Changelog for sudo-1.6.9p23-39.1.x86_64.rpm :
Tue Feb 15 13:00:00 2011 toganmAATTopensuse.org
- updated to 1.6.9p23

* Fixes CVE 2010-0426 CVE 2010-1163 CVE-2010-1646

Wed Aug 20 14:00:00 2008 prusnakAATTsuse.cz
- enabled SELinux support [Fate#303662]
- added comment about !env_reset into sudoers file

Wed Aug 6 14:00:00 2008 prusnakAATTsuse.cz
- updated to 1.6.9p17

* The -i flag should imply resetting the environment, as it did in
sudo version prior to 1.6.9. Also, the -i and -E flags are
mutually exclusive.

* Fixed the configure test for dirfd() under Linux.

* Fixed test for whether -lintl is required to link.

* Changed how sudo handles the child process when sending mail.
This fixes a problem on Linux with the mail_always option.

* Fixed a problem with line continuation characters inside of
quoted strings.
- updated to 1.6.9p16

* There was a missing space before the ldap libraries in the Makefile
for some configurations.

* LDAPS_PORT may not be defined on older Solaris LDAP SDKs.

* If the LDAP server could not be contacted and the user was not present
in sudoers, a syntax error in sudoers was incorrectly reported.

Wed Jul 30 14:00:00 2008 prusnakAATTsuse.cz
- fix note in manpage (added to sudoers.diff) [bnc#404710]
- added commented \'session optional pam_xauth.so\' to pam [bnc#402818]

Tue May 6 14:00:00 2008 prusnakAATTsuse.cz
- do not set PAM_RHOST (pam_rhost.diff) [bnc#386587]

Thu Apr 24 14:00:00 2008 prusnakAATTsuse.cz
- updated to 1.6.9p15

* updated libtool to version 1.5.26

* fixed printing of default SELinux role and type in -V mode

* the HOME environment variable is once again preserved by default,
as per the documentation

Wed Mar 19 13:00:00 2008 prusnakAATTsuse.cz
- updated to 1.6.9p14

* Moved LDAP options into a table for simplified parsing/setting.

* Fixed a problem with how some LDAP options were being applied.

* Added support for connecting directly to LDAP servers via SSL
in addition to the existing start_tls support.

* Fixed a compilation problem on SCO related to how they
store the high resolution timestamps in struct stat.

* Avoid checking the passwd file group multiple times
in the LDAP query when the user\'s passwd group is also
listed in the supplemental group vector.

* The URI specifier can now be used in ldap.conf even when
the LDAP SDK doesn\'t support ldap_initialize().

* New %p prompt escape that expands to the user whose password
is being prompted, as specified by the rootpw, targetpw and
runaspw sudoers flags. Based on a diff from Patrick Schoenfeld.

* Added a configure check for the ber_set_option() function.

* Fixed a compilation problem with the HP-UX K&R C compiler.

* Revamped the Kerberos 5 ticket verification code.

* Added support for the checkpeer ldap.conf variable for
netscape-based LDAP SDKs.

* Fixed a problem where an incomplete password could be echoed
to the screen if there was a read timeout.

* Sudo will now set the nproc resource limit to unlimited on Linux
systems to work around Linux\'s setuid() resource limit semantics.
On PAM systems the resource limits will be reset by pam_limits.so
before the command is executed.

* SELinux support that can be used to implement role based access
control (RBAC). A role and (optional) type may be specified
in sudoers or on the command line. These are then used in the
security context that the command is run as.

* Fixed a Kerberos 5 compilation problem with MIT Kerberos.

* Fixed an invalid assumption in the PAM conversation function
introduced in version 1.6.9p9. The conversation function may
be called for non-password reading purposes as well.

* Fixed freeing an uninitialized pointer in -l mode, introduced in
version 1.6.9p13.

* Check /etc/sudoers after LDAP even if the user was found in LDAP.
This allows Defaults options in /etc/sudoers to take effect.

* Add missing checks for enforcing mode in SELinux RBAC mode.
- dropped obsoleted patch:

* prompt.patch (included in update)

Tue Dec 4 13:00:00 2007 prusnakAATTsuse.cz
- updated to 1.6.9p9

* the ALL command in sudoers now implies SETENV permissions

* the command search is now performed using the target user\'s
auxiliary group vector too

* when determining if the PAM prompt is the default \"Password: \",
compare the localized version if possible

* added passprompt_override flag to sudoers to cause sudo\'s prompt
to be used in all cases, also set when the -p flag is used

Tue Nov 6 13:00:00 2007 prusnakAATTsuse.cz
- updated to 1.6.9p8

* fixed a bug where a sudoers entry with no runas user specified
was treated differently from a line with the default runas user
explicitly specified

Tue Oct 30 13:00:00 2007 prusnakAATTsuse.cz
- updated to 1.6.9p7

* go back to using TCSAFLUSH instead of TCSADRAIN when turning off
echo during password reading

* fixed a configure bug that was preventing the addition of -lutil
for login.conf support on FreeBSD and NetBSD

* add configure check for struct in6_addr since some systems define
AF_INET6 but have no real IPv6 support

Wed Oct 10 14:00:00 2007 prusnakAATTsuse.cz
- update to 1.6.9p6

* worked around bugs in the session support of some PAM
implementations

* the full tty path is now passed to PAM as well

* sudo now only prints the password prompt if the process is in
the foreground

* inttypes.h is now included when appropriate if it is present

* simplified alias allocation in the parser

Tue Sep 25 14:00:00 2007 prusnakAATTsuse.cz
- update to 1.6.9p5

* fixed a bug related to supplemental group matching

* added IPv6 support from YOSHIFUJI Hideaki

* fixed the sudo_noexec installation path

* fixed a compilation error on old K&R-style compilers

* fixed a bug in the IP address matching introduced by the IPV6 merge

* for \"visudo -f file\" we now use the permissions of the original file
and not the hard-coded sudoers owner/group/mode
(this makes it possible to use visudo with a revision control system)

* fixed sudoedit when used on a non-existent file

* regenerated configure using autoconf 2.6.1 and libtool 1.5.24

* groups and netgroups are now valid in an LDAP sudoRunas statement
- dropped obsolete patches:

* groupmatch.patch (included in update)

Tue Aug 28 14:00:00 2007 prusnakAATTsuse.cz
- build --without-secure-path
- hardcoded secure path changed to /usr/sbin:/bin:/usr/bin:/sbin
(secure_path.diff)
- user can now add PATH variable to env_keep in /etc/sudoers

Tue Aug 14 14:00:00 2007 prusnakAATTsuse.cz
- added XDG_SESSION_COOKIE to env_keep variables [#298943]
- fixed supplemental group matching (groupmatch.patch)

Sat Aug 11 14:00:00 2007 schwabAATTsuse.de
- Avoid command line parsing bug in autoconf < 2.59c.

Tue Jul 31 14:00:00 2007 prusnakAATTsuse.cz
- updated to 1.6.9p2

* fixed a crash in the error logging function

* worked around a crash when no tty was present in some PAM
implementations

* fixed updating of the saved environment when the environ pointer
gets changed out from underneath us

Tue Jul 24 14:00:00 2007 prusnakAATTsuse.cz
- updated to 1.6.9

* added to the list of variables to remove from the environment

* fixed a Kerberos V security issue that could allow a user to
authenticate using a fake KDC

* PAM is now the default on systems where it is supported

* removed POSIX saved uid use; the stay_setuid option now requires
the setreuid() or setresuid() functions to work

* fixed fd leak when lecture file option is enabled

* PAM fixes

* security fix for Kerberos5

* fixed securid5 authentication

* added fcntl F_CLOSEM support to closefrom()

* sudo now uses the supplemental group vector for matching

* added more environment variables to remove by default

* mail from sudo now includes an Auto-Submitted: auto-generated header

* reworked the environment handling code

* remove the --with-execv option, it was not useful

* use TCSADRAIN instead of TCSAFLUSH in tgetpass() since some OSes
have issues with TCSAFLUSH

* use glob(3) instead of fnmatch(3) for matching pathnames

* reworked the syslog long line splitting code based on changes
from Eygene Ryabinkin

* visudo will now honor command line arguments in the EDITOR or VISUAL
environment variables if env_editor is enabled

* LDAP now honors rootbinddn, timelimit and bind_timelimit in /etc/ldap.conf

* For LDAP, do a sub tree search instead of a base search (one level in
the tree only) for sudo right objects

* env_reset option is now enabled by default

* moved LDAP schema data into separate files

* sudo no longer assumes that gr_mem in struct group is non-NULL

* added support for setting environment variables on the command line
if the command has the SETENV attribute set in sudoers

* added a -E flag to preserve the environment if the SETENV attribute
has been set

* sudoers2ldif script now parses Runas users

* -- flag now behaves as documented

* sudo -k/-K no longer cares if the timestamp is in the future

* when searching for the command, sudo now uses the effective gid of
the runas user

* sudo no longer updates the timestamp if not validated by sudoers

* now rebuild environment regardless of how sudo was invoked

* more accurate usage() when called as sudoedit

* command line environment variables are now treated like normal
environment variables unless the SETENV tag is set

* better explanation of environment handling in the sudo man page
- changed \'/usr/bin/env perl\' to \'/usr/bin/env\' in sudoers2ldif
script (env.diff)
- dropped obsoleted patches:

* sudo-1.6.8p12-conf.diff

* sudo-1.6.8p12-configure.diff

Tue Jul 17 14:00:00 2007 prusnakAATTsuse.cz
- added note about special input method variables into /etc/sudoers
(sudoers.diff) [#222728]

Fri Jan 26 13:00:00 2007 prusnakAATTsuse.cz
- packaged script sudoers2ldif

* can be used for importing /etc/sudoers to LDAP

* more info at http://www.sudo.ws/sudo/readme_ldap.html

Wed Jan 24 13:00:00 2007 prusnakAATTsuse.cz
- added sudoers permission change to %post section of spec file

Thu Nov 30 13:00:00 2006 prusnakAATTsuse.cz
- package /etc/sudoers as 0440 [Fate#300934]

Wed Nov 29 13:00:00 2006 prusnakAATTsuse.cz
- protect locale-related environment variables from resetting (sudoers.diff) [#222728]

Wed Oct 4 14:00:00 2006 mjancarAATTsuse.cz
- enable LDAP support (#159774)