From 6c167fc33279507ede5f6003548abd0d0e978c35 Mon Sep 17 00:00:00 2001 From: Tom Callaway Date: Tue, 5 Aug 2014 11:05:06 -0400 Subject: [PATCH 1/7] fix license handling --- sudo.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/sudo.spec b/sudo.spec index 13f0c4a..b777e28 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.8.8 -Release: 5%{?dist} +Release: 6%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -112,6 +112,9 @@ chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%fil # Remove execute permission on this script so we don't pull in perl deps chmod -x $RPM_BUILD_ROOT%{_pkgdocdir}/sudoers2ldif +# Don't package LICENSE as a doc +rm -rf $RPM_BUILD_ROOT%{_pkgdocdir}/LICENSE + %find_lang sudo %find_lang sudoers @@ -167,6 +170,8 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/visudo.8* %dir %{_pkgdocdir}/ %{_pkgdocdir}/* +%{!?_licensedir:%global license %%doc} +%license doc/LICENSE %exclude %{_pkgdocdir}/ChangeLog @@ -181,6 +186,9 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/sudo_plugin.8* %changelog +* Tue Aug 5 2014 Tom Callaway - 1.8.8-6 +- fix license handling + * Sun Jun 08 2014 Fedora Release Engineering - 1.8.8-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild From 32c5d458e8a5f56551a46d633ae49e09a6eb719d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 18 Aug 2014 04:03:51 +0000 Subject: [PATCH 2/7] - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild --- sudo.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sudo.spec b/sudo.spec index b777e28..132e1f2 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo Version: 1.8.8 -Release: 6%{?dist} +Release: 7%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -186,6 +186,9 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/sudo_plugin.8* %changelog +* Mon Aug 18 2014 Fedora Release Engineering - 1.8.8-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + * Tue Aug 5 2014 Tom Callaway - 1.8.8-6 - fix license handling From cb637c8790d09c99b82543bcaa0355797cea83c4 Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Tue, 30 Sep 2014 15:45:25 +0200 Subject: [PATCH 3/7] update to 1.8.11 - major changes & fixes: - when running a command in the background, sudo will now forward SIGINFO to the command - the passwords in ldap.conf and ldap.secret may now be encoded in base64. - SELinux role changes are now audited. For sudoedit, we now audit the actual editor being run, instead of just the sudoedit command. - it is now possible to match an environment variable's value as well as its name using env_keep and env_check - new files created via sudoedit as a non-root user now have the proper group id - sudoedit now works correctly in conjunction with sudo's SELinux RBAC support - it is now possible to disable network interface probing in sudo.conf by changing the value of the probe_interfaces setting - when listing a user's privileges (sudo -l), the sudoers plugin will now prompt for the user's password even if the targetpw, rootpw or runaspw options are set. - the new use_netgroups sudoers option can be used to explicitly enable or disable netgroups support - visudo can now export a sudoers file in JSON format using the new -x flag - added patch to read ldap.conf more closely to nss_ldap - require /usr/bin/vi instead of vim-minimal - include pam.d/system-auth in PAM session phase from pam.d/sudo - include pam.d/sudo in PAM session phase from pam.d/sudo-i --- sudo-1.8.11b4-ldapconfpatch.patch | 54 +++++++++++++++++++++++++++++++ sudo.spec | 53 +++++++++++++++++++----------- 2 files changed, 89 insertions(+), 18 deletions(-) create mode 100644 sudo-1.8.11b4-ldapconfpatch.patch diff --git a/sudo-1.8.11b4-ldapconfpatch.patch b/sudo-1.8.11b4-ldapconfpatch.patch new file mode 100644 index 0000000..c7e9937 --- /dev/null +++ b/sudo-1.8.11b4-ldapconfpatch.patch @@ -0,0 +1,54 @@ +diff -up sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.11b4/plugins/sudoers/ldap.c +--- sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch 2014-07-22 22:52:34.000000000 +0200 ++++ sudo-1.8.11b4/plugins/sudoers/ldap.c 2014-09-15 11:22:11.122094452 +0200 +@@ -1550,6 +1550,33 @@ sudo_check_krb5_ccname(const char *ccnam + } + #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */ + ++/* ++ * Read a line of input, remove whole line comments and strip off leading ++ * and trailing spaces. Returns static storage that is reused. ++ */ ++static char * ++sudo_ldap_parseln(fp) ++ FILE *fp; ++{ ++ size_t len; ++ char *cp = NULL; ++ static char buf[LINE_MAX]; ++ ++ if (fgets(buf, sizeof(buf), fp) != NULL) { ++ /* Remove comments */ ++ if (*buf == '#') ++ *buf = '\0'; ++ ++ /* Trim leading and trailing whitespace/newline */ ++ len = strlen(buf); ++ while (len > 0 && isspace((unsigned char)buf[len - 1])) ++ buf[--len] = '\0'; ++ for (cp = buf; isblank(*cp); cp++) ++ continue; ++ } ++ return(cp); ++} ++ + static bool + sudo_ldap_read_config(void) + { +@@ -1575,7 +1602,7 @@ sudo_ldap_read_config(void) + if ((fp = fopen(path_ldap_conf, "r")) == NULL) + debug_return_bool(false); + +- while (sudo_parseln(&line, &linesize, NULL, fp) != -1) { ++ while ((line = sudo_ldap_parseln(fp)) != NULL) { + if (*line == '\0') + continue; /* skip empty line */ + +@@ -1595,7 +1622,6 @@ sudo_ldap_read_config(void) + if (!sudo_ldap_parse_keyword(keyword, value, ldap_conf_global)) + sudo_ldap_parse_keyword(keyword, value, ldap_conf_conn); + } +- free(line); + fclose(fp); + + if (!ldap_conf.host) diff --git a/sudo.spec b/sudo.spec index 132e1f2..2da6fe3 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,14 +1,15 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.8 -Release: 7%{?dist} +Version: 1.8.11 +Release: 1%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz Source1: sudo-1.8.8-sudoers Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) -Requires: /etc/pam.d/system-auth, vim-minimal +Requires: /etc/pam.d/system-auth +Requires: /usr/bin/vi Requires(post): /bin/chmod BuildRequires: pam-devel @@ -25,14 +26,8 @@ BuildRequires: zlib-devel # don't strip Patch1: sudo-1.6.7p5-strip.patch -# configure.in fix -Patch2: sudo-1.7.2p1-envdebug.patch -# Fix several issues in the sssd code -Patch3: sudo-1.8.8-sssdfixes.patch -# Don't accept invalid number in uid/gid specifications -Patch4: sudo-1.8.8-strictuidgid.patch -# Fix several issues found by the clang static analyzer -Patch5: sudo-1.8.8-clangbugs.patch +# Patch to read ldap.conf more closely to nss_ldap +Patch2: sudo-1.8.11b4-ldapconfpatch.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -58,10 +53,7 @@ plugins that use %{name}. %setup -q %patch1 -p1 -b .strip -%patch2 -p1 -b .envdebug -%patch3 -p1 -b .sssdfixes -%patch4 -p1 -b .strictuidgid -%patch5 -p1 -b .clangbugs +%patch2 -p1 -b .ldapconfpatch %build # Remove bundled copy of zlib @@ -129,6 +121,7 @@ account include system-auth password include system-auth session optional pam_keyinit.so revoke session required pam_limits.so +session include system-auth EOF cat > $RPM_BUILD_ROOT/etc/pam.d/sudo-i << EOF @@ -137,7 +130,7 @@ auth include sudo account include sudo password include sudo session optional pam_keyinit.so force revoke -session required pam_limits.so +session include sudo EOF @@ -161,6 +154,7 @@ rm -rf $RPM_BUILD_ROOT %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so +%attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.* %{_mandir}/man5/sudoers.5* %{_mandir}/man5/sudoers.ldap.5* %{_mandir}/man5/sudo.conf.5* @@ -184,10 +178,33 @@ rm -rf $RPM_BUILD_ROOT %doc plugins/sample/sample_plugin.c %{_includedir}/sudo_plugin.h %{_mandir}/man8/sudo_plugin.8* +%attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so +%attr(0644,root,root) %{_libexecdir}/sudo/*.la %changelog -* Mon Aug 18 2014 Fedora Release Engineering - 1.8.8-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild +* Tue Sep 30 2014 Daniel Kopecek - 1.8.11-1 +- update to 1.8.11 +- major changes & fixes: + - when running a command in the background, sudo will now forward + SIGINFO to the command + - the passwords in ldap.conf and ldap.secret may now be encoded in base64. + - SELinux role changes are now audited. For sudoedit, we now audit + the actual editor being run, instead of just the sudoedit command. + - it is now possible to match an environment variable's value as well as + its name using env_keep and env_check + - new files created via sudoedit as a non-root user now have the proper group id + - sudoedit now works correctly in conjunction with sudo's SELinux RBAC support + - it is now possible to disable network interface probing in sudo.conf by + changing the value of the probe_interfaces setting + - when listing a user's privileges (sudo -l), the sudoers plugin will now prompt + for the user's password even if the targetpw, rootpw or runaspw options are set. + - the new use_netgroups sudoers option can be used to explicitly enable or disable + netgroups support + - visudo can now export a sudoers file in JSON format using the new -x flag +- added patch to read ldap.conf more closely to nss_ldap +- require /usr/bin/vi instead of vim-minimal +- include pam.d/system-auth in PAM session phase from pam.d/sudo +- include pam.d/sudo in PAM session phase from pam.d/sudo-i * Tue Aug 5 2014 Tom Callaway - 1.8.8-6 - fix license handling From a9a105e68291d5e0b57f93521de4beb06f0fb321 Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Tue, 30 Sep 2014 15:57:08 +0200 Subject: [PATCH 4/7] Added the sudo-1.8.11 tarball --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 77602a6..869dbfe 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ sudo-1.7.2p2-sudoers /sudo-1.8.6p7.tar.gz /sudo-1.8.8.tar.gz /sudo-1.8.8-sudoers +/sudo-1.8.11.tar.gz diff --git a/sources b/sources index a2d9920..deff375 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -fc4f074090afd56d9ff4ff4e97321971 sudo-1.8.8.tar.gz +9a642cf6aca5375f8569a2961f44d0f3 sudo-1.8.11.tar.gz 775b863cdff3a2ee2a26c2d53b51aff5 sudo-1.8.8-sudoers From 581b0fecea8a21701efe804ca279f8f0694372d2 Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Mon, 3 Nov 2014 13:23:04 +0100 Subject: [PATCH 5/7] update to 1.8.11p2 - added patch to fix upstream bug #671 -- exiting immediately when audit is disabled --- .gitignore | 1 + sources | 2 +- sudo-1.8.11p2-auditfix.patch | 17 +++++++++++++++++ sudo.spec | 10 +++++++++- 4 files changed, 28 insertions(+), 2 deletions(-) create mode 100644 sudo-1.8.11p2-auditfix.patch diff --git a/.gitignore b/.gitignore index 869dbfe..b8a25f7 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ sudo-1.7.2p2-sudoers /sudo-1.8.8.tar.gz /sudo-1.8.8-sudoers /sudo-1.8.11.tar.gz +/sudo-1.8.11p2.tar.gz diff --git a/sources b/sources index deff375..4762a29 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -9a642cf6aca5375f8569a2961f44d0f3 sudo-1.8.11.tar.gz 775b863cdff3a2ee2a26c2d53b51aff5 sudo-1.8.8-sudoers +84012b4871b6c775c957cd310d5bad87 sudo-1.8.11p2.tar.gz diff --git a/sudo-1.8.11p2-auditfix.patch b/sudo-1.8.11p2-auditfix.patch new file mode 100644 index 0000000..963ef4e --- /dev/null +++ b/sudo-1.8.11p2-auditfix.patch @@ -0,0 +1,17 @@ +diff -up sudo-1.8.11p2/plugins/sudoers/linux_audit.c.auditfix sudo-1.8.11p2/plugins/sudoers/linux_audit.c +--- sudo-1.8.11p2/plugins/sudoers/linux_audit.c.auditfix 2014-11-03 12:44:53.674230966 +0100 ++++ sudo-1.8.11p2/plugins/sudoers/linux_audit.c 2014-11-03 12:45:13.407021599 +0100 +@@ -57,10 +57,10 @@ linux_audit_open(void) + au_fd = audit_open(); + if (au_fd == -1) { + /* Kernel may not have audit support. */ +- if (errno != EINVAL && errno != EPROTONOSUPPORT && errno != EAFNOSUPPORT) { +- sudo_warn(U_("unable to open audit system")); ++ if (errno == EINVAL || errno == EPROTONOSUPPORT || errno == EAFNOSUPPORT) + au_fd = AUDIT_NOT_CONFIGURED; +- } ++ else ++ sudo_warn(U_("unable to open audit system")); + } else { + (void)fcntl(au_fd, F_SETFD, FD_CLOEXEC); + } diff --git a/sudo.spec b/sudo.spec index 2da6fe3..f915365 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,6 +1,6 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.11 +Version: 1.8.11p2 Release: 1%{?dist} License: ISC Group: Applications/System @@ -28,6 +28,8 @@ BuildRequires: zlib-devel Patch1: sudo-1.6.7p5-strip.patch # Patch to read ldap.conf more closely to nss_ldap Patch2: sudo-1.8.11b4-ldapconfpatch.patch +# Don't exit if audit is not supported by the kernel +Patch3: sudo-1.8.11p2-auditfix.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -54,6 +56,7 @@ plugins that use %{name}. %patch1 -p1 -b .strip %patch2 -p1 -b .ldapconfpatch +%patch3 -p1 -b .auditfix %build # Remove bundled copy of zlib @@ -182,6 +185,11 @@ rm -rf $RPM_BUILD_ROOT %attr(0644,root,root) %{_libexecdir}/sudo/*.la %changelog +* Mon Nov 3 2014 Daniel Kopecek - 1.8.11p2-1 +- update to 1.8.11p2 +- added patch to fix upstream bug #671 -- exiting immediately + when audit is disabled + * Tue Sep 30 2014 Daniel Kopecek - 1.8.11-1 - update to 1.8.11 - major changes & fixes: From f439d30a9883801b70e8875d7e80ef760f35aa77 Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Wed, 18 Feb 2015 10:32:39 +0100 Subject: [PATCH 6/7] update to 1.8.12 - fixes CVE-2014-9680 --- .gitignore | 1 + sources | 2 +- sudo.spec | 12 ++++++++---- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index b8a25f7..31c82be 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ sudo-1.7.2p2-sudoers /sudo-1.8.8-sudoers /sudo-1.8.11.tar.gz /sudo-1.8.11p2.tar.gz +/sudo-1.8.12.tar.gz diff --git a/sources b/sources index 4762a29..4bfc811 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 775b863cdff3a2ee2a26c2d53b51aff5 sudo-1.8.8-sudoers -84012b4871b6c775c957cd310d5bad87 sudo-1.8.11p2.tar.gz +87558f3a55c62bc9244b19594f103ffa sudo-1.8.12.tar.gz diff --git a/sudo.spec b/sudo.spec index f915365..8630d4b 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,6 +1,6 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.11p2 +Version: 1.8.12 Release: 1%{?dist} License: ISC Group: Applications/System @@ -28,8 +28,6 @@ BuildRequires: zlib-devel Patch1: sudo-1.6.7p5-strip.patch # Patch to read ldap.conf more closely to nss_ldap Patch2: sudo-1.8.11b4-ldapconfpatch.patch -# Don't exit if audit is not supported by the kernel -Patch3: sudo-1.8.11p2-auditfix.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -56,7 +54,6 @@ plugins that use %{name}. %patch1 -p1 -b .strip %patch2 -p1 -b .ldapconfpatch -%patch3 -p1 -b .auditfix %build # Remove bundled copy of zlib @@ -110,6 +107,9 @@ chmod -x $RPM_BUILD_ROOT%{_pkgdocdir}/sudoers2ldif # Don't package LICENSE as a doc rm -rf $RPM_BUILD_ROOT%{_pkgdocdir}/LICENSE +# Remove examples; Examples can be found in man pages too. +rm -rf $RPM_BUILD_ROOT%{_datadir}/examples/sudo + %find_lang sudo %find_lang sudoers @@ -185,6 +185,10 @@ rm -rf $RPM_BUILD_ROOT %attr(0644,root,root) %{_libexecdir}/sudo/*.la %changelog +* Wed Feb 18 2015 Daniel Kopecek - 1.8.12 +- update to 1.8.12 +- fixes CVE-2014-9680 + * Mon Nov 3 2014 Daniel Kopecek - 1.8.11p2-1 - update to 1.8.11p2 - added patch to fix upstream bug #671 -- exiting immediately From ab230f309f95f2fb562cac741e6ecf084951f51e Mon Sep 17 00:00:00 2001 From: Daniel Kopecek Date: Thu, 5 Nov 2015 10:37:26 +0100 Subject: [PATCH 7/7] update to 1.8.15 - fixes CVE-2015-5602 --- .gitignore | 1 + sources | 2 +- ....patch => sudo-1.8.14p1-ldapconfpatch.patch | 15 ++++++++------- sudo.spec | 18 +++++++++++++----- 4 files changed, 23 insertions(+), 13 deletions(-) rename sudo-1.8.11b4-ldapconfpatch.patch => sudo-1.8.14p1-ldapconfpatch.patch (71%) diff --git a/.gitignore b/.gitignore index 31c82be..f1a631a 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,4 @@ sudo-1.7.2p2-sudoers /sudo-1.8.11.tar.gz /sudo-1.8.11p2.tar.gz /sudo-1.8.12.tar.gz +/sudo-1.8.15.tar.gz diff --git a/sources b/sources index 4bfc811..a565d42 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 775b863cdff3a2ee2a26c2d53b51aff5 sudo-1.8.8-sudoers -87558f3a55c62bc9244b19594f103ffa sudo-1.8.12.tar.gz +7cf6b9b76d0478a572432bed481dd7b5 sudo-1.8.15.tar.gz diff --git a/sudo-1.8.11b4-ldapconfpatch.patch b/sudo-1.8.14p1-ldapconfpatch.patch similarity index 71% rename from sudo-1.8.11b4-ldapconfpatch.patch rename to sudo-1.8.14p1-ldapconfpatch.patch index c7e9937..f42d487 100644 --- a/sudo-1.8.11b4-ldapconfpatch.patch +++ b/sudo-1.8.14p1-ldapconfpatch.patch @@ -1,7 +1,7 @@ -diff -up sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.11b4/plugins/sudoers/ldap.c ---- sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch 2014-07-22 22:52:34.000000000 +0200 -+++ sudo-1.8.11b4/plugins/sudoers/ldap.c 2014-09-15 11:22:11.122094452 +0200 -@@ -1550,6 +1550,33 @@ sudo_check_krb5_ccname(const char *ccnam +diff -up sudo-1.8.14b3/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.14b3/plugins/sudoers/ldap.c +--- sudo-1.8.14b3/plugins/sudoers/ldap.c.ldapconfpatch 2015-07-07 18:51:11.000000000 +0200 ++++ sudo-1.8.14b3/plugins/sudoers/ldap.c 2015-07-09 11:03:25.686645581 +0200 +@@ -1922,6 +1922,33 @@ sudo_check_krb5_ccname(const char *ccnam } #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */ @@ -35,7 +35,7 @@ diff -up sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.11b4/plugin static bool sudo_ldap_read_config(void) { -@@ -1575,7 +1602,7 @@ sudo_ldap_read_config(void) +@@ -1955,7 +1982,7 @@ sudo_ldap_read_config(void) if ((fp = fopen(path_ldap_conf, "r")) == NULL) debug_return_bool(false); @@ -44,11 +44,12 @@ diff -up sudo-1.8.11b4/plugins/sudoers/ldap.c.ldapconfpatch sudo-1.8.11b4/plugin if (*line == '\0') continue; /* skip empty line */ -@@ -1595,7 +1622,6 @@ sudo_ldap_read_config(void) +@@ -1975,7 +2002,7 @@ sudo_ldap_read_config(void) if (!sudo_ldap_parse_keyword(keyword, value, ldap_conf_global)) sudo_ldap_parse_keyword(keyword, value, ldap_conf_conn); } - free(line); ++ fclose(fp); - if (!ldap_conf.host) + if (!ldap_conf.host) { diff --git a/sudo.spec b/sudo.spec index 8630d4b..8473afd 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,6 +1,6 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.12 +Version: 1.8.15 Release: 1%{?dist} License: ISC Group: Applications/System @@ -27,7 +27,7 @@ BuildRequires: zlib-devel # don't strip Patch1: sudo-1.6.7p5-strip.patch # Patch to read ldap.conf more closely to nss_ldap -Patch2: sudo-1.8.11b4-ldapconfpatch.patch +Patch2: sudo-1.8.14p1-ldapconfpatch.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -110,6 +110,9 @@ rm -rf $RPM_BUILD_ROOT%{_pkgdocdir}/LICENSE # Remove examples; Examples can be found in man pages too. rm -rf $RPM_BUILD_ROOT%{_datadir}/examples/sudo +#Remove all .la files +find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';' + %find_lang sudo %find_lang sudoers @@ -146,9 +149,10 @@ rm -rf $RPM_BUILD_ROOT %attr(0750,root,root) %dir /etc/sudoers.d/ %config(noreplace) /etc/pam.d/sudo %config(noreplace) /etc/pam.d/sudo-i +%attr(0644,root,root) %{_tmpfilesdir}/sudo.conf %dir /var/db/sudo %attr(4111,root,root) %{_bindir}/sudo -%attr(4111,root,root) %{_bindir}/sudoedit +%{_bindir}/sudoedit %attr(0111,root,root) %{_bindir}/sudoreplay %attr(0755,root,root) %{_sbindir}/visudo %dir %{_libexecdir}/sudo @@ -157,7 +161,8 @@ rm -rf $RPM_BUILD_ROOT %attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so %attr(0644,root,root) %{_libexecdir}/sudo/group_file.so %attr(0644,root,root) %{_libexecdir}/sudo/system_group.so -%attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.* +%attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so.?.?.? +%{_libexecdir}/sudo/libsudo_util.so.? %{_mandir}/man5/sudoers.5* %{_mandir}/man5/sudoers.ldap.5* %{_mandir}/man5/sudo.conf.5* @@ -182,9 +187,12 @@ rm -rf $RPM_BUILD_ROOT %{_includedir}/sudo_plugin.h %{_mandir}/man8/sudo_plugin.8* %attr(0644,root,root) %{_libexecdir}/sudo/libsudo_util.so -%attr(0644,root,root) %{_libexecdir}/sudo/*.la %changelog +* Thu Nov 5 2015 Daniel Kopecek - 1.8.15-1 +- update to 1.8.15 +- fixes CVE-2015-5602 + * Wed Feb 18 2015 Daniel Kopecek - 1.8.12 - update to 1.8.12 - fixes CVE-2014-9680