mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
54de8d26d0
This backport is provided thanks to the Debian community [1].
- CVE-2026-35535:
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid,
setgid, or setgroups call, during a privilege drop before running the
mailer, is not a fatal error and can lead to privilege escalation.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-35535
[1] https://salsa.debian.org/sudo-team/sudo/-/blob/debian/trixie/debian/patches/0006-exec_mailer-Set-group-as-well-as-uid-when-running-th.patch
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
89 lines
2.3 KiB
Makefile
89 lines
2.3 KiB
Makefile
################################################################################
|
|
#
|
|
# sudo
|
|
#
|
|
################################################################################
|
|
|
|
SUDO_VERSION_MAJOR = 1.9.17
|
|
SUDO_VERSION_MINOR = p2
|
|
SUDO_VERSION = $(SUDO_VERSION_MAJOR)$(SUDO_VERSION_MINOR)
|
|
SUDO_SITE = https://www.sudo.ws/sudo/dist
|
|
SUDO_LICENSE = ISC, BSD-3-Clause
|
|
SUDO_LICENSE_FILES = LICENSE.md
|
|
SUDO_CPE_ID_VERSION = $(SUDO_VERSION_MAJOR)
|
|
SUDO_CPE_ID_UPDATE = $(SUDO_VERSION_MINOR)
|
|
|
|
# 0001-exec-mailer-set-group-as-well-as-uid-when-running-the-mailer.patch
|
|
SUDO_IGNORE_CVES += CVE-2026-35535
|
|
|
|
SUDO_SELINUX_MODULES = sudo
|
|
# This is to avoid sudo's make install from chown()ing files which fails
|
|
SUDO_INSTALL_TARGET_OPTS = INSTALL_OWNER="" DESTDIR="$(TARGET_DIR)" install
|
|
SUDO_CONF_OPTS = \
|
|
--with-tzdir=$(if $(BR2_PACKAGE_TZDATA),/usr/share/zoneinfo,no) \
|
|
--enable-tmpfiles.d=$(if $(BR2_PACKAGE_SYSTEMD),/usr/lib/tmpfiles.d,no) \
|
|
--without-lecture \
|
|
--without-sendmail \
|
|
--without-umask \
|
|
--with-logging=syslog \
|
|
--without-interfaces \
|
|
--with-env-editor
|
|
|
|
ifeq ($(BR2_PACKAGE_LINUX_PAM),y)
|
|
define SUDO_INSTALL_PAM_CONF
|
|
$(INSTALL) -D -m 0644 package/sudo/sudo.pam $(TARGET_DIR)/etc/pam.d/sudo
|
|
endef
|
|
|
|
SUDO_DEPENDENCIES += linux-pam
|
|
SUDO_CONF_OPTS += --with-pam
|
|
SUDO_POST_INSTALL_TARGET_HOOKS += SUDO_INSTALL_PAM_CONF
|
|
else
|
|
SUDO_CONF_OPTS += --without-pam
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBXCRYPT),y)
|
|
SUDO_DEPENDENCIES += libxcrypt
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZLIB),y)
|
|
SUDO_CONF_OPTS += --enable-zlib
|
|
SUDO_DEPENDENCIES += zlib
|
|
else
|
|
SUDO_CONF_OPTS += --disable-zlib
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_OPENLDAP),y)
|
|
SUDO_DEPENDENCIES += openldap
|
|
SUDO_CONF_OPTS += --with-ldap
|
|
else
|
|
SUDO_CONF_OPTS += --without-ldap
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_OPENSSL),y)
|
|
SUDO_DEPENDENCIES += host-pkgconf openssl
|
|
SUDO_CONF_OPTS += --enable-openssl
|
|
else
|
|
SUDO_CONF_OPTS += --disable-openssl
|
|
endif
|
|
|
|
define SUDO_PERMISSIONS
|
|
/usr/bin/sudo f 4755 0 0 - - - - -
|
|
endef
|
|
|
|
define SUDO_REMOVE_DIST_EXAMPLES
|
|
$(RM) $(TARGET_DIR)/etc/sudoers.dist
|
|
rmdir --ignore-fail-on-non-empty $(TARGET_DIR)/etc/sudoers.d
|
|
endef
|
|
SUDO_POST_INSTALL_TARGET_HOOKS += SUDO_REMOVE_DIST_EXAMPLES
|
|
|
|
define SUDO_USERS
|
|
- - sudo -1 - - - -
|
|
endef
|
|
|
|
define SUDO_ENABLE_SUDO_GROUP_RULE
|
|
$(SED) '/^# \%sudo ALL=(ALL:ALL) ALL/s/^# //' $(TARGET_DIR)/etc/sudoers
|
|
endef
|
|
SUDO_POST_INSTALL_TARGET_HOOKS += SUDO_ENABLE_SUDO_GROUP_RULE
|
|
|
|
$(eval $(autotools-package))
|