summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrea Barisani <lcars@gentoo.org>2005-07-05 16:52:30 +0000
committerAndrea Barisani <lcars@gentoo.org>2005-07-05 16:52:30 +0000
commitaf9c3c148fe6545943d28f64f45335a12bab95d6 (patch)
treeacf1baf52440e844f854b3997027759373743b97 /app-admin/sudo
parentStable on mips. (diff)
downloadgentoo-2-af9c3c148fe6545943d28f64f45335a12bab95d6.tar.gz
gentoo-2-af9c3c148fe6545943d28f64f45335a12bab95d6.tar.bz2
gentoo-2-af9c3c148fe6545943d28f64f45335a12bab95d6.zip
new revision with ldap timelimit patch
(Portage version: 2.0.51.19)
Diffstat (limited to 'app-admin/sudo')
-rw-r--r--app-admin/sudo/ChangeLog8
-rw-r--r--app-admin/sudo/Manifest5
-rw-r--r--app-admin/sudo/files/digest-sudo-1.6.8_p9-r21
-rw-r--r--app-admin/sudo/files/sudo-ldap_timelimit.diff76
-rw-r--r--app-admin/sudo/sudo-1.6.8_p9-r2.ebuild191
5 files changed, 279 insertions, 2 deletions
diff --git a/app-admin/sudo/ChangeLog b/app-admin/sudo/ChangeLog
index 699f2239b3fb..5917319cf73b 100644
--- a/app-admin/sudo/ChangeLog
+++ b/app-admin/sudo/ChangeLog
@@ -1,6 +1,12 @@
# ChangeLog for app-admin/sudo
# Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.74 2005/07/02 19:05:56 hardave Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.75 2005/07/05 16:52:30 lcars Exp $
+
+*sudo-1.6.8_p9-r2 (05 Jul 2005)
+
+ 05 Jul 2005; Andrea Barisani <lcars@gentoo.org>
+ +files/sudo-ldap_timelimit.diff, +sudo-1.6.8_p9-r2.ebuild:
+ Added ldap failover patch, bug #96766. Minor change to ldap.conf.sudo.
02 Jul 2005; Hardave Riar <hardave@gentoo.org> sudo-1.6.8_p9.ebuild,
sudo-1.6.8_p9-r1.ebuild:
diff --git a/app-admin/sudo/Manifest b/app-admin/sudo/Manifest
index b1fe60892064..619abf904055 100644
--- a/app-admin/sudo/Manifest
+++ b/app-admin/sudo/Manifest
@@ -1,13 +1,16 @@
MD5 1269b5829b15c970999857fe3db6c19d ChangeLog 9856
MD5 4e3ab49065539b5aa4d3153261b5d687 metadata.xml 561
MD5 1830dd653b9b5b92fa5cc86823e06d65 sudo-1.6.7_p5-r2.ebuild 1438
+MD5 049b187861fed345437fe7be97d26827 sudo-1.6.8_p9-r2.ebuild 6688
MD5 02caf6e86d5e08fd89baccd299a0ee3c sudo-1.6.7_p5-r5.ebuild 1508
MD5 52abea0d36b857d1b016958de2d0ac7f sudo-1.6.8_p9-r1.ebuild 6307
MD5 2740c4c96783b26c557d16e7ae0921a0 sudo-1.6.8_p9.ebuild 6046
MD5 ea5d9d51e647a2dbd410d952019ff19b files/digest-sudo-1.6.7_p5-r2 64
+MD5 375b1725c7c89570ce74eba2a96b767d files/digest-sudo-1.6.8_p9-r1 64
MD5 ea5d9d51e647a2dbd410d952019ff19b files/digest-sudo-1.6.7_p5-r5 64
+MD5 2a601951e4e5d6bdafc31b223737ddf5 files/sudo-ldap_timelimit.diff 2550
+MD5 375b1725c7c89570ce74eba2a96b767d files/digest-sudo-1.6.8_p9-r2 64
MD5 375b1725c7c89570ce74eba2a96b767d files/digest-sudo-1.6.8_p9 64
-MD5 375b1725c7c89570ce74eba2a96b767d files/digest-sudo-1.6.8_p9-r1 64
MD5 a5463236fbb98e4ee6b1a0faba8c9c52 files/sudo 135
MD5 b906eb71f7564707384cfa9fc80c1b5f files/sudo-1.6.7_p5-strip-bash-functions.diff 1101
MD5 6c08a6d5527a45278ebc165df7f0031d files/sudo-1.6.8_p8 223
diff --git a/app-admin/sudo/files/digest-sudo-1.6.8_p9-r2 b/app-admin/sudo/files/digest-sudo-1.6.8_p9-r2
new file mode 100644
index 000000000000..0629e17e9dd7
--- /dev/null
+++ b/app-admin/sudo/files/digest-sudo-1.6.8_p9-r2
@@ -0,0 +1 @@
+MD5 6d0346abd16914956bc7ea4f17fc85fb sudo-1.6.8p9.tar.gz 585509
diff --git a/app-admin/sudo/files/sudo-ldap_timelimit.diff b/app-admin/sudo/files/sudo-ldap_timelimit.diff
new file mode 100644
index 000000000000..2c13ba4ed4e6
--- /dev/null
+++ b/app-admin/sudo/files/sudo-ldap_timelimit.diff
@@ -0,0 +1,76 @@
+diff -urN sudo-1.6.8p8/ldap.c sudo-1.6.8p8-patched/ldap.c
+--- sudo-1.6.8p8/ldap.c 2004-12-01 03:28:46.000000000 +0000
++++ sudo-1.6.8p8-patched/ldap.c 2005-06-22 08:14:59.000000000 +0000
+@@ -82,6 +82,8 @@
+ char *bindpw;
+ char *base;
+ char *ssl;
++ int bind_timelimit;
++ int timelimit;
+ int tls_checkpeer;
+ char *tls_cacertfile;
+ char *tls_cacertdir;
+@@ -545,6 +547,8 @@
+ else MATCH_S("tls_cert", ldap_conf.tls_certfile)
+ else MATCH_S("tls_key", ldap_conf.tls_keyfile)
+ else MATCH_I("ldap_version", ldap_conf.version)
++ else MATCH_I("bind_timelimit", ldap_conf.bind_timelimit)
++ else MATCH_I("timelimit", ldap_conf.timelimit)
+ else MATCH_S("uri", ldap_conf.uri)
+ else MATCH_S("binddn", ldap_conf.binddn)
+ else MATCH_S("bindpw", ldap_conf.bindpw)
+@@ -566,6 +570,8 @@
+ if (!ldap_conf.version) ldap_conf.version=3;
+ if (!ldap_conf.port) ldap_conf.port=389;
+ if (!ldap_conf.host) ldap_conf.host=estrdup("localhost");
++ if (!ldap_conf.bind_timelimit) ldap_conf.bind_timelimit=30;
++ if (!ldap_conf.timelimit) ldap_conf.timelimit=30;
+
+
+ if (ldap_conf.debug>1) {
+@@ -589,6 +595,10 @@
+ ldap_conf.binddn : "(anonymous)");
+ printf("bindpw %s\n", ldap_conf.bindpw ?
+ ldap_conf.bindpw : "(anonymous)");
++ printf("bind_timelimit %d\n", ldap_conf.bind_timelimit ?
++ ldap_conf.bind_timelimit : 30);
++ printf("timelimit %d\n", ldap_conf.timelimit ?
++ ldap_conf.timelimit : 30);
+ #ifdef HAVE_LDAP_START_TLS_S
+ printf("ssl %s\n", ldap_conf.ssl ?
+ ldap_conf.ssl : "(no)");
+@@ -772,6 +782,34 @@
+ }
+ #endif /* LDAP_OPT_X_TLS_REQUIRE_CERT */
+
++ /* setup timelimit options */
++
++SET_OPTI(LDAP_OPT_TIMELIMIT, "TIMELIMIT", timelimit);
++
++#ifdef LDAP_X_OPT_CONNECT_TIMEOUT
++ int timeout;
++ timeout = ldap_conf.bind_timelimit * 1000;
++
++ SET_OPTI(LDAP_X_OPT_CONNECT_TIMEOUT, "X_OPT_CONNECT_TIMEOUT", timeout);
++#endif
++
++#ifdef LDAP_OPT_NETWORK_TIMEOUT
++ if (ldap_conf.debug>1) fprintf(stderr, "setting bind_timelimit to %d\n", \
++ ldap_conf.bind_timelimit);
++
++ struct timeval tv;
++
++ tv.tv_sec = ldap_conf.bind_timelimit;
++ tv.tv_usec = 0;
++
++ rc = ldap_set_option (ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
++
++ if (rc != LDAP_OPT_SUCCESS) {
++ fprintf(stderr, "bind_timelimit ldap_set_option failed: %s\n", ldap_err2string(rc));
++ return VALIDATE_ERROR;
++ }
++#endif
++
+ /* attempt connect */
+ #ifdef HAVE_LDAP_INITIALIZE
+ if (ldap_conf.uri) {
diff --git a/app-admin/sudo/sudo-1.6.8_p9-r2.ebuild b/app-admin/sudo/sudo-1.6.8_p9-r2.ebuild
new file mode 100644
index 000000000000..96b86c50ef0a
--- /dev/null
+++ b/app-admin/sudo/sudo-1.6.8_p9-r2.ebuild
@@ -0,0 +1,191 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.8_p9-r2.ebuild,v 1.1 2005/07/05 16:52:30 lcars Exp $
+
+inherit eutils pam
+
+# TODO: Fix support for krb4 and krb5
+
+DESCRIPTION="Allows users or groups to run commands as other users"
+HOMEPAGE="http://www.sudo.ws/"
+SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${P/_/}.tar.gz"
+LICENSE="Sudo"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="pam skey offensive ldap"
+
+DEPEND="pam? ( || ( virtual/pam sys-libs/pam ) )
+ ldap? ( >=net-nds/openldap-2.1.30-r1 )
+ skey? ( >=app-admin/skey-1.1.5-r1 )
+ sys-devel/bison
+ virtual/mta"
+RDEPEND="${DEPEND} ldap? ( dev-lang/perl )"
+
+S=${WORKDIR}/${P/_/}
+
+src_unpack() {
+ unpack ${A}; cd ${S}
+
+ # ldap failover patch
+ epatch ${FILESDIR}/${PN}-ldap_timelimit.diff
+
+ # compatability fix.
+ epatch ${FILESDIR}/${PN}-skeychallengeargs.diff
+
+ # make tls_cacert synonymous with tls_cacertfile.
+ epatch ${FILESDIR}/${PN}-1.6.8_p8-ldap-tls_cacert.diff
+
+ # additional variables to disallow, should user disable env_reset.
+
+ # NOTE: this is not a supported mode of operation, these variables
+ # are added to the blacklist as a convenience to administrators
+ # who fail to heed the warnings of allowing untrusted users
+ # to access sudo.
+ #
+ # there is *no possible way* to foresee all attack vectors in
+ # all possible applications that could potentially be used via
+ # sudo, these settings will just delay the inevitable.
+ #
+ # that said, I will accept suggestions for variables that can
+ # be misused in _common_ interpreters or libraries, such as
+ # perl, bash, python, ruby, etc., in the hope of dissuading
+ # a casual attacker.
+
+ # XXX: perl should be using suid_perl.
+ # XXX: users can remove/add more via env_delete and env_check.
+ # XXX: <?> = probably safe enough for most circumstances.
+
+ einfo "Blacklisting common variables (env_delete)..."
+ sudo_bad_var 'SHELLOPTS' # bash, change shoptions.
+ sudo_bad_var 'PERLIO_DEBUG' # perl, write debug to file.
+ sudo_bad_var 'PERL5LIB' # perl, change search path.
+ sudo_bad_var 'PERLLIB' # perl, change search path.
+# sudo_bad_var 'PERL_HASH_SEED' # perl, change seed. <?>
+# sudo_bad_var 'PERL_HASH_SEED_DEBUG' # perl, disclose seed. <?>
+# sudo_bad_var 'PERL_SIGNALS' # perl, use deferred signals. <?>
+ sudo_bad_var 'FPATH' # ksh, search path for functions.
+ sudo_bad_var 'PS4' # sh, in case set -x is used. <?>
+ sudo_bad_var 'NULLCMD' # zsh, command on null-redir. <?>
+ sudo_bad_var 'READNULLCMD' # zsh, command on null-redir. <?>
+# sudo_bad_var 'TMPPREFIX' # zsh, prefix for tmp files. <?>
+ sudo_bad_var 'GLOBIGNORE' # bash, glob paterns to ignore. <?>
+ sudo_bad_var 'PERL5OPT' # perl, set options.
+ sudo_bad_var 'PYTHONHOME' # python, module search path.
+ sudo_bad_var 'PYTHONPATH' # python, search path.
+ sudo_bad_var 'PYTHONINSPECT' # python, allow inspection.
+ sudo_bad_var 'RUBYLIB' # ruby, lib load path.
+ sudo_bad_var 'RUBYOPT' # ruby, cl options.
+# sudo_bad_var 'RUBYPATH' # ruby, script search path. <?>
+ sudo_bad_var 'ZDOTDIR' # zsh, path to search for dotfiles.
+ einfo "...done."
+
+ # prevent binaries from being stripped.
+ sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in
+}
+
+src_compile() {
+ local line ROOTPATH
+
+ # FIXME: secure_path is a compile time setting. using ROOTPATH
+ # is not perfect, env-update may invalidate this, but until it
+ # is available as a sudoers setting this will have to do.
+ einfo "Setting secure_path..."
+
+ # why not use grep? variable might be expanded from other variables
+ # declared in that file. cannot just source the file, would override
+ # any variables already set.
+ eval `PS4= bash -x /etc/profile.env 2>&1 | \
+ while read line; do
+ case $line in
+ ROOTPATH=*) echo $line; break;;
+ *) continue;;
+ esac
+ done` && einfo " Found ROOTPATH..." || \
+ ewarn " Failed to find ROOTPATH, please report this."
+
+ # remove any duplicate entries
+ ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}})
+
+ einfo "...done."
+
+ # XXX: --disable-path-info closes an info leak, but may be confusing.
+ # XXX: /bin/vi may not be available, make nano visudo's default.
+ econf --with-secure-path="${ROOTPATH}" \
+ --with-editor=/bin/nano \
+ --with-env-editor \
+ $(use_with offensive insults) \
+ $(use_with offensive all-insults) \
+ $(use_with pam) \
+ $(use_with skey) \
+ $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \
+ $(use_with ldap) || die
+
+ # disallow lazy bindings
+ emake SUDO_LDFLAGS="-Wl,-z,now" || die
+}
+
+src_install() {
+ einstall || die
+ dodoc BUGS CHANGES HISTORY PORTING README RUNSON TODO \
+ TROUBLESHOOTING UPGRADE sample.*
+
+ if use ldap; then
+ dodoc README.LDAP
+ dosbin sudoers2ldif
+
+ printf "# See ldap.conf(5) and README.LDAP for details\n" > ${T}/ldap.conf.sudo
+ printf "# This file should only be readable by root\n\n" >> ${T}/ldap.conf.sudo
+ printf "# supported directives: host, port, ssl, ldap_version\n" >> ${T}/ldap.conf.sudo
+ printf "# uri, binddn, bindpw, sudoers_base, sudoers_debug\n" >> ${T}/ldap.conf.sudo
+ printf "# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key}\n" >> ${T}/ldap.conf.sudo
+
+ insinto /etc
+ doins ${T}/ldap.conf.sudo
+ fperms 0440 /etc/ldap.conf.sudo
+ fi
+
+ if has_version virtual/pam; then
+ pamd_mimic_system sudo auth account password session
+ else
+ newpamd ${FILESDIR}/sudo-1.6.8_p8 sudo
+ fi
+
+ insinto /etc
+ doins ${FILESDIR}/sudoers
+ fperms 0640 /etc/sudoers
+}
+
+# remove duplicate path entries from $1
+cleanpath() {
+ local i=1 x n IFS=:
+ local -a paths; paths=($1)
+
+ for ((n=${#paths[*]}-1;i<=n;i++)); do
+ for ((x=0;x<i;x++)); do
+ test "${paths[i]}" == "${paths[x]}" && {
+ einfo " Duplicate entry ${paths[i]} removed..." 1>&2
+ unset paths[i]; continue 2; }
+ done; # einfo " Adding ${paths[i]}..." 1>&2
+ done; echo "${paths[*]}"
+}
+
+# add $1 to default env_delete list.
+sudo_bad_var() {
+ local target='env.c' marker='\*initial_badenv_table\[\]'
+
+ ebegin " $1"
+ sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' ${S}/${target}
+ eend $?
+}
+
+pkg_postinst() {
+ use skey && use pam && {
+ ewarn "sudo will not use skey authentication when compiled with"
+ ewarn "pam support."
+ ewarn "To allow users to authenticate with one time passwords,"
+ ewarn "you should unset the pam USE flag for sudo."
+ }
+ use ldap && {
+ ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration."
+ }
+}