CVS commit: pkgsrc/security/sudo

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Nov  9 12:17:07 UTC 2023

Modified Files:
        pkgsrc/security/sudo: Makefile PLIST distinfo

Log Message:
sudo: updated to 1.9.15p1

What's new in Sudo 1.9.15p1

 * Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based
   sudoers from being able to read the ldap.conf file.

What's new in Sudo 1.9.15

 * Fixed an undefined symbol problem on older versions of macOS
   when "intercept" or "log_subcmds" are enabled in sudoers.

 * Fixed "make check" failure related to getpwent(3) wrapping
   on NetBSD.

 * Fixed the warning message for "sudo -l command" when the command
   is not permitted.  There was a missing space between "list" and
   the actual command due to changes in sudo 1.9.14.

 * Fixed a bug where output could go to the wrong terminal if
   "use_pty" is enabled (the default) and the standard input, output
   or error is redirected to a different terminal.

 * The visudo utility will no longer create an empty file when the
   specified sudoers file does not exist and the user exits the
   editor without making any changes.

 * The AIX and Solaris sudo packages on www.sudo.ws now support
   "log_subcmds" and "intercept" with both 32-bit and 64-bit
   binaries.  Previously, they only worked when running binaries
   with the same word size as the sudo binary.

 * The sudoers source is now logged in the JSON event log.  This
   makes it possible to tell which rule resulted in a match.

 * Running "sudo -ll command" now produces verbose output that
   includes matching rule as well as the path to the sudoers file
   the matching rule came from.  For LDAP sudoers, the name of the
   matching sudoRole is printed instead.

 * The embedded copy of zlib has been updated to version 1.3.

 * The sudoers plugin has been modified to make it more resilient
   to ROWHAMMER attacks on authentication and policy matching.
   This addresses CVE-2023-42465.

 * The sudoers plugin now constructs the user time stamp file path
   name using the user-ID instead of the user name.  This avoids a
   potential problem with user names that contain a path separator
   ('/') being interpreted as part of the path name.  A similar
   issue in sudo-rs has been assigned CVE-2023-42456.

 * A path separator ('/') in a user, group or host name is now
   replaced with an underbar character ('_') when expanding escapes
   in @include and @includedir directives as well as the "iolog_file"
   and "iolog_dir" sudoers Default settings.

 * The "intercept_verify" sudoers option is now only applied when
   the "intercept" option is set in sudoers.  Previously, it was
   also applied when "log_subcmds" was enabled.  Sudo 1.9.14
   contained an incorrect fix for this.

 * Changes to terminal settings are now performed atomically, where
   possible.  If the command is being run in a pseudo-terminal and
   the user's terminal is already in raw mode, sudo will not change
   the user's terminal settings.  This prevents concurrent sudo
   processes from restoring the terminal settings to the wrong values.

 * Reverted a change from sudo 1.9.4 that resulted in PAM session
   modules being called with the environment of the command to be
   run instead of the environment of the invoking user.

 * New Indonesian translation from translationproject.org.

 * The sudo_logsrvd server will now raise its open file descriptor
   limit to the maximum allowed value when it starts up.  Each
   connection can require up to nine open file descriptors so the
   default soft limit may be too low.

 * Better log message when rejecting a command if the "intercept"
   option is enabled and the "intercept_allow_setid" option is
   disabled.  Previously, "command not allowed" would be logged and
   the user had no way of knowing what the actual problem was.

 * Sudo will now log the invoking user's environment as "submitenv"
   in the JSON logs.  The command's environment ("runenv") is no
   longer logged for commands rejected by the sudoers file or an
   approval plugin.


To generate a diff of this commit:
cvs rdiff -u -r1.199 -r1.200 pkgsrc/security/sudo/Makefile
cvs rdiff -u -r1.24 -r1.25 pkgsrc/security/sudo/PLIST
cvs rdiff -u -r1.130 -r1.131 pkgsrc/security/sudo/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/sudo/Makefile
diff -u pkgsrc/security/sudo/Makefile:1.199 pkgsrc/security/sudo/Makefile:1.200
--- pkgsrc/security/sudo/Makefile:1.199 Tue Oct 24 22:11:00 2023
+++ pkgsrc/security/sudo/Makefile       Thu Nov  9 12:17:07 2023
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.199 2023/10/24 22:11:00 wiz Exp $
+# $NetBSD: Makefile,v 1.200 2023/11/09 12:17:07 adam Exp $
 
-DISTNAME=      sudo-1.9.14p3
-PKGREVISION=   1
+DISTNAME=      sudo-1.9.15p1
 CATEGORIES=    security
 MASTER_SITES=  https://www.sudo.ws/dist/
 MASTER_SITES+= ftp://ftp.sudo.ws/pub/sudo/

Index: pkgsrc/security/sudo/PLIST
diff -u pkgsrc/security/sudo/PLIST:1.24 pkgsrc/security/sudo/PLIST:1.25
--- pkgsrc/security/sudo/PLIST:1.24     Mon Feb 20 13:36:42 2023
+++ pkgsrc/security/sudo/PLIST  Thu Nov  9 12:17:07 2023
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.24 2023/02/20 13:36:42 taca Exp $
+@comment $NetBSD: PLIST,v 1.25 2023/11/09 12:17:07 adam Exp $
 bin/cvtsudoers
 bin/sudo
 bin/sudoedit
@@ -77,6 +77,7 @@ ${PLIST.nls}share/locale/hr/LC_MESSAGES/
 ${PLIST.nls}share/locale/hr/LC_MESSAGES/sudoers.mo
 ${PLIST.nls}share/locale/hu/LC_MESSAGES/sudo.mo
 ${PLIST.nls}share/locale/hu/LC_MESSAGES/sudoers.mo
+${PLIST.nls}share/locale/id/LC_MESSAGES/sudo.mo
 ${PLIST.nls}share/locale/it/LC_MESSAGES/sudo.mo
 ${PLIST.nls}share/locale/it/LC_MESSAGES/sudoers.mo
 ${PLIST.nls}share/locale/ja/LC_MESSAGES/sudo.mo

Index: pkgsrc/security/sudo/distinfo
diff -u pkgsrc/security/sudo/distinfo:1.130 pkgsrc/security/sudo/distinfo:1.131
--- pkgsrc/security/sudo/distinfo:1.130 Sun Aug 13 14:14:37 2023
+++ pkgsrc/security/sudo/distinfo       Thu Nov  9 12:17:07 2023
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.130 2023/08/13 14:14:37 taca Exp $
+$NetBSD: distinfo,v 1.131 2023/11/09 12:17:07 adam Exp $
 
-BLAKE2s (sudo-1.9.14p3.tar.gz) = ede93724daf64c1aa294ae85a3228b4d53863b1e7d61a849ada87e1ee7c26eb0
-SHA512 (sudo-1.9.14p3.tar.gz) = d4af836e3316c35d8b81a2c869ca199e8f2d5cb26dbd98b8ad031f29be62b154452afdf5a506ddabad21b80e5988a49f1f7c8f1ec44718ffcbd7e89ccbdef612
-Size (sudo-1.9.14p3.tar.gz) = 5232320 bytes
+BLAKE2s (sudo-1.9.15p1.tar.gz) = db565c4aa342026fec234ab5cf567c940789a10a738fbe6b9a53450d6ca94fab
+SHA512 (sudo-1.9.15p1.tar.gz) = 8a8042dc255cc5ed2b024a2b77646983e7d93f88f7974e34b125ca13d38720b76df57b46c6fe7158f33cf4f3c7cad793398892a0fcd1956077b5cd144f31ca0f
+Size (sudo-1.9.15p1.tar.gz) = 5302562 bytes
 SHA1 (patch-Makefile.in) = 1a83c55d27829013e2e23073046c5c39b020fafe
 SHA1 (patch-configure) = 824095fe7be5f8503434581a07e947c94552b0f7
 SHA1 (patch-examples_Makefile.in) = a20967ecd88eb5e4a8b47e6a3b80bc18be713409