From 61dacac7f9af6e92bb128db8df856009cbd4c5be Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Thu, 19 Jan 2023 14:19:32 +0100 Subject: [PATCH 01/24] Rebase to sudo 1.9.12p2 - sudo-1.9.12p2 is available Resolves: rhbz#2137775 - sudo: arbitrary file write with privileges of the RunAs user Resolves: CVE-2023-22809 Signed-off-by: Radovan Sroka --- .gitignore | 1 + sources | 2 +- sudo.spec | 14 ++++++-------- 3 files changed, 8 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index fe1779d..3d050b5 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ /sudo-1.9.5p2.tar.gz /sudo-1.9.8p2.tar.gz /sudo-1.9.11p3.tar.gz +/sudo-1.9.12p2.tar.gz diff --git a/sources b/sources index 88162bb..f68ca42 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.9.11p3.tar.gz) = ad5c3d623547d1e3016e1a721676fee6d6b7348e77b2c234041e0af40c7220e8934c8c27beef0d12fa6df11708d37de711dacfefc135d26de46abca7f91c55d1 +SHA512 (sudo-1.9.12p2.tar.gz) = 5e035246137d5820691f7ddfc13faec3886e3cf1563ed56633667d86ab4f1306f34cc0e27808f56790b6c6a4614826e54c5b7e47b31eb009b96dde3e52170c45 diff --git a/sudo.spec b/sudo.spec index 703e52c..f0f1e53 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,15 +1,14 @@ - # comment out if no extra version -%global extraver p3 +%global extraver p2 Summary: Allows restricted root access for specified users Name: sudo -Version: 1.9.11 +Version: 1.9.12 # remove -b 3 after rebase !!! # use "-p -e % {?extraver}" when beta # use "-e % {?extraver}"" when patch version # use nothing special when normal version -Release: %autorelease -e %{?extraver} -b 3 +Release: %autorelease -e %{?extraver} License: ISC URL: https://www.sudo.ws Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz @@ -90,7 +89,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --sbindir=%{_sbindir} \ --libdir=%{_libdir} \ --docdir=%{_pkgdocdir} \ - --enable-openssl \ + --enable-openssl \ --disable-root-mailer \ --disable-intercept \ --with-logging=syslog \ @@ -104,8 +103,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --with-ldap \ --with-selinux \ --with-passprompt="[sudo] password for %p: " \ - --enable-python \ - --enable-zlib=system \ + --enable-python \ + --enable-zlib=system \ --with-linux-audit \ --with-sssd # --without-kerb5 \ @@ -194,7 +193,6 @@ EOF %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so %attr(0644,root,root) %{_libexecdir}/sudo/audit_json.so %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so -%attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.? %{_libexecdir}/sudo/libsudo_util.so.? From 7a333e0b720ec8ceb0dbe63a3e3d8f412fbaec76 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Thu, 19 Jan 2023 14:19:32 +0100 Subject: [PATCH 02/24] Rebase to sudo 1.9.12p2 - sudo-1.9.12p2 is available Resolves: rhbz#2137775 - sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Resolves: rhbz#2162042 Signed-off-by: Radovan Sroka --- .gitignore | 1 + sources | 2 +- sudo.spec | 14 ++++++-------- 3 files changed, 8 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index fe1779d..3d050b5 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ /sudo-1.9.5p2.tar.gz /sudo-1.9.8p2.tar.gz /sudo-1.9.11p3.tar.gz +/sudo-1.9.12p2.tar.gz diff --git a/sources b/sources index 88162bb..f68ca42 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.9.11p3.tar.gz) = ad5c3d623547d1e3016e1a721676fee6d6b7348e77b2c234041e0af40c7220e8934c8c27beef0d12fa6df11708d37de711dacfefc135d26de46abca7f91c55d1 +SHA512 (sudo-1.9.12p2.tar.gz) = 5e035246137d5820691f7ddfc13faec3886e3cf1563ed56633667d86ab4f1306f34cc0e27808f56790b6c6a4614826e54c5b7e47b31eb009b96dde3e52170c45 diff --git a/sudo.spec b/sudo.spec index 703e52c..f0f1e53 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,15 +1,14 @@ - # comment out if no extra version -%global extraver p3 +%global extraver p2 Summary: Allows restricted root access for specified users Name: sudo -Version: 1.9.11 +Version: 1.9.12 # remove -b 3 after rebase !!! # use "-p -e % {?extraver}" when beta # use "-e % {?extraver}"" when patch version # use nothing special when normal version -Release: %autorelease -e %{?extraver} -b 3 +Release: %autorelease -e %{?extraver} License: ISC URL: https://www.sudo.ws Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz @@ -90,7 +89,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --sbindir=%{_sbindir} \ --libdir=%{_libdir} \ --docdir=%{_pkgdocdir} \ - --enable-openssl \ + --enable-openssl \ --disable-root-mailer \ --disable-intercept \ --with-logging=syslog \ @@ -104,8 +103,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --with-ldap \ --with-selinux \ --with-passprompt="[sudo] password for %p: " \ - --enable-python \ - --enable-zlib=system \ + --enable-python \ + --enable-zlib=system \ --with-linux-audit \ --with-sssd # --without-kerb5 \ @@ -194,7 +193,6 @@ EOF %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so %attr(0644,root,root) %{_libexecdir}/sudo/audit_json.so %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so -%attr(0644,root,root) %{_libexecdir}/sudo/sample_approval.so %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.? %{_libexecdir}/sudo/libsudo_util.so.? From 8d3c03b4da2e952682b05abc69fe7f7ba121a000 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 1 Mar 2023 17:42:19 +0100 Subject: [PATCH 03/24] Rebase to sudo 1.9.13p2 - sudo-1.9.13p2 is available Resolves: rhbz#2169840 - sudo: double free with per-command chroot sudoers rules Resolves: CVE-2023-27320 Signed-off-by: Radovan Sroka --- .gitignore | 1 + sources | 2 +- sudo.spec | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 3d050b5..224d9ce 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ /sudo-1.9.8p2.tar.gz /sudo-1.9.11p3.tar.gz /sudo-1.9.12p2.tar.gz +/sudo-1.9.13p2.tar.gz diff --git a/sources b/sources index f68ca42..d221fe6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.9.12p2.tar.gz) = 5e035246137d5820691f7ddfc13faec3886e3cf1563ed56633667d86ab4f1306f34cc0e27808f56790b6c6a4614826e54c5b7e47b31eb009b96dde3e52170c45 +SHA512 (sudo-1.9.13p2.tar.gz) = b3015a114fd518afd644c9934f2461046f1116506723217603af1a952bdb436689761b4d009dfe32b725bad2e0ebcaf19db72febfaa63895ba004256fea12bef diff --git a/sudo.spec b/sudo.spec index f0f1e53..7a10271 100644 --- a/sudo.spec +++ b/sudo.spec @@ -3,7 +3,7 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.9.12 +Version: 1.9.13 # remove -b 3 after rebase !!! # use "-p -e % {?extraver}" when beta # use "-e % {?extraver}"" when patch version From 559f4b66bed06619fe37e80cfedf6d68c8de1319 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 1 Mar 2023 17:42:19 +0100 Subject: [PATCH 04/24] Rebase to sudo 1.9.13p2 - sudo-1.9.13p2 is available Resolves: rhbz#2169840 - sudo: double free with per-command chroot sudoers rules Resolves: CVE-2023-27320 Signed-off-by: Radovan Sroka --- .gitignore | 1 + sources | 2 +- sudo.spec | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 3d050b5..224d9ce 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ /sudo-1.9.8p2.tar.gz /sudo-1.9.11p3.tar.gz /sudo-1.9.12p2.tar.gz +/sudo-1.9.13p2.tar.gz diff --git a/sources b/sources index f68ca42..d221fe6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.9.12p2.tar.gz) = 5e035246137d5820691f7ddfc13faec3886e3cf1563ed56633667d86ab4f1306f34cc0e27808f56790b6c6a4614826e54c5b7e47b31eb009b96dde3e52170c45 +SHA512 (sudo-1.9.13p2.tar.gz) = b3015a114fd518afd644c9934f2461046f1116506723217603af1a952bdb436689761b4d009dfe32b725bad2e0ebcaf19db72febfaa63895ba004256fea12bef diff --git a/sudo.spec b/sudo.spec index f0f1e53..7a10271 100644 --- a/sudo.spec +++ b/sudo.spec @@ -3,7 +3,7 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.9.12 +Version: 1.9.13 # remove -b 3 after rebase !!! # use "-p -e % {?extraver}" when beta # use "-e % {?extraver}"" when patch version From 025901c345374ddb0c882308c8c02fb702b306ed Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Wed, 26 Apr 2023 11:41:20 +0200 Subject: [PATCH 05/24] Port configure script to C99 Related to: --- sudo-configure-c99.patch | 65 ++++++++++++++++++++++++++++++++++++++++ sudo.spec | 3 +- 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 sudo-configure-c99.patch diff --git a/sudo-configure-c99.patch b/sudo-configure-c99.patch new file mode 100644 index 0000000..69a0cd2 --- /dev/null +++ b/sudo-configure-c99.patch @@ -0,0 +1,65 @@ +Avoid implicit function declarations, so that the configure probe +results do not change with future compilers. + +Submitted upstream for discussion: + + + + +diff --git a/configure b/configure +index d406eb77a22d3c3c..29483788443d2b21 100755 +--- a/configure ++++ b/configure +@@ -31220,10 +31220,13 @@ else case e in #( + /* end confdefs.h. */ + #include + #include ++ ++void *volatile ptr; ++ + int + main (void) + { +-(void)ldap_init(0, 0) ++ptr = (void *) ldap_msgfree + ; + return 0; + } +@@ -33914,7 +33917,7 @@ then : + else case e in #( + e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ +- ++#include + + int + main (void) +diff --git a/m4/hardening.m4 b/m4/hardening.m4 +index f7d2a8c2911ed9d6..1ebfd9fdaf461285 100644 +--- a/m4/hardening.m4 ++++ b/m4/hardening.m4 +@@ -10,7 +10,7 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [ + [sudo_cv_use_fortify_source], + [AC_LINK_IFELSE([ + AC_LANG_PROGRAM( +- [[]], [[char buf[4]; (void)sprintf(buf, "%s", "foo");]] ++ [[#include ]], [[char buf[4]; (void)sprintf(buf, "%s", "foo");]] + )], + [sudo_cv_use_fortify_source=yes], + [sudo_cv_use_fortify_source=no] +diff --git a/m4/ldap.m4 b/m4/ldap.m4 +index 78c21e0bc0a1f65f..a6361df044d84f92 100644 +--- a/m4/ldap.m4 ++++ b/m4/ldap.m4 +@@ -52,7 +52,10 @@ AC_DEFUN([SUDO_CHECK_LDAP], [ + #include ]) + AC_CACHE_CHECK([whether lber.h is needed when including ldap.h], [sudo_cv_header_lber_h], [ + AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include +-#include ]], [[(void)ldap_init(0, 0)]])], [ ++#include ++ ++void *volatile ptr; ++]], [[ptr = (void *) ldap_msgfree]])], [ + # No need to explicitly include lber.h when including ldap.h. + sudo_cv_header_lber_h=no + ], [ diff --git a/sudo.spec b/sudo.spec index 7a10271..315ea49 100644 --- a/sudo.spec +++ b/sudo.spec @@ -13,6 +13,7 @@ License: ISC URL: https://www.sudo.ws Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz Source1: sudoers +Patch0: sudo-configure-c99.patch Requires: pam Recommends: system-default-editor Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release} @@ -70,7 +71,7 @@ BuildRequires: python3-devel %{name}-python-plugin allows using sudo plugins written in Python. %prep -%setup -q -n %{name}-%{version}%{?extraver} +%autosetup -p1 -n %{name}-%{version}%{?extraver} %build # Remove bundled copy of zlib From 85dfa5defb283f16ce10eeab0e334265cdd65d51 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Tue, 13 Jun 2023 20:59:29 +0200 Subject: [PATCH 06/24] Rebuilt for Python 3.12 From 06544f1ab28b4ec2d854755252fa7b1aa72ca14a Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Tue, 20 Jun 2023 14:59:34 +0200 Subject: [PATCH 07/24] - migrated to SPDX license Signed-off-by: Radovan Sroka From 328503ded5ac0f20a51309a87f0f65e09ee3c7ab Mon Sep 17 00:00:00 2001 From: Leigh Scott Date: Thu, 6 Jul 2023 14:20:50 +0100 Subject: [PATCH 08/24] Rebuilt for Python 3.12 From 347c83287d756eddc76727ff8915a92c96c33aa2 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 02:42:07 +0000 Subject: [PATCH 09/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering From da01b87507f57dc956dcba8e559ca01d2f955458 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 24 Jul 2023 22:07:19 -0400 Subject: [PATCH 10/24] Rebase to 1.9.14p3 - sudo-1_9_14p2 is available Resolves: rhbz#2175672 - sudo fails to build with Python 3.12: FAILED: testcase check_example_group_plugin_is_able_to_debug() Resolves: rhbz#2186412 Signed-off-by: Yaakov Selkowitz --- .gitignore | 1 + sources | 2 +- sudo-configure-c99.patch | 65 ---------------------------------------- sudo.spec | 5 ++-- 4 files changed, 4 insertions(+), 69 deletions(-) delete mode 100644 sudo-configure-c99.patch diff --git a/.gitignore b/.gitignore index 224d9ce..01b9ff5 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,4 @@ /sudo-1.9.11p3.tar.gz /sudo-1.9.12p2.tar.gz /sudo-1.9.13p2.tar.gz +/sudo-1.9.14p3.tar.gz diff --git a/sources b/sources index d221fe6..fc05228 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.9.13p2.tar.gz) = b3015a114fd518afd644c9934f2461046f1116506723217603af1a952bdb436689761b4d009dfe32b725bad2e0ebcaf19db72febfaa63895ba004256fea12bef +SHA512 (sudo-1.9.14p3.tar.gz) = d4af836e3316c35d8b81a2c869ca199e8f2d5cb26dbd98b8ad031f29be62b154452afdf5a506ddabad21b80e5988a49f1f7c8f1ec44718ffcbd7e89ccbdef612 diff --git a/sudo-configure-c99.patch b/sudo-configure-c99.patch deleted file mode 100644 index 69a0cd2..0000000 --- a/sudo-configure-c99.patch +++ /dev/null @@ -1,65 +0,0 @@ -Avoid implicit function declarations, so that the configure probe -results do not change with future compilers. - -Submitted upstream for discussion: - - - - -diff --git a/configure b/configure -index d406eb77a22d3c3c..29483788443d2b21 100755 ---- a/configure -+++ b/configure -@@ -31220,10 +31220,13 @@ else case e in #( - /* end confdefs.h. */ - #include - #include -+ -+void *volatile ptr; -+ - int - main (void) - { --(void)ldap_init(0, 0) -+ptr = (void *) ldap_msgfree - ; - return 0; - } -@@ -33914,7 +33917,7 @@ then : - else case e in #( - e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext - /* end confdefs.h. */ -- -+#include - - int - main (void) -diff --git a/m4/hardening.m4 b/m4/hardening.m4 -index f7d2a8c2911ed9d6..1ebfd9fdaf461285 100644 ---- a/m4/hardening.m4 -+++ b/m4/hardening.m4 -@@ -10,7 +10,7 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [ - [sudo_cv_use_fortify_source], - [AC_LINK_IFELSE([ - AC_LANG_PROGRAM( -- [[]], [[char buf[4]; (void)sprintf(buf, "%s", "foo");]] -+ [[#include ]], [[char buf[4]; (void)sprintf(buf, "%s", "foo");]] - )], - [sudo_cv_use_fortify_source=yes], - [sudo_cv_use_fortify_source=no] -diff --git a/m4/ldap.m4 b/m4/ldap.m4 -index 78c21e0bc0a1f65f..a6361df044d84f92 100644 ---- a/m4/ldap.m4 -+++ b/m4/ldap.m4 -@@ -52,7 +52,10 @@ AC_DEFUN([SUDO_CHECK_LDAP], [ - #include ]) - AC_CACHE_CHECK([whether lber.h is needed when including ldap.h], [sudo_cv_header_lber_h], [ - AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include --#include ]], [[(void)ldap_init(0, 0)]])], [ -+#include -+ -+void *volatile ptr; -+]], [[ptr = (void *) ldap_msgfree]])], [ - # No need to explicitly include lber.h when including ldap.h. - sudo_cv_header_lber_h=no - ], [ diff --git a/sudo.spec b/sudo.spec index 315ea49..3237084 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,9 +1,9 @@ # comment out if no extra version -%global extraver p2 +%global extraver p3 Summary: Allows restricted root access for specified users Name: sudo -Version: 1.9.13 +Version: 1.9.14 # remove -b 3 after rebase !!! # use "-p -e % {?extraver}" when beta # use "-e % {?extraver}"" when patch version @@ -13,7 +13,6 @@ License: ISC URL: https://www.sudo.ws Source0: %{url}/dist/%{name}-%{version}%{?extraver}.tar.gz Source1: sudoers -Patch0: sudo-configure-c99.patch Requires: pam Recommends: system-default-editor Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release} From 462f43c97aa9bd80e22243a82d454b8ad949c6fd Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 24 Jan 2024 10:59:51 +0100 Subject: [PATCH 11/24] Rabase to 1.9.15p5 - sudo-1_9_15p5 is available Resolves: rhbz#2248505 - TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables Resolves: rhbz#2255569 Signed-off-by: Radovan Sroka --- .gitignore | 2 ++ sources | 2 +- sudo-1.6.7p5-strip.patch | 11 ----------- sudo.spec | 4 ++-- 4 files changed, 5 insertions(+), 14 deletions(-) delete mode 100644 sudo-1.6.7p5-strip.patch diff --git a/.gitignore b/.gitignore index 01b9ff5..842ab45 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,5 @@ /sudo-1.9.12p2.tar.gz /sudo-1.9.13p2.tar.gz /sudo-1.9.14p3.tar.gz +/sudo-1.9.15p4.tar.gz +/sudo-1.9.15p5.tar.gz diff --git a/sources b/sources index fc05228..a9b6cfd 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.9.14p3.tar.gz) = d4af836e3316c35d8b81a2c869ca199e8f2d5cb26dbd98b8ad031f29be62b154452afdf5a506ddabad21b80e5988a49f1f7c8f1ec44718ffcbd7e89ccbdef612 +SHA512 (sudo-1.9.15p5.tar.gz) = ebac69719de2fe7bd587924701bdd24149bf376a68b17ec02f69b2b96d4bb6fa5eb8260a073ec5ea046d3ac69bb5b1c0b9d61709fe6a56f1f66e40817a70b15a diff --git a/sudo-1.6.7p5-strip.patch b/sudo-1.6.7p5-strip.patch deleted file mode 100644 index f690659..0000000 --- a/sudo-1.6.7p5-strip.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- sudo-1.6.7p5/scripts/install-sh.strip 2005-07-21 14:28:25.000000000 +0200 -+++ sudo-1.6.7p5/scripts/install-sh 2005-07-21 14:29:18.000000000 +0200 -@@ -138,7 +138,7 @@ - fi - ;; - X-s) -- STRIPIT=true -+ #STRIPIT=true - ;; - X--) - shift diff --git a/sudo.spec b/sudo.spec index 3237084..e755179 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,9 +1,9 @@ # comment out if no extra version -%global extraver p3 +%global extraver p5 Summary: Allows restricted root access for specified users Name: sudo -Version: 1.9.14 +Version: 1.9.15 # remove -b 3 after rebase !!! # use "-p -e % {?extraver}" when beta # use "-e % {?extraver}"" when patch version From df275faeadacae6c625a5ec30f448b01a698ddea Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Thu, 8 Feb 2024 16:46:56 -0500 Subject: [PATCH 12/24] Avoid sendmail build dependency sudo should be compatible with any MTA, any of which in Fedora provide /usr/sbin/sendmail, and is used at build time only to determine its location. Instead of generalizing the build requirement (e.g. for RHEL 10 which includes only postfix), we can just tell sudo its location during configure, in which case it is not needed at all to build. However, doing so uncovered that systemd's presence was being relied upon without being specified. This too can be avoided by using the macros to define the proper tmpfiles location during configure. --- sudo.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sudo.spec b/sudo.spec index e755179..e2c4ba9 100644 --- a/sudo.spec +++ b/sudo.spec @@ -26,7 +26,7 @@ BuildRequires: bison BuildRequires: libtool BuildRequires: audit-libs-devel libcap-devel BuildRequires: libselinux-devel -BuildRequires: sendmail +BuildRequires: systemd-rpm-macros BuildRequires: gettext BuildRequires: zlib-devel @@ -89,6 +89,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --sbindir=%{_sbindir} \ --libdir=%{_libdir} \ --docdir=%{_pkgdocdir} \ + --enable-tmpfiles.d=%{_tmpfilesdir} \ --enable-openssl \ --disable-root-mailer \ --disable-intercept \ @@ -102,6 +103,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --with-tty-tickets \ --with-ldap \ --with-selinux \ + --with-sendmail=/usr/sbin/sendmail \ --with-passprompt="[sudo] password for %p: " \ --enable-python \ --enable-zlib=system \ From 545c191f72083b8ef9b7ce26706e8a17ca537d20 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 2 May 2024 23:09:47 -0700 Subject: [PATCH 13/24] Backport upstream fix for tests with Python 3.13+ --- ...traces-use-in-addition-to-when-under.patch | 41 +++++++++++++++++++ sudo.spec | 6 +++ 2 files changed, 47 insertions(+) create mode 100644 0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch diff --git a/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch b/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch new file mode 100644 index 0000000..2c9ce75 --- /dev/null +++ b/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch @@ -0,0 +1,41 @@ +From 89918caf5a349cac4e2a56ba503d7476c6f16067 Mon Sep 17 00:00:00 2001 +From: "Todd C. Miller" +Date: Thu, 2 May 2024 20:02:43 -0600 +Subject: [PATCH] Python 3.12 backtraces use '~' in addition to '^' when + underlining. GitHub issue #374 + +--- + plugins/python/regress/testhelpers.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/plugins/python/regress/testhelpers.c b/plugins/python/regress/testhelpers.c +index ee55fb901..0f28d01e9 100644 +--- a/plugins/python/regress/testhelpers.c ++++ b/plugins/python/regress/testhelpers.c +@@ -27,19 +27,19 @@ struct TestData data; + + /* + * Starting with Python 3.11, backtraces may contain a line with +- * '^' characters to bring attention to the important part of the +- * line. ++ * '~' and '^' characters to bring attention to the important part ++ * of the line. + */ + static void + remove_underline(char *output) + { + char *cp, *ep; + +- // Remove lines that only consist of '^' and white space. ++ // Remove lines that only consist of '~', '^' and white space. + cp = output; + ep = output + strlen(output); + for (;;) { +- size_t len = strspn(cp, "^ \t"); ++ size_t len = strspn(cp, "~^ \t"); + if (len > 0 && cp[len] == '\n') { + /* Prune out lines that are "underlining". */ + memmove(cp, cp + len + 1, (size_t)(ep - cp)); +-- +2.44.0 + diff --git a/sudo.spec b/sudo.spec index e2c4ba9..6f483cb 100644 --- a/sudo.spec +++ b/sudo.spec @@ -17,6 +17,12 @@ Requires: pam Recommends: system-default-editor Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release} +# https://github.com/sudo-project/sudo/commit/89918caf5a349cac4e2a56ba503d7476c6f16067 +# https://github.com/sudo-project/sudo/issues/374 +# https://bugzilla.redhat.com/show_bug.cgi?id=2245820 +# Fix tests with Python 3.13+ +Patch: 0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch + BuildRequires: make BuildRequires: pam-devel BuildRequires: groff From 47db28a6937258900d879ee298e681ff7708d750 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 7 Jun 2024 09:11:33 +0200 Subject: [PATCH 14/24] Rebuilt for Python 3.13 From f5682491133aea55fb176ca8c381afd8bb1dc411 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 06:36:47 +0000 Subject: [PATCH 15/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From ac16a17374c5799d7f570330d5e9c72291bb8466 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 11:50:30 +0000 Subject: [PATCH 16/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From e2e397029e0d35046a4cf891e075d24c7540da4f Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 26 Feb 2025 12:59:14 -0500 Subject: [PATCH 17/24] Fix build with GCC 15 GCC 15 defaults to C23, which changes the interpretation of function declarations without parameters to be `void` rather than of an unknown number and type (as in K&R). The sudoers plugin relies on the older behaviour for its hook functions. --- sudo.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sudo.spec b/sudo.spec index 6f483cb..4175d8c 100644 --- a/sudo.spec +++ b/sudo.spec @@ -88,7 +88,7 @@ F_PIE=-fPIE F_PIE=-fpie %endif -export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" +export CFLAGS="$RPM_OPT_FLAGS $F_PIE -std=gnu17" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" %configure \ --prefix=%{_prefix} \ From 770b8e2647c61512b8508c61bb3a55318f31d9b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 24 Sep 2024 16:46:11 +0200 Subject: [PATCH 18/24] Move yum/dnf protection removal config file under /usr https://github.com/uapi-group/specifications/issues/76 Actually, add a new file under /usr, but keep the old file in /etc because it's still needed for dnf. The new file in the new location is useful because it means that we get the correct behaviour even when /etc is emptied (on systems with new dnf version). dnf5 reads the new location: https://github.com/rpm-software-management/dnf5/issues/1107 https://github.com/rpm-software-management/dnf5/pull/1110 --- sudo.spec | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/sudo.spec b/sudo.spec index 6f483cb..63fb36f 100644 --- a/sudo.spec +++ b/sudo.spec @@ -131,12 +131,15 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers -#add sudo to protected packages -install -p -d -m 755 $RPM_BUILD_ROOT/etc/dnf/protected.d/ -touch sudo.conf -echo sudo > sudo.conf -install -p -c -m 0644 sudo.conf $RPM_BUILD_ROOT/etc/dnf/protected.d/ -rm -f sudo.conf +# Add sudo to protected packages. Old location for yum/dnf. +mkdir -p $RPM_BUILD_ROOT/etc/dnf/protected.d/ +echo "sudo" >$RPM_BUILD_ROOT/etc/dnf/protected.d/sudo.conf +# Add sudo to protected packages. New location for dnf5. +mkdir -p $RPM_BUILD_ROOT/usr/share/dnf5/libdnf.conf.d/ +cat >$RPM_BUILD_ROOT/usr/share/dnf5/libdnf.conf.d/protect-sudo.conf < Date: Mon, 2 Jun 2025 20:53:02 +0200 Subject: [PATCH 19/24] Rebuilt for Python 3.14 From 9641cbaa6b0934d03f4e0398261eef8509f282dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 5 Jul 2025 11:46:27 +0200 Subject: [PATCH 20/24] Rebase to sudo 1.9.17p1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - sudo-1_9_16p2 is available Resolves: rhbz#2309626 - sudo: LPE via host option Resolves: CVE-2025-32462 - Properly apply system buildflags - Use new build macros, drop unneeded %%defattr Signed-off-by: Björn Esser --- .gitignore | 1 + ...traces-use-in-addition-to-when-under.patch | 41 ------------------- sources | 2 +- sudo.spec | 26 +++--------- 4 files changed, 7 insertions(+), 63 deletions(-) delete mode 100644 0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch diff --git a/.gitignore b/.gitignore index 842ab45..e4940ce 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,4 @@ /sudo-1.9.14p3.tar.gz /sudo-1.9.15p4.tar.gz /sudo-1.9.15p5.tar.gz +/sudo-1.9.17p1.tar.gz diff --git a/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch b/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch deleted file mode 100644 index 2c9ce75..0000000 --- a/0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 89918caf5a349cac4e2a56ba503d7476c6f16067 Mon Sep 17 00:00:00 2001 -From: "Todd C. Miller" -Date: Thu, 2 May 2024 20:02:43 -0600 -Subject: [PATCH] Python 3.12 backtraces use '~' in addition to '^' when - underlining. GitHub issue #374 - ---- - plugins/python/regress/testhelpers.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/plugins/python/regress/testhelpers.c b/plugins/python/regress/testhelpers.c -index ee55fb901..0f28d01e9 100644 ---- a/plugins/python/regress/testhelpers.c -+++ b/plugins/python/regress/testhelpers.c -@@ -27,19 +27,19 @@ struct TestData data; - - /* - * Starting with Python 3.11, backtraces may contain a line with -- * '^' characters to bring attention to the important part of the -- * line. -+ * '~' and '^' characters to bring attention to the important part -+ * of the line. - */ - static void - remove_underline(char *output) - { - char *cp, *ep; - -- // Remove lines that only consist of '^' and white space. -+ // Remove lines that only consist of '~', '^' and white space. - cp = output; - ep = output + strlen(output); - for (;;) { -- size_t len = strspn(cp, "^ \t"); -+ size_t len = strspn(cp, "~^ \t"); - if (len > 0 && cp[len] == '\n') { - /* Prune out lines that are "underlining". */ - memmove(cp, cp + len + 1, (size_t)(ep - cp)); --- -2.44.0 - diff --git a/sources b/sources index a9b6cfd..86f8d45 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.9.15p5.tar.gz) = ebac69719de2fe7bd587924701bdd24149bf376a68b17ec02f69b2b96d4bb6fa5eb8260a073ec5ea046d3ac69bb5b1c0b9d61709fe6a56f1f66e40817a70b15a +SHA512 (sudo-1.9.17p1.tar.gz) = 1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc diff --git a/sudo.spec b/sudo.spec index 4175d8c..73b3930 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,9 +1,9 @@ # comment out if no extra version -%global extraver p5 +%global extraver p1 Summary: Allows restricted root access for specified users Name: sudo -Version: 1.9.15 +Version: 1.9.17 # remove -b 3 after rebase !!! # use "-p -e % {?extraver}" when beta # use "-e % {?extraver}"" when patch version @@ -17,12 +17,6 @@ Requires: pam Recommends: system-default-editor Recommends: %{name}-python-plugin%{?_isa} = %{version}-%{release} -# https://github.com/sudo-project/sudo/commit/89918caf5a349cac4e2a56ba503d7476c6f16067 -# https://github.com/sudo-project/sudo/issues/374 -# https://bugzilla.redhat.com/show_bug.cgi?id=2245820 -# Fix tests with Python 3.13+ -Patch: 0001-Python-3.12-backtraces-use-in-addition-to-when-under.patch - BuildRequires: make BuildRequires: pam-devel BuildRequires: groff @@ -82,14 +76,6 @@ BuildRequires: python3-devel # Remove bundled copy of zlib rm -rf zlib/ -%ifarch s390 s390x sparc64 -F_PIE=-fPIE -%else -F_PIE=-fpie -%endif - -export CFLAGS="$RPM_OPT_FLAGS $F_PIE -std=gnu17" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" - %configure \ --prefix=%{_prefix} \ --sbindir=%{_sbindir} \ @@ -117,14 +103,13 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE -std=gnu17" LDFLAGS="-pie -Wl,-z,relro -Wl, --with-sssd # --without-kerb5 \ # --without-kerb4 -make +%make_build %check -make check +%make_build check %install -rm -rf $RPM_BUILD_ROOT -make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g` +%make_install install_uid=`id -u` install_gid=`id -g` sudoers_uid=`id -u` sudoers_gid=`id -g` chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo @@ -180,7 +165,6 @@ EOF %files -f sudo_all.lang -%defattr(-,root,root) %attr(0440,root,root) %config(noreplace) /etc/sudoers %attr(0750,root,root) %dir /etc/sudoers.d/ %config(noreplace) /etc/pam.d/sudo From 04179b541723d5914c5ce01021dd7a2a7a68eaf6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 5 Jul 2025 12:22:08 +0200 Subject: [PATCH 21/24] Re-apply changes from commit e2e397029e0d35046a4cf891e075d24c7540da4f MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- sudo.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sudo.spec b/sudo.spec index 73b3930..9e72bb5 100644 --- a/sudo.spec +++ b/sudo.spec @@ -76,6 +76,8 @@ BuildRequires: python3-devel # Remove bundled copy of zlib rm -rf zlib/ +export CFLAGS="$RPM_OPT_FLAGS -std=gnu17" + %configure \ --prefix=%{_prefix} \ --sbindir=%{_sbindir} \ From 1899e2aa8d10783369a1d840c2fc30cf86a6e782 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Mon, 7 Jul 2025 13:10:49 +0200 Subject: [PATCH 22/24] Drop '-std=gnu17' from CFLAGS, as C23 builds fine now MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This was introduced in commit e2e397029e0d35046a4cf891e075d24c7540da4f for an older version of sudo that was FTBFS for GCC 15 defaulting to C23. Signed-off-by: Björn Esser --- sudo.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/sudo.spec b/sudo.spec index 9e72bb5..73b3930 100644 --- a/sudo.spec +++ b/sudo.spec @@ -76,8 +76,6 @@ BuildRequires: python3-devel # Remove bundled copy of zlib rm -rf zlib/ -export CFLAGS="$RPM_OPT_FLAGS -std=gnu17" - %configure \ --prefix=%{_prefix} \ --sbindir=%{_sbindir} \ From 81e84c1f0692ac90603c7cbeaeeb2b891a852e45 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 18:50:05 +0000 Subject: [PATCH 23/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 2ead99a2b1915e06b2918b5547d0587fbe678e0e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= Date: Tue, 21 Oct 2025 10:16:55 +0200 Subject: [PATCH 24/24] Rebase to 1.9.17p2 - sudo-1.9.17p2 is available Resolves: rhbz#2383665 --- .gitignore | 1 + sources | 2 +- sudo.spec | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index e4940ce..b0986fa 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,4 @@ /sudo-1.9.15p4.tar.gz /sudo-1.9.15p5.tar.gz /sudo-1.9.17p1.tar.gz +/sudo-1.9.17p2.tar.gz diff --git a/sources b/sources index 86f8d45..54e59ea 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.9.17p1.tar.gz) = 1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc +SHA512 (sudo-1.9.17p2.tar.gz) = c8abd6ca56e54a081c9ef1e9f6579d1db5b93ff857e60d1f58d1f425d7dc23c31c58d40b7819780688f66dfdf87a1f3bbe0a78387b007e2beb1b0e546203ea93 diff --git a/sudo.spec b/sudo.spec index e321ec4..be44d00 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,5 +1,5 @@ # comment out if no extra version -%global extraver p1 +%global extraver p2 Summary: Allows restricted root access for specified users Name: sudo