[sudo-announce] sudo 1.9.14p2 released
Todd C. Miller
Todd.Miller at sudo.ws
Mon Jul 17 08:01:23 MDT 2023
Sudo version 1.9.14p2 is now available, which fixes two bugs
introduced in the 1.9.14 release as well as a long-standing issue
with piped output when running commands in a pseudo-terminal.
Source:
https://www.sudo.ws/dist/sudo-1.9.14p2.tar.gz
ftp://ftp.sudo.ws/pub/sudo/sudo-1.9.14p2.tar.gz
SHA256 checksum:
15f6308db0ed4265ec929f2c61e2e13492e551750c203ee001d1fcd8104c9514
MD5 checksum:
dcb3e785029193407b3216156db74dad
Binary packages:
https://www.sudo.ws/getting/packages/
https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_14p2
For a list of download mirror sites, see:
https://www.sudo.ws/getting/download_mirrors/
Sudo web site:
https://www.sudo.ws/
Major changes between sudo 1.9.14p2 and 1.9.14p1:
* Fixed a crash on Linux systems introduced in version 1.9.14 when
running a command with a NULL argv[0] if "log_subcmds" or
"intercept" is enabled in sudoers.
* Fixed a problem with "stair-stepped" output when piping or
redirecting the output of a sudo command that takes user input
when running a command in a pseudo-terminal.
* Fixed a bug introduced in sudo 1.9.14 that affects matching
sudoers rules containing a Runas_Spec with an empty Runas user.
These rules should only match when sudo's -g option is used but
were matching even without the -g option. GitHub issue #290.
Major changes between sudo 1.9.14p1 and 1.9.14:
* Fixed an "invalid free" bug in sudo_logsrvd that was introduced
in version 1.9.14 which could cause sudo_logsrvd to crash.
* The sudoers plugin no longer tries to send the terminal name
to the log server when no terminal is present. This bug was
introduced in version 1.9.14.
Major changes between sudo 1.9.14 and 1.9.13p3:
* Fixed a bug where if the "intercept" or "log_subcmds" sudoers
option was enabled and a sub-command was run where the first
entry of the argument vector didn't match the command being run.
This resulted in commands like "sudo su -" being killed due to
the mismatch. Bug #1050.
* The sudoers plugin now canonicalizes command path names before
matching (where possible). This fixes a bug where sudo could
execute the wrong path if there are multiple symbolic links with
the same target and the same base name in sudoers that a user is
allowed to run. GitHub issue #228.
* Improved command matching when a chroot is specified in sudoers.
The sudoers plugin will now change the root directory id needed
before performing command matching. Previously, the root directory
was simply prepended to the path that was being processed.
* When NETGROUP_BASE is set in the ldap.conf file, sudo will now
perform its own netgroup lookups of the host name instead of
using the system innetgr(3) function. This guarantees that user
and host netgroup lookups are performed using the same LDAP
server (or servers).
* Fixed a bug introduced in sudo 1.9.13 that resulted in a missing
" ; " separator between environment variables and the command
in log entries.
* The visudo utility now displays a warning when it ignores a file
in an include dir such as /etc/sudoers.d.
* When running a command in a pseudo-terminal, sudo will initialize
the terminal settings even if it is the background process.
Previously, sudo only initialized the pseudo-terminal when running
in the foreground. This fixes an issue where a program that
checks the window size would read the wrong value when sudo was
running in the background.
* Fixed a bug where only the first two digits of the TSID field
being was logged. Bug #1046.
* The "log_pty" sudoers option is now enabled by default. To
restore the historic behavior where a command is run in the
user's terminal, add "Defaults !use_pty" to the sudoers file.
GitHub issue #258.
* Sudo's "-b" option now works when the command is run in a
pseudo-terminal.
* When disabling core dumps, sudo now only modifies the soft limit
and leaves the hard limit as-is. This avoids problems on Linux
when sudo does not have CAP_SYS_RESOURCE, which may be the case
when run inside a container. GitHub issue #42.
* Sudo configuration file paths have been converted to colon-separated
lists of paths. This makes it possible to have configuration
files on a read-only file system while still allowing for local
modifications in a different (writable) directory. The new
--enable-adminconf configure option can be used to specify a
directory that is searched for configuration files in preference
to the sysconfdir (which is usually /etc).
* The "intercept_verify" sudoers option is now only applied when
the "intercept" option is set in sudoers. Previously, it was
also applied when "log_subcmds" was enabled.
* The NETGROUP_QUERY ldap.conf parameter can now be disabled for
LDAP servers that do not support querying the nisNetgroup object
by its nisNetgroupTriple attribute, while still allowing sudo to
query the LDAP server directly to determine netgroup membership.
* Fixed a long-standing bug where a sudoers rule without an explicit
runas list allowed the user to run a command as root and any
group instead of just one of the groups that root is a member
of. For example, a rule such as "myuser ALL = ALL" would permit
"sudo -u root -g othergroup" even if root did not belong to
"othergroup".
* Fixed a bug where a sudoers rule with an explicit runas list
allowed a user to run sudo commands as themselves. For example,
a rule such as "myuser ALL = (root) ALL", "myuser" should only
allow commands to be run as root (optionally using one of root's
groups). However, the rule also allowed the user to run
"sudo -u myuser -g myuser command".
* Fixed a bug that prevented the user from specifying a group on
the command line via "sudo -g" if the rule's Runas_Spec contained
a Runas_Alias.
* Sudo now requires a C compiler that conforms to ISO C99 or higher
to build.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://www.sudo.ws/pipermail/sudo-announce/attachments/20230717/ba4dcbce/attachment.bin>
More information about the sudo-announce
mailing list