rpms/sudo
7
0
Fork 0
Code Issues Pull Requests Releases Activity

rebase to 1.8.1p2

Browse Source 
removed .sudoi patch
fixed typo: RELPRO -> RELRO
added -devel subpackage for the sudo_plugin.h header file
use default ldap configuration files again
This commit is contained in:
Daniel Kopecek 2011-07-12 13:20:39 +02:00
parent c973b40001
commit 269d3c7dce
6 changed files with 77 additions and 115 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -4,3 +4,4 @@ sudo-1.7.2p2-sudoers
/sudo-1.7.2p2-sudoers /sudo-1.7.2p2-sudoers
/sudo-1.7.4p4-sudoers /sudo-1.7.4p4-sudoers
/sudo-1.7.4p5.tar.gz /sudo-1.7.4p5.tar.gz
/sudo-1.8.1p2.tar.gz

2
sources
View File

@ -1,2 +1,2 @@
4c8105507363371dea89ceb7c92187dd sudo-1.7.4p5.tar.gz e8330f0e63b0ecb2e12b5c76922818cc sudo-1.8.1p2.tar.gz
56f74aed3a7b32f2b01a34d65ac86f85 sudo-1.7.4p4-sudoers 56f74aed3a7b32f2b01a34d65ac86f85 sudo-1.7.4p4-sudoers

42
sudo-1.7.4p4-getgrouplist-fixed.patch
View File

@ -1,42 +0,0 @@
diff -up sudo-1.7.4p4/configure.in.getgrouplist sudo-1.7.4p4/configure.in
--- sudo-1.7.4p4/configure.in.getgrouplist 2011-01-11 10:45:49.170262147 +0100
+++ sudo-1.7.4p4/configure.in 2011-01-11 10:45:49.176261407 +0100
@@ -1913,7 +1913,7 @@ AC_FUNC_GETGROUPS
AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
strftime setrlimit initgroups getgroups fstat gettimeofday \
regcomp setlocale getaddrinfo setenv vhangup \
- mbr_check_membership setrlimit64)
+ mbr_check_membership setrlimit64 getgrouplist)
AC_CHECK_FUNCS(getline, [], [
AC_LIBOBJ(getline)
AC_CHECK_FUNCS(fgetln)
diff -up sudo-1.7.4p4/pwutil.c.getgrouplist sudo-1.7.4p4/pwutil.c
--- sudo-1.7.4p4/pwutil.c.getgrouplist 2010-08-06 15:44:30.000000000 +0200
+++ sudo-1.7.4p4/pwutil.c 2011-01-11 11:42:16.771282451 +0100
@@ -628,5 +628,26 @@ user_in_group(pw, group)
}
#endif /* HAVE_MBR_CHECK_MEMBERSHIP */
+#ifdef HAVE_GETGROUPLIST
+ if (user_ngroups >= 0 &&
+ strcmp(pw->pw_name, list_pw ? list_pw->pw_name : user_name) == 0)
+ {
+ gid_t *grouplist, grouptmp;
+ int n_groups, i;
+ n_groups = 1;
+
+ if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
+ grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
+ if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
+ for (i = 0; i < n_groups; i++)
+ if (grouplist[i] == grp->gr_gid) {
+ free(grouplist);
+ return(TRUE);
+ }
+ free(grouplist);
+ }
+ }
+#endif /* HAVE_GETGROUPLIST */
+
return(FALSE);
}

57
sudo-1.7.4p4-sudoi.patch
View File

@ -1,57 +0,0 @@
--- env.c Wed Aug 18 15:27:03 2010
+++ env.c Tue Sep 14 11:41:50 2010
@@ -608,10 +608,16 @@
#ifdef ENV_DEBUG
memset(env.envp, 0, env.env_size * sizeof(char *));
#endif
- if (def_env_reset || ISSET(sudo_mode, MODE_LOGIN_SHELL)) {
- /* Reset HOME based on target user unless keeping old value. */
- reset_home = TRUE;
+ /* Reset HOME based on target user if configured to. */
+ if (ISSET(sudo_mode, MODE_RUN)) {
+ if (def_always_set_home ||
+ ISSET(sudo_mode, MODE_RESET_HOME | MODE_LOGIN_SHELL) ||
+ (ISSET(sudo_mode, MODE_SHELL) && def_set_home))
+ reset_home = TRUE;
+ }
+
+ if (def_env_reset || ISSET(sudo_mode, MODE_LOGIN_SHELL)) {
/* Pull in vars we want to keep from the old environment. */
for (ep = old_envp; *ep; ep++) {
int keepit;
@@ -696,6 +702,11 @@
if (!ISSET(didvar, DID_USERNAME))
sudo_setenv("USERNAME", user_name, FALSE);
}
+
+ /* If we didn't keep HOME, reset it based on target user. */
+ if (!ISSET(didvar, KEPT_HOME))
+ reset_home = TRUE;
+
/*
* Set MAIL to target user in -i mode or if MAIL is not preserved
* from user's environment.
@@ -709,13 +720,6 @@
sudo_putenv(cp, ISSET(didvar, DID_MAIL), TRUE);
}
} else {
- /* Reset HOME based on target user if configured to. */
- if (ISSET(sudo_mode, MODE_RUN)) {
- if (def_always_set_home || ISSET(sudo_mode, MODE_RESET_HOME) ||
- (ISSET(sudo_mode, MODE_SHELL) && def_set_home))
- reset_home = TRUE;
- }
-
/*
* Copy environ entries as long as they don't match env_delete or
* env_check.
@@ -765,7 +769,7 @@
}
/* Set $HOME to target user if not preserving user's value. */
- if (reset_home && !ISSET(didvar, KEPT_HOME))
+ if (reset_home)
sudo_setenv("HOME", runas_pw->pw_dir, TRUE);
/* Provide default values for $TERM and $PATH if they are not set. */

44
sudo-1.8.1p2-getgrouplist.patch Normal file
View File

@ -0,0 +1,44 @@
diff -up sudo-1.8.1p2/configure.in.getgrouplist sudo-1.8.1p2/configure.in
--- sudo-1.8.1p2/configure.in.getgrouplist 2011-07-12 12:13:29.562597933 +0200
+++ sudo-1.8.1p2/configure.in 2011-07-12 12:15:27.116597851 +0200
@@ -2007,7 +2007,7 @@ dnl
AC_FUNC_GETGROUPS
AC_CHECK_FUNCS(strrchr sysconf tzset strftime initgroups getgroups fstat \
regcomp setlocale nl_langinfo getaddrinfo mbr_check_membership \
- setrlimit64 sysctl)
+ setrlimit64 sysctl getgrouplist)
AC_CHECK_FUNCS(getline, [], [
AC_LIBOBJ(getline)
AC_CHECK_FUNCS(fgetln)
diff -up sudo-1.8.1p2/plugins/sudoers/pwutil.c.getgrouplist sudo-1.8.1p2/plugins/sudoers/pwutil.c
--- sudo-1.8.1p2/plugins/sudoers/pwutil.c.getgrouplist 2011-07-12 12:13:17.346597942 +0200
+++ sudo-1.8.1p2/plugins/sudoers/pwutil.c 2011-07-12 12:19:02.171597700 +0200
@@ -711,6 +711,28 @@ user_in_group(struct passwd *pw, const c
}
#endif /* HAVE_MBR_CHECK_MEMBERSHIP */
+#ifdef HAVE_GETGROUPLIST
+ if (user_ngroups >= 0 &&
+ strcmp(pw->pw_name, list_pw ? list_pw->pw_name : user_name) == 0)
+ {
+ gid_t *grouplist, grouptmp;
+ int n_groups, i;
+ n_groups = 1;
+
+ if (getgrouplist(user_name, user_gid, &grouptmp, &n_groups) == -1) {
+ grouplist = (gid_t *) emalloc(sizeof(gid_t) * (n_groups + 1));
+ if (getgrouplist(user_name, user_gid, grouplist, &n_groups) > 0)
+ for (i = 0; i < n_groups; i++)
+ if (grouplist[i] == grp->gr_gid) {
+ free(grouplist);
+ retval = TRUE;
+ goto done;
+ }
+ free(grouplist);
+ }
+ }
+#endif /* HAVE_GETGROUPLIST */
+
done:
if (grp != NULL)
gr_delref(grp);

46
sudo.spec
View File

@ -1,7 +1,7 @@
Summary: Allows restricted root access for specified users Summary: Allows restricted root access for specified users
Name: sudo Name: sudo
Version: 1.7.4p5 Version: 1.8.1p2
Release: 4%{?dist} Release: 1%{?dist}
License: ISC License: ISC
Group: Applications/System Group: Applications/System
URL: http://www.courtesan.com/sudo/ URL: http://www.courtesan.com/sudo/
@ -28,9 +28,7 @@ Patch2: sudo-1.7.2p1-envdebug.patch
Patch3: sudo-1.7.4p3-m4path.patch Patch3: sudo-1.7.4p3-m4path.patch
# getgrouplist() to determine group membership (#235915) # getgrouplist() to determine group membership (#235915)
# - version with CVE-2009-0034 fixed # - version with CVE-2009-0034 fixed
Patch4: sudo-1.7.4p4-getgrouplist-fixed.patch Patch4: sudo-1.8.1p2-getgrouplist.patch
# reset HOME when using the `-i' option (#635250)
Patch5: sudo-1.7.4p4-sudoi.patch
%description %description
Sudo (superuser do) allows a system administrator to give certain Sudo (superuser do) allows a system administrator to give certain
@ -43,19 +41,24 @@ audit trail of who did what), a configurable timeout of the sudo
command, and the ability to use the same configuration file (sudoers) command, and the ability to use the same configuration file (sudoers)
on many different machines. on many different machines.
%package devel
Summary: Development files for %{name}
Group: Development/Libraries
Requires: %{name} = %{version}-%{release}
%description devel
The %{name}-devel package contains header files developing sudo
plugins that use %{name}.
%prep %prep
%setup -q %setup -q
%patch1 -p1 -b .strip %patch1 -p1 -b .strip
%patch2 -p1 -b .envdebug %patch2 -p1 -b .envdebug
%patch3 -p1 -b .m4path %patch3 -p1 -b .m4path
%patch4 -p1 -b .getgrouplist-fixed %patch4 -p1 -b .getgrouplist
%patch5 -p0 -b .sudoi
%build %build
# handle newer autoconf
rm -f acsite.m4
mv aclocal.m4 acinclude.m4
autoreconf -fv --install autoreconf -fv --install
%ifarch s390 s390x sparc64 %ifarch s390 s390x sparc64
@ -80,8 +83,6 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
--with-ignore-dot \ --with-ignore-dot \
--with-tty-tickets \ --with-tty-tickets \
--with-ldap \ --with-ldap \
--with-ldap-conf-file="%{_sysconfdir}/nss_ldap.conf" \
--with-ldap-secret-file="%{_sysconfdir}/nss_ldap.secret" \
--with-selinux \ --with-selinux \
--with-passprompt="[sudo] password for %p: " \ --with-passprompt="[sudo] password for %p: " \
--with-linux-audit --with-linux-audit
@ -122,8 +123,9 @@ rm -rf $RPM_BUILD_ROOT
%files %files
%defattr(-,root,root) %defattr(-,root,root)
%doc ChangeLog NEWS HISTORY LICENSE README* TROUBLESHOOTING UPGRADE %doc ChangeLog NEWS README* MANIFEST
%doc schema.* sudoers2ldif sample.* %doc doc/HISTORY doc/LICENSE doc/TROUBLESHOOTING doc/UPGRADE
%doc doc/schema.* plugins/sudoers/sudoers2ldif doc/sample.*
%attr(0440,root,root) %config(noreplace) /etc/sudoers %attr(0440,root,root) %config(noreplace) /etc/sudoers
%attr(0750,root,root) %dir /etc/sudoers.d/ %attr(0750,root,root) %dir /etc/sudoers.d/
%config(noreplace) /etc/pam.d/sudo %config(noreplace) /etc/pam.d/sudo
@ -135,6 +137,7 @@ rm -rf $RPM_BUILD_ROOT
%attr(0755,root,root) %{_sbindir}/visudo %attr(0755,root,root) %{_sbindir}/visudo
%attr(0755,root,root) %{_libexecdir}/sesh %attr(0755,root,root) %{_libexecdir}/sesh
%{_libexecdir}/sudo_noexec.* %{_libexecdir}/sudo_noexec.*
%{_libexecdir}/sudoers.*
%{_mandir}/man5/sudoers.5* %{_mandir}/man5/sudoers.5*
%{_mandir}/man5/sudoers.ldap.5* %{_mandir}/man5/sudoers.ldap.5*
%{_mandir}/man8/sudo.8* %{_mandir}/man8/sudo.8*
@ -146,9 +149,22 @@ rm -rf $RPM_BUILD_ROOT
%post %post
/bin/chmod 0440 /etc/sudoers || : /bin/chmod 0440 /etc/sudoers || :
%files devel
%defattr(-,root,root,-)
%doc plugins/{sample,sample_group}
%{_includedir}/sudo_plugin.h
%{_mandir}/man8/sudo_plugin.8*
%changelog %changelog
* Tue Jul 12 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
- rebase to 1.8.1p2
- removed .sudoi patch
- fixed typo: RELPRO -> RELRO
- added -devel subpackage for the sudo_plugin.h header file
- use default ldap configuration files again
* Fri Jun 3 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-4 * Fri Jun 3 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-4
- build with RELPRO - build with RELRO
* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.4p5-3 * Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.4p5-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild