pkgsrc/security/sudo/Makefile
tls 36ca7970b3 Fix privilege-escalation vulnerability with PKG_OPTIONS.sudo=kerberos:
cleanse environment of variables that alter behavior of Kerberos library
so the user can't override the default keytab location, and do *not*
ignore missing keytab errors.  Prevents root compromise via spoofed KDC
on systems with Kerberos libraries but no host key in keytab, no keytab,
or keytab overidden via environment.

Don't insist that the keytab key be DES -- some Kerberos sites are 3DES/AES
only.

Somewhat less invasive than the fix Todd incorporated into the 1.6.9 branch
of sudo (presently beta) but equivalent (though not as clean).
2007-06-25 09:53:42 +00:00

49 lines
1.4 KiB
Makefile

# $NetBSD: Makefile,v 1.90 2007/06/25 09:53:42 tls Exp $
#
DISTNAME= sudo-1.6.8p12
PKGNAME= sudo-1.6.8pl12
PKGREVISION= 4
CATEGORIES= security
MASTER_SITES= http://www.courtesan.com/sudo/dist/ \
ftp://ftp.courtesan.com/pub/sudo/ \
ftp://ftp.cs.colorado.edu/pub/sudo/ \
ftp://ftp.uu.net/pub/security/sudo/ \
ftp://ftp.tux.org/pub/security/sudo/ \
http://www.courtesan.com/sudo/dist/beta/
MAINTAINER= kim@tac.nyc.ny.us
HOMEPAGE= http://www.courtesan.com/sudo/
COMMENT= Allow others to run commands as root
PKG_INSTALLATION_TYPES= overwrite pkgviews
USE_LIBTOOL= yes
OWN_DIRS+= ${VARBASE}/run
GNU_CONFIGURE= yes
.include "../../mk/bsd.prefs.mk"
CONFIGURE_ENV+= NROFFPROG=${CAT} # to always install man instead of cat
CONFIGURE_ARGS+= --disable-root-mailer
CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR:Q}
CONFIGURE_ARGS+= --with-timedir=${VARBASE:Q}/run/sudo
CONFIGURE_ARGS+= --with-logpath=${VARBASE:Q}/log/sudo.log
.include "options.mk"
CONFIGURE_ARGS+= --with-nbsdops --disable-path-info
DOCDIR= ${PREFIX}/share/doc/${PKGBASE}
EGDIR= ${PREFIX}/share/examples/${PKGBASE}
CONF_FILES_PERMS= ${EGDIR}/sudoers ${PKG_SYSCONFDIR}/sudoers 0 0 0440
SPECIAL_PERMS+= bin/sudo ${SETUID_ROOT_PERMS}
post-install:
${INSTALL_DATA_DIR} ${DOCDIR}
${INSTALL_DATA} ${WRKSRC}/UPGRADE ${DOCDIR}
${INSTALL_DATA_DIR} ${EGDIR}
${INSTALL_DATA} ${WRKSRC}/sudoers ${EGDIR}/sudoers
${INSTALL_DATA} ${WRKSRC}/README* ${DOCDIR}
.include "../../mk/bsd.pkg.mk"