aboutsummaryrefslogtreecommitdiff
path: root/security/sudo
Commit message (Collapse)AuthorAgeFilesLines
* */*: PORTREVISION++ on some @sample-using portsColin Percival2025-11-061-1/+1
| | | | | | | | | | | | | | | | | | | | The handling of @sample with regard to no-root installation was recently fixed, by 452309533805 (in ports) plus changes in pkg 2.4. These need new packages built before they will correctly install, including into VM images generated as part of the FreeBSD release process. Unfortunately with the release scheduled for just a few weeks away and generally slow arm64 package building, there isn't time for a full pkg set rebuild; so bump a handful of ports which are used in the release process so that they will be rebuilt. Users who are not building VM images using the "no-root" pathway (aka using a METALOG index of the disk image) are not affected by this; we doubt anyone other than re@ will notice. With hat: re@ Discussed with: bapt, antoine
* security/sudo: Pass correct --with-sssd-conf value to the configure scriptGleb Popov2025-10-291-1/+3
| | | | | Approved by: kiwi Differential Revision: https://reviews.freebsd.org/D53072
* security/sudo: Update to 1.9.17p2Renato Botelho2025-07-282-4/+4
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: security update to 1.9.17p1FiLiS2025-07-012-4/+4
| | | | | | | | | | | | | | | | | | This update fixes two security vulnerabilities that allow privilege escalation. https://www.sudo.ws/security/advisories/host_any/ https://www.sudo.ws/security/advisories/chroot_bug/ https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot PR: 287938 Approved by: garga@ (maintainer) Security: 24f4b495-56a1-11f0-9621-93abbef07693 Security: CVE-2025-32462 Security: CVE-2025-32463 MFH: 2025Q2 MFH: 2025Q3 (as needed)
* security/sudo: Update to 1.9.17Cy Schubert2025-06-233-5/+5
| | | | PR: 287709
* security/sudo: Remove SSSD2 option, replaced by a flavorGleb Popov2025-02-261-6/+3
| | | | | Approved by: kiwi, garga Differential Revision: https://reviews.freebsd.org/D48586
* security/sudo: Fix typo in OPTIONS_DEFAULT,Matthias Andree2025-01-111-1/+1
| | | | | | | removing an excess "s". Approved by: portmgr@ (implicit, with kiwi@'s consent) Reported by: ler@
* security/sudo: Add sssd flavorXavier Beaudouin2025-01-101-0/+8
| | | | | | | | | | | Sudo with sssd support is a good candidate for a flavor because it is a fairly common requirement in some deployments. Sponsored by: Klara, Inc. Approved by: 0mp (mentor) Approved by: garga (maintainer) Differential Revision: https://reviews.freebsd.org/D48147
* security/sudo: Remove dependency on security/sssdXavier Beaudouin2025-01-101-9/+3
| | | | | | | | | | | | | | | security/sssd was removed from ports recently, which broke the SSSD option. Let's remove the SSSD option and let users use SSSD2 instead. PORTREVISION has been bumped so it is easier to tell which version of the sudo package supports only sssd2. PR: 283952 Sponsored by: Klara, Inc. Approved by: 0mp (mentor) Approved by: garga (maintainer) Differential Revision: https://reviews.freebsd.org/D48389
* security/sudo: Update to 1.9.16p2Cy Schubert2024-11-262-4/+4
| | | | | | | | | | | | | | | | | | | | | Major changes between sudo 1.9.16p2 and 1.9.16p1: * Sudo now passes the terminal device number to the policy plugin even if it cannot resolve it to a path name. This allows sudo to run without warnings in a chroot jail when the terminal device files are not present. GitHub issue #421. * On Linux systems, sudo will now attempt to use the symbolic links in /proc/self/fd/{0,1,2} when resolving the terminal device number. This can allow sudo to map a terminal device to its path name even when /dev/pts is not mounted in a chroot jail. * Fixed compilation errors with gcc and clang in C23 mode. C23 no longer supports functions with unspecified arguments. GitHub issue #420. PR: 282976 Approved by: garga (maintainer)
* security/sudo: Update to 1.9.16p1Cy Schubert2024-11-132-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Major changes between sudo 1.9.16p1 and 1.9.16: * Fixed the test for cross-compiling when checking for C99 snprintf(). The changes made to the test in sudo 1.9.16 resulted in a different problem. GitHub issue #386. * Fixed the date used by the exit record in sudo-format log files. This was a regression introduced in sudo 1.9.16 and only affected file-based logs, not syslog. GitHub issue #405. * Fixed the root cause of the "unable to find terminal name for device" message when running sudo on AIX when no terminal is present. In sudo 1.9.16 this was turned from a debug message into a warning. GitHub issue #408. * When a duplicate alias is found in the sudoers file, the warning message now includes the file and line number of the previous definition. * Added support for the --with-secure-path-value=no configure option to allow packagers to ship the default sudoers file with the secure path line commented out. * Sudo no longer sends mail when a user runs "sudo -nv" or "sudo -nl", even if "mail_badpass" or "mail_always" are set. Sudo already avoids logging to a file or syslog in this case. Bug #1072. PR: 282720 Approved by: garga (maintainer) MFH: 2024Q4
* security/sudo: hook up orphaned doc file with LDAP option enabled (+)Dima Panov2024-09-271-0/+1
| | | | | Reported-by: poudriere bulk -t failure Approved-by: portmgr blanket (trivial fix)
* security/sudo: Update to 1.9.16Yasuhiro Kimura2024-09-163-5/+5
| | | | | | ChangeLog: https://www.sudo.ws/releases/stable/#1.9.16 PR: 281428 Approved by: garga (maintainer)
* security/sudo: Mark SSSD option as deprecatedRenato Botelho2024-02-281-1/+1
| | | | | | security/sssd is marked as deprecated, add a note on option description Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: rename the SSSD_DEVEL option to SSSD2Dan Langille2024-02-151-5/+5
| | | | | | security/sssd-devel was renamed to security/sssd2 PR: 277077
* security/sudo: re-add sssd-devel optionDan Langille2024-01-241-3/+8
| | | | | | | | | | | sudo already allows for the use of security/sssd (SSSD) This patch allows for selecting security/sssd-devel (SSSD_DEVEL) instead. Also updates security/sssd-devel, elminating a circular dependency. PR: 276598 272571
* */*: Restore GNU_CONFIGURE on my portsRenato Botelho2024-01-161-2/+3
| | | | | | | | | | I made a mistake and changed these ports to HAS_CONFIGURE when working on MANPREFIX sanitization. Restore proper macro usage and set GNU_CONFIGURE_MANPREFIX properly to keep manpages installed under ${PREFIX}/share. Reported by: danfe Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Move manpages to ${PREFIX}/shareRenato Botelho2024-01-152-17/+19
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Update to 1.9.15p5Cy Schubert2024-01-022-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | Major changes between sudo 1.9.15p5 and 1.9.15p4: * Fixed evaluation of the "lecture", "listpw", "verifypw", and "fdexec" sudoers Defaults settings when used without an explicit value. Previously, if specified without a value they were evaluated as boolean "false", even when the negation operator ('!') was not present. * Fixed a bug introduced in sudo 1.9.14 that prevented LDAP netgroup queries using the NETGROUP_BASE setting from being performed. * Sudo will now transparently rename a user's lecture file from the older name-based path to the newer user-ID-based path. GitHub issue #342. * Fixed a bug introduced in sudo 1.9.15 that could cause a memory allocation failure if sysconf(_SC_LOGIN_NAME_MAX) fails. Bug #1066. PR: 276032 Approved by: garga (maintainer) MFH: 2024Q1
* security/sudo: Update to 1.9.15p4Cy Schubert2023-12-192-4/+4
| | | | | | | | | | | | | Major changes between sudo 1.9.15p4 and 1.9.15p3: * Fixed a bug introduced in sudo 1.9.15 that could prevent a user's privileges from being listed by "sudo -l" if the sudoers entry in /etc/nsswitch.conf contains "[SUCCESS=return]". This did not affect the ability to run commands via sudo. Bug #1063. PR: 275788 Approved by: garga (maintainer) MFH: 2023Q4
* security/sudo: Update to 1.9.15p3Cy Schubert2023-12-142-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Major changes between sudo 1.9.15p3 and 1.9.15p2: * Always disable core dumps when sudo sends itself a fatal signal. Fixes a problem where sudo could potentially dump core dump when it re-sends the fatal signal to itself. This is only an issue if the command received a signal that would normally result in a core dump but the command did not actually dump core. * Fixed a bug matching a command with a relative path name when the sudoers rule uses shell globbing rules for the path name. Bug #1062. * Permit visudo to be run even if the local host name is not set. GitHub issue #332. * Fixed an editing error introduced in sudo 1.9.15 that could prevent sudoreplay from replaying sessions correctly. GitHub issue #334. * Fixed a bug introduced in sudo 1.9.15 where "sudo -l > /dev/null" could hang on Linux systems. GitHub issue #335. * Fixed a bug introduced in sudo 1.9.15 where Solaris privileges specified in sudoers were not applied to the command being run. PR: 275754 Approved by: garga (maintainer) MFH: 2023Q4
* security/sudo: Update to 1.9.15p2Renato Botelho2023-11-092-4/+4
| | | | | | | | * Fixed a bug on BSD systems where sudo would not restore the terminal settings on exit if the terminal had parity enabled. GitHub issue #326. Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Update to 1.9.15p1Renato Botelho2023-11-082-4/+4
| | | | | | | | | | * Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based sudoers from being able to read the ldap.conf file. GitHub issue #325. PR: 274960 Reported by: Daniel Porsch <daniel.porsch@loopia.se> Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Update to 1.9.15Renato Botelho2023-11-063-15/+18
| | | | | | | | | | | | While here: - Prevent combination of SSSD and GSSAPI_HEIMDAL because sssd port requires MIT kerberos and it will conflict with heimdal - Removed SSSD_DEVEL option because sssd-devel port requires sudo and it creates a circular dependency - Fix OPIE on FreeBSD versions after it was removed from base Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Fix build with openssl from portsRenato Botelho2023-11-011-3/+8
| | | | | | | | | | | | | | Since SSL support is being changed and sudo can be built without it, add a new SSL option, on by default. When option is enabled, use --enable-openssl=${OPENSSLBASE} to make sure it consumes desired OpenSSL implementation. Also add pkgconfig dependency because configure script rely on it to detect openssl details. PR: 274753 Reported by: tburns@hrsd.com Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Update to 1.9.14p3Cy Schubert2023-07-252-4/+4
| | | | | | | | | | | | | Major changes between sudo 1.9.14p3 and 1.9.14p2: * Fixed a crash with Python 3.12 when the sudo Python python is unloaded. This only affects "make check" for the Python plugin. * Adapted the sudo Python plugin test output to match Python 3.12. PR: 272707 Approved by: garga (maintainer) MFH: 2023Q3
* security/sudo: Update to 1.9.14p2Renato Botelho2023-07-172-5/+4
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: add sssd-devel optionDan Langille2023-07-141-2/+8
| | | | | | | | | security/sudo already allows for the use of security/sssd (SSSD) This patch allows for selecting security/sssd-devel (SSSD_DEVEL) instead. PR: 272488
* security/sudo: Update to 1.9.14p1Cy Schubert2023-07-122-4/+4
| | | | | | | | | | | | | | | Major changes between sudo 1.9.14p1 and 1.9.14: * Fixed an "invalid free" bug in sudo_logsrvd that was introduced in version 1.9.14 which could cause sudo_logsrvd to crash. * The sudoers plugin no longer tries to send the terminal name to the log server when no terminal is present. This bug was introduced in version 1.9.14. PR: 272456 Approved by: garga (maintainer) MFH: 2023Q3
* Revert "security/sudo: Update to 1.9.14p1"Cy Schubert2023-07-122-4/+4
| | | | | | I forgot to put the PR number in its placeholder. This reverts commit af3f8976df6f16a1a2554537e9c35188db653d0f.
* security/sudo: Update to 1.9.14p1Cy Schubert2023-07-122-4/+4
| | | | | | | | | | | | | | | Major changes between sudo 1.9.14p1 and 1.9.14: * Fixed an "invalid free" bug in sudo_logsrvd that was introduced in version 1.9.14 which could cause sudo_logsrvd to crash. * The sudoers plugin no longer tries to send the terminal name to the log server when no terminal is present. This bug was introduced in version 1.9.14. PR: NNNNNN Approved by: garga (maintainer) MFH: 2023Q3
* security/sudo: Update to 1.9.14Cy Schubert2023-06-292-4/+4
| | | | | | PR: 272255 Approved by: garga (maintainer) MFH" 2023Q2
* security/sudo: Ignore portscoutRenato Botelho2023-06-201-0/+2
| | | | | | | It doesn't understand sudo versioning scheme and keep giving false alerts. Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Pacify portclippyRenato Botelho2023-06-201-52/+57
| | | | | | No functional changes intended Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Update to 1.9.13p3Yasuhiro Kimura2023-03-092-4/+4
| | | | | | | | PR 270002 Approved by: garga (maintainer - private email to myself, implicit) message-id: 816dd4b5-0a0d-3dd2-4bcc-c9b3b1a4ddfd@FreeBSD.org MFH: 2023Q1 ChangeLog: https://www.sudo.ws/releases/stable/#1.9.13p3
* security/sudo: Update to 1.9.13p2Cy Schubert2023-03-012-4/+4
| | | | | | | | | | | | | | | Major changes between sudo 1.9.13p2 and 1.9.13p1: * Fixed the --enable-static-sudoers option, broken in sudo 1.9.13. GitHub issue #245. * Fixed a potential double-free bug when matching a sudoers rule that contains a per-command chroot directive (CHROOT=dir). This bug was introduced in sudo 1.9.8. PR: 269854 Approved by: garga MFH: 2023Q1
* security/sudo: Upgrade to 1.9.13p1Renato Botelho2023-02-202-4/+4
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Update to 1.9.13Cy Schubert2023-02-153-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Major changes between sudo 1.9.13 and 1.9.12p2: * Fixed a bug running relative commands via sudo when "log_subcmds" is enabled. GitHub issue #194. * Fixed a signal handling bug when running sudo commands in a shell script. Signals were not being forwarded to the command when the sudo process was not run in its own process group. * Fixed a bug in cvtsudoers' LDIF parsing when the file ends without a newline and a backslash is the last character of the file. * Fixed a potential use-after-free bug with cvtsudoers filtering. GitHub issue #198. * Added a reminder to the default lecture that the password will not echo. This line is only displayed when the pwfeedback option is disabled. GitHub issue #195. * Fixed potential memory leaks in error paths. GitHub issues #199, #202. * Fixed potential NULL dereferences on memory allocation failure. GitHub issues #204, #211. * Sudo now uses C23-style attributes in function prototypes instead of gcc-style attributes if supported. * Added a new "list" pseudo-command in sudoers to allow a user to list another user's privileges. Previously, only root or a user with the ability to run any command as either root or the target user on the current host could use the -U option. This also includes a fix to the log entry when a user lacks permission to run "sudo -U otheruser -l command". Previously, the logs would indicate that the user tried to run the actual command, now the log entry includes the list operation. * JSON logging now escapes control characters if they happen to appear in the command or environment. * New Albanian translation from translationproject.org. * Regular expressions in sudoers or logsrvd.conf may no longer contain consecutive repetition operators. This is implementation- specific behavior according to POSIX, but some implementations will allocate excessive amounts of memory. This mainly affects the fuzzers. * Sudo now builds AIX-style shared libraries and dynamic shared objects by default instead of svr4-style. This means that the default sudo plugins are now .a (archive) files that contain a .so shared object file instead of bare .so files. This was done to improve compatibility with the AIX Freeware ecosystem, specifically, the AIX Freeware build of OpenSSL. Sudo will still load svr4-style .so plugins and if a .so file is requested, either via sudo.conf or the sudoers file, and only the .a file is present, sudo will convert the path from plugin.so to plugin.a(plugin.so) when loading it. This ensures compatibility with existing configurations. To restore the old, pre-1.9.13 behavior, run configure using the --with-aix-soname=svr4 option. * Sudo no longer checks the ownership and mode of the plugins that it loads. Plugins are configured via either the sudo.conf or sudoers file which are trusted configuration files. These checks suffered from time-of-check vs. time-of-use race conditions and complicate loading plugins that are not simple paths. Ownership and mode checks are still performed when loading the sudo.conf and sudoers files, which do not suffer from race conditions. The sudo.conf "developer_mode" setting is no longer used. * Control characters in sudo log messages and "sudoreplay -l" output are now escaped in octal format. Space characters in the command path are also escaped. Command line arguments that contain spaces are surrounded by single quotes and any literal single quote or backslash characters are escaped with a backslash. This makes it possible to distinguish multiple command line arguments from a single argument that contains spaces. * Improved support for DragonFly BSD which uses a different struct procinfo than either FreeBSD or 4.4BSD. * Fixed a compilation error on Linux arm systems running older kernels that may not define EM_ARM in linux/elf-em.h. GitHub issue #232. * Fixed a compilation error when LDFLAGS contains -Wl,--no-undefined. Sudo will now link using -Wl,--no-undefined by default if possible. GitHub issue #234. * Fixed a bug executing a command with a very long argument vector when "log_subcmds" or "intercept" is enabled on a system where "intercept_type" is set to "trace". GitHub issue #194. * When sudo is configured to run a command in a pseudo-terminal but the standard input is not connected to a terminal, the command will now be run as a background process. This works around a problem running sudo commands in the background from a shell script where changing the terminal to raw mode could interfere with the interactive shell that ran the script. GitHub issue #237. * A missing include file in sudoers is no longer a fatal error unless the error_recovery plugin argument has been set to false. PR: 269563 Submitted by: cy Reported by: cy Approved by: garga MFH: 2023Q1
* Mk/**ldap.mk: Convert USE_LDAP to USES=ldapMuhammad Moinur Rahman2023-02-081-1/+1
| | | | | | | | | | | | | | | Convert the USE_LDAP=yes to USES=ldap and adds the following features: - Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as RUN_DEPENDS - Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER - Adds OPENLDAP versions in bsd.default-versions.mk - Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk - Changes consumers to use the features Reviewed by: delphij Approved by: portmgr Differential Revision: https://reviews.freebsd.org/D38233
* security/sudo: Update to 1.9.12p2Cy Schubert2023-01-182-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | Major changes between sudo 1.9.12p2 and 1.9.12p1: * Fixed a compilation error on Linux/aarch64. GitHub issue #197. * Fixed a potential crash introduced in the fix for GitHub issue #134. If a user's sudoers entry did not have any RunAs user's set, running "sudo -U otheruser -l" would dereference a NULL pointer. * Fixed a bug introduced in sudo 1.9.12 that could prevent sudo from creating a I/O files when the "iolog_file" sudoers setting contains six or more Xs. * Fixed CVE-2023-22809, a flaw in sudo's -e option (aka sudoedit) that coud allow a malicious user with sudoedit privileges to edit arbitrary files. PR: 269030 Submitted by: cy Reported by: cy Approved by: garga MFH: 2023Q1 Security: CVE-2023-22809
* security/sudo: Update to 1.9.12p1Cy Schubert2022-11-072-4/+4
| | | | | | | | | | | This release includes fixes to minor bugs, including a fix for CVE-2022-43995, a non-exploitable potential out-of-bounds write on systems that do not use PAM, AIX authentication or BSD authentication. PR: 267617 Approved by: garga (Maintainer) MFH: 2022Q4 Security: CVE-2022-43995
* security/sudo: Update to 1.9.12Renato Botelho2022-10-243-6/+5
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* Remove WWW entries moved into port MakefilesStefan Eßer2022-09-071-2/+0
| | | | | | | | | | Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)
* Add WWW entries to port MakefilesStefan Eßer2022-09-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)
* security: remove 'Created by' linesTobias C. Berner2022-07-201-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A big Thank You to the original contributors of these ports: * <ports@c0decafe.net> * Aaron Dalton <aaron@FreeBSD.org> * Adam Weinberger <adamw@FreeBSD.org> * Ade Lovett <ade@FreeBSD.org> * Aldis Berjoza <aldis@bsdroot.lv> * Alex Dupre <ale@FreeBSD.org> * Alex Kapranoff <kappa@rambler-co.ru> * Alex Samorukov <samm@freebsd.org> * Alexander Botero-Lowry <alex@foxybanana.com> * Alexander Kriventsov <avk@vl.ru> * Alexander Leidinger <netchild@FreeBSD.org> * Alexander Logvinov <ports@logvinov.com> * Alexander Y. Grigoryev <alexander.4mail@gmail.com> * Alexey Dokuchaev <danfe@FreeBSD.org> * Alfred Perlstein * Alfred Perlstein <alfred@FreeBSD.org> * Anders Nordby <anders@FreeBSD.org> * Anders Nordby <anders@fix.no> * Andreas Klemm <andreas@klemm.gtn.com> * Andrew Lewis <freeghb@gmail.com> * Andrew Pantyukhin <infofarmer@FreeBSD.org> * Andrew St. Jean <andrew@arda.homeunix.net> * Anes Mukhametov <anes@anes.su> * Antoine Brodin <antoine@FreeBSD.org> * Anton Berezin <tobez@FreeBSD.org> * Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>) * Antonio Carlos Venancio Junior <antonio@inf.ufsc.br> * Ashish SHUKLA <ashish@FreeBSD.org> * Attila Nagy <bra@fsn.hu> * Autrijus Tang <autrijus@autrijus.org> * Axel Rau <axel.rau@chaos1.de> * Babak Farrokhi <farrokhi@FreeBSD.org> * Ben Woods <woodsb02@FreeBSD.org> * Bernard Spil <brnrd@FreeBSD.org> * Bernard Spil <brnrd@freebsd.org> * Blaz Zupan <blaz@si.FreeBSD.org> * Bob Hockney <zeus@ix.netcom.com> * Boris Kochergin <spawk@acm.poly.edu> * Brendan Molloy <brendan+freebsd@bbqsrc.net> * Bruce M Simpson * Bruce M Simpson <bms@FreeBSD.org> * Bruce M. Simpson <bms@FreeBSD.org> * Carlo Strub * Carlo Strub <cs@FreeBSD.org> * Carlos J Puga Medina <cpm@FreeBSD.org> * Carlos J Puga Medina <cpm@fbsd.es> * Charlie Root <se@FreeBSD.org> * Cheng-Lung Sung <clsung@FreeBSD.org> * Cheng-Lung Sung <clsung@dragon2.net> * Chie Taguchi <taguchi.ch@gmail.com> * Chris Cowart <ccowart@rescomp.berkeley.edu> * Chris D. Faulhaber <jedgar@FreeBSD.org> * Christer Edwards <christer.edwards@gmail.com> * Christian Lackas * Christopher Hall <hsw@bitmark.com> * Clement Laforet <sheepkiller@cultdeadsheep.org> * Clive Lin <clive@CirX.ORG> * Colin Percival * Cory McIntire (loon@noncensored.com) * Craig Leres <leres@FreeBSD.org> * Cristiano Deana <cris@gufi.org> * Cy Schubert (Cy.Schubert@uumail.gov.bc.ca) * Cy Schubert <Cy.Schubert@uumail.gov.bc.ca> * Cy Schubert <cy@FreeBSD.org> * Damian Gerow <dgerow@afflictions.org> * Damien Bobillot * Dan Langille * Dan Langille <dan@freebsddiary.org> * Dan Langille <dvl@FreeBSD.org> * Dan Langille <dvl@freebsd.org> * Dan Langille <dvl@sourcefire.com> * Daniel Kahn Gillmor <dkg@fifthhorseman.net> * Daniel Roethlisberger <daniel@roe.ch> * Danilo Egea Gondolfo <danilo@FreeBSD.org> * Danton Dorati <urisso@bsd.com.br> * Dave McKay <dave@mu.org> * David E. Thiel <lx@FreeBSD.org> * David O'Brien (obrien@NUXI.com) * David O'Brien <obrien@FreeBSD.org> * David Thiel <lx@redundancy.redundancy.org> * Dean Hollister <dean@odyssey.apana.org.au> * Denis Shaposhnikov <dsh@vlink.ru> * Dereckson <dereckson@gmail.com> * Dirk Froemberg <dirk@FreeBSD.org> * Ditesh Shashikant Gathani <ditesh@gathani.org> * Dom Mitchell <dom@happygiraffe.net> * Dominic Marks <dominic.marks@btinternet.com> * Don Croyle <croyle@gelemna.org> * Douglas Thrift <douglas@douglasthrift.net> * Edson Brandi <ebrandi@fugspbr.org> * Edwin Groothuis <edwin@mavetju.org> * Ekkehard 'Ekki' Gehm <gehm@physik.tu-berlin.de> * Emanuel Haupt <ehaupt@FreeBSD.org> * Emanuel Haupt <ehaupt@critical.ch> * Eric Crist <ecrist@secure-computing.net> * Erwin Lansing <erwin@FreeBSD.org> * Eugene Grosbein <eugen@FreeBSD.org> * Fabian Keil <fk@fabiankeil.de> * Felix Palmen <felix@palmen-it.de> * Florent Thoumie <flz@xbsd.org> * Foxfair Hu <foxfair@FreeBSD.org> * Frank Laszlo <laszlof@vonostingroup.com> * Frank Wall <fw@moov.de> * Franz Bettag <franz@bett.ag> * Gabor Kovesdan * Gabor Kovesdan <gabor@FreeBSD.org> * Gabriel M. Dutra <0xdutra@gmail.com> * Gary Hayers <Gary@Hayers.net> * Gasol Wu <gasol.wu@gmail.com> * Gea-Suan Lin <gslin@gslin.org> * George Reid <greid@ukug.uk.freebsd.org> * George Reid <services@nevernet.net> * Greg Larkin <glarkin@FreeBSD.org> * Greg V <greg@unrelenting.technology> * Gregory Neil Shapiro <gshapiro@FreeBSD.org> * Grzegorz Blach <gblach@FreeBSD.org> * Guangyuan Yang <ygy@FreeBSD.org> * Hakisho Nukama <nukama@gmail.com> * Hammurabi Mendes <hmendes@brturbo.com> * Henk van Oers <hvo.pm@xs4all.nl> * Horia Racoviceanu <horia@racoviceanu.com> * Hung-Yi Chen <gaod@hychen.org> * Jaap Akkerhuis <jaap@NLnetLabs.nl> * Jaap Boender <jaapb@kerguelen.org> * Jacek Serwatynski <tutus@trynet.eu.org> * James FitzGibbon <jfitz@FreeBSD.org> * James Thomason <james@divide.org> * Jan-Peter Koopmann <Jan-Peter.Koopmann@seceidos.de> * Janky Jay <ek@purplehat.org> * Janos Mohacsi * Janos Mohacsi <janos.mohacsi@bsd.hu> * Jean-Yves Lefort <jylefort@brutele.be> * Jim Geovedi <jim@corebsd.or.id> * Jim Ohlstein <jim@ohlste.in> * Joe Clarke <marcus@marcuscom.com> * Joe Marcus Clarke <marcus@FreeBSD.org> * Johann Visagie <johann@egenetics.com> * Johann Visagie <wjv@FreeBSD.org> * John Ferrell <jdferrell3@yahoo.com> * John Hixson <jhixson@gmail.com> * John Polstra <jdp@polstra.com> * John W. O'Brien <john@saltant.com> * John-Mark Gurney <jmg@FreeBSD.org> * Jose Alonso Cardenas Marquez <acardenas@bsd.org.pe> * Joseph Benden <joe@thrallingpenguin.com> * Joshua D. Abraham <jabra@ccs.neu.edu> * Jov <amutu@amutu.com> * Jui-Nan Lin <jnlin@freebsd.cs.nctu.edu.tw> * Ka Ho Ng <khng300@gmail.com> * Kay Lehmann <kay_lehmann@web.de> * Keith J. Jones <kjones@antihackertoolkit.com> * Kevin Zheng <kevinz5000@gmail.com> * Kimura Fuyuki <fuyuki@hadaly.org> * Kimura Fuyuki <fuyuki@mj.0038.net> * Klayton Monroe <klm@uidzero.org> * Konstantin Menshikov <kostjnspb@yandex.ru> * Koop Mast <kwm@FreeBSD.org> * Kris Kennaway <kris@FreeBSD.org> * Kubilay Kocak <koobs@FreeBSD.org> * Kurt Jaeger <fbsd-ports@opsec.eu> * LEVAI Daniel <leva@ecentrum.hu> * Lars Engels <lme@FreeBSD.org> * Lars Thegler <lth@FreeBSD.org> * Laurent LEVIER <llevier@argosnet.com> * Luiz Eduardo R. Cordeiro * Lukas Slebodnik <lukas.slebodnik@intrak.sk> * Lukasz Komsta * Mageirias Anastasios <anastmag@gmail.com> * Marcel Prisi <marcel.prisi@virtua.ch> * Marcello Coutinho * Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org> * Mark Felder <feld@FreeBSD.org> * Mark Hannon <markhannon@optusnet.com.au> * Mark Murray <markm@FreeBSD.org> * Mark Pulford <mark@kyne.com.au> * Marko Njezic <sf@maxempire.com> * Martin Matuska <martin@tradex.sk> * Martin Matuska <mm@FreeBSD.org> * Martin Mersberger * Martin Wilke <miwi@FreeBSD.org> * Martti Kuparinen <martti.kuparinen@ericsson.com> * Mateusz Piotrowski <0mp@FreeBSD.org> * Matt <matt@xtaz.net> * Matt Behrens <matt@zigg.com> * Matthias Andree <mandree@FreeBSD.org> * Matthias Fechner <mfechner@FreeBSD.org> * Matthieu BOUTHORS <matthieu@labs.fr> * Maxim Sobolev <sobomax@FreeBSD.org> * Meno Abels <meno.abels@adviser.com> * Michael Haro <mharo@FreeBSD.org> * Michael Johnson <ahze@FreeBSD.org> * Michael Nottebrock <lofi@FreeBSD.org> * Michael Reifenberger <mr@FreeBSD.org> * Michael Schout <mschout@gkg.net> * Michal Bielicki <m.bielicki@llizardfs.com> * Michiel van Baak <michiel@vanbaak.eu * Mij <mij@bitchx.it> * Mike Heffner <mheffner@vt.edu> * Mikhail T. <m.tsatsenko@gmail.com> * Mikhail Teterin <mi@aldan.algebra.com> * Milan Obuch * Mosconi <mosconi.rmg@gmail.com> * Muhammad Moinur Rahman <5u623l20@gmail.com> * Mustafa Arif <ma499@doc.ic.ac.uk> * Neil Booth * Neil Booth <kyuupichan@gmail.com> * Nick Barkas <snb@threerings.net> * Nicola Vitale <nivit@FreeBSD.org> * Niels Heinen * Nikola Kolev <koue@chaosophia.net> * Nobutaka Mantani <nobutaka@FreeBSD.org> * Oliver Lehmann * Oliver Lehmann <oliver@FreeBSD.org> * Olivier Duchateau * Olivier Duchateau <duchateau.olivier@gmail.com> * Olli Hauer * Patrick Li <pat@databits.net> * Paul Chvostek <paul@it.ca> * Paul Schmehl <pauls@utdallas.edu> * Pavel I Volkov <pavelivolkov@googlemail.com> * Pete Fritchman <petef@databits.net> * Peter Ankerstal <peter@pean.org> * Peter Haight <peterh@sapros.com> * Peter Johnson <johnson.peter@gmail.com> * Peter Pentchev <roam@FreeBSD.org> * Petr Rehor <rx@rx.cz> * Philippe Audeoud <jadawin@tuxaco.net> * Philippe Rocques <phil@teaser.fr> * Piotr Kubaj <pkubaj@FreeBSD.org> * Piotr Kubaj <pkubaj@anongoth.pl> * Po-Chuan Hsieh <sunpoet@FreeBSD.org> * RaRa Rasputin <rasputin@submonkey.net> * Radim Kolar * Ralf Meister * Remington Lang <MrL0Lz@gmail.com> * Renaud Chaput <renchap@cocoa-x.com> * Roderick van Domburg <r.s.a.vandomburg@student.utwente.nl> * Roland van Laar <roland@micite.net> * Romain Tartiere <romain@blogreen.org> * Roman Bogorodskiy * Roman Bogorodskiy <novel@FreeBSD.org> * Roman Shterenzon <roman@xpert.com> * Rong-En Fan <rafan@FreeBSD.org> * Ryan Steinmetz <zi@FreeBSD.org> * Sahil Tandon <sahil@tandon.net> * Sascha Holzleiter <sascha@root-login.org> * SeaD * Seamus Venasse <svenasse@polaris.ca> * Sean Greven <sean.greven@gmail.com> * Sebastian Schuetz <sschuetz@fhm.edu> * Sergei Kolobov <sergei@FreeBSD.org> * Sergei Kolobov <sergei@kolobov.com> * Sergei Vyshenski * Sergei Vyshenski <svysh.fbsd@gmail.com> * Sergey Skvortsov <skv@protey.ru> * Seth Kingsley <sethk@meowfishies.com> * Shaun Amott <shaun@inerd.com> * Simeon Simeonov <sgs@pichove.org> * Simon Dick <simond@irrelevant.org> * Sofian Brabez <sbrabez@gmail.com> * Stanislav Sedov <ssedov@mbsd.msk.ru> * Stefan Esser <se@FreeBSD.org> * Stefan Grundmann * Stefan Walter <sw@gegenunendlich.de> * Stephon Chen <stephon@gmail.com> * Steve Wills <steve@mouf.net> * Steve Wills <swills@FreeBSD.org> * Steven Kreuzer * Steven Kreuzer <skreuzer@exit2shell.com> * Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> * TAKAHASHI Kaoru <kaoru@kaisei.org> * TAKATSU Tomonari <tota@FreeBSD.org> * Tatsuki Makino <tatsuki_makino@hotmail.com> * Thibault Payet <monwarez@mailoo.org> * Thierry Thomas (<thierry@pompo.net>) * Thierry Thomas <thierry@pompo.net> * Thomas Hurst <tom@hur.st> * Thomas Quinot <thomas@cuivre.fr.eu.org> * Thomas Zander <riggs@FreeBSD.org> * Thomas von Dein <freebsd@daemon.de> * Tilman Linneweh <arved@FreeBSD.org> * Tim Bishop <tim@bishnet.net> * Tom Judge <tom@tomjudge.com> * Tomoyuki Sakurai <cherry@trombik.org> * Toni Viemerö <toni.viemero@iki.fi> * Tony Maher * Torsten Zuhlsdorff <ports@toco-domains.de> * Travis Campbell <hcoyote@ghostar.org> * Tsung-Han Yeh <snowfly@yuntech.edu.tw> * Ulf Lilleengen * Vaida Bogdan <vaida.bogdan@gmail.com> * Valentin Zahariev <curly@e-card.bg> * Valerio Daelli <valerio.daelli@gmail.com> * Veniamin Gvozdikov <vg@FreeBSD.org> * Victor Popov * Victor Popov <v.a.popov@gmail.com> * Vsevolod Stakhov * Vsevolod Stakhov <vsevolod@FreeBSD.org> * Wen Heping <wen@FreeBSD.org> * Wen Heping <wenheping@gmail.com> * Yarodin <yarodin@gmail.com> * Yen-Ming Lee <leeym@FreeBSD.org> * Yen-Ming Lee <leeym@cae.ce.ntu.edu.tw> * Yen-Ming Lee <leeym@leeym.com> * Ying-Chieh Liao <ijliao@FreeBSD.org> * Yonatan <Yonatan@Xpert.com> * Yonatan <onatan@gmail.com> * Yoshisato YANAGISAWA * Yuri Victorovich * Yuri Victorovich <yuri@rawbw.com> * Zach Thompson <hideo@lastamericanempire.com> * Zane C. Bowers <vvelox@vvelox.net> * Zeus Panchenko <zeus@gnu.org.ua> * ache * adamw * ajk@iu.edu * alex@FreeBSD.org * allan@saddi.com * alm * andrej@ebert.su * andrew@scoop.co.nz * andy@fud.org.nz * antoine@FreeBSD.org * arved * barner * brix@FreeBSD.org * buganini@gmail.com * chinsan * chris@still.whet.org * clement * clsung * crow * cy@FreeBSD.org * dominik karczmarski <dominik@karczmarski.com> * dwcjr@inethouston.net * eivind * erich@rrnet.com * erwin@FreeBSD.org * girgen@FreeBSD.org * glen.j.barber@gmail.com * hbo@egbok.com * ijliao * jesper * jfitz * johans * joris * kftseng@iyard.org * kris@FreeBSD.org * lx * markm * mharo@FreeBSD.org * michaelnottebrock@gmx.net * mnag@FreeBSD.org * mp39590@gmail.com * nbm * nectar@FreeBSD.org * nork@FreeBSD.org * nork@cityfujisawa.ne.jp * nsayer@FreeBSD.org * nsayer@quack.kfu.com * ntarmos@cs.uoi.gr * oly * onatan@gmail.com * pandzilla * patrick@mindstep.com * pauls * perl@FreeBSD.org * petef@FreeBSD.org * peter.thoenen@yahoo.com * ports@c0decafe.net * ports@rbt.ca * roam@FreeBSD.org * rokaz * sada@FreeBSD.org * scrappy * se * shane@freebsdhackers.net aka modsix@gmail.com * snb@threerings.net * sumikawa * sviat * teramoto@comm.eng.osaka-u.ac.jp * thierry@pompo.net * tobez@FreeBSD.org * torstenb@FreeBSD.org * trasz <trasz@pin.if.uz.zgora.pl> * trevor * truckman * vanhu * vanilla@ * wen@FreeBSD.org * will With hat: portmgr
* security/sudo: Update to 1.9.11p3Renato Botelho2022-06-212-4/+4
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* security/sudo: Update to 1.9.11p2 -- Fix regressionsCy Schubert2022-06-132-4/+4
| | | | | | | | | | | | Major changes between sudo 1.9.11p2 and 1.9.11p1: * Fixed a compilation error on Linux/x86_64 with the x32 ABI. * Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to sudo_logsrvd if the command returned no output. PR: 264643 Approved by: garga (maintainer)
* security/sudo: Update to 1.9.11p1Cy Schubert2022-06-092-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Major changes between sudo 1.9.11p1 and 1.9.11: * Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on some systems when piping a large amount of data through sudo, such as via rsync. Bug #963. * Changes to avoid implementation or unspecified behavior when bit shifting signed values in the protobuf library. * Fixed a compilation error on Linux/aarch64. * Fixed the configure check for seccomp(2) support on Linux. * Corrected the EBNF specification for tags in the sudoers manual page. GitHub issue #153. Major changes between sudo 1.9.11 and 1.9.10: * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, "make check" now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by "make check" now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The "starttime" test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo's "intercept" and "log_subcmds" options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the "tls_dhparams" configuration setting was used. * The "intercept" and "log_subcmds" functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo's SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new "intercept_type" sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the "server_log" setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. PR: 264554 Approved by: garga (maintainer)
* security/sudo: fix packaging with PYTHON option enabled (+)Dima Panov2022-06-081-1/+1
| | | | | | | | | This a followup to commit 3ee710e0b22309a7e87c71b87bf5510aa8678ed8 sudo-1.9.11 have moved plugins manpages from section 8 to section 5 Pointy hat to: cy Approved by: portmgr blanket
* security/sudo: Update to 1.9.11Cy Schubert2022-06-083-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Major changes between sudo 1.9.11 and 1.9.10: * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, "make check" now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by "make check" now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The "starttime" test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo's "intercept" and "log_subcmds" options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the "tls_dhparams" configuration setting was used. * The "intercept" and "log_subcmds" functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo's SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new "intercept_type" sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the "server_log" setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. PR: 264515 Approved by: garga (maintainer)
generated by cgit v1.2.3 (git 2.25.1) at 2026-02-04 13:58:36 +0000