From owner-svn-ports-head@freebsd.org Thu Apr 19 13:11:35 2018 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 42620FA44C2; Thu, 19 Apr 2018 13:11:35 +0000 (UTC) (envelope-from garga@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id E71D67303A; Thu, 19 Apr 2018 13:11:34 +0000 (UTC) (envelope-from garga@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id C80C32055; Thu, 19 Apr 2018 13:11:34 +0000 (UTC) (envelope-from garga@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w3JDBYAt088173; Thu, 19 Apr 2018 13:11:34 GMT (envelope-from garga@FreeBSD.org) Received: (from garga@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w3JDBYnY088172; Thu, 19 Apr 2018 13:11:34 GMT (envelope-from garga@FreeBSD.org) Message-Id: <201804191311.w3JDBYnY088172@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: garga set sender to garga@FreeBSD.org using -f From: Renato Botelho Date: Thu, 19 Apr 2018 13:11:34 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r467768 - head/security/sudo X-SVN-Group: ports-head X-SVN-Commit-Author: garga X-SVN-Commit-Paths: head/security/sudo X-SVN-Commit-Revision: 467768 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Apr 2018 13:11:35 -0000 Author: garga Date: Thu Apr 19 13:11:34 2018 New Revision: 467768 URL: https://svnweb.freebsd.org/changeset/ports/467768 Log: - Add new options to security/sudo to make it possible to build it with kerberos support. - Bump PORTREVISION PR: 225498 Submitted by: Cullum Smith Sponsored by: Rubicon Communications, LLC (Netgate) Modified: head/security/sudo/Makefile Modified: head/security/sudo/Makefile ============================================================================== --- head/security/sudo/Makefile Thu Apr 19 13:09:58 2018 (r467767) +++ head/security/sudo/Makefile Thu Apr 19 13:11:34 2018 (r467768) @@ -3,6 +3,7 @@ PORTNAME= sudo PORTVERSION= 1.8.22 +PORTREVISION= 1 CATEGORIES= security MASTER_SITES= SUDO @@ -28,8 +29,9 @@ CONFIGURE_ARGS= --sysconfdir=${PREFIX}/etc \ --with-long-otp-prompt OPTIONS_DEFINE= LDAP INSULTS DISABLE_ROOT_SUDO DISABLE_AUTH NOARGS_SHELL \ - AUDIT OPIE NLS SSSD DOCS EXAMPLES -OPTIONS_DEFAULT= AUDIT + AUDIT OPIE PAM NLS SSSD DOCS EXAMPLES +OPTIONS_RADIO= KERBEROS +OPTIONS_DEFAULT= AUDIT PAM OPTIONS_SUB= yes INSULTS_DESC= Enable insults on failures @@ -37,9 +39,13 @@ DISABLE_ROOT_SUDO_DESC= Do not allow root to run sudo DISABLE_AUTH_DESC= Do not require authentication by default NOARGS_SHELL_DESC= Run a shell if no arguments are given AUDIT_DESC= Enable BSM audit support +KERBEROS_DESC= Enable Kerberos 5 authentication (no PAM support) OPIE_DESC= Enable one-time passwords (no PAM support) SSSD_DESC= Enable SSSD backend support. +PAM_PREVENTS= OPIE GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT +PAM_PREVENTS_MSG= PAM cannot be combined with any other authentication plugin + LOGFAC?= authpriv CONFIGURE_ARGS+= --with-logfac=${LOGFAC} @@ -67,10 +73,24 @@ DISABLE_ROOT_SUDO_CONFIGURE_ON= --disable-root-sudo DISABLE_AUTH_CONFIGURE_ON= --disable-authentication NOARGS_SHELL_CONFIGURE_ENABLE= noargs-shell AUDIT_CONFIGURE_WITH= bsm-audit +PAM_CONFIGURE_ON= --with-pam OPIE_CONFIGURE_ON= --with-opie -OPIE_CONFIGURE_OFF= --with-pam SSSD_CONFIGURE_ON= --with-sssd SSSD_RUN_DEPENDS= sssd:security/sssd + +OPTIONS_RADIO_KERBEROS= GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT +GSSAPI_BASE_USES= gssapi +GSSAPI_BASE_CONFIGURE_ON= --with-kerb5=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS} +GSSAPI_HEIMDAL_USES= gssapi:heimdal +GSSAPI_HEIMDAL_CONFIGURE_ON= --with-kerb5=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS} +GSSAPI_MIT_USES= gssapi:mit +GSSAPI_MIT_CONFIGURE_ON= --with-kerb5=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS} +# This is intentionally not an option. +# SUDO_KERB5_INSTANCE is an optional instance string that will be appended to kerberos +# principals when to perform authentication. Common choices are "admin" and "sudo". +.if defined(SUDO_KERB5_INSTANCE) +CONFIGURE_ARGS+= --enable-kerb5-instance="${SUDO_KERB5_INSTANCE}" +.endif .include