- Update to 1.9.15p5:
* Fixed evaluation of the lecture, listpw, verifypw, and fdexec sudoers
Defaults settings when used without an explicit value. Previously, if
specified without a value they were evaluated as boolean false, even when
the negation operator ('!') was not present.
* Fixed a bug introduced in sudo 1.9.14 that prevented LDAP netgroup queries
using the NETGROUP_BASE setting from being performed.
* Sudo will now transparently rename a user's lecture file from the older
name-based path to the newer user-ID-based path. GitHub issue #342.
* Fixed a bug introduced in sudo 1.9.15 that could cause a memory allocation
failure if sysconf(_SC_LOGIN_NAME_MAX) fails. Bug #1066.
OBS-URL: https://build.opensuse.org/request/show/1136064
OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=251
- For existing products (SLE15-SP* and older) keep using /etc and don't
switch to /usr/etc. So only SLES16/ALP, Tumbleweed and newer products
will use both /etc and /usr/etc locations.
- Update to 1.9.15p4:
* Fixed a bug introduced in sudo 1.9.15 that could prevent a user’s
privileges from being listed by sudo -l if the sudoers entry
in /etc/nsswitch.conf contains [SUCCESS=return]. This did not affect the
ability to run commands via sudo. Bug #1063.
- Update to 1.9.15p3:
* Always disable core dumps when sudo sends itself a fatal signal. Fixes a
problem where sudo could potentially dump core dump when it re-sends the
fatal signal to itself. This is only an issue if the command * received
a signal that would normally result in a core dump but the command did
not actually dump core.
* Fixed a bug matching a command with a relative path name when the sudoers
rule uses shell globbing rules for the path name. Bug #1062.
* Permit visudo to be run even if the local host name is not set. GitHub
issue #332.
* Fixed an editing error introduced in sudo 1.9.15 that could prevent
sudoreplay from replaying sessions correctly. GitHub issue #334.
* Fixed a bug introduced in sudo 1.9.15 where sudo -l > /dev/null could hang
on Linux systems. GitHub issue #335.
* Fixed a bug introduced in sudo 1.9.15 where Solaris privileges specified
in sudoers were not applied to the command being run.
OBS-URL: https://build.opensuse.org/request/show/1134033
OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=249
- Update to 1.9.15p2:
* Fixed a bug on BSD systems where sudo would not restore the
terminal settings on exit if the terminal had parity enabled.
GitHub issue #326.
- Update to 1.9.15p1:
* Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based
sudoers from being able to read the ldap.conf file.
GitHub issue #325.
- Update to 1.9.15:
* Fixed an undefined symbol problem on older versions of macOS
when "intercept" or "log_subcmds" are enabled in sudoers.
GitHub issue #276.
* Fixed "make check" failure related to getpwent(3) wrapping
on NetBSD.
* Fixed the warning message for "sudo -l command" when the command
is not permitted. There was a missing space between "list" and
the actual command due to changes in sudo 1.9.14.
* Fixed a bug where output could go to the wrong terminal if
"use_pty" is enabled (the default) and the standard input, output
or error is redirected to a different terminal. Bug #1056.
* The visudo utility will no longer create an empty file when the
specified sudoers file does not exist and the user exits the
editor without making any changes. GitHub issue #294.
* The AIX and Solaris sudo packages on www.sudo.ws now support
"log_subcmds" and "intercept" with both 32-bit and 64-bit
binaries. Previously, they only worked when running binaries
with the same word size as the sudo binary. GitHub issue #289.
* The sudoers source is now logged in the JSON event log. This
makes it possible to tell which rule resulted in a match.
* Running "sudo -ll command" now produces verbose output that
OBS-URL: https://build.opensuse.org/request/show/1128361
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/sudo?expand=0&rev=149
- Update to 1.9.15p2:
* Fixed a bug on BSD systems where sudo would not restore the
terminal settings on exit if the terminal had parity enabled.
GitHub issue #326.
- Update to 1.9.15p1:
* Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based
sudoers from being able to read the ldap.conf file.
GitHub issue #325.
- Update to 1.9.15:
* Fixed an undefined symbol problem on older versions of macOS
when "intercept" or "log_subcmds" are enabled in sudoers.
GitHub issue #276.
* Fixed "make check" failure related to getpwent(3) wrapping
on NetBSD.
* Fixed the warning message for "sudo -l command" when the command
is not permitted. There was a missing space between "list" and
the actual command due to changes in sudo 1.9.14.
* Fixed a bug where output could go to the wrong terminal if
"use_pty" is enabled (the default) and the standard input, output
or error is redirected to a different terminal. Bug #1056.
* The visudo utility will no longer create an empty file when the
specified sudoers file does not exist and the user exits the
editor without making any changes. GitHub issue #294.
* The AIX and Solaris sudo packages on www.sudo.ws now support
"log_subcmds" and "intercept" with both 32-bit and 64-bit
binaries. Previously, they only worked when running binaries
with the same word size as the sudo binary. GitHub issue #289.
* The sudoers source is now logged in the JSON event log. This
makes it possible to tell which rule resulted in a match.
* Running "sudo -ll command" now produces verbose output that
OBS-URL: https://build.opensuse.org/request/show/1128140
OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=247
- Update to 1.9.14p3:
* Fixed a crash with Python 3.12 when the sudo Python python is unloaded.
This only affects make check for the Python plugin.
* Adapted the sudo Python plugin test output to match Python 3.12.
- Update to 1.9.14p2:
* Fixed a crash on Linux systems introduced in version 1.9.14 when running a
command with a NULL argv[0] if log_subcmds or intercept is enabled in
sudoers.
* Fixed a problem with "stair-stepped" output when piping or redirecting the
output of a sudo command that takes user input when running a command in
a pseudo-terminal.
* Fixed a bug introduced in sudo 1.9.14 that affects matching sudoers rules
containing a Runas_Spec with an empty Runas user. These rules should only
match when sudo’s -g option is used but were matching even without the -g
option. #290.
OBS-URL: https://build.opensuse.org/request/show/1110618
OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=243
- Update to 1.9.14p1:
* Fixed an invalid free bug in sudo_logsrvd that was introduced
in version 1.9.14 which could cause sudo_logsrvd to crash.
* The sudoers plugin no longer tries to send the terminal name
to the log server when no terminal is present. This bug was
introduced in version 1.9.14.
* Fixed a bug where if the "intercept" or "log_subcmds" sudoers
option was enabled and a sub-command was run where the first
entry of the argument vector didn't match the command being run.
This resulted in commands like "sudo su -" being killed due to
the mismatch. Bug #1050.
* The sudoers plugin now canonicalizes command path names before
matching (where possible). This fixes a bug where sudo could
execute the wrong path if there are multiple symbolic links with
the same target and the same base name in sudoers that a user is
allowed to run. GitHub issue #228.
* Improved command matching when a chroot is specified in sudoers.
The sudoers plugin will now change the root directory id needed
before performing command matching. Previously, the root directory
was simply prepended to the path that was being processed.
* When NETGROUP_BASE is set in the ldap.conf file, sudo will now
perform its own netgroup lookups of the host name instead of
using the system innetgr(3) function. This guarantees that user
and host netgroup lookups are performed using the same LDAP
server (or servers).
* Fixed a bug introduced in sudo 1.9.13 that resulted in a missing
" ; " separator between environment variables and the command
in log entries.
* The visudo utility now displays a warning when it ignores a file
in an include dir such as /etc/sudoers.d.
OBS-URL: https://build.opensuse.org/request/show/1098344
OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=241
- update to 1.9.10:
* Added new log_passwords and passprompt_regex sudoers options. If
log_passwords is disabled, sudo will attempt to prevent passwords from being
logged. If sudo detects any of the regular expressions in the passprompt_regex
list in the terminal output, sudo will log ‘*’ characters instead of the
terminal input until a newline or carriage return is found in the input or an
output character is received.
* Added new log_passwords and passprompt_regex settings to sudo_logsrvd that
operate like the sudoers options when logging terminal input.
* Fixed several few bugs in the cvtsudoers utility when merging multiple sudoers
sources.
* Fixed a bug in sudo_logsrvd parsing the sudo_logsrvd.conf file, where the
retry_interval in the [relay] section was not being recognized.
* Restored the pre-1.9.9 behavior of not performing authentication when sudo’s -n
option is specified. A new noninteractive_auth sudoers option has been added to
enable PAM authentication in non-interactive mode. GitHub issue #131.
* On systems with /proc, if the /proc/self/stat (Linux) or /proc/pid/psinfo
(other systems) file is missing or invalid, sudo will now check file
descriptors 0-2 to determine the user’s terminal. Bug #1020.
* Fixed a compilation problem on Debian kFreeBSD. Bug #1021.
* Fixed a crash in sudo_logsrvd when running in relay mode if an alert message is
received.
* Fixed an issue that resulting in “problem with defaults entries” email to be
sent if a user ran sudo when the sudoers entry in the nsswitch.conf file
includes “sss” but no sudo provider is configured in /etc/sssd/sssd.conf.
* Updated the warning displayed when the invoking user is not allowed to run
sudo. If sudo has been configured to send mail on failed attempts (see the
mail_* flags in sudoers), it will now print “This incident has been reported to
the administrator.” If the mailto or mailerpath sudoers settings are disabled,
the message will not be printed and no mail will be sent.
OBS-URL: https://build.opensuse.org/request/show/964503
OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=211
- Update to 1.9.9
* Sudo can now be built with OpenSSL 3.0 without generating
warnings about deprecated OpenSSL APIs.
* A digest can now be specified along with the ALL command in
the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for
this in the sudoers file but did not include corresponding
changes for the other back-ends.
* visudo now only warns about an undefined alias or a cycle in
an alias once for each alias.
* The sudoRole cn was truncated by a single character in warning
messages. GitHub issue #115.
* The cvtsudoers utility has new --group-file and --passwd-file
options to use a custom passwd or group file when the
--match-local option is also used.
* The cvtsudoers utility can now filter or match based on a command.
* The cvtsudoers utility can now produce output in csv
(comma-separated value) format. This can be used to help generate
entitlement reports.
* Fixed a bug in sudo_logsrvd that could result in the connection
being dropped for very long command lines.
* Fixed a bug where sudo_logsrvd would not accept a restore point
of zero.
* Fixed a bug in visudo where the value of the editor setting was
not used if it did not match the user’s EDITOR environment
variable. This was only a problem if the env_editor setting was
not enabled. Bug #1000.
* Sudo now builds with the -fcf-protection compiler option and the
-z now linker option if supported.
* The output of sudoreplay -l now more closely matches the
traditional sudo log format.
* The sudo_sendlog utility will now use the full contents of the
log.json file, if present. This makes it possible to send
sudo-format I/O logs that use the newer log.json format to
sudo_logsrvd without losing any information.
* Fixed compilation of the arc4random_buf() replacement on systems
with arc4random() but no arc4random_buf(). Bug #1008.
* Sudo now uses its own getentropy() by default on Linux. The GNU
libc version of getentropy() will fail on older kernels that
don’t support the getrandom() system call.
* It is now possible to build sudo with WolfSSL’s OpenSSL
compatibility layer by using the --enable-wolfssl configure
option.
* Fixed a bug related to Daylight Saving Time when parsing
timestamps in Generalized Time format. This affected the NOTBEFORE
and NOTAFTER options in sudoers. Bug #1006.
* Added the -O and -P options to visudo, which can be used to check
or set the owner and permissions. This can be used in conjunction
with the -c option to check that the sudoers file ownership and
permissions are correct. Bug #1007.
* It is now possible to set resource limits in the sudoers file
itself. The special values default and “user” refer to the
default system limit and invoking user limit respectively. The
core dump size limit is now set to 0 by default unless overridden
by the sudoers file.
* The cvtsudoers utility can now merge multiple sudoers sources into
a single, combined sudoers file. If there are conflicting entries,
cvtsudoers will attempt to resolve them but manual intervention
may be required. The merging of sudoers rules is currently fairly
simplistic but will be improved in a future release.
* Sudo was parsing but not applying the “deref” and “tls_reqcert”
ldap.conf settings. This meant the options were effectively ignored
which broke dereferencing of aliases in LDAP. Bug #1013.
* Clarified in the sudo man page that the security policy may
override the user’s PATH environment variable. Bug #1014.
* When sudo is run in non-interactive mode (with the -n option), it
will now attempt PAM authentication and only exit with an error if
user interaction is required. This allows PAM modules that don’t
interact with the user to succeed. Previously, sudo would not
attempt authentication if the -n option was specified. Bug #956
and GitHub issue #83.
* Fixed a regression introduced in version 1.9.1 when sudo is built
with the --with-fqdn configure option. The local host name was
being resolved before the sudoers file was processed, making it
impossible to disable DNS lookups by negating the fqdn sudoers
option. Bug #1016.
* Added support for negated sudoUser attributes in the LDAP and SSSD
sudoers back ends. A matching sudoUser that is negated will cause
the sudoRole containing it to be ignored.
* Fixed a bug where the stack resource limit could be set to a value
smaller than that of the invoking user and not be reset before the
command was run. Bug #1016.
- sudo no longer ships schema for LDAP.
- sudo-feature-negated-LDAP-users.patch dropped, included upstream
- refreshed sudo-sudoers.patch
OBS-URL: https://build.opensuse.org/request/show/950728
OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=207
