forked from sudo-project/sudo
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathNEWS
3114 lines (2236 loc) · 125 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
What's new in Sudo 1.9.3p1
* Fixed a regression introduced in sudo 1.9.3 where the configure
script would not detect the crypt(3) function if it was present
in the C library, not an additional library.
* Fixed a regression introduced in sudo 1.8.23 with shadow passwd
file authentication on OpenBSD. BSD authentication was not
affected.
* Sudo now logs when a user-specified command-line option is
rejected by a sudoers rule. Previously, these conditions were
written to the audit log, but the default sudo log file. Affected
command line arguments include -C (--close-from), -D (--chdir),
-R (--chroot), -g (--group) and -u (--user).
What's new in Sudo 1.9.3
* sudoedit will now prompt the user before overwriting an existing
file with one that is zero-length after editing. Bug #922.
* Fixed building the Python plugin on systems with a compiler that
doesn't support symbol hiding.
* Sudo now uses a linker script to hide symbols even when the
compiler has native symbol hiding support. This should make it
easier to detect omissions in the symbol exports file, regardless
of the platform.
* Fixed the libssl dependency in Debian packages for older releases
that use libssl1.0.0.
* Sudo and visudo now provide more detailed messages when a syntax
error is detected in sudoers. The offending line and token are
now displayed. If the parser was generated by GNU bison,
additional information about what token was expected is also
displayed. Bug #841.
* Sudoers rules must now end in either a newline or the end-of-file.
Previously, it was possible to have multiple rules on a single
line, separated by white space. The use of an end-of-line
terminator makes it possible to display accurate error messages.
* Sudo no longer refuses to run if a syntax error in the sudoers
file is encountered. The entry with the syntax error will be
discarded and sudo will continue to parse the file. This makes
recovery from a syntax error less painful on systems where sudo
is the primary method of superuser access. The historic behavior
can be restored by add "error_recovery=false" to the sudoers
plugin's optional arguments in sudo.conf. Bug #618.
* Fixed the sample_approval plugin's symbol exports file for systems
where the compiler doesn't support symbol hiding.
* Fixed a regression introduced in sudo 1.9.1 where arguments to
the "sudoers_policy" plugin in sudo.conf were not being applied.
The sudoers file is now parsed by the "sudoers_audit" plugin,
which is loaded implicitly when "sudoers_policy" is listed in
sudo.conf. Starting with sudo 1.9.3, if there are plugin arguments
for "sudoers_policy" but "sudoers_audit" is not listed, those
arguments will be applied to "sudoers_audit" instead.
* The user's resource limits are now passed to sudo plugins in
the user_info[] list. A plugin cannot determine the limits
itself because sudo changes the limits while it runs to prevent
resource starvation.
* It is now possible to set the working directory or change the
root directory on a per-command basis using the CWD and CHROOT
options. CWD and CHROOT are now reserved words in sudoers--they
can no longer be used as alias names. There are also new Defaults
settings, runchroot and runcwd, that can be used to set the
working directory or root directory on a more global basis.
* New -D (--chdir) and -R (--chroot) command line options can be
used to set the working directory or root directory if the sudoers
file allows it. This functionality is not enabled by default
and must be explicitly enabled in the sudoers file.
What's new in Sudo 1.9.2
* Fixed package builds on RedHat Enterprise Linux 8.
* The configure script now uses pkg-config to find the openssl
cflags and libs where possible.
* The contents of the log.json I/O log file is now documented in
the sudoers manual.
* The sudoers plugin now properly exports the sudoers_audit symbol
on systems where the compiler lacks symbol visibility controls.
This caused a regression in 1.9.1 where a successful sudo command
was not logged due to the missing audit plugin. Bug #931.
* Fixed a regression introduced in 1.9.1 that can result in crash
when there is a syntax error in the sudoers file. Bug #934.
What's new in Sudo 1.9.1
* Fixed an AIX-specific problem when I/O logging was enabled.
The terminal device was not being properly set to raw mode.
Bug #927.
* Corrected handling of sudo_logsrvd connections without associated
I/O log data. This fixes support for RejectMessage as well as
AcceptMessage when the expect_iobufs flag is not set.
* Added an "iolog_path" entry to the JSON-format event log produced
by sudo_logsrvd. Previously, it was only possible to determine
the I/O log file an event belonged to using sudo-format logs.
* Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
* I/O log files produced by the sudoers plugin now clear the write
bits on the I/O log timing file when the log is complete. This
is consistent with how sudo_logsrvd indicates that a log is
complete.
* The sudoreplay utility has a new "-F" (follow) command line
option to allow replaying a session that is still in progress,
similar to "tail -f".
* The @include and @includedir directives can be used in sudoers
instead of #include and #includedir. In addition, include paths
may now have embedded white space by either using a double-quoted
string or escaping the space characters with a backslash.
* Fixed some Solaris 11.4 compilation errors.
* When running a command in a pty, sudo will no longer try to
suspend itself if the user's tty has been revoked (for instance
when the parent ssh daemon is killed). This fixes a bug where
sudo would continuously suspend the command (which would succeed),
then suspend itself (which would fail due to the missing tty)
and then resume the command.
* If sudo's event loop fails due to the tty being revoked, remove
the user's tty events and restart the event loop (once). This
fixes a problem when running "sudo reboot" in a pty on some
systems. When the event loop exited unexpectedly, sudo would
kill the command running in the pty, which in the case of "reboot",
could lead to the system being in a half-rebooted state.
* Fixed a regression introduced in sudo 1.8.23 in the LDAP and
SSSD back-ends where a missing sudoHost attribute was treated
as an "ALL" wildcard value. A sudoRole with no sudoHost attribute
is now ignored as it was prior to version 1.8.23.
* The audit plugin API has been changed slightly. The sudo front-end
now audits an accept event itself after all approval plugins are
run and the I/O logging plugins (if any) are opened. This makes
it possible for an audit plugin to only log a single overall
accept event if desired.
* The sudoers plugin can now be loaded as an audit plugin. Logging
of successful commands is now performed in the audit plugin's
accept function. As a result, commands are now only logged if
allowed by sudoers and all approval plugins. Commands rejected
by an approval plugin are now also logged by the sudoers plugin.
* Romanian translation for sudo and sudoers from translationproject.org.
* Fixed a regression introduced in sudo 1.9.0 where sudoedit did
not remove its temporary files after installing them. Bug #929.
* Fixed a regression introduced in sudo 1.9.0 where the iolog_file
setting in sudoers and sudo_logsrvd.conf caused an error if the
file name ended in six or more X's.
What's new in Sudo 1.9.0
* Fixed a test failure in the strsig_test regress test on FreeBSD.
* The maximum length of a conversation reply has been increased
from 255 to 1023 characters. This allows for longer user passwords.
Bug #860.
* Sudo now includes a logging daemon, sudo_logsrvd, which can be
used to implement centralized logging of I/O logs. TLS connections
are supported when sudo is configured with the --enable-openssl
option. For more information, see the sudo_logsrvd, logsrvd.conf
and sudo_logsrv.proto manuals as well as the log_servers setting
in the sudoers manual.
The --disable-log-server and --disable-log-client configure
options can be used to disable building the I/O log server and/or
remote I/O log support in the sudoers plugin.
* The new sudo_sendlog utility can be used to test sudo_logsrvd
or send existing sudo I/O logs to a centralized server.
* It is now possible to write sudo plugins in Python 3 when sudo
is configured with the --enable-python option. See the
sudo_plugin_python manual for details.
Sudo 1.9.0 comes with several Python example plugins that get
installed sudo's examples directory.
The sudo blog article "What's new in sudo 1.9: Python"
(https://blog.sudo.ws/posts/2020/01/whats-new-in-sudo-1.9-python/)
includes a simple tutorial on writing python plugins.
* Sudo now supports an "audit" plugin type. An audit plugin
receives accept, reject, exit and error messages and can be used
to implement custom logging that is independent of the underlying
security policy. Multiple audit plugins may be specified in
the sudo.conf file. A sample audit plugin is included that
writes logs in JSON format.
* Sudo now supports an "approval" plugin type. An approval plugin
is run only after the main security policy (such as sudoers) accepts
a command to be run. The approval policy may perform additional
checks, potentially interacting with the user. Multiple approval
plugins may be specified in the sudo.conf file. Only if all
approval plugins succeed will the command be allowed.
* Sudo's -S command line option now causes the sudo conversation
function to write to the standard output or standard error instead
of the terminal device.
* Fixed a bug where if a #include or #includedir directive was the
last line in sudoers and there was no final newline character, it
was silently ignored. Bug #917.
* It is now possible to use "Cmd_Alias" instead of "Cmnd_Alias" for
people who find the former more natural.
* The new "pam_ruser" and "pam_rhost" sudoers settings can be used
to enable or disable setting the PAM remote user and/or host
values during PAM session setup.
* More than one SHA-2 digest may now be specified for a single
command. Multiple digests must be separated by a comma.
* It is now possible to specify a SHA-2 digest in conjunction with
the "ALL" reserved word in a command specification. This allows
one to give permission to run any command that matches the
specified digest, regardless of its path.
* Sudo and sudo_logsrvd now create an extended I/O log info file
in JSON format that contains additional information about the
command that was run, such as the host name. The sudoreplay
utility uses this file in preference to the legacy log file.
* The sudoreplay utility can now match on a host name in list mode.
The list output also now includes the host name if one is present
in the log file.
* For "sudo -i", if the target user's home directory does not
exist, sudo will now warn about the problem but run the command
in the current working directory. Previously, this was a fatal
error. Debian bug #598519.
* The command line arguments in the SUDO_COMMAND environment
variable are now truncated at 4096 characters. This avoids an
"Argument list too long" error when executing a command with a
large number of arguments. Bug #923 (Debian bug #596631).
* Sudo now properly ends the PAM transaction when the user
authenticates successfully but sudoers denies the command.
Debian bug #669687.
* The sudoers grammar in the manual now indicates that "sudoedit"
requires one or more arguments. Debian bug #571621.
* When copying the edited files to the original path, sudoedit now
allocates any additional space needed before writing. Previously,
it could truncate the destination file if the file system was
full. Bug #922.
* Fixed an issue where PAM session modules could be called with
the wrong user name when multiple users in the passwd database
share the the same user-ID. Debian bug #734752.
* Sudo command line options that take a value may only be specified
once. This is to help guard against problems caused by poorly
written scripts that invoke sudo with user-controlled input.
Bug #924.
What's new in Sudo 1.8.31p1
* Sudo once again ignores a failure to restore the RLIMIT_CORE
resource limit, as it did prior to version 1.8.29. Linux
containers don't allow RLIMIT_CORE to be set back to RLIM_INFINITY
if we set the limit to zero, even for root, which resulted in a
warning from sudo.
What's new in Sudo 1.8.31
* Fixed CVE-2019-18634, a buffer overflow when the "pwfeedback"
sudoers option is enabled on systems with uni-directional pipes.
* The "sudoedit_checkdir" option now treats a user-owned directory
as writable, even if it does not have the write bit set at the
time of check. Symbolic links will no longer be followed by
sudoedit in any user-owned directory. Bug #912
* Fixed sudoedit on macOS 10.15 and above where the root file system
is mounted read-only. Bug #913.
* Fixed a crash introduced in sudo 1.8.30 when suspending sudo
at the password prompt. Bug #914.
* Fixed compilation on systems where the mmap MAP_ANON flag
is not available. Bug #915.
What's new in Sudo 1.8.30
* Fixed a warning on macOS introduced in sudo 1.8.29 when sudo
attempts to set the open file limit to unlimited. Bug #904.
* Sudo now closes file descriptors before changing uids. This
prevents a non-root process from interfering with sudo's ability
to close file descriptors on systems that support the prlimit(2)
system call.
* Sudo now treats an attempt to run "sudo sudoedit" as simply
"sudoedit". If the sudoers file contains a fully-qualified path
to sudoedit, sudo will now treat it simply as "sudoedit" (with
no path). Visudo will will now treat a fully-qualified path
to sudoedit as an error. Bug #871.
* Fixed a bug introduced in sudo 1.8.28 where sudo would warn about
a missing /etc/environment file on AIX and Linux when PAM is not
enabled. Bug #907
* Fixed a bug on Linux introduced in sudo 1.8.29 that prevented
the askpass program from running due to an unlimited stack size
resource limit. Bug #908.
* If a group provider plugin has optional arguments, the argument list
passed to the plugin is now NULL terminated as per the documentation.
* The user's time stamp file is now only updated if both authentication
and approval phases succeed. This is consistent with the behavior
of sudo prior to version 1.8.23. Bug #910
* The new allow_unknown_runas_id sudoers setting can be used to
enable or disable the use of unknown user or group IDs. Previously,
sudo would always allow unknown user or group IDs if the sudoers
entry permitted it, including via the "ALL" alias. As of sudo
1.8.30, the admin must explicitly enable support for unknown IDs.
* The new runas_check_shell sudoers setting can be used to require
that the runas user have a shell listed in the /etc/shells file.
On many systems, users such as "bin", do not have a valid shell
and this flag can be used to prevent commands from being run as
those users.
* Fixed a problem restoring the SELinux tty context during reboot
if mctransd is killed before sudo finishes. GitHub Issue #17.
* Fixed an intermittent warning on NetBSD when sudo restores the
initial stack size limit.
What's new in Sudo 1.8.29
* The cvtsudoers command will now reject non-LDIF input when converting
from LDIF format to sudoers or JSON formats.
* The new log_allowed and log_denied sudoers settings make it possible
to disable logging and auditing of allowed and/or denied commands.
* The umask is now handled differently on systems with PAM or login.conf.
If the umask is explicitly set in sudoers, that value is used regardless
of what PAM or login.conf may specify. However, if the umask is not
explicitly set in sudoers, PAM or login.conf may now override the default
sudoers umask. Bug #900.
* For "make install", the sudoers file is no longer checked for syntax
errors when DESTDIR is set. The default sudoers file includes the
contents of /etc/sudoers.d which may not be readable as non-root.
Bug #902.
* Sudo now sets most resource limits to their maximum value to avoid
problems caused by insufficient resources, such as an inability to
allocate memory or open files and pipes.
* Fixed a regression introduced in sudo 1.8.28 where sudo would refuse
to run if the parent process was not associated with a session.
This was due to sudo passing a session ID of -1 to the plugin.
What's new in Sudo 1.8.28p1
* The fix for Bug #869 caused "sudo -v" to prompt for a password
when "verifypw" is set to "all" (the default) and all of the
user's sudoers entries are marked with NOPASSWD. Bug #901.
What's new in Sudo 1.8.28
* Sudo will now only set PAM_TTY to the empty string when no
terminal is present on Solaris and Linux. This workaround is
only needed on those systems which may have PAM modules that
misbehave when PAM_TTY is not set.
* The mailerflags sudoers option now has a default value even if
sendmail support was disabled at configure time. Fixes a crash
when the mailerpath sudoers option is set but mailerflags is not.
Bug #878.
* Sudo will now filter out last login messages on HP-UX unless it
a shell is being run via "sudo -s" or "sudo -i". Otherwise,
when trusted mode is enabled, these messages will be displayed
for each command.
* On AIX, when the user's password has expired and PAM is not in use,
sudo will now allow the user to change their password.
Bug #883.
* Sudo has a new -B command line option that will ring the terminal
bell when prompting for a password.
* Sudo no longer refuses to prompt for a password when it cannot
determine the user's terminal as long as it can open /dev/tty.
This allows sudo to function on systems where /proc is unavailable,
such as when running in a chroot environment.
* The "env_editor" sudoers flag is now on by default. This makes
source builds more consistent with the packages generated by
sudo's mkpkg script.
* Sudo no longer ships with pre-formatted copies of the manual pages.
These were included for systems like IRIX that don't ship with an
nroff utility. There are now multiple Open Source nroff replacements
so this should no longer be an issue.
* Fixed a bad interaction with configure's --prefix and
--disable-shared options. Bug #886.
* More verbose error message when a password is required and no terminal
is present. Bug #828.
* Command tags, such as NOPASSWD, are honored when a user tries to run a
command that is allowed by sudoers but which does not actually
exist on the file system. Bug #888.
* Asturian translation for sudoers from translationproject.org.
* I/O log timing files now store signal suspend and resume information
in the form of a signal name instead of a number.
* Fixed a bug introduced in 1.8.24 that prevented sudo from honoring
the value of "ipa_hostname" from sssd.conf, if specified, when
matching the host name.
* Fixed a bug introduced in 1.8.21 that prevented the core dump
resource limit set in the pam_limits module from taking effect.
Bug #894.
* Fixed parsing of double-quoted Defaults group and netgroup bindings.
* The user ID is now used when matching sudoUser attributes in LDAP.
Previously, the user name, group name and group IDs were used
when matching but not the user ID.
* Sudo now writes PAM messages to the user's terminal, if available,
instead of the standard output or standard error. This prevents
PAM output from being intermixed with that of the command when
output is sent to a file or pipe. Bug #895.
* Sudoedit now honors the umask and umask_override settings in sudoers.
Previously, the user's umask was used as-is.
* Fixed a bug where the terminal's file context was not restored
when using SELinux RBAC. Bug #898.
* Fixed CVE-2019-14287, a bug where a sudo user may be able to
run a command as root when the Runas specification explicitly
disallows root access as long as the ALL keyword is listed first.
What's new in Sudo 1.8.27
* On HP-UX, sudo will now update the utmps file when running a command
in a pseudo-tty. Previously, only the utmp and utmpx files were
updated.
* Nanosecond precision file time stamps are now supported in HP-UX.
* Fixes and clarifications to the sudo plugin documentation.
* The sudo manuals no longer require extensive post-processing to
hide system-specific features. Conditionals in the roff source
are now used instead. This fixes corruption of the sudo manual
on systems without BSD login classes. Bug #861.
* If an I/O logging plugin is configured but the plugin does not
actually log any I/O, sudo will no longer force the command to
be run in a pseudo-tty.
* The fix for bug #843 in sudo 1.8.24 was incomplete. If the
user's password was expired or needed to be updated, but no sudo
password was required, the PAM handle was freed too early,
resulting in a failure when processing PAM session modules.
* In visudo, it is now possible to specify the path to sudoers
without using the -f option. Bug #864.
* Fixed a bug introduced in sudo 1.8.22 where the utmp (or utmpx)
file would not be updated when a command was run in a pseudo-tty.
Bug #865.
* Sudo now sets the silent flag when opening the PAM session except
when running a shell via "sudo -s" or "sudo -i". This prevents
the pam_lastlog module from printing the last login information
for each sudo command. Bug #867.
* Fixed the default AIX hard resource limit for the maximum number
of files a user may have open. If no hard limit for "nofiles"
is explicitly set in /etc/security/limits, the default should
be "unlimited". Previously, the default hard limit was 8196.
What's new in Sudo 1.8.26
* Fixed a bug in cvtsudoers when converting to JSON format when
alias expansion is enabled. Bug #853.
* Sudo no long sets the USERNAME environment variable when running
commands. This is a non-standard environment variable that was
set on some older Linux systems.
* Sudo now treats the LOGNAME and USER environment variables (as
well as the LOGIN variable on AIX) as a single unit. If one is
preserved or removed from the environment using env_keep, env_check
or env_delete, so is the other.
* Added support for OpenLDAP's TLS_REQCERT setting in ldap.conf.
* Sudo now logs when the command was suspended and resumed in the
I/O logs. This information is used by sudoreplay to skip the
time suspended when replaying the session unless the new -S flag
is used.
* Fixed documentation problems found by the igor utility. Bug #854.
* Sudo now prints a warning message when there is an error or end
of file while reading the password instead of exiting silently.
* Fixed a bug in the sudoers LDAP back-end parsing the command_timeout,
role, type, privs and limitprivs sudoOptions. This also affected
cvtsudoers conversion from LDIF to sudoers or JSON.
* Fixed a bug that prevented timeout settings in sudoers from
functioning unless a timeout was also specified on the command
line.
* Asturian translation for sudo from translationproject.org.
* When generating LDIF output, cvtsudoers can now be configured
to pad the sudoOrder increment such that the start order is used
as a prefix. Bug #856.
* Fixed a bug introduced in sudo 1.8.25 that prevented sudo from
properly setting the user's groups on AIX. Bug #857.
* If the user specifies a group via sudo's -g option that matches
any of the target user's groups, it is now allowed even if no
groups are present in the Runas_Spec. Previously, it was only
allowed if it matched the target user's primary group.
* The sudoers LDAP back-end now supports negated sudoRunAsUser and
sudoRunAsGroup entries.
* Sudo now provides a proper error message when the "fqdn" sudoers
option is set and it is unable to resolve the local host name.
Bug #859.
* Portuguese translation for sudo and sudoers from translationproject.org.
* Sudo now includes sudoers LDAP schema for the on-line configuration
supported by OpenLDAP.
What's new in Sudo 1.8.25p1
* Fixed a bug introduced in sudo 1.8.25 that caused a crash on
systems that have the poll() function but not the ppoll() function.
Bug #851.
What's new in Sudo 1.8.25
* Fixed a bug introduced in sudo 1.8.20 that broke formatting of
I/O log timing file entries on systems without a C99-compatible
snprintf() function. Our replacement snprintf() doesn't support
floating point so we can't use the "%f" format directive.
* I/O log timing file entries now use a monotonic timer and include
nanosecond precision. A monotonic timer that does not increment
while the system is sleeping is used where available.
* Fixed a bug introduced in sudo 1.8.24 where sudoNotAfter in the LDAP
back-end was not being properly parsed. Bug #845.
* When sudo runs a command in a pseudo-terminal, the follower
device is now closed in the main process immediately after
starting the monitor process. This removes the need for an
AIX-specific workaround that was added in sudo 1.8.24.
* Added support for monotonic timers on HP-UX.
* Fixed a bug displaying timeout values the "sudo -V" output.
The value displayed was 3600 times the actual value. Bug #846.
* Fixed a build issue on AIX 7.1 BOS levels that include memset_s()
and define rsize_t in string.h. Bug #847.
* The testsudoers utility now supports querying an LDIF-format
policy.
* Sudo now sets the LOGIN environment variable to the same value as
LOGNAME on AIX systems. Bug #848.
* Fixed a regression introduced in sudo 1.8.24 where the LDAP and
SSSD back-ends evaluated the rules in reverse sudoOrder. Bug #849.
What's new in Sudo 1.8.24
* The LDAP and SSS back-ends now use the same rule evaluation code
as the sudoers file back-end. This builds on the work in sudo
1.8.23 where the formatting functions for "sudo -l" output were
shared. The handling of negated commands in SSS and LDAP is
unchanged.
* Fixed a regression introduced in 1.8.23 where "sudo -i" could
not be used in conjunction with --preserve-env=VARIABLE. Bug #835.
* cvtsudoers can now parse base64-encoded attributes in LDIF files.
* Random insults are now more random.
* Fixed the noexec wordexp(3) test on FreeBSD.
* Added SUDO_CONV_PREFER_TTY flag for conversation function to
tell sudo to try writing to /dev/tty first. Can be used in
conjunction with SUDO_CONV_INFO_MSG and SUDO_CONV_ERROR_MSG.
* Sudo now supports an arbitrary number of groups per user on
Solaris. Previously, only the first 64 groups were found.
This should remove the need to set "max_groups" in sudo.conf.
* Fixed typos in the OpenLDAP sudo schema. Bugs #839 and #840.
* Fixed a race condition when building with parallel make.
Bug #842.
* Fixed a duplicate free when netgroup_base in ldap.conf is set
to an invalid value.
* Fixed a bug introduced in sudo 1.8.23 on AIX that could prevent
local users and groups from being resolved properly on systems
that have users stored in NIS, LDAP or AD.
* Added a workaround for an AIX bug exposed by a change in sudo
1.8.23 that prevents the terminal mode from being restored when
I/O logging is enabled.
* On systems using PAM, sudo now ignores the PAM_NEW_AUTHTOK_REQD
and PAM_AUTHTOK_EXPIRED errors from PAM account management if
authentication is disabled for the user. This fixes a regression
introduced in sudo 1.8.23. Bug #843.
* Fixed an ambiguity in the sudoers manual in the description and
definition of User, Runas, Host, and Cmnd Aliases. Bug #834.
* Fixed a bug that resulted in only the first window size change
event being logged.
* Fixed a bug on HP-UX systems introduced in sudo 1.8.22 that
caused sudo to prompt for a password every time when tty-based
time stamp files were in use.
* Fixed a compilation problem on systems that define O_PATH or
O_SEARCH in fnctl.h but do not define O_DIRECTORY. Bug #844.
What's new in Sudo 1.8.23
* PAM account management modules and BSD auth approval modules are
now run even when no password is required.
* For kernel-based time stamps, if no terminal is present, fall
back to parent-pid style time stamps.
* The new cvtsudoers utility replaces both the "sudoers2ldif" script
and the "visudo -x" functionality. It can read a file in either
sudoers or LDIF format and produce JSON, LDIF or sudoers output.
It is also possible to filter the generated output file by user,
group or host name.
* The file, ldap and sss sudoers back-ends now share a common set
of formatting functions for "sudo -l" output, which is also used
by the cvtsudoers utility.
* The /run directory is now used in preference to /var/run if it
exists. Bug #822.
* More accurate descriptions of the --with-rundir and --with-vardir
configure options. Bug #823.
* The setpassent() and setgroupent() functions are now used on systems
that support them to keep the passwd and group database open.
Sudo performs a lot of passwd and group lookups so it can be
beneficial to avoid opening and closing the files each time.
* The new case_insensitive_user and case_insensitive_group sudoers
options can be used to control whether sudo does case-sensitive
matching of users and groups in sudoers. Case insensitive
matching is now the default.
* Fixed a bug on some systems where sudo could hang on command
exit when I/O logging was enabled. Bug #826.
* Fixed the build-time process start time test on Linux when the
test is run from within a container. Bug #829.
* When determining which temporary directory to use, sudoedit now
checks the directory for writability before using it. Previously,
sudoedit only performed an existence check. Bug #827.
* Sudo now includes an optional set of Monty Python-inspired insults.
* Fixed the execution of scripts with an associated digest (checksum)
in sudoers on FreeBSD systems. FreeBSD does not have a proper
/dev/fd directory mounted by default and its fexecve(2) is not
fully POSIX compliant when executing scripts. Bug #831.
* Chinese (Taiwan) translation for sudo from translationproject.org.
What's new in Sudo 1.8.22
* Commands run in the background from a script run via sudo will
no longer receive SIGHUP when the parent exits and I/O logging
is enabled. Bug #502
* A particularly offensive insult is now disabled by default.
Bug #804
* The description of "sudo -i" now correctly documents that
the "env_keep" and "env_check" sudoers options are applied to
the environment. Bug #806
* Fixed a crash when the system's host name is not set.
Bug #807
* The sudoers2ldif script now handles #include and #includedir
directives.
* Fixed a bug where sudo would silently exit when the command was
not allowed by sudoers and the "passwd_tries" sudoers option
was set to a value less than one.
* Fixed a bug with the "listpw" and "verifypw" sudoers options and
multiple sudoers sources. If the option is set to "all", a
password should be required unless none of a user's sudoers
entries from any source require authentication.
* Fixed a bug with the "listpw" and "verifypw" sudoers options in
the LDAP and SSSD back-ends. If the option is set to "any", and
the entry contained multiple rules, only the first matching rule
was checked. If an entry contained more than one matching rule
and the first rule required authentication but a subsequent rule
did not, sudo would prompt for a password when it should not have.
* When running a command as the invoking user (not root), sudo
would execute the command with the same group vector it was
started with. Sudo now executes the command with a new group
vector based on the group database which is consistent with
how su(1) operates.
* Fixed a double free in the SSSD back-end that could occur when
ipa_hostname is present in sssd.conf and is set to an unqualified
host name.
* When I/O logging is enabled, sudo will now write to the terminal
even when it is a background process. Previously, sudo would
only write to the tty when it was the foreground process when
I/O logging was enabled. If the TOSTOP terminal flag is set,
sudo will suspend the command (and then itself) with the SIGTTOU
signal.
* A new "authfail_message" sudoers option that overrides the
default "N incorrect password attempt(s)".
* An empty sudoRunAsUser attribute in the LDAP and SSSD back-ends
will now match the invoking user. This is more consistent with
how an empty runas user in the sudoers file is treated.
* Documented that in check mode, visudo does not check the owner/mode
on files specified with the -f flag. Bug #809.
* It is now an error to specify the runas user as an empty string
on the command line. Previously, an empty runas user was treated
the same as an unspecified runas user. Bug #817.
* When "timestamp_type" option is set to "tty" and a terminal is
present, the time stamp record will now include the start time
of the session leader. When the "timestamp_type" option is set
to "ppid" or when no terminal is available, the start time of
the parent process is used instead. This significantly reduces
the likelihood of a time stamp record being re-used when a user
logs out and back in again. Bug #818.
* The sudoers time stamp file format is now documented in the new
sudoers_timestamp manual.
* The "timestamp_type" option now takes a "kernel" value on OpenBSD
systems. This causes the tty-based time stamp to be stored in
the kernel instead of on the file system. If no tty is present,
the time stamp is considered to be invalid.
* Visudo will now use the SUDO_EDITOR environment variable (if
present) in addition to VISUAL and EDITOR.
What's new in Sudo 1.8.21p2
* Fixed a bug introduced in version 1.8.21 which prevented sudo
from using the PAM-supplied prompt. Bug #799
* Fixed a bug introduced in version 1.8.21 which could result in
sudo hanging when running commands that exit quickly. Bug #800
* Fixed a bug introduced in version 1.8.21 which prevented the
command from being run when the password was read via an external
program using the askpass interface. Bug #801
What's new in Sudo 1.8.21p1
* On systems that support both PAM and SIGINFO, the main sudo
process will no longer forward SIGINFO to the command if the
signal was generated from the keyboard. The command will have
already received SIGINFO since it is part of the same process
group so there's no need for sudo to forward it. This is
consistent with the handling of SIGINT, SIGQUIT and SIGTSTP.
Bug #796
* If SUDOERS_SEARCH_FILTER in ldap.conf does not specify a value,
the LDAP search expression used when looking up netgroups and
non-Unix groups had a syntax error if a group plugin was not
specified.
* "sudo -U otheruser -l" will now have an exit value of 0 even
if "otheruser" has no sudo privileges. The exit value when a
user attempts to lists their own privileges or when a command
is specified is unchanged.
* Fixed a regression introduced in sudo 1.8.21 where sudoreplay
playback would hang for I/O logs that contain terminal input.
* Sudo 1.8.18 contained an incomplete fix for the matching of
entries in the LDAP and SSSD back-ends when a sudoRunAsGroup is
specified but no sudoRunAsUser is present in the sudoRole.
What's new in Sudo 1.8.21
* The path that sudo uses to search for terminal devices can now
be configured via the new "devsearch" Path setting in sudo.conf.
* It is now possible to preserve bash shell functions in the
environment when the "env_reset" sudoers setting is disabled by
removing the "*=()*" pattern from the env_delete list.
* A change made in sudo 1.8.15 inadvertently caused sudoedit to
send itself SIGHUP instead of exiting when the editor returns
an error or the file was not modified.
* Sudoedit now uses an exit code of zero if the file was not
actually modified. Previously, sudoedit treated a lack of
modifications as an error.
* When running a command in a pseudo-tty (pty), sudo now copies a
subset of the terminal flags to the new pty. Previously, all
flags were copied, even those not appropriate for a pty.
* Fixed a problem with debug logging in the sudoers I/O logging
plugin.
* Window size change events are now logged to the policy plugin.
On xterm and compatible terminals, sudoreplay is now capable of
resizing the terminal to match the size of the terminal the
command was run on. The new -R option can be used to disable
terminal resizing.
* Fixed a bug in visudo where a newly added file was not checked
for syntax errors. Bug #791.
* Fixed a bug in visudo where if a syntax error in an include
directory (like /etc/sudoers.d) was detected, the edited version
was left as a temporary file instead of being installed.
* On PAM systems, sudo will now treat "username's Password:" as
a standard password prompt. As a result, the SUDO_PROMPT
environment variable will now override "username's Password:"
as well as the more common "Password:". Previously, the
"passprompt_override" Defaults setting would need to be set for
SUDO_PROMPT to override a prompt of "username's Password:".
* A new "syslog_pid" sudoers setting has been added to include
sudo's process ID along with the process name when logging via
syslog. Bug #792.
* Fixed a bug introduced in sudo 1.8.18 where a command would
not be terminated when the I/O logging plugin returned an error
to the sudo front-end.
* A new "timestamp_type" sudoers setting has been added that replaces
the "tty_tickets" option. In addition to tty and global time stamp
records, it is now possible to use the parent process ID to restrict
the time stamp to commands run by the same process, usually the shell.
Bug #793.
* The --preserve-env command line option has been extended to accept
a comma-separated list of environment variables to preserve.
Bug #279.
* Friulian translation for sudo from translationproject.org.
What's new in Sudo 1.8.20p2
* Fixed a bug parsing /proc/pid/stat on Linux when the process
name contains newlines. This is not exploitable due to the /dev
traversal changes in sudo 1.8.20p1.
What's new in Sudo 1.8.20p1
* Fixed "make check" when using OpenSSL or GNU crypt.
Bug #787.
* Fixed CVE-2017-1000367, a bug parsing /proc/pid/stat on Linux
when the process name contains spaces. Since the user has control
over the command name, this could potentially be used by a user
with sudo access to overwrite an arbitrary file on systems with
SELinux enabled. Also stop performing a breadth-first traversal
of /dev when looking for the device; only a hard-coded list of
directories are checked,
What's new in Sudo 1.8.20
* Added support for SASL_MECH in ldap.conf. Bug #764
* Added support for digest matching when the command is a glob-style
pattern or a directory. Previously, only explicit path matches
supported digest checks.
* New "fdexec" Defaults option to control whether a command
is executed by path or by open file descriptor.
* The embedded copy of zlib has been upgraded to version 1.2.11.
* Fixed a bug that prevented sudoers include files with a relative
path starting with the letter 'i' from being opened. Bug #776.
* Added support for command timeouts in sudoers. The command will
be terminated if the timeout expires.
* The SELinux role and type are now displayed in the "sudo -l"
output for the LDAP and SSSD back-ends, just as they are in the
sudoers back-end.
* A new command line option, -T, can be used to specify a command
timeout as long as the user-specified timeout is not longer than
the timeout specified in sudoers. This option may only be
used when the "user_command_timeouts" flag is enabled in sudoers.
* Added NOTBEFORE and NOTAFTER command options to the sudoers
back-end similar to what is already available in the LDAP back-end.
* Sudo can now optionally use the SHA2 functions in OpenSSL or GNU
crypt instead of the SHA2 implementation bundled with sudo.
* Fixed a compilation error on systems without the stdbool.h header
file. Bug #778.
* Fixed a compilation error in the standalone Kerberos V authentication
module. Bug #777.
* Added the iolog_flush flag to sudoers which causes I/O log data
to be written immediately to disk instead of being buffered.
* I/O log files are now created with group ID 0 by default unless
the "iolog_user" or "iolog_group" options are set in sudoers.
* It is now possible to store I/O log files on an NFS-mounted
file system where uid 0 is remapped to an unprivileged user.
The "iolog_user" option must be set to a non-root user and the
top-level I/O log directory must exist and be owned by that user.
* Added the restricted_env_file setting to sudoers which is similar
to env_file but its contents are subject to the same restrictions
as variables in the invoking user's environment.
* Fixed a use after free bug in the SSSD back-end when the fqdn
sudoOption is enabled and no hostname value is present in
/etc/sssd/sssd.conf.
* Fixed a typo that resulted in a compilation error on systems
where the killpg() function is not found by configure.
* Fixed a compilation error with the included version of zlib
when sudo was built outside the source tree.
* Fixed the exit value of sudo when the command is terminated by
a signal other than SIGINT. This was broken in sudo 1.8.15 by
the fix for Bug #722. Bug #784.