sudo 1.6.9.17 security =462

Allow others to run commands as root
Maintained by: tmclaugh@FreeBSD.org
Port Added: unknown

---

---

This is the CU version of sudo.

Sudo is a program designed to allow a sysadmin to give limited root
privileges to users and log root activity.  The basic philosophy is to
give as few privileges as possible but still allow people to get their
work done.

MAILING LISTS:

Please send bugs, problems, comments, etc to sudo-bugs@courtesan.com
There is a mailing list that receives announcements whenever a new
version of sudo is released.  You can subscribe to it by sending a
message to "majordomo@courtesan.com" that includes the line
"subscribe sudo-announce".  There is also a list for people working
on sudo.  The command to add yourself is "subscribe sudo-workers".

WWW: http://www.courtesan.com/sudo/

CVSWeb : Sources : Main Web Site : Distfiles Availability : PortsMon

---

To install the port: cd /usr/ports/security/sudo/ && make install clean
To add the package: pkg_add -r sudo

---

Configuration Options

===> The following configuration options are available for sudo-1.6.9.17:
     LDAP=off (default) "With LDAP support"
     INSULTS=off (default) "With all insults"
     SHELL_SETS_HOME=off (default) "Set HOME env to target user in shell mode"
===> Use 'make config' to modify these settings

---

Master Sites:

http://www.sudo.ws/sudo/dist/

ftp://obsd.isc.org/pub/sudo/

ftp://ftp.uwsg.indiana.edu/pub/security/sudo/

ftp://boulder.tele.dk/pub/sudo/

ftp://core.ring.gr.jp/pub/misc/sudo/

ftp://ftp.wiretapped.net/pub/security/host-security/sudo/

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/tmclaugh/sudo/

ftp://ftp.se.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/tmclaugh/sudo/

ftp://ftp.uk.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/tmclaugh/sudo/

ftp://ftp.ru.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/tmclaugh/sudo/

ftp://ftp.jp.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/tmclaugh/sudo/

ftp://ftp.tw.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/tmclaugh/sudo/

ftp://ftp.cn.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/tmclaugh/sudo/

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/

Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script.
Specifically, newer autoconf (> 2.13) has different semantic of the
configure target. In short, one should use --build=CONFIGURE_TARGET
instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning
and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk

- Update to 1.6.9p17
* the -i flag implies resetting the environment as it did prior to
  1.6.9.  The -i and -E flags are now mutually-exclusive.

- Fix pkg-plist, libtool archive is no longer installed.

Prompted by:    pavmail

- Update to 1.6.9p15
* The HOME environment variable is once again preserved by default, as per
  the documentation.

- Finally remember to fix the $FreeBSD$ line in pam file.

- Update to 1.6.9p14

* Check sudoers even if user is found in LDAP so Defaults can take
  effect.
* Fix crash when pam_lastlog is (incorrectly) usesd in session section
  of PAM file.

Update to 1.6.9p12

Changes:
- The ALL command in sudoers now implies SETENV permissions.
- The command search is now performed using the target user's auxiliary
  group vector too.
- Various LDAP code improvements.
- Added passprompt_override flag to sudoers to cause sudo's prompt to be
  used in all cases.  Also set when the -p flag is used.
- New %p prompt escape that expands to the user whose password is being
  prompted, as specified by the rootpw, targetpw and runaspw sudoers
  flags.

- Make fetchable again.  Add my MASTER_SITE_LOCAL to the mix and replace
  a number of outdated sites.

Notified by:    Ferenc Gartner
Approved by:    portmgr (linimon, erwin)

Update to 1.6.9p6
- Sudo now only prints the password prompt if the process is in the
  foreground.

Update to 1.6.9p5:
- Fixed a bug in the IP address matching introduced by the IPV6 merge.
- Fixed sudoedit when used on a non-existent file.
- Groups and netgroups are now valid in an LDAP sudoRunas statement.

Install schema.OpenLDAP into DOCSDIR.

Prompted by:    flz

Update to 1.6.9p4
- IPv6 support added.
- Added notes to default sudoers for handling environmental variables
  related to our pkg_* tools and portupgrade.

- Work around broken configure script and explicitly set location of
  sudo_noexec.so to unbreak NOEXEC option. [1]
- Build using --with-secure-path if SUDO_SECURE_PATH is set when
  building the port.  SUDO_SECURE_PATH should be set to a PATH string.
  [2]
- Don't bother deleting sudo_noexec.la.  Deleting the file after it's
  installed is ugly and since it's not harmful it's not worth patching
  the install.
- Set CONFIGURE_TARGET.

PR:             115442 [1], 115381 [2]
Submitted by:   vd [1], Janos Mohacsi [2]

Fix session stack in default pam file.

Update to 1.6.9p3
- Fixes bug related to supplemental group matching

Update to 1.6.9p2
- Environment handling fix.

Fix PORTVERSION

Noticed by:     ume

- Update to 1.6.9p1
  * Worked around a bug in some PAM implementations that caused a crash
    when no tty was present.
  * Fixed a crash on some platforms in the error logging function.
- Change default pam session stack to pam_permit like su does [1]
- Grab maintainership

Sugested by:    des [1]

- Fix segfault when there is no TTY when executing. [1]
- Temporarilly disable session entry in default pam file because
  pam_lastlog causes users to appear as though they have logged out in
  system logs. [2]

Reported by:    yarodin@gmail.com [1], Paul Fraser <pfraser@gmail.com> [2]
Submitted by:   Todd Miller [1]

Update to 1.6.9

Application changes:
- PAM, since present, is used by default.
- Environment variable handling has changed significantly.
- Sudo checks the user's supplemental group vector so nsswitch order is
  no longer important for group based rules.
(See UPGRADE and CHANGING under share/doc/sudo/ for more.)

Port changes:
- PAM file is no longer clobered on reinstall.
- OPIE option has been removed due to PAM being used by default.
- Selected documentation is now installed.

- Add an option to enable insults

Submitted by:   Dan Casey <dcasey@debtresolve.com>

Install a PAM policy, rather than just suggesting that the admin do so.

Reset mharo due to maintainer-timeouts and no response to PRs.

Hat:            portmgr

fix option text

Reported by: Nick Fishman <kwlogical@bellsouth.net>

- Add LDAP support (off by default)
- OPTIONS'fy
- Remove obsoleted USE_REINPLACE

PR:             ports/95598
Submitted by:   Dmitriy Kirhlarov <dkirhlarov@localhost.oilspace.com>
Approved by:    maintainer timeout (2 weeks)

SHA256ify

Approved by: krion@

- Remove etc/sudoers on deinstall if user haven't modified it

PR:             ports/69288 (based on)
Approved by:    maintainer timeout (mharo; year and a half)

Upgrade to 1.6.8.12

PR:             88865
Submitted by:   Phil Oleson <oz@nixil.net>

Security update to latest release: 1.6.8p9.

<Security Alert>
Summary:
A race condition in Sudo's command pathname handling prior
to Sudo version 1.6.8p9 that could allow a user with Sudo
privileges to run arbitrary commands.
Sudo versions affected:
Sudo versions 1.3.1 up to and including 1.6.8p8.
</Security Alert>

More information about this incident available at:
http://www.sudo.ws/sudo/alerts/path_race.html

Upgrade to 1.6.8p8

update to 1.6.8p7

Upgrade to 1.6.8p6

Update to 1.6.8p5

Update to latest release of sudo

Update to sudo-1.6.3p8, which *really* includes the CDPATH fix, and
another one that does not directly affect FreeBSD (our _PATH_VARTMP
was fine before, too).

Approved by:    mharo (maintainer)

strip out CDPATH

Submitted by:   Peter Pentchev <roam@ringlet.net>

Update to 1.6.8p2

 o Bash exported functions and the CDPATH variable are now stripped from
   the environment passed to the program to be executed.

Update to 1.6.8p1

Submitted by:   many people
Approved by:    portsmgr (marcus)

Update to 1.6.8

Undo yesterdays change after sysutils/porttools suddenly failed.

Kris (bento (noh! pointyhat)) reported it

PR:             ports/58387

[PATCH] security/sudo: Utilize EXAMPLESDIR

        Utilize EXAMPLESDIR to improves layout; i.e.,

          configuration file        -> ${PREFIX}/etc
          sample configuration file -> ${PREFIX}/share/examples/${PORTNAME}

        This change helps if many configuration files and sample ones exist.

PR:             ports/58387
Submitted by:   Hideyuki KURASHINA <rushani@FreeBSD.org>

Add SIZE

Add more MASTER_SITES and remove dead one

Add another MASTER_SITE

Submitted by:   "Michael Sharp" <ms@probsd.org>

Add WITH_SHELL_SETS_HOME knob to security/sudo

PR:             47087
Submitted by:       Stefan Farfeleder <stefan@fafoe.dyndns.org>

upgrade from 1.6.7.4 to 1.6.7.5

PR:             52237
Submitted by:   Sergey A. Osokin <osa@FreeBSD.org.ru>

update from 1.6.6 to 1.6.7p4

PR:             51084
Submitted by:   Sergey A. Osokin  <osa@freebsd.org.ru>

Clear moonlight beckons.
Requiem mors pacem pkg-comment,
And be calm ports tree.

E Nomini Patri, E Fili, E Spiritu Sancti.

Add a patch from the Sudo CVS repository for proper handling of
the PAM transition from echoed to non-echoed input.

PR:             46026
Approved by:    mharo (maintainer)

don't depend on perl

Submitted by:   David Yeske <dyeske@yahoo.com>

remove insults and allow root to use sudo

update to 1.6.6

revert change from this morning

Patch sudo 1.6.5.2 with GlobalInterSec's sudo patch.

update to 1.6.5p2    

update the distfile name    

update to 1.6.5p1    

correct checksum    

update to 1.6.5    

update to 1.6.4p2    

Update to 1.6.4.1, which fixes a security hole when sending email  
notifications    

Bump port revision to reflect change in November to pkg-install   which sets the
file permissions on the sudoers file.    

Fix permissions on the sudoers file when installed from package    

Support latest -current which has no libskey.2.    

if the sudoers file is unchanged from the sample one, remove it too    

Use PAM and bump PORTREVISION as a result    

Add WITH_OPIE, which will compile with OPIE instead of S/Key    

update to 1.6.3p7    

Update to 1.6.3p5    

typo clean up police: \s -> \t    

Convert category security to new layout.  

update to p5    

update to 1.6.3p4    

2 vulnerabilities affecting 3 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities