From 6044cc5f26f8f076ead9a3d22dd84681c7c9e23f Mon Sep 17 00:00:00 2001 From: Nathaniel Roach Date: Mon, 21 Jul 2025 20:08:20 +0800 Subject: [PATCH] package/sudo: Enable libxcrypt with glibc, allowing hashed passwords without PAM Per https://gitlab.com/buildroot.org/buildroot/-/issues/27 , on glibc builds without PAM, sudo will "fail" all password prompts. It was found that it's simply checking the entered string against the raw hash, because 'libcryp' isn't available. On glibc, we need libxcrypt, so enable it and ensure sudo is built with it. musl and uclibc do have crypt() functions, so this is not needed. Relevant code from sudo: https://github.com/sudo-project/sudo/blob/v1.9.17p1/plugins/sudoers/auth/passwd.c#L139 Signed-off-by: Nathaniel Roach Signed-off-by: Julien Olivain --- package/sudo/Config.in | 1 + package/sudo/sudo.mk | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/package/sudo/Config.in b/package/sudo/Config.in index ee5ea542ab..85bc4859b8 100644 --- a/package/sudo/Config.in +++ b/package/sudo/Config.in @@ -2,6 +2,7 @@ config BR2_PACKAGE_SUDO bool "sudo" # uses fork() depends on BR2_USE_MMU + select BR2_PACKAGE_LIBXCRYPT if BR2_TOOLCHAIN_USES_GLIBC help Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The diff --git a/package/sudo/sudo.mk b/package/sudo/sudo.mk index f57a86805a..0aacd8207d 100644 --- a/package/sudo/sudo.mk +++ b/package/sudo/sudo.mk @@ -37,6 +37,10 @@ else SUDO_CONF_OPTS += --without-pam endif +ifeq ($(BR2_PACKAGE_LIBXCRYPT),y) +SUDO_DEPENDENCIES += libxcrypt +endif + ifeq ($(BR2_PACKAGE_ZLIB),y) SUDO_CONF_OPTS += --enable-zlib SUDO_DEPENDENCIES += zlib