mirror of
https://github.com/openwrt/packages.git
synced 2026-10-12 05:57:04 +04:00
Michael Pfeifroth
6b5954ef81
Add a 'sudo' system group at package-install time using the USERID
mechanism.
Rationale: sudoers configurations that grant privileges to the 'sudo'
group -- the near-universal Debian/Ubuntu idiom, e.g.
%sudo ALL=(ALL:ALL) NOPASSWD: ALL
-- fail silently on OpenWrt today because no 'sudo' group exists in
/etc/group. sudo(8) logs 'unknown group: sudo' and the rule is skipped.
Users also cannot 'usermod -aG sudo <user>' without the group present,
so there is no straightforward way to delegate root without hand-editing
/etc/group or writing per-user sudoers snippets.
Seeding the group here matches how OpenWrt already handles other
service accounts (chrony, dbus, ntpd, ...): the USERID mechanism
creates them lazily via add_group_and_user in the postinst script.
No privileges are granted by default -- an administrator still has to
add users to the group and ship a sudoers rule that references it.
No numeric GID is pinned. The group name is what sudoers, addgroup(1),
and getgrnam() operate on; the numeric GID is invisible to sudo's
authorisation path and matters only for on-disk group ownership
metadata (e.g. 'chgrp sudo' persisted to shared storage) -- something
this package does not do. Letting add_group_and_user pick a dynamic
GID in the 32768+ range keeps sudo out of base-files' reserved
low-range group space and avoids any name-vs-number collision debate.
Bump PKG_RELEASE.
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
92 lines
2.2 KiB
Makefile
92 lines
2.2 KiB
Makefile
#
|
|
# Copyright (C) 2006-2017 OpenWrt.org
|
|
#
|
|
# This is free software, licensed under the GNU General Public License v2.
|
|
# See /LICENSE for more information.
|
|
#
|
|
|
|
include $(TOPDIR)/rules.mk
|
|
|
|
PKG_NAME:=sudo
|
|
PKG_REALVERSION:=1.9.17p2
|
|
PKG_VERSION:=$(subst p,_p,$(PKG_REALVERSION))
|
|
PKG_RELEASE:=2
|
|
|
|
PKG_SOURCE:=$(PKG_NAME)-$(PKG_REALVERSION).tar.gz
|
|
PKG_SOURCE_URL:=https://www.sudo.ws/dist
|
|
PKG_HASH:=4a38a1ab3adb1199257edc2a7c4a2bd714665eb605b04368843b06dada2cfcfb
|
|
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_REALVERSION)
|
|
|
|
PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
|
|
|
|
PKG_LICENSE:=ISC
|
|
PKG_LICENSE_FILES:=LICENSE.md
|
|
PKG_CPE_ID:=cpe:/a:sudo_project:sudo
|
|
|
|
PKG_INSTALL:=1
|
|
PKG_BUILD_PARALLEL:=1
|
|
PKG_BUILD_FLAGS:=no-mips16
|
|
|
|
include $(INCLUDE_DIR)/package.mk
|
|
|
|
define Package/sudo
|
|
SECTION:=admin
|
|
CATEGORY:=Administration
|
|
TITLE:=Delegate authority to run commands
|
|
URL:=https://www.sudo.ws/
|
|
USERID:=:sudo
|
|
DEPENDS:= +USE_GLIBC:libcrypt-compat
|
|
endef
|
|
|
|
define Package/sudo/description
|
|
Sudo (su "do") allows a system administrator to delegate authority to
|
|
give certain users (or groups of users) the ability to run some (or
|
|
all) commands as root or another user while providing an audit trail of
|
|
the commands and their arguments.
|
|
endef
|
|
|
|
define Package/sudo/conffiles
|
|
/etc/sudoers
|
|
/etc/sudoers.d/
|
|
endef
|
|
|
|
CONFIGURE_ARGS += \
|
|
--without-pam \
|
|
--disable-pam-session \
|
|
--with-editor=/bin/vi \
|
|
--without-lecture \
|
|
--disable-zlib \
|
|
--disable-openssl \
|
|
--with-rundir=/var/lib/sudo \
|
|
--with-vardir=/var/lib/sudo
|
|
|
|
CONFIGURE_VARS += \
|
|
sudo_cv_uid_t_len=10 \
|
|
sudo_cv_func_unsetenv_void=no
|
|
|
|
define Package/sudo/install
|
|
$(INSTALL_DIR) \
|
|
$(1)/etc/{init.d,sudoers.d} \
|
|
$(1)/usr/{bin,sbin} \
|
|
$(1)/usr/lib/sudo
|
|
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/bin/sudo $(1)/usr/bin/
|
|
chmod 4755 $(1)/usr/bin/sudo
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/visudo $(1)/usr/sbin/
|
|
$(CP) $(PKG_INSTALL_DIR)/etc/sudoers $(1)/etc/
|
|
chmod 0440 $(1)/etc/sudoers
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/sudo/*.so* $(1)/usr/lib/sudo/
|
|
$(INSTALL_BIN) ./files/sudo.init $(1)/etc/init.d/sudo
|
|
endef
|
|
|
|
define Package/sudo/postinst
|
|
#!/bin/sh
|
|
|
|
[ -n "$$IPKG_INSTROOT" ] || {
|
|
/etc/init.d/sudo enable
|
|
/etc/init.d/sudo start
|
|
}
|
|
endef
|
|
|
|
$(eval $(call BuildPackage,sudo))
|