mirror of
https://github.com/sudo-project/sudo.git
synced 2025-08-22 01:49:11 +00:00
Run igor on other docs too, not just man pages
This commit is contained in:
parent
5180dd8021
commit
9d49f861c8
32
NEWS
32
NEWS
@ -263,7 +263,7 @@ What's new in Sudo 1.9.14
|
|||||||
The sudoers plugin will now change the root directory id needed
|
The sudoers plugin will now change the root directory id needed
|
||||||
before performing command matching. Previously, the root directory
|
before performing command matching. Previously, the root directory
|
||||||
was simply prepended to the path that was being processed.
|
was simply prepended to the path that was being processed.
|
||||||
|
|
||||||
* When NETGROUP_BASE is set in the ldap.conf file, sudo will now
|
* When NETGROUP_BASE is set in the ldap.conf file, sudo will now
|
||||||
perform its own netgroup lookups of the host name instead of
|
perform its own netgroup lookups of the host name instead of
|
||||||
using the system innetgr(3) function. This guarantees that user
|
using the system innetgr(3) function. This guarantees that user
|
||||||
@ -273,7 +273,7 @@ What's new in Sudo 1.9.14
|
|||||||
* Fixed a bug introduced in sudo 1.9.13 that resulted in a missing
|
* Fixed a bug introduced in sudo 1.9.13 that resulted in a missing
|
||||||
" ; " separator between environment variables and the command
|
" ; " separator between environment variables and the command
|
||||||
in log entries.
|
in log entries.
|
||||||
|
|
||||||
* The visudo utility now displays a warning when it ignores a file
|
* The visudo utility now displays a warning when it ignores a file
|
||||||
in an include dir such as /etc/sudoers.d.
|
in an include dir such as /etc/sudoers.d.
|
||||||
|
|
||||||
@ -442,7 +442,7 @@ What's new in Sudo 1.9.13
|
|||||||
* Sudo no longer checks the ownership and mode of the plugins that
|
* Sudo no longer checks the ownership and mode of the plugins that
|
||||||
it loads. Plugins are configured via either the sudo.conf or
|
it loads. Plugins are configured via either the sudo.conf or
|
||||||
sudoers file which are trusted configuration files. These checks
|
sudoers file which are trusted configuration files. These checks
|
||||||
suffered from time-of-check vs. time-of-use race conditions and
|
suffered from time-of-check versus time-of-use race conditions and
|
||||||
complicate loading plugins that are not simple paths. Ownership
|
complicate loading plugins that are not simple paths. Ownership
|
||||||
and mode checks are still performed when loading the sudo.conf
|
and mode checks are still performed when loading the sudo.conf
|
||||||
and sudoers files, which do not suffer from race conditions.
|
and sudoers files, which do not suffer from race conditions.
|
||||||
@ -531,7 +531,7 @@ What's new in Sudo 1.9.12
|
|||||||
security policy. The new "intercept_verify" sudoers setting can
|
security policy. The new "intercept_verify" sudoers setting can
|
||||||
be used to control this behavior.
|
be used to control this behavior.
|
||||||
|
|
||||||
* Fixed running commands with a relative path (e.g. ./foo) in
|
* Fixed running commands with a relative path (e.g., ./foo) in
|
||||||
intercept mode. Previously, this would fail if sudo's current
|
intercept mode. Previously, this would fail if sudo's current
|
||||||
working directory was different from that of the command.
|
working directory was different from that of the command.
|
||||||
|
|
||||||
@ -831,7 +831,7 @@ What's new in Sudo 1.9.9
|
|||||||
|
|
||||||
* visudo now only warns about an undefined alias or a cycle in an
|
* visudo now only warns about an undefined alias or a cycle in an
|
||||||
alias once for each alias.
|
alias once for each alias.
|
||||||
|
|
||||||
* The sudoRole cn was truncated by a single character in warning messages.
|
* The sudoRole cn was truncated by a single character in warning messages.
|
||||||
GitHub issue #115.
|
GitHub issue #115.
|
||||||
|
|
||||||
@ -997,7 +997,7 @@ What's new in Sudo 1.9.8
|
|||||||
* The new "log_exit_status" sudoers setting can be used to log
|
* The new "log_exit_status" sudoers setting can be used to log
|
||||||
the exit status commands run via sudo. This is also a corresponding
|
the exit status commands run via sudo. This is also a corresponding
|
||||||
"log_exit" setting in the sudo_logsrvd.conf eventlog stanza.
|
"log_exit" setting in the sudo_logsrvd.conf eventlog stanza.
|
||||||
|
|
||||||
* Support for logging sudo_logsrvd errors via syslog or to a file.
|
* Support for logging sudo_logsrvd errors via syslog or to a file.
|
||||||
Previously, most sudo_logsrvd errors were only visible in the
|
Previously, most sudo_logsrvd errors were only visible in the
|
||||||
debug log.
|
debug log.
|
||||||
@ -1089,7 +1089,7 @@ What's new in Sudo 1.9.7
|
|||||||
* The "fuzz" Makefile target now runs all the fuzzers for 8192
|
* The "fuzz" Makefile target now runs all the fuzzers for 8192
|
||||||
passes (can be overridden via the FUZZ_RUNS variable). This makes
|
passes (can be overridden via the FUZZ_RUNS variable). This makes
|
||||||
it easier to run the fuzzers in-tree. To run a fuzzer indefinitely,
|
it easier to run the fuzzers in-tree. To run a fuzzer indefinitely,
|
||||||
set FUZZ_RUNS=-1, e.g. "make FUZZ_RUNS=-1 fuzz".
|
set FUZZ_RUNS=-1, e.g., "make FUZZ_RUNS=-1 fuzz".
|
||||||
|
|
||||||
* Fixed fuzzing on FreeBSD where the ld.lld linker returns an
|
* Fixed fuzzing on FreeBSD where the ld.lld linker returns an
|
||||||
error by default when a symbol is multiply-defined.
|
error by default when a symbol is multiply-defined.
|
||||||
@ -1766,7 +1766,7 @@ What's new in Sudo 1.8.30
|
|||||||
* Sudo now treats an attempt to run "sudo sudoedit" as simply
|
* Sudo now treats an attempt to run "sudo sudoedit" as simply
|
||||||
"sudoedit". If the sudoers file contains a fully-qualified path
|
"sudoedit". If the sudoers file contains a fully-qualified path
|
||||||
to sudoedit, sudo will now treat it simply as "sudoedit" (with
|
to sudoedit, sudo will now treat it simply as "sudoedit" (with
|
||||||
no path). Visudo will will now treat a fully-qualified path
|
no path). Visudo will now treat a fully-qualified path
|
||||||
to sudoedit as an error. Bug #871.
|
to sudoedit as an error. Bug #871.
|
||||||
|
|
||||||
* Fixed a bug introduced in sudo 1.8.28 where sudo would warn about
|
* Fixed a bug introduced in sudo 1.8.28 where sudo would warn about
|
||||||
@ -2826,7 +2826,7 @@ What's new in Sudo 1.8.15
|
|||||||
* When the command sudo is running dies due to a signal, sudo will
|
* When the command sudo is running dies due to a signal, sudo will
|
||||||
now send itself that same signal with the default signal handler
|
now send itself that same signal with the default signal handler
|
||||||
installed instead of exiting. The bash shell appears to ignore
|
installed instead of exiting. The bash shell appears to ignore
|
||||||
some signals, e.g. SIGINT, unless the command being run is killed
|
some signals, e.g., SIGINT, unless the command being run is killed
|
||||||
by that signal. This makes the behavior of commands run under
|
by that signal. This makes the behavior of commands run under
|
||||||
sudo the same as without sudo when bash is the shell. Bug #722
|
sudo the same as without sudo when bash is the shell. Bug #722
|
||||||
|
|
||||||
@ -3758,7 +3758,7 @@ What's new in Sudo 1.8.5?
|
|||||||
|
|
||||||
* On systems with an SVR4-style /proc file system, the /proc/pid/psinfo
|
* On systems with an SVR4-style /proc file system, the /proc/pid/psinfo
|
||||||
file is now uses to determine the controlling terminal, if possible.
|
file is now uses to determine the controlling terminal, if possible.
|
||||||
This allows tty-based tickets to work properly even when, e.g.
|
This allows tty-based tickets to work properly even when, e.g.,
|
||||||
standard input, output and error are redirected to /dev/null.
|
standard input, output and error are redirected to /dev/null.
|
||||||
|
|
||||||
* The output of "sudoreplay -l" is now sorted by file name (or
|
* The output of "sudoreplay -l" is now sorted by file name (or
|
||||||
@ -3766,7 +3766,7 @@ What's new in Sudo 1.8.5?
|
|||||||
order in which they were found on the file system.
|
order in which they were found on the file system.
|
||||||
|
|
||||||
* Sudo now behaves properly when I/O logging is enabled and the
|
* Sudo now behaves properly when I/O logging is enabled and the
|
||||||
controlling terminal is revoked (e.g. the running sshd is killed).
|
controlling terminal is revoked (e.g., the running sshd is killed).
|
||||||
Previously, sudo may have exited without calling the I/O plugin's
|
Previously, sudo may have exited without calling the I/O plugin's
|
||||||
close function which can lead to an incomplete I/O log.
|
close function which can lead to an incomplete I/O log.
|
||||||
|
|
||||||
@ -3877,19 +3877,19 @@ What's new in Sudo 1.8.4?
|
|||||||
* The deprecated "noexec_file" sudoers option is no longer supported.
|
* The deprecated "noexec_file" sudoers option is no longer supported.
|
||||||
|
|
||||||
* Fixed a race condition when I/O logging is not enabled that could
|
* Fixed a race condition when I/O logging is not enabled that could
|
||||||
result in tty-generated signals (e.g. control-C) being received
|
result in tty-generated signals (e.g., control-C) being received
|
||||||
by the command twice.
|
by the command twice.
|
||||||
|
|
||||||
* If none of the standard input, output or error are connected to
|
* If none of the standard input, output or error are connected to
|
||||||
a tty device, sudo will now check its parent's standard input,
|
a tty device, sudo will now check its parent's standard input,
|
||||||
output or error for the tty name on systems with /proc and BSD
|
output or error for the tty name on systems with /proc and BSD
|
||||||
systems that support the KERN_PROC_PID sysctl. This allows
|
systems that support the KERN_PROC_PID sysctl. This allows
|
||||||
tty-based tickets to work properly even when, e.g. standard
|
tty-based tickets to work properly even when, e.g., standard
|
||||||
input, output and error are redirected to /dev/null.
|
input, output and error are redirected to /dev/null.
|
||||||
|
|
||||||
* Added the --enable-kerb5-instance configure option to allow
|
* Added the --enable-kerb5-instance configure option to allow
|
||||||
people using Kerberos V authentication to specify a custom
|
people using Kerberos V authentication to specify a custom
|
||||||
instance so the principal name can be, e.g. "username/sudo"
|
instance so the principal name can be, e.g., "username/sudo"
|
||||||
similar to how ksu uses "username/root".
|
similar to how ksu uses "username/root".
|
||||||
|
|
||||||
* Fixed a bug where a pattern like "/usr/*" included /usr/bin/ in
|
* Fixed a bug where a pattern like "/usr/*" included /usr/bin/ in
|
||||||
@ -4076,7 +4076,7 @@ What's new in Sudo 1.8.1?
|
|||||||
fixed.
|
fixed.
|
||||||
|
|
||||||
* Sudo will now create an entry in the utmp (or utmpx) file when
|
* Sudo will now create an entry in the utmp (or utmpx) file when
|
||||||
allocating a pseudo-tty (e.g. when logging I/O). The "set_utmp"
|
allocating a pseudo-tty (e.g., when logging I/O). The "set_utmp"
|
||||||
and "utmp_runas" sudoers file options can be used to control this.
|
and "utmp_runas" sudoers file options can be used to control this.
|
||||||
Other policy plugins may use the "set_utmp" and "utmp_user"
|
Other policy plugins may use the "set_utmp" and "utmp_user"
|
||||||
entries in the command_info list.
|
entries in the command_info list.
|
||||||
@ -4377,7 +4377,7 @@ What's new in Sudo 1.7.3?
|
|||||||
now taken into account when looking up users and groups. Sudo
|
now taken into account when looking up users and groups. Sudo
|
||||||
now applies the correct the user and group ids when running a
|
now applies the correct the user and group ids when running a
|
||||||
command as a user whose account details come from a different
|
command as a user whose account details come from a different
|
||||||
source (e.g. LDAP or DCE vs. local files).
|
source (e.g., LDAP or DCE versus local files).
|
||||||
|
|
||||||
* Support for multiple 'sudoers_base' and 'uri' entries in ldap.conf.
|
* Support for multiple 'sudoers_base' and 'uri' entries in ldap.conf.
|
||||||
When multiple entries are listed, sudo will try each one in the
|
When multiple entries are listed, sudo will try each one in the
|
||||||
|
@ -60,7 +60,7 @@ can store sudoers content.
|
|||||||
For OpenLDAP, there are two options, depending on how slapd is configured.
|
For OpenLDAP, there are two options, depending on how slapd is configured.
|
||||||
|
|
||||||
The first option is to copy the file schema.OpenLDAP to the schema
|
The first option is to copy the file schema.OpenLDAP to the schema
|
||||||
directory (e.g. /etc/openldap/schema). You must then edit your
|
directory (e.g., /etc/openldap/schema). You must then edit your
|
||||||
slapd.conf and add an include line the new schema, for example:
|
slapd.conf and add an include line the new schema, for example:
|
||||||
|
|
||||||
# Sudo LDAP schema
|
# Sudo LDAP schema
|
||||||
|
@ -102,18 +102,20 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
|
|||||||
|
|
||||||
all: $(DEVDOCS) $(DOCS)
|
all: $(DEVDOCS) $(DOCS)
|
||||||
|
|
||||||
igor: all
|
igor:
|
||||||
@if [ "$(mantype)" != "mdoc" ]; then \
|
@rval=0; \
|
||||||
echo "make igor only supported for mdoc manuals" 1>&2; \
|
for f in *.mdoc.in; do \
|
||||||
exit 1; \
|
echo $(IGOR) -D $$f; \
|
||||||
else \
|
$(IGOR) -D $$f || rval=`expr $$rval + $$?`; \
|
||||||
rval=0; \
|
done; \
|
||||||
for m in $(DOCS); do \
|
for f in $(OTHER_DOCS) $(OTHER_DOCS_LDAP); do \
|
||||||
echo $(IGOR) -D $$m; \
|
case `basename $$f` in \
|
||||||
$(IGOR) -D $$m || rval=`expr $$rval + $$?`; \
|
[A-Z][A-Z]*) \
|
||||||
done; \
|
echo $(IGOR) -abrw $$f; \
|
||||||
exit $$rval; \
|
$(IGOR) -abrw $$f || rval=`expr $$rval + $$?`;; \
|
||||||
fi
|
esac; \
|
||||||
|
done; \
|
||||||
|
exit $$rval
|
||||||
|
|
||||||
lint: all
|
lint: all
|
||||||
@if [ "$(mantype)" != "mdoc" ]; then \
|
@if [ "$(mantype)" != "mdoc" ]; then \
|
||||||
|
@ -13,7 +13,7 @@ We try to respond to security issues in a timely manner but understand that Sudo
|
|||||||
|
|
||||||
Include as much of the following information as possible to help us better understand the nature and scope of the potential issue:
|
Include as much of the following information as possible to help us better understand the nature and scope of the potential issue:
|
||||||
|
|
||||||
* Type of issue (e.g. buffer overflow, privilege escalation, etc.)
|
* Type of issue (e.g., buffer overflow, privilege escalation, etc.)
|
||||||
* Full paths of source file(s) related to the issue
|
* Full paths of source file(s) related to the issue
|
||||||
* The location of the affected source code (tag/branch/commit or direct URL)
|
* The location of the affected source code (tag/branch/commit or direct URL)
|
||||||
* Any special configuration required to reproduce the issue
|
* Any special configuration required to reproduce the issue
|
||||||
|
@ -95,10 +95,10 @@ It just says "Sorry, try again." three times and exits.
|
|||||||
> Don't forget to send a SIGHUP to your syslogd so that it re-reads
|
> Don't forget to send a SIGHUP to your syslogd so that it re-reads
|
||||||
> its conf file. Also, remember that syslogd does *not* create
|
> its conf file. Also, remember that syslogd does *not* create
|
||||||
> log files, you need to create the file before syslogd will log
|
> log files, you need to create the file before syslogd will log
|
||||||
> to it (e.g.: touch /var/log/sudo).
|
> to it (e.g., `touch /var/log/sudo`).
|
||||||
|
|
||||||
> The facility (e.g. 'auth.debug') must be separated from
|
> The facility (e.g., 'auth.debug') must be separated from
|
||||||
> the destination (e.g. '/var/log/auth' or '@loghost') by tabs,
|
> the destination (e.g., '/var/log/auth' or '@loghost') by tabs,
|
||||||
> *not* spaces. This is a common error.
|
> *not* spaces. This is a common error.
|
||||||
|
|
||||||
#### Sudo won't accept my password, even when entered correctly
|
#### Sudo won't accept my password, even when entered correctly
|
||||||
@ -137,9 +137,9 @@ It just says "Sorry, try again." three times and exits.
|
|||||||
> site you may be interested in sudo's LDAP sudoers support, see
|
> site you may be interested in sudo's LDAP sudoers support, see
|
||||||
> [README.LDAP.md](../README.LDAP.md) and the sudoers.ldap manual.
|
> [README.LDAP.md](../README.LDAP.md) and the sudoers.ldap manual.
|
||||||
|
|
||||||
#### I don't run sendmail, does this mean that I cannot use sudo?
|
#### I don't run sendmail, can I still use sudo?
|
||||||
|
|
||||||
> No, you just need to disable mailing with a line like:
|
> Yes, you just need to disable mailing with a line like:
|
||||||
|
|
||||||
Defaults !mailerpath
|
Defaults !mailerpath
|
||||||
|
|
||||||
|
@ -294,8 +294,8 @@ Notes on upgrading from an older release
|
|||||||
important that the time stamp files not persist when the system
|
important that the time stamp files not persist when the system
|
||||||
reboots. For this reason, the default location for the time
|
reboots. For this reason, the default location for the time
|
||||||
stamp files has changed back to a directory located in `/var/run`.
|
stamp files has changed back to a directory located in `/var/run`.
|
||||||
Systems that do not have `/var/run` (e.g. AIX) or that do not clear
|
Systems that do not have `/var/run` (e.g., AIX) or that do not clear
|
||||||
it on boot (e.g. HP-UX) will need to clear the time stamp
|
it on boot (e.g., HP-UX) will need to clear the time stamp
|
||||||
directory via a start up script. Such a script is installed by
|
directory via a start up script. Such a script is installed by
|
||||||
default on AIX and HP-UX systems.
|
default on AIX and HP-UX systems.
|
||||||
|
|
||||||
@ -504,7 +504,7 @@ Notes on upgrading from an older release
|
|||||||
When sudo is build with LDAP support the `/etc/nsswitch.conf` file is
|
When sudo is build with LDAP support the `/etc/nsswitch.conf` file is
|
||||||
now used to determine the sudoers sea ch order. sudo will default to
|
now used to determine the sudoers sea ch order. sudo will default to
|
||||||
only using `/etc/sudoers` unless `/etc/nsswitch.conf` says otherwise.
|
only using `/etc/sudoers` unless `/etc/nsswitch.conf` says otherwise.
|
||||||
This can be changed with an nsswitch.conf line, e.g.:
|
This can be changed with an nsswitch.conf line, for example:
|
||||||
|
|
||||||
sudoers: ldap files
|
sudoers: ldap files
|
||||||
|
|
||||||
@ -548,7 +548,7 @@ Notes on upgrading from an older release
|
|||||||
Prior to sudo 1.6.9, the TERM and PATH environment variables
|
Prior to sudo 1.6.9, the TERM and PATH environment variables
|
||||||
would always be preserved even if the env_keep option was
|
would always be preserved even if the env_keep option was
|
||||||
redefined. That is no longer the case. Consequently, if
|
redefined. That is no longer the case. Consequently, if
|
||||||
env_keep is set with "=" and not simply appended to (i.e. using
|
env_keep is set with "=" and not simply appended to (i.e., using
|
||||||
"+="), PATH and TERM must be explicitly included in the list
|
"+="), PATH and TERM must be explicitly included in the list
|
||||||
of environment variables to keep. The LOGNAME, SHELL, USER,
|
of environment variables to keep. The LOGNAME, SHELL, USER,
|
||||||
and USERNAME environment variables are still always set.
|
and USERNAME environment variables are still always set.
|
||||||
|
Loading…
x
Reference in New Issue
Block a user