current/SPECS/sudo.spec

# use fakeroot -ba sudo.spec to build!

Name:           sudo
Version:        1.8.10p3
Release:        %mkrel 3
Epoch:          1
Summary:        Allows command execution as root for specified users
License:        GPLv2+
Group:          System/Base
URL:            http://www.sudo.ws/sudo
Source0:        http://www.sudo.ws/sudo/dist/%{name}-%{version}%{?pre}.tar.gz
Source1:        http://www.sudo.ws/sudo/dist/%{name}-%{version}%{?pre}.tar.gz.sig
Source2:        sudo.pamd
Source3:        sudo-1.7.2p2-sudoers
Patch1:         sudo-1.6.7p5-strip.patch
Patch2:         sudo-1.7.2p1-envdebug.patch
Patch4:         sudo-1.8.5-pipelist.patch
Patch5:         sudo-1.8.11-blacklist-bash-func.patch
BuildRequires:  audit-devel
BuildRequires:  bison
BuildRequires:  groff-for-man
BuildRequires:  libcap-devel
BuildRequires:  openldap-devel
BuildRequires:  pam-devel
Requires(pre):  openldap

%description
Sudo (superuser do) allows a system administrator to give certain users (or
groups of users) the ability to run some (or all) commands as root while
logging all commands and arguments. Sudo operates on a per-command basis.
It is not a replacement for the shell. Features include: the ability to
restrict what commands a user may run on a per-host basis, copious logging
of each command (providing a clear audit trail of who did what), a
configurable timeout of the sudo command, and the ability to use the same
configuration file (sudoers) on many different machines.

%package devel
Summary:        Development files for sudo plugins
Group:          Development/C
Requires:       %{name} = %{epoch}:%{version}-%{release}

%description    devel
Development files for compiling sudo plugins.

%prep
%setup -q -n %{name}-%{version}%{?pre}
%patch1 -p1 -b .strip
%patch2 -p1 -b .envdebug
#patch4 -p1 -b .pipelist
%patch5 -p1 -b .bash-func

# fix attribs
find -name "Makefile.*" | xargs perl -pi -e "s|-m 0444|-m 0644|g"


%build
# handle newer autoconf
rm -f acsite.m4
mv aclocal.m4 acinclude.m4
autoreconf -fv --install

%serverbuild
export CFLAGS="%{optflags} -D_GNU_SOURCE"

%configure2_5x \
        --without-rpath \
        --with-logging=both \
        --with-logfac=authpriv \
        --with-logpath=%{_logdir}/sudo.log \
        --with-editor=/bin/vi \
        --enable-log-host \
        --with-pam \
        --with-pam-login \
        --with-env-editor \
        --with-noexec=no \
        --with-linux-audit \
        --with-ignore-dot \
        --with-tty-tickets \
        --with-ldap \
        --with-ldap-conf-file=%{_sysconfdir}/ldap.conf \
        --with-secure-path="/sbin:%{_sbindir}:/bin:%{_bindir}:/usr/local/bin:/usr/local/sbin" \
        --with-passprompt="[sudo] password for %p: " \
        --with-plugindir=%{_libdir}/sudo

%make

%install
install -d %{buildroot}/usr
install -d %{buildroot}%{_sysconfdir}/logrotate.d
install -d %{buildroot}%{_sysconfdir}/sudoers.d
install -d %{buildroot}%{_sysconfdir}/pam.d
install -d %{buildroot}%{_var}/db/sudo
install -d %{buildroot}%{_logdir}/sudo
install -d %{buildroot}%{_logdir}/sudo-io

%makeinstall_std install_uid=$UID install_gid=$(id -g) sudoers=uid=$UID sudoers_gid=$(id -g)

install -m0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/pam.d/sudo
install -m0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sudoers
install -m0755 plugins/sudoers/sudoers2ldif %{buildroot}%{_bindir}

# Installing logrotated file
cat <<END >%{buildroot}%{_sysconfdir}/logrotate.d/sudo
%{_logdir}/sudo.log {
    missingok
    monthly
    compress
}
END

cat > %{buildroot}%{_sysconfdir}/pam.d/sudo << EOF
#%PAM-1.0
auth            include         system-auth
account         include         system-auth
password        include         system-auth
session         optional        pam_keyinit.so revoke
session         required        pam_limits.so
EOF

cat > %{buildroot}%{_sysconfdir}/pam.d/sudo-i << EOF
#%PAM-1.0
auth            include         sudo
account         include         sudo
password        include         sudo
session         optional        pam_keyinit.so force revoke
session         required        pam_limits.so
EOF

# so that strip can touch it...
chmod 755 %{buildroot}%{_bindir}/*
chmod 755 %{buildroot}%{_sbindir}/*

# (tpg) create the missing log file
touch %{buildroot}%{_logdir}/sudo.log

%find_lang sudo
%find_lang sudoers

cat sudo.lang sudoers.lang > sudo_all.lang
rm sudo.lang sudoers.lang

%check
make check

%post
/bin/chmod 0440 %{_sysconfdir}/sudoers || :
%create_ghostfile %{_logdir}/sudo.log root root 600

%files -f sudo_all.lang
%doc doc/HISTORY README README.LDAP
%doc doc/TROUBLESHOOTING doc/UPGRADE doc/sample.* doc/schema.*
%attr(0440,root,root) %config(noreplace) %{_sysconfdir}/sudoers
%attr(0750,root,root) %dir %{_sysconfdir}/sudoers.d/
%config(noreplace) %{_sysconfdir}/logrotate.d/sudo
%config(noreplace) %{_sysconfdir}/pam.d/sudo
%config(noreplace) %{_sysconfdir}/pam.d/sudo-i
%attr(0755,root,root) %{_bindir}/sudoers2ldif
%attr(4111,root,root) %{_bindir}/sudo
%attr(4111,root,root) %{_bindir}/sudoedit
%attr(0111,root,root) %{_bindir}/sudoreplay
%attr(0755,root,root) %{_sbindir}/visudo
%ghost %{_logdir}/sudo.log
%{_mandir}/*/*
%attr(0700,root,root) %dir %{_var}/db/sudo
%attr(0750,root,root) %dir %{_logdir}/sudo-io
%{_libdir}/sudo/group_file.so
%{_libdir}/sudo/sudoers.so
%{_libdir}/sudo/system_group.so

%files devel
%doc plugins/{group_file,sample}
%{_includedir}/sudo_plugin.h
%{_mandir}/man8/sudo_plugin.8*
1	blino	17466	# use fakeroot -ba sudo.spec to build!
2
3	shlomif	152774	Name: sudo
4	luigiwalser	622656	Version: 1.8.10p3
5	luigiwalser	737649	Release: %mkrel 3
6	shlomif	152774	Epoch: 1
7			Summary: Allows command execution as root for specified users
8			License: GPLv2+
9			Group: System/Base
10			URL: http://www.sudo.ws/sudo
11	luigiwalser	400679	Source0: http://www.sudo.ws/sudo/dist/%{name}-%{version}%{?pre}.tar.gz
12			Source1: http://www.sudo.ws/sudo/dist/%{name}-%{version}%{?pre}.tar.gz.sig
13	shlomif	152774	Source2: sudo.pamd
14			Source3: sudo-1.7.2p2-sudoers
15			Patch1: sudo-1.6.7p5-strip.patch
16			Patch2: sudo-1.7.2p1-envdebug.patch
17	luigiwalser	275808	Patch4: sudo-1.8.5-pipelist.patch
18	luigiwalser	737649	Patch5: sudo-1.8.11-blacklist-bash-func.patch
19	shlomif	152774	BuildRequires: audit-devel
20			BuildRequires: bison
21			BuildRequires: groff-for-man
22			BuildRequires: libcap-devel
23			BuildRequires: openldap-devel
24			BuildRequires: pam-devel
25			Requires(pre): openldap
26	blino	17466
27			%description
28	luigiwalser	275808	Sudo (superuser do) allows a system administrator to give certain users (or
29			groups of users) the ability to run some (or all) commands as root while
30			logging all commands and arguments. Sudo operates on a per-command basis.
31			It is not a replacement for the shell. Features include: the ability to
32			restrict what commands a user may run on a per-host basis, copious logging
33			of each command (providing a clear audit trail of who did what), a
34			configurable timeout of the sudo command, and the ability to use the same
35			configuration file (sudoers) on many different machines.
36	blino	17466
37	boklm	74479	%package devel
38	shlomif	152774	Summary: Development files for sudo plugins
39			Group: Development/C
40	luigiwalser	275808	Requires: %{name} = %{epoch}:%{version}-%{release}
41	boklm	74479
42	shlomif	152774	%description devel
43	boklm	74479	Development files for compiling sudo plugins.
44
45	blino	17466	%prep
46			%setup -q -n %{name}-%{version}%{?pre}
47			%patch1 -p1 -b .strip
48			%patch2 -p1 -b .envdebug
49	tv	549844	#patch4 -p1 -b .pipelist
50	luigiwalser	737649	%patch5 -p1 -b .bash-func
51	blino	17466
52	luigiwalser	275808	# fix attribs
53			find -name "Makefile.*" \| xargs perl -pi -e "s\|-m 0444\|-m 0644\|g"
54
55
56	blino	17466	%build
57			# handle newer autoconf
58			rm -f acsite.m4
59			mv aclocal.m4 acinclude.m4
60			autoreconf -fv --install
61
62			%serverbuild
63			export CFLAGS="%{optflags} -D_GNU_SOURCE"
64
65			%configure2_5x \
66	shlomif	152774	--without-rpath \
67			--with-logging=both \
68	blino	17466	--with-logfac=authpriv \
69	shlomif	152774	--with-logpath=%{_logdir}/sudo.log \
70			--with-editor=/bin/vi \
71			--enable-log-host \
72			--with-pam \
73			--with-pam-login \
74			--with-env-editor \
75			--with-noexec=no \
76			--with-linux-audit \
77	blino	17466	--with-ignore-dot \
78			--with-tty-tickets \
79	shlomif	152774	--with-ldap \
80			--with-ldap-conf-file=%{_sysconfdir}/ldap.conf \
81			--with-secure-path="/sbin:%{_sbindir}:/bin:%{_bindir}:/usr/local/bin:/usr/local/sbin" \
82	pterjan	340151	--with-passprompt="[sudo] password for %p: " \
83			--with-plugindir=%{_libdir}/sudo
84	blino	17466
85			%make
86
87			%install
88			install -d %{buildroot}/usr
89			install -d %{buildroot}%{_sysconfdir}/logrotate.d
90			install -d %{buildroot}%{_sysconfdir}/sudoers.d
91			install -d %{buildroot}%{_sysconfdir}/pam.d
92			install -d %{buildroot}%{_var}/db/sudo
93			install -d %{buildroot}%{_logdir}/sudo
94			install -d %{buildroot}%{_logdir}/sudo-io
95
96			%makeinstall_std install_uid=$UID install_gid=$(id -g) sudoers=uid=$UID sudoers_gid=$(id -g)
97
98			install -m0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/pam.d/sudo
99			install -m0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sudoers
100	boklm	74479	install -m0755 plugins/sudoers/sudoers2ldif %{buildroot}%{_bindir}
101	blino	17466
102			# Installing logrotated file
103			cat <<END >%{buildroot}%{_sysconfdir}/logrotate.d/sudo
104			%{_logdir}/sudo.log {
105			missingok
106			monthly
107			compress
108			}
109			END
110
111			cat > %{buildroot}%{_sysconfdir}/pam.d/sudo << EOF
112			#%PAM-1.0
113	shlomif	152774	auth include system-auth
114			account include system-auth
115			password include system-auth
116			session optional pam_keyinit.so revoke
117			session required pam_limits.so
118	blino	17466	EOF
119
120			cat > %{buildroot}%{_sysconfdir}/pam.d/sudo-i << EOF
121			#%PAM-1.0
122	shlomif	152774	auth include sudo
123			account include sudo
124			password include sudo
125			session optional pam_keyinit.so force revoke
126			session required pam_limits.so
127	blino	17466	EOF
128
129			# so that strip can touch it...
130			chmod 755 %{buildroot}%{_bindir}/*
131			chmod 755 %{buildroot}%{_sbindir}/*
132
133			# (tpg) create the missing log file
134			touch %{buildroot}%{_logdir}/sudo.log
135
136	luigiwalser	275808	%find_lang sudo
137			%find_lang sudoers
138
139			cat sudo.lang sudoers.lang > sudo_all.lang
140			rm sudo.lang sudoers.lang
141
142	fwang	160282	%check
143			make check
144
145	blino	17466	%post
146			/bin/chmod 0440 %{_sysconfdir}/sudoers \|\| :
147			%create_ghostfile %{_logdir}/sudo.log root root 600
148
149	luigiwalser	275808	%files -f sudo_all.lang
150	boklm	74479	%doc doc/HISTORY README README.LDAP
151	luigiwalser	275808	%doc doc/TROUBLESHOOTING doc/UPGRADE doc/sample.* doc/schema.*
152	blino	17466	%attr(0440,root,root) %config(noreplace) %{_sysconfdir}/sudoers
153			%attr(0750,root,root) %dir %{_sysconfdir}/sudoers.d/
154			%config(noreplace) %{_sysconfdir}/logrotate.d/sudo
155			%config(noreplace) %{_sysconfdir}/pam.d/sudo
156			%config(noreplace) %{_sysconfdir}/pam.d/sudo-i
157			%attr(0755,root,root) %{_bindir}/sudoers2ldif
158			%attr(4111,root,root) %{_bindir}/sudo
159			%attr(4111,root,root) %{_bindir}/sudoedit
160			%attr(0111,root,root) %{_bindir}/sudoreplay
161			%attr(0755,root,root) %{_sbindir}/visudo
162			%ghost %{_logdir}/sudo.log
163			%{_mandir}//
164			%attr(0700,root,root) %dir %{_var}/db/sudo
165			%attr(0750,root,root) %dir %{_logdir}/sudo-io
166	luigiwalser	451036	%{_libdir}/sudo/group_file.so
167	pterjan	340151	%{_libdir}/sudo/sudoers.so
168	luigiwalser	451036	%{_libdir}/sudo/system_group.so
169	blino	17466
170	luigiwalser	275808	%files devel
171	luigiwalser	451036	%doc plugins/{group_file,sample}
172	boklm	74479	%{_includedir}/sudo_plugin.h
173	luigiwalser	275808	%{_mandir}/man8/sudo_plugin.8*