From 50dc239656bb9cae4fd2a906e4065a1365ef8a47 Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Tue, 5 Apr 2016 12:52:51 +0200 Subject: [PATCH 01/11] update to 1.8.16 --- .gitignore | 1 + sources | 2 +- sudo.spec | 7 +++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2f6d35c..d5d6c38 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,4 @@ sudo-1.7.2p2-sudoers /sudo-1.8.14p1.tar.gz /sudo-1.8.14p3.tar.gz /sudo-1.8.15.tar.gz +/sudo-1.8.16.tar.gz diff --git a/sources b/sources index a565d42..fbe3514 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ +a977449587dc857e129bb20555b46af4 sudo-1.8.16.tar.gz 775b863cdff3a2ee2a26c2d53b51aff5 sudo-1.8.8-sudoers -7cf6b9b76d0478a572432bed481dd7b5 sudo-1.8.15.tar.gz diff --git a/sudo.spec b/sudo.spec index dc02960..7f54c1f 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.15 -Release: 2%{?dist} +Version: 1.8.16 +Release: 1%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -198,6 +198,9 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Mon Apr 04 2016 Daniel Kopecek 1.8.16-1 +- update to 1.8.16 + * Fri Feb 05 2016 Fedora Release Engineering - 1.8.15-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild From 051f80c5d2fd8d7d3ac6082fefbd03c4af25bb47 Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Thu, 12 May 2016 09:33:11 +0200 Subject: [PATCH 02/11] fixed invalid sesh argument array construction --- sudo-1.8.16-seshargsfix.patch | 41 +++++++++++++++++++++++++++++++++++ sudo.spec | 8 ++++++- 2 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 sudo-1.8.16-seshargsfix.patch diff --git a/sudo-1.8.16-seshargsfix.patch b/sudo-1.8.16-seshargsfix.patch new file mode 100644 index 0000000..43418bc --- /dev/null +++ b/sudo-1.8.16-seshargsfix.patch @@ -0,0 +1,41 @@ +diff -up sudo-1.8.16/src/selinux.c.seshargsfix sudo-1.8.16/src/selinux.c +--- sudo-1.8.16/src/selinux.c.seshargsfix 2016-03-17 17:13:10.000000000 +0100 ++++ sudo-1.8.16/src/selinux.c 2016-05-12 09:29:14.687014460 +0200 +@@ -378,7 +378,7 @@ selinux_execve(int fd, const char *path, + { + char **nargv; + const char *sesh; +- int argc, serrno; ++ int argc, nargc, serrno; + debug_decl(selinux_execve, SUDO_DEBUG_SELINUX) + + sesh = sudo_conf_sesh_path(); +@@ -409,9 +409,7 @@ selinux_execve(int fd, const char *path, + */ + for (argc = 0; argv[argc] != NULL; argc++) + continue; +- if (fd != -1) +- argc++; +- nargv = reallocarray(NULL, argc + 2, sizeof(char *)); ++ nargv = reallocarray(NULL, argc + 3, sizeof(char *)); + if (nargv == NULL) { + sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory")); + debug_return; +@@ -420,13 +418,13 @@ selinux_execve(int fd, const char *path, + nargv[0] = *argv[0] == '-' ? "-sesh-noexec" : "sesh-noexec"; + else + nargv[0] = *argv[0] == '-' ? "-sesh" : "sesh"; +- argc = 1; +- if (fd != -1 && asprintf(&nargv[argc++], "--execfd=%d", fd) == -1) { ++ nargc = 1; ++ if (fd != -1 && asprintf(&nargv[nargc++], "--execfd=%d", fd) == -1) { + sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory")); + debug_return; + } +- nargv[argc] = (char *)path; +- memcpy(&nargv[argc + 1], &argv[argc], argc * sizeof(char *)); /* copies NULL */ ++ nargv[nargc++] = (char *)path; ++ memcpy(&nargv[nargc], &argv[argc], argc * sizeof(char *)); /* copies NULL */ + + /* sesh will handle noexec for us. */ + sudo_execve(-1, sesh, nargv, envp, false); diff --git a/sudo.spec b/sudo.spec index 7f54c1f..1af1dfd 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.8.16 -Release: 1%{?dist} +Release: 2%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -32,6 +32,8 @@ Patch2: sudo-1.8.14p1-ldapconfpatch.patch Patch3: sudo-1.8.14p1-docpassexpire.patch # Patch initialize variable before executing sudo_strsplit Patch4: sudo-1.8.14p3-initialization.patch +# 1335401 - Weird sudo issue that seems to be selinux related +Patch5: sudo-1.8.16-seshargsfix.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -60,6 +62,7 @@ plugins that use %{name}. %patch2 -p1 -b .ldapconfpatch %patch3 -p1 -b .docpassexpire %patch4 -p1 -b .initialization +%patch5 -p1 -b .seshargsfix %build # Remove bundled copy of zlib @@ -198,6 +201,9 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Thu May 12 2016 Daniel Kopecek 1.8.16-2 +- fixed invalid sesh argument array construction + * Mon Apr 04 2016 Daniel Kopecek 1.8.16-1 - update to 1.8.16 From b1ec1d203561eec535cd0cd376cb9847b62711fc Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Fri, 13 May 2016 11:28:06 +0200 Subject: [PATCH 03/11] fixed upstream patch for rhbz#1335401 --- sudo-1.8.16-seshargsfix.patch | 4 ++-- sudo.spec | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/sudo-1.8.16-seshargsfix.patch b/sudo-1.8.16-seshargsfix.patch index 43418bc..725fe75 100644 --- a/sudo-1.8.16-seshargsfix.patch +++ b/sudo-1.8.16-seshargsfix.patch @@ -1,6 +1,6 @@ diff -up sudo-1.8.16/src/selinux.c.seshargsfix sudo-1.8.16/src/selinux.c --- sudo-1.8.16/src/selinux.c.seshargsfix 2016-03-17 17:13:10.000000000 +0100 -+++ sudo-1.8.16/src/selinux.c 2016-05-12 09:29:14.687014460 +0200 ++++ sudo-1.8.16/src/selinux.c 2016-05-13 11:14:04.628296996 +0200 @@ -378,7 +378,7 @@ selinux_execve(int fd, const char *path, { char **nargv; @@ -35,7 +35,7 @@ diff -up sudo-1.8.16/src/selinux.c.seshargsfix sudo-1.8.16/src/selinux.c - nargv[argc] = (char *)path; - memcpy(&nargv[argc + 1], &argv[argc], argc * sizeof(char *)); /* copies NULL */ + nargv[nargc++] = (char *)path; -+ memcpy(&nargv[nargc], &argv[argc], argc * sizeof(char *)); /* copies NULL */ ++ memcpy(&nargv[nargc], &argv[1], argc * sizeof(char *)); /* copies NULL */ /* sesh will handle noexec for us. */ sudo_execve(-1, sesh, nargv, envp, false); diff --git a/sudo.spec b/sudo.spec index 1af1dfd..58d07f6 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.8.16 -Release: 2%{?dist} +Release: 3%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -201,6 +201,9 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Fri May 13 2016 Daniel Kopecek 1.8.16-3 +- fixed upstream patch for rhbz#1335401 + * Thu May 12 2016 Daniel Kopecek 1.8.16-2 - fixed invalid sesh argument array construction From 8d93f09269494bcd013eec8f1de31223c69664c3 Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Tue, 31 May 2016 12:22:54 +0200 Subject: [PATCH 04/11] Track the default sudoers file in git --- .gitignore | 21 ------------ sources | 1 - sudo.spec | 2 +- sudoers | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 97 insertions(+), 23 deletions(-) create mode 100644 sudoers diff --git a/.gitignore b/.gitignore index d5d6c38..f68bf75 100644 --- a/.gitignore +++ b/.gitignore @@ -1,22 +1 @@ -sudo-1.7.2p6.tar.gz -sudo-1.7.2p2-sudoers -/sudo-1.7.4p4.tar.gz -/sudo-1.7.2p2-sudoers -/sudo-1.7.4p4-sudoers -/sudo-1.7.4p5.tar.gz -/sudo-1.8.1p2.tar.gz -/sudo-1.8.3p1.tar.gz -/sudo-1.8.5.tar.gz -/sudo-1.8.6.tar.gz -/sudo-1.8.6p3.tar.gz -/sudo-1.8.6p7.tar.gz -/sudo-1.8.8.tar.gz -/sudo-1.8.8-sudoers -/sudo-1.8.11.tar.gz -/sudo-1.8.11p2.tar.gz -/sudo-1.8.12.tar.gz -/sudo-1.8.14b4.tar.gz -/sudo-1.8.14p1.tar.gz -/sudo-1.8.14p3.tar.gz -/sudo-1.8.15.tar.gz /sudo-1.8.16.tar.gz diff --git a/sources b/sources index fbe3514..41f39d1 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ a977449587dc857e129bb20555b46af4 sudo-1.8.16.tar.gz -775b863cdff3a2ee2a26c2d53b51aff5 sudo-1.8.8-sudoers diff --git a/sudo.spec b/sudo.spec index 58d07f6..3b1d43b 100644 --- a/sudo.spec +++ b/sudo.spec @@ -6,7 +6,7 @@ License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz -Source1: sudo-1.8.8-sudoers +Source1: sudoers Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: /etc/pam.d/system-auth Requires: /usr/bin/vi diff --git a/sudoers b/sudoers new file mode 100644 index 0000000..be6332f --- /dev/null +++ b/sudoers @@ -0,0 +1,96 @@ +## Sudoers allows particular users to run various commands as +## the root user, without needing the root password. +## +## Examples are provided at the bottom of the file for collections +## of related commands, which can then be delegated out to particular +## users or groups. +## +## This file must be edited with the 'visudo' command. + +## Host Aliases +## Groups of machines. You may prefer to use hostnames (perhaps using +## wildcards for entire domains) or IP addresses instead. +# Host_Alias FILESERVERS = fs1, fs2 +# Host_Alias MAILSERVERS = smtp, smtp2 + +## User Aliases +## These aren't often necessary, as you can use regular groups +## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname +## rather than USERALIAS +# User_Alias ADMINS = jsmith, mikem + + +## Command Aliases +## These are groups of related commands... + +## Networking +# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool + +## Installation and management of software +# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum + +## Services +# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig + +## Updating the locate database +# Cmnd_Alias LOCATE = /usr/bin/updatedb + +## Storage +# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount + +## Delegating permissions +# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp + +## Processes +# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall + +## Drivers +# Cmnd_Alias DRIVERS = /sbin/modprobe + +# Defaults specification + +# +# Refuse to run if unable to disable echo on the tty. +# +Defaults !visiblepw + +Defaults env_reset +Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS" +Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE" +Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES" +Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE" +Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY" + +Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin + +## Next comes the main part: which users can run what software on +## which machines (the sudoers file can be shared between multiple +## systems). +## Syntax: +## +## user MACHINE=COMMANDS +## +## The COMMANDS section may have other options added to it. +## +## Allow root to run any commands anywhere +root ALL=(ALL) ALL + +## Allows members of the 'sys' group to run networking, software, +## service management apps and more. +# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS + +## Allows people in group wheel to run all commands +%wheel ALL=(ALL) ALL + +## Same thing without a password +# %wheel ALL=(ALL) NOPASSWD: ALL + +## Allows members of the users group to mount and unmount the +## cdrom as root +# %users ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom + +## Allows members of the users group to shutdown this system +# %users localhost=/sbin/shutdown -h now + +## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment) +#includedir /etc/sudoers.d From a3b3d5977e94a877b3cc20eab0e0829ffd29c0b2 Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Tue, 31 May 2016 14:17:26 +0200 Subject: [PATCH 05/11] removed INPUTRC from env_keep to prevent a possible info leak Resolves: rhbz#1340701 --- sudo.spec | 6 +++++- sudoers | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/sudo.spec b/sudo.spec index 3b1d43b..2a01943 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.8.16 -Release: 3%{?dist} +Release: 4%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -201,6 +201,10 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Tue May 31 2016 Daniel Kopecek 1.8.16-4 +- removed INPUTRC from env_keep to prevent a possible info leak + Resolves: rhbz#1340701 + * Fri May 13 2016 Daniel Kopecek 1.8.16-3 - fixed upstream patch for rhbz#1335401 diff --git a/sudoers b/sudoers index be6332f..bc4d793 100644 --- a/sudoers +++ b/sudoers @@ -55,7 +55,7 @@ Defaults !visiblepw Defaults env_reset -Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS" +Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS" Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE" Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES" Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE" From cc26f17cfe37ba41254cd069f3aa66b9ac4554eb Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Fri, 24 Jun 2016 16:22:57 +0200 Subject: [PATCH 06/11] update to 1.8.17p1 - install the /var/db/sudo/lectured Resolves: rhbz#1321414 --- .gitignore | 1 + sources | 2 +- sudo-1.7.2p1-envdebug.patch | 12 --- sudo-1.8.11p2-auditfix.patch | 17 ---- sudo-1.8.14p1-docpassexpire.patch | 38 --------- sudo-1.8.14p3-initialization.patch | 122 ----------------------------- sudo-1.8.16-seshargsfix.patch | 41 ---------- sudo-1.8.8-clangbugs.patch | 60 -------------- sudo-1.8.8-sssdfixes.patch | 119 ---------------------------- sudo-1.8.8-strictuidgid.patch | 53 ------------- sudo.spec | 20 +++-- 11 files changed, 11 insertions(+), 474 deletions(-) delete mode 100644 sudo-1.7.2p1-envdebug.patch delete mode 100644 sudo-1.8.11p2-auditfix.patch delete mode 100644 sudo-1.8.14p1-docpassexpire.patch delete mode 100644 sudo-1.8.14p3-initialization.patch delete mode 100644 sudo-1.8.16-seshargsfix.patch delete mode 100644 sudo-1.8.8-clangbugs.patch delete mode 100644 sudo-1.8.8-sssdfixes.patch delete mode 100644 sudo-1.8.8-strictuidgid.patch diff --git a/.gitignore b/.gitignore index f68bf75..04f884a 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /sudo-1.8.16.tar.gz +/sudo-1.8.17p1.tar.gz diff --git a/sources b/sources index 41f39d1..9534406 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -a977449587dc857e129bb20555b46af4 sudo-1.8.16.tar.gz +50a840a688ceb6fa3ab24fc0adf4fa23 sudo-1.8.17p1.tar.gz diff --git a/sudo-1.7.2p1-envdebug.patch b/sudo-1.7.2p1-envdebug.patch deleted file mode 100644 index e189c98..0000000 --- a/sudo-1.7.2p1-envdebug.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up sudo-1.7.2p1/configure.in.envdebug sudo-1.7.2p1/configure.in ---- sudo-1.7.2p1/configure.in.envdebug 2009-10-30 12:18:09.000000000 +0100 -+++ sudo-1.7.2p1/configure.in 2009-10-30 12:19:01.000000000 +0100 -@@ -1214,7 +1214,7 @@ AC_ARG_ENABLE(env_debug, - [AS_HELP_STRING([--enable-env-debug], [Whether to enable environment debugging.])], - [ case "$enableval" in - yes) AC_MSG_RESULT(yes) -- AC_DEFINE(ENV_DEBUG) -+ AC_DEFINE(ENV_DEBUG, [], [Environment debugging.]) - ;; - no) AC_MSG_RESULT(no) - ;; diff --git a/sudo-1.8.11p2-auditfix.patch b/sudo-1.8.11p2-auditfix.patch deleted file mode 100644 index 963ef4e..0000000 --- a/sudo-1.8.11p2-auditfix.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff -up sudo-1.8.11p2/plugins/sudoers/linux_audit.c.auditfix sudo-1.8.11p2/plugins/sudoers/linux_audit.c ---- sudo-1.8.11p2/plugins/sudoers/linux_audit.c.auditfix 2014-11-03 12:44:53.674230966 +0100 -+++ sudo-1.8.11p2/plugins/sudoers/linux_audit.c 2014-11-03 12:45:13.407021599 +0100 -@@ -57,10 +57,10 @@ linux_audit_open(void) - au_fd = audit_open(); - if (au_fd == -1) { - /* Kernel may not have audit support. */ -- if (errno != EINVAL && errno != EPROTONOSUPPORT && errno != EAFNOSUPPORT) { -- sudo_warn(U_("unable to open audit system")); -+ if (errno == EINVAL || errno == EPROTONOSUPPORT || errno == EAFNOSUPPORT) - au_fd = AUDIT_NOT_CONFIGURED; -- } -+ else -+ sudo_warn(U_("unable to open audit system")); - } else { - (void)fcntl(au_fd, F_SETFD, FD_CLOEXEC); - } diff --git a/sudo-1.8.14p1-docpassexpire.patch b/sudo-1.8.14p1-docpassexpire.patch deleted file mode 100644 index cb7fe8a..0000000 --- a/sudo-1.8.14p1-docpassexpire.patch +++ /dev/null @@ -1,38 +0,0 @@ -diff -up sudo-1.8.14b4/doc/sudoers.cat.docpassexpire sudo-1.8.14b4/doc/sudoers.cat ---- sudo-1.8.14b4/doc/sudoers.cat.docpassexpire 2015-06-09 00:47:07.000000000 +0200 -+++ sudo-1.8.14b4/doc/sudoers.cat 2015-07-14 13:11:11.116000185 +0200 -@@ -1328,8 +1328,8 @@ SSUUDDOOEERRSS OOPPTTIIOONN - fractional component if minute granularity is - insufficient, for example 2.5. The default is 5. Set - this to 0 to always prompt for a password. If set to a -- value less than 0 the user's time stamp will never -- expire. This can be used to allow users to create or -+ value less than 0 the user's time stamp will not -+ expire until reboot. This can be used to allow users to create or - delete their own time stamps via ``sudo -v'' and ``sudo - -k'' respectively. - -diff -up sudo-1.8.14b4/doc/sudoers.man.in.docpassexpire sudo-1.8.14b4/doc/sudoers.man.in ---- sudo-1.8.14b4/doc/sudoers.man.in.docpassexpire 2015-07-14 13:11:11.116000185 +0200 -+++ sudo-1.8.14b4/doc/sudoers.man.in 2015-07-14 13:14:17.261222481 +0200 -@@ -2822,7 +2822,7 @@ Set this to - to always prompt for a password. - If set to a value less than - \fR0\fR --the user's time stamp will never expire. -+the user's time stamp will not expire until reboot. - This can be used to allow users to create or delete their own time stamps via - \(Lq\fRsudo -v\fR\(Rq - and -diff -up sudo-1.8.14b4/doc/sudoers.mdoc.in.docpassexpire sudo-1.8.14b4/doc/sudoers.mdoc.in ---- sudo-1.8.14b4/doc/sudoers.mdoc.in.docpassexpire 2015-04-07 18:15:50.000000000 +0200 -+++ sudo-1.8.14b4/doc/sudoers.mdoc.in 2015-07-14 13:11:11.117000176 +0200 -@@ -2647,7 +2647,7 @@ Set this to - to always prompt for a password. - If set to a value less than - .Li 0 --the user's time stamp will never expire. -+the user's time stamp will not expire until reboot. - This can be used to allow users to create or delete their own time stamps via - .Dq Li sudo -v - and diff --git a/sudo-1.8.14p3-initialization.patch b/sudo-1.8.14p3-initialization.patch deleted file mode 100644 index 75da7fd..0000000 --- a/sudo-1.8.14p3-initialization.patch +++ /dev/null @@ -1,122 +0,0 @@ -diff -up ./lib/util/strsplit.c.initialization ./lib/util/strsplit.c ---- ./lib/util/strsplit.c.initialization 2015-07-22 14:22:49.000000000 +0200 -+++ ./lib/util/strsplit.c 2015-08-18 13:28:28.141319501 +0200 -@@ -37,6 +37,10 @@ sudo_strsplit_v1(const char *str, const - const char *cp, *s; - debug_decl(sudo_strsplit, SUDO_DEBUG_UTIL) - -+ /* exclusion of two NULLs at the same time */ -+ if (str == NULL && *last == NULL) -+ debug_return_ptr(NULL); -+ - /* If no str specified, use last ptr (if any). */ - if (str == NULL) - str = *last; -diff -up ./lib/util/sudo_conf.c.initialization ./lib/util/sudo_conf.c ---- ./lib/util/sudo_conf.c.initialization 2015-07-22 14:22:49.000000000 +0200 -+++ ./lib/util/sudo_conf.c 2015-08-18 13:28:28.142319494 +0200 -@@ -161,7 +161,7 @@ static int - parse_path(const char *entry, const char *conf_file, unsigned int lineno) - { - const char *entry_end = entry + strlen(entry); -- const char *ep, *name, *path; -+ const char *ep = NULL, *name, *path; - struct sudo_conf_path_table *cur; - size_t namelen; - debug_decl(parse_path, SUDO_DEBUG_UTIL) -@@ -208,7 +208,7 @@ parse_debug(const char *entry, const cha - { - struct sudo_conf_debug *debug_spec; - struct sudo_debug_file *debug_file = NULL; -- const char *ep, *path, *progname, *flags; -+ const char *ep = NULL, *path, *progname, *flags; - const char *entry_end = entry + strlen(entry); - size_t pathlen, prognamelen; - debug_decl(parse_debug, SUDO_DEBUG_UTIL) -@@ -278,7 +278,7 @@ static int - parse_plugin(const char *entry, const char *conf_file, unsigned int lineno) - { - struct plugin_info *info = NULL; -- const char *ep, *path, *symbol; -+ const char *ep = NULL, *path, *symbol; - const char *entry_end = entry + strlen(entry); - char **options = NULL; - size_t pathlen, symlen; -diff -up ./plugins/sudoers/editor.c.initialization ./plugins/sudoers/editor.c ---- ./plugins/sudoers/editor.c.initialization 2015-07-22 14:22:49.000000000 +0200 -+++ ./plugins/sudoers/editor.c 2015-08-18 13:28:28.142319494 +0200 -@@ -45,7 +45,7 @@ resolve_editor(const char *ed, size_t ed - int *argc_out, char ***argv_out, char * const *whitelist) - { - char **nargv, *editor, *editor_path = NULL; -- const char *cp, *ep, *tmp; -+ const char *cp, *ep = NULL, *tmp; - const char *edend = ed + edlen; - struct stat user_editor_sb; - int nargc; -diff -up ./plugins/sudoers/interfaces.c.initialization ./plugins/sudoers/interfaces.c ---- ./plugins/sudoers/interfaces.c.initialization 2015-07-22 14:22:50.000000000 +0200 -+++ ./plugins/sudoers/interfaces.c 2015-08-18 13:28:28.142319494 +0200 -@@ -109,7 +109,7 @@ get_interfaces(void) - void - dump_interfaces(const char *ai) - { -- const char *cp, *ep; -+ const char *cp, *ep = NULL; - const char *ai_end = ai + strlen(ai); - debug_decl(set_interfaces, SUDOERS_DEBUG_NETIF) - -diff -up ./plugins/sudoers/sudoers.c.initialization ./plugins/sudoers/sudoers.c ---- ./plugins/sudoers/sudoers.c.initialization 2015-07-22 14:22:50.000000000 +0200 -+++ ./plugins/sudoers/sudoers.c 2015-08-18 13:28:28.142319494 +0200 -@@ -1186,7 +1186,7 @@ sudoers_cleanup(void) - static char * - find_editor(int nfiles, char **files, int *argc_out, char ***argv_out) - { -- const char *cp, *ep, *editor = NULL; -+ const char *cp, *ep = NULL, *editor = NULL; - char *editor_path = NULL, **ev, *ev0[4]; - debug_decl(find_editor, SUDOERS_DEBUG_PLUGIN) - -diff -up ./plugins/sudoers/sudoreplay.c.initialization ./plugins/sudoers/sudoreplay.c ---- ./plugins/sudoers/sudoreplay.c.initialization 2015-07-22 14:22:49.000000000 +0200 -+++ ./plugins/sudoers/sudoreplay.c 2015-08-18 13:39:53.776411920 +0200 -@@ -189,7 +189,7 @@ main(int argc, char *argv[]) - int ch, idx, plen, exitcode = 0, rows = 0, cols = 0; - bool def_filter = true, listonly = false; - const char *decimal, *id, *user = NULL, *pattern = NULL, *tty = NULL; -- char *cp, *ep, path[PATH_MAX]; -+ char *cp, *ep = NULL, path[PATH_MAX]; - struct log_info *li; - double max_wait = 0; - debug_decl(main, SUDO_DEBUG_MAIN) -@@ -225,6 +225,8 @@ main(int argc, char *argv[]) - /* Set the replay filter. */ - def_filter = false; - for (cp = strtok_r(optarg, ",", &ep); cp; cp = strtok_r(NULL, ",", &ep)) { -+ if (ep == NULL) -+ sudo_fatalx(U_("invalid filter option: %s"), optarg); - if (strcmp(cp, "stdout") == 0) - io_log_files[IOFD_STDOUT].enabled = true; - else if (strcmp(cp, "stderr") == 0) -diff -up ./plugins/sudoers/visudo.c.initialization ./plugins/sudoers/visudo.c ---- ./plugins/sudoers/visudo.c.initialization 2015-07-22 14:22:50.000000000 +0200 -+++ ./plugins/sudoers/visudo.c 2015-08-18 13:28:28.142319494 +0200 -@@ -287,7 +287,7 @@ get_editor(int *editor_argc, char ***edi - - /* Build up editor whitelist from def_editor unless env_editor is set. */ - if (!def_env_editor) { -- const char *cp, *ep; -+ const char *cp, *ep = NULL; - const char *def_editor_end = def_editor + strlen(def_editor); - - /* Count number of entries in whitelist and split into a list. */ -@@ -325,7 +325,7 @@ get_editor(int *editor_argc, char ***edi - if (editor_path == NULL) { - /* def_editor could be a path, split it up, avoiding strtok() */ - const char *def_editor_end = def_editor + strlen(def_editor); -- const char *cp, *ep; -+ const char *cp, *ep = NULL; - for (cp = sudo_strsplit(def_editor, def_editor_end, ":", &ep); - cp != NULL; cp = sudo_strsplit(NULL, def_editor_end, ":", &ep)) { - editor_path = resolve_editor(cp, (size_t)(ep - cp), 2, files, diff --git a/sudo-1.8.16-seshargsfix.patch b/sudo-1.8.16-seshargsfix.patch deleted file mode 100644 index 725fe75..0000000 --- a/sudo-1.8.16-seshargsfix.patch +++ /dev/null @@ -1,41 +0,0 @@ -diff -up sudo-1.8.16/src/selinux.c.seshargsfix sudo-1.8.16/src/selinux.c ---- sudo-1.8.16/src/selinux.c.seshargsfix 2016-03-17 17:13:10.000000000 +0100 -+++ sudo-1.8.16/src/selinux.c 2016-05-13 11:14:04.628296996 +0200 -@@ -378,7 +378,7 @@ selinux_execve(int fd, const char *path, - { - char **nargv; - const char *sesh; -- int argc, serrno; -+ int argc, nargc, serrno; - debug_decl(selinux_execve, SUDO_DEBUG_SELINUX) - - sesh = sudo_conf_sesh_path(); -@@ -409,9 +409,7 @@ selinux_execve(int fd, const char *path, - */ - for (argc = 0; argv[argc] != NULL; argc++) - continue; -- if (fd != -1) -- argc++; -- nargv = reallocarray(NULL, argc + 2, sizeof(char *)); -+ nargv = reallocarray(NULL, argc + 3, sizeof(char *)); - if (nargv == NULL) { - sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory")); - debug_return; -@@ -420,13 +418,13 @@ selinux_execve(int fd, const char *path, - nargv[0] = *argv[0] == '-' ? "-sesh-noexec" : "sesh-noexec"; - else - nargv[0] = *argv[0] == '-' ? "-sesh" : "sesh"; -- argc = 1; -- if (fd != -1 && asprintf(&nargv[argc++], "--execfd=%d", fd) == -1) { -+ nargc = 1; -+ if (fd != -1 && asprintf(&nargv[nargc++], "--execfd=%d", fd) == -1) { - sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory")); - debug_return; - } -- nargv[argc] = (char *)path; -- memcpy(&nargv[argc + 1], &argv[argc], argc * sizeof(char *)); /* copies NULL */ -+ nargv[nargc++] = (char *)path; -+ memcpy(&nargv[nargc], &argv[1], argc * sizeof(char *)); /* copies NULL */ - - /* sesh will handle noexec for us. */ - sudo_execve(-1, sesh, nargv, envp, false); diff --git a/sudo-1.8.8-clangbugs.patch b/sudo-1.8.8-clangbugs.patch deleted file mode 100644 index 9d4f1cb..0000000 --- a/sudo-1.8.8-clangbugs.patch +++ /dev/null @@ -1,60 +0,0 @@ -diff -up sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs sudo-1.8.8/plugins/sudoers/auth/pam.c ---- sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs 2013-09-30 23:41:07.899529555 +0200 -+++ sudo-1.8.8/plugins/sudoers/auth/pam.c 2013-09-30 23:41:58.988707761 +0200 -@@ -246,6 +246,7 @@ sudo_pam_begin_session(struct passwd *pw - (void) pam_end(pamh, *pam_status | PAM_DATA_SILENT); - pamh = NULL; - status = AUTH_FAILURE; -+ goto done; - } - } - -diff -up sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs sudo-1.8.8/plugins/sudoers/sssd.c ---- sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs 2013-09-30 23:44:20.404200629 +0200 -+++ sudo-1.8.8/plugins/sudoers/sssd.c 2013-09-30 23:49:05.998194738 +0200 -@@ -310,11 +310,10 @@ static int sudo_sss_close(struct sudo_ns - debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD); - - if (nss && nss->handle) { -- handle = nss->handle; -- dlclose(handle->ssslib); -+ handle = nss->handle; -+ dlclose(handle->ssslib); -+ efree(nss->handle); - } -- -- efree(nss->handle); - debug_return_int(0); - } - -@@ -705,17 +704,21 @@ sudo_sss_result_get(struct sudo_nss *nss - sudo_sss_result_filterp, _SUDO_SSS_FILTER_INCLUDE, NULL); - - if (f_sss_result != NULL) { -- if (f_sss_result->num_rules > 0) { -- if (state != NULL) { -- sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH"); -- *state |= _SUDO_SSS_STATE_HOSTMATCH; -+ if (f_sss_result->num_rules > 0) { -+ if (state != NULL) { -+ sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH"); -+ *state |= _SUDO_SSS_STATE_HOSTMATCH; -+ } - } -- } -- } - -- sudo_debug_printf(SUDO_DEBUG_DEBUG, -- "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result, -- u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules); -+ sudo_debug_printf(SUDO_DEBUG_DEBUG, -+ "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result, -+ u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules); -+ } else { -+ sudo_debug_printf(SUDO_DEBUG_DEBUG, -+ "u_sss_result=(%p, %u) => f_sss_result=NULL", -+ u_sss_result, u_sss_result->num_rules); -+ } - - handle->fn_free_result(u_sss_result); - diff --git a/sudo-1.8.8-sssdfixes.patch b/sudo-1.8.8-sssdfixes.patch deleted file mode 100644 index 31edde6..0000000 --- a/sudo-1.8.8-sssdfixes.patch +++ /dev/null @@ -1,119 +0,0 @@ -diff -up sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes sudo-1.8.8/plugins/sudoers/sssd.c ---- sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes 2013-09-30 23:18:49.641913457 +0200 -+++ sudo-1.8.8/plugins/sudoers/sssd.c 2013-09-30 23:25:54.819376696 +0200 -@@ -534,30 +534,31 @@ sudo_sss_check_runas_group(struct sudo_s - * Walk through search results and return true if we have a runas match, - * else false. RunAs info is optional. - */ --static int -+static bool - sudo_sss_check_runas(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule) - { -- int ret; -+ bool ret; - debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD); - - if (rule == NULL) -- debug_return_int(false); -+ debug_return_bool(false); - - ret = sudo_sss_check_runas_user(handle, rule) != false && - sudo_sss_check_runas_group(handle, rule) != false; - -- debug_return_int(ret); -+ debug_return_bool(ret); - } - --static int -+static bool - sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule) - { - char **val_array, *val; -- int ret = false, i; -+ bool ret = false; -+ int i; - debug_decl(sudo_sss_check_host, SUDO_DEBUG_SSSD); - - if (rule == NULL) -- debug_return_int(ret); -+ debug_return_bool(ret); - - /* get the values from the rule */ - switch (handle->fn_get_values(rule, "sudoHost", &val_array)) -@@ -566,10 +567,10 @@ sudo_sss_check_host(struct sudo_sss_hand - break; - case ENOENT: - sudo_debug_printf(SUDO_DEBUG_INFO, "No result."); -- debug_return_int(false); -+ debug_return_bool(false); - default: - sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoHost): != 0"); -- debug_return_int(ret); -+ debug_return_bool(ret); - } - - /* walk through values */ -@@ -589,7 +590,52 @@ sudo_sss_check_host(struct sudo_sss_hand - - handle->fn_free_values(val_array); - -- debug_return_int(ret); -+ debug_return_bool(ret); -+} -+ -+/* -+ * Look for netgroup specifcations in the sudoUser attribute and -+ * if found, filter according to netgroup membership. -+ * returns: -+ * true -> netgroup spec found && negroup member -+ * false -> netgroup spec found && not a meber of netgroup -+ * true -> netgroup spec not found (filtered by SSSD already, netgroups are an exception) -+ */ -+bool sudo_sss_filter_user_netgroup(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule) -+{ -+ bool ret = false, netgroup_spec_found = false; -+ char **val_array, *val; -+ int i; -+ debug_decl(sudo_sss_check_user_netgroup, SUDO_DEBUG_SSSD); -+ -+ if (!handle || !rule) -+ debug_return_bool(ret); -+ -+ switch (handle->fn_get_values(rule, "sudoUser", &val_array)) { -+ case 0: -+ break; -+ case ENOENT: -+ sudo_debug_printf(SUDO_DEBUG_INFO, "No result."); -+ debug_return_bool(ret); -+ default: -+ sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoUser): != 0"); -+ debug_return_bool(ret); -+ } -+ -+ for (i = 0; val_array[i] != NULL && !ret; ++i) { -+ val = val_array[i]; -+ if (*val == '+') { -+ netgroup_spec_found = true; -+ } -+ sudo_debug_printf(SUDO_DEBUG_DEBUG, "val[%d]=%s", i, val); -+ if (strcmp(val, "ALL") == 0 || netgr_matches(val, NULL, NULL, user_name)) { -+ ret = true; -+ sudo_debug_printf(SUDO_DEBUG_DIAG, -+ "sssd/ldap sudoUser '%s' ... MATCH! (%s)", val, user_name); -+ } -+ } -+ handle->fn_free_values(val_array); -+ debug_return_bool(netgroup_spec_found ? ret : true); - } - - static int -@@ -599,7 +645,8 @@ sudo_sss_result_filterp(struct sudo_sss_ - (void)unused; - debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD); - -- if (sudo_sss_check_host(handle, rule)) -+ if (sudo_sss_check_host(handle, rule) && -+ sudo_sss_filter_user_netgroup(handle, rule)) - debug_return_int(1); - else - debug_return_int(0); diff --git a/sudo-1.8.8-strictuidgid.patch b/sudo-1.8.8-strictuidgid.patch deleted file mode 100644 index ebb14ff..0000000 --- a/sudo-1.8.8-strictuidgid.patch +++ /dev/null @@ -1,53 +0,0 @@ -diff -up sudo-1.8.8/plugins/sudoers/match.c.strictuidgid sudo-1.8.8/plugins/sudoers/match.c ---- sudo-1.8.8/plugins/sudoers/match.c.strictuidgid 2013-09-30 23:30:12.359263967 +0200 -+++ sudo-1.8.8/plugins/sudoers/match.c 2013-09-30 23:31:04.335443002 +0200 -@@ -777,14 +777,16 @@ hostname_matches(char *shost, char *lhos - bool - userpw_matches(char *sudoers_user, char *user, struct passwd *pw) - { -- debug_decl(userpw_matches, SUDO_DEBUG_MATCH) -- -- if (pw != NULL && *sudoers_user == '#') { -- uid_t uid = (uid_t) atoi(sudoers_user + 1); -- if (uid == pw->pw_uid) -- debug_return_bool(true); -- } -- debug_return_bool(strcmp(sudoers_user, user) == 0); -+ debug_decl(userpw_matches, SUDO_DEBUG_MATCH) -+ if (pw != NULL && *sudoers_user == '#') { -+ char *end = NULL; -+ uid_t uid = (uid_t) strtol(sudoers_user + 1, &end, 10); -+ if (end != NULL && (sudoers_user[1] != '\0' && *end == '\0')) { -+ if (uid == pw->pw_uid) -+ debug_return_bool(true); -+ } -+ } -+ debug_return_bool(strcmp(sudoers_user, user) == 0); - } - - /* -@@ -794,14 +796,16 @@ userpw_matches(char *sudoers_user, char - bool - group_matches(char *sudoers_group, struct group *gr) - { -- debug_decl(group_matches, SUDO_DEBUG_MATCH) -- -- if (*sudoers_group == '#') { -- gid_t gid = (gid_t) atoi(sudoers_group + 1); -- if (gid == gr->gr_gid) -- debug_return_bool(true); -- } -- debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0); -+ debug_decl(group_matches, SUDO_DEBUG_MATCH) -+ if (*sudoers_group == '#') { -+ char *end = NULL; -+ gid_t gid = (gid_t) strtol(sudoers_group + 1, &end, 10); -+ if (end != NULL && (sudoers_group[1] != '\0' && *end == '\0')) { -+ if (gid == gr->gr_gid) -+ debug_return_bool(true); -+ } -+ } -+ debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0); - } - - /* diff --git a/sudo.spec b/sudo.spec index 2a01943..5f72730 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.16 -Release: 4%{?dist} +Version: 1.8.17p1 +Release: 1%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -28,12 +28,6 @@ BuildRequires: zlib-devel Patch1: sudo-1.6.7p5-strip.patch # Patch to read ldap.conf more closely to nss_ldap Patch2: sudo-1.8.14p1-ldapconfpatch.patch -# Patch makes changes in documentation bz:1162070 -Patch3: sudo-1.8.14p1-docpassexpire.patch -# Patch initialize variable before executing sudo_strsplit -Patch4: sudo-1.8.14p3-initialization.patch -# 1335401 - Weird sudo issue that seems to be selinux related -Patch5: sudo-1.8.16-seshargsfix.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -60,9 +54,6 @@ plugins that use %{name}. %patch1 -p1 -b .strip %patch2 -p1 -b .ldapconfpatch -%patch3 -p1 -b .docpassexpire -%patch4 -p1 -b .initialization -%patch5 -p1 -b .seshargsfix %build # Remove bundled copy of zlib @@ -108,6 +99,7 @@ make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` s chmod 755 $RPM_BUILD_ROOT%{_bindir}/* $RPM_BUILD_ROOT%{_sbindir}/* install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo +install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers @@ -163,6 +155,7 @@ rm -rf $RPM_BUILD_ROOT %config(noreplace) /etc/pam.d/sudo-i %attr(0644,root,root) %{_tmpfilesdir}/sudo.conf %dir /var/db/sudo +%dir /var/db/sudo/lectured %attr(4111,root,root) %{_bindir}/sudo %{_bindir}/sudoedit %attr(0111,root,root) %{_bindir}/sudoreplay @@ -201,6 +194,11 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Fri Jun 24 2016 Daniel Kopecek 1.8.17p1-1 +- update to 1.8.17p1 +- install the /var/db/sudo/lectured + Resolves: rhbz#1321414 + * Tue May 31 2016 Daniel Kopecek 1.8.16-4 - removed INPUTRC from env_keep to prevent a possible info leak Resolves: rhbz#1340701 From 89e79d5fa430bc7c8250ebce23b4571299f35d88 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Fri, 26 Aug 2016 14:05:06 +0200 Subject: [PATCH 07/11] update to 1.8.18 - dropped sudo-1.8.14p1-ldapconfpatch.patch upstreamed --> https://www.sudo.ws/pipermail/sudo-workers/2016-September/001006.html - added --disable-root-mailer as configure option Resolves: rhbz#1324091 --- .gitignore | 4 +++ sources | 2 +- sudo-1.8.14p1-ldapconfpatch.patch | 55 ------------------------------- sudo.spec | 13 +++++--- 4 files changed, 14 insertions(+), 60 deletions(-) delete mode 100644 sudo-1.8.14p1-ldapconfpatch.patch diff --git a/.gitignore b/.gitignore index 04f884a..20ced3c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,6 @@ /sudo-1.8.16.tar.gz /sudo-1.8.17p1.tar.gz +/sudo-1.8.18b2.tar.gz +/sudo-1.8.18rc2.tar.gz +/sudo-1.8.18rc4.tar.gz +/sudo-1.8.18.tar.gz diff --git a/sources b/sources index 9534406..9410aa8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -50a840a688ceb6fa3ab24fc0adf4fa23 sudo-1.8.17p1.tar.gz +c1201904fd9144ea5e7cd9496fcbbc64 sudo-1.8.18.tar.gz diff --git a/sudo-1.8.14p1-ldapconfpatch.patch b/sudo-1.8.14p1-ldapconfpatch.patch deleted file mode 100644 index f42d487..0000000 --- a/sudo-1.8.14p1-ldapconfpatch.patch +++ /dev/null @@ -1,55 +0,0 @@ -diff -up sudo-1.8.14b3/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.14b3/plugins/sudoers/ldap.c ---- sudo-1.8.14b3/plugins/sudoers/ldap.c.ldapconfpatch 2015-07-07 18:51:11.000000000 +0200 -+++ sudo-1.8.14b3/plugins/sudoers/ldap.c 2015-07-09 11:03:25.686645581 +0200 -@@ -1922,6 +1922,33 @@ sudo_check_krb5_ccname(const char *ccnam - } - #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */ - -+/* -+ * Read a line of input, remove whole line comments and strip off leading -+ * and trailing spaces. Returns static storage that is reused. -+ */ -+static char * -+sudo_ldap_parseln(fp) -+ FILE *fp; -+{ -+ size_t len; -+ char *cp = NULL; -+ static char buf[LINE_MAX]; -+ -+ if (fgets(buf, sizeof(buf), fp) != NULL) { -+ /* Remove comments */ -+ if (*buf == '#') -+ *buf = '\0'; -+ -+ /* Trim leading and trailing whitespace/newline */ -+ len = strlen(buf); -+ while (len > 0 && isspace((unsigned char)buf[len - 1])) -+ buf[--len] = '\0'; -+ for (cp = buf; isblank(*cp); cp++) -+ continue; -+ } -+ return(cp); -+} -+ - static bool - sudo_ldap_read_config(void) - { -@@ -1955,7 +1982,7 @@ sudo_ldap_read_config(void) - if ((fp = fopen(path_ldap_conf, "r")) == NULL) - debug_return_bool(false); - -- while (sudo_parseln(&line, &linesize, NULL, fp) != -1) { -+ while ((line = sudo_ldap_parseln(fp)) != NULL) { - if (*line == '\0') - continue; /* skip empty line */ - -@@ -1975,7 +2002,7 @@ sudo_ldap_read_config(void) - if (!sudo_ldap_parse_keyword(keyword, value, ldap_conf_global)) - sudo_ldap_parse_keyword(keyword, value, ldap_conf_conn); - } -- free(line); -+ - fclose(fp); - - if (!ldap_conf.host) { diff --git a/sudo.spec b/sudo.spec index 5f72730..4d68c37 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,6 +1,6 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.17p1 +Version: 1.8.18 Release: 1%{?dist} License: ISC Group: Applications/System @@ -26,8 +26,6 @@ BuildRequires: zlib-devel # don't strip Patch1: sudo-1.6.7p5-strip.patch -# Patch to read ldap.conf more closely to nss_ldap -Patch2: sudo-1.8.14p1-ldapconfpatch.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -53,7 +51,6 @@ plugins that use %{name}. %setup -q %patch1 -p1 -b .strip -%patch2 -p1 -b .ldapconfpatch %build # Remove bundled copy of zlib @@ -73,6 +70,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --sbindir=%{_sbindir} \ --libdir=%{_libdir} \ --docdir=%{_pkgdocdir} \ + --disable-root-mailer \ --with-logging=syslog \ --with-logfac=authpriv \ --with-pam \ @@ -194,6 +192,13 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Wed Sep 21 2016 Radovan Sroka 1.8.18-1 +- update to 1.8.18 +- dropped sudo-1.8.14p1-ldapconfpatch.patch + upstreamed --> https://www.sudo.ws/pipermail/sudo-workers/2016-September/001006.html +- added --disable-root-mailer as configure option + Resolves: rhbz#1324091 + * Fri Jun 24 2016 Daniel Kopecek 1.8.17p1-1 - update to 1.8.17p1 - install the /var/db/sudo/lectured From 2afce7309ac6ea9450716c94c05de203a50b42ec Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Tue, 8 Nov 2016 14:21:34 +0100 Subject: [PATCH 08/11] update to 1.8.18p1 - fixes CVE-2016-7076 --- .gitignore | 1 + sources | 2 +- sudo.spec | 6 +++++- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 20ced3c..c098183 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /sudo-1.8.18rc2.tar.gz /sudo-1.8.18rc4.tar.gz /sudo-1.8.18.tar.gz +/sudo-1.8.18p1.tar.gz diff --git a/sources b/sources index 9410aa8..4136fe2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -c1201904fd9144ea5e7cd9496fcbbc64 sudo-1.8.18.tar.gz +28f5214d5bcb5af5710decb95184a0a6 sudo-1.8.18p1.tar.gz diff --git a/sudo.spec b/sudo.spec index 4d68c37..158cb13 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,6 +1,6 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.18 +Version: 1.8.18p1 Release: 1%{?dist} License: ISC Group: Applications/System @@ -192,6 +192,10 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Tue Nov 08 2016 Daniel Kopecek 1.8.18p1-1 +- update to 1.8.18p1 +- fixes CVE-2016-7076 + * Wed Sep 21 2016 Radovan Sroka 1.8.18-1 - update to 1.8.18 - dropped sudo-1.8.14p1-ldapconfpatch.patch From 27656ff04a2bde85314c5d5a3ad3d439349b0f92 Mon Sep 17 00:00:00 2001 From: Jiri Vymazal Date: Mon, 3 Apr 2017 15:53:54 +0200 Subject: [PATCH 09/11] * Mon Apr 03 2017 Jiri Vymazal 1.8.19p2-1 - update to 1.8.19p2 - updated URL and source0 as upstream changed domain --- .gitignore | 1 + sources | 2 +- sudo.spec | 10 +++++++--- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index c098183..4940882 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /sudo-1.8.18rc4.tar.gz /sudo-1.8.18.tar.gz /sudo-1.8.18p1.tar.gz +/sudo-1.8.19p2.tar.gz diff --git a/sources b/sources index 4136fe2..a3d7225 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -28f5214d5bcb5af5710decb95184a0a6 sudo-1.8.18p1.tar.gz +SHA512 (sudo-1.8.19p2.tar.gz) = 21c83403e7ff219a273b2c4873be0d858997558ca150bc8239379a9dfcc587fdd7c0c49cdf4cdc27dfd6dd45f9f089fa034b58bfcee07dceb4a481542251b3fc diff --git a/sudo.spec b/sudo.spec index 158cb13..e0b67d9 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,11 +1,11 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.18p1 +Version: 1.8.19p2 Release: 1%{?dist} License: ISC Group: Applications/System -URL: http://www.courtesan.com/sudo/ -Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz +URL: https://www.sudo.ws/ +Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz Source1: sudoers Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: /etc/pam.d/system-auth @@ -192,6 +192,10 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Mon Apr 03 2017 Jiri Vymazal 1.8.19p2-1 +- update to 1.8.19p2 +- updated URL and source0 as upstream changed domain + * Tue Nov 08 2016 Daniel Kopecek 1.8.18p1-1 - update to 1.8.18p1 - fixes CVE-2016-7076 From 6f3e82a06e788b0e3b19c883032b6c5a49a22877 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Wed, 31 May 2017 09:13:04 +0200 Subject: [PATCH 10/11] update to 1.8.20p1 fixes CVE-2017-1000367 Resolves: rhbz#1456884 --- .gitignore | 1 + sources | 2 +- sudo.spec | 10 +++++++++- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 4940882..bd48951 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ /sudo-1.8.18.tar.gz /sudo-1.8.18p1.tar.gz /sudo-1.8.19p2.tar.gz +/sudo-1.8.20p1.tar.gz diff --git a/sources b/sources index a3d7225..4921bf3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.8.19p2.tar.gz) = 21c83403e7ff219a273b2c4873be0d858997558ca150bc8239379a9dfcc587fdd7c0c49cdf4cdc27dfd6dd45f9f089fa034b58bfcee07dceb4a481542251b3fc +SHA512 (sudo-1.8.20p1.tar.gz) = b7d4c07a550da917029e31d15e734d9462f3565ee43eb5f6fd19463b54a2fa3f444381f0999d6d1ba643b65832056dd9177dad4452fa9f87f2542c223b13f258 diff --git a/sudo.spec b/sudo.spec index e0b67d9..cba28e3 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,6 +1,6 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.19p2 +Version: 1.8.20p1 Release: 1%{?dist} License: ISC Group: Applications/System @@ -115,6 +115,9 @@ rm -rf $RPM_BUILD_ROOT%{_datadir}/examples/sudo #Remove all .la files find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';' +# Remove sudoers.dist +rm -f $RPM_BUILD_ROOT%{_sysconfdir}/sudoers.dist + %find_lang sudo %find_lang sudoers @@ -192,6 +195,11 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Wed May 31 2017 Daniel Kopecek 1.8.20p1-1 +- update to 1.8.20p1 +- fixes CVE-2017-1000367 + Resolves: rhbz#1456884 + * Mon Apr 03 2017 Jiri Vymazal 1.8.19p2-1 - update to 1.8.19p2 - updated URL and source0 as upstream changed domain From 4a38bfd9938ac895914917422cac3bfb0262d94a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 1 Jun 2017 13:07:20 +0200 Subject: [PATCH 11/11] update to 1.8.20p2 added sudo to dnf/yum protected packages --- .gitignore | 1 + sources | 2 +- sudo.spec | 13 ++++++++++++- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index bd48951..8d7884e 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /sudo-1.8.18p1.tar.gz /sudo-1.8.19p2.tar.gz /sudo-1.8.20p1.tar.gz +/sudo-1.8.20p2.tar.gz diff --git a/sources b/sources index 4921bf3..21e6b4a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sudo-1.8.20p1.tar.gz) = b7d4c07a550da917029e31d15e734d9462f3565ee43eb5f6fd19463b54a2fa3f444381f0999d6d1ba643b65832056dd9177dad4452fa9f87f2542c223b13f258 +SHA512 (sudo-1.8.20p2.tar.gz) = 8bf67e687f7a84605fdef8d547b5cd661141b6c8fd25820c33c7e37e97ca7f21f564c3bae691f8a8cd08df7d80338e36a8f06bb5086cc104509d71d6ab1bceda diff --git a/sudo.spec b/sudo.spec index cba28e3..6eb4198 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,6 +1,6 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.20p1 +Version: 1.8.20p2 Release: 1%{?dist} License: ISC Group: Applications/System @@ -100,6 +100,12 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo/lectured install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers +#add sudo to protected packages +install -p -d -m 755 $RPM_BUILD_ROOT/etc/yum/protected.d/ +touch sudo.conf +echo sudo > sudo.conf +install -p -c -m 0644 sudo.conf $RPM_BUILD_ROOT/etc/yum/protected.d/ +rm -f sudo.conf chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%files @@ -155,6 +161,7 @@ rm -rf $RPM_BUILD_ROOT %config(noreplace) /etc/pam.d/sudo %config(noreplace) /etc/pam.d/sudo-i %attr(0644,root,root) %{_tmpfilesdir}/sudo.conf +%attr(0644,root,root) /etc/yum/protected.d/sudo.conf %dir /var/db/sudo %dir /var/db/sudo/lectured %attr(4111,root,root) %{_bindir}/sudo @@ -195,6 +202,10 @@ rm -rf $RPM_BUILD_ROOT %{_libexecdir}/sudo/libsudo_util.so %changelog +* Thu Jun 01 2017 Daniel Kopecek 1.8.20p2-1 +- update to 1.8.20p2 +- added sudo to dnf/yum protected packages + * Wed May 31 2017 Daniel Kopecek 1.8.20p1-1 - update to 1.8.20p1 - fixes CVE-2017-1000367