Skip to content

Commit f7ae17d

Browse files
committed
Merge sudo 1.9.15 from tip.
--HG-- branch : 1.9
2 parents efc6ab4 + 747c340 commit f7ae17d

577 files changed

Lines changed: 31685 additions & 25222 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.circleci/config.yml

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ jobs:
44
build_linux:
55
description: Configure, build and package sudo (Linux)
66
parameters:
7+
krb5:
8+
description: if true, build sudo's Kerberos V support
9+
default: false
10+
type: boolean
711
ldap:
812
description: if true, build sudo's LDAP support
913
default: false
@@ -31,7 +35,7 @@ jobs:
3135
- checkout
3236
- run:
3337
name: "Building and packaging sudo (Linux)"
34-
command: ./scripts/mkpkg <<# parameters.ldap >>--flavor=ldap --with-sssd --with-sssd-lib=/usr/lib/x86_64-linux-gnu <</ parameters.ldap >><<# parameters.wolfssl >>--enable-wolfssl <</ parameters.wolfssl >><<^ parameters.logsrvd >>--disable-log-server --disable-log-client <</ parameters.logsrvd >><<^ parameters.intercept >>--disable-intercept <</ parameters.intercept >><<# parameters.static_sudoers >>--enable-static-sudoers <</ parameters.static_sudoers >>--enable-warnings --enable-werror --enable-sanitizer
38+
command: ./scripts/mkpkg <<# parameters.krb5 >>--without-pam --with-kerb5 <</ parameters.krb5 >><<# parameters.ldap >>--flavor=ldap --with-sssd --with-sssd-lib=/usr/lib/x86_64-linux-gnu <</ parameters.ldap >><<# parameters.wolfssl >>--enable-wolfssl <</ parameters.wolfssl >><<^ parameters.logsrvd >>--disable-log-server --disable-log-client <</ parameters.logsrvd >><<^ parameters.intercept >>--disable-intercept <</ parameters.intercept >><<# parameters.static_sudoers >>--enable-static-sudoers <</ parameters.static_sudoers >>--enable-warnings --enable-werror --enable-sanitizer
3539
# Save workspace for subsequent jobs (i.e. test)
3640
- persist_to_workspace:
3741
root: .
@@ -56,7 +60,7 @@ jobs:
5660
build_macos:
5761
description: Configure, build and package sudo (macOS)
5862
macos:
59-
xcode: 13.4.1 # indicate our selected version of Xcode
63+
xcode: 14.2.0 # indicate our selected version of Xcode
6064
steps:
6165
- checkout
6266
- run:
@@ -70,7 +74,7 @@ jobs:
7074
test_macos:
7175
description: run sudo tests in a pre-built workspace (macOS)
7276
macos:
73-
xcode: 13.2.1 # indicate our selected version of Xcode
77+
xcode: 14.2.0 # indicate our selected version of Xcode
7478
steps:
7579
# Reuse the workspace from the build job
7680
- attach_workspace:
@@ -84,6 +88,12 @@ workflows:
8488
version: 2
8589
build_and_test:
8690
jobs:
91+
- build_linux:
92+
name: build-linux-krb5
93+
krb5: true
94+
filters:
95+
branches:
96+
only: main
8797
- build_linux:
8898
name: build-linux-ldap
8999
ldap: true
@@ -119,6 +129,10 @@ workflows:
119129
filters:
120130
branches:
121131
only: main
132+
- test_linux:
133+
name: test-linux-krb5
134+
requires:
135+
- build-linux-krb5
122136
- test_linux:
123137
name: test-linux-ldap
124138
requires:

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ plugins/sudoers/sudoers
7979
plugins/sudoers/sudoreplay
8080
plugins/sudoers/testsudoers
8181
plugins/sudoers/tsdump
82+
plugins/sudoers/tsgetusershell.c
8283
plugins/sudoers/visudo
8384
plugins/sudoers/prologue
8485
plugins/sudoers/check_[a-z]*

.hgignore

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ Makefile$
6767
^logsrvd/fuzz_logsrvd_conf$
6868
^logsrvd/logsrvd_conf_test$
6969

70-
^plugins/sudoers/(cvtsudoers|sudoers|sudoreplay|testsudoers|tsdump|visudo|prologue|check_[a-z0-9_]+)$
70+
^plugins/sudoers/(cvtsudoers|sudoers|sudoreplay|testsudoers|tsdump|tsgetusershell\.c|visudo|prologue|check_[a-z0-9_]+)$
7171
^plugins/sudoers/fuzz_(policy|sudoers(_ldif)?)$
7272
^plugins/sudoers/.*\.(out|toke|err|json|ldif|sudo|ldif2sudo)$
7373
^plugins/sudoers/regress/harness

INSTALL.md

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -434,24 +434,30 @@ Defaults are listed in brackets after the description.
434434
This is also used to support the "log_subcmds" sudoers
435435
setting. For example, this means that for a shell run
436436
through sudo, the individual commands run by the shell are
437-
also subject to rules in the sudoers file. See the
438-
"Preventing Shell Escapes" section in the sudoers man page
439-
for details. If specified, PATH should be a fully qualified
440-
path name, e.g. /usr/local/libexec/sudo/sudo_intercept.so.
441-
If PATH is "no", intercept support will not be compiled in.
442-
The default is to compile intercept support if libtool
443-
supports building shared objects on your system.
437+
also subject to rules in the sudoers file. See the "Preventing
438+
Shell Escapes" section in the sudoers man page for details.
439+
If specified, PATH should either be a fully-qualified path
440+
name such as /usr/local/libexec/sudo/sudo_intercept.so, or,
441+
for AIX and Solaris systems, it may optionally be set to a
442+
32-bit shared library followed by a 64-bit shared library,
443+
separated by a colon. If PATH is "no", intercept support
444+
will not be compiled in. The default is to compile intercept
445+
support if libtool supports building shared objects on your
446+
system.
444447

445448
--with-noexec[=PATH]
446449
Enable support for the "noexec" functionality which prevents
447450
a dynamically-linked program being run by sudo from executing
448451
another program (think shell escapes). See the "Preventing
449452
Shell Escapes" section in the sudoers man page for details.
450-
If specified, PATH should be a fully qualified path name,
451-
e.g. /usr/local/libexec/sudo/sudo_noexec.so. If PATH is
452-
"no", noexec support will not be compiled in. The default
453-
is to compile noexec support if libtool supports building
454-
shared objects on your system.
453+
If specified, PATH should either be a fully-qualified path
454+
name such as /usr/local/libexec/sudo/sudo_noexec.so, or,
455+
for AIX and Solaris systems, it may optionally be set to a
456+
32-bit shared library followed by a 64-bit shared library,
457+
separated by a colon. If PATH is "no", noexec support
458+
will not be compiled in. The default is to compile noexec
459+
support if libtool supports building shared objects on your
460+
system.
455461

456462
--with-selinux
457463
Enable support for role based access control (RBAC) on systems
@@ -703,6 +709,11 @@ Defaults are listed in brackets after the description.
703709
enables extra checks to make sure the environment does not
704710
become corrupted.
705711

712+
--enable-postinstall=PATH
713+
Enable the use of a postinstall script that is run after
714+
the "install" target but before packages as built as part
715+
of the "package" target.
716+
706717
--enable-warnings
707718
Enable compiler warnings when building sudo with gcc or clang.
708719

@@ -836,7 +847,7 @@ Defaults are listed in brackets after the description.
836847
Sudoers option: exempt_group
837848

838849
--with-fqdn
839-
Define this if you want to put fully qualified host names in the sudoers
850+
Define this if you want to put fully-qualified host names in the sudoers
840851
file. Ie: instead of myhost you would use myhost.mydomain.edu. You may
841852
still use the short form if you wish (and even mix the two). Beware
842853
that turning FQDN on requires sudo to make DNS lookups which may make

MANIFEST

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ include/sudo_lbuf.h
110110
include/sudo_plugin.h
111111
include/sudo_queue.h
112112
include/sudo_rand.h
113+
include/sudo_ssl_compat.h
113114
include/sudo_util.h
114115
lib/eventlog/Makefile.in
115116
lib/eventlog/eventlog.c
@@ -227,6 +228,8 @@ lib/logsrv/log_server.pb-c.c
227228
lib/logsrv/log_server.proto
228229
lib/protobuf-c/Makefile.in
229230
lib/protobuf-c/protobuf-c.c
231+
lib/ssl_compat/Makefile.in
232+
lib/ssl_compat/ssl_compat.c
230233
lib/util/Makefile.in
231234
lib/util/aix.c
232235
lib/util/arc4random.c
@@ -452,6 +455,7 @@ m4/ax_check_compile_flag.m4
452455
m4/ax_check_link_flag.m4
453456
m4/ax_func_getaddrinfo.m4
454457
m4/ax_func_snprintf.m4
458+
m4/ax_gcc_builtin.m4
455459
m4/ax_prog_cc_for_build.m4
456460
m4/gettext.m4
457461
m4/hardening.m4
@@ -616,8 +620,8 @@ plugins/sudoers/bsm_audit.c
616620
plugins/sudoers/bsm_audit.h
617621
plugins/sudoers/canon_path.c
618622
plugins/sudoers/check.c
619-
plugins/sudoers/check.h
620623
plugins/sudoers/check_aliases.c
624+
plugins/sudoers/check_util.c
621625
plugins/sudoers/cvtsudoers.c
622626
plugins/sudoers/cvtsudoers.h
623627
plugins/sudoers/cvtsudoers_csv.c
@@ -631,6 +635,7 @@ plugins/sudoers/def_data.in
631635
plugins/sudoers/defaults.c
632636
plugins/sudoers/defaults.h
633637
plugins/sudoers/digestname.c
638+
plugins/sudoers/display.c
634639
plugins/sudoers/editor.c
635640
plugins/sudoers/env.c
636641
plugins/sudoers/env_pattern.c
@@ -671,15 +676,17 @@ plugins/sudoers/log_client.c
671676
plugins/sudoers/log_client.h
672677
plugins/sudoers/logging.c
673678
plugins/sudoers/logging.h
679+
plugins/sudoers/lookup.c
674680
plugins/sudoers/match.c
675681
plugins/sudoers/match_addr.c
676682
plugins/sudoers/match_command.c
677683
plugins/sudoers/match_digest.c
678684
plugins/sudoers/mkdefaults
679-
plugins/sudoers/parse.c
680685
plugins/sudoers/parse.h
681686
plugins/sudoers/parse_ldif.c
687+
plugins/sudoers/parser_warnx.c
682688
plugins/sudoers/pivot.c
689+
plugins/sudoers/pivot.h
683690
plugins/sudoers/po/README
684691
plugins/sudoers/po/ast.mo
685692
plugins/sudoers/po/ast.po
@@ -1087,8 +1094,24 @@ plugins/sudoers/regress/testsudoers/test22.out.ok
10871094
plugins/sudoers/regress/testsudoers/test22.sh
10881095
plugins/sudoers/regress/testsudoers/test23.out.ok
10891096
plugins/sudoers/regress/testsudoers/test23.sh
1097+
plugins/sudoers/regress/testsudoers/test24.out.ok
1098+
plugins/sudoers/regress/testsudoers/test24.sh
1099+
plugins/sudoers/regress/testsudoers/test25.out.ok
1100+
plugins/sudoers/regress/testsudoers/test25.sh
1101+
plugins/sudoers/regress/testsudoers/test26.out.ok
1102+
plugins/sudoers/regress/testsudoers/test26.sh
1103+
plugins/sudoers/regress/testsudoers/test27.out.ok
1104+
plugins/sudoers/regress/testsudoers/test27.sh
1105+
plugins/sudoers/regress/testsudoers/test28.out.ok
1106+
plugins/sudoers/regress/testsudoers/test28.sh
1107+
plugins/sudoers/regress/testsudoers/test29.out.ok
1108+
plugins/sudoers/regress/testsudoers/test29.sh
10901109
plugins/sudoers/regress/testsudoers/test3.out.ok
10911110
plugins/sudoers/regress/testsudoers/test3.sh
1111+
plugins/sudoers/regress/testsudoers/test30.out.ok
1112+
plugins/sudoers/regress/testsudoers/test30.sh
1113+
plugins/sudoers/regress/testsudoers/test31.out.ok
1114+
plugins/sudoers/regress/testsudoers/test31.sh
10921115
plugins/sudoers/regress/testsudoers/test4.out.ok
10931116
plugins/sudoers/regress/testsudoers/test4.sh
10941117
plugins/sudoers/regress/testsudoers/test5.out.ok
@@ -1125,8 +1148,10 @@ plugins/sudoers/regress/visudo/test8.out.ok
11251148
plugins/sudoers/regress/visudo/test8.sh
11261149
plugins/sudoers/regress/visudo/test9.out.ok
11271150
plugins/sudoers/regress/visudo/test9.sh
1151+
plugins/sudoers/resolve_cmnd.c
11281152
plugins/sudoers/serialize_list.c
11291153
plugins/sudoers/set_perms.c
1154+
plugins/sudoers/sethost.c
11301155
plugins/sudoers/solaris_audit.c
11311156
plugins/sudoers/solaris_audit.h
11321157
plugins/sudoers/sssd.c
@@ -1145,15 +1170,19 @@ plugins/sudoers/sudoers.c
11451170
plugins/sudoers/sudoers.exp
11461171
plugins/sudoers/sudoers.h
11471172
plugins/sudoers/sudoers.in
1173+
plugins/sudoers/sudoers_cb.c
1174+
plugins/sudoers/sudoers_ctx_free.c
11481175
plugins/sudoers/sudoers_debug.c
11491176
plugins/sudoers/sudoers_debug.h
11501177
plugins/sudoers/sudoers_hooks.c
11511178
plugins/sudoers/sudoers_version.h
11521179
plugins/sudoers/sudoreplay.c
11531180
plugins/sudoers/testsudoers.c
11541181
plugins/sudoers/testsudoers_pwutil.c
1182+
plugins/sudoers/testsudoers_pwutil.h
11551183
plugins/sudoers/timeout.c
11561184
plugins/sudoers/timestamp.c
1185+
plugins/sudoers/timestamp.h
11571186
plugins/sudoers/timestr.c
11581187
plugins/sudoers/toke.c
11591188
plugins/sudoers/toke.h
@@ -1164,6 +1193,7 @@ plugins/sudoers/tsgetgrpw.c
11641193
plugins/sudoers/tsgetgrpw.h
11651194
plugins/sudoers/unesc_str.c
11661195
plugins/sudoers/visudo.c
1196+
plugins/sudoers/visudo_cb.c
11671197
plugins/system_group/Makefile.in
11681198
plugins/system_group/system_group.c
11691199
plugins/system_group/system_group.exp
@@ -1198,6 +1228,8 @@ po/hr.mo
11981228
po/hr.po
11991229
po/hu.mo
12001230
po/hu.po
1231+
po/id.mo
1232+
po/id.po
12011233
po/it.mo
12021234
po/it.po
12031235
po/ja.mo

Makefile.in

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,10 @@ shlib_mode = @SHLIB_MODE@
5757
python_version = @PYTHON_VERSION@
5858

5959
SUBDIRS = lib/util @ZLIB_SRC@ lib/eventlog lib/fuzzstub lib/iolog \
60-
lib/protobuf-c @LOGSRV_SRC@ @LOGSRVD_SRC@ plugins/audit_json \
61-
plugins/group_file plugins/sudoers plugins/system_group \
62-
@PYTHON_PLUGIN_SRC@ src include docs examples
60+
lib/protobuf-c @SSL_COMPAT_SRC@ @LOGSRV_SRC@ @LOGSRVD_SRC@ \
61+
plugins/audit_json plugins/group_file plugins/sudoers \
62+
plugins/system_group @PYTHON_PLUGIN_SRC@ src include \
63+
docs examples
6364

6465
SAMPLES = plugins/sample plugins/sample_approval
6566

@@ -193,6 +194,9 @@ install: config.status ChangeLog pre-install install-nls
193194
exit $$?; \
194195
done
195196

197+
postinstall:
198+
@POSTINSTALL@
199+
196200
uninstall: uninstall-nls
197201
for d in $(SUBDIRS); do \
198202
(cd $$d && exec $(MAKE) $@) && continue; \
@@ -208,7 +212,10 @@ uninstall-nls:
208212
siglist.c signame.c:
209213
cd lib/util && exec $(MAKE) $@
210214

211-
depend: siglist.c signame.c
215+
tsgetusershell.c:
216+
cd plugins/sudoers && exec $(MAKE) $@
217+
218+
depend: siglist.c signame.c tsgetusershell.c
212219
$(scriptdir)/mkdep.pl \
213220
--srcdir=$(abs_top_srcdir) --builddir=$(abs_top_builddir) \
214221
lib/util/Makefile.in lib/zlib/Makefile.in \
@@ -394,6 +401,7 @@ force-dist: ChangeLog $(srcdir)/MANIFEST
394401
package: @PPFILES@
395402
DESTDIR=$(abs_top_builddir)/destdir; rm -rf $$DESTDIR; \
396403
$(MAKE) install INSTALL_OWNER= DESTDIR=$$DESTDIR && \
404+
$(MAKE) postinstall INSTALL_OWNER= DESTDIR=$$DESTDIR && \
397405
for p in @PPFILES@; do \
398406
$(SHELL) $(scriptdir)/pp $(PPFLAGS) --destdir=$$DESTDIR $$p \
399407
srcdir=$(top_srcdir) \

0 commit comments

Comments
 (0)