github.com/sudo-project/sudo commits | Ecosyste.ms: OpenCollective

Add missing sudoers4 test file for new cvtsudoers test.

3c84aef902d2ece1c6e0f619822684aac2b8cfd4 authored over 2 years ago by Todd C. Miller <[email protected]>

defaults_check_conflict: it is only really a conflict if the binding match

If the Defaults name matched but the binding does not, we can simply
leave it be. Fixes a proble...

960bf99656ebefdc1bd60de68b17717d363492aa authored over 2 years ago by Todd C. Miller <[email protected]>

Make it possible to merge a host-based Defaults with a global one.

We convert the global Defaults to a host-based one with a single
"ALL" member. Later, when we si...

8f4351a89768085637e0e81b01ae5dadbda33809 authored over 2 years ago by Todd C. Miller <[email protected]>

Check for garbage after [section] in sudo_logsrvd.conf.

be4d62e9a4e584b1a51a90b35554493b09e12b6e authored over 2 years ago by Todd C. Miller <[email protected]>

Sync fuzzing dictionary with current configuration keyword list.

9303aec0dee1f08520877822896bb6d601309423 authored over 2 years ago by Todd C. Miller <[email protected]>

Escape/unescape commas when serializing/deserializing a stringlist.

5ea0bf4ee2960c5cc919659b9bf1183edece9bd5 authored over 2 years ago by Todd C. Miller <[email protected]>

Add new log_passwords and passprompt_regex settings.

When logging terminal input, if log_passwords is false and any
of the regular expressions in the ...

9b93961b3e9db14c8dc78f285d931d79a186e1b9 authored over 2 years ago by Todd C. Miller <[email protected]>

lib/iolog: add support for filtering password out of tty input

If a password regex is found in the tty output, tty input will be
replaced with '*' chars until a...

946404434ee6330cef95557275f30d14ac6ae591 authored over 2 years ago by Todd C. Miller <[email protected]>

Pass the operator to the Defaults callback too.

That way we can tell what to do in callbacks for lists.

86f123cd9d3682e1e93b044138695ea55c9d2578 authored over 2 years ago by Todd C. Miller <[email protected]>

Add a flag to avoid splitting list entries on white space.

c58a080dd57956ff569b21b74518bcd119039172 authored over 2 years ago by Todd C. Miller <[email protected]>

Add a new sudoers settings log_passwords and passprompt_regex.

When logging terminal input, if log_passwords is disabled and any
of the regular expressions in t...

0efe280037cf15f70db6527dbc826bc4aacd20e1 authored over 2 years ago by Todd C. Miller <[email protected]>

"plain text" -> "plaintext" for consistency.

be45d8fef425c05af694d06ed193b9438832502c authored over 2 years ago by Todd C. Miller <[email protected]>

Updated translations from translationproject.org

cc5eb2bc4d99799fcc057c2bf5dfdbd3998f51fd authored over 2 years ago by Todd C. Miller <[email protected]>

Sync with autoconf git.

f4dd590498bddfed891bdab0005d07c564ca00f7 authored over 2 years ago by Todd C. Miller <[email protected]>

Fix potential infinite loop when trying to format long lines.

ada7d438258a7020e4b055523bf4e97cb029d918 authored over 2 years ago by Todd C. Miller <[email protected]>

Document how commands are passed to the shell for the -i and -s options.

The concatenation of command and arguments and escaping of special
characters was not documented....

5f45fd907bf2ef0bbdd87cd991760f98783693d9 authored over 2 years ago by Todd C. Miller <[email protected]>

Also mention no_new_privs error in the troubleshooting guide.

805e1b94705e5ef0fd88e170b0d1f642df973262 authored over 2 years ago by Todd C. Miller <[email protected]>

Replace uid and gid with user-ID and group-ID in more places.

e4ee1a850291636c54ac75c043bc2ce0366df177 authored over 2 years ago by Todd C. Miller <[email protected]>

PAM is enabled on NetBSD by default too.

bdae9843ab90fb2091ad5673e11a667ddcb0f3a8 authored over 2 years ago by Todd C. Miller <[email protected]>

Use the Oxford comma consistently, it is helpful in technical documents.

9d79a0767ccd0dadfaf7f41565b44b01ed938c24 authored over 2 years ago by Todd C. Miller <[email protected]>

Document the error message when no_new_privs is set.

78e74c605ef6a2990500f66f0fbd8032a1b78cee authored over 2 years ago by Todd C. Miller <[email protected]>

Sudo now recovers from sudoers syntax errors.

17b7ac3460ef902361b3d2a77cfcaf864274f9b7 authored over 2 years ago by Todd C. Miller <[email protected]>

Use the Oxford comma consistently, it is helpful in technical documents.

0d0e7de45497cc147af607ebafc67f42ccc0e4e9 authored over 2 years ago by Todd C. Miller <[email protected]>

Mention docker configuration.

144e57832495f77d15991e053e365ffb4e58bff3 authored over 2 years ago by Todd C. Miller <[email protected]>

Quiet a cppcheck false positive.

368e5d49eb38ed37fb20e050ae3ae543597cd7a6 authored over 2 years ago by Todd C. Miller <[email protected]>

Mention https://www.sudo.ws/security/fuzzing/ in the fuzzing section.

9a013b79b80cda963c511cbf3d637eed50c5113d authored over 2 years ago by Todd C. Miller <[email protected]>

Fix logic inversion when setting negated flag.

08abeb94a55bd2abee7af79daadde87b6617888b authored over 2 years ago by Todd C. Miller <[email protected]>

Quiet a PVS-Studio format string warning.

5e30d01205533af2b04bbedd3aaf76f3916cbb6c authored over 2 years ago by Todd C. Miller <[email protected]>

Regen .pot files.

c8b9f4ad1df0f83b44c7a87d1787551c944fb2de authored almost 3 years ago by Todd C. Miller <[email protected]>

Bug #1016, #1017 and negated sudoUser in LDAP.

3f8b7f6eae3602e5b765e78ae6d3789828050624 authored almost 3 years ago by Todd C. Miller <[email protected]>

Don't set/run early Defaults if a custom defaults_list is specified.

Defaults settings passed in by the front end are already "early"
so there is no need to treat any...

e1c2288fbce9d1f9ff790ddc074f6648331499c9 authored almost 3 years ago by Todd C. Miller <[email protected]>

Mark is_early_default(), run_early_defaults(), set_early_default() static.

They are not used outside of defaults.c.

28cfe868ec5548adc7c9b12b7688323d0211a645 authored almost 3 years ago by Todd C. Miller <[email protected]>

Add support in SSSD for negated users.

9bb3df748e7df486e4492bd712a1ed61f672bf44 authored almost 3 years ago by Todd C. Miller <[email protected]>

Add support in the LDAP filter for negated users.

Based on a diff from Simon Lees

e88087721be391ec851b3cad8a88a5476f03d317 authored almost 3 years ago by Todd C. Miller <[email protected]>

Use PATH_MAX, not NAME_MAX+1 for the directory entry length.

On some systems, such as Solaris, the max length of a directory
entry is filesystem-dependent. W...

1afce22f7fc58b5f63f0430daa91cc394296ed0a authored almost 3 years ago by Todd C. Miller <[email protected]>

Only emulate Py_FinalizeEx for Python 3.[0-5].

853e710f4a8aaf295e595be4ddb908c9b08520cd authored almost 3 years ago by Todd C. Miller <[email protected]>

Use POSIX NAME_MAX, not the obsolete MAXNAMLEN define.

Fixes compilation with musl libc.

1f098a202955e667d077a9a1c286eee1dddc1bca authored almost 3 years ago by Todd C. Miller <[email protected]>

When applying fallback limits, make sure we don't reduce rlim_max.

Fixes a problem where sudo could reduce the max stack size on some
systems if the original limit ...

757c3a1d3776bb53a35bc8870620c3f9c2dbf0b7 authored almost 3 years ago by Todd C. Miller <[email protected]>

Don't modify the stack limit if it is >= SUDO_STACK_MIN.

1c95ab8852db67aaae7338165973e75abac011f7 authored almost 3 years ago by Todd C. Miller <[email protected]>

The pre-install target requires visudo, add an explicit dependency.

5fdaa482282926f319d3975839fb53d1ea1aab55 authored almost 3 years ago by Todd C. Miller <[email protected]>

If sudo is not set-user-ID root, check for the no_new_privs flag on Linux.

This flag disables set-user-ID at execve(2) time and may be set by
default for some containers. ...

2e08db36952ab6c55eff0b0a70a5bfed06edbf5f authored almost 3 years ago by Todd C. Miller <[email protected]>

Add pam_askpass_service sudoers setting for "sudo -A".

This makes it possible to use a different PAM configuration for
when "sudo -A" is used. The main...

48bc498a6fbbe6a98de916a6a3e68f0ee6acfab1 authored almost 3 years ago by Todd C. Miller <[email protected]>

Improve debugging info when fdopen() fails.

763256e464ea5ede0e41d937929dd6c7f4c0b5d2 authored almost 3 years ago by Todd C. Miller <[email protected]>

sss_sudo_free_values() checks for NULL, no need to do it manually.

3b7d32b251cca6513f59b8a623964ac787ca01aa authored almost 3 years ago by Todd C. Miller <[email protected]>

Quiet a clang analyzer false positive.

8aec6c2a8d42b3a5110c723789058aec94441a27 authored almost 3 years ago by Todd C. Miller <[email protected]>

Quiet a clang analyzer false positive.

de7171ab6c67249445d5e8f958d53a9359937bd6 authored almost 3 years ago by Todd C. Miller <[email protected]>

Fix return value for non-interactive mode for non-standalone auth methods.

AUTH_NONINTERACTIVE was being stored in the wrong variable.

a2d27bc9ec55b569c25ffa0481855b9c94fe8b8c authored almost 3 years ago by Todd C. Miller <[email protected]>

Updated translations from translationproject.org

513574ce105e473aaa2c891e443b1151ed235d97 authored almost 3 years ago by Todd C. Miller <[email protected]>

defaults_var_matches() should return bool, not enum match_result.

Remove enum match_result as it is no longer used.

d6ff97d8377232e4d46af47a7ce0904c97717dfd authored almost 3 years ago by Todd C. Miller <[email protected]>

Quiet two PVS-studio warnings.

72989bf83f0947d5171336a37ce4c1308cceb04d authored almost 3 years ago by Todd C. Miller <[email protected]>

Remove PAM_TTY workaround for old, buggy PAM modules.

In the past, some PAM modules assumed that PAM_TTY was set and would
misbehave (or crash) if not....

1b72f138e33e17465c3cdf232233a0b013ebccbc authored almost 3 years ago by Todd C. Miller <[email protected]>

Mention fix for Bug #956 and GitHub issue #83.

8c42a29a1e96bb8581cc6e6cfe7d698e7223f3b3 authored almost 3 years ago by Todd C. Miller <[email protected]>

Push non-interactive mode checking down into the auth methods.

For "sudo -n" we only want to reject a command if user input is
actually required. In the case o...

521ef37aeaa8899928a83e8d6b7a5858894e18b5 authored almost 3 years ago by Todd C. Miller <[email protected]>

userspec_overridden: fix checks when there is more than one userspec

296d876b76b56563807cfb5077c39ee72a8dbffb authored almost 3 years ago by Todd C. Miller <[email protected]>

Fix merging of global/ALL entries when each input file has a host.

If a host is specified for the input file, cvtsudoers will bind
global Defaults to that host and ...

835079fa3f984d81ddc6345bdb8b3a38cb3d7a6a authored almost 3 years ago by Todd C. Miller <[email protected]>

Welcome to 2022.

d02ba52fa41fcdfdd5b6500ed81419cd077cd79b authored almost 3 years ago by Todd C. Miller <[email protected]>

LICENSE.md moved to the top-level src dir.

59d55c5308b4b652851531c6ddde090453b3e9c8 authored almost 3 years ago by Todd C. Miller <[email protected]>

Merge pull request #127 from Tyler887/main

Typo

dabd8d80a219e4f5dc819c41f49668225b0e139d authored almost 3 years ago by Todd C. Miller <[email protected]>

Typo

d9594cb216d16aca723fa3e09d92ba1edbe28cc6 authored almost 3 years ago by Tyler887 <[email protected]>

Back out changes to enable SELinux by default.

This may return in a future release in a different form.

e22cc7253002b778a72685510ec1adee05bfb9a4 authored almost 3 years ago by Todd C. Miller <[email protected]>

Move LICENSE.md out of docs and back to the top-level.

GitHub expects it to be in the top-level directory.

0ed92e6165c3f35d5188d1d0db04754fea023bcb authored almost 3 years ago by Todd C. Miller <[email protected]>

cvtsudoers: fix a regression when merging matching Defaults.

If a host is specified with a sudoers file, we have to treat Defaults
as Defaults@host checking f...

149e8208b5e27adf4fe843e1ad13b164fcba914b authored almost 3 years ago by Todd C. Miller <[email protected]>

add_defaults: add defs == NULL check to quiet coverity false positive

4ffc3142c5bcd99fcd11e145be3bc1c69be29d36 authored almost 3 years ago by Todd C. Miller <[email protected]>

When merging Defaults, allow a subsequent global Defaults (no

binding) to override a prior Defaults setting with a binding.

dfc11d74839bf7e3ab0bda0a5b4f6e569a7977a5 authored almost 3 years ago by Todd C. Miller <[email protected]>

add_defaults: defs can never be NULL

6a2c5043a9cff1124489fad0a1f42e47bd9461bf authored almost 3 years ago by Todd C. Miller <[email protected]>

Plug memory leak when making a default host-specific.

We don't need to allocate new space for the binding list,
just the members of the list.

546d4f624657d1f9825fc14cb5dd945c7869ae14 authored almost 3 years ago by Todd C. Miller <[email protected]>

Add an example cvtsudoers.conf file.

5d95345e60fc8ff57f8864fe1fe39e7465e47566 authored almost 3 years ago by Todd C. Miller <[email protected]>

Add group_file, match_local, and passwd_file to cvtsudoers.conf.

Previously, these were only settable via command line options.

991ef32508071a41078c03bcb088c2226806d615 authored almost 3 years ago by Todd C. Miller <[email protected]>

Remove question about running Solaris 11 binaries on Solaris 10.

Current versions of sudo use many APIs that are not present on
Solaris 10. If you want a sudo So...

537f75dc74a148d15fdf08d26cf2bdcca9f868dd authored almost 3 years ago by Todd C. Miller <[email protected]>

Add simple test for cvtsudoers merge functionality.

7158b03b5029fcf528b4bbfc827d25af09b9a809 authored almost 3 years ago by Todd C. Miller <[email protected]>

Updated translations from translationproject.org

955359af5de957bf8c6c4cf174a48c3c59b65962 authored almost 3 years ago by Todd C. Miller <[email protected]>

Add sudoers Spanish translation from translationproject.org

869994433fc538f8f61031ded090f1267b4661a6 authored almost 3 years ago by Todd C. Miller <[email protected]>

Bugs #1013 and #1014

7d7e24d16780c16c7296ac5420dbe7d65f07f082 authored almost 3 years ago by Todd C. Miller <[email protected]>

sudo_mkdir_parents: make sure the path we created is a directory

For extra paranoia, verify that the directory we created is still
a directory before we fchown() it.

c53192eb7ed9286e0b617e23601ddbf81d90fab6 authored almost 3 years ago by Todd C. Miller <[email protected]>

In SECURITY NOTES, clarify that PATH may be overridden by the policy.

Bug #1014

e66e1ca383e22643936f3befb3c2095c4f4d3a32 authored almost 3 years ago by Todd C. Miller <[email protected]>

Avoid TOCTOU in sudo_mkdir_parents() using openat(2) and mkdirat(2).

This also allows us to make path const as it should be.

c13b21c19974615434b8825aba72b5c95225eeb4 authored almost 3 years ago by Todd C. Miller <[email protected]>

Sudo parsed "deref" and "tls_reqcert" in ldap.conf but didn't set the options.

The switch() in the sudo_ldap_set_options_table() function needed to be
updated to treat CONF_DER...

55db23924313020c49de3ddd9b04ef4180f18064 authored almost 3 years ago by Todd C. Miller <[email protected]>

Minor formatting tweak so we can import into the sudo web site.

a2aa709707b8d7257720b0a51f1acbb681241892 authored almost 3 years ago by Todd C. Miller <[email protected]>

Fix CodeQL "Multiplication result converted to larger type" warnings.

83defd3a6fef867eea9e640c6650e5c3dc1011aa authored almost 3 years ago by Todd C. Miller <[email protected]>

Surround email addresses with angle brackets, not square backets.

014339948c9b3be4f4dcf7cc512db3ab71384f00 authored almost 3 years ago by Todd C. Miller <[email protected]>

Updated translations from translationproject.org

3cd0ffade8b98e12888e44b5a6e9fc68434b72d5 authored almost 3 years ago by Todd C. Miller <[email protected]>

Update .pot files for 1.9.9

27121cff65f563a4c8986360a488e67ecb50ed07 authored almost 3 years ago by Todd C. Miller <[email protected]>

Minor formatting tweaks.

d324a530656ba18927f918b7e73a82970f6ed9e1 authored almost 3 years ago by Todd C. Miller <[email protected]>

Convert README and docs files to markdown.

This makes things look better on GitHub and we can use the
markdown version directly in the new s...

3bd572ba80f8e65095a3fb643007b2937f275a4b authored almost 3 years ago by Todd C. Miller <[email protected]>

Policy -> Disclosure Policy

2c754a8d497b0961a4ef3528037ab877924ff3f2 authored almost 3 years ago by Todd C. Miller <[email protected]>

Merge pull request #124 from juspence/main

Allow sudo -g anyone and sudo -u anyone -g anytwo

9497ab99c671c3d7054a78817d176f175cc614ea authored almost 3 years ago by Todd C. Miller <[email protected]>

Allow sudo -g anyone and sudo -u anyone -g anytwo

When only the user (ALL) is specified explicitly, and the group is implied, only sudo -u works. ...

1d13533ea3cda05ec666c45c6c533b614fdd97aa authored almost 3 years ago by juspence <[email protected]>

Add build dir to include search path for mksiglist.h and mksigname.h

Fixes out of tree builds on systems without sys_siglist[] or
sys_signame[]. GitHub issue #123.

aae130eb7367d72d335222a18d409687847f0b9c authored almost 3 years ago by Todd C. Miller <[email protected]>

cvtsudoers: better merging of lists that are not exact duplicates

When merging rules, if one list would be overridden by another,
remove the overridden rule and co...

0608a4ea6fc13ca35141dcd6ee843f7624d49095 authored almost 3 years ago by Todd C. Miller <[email protected]>

Update NEWS with latest changes.

a9f3032b5b5a30e72d7efb1fd440c0527409ae7d authored almost 3 years ago by Todd C. Miller <[email protected]>

dir_is_writable: don't treat EPERM from faccessat() as a fatal error.

We can get EPERM on Linux with SELinux. GitHub issue #122.

f9f39cde20a7c0eb4c880bd73095757c3b847789 authored almost 3 years ago by Todd C. Miller <[email protected]>

cvtsudoers: add -l option to log merge actions

The "-l logfile" option can be used to store a log of what
actions cvtsudoers took when merging m...

003f9550f175f0dff7ca437ee59b5c5bc1f4b36c authored almost 3 years ago by Todd C. Miller <[email protected]>

Sudo 1.9.9

ce9c6d17c5d857d4a29fb70b23df1733d37c7911 authored almost 3 years ago by Todd C. Miller <[email protected]>

New Persian (Farsi) translation from translationproject.org

409410b029aa56ca02336507a9f9b3df6feabd03 authored almost 3 years ago by Todd C. Miller <[email protected]>

Quiet a PVS Studio warning.

The warning that need_comma is always false is correct but in this
case it is better to use a con...

d83321388d5bd6c4d99ae7d8a84b59145eb539c2 authored almost 3 years ago by Todd C. Miller <[email protected]>

Pass correct size to free_zero().

Coverity CID 241233

dc5ac7424b93b750efa20238b1d7502966dc745d authored almost 3 years ago by Todd C. Miller <[email protected]>

Add reference counting to Defaults bindings.

Previously, we checked that the previous entry's binding pointer
was not the same while freeing. ...

e64a089aea42710098666e55427fce9c97a1c94d authored almost 3 years ago by Todd C. Miller <[email protected]>

cvtsudoers: merge Defaults when multiple sudoers files are specified

If a hostname is specified with the sudoers file, it will be used to
make the Defaults setting ho...

d31109ded2974cc14cad3d1ca4cc885a4b893f04 authored almost 3 years ago by Todd C. Miller <[email protected]>

cvtsudoers: merge userspecs when multiple sudoers files are specified

If a hostname is specified with the sudoers file, it will be used to
make the userspec host-speci...

f5c6e2df7b363dd0fb015332b0f4d7fa76777c75 authored almost 3 years ago by Todd C. Miller <[email protected]>

Document how to merge sudoers files with cvtsudoers.

cc79038730793ab5c4c4dacd9d1bd7f59c088e00 authored almost 3 years ago by Todd C. Miller <[email protected]>