# enable tests by default %define dotests 1 # enable LDAP by default. %define IDSLDAP 1 Summary: Allows restricted root access for specified users. Summary(ja): >>O"A^eyenae!OEyenPEUR"E`A(c)z^A'E~OEUR^Irootzcz^AEUR`ou"o^2"AEUR^1EUR"e Name: sudo_ids Version: 1.9.17p2 Release: 2 Group: Applications/System License: ISC Source: https://www.sudo.ws/dist/sudo-%{version}.tar.gz URL: https://www.sudo.ws Prefix: %{_prefix} #This patch is to fix expired password login issue Patch1: sudo-1.9.15p5-exppasswd2-aix1.patch Patch2: sudo-1.9.15p5-64bit_test.patch Patch3: sudo-1.9.17p2-CVE-2026-35535.patch Conflicts: sudo Requires: gettext >= 0.21 Requires: zlib >= 1.3.2 %pre # Check if native AIX installp filesets for sudo exist if lslpp -l sudo.exp >/dev/null 2>&1 || lslpp -l sudo.base >/dev/null 2>&1; then echo "sudo lpp fileset installation is detected in the machine." echo "Skipping installation of sudo rpm to prevent conflicts." exit 1 fi %description Sudo (superuser do) allows a system administrator to give certain users (or groups of users) the ability to run some (or all) commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict what commands a user may run on a per-host basis, copious logging of each command (providing a clear audit trail of who did what), a configurable timeout of the sudo command, and the ability to use the same configuration file (sudoers) on many different machines. This sudo is built with ibm idsldap. One has to make sure appropriate symbolic links are created in /usr/lib for idsldap libraries (through idslink command provided by idsldap filesets) followed by "updtvpkg" before installing the rpm. %description -l ja sudo (superuser do) EUR`EEUR"Iyen.yen^1yenAEyen`aZ'E'I'yOE^OEURnot!c?(R)'I~NEURCEUR-EUR"eyenae!OEyenP(EURThEUR?EUR"Iyen^0yen"e!OEyenx)EUR"E^AD EUR.EURAE!cEUREUREUREUR"AEUR<<(EUR^aEUR.EUREUR"I'AZEURAE)EUR^Iyen^3yenThyen'oyen'EEUR`o root EUR`EEUR.EURAEOE^A^1^OEURCEUR-EUR"eEUR`eEURS!cEURoeEUR^Iyen^3yenThyen'o yen'EEUR^IOE^A^1^O'I'u^I`oEUR^Iyen'iyen^0EUR`oEUR`EEUR^eEUR"AEUR"Au"o^2"AEUR^1EUR"e>>A'A`EEURssEURCEUR^1!lbsudo EUR"Iyen^3yenThyen'oyen'E^0`i^1^O~A+/-^0`IEURCAE^0o^i EUR.EURThEUR^1!lbyen.yenSSyen"eEUR^I~A"OEUR-Z^1EURsEURCEUR"IEURcEUR^eEURThEUR>>EUR'o!lb^0^E^2OEEUR^Iu!CoeEUR`oAE^a^AcEUR.EURAEEUREUREURThEUR^1!lbyen^Uyen^1yen`E~A+/-^0`I EURC!cEURoeEUR^Iyen^3yenThyen'oyen'EEUR`oOE^A^1^O^2"ACoeEUR^Eyenae!OEyenPEUR`o`A(c)z^AEUR^1EUR"eu!Coe!c^3AEyen^3yenThyen'oyen'EEUR"EEUR"AEUREUREURAEEUR^I(~AEURnotEUR^E EUR"EEUR`oOE^A^1^OEUR.EUR?EUR<>"AEUR^1EUR?EUR'aEUR^I)"E-'E`UEUR^Eyen'iyen(R)yen'oyen^0u!Coe!csudo yen^3yenThyen'oyen'EEUR^Iyen?yenEURyen`ayencyenS yen`E>>thZ"OEUR`o`Ass"A^e^2"ACoe!c^Elb?^oEUR^IyenThyen.yen'oEURCAE+/-^0`iEUR^I`Ass"A^eyen~Oyen!yenEURyen"e(sudoers)EUR`oPS'I-EUR^1EUR"eu!Coe!cEURnot tatcEUR^eEURThEUR^1!lb %prep %setup -q -n sudo-%{version} %patch1 -p0 %patch3 -p0 # Add license info cat LICENSE.md>> docs/LICENSE.new mv docs/LICENSE.new docs/LICENSE rm -rf /tmp/%{name}-%{version}-32bit mkdir /tmp/%{name}-%{version}-32bit mv * /tmp/%{name}-%{version}-32bit mkdir 32bit mv /tmp/%{name}-%{version}-32bit/* 32bit rm -rf /tmp/%{name}-%{version}-32bit mkdir 64bit cp -rp 32bit/* 64bit/ cd 64bit %patch2 -p1 %build cd 64bit export CC="%{__cc__} -maix64" export OBJECT_MODE=64 export CFLAGS="$RPM_OPT_FLAGS -fstack-check -O2 -maix64 -I/opt/IBM/ldap/V6.3.1/include" #IBM ldap fileset creates symbolic links in /usr/lib/lib64 for 64bit libraries export LDFLAGS="-L/usr/lib/lib64 -libmldap -L/opt/freeware/lib64 -L/opt/freeware/lib -Wl,-blibpath:/usr/lib/lib64:/opt/freeware/libexec64/sudo:/opt/freeware/lib64:/opt/freeware/lib:/usr/lib:/lib" export AR="/usr/bin/ar -X64" ./configure \ --prefix=%{_prefix} \ --sbindir=%{_prefix}/sbin \ --mandir=%{_mandir} \ --libexecdir=%{_libexecdir}64 \ --docdir=%{_datadir}/docs/%{name}-%{version} \ --libdir=%{_libdir}64 \ --with-logging=syslog \ --with-aixauth \ --with-logfac=auth \ --with-pam \ --with-pam-login \ --with-env-editor \ --with-ignore-dot \ --with-tty-tickets \ --with-secure-path-value=no \ %if %{IDSLDAP} == 1 --with-ldap \ --with-ldap-conf-file=/etc/sudo-ldap.conf %endif make if [ "%{dotests}" == 1 ] then ( gmake -k check || true ) /usr/sbin/slibclean fi cd ../32bit export CC="%{__cc__} -maix32" export OBJECT_MODE=32 export CFLAGS="$RPM_OPT_FLAGS -fstack-check -I/opt/IBM/ldap/V6.3.1/include -D_LARGE_FILES" export LDFLAGS="-L/usr/lib -libmldap -L/opt/freeware/lib -Wl,-blibpath:/usr/lib:/lib:/opt/freeware/libexec/sudo:/opt/freeware/lib -Wl,-bmaxdata:0x80000000" export AR="/usr/bin/ar -X32" ./configure \ --prefix=%{_prefix} \ --sbindir=%{_prefix}/sbin \ --mandir=%{_mandir} \ --libexecdir=%{_libexecdir} \ --docdir=%{_datadir}/docs/%{name}-%{version} \ --libdir=%{_libdir} \ --with-logging=syslog \ --with-aixauth \ --with-logfac=auth \ --with-pam \ --with-pam-login \ --with-env-editor \ --with-ignore-dot \ --disable-year2038 \ --with-tty-tickets \ --with-secure-path-value=no \ %if %{IDSLDAP} == 1 --with-ldap \ --with-ldap-conf-file=/etc/sudo-ldap.conf %endif make if [ "%{dotests}" == 1 ] then ( gmake -k check || true ) /usr/sbin/slibclean fi %install rm -rf $RPM_BUILD_ROOT mkdir $RPM_BUILD_ROOT cd 64bit export OBJECT_MODE=64 sed -e 's/-o $(sudoers_uid) -g $(sudoers_gid) / /g' \ -e 's/-o $(install_uid) -g $(install_gid) / /g' \ -e 's/-m 4111//' -e 's/-m 0111//' Makefile > Makefile.$$ mv Makefile.$$ Makefile CFLAGS="$RPM_OPT_FLAGS -maix64" \ make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` chmod 0755 ${RPM_BUILD_ROOT}%{_sbindir}/* /opt/freeware/bin/install -d -m 700 $RPM_BUILD_ROOT/var/run/sudo ( cd ${RPM_BUILD_ROOT}/%{_prefix}/bin for f in $(ls -1| grep -v -e _32 -e _64) do mv $f "$f"_64 done ) ( cd ${RPM_BUILD_ROOT}/%{_prefix}/sbin for f in $(ls -1| grep -v -e _32 -e _64) do mv $f "$f"_64 done ) cd ../32bit export OBJECT_MODE=32 sed -e 's/-o $(sudoers_uid) -g $(sudoers_gid) / /g' \ -e 's/-o $(install_uid) -g $(install_gid) / /g' \ -e 's/-m 4111//' -e 's/-m 0111//' Makefile > Makefile.$$ mv Makefile.$$ Makefile CFLAGS="$RPM_OPT_FLAGS" \ make install DESTDIR="$RPM_BUILD_ROOT" install_uid=`id -u` install_gid=`id -g` chmod 0755 ${RPM_BUILD_ROOT}%{_sbindir}/* /opt/freeware/bin/install -d -m 700 $RPM_BUILD_ROOT/var/run/sudo ( cd ${RPM_BUILD_ROOT}/%{_prefix}/bin for f in $(ls -1| grep -v -e _32 -e _64) do mv $f "$f"_32 ln -sf "$f"_32 $f done ) ( cd ${RPM_BUILD_ROOT}/%{_prefix}/sbin for f in $(ls -1| grep -v -e _32 -e _64) do mv $f "$f"_32 ln -sf "$f"_32 $f done ) (cd $RPM_BUILD_ROOT for dir in bin sbin include do mkdir -p usr/$dir cd usr/$dir ln -sf ../..%{_prefix}/$dir/* . cd - done ) cd $RPM_BUILD_ROOT mkdir -p etc/rc.d/rc2.d ln -s /etc/rc.d/init.d/sudo etc/rc.d/rc2.d/S90sudo /usr/bin/strip -X32_64 ${RPM_BUILD_ROOT}%{_bindir}/* || : /usr/bin/strip -X32_64 ${RPM_BUILD_ROOT}%{_sbindir}/* || : rm ${RPM_BUILD_ROOT}/%{_libexecdir}/sudo/*.la rm ${RPM_BUILD_ROOT}/%{_libexecdir}64/sudo/*.la %post echo "This sudo is built with /etc/sudo-ldap.conf as the ldap configuration file. Run \"sudo -V\" to check build configure options" %clean rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,system) %{_datadir}/docs/%{name}-%{version}/* %config(noreplace) %attr(0440,root,system) /etc/sudoers %attr(0750,root,system) %dir /etc/sudoers.d %attr(0711,root,system) %dir /var/lib/sudo %attr(0711,root,system) %dir /var/lib/sudo/lectured %attr(0700,root,system) %dir /var/run/sudo %attr(4111,root,system) %{prefix}/bin/sudo %attr(4111,root,system) %{prefix}/bin/sudoreplay %attr(4111,root,system) %{prefix}/bin/sudoedit %attr(0111,root,system) %{prefix}/sbin/visudo %attr(4111,root,system) %{prefix}/bin/sudo_32 %attr(4111,root,system) %{prefix}/bin/sudoreplay_32 %attr(4111,root,system) %{prefix}/bin/sudoedit_32 %attr(0111,root,system) %{prefix}/sbin/visudo_32 %attr(4111,root,system) %{prefix}/bin/sudo_64 %attr(4111,root,system) %{prefix}/bin/sudoreplay_64 %attr(4111,root,system) %{prefix}/bin/sudoedit_64 %attr(0111,root,system) %{prefix}/sbin/visudo_64 /usr/bin/sudo /usr/bin/sudoreplay /usr/bin/sudoedit /usr/sbin/visudo /usr/bin/sudo_32 /usr/bin/sudoreplay_32 /usr/bin/sudoedit_32 /usr/sbin/visudo_32 /usr/bin/sudo_64 /usr/bin/sudoreplay_64 /usr/bin/sudoedit_64 /usr/sbin/visudo_64 %{_libexecdir}/sudo %{_libexecdir}64/sudo /etc/rc.d/init.d/* /etc/rc.d/rc2.d/* %{_datadir}/locale/*/LC_MESSAGES/* %{_mandir}/man5/* %{_mandir}/man8/sudo.8* %{_mandir}/man8/sudoedit.8* %{_mandir}/man8/sudoreplay.8* %{_mandir}/man8/visudo.8* %{_includedir}/* %changelog * Tue Aug 04 2026 Sumitra Dawn - 1.9.17p2-2 - Rebuild to fix CVE-2026-35535 - Restrict sudo installation if fileset is already present. * Mon Aug 25 2025 Reshma V Kumar - 1.9.17p2-1 - Update to version 1.9.17p2 * Tue Jul 08 2025 Reshma V Kumar - 1.9.17p1-1 - Update to version 1.9.17p1 to fix CVE-2025-32462,CVE-2025-32463 - Disable secure_path value in sudoers file by default * Thu May 29 2025 Reshma V Kumar - 1.9.16p2-1 - Update to version 1.9.16p2 * Tue Apr 24 2024 Sangamesh Mallayya - 1.9.15p5-1 - Update to latest version. - Add patch to fix 64-bit test core dump. * Thu Jan 18 2024 Sangamesh Mallayya - 1.9.14p3-1 - Update to latest version. * Fri Dec 08 2023 Sangamesh Mallayya - 1.9.13p2-2 - Rebuild with corrected patch for password expiry which caused failures - with KRB5files users. * Wed Mar 08 2023 Sangeetha Bandi - 1.9.13p2-1 - Update to fix CVE-2023-27320 * Fri Feb 03 2023 Sangeetha Bandi - 1.9.12p2-1 - Update to fix CVE-2023-22809 - Change IBM_ILA to ISC License * Wed Jan 27 2021 Ayappan P - 1.9.5p2-1 - Update to 1.9.5p2 version (contains fix for CVE-2021-3156) * Mon Oct 09 2020 Baanu Tumma - 1.8.31p1-3 - No longer shipping files from /usr/include directory * Fri Jun 26 2020 Ayappan P - 1.8.31p1-2 - Fix library search path for 64bit - Set LDR_PRELOAD64 for 64bit build * Mon May 04 2020 Baanu Tumma - 1.8.31p1 - Updated to version 1.8.31p1 * Wed Dec 04 2019 Sangamesh Mallayya 1.8.28-1 - Update to 1.8.28 which includes CVE fix CVE-2019-14287. * Thu Sep 12 2019 Sangamesh Mallayya 1.8.27-3 - Rebuild to use newer AIX authentication API. - Newer API's saves the state information and works better than - the older API's. * Thu Jun 06 2019 Ravi Hirekurabar - sudo_ids-1.8.27-2 - Rebuilt with pam support - Used patch0 to fix expired password login issue * Mon Mar 18 2019 Ravi Hirekurabar - sudo_ids-1.8.27-1 - Updated to 1.8.17 * Fri Mar 2 2018 Harshita Jain sudo_ods-1.8.21p2-1 - update to 1.8.21p2 * Fri Dec 15 2017 Ayappan P sudo_ids-1.8.20p2-3 - Include necessary files like sudoers2ldif and correct post-install - message to show /etc/sudo-ldap.conf as the conf file. * Tue Nov 14 2017 Ayappan P sudo_ids-1.8.20p2-2 - Fixes regarding proper ldap conf file & gettext dependency - rectify rpm_share errors due to improper symlinks * Wed Sep 27 2017 Ravi Hirekurabar sudo_ids-1.8.20p2-1 - Build with IBMLDAP. * Fri Jul 14 2017 Sangamesh Mallayya 1.8.20p2-3 - Update to include CVE fixes. - Build with -fstack-check & maxdata. * Sat Jul 02 2016 Sangamesh Mallayya 1.8.15-2 - Rebuild with ldap support. * Thu Mar 17 2016 Sangamesh Mallayya 1.8.15-1 - Update to 1.8.15 * Tue Apr 7 2015 Sangamesh Mallayya 1.8.13-1 - Update to 1.8.13 * Thu Nov 11 2011 Sangamesh Mallayya 1.6.9p23 - Update to 1.6.9p23 * Fri Aug 22 2008 Garrick Trowsdale - Move BuildRequires: openldap-devel inside conditional block * Tue Jul 29 2008 Reza Arbab 1.6.9p15-2noldap - Create a non-LDAP enabled release. Build with --define 'noldap 1'. * Wed Jul 2 2008 Reza Arbab 1.6.9p15-2 - Change the order of the libpath encoded in the sudo binary. * Fri May 2 2008 Reza Arbab 1.6.9p15-1 - Update to 1.6.9p15. - Configure with-ldap and with-noexec. Require openldap. * Tue Apr 27 2004 David Clissold 1.6.7p5-2 - Make sure /etc/sudoers installs with 0440 permissions. - Thanks to Leigh Brown (leigh@solinno.co.uk) for pointing this out. * Wed May 21 2003 David Clissold 1.6.7p5-1 - New version, 1.6.7p5. (Includes earlier security fix; separate - patch no longer required). * Fri Nov 22 2002 David Clissold - Add IBM ILA license. * Wed Jul 17 2002 David Clissold - New version, 1.6.5p2. Security patch still required. * Thu Apr 25 2002 David Clissold - Security patch announced today; added. * Fri Feb 08 2002 Marc Stephenson - New version * Tue Oct 23 2001 David Clissold - No functional change. Remove unneccessary libtool use. * Thu Oct 11 2001 Marc Stephenson - Use configure with-authenticate * Fri Apr 20 2001 Marc Stephenson - Build for AIX Toolbox for Linux Distributions * Mon Mar 5 2001 Hirofumi Takeda - update to 1.6.3p7 * Thu Feb 22 2001 Hirofumi Takeda - update to 1.6.3p6 * Sat Dec 30 2000 Roger Luethi - 1.6.3p5-2: libtoolized build * Thu Sep 21 2000 Hirofumi Takeda - rewrite spec file for FHS 2.1 - updated to 1.6.3p5 o Fixed a case where a string was used after it had been freed. o Fixed a bug that prevented the -H option from working. o Fixed targetpw, rootpw, and runaspw options when used with non-passwd file authentication (PAM, etc). o When the targetpw flag is set, use the target username as part of the timestamp path. o The listpw and verifypw options had no effect. * Mon Jul 17 2000 SL Baur - alpha port * Mon Mar 27 2000 Takeshi Aihana - updated to 1.6.3 - patch pathname of libpam * Sat Mar 25 2000 Hirofumi Takeda - update to 1.6.2p3 * Fri Feb 4 2000 Hirofumi Takeda - Repackaged for TurboLinux Workstation 6.0J * Sun Jan 9 2000 Takaaki Tabuchi - be able to rebuild non-root user. * Sun Dec 19 1999 Taichi Nakamura - update to 1.6.1 * Tue Dec 14 1999 Tenkou N. Hattori - change /etc/sudoers to noreplace. * Tue Nov 30 1999 Tenkou N. Hattori - updated to 1.6 - be a NoSrc :-P * Thu Jul 22 1999 Tim Powers - updated to 1.5.9p2 for Powertools 6.1 * Wed May 12 1999 Bill Nottingham - sudo is configured with pam. There's no pam.d file. Oops. * Mon Apr 26 1999 Preston Brown - upgraded to 1.59p1 for powertools 6.0 * Tue Oct 27 1998 Preston Brown - fixed so it doesn't find /usr/bin/vi first, but instead /bin/vi (always installed) * Fri Oct 08 1998 Michael Maher - built package for 5.2 * Mon May 18 1998 Michael Maher - updated SPEC file. * Thu Jan 29 1998 Otto Hammersmith - updated to 1.5.4 * Tue Nov 18 1997 Otto Hammersmith - built for glibc, no problems * Fri Apr 25 1997 Michael Fulbright - Fixed for 4.2 PowerTools - Still need to be pamified - Still need to move stmp file to /var/log * Mon Feb 17 1997 Michael Fulbright - First version for PowerCD.