From Todd.Miller at courtesan.com Fri Jun 12 09:32:01 2009 From: Todd.Miller at courtesan.com (Todd C. Miller) Date: Fri, 12 Jun 2009 09:32:01 -0400 Subject: [sudo-workers] sudo 1.7.2b1 available Message-ID: <200906121332.n5CDW1Mh023543@core.courtesan.com> The first beta version of sudo 1.7.2 is now available. Download links: http://www.sudo.ws/sudo/dist/beta/sudo-1.7.2b1.tar.gz ftp://ftp.sudo.ws/pub/sudo/beta/sudo-1.7.2b1.tar.gz Major changes between sudo 1.7.1 and 1.7.2b1: * A new #includedir directive is available in sudoers. This can be used to implement an /etc/sudo.d directory. Files in an includedir are not edited by visudo unless they contain a syntax error. * A setenv() compatibility fix for Linux systems, where a NULL value is treated the same as an empty string. * When doing password and group database lookups, sudo will only cache an entry by name or by id, depending on how the entry was looked up. Previously, sudo would cache by both name and id from a single lookup, but this breaks sites that have multiple password or group database names that map to the same uid or gid. * The -g option did not work properly when only setting the group (and not the user). Also, in -l mode the wrong user was displayed for sudoers entries where only the group was allowed to be set. * BSM audit fixes when changing to a non-root uid. * User and group names in sudoers may now be enclosed in double quotes to avoid having to escape special characters. * Experimental non-Unix group support. Currently only works with Quest Authorization Services and allows Active Directory groups to be specified in sudoers. * Portability fixes for Minix-3. * For Netscape/Mozilla-derived LDAP SDKs the certificate and key paths may be specified as a directory or a file. However, version 5.0 of the SDK only appears to support using a directory (despite documentation to the contrary). If SSL client initialization fails and the certificate or key paths look like they could be default file name, strip off the last path element and try again. From Todd.Miller at courtesan.com Sun Jun 21 17:29:30 2009 From: Todd.Miller at courtesan.com (Todd C. Miller) Date: Sun, 21 Jun 2009 17:29:30 -0400 Subject: [sudo-workers] sudo 1.7.2b1 available Message-ID: <200906212129.n5LLTUmi008239@core.courtesan.com> The seond beta version of sudo 1.7.2 is now available. Unless a major problem is found the first release candidate should be out in a week. Download links: http://www.sudo.ws/sudo/dist/beta/sudo-1.7.2b2.tar.gz ftp://ftp.sudo.ws/pub/sudo/beta/sudo-1.7.2b2.tar.gz Major changes between sudo 1.7.2b1 and 1.7.2b2: * Fixed a problem with certain PAM modules that call setenv() with a NULL variable name. * Better documentation for non-Unix group support. From dkopecek at redhat.com Mon Jun 22 09:44:11 2009 From: dkopecek at redhat.com (Daniel Kopecek) Date: Mon, 22 Jun 2009 09:44:11 -0400 (EDT) Subject: [sudo-workers] Bug in configure.in? In-Reply-To: <202051673.347161245678113583.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com> Message-ID: <621130971.347481245678251697.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com> Hi, during investigating why LDAP auth stopped working after an upgrade from 1.6.9 to 1.7.1 I've noticed that ./configure says: ... checking for sasl/sasl.h... yes checking for ldap_sasl_interactive_bind_s... yes ./configure: line 24121: ,: command not found checking sasl.h usability... no checking sasl.h presence... no ... The actual code in ./configure looks like this: ... 24119 fi 24120 done 24121 , break 24122 fi 24123 24124 done ... And here is the macro from configure.in that generates the above code: AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], [AC_CHECK_FUNCS(ldap_sasl_interactive_bind_s), [break]]) This looks strange to me but maybe there some magic behind it..?:] Changing it to: AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], [AC_CHECK_FUNCS(ldap_sasl_interactive_bind_s)], [break]) ...solves the problem ("command not found" disappears). However, I don't think that this is the cause of sudo+LDAP not working and I'll have to check our patches before searching for a bug in sudo. Dan From Todd.Miller at courtesan.com Mon Jun 22 09:49:05 2009 From: Todd.Miller at courtesan.com (Todd C. Miller) Date: Mon, 22 Jun 2009 09:49:05 -0400 Subject: [sudo-workers] Bug in configure.in? In-Reply-To: Your message of "Mon, 22 Jun 2009 09:44:11 EDT." <621130971.347481245678251697.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com> References: <621130971.347481245678251697.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com> Message-ID: <200906221349.n5MDn5II021479@core.courtesan.com> In message <621130971.347481245678251697.JavaMail.root at zmail07.collab.prod.int. phx2.redhat.com> so spake Daniel Kopecek (dkopecek): > And here is the macro from configure.in that generates the above code: > > AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], [AC_CHECK_FUNCS(ldap_sasl_interactiv > e_bind_s), [break]]) > > This looks strange to me but maybe there some magic behind it..?:] > Changing it to: > > AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], [AC_CHECK_FUNCS(ldap_sasl_interactiv > e_bind_s)], [break]) > > ...solves the problem ("command not found" disappears). Yes, that is correct, it was a misplaced bracket. This is already fixed in the sudo cvs repo. - todd From dkopecek at redhat.com Mon Jun 22 10:50:19 2009 From: dkopecek at redhat.com (Daniel Kopecek) Date: Mon, 22 Jun 2009 10:50:19 -0400 (EDT) Subject: [sudo-workers] Bug in configure.in? In-Reply-To: <1725628744.354771245682186877.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com> Message-ID: <371615298.354811245682219509.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com> ----- "Todd C. Miller" wrote: > In message > <621130971.347481245678251697.JavaMail.root at zmail07.collab.prod.int. > phx2.redhat.com> > so spake Daniel Kopecek (dkopecek): > > > And here is the macro from configure.in that generates the above > code: > > > > AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], > [AC_CHECK_FUNCS(ldap_sasl_interactiv > > e_bind_s), [break]]) > > > > This looks strange to me but maybe there some magic behind it..?:] > > Changing it to: > > > > AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], > [AC_CHECK_FUNCS(ldap_sasl_interactiv > > e_bind_s)], [break]) > > > > ...solves the problem ("command not found" disappears). > > Yes, that is correct, it was a misplaced bracket. This is already > fixed in the sudo cvs repo. > > - todd Thanks and sorry for the noise. Dan From Todd.Miller at courtesan.com Tue Jun 23 15:21:06 2009 From: Todd.Miller at courtesan.com (Todd C. Miller) Date: Tue, 23 Jun 2009 15:21:06 -0400 Subject: [sudo-workers] sudo 1.7.2b3 available Message-ID: <200906231921.n5NJL6DF017916@core.courtesan.com> The third beta release of sudo 1.7.2 is now available. Unless a major problem is found the first release candidate will be out early next week. Download links: http://www.sudo.ws/sudo/dist/beta/sudo-1.7.2b3.tar.gz ftp://ftp.sudo.ws/pub/sudo/beta/sudo-1.7.2b3.tar.gz Major changes between sudo 1.7.2b2 and 1.7.2b3: * Sudo will now correctly parse the shell-style /etc/environment file format used by pam_env on Linux. From Todd.Miller at courtesan.com Mon Jun 29 10:35:01 2009 From: Todd.Miller at courtesan.com (Todd C. Miller) Date: Mon, 29 Jun 2009 10:35:01 -0400 Subject: [sudo-workers] sudo 1.7.2rc1 available Message-ID: <200906291435.n5TEZ1aI027805@core.courtesan.com> The first release candidate of sudo 1.7.2 is now available. Unless a major problem is found, the GA of 1.7.2 will be out next Monday. Download links: http://www.sudo.ws/sudo/dist/beta/sudo-1.7.2rc1.tar.gz ftp://ftp.sudo.ws/pub/sudo/beta/sudo-1.7.2rc1.tar.gz Major changes between sudo 1.7.2b3 and 1.7.2rc1: * Fixed a problem with the alias checking in visudo which could prevent visudo from exiting.