[ptxdist] [PATCH] sudo: version bump 1.8.22 -> 1.8.28

[ptxdist] [PATCH] sudo: version bump 1.8.22 -> 1.8.28

[Roland Hieber]

This update fixes CVE-2019-14287, see also
https://www.sudo.ws/alerts/minus_1_uid.html

Pin down more configure options, and update the license MD5, which added
some more file headers of files under ISC license, reformatted the
existing license file headers, and bumped the copyright date to 2019.

Signed-off-by: Roland Hieber <rhi@pengutronix.de>
---
 rules/sudo.make | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/rules/sudo.make b/rules/sudo.make
index 96349406f67b..a7fa0ad4a2db 100644
--- a/rules/sudo.make
+++ b/rules/sudo.make
@@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_SUDO) += sudo
 #
 # Paths and names
 #
-SUDO_VERSION	:= 1.8.22
-SUDO_MD5	:= 24abdea48db4c5abcd410167c801cc8c
+SUDO_VERSION	:= 1.8.28
+SUDO_MD5	:= 5afa5acd0c55b40916e4ad864607edfe
 SUDO		:= sudo-$(SUDO_VERSION)
 SUDO_SUFFIX	:= tar.gz
 SUDO_URL	:= \
@@ -25,7 +25,7 @@ SUDO_URL	:= \
 SUDO_SOURCE	:= $(SRCDIR)/$(SUDO).$(SUDO_SUFFIX)
 SUDO_DIR	:= $(BUILDDIR)/$(SUDO)
 SUDO_LICENSE	:= ISC AND BSD-3-Clause AND BSD-2-Clause-NetBSD AND Zlib
-SUDO_LICENSE_FILES := file://doc/LICENSE;md5=7765a3d787cb4fed3ccc3c9cee030af9
+SUDO_LICENSE_FILES := file://doc/LICENSE;md5=6c76b73603ac7763ab0516ebfbe67b42
 
 # ----------------------------------------------------------------------------
 # Prepare
@@ -44,22 +44,43 @@ SUDO_ENV 	:= \
 #
 SUDO_AUTOCONF = \
 	$(CROSS_AUTOCONF_USR) \
+	--enable-authentication \
+	--disable-root-mailer \
+	--enable-setreuid \
+	--enable-setresuid \
 	--enable-shadow \
 	--enable-root-sudo \
 	--disable-log-host \
 	--enable-noargs-shell \
+	--disable-shell-sets-home \
 	--disable-path-info \
+	--disable-env-debug \
+	--enable-zlib \
+	--disable-env-reset \
 	--enable-warnings \
 	--disable-werror \
+	--disable-openssl \
+	--disable-gcrypt \
 	--enable-hardening \
 	--enable-pie \
+	--enable-asan \
+	--enable-poll \
+	--disable-admin-flag \
 	--disable-nls \
 	--disable-rpath \
 	--enable-static-sudoers \
 	--disable-shared-libutil \
+	--disable-tmpfiles.d \
+	--disable-devsearch \
+	--disable-sasl \
+	--disable-offensive-insults \
+	--disable-package-build \
+	--disable-gss-krb5-ccache-name \
+	--disable-pvs-studio \
 	--disable-sia \
 	$(GLOBAL_LARGE_FILE_OPTION) \
 	--disable-pam-session \
+	--disable-kerb5-instance \
 	--without-AFS \
 	--without-DCE \
 	--without-logincap \
-- 
2.23.0


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH] sudo: version bump 1.8.22 -> 1.8.28

[Bruno Thomsen]

Hi Roland

> Subject: [ptxdist] [PATCH] sudo: version bump 1.8.22 -> 1.8.28
>
> Pin down more configure options, and update the license MD5, which added
> some more file headers of files under ISC license, reformatted the
> existing license file headers, and bumped the copyright date to 2019.

Thanks for updating the rule.

After using this updated rule I hit a few runtime issues:

sudo --version
sudo: error while loading shared libraries: libasan.so.5: cannot open shared object file: No such file or directory

sudo --version
sudo: error while loading shared libraries: libubsan.so.1: cannot open shared object file: No such file or directory

sudo --version
Sudo version 1.8.28

Below is a quick-and-dirty patch that fixes the issues.

I can send a proper patch if this is the correct way of fixing it as
it's most likely caused by a changed in the pinned configure options.

/Bruno

--------------------8<--------------------

diff --git a/rules/sudo.in b/rules/sudo.in
index 480c90cd9..aa47e4444 100644
--- a/rules/sudo.in
+++ b/rules/sudo.in
@@ -2,6 +2,8 @@
 menuconfig SUDO
        tristate
        prompt "sudo                          "
+       select GCCLIBS_LIBASAN
+       select GCCLIBS_LIBUBSAN
        select LIBC_CRYPT
        select LIBC_UTIL
        select LIBC_DL

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH] sudo: version bump 1.8.22 -> 1.8.28

[Roland Hieber]

On Wed, Oct 23, 2019 at 08:56:39AM +0000, Bruno Thomsen wrote:
> 
> Hi Roland
> 
> > Subject: [ptxdist] [PATCH] sudo: version bump 1.8.22 -> 1.8.28
> >
> > Pin down more configure options, and update the license MD5, which added
> > some more file headers of files under ISC license, reformatted the
> > existing license file headers, and bumped the copyright date to 2019.
> 
> Thanks for updating the rule.
> 
> After using this updated rule I hit a few runtime issues:
> 
> sudo --version
> sudo: error while loading shared libraries: libasan.so.5: cannot open shared object file: No such file or directory
> 
> sudo --version
> sudo: error while loading shared libraries: libubsan.so.1: cannot open shared object file: No such file or directory
> 
> sudo --version
> Sudo version 1.8.28
> 
> Below is a quick-and-dirty patch that fixes the issues.
> 
> I can send a proper patch if this is the correct way of fixing it as
> it's most likely caused by a changed in the pinned configure options.

Please feel free to do so, and thanks for testing!

 - Roland

> 
> /Bruno
> 
> --------------------8<--------------------
> 
> diff --git a/rules/sudo.in b/rules/sudo.in
> index 480c90cd9..aa47e4444 100644
> --- a/rules/sudo.in
> +++ b/rules/sudo.in
> @@ -2,6 +2,8 @@
>  menuconfig SUDO
>         tristate
>         prompt "sudo                          "
> +       select GCCLIBS_LIBASAN
> +       select GCCLIBS_LIBUBSAN
>         select LIBC_CRYPT
>         select LIBC_UTIL
>         select LIBC_DL
> 

-- 
Roland Hieber                     | r.hieber@pengutronix.de     |
Pengutronix e.K.                  | https://www.pengutronix.de/ |
Peiner Str. 6-8, 31137 Hildesheim | Phone: +49-5121-206917-5086 |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH] sudo: version bump 1.8.22 -> 1.8.28

[Michael Olbrich]

On Wed, Oct 23, 2019 at 11:05:27AM +0200, Roland Hieber wrote:
> On Wed, Oct 23, 2019 at 08:56:39AM +0000, Bruno Thomsen wrote:
> > 
> > Hi Roland
> > 
> > > Subject: [ptxdist] [PATCH] sudo: version bump 1.8.22 -> 1.8.28
> > >
> > > Pin down more configure options, and update the license MD5, which added
> > > some more file headers of files under ISC license, reformatted the
> > > existing license file headers, and bumped the copyright date to 2019.
> > 
> > Thanks for updating the rule.
> > 
> > After using this updated rule I hit a few runtime issues:
> > 
> > sudo --version
> > sudo: error while loading shared libraries: libasan.so.5: cannot open shared object file: No such file or directory
> > 
> > sudo --version
> > sudo: error while loading shared libraries: libubsan.so.1: cannot open shared object file: No such file or directory
> > 
> > sudo --version
> > Sudo version 1.8.28
> > 
> > Below is a quick-and-dirty patch that fixes the issues.
> > 
> > I can send a proper patch if this is the correct way of fixing it as
> > it's most likely caused by a changed in the pinned configure options.
> 
> Please feel free to do so, and thanks for testing!

This is the wrong fix. Use --disable-asan instead.

Michael

>  - Roland
> 
> > 
> > /Bruno
> > 
> > --------------------8<--------------------
> > 
> > diff --git a/rules/sudo.in b/rules/sudo.in
> > index 480c90cd9..aa47e4444 100644
> > --- a/rules/sudo.in
> > +++ b/rules/sudo.in
> > @@ -2,6 +2,8 @@
> >  menuconfig SUDO
> >         tristate
> >         prompt "sudo                          "
> > +       select GCCLIBS_LIBASAN
> > +       select GCCLIBS_LIBUBSAN
> >         select LIBC_CRYPT
> >         select LIBC_UTIL
> >         select LIBC_DL
> > 
> 
> -- 
> Roland Hieber                     | r.hieber@pengutronix.de     |
> Pengutronix e.K.                  | https://www.pengutronix.de/ |
> Peiner Str. 6-8, 31137 Hildesheim | Phone: +49-5121-206917-5086 |
> Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de