Otherwise, sudo_ldap_role_to_priv() will treat a NULL host list as
as the "ALL" wildcard. This r...

Now that logging of successful commands is performed by sudoers as an
audit plugin we need to loa...

This adds audit plugin support to the sudoers module, currently
only used for accept events. As ...

With this change, the sudo front-end will send an "accept" audit
event to the audit plugins after...

This fixes an issue on Solaris 11.4 (and probably others) with "sudo
reboot" when I/O logging is ...

Fixes a problem on Solaris 11.4 (and possibly others) where sudo
continually tries to put itself ...

BSM audit is no longer supported in Solaris 11.4.

We cannot exec the command directly if any of the policy or audit
plugins use a close function.

If the user specifies --runstatedir but not --with-rundir, use
runstatdir as the parent directory...

These are less confusing than #include and #includedir when the
hash character is also the commen...

This prevents problems caused by the change to strip the write bit
from the timing file when it i...

Avoids a generic "input in flex scanner failed" error message.

By default, sudoreplay will exit when it reaches the end of the
timing file. With the -F option,...

Works for both compressed and uncompressed I/O logs.

This matches the behavior of sudo_logsrvd.

We no longer need to include sudo_gettext.h before sudo_compat.h

In the pre-POSIX days BSD had strings.h, not string.h.
Now strings.h is only used for non-ANSI st...

Previously we needed to include headers required by the various
sudo*h files. Now those files ar...

In the past we've relied on the various .c files to include the
system headers that define types ...

This has no effect unless env_reset is disabled.
From Allan Wirth

Include sys/types.h for mode_t and id_t in sudo_debug.h

Fixes a regress failure on musl libc where SIGSYS and SIGUNUSED
share the same value.

Fixes a warning on musl libc where WIFCONTINUED is defined in
stdlib.h for some reason.

The version of OpenSSL in RHEL 6 is new enough for the log server to use.

This makes more sense when receiving event-only logs.

This fixes reject events as well as accept events without the
expect_iobufs flag set.

Only set expect_iobufs in AcceptMessage if sending I/O logs.
Set state to FINISHED immediately af...

If -A is specified, no I/O will be sent, only the accept event.
For -R, a reject event with the s...

The cfmakeraw(3) function exists but does not set VMIN to 1 or VTIME
to 0 in c_cc[] in struct ter...

It is not used outside of the I/O log client and server and the
host:port syntax may change in th...

We want the log server to work with the default configuration. If
the default certificate path e...

Previously, if multiple instances of the same command line option were
specified, the last one wo...

Fixes a problem when there are multiple users with the same user-ID
where the PAM session modules...

Fixes from PR #30 (ka7) and Bug #925 (fossies.org codespell)

The configure script already detects the python version, we just need
to use it.

If SSL_read, SSL_write or SSL_connect fails we can use the reason
string to let the user know wha...

The TLS connection is now initiated before ServerHello is received.

We write messages to stderr until we become a daemon.

If the string "(tls)" appears at the end, the tls flag is set to true
and the default tls port is...

For TLS connections we now do the TLS handshake immediately before
the ServerHello message. This...

The TLS handshake now occurs before the ServerHello message is read.
This fixes potential man-in-...

This makes it easier to detect a plaintext client sending to a
TLS port. Without this, the TLS s...

On some systems, poll() and select() can return EAGAIN instead
of ENOMEM if there is a kernel res...

Newer versions of python3-config only include libpython in the
output when the --embed is used. ...

Fixes the final message at the end when there is a network error.

Both poll(2) and ppoll(2) will return EINVAL if the nfds function
argument is larger than the max...

Fixes a double free on error introduced with the TLS state cleanup in
client_closure_free().

Also add -t to the usage message

Older, pre-C99, systems may not include strtoll() in their C library.

Old, pre-C99, systems may have inttypes.h but not stdint.h.

On our build schroots we don't have systemctl installed but do have
the /etc/systemd and /lib/sys...

It is only effective to set pp_macos_default_service_id_prefix in
the indivisual %service section...

The default value in PolyPkg is "com.quest.rc."

Also free the SSL data which is part of the client closure.

We can't use run_command() to run sesh, that will use the sudo event
loop (and might run it in a ...

The SELinux sudoedit code now extends the destination file the
same way the non-SELinux version d...

The warning message says the files were preserved but they actually
got removed.

If the service file was installed as part of the package it will
be removed automatically when th...

Instead of opening the original file for writing w/ tuncation, we
first extend the file with zero...

We already include the error string in the format so no need to use
errno too.

The logging functions may try to use the cache via set_perms(PERM_ROOT).