Todd C. Miller [Thu, 19 Jan 2012 16:08:45 +0000 (11:08 -0500)]
For "sudo -g" prepend the specified group ID to the beginning of
the groups list. This matches BSD convention where the effective
gid is the first entry in the group list. This is required on newer
FreeBSD where the effective gid is not tracked separately and thus
setgroups() changes the egid if this convention is not followed.
Fixes bug #532
Todd C. Miller [Thu, 19 Jan 2012 16:03:22 +0000 (11:03 -0500)]
For "sudo -g" prepend the specified group ID to the beginning of
the groups list. This matches BSD convention where the effective
gid is the first entry in the group list. This is required on newer
FreeBSD where the effective gid is not tracked separately and thus
setgroups() changes the egid if this convention is not followed.
Fixes bug #532
Todd C. Miller [Tue, 17 Jan 2012 15:28:42 +0000 (10:28 -0500)]
When not logging I/O, use a signal handler that only forwards SIGINT,
SIGQUIT and SIGHUP when they are user-generated signals. Fixes a
race in the non-I/O logging path where the command may receive two
keyboard-generated signals; one from the kernel and one from the
sudo process.
Todd C. Miller [Tue, 17 Jan 2012 15:28:21 +0000 (10:28 -0500)]
Only run compat regress tests on compat objects we actually build.
Fixes "make check" in the compat dir for systems that don't implement
character classes in fnmatch() or glob(). Bug #531
Todd C. Miller [Tue, 17 Jan 2012 15:27:33 +0000 (10:27 -0500)]
When not logging I/O, use a signal handler that only forwards SIGINT,
SIGQUIT and SIGHUP when they are user-generated signals. Fixes a
race in the non-I/O logging path where the command may receive two
keyboard-generated signals; one from the kernel and one from the
sudo process.
Todd C. Miller [Mon, 16 Jan 2012 15:40:11 +0000 (10:40 -0500)]
Only run compat regress tests on compat objects we actually build.
Fixes "make check" in the compat dir for systems that don't implement
character classes in fnmatch() or glob(). Bug #531
Todd C. Miller [Fri, 13 Jan 2012 14:49:48 +0000 (09:49 -0500)]
Include parent directories in case they don't already exist. This
fixes a directory permissions problem with the AIX package when the
/usr/local directories don't already exist.
Todd C. Miller [Fri, 13 Jan 2012 14:49:20 +0000 (09:49 -0500)]
Include parent directories in case they don't already exist. This
fixes a directory permissions problem with the AIX package when the
/usr/local directories don't already exist.
Todd C. Miller [Thu, 12 Jan 2012 21:44:07 +0000 (16:44 -0500)]
Add a check for devname() returning a fully-qualified pathname.
None of the devname() implementations do this today but you never
know when this might change.
Todd C. Miller [Thu, 12 Jan 2012 12:50:40 +0000 (07:50 -0500)]
Add a check for devname() returning a fully-qualified pathname.
None of the devname() implementations do this today but you never
know when this might change.
Todd C. Miller [Wed, 11 Jan 2012 20:40:42 +0000 (15:40 -0500)]
The device name returned by devname() does not include the /dev/
prefix so we need to add it ourselves. Also add debug warning if
KERN_PROC sysctl fails or devname() can't resolve the tty device
to a name.
Todd C. Miller [Fri, 6 Jan 2012 18:26:10 +0000 (13:26 -0500)]
Do not include GLOB_MARK in the flags we pass to glob(3). Fixes a
bug where a pattern like "/usr/*" include /usr/bin/ in the results,
which would be incorrectly be interpreted as if the sudoers file
had specified a directory. From Vitezslav Cizek.
Todd C. Miller [Fri, 6 Jan 2012 18:25:57 +0000 (13:25 -0500)]
Add --enable-kerb5-instance configure option to allow people using
Kerberos V authentication to use a custom instance. Adapted from
a diff by Michael E Burr.
Todd C. Miller [Thu, 5 Jan 2012 20:54:00 +0000 (15:54 -0500)]
Do not include GLOB_MARK in the flags we pass to glob(3). Fixes a
bug where a pattern like "/usr/*" include /usr/bin/ in the results,
which would be incorrectly be interpreted as if the sudoers file
had specified a directory. From Vitezslav Cizek.
Todd C. Miller [Thu, 5 Jan 2012 20:39:05 +0000 (15:39 -0500)]
Add --enable-kerb5-instance configure option to allow people using
Kerberos V authentication to use a custom instance. Adapted from
a diff by Michael E Burr.