openSUSE Build Service

Overview Repositories Revisions Requests Users Attributes Meta

File sudo.spec of Package sudo

#
# spec file for package sudo
#
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via http://bugs.opensuse.org/
#

Name:           sudo
Version:        1.8.27
Release:        0
Summary:        Execute some commands as root
License:        ISC
Group:          System/Base
Url:            https://www.sudo.ws/
Source0:        https://sudo.ws/sudo/dist/%{name}-%{version}.tar.gz
Source1:        https://sudo.ws/sudo/dist/%{name}-%{version}.tar.gz.sig
Source2:        %{name}.keyring
Source3:        sudo.pamd
Source4:        sudo-i.pamd
Source5:        README.SUSE
Source6:        fate_313276_test.sh
Source7:        README_313276.test
# PATCH-OPENSUSE: the "SUSE" branding of the default sudo config
Patch1:         sudo-sudoers.patch
Patch2:         sudo-CVE-2019-14287.patch
Patch3:         sudo-1.8.22-CVE-2019-18634.patch
Patch4:         sudo-1.8.22-fix_listpw.patch
Patch5:         sudo-1.8.22-pam_xauth.patch
Patch6:         sudo-CVE-2021-23239.patch
Patch7:         sudo-CVE-2021-23240.patch
Patch8:         sudo-fix-bsc-1180687.patch
Patch9:         sudo-CVE-2021-3156.patch
Patch10:        sudo-1.8.27-ipa_hostname.patch
Patch11:        sudo-1.8.27-ldap-respect-SUDOERS_TIMED.patch
Patch12:        feature-not-user-ldap.patch
Patch13:        feature-upstream-restrict-sudo-U-other-l.patch
Patch14:        sudo-1-8-27-bsc1201462-ignore-no-sudohost.patch
Patch15:        sudo-CVE-2022-43995.patch
Patch16:        sudo-observe-SIGCHLD.patch
Patch17:        sudo-utf8-ldap-schema.patch
Patch18:        sudo-CVE-2023-22809.patch
Patch19:        sudo-fix_NULL_deref_RunAs.patch
Patch20:        sudo-dont-enable-read-after-pty_finish.patch
# PATCH-FIX-UPSTREAM bsc#1209361 bsc#1209362 CVE-2023-28486 CVE-2023-28487
Patch21:        sudo-CVE-2023-28486.patch
# PATCH-FIX-UPSTREAM bsc#1219026 CVE-2023-42465 row hammer attacks hardening
Patch22:        sudo-CVE-2023-42465-1of2.patch
Patch23:        sudo-CVE-2023-42465-2of2.patch
BuildRequires:  audit-devel
BuildRequires:  cyrus-sasl-devel
BuildRequires:  groff
BuildRequires:  libselinux-devel
BuildRequires:  openldap2-devel
BuildRequires:  pam-devel
BuildRequires:  systemd-rpm-macros
BuildRequires:  zlib-devel
Requires(pre):  coreutils
Requires(pre):  permissions

%description
Sudo is a command that allows users to execute some commands as root.
The %{_sysconfdir}/sudoers file (edited with 'visudo') specifies which users have
access to sudo and which commands they can run. Sudo logs all its
activities to syslogd, so the system administrator can keep an eye on
things. Sudo asks for the password for initializing a check period of a
given time N (where N is defined at installation and is set to 5
minutes by default).

%package devel
Summary:        Header files needed for sudo plugin development
Group:          Development/Libraries/C and C++
Requires:       %{name} = %{version}

%description devel
These header files are needed for building of sudo plugins.

%package test
Summary:        Tests for the package
Group:          Development/Tools/Other
Requires:       %{name} = %{version}

%description test
Tests for fate#313276

%prep
%setup -q
%autopatch -p1

%build
%ifarch s390 s390x %{sparc}
F_PIE=-fPIE
%else
F_PIE=-fpie
%endif
export CFLAGS="%{optflags} -Wall $F_PIE -DLDAP_DEPRECATED"
export LDFLAGS="-pie"
%configure \
    --libexecdir=%{_libexecdir}/sudo \
    --docdir=%{_docdir}/%{name} \
    --with-noexec=%{_libexecdir}/sudo/sudo_noexec.so \
    --enable-tmpfiles.d=%{_tmpfilesdir} \
    --with-pam \
    --with-pam-login \
    --with-ldap \
    --with-selinux \
    --with-linux-audit \
    --with-logfac=auth \
    --with-all-insults \
    --with-ignore-dot \
    --with-tty-tickets \
    --enable-shell-sets-home \
    --enable-warnings \
    --with-sendmail=%{_sbindir}/sendmail \
    --with-sudoers-mode=0440 \
    --with-env-editor \
    --without-secure-path \
    --with-passprompt="[sudo] password for %%p: " \
    --with-rundir=%{_localstatedir}/lib/sudo \
    --with-sssd
make %{?_smp_mflags}

%check
make check

%install
%make_install install_uid=`id -u` install_gid=`id -g`
install -d -m 755 %{buildroot}%{_sysconfdir}/pam.d
install -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/pam.d/sudo
install -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/pam.d/sudo-i
rm -f %{buildroot}%{_bindir}/sudoedit
ln -sf %{_bindir}/sudo %{buildroot}%{_bindir}/sudoedit
install -d -m 755 %{buildroot}%{_sysconfdir}/openldap/schema
install -m 644 doc/schema.OpenLDAP %{buildroot}%{_sysconfdir}/openldap/schema/sudo.schema
install -m 644 %{SOURCE5} %{buildroot}%{_docdir}/%{name}/
rm -f %{buildroot}%{_docdir}/%{name}/sample.pam
rm -f %{buildroot}%{_docdir}/%{name}/sample.syslog.conf
rm -f %{buildroot}%{_docdir}/%{name}/schema.OpenLDAP
rm -f %{buildroot}%{_sysconfdir}/sudoers.dist

%find_lang %{name}
%find_lang sudoers
cat sudoers.lang >> %{name}.lang
# tests
install -d -m 755 %{buildroot}%{_localstatedir}/lib/tests/sudo
install -m 755 %{SOURCE6} %{buildroot}%{_localstatedir}/lib/tests/sudo
install -m 755 %{SOURCE7} %{buildroot}%{_localstatedir}/lib/tests/sudo
install -d %{buildroot}%{_docdir}/%{name}-test
install -m 644 %{buildroot}%{_docdir}/%{name}/LICENSE %{buildroot}%{_docdir}/%{name}-test/LICENSE
rm -fv %{buildroot}%{_docdir}/%{name}/LICENSE

%post
chmod 0440 %{_sysconfdir}/sudoers
%if 0%{?suse_version} <= 1130
%run_permissions
%else
%set_permissions %{_bindir}/sudo
%endif
%tmpfiles_create %{_tmpfilesdir}/sudo.conf

%verifyscript
%verify_permissions -e %{_bindir}/sudo

%files -f %{name}.lang
%license doc/LICENSE
%doc %{_docdir}/%{name}
%{_mandir}/man1/cvtsudoers.1%{ext_man}
%{_mandir}/man5/sudoers.5%{ext_man}
%{_mandir}/man5/sudo.conf.5%{ext_man}
%{_mandir}/man5/sudoers.ldap.5%{ext_man}
%{_mandir}/man5/sudoers_timestamp.5%{ext_man}
%{_mandir}/man8/sudo.8%{ext_man}
%{_mandir}/man8/sudoedit.8%{ext_man}
%{_mandir}/man8/sudoreplay.8%{ext_man}
%{_mandir}/man8/visudo.8%{ext_man}

%config(noreplace) %attr(0440,root,root) %{_sysconfdir}/sudoers
%dir %{_sysconfdir}/sudoers.d
%config(noreplace) %{_sysconfdir}/pam.d/sudo
%config(noreplace) %{_sysconfdir}/pam.d/sudo-i
%attr(4755,root,root) %{_bindir}/sudo
%dir %{_sysconfdir}/openldap
%dir %{_sysconfdir}/openldap/schema
%attr(0444,root,root) %config %{_sysconfdir}/openldap/schema/sudo.schema
%{_bindir}/sudoedit
%{_bindir}/sudoreplay
%{_bindir}/cvtsudoers
%{_sbindir}/visudo
%dir %{_libexecdir}/%{name}
%{_libexecdir}/%{name}/sesh
%{_libexecdir}/%{name}/sudo_noexec.so
%{_libexecdir}/%{name}/sudoers.so
%{_libexecdir}/%{name}/group_file.so
%{_libexecdir}/%{name}/system_group.so
%{_libexecdir}/%{name}/libsudo_util.so.*
%attr(0711,root,root) %dir %ghost %{_localstatedir}/lib/%{name}
%attr(0700,root,root) %dir %ghost %{_localstatedir}/lib/%{name}/ts
%dir %{_tmpfilesdir}
%{_tmpfilesdir}/sudo.conf

%files devel
%doc plugins/sample/sample_plugin.c
%{_includedir}/sudo_plugin.h
%{_mandir}/man8/sudo_plugin.8*
%attr(0644,root,root) %{_libexecdir}/%{name}/libsudo_util.so
%{_libexecdir}/%{name}/*.la

%files test
%{_localstatedir}/lib/tests
%{_docdir}/%{name}-test/

%changelog

Places

File sudo.spec of Package sudo

Places