-# TODO: SSSD support?
#
# Conditional build:
+%if "%{pld_release}" == "ac"
+%bcond_with audit # Linux audit support
+%else
%bcond_without audit # Linux audit support
-%bcond_with kerberos5 # enable Kerberos V support (conflicts with PAM)
-%bcond_without ldap # disable LDAP support
-%bcond_without pam # disable PAM support
-%bcond_without selinux # build without SELinux support
-%bcond_with skey # enable skey (onetime passwords) support (conflicts with PAM)
+%endif
+%bcond_with kerberos5 # Kerberos V support (conflicts with PAM)
+%bcond_without ldap # LDAP support
+%bcond_without pam # PAM support
+%bcond_without selinux # SELinux support
+%bcond_with skey # skey (onetime passwords) support (conflicts with PAM)
+%bcond_without sssd # SSSD support plugin
%bcond_without tests # do not perform "make check"
%if "%{pld_release}" == "ac"
Summary(ru.UTF-8): Позволяет определенным пользователям исполнять команды от имени root
Summary(uk.UTF-8): Дозволяє вказаним користувачам виконувати команди від імені root
Name: sudo
-Version: 1.8.7
-Release: 1
+Version: 1.8.13
+Release: 2
Epoch: 1
License: BSD
Group: Applications/System
Source0: ftp://ftp.sudo.ws/pub/sudo/%{name}-%{version}.tar.gz
-# Source0-md5: a02367090e1dac8d0c1747de1127b6bf
+# Source0-md5: f61577ec330ad1bd504c0e2eec6ea2d8
Source1: %{name}.pamd
Source2: %{name}-i.pamd
Source3: %{name}.logrotate
-Patch0: %{name}-libtool.patch
-Patch1: %{name}-env.patch
-Patch2: config.patch
+Source4: %{name}.tmpfiles
+Patch0: %{name}-env.patch
+Patch1: config.patch
URL: http://www.sudo.ws/sudo/
%{?with_audit:BuildRequires: audit-libs-devel}
BuildRequires: autoconf >= 2.53
+BuildRequires: autoconf-archive
BuildRequires: automake
BuildRequires: bison
BuildRequires: flex
BuildRequires: gettext-devel
+BuildRequires: groff
%{?with_kerberos5:BuildRequires: heimdal-devel}
%{?with_selinux:BuildRequires: libselinux-devel}
-BuildRequires: libtool >= 2:2.2.6b
+BuildRequires: libtool >= 2:2.2.6
%{?with_ldap:BuildRequires: openldap-devel >= 2.3.0}
%{?with_pam:BuildRequires: pam-devel}
BuildRequires: rpm >= 4.4.9-56
%define schemadir /usr/share/openldap/schema
+# uses sudo_warn_*_v1 symbols from binaries
+%define skip_post_check_so libsudo_util.so.*
+
%description
Sudo (superuser do) allows a permitted user to execute a command as
the superuser (real and effective uid and gid are set to 0 and root's
Requires(post,postun): sed >= 4.0
Requires: openldap-servers
Requires: sed >= 4.0
+%if "%{_rpmversion}" >= "5"
+BuildArch: noarch
+%endif
%description -n openldap-schema-sudo
This package contains sudo.schema for openldap.
%patch0 -p1
%patch1 -p1
-%patch2 -p1
+
+! [ -f m4/ax_sys_weak_alias.m4 ] # provide own copy only until it is there
+cp /usr/share/aclocal/ax_sys_weak_alias.m4 m4
%build
%{__mv} install-sh install-custom-sh
--with-env-editor \
--with-ignore-dot \
--with-incpath=/usr/include/security \
- %{?with_kerberos5:--with-kerb5} \
- %{?with_ldap:--with-ldap} \
- %{?with_audit:--with-linux-audit} \
--with-logfac=auth \
--with-logging=both \
--with-loglen=320 \
--with-pam-login \
--with-passprompt="[sudo] password for %%p: " \
--with-secure-path="/bin:/sbin:/usr/bin:/usr/sbin" \
- %{?with_selinux:--with-selinux} \
- %{?with_skey:--with-skey}
+ %{__with kerberos5 kerb5} \
+ %{__with ldap} \
+ %{__with audit linux-audit} \
+ %{__with selinux} \
+ %{__with skey} \
+ %{__with sssd} \
%{__make}
%install
rm -rf $RPM_BUILD_ROOT
-install -d $RPM_BUILD_ROOT{%{_sysconfdir}/{sudoers.d,pam.d,logrotate.d},/var/log/sudo-io,%{_mandir}/man8}
+install -d $RPM_BUILD_ROOT%{_sysconfdir}/{sudoers.d,pam.d,logrotate.d}
+install -d $RPM_BUILD_ROOT{%{systemdtmpfilesdir},/var/log/sudo-io,%{_mandir}/man8}
%{__make} -j1 install \
DESTDIR=$RPM_BUILD_ROOT \
install_uid=$(id -u) \
install_gid=$(id -g) \
sudoers_uid=$(id -u) \
- sudoers_gid=$(id -g)
+ sudoers_gid=$(id -g) \
+ shlib_mode="0755"
cp -p %{SOURCE1} $RPM_BUILD_ROOT/etc/pam.d/sudo
cp -p %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sudo-i
cp -p %{SOURCE3} $RPM_BUILD_ROOT/etc/logrotate.d/sudo
+cp -p %{SOURCE4} $RPM_BUILD_ROOT%{systemdtmpfilesdir}/%{name}.conf
+
+%if "%{pld_release}" == "ac"
+# not present in ac, no point searching it
+%{__sed} -i -e '/pam_keyinit.so/d' $RPM_BUILD_ROOT/etc/pam.d/sudo*
+%endif
touch $RPM_BUILD_ROOT/var/log/sudo
+%{__rm} $RPM_BUILD_ROOT%{_libdir}/sudo/*.la
%{__rm} -r $RPM_BUILD_ROOT%{_docdir}/%{name}
%if %{with ldap}
%service -q ldap restart
fi
-%triggerpostun -- %{name} < 1:1.7.8p2-5
+%triggerpostun -- %{name} < 1:1.8.7-2
+# 1:1.7.8p2-5
mv -f /var/run/sudo/* /var/db/sudo 2>/dev/null
rmdir /var/run/sudo 2>/dev/null || :
+# 1:1.8.7-2
+# add include statement to sudoers
+if ! grep -q '#includedir %{_sysconfdir}/sudoers.d' /etc/sudoers; then
+ echo 'Adding includedir %{_sysconfdir}/sudoers.d to /etc/sudoers'
+ cat <<-EOF >> /etc/sudoers
+ ## Read drop-in files from %{_sysconfdir}/sudoers.d
+ ## (the '#' here does not indicate a comment)
+ #includedir %{_sysconfdir}/sudoers.d
+ EOF
+fi
+
%files -f %{name}.lang
%defattr(644,root,root,755)
-%doc ChangeLog NEWS README doc/{CONTRIBUTORS,HISTORY,LICENSE,TROUBLESHOOTING,UPGRADE,sample.*}
+%doc ChangeLog NEWS README doc/{CONTRIBUTORS,HISTORY,LICENSE,TROUBLESHOOTING,UPGRADE}
+%doc examples/{*.conf,sudoers}
%{?with_ldap:%doc README.LDAP plugins/sudoers/sudoers2ldif}
%attr(550,root,root) %dir %{_sysconfdir}/sudoers.d
%attr(440,root,root) %verify(not md5 mtime size) %config(noreplace) %{_sysconfdir}/sudoers
%attr(755,root,root) %{_bindir}/sudoreplay
%attr(755,root,root) %{_sbindir}/visudo
%dir %{_libdir}/sudo
+%attr(755,root,root) %{_libdir}/sudo/libsudo_util.so.*.*.*
+%attr(755,root,root) %{_libdir}/sudo/libsudo_util.so.0
+%attr(755,root,root) %{_libdir}/sudo/libsudo_util.so
%{?with_selinux:%attr(755,root,root) %{_libdir}/sudo/sesh}
%attr(755,root,root) %{_libdir}/sudo/group_file.so
%attr(755,root,root) %{_libdir}/sudo/sudo_noexec.so
%attr(755,root,root) %{_libdir}/sudo/sudoers.so
%attr(755,root,root) %{_libdir}/sudo/system_group.so
+%dir /var/run/sudo
%{_mandir}/man5/sudoers.5*
%{_mandir}/man5/sudo.conf.5*
%{?with_ldap:%{_mandir}/man5/sudoers.ldap.5*}
%{_mandir}/man8/sudoedit.8*
%{_mandir}/man8/sudoreplay.8*
%{_mandir}/man8/visudo.8*
+%{systemdtmpfilesdir}/%{name}.conf
%attr(600,root,root) %ghost /var/log/sudo
%attr(700,root,root) /var/log/sudo-io
%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/logrotate.d/sudo