forked from sudo-project/sudo
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathNEWS
2759 lines (1967 loc) · 109 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
What's new in Sudo 1.8.29
* The cvtsudoers command will now reject non-LDIF input when converting
from LDIF format to sudoers or JSON formats.
* The new log_allowed and log_denied sudoers settings make it possible
to disable logging and auditing of allowed and/or denied commands.
* The umask is now handled differently on systems with PAM or login.conf.
If the umask is explicitly set in sudoers, that value is used regardless
of what PAM or login.conf may specify. However, if the umask is not
explicitly set in sudoers, PAM or login.conf may now override the default
sudoers umask. Bug #900.
* For "make install", the sudoers file is no longer checked for syntax
errors when DESTDIR is set. The default sudoers file includes the
contents of /etc/sudoers.d which may not be readable as non-root.
Bug #902.
* Sudo now sets most resource limits to their maximum value to avoid
problems caused by insufficient resources, such as an inability to
allocate memory or open files and pipes.
* Fixed a regression introduced in sudo 1.8.28 where sudo would refuse
to run if the parent process was not associated with a session.
This was due to sudo passing a session ID of -1 to the plugin.
What's new in Sudo 1.8.28p1
* The fix for Bug #869 caused "sudo -v" to prompt for a password
when "verifypw" is set to "all" (the default) and all of the
user's sudoers entries are marked with NOPASSWD. Bug #901.
What's new in Sudo 1.8.28
* Sudo will now only set PAM_TTY to the empty string when no
terminal is present on Solaris and Linux. This workaround is
only needed on those systems which may have PAM modules that
misbehave when PAM_TTY is not set.
* The mailerflags sudoers option now has a default value even if
sendmail support was disabled at configure time. Fixes a crash
when the mailerpath sudoers option is set but mailerflags is not.
Bug #878.
* Sudo will now filter out last login messages on HP-UX unless it
a shell is being run via "sudo -s" or "sudo -i". Otherwise,
when trusted mode is enabled, these messages will be displayed
for each command.
* On AIX, when the user's password has expired and PAM is not in use,
sudo will now allow the user to change their password.
Bug #883.
* Sudo has a new -B command line option that will ring the terminal
bell when prompting for a password.
* Sudo no longer refuses to prompt for a password when it cannot
determine the user's terminal as long as it can open /dev/tty.
This allows sudo to function on systems where /proc is unavailable,
such as when running in a chroot environment.
* The "env_editor" sudoers flag is now on by default. This makes
source builds more consistent with the packages generated by
sudo's mkpkg script.
* Sudo no longer ships with pre-formatted copies of the manual pages.
These were included for systems like IRIX that don't ship with an
nroff utility. There are now multiple Open Source nroff replacements
so this should no longer be an issue.
* Fixed a bad interaction with configure's --prefix and
--disable-shared options. Bug #886.
* More verbose error message when a password is required and no terminal
is present. Bug #828.
* Command tags, such as NOPASSWD, are honored when a user tries to run a
command that is allowed by sudoers but which does not actually
exist on the file system. Bug #888.
* Asturian translation for sudoers from translationproject.org.
* I/O log timing files now store signal suspend and resume information
in the form of a signal name instead of a number.
* Fixed a bug introduced in 1.8.24 that prevented sudo from honoring
the value of "ipa_hostname" from sssd.conf, if specified, when
matching the host name.
* Fixed a bug introduced in 1.8.21 that prevented the core dump
resource limit set in the pam_limits module from taking effect.
Bug #894.
* Fixed parsing of double-quoted Defaults group and netgroup bindings.
* The user ID is now used when matching sudoUser attributes in LDAP.
Previously, the user name, group name and group IDs were used
when matching but not the user ID.
* Sudo now writes PAM messages to the user's terminal, if available,
instead of the standard output or standard error. This prevents
PAM output from being intermixed with that of the command when
output is sent to a file or pipe. Bug #895.
* Sudoedit now honors the umask and umask_override settings in sudoers.
Previously, the user's umask was used as-is.
* Fixed a bug where the terminal's file context was not restored
when using SELinux RBAC. Bug #898.
* Fixed CVE-2019-14287, a bug where a sudo user may be able to
run a command as root when the Runas specification explicitly
disallows root access as long as the ALL keyword is listed first.
What's new in Sudo 1.8.27
* On HP-UX, sudo will now update the utmps file when running a command
in a pseudo-tty. Previously, only the utmp and utmpx files were
updated.
* Nanosecond precision file time stamps are now supported in HP-UX.
* Fixes and clarifications to the sudo plugin documentation.
* The sudo manuals no longer require extensive post-processing to
hide system-specific features. Conditionals in the roff source
are now used instead. This fixes corruption of the sudo manual
on systems without BSD login classes. Bug #861.
* If an I/O logging plugin is configured but the plugin does not
actually log any I/O, sudo will no longer force the command to
be run in a pseudo-tty.
* The fix for bug #843 in sudo 1.8.24 was incomplete. If the
user's password was expired or needed to be updated, but no sudo
password was required, the PAM handle was freed too early,
resulting in a failure when processing PAM session modules.
* In visudo, it is now possible to specify the path to sudoers
without using the -f option. Bug #864.
* Fixed a bug introduced in sudo 1.8.22 where the utmp (or utmpx)
file would not be updated when a command was run in a pseudo-tty.
Bug #865.
* Sudo now sets the silent flag when opening the PAM session except
when running a shell via "sudo -s" or "sudo -i". This prevents
the pam_lastlog module from printing the last login information
for each sudo command. Bug #867.
* Fixed the default AIX hard resource limit for the maximum number
of files a user may have open. If no hard limit for "nofiles"
is explicitly set in /etc/security/limits, the default should
be "unlimited". Previously, the default hard limit was 8196.
What's new in Sudo 1.8.26
* Fixed a bug in cvtsudoers when converting to JSON format when
alias expansion is enabled. Bug #853.
* Sudo no long sets the USERNAME environment variable when running
commands. This is a non-standard environment variable that was
set on some older Linux systems.
* Sudo now treats the LOGNAME and USER environment variables (as
well as the LOGIN variable on AIX) as a single unit. If one is
preserved or removed from the environment using env_keep, env_check
or env_delete, so is the other.
* Added support for OpenLDAP's TLS_REQCERT setting in ldap.conf.
* Sudo now logs when the command was suspended and resumed in the
I/O logs. This information is used by sudoreplay to skip the
time suspended when replaying the session unless the new -S flag
is used.
* Fixed documentation problems found by the igor utility. Bug #854.
* Sudo now prints a warning message when there is an error or end
of file while reading the password instead of exiting silently.
* Fixed a bug in the sudoers LDAP back-end parsing the command_timeout,
role, type, privs and limitprivs sudoOptions. This also affected
cvtsudoers conversion from LDIF to sudoers or JSON.
* Fixed a bug that prevented timeout settings in sudoers from
functioning unless a timeout was also specified on the command
line.
* Asturian translation for sudo from translationproject.org.
* When generating LDIF output, cvtsudoers can now be configured
to pad the sudoOrder increment such that the start order is used
as a prefix. Bug #856.
* Fixed a bug introduced in sudo 1.8.25 that prevented sudo from
properly setting the user's groups on AIX. Bug #857.
* If the user specifies a group via sudo's -g option that matches
any of the target user's groups, it is now allowed even if no
groups are present in the Runas_Spec. Previously, it was only
allowed if it matched the target user's primary group.
* The sudoers LDAP back-end now supports negated sudoRunAsUser and
sudoRunAsGroup entries.
* Sudo now provides a proper error message when the "fqdn" sudoers
option is set and it is unable to resolve the local host name.
Bug #859.
* Portuguese translation for sudo and sudoers from translationproject.org.
* Sudo now includes sudoers LDAP schema for the on-line configuration
supported by OpenLDAP.
What's new in Sudo 1.8.25p1
* Fixed a bug introduced in sudo 1.8.25 that caused a crash on
systems that have the poll() function but not the ppoll() function.
Bug #851.
What's new in Sudo 1.8.25
* Fixed a bug introduced in sudo 1.8.20 that broke formatting of
I/O log timing file entries on systems without a C99-compatible
snprintf() function. Our replacement snprintf() doesn't support
floating point so we can't use the "%f" format directive.
* I/O log timing file entries now use a monotonic timer and include
nanosecond precision. A monotonic timer that does not increment
while the system is sleeping is used where available.
* Fixed a bug introduced in sudo 1.8.24 where sudoNotAfter in the LDAP
backend was not being properly parsed. Bug #845.
* When sudo runs a command in a pseudo-tty, the slave device is
now closed in the main process immediately after starting the
monitor process. This removes the need for an AIX-specific
workaround that was added in sudo 1.8.24.
* Added support for monotonic timers on HP-UX.
* Fixed a bug displaying timeout values the "sudo -V" output.
The value displayed was 3600 times the actual value. Bug #846.
* Fixed a build issue on AIX 7.1 BOS levels that include memset_s()
and define rsize_t in string.h. Bug #847.
* The testsudoers utility now supports querying an LDIF-format
policy.
* Sudo now sets the LOGIN environment variable to the same value as
LOGNAME on AIX systems. Bug #848.
* Fixed a regression introduced in sudo 1.8.24 where the LDAP and
SSSD backends evaluated the rules in reverse sudoOrder. Bug #849.
What's new in Sudo 1.8.24
* The LDAP and SSS back-ends now use the same rule evaluation code
as the sudoers file backend. This builds on the work in sudo
1.8.23 where the formatting functions for "sudo -l" output were
shared. The handling of negated commands in SSS and LDAP is
unchanged.
* Fixed a regression introduced in 1.8.23 where "sudo -i" could
not be used in conjunction with --preserve-env=VARIABLE. Bug #835.
* cvtsudoers can now parse base64-encoded attributes in LDIF files.
* Random insults are now more random.
* Fixed the noexec wordexp(3) test on FreeBSD.
* Added SUDO_CONV_PREFER_TTY flag for conversation function to
tell sudo to try writing to /dev/tty first. Can be used in
conjunction with SUDO_CONV_INFO_MSG and SUDO_CONV_ERROR_MSG.
* Sudo now supports an arbitrary number of groups per user on
Solaris. Previously, only the first 64 groups were found.
This should remove the need to set "max_groups" in sudo.conf.
* Fixed typos in the OpenLDAP sudo schema. Bugs #839 and #840.
* Fixed a race condition when building with parallel make.
Bug #842.
* Fixed a duplicate free when netgroup_base in ldap.conf is set
to an invalid value.
* Fixed a bug introduced in sudo 1.8.23 on AIX that could prevent
local users and groups from being resolved properly on systems
that have users stored in NIS, LDAP or AD.
* Added a workaround for an AIX bug exposed by a change in sudo
1.8.23 that prevents the terminal mode from being restored when
I/O logging is enabled.
* On systems using PAM, sudo now ignores the PAM_NEW_AUTHTOK_REQD
and PAM_AUTHTOK_EXPIRED errors from PAM account management if
authentication is disabled for the user. This fixes a regression
introduced in sudo 1.8.23. Bug #843.
* Fixed an ambiguity in the sudoers manual in the description and
definition of User, Runas, Host, and Cmnd Aliases. Bug #834.
* Fixed a bug that resulted in only the first window size change
event being logged.
* Fixed a bug on HP-UX systems introduced in sudo 1.8.22 that
caused sudo to prompt for a password every time when tty-based
time stamp files were in use.
* Fixed a compilation problem on systems that define O_PATH or
O_SEARCH in fnctl.h but do not define O_DIRECTORY. Bug #844.
What's new in Sudo 1.8.23
* PAM account management modules and BSD auth approval modules are
now run even when no password is required.
* For kernel-based time stamps, if no terminal is present, fall
back to parent-pid style time stamps.
* The new cvtsudoers utility replaces both the "sudoers2ldif" script
and the "visudo -x" functionality. It can read a file in either
sudoers or LDIF format and produce JSON, LDIF or sudoers output.
It is also possible to filter the generated output file by user,
group or host name.
* The file, ldap and sss sudoers backends now share a common set
of formatting functions for "sudo -l" output, which is also used
by the cvtsudoers utility.
* The /run directory is now used in preference to /var/run if it
exists. Bug #822.
* More accurate descriptions of the --with-rundir and --with-vardir
configure options. Bug #823.
* The setpassent() and setgroupent() functions are now used on systems
that support them to keep the passwd and group database open.
Sudo performs a lot of passwd and group lookups so it can be
beneficial to avoid opening and closing the files each time.
* The new case_insensitive_user and case_insensitive_group sudoers
options can be used to control whether sudo does case-sensitive
matching of users and groups in sudoers. Case insensitive
matching is now the default.
* Fixed a bug on some systems where sudo could hang on command
exit when I/O logging was enabled. Bug #826.
* Fixed the build-time process start time test on Linux when the
test is run from within a container. Bug #829.
* When determining which temporary directory to use, sudoedit now
checks the directory for writability before using it. Previously,
sudoedit only performed an existence check. Bug #827.
* Sudo now includes an optional set of Monty Python-inspired insults.
* Fixed the execution of scripts with an associated digest (checksum)
in sudoers on FreeBSD systems. FreeBSD does not have a proper
/dev/fd directory mounted by default and its fexecve(2) is not
fully POSIX compliant when executing scripts. Bug #831.
* Chinese (Taiwan) translation for sudo from translationproject.org.
What's new in Sudo 1.8.22
* Commands run in the background from a script run via sudo will
no longer receive SIGHUP when the parent exits and I/O logging
is enabled. Bug #502
* A particularly offensive insult is now disabled by default.
Bug #804
* The description of "sudo -i" now correctly documents that
the "env_keep" and "env_check" sudoers options are applied to
the environment. Bug #806
* Fixed a crash when the system's host name is not set.
Bug #807
* The sudoers2ldif script now handles #include and #includedir
directives.
* Fixed a bug where sudo would silently exit when the command was
not allowed by sudoers and the "passwd_tries" sudoers option
was set to a value less than one.
* Fixed a bug with the "listpw" and "verifypw" sudoers options and
multiple sudoers sources. If the option is set to "all", a
password should be required unless none of a user's sudoers
entries from any source require authentication.
* Fixed a bug with the "listpw" and "verifypw" sudoers options in
the LDAP and SSSD back-ends. If the option is set to "any", and
the entry contained multiple rules, only the first matching rule
was checked. If an entry contained more than one matching rule
and the first rule required authentication but a subsequent rule
did not, sudo would prompt for a password when it should not have.
* When running a command as the invoking user (not root), sudo
would execute the command with the same group vector it was
started with. Sudo now executes the command with a new group
vector based on the group database which is consistent with
how su(1) operates.
* Fixed a double free in the SSSD back-end that could occur when
ipa_hostname is present in sssd.conf and is set to an unqualified
host name.
* When I/O logging is enabled, sudo will now write to the terminal
even when it is a background process. Previously, sudo would
only write to the tty when it was the foreground process when
I/O logging was enabled. If the TOSTOP terminal flag is set,
sudo will suspend the command (and then itself) with the SIGTTOU
signal.
* A new "authfail_message" sudoers option that overrides the
default "N incorrect password attempt(s)".
* An empty sudoRunAsUser attribute in the LDAP and SSSD backends
will now match the invoking user. This is more consistent with
how an empty runas user in the sudoers file is treated.
* Documented that in check mode, visudo does not check the owner/mode
on files specified with the -f flag. Bug #809.
* It is now an error to specify the runas user as an empty string
on the command line. Previously, an empty runas user was treated
the same as an unspecified runas user. Bug #817.
* When "timestamp_type" option is set to "tty" and a terminal is
present, the time stamp record will now include the start time
of the session leader. When the "timestamp_type" option is set
to "ppid" or when no terminal is available, the start time of
the parent process is used instead. This significantly reduces
the likelihood of a time stamp record being re-used when a user
logs out and back in again. Bug #818.
* The sudoers time stamp file format is now documented in the new
sudoers_timestamp manual.
* The "timestamp_type" option now takes a "kernel" value on OpenBSD
systems. This causes the tty-based time stamp to be stored in
the kernel instead of on the file system. If no tty is present,
the time stamp is considered to be invalid.
* Visudo will now use the SUDO_EDITOR environment variable (if
present) in addition to VISUAL and EDITOR.
What's new in Sudo 1.8.21p2
* Fixed a bug introduced in version 1.8.21 which prevented sudo
from using the PAM-supplied prompt. Bug #799
* Fixed a bug introduced in version 1.8.21 which could result in
sudo hanging when running commands that exit quickly. Bug #800
* Fixed a bug introduced in version 1.8.21 which prevented the
command from being run when the password was read via an external
program using the askpass interface. Bug #801
What's new in Sudo 1.8.21p1
* On systems that support both PAM and SIGINFO, the main sudo
process will no longer forward SIGINFO to the command if the
signal was generated from the keyboard. The command will have
already received SIGINFO since it is part of the same process
group so there's no need for sudo to forward it. This is
consistent with the handling of SIGINT, SIGQUIT and SIGTSTP.
Bug #796
* If SUDOERS_SEARCH_FILTER in ldap.conf does not specify a value,
the LDAP search expression used when looking up netgroups and
non-Unix groups had a syntax error if a group plugin was not
specified.
* "sudo -U otheruser -l" will now have an exit value of 0 even
if "otheruser" has no sudo privileges. The exit value when a
user attempts to lists their own privileges or when a command
is specified is unchanged.
* Fixed a regression introduced in sudo 1.8.21 where sudoreplay
playback would hang for I/O logs that contain terminal input.
* Sudo 1.8.18 contained an incomplete fix for the matching of
entries in the LDAP and SSSD back-ends when a sudoRunAsGroup is
specified but no sudoRunAsUser is present in the sudoRole.
What's new in Sudo 1.8.21
* The path that sudo uses to search for terminal devices can now
be configured via the new "devsearch" Path setting in sudo.conf.
* It is now possible to preserve bash shell functions in the
environment when the "env_reset" sudoers setting is disabled by
removing the "*=()*" pattern from the env_delete list.
* A change made in sudo 1.8.15 inadvertantly caused sudoedit to
send itself SIGHUP instead of exiting when the editor returns
an error or the file was not modified.
* Sudoedit now uses an exit code of zero if the file was not
actually modified. Previously, sudoedit treated a lack of
modifications as an error.
* When running a command in a pseudo-tty (pty), sudo now copies a
subset of the terminal flags to the new pty. Previously, all
flags were copied, even those not appropriate for a pty.
* Fixed a problem with debug logging in the sudoers I/O logging
plugin.
* Window size change events are now logged to the policy plugin.
On xterm and compatible terminals, sudoreplay is now capable of
resizing the terminal to match the size of the terminal the
command was run on. The new -R option can be used to disable
terminal resizing.
* Fixed a bug in visudo where a newly added file was not checked
for syntax errors. Bug #791.
* Fixed a bug in visudo where if a syntax error in an include
directory (like /etc/sudoers.d) was detected, the edited version
was left as a temporary file instead of being installed.
* On PAM systems, sudo will now treat "username's Password:" as
a standard password prompt. As a result, the SUDO_PROMPT
environment variable will now override "username's Password:"
as well as the more common "Password:". Previously, the
"passprompt_override" Defaults setting would need to be set for
SUDO_PROMPT to override a prompt of "username's Password:".
* A new "syslog_pid" sudoers setting has been added to include
sudo's process ID along with the process name when logging via
syslog. Bug #792.
* Fixed a bug introduced in sudo 1.8.18 where a command would
not be terminated when the I/O logging plugin returned an error
to the sudo front-end.
* A new "timestamp_type" sudoers setting has been added that replaces
the "tty_tickets" option. In addition to tty and global time stamp
records, it is now possible to use the parent process ID to restrict
the time stamp to commands run by the same process, usually the shell.
Bug #793.
* The --preserve-env command line option has been extended to accept
a comma-separated list of environment variables to preserve.
Bug #279.
* Friulian translation for sudo from translationproject.org.
What's new in Sudo 1.8.20p2
* Fixed a bug parsing /proc/pid/stat on Linux when the process
name contains newlines. This is not exploitable due to the /dev
traversal changes in sudo 1.8.20p1.
What's new in Sudo 1.8.20p1
* Fixed "make check" when using OpenSSL or GNU crypt.
Bug #787.
* Fixed CVE-2017-1000367, a bug parsing /proc/pid/stat on Linux
when the process name contains spaces. Since the user has control
over the command name, this could potentially be used by a user
with sudo access to overwrite an arbitrary file on systems with
SELinux enabled. Also stop performing a breadth-first traversal
of /dev when looking for the device; only a hard-coded list of
directories are checked,
What's new in Sudo 1.8.20
* Added support for SASL_MECH in ldap.conf. Bug #764
* Added support for digest matching when the command is a glob-style
pattern or a directory. Previously, only explicit path matches
supported digest checks.
* New "fdexec" Defaults option to control whether a command
is executed by path or by open file descriptor.
* The embedded copy of zlib has been upgraded to version 1.2.11.
* Fixed a bug that prevented sudoers include files with a relative
path starting with the letter 'i' from being opened. Bug #776.
* Added support for command timeouts in sudoers. The command will
be terminated if the timeout expires.
* The SELinux role and type are now displayed in the "sudo -l"
output for the LDAP and SSSD back-ends, just as they are in the
sudoers back-end.
* A new command line option, -T, can be used to specify a command
timeout as long as the user-specified timeout is not longer than
the timeout specified in sudoers. This option may only be
used when the "user_command_timeouts" flag is enabled in sudoers.
* Added NOTBEFORE and NOTAFTER command options to the sudoers
back-end similar to what is already available in the LDAP back-end.
* Sudo can now optionally use the SHA2 functions in OpenSSL or GNU
crypt instead of the SHA2 implementation bundled with sudo.
* Fixed a compilation error on systems without the stdbool.h header
file. Bug #778.
* Fixed a compilation error in the standalone Kerberos V authentication
module. Bug #777.
* Added the iolog_flush flag to sudoers which causes I/O log data
to be written immediately to disk instead of being buffered.
* I/O log files are now created with group ID 0 by default unless
the "iolog_user" or "iolog_group" options are set in sudoers.
* It is now possible to store I/O log files on an NFS-mounted
file system where uid 0 is remapped to an unprivileged user.
The "iolog_user" option must be set to a non-root user and the
top-level I/O log directory must exist and be owned by that user.
* Added the restricted_env_file setting to sudoers which is similar
to env_file but its contents are subject to the same restrictions
as variables in the invoking user's environment.
* Fixed a use after free bug in the SSSD back-end when the fqdn
sudoOption is enabled and no hostname value is present in
/etc/sssd/sssd.conf.
* Fixed a typo that resulted in a compilation error on systems
where the killpg() function is not found by configure.
* Fixed a compilation error with the included version of zlib
when sudo was built outside the source tree.
* Fixed the exit value of sudo when the command is terminated by
a signal other than SIGINT. This was broken in sudo 1.8.15 by
the fix for Bug #722. Bug #784.
* Fixed a regression introduced in sudo 1.8.18 where the "lecture"
option could not be used in a positive boolean context, only
a negative one.
* Fixed an issue where sudo would consume stdin if it was not
connected to a tty even if log_input is not enabled in sudoers.
Bug #786.
* Clarify in the sudoers manual that the #includedir directive
diverts control to the files in the specified directory and,
when parsing of those files is complete, returns control to the
original file. Bug #775.
What's new in Sudo 1.8.19p2
* Fixed a crash in visudo introduced in sudo 1.8.9 when an IP address
or network is used in a host-based Defaults entry. Bug #766
* Added a missing check for the ignore_iolog_errors flag when
the sudoers plugin generates the I/O log file path name.
* Fixed a typo in sudo's vsyslog() replacement that resulted in
garbage being logged to syslog.
What's new in Sudo 1.8.19p1
* Fixed a bug introduced in sudo 1.8.19 that resulted in the wrong
syslog priority and facility being used.
What's new in Sudo 1.8.19
* New "syslog_maxlen" Defaults option to control the maximum size of
syslog messages generated by sudo.
* Sudo has been run against PVS-Studio and any issues that were
not false positives have been addressed.
* I/O log files are now created with the same group ID as the
parent directory and not the invoking user's group ID.
* I/O log permissions and ownership are now configurable via the
"iolog_mode", "iolog_user" and "iolog_group" sudoers Defaults
variables.
* Fixed configuration of the sudoers I/O log plugin debug subsystem.
Previously, I/O log information was not being written to the
sudoers debug log.
* Fixed a bug in visudo that broke editing of files in an include
dir that have a syntax error. Normally, visudo does not edit
those files, but if a syntax error is detected in one, the user
should get a chance to fix it.
* Warnings about unknown or unparsable sudoers Defaults entries now
include the file and line number of the problem.
* Visudo will now use the file and line number information about an
unknown or unparsable Defaults entry to go directly to the file
with the problem.
* Fixed a bug in the sudoers LDAP back-end where a negated sudoHost
entry would prevent other sudoHost entries following it from matching.
* Warnings from visudo about a cycle in an Alias entry now include the
file and line number of the problem.
* In strict mode, visudo will now use the file and line number
information about a cycle in an Alias entry to go directly to the
file with the problem.
* The sudo_noexec.so file is now linked with -ldl on systems that
require it for the wordexp() wrapper.
* Fixed linking of sudo_noexec.so on macOS systems where it must be
a dynamic library and not a module.
* Sudo's "make check" now includes a test for sudo_noexec.so
working.
* The sudo front-end now passes the user's umask to the plugin.
Previously the plugin had to determine this itself.
* Sudoreplay can now display the stdin and ttyin streams when they
are explicitly added to the filter list.
* Fixed a bug introduced in sudo 1.8.17 where the "all" setting
for verifypw and listpw was not being honored. Bug #762.
* The syslog priority (syslog_goodpri and syslog_badpri) can now
be negated or set to "none" to disable logging of successful or
unsuccessful sudo attempts via syslog.
What's new in Sudo 1.8.18p1
* When sudo_noexec.so is used, the WRDE_NOCMD flag is now added
if the wordexp() function is called. This prevents commands
from being run via wordexp() without disabling it entirely.
* On Linux systems, sudo_noexec.so now uses a seccomp filter to
disable execute access if the kernel supports seccomp. This is
more robust than the traditional method of using stub functions
that return an error.
What's new in Sudo 1.8.18
* The sudoers locale is now set before parsing the sudoers file.
If sudoers_locale is set in sudoers, it is applied before
evaluating other Defaults entries. Previously, sudoers_locale
was used when evaluating sudoers but not during the inital parse.
Bug #748.
* A missing or otherwise invalid #includedir is now ignored instead
of causing a parse error.
* During "make install", backup files are only used on HP-UX where
it is not possible to unlink a shared object that is in use.
This works around a bug in ldconfig on Linux which could create
links to the backup shared library file instead of the current
one.
* Fixed a bug introduced in 1.8.17 where sudoers entries with long
commands lines could be truncated, preventing a match. Bug #752.
* The fqdn, runas_default and sudoers_locale Defaults settings are
now applied before any other Defaults settings since they can
change how other Defaults settings are parsed.
* On systems without the O_NOFOLLOW open(2) flag, when the NOFOLLOW
flag is set, sudoedit now checks whether the file is a symbolic link
before opening it as well as after the open. Bug #753.
* Sudo will now only resolve a user's group IDs to group names
when sudoers includes group-based permissions. Group lookups
can be expensive on some systems where the group database is
not local.
* If the file system holding the sudo log file is full, allow
the command to run unless the new ignore_logfile_errors Defaults
option is disabled. Bug #751.
* The ignore_audit_errors and ignore_iolog_errors Defaults options
have been added to control sudo's behavior when it is unable to
write to the audit and I/O logs.
* Fixed a bug introduced in 1.8.17 where the SIGPIPE signal handler
was not being restored when sudo directly executes the command.
* Fixed a bug where "sudo -l command" would indicate that a command
was runnable even when denied by sudoers when using the LDAP or
SSSD back-ends.
* The match_group_by_gid Defaults option has been added to allow
sites where group name resolution is slow and where sudoers only
contains a small number of groups to match groups by group ID
instead of by group name.
* Fixed a bug on Linux where a 32-bit sudo binary could fail with
an "unable to allocate memory" error when run on a 64-bit system.
Bug #755
* When parsing ldap.conf, sudo will now only treat a '#' character
as the start of a comment when it is at the beginning of the
line.
* Fixed a potential crash when auditing is enabled and the audit
function fails with an error. Bug #756
* Norwegian Nynorsk translation for sudo from translationproject.org.
* Fixed a typo that broke short host name matching when the fqdn
flag is enabled in sudoers. Bug #757
* Negated sudoHost attributes are now supported by the LDAP and
SSSD back-ends.
* Fixed matching entries in the LDAP and SSSD back-ends when a
RunAsGroup is specified but no RunAsUser is present.
* Fixed "sudo -l" output in the LDAP and SSSD back-ends when a
RunAsGroup is specified but no RunAsUser is present.
What's new in Sudo 1.8.17p1
* Fixed a bug introduced in 1.8.17 where the user's groups were
not set on systems that don't use PAM. Bug #749.
What's new in Sudo 1.8.17
* On AIX, if /etc/security/login.cfg has auth_type set to PAM_AUTH
but pam_start(3) fails, fall back to AIX authentication.
Bug #740.
* Sudo now takes all sudoers sources into account when determining
whether or not "sudo -l" or "sudo -v" should prompt for a password.
In other words, if both file and ldap sudoers sources are in
specified in /etc/nsswitch.conf, "sudo -v" will now require that
all entries in both sources be have NOPASSWD (file) or !authenticate
(ldap) in the entries.
* Sudo now ignores SIGPIPE until the command is executed. Previously,
SIGPIPE was only ignored in a few select places. Bug #739.
* Fixed a bug introduced in sudo 1.8.14 where (non-syslog) log
file entries were missing the newline when loglinelen is set to
a non-positive number. Bug #742.
* Unix groups are now set before the plugin session intialization
code is run. This makes it possible to use dynamic groups with
the Linux-PAM pam_group module.
* Fixed a bug where a debugging statement could dereference a NULL
pointer when looking up a group that doesn't exist. Bug #743.
* Sudo has been run through the Coverity code scanner. A number of
minor bugs have been fixed as a result. None were security issues.
* SELinux support, which was broken in 1.8.16, has been repaired.
* Fixed a bug when logging I/O where all output buffers might not
get flushed at exit.
* Forward slashes are no longer escaped in the JSON output of
"visudo -x". This was never required by the standard and not
escaping them improves readability of the output.
* Sudo no longer treats PAM_SESSION_ERR as a fatal error when
opening the PAM session. Other errors from pam_open_session()
are still treated as fatal. This avoids the "policy plugin
failed session initialization" error message seen on some systems.
* Korean translation for sudo and sudoers from translationproject.org.
* Fixed a bug on AIX where the stack size hard resource limit was
being set to 2GB instead of 4GB on 64-bit systems.
* The SSSD back-end now properly supports "sudo -U otheruser -l".
* The SSSD back-end now uses the value of "ipa_hostname"
from sssd.conf, if specified, when matching the host name.
* Fixed a hang on some systems when the command is being run in
a pty and it failed to execute.
* When performing a wildcard match in sudoers, check for an exact
string match if the user command was fully-qualified (or resolved
via the PATH). This fixes an issue executing scripts on Linux
when there are multiple wildcard matches with the same base name.
Bug #746.
What's new in Sudo 1.8.16
* Fixed a compilation error on Solaris 10 with Stun Studio 12.
Bug #727.
* When preserving variables from the invoking user's environment, if
there are duplicates sudo now only keeps the first instance.
* Fixed a bug that could cause warning mail to be sent in list
mode (sudo -l) for users without sudo privileges when the
LDAP and sssd back-ends are used.
* Fixed a bug that prevented the "mail_no_user" option from working
properly with the LDAP back-end.
* In the LDAP and sssd back-ends, white space is now ignored between
an operator (!, +, +=, -=) when parsing a sudoOption.
* It is now possible to disable Path settings in sudo.conf
by omitting the path name.
* The sudoedit_checkdir Defaults option is now enabled by default
and has been extended. When editing files with sudoedit, each
directory in the path to be edited is now checked. If a directory
is writable by the invoking user, symbolic links will not be
followed. If the parent directory of the file to be edited is
writable, sudoedit will refuse to edit it.
Bug #707.
* The netgroup_tuple Defaults option has been added to enable matching
of the entire netgroup tuple, not just the host or user portion.
Bug #717.
* When matching commands based on the SHA2 digest, sudo will now
use fexecve(2) to execute the command if it is available. This
fixes a time of check versus time of use race condition when the
directory holding the command is writable by the invoking user.
* On AIX systems, sudo now caches the auth registry string along
with password and group information. This fixes a potential
problem when a user or group of the same name exists in multiple
auth registries. For example, local and LDAP.
* Fixed a crash in the SSSD back-end when the invoking user is not
found. Bug #732.
* Added the --enable-asan configure flag to enable address sanitizer
support. A few minor memory leaks have been plugged to quiet
the ASAN leak detector.
* The value of _PATH_SUDO_CONF may once again be overridden via
the Makefile. Bug #735.
* The sudoers2ldif script now handles multiple roles with same name.
* Fixed a compilation error on systems that have the posix_spawn()
and posix_spawnp() functions but an unusable spawn.h header.
Bug #730.
* Fixed support for negating character classes in sudo's version
of the fnmatch() function.
* Fixed a bug in the LDAP and SSSD back-ends that could allow an
unauthorized user to list another user's privileges. Bug #738.
* The PAM conversation function now works around an ambiguity in the
PAM spec with respect to multiple messages. Bug #726.
What's new in Sudo 1.8.15
* Fixed a bug that prevented sudo from building outside the source tree
on some platforms. Bug #708.
* Fixed the location of the sssd library in the RHEL/Centos packages.
Bug #710.
* Fixed a build problem on systems that don't implicitly include
sys/types.h from other header files. Bug #711.
* Fixed a problem on Linux using containers where sudo would ignore
signals sent by a process in a different container.
* Sudo now refuses to run a command if the PAM session module
returns an error.
* When editing files with sudoedit, symbolic links will no longer
be followed by default. The old behavior can be restored by
enabling the sudoedit_follow option in sudoers or on a per-command
basis with the FOLLOW and NOFOLLOW tags. Bug #707.
* Fixed a bug introduced in version 1.8.14 that caused the last
valid editor in the sudoers "editor" list to be used by visudo
and sudoedit instead of the first. Bug #714.
* Fixed a bug in visudo that prevented the addition of a final
newline to edited files without one.
* Fixed a bug decoding certain base64 digests in sudoers when the
intermediate format included a '=' character.
* Individual records are now locked in the time stamp file instead
of the entire file. This allows sudo to avoid prompting for a
password multiple times on the same terminal when used in a
pipeline. In other words, "sudo cat foo | sudo grep bar" now
only prompts for the password once. Previously, both sudo