This patch will upgrade Sudo version 1.7.10 patchlevel 6 to Sudo version 1.7.10 patchlevel 7. To apply: $ cd sudo-1.7.10p6 $ patch -p1 < sudo-1.7.10p7.patch diff -urNa sudo-1.7.10p6/ChangeLog sudo-1.7.10p7/ChangeLog --- sudo-1.7.10p6/ChangeLog Sun Feb 10 18:44:50 2013 +++ sudo-1.7.10p7/ChangeLog Mon Feb 25 15:08:09 2013 @@ -1,8 +1,36 @@ +2013-02-25 Todd C. Miller + + * .hgtags: + Added tag SUDO_1_7_10p7 for changeset ddf399e3e306 + [23db6a503c5c] [tip] <1.7> + +2013-02-21 Todd C. Miller + + * check.c: + Completely ignore time stamp file if it is set to the epoch, + regardless of what gettimeofday() returns. + [ddf399e3e306] [SUDO_1_7_10p7] <1.7> + +2013-02-19 Todd C. Miller + + * sudo_nss.c: + Make display_cmnd() return value match trunk version. Fixes exit + status of "sudo -l command". + [ac2bf49a24b8] <1.7> + +2013-02-15 Todd C. Miller + + * sudo.c: + #include "sudo_usage.h" not so we get the one in the + build directory and not the src dir when using a separate build + directory. + [5ae0986ff454] <1.7> + 2013-02-10 Todd C. Miller * .hgtags: Added tag SUDO_1_7_10p6 for changeset 882475dfa47c - [5317840e3275] [tip] <1.7> + [5317840e3275] <1.7> * NEWS, configure, configure.in: Sudo 1.7.10p6 diff -urNa sudo-1.7.10p6/NEWS sudo-1.7.10p7/NEWS --- sudo-1.7.10p6/NEWS Sun Feb 10 18:42:26 2013 +++ sudo-1.7.10p7/NEWS Thu Feb 21 10:42:30 2013 @@ -1,3 +1,14 @@ +What's new in Sudo 1.7.10p7? + + * A time stamp file with the date set to the epoch by "sudo -k" + is now completely ignored regardless of what the local clock is + set to. Previously, if the local clock was set to a value between + the epoch and the time stamp timeout value, a time stamp reset + by "sudo -k" would be considered current. + + * Fixed the sudo exit status when "sudo -l command" is run. + This is a regression introduced in version 1.7.10. + What's new in Sudo 1.7.10p6? * Fixed the restoration of SIGINT, SIGQUIT and SIGTSTP. This diff -urNa sudo-1.7.10p6/check.c sudo-1.7.10p7/check.c --- sudo-1.7.10p6/check.c Fri Feb 8 10:35:46 2013 +++ sudo-1.7.10p7/check.c Thu Feb 21 10:04:28 2013 @@ -628,31 +628,34 @@ */ if (status == TS_OLD && !ISSET(flags, TS_REMOVE)) { mtim_get(&sb, &mtime); - /* Negative timeouts only expire manually (sudo -k). */ - if (def_timestamp_timeout < 0 && mtime.tv_sec != 0) - status = TS_CURRENT; - else { - now = time(NULL); - if (def_timestamp_timeout && - now - mtime.tv_sec < 60 * def_timestamp_timeout) { - /* - * Check for bogus time on the stampfile. The clock may - * have been set back or someone could be trying to spoof us. - */ - if (mtime.tv_sec > now + 60 * def_timestamp_timeout * 2) { - time_t tv_sec = (time_t)mtime.tv_sec; - log_error(0, - "timestamp too far in the future: %20.20s", - 4 + ctime(&tv_sec)); - if (timestampfile) - (void) unlink(timestampfile); - else - (void) rmdir(timestampdir); - status = TS_MISSING; - } else if (get_boottime(&boottime) && timevalcmp(&mtime, &boottime, <)) { - status = TS_OLD; - } else { - status = TS_CURRENT; + if (timevalisset(&mtime)) { + /* Negative timeouts only expire manually (sudo -k). */ + if (def_timestamp_timeout < 0) { + status = TS_CURRENT; + } else { + now = time(NULL); + if (def_timestamp_timeout && + now - mtime.tv_sec < 60 * def_timestamp_timeout) { + /* + * Check for bogus time on the stampfile. The clock may + * have been set back or user could be trying to spoof us. + */ + if (mtime.tv_sec > now + 60 * def_timestamp_timeout * 2) { + time_t tv_sec = (time_t)mtime.tv_sec; + log_error(0, + "timestamp too far in the future: %20.20s", + 4 + ctime(&tv_sec)); + if (timestampfile) + (void) unlink(timestampfile); + else + (void) rmdir(timestampdir); + status = TS_MISSING; + } else if (get_boottime(&boottime) && + timevalcmp(&mtime, &boottime, <)) { + status = TS_OLD; + } else { + status = TS_CURRENT; + } } } } diff -urNa sudo-1.7.10p6/configure sudo-1.7.10p7/configure --- sudo-1.7.10p6/configure Sun Feb 10 18:35:47 2013 +++ sudo-1.7.10p7/configure Thu Feb 21 10:43:29 2013 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.68 for sudo 1.7.10p6. +# Generated by GNU Autoconf 2.68 for sudo 1.7.10p7. # # Report bugs to . # @@ -570,8 +570,8 @@ # Identity of this package. PACKAGE_NAME='sudo' PACKAGE_TARNAME='sudo' -PACKAGE_VERSION='1.7.10p6' -PACKAGE_STRING='sudo 1.7.10p6' +PACKAGE_VERSION='1.7.10p7' +PACKAGE_STRING='sudo 1.7.10p7' PACKAGE_BUGREPORT='http://www.sudo.ws/bugs/' PACKAGE_URL='' @@ -1447,7 +1447,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures sudo 1.7.10p6 to adapt to many kinds of systems. +\`configure' configures sudo 1.7.10p7 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1512,7 +1512,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of sudo 1.7.10p6:";; + short | recursive ) echo "Configuration of sudo 1.7.10p7:";; esac cat <<\_ACEOF @@ -1737,7 +1737,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -sudo configure 1.7.10p6 +sudo configure 1.7.10p7 generated by GNU Autoconf 2.68 Copyright (C) 2010 Free Software Foundation, Inc. @@ -2441,7 +2441,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by sudo $as_me 1.7.10p6, which was +It was created by sudo $as_me 1.7.10p7, which was generated by GNU Autoconf 2.68. Invocation command line was $ $0 $@ @@ -20835,7 +20835,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by sudo $as_me 1.7.10p6, which was +This file was extended by sudo $as_me 1.7.10p7, which was generated by GNU Autoconf 2.68. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -20901,7 +20901,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -sudo config.status 1.7.10p6 +sudo config.status 1.7.10p7 configured by $0, generated by GNU Autoconf 2.68, with options \\"\$ac_cs_config\\" diff -urNa sudo-1.7.10p6/configure.in sudo-1.7.10p7/configure.in --- sudo-1.7.10p6/configure.in Sun Feb 10 18:35:37 2013 +++ sudo-1.7.10p7/configure.in Thu Feb 21 10:43:17 2013 @@ -3,7 +3,7 @@ dnl dnl Copyright (c) 1994-1996,1998-2012 Todd C. Miller dnl -AC_INIT([sudo], [1.7.10p6], [http://www.sudo.ws/bugs/], [sudo]) +AC_INIT([sudo], [1.7.10p7], [http://www.sudo.ws/bugs/], [sudo]) AC_CONFIG_HEADER(config.h pathnames.h zlib/zconf.h) dnl dnl Note: this must come after AC_INIT diff -urNa sudo-1.7.10p6/sudo.c sudo-1.7.10p7/sudo.c --- sudo-1.7.10p6/sudo.c Sun Feb 10 18:23:20 2013 +++ sudo-1.7.10p7/sudo.c Fri Feb 15 10:27:08 2013 @@ -107,7 +107,7 @@ #include "lbuf.h" #include "interfaces.h" #include "secure_path.h" -#include +#include "sudo_usage.h" #ifdef USING_NONUNIX_GROUPS # include "nonunix.h" diff -urNa sudo-1.7.10p6/sudo_nss.c sudo-1.7.10p7/sudo_nss.c --- sudo-1.7.10p6/sudo_nss.c Tue Sep 18 10:00:11 2012 +++ sudo-1.7.10p7/sudo_nss.c Tue Feb 19 14:35:31 2013 @@ -321,7 +321,7 @@ tq_foreach_fwd(snl, nss) { if (nss->display_cmnd(nss, pw) == 0) - return 0; + return TRUE; } - return 1; + return FALSE; }