|
| 1 | +# Copyright 1999-2025 Gentoo Authors |
| 2 | +# Distributed under the terms of the GNU General Public License v2 |
| 3 | + |
| 4 | +EAPI=8 |
| 5 | + |
| 6 | +inherit pam tmpfiles toolchain-funcs |
| 7 | + |
| 8 | +MY_P="${P/_/}" |
| 9 | +MY_P="${MY_P/beta/b}" |
| 10 | + |
| 11 | +DESCRIPTION="Allows users or groups to run commands as other users" |
| 12 | +HOMEPAGE="https://www.sudo.ws/" |
| 13 | + |
| 14 | +if [[ ${PV} == 9999 ]] ; then |
| 15 | + inherit autotools mercurial |
| 16 | + EHG_REPO_URI="https://www.sudo.ws/repos/sudo" |
| 17 | +else |
| 18 | + VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/sudo.ws.asc |
| 19 | + inherit libtool verify-sig |
| 20 | + |
| 21 | + uri_prefix= |
| 22 | + case ${P} in |
| 23 | + *_beta*|*_rc*) uri_prefix=beta/ ;; |
| 24 | + esac |
| 25 | + |
| 26 | + SRC_URI=" |
| 27 | + https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz |
| 28 | + verify-sig? ( |
| 29 | + https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz.sig |
| 30 | + ) |
| 31 | + " |
| 32 | + |
| 33 | + if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then |
| 34 | + KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86" |
| 35 | + fi |
| 36 | + |
| 37 | + BDEPEND="verify-sig? ( sec-keys/openpgp-keys-sudo )" |
| 38 | +fi |
| 39 | + |
| 40 | +S="${WORKDIR}/${MY_P}" |
| 41 | + |
| 42 | +# Basic license is ISC-style as-is, some files are released under |
| 43 | +# 3-clause BSD license |
| 44 | +LICENSE="ISC BSD" |
| 45 | +SLOT="0" |
| 46 | +IUSE="gcrypt ldap nls offensive pam sasl +secure-path selinux +sendmail skey ssl sssd" |
| 47 | + |
| 48 | +DEPEND=" |
| 49 | + sys-libs/zlib:= |
| 50 | + virtual/libcrypt:= |
| 51 | + gcrypt? ( dev-libs/libgcrypt:= ) |
| 52 | + ldap? ( |
| 53 | + >=net-nds/openldap-2.1.30-r1:= |
| 54 | + sasl? ( |
| 55 | + dev-libs/cyrus-sasl |
| 56 | + net-nds/openldap:=[sasl] |
| 57 | + ) |
| 58 | + ) |
| 59 | + pam? ( sys-libs/pam ) |
| 60 | + sasl? ( dev-libs/cyrus-sasl ) |
| 61 | + selinux? ( sys-libs/libselinux ) |
| 62 | + skey? ( >=sys-auth/skey-1.1.5-r1 ) |
| 63 | + ssl? ( dev-libs/openssl:= ) |
| 64 | + sssd? ( sys-auth/sssd[sudo(+)] ) |
| 65 | +" |
| 66 | +RDEPEND=" |
| 67 | + ${DEPEND} |
| 68 | + >=app-misc/editor-wrapper-3 |
| 69 | + virtual/editor |
| 70 | + ldap? ( dev-lang/perl ) |
| 71 | + pam? ( sys-auth/pambase ) |
| 72 | + selinux? ( sec-policy/selinux-sudo ) |
| 73 | + sendmail? ( virtual/mta ) |
| 74 | +" |
| 75 | +BDEPEND+=" |
| 76 | + app-alternatives/yacc |
| 77 | + virtual/pkgconfig |
| 78 | +" |
| 79 | + |
| 80 | +REQUIRED_USE=" |
| 81 | + ?? ( pam skey ) |
| 82 | + ?? ( gcrypt ssl ) |
| 83 | +" |
| 84 | + |
| 85 | +MAKEOPTS+=" SAMPLES=" |
| 86 | + |
| 87 | +src_prepare() { |
| 88 | + default |
| 89 | + |
| 90 | + if [[ ${PV} == 9999 ]] ; then |
| 91 | + eautoreconf |
| 92 | + else |
| 93 | + elibtoolize |
| 94 | + fi |
| 95 | +} |
| 96 | + |
| 97 | +set_secure_path() { |
| 98 | + # First extract the default ROOTPATH from build env |
| 99 | + SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}") |
| 100 | + |
| 101 | + case "${SECURE_PATH}" in |
| 102 | + */usr/sbin*) |
| 103 | + ;; |
| 104 | + *) |
| 105 | + SECURE_PATH=$(unset PATH; . "${EPREFIX}"/etc/profile.env; echo "${PATH}") |
| 106 | + ;; |
| 107 | + esac |
| 108 | + |
| 109 | + if [[ -z ${SECURE_PATH} ]] ; then |
| 110 | + ewarn " Failed to detect SECURE_PATH, please report this" |
| 111 | + fi |
| 112 | + |
| 113 | + # Then remove duplicate path entries |
| 114 | + cleanpath() { |
| 115 | + local newpath thisp IFS=: |
| 116 | + for thisp in $1 ; do |
| 117 | + if [[ :${newpath}: != *:${thisp}:* ]] ; then |
| 118 | + newpath+=:${thisp} |
| 119 | + else |
| 120 | + einfo " Duplicate entry ${thisp} removed..." |
| 121 | + fi |
| 122 | + done |
| 123 | + SECURE_PATH=${newpath#:} |
| 124 | + } |
| 125 | + cleanpath /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}} |
| 126 | + |
| 127 | + # Finally, strip gcc paths, bug #136027 |
| 128 | + rmpath() { |
| 129 | + local e newpath thisp IFS=: |
| 130 | + for thisp in ${SECURE_PATH} ; do |
| 131 | + for e ; do |
| 132 | + [[ ${thisp} == ${e} ]] && continue 2 ; |
| 133 | + done |
| 134 | + newpath+=:${thisp} |
| 135 | + done |
| 136 | + SECURE_PATH=${newpath#:} |
| 137 | + } |
| 138 | + rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*' |
| 139 | +} |
| 140 | + |
| 141 | +src_configure() { |
| 142 | + local SECURE_PATH |
| 143 | + |
| 144 | + set_secure_path |
| 145 | + |
| 146 | + # bug #767712 |
| 147 | + tc-export PKG_CONFIG |
| 148 | + |
| 149 | + # - audit: somebody got to explain me how I can test this before I |
| 150 | + # enable it.. - Diego |
| 151 | + # - plugindir: autoconf code is crappy and does not delay evaluation |
| 152 | + # until `make` time, so we have to use a full path here rather than |
| 153 | + # basing off other values. |
| 154 | + local myeconfargs=( |
| 155 | + # We set all of the relevant options by ourselves (patched |
| 156 | + # into the toolchain) and setting these in the build system |
| 157 | + # actually causes a downgrade when using e.g. -D_FORTIFY_SOURCE=3 |
| 158 | + # (it'll downgrade to =2). So, this has no functional effect on |
| 159 | + # the hardening for users. It's safe. |
| 160 | + --disable-hardening |
| 161 | + |
| 162 | + # requires some python eclass |
| 163 | + --disable-python |
| 164 | + --enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d |
| 165 | + --enable-zlib=system |
| 166 | + --with-editor="${EPREFIX}"/usr/libexec/editor |
| 167 | + --with-env-editor |
| 168 | + --with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo |
| 169 | + --with-rundir="${EPREFIX}"/run/sudo |
| 170 | + --with-vardir="${EPREFIX}"/var/db/sudo |
| 171 | + --without-linux-audit |
| 172 | + --without-opie |
| 173 | + $(use_enable gcrypt) |
| 174 | + $(use_enable nls) |
| 175 | + $(use_enable sasl) |
| 176 | + $(use_enable ssl openssl) |
| 177 | + $(use_with ldap) |
| 178 | + $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) |
| 179 | + $(use_with offensive insults) |
| 180 | + $(use_with offensive all-insults) |
| 181 | + $(use_with pam) |
| 182 | + $(use_with pam pam-login) |
| 183 | + $(use_with secure-path) |
| 184 | + "$(use_with secure-path secure-path-value "${SECURE_PATH}")" |
| 185 | + $(use_with selinux) |
| 186 | + $(use_with sendmail) |
| 187 | + $(use_with skey) |
| 188 | + $(use_with sssd) |
| 189 | + ) |
| 190 | + |
| 191 | + econf "${myeconfargs[@]}" |
| 192 | +} |
| 193 | + |
| 194 | +src_install() { |
| 195 | + default |
| 196 | + |
| 197 | + if use ldap ; then |
| 198 | + dodoc README.LDAP.md |
| 199 | + |
| 200 | + cat <<-EOF > "${T}"/ldap.conf.sudo |
| 201 | + # See ldap.conf(5) and README.LDAP.md for details |
| 202 | + # This file should only be readable by root |
| 203 | +
|
| 204 | + # supported directives: host, port, ssl, ldap_version |
| 205 | + # uri, binddn, bindpw, sudoers_base, sudoers_debug |
| 206 | + # tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key} |
| 207 | + EOF |
| 208 | + |
| 209 | + if use sasl ; then |
| 210 | + cat <<-EOF >> "${T}"/ldap.conf.sudo |
| 211 | +
|
| 212 | + # SASL directives: use_sasl, sasl_mech, sasl_auth_id |
| 213 | + # sasl_secprops, rootuse_sasl, rootsasl_auth_id, krb5_ccname |
| 214 | + EOF |
| 215 | + fi |
| 216 | + |
| 217 | + insinto /etc |
| 218 | + doins "${T}"/ldap.conf.sudo |
| 219 | + fperms 0440 /etc/ldap.conf.sudo |
| 220 | + |
| 221 | + insinto /etc/openldap/schema |
| 222 | + newins docs/schema.OpenLDAP sudo.schema |
| 223 | + fi |
| 224 | + |
| 225 | + if use pam ; then |
| 226 | + pamd_mimic system-auth sudo auth account session |
| 227 | + pamd_mimic system-auth sudo-i auth account session |
| 228 | + fi |
| 229 | + |
| 230 | + keepdir /var/db/sudo/lectured |
| 231 | + fperms 0700 /var/db/sudo/lectured |
| 232 | + # bug #652958 |
| 233 | + fperms 0711 /var/db/sudo |
| 234 | + |
| 235 | + # Don't install into /run as that is a tmpfs most of the time |
| 236 | + # (bug #504854) |
| 237 | + rm -rf "${ED}"/run || die |
| 238 | + |
| 239 | + # bug #697812 |
| 240 | + find "${ED}" -type f -name "*.la" -delete || die |
| 241 | +} |
| 242 | + |
| 243 | +pkg_postinst() { |
| 244 | + tmpfiles_process sudo.conf |
| 245 | + |
| 246 | + # bug #652958 |
| 247 | + local sudo_db="${EROOT}/var/db/sudo" |
| 248 | + if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then |
| 249 | + chmod 711 "${sudo_db}" || die |
| 250 | + fi |
| 251 | + |
| 252 | + if use ldap ; then |
| 253 | + ewarn |
| 254 | + ewarn "sudo uses the ${ROOT}/etc/ldap.conf.sudo file for ldap configuration." |
| 255 | + ewarn |
| 256 | + if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then |
| 257 | + ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly" |
| 258 | + ewarn "configured in ${ROOT}/etc/nsswitch.conf." |
| 259 | + ewarn |
| 260 | + ewarn "To make use of LDAP, add this line to your ${ROOT}/etc/nsswitch.conf:" |
| 261 | + ewarn " sudoers: ldap files" |
| 262 | + ewarn |
| 263 | + fi |
| 264 | + fi |
| 265 | + if use prefix ; then |
| 266 | + ewarn |
| 267 | + ewarn "To use sudo on Prefix, you need to change file ownership and permissions" |
| 268 | + ewarn "with root privileges, as follows:" |
| 269 | + ewarn |
| 270 | + ewarn " # chown root:root ${EPREFIX}/usr/bin/sudo" |
| 271 | + ewarn " # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so" |
| 272 | + ewarn " # chown root:root ${EPREFIX}/etc/sudoers" |
| 273 | + ewarn " # chown root:root ${EPREFIX}/etc/sudoers.d" |
| 274 | + ewarn " # chown root:root ${EPREFIX}/var/db/sudo" |
| 275 | + ewarn " # chmod 4111 ${EPREFIX}/usr/bin/sudo" |
| 276 | + ewarn |
| 277 | + fi |
| 278 | + |
| 279 | + elog "To use the -A (askpass) option, you need to install a compatible" |
| 280 | + elog "password program from the following list. Starred packages will" |
| 281 | + elog "automatically register for the use with sudo (but will not force" |
| 282 | + elog "the -A option):" |
| 283 | + elog "" |
| 284 | + elog " [*] net-misc/ssh-askpass-fullscreen" |
| 285 | + elog " net-misc/x11-ssh-askpass" |
| 286 | + elog "" |
| 287 | + elog "You can override the choice by setting the SUDO_ASKPASS environmnent" |
| 288 | + elog "variable to the program you want to use." |
| 289 | +} |
0 commit comments