diff options
| -rw-r--r-- | app-admin/sudo/Manifest | 11 | ||||
| -rw-r--r-- | app-admin/sudo/files/sudo-1.6.9_p13-ssh_client.diff | 46 | ||||
| -rw-r--r-- | app-admin/sudo/files/sudo-1.6.9_p16-ssh_client.diff | 46 | ||||
| -rw-r--r-- | app-admin/sudo/files/sudo-1.7.0_rc1-ssh_client.diff | 65 | ||||
| -rw-r--r-- | app-admin/sudo/sudo-1.6.9_p13.ebuild | 190 | ||||
| -rw-r--r-- | app-admin/sudo/sudo-1.6.9_p16.ebuild | 191 | ||||
| -rw-r--r-- | app-admin/sudo/sudo-1.7.0_rc1.ebuild | 211 |
7 files changed, 759 insertions, 1 deletions
diff --git a/app-admin/sudo/Manifest b/app-admin/sudo/Manifest index 1296c45..3324ff6 100644 --- a/app-admin/sudo/Manifest +++ b/app-admin/sudo/Manifest @@ -2,10 +2,19 @@ AUX patch.sudo-1.6.8p9.logging.c.diff 1539 RMD160 0bdfff8770e4937692f8dda82c2d64 AUX sudo 223 RMD160 4bc9a3e5d2dfd73bb1f14e5bad3b644ba80758d3 SHA1 fa6377c699ff2061c77cb87737fa2b4aaa8e8b9f SHA256 3f8dae2c663ed62bbe19e9b3e24f0e206fd1a4929bbafdff2e577e1aed9f2b58 AUX sudo-1.6.8_p12-ssh_client.diff 1815 RMD160 1ec5b9858bceee2292dd88167eb8e3760b46da2b SHA1 f54690102a0e669a34089acf2d0c37d4dd86ae67 SHA256 4d51ab9e7de3a6b5d222e4de2ec1eb3a17d35abbbf4182fc36d8b3d91c5b8bfc AUX sudo-1.6.8_p8-ldap-tls_cacert.diff 542 RMD160 cff54e31749796f732ce176b568797999325715e SHA1 3e7e493055998034d2b5a91160041e93d2246556 SHA256 2bc04b2b3ccd20f0ca545b74ca7ac68b708a1852af2fe2c620e78a92a45c2b23 +AUX sudo-1.6.9_p13-ssh_client.diff 1859 RMD160 719abc2137f210f3119438a39ccf874eee2293d3 SHA1 92b68a369fbff210ec9cb711a8d322cb853c204a SHA256 aa9489035fa78dc0f796345fd9a7aa10a7e5b5318e9ddfe3fa8ddbede8ed3235 +AUX sudo-1.6.9_p16-ssh_client.diff 1859 RMD160 719abc2137f210f3119438a39ccf874eee2293d3 SHA1 92b68a369fbff210ec9cb711a8d322cb853c204a SHA256 aa9489035fa78dc0f796345fd9a7aa10a7e5b5318e9ddfe3fa8ddbede8ed3235 +AUX sudo-1.7.0_rc1-ssh_client.diff 2144 RMD160 c755821682ba47390120611fb138e32f32687056 SHA1 9292713f7ad1963a4962cadc6f9677b49753b047 SHA256 cc6be42d991fd02cf521abd9bc5cd5b3a5178dded8d7497bb3b2cabd764839fc AUX sudo-ldap_timelimit.diff 2550 RMD160 b34a41e3fc4016ff182ed1800e0f1b0f82d3bfdf SHA1 c3c15eea9cf2e552010e27d0282246fa770d2fae SHA256 fc6eedb3435edbf5ccfcd5f62d8f31a78bf01afbb519c6b40bbe1329d82d6cea AUX sudo-skeychallengeargs.diff 567 RMD160 906ee43a7c2f21d1cf5130eac5c98ef0833154fd SHA1 b0efbedc72a1ed85c74ba10e343a68368e76c3e9 SHA256 dd2f4fdba26be6c3b4af15f3b6e18efa19375e1f9c579cdc2c76ee1adcce5e1d AUX sudoers 1612 RMD160 f61c372791112feecae7e0a762a9aa9f30285099 SHA1 b27d644dcd9d7d3727db9355a81cebf7deaa6a7a SHA256 4ff5355e2d1dcac48bdd8420982a5b437546cd40b3dc445f9fbfb9464a4af1a0 DIST sudo-1.6.8p12.tar.gz 585643 RMD160 d7ff9f18ca0973615258c2e975300b94567451d5 SHA1 a79631e9e1c0d0d3f2aa88ae685628e5fde61982 SHA256 56f7d86032538a4a98d90af3742903a09ba16d6db82b593e4a47605f87fa581a -EBUILD sudo-1.6.8_p12-r1.ebuild 6676 RMD160 b04da97519ece66fefa1f4079a8eb590f922a68f SHA1 864c3bdb6bdce8f8ad1537b68f6af27e8cddce83 SHA256 8d32748e74745b87106cbad2983bc0cd6fbde4b02e0ee00c99c3435f3c07ef89 +DIST sudo-1.6.9p13.tar.gz 589079 RMD160 eb2a4d835553061f9a15d71abee83a5574215c28 SHA1 0e84a265bb18772bc99d0f37c65dd6564962a6c4 SHA256 c54b8f10eca330cb3181e4a16bd743b145d4fcf9d1d85df6127d7e9979d4a805 +DIST sudo-1.6.9p16.tar.gz 593175 RMD160 b36b1ecc4383a6e411a8f0c2e90f9bfb6df4a220 SHA1 6c9248441eb6f5d56a9ba3545b83fceb875bd4ee SHA256 634e2b596bc6fc6a9143e00387ae79941980f548c9a20ea651ce755cc4e35f6a +DIST sudo-1.7.0rc1.tar.gz 736445 RMD160 1d226161876a3e290f30eba067ee8fbecef6cd66 SHA1 4a83cadd37aab864cbf21efd9e39996a73cbb210 SHA256 b1cb268376f9c8ce0e69567b3e53bfa09618d825df8e4ad1273ff196eba36952 +EBUILD sudo-1.6.8_p12-r1.ebuild 6675 RMD160 402017649c8360ee2153eb61bd04ee3390d9d1f5 SHA1 0554e036e26378b2443c287cf1f1bd4450fca796 SHA256 6f8c73062a59edbb81120add56bad7f6e4b841647767d6f11db0512aca0e90f0 +EBUILD sudo-1.6.9_p13.ebuild 5956 RMD160 281921b4b421bf2373d264f485ed09c83f6b4193 SHA1 50f29dbf598c327faff26e12431d06f321989bf8 SHA256 f708be67b6d9ff03f18d11e1d6cf9f5334a670414b250276162a727fec9f1b9f +EBUILD sudo-1.6.9_p16.ebuild 5990 RMD160 802c6066ffd4e8c225eef83750af372041e84e09 SHA1 bc1c49f7b86928496e558a8ed7cbb0592f07aea2 SHA256 5327c1d887966abcde066665a52cefa143832dae40dc9c8cabfe12e6fe8e93f7 +EBUILD sudo-1.7.0_rc1.ebuild 6444 RMD160 9d466129c9948e9e93adc460518ca7b4203ffcbc SHA1 6ee856110b47016b78649b6a5288885998849b2e SHA256 8b036824daac7db4dbde5269b138d63f10524f95f27647ff55ab8a9c42d9abab MISC ChangeLog 16836 RMD160 3a828b9690071c79737bcf44cc1ad989d52156ce SHA1 e036e4312d1f1b329326f8887a0789647c09b438 SHA256 884f594a3cf7e2fa2616d35d25b7f98c1466fb32c3e3979c26d158a6775c36ba MISC metadata.xml 501 RMD160 74dd36daa51d7ad5ce1659f0279e1245cd1ef4bc SHA1 e447d21dc61ee4a6de8cc0f66aa28aa422d9990a SHA256 5f399b83a90977486ff92847caa884d16f8b71705fd0d2203acb35f56c9a6db6 diff --git a/app-admin/sudo/files/sudo-1.6.9_p13-ssh_client.diff b/app-admin/sudo/files/sudo-1.6.9_p13-ssh_client.diff new file mode 100644 index 0000000..b53ebbc --- /dev/null +++ b/app-admin/sudo/files/sudo-1.6.9_p13-ssh_client.diff @@ -0,0 +1,46 @@ +diff -uNr -r sudo-1.6.9p13.orig/logging.c sudo-1.6.9p13/logging.c +--- sudo-1.6.9p13.orig/logging.c 2007-11-25 14:07:38.000000000 +0100 ++++ sudo-1.6.9p13/logging.c 2008-05-22 14:40:04.000000000 +0200 +@@ -313,9 +313,9 @@ + strlcat(evstr, " ", len); /* NOTE: last one will fail */ + } + } +- easprintf(&logline, "%sTTY=%s ; PWD=%s ; USER=%s%s ; COMMAND=%s%s%s", ++ easprintf(&logline, "%sTTY=%s ; PWD=%s ; USER=%s%s ; COMMAND=%s%s%s ; SSH_CLIENT=%s", + message, user_tty, user_cwd, *user_runas, evstr ? evstr : "", +- user_cmnd, user_args ? " " : "", user_args ? user_args : ""); ++ user_cmnd, user_args ? " " : "", user_args ? user_args : "", user_ssh_client ? user_ssh_client : "" ); + + mail_auth(status, logline); /* send mail based on status */ + +diff -uNr -r sudo-1.6.9p13.orig/sudo.c sudo-1.6.9p13/sudo.c +--- sudo-1.6.9p13.orig/sudo.c 2008-02-09 15:44:48.000000000 +0100 ++++ sudo-1.6.9p13/sudo.c 2008-05-22 14:37:03.000000000 +0200 +@@ -568,6 +568,8 @@ + user_prompt = *ep + 12; + else if (strncmp("SUDO_USER=", *ep, 10) == 0) + prev_user = *ep + 10; ++ else if (strncmp("SSH_CLIENT=", *ep, 11) == 0) ++ user_ssh_client = *ep + 11; + break; + + } +diff -uNr -r sudo-1.6.9p13.orig/sudo.h sudo-1.6.9p13/sudo.h +--- sudo-1.6.9p13.orig/sudo.h 2008-02-09 15:44:48.000000000 +0100 ++++ sudo-1.6.9p13/sudo.h 2008-05-22 14:40:36.000000000 +0200 +@@ -38,6 +38,7 @@ + struct stat *cmnd_stat; + char *path; + char *shell; ++ char *user_ssh_client; + char *tty; + char *ttypath; + char cwd[PATH_MAX]; +@@ -136,6 +137,7 @@ + #define user_gid (sudo_user.pw->pw_gid) + #define user_dir (sudo_user.pw->pw_dir) + #define user_shell (sudo_user.shell) ++#define user_ssh_client (sudo_user.user_ssh_client) + #define user_ngroups (sudo_user.ngroups) + #define user_groups (sudo_user.groups) + #define user_tty (sudo_user.tty) diff --git a/app-admin/sudo/files/sudo-1.6.9_p16-ssh_client.diff b/app-admin/sudo/files/sudo-1.6.9_p16-ssh_client.diff new file mode 100644 index 0000000..b53ebbc --- /dev/null +++ b/app-admin/sudo/files/sudo-1.6.9_p16-ssh_client.diff @@ -0,0 +1,46 @@ +diff -uNr -r sudo-1.6.9p13.orig/logging.c sudo-1.6.9p13/logging.c +--- sudo-1.6.9p13.orig/logging.c 2007-11-25 14:07:38.000000000 +0100 ++++ sudo-1.6.9p13/logging.c 2008-05-22 14:40:04.000000000 +0200 +@@ -313,9 +313,9 @@ + strlcat(evstr, " ", len); /* NOTE: last one will fail */ + } + } +- easprintf(&logline, "%sTTY=%s ; PWD=%s ; USER=%s%s ; COMMAND=%s%s%s", ++ easprintf(&logline, "%sTTY=%s ; PWD=%s ; USER=%s%s ; COMMAND=%s%s%s ; SSH_CLIENT=%s", + message, user_tty, user_cwd, *user_runas, evstr ? evstr : "", +- user_cmnd, user_args ? " " : "", user_args ? user_args : ""); ++ user_cmnd, user_args ? " " : "", user_args ? user_args : "", user_ssh_client ? user_ssh_client : "" ); + + mail_auth(status, logline); /* send mail based on status */ + +diff -uNr -r sudo-1.6.9p13.orig/sudo.c sudo-1.6.9p13/sudo.c +--- sudo-1.6.9p13.orig/sudo.c 2008-02-09 15:44:48.000000000 +0100 ++++ sudo-1.6.9p13/sudo.c 2008-05-22 14:37:03.000000000 +0200 +@@ -568,6 +568,8 @@ + user_prompt = *ep + 12; + else if (strncmp("SUDO_USER=", *ep, 10) == 0) + prev_user = *ep + 10; ++ else if (strncmp("SSH_CLIENT=", *ep, 11) == 0) ++ user_ssh_client = *ep + 11; + break; + + } +diff -uNr -r sudo-1.6.9p13.orig/sudo.h sudo-1.6.9p13/sudo.h +--- sudo-1.6.9p13.orig/sudo.h 2008-02-09 15:44:48.000000000 +0100 ++++ sudo-1.6.9p13/sudo.h 2008-05-22 14:40:36.000000000 +0200 +@@ -38,6 +38,7 @@ + struct stat *cmnd_stat; + char *path; + char *shell; ++ char *user_ssh_client; + char *tty; + char *ttypath; + char cwd[PATH_MAX]; +@@ -136,6 +137,7 @@ + #define user_gid (sudo_user.pw->pw_gid) + #define user_dir (sudo_user.pw->pw_dir) + #define user_shell (sudo_user.shell) ++#define user_ssh_client (sudo_user.user_ssh_client) + #define user_ngroups (sudo_user.ngroups) + #define user_groups (sudo_user.groups) + #define user_tty (sudo_user.tty) diff --git a/app-admin/sudo/files/sudo-1.7.0_rc1-ssh_client.diff b/app-admin/sudo/files/sudo-1.7.0_rc1-ssh_client.diff new file mode 100644 index 0000000..e187a05 --- /dev/null +++ b/app-admin/sudo/files/sudo-1.7.0_rc1-ssh_client.diff @@ -0,0 +1,65 @@ +diff -uNr -r sudo-1.7.0rc1.orig/logging.c sudo-1.7.0rc1/logging.c +--- sudo-1.7.0rc1.orig/logging.c 2008-03-18 21:00:52.000000000 +0100 ++++ sudo-1.7.0rc1/logging.c 2008-05-22 16:12:11.000000000 +0200 +@@ -613,6 +613,7 @@ + #define LL_GROUP_STR "GROUP=" + #define LL_ENV_STR "ENV=" + #define LL_CMND_STR "COMMAND=" ++#define LL_ENV_SSH_CLIENT "SSH_CLIENT=" + + /* + * Allocate and fill in a new logline. +@@ -642,6 +643,8 @@ + len += sizeof(LL_USER_STR) + 2 + strlen(runas_pw->pw_name); + if (runas_gr != NULL) + len += sizeof(LL_GROUP_STR) + 2 + strlen(runas_gr->gr_name); ++ if (user_ssh_client != NULL) ++ len += sizeof(LL_ENV_SSH_CLIENT) + 2 + strlen(user_ssh_client); + if (sudo_user.env_vars != NULL) { + size_t evlen = 0; + struct list_member *cur; +@@ -710,6 +713,13 @@ + strlcat(line, user_args, len) >= len) + goto toobig; + } ++ if (user_ssh_client != NULL) { ++ if (strlcat(line, " ; ", len) >= len || ++ strlcat(line, LL_ENV_SSH_CLIENT, len) >= len || ++ strlcat(line, user_ssh_client, len) >= len) ++ goto toobig; ++ efree(evstr); ++ } + + return (line); + toobig: +diff -uNr -r sudo-1.7.0rc1.orig/sudo.c sudo-1.7.0rc1/sudo.c +--- sudo-1.7.0rc1.orig/sudo.c 2008-05-03 02:53:20.000000000 +0200 ++++ sudo-1.7.0rc1/sudo.c 2008-05-22 16:10:26.000000000 +0200 +@@ -632,6 +632,8 @@ + prev_user = *ep + 10; + else if (strncmp("SUDO_ASKPASS=", *ep, 13) == 0) + user_askpass = *ep + 13; ++ else if (strncmp("SSH_CLIENT=", *ep, 11) == 0) ++ user_ssh_client = *ep + 11; + break; + } + } +diff -uNr -r sudo-1.7.0rc1.orig/sudo.h sudo-1.7.0rc1/sudo.h +--- sudo-1.7.0rc1.orig/sudo.h 2008-05-03 02:53:20.000000000 +0200 ++++ sudo-1.7.0rc1/sudo.h 2008-05-22 16:08:30.000000000 +0200 +@@ -43,6 +43,7 @@ + struct stat *cmnd_stat; + char *path; + char *shell; ++ char *user_ssh_client; + char *tty; + char *ttypath; + char *host; +@@ -161,6 +162,7 @@ + #define runas_gr (sudo_user._runas_gr) + #define user_role (sudo_user.role) + #define user_type (sudo_user.type) ++#define user_ssh_client (sudo_user.user_ssh_client) + + /* + * We used to use the system definition of PASS_MAX or _PASSWD_LEN, diff --git a/app-admin/sudo/sudo-1.6.9_p13.ebuild b/app-admin/sudo/sudo-1.6.9_p13.ebuild new file mode 100644 index 0000000..acc0bc4 --- /dev/null +++ b/app-admin/sudo/sudo-1.6.9_p13.ebuild @@ -0,0 +1,190 @@ +# Copyright 1999-2008 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.9_p13.ebuild,v 1.10 2008/05/13 17:20:53 jer Exp $ + +inherit eutils pam confutils + +DESCRIPTION="Allows users or groups to run commands as other users" +HOMEPAGE="http://www.sudo.ws/" +SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${P/_/}.tar.gz" +LICENSE="Sudo" +SLOT="0" +KEYWORDS="alpha amd64 ~arm hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc ~sparc-fbsd x86 ~x86-fbsd" +IUSE="pam skey offensive ldap selinux" + +DEPEND="pam? ( virtual/pam ) + ldap? ( >=net-nds/openldap-2.1.30-r1 ) + skey? ( >=sys-auth/skey-1.1.5-r1 ) + virtual/editor + virtual/mta" +RDEPEND="selinux? ( sec-policy/selinux-sudo ) + ldap? ( dev-lang/perl ) + ${DEPEND}" +DEPEND="${RDEPEND} sys-devel/bison" + +S=${WORKDIR}/${P/_/} + +pkg_setup() { + confutils_use_conflict skey pam +} + +src_unpack() { + unpack ${A}; cd "${S}" + + # falco's patch for logging and pam + epatch "${FILESDIR}"/${P}-ssh_client.diff + + # compatability fix. + epatch "${FILESDIR}"/${PN}-skeychallengeargs.diff + + # additional variables to disallow, should user disable env_reset. + + # NOTE: this is not a supported mode of operation, these variables + # are added to the blacklist as a convenience to administrators + # who fail to heed the warnings of allowing untrusted users + # to access sudo. + # + # there is *no possible way* to foresee all attack vectors in + # all possible applications that could potentially be used via + # sudo, these settings will just delay the inevitable. + # + # that said, I will accept suggestions for variables that can + # be misused in _common_ interpreters or libraries, such as + # perl, bash, python, ruby, etc., in the hope of dissuading + # a casual attacker. + + # XXX: perl should be using suid_perl. + # XXX: users can remove/add more via env_delete and env_check. + # XXX: <?> = probably safe enough for most circumstances. + + einfo "Blacklisting common variables (env_delete)..." + sudo_bad_var 'PERLIO_DEBUG' # perl, write debug to file. + sudo_bad_var 'FPATH' # ksh, search path for functions. + sudo_bad_var 'NULLCMD' # zsh, command on null-redir. <?> + sudo_bad_var 'READNULLCMD' # zsh, command on null-redir. <?> + sudo_bad_var 'GLOBIGNORE' # bash, glob paterns to ignore. <?> + sudo_bad_var 'PYTHONHOME' # python, module search path. + sudo_bad_var 'PYTHONPATH' # python, search path. + sudo_bad_var 'PYTHONINSPECT' # python, allow inspection. + sudo_bad_var 'RUBYLIB' # ruby, lib load path. + sudo_bad_var 'RUBYOPT' # ruby, cl options. + sudo_bad_var 'ZDOTDIR' # zsh, path to search for dotfiles. + einfo "...done." + + # prevent binaries from being stripped. + sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in + + # remove useless c++ checks + epunt_cxx +} + +src_compile() { + local line ROOTPATH + + # FIXME: secure_path is a compile time setting. using ROOTPATH + # is not perfect, env-update may invalidate this, but until it + # is available as a sudoers setting this will have to do. + einfo "Setting secure_path..." + + # why not use grep? variable might be expanded from other variables + # declared in that file. cannot just source the file, would override + # any variables already set. + eval `PS4= bash -x /etc/profile.env 2>&1 | \ + while read line; do + case $line in + ROOTPATH=*) echo $line; break;; + *) continue;; + esac + done` && einfo " Found ROOTPATH..." || \ + ewarn " Failed to find ROOTPATH, please report this." + + # remove any duplicate entries + ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}) + + # strip gcc path (bug #136027) + rmpath ROOTPATH '*/gcc-bin/*' + + einfo "...done." + + # XXX: --disable-path-info closes an info leak, but may be confusing. + # XXX: /bin/vi may not be available, make nano visudo's default. + econf --with-secure-path="${ROOTPATH}" \ + --with-editor=/bin/nano \ + --with-env-editor \ + $(use_with offensive insults) \ + $(use_with offensive all-insults) \ + $(use_with pam) \ + $(use_with skey) \ + $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \ + $(use_with ldap) || die + + emake || die +} + +src_install() { + emake -j1 DESTDIR="${D}" install || die + dodoc BUGS CHANGES HISTORY PORTING README TROUBLESHOOTING \ + UPGRADE sample.sudoers sample.syslog.conf + + if use ldap; then + dodoc README.LDAP schema.OpenLDAP + dosbin sudoers2ldif + + cat - > "${T}"/ldap.conf.sudo <<EOF +# See ldap.conf(5) and README.LDAP for details\n" +# This file should only be readable by root\n\n" +# supported directives: host, port, ssl, ldap_version\n" +# uri, binddn, bindpw, sudoers_base, sudoers_debug\n" +# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key +EOF + + insinto /etc + doins "${T}"/ldap.conf.sudo + fperms 0440 /etc/ldap.conf.sudo + fi + + pamd_mimic system-auth sudo auth account password session + + insinto /etc + doins "${FILESDIR}"/sudoers + fperms 0440 /etc/sudoers +} + +# remove duplicate path entries from $1 +cleanpath() { + local i=1 x n IFS=: + local -a paths; paths=($1) + + for ((n=${#paths[*]}-1;i<=n;i++)); do + for ((x=0;x<i;x++)); do + test "${paths[i]}" == "${paths[x]}" && { + einfo " Duplicate entry ${paths[i]} removed..." 1>&2 + unset paths[i]; continue 2; } + done; # einfo " Adding ${paths[i]}..." 1>&2 + done; echo "${paths[*]}" +} + +# add $1 to default env_delete list. +sudo_bad_var() { + local target='env.c' marker='\*initial_badenv_table\[\]' + + ebegin " $1" + sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' "${S}"/${target} + eend $? +} + +rmpath() { + declare e newpath oldpath=${!1} PATHvar=$1 thisp IFS=: + shift + for thisp in $oldpath; do + for e; do [[ $thisp == $e ]] && continue 2; done + newpath=$newpath:$thisp + done + eval $PATHvar='${newpath#:}' +} + +pkg_postinst() { + use ldap && { + ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration." + } +} diff --git a/app-admin/sudo/sudo-1.6.9_p16.ebuild b/app-admin/sudo/sudo-1.6.9_p16.ebuild new file mode 100644 index 0000000..85c47ac --- /dev/null +++ b/app-admin/sudo/sudo-1.6.9_p16.ebuild @@ -0,0 +1,191 @@ +# Copyright 1999-2008 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.9_p16.ebuild,v 1.2 2008/05/11 17:22:36 flameeyes Exp $ + +inherit eutils pam confutils + +DESCRIPTION="Allows users or groups to run commands as other users" +HOMEPAGE="http://www.sudo.ws/" +SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${P/_/}.tar.gz" +LICENSE="Sudo" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd" +IUSE="pam skey offensive ldap selinux" + +DEPEND="pam? ( virtual/pam ) + ldap? ( >=net-nds/openldap-2.1.30-r1 ) + skey? ( >=sys-auth/skey-1.1.5-r1 ) + virtual/editor + virtual/mta" +RDEPEND="selinux? ( sec-policy/selinux-sudo ) + ldap? ( dev-lang/perl ) + pam? ( sys-auth/pambase ) + ${DEPEND}" +DEPEND="${RDEPEND} sys-devel/bison" + +S=${WORKDIR}/${P/_/} + +pkg_setup() { + confutils_use_conflict skey pam +} + +src_unpack() { + unpack ${A}; cd "${S}" + + # falco's patch for logging and pam + epatch "${FILESDIR}"/${P}-ssh_client.diff + + # compatability fix. + epatch "${FILESDIR}"/${PN}-skeychallengeargs.diff + + # additional variables to disallow, should user disable env_reset. + + # NOTE: this is not a supported mode of operation, these variables + # are added to the blacklist as a convenience to administrators + # who fail to heed the warnings of allowing untrusted users + # to access sudo. + # + # there is *no possible way* to foresee all attack vectors in + # all possible applications that could potentially be used via + # sudo, these settings will just delay the inevitable. + # + # that said, I will accept suggestions for variables that can + # be misused in _common_ interpreters or libraries, such as + # perl, bash, python, ruby, etc., in the hope of dissuading + # a casual attacker. + + # XXX: perl should be using suid_perl. + # XXX: users can remove/add more via env_delete and env_check. + # XXX: <?> = probably safe enough for most circumstances. + + einfo "Blacklisting common variables (env_delete)..." + sudo_bad_var 'PERLIO_DEBUG' # perl, write debug to file. + sudo_bad_var 'FPATH' # ksh, search path for functions. + sudo_bad_var 'NULLCMD' # zsh, command on null-redir. <?> + sudo_bad_var 'READNULLCMD' # zsh, command on null-redir. <?> + sudo_bad_var 'GLOBIGNORE' # bash, glob paterns to ignore. <?> + sudo_bad_var 'PYTHONHOME' # python, module search path. + sudo_bad_var 'PYTHONPATH' # python, search path. + sudo_bad_var 'PYTHONINSPECT' # python, allow inspection. + sudo_bad_var 'RUBYLIB' # ruby, lib load path. + sudo_bad_var 'RUBYOPT' # ruby, cl options. + sudo_bad_var 'ZDOTDIR' # zsh, path to search for dotfiles. + einfo "...done." + + # prevent binaries from being stripped. + sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in + + # remove useless c++ checks + epunt_cxx +} + +src_compile() { + local line ROOTPATH + + # FIXME: secure_path is a compile time setting. using ROOTPATH + # is not perfect, env-update may invalidate this, but until it + # is available as a sudoers setting this will have to do. + einfo "Setting secure_path..." + + # why not use grep? variable might be expanded from other variables + # declared in that file. cannot just source the file, would override + # any variables already set. + eval `PS4= bash -x /etc/profile.env 2>&1 | \ + while read line; do + case $line in + ROOTPATH=*) echo $line; break;; + *) continue;; + esac + done` && einfo " Found ROOTPATH..." || \ + ewarn " Failed to find ROOTPATH, please report this." + + # remove any duplicate entries + ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}) + + # strip gcc path (bug #136027) + rmpath ROOTPATH '*/gcc-bin/*' + + einfo "...done." + + # XXX: --disable-path-info closes an info leak, but may be confusing. + # XXX: /bin/vi may not be available, make nano visudo's default. + econf --with-secure-path="${ROOTPATH}" \ + --with-editor=/bin/nano \ + --with-env-editor \ + $(use_with offensive insults) \ + $(use_with offensive all-insults) \ + $(use_with pam) \ + $(use_with skey) \ + $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \ + $(use_with ldap) || die + + emake || die +} + +src_install() { + emake -j1 DESTDIR="${D}" install || die + dodoc BUGS CHANGES HISTORY PORTING README TROUBLESHOOTING \ + UPGRADE sample.sudoers sample.syslog.conf + + if use ldap; then + dodoc README.LDAP schema.OpenLDAP + dosbin sudoers2ldif + + cat - > "${T}"/ldap.conf.sudo <<EOF +# See ldap.conf(5) and README.LDAP for details\n" +# This file should only be readable by root\n\n" +# supported directives: host, port, ssl, ldap_version\n" +# uri, binddn, bindpw, sudoers_base, sudoers_debug\n" +# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key +EOF + + insinto /etc + doins "${T}"/ldap.conf.sudo + fperms 0440 /etc/ldap.conf.sudo + fi + + pamd_mimic system-auth sudo auth account password session + + insinto /etc + doins "${FILESDIR}"/sudoers + fperms 0440 /etc/sudoers +} + +# remove duplicate path entries from $1 +cleanpath() { + local i=1 x n IFS=: + local -a paths; paths=($1) + + for ((n=${#paths[*]}-1;i<=n;i++)); do + for ((x=0;x<i;x++)); do + test "${paths[i]}" == "${paths[x]}" && { + einfo " Duplicate entry ${paths[i]} removed..." 1>&2 + unset paths[i]; continue 2; } + done; # einfo " Adding ${paths[i]}..." 1>&2 + done; echo "${paths[*]}" +} + +# add $1 to default env_delete list. +sudo_bad_var() { + local target='env.c' marker='\*initial_badenv_table\[\]' + + ebegin " $1" + sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' "${S}"/${target} + eend $? +} + +rmpath() { + declare e newpath oldpath=${!1} PATHvar=$1 thisp IFS=: + shift + for thisp in $oldpath; do + for e; do [[ $thisp == $e ]] && continue 2; done + newpath=$newpath:$thisp + done + eval $PATHvar='${newpath#:}' +} + +pkg_postinst() { + use ldap && { + ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration." + } +} diff --git a/app-admin/sudo/sudo-1.7.0_rc1.ebuild b/app-admin/sudo/sudo-1.7.0_rc1.ebuild new file mode 100644 index 0000000..0036a0b --- /dev/null +++ b/app-admin/sudo/sudo-1.7.0_rc1.ebuild @@ -0,0 +1,211 @@ +# Copyright 1999-2008 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.7.0_rc1.ebuild,v 1.2 2008/05/11 17:22:36 flameeyes Exp $ + +inherit eutils pam confutils + +MY_P=${P/_/} +MY_P=${MY_P/beta/b} + +case "${P}" in + *_beta* | *_rc*) + uri_prefix=beta/ + ;; + *) + uri_prefix="" + ;; +esac + +DESCRIPTION="Allows users or groups to run commands as other users" +HOMEPAGE="http://www.sudo.ws/" +SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz" +LICENSE="Sudo" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd" +IUSE="pam skey offensive ldap selinux" + +DEPEND="pam? ( virtual/pam ) + ldap? ( >=net-nds/openldap-2.1.30-r1 ) + skey? ( >=sys-auth/skey-1.1.5-r1 ) + virtual/editor + virtual/mta" +RDEPEND="selinux? ( sec-policy/selinux-sudo ) + ldap? ( dev-lang/perl ) + pam? ( sys-auth/pambase ) + ${DEPEND}" +DEPEND="${RDEPEND} sys-devel/bison" + +S=${WORKDIR}/${MY_P} + +pkg_setup() { + confutils_use_conflict skey pam +} + +src_unpack() { + unpack ${A}; cd "${S}" + + # falco's patch for logging and pam + epatch "${FILESDIR}"/${P}-ssh_client.diff + + # compatability fix. + epatch "${FILESDIR}"/${PN}-skeychallengeargs.diff + + # additional variables to disallow, should user disable env_reset. + + # NOTE: this is not a supported mode of operation, these variables + # are added to the blacklist as a convenience to administrators + # who fail to heed the warnings of allowing untrusted users + # to access sudo. + # + # there is *no possible way* to foresee all attack vectors in + # all possible applications that could potentially be used via + # sudo, these settings will just delay the inevitable. + # + # that said, I will accept suggestions for variables that can + # be misused in _common_ interpreters or libraries, such as + # perl, bash, python, ruby, etc., in the hope of dissuading + # a casual attacker. + + # XXX: perl should be using suid_perl. + # XXX: users can remove/add more via env_delete and env_check. + # XXX: <?> = probably safe enough for most circumstances. + + einfo "Blacklisting common variables (env_delete)..." + sudo_bad_var() { + local target='env.c' marker='\*initial_badenv_table\[\]' + + ebegin " $1" + sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' "${S}"/${target} + eend $? + } + + sudo_bad_var 'PERLIO_DEBUG' # perl, write debug to file. + sudo_bad_var 'FPATH' # ksh, search path for functions. + sudo_bad_var 'NULLCMD' # zsh, command on null-redir. <?> + sudo_bad_var 'READNULLCMD' # zsh, command on null-redir. <?> + sudo_bad_var 'GLOBIGNORE' # bash, glob paterns to ignore. <?> + sudo_bad_var 'PYTHONHOME' # python, module search path. + sudo_bad_var 'PYTHONPATH' # python, search path. + sudo_bad_var 'PYTHONINSPECT' # python, allow inspection. + sudo_bad_var 'RUBYLIB' # ruby, lib load path. + sudo_bad_var 'RUBYOPT' # ruby, cl options. + sudo_bad_var 'ZDOTDIR' # zsh, path to search for dotfiles. + einfo "...done." + + # prevent binaries from being stripped. + sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in + + # remove useless c++ checks + epunt_cxx +} + +src_compile() { + local line ROOTPATH + + # FIXME: secure_path is a compile time setting. using ROOTPATH + # is not perfect, env-update may invalidate this, but until it + # is available as a sudoers setting this will have to do. + einfo "Setting secure_path..." + + # why not use grep? variable might be expanded from other variables + # declared in that file. cannot just source the file, would override + # any variables already set. + eval `PS4= bash -x /etc/profile.env 2>&1 | \ + while read line; do + case $line in + ROOTPATH=*) echo $line; break;; + *) continue;; + esac + done` && einfo " Found ROOTPATH..." || \ + ewarn " Failed to find ROOTPATH, please report this." + + # remove duplicate path entries from $1 + cleanpath() { + local i=1 x n IFS=: + local -a paths; paths=($1) + + for ((n=${#paths[*]}-1;i<=n;i++)); do + for ((x=0;x<i;x++)); do + test "${paths[i]}" == "${paths[x]}" && { + einfo " Duplicate entry ${paths[i]} removed..." 1>&2 + unset paths[i]; continue 2; } + done; # einfo " Adding ${paths[i]}..." 1>&2 + done; echo "${paths[*]}" + } + + ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}) + + # strip gcc path (bug #136027) + rmpath() { + declare e newpath oldpath=${!1} PATHvar=$1 thisp IFS=: + shift + for thisp in $oldpath; do + for e; do [[ $thisp == $e ]] && continue 2; done + newpath=$newpath:$thisp + done + eval $PATHvar='${newpath#:}' + } + + rmpath ROOTPATH '*/gcc-bin/*' + + einfo "...done." + + # XXX: --disable-path-info closes an info leak, but may be confusing. + # XXX: /bin/vi may not be available, make nano visudo's default. + econf --with-secure-path="${ROOTPATH}" \ + --with-editor=/bin/nano \ + --with-env-editor \ + $(use_with offensive insults) \ + $(use_with offensive all-insults) \ + $(use_with pam) \ + $(use_with skey) \ + $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \ + $(use_with ldap) || die + + emake || die +} + +src_install() { + emake -j1 DESTDIR="${D}" install || die + dodoc ChangeLog HISTORY PORTING README TROUBLESHOOTING \ + UPGRADE sample.sudoers sample.syslog.conf + + if use ldap; then + dodoc README.LDAP schema.OpenLDAP + dosbin sudoers2ldif + + cat - > "${T}"/ldap.conf.sudo <<EOF +# See ldap.conf(5) and README.LDAP for details\n" +# This file should only be readable by root\n\n" +# supported directives: host, port, ssl, ldap_version\n" +# uri, binddn, bindpw, sudoers_base, sudoers_debug\n" +# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key +EOF + + insinto /etc + doins "${T}"/ldap.conf.sudo + fperms 0440 /etc/ldap.conf.sudo + fi + + pamd_mimic system-auth sudo auth account password session + + insinto /etc + doins "${FILESDIR}"/sudoers + fperms 0440 /etc/sudoers +} + +pkg_postinst() { + if use ldap; then + ewarn + ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration." + ewarn + if egrep -q '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf; then + ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly" + ewarn "configured in /etc/nsswitch.conf." + ewarn + ewarn "To make use of LDAP, add this line to your /etc/nsswitch.conf:" + ewarn " sudoers: ldap files" + ewarn + fi + fi +} |