2
0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-22 09:57:41 +00:00

Run igor on other docs too, not just man pages

This commit is contained in:
Todd C. Miller 2024-10-28 09:33:23 -06:00
parent 5180dd8021
commit 9d49f861c8
6 changed files with 41 additions and 39 deletions

24
NEWS
View File

@ -442,7 +442,7 @@ What's new in Sudo 1.9.13
* Sudo no longer checks the ownership and mode of the plugins that * Sudo no longer checks the ownership and mode of the plugins that
it loads. Plugins are configured via either the sudo.conf or it loads. Plugins are configured via either the sudo.conf or
sudoers file which are trusted configuration files. These checks sudoers file which are trusted configuration files. These checks
suffered from time-of-check vs. time-of-use race conditions and suffered from time-of-check versus time-of-use race conditions and
complicate loading plugins that are not simple paths. Ownership complicate loading plugins that are not simple paths. Ownership
and mode checks are still performed when loading the sudo.conf and mode checks are still performed when loading the sudo.conf
and sudoers files, which do not suffer from race conditions. and sudoers files, which do not suffer from race conditions.
@ -531,7 +531,7 @@ What's new in Sudo 1.9.12
security policy. The new "intercept_verify" sudoers setting can security policy. The new "intercept_verify" sudoers setting can
be used to control this behavior. be used to control this behavior.
* Fixed running commands with a relative path (e.g. ./foo) in * Fixed running commands with a relative path (e.g., ./foo) in
intercept mode. Previously, this would fail if sudo's current intercept mode. Previously, this would fail if sudo's current
working directory was different from that of the command. working directory was different from that of the command.
@ -1089,7 +1089,7 @@ What's new in Sudo 1.9.7
* The "fuzz" Makefile target now runs all the fuzzers for 8192 * The "fuzz" Makefile target now runs all the fuzzers for 8192
passes (can be overridden via the FUZZ_RUNS variable). This makes passes (can be overridden via the FUZZ_RUNS variable). This makes
it easier to run the fuzzers in-tree. To run a fuzzer indefinitely, it easier to run the fuzzers in-tree. To run a fuzzer indefinitely,
set FUZZ_RUNS=-1, e.g. "make FUZZ_RUNS=-1 fuzz". set FUZZ_RUNS=-1, e.g., "make FUZZ_RUNS=-1 fuzz".
* Fixed fuzzing on FreeBSD where the ld.lld linker returns an * Fixed fuzzing on FreeBSD where the ld.lld linker returns an
error by default when a symbol is multiply-defined. error by default when a symbol is multiply-defined.
@ -1766,7 +1766,7 @@ What's new in Sudo 1.8.30
* Sudo now treats an attempt to run "sudo sudoedit" as simply * Sudo now treats an attempt to run "sudo sudoedit" as simply
"sudoedit". If the sudoers file contains a fully-qualified path "sudoedit". If the sudoers file contains a fully-qualified path
to sudoedit, sudo will now treat it simply as "sudoedit" (with to sudoedit, sudo will now treat it simply as "sudoedit" (with
no path). Visudo will will now treat a fully-qualified path no path). Visudo will now treat a fully-qualified path
to sudoedit as an error. Bug #871. to sudoedit as an error. Bug #871.
* Fixed a bug introduced in sudo 1.8.28 where sudo would warn about * Fixed a bug introduced in sudo 1.8.28 where sudo would warn about
@ -2826,7 +2826,7 @@ What's new in Sudo 1.8.15
* When the command sudo is running dies due to a signal, sudo will * When the command sudo is running dies due to a signal, sudo will
now send itself that same signal with the default signal handler now send itself that same signal with the default signal handler
installed instead of exiting. The bash shell appears to ignore installed instead of exiting. The bash shell appears to ignore
some signals, e.g. SIGINT, unless the command being run is killed some signals, e.g., SIGINT, unless the command being run is killed
by that signal. This makes the behavior of commands run under by that signal. This makes the behavior of commands run under
sudo the same as without sudo when bash is the shell. Bug #722 sudo the same as without sudo when bash is the shell. Bug #722
@ -3758,7 +3758,7 @@ What's new in Sudo 1.8.5?
* On systems with an SVR4-style /proc file system, the /proc/pid/psinfo * On systems with an SVR4-style /proc file system, the /proc/pid/psinfo
file is now uses to determine the controlling terminal, if possible. file is now uses to determine the controlling terminal, if possible.
This allows tty-based tickets to work properly even when, e.g. This allows tty-based tickets to work properly even when, e.g.,
standard input, output and error are redirected to /dev/null. standard input, output and error are redirected to /dev/null.
* The output of "sudoreplay -l" is now sorted by file name (or * The output of "sudoreplay -l" is now sorted by file name (or
@ -3766,7 +3766,7 @@ What's new in Sudo 1.8.5?
order in which they were found on the file system. order in which they were found on the file system.
* Sudo now behaves properly when I/O logging is enabled and the * Sudo now behaves properly when I/O logging is enabled and the
controlling terminal is revoked (e.g. the running sshd is killed). controlling terminal is revoked (e.g., the running sshd is killed).
Previously, sudo may have exited without calling the I/O plugin's Previously, sudo may have exited without calling the I/O plugin's
close function which can lead to an incomplete I/O log. close function which can lead to an incomplete I/O log.
@ -3877,19 +3877,19 @@ What's new in Sudo 1.8.4?
* The deprecated "noexec_file" sudoers option is no longer supported. * The deprecated "noexec_file" sudoers option is no longer supported.
* Fixed a race condition when I/O logging is not enabled that could * Fixed a race condition when I/O logging is not enabled that could
result in tty-generated signals (e.g. control-C) being received result in tty-generated signals (e.g., control-C) being received
by the command twice. by the command twice.
* If none of the standard input, output or error are connected to * If none of the standard input, output or error are connected to
a tty device, sudo will now check its parent's standard input, a tty device, sudo will now check its parent's standard input,
output or error for the tty name on systems with /proc and BSD output or error for the tty name on systems with /proc and BSD
systems that support the KERN_PROC_PID sysctl. This allows systems that support the KERN_PROC_PID sysctl. This allows
tty-based tickets to work properly even when, e.g. standard tty-based tickets to work properly even when, e.g., standard
input, output and error are redirected to /dev/null. input, output and error are redirected to /dev/null.
* Added the --enable-kerb5-instance configure option to allow * Added the --enable-kerb5-instance configure option to allow
people using Kerberos V authentication to specify a custom people using Kerberos V authentication to specify a custom
instance so the principal name can be, e.g. "username/sudo" instance so the principal name can be, e.g., "username/sudo"
similar to how ksu uses "username/root". similar to how ksu uses "username/root".
* Fixed a bug where a pattern like "/usr/*" included /usr/bin/ in * Fixed a bug where a pattern like "/usr/*" included /usr/bin/ in
@ -4076,7 +4076,7 @@ What's new in Sudo 1.8.1?
fixed. fixed.
* Sudo will now create an entry in the utmp (or utmpx) file when * Sudo will now create an entry in the utmp (or utmpx) file when
allocating a pseudo-tty (e.g. when logging I/O). The "set_utmp" allocating a pseudo-tty (e.g., when logging I/O). The "set_utmp"
and "utmp_runas" sudoers file options can be used to control this. and "utmp_runas" sudoers file options can be used to control this.
Other policy plugins may use the "set_utmp" and "utmp_user" Other policy plugins may use the "set_utmp" and "utmp_user"
entries in the command_info list. entries in the command_info list.
@ -4377,7 +4377,7 @@ What's new in Sudo 1.7.3?
now taken into account when looking up users and groups. Sudo now taken into account when looking up users and groups. Sudo
now applies the correct the user and group ids when running a now applies the correct the user and group ids when running a
command as a user whose account details come from a different command as a user whose account details come from a different
source (e.g. LDAP or DCE vs. local files). source (e.g., LDAP or DCE versus local files).
* Support for multiple 'sudoers_base' and 'uri' entries in ldap.conf. * Support for multiple 'sudoers_base' and 'uri' entries in ldap.conf.
When multiple entries are listed, sudo will try each one in the When multiple entries are listed, sudo will try each one in the

View File

@ -60,7 +60,7 @@ can store sudoers content.
For OpenLDAP, there are two options, depending on how slapd is configured. For OpenLDAP, there are two options, depending on how slapd is configured.
The first option is to copy the file schema.OpenLDAP to the schema The first option is to copy the file schema.OpenLDAP to the schema
directory (e.g. /etc/openldap/schema). You must then edit your directory (e.g., /etc/openldap/schema). You must then edit your
slapd.conf and add an include line the new schema, for example: slapd.conf and add an include line the new schema, for example:
# Sudo LDAP schema # Sudo LDAP schema

View File

@ -102,18 +102,20 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
all: $(DEVDOCS) $(DOCS) all: $(DEVDOCS) $(DOCS)
igor: all igor:
@if [ "$(mantype)" != "mdoc" ]; then \ @rval=0; \
echo "make igor only supported for mdoc manuals" 1>&2; \ for f in *.mdoc.in; do \
exit 1; \ echo $(IGOR) -D $$f; \
else \ $(IGOR) -D $$f || rval=`expr $$rval + $$?`; \
rval=0; \ done; \
for m in $(DOCS); do \ for f in $(OTHER_DOCS) $(OTHER_DOCS_LDAP); do \
echo $(IGOR) -D $$m; \ case `basename $$f` in \
$(IGOR) -D $$m || rval=`expr $$rval + $$?`; \ [A-Z][A-Z]*) \
done; \ echo $(IGOR) -abrw $$f; \
exit $$rval; \ $(IGOR) -abrw $$f || rval=`expr $$rval + $$?`;; \
fi esac; \
done; \
exit $$rval
lint: all lint: all
@if [ "$(mantype)" != "mdoc" ]; then \ @if [ "$(mantype)" != "mdoc" ]; then \

View File

@ -13,7 +13,7 @@ We try to respond to security issues in a timely manner but understand that Sudo
Include as much of the following information as possible to help us better understand the nature and scope of the potential issue: Include as much of the following information as possible to help us better understand the nature and scope of the potential issue:
* Type of issue (e.g. buffer overflow, privilege escalation, etc.) * Type of issue (e.g., buffer overflow, privilege escalation, etc.)
* Full paths of source file(s) related to the issue * Full paths of source file(s) related to the issue
* The location of the affected source code (tag/branch/commit or direct URL) * The location of the affected source code (tag/branch/commit or direct URL)
* Any special configuration required to reproduce the issue * Any special configuration required to reproduce the issue

View File

@ -95,10 +95,10 @@ It just says "Sorry, try again." three times and exits.
> Don't forget to send a SIGHUP to your syslogd so that it re-reads > Don't forget to send a SIGHUP to your syslogd so that it re-reads
> its conf file. Also, remember that syslogd does *not* create > its conf file. Also, remember that syslogd does *not* create
> log files, you need to create the file before syslogd will log > log files, you need to create the file before syslogd will log
> to it (e.g.: touch /var/log/sudo). > to it (e.g., `touch /var/log/sudo`).
> The facility (e.g. 'auth.debug') must be separated from > The facility (e.g., 'auth.debug') must be separated from
> the destination (e.g. '/var/log/auth' or '@loghost') by tabs, > the destination (e.g., '/var/log/auth' or '@loghost') by tabs,
> *not* spaces. This is a common error. > *not* spaces. This is a common error.
#### Sudo won't accept my password, even when entered correctly #### Sudo won't accept my password, even when entered correctly
@ -137,9 +137,9 @@ It just says "Sorry, try again." three times and exits.
> site you may be interested in sudo's LDAP sudoers support, see > site you may be interested in sudo's LDAP sudoers support, see
> [README.LDAP.md](../README.LDAP.md) and the sudoers.ldap manual. > [README.LDAP.md](../README.LDAP.md) and the sudoers.ldap manual.
#### I don't run sendmail, does this mean that I cannot use sudo? #### I don't run sendmail, can I still use sudo?
> No, you just need to disable mailing with a line like: > Yes, you just need to disable mailing with a line like:
Defaults !mailerpath Defaults !mailerpath

View File

@ -294,8 +294,8 @@ Notes on upgrading from an older release
important that the time stamp files not persist when the system important that the time stamp files not persist when the system
reboots. For this reason, the default location for the time reboots. For this reason, the default location for the time
stamp files has changed back to a directory located in `/var/run`. stamp files has changed back to a directory located in `/var/run`.
Systems that do not have `/var/run` (e.g. AIX) or that do not clear Systems that do not have `/var/run` (e.g., AIX) or that do not clear
it on boot (e.g. HP-UX) will need to clear the time stamp it on boot (e.g., HP-UX) will need to clear the time stamp
directory via a start up script. Such a script is installed by directory via a start up script. Such a script is installed by
default on AIX and HP-UX systems. default on AIX and HP-UX systems.
@ -504,7 +504,7 @@ Notes on upgrading from an older release
When sudo is build with LDAP support the `/etc/nsswitch.conf` file is When sudo is build with LDAP support the `/etc/nsswitch.conf` file is
now used to determine the sudoers sea ch order. sudo will default to now used to determine the sudoers sea ch order. sudo will default to
only using `/etc/sudoers` unless `/etc/nsswitch.conf` says otherwise. only using `/etc/sudoers` unless `/etc/nsswitch.conf` says otherwise.
This can be changed with an nsswitch.conf line, e.g.: This can be changed with an nsswitch.conf line, for example:
sudoers: ldap files sudoers: ldap files
@ -548,7 +548,7 @@ Notes on upgrading from an older release
Prior to sudo 1.6.9, the TERM and PATH environment variables Prior to sudo 1.6.9, the TERM and PATH environment variables
would always be preserved even if the env_keep option was would always be preserved even if the env_keep option was
redefined. That is no longer the case. Consequently, if redefined. That is no longer the case. Consequently, if
env_keep is set with "=" and not simply appended to (i.e. using env_keep is set with "=" and not simply appended to (i.e., using
"+="), PATH and TERM must be explicitly included in the list "+="), PATH and TERM must be explicitly included in the list
of environment variables to keep. The LOGNAME, SHELL, USER, of environment variables to keep. The LOGNAME, SHELL, USER,
and USERNAME environment variables are still always set. and USERNAME environment variables are still always set.