CVS commit: pkgsrc/security/sudo

["Kimmo Suominen" <kim%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   kim
Date:           Sat Dec 28 20:43:56 UTC 2019

Modified Files:
        pkgsrc/security/sudo: Makefile distinfo
        pkgsrc/security/sudo/patches: patch-Makefile.in patch-configure
            patch-plugins_sudoers_Makefile.in patch-src_Makefile.in
Removed Files:
        pkgsrc/security/sudo/patches: patch-include_sudo__compat.h
            patch-include_sudo__event.h patch-lib_util_sig2str.c
            patch-lib_util_str2sig.c patch-plugins_sudoers_logging.c
            patch-plugins_sudoers_starttime.c patch-plugins_sudoers_sudoers.c
            patch-src_limits.c

Log Message:
Update to sudo 1.8.30beta3

* Portability fixes from pkgsrc have been merged upstream

* Add runas_check_shell flag to require a runas user to have a valid
  shell. Not enabled by default.

* Add a new flag "allow_unknown_runas_id" to control matching of unknown
  IDs. Previous, sudo would always allow unknown user or group IDs if
  the sudoers entry permitted it. This included the "ALL" alias. With
  this change, the admin must explicitly enable support for unknown IDs.

* Transparently handle the "sudo sudoedit" problem. Some admin are
  confused about how to give users sudoedit permission and many users
  try to run sudoedit via sudo instead of directly. If the user runs
  "sudo sudoedit" sudo will now treat it as plain "sudoedit" after
  issuing a warning. If the admin has specified a fully-qualified path
  for sudoedit in sudoers, sudo will treat it as just "sudoedit" and
  match accordingly. In visudo (but not sudo), a fully-qualified path
  for sudoedit is now treated as an error.

* When restoring old resource limits, try to recover if we receive
  EINVAL. On NetBSD, setrlimit(2) can return EINVAL if the new soft
  limit is lower than the current resource usage. This can be a problem
  when restoring the old stack limit if sudo has raised it.

* Restore resource limits before executing the askpass program. Linux
  with docker seems to have issues executing a program when the stack
  size is unlimited. Bug #908

* macOS does not allow rlim_cur to be set to RLIM_INFINITY for
  RLIMIT_NOFILE. We need to use OPEN_MAX instead as per the macOS
  setrlimit manual. Bug #904

* Use 64-bit resource limits on AIX.


To generate a diff of this commit:
cvs rdiff -u -r1.173 -r1.174 pkgsrc/security/sudo/Makefile
cvs rdiff -u -r1.106 -r1.107 pkgsrc/security/sudo/distinfo
cvs rdiff -u -r1.1 -r1.2 pkgsrc/security/sudo/patches/patch-Makefile.in \
    pkgsrc/security/sudo/patches/patch-configure
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/sudo/patches/patch-include_sudo__compat.h \
    pkgsrc/security/sudo/patches/patch-lib_util_sig2str.c \
    pkgsrc/security/sudo/patches/patch-plugins_sudoers_sudoers.c
cvs rdiff -u -r1.2 -r0 \
    pkgsrc/security/sudo/patches/patch-include_sudo__event.h \
    pkgsrc/security/sudo/patches/patch-lib_util_str2sig.c \
    pkgsrc/security/sudo/patches/patch-plugins_sudoers_logging.c \
    pkgsrc/security/sudo/patches/patch-plugins_sudoers_starttime.c \
    pkgsrc/security/sudo/patches/patch-src_limits.c
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/security/sudo/patches/patch-plugins_sudoers_Makefile.in
cvs rdiff -u -r1.3 -r1.4 pkgsrc/security/sudo/patches/patch-src_Makefile.in

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/sudo/Makefile
diff -u pkgsrc/security/sudo/Makefile:1.173 pkgsrc/security/sudo/Makefile:1.174
--- pkgsrc/security/sudo/Makefile:1.173 Thu Dec 19 16:59:44 2019
+++ pkgsrc/security/sudo/Makefile       Sat Dec 28 20:43:56 2019
@@ -1,9 +1,10 @@
-# $NetBSD: Makefile,v 1.173 2019/12/19 16:59:44 kim Exp $
+# $NetBSD: Makefile,v 1.174 2019/12/28 20:43:56 kim Exp $
 
-DISTNAME=      sudo-1.8.29
-PKGREVISION=   2
+DISTNAME=      sudo-1.8.30b3
+PKGNAME=       ${DISTNAME:S/b/beta/}
 CATEGORIES=    security
 MASTER_SITES=  https://www.sudo.ws/dist/
+MASTER_SITES=  https://www.sudo.ws/dist/beta/
 MASTER_SITES+= ftp://ftp.sudo.ws/pub/sudo/
 MASTER_SITES+= ftp://ftp.uwsg.indiana.edu/pub/security/sudo/
 MASTER_SITES+= ftp://ftp.twaren.net/Unix/Security/Sudo/

Index: pkgsrc/security/sudo/distinfo
diff -u pkgsrc/security/sudo/distinfo:1.106 pkgsrc/security/sudo/distinfo:1.107
--- pkgsrc/security/sudo/distinfo:1.106 Thu Dec 19 16:59:44 2019
+++ pkgsrc/security/sudo/distinfo       Sat Dec 28 20:43:56 2019
@@ -1,18 +1,10 @@
-$NetBSD: distinfo,v 1.106 2019/12/19 16:59:44 kim Exp $
+$NetBSD: distinfo,v 1.107 2019/12/28 20:43:56 kim Exp $
 
-SHA1 (sudo-1.8.29.tar.gz) = fdce342856f1803478eb549479190370001dca95
-RMD160 (sudo-1.8.29.tar.gz) = 706c7c8ec2a90b2e464e138384335b7de91d1c25
-SHA512 (sudo-1.8.29.tar.gz) = ea780922b2afb47df4df4b533fb355fd916cb18a6bfd13c7ca36a25b03ef585d805648c6fa85692bea363b1f83664ac3bc622f99bcd149b3a86f70522eb4d340
-Size (sudo-1.8.29.tar.gz) = 3338260 bytes
-SHA1 (patch-Makefile.in) = 279c7ad0f7f85ea7bc2d4beb5aa21abdf6237a7c
-SHA1 (patch-configure) = 460b9575346c263b944535aa8e2408e959840c77
-SHA1 (patch-include_sudo__compat.h) = 4f9b021ebdd507949f13e289deabdb6090ab334c
-SHA1 (patch-include_sudo__event.h) = 4d0787a45c2c7d4a7d3ae3111ccb3a4a4b84d083
-SHA1 (patch-lib_util_sig2str.c) = e5636d9e414fc9354cd238751fa4a00026320dd3
-SHA1 (patch-lib_util_str2sig.c) = e04aa67cab901e1be10d59bd1b0ee740aa1295b8
-SHA1 (patch-plugins_sudoers_Makefile.in) = 46bbee9c51664357099dc6d6871341de3e3fcc6f
-SHA1 (patch-plugins_sudoers_logging.c) = 700ac9540a82bea4f3106cea941b785e5bd31203
-SHA1 (patch-plugins_sudoers_starttime.c) = acec2f8a96041381582acff4928233568411f2c6
-SHA1 (patch-plugins_sudoers_sudoers.c) = b5aa8a91da50d4b12ea47cd92e29d25ea325b52c
-SHA1 (patch-src_Makefile.in) = cc6398a810dc394d8e4b50f2b2412cda839c0ca9
-SHA1 (patch-src_limits.c) = 790c64fed4a4f406ce07b3d0e806866095c0a5ca
+SHA1 (sudo-1.8.30b3.tar.gz) = 9e674a93413e1e7733b577ea5773a8aba758ae35
+RMD160 (sudo-1.8.30b3.tar.gz) = b9651a87d23fa64eebab9508ab876517ea24b615
+SHA512 (sudo-1.8.30b3.tar.gz) = c765f69d80207d70d0fd64382b33b08a08c59306e8930cd76eeaf907f22d55f6531e6bdf156514d07692bd700cbda6f1fe670c0dd0fa8b844e094f7561632547
+Size (sudo-1.8.30b3.tar.gz) = 3349576 bytes
+SHA1 (patch-Makefile.in) = e8813e1aa208d9ef6304038328504a5402341560
+SHA1 (patch-configure) = 906a90a8e8f5397693d9f410b7715439cf029508
+SHA1 (patch-plugins_sudoers_Makefile.in) = 730193c6437197a7114dd31886050cecdcba6772
+SHA1 (patch-src_Makefile.in) = 8959049bc428f592f84de1cad1a898c07c6e6b39

Index: pkgsrc/security/sudo/patches/patch-Makefile.in
diff -u pkgsrc/security/sudo/patches/patch-Makefile.in:1.1 pkgsrc/security/sudo/patches/patch-Makefile.in:1.2
--- pkgsrc/security/sudo/patches/patch-Makefile.in:1.1  Tue Aug 14 13:18:38 2018
+++ pkgsrc/security/sudo/patches/patch-Makefile.in      Sat Dec 28 20:43:56 2019
@@ -1,10 +1,10 @@
-$NetBSD: patch-Makefile.in,v 1.1 2018/08/14 13:18:38 adam Exp $
+$NetBSD: patch-Makefile.in,v 1.2 2019/12/28 20:43:56 kim Exp $
 
 Don't setuid here.
 
---- Makefile.in.orig   2015-10-31 23:35:07.000000000 +0000
-+++ Makefile.in
-@@ -63,7 +63,8 @@ SHELL = @SHELL@
+--- Makefile.in.orig   2019-10-28 15:51:30.000000000 +0200
++++ Makefile.in        2019-12-28 21:41:28.028886752 +0200
+@@ -64,7 +64,8 @@
  SED = @SED@
  
  INSTALL = $(SHELL) $(top_srcdir)/install-sh -c
@@ -14,7 +14,7 @@ Don't setuid here.
  
  ECHO_N = @ECHO_N@
  ECHO_C = @ECHO_C@
-@@ -129,7 +130,7 @@ install-doc: config.status ChangeLog
+@@ -165,7 +166,7 @@
            exit $$?; \
        done
  
Index: pkgsrc/security/sudo/patches/patch-configure
diff -u pkgsrc/security/sudo/patches/patch-configure:1.1 pkgsrc/security/sudo/patches/patch-configure:1.2
--- pkgsrc/security/sudo/patches/patch-configure:1.1    Tue Aug 14 13:18:38 2018
+++ pkgsrc/security/sudo/patches/patch-configure        Sat Dec 28 20:43:56 2019
@@ -1,4 +1,4 @@
-$NetBSD: patch-configure,v 1.1 2018/08/14 13:18:38 adam Exp $
+$NetBSD: patch-configure,v 1.2 2019/12/28 20:43:56 kim Exp $
 
 * Add "--with-nbsdops" option, NetBSD standard options.
 * Link with util(3) in the case of DragonFly, too.
@@ -7,9 +7,9 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
   functions (HAVE_KRB5_*).
 * Remove setting sysconfdir to "/etc".
 
---- configure.orig     2017-05-29 20:33:06.000000000 +0000
-+++ configure
-@@ -865,6 +865,7 @@ with_libpath
+--- configure.orig     2019-12-26 06:24:43.000000000 +0200
++++ configure  2019-12-28 21:41:28.049372280 +0200
+@@ -869,6 +869,7 @@
  with_libraries
  with_efence
  with_csops
@@ -17,7 +17,7 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
  with_passwd
  with_skey
  with_opie
-@@ -1571,7 +1572,7 @@ Fine tuning of the installation director
+@@ -1581,7 +1582,7 @@
    --bindir=DIR            user executables [EPREFIX/bin]
    --sbindir=DIR           system admin executables [EPREFIX/sbin]
    --libexecdir=DIR        program executables [EPREFIX/libexec]
@@ -26,7 +26,7 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
    --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
    --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
    --libdir=DIR            object code libraries [EPREFIX/lib]
-@@ -1674,6 +1675,7 @@ Optional Packages:
+@@ -1694,6 +1695,7 @@
    --with-libraries        additional libraries to link with
    --with-efence           link with -lefence for malloc() debugging
    --with-csops            add CSOps standard options
@@ -34,7 +34,7 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
    --without-passwd        don't use passwd/shadow file for authentication
    --with-skey[=DIR]       enable S/Key support
    --with-opie[=DIR]       enable OPIE support
-@@ -4746,6 +4748,23 @@ fi
+@@ -4797,6 +4799,23 @@
  
  
  
@@ -58,7 +58,7 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
  # Check whether --with-passwd was given.
  if test "${with_passwd+set}" = set; then :
    withval=$with_passwd; case $with_passwd in
-@@ -15770,7 +15789,7 @@ fi
+@@ -15925,7 +15944,7 @@
                : ${mansectsu='1m'}
                : ${mansectform='4'}
                ;;
@@ -67,7 +67,7 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
                shadow_funcs="getspnam"
                test -z "$with_pam" && AUTH_EXCL_DEF="PAM"
                # Check for SECCOMP_SET_MODE_FILTER in linux/seccomp.h
-@@ -17995,7 +18014,7 @@ if test "x$ac_cv_header_login_cap_h" = x
+@@ -18163,7 +18182,7 @@
  _ACEOF
   LOGINCAP_USAGE='[-c class] '; LCMAN=1
        case "$OS" in
@@ -76,7 +76,7 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
                SUDO_LIBS="${SUDO_LIBS} -lutil"
                SUDOERS_LIBS="${SUDOERS_LIBS} -lutil"
                ;;
-@@ -22483,10 +22502,9 @@ if test ${with_pam-"no"} != "no"; then
+@@ -22993,10 +23012,9 @@
      # Check for pam_start() in libpam first, then for pam_appl.h.
      #
      found_pam_lib=no
@@ -89,7 +89,7 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
    $as_echo_n "(cached) " >&6
  else
    ac_check_lib_save_LIBS=$LIBS
-@@ -22510,18 +22528,17 @@ return pam_start ();
+@@ -23020,18 +23038,17 @@
  }
  _ACEOF
  if ac_fn_c_try_link "$LINENO"; then :
@@ -113,7 +113,7 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
    found_pam_lib=yes
  fi
  
-@@ -23256,6 +23273,8 @@ fi
+@@ -23766,6 +23783,8 @@
  rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
        AUTH_OBJS="$AUTH_OBJS kerb5.lo"
      fi
@@ -122,7 +122,7 @@ $NetBSD: patch-configure,v 1.1 2018/08/1
      _LIBS="$LIBS"
      LIBS="${LIBS} ${SUDOERS_LIBS}"
      for ac_func in krb5_verify_user krb5_init_secure_context
-@@ -26426,7 +26445,6 @@ test "$datarootdir" = '${prefix}/share' 
+@@ -27026,7 +27045,6 @@
  test "$docdir" = '${datarootdir}/doc/${PACKAGE_TARNAME}' && docdir='$(datarootdir)/doc/$(PACKAGE_TARNAME)'
  test "$localedir" = '${datarootdir}/locale' && localedir='$(datarootdir)/locale'
  test "$localstatedir" = '${prefix}/var' && localstatedir='$(prefix)/var'

Index: pkgsrc/security/sudo/patches/patch-plugins_sudoers_Makefile.in
diff -u pkgsrc/security/sudo/patches/patch-plugins_sudoers_Makefile.in:1.2 pkgsrc/security/sudo/patches/patch-plugins_sudoers_Makefile.in:1.3
--- pkgsrc/security/sudo/patches/patch-plugins_sudoers_Makefile.in:1.2  Sun Dec 15 18:42:10 2019
+++ pkgsrc/security/sudo/patches/patch-plugins_sudoers_Makefile.in      Sat Dec 28 20:43:56 2019
@@ -1,11 +1,11 @@
-$NetBSD: patch-plugins_sudoers_Makefile.in,v 1.2 2019/12/15 18:42:10 adam Exp $
+$NetBSD: patch-plugins_sudoers_Makefile.in,v 1.3 2019/12/28 20:43:56 kim Exp $
 
 Do not install the sudoers file to etc.
 
---- plugins/sudoers/Makefile.in.orig   2019-10-28 12:28:53.000000000 +0000
-+++ plugins/sudoers/Makefile.in
-@@ -394,7 +394,7 @@ pre-install:
-           ./visudo -c -f $(sudoersdir)/sudoers; \
+--- plugins/sudoers/Makefile.in.orig   2019-12-25 21:21:05.000000000 +0200
++++ plugins/sudoers/Makefile.in        2019-12-28 22:01:00.540953438 +0200
+@@ -396,7 +396,7 @@
+           fi; \
        fi
  
 -install: install-plugin install-binaries install-sudoers install-doc

Index: pkgsrc/security/sudo/patches/patch-src_Makefile.in
diff -u pkgsrc/security/sudo/patches/patch-src_Makefile.in:1.3 pkgsrc/security/sudo/patches/patch-src_Makefile.in:1.4
--- pkgsrc/security/sudo/patches/patch-src_Makefile.in:1.3      Wed Mar  7 09:17:06 2018
+++ pkgsrc/security/sudo/patches/patch-src_Makefile.in  Sat Dec 28 20:43:56 2019
@@ -1,10 +1,10 @@
-$NetBSD: patch-src_Makefile.in,v 1.3 2018/03/07 09:17:06 adam Exp $
+$NetBSD: patch-src_Makefile.in,v 1.4 2019/12/28 20:43:56 kim Exp $
 
 * install the suid sudo without write-bits
 
---- src/Makefile.in.orig       2015-10-31 23:35:25.000000000 +0000
-+++ src/Makefile.in
-@@ -198,7 +198,7 @@ install-rc: install-dirs
+--- src/Makefile.in.orig       2019-12-10 15:11:46.000000000 +0200
++++ src/Makefile.in    2019-12-28 21:51:27.794734242 +0200
+@@ -219,7 +219,7 @@
        fi
  
  install-binaries: install-dirs $(PROGS)