mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-22 09:57:41 +00:00
Code Issues Releases Wiki Activity

Allow --secure-path-value=no

Browse Source 
This adds support for --with-secure-path-value=no to allow packagers
to ship the sudoers configuration file with the secure path
line commented out if required.
This commit is contained in:
Andy Fiddaman 2024-09-17 12:49:13 +00:00 committed by Todd C. Miller
parent ae5cf31a9d
commit 131e7e2de0
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
configure.ac
View File

@ -177,6 +177,7 @@ AC_SUBST([sssd_lib])
AC_SUBST([nsswitch_conf]) AC_SUBST([nsswitch_conf])
AC_SUBST([netsvc_conf]) AC_SUBST([netsvc_conf])
AC_SUBST([secure_path]) AC_SUBST([secure_path])
AC_SUBST([secure_path_config])
AC_SUBST([secure_path_status]) AC_SUBST([secure_path_status])
AC_SUBST([editor]) AC_SUBST([editor])
AC_SUBST([pam_session]) AC_SUBST([pam_session])
@ -230,6 +231,7 @@ sesh_file="$libexecdir/sudo/sesh"
visudo="$sbindir/visudo" visudo="$sbindir/visudo"
nsswitch_conf=/etc/nsswitch.conf nsswitch_conf=/etc/nsswitch.conf
secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
secure_path_config=
secure_path_status="disabled" secure_path_status="disabled"
pam_session=on pam_session=on
pam_login_service=sudo pam_login_service=sudo
@ -1068,9 +1070,11 @@ AC_ARG_WITH(ldap-secret-file, [AS_HELP_STRING([--with-ldap-secret-file], [path t
test -n "$with_ldap_secret_file" && ldap_secret="$with_ldap_secret_file" test -n "$with_ldap_secret_file" && ldap_secret="$with_ldap_secret_file"
SUDO_DEFINE_UNQUOTED(_PATH_LDAP_SECRET, "$ldap_secret", [Path to the ldap.secret file]) SUDO_DEFINE_UNQUOTED(_PATH_LDAP_SECRET, "$ldap_secret", [Path to the ldap.secret file])
AC_ARG_WITH(secure-path-value, [AS_HELP_STRING([--with-secure-path-value], [value of secure_path in the default sudoers file])], AC_ARG_WITH(secure-path-value, [AS_HELP_STRING([--with-secure-path-value], [value of secure_path in the default sudoers file, or "no" to comment out by default])],
[case $with_secure_path_value in [case $with_secure_path_value in
yes|no) AC_MSG_ERROR([must give --secure-path-value an argument.]) yes) AC_MSG_ERROR([must give --with-secure-path-value an argument.])
;;
no) secure_path_config="# "
;; ;;
*) secure_path="$with_secure_path_value" *) secure_path="$with_secure_path_value"
;; ;;

2
plugins/sudoers/sudoers.in
View File

@ -48,7 +48,7 @@ Defaults!@visudo@ env_keep += "SUDO_EDITOR EDITOR VISUAL"
## Use a hard-coded PATH instead of the user's to find commands. ## Use a hard-coded PATH instead of the user's to find commands.
## This also helps prevent poorly written scripts from running ## This also helps prevent poorly written scripts from running
## artbitrary commands under sudo. ## artbitrary commands under sudo.
Defaults secure_path="@secure_path@" @secure_path_config@Defaults secure_path="@secure_path@"
## ##
## You may wish to keep some of the following environment variables ## You may wish to keep some of the following environment variables
## when running commands via sudo. ## when running commands via sudo.