Add support for Ubuntu admin flag file and enable it when building

Ubuntu packages.

--HG--
branch : 1.7

diff --git a/INSTALL b/INSTALL
index 5cb6666c254f79b1cd58c3e771f2bed787786a9d..8d92b4cbfd7eb5659a1cc23cd08ec19ba20fbee3 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -627,6 +627,10 @@ The following options are also configurable at runtime:
   --enable-warnings
        Enable compiler warnings when building sudo with gcc.
 
+  --enable-admin-flag
+       Enable the creation of an Ubuntu-style admin flag file
+       the first time sudo is run.
+
 Shadow password and C2 support
 ==============================
 

diff --git a/config.h.in b/config.h.in
index ebce631d99da3a9d4583505b22c1b5584f0d71c0..7c70f7f5af3c2f4b67f666e985ec11041d2bc830 100644 (file)
--- a/config.h.in
+++ b/config.h.in
@@ -744,6 +744,10 @@
 /* Define to 1 if the `unsetenv' function returns void instead of `int'. */
 #undef UNSETENV_VOID
 
+/* Define to 1 if you want to create ~/.sudo_as_admin_successful if the user
+   is in the admin group the first time they run sudo. */
+#undef USE_ADMIN_FLAG
+
 /* Define to 1 if you want to insult the user for entering an incorrect
    password. */
 #undef USE_INSULTS

diff --git a/configure b/configure
index 879bb8599747d6dbaf0e3cf6c565b9307d1666b5..45c29379ec65e01abe54d9f2f39f3499241de598 100755 (executable)
--- a/configure
+++ b/configure
@@ -984,6 +984,7 @@ enable_shell_sets_home
 enable_path_info
 enable_env_debug
 enable_warnings
+enable_admin_flag
 with_selinux
 enable_gss_krb5_ccache_name
 enable_shared
@@ -1638,6 +1639,7 @@ Optional Features:
   --disable-path-info     Print 'command not allowed' not 'command not found'
   --enable-env-debug      Whether to enable environment debugging.
   --enable-warnings       Whether to enable compiler warnings
+  --enable-admin-flag     Whether to create a Ubuntu-style admin flag file
   --enable-gss-krb5-ccache-name
                           Use GSS-API to set the Kerberos V cred cache name
   --enable-shared[=PKGS]  build shared libraries [default=yes]
@@ -5416,6 +5418,21 @@ $as_echo "$as_me: WARNING: Ignoring unknown argument to --enable-warnings: $enab
 fi
 
 
+# Check whether --enable-admin-flag was given.
+if test "${enable_admin_flag+set}" = set; then :
+  enableval=$enable_admin_flag;  case "$enableval" in
+    yes)    $as_echo "#define USE_ADMIN_FLAG 1" >>confdefs.h
+
+           ;;
+    no)            ;;
+    *)     { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Ignoring unknown argument to --enable-admin-flag: $enableval" >&5
+$as_echo "$as_me: WARNING: Ignoring unknown argument to --enable-admin-flag: $enableval" >&2;}
+           ;;
+  esac
+
+fi
+
+
 
 # Check whether --with-selinux was given.
 if test "${with_selinux+set}" = set; then :
@@ -6567,13 +6584,13 @@ if test "${lt_cv_nm_interface+set}" = set; then :
 else
   lt_cv_nm_interface="BSD nm"
   echo "int some_variable = 0;" > conftest.$ac_ext
-  (eval echo "\"\$as_me:6570: $ac_compile\"" >&5)
+  (eval echo "\"\$as_me:6587: $ac_compile\"" >&5)
   (eval "$ac_compile" 2>conftest.err)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:6573: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
+  (eval echo "\"\$as_me:6590: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
   (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:6576: output\"" >&5)
+  (eval echo "\"\$as_me:6593: output\"" >&5)
   cat conftest.out >&5
   if $GREP 'External.*some_variable' conftest.out > /dev/null; then
     lt_cv_nm_interface="MS dumpbin"
@@ -7778,7 +7795,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 7781 "configure"' > conftest.$ac_ext
+  echo '#line 7798 "configure"' > conftest.$ac_ext
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -9171,11 +9188,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9174: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9191: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:9178: \$? = $ac_status" >&5
+   echo "$as_me:9195: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -9510,11 +9527,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9513: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9530: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:9517: \$? = $ac_status" >&5
+   echo "$as_me:9534: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -9615,11 +9632,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9618: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9635: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:9622: \$? = $ac_status" >&5
+   echo "$as_me:9639: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -9670,11 +9687,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9673: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9690: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:9677: \$? = $ac_status" >&5
+   echo "$as_me:9694: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -12037,7 +12054,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12040 "configure"
+#line 12057 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -12133,7 +12150,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12136 "configure"
+#line 12153 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -20487,5 +20504,6 @@ fi
 
 
 
+
 
 

diff --git a/configure.in b/configure.in
index 2182e98c68927857c02a90c7f64c72634b327c27..f54eb79d1a070b8550eb8a26133a2bbb071659c4 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1269,6 +1269,17 @@ AC_ARG_ENABLE(warnings,
   esac
 ])
 
+AC_ARG_ENABLE(admin-flag,
+[AS_HELP_STRING([--enable-admin-flag], [Whether to create a Ubuntu-style admin flag file])],
+[ case "$enableval" in
+    yes)    AC_DEFINE(USE_ADMIN_FLAG)
+           ;;
+    no)            ;;
+    *)     AC_MSG_WARN([Ignoring unknown argument to --enable-admin-flag: $enableval])
+           ;;
+  esac
+])
+
 AC_ARG_WITH(selinux, [AS_HELP_STRING([--with-selinux], [enable SELinux support])],
 [case $with_selinux in
     yes)       SELINUX_USAGE="[[-r role]] [[-t type]] "
@@ -2883,6 +2894,7 @@ AH_TEMPLATE(SEND_MAIL_WHEN_NO_USER, [Define to 1 to send mail when the user is n
 AH_TEMPLATE(SHELL_IF_NO_ARGS, [Define to 1 if you want sudo to start a shell if given no arguments.])
 AH_TEMPLATE(SHELL_SETS_HOME, [Define to 1 if you want sudo to set $HOME in shell mode.])
 AH_TEMPLATE(STUB_LOAD_INTERFACES, [Define to 1 if the code in interfaces.c does not compile for you.])
+AH_TEMPLATE(USE_ADMIN_FLAG, [Define to 1 if you want to create ~/.sudo_as_admin_successful if the user is in the admin group the first time they run sudo.])
 AH_TEMPLATE(USE_INSULTS, [Define to 1 if you want to insult the user for entering an incorrect password.])
 AH_TEMPLATE(USE_STOW, [Define to 1 if you use GNU stow packaging.])
 AH_TEMPLATE(WITHOUT_PASSWD, [Define to avoid using the passwd/shadow file for authentication.])

diff --git a/mkpkg b/mkpkg
index 6d4d6dadde594ce72cfa25f15bd2a1b72266c77c..ae4135681715b832d0c8a481995a134ac14229a1 100755 (executable)
--- a/mkpkg
+++ b/mkpkg
@@ -150,8 +150,14 @@ case "$platform" in
 
        make_opts='docdir=$(datarootdir)/doc/packages/$(PACKAGE_TARNAME)'
        ;;
-    deb*)
+    deb*|ubu*)
        prefix=/usr
+       # If Ubuntu, add --enable-admin-flag
+       case "$platform" in
+           ubu*)
+               configure_opts="${configure_opts}${configure_opts+$tab}--enable-admin-flag${tab}--without-lecture"
+               ;;
+       esac
        # Note, must indent with tabs, not spaces due to IFS trickery
        if test "$flavor" = "ldap"; then
            configure_opts="${configure_opts}${configure_opts+$tab}--with-ldap

diff --git a/sudo.c b/sudo.c
index c00a3094334ad21b5930f9d42b697b7b9106565b..3bccdd34c484fab61e2e2068c257658664c2346e 100644 (file)
--- a/sudo.c
+++ b/sudo.c
@@ -123,6 +123,7 @@ static void set_runasgr                     __P((char *));
 static void set_runaspw                        __P((char *));
 static void show_version               __P((void));
 static struct passwd *get_authpw       __P((void));
+static void create_admin_success_flag  __P((void));
 extern int sudo_edit                   __P((int, char **, char **));
 int run_command __P((const char *path, char *argv[], char *envp[], uid_t uid, int dowait)); /* XXX should be in sudo.h */
 
@@ -449,6 +450,9 @@ main(argc, argv, envp)
     }
 
     if (ISSET(validated, VALIDATE_OK)) {
+       /* Create Ubuntu-style dot file to indicate sudo was successful. */
+       create_admin_success_flag();
+
        /* Finally tell the user if the command did not exist. */
        if (cmnd_status == NOT_FOUND_DOT) {
            audit_failure(NewArgv, "command in current directory");
@@ -1360,3 +1364,40 @@ show_version()
     }
     exit(0);
 }
+
+#ifdef USE_ADMIN_FLAG
+static void
+create_admin_success_flag()
+{
+    struct stat statbuf;
+    char flagfile[PATH_MAX];
+    int fd, n;
+
+    /* Check whether the user is in the admin group. */
+    if (!user_in_group(sudo_user.pw, "admin"))
+       return;
+
+    /* Build path to flag file. */
+    n = snprintf(flagfile, sizeof(flagfile), "%s/.sudo_as_admin_successful",
+       user_dir);
+    if (n <= 0 || n >= sizeof(flagfile))
+       return;
+
+    /* Create admin flag file if it doesn't already exist. */
+    set_perms(PERM_USER);
+    if (stat(flagfile, &statbuf) == 0) {
+       set_perms(PERM_ROOT);
+       return;
+    }
+
+    fd = open(flagfile, O_CREAT|O_WRONLY|O_EXCL, 0644);
+    close(fd);
+    set_perms(PERM_ROOT);
+}
+#else /* !USE_ADMIN_FLAG */
+static void
+create_admin_success_flag()
+{
+    /* STUB */
+}
+#endif /* USE_ADMIN_FLAG */