Renamed openssh-portable

Added base sudo

security/sudo/Makefile

@@ -0,0 +1,152 @@
+PORTNAME=	sudo
+PORTVERSION=	1.9.16p1
+CATEGORIES=	security
+MASTER_SITES=	SUDO
+
+MAINTAINER=	garga@FreeBSD.org
+COMMENT=	Allow others to run commands as root
+WWW=		https://www.sudo.ws/
+
+LICENSE=	sudo
+LICENSE_NAME=	Sudo license
+LICENSE_FILE=	${WRKSRC}/LICENSE.md
+LICENSE_PERMS=	dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
+
+USES=		cpe libtool pkgconfig
+CPE_VENDOR=	todd_miller
+USE_LDCONFIG=	yes
+GNU_CONFIGURE=	yes
+GNU_CONFIGURE_MANPREFIX=	${PREFIX}/share
+CONFIGURE_ARGS=	--mandir=${PREFIX}/share/man \
+		--sysconfdir=${PREFIX}/etc \
+		--with-env-editor \
+		--with-ignore-dot \
+		--with-logfac=${LOGFAC} \
+		--with-logincap \
+		--with-long-otp-prompt \
+		--with-rundir=/var/run/sudo \
+		--with-tty-tickets
+LDFLAGS+=	-lgcc
+
+PORTSCOUT=	ignore:1
+
+OPTIONS_DEFINE=		AUDIT DISABLE_AUTH DISABLE_ROOT_SUDO DOCS EXAMPLES \
+			INSULTS LDAP NLS NOARGS_SHELL OPIE PAM PYTHON SSL
+OPTIONS_DEFAULT=	AUDIT PAM SSL
+OPTIONS_RADIO=		KERBEROS SSSD
+OPTIONS_RADIO_KERBEROS=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT
+OPTIONS_RADIO_SSSD=	SSSD SSSD2
+OPTIONS_SUB=		yes
+
+AUDIT_DESC=		Enable BSM audit support
+DISABLE_AUTH_DESC=	Do not require authentication by default
+DISABLE_ROOT_SUDO_DESC=	Do not allow root to run sudo
+INSULTS_DESC=		Enable insults on failures
+KERBEROS_DESC=		Enable Kerberos 5 authentication (no PAM support)
+NOARGS_SHELL_DESC=	Run a shell if no arguments are given
+OPIE_DESC=		Enable one-time passwords (no PAM support)
+PYTHON_DESC=		Enable python plugin support
+SSL_DESC=		Use OpenSSL TLS and SHA2 functions
+SSSD_DESC=		Enable SSSD backend support (deprecated)
+SSSD2_DESC=		Enable SSSD2 backend support
+
+AUDIT_CONFIGURE_WITH=	bsm-audit
+
+DISABLE_AUTH_CONFIGURE_ON=	--disable-authentication
+DISABLE_ROOT_SUDO_CONFIGURE_ON=	--disable-root-sudo
+
+GSSAPI_BASE_USES=		gssapi
+GSSAPI_BASE_CONFIGURE_ON=	--with-kerb5=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
+GSSAPI_HEIMDAL_USES=		gssapi:heimdal
+GSSAPI_HEIMDAL_CONFIGURE_ON=	--with-kerb5=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
+GSSAPI_MIT_USES=		gssapi:mit
+GSSAPI_MIT_CONFIGURE_ON=	--with-kerb5=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
+
+INSULTS_CONFIGURE_ON=	--with-insults --with-all-insults
+
+LDAP_USES=		ldap
+LDAP_CONFIGURE_ON=	--with-ldap=${PREFIX} \
+			--with-ldap-conf-file=${PREFIX}/etc/${SUDO_LDAP_CONF}
+
+NLS_USES=		gettext
+NLS_CONFIGURE_ENABLE=	nls
+NLS_CFLAGS=		-I${LOCALBASE}/include
+NLS_LDFLAGS=		-L${LOCALBASE}/lib -lintl
+
+NOARGS_SHELL_CONFIGURE_ENABLE=	noargs-shell
+
+OPIE_CONFIGURE_ON=	--with-opie
+
+PAM_PREVENTS=		OPIE GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT
+PAM_PREVENTS_MSG=	PAM cannot be combined with any other authentication plugin
+PAM_CONFIGURE_ON=	--with-pam
+
+PYTHON_USES=		python
+PYTHON_CONFIGURE_ENABLE=python
+
+SSL_USES=		ssl
+SSL_CONFIGURE_ON=	--enable-openssl=${OPENSSLBASE}
+
+SSSD_PREVENTS=		GSSAPI_HEIMDAL
+SSSD_PREVENTS_MSG=	sssd requires MIT kerberos and it conflicts with heimdal
+SSSD_RUN_DEPENDS=	sssd:security/sssd
+SSSD_CONFIGURE_ON=	--with-sssd
+
+SSSD2_RUN_DEPENDS=	sssd:security/sssd2
+SSSD2_CONFIGURE_ON=	--with-sssd
+
+LOGFAC?=		authpriv
+SUDO_LDAP_CONF?=	ldap.conf
+
+# This is intentionally not an option.
+# SUDO_SECURE_PATH is a PATH string that will override the user's PATH.
+# ex: make SUDO_SECURE_PATH="/sbin:/bin:/usr/sbin:/usr/bin"
+.if defined(SUDO_SECURE_PATH)
+CONFIGURE_ARGS+=	--with-secure-path="${SUDO_SECURE_PATH}"
+.endif
+
+# This is intentionally not an option.
+# SUDO_KERB5_INSTANCE is an optional instance string that will be appended
+# to kerberos principals when to perform authentication. Common choices
+# are "admin" and "sudo".
+.if defined(SUDO_KERB5_INSTANCE)
+CONFIGURE_ARGS+=	--enable-kerb5-instance="${SUDO_KERB5_INSTANCE}"
+.endif
+
+.include <bsd.port.options.mk>
+
+.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400072
+. if ${PORT_OPTIONS:MOPIE}
+BUILD_DEPENDS+=	opie>0:security/opie
+RUN_DEPENDS+=	opie>0:security/opie
+. endif
+.endif
+
+.if ${ARCH} == "arm"
+CONFIGURE_ARGS+=	--disable-pie
+.endif
+
+post-patch:
+	@${REINPLACE_CMD} -E '/install-(binaries|noexec):/,/^$$/ \
+		s/\$$\(INSTALL\)/& ${STRIP}/;s/-b\~/-b ~/' \
+		${WRKSRC}/src/Makefile.in
+
+post-install:
+	${INSTALL_DATA} ${FILESDIR}/pam.conf ${STAGEDIR}${PREFIX}/etc/pam.d/sudo.default
+	${MV} ${STAGEDIR}${PREFIX}/etc/sudo.conf ${STAGEDIR}${PREFIX}/etc/sudo.conf.sample
+	${MV} ${STAGEDIR}${PREFIX}/etc/sudo_logsrvd.conf ${STAGEDIR}${PREFIX}/etc/sudo_logsrvd.conf.sample
+	${RM} ${STAGEDIR}${PREFIX}/etc/sudoers
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/cvtsudoers
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/sudoreplay
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/libexec/sudo/sudo_intercept.so
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/sbin/sudo_logsrvd
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/sbin/sudo_sendlog
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/sbin/visudo
+.for f in audit_json.so group_file.so libsudo_util.so sudoers.so system_group.so
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/libexec/sudo/${f}
+.endfor
+
+post-install-PYTHON-on:
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/libexec/sudo/python_plugin.so
+
+.include <bsd.port.mk>

security/sudo/distinfo

@@ -0,0 +1,3 @@
+TIMESTAMP = 1731468346
+SHA256 (sudo-1.9.16p1.tar.gz) = 404994e23ae8bcf4be59ed6fd3759ad70a8cefa9bcf71640b33f176afec243b0
+SIZE (sudo-1.9.16p1.tar.gz) = 5396038

security/sudo/files/pam.conf

@@ -0,0 +1,16 @@
+# PAM configuration for the "sudo" service
+#
+
+# auth
+auth		include		system
+
+# account
+account		include		system
+
+# session
+# XXX: pam_lastlog (used in system) causes users to appear as though
+# they are no longer logged in in system logs.
+session		required	pam_permit.so
+
+# password
+password	include		system

security/sudo/files/patch-plugins__sudoers__sudoers.in

@@ -0,0 +1,27 @@
+--- plugins/sudoers/sudoers.in.orig	2021-12-04 23:28:43 UTC
++++ plugins/sudoers/sudoers.in
+@@ -32,6 +32,14 @@
+ ##
+ ## Defaults specification
+ ##
++## Uncomment if needed to preserve environmental variables related to the
++## FreeBSD pkg utility and fetch.
++# Defaults     env_keep += "PKG_CACHEDIR PKG_DBDIR FTP_PASSIVE_MODE"
++##
++## Additionally uncomment if needed to preserve environmental variables
++## related to portupgrade
++# Defaults     env_keep += "PORTSDIR PORTS_INDEX PORTS_DBDIR PACKAGES PKGTOOLS_CONF"
++##
+ ## You may wish to keep some of the following environment variables
+ ## when running commands via sudo.
+ ##
+@@ -91,6 +99,9 @@ root ALL=(ALL:ALL) ALL
+ ## of the user they are running the command as (root by default).
+ # Defaults targetpw  # Ask for the password of the target user
+ # ALL ALL=(ALL:ALL) ALL  # WARNING: only use this together with 'Defaults targetpw'
++
++## Uncomment to show on password prompt which users' password is being expected
++# Defaults passprompt="%p's password:"
+ 
+ ## Read drop-in files from @sysconfdir@/sudoers.d
+ @includedir @sysconfdir@/sudoers.d

security/sudo/files/patch-scripts_install-sh

@@ -0,0 +1,28 @@
+--- scripts/install-sh.orig	2017-01-14 04:30:15 UTC
++++ scripts/install-sh
+@@ -171,12 +171,6 @@ if ${DIRMODE} ; then
+ 	if [ ! -d "${DEST}" ] ; then
+ 	    ${MKDIR} "${DEST}" || exit 1
+ 	fi
+-	if ${CHOWNIT} ; then
+-	    ${CHOWN} "${OWNER}" "${DEST}" || exit 1
+-	fi
+-	if ${CHGROUPIT} ; then
+-	    ${CHGRP} "${GROUP}" "${DEST}" || exit 1
+-	fi
+ 	if ${CHMODIT} ; then
+ 	    ${CHMOD} "${MODE}"  "${DEST}" || exit 1
+ 	fi
+@@ -226,12 +220,6 @@ fi
+ ##  Strip and set the owner/mode.
+ if ${STRIPIT} ; then
+     ${STRIP} "${DEST}" || exit 1
+-fi
+-if ${CHOWNIT} ; then
+-    ${CHOWN} "${OWNER}" "${DEST}" || exit 1
+-fi
+-if ${CHGROUPIT} ; then
+-    ${CHGRP} "${GROUP}" "${DEST}" || exit 1
+ fi
+ if ${CHMODIT} ; then
+     ${CHMOD} "${MODE}" "${DEST}" || exit 1

security/sudo/pkg-descr

@@ -0,0 +1,6 @@
+This is the CU version of sudo.
+
+Sudo is a program designed to allow a sysadmin to give limited root
+privileges to users and log root activity.  The basic philosophy is to
+give as few privileges as possible but still allow people to get their
+work done.

security/sudo/pkg-plist

@@ -0,0 +1,144 @@
+bin/cvtsudoers
+bin/sudo
+bin/sudoedit
+bin/sudoreplay
+@sample etc/pam.d/sudo.default etc/pam.d/sudo
+@sample etc/sudo.conf.sample
+@sample etc/sudo_logsrvd.conf.sample
+@sample etc/sudoers.dist etc/sudoers
+include/sudo_plugin.h
+libexec/sudo/audit_json.so
+libexec/sudo/group_file.so
+libexec/sudo/libsudo_util.so
+libexec/sudo/libsudo_util.so.0
+libexec/sudo/libsudo_util.so.0.0.0
+%%PYTHON%%libexec/sudo/python_plugin.so
+libexec/sudo/sudo_intercept.so
+libexec/sudo/sudo_noexec.so
+libexec/sudo/sudoers.so
+libexec/sudo/system_group.so
+share/man/man1/cvtsudoers.1.gz
+share/man/man5/sudo.conf.5.gz
+share/man/man5/sudo_logsrv.proto.5.gz
+share/man/man5/sudo_logsrvd.conf.5.gz
+share/man/man5/sudo_plugin.5.gz
+%%PYTHON%%share/man/man5/sudo_plugin_python.5.gz
+share/man/man5/sudoers.5.gz
+share/man/man5/sudoers_timestamp.5.gz
+%%LDAP%%share/man/man5/sudoers.ldap.5.gz
+share/man/man8/sudo.8.gz
+share/man/man8/sudo_logsrvd.8.gz
+share/man/man8/sudo_sendlog.8.gz
+share/man/man8/sudoedit.8.gz
+share/man/man8/sudoreplay.8.gz
+share/man/man8/visudo.8.gz
+sbin/visudo
+sbin/sudo_logsrvd
+sbin/sudo_sendlog
+%%PORTDOCS%%%%DOCSDIR%%/CONTRIBUTING.md
+%%PORTDOCS%%%%DOCSDIR%%/CONTRIBUTORS.md
+%%PORTDOCS%%%%DOCSDIR%%/ChangeLog
+%%PORTDOCS%%%%DOCSDIR%%/HISTORY.md
+%%PORTDOCS%%%%DOCSDIR%%/LICENSE.md
+%%PORTDOCS%%%%DOCSDIR%%/NEWS
+%%PORTDOCS%%%%DOCSDIR%%/README.md
+%%PORTDOCS%%%%DOCSDIR%%/SECURITY.md
+%%PORTDOCS%%%%DOCSDIR%%/TROUBLESHOOTING.md
+%%PORTDOCS%%%%DOCSDIR%%/UPGRADE.md
+%%LDAP%%%%PORTDOCS%%%%DOCSDIR%%/README.LDAP.md
+%%LDAP%%%%PORTDOCS%%%%DOCSDIR%%/schema.ActiveDirectory
+%%LDAP%%%%PORTDOCS%%%%DOCSDIR%%/schema.IBM_LDAP
+%%LDAP%%%%PORTDOCS%%%%DOCSDIR%%/schema.OpenLDAP
+%%LDAP%%%%PORTDOCS%%%%DOCSDIR%%/schema.iPlanet
+%%LDAP%%%%PORTDOCS%%%%DOCSDIR%%/schema.olcSudo
+%%PORTEXAMPLES%%%%EXAMPLESDIR%%/cvtsudoers.conf
+%%PORTEXAMPLES%%%%EXAMPLESDIR%%/pam.conf
+%%PORTEXAMPLES%%%%EXAMPLESDIR%%/sudo.conf
+%%PORTEXAMPLES%%%%EXAMPLESDIR%%/sudo_logsrvd.conf
+%%PORTEXAMPLES%%%%EXAMPLESDIR%%/sudoers
+%%PORTEXAMPLES%%%%EXAMPLESDIR%%/syslog.conf
+%%PYTHON%%%%PORTEXAMPLES%%%%EXAMPLESDIR%%/example_approval_plugin.py
+%%PYTHON%%%%PORTEXAMPLES%%%%EXAMPLESDIR%%/example_audit_plugin.py
+%%PYTHON%%%%PORTEXAMPLES%%%%EXAMPLESDIR%%/example_conversation.py
+%%PYTHON%%%%PORTEXAMPLES%%%%EXAMPLESDIR%%/example_debugging.py
+%%PYTHON%%%%PORTEXAMPLES%%%%EXAMPLESDIR%%/example_group_plugin.py
+%%PYTHON%%%%PORTEXAMPLES%%%%EXAMPLESDIR%%/example_io_plugin.py
+%%PYTHON%%%%PORTEXAMPLES%%%%EXAMPLESDIR%%/example_policy_plugin.py
+%%NLS%%share/locale/ast/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/ast/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/ca/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/ca/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/cs/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/cs/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/da/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/da/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/de/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/de/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/el/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/eo/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/eo/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/es/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/es/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/eu/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/eu/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/fa/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/fi/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/fi/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/fr/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/fr/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/fur/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/fur/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/gl/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/hr/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/hr/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/hu/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/hu/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/id/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/id/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/it/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/it/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/ja/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/ja/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/ka/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/ka/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/ko/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/ko/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/lt/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/nb/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/nb/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/nl/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/nl/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/nn/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/pl/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/pl/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/pt/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/pt/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/pt_BR/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/pt_BR/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/ro/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/ro/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/ru/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/ru/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/sk/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/sk/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/sl/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/sl/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/sq/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/sr/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/sr/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/sv/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/sv/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/tr/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/tr/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/uk/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/uk/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/vi/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/vi/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/zh_CN/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/zh_CN/LC_MESSAGES/sudoers.mo
+%%NLS%%share/locale/zh_TW/LC_MESSAGES/sudo.mo
+%%NLS%%share/locale/zh_TW/LC_MESSAGES/sudoers.mo
+@dir etc/sudoers.d
+@dir /var/db/sudo/lectured
+@dir /var/db/sudo
+@dir /var/run/sudo