This patch will upgrade Sudo version 1.7.4 patchlevel 3 to Sudo version 1.7.4 patchlevel 4. To apply: $ cd sudo-1.7.4p3 $ patch -p1 < sudo-1.7.4p4.patch diff -urNa sudo-1.7.4p3/ChangeLog sudo-1.7.4p4/ChangeLog --- sudo-1.7.4p3/ChangeLog Wed Aug 18 15:36:09 2010 +++ sudo-1.7.4p4/ChangeLog Mon Sep 6 08:14:27 2010 @@ -1,3 +1,69 @@ +2010-09-06 Todd C. Miller + + * match.c: + When matching the runas user and runas group (-u and -g command line + options), keep track of runas group and runas user matches + separately. Only return a positive match if we have a match for + both runas user and runas group (if specified). + [68d30216c13a] + +2010-09-04 Todd C. Miller + + * ldap.c, parse.c: + Do not return -1 on error from the display functions; the call + expects a return value >= 0. + [e50e6ae4d06d] + + * ldap.c: + display_bound_defaults now returns a count so make the stub return + 0, not 1. + [97293ced4908] + +2010-09-03 Todd C. Miller + + * get_pty.c: + It looks like AIX doesn't need to push STREAMS modules for ptys. + [62c281fcd4ad] + +2010-08-30 Todd C. Miller + + * Makefile.in: + Install sudoers file from the build dir not hte src dir. + [a26afd8db531] + +2010-08-26 Todd C. Miller + + * set_perms.c: + If runas_pw changes, reset the stashed runas aux group vector. + Otherwise, if runas_default is set in a per-command Defaults + statement, the command runs with root's aux group vector (i.e. the + one that was used when locating the command). + [24a695707b67] + + * Makefile.in: + Add target to generate sudoers file Remove generated sudoers file as + part of distclean + [448627fc35b6] + +2010-08-23 millert + + * exec.c: + When not logging I/O install a handler for SIGCONT and deliver it to + the command upon resume. Fixes bugzilla #431 + [e84690aa67bd] + +2010-08-21 Todd C. Miller + + * sudo.c: + Don't need to fork and wait when compiled with --disable-pam-session + [2ae1bbe4437a] + +2010-08-20 Todd C. Miller + + * lbuf.c: + Convert a remaining puts() and putchar() to use the output function. + [d68c213feb0f] + 2010-08-18 Todd C. Miller * Makefile.in: @@ -54,6 +120,11 @@ [d18ef30f0a72] 2010-08-06 Todd C. Miller + + * auth/sudo_auth.c: + For non-standalone auth methods, stop reading the password if the + user enters ^C at the prompt. + [59d2b1328d1e] * check.c: When removing/resetting the timestamp file ignore the tty ticket diff -urNa sudo-1.7.4p3/Makefile.in sudo-1.7.4p4/Makefile.in --- sudo-1.7.4p3/Makefile.in Wed Aug 18 15:32:57 2010 +++ sudo-1.7.4p4/Makefile.in Fri Sep 3 17:43:57 2010 @@ -465,6 +465,9 @@ @DEV@LICENSE: $(srcdir)/license.pod @DEV@ pod2text -l -i0 $(srcdir)/license.pod | sed '1,2d' > $@ +sudoers: $(srcdir)/sudoers.in + (cd $(top_builddir) && $(SHELL) config.status --file=plugins/sudoers/$@) + # The 1.7 branch started Jan 18, 2010 ChangeLog: if test -d $(srcdir)/.hg; then \ @@ -497,7 +500,7 @@ $(DESTDIR)$(sudoersdir)/sudoers.d test -f $(DESTDIR)$(sudoersdir)/sudoers || \ $(INSTALL) -O $(sudoers_uid) -G $(sudoers_gid) -M $(sudoers_mode) \ - $(srcdir)/sudoers $(DESTDIR)$(sudoersdir)/sudoers + sudoers $(DESTDIR)$(sudoersdir)/sudoers install-doc: install-dirs ChangeLog (cd $(srcdir) && for f in ChangeLog HISTORY LICENSE NEWS README TROUBLESHOOTING UPGRADE sample.*; do $(INSTALL) -O $(install_uid) -G $(install_gid) -M 0444 $$f $(DESTDIR)$(docdir); done) @@ -521,7 +524,7 @@ distclean: clean -rm -rf Makefile pathnames.h config.h config.status config.cache \ - config.log libtool sudo_noexec.lo .libs $(GENERATED) \ + config.log libtool sudoers sudo_noexec.lo .libs $(GENERATED) \ sudo.man sudoers.man sudoers.ldap.man sudoreplay.man \ visudo.man sudo_usage.h Makefile.binary diff -urNa sudo-1.7.4p3/auth/sudo_auth.c sudo-1.7.4p4/auth/sudo_auth.c --- sudo-1.7.4p3/auth/sudo_auth.c Fri Aug 6 09:44:13 2010 +++ sudo-1.7.4p4/auth/sudo_auth.c Mon Sep 6 08:15:32 2010 @@ -185,8 +185,9 @@ goto cleanup; } #ifndef AUTH_STANDALONE - if (p) - zero_bytes(p, strlen(p)); + if (p == NULL) + break; + zero_bytes(p, strlen(p)); #endif if (!ISSET(tgetpass_flags, TGP_ASKPASS)) pass_warn(stderr); diff -urNa sudo-1.7.4p3/configure sudo-1.7.4p4/configure --- sudo-1.7.4p3/configure Wed Aug 18 15:34:11 2010 +++ sudo-1.7.4p4/configure Mon Sep 6 08:03:39 2010 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.65 for sudo 1.7.4p3. +# Generated by GNU Autoconf 2.65 for sudo 1.7.4p4. # # Report bugs to . # @@ -701,8 +701,8 @@ # Identity of this package. PACKAGE_NAME='sudo' PACKAGE_TARNAME='sudo' -PACKAGE_VERSION='1.7.4p3' -PACKAGE_STRING='sudo 1.7.4p3' +PACKAGE_VERSION='1.7.4p4' +PACKAGE_STRING='sudo 1.7.4p4' PACKAGE_BUGREPORT='http://www.sudo.ws/bugs/' PACKAGE_URL='' @@ -1552,7 +1552,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures sudo 1.7.4p3 to adapt to many kinds of systems. +\`configure' configures sudo 1.7.4p4 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1617,7 +1617,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of sudo 1.7.4p3:";; + short | recursive ) echo "Configuration of sudo 1.7.4p4:";; esac cat <<\_ACEOF @@ -1828,7 +1828,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -sudo configure 1.7.4p3 +sudo configure 1.7.4p4 generated by GNU Autoconf 2.65 Copyright (C) 2009 Free Software Foundation, Inc. @@ -2527,7 +2527,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by sudo $as_me 1.7.4p3, which was +It was created by sudo $as_me 1.7.4p4, which was generated by GNU Autoconf 2.65. Invocation command line was $ $0 $@ @@ -18977,7 +18977,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by sudo $as_me 1.7.4p3, which was +This file was extended by sudo $as_me 1.7.4p4, which was generated by GNU Autoconf 2.65. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -19043,7 +19043,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -sudo config.status 1.7.4p3 +sudo config.status 1.7.4p4 configured by $0, generated by GNU Autoconf 2.65, with options \\"\$ac_cs_config\\" diff -urNa sudo-1.7.4p3/configure.in sudo-1.7.4p4/configure.in --- sudo-1.7.4p3/configure.in Wed Aug 18 15:33:56 2010 +++ sudo-1.7.4p4/configure.in Mon Sep 6 08:03:33 2010 @@ -3,7 +3,7 @@ dnl dnl Copyright (c) 1994-1996,1998-2010 Todd C. Miller dnl -AC_INIT([sudo], [1.7.4p3], [http://www.sudo.ws/bugs/], [sudo]) +AC_INIT([sudo], [1.7.4p4], [http://www.sudo.ws/bugs/], [sudo]) AC_CONFIG_HEADER(config.h pathnames.h) dnl dnl This won't work before AC_INIT diff -urNa sudo-1.7.4p3/exec.c sudo-1.7.4p4/exec.c --- sudo-1.7.4p3/exec.c Mon Aug 9 06:37:11 2010 +++ sudo-1.7.4p4/exec.c Fri Sep 3 17:40:19 2010 @@ -101,7 +101,14 @@ int rbac_enabled; { struct command_status cstat; + sigaction_t sa; int pid; + + zero_bytes(&sa, sizeof(sa)); + sigemptyset(&sa.sa_mask); + sa.sa_flags = SA_INTERRUPT; /* do not restart syscalls */ + sa.sa_handler = handler; + sigaction(SIGCONT, &sa, NULL); pid = fork(); switch (pid) { diff -urNa sudo-1.7.4p3/get_pty.c sudo-1.7.4p4/get_pty.c --- sudo-1.7.4p3/get_pty.c Wed Aug 18 15:29:42 2010 +++ sudo-1.7.4p4/get_pty.c Fri Sep 3 17:40:19 2010 @@ -146,7 +146,7 @@ close(*master); return(0); } -# ifdef I_PUSH +# if defined(I_PUSH) && !defined(_AIX) ioctl(*slave, I_PUSH, "ptem"); /* pseudo tty emulation module */ ioctl(*slave, I_PUSH, "ldterm"); /* line discipline module */ # endif diff -urNa sudo-1.7.4p3/lbuf.c sudo-1.7.4p4/lbuf.c --- sudo-1.7.4p3/lbuf.c Fri Jul 30 11:58:54 2010 +++ sudo-1.7.4p4/lbuf.c Fri Sep 3 17:40:19 2010 @@ -282,14 +282,15 @@ /* For very small widths just give up... */ if (lbuf->cols <= lbuf->indent + contlen + 20) { - puts(lbuf->buf); + lbuf->output(lbuf->buf); + lbuf->output("\n"); goto done; } /* Print each line in the buffer */ for (cp = lbuf->buf; cp != NULL && *cp != '\0'; ) { if (*cp == '\n') { - putchar('\n'); + lbuf->output("\n"); cp++; } else { ep = memchr(cp, '\n', lbuf->len - (cp - lbuf->buf)); diff -urNa sudo-1.7.4p3/ldap.c sudo-1.7.4p4/ldap.c --- sudo-1.7.4p3/ldap.c Fri Aug 6 09:44:30 2010 +++ sudo-1.7.4p4/ldap.c Sat Sep 4 08:50:47 2010 @@ -1227,7 +1227,7 @@ int rc, count = 0; if (ld == NULL) - return(-1); + goto done; for (base = ldap_conf.base; base != NULL; base = base->next) { result = NULL; @@ -1251,6 +1251,7 @@ if (result) ldap_msgfree(result); } +done: return(count); } @@ -1263,7 +1264,7 @@ struct passwd *pw; struct lbuf *lbuf; { - return(1); + return(0); } /* @@ -1440,7 +1441,7 @@ int rc, do_netgr, count = 0; if (ld == NULL) - return(-1); + goto done; /* * Okay - time to search for anything that matches this user @@ -1482,6 +1483,7 @@ } efree(filt); } +done: return(count); } diff -urNa sudo-1.7.4p3/match.c sudo-1.7.4p4/match.c --- sudo-1.7.4p3/match.c Fri Aug 6 09:44:30 2010 +++ sudo-1.7.4p4/match.c Fri Sep 3 17:40:19 2010 @@ -170,16 +170,10 @@ { struct member *m; struct alias *a; - int rval, matched = UNSPEC; + int rval; + int user_matched = UNSPEC; + int group_matched = UNSPEC; - if (runas_gr != NULL) { - if (tq_empty(group_list)) - return(DENY); /* group was specified but none in sudoers */ - if (runas_pw != NULL && strcmp(runas_pw->pw_name, user_name) && - tq_empty(user_list)) - return(DENY); /* user was specified but none in sudoers */ - } - if (tq_empty(user_list) && tq_empty(group_list)) return(userpw_matches(def_runas_default, runas_pw->pw_name, runas_pw)); @@ -187,59 +181,67 @@ tq_foreach_rev(user_list, m) { switch (m->type) { case ALL: - matched = !m->negated; + user_matched = !m->negated; break; case NETGROUP: if (netgr_matches(m->name, NULL, NULL, runas_pw->pw_name)) - matched = !m->negated; + user_matched = !m->negated; break; case USERGROUP: if (usergr_matches(m->name, runas_pw->pw_name, runas_pw)) - matched = !m->negated; + user_matched = !m->negated; break; case ALIAS: if ((a = alias_find(m->name, RUNASALIAS)) != NULL) { rval = _runaslist_matches(&a->members, &empty); if (rval != UNSPEC) - matched = m->negated ? !rval : rval; + user_matched = m->negated ? !rval : rval; break; } /* FALLTHROUGH */ case WORD: if (userpw_matches(m->name, runas_pw->pw_name, runas_pw)) - matched = !m->negated; + user_matched = !m->negated; break; } - if (matched != UNSPEC) + if (user_matched != UNSPEC) break; } } if (runas_gr != NULL) { + if (user_matched == UNSPEC) { + if (runas_pw == NULL || strcmp(runas_pw->pw_name, user_name) == 0) + user_matched = ALLOW; /* only changing group */ + } tq_foreach_rev(group_list, m) { switch (m->type) { case ALL: - matched = !m->negated; + group_matched = !m->negated; break; case ALIAS: if ((a = alias_find(m->name, RUNASALIAS)) != NULL) { rval = _runaslist_matches(&a->members, &empty); if (rval != UNSPEC) - matched = m->negated ? !rval : rval; + group_matched = m->negated ? !rval : rval; break; } /* FALLTHROUGH */ case WORD: if (group_matches(m->name, runas_gr)) - matched = !m->negated; + group_matched = !m->negated; break; } - if (matched != UNSPEC) + if (group_matched != UNSPEC) break; } } - return(matched); + if (user_matched == DENY || group_matched == DENY) + return(DENY); + if (user_matched == group_matched || runas_gr == NULL) + return(user_matched); + return(UNSPEC); } int diff -urNa sudo-1.7.4p3/parse.c sudo-1.7.4p4/parse.c --- sudo-1.7.4p3/parse.c Fri Jul 30 11:58:54 2010 +++ sudo-1.7.4p4/parse.c Sat Sep 4 08:50:47 2010 @@ -429,7 +429,7 @@ int nfound = 0; if (nss->handle == NULL) - return(-1); + goto done; tq_foreach_fwd(&userspecs, us) { if (userlist_matches(pw, &us->users) != ALLOW) @@ -440,6 +440,7 @@ else nfound += sudo_file_display_priv_short(pw, us, lbuf); } +done: return(nfound); } @@ -457,7 +458,7 @@ int nfound = 0; if (nss->handle == NULL) - return(-1); + goto done; if (lbuf->len == 0 || isspace((unsigned char)lbuf->buf[lbuf->len - 1])) prefix = " "; @@ -493,7 +494,7 @@ prefix = ", "; nfound++; } - +done: return(nfound); } @@ -594,7 +595,7 @@ int host_match, runas_match, cmnd_match; if (nss->handle == NULL) - return(rval); + goto done; match = NULL; tq_foreach_rev(&userspecs, us) { @@ -625,6 +626,7 @@ user_args ? user_args : ""); rval = 0; } +done: return(rval); } diff -urNa sudo-1.7.4p3/set_perms.c sudo-1.7.4p4/set_perms.c --- sudo-1.7.4p3/set_perms.c Fri Jul 30 11:58:54 2010 +++ sudo-1.7.4p4/set_perms.c Fri Sep 3 17:40:19 2010 @@ -488,7 +488,8 @@ # ifdef HAVE_GETGROUPS static GETGROUPS_T *groups; # endif - struct passwd *pw; + static struct passwd *pw; + struct passwd *opw = pw; if (def_preserve_groups) return; @@ -496,14 +497,18 @@ /* * Use stashed copy of runas groups if available, else initgroups and stash. */ - if (ngroups == -1) { - pw = runas_pw ? runas_pw : sudo_user.pw; + pw = runas_pw ? runas_pw : sudo_user.pw; + if (pw != opw) { # ifdef HAVE_SETAUTHDB aix_setauthdb(pw->pw_name); # endif if (initgroups(pw->pw_name, pw->pw_gid) < 0) log_error(USE_ERRNO|MSG_ONLY, "can't set runas group vector"); # ifdef HAVE_GETGROUPS + if (groups) { + efree(groups); + groups = NULL; + } if ((ngroups = getgroups(0, NULL)) > 0) { groups = emalloc2(ngroups, sizeof(GETGROUPS_T)); if (getgroups(ngroups, groups) < 0) diff -urNa sudo-1.7.4p3/sudo.c sudo-1.7.4p4/sudo.c --- sudo-1.7.4p3/sudo.c Fri Aug 6 09:44:30 2010 +++ sudo-1.7.4p4/sudo.c Mon Sep 6 08:16:09 2010 @@ -105,7 +105,7 @@ # include "nonunix.h" #endif -#ifdef HAVE_PAM +#if defined(HAVE_PAM) && !defined(NO_PAM_SESSION) # define CMND_WAIT TRUE #else # define CMND_WAIT FALSE