From 5aab495c5d008c2893e275030068481d2d30fa67 Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Mon, 21 Apr 2008 21:17:19 +0000 Subject: [PATCH 1/8] Initialize branch F-9 for sudo --- branch | 1 + 1 file changed, 1 insertion(+) create mode 100644 branch diff --git a/branch b/branch new file mode 100644 index 0000000..1c26f78 --- /dev/null +++ b/branch @@ -0,0 +1 @@ +F-9 From 262c0abdbe0efa6e69f94741940d6e8f1929a6fd Mon Sep 17 00:00:00 2001 From: Peter Vrabec Date: Tue, 13 May 2008 13:00:09 +0000 Subject: [PATCH 2/8] compiled with secure path (#80215) --- sudo.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sudo.spec b/sudo.spec index e5a23bf..1dbe5b7 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.6.9p13 -Release: 4%{?dist} +Release: 5%{?dist} License: BSD Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -72,7 +72,8 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie" --with-tty-tickets \ --with-ldap \ --with-selinux \ - --with-passprompt="[sudo] password for %p: " + --with-passprompt="[sudo] password for %p: " \ + --with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin" # --without-kerb5 \ # --without-kerb4 make @@ -131,6 +132,9 @@ rm -rf $RPM_BUILD_ROOT /bin/chmod 0440 /etc/sudoers || : %changelog +* Tue May 13 2008 Peter Vrabec 1.6.9p13-5 +- compiled with secure path (#80215) + * Mon Mar 31 2008 Peter Vrabec 1.6.9p13-4 - include ldap files in rpm package (#439506) From b72103fe92a9d52b6d25c005a62f635da01f2c56 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Thu, 22 May 2008 14:52:53 +0000 Subject: [PATCH 3/8] minor rebuild for sparc --- sudo.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sudo.spec b/sudo.spec index 1dbe5b7..a59e9ec 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.6.9p13 -Release: 5%{?dist} +Release: 5%{?dist}.1 License: BSD Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -132,6 +132,9 @@ rm -rf $RPM_BUILD_ROOT /bin/chmod 0440 /etc/sudoers || : %changelog +* Thu May 22 2008 Dennis Gilmore 1.6.9p13-5.1 +- minor rebuild for sparc + * Tue May 13 2008 Peter Vrabec 1.6.9p13-5 - compiled with secure path (#80215) From a317cbc8d420267a7dfec92b26040ae701546199 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 30 Oct 2008 13:09:18 +0000 Subject: [PATCH 4/8] Fixed type/role parsing (#466292) --- sudo-1.6.9p13-selinuxfix.patch | 959 +++++++++++++++++++++++++++++++++ sudo.spec | 7 +- 2 files changed, 965 insertions(+), 1 deletion(-) create mode 100644 sudo-1.6.9p13-selinuxfix.patch diff --git a/sudo-1.6.9p13-selinuxfix.patch b/sudo-1.6.9p13-selinuxfix.patch new file mode 100644 index 0000000..0297845 --- /dev/null +++ b/sudo-1.6.9p13-selinuxfix.patch @@ -0,0 +1,959 @@ +diff -up sudo-1.6.9p13/parse.yacc.orig sudo-1.6.9p13/parse.yacc +--- sudo-1.6.9p13/parse.yacc.orig 2008-10-30 14:07:52.000000000 +0100 ++++ sudo-1.6.9p13/parse.yacc 2008-10-30 14:06:58.000000000 +0100 +@@ -569,6 +569,7 @@ selinux : /* empty */ { + #ifdef HAVE_SELINUX + if (printmatches == TRUE && host_matches == TRUE && + user_matches == TRUE && runas_matches == TRUE) { ++ if (match[top-1].role != NULL) { + /* Inherit role. */ + cm_list[cm_list_len].role = + estrdup(cm_list[cm_list_len-1].role); +@@ -576,6 +577,12 @@ selinux : /* empty */ { + cm_list[cm_list_len-1].role_len; + cm_list[cm_list_len].role_size = + cm_list[cm_list_len-1].role_len + 1; ++ } else { ++ cm_list[cm_list_len].role = NULL; ++ cm_list[cm_list_len].role_len = 0; ++ cm_list[cm_list_len].role_size = 0; ++ } ++ if (match[top-1].type != NULL) { + /* Inherit type. */ + cm_list[cm_list_len].type = + estrdup(cm_list[cm_list_len-1].type); +@@ -583,6 +590,11 @@ selinux : /* empty */ { + cm_list[cm_list_len-1].type_len; + cm_list[cm_list_len].type_size = + cm_list[cm_list_len-1].type_len + 1; ++ } else { ++ cm_list[cm_list_len].type = NULL; ++ cm_list[cm_list_len].type_len = 0; ++ cm_list[cm_list_len].type_size = 0; ++ } + } + #endif /* HAVE_SELINUX */ + $$.role = NULL; +@@ -592,6 +604,7 @@ selinux : /* empty */ { + #ifdef HAVE_SELINUX + if (printmatches == TRUE && host_matches == TRUE && + user_matches == TRUE && runas_matches == TRUE) { ++ if (match[top-1].type != NULL) { + /* Inherit type. */ + cm_list[cm_list_len].type = + estrdup(cm_list[cm_list_len-1].type); +@@ -599,6 +612,11 @@ selinux : /* empty */ { + cm_list[cm_list_len-1].type_len; + cm_list[cm_list_len].type_size = + cm_list[cm_list_len-1].type_len + 1; ++ } else { ++ cm_list[cm_list_len].type = NULL; ++ cm_list[cm_list_len].type_len = 0; ++ cm_list[cm_list_len].type_size = 0; ++ } + } + #endif /* HAVE_SELINUX */ + $$.role = $1; +@@ -608,6 +626,7 @@ selinux : /* empty */ { + #ifdef HAVE_SELINUX + if (printmatches == TRUE && host_matches == TRUE && + user_matches == TRUE && runas_matches == TRUE) { ++ if (match[top-1].role != NULL) { + /* Inherit role. */ + cm_list[cm_list_len].role = + estrdup(cm_list[cm_list_len-1].role); +@@ -615,6 +634,11 @@ selinux : /* empty */ { + cm_list[cm_list_len-1].role_len; + cm_list[cm_list_len].role_size = + cm_list[cm_list_len-1].role_len + 1; ++ } else { ++ cm_list[cm_list_len].role = NULL; ++ cm_list[cm_list_len].role_len = 0; ++ cm_list[cm_list_len].role_size = 0; ++ } + } + #endif /* HAVE_SELINUX */ + $$.type = $1; +diff -up sudo-1.6.9p13/sudo.tab.c.orig sudo-1.6.9p13/sudo.tab.c +--- sudo-1.6.9p13/sudo.tab.c.orig 2008-10-30 13:54:08.000000000 +0100 ++++ sudo-1.6.9p13/sudo.tab.c 2008-10-30 14:08:17.000000000 +0100 +@@ -1,20 +1,22 @@ + #ifndef lint +-/*static char yysccsid[] = "from: @(#)yaccpar 1.9 (Berkeley) 02/21/93";*/ +-static char yyrcsid[] +-#if __GNUC__ >= 2 +- __attribute__ ((unused)) +-#endif /* __GNUC__ >= 2 */ +- = "$OpenBSD: skeleton.c,v 1.28 2007/09/03 21:14:58 deraadt Exp $"; ++static const char yysccsid[] = "@(#)yaccpar 1.9 (Berkeley) 02/21/93"; + #endif ++ + #include ++ + #define YYBYACC 1 + #define YYMAJOR 1 + #define YYMINOR 9 +-#define YYLEX yylex() +-#define YYEMPTY -1 +-#define yyclearin (yychar=(YYEMPTY)) +-#define yyerrok (yyerrflag=0) +-#define YYRECOVERING() (yyerrflag!=0) ++#define YYPATCH 20070509 ++ ++#define YYEMPTY (-1) ++#define yyclearin (yychar = YYEMPTY) ++#define yyerrok (yyerrflag = 0) ++#define YYRECOVERING (yyerrflag != 0) ++ ++extern int yyparse(void); ++ ++static int yygrowstack(void); + #define YYPREFIX "yy" + #line 2 "parse.yacc" + /* +@@ -88,7 +90,7 @@ static char yyrcsid[] + #endif /* HAVE_LSEARCH */ + + #ifndef lint +-__unused static const char rcsid[] = "$Sudo: sudo.tab.c,v 1.76.2.13 2008/02/11 14:49:28 millert Exp $"; ++__unused static const char rcsid[] = "$Sudo: parse.yacc,v 1.204.2.12 2008/02/11 14:49:28 millert Exp $"; + #endif /* lint */ + + /* +@@ -265,8 +267,6 @@ yyerror(s) + parse_error = TRUE; + } + #line 251 "parse.yacc" +-#ifndef YYSTYPE_DEFINED +-#define YYSTYPE_DEFINED + typedef union { + char *string; + int BOOLEAN; +@@ -274,8 +274,7 @@ typedef union { + int tok; + struct selinux_info seinfo; + } YYSTYPE; +-#endif /* YYSTYPE_DEFINED */ +-#line 279 "sudo.tab.c" ++#line 278 "sudo.tab.c" + #define COMMAND 257 + #define ALIAS 258 + #define DEFVAR 259 +@@ -304,12 +303,7 @@ typedef union { + #define TYPE 282 + #define ROLE 283 + #define YYERRCODE 256 +-#if defined(__cplusplus) || defined(__STDC__) +-const short yylhs[] = +-#else +-short yylhs[] = +-#endif +- { -1, ++short yylhs[] = { -1, + 0, 0, 10, 10, 12, 10, 10, 10, 10, 10, + 10, 18, 19, 21, 19, 22, 19, 24, 19, 20, + 20, 25, 25, 25, 25, 25, 13, 13, 26, 28, +@@ -322,12 +316,7 @@ short yylhs[] = + 44, 43, 11, 11, 45, 45, 6, 6, 6, 6, + 6, + }; +-#if defined(__cplusplus) || defined(__STDC__) +-const short yylen[] = +-#else +-short yylen[] = +-#endif +- { 2, ++short yylen[] = { 2, + 1, 2, 1, 2, 0, 3, 2, 2, 2, 2, + 1, 2, 1, 0, 3, 0, 3, 0, 3, 1, + 3, 1, 2, 3, 3, 3, 1, 3, 3, 1, +@@ -340,12 +329,7 @@ short yylen[] = + 0, 4, 1, 3, 1, 2, 1, 1, 1, 1, + 1, + }; +-#if defined(__cplusplus) || defined(__STDC__) +-const short yydefred[] = +-#else +-short yydefred[] = +-#endif +- { 0, ++short yydefred[] = { 0, + 0, 13, 18, 14, 16, 3, 0, 0, 0, 0, + 0, 1, 0, 11, 0, 4, 0, 0, 0, 75, + 0, 73, 81, 0, 79, 91, 0, 89, 87, 0, +@@ -362,24 +346,14 @@ short yydefred[] = + 0, 0, 0, 0, 0, 49, 50, 45, 44, 64, + 65, 66, 67, 68, 69, 40, + }; +-#if defined(__cplusplus) || defined(__STDC__) +-const short yydgoto[] = +-#else +-short yydgoto[] = +-#endif +- { 11, ++short yydgoto[] = { 11, + 110, 52, 62, 63, 64, 39, 130, 131, 132, 12, + 40, 13, 75, 27, 21, 24, 30, 14, 15, 44, + 18, 19, 76, 17, 45, 77, 116, 54, 117, 123, + 118, 135, 111, 119, 85, 22, 65, 25, 67, 112, + 31, 71, 28, 69, 41, + }; +-#if defined(__cplusplus) || defined(__STDC__) +-const short yysindex[] = +-#else +-short yysindex[] = +-#endif +- { -247, ++short yysindex[] = { -247, + -248, 0, 0, 0, 0, 0, -211, -210, -205, -201, + -247, 0, 62, 0, -33, 0, 89, 62, 114, 0, + 2, 0, 0, 3, 0, 0, 4, 0, 0, 6, +@@ -394,13 +368,9 @@ short yysindex[] = + 0, 36, 23, 24, 0, 37, 0, -185, -221, -20, + 0, 114, -268, 0, 0, 0, 24, 21, 25, 0, + -195, -193, -175, -174, 274, 0, 0, 0, 0, 0, +- 0, 0, 0, 0, 0, 0,}; +-#if defined(__cplusplus) || defined(__STDC__) +-const short yyrindex[] = +-#else +-short yyrindex[] = +-#endif +- { 141, ++ 0, 0, 0, 0, 0, 0, ++}; ++short yyrindex[] = { 141, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 141, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 156, 0, 0, 181, 0, 0, 206, 0, 0, 236, +@@ -415,13 +385,9 @@ short yyrindex[] = + 0, 52, 78, 104, 0, 130, 0, -29, 0, 0, + 0, 0, 340, 0, 0, 0, 313, 0, 0, 0, + 365, 391, 0, 0, 0, 0, 0, 0, 0, 0, +- 0, 0, 0, 0, 0, 0,}; +-#if defined(__cplusplus) || defined(__STDC__) +-const short yygindex[] = +-#else +-short yygindex[] = +-#endif +- { 0, ++ 0, 0, 0, 0, 0, 0, ++}; ++short yygindex[] = { 0, + -27, 40, 12, 7, -87, 56, 0, -36, -32, 87, + -16, 0, 0, 0, 0, 0, 0, 0, 0, 18, + 0, 0, -14, 0, 0, 5, 0, 19, -19, 0, +@@ -429,12 +395,7 @@ short yygindex[] = + 35, 0, 42, 0, 34, + }; + #define YYTABLESIZE 666 +-#if defined(__cplusplus) || defined(__STDC__) +-const short yytable[] = +-#else +-short yytable[] = +-#endif +- { 43, ++short yytable[] = { 43, + 22, 55, 53, 51, 51, 114, 33, 19, 1, 34, + 35, 36, 109, 128, 129, 74, 2, 3, 4, 5, + 84, 15, 17, 37, 79, 76, 80, 16, 6, 7, +@@ -503,12 +464,7 @@ short yytable[] = + 0, 0, 0, 0, 0, 0, 0, 0, 0, 48, + 48, 48, 48, 48, 48, 48, + }; +-#if defined(__cplusplus) || defined(__STDC__) +-const short yycheck[] = +-#else +-short yycheck[] = +-#endif +- { 33, ++short yycheck[] = { 33, + 0, 18, 17, 33, 33, 93, 258, 33, 256, 261, + 262, 263, 33, 282, 283, 44, 264, 265, 266, 267, + 44, 33, 33, 275, 43, 0, 45, 276, 276, 277, +@@ -583,12 +539,7 @@ short yycheck[] = + #endif + #define YYMAXTOKEN 283 + #if YYDEBUG +-#if defined(__cplusplus) || defined(__STDC__) +-const char * const yyname[] = +-#else +-char *yyname[] = +-#endif +- { ++char *yyname[] = { + "end-of-file",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, + "'!'",0,0,0,0,0,0,0,0,0,"'+'","','","'-'",0,0,0,0,0,0,0,0,0,0,0,0,"':'",0,0, + "'='",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +@@ -601,12 +552,8 @@ char *yyname[] = + "NOEXEC","EXEC","SETENV","NOSETENV","ALL","COMMENT","HOSTALIAS","CMNDALIAS", + "USERALIAS","RUNASALIAS","ERROR","TYPE","ROLE", + }; +-#if defined(__cplusplus) || defined(__STDC__) +-const char * const yyrule[] = +-#else +-char *yyrule[] = +-#endif +- {"$accept : file", ++char *yyrule[] = { ++"$accept : file", + "file : entry", + "file : file entry", + "entry : COMMENT", +@@ -710,32 +657,40 @@ char *yyrule[] = + "user : ALL", + }; + #endif ++#if YYDEBUG ++#include ++#endif ++ ++/* define the initial stack-sizes */ + #ifdef YYSTACKSIZE + #undef YYMAXDEPTH +-#define YYMAXDEPTH YYSTACKSIZE ++#define YYMAXDEPTH YYSTACKSIZE + #else + #ifdef YYMAXDEPTH + #define YYSTACKSIZE YYMAXDEPTH + #else +-#define YYSTACKSIZE 10000 +-#define YYMAXDEPTH 10000 ++#define YYSTACKSIZE 500 ++#define YYMAXDEPTH 500 + #endif + #endif +-#define YYINITSTACKSIZE 200 +-/* LINTUSED */ +-int yydebug; +-int yynerrs; +-int yyerrflag; +-int yychar; +-short *yyssp; ++ ++#define YYINITSTACKSIZE 500 ++ ++int yydebug; ++int yynerrs; ++int yyerrflag; ++int yychar; ++short *yyssp; + YYSTYPE *yyvsp; +-YYSTYPE yyval; +-YYSTYPE yylval; +-short *yyss; +-short *yysslim; +-YYSTYPE *yyvs; +-int yystacksize; +-#line 1053 "parse.yacc" ++YYSTYPE yyval; ++YYSTYPE yylval; ++ ++/* variables for the parser stack */ ++static short *yyss; ++static short *yysslim; ++static YYSTYPE *yyvs; ++static int yystacksize; ++#line 1077 "parse.yacc" + + #define MOREALIASES (32) + aliasinfo *aliases = NULL; +@@ -1101,13 +1056,9 @@ init_parser() + if (printmatches == TRUE) + expand_match_list(); + } +-#line 1053 "sudo.tab.c" ++#line 1060 "sudo.tab.c" + /* allocate initial stack or double stack size, up to YYMAXDEPTH */ +-#if defined(__cplusplus) || defined(__STDC__) + static int yygrowstack(void) +-#else +-static int yygrowstack() +-#endif + { + int newsize, i; + short *newss; +@@ -1119,40 +1070,27 @@ static int yygrowstack() + return -1; + else if ((newsize *= 2) > YYMAXDEPTH) + newsize = YYMAXDEPTH; ++ + i = yyssp - yyss; +-#ifdef SIZE_MAX +-#define YY_SIZE_MAX SIZE_MAX +-#else +-#define YY_SIZE_MAX 0x7fffffff +-#endif +- if (newsize && YY_SIZE_MAX / newsize < sizeof *newss) +- goto bail; +- newss = yyss ? (short *)realloc(yyss, newsize * sizeof *newss) : +- (short *)malloc(newsize * sizeof *newss); /* overflow check above */ +- if (newss == NULL) +- goto bail; +- yyss = newss; ++ newss = (yyss != 0) ++ ? (short *)realloc(yyss, newsize * sizeof(*newss)) ++ : (short *)malloc(newsize * sizeof(*newss)); ++ if (newss == 0) ++ return -1; ++ ++ yyss = newss; + yyssp = newss + i; +- if (newsize && YY_SIZE_MAX / newsize < sizeof *newvs) +- goto bail; +- newvs = yyvs ? (YYSTYPE *)realloc(yyvs, newsize * sizeof *newvs) : +- (YYSTYPE *)malloc(newsize * sizeof *newvs); /* overflow check above */ +- if (newvs == NULL) +- goto bail; ++ newvs = (yyvs != 0) ++ ? (YYSTYPE *)realloc(yyvs, newsize * sizeof(*newvs)) ++ : (YYSTYPE *)malloc(newsize * sizeof(*newvs)); ++ if (newvs == 0) ++ return -1; ++ + yyvs = newvs; + yyvsp = newvs + i; + yystacksize = newsize; + yysslim = yyss + newsize - 1; + return 0; +-bail: +- if (yyss) +- free(yyss); +- if (yyvs) +- free(yyvs); +- yyss = yyssp = NULL; +- yyvs = yyvsp = NULL; +- yystacksize = 0; +- return -1; + } + + #define YYABORT goto yyabort +@@ -1160,31 +1098,23 @@ bail: + #define YYACCEPT goto yyaccept + #define YYERROR goto yyerrlab + int +-#if defined(__cplusplus) || defined(__STDC__) + yyparse(void) +-#else +-yyparse() +-#endif + { +- int yym, yyn, yystate; ++ register int yym, yyn, yystate; + #if YYDEBUG +-#if defined(__cplusplus) || defined(__STDC__) +- const char *yys; +-#else /* !(defined(__cplusplus) || defined(__STDC__)) */ +- char *yys; +-#endif /* !(defined(__cplusplus) || defined(__STDC__)) */ ++ register const char *yys; + +- if ((yys = getenv("YYDEBUG"))) ++ if ((yys = getenv("YYDEBUG")) != 0) + { + yyn = *yys; + if (yyn >= '0' && yyn <= '9') + yydebug = yyn - '0'; + } +-#endif /* YYDEBUG */ ++#endif + + yynerrs = 0; + yyerrflag = 0; +- yychar = (-1); ++ yychar = YYEMPTY; + + if (yyss == NULL && yygrowstack()) goto yyoverflow; + yyssp = yyss; +@@ -1221,7 +1151,7 @@ yyloop: + } + *++yyssp = yystate = yytable[yyn]; + *++yyvsp = yylval; +- yychar = (-1); ++ yychar = YYEMPTY; + if (yyerrflag > 0) --yyerrflag; + goto yyloop; + } +@@ -1232,16 +1162,16 @@ yyloop: + goto yyreduce; + } + if (yyerrflag) goto yyinrecovery; +-#if defined(lint) || defined(__GNUC__) +- goto yynewerror; +-#endif +-yynewerror: ++ + yyerror("syntax error"); +-#if defined(lint) || defined(__GNUC__) ++ ++#ifdef lint + goto yyerrlab; + #endif ++ + yyerrlab: + ++yynerrs; ++ + yyinrecovery: + if (yyerrflag < 3) + { +@@ -1290,9 +1220,10 @@ yyinrecovery: + YYPREFIX, yystate, yychar, yys); + } + #endif +- yychar = (-1); ++ yychar = YYEMPTY; + goto yyloop; + } ++ + yyreduce: + #if YYDEBUG + if (yydebug) +@@ -1637,6 +1568,7 @@ case 46: + #ifdef HAVE_SELINUX + if (printmatches == TRUE && host_matches == TRUE && + user_matches == TRUE && runas_matches == TRUE) { ++ if (match[top-1].role != NULL) { + /* Inherit role. */ + cm_list[cm_list_len].role = + estrdup(cm_list[cm_list_len-1].role); +@@ -1644,6 +1576,12 @@ case 46: + cm_list[cm_list_len-1].role_len; + cm_list[cm_list_len].role_size = + cm_list[cm_list_len-1].role_len + 1; ++ } else { ++ cm_list[cm_list_len].role = NULL; ++ cm_list[cm_list_len].role_len = 0; ++ cm_list[cm_list_len].role_size = 0; ++ } ++ if (match[top-1].type != NULL) { + /* Inherit type. */ + cm_list[cm_list_len].type = + estrdup(cm_list[cm_list_len-1].type); +@@ -1651,6 +1589,11 @@ case 46: + cm_list[cm_list_len-1].type_len; + cm_list[cm_list_len].type_size = + cm_list[cm_list_len-1].type_len + 1; ++ } else { ++ cm_list[cm_list_len].type = NULL; ++ cm_list[cm_list_len].type_len = 0; ++ cm_list[cm_list_len].type_size = 0; ++ } + } + #endif /* HAVE_SELINUX */ + yyval.seinfo.role = NULL; +@@ -1658,11 +1601,12 @@ case 46: + } + break; + case 47: +-#line 591 "parse.yacc" ++#line 603 "parse.yacc" + { + #ifdef HAVE_SELINUX + if (printmatches == TRUE && host_matches == TRUE && + user_matches == TRUE && runas_matches == TRUE) { ++ if (match[top-1].type != NULL) { + /* Inherit type. */ + cm_list[cm_list_len].type = + estrdup(cm_list[cm_list_len-1].type); +@@ -1670,6 +1614,11 @@ case 47: + cm_list[cm_list_len-1].type_len; + cm_list[cm_list_len].type_size = + cm_list[cm_list_len-1].type_len + 1; ++ } else { ++ cm_list[cm_list_len].type = NULL; ++ cm_list[cm_list_len].type_len = 0; ++ cm_list[cm_list_len].type_size = 0; ++ } + } + #endif /* HAVE_SELINUX */ + yyval.seinfo.role = yyvsp[0].string; +@@ -1677,11 +1626,12 @@ case 47: + } + break; + case 48: +-#line 607 "parse.yacc" ++#line 625 "parse.yacc" + { + #ifdef HAVE_SELINUX + if (printmatches == TRUE && host_matches == TRUE && + user_matches == TRUE && runas_matches == TRUE) { ++ if (match[top-1].role != NULL) { + /* Inherit role. */ + cm_list[cm_list_len].role = + estrdup(cm_list[cm_list_len-1].role); +@@ -1689,6 +1639,11 @@ case 48: + cm_list[cm_list_len-1].role_len; + cm_list[cm_list_len].role_size = + cm_list[cm_list_len-1].role_len + 1; ++ } else { ++ cm_list[cm_list_len].role = NULL; ++ cm_list[cm_list_len].role_len = 0; ++ cm_list[cm_list_len].role_size = 0; ++ } + } + #endif /* HAVE_SELINUX */ + yyval.seinfo.type = yyvsp[0].string; +@@ -1696,21 +1651,21 @@ case 48: + } + break; + case 49: +-#line 623 "parse.yacc" ++#line 647 "parse.yacc" + { + yyval.seinfo.role = yyvsp[-1].string; + yyval.seinfo.type = yyvsp[0].string; + } + break; + case 50: +-#line 627 "parse.yacc" ++#line 651 "parse.yacc" + { + yyval.seinfo.type = yyvsp[-1].string; + yyval.seinfo.role = yyvsp[0].string; + } + break; + case 51: +-#line 633 "parse.yacc" ++#line 657 "parse.yacc" + { + if (printmatches == TRUE && host_matches == TRUE && + user_matches == TRUE) { +@@ -1737,17 +1692,17 @@ case 51: + } + break; + case 52: +-#line 657 "parse.yacc" ++#line 681 "parse.yacc" + { + runas_matches = yyvsp[0].BOOLEAN; + } + break; + case 53: +-#line 662 "parse.yacc" ++#line 686 "parse.yacc" + { ; } + break; + case 54: +-#line 663 "parse.yacc" ++#line 687 "parse.yacc" + { + /* Later entries override earlier ones. */ + if (yyvsp[0].BOOLEAN != NOMATCH) +@@ -1757,11 +1712,11 @@ case 54: + } + break; + case 55: +-#line 672 "parse.yacc" ++#line 696 "parse.yacc" + { ; } + break; + case 56: +-#line 673 "parse.yacc" ++#line 697 "parse.yacc" + { + if (printmatches == TRUE) { + if (in_alias == TRUE) +@@ -1773,14 +1728,14 @@ case 56: + } + break; + case 57: +-#line 681 "parse.yacc" ++#line 705 "parse.yacc" + { + /* Set $$ to the negation of runasuser */ + yyval.BOOLEAN = (yyvsp[0].BOOLEAN == NOMATCH ? NOMATCH : ! yyvsp[0].BOOLEAN); + } + break; + case 58: +-#line 687 "parse.yacc" ++#line 711 "parse.yacc" + { + if (printmatches == TRUE) { + if (in_alias == TRUE) +@@ -1798,7 +1753,7 @@ case 58: + } + break; + case 59: +-#line 702 "parse.yacc" ++#line 726 "parse.yacc" + { + if (printmatches == TRUE) { + if (in_alias == TRUE) +@@ -1816,7 +1771,7 @@ case 59: + } + break; + case 60: +-#line 717 "parse.yacc" ++#line 741 "parse.yacc" + { + if (printmatches == TRUE) { + if (in_alias == TRUE) +@@ -1834,7 +1789,7 @@ case 60: + } + break; + case 61: +-#line 732 "parse.yacc" ++#line 756 "parse.yacc" + { + aliasinfo *aip = find_alias(yyvsp[0].string, RUNAS_ALIAS); + +@@ -1867,7 +1822,7 @@ case 61: + } + break; + case 62: +-#line 762 "parse.yacc" ++#line 786 "parse.yacc" + { + if (printmatches == TRUE) { + if (in_alias == TRUE) +@@ -1880,7 +1835,7 @@ case 62: + } + break; + case 63: +-#line 774 "parse.yacc" ++#line 798 "parse.yacc" + { + /* Inherit {NO,}{PASSWD,EXEC,SETENV} status. */ + if (printmatches == TRUE && host_matches == TRUE && +@@ -1901,7 +1856,7 @@ case 63: + } + break; + case 64: +-#line 792 "parse.yacc" ++#line 816 "parse.yacc" + { + no_passwd = TRUE; + if (printmatches == TRUE && host_matches == TRUE && +@@ -1910,7 +1865,7 @@ case 64: + } + break; + case 65: +-#line 798 "parse.yacc" ++#line 822 "parse.yacc" + { + no_passwd = FALSE; + if (printmatches == TRUE && host_matches == TRUE && +@@ -1919,7 +1874,7 @@ case 65: + } + break; + case 66: +-#line 804 "parse.yacc" ++#line 828 "parse.yacc" + { + no_execve = TRUE; + if (printmatches == TRUE && host_matches == TRUE && +@@ -1928,7 +1883,7 @@ case 66: + } + break; + case 67: +-#line 810 "parse.yacc" ++#line 834 "parse.yacc" + { + no_execve = FALSE; + if (printmatches == TRUE && host_matches == TRUE && +@@ -1937,7 +1892,7 @@ case 67: + } + break; + case 68: +-#line 816 "parse.yacc" ++#line 840 "parse.yacc" + { + setenv_ok = TRUE; + if (printmatches == TRUE && host_matches == TRUE && +@@ -1946,7 +1901,7 @@ case 68: + } + break; + case 69: +-#line 822 "parse.yacc" ++#line 846 "parse.yacc" + { + setenv_ok = FALSE; + if (printmatches == TRUE && host_matches == TRUE && +@@ -1955,7 +1910,7 @@ case 69: + } + break; + case 70: +-#line 830 "parse.yacc" ++#line 854 "parse.yacc" + { + if (printmatches == TRUE) { + if (in_alias == TRUE) +@@ -1976,7 +1931,7 @@ case 70: + } + break; + case 71: +-#line 848 "parse.yacc" ++#line 872 "parse.yacc" + { + aliasinfo *aip; + +@@ -2008,7 +1963,7 @@ case 71: + } + break; + case 72: +-#line 877 "parse.yacc" ++#line 901 "parse.yacc" + { + if (printmatches == TRUE) { + if (in_alias == TRUE) { +@@ -2035,11 +1990,11 @@ case 72: + } + break; + case 75: +-#line 907 "parse.yacc" ++#line 931 "parse.yacc" + { push; } + break; + case 76: +-#line 907 "parse.yacc" ++#line 931 "parse.yacc" + { + if ((MATCHED(host_matches) || pedantic) && + !add_alias(yyvsp[-3].string, HOST_ALIAS, host_matches)) { +@@ -2050,7 +2005,7 @@ case 76: + } + break; + case 81: +-#line 925 "parse.yacc" ++#line 949 "parse.yacc" + { + push; + if (printmatches == TRUE) { +@@ -2063,7 +2018,7 @@ case 81: + } + break; + case 82: +-#line 934 "parse.yacc" ++#line 958 "parse.yacc" + { + if ((MATCHED(cmnd_matches) || pedantic) && + !add_alias(yyvsp[-3].string, CMND_ALIAS, cmnd_matches)) { +@@ -2078,11 +2033,11 @@ case 82: + } + break; + case 83: +-#line 948 "parse.yacc" ++#line 972 "parse.yacc" + { ; } + break; + case 87: +-#line 956 "parse.yacc" ++#line 980 "parse.yacc" + { + if (printmatches == TRUE) { + in_alias = TRUE; +@@ -2094,7 +2049,7 @@ case 87: + } + break; + case 88: +-#line 964 "parse.yacc" ++#line 988 "parse.yacc" + { + if ((yyvsp[0].BOOLEAN != NOMATCH || pedantic) && + !add_alias(yyvsp[-3].string, RUNAS_ALIAS, yyvsp[0].BOOLEAN)) { +@@ -2108,11 +2063,11 @@ case 88: + } + break; + case 91: +-#line 981 "parse.yacc" ++#line 1005 "parse.yacc" + { push; } + break; + case 92: +-#line 981 "parse.yacc" ++#line 1005 "parse.yacc" + { + if ((MATCHED(user_matches) || pedantic) && + !add_alias(yyvsp[-3].string, USER_ALIAS, user_matches)) { +@@ -2124,19 +2079,19 @@ case 92: + } + break; + case 95: +-#line 996 "parse.yacc" ++#line 1020 "parse.yacc" + { + SETMATCH(user_matches, yyvsp[0].BOOLEAN); + } + break; + case 96: +-#line 999 "parse.yacc" ++#line 1023 "parse.yacc" + { + SETNMATCH(user_matches, yyvsp[0].BOOLEAN); + } + break; + case 97: +-#line 1004 "parse.yacc" ++#line 1028 "parse.yacc" + { + if (userpw_matches(yyvsp[0].string, user_name, sudo_user.pw)) + yyval.BOOLEAN = TRUE; +@@ -2146,7 +2101,7 @@ case 97: + } + break; + case 98: +-#line 1011 "parse.yacc" ++#line 1035 "parse.yacc" + { + if (usergr_matches(yyvsp[0].string, user_name, sudo_user.pw)) + yyval.BOOLEAN = TRUE; +@@ -2156,7 +2111,7 @@ case 98: + } + break; + case 99: +-#line 1018 "parse.yacc" ++#line 1042 "parse.yacc" + { + if (netgr_matches(yyvsp[0].string, NULL, NULL, user_name)) + yyval.BOOLEAN = TRUE; +@@ -2166,7 +2121,7 @@ case 99: + } + break; + case 100: +-#line 1025 "parse.yacc" ++#line 1049 "parse.yacc" + { + aliasinfo *aip = find_alias(yyvsp[0].string, USER_ALIAS); + +@@ -2191,12 +2146,12 @@ case 100: + } + break; + case 101: +-#line 1047 "parse.yacc" ++#line 1071 "parse.yacc" + { + yyval.BOOLEAN = TRUE; + } + break; +-#line 2148 "sudo.tab.c" ++#line 2155 "sudo.tab.c" + } + yyssp -= yym; + yystate = *yyssp; +@@ -2246,24 +2201,13 @@ to state %d\n", YYPREFIX, *yyssp, yystat + *++yyssp = yystate; + *++yyvsp = yyval; + goto yyloop; ++ + yyoverflow: + yyerror("yacc stack overflow"); ++ + yyabort: +- if (yyss) +- free(yyss); +- if (yyvs) +- free(yyvs); +- yyss = yyssp = NULL; +- yyvs = yyvsp = NULL; +- yystacksize = 0; + return (1); ++ + yyaccept: +- if (yyss) +- free(yyss); +- if (yyvs) +- free(yyvs); +- yyss = yyssp = NULL; +- yyvs = yyvsp = NULL; +- yystacksize = 0; + return (0); + } diff --git a/sudo.spec b/sudo.spec index a59e9ec..e5f1603 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.6.9p13 -Release: 5%{?dist}.1 +Release: 6%{?dist} License: BSD Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -27,6 +27,7 @@ Patch2: sudo-1.6.9p4-login.patch Patch3: sudo-1.6.9p4-getgrouplist.patch Patch4: sudo-1.6.9p12-noPam.patch Patch5: sudo-1.6.9p13-audit.patch +Patch6: sudo-1.6.9p13-selinuxfix.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -46,6 +47,7 @@ on many different machines. %patch3 -p1 -b .getgrouplist %patch4 -p1 -b .noPam %patch5 -p1 -b .audit +%patch6 -p1 -b .selinuxfix autoreconf @@ -132,6 +134,9 @@ rm -rf $RPM_BUILD_ROOT /bin/chmod 0440 /etc/sudoers || : %changelog +* Thu Oct 30 2008 Daniel Kopecek 1.6.9p13-6 +- Fixed type/role parsing (#466292) + * Thu May 22 2008 Dennis Gilmore 1.6.9p13-5.1 - minor rebuild for sparc From 79a88b10e426529cc1796fb59798de52fa5a7103 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 30 Oct 2008 13:34:55 +0000 Subject: [PATCH 5/8] Release set to 7 because 6 is already used in devel branch (with f9 suffix). --- sudo.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sudo.spec b/sudo.spec index e5f1603..344b7aa 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.6.9p13 -Release: 6%{?dist} +Release: 7%{?dist} License: BSD Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -134,8 +134,10 @@ rm -rf $RPM_BUILD_ROOT /bin/chmod 0440 /etc/sudoers || : %changelog -* Thu Oct 30 2008 Daniel Kopecek 1.6.9p13-6 +* Thu Oct 30 2008 Daniel Kopecek 1.6.9p13-7 - Fixed type/role parsing (#466292) +- Release set to 7 because 6 is already used in devel branch + (with f9 suffix). * Thu May 22 2008 Dennis Gilmore 1.6.9p13-5.1 - minor rebuild for sparc From 7c8eaeaefed5eb8001bc565104d83182abac0ebd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 8 Jan 2009 14:11:40 +0000 Subject: [PATCH 6/8] Added /usr/local/bin to secure-path --- sudo.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sudo.spec b/sudo.spec index 344b7aa..e2426a9 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.6.9p13 -Release: 7%{?dist} +Release: 8%{?dist} License: BSD Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -75,7 +75,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie" --with-ldap \ --with-selinux \ --with-passprompt="[sudo] password for %p: " \ - --with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin" + --with-secure-path="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" # --without-kerb5 \ # --without-kerb4 make @@ -134,6 +134,9 @@ rm -rf $RPM_BUILD_ROOT /bin/chmod 0440 /etc/sudoers || : %changelog +* Thu Jan 08 2009 Daniel Kopecek 1.6.9p13-8 +- Added /usr/local/bin to secure-path + * Thu Oct 30 2008 Daniel Kopecek 1.6.9p13-7 - Fixed type/role parsing (#466292) - Release set to 7 because 6 is already used in devel branch From 229f6fc74876b9168d84a4c8c02dfa48ac14286a Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Thu, 26 Nov 2009 01:44:56 +0000 Subject: [PATCH 7/8] Fix typo that causes a failure to update the common directory. (releng #2781) --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 19b4f18..45ef6e6 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,10 @@ # Makefile for source rpm: sudo -# $Id: Makefile,v 1.1 2004/09/09 12:46:19 cvsdist Exp $ +# $Id: Makefile,v 1.2 2007/10/15 19:24:45 notting Exp $ NAME := sudo SPECFILE = $(firstword $(wildcard *.spec)) define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done +for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done endef MAKEFILE_COMMON := $(shell $(find-makefile-common)) From 03e774b3379ef223d1403d2c0f6dcf0541b42718 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 29 Jul 2010 13:19:39 +0000 Subject: [PATCH 8/8] dist-git conversion --- .cvsignore => .gitignore | 0 Makefile | 21 --------------------- branch | 1 - 3 files changed, 22 deletions(-) rename .cvsignore => .gitignore (100%) delete mode 100644 Makefile delete mode 100644 branch diff --git a/.cvsignore b/.gitignore similarity index 100% rename from .cvsignore rename to .gitignore diff --git a/Makefile b/Makefile deleted file mode 100644 index 45ef6e6..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: sudo -# $Id: Makefile,v 1.2 2007/10/15 19:24:45 notting Exp $ -NAME := sudo -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attempt a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/branch b/branch deleted file mode 100644 index 1c26f78..0000000 --- a/branch +++ /dev/null @@ -1 +0,0 @@ -F-9