Accepting request 1128140 from home:ohollmann:branches:Base:System
- Update to 1.9.15p2: * Fixed a bug on BSD systems where sudo would not restore the terminal settings on exit if the terminal had parity enabled. GitHub issue #326. - Update to 1.9.15p1: * Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based sudoers from being able to read the ldap.conf file. GitHub issue #325. - Update to 1.9.15: * Fixed an undefined symbol problem on older versions of macOS when "intercept" or "log_subcmds" are enabled in sudoers. GitHub issue #276. * Fixed "make check" failure related to getpwent(3) wrapping on NetBSD. * Fixed the warning message for "sudo -l command" when the command is not permitted. There was a missing space between "list" and the actual command due to changes in sudo 1.9.14. * Fixed a bug where output could go to the wrong terminal if "use_pty" is enabled (the default) and the standard input, output or error is redirected to a different terminal. Bug #1056. * The visudo utility will no longer create an empty file when the specified sudoers file does not exist and the user exits the editor without making any changes. GitHub issue #294. * The AIX and Solaris sudo packages on www.sudo.ws now support "log_subcmds" and "intercept" with both 32-bit and 64-bit binaries. Previously, they only worked when running binaries with the same word size as the sudo binary. GitHub issue #289. * The sudoers source is now logged in the JSON event log. This makes it possible to tell which rule resulted in a match. * Running "sudo -ll command" now produces verbose output that OBS-URL: https://build.opensuse.org/request/show/1128140 OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=247
This commit is contained in:
parent
27c0857d41
commit
01793c9cfc
@ -1,3 +0,0 @@
|
|||||||
version https://git-lfs.github.com/spec/v1
|
|
||||||
oid sha256:a08318b1c4bc8582c004d4cd9ae2903abc549e7e46ba815e41fe81d1c0782b62
|
|
||||||
size 5232320
|
|
Binary file not shown.
3
sudo-1.9.15p2.tar.gz
Normal file
3
sudo-1.9.15p2.tar.gz
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
version https://git-lfs.github.com/spec/v1
|
||||||
|
oid sha256:199c0cdbfa7efcfffa9c88684a8e2fb206a62b70a316507e4a91c89c873bbcc8
|
||||||
|
size 5303642
|
BIN
sudo-1.9.15p2.tar.gz.sig
Normal file
BIN
sudo-1.9.15p2.tar.gz.sig
Normal file
Binary file not shown.
@ -1,8 +1,8 @@
|
|||||||
Index: sudo-1.9.14p3/plugins/sudoers/sudoers.in
|
Index: sudo-1.9.15p2/plugins/sudoers/sudoers.in
|
||||||
===================================================================
|
===================================================================
|
||||||
--- sudo-1.9.14p3.orig/plugins/sudoers/sudoers.in
|
--- sudo-1.9.15p2.orig/plugins/sudoers/sudoers.in
|
||||||
+++ sudo-1.9.14p3/plugins/sudoers/sudoers.in
|
+++ sudo-1.9.15p2/plugins/sudoers/sudoers.in
|
||||||
@@ -32,32 +32,23 @@
|
@@ -41,32 +41,23 @@
|
||||||
##
|
##
|
||||||
## Defaults specification
|
## Defaults specification
|
||||||
##
|
##
|
||||||
@ -52,13 +52,17 @@ Index: sudo-1.9.14p3/plugins/sudoers/sudoers.in
|
|||||||
##
|
##
|
||||||
## Uncomment to restore the historic behavior where a command is run in
|
## Uncomment to restore the historic behavior where a command is run in
|
||||||
## the user's own terminal.
|
## the user's own terminal.
|
||||||
@@ -72,10 +63,15 @@
|
@@ -81,7 +72,6 @@
|
||||||
## Set maxseq to a smaller number if you don't have unlimited disk space.
|
## Set maxseq to a smaller number if you don't have unlimited disk space.
|
||||||
# Defaults log_output
|
# Defaults log_output
|
||||||
# Defaults!/usr/bin/sudoreplay !log_output
|
# Defaults!/usr/bin/sudoreplay !log_output
|
||||||
-# Defaults!/usr/local/bin/sudoreplay !log_output
|
-# Defaults!/usr/local/bin/sudoreplay !log_output
|
||||||
# Defaults!REBOOT !log_output
|
# Defaults!REBOOT !log_output
|
||||||
# Defaults maxseq = 1000
|
# Defaults maxseq = 1000
|
||||||
|
##
|
||||||
|
@@ -95,6 +85,12 @@
|
||||||
|
## slower by these options and also can clutter up the logs.
|
||||||
|
# Defaults!PKGMAN !intercept, !log_subcmds
|
||||||
|
|
||||||
+## In the default (unconfigured) configuration, sudo asks for the root password.
|
+## In the default (unconfigured) configuration, sudo asks for the root password.
|
||||||
+## This allows use of an ordinary user account for administration of a freshly
|
+## This allows use of an ordinary user account for administration of a freshly
|
||||||
@ -69,7 +73,7 @@ Index: sudo-1.9.14p3/plugins/sudoers/sudoers.in
|
|||||||
##
|
##
|
||||||
## Runas alias specification
|
## Runas alias specification
|
||||||
##
|
##
|
||||||
@@ -91,13 +87,5 @@ root ALL=(ALL:ALL) ALL
|
@@ -110,13 +106,5 @@ root ALL=(ALL:ALL) ALL
|
||||||
## Same thing without a password
|
## Same thing without a password
|
||||||
# %wheel ALL=(ALL:ALL) NOPASSWD: ALL
|
# %wheel ALL=(ALL:ALL) NOPASSWD: ALL
|
||||||
|
|
||||||
|
77
sudo.changes
77
sudo.changes
@ -1,3 +1,80 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Nov 22 12:46:00 UTC 2023 - Otto Hollmann <otto.hollmann@suse.com>
|
||||||
|
|
||||||
|
- Update to 1.9.15p2:
|
||||||
|
* Fixed a bug on BSD systems where sudo would not restore the
|
||||||
|
terminal settings on exit if the terminal had parity enabled.
|
||||||
|
GitHub issue #326.
|
||||||
|
- Update to 1.9.15p1:
|
||||||
|
* Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based
|
||||||
|
sudoers from being able to read the ldap.conf file.
|
||||||
|
GitHub issue #325.
|
||||||
|
- Update to 1.9.15:
|
||||||
|
* Fixed an undefined symbol problem on older versions of macOS
|
||||||
|
when "intercept" or "log_subcmds" are enabled in sudoers.
|
||||||
|
GitHub issue #276.
|
||||||
|
* Fixed "make check" failure related to getpwent(3) wrapping
|
||||||
|
on NetBSD.
|
||||||
|
* Fixed the warning message for "sudo -l command" when the command
|
||||||
|
is not permitted. There was a missing space between "list" and
|
||||||
|
the actual command due to changes in sudo 1.9.14.
|
||||||
|
* Fixed a bug where output could go to the wrong terminal if
|
||||||
|
"use_pty" is enabled (the default) and the standard input, output
|
||||||
|
or error is redirected to a different terminal. Bug #1056.
|
||||||
|
* The visudo utility will no longer create an empty file when the
|
||||||
|
specified sudoers file does not exist and the user exits the
|
||||||
|
editor without making any changes. GitHub issue #294.
|
||||||
|
* The AIX and Solaris sudo packages on www.sudo.ws now support
|
||||||
|
"log_subcmds" and "intercept" with both 32-bit and 64-bit
|
||||||
|
binaries. Previously, they only worked when running binaries
|
||||||
|
with the same word size as the sudo binary. GitHub issue #289.
|
||||||
|
* The sudoers source is now logged in the JSON event log. This
|
||||||
|
makes it possible to tell which rule resulted in a match.
|
||||||
|
* Running "sudo -ll command" now produces verbose output that
|
||||||
|
includes matching rule as well as the path to the sudoers file
|
||||||
|
the matching rule came from. For LDAP sudoers, the name of the
|
||||||
|
matching sudoRole is printed instead.
|
||||||
|
* The embedded copy of zlib has been updated to version 1.3.
|
||||||
|
* The sudoers plugin has been modified to make it more resilient
|
||||||
|
to ROWHAMMER attacks on authentication and policy matching.
|
||||||
|
This addresses CVE-2023-42465.
|
||||||
|
* The sudoers plugin now constructs the user time stamp file path
|
||||||
|
name using the user-ID instead of the user name. This avoids a
|
||||||
|
potential problem with user names that contain a path separator
|
||||||
|
('/') being interpreted as part of the path name. A similar
|
||||||
|
issue in sudo-rs has been assigned CVE-2023-42456.
|
||||||
|
* A path separator ('/') in a user, group or host name is now
|
||||||
|
replaced with an underbar character ('_') when expanding escapes
|
||||||
|
in @include and @includedir directives as well as the "iolog_file"
|
||||||
|
and "iolog_dir" sudoers Default settings.
|
||||||
|
* The "intercept_verify" sudoers option is now only applied when
|
||||||
|
the "intercept" option is set in sudoers. Previously, it was
|
||||||
|
also applied when "log_subcmds" was enabled. Sudo 1.9.14
|
||||||
|
contained an incorrect fix for this. Bug #1058.
|
||||||
|
* Changes to terminal settings are now performed atomically, where
|
||||||
|
possible. If the command is being run in a pseudo-terminal and
|
||||||
|
the user's terminal is already in raw mode, sudo will not change
|
||||||
|
the user's terminal settings. This prevents concurrent sudo
|
||||||
|
processes from restoring the terminal settings to the wrong values.
|
||||||
|
GitHub issue #312.
|
||||||
|
* Reverted a change from sudo 1.9.4 that resulted in PAM session
|
||||||
|
modules being called with the environment of the command to be
|
||||||
|
run instead of the environment of the invoking user.
|
||||||
|
GitHub issue #318.
|
||||||
|
* New Indonesian translation from translationproject.org.
|
||||||
|
* The sudo_logsrvd server will now raise its open file descriptor
|
||||||
|
limit to the maximum allowed value when it starts up. Each
|
||||||
|
connection can require up to nine open file descriptors so the
|
||||||
|
default soft limit may be too low.
|
||||||
|
* Better log message when rejecting a command if the "intercept"
|
||||||
|
option is enabled and the "intercept_allow_setid" option is
|
||||||
|
disabled. Previously, "command not allowed" would be logged and
|
||||||
|
the user had no way of knowing what the actual problem was.
|
||||||
|
* Sudo will now log the invoking user's environment as "submitenv"
|
||||||
|
in the JSON logs. The command's environment ("runenv") is no
|
||||||
|
longer logged for commands rejected by the sudoers file or an
|
||||||
|
approval plugin.
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Tue Nov 21 08:56:42 UTC 2023 - Dominique Leuenberger <dimstar@opensuse.org>
|
Tue Nov 21 08:56:42 UTC 2023 - Dominique Leuenberger <dimstar@opensuse.org>
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user