Sudo Project commits | Ecosyste.ms: OpenCollective

Add a note that --with-solaris-audit is only for Solaris 11 and

above. Bug #737

github.com/sudo-project/sudo - 8509229eb160c63da1b263108f74e3fc1b81ae6d authored over 8 years ago by Todd C. Miller <[email protected]>

Remove last remnants of the deprecated --with-stow option.

github.com/sudo-project/sudo - 4f7b0b11590c03245b1cf314274a030e64c2eb65 authored over 8 years ago by Todd C. Miller <[email protected]>

src/load_plugins.c needs _PATH_SUDO_CONF so allow it to be overridden

via the Makefile like other consumers of _PATH_SUDO_CONF. Bug #735

github.com/sudo-project/sudo - 42548a1b01ed57bf633dee03c796bdc1f6718be7 authored over 8 years ago by Todd C. Miller <[email protected]>

Add an administrative domain to the passwd/group cache key for

AIX which can have different name <-> ID mappings depending
on whether the database is local, LDA...

github.com/sudo-project/sudo - 6cbba7d66556dc67d71c6dfae91bcf35ff9bef8c authored over 8 years ago by Todd C. Miller <[email protected]>

Fedora dropped "core" from the name some time ago so just match on

f[0-9] for the rpm distro name provided by pp. Since the version
numbers of Fedora and RHEL are ...

github.com/sudo-project/sudo - 9b19ea440cd58b8971b159f8a31942c945f4e186 authored over 8 years ago by Todd C. Miller <[email protected]>

Treat fedora core like centos/rhel for package building.

github.com/sudo-project/sudo - 25abb7218474e0fc7d8c9a214a627cdf226e6e9b authored over 8 years ago by Todd C. Miller <[email protected]>

Plug some memory leaks in the tests.

github.com/sudo-project/sudo - 73163c750a3030b68eabe0de6387da08d964ad2a authored over 8 years ago by Todd C. Miller <[email protected]>

If realloc of sudoerslval.command.args fails, reset sudoerslval.command.args

as well as arg_len and arg_size after freeing sudoerslval.command.args.

github.com/sudo-project/sudo - 2224cfd00004207a96a65ccadd94ec19b94dfa70 authored over 8 years ago by Todd C. Miller <[email protected]>

When freeing the iobs after pty tear-down, also free the associated

event structures. Quiets a memory leak warnings from address
sanitizer and valgrind.

github.com/sudo-project/sudo - a7e5ae1e5ba242851f7cbecf4b964c561092f306 authored over 8 years ago by Todd C. Miller <[email protected]>

iolog_compress should be bool, not int

github.com/sudo-project/sudo - 5cbe1edcfee429c550744f82f2efb3560a621407 authored over 8 years ago by Todd C. Miller <[email protected]>

Quiet address sanitizer leak detector.

github.com/sudo-project/sudo - 3bebdfea797f1e7e7a48194935f66d1baa1180ba authored over 8 years ago by Todd C. Miller <[email protected]>

Simple garbage collection (really a to-be-freed list) for the sudoers

plugin. Almost identical to what sudo.c uses. Currenly only the
environment strings are collect...

github.com/sudo-project/sudo - 21d6fc3d8f18f893686ddd8c5a39b63c789b93b6 authored over 8 years ago by Todd C. Miller <[email protected]>

Rename gc_cleanup to gc_run and remove I/O plugins from the plugin

list when freeing them.

github.com/sudo-project/sudo - 7b2fbed45d0e86951ab9414009a20c8a194d6073 authored over 8 years ago by Todd C. Miller <[email protected]>

Free up the garbage via an atexit() handler instead of requiring

a call to gc_exit.

github.com/sudo-project/sudo - 23aeb0b5ec6b53e9a3f0f05a18111d59590343bb authored over 8 years ago by Todd C. Miller <[email protected]>

Plug a memory leak in sudo_edit.

github.com/sudo-project/sudo - 78ac87cd90f5281fb4f1e2f1fdc042a3b85949d2 authored over 8 years ago by Todd C. Miller <[email protected]>

mention --enable-asan

github.com/sudo-project/sudo - fd9f0100642f1339775a1ae0001d0279c0b255ea authored over 8 years ago by Todd C. Miller <[email protected]>

Try to deconfuse static analyzers a bit.

github.com/sudo-project/sudo - 873d5cc5ff7c219fe2d41dc156c9792fde5e5134 authored over 8 years ago by Todd C. Miller <[email protected]>

Avoid possible NULL deref found by clang analyzer.

github.com/sudo-project/sudo - 23a82ab2e8865ae01260bad7d6079e8d6416ec1d authored over 8 years ago by Todd C. Miller <[email protected]>

Add --enable-asan configure flag to enable address sanitizer

github.com/sudo-project/sudo - 3d0b0f061e3c5798d34373296b0c6dd06b86631f authored over 8 years ago by Todd C. Miller <[email protected]>

Add support for garbage collecting info passed to the plugin before

exit to appease address sanitizer's leak detector (and valgrind's
leak checker). We can't free t...

github.com/sudo-project/sudo - 9b3ef072f9ecc931b6f9c044e862ff8bcd59f4ae authored over 8 years ago by Todd C. Miller <[email protected]>

auth_getpass() returns a dynamically allocated copy of the plaintext

password which needs to be freed after checking (and clearing) it.

github.com/sudo-project/sudo - ab11cdde2cb1be407f3c720d74c2294518d68dea authored over 8 years ago by Todd C. Miller <[email protected]>

Remove sudo_fatalx() calls from format_plugin_settings().

github.com/sudo-project/sudo - 91bce65e29d93e6c7bae30415efb9b7f3f79ddca authored over 8 years ago by Todd C. Miller <[email protected]>

fn_free_result() (aka sss_sudo_free_result() in sss_sudo.c) handles

a NULL poiner so there's no need to check before calling it. Add
missing initialization of sss_s...

github.com/sudo-project/sudo - e48ceebf14fdfd75962857094f06d90123311684 authored over 8 years ago by Todd C. Miller <[email protected]>

Add missing return when user is not found in sudo_sss_result_get().

Previously we fell through to the default case which just logged a
debug message and returned so ...

github.com/sudo-project/sudo - 60ea106cc489e4dc360cd1aab8bd6abf1c133b69 authored over 8 years ago by Todd C. Miller <[email protected]>

Fix a warning on AIX.

github.com/sudo-project/sudo - 6635f97b33b5097c4e33d1014007b9134b8fe5fc authored over 8 years ago by Todd C. Miller <[email protected]>

Pass updated user_env_out, not envp, to the I/O open function.

github.com/sudo-project/sudo - 5507b2328c58f1032de0e217e40952165d4d0d51 authored over 8 years ago by Todd C. Miller <[email protected]>

Pass updated argv/envp to the I/O open function like the plugin API

documents.

github.com/sudo-project/sudo - ca330adada9e02f9a45a8ecf7eddfc2548615655 authored over 8 years ago by Todd C. Miller <[email protected]>

Add check for I/O log file handle being NULL. This could only

happen if the front-end calls iolog_open with argc == 0 but actually
runs a command.

github.com/sudo-project/sudo - a6886d2345efd077f73e72c0a78a5da39ca66bf6 authored over 8 years ago by Todd C. Miller <[email protected]>

Additional debugging for pwutil functions.

github.com/sudo-project/sudo - c28f59271a7272b201763a51f558f5dd77533094 authored over 8 years ago by Todd C. Miller <[email protected]>

When calling setauthdb(), save the old registry value so we can

restore it properly. Previously we were setting the registry to
unrestricted instead of actually...

github.com/sudo-project/sudo - 41a32a1c58c8d2d82caab0733535a2877bfd9408 authored over 8 years ago by Todd C. Miller <[email protected]>

Use SUDOERS_DEBUG_UTIL not SUDO_DEBUG_UTIL in the plugin.

github.com/sudo-project/sudo - 578be4f39cc73e1d6bda567f64785a58a27dc759 authored over 8 years ago by Todd C. Miller <[email protected]>

When parsing debug entries, don't make a lower value override a

higher one. For example, for "pcomm@debug,all@warn" the "all@warn"
should not set pcomm to "warn...

github.com/sudo-project/sudo - 5016fa23df76867fb14d62e0d6fa5bb736f1d03f authored over 8 years ago by Todd C. Miller <[email protected]>

Set sudoedit_checkdir=false in command_details when it is disabled

in sudoers.

github.com/sudo-project/sudo - 7ed519125e4f65c33b327e3031f3569318ddf78a authored over 8 years ago by Todd C. Miller <[email protected]>

Update copyright year

github.com/sudo-project/sudo - f4e5b135bb8d3957ebfa4f6065b4bb70fca944d1 authored over 8 years ago by Todd C. Miller <[email protected]>

If the user runs "sudoedit /" we will receive ENOENT from openat(2)

and sudoedit will try to create a file with the null string. If
path is empty, open the cwd inst...

github.com/sudo-project/sudo - 726b4dc9681ebba0df3d2ea26736e2a60a0d3284 authored over 8 years ago by Todd C. Miller <[email protected]>

Log an error for invalid boolean strings.

github.com/sudo-project/sudo - 399ec8b2b0081600025af8bf070c7430ad9368b1 authored over 8 years ago by Todd C. Miller <[email protected]>

Fix off by one error in new SET_FLAG macro.

github.com/sudo-project/sudo - 5bae35c05c73e85075c38a4f6cb860aa48f4bed2 authored over 8 years ago by Todd C. Miller <[email protected]>

Document the race with sudoedit_checkdir in 1.8.15.

github.com/sudo-project/sudo - ec37504dfb711a0f297ff0ac77bf24a8f58810e5 authored over 8 years ago by Todd C. Miller <[email protected]>

Document sudoedit_checkdir

github.com/sudo-project/sudo - 42671f6b95f17afca87457d91763ff10f44f90f1 authored over 8 years ago by Todd C. Miller <[email protected]>

There are no systems that support O_SEARCH/O_PATH that do not also

support O_DIRECTORY so simplify the definition of DIR_OPEN_FLAGS a
bit.

github.com/sudo-project/sudo - 5e300f1e4c0d0ae407bac6393d1bbdcc9d640334 authored over 8 years ago by Todd C. Miller <[email protected]>

regen

github.com/sudo-project/sudo - 5dae4d3f355f62816249523776f312df3a326033 authored over 8 years ago by Todd C. Miller <[email protected]>

Add 1.8.16 changes

github.com/sudo-project/sudo - 647bfa4a9d2aa12e5755e5443b5beb01317c3527 authored over 8 years ago by Todd C. Miller <[email protected]>

Make sudoedit_checkdir the default and update the documentation accordingly.

github.com/sudo-project/sudo - de0208a01b87feea002a1d28d40db1c6f4a084bc authored over 8 years ago by Todd C. Miller <[email protected]>

Add a SET_FLAG macro to simplify parsing command details boolean

flags. Previously, flags were only set and never cleared even if
the boolean value was false. T...

github.com/sudo-project/sudo - e719d954e701561fde629e3ad0af64b74f4aef4f authored over 8 years ago by Todd C. Miller <[email protected]>

Need to be root when switching to a different user.

github.com/sudo-project/sudo - 4b96e94f37f89f741cbeaeb84a7d3d02b88a130e authored over 8 years ago by Todd C. Miller <[email protected]>

Use O_SEARCH on systems without O_PATH if present. It can be used

for a similar purpose.

github.com/sudo-project/sudo - 9f481f128dd6d23dd933fa0d1330bd6d6d0d7be9 authored over 8 years ago by Todd C. Miller <[email protected]>

Use faccessat(2) for directory writability instead of doing the

checks manually where possible. This also allows us to remove the
#ifdef __linux__ bits since we...

github.com/sudo-project/sudo - c1b148120406c958636e17ef7fdb8223a8087c55 authored over 8 years ago by Todd C. Miller <[email protected]>

Add "I/O LOG FILES" section to the manual and move many of the

details from the log_input and log_output descriptions to it.

github.com/sudo-project/sudo - 7f8a29dfc040c2a30967e12ba426c84bacc139a1 authored almost 9 years ago by Todd C. Miller <[email protected]>

Use "Nm sudoers" when talking about the plugin and "Em sudoers" when

talking about the sudoers file.

github.com/sudo-project/sudo - ad8c96403d8c39d47138862bc94e996d2f19e30a authored almost 9 years ago by Todd C. Miller <[email protected]>

Remove gzopen_w which is only defined on Windows.

github.com/sudo-project/sudo - 12a8becd7085669b9dd16cf4ef5953165dc4e0ae authored almost 9 years ago by Todd C. Miller <[email protected]>

Work around the buggy pread(2) on 32-bit HP-UX 11.00 by using

pread64() on that platform.

github.com/sudo-project/sudo - 4bcef637f86773382d6d4fb15044fc14751124fa authored almost 9 years ago by Todd C. Miller <[email protected]>

Add support for matching the entire netgroup tuple (user, host, domain).

github.com/sudo-project/sudo - 5a77989a33ee8f27349aec831603fcd55cce159c authored almost 9 years ago by Todd C. Miller <[email protected]>

Use asprintf() to generate the netgroup filter instead of using

lots of concatenation.

github.com/sudo-project/sudo - 9d7bc0311fa831012c5be4ff5bef19d0f46a7ddf authored almost 9 years ago by Todd C. Miller <[email protected]>

Add missing sudo_debug_exit_ssize_t_v1 symbol.

github.com/sudo-project/sudo - f97eba71f0cf249617c8a9be1b0ea835912e0f6f authored almost 9 years ago by Todd C. Miller <[email protected]>

Silence warning in digest_matches() on systems with no fexecve(2).

github.com/sudo-project/sudo - 089b468de730c3af912048cbf05659d7eb222bea authored almost 9 years ago by Todd C. Miller <[email protected]>

Fix free() of invalid pointer introduced in the commit that stripped

whitespace between a '!' and the name in a sudoOption.

github.com/sudo-project/sudo - 9308d05e7e73fa00daf2143fd899d618a7a89c30 authored almost 9 years ago by Todd C. Miller <[email protected]>

Fix free() of invalid pointer introduced in the commit that stripped

whitespace between a '!' and the name in a sudoOption.

github.com/sudo-project/sudo - 14b454cc0df788ec2fc080af60994e49fa72a4ce authored almost 9 years ago by Todd C. Miller <[email protected]>

Add missing dfd argument to the version of sudo_edit_openat_nofollow()

for systems without O_NOFOLLOW.

github.com/sudo-project/sudo - 051fe2d4cfe103fec0944ee41759380de0ba15f3 authored almost 9 years ago by Todd C. Miller <[email protected]>

In sudo_netgroup_lookup() only build up the search filter once

instead of once per netgroup_base.

github.com/sudo-project/sudo - 55fdf66c1daeff4ae4e1219b9ea54966cdde6740 authored almost 9 years ago by Todd C. Miller <[email protected]>

It is safe to pass ldap_msgfree() a NULL pointer.

github.com/sudo-project/sudo - 7c454656d5d3e9e106bd204c5a12a10021bbeb7d authored almost 9 years ago by Todd C. Miller <[email protected]>

On overflow, warn before freeing anything.

github.com/sudo-project/sudo - ae5a2f407272b634c75f7112479ab0babaa25c7b authored almost 9 years ago by Todd C. Miller <[email protected]>

Use user_runhost and user_srunhost instead of user_host and user_shost.

Fixes "sudo -l -h other_host" for LDAP and sssd.

github.com/sudo-project/sudo - 0f991ff78bf498171a2e7cebb05a2e6270611644 authored almost 9 years ago by Todd C. Miller <[email protected]>

Update description of sudoedit_checkdir. Reported by Sander Bos.

github.com/sudo-project/sudo - 8ed9f6172a0aed2f4c8aa57cb0a5e5364acca396 authored almost 9 years ago by Todd C. Miller <[email protected]>

No need to check whether the fd we opened is really a directory in

sudo_edit_open_nonwritable() since if not, the openat() will fail
with ENOTDIR anyway.

github.com/sudo-project/sudo - c7c80913ef5258bcc632bce370b88aa967b19e52 authored almost 9 years ago by Todd C. Miller <[email protected]>

Rewritten sudoedit_checkdir support that checks all the dirs in the

path and refuses to follow symlinks in writable directories.
This is a better fix for CVE-2015-56...

github.com/sudo-project/sudo - 68c1073fe52680f31682d3381d8824f709e40ec7 authored almost 9 years ago by Todd C. Miller <[email protected]>

sync with translationproject.org

github.com/sudo-project/sudo - 39db87e62b9b2061e59588bd96237623d0977e0b authored almost 9 years ago by Todd C. Miller <[email protected]>

Add support for using fexecve() if supported on commands that are

checksummed.

github.com/sudo-project/sudo - b20977d4452adc95de4fb582ed688335639e6dc3 authored almost 9 years ago by Todd C. Miller <[email protected]>

Call openat() with the basename not the full path. From Ben Hutchings.

github.com/sudo-project/sudo - 97e86c74ff31ee8935507b58ac2514a33d7f7146 authored almost 9 years ago by Todd C. Miller <[email protected]>

Fix compilation with --disable-shared

github.com/sudo-project/sudo - 330a209695771857b255a7298ca1581cc2f6712e authored almost 9 years ago by Todd C. Miller <[email protected]>

Check for existing dso in LD_PRELOAD and only add it if it is not

already present.

github.com/sudo-project/sudo - 88a634b7fb9c248efb51f96d30323a08c02856fb authored almost 9 years ago by Todd C. Miller <[email protected]>

Clarify when SIGINT and SIGQUIT are relayed by sudo to the command.

github.com/sudo-project/sudo - 584aebe738084f4bc74bcffa886f8da82010bd30 authored almost 9 years ago by Todd C. Miller <[email protected]>

Actually use the plugin_dir Path setting in sudo.conf.

github.com/sudo-project/sudo - ad1068c1eed2cc70053336d32f134e318025ad67 authored almost 9 years ago by Todd C. Miller <[email protected]>

The Path setting for the plugin directory is "plugin_dir" not "plugin".

github.com/sudo-project/sudo - 0123cf63f1ba9a043689a68fcbc79d94b47e7a5d authored almost 9 years ago by Todd C. Miller <[email protected]>

Allow sudo.conf Path settings to disable path names (by setting the

value of NULL).

github.com/sudo-project/sudo - 55531958de66a522c1d0dedcbdf2c1e984a1a278 authored almost 9 years ago by Todd C. Miller <[email protected]>

Change noexec flag in selinux_execve() from int to bool.

github.com/sudo-project/sudo - 7a57bae1e6bc2508f03f717ce3416b2d95d5272b authored almost 9 years ago by Todd C. Miller <[email protected]>

Refactor code to set LD_PRELOAD (or the equivalent) in the environment

into a preload_dso() function. Also avoid allocating a new copy
of the environment array if the ...

github.com/sudo-project/sudo - 4536480800bc196b0d2e80e69261fc5a4d60635d authored almost 9 years ago by Todd C. Miller <[email protected]>

Add missing square brackets in configure option descriptions.

github.com/sudo-project/sudo - 3b338830cf5f6f5efa66a4d3939690ad49afae92 authored almost 9 years ago by Todd C. Miller <[email protected]>

Document the names of the I/O log files and mention buffering.

Document that I/O logs are in gzip format by default.

github.com/sudo-project/sudo - a6f8994a593870e4ae3b614910bf06974840699c authored almost 9 years ago by Todd C. Miller <[email protected]>

Add BASHOPTS to initial_badenv_table[]; from Stephane Chazelas

github.com/sudo-project/sudo - 290dafda3b24027e18ae83dab05e386597be81a7 authored almost 9 years ago by Todd C. Miller <[email protected]>

When parsing sudoOptions that include an operator (!, +, +=, -=)

strip out any whitespace on either side of the operator.

github.com/sudo-project/sudo - d46d0fbc6fb5e3204d3970f0d8c88ae105923681 authored almost 9 years ago by Todd C. Miller <[email protected]>

Strip whitespace around '!', '=', '+=' and '-=' in Defaults entries.

github.com/sudo-project/sudo - e2add4ae20b365f27dbcf12bf43984aeca9f58f6 authored almost 9 years ago by Todd C. Miller <[email protected]>

Document the race condition between the digest check and command

execution.

github.com/sudo-project/sudo - 96201a275ec9d2f54c870aa725dc96115da08ce7 authored almost 9 years ago by Todd C. Miller <[email protected]>

When checking the query results, don't set user_matches in the

netgroup pass unless sudo_ldap_check_non_unix_group() returns true.
This was preventing the mail_...

github.com/sudo-project/sudo - 29e9273a402caddb0238219f28a51489c210471b authored almost 9 years ago by Todd C. Miller <[email protected]>

In list mode, we always want to clear FLAG_NO_USER and FLAG_NO_HOST

regardless of whether or not there was an actual match. Otherwise,
warning mail may be sent whic...

github.com/sudo-project/sudo - 9c9b487b0c40dd9c2248dd0acf60492e4302588a authored almost 9 years ago by Todd C. Miller <[email protected]>

Use size_t for length parameters in the fill functions used by the

lexer.

github.com/sudo-project/sudo - 604d350344d248ed971158ca10e20fc9340b83e7 authored almost 9 years ago by Todd C. Miller <[email protected]>

Use yy_size_t for digest_len since newer flex uses yy_size_t for

yyleng. Old flex uses int for yyleng so we need to use a cast to
avoid a sign compare warning.

github.com/sudo-project/sudo - 90e6bf318022a93d0af2f41230004906e47e38b8 authored almost 9 years ago by Todd C. Miller <[email protected]>

Use https in sudo.ws urls

github.com/sudo-project/sudo - d13bb39d1d1a06b44c8cb08c8c28562912489ed9 authored almost 9 years ago by Todd C. Miller <[email protected]>

Use https in urls.

github.com/sudo-project/sudo - 79be007bd6bfad627aed8684562ef570095b45a0 authored almost 9 years ago by Todd C. Miller <[email protected]>

sudo 1.8.16

github.com/sudo-project/sudo - 48a95973a5dcda4f15b232c1974bd2df88510cfa authored almost 9 years ago by Todd C. Miller <[email protected]>

When preserving variables from the invoking user's environment, if

there are duplicates only keep the first instance.

github.com/sudo-project/sudo - 9c0354730af98baf5944226d7c60c0f353536ee8 authored almost 9 years ago by Todd C. Miller <[email protected]>

Add debug_return_ssize_t

github.com/sudo-project/sudo - 8b12390abf20c79228dbdc905a3f65fa17dd2b73 authored almost 9 years ago by Todd C. Miller <[email protected]>

Avoid compilation error on Solaris 10 with Stun Studio 12.

Bug #727

github.com/sudo-project/sudo - c6dad0001d183143fe608b74b268b29723769691 authored almost 9 years ago by Todd C. Miller <[email protected]>

sync with translationproject.org

github.com/sudo-project/sudo - c752d91a3c76d74bbd907995596a3d1e4c626cb6 authored almost 9 years ago by Todd C. Miller <[email protected]>

Mention ssp configure fix.

github.com/sudo-project/sudo - 7fd8a7df3cc43cfc6603d7a84244058bcd9718d9 authored almost 9 years ago by Todd C. Miller <[email protected]>

sync with translationproject.org

github.com/sudo-project/sudo - a012fba17efabb2873e30e40d771eb3c7a69c6f8 authored almost 9 years ago by Todd C. Miller <[email protected]>

Don't use CPPFLAGS for the -fstack-protector check. Otherwise on

systems with _FORTIFY_SOURCE support we'll get an error due to the
lack of optimization flags. B...

github.com/sudo-project/sudo - 640e867dbd70bbebefa0baaeffd894016478a7d5 authored almost 9 years ago by Todd C. Miller <[email protected]>

When checking for stack protector support we need to actually link

the test program.

github.com/sudo-project/sudo - 448f7f25f2033a14f45071f226acbde98f6c0a84 authored almost 9 years ago by Todd C. Miller <[email protected]>

Preserve LDFLAGS when checking for stack protector as they may include

rpath settings to allow the stack protector lib to be found. Avoid
using existing CFLAGS since w...

github.com/sudo-project/sudo - b87ac0f0a25a08e46ef79b6324f02adf4ef67227 authored almost 9 years ago by Todd C. Miller <[email protected]>

Better configure test for -fstack-protector. Some gcc installations

may be missing the ssp library even though the compiler supports it.

github.com/sudo-project/sudo - bdcb83be92f012d2d9d635cd0ba77e8ffebaded6 authored almost 9 years ago by Todd C. Miller <[email protected]>

Set errno to EISDIR instead of ENOTDIR if directory is writable

since ENOTDIR can be a legitimate errno. This avoids a bogus
"directory is writable" error in th...

github.com/sudo-project/sudo - 9ecf12daa72bf24f22e49fa9a1df81f82ea68091 authored almost 9 years ago by Todd C. Miller <[email protected]>