Update multilib patch for sudo.conf that there is one more replacement
of @plugindir@ to avoid installation conflict.
(From OE-Core rev: e1afed1569bc076a1823e997137884172acc7123)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Make the license more accurate by specifying the specific variant of BSD
license instead of the generic one. This helps with SPDX license
attribution as "BSD" is not a valid SPDX license.
(From OE-Core rev: ff27ea21d7c14086335da5c3e2fac353e44438da)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the result of automated script conversion:
scripts/contrib/convert-overrides.py <oe-core directory>
converting the metadata to use ":" as the override character instead of "_".
(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE_VERSION_SUFFIX in "patch" to treat version string with suffix "pX"
or "patchX" as patched release.
also update testcases to cover this changes and set CVE_VERSION_SUFFIX
for sudo.
(From OE-Core rev: 8076815fc2ffc8f632e73527ce2b7d158a29e9ea)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Package just sudo binary into its own package for size concerned
targets.
(From OE-Core rev: 788c95c3bb8ede0d3d6a8f125743ac47c0b3f00e)
Signed-off-by: Sinan Kaya <okaya@kernel.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It fails to install sudo and lib32-sudo at same time:
| Error: Transaction test error:
| file /usr/libexec/sudo/audit_json.so conflicts between attempted
installs of lib32-sudo-1.9.3p1-r0.core2_32 and sudo-1.9.3p1-r0.core2_64
| file /usr/libexec/sudo/group_file.so conflicts between attempted
installs of lib32-sudo-1.9.3p1-r0.core2_32 and sudo-1.9.3p1-r0.core2_64
Pass ${libdir} to configure option --libexecdir of sudo that it installs
plugin libraries to /usr/lib{,64} rather than /usr/libexec/. Then add a
patch to fix multilib conflict of sudo.conf.
[RP: Add missing Upstream-Status]
(From OE-Core rev: c9b6974cfcac370c6848d28400e0546ac85512e9)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Set with-rundir to a known path instead of letting configure decide
which is the best folder to store the timestamp files. This is required
otherwise it might end up at /sudo, which will cause errors on a ro
filesystem.
(From OE-Core rev: 22ae707afa69d1d0a0496a6dc25a400a9c4404d9)
Signed-off-by: Ricardo Salveti <ricardo@foundries.io>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop the patch as it is merged upstream.
(From OE-Core rev: 000577afd815fa8399c595d1aef81f4327204327)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-License-Update: Copyright year updated from 1998-2019 to 1998-2020.
(From OE-Core rev: 19711adc45cf57fc007a7d1e052726fd45157f98)
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
sudo uses AC_PATH_PROG to find target paths, which means at best
potential host-contamination (and reproducible issues) and at worst it
thinks sh is at /your/build/path/hosttools/sh.
Solve this by explicitly passing the correct paths to configure.
(From OE-Core rev: 61650dd8498a093f3bfa93202c9cd2e9a7fb7834)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Without setting this it will vary depending on which directories are present
on the host.
[YOCTO #13775]
(From OE-Core rev: 39fe849b56d70689846262c31ab7c182c8443923)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer
account can bypass certain policy blacklists and session PAM modules,
and can cause incorrect logging, by invoking sudo with a crafted user
ID. For example, this allows bypass of !root configuration, and USER=
logging, for a "sudo -u \#$((0xffffffff))" command.
(From OE-Core rev: 4e11cd561f2bdaa6807cf02ee7c9870881826308)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
BSD license files must include the copyright notice.
(From OE-Core rev: f5cfcaa79fd3a2cfd9299f2c8e7686b502e52551)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The old URI returns 404, and has an invalid TLS certificate.
(From OE-Core rev: 73ff6aba0a53ffc3ee0a5859a3ad4c8021be4de0)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In case of multilib, /usr/lib64/tmpfiles.d is not a path
that will be searched. So we need to use nonarch_libdir.
(From OE-Core rev: 2623d9d2f243128e50be9ed6fb5bb222b3fe9fa0)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License-Update: include more files to check, but license remains the same.
(From OE-Core rev: ad0f26263eb51cda4cf96cd2fe7f6e7f950b9e8e)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ensure we have virtual/crypt even if building without PAM; fixes:
sudo: error in /etc/sudo.conf, line 0 while loading plugin "sudoers_policy"
sudo: unable to load /usr/libexec/sudo/sudoers.so: /usr/libexec/sudo/sudoers.so: undefined symbol: crypt
sudo: fatal error, unable to load plugins
(From OE-Core rev: f863713ae255bf5b6619c98ecd36aacbda352bbb)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The pam_wheel PAM module is used to enforce the so-called wheel group.
By default it permits root access to the system if the applicant user is
a member of the wheel group.
Add PACKAGECONFIG to enable pam_wheel module for sudo.
(From OE-Core rev: 7a46ca79b18527a56de470fcaaf95c870c097cf6)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upgrade sudo to 1.8.23.
The license checksum changes but the actual license does not.
The /var/run/sudo directory has changed to /run/sudo, change
do_install_append according to avoid error.
(From OE-Core rev: abd809670ea4048551d20c11da95203536250001)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Delete various build host references from the internally
generated file sudo_usage.h. The references get compiled into
executables, which leads to non-reproducible builds.
The removed references (configure options) were only used as part
of the sudo "usage", and even then only when ran as root.
(From OE-Core rev: 090eb9efdb2204673b1d569582813ea8860c8570)
Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The checksum for doc/LICENSE is changed, but the content only changes
year from '2013' to '2017', so the license remains the same.
(From OE-Core rev: e1d27852bf21be49db574ed207bc90d42c4bd898)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The license checksum for doc/LICENSE is changed. It's a small change.
'2015' is changed to '2017'. Nothing else is changed. So the licenses
remain the same.
(From OE-Core rev: a14b935461d231429b6dc3bd0fdc34142b48fe86)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pam_keyinit revoke causes issues on systemd systems. Make its use
optional. This brings it in line with Fedora 23 and Centos 7.
(From OE-Core rev: 36825c7b14b92434705a58aa4c22b8c1710a9760)
Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Now that the libdir check allows libraries in libexecdir, remove INSANE_SKIP.
(From OE-Core rev: a760d550b099a9287b188b8376ef2f0787cc85fc)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
sudo has somewhat special file installation logic and installs the modules and
libraries to $libexecdir/sudo, with special handling for the case when
libexecdir already contains /sudo (which it does by default in current oe-core
where libexecdir=$libdir/$PN).
As setting libexecdir to /usr/libexec should work, add both possibilities to
FILES to be sure the right files are captured, and add INSANE_SKIP for the
libdir warning that libraries are outside of /usr/lib/ (arguably, this should be
fixed in insane).
(From OE-Core rev: 431ad7a268fc07c367ce830c4f69dba515f44b4e)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
