8729726fc1
- major changes & fixes:
- LDAP SASL support now works properly with Kerberos
- root may no longer change its SELinux role without entering a password
- user messages are now always displayed in the user's locale, even when
the same message is being logged or mailed in a different locale.
- log files created by sudo now explicitly have the group set to group
ID 0 rather than relying on BSD group semantics
- sudo now stores its libexec files in a sudo subdirectory instead of in
libexec itself
- system_group and group_file sudoers group provider plugins are now
installed by default
- the paths to ldap.conf and ldap.secret may now be specified as arguments
to the sudoers plugin in the sudo.conf file
- ...and many new features and settings. See the upstream ChangeLog for the
full list.
- several sssd support fixes
- added patch to make uid/gid specification parsing more strict (don't accept
an invalid number as uid/gid)
- use the _pkgdocdir macro
(see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs)
- fixed several bugs found by the clang static analyzer
- added %post dependency on chmod
61 lines
2.2 KiB
Diff
61 lines
2.2 KiB
Diff
diff -up sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs sudo-1.8.8/plugins/sudoers/auth/pam.c
|
|
--- sudo-1.8.8/plugins/sudoers/auth/pam.c.clangbugs 2013-09-30 23:41:07.899529555 +0200
|
|
+++ sudo-1.8.8/plugins/sudoers/auth/pam.c 2013-09-30 23:41:58.988707761 +0200
|
|
@@ -246,6 +246,7 @@ sudo_pam_begin_session(struct passwd *pw
|
|
(void) pam_end(pamh, *pam_status | PAM_DATA_SILENT);
|
|
pamh = NULL;
|
|
status = AUTH_FAILURE;
|
|
+ goto done;
|
|
}
|
|
}
|
|
|
|
diff -up sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs sudo-1.8.8/plugins/sudoers/sssd.c
|
|
--- sudo-1.8.8/plugins/sudoers/sssd.c.clangbugs 2013-09-30 23:44:20.404200629 +0200
|
|
+++ sudo-1.8.8/plugins/sudoers/sssd.c 2013-09-30 23:49:05.998194738 +0200
|
|
@@ -310,11 +310,10 @@ static int sudo_sss_close(struct sudo_ns
|
|
debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD);
|
|
|
|
if (nss && nss->handle) {
|
|
- handle = nss->handle;
|
|
- dlclose(handle->ssslib);
|
|
+ handle = nss->handle;
|
|
+ dlclose(handle->ssslib);
|
|
+ efree(nss->handle);
|
|
}
|
|
-
|
|
- efree(nss->handle);
|
|
debug_return_int(0);
|
|
}
|
|
|
|
@@ -705,17 +704,21 @@ sudo_sss_result_get(struct sudo_nss *nss
|
|
sudo_sss_result_filterp, _SUDO_SSS_FILTER_INCLUDE, NULL);
|
|
|
|
if (f_sss_result != NULL) {
|
|
- if (f_sss_result->num_rules > 0) {
|
|
- if (state != NULL) {
|
|
- sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH");
|
|
- *state |= _SUDO_SSS_STATE_HOSTMATCH;
|
|
+ if (f_sss_result->num_rules > 0) {
|
|
+ if (state != NULL) {
|
|
+ sudo_debug_printf(SUDO_DEBUG_DEBUG, "state |= HOSTMATCH");
|
|
+ *state |= _SUDO_SSS_STATE_HOSTMATCH;
|
|
+ }
|
|
}
|
|
- }
|
|
- }
|
|
|
|
- sudo_debug_printf(SUDO_DEBUG_DEBUG,
|
|
- "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result,
|
|
- u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
|
|
+ sudo_debug_printf(SUDO_DEBUG_DEBUG,
|
|
+ "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)", u_sss_result,
|
|
+ u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
|
|
+ } else {
|
|
+ sudo_debug_printf(SUDO_DEBUG_DEBUG,
|
|
+ "u_sss_result=(%p, %u) => f_sss_result=NULL",
|
|
+ u_sss_result, u_sss_result->num_rules);
|
|
+ }
|
|
|
|
handle->fn_free_result(u_sss_result);
|
|
|