diff --git a/security/sudo-rs/Makefile b/security/sudo-rs/Makefile index c85edcc53e91..e13cb04708df 100644 --- a/security/sudo-rs/Makefile +++ b/security/sudo-rs/Makefile @@ -1,67 +1,69 @@ PORTNAME= sudo-rs DISTVERSIONPREFIX= v -DISTVERSION= 0.2.12 +DISTVERSION= 0.2.13 CATEGORIES= security MAINTAINER= marc@trifectatech.org COMMENT= Allow others to run commands as root WWW= https://trifectatech.org/initiatives/privilege-boundary/ LICENSE= APACHE20 MIT LICENSE_COMB= dual LICENSE_FILE_APACHE20= ${WRKSRC}/LICENSE-APACHE LICENSE_FILE_MIT= ${WRKSRC}/LICENSE-MIT USES= cargo USE_GITHUB= yes GH_ACCOUNT= trifectatechfoundation FLAVORS= default coexist FLAVOR?= ${FLAVORS:[1]} coexist_PKGNAMESUFFIX= -coexist coexist_DESCR= pkg-descr-coexist .if !defined(USER) || ${USER} == root CARGO_TEST= no .endif .if ${FLAVOR} == default CONFLICTS_INSTALL= sudo RS_SUFFIX= PLIST_SUB+= NO_COEXIST="" .else RS_SUFFIX= -rs PLIST_SUB+= NO_COEXIST="@comment " .endif +SUB_FILES= sudoers + PLIST_SUB+= RS_SUFFIX=${RS_SUFFIX} PORTDOCS= CHANGELOG.md CONTRIBUTING.md COPYRIGHT LICENSE-* README.md SECURITY.md OPTIONS_DEFINE= DOCS post-install: ${MV} ${STAGEDIR}${PREFIX}/bin/visudo ${STAGEDIR}${PREFIX}/sbin/visudo${RS_SUFFIX} ${INSTALL_MAN} ${WRKSRC}/docs/man/sudo.8.man ${STAGEDIR}${PREFIX}/share/man/man8/sudo${RS_SUFFIX}.8 ${INSTALL_MAN} ${WRKSRC}/docs/man/visudo.8.man ${STAGEDIR}${PREFIX}/share/man/man8/visudo${RS_SUFFIX}.8 ${INSTALL_MAN} ${WRKSRC}/docs/man/sudoers.5.man ${STAGEDIR}${PREFIX}/share/man/man5/sudoers${RS_SUFFIX}.5 ${LN} -s sudo${RS_SUFFIX} ${STAGEDIR}${PREFIX}/bin/sudoedit${RS_SUFFIX} ${LN} -s sudo${RS_SUFFIX}.8 ${STAGEDIR}${PREFIX}/share/man/man8/sudoedit${RS_SUFFIX}.8 ${MKDIR} ${STAGEDIR}${PREFIX}/etc/sudoers.d ${MKDIR} ${STAGEDIR}${PREFIX}/etc/pam.d ${MKDIR} ${STAGEDIR}/var/run/sudo ${MKDIR} ${STAGEDIR}/var/db/sudo # we are not going to try to replace 'su', since that is part of FreeBSD itself ${RM} ${STAGEDIR}${PREFIX}/bin/su .if ${FLAVOR} == default ${INSTALL_DATA} ${FILESDIR}/pam.conf ${STAGEDIR}${PREFIX}/etc/pam.d/sudo.default - ${INSTALL_DATA} ${FILESDIR}/sudoers ${STAGEDIR}${PREFIX}/etc/sudoers.dist + ${INSTALL_DATA} ${WRKDIR}/sudoers ${STAGEDIR}${PREFIX}/etc/sudoers.dist .else ${MV} ${STAGEDIR}${PREFIX}/bin/sudo ${STAGEDIR}${PREFIX}/bin/sudo${RS_SUFFIX} .endif post-install-DOCS-on: ${MKDIR} ${STAGEDIR}${DOCSDIR} cd ${WRKSRC} && ${INSTALL_DATA} ${PORTDOCS} ${STAGEDIR}${DOCSDIR} .include diff --git a/security/sudo-rs/Makefile.crates b/security/sudo-rs/Makefile.crates index 525a8f99b8d7..c594955d597a 100644 --- a/security/sudo-rs/Makefile.crates +++ b/security/sudo-rs/Makefile.crates @@ -1,2 +1,2 @@ CARGO_CRATES= glob-0.3.3 \ - libc-0.2.180 + libc-0.2.183 diff --git a/security/sudo-rs/distinfo b/security/sudo-rs/distinfo index 191186d4cc72..ccaec81c37d2 100644 --- a/security/sudo-rs/distinfo +++ b/security/sudo-rs/distinfo @@ -1,7 +1,7 @@ -TIMESTAMP = 1771292939 +TIMESTAMP = 1773238460 SHA256 (rust/crates/glob-0.3.3.crate) = 0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280 SIZE (rust/crates/glob-0.3.3.crate) = 22861 -SHA256 (rust/crates/libc-0.2.180.crate) = bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc -SIZE (rust/crates/libc-0.2.180.crate) = 812207 -SHA256 (trifectatechfoundation-sudo-rs-v0.2.12_GH0.tar.gz) = 1f4a0577df3ae64fd35d75d30ece458fa18d57bdc7bc777aea3bfdfcb841dbeb -SIZE (trifectatechfoundation-sudo-rs-v0.2.12_GH0.tar.gz) = 1187822 +SHA256 (rust/crates/libc-0.2.183.crate) = b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d +SIZE (rust/crates/libc-0.2.183.crate) = 816918 +SHA256 (trifectatechfoundation-sudo-rs-v0.2.13_GH0.tar.gz) = 79becefc504d14ffccc7cab18d42f8d892e78b2d13d9c5bb887c5f02a2721eaf +SIZE (trifectatechfoundation-sudo-rs-v0.2.13_GH0.tar.gz) = 1202390 diff --git a/security/sudo-rs/files/patch-src_pam_rpassword.rs b/security/sudo-rs/files/patch-src_pam_rpassword.rs new file mode 100644 index 000000000000..fd5dd22cf132 --- /dev/null +++ b/security/sudo-rs/files/patch-src_pam_rpassword.rs @@ -0,0 +1,14 @@ +Based upon https://github.com/trifectatechfoundation/sudo-rs/commit/d43ff79df262568d8977771f03977d5965bf8474 + +--- + +--- src/pam/rpassword.rs.orig 2026-03-11 14:23:39 UTC ++++ src/pam/rpassword.rs +@@ -263,6 +263,7 @@ fn read_unbuffered( + if read_byte == b'\t' && feedback.visible_len.take().is_some() { + feedback.clear(); + let _ = feedback.sink.write(b"(no echo)"); ++ continue; + } + } + diff --git a/security/sudo-rs/files/sudoers b/security/sudo-rs/files/sudoers.in similarity index 89% rename from security/sudo-rs/files/sudoers rename to security/sudo-rs/files/sudoers.in index 99ef7934c811..7c04747e20cf 100644 --- a/security/sudo-rs/files/sudoers +++ b/security/sudo-rs/files/sudoers.in @@ -1,73 +1,76 @@ ## sudoers file. ## ## This file MUST be edited with the 'visudo' command as root. ## Failure to use 'visudo' may result in syntax or file permission errors ## that prevent sudo from running. ## ## See the sudoers man page for the details on how to write a sudoers file. ## Defaults specification ## ## Preserve editor environment variables for visudo. ## To preserve these for all commands, remove the "!visudo" qualifier. -Defaults!/usr/local/sbin/visudo env_keep += "SUDO_EDITOR EDITOR VISUAL" +Defaults!%%PREFIX%%/sbin/visudo env_keep += "SUDO_EDITOR EDITOR VISUAL" ## ## Use a hard-coded PATH instead of the user's to find commands. ## This also helps prevent poorly written scripts from running ## arbitrary commands under sudo. -Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" +Defaults secure_path="%%PREFIX%%/sbin:%%PREFIX%%/bin:/usr/sbin:/usr/bin:/sbin:/bin" ## ## Uncomment if needed to preserve environmental variables related to the ## FreeBSD pkg utility and fetch. # Defaults env_keep += "PKG_CACHEDIR PKG_DBDIR FTP_PASSIVE_MODE" ## ## Additionally uncomment if needed to preserve environmental variables ## related to portupgrade # Defaults env_keep += "PORTSDIR PORTS_INDEX PORTS_DBDIR PACKAGES PKGTOOLS_CONF" ## ## You may wish to keep some of the following environment variables ## when running commands via sudo. ## ## Locale settings # Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET" ## ## X11 resource path settings # Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH" ## ## Desktop path settings # Defaults env_keep += "QTDIR KDEDIR" ## ## Allow sudo-run commands to inherit the callers' ConsoleKit session # Defaults env_keep += "XDG_SESSION_COOKIE" ## ## Uncomment to enable special input methods. Care should be taken as ## this may allow users to subvert the command being run via sudo. # Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER" ## ## Uncomment to disable "use_pty" when running commands as root. ## Commands run as non-root users will run in a pseudo-terminal, ## not the user's own terminal, to prevent command injection. # Defaults>root !use_pty ## +## Uncomment if the historical silent password prompt is desired +# Defaults !pwfeedback +## ## ## User privilege specification ## root ALL=(ALL:ALL) ALL ## Uncomment to allow members of group wheel to execute any command # %wheel ALL=(ALL:ALL) ALL ## Same thing without a password # %wheel ALL=(ALL:ALL) NOPASSWD: ALL ## Uncomment to allow members of group sudo to execute any command # %sudo ALL=(ALL:ALL) ALL ## Uncomment to allow any user to run sudo if they know the password ## of the user they are running the command as (root by default). # Defaults targetpw # Ask for the password of the target user # ALL ALL=(ALL:ALL) ALL # WARNING: only use this together with 'Defaults targetpw' -## Read drop-in files from /usr/local/etc/sudoers.d -@includedir sudoers.d +## Read drop-in files from %%PREFIX%%/etc/sudoers.d +@includedir %%PREFIX%%/etc/sudoers.d