scm-commits September 2013

scm-commits@lists.fedoraproject.org

475 participants
17685 discussions

Start a nNew thread

[krb5] Created tag krb5-1.11.3-16.fc20
by Nalin Dahyabhai 30 Sep '13

30 Sep '13

The lightweight tag 'krb5-1.11.3-16.fc20' was created pointing to: 3bc9a0e... Back to DIR: caches by default, for now

1 0

[sudo/f20] update to 1.8.8
by mildew＠fedoraproject.org 30 Sep '13

30 Sep '13

commit 9eeaef0b8568f04fc9492aaf84092f9e40cee021 Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Tue Oct 1 00:09:16 2013 +0200 update to 1.8.8 - major changes & fixes: - LDAP SASL support now works properly with Kerberos - root may no longer change its SELinux role without entering a password - user messages are now always displayed in the user's locale, even when the same message is being logged or mailed in a different locale. - log files created by sudo now explicitly have the group set to group ID 0 rather than relying on BSD group semantics - sudo now stores its libexec files in a sudo subdirectory instead of in libexec itself - system_group and group_file sudoers group provider plugins are now installed by default - the paths to ldap.conf and ldap.secret may now be specified as arguments to the sudoers plugin in the sudo.conf file - ...and many new features and settings. See the upstream ChangeLog for the full list. - several sssd support fixes - added patch to make uid/gid specification parsing more strict (don't accept an invalid number as uid/gid) - use the _pkgdocdir macro (see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs) - fixed several bugs found by the clang static analyzer - added %post dependency on chmod .gitignore | 1 + sources | 2 +- sudo-1.8.8-clangbugs.patch | 60 +++++++++++++++++++++ sudo-1.8.8-sssdfixes.patch | 119 +++++++++++++++++++++++++++++++++++++++++ sudo-1.8.8-strictuidgid.patch | 53 ++++++++++++++++++ sudo.spec | 58 ++++++++++++++++---- 6 files changed, 282 insertions(+), 11 deletions(-) --- diff --git a/.gitignore b/.gitignore index 44949ff..420d45e 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ sudo-1.7.2p2-sudoers /sudo-1.8.6.tar.gz /sudo-1.8.6p3.tar.gz /sudo-1.8.6p7.tar.gz +/sudo-1.8.8.tar.gz diff --git a/sources b/sources index 95bc198..97b27b4 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 56f74aed3a7b32f2b01a34d65ac86f85 sudo-1.7.4p4-sudoers -126abfa2e841139e774d4c67d80f0e5b sudo-1.8.6p7.tar.gz +fc4f074090afd56d9ff4ff4e97321971 sudo-1.8.8.tar.gz diff --git a/sudo-1.8.8-clangbugs.patch b/sudo-1.8.8-clangbugs.patch new file mode 100644 index 0000000..9d4f1cb --- /dev/null +++ b/sudo-1.8.8-clangbugs.patch @@ -0,0 +1,60 @@ +diff -up sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs sudo-1.8.8/plugins/sudoers/auth/pam.c +--- sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs 2013-09-30 23:41:07.899529555 +0200 ++++ sudo-1.8.8/plugins/sudoers/auth/pam.c 2013-09-30 23:41:58.988707761 +0200 +@@ -246,6 +246,7 @@ sudo_pam_begin_session(struct passwd *pw + (void) pam_end(pamh, *pam_status | PAM_DATA_SILENT); + pamh = NULL; + status = AUTH_FAILURE; ++ goto done; + } + } + +diff -up sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs sudo-1.8.8/plugins/sudoers/sssd.c +--- sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs 2013-09-30 23:44:20.404200629 +0200 ++++ sudo-1.8.8/plugins/sudoers/sssd.c 2013-09-30 23:49:05.998194738 +0200 +@@ -310,11 +310,10 @@ static int sudo_sss_close(struct sudo_ns + debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD); + + if (nss && nss->handle) { +- handle = nss->handle; +- dlclose(handle->ssslib); ++ handle = nss->handle; ++ dlclose(handle->ssslib); ++ efree(nss->handle); + } +- +- efree(nss->handle); + debug_return_int(0); + } + +@@ -705,17 +704,21 @@ sudo_sss_result_get(struct sudo_nss *nss + sudo_sss_result_filterp, _SUDO_SSS_FILTER_INCLUDE, NULL); + + if (f_sss_result != NULL) { +- if (f_sss_result->num_rules > 0) { +- if (state != NULL) { +- sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH"); +- *state |= _SUDO_SSS_STATE_HOSTMATCH; ++ if (f_sss_result->num_rules > 0) { ++ if (state != NULL) { ++ sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH"); ++ *state |= _SUDO_SSS_STATE_HOSTMATCH; ++ } + } +- } +- } + +- sudo_debug_printf(SUDO_DEBUG_DEBUG, +- "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result, +- u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules); ++ sudo_debug_printf(SUDO_DEBUG_DEBUG, ++ "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result, ++ u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules); ++ } else { ++ sudo_debug_printf(SUDO_DEBUG_DEBUG, ++ "u_sss_result=(%p, %u) => f_sss_result=NULL", ++ u_sss_result, u_sss_result->num_rules); ++ } + + handle->fn_free_result(u_sss_result); + diff --git a/sudo-1.8.8-sssdfixes.patch b/sudo-1.8.8-sssdfixes.patch new file mode 100644 index 0000000..31edde6 --- /dev/null +++ b/sudo-1.8.8-sssdfixes.patch @@ -0,0 +1,119 @@ +diff -up sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes sudo-1.8.8/plugins/sudoers/sssd.c +--- sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes 2013-09-30 23:18:49.641913457 +0200 ++++ sudo-1.8.8/plugins/sudoers/sssd.c 2013-09-30 23:25:54.819376696 +0200 +@@ -534,30 +534,31 @@ sudo_sss_check_runas_group(struct sudo_s + * Walk through search results and return true if we have a runas match, + * else false. RunAs info is optional. + */ +-static int ++static bool + sudo_sss_check_runas(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule) + { +- int ret; ++ bool ret; + debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD); + + if (rule == NULL) +- debug_return_int(false); ++ debug_return_bool(false); + + ret = sudo_sss_check_runas_user(handle, rule) != false && + sudo_sss_check_runas_group(handle, rule) != false; + +- debug_return_int(ret); ++ debug_return_bool(ret); + } + +-static int ++static bool + sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule) + { + char **val_array, *val; +- int ret = false, i; ++ bool ret = false; ++ int i; + debug_decl(sudo_sss_check_host, SUDO_DEBUG_SSSD); + + if (rule == NULL) +- debug_return_int(ret); ++ debug_return_bool(ret); + + /* get the values from the rule */ + switch (handle->fn_get_values(rule, "sudoHost", &val_array)) +@@ -566,10 +567,10 @@ sudo_sss_check_host(struct sudo_sss_hand + break; + case ENOENT: + sudo_debug_printf(SUDO_DEBUG_INFO, "No result."); +- debug_return_int(false); ++ debug_return_bool(false); + default: + sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoHost): != 0"); +- debug_return_int(ret); ++ debug_return_bool(ret); + } + + /* walk through values */ +@@ -589,7 +590,52 @@ sudo_sss_check_host(struct sudo_sss_hand + + handle->fn_free_values(val_array); + +- debug_return_int(ret); ++ debug_return_bool(ret); ++} ++ ++/* ++ * Look for netgroup specifcations in the sudoUser attribute and ++ * if found, filter according to netgroup membership. ++ * returns: ++ * true -> netgroup spec found && negroup member ++ * false -> netgroup spec found && not a meber of netgroup ++ * true -> netgroup spec not found (filtered by SSSD already, netgroups are an exception) ++ */ ++bool sudo_sss_filter_user_netgroup(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule) ++{ ++ bool ret = false, netgroup_spec_found = false; ++ char **val_array, *val; ++ int i; ++ debug_decl(sudo_sss_check_user_netgroup, SUDO_DEBUG_SSSD); ++ ++ if (!handle || !rule) ++ debug_return_bool(ret); ++ ++ switch (handle->fn_get_values(rule, "sudoUser", &val_array)) { ++ case 0: ++ break; ++ case ENOENT: ++ sudo_debug_printf(SUDO_DEBUG_INFO, "No result."); ++ debug_return_bool(ret); ++ default: ++ sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoUser): != 0"); ++ debug_return_bool(ret); ++ } ++ ++ for (i = 0; val_array[i] != NULL && !ret; ++i) { ++ val = val_array[i]; ++ if (*val == '+') { ++ netgroup_spec_found = true; ++ } ++ sudo_debug_printf(SUDO_DEBUG_DEBUG, "val[%d]=%s", i, val); ++ if (strcmp(val, "ALL") == 0 || netgr_matches(val, NULL, NULL, user_name)) { ++ ret = true; ++ sudo_debug_printf(SUDO_DEBUG_DIAG, ++ "sssd/ldap sudoUser '%s' ... MATCH! (%s)", val, user_name); ++ } ++ } ++ handle->fn_free_values(val_array); ++ debug_return_bool(netgroup_spec_found ? ret : true); + } + + static int +@@ -599,7 +645,8 @@ sudo_sss_result_filterp(struct sudo_sss_ + (void)unused; + debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD); + +- if (sudo_sss_check_host(handle, rule)) ++ if (sudo_sss_check_host(handle, rule) && ++ sudo_sss_filter_user_netgroup(handle, rule)) + debug_return_int(1); + else + debug_return_int(0); diff --git a/sudo-1.8.8-strictuidgid.patch b/sudo-1.8.8-strictuidgid.patch new file mode 100644 index 0000000..ebb14ff --- /dev/null +++ b/sudo-1.8.8-strictuidgid.patch @@ -0,0 +1,53 @@ +diff -up sudo-1.8.8/plugins/sudoers/match.c.strictuidgid sudo-1.8.8/plugins/sudoers/match.c +--- sudo-1.8.8/plugins/sudoers/match.c.strictuidgid 2013-09-30 23:30:12.359263967 +0200 ++++ sudo-1.8.8/plugins/sudoers/match.c 2013-09-30 23:31:04.335443002 +0200 +@@ -777,14 +777,16 @@ hostname_matches(char *shost, char *lhos + bool + userpw_matches(char *sudoers_user, char *user, struct passwd *pw) + { +- debug_decl(userpw_matches, SUDO_DEBUG_MATCH) +- +- if (pw != NULL && *sudoers_user == '#') { +- uid_t uid = (uid_t) atoi(sudoers_user + 1); +- if (uid == pw->pw_uid) +- debug_return_bool(true); +- } +- debug_return_bool(strcmp(sudoers_user, user) == 0); ++ debug_decl(userpw_matches, SUDO_DEBUG_MATCH) ++ if (pw != NULL && *sudoers_user == '#') { ++ char *end = NULL; ++ uid_t uid = (uid_t) strtol(sudoers_user + 1, &end, 10); ++ if (end != NULL && (sudoers_user[1] != '\0' && *end == '\0')) { ++ if (uid == pw->pw_uid) ++ debug_return_bool(true); ++ } ++ } ++ debug_return_bool(strcmp(sudoers_user, user) == 0); + } + + /* +@@ -794,14 +796,16 @@ userpw_matches(char *sudoers_user, char + bool + group_matches(char *sudoers_group, struct group *gr) + { +- debug_decl(group_matches, SUDO_DEBUG_MATCH) +- +- if (*sudoers_group == '#') { +- gid_t gid = (gid_t) atoi(sudoers_group + 1); +- if (gid == gr->gr_gid) +- debug_return_bool(true); +- } +- debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0); ++ debug_decl(group_matches, SUDO_DEBUG_MATCH) ++ if (*sudoers_group == '#') { ++ char *end = NULL; ++ gid_t gid = (gid_t) strtol(sudoers_group + 1, &end, 10); ++ if (end != NULL && (sudoers_group[1] != '\0' && *end == '\0')) { ++ if (gid == gr->gr_gid) ++ debug_return_bool(true); ++ } ++ } ++ debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0); + } + + /* diff --git a/sudo.spec b/sudo.spec index f12c88a..aefcc1e 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.6p7 -Release: 2%{?dist} +Version: 1.8.8 +Release: 1%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -9,6 +9,7 @@ Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz Source1: sudo-1.7.4p4-sudoers Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: /etc/pam.d/system-auth, vim-minimal +Requires(post): /bin/chmod BuildRequires: pam-devel BuildRequires: groff @@ -26,6 +27,12 @@ BuildRequires: zlib-devel Patch1: sudo-1.6.7p5-strip.patch # configure.in fix Patch2: sudo-1.7.2p1-envdebug.patch +# Fix several issues in the sssd code +Patch3: sudo-1.8.8-sssdfixes.patch +# Don't accept invalid number in uid/gid specifications +Patch4: sudo-1.8.8-strictuidgid.patch +# Fix several issues found by the clang static analyzer +Patch5: sudo-1.8.8-clangbugs.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -52,6 +59,9 @@ plugins that use %{name}. %patch1 -p1 -b .strip %patch2 -p1 -b .envdebug +%patch3 -p1 -b .sssdfixes +%patch4 -p1 -b .strictuidgid +%patch5 -p1 -b .clangbugs %build autoreconf -I m4 -fv --install @@ -68,7 +78,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --prefix=%{_prefix} \ --sbindir=%{_sbindir} \ --libdir=%{_libdir} \ - --docdir=%{_datadir}/doc/%{name}-%{version} \ + --docdir=%{_pkgdocdir} \ --with-logging=syslog \ --with-logfac=authpriv \ --with-pam \ @@ -95,10 +105,10 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers -chmod +x $RPM_BUILD_ROOT%{_libexecdir}/*.so # for stripping, reset in %%files +chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%files # Remove execute permission on this script so we don't pull in perl deps -chmod -x $RPM_BUILD_ROOT%{_docdir}/sudo-*/sudoers2ldif +chmod -x $RPM_BUILD_ROOT%{_pkgdocdir}/sudoers2ldif %find_lang sudo %find_lang sudoers @@ -140,17 +150,20 @@ rm -rf $RPM_BUILD_ROOT %attr(4111,root,root) %{_bindir}/sudoedit %attr(0111,root,root) %{_bindir}/sudoreplay %attr(0755,root,root) %{_sbindir}/visudo -%attr(0755,root,root) %{_libexecdir}/sesh -%attr(0644,root,root) %{_libexecdir}/sudo_noexec.so -%attr(0644,root,root) %{_libexecdir}/sudoers.so +%attr(0755,root,root) %{_libexecdir}/sudo/sesh +%attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so +%attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so +%attr(0644,root,root) %{_libexecdir}/sudo/group_file.so +%attr(0644,root,root) %{_libexecdir}/sudo/system_group.so %{_mandir}/man5/sudoers.5* %{_mandir}/man5/sudoers.ldap.5* +%{_mandir}/man5/sudo.conf.5* %{_mandir}/man8/sudo.8* %{_mandir}/man8/sudoedit.8* %{_mandir}/man8/sudoreplay.8* %{_mandir}/man8/visudo.8* -%dir %{_docdir}/sudo-%{version} -%{_docdir}/sudo-%{version}/* +%dir %{_pkgdocdir}/ +%{_pkgdocdir}/* # Make sure permissions are ok even if we're updating @@ -164,6 +177,31 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/sudo_plugin.8* %changelog +* Mon Sep 30 2013 Daniel Kopecek <dkopecek(a)redhat.com> - 1.8.8-1 +- update to 1.8.8 +- major changes & fixes: + - LDAP SASL support now works properly with Kerberos + - root may no longer change its SELinux role without entering a password + - user messages are now always displayed in the user's locale, even when + the same message is being logged or mailed in a different locale. + - log files created by sudo now explicitly have the group set to group + ID 0 rather than relying on BSD group semantics + - sudo now stores its libexec files in a sudo subdirectory instead of in + libexec itself + - system_group and group_file sudoers group provider plugins are now + installed by default + - the paths to ldap.conf and ldap.secret may now be specified as arguments + to the sudoers plugin in the sudo.conf file + - ...and many new features and settings. See the upstream ChangeLog for the + full list. +- several sssd support fixes +- added patch to make uid/gid specification parsing more strict (don't accept + an invalid number as uid/gid) +- use the _pkgdocdir macro + (see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs) +- fixed several bugs found by the clang static analyzer +- added %%post dependency on chmod + * Sun Aug 04 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.8.6p7-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

1 0

[sudo/f20] Removed unused patches
by mildew＠fedoraproject.org 30 Sep '13

30 Sep '13

commit 5ad9e5110c12637e1f79336433f926ae6f64c944 Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Tue Oct 1 00:30:24 2013 +0200 Removed unused patches sudo-1.7.4p3-m4path.patch | 17 ------- sudo-1.8.6p3-noauthwarn-regression.patch | 77 ------------------------------ 2 files changed, 0 insertions(+), 94 deletions(-)

1 0

[sudo] update to 1.8.8
by mildew＠fedoraproject.org 30 Sep '13

30 Sep '13

commit 8729726fc17c029678991ffe5f8dc339a5740fcf Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Tue Oct 1 00:09:16 2013 +0200 update to 1.8.8 - major changes & fixes: - LDAP SASL support now works properly with Kerberos - root may no longer change its SELinux role without entering a password - user messages are now always displayed in the user's locale, even when the same message is being logged or mailed in a different locale. - log files created by sudo now explicitly have the group set to group ID 0 rather than relying on BSD group semantics - sudo now stores its libexec files in a sudo subdirectory instead of in libexec itself - system_group and group_file sudoers group provider plugins are now installed by default - the paths to ldap.conf and ldap.secret may now be specified as arguments to the sudoers plugin in the sudo.conf file - ...and many new features and settings. See the upstream ChangeLog for the full list. - several sssd support fixes - added patch to make uid/gid specification parsing more strict (don't accept an invalid number as uid/gid) - use the _pkgdocdir macro (see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs) - fixed several bugs found by the clang static analyzer - added %post dependency on chmod .gitignore | 1 + sources | 2 +- sudo-1.8.8-clangbugs.patch | 60 +++++++++++++++++++++ sudo-1.8.8-sssdfixes.patch | 119 +++++++++++++++++++++++++++++++++++++++++ sudo-1.8.8-strictuidgid.patch | 53 ++++++++++++++++++ sudo.spec | 58 ++++++++++++++++---- 6 files changed, 282 insertions(+), 11 deletions(-) --- diff --git a/.gitignore b/.gitignore index 44949ff..420d45e 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ sudo-1.7.2p2-sudoers /sudo-1.8.6.tar.gz /sudo-1.8.6p3.tar.gz /sudo-1.8.6p7.tar.gz +/sudo-1.8.8.tar.gz diff --git a/sources b/sources index 95bc198..97b27b4 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 56f74aed3a7b32f2b01a34d65ac86f85 sudo-1.7.4p4-sudoers -126abfa2e841139e774d4c67d80f0e5b sudo-1.8.6p7.tar.gz +fc4f074090afd56d9ff4ff4e97321971 sudo-1.8.8.tar.gz diff --git a/sudo-1.8.8-clangbugs.patch b/sudo-1.8.8-clangbugs.patch new file mode 100644 index 0000000..9d4f1cb --- /dev/null +++ b/sudo-1.8.8-clangbugs.patch @@ -0,0 +1,60 @@ +diff -up sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs sudo-1.8.8/plugins/sudoers/auth/pam.c +--- sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs 2013-09-30 23:41:07.899529555 +0200 ++++ sudo-1.8.8/plugins/sudoers/auth/pam.c 2013-09-30 23:41:58.988707761 +0200 +@@ -246,6 +246,7 @@ sudo_pam_begin_session(struct passwd *pw + (void) pam_end(pamh, *pam_status | PAM_DATA_SILENT); + pamh = NULL; + status = AUTH_FAILURE; ++ goto done; + } + } + +diff -up sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs sudo-1.8.8/plugins/sudoers/sssd.c +--- sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs 2013-09-30 23:44:20.404200629 +0200 ++++ sudo-1.8.8/plugins/sudoers/sssd.c 2013-09-30 23:49:05.998194738 +0200 +@@ -310,11 +310,10 @@ static int sudo_sss_close(struct sudo_ns + debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD); + + if (nss && nss->handle) { +- handle = nss->handle; +- dlclose(handle->ssslib); ++ handle = nss->handle; ++ dlclose(handle->ssslib); ++ efree(nss->handle); + } +- +- efree(nss->handle); + debug_return_int(0); + } + +@@ -705,17 +704,21 @@ sudo_sss_result_get(struct sudo_nss *nss + sudo_sss_result_filterp, _SUDO_SSS_FILTER_INCLUDE, NULL); + + if (f_sss_result != NULL) { +- if (f_sss_result->num_rules > 0) { +- if (state != NULL) { +- sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH"); +- *state |= _SUDO_SSS_STATE_HOSTMATCH; ++ if (f_sss_result->num_rules > 0) { ++ if (state != NULL) { ++ sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH"); ++ *state |= _SUDO_SSS_STATE_HOSTMATCH; ++ } + } +- } +- } + +- sudo_debug_printf(SUDO_DEBUG_DEBUG, +- "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result, +- u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules); ++ sudo_debug_printf(SUDO_DEBUG_DEBUG, ++ "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result, ++ u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules); ++ } else { ++ sudo_debug_printf(SUDO_DEBUG_DEBUG, ++ "u_sss_result=(%p, %u) => f_sss_result=NULL", ++ u_sss_result, u_sss_result->num_rules); ++ } + + handle->fn_free_result(u_sss_result); + diff --git a/sudo-1.8.8-sssdfixes.patch b/sudo-1.8.8-sssdfixes.patch new file mode 100644 index 0000000..31edde6 --- /dev/null +++ b/sudo-1.8.8-sssdfixes.patch @@ -0,0 +1,119 @@ +diff -up sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes sudo-1.8.8/plugins/sudoers/sssd.c +--- sudo-1.8.8/plugins/sudoers/sssd.c.sssdfixes 2013-09-30 23:18:49.641913457 +0200 ++++ sudo-1.8.8/plugins/sudoers/sssd.c 2013-09-30 23:25:54.819376696 +0200 +@@ -534,30 +534,31 @@ sudo_sss_check_runas_group(struct sudo_s + * Walk through search results and return true if we have a runas match, + * else false. RunAs info is optional. + */ +-static int ++static bool + sudo_sss_check_runas(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule) + { +- int ret; ++ bool ret; + debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD); + + if (rule == NULL) +- debug_return_int(false); ++ debug_return_bool(false); + + ret = sudo_sss_check_runas_user(handle, rule) != false && + sudo_sss_check_runas_group(handle, rule) != false; + +- debug_return_int(ret); ++ debug_return_bool(ret); + } + +-static int ++static bool + sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule) + { + char **val_array, *val; +- int ret = false, i; ++ bool ret = false; ++ int i; + debug_decl(sudo_sss_check_host, SUDO_DEBUG_SSSD); + + if (rule == NULL) +- debug_return_int(ret); ++ debug_return_bool(ret); + + /* get the values from the rule */ + switch (handle->fn_get_values(rule, "sudoHost", &val_array)) +@@ -566,10 +567,10 @@ sudo_sss_check_host(struct sudo_sss_hand + break; + case ENOENT: + sudo_debug_printf(SUDO_DEBUG_INFO, "No result."); +- debug_return_int(false); ++ debug_return_bool(false); + default: + sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoHost): != 0"); +- debug_return_int(ret); ++ debug_return_bool(ret); + } + + /* walk through values */ +@@ -589,7 +590,52 @@ sudo_sss_check_host(struct sudo_sss_hand + + handle->fn_free_values(val_array); + +- debug_return_int(ret); ++ debug_return_bool(ret); ++} ++ ++/* ++ * Look for netgroup specifcations in the sudoUser attribute and ++ * if found, filter according to netgroup membership. ++ * returns: ++ * true -> netgroup spec found && negroup member ++ * false -> netgroup spec found && not a meber of netgroup ++ * true -> netgroup spec not found (filtered by SSSD already, netgroups are an exception) ++ */ ++bool sudo_sss_filter_user_netgroup(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule) ++{ ++ bool ret = false, netgroup_spec_found = false; ++ char **val_array, *val; ++ int i; ++ debug_decl(sudo_sss_check_user_netgroup, SUDO_DEBUG_SSSD); ++ ++ if (!handle || !rule) ++ debug_return_bool(ret); ++ ++ switch (handle->fn_get_values(rule, "sudoUser", &val_array)) { ++ case 0: ++ break; ++ case ENOENT: ++ sudo_debug_printf(SUDO_DEBUG_INFO, "No result."); ++ debug_return_bool(ret); ++ default: ++ sudo_debug_printf(SUDO_DEBUG_INFO, "handle->fn_get_values(sudoUser): != 0"); ++ debug_return_bool(ret); ++ } ++ ++ for (i = 0; val_array[i] != NULL && !ret; ++i) { ++ val = val_array[i]; ++ if (*val == '+') { ++ netgroup_spec_found = true; ++ } ++ sudo_debug_printf(SUDO_DEBUG_DEBUG, "val[%d]=%s", i, val); ++ if (strcmp(val, "ALL") == 0 || netgr_matches(val, NULL, NULL, user_name)) { ++ ret = true; ++ sudo_debug_printf(SUDO_DEBUG_DIAG, ++ "sssd/ldap sudoUser '%s' ... MATCH! (%s)", val, user_name); ++ } ++ } ++ handle->fn_free_values(val_array); ++ debug_return_bool(netgroup_spec_found ? ret : true); + } + + static int +@@ -599,7 +645,8 @@ sudo_sss_result_filterp(struct sudo_sss_ + (void)unused; + debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD); + +- if (sudo_sss_check_host(handle, rule)) ++ if (sudo_sss_check_host(handle, rule) && ++ sudo_sss_filter_user_netgroup(handle, rule)) + debug_return_int(1); + else + debug_return_int(0); diff --git a/sudo-1.8.8-strictuidgid.patch b/sudo-1.8.8-strictuidgid.patch new file mode 100644 index 0000000..ebb14ff --- /dev/null +++ b/sudo-1.8.8-strictuidgid.patch @@ -0,0 +1,53 @@ +diff -up sudo-1.8.8/plugins/sudoers/match.c.strictuidgid sudo-1.8.8/plugins/sudoers/match.c +--- sudo-1.8.8/plugins/sudoers/match.c.strictuidgid 2013-09-30 23:30:12.359263967 +0200 ++++ sudo-1.8.8/plugins/sudoers/match.c 2013-09-30 23:31:04.335443002 +0200 +@@ -777,14 +777,16 @@ hostname_matches(char *shost, char *lhos + bool + userpw_matches(char *sudoers_user, char *user, struct passwd *pw) + { +- debug_decl(userpw_matches, SUDO_DEBUG_MATCH) +- +- if (pw != NULL && *sudoers_user == '#') { +- uid_t uid = (uid_t) atoi(sudoers_user + 1); +- if (uid == pw->pw_uid) +- debug_return_bool(true); +- } +- debug_return_bool(strcmp(sudoers_user, user) == 0); ++ debug_decl(userpw_matches, SUDO_DEBUG_MATCH) ++ if (pw != NULL && *sudoers_user == '#') { ++ char *end = NULL; ++ uid_t uid = (uid_t) strtol(sudoers_user + 1, &end, 10); ++ if (end != NULL && (sudoers_user[1] != '\0' && *end == '\0')) { ++ if (uid == pw->pw_uid) ++ debug_return_bool(true); ++ } ++ } ++ debug_return_bool(strcmp(sudoers_user, user) == 0); + } + + /* +@@ -794,14 +796,16 @@ userpw_matches(char *sudoers_user, char + bool + group_matches(char *sudoers_group, struct group *gr) + { +- debug_decl(group_matches, SUDO_DEBUG_MATCH) +- +- if (*sudoers_group == '#') { +- gid_t gid = (gid_t) atoi(sudoers_group + 1); +- if (gid == gr->gr_gid) +- debug_return_bool(true); +- } +- debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0); ++ debug_decl(group_matches, SUDO_DEBUG_MATCH) ++ if (*sudoers_group == '#') { ++ char *end = NULL; ++ gid_t gid = (gid_t) strtol(sudoers_group + 1, &end, 10); ++ if (end != NULL && (sudoers_group[1] != '\0' && *end == '\0')) { ++ if (gid == gr->gr_gid) ++ debug_return_bool(true); ++ } ++ } ++ debug_return_bool(strcmp(gr->gr_name, sudoers_group) == 0); + } + + /* diff --git a/sudo.spec b/sudo.spec index f12c88a..aefcc1e 100644 --- a/sudo.spec +++ b/sudo.spec @@ -1,7 +1,7 @@ Summary: Allows restricted root access for specified users Name: sudo -Version: 1.8.6p7 -Release: 2%{?dist} +Version: 1.8.8 +Release: 1%{?dist} License: ISC Group: Applications/System URL: http://www.courtesan.com/sudo/ @@ -9,6 +9,7 @@ Source0: http://www.courtesan.com/sudo/dist/sudo-%{version}.tar.gz Source1: sudo-1.7.4p4-sudoers Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: /etc/pam.d/system-auth, vim-minimal +Requires(post): /bin/chmod BuildRequires: pam-devel BuildRequires: groff @@ -26,6 +27,12 @@ BuildRequires: zlib-devel Patch1: sudo-1.6.7p5-strip.patch # configure.in fix Patch2: sudo-1.7.2p1-envdebug.patch +# Fix several issues in the sssd code +Patch3: sudo-1.8.8-sssdfixes.patch +# Don't accept invalid number in uid/gid specifications +Patch4: sudo-1.8.8-strictuidgid.patch +# Fix several issues found by the clang static analyzer +Patch5: sudo-1.8.8-clangbugs.patch %description Sudo (superuser do) allows a system administrator to give certain @@ -52,6 +59,9 @@ plugins that use %{name}. %patch1 -p1 -b .strip %patch2 -p1 -b .envdebug +%patch3 -p1 -b .sssdfixes +%patch4 -p1 -b .strictuidgid +%patch5 -p1 -b .clangbugs %build autoreconf -I m4 -fv --install @@ -68,7 +78,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" --prefix=%{_prefix} \ --sbindir=%{_sbindir} \ --libdir=%{_libdir} \ - --docdir=%{_datadir}/doc/%{name}-%{version} \ + --docdir=%{_pkgdocdir} \ --with-logging=syslog \ --with-logfac=authpriv \ --with-pam \ @@ -95,10 +105,10 @@ install -p -d -m 700 $RPM_BUILD_ROOT/var/db/sudo install -p -d -m 750 $RPM_BUILD_ROOT/etc/sudoers.d install -p -c -m 0440 %{SOURCE1} $RPM_BUILD_ROOT/etc/sudoers -chmod +x $RPM_BUILD_ROOT%{_libexecdir}/*.so # for stripping, reset in %%files +chmod +x $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.so # for stripping, reset in %%files # Remove execute permission on this script so we don't pull in perl deps -chmod -x $RPM_BUILD_ROOT%{_docdir}/sudo-*/sudoers2ldif +chmod -x $RPM_BUILD_ROOT%{_pkgdocdir}/sudoers2ldif %find_lang sudo %find_lang sudoers @@ -140,17 +150,20 @@ rm -rf $RPM_BUILD_ROOT %attr(4111,root,root) %{_bindir}/sudoedit %attr(0111,root,root) %{_bindir}/sudoreplay %attr(0755,root,root) %{_sbindir}/visudo -%attr(0755,root,root) %{_libexecdir}/sesh -%attr(0644,root,root) %{_libexecdir}/sudo_noexec.so -%attr(0644,root,root) %{_libexecdir}/sudoers.so +%attr(0755,root,root) %{_libexecdir}/sudo/sesh +%attr(0644,root,root) %{_libexecdir}/sudo/sudo_noexec.so +%attr(0644,root,root) %{_libexecdir}/sudo/sudoers.so +%attr(0644,root,root) %{_libexecdir}/sudo/group_file.so +%attr(0644,root,root) %{_libexecdir}/sudo/system_group.so %{_mandir}/man5/sudoers.5* %{_mandir}/man5/sudoers.ldap.5* +%{_mandir}/man5/sudo.conf.5* %{_mandir}/man8/sudo.8* %{_mandir}/man8/sudoedit.8* %{_mandir}/man8/sudoreplay.8* %{_mandir}/man8/visudo.8* -%dir %{_docdir}/sudo-%{version} -%{_docdir}/sudo-%{version}/* +%dir %{_pkgdocdir}/ +%{_pkgdocdir}/* # Make sure permissions are ok even if we're updating @@ -164,6 +177,31 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/sudo_plugin.8* %changelog +* Mon Sep 30 2013 Daniel Kopecek <dkopecek(a)redhat.com> - 1.8.8-1 +- update to 1.8.8 +- major changes & fixes: + - LDAP SASL support now works properly with Kerberos + - root may no longer change its SELinux role without entering a password + - user messages are now always displayed in the user's locale, even when + the same message is being logged or mailed in a different locale. + - log files created by sudo now explicitly have the group set to group + ID 0 rather than relying on BSD group semantics + - sudo now stores its libexec files in a sudo subdirectory instead of in + libexec itself + - system_group and group_file sudoers group provider plugins are now + installed by default + - the paths to ldap.conf and ldap.secret may now be specified as arguments + to the sudoers plugin in the sudo.conf file + - ...and many new features and settings. See the upstream ChangeLog for the + full list. +- several sssd support fixes +- added patch to make uid/gid specification parsing more strict (don't accept + an invalid number as uid/gid) +- use the _pkgdocdir macro + (see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs) +- fixed several bugs found by the clang static analyzer +- added %%post dependency on chmod + * Sun Aug 04 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.8.6p7-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

1 0

[sudo] Removed unused patches
by mildew＠fedoraproject.org 30 Sep '13

30 Sep '13

commit 42f0c7e7264a4e8ba2e6c9f41db71584c036376f Author: Daniel Kopecek <dkopecek(a)redhat.com> Date: Tue Oct 1 00:05:52 2013 +0200 Removed unused patches sudo-1.7.4p3-m4path.patch | 17 ------- sudo-1.8.6p3-noauthwarn-regression.patch | 77 ------------------------------ 2 files changed, 0 insertions(+), 94 deletions(-)

1 0

[tinyproxy/f19] add missing NDEBUG to CFLAGS
by jjh 30 Sep '13

30 Sep '13

commit eab36c6343fe2bb78816fccf2e7afad819211b9b Author: Jeremy Hinegardner <jeremy(a)hinegardner.org> Date: Mon Sep 30 16:18:46 2013 -0600 add missing NDEBUG to CFLAGS tinyproxy.spec | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) --- diff --git a/tinyproxy.spec b/tinyproxy.spec index b388628..2e00ba3 100644 --- a/tinyproxy.spec +++ b/tinyproxy.spec @@ -9,7 +9,7 @@ Name: tinyproxy Version: 1.8.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A small, efficient HTTP/SSL proxy daemon Group: System Environment/Daemons @@ -39,7 +39,7 @@ resource intensive, or a security risk. --enable-reverse \ --enable-transparent -make LDFLAGS="%{?__global_ldflags}" CFLAGS="$RPM_OPT_FLAGS" %{?_smp_mflags} +make LDFLAGS="%{?__global_ldflags}" CFLAGS="-DNDEBUG $RPM_OPT_FLAGS" %{?_smp_mflags} %install @@ -94,6 +94,9 @@ fi %attr(-,%{tinyproxy_user},%{tinyproxy_group}) %dir %{tinyproxy_logdir} %changelog +* Mon Sep 30 2013 Jeremy Hinegardner <jeremy(a)hinegardner.org> - 1.8.3-2 +- fix missing NDEBUG flag (#1011783) + * Sun Sep 08 2013 Jeremy Hinegardner <jeremy(a)hinegardner.org> - 1.8.3-1 - update to upstream 1.8.3

1 0

[tinyproxy/f20] add missing NDEBUG to CFLAGS
by jjh 30 Sep '13

30 Sep '13

commit 58cb71996d21daedfa8ccd84add523632433395a Author: Jeremy Hinegardner <jeremy(a)hinegardner.org> Date: Mon Sep 30 16:17:02 2013 -0600 add missing NDEBUG to CFLAGS tinyproxy.spec | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) --- diff --git a/tinyproxy.spec b/tinyproxy.spec index b388628..2e00ba3 100644 --- a/tinyproxy.spec +++ b/tinyproxy.spec @@ -9,7 +9,7 @@ Name: tinyproxy Version: 1.8.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A small, efficient HTTP/SSL proxy daemon Group: System Environment/Daemons @@ -39,7 +39,7 @@ resource intensive, or a security risk. --enable-reverse \ --enable-transparent -make LDFLAGS="%{?__global_ldflags}" CFLAGS="$RPM_OPT_FLAGS" %{?_smp_mflags} +make LDFLAGS="%{?__global_ldflags}" CFLAGS="-DNDEBUG $RPM_OPT_FLAGS" %{?_smp_mflags} %install @@ -94,6 +94,9 @@ fi %attr(-,%{tinyproxy_user},%{tinyproxy_group}) %dir %{tinyproxy_logdir} %changelog +* Mon Sep 30 2013 Jeremy Hinegardner <jeremy(a)hinegardner.org> - 1.8.3-2 +- fix missing NDEBUG flag (#1011783) + * Sun Sep 08 2013 Jeremy Hinegardner <jeremy(a)hinegardner.org> - 1.8.3-1 - update to upstream 1.8.3

1 0

[tinyproxy] add missing NDEBUG to CFLAGS
by jjh 30 Sep '13

30 Sep '13

commit 5e218c7e322b81bcb37c894f4532621b8eab32e3 Author: Jeremy Hinegardner <jeremy(a)hinegardner.org> Date: Mon Sep 30 16:06:26 2013 -0600 add missing NDEBUG to CFLAGS tinyproxy.spec | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) --- diff --git a/tinyproxy.spec b/tinyproxy.spec index b388628..2e00ba3 100644 --- a/tinyproxy.spec +++ b/tinyproxy.spec @@ -9,7 +9,7 @@ Name: tinyproxy Version: 1.8.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A small, efficient HTTP/SSL proxy daemon Group: System Environment/Daemons @@ -39,7 +39,7 @@ resource intensive, or a security risk. --enable-reverse \ --enable-transparent -make LDFLAGS="%{?__global_ldflags}" CFLAGS="$RPM_OPT_FLAGS" %{?_smp_mflags} +make LDFLAGS="%{?__global_ldflags}" CFLAGS="-DNDEBUG $RPM_OPT_FLAGS" %{?_smp_mflags} %install @@ -94,6 +94,9 @@ fi %attr(-,%{tinyproxy_user},%{tinyproxy_group}) %dir %{tinyproxy_logdir} %changelog +* Mon Sep 30 2013 Jeremy Hinegardner <jeremy(a)hinegardner.org> - 1.8.3-2 +- fix missing NDEBUG flag (#1011783) + * Sun Sep 08 2013 Jeremy Hinegardner <jeremy(a)hinegardner.org> - 1.8.3-1 - update to upstream 1.8.3

1 0

File sudo-1.8.8.tar.gz uploaded to lookaside cache by mildew
by mildew＠fedoraproject.org 30 Sep '13

30 Sep '13

A file has been added to the lookaside cache for sudo: fc4f074090afd56d9ff4ff4e97321971 sudo-1.8.8.tar.gz

1 0

[eclipse-m2e-core/f20] (2 commits) ...Fix jar locations for f20+
by Gerard Ryan 30 Sep '13

30 Sep '13

Summary of changes: 23ed4c9... Add patch for maven 3.1.0 (*) 4aa8244... Fix jar locations for f20+ (*) (*) This commit already existed in another branch; no separate mail sent

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

scm-commits September 2013