Accepting request 998921 from Base:System
OBS-URL: https://build.opensuse.org/request/show/998921 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/sudo?expand=0&rev=132
This commit is contained in:
commit
277f190914
116
sudo-1.9.10-update_sudouser_to_utf8.patch
Normal file
116
sudo-1.9.10-update_sudouser_to_utf8.patch
Normal file
@ -0,0 +1,116 @@
|
|||||||
|
From 7f9ea23e7447b8e1308fc282cd13b6cf5d39d3c4 Mon Sep 17 00:00:00 2001
|
||||||
|
From: William Brown <wbrown@suse.de>
|
||||||
|
Date: Mon, 25 Jul 2022 15:21:39 +1000
|
||||||
|
Subject: [PATCH] Update sudoUser to be utf8 in ldap schemas
|
||||||
|
|
||||||
|
In most unix-style LDAP servers, uid is a utf8 string defined by
|
||||||
|
OID 1.3.6.1.4.1.1466.115.121.1.15. However, sudoUser was defined
|
||||||
|
as an IA5 String (OID 1.3.6.1.4.1.1466.115.121.1.26) which meant
|
||||||
|
that sudoUser could only represent a subset of possible values.
|
||||||
|
|
||||||
|
In some cases when using sudoers.ldap, the uid from the machine
|
||||||
|
which was utf8 was fed back into sudo which would then issue a
|
||||||
|
search for sudoUsers. If this uid contained utf8 characters, the
|
||||||
|
ldap server would refuse to match into sudoUsers because these
|
||||||
|
were limited to IA5.
|
||||||
|
|
||||||
|
This is a safe-forward upgrade as IA5 is a subset of UTF8 meaning
|
||||||
|
that this change will not impact existing deployments and their
|
||||||
|
rules.
|
||||||
|
---
|
||||||
|
docs/schema.OpenLDAP | 14 +++++++-------
|
||||||
|
docs/schema.iPlanet | 6 +++---
|
||||||
|
docs/schema.olcSudo | 14 +++++++-------
|
||||||
|
3 files changed, 17 insertions(+), 17 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/docs/schema.OpenLDAP b/docs/schema.OpenLDAP
|
||||||
|
index e1d525f84..451c5250a 100644
|
||||||
|
--- a/docs/schema.OpenLDAP
|
||||||
|
+++ b/docs/schema.OpenLDAP
|
||||||
|
@@ -7,9 +7,9 @@
|
||||||
|
attributetype ( 1.3.6.1.4.1.15953.9.1.1
|
||||||
|
NAME 'sudoUser'
|
||||||
|
DESC 'User(s) who may run sudo'
|
||||||
|
- EQUALITY caseExactIA5Match
|
||||||
|
- SUBSTR caseExactIA5SubstringsMatch
|
||||||
|
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
+ EQUALITY caseExactMatch
|
||||||
|
+ SUBSTR caseExactSubstringsMatch
|
||||||
|
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||||
|
|
||||||
|
attributetype ( 1.3.6.1.4.1.15953.9.1.2
|
||||||
|
NAME 'sudoHost'
|
||||||
|
@@ -39,14 +39,14 @@ attributetype ( 1.3.6.1.4.1.15953.9.1.5
|
||||||
|
attributetype ( 1.3.6.1.4.1.15953.9.1.6
|
||||||
|
NAME 'sudoRunAsUser'
|
||||||
|
DESC 'User(s) impersonated by sudo'
|
||||||
|
- EQUALITY caseExactIA5Match
|
||||||
|
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
+ EQUALITY caseExactMatch
|
||||||
|
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||||
|
|
||||||
|
attributetype ( 1.3.6.1.4.1.15953.9.1.7
|
||||||
|
NAME 'sudoRunAsGroup'
|
||||||
|
DESC 'Group(s) impersonated by sudo'
|
||||||
|
- EQUALITY caseExactIA5Match
|
||||||
|
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
+ EQUALITY caseExactMatch
|
||||||
|
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||||
|
|
||||||
|
attributetype ( 1.3.6.1.4.1.15953.9.1.8
|
||||||
|
NAME 'sudoNotBefore'
|
||||||
|
diff --git a/docs/schema.iPlanet b/docs/schema.iPlanet
|
||||||
|
index e51286436..56ad02bc0 100644
|
||||||
|
--- a/docs/schema.iPlanet
|
||||||
|
+++ b/docs/schema.iPlanet
|
||||||
|
@@ -1,11 +1,11 @@
|
||||||
|
dn: cn=schema
|
||||||
|
-attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
|
||||||
|
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactMatch SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'SUDO' )
|
||||||
|
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
|
||||||
|
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
|
||||||
|
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
|
||||||
|
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
|
||||||
|
-attributeTypes: ( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
|
||||||
|
-attributeTypes: ( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Group(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
|
||||||
|
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'User(s) impersonated by sudo' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'SUDO' )
|
||||||
|
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Group(s) impersonated by sudo' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'SUDO' )
|
||||||
|
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'Start of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
|
||||||
|
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'End of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
|
||||||
|
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an integer to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
|
||||||
|
diff --git a/docs/schema.olcSudo b/docs/schema.olcSudo
|
||||||
|
index 8748dfc2a..8948ca4ae 100644
|
||||||
|
--- a/docs/schema.olcSudo
|
||||||
|
+++ b/docs/schema.olcSudo
|
||||||
|
@@ -9,9 +9,9 @@ cn: sudoschema
|
||||||
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.1
|
||||||
|
NAME 'sudoUser'
|
||||||
|
DESC 'User(s) who may run sudo'
|
||||||
|
- EQUALITY caseExactIA5Match
|
||||||
|
- SUBSTR caseExactIA5SubstringsMatch
|
||||||
|
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
+ EQUALITY caseExactMatch
|
||||||
|
+ SUBSTR caseExactSubstringsMatch
|
||||||
|
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||||
|
#
|
||||||
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.2
|
||||||
|
NAME 'sudoHost'
|
||||||
|
@@ -41,14 +41,14 @@ olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.5
|
||||||
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.6
|
||||||
|
NAME 'sudoRunAsUser'
|
||||||
|
DESC 'User(s) impersonated by sudo'
|
||||||
|
- EQUALITY caseExactIA5Match
|
||||||
|
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
+ EQUALITY caseExactMatch
|
||||||
|
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||||
|
#
|
||||||
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.7
|
||||||
|
NAME 'sudoRunAsGroup'
|
||||||
|
DESC 'Group(s) impersonated by sudo'
|
||||||
|
- EQUALITY caseExactIA5Match
|
||||||
|
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
+ EQUALITY caseExactMatch
|
||||||
|
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||||
|
#
|
||||||
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.8
|
||||||
|
NAME 'sudoNotBefore'
|
@ -1,3 +0,0 @@
|
|||||||
version https://git-lfs.github.com/spec/v1
|
|
||||||
oid sha256:44a1461098e7c7b8e6ac597499c24fb2e43748c0c139a8b4944e57d1349a64f4
|
|
||||||
size 4516568
|
|
Binary file not shown.
3
sudo-1.9.11p3.tar.gz
Normal file
3
sudo-1.9.11p3.tar.gz
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
version https://git-lfs.github.com/spec/v1
|
||||||
|
oid sha256:4687e7d2f56721708f59cca2e1352c056cb23de526c22725615a42bb094f1f70
|
||||||
|
size 4826520
|
BIN
sudo-1.9.11p3.tar.gz.sig
Normal file
BIN
sudo-1.9.11p3.tar.gz.sig
Normal file
Binary file not shown.
@ -1,7 +1,7 @@
|
|||||||
Index: sudo-1.9.9/plugins/sudoers/sudoers.in
|
diff --git a/plugins/sudoers/sudoers.in b/plugins/sudoers/sudoers.in
|
||||||
===================================================================
|
index 5efda5d..ddd311a 100644
|
||||||
--- sudo-1.9.9.orig/plugins/sudoers/sudoers.in
|
--- a/plugins/sudoers/sudoers.in
|
||||||
+++ sudo-1.9.9/plugins/sudoers/sudoers.in
|
+++ b/plugins/sudoers/sudoers.in
|
||||||
@@ -32,30 +32,23 @@
|
@@ -32,30 +32,23 @@
|
||||||
##
|
##
|
||||||
## Defaults specification
|
## Defaults specification
|
||||||
@ -50,12 +50,13 @@ Index: sudo-1.9.9/plugins/sudoers/sudoers.in
|
|||||||
## Uncomment to use a hard-coded PATH instead of the user's to find commands
|
## Uncomment to use a hard-coded PATH instead of the user's to find commands
|
||||||
# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||||
##
|
##
|
||||||
@@ -66,9 +59,15 @@
|
@@ -68,10 +61,16 @@
|
||||||
## sudoreplay and reboot. Use sudoreplay to play back logged sessions.
|
## Set maxseq to a smaller number if you don't have unlimited disk space.
|
||||||
# Defaults log_output
|
# Defaults log_output
|
||||||
# Defaults!/usr/bin/sudoreplay !log_output
|
# Defaults!/usr/bin/sudoreplay !log_output
|
||||||
-# Defaults!/usr/local/bin/sudoreplay !log_output
|
-# Defaults!/usr/local/bin/sudoreplay !log_output
|
||||||
# Defaults!REBOOT !log_output
|
# Defaults!REBOOT !log_output
|
||||||
|
# Defaults maxseq = 1000
|
||||||
|
|
||||||
+## In the default (unconfigured) configuration, sudo asks for the root password.
|
+## In the default (unconfigured) configuration, sudo asks for the root password.
|
||||||
+## This allows use of an ordinary user account for administration of a freshly
|
+## This allows use of an ordinary user account for administration of a freshly
|
||||||
@ -67,7 +68,7 @@ Index: sudo-1.9.9/plugins/sudoers/sudoers.in
|
|||||||
##
|
##
|
||||||
## Runas alias specification
|
## Runas alias specification
|
||||||
##
|
##
|
||||||
@@ -84,13 +83,5 @@ root ALL=(ALL:ALL) ALL
|
@@ -87,13 +86,5 @@ root ALL=(ALL:ALL) ALL
|
||||||
## Same thing without a password
|
## Same thing without a password
|
||||||
# %wheel ALL=(ALL:ALL) NOPASSWD: ALL
|
# %wheel ALL=(ALL:ALL) NOPASSWD: ALL
|
||||||
|
|
||||||
|
81
sudo.changes
81
sudo.changes
@ -1,3 +1,84 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Sat Aug 20 02:04:06 UTC 2022 - Jason Sikes <jsikes@suse.com>
|
||||||
|
|
||||||
|
- Update to 1.9.11p3:
|
||||||
|
* Changes in Sudo 1.9.11
|
||||||
|
* Fixed a crash in the Python module with Python 3.9.10 on some systems.
|
||||||
|
Additionally, make check now passes for Python 3.9.10.
|
||||||
|
* Error messages sent via email now include more details, including the file
|
||||||
|
name and the line number and column of the error. Multiple errors are sent in
|
||||||
|
a single message. Previously, only the first error was included.
|
||||||
|
* Fixed logging of parse errors in JSON format. Previously, the JSON logger would
|
||||||
|
not write entries unless the command and runuser were set. These may not be
|
||||||
|
known at the time a parse error is encountered.
|
||||||
|
* Fixed a potential crash parsing sudoers lines larger than twice the value of
|
||||||
|
LINE_MAX on systems that lack the getdelim() function.
|
||||||
|
* The tests run by make check now unset the LANGUAGE environment variable.
|
||||||
|
Otherwise, localization strings will not match if LANGUAGE is set to a
|
||||||
|
non-English locale. Bug #1025.
|
||||||
|
* The “starttime” test now passed when run under Debian faketime. Bug #1026.
|
||||||
|
* The Kerberos authentication module now honors the custom password prompt if one
|
||||||
|
has been specified.
|
||||||
|
* The embedded copy of zlib has been updated to version 1.2.12.
|
||||||
|
* Updated the version of libtool used by sudo to version 2.4.7.
|
||||||
|
* Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the
|
||||||
|
header files (currently only GNU libc). This is required to allow the use of
|
||||||
|
64-bit time values on some 32-bit systems.
|
||||||
|
* Sudo’s intercept and log_subcmds options no longer force the command to run in
|
||||||
|
its own pseudo-terminal. It is now also possible to intercept the system(3) function.
|
||||||
|
* Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit
|
||||||
|
point messages sent by the server were incorrect if the command was suspended
|
||||||
|
or received a window size change event.
|
||||||
|
* Fixed a potential crash in sudo_logsrvd when the tls_dhparams configuration
|
||||||
|
setting was used.
|
||||||
|
* The intercept and log_subcmds functionality can now use ptrace(2) on Linux
|
||||||
|
systems that support seccomp(2) filtering. This has the advantage of working
|
||||||
|
for both static and dynamic binaries and can work with sudo’s SELinux RBAC mode.
|
||||||
|
The following architectures are currently supported: i386, x86_64, aarch64, arm,
|
||||||
|
mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use
|
||||||
|
ptrace(2) where possible; the new intercept_type sudoers setting can be used
|
||||||
|
to explicitly set the type.
|
||||||
|
* New Georgian translation from translationproject.org.
|
||||||
|
* Fixed creating packages on CentOS Stream.
|
||||||
|
* Fixed a bug in the intercept and log_subcmds support where the execve(2)
|
||||||
|
wrapper was using the current environment instead of the passed environment
|
||||||
|
pointer. Bug #1030.
|
||||||
|
* Added AppArmor integration for Linux. A sudoers rule can now specify an
|
||||||
|
APPARMOR_PROFILE option to run a command confined by the named AppArmor profile.
|
||||||
|
* Fixed parsing of the server_log setting in sudo_logsrvd.conf. Non-paths were
|
||||||
|
being treated as paths and an actual path was treated as an error.
|
||||||
|
|
||||||
|
* Changes in Sudo 1.9.11p1:
|
||||||
|
* Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on
|
||||||
|
some systems when piping a large amount of data through sudo, such as via rsync.
|
||||||
|
Bug #963.
|
||||||
|
* Changes to avoid implementation or unspecified behavior when bit shifting signed
|
||||||
|
values in the protobuf library.
|
||||||
|
* Fixed a compilation error on Linux/aarch64.
|
||||||
|
* Fixed the configure check for seccomp(2) support on Linux.
|
||||||
|
* Corrected the EBNF specification for tags in the sudoers manual page.
|
||||||
|
GitHub issue #153.
|
||||||
|
|
||||||
|
* Changes in Sudo 1.9.11p2:
|
||||||
|
* Fixed a compilation error on Linux/x86_64 with the x32 ABI.
|
||||||
|
* Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to
|
||||||
|
sudo_logsrvd if the command returned no output.
|
||||||
|
|
||||||
|
* Changes in Sudo 1.9.11p3:
|
||||||
|
* Fixed “connection reset” errors on AIX when running shell scripts with the intercept
|
||||||
|
or log_subcmds sudoers options enabled. Bug #1034.
|
||||||
|
* Fixed very slow execution of shell scripts when the intercept or log_subcmds sudoers
|
||||||
|
options are set on systems that enable Nagle’s algorithm on the loopback device,
|
||||||
|
such as AIX. Bug #1034.
|
||||||
|
|
||||||
|
* Modified sudo-sudoers.patch
|
||||||
|
|
||||||
|
- Added sudo-1.9.10-update_sudouser_to_utf8.patch
|
||||||
|
* [bsc#1197998]
|
||||||
|
* Enable sudouser LDAP schema to use UTF-8 encodings.
|
||||||
|
* Sourced from https://github.com/sudo-project/sudo/pull/163
|
||||||
|
* Credit to William Brown, william.brown@suse.com
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Mon Aug 8 09:17:43 UTC 2022 - Thorsten Kukuk <kukuk@suse.com>
|
Mon Aug 8 09:17:43 UTC 2022 - Thorsten Kukuk <kukuk@suse.com>
|
||||||
|
|
||||||
|
@ -17,7 +17,7 @@
|
|||||||
|
|
||||||
|
|
||||||
Name: sudo
|
Name: sudo
|
||||||
Version: 1.9.10
|
Version: 1.9.11p3
|
||||||
Release: 0
|
Release: 0
|
||||||
Summary: Execute some commands as root
|
Summary: Execute some commands as root
|
||||||
License: ISC
|
License: ISC
|
||||||
@ -33,6 +33,7 @@ Source6: fate_313276_test.sh
|
|||||||
Source7: README_313276.test
|
Source7: README_313276.test
|
||||||
# PATCH-OPENSUSE: the "SUSE" branding of the default sudo config
|
# PATCH-OPENSUSE: the "SUSE" branding of the default sudo config
|
||||||
Patch0: sudo-sudoers.patch
|
Patch0: sudo-sudoers.patch
|
||||||
|
Patch1: sudo-1.9.10-update_sudouser_to_utf8.patch
|
||||||
BuildRequires: audit-devel
|
BuildRequires: audit-devel
|
||||||
BuildRequires: cyrus-sasl-devel
|
BuildRequires: cyrus-sasl-devel
|
||||||
BuildRequires: groff
|
BuildRequires: groff
|
||||||
@ -235,13 +236,13 @@ chmod 0440 %{_sysconfdir}/sudoers
|
|||||||
%{_tmpfilesdir}/sudo.conf
|
%{_tmpfilesdir}/sudo.conf
|
||||||
|
|
||||||
%files plugin-python
|
%files plugin-python
|
||||||
%{_mandir}/man8/sudo_plugin_python.8%{?ext_man}
|
%{_mandir}/man5/sudo_plugin_python.5%{?ext_man}
|
||||||
%{_libexecdir}/%{name}/%{name}/python_plugin.so
|
%{_libexecdir}/%{name}/%{name}/python_plugin.so
|
||||||
|
|
||||||
%files devel
|
%files devel
|
||||||
%doc plugins/sample/sample_plugin.c
|
%doc plugins/sample/sample_plugin.c
|
||||||
%{_includedir}/sudo_plugin.h
|
%{_includedir}/sudo_plugin.h
|
||||||
%{_mandir}/man8/sudo_plugin.8%{?ext_man}
|
%{_mandir}/man5/sudo_plugin.5%{?ext_man}
|
||||||
%attr(0644,root,root) %{_libexecdir}/%{name}/libsudo_util.so
|
%attr(0644,root,root) %{_libexecdir}/%{name}/libsudo_util.so
|
||||||
%{_libexecdir}/%{name}/sudo/*.la
|
%{_libexecdir}/%{name}/sudo/*.la
|
||||||
%{_libexecdir}/%{name}/*.la
|
%{_libexecdir}/%{name}/*.la
|
||||||
|
Loading…
Reference in New Issue
Block a user