Pullup ticket #6415 - requested by spz

security/sudo: security fix

Revisions pulled up:
- security/sudo/Makefile                                        1.181-1.182
- security/sudo/PLIST                                           1.19
- security/sudo/distinfo                                        1.112-1.113
- security/sudo/patches/patch-configure                         1.4
- security/sudo/patches/patch-examples_Makefile.in              1.1
- security/sudo/patches/patch-logsrvd_Makefile.in               1.1
- security/sudo/patches/patch-plugins_sudoers_Makefile.in       1.4

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Jan 18 14:32:24 UTC 2021

   Modified Files:
   	pkgsrc/security/sudo: Makefile PLIST distinfo
   	pkgsrc/security/sudo/patches: patch-configure
   	    patch-plugins_sudoers_Makefile.in
   Added Files:
   	pkgsrc/security/sudo/patches: patch-examples_Makefile.in
   	    patch-logsrvd_Makefile.in

   Log Message:
   security/sudo: update to 1.9.5p1

   Update sudo package to 1.9.5p1.  CHanges from 1.8.31p2 are too many to
   write here.  Please refer <https://www.sudo.ws/stable.html>.

   1.9.5 fixes these security problems:

   * Fixed CVE-2021-23239, a potential information leak in sudoedit that
     could be used to test for the existence of directories not normally
     accessible to the user in certain circumstances.  When creating a new
     file, sudoedit checks to make sure the parent directory of the new file
     exists before running the editor.  However, a race condition exists if
     the invoking user can replace (or create) the parent directory. If a
     symbolic link is created in place of the parent directory, sudoedit will
     run the editor as long as the target of the link exists.  If the target
     of the link does not exist, an error message will be displayed.  The
     race condition can be used to test for the existence of an arbitrary
     directory.  However, it cannot be used to write to an arbitrary
     location.

   * Fixed CVE-2021-23240, a flaw in the temporary file handling of
     sudoedit's SELinux RBAC support.  On systems where SELinux is enabled, a
     user with sudoedit permissions may be able to set the owner of an
     arbitrary file to the user-ID of the target user.  On Linux kernels that
     support protected symlinks setting /proc/sys/fs/protected_symlinks to 1
     will prevent the bug from being exploited.  For more information, see
     Symbolic link attack in SELinux-enabled sudoedit.

   Quote from 1.9.0 features:

   * The maximum length of a conversation reply has been increased from 255
     to 1023 characters.  This allows for longer user passwords. Bug #860.

   * Sudo now includes a logging daemon, sudo_logsrvd, which can be used to
     implement centralized logging of I/O logs.  TLS connections are
     supported when sudo is configured with the --enable-openssl option.  For
     more information, see the sudo_logsrvd, sudo_logsrvd.conf and
     sudo_logsrv.proto manuals as well as the log_servers setting in the
     sudoers manual.

   * The --disable-log-server and --disable-log-client configure options can
     be used to disable building the I/O log server and/or remote I/O log
     support in the sudoers plugin.

   * The new sudo_sendlog utility can be used to test sudo_logsrvd or send
     existing sudo I/O logs to a centralized server.

   * It is now possible to write sudo plugins in Python 4 when sudo is
     configured with the --enable-python option.  See the sudo_plugin_python
     manual for details.

     Sudo 1.9.0 comes with several Python example plugins that get installed
     sudo's examples directory.

     The sudo blog article What's new in sudo 1.9: Python includes a simple
     tutorial on writing python plugins.

   * Sudo now supports an audit plugin type.  An audit plugin receives
     accept, reject, exit and error messages and can be used to implement
     custom logging that is independent of the underlying security policy.
     Multiple audit plugins may be specified in the sudo.conf file.  A sample
     audit plugin is included that writes logs in JSON format.

   * Sudo now supports an approval plugin type.  An approval plugin is run
     only after the main security policy (such as sudoers) accepts a command
     to be run.  The approval policy may perform additional checks,
     potentially interacting with the user.  Multiple approval plugins may be
     specified in the sudo.conf file.  Only if all approval plugins succeed
     will the command be allowed.

   * Sudo's -S command line option now causes the sudo conversation function
     to write to the standard output or standard error instead of the
     terminal device.

---
   Module Name:	pkgsrc
   Committed By:	jperkin
   Date:		Tue Jan 26 20:18:43 UTC 2021

   Modified Files:
   	pkgsrc/security/sudo: Makefile distinfo

   Log Message:
   sudo: Update to 1.9.5p2 for CVE-2021-3156.

   What's new in Sudo 1.9.5p2

    * Fixed sudo's setprogname(3) emulation on systems that don't
      provide it.

    * Fixed a problem with the sudoers log server client where a partial
      write to the server could result the sudo process consuming large
      amounts of CPU time due to a cycle in the buffer queue. Bug #954.

    * Added a missing dependency on libsudo_util in libsudo_eventlog.
      Fixes a link error when building sudo statically.

    * The user's KRB5CCNAME environment variable is now preserved when
      performing PAM authentication.  This fixes GSSAPI authentication
      when the user has a non-default ccache.

    * When invoked as sudoedit, the same set of command line options
      are now accepted as for "sudo -e".  The -H and -P options are
      now rejected for sudoedit and "sudo -e" which matches the sudo
      1.7 behavior.  This is part of the fix for CVE-2021-3156.

    * Fixed a potential buffer overflow when unescaping backslashes
      in the command's arguments.  Normally, sudo escapes special
      characters when running a command via a shell (sudo -s or sudo
      -i).  However, it was also possible to run sudoedit with the -s
      or -i flags in which case no escaping had actually been done,
      making a buffer overflow possible.  This fixes CVE-2021-3156.

7 files changed, 98 insertions, 31 deletions

diff --git a/security/sudo/Makefile b/security/sudo/Makefile
index 5e9b31f3d4e..e88e5104452 100644
--- a/security/sudo/Makefile
+++ b/security/sudo/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.180 2020/09/19 14:04:29 taca Exp $
+# $NetBSD: Makefile,v 1.180.4.1 2021/01/28 08:09:40 bsiegert Exp $
 
-DISTNAME=	sudo-1.8.31p2
+DISTNAME=	sudo-1.9.5p2
 CATEGORIES=	security
 MASTER_SITES=	https://www.sudo.ws/dist/
 MASTER_SITES+=	ftp://ftp.sudo.ws/pub/sudo/
@@ -54,7 +54,12 @@ BUILD_DEFS+=		VARBASE
 
 DOCDIR=			share/doc/${PKGBASE}
 EGDIR=			share/examples/${PKGBASE}
-CONF_FILES_PERMS=	${EGDIR}/sudoers ${PKG_SYSCONFDIR}/sudoers \
+CONF_FILES_PERMS=	${EGDIR}/sudo.conf ${PKG_SYSCONFDIR}/sudo.conf \
+			${REAL_ROOT_USER} ${REAL_ROOT_GROUP} 0440
+CONF_FILES_PERMS+=	${EGDIR}/sudo_logsrvd.conf \
+			${PKG_SYSCONFDIR}/sudo_logsrvd.conf \
+			${REAL_ROOT_USER} ${REAL_ROOT_GROUP} 0440
+CONF_FILES_PERMS+=	${EGDIR}/sudoers ${PKG_SYSCONFDIR}/sudoers \
 			${REAL_ROOT_USER} ${REAL_ROOT_GROUP} 0440
 OWN_DIRS+=		${PKG_SYSCONFDIR}/sudoers.d
 SPECIAL_PERMS+=		bin/sudo ${SETUID_ROOT_PERMS}
diff --git a/security/sudo/PLIST b/security/sudo/PLIST
index 8a020cafb6f..f094c4415fb 100644
--- a/security/sudo/PLIST
+++ b/security/sudo/PLIST
@@ -1,24 +1,32 @@
-@comment $NetBSD: PLIST,v 1.18 2019/10/31 14:43:13 triaxx Exp $
+@comment $NetBSD: PLIST,v 1.18.10.1 2021/01/28 08:09:40 bsiegert Exp $
 bin/cvtsudoers
 bin/sudo
 bin/sudoedit
 bin/sudoreplay
 include/sudo_plugin.h
+lib/sudo/audit_json.la
 lib/sudo/group_file.la
 lib/sudo/libsudo_util.la
+lib/sudo/sample_approval.la
 ${PLIST.noexec}lib/sudo/sudo_noexec.la
 lib/sudo/sudoers.la
 lib/sudo/system_group.la
 man/man1/cvtsudoers.1
 man/man5/sudo.conf.5
+man/man5/sudo_logsrv.proto.5
+man/man5/sudo_logsrvd.conf.5
 man/man5/sudoers.5
 ${PLIST.ldap}man/man5/sudoers.ldap.5
 man/man5/sudoers_timestamp.5
 man/man8/sudo.8
+man/man8/sudo_logsrvd.8
 man/man8/sudo_plugin.8
+man/man8/sudo_sendlog.8
 man/man8/sudoedit.8
 man/man8/sudoreplay.8
 man/man8/visudo.8
+sbin/sudo_logsrvd
+sbin/sudo_sendlog
 sbin/visudo
 share/doc/sudo/CONTRIBUTORS
 share/doc/sudo/ChangeLog
@@ -35,6 +43,7 @@ ${PLIST.ldap}share/doc/sudo/schema.iPlanet
 ${PLIST.ldap}share/doc/sudo/schema.olcSudo
 share/examples/sudo/pam.conf
 share/examples/sudo/sudo.conf
+share/examples/sudo/sudo_logsrvd.conf
 share/examples/sudo/sudoers
 share/examples/sudo/syslog.conf
 ${PLIST.nls}share/locale/ast/LC_MESSAGES/sudo.mo
@@ -82,6 +91,8 @@ ${PLIST.nls}share/locale/pt/LC_MESSAGES/sudo.mo
 ${PLIST.nls}share/locale/pt/LC_MESSAGES/sudoers.mo
 ${PLIST.nls}share/locale/pt_BR/LC_MESSAGES/sudo.mo
 ${PLIST.nls}share/locale/pt_BR/LC_MESSAGES/sudoers.mo
+${PLIST.nls}share/locale/ro/LC_MESSAGES/sudo.mo
+${PLIST.nls}share/locale/ro/LC_MESSAGES/sudoers.mo
 ${PLIST.nls}share/locale/ru/LC_MESSAGES/sudo.mo
 ${PLIST.nls}share/locale/ru/LC_MESSAGES/sudoers.mo
 ${PLIST.nls}share/locale/sk/LC_MESSAGES/sudo.mo
diff --git a/security/sudo/distinfo b/security/sudo/distinfo
index 975231b54f1..720cddeed5c 100644
--- a/security/sudo/distinfo
+++ b/security/sudo/distinfo
@@ -1,10 +1,12 @@
-$NetBSD: distinfo,v 1.111 2020/09/19 14:04:29 taca Exp $
+$NetBSD: distinfo,v 1.111.4.1 2021/01/28 08:09:40 bsiegert Exp $
 
-SHA1 (sudo-1.8.31p2.tar.gz) = 53a6dfa90f78bc10615b83b7026bf3ba206c69e9
-RMD160 (sudo-1.8.31p2.tar.gz) = 5ffd8e785095c19c26ad8e3b3d5768669951f777
-SHA512 (sudo-1.8.31p2.tar.gz) = ad1bbbde74d3ab6e947071c6f21e436ebabcf5af11ecc75cde8f0c01ca0b8c6ae1cce2ff42f21612816c636e96722a2a14daa57757644ceab6577091f82242be
-Size (sudo-1.8.31p2.tar.gz) = 3353538 bytes
+SHA1 (sudo-1.9.5p2.tar.gz) = 08bde247a1e08bc881eec43e09733f7ca06408f5
+RMD160 (sudo-1.9.5p2.tar.gz) = 5952aafd4e777196eb8af81c4cdc420e3d688684
+SHA512 (sudo-1.9.5p2.tar.gz) = f0fe914963c31a6f8ab6c86847ff6cdd125bd5a839b27f46dcae03963f4fc413b3d4cca54c1979feb825c8479b44c7df0642c07345c941eecf6f9f1e03ea0e27
+Size (sudo-1.9.5p2.tar.gz) = 4012277 bytes
 SHA1 (patch-Makefile.in) = e8813e1aa208d9ef6304038328504a5402341560
-SHA1 (patch-configure) = 498b1040fceb317c239d050b59b3d1a180598441
-SHA1 (patch-plugins_sudoers_Makefile.in) = 730193c6437197a7114dd31886050cecdcba6772
+SHA1 (patch-configure) = 4db043c7384cdeb4701ccd2f455dfad2dc17c663
+SHA1 (patch-examples_Makefile.in) = a20967ecd88eb5e4a8b47e6a3b80bc18be713409
+SHA1 (patch-logsrvd_Makefile.in) = c460b868e09560a80f632d1332fc7d7c3d1822cf
+SHA1 (patch-plugins_sudoers_Makefile.in) = efc0fb726c23dcb2d6a006524fd561800d6d7924
 SHA1 (patch-src_Makefile.in) = 8959049bc428f592f84de1cad1a898c07c6e6b39
diff --git a/security/sudo/patches/patch-configure b/security/sudo/patches/patch-configure
index 6c18c0e8818..16b17a3c56b 100644
--- a/security/sudo/patches/patch-configure
+++ b/security/sudo/patches/patch-configure
@@ -1,4 +1,4 @@
-$NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
+$NetBSD: patch-configure,v 1.3.4.1 2021/01/28 08:09:40 bsiegert Exp $
 
 * Add "--with-nbsdops" option, NetBSD standard options.
 * Link with util(3) in the case of DragonFly, too.
@@ -7,9 +7,9 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
   functions (HAVE_KRB5_*).
 * Remove setting sysconfdir to "/etc".
 
---- configure.orig	2020-06-12 13:15:11.000000000 +0000
+--- configure.orig	2021-01-09 20:12:16.000000000 +0000
 +++ configure
-@@ -870,6 +870,7 @@ with_libpath
+@@ -892,6 +892,7 @@ with_libpath
  with_libraries
  with_efence
  with_csops
@@ -17,7 +17,7 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
  with_passwd
  with_skey
  with_opie
-@@ -1592,7 +1593,7 @@ Fine tuning of the installation director
+@@ -1621,7 +1622,7 @@ Fine tuning of the installation director
    --bindir=DIR            user executables [EPREFIX/bin]
    --sbindir=DIR           system admin executables [EPREFIX/sbin]
    --libexecdir=DIR        program executables [EPREFIX/libexec]
@@ -26,7 +26,7 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
    --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
    --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
    --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
-@@ -1706,6 +1707,7 @@ Optional Packages:
+@@ -1737,6 +1738,7 @@ Optional Packages:
    --with-libraries        additional libraries to link with
    --with-efence           link with -lefence for malloc() debugging
    --with-csops            add CSOps standard options
@@ -34,7 +34,7 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
    --without-passwd        don't use passwd/shadow file for authentication
    --with-skey[=DIR]       enable S/Key support
    --with-opie[=DIR]       enable OPIE support
-@@ -4809,6 +4811,23 @@ fi
+@@ -4863,6 +4865,23 @@ fi
  
  
  
@@ -58,7 +58,7 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
  # Check whether --with-passwd was given.
  if test "${with_passwd+set}" = set; then :
    withval=$with_passwd; case $with_passwd in
-@@ -15937,7 +15956,7 @@ fi
+@@ -15765,7 +15784,7 @@ fi
  		: ${mansectsu='1m'}
  		: ${mansectform='4'}
  		;;
@@ -67,7 +67,7 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
  		shadow_funcs="getspnam"
  		test -z "$with_pam" && AUTH_EXCL_DEF="PAM"
  		# Check for SECCOMP_SET_MODE_FILTER in linux/seccomp.h
-@@ -18175,7 +18194,7 @@ if test "x$ac_cv_header_login_cap_h" = x
+@@ -18026,7 +18045,7 @@ if test "x$ac_cv_header_login_cap_h" = x
  _ACEOF
   LOGINCAP_USAGE='[-c class] '; LCMAN=1
  	case "$OS" in
@@ -76,7 +76,7 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
  		SUDO_LIBS="${SUDO_LIBS} -lutil"
  		SUDOERS_LIBS="${SUDOERS_LIBS} -lutil"
  		;;
-@@ -23018,10 +23037,9 @@ if test ${with_pam-"no"} != "no"; then
+@@ -23965,10 +23984,9 @@ if test ${with_pam-"no"} != "no"; then
      # Check for pam_start() in libpam first, then for pam_appl.h.
      #
      found_pam_lib=no
@@ -89,7 +89,7 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
    $as_echo_n "(cached) " >&6
  else
    ac_check_lib_save_LIBS=$LIBS
-@@ -23045,18 +23063,17 @@ return pam_start ();
+@@ -23992,18 +24010,17 @@ return pam_start ();
  }
  _ACEOF
  if ac_fn_c_try_link "$LINENO"; then :
@@ -113,7 +113,7 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
    found_pam_lib=yes
  fi
  
-@@ -23791,6 +23808,8 @@ fi
+@@ -24738,6 +24755,8 @@ fi
  rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
  	AUTH_OBJS="$AUTH_OBJS kerb5.lo"
      fi
@@ -122,11 +122,11 @@ $NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
      _LIBS="$LIBS"
      LIBS="${LIBS} ${SUDOERS_LIBS}"
      for ac_func in krb5_verify_user krb5_init_secure_context
-@@ -27051,7 +27070,6 @@ test "$datarootdir" = '${prefix}/share' 
- test "$docdir" = '${datarootdir}/doc/${PACKAGE_TARNAME}' && docdir='$(datarootdir)/doc/$(PACKAGE_TARNAME)'
+@@ -28297,7 +28316,6 @@ test "$docdir" = '${datarootdir}/doc/${P
  test "$localedir" = '${datarootdir}/locale' && localedir='$(datarootdir)/locale'
  test "$localstatedir" = '${prefix}/var' && localstatedir='$(prefix)/var'
+ test "$runstatedir" = '${localstatedir}/run' && runstatedir='$(localstatedir)/run'
 -test "$sysconfdir" = '${prefix}/etc' && sysconfdir='/etc'
  
  if test X"$INIT_SCRIPT" != X""; then
-     ac_config_files="$ac_config_files init.d/$INIT_SCRIPT"
+     ac_config_files="$ac_config_files etc/init.d/$INIT_SCRIPT"
diff --git a/security/sudo/patches/patch-examples_Makefile.in b/security/sudo/patches/patch-examples_Makefile.in
new file mode 100644
index 00000000000..7186f6b37b8
--- /dev/null
+++ b/security/sudo/patches/patch-examples_Makefile.in
@@ -0,0 +1,18 @@
+$NetBSD: patch-examples_Makefile.in,v 1.1.2.2 2021/01/28 08:09:40 bsiegert Exp $
+
+Do not install the configuration files.
+
+--- examples/Makefile.in.orig	2020-12-17 01:33:43.000000000 +0000
++++ examples/Makefile.in
+@@ -83,11 +83,6 @@ install-includes:
+ 
+ install-doc: install-dirs
+ 	for f in $(EXAMPLES); do $(INSTALL) $(INSTALL_OWNER) -m 0644 $$f $(DESTDIR)$(exampledir); done
+-	test -r $(DESTDIR)$(sysconfdir)/sudo.conf || \
+-	    $(INSTALL) $(INSTALL_OWNER) -m 0644 sudo.conf $(DESTDIR)$(sysconfdir)
+-	if test -n "$(LOGSRVD_CONF)" -a ! -r $(DESTDIR)$(sysconfdir)/sudo_logsrvd.conf; then \
+-	    $(INSTALL) $(INSTALL_OWNER) -m 0644 $(LOGSRVD_CONF) $(DESTDIR)$(sysconfdir); \
+-	fi
+ 
+ install-plugin:
+ 
diff --git a/security/sudo/patches/patch-logsrvd_Makefile.in b/security/sudo/patches/patch-logsrvd_Makefile.in
new file mode 100644
index 00000000000..0c1f3e5a42c
--- /dev/null
+++ b/security/sudo/patches/patch-logsrvd_Makefile.in
@@ -0,0 +1,15 @@
+$NetBSD: patch-logsrvd_Makefile.in,v 1.1.2.2 2021/01/28 08:09:40 bsiegert Exp $
+
+Fix build error.
+
+--- logsrvd/Makefile.in.orig	2021-01-09 20:12:16.000000000 +0000
++++ logsrvd/Makefile.in
+@@ -46,7 +46,7 @@ INSTALL_BACKUP = @INSTALL_BACKUP@
+ LT_LIBS = $(top_builddir)/lib/iolog/libsudo_iolog.la \
+ 	  $(top_builddir)/lib/eventlog/libsudo_eventlog.la \
+ 	  $(top_builddir)/lib/logsrv/liblogsrv.la
+-LIBS = $(LT_LIBS) @LIBTLS@
++LIBS = $(LT_LIBS) @LIBTLS@ @LIBS@
+ 
+ # C preprocessor defines
+ CPPDEFS = -D_PATH_SUDO_LOGSRVD_CONF=\"$(sysconfdir)/sudo_logsrvd.conf\" \
diff --git a/security/sudo/patches/patch-plugins_sudoers_Makefile.in b/security/sudo/patches/patch-plugins_sudoers_Makefile.in
index 2205fe841d3..d746f5c2263 100644
--- a/security/sudo/patches/patch-plugins_sudoers_Makefile.in
+++ b/security/sudo/patches/patch-plugins_sudoers_Makefile.in
@@ -1,10 +1,26 @@
-$NetBSD: patch-plugins_sudoers_Makefile.in,v 1.3 2019/12/28 20:43:56 kim Exp $
+$NetBSD: patch-plugins_sudoers_Makefile.in,v 1.3.8.1 2021/01/28 08:09:40 bsiegert Exp $
 
-Do not install the sudoers file to etc.
+* Do not install the sudoers file.
+* link with @LIBS@ for PKG_OPTIONS nls enabled case.
 
---- plugins/sudoers/Makefile.in.orig	2019-12-25 21:21:05.000000000 +0200
-+++ plugins/sudoers/Makefile.in	2019-12-28 22:01:00.540953438 +0200
-@@ -396,7 +396,7 @@
+--- plugins/sudoers/Makefile.in.orig	2021-01-09 20:12:16.000000000 +0000
++++ plugins/sudoers/Makefile.in
+@@ -62,10 +62,10 @@ LIBUTIL = $(top_builddir)/lib/util/libsu
+ LIBS = $(LIBUTIL)
+ NET_LIBS = @NET_LIBS@
+ SUDOERS_LIBS = @SUDOERS_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ @LIBTLS@ $(NET_LIBS) $(LIBIOLOG) $(LIBEVENTLOG) $(LIBLOGSRV)
+-REPLAY_LIBS = @REPLAY_LIBS@ $(LIBEVENTLOG) $(LIBIOLOG)
+-VISUDO_LIBS = $(NET_LIBS)
+-CVTSUDOERS_LIBS = $(NET_LIBS)
+-TESTSUDOERS_LIBS = $(NET_LIBS)
++REPLAY_LIBS = @REPLAY_LIBS@ $(LIBEVENTLOG) $(LIBIOLOG) @LIBS@
++VISUDO_LIBS = $(NET_LIBS) @LIBS@
++CVTSUDOERS_LIBS = $(NET_LIBS) @LIBS@
++TESTSUDOERS_LIBS = $(NET_LIBS) @LIBS@
+ 
+ # C preprocessor defines
+ CPPDEFS = -DLIBDIR=\"$(libdir)\" -DLOCALEDIR=\"$(localedir)\" \
+@@ -390,7 +390,7 @@ pre-install:
  	    fi; \
  	fi
  
@@ -12,4 +28,4 @@ Do not install the sudoers file to etc.
 +install: install-plugin install-binaries install-doc
  
  install-dirs:
- 	$(SHELL) $(top_srcdir)/mkinstalldirs $(DESTDIR)$(plugindir) \
+ 	$(SHELL) $(scriptdir)/mkinstalldirs $(DESTDIR)$(plugindir) \