Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package sudo for openSUSE:Factory checked in at 2024-01-03 12:23:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sudo (Old) and /work/SRC/openSUSE:Factory/.sudo.new.28375 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sudo" Wed Jan 3 12:23:00 2024 rev:151 rq:1136065 version:1.9.15p5 Changes: -------- --- /work/SRC/openSUSE:Factory/sudo/sudo.changes 2023-12-20 21:01:14.304244862 +0100 +++ /work/SRC/openSUSE:Factory/.sudo.new.28375/sudo.changes 2024-01-03 12:23:03.619250789 +0100 @@ -1,0 +2,15 @@ +Tue Jan 2 07:18:04 UTC 2024 - Otto Hollmann <otto.hollm...@suse.com> + +- Update to 1.9.15p5: + * Fixed evaluation of the lecture, listpw, verifypw, and fdexec sudoers + Defaults settings when used without an explicit value. Previously, if + specified without a value they were evaluated as boolean false, even when + the negation operator ('!') was not present. + * Fixed a bug introduced in sudo 1.9.14 that prevented LDAP netgroup queries + using the NETGROUP_BASE setting from being performed. + * Sudo will now transparently rename a user's lecture file from the older + name-based path to the newer user-ID-based path. GitHub issue #342. + * Fixed a bug introduced in sudo 1.9.15 that could cause a memory allocation + failure if sysconf(_SC_LOGIN_NAME_MAX) fails. Bug #1066. + +------------------------------------------------------------------- Old: ---- sudo-1.9.15p4.tar.gz sudo-1.9.15p4.tar.gz.sig New: ---- sudo-1.9.15p5.tar.gz sudo-1.9.15p5.tar.gz.sig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sudo.spec ++++++ --- /var/tmp/diff_new_pack.jQOqH5/_old 2024-01-03 12:23:05.551321402 +0100 +++ /var/tmp/diff_new_pack.jQOqH5/_new 2024-01-03 12:23:05.551321402 +0100 @@ -1,7 +1,7 @@ # # spec file for package sudo # -# Copyright (c) 2023 SUSE LLC +# Copyright (c) 2024 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -25,7 +25,7 @@ %endif Name: sudo -Version: 1.9.15p4 +Version: 1.9.15p5 Release: 0 Summary: Execute some commands as root License: ISC ++++++ sudo-1.9.15p4.tar.gz -> sudo-1.9.15p5.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/ChangeLog new/sudo-1.9.15p5/ChangeLog --- old/sudo-1.9.15p4/ChangeLog 2023-12-15 20:10:37.000000000 +0100 +++ new/sudo-1.9.15p5/ChangeLog 2023-12-29 22:48:37.000000000 +0100 @@ -1,8 +1,69 @@ +2023-12-29 Todd C. Miller <todd.mil...@sudo.ws> + + * .hgtags: + Added tag SUDO_1_9_15p5 for changeset 4418cfdc5b2a + [c1df7aef0fa8] [tip] <1.9> + + * NEWS, configure, configure.ac: + Sudo 1.9.15p5 + [4418cfdc5b2a] [SUDO_1_9_15p5] <1.9> + +2023-12-28 Todd C. Miller <todd.mil...@sudo.ws> + + * plugins/sudoers/cvtsudoers_pwutil.c, plugins/sudoers/pwutil_impl.c: + Properly handle sysconf(_SC_LOGIN_NAME_MAX) returning -1 on failure. + + The cast to size_t needs to be outside the MAX() macro or the -1 + will get cast to unsigned. + [343b22c1fc59] <1.9> + +2023-12-22 Todd C. Miller <todd.mil...@sudo.ws> + + * config.h.in, configure, configure.ac, plugins/sudoers/timestamp.c: + Automatically migrate lecture file path from name-based to uid- + based. + + GitHub issue #342. + [cfa82cf5ac29] <1.9> + +2023-12-19 Todd C. Miller <todd.mil...@sudo.ws> + + * plugins/sudoers/ldap_conf.c: + Disable netgroup_query when netgroup_base is not set. + + The logic was inverted when support for netgroup_query was added. + This supercedes PR #341. + [a575b106220e] <1.9> + + * docs/sudoers.man.in, docs/sudoers.mdoc.in: + In the NOEXEC example make it clear that "shanty" is a host. Bug + #1064 + [18e3b6a981d4] <1.9> + +2023-12-16 Todd C. Miller <todd.mil...@sudo.ws> + + * plugins/sudoers/defaults.c: + Fix printing of warning when a Defaults setting is missing a value. + + This is a bug in parse_default_entry() introduced in sudo 1.8.19 + when support for using the default syslog facility was added at the + wrong place in a switch(). + [f9de87a2f501] <1.9> + 2023-12-15 Todd C. Miller <todd.mil...@sudo.ws> + * plugins/sudoers/defaults.c: + Fix evaluation of a tuple used in "true" boolean context. + + Previously, a tuple in boolean context was always treated as a + negated entry, which doesn't match the documentation. We assume that + there are at least two tuple entries where the first maps to boolean + false and the second maps to boolean true. + [39a6e634c9d6] <1.9> + * .hgtags: Added tag SUDO_1_9_15p4 for changeset cc9d22d261de - [382e15393814] [tip] <1.9> + [382e15393814] <1.9> * NEWS, configure, configure.ac: Sudo 1.9.15p4 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/NEWS new/sudo-1.9.15p5/NEWS --- old/sudo-1.9.15p4/NEWS 2023-12-15 20:08:42.000000000 +0100 +++ new/sudo-1.9.15p5/NEWS 2023-12-29 22:47:10.000000000 +0100 @@ -1,3 +1,22 @@ +What's new in Sudo 1.9.15p5 + + * Fixed evaluation of the "lecture", "listpw", "verifypw", and + "fdexec" sudoers Defaults settings when used without an explicit + value. Previously, if specified without a value they were + evaluated as boolean "false", even when the negation operator + ('!') was not present. + + * Fixed a bug introduced in sudo 1.9.14 that prevented LDAP + netgroup queries using the NETGROUP_BASE setting from being + performed. + + * Sudo will now transparently rename a user's lecture file from + the older name-based path to the newer user-ID-based path. + GitHub issue #342. + + * Fixed a bug introduced in sudo 1.9.15 that could cause a memory + allocation failure if sysconf(_SC_LOGIN_NAME_MAX) fails. Bug #1066. + What's new in Sudo 1.9.15p4 * Fixed a bug introduced in sudo 1.9.15 that could prevent a user's diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/config.h.in new/sudo-1.9.15p5/config.h.in --- old/sudo-1.9.15p4/config.h.in 2023-12-15 20:08:30.000000000 +0100 +++ new/sudo-1.9.15p5/config.h.in 2023-12-29 22:46:18.000000000 +0100 @@ -758,6 +758,9 @@ /* Define to 1 if you have the 'realpath' function. */ #undef HAVE_REALPATH +/* Define to 1 if you have the 'renameat' function. */ +#undef HAVE_RENAMEAT + /* Define to 1 if you have the 'revoke' function. */ #undef HAVE_REVOKE diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/configure new/sudo-1.9.15p5/configure --- old/sudo-1.9.15p4/configure 2023-12-15 20:08:57.000000000 +0100 +++ new/sudo-1.9.15p5/configure 2023-12-29 22:47:36.000000000 +0100 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.72c for sudo 1.9.15p4. +# Generated by GNU Autoconf 2.72c for sudo 1.9.15p5. # # Report bugs to <https://bugzilla.sudo.ws/>. # @@ -614,8 +614,8 @@ # Identity of this package. PACKAGE_NAME='sudo' PACKAGE_TARNAME='sudo' -PACKAGE_VERSION='1.9.15p4' -PACKAGE_STRING='sudo 1.9.15p4' +PACKAGE_VERSION='1.9.15p5' +PACKAGE_STRING='sudo 1.9.15p5' PACKAGE_BUGREPORT='https://bugzilla.sudo.ws/' PACKAGE_URL='' @@ -1642,7 +1642,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -'configure' configures sudo 1.9.15p4 to adapt to many kinds of systems. +'configure' configures sudo 1.9.15p5 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1708,7 +1708,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of sudo 1.9.15p4:";; + short | recursive ) echo "Configuration of sudo 1.9.15p5:";; esac cat <<\_ACEOF @@ -2003,7 +2003,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -sudo configure 1.9.15p4 +sudo configure 1.9.15p5 generated by GNU Autoconf 2.72c Copyright (C) 2023 Free Software Foundation, Inc. @@ -2823,7 +2823,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by sudo $as_me 1.9.15p4, which was +It was created by sudo $as_me 1.9.15p5, which was generated by GNU Autoconf 2.72c. Invocation command line was $ $0$ac_configure_args_raw @@ -3439,13 +3439,14 @@ as_fn_append ac_header_c_list " sys/stropts.h sys_stropts_h HAVE_SYS_STROPTS_H" as_fn_append ac_header_c_list " sys/sysmacros.h sys_sysmacros_h HAVE_SYS_SYSMACROS_H" as_fn_append ac_header_c_list " sys/statvfs.h sys_statvfs_h HAVE_SYS_STATVFS_H" +as_fn_append ac_func_c_list " faccessat HAVE_FACCESSAT" as_fn_append ac_func_c_list " fexecve HAVE_FEXECVE" as_fn_append ac_func_c_list " fmemopen HAVE_FMEMOPEN" as_fn_append ac_func_c_list " killpg HAVE_KILLPG" as_fn_append ac_func_c_list " nl_langinfo HAVE_NL_LANGINFO" -as_fn_append ac_func_c_list " faccessat HAVE_FACCESSAT" -as_fn_append ac_func_c_list " wordexp HAVE_WORDEXP" +as_fn_append ac_func_c_list " renameat HAVE_RENAMEAT" as_fn_append ac_func_c_list " strtoull HAVE_STRTOULL" +as_fn_append ac_func_c_list " wordexp HAVE_WORDEXP" as_fn_append ac_func_c_list " seteuid HAVE_SETEUID" # Auxiliary files required by this configure script. @@ -22281,6 +22282,7 @@ + for ac_func in execvpe do : ac_fn_c_check_func "$LINENO" "execvpe" "ac_cv_func_execvpe" @@ -36671,7 +36673,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by sudo $as_me 1.9.15p4, which was +This file was extended by sudo $as_me 1.9.15p5, which was generated by GNU Autoconf 2.72c. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -36739,7 +36741,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -sudo config.status 1.9.15p4 +sudo config.status 1.9.15p5 configured by $0, generated by GNU Autoconf 2.72c, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/configure.ac new/sudo-1.9.15p5/configure.ac --- old/sudo-1.9.15p4/configure.ac 2023-12-15 20:08:44.000000000 +0100 +++ new/sudo-1.9.15p5/configure.ac 2023-12-29 22:47:12.000000000 +0100 @@ -18,7 +18,7 @@ dnl OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. dnl AC_PREREQ([2.69]) -AC_INIT([sudo], [1.9.15p4], [https://bugzilla.sudo.ws/], [sudo]) +AC_INIT([sudo], [1.9.15p5], [https://bugzilla.sudo.ws/], [sudo]) AC_CONFIG_HEADERS([config.h pathnames.h]) AC_CONFIG_SRCDIR([src/sudo.c]) AC_CONFIG_AUX_DIR([scripts]) @@ -2660,7 +2660,7 @@ dnl AC_FUNC_GETGROUPS AC_FUNC_FSEEKO -AC_CHECK_FUNCS_ONCE([fexecve fmemopen killpg nl_langinfo faccessat wordexp strtoull]) +AC_CHECK_FUNCS_ONCE([faccessat fexecve fmemopen killpg nl_langinfo renameat strtoull wordexp]) AC_CHECK_FUNCS([execvpe], [SUDO_APPEND_INTERCEPT_EXP(execvpe)]) AC_CHECK_FUNCS([pread], [ # pread/pwrite on 32-bit HP-UX 11.x may not support large files diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/docs/sudoers.man.in new/sudo-1.9.15p5/docs/sudoers.man.in --- old/sudo-1.9.15p4/docs/sudoers.man.in 2023-12-15 20:08:30.000000000 +0100 +++ new/sudo-1.9.15p5/docs/sudoers.man.in 2023-12-29 22:45:50.000000000 +0100 @@ -25,7 +25,7 @@ .nr BA @BAMAN@ .nr LC @LCMAN@ .nr PS @PSMAN@ -.TH "SUDOERS" "@mansectform@" "November 6, 2023" "Sudo @PACKAGE_VERSION@" "File Formats Manual" +.TH "SUDOERS" "@mansectform@" "December 19, 2023" "Sudo @PACKAGE_VERSION@" "File Formats Manual" .nh .if n .ad l .SH "NAME" @@ -1929,7 +1929,7 @@ \fI/usr/bin/more\fR and \fI/usr/bin/vi\fR -but shell escapes will be disabled. +on the host shanty, but shell escapes will be disabled. .nf .sp .RS 2n diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/docs/sudoers.mdoc.in new/sudo-1.9.15p5/docs/sudoers.mdoc.in --- old/sudo-1.9.15p4/docs/sudoers.mdoc.in 2023-12-15 20:08:30.000000000 +0100 +++ new/sudo-1.9.15p5/docs/sudoers.mdoc.in 2023-12-29 22:45:40.000000000 +0100 @@ -25,7 +25,7 @@ .nr BA @BAMAN@ .nr LC @LCMAN@ .nr PS @PSMAN@ -.Dd November 6, 2023 +.Dd December 19, 2023 .Dt SUDOERS @mansectform@ .Os Sudo @PACKAGE_VERSION@ .Sh NAME @@ -1846,7 +1846,7 @@ .Pa /usr/bin/more and .Pa /usr/bin/vi -but shell escapes will be disabled. +on the host shanty, but shell escapes will be disabled. .Bd -literal aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi .Ed diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/plugins/sudoers/cvtsudoers_pwutil.c new/sudo-1.9.15p5/plugins/sudoers/cvtsudoers_pwutil.c --- old/sudo-1.9.15p4/plugins/sudoers/cvtsudoers_pwutil.c 2023-12-15 20:08:29.000000000 +0100 +++ new/sudo-1.9.15p5/plugins/sudoers/cvtsudoers_pwutil.c 2023-12-29 22:46:18.000000000 +0100 @@ -421,7 +421,7 @@ } #ifdef _SC_LOGIN_NAME_MAX - groupname_len = MAX((size_t)sysconf(_SC_LOGIN_NAME_MAX), 32); + groupname_len = (size_t)MAX(sysconf(_SC_LOGIN_NAME_MAX), 32); #else groupname_len = MAX(LOGIN_NAME_MAX, 32); #endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/plugins/sudoers/defaults.c new/sudo-1.9.15p5/plugins/sudoers/defaults.c --- old/sudo-1.9.15p4/plugins/sudoers/defaults.c 2023-12-15 20:08:29.000000000 +0100 +++ new/sudo-1.9.15p5/plugins/sudoers/defaults.c 2023-12-29 22:45:01.000000000 +0100 @@ -67,7 +67,7 @@ static bool store_syslogfac(const char *str, struct sudo_defs_types *def); static bool store_syslogpri(const char *str, struct sudo_defs_types *def); static bool store_timeout(const char *str, struct sudo_defs_types *def); -static bool store_tuple(const char *str, struct sudo_defs_types *def); +static bool store_tuple(const char *str, struct sudo_defs_types *def, int op); static bool store_uint(const char *str, struct sudo_defs_types *def); static bool store_timespec(const char *str, struct sudo_defs_types *def); static bool store_rlimit(const char *str, struct sudo_defs_types *def); @@ -233,18 +233,18 @@ */ if (val == NULL) { switch (def->type & T_MASK) { - case T_FLAG: - break; - case T_TUPLE: - if (ISSET(def->type, T_BOOL)) - break; - FALLTHROUGH; case T_LOGFAC: if (op == true) { /* Use default syslog facility if none specified. */ val = LOGFAC; } break; + case T_FLAG: + break; + case T_TUPLE: + if (ISSET(def->type, T_BOOL)) + break; + FALLTHROUGH; default: if (!ISSET(def->type, T_BOOL) || op != false) { defaults_warnx(ctx, file, line, column, quiet, @@ -303,7 +303,7 @@ rc = store_timeout(val, def); break; case T_TUPLE: - rc = store_tuple(val, def); + rc = store_tuple(val, def, op); break; case T_TIMESPEC: rc = store_timespec(val, def); @@ -593,8 +593,8 @@ #endif /* Password flags also have a string and integer component. */ - (void) store_tuple("any", &sudo_defs_table[I_LISTPW]); - (void) store_tuple("all", &sudo_defs_table[I_VERIFYPW]); + (void) store_tuple("any", &sudo_defs_table[I_LISTPW], 0); + (void) store_tuple("all", &sudo_defs_table[I_VERIFYPW], 0); /* Then initialize the int-like things. */ #ifdef SUDO_UMASK @@ -1013,18 +1013,28 @@ } static bool -store_tuple(const char *str, struct sudo_defs_types *def) +store_tuple(const char *str, struct sudo_defs_types *def, int op) { struct def_values *v; debug_decl(store_tuple, SUDOERS_DEBUG_DEFAULTS); /* * Look up tuple value by name to find enum def_tuple value. - * For negation to work the first element of enum def_tuple - * must be equivalent to boolean false. + * A tuple must have at least two possible values. */ if (str == NULL) { - def->sd_un.ival = 0; + /* + * Boolean context: true maps to values[1], false maps to values[0]. + */ + if (op == true) { + v = &def->values[1]; + def->sd_un.ival = v->nval; + } else if (op == false) { + v = &def->values[0]; + def->sd_un.ival = v->nval; + } else { + debug_return_bool(false); + } } else { for (v = def->values; v->sval != NULL; v++) { if (strcmp(v->sval, str) == 0) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/plugins/sudoers/ldap_conf.c new/sudo-1.9.15p5/plugins/sudoers/ldap_conf.c --- old/sudo-1.9.15p4/plugins/sudoers/ldap_conf.c 2023-12-15 20:08:29.000000000 +0100 +++ new/sudo-1.9.15p5/plugins/sudoers/ldap_conf.c 2023-12-29 22:46:18.000000000 +0100 @@ -599,8 +599,10 @@ debug_return_bool(false); } } - if (!STAILQ_EMPTY(&ldap_conf.netgroup_base)) + if (STAILQ_EMPTY(&ldap_conf.netgroup_base)) { + /* netgroup_query is only valid in conjunction with netgroup_base */ ldap_conf.netgroup_query = false; + } DPRINTF1("LDAP Config Summary"); DPRINTF1("==================="); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/plugins/sudoers/pwutil_impl.c new/sudo-1.9.15p5/plugins/sudoers/pwutil_impl.c --- old/sudo-1.9.15p4/plugins/sudoers/pwutil_impl.c 2023-12-15 20:08:29.000000000 +0100 +++ new/sudo-1.9.15p5/plugins/sudoers/pwutil_impl.c 2023-12-29 22:46:18.000000000 +0100 @@ -381,7 +381,7 @@ } #ifdef _SC_LOGIN_NAME_MAX - groupname_len = MAX((size_t)sysconf(_SC_LOGIN_NAME_MAX), 32); + groupname_len = (size_t)MAX(sysconf(_SC_LOGIN_NAME_MAX), 32); #else groupname_len = MAX(LOGIN_NAME_MAX, 32); #endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sudo-1.9.15p4/plugins/sudoers/timestamp.c new/sudo-1.9.15p5/plugins/sudoers/timestamp.c --- old/sudo-1.9.15p4/plugins/sudoers/timestamp.c 2023-12-15 20:08:31.000000000 +0100 +++ new/sudo-1.9.15p5/plugins/sudoers/timestamp.c 2023-12-29 22:46:18.000000000 +0100 @@ -1148,6 +1148,35 @@ goto done; ret = fstatat(dfd, uidstr, &sb, AT_SYMLINK_NOFOLLOW) == 0; + if (!ret && errno == ENOENT && strchr(ctx->user.name, '/') == NULL) { + /* No uid-based lecture path, check for username-based path. */ + ret = fstatat(dfd, ctx->user.name, &sb, AT_SYMLINK_NOFOLLOW) == 0; + if (ret) { + /* Migrate lecture file to uid-based path. */ +#ifdef HAVE_RENAMEAT + if (renameat(dfd, ctx->user.name, dfd, uidstr) == -1) { + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO, + "%s: unable to rename %s/%s to %s/%s", __func__, + def_lecture_status_dir, ctx->user.name, + def_lecture_status_dir, uidstr); + } +#else + char from[PATH_MAX], to[PATH_MAX]; + len = snprintf(from, sizeof(from), "%s/%s", def_lecture_status_dir, + ctx->user.name); + if (len < 0 || len >= ssizeof(from)) + goto done; + len = snprintf(to, sizeof(to), "%s/%s", def_lecture_status_dir, + uidstr); + if (len < 0 || len >= ssizeof(to)) + goto done; + if (rename(from, to) == -1) { + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO, + "%s: unable to rename %s to %s", __func__, from, to); + } +#endif + } + } done: if (dfd != -1)