summaryrefslogtreecommitdiff
path: root/security/sudo
AgeCommit message (Collapse)AuthorFilesLines
2008-06-30Update sudo package to 1.6.9p17.taca2-6/+6
660) The -i flag should imply resetting the environment, as it did in sudo version prior to 1.6.9. Also, the -i and -E flags are mutually exclusive. 661) Fixed the configure test for dirfd() under Linux. 662) Fixed test for whether -lintl is required to link. 663) Changed how sudo handles the child process when sending mail. This fixes a problem on Linux with the mail_always option. 664) Fixed a problem with line continuation characters inside of quoted strings.
2008-05-14Update security/seudo pacakge to 1.6.p16.taca2-7/+7
Major changes since Sudo 1.6.9p15: o There was missing whitespace before the ldap libraries in the Makefile for some configurations. o LDAPS_PORT may not be defined on older Solaris LDAP SDKs. o If the LDAP server could not be contacted and the user was not present in sudoers, a syntax error in sudoers was incorrectly reported.
2008-04-02Don't hardcode "0 0" for the root user and group -- use ${REAL_ROOT_USER}jlam1-2/+3
and ${REAL_ROOT_GROUP} instead. The pkginstall framework checks for the name of the user and group, not the uid and gid, when comparing permissions. This fixes the following spurious warning from appearing: The following files are used by sudo-1.6.9p15 and have the wrong ownership and/or permissions: /usr/pkg/etc/sudoers (m=0440, o=0, g=0)
2008-03-29Update sudo package to 1.6.9p15.taca4-20/+21
653) Fixed installation of sudo_noexec.so on AIX. 654) Updated libtool to version 1.5.26. 655) Fixed printing of default SELinux role and type in -V mode. 656) The HOME environment variable is once again preserved by default, as per the documentation.
2008-03-11Update sudo package to 1.6.9p14.taca7-34/+53
pkgsrc changes: - Explict to depends security/heimdal package when kerberos option is specified. PR pkg/37999 should be fixed. Change: 646) Sudo will now set the nproc resource limit to unlimited on Linux systems to work around Linux's setuid() resource limit semantics. On PAM systems the resource limits will be reset by pam_limits.so before the command is executed. 647) SELinux support that can be used to implement role based access control (RBAC). A role and (optional) type may be specified in sudoers or on the command line. These are then used in the security context that the command is run as. 648) Fixed a Kerberos 5 compilation problem with MIT Kerberos. Sudo 1.6.9p13 released. 649) Fixed an invalid assumption in the PAM conversation function introduced in version 1.6.9p9. The conversation function may be called for non-password reading purposes as well. 650) Fixed freeing an uninitialized pointer in -l mode, introduced in version 1.6.9p13. 651) Check /etc/sudoers after LDAP even if the user was found in LDAP. This allows Defaults options in /etc/sudoers to take effect. 652) Add missing checks for enforcing mode in SELinux RBAC mode. Sudo 1.6.9p14 released.
2008-01-22Distribution file was changed after sudo 1.6.9p12 was released. :-(taca2-5/+7
config.h.in configure configure.in ldap.c Add DIST_SUBDIR to handle this situation. Bump PKG_REVISION.
2008-01-21Update sudo package to 1.6.9p12.taca2-6/+6
Changes from 1.6.9p11: 641) Added a configure check for the ber_set_option() function. 642) Fixed a compilation problem with the HP-UX K&R C compiler. 643) Revamped the Kerberos 5 ticket verification code. 644) Added support for the checkpeer ldap.conf variable for netscape-based LDAP SDKs. 645) Fixed a problem where an incomplete password could be echoed to the screen if there was a read timeout.
2008-01-06Update sudo package to 1.6.9p11.taca2-8/+6
637) Fixed a compilation problem on SCO related to how they store the high resolution timestamps in struct stat. 638) Avoid checking the passwd file group multiple times in the LDAP query when the user's passwd group is also listed in the supplemental group vector. 639) The URI specifier can now be used in ldap.conf even when the LDAP SDK doesn't support ldap_initialize(). 640) New %p prompt escape that expands to the user whose password is being prompted, as specified by the rootpw, targetpw and runaspw sudoers flags. Based on a diff from Patrick Schoenfeld.
2008-01-03Install the binaries readable for the owner, so that a package can berillig3-6/+7
created in unprivileged pkgsrc mode. PKGREVISION++
2007-12-30Replaced outdated mirrors by working mirrors.heinz1-4/+5
2007-12-21Update sudo pacakge to 1.6.9p10.taca2-7/+6
Major changes since Sudo 1.6.9p9: o Moved LDAP options into a table for simplified parsing/setting. o Fixed a problem with how some LDAP options were being applied. o Added support for connecting directly to LDAP servers via SSL/TLS for servers that don't support the start_tls extension.
2007-12-05sudo-1.6.9p9.tar.gz was updated now. So, introduce DIST_SUBDIR andtaca2-5/+7
bump PKGREVISION. A little bug fix seems to applied. -rw-r--r-- 1 taca taca 578259 Dec 3 19:38 sudo-1.6.9p9.tar.gz-prev -rw-r--r-- 1 taca taca 578262 Dec 5 00:27 sudo-1.6.9p9.tar.gz diff -dupNr sudo-1.6.9p9-20071203/parse.c sudo-1.6.9p9/parse.c --- sudo-1.6.9p9-20071203/parse.c 2007-11-28 08:29:59.000000000 +0900 +++ sudo-1.6.9p9/parse.c 2007-12-05 00:26:40.000000000 +0900 @@ -90,7 +90,7 @@ #endif /* HAVE_EXTENDED_GLOB */ #ifndef lint -__unused static const char rcsid[] = "$Sudo: parse.c,v 1.160.2.14 2007/10/24 16:43:27 millert Exp $"; +__unused static const char rcsid[] = "$Sudo: parse.c,v 1.160.2.15 2007/12/04 15:26:40 millert Exp $"; #endif /* lint */ /* @@ -202,7 +202,7 @@ sudoers_lookup(pwflag) return(VALIDATE_OK | (no_passwd == TRUE ? FLAG_NOPASS : 0) | (no_execve == TRUE ? FLAG_NOEXEC : 0) | - (setenv_ok == TRUE ? FLAG_SETENV : 0)); + (setenv_ok >= TRUE ? FLAG_SETENV : 0)); } else if ((runas_matches == TRUE && cmnd_matches == FALSE) || (runas_matches == FALSE && cmnd_matches == TRUE)) { /* @@ -212,7 +212,7 @@ sudoers_lookup(pwflag) return(VALIDATE_NOT_OK | (no_passwd == TRUE ? FLAG_NOPASS : 0) | (no_execve == TRUE ? FLAG_NOEXEC : 0) | - (setenv_ok == TRUE ? FLAG_SETENV : 0)); + (setenv_ok >= TRUE ? FLAG_SETENV : 0)); } } top--; diff -dupNr sudo-1.6.9p9-20071203/sudo.c sudo-1.6.9p9/sudo.c --- sudo-1.6.9p9-20071203/sudo.c 2007-12-03 02:13:52.000000000 +0900 +++ sudo-1.6.9p9/sudo.c 2007-12-04 01:12:03.000000000 +0900 @@ -730,8 +730,10 @@ parse_args(argc, argv) while (NewArgc > 0) { if (NewArgv[0][0] == '-') { - if (NewArgv[0][1] != '\0' && NewArgv[0][2] != '\0') + if (NewArgv[0][1] != '\0' && NewArgv[0][2] != '\0') { warnx("please use single character options"); + usage(1); + } switch (NewArgv[0][1]) { case 'p':
2007-12-05Update sudo package to 1.6.9p9.taca2-6/+6
Major changes since Sudo 1.6.9p8: o The ALL command in sudoers now implies SETENV permissions. o The command search is now performed using the target user's auxiliary group vector, not just the target's primary group. o When determining if the PAM prompt is the default "Password: ", compare the localized version if possible. o New passprompt_override option in sudoers to cause sudo's prompt to be used in all cases. Also set when the -p flag is used.
2007-11-12- Fix build problem on DragonFly BSD.taca3-51/+23
- Reduce patch size. Build problem on DragonFly BSD was noted by YONETANI Tomokazu via private mail.
2007-11-04Update sudo package to 1.6.9p8.taca2-6/+6
Major changes since Sudo 1.6.9p7: o Fixed a bug where a sudoers entry with no runas user specified was treated differently from a line with the default runas user explicitly specified.
2007-10-28Update sudo package to 1.6.9p7.taca5-66/+32
pkgsrc change: added DESTDIR support. Major changes since Sudo 1.6.9p6: o Reverted back to to using TCSAFLUSH instead of TCSADRAIN when turning off echo during password reading. o Fixed a configure bug that was preventing the addition of -lutil for login.conf support on FreeBSD and NetBSD. o Added a configure check for struct in6_addr since some systems define AF_INET6 but have no real IPv6 support.
2007-10-10Update sudo package to 1.6.9p6.taca2-6/+6
Major changes since Sudo 1.6.9p5: o Worked around bugs in the session support of some PAM implementations. The full tty path is now passed to PAM as well. o Sudo now only prints the password prompt if the process is in the foreground. o inttypes.h is now included when appropriate if it is present. o Simplified alias allocation in the parser.
2007-09-26PKG_OPTIONS_OPTIONAL_GROUPS/PKG_OPTIONS_NONEMPTY_SETS have their respectivebjs1-2/+2
options added to PKG_SUPPORTED_OPTIONS automagically. Duplicate options removed.
2007-09-09Update sudo pacakge to 1.6.9p5.taca4-304/+48
617) Fixed a bug in the IP address matching introduced by the IPV6 merge. 618) For "visudo -f file" we now use the permissions of the original file and not the hard-coded sudoers owner/group/mode. This makes it possible to use visudo with a revision control system. 619) Fixed sudoedit when used on a non-existent file. 620) Regenerated configure using autoconf 2.6.1 and libtool 1.5.24. 621) Groups and netgroups are now valid in an LDAP sudoRunas statement.
2007-08-18Update sudo package to 1.6.9p4.taca5-12/+15
pkgsrc change: Make these options mutual exclusive: kerberos pam skey. (Really, combinations of kerberos and pam, pam and skey are conflicts.) CHANGES: 609) Worked around a bug ins some PAM implementations that caused a crash when no tty was present. 610) Fixed a crash on some platforms in the error logging function. 611) Documentation improvements. Sudo 1.6.9p1 released. 612) Fixed updating of the saved environment when the environ pointer gets changed out from underneath us. Sudo 1.6.9p2 released. 613) Fixed a bug related to supplemental group matching introduced in 1.6.9. Sudo 1.6.9p3 released. 614) Added IPv6 support from YOSHIFUJI Hideaki. 615) Fixed sudo_noexec installation path. 616) Fixed a K&R compilation error. Sudo 1.6.9p4 released.
2007-07-30Readd the DragonFly libtool.m4 patches.joerg2-105/+58
2007-07-27Fix location of old distfiles in MASTER_SITE (s/old/OLD/).gdt1-2/+2
2007-07-26Remove a redundant PKGNAME definition (which matches DISTNAME), and addjlam1-2/+2
a fetch location for old distfiles so that we don't need to always keep this package at the latest release.
2007-07-23Update sudo to 1.6.9. We don't take the new default of PAM and no othertls8-264/+406
authentication; that can be enabled by adding pam to the package options if users desire.
2007-07-04pkgsrc basically follows the BSD man page hierarchy. Install the sujlam6-22/+8
and visudo manpages in man/man1, and the sudoers manpage in man/man5. Remove the platform-specific PLISTs that only differed in the location of the man pages. Bump the PKGREVISION to 5.
2007-07-02On some hosts, this package's configure script fails to detech Heimdaltls3-7/+13
(in fact, it's not clear that there is a good way to do so). The resulting configuration works fine *except* if it encounters a host that has 3DES but no DES service keys in its keytab. Fix this by explicitly passing 0 ("default enctype") to Kerberos.
2007-06-26Use -[ogm] instead of -[OGM] when passing permissions options to thejlam2-5/+36
install script. The latter are special install-sh script options that check whether the invoking user is the root user or not, which is completely unnecessary.
2007-06-25Add file omitted from previous commit.tls1-0/+21
2007-06-25Fix privilege-escalation vulnerability with PKG_OPTIONS.sudo=kerberos:tls3-8/+28
cleanse environment of variables that alter behavior of Kerberos library so the user can't override the default keytab location, and do *not* ignore missing keytab errors. Prevents root compromise via spoofed KDC on systems with Kerberos libraries but no host key in keytab, no keytab, or keytab overidden via environment. Don't insist that the keytab key be DES -- some Kerberos sites are 3DES/AES only. Somewhat less invasive than the fix Todd incorporated into the 1.6.9 branch of sudo (presently beta) but equivalent (though not as clean).
2007-03-18Try fixing PLIST for Darwin.wiz1-0/+5
2007-03-13bin/sudo is set-uid root. PKGREVISION++rillig1-2/+3
2006-06-14Make sudo use VARBASE.reed1-2/+6
Always use "man" instead of catpages. Make sure "run" directory is precreated, so you don't get: /usr/bin/sudo sudo: can't mkdir /var/run/sudo: No such file or directory Bump PKGREVISION. Okayed by maintainer back in December. The only concern was that /var/run may not be for all platforms, but this is same as other packages to (not specific to sudo).
2006-05-31The databases/openldap package has been split in -client and -server componentghen1-3/+3
packages. Convert LDAP-based applications to depend on openldap-client, and bump PKGREVISION for those that depend on it by default.
2006-01-15Add PYTHONINSPECT to the list of environment variables to cleanadrianp3-2/+16
Fix for http://secunia.com/advisories/18358/ Bump to nb1
2006-01-09Sync with latest sudo release (1.6.8pl12). The actual diff is one linecube3-32/+7
long. PR#32378 by Stefan Krüger. Changes: Added PS4 and SHELLOPTS to the list of variables to remove from the environment. (Already in pkgsrc) Added JAVA_TOOL_OPTIONS to the list of variables to remove from the environment. Added PERLLIB, PERL5LIB and PERL5OPT to the list of variables to remove from the environment. (Already in pkgsrc)
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-27Remove paragraph about "MAILING LISTS".reed1-9/+0
2005-12-27Sort.reed1-2/+2
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig1-2/+2
CONFIGURE_ARGS.
2005-11-12Update sudo to nb2 to address the recent secuity issue:adrianp3-6/+16
- http://www.sudo.ws/sudo/alerts/perl_env.html - Add "PERLLIB", "PERL5LIB" and the "PERL5OPT" to the list of environment variables to be cleaned.
2005-10-25Add a patch for CVE-2005-2959: SHELLOPTS and PS4 have to be cleared fromcube3-2/+17
the environment before letting the user execute bash scripts. Bump PKGREVISION. From Debian.
2005-10-11When patches are updated, distinfo must be updated as well.riz1-3/+3
Hi joerg! 8-)
2005-10-10Allow sudo to properly build on DragonFly. Without the detection ofjoerg3-14/+138
shared linking the noexec wrapper is not build.
2005-10-07Fixed a pkglint warning.rillig1-2/+1
2005-08-22check for /usr/include/skey.h on NetBSD - in case dist with MKSKEY=noabs1-2/+2
2005-06-22Update PKG_OPTIONS variable "PAM" to "pam".taca1-3/+3
2005-06-20Security update for security/sudo to 1.6.8p9. Changes from versionjlam2-7/+7
1.6.8p7 include: 562) Fixed noexec functionality on Linux. 564) Fixed a bug that prevented Heimdal authentication from working. 566) A sudoers entry with sudo ALL no longer overwrites the value of safe_cmnd. This fixes the privilege escalation vulnerability noted in http://www.courtesan.com/sudo/alerts/path_race.html
2005-05-31Packages have no business modifying PKG_DEFAULT_OPTIONS -- it's adillo1-2/+3
user settable variable. Set PKG_SUGGESTED_OPTIONS instead. Also, make use of PKG_OPTIONS_LEGACY_VARS. Reviewed by wiz.
2005-04-11Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used.tv1-2/+1
2005-03-30Update to 1.6.8pl7.cube2-8/+8
Changes: 557) Added a set of missing braces needed for MacOS X / Darwin. 558) Define LDAP_OPT_SUCCESS for those without it. 559) Warn if the user tries to use the -u option when not running a command. 560) Better PAM error handling and messages. 561) Fixed setting of $USER when env_reset is enabled.
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-27 19:24:56 +0000