sudo-1.9.17p1-160000.2.2

- Update to 1.9.17p1
  * Fix a possible local privilege escalation via the --host option
    [bsc#1245274, CVE-2025-32462]
  * Fix a possible local privilege Escalation via chroot option
    [bsc#1245275, CVE-2025-32463]
- Update to 1.9.17
  * Sudo now uses the NODEV macro consistently. Bug #1074.
    Fixed a bug where the ALL command in a sudoers rule would
    override a previous NOSETENV tag. Command tags are inherited from
    previous Cmnds in a Cmnd_Spec_List. There is a special case for
    the SETENV tag with the ALL command, where SETENV is implied if
    no explicit SETENV or NOSETENV tag is specified. This special
    case did not take into account that a NOSETENV tag that was inherited
    should override this behavior.
  * If sudo is run via ssh without a terminal and a password is required,
    it now suggest using ssh’s -t option.
  * Fixed the display of timeout values in the sudo -V output on systems
    without a C99-compliant snprintf() function.
  * Quieted a number of minor Coverity warnings.
  * Fixed a problem running sudo from a serial console on Linux when the
    command is run in a pseudo-terminal (the default).
  * Fixed a crash in sudo which could occur if there was a fatal error
    after the user was validated but before the command was actually run.
  * Fixed a number of man page style warnings. The “lint” make target in
    the docs directory will now run groff with warnings enabled if it is
    available. Bug #1075.
  * The ignore_dot sudoers setting is now on by default. There is now a
  - -disable-ignore-dot configure option to disable it. The
  - -with-ignore-dot configure option has been deprecated.
  * Fixed a problem with the pwfeedback option where an initial backspace
    would reduce the maximum length allowed for the password.
    GitHub issue #439.
  * Fixed minor grammar and spelling problems in the man pages.
  * Fixed a bug where a user could avoid entering a password for sudo -l
    command if they specified their own user or group name via the -u or
  - g options.
  * Avoid potential password guessing based on timing attacks on the
    strcmp() function on systems without PAM or a crypt() function where
    plaintext passwords are stored in the shadow password file.
  * Fixed a potential information leak where sudo -l command could be used
    to determine whether an executable exists in a directory that they do
    not have search access to.
  * Sudo uses TCSAFLUSH, not TCSADRAIN, when disabling echo once again.
    A long time ago sudo changed from using TCSAFLUSH to TCSADRAIN due
    to some systems having bugs related to TCSAFLUSH. That should no longer
    be a concern. Using TCSAFLUSH ensures that password input that has been
    received by the kernel, but not yet read by sudo, will be discarded and
    not echoed.
  * Added the SUDO_TTY environment variable if the user has a terminal.
    This can be used to find the user’s original tty device when sudo runs
    the command in its own pseudo-terminal. GitHub issue #447.
  * New Cantonese translation for sudo.

- Update to 1.9.16p2:
  * Sudo now passes the terminal device number to the policy plugin
  even if it cannot resolve it to a path name. This allows sudo to
  run without warnings in a chroot jail when the terminal device
  files are not present. GitHub issue #421.
  * On Linux systems, sudo will now attempt to use the symbolic links
  in /proc/self/fd/{0,1,2} when resolving the terminal device number.
  This can allow sudo to map a terminal device to its path name even
  when /dev/pts is not mounted in a chroot jail.
  * Fixed compilation errors with gcc and clang in C23 mode. C23 no
  longer supports functions with unspecified arguments. GitHub issue
  [#420].
  * Fixed the test for cross-compiling when checking for C99 snprintf().
  The changes made to the test in sudo 1.9.16 resulted in a different
  problem. GitHub issue #386.
  * Fixed the date used by the exit record in sudo-format log files.
  This was a regression introduced in sudo 1.9.16 and only affected
  file-based logs, not syslog. GitHub issue #405.
  * Fixed the root cause of the “unable to find terminal name for device”
  message when running sudo on AIX when no terminal is present. In
  sudo 1.9.16 this was turned from a debug message into a warning.
  GitHub issue #408.
  * When a duplicate alias is found in the sudoers file, the warning
  message now includes the file and line number of the previous
  definition.
  * Added support for the --with-secure-path-value=no configure option
  to allow packagers to ship the default sudoers file with the secure
  path line commented out.
  * Sudo no longer sends mail when a user runs sudo -nv or sudo -nl,
  even if mail_badpass or mail_always are set. Sudo already avoids
  logging to a file or syslog in this case. Bug #1072.
  * Added the cmddenial_message sudoers option to provide additional
  information to the user when a command is denied by the sudoers
  policy. The default message is still displayed.
  * The time stamp used for file-based logs is now more consistent
  with the time stamp produced by syslog. GitHub issue #327.
  * Sudo will now warn the user if it can detect the user’s terminal but
  cannot determine the path to the terminal device. The sudoers time
  stamp file will now use the terminal device number directly.
  GitHub issue #329.
  * The embedded copy of zlib has been updated to version 1.3.1.
  * Improved error handling if generating the list of signals and signal
  names fails at build time.
  * Fixed a compilation issue on Linux systems without process_vm_readv().
  * Fixed cross-compilation with WolfSSL.
  * Added a json_compact value for the sudoers log_format option which can
  be used when logging to a file. The existing json value has been aliased
  to json_pretty. In a future release, json will be an alias for
  json_compact. GitHub issue #357.
  * A new pam_silent sudoers option has been added which may be negated to
  avoid suppressing output from PAM authentication modules. GitHub issue #216.
  * Fixed several cvtsudoers JSON output problems. GitHub issues #369, #370,
  [#371], #373, #381.
  * When sudo runs a command in a pseudo-terminal and the user’s terminal is
  revoked, the pseudo-terminal’s foreground process group will now receive
  SIGHUP before the terminal is revoked. This emulates the behavior of the
  session leader exiting and is consistent with what happens when,
  for example, an ssh session is closed. GitHub issue #367.
  * Fixed make test with Python 3.12. GitHub issue #374.
  * In schema.ActiveDirectory, fixed the quoting in the example command.
  GitHub issue #376.
  * Paths specified via a Chdir_Spec or Chroot_Spec in sudoers may now
  be double-quoted.
  * Sudo insults are now included by default, but disabled unless the
  - -with-insults configure option is specified or the insults sudoers
  option is enabled.
  * The default sudoers file now enables the secure_path option by
  default and preserves the EDITOR, VISUAL, and SUDO_EDITOR environment
  variables when running visudo. The new --with-secure-path-value
  configure option can be used to set the value of secure_path in
  the default sudoers file. GitHub issue #387.
  * A sudoers schema for IBM Directory Server (aka IBM Tivoli Directory
  Server, IBM Security Directory Server, and IBM Security Verify
  Directory) is now included.
  * When cross-compiling sudo, the configure script now assumes that
  the snprintf() function is C99-compliant if the C compiler
  supports the C99 standard. Previously, configure would use sudo’s
  own snprintf() when cross-compiling. GitHub issue #386.

- A quick note that bsc#1227574 is expected behavior in this
  version of sudo. It was a regression in 15.6 which doesn't have
  the /etc/ split for pam.d yet.

- Update to 1.9.15p5:
  * Fixed evaluation of the lecture, listpw, verifypw, and fdexec sudoers
    Defaults settings when used without an explicit value. Previously, if
    specified without a value they were evaluated as boolean false, even when
    the negation operator ('!') was not present.
  * Fixed a bug introduced in sudo 1.9.14 that prevented LDAP netgroup queries
    using the NETGROUP_BASE setting from being performed.
  * Sudo will now transparently rename a user's lecture file from the older
    name-based path to the newer user-ID-based path. GitHub issue #342.
  * Fixed a bug introduced in sudo 1.9.15 that could cause a memory allocation
    failure if sysconf(_SC_LOGIN_NAME_MAX) fails. Bug #1066.

- For existing products (SLE15-SP* and older) keep using /etc and don't
  switch to /usr/etc. So only SLES16/ALP, Tumbleweed and newer products
  will use both /etc and /usr/etc locations.

- Update to 1.9.15p4:
  * Fixed a bug introduced in sudo 1.9.15 that could prevent a user’s
    privileges from being listed by sudo -l if the sudoers entry
    in /etc/nsswitch.conf contains [SUCCESS=return]. This did not affect the
    ability to run commands via sudo. Bug #1063.
- Update to 1.9.15p3:
  * Always disable core dumps when sudo sends itself a fatal signal. Fixes a
    problem where sudo could potentially dump core dump when it re-sends the
    fatal signal to itself. This is only an issue if the command   * received
    a signal that would normally result in a core dump but the command did
    not actually dump core.
  * Fixed a bug matching a command with a relative path name when the sudoers
    rule uses shell globbing rules for the path name. Bug #1062.
  * Permit visudo to be run even if the local host name is not set. GitHub
    issue #332.
  * Fixed an editing error introduced in sudo 1.9.15 that could prevent
    sudoreplay from replaying sessions correctly. GitHub issue #334.
  * Fixed a bug introduced in sudo 1.9.15 where sudo -l > /dev/null could hang
    on Linux systems. GitHub issue #335.
  * Fixed a bug introduced in sudo 1.9.15 where Solaris privileges specified
    in sudoers were not applied to the command being run.

- Update to 1.9.15p2:
  * Fixed a bug on BSD systems where sudo would not restore the
    terminal settings on exit if the terminal had parity enabled.
    GitHub issue #326.
- Update to 1.9.15p1:
  * Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based
    sudoers from being able to read the ldap.conf file.
    GitHub issue #325.
- Update to 1.9.15:
  * Fixed an undefined symbol problem on older versions of macOS
    when "intercept" or "log_subcmds" are enabled in sudoers.
    GitHub issue #276.
  * Fixed "make check" failure related to getpwent(3) wrapping
    on NetBSD.
  * Fixed the warning message for "sudo -l command" when the command
    is not permitted.  There was a missing space between "list" and
    the actual command due to changes in sudo 1.9.14.
  * Fixed a bug where output could go to the wrong terminal if
    "use_pty" is enabled (the default) and the standard input, output
    or error is redirected to a different terminal.  Bug #1056.
  * The visudo utility will no longer create an empty file when the
    specified sudoers file does not exist and the user exits the
    editor without making any changes.  GitHub issue #294.
  * The AIX and Solaris sudo packages on www.sudo.ws now support
    "log_subcmds" and "intercept" with both 32-bit and 64-bit
    binaries.  Previously, they only worked when running binaries
    with the same word size as the sudo binary.  GitHub issue #289.
  * The sudoers source is now logged in the JSON event log.  This
    makes it possible to tell which rule resulted in a match.
  * Running "sudo -ll command" now produces verbose output that
    includes matching rule as well as the path to the sudoers file
    the matching rule came from.  For LDAP sudoers, the name of the
    matching sudoRole is printed instead.
  * The embedded copy of zlib has been updated to version 1.3.
  * The sudoers plugin has been modified to make it more resilient
    to ROWHAMMER attacks on authentication and policy matching.
    This addresses CVE-2023-42465.
  * The sudoers plugin now constructs the user time stamp file path
    name using the user-ID instead of the user name.  This avoids a
    potential problem with user names that contain a path separator
    ('/') being interpreted as part of the path name.  A similar
    issue in sudo-rs has been assigned CVE-2023-42456.
  * A path separator ('/') in a user, group or host name is now
    replaced with an underbar character ('_') when expanding escapes
    in @include and @includedir directives as well as the "iolog_file"
    and "iolog_dir" sudoers Default settings.
  * The "intercept_verify" sudoers option is now only applied when
    the "intercept" option is set in sudoers.  Previously, it was
    also applied when "log_subcmds" was enabled.  Sudo 1.9.14
    contained an incorrect fix for this.  Bug #1058.
  * Changes to terminal settings are now performed atomically, where
    possible.  If the command is being run in a pseudo-terminal and
    the user's terminal is already in raw mode, sudo will not change
    the user's terminal settings.  This prevents concurrent sudo
    processes from restoring the terminal settings to the wrong values.
    GitHub issue #312.
  * Reverted a change from sudo 1.9.4 that resulted in PAM session
    modules being called with the environment of the command to be
    run instead of the environment of the invoking user.
    GitHub issue #318.
  * New Indonesian translation from translationproject.org.
  * The sudo_logsrvd server will now raise its open file descriptor
    limit to the maximum allowed value when it starts up.  Each
    connection can require up to nine open file descriptors so the
    default soft limit may be too low.
  * Better log message when rejecting a command if the "intercept"
    option is enabled and the "intercept_allow_setid" option is
    disabled.  Previously, "command not allowed" would be logged and
    the user had no way of knowing what the actual problem was.
  * Sudo will now log the invoking user's environment as "submitenv"
    in the JSON logs.  The command's environment ("runenv") is no
    longer logged for commands rejected by the sudoers file or an
    approval plugin.

- Package/ship empty /etc/sudoers.d directory for admins to
  discover where to put their won config.

- Introduce optional wheel and sudo group policies as separate packages
  (bsc#1203978, jsc#PED-260)

- Install config files into /usr/etc and read from both location:
  /etc and /usr/etc (bsc#1205118)