diff --git a/.gitignore b/.gitignore index 754758f..7252493 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ sudo-1.7.2p2-sudoers /sudo-1.7.4p5.tar.gz /sudo-1.8.1p2.tar.gz /sudo-1.8.3p1.tar.gz +/sudo-1.8.6p7.tar.gz diff --git a/sources b/sources index d108a9e..95bc198 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -7becc572fa97f94cf721a2ee8299c45b sudo-1.8.3p1.tar.gz 56f74aed3a7b32f2b01a34d65ac86f85 sudo-1.7.4p4-sudoers +126abfa2e841139e774d4c67d80f0e5b sudo-1.8.6p7.tar.gz diff --git a/sudo-1.8.3p1-CVE-2012-2337.patch b/sudo-1.8.3p1-CVE-2012-2337.patch new file mode 100644 index 0000000..ecf8c5a --- /dev/null +++ b/sudo-1.8.3p1-CVE-2012-2337.patch @@ -0,0 +1,27 @@ +diff -up sudo-1.8.3p1/plugins/sudoers/match_addr.c.CVE-2012-2337 sudo-1.8.3p1/plugins/sudoers/match_addr.c +--- sudo-1.8.3p1/plugins/sudoers/match_addr.c.CVE-2012-2337 2012-05-17 09:58:05.760242173 +0200 ++++ sudo-1.8.3p1/plugins/sudoers/match_addr.c 2012-05-17 10:13:37.045581333 +0200 +@@ -91,6 +91,7 @@ addr_matches_if(char *n) + } + if (j == sizeof(addr.ip6.s6_addr)) + return TRUE; ++ break; + #endif + } + } +@@ -158,6 +159,7 @@ addr_matches_if_netmask(char *n, char *m + case AF_INET: + if ((ifp->addr.ip4.s_addr & mask.ip4.s_addr) == addr.ip4.s_addr) + return TRUE; ++ break; + #ifdef HAVE_IN6_ADDR + case AF_INET6: + for (j = 0; j < sizeof(addr.ip6.s6_addr); j++) { +@@ -166,6 +168,7 @@ addr_matches_if_netmask(char *n, char *m + } + if (j == sizeof(addr.ip6.s6_addr)) + return TRUE; ++ break; + #endif /* HAVE_IN6_ADDR */ + } + } diff --git a/sudo-1.8.3p1-sssd-support.patch b/sudo-1.8.3p1-sssd-support.patch index ee1b68a..7e510bc 100644 --- a/sudo-1.8.3p1-sssd-support.patch +++ b/sudo-1.8.3p1-sssd-support.patch @@ -48,7 +48,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/Makefile.in.sssd-support sudo-1.8.3p1/plug $(incdir)/alloc.h $(incdir)/list.h $(incdir)/fileops.h \ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/sudoers/sssd.c --- sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support 2012-01-19 13:41:51.885154296 +0100 -+++ sudo-1.8.3p1/plugins/sudoers/sssd.c 2012-02-07 12:22:37.641156963 +0100 ++++ sudo-1.8.3p1/plugins/sudoers/sssd.c 2012-02-29 10:05:49.169875120 +0100 @@ -0,0 +1,1157 @@ +/* + * Copyright (c) 2003-2011 Todd C. Miller @@ -116,7 +116,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +static int sudo_sssd_open(struct sudo_nss *nss); +static int sudo_sssd_close(struct sudo_nss *nss); +static int sudo_sssd_parse(struct sudo_nss *nss); -+static void sudo_sssd_parse_options(struct sss_rule *rule); ++static void sudo_sssd_parse_options(struct sss_sudo_rule *rule); +static int sudo_sssd_setdefs(struct sudo_nss *nss); +static int sudo_sssd_lookup(struct sudo_nss *nss, int ret, int pwflag); +static int sudo_sssd_display_cmnd(struct sudo_nss *nss, struct passwd *pw); @@ -130,11 +130,11 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + struct lbuf *lbuf); + + -+static struct sss_result *sudo_sssd_result_get(struct sudo_nss *nss, ++static struct sss_sudo_result *sudo_sssd_result_get(struct sudo_nss *nss, + struct passwd *pw, + uint32_t *state); + -+static void sudo_sssd_attrcpy(struct sss_attr *dst, const struct sss_attr *src) ++static void sudo_sssd_attrcpy(struct sss_sudo_attr *dst, const struct sss_sudo_attr *src) +{ + int i; + @@ -151,7 +151,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + return; +} + -+static void sudo_sssd_rulecpy(struct sss_rule *dst, const struct sss_rule *src) ++static void sudo_sssd_rulecpy(struct sss_sudo_rule *dst, const struct sss_sudo_rule *src) +{ + int i; + @@ -159,7 +159,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + DPRINTF(2, "emalloc: cnt=%d", src->num_attrs); + + dst->num_attrs = src->num_attrs; -+ dst->attrs = emalloc(sizeof(struct sss_attr) * dst->num_attrs); ++ dst->attrs = emalloc(sizeof(struct sss_sudo_attr) * dst->num_attrs); + + for (i = 0; i < dst->num_attrs; ++i) { + sudo_sssd_attrcpy(dst->attrs + i, @@ -173,9 +173,9 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +#define _SUDO_SSS_STATE_HOSTMATCH 0x01 +#define _SUDO_SSS_STATE_USERMATCH 0x02 + -+static struct sss_result *sudo_sssd_filter_result(struct sss_result *in_res, int (*filterp)(struct sss_rule *, void *), int act, void *filterp_arg) ++static struct sss_sudo_result *sudo_sssd_filter_result(struct sss_sudo_result *in_res, int (*filterp)(struct sss_sudo_rule *, void *), int act, void *filterp_arg) +{ -+ struct sss_result *out_res; ++ struct sss_sudo_result *out_res; + int i, l, r; + + DPRINTF(3, "in_res=%p, count=%u, act=%s", @@ -186,8 +186,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + + DPRINTF(3, "emalloc: cnt=%d", in_res->num_rules); + -+ out_res = emalloc(sizeof(struct sss_result)); -+ out_res->rules = in_res->num_rules > 0 ? emalloc(sizeof(struct sss_rule) * in_res->num_rules) : NULL; ++ out_res = emalloc(sizeof(struct sss_sudo_result)); ++ out_res->rules = in_res->num_rules > 0 ? emalloc(sizeof(struct sss_sudo_rule) * in_res->num_rules) : NULL; + out_res->num_rules = 0; + + for (i = l = 0; i < in_res->num_rules; ++i) { @@ -207,7 +207,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + + if (l < in_res->num_rules) { + DPRINTF(3, "reallocating result: %p (count: %u -> %u)", out_res->rules, in_res->num_rules, l); -+ out_res->rules = realloc(out_res->rules, sizeof(struct sss_rule) * l); ++ out_res->rules = realloc(out_res->rules, sizeof(struct sss_sudo_rule) * l); + } + + out_res->num_rules = l; @@ -217,7 +217,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + +struct sudo_sssd_handle { + char *username; -+ struct sss_result *result; ++ struct sss_sudo_result *result; + struct group_list *grlist; +}; + @@ -271,8 +271,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +{ + struct sudo_sssd_handle *handle = nss->handle; + -+ struct sss_result *sres; -+ struct sss_rule *rule; ++ struct sss_sudo_result *sres; ++ struct sss_sudo_rule *rule; + uint32_t serr; + int i; + @@ -300,7 +300,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +} + +static int -+sudo_sssd_check_runas_user(struct sss_rule *rule) ++sudo_sssd_check_runas_user(struct sss_sudo_rule *rule) +{ + char **v_arr = NULL; + char *val; @@ -403,7 +403,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +} + +static int -+sudo_sssd_check_runas_group(struct sss_rule *rule) ++sudo_sssd_check_runas_group(struct sss_sudo_rule *rule) +{ + char **v_arr = NULL; + char *val; @@ -447,7 +447,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + * else FALSE. RunAs info is optional. + */ +static int -+sudo_sssd_check_runas(struct sss_rule *rule) ++sudo_sssd_check_runas(struct sss_sudo_rule *rule) +{ + int ret; + @@ -460,7 +460,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + return ret; +} + -+static int sudo_sssd_check_host(struct sss_rule *rule) ++static int sudo_sssd_check_host(struct sss_sudo_rule *rule) +{ + char **v_arr, *val; + int ret = FALSE, i; @@ -500,7 +500,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + return ret; +} + -+static int sudo_sssd_result_filterp(struct sss_rule *rule, void *unused) ++static int sudo_sssd_result_filterp(struct sss_sudo_rule *rule, void *unused) +{ + (void)unused; + @@ -510,12 +510,12 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + return 0; +} + -+static struct sss_result *sudo_sssd_result_get(struct sudo_nss *nss, ++static struct sss_sudo_result *sudo_sssd_result_get(struct sudo_nss *nss, + struct passwd *pw, + uint32_t *state) +{ + struct sudo_sssd_handle *handle = nss->handle; -+ struct sss_result *u_sres, *f_sres; ++ struct sss_sudo_result *u_sres, *f_sres; + uint32_t serr = 0, ret; + + DPRINTF(1, "pw_name=%s", pw->pw_name); @@ -583,7 +583,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + * Returns TRUE if found and allowed, FALSE if negated, else UNSPEC. + */ +static int -+sudo_sssd_check_bool(struct sss_rule *rule, char *option) ++sudo_sssd_check_bool(struct sss_sudo_rule *rule, char *option) +{ + char ch, *var, **v_arr = NULL; + int i, ret = UNSPEC; @@ -624,7 +624,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + * FALSE if disallowed and UNSPEC if not matched. + */ +static int -+sudo_sssd_check_command(struct sss_rule *rule, int *setenv_implied) ++sudo_sssd_check_command(struct sss_sudo_rule *rule, int *setenv_implied) +{ + char **v_arr = NULL, *val; + char *allowed_cmnd, *allowed_args; @@ -692,7 +692,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +} + +static void -+sudo_sssd_parse_options(struct sss_rule *rule) ++sudo_sssd_parse_options(struct sss_sudo_rule *rule) +{ + int i; + char op, *v, *val; @@ -748,8 +748,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +{ + int rc, setenv_implied; + -+ struct sss_result *sres = NULL; -+ struct sss_rule *rule; ++ struct sss_sudo_result *sres = NULL; ++ struct sss_sudo_rule *rule; + uint32_t i, state = 0; + + /* Fetch list of sudoRole entries that match user and host. */ @@ -863,8 +863,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +static int sudo_sssd_display_cmnd(struct sudo_nss *nss, struct passwd *pw) +{ + struct sudo_sssd_handle *handle = nss->handle; -+ struct sss_result *sres = NULL; -+ struct sss_rule *rule; ++ struct sss_sudo_result *sres = NULL; ++ struct sss_sudo_rule *rule; + int i, found = FALSE; + + if (handle == NULL) @@ -905,8 +905,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +{ + struct sudo_sssd_handle *handle = nss->handle; + -+ struct sss_rule *rule; -+ struct sss_result *sres = NULL; ++ struct sss_sudo_rule *rule; ++ struct sss_sudo_result *sres = NULL; + + uint32_t serr = 0; + @@ -964,7 +964,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + return 0; +} + -+static int sudo_sssd_display_entry_long(struct sss_rule *rule, struct lbuf *lbuf) ++static int sudo_sssd_display_entry_long(struct sss_sudo_rule *rule, struct lbuf *lbuf) +{ + char **v_arr = NULL; + int count = 0, i; @@ -1071,7 +1071,7 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s + return count; +} + -+static int sudo_sssd_display_entry_short(struct sss_rule *rule, struct lbuf *lbuf) ++static int sudo_sssd_display_entry_short(struct sss_sudo_rule *rule, struct lbuf *lbuf) +{ + char **v_arr = NULL; + int count = 0, i; @@ -1182,8 +1182,8 @@ diff -up sudo-1.8.3p1/plugins/sudoers/sssd.c.sssd-support sudo-1.8.3p1/plugins/s +static int sudo_sssd_display_privs(struct sudo_nss *nss, struct passwd *pw, + struct lbuf *lbuf) +{ -+ struct sss_result *sres = NULL; -+ struct sss_rule *rule; ++ struct sss_sudo_result *sres = NULL; ++ struct sss_sudo_rule *rule; + unsigned int i, count = 0; + + DPRINTF(2, "sssd/ldap search for command list"); diff --git a/sudo.spec b/sudo.spec index 16ee6cf..dac5ce6 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.3p1 -Release: 4%{?dist} +Version: 1.8.6p7 +Release: 1%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -20,20 +20,12 @@ BuildRequires: audit-libs-devel libcap-devel BuildRequires: libselinux-devel BuildRequires: sendmail BuildRequires: gettext -BuildRequires: libsss_sudo-devel +BuildRequires: zlib-devel # don't strip Patch1: sudo-1.6.7p5-strip.patch # configure.in fix Patch2: sudo-1.7.2p1-envdebug.patch -# add m4/ to paths in aclocal.m4 -Patch3: sudo-1.7.4p3-m4path.patch -# disable word wrapping if the ouput is piped -Patch4: sudo-1.8.3-pipelist.patch -# CVE-2012-0809 -Patch5: sudo-1.8.3p1-CVE-2012-0809.patch -# SSSD support -Patch6: sudo-1.8.3p1-sssd-support.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -60,16 +52,12 @@ plugins that use %{name}. %patch1 -p1 -b .strip %patch2 -p1 -b .envdebug -%patch3 -p1 -b .m4path -%patch4 -p1 -b .pipelist -%patch5 -p1 -b .CVE-2012-0809 -%patch6 -p1 -b .sssd-support # Remove execute permission on this script so we don't pull in perl deps chmod -x plugins/sudoers/sudoers2ldif %build -autoreconf -fv --install +autoreconf -I m4 -fv --install %ifarch s390 s390x sparc64 F_PIE=-fPIE @@ -83,22 +71,22 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --prefix=%{_prefix} \ --sbindir=%{_sbindir} \ --libdir=%{_libdir} \ - --docdir=%{_datadir}/doc/%{name}-%{version} \ + --docdir=%{_datadir}/doc/%{name}-%{version} \ --with-logging=syslog \ --with-logfac=authpriv \ --with-pam \ - --with-pam-login \ + --with-pam-login \ --with-editor=/bin/vi \ --with-env-editor \ --with-ignore-dot \ --with-tty-tickets \ --with-ldap \ - --with-selinux \ - --with-passprompt="[sudo] password for %p: " \ - --with-linux-audit \ - --with-sssd -# --without-kerb5 \ -# --without-kerb4 + --with-selinux \ + --with-passprompt="[sudo] password for %p: " \ + --with-linux-audit \ + --with-sssd +# --without-kerb5 \ +# --without-kerb4 make %install @@ -110,6 +98,11 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers +chmod +x $RPM_BUILD_ROOT%{_libexecdir}/*.so # for stripping, reset in %%files + +# Remove execute permission on this script so we don't pull in perl deps +chmod -x $RPM_BUILD_ROOT%{_docdir}/sudo-*/sudoers2ldif + %find_lang sudo %find_lang sudoers @@ -118,7 +111,7 @@ rm sudo.lang sudoers.lang mkdir -p $RPM_BUILD_ROOT/etc/pam.d cat > $RPM_BUILD_ROOT/etc/pam.d/sudo << EOF -#%PAM-1.0 +#%%PAM-1.0 auth include system-auth account include system-auth password include system-auth @@ -127,7 +120,7 @@ session required pam_limits.so EOF cat > $RPM_BUILD_ROOT/etc/pam.d/sudo-i << EOF -#%PAM-1.0 +#%%PAM-1.0 auth include sudo account include sudo password include sudo @@ -136,14 +129,11 @@ session required pam_limits.so EOF -%clean +%clean rm -rf $RPM_BUILD_ROOT %files -f sudo_all.lang %defattr(-,root,root) -%doc ChangeLog NEWS README* MANIFEST -%doc doc/HISTORY doc/LICENSE doc/TROUBLESHOOTING doc/UPGRADE -%doc doc/schema.* plugins/sudoers/sudoers2ldif doc/sample.* %attr(0440,root,root) %config(noreplace) /etc/sudoers %attr(0750,root,root) %dir /etc/sudoers.d/ %config(noreplace) /etc/pam.d/sudo @@ -154,14 +144,16 @@ rm -rf $RPM_BUILD_ROOT %attr(0111,root,root) %{_bindir}/sudoreplay %attr(0755,root,root) %{_sbindir}/visudo %attr(0755,root,root) %{_libexecdir}/sesh -%{_libexecdir}/sudo_noexec.* -%{_libexecdir}/sudoers.* +%attr(0644,root,root) %{_libexecdir}/sudo_noexec.so +%attr(0644,root,root) %{_libexecdir}/sudoers.so %{_mandir}/man5/sudoers.5* %{_mandir}/man5/sudoers.ldap.5* %{_mandir}/man8/sudo.8* %{_mandir}/man8/sudoedit.8* %{_mandir}/man8/sudoreplay.8* %{_mandir}/man8/visudo.8* +%dir %{_docdir}/sudo-%{version} +%{_docdir}/sudo-%{version}/* # Make sure permissions are ok even if we're updating @@ -175,6 +167,25 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/sudo_plugin.8* %changelog +* Thu Feb 28 2013 Daniel Kopecek - 1.8.6p7-1 +- update to 1.8.6p7 +- fixes CVE-2013-1775 and CVE-2013-1776 +- fixed several packaging issues (thanks to ville.skytta@iki.fi) + - build with system zlib. + - let rpmbuild strip libexecdir/*.so. + - own the %%{_docdir}/sudo-* dir. + - fix some rpmlint warnings (spaces vs tabs, unescaped macros). + - fix bogus %%changelog dates. + +* Thu May 17 2012 Daniel Kopecek - 1.8.3p1-7 +- added patch for CVE-2012-2337 (rhbz#820677) + +* Wed Feb 29 2012 Daniel Kopecek - 1.8.3p1-6 +- fixed problems with undefined symbols (rhbz#798517) + +* Wed Feb 22 2012 Daniel Kopecek - 1.8.3p1-5 +- SSSD patch update + * Tue Feb 7 2012 Daniel Kopecek - 1.8.3p1-4 - added SSSD support @@ -184,7 +195,7 @@ rm -rf $RPM_BUILD_ROOT * Sat Jan 14 2012 Fedora Release Engineering - 1.8.3p1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild -* Tue Nov 10 2011 Daniel Kopecek - 1.8.3p1-1 +* Thu Nov 10 2011 Daniel Kopecek - 1.8.3p1-1 - update to 1.8.3p1 - disable output word wrapping if the output is piped @@ -317,7 +328,7 @@ rm -rf $RPM_BUILD_ROOT - upgrade to the latest upstream release - add selinux support -* Mon Feb 02 2008 Dennis Gilmore 1.6.9p4-6 +* Mon Feb 04 2008 Dennis Gilmore 1.6.9p4-6 - sparc64 needs to be in the -fPIE list with s390 * Mon Jan 07 2008 Peter Vrabec 1.6.9p4-5 @@ -443,7 +454,7 @@ rm -rf $RPM_BUILD_ROOT * Thu Apr 1 2004 Thomas Woerner 1.6.7p5-25 - fixed spec file: sesh in file section with selinux flag (#119682) -* Thu Mar 30 2004 Colin Walters 1.6.7p5-24 +* Tue Mar 30 2004 Colin Walters 1.6.7p5-24 - Enhance sesh.c to fork/exec children itself, to avoid having sudo reap all domains. - Only reinstall default signal handlers immediately before @@ -605,7 +616,7 @@ rm -rf $RPM_BUILD_ROOT * Tue Oct 27 1998 Preston Brown - fixed so it doesn't find /usr/bin/vi first, but instead /bin/vi (always installed) -* Fri Oct 08 1998 Michael Maher +* Thu Oct 08 1998 Michael Maher - built package for 5.2 * Mon May 18 1998 Michael Maher