pkgsrc-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[pkgsrc/trunk]: pkgsrc/security/sudo security/sudo: update to 1.9.5p1



details:   https://anonhg.NetBSD.org/pkgsrc/rev/9350832cbe45
branches:  trunk
changeset: 445220:9350832cbe45
user:      taca <taca%pkgsrc.org@localhost>
date:      Mon Jan 18 14:32:23 2021 +0000

description:
security/sudo: update to 1.9.5p1

Update sudo package to 1.9.5p1.  CHanges from 1.8.31p2 are too many to
write here.  Please refer <https://www.sudo.ws/stable.html>.

1.9.5 fixes these security problems:

* Fixed CVE-2021-23239, a potential information leak in sudoedit that
  could be used to test for the existence of directories not normally
  accessible to the user in certain circumstances.  When creating a new
  file, sudoedit checks to make sure the parent directory of the new file
  exists before running the editor.  However, a race condition exists if
  the invoking user can replace (or create) the parent directory. If a
  symbolic link is created in place of the parent directory, sudoedit will
  run the editor as long as the target of the link exists.  If the target
  of the link does not exist, an error message will be displayed.  The
  race condition can be used to test for the existence of an arbitrary
  directory.  However, it cannot be used to write to an arbitrary
  location.

* Fixed CVE-2021-23240, a flaw in the temporary file handling of
  sudoedit's SELinux RBAC support.  On systems where SELinux is enabled, a
  user with sudoedit permissions may be able to set the owner of an
  arbitrary file to the user-ID of the target user.  On Linux kernels that
  support protected symlinks setting /proc/sys/fs/protected_symlinks to 1
  will prevent the bug from being exploited.  For more information, see
  Symbolic link attack in SELinux-enabled sudoedit.

Quote from 1.9.0 features:

* The maximum length of a conversation reply has been increased from 255
  to 1023 characters.  This allows for longer user passwords. Bug #860.

* Sudo now includes a logging daemon, sudo_logsrvd, which can be used to
  implement centralized logging of I/O logs.  TLS connections are
  supported when sudo is configured with the --enable-openssl option.  For
  more information, see the sudo_logsrvd, sudo_logsrvd.conf and
  sudo_logsrv.proto manuals as well as the log_servers setting in the
  sudoers manual.

* The --disable-log-server and --disable-log-client configure options can
  be used to disable building the I/O log server and/or remote I/O log
  support in the sudoers plugin.

* The new sudo_sendlog utility can be used to test sudo_logsrvd or send
  existing sudo I/O logs to a centralized server.

* It is now possible to write sudo plugins in Python 4 when sudo is
  configured with the --enable-python option.  See the sudo_plugin_python
  manual for details.

  Sudo 1.9.0 comes with several Python example plugins that get installed
  sudo's examples directory.

  The sudo blog article What's new in sudo 1.9: Python includes a simple
  tutorial on writing python plugins.

* Sudo now supports an audit plugin type.  An audit plugin receives
  accept, reject, exit and error messages and can be used to implement
  custom logging that is independent of the underlying security policy.
  Multiple audit plugins may be specified in the sudo.conf file.  A sample
  audit plugin is included that writes logs in JSON format.

* Sudo now supports an approval plugin type.  An approval plugin is run
  only after the main security policy (such as sudoers) accepts a command
  to be run.  The approval policy may perform additional checks,
  potentially interacting with the user.  Multiple approval plugins may be
  specified in the sudo.conf file.  Only if all approval plugins succeed
  will the command be allowed.

* Sudo's -S command line option now causes the sudo conversation function
  to write to the standard output or standard error instead of the
  terminal device.

diffstat:

 security/sudo/Makefile                                  |  11 ++++-
 security/sudo/PLIST                                     |  13 +++++++-
 security/sudo/distinfo                                  |  16 +++++----
 security/sudo/patches/patch-configure                   |  28 ++++++++--------
 security/sudo/patches/patch-examples_Makefile.in        |  18 ++++++++++
 security/sudo/patches/patch-logsrvd_Makefile.in         |  15 +++++++++
 security/sudo/patches/patch-plugins_sudoers_Makefile.in |  28 +++++++++++++---
 7 files changed, 98 insertions(+), 31 deletions(-)

diffs (293 lines):

diff -r 594906486f9e -r 9350832cbe45 security/sudo/Makefile
--- a/security/sudo/Makefile    Mon Jan 18 13:44:42 2021 +0000
+++ b/security/sudo/Makefile    Mon Jan 18 14:32:23 2021 +0000
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.180 2020/09/19 14:04:29 taca Exp $
+# $NetBSD: Makefile,v 1.181 2021/01/18 14:32:23 taca Exp $
 
-DISTNAME=      sudo-1.8.31p2
+DISTNAME=      sudo-1.9.5p1
 CATEGORIES=    security
 MASTER_SITES=  https://www.sudo.ws/dist/
 MASTER_SITES+= ftp://ftp.sudo.ws/pub/sudo/
@@ -54,7 +54,12 @@
 
 DOCDIR=                        share/doc/${PKGBASE}
 EGDIR=                 share/examples/${PKGBASE}
-CONF_FILES_PERMS=      ${EGDIR}/sudoers ${PKG_SYSCONFDIR}/sudoers \
+CONF_FILES_PERMS=      ${EGDIR}/sudo.conf ${PKG_SYSCONFDIR}/sudo.conf \
+                       ${REAL_ROOT_USER} ${REAL_ROOT_GROUP} 0440
+CONF_FILES_PERMS+=     ${EGDIR}/sudo_logsrvd.conf \
+                       ${PKG_SYSCONFDIR}/sudo_logsrvd.conf \
+                       ${REAL_ROOT_USER} ${REAL_ROOT_GROUP} 0440
+CONF_FILES_PERMS+=     ${EGDIR}/sudoers ${PKG_SYSCONFDIR}/sudoers \
                        ${REAL_ROOT_USER} ${REAL_ROOT_GROUP} 0440
 OWN_DIRS+=             ${PKG_SYSCONFDIR}/sudoers.d
 SPECIAL_PERMS+=                bin/sudo ${SETUID_ROOT_PERMS}
diff -r 594906486f9e -r 9350832cbe45 security/sudo/PLIST
--- a/security/sudo/PLIST       Mon Jan 18 13:44:42 2021 +0000
+++ b/security/sudo/PLIST       Mon Jan 18 14:32:23 2021 +0000
@@ -1,24 +1,32 @@
-@comment $NetBSD: PLIST,v 1.18 2019/10/31 14:43:13 triaxx Exp $
+@comment $NetBSD: PLIST,v 1.19 2021/01/18 14:32:23 taca Exp $
 bin/cvtsudoers
 bin/sudo
 bin/sudoedit
 bin/sudoreplay
 include/sudo_plugin.h
+lib/sudo/audit_json.la
 lib/sudo/group_file.la
 lib/sudo/libsudo_util.la
+lib/sudo/sample_approval.la
 ${PLIST.noexec}lib/sudo/sudo_noexec.la
 lib/sudo/sudoers.la
 lib/sudo/system_group.la
 man/man1/cvtsudoers.1
 man/man5/sudo.conf.5
+man/man5/sudo_logsrv.proto.5
+man/man5/sudo_logsrvd.conf.5
 man/man5/sudoers.5
 ${PLIST.ldap}man/man5/sudoers.ldap.5
 man/man5/sudoers_timestamp.5
 man/man8/sudo.8
+man/man8/sudo_logsrvd.8
 man/man8/sudo_plugin.8
+man/man8/sudo_sendlog.8
 man/man8/sudoedit.8
 man/man8/sudoreplay.8
 man/man8/visudo.8
+sbin/sudo_logsrvd
+sbin/sudo_sendlog
 sbin/visudo
 share/doc/sudo/CONTRIBUTORS
 share/doc/sudo/ChangeLog
@@ -35,6 +43,7 @@
 ${PLIST.ldap}share/doc/sudo/schema.olcSudo
 share/examples/sudo/pam.conf
 share/examples/sudo/sudo.conf
+share/examples/sudo/sudo_logsrvd.conf
 share/examples/sudo/sudoers
 share/examples/sudo/syslog.conf
 ${PLIST.nls}share/locale/ast/LC_MESSAGES/sudo.mo
@@ -82,6 +91,8 @@
 ${PLIST.nls}share/locale/pt/LC_MESSAGES/sudoers.mo
 ${PLIST.nls}share/locale/pt_BR/LC_MESSAGES/sudo.mo
 ${PLIST.nls}share/locale/pt_BR/LC_MESSAGES/sudoers.mo
+${PLIST.nls}share/locale/ro/LC_MESSAGES/sudo.mo
+${PLIST.nls}share/locale/ro/LC_MESSAGES/sudoers.mo
 ${PLIST.nls}share/locale/ru/LC_MESSAGES/sudo.mo
 ${PLIST.nls}share/locale/ru/LC_MESSAGES/sudoers.mo
 ${PLIST.nls}share/locale/sk/LC_MESSAGES/sudo.mo
diff -r 594906486f9e -r 9350832cbe45 security/sudo/distinfo
--- a/security/sudo/distinfo    Mon Jan 18 13:44:42 2021 +0000
+++ b/security/sudo/distinfo    Mon Jan 18 14:32:23 2021 +0000
@@ -1,10 +1,12 @@
-$NetBSD: distinfo,v 1.111 2020/09/19 14:04:29 taca Exp $
+$NetBSD: distinfo,v 1.112 2021/01/18 14:32:23 taca Exp $
 
-SHA1 (sudo-1.8.31p2.tar.gz) = 53a6dfa90f78bc10615b83b7026bf3ba206c69e9
-RMD160 (sudo-1.8.31p2.tar.gz) = 5ffd8e785095c19c26ad8e3b3d5768669951f777
-SHA512 (sudo-1.8.31p2.tar.gz) = ad1bbbde74d3ab6e947071c6f21e436ebabcf5af11ecc75cde8f0c01ca0b8c6ae1cce2ff42f21612816c636e96722a2a14daa57757644ceab6577091f82242be
-Size (sudo-1.8.31p2.tar.gz) = 3353538 bytes
+SHA1 (sudo-1.9.5p1.tar.gz) = 0a6b9b18518c8f7c37bd09573b9b711174cdf3b9
+RMD160 (sudo-1.9.5p1.tar.gz) = 4fdcb72761b7d3a7de6c98c11c5efc976a6b11e5
+SHA512 (sudo-1.9.5p1.tar.gz) = 0168f0b61a6c2d2f60a92b5b4d3c3254aed4116decabac3821d9ac2fd7f74bb7b019e35bb8955335315b3b00ddf4e4acd82540df0addc1d9bf4f44b60447a878
+Size (sudo-1.9.5p1.tar.gz) = 4008926 bytes
 SHA1 (patch-Makefile.in) = e8813e1aa208d9ef6304038328504a5402341560
-SHA1 (patch-configure) = 498b1040fceb317c239d050b59b3d1a180598441
-SHA1 (patch-plugins_sudoers_Makefile.in) = 730193c6437197a7114dd31886050cecdcba6772
+SHA1 (patch-configure) = 4db043c7384cdeb4701ccd2f455dfad2dc17c663
+SHA1 (patch-examples_Makefile.in) = a20967ecd88eb5e4a8b47e6a3b80bc18be713409
+SHA1 (patch-logsrvd_Makefile.in) = c460b868e09560a80f632d1332fc7d7c3d1822cf
+SHA1 (patch-plugins_sudoers_Makefile.in) = efc0fb726c23dcb2d6a006524fd561800d6d7924
 SHA1 (patch-src_Makefile.in) = 8959049bc428f592f84de1cad1a898c07c6e6b39
diff -r 594906486f9e -r 9350832cbe45 security/sudo/patches/patch-configure
--- a/security/sudo/patches/patch-configure     Mon Jan 18 13:44:42 2021 +0000
+++ b/security/sudo/patches/patch-configure     Mon Jan 18 14:32:23 2021 +0000
@@ -1,4 +1,4 @@
-$NetBSD: patch-configure,v 1.3 2020/09/19 14:04:29 taca Exp $
+$NetBSD: patch-configure,v 1.4 2021/01/18 14:32:24 taca Exp $
 
 * Add "--with-nbsdops" option, NetBSD standard options.
 * Link with util(3) in the case of DragonFly, too.
@@ -7,9 +7,9 @@
   functions (HAVE_KRB5_*).
 * Remove setting sysconfdir to "/etc".
 
---- configure.orig     2020-06-12 13:15:11.000000000 +0000
+--- configure.orig     2021-01-09 20:12:16.000000000 +0000
 +++ configure
-@@ -870,6 +870,7 @@ with_libpath
+@@ -892,6 +892,7 @@ with_libpath
  with_libraries
  with_efence
  with_csops
@@ -17,7 +17,7 @@
  with_passwd
  with_skey
  with_opie
-@@ -1592,7 +1593,7 @@ Fine tuning of the installation director
+@@ -1621,7 +1622,7 @@ Fine tuning of the installation director
    --bindir=DIR            user executables [EPREFIX/bin]
    --sbindir=DIR           system admin executables [EPREFIX/sbin]
    --libexecdir=DIR        program executables [EPREFIX/libexec]
@@ -26,7 +26,7 @@
    --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
    --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
    --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
-@@ -1706,6 +1707,7 @@ Optional Packages:
+@@ -1737,6 +1738,7 @@ Optional Packages:
    --with-libraries        additional libraries to link with
    --with-efence           link with -lefence for malloc() debugging
    --with-csops            add CSOps standard options
@@ -34,7 +34,7 @@
    --without-passwd        don't use passwd/shadow file for authentication
    --with-skey[=DIR]       enable S/Key support
    --with-opie[=DIR]       enable OPIE support
-@@ -4809,6 +4811,23 @@ fi
+@@ -4863,6 +4865,23 @@ fi
  
  
  
@@ -58,7 +58,7 @@
  # Check whether --with-passwd was given.
  if test "${with_passwd+set}" = set; then :
    withval=$with_passwd; case $with_passwd in
-@@ -15937,7 +15956,7 @@ fi
+@@ -15765,7 +15784,7 @@ fi
                : ${mansectsu='1m'}
                : ${mansectform='4'}
                ;;
@@ -67,7 +67,7 @@
                shadow_funcs="getspnam"
                test -z "$with_pam" && AUTH_EXCL_DEF="PAM"
                # Check for SECCOMP_SET_MODE_FILTER in linux/seccomp.h
-@@ -18175,7 +18194,7 @@ if test "x$ac_cv_header_login_cap_h" = x
+@@ -18026,7 +18045,7 @@ if test "x$ac_cv_header_login_cap_h" = x
  _ACEOF
   LOGINCAP_USAGE='[-c class] '; LCMAN=1
        case "$OS" in
@@ -76,7 +76,7 @@
                SUDO_LIBS="${SUDO_LIBS} -lutil"
                SUDOERS_LIBS="${SUDOERS_LIBS} -lutil"
                ;;
-@@ -23018,10 +23037,9 @@ if test ${with_pam-"no"} != "no"; then
+@@ -23965,10 +23984,9 @@ if test ${with_pam-"no"} != "no"; then
      # Check for pam_start() in libpam first, then for pam_appl.h.
      #
      found_pam_lib=no
@@ -89,7 +89,7 @@
    $as_echo_n "(cached) " >&6
  else
    ac_check_lib_save_LIBS=$LIBS
-@@ -23045,18 +23063,17 @@ return pam_start ();
+@@ -23992,18 +24010,17 @@ return pam_start ();
  }
  _ACEOF
  if ac_fn_c_try_link "$LINENO"; then :
@@ -113,7 +113,7 @@
    found_pam_lib=yes
  fi
  
-@@ -23791,6 +23808,8 @@ fi
+@@ -24738,6 +24755,8 @@ fi
  rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
        AUTH_OBJS="$AUTH_OBJS kerb5.lo"
      fi
@@ -122,11 +122,11 @@
      _LIBS="$LIBS"
      LIBS="${LIBS} ${SUDOERS_LIBS}"
      for ac_func in krb5_verify_user krb5_init_secure_context
-@@ -27051,7 +27070,6 @@ test "$datarootdir" = '${prefix}/share' 
- test "$docdir" = '${datarootdir}/doc/${PACKAGE_TARNAME}' && docdir='$(datarootdir)/doc/$(PACKAGE_TARNAME)'
+@@ -28297,7 +28316,6 @@ test "$docdir" = '${datarootdir}/doc/${P
  test "$localedir" = '${datarootdir}/locale' && localedir='$(datarootdir)/locale'
  test "$localstatedir" = '${prefix}/var' && localstatedir='$(prefix)/var'
+ test "$runstatedir" = '${localstatedir}/run' && runstatedir='$(localstatedir)/run'
 -test "$sysconfdir" = '${prefix}/etc' && sysconfdir='/etc'
  
  if test X"$INIT_SCRIPT" != X""; then
-     ac_config_files="$ac_config_files init.d/$INIT_SCRIPT"
+     ac_config_files="$ac_config_files etc/init.d/$INIT_SCRIPT"
diff -r 594906486f9e -r 9350832cbe45 security/sudo/patches/patch-examples_Makefile.in
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/security/sudo/patches/patch-examples_Makefile.in  Mon Jan 18 14:32:23 2021 +0000
@@ -0,0 +1,18 @@
+$NetBSD: patch-examples_Makefile.in,v 1.1 2021/01/18 14:32:24 taca Exp $
+
+Do not install the configuration files.
+
+--- examples/Makefile.in.orig  2020-12-17 01:33:43.000000000 +0000
++++ examples/Makefile.in
+@@ -83,11 +83,6 @@ install-includes:
+ 
+ install-doc: install-dirs
+       for f in $(EXAMPLES); do $(INSTALL) $(INSTALL_OWNER) -m 0644 $$f $(DESTDIR)$(exampledir); done
+-      test -r $(DESTDIR)$(sysconfdir)/sudo.conf || \
+-          $(INSTALL) $(INSTALL_OWNER) -m 0644 sudo.conf $(DESTDIR)$(sysconfdir)
+-      if test -n "$(LOGSRVD_CONF)" -a ! -r $(DESTDIR)$(sysconfdir)/sudo_logsrvd.conf; then \
+-          $(INSTALL) $(INSTALL_OWNER) -m 0644 $(LOGSRVD_CONF) $(DESTDIR)$(sysconfdir); \
+-      fi
+ 
+ install-plugin:
+ 
diff -r 594906486f9e -r 9350832cbe45 security/sudo/patches/patch-logsrvd_Makefile.in
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/security/sudo/patches/patch-logsrvd_Makefile.in   Mon Jan 18 14:32:23 2021 +0000
@@ -0,0 +1,15 @@
+$NetBSD: patch-logsrvd_Makefile.in,v 1.1 2021/01/18 14:32:24 taca Exp $
+
+Fix build error.
+
+--- logsrvd/Makefile.in.orig   2021-01-09 20:12:16.000000000 +0000
++++ logsrvd/Makefile.in
+@@ -46,7 +46,7 @@ INSTALL_BACKUP = @INSTALL_BACKUP@
+ LT_LIBS = $(top_builddir)/lib/iolog/libsudo_iolog.la \
+         $(top_builddir)/lib/eventlog/libsudo_eventlog.la \
+         $(top_builddir)/lib/logsrv/liblogsrv.la
+-LIBS = $(LT_LIBS) @LIBTLS@
++LIBS = $(LT_LIBS) @LIBTLS@ @LIBS@
+ 
+ # C preprocessor defines
+ CPPDEFS = -D_PATH_SUDO_LOGSRVD_CONF=\"$(sysconfdir)/sudo_logsrvd.conf\" \
diff -r 594906486f9e -r 9350832cbe45 security/sudo/patches/patch-plugins_sudoers_Makefile.in
--- a/security/sudo/patches/patch-plugins_sudoers_Makefile.in   Mon Jan 18 13:44:42 2021 +0000
+++ b/security/sudo/patches/patch-plugins_sudoers_Makefile.in   Mon Jan 18 14:32:23 2021 +0000
@@ -1,10 +1,26 @@
-$NetBSD: patch-plugins_sudoers_Makefile.in,v 1.3 2019/12/28 20:43:56 kim Exp $
+$NetBSD: patch-plugins_sudoers_Makefile.in,v 1.4 2021/01/18 14:32:24 taca Exp $
 
-Do not install the sudoers file to etc.
+* Do not install the sudoers file.
+* link with @LIBS@ for PKG_OPTIONS nls enabled case.
 
---- plugins/sudoers/Makefile.in.orig   2019-12-25 21:21:05.000000000 +0200
-+++ plugins/sudoers/Makefile.in        2019-12-28 22:01:00.540953438 +0200
-@@ -396,7 +396,7 @@
+--- plugins/sudoers/Makefile.in.orig   2021-01-09 20:12:16.000000000 +0000
++++ plugins/sudoers/Makefile.in
+@@ -62,10 +62,10 @@ LIBUTIL = $(top_builddir)/lib/util/libsu
+ LIBS = $(LIBUTIL)
+ NET_LIBS = @NET_LIBS@
+ SUDOERS_LIBS = @SUDOERS_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ @LIBTLS@ $(NET_LIBS) $(LIBIOLOG) $(LIBEVENTLOG) $(LIBLOGSRV)
+-REPLAY_LIBS = @REPLAY_LIBS@ $(LIBEVENTLOG) $(LIBIOLOG)
+-VISUDO_LIBS = $(NET_LIBS)
+-CVTSUDOERS_LIBS = $(NET_LIBS)
+-TESTSUDOERS_LIBS = $(NET_LIBS)
++REPLAY_LIBS = @REPLAY_LIBS@ $(LIBEVENTLOG) $(LIBIOLOG) @LIBS@
++VISUDO_LIBS = $(NET_LIBS) @LIBS@
++CVTSUDOERS_LIBS = $(NET_LIBS) @LIBS@
++TESTSUDOERS_LIBS = $(NET_LIBS) @LIBS@
+ 
+ # C preprocessor defines
+ CPPDEFS = -DLIBDIR=\"$(libdir)\" -DLOCALEDIR=\"$(localedir)\" \
+@@ -390,7 +390,7 @@ pre-install:
            fi; \
        fi
  
@@ -12,4 +28,4 @@
 +install: install-plugin install-binaries install-doc
  
  install-dirs:
-       $(SHELL) $(top_srcdir)/mkinstalldirs $(DESTDIR)$(plugindir) \
+       $(SHELL) $(scriptdir)/mkinstalldirs $(DESTDIR)$(plugindir) \



Home | Main Index | Thread Index | Old Index