1 |
commit: 28909837d2ce52371aac93d39b0f79297aad09f3 |
2 |
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
3 |
AuthorDate: Mon Mar 30 15:21:30 2020 +0000 |
4 |
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
5 |
CommitDate: Mon Mar 30 15:21:49 2020 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=28909837 |
7 |
|
8 |
app-admin/sudo: security cleanup |
9 |
|
10 |
Bug: https://bugs.gentoo.org/707574 |
11 |
Package-Manager: Portage-2.3.96, Repoman-2.3.22 |
12 |
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> |
13 |
|
14 |
app-admin/sudo/Manifest | 3 - |
15 |
.../sudo-1.8.28-no_pam_error_message_fix.patch | 46 ---- |
16 |
app-admin/sudo/sudo-1.8.28_p1-r2.ebuild | 267 --------------------- |
17 |
app-admin/sudo/sudo-1.8.29-r2.ebuild | 267 --------------------- |
18 |
app-admin/sudo/sudo-1.8.30.ebuild | 263 -------------------- |
19 |
5 files changed, 846 deletions(-) |
20 |
|
21 |
diff --git a/app-admin/sudo/Manifest b/app-admin/sudo/Manifest |
22 |
index 5c165d2900f..223a348e808 100644 |
23 |
--- a/app-admin/sudo/Manifest |
24 |
+++ b/app-admin/sudo/Manifest |
25 |
@@ -1,5 +1,2 @@ |
26 |
-DIST sudo-1.8.28p1.tar.gz 3310254 BLAKE2B a1810af7a42d05cce49bb9d0acf6f3731a5193e9e9c3b458691379131eb86d36995854d11c09525e8d999ed1da7e99cf170634667c5a444aa522b8f23db7d1aa SHA512 bda3de34c15fbb68fc29759542295560ccc1562b419d03709cea51613937e9b92ba689c79c3ef4858aeea90d3d1a4dc0148225b11b22cf82395ae1bad8cb1734 |
27 |
-DIST sudo-1.8.29.tar.gz 3338260 BLAKE2B 7ba29d155bfb1d7ba20e32ade2e8ee3919e70400b6c235e313052b247b48406b9a051e71daa7e47fdb0a9fd0889f4c05b8a1a170c027503b90081e8cec81660e SHA512 ea780922b2afb47df4df4b533fb355fd916cb18a6bfd13c7ca36a25b03ef585d805648c6fa85692bea363b1f83664ac3bc622f99bcd149b3a86f70522eb4d340 |
28 |
-DIST sudo-1.8.30.tar.gz 3349455 BLAKE2B 5e0aaa41f42c18cd0de473add3665adf797cd37eacfb4abfc9472814ea679c1e88e28e95e13a73eb7d9648174609d80a2d4eccf3bdf87a44186df07aeba60eee SHA512 d44831feabd92d736614239e0e0f086829d84b213c98524fffb4b926a96715b1156538a7ab5e0b6e0db8be67a6e24a1642b3648105b076d23b58c39d0dd947af |
29 |
DIST sudo-1.8.31.tar.gz 3350674 BLAKE2B de5a968732fdd58933b4c513d13c43a08cb50075a00c3e0d338c9892570a416a2b3a8f19940c0893715f4eeab991e804831a87ef656ffd91e7f1ba047c119261 SHA512 b9e408a322938c7a712458e9012d8a5f648fba5b23a5057cf5d8372c7f931262595f1575c32c32b9cb1a04af670ff4611e7df48d197e5c4cc038d6b65439a28a |
30 |
DIST sudo-1.8.31p1.tar.gz 3351312 BLAKE2B 85775ef574a3a1a9cc749809fe81f8350f7a4e3f46a905bc3392790b20bb7bc8e3c99fb504e01776f3a92aa6afa7972d3ff1c071aadd3a08ee1d2281f8b9ba50 SHA512 9344fd1d8a8445e8afb9c5628cdc832fe32ea29199f071f35fb6ec694371801556df560f4382afec199f468b1f3264ad5e3a89e964612e571b8d911f823724cc |
31 |
|
32 |
diff --git a/app-admin/sudo/files/sudo-1.8.28-no_pam_error_message_fix.patch b/app-admin/sudo/files/sudo-1.8.28-no_pam_error_message_fix.patch |
33 |
deleted file mode 100644 |
34 |
index 6931ea26c3b..00000000000 |
35 |
--- a/app-admin/sudo/files/sudo-1.8.28-no_pam_error_message_fix.patch |
36 |
+++ /dev/null |
37 |
@@ -1,46 +0,0 @@ |
38 |
- |
39 |
-# HG changeset patch |
40 |
-# User Todd C. Miller <Todd.Miller@××××.ws> |
41 |
-# Date 1573059314 25200 |
42 |
-# Node ID f85ff5ee2caf19cefca67ae49c1d6048d61125cb |
43 |
-# Parent 5cdcfd9a6c33a157a12f1b1893e397c3198b206b |
44 |
-Do not warn about a missing /etc/environment file on Linux without PAM. |
45 |
-Bug #907 |
46 |
- |
47 |
-diff -r 5cdcfd9a6c33 -r f85ff5ee2caf plugins/sudoers/env.c |
48 |
---- a/plugins/sudoers/env.c Tue Nov 05 15:18:34 2019 -0700 |
49 |
-+++ b/plugins/sudoers/env.c Wed Nov 06 09:55:14 2019 -0700 |
50 |
-@@ -940,7 +940,8 @@ |
51 |
- #endif /* HAVE_LOGIN_CAP_H */ |
52 |
- #if defined(_AIX) || (defined(__linux__) && !defined(HAVE_PAM)) |
53 |
- /* Insert system-wide environment variables. */ |
54 |
-- read_env_file(_PATH_ENVIRONMENT, true, false); |
55 |
-+ if (!read_env_file(_PATH_ENVIRONMENT, true, false)) |
56 |
-+ sudo_warn("%s", _PATH_ENVIRONMENT); |
57 |
- #endif |
58 |
- for (ep = env.envp; *ep; ep++) |
59 |
- env_update_didvar(*ep, &didvar); |
60 |
-@@ -1218,8 +1219,10 @@ |
61 |
- efl = calloc(1, sizeof(*efl)); |
62 |
- if (efl != NULL) { |
63 |
- if ((efl->fp = fopen(path, "r")) == NULL) { |
64 |
-- free(efl); |
65 |
-- efl = NULL; |
66 |
-+ if (errno != ENOENT) { |
67 |
-+ free(efl); |
68 |
-+ efl = NULL; |
69 |
-+ } |
70 |
- } |
71 |
- } |
72 |
- debug_return_ptr(efl); |
73 |
-@@ -1259,6 +1262,9 @@ |
74 |
- debug_decl(env_file_next_local, SUDOERS_DEBUG_ENV) |
75 |
- |
76 |
- *errnum = 0; |
77 |
-+ if (efl->fp == NULL) |
78 |
-+ debug_return_ptr(NULL); |
79 |
-+ |
80 |
- for (;;) { |
81 |
- if (sudo_parseln(&efl->line, &efl->linesize, NULL, efl->fp, PARSELN_CONT_IGN) == -1) { |
82 |
- if (!feof(efl->fp)) |
83 |
- |
84 |
|
85 |
diff --git a/app-admin/sudo/sudo-1.8.28_p1-r2.ebuild b/app-admin/sudo/sudo-1.8.28_p1-r2.ebuild |
86 |
deleted file mode 100644 |
87 |
index 47224e32f95..00000000000 |
88 |
--- a/app-admin/sudo/sudo-1.8.28_p1-r2.ebuild |
89 |
+++ /dev/null |
90 |
@@ -1,267 +0,0 @@ |
91 |
-# Copyright 1999-2020 Gentoo Authors |
92 |
-# Distributed under the terms of the GNU General Public License v2 |
93 |
- |
94 |
-EAPI=7 |
95 |
- |
96 |
-inherit pam multilib libtool tmpfiles |
97 |
- |
98 |
-MY_P="${P/_/}" |
99 |
-MY_P="${MY_P/beta/b}" |
100 |
- |
101 |
-DESCRIPTION="Allows users or groups to run commands as other users" |
102 |
-HOMEPAGE="https://www.sudo.ws/" |
103 |
-if [[ ${PV} == "9999" ]] ; then |
104 |
- inherit mercurial |
105 |
- EHG_REPO_URI="https://www.sudo.ws/repos/sudo" |
106 |
-else |
107 |
- uri_prefix= |
108 |
- case ${P} in |
109 |
- *_beta*|*_rc*) uri_prefix=beta/ ;; |
110 |
- esac |
111 |
- |
112 |
- SRC_URI="https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz |
113 |
- ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz" |
114 |
- if [[ ${PV} != *_beta* ]] && [[ ${PV} != *_rc* ]] ; then |
115 |
- KEYWORDS="~alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sparc x86 ~sparc-solaris" |
116 |
- fi |
117 |
-fi |
118 |
- |
119 |
-# Basic license is ISC-style as-is, some files are released under |
120 |
-# 3-clause BSD license |
121 |
-LICENSE="ISC BSD" |
122 |
-SLOT="0" |
123 |
-IUSE="gcrypt ldap libressl nls offensive pam sasl +secure-path selinux +sendmail skey sssd system-digest" |
124 |
- |
125 |
-DEPEND=" |
126 |
- sys-libs/zlib:= |
127 |
- ldap? ( |
128 |
- >=net-nds/openldap-2.1.30-r1 |
129 |
- sasl? ( |
130 |
- dev-libs/cyrus-sasl |
131 |
- net-nds/openldap[sasl] |
132 |
- ) |
133 |
- ) |
134 |
- pam? ( sys-libs/pam ) |
135 |
- sasl? ( dev-libs/cyrus-sasl ) |
136 |
- skey? ( >=sys-auth/skey-1.1.5-r1 ) |
137 |
- sssd? ( sys-auth/sssd[sudo] ) |
138 |
- system-digest? ( |
139 |
- gcrypt? ( dev-libs/libgcrypt:= ) |
140 |
- !gcrypt? ( |
141 |
- !libressl? ( dev-libs/openssl:0= ) |
142 |
- libressl? ( dev-libs/libressl:0= ) |
143 |
- ) |
144 |
- ) |
145 |
-" |
146 |
-RDEPEND=" |
147 |
- ${DEPEND} |
148 |
- >=app-misc/editor-wrapper-3 |
149 |
- virtual/editor |
150 |
- ldap? ( dev-lang/perl ) |
151 |
- pam? ( sys-auth/pambase ) |
152 |
- selinux? ( sec-policy/selinux-sudo ) |
153 |
- sendmail? ( virtual/mta ) |
154 |
-" |
155 |
-BDEPEND=" |
156 |
- sys-devel/bison |
157 |
-" |
158 |
- |
159 |
-S="${WORKDIR}/${MY_P}" |
160 |
- |
161 |
-REQUIRED_USE=" |
162 |
- pam? ( !skey ) |
163 |
- skey? ( !pam ) |
164 |
-" |
165 |
- |
166 |
-MAKEOPTS+=" SAMPLES=" |
167 |
- |
168 |
-PATCHES=( |
169 |
- "${FILESDIR}/${PN}-1.8.28-no_pam_error_message_fix.patch" #698946 |
170 |
-) |
171 |
- |
172 |
-src_prepare() { |
173 |
- default |
174 |
- elibtoolize |
175 |
-} |
176 |
- |
177 |
-set_secure_path() { |
178 |
- # FIXME: secure_path is a compile time setting. using PATH or |
179 |
- # ROOTPATH is not perfect, env-update may invalidate this, but until it |
180 |
- # is available as a sudoers setting this will have to do. |
181 |
- einfo "Setting secure_path ..." |
182 |
- |
183 |
- # first extract the default ROOTPATH from build env |
184 |
- SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; |
185 |
- echo "${ROOTPATH}") |
186 |
- case "${SECURE_PATH}" in |
187 |
- */usr/sbin*) ;; |
188 |
- *) SECURE_PATH=$(unset PATH; |
189 |
- . "${EPREFIX}"/etc/profile.env; echo "${PATH}") |
190 |
- ;; |
191 |
- esac |
192 |
- if [[ -z ${SECURE_PATH} ]] ; then |
193 |
- ewarn " Failed to detect SECURE_PATH, please report this" |
194 |
- fi |
195 |
- |
196 |
- # then remove duplicate path entries |
197 |
- cleanpath() { |
198 |
- local newpath thisp IFS=: |
199 |
- for thisp in $1 ; do |
200 |
- if [[ :${newpath}: != *:${thisp}:* ]] ; then |
201 |
- newpath+=:${thisp} |
202 |
- else |
203 |
- einfo " Duplicate entry ${thisp} removed..." |
204 |
- fi |
205 |
- done |
206 |
- SECURE_PATH=${newpath#:} |
207 |
- } |
208 |
- cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}} |
209 |
- |
210 |
- # finally, strip gcc paths #136027 |
211 |
- rmpath() { |
212 |
- local e newpath thisp IFS=: |
213 |
- for thisp in ${SECURE_PATH} ; do |
214 |
- for e ; do [[ ${thisp} == ${e} ]] && continue 2 ; done |
215 |
- newpath+=:${thisp} |
216 |
- done |
217 |
- SECURE_PATH=${newpath#:} |
218 |
- } |
219 |
- rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*' |
220 |
- |
221 |
- einfo "... done" |
222 |
-} |
223 |
- |
224 |
-src_configure() { |
225 |
- local SECURE_PATH |
226 |
- set_secure_path |
227 |
- |
228 |
- # audit: somebody got to explain me how I can test this before I |
229 |
- # enable it.. - Diego |
230 |
- # plugindir: autoconf code is crappy and does not delay evaluation |
231 |
- # until `make` time, so we have to use a full path here rather than |
232 |
- # basing off other values. |
233 |
- myeconfargs=( |
234 |
- --enable-zlib=system |
235 |
- --enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d |
236 |
- --with-editor="${EPREFIX}"/usr/libexec/editor |
237 |
- --with-env-editor |
238 |
- --with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo |
239 |
- --with-rundir="${EPREFIX}"/run/sudo |
240 |
- $(use_with secure-path secure-path "${SECURE_PATH}") |
241 |
- --with-vardir="${EPREFIX}"/var/db/sudo |
242 |
- --without-linux-audit |
243 |
- --without-opie |
244 |
- $(use_enable gcrypt) |
245 |
- $(use_enable nls) |
246 |
- $(use_enable sasl) |
247 |
- $(use_with offensive insults) |
248 |
- $(use_with offensive all-insults) |
249 |
- $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) |
250 |
- $(use_with ldap) |
251 |
- $(use_with pam) |
252 |
- $(use_with skey) |
253 |
- $(use_with sssd) |
254 |
- $(use_with selinux) |
255 |
- $(use_with sendmail) |
256 |
- ) |
257 |
- |
258 |
- if use system-digest && ! use gcrypt; then |
259 |
- myeconfargs+=("--enable-openssl") |
260 |
- else |
261 |
- myeconfargs+=("--disable-openssl") |
262 |
- fi |
263 |
- |
264 |
- econf "${myeconfargs[@]}" |
265 |
-} |
266 |
- |
267 |
-src_install() { |
268 |
- default |
269 |
- |
270 |
- if use ldap ; then |
271 |
- dodoc README.LDAP |
272 |
- |
273 |
- cat <<-EOF > "${T}"/ldap.conf.sudo |
274 |
- # See ldap.conf(5) and README.LDAP for details |
275 |
- # This file should only be readable by root |
276 |
- |
277 |
- # supported directives: host, port, ssl, ldap_version |
278 |
- # uri, binddn, bindpw, sudoers_base, sudoers_debug |
279 |
- # tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key} |
280 |
- EOF |
281 |
- |
282 |
- if use sasl ; then |
283 |
- cat <<-EOF >> "${T}"/ldap.conf.sudo |
284 |
- |
285 |
- # SASL directives: use_sasl, sasl_mech, sasl_auth_id |
286 |
- # sasl_secprops, rootuse_sasl, rootsasl_auth_id, krb5_ccname |
287 |
- EOF |
288 |
- fi |
289 |
- |
290 |
- insinto /etc |
291 |
- doins "${T}"/ldap.conf.sudo |
292 |
- fperms 0440 /etc/ldap.conf.sudo |
293 |
- |
294 |
- insinto /etc/openldap/schema |
295 |
- newins doc/schema.OpenLDAP sudo.schema |
296 |
- fi |
297 |
- |
298 |
- pamd_mimic system-auth sudo auth account session |
299 |
- |
300 |
- keepdir /var/db/sudo/lectured |
301 |
- fperms 0700 /var/db/sudo/lectured |
302 |
- fperms 0711 /var/db/sudo #652958 |
303 |
- |
304 |
- # Don't install into /run as that is a tmpfs most of the time |
305 |
- # (bug #504854) |
306 |
- rm -rf "${ED}"/run |
307 |
- |
308 |
- find "${ED}" -type f -name "*.la" -delete || die #697812 |
309 |
-} |
310 |
- |
311 |
-pkg_postinst() { |
312 |
- tmpfiles_process sudo.conf |
313 |
- |
314 |
- #652958 |
315 |
- local sudo_db="${EROOT}/var/db/sudo" |
316 |
- if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then |
317 |
- chmod 711 "${sudo_db}" || die |
318 |
- fi |
319 |
- |
320 |
- if use ldap ; then |
321 |
- ewarn |
322 |
- ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration." |
323 |
- ewarn |
324 |
- if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then |
325 |
- ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly" |
326 |
- ewarn "configured in /etc/nsswitch.conf." |
327 |
- ewarn |
328 |
- ewarn "To make use of LDAP, add this line to your /etc/nsswitch.conf:" |
329 |
- ewarn " sudoers: ldap files" |
330 |
- ewarn |
331 |
- fi |
332 |
- fi |
333 |
- if use prefix ; then |
334 |
- ewarn |
335 |
- ewarn "To use sudo, you need to change file ownership and permissions" |
336 |
- ewarn "with root privileges, as follows:" |
337 |
- ewarn |
338 |
- ewarn " # chown root:root ${EPREFIX}/usr/bin/sudo" |
339 |
- ewarn " # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so" |
340 |
- ewarn " # chown root:root ${EPREFIX}/etc/sudoers" |
341 |
- ewarn " # chown root:root ${EPREFIX}/etc/sudoers.d" |
342 |
- ewarn " # chown root:root ${EPREFIX}/var/db/sudo" |
343 |
- ewarn " # chmod 4111 ${EPREFIX}/usr/bin/sudo" |
344 |
- ewarn |
345 |
- fi |
346 |
- |
347 |
- elog "To use the -A (askpass) option, you need to install a compatible" |
348 |
- elog "password program from the following list. Starred packages will" |
349 |
- elog "automatically register for the use with sudo (but will not force" |
350 |
- elog "the -A option):" |
351 |
- elog "" |
352 |
- elog " [*] net-misc/ssh-askpass-fullscreen" |
353 |
- elog " net-misc/x11-ssh-askpass" |
354 |
- elog "" |
355 |
- elog "You can override the choice by setting the SUDO_ASKPASS environmnent" |
356 |
- elog "variable to the program you want to use." |
357 |
-} |
358 |
|
359 |
diff --git a/app-admin/sudo/sudo-1.8.29-r2.ebuild b/app-admin/sudo/sudo-1.8.29-r2.ebuild |
360 |
deleted file mode 100644 |
361 |
index da5146b1241..00000000000 |
362 |
--- a/app-admin/sudo/sudo-1.8.29-r2.ebuild |
363 |
+++ /dev/null |
364 |
@@ -1,267 +0,0 @@ |
365 |
-# Copyright 1999-2020 Gentoo Authors |
366 |
-# Distributed under the terms of the GNU General Public License v2 |
367 |
- |
368 |
-EAPI=7 |
369 |
- |
370 |
-inherit pam multilib libtool tmpfiles |
371 |
- |
372 |
-MY_P="${P/_/}" |
373 |
-MY_P="${MY_P/beta/b}" |
374 |
- |
375 |
-DESCRIPTION="Allows users or groups to run commands as other users" |
376 |
-HOMEPAGE="https://www.sudo.ws/" |
377 |
-if [[ ${PV} == "9999" ]] ; then |
378 |
- inherit mercurial |
379 |
- EHG_REPO_URI="https://www.sudo.ws/repos/sudo" |
380 |
-else |
381 |
- uri_prefix= |
382 |
- case ${P} in |
383 |
- *_beta*|*_rc*) uri_prefix=beta/ ;; |
384 |
- esac |
385 |
- |
386 |
- SRC_URI="https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz |
387 |
- ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz" |
388 |
- if [[ ${PV} != *_beta* ]] && [[ ${PV} != *_rc* ]] ; then |
389 |
- KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~sparc-solaris" |
390 |
- fi |
391 |
-fi |
392 |
- |
393 |
-# Basic license is ISC-style as-is, some files are released under |
394 |
-# 3-clause BSD license |
395 |
-LICENSE="ISC BSD" |
396 |
-SLOT="0" |
397 |
-IUSE="gcrypt ldap libressl nls offensive pam sasl +secure-path selinux +sendmail skey sssd system-digest" |
398 |
- |
399 |
-DEPEND=" |
400 |
- sys-libs/zlib:= |
401 |
- ldap? ( |
402 |
- >=net-nds/openldap-2.1.30-r1 |
403 |
- sasl? ( |
404 |
- dev-libs/cyrus-sasl |
405 |
- net-nds/openldap[sasl] |
406 |
- ) |
407 |
- ) |
408 |
- pam? ( sys-libs/pam ) |
409 |
- sasl? ( dev-libs/cyrus-sasl ) |
410 |
- skey? ( >=sys-auth/skey-1.1.5-r1 ) |
411 |
- sssd? ( sys-auth/sssd[sudo] ) |
412 |
- system-digest? ( |
413 |
- gcrypt? ( dev-libs/libgcrypt:= ) |
414 |
- !gcrypt? ( |
415 |
- !libressl? ( dev-libs/openssl:0= ) |
416 |
- libressl? ( dev-libs/libressl:0= ) |
417 |
- ) |
418 |
- ) |
419 |
-" |
420 |
-RDEPEND=" |
421 |
- ${DEPEND} |
422 |
- >=app-misc/editor-wrapper-3 |
423 |
- virtual/editor |
424 |
- ldap? ( dev-lang/perl ) |
425 |
- pam? ( sys-auth/pambase ) |
426 |
- selinux? ( sec-policy/selinux-sudo ) |
427 |
- sendmail? ( virtual/mta ) |
428 |
-" |
429 |
-BDEPEND=" |
430 |
- sys-devel/bison |
431 |
-" |
432 |
- |
433 |
-S="${WORKDIR}/${MY_P}" |
434 |
- |
435 |
-REQUIRED_USE=" |
436 |
- pam? ( !skey ) |
437 |
- skey? ( !pam ) |
438 |
-" |
439 |
- |
440 |
-MAKEOPTS+=" SAMPLES=" |
441 |
- |
442 |
-PATCHES=( |
443 |
- "${FILESDIR}/${PN}-1.8.28-no_pam_error_message_fix.patch" #698946 |
444 |
-) |
445 |
- |
446 |
-src_prepare() { |
447 |
- default |
448 |
- elibtoolize |
449 |
-} |
450 |
- |
451 |
-set_secure_path() { |
452 |
- # FIXME: secure_path is a compile time setting. using PATH or |
453 |
- # ROOTPATH is not perfect, env-update may invalidate this, but until it |
454 |
- # is available as a sudoers setting this will have to do. |
455 |
- einfo "Setting secure_path ..." |
456 |
- |
457 |
- # first extract the default ROOTPATH from build env |
458 |
- SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; |
459 |
- echo "${ROOTPATH}") |
460 |
- case "${SECURE_PATH}" in |
461 |
- */usr/sbin*) ;; |
462 |
- *) SECURE_PATH=$(unset PATH; |
463 |
- . "${EPREFIX}"/etc/profile.env; echo "${PATH}") |
464 |
- ;; |
465 |
- esac |
466 |
- if [[ -z ${SECURE_PATH} ]] ; then |
467 |
- ewarn " Failed to detect SECURE_PATH, please report this" |
468 |
- fi |
469 |
- |
470 |
- # then remove duplicate path entries |
471 |
- cleanpath() { |
472 |
- local newpath thisp IFS=: |
473 |
- for thisp in $1 ; do |
474 |
- if [[ :${newpath}: != *:${thisp}:* ]] ; then |
475 |
- newpath+=:${thisp} |
476 |
- else |
477 |
- einfo " Duplicate entry ${thisp} removed..." |
478 |
- fi |
479 |
- done |
480 |
- SECURE_PATH=${newpath#:} |
481 |
- } |
482 |
- cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}} |
483 |
- |
484 |
- # finally, strip gcc paths #136027 |
485 |
- rmpath() { |
486 |
- local e newpath thisp IFS=: |
487 |
- for thisp in ${SECURE_PATH} ; do |
488 |
- for e ; do [[ ${thisp} == ${e} ]] && continue 2 ; done |
489 |
- newpath+=:${thisp} |
490 |
- done |
491 |
- SECURE_PATH=${newpath#:} |
492 |
- } |
493 |
- rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*' |
494 |
- |
495 |
- einfo "... done" |
496 |
-} |
497 |
- |
498 |
-src_configure() { |
499 |
- local SECURE_PATH |
500 |
- set_secure_path |
501 |
- |
502 |
- # audit: somebody got to explain me how I can test this before I |
503 |
- # enable it.. - Diego |
504 |
- # plugindir: autoconf code is crappy and does not delay evaluation |
505 |
- # until `make` time, so we have to use a full path here rather than |
506 |
- # basing off other values. |
507 |
- myeconfargs=( |
508 |
- --enable-zlib=system |
509 |
- --enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d |
510 |
- --with-editor="${EPREFIX}"/usr/libexec/editor |
511 |
- --with-env-editor |
512 |
- --with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo |
513 |
- --with-rundir="${EPREFIX}"/run/sudo |
514 |
- $(use_with secure-path secure-path "${SECURE_PATH}") |
515 |
- --with-vardir="${EPREFIX}"/var/db/sudo |
516 |
- --without-linux-audit |
517 |
- --without-opie |
518 |
- $(use_enable gcrypt) |
519 |
- $(use_enable nls) |
520 |
- $(use_enable sasl) |
521 |
- $(use_with offensive insults) |
522 |
- $(use_with offensive all-insults) |
523 |
- $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) |
524 |
- $(use_with ldap) |
525 |
- $(use_with pam) |
526 |
- $(use_with skey) |
527 |
- $(use_with sssd) |
528 |
- $(use_with selinux) |
529 |
- $(use_with sendmail) |
530 |
- ) |
531 |
- |
532 |
- if use system-digest && ! use gcrypt; then |
533 |
- myeconfargs+=("--enable-openssl") |
534 |
- else |
535 |
- myeconfargs+=("--disable-openssl") |
536 |
- fi |
537 |
- |
538 |
- econf "${myeconfargs[@]}" |
539 |
-} |
540 |
- |
541 |
-src_install() { |
542 |
- default |
543 |
- |
544 |
- if use ldap ; then |
545 |
- dodoc README.LDAP |
546 |
- |
547 |
- cat <<-EOF > "${T}"/ldap.conf.sudo |
548 |
- # See ldap.conf(5) and README.LDAP for details |
549 |
- # This file should only be readable by root |
550 |
- |
551 |
- # supported directives: host, port, ssl, ldap_version |
552 |
- # uri, binddn, bindpw, sudoers_base, sudoers_debug |
553 |
- # tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key} |
554 |
- EOF |
555 |
- |
556 |
- if use sasl ; then |
557 |
- cat <<-EOF >> "${T}"/ldap.conf.sudo |
558 |
- |
559 |
- # SASL directives: use_sasl, sasl_mech, sasl_auth_id |
560 |
- # sasl_secprops, rootuse_sasl, rootsasl_auth_id, krb5_ccname |
561 |
- EOF |
562 |
- fi |
563 |
- |
564 |
- insinto /etc |
565 |
- doins "${T}"/ldap.conf.sudo |
566 |
- fperms 0440 /etc/ldap.conf.sudo |
567 |
- |
568 |
- insinto /etc/openldap/schema |
569 |
- newins doc/schema.OpenLDAP sudo.schema |
570 |
- fi |
571 |
- |
572 |
- pamd_mimic system-auth sudo auth account session |
573 |
- |
574 |
- keepdir /var/db/sudo/lectured |
575 |
- fperms 0700 /var/db/sudo/lectured |
576 |
- fperms 0711 /var/db/sudo #652958 |
577 |
- |
578 |
- # Don't install into /run as that is a tmpfs most of the time |
579 |
- # (bug #504854) |
580 |
- rm -rf "${ED}"/run |
581 |
- |
582 |
- find "${ED}" -type f -name "*.la" -delete || die #697812 |
583 |
-} |
584 |
- |
585 |
-pkg_postinst() { |
586 |
- tmpfiles_process sudo.conf |
587 |
- |
588 |
- #652958 |
589 |
- local sudo_db="${EROOT}/var/db/sudo" |
590 |
- if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then |
591 |
- chmod 711 "${sudo_db}" || die |
592 |
- fi |
593 |
- |
594 |
- if use ldap ; then |
595 |
- ewarn |
596 |
- ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration." |
597 |
- ewarn |
598 |
- if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then |
599 |
- ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly" |
600 |
- ewarn "configured in /etc/nsswitch.conf." |
601 |
- ewarn |
602 |
- ewarn "To make use of LDAP, add this line to your /etc/nsswitch.conf:" |
603 |
- ewarn " sudoers: ldap files" |
604 |
- ewarn |
605 |
- fi |
606 |
- fi |
607 |
- if use prefix ; then |
608 |
- ewarn |
609 |
- ewarn "To use sudo, you need to change file ownership and permissions" |
610 |
- ewarn "with root privileges, as follows:" |
611 |
- ewarn |
612 |
- ewarn " # chown root:root ${EPREFIX}/usr/bin/sudo" |
613 |
- ewarn " # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so" |
614 |
- ewarn " # chown root:root ${EPREFIX}/etc/sudoers" |
615 |
- ewarn " # chown root:root ${EPREFIX}/etc/sudoers.d" |
616 |
- ewarn " # chown root:root ${EPREFIX}/var/db/sudo" |
617 |
- ewarn " # chmod 4111 ${EPREFIX}/usr/bin/sudo" |
618 |
- ewarn |
619 |
- fi |
620 |
- |
621 |
- elog "To use the -A (askpass) option, you need to install a compatible" |
622 |
- elog "password program from the following list. Starred packages will" |
623 |
- elog "automatically register for the use with sudo (but will not force" |
624 |
- elog "the -A option):" |
625 |
- elog "" |
626 |
- elog " [*] net-misc/ssh-askpass-fullscreen" |
627 |
- elog " net-misc/x11-ssh-askpass" |
628 |
- elog "" |
629 |
- elog "You can override the choice by setting the SUDO_ASKPASS environmnent" |
630 |
- elog "variable to the program you want to use." |
631 |
-} |
632 |
|
633 |
diff --git a/app-admin/sudo/sudo-1.8.30.ebuild b/app-admin/sudo/sudo-1.8.30.ebuild |
634 |
deleted file mode 100644 |
635 |
index f0df8a6c9e2..00000000000 |
636 |
--- a/app-admin/sudo/sudo-1.8.30.ebuild |
637 |
+++ /dev/null |
638 |
@@ -1,263 +0,0 @@ |
639 |
-# Copyright 1999-2020 Gentoo Authors |
640 |
-# Distributed under the terms of the GNU General Public License v2 |
641 |
- |
642 |
-EAPI=7 |
643 |
- |
644 |
-inherit pam multilib libtool tmpfiles |
645 |
- |
646 |
-MY_P="${P/_/}" |
647 |
-MY_P="${MY_P/beta/b}" |
648 |
- |
649 |
-DESCRIPTION="Allows users or groups to run commands as other users" |
650 |
-HOMEPAGE="https://www.sudo.ws/" |
651 |
-if [[ ${PV} == "9999" ]] ; then |
652 |
- inherit mercurial |
653 |
- EHG_REPO_URI="https://www.sudo.ws/repos/sudo" |
654 |
-else |
655 |
- uri_prefix= |
656 |
- case ${P} in |
657 |
- *_beta*|*_rc*) uri_prefix=beta/ ;; |
658 |
- esac |
659 |
- |
660 |
- SRC_URI="https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz |
661 |
- ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz" |
662 |
- if [[ ${PV} != *_beta* ]] && [[ ${PV} != *_rc* ]] ; then |
663 |
- KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~sparc-solaris" |
664 |
- fi |
665 |
-fi |
666 |
- |
667 |
-# Basic license is ISC-style as-is, some files are released under |
668 |
-# 3-clause BSD license |
669 |
-LICENSE="ISC BSD" |
670 |
-SLOT="0" |
671 |
-IUSE="gcrypt ldap libressl nls offensive pam sasl +secure-path selinux +sendmail skey sssd system-digest" |
672 |
- |
673 |
-DEPEND=" |
674 |
- sys-libs/zlib:= |
675 |
- ldap? ( |
676 |
- >=net-nds/openldap-2.1.30-r1 |
677 |
- sasl? ( |
678 |
- dev-libs/cyrus-sasl |
679 |
- net-nds/openldap[sasl] |
680 |
- ) |
681 |
- ) |
682 |
- pam? ( sys-libs/pam ) |
683 |
- sasl? ( dev-libs/cyrus-sasl ) |
684 |
- skey? ( >=sys-auth/skey-1.1.5-r1 ) |
685 |
- sssd? ( sys-auth/sssd[sudo] ) |
686 |
- system-digest? ( |
687 |
- gcrypt? ( dev-libs/libgcrypt:= ) |
688 |
- !gcrypt? ( |
689 |
- !libressl? ( dev-libs/openssl:0= ) |
690 |
- libressl? ( dev-libs/libressl:0= ) |
691 |
- ) |
692 |
- ) |
693 |
-" |
694 |
-RDEPEND=" |
695 |
- ${DEPEND} |
696 |
- >=app-misc/editor-wrapper-3 |
697 |
- virtual/editor |
698 |
- ldap? ( dev-lang/perl ) |
699 |
- pam? ( sys-auth/pambase ) |
700 |
- selinux? ( sec-policy/selinux-sudo ) |
701 |
- sendmail? ( virtual/mta ) |
702 |
-" |
703 |
-BDEPEND=" |
704 |
- sys-devel/bison |
705 |
-" |
706 |
- |
707 |
-S="${WORKDIR}/${MY_P}" |
708 |
- |
709 |
-REQUIRED_USE=" |
710 |
- pam? ( !skey ) |
711 |
- skey? ( !pam ) |
712 |
-" |
713 |
- |
714 |
-MAKEOPTS+=" SAMPLES=" |
715 |
- |
716 |
-src_prepare() { |
717 |
- default |
718 |
- elibtoolize |
719 |
-} |
720 |
- |
721 |
-set_secure_path() { |
722 |
- # FIXME: secure_path is a compile time setting. using PATH or |
723 |
- # ROOTPATH is not perfect, env-update may invalidate this, but until it |
724 |
- # is available as a sudoers setting this will have to do. |
725 |
- einfo "Setting secure_path ..." |
726 |
- |
727 |
- # first extract the default ROOTPATH from build env |
728 |
- SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; |
729 |
- echo "${ROOTPATH}") |
730 |
- case "${SECURE_PATH}" in |
731 |
- */usr/sbin*) ;; |
732 |
- *) SECURE_PATH=$(unset PATH; |
733 |
- . "${EPREFIX}"/etc/profile.env; echo "${PATH}") |
734 |
- ;; |
735 |
- esac |
736 |
- if [[ -z ${SECURE_PATH} ]] ; then |
737 |
- ewarn " Failed to detect SECURE_PATH, please report this" |
738 |
- fi |
739 |
- |
740 |
- # then remove duplicate path entries |
741 |
- cleanpath() { |
742 |
- local newpath thisp IFS=: |
743 |
- for thisp in $1 ; do |
744 |
- if [[ :${newpath}: != *:${thisp}:* ]] ; then |
745 |
- newpath+=:${thisp} |
746 |
- else |
747 |
- einfo " Duplicate entry ${thisp} removed..." |
748 |
- fi |
749 |
- done |
750 |
- SECURE_PATH=${newpath#:} |
751 |
- } |
752 |
- cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}} |
753 |
- |
754 |
- # finally, strip gcc paths #136027 |
755 |
- rmpath() { |
756 |
- local e newpath thisp IFS=: |
757 |
- for thisp in ${SECURE_PATH} ; do |
758 |
- for e ; do [[ ${thisp} == ${e} ]] && continue 2 ; done |
759 |
- newpath+=:${thisp} |
760 |
- done |
761 |
- SECURE_PATH=${newpath#:} |
762 |
- } |
763 |
- rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*' |
764 |
- |
765 |
- einfo "... done" |
766 |
-} |
767 |
- |
768 |
-src_configure() { |
769 |
- local SECURE_PATH |
770 |
- set_secure_path |
771 |
- |
772 |
- # audit: somebody got to explain me how I can test this before I |
773 |
- # enable it.. - Diego |
774 |
- # plugindir: autoconf code is crappy and does not delay evaluation |
775 |
- # until `make` time, so we have to use a full path here rather than |
776 |
- # basing off other values. |
777 |
- myeconfargs=( |
778 |
- --enable-zlib=system |
779 |
- --enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d |
780 |
- --with-editor="${EPREFIX}"/usr/libexec/editor |
781 |
- --with-env-editor |
782 |
- --with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo |
783 |
- --with-rundir="${EPREFIX}"/run/sudo |
784 |
- $(use_with secure-path secure-path "${SECURE_PATH}") |
785 |
- --with-vardir="${EPREFIX}"/var/db/sudo |
786 |
- --without-linux-audit |
787 |
- --without-opie |
788 |
- $(use_enable gcrypt) |
789 |
- $(use_enable nls) |
790 |
- $(use_enable sasl) |
791 |
- $(use_with offensive insults) |
792 |
- $(use_with offensive all-insults) |
793 |
- $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) |
794 |
- $(use_with ldap) |
795 |
- $(use_with pam) |
796 |
- $(use_with skey) |
797 |
- $(use_with sssd) |
798 |
- $(use_with selinux) |
799 |
- $(use_with sendmail) |
800 |
- ) |
801 |
- |
802 |
- if use system-digest && ! use gcrypt; then |
803 |
- myeconfargs+=("--enable-openssl") |
804 |
- else |
805 |
- myeconfargs+=("--disable-openssl") |
806 |
- fi |
807 |
- |
808 |
- econf "${myeconfargs[@]}" |
809 |
-} |
810 |
- |
811 |
-src_install() { |
812 |
- default |
813 |
- |
814 |
- if use ldap ; then |
815 |
- dodoc README.LDAP |
816 |
- |
817 |
- cat <<-EOF > "${T}"/ldap.conf.sudo |
818 |
- # See ldap.conf(5) and README.LDAP for details |
819 |
- # This file should only be readable by root |
820 |
- |
821 |
- # supported directives: host, port, ssl, ldap_version |
822 |
- # uri, binddn, bindpw, sudoers_base, sudoers_debug |
823 |
- # tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key} |
824 |
- EOF |
825 |
- |
826 |
- if use sasl ; then |
827 |
- cat <<-EOF >> "${T}"/ldap.conf.sudo |
828 |
- |
829 |
- # SASL directives: use_sasl, sasl_mech, sasl_auth_id |
830 |
- # sasl_secprops, rootuse_sasl, rootsasl_auth_id, krb5_ccname |
831 |
- EOF |
832 |
- fi |
833 |
- |
834 |
- insinto /etc |
835 |
- doins "${T}"/ldap.conf.sudo |
836 |
- fperms 0440 /etc/ldap.conf.sudo |
837 |
- |
838 |
- insinto /etc/openldap/schema |
839 |
- newins doc/schema.OpenLDAP sudo.schema |
840 |
- fi |
841 |
- |
842 |
- pamd_mimic system-auth sudo auth account session |
843 |
- |
844 |
- keepdir /var/db/sudo/lectured |
845 |
- fperms 0700 /var/db/sudo/lectured |
846 |
- fperms 0711 /var/db/sudo #652958 |
847 |
- |
848 |
- # Don't install into /run as that is a tmpfs most of the time |
849 |
- # (bug #504854) |
850 |
- rm -rf "${ED}"/run |
851 |
- |
852 |
- find "${ED}" -type f -name "*.la" -delete || die #697812 |
853 |
-} |
854 |
- |
855 |
-pkg_postinst() { |
856 |
- tmpfiles_process sudo.conf |
857 |
- |
858 |
- #652958 |
859 |
- local sudo_db="${EROOT}/var/db/sudo" |
860 |
- if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then |
861 |
- chmod 711 "${sudo_db}" || die |
862 |
- fi |
863 |
- |
864 |
- if use ldap ; then |
865 |
- ewarn |
866 |
- ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration." |
867 |
- ewarn |
868 |
- if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then |
869 |
- ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly" |
870 |
- ewarn "configured in /etc/nsswitch.conf." |
871 |
- ewarn |
872 |
- ewarn "To make use of LDAP, add this line to your /etc/nsswitch.conf:" |
873 |
- ewarn " sudoers: ldap files" |
874 |
- ewarn |
875 |
- fi |
876 |
- fi |
877 |
- if use prefix ; then |
878 |
- ewarn |
879 |
- ewarn "To use sudo, you need to change file ownership and permissions" |
880 |
- ewarn "with root privileges, as follows:" |
881 |
- ewarn |
882 |
- ewarn " # chown root:root ${EPREFIX}/usr/bin/sudo" |
883 |
- ewarn " # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so" |
884 |
- ewarn " # chown root:root ${EPREFIX}/etc/sudoers" |
885 |
- ewarn " # chown root:root ${EPREFIX}/etc/sudoers.d" |
886 |
- ewarn " # chown root:root ${EPREFIX}/var/db/sudo" |
887 |
- ewarn " # chmod 4111 ${EPREFIX}/usr/bin/sudo" |
888 |
- ewarn |
889 |
- fi |
890 |
- |
891 |
- elog "To use the -A (askpass) option, you need to install a compatible" |
892 |
- elog "password program from the following list. Starred packages will" |
893 |
- elog "automatically register for the use with sudo (but will not force" |
894 |
- elog "the -A option):" |
895 |
- elog "" |
896 |
- elog " [*] net-misc/ssh-askpass-fullscreen" |
897 |
- elog " net-misc/x11-ssh-askpass" |
898 |
- elog "" |
899 |
- elog "You can override the choice by setting the SUDO_ASKPASS environmnent" |
900 |
- elog "variable to the program you want to use." |
901 |
-} |