO
+
+* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.4p5-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Mon Jan 17 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-2
+- rebase to 1.7.4p5
+- fixed sudo-1.7.4p4-getgrouplist.patch
+- fixes CVE-2011-0008, CVE-2011-0010
+
+* Tue Nov 30 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-5
+- anybody in the wheel group has now root access (using password) (rhbz#656873)
+- sync configuration paths with the nss_ldap package (rhbz#652687)
+
+* Wed Sep 29 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-4
+- added upstream patch to fix rhbz#638345
+
+* Mon Sep 20 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-3
+- added patch for #635250
+- /var/run/sudo -> /var/db/sudo in .spec
+
+* Tue Sep  7 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-2
+- sudo now uses /var/db/sudo for timestamps
+
+* Tue Sep  7 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-1
+- update to new upstream version
+- new command available: sudoreplay
+- use native audit support
+- corrected license field value: BSD -> ISC
+
+* Wed Jun  2 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-2
+- added patch that fixes insufficient environment sanitization issue (#598154)
+
+* Wed Apr 14 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-1
+- update to new upstream version
+- merged .audit and .libaudit patch
+- added sudoers.ldap.5* to files
+
+* Mon Mar  1 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p5-2
+- update to new upstream version
+
+* Tue Feb 16 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-5
+- fixed no valid sudoers sources found (#558875)
+
+* Wed Feb 10 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-4
+- audit related Makefile.in and configure.in corrections
+- added --with-audit configure option
+- removed call to libtoolize
+
+* Wed Feb 10 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-3
+- fixed segfault when #include directive is used in cycles (#561336)
+
+* Fri Jan  8 2010 Ville Skyttä <ville.skytta@iki.fi> - 1.7.2p2-2
+- Add /etc/sudoers.d dir and use it in default config (#551470).
+- Drop *.pod man page duplicates from docs.
+
+* Thu Jan 07 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
+- new upstream version 1.7.2p2-1
+- commented out unused aliases in sudoers to make visudo happy (#550239)
+
+* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.7.1-7
+- rebuilt with new audit
+
+* Thu Aug 20 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-6
+- moved secure_path from compile-time option to sudoers file (#517428)
+
+* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.1-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Thu Jul 09 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
+- moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
+- epoch number sync
+
+* Mon Jun 22 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-1
+- updated sudo to version 1.7.1
+- fixed small bug in configure.in (sudo-1.7.1-conffix.patch)
+
+* Tue Feb 24 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
+- fixed building with new libtool
+- fix for incorrect handling of groups in Runas_User
+- added /usr/local/sbin to secure-path
+
+* Tue Jan 13 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-3
+- build with sendmail installed
+- Added /usr/local/bin to secure-path
+
+* Tue Sep 02 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
+- adjust audit patch, do not scream when kernel is
+  compiled without audit netlink support (#401201)
+
+* Fri Jul 04 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-1
+- upgrade
+
+* Wed Jun 18 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-7
+- build with newer autoconf-2.62 (#449614)
+
+* Tue May 13 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-6
+- compiled with secure path (#80215)
+
+* Mon May 05 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-5
+- fix path to updatedb in /etc/sudoers (#445103)
+
+* Mon Mar 31 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-4
+- include ldap files in rpm package (#439506)
+
+* Thu Mar 13 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-3
+- include [sudo] in password prompt (#437092)
+
+* Tue Mar 04 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-2
+- audit support improvement
+
+* Thu Feb 21 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-1
+- upgrade to the latest upstream release
+
+* Wed Feb 06 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p12-1
+- upgrade to the latest upstream release
+- add selinux support
+
+* Mon Feb 04 2008 Dennis Gilmore <dennis@ausil.us> 1.6.9p4-6
+- sparc64 needs to be in the -fPIE list with s390
+
+* Mon Jan 07 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-5
+- fix complains about audit_log_user_command(): Connection
+  refused (#401201)
+
+* Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-4
+- Rebuild for deps
+
+* Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-3
+- Rebuild for openssl bump
+
+* Thu Aug 30 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-2
+- fix autotools stuff and add audit support
+
+* Mon Aug 20 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-1
+- upgrade to upstream release
+
+* Thu Apr 12 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-14
+- also use getgrouplist() to determine group membership (#235915)
+
+* Mon Feb 26 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-13
+- fix some spec file issues
+
+* Thu Dec 14 2006 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-12
+- fix rpmlint issue
+
+* Thu Oct 26 2006 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-11
+- fix typo in sudoers file (#212308)
+
+* Sun Oct 01 2006 Jesse Keating <jkeating@redhat.com> - 1.6.8p12-10
+- rebuilt for unwind info generation, broken in gcc-4.1.1-21
+
+* Thu Sep 21 2006 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-9
+- fix sudoers file, X apps didn't work (#206320)
+
+* Tue Aug 08 2006 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-8
+- use Red Hat specific default sudoers file
+
+* Sun Jul 16 2006 Karel Zak <kzak@redhat.com> 1.6.8p12-7
+- fix #198755 - make login processes (sudo -i) initialise session keyring
+  (thanks for PAM config files to David Howells)
+- add IPv6 support (patch by Milan Zazrivec)
+
+* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.6.8p12-6.1
+- rebuild
+
+* Mon May 29 2006 Karel Zak <kzak@redhat.com> 1.6.8p12-6
+- fix #190062 - "ssh localhost sudo su" will show the password in clear
+
+* Tue May 23 2006 Karel Zak <kzak@redhat.com> 1.6.8p12-5
+- add LDAP support (#170848)
+
+* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 1.6.8p12-4.1
+- bump again for double-long bug on ppc(64)
+
+* Wed Feb  8 2006 Karel Zak <kzak@redhat.com> 1.6.8p12-4
+- reset env. by default
+
+* Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 1.6.8p12-3.1
+- rebuilt for new gcc4.1 snapshot and glibc changes
+
+* Mon Jan 23 2006 Dan Walsh <dwalsh@redhat.com> 1.6.8p12-3
+- Remove selinux patch.  It has been decided that the SELinux patch for sudo is
+- no longer necessary.  In tageted policy it had no effect.  In strict/MLS policy
+- We require the person using sudo to execute newrole before using sudo.
+
+* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
+- rebuilt
+
+* Fri Nov 25 2005 Karel Zak <kzak@redhat.com> 1.6.8p12-1
+- new upstream version 1.6.8p12
+
+* Tue Nov  8 2005 Karel Zak <kzak@redhat.com> 1.6.8p11-1
+- new upstream version 1.6.8p11
+
+* Thu Oct 13 2005 Tomas Mraz <tmraz@redhat.com> 1.6.8p9-6
+- use include instead of pam_stack in pam config
+
+* Tue Oct 11 2005 Karel Zak <kzak@redhat.com> 1.6.8p9-5
+- enable interfaces in selinux patch
+- merge sudo-1.6.8p8-sesh-stopsig.patch to selinux patch
+
+* Mon Sep 19 2005 Karel Zak <kzak@redhat.com> 1.6.8p9-4
+- fix debuginfo
+
+* Mon Sep 19 2005 Karel Zak <kzak@redhat.com> 1.6.8p9-3
+- fix #162623 - sesh hangs when child suspends
+
+* Mon Aug 1 2005 Dan Walsh <dwalsh@redhat.com> 1.6.8p9-2
+- Add back in interfaces call, SELinux has been fixed to work around
+
+* Tue Jun 21 2005 Karel Zak <kzak@redhat.com> 1.6.8p9-1
+- new version 1.6.8p9 (resolve #161116 - CAN-2005-1993 sudo trusted user arbitrary command execution)
+
+* Tue May 24 2005 Karel Zak <kzak@redhat.com> 1.6.8p8-2
+- fix #154511 - sudo does not use limits.conf
+
+* Mon Apr  4 2005 Thomas Woerner <twoerner@redhat.com> 1.6.8p8-1
+- new version 1.6.8p8: new sudoedit and sudo_noexec
+
+* Wed Feb  9 2005 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-31
+- rebuild
+
+* Mon Oct  4 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-30.1
+- added missing BuildRequires for libselinux-devel (#132883)
+
+* Wed Sep 29 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-30
+- Fix missing param error in sesh
+
+* Mon Sep 27 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-29
+- Remove full patch check from sesh
+
+* Thu Jul 8 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-28
+- Fix selinux patch to switch to root user
+
+* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Tue Apr 13 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-26
+- Eliminate tty handling from selinux
+
+* Thu Apr  1 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-25
+- fixed spec file: sesh in file section with selinux flag (#119682)
+
+* Tue Mar 30 2004 Colin Walters <walters@redhat.com> 1.6.7p5-24
+- Enhance sesh.c to fork/exec children itself, to avoid
+  having sudo reap all domains.
+- Only reinstall default signal handlers immediately before
+  exec of child with SELinux patch
+
+* Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-23
+- change to default to sysadm_r
+- Fix tty handling
+
+* Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-22
+- Add /bin/sesh to run selinux code.
+- replace /bin/bash -c with /bin/sesh
+
+* Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-21
+- Hard code to use "/bin/bash -c" for selinux
+
+* Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-20
+- Eliminate closing and reopening of terminals, to match su.
+
+* Mon Mar 15 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-19
+- SELinux fixes to make transitions work properly
+
+* Fri Mar  5 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-18
+- pied sudo
+
+* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Tue Jan 27 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-16
+- Eliminate interfaces call, since this requires big SELinux privs
+- and it seems to be useless.
+
+* Tue Jan 27 2004 Karsten Hopp <karsten@redhat.de> 1.6.7p5-15
+- visudo requires vim-minimal or setting EDITOR to something useful (#68605)
+
+* Mon Jan 26 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-14
+- Fix is_selinux_enabled call
+
+* Tue Jan 13 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-13
+- Clean up patch on failure
+
+* Tue Jan 6 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-12
+- Remove sudo.te for now.
+
+* Fri Jan 2 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-11
+- Fix usage message
+
+* Mon Dec 22 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-10
+- Clean up sudo.te to not blow up if pam.te not present
+
+* Thu Dec 18 2003 Thomas Woerner <twoerner@redhat.com>
+- added missing BuildRequires for groff
+
+* Tue Dec 16 2003 Jeremy Katz <katzj@redhat.com> 1.6.7p5-9
+- remove left-over debugging code
+
+* Tue Dec 16 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-8
+- Fix terminal handling that caused Sudo to exit on non selinux machines.
+
+* Mon Dec 15 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-7
+- Remove sudo_var_run_t which is now pam_var_run_t
+
+* Fri Dec 12 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-6
+- Fix terminal handling and policy
+
+* Thu Dec 11 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-5
+- Fix policy
+
+* Thu Nov 13 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-4.sel
+- Turn on SELinux support
+
+* Tue Jul 29 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-3
+- Add support for SELinux
+
+* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Mon May 19 2003 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-1
+
+* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
+- rebuilt
+
+* Tue Nov 12 2002 Nalin Dahyabhai <nalin@redhat.com> 1.6.6-2
+- remove absolute path names from the PAM configuration, ensuring that the
+  right modules get used for whichever arch we're built for
+- don't try to install the FAQ, which isn't there any more
+
+* Thu Jun 27 2002 Bill Nottingham <notting@redhat.com> 1.6.6-1
+- update to 1.6.6
+
+* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Thu May 23 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Thu Apr 18 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.5p2-2
+- Fix bug #63768
+
+* Thu Mar 14 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.5p2-1
+- 1.6.5p2
+
+* Fri Jan 18 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.5p1-1
+- 1.6.5p1
+- Hope this "a new release per day" madness stops ;)
+
+* Thu Jan 17 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.5-1
+- 1.6.5
+
+* Tue Jan 15 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.4p1-1
+- 1.6.4p1
+
+* Mon Jan 14 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.4-1
+- Update to 1.6.4
+
+* Mon Jul 23 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.3p7-2
+- Add build requirements (#49706)
+- s/Copyright/License/
+- bzip2 source
+
+* Sat Jun 16 2001 Than Ngo <than@redhat.com>
+- update to 1.6.3p7
+- use %%{_tmppath}
+
+* Fri Feb 23 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- 1.6.3p6, fixes buffer overrun
+
+* Tue Oct 10 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- 1.6.3p5
+
+* Wed Jul 12 2000 Prospector <bugzilla@redhat.com>
+- automatic rebuild
+
+* Tue Jun 06 2000 Karsten Hopp <karsten@redhat.de>
+- fixed owner of sudo and visudo
+
+* Thu Jun  1 2000 Nalin Dahyabhai <nalin@redhat.com>
+- modify PAM setup to use system-auth
+- clean up buildrooting by using the makeinstall macro
+
+* Tue Apr 11 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- initial build in main distrib
+- update to 1.6.3
+- deal with compressed man pages
+
+* Tue Dec 14 1999 Preston Brown <pbrown@redhat.com>
+- updated to 1.6.1 for Powertools 6.2
+- config files are now noreplace.
+
+* Thu Jul 22 1999 Tim Powers <timp@redhat.com>
+- updated to 1.5.9p2 for Powertools 6.1
+
+* Wed May 12 1999 Bill Nottingham <notting@redhat.com>
+- sudo is configured with pam. There's no pam.d file. Oops.
+
+* Mon Apr 26 1999 Preston Brown <pbrown@redhat.com>
+- upgraded to 1.59p1 for powertools 6.0
+
+* Tue Oct 27 1998 Preston Brown <pbrown@redhat.com>
+- fixed so it doesn't find /usr/bin/vi first, but instead /bin/vi (always installed)
+
+* Thu Oct 08 1998 Michael Maher <mike@redhat.com>
+- built package for 5.2
+
+* Mon May 18 1998 Michael Maher <mike@redhat.com>
+- updated SPEC file
+
+* Thu Jan 29 1998 Otto Hammersmith <otto@redhat.com>
+- updated to 1.5.4
+
+* Tue Nov 18 1997 Otto Hammersmith <otto@redhat.com>
+- built for glibc, no problems
+
+* Fri Apr 25 1997 Michael Fulbright <msf@redhat.com>
+- Fixed for 4.2 PowerTools
+- Still need to be pamified
+- Still need to move stmp file to /var/log
+
+* Mon Feb 17 1997 Michael Fulbright <msf@redhat.com>
+- First version for PowerCD.
diff --git a/sudo.spec b/sudo.spec
index d2e2cd9..762cc13 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.7p2
-Release: 2%{?dist}
+Release: %autorelease
 License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}.tar.gz
@@ -229,836 +229,4 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 
 %changelog
-* Sat Aug  7 2021 Matthew Miller <mattdm@fedoraproject.org> - 1.9.7p2-2 
-- drop obsolete requirement for post script that doesn't exist anymore 
-  (thanks @scfc)
-- remove commented-out lines from prior PR
-
-* Fri Jul 30 2021 Peter Czanik <peter@czanik.hu> - 1.9.7p2-1
-- update to 1.9.7p2
-- follow up path change in strip patch
-- added --enable-zlib=system configure parameter, so sudo uses system zlib,
-  autoconf is no more needed
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.5p2-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 1.9.5p2-2
-- Rebuilt for Python 3.10
-
-* Tue Jan 26 2021 Matthew Miller <mattdm@fedoraproject.org> - 1.9.5p2-1
-- rebase to 1.9.5p2
-Resolves: rhbz#1920611
-- fixed CVE-2021-3156 sudo: Heap buffer overflow in argument parsing
-Resolves: rhbz#1920618
-
-* Mon Jan 18 2021 Radovan Sroka <rsroka@redhat.com> - 1.9.5p1-1
-- rebase to 1.9.5p1
-Resolves: rhbz#1902758
-- fixed double free in sss_to_sudoers
-Resolves: rhbz#1885874
-- fixed CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
-Resolves: rhbz#1915055
-- fixed CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
-Resolves: rhbz#1915054
-
-* Wed Jan 13 2021 Jonathan Lebon <jonathan@jlebon.com> - 1.9.3p1-2
-- split out Python modules into separate subpackage
-Resolves: rhbz#1909299
-
-* Mon Oct 05 2020 Radovan Sroka <rsroka@redhat.com> - 1.9.3p1-1
-- rebase to 1.9.3p1
-- enable python modules
-Resolves: rhbz#1881112
-
-* Tue Sep 15 2020 Radovan Sroka <rsroka@redhat.com> - 1.9.2-1
-- rebase to 1.9.2
-Resolves: rhbz#1859577
-- added logsrvd subpackage
-- added openssl-devel buildrequires
-Resolves: rhbz#1860653
-- fixed sudo runstatedir path
-- it was generated as /sudo instead of /run/sudo
-Resolves: rhbz#1868215
-- added /var/lib/snapd/snap/bin to secure_path variable
-Resolves: rhbz#1691996
-
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.1-3
-- Second attempt - Rebuilt for
-  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Wed Jul 08 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.1-1
-- rebase to 1.9.1
-Resolves: rhbz#1848788
-- fix rpmlint errors
-Resolves: rhbz#1817139
-
-* Wed Mar 25 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b4
-- update to latest development version 1.9.0b4
-Resolves: rhbz#1816593
-- setrlimit(RLIMIT_CORE): Operation not permitted warning message fix
-Resolves: rhbz#1773148
-
-* Mon Feb 24 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b1
-- update to latest development version 1.9.0b1
-- added sudo_logsrvd and sudo_sendlog to files and their appropriate man pages
-Resolves: rhbz#1787823
-- Stack based buffer overflow in when pwfeedback is enabled
-Resolves: rhbz#1796945
-- fixes: CVE-2019-18634
-- By using ! character in the shadow file instead of a password hash can access to a run as all sudoer account
-Resolves: rhbz#1786709
-- fixes CVE-2019-19234
-- attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user
-Resolves: rhbz#1786705
-- fixes CVE-2019-19232
-
-* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.29-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Mon Nov 11 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.29-1
-- rebase to 1.8.29
-Resolves: rhbz#1766233
-
-* Tue Oct 22 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
-- rebase to 1.8.28p1
-Resolves: rhbz#1762350
-
-* Tue Oct 15 2019 Radovan Sroka <rsroka@redhat.com> - 1.8.28-1
-- rebase to 1.8.28
-Resolves: rhbz#1761533
-- set always_set_home by default
-Resolves: rhbz#1728687
-- Sync sudoers options from rhel8 to fedora
-Resolves: rhbz#1761781
-- CVE-2019-14287
-Resolves: rhbz#1761584
-
-* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.27-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Sun Mar 31 2019 Marek Tamaskovic <mtamasko@redhat.com> 1.8.27-2
-- resolves rhbz#1676925
-- Removed PS1, PS2 from sudoers
-
-* Mon Mar 11 2019 Radovan Sroka <rsroka@redhat.com> 1.8.27-1
-- rebase sudo to 1.8.27
-
-* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.25p1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Mon Oct 01 2018 Radovan Sroka <rsroka@redhat.com> 1.8.25p1-1
-- rebase sudo to 1.8.25p1
-
-* Mon Sep 10 2018 Radovan Sroka <rsroka@redhat.com> 1.8.25-1
-- rebase sudo to latest stawble version
-- install /etc/dnf/protected.d/sudo instead of /etc/yum/protected.d/sudo (1626968)
-
-* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.23-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Tue Jul 03 2018 Matthew Miller <mattdm@fedoraproject.org> - 1.8.23-2
-- remove defattr, as default is now sane
-
-* Wed May 09 2018 Daniel Kopecek <dkopecek@redhat.com> - 1.8.23-1
-- update to 1.8.23
-
-* Wed Apr 18 2018 Daniel Kopecek <dkopecek@redhat.com> - 1.8.23-0.1.b3
-- update to 1.8.23b3
-
-* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.22-0.2.b1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Thu Dec 14 2017 Radovan Sroka <rsroka@redhat.com> - 1.8.22b1-1
-- update to 1.8.22b1
-- Added /usr/local/sbin and /usr/local/bin to secure path rhbz#1166185
-
-* Thu Sep 21 2017 Marek Tamaskovic <mtamasko@redhat.com> - 1.8.21p2-1
-- update to 1.8.21p2
-- Moved libsudo_util.so from the -devel sub-package to main package (1481225)
-
-* Wed Sep 06 2017 Matthew Miller <mattdm@fedoraproject.org> - 1.8.20p2-4
-- replace file-based requirements with package-level ones:
-- /etc/pam.d/system-auth to 'pam'
-- /bin/chmod to 'coreutils' (bug #1488934)
-- /usr/bin/vi to vim-minimal
-- ... and make vim-minimal "recommends" instead of "requires", because
-  other editors can be configured.
-
-* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.20p2-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.20p2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Thu Jun 01 2017 Daniel Kopecek <dkopecek@redhat.com> 1.8.20p2-1
-- update to 1.8.20p2
-
-* Wed May 31 2017 Daniel Kopecek <dkopecek@redhat.com> 1.8.20p1-1
-- update to 1.8.20p1
-- fixes CVE-2017-1000367
-  Resolves: rhbz#1456884
-
-* Fri Apr 07 2017 Jiri Vymazal <jvymazal@redhat.com> - 1.8.20-0.1.b1
-- update to latest development version 1.8.20b1
-- added sudo to dnf/yum protected packages
-  Resolves: rhbz#1418756
-
-* Mon Feb 13 2017 Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-1
-- update to 1.8.19p2
-
-* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.19-0.3.20161108git738c3cb
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Tue Nov 08 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.19-0.2.20161108git738c3cb
-- update to latest development version
-- fixes CVE-2016-7076
-
-* Fri Sep 23 2016 Radovan Sroka <rsroka@redhat.com> 1.8.19-0.1.20160923git90e4538
-- we were not able to update from rc and beta versions to stable one
-- so this is a new snapshot package which resolves it
-
-* Wed Sep 21 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18-1
-- update to 1.8.18
-
-* Fri Sep 16 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18rc4-1
-- update to 1.8.18rc4
-
-* Wed Sep 14 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18rc2-1
-- update to 1.8.18rc2
-- dropped sudo-1.8.14p1-ldapconfpatch.patch
-  upstreamed --> https://www.sudo.ws/pipermail/sudo-workers/2016-September/001006.html
-
-* Fri Aug 26 2016 Radovan Sroka <rsroka@redhat.com> 1.8.18b2-1
-- update to 1.8.18b2
-- added --disable-root-mailer as configure option
-  Resolves: rhbz#1324091
-
-* Fri Jun 24 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.17p1-1
-- update to 1.8.17p1
-- install the /var/db/sudo/lectured
-  Resolves: rhbz#1321414
-
-* Tue May 31 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-4
-- removed INPUTRC from env_keep to prevent a possible info leak
-  Resolves: rhbz#1340701
-
-* Fri May 13 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-3
-- fixed upstream patch for rhbz#1328735
-
-* Thu May 12 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-2
-- fixed invalid sesh argument array construction
-
-* Mon Apr 04 2016 Daniel Kopecek <dkopecek@redhat.com> 1.8.16-1
-- update to 1.8.16
-
-* Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.15-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Thu Nov  5 2015 Daniel Kopecek <dkopecek@redhat.com> 1.8.15-1
-- update to 1.8.15
-- fixes CVE-2015-5602
-
-* Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-3
-- enable upstream test suite
-
-* Mon Aug 24 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-2
-- add patch that resolves initialization problem before sudo_strsplit call
-- add patch that resolves deadcode in visudo.c
-- add patch that removes extra while in visudo.c and sudoers.c
-
-* Mon Jul 27 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p3-1
-- update to 1.8.14p3
-
-* Mon Jul 20 2015 Radovan Sroka <rsroka@redhat.com> 1.8.14p1-1
-- update to 1.8.14p1-1
-- rebase sudo-1.8.14b3-ldapconfpatch.patch -> sudo-1.8.14p1-ldapconfpatch.patch
-- rebase sudo-1.8.14b4-docpassexpire.patch -> sudo-1.8.14p1-docpassexpire.patch
-
-* Tue Jul 14 2015 Radovan Sroka <rsroka@redhat.com> 1.8.12-2
-- add patch3 sudo.1.8.14b4-passexpire.patch that makes change in documentation about timestamp_time
-- Resolves: rhbz#1162070
-
-* Fri Jul 10 2015 Radovan Sroka <rsroka@redhat.com> - 1.8.14b4-1
-- Update to 1.8.14b4
-- Add own %%{_tmpfilesdir}/sudo.conf
-
-* Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.12-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
-* Wed Feb 18 2015 Daniel Kopecek <dkopecek@redhat.com> - 1.8.12
-- update to 1.8.12
-- fixes CVE-2014-9680
-
-* Mon Nov  3 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.11p2-1
-- update to 1.8.11p2
-- added patch to fix upstream bug #671 -- exiting immediately
-  when audit is disabled
-
-* Tue Sep 30 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.11-1
-- update to 1.8.11
-- major changes & fixes:
-  - when running a command in the background, sudo will now forward
-    SIGINFO to the command
-  - the passwords in ldap.conf and ldap.secret may now be encoded in base64.
-  - SELinux role changes are now audited. For sudoedit, we now audit
-    the actual editor being run, instead of just the sudoedit command.
-  - it is now possible to match an environment variable's value as well as
-    its name using env_keep and env_check
-  - new files created via sudoedit as a non-root user now have the proper group id
-  - sudoedit now works correctly in conjunction with sudo's SELinux RBAC support
-  - it is now possible to disable network interface probing in sudo.conf by
-    changing the value of the probe_interfaces setting
-  - when listing a user's privileges (sudo -l), the sudoers plugin will now prompt
-    for the user's password even if the targetpw, rootpw or runaspw options are set.
-  - the new use_netgroups sudoers option can be used to explicitly enable or disable
-    netgroups support
-  - visudo can now export a sudoers file in JSON format using the new -x flag
-- added patch to read ldap.conf more closely to nss_ldap
-- require /usr/bin/vi instead of vim-minimal
-- include pam.d/system-auth in PAM session phase from pam.d/sudo
-- include pam.d/sudo in PAM session phase from pam.d/sudo-i
-
-* Tue Aug  5 2014 Tom Callaway <spot@fedoraproject.org> - 1.8.8-6
-- fix license handling
-
-* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.8-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Sat May 31 2014 Peter Robinson <pbrobinson@fedoraproject.org> 1.8.8-4
-- Drop ChangeLog, we ship NEWS
-
-* Mon Mar 10 2014 Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-3
-- remove bundled copy of zlib before compilation
-- drop the requiretty Defaults setting from sudoers
-
-* Sat Jan 25 2014 Ville Skyttä <ville.skytta@iki.fi> - 1.8.8-2
-- Own the %%{_libexecdir}/sudo dir.
-
-* Mon Sep 30 2013 Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-1
-- update to 1.8.8
-- major changes & fixes:
-  - LDAP SASL support now works properly with Kerberos
-  - root may no longer change its SELinux role without entering a password
-  - user messages are now always displayed in the user's locale, even when
-    the same message is being logged or mailed in a different locale.
-  - log files created by sudo now explicitly have the group set to group
-    ID 0 rather than relying on BSD group semantics
-  - sudo now stores its libexec files in a sudo subdirectory instead of in
-    libexec itself
-  - system_group and group_file sudoers group provider plugins are now
-    installed by default
-  - the paths to ldap.conf and ldap.secret may now be specified as arguments
-    to the sudoers plugin in the sudo.conf file
-  - ...and many new features and settings. See the upstream ChangeLog for the
-    full list.
-- several sssd support fixes
-- added patch to make uid/gid specification parsing more strict (don't accept
-  an invalid number as uid/gid)
-- use the _pkgdocdir macro
-  (see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs)
-- fixed several bugs found by the clang static analyzer
-- added %%post dependency on chmod
-
-* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.6p7-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
-
-* Thu Feb 28 2013 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-1
-- update to 1.8.6p7
-- fixes CVE-2013-1775 and CVE-2013-1776
-- fixed several packaging issues (thanks to ville.skytta@iki.fi)
-  - build with system zlib.
-  - let rpmbuild strip libexecdir/*.so.
-  - own the %%{_docdir}/sudo-* dir.
-  - fix some rpmlint warnings (spaces vs tabs, unescaped macros).
-  - fix bogus %%changelog dates.
-
-* Fri Feb 15 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.6p3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
-
-* Mon Nov 12 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
-- added upstream patch for a regression
-- don't include arch specific files in the -devel subpackage
-- ship only one sample plugin in the -devel subpackage
-
-* Tue Sep 25 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-1
-- update to 1.8.6p3
-- drop -pipelist patch (fixed in upstream)
-
-* Thu Sep  6 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.6-1
-- update to 1.8.6
-
-* Thu Jul 26 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-4
-- added patches that fix & improve SSSD support (thanks to pbrezina@redhat.com)
-- re-enabled SSSD support
-- removed libsss_sudo dependency
-
-* Tue Jul 24 2012 Bill Nottingham <notting@redhat.com> - 1.8.5-3
-- flip sudoers2ldif executable bit after make install, not in setup
-
-* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.5-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
-
-* Thu May 17 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-1
-- update to 1.8.5
-- fixed CVE-2012-2337
-- temporarily disabled SSSD support
-
-* Wed Feb 29 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-6
-- fixed problems with undefined symbols (rhbz#798517)
-
-* Wed Feb 22 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-5
-- SSSD patch update
-
-* Tue Feb  7 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-4
-- added SSSD support
-
-* Thu Jan 26 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-3
-- added patch for CVE-2012-0809
-
-* Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8.3p1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
-
-* Thu Nov 10 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.3p1-1
-- update to 1.8.3p1
-- disable output word wrapping if the output is piped
-
-* Wed Sep  7 2011 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.1p2-2
-- Remove execute bit from sample script in docs so we don't pull in perl
-
-* Tue Jul 12 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
-- rebase to 1.8.1p2
-- removed .sudoi patch
-- fixed typo: RELPRO -> RELRO
-- added -devel subpackage for the sudo_plugin.h header file
-- use default ldap configuration files again
-
-* Fri Jun  3 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-4
-- build with RELRO
-
-* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.4p5-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
-
-* Mon Jan 17 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-2
-- rebase to 1.7.4p5
-- fixed sudo-1.7.4p4-getgrouplist.patch
-- fixes CVE-2011-0008, CVE-2011-0010
-
-* Tue Nov 30 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-5
-- anybody in the wheel group has now root access (using password) (rhbz#656873)
-- sync configuration paths with the nss_ldap package (rhbz#652687)
-
-* Wed Sep 29 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-4
-- added upstream patch to fix rhbz#638345
-
-* Mon Sep 20 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-3
-- added patch for #635250
-- /var/run/sudo -> /var/db/sudo in .spec
-
-* Tue Sep  7 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-2
-- sudo now uses /var/db/sudo for timestamps
-
-* Tue Sep  7 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-1
-- update to new upstream version
-- new command available: sudoreplay
-- use native audit support
-- corrected license field value: BSD -> ISC
-
-* Wed Jun  2 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-2
-- added patch that fixes insufficient environment sanitization issue (#598154)
-
-* Wed Apr 14 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-1
-- update to new upstream version
-- merged .audit and .libaudit patch
-- added sudoers.ldap.5* to files
-
-* Mon Mar  1 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p5-2
-- update to new upstream version
-
-* Tue Feb 16 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-5
-- fixed no valid sudoers sources found (#558875)
-
-* Wed Feb 10 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-4
-- audit related Makefile.in and configure.in corrections
-- added --with-audit configure option
-- removed call to libtoolize
-
-* Wed Feb 10 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-3
-- fixed segfault when #include directive is used in cycles (#561336)
-
-* Fri Jan  8 2010 Ville Skyttä <ville.skytta@iki.fi> - 1.7.2p2-2
-- Add /etc/sudoers.d dir and use it in default config (#551470).
-- Drop *.pod man page duplicates from docs.
-
-* Thu Jan 07 2010 Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
-- new upstream version 1.7.2p2-1
-- commented out unused aliases in sudoers to make visudo happy (#550239)
-
-* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.7.1-7
-- rebuilt with new audit
-
-* Thu Aug 20 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-6
-- moved secure_path from compile-time option to sudoers file (#517428)
-
-* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.1-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
-
-* Thu Jul 09 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
-- moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
-- epoch number sync
-
-* Mon Jun 22 2009 Daniel Kopecek <dkopecek@redhat.com> 1.7.1-1
-- updated sudo to version 1.7.1
-- fixed small bug in configure.in (sudo-1.7.1-conffix.patch)
-
-* Tue Feb 24 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
-- fixed building with new libtool
-- fix for incorrect handling of groups in Runas_User
-- added /usr/local/sbin to secure-path
-
-* Tue Jan 13 2009 Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-3
-- build with sendmail installed
-- Added /usr/local/bin to secure-path
-
-* Tue Sep 02 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
-- adjust audit patch, do not scream when kernel is
-  compiled without audit netlink support (#401201)
-
-* Fri Jul 04 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-1
-- upgrade
-
-* Wed Jun 18 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-7
-- build with newer autoconf-2.62 (#449614)
-
-* Tue May 13 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-6
-- compiled with secure path (#80215)
-
-* Mon May 05 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-5
-- fix path to updatedb in /etc/sudoers (#445103)
-
-* Mon Mar 31 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-4
-- include ldap files in rpm package (#439506)
-
-* Thu Mar 13 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-3
-- include [sudo] in password prompt (#437092)
-
-* Tue Mar 04 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-2
-- audit support improvement
-
-* Thu Feb 21 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p13-1
-- upgrade to the latest upstream release
-
-* Wed Feb 06 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p12-1
-- upgrade to the latest upstream release
-- add selinux support
-
-* Mon Feb 04 2008 Dennis Gilmore <dennis@ausil.us> 1.6.9p4-6
-- sparc64 needs to be in the -fPIE list with s390
-
-* Mon Jan 07 2008 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-5
-- fix complains about audit_log_user_command(): Connection
-  refused (#401201)
-
-* Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-4
-- Rebuild for deps
-
-* Wed Dec 05 2007 Release Engineering <rel-eng at fedoraproject dot org> - 1.6.9p4-3
-- Rebuild for openssl bump
-
-* Thu Aug 30 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-2
-- fix autotools stuff and add audit support
-
-* Mon Aug 20 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.9p4-1
-- upgrade to upstream release
-
-* Thu Apr 12 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-14
-- also use getgrouplist() to determine group membership (#235915)
-
-* Mon Feb 26 2007 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-13
-- fix some spec file issues
-
-* Thu Dec 14 2006 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-12
-- fix rpmlint issue
-
-* Thu Oct 26 2006 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-11
-- fix typo in sudoers file (#212308)
-
-* Sun Oct 01 2006 Jesse Keating <jkeating@redhat.com> - 1.6.8p12-10
-- rebuilt for unwind info generation, broken in gcc-4.1.1-21
-
-* Thu Sep 21 2006 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-9
-- fix sudoers file, X apps didn't work (#206320)
-
-* Tue Aug 08 2006 Peter Vrabec <pvrabec@redhat.com> 1.6.8p12-8
-- use Red Hat specific default sudoers file
-
-* Sun Jul 16 2006 Karel Zak <kzak@redhat.com> 1.6.8p12-7
-- fix #198755 - make login processes (sudo -i) initialise session keyring
-  (thanks for PAM config files to David Howells)
-- add IPv6 support (patch by Milan Zazrivec)
-
-* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.6.8p12-6.1
-- rebuild
-
-* Mon May 29 2006 Karel Zak <kzak@redhat.com> 1.6.8p12-6
-- fix #190062 - "ssh localhost sudo su" will show the password in clear
-
-* Tue May 23 2006 Karel Zak <kzak@redhat.com> 1.6.8p12-5
-- add LDAP support (#170848)
-
-* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 1.6.8p12-4.1
-- bump again for double-long bug on ppc(64)
-
-* Wed Feb  8 2006 Karel Zak <kzak@redhat.com> 1.6.8p12-4
-- reset env. by default
-
-* Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 1.6.8p12-3.1
-- rebuilt for new gcc4.1 snapshot and glibc changes
-
-* Mon Jan 23 2006 Dan Walsh <dwalsh@redhat.com> 1.6.8p12-3
-- Remove selinux patch.  It has been decided that the SELinux patch for sudo is
-- no longer necessary.  In tageted policy it had no effect.  In strict/MLS policy
-- We require the person using sudo to execute newrole before using sudo.
-
-* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
-- rebuilt
-
-* Fri Nov 25 2005 Karel Zak <kzak@redhat.com> 1.6.8p12-1
-- new upstream version 1.6.8p12
-
-* Tue Nov  8 2005 Karel Zak <kzak@redhat.com> 1.6.8p11-1
-- new upstream version 1.6.8p11
-
-* Thu Oct 13 2005 Tomas Mraz <tmraz@redhat.com> 1.6.8p9-6
-- use include instead of pam_stack in pam config
-
-* Tue Oct 11 2005 Karel Zak <kzak@redhat.com> 1.6.8p9-5
-- enable interfaces in selinux patch
-- merge sudo-1.6.8p8-sesh-stopsig.patch to selinux patch
-
-* Mon Sep 19 2005 Karel Zak <kzak@redhat.com> 1.6.8p9-4
-- fix debuginfo
-
-* Mon Sep 19 2005 Karel Zak <kzak@redhat.com> 1.6.8p9-3
-- fix #162623 - sesh hangs when child suspends
-
-* Mon Aug 1 2005 Dan Walsh <dwalsh@redhat.com> 1.6.8p9-2
-- Add back in interfaces call, SELinux has been fixed to work around
-
-* Tue Jun 21 2005 Karel Zak <kzak@redhat.com> 1.6.8p9-1
-- new version 1.6.8p9 (resolve #161116 - CAN-2005-1993 sudo trusted user arbitrary command execution)
-
-* Tue May 24 2005 Karel Zak <kzak@redhat.com> 1.6.8p8-2
-- fix #154511 - sudo does not use limits.conf
-
-* Mon Apr  4 2005 Thomas Woerner <twoerner@redhat.com> 1.6.8p8-1
-- new version 1.6.8p8: new sudoedit and sudo_noexec
-
-* Wed Feb  9 2005 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-31
-- rebuild
-
-* Mon Oct  4 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-30.1
-- added missing BuildRequires for libselinux-devel (#132883)
-
-* Wed Sep 29 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-30
-- Fix missing param error in sesh
-
-* Mon Sep 27 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-29
-- Remove full patch check from sesh
-
-* Thu Jul 8 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-28
-- Fix selinux patch to switch to root user
-
-* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Tue Apr 13 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-26
-- Eliminate tty handling from selinux
-
-* Thu Apr  1 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-25
-- fixed spec file: sesh in file section with selinux flag (#119682)
-
-* Tue Mar 30 2004 Colin Walters <walters@redhat.com> 1.6.7p5-24
-- Enhance sesh.c to fork/exec children itself, to avoid
-  having sudo reap all domains.
-- Only reinstall default signal handlers immediately before
-  exec of child with SELinux patch
-
-* Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-23
-- change to default to sysadm_r
-- Fix tty handling
-
-* Thu Mar 18 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-22
-- Add /bin/sesh to run selinux code.
-- replace /bin/bash -c with /bin/sesh
-
-* Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-21
-- Hard code to use "/bin/bash -c" for selinux
-
-* Tue Mar 16 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-20
-- Eliminate closing and reopening of terminals, to match su.
-
-* Mon Mar 15 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-19
-- SELinux fixes to make transitions work properly
-
-* Fri Mar  5 2004 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-18
-- pied sudo
-
-* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Tue Jan 27 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-16
-- Eliminate interfaces call, since this requires big SELinux privs
-- and it seems to be useless.
-
-* Tue Jan 27 2004 Karsten Hopp <karsten@redhat.de> 1.6.7p5-15
-- visudo requires vim-minimal or setting EDITOR to something useful (#68605)
-
-* Mon Jan 26 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-14
-- Fix is_selinux_enabled call
-
-* Tue Jan 13 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-13
-- Clean up patch on failure
-
-* Tue Jan 6 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-12
-- Remove sudo.te for now.
-
-* Fri Jan 2 2004 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-11
-- Fix usage message
-
-* Mon Dec 22 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-10
-- Clean up sudo.te to not blow up if pam.te not present
-
-* Thu Dec 18 2003 Thomas Woerner <twoerner@redhat.com>
-- added missing BuildRequires for groff
-
-* Tue Dec 16 2003 Jeremy Katz <katzj@redhat.com> 1.6.7p5-9
-- remove left-over debugging code
-
-* Tue Dec 16 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-8
-- Fix terminal handling that caused Sudo to exit on non selinux machines.
-
-* Mon Dec 15 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-7
-- Remove sudo_var_run_t which is now pam_var_run_t
-
-* Fri Dec 12 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-6
-- Fix terminal handling and policy
-
-* Thu Dec 11 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-5
-- Fix policy
-
-* Thu Nov 13 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-4.sel
-- Turn on SELinux support
-
-* Tue Jul 29 2003 Dan Walsh <dwalsh@redhat.com> 1.6.7p5-3
-- Add support for SELinux
-
-* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Mon May 19 2003 Thomas Woerner <twoerner@redhat.com> 1.6.7p5-1
-
-* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
-- rebuilt
-
-* Tue Nov 12 2002 Nalin Dahyabhai <nalin@redhat.com> 1.6.6-2
-- remove absolute path names from the PAM configuration, ensuring that the
-  right modules get used for whichever arch we're built for
-- don't try to install the FAQ, which isn't there any more
-
-* Thu Jun 27 2002 Bill Nottingham <notting@redhat.com> 1.6.6-1
-- update to 1.6.6
-
-* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
-- automated rebuild
-
-* Thu May 23 2002 Tim Powers <timp@redhat.com>
-- automated rebuild
-
-* Thu Apr 18 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.5p2-2
-- Fix bug #63768
-
-* Thu Mar 14 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.5p2-1
-- 1.6.5p2
-
-* Fri Jan 18 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.5p1-1
-- 1.6.5p1
-- Hope this "a new release per day" madness stops ;)
-
-* Thu Jan 17 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.5-1
-- 1.6.5
-
-* Tue Jan 15 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.4p1-1
-- 1.6.4p1
-
-* Mon Jan 14 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.4-1
-- Update to 1.6.4
-
-* Mon Jul 23 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.6.3p7-2
-- Add build requirements (#49706)
-- s/Copyright/License/
-- bzip2 source
-
-* Sat Jun 16 2001 Than Ngo <than@redhat.com>
-- update to 1.6.3p7
-- use %%{_tmppath}
-
-* Fri Feb 23 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- 1.6.3p6, fixes buffer overrun
-
-* Tue Oct 10 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- 1.6.3p5
-
-* Wed Jul 12 2000 Prospector <bugzilla@redhat.com>
-- automatic rebuild
-
-* Tue Jun 06 2000 Karsten Hopp <karsten@redhat.de>
-- fixed owner of sudo and visudo
-
-* Thu Jun  1 2000 Nalin Dahyabhai <nalin@redhat.com>
-- modify PAM setup to use system-auth
-- clean up buildrooting by using the makeinstall macro
-
-* Tue Apr 11 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- initial build in main distrib
-- update to 1.6.3
-- deal with compressed man pages
-
-* Tue Dec 14 1999 Preston Brown <pbrown@redhat.com>
-- updated to 1.6.1 for Powertools 6.2
-- config files are now noreplace.
-
-* Thu Jul 22 1999 Tim Powers <timp@redhat.com>
-- updated to 1.5.9p2 for Powertools 6.1
-
-* Wed May 12 1999 Bill Nottingham <notting@redhat.com>
-- sudo is configured with pam. There's no pam.d file. Oops.
-
-* Mon Apr 26 1999 Preston Brown <pbrown@redhat.com>
-- upgraded to 1.59p1 for powertools 6.0
-
-* Tue Oct 27 1998 Preston Brown <pbrown@redhat.com>
-- fixed so it doesn't find /usr/bin/vi first, but instead /bin/vi (always installed)
-
-* Thu Oct 08 1998 Michael Maher <mike@redhat.com>
-- built package for 5.2
-
-* Mon May 18 1998 Michael Maher <mike@redhat.com>
-- updated SPEC file
-
-* Thu Jan 29 1998 Otto Hammersmith <otto@redhat.com>
-- updated to 1.5.4
-
-* Tue Nov 18 1997 Otto Hammersmith <otto@redhat.com>
-- built for glibc, no problems
-
-* Fri Apr 25 1997 Michael Fulbright <msf@redhat.com>
-- Fixed for 4.2 PowerTools
-- Still need to be pamified
-- Still need to move stmp file to /var/log
-
-* Mon Feb 17 1997 Michael Fulbright <msf@redhat.com>
-- First version for PowerCD.
+%autochangelog

From 9c56ac9403da53f8578cfaa1422f2e14063b2dd2 Mon Sep 17 00:00:00 2001
From: Sahana Prasad <sahana@redhat.com>
Date: Tue, 14 Sep 2021 19:15:57 +0200
Subject: [PATCH 168/199] Rebuilt with OpenSSL 3.0.0


From bf29ad1a05ee6269f683e63afeb7291fd9f84f0a Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Sun, 3 Oct 2021 15:51:02 -0400
Subject: [PATCH 169/199] Update to 1.9.8p2, and include new sudo_intercept.so

---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 3 ++-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index eb540df..95a08a0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,4 @@
 /sudo-1.9.3p1.tar.gz
 /sudo-1.9.5p1.tar.gz
 /sudo-1.9.5p2.tar.gz
+/sudo-1.9.8p2.tar.gz
diff --git a/sources b/sources
index 3bae7ed..0004df8 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.7p2.tar.gz) = 39184127122014d0d1d194d455644191009835ffdcc0efda3a99028fe346ca3ff6b15341016f85029556e9f1f9deeaf83b52160effc47d1a5713affb36b99386
+SHA512 (sudo-1.9.8p2.tar.gz) = 899b252e8c219226f658dff3dd34c97b07d42004998b45175b4c0c4de42a6bf9f909598e99b4056fa1171e63378e203854b0f8608b0f5c1b00e9d3677818f6d3
diff --git a/sudo.spec b/sudo.spec
index 762cc13..6028dd8 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,6 +1,6 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.7p2
+Version: 1.9.8p2
 Release: %autorelease
 License: ISC
 URL: https://www.sudo.ws
@@ -192,6 +192,7 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
+%attr(0644,root,root) %{_libexecdir}/sudo/sudo_intercept.so
 %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
 %{_libexecdir}/sudo/libsudo_util.so.?
 %{_libexecdir}/sudo/libsudo_util.so

From b9a4f24d9542bfb531b285113b77a6bf31525db7 Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Sun, 3 Oct 2021 16:18:20 -0400
Subject: [PATCH 170/199] rhbz#1328973 -- make nano the default with fallback
 to vim and vi in that order

and make nano the "Recommends" instead of vim-minimal.
---
 sudo.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 6028dd8..bb95586 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -7,7 +7,7 @@ URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}.tar.gz
 Source1: sudoers
 Requires: pam
-Recommends: vim-minimal
+Recommends: nano
 Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release}
 
 BuildRequires: make
@@ -93,7 +93,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --with-logfac=authpriv \
         --with-pam \
         --with-pam-login \
-        --with-editor=/bin/vi \
+        --with-editor=%{_bindir}/nano:%{_bindir}/vim:%{_bindir}/vi \
         --with-env-editor \
         --with-ignore-dot \
         --with-tty-tickets \

From 206108fe35cd653fae69a004bb8e16bfea25b29c Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Wed, 6 Oct 2021 17:15:52 +0200
Subject: [PATCH 171/199] Set up update workflow with %autorelease macro

- removed stri patch that was not relevant

- intercept feature is not compatible with selinux rbac support so we
  do not build it anymore

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 sudo.spec | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index bb95586..fbadf99 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,10 +1,18 @@
+
+# comment out if no extra version
+%global extraver p2
+
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.8p2
-Release: %autorelease
+Version: 1.9.8
+# remove -b 3 after rebase !!!
+# use "-p -e % {?extraver}" when beta
+# use "-e % {?extraver}"" when patch version
+# use nothing special when normal version
+Release: %autorelease -b 3
 License: ISC
 URL: https://www.sudo.ws
-Source0: %{url}/dist/%{name}-%{version}.tar.gz
+Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz
 Source1: sudoers
 Requires: pam
 Recommends: nano
@@ -23,9 +31,6 @@ BuildRequires: sendmail
 BuildRequires: gettext
 BuildRequires: zlib-devel
 
-# don't strip
-Patch1: sudo-1.6.7p5-strip.patch
-
 %description
 Sudo (superuser do) allows a system administrator to give certain
 users (or groups of users) the ability to run some (or all) commands
@@ -66,9 +71,7 @@ BuildRequires:  python3-devel
 %{name}-python-plugin allows using sudo plugins written in Python.
 
 %prep
-%setup -q
-
-%patch1 -p1 -b .strip
+%setup -q -n %{name}-%{version}%{?extraver}
 
 %build
 # Remove bundled copy of zlib
@@ -89,6 +92,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --docdir=%{_pkgdocdir} \
 	--enable-openssl \
         --disable-root-mailer \
+        --disable-intercept \
         --with-logging=syslog \
         --with-logfac=authpriv \
         --with-pam \
@@ -192,7 +196,6 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
 %attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
-%attr(0644,root,root) %{_libexecdir}/sudo/sudo_intercept.so
 %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
 %{_libexecdir}/sudo/libsudo_util.so.?
 %{_libexecdir}/sudo/libsudo_util.so

From c3febb3692e207c7ab11d3be865d4714baf3fa66 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Wed, 6 Oct 2021 19:17:44 +0200
Subject: [PATCH 172/199] Rebuild. previously built with wrong version

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 sudo.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index fbadf99..ba67a9b 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -9,7 +9,7 @@ Version: 1.9.8
 # use "-p -e % {?extraver}" when beta
 # use "-e % {?extraver}"" when patch version
 # use nothing special when normal version
-Release: %autorelease -b 3
+Release: %autorelease -e %{?extraver} -b 3
 License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz

From 23fd9b0822dcfce0a854779b1f43beaa434a5991 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 22 Jan 2022 01:48:40 +0000
Subject: [PATCH 173/199] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>

From 4a2b9f551b84a3192c65d99bc43e912166466ed4 Mon Sep 17 00:00:00 2001
From: Matthew Miller <mattdm@mattdm.org>
Date: Mon, 6 Jun 2022 12:54:31 -0400
Subject: [PATCH 174/199] recommend system-default-editor instead of nano
 specifically

---
 sudo.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index ba67a9b..1f35743 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -15,7 +15,7 @@ URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz
 Source1: sudoers
 Requires: pam
-Recommends: nano
+Recommends: system-default-editor
 Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release}
 
 BuildRequires: make

From 7a172559a329f8ea21cd73e2547d3729abd3b4cb Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Mon, 13 Jun 2022 15:38:33 +0200
Subject: [PATCH 175/199] Rebuilt for Python 3.11


From d9475dd3d99b30ca954ca330510e09a701ebb887 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Wed, 22 Jun 2022 15:57:57 +0200
Subject: [PATCH 176/199] Update to 1.9.11p3

Resolves: rhbz#2047541
Resolves: rhbz#2062150

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 10 +++++-----
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 95a08a0..fe1779d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,4 @@
 /sudo-1.9.5p1.tar.gz
 /sudo-1.9.5p2.tar.gz
 /sudo-1.9.8p2.tar.gz
+/sudo-1.9.11p3.tar.gz
diff --git a/sources b/sources
index 0004df8..88162bb 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.8p2.tar.gz) = 899b252e8c219226f658dff3dd34c97b07d42004998b45175b4c0c4de42a6bf9f909598e99b4056fa1171e63378e203854b0f8608b0f5c1b00e9d3677818f6d3
+SHA512 (sudo-1.9.11p3.tar.gz) = ad5c3d623547d1e3016e1a721676fee6d6b7348e77b2c234041e0af40c7220e8934c8c27beef0d12fa6df11708d37de711dacfefc135d26de46abca7f91c55d1
diff --git a/sudo.spec b/sudo.spec
index 1f35743..703e52c 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,10 +1,10 @@
 
 # comment out if no extra version
-%global extraver p2
+%global extraver p3
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.8
+Version: 1.9.11
 # remove -b 3 after rebase !!!
 # use "-p -e % {?extraver}" when beta
 # use "-e % {?extraver}"" when patch version
@@ -211,13 +211,13 @@ EOF
 %dir %{_pkgdocdir}/
 %{_pkgdocdir}/*
 %{!?_licensedir:%global license %%doc}
-%license doc/LICENSE
+%license LICENSE.md
 %exclude %{_pkgdocdir}/ChangeLog
 
 %files devel
 %doc plugins/sample/sample_plugin.c
 %{_includedir}/sudo_plugin.h
-%{_mandir}/man8/sudo_plugin.8*
+%{_mandir}/man5/sudo_plugin.5*
 
 %files logsrvd
 %attr(0640,root,root) %config(noreplace) /etc/sudo_logsrvd.conf
@@ -229,7 +229,7 @@ EOF
 %{_mandir}/man8/sudo_sendlog.8.gz
 
 %files python-plugin
-%{_mandir}/man8/sudo_plugin_python.8.gz
+%{_mandir}/man5/sudo_plugin_python.5.gz
 %attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 
 %changelog

From e56d19d93d738b690fef4cb9a0ee5a40d8de6733 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 23 Jul 2022 09:34:59 +0000
Subject: [PATCH 177/199] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>

From 61dacac7f9af6e92bb128db8df856009cbd4c5be Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Thu, 19 Jan 2023 14:19:32 +0100
Subject: [PATCH 178/199] Rebase to sudo 1.9.12p2

- sudo-1.9.12p2 is available
Resolves: rhbz#2137775
- sudo: arbitrary file write with privileges of the RunAs user
Resolves: CVE-2023-22809

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 .gitignore |  1 +
 sources    |  2 +-
 sudo.spec  | 14 ++++++--------
 3 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/.gitignore b/.gitignore
index fe1779d..3d050b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,4 @@
 /sudo-1.9.5p2.tar.gz
 /sudo-1.9.8p2.tar.gz
 /sudo-1.9.11p3.tar.gz
+/sudo-1.9.12p2.tar.gz
diff --git a/sources b/sources
index 88162bb..f68ca42 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.11p3.tar.gz) = ad5c3d623547d1e3016e1a721676fee6d6b7348e77b2c234041e0af40c7220e8934c8c27beef0d12fa6df11708d37de711dacfefc135d26de46abca7f91c55d1
+SHA512 (sudo-1.9.12p2.tar.gz) = 5e035246137d5820691f7ddfc13faec3886e3cf1563ed56633667d86ab4f1306f34cc0e27808f56790b6c6a4614826e54c5b7e47b31eb009b96dde3e52170c45
diff --git a/sudo.spec b/sudo.spec
index 703e52c..f0f1e53 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,15 +1,14 @@
-
 # comment out if no extra version
-%global extraver p3
+%global extraver p2
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.11
+Version: 1.9.12
 # remove -b 3 after rebase !!!
 # use "-p -e % {?extraver}" when beta
 # use "-e % {?extraver}"" when patch version
 # use nothing special when normal version
-Release: %autorelease -e %{?extraver} -b 3
+Release: %autorelease -e %{?extraver}
 License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz
@@ -90,7 +89,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --sbindir=%{_sbindir} \
         --libdir=%{_libdir} \
         --docdir=%{_pkgdocdir} \
-	--enable-openssl \
+        --enable-openssl \
         --disable-root-mailer \
         --disable-intercept \
         --with-logging=syslog \
@@ -104,8 +103,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --with-ldap \
         --with-selinux \
         --with-passprompt="[sudo] password for %p: " \
-	--enable-python \
-	--enable-zlib=system \
+        --enable-python \
+        --enable-zlib=system \
         --with-linux-audit \
         --with-sssd
 #       --without-kerb5 \
@@ -194,7 +193,6 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so
 %attr(0644,root,root) %{_libexecdir}/sudo/audit_json.so
 %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so
-%attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so
 %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so
 %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.?
 %{_libexecdir}/sudo/libsudo_util.so.?

From 8d3c03b4da2e952682b05abc69fe7f7ba121a000 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Wed, 1 Mar 2023 17:42:19 +0100
Subject: [PATCH 179/199] Rebase to sudo 1.9.13p2

- sudo-1.9.13p2 is available
Resolves: rhbz#2169840
- sudo: double free with per-command chroot sudoers rules
Resolves: CVE-2023-27320

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 3d050b5..224d9ce 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,4 @@
 /sudo-1.9.8p2.tar.gz
 /sudo-1.9.11p3.tar.gz
 /sudo-1.9.12p2.tar.gz
+/sudo-1.9.13p2.tar.gz
diff --git a/sources b/sources
index f68ca42..d221fe6 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.12p2.tar.gz) = 5e035246137d5820691f7ddfc13faec3886e3cf1563ed56633667d86ab4f1306f34cc0e27808f56790b6c6a4614826e54c5b7e47b31eb009b96dde3e52170c45
+SHA512 (sudo-1.9.13p2.tar.gz) = b3015a114fd518afd644c9934f2461046f1116506723217603af1a952bdb436689761b4d009dfe32b725bad2e0ebcaf19db72febfaa63895ba004256fea12bef
diff --git a/sudo.spec b/sudo.spec
index f0f1e53..7a10271 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -3,7 +3,7 @@
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.12
+Version: 1.9.13
 # remove -b 3 after rebase !!!
 # use "-p -e % {?extraver}" when beta
 # use "-e % {?extraver}"" when patch version

From 025901c345374ddb0c882308c8c02fb702b306ed Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Wed, 26 Apr 2023 11:41:20 +0200
Subject: [PATCH 180/199] Port configure script to C99

Related to:

  <https://fedoraproject.org/wiki/Changes/PortingToModernC>
  <https://fedoraproject.org/wiki/Toolchain/PortingToModernC>
---
 sudo-configure-c99.patch | 65 ++++++++++++++++++++++++++++++++++++++++
 sudo.spec                |  3 +-
 2 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 sudo-configure-c99.patch

diff --git a/sudo-configure-c99.patch b/sudo-configure-c99.patch
new file mode 100644
index 0000000..69a0cd2
--- /dev/null
+++ b/sudo-configure-c99.patch
@@ -0,0 +1,65 @@
+Avoid implicit function declarations, so that the configure probe
+results do not change with future compilers.
+
+Submitted upstream for discussion:
+
+  <https://www.sudo.ws/pipermail/sudo-workers/2023-April/001387.html>
+
+
+diff --git a/configure b/configure
+index d406eb77a22d3c3c..29483788443d2b21 100755
+--- a/configure
++++ b/configure
+@@ -31220,10 +31220,13 @@ else case e in #(
+ /* end confdefs.h.  */
+ #include <sys/types.h>
+ #include <ldap.h>
++
++void *volatile ptr;
++
+ int
+ main (void)
+ {
+-(void)ldap_init(0, 0)
++ptr = (void *) ldap_msgfree
+   ;
+   return 0;
+ }
+@@ -33914,7 +33917,7 @@ then :
+ else case e in #(
+   e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+-
++#include <stdio.h>
+ 
+ int
+ main (void)
+diff --git a/m4/hardening.m4 b/m4/hardening.m4
+index f7d2a8c2911ed9d6..1ebfd9fdaf461285 100644
+--- a/m4/hardening.m4
++++ b/m4/hardening.m4
+@@ -10,7 +10,7 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [
+ 	    [sudo_cv_use_fortify_source],
+ 	    [AC_LINK_IFELSE([
+ 		    AC_LANG_PROGRAM(
+-			[[]], [[char buf[4]; (void)sprintf(buf, "%s", "foo");]]
++			[[#include <string.h>]], [[char buf[4]; (void)sprintf(buf, "%s", "foo");]]
+ 		    )],
+ 		    [sudo_cv_use_fortify_source=yes],
+ 		    [sudo_cv_use_fortify_source=no]
+diff --git a/m4/ldap.m4 b/m4/ldap.m4
+index 78c21e0bc0a1f65f..a6361df044d84f92 100644
+--- a/m4/ldap.m4
++++ b/m4/ldap.m4
+@@ -52,7 +52,10 @@ AC_DEFUN([SUDO_CHECK_LDAP], [
+ #include <lber.h>])
+ 	AC_CACHE_CHECK([whether lber.h is needed when including ldap.h], [sudo_cv_header_lber_h], [
+ 	    AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>
+-#include <ldap.h>]], [[(void)ldap_init(0, 0)]])], [
++#include <ldap.h>
++
++void *volatile ptr;
++]], [[ptr = (void *) ldap_msgfree]])], [
+ 		# No need to explicitly include lber.h when including ldap.h.
+ 		sudo_cv_header_lber_h=no
+ 	    ], [
diff --git a/sudo.spec b/sudo.spec
index 7a10271..315ea49 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -13,6 +13,7 @@ License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz
 Source1: sudoers
+Patch0: sudo-configure-c99.patch
 Requires: pam
 Recommends: system-default-editor
 Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release}
@@ -70,7 +71,7 @@ BuildRequires:  python3-devel
 %{name}-python-plugin allows using sudo plugins written in Python.
 
 %prep
-%setup -q -n %{name}-%{version}%{?extraver}
+%autosetup -p1 -n %{name}-%{version}%{?extraver}
 
 %build
 # Remove bundled copy of zlib

From 85dfa5defb283f16ce10eeab0e334265cdd65d51 Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Tue, 13 Jun 2023 20:59:29 +0200
Subject: [PATCH 181/199] Rebuilt for Python 3.12


From 06544f1ab28b4ec2d854755252fa7b1aa72ca14a Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Tue, 20 Jun 2023 14:59:34 +0200
Subject: [PATCH 182/199] - migrated to SPDX license

Signed-off-by: Radovan Sroka <rsroka@redhat.com>

From 328503ded5ac0f20a51309a87f0f65e09ee3c7ab Mon Sep 17 00:00:00 2001
From: Leigh Scott <leigh123linux@gmail.com>
Date: Thu, 6 Jul 2023 14:20:50 +0100
Subject: [PATCH 183/199] Rebuilt for Python 3.12


From 347c83287d756eddc76727ff8915a92c96c33aa2 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 22 Jul 2023 02:42:07 +0000
Subject: [PATCH 184/199] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>

From da01b87507f57dc956dcba8e559ca01d2f955458 Mon Sep 17 00:00:00 2001
From: Yaakov Selkowitz <yselkowi@redhat.com>
Date: Mon, 24 Jul 2023 22:07:19 -0400
Subject: [PATCH 185/199] Rebase to 1.9.14p3

- sudo-1_9_14p2 is available
Resolves: rhbz#2175672
- sudo fails to build with Python 3.12: FAILED: testcase check_example_group_plugin_is_able_to_debug()
Resolves: rhbz#2186412

Signed-off-by: Yaakov Selkowitz <yselkowi@redhat.com>
---
 .gitignore               |  1 +
 sources                  |  2 +-
 sudo-configure-c99.patch | 65 ----------------------------------------
 sudo.spec                |  5 ++--
 4 files changed, 4 insertions(+), 69 deletions(-)
 delete mode 100644 sudo-configure-c99.patch

diff --git a/.gitignore b/.gitignore
index 224d9ce..01b9ff5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,3 +31,4 @@
 /sudo-1.9.11p3.tar.gz
 /sudo-1.9.12p2.tar.gz
 /sudo-1.9.13p2.tar.gz
+/sudo-1.9.14p3.tar.gz
diff --git a/sources b/sources
index d221fe6..fc05228 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.13p2.tar.gz) = b3015a114fd518afd644c9934f2461046f1116506723217603af1a952bdb436689761b4d009dfe32b725bad2e0ebcaf19db72febfaa63895ba004256fea12bef
+SHA512 (sudo-1.9.14p3.tar.gz) = d4af836e3316c35d8b81a2c869ca199e8f2d5cb26dbd98b8ad031f29be62b154452afdf5a506ddabad21b80e5988a49f1f7c8f1ec44718ffcbd7e89ccbdef612
diff --git a/sudo-configure-c99.patch b/sudo-configure-c99.patch
deleted file mode 100644
index 69a0cd2..0000000
--- a/sudo-configure-c99.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-Avoid implicit function declarations, so that the configure probe
-results do not change with future compilers.
-
-Submitted upstream for discussion:
-
-  <https://www.sudo.ws/pipermail/sudo-workers/2023-April/001387.html>
-
-
-diff --git a/configure b/configure
-index d406eb77a22d3c3c..29483788443d2b21 100755
---- a/configure
-+++ b/configure
-@@ -31220,10 +31220,13 @@ else case e in #(
- /* end confdefs.h.  */
- #include <sys/types.h>
- #include <ldap.h>
-+
-+void *volatile ptr;
-+
- int
- main (void)
- {
--(void)ldap_init(0, 0)
-+ptr = (void *) ldap_msgfree
-   ;
-   return 0;
- }
-@@ -33914,7 +33917,7 @@ then :
- else case e in #(
-   e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h.  */
--
-+#include <stdio.h>
- 
- int
- main (void)
-diff --git a/m4/hardening.m4 b/m4/hardening.m4
-index f7d2a8c2911ed9d6..1ebfd9fdaf461285 100644
---- a/m4/hardening.m4
-+++ b/m4/hardening.m4
-@@ -10,7 +10,7 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [
- 	    [sudo_cv_use_fortify_source],
- 	    [AC_LINK_IFELSE([
- 		    AC_LANG_PROGRAM(
--			[[]], [[char buf[4]; (void)sprintf(buf, "%s", "foo");]]
-+			[[#include <string.h>]], [[char buf[4]; (void)sprintf(buf, "%s", "foo");]]
- 		    )],
- 		    [sudo_cv_use_fortify_source=yes],
- 		    [sudo_cv_use_fortify_source=no]
-diff --git a/m4/ldap.m4 b/m4/ldap.m4
-index 78c21e0bc0a1f65f..a6361df044d84f92 100644
---- a/m4/ldap.m4
-+++ b/m4/ldap.m4
-@@ -52,7 +52,10 @@ AC_DEFUN([SUDO_CHECK_LDAP], [
- #include <lber.h>])
- 	AC_CACHE_CHECK([whether lber.h is needed when including ldap.h], [sudo_cv_header_lber_h], [
- 	    AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>
--#include <ldap.h>]], [[(void)ldap_init(0, 0)]])], [
-+#include <ldap.h>
-+
-+void *volatile ptr;
-+]], [[ptr = (void *) ldap_msgfree]])], [
- 		# No need to explicitly include lber.h when including ldap.h.
- 		sudo_cv_header_lber_h=no
- 	    ], [
diff --git a/sudo.spec b/sudo.spec
index 315ea49..3237084 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,9 +1,9 @@
 # comment out if no extra version
-%global extraver p2
+%global extraver p3
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.13
+Version: 1.9.14
 # remove -b 3 after rebase !!!
 # use "-p -e % {?extraver}" when beta
 # use "-e % {?extraver}"" when patch version
@@ -13,7 +13,6 @@ License: ISC
 URL: https://www.sudo.ws
 Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz
 Source1: sudoers
-Patch0: sudo-configure-c99.patch
 Requires: pam
 Recommends: system-default-editor
 Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release}

From 462f43c97aa9bd80e22243a82d454b8ad949c6fd Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Wed, 24 Jan 2024 10:59:51 +0100
Subject: [PATCH 186/199] Rabase to 1.9.15p5

- sudo-1_9_15p5 is available
Resolves: rhbz#2248505
- TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack
Variables
Resolves: rhbz#2255569

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 .gitignore               |  2 ++
 sources                  |  2 +-
 sudo-1.6.7p5-strip.patch | 11 -----------
 sudo.spec                |  4 ++--
 4 files changed, 5 insertions(+), 14 deletions(-)
 delete mode 100644 sudo-1.6.7p5-strip.patch

diff --git a/.gitignore b/.gitignore
index 01b9ff5..842ab45 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,3 +32,5 @@
 /sudo-1.9.12p2.tar.gz
 /sudo-1.9.13p2.tar.gz
 /sudo-1.9.14p3.tar.gz
+/sudo-1.9.15p4.tar.gz
+/sudo-1.9.15p5.tar.gz
diff --git a/sources b/sources
index fc05228..a9b6cfd 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.14p3.tar.gz) = d4af836e3316c35d8b81a2c869ca199e8f2d5cb26dbd98b8ad031f29be62b154452afdf5a506ddabad21b80e5988a49f1f7c8f1ec44718ffcbd7e89ccbdef612
+SHA512 (sudo-1.9.15p5.tar.gz) = ebac69719de2fe7bd587924701bdd24149bf376a68b17ec02f69b2b96d4bb6fa5eb8260a073ec5ea046d3ac69bb5b1c0b9d61709fe6a56f1f66e40817a70b15a
diff --git a/sudo-1.6.7p5-strip.patch b/sudo-1.6.7p5-strip.patch
deleted file mode 100644
index f690659..0000000
--- a/sudo-1.6.7p5-strip.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- sudo-1.6.7p5/scripts/install-sh.strip	2005-07-21 14:28:25.000000000 +0200
-+++ sudo-1.6.7p5/scripts/install-sh	2005-07-21 14:29:18.000000000 +0200
-@@ -138,7 +138,7 @@
- 	fi
- 	;;
-     X-s)
--	STRIPIT=true
-+	#STRIPIT=true
- 	;;
-     X--)
- 	shift
diff --git a/sudo.spec b/sudo.spec
index 3237084..e755179 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,9 +1,9 @@
 # comment out if no extra version
-%global extraver p3
+%global extraver p5
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.14
+Version: 1.9.15
 # remove -b 3 after rebase !!!
 # use "-p -e % {?extraver}" when beta
 # use "-e % {?extraver}"" when patch version

From df275faeadacae6c625a5ec30f448b01a698ddea Mon Sep 17 00:00:00 2001
From: Yaakov Selkowitz <yselkowi@redhat.com>
Date: Thu, 8 Feb 2024 16:46:56 -0500
Subject: [PATCH 187/199] Avoid sendmail build dependency

sudo should be compatible with any MTA, any of which in Fedora provide
/usr/sbin/sendmail, and is used at build time only to determine its
location.  Instead of generalizing the build requirement (e.g. for RHEL
10 which includes only postfix), we can just tell sudo its location
during configure, in which case it is not needed at all to build.

However, doing so uncovered that systemd's presence was being relied
upon without being specified.  This too can be avoided by using the
macros to define the proper tmpfiles location during configure.
---
 sudo.spec | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index e755179..e2c4ba9 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -26,7 +26,7 @@ BuildRequires: bison
 BuildRequires: libtool
 BuildRequires: audit-libs-devel libcap-devel
 BuildRequires: libselinux-devel
-BuildRequires: sendmail
+BuildRequires: systemd-rpm-macros
 BuildRequires: gettext
 BuildRequires: zlib-devel
 
@@ -89,6 +89,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --sbindir=%{_sbindir} \
         --libdir=%{_libdir} \
         --docdir=%{_pkgdocdir} \
+        --enable-tmpfiles.d=%{_tmpfilesdir} \
         --enable-openssl \
         --disable-root-mailer \
         --disable-intercept \
@@ -102,6 +103,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
         --with-tty-tickets \
         --with-ldap \
         --with-selinux \
+        --with-sendmail=/usr/sbin/sendmail \
         --with-passprompt="[sudo] password for %p: " \
         --enable-python \
         --enable-zlib=system \

From 545c191f72083b8ef9b7ce26706e8a17ca537d20 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Thu, 2 May 2024 23:09:47 -0700
Subject: [PATCH 188/199] Backport upstream fix for tests with Python 3.13+

---
 ...traces-use-in-addition-to-when-under.patch | 41 +++++++++++++++++++
 sudo.spec                                     |  6 +++
 2 files changed, 47 insertions(+)
 create mode 100644 0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch

diff --git a/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch b/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch
new file mode 100644
index 0000000..2c9ce75
--- /dev/null
+++ b/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch
@@ -0,0 +1,41 @@
+From 89918caf5a349cac4e2a56ba503d7476c6f16067 Mon Sep 17 00:00:00 2001
+From: "Todd C. Miller" <Todd.Miller@sudo.ws>
+Date: Thu, 2 May 2024 20:02:43 -0600
+Subject: [PATCH] Python 3.12 backtraces use '~' in addition to '^' when
+ underlining. GitHub issue #374
+
+---
+ plugins/python/regress/testhelpers.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/plugins/python/regress/testhelpers.c b/plugins/python/regress/testhelpers.c
+index ee55fb901..0f28d01e9 100644
+--- a/plugins/python/regress/testhelpers.c
++++ b/plugins/python/regress/testhelpers.c
+@@ -27,19 +27,19 @@ struct TestData data;
+ 
+ /*
+  * Starting with Python 3.11, backtraces may contain a line with
+- * '^' characters to bring attention to the important part of the
+- * line.
++ * '~' and '^' characters to bring attention to the important part
++ * of the line.
+  */
+ static void
+ remove_underline(char *output)
+ {
+     char *cp, *ep;
+ 
+-    // Remove lines that only consist of '^' and white space.
++    // Remove lines that only consist of '~', '^' and white space.
+     cp = output;
+     ep = output + strlen(output);
+     for (;;) {
+-	size_t len = strspn(cp, "^ \t");
++	size_t len = strspn(cp, "~^ \t");
+ 	if (len > 0 && cp[len] == '\n') {
+ 	    /* Prune out lines that are "underlining". */
+ 	    memmove(cp, cp + len + 1, (size_t)(ep - cp));
+-- 
+2.44.0
+
diff --git a/sudo.spec b/sudo.spec
index e2c4ba9..6f483cb 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -17,6 +17,12 @@ Requires: pam
 Recommends: system-default-editor
 Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release}
 
+# https://github.com/sudo-project/sudo/commit/89918caf5a349cac4e2a56ba503d7476c6f16067
+# https://github.com/sudo-project/sudo/issues/374
+# https://bugzilla.redhat.com/show_bug.cgi?id=2245820
+# Fix tests with Python 3.13+
+Patch: 0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch
+
 BuildRequires: make
 BuildRequires: pam-devel
 BuildRequires: groff

From 47db28a6937258900d879ee298e681ff7708d750 Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Fri, 7 Jun 2024 09:11:33 +0200
Subject: [PATCH 189/199] Rebuilt for Python 3.13


From f5682491133aea55fb176ca8c381afd8bb1dc411 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 20 Jul 2024 06:36:47 +0000
Subject: [PATCH 190/199] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild


From ac16a17374c5799d7f570330d5e9c72291bb8466 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sun, 19 Jan 2025 11:50:30 +0000
Subject: [PATCH 191/199] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild


From e2e397029e0d35046a4cf891e075d24c7540da4f Mon Sep 17 00:00:00 2001
From: Yaakov Selkowitz <yselkowi@redhat.com>
Date: Wed, 26 Feb 2025 12:59:14 -0500
Subject: [PATCH 192/199] Fix build with GCC 15

GCC 15 defaults to C23, which changes the interpretation of function
declarations without parameters to be `void` rather than of an unknown
number and type (as in K&R).  The sudoers plugin relies on the older
behaviour for its hook functions.
---
 sudo.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sudo.spec b/sudo.spec
index 6f483cb..4175d8c 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -88,7 +88,7 @@ F_PIE=-fPIE
 F_PIE=-fpie
 %endif
 
-export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
+export CFLAGS="$RPM_OPT_FLAGS $F_PIE -std=gnu17" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
 
 %configure \
         --prefix=%{_prefix} \

From 770b8e2647c61512b8508c61bb3a55318f31d9b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Tue, 24 Sep 2024 16:46:11 +0200
Subject: [PATCH 193/199] Move yum/dnf protection removal config file under
 /usr

https://github.com/uapi-group/specifications/issues/76

Actually, add a new file under /usr, but keep the old file in /etc
because it's still needed for dnf. The new file in the new location
is useful because it means that we get the correct behaviour even when
/etc is emptied (on systems with new dnf version).

dnf5 reads the new location:
https://github.com/rpm-software-management/dnf5/issues/1107
https://github.com/rpm-software-management/dnf5/pull/1110
---
 sudo.spec | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 6f483cb..63fb36f 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -131,12 +131,15 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured
 install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d
 install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers
-#add sudo to protected packages
-install -p -d -m 755 $RPM_BUILD_ROOT/etc/dnf/protected.d/
-touch sudo.conf
-echo sudo > sudo.conf
-install -p -c -m 0644 sudo.conf $RPM_BUILD_ROOT/etc/dnf/protected.d/
-rm -f sudo.conf
+# Add sudo to protected packages. Old location for yum/dnf.
+mkdir -p $RPM_BUILD_ROOT/etc/dnf/protected.d/
+echo "sudo" >$RPM_BUILD_ROOT/etc/dnf/protected.d/sudo.conf
+# Add sudo to protected packages. New location for dnf5.
+mkdir -p $RPM_BUILD_ROOT/usr/share/dnf5/libdnf.conf.d/
+cat >$RPM_BUILD_ROOT/usr/share/dnf5/libdnf.conf.d/protect-sudo.conf <<EOF
+[main]
+protected_packages = sudo
+EOF
 
 chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%files
 
@@ -188,6 +191,9 @@ EOF
 %attr(0644,root,root) %{_tmpfilesdir}/sudo.conf
 %attr(0644,root,root) %config(noreplace) /etc/dnf/protected.d/sudo.conf
 %attr(0640,root,root) %config(noreplace) /etc/sudo.conf
+%dir /usr/share/dnf5
+%dir /usr/share/dnf5/libdnf.conf.d
+/usr/share/dnf5/libdnf.conf.d/protect-sudo.conf
 %dir /var/db/sudo
 %dir /var/db/sudo/lectured
 %attr(4111,root,root) %{_bindir}/sudo

From aa37372f8a7966e1ddff3c15473ba092bbf0fa59 Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Mon, 2 Jun 2025 20:53:02 +0200
Subject: [PATCH 194/199] Rebuilt for Python 3.14


From 9641cbaa6b0934d03f4e0398261eef8509f282dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
Date: Sat, 5 Jul 2025 11:46:27 +0200
Subject: [PATCH 195/199] Rebase to sudo 1.9.17p1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

    - sudo-1_9_16p2 is available
    Resolves: rhbz#2309626
    - sudo: LPE via host option
    Resolves: CVE-2025-32462
    - Properly apply system buildflags
    - Use new build macros, drop unneeded %%defattr

Signed-off-by: Björn Esser <besser82@fedoraproject.org>
---
 .gitignore                                    |  1 +
 ...traces-use-in-addition-to-when-under.patch | 41 -------------------
 sources                                       |  2 +-
 sudo.spec                                     | 26 +++---------
 4 files changed, 7 insertions(+), 63 deletions(-)
 delete mode 100644 0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch

diff --git a/.gitignore b/.gitignore
index 842ab45..e4940ce 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,4 @@
 /sudo-1.9.14p3.tar.gz
 /sudo-1.9.15p4.tar.gz
 /sudo-1.9.15p5.tar.gz
+/sudo-1.9.17p1.tar.gz
diff --git a/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch b/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch
deleted file mode 100644
index 2c9ce75..0000000
--- a/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 89918caf5a349cac4e2a56ba503d7476c6f16067 Mon Sep 17 00:00:00 2001
-From: "Todd C. Miller" <Todd.Miller@sudo.ws>
-Date: Thu, 2 May 2024 20:02:43 -0600
-Subject: [PATCH] Python 3.12 backtraces use '~' in addition to '^' when
- underlining. GitHub issue #374
-
----
- plugins/python/regress/testhelpers.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/plugins/python/regress/testhelpers.c b/plugins/python/regress/testhelpers.c
-index ee55fb901..0f28d01e9 100644
---- a/plugins/python/regress/testhelpers.c
-+++ b/plugins/python/regress/testhelpers.c
-@@ -27,19 +27,19 @@ struct TestData data;
- 
- /*
-  * Starting with Python 3.11, backtraces may contain a line with
-- * '^' characters to bring attention to the important part of the
-- * line.
-+ * '~' and '^' characters to bring attention to the important part
-+ * of the line.
-  */
- static void
- remove_underline(char *output)
- {
-     char *cp, *ep;
- 
--    // Remove lines that only consist of '^' and white space.
-+    // Remove lines that only consist of '~', '^' and white space.
-     cp = output;
-     ep = output + strlen(output);
-     for (;;) {
--	size_t len = strspn(cp, "^ \t");
-+	size_t len = strspn(cp, "~^ \t");
- 	if (len > 0 && cp[len] == '\n') {
- 	    /* Prune out lines that are "underlining". */
- 	    memmove(cp, cp + len + 1, (size_t)(ep - cp));
--- 
-2.44.0
-
diff --git a/sources b/sources
index a9b6cfd..86f8d45 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.15p5.tar.gz) = ebac69719de2fe7bd587924701bdd24149bf376a68b17ec02f69b2b96d4bb6fa5eb8260a073ec5ea046d3ac69bb5b1c0b9d61709fe6a56f1f66e40817a70b15a
+SHA512 (sudo-1.9.17p1.tar.gz) = 1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc
diff --git a/sudo.spec b/sudo.spec
index 4175d8c..73b3930 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,9 +1,9 @@
 # comment out if no extra version
-%global extraver p5
+%global extraver p1
 
 Summary: Allows restricted root access for specified users
 Name: sudo
-Version: 1.9.15
+Version: 1.9.17
 # remove -b 3 after rebase !!!
 # use "-p -e % {?extraver}" when beta
 # use "-e % {?extraver}"" when patch version
@@ -17,12 +17,6 @@ Requires: pam
 Recommends: system-default-editor
 Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release}
 
-# https://github.com/sudo-project/sudo/commit/89918caf5a349cac4e2a56ba503d7476c6f16067
-# https://github.com/sudo-project/sudo/issues/374
-# https://bugzilla.redhat.com/show_bug.cgi?id=2245820
-# Fix tests with Python 3.13+
-Patch: 0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch
-
 BuildRequires: make
 BuildRequires: pam-devel
 BuildRequires: groff
@@ -82,14 +76,6 @@ BuildRequires:  python3-devel
 # Remove bundled copy of zlib
 rm -rf zlib/
 
-%ifarch s390 s390x sparc64
-F_PIE=-fPIE
-%else
-F_PIE=-fpie
-%endif
-
-export CFLAGS="$RPM_OPT_FLAGS $F_PIE -std=gnu17" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
-
 %configure \
         --prefix=%{_prefix} \
         --sbindir=%{_sbindir} \
@@ -117,14 +103,13 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE -std=gnu17" LDFLAGS="-pie -Wl,-z,relro -Wl,
         --with-sssd
 #       --without-kerb5 \
 #       --without-kerb4
-make
+%make_build
 
 %check
-make check
+%make_build check
 
 %install
-rm -rf $RPM_BUILD_ROOT
-make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
+%make_install install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g`
 
 chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/*
 install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo
@@ -180,7 +165,6 @@ EOF
 
 
 %files -f sudo_all.lang
-%defattr(-,root,root)
 %attr(0440,root,root) %config(noreplace) /etc/sudoers
 %attr(0750,root,root) %dir /etc/sudoers.d/
 %config(noreplace) /etc/pam.d/sudo

From 04179b541723d5914c5ce01021dd7a2a7a68eaf6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
Date: Sat, 5 Jul 2025 12:22:08 +0200
Subject: [PATCH 196/199] Re-apply changes from commit
 e2e397029e0d35046a4cf891e075d24c7540da4f
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Björn Esser <besser82@fedoraproject.org>
---
 sudo.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sudo.spec b/sudo.spec
index 73b3930..9e72bb5 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -76,6 +76,8 @@ BuildRequires:  python3-devel
 # Remove bundled copy of zlib
 rm -rf zlib/
 
+export CFLAGS="$RPM_OPT_FLAGS -std=gnu17"
+
 %configure \
         --prefix=%{_prefix} \
         --sbindir=%{_sbindir} \

From 1899e2aa8d10783369a1d840c2fc30cf86a6e782 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
Date: Mon, 7 Jul 2025 13:10:49 +0200
Subject: [PATCH 197/199] Drop '-std=gnu17' from CFLAGS, as C23 builds fine now
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This was introduced in commit e2e397029e0d35046a4cf891e075d24c7540da4f
for an older version of sudo that was FTBFS for GCC 15 defaulting to C23.

Signed-off-by: Björn Esser <besser82@fedoraproject.org>
---
 sudo.spec | 2 --
 1 file changed, 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 9e72bb5..73b3930 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -76,8 +76,6 @@ BuildRequires:  python3-devel
 # Remove bundled copy of zlib
 rm -rf zlib/
 
-export CFLAGS="$RPM_OPT_FLAGS -std=gnu17"
-
 %configure \
         --prefix=%{_prefix} \
         --sbindir=%{_sbindir} \

From 81e84c1f0692ac90603c7cbeaeeb2b891a852e45 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 25 Jul 2025 18:50:05 +0000
Subject: [PATCH 198/199] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild


From 2ead99a2b1915e06b2918b5547d0587fbe678e0e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= <allopez@redhat.com>
Date: Tue, 21 Oct 2025 10:16:55 +0200
Subject: [PATCH 199/199] Rebase to 1.9.17p2

- sudo-1.9.17p2 is available
  Resolves: rhbz#2383665
---
 .gitignore | 1 +
 sources    | 2 +-
 sudo.spec  | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index e4940ce..b0986fa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,4 @@
 /sudo-1.9.15p4.tar.gz
 /sudo-1.9.15p5.tar.gz
 /sudo-1.9.17p1.tar.gz
+/sudo-1.9.17p2.tar.gz
diff --git a/sources b/sources
index 86f8d45..54e59ea 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sudo-1.9.17p1.tar.gz) = 1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc
+SHA512 (sudo-1.9.17p2.tar.gz) = c8abd6ca56e54a081c9ef1e9f6579d1db5b93ff857e60d1f58d1f425d7dc23c31c58d40b7819780688f66dfdf87a1f3bbe0a78387b007e2beb1b0e546203ea93
diff --git a/sudo.spec b/sudo.spec
index e321ec4..be44d00 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,5 +1,5 @@
 # comment out if no extra version
-%global extraver p1
+%global extraver p2
 
 Summary: Allows restricted root access for specified users
 Name: sudo