Skip to content

Commit 802d0e8

Browse files
authored
Merge pull request #3066 from flatcar/krnowak/main-sudo
Update app-admin/sudo to 1.9.17p1
2 parents 0cbc3dc + 27b32c5 commit 802d0e8

File tree

5 files changed

+298
-2
lines changed

5 files changed

+298
-2
lines changed

changelog/security/2025-07-01-sudo.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- sudo ([CVE-2025-32462](https://www.cve.org/CVERecord?id=CVE-2025-32462), [CVE-2025-32463](https://www.cve.org/CVERecord?id=CVE-2025-32463))

changelog/updates/2025-07-01-sudo.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- sudo ([1.9.17p1](https://www.sudo.ws/releases/stable/#1.9.17p1))

sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,5 @@ DIST sudo-1.9.16p2.tar.gz 5398419 BLAKE2B ef9f1c2cd4044454a808d1dff5f865355e1bd0
22
DIST sudo-1.9.16p2.tar.gz.sig 566 BLAKE2B 90f90658a7d6ec3b32f6a726a2cd28e156826a65749a88a2a29d970e97804d2d75de856bc85c9a459233b59e35564c5fbf93aff53ffe42d17d0e94dd23724acd SHA512 7f0e3269c9befada535590b2cfc36f96cd70831b5c030df5b3bf8c7cb3eff296d22193429f940db4a0df849b4d8080e4006086c49869b4bbae663836b2632b49
33
DIST sudo-1.9.17.tar.gz 5447899 BLAKE2B d9f2e0d8bca5d5dba5f78a9c064454032038fa60dae022ce72dd0d262bc4bd756fcc5a8e5b0ab4e179c3786fc86a401f7f1ba6d45ca4fe02e43d5cacb1e7f022 SHA512 e94df174ca63a828d953d8400d7e68f8cb86119ca1cd845567b7b452d09bef806a6bd0a6cfc232acfdf7c85aa915f2897b29990c7df89b36c92c62aa469cd7a7
44
DIST sudo-1.9.17.tar.gz.sig 566 BLAKE2B c7543ab8f3a20a27eb2df6b4b6f0aa69d657cbc5d88ea4377ec28b5ef77ec137b7a88a9f28d7051a0ce95493e4c860a01a1cb7e081563183850f4d704805336e SHA512 c03534cf696f300c4434ad2053267b586d3a01459269206632c3c8f348469d3b40d7b4ace30373203c539e2f69b94402d6d2b96da1427d7e872509e4e8029812
5+
DIST sudo-1.9.17p1.tar.gz 5449076 BLAKE2B 21771348a8de392767c366bb938951327dcc64a4cedee716a802435899e5135c218468271833a9e3ab9d90bda29e36c0870e27dd333d3a5c64fb8e3a5ebbff58 SHA512 1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc
6+
DIST sudo-1.9.17p1.tar.gz.sig 566 BLAKE2B b6380c84b82740455a28388925d27bdf9296ddef943653c1883af3c7684ab53571053ef333ac9747ee11330b06fd23adf477856f70bd5fcaa6dbda1c9e432675 SHA512 714ce7c613683689e9d166171b04c03220e21d06f2e66d800f2d075927830014447611933d7293d9c763beeea66fc02255d8175c9ac8cba6d62166750aab50a6
Lines changed: 289 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,289 @@
1+
# Copyright 1999-2025 Gentoo Authors
2+
# Distributed under the terms of the GNU General Public License v2
3+
4+
EAPI=8
5+
6+
inherit pam tmpfiles toolchain-funcs
7+
8+
MY_P="${P/_/}"
9+
MY_P="${MY_P/beta/b}"
10+
11+
DESCRIPTION="Allows users or groups to run commands as other users"
12+
HOMEPAGE="https://www.sudo.ws/"
13+
14+
if [[ ${PV} == 9999 ]] ; then
15+
inherit autotools mercurial
16+
EHG_REPO_URI="https://www.sudo.ws/repos/sudo"
17+
else
18+
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/sudo.ws.asc
19+
inherit libtool verify-sig
20+
21+
uri_prefix=
22+
case ${P} in
23+
*_beta*|*_rc*) uri_prefix=beta/ ;;
24+
esac
25+
26+
SRC_URI="
27+
https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz
28+
verify-sig? (
29+
https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz.sig
30+
)
31+
"
32+
33+
if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
34+
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
35+
fi
36+
37+
BDEPEND="verify-sig? ( sec-keys/openpgp-keys-sudo )"
38+
fi
39+
40+
S="${WORKDIR}/${MY_P}"
41+
42+
# Basic license is ISC-style as-is, some files are released under
43+
# 3-clause BSD license
44+
LICENSE="ISC BSD"
45+
SLOT="0"
46+
IUSE="gcrypt ldap nls offensive pam sasl +secure-path selinux +sendmail skey ssl sssd"
47+
48+
DEPEND="
49+
sys-libs/zlib:=
50+
virtual/libcrypt:=
51+
gcrypt? ( dev-libs/libgcrypt:= )
52+
ldap? (
53+
>=net-nds/openldap-2.1.30-r1:=
54+
sasl? (
55+
dev-libs/cyrus-sasl
56+
net-nds/openldap:=[sasl]
57+
)
58+
)
59+
pam? ( sys-libs/pam )
60+
sasl? ( dev-libs/cyrus-sasl )
61+
selinux? ( sys-libs/libselinux )
62+
skey? ( >=sys-auth/skey-1.1.5-r1 )
63+
ssl? ( dev-libs/openssl:= )
64+
sssd? ( sys-auth/sssd[sudo(+)] )
65+
"
66+
RDEPEND="
67+
${DEPEND}
68+
>=app-misc/editor-wrapper-3
69+
virtual/editor
70+
ldap? ( dev-lang/perl )
71+
pam? ( sys-auth/pambase )
72+
selinux? ( sec-policy/selinux-sudo )
73+
sendmail? ( virtual/mta )
74+
"
75+
BDEPEND+="
76+
app-alternatives/yacc
77+
virtual/pkgconfig
78+
"
79+
80+
REQUIRED_USE="
81+
?? ( pam skey )
82+
?? ( gcrypt ssl )
83+
"
84+
85+
MAKEOPTS+=" SAMPLES="
86+
87+
src_prepare() {
88+
default
89+
90+
if [[ ${PV} == 9999 ]] ; then
91+
eautoreconf
92+
else
93+
elibtoolize
94+
fi
95+
}
96+
97+
set_secure_path() {
98+
# First extract the default ROOTPATH from build env
99+
SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}")
100+
101+
case "${SECURE_PATH}" in
102+
*/usr/sbin*)
103+
;;
104+
*)
105+
SECURE_PATH=$(unset PATH; . "${EPREFIX}"/etc/profile.env; echo "${PATH}")
106+
;;
107+
esac
108+
109+
if [[ -z ${SECURE_PATH} ]] ; then
110+
ewarn " Failed to detect SECURE_PATH, please report this"
111+
fi
112+
113+
# Then remove duplicate path entries
114+
cleanpath() {
115+
local newpath thisp IFS=:
116+
for thisp in $1 ; do
117+
if [[ :${newpath}: != *:${thisp}:* ]] ; then
118+
newpath+=:${thisp}
119+
else
120+
einfo " Duplicate entry ${thisp} removed..."
121+
fi
122+
done
123+
SECURE_PATH=${newpath#:}
124+
}
125+
cleanpath /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}}
126+
127+
# Finally, strip gcc paths, bug #136027
128+
rmpath() {
129+
local e newpath thisp IFS=:
130+
for thisp in ${SECURE_PATH} ; do
131+
for e ; do
132+
[[ ${thisp} == ${e} ]] && continue 2 ;
133+
done
134+
newpath+=:${thisp}
135+
done
136+
SECURE_PATH=${newpath#:}
137+
}
138+
rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*'
139+
}
140+
141+
src_configure() {
142+
local SECURE_PATH
143+
144+
set_secure_path
145+
146+
# bug #767712
147+
tc-export PKG_CONFIG
148+
149+
# - audit: somebody got to explain me how I can test this before I
150+
# enable it.. - Diego
151+
# - plugindir: autoconf code is crappy and does not delay evaluation
152+
# until `make` time, so we have to use a full path here rather than
153+
# basing off other values.
154+
local myeconfargs=(
155+
# We set all of the relevant options by ourselves (patched
156+
# into the toolchain) and setting these in the build system
157+
# actually causes a downgrade when using e.g. -D_FORTIFY_SOURCE=3
158+
# (it'll downgrade to =2). So, this has no functional effect on
159+
# the hardening for users. It's safe.
160+
--disable-hardening
161+
162+
# requires some python eclass
163+
--disable-python
164+
--enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d
165+
--enable-zlib=system
166+
--with-editor="${EPREFIX}"/usr/libexec/editor
167+
--with-env-editor
168+
--with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo
169+
--with-rundir="${EPREFIX}"/run/sudo
170+
--with-vardir="${EPREFIX}"/var/db/sudo
171+
--without-linux-audit
172+
--without-opie
173+
$(use_enable gcrypt)
174+
$(use_enable nls)
175+
$(use_enable sasl)
176+
$(use_enable ssl openssl)
177+
$(use_with ldap)
178+
$(use_with ldap ldap_conf_file /etc/ldap.conf.sudo)
179+
$(use_with offensive insults)
180+
$(use_with offensive all-insults)
181+
$(use_with pam)
182+
$(use_with pam pam-login)
183+
$(use_with secure-path)
184+
"$(use_with secure-path secure-path-value "${SECURE_PATH}")"
185+
$(use_with selinux)
186+
$(use_with sendmail)
187+
$(use_with skey)
188+
$(use_with sssd)
189+
)
190+
191+
econf "${myeconfargs[@]}"
192+
}
193+
194+
src_install() {
195+
default
196+
197+
if use ldap ; then
198+
dodoc README.LDAP.md
199+
200+
cat <<-EOF > "${T}"/ldap.conf.sudo
201+
# See ldap.conf(5) and README.LDAP.md for details
202+
# This file should only be readable by root
203+
204+
# supported directives: host, port, ssl, ldap_version
205+
# uri, binddn, bindpw, sudoers_base, sudoers_debug
206+
# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key}
207+
EOF
208+
209+
if use sasl ; then
210+
cat <<-EOF >> "${T}"/ldap.conf.sudo
211+
212+
# SASL directives: use_sasl, sasl_mech, sasl_auth_id
213+
# sasl_secprops, rootuse_sasl, rootsasl_auth_id, krb5_ccname
214+
EOF
215+
fi
216+
217+
insinto /etc
218+
doins "${T}"/ldap.conf.sudo
219+
fperms 0440 /etc/ldap.conf.sudo
220+
221+
insinto /etc/openldap/schema
222+
newins docs/schema.OpenLDAP sudo.schema
223+
fi
224+
225+
if use pam ; then
226+
pamd_mimic system-auth sudo auth account session
227+
pamd_mimic system-auth sudo-i auth account session
228+
fi
229+
230+
keepdir /var/db/sudo/lectured
231+
fperms 0700 /var/db/sudo/lectured
232+
# bug #652958
233+
fperms 0711 /var/db/sudo
234+
235+
# Don't install into /run as that is a tmpfs most of the time
236+
# (bug #504854)
237+
rm -rf "${ED}"/run || die
238+
239+
# bug #697812
240+
find "${ED}" -type f -name "*.la" -delete || die
241+
}
242+
243+
pkg_postinst() {
244+
tmpfiles_process sudo.conf
245+
246+
# bug #652958
247+
local sudo_db="${EROOT}/var/db/sudo"
248+
if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then
249+
chmod 711 "${sudo_db}" || die
250+
fi
251+
252+
if use ldap ; then
253+
ewarn
254+
ewarn "sudo uses the ${ROOT}/etc/ldap.conf.sudo file for ldap configuration."
255+
ewarn
256+
if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then
257+
ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly"
258+
ewarn "configured in ${ROOT}/etc/nsswitch.conf."
259+
ewarn
260+
ewarn "To make use of LDAP, add this line to your ${ROOT}/etc/nsswitch.conf:"
261+
ewarn " sudoers: ldap files"
262+
ewarn
263+
fi
264+
fi
265+
if use prefix ; then
266+
ewarn
267+
ewarn "To use sudo on Prefix, you need to change file ownership and permissions"
268+
ewarn "with root privileges, as follows:"
269+
ewarn
270+
ewarn " # chown root:root ${EPREFIX}/usr/bin/sudo"
271+
ewarn " # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so"
272+
ewarn " # chown root:root ${EPREFIX}/etc/sudoers"
273+
ewarn " # chown root:root ${EPREFIX}/etc/sudoers.d"
274+
ewarn " # chown root:root ${EPREFIX}/var/db/sudo"
275+
ewarn " # chmod 4111 ${EPREFIX}/usr/bin/sudo"
276+
ewarn
277+
fi
278+
279+
elog "To use the -A (askpass) option, you need to install a compatible"
280+
elog "password program from the following list. Starred packages will"
281+
elog "automatically register for the use with sudo (but will not force"
282+
elog "the -A option):"
283+
elog ""
284+
elog " [*] net-misc/ssh-askpass-fullscreen"
285+
elog " net-misc/x11-ssh-askpass"
286+
elog ""
287+
elog "You can override the choice by setting the SUDO_ASKPASS environmnent"
288+
elog "variable to the program you want to use."
289+
}

sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-9999.ebuild

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,11 @@ DESCRIPTION="Allows users or groups to run commands as other users"
1212
HOMEPAGE="https://www.sudo.ws/"
1313

1414
if [[ ${PV} == 9999 ]] ; then
15-
inherit autotools mercurial
16-
EHG_REPO_URI="https://www.sudo.ws/repos/sudo"
15+
EGIT_REPO_URI="
16+
https://github.com/sudo-project/sudo
17+
https://git.sudo.ws/sudo
18+
"
19+
inherit autotools git-r3
1720
else
1821
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/sudo.ws.asc
1922
inherit libtool verify-sig

0 commit comments

Comments
 (0)