]>
Commit | Line | Data |
---|---|---|
7612bda9 | 1 | # |
7df1c00d | 2 | # Conditional build: |
9baa7f8b ER |
3 | %if "%{pld_release}" == "ac" |
4 | %bcond_with audit # Linux audit support | |
5 | %else | |
95abd744 | 6 | %bcond_without audit # Linux audit support |
9baa7f8b | 7 | %endif |
30831543 JB |
8 | %bcond_with kerberos5 # Kerberos V support (conflicts with PAM) |
9 | %bcond_without ldap # LDAP support | |
10 | %bcond_without pam # PAM support | |
11 | %bcond_without selinux # SELinux support | |
12 | %bcond_with skey # skey (onetime passwords) support (conflicts with PAM) | |
13 | %bcond_without sssd # SSSD support plugin | |
8e94d95e | 14 | %bcond_without tests # do not perform "make check" |
ce01611a | 15 | %bcond_without apparmor # AppArmor support |
14b70151 ER |
16 | |
17 | %if "%{pld_release}" == "ac" | |
18 | %define pam_ver 0.80.1 | |
19 | %else | |
20 | %define pam_ver 0.99.7.1 | |
21 | %endif | |
22 | ||
503af0bc | 23 | Summary: Allows command execution as root for specified users |
3e9a1f39 ER |
24 | Summary(es.UTF-8): Permite que usuarios específicos ejecuten comandos como se fueran el root |
25 | Summary(ja.UTF-8): 指定ユーザに制限付のroot権限を許可する | |
26 | Summary(pl.UTF-8): Umożliwia wykonywanie poleceń jako root dla konkretnych użytkowników | |
27 | Summary(pt_BR.UTF-8): Permite que usuários específicos executem comandos como se fossem o root | |
28 | Summary(ru.UTF-8): Позволяет определенным пользователям исполнять команды от имени root | |
29 | Summary(uk.UTF-8): Дозволяє вказаним користувачам виконувати команди від імені root | |
503af0bc | 30 | Name: sudo |
ce01611a | 31 | # please see docs/UPGRADE.md for important changes each time updating sudo |
53dc7269 | 32 | Version: 1.9.14p1 |
ed6c0921 | 33 | Release: 1 |
f96f7820 | 34 | Epoch: 1 |
6e8425a9 | 35 | License: BSD |
e71b3bd8 | 36 | Group: Applications/System |
de00551e | 37 | Source0: https://www.sudo.ws/dist/%{name}-%{version}.tar.gz |
53dc7269 | 38 | # Source0-md5: 25b059d132f163d5d3acdc1672f36b05 |
e71b3bd8 | 39 | Source1: %{name}.pamd |
d2bc6fd7 | 40 | Source2: %{name}-i.pamd |
4be73cd1 JB |
41 | Patch0: %{name}-env.patch |
42 | Patch1: config.patch | |
605c7cc4 | 43 | Patch2: %{name}-sh.patch |
2c7dece1 | 44 | URL: http://www.sudo.ws/sudo/ |
95abd744 | 45 | %{?with_audit:BuildRequires: audit-libs-devel} |
2a838463 | 46 | BuildRequires: autoconf >= 2.69 |
d9c59312 | 47 | BuildRequires: autoconf-archive |
2c255aa3 | 48 | BuildRequires: automake |
95abd744 JB |
49 | BuildRequires: bison |
50 | BuildRequires: flex | |
a2bbf8a6 | 51 | BuildRequires: gettext-tools |
d9c59312 | 52 | BuildRequires: groff |
68ebed37 | 53 | %{?with_kerberos5:BuildRequires: heimdal-devel} |
ce01611a | 54 | %{?with_apparmor:BuildRequires: libapparmor-devel} |
50eae64a | 55 | %{?with_selinux:BuildRequires: libselinux-devel} |
d6064043 | 56 | BuildRequires: libtool >= 2:2.2.6 |
b96e1495 | 57 | %{?with_ldap:BuildRequires: openldap-devel >= 2.3.0} |
c4cb6c42 | 58 | %{?with_pam:BuildRequires: pam-devel} |
14b70151 | 59 | BuildRequires: rpm >= 4.4.9-56 |
2893ac93 | 60 | BuildRequires: rpm-build >= 4.6 |
bb80494b | 61 | BuildRequires: rpmbuild(macros) >= 1.752 |
50eae64a | 62 | %{?with_skey:BuildRequires: skey-devel >= 2.2-11} |
63a8eea5 | 63 | BuildRequires: zlib-devel |
5c9f727f | 64 | %if "%{pld_release}" != "ac" |
b771ccac JB |
65 | # uses /run |
66 | Requires: FHS >= 3.0 | |
5c9f727f | 67 | %endif |
14b70151 | 68 | Requires: pam >= %{pam_ver} |
f6636f28 | 69 | Obsoletes: cu-sudo < 1.6 |
7df1c00d | 70 | BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n) |
60f3cbe5 | 71 | |
02cd30f3 ER |
72 | %define schemadir /usr/share/openldap/schema |
73 | ||
4be73cd1 JB |
74 | # uses sudo_warn_*_v1 symbols from binaries |
75 | %define skip_post_check_so libsudo_util.so.* | |
76 | ||
60f3cbe5 | 77 | %description |
9739caca | 78 | Sudo (superuser do) allows a permitted user to execute a command as |
79 | the superuser (real and effective uid and gid are set to 0 and root's | |
80 | group as set in the passwd file respectively). | |
b0356f24 | 81 | |
60f3cbe5 | 82 | Sudo determines who is an authorized user by consulting the file |
9739caca | 83 | /etc/sudoers. By giving sudo the -v flag a user can update the time |
84 | stamp without running a command. The password prompt itself will also | |
85 | time out if the password is not entered with N minutes (again, this is | |
86 | defined at installation time and defaults to 5 minutes). | |
60f3cbe5 | 87 | |
85bc7a24 | 88 | %description -l es.UTF-8 |
485535e1 | 89 | Sudo (superuser do) permite que el administrador del sistema otorga a |
90 | ciertos usuarios (o grupos de usuarios) la habilidad para ejecutar | |
91 | algunos (o todos) comandos como root, registrando todos los comandos y | |
92 | argumentos. Sudo opera en una base por comando, no siendo un | |
93 | substituto para la shell. | |
94 | ||
85bc7a24 | 95 | %description -l ja.UTF-8 |
bec81e97 ER |
96 | sudo (superuser do) |
97 | とはシステム管理者が、信用できるユーザ(またはグループ)に対 | |
98 | して、いくつか(もしくは全て)のコマンドを root | |
99 | として実行できるよう、そのコマン | |
100 | ドの実行履歴のログをとりつつ許可する仕組みです。sudo | |
101 | はコマンド一行単位で動作 | |
85bc7a24 JR |
102 | します。シェルの置き換えではありません。以下の機能を内蔵しています。ホスト単位 |
103 | で、そのコマンドを実行可能なユーザを制限する機能、各コマンドについての(誰がな | |
bec81e97 ER |
104 | にを実行したかの痕跡を残すための)豊富なロギング機能、sudo |
105 | コマンドのタイムアウ | |
106 | ト時間を設定可能、複数のマシンで同一の設定ファイル(sudoers)を共有する機能、が | |
107 | あります。 | |
c34eaf08 | 108 | |
85bc7a24 JR |
109 | %description -l pl.UTF-8 |
110 | Sudo (superuser do) umożliwia wykonywanie konkretnych poleceń jako | |
111 | root dla wyspecyfikowanych użytkowników (rzeczywiste i efektywne | |
112 | uid/gid podczas wykonywania tych programów jest 0). To kto może | |
113 | wykonywać konkretne polecenia i w jaki sposób ma być autoryzowany jest | |
9739caca | 114 | opisane w pliku /etc/sudoers. |
60f3cbe5 | 115 | |
85bc7a24 JR |
116 | %description -l pt_BR.UTF-8 |
117 | Sudo (superuser do) permite que o administrador do sistema dê a certos | |
118 | usuários (ou grupos de usuários) a habilidade para rodar alguns (ou | |
485535e1 | 119 | todos) comandos como root, registrando todos os comandos e argumentos. |
85bc7a24 | 120 | Sudo opera numa base por comando, não sendo um substituto para a |
485535e1 | 121 | shell. |
122 | ||
85bc7a24 JR |
123 | %description -l ru.UTF-8 |
124 | Sudo (superuser do) позволяет системному администратору предоставлять | |
125 | определенным пользователям (или их группам) возможность исполнять | |
126 | некоторые (или все) команды с правами root, при этом протоколируя все | |
127 | команды и аргументы. Sudo работает с отдельными командами, это не | |
128 | замена командной оболочки (shell). Некоторые из возможностей sudo: | |
129 | ограничение того, какие команды пользователь может запускать в | |
130 | зависимости от хоста; полное протоколирование каждой команды; | |
131 | настраиваемое время, на протяжении которого sudo помнит пароль; | |
132 | использование одного конфигурационного файла (sudoers) на многих | |
133 | машинах. | |
c34eaf08 | 134 | |
85bc7a24 JR |
135 | %description -l uk.UTF-8 |
136 | Sudo (superuser do) дозволяє системному адміністраторові надати певним | |
137 | користувачам (чи їх групам) можливість виконувати деякі (чи всі) | |
138 | команди з правами root, при цьому протоколюючи всі команди та | |
139 | аргументи. Sudo працює з окремими командами, це не заміна командної | |
140 | оболонки (shell). Деякі з можливостей sudo: обмеження того, які | |
141 | команди користувач може запускати в залежності від хоста; повне | |
142 | протоколювання кожної команди; настроюваний час, на протязі якого sudo | |
143 | пам'ятає пароль; використання одного конфігураційного файлу (sudoers) | |
144 | на багатьох машинах. | |
c34eaf08 | 145 | |
9f41d987 JB |
146 | %package devel |
147 | Summary: Header file for sudo plugins development | |
148 | Summary(pl.UTF-8): Plik nagłówkowy do tworzenia wtyczek dla sudo | |
149 | Group: Development/Libraries | |
150 | ||
151 | %description devel | |
152 | Header file for sudo plugins development. | |
153 | ||
154 | %description devel -l pl.UTF-8 | |
155 | Plik nagłówkowy do tworzenia wtyczek dla sudo. | |
156 | ||
02cd30f3 ER |
157 | %package -n openldap-schema-sudo |
158 | Summary: Sudo LDAP schema | |
3587fdcd | 159 | Summary(pl.UTF-8): Schemat bazy sudo dla LDAP |
02cd30f3 ER |
160 | Group: Networking/Daemons |
161 | Requires(post,postun): sed >= 4.0 | |
162 | Requires: openldap-servers | |
163 | Requires: sed >= 4.0 | |
50effa53 | 164 | BuildArch: noarch |
02cd30f3 ER |
165 | |
166 | %description -n openldap-schema-sudo | |
167 | This package contains sudo.schema for openldap. | |
168 | ||
169 | %description -n openldap-schema-sudo -l pl.UTF-8 | |
170 | Ten pakiet zawiera sudo.schema dla pakietu openldap. | |
171 | ||
bb80494b JB |
172 | %package logsrvd |
173 | Summary: High-performance log server for sudo | |
174 | Summary(pl.UTF-8): Wysoko wydajny serwer logujący dla sudo | |
d8dd1d78 AM |
175 | Group: Daemons |
176 | Requires: %{name} = %{epoch}:%{version}-%{release} | |
177 | ||
bb80494b JB |
178 | %description logsrvd |
179 | sudo-logsrvd is a high-performance log server that accepts event | |
d8dd1d78 AM |
180 | and I/O logs from sudo. It can be used to implement centralized |
181 | logging of sudo logs. | |
182 | ||
bb80494b JB |
183 | %description logsrvd -l pl.UTF-8 |
184 | sudo-logsrvd to wysoko wydajny serwer logujący przyjmyjący logi | |
185 | zdarzeń i we/wy z sudo. Może byc używany do zaimplementowania | |
186 | scentralizowanego logowania z sudo. | |
187 | ||
60f3cbe5 | 188 | %prep |
5a7b980b | 189 | %setup -q |
7df1c00d | 190 | # only local macros |
605c7cc4 | 191 | %{__mv} aclocal.m4 acinclude.m4 |
3da66796 | 192 | # do not load libtool macros from acinclude |
1e0a7c25 | 193 | cp -p acinclude.m4 acinclude.m4.orig |
3da66796 | 194 | %{__sed} -i -e '/Pull in libtool macros/,$d' acinclude.m4 |
7df1c00d | 195 | |
bd33fb9b | 196 | %patch0 -p1 |
7df1c00d | 197 | %patch1 -p1 |
605c7cc4 | 198 | %patch2 -p1 |
7df1c00d | 199 | |
574d43c4 | 200 | ! [ -f m4/ax_sys_weak_alias.m4 ] # provide own copy only until it is there |
0c7914d4 | 201 | cp %{_aclocaldir}/ax_sys_weak_alias.m4 m4 |
574d43c4 | 202 | |
60f3cbe5 | 203 | %build |
7df1c00d | 204 | %{__libtoolize} |
0b8ffdaf | 205 | cp -f /usr/share/automake/config.sub . |
dc47c82d | 206 | %{__aclocal} -I m4 |
7df1c00d | 207 | %{__autoconf} |
2e2fb1cb | 208 | %configure \ |
7df1c00d | 209 | NROFFPROG=nroff \ |
95abd744 | 210 | --enable-zlib=system \ |
ce01611a | 211 | %{__with_without apparmor} \ |
95abd744 JB |
212 | --with-env-editor \ |
213 | --with-ignore-dot \ | |
a0533340 | 214 | --with-incpath=/usr/include/security \ |
cec6feeb AM |
215 | --with-logfac=authpriv \ |
216 | --with-logging=syslog \ | |
95abd744 | 217 | --with-loglen=320 \ |
213866f0 | 218 | --with-logpath=/var/log/sudo \ |
95abd744 JB |
219 | --with-long-otp-prompt \ |
220 | --with-pam \ | |
221 | --with-pam-login \ | |
42163b23 | 222 | --with-passprompt="[sudo] password for %%p: " \ |
a0533340 | 223 | --with-secure-path="/bin:/sbin:/usr/bin:/usr/sbin" \ |
cec6feeb | 224 | --with-tty-tickets \ |
0c7914d4 | 225 | --with-exampledir=%{_examplesdir}/%{name}-%{version} \ |
2f5cbf09 | 226 | --enable-tmpfiles.d=%{systemdtmpfilesdir} \ |
9ca9a4a5 ER |
227 | %{__with kerberos5 kerb5} \ |
228 | %{__with ldap} \ | |
229 | %{__with audit linux-audit} \ | |
230 | %{__with selinux} \ | |
231 | %{__with skey} \ | |
232 | %{__with sssd} \ | |
60f3cbe5 | 233 | |
325b84c6 | 234 | %{__make} |
60f3cbe5 | 235 | |
7cd93059 AM |
236 | %{?with_tests:%{__make} check} |
237 | ||
60f3cbe5 | 238 | %install |
239 | rm -rf $RPM_BUILD_ROOT | |
605c7cc4 | 240 | install -d $RPM_BUILD_ROOT{/etc/pam.d,/var/log/sudo-io} |
3da66796 | 241 | |
af50df21 SS |
242 | %{__make} -j1 install \ |
243 | DESTDIR=$RPM_BUILD_ROOT \ | |
02cd30f3 ER |
244 | install_uid=$(id -u) \ |
245 | install_gid=$(id -g) \ | |
246 | sudoers_uid=$(id -u) \ | |
5972204f MB |
247 | sudoers_gid=$(id -g) \ |
248 | shlib_mode="0755" | |
60f3cbe5 | 249 | |
926d4d83 ER |
250 | %{__rm} $RPM_BUILD_ROOT%{_sysconfdir}/sudoers.dist |
251 | ||
63a8eea5 ER |
252 | cp -p %{SOURCE1} $RPM_BUILD_ROOT/etc/pam.d/sudo |
253 | cp -p %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sudo-i | |
e39eae9c | 254 | |
1522848b ER |
255 | %if "%{pld_release}" == "ac" |
256 | # not present in ac, no point searching it | |
257 | %{__sed} -i -e '/pam_keyinit.so/d' $RPM_BUILD_ROOT/etc/pam.d/sudo* | |
258 | %endif | |
259 | ||
3e34f990 | 260 | %{__rm} $RPM_BUILD_ROOT%{_libexecdir}/sudo/*.la |
63a8eea5 | 261 | %{__rm} -r $RPM_BUILD_ROOT%{_docdir}/%{name} |
7df1c00d | 262 | |
02cd30f3 ER |
263 | %if %{with ldap} |
264 | install -d $RPM_BUILD_ROOT%{schemadir} | |
ce01611a | 265 | cp -p docs/schema.OpenLDAP $RPM_BUILD_ROOT%{schemadir}/sudo.schema |
02cd30f3 | 266 | %endif |
206acba3 | 267 | |
9f41d987 JB |
268 | # sudo,sudoers domains |
269 | %find_lang %{name} --all-name | |
270 | ||
60f3cbe5 | 271 | %clean |
272 | rm -rf $RPM_BUILD_ROOT | |
273 | ||
02cd30f3 ER |
274 | %post -n openldap-schema-sudo |
275 | %openldap_schema_register %{schemadir}/sudo.schema -d core | |
276 | %service -q ldap restart | |
63a8eea5 | 277 | %banner -o -e openldap-schema-sudo <<'EOF' |
02cd30f3 ER |
278 | NOTE: |
279 | In order for sudoRole LDAP queries to be efficient, the server must index | |
280 | the attribute 'sudoUser', e.g. | |
281 | ||
282 | # Indices to maintain | |
283 | index sudoUser eq | |
284 | EOF | |
02cd30f3 ER |
285 | |
286 | %postun -n openldap-schema-sudo | |
287 | if [ "$1" = "0" ]; then | |
288 | %openldap_schema_unregister %{schemadir}/sudo.schema | |
289 | %service -q ldap restart | |
290 | fi | |
291 | ||
6519a971 | 292 | %triggerpostun -- %{name} < 1:1.8.7-2 |
6519a971 | 293 | # 1:1.8.7-2 |
037b070e ER |
294 | # add include statement to sudoers |
295 | if ! grep -q '#includedir %{_sysconfdir}/sudoers.d' /etc/sudoers; then | |
296 | echo 'Adding includedir %{_sysconfdir}/sudoers.d to /etc/sudoers' | |
297 | cat <<-EOF >> /etc/sudoers | |
298 | ## Read drop-in files from %{_sysconfdir}/sudoers.d | |
299 | ## (the '#' here does not indicate a comment) | |
300 | #includedir %{_sysconfdir}/sudoers.d | |
301 | EOF | |
302 | fi | |
303 | ||
9f41d987 | 304 | %files -f %{name}.lang |
503af0bc | 305 | %defattr(644,root,root,755) |
ce01611a JP |
306 | %doc ChangeLog LICENSE.md NEWS README.md docs/{CONTRIBUTORS,HISTORY,TROUBLESHOOTING,UPGRADE}.md |
307 | %{?with_ldap:%doc README.LDAP.md} | |
d110a738 | 308 | %attr(550,root,root) %dir %{_sysconfdir}/sudoers.d |
50eae64a | 309 | %attr(440,root,root) %verify(not md5 mtime size) %config(noreplace) %{_sysconfdir}/sudoers |
d8dd1d78 | 310 | %attr(640,root,root) %verify(not md5 mtime size) %config(noreplace) %{_sysconfdir}/sudo.conf |
50eae64a | 311 | %attr(600,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/sudo |
d2bc6fd7 | 312 | %attr(600,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/sudo-i |
605c7cc4 | 313 | %attr(755,root,root) %{_bindir}/cvtsudoers |
7df1c00d JB |
314 | %attr(4755,root,root) %{_bindir}/sudo |
315 | %attr(4755,root,root) %{_bindir}/sudoedit | |
3da66796 | 316 | %attr(755,root,root) %{_bindir}/sudoreplay |
7df1c00d | 317 | %attr(755,root,root) %{_sbindir}/visudo |
3e34f990 JB |
318 | %dir %{_libexecdir}/sudo |
319 | %attr(755,root,root) %{_libexecdir}/sudo/libsudo_util.so.*.*.* | |
320 | %attr(755,root,root) %{_libexecdir}/sudo/libsudo_util.so.0 | |
321 | %attr(755,root,root) %{_libexecdir}/sudo/libsudo_util.so | |
322 | %{?with_selinux:%attr(755,root,root) %{_libexecdir}/sudo/sesh} | |
d8dd1d78 | 323 | %attr(755,root,root) %{_libexecdir}/sudo/audit_json.so |
3e34f990 | 324 | %attr(755,root,root) %{_libexecdir}/sudo/group_file.so |
0297c142 | 325 | %attr(755,root,root) %{_libexecdir}/sudo/sudo_intercept.so |
3e34f990 JB |
326 | %attr(755,root,root) %{_libexecdir}/sudo/sudo_noexec.so |
327 | %attr(755,root,root) %{_libexecdir}/sudo/sudoers.so | |
328 | %attr(755,root,root) %{_libexecdir}/sudo/system_group.so | |
605c7cc4 | 329 | %{_mandir}/man1/cvtsudoers.1* |
ce01611a | 330 | %{_mandir}/man5/sudo_plugin.5* |
ff6a027f | 331 | %{_mandir}/man5/sudoers.5* |
605c7cc4 | 332 | %{_mandir}/man5/sudoers_timestamp.5* |
7cd93059 | 333 | %{_mandir}/man5/sudo.conf.5* |
14b70151 | 334 | %{?with_ldap:%{_mandir}/man5/sudoers.ldap.5*} |
938895e3 | 335 | %{_mandir}/man8/sudo.8* |
ff6a027f | 336 | %{_mandir}/man8/sudoedit.8* |
3da66796 | 337 | %{_mandir}/man8/sudoreplay.8* |
ff6a027f | 338 | %{_mandir}/man8/visudo.8* |
15ce7c31 | 339 | %{systemdtmpfilesdir}/%{name}.conf |
0c7914d4 | 340 | %{_examplesdir}/%{name}-%{version} |
63a8eea5 | 341 | %attr(700,root,root) /var/log/sudo-io |
67f231a2 | 342 | %attr(700,root,root) %dir /var/db/sudo |
02cd30f3 | 343 | |
9f41d987 JB |
344 | %files devel |
345 | %defattr(644,root,root,755) | |
346 | %{_includedir}/sudo_plugin.h | |
347 | ||
dd41247c | 348 | %if %{with ldap} |
02cd30f3 ER |
349 | %files -n openldap-schema-sudo |
350 | %defattr(644,root,root,755) | |
3587fdcd | 351 | %{schemadir}/sudo.schema |
dd41247c | 352 | %endif |
d8dd1d78 AM |
353 | |
354 | %files logsrvd | |
355 | %defattr(644,root,root,755) | |
356 | %attr(640,root,root) %verify(not md5 mtime size) %config(noreplace) %{_sysconfdir}/sudo_logsrvd.conf | |
357 | %attr(755,root,root) %{_sbindir}/sudo_logsrvd | |
358 | %attr(755,root,root) %{_sbindir}/sudo_sendlog | |
359 | %{_mandir}/man5/sudo_logsrv.proto.5* | |
360 | %{_mandir}/man5/sudo_logsrvd.conf.5* | |
361 | %{_mandir}/man8/sudo_logsrvd.8* | |
362 | %{_mandir}/man8/sudo_sendlog.8* |