pool/sudo
SHA256
17
0
Fork 1
Code Issues Pull Requests Activity
Files
slfo-1.2
sudo/sudo-sudoers.patch
Simon Lees 391a744635 - Update to 1.9.17p1 
* Fix a possible local privilege escalation via the --host option
    [bsc#1245274, CVE-2025-32462]
  * Fix a possible local privilege Escalation via chroot option
    [bsc#1245275, CVE-2025-32463]
- Update to 1.9.17
  * Sudo now uses the NODEV macro consistently. Bug #1074.
    Fixed a bug where the ALL command in a sudoers rule would 
    override a previous NOSETENV tag. Command tags are inherited from
    previous Cmnds in a Cmnd_Spec_List. There is a special case for 
    the SETENV tag with the ALL command, where SETENV is implied if
    no explicit SETENV or NOSETENV tag is specified. This special 
    case did not take into account that a NOSETENV tag that was inherited 
    should override this behavior.
  * If sudo is run via ssh without a terminal and a password is required,
    it now suggest using ssh’s -t option.
  * Fixed the display of timeout values in the sudo -V output on systems
    without a C99-compliant snprintf() function.
  * Quieted a number of minor Coverity warnings.
  * Fixed a problem running sudo from a serial console on Linux when the
    command is run in a pseudo-terminal (the default).
  * Fixed a crash in sudo which could occur if there was a fatal error
    after the user was validated but before the command was actually run.
  * Fixed a number of man page style warnings. The “lint” make target in
    the docs directory will now run groff with warnings enabled if it is
    available. Bug #1075.
  * The ignore_dot sudoers setting is now on by default. There is now a
    --disable-ignore-dot configure option to disable it. The 
    --with-ignore-dot configure option has been deprecated.
  * Fixed a problem with the pwfeedback option where an initial backspace
    would reduce the maximum length allowed for the password. 
    GitHub issue #439.
  * Fixed minor grammar and spelling problems in the man pages.
  * Fixed a bug where a user could avoid entering a password for sudo -l
    command if they specified their own user or group name via the -u or
    -g options.
  * Avoid potential password guessing based on timing attacks on the 
    strcmp() function on systems without PAM or a crypt() function where
    plaintext passwords are stored in the shadow password file.
  * Fixed a potential information leak where sudo -l command could be used
    to determine whether an executable exists in a directory that they do
    not have search access to.
  * Sudo uses TCSAFLUSH, not TCSADRAIN, when disabling echo once again.
    A long time ago sudo changed from using TCSAFLUSH to TCSADRAIN due
    to some systems having bugs related to TCSAFLUSH. That should no longer
    be a concern. Using TCSAFLUSH ensures that password input that has been
    received by the kernel, but not yet read by sudo, will be discarded and
    not echoed.
  * Added the SUDO_TTY environment variable if the user has a terminal. 
    This can be used to find the user’s original tty device when sudo runs
    the command in its own pseudo-terminal. GitHub issue #447.
  * New Cantonese translation for sudo.

OBS-URL: https://build.opensuse.org/package/show/Base:System/sudo?expand=0&rev=258
2025-06-30 20:28:18 +00:00

87 lines
4.0 KiB
Diff
Raw Permalink Blame History

Index: sudo-1.9.17p1/plugins/sudoers/sudoers.in
===================================================================
--- sudo-1.9.17p1.orig/plugins/sudoers/sudoers.in
+++ sudo-1.9.17p1/plugins/sudoers/sudoers.in
@@ -50,29 +50,23 @@ Defaults!@visudo@ env_keep += "SUDO_EDIT
## arbitrary commands under sudo.
@secure_path_config@Defaults secure_path="@secure_path@"
##
-## You may wish to keep some of the following environment variables
-## when running commands via sudo.
-##
-## Locale settings
-# Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET"
-##
-## Run X applications through sudo; HOME is used to find the
-## .Xauthority file. Note that other programs use HOME to find
-## configuration files and this may lead to privilege escalation!
-# Defaults env_keep += "HOME"
-##
-## X11 resource path settings
-# Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH"
-##
-## Desktop path settings
-# Defaults env_keep += "QTDIR KDEDIR"
-##
-## Allow sudo-run commands to inherit the callers' ConsoleKit session
-# Defaults env_keep += "XDG_SESSION_COOKIE"
-##
-## Uncomment to enable special input methods. Care should be taken as
-## this may allow users to subvert the command being run via sudo.
-# Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER"
+## Prevent environment variables from influencing programs in an
+## unexpected or harmful way (CVE-2005-2959, CVE-2005-4158, CVE-2006-0151)
+Defaults always_set_home
+Defaults env_reset
+## Change env_reset to !env_reset in previous line to keep all environment variables
+## Following list will no longer be necessary after this change
+Defaults env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE"
+## Comment out the preceding line and uncomment the following one if you need
+## to use special input methods. This may allow users to compromise the root
+## account if they are allowed to run commands without authentication.
+#Defaults env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER"
+
+## Do not insult users when they enter an incorrect password.
+Defaults !insults
+
+## Use this PATH instead of the user's to find commands.
+Defaults secure_path="/usr/sbin:/usr/bin:/sbin:/bin"
##
## Uncomment to disable "use_pty" when running commands as root.
## Commands run as non-root users will run in a pseudo-terminal,
@@ -94,7 +88,6 @@ Defaults!@visudo@ env_keep += "SUDO_EDIT
## Set maxseq to a smaller number if you don't have unlimited disk space.
# Defaults log_output
# Defaults!/usr/bin/sudoreplay !log_output
-# Defaults!/usr/local/bin/sudoreplay !log_output
# Defaults!REBOOT !log_output
# Defaults maxseq = 1000
##
@@ -112,6 +105,12 @@ Defaults!@visudo@ env_keep += "SUDO_EDIT
## modules such as pam_faillock will not be printed.
# Defaults !pam_silent
+## In the default (unconfigured) configuration, sudo asks for the root password.
+## This allows use of an ordinary user account for administration of a freshly
+## installed system.
+Defaults targetpw # ask for the password of the target user i.e. root
+ALL ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'!
+
##
## Runas alias specification
##
@@ -127,13 +126,5 @@ root ALL=(ALL:ALL) ALL
## Same thing without a password
# %wheel ALL=(ALL:ALL) NOPASSWD: ALL
-## Uncomment to allow members of group sudo to execute any command
-# %sudo ALL=(ALL:ALL) ALL
-
-## Uncomment to allow any user to run sudo if they know the password
-## of the user they are running the command as (root by default).
-# Defaults targetpw # Ask for the password of the target user
-# ALL ALL=(ALL:ALL) ALL # WARNING: only use this together with 'Defaults targetpw'
-
## Read drop-in files from @sysconfdir@/sudoers.d
@includedir @sysconfdir@/sudoers.d
Reference in New Issue View Git Blame Copy Permalink