f30cb74fef
To fix below CVE, we will use sudo-1.8.23-4.el7_7.1.src.rpm And we have to update some patches according to new srpm. https://lists.centos.org/pipermail/centos-announce/2019-October/023499.html CVE bug: CVE-2019-14287: sudo: can bypass certain policy blacklists Closes-Bug: 1852825 Depends-On: https://review.opendev.org/#/c/695637/ Change-Id: Ifc0a3423464fafce06cd504d9b427fc3433fb756 Signed-off-by: Robin Lu <bin1.lu@intel.com>
44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
From 70046603b8d607445e2fbf5e7d934bcd43a77dc8 Mon Sep 17 00:00:00 2001
|
|
From: Scott Little <scott.little@windriver.com>
|
|
Date: Mon, 2 Oct 2017 16:50:44 -0400
|
|
Subject: [PATCH 2/4] STX: 0002-spec-include-TiS-changes.patch
|
|
|
|
---
|
|
SPECS/sudo.spec | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/SPECS/sudo.spec b/SPECS/sudo.spec
|
|
index b6402bb..acbcb26 100644
|
|
--- a/SPECS/sudo.spec
|
|
+++ b/SPECS/sudo.spec
|
|
@@ -126,7 +126,7 @@ export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" SHL
|
|
--with-ignore-dot \
|
|
--with-tty-tickets \
|
|
--with-ldap \
|
|
- --with-ldap-conf-file="%{_sysconfdir}/sudo-ldap.conf" \
|
|
+ --with-ldap-conf-file="%{_sysconfdir}/openldap/ldap.conf" \
|
|
--with-selinux \
|
|
--with-passprompt="[sudo] password for %p: " \
|
|
--with-linux-audit \
|
|
@@ -153,6 +153,9 @@ install -p -c -m 0440 %{SOURCE1} %{buildroot}%{_sysconfdir}/sudoers
|
|
install -p -c -m 0640 %{SOURCE3} %{buildroot}%{_sysconfdir}/sudo.conf
|
|
install -p -c -m 0640 %{SOURCE2} %{buildroot}%{_sysconfdir}/sudo-ldap.conf
|
|
|
|
+install -d %{buildroot}%{_sysconfdir}/openldap/schema/
|
|
+install -m 644 doc/schema.OpenLDAP %{buildroot}%{_sysconfdir}/openldap/schema/sudo.schema
|
|
+
|
|
# Remove upstream sudoers file
|
|
rm -f %{buildroot}%{_sysconfdir}/sudoers.dist
|
|
|
|
@@ -225,6 +228,7 @@ rm -rf %{buildroot}
|
|
%{_mandir}/man5/sudoers_timestamp.5.gz
|
|
%dir %{_docdir}/sudo-%{version}
|
|
%{_docdir}/sudo-%{version}/*
|
|
+%{_sysconfdir}/openldap/schema/sudo.schema
|
|
|
|
# Make sure permissions are ok even if we're updating
|
|
%post
|
|
--
|
|
2.7.4
|
|
|