Major changes between version 1.7.2p3 and 1.7.2p4:
* Fix a bug that could allow users with permission to run sudoedit
to run arbitrary commands.
Major changes between version 1.7.2p2 and 1.7.2p3:
* Fix printing of entries with multiple host entries on a single line.
* Fix use after free when sending error messages via email.
* Use setrlimit64(), if available, instead of setrlimit() when
setting AIX resource limits since rlim_t is 32bits.
* Fix size arg when realloc()ing include stack.
* Avoid a duplicate fclose() of the sudoers file.
Major changes between sudo 1.7.2p1 and 1.7.2p2:
* Fixed a a bug where the negation operator in a Cmnd_List
was not being honored.
* Sudo no longer produces a parse error when #includedir references
a directory that contains no valid filenames.
* The sudo.man.pl and sudoers.man.pl files are now included in
the distribution for people who wish to regenerate the man pages.
* Fixed the emulation of krb5_get_init_creds_opt_alloc() for MIT kerberos.
* When authenticating via PAM, set PAM_RUSER and PAM_RHOST early so
they can be used during authentication.
Changes in 1.7.2p1 since 1.7.2:
===============================
* Fixed the expansion of the %h escape in #include file names introduced in
sudo 1.7.1.
Changes in 1.7.2 since 1.7.1:
=============================
* A new #includedir directive is available in sudoers. This can be used to
implement an /etc/sudo.d directory. Files in an includedir are not edited
by visudo unless they contain a syntax error.
* The -g option did not work properly when only setting the group (and not
the user). Also, in -l mode the wrong user was displayed for sudoers
entries where only the group was allowed to be set.
* Fixed a problem with the alias checking in visudo which could prevent
visudo from exiting.
* Sudo will now correctly parse the shell-style /etc/environment file format
used by pam_env on Linux.
* When doing password and group database lookups, sudo will only cache an
entry by name or by id, depending on how the entry was looked up.
Previously, sudo would cache by both name and id from a single lookup, but
this breaks sites that have multiple password or group database names that
map to the same uid or gid.
* User and group names in sudoers may now be enclosed in double quotes to
avoid having to escape special characters.
* BSM audit fixes when changing to a non-root uid.
* Experimental non-Unix group support. Currently only works with Quest
Authorization Services and allows Active Directory groups fixes for
Minix-3.
* For Netscape/Mozilla-derived LDAP SDKs the certificate and key paths may
be specified as a directory or a file. However, version 5.0 of the SDK
only appears to support using a directory (despite documentation to the
contrary). If SSL client initialization fails and the certificate or key
paths look like they could be default file name, strip off the last path
element and try again.
* A setenv() compatibility fix for Linux systems, where a NULL value is
treated the same as an empty string and the variable name is checked
against the NULL pointer.
pkgsrc change: add LICENSE.
What's new in Sudo 1.7.1?
* A new Defaults option "pwfeedback" will cause sudo to provide visual
feedback when the user is entering a password.
* A new Defaults option "fast_glob" will cause sudo to use the fnmatch()
function for file name globbing instead of glob(). When this option
is enabled, sudo will not check the file system when expanding wildcards.
This is faster but a side effect is that relative paths with wildcard
will no longer work.
* New BSM audit support for systems that support it such as FreeBSD
and Mac OS X.
* The file name specified with the #include directive may now include
a %h escape which is expanded to the short form of hostname.
* The -k flag may now be specified along with a command, causing the
user's timestamp file to be ignored.
* New support for Tivoli-based LDAP START_TLS, present in AIX.
* New support for /etc/netsvc.conf on AIX.
* The unused alias checks in visudo now handle the case of an alias
referring to another alias.
* pkgsrc change: relax restriction to kerberos package.
What's new in Sudo 1.7.0?
* Rewritten parser that converts sudoers into a set of data structures.
This eliminates a number of ordering issues and makes it possible to
apply sudoers Defaults entries before searching for the command.
It also adds support for per-command Defaults specifications.
* Sudoers now supports a #include facility to allow the inclusion of other
sudoers-format files.
* Sudo's -l (list) flag has been enhanced:
o applicable Defaults options are now listed
o a command argument can be specified for testing whether a user
may run a specific command.
o a new -U flag can be used in conjunction with "sudo -l" to allow
root (or a user with "sudo ALL") list another user's privileges.
* A new -g flag has been added to allow the user to specify a
primary group to run the command as. The sudoers syntax has been
extended to include a group section in the Runas specification.
* A uid may now be used anywhere a username is valid.
* The "secure_path" run-time Defaults option has been restored.
* Password and group data is now cached for fast lookups.
* The file descriptor at which sudo starts closing all open files is now
configurable via sudoers and, optionally, the command line.
* Visudo will now warn about aliases that are defined but not used.
* The -i and -s command line flags now take an optional command
to be run via the shell. Previously, the argument was passed
to the shell as a script to run.
* Improved LDAP support. SASL authentication may now be used in
conjunction when connecting to an LDAP server. The krb5_ccname
parameter in ldap.conf may be used to enable Kerberos.
* Support for /etc/nsswitch.conf. LDAP users may now use nsswitch.conf
to specify the sudoers order. E.g.:
sudoers: ldap files
to check LDAP, then /etc/sudoers. The default is "files", even
when LDAP support is compiled in. This differs from sudo 1.6
where LDAP was always consulted first.
* Support for /etc/environment on AIX and Linux. If sudo is run
with the -i flag, the contents of /etc/environment are used to
populate the new environment that is passed to the command being
run.
* If no terminal is available or if the new -A flag is specified,
sudo will use a helper program to read the password if one is
configured. Typically, this is a graphical password prompter
such as ssh-askpass.
* A new Defaults option, "mailfrom" that sets the value of the
"From:" field in the warning/error mail. If unspecified, the
login name of the invoking user is used.
* A new Defaults option, "env_file" that refers to a file containing
environment variables to be set in the command being run.
* A new flag, -n, may be used to indicate that sudo should not
prompt the user for a password and, instead, exit with an error
if authentication is required.
* If sudo needs to prompt for a password and it is unable to disable
echo (and no askpass program is defined), it will refuse to run
unless the "visiblepw" Defaults option has been specified.
* Prior to version 1.7.0, hitting enter/return at the Password: prompt
would exit sudo. In sudo 1.7.0 and beyond, this is treated as
an empty password. To exit sudo, the user must press ^C or ^D
at the prompt.
* visudo will now check the sudoers file owner and mode in -c (check)
mode when the -s (strict) flag is specified.
660) The -i flag should imply resetting the environment, as it did in
sudo version prior to 1.6.9. Also, the -i and -E flags are
mutually exclusive.
661) Fixed the configure test for dirfd() under Linux.
662) Fixed test for whether -lintl is required to link.
663) Changed how sudo handles the child process when sending mail.
This fixes a problem on Linux with the mail_always option.
664) Fixed a problem with line continuation characters inside of
quoted strings.
Major changes since Sudo 1.6.9p15:
o There was missing whitespace before the ldap libraries in the Makefile
for some configurations.
o LDAPS_PORT may not be defined on older Solaris LDAP SDKs.
o If the LDAP server could not be contacted and the user was not present
in sudoers, a syntax error in sudoers was incorrectly reported.
and ${REAL_ROOT_GROUP} instead. The pkginstall framework checks for
the name of the user and group, not the uid and gid, when comparing
permissions. This fixes the following spurious warning from appearing:
The following files are used by sudo-1.6.9p15 and have
the wrong ownership and/or permissions:
/usr/pkg/etc/sudoers (m=0440, o=0, g=0)
653) Fixed installation of sudo_noexec.so on AIX.
654) Updated libtool to version 1.5.26.
655) Fixed printing of default SELinux role and type in -V mode.
656) The HOME environment variable is once again preserved by default,
as per the documentation.
pkgsrc changes:
- Explict to depends security/heimdal package when kerberos option is
specified. PR pkg/37999 should be fixed.
Change:
646) Sudo will now set the nproc resource limit to unlimited on Linux
systems to work around Linux's setuid() resource limit semantics.
On PAM systems the resource limits will be reset by pam_limits.so
before the command is executed.
647) SELinux support that can be used to implement role based access
control (RBAC). A role and (optional) type may be specified
in sudoers or on the command line. These are then used in the
security context that the command is run as.
648) Fixed a Kerberos 5 compilation problem with MIT Kerberos.
Sudo 1.6.9p13 released.
649) Fixed an invalid assumption in the PAM conversation function
introduced in version 1.6.9p9. The conversation function may
be called for non-password reading purposes as well.
650) Fixed freeing an uninitialized pointer in -l mode, introduced in
version 1.6.9p13.
651) Check /etc/sudoers after LDAP even if the user was found in LDAP.
This allows Defaults options in /etc/sudoers to take effect.
652) Add missing checks for enforcing mode in SELinux RBAC mode.
Sudo 1.6.9p14 released.
Changes from 1.6.9p11:
641) Added a configure check for the ber_set_option() function.
642) Fixed a compilation problem with the HP-UX K&R C compiler.
643) Revamped the Kerberos 5 ticket verification code.
644) Added support for the checkpeer ldap.conf variable for
netscape-based LDAP SDKs.
645) Fixed a problem where an incomplete password could be echoed
to the screen if there was a read timeout.
637) Fixed a compilation problem on SCO related to how they
store the high resolution timestamps in struct stat.
638) Avoid checking the passwd file group multiple times
in the LDAP query when the user's passwd group is also
listed in the supplemental group vector.
639) The URI specifier can now be used in ldap.conf even when
the LDAP SDK doesn't support ldap_initialize().
640) New %p prompt escape that expands to the user whose password
is being prompted, as specified by the rootpw, targetpw and
runaspw sudoers flags. Based on a diff from Patrick Schoenfeld.
Major changes since Sudo 1.6.9p9:
o Moved LDAP options into a table for simplified parsing/setting.
o Fixed a problem with how some LDAP options were being applied.
o Added support for connecting directly to LDAP servers via SSL/TLS
for servers that don't support the start_tls extension.
Major changes since Sudo 1.6.9p8:
o The ALL command in sudoers now implies SETENV permissions.
o The command search is now performed using the target user's
auxiliary group vector, not just the target's primary group.
o When determining if the PAM prompt is the default "Password: ",
compare the localized version if possible.
o New passprompt_override option in sudoers to cause sudo's prompt
to be used in all cases. Also set when the -p flag is used.
Major changes since Sudo 1.6.9p7:
o Fixed a bug where a sudoers entry with no runas user specified
was treated differently from a line with the default runas user
explicitly specified.
pkgsrc change: added DESTDIR support.
Major changes since Sudo 1.6.9p6:
o Reverted back to to using TCSAFLUSH instead of TCSADRAIN when
turning off echo during password reading.
o Fixed a configure bug that was preventing the addition of -lutil for
login.conf support on FreeBSD and NetBSD.
o Added a configure check for struct in6_addr since some systems
define AF_INET6 but have no real IPv6 support.
Major changes since Sudo 1.6.9p5:
o Worked around bugs in the session support of some PAM implementations.
The full tty path is now passed to PAM as well.
o Sudo now only prints the password prompt if the process is in the
foreground.
o inttypes.h is now included when appropriate if it is present.
o Simplified alias allocation in the parser.
617) Fixed a bug in the IP address matching introduced by the IPV6 merge.
618) For "visudo -f file" we now use the permissions of the original file
and not the hard-coded sudoers owner/group/mode. This makes
it possible to use visudo with a revision control system.
619) Fixed sudoedit when used on a non-existent file.
620) Regenerated configure using autoconf 2.6.1 and libtool 1.5.24.
621) Groups and netgroups are now valid in an LDAP sudoRunas statement.
pkgsrc change:
Make these options mutual exclusive: kerberos pam skey.
(Really, combinations of kerberos and pam, pam and skey are conflicts.)
CHANGES:
609) Worked around a bug ins some PAM implementations that caused a crash
when no tty was present.
610) Fixed a crash on some platforms in the error logging function.
611) Documentation improvements.
Sudo 1.6.9p1 released.
612) Fixed updating of the saved environment when the environ pointer
gets changed out from underneath us.
Sudo 1.6.9p2 released.
613) Fixed a bug related to supplemental group matching introduced
in 1.6.9.
Sudo 1.6.9p3 released.
614) Added IPv6 support from YOSHIFUJI Hideaki.
615) Fixed sudo_noexec installation path.
616) Fixed a K&R compilation error.
Sudo 1.6.9p4 released.
and visudo manpages in man/man1, and the sudoers manpage in man/man5.
Remove the platform-specific PLISTs that only differed in the location
of the man pages.
Bump the PKGREVISION to 5.
(in fact, it's not clear that there is a good way to do so). The resulting
configuration works fine *except* if it encounters a host that has 3DES
but no DES service keys in its keytab.
Fix this by explicitly passing 0 ("default enctype") to Kerberos.
cleanse environment of variables that alter behavior of Kerberos library
so the user can't override the default keytab location, and do *not*
ignore missing keytab errors. Prevents root compromise via spoofed KDC
on systems with Kerberos libraries but no host key in keytab, no keytab,
or keytab overidden via environment.
Don't insist that the keytab key be DES -- some Kerberos sites are 3DES/AES
only.
Somewhat less invasive than the fix Todd incorporated into the 1.6.9 branch
of sudo (presently beta) but equivalent (though not as clean).
Always use "man" instead of catpages.
Make sure "run" directory is precreated, so you don't get:
/usr/bin/sudo sudo: can't mkdir /var/run/sudo: No such file or directory
Bump PKGREVISION.
Okayed by maintainer back in December. The only concern was
that /var/run may not be for all platforms, but this is same
as other packages to (not specific to sudo).
long. PR#32378 by Stefan Krüger.
Changes:
Added PS4 and SHELLOPTS to the list of variables to remove from
the environment. (Already in pkgsrc)
Added JAVA_TOOL_OPTIONS to the list of variables to remove from
the environment.
Added PERLLIB, PERL5LIB and PERL5OPT to the list of variables to
remove from the environment. (Already in pkgsrc)
1.6.8p7 include:
562) Fixed noexec functionality on Linux.
564) Fixed a bug that prevented Heimdal authentication from working.
566) A sudoers entry with sudo ALL no longer overwrites the value of
safe_cmnd. This fixes the privilege escalation vulnerability
noted in http://www.courtesan.com/sudo/alerts/path_race.html
Changes:
557) Added a set of missing braces needed for MacOS X / Darwin.
558) Define LDAP_OPT_SUCCESS for those without it.
559) Warn if the user tries to use the -u option when not running a command.
560) Better PAM error handling and messages.
561) Fixed setting of $USER when env_reset is enabled.
Changes:
o Added a configure check for systems with a 2-argument version of
timespecsub (like BSD/OS).
o Added stub struct defintions to sudo.h to quiet compiler warnings
on some systems.
o In sudoers Defaults lines, tuples like "lecture" may now be used
without a value, restoring their old boolean-like nature.
o Invalid values for a tuple are now handled correctly.
Just as for pl2, changes are about environment sanitizing, meaning there
are possible security issues with current versions.
Changes:
550) The CDPATH variable is now stripped from the environment passed
to the program to be executed.
551) Fix temp file generation on systems where the _PATH_VARTMP macro
lacks a trailing slash.
552) The KRB5CCNAME environment variable is preserved during sudo
execution for password lookups that use GSSAPI.
bash-as-sh (and people allowing bash scripts to be run through sudo). The
user could override commands by functions of her own.
ChangeLog:
549) Bash exported functions and the CDPATH variable are now stripped from
the environment passed to the program to be executed.
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
