diff options
author | Patrick J Volkerding <volkerdi@slackware.com> | 2022-11-05 19:18:19 +0000 |
---|---|---|
committer | Eric Hameleers <alien@slackware.com> | 2022-11-06 13:30:38 +0100 |
commit | 2d3e95aa334c39f59069fd1a725ec375deedc602 (patch) | |
tree | ca103f4c8b2c2a7189bfc19ca060ca056b9896b0 /patches | |
parent | 44df9c66d8f2adaa07a6bb0d956908e9e0dd3bb0 (diff) | |
download | current-2d3e95aa334c39f59069fd1a725ec375deedc602.tar.gz current-2d3e95aa334c39f59069fd1a725ec375deedc602.tar.xz |
Sat Nov 5 19:18:19 UTC 202220221105191819_15.0
patches/packages/sudo-1.9.12p1-x86_64-1_slack15.0.txz: Upgraded.
Fixed a potential out-of-bounds write for passwords smaller than 8
characters when passwd authentication is enabled.
This does not affect configurations that use other authentication
methods such as PAM, AIX authentication or BSD authentication.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2022-43995
(* Security fix *)
Diffstat (limited to 'patches')
-rw-r--r-- | patches/packages/sudo-1.9.12p1-x86_64-1_slack15.0.txt | 11 | ||||
-rw-r--r-- | patches/source/sudo/doinst.sh | 14 | ||||
-rw-r--r-- | patches/source/sudo/slack-desc | 19 | ||||
-rwxr-xr-x | patches/source/sudo/sudo.SlackBuild | 150 | ||||
-rw-r--r-- | patches/source/sudo/sudo.url | 1 |
5 files changed, 195 insertions, 0 deletions
diff --git a/patches/packages/sudo-1.9.12p1-x86_64-1_slack15.0.txt b/patches/packages/sudo-1.9.12p1-x86_64-1_slack15.0.txt new file mode 100644 index 000000000..427ea5539 --- /dev/null +++ b/patches/packages/sudo-1.9.12p1-x86_64-1_slack15.0.txt @@ -0,0 +1,11 @@ +sudo: sudo (give limited root privileges to certain users) +sudo: +sudo: 'sudo' is a command that allows users to execute some commands as +sudo: root. The /etc/sudoers file (edited with 'visudo') specifies which +sudo: users have access to sudo and which commands they can run. 'sudo' +sudo: logs all its activities to /var/log/ so the system administrator +sudo: can keep an eye on things. +sudo: +sudo: Homepage: https://www.sudo.ws +sudo: +sudo: diff --git a/patches/source/sudo/doinst.sh b/patches/source/sudo/doinst.sh new file mode 100644 index 000000000..01e3d173e --- /dev/null +++ b/patches/source/sudo/doinst.sh @@ -0,0 +1,14 @@ +#!/bin/sh +config() { + NEW="$1" + OLD="`dirname $NEW`/`basename $NEW .new`" + # If there's no config file by that name, mv it over: + if [ ! -r $OLD ]; then + mv $NEW $OLD + elif [ "`cat $OLD | md5sum`" = "`cat $NEW | md5sum`" ]; then # toss the redundant copy + rm $NEW + fi + # Otherwise, we leave the .new copy for the admin to consider... +} +config etc/sudoers.new +rm -f etc/sudoers.new diff --git a/patches/source/sudo/slack-desc b/patches/source/sudo/slack-desc new file mode 100644 index 000000000..2cd4e31cb --- /dev/null +++ b/patches/source/sudo/slack-desc @@ -0,0 +1,19 @@ +# HOW TO EDIT THIS FILE: +# The "handy ruler" below makes it easier to edit a package description. Line +# up the first '|' above the ':' following the base package name, and the '|' on +# the right side marks the last column you can put a character in. You must make +# exactly 11 lines for the formatting to be correct. It's also customary to +# leave one space after the ':'. + + |-----handy-ruler------------------------------------------------------| +sudo: sudo (give limited root privileges to certain users) +sudo: +sudo: 'sudo' is a command that allows users to execute some commands as +sudo: root. The /etc/sudoers file (edited with 'visudo') specifies which +sudo: users have access to sudo and which commands they can run. 'sudo' +sudo: logs all its activities to /var/log/ so the system administrator +sudo: can keep an eye on things. +sudo: +sudo: Homepage: https://www.sudo.ws +sudo: +sudo: diff --git a/patches/source/sudo/sudo.SlackBuild b/patches/source/sudo/sudo.SlackBuild new file mode 100755 index 000000000..8da5d9b91 --- /dev/null +++ b/patches/source/sudo/sudo.SlackBuild @@ -0,0 +1,150 @@ +#!/bin/bash + +# Copyright 2008, 2009, 2010, 2011, 2012, 2015, 2016, 2018, 2021 Patrick J. Volkerding, Sebeka, MN, USA +# All rights reserved. +# +# Redistribution and use of this script, with or without modification, is +# permitted provided that the following conditions are met: +# +# 1. Redistributions of this script must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO +# EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; +# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF +# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +cd $(dirname $0) ; CWD=$(pwd) + +PKGNAM=sudo +VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z | rev | cut -f 3- -d . | cut -f 1 -d - | rev)} +BUILD=${BUILD:-1_slack15.0} + +# Automatically determine the architecture we're building on: +if [ -z "$ARCH" ]; then + case "$( uname -m )" in + i?86) export ARCH=i586 ;; + arm*) export ARCH=arm ;; + # Unless $ARCH is already set, use uname -m for all other archs: + *) export ARCH=$( uname -m ) ;; + esac +fi + +# If the variable PRINT_PACKAGE_NAME is set, then this script will report what +# the name of the created package would be, and then exit. This information +# could be useful to other scripts. +if [ ! -z "${PRINT_PACKAGE_NAME}" ]; then + echo "$PKGNAM-$VERSION-$ARCH-$BUILD.txz" + exit 0 +fi + +NUMJOBS=${NUMJOBS:-" -j$(expr $(nproc) + 1) "} + +TMP=${TMP:-/tmp} +PKG=$TMP/package-sudo + +rm -rf $PKG +mkdir -p $TMP $PKG/var/db + +if [ "$ARCH" = "i386" ]; then + SLKCFLAGS="-O2 -march=i386 -mcpu=i686" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "i586" ]; then + SLKCFLAGS="-O2 -march=i586 -mtune=i686" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "s390" ]; then + SLKCFLAGS="-O2" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "x86_64" ]; then + SLKCFLAGS="-O2 -fPIC" + LIBDIRSUFFIX="64" +else + SLKCFLAGS="-O2" + LIBDIRSUFFIX="" +fi + +cd $TMP +rm -rf sudo-$VERSION +tar xvf $CWD/sudo-$VERSION.tar.?z || exit 1 +cd sudo-$VERSION + +chown -R root:root . +find . \ + \( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \ + -exec chmod 755 {} \+ -o \ + \( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \ + -exec chmod 644 {} \+ + +# Choose correct options depending on whether PAM is installed: +if [ -L /lib${LIBDIRSUFFIX}/libpam.so.? ]; then + PAM_OPTIONS="--enable-pam-session --with-pam=yes" + unset SHADOW_OPTIONS +else + SHADOW_OPTIONS="--disable-pam-session --with-pam=no" + unset PAM_OPTIONS +fi + +CFLAGS="$SLKCFLAGS" \ +./configure \ + --prefix=/usr \ + --sbindir=/usr/sbin \ + --mandir=/usr/man \ + --docdir=/usr/doc/sudo-$VERSION \ + --with-env-editor \ + $PAM_OPTIONS \ + $SHADOW_OPTIONS \ + --with-rundir=/run/sudo \ + --with-vardir=/var/db/sudo \ + --with-insults \ + --with-all-insults \ + --with-pc-insults \ + --build=$ARCH-slackware-linux || exit 1 + +make $NUMJOBS || make || exit 1 +make install DESTDIR=$PKG || exit 1 + +( cd $PKG/usr/bin + chmod 4711 sudo + ln -sf sudo sudoedit +) +chmod 755 $PKG/usr/sbin/visudo + +rm -f $PKG/usr/man/man8/sudoedit.8 +gzip -9 $PKG/usr/man/man?/*.? +( cd $PKG/usr/man/man8 ; ln -sf sudo.8.gz sudoedit.8.gz ) + +find $PKG | xargs file | grep -e "executable" -e "shared object" | grep ELF \ + | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null + +mv $PKG/etc/sudoers $PKG/etc/sudoers.new + +rm -r $PKG/usr/doc/sudo-$VERSION +mkdir -p $PKG/usr/doc/sudo-$VERSION +cp -a \ + INSTALL* LICENSE* NEWS* README* \ + docs/{CONTRIB*,HISTORY*,SECURITY*,TROUBLESHOOTING*,UPGRADE*} \ + $PKG/usr/doc/sudo-$VERSION +chmod 644 $PKG/usr/doc/sudo-$VERSION/* + +# If there's a ChangeLog, installing at least part of the recent history +# is useful, but don't let it get totally out of control: +if [ -r ChangeLog ]; then + DOCSDIR=$(echo $PKG/usr/doc/${PKGNAM}-$VERSION) + cat ChangeLog | head -n 1000 > $DOCSDIR/ChangeLog + touch -r ChangeLog $DOCSDIR/ChangeLog +fi + +mkdir -p $PKG/install +cat $CWD/slack-desc > $PKG/install/slack-desc +zcat $CWD/doinst.sh.gz > $PKG/install/doinst.sh + +# Build the package: +cd $PKG +/sbin/makepkg -l y -c n $TMP/sudo-$VERSION-$ARCH-$BUILD.txz + diff --git a/patches/source/sudo/sudo.url b/patches/source/sudo/sudo.url new file mode 100644 index 000000000..a80c5d324 --- /dev/null +++ b/patches/source/sudo/sudo.url @@ -0,0 +1 @@ +https://www.sudo.ws/dist |