This adds support for --with-secure-path-value=no to allow packagers
to ship the sudoers configuration file with the secure path
line commented out if required.
We want to avoid calling AX_FUNC_SNPRINTF entirely if cross-compiling
since it is not possible to undo the setting of PREFER_PORTABLE_SNPRINTF.
The previous attempt to do this failed to take into account that
PREFER_PORTABLE_SNPRINTF would still be defined. GitHub issue #969
Now that we parse ttydev as a long long it makes more sense to
format it the same way. This completely avoids the sign extension
issue on systems where dev_t is signed.
This is a better default than assuming it is not compliant (the
previous behavior) when cross-compiling. These days it is rare for
sudo to be built on pre-C99 systems. GitHub issue #969
Insults are still disabled by default but can be enabled in the
sudoers file. To completely disable insult support, use the
--without-insults configure option.
This makes it possible to run an arbitrary script between "make
install" and the polypkg run. This will be used to copy different
word size versions of sudo_intercept.so and sudo_noexec.so.
The noexec and intercept DSO settings may now include both a 32-bit
DSO and a 64-bit DSO specified by a colon. For example:
/usr/libexec/sudo/sudo_intercept.so:/usr/libexec/sudo/sudo_intercept_64.so.
This is more portable and eliminates the need to check for SYMLOOP_MAX
(and provide it if missing) in configure. Also quiet some -Wconversion
warnings.
macOS does not support direct access to the environ pointer from a
shared object. We need to redirect through _NSGetEnviron() instead.
Fixes GitHub issue #276.
Configuration paths in sudo are now a colon-separated list of files
with the adminconfdir instance first (if enabled), followed by a
sysconfdir instance.
This means that _PATH_SUDO_CONF, _PATH_SUDOERS, _PATH_SUDO_LOGSRVD_CONF,
and _PATH_CVTSUDOERS_CONF can now specify multiple files. The first
file that exists is used.
Starting with macOS 13, the linker warns when "-undefined dynamic_lookup"
is used. This is added by libtool by default on macOS but we can
suppress it by passing -no-undefined to libtool.
