Annotation of src/usr.bin/sudo/WHATSNEW, Revision 1.4
1.4 ! millert 1: What's new in Sudo 1.7.2?
! 2:
! 3: * A new #includedir directive is available in sudoers. This can be
! 4: used to implement an /etc/sudo.d directory. Files in an includedir
! 5: are not edited by visudo unless they contain a syntax error.
! 6:
! 7: * The -g option did not work properly when only setting the group
! 8: (and not the user). Also, in -l mode the wrong user was displayed
! 9: for sudoers entries where only the group was allowed to be set.
! 10:
! 11: * Fixed a problem with the alias checking in visudo which
! 12: could prevent visudo from exiting.
! 13:
! 14: * Sudo will now correctly parse the shell-style /etc/environment
! 15: file format used by pam_env on Linux.
! 16:
! 17: * When doing password and group database lookups, sudo will only
! 18: cache an entry by name or by id, depending on how the entry was
! 19: looked up. Previously, sudo would cache by both name and id
! 20: from a single lookup, but this breaks sites that have multiple
! 21: password or group database names that map to the same uid or
! 22: gid.
! 23:
! 24: * User and group names in sudoers may now be enclosed in double
! 25: quotes to avoid having to escape special characters.
! 26:
! 27: * BSM audit fixes when changing to a non-root uid.
! 28:
! 29: * Experimental non-Unix group support. Currently only works with
! 30: Quest Authorization Services and allows Active Directory groups
! 31: fixes for Minix-3.
! 32:
! 33: * For Netscape/Mozilla-derived LDAP SDKs the certificate and key
! 34: paths may be specified as a directory or a file. However, version
! 35: 5.0 of the SDK only appears to support using a directory (despite
! 36: documentation to the contrary). If SSL client initialization
! 37: fails and the certificate or key paths look like they could be
! 38: default file name, strip off the last path element and try again.
! 39:
! 40: * A setenv() compatibility fix for Linux systems, where a NULL
! 41: value is treated the same as an empty string and the variable
! 42: name is checked against the NULL pointer.
! 43:
1.2 millert 44: What's new in Sudo 1.7.1?
45:
46: * A new Defaults option "pwfeedback" will cause sudo to provide visual
47: feedback when the user is entering a password.
48:
49: * A new Defaults option "fast_glob" will cause sudo to use the fnmatch()
50: function for file name globbing instead of glob(). When this option
51: is enabled, sudo will not check the file system when expanding wildcards.
52: This is faster but a side effect is that relative paths with wildcard
53: will no longer work.
54:
55: * New BSM audit support for systems that support it such as FreeBSD
56: and Mac OS X.
57:
58: * The file name specified with the #include directive may now include
59: a %h escape which is expanded to the short form of hostname.
60:
61: * The -k flag may now be specified along with a command, causing the
62: user's timestamp file to be ignored.
63:
64: * New support for Tivoli-based LDAP START_TLS, present in AIX.
65:
66: * New support for /etc/netsvc.conf on AIX.
67:
68: * The unused alias checks in visudo now handle the case of an alias
69: referring to another alias.
70:
1.1 millert 71: What's new in Sudo 1.7.0?
72:
73: * Rewritten parser that converts sudoers into a set of data structures.
74: This eliminates a number of ordering issues and makes it possible to
75: apply sudoers Defaults entries before searching for the command.
76: It also adds support for per-command Defaults specifications.
77:
78: * Sudoers now supports a #include facility to allow the inclusion of other
79: sudoers-format files.
80:
81: * Sudo's -l (list) flag has been enhanced:
82: o applicable Defaults options are now listed
83: o a command argument can be specified for testing whether a user
84: may run a specific command.
85: o a new -U flag can be used in conjunction with "sudo -l" to allow
86: root (or a user with "sudo ALL") list another user's privileges.
87:
88: * A new -g flag has been added to allow the user to specify a
89: primary group to run the command as. The sudoers syntax has been
90: extended to include a group section in the Runas specification.
91:
92: * A uid may now be used anywhere a username is valid.
93:
94: * The "secure_path" run-time Defaults option has been restored.
95:
96: * Password and group data is now cached for fast lookups.
97:
98: * The file descriptor at which sudo starts closing all open files is now
99: configurable via sudoers and, optionally, the command line.
100:
101: * Visudo will now warn about aliases that are defined but not used.
102:
103: * The -i and -s command line flags now take an optional command
104: to be run via the shell. Previously, the argument was passed
105: to the shell as a script to run.
106:
107: * Improved LDAP support. SASL authentication may now be used in
108: conjunction when connecting to an LDAP server. The krb5_ccname
109: parameter in ldap.conf may be used to enable Kerberos.
110:
111: * Support for /etc/nsswitch.conf. LDAP users may now use nsswitch.conf
112: to specify the sudoers order. E.g.:
113: sudoers: ldap files
114: to check LDAP, then /etc/sudoers. The default is "files", even
115: when LDAP support is compiled in. This differs from sudo 1.6
116: where LDAP was always consulted first.
117:
118: * Support for /etc/environment on AIX and Linux. If sudo is run
119: with the -i flag, the contents of /etc/environment are used to
120: populate the new environment that is passed to the command being
121: run.
122:
123: * If no terminal is available or if the new -A flag is specified,
124: sudo will use a helper program to read the password if one is
125: configured. Typically, this is a graphical password prompter
126: such as ssh-askpass.
127:
128: * A new Defaults option, "mailfrom" that sets the value of the
129: "From:" field in the warning/error mail. If unspecified, the
130: login name of the invoking user is used.
131:
132: * A new Defaults option, "env_file" that refers to a file containing
133: environment variables to be set in the command being run.
134:
135: * A new flag, -n, may be used to indicate that sudo should not
136: prompt the user for a password and, instead, exit with an error
137: if authentication is required.
138:
139: * If sudo needs to prompt for a password and it is unable to disable
140: echo (and no askpass program is defined), it will refuse to run
141: unless the "visiblepw" Defaults option has been specified.
142:
143: * Prior to version 1.7.0, hitting enter/return at the Password: prompt
144: would exit sudo. In sudo 1.7.0 and beyond, this is treated as
145: an empty password. To exit sudo, the user must press ^C or ^D
146: at the prompt.
147:
148: * visudo will now check the sudoers file owner and mode in -c (check)
149: mode when the -s (strict) flag is specified.
1.3 millert 150:
151: * A new Defaults option "umask_override" will cause sudo to set the
152: umask specified in sudoers even if it is more permissive than the
153: invoking user's umask.
![[BACK]](/icons/back.gif){kind=icon}
Return to WHATSNEW CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / sudo