sudo/sudo.spec

197 lines
6.3 KiB
RPMSpec
Raw Normal View History

#
# spec file for package sudo
#
Accepting request 568794 from home:avindra - Update to 1.8.22 * Commands run in the background from a script run via sudo will no longer receive SIGHUP when the parent exits and I/O logging is enabled * A particularly offensive insult is now disabled by default * The description of sudo -i now correctly documents that the env_keep and env_check sudoers options are applied to the environment * Fixed a crash when the system's host name is not set * The sudoers2ldif script now handles #include and #includedir directives. * Fixed a bug where sudo would silently exit when the command was not allowed by sudoers and the passwd_tries sudoers option was set to a value less than one. * Fixed a bug with the listpw and verifypw sudoers options and multiple sudoers sources. If the option is set to all a password should be required unless none of a user's sudoers entries from any source require authentication. * Fixed a bug with the listpw and verifypw sudoers options in the LDAP and SSSD back-ends. If the option is set to any and the entry contained multiple rules, only the first matching rule was checked. If an entry contained more than one matching rule and the first rule required authentication but a subsequent rule did not, sudo would prompt for a password when it should not have. * When running a command as the invoking user (not root), sudo would execute the command with the same group vector it was started with. Sudo now executes the command with a new group vector based on the group database which is consistent with how su(1) operates. * Fixed a double free in the SSSD back-end that could occur when ipa_hostname is present in sssd.conf and is set to an unqualified host name. * When I/O logging is enabled, sudo will now write to the terminal even when it is a background process. Previously, sudo would only write to the tty when it was the foreground process when I/O logging was enabled. If the TOSTOP terminal flag is set, sudo will suspend the command (and then itself) with the SIGTTOU signal. * A new authfail_message sudoers option that overrides the default N incorrect password attempt(s). * An empty sudoRunAsUser attribute in the LDAP and SSSD backends will now match the invoking user. This is more consistent with how an empty runas user in the sudoers file is treated. * Documented that in check mode, visudo does not check the owner / mode on files specified with the -f flag * It is now an error to specify the runas user as an empty string on the command line. Previously, an empty runas user was treated the same as an unspecified runas user * When timestamp_type option is set to tty and a terminal is present, the time stamp record will now include the start time of the session leader. When the timestamp_type option is set to ppid or when no terminal is available, the start time of the parent process is used instead. This significantly reduces the likelihood of a time stamp record being re-used when a user logs out and back in again. * The sudoers time stamp file format is now documented in the new sudoers_timestamp manual. * Visudo will now use the SUDO_EDITOR environment variable (if present) in addition to VISUAL and EDITOR. - rebase sudoers2ldif-env.patch - cleanup with spec-cleaner OBS-URL: https://build.opensuse.org/request/show/568794 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=130
2018-01-24 12:27:07 +01:00
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
Name: sudo
Version: 1.8.25
Release: 0
Summary: Execute some commands as root
License: ISC
Group: System/Base
Url: https://www.sudo.ws/
Source0: https://sudo.ws/sudo/dist/%{name}-%{version}.tar.gz
Source1: https://sudo.ws/sudo/dist/%{name}-%{version}.tar.gz.sig
Source2: %{name}.keyring
Source3: sudo.pamd
Source4: sudo-i.pamd
Source5: README.SUSE
Source6: fate_313276_test.sh
Source7: README_313276.test
# PATCH-OPENSUSE: the "SUSE" branding of the default sudo config
Patch0: sudo-sudoers.patch
BuildRequires: audit-devel
BuildRequires: cyrus-sasl-devel
BuildRequires: groff
BuildRequires: libselinux-devel
BuildRequires: openldap2-devel
BuildRequires: pam-devel
BuildRequires: systemd-rpm-macros
BuildRequires: zlib-devel
Accepting request 89134 from home:vitezslav_cizek:branches:Base:System - update to sudo-1.8.3 - Fixed expansion of strftime() escape sequences in the log_dir sudoers setting. - Esperanto, Italian and Japanese translations from translationproject.org. - Added --enable-werror configure option for gcc's -Werror flag. - Visudo no longer assumes all editors support the +linenumber command line argument. It now uses a whitelist of editors known to support the option. - Fixed matching of network addresses when a netmask is specified but the address is not the first one in the CIDR block. - The configure script now check whether or not errno.h declares the errno variable. Previously, sudo would always declare errno itself for older systems that don't declare it in errno.h. - The NOPASSWD tag is now honored for denied commands too, which matches historic sudo behavior (prior to sudo 1.7.0). - Sudo now honors the DEREF setting in ldap.conf which controls how alias dereferencing is done during an LDAP search. - A symbol conflict with the pam_ssh_agent_auth PAM module that would cause a crash been resolved. - The inability to load a group provider plugin is no longer a fatal error. - A potential crash in the utmp handling code has been fixed. - Two PAM session issues have been resolved. In previous versions of sudo, the PAM session was opened as one user and closed as another. Additionally, if no authentication was performed, the PAM session would never be closed. OBS-URL: https://build.opensuse.org/request/show/89134 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=27
2011-10-24 13:08:52 +02:00
Requires(pre): coreutils
Requires(pre): permissions
%description
Sudo is a command that allows users to execute some commands as root.
Accepting request 342689 from home:kstreitova:branches:Base:System - update to 1.8.15: * Fixed a bug that prevented sudo from building outside the source tree on some platforms. Bug #708. * Fixed the location of the sssd library in the RHEL/Centos packages. Bug #710. * Fixed a build problem on systems that don't implicitly include sys/types.h from other header files. Bug #711. * Fixed a problem on Linux using containers where sudo would ignore signals sent by a process in a different container. * Sudo now refuses to run a command if the PAM session module returns an error. * When editing files with sudoedit, symbolic links will no longer be followed by default. The old behavior can be restored by enabling the sudoedit_follow option in sudoers or on a per-command basis with the FOLLOW and NOFOLLOW tags. Bug #707. * Fixed a bug introduced in version 1.8.14 that caused the last valid editor in the sudoers "editor" list to be used by visudo and sudoedit instead of the first. Bug #714. * Fixed a bug in visudo that prevented the addition of a final newline to edited files without one. * Fixed a bug decoding certain base64 digests in sudoers when the intermediate format included a '=' character. * Individual records are now locked in the time stamp file instead of the entire file. This allows sudo to avoid prompting for a password multiple times on the same terminal when used in a pipeline. In other words, sudo cat foo | sudo grep bar now only prompts for the password once. Previously, both sudo processes would prompt for a password, often making it impossible to enter. Bug #705. * Fixed a bug where sudo would fail to run commands as a non-root user on systems that lack both setresuid() and setreuid(). Bug #713. OBS-URL: https://build.opensuse.org/request/show/342689 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=92
2015-11-06 13:38:32 +01:00
The %{_sysconfdir}/sudoers file (edited with 'visudo') specifies which users have
access to sudo and which commands they can run. Sudo logs all its
activities to syslogd, so the system administrator can keep an eye on
things. Sudo asks for the password for initializing a check period of a
given time N (where N is defined at installation and is set to 5
minutes by default).
%package devel
Summary: Header files needed for sudo plugin development
Group: Development/Libraries/C and C++
Requires: %{name} = %{version}
%description devel
These header files are needed for building of sudo plugins.
%package test
Summary: Tests for the package
Group: Development/Tools/Other
Requires: %{name} = %{version}
%description test
Tests for fate#313276
%prep
%setup -q
Accepting request 342689 from home:kstreitova:branches:Base:System - update to 1.8.15: * Fixed a bug that prevented sudo from building outside the source tree on some platforms. Bug #708. * Fixed the location of the sssd library in the RHEL/Centos packages. Bug #710. * Fixed a build problem on systems that don't implicitly include sys/types.h from other header files. Bug #711. * Fixed a problem on Linux using containers where sudo would ignore signals sent by a process in a different container. * Sudo now refuses to run a command if the PAM session module returns an error. * When editing files with sudoedit, symbolic links will no longer be followed by default. The old behavior can be restored by enabling the sudoedit_follow option in sudoers or on a per-command basis with the FOLLOW and NOFOLLOW tags. Bug #707. * Fixed a bug introduced in version 1.8.14 that caused the last valid editor in the sudoers "editor" list to be used by visudo and sudoedit instead of the first. Bug #714. * Fixed a bug in visudo that prevented the addition of a final newline to edited files without one. * Fixed a bug decoding certain base64 digests in sudoers when the intermediate format included a '=' character. * Individual records are now locked in the time stamp file instead of the entire file. This allows sudo to avoid prompting for a password multiple times on the same terminal when used in a pipeline. In other words, sudo cat foo | sudo grep bar now only prompts for the password once. Previously, both sudo processes would prompt for a password, often making it impossible to enter. Bug #705. * Fixed a bug where sudo would fail to run commands as a non-root user on systems that lack both setresuid() and setreuid(). Bug #713. OBS-URL: https://build.opensuse.org/request/show/342689 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=92
2015-11-06 13:38:32 +01:00
%patch0 -p1
%build
Accepting request 568794 from home:avindra - Update to 1.8.22 * Commands run in the background from a script run via sudo will no longer receive SIGHUP when the parent exits and I/O logging is enabled * A particularly offensive insult is now disabled by default * The description of sudo -i now correctly documents that the env_keep and env_check sudoers options are applied to the environment * Fixed a crash when the system's host name is not set * The sudoers2ldif script now handles #include and #includedir directives. * Fixed a bug where sudo would silently exit when the command was not allowed by sudoers and the passwd_tries sudoers option was set to a value less than one. * Fixed a bug with the listpw and verifypw sudoers options and multiple sudoers sources. If the option is set to all a password should be required unless none of a user's sudoers entries from any source require authentication. * Fixed a bug with the listpw and verifypw sudoers options in the LDAP and SSSD back-ends. If the option is set to any and the entry contained multiple rules, only the first matching rule was checked. If an entry contained more than one matching rule and the first rule required authentication but a subsequent rule did not, sudo would prompt for a password when it should not have. * When running a command as the invoking user (not root), sudo would execute the command with the same group vector it was started with. Sudo now executes the command with a new group vector based on the group database which is consistent with how su(1) operates. * Fixed a double free in the SSSD back-end that could occur when ipa_hostname is present in sssd.conf and is set to an unqualified host name. * When I/O logging is enabled, sudo will now write to the terminal even when it is a background process. Previously, sudo would only write to the tty when it was the foreground process when I/O logging was enabled. If the TOSTOP terminal flag is set, sudo will suspend the command (and then itself) with the SIGTTOU signal. * A new authfail_message sudoers option that overrides the default N incorrect password attempt(s). * An empty sudoRunAsUser attribute in the LDAP and SSSD backends will now match the invoking user. This is more consistent with how an empty runas user in the sudoers file is treated. * Documented that in check mode, visudo does not check the owner / mode on files specified with the -f flag * It is now an error to specify the runas user as an empty string on the command line. Previously, an empty runas user was treated the same as an unspecified runas user * When timestamp_type option is set to tty and a terminal is present, the time stamp record will now include the start time of the session leader. When the timestamp_type option is set to ppid or when no terminal is available, the start time of the parent process is used instead. This significantly reduces the likelihood of a time stamp record being re-used when a user logs out and back in again. * The sudoers time stamp file format is now documented in the new sudoers_timestamp manual. * Visudo will now use the SUDO_EDITOR environment variable (if present) in addition to VISUAL and EDITOR. - rebase sudoers2ldif-env.patch - cleanup with spec-cleaner OBS-URL: https://build.opensuse.org/request/show/568794 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=130
2018-01-24 12:27:07 +01:00
%ifarch s390 s390x %{sparc}
F_PIE=-fPIE
%else
F_PIE=-fpie
%endif
export CFLAGS="%{optflags} -Wall $F_PIE -DLDAP_DEPRECATED"
export LDFLAGS="-pie"
%configure \
--libexecdir=%{_libexecdir}/sudo \
--docdir=%{_docdir}/%{name} \
--with-noexec=%{_libexecdir}/sudo/sudo_noexec.so \
--enable-tmpfiles.d=%{_tmpfilesdir} \
--with-pam \
--with-pam-login \
--with-ldap \
--with-selinux \
--with-linux-audit \
--with-logfac=auth \
--with-all-insults \
--with-ignore-dot \
--with-tty-tickets \
--enable-shell-sets-home \
--enable-warnings \
--with-sendmail=%{_sbindir}/sendmail \
--with-sudoers-mode=0440 \
--with-env-editor \
--without-secure-path \
--with-passprompt="[sudo] password for %%p: " \
Accepting request 225988 from home:vitezslav_cizek:branches:Base:System - update to 1.8.10p1 * Fixed a bug with netgated commands in "sudo -l command" that could cause the command to be listed even when it was explicitly denied. This only affected list mode when a command was specified. Bug #636. * It is now possible to disable network interface probing in sudo.conf by changing the value of the probe_interfaces setting. * When listing a user's privileges (sudo -l), the sudoers plugin will now prompt for the user's password even if the targetpw, rootpw or runaspw options are set. * The sudoers plugin uses a new format for its time stamp files. Bug #616. * sudo's -K option will now remove all of the user's time stamps, not just the time stamp for the current terminal. The -k option can be used to only disable time stamps for the current terminal. * If sudo was started in the background and needed to prompt for a password, it was not possible to suspend it at the password prompt * LDAP-based sudoers now uses a default search filter of (objectClass=sudoRole) for more efficient queries. The netgroup query has been modified to avoid falling below the minimum length for OpenLDAP substring indices. * The new use_netgroups sudoers option can be used to explicitly enable or disable netgroups support. For LDAP-based sudoers, netgroup support requires an expensive substring match on the server. If netgroups are not needed, this option can be disabled to reduce the load on the LDAP server. * Sudo is once again able to open the sudoers file when the group on sudoers doesn't match the expected value, so long as the file is not group writable. OBS-URL: https://build.opensuse.org/request/show/225988 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=71
2014-03-15 07:41:25 +01:00
--with-rundir=%{_localstatedir}/lib/sudo \
Accepting request 342689 from home:kstreitova:branches:Base:System - update to 1.8.15: * Fixed a bug that prevented sudo from building outside the source tree on some platforms. Bug #708. * Fixed the location of the sssd library in the RHEL/Centos packages. Bug #710. * Fixed a build problem on systems that don't implicitly include sys/types.h from other header files. Bug #711. * Fixed a problem on Linux using containers where sudo would ignore signals sent by a process in a different container. * Sudo now refuses to run a command if the PAM session module returns an error. * When editing files with sudoedit, symbolic links will no longer be followed by default. The old behavior can be restored by enabling the sudoedit_follow option in sudoers or on a per-command basis with the FOLLOW and NOFOLLOW tags. Bug #707. * Fixed a bug introduced in version 1.8.14 that caused the last valid editor in the sudoers "editor" list to be used by visudo and sudoedit instead of the first. Bug #714. * Fixed a bug in visudo that prevented the addition of a final newline to edited files without one. * Fixed a bug decoding certain base64 digests in sudoers when the intermediate format included a '=' character. * Individual records are now locked in the time stamp file instead of the entire file. This allows sudo to avoid prompting for a password multiple times on the same terminal when used in a pipeline. In other words, sudo cat foo | sudo grep bar now only prompts for the password once. Previously, both sudo processes would prompt for a password, often making it impossible to enter. Bug #705. * Fixed a bug where sudo would fail to run commands as a non-root user on systems that lack both setresuid() and setreuid(). Bug #713. OBS-URL: https://build.opensuse.org/request/show/342689 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=92
2015-11-06 13:38:32 +01:00
--with-sssd
# -B required to make every build give the same result - maybe from bad build deps in Makefiles?
make -B %{?_smp_mflags}
%install
%make_install install_uid=`id -u` install_gid=`id -g`
install -d -m 755 %{buildroot}%{_sysconfdir}/pam.d
install -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/pam.d/sudo
install -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/pam.d/sudo-i
rm -f %{buildroot}%{_bindir}/sudoedit
ln -sf %{_bindir}/sudo %{buildroot}%{_bindir}/sudoedit
install -d -m 755 %{buildroot}%{_sysconfdir}/openldap/schema
install -m 644 doc/schema.OpenLDAP %{buildroot}%{_sysconfdir}/openldap/schema/sudo.schema
install -m 644 %{SOURCE5} %{buildroot}%{_docdir}/%{name}/
rm -f %{buildroot}%{_docdir}/%{name}/sample.pam
rm -f %{buildroot}%{_docdir}/%{name}/sample.syslog.conf
rm -f %{buildroot}%{_docdir}/%{name}/schema.OpenLDAP
rm -f %{buildroot}%{_sysconfdir}/sudoers.dist
%find_lang %{name}
%find_lang sudoers
cat sudoers.lang >> %{name}.lang
# tests
Accepting request 342689 from home:kstreitova:branches:Base:System - update to 1.8.15: * Fixed a bug that prevented sudo from building outside the source tree on some platforms. Bug #708. * Fixed the location of the sssd library in the RHEL/Centos packages. Bug #710. * Fixed a build problem on systems that don't implicitly include sys/types.h from other header files. Bug #711. * Fixed a problem on Linux using containers where sudo would ignore signals sent by a process in a different container. * Sudo now refuses to run a command if the PAM session module returns an error. * When editing files with sudoedit, symbolic links will no longer be followed by default. The old behavior can be restored by enabling the sudoedit_follow option in sudoers or on a per-command basis with the FOLLOW and NOFOLLOW tags. Bug #707. * Fixed a bug introduced in version 1.8.14 that caused the last valid editor in the sudoers "editor" list to be used by visudo and sudoedit instead of the first. Bug #714. * Fixed a bug in visudo that prevented the addition of a final newline to edited files without one. * Fixed a bug decoding certain base64 digests in sudoers when the intermediate format included a '=' character. * Individual records are now locked in the time stamp file instead of the entire file. This allows sudo to avoid prompting for a password multiple times on the same terminal when used in a pipeline. In other words, sudo cat foo | sudo grep bar now only prompts for the password once. Previously, both sudo processes would prompt for a password, often making it impossible to enter. Bug #705. * Fixed a bug where sudo would fail to run commands as a non-root user on systems that lack both setresuid() and setreuid(). Bug #713. OBS-URL: https://build.opensuse.org/request/show/342689 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=92
2015-11-06 13:38:32 +01:00
install -d -m 755 %{buildroot}%{_localstatedir}/lib/tests/sudo
install -m 755 %{SOURCE6} %{buildroot}%{_localstatedir}/lib/tests/sudo
install -m 755 %{SOURCE7} %{buildroot}%{_localstatedir}/lib/tests/sudo
install -d %{buildroot}%{_docdir}/%{name}-test
install -m 644 %{buildroot}%{_docdir}/%{name}/LICENSE %{buildroot}%{_docdir}/%{name}-test/LICENSE
rm -fv %{buildroot}%{_docdir}/%{name}/LICENSE
%post
chmod 0440 %{_sysconfdir}/sudoers
%if 0%{?suse_version} <= 1130
%run_permissions
%else
Accepting request 342689 from home:kstreitova:branches:Base:System - update to 1.8.15: * Fixed a bug that prevented sudo from building outside the source tree on some platforms. Bug #708. * Fixed the location of the sssd library in the RHEL/Centos packages. Bug #710. * Fixed a build problem on systems that don't implicitly include sys/types.h from other header files. Bug #711. * Fixed a problem on Linux using containers where sudo would ignore signals sent by a process in a different container. * Sudo now refuses to run a command if the PAM session module returns an error. * When editing files with sudoedit, symbolic links will no longer be followed by default. The old behavior can be restored by enabling the sudoedit_follow option in sudoers or on a per-command basis with the FOLLOW and NOFOLLOW tags. Bug #707. * Fixed a bug introduced in version 1.8.14 that caused the last valid editor in the sudoers "editor" list to be used by visudo and sudoedit instead of the first. Bug #714. * Fixed a bug in visudo that prevented the addition of a final newline to edited files without one. * Fixed a bug decoding certain base64 digests in sudoers when the intermediate format included a '=' character. * Individual records are now locked in the time stamp file instead of the entire file. This allows sudo to avoid prompting for a password multiple times on the same terminal when used in a pipeline. In other words, sudo cat foo | sudo grep bar now only prompts for the password once. Previously, both sudo processes would prompt for a password, often making it impossible to enter. Bug #705. * Fixed a bug where sudo would fail to run commands as a non-root user on systems that lack both setresuid() and setreuid(). Bug #713. OBS-URL: https://build.opensuse.org/request/show/342689 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=92
2015-11-06 13:38:32 +01:00
%set_permissions %{_bindir}/sudo
%endif
%tmpfiles_create %{_tmpfilesdir}/sudo.conf
%verifyscript
Accepting request 342689 from home:kstreitova:branches:Base:System - update to 1.8.15: * Fixed a bug that prevented sudo from building outside the source tree on some platforms. Bug #708. * Fixed the location of the sssd library in the RHEL/Centos packages. Bug #710. * Fixed a build problem on systems that don't implicitly include sys/types.h from other header files. Bug #711. * Fixed a problem on Linux using containers where sudo would ignore signals sent by a process in a different container. * Sudo now refuses to run a command if the PAM session module returns an error. * When editing files with sudoedit, symbolic links will no longer be followed by default. The old behavior can be restored by enabling the sudoedit_follow option in sudoers or on a per-command basis with the FOLLOW and NOFOLLOW tags. Bug #707. * Fixed a bug introduced in version 1.8.14 that caused the last valid editor in the sudoers "editor" list to be used by visudo and sudoedit instead of the first. Bug #714. * Fixed a bug in visudo that prevented the addition of a final newline to edited files without one. * Fixed a bug decoding certain base64 digests in sudoers when the intermediate format included a '=' character. * Individual records are now locked in the time stamp file instead of the entire file. This allows sudo to avoid prompting for a password multiple times on the same terminal when used in a pipeline. In other words, sudo cat foo | sudo grep bar now only prompts for the password once. Previously, both sudo processes would prompt for a password, often making it impossible to enter. Bug #705. * Fixed a bug where sudo would fail to run commands as a non-root user on systems that lack both setresuid() and setreuid(). Bug #713. OBS-URL: https://build.opensuse.org/request/show/342689 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=92
2015-11-06 13:38:32 +01:00
%verify_permissions -e %{_bindir}/sudo
%files -f %{name}.lang
%license doc/LICENSE
%doc %{_docdir}/%{name}
%{_mandir}/man1/cvtsudoers.1%{ext_man}
Accepting request 568794 from home:avindra - Update to 1.8.22 * Commands run in the background from a script run via sudo will no longer receive SIGHUP when the parent exits and I/O logging is enabled * A particularly offensive insult is now disabled by default * The description of sudo -i now correctly documents that the env_keep and env_check sudoers options are applied to the environment * Fixed a crash when the system's host name is not set * The sudoers2ldif script now handles #include and #includedir directives. * Fixed a bug where sudo would silently exit when the command was not allowed by sudoers and the passwd_tries sudoers option was set to a value less than one. * Fixed a bug with the listpw and verifypw sudoers options and multiple sudoers sources. If the option is set to all a password should be required unless none of a user's sudoers entries from any source require authentication. * Fixed a bug with the listpw and verifypw sudoers options in the LDAP and SSSD back-ends. If the option is set to any and the entry contained multiple rules, only the first matching rule was checked. If an entry contained more than one matching rule and the first rule required authentication but a subsequent rule did not, sudo would prompt for a password when it should not have. * When running a command as the invoking user (not root), sudo would execute the command with the same group vector it was started with. Sudo now executes the command with a new group vector based on the group database which is consistent with how su(1) operates. * Fixed a double free in the SSSD back-end that could occur when ipa_hostname is present in sssd.conf and is set to an unqualified host name. * When I/O logging is enabled, sudo will now write to the terminal even when it is a background process. Previously, sudo would only write to the tty when it was the foreground process when I/O logging was enabled. If the TOSTOP terminal flag is set, sudo will suspend the command (and then itself) with the SIGTTOU signal. * A new authfail_message sudoers option that overrides the default N incorrect password attempt(s). * An empty sudoRunAsUser attribute in the LDAP and SSSD backends will now match the invoking user. This is more consistent with how an empty runas user in the sudoers file is treated. * Documented that in check mode, visudo does not check the owner / mode on files specified with the -f flag * It is now an error to specify the runas user as an empty string on the command line. Previously, an empty runas user was treated the same as an unspecified runas user * When timestamp_type option is set to tty and a terminal is present, the time stamp record will now include the start time of the session leader. When the timestamp_type option is set to ppid or when no terminal is available, the start time of the parent process is used instead. This significantly reduces the likelihood of a time stamp record being re-used when a user logs out and back in again. * The sudoers time stamp file format is now documented in the new sudoers_timestamp manual. * Visudo will now use the SUDO_EDITOR environment variable (if present) in addition to VISUAL and EDITOR. - rebase sudoers2ldif-env.patch - cleanup with spec-cleaner OBS-URL: https://build.opensuse.org/request/show/568794 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=130
2018-01-24 12:27:07 +01:00
%{_mandir}/man5/sudoers.5%{ext_man}
%{_mandir}/man5/sudo.conf.5%{ext_man}
%{_mandir}/man5/sudoers.ldap.5%{ext_man}
%{_mandir}/man5/sudoers_timestamp.5%{ext_man}
%{_mandir}/man8/sudo.8%{ext_man}
%{_mandir}/man8/sudoedit.8%{ext_man}
%{_mandir}/man8/sudoreplay.8%{ext_man}
%{_mandir}/man8/visudo.8%{ext_man}
%config(noreplace) %attr(0440,root,root) %{_sysconfdir}/sudoers
%dir %{_sysconfdir}/sudoers.d
%config(noreplace) %{_sysconfdir}/pam.d/sudo
%config(noreplace) %{_sysconfdir}/pam.d/sudo-i
%attr(4755,root,root) %{_bindir}/sudo
%dir %{_sysconfdir}/openldap
%dir %{_sysconfdir}/openldap/schema
%attr(0444,root,root) %config %{_sysconfdir}/openldap/schema/sudo.schema
%{_bindir}/sudoedit
%{_bindir}/sudoreplay
%{_bindir}/cvtsudoers
%{_sbindir}/visudo
%dir %{_libexecdir}/%{name}
%{_libexecdir}/%{name}/sesh
%{_libexecdir}/%{name}/sudo_noexec.so
%{_libexecdir}/%{name}/sudoers.so
%{_libexecdir}/%{name}/group_file.so
%{_libexecdir}/%{name}/system_group.so
%{_libexecdir}/%{name}/libsudo_util.so.*
%attr(0700,root,root) %dir %ghost %{_localstatedir}/lib/%{name}
%dir %{_tmpfilesdir}
%{_tmpfilesdir}/sudo.conf
%ghost %{_localstatedir}/lib/sudo/ts
%files devel
%doc plugins/sample/sample_plugin.c
%{_includedir}/sudo_plugin.h
%{_mandir}/man8/sudo_plugin.8*
%attr(0644,root,root) %{_libexecdir}/%{name}/libsudo_util.so
%{_libexecdir}/%{name}/*.la
%files test
Accepting request 342689 from home:kstreitova:branches:Base:System - update to 1.8.15: * Fixed a bug that prevented sudo from building outside the source tree on some platforms. Bug #708. * Fixed the location of the sssd library in the RHEL/Centos packages. Bug #710. * Fixed a build problem on systems that don't implicitly include sys/types.h from other header files. Bug #711. * Fixed a problem on Linux using containers where sudo would ignore signals sent by a process in a different container. * Sudo now refuses to run a command if the PAM session module returns an error. * When editing files with sudoedit, symbolic links will no longer be followed by default. The old behavior can be restored by enabling the sudoedit_follow option in sudoers or on a per-command basis with the FOLLOW and NOFOLLOW tags. Bug #707. * Fixed a bug introduced in version 1.8.14 that caused the last valid editor in the sudoers "editor" list to be used by visudo and sudoedit instead of the first. Bug #714. * Fixed a bug in visudo that prevented the addition of a final newline to edited files without one. * Fixed a bug decoding certain base64 digests in sudoers when the intermediate format included a '=' character. * Individual records are now locked in the time stamp file instead of the entire file. This allows sudo to avoid prompting for a password multiple times on the same terminal when used in a pipeline. In other words, sudo cat foo | sudo grep bar now only prompts for the password once. Previously, both sudo processes would prompt for a password, often making it impossible to enter. Bug #705. * Fixed a bug where sudo would fail to run commands as a non-root user on systems that lack both setresuid() and setreuid(). Bug #713. OBS-URL: https://build.opensuse.org/request/show/342689 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=92
2015-11-06 13:38:32 +01:00
%{_localstatedir}/lib/tests
%{_docdir}/%{name}-test/
%changelog