From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1LoJ7a-0002mQ-3g for garchives@archives.gentoo.org; Mon, 30 Mar 2009 15:09:54 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id EEEC5E05A3; Mon, 30 Mar 2009 15:09:52 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id ADCDDE05A3 for ; Mon, 30 Mar 2009 15:09:52 +0000 (UTC) Received: from stork.gentoo.org (stork.gentoo.org [64.127.104.133]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTP id 2B2FC64E8C for ; Mon, 30 Mar 2009 15:09:52 +0000 (UTC) Received: from flameeyes by stork.gentoo.org with local (Exim 4.69) (envelope-from ) id 1LoJ7X-0003PI-N9 for gentoo-commits@lists.gentoo.org; Mon, 30 Mar 2009 15:09:51 +0000 From: "Diego Petteno (flameeyes)" To: gentoo-commits@lists.gentoo.org Reply-To: gentoo-dev@lists.gentoo.org, flameeyes@gentoo.org Subject: [gentoo-commits] gentoo-x86 commit in app-admin/sudo: ChangeLog sudo-1.7.1_beta5.ebuild sudo-1.7.1_beta4.ebuild X-VCS-Repository: gentoo-x86 X-VCS-Files: ChangeLog sudo-1.7.1_beta5.ebuild sudo-1.7.1_beta4.ebuild X-VCS-Directories: app-admin/sudo X-VCS-Committer: flameeyes X-VCS-Committer-Name: Diego Petteno Content-Type: text/plain; charset=utf8 Message-Id: Sender: Diego Petteno Date: Mon, 30 Mar 2009 15:09:51 +0000 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: quoted-printable X-Archives-Salt: ba653eb7-a816-4853-9d7e-1f4c4a86c6e2 X-Archives-Hash: 9355675f47b02957fd4537f83dfb5d19 flameeyes 09/03/30 15:09:51 Modified: ChangeLog Added: sudo-1.7.1_beta5.ebuild Removed: sudo-1.7.1_beta4.ebuild Log: Bump development version. (Portage version: 2.2_rc27/cvs/Linux x86_64) Revision Changes Path 1.168 app-admin/sudo/ChangeLog file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-admin/sudo/Cha= ngeLog?rev=3D1.168&view=3Dmarkup plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-admin/sudo/Cha= ngeLog?rev=3D1.168&content-type=3Dtext/plain diff : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-admin/sudo/Cha= ngeLog?r1=3D1.167&r2=3D1.168 Index: ChangeLog =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D RCS file: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v retrieving revision 1.167 retrieving revision 1.168 diff -u -r1.167 -r1.168 --- ChangeLog 27 Mar 2009 18:38:20 -0000 1.167 +++ ChangeLog 30 Mar 2009 15:09:51 -0000 1.168 @@ -1,6 +1,12 @@ # ChangeLog for app-admin/sudo # Copyright 2002-2009 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.167 2009= /03/27 18:38:20 armin76 Exp $ +# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.168 2009= /03/30 15:09:51 flameeyes Exp $ + +*sudo-1.7.1_beta5 (30 Mar 2009) + + 30 Mar 2009; Diego E. Petten=C3=B2 + -sudo-1.7.1_beta4.ebuild, +sudo-1.7.1_beta5.ebuild: + Bump development version. =20 27 Mar 2009; Ra=C3=BAl Porcel sudo-1.7.0.ebuild: m68k stable, thanks to kolla for testing 1.1 app-admin/sudo/sudo-1.7.1_beta5.ebuild file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-admin/sudo/sud= o-1.7.1_beta5.ebuild?rev=3D1.1&view=3Dmarkup plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-admin/sudo/sud= o-1.7.1_beta5.ebuild?rev=3D1.1&content-type=3Dtext/plain Index: sudo-1.7.1_beta5.ebuild =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D # Copyright 1999-2009 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 # $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.7.1_beta5.ebuild= ,v 1.1 2009/03/30 15:09:51 flameeyes Exp $ inherit eutils pam confutils MY_P=3D${P/_/} MY_P=3D${MY_P/beta/b} case "${P}" in *_beta* | *_rc*) uri_prefix=3Dbeta/ ;; *) uri_prefix=3D"" ;; esac DESCRIPTION=3D"Allows users or groups to run commands as other users" HOMEPAGE=3D"http://www.sudo.ws/" SRC_URI=3D"ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz" LICENSE=3D"Sudo" SLOT=3D"0" KEYWORDS=3D"~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 = ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd" IUSE=3D"pam skey offensive ldap selinux" DEPEND=3D"pam? ( virtual/pam ) ldap? ( >=3Dnet-nds/openldap-2.1.30-r1 dev-libs/cyrus-sasl ) skey? ( >=3Dsys-auth/skey-1.1.5-r1 ) virtual/editor virtual/mta" RDEPEND=3D"selinux? ( sec-policy/selinux-sudo ) ldap? ( dev-lang/perl ) pam? ( sys-auth/pambase ) ${DEPEND}" DEPEND=3D"${DEPEND} sys-devel/bison" S=3D${WORKDIR}/${MY_P} pkg_setup() { confutils_use_conflict skey pam } src_unpack() { unpack ${A}; cd "${S}" # compatability fix. epatch "${FILESDIR}"/${PN}-skeychallengeargs.diff # additional variables to disallow, should user disable env_reset. # NOTE: this is not a supported mode of operation, these variables # are added to the blacklist as a convenience to administrators # who fail to heed the warnings of allowing untrusted users # to access sudo. # # there is *no possible way* to foresee all attack vectors in # all possible applications that could potentially be used via # sudo, these settings will just delay the inevitable. # # that said, I will accept suggestions for variables that can # be misused in _common_ interpreters or libraries, such as # perl, bash, python, ruby, etc., in the hope of dissuading # a casual attacker. # XXX: perl should be using suid_perl. # XXX: users can remove/add more via env_delete and env_check. # XXX: =3D probably safe enough for most circumstances. einfo "Blacklisting common variables (env_delete)..." sudo_bad_var() { local target=3D'env.c' marker=3D'\*initial_badenv_table\[\]' ebegin " $1" sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' "${S}"/${target} eend $? } sudo_bad_var 'PERLIO_DEBUG' # perl, write debug to file. sudo_bad_var 'FPATH' # ksh, search path for functions. sudo_bad_var 'NULLCMD' # zsh, command on null-redir. sudo_bad_var 'READNULLCMD' # zsh, command on null-redir. sudo_bad_var 'GLOBIGNORE' # bash, glob paterns to ignore. sudo_bad_var 'PYTHONHOME' # python, module search path. sudo_bad_var 'PYTHONPATH' # python, search path. sudo_bad_var 'PYTHONINSPECT' # python, allow inspection. sudo_bad_var 'RUBYLIB' # ruby, lib load path. sudo_bad_var 'RUBYOPT' # ruby, cl options. sudo_bad_var 'ZDOTDIR' # zsh, path to search for dotfiles. einfo "...done." # prevent binaries from being stripped. sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in # remove useless c++ checks epunt_cxx } src_compile() { local line ROOTPATH # FIXME: secure_path is a compile time setting. using ROOTPATH # is not perfect, env-update may invalidate this, but until it # is available as a sudoers setting this will have to do. einfo "Setting secure_path..." # why not use grep? variable might be expanded from other variables # declared in that file. cannot just source the file, would override # any variables already set. eval `PS4=3D bash -x /etc/profile.env 2>&1 | \ while read line; do case $line in ROOTPATH=3D*) echo $line; break;; *) continue;; esac done` && einfo " Found ROOTPATH..." || \ ewarn " Failed to find ROOTPATH, please report this." # remove duplicate path entries from $1 cleanpath() { local i=3D1 x n IFS=3D: local -a paths; paths=3D($1) for ((n=3D${#paths[*]}-1;i<=3Dn;i++)); do for ((x=3D0;x&2 unset paths[i]; continue 2; } done; # einfo " Adding ${paths[i]}..." 1>&2 done; echo "${paths[*]}" } ROOTPATH=3D$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/us= r/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}}) # strip gcc path (bug #136027) rmpath() { declare e newpath oldpath=3D${!1} PATHvar=3D$1 thisp IFS=3D: shift for thisp in $oldpath; do for e; do [[ $thisp =3D=3D $e ]] && continue 2; done newpath=3D$newpath:$thisp done eval $PATHvar=3D'${newpath#:}' } rmpath ROOTPATH '*/gcc-bin/*' einfo "...done." # XXX: --disable-path-info closes an info leak, but may be confusing. # XXX: /bin/vi may not be available, make nano visudo's default. econf --with-secure-path=3D"${ROOTPATH}" \ --with-editor=3D/bin/nano \ --with-env-editor \ $(use_with offensive insults) \ $(use_with offensive all-insults) \ $(use_with pam) \ $(use_with skey) \ $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) \ $(use_with ldap) || die emake || die } src_install() { emake DESTDIR=3D"${D}" install || die dodoc ChangeLog HISTORY PORTING README TROUBLESHOOTING \ UPGRADE WHATSNEW sample.sudoers sample.syslog.conf if use ldap; then dodoc README.LDAP schema.OpenLDAP dosbin sudoers2ldif cat - > "${T}"/ldap.conf.sudo <