version bump, fixes security issue.

Package-Manager: portage-2.0.51.19

4 files changed, 193 insertions, 23 deletions

diff --git a/app-admin/sudo/ChangeLog b/app-admin/sudo/ChangeLog
index f7e281a95117..a7bca19909cf 100644
--- a/app-admin/sudo/ChangeLog
+++ b/app-admin/sudo/ChangeLog
@@ -1,6 +1,11 @@
 # ChangeLog for app-admin/sudo
 # Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.61 2005/06/19 00:05:56 kloeri Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/ChangeLog,v 1.62 2005/06/20 15:55:53 taviso Exp $
+
+*sudo-1.6.8_p9 (20 Jun 2005)
+
+  20 Jun 2005; Tavis Ormandy <taviso@gentoo.org> +sudo-1.6.8_p9.ebuild:
+  new version fixes security issue.
 
   19 Jun 2005; Bryan Østergaard <kloeri@gentoo.org>
   sudo-1.6.8_p8-r3.ebuild:
diff --git a/app-admin/sudo/Manifest b/app-admin/sudo/Manifest
index 3780adf0e760..696f8d625aa4 100644
--- a/app-admin/sudo/Manifest
+++ b/app-admin/sudo/Manifest
@@ -1,31 +1,23 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
-
-MD5 2516abdfae0af5ad44c670fac08d912f ChangeLog 8277
-MD5 682dc1426cfd3869d86ba74169674ff0 sudo-1.6.8_p8-r3.ebuild 5760
+MD5 66c7da2895b3dd196e6c1ff35ee25e79 sudo-1.6.8_p9.ebuild 5878
 MD5 eec74c7e7844116754be94ca7ed74d49 sudo-1.6.8_p8-r2.ebuild 4708
-MD5 8fc22f08ecb2e292e60ce7553c58d0c2 metadata.xml 222
-MD5 02caf6e86d5e08fd89baccd299a0ee3c sudo-1.6.7_p5-r5.ebuild 1508
-MD5 994fa3d27c4fddfd287e805b67f5434c sudo-1.6.7_p5-r4.ebuild 1497
 MD5 1830dd653b9b5b92fa5cc86823e06d65 sudo-1.6.7_p5-r2.ebuild 1438
-MD5 0c8a06b3d3d86e988a826c8d9e86dbbf files/digest-sudo-1.6.8_p8-r2 64
+MD5 994fa3d27c4fddfd287e805b67f5434c sudo-1.6.7_p5-r4.ebuild 1497
+MD5 682dc1426cfd3869d86ba74169674ff0 sudo-1.6.8_p8-r3.ebuild 5760
+MD5 84475bb10b6cfdb760ccc8cf34d1b7d8 ChangeLog 8416
+MD5 02caf6e86d5e08fd89baccd299a0ee3c sudo-1.6.7_p5-r5.ebuild 1508
+MD5 8fc22f08ecb2e292e60ce7553c58d0c2 metadata.xml 222
+MD5 a5463236fbb98e4ee6b1a0faba8c9c52 files/sudo 135
+MD5 ea5d9d51e647a2dbd410d952019ff19b files/digest-sudo-1.6.7_p5-r2 64
 MD5 ea5d9d51e647a2dbd410d952019ff19b files/digest-sudo-1.6.7_p5-r4 64
 MD5 ea5d9d51e647a2dbd410d952019ff19b files/digest-sudo-1.6.7_p5-r5 64
-MD5 ea5d9d51e647a2dbd410d952019ff19b files/digest-sudo-1.6.7_p5-r2 64
 MD5 6c08a6d5527a45278ebc165df7f0031d files/sudo-1.6.8_p8 223
-MD5 4362800877ccb8e27de5437707d8a954 files/sudo-strip-bash-functions.diff 1335
+MD5 0c8a06b3d3d86e988a826c8d9e86dbbf files/digest-sudo-1.6.8_p8-r2 64
+MD5 0c8a06b3d3d86e988a826c8d9e86dbbf files/digest-sudo-1.6.8_p8-r3 64
+MD5 0b50aabedf9bb326893b5f1c333e46b2 files/sudo-skeychallengeargs.diff 567
 MD5 59acf8b0292a8e60b5277b5dc952cfc4 files/sudoers 1645
 MD5 b906eb71f7564707384cfa9fc80c1b5f files/sudo-1.6.7_p5-strip-bash-functions.diff 1101
-MD5 a5463236fbb98e4ee6b1a0faba8c9c52 files/sudo 135
-MD5 4a46750ff53c19dbfed39d894dd6ff4d files/sudo-1.6.8_p8-ldap-tls_cacert.diff 542
 MD5 b1fc3dd8440dc02690820c01190106a3 files/sudo-strip-shellopts.diff 316
-MD5 0c8a06b3d3d86e988a826c8d9e86dbbf files/digest-sudo-1.6.8_p8-r3 64
-MD5 0b50aabedf9bb326893b5f1c333e46b2 files/sudo-skeychallengeargs.diff 567
 MD5 774b75e759fe13c7334c523b1db8ab2e files/sudo_include 67
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.4.1 (GNU/Linux)
-
-iD8DBQFCtLdmKf2g/qXtneoRApOwAJ9TS+m2TYYYZxzigOn7BHPOacA4hQCfat0P
-23m5PTIFgblhRUQnB/YSNGI=
-=ZgNk
------END PGP SIGNATURE-----
+MD5 4a46750ff53c19dbfed39d894dd6ff4d files/sudo-1.6.8_p8-ldap-tls_cacert.diff 542
+MD5 4362800877ccb8e27de5437707d8a954 files/sudo-strip-bash-functions.diff 1335
+MD5 375b1725c7c89570ce74eba2a96b767d files/digest-sudo-1.6.8_p9 64
diff --git a/app-admin/sudo/files/digest-sudo-1.6.8_p9 b/app-admin/sudo/files/digest-sudo-1.6.8_p9
new file mode 100644
index 000000000000..0629e17e9dd7
--- /dev/null
+++ b/app-admin/sudo/files/digest-sudo-1.6.8_p9
@@ -0,0 +1 @@
+MD5 6d0346abd16914956bc7ea4f17fc85fb sudo-1.6.8p9.tar.gz 585509
diff --git a/app-admin/sudo/sudo-1.6.8_p9.ebuild b/app-admin/sudo/sudo-1.6.8_p9.ebuild
new file mode 100644
index 000000000000..e30ee316ee21
--- /dev/null
+++ b/app-admin/sudo/sudo-1.6.8_p9.ebuild
@@ -0,0 +1,172 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-admin/sudo/sudo-1.6.8_p9.ebuild,v 1.1 2005/06/20 15:55:53 taviso Exp $
+
+inherit eutils pam
+
+# TODO: Fix support for krb4 and krb5
+
+DESCRIPTION="Allows certain users/groups to run commands as root"
+HOMEPAGE="http://www.sudo.ws/"
+SRC_URI="ftp://ftp.sudo.ws/pub/sudo/${P/_/}.tar.gz"
+LICENSE="Sudo"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~ppc64 ~sparc ~x86"
+IUSE="pam skey offensive ldap"
+
+DEPEND="pam? ( || ( virtual/pam sys-libs/pam ) )
+	ldap? ( >=net-nds/openldap-2.1.30-r1 )
+	skey? ( >=app-admin/skey-1.1.5-r1 )"
+RDEPEND="${DEPEND} ldap? ( dev-lang/perl )"
+
+S=${WORKDIR}/${P/_/}
+
+src_unpack() {
+	unpack ${A}; cd ${S}
+
+	# compatability fix.
+	epatch ${FILESDIR}/${PN}-skeychallengeargs.diff
+
+	# make tls_cacert synonymous with tls_cacertfile.
+	epatch ${FILESDIR}/${PN}-1.6.8_p8-ldap-tls_cacert.diff
+
+	# additional variables to disallow, should user disable env_reset.
+
+	# NOTE: this is not a supported mode of operation, these variables
+	#       are added to the blacklist as a convenience to administrators
+	#       who fail to heed the warnings of allowing untrusted users
+	#       to access sudo.
+	#
+	#       there is *no possible way* to foresee all attack vectors in
+	#       all possible applications that could potentially be used via
+	#       sudo, these settings will just delay the inevitable.
+	#
+	#       that said, I will accept suggestions for variables that can
+	#       be misused in _common_ interpreters or libraries, such as
+	#       perl, bash, python, ruby, etc., in the hope of dissuading
+	#       a casual attacker.
+
+	# XXX: perl should be using suid_perl.
+	# XXX: users can remove/add more via env_delete and env_check.
+	# XXX: <?> = probably safe enough for most circumstances.
+
+	einfo "Blacklisting common variables (env_delete)..."
+		sudo_bad_var 'SHELLOPTS'      # bash, change shoptions.
+		sudo_bad_var 'PERLIO_DEBUG'   # perl, write debug to file.
+		sudo_bad_var 'PERL5LIB'       # perl, change search path.
+		sudo_bad_var 'PERLLIB'        # perl, change search path.
+#		sudo_bad_var 'PERL_HASH_SEED' # perl, change seed. <?>
+#		sudo_bad_var 'PERL_HASH_SEED_DEBUG' # perl, disclose seed. <?>
+#		sudo_bad_var 'PERL_SIGNALS'   # perl, use deferred signals. <?>
+		sudo_bad_var 'FPATH'          # ksh, search path for functions.
+		sudo_bad_var 'PS4'            # sh, in case set -x is used. <?>
+		sudo_bad_var 'NULLCMD'        # zsh, command on null-redir. <?>
+		sudo_bad_var 'READNULLCMD'    # zsh, command on null-redir. <?>
+#		sudo_bad_var 'TMPPREFIX'      # zsh, prefix for tmp files. <?>
+		sudo_bad_var 'GLOBIGNORE'     # bash, glob paterns to ignore. <?>
+		sudo_bad_var 'PERL5OPT'       # perl, set options.
+		sudo_bad_var 'PYTHONHOME'     # python, module search path.
+		sudo_bad_var 'PYTHONPATH'     # python, search path.
+		sudo_bad_var 'PYTHONINSPECT'  # python, allow inspection.
+		sudo_bad_var 'RUBYLIB'        # ruby, lib load path.
+		sudo_bad_var 'RUBYOPT'        # ruby, cl options.
+#		sudo_bad_var 'RUBYPATH'       # ruby, script search path. <?>
+		sudo_bad_var 'ZDOTDIR'        # zsh, path to search for dotfiles.
+	einfo "...done."
+
+	# prevent binaries from being stripped.
+	sed -i 's/\($(INSTALL).*\) -s \(.*[(sudo|visudo)]\)/\1 \2/g' Makefile.in
+}
+
+src_compile() {
+	local line ROOTPATH
+
+	# FIXME: secure_path is a compile time setting. using ROOTPATH
+	# is not perfect, env-update may invalidate this, but until it
+	# is available as a sudoers setting this will have to do.
+	einfo "Setting secure_path..."
+
+		# why not use grep? variable might be expanded from other variables
+		# declared in that file. cannot just source the file, would override
+		# any variables already set.
+		eval `PS4= bash -x /etc/profile.env 2>&1 | \
+			while read line; do
+				case $line in
+					ROOTPATH=*) echo $line; break;;
+					*) continue;;
+				esac
+			done`  && einfo "	Found ROOTPATH..." || \
+				ewarn "	Failed to find ROOTPATH, please report this."
+
+		# remove any duplicate entries
+		ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}})
+
+	einfo "...done."
+
+	# XXX: --disable-path-info closes an info leak, but may be confusing.
+	# XXX: /bin/vi may not be available, make nano visudo's default.
+	econf --with-secure-path="${ROOTPATH}" \
+		--with-editor=/bin/nano \
+		--with-env-editor \
+		$(use_with offensive insults) \
+		$(use_with offensive all-insults) \
+		$(use_with pam) \
+		$(use_with skey) \
+		$(use_with ldap) || die
+
+	# disallow lazy bindings
+	emake SUDO_LDFLAGS="-Wl,-z,now" || die
+}
+
+src_install() {
+	einstall || die
+	dodoc BUGS CHANGES HISTORY PORTING README RUNSON TODO \
+		TROUBLESHOOTING UPGRADE sample.*
+
+	use ldap && {
+		dodoc README.LDAP
+		dosbin sudoers2ldif
+	}
+
+	if has_version virtual/pam; then
+		pamd_mimic_system sudo auth account password session
+	else
+		newpamd ${FILESDIR}/sudo-sudo-1.6.8_p8 sudo
+	fi
+
+	insinto /etc
+	doins ${FILESDIR}/sudoers
+	fperms 0440 /etc/sudoers
+}
+
+# remove duplicate path entries from $1
+cleanpath() {
+	local i=1 x n IFS=:
+	local -a paths;	paths=($1)
+
+	for ((n=${#paths[*]}-1;i<=n;i++)); do
+		for ((x=0;x<i;x++)); do
+			test "${paths[i]}" == "${paths[x]}" && {
+				einfo "	Duplicate entry ${paths[i]} removed..." 1>&2
+				unset paths[i]; continue 2; }
+		done; # einfo "	Adding ${paths[i]}..." 1>&2
+	done; echo "${paths[*]}"
+}
+
+# add $1 to default env_delete list.
+sudo_bad_var() {
+	local target='env.c' marker='\*initial_badenv_table\[\]'
+
+	ebegin "	$1"
+		sed -i 's#\(^.*'${marker}'.*$\)#\1\n\t"'${1}'",#' ${S}/${target}
+	eend $?
+}
+
+pkg_postinst() {
+	use skey && use pam && {
+		 ewarn "sudo will not use skey authentication when compiled with"
+		 ewarn "pam support."
+		 ewarn "To allow users to authenticate with one time passwords,"
+		 ewarn "you should unset the pam USE flag for sudo."
+	}
+}