From 3bdf1eeb324f5db9612482dbc8af793a4f28a0d1 Mon Sep 17 00:00:00 2001 From: Diego Elio Pettenò Date: Wed, 30 Jun 2010 23:23:21 +0000 Subject: Version bump to 1.7.3 final. Package-Manager: portage-2.2_rc67/cvs/Linux x86_64 --- app-admin/sudo/ChangeLog | 8 +- app-admin/sudo/Manifest | 12 +- app-admin/sudo/sudo-1.7.3.ebuild | 224 +++++++++++++++++++++++++++++++++++ app-admin/sudo/sudo-1.7.3_rc1.ebuild | 224 ----------------------------------- 4 files changed, 237 insertions(+), 231 deletions(-) create mode 100644 app-admin/sudo/sudo-1.7.3.ebuild delete mode 100644 app-admin/sudo/sudo-1.7.3_rc1.ebuild (limited to 'app-admin/sudo') diff --git a/app-admin/sudo/ChangeLog b/app-admin/sudo/ChangeLog index e9a6ce57f95d..bb4ebef94ca0 100644 --- a/app-admin/sudo/ChangeLog +++ b/app-admin/sudo/ChangeLog @@ -1,6 +1,12 @@ # ChangeLog for app-admin/sudo # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.231 2010/06/29 11:29:21 flameeyes Exp $ +# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.232 2010/06/30 23:23:21 flameeyes Exp $ + +*sudo-1.7.3 (30 Jun 2010) + + 30 Jun 2010; Diego E. Pettenò + -sudo-1.7.3_rc1.ebuild, +sudo-1.7.3.ebuild: + Version bump to 1.7.3 final. *sudo-1.7.3_rc1 (29 Jun 2010) diff --git a/app-admin/sudo/Manifest b/app-admin/sudo/Manifest index 749f48f54ee4..68aa3e5c0009 100644 --- a/app-admin/sudo/Manifest +++ b/app-admin/sudo/Manifest @@ -3,15 +3,15 @@ Hash: SHA1 AUX sudo-skeychallengeargs.diff 567 RMD160 906ee43a7c2f21d1cf5130eac5c98ef0833154fd SHA1 b0efbedc72a1ed85c74ba10e343a68368e76c3e9 SHA256 dd2f4fdba26be6c3b4af15f3b6e18efa19375e1f9c579cdc2c76ee1adcce5e1d DIST sudo-1.7.2p7.tar.gz 772356 RMD160 7ed1976bbce6d66939b85ce08a97c089dbeb1ec4 SHA1 0504e0d7b1d3c987e48325ec4caa6ebfe5237ff5 SHA256 07a9c83e628a088314523e558236ac3c4cb0d54d7d7093e5b3e4c8101b1a2bea -DIST sudo-1.7.3rc1.tar.gz 895941 RMD160 7c9e8e0c9996fef50e8db95b343026de3496aab4 SHA1 eb919087d8387da723613db74af0ba7e9117880c SHA256 154c4e4fbef7caeaa506e90914ceea57f6edf534bab62d36c277be213b0ef6f2 +DIST sudo-1.7.3.tar.gz 896160 RMD160 133011c6318268bd61a85a1a48fa94a7bbfd92cd SHA1 7d237f843acbc6b7f3b587b52ccbeb6e824d2375 SHA256 d1aeb6bb8770c4239cfb33ff6e5e6b7c3c026f245b546f2eda147da2f742d0ba EBUILD sudo-1.7.2_p7.ebuild 6873 RMD160 65f3b568b6cd9ffcb6416aa49fb077fe89b225ef SHA1 a462e80abcfd833862f491d06a9270869a77b003 SHA256 b217c506a2cd211f3da4dc325d31af247c1b8f76a2332f44a08d48c4791a8a57 -EBUILD sudo-1.7.3_rc1.ebuild 7002 RMD160 f1f432d9c29af470827e667d2fe163e3910dd3b4 SHA1 611d03b6d8f7d2dd72f87efb185860b28e392adf SHA256 f3616efd3da638cbf85495c8e8572215187484979e8b7a0a5662080100aab634 -MISC ChangeLog 32481 RMD160 9c87ea840a9e03fdb8c96da9e3075bc34b0a49fc SHA1 615ba802e019a1c5f82ad5f0d353c62c2aa2db06 SHA256 f634b6540f33eb41705b3e2a469bddbfdcbba6bd9b4710a6691e69896e1e23c1 +EBUILD sudo-1.7.3.ebuild 6998 RMD160 9bbe9ec9d5ac6686be76c6c87c83ad7e69426d0a SHA1 3ad82bc17350988e2941106461c3f4431203a477 SHA256 c680fdbdaccba9e3c46f0b037a2a04cbb853ecc7f1a3b57d7e765b084e042495 +MISC ChangeLog 32642 RMD160 ec0f34066f574ca33ca4a2dfa6abbd143ec22fe3 SHA1 b461c2912f2da860e4d3fcbaba17f2672ec959f6 SHA256 23932351b06da6b65bd555fd935520d6928f0c14223980db0b2d8ccd5a31de90 MISC metadata.xml 434 RMD160 a713e5ffdcc2216a46f5023ab77c6e3aeed0d183 SHA1 49a31df517e1ec39344ac83c13e9fca87379d261 SHA256 87e2d9f4535e80f4ba1f73366040bb23cfb4b1f3101c0e33df73aff2e77fc13f -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.15 (GNU/Linux) -iEYEARECAAYFAkwp2SIACgkQAiZjviIA2XiPOQCfSOs2zNlGjvwvftkC08XGPWqI -gLgAn0R/KlWDsnirKN09wCkihzewFqII -=ts/4 +iEYEARECAAYFAkwr0f4ACgkQAiZjviIA2XiD/gCfRM3pZ2BfW8fkrK1BpGaYXx81 +U1IAoNpTcrncuj4AgzM3KR5GyzENoM42 +=gxY/ -----END PGP SIGNATURE----- diff --git a/app-admin/sudo/sudo-1.7.3.ebuild b/app-admin/sudo/sudo-1.7.3.ebuild new file mode 100644 index 000000000000..fd92cfae1b77 --- /dev/null +++ b/app-admin/sudo/sudo-1.7.3.ebuild @@ -0,0 +1,224 @@ +# Copyright 1999-2010 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.7.3.ebuild,v 1.1 2010/06/30 23:23:21 flameeyes Exp $ + +inherit eutils pam confutils + +MY_P=${P/_/} +MY_P=${MY_P/beta/b} + +case "${P}" in + *_beta* | *_rc*) + uri_prefix=beta/ + ;; + *) + uri_prefix="" + ;; +esac + +DESCRIPTION="Allows users or groups to run commands as other users" +HOMEPAGE="http://www.sudo.ws/" +SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz" +# Basic license is ISC-style as-is, some files are released under +# 3-clause BSD license +LICENSE="as-is BSD" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~sparc-fbsd ~x86-fbsd" +IUSE="pam skey offensive ldap selinux" + +DEPEND="pam? ( virtual/pam ) + ldap? ( + >=net-nds/openldap-2.1.30-r1 + dev-libs/cyrus-sasl + ) + skey? ( >=sys-auth/skey-1.1.5-r1 ) + app-editors/gentoo-editor + virtual/editor + virtual/mta" +RDEPEND="selinux? ( sec-policy/selinux-sudo ) + ldap? ( dev-lang/perl ) + pam? ( sys-auth/pambase ) + ${DEPEND}" +DEPEND="${DEPEND} sys-devel/bison" + +S=${WORKDIR}/${MY_P} + +pkg_setup() { + confutils_use_conflict skey pam +} + +src_unpack() { + unpack ${A}; cd "${S}" + + # compatability fix. + epatch "${FILESDIR}"/${PN}-skeychallengeargs.diff + + # additional variables to disallow, should user disable env_reset. + + # NOTE: this is not a supported mode of operation, these variables + # are added to the blacklist as a convenience to administrators + # who fail to heed the warnings of allowing untrusted users + # to access sudo. + # + # there is *no possible way* to foresee all attack vectors in + # all possible applications that could potentially be used via + # sudo, these settings will just delay the inevitable. + # + # that said, I will accept suggestions for variables that can + # be misused in _common_ interpreters or libraries, such as + # perl, bash, python, ruby, etc., in the hope of dissuading + # a casual attacker. + + # XXX: perl should be using suid_perl. + # XXX: users can remove/add more via env_delete and env_check. + # XXX: = probably safe enough for most circumstances. + + einfo "Blacklisting common variables (env_delete)..." + sudo_bad_var() { + local target='env.c' marker='\*initial_badenv_table\[\]' + + ebegin " $1" + sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' "${S}"/${target} + eend $? + } + + sudo_bad_var 'PERLIO_DEBUG' # perl, write debug to file. + sudo_bad_var 'FPATH' # ksh, search path for functions. + sudo_bad_var 'NULLCMD' # zsh, command on null-redir. + sudo_bad_var 'READNULLCMD' # zsh, command on null-redir. + sudo_bad_var 'GLOBIGNORE' # bash, glob paterns to ignore. + sudo_bad_var 'PYTHONHOME' # python, module search path. + sudo_bad_var 'PYTHONPATH' # python, search path. + sudo_bad_var 'PYTHONINSPECT' # python, allow inspection. + sudo_bad_var 'RUBYLIB' # ruby, lib load path. + sudo_bad_var 'RUBYOPT' # ruby, cl options. + sudo_bad_var 'ZDOTDIR' # zsh, path to search for dotfiles. + einfo "...done." + + # prevent binaries from being stripped. + sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in +} + +src_compile() { + local line ROOTPATH + + # FIXME: secure_path is a compile time setting. using ROOTPATH + # is not perfect, env-update may invalidate this, but until it + # is available as a sudoers setting this will have to do. + einfo "Setting secure_path..." + + # why not use grep? variable might be expanded from other variables + # declared in that file. cannot just source the file, would override + # any variables already set. + eval `PS4= bash -x /etc/profile.env 2>&1 | \ + while read line; do + case $line in + ROOTPATH=*) echo $line; break;; + *) continue;; + esac + done` && einfo " Found ROOTPATH..." || \ + ewarn " Failed to find ROOTPATH, please report this." + + # remove duplicate path entries from $1 + cleanpath() { + local i=1 x n IFS=: + local -a paths; paths=($1) + + for ((n=${#paths[*]}-1;i<=n;i++)); do + for ((x=0;x&2 + unset paths[i]; continue 2; } + done; # einfo " Adding ${paths[i]}..." 1>&2 + done; echo "${paths[*]}" + } + + ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}) + + # strip gcc path (bug #136027) + rmpath() { + declare e newpath oldpath=${!1} PATHvar=$1 thisp IFS=: + shift + for thisp in $oldpath; do + for e; do [[ $thisp == $e ]] && continue 2; done + newpath=$newpath:$thisp + done + eval $PATHvar='${newpath#:}' + } + + rmpath ROOTPATH '*/gcc-bin/*' + + einfo "...done." + + # XXX: --disable-path-info closes an info leak, but may be confusing. + # audit: somebody got to explain me how I can test this before I + # enable it.. — Diego + econf --with-secure-path="${ROOTPATH}" \ + --with-editor=/usr/libexec/gentoo-editor \ + --with-env-editor \ + $(use_with offensive insults) \ + $(use_with offensive all-insults) \ + $(use_with pam) \ + $(use_with skey) \ + $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \ + $(use_with ldap) \ + --without-linux-audit + + emake || die +} + +src_install() { + emake DESTDIR="${D}" install || die + dodoc ChangeLog HISTORY PORTING README TROUBLESHOOTING \ + UPGRADE WHATSNEW sample.sudoers sample.syslog.conf + + if use ldap; then + dodoc README.LDAP schema.OpenLDAP + dosbin sudoers2ldif + + cat - > "${T}"/ldap.conf.sudo < = probably safe enough for most circumstances. - - einfo "Blacklisting common variables (env_delete)..." - sudo_bad_var() { - local target='env.c' marker='\*initial_badenv_table\[\]' - - ebegin " $1" - sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' "${S}"/${target} - eend $? - } - - sudo_bad_var 'PERLIO_DEBUG' # perl, write debug to file. - sudo_bad_var 'FPATH' # ksh, search path for functions. - sudo_bad_var 'NULLCMD' # zsh, command on null-redir. - sudo_bad_var 'READNULLCMD' # zsh, command on null-redir. - sudo_bad_var 'GLOBIGNORE' # bash, glob paterns to ignore. - sudo_bad_var 'PYTHONHOME' # python, module search path. - sudo_bad_var 'PYTHONPATH' # python, search path. - sudo_bad_var 'PYTHONINSPECT' # python, allow inspection. - sudo_bad_var 'RUBYLIB' # ruby, lib load path. - sudo_bad_var 'RUBYOPT' # ruby, cl options. - sudo_bad_var 'ZDOTDIR' # zsh, path to search for dotfiles. - einfo "...done." - - # prevent binaries from being stripped. - sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in -} - -src_compile() { - local line ROOTPATH - - # FIXME: secure_path is a compile time setting. using ROOTPATH - # is not perfect, env-update may invalidate this, but until it - # is available as a sudoers setting this will have to do. - einfo "Setting secure_path..." - - # why not use grep? variable might be expanded from other variables - # declared in that file. cannot just source the file, would override - # any variables already set. - eval `PS4= bash -x /etc/profile.env 2>&1 | \ - while read line; do - case $line in - ROOTPATH=*) echo $line; break;; - *) continue;; - esac - done` && einfo " Found ROOTPATH..." || \ - ewarn " Failed to find ROOTPATH, please report this." - - # remove duplicate path entries from $1 - cleanpath() { - local i=1 x n IFS=: - local -a paths; paths=($1) - - for ((n=${#paths[*]}-1;i<=n;i++)); do - for ((x=0;x&2 - unset paths[i]; continue 2; } - done; # einfo " Adding ${paths[i]}..." 1>&2 - done; echo "${paths[*]}" - } - - ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}) - - # strip gcc path (bug #136027) - rmpath() { - declare e newpath oldpath=${!1} PATHvar=$1 thisp IFS=: - shift - for thisp in $oldpath; do - for e; do [[ $thisp == $e ]] && continue 2; done - newpath=$newpath:$thisp - done - eval $PATHvar='${newpath#:}' - } - - rmpath ROOTPATH '*/gcc-bin/*' - - einfo "...done." - - # XXX: --disable-path-info closes an info leak, but may be confusing. - # audit: somebody got to explain me how I can test this before I - # enable it.. — Diego - econf --with-secure-path="${ROOTPATH}" \ - --with-editor=/usr/libexec/gentoo-editor \ - --with-env-editor \ - $(use_with offensive insults) \ - $(use_with offensive all-insults) \ - $(use_with pam) \ - $(use_with skey) \ - $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \ - $(use_with ldap) \ - --without-linux-audit - - emake || die -} - -src_install() { - emake DESTDIR="${D}" install || die - dodoc ChangeLog HISTORY PORTING README TROUBLESHOOTING \ - UPGRADE WHATSNEW sample.sudoers sample.syslog.conf - - if use ldap; then - dodoc README.LDAP schema.OpenLDAP - dosbin sudoers2ldif - - cat - > "${T}"/ldap.conf.sudo <