<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="10">
<package pkgid="d0c1fa1a343d1d78b29eb75bb89910888f0e811ba86330a51cf5ad84bc6a71c0" name="hostapd" arch="src">
    <version epoch="0" ver="2.6" rel="49.1"/>

<changelog author="cstender@suse.de" date="1200916800">- fixed madwifi include dir (b.n.c #350982)</changelog>
<changelog author="ro@suse.de" date="1222084800">- updae to version 0.5.10, changes:
  * fixed EAP-SIM and EAP-AKA message parser to validate attribute
    lengths properly to avoid potential crash caused by invalid messages
  * fixed Reassociation Response callback processing when using internal
    MLME (driver_{hostap,devicescape,test}.c)
  * fixed EAP-SIM/AKA realm processing to allow decorated usernames to
    be used
  * added a workaround for EAP-SIM/AKA peers that include incorrect null
    termination in the username
  * fixed EAP-SIM Start response processing for fast reauthentication
    case
  * copy optional Proxy-State attributes into RADIUS response when acting
    as a RADIUS authentication server
- update to version 0.5.9, changes:
  * updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest
    draft (draft-ietf-emu-eap-gpsk-07.txt)
  * fixed debugging code not to use potentially unaligned read to fetch
    IPv4 addresses</changelog>
<changelog author="ro@suse.de" date="1222171200">- drop buildreq for madwifi (dropped package)</changelog>
<changelog author="sndirsch@suse.de" date="1276084800">- udpated to release 0.6.10
- updated hostapd.dif
- git-commit-eb1f744.diff:
  * Move DTIM period configuration into Beacon set operation; fixes
    "Could not set DTIM period for kernel driver; wlan0: Unable to
    setup interface.rmdir[ctrl_interface]: No such file or
    directory" error when using "nl80211" driver</changelog>
<changelog author="jengelh@medozas.de" date="1288526400">- Use %_smp_mflags</changelog>
<changelog author="jengelh@medozas.de" date="1316174400">- Select libnl-1_1-devel</changelog>
<changelog author="uli@suse.com" date="1317384000">- cross-build fix: use %__cc macro</changelog>
<changelog author="lnussel@suse.de" date="1318420800">- update to version 0.7.3
- don't use /tmp for dump file in default config
- verbose build
- fix build for older distros
- enable driver 'none' for radius only mode
- add init script</changelog>
<changelog author="glin@suse.com" date="1337083200">- update to version 1.0
- respin hostapd.dif to fit the new defconfig
- change the file permission of the config files with passwords
  to 600 (bnc#740964)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1352203200">- Add Native systemd units</changelog>
<changelog author="avm-xandry@yandex.ru" date="1365508800">- update to version 2.0
- fix corrected file name hostapd.dif to hostapd.diff
- in default config includes all features (IEEE 802.11w, Hotspot 2.0, IEEE 802.11ac, WPS, etc.)</changelog>
<changelog author="cfarrell@suse.com" date="1366200000">- license update: GPL-2.0 or BSD-3-Clause
  README makes it clear that this is a dual license - i.e. choice of either
  or</changelog>
<changelog author="aj@suse.com" date="1366286400">- Do not package /etc/init.d
- Do not install init file since package contains a service file and
  is only build for Factory
- Cleanup spec file
- Use /run instead of /var/run</changelog>
<changelog author="dvaleev@suse.com" date="1380715200">- fix host_to_le32 undefined on BigEndian architectures
  (hostapd-be-host_to_le.patch)</changelog>
<changelog author="i@marguerite.su" date="1397649600">- update version 2.1
  * see http://hostap.epitest.fi/cgit/hostap/log/ for details.
- change hostapd.diff to hostapd-2.1-defconfig.patch
- remove patch: hostapd-tmp.diff, no longer needed.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1401192000">- Update hostapd-2.1-defconfig.patch and spec file
  to build with libnl3 instead of libnl1</changelog>
<changelog author="michael@stroeder.com" date="1420459200">- update version 2.3
- removed patch hostapd-2.1-be-host_to_le.patch because it
  seems obsolete
- hostapd-2.1-defconfig.patch rediffed and renamed to hostapd-2.3-defconfig.patch
  ChangeLog for hostapd since 2.1:
  2014-10-09 - v2.3
  * fixed number of minor issues identified in static analyzer warnings
  * fixed DFS and channel switch operation for multi-BSS cases
  * started to use constant time comparison for various password and hash
  values to reduce possibility of any externally measurable timing
  differences
  * extended explicit clearing of freed memory and expired keys to avoid
  keeping private data in memory longer than necessary
  * added support for number of new RADIUS attributes from RFC 7268
  (Mobility-Domain-Id, WLAN-HESSID, WLAN-Pairwise-Cipher,
  WLAN-Group-Cipher, WLAN-AKM-Suite, WLAN-Group-Mgmt-Pairwise-Cipher)
  * fixed GET_CONFIG wpa_pairwise_cipher value
  * added code to clear bridge FDB entry on station disconnection
  * fixed PMKSA cache timeout from Session-Timeout for WPA/WPA2 cases
  * fixed OKC PMKSA cache entry fetch to avoid a possible infinite loop
  in case the first entry does not match
  * fixed hostapd_cli action script execution to use more robust mechanism
  (CVE-2014-3686)
  2014-06-04 - v2.2
  * fixed SAE confirm-before-commit validation to avoid a potential
  segmentation fault in an unexpected message sequence that could be
  triggered remotely
  * extended VHT support
  - Operating Mode Notification
  - Power Constraint element (local_pwr_constraint)
  - Spectrum management capability (spectrum_mgmt_required=1)
  - fix VHT80 segment picking in ACS
  - fix vht_capab 'Maximum A-MPDU Length Exponent' handling
  - fix VHT20
  * fixed HT40 co-ex scan for some pri/sec channel switches
  * extended HT40 co-ex support to allow dynamic channel width changes
  during the lifetime of the BSS
  * fixed HT40 co-ex support to check for overlapping 20 MHz BSS
  * fixed MSCHAP UTF-8 to UCS-2 conversion for three-byte encoding;
  this fixes password with include UTF-8 characters that use
  three-byte encoding EAP methods that use NtPasswordHash
  * reverted TLS certificate validation step change in v2.1 that rejected
  any AAA server certificate with id-kp-clientAuth even if
  id-kp-serverAuth EKU was included
  * fixed STA validation step for WPS ER commands to prevent a potential
  crash if an ER sends an unexpected PutWLANResponse to a station that
  is disassociated, but not fully removed
  * enforce full EAP authentication after RADIUS Disconnect-Request by
  removing the PMKSA cache entry
  * added support for NAS-IP-Address, NAS-identifier, and NAS-IPv6-Address
  in RADIUS Disconnect-Request
  * added mechanism for removing addresses for MAC ACLs by prefixing an
  entry with "-"
  * Interworking/Hotspot 2.0 enhancements
  - support Hotspot 2.0 Release 2
  * OSEN network for online signup connection
  * subscription remediation (based on RADIUS server request or
  control interface HS20_WNM_NOTIF for testing purposes)
  * Hotspot 2.0 release number indication in WFA RADIUS VSA
  * deauthentication request (based on RADIUS server request or
  control interface WNM_DEAUTH_REQ for testing purposes)
  * Session Info URL RADIUS AVP to trigger ESS Disassociation Imminent
  * hs20_icon config parameter to configure icon files for OSU
  * osu_* config parameters for OSU Providers list
  - do not use Interworking filtering rules on Probe Request if
  Interworking is disabled to avoid interop issues
  * added/fixed nl80211 functionality
  - AP interface teardown optimization
  - support vendor specific driver command
  (VENDOR &lt;vendor id&gt; &lt;sub command id&gt; [&lt;hex formatted data&gt;])
  * fixed PMF protection of Deauthentication frame when this is triggered
  by session timeout
  * internal TLS implementation enhancements/fixes
  - add SHA256-based cipher suites
  - add DHE-RSA cipher suites
  - fix X.509 validation of PKCS#1 signature to check for extra data
  * RADIUS server functionality
  - add minimal RADIUS accounting server support (hostapd-as-server);
  this is mainly to enable testing coverage with hwsim scripts
  - allow authentication log to be written into SQLite databse
  - added option for TLS protocol testing of an EAP peer by simulating
  various misbehaviors/known attacks
  - MAC ACL support for testing purposes
  * fixed PTK derivation for CCMP-256 and GCMP-256
  * extended WPS per-station PSK to support ER case
  * added option to configure the management group cipher
  (group_mgmt_cipher=AES-128-CMAC (default), BIP-GMAC-128, BIP-GMAC-256,
  BIP-CMAC-256)
  * fixed AP mode default TXOP Limit values for AC_VI and AC_VO (these
  were rounded incorrectly)
  * added support for postponing FT response in case PMK-R1 needs to be
  pulled from R0KH
  * added option to advertise 40 MHz intolerant HT capability with
  ht_capab=[40-INTOLERANT]
  * remove WPS 1.0 only support, i.e., WSC 2.0 support is now enabled
  whenever CONFIG_WPS=y is set
  * EAP-pwd fixes
  - fix possible segmentation fault on EAP method deinit if an invalid
  group is negotiated
  * fixed RADIUS client retransmit/failover behavior
  - there was a potential ctash due to freed memory being accessed
  - failover to a backup server mechanism did not work properly
  * fixed a possible crash on double DISABLE command when multiple BSSes
  are enabled
  * fixed a memory leak in SAE random number generation
  * fixed GTK rekeying when the station uses FT protocol
  * fixed off-by-one bounds checking in printf_encode()
  - this could result in deinial of service in some EAP server cases
  * various bug fixes</changelog>
<changelog author="michael@stroeder.com" date="1429790400">- update version 2.4
- added 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
  for CVE-2015-1863
- updated URLs
- require pkg-config and libnl3-devel during build
- replaced hostapd-2.3-defconfig.patch by hostapd-2.4-defconfig.patch
  ChangeLog for hostapd since 2.3:
  2015-03-15 - v2.4
  * allow OpenSSL cipher configuration to be set for internal EAP server
    (openssl_ciphers parameter)
  * fixed number of small issues based on hwsim test case failures and
    static analyzer reports
  * fixed Accounting-Request to not include duplicated Acct-Session-Id
  * add support for Acct-Multi-Session-Id in RADIUS Accounting messages
  * add support for PMKSA caching with SAE
  * add support for generating BSS Load element (bss_load_update_period)
  * fixed channel switch from VHT to HT
  * add INTERFACE-ENABLED and INTERFACE-DISABLED ctrl_iface events
  * add support for learning STA IPv4/IPv6 addresses and configuring
    ProxyARP support
  * dropped support for the madwifi driver interface
  * add support for Suite B (128-bit and 192-bit level) key management and
    cipher suites
  * fixed a regression with driver=wired
  * extend EAPOL-Key msg 1/4 retry workaround for changing SNonce
  * add BSS_TM_REQ ctrl_iface command to send BSS Transition Management
    Request frames and BSS-TM-RESP event to indicate response to such
    frame
  * add support for EAP Re-Authentication Protocol (ERP)
  * fixed AP IE in EAPOL-Key 3/4 when both WPA and FT was enabled
  * fixed a regression in HT 20/40 coex Action frame parsing
  * set stdout to be line-buffered
  * add support for vendor specific VHT extension to enable 256 QAM rates
    (VHT-MCS 8 and 9) on 2.4 GHz band
  * RADIUS DAS:
  - extend Disconnect-Request processing to allow matching of multiple
    sessions
  - support Acct-Multi-Session-Id as an identifier
  - allow PMKSA cache entry to be removed without association
  * expire hostapd STA entry if kernel does not have a matching entry
  * allow chanlist to be used to specify a subset of channels for ACS
  * improve ACS behavior on 2.4 GHz band and allow channel bias to be
    configured with acs_chan_bias parameter
  * do not reply to a Probe Request frame that includes DSS Parameter Set
    element in which the channel does not match the current operating
    channel
  * add UPDATE_BEACON ctrl_iface command; this can be used to force Beacon
    frame contents to be updated and to start beaconing on an interface
    that used start_disabled=1
  * fixed some RADIUS server failover cases</changelog>
<changelog author="michael@stroeder.com" date="1445169600">- update to upstream release 2.5
- removed 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
  (CVE-2015-1863) because it's fixed in upstream release 2.5
- rebased hostapd-2.4-defconfig.patch -&gt; hostapd-2.5-defconfig.patch
  ChangeLog for hostapd since 2.4:
  2015-09-27 - v2.5
  * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding
  [http://w1.fi/security/2015-2/] (CVE-2015-4141 bsc#930077)
  * fixed WMM Action frame parser
  [http://w1.fi/security/2015-3/] (CVE-2015-4142 bsc#930078)
  * fixed EAP-pwd server missing payload length validation
  [http://w1.fi/security/2015-4/]
  (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, bsc#930079)
  * fixed validation of WPS and P2P NFC NDEF record payload length
  [http://w1.fi/security/2015-5/]
  * nl80211:
  - fixed vendor command handling to check OUI properly
  * fixed hlr_auc_gw build with OpenSSL
  * hlr_auc_gw: allow Milenage RES length to be reduced
  * disable HT for a station that does not support WMM/QoS
  * added support for hashed password (NtHash) in EAP-pwd server
  * fixed and extended dynamic VLAN cases
  * added EAP-EKE server support for deriving Session-Id
  * set Acct-Session-Id to a random value to make it more likely to be
  unique even if the device does not have a proper clock
  * added more 2.4 GHz channels for 20/40 MHz HT co-ex scan
  * modified SAE routines to be more robust and PWE generation to be
  stronger against timing attacks
  * added support for Brainpool Elliptic Curves with SAE
  * increases maximum value accepted for cwmin/cwmax
  * added support for CCMP-256 and GCMP-256 as group ciphers with FT
  * added Fast Session Transfer (FST) module
  * removed optional fields from RSNE when using FT with PMF
  (workaround for interoperability issues with iOS 8.4)
  * added EAP server support for TLS session resumption
  * fixed key derivation for Suite B 192-bit AKM (this breaks
  compatibility with the earlier version)
  * added mechanism to track unconnected stations and do minimal band
  steering
  * number of small fixes</changelog>
<changelog author="chris@intrbiz.com" date="1475409600">- update to upstream release 2.6
  * fixed EAP-pwd last fragment validation
    [http://w1.fi/security/2015-7/] (CVE-2015-5314)
  * fixed WPS configuration update vulnerability with malformed passphrase
    [http://w1.fi/security/2016-1/] (CVE-2016-4476)
  * extended channel switch support for VHT bandwidth changes
  * added support for configuring new ANQP-elements with
    anqp_elem=&lt;InfoID&gt;:&lt;hexdump of payload&gt;
  * fixed Suite B 192-bit AKM to use proper PMK length
    (note: this makes old releases incompatible with the fixed behavior)
  * added no_probe_resp_if_max_sta=1 parameter to disable Probe Response
    frame sending for not-associated STAs if max_num_sta limit has been
    reached
  * added option (-S as command line argument) to request all interfaces
    to be started at the same time
  * modified rts_threshold and fragm_threshold configuration parameters
    to allow -1 to be used to disable RTS/fragmentation
  * EAP-pwd: added support for Brainpool Elliptic Curves
    (with OpenSSL 1.0.2 and newer)
  * fixed EAPOL reauthentication after FT protocol run
  * fixed FTIE generation for 4-way handshake after FT protocol run
  * fixed and improved various FST operations
  * TLS server
  - support SHA384 and SHA512 hashes
  - support TLS v1.2 signature algorithm with SHA384 and SHA512
  - support PKCS #5 v2.0 PBES2
  - support PKCS #5 with PKCS #12 style key decryption
  - minimal support for PKCS #12
  - support OCSP stapling (including ocsp_multi)
  * added support for OpenSSL 1.1 API changes
  - drop support for OpenSSL 0.9.8
  - drop support for OpenSSL 1.0.0
  * EAP-PEAP: support fast-connect crypto binding
  * RADIUS
  - fix Called-Station-Id to not escape SSID
  - add Event-Timestamp to all Accounting-Request packets
  - add Acct-Session-Id to Accounting-On/Off
  - add Acct-Multi-Session-Id  ton Access-Request packets
  - add Service-Type (= Frames)
  - allow server to provide PSK instead of passphrase for WPA-PSK
    Tunnel_password case
  - update full message for interim accounting updates
  - add Acct-Delay-Time into Accounting messages
  - add require_message_authenticator configuration option to require
    CoA/Disconnect-Request packets to be authenticated
  * started to postpone WNM-Notification frame sending by 100 ms so that
    the STA has some more time to configure the key before this frame is
    received after the 4-way handshake
  * VHT: added interoperability workaround for 80+80 and 160 MHz channels
  * extended VLAN support (per-STA vif, etc.)
  * fixed PMKID derivation with SAE
  * nl80211
  - added support for full station state operations
  - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use
    unencrypted EAPOL frames
  * added initial MBO support; number of extensions to WNM BSS Transition
    Management
  * added initial functionality for location related operations
  * added assocresp_elements parameter to allow vendor specific elements
    to be added into (Re)Association Response frames
  * improved Public Action frame addressing
  - use Address 3 = wildcard BSSID in GAS response if a query from an
    unassociated STA used that address
  - fix TX status processing for Address 3 = wildcard BSSID
  - add gas_address3 configuration parameter to control Address 3
    behavior
  * added command line parameter -i to override interface parameter in
    hostapd.conf
  * added command completion support to hostapd_cli
  * added passive client taxonomy determination (CONFIG_TAXONOMY=y
    compile option and "SIGNATURE &lt;addr&gt;" control interface command)
  * number of small fixes
- renamed hostapd-2.5-defconfig.patch to hostapd-2.6-defconfig.patch</changelog>

</package>

<package pkgid="25711b04be8b923386c73ee320bb2f386399c622e550e5ae82c9293da4728255" name="hostapd" arch="x86_64">
    <version epoch="0" ver="2.6" rel="49.1"/>

<changelog author="sndirsch@suse.de" date="1276084800">- udpated to release 0.6.10
- updated hostapd.dif
- git-commit-eb1f744.diff:
  * Move DTIM period configuration into Beacon set operation; fixes
    "Could not set DTIM period for kernel driver; wlan0: Unable to
    setup interface.rmdir[ctrl_interface]: No such file or
    directory" error when using "nl80211" driver</changelog>
<changelog author="jengelh@medozas.de" date="1288526400">- Use %_smp_mflags</changelog>
<changelog author="jengelh@medozas.de" date="1316174400">- Select libnl-1_1-devel</changelog>
<changelog author="uli@suse.com" date="1317384000">- cross-build fix: use %__cc macro</changelog>
<changelog author="lnussel@suse.de" date="1318420800">- update to version 0.7.3
- don't use /tmp for dump file in default config
- verbose build
- fix build for older distros
- enable driver 'none' for radius only mode
- add init script</changelog>
<changelog author="glin@suse.com" date="1337083200">- update to version 1.0
- respin hostapd.dif to fit the new defconfig
- change the file permission of the config files with passwords
  to 600 (bnc#740964)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1352203200">- Add Native systemd units</changelog>
<changelog author="avm-xandry@yandex.ru" date="1365508800">- update to version 2.0
- fix corrected file name hostapd.dif to hostapd.diff
- in default config includes all features (IEEE 802.11w, Hotspot 2.0, IEEE 802.11ac, WPS, etc.)</changelog>
<changelog author="cfarrell@suse.com" date="1366200000">- license update: GPL-2.0 or BSD-3-Clause
  README makes it clear that this is a dual license - i.e. choice of either
  or</changelog>
<changelog author="aj@suse.com" date="1366286400">- Do not package /etc/init.d
- Do not install init file since package contains a service file and
  is only build for Factory
- Cleanup spec file
- Use /run instead of /var/run</changelog>
<changelog author="dvaleev@suse.com" date="1380715200">- fix host_to_le32 undefined on BigEndian architectures
  (hostapd-be-host_to_le.patch)</changelog>
<changelog author="i@marguerite.su" date="1397649600">- update version 2.1
  * see http://hostap.epitest.fi/cgit/hostap/log/ for details.
- change hostapd.diff to hostapd-2.1-defconfig.patch
- remove patch: hostapd-tmp.diff, no longer needed.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1401192000">- Update hostapd-2.1-defconfig.patch and spec file
  to build with libnl3 instead of libnl1</changelog>
<changelog author="michael@stroeder.com" date="1420459200">- update version 2.3
- removed patch hostapd-2.1-be-host_to_le.patch because it
  seems obsolete
- hostapd-2.1-defconfig.patch rediffed and renamed to hostapd-2.3-defconfig.patch
  ChangeLog for hostapd since 2.1:
  2014-10-09 - v2.3
  * fixed number of minor issues identified in static analyzer warnings
  * fixed DFS and channel switch operation for multi-BSS cases
  * started to use constant time comparison for various password and hash
  values to reduce possibility of any externally measurable timing
  differences
  * extended explicit clearing of freed memory and expired keys to avoid
  keeping private data in memory longer than necessary
  * added support for number of new RADIUS attributes from RFC 7268
  (Mobility-Domain-Id, WLAN-HESSID, WLAN-Pairwise-Cipher,
  WLAN-Group-Cipher, WLAN-AKM-Suite, WLAN-Group-Mgmt-Pairwise-Cipher)
  * fixed GET_CONFIG wpa_pairwise_cipher value
  * added code to clear bridge FDB entry on station disconnection
  * fixed PMKSA cache timeout from Session-Timeout for WPA/WPA2 cases
  * fixed OKC PMKSA cache entry fetch to avoid a possible infinite loop
  in case the first entry does not match
  * fixed hostapd_cli action script execution to use more robust mechanism
  (CVE-2014-3686)
  2014-06-04 - v2.2
  * fixed SAE confirm-before-commit validation to avoid a potential
  segmentation fault in an unexpected message sequence that could be
  triggered remotely
  * extended VHT support
  - Operating Mode Notification
  - Power Constraint element (local_pwr_constraint)
  - Spectrum management capability (spectrum_mgmt_required=1)
  - fix VHT80 segment picking in ACS
  - fix vht_capab 'Maximum A-MPDU Length Exponent' handling
  - fix VHT20
  * fixed HT40 co-ex scan for some pri/sec channel switches
  * extended HT40 co-ex support to allow dynamic channel width changes
  during the lifetime of the BSS
  * fixed HT40 co-ex support to check for overlapping 20 MHz BSS
  * fixed MSCHAP UTF-8 to UCS-2 conversion for three-byte encoding;
  this fixes password with include UTF-8 characters that use
  three-byte encoding EAP methods that use NtPasswordHash
  * reverted TLS certificate validation step change in v2.1 that rejected
  any AAA server certificate with id-kp-clientAuth even if
  id-kp-serverAuth EKU was included
  * fixed STA validation step for WPS ER commands to prevent a potential
  crash if an ER sends an unexpected PutWLANResponse to a station that
  is disassociated, but not fully removed
  * enforce full EAP authentication after RADIUS Disconnect-Request by
  removing the PMKSA cache entry
  * added support for NAS-IP-Address, NAS-identifier, and NAS-IPv6-Address
  in RADIUS Disconnect-Request
  * added mechanism for removing addresses for MAC ACLs by prefixing an
  entry with "-"
  * Interworking/Hotspot 2.0 enhancements
  - support Hotspot 2.0 Release 2
  * OSEN network for online signup connection
  * subscription remediation (based on RADIUS server request or
  control interface HS20_WNM_NOTIF for testing purposes)
  * Hotspot 2.0 release number indication in WFA RADIUS VSA
  * deauthentication request (based on RADIUS server request or
  control interface WNM_DEAUTH_REQ for testing purposes)
  * Session Info URL RADIUS AVP to trigger ESS Disassociation Imminent
  * hs20_icon config parameter to configure icon files for OSU
  * osu_* config parameters for OSU Providers list
  - do not use Interworking filtering rules on Probe Request if
  Interworking is disabled to avoid interop issues
  * added/fixed nl80211 functionality
  - AP interface teardown optimization
  - support vendor specific driver command
  (VENDOR &lt;vendor id&gt; &lt;sub command id&gt; [&lt;hex formatted data&gt;])
  * fixed PMF protection of Deauthentication frame when this is triggered
  by session timeout
  * internal TLS implementation enhancements/fixes
  - add SHA256-based cipher suites
  - add DHE-RSA cipher suites
  - fix X.509 validation of PKCS#1 signature to check for extra data
  * RADIUS server functionality
  - add minimal RADIUS accounting server support (hostapd-as-server);
  this is mainly to enable testing coverage with hwsim scripts
  - allow authentication log to be written into SQLite databse
  - added option for TLS protocol testing of an EAP peer by simulating
  various misbehaviors/known attacks
  - MAC ACL support for testing purposes
  * fixed PTK derivation for CCMP-256 and GCMP-256
  * extended WPS per-station PSK to support ER case
  * added option to configure the management group cipher
  (group_mgmt_cipher=AES-128-CMAC (default), BIP-GMAC-128, BIP-GMAC-256,
  BIP-CMAC-256)
  * fixed AP mode default TXOP Limit values for AC_VI and AC_VO (these
  were rounded incorrectly)
  * added support for postponing FT response in case PMK-R1 needs to be
  pulled from R0KH
  * added option to advertise 40 MHz intolerant HT capability with
  ht_capab=[40-INTOLERANT]
  * remove WPS 1.0 only support, i.e., WSC 2.0 support is now enabled
  whenever CONFIG_WPS=y is set
  * EAP-pwd fixes
  - fix possible segmentation fault on EAP method deinit if an invalid
  group is negotiated
  * fixed RADIUS client retransmit/failover behavior
  - there was a potential ctash due to freed memory being accessed
  - failover to a backup server mechanism did not work properly
  * fixed a possible crash on double DISABLE command when multiple BSSes
  are enabled
  * fixed a memory leak in SAE random number generation
  * fixed GTK rekeying when the station uses FT protocol
  * fixed off-by-one bounds checking in printf_encode()
  - this could result in deinial of service in some EAP server cases
  * various bug fixes</changelog>
<changelog author="michael@stroeder.com" date="1429790400">- update version 2.4
- added 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
  for CVE-2015-1863
- updated URLs
- require pkg-config and libnl3-devel during build
- replaced hostapd-2.3-defconfig.patch by hostapd-2.4-defconfig.patch
  ChangeLog for hostapd since 2.3:
  2015-03-15 - v2.4
  * allow OpenSSL cipher configuration to be set for internal EAP server
    (openssl_ciphers parameter)
  * fixed number of small issues based on hwsim test case failures and
    static analyzer reports
  * fixed Accounting-Request to not include duplicated Acct-Session-Id
  * add support for Acct-Multi-Session-Id in RADIUS Accounting messages
  * add support for PMKSA caching with SAE
  * add support for generating BSS Load element (bss_load_update_period)
  * fixed channel switch from VHT to HT
  * add INTERFACE-ENABLED and INTERFACE-DISABLED ctrl_iface events
  * add support for learning STA IPv4/IPv6 addresses and configuring
    ProxyARP support
  * dropped support for the madwifi driver interface
  * add support for Suite B (128-bit and 192-bit level) key management and
    cipher suites
  * fixed a regression with driver=wired
  * extend EAPOL-Key msg 1/4 retry workaround for changing SNonce
  * add BSS_TM_REQ ctrl_iface command to send BSS Transition Management
    Request frames and BSS-TM-RESP event to indicate response to such
    frame
  * add support for EAP Re-Authentication Protocol (ERP)
  * fixed AP IE in EAPOL-Key 3/4 when both WPA and FT was enabled
  * fixed a regression in HT 20/40 coex Action frame parsing
  * set stdout to be line-buffered
  * add support for vendor specific VHT extension to enable 256 QAM rates
    (VHT-MCS 8 and 9) on 2.4 GHz band
  * RADIUS DAS:
  - extend Disconnect-Request processing to allow matching of multiple
    sessions
  - support Acct-Multi-Session-Id as an identifier
  - allow PMKSA cache entry to be removed without association
  * expire hostapd STA entry if kernel does not have a matching entry
  * allow chanlist to be used to specify a subset of channels for ACS
  * improve ACS behavior on 2.4 GHz band and allow channel bias to be
    configured with acs_chan_bias parameter
  * do not reply to a Probe Request frame that includes DSS Parameter Set
    element in which the channel does not match the current operating
    channel
  * add UPDATE_BEACON ctrl_iface command; this can be used to force Beacon
    frame contents to be updated and to start beaconing on an interface
    that used start_disabled=1
  * fixed some RADIUS server failover cases</changelog>
<changelog author="michael@stroeder.com" date="1445169600">- update to upstream release 2.5
- removed 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
  (CVE-2015-1863) because it's fixed in upstream release 2.5
- rebased hostapd-2.4-defconfig.patch -&gt; hostapd-2.5-defconfig.patch
  ChangeLog for hostapd since 2.4:
  2015-09-27 - v2.5
  * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding
  [http://w1.fi/security/2015-2/] (CVE-2015-4141 bsc#930077)
  * fixed WMM Action frame parser
  [http://w1.fi/security/2015-3/] (CVE-2015-4142 bsc#930078)
  * fixed EAP-pwd server missing payload length validation
  [http://w1.fi/security/2015-4/]
  (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, bsc#930079)
  * fixed validation of WPS and P2P NFC NDEF record payload length
  [http://w1.fi/security/2015-5/]
  * nl80211:
  - fixed vendor command handling to check OUI properly
  * fixed hlr_auc_gw build with OpenSSL
  * hlr_auc_gw: allow Milenage RES length to be reduced
  * disable HT for a station that does not support WMM/QoS
  * added support for hashed password (NtHash) in EAP-pwd server
  * fixed and extended dynamic VLAN cases
  * added EAP-EKE server support for deriving Session-Id
  * set Acct-Session-Id to a random value to make it more likely to be
  unique even if the device does not have a proper clock
  * added more 2.4 GHz channels for 20/40 MHz HT co-ex scan
  * modified SAE routines to be more robust and PWE generation to be
  stronger against timing attacks
  * added support for Brainpool Elliptic Curves with SAE
  * increases maximum value accepted for cwmin/cwmax
  * added support for CCMP-256 and GCMP-256 as group ciphers with FT
  * added Fast Session Transfer (FST) module
  * removed optional fields from RSNE when using FT with PMF
  (workaround for interoperability issues with iOS 8.4)
  * added EAP server support for TLS session resumption
  * fixed key derivation for Suite B 192-bit AKM (this breaks
  compatibility with the earlier version)
  * added mechanism to track unconnected stations and do minimal band
  steering
  * number of small fixes</changelog>
<changelog author="chris@intrbiz.com" date="1475409600">- update to upstream release 2.6
  * fixed EAP-pwd last fragment validation
    [http://w1.fi/security/2015-7/] (CVE-2015-5314)
  * fixed WPS configuration update vulnerability with malformed passphrase
    [http://w1.fi/security/2016-1/] (CVE-2016-4476)
  * extended channel switch support for VHT bandwidth changes
  * added support for configuring new ANQP-elements with
    anqp_elem=&lt;InfoID&gt;:&lt;hexdump of payload&gt;
  * fixed Suite B 192-bit AKM to use proper PMK length
    (note: this makes old releases incompatible with the fixed behavior)
  * added no_probe_resp_if_max_sta=1 parameter to disable Probe Response
    frame sending for not-associated STAs if max_num_sta limit has been
    reached
  * added option (-S as command line argument) to request all interfaces
    to be started at the same time
  * modified rts_threshold and fragm_threshold configuration parameters
    to allow -1 to be used to disable RTS/fragmentation
  * EAP-pwd: added support for Brainpool Elliptic Curves
    (with OpenSSL 1.0.2 and newer)
  * fixed EAPOL reauthentication after FT protocol run
  * fixed FTIE generation for 4-way handshake after FT protocol run
  * fixed and improved various FST operations
  * TLS server
  - support SHA384 and SHA512 hashes
  - support TLS v1.2 signature algorithm with SHA384 and SHA512
  - support PKCS #5 v2.0 PBES2
  - support PKCS #5 with PKCS #12 style key decryption
  - minimal support for PKCS #12
  - support OCSP stapling (including ocsp_multi)
  * added support for OpenSSL 1.1 API changes
  - drop support for OpenSSL 0.9.8
  - drop support for OpenSSL 1.0.0
  * EAP-PEAP: support fast-connect crypto binding
  * RADIUS
  - fix Called-Station-Id to not escape SSID
  - add Event-Timestamp to all Accounting-Request packets
  - add Acct-Session-Id to Accounting-On/Off
  - add Acct-Multi-Session-Id  ton Access-Request packets
  - add Service-Type (= Frames)
  - allow server to provide PSK instead of passphrase for WPA-PSK
    Tunnel_password case
  - update full message for interim accounting updates
  - add Acct-Delay-Time into Accounting messages
  - add require_message_authenticator configuration option to require
    CoA/Disconnect-Request packets to be authenticated
  * started to postpone WNM-Notification frame sending by 100 ms so that
    the STA has some more time to configure the key before this frame is
    received after the 4-way handshake
  * VHT: added interoperability workaround for 80+80 and 160 MHz channels
  * extended VLAN support (per-STA vif, etc.)
  * fixed PMKID derivation with SAE
  * nl80211
  - added support for full station state operations
  - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use
    unencrypted EAPOL frames
  * added initial MBO support; number of extensions to WNM BSS Transition
    Management
  * added initial functionality for location related operations
  * added assocresp_elements parameter to allow vendor specific elements
    to be added into (Re)Association Response frames
  * improved Public Action frame addressing
  - use Address 3 = wildcard BSSID in GAS response if a query from an
    unassociated STA used that address
  - fix TX status processing for Address 3 = wildcard BSSID
  - add gas_address3 configuration parameter to control Address 3
    behavior
  * added command line parameter -i to override interface parameter in
    hostapd.conf
  * added command completion support to hostapd_cli
  * added passive client taxonomy determination (CONFIG_TAXONOMY=y
    compile option and "SIGNATURE &lt;addr&gt;" control interface command)
  * number of small fixes
- renamed hostapd-2.5-defconfig.patch to hostapd-2.6-defconfig.patch</changelog>

</package>

<package pkgid="5596f2a4711b7cf2f259a1cf6da03b02842552d25f4785099eda276b66b4c254" name="hostapd-debuginfo" arch="x86_64">
    <version epoch="0" ver="2.6" rel="49.1"/>

<changelog author="cstender@suse.de" date="1200916800">- fixed madwifi include dir (b.n.c #350982)</changelog>
<changelog author="ro@suse.de" date="1222084800">- updae to version 0.5.10, changes:
  * fixed EAP-SIM and EAP-AKA message parser to validate attribute
    lengths properly to avoid potential crash caused by invalid messages
  * fixed Reassociation Response callback processing when using internal
    MLME (driver_{hostap,devicescape,test}.c)
  * fixed EAP-SIM/AKA realm processing to allow decorated usernames to
    be used
  * added a workaround for EAP-SIM/AKA peers that include incorrect null
    termination in the username
  * fixed EAP-SIM Start response processing for fast reauthentication
    case
  * copy optional Proxy-State attributes into RADIUS response when acting
    as a RADIUS authentication server
- update to version 0.5.9, changes:
  * updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest
    draft (draft-ietf-emu-eap-gpsk-07.txt)
  * fixed debugging code not to use potentially unaligned read to fetch
    IPv4 addresses</changelog>
<changelog author="ro@suse.de" date="1222171200">- drop buildreq for madwifi (dropped package)</changelog>
<changelog author="sndirsch@suse.de" date="1276084800">- udpated to release 0.6.10
- updated hostapd.dif
- git-commit-eb1f744.diff:
  * Move DTIM period configuration into Beacon set operation; fixes
    "Could not set DTIM period for kernel driver; wlan0: Unable to
    setup interface.rmdir[ctrl_interface]: No such file or
    directory" error when using "nl80211" driver</changelog>
<changelog author="jengelh@medozas.de" date="1288526400">- Use %_smp_mflags</changelog>
<changelog author="jengelh@medozas.de" date="1316174400">- Select libnl-1_1-devel</changelog>
<changelog author="uli@suse.com" date="1317384000">- cross-build fix: use %__cc macro</changelog>
<changelog author="lnussel@suse.de" date="1318420800">- update to version 0.7.3
- don't use /tmp for dump file in default config
- verbose build
- fix build for older distros
- enable driver 'none' for radius only mode
- add init script</changelog>
<changelog author="glin@suse.com" date="1337083200">- update to version 1.0
- respin hostapd.dif to fit the new defconfig
- change the file permission of the config files with passwords
  to 600 (bnc#740964)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1352203200">- Add Native systemd units</changelog>
<changelog author="avm-xandry@yandex.ru" date="1365508800">- update to version 2.0
- fix corrected file name hostapd.dif to hostapd.diff
- in default config includes all features (IEEE 802.11w, Hotspot 2.0, IEEE 802.11ac, WPS, etc.)</changelog>
<changelog author="cfarrell@suse.com" date="1366200000">- license update: GPL-2.0 or BSD-3-Clause
  README makes it clear that this is a dual license - i.e. choice of either
  or</changelog>
<changelog author="aj@suse.com" date="1366286400">- Do not package /etc/init.d
- Do not install init file since package contains a service file and
  is only build for Factory
- Cleanup spec file
- Use /run instead of /var/run</changelog>
<changelog author="dvaleev@suse.com" date="1380715200">- fix host_to_le32 undefined on BigEndian architectures
  (hostapd-be-host_to_le.patch)</changelog>
<changelog author="i@marguerite.su" date="1397649600">- update version 2.1
  * see http://hostap.epitest.fi/cgit/hostap/log/ for details.
- change hostapd.diff to hostapd-2.1-defconfig.patch
- remove patch: hostapd-tmp.diff, no longer needed.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1401192000">- Update hostapd-2.1-defconfig.patch and spec file
  to build with libnl3 instead of libnl1</changelog>
<changelog author="michael@stroeder.com" date="1420459200">- update version 2.3
- removed patch hostapd-2.1-be-host_to_le.patch because it
  seems obsolete
- hostapd-2.1-defconfig.patch rediffed and renamed to hostapd-2.3-defconfig.patch
  ChangeLog for hostapd since 2.1:
  2014-10-09 - v2.3
  * fixed number of minor issues identified in static analyzer warnings
  * fixed DFS and channel switch operation for multi-BSS cases
  * started to use constant time comparison for various password and hash
  values to reduce possibility of any externally measurable timing
  differences
  * extended explicit clearing of freed memory and expired keys to avoid
  keeping private data in memory longer than necessary
  * added support for number of new RADIUS attributes from RFC 7268
  (Mobility-Domain-Id, WLAN-HESSID, WLAN-Pairwise-Cipher,
  WLAN-Group-Cipher, WLAN-AKM-Suite, WLAN-Group-Mgmt-Pairwise-Cipher)
  * fixed GET_CONFIG wpa_pairwise_cipher value
  * added code to clear bridge FDB entry on station disconnection
  * fixed PMKSA cache timeout from Session-Timeout for WPA/WPA2 cases
  * fixed OKC PMKSA cache entry fetch to avoid a possible infinite loop
  in case the first entry does not match
  * fixed hostapd_cli action script execution to use more robust mechanism
  (CVE-2014-3686)
  2014-06-04 - v2.2
  * fixed SAE confirm-before-commit validation to avoid a potential
  segmentation fault in an unexpected message sequence that could be
  triggered remotely
  * extended VHT support
  - Operating Mode Notification
  - Power Constraint element (local_pwr_constraint)
  - Spectrum management capability (spectrum_mgmt_required=1)
  - fix VHT80 segment picking in ACS
  - fix vht_capab 'Maximum A-MPDU Length Exponent' handling
  - fix VHT20
  * fixed HT40 co-ex scan for some pri/sec channel switches
  * extended HT40 co-ex support to allow dynamic channel width changes
  during the lifetime of the BSS
  * fixed HT40 co-ex support to check for overlapping 20 MHz BSS
  * fixed MSCHAP UTF-8 to UCS-2 conversion for three-byte encoding;
  this fixes password with include UTF-8 characters that use
  three-byte encoding EAP methods that use NtPasswordHash
  * reverted TLS certificate validation step change in v2.1 that rejected
  any AAA server certificate with id-kp-clientAuth even if
  id-kp-serverAuth EKU was included
  * fixed STA validation step for WPS ER commands to prevent a potential
  crash if an ER sends an unexpected PutWLANResponse to a station that
  is disassociated, but not fully removed
  * enforce full EAP authentication after RADIUS Disconnect-Request by
  removing the PMKSA cache entry
  * added support for NAS-IP-Address, NAS-identifier, and NAS-IPv6-Address
  in RADIUS Disconnect-Request
  * added mechanism for removing addresses for MAC ACLs by prefixing an
  entry with "-"
  * Interworking/Hotspot 2.0 enhancements
  - support Hotspot 2.0 Release 2
  * OSEN network for online signup connection
  * subscription remediation (based on RADIUS server request or
  control interface HS20_WNM_NOTIF for testing purposes)
  * Hotspot 2.0 release number indication in WFA RADIUS VSA
  * deauthentication request (based on RADIUS server request or
  control interface WNM_DEAUTH_REQ for testing purposes)
  * Session Info URL RADIUS AVP to trigger ESS Disassociation Imminent
  * hs20_icon config parameter to configure icon files for OSU
  * osu_* config parameters for OSU Providers list
  - do not use Interworking filtering rules on Probe Request if
  Interworking is disabled to avoid interop issues
  * added/fixed nl80211 functionality
  - AP interface teardown optimization
  - support vendor specific driver command
  (VENDOR &lt;vendor id&gt; &lt;sub command id&gt; [&lt;hex formatted data&gt;])
  * fixed PMF protection of Deauthentication frame when this is triggered
  by session timeout
  * internal TLS implementation enhancements/fixes
  - add SHA256-based cipher suites
  - add DHE-RSA cipher suites
  - fix X.509 validation of PKCS#1 signature to check for extra data
  * RADIUS server functionality
  - add minimal RADIUS accounting server support (hostapd-as-server);
  this is mainly to enable testing coverage with hwsim scripts
  - allow authentication log to be written into SQLite databse
  - added option for TLS protocol testing of an EAP peer by simulating
  various misbehaviors/known attacks
  - MAC ACL support for testing purposes
  * fixed PTK derivation for CCMP-256 and GCMP-256
  * extended WPS per-station PSK to support ER case
  * added option to configure the management group cipher
  (group_mgmt_cipher=AES-128-CMAC (default), BIP-GMAC-128, BIP-GMAC-256,
  BIP-CMAC-256)
  * fixed AP mode default TXOP Limit values for AC_VI and AC_VO (these
  were rounded incorrectly)
  * added support for postponing FT response in case PMK-R1 needs to be
  pulled from R0KH
  * added option to advertise 40 MHz intolerant HT capability with
  ht_capab=[40-INTOLERANT]
  * remove WPS 1.0 only support, i.e., WSC 2.0 support is now enabled
  whenever CONFIG_WPS=y is set
  * EAP-pwd fixes
  - fix possible segmentation fault on EAP method deinit if an invalid
  group is negotiated
  * fixed RADIUS client retransmit/failover behavior
  - there was a potential ctash due to freed memory being accessed
  - failover to a backup server mechanism did not work properly
  * fixed a possible crash on double DISABLE command when multiple BSSes
  are enabled
  * fixed a memory leak in SAE random number generation
  * fixed GTK rekeying when the station uses FT protocol
  * fixed off-by-one bounds checking in printf_encode()
  - this could result in deinial of service in some EAP server cases
  * various bug fixes</changelog>
<changelog author="michael@stroeder.com" date="1429790400">- update version 2.4
- added 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
  for CVE-2015-1863
- updated URLs
- require pkg-config and libnl3-devel during build
- replaced hostapd-2.3-defconfig.patch by hostapd-2.4-defconfig.patch
  ChangeLog for hostapd since 2.3:
  2015-03-15 - v2.4
  * allow OpenSSL cipher configuration to be set for internal EAP server
    (openssl_ciphers parameter)
  * fixed number of small issues based on hwsim test case failures and
    static analyzer reports
  * fixed Accounting-Request to not include duplicated Acct-Session-Id
  * add support for Acct-Multi-Session-Id in RADIUS Accounting messages
  * add support for PMKSA caching with SAE
  * add support for generating BSS Load element (bss_load_update_period)
  * fixed channel switch from VHT to HT
  * add INTERFACE-ENABLED and INTERFACE-DISABLED ctrl_iface events
  * add support for learning STA IPv4/IPv6 addresses and configuring
    ProxyARP support
  * dropped support for the madwifi driver interface
  * add support for Suite B (128-bit and 192-bit level) key management and
    cipher suites
  * fixed a regression with driver=wired
  * extend EAPOL-Key msg 1/4 retry workaround for changing SNonce
  * add BSS_TM_REQ ctrl_iface command to send BSS Transition Management
    Request frames and BSS-TM-RESP event to indicate response to such
    frame
  * add support for EAP Re-Authentication Protocol (ERP)
  * fixed AP IE in EAPOL-Key 3/4 when both WPA and FT was enabled
  * fixed a regression in HT 20/40 coex Action frame parsing
  * set stdout to be line-buffered
  * add support for vendor specific VHT extension to enable 256 QAM rates
    (VHT-MCS 8 and 9) on 2.4 GHz band
  * RADIUS DAS:
  - extend Disconnect-Request processing to allow matching of multiple
    sessions
  - support Acct-Multi-Session-Id as an identifier
  - allow PMKSA cache entry to be removed without association
  * expire hostapd STA entry if kernel does not have a matching entry
  * allow chanlist to be used to specify a subset of channels for ACS
  * improve ACS behavior on 2.4 GHz band and allow channel bias to be
    configured with acs_chan_bias parameter
  * do not reply to a Probe Request frame that includes DSS Parameter Set
    element in which the channel does not match the current operating
    channel
  * add UPDATE_BEACON ctrl_iface command; this can be used to force Beacon
    frame contents to be updated and to start beaconing on an interface
    that used start_disabled=1
  * fixed some RADIUS server failover cases</changelog>
<changelog author="michael@stroeder.com" date="1445169600">- update to upstream release 2.5
- removed 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
  (CVE-2015-1863) because it's fixed in upstream release 2.5
- rebased hostapd-2.4-defconfig.patch -&gt; hostapd-2.5-defconfig.patch
  ChangeLog for hostapd since 2.4:
  2015-09-27 - v2.5
  * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding
  [http://w1.fi/security/2015-2/] (CVE-2015-4141 bsc#930077)
  * fixed WMM Action frame parser
  [http://w1.fi/security/2015-3/] (CVE-2015-4142 bsc#930078)
  * fixed EAP-pwd server missing payload length validation
  [http://w1.fi/security/2015-4/]
  (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, bsc#930079)
  * fixed validation of WPS and P2P NFC NDEF record payload length
  [http://w1.fi/security/2015-5/]
  * nl80211:
  - fixed vendor command handling to check OUI properly
  * fixed hlr_auc_gw build with OpenSSL
  * hlr_auc_gw: allow Milenage RES length to be reduced
  * disable HT for a station that does not support WMM/QoS
  * added support for hashed password (NtHash) in EAP-pwd server
  * fixed and extended dynamic VLAN cases
  * added EAP-EKE server support for deriving Session-Id
  * set Acct-Session-Id to a random value to make it more likely to be
  unique even if the device does not have a proper clock
  * added more 2.4 GHz channels for 20/40 MHz HT co-ex scan
  * modified SAE routines to be more robust and PWE generation to be
  stronger against timing attacks
  * added support for Brainpool Elliptic Curves with SAE
  * increases maximum value accepted for cwmin/cwmax
  * added support for CCMP-256 and GCMP-256 as group ciphers with FT
  * added Fast Session Transfer (FST) module
  * removed optional fields from RSNE when using FT with PMF
  (workaround for interoperability issues with iOS 8.4)
  * added EAP server support for TLS session resumption
  * fixed key derivation for Suite B 192-bit AKM (this breaks
  compatibility with the earlier version)
  * added mechanism to track unconnected stations and do minimal band
  steering
  * number of small fixes</changelog>
<changelog author="chris@intrbiz.com" date="1475409600">- update to upstream release 2.6
  * fixed EAP-pwd last fragment validation
    [http://w1.fi/security/2015-7/] (CVE-2015-5314)
  * fixed WPS configuration update vulnerability with malformed passphrase
    [http://w1.fi/security/2016-1/] (CVE-2016-4476)
  * extended channel switch support for VHT bandwidth changes
  * added support for configuring new ANQP-elements with
    anqp_elem=&lt;InfoID&gt;:&lt;hexdump of payload&gt;
  * fixed Suite B 192-bit AKM to use proper PMK length
    (note: this makes old releases incompatible with the fixed behavior)
  * added no_probe_resp_if_max_sta=1 parameter to disable Probe Response
    frame sending for not-associated STAs if max_num_sta limit has been
    reached
  * added option (-S as command line argument) to request all interfaces
    to be started at the same time
  * modified rts_threshold and fragm_threshold configuration parameters
    to allow -1 to be used to disable RTS/fragmentation
  * EAP-pwd: added support for Brainpool Elliptic Curves
    (with OpenSSL 1.0.2 and newer)
  * fixed EAPOL reauthentication after FT protocol run
  * fixed FTIE generation for 4-way handshake after FT protocol run
  * fixed and improved various FST operations
  * TLS server
  - support SHA384 and SHA512 hashes
  - support TLS v1.2 signature algorithm with SHA384 and SHA512
  - support PKCS #5 v2.0 PBES2
  - support PKCS #5 with PKCS #12 style key decryption
  - minimal support for PKCS #12
  - support OCSP stapling (including ocsp_multi)
  * added support for OpenSSL 1.1 API changes
  - drop support for OpenSSL 0.9.8
  - drop support for OpenSSL 1.0.0
  * EAP-PEAP: support fast-connect crypto binding
  * RADIUS
  - fix Called-Station-Id to not escape SSID
  - add Event-Timestamp to all Accounting-Request packets
  - add Acct-Session-Id to Accounting-On/Off
  - add Acct-Multi-Session-Id  ton Access-Request packets
  - add Service-Type (= Frames)
  - allow server to provide PSK instead of passphrase for WPA-PSK
    Tunnel_password case
  - update full message for interim accounting updates
  - add Acct-Delay-Time into Accounting messages
  - add require_message_authenticator configuration option to require
    CoA/Disconnect-Request packets to be authenticated
  * started to postpone WNM-Notification frame sending by 100 ms so that
    the STA has some more time to configure the key before this frame is
    received after the 4-way handshake
  * VHT: added interoperability workaround for 80+80 and 160 MHz channels
  * extended VLAN support (per-STA vif, etc.)
  * fixed PMKID derivation with SAE
  * nl80211
  - added support for full station state operations
  - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use
    unencrypted EAPOL frames
  * added initial MBO support; number of extensions to WNM BSS Transition
    Management
  * added initial functionality for location related operations
  * added assocresp_elements parameter to allow vendor specific elements
    to be added into (Re)Association Response frames
  * improved Public Action frame addressing
  - use Address 3 = wildcard BSSID in GAS response if a query from an
    unassociated STA used that address
  - fix TX status processing for Address 3 = wildcard BSSID
  - add gas_address3 configuration parameter to control Address 3
    behavior
  * added command line parameter -i to override interface parameter in
    hostapd.conf
  * added command completion support to hostapd_cli
  * added passive client taxonomy determination (CONFIG_TAXONOMY=y
    compile option and "SIGNATURE &lt;addr&gt;" control interface command)
  * number of small fixes
- renamed hostapd-2.5-defconfig.patch to hostapd-2.6-defconfig.patch</changelog>

</package>

<package pkgid="cfe7a6b772192f6f8c4ad72cd92c410fc7362a1e0520d05086072bbfd43ae9c8" name="hostapd-debugsource" arch="x86_64">
    <version epoch="0" ver="2.6" rel="49.1"/>

<changelog author="sndirsch@suse.de" date="1276084800">- udpated to release 0.6.10
- updated hostapd.dif
- git-commit-eb1f744.diff:
  * Move DTIM period configuration into Beacon set operation; fixes
    "Could not set DTIM period for kernel driver; wlan0: Unable to
    setup interface.rmdir[ctrl_interface]: No such file or
    directory" error when using "nl80211" driver</changelog>
<changelog author="jengelh@medozas.de" date="1288526400">- Use %_smp_mflags</changelog>
<changelog author="jengelh@medozas.de" date="1316174400">- Select libnl-1_1-devel</changelog>
<changelog author="uli@suse.com" date="1317384000">- cross-build fix: use %__cc macro</changelog>
<changelog author="lnussel@suse.de" date="1318420800">- update to version 0.7.3
- don't use /tmp for dump file in default config
- verbose build
- fix build for older distros
- enable driver 'none' for radius only mode
- add init script</changelog>
<changelog author="glin@suse.com" date="1337083200">- update to version 1.0
- respin hostapd.dif to fit the new defconfig
- change the file permission of the config files with passwords
  to 600 (bnc#740964)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1352203200">- Add Native systemd units</changelog>
<changelog author="avm-xandry@yandex.ru" date="1365508800">- update to version 2.0
- fix corrected file name hostapd.dif to hostapd.diff
- in default config includes all features (IEEE 802.11w, Hotspot 2.0, IEEE 802.11ac, WPS, etc.)</changelog>
<changelog author="cfarrell@suse.com" date="1366200000">- license update: GPL-2.0 or BSD-3-Clause
  README makes it clear that this is a dual license - i.e. choice of either
  or</changelog>
<changelog author="aj@suse.com" date="1366286400">- Do not package /etc/init.d
- Do not install init file since package contains a service file and
  is only build for Factory
- Cleanup spec file
- Use /run instead of /var/run</changelog>
<changelog author="dvaleev@suse.com" date="1380715200">- fix host_to_le32 undefined on BigEndian architectures
  (hostapd-be-host_to_le.patch)</changelog>
<changelog author="i@marguerite.su" date="1397649600">- update version 2.1
  * see http://hostap.epitest.fi/cgit/hostap/log/ for details.
- change hostapd.diff to hostapd-2.1-defconfig.patch
- remove patch: hostapd-tmp.diff, no longer needed.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1401192000">- Update hostapd-2.1-defconfig.patch and spec file
  to build with libnl3 instead of libnl1</changelog>
<changelog author="michael@stroeder.com" date="1420459200">- update version 2.3
- removed patch hostapd-2.1-be-host_to_le.patch because it
  seems obsolete
- hostapd-2.1-defconfig.patch rediffed and renamed to hostapd-2.3-defconfig.patch
  ChangeLog for hostapd since 2.1:
  2014-10-09 - v2.3
  * fixed number of minor issues identified in static analyzer warnings
  * fixed DFS and channel switch operation for multi-BSS cases
  * started to use constant time comparison for various password and hash
  values to reduce possibility of any externally measurable timing
  differences
  * extended explicit clearing of freed memory and expired keys to avoid
  keeping private data in memory longer than necessary
  * added support for number of new RADIUS attributes from RFC 7268
  (Mobility-Domain-Id, WLAN-HESSID, WLAN-Pairwise-Cipher,
  WLAN-Group-Cipher, WLAN-AKM-Suite, WLAN-Group-Mgmt-Pairwise-Cipher)
  * fixed GET_CONFIG wpa_pairwise_cipher value
  * added code to clear bridge FDB entry on station disconnection
  * fixed PMKSA cache timeout from Session-Timeout for WPA/WPA2 cases
  * fixed OKC PMKSA cache entry fetch to avoid a possible infinite loop
  in case the first entry does not match
  * fixed hostapd_cli action script execution to use more robust mechanism
  (CVE-2014-3686)
  2014-06-04 - v2.2
  * fixed SAE confirm-before-commit validation to avoid a potential
  segmentation fault in an unexpected message sequence that could be
  triggered remotely
  * extended VHT support
  - Operating Mode Notification
  - Power Constraint element (local_pwr_constraint)
  - Spectrum management capability (spectrum_mgmt_required=1)
  - fix VHT80 segment picking in ACS
  - fix vht_capab 'Maximum A-MPDU Length Exponent' handling
  - fix VHT20
  * fixed HT40 co-ex scan for some pri/sec channel switches
  * extended HT40 co-ex support to allow dynamic channel width changes
  during the lifetime of the BSS
  * fixed HT40 co-ex support to check for overlapping 20 MHz BSS
  * fixed MSCHAP UTF-8 to UCS-2 conversion for three-byte encoding;
  this fixes password with include UTF-8 characters that use
  three-byte encoding EAP methods that use NtPasswordHash
  * reverted TLS certificate validation step change in v2.1 that rejected
  any AAA server certificate with id-kp-clientAuth even if
  id-kp-serverAuth EKU was included
  * fixed STA validation step for WPS ER commands to prevent a potential
  crash if an ER sends an unexpected PutWLANResponse to a station that
  is disassociated, but not fully removed
  * enforce full EAP authentication after RADIUS Disconnect-Request by
  removing the PMKSA cache entry
  * added support for NAS-IP-Address, NAS-identifier, and NAS-IPv6-Address
  in RADIUS Disconnect-Request
  * added mechanism for removing addresses for MAC ACLs by prefixing an
  entry with "-"
  * Interworking/Hotspot 2.0 enhancements
  - support Hotspot 2.0 Release 2
  * OSEN network for online signup connection
  * subscription remediation (based on RADIUS server request or
  control interface HS20_WNM_NOTIF for testing purposes)
  * Hotspot 2.0 release number indication in WFA RADIUS VSA
  * deauthentication request (based on RADIUS server request or
  control interface WNM_DEAUTH_REQ for testing purposes)
  * Session Info URL RADIUS AVP to trigger ESS Disassociation Imminent
  * hs20_icon config parameter to configure icon files for OSU
  * osu_* config parameters for OSU Providers list
  - do not use Interworking filtering rules on Probe Request if
  Interworking is disabled to avoid interop issues
  * added/fixed nl80211 functionality
  - AP interface teardown optimization
  - support vendor specific driver command
  (VENDOR &lt;vendor id&gt; &lt;sub command id&gt; [&lt;hex formatted data&gt;])
  * fixed PMF protection of Deauthentication frame when this is triggered
  by session timeout
  * internal TLS implementation enhancements/fixes
  - add SHA256-based cipher suites
  - add DHE-RSA cipher suites
  - fix X.509 validation of PKCS#1 signature to check for extra data
  * RADIUS server functionality
  - add minimal RADIUS accounting server support (hostapd-as-server);
  this is mainly to enable testing coverage with hwsim scripts
  - allow authentication log to be written into SQLite databse
  - added option for TLS protocol testing of an EAP peer by simulating
  various misbehaviors/known attacks
  - MAC ACL support for testing purposes
  * fixed PTK derivation for CCMP-256 and GCMP-256
  * extended WPS per-station PSK to support ER case
  * added option to configure the management group cipher
  (group_mgmt_cipher=AES-128-CMAC (default), BIP-GMAC-128, BIP-GMAC-256,
  BIP-CMAC-256)
  * fixed AP mode default TXOP Limit values for AC_VI and AC_VO (these
  were rounded incorrectly)
  * added support for postponing FT response in case PMK-R1 needs to be
  pulled from R0KH
  * added option to advertise 40 MHz intolerant HT capability with
  ht_capab=[40-INTOLERANT]
  * remove WPS 1.0 only support, i.e., WSC 2.0 support is now enabled
  whenever CONFIG_WPS=y is set
  * EAP-pwd fixes
  - fix possible segmentation fault on EAP method deinit if an invalid
  group is negotiated
  * fixed RADIUS client retransmit/failover behavior
  - there was a potential ctash due to freed memory being accessed
  - failover to a backup server mechanism did not work properly
  * fixed a possible crash on double DISABLE command when multiple BSSes
  are enabled
  * fixed a memory leak in SAE random number generation
  * fixed GTK rekeying when the station uses FT protocol
  * fixed off-by-one bounds checking in printf_encode()
  - this could result in deinial of service in some EAP server cases
  * various bug fixes</changelog>
<changelog author="michael@stroeder.com" date="1429790400">- update version 2.4
- added 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
  for CVE-2015-1863
- updated URLs
- require pkg-config and libnl3-devel during build
- replaced hostapd-2.3-defconfig.patch by hostapd-2.4-defconfig.patch
  ChangeLog for hostapd since 2.3:
  2015-03-15 - v2.4
  * allow OpenSSL cipher configuration to be set for internal EAP server
    (openssl_ciphers parameter)
  * fixed number of small issues based on hwsim test case failures and
    static analyzer reports
  * fixed Accounting-Request to not include duplicated Acct-Session-Id
  * add support for Acct-Multi-Session-Id in RADIUS Accounting messages
  * add support for PMKSA caching with SAE
  * add support for generating BSS Load element (bss_load_update_period)
  * fixed channel switch from VHT to HT
  * add INTERFACE-ENABLED and INTERFACE-DISABLED ctrl_iface events
  * add support for learning STA IPv4/IPv6 addresses and configuring
    ProxyARP support
  * dropped support for the madwifi driver interface
  * add support for Suite B (128-bit and 192-bit level) key management and
    cipher suites
  * fixed a regression with driver=wired
  * extend EAPOL-Key msg 1/4 retry workaround for changing SNonce
  * add BSS_TM_REQ ctrl_iface command to send BSS Transition Management
    Request frames and BSS-TM-RESP event to indicate response to such
    frame
  * add support for EAP Re-Authentication Protocol (ERP)
  * fixed AP IE in EAPOL-Key 3/4 when both WPA and FT was enabled
  * fixed a regression in HT 20/40 coex Action frame parsing
  * set stdout to be line-buffered
  * add support for vendor specific VHT extension to enable 256 QAM rates
    (VHT-MCS 8 and 9) on 2.4 GHz band
  * RADIUS DAS:
  - extend Disconnect-Request processing to allow matching of multiple
    sessions
  - support Acct-Multi-Session-Id as an identifier
  - allow PMKSA cache entry to be removed without association
  * expire hostapd STA entry if kernel does not have a matching entry
  * allow chanlist to be used to specify a subset of channels for ACS
  * improve ACS behavior on 2.4 GHz band and allow channel bias to be
    configured with acs_chan_bias parameter
  * do not reply to a Probe Request frame that includes DSS Parameter Set
    element in which the channel does not match the current operating
    channel
  * add UPDATE_BEACON ctrl_iface command; this can be used to force Beacon
    frame contents to be updated and to start beaconing on an interface
    that used start_disabled=1
  * fixed some RADIUS server failover cases</changelog>
<changelog author="michael@stroeder.com" date="1445169600">- update to upstream release 2.5
- removed 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
  (CVE-2015-1863) because it's fixed in upstream release 2.5
- rebased hostapd-2.4-defconfig.patch -&gt; hostapd-2.5-defconfig.patch
  ChangeLog for hostapd since 2.4:
  2015-09-27 - v2.5
  * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding
  [http://w1.fi/security/2015-2/] (CVE-2015-4141 bsc#930077)
  * fixed WMM Action frame parser
  [http://w1.fi/security/2015-3/] (CVE-2015-4142 bsc#930078)
  * fixed EAP-pwd server missing payload length validation
  [http://w1.fi/security/2015-4/]
  (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, bsc#930079)
  * fixed validation of WPS and P2P NFC NDEF record payload length
  [http://w1.fi/security/2015-5/]
  * nl80211:
  - fixed vendor command handling to check OUI properly
  * fixed hlr_auc_gw build with OpenSSL
  * hlr_auc_gw: allow Milenage RES length to be reduced
  * disable HT for a station that does not support WMM/QoS
  * added support for hashed password (NtHash) in EAP-pwd server
  * fixed and extended dynamic VLAN cases
  * added EAP-EKE server support for deriving Session-Id
  * set Acct-Session-Id to a random value to make it more likely to be
  unique even if the device does not have a proper clock
  * added more 2.4 GHz channels for 20/40 MHz HT co-ex scan
  * modified SAE routines to be more robust and PWE generation to be
  stronger against timing attacks
  * added support for Brainpool Elliptic Curves with SAE
  * increases maximum value accepted for cwmin/cwmax
  * added support for CCMP-256 and GCMP-256 as group ciphers with FT
  * added Fast Session Transfer (FST) module
  * removed optional fields from RSNE when using FT with PMF
  (workaround for interoperability issues with iOS 8.4)
  * added EAP server support for TLS session resumption
  * fixed key derivation for Suite B 192-bit AKM (this breaks
  compatibility with the earlier version)
  * added mechanism to track unconnected stations and do minimal band
  steering
  * number of small fixes</changelog>
<changelog author="chris@intrbiz.com" date="1475409600">- update to upstream release 2.6
  * fixed EAP-pwd last fragment validation
    [http://w1.fi/security/2015-7/] (CVE-2015-5314)
  * fixed WPS configuration update vulnerability with malformed passphrase
    [http://w1.fi/security/2016-1/] (CVE-2016-4476)
  * extended channel switch support for VHT bandwidth changes
  * added support for configuring new ANQP-elements with
    anqp_elem=&lt;InfoID&gt;:&lt;hexdump of payload&gt;
  * fixed Suite B 192-bit AKM to use proper PMK length
    (note: this makes old releases incompatible with the fixed behavior)
  * added no_probe_resp_if_max_sta=1 parameter to disable Probe Response
    frame sending for not-associated STAs if max_num_sta limit has been
    reached
  * added option (-S as command line argument) to request all interfaces
    to be started at the same time
  * modified rts_threshold and fragm_threshold configuration parameters
    to allow -1 to be used to disable RTS/fragmentation
  * EAP-pwd: added support for Brainpool Elliptic Curves
    (with OpenSSL 1.0.2 and newer)
  * fixed EAPOL reauthentication after FT protocol run
  * fixed FTIE generation for 4-way handshake after FT protocol run
  * fixed and improved various FST operations
  * TLS server
  - support SHA384 and SHA512 hashes
  - support TLS v1.2 signature algorithm with SHA384 and SHA512
  - support PKCS #5 v2.0 PBES2
  - support PKCS #5 with PKCS #12 style key decryption
  - minimal support for PKCS #12
  - support OCSP stapling (including ocsp_multi)
  * added support for OpenSSL 1.1 API changes
  - drop support for OpenSSL 0.9.8
  - drop support for OpenSSL 1.0.0
  * EAP-PEAP: support fast-connect crypto binding
  * RADIUS
  - fix Called-Station-Id to not escape SSID
  - add Event-Timestamp to all Accounting-Request packets
  - add Acct-Session-Id to Accounting-On/Off
  - add Acct-Multi-Session-Id  ton Access-Request packets
  - add Service-Type (= Frames)
  - allow server to provide PSK instead of passphrase for WPA-PSK
    Tunnel_password case
  - update full message for interim accounting updates
  - add Acct-Delay-Time into Accounting messages
  - add require_message_authenticator configuration option to require
    CoA/Disconnect-Request packets to be authenticated
  * started to postpone WNM-Notification frame sending by 100 ms so that
    the STA has some more time to configure the key before this frame is
    received after the 4-way handshake
  * VHT: added interoperability workaround for 80+80 and 160 MHz channels
  * extended VLAN support (per-STA vif, etc.)
  * fixed PMKID derivation with SAE
  * nl80211
  - added support for full station state operations
  - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use
    unencrypted EAPOL frames
  * added initial MBO support; number of extensions to WNM BSS Transition
    Management
  * added initial functionality for location related operations
  * added assocresp_elements parameter to allow vendor specific elements
    to be added into (Re)Association Response frames
  * improved Public Action frame addressing
  - use Address 3 = wildcard BSSID in GAS response if a query from an
    unassociated STA used that address
  - fix TX status processing for Address 3 = wildcard BSSID
  - add gas_address3 configuration parameter to control Address 3
    behavior
  * added command line parameter -i to override interface parameter in
    hostapd.conf
  * added command completion support to hostapd_cli
  * added passive client taxonomy determination (CONFIG_TAXONOMY=y
    compile option and "SIGNATURE &lt;addr&gt;" control interface command)
  * number of small fixes
- renamed hostapd-2.5-defconfig.patch to hostapd-2.6-defconfig.patch</changelog>

</package>

<package pkgid="612df6e14668f04dc03f9039dbbe752d45246effb91b140fa534f69d6d2be762" name="sudo" arch="src">
    <version epoch="0" ver="1.8.18p1" rel="127.1"/>

<changelog author="vcizek@suse.com" date="1400155200">- update to 1.8.10p3
  * Fixed expansion of the %p escape in the prompt for "sudo -l"
    when rootpw, runaspw or targetpw is set. Bug #639.
  * Fixed matching of uids and gids which was broken in version 1.8.9
  * PAM credential initialization has been re-enabled. It was
    unintentionally disabled by default in version 1.8.8. The way
    credentials are initialized has also been fixed. Bug #642.
  * Fixed a descriptor leak on Linux when determing boot time. Sudo
    normally closes extra descriptors before running a command so
    the impact is limited. Bug #645.
  * Fixed flushing of the last buffer of data when I/O logging is
    enabled. This bug, introduced in version 1.8.9, could cause
    incomplete command output on some systems. Bug #646.
  * Fixed a hang introduced in sudo 1.8.10 when timestamp_timeout
    is set to zero. Bug #638.
- don't install test LICENSE with executable perms</changelog>
<changelog author="tabraham@suse.com" date="1413028800">- refresh sudo-sudoers.patch
- update to 1.8.11p1
  * Fixed a compilation problem on some systems when the
  - -disable-shared-libutil configure option was specified.
  * The user can no longer interrupt the sleep after an incorrect password on
    PAM systems using pam_unix. Bug #666.
  * Fixed a compilation problem on Linux systems that do not use PAM. Bug #667.
  * "make install" will now work with the stock GNU autotools install-sh
    script. Bug #669.
  * Fixed a crash with "sudo -i" when the current working directory does not
    exist. Bug #670.
  * Fixed a potential crash in the debug subsystem when logging a message
    larger that 1024 bytes.
  * Fixed a "make check" failure for ttyname when stdin is closed and stdout
    and stderr are redirected to a different tty. Bug #643.
  * Added BASH_FUNC_* to environment blacklist to match newer-style bash
    functions.
- changes from 1.8.11
  * The sudoers plugin no longer uses setjmp/longjmp to recover from fatal
    errors. All errors are now propagated to the caller via return codes.
  * When running a command in the background, sudo will now forward SIGINFO to
    the command (if supported).
  * Sudo will now use the system versions of the sha2 functions from libc or
    libmd if available.
  * Visudo now works correctly on GNU Hurd. Bug #647.
  * Fixed suspend and resume of curses programs on some system when the
    command is not being run in a pseudo-terminal. Bug #649.
  * Fixed a crash with LDAP-based sudoers on some systems when Kerberos was
    enabled.
  * Sudo now includes optional Solaris audit support.
  * Catalan translation for sudoers from translationproject.org.
  * Norwegian Bokmaal translation for sudo from translationproject.org.
  * Greek translation for sudoers from translationproject.org
  * The sudo source tree has been reorganized to more closely resemble that of
    other gettext-enabled packages.
  * Sudo and its associated programs now link against a shared version of
    libsudo_util. The --disable-shared-libutil configure option may be used to
    force static linking if the --enable-static-sudoers option is also
    specified.
  * The passwords in ldap.conf and ldap.secret may now be encoded in base64.
  * Audit updates. SELinux role changes are now audited. For sudoedit, we now
    audit the actual editor being run, instead of just the sudoedit command.
  * Fixed bugs in the man page post-processing that could cause portions of the
    manuals to be removed.
  * Fixed a crash in the system_group plugin. Bug #653.
  * Fixed sudoedit on platforms without a native version of the getprogname()
    function. Bug #654.
  * Fixed compilation problems with some pre-C99 compilers.
  * Fixed sudo's -C option which was broken in version 1.8.9.
  * It is now possible to match an environment variable's value as well as its
    name using env_keep and env_check. This can be used to preserve bash
    functions which would otherwise be removed from the environment.
  * New files created via sudoedit as a non-root user now have the proper
    group id. Bug #656.
  * Sudoedit now works correctly in conjunction with sudo's SELinux RBAC
    support. Temporary files are now created with the proper security context.
  * The sudo I/O logging plugin API has been updated. If a logging function
    returns an error, the command will be terminated and all of the plugin's
    logging functions will be disabled. If a logging function rejects the
    command's output it will no longer be displayed to the user's terminal.
  * Fixed a compilation error on systems that lack openpty(), _getpty() and
    grantpt(). Bug #660.
  * Fixed a hang when a sudoers source is listed more than once in a single
    sudoers nsswitch.conf entry.
  * On AIX, shell scripts without a #! magic number are now passed to
    /usr/bin/sh, not /usr/bin/bsh. This is consistent with what the execvp()
    function on AIX does and matches historic sudo behavior. Bug #661.
  * Fixed a cross-compilation problem building mksiglist and mksigname.
    Bug #662.</changelog>
<changelog author="fstrba@suse.com" date="1415275200">- update to 1.8.11p2
  * Fixed a bug where dynamic shared objects loaded from a plugin
    could use the hooked version of getenv() but not the hooked
    versions of putenv(), setenv() or unsetenv().  This can cause
    problems for PAM modules that use those functions.</changelog>
<changelog author="vcizek@suse.com" date="1418817600">- correctly parse /proc/stat for boottime (bnc#899252)
  * added sudo-parse_boottime_properly.patch from Debian</changelog>
<changelog author="vcizek@suse.com" date="1424606400">- update to 1.8.12 (fixes bnc#918953)
- changelog:
  * The embedded copy of zlib has been upgraded to version 1.2.8 and
    is now installed as a shared library where supported.
  * Debug settings for the sudo front end and sudoers plugin are now configured separately.
  * Multiple sudo.conf Debug entries may now be specified per program (or plugin).
  * The plugin API has been extended such that the path to the plugin
    that was loaded is now included in the settings array. This path
    can be used to register with the debugging subsystem. The debug_flags
    setting is now prefixed with a file name and may be specified multiple
    times if there is more than one matching Debug setting in sudo.conf.
  * The sudoers regression tests now run with the locale set to C since
    some of the tests compare output that includes locale-specific messages. Bug #672.
  * Fixed a bug where sudo would not run commands on Linux when compiled
    with audit support if audit is disabled. Bug #671.
  * The default password prompt now includes a trailing space after
    "Password:" for consistency with su(1) on most systems. Bug #663.
  * Visudo will now use the optional sudoers_file, sudoers_mode,
    sudoers_uid and sudoers_gid arguments if specified on the sudoers.so Plugin line in the sudo.conf file.
  * Fixed a problem introduced in sudo 1.8.8 that prevented the full
    host name from being used when the fqdn sudoers option is used. Bug #678.
  * Sudo now installs a handler for SIGCHLD signal handler immediately
    before stating the process that will execute the command (or start the monitor).
  * Removed a limit on the length of command line arguments expanded by
    a wild card using sudo's version of the fnmatch() function.
    This limit was introduced when sudo's version of fnmatch() was replaced in sudo 1.8.4.
  * LDAP-based sudoers can now query an LDAP server for a user's netgroups
    directly. This is often much faster than fetching every sudoRole object
    containing a sudoUser that begins with a `+' prefix and checking
    whether the user is a member of any of the returned netgroups.
  * The mail_always sudoers option no longer sends mail for
    sudo -l or sudo -v unless the user is unable to authenticate themselves.
  * Fixed a crash when sudo is run with an empty argument vector.
  * Fixed two potential crashes when sudo is run with very low resource limits.
  * The TZ environment variable is now checked for safety instead of simply
    being copied to the environment of the command. This fixes a potential security issue.</changelog>
<changelog author="vcizek@suse.com" date="1431604800">- update to 1.8.13
  * The examples directory is now a subdirectory of the doc dir to
  conform to Debian guidelines.  Bug #682.
  * Fixed a compilation error for siglist.c and signame.c on some
  systems.  Bug #686
  * Weak symbols are now used for sudo_warn_gettext() and
  sudo_warn_strerror() in libsudo_util to avoid link errors when
  - Wl,--no-undefined is used in LDFLAGS.  The --disable-weak-symbols
  configure option can be used to disable the user of weak symbols.
  * Fixed a bug in sudo's mkstemps() replacement function that
  prevented the file extension from being preserved in sudoedit.
  * A new mail_all_cmnds sudoers flag will send mail when a user runs
  a command (or tries to). The behavior of the mail_always flag has
  been restored to always send mail when sudo is run.
  * New "MAIL" and "NOMAIL" command tags have been added to toggle
  mail sending behavior on a per-command (or Cmnd_Alias) basis.
  * Fixed matching of empty passwords when sudo is configured to
  use passwd (or shadow) file authentication on systems where the
  crypt() function returns NULL for invalid salts.
  * The "all" setting for listpw and verifypw now works correctly
  with LDAP and sssd sudoers.
  * The sudo timestamp directory is now created at boot time on
  platforms that use systemd.
  * Sudo will now restore the value of the SIGPIPE handler before
  executing the command.
  * Sudo now uses "struct timespec" instead of "struct timeval" for
  time keeping when possible.  If supported, sudoedit and visudo
  now use nanosecond granularity time stamps.
  * Fixed a symbol name collision with systems that have their own
  SHA2 implementation.  This fixes a problem where PAM could use
  the wrong SHA2 implementation on Solaris 10 systems configured
  to use SHA512 for passwords.
  * The editor invoked by sudoedit once again uses an unmodified
  copy of the user's environment as per the documentation.  This
  was inadvertantly changed in sudo 1.8.0.  Bug #688.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1437566400">- BuildRequires zlib-devel, support zlib compressed I/O logs.</changelog>
<changelog author="kstreitova@suse.com" date="1437652800">- update to 1.8.14p3:
  * changes in 1.8.14p3
  * Fixed a bug introduced in sudo 1.8.14p2 that prevented sudo
    from working when no tty was present. Bug #706.
  * Fixed tty detection on newer AIX systems where dev_t is 64-bit.
  * changes in 1.8.14p2
  * Fixed a bug introduced in sudo 1.8.14 that prevented the
    lecture file from being created. Bug #704.
  * changes in 1.8.14p1
  * Fixed a bug introduced in sudo 1.8.14 that prevented the sssd
    backend from working. Bug #703.
  * changes in 1.8.14
  * Log messages on Mac OS X now respect sudoers_locale when sudo
    is build with NLS support.
  * The sudo manual pages now pass mandoc -Tlint with no warnings.
  * Fixed a compilation problem on systems with the sig2str()
    function that do not define SIG2STR_MAX in signal.h.
  * Worked around a compiler bug that resulted in unexpected
    behavior when returning an int from a function declared to
    return bool without an explicit cast.
  * Worked around a bug in Mac OS X 10.10 BSD auditing where the
    au_preselect() fails for AUE_sudo events but succeeds for
    AUE_DARWIN_sudo.
  * Fixed a hang on Linux systems with glibc when sudo is linked
    with jemalloc.
  * When the user runs a command as a user ID that is not present
    in the password database via the -u flag, the command is now
    run with the group ID of the invoking user instead of group ID 0.
  * Fixed a compilation problem on systems that don't pull in
    definitions of uid_t and gid_t without sys/types.h or unistd.h.
  * Fixed a compilation problem on newer AIX systems which use a
    struct st_timespec for time stamps in struct stat that differs
    from struct timespec. Bug #702.
  * The example directory is now configurable via --with-exampledir
    and defaults to DATAROOTDIR/examples/sudo on BSD systems.
  * The /usr/lib/tmpfiles.d/sudo.conf file is now installed as part
    of "make install" when systemd is in use.
  * Fixed a linker problem on some systems with libintl. Bug #690.
  * Fixed compilation with compilers that don't support __func__ or
    __FUNCTION__.
  * Sudo no longer needs to uses weak symbols to support localization
    in the warning functions. A registration function is used instead.
  * Fixed a setresuid() failure in sudoers on Linux kernels where
    uid changes take the nproc resource limit into account.
  * Fixed LDAP netgroup queries on AIX.
  * Sudo will now display the custom prompt on Linux systems with
    PAM even if the "Password: " prompt is not localized by the
    PAM module. Bug #701.
  * Double-quoted values in an LDAP sudoOption are now supported
    for consistency with file-based sudoers.
  * Fixed a bug that prevented the btime entry in /proc/stat from
    being parsed on Linux.
  * update sudo-sudoers.patch
  * remove sudo-parse_boottime_properly.patch (it's not longer needed)</changelog>
<changelog author="dimstar@opensuse.org" date="1439380800">- Pass --enable-tmpfiles.d=%{_tmpfilesdir} to configure: let's be
  specific about this feature, and not randomly rely on the
  presence/absence of /usr/lib/tmpfiles.d/systemd.conf.
- Add systemd-rpm-macros BuildRequires to ensure %_tmpfilesdir is
  defined.
- Add relevant %tmpfiles_create call to post scriptlet.</changelog>
<changelog author="jengelh@inai.de" date="1439380801">- No need to buildrequire an sssd plugin (libsss_sudo)</changelog>
<changelog author="kstreitova@suse.com" date="1446811200">- update to 1.8.15:
  * Fixed a bug that prevented sudo from building outside the source
    tree on some platforms. Bug #708.
  * Fixed the location of the sssd library in the RHEL/Centos packages.
    Bug #710.
  * Fixed a build problem on systems that don't implicitly include
    sys/types.h from other header files. Bug #711.
  * Fixed a problem on Linux using containers where sudo would ignore
    signals sent by a process in a different container.
  * Sudo now refuses to run a command if the PAM session module returns
    an error.
  * When editing files with sudoedit, symbolic links will no longer be
    followed by default. The old behavior can be restored by enabling
    the sudoedit_follow option in sudoers or on a per-command basis with
    the FOLLOW and NOFOLLOW tags. Bug #707.
  * Fixed a bug introduced in version 1.8.14 that caused the last valid
    editor in the sudoers "editor" list to be used by visudo and sudoedit
    instead of the first. Bug #714.
  * Fixed a bug in visudo that prevented the addition of a final newline
    to edited files without one.
  * Fixed a bug decoding certain base64 digests in sudoers when the
    intermediate format included a '=' character.
  * Individual records are now locked in the time stamp file instead of
    the entire file. This allows sudo to avoid prompting for a password
    multiple times on the same terminal when used in a pipeline.
    In other words, sudo cat foo | sudo grep bar now only prompts for
    the password once. Previously, both sudo processes would prompt for
    a password, often making it impossible to enter. Bug #705.
  * Fixed a bug where sudo would fail to run commands as a non-root user
    on systems that lack both setresuid() and setreuid(). Bug #713.
  * Fixed a bug introduced in sudo 1.8.14 that prevented visudo from
    re-editing the correct file when a syntax error was detected.
  * Fixed a bug where sudo would not relay a SIGHUP signal to the command
    when the terminal is closed and the command is not run in its own
    pseudo-tty. Bug #719.
  * If some, but not all, of the LOGNAME, USER or USERNAME environment
    variables have been preserved from the invoking user's environment,
    sudo will now use the preserved value to set the remaining variables
    instead of using the runas user. This ensures that if, for example,
    only LOGNAME is present in the env_keep list, that sudo will not set
    USER and USERNAME to the runas user.
  * When the command sudo is running dies due to a signal, sudo will now
    send itself that same signal with the default signal handler installed
    instead of exiting. The bash shell appears to ignore some signals,
    e.g. SIGINT, unless the command being run is killed by that signal.
    This makes the behavior of commands run under sudo the same as
    without sudo when bash is the shell. Bug #722.
  * Slovak translation for sudo from translationproject.org.
  * Hungarian and Slovak translations for sudoers from
    translationproject.org.
  * Previously, when env_reset was enabled (the default) and the
  - s option was not used, the SHELL environment variable was set to the
    shell of the invoking user. Now, when env_reset is enabled and the
  - s option is not used, SHELL is set based on the target user.
  * Fixed challenge/response style BSD authentication.
  * Added the sudoedit_checkdir Defaults option to prevent sudoedit from
    editing files located in a directory that is writable by the
    invoking user.
  * Added the always_query_group_plugin Defaults option to control
    whether groups not found in the system group database are passed to
    the group plugin. Previously, unknown system groups were always
    passed to the group plugin.
  * When creating a new file, sudoedit will now check that the file's
    parent directory exists before running the editor.
  * Fixed the compiler stack protector test in configure for compilers
    that support -fstack-protector but don't actually have the ssp
    library available.
- use spec-cleaner</changelog>
<changelog author="michael@stroeder.com" date="1458216000">- update to 1.8.16:
  * Fixed a compilation error on Solaris 10 with Stun Studio 12.
  Bug #727.
  * When preserving variables from the invoking user's environment, if
  there are duplicates sudo now only keeps the first instance.
  * Fixed a bug that could cause warning mail to be sent in list
  mode (sudo -l) for users without sudo privileges when the
  LDAP and sssd backends are used.
  * Fixed a bug that prevented the "mail_no_user" option from working
  properly with the LDAP backend.
  * In the LDAP and sssd backends, white space is now ignored between
  an operator (!, +, +=, -=) when parsing a sudoOption.
  * It is now possible to disable Path settings in sudo.conf
  by omitting the path name.
  * The sudoedit_checkdir Defaults option is now enabled by default
  and has been extended.  When editing files with sudoedit, each
  directory in the path to be edited is now checked.  If a directory
  is writable by the invoking user, symbolic links will not be
  followed.  If the parent directory of the file to be edited is
  writable, sudoedit will refuse to edit it.
  Bug #707.
  * The netgroup_tuple Defaults option has been added to enable matching
  of the entire netgroup tuple, not just the host or user portion.
  Bug #717.
  * When matching commands based on the SHA2 digest, sudo will now
  use fexecve(2) to execute the command if it is available.  This
  fixes a time of check versus time of use race condition when the
  directory holding the command is writable by the invoking user.
  * On AIX systems, sudo now caches the auth registry string along
  with password and group information.  This fixes a potential
  problem when a user or group of the same name exists in multiple
  auth registries.  For example, local and LDAP.
  * Fixed a crash in the SSSD backend when the invoking user is not
  found.  Bug #732.
  * Added the --enable-asan configure flag to enable address sanitizer
  support.  A few minor memory leaks have been plugged to quiet
  the ASAN leak detector.
  * The value of _PATH_SUDO_CONF may once again be overridden via
  the Makefile.  Bug #735.
  * The sudoers2ldif script now handles multiple roles with same name.
  * Fixed a compilation error on systems that have the posix_spawn()
  and posix_spawnp() functions but an unusable spawn.h header.
  Bug #730.
  * Fixed support for negating character classes in sudo's version
  of the fnmatch() function.
  * Fixed a bug in the LDAP and SSSD backends that could allow an
  unauthorized user to list another user's privileges.  Bug #738.
  * The PAM conversation function now works around an ambiguity in the
  PAM spec with respect to multiple messages.  Bug #726.</changelog>
<changelog author="mpluskal@suse.com" date="1458388800">- Add gpg signature
- Use valid category for tests</changelog>
<changelog author="kstreitova@suse.com" date="1461931200">- add sudo-1.8.16-pam_groups.patch to do group setup in
  policy_init_session() before calling out to the plugin. This makes
  it possible for the pam_group module to change the group in
  pam_setcred() [fate#318850]</changelog>
<changelog author="kstreitova@suse.com" date="1463659200">- add "BuildRequires: cyrus-sasl-devel" to enable SASL
  authentication [bnc#979531]</changelog>
<changelog author="egeorget@openmailbox.org" date="1464004800">- Changing password promp to make use of sudo localized prompts.</changelog>
<changelog author="michael@stroeder.com" date="1466337600">- removed obsolete patch sudo-1.8.16-pam_groups.patch
- update to 1.8.17:
  * On AIX, if /etc/security/login.cfg has auth_type set to PAM_AUTH
  but pam_start(3) fails, fall back to AIX authentication.
  Bug #740.
  * Sudo now takes all sudoers sources into account when determining
  whether or not "sudo -l" or "sudo -b" should prompt for a password.
  In other words, if both file and ldap sudoers sources are in
  specified in /etc/nsswitch.conf, "sudo -v" will now require that
  all entries in both sources be have NOPASSWD (file) or !authenticate
  (ldap) in the entries.
  * Sudo now ignores SIGPIPE until the command is executed.  Previously,
  SIGPIPE was only ignored in a few select places.  Bug #739.
  * Fixed a bug introduced in sudo 1.8.14 where (non-syslog) log
  file entries were missing the newline when loglinelen is set to
  a non-positive number.  Bug #742.
  * Unix groups are now set before the plugin session intialization
  code is run.  This makes it possible to use dynamic groups with
  the Linux-PAM pam_group module.
  * Fixed a bug where a debugging statement could dereference a NULL
  pointer when looking up a group that doesn't exist.  Bug #743.
  * Sudo has been run through the Coverity code scanner.  A number of
  minor bugs have been fixed as a result.  None were security issues.
  * SELinux support, which was broken in 1.8.16, has been repaired.
  * Fixed a bug when logging I/O where all output buffers might not
  get flushed at exit.
  * Forward slashes are no longer escaped in the JSON output of
  "visudo -x".  This was never required by the standard and not
  escaping them improves readability of the output.
  * Sudo no longer treats PAM_SESSION_ERR as a fatal error when
  opening the PAM session.  Other errors from pam_open_session()
  are still treated as fatal.  This avoids the "policy plugin
  failed session initialization" error message seen on some systems.
  * Korean translation for sudo and sudoers from translationproject.org.
  * Fixed a bug on AIX where the stack size hard resource limit was
  being set to 2GB instead of 4GB on 64-bit systems.
  * The SSSD backend now properly supports "sudo -U otheruser -l".
  * The SSSD backend now uses the value of "ipa_hostname"
  from sssd.conf, if specified, when matching the host name.
  * Fixed a hang on some systems when the command is being run in
  a pty and it failed to execute.
  * When performing a wildcard match in sudoers, check for an exact
  string match if the user command was fully-qualified (or resolved
  via the PATH).  This fixes an issue executing scripts on Linux
  when there are multiple wildcard matches with the same base name.
  Bug #746.</changelog>
<changelog author="michael@stroeder.com" date="1466596800">- update to 1.8.17p1:
  * Fixed a bug introduced in 1.8.17 where the user's groups were
    not set on systems that don't use PAM.  Bug #749.</changelog>
<changelog author="michael@stroeder.com" date="1474372800">- update to 1.8.18
  * The sudoers locale is now set before parsing the sudoers file.
  If sudoers_locale is set in sudoers, it is applied before
  evaluating other Defaults entries.  Previously, sudoers_locale
  was used when evaluating sudoers but not during the inital parse.
  Bug #748.
  * A missing or otherwise invalid #includedir is now ignored instead
  of causing a parse error.
  * During "make install", backup files are only used on HP-UX where
  it is not possible to unlink a shared object that is in use.
  This works around a bug in ldconfig on Linux which could create
  links to the backup shared library file instead of the current
  one.
  * Fixed a bug introduced in 1.8.17 where sudoers entries with long
  commands lines could be truncated, preventing a match.  Bug #752.
  * The fqdn, runas_default and sudoers_locale Defaults settings are
  now applied before any other Defaults settings since they can
  change how other Defaults settings are parsed.
  * On systems without the O_NOFOLLOW open(2) flag, when the NOFOLLOW
  flag is set, sudoedit now checks whether the file is a symbolic link
  before opening it as well as after the open.  Bug #753.
  * Sudo will now only resolve a user's group IDs to group names
  when sudoers includes group-based permissions.  Group lookups
  can be expensive on some systems where the group database is
  not local.
  * If the file system holding the sudo log file is full, allow
  the command to run unless the new ignore_logfile_errors Defaults
  option is disabled.  Bug #751.
  * The ignore_audit_errors and ignore_iolog_errors Defaults options
  have been added to control sudo's behavior when it is unable to
  write to the audit and I/O logs.
  * Fixed a bug introduced in 1.8.17 where the SIGPIPE signal handler
  was not being restored when sudo directly executes the command.
  * Fixed a bug where "sudo -l command" would indicate that a command
  was runnable even when denied by sudoers when using the LDAP or
  SSSD backends.
  * The match_group_by_gid Defaults option has been added to allow
  sites where group name resolution is slow and where sudoers only
  contains a small number of groups to match groups by group ID
  instead of by group name.
  * Fixed a bug on Linux where a 32-bit sudo binary could fail with
  an "unable to allocate memory" error when run on a 64-bit system.
  Bug #755
  * When parsing ldap.conf, sudo will now only treat a '#' character
  as the start of a comment when it is at the beginning of the
  line.
  * Fixed a potential crash when auditing is enabled and the audit
  function fails with an error.  Bug #756
  * Norwegian Nynorsk translation for sudo from translationproject.org.
  * Fixed a typo that broke short host name matching when the fqdn
  flag is enabled in sudoers.  Bug #757
  * Negated sudoHost attributes are now supported by the LDAP and
  SSSD backends.
  * Fixed matching entries in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.
  * Fixed "sudo -l" output in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.</changelog>
<changelog author="michael@stroeder.com" date="1477656000">- update to 1.8.18p1 with these major changes:
  * When sudo_noexec.so is used, the WRDE_NOCMD flag is now added
  if the wordexp() function is called.  This prevents commands
  from being run via wordexp() without disabling it entirely.
  * On Linux systems, sudo_noexec.so now uses a seccomp filter to
  disable execute access if the kernel supports seccomp.  This is
  more robust than the traditional method of using stub functions
  that return an error.</changelog>

</package>

<package pkgid="600b25320cb4acbce523aca6a641bdbc1ed1bc170c7cd5e32daddc297f8af0cb" name="sudo" arch="x86_64">
    <version epoch="0" ver="1.8.18p1" rel="127.1"/>

<changelog author="vcizek@suse.com" date="1400155200">- update to 1.8.10p3
  * Fixed expansion of the %p escape in the prompt for "sudo -l"
    when rootpw, runaspw or targetpw is set. Bug #639.
  * Fixed matching of uids and gids which was broken in version 1.8.9
  * PAM credential initialization has been re-enabled. It was
    unintentionally disabled by default in version 1.8.8. The way
    credentials are initialized has also been fixed. Bug #642.
  * Fixed a descriptor leak on Linux when determing boot time. Sudo
    normally closes extra descriptors before running a command so
    the impact is limited. Bug #645.
  * Fixed flushing of the last buffer of data when I/O logging is
    enabled. This bug, introduced in version 1.8.9, could cause
    incomplete command output on some systems. Bug #646.
  * Fixed a hang introduced in sudo 1.8.10 when timestamp_timeout
    is set to zero. Bug #638.
- don't install test LICENSE with executable perms</changelog>
<changelog author="tabraham@suse.com" date="1413028800">- refresh sudo-sudoers.patch
- update to 1.8.11p1
  * Fixed a compilation problem on some systems when the
  - -disable-shared-libutil configure option was specified.
  * The user can no longer interrupt the sleep after an incorrect password on
    PAM systems using pam_unix. Bug #666.
  * Fixed a compilation problem on Linux systems that do not use PAM. Bug #667.
  * "make install" will now work with the stock GNU autotools install-sh
    script. Bug #669.
  * Fixed a crash with "sudo -i" when the current working directory does not
    exist. Bug #670.
  * Fixed a potential crash in the debug subsystem when logging a message
    larger that 1024 bytes.
  * Fixed a "make check" failure for ttyname when stdin is closed and stdout
    and stderr are redirected to a different tty. Bug #643.
  * Added BASH_FUNC_* to environment blacklist to match newer-style bash
    functions.
- changes from 1.8.11
  * The sudoers plugin no longer uses setjmp/longjmp to recover from fatal
    errors. All errors are now propagated to the caller via return codes.
  * When running a command in the background, sudo will now forward SIGINFO to
    the command (if supported).
  * Sudo will now use the system versions of the sha2 functions from libc or
    libmd if available.
  * Visudo now works correctly on GNU Hurd. Bug #647.
  * Fixed suspend and resume of curses programs on some system when the
    command is not being run in a pseudo-terminal. Bug #649.
  * Fixed a crash with LDAP-based sudoers on some systems when Kerberos was
    enabled.
  * Sudo now includes optional Solaris audit support.
  * Catalan translation for sudoers from translationproject.org.
  * Norwegian Bokmaal translation for sudo from translationproject.org.
  * Greek translation for sudoers from translationproject.org
  * The sudo source tree has been reorganized to more closely resemble that of
    other gettext-enabled packages.
  * Sudo and its associated programs now link against a shared version of
    libsudo_util. The --disable-shared-libutil configure option may be used to
    force static linking if the --enable-static-sudoers option is also
    specified.
  * The passwords in ldap.conf and ldap.secret may now be encoded in base64.
  * Audit updates. SELinux role changes are now audited. For sudoedit, we now
    audit the actual editor being run, instead of just the sudoedit command.
  * Fixed bugs in the man page post-processing that could cause portions of the
    manuals to be removed.
  * Fixed a crash in the system_group plugin. Bug #653.
  * Fixed sudoedit on platforms without a native version of the getprogname()
    function. Bug #654.
  * Fixed compilation problems with some pre-C99 compilers.
  * Fixed sudo's -C option which was broken in version 1.8.9.
  * It is now possible to match an environment variable's value as well as its
    name using env_keep and env_check. This can be used to preserve bash
    functions which would otherwise be removed from the environment.
  * New files created via sudoedit as a non-root user now have the proper
    group id. Bug #656.
  * Sudoedit now works correctly in conjunction with sudo's SELinux RBAC
    support. Temporary files are now created with the proper security context.
  * The sudo I/O logging plugin API has been updated. If a logging function
    returns an error, the command will be terminated and all of the plugin's
    logging functions will be disabled. If a logging function rejects the
    command's output it will no longer be displayed to the user's terminal.
  * Fixed a compilation error on systems that lack openpty(), _getpty() and
    grantpt(). Bug #660.
  * Fixed a hang when a sudoers source is listed more than once in a single
    sudoers nsswitch.conf entry.
  * On AIX, shell scripts without a #! magic number are now passed to
    /usr/bin/sh, not /usr/bin/bsh. This is consistent with what the execvp()
    function on AIX does and matches historic sudo behavior. Bug #661.
  * Fixed a cross-compilation problem building mksiglist and mksigname.
    Bug #662.</changelog>
<changelog author="fstrba@suse.com" date="1415275200">- update to 1.8.11p2
  * Fixed a bug where dynamic shared objects loaded from a plugin
    could use the hooked version of getenv() but not the hooked
    versions of putenv(), setenv() or unsetenv().  This can cause
    problems for PAM modules that use those functions.</changelog>
<changelog author="vcizek@suse.com" date="1418817600">- correctly parse /proc/stat for boottime (bnc#899252)
  * added sudo-parse_boottime_properly.patch from Debian</changelog>
<changelog author="vcizek@suse.com" date="1424606400">- update to 1.8.12 (fixes bnc#918953)
- changelog:
  * The embedded copy of zlib has been upgraded to version 1.2.8 and
    is now installed as a shared library where supported.
  * Debug settings for the sudo front end and sudoers plugin are now configured separately.
  * Multiple sudo.conf Debug entries may now be specified per program (or plugin).
  * The plugin API has been extended such that the path to the plugin
    that was loaded is now included in the settings array. This path
    can be used to register with the debugging subsystem. The debug_flags
    setting is now prefixed with a file name and may be specified multiple
    times if there is more than one matching Debug setting in sudo.conf.
  * The sudoers regression tests now run with the locale set to C since
    some of the tests compare output that includes locale-specific messages. Bug #672.
  * Fixed a bug where sudo would not run commands on Linux when compiled
    with audit support if audit is disabled. Bug #671.
  * The default password prompt now includes a trailing space after
    "Password:" for consistency with su(1) on most systems. Bug #663.
  * Visudo will now use the optional sudoers_file, sudoers_mode,
    sudoers_uid and sudoers_gid arguments if specified on the sudoers.so Plugin line in the sudo.conf file.
  * Fixed a problem introduced in sudo 1.8.8 that prevented the full
    host name from being used when the fqdn sudoers option is used. Bug #678.
  * Sudo now installs a handler for SIGCHLD signal handler immediately
    before stating the process that will execute the command (or start the monitor).
  * Removed a limit on the length of command line arguments expanded by
    a wild card using sudo's version of the fnmatch() function.
    This limit was introduced when sudo's version of fnmatch() was replaced in sudo 1.8.4.
  * LDAP-based sudoers can now query an LDAP server for a user's netgroups
    directly. This is often much faster than fetching every sudoRole object
    containing a sudoUser that begins with a `+' prefix and checking
    whether the user is a member of any of the returned netgroups.
  * The mail_always sudoers option no longer sends mail for
    sudo -l or sudo -v unless the user is unable to authenticate themselves.
  * Fixed a crash when sudo is run with an empty argument vector.
  * Fixed two potential crashes when sudo is run with very low resource limits.
  * The TZ environment variable is now checked for safety instead of simply
    being copied to the environment of the command. This fixes a potential security issue.</changelog>
<changelog author="vcizek@suse.com" date="1431604800">- update to 1.8.13
  * The examples directory is now a subdirectory of the doc dir to
  conform to Debian guidelines.  Bug #682.
  * Fixed a compilation error for siglist.c and signame.c on some
  systems.  Bug #686
  * Weak symbols are now used for sudo_warn_gettext() and
  sudo_warn_strerror() in libsudo_util to avoid link errors when
  - Wl,--no-undefined is used in LDFLAGS.  The --disable-weak-symbols
  configure option can be used to disable the user of weak symbols.
  * Fixed a bug in sudo's mkstemps() replacement function that
  prevented the file extension from being preserved in sudoedit.
  * A new mail_all_cmnds sudoers flag will send mail when a user runs
  a command (or tries to). The behavior of the mail_always flag has
  been restored to always send mail when sudo is run.
  * New "MAIL" and "NOMAIL" command tags have been added to toggle
  mail sending behavior on a per-command (or Cmnd_Alias) basis.
  * Fixed matching of empty passwords when sudo is configured to
  use passwd (or shadow) file authentication on systems where the
  crypt() function returns NULL for invalid salts.
  * The "all" setting for listpw and verifypw now works correctly
  with LDAP and sssd sudoers.
  * The sudo timestamp directory is now created at boot time on
  platforms that use systemd.
  * Sudo will now restore the value of the SIGPIPE handler before
  executing the command.
  * Sudo now uses "struct timespec" instead of "struct timeval" for
  time keeping when possible.  If supported, sudoedit and visudo
  now use nanosecond granularity time stamps.
  * Fixed a symbol name collision with systems that have their own
  SHA2 implementation.  This fixes a problem where PAM could use
  the wrong SHA2 implementation on Solaris 10 systems configured
  to use SHA512 for passwords.
  * The editor invoked by sudoedit once again uses an unmodified
  copy of the user's environment as per the documentation.  This
  was inadvertantly changed in sudo 1.8.0.  Bug #688.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1437566400">- BuildRequires zlib-devel, support zlib compressed I/O logs.</changelog>
<changelog author="kstreitova@suse.com" date="1437652800">- update to 1.8.14p3:
  * changes in 1.8.14p3
  * Fixed a bug introduced in sudo 1.8.14p2 that prevented sudo
    from working when no tty was present. Bug #706.
  * Fixed tty detection on newer AIX systems where dev_t is 64-bit.
  * changes in 1.8.14p2
  * Fixed a bug introduced in sudo 1.8.14 that prevented the
    lecture file from being created. Bug #704.
  * changes in 1.8.14p1
  * Fixed a bug introduced in sudo 1.8.14 that prevented the sssd
    backend from working. Bug #703.
  * changes in 1.8.14
  * Log messages on Mac OS X now respect sudoers_locale when sudo
    is build with NLS support.
  * The sudo manual pages now pass mandoc -Tlint with no warnings.
  * Fixed a compilation problem on systems with the sig2str()
    function that do not define SIG2STR_MAX in signal.h.
  * Worked around a compiler bug that resulted in unexpected
    behavior when returning an int from a function declared to
    return bool without an explicit cast.
  * Worked around a bug in Mac OS X 10.10 BSD auditing where the
    au_preselect() fails for AUE_sudo events but succeeds for
    AUE_DARWIN_sudo.
  * Fixed a hang on Linux systems with glibc when sudo is linked
    with jemalloc.
  * When the user runs a command as a user ID that is not present
    in the password database via the -u flag, the command is now
    run with the group ID of the invoking user instead of group ID 0.
  * Fixed a compilation problem on systems that don't pull in
    definitions of uid_t and gid_t without sys/types.h or unistd.h.
  * Fixed a compilation problem on newer AIX systems which use a
    struct st_timespec for time stamps in struct stat that differs
    from struct timespec. Bug #702.
  * The example directory is now configurable via --with-exampledir
    and defaults to DATAROOTDIR/examples/sudo on BSD systems.
  * The /usr/lib/tmpfiles.d/sudo.conf file is now installed as part
    of "make install" when systemd is in use.
  * Fixed a linker problem on some systems with libintl. Bug #690.
  * Fixed compilation with compilers that don't support __func__ or
    __FUNCTION__.
  * Sudo no longer needs to uses weak symbols to support localization
    in the warning functions. A registration function is used instead.
  * Fixed a setresuid() failure in sudoers on Linux kernels where
    uid changes take the nproc resource limit into account.
  * Fixed LDAP netgroup queries on AIX.
  * Sudo will now display the custom prompt on Linux systems with
    PAM even if the "Password: " prompt is not localized by the
    PAM module. Bug #701.
  * Double-quoted values in an LDAP sudoOption are now supported
    for consistency with file-based sudoers.
  * Fixed a bug that prevented the btime entry in /proc/stat from
    being parsed on Linux.
  * update sudo-sudoers.patch
  * remove sudo-parse_boottime_properly.patch (it's not longer needed)</changelog>
<changelog author="dimstar@opensuse.org" date="1439380800">- Pass --enable-tmpfiles.d=%{_tmpfilesdir} to configure: let's be
  specific about this feature, and not randomly rely on the
  presence/absence of /usr/lib/tmpfiles.d/systemd.conf.
- Add systemd-rpm-macros BuildRequires to ensure %_tmpfilesdir is
  defined.
- Add relevant %tmpfiles_create call to post scriptlet.</changelog>
<changelog author="jengelh@inai.de" date="1439380801">- No need to buildrequire an sssd plugin (libsss_sudo)</changelog>
<changelog author="kstreitova@suse.com" date="1446811200">- update to 1.8.15:
  * Fixed a bug that prevented sudo from building outside the source
    tree on some platforms. Bug #708.
  * Fixed the location of the sssd library in the RHEL/Centos packages.
    Bug #710.
  * Fixed a build problem on systems that don't implicitly include
    sys/types.h from other header files. Bug #711.
  * Fixed a problem on Linux using containers where sudo would ignore
    signals sent by a process in a different container.
  * Sudo now refuses to run a command if the PAM session module returns
    an error.
  * When editing files with sudoedit, symbolic links will no longer be
    followed by default. The old behavior can be restored by enabling
    the sudoedit_follow option in sudoers or on a per-command basis with
    the FOLLOW and NOFOLLOW tags. Bug #707.
  * Fixed a bug introduced in version 1.8.14 that caused the last valid
    editor in the sudoers "editor" list to be used by visudo and sudoedit
    instead of the first. Bug #714.
  * Fixed a bug in visudo that prevented the addition of a final newline
    to edited files without one.
  * Fixed a bug decoding certain base64 digests in sudoers when the
    intermediate format included a '=' character.
  * Individual records are now locked in the time stamp file instead of
    the entire file. This allows sudo to avoid prompting for a password
    multiple times on the same terminal when used in a pipeline.
    In other words, sudo cat foo | sudo grep bar now only prompts for
    the password once. Previously, both sudo processes would prompt for
    a password, often making it impossible to enter. Bug #705.
  * Fixed a bug where sudo would fail to run commands as a non-root user
    on systems that lack both setresuid() and setreuid(). Bug #713.
  * Fixed a bug introduced in sudo 1.8.14 that prevented visudo from
    re-editing the correct file when a syntax error was detected.
  * Fixed a bug where sudo would not relay a SIGHUP signal to the command
    when the terminal is closed and the command is not run in its own
    pseudo-tty. Bug #719.
  * If some, but not all, of the LOGNAME, USER or USERNAME environment
    variables have been preserved from the invoking user's environment,
    sudo will now use the preserved value to set the remaining variables
    instead of using the runas user. This ensures that if, for example,
    only LOGNAME is present in the env_keep list, that sudo will not set
    USER and USERNAME to the runas user.
  * When the command sudo is running dies due to a signal, sudo will now
    send itself that same signal with the default signal handler installed
    instead of exiting. The bash shell appears to ignore some signals,
    e.g. SIGINT, unless the command being run is killed by that signal.
    This makes the behavior of commands run under sudo the same as
    without sudo when bash is the shell. Bug #722.
  * Slovak translation for sudo from translationproject.org.
  * Hungarian and Slovak translations for sudoers from
    translationproject.org.
  * Previously, when env_reset was enabled (the default) and the
  - s option was not used, the SHELL environment variable was set to the
    shell of the invoking user. Now, when env_reset is enabled and the
  - s option is not used, SHELL is set based on the target user.
  * Fixed challenge/response style BSD authentication.
  * Added the sudoedit_checkdir Defaults option to prevent sudoedit from
    editing files located in a directory that is writable by the
    invoking user.
  * Added the always_query_group_plugin Defaults option to control
    whether groups not found in the system group database are passed to
    the group plugin. Previously, unknown system groups were always
    passed to the group plugin.
  * When creating a new file, sudoedit will now check that the file's
    parent directory exists before running the editor.
  * Fixed the compiler stack protector test in configure for compilers
    that support -fstack-protector but don't actually have the ssp
    library available.
- use spec-cleaner</changelog>
<changelog author="michael@stroeder.com" date="1458216000">- update to 1.8.16:
  * Fixed a compilation error on Solaris 10 with Stun Studio 12.
  Bug #727.
  * When preserving variables from the invoking user's environment, if
  there are duplicates sudo now only keeps the first instance.
  * Fixed a bug that could cause warning mail to be sent in list
  mode (sudo -l) for users without sudo privileges when the
  LDAP and sssd backends are used.
  * Fixed a bug that prevented the "mail_no_user" option from working
  properly with the LDAP backend.
  * In the LDAP and sssd backends, white space is now ignored between
  an operator (!, +, +=, -=) when parsing a sudoOption.
  * It is now possible to disable Path settings in sudo.conf
  by omitting the path name.
  * The sudoedit_checkdir Defaults option is now enabled by default
  and has been extended.  When editing files with sudoedit, each
  directory in the path to be edited is now checked.  If a directory
  is writable by the invoking user, symbolic links will not be
  followed.  If the parent directory of the file to be edited is
  writable, sudoedit will refuse to edit it.
  Bug #707.
  * The netgroup_tuple Defaults option has been added to enable matching
  of the entire netgroup tuple, not just the host or user portion.
  Bug #717.
  * When matching commands based on the SHA2 digest, sudo will now
  use fexecve(2) to execute the command if it is available.  This
  fixes a time of check versus time of use race condition when the
  directory holding the command is writable by the invoking user.
  * On AIX systems, sudo now caches the auth registry string along
  with password and group information.  This fixes a potential
  problem when a user or group of the same name exists in multiple
  auth registries.  For example, local and LDAP.
  * Fixed a crash in the SSSD backend when the invoking user is not
  found.  Bug #732.
  * Added the --enable-asan configure flag to enable address sanitizer
  support.  A few minor memory leaks have been plugged to quiet
  the ASAN leak detector.
  * The value of _PATH_SUDO_CONF may once again be overridden via
  the Makefile.  Bug #735.
  * The sudoers2ldif script now handles multiple roles with same name.
  * Fixed a compilation error on systems that have the posix_spawn()
  and posix_spawnp() functions but an unusable spawn.h header.
  Bug #730.
  * Fixed support for negating character classes in sudo's version
  of the fnmatch() function.
  * Fixed a bug in the LDAP and SSSD backends that could allow an
  unauthorized user to list another user's privileges.  Bug #738.
  * The PAM conversation function now works around an ambiguity in the
  PAM spec with respect to multiple messages.  Bug #726.</changelog>
<changelog author="mpluskal@suse.com" date="1458388800">- Add gpg signature
- Use valid category for tests</changelog>
<changelog author="kstreitova@suse.com" date="1461931200">- add sudo-1.8.16-pam_groups.patch to do group setup in
  policy_init_session() before calling out to the plugin. This makes
  it possible for the pam_group module to change the group in
  pam_setcred() [fate#318850]</changelog>
<changelog author="kstreitova@suse.com" date="1463659200">- add "BuildRequires: cyrus-sasl-devel" to enable SASL
  authentication [bnc#979531]</changelog>
<changelog author="egeorget@openmailbox.org" date="1464004800">- Changing password promp to make use of sudo localized prompts.</changelog>
<changelog author="michael@stroeder.com" date="1466337600">- removed obsolete patch sudo-1.8.16-pam_groups.patch
- update to 1.8.17:
  * On AIX, if /etc/security/login.cfg has auth_type set to PAM_AUTH
  but pam_start(3) fails, fall back to AIX authentication.
  Bug #740.
  * Sudo now takes all sudoers sources into account when determining
  whether or not "sudo -l" or "sudo -b" should prompt for a password.
  In other words, if both file and ldap sudoers sources are in
  specified in /etc/nsswitch.conf, "sudo -v" will now require that
  all entries in both sources be have NOPASSWD (file) or !authenticate
  (ldap) in the entries.
  * Sudo now ignores SIGPIPE until the command is executed.  Previously,
  SIGPIPE was only ignored in a few select places.  Bug #739.
  * Fixed a bug introduced in sudo 1.8.14 where (non-syslog) log
  file entries were missing the newline when loglinelen is set to
  a non-positive number.  Bug #742.
  * Unix groups are now set before the plugin session intialization
  code is run.  This makes it possible to use dynamic groups with
  the Linux-PAM pam_group module.
  * Fixed a bug where a debugging statement could dereference a NULL
  pointer when looking up a group that doesn't exist.  Bug #743.
  * Sudo has been run through the Coverity code scanner.  A number of
  minor bugs have been fixed as a result.  None were security issues.
  * SELinux support, which was broken in 1.8.16, has been repaired.
  * Fixed a bug when logging I/O where all output buffers might not
  get flushed at exit.
  * Forward slashes are no longer escaped in the JSON output of
  "visudo -x".  This was never required by the standard and not
  escaping them improves readability of the output.
  * Sudo no longer treats PAM_SESSION_ERR as a fatal error when
  opening the PAM session.  Other errors from pam_open_session()
  are still treated as fatal.  This avoids the "policy plugin
  failed session initialization" error message seen on some systems.
  * Korean translation for sudo and sudoers from translationproject.org.
  * Fixed a bug on AIX where the stack size hard resource limit was
  being set to 2GB instead of 4GB on 64-bit systems.
  * The SSSD backend now properly supports "sudo -U otheruser -l".
  * The SSSD backend now uses the value of "ipa_hostname"
  from sssd.conf, if specified, when matching the host name.
  * Fixed a hang on some systems when the command is being run in
  a pty and it failed to execute.
  * When performing a wildcard match in sudoers, check for an exact
  string match if the user command was fully-qualified (or resolved
  via the PATH).  This fixes an issue executing scripts on Linux
  when there are multiple wildcard matches with the same base name.
  Bug #746.</changelog>
<changelog author="michael@stroeder.com" date="1466596800">- update to 1.8.17p1:
  * Fixed a bug introduced in 1.8.17 where the user's groups were
    not set on systems that don't use PAM.  Bug #749.</changelog>
<changelog author="michael@stroeder.com" date="1474372800">- update to 1.8.18
  * The sudoers locale is now set before parsing the sudoers file.
  If sudoers_locale is set in sudoers, it is applied before
  evaluating other Defaults entries.  Previously, sudoers_locale
  was used when evaluating sudoers but not during the inital parse.
  Bug #748.
  * A missing or otherwise invalid #includedir is now ignored instead
  of causing a parse error.
  * During "make install", backup files are only used on HP-UX where
  it is not possible to unlink a shared object that is in use.
  This works around a bug in ldconfig on Linux which could create
  links to the backup shared library file instead of the current
  one.
  * Fixed a bug introduced in 1.8.17 where sudoers entries with long
  commands lines could be truncated, preventing a match.  Bug #752.
  * The fqdn, runas_default and sudoers_locale Defaults settings are
  now applied before any other Defaults settings since they can
  change how other Defaults settings are parsed.
  * On systems without the O_NOFOLLOW open(2) flag, when the NOFOLLOW
  flag is set, sudoedit now checks whether the file is a symbolic link
  before opening it as well as after the open.  Bug #753.
  * Sudo will now only resolve a user's group IDs to group names
  when sudoers includes group-based permissions.  Group lookups
  can be expensive on some systems where the group database is
  not local.
  * If the file system holding the sudo log file is full, allow
  the command to run unless the new ignore_logfile_errors Defaults
  option is disabled.  Bug #751.
  * The ignore_audit_errors and ignore_iolog_errors Defaults options
  have been added to control sudo's behavior when it is unable to
  write to the audit and I/O logs.
  * Fixed a bug introduced in 1.8.17 where the SIGPIPE signal handler
  was not being restored when sudo directly executes the command.
  * Fixed a bug where "sudo -l command" would indicate that a command
  was runnable even when denied by sudoers when using the LDAP or
  SSSD backends.
  * The match_group_by_gid Defaults option has been added to allow
  sites where group name resolution is slow and where sudoers only
  contains a small number of groups to match groups by group ID
  instead of by group name.
  * Fixed a bug on Linux where a 32-bit sudo binary could fail with
  an "unable to allocate memory" error when run on a 64-bit system.
  Bug #755
  * When parsing ldap.conf, sudo will now only treat a '#' character
  as the start of a comment when it is at the beginning of the
  line.
  * Fixed a potential crash when auditing is enabled and the audit
  function fails with an error.  Bug #756
  * Norwegian Nynorsk translation for sudo from translationproject.org.
  * Fixed a typo that broke short host name matching when the fqdn
  flag is enabled in sudoers.  Bug #757
  * Negated sudoHost attributes are now supported by the LDAP and
  SSSD backends.
  * Fixed matching entries in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.
  * Fixed "sudo -l" output in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.</changelog>
<changelog author="michael@stroeder.com" date="1477656000">- update to 1.8.18p1 with these major changes:
  * When sudo_noexec.so is used, the WRDE_NOCMD flag is now added
  if the wordexp() function is called.  This prevents commands
  from being run via wordexp() without disabling it entirely.
  * On Linux systems, sudo_noexec.so now uses a seccomp filter to
  disable execute access if the kernel supports seccomp.  This is
  more robust than the traditional method of using stub functions
  that return an error.</changelog>

</package>

<package pkgid="1da90875ddaf8c1516512d5db6d23d18e715f33e2991aa955c254a720ae360d9" name="sudo-debuginfo" arch="x86_64">
    <version epoch="0" ver="1.8.18p1" rel="127.1"/>

<changelog author="vcizek@suse.com" date="1400155200">- update to 1.8.10p3
  * Fixed expansion of the %p escape in the prompt for "sudo -l"
    when rootpw, runaspw or targetpw is set. Bug #639.
  * Fixed matching of uids and gids which was broken in version 1.8.9
  * PAM credential initialization has been re-enabled. It was
    unintentionally disabled by default in version 1.8.8. The way
    credentials are initialized has also been fixed. Bug #642.
  * Fixed a descriptor leak on Linux when determing boot time. Sudo
    normally closes extra descriptors before running a command so
    the impact is limited. Bug #645.
  * Fixed flushing of the last buffer of data when I/O logging is
    enabled. This bug, introduced in version 1.8.9, could cause
    incomplete command output on some systems. Bug #646.
  * Fixed a hang introduced in sudo 1.8.10 when timestamp_timeout
    is set to zero. Bug #638.
- don't install test LICENSE with executable perms</changelog>
<changelog author="tabraham@suse.com" date="1413028800">- refresh sudo-sudoers.patch
- update to 1.8.11p1
  * Fixed a compilation problem on some systems when the
  - -disable-shared-libutil configure option was specified.
  * The user can no longer interrupt the sleep after an incorrect password on
    PAM systems using pam_unix. Bug #666.
  * Fixed a compilation problem on Linux systems that do not use PAM. Bug #667.
  * "make install" will now work with the stock GNU autotools install-sh
    script. Bug #669.
  * Fixed a crash with "sudo -i" when the current working directory does not
    exist. Bug #670.
  * Fixed a potential crash in the debug subsystem when logging a message
    larger that 1024 bytes.
  * Fixed a "make check" failure for ttyname when stdin is closed and stdout
    and stderr are redirected to a different tty. Bug #643.
  * Added BASH_FUNC_* to environment blacklist to match newer-style bash
    functions.
- changes from 1.8.11
  * The sudoers plugin no longer uses setjmp/longjmp to recover from fatal
    errors. All errors are now propagated to the caller via return codes.
  * When running a command in the background, sudo will now forward SIGINFO to
    the command (if supported).
  * Sudo will now use the system versions of the sha2 functions from libc or
    libmd if available.
  * Visudo now works correctly on GNU Hurd. Bug #647.
  * Fixed suspend and resume of curses programs on some system when the
    command is not being run in a pseudo-terminal. Bug #649.
  * Fixed a crash with LDAP-based sudoers on some systems when Kerberos was
    enabled.
  * Sudo now includes optional Solaris audit support.
  * Catalan translation for sudoers from translationproject.org.
  * Norwegian Bokmaal translation for sudo from translationproject.org.
  * Greek translation for sudoers from translationproject.org
  * The sudo source tree has been reorganized to more closely resemble that of
    other gettext-enabled packages.
  * Sudo and its associated programs now link against a shared version of
    libsudo_util. The --disable-shared-libutil configure option may be used to
    force static linking if the --enable-static-sudoers option is also
    specified.
  * The passwords in ldap.conf and ldap.secret may now be encoded in base64.
  * Audit updates. SELinux role changes are now audited. For sudoedit, we now
    audit the actual editor being run, instead of just the sudoedit command.
  * Fixed bugs in the man page post-processing that could cause portions of the
    manuals to be removed.
  * Fixed a crash in the system_group plugin. Bug #653.
  * Fixed sudoedit on platforms without a native version of the getprogname()
    function. Bug #654.
  * Fixed compilation problems with some pre-C99 compilers.
  * Fixed sudo's -C option which was broken in version 1.8.9.
  * It is now possible to match an environment variable's value as well as its
    name using env_keep and env_check. This can be used to preserve bash
    functions which would otherwise be removed from the environment.
  * New files created via sudoedit as a non-root user now have the proper
    group id. Bug #656.
  * Sudoedit now works correctly in conjunction with sudo's SELinux RBAC
    support. Temporary files are now created with the proper security context.
  * The sudo I/O logging plugin API has been updated. If a logging function
    returns an error, the command will be terminated and all of the plugin's
    logging functions will be disabled. If a logging function rejects the
    command's output it will no longer be displayed to the user's terminal.
  * Fixed a compilation error on systems that lack openpty(), _getpty() and
    grantpt(). Bug #660.
  * Fixed a hang when a sudoers source is listed more than once in a single
    sudoers nsswitch.conf entry.
  * On AIX, shell scripts without a #! magic number are now passed to
    /usr/bin/sh, not /usr/bin/bsh. This is consistent with what the execvp()
    function on AIX does and matches historic sudo behavior. Bug #661.
  * Fixed a cross-compilation problem building mksiglist and mksigname.
    Bug #662.</changelog>
<changelog author="fstrba@suse.com" date="1415275200">- update to 1.8.11p2
  * Fixed a bug where dynamic shared objects loaded from a plugin
    could use the hooked version of getenv() but not the hooked
    versions of putenv(), setenv() or unsetenv().  This can cause
    problems for PAM modules that use those functions.</changelog>
<changelog author="vcizek@suse.com" date="1418817600">- correctly parse /proc/stat for boottime (bnc#899252)
  * added sudo-parse_boottime_properly.patch from Debian</changelog>
<changelog author="vcizek@suse.com" date="1424606400">- update to 1.8.12 (fixes bnc#918953)
- changelog:
  * The embedded copy of zlib has been upgraded to version 1.2.8 and
    is now installed as a shared library where supported.
  * Debug settings for the sudo front end and sudoers plugin are now configured separately.
  * Multiple sudo.conf Debug entries may now be specified per program (or plugin).
  * The plugin API has been extended such that the path to the plugin
    that was loaded is now included in the settings array. This path
    can be used to register with the debugging subsystem. The debug_flags
    setting is now prefixed with a file name and may be specified multiple
    times if there is more than one matching Debug setting in sudo.conf.
  * The sudoers regression tests now run with the locale set to C since
    some of the tests compare output that includes locale-specific messages. Bug #672.
  * Fixed a bug where sudo would not run commands on Linux when compiled
    with audit support if audit is disabled. Bug #671.
  * The default password prompt now includes a trailing space after
    "Password:" for consistency with su(1) on most systems. Bug #663.
  * Visudo will now use the optional sudoers_file, sudoers_mode,
    sudoers_uid and sudoers_gid arguments if specified on the sudoers.so Plugin line in the sudo.conf file.
  * Fixed a problem introduced in sudo 1.8.8 that prevented the full
    host name from being used when the fqdn sudoers option is used. Bug #678.
  * Sudo now installs a handler for SIGCHLD signal handler immediately
    before stating the process that will execute the command (or start the monitor).
  * Removed a limit on the length of command line arguments expanded by
    a wild card using sudo's version of the fnmatch() function.
    This limit was introduced when sudo's version of fnmatch() was replaced in sudo 1.8.4.
  * LDAP-based sudoers can now query an LDAP server for a user's netgroups
    directly. This is often much faster than fetching every sudoRole object
    containing a sudoUser that begins with a `+' prefix and checking
    whether the user is a member of any of the returned netgroups.
  * The mail_always sudoers option no longer sends mail for
    sudo -l or sudo -v unless the user is unable to authenticate themselves.
  * Fixed a crash when sudo is run with an empty argument vector.
  * Fixed two potential crashes when sudo is run with very low resource limits.
  * The TZ environment variable is now checked for safety instead of simply
    being copied to the environment of the command. This fixes a potential security issue.</changelog>
<changelog author="vcizek@suse.com" date="1431604800">- update to 1.8.13
  * The examples directory is now a subdirectory of the doc dir to
  conform to Debian guidelines.  Bug #682.
  * Fixed a compilation error for siglist.c and signame.c on some
  systems.  Bug #686
  * Weak symbols are now used for sudo_warn_gettext() and
  sudo_warn_strerror() in libsudo_util to avoid link errors when
  - Wl,--no-undefined is used in LDFLAGS.  The --disable-weak-symbols
  configure option can be used to disable the user of weak symbols.
  * Fixed a bug in sudo's mkstemps() replacement function that
  prevented the file extension from being preserved in sudoedit.
  * A new mail_all_cmnds sudoers flag will send mail when a user runs
  a command (or tries to). The behavior of the mail_always flag has
  been restored to always send mail when sudo is run.
  * New "MAIL" and "NOMAIL" command tags have been added to toggle
  mail sending behavior on a per-command (or Cmnd_Alias) basis.
  * Fixed matching of empty passwords when sudo is configured to
  use passwd (or shadow) file authentication on systems where the
  crypt() function returns NULL for invalid salts.
  * The "all" setting for listpw and verifypw now works correctly
  with LDAP and sssd sudoers.
  * The sudo timestamp directory is now created at boot time on
  platforms that use systemd.
  * Sudo will now restore the value of the SIGPIPE handler before
  executing the command.
  * Sudo now uses "struct timespec" instead of "struct timeval" for
  time keeping when possible.  If supported, sudoedit and visudo
  now use nanosecond granularity time stamps.
  * Fixed a symbol name collision with systems that have their own
  SHA2 implementation.  This fixes a problem where PAM could use
  the wrong SHA2 implementation on Solaris 10 systems configured
  to use SHA512 for passwords.
  * The editor invoked by sudoedit once again uses an unmodified
  copy of the user's environment as per the documentation.  This
  was inadvertantly changed in sudo 1.8.0.  Bug #688.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1437566400">- BuildRequires zlib-devel, support zlib compressed I/O logs.</changelog>
<changelog author="kstreitova@suse.com" date="1437652800">- update to 1.8.14p3:
  * changes in 1.8.14p3
  * Fixed a bug introduced in sudo 1.8.14p2 that prevented sudo
    from working when no tty was present. Bug #706.
  * Fixed tty detection on newer AIX systems where dev_t is 64-bit.
  * changes in 1.8.14p2
  * Fixed a bug introduced in sudo 1.8.14 that prevented the
    lecture file from being created. Bug #704.
  * changes in 1.8.14p1
  * Fixed a bug introduced in sudo 1.8.14 that prevented the sssd
    backend from working. Bug #703.
  * changes in 1.8.14
  * Log messages on Mac OS X now respect sudoers_locale when sudo
    is build with NLS support.
  * The sudo manual pages now pass mandoc -Tlint with no warnings.
  * Fixed a compilation problem on systems with the sig2str()
    function that do not define SIG2STR_MAX in signal.h.
  * Worked around a compiler bug that resulted in unexpected
    behavior when returning an int from a function declared to
    return bool without an explicit cast.
  * Worked around a bug in Mac OS X 10.10 BSD auditing where the
    au_preselect() fails for AUE_sudo events but succeeds for
    AUE_DARWIN_sudo.
  * Fixed a hang on Linux systems with glibc when sudo is linked
    with jemalloc.
  * When the user runs a command as a user ID that is not present
    in the password database via the -u flag, the command is now
    run with the group ID of the invoking user instead of group ID 0.
  * Fixed a compilation problem on systems that don't pull in
    definitions of uid_t and gid_t without sys/types.h or unistd.h.
  * Fixed a compilation problem on newer AIX systems which use a
    struct st_timespec for time stamps in struct stat that differs
    from struct timespec. Bug #702.
  * The example directory is now configurable via --with-exampledir
    and defaults to DATAROOTDIR/examples/sudo on BSD systems.
  * The /usr/lib/tmpfiles.d/sudo.conf file is now installed as part
    of "make install" when systemd is in use.
  * Fixed a linker problem on some systems with libintl. Bug #690.
  * Fixed compilation with compilers that don't support __func__ or
    __FUNCTION__.
  * Sudo no longer needs to uses weak symbols to support localization
    in the warning functions. A registration function is used instead.
  * Fixed a setresuid() failure in sudoers on Linux kernels where
    uid changes take the nproc resource limit into account.
  * Fixed LDAP netgroup queries on AIX.
  * Sudo will now display the custom prompt on Linux systems with
    PAM even if the "Password: " prompt is not localized by the
    PAM module. Bug #701.
  * Double-quoted values in an LDAP sudoOption are now supported
    for consistency with file-based sudoers.
  * Fixed a bug that prevented the btime entry in /proc/stat from
    being parsed on Linux.
  * update sudo-sudoers.patch
  * remove sudo-parse_boottime_properly.patch (it's not longer needed)</changelog>
<changelog author="dimstar@opensuse.org" date="1439380800">- Pass --enable-tmpfiles.d=%{_tmpfilesdir} to configure: let's be
  specific about this feature, and not randomly rely on the
  presence/absence of /usr/lib/tmpfiles.d/systemd.conf.
- Add systemd-rpm-macros BuildRequires to ensure %_tmpfilesdir is
  defined.
- Add relevant %tmpfiles_create call to post scriptlet.</changelog>
<changelog author="jengelh@inai.de" date="1439380801">- No need to buildrequire an sssd plugin (libsss_sudo)</changelog>
<changelog author="kstreitova@suse.com" date="1446811200">- update to 1.8.15:
  * Fixed a bug that prevented sudo from building outside the source
    tree on some platforms. Bug #708.
  * Fixed the location of the sssd library in the RHEL/Centos packages.
    Bug #710.
  * Fixed a build problem on systems that don't implicitly include
    sys/types.h from other header files. Bug #711.
  * Fixed a problem on Linux using containers where sudo would ignore
    signals sent by a process in a different container.
  * Sudo now refuses to run a command if the PAM session module returns
    an error.
  * When editing files with sudoedit, symbolic links will no longer be
    followed by default. The old behavior can be restored by enabling
    the sudoedit_follow option in sudoers or on a per-command basis with
    the FOLLOW and NOFOLLOW tags. Bug #707.
  * Fixed a bug introduced in version 1.8.14 that caused the last valid
    editor in the sudoers "editor" list to be used by visudo and sudoedit
    instead of the first. Bug #714.
  * Fixed a bug in visudo that prevented the addition of a final newline
    to edited files without one.
  * Fixed a bug decoding certain base64 digests in sudoers when the
    intermediate format included a '=' character.
  * Individual records are now locked in the time stamp file instead of
    the entire file. This allows sudo to avoid prompting for a password
    multiple times on the same terminal when used in a pipeline.
    In other words, sudo cat foo | sudo grep bar now only prompts for
    the password once. Previously, both sudo processes would prompt for
    a password, often making it impossible to enter. Bug #705.
  * Fixed a bug where sudo would fail to run commands as a non-root user
    on systems that lack both setresuid() and setreuid(). Bug #713.
  * Fixed a bug introduced in sudo 1.8.14 that prevented visudo from
    re-editing the correct file when a syntax error was detected.
  * Fixed a bug where sudo would not relay a SIGHUP signal to the command
    when the terminal is closed and the command is not run in its own
    pseudo-tty. Bug #719.
  * If some, but not all, of the LOGNAME, USER or USERNAME environment
    variables have been preserved from the invoking user's environment,
    sudo will now use the preserved value to set the remaining variables
    instead of using the runas user. This ensures that if, for example,
    only LOGNAME is present in the env_keep list, that sudo will not set
    USER and USERNAME to the runas user.
  * When the command sudo is running dies due to a signal, sudo will now
    send itself that same signal with the default signal handler installed
    instead of exiting. The bash shell appears to ignore some signals,
    e.g. SIGINT, unless the command being run is killed by that signal.
    This makes the behavior of commands run under sudo the same as
    without sudo when bash is the shell. Bug #722.
  * Slovak translation for sudo from translationproject.org.
  * Hungarian and Slovak translations for sudoers from
    translationproject.org.
  * Previously, when env_reset was enabled (the default) and the
  - s option was not used, the SHELL environment variable was set to the
    shell of the invoking user. Now, when env_reset is enabled and the
  - s option is not used, SHELL is set based on the target user.
  * Fixed challenge/response style BSD authentication.
  * Added the sudoedit_checkdir Defaults option to prevent sudoedit from
    editing files located in a directory that is writable by the
    invoking user.
  * Added the always_query_group_plugin Defaults option to control
    whether groups not found in the system group database are passed to
    the group plugin. Previously, unknown system groups were always
    passed to the group plugin.
  * When creating a new file, sudoedit will now check that the file's
    parent directory exists before running the editor.
  * Fixed the compiler stack protector test in configure for compilers
    that support -fstack-protector but don't actually have the ssp
    library available.
- use spec-cleaner</changelog>
<changelog author="michael@stroeder.com" date="1458216000">- update to 1.8.16:
  * Fixed a compilation error on Solaris 10 with Stun Studio 12.
  Bug #727.
  * When preserving variables from the invoking user's environment, if
  there are duplicates sudo now only keeps the first instance.
  * Fixed a bug that could cause warning mail to be sent in list
  mode (sudo -l) for users without sudo privileges when the
  LDAP and sssd backends are used.
  * Fixed a bug that prevented the "mail_no_user" option from working
  properly with the LDAP backend.
  * In the LDAP and sssd backends, white space is now ignored between
  an operator (!, +, +=, -=) when parsing a sudoOption.
  * It is now possible to disable Path settings in sudo.conf
  by omitting the path name.
  * The sudoedit_checkdir Defaults option is now enabled by default
  and has been extended.  When editing files with sudoedit, each
  directory in the path to be edited is now checked.  If a directory
  is writable by the invoking user, symbolic links will not be
  followed.  If the parent directory of the file to be edited is
  writable, sudoedit will refuse to edit it.
  Bug #707.
  * The netgroup_tuple Defaults option has been added to enable matching
  of the entire netgroup tuple, not just the host or user portion.
  Bug #717.
  * When matching commands based on the SHA2 digest, sudo will now
  use fexecve(2) to execute the command if it is available.  This
  fixes a time of check versus time of use race condition when the
  directory holding the command is writable by the invoking user.
  * On AIX systems, sudo now caches the auth registry string along
  with password and group information.  This fixes a potential
  problem when a user or group of the same name exists in multiple
  auth registries.  For example, local and LDAP.
  * Fixed a crash in the SSSD backend when the invoking user is not
  found.  Bug #732.
  * Added the --enable-asan configure flag to enable address sanitizer
  support.  A few minor memory leaks have been plugged to quiet
  the ASAN leak detector.
  * The value of _PATH_SUDO_CONF may once again be overridden via
  the Makefile.  Bug #735.
  * The sudoers2ldif script now handles multiple roles with same name.
  * Fixed a compilation error on systems that have the posix_spawn()
  and posix_spawnp() functions but an unusable spawn.h header.
  Bug #730.
  * Fixed support for negating character classes in sudo's version
  of the fnmatch() function.
  * Fixed a bug in the LDAP and SSSD backends that could allow an
  unauthorized user to list another user's privileges.  Bug #738.
  * The PAM conversation function now works around an ambiguity in the
  PAM spec with respect to multiple messages.  Bug #726.</changelog>
<changelog author="mpluskal@suse.com" date="1458388800">- Add gpg signature
- Use valid category for tests</changelog>
<changelog author="kstreitova@suse.com" date="1461931200">- add sudo-1.8.16-pam_groups.patch to do group setup in
  policy_init_session() before calling out to the plugin. This makes
  it possible for the pam_group module to change the group in
  pam_setcred() [fate#318850]</changelog>
<changelog author="kstreitova@suse.com" date="1463659200">- add "BuildRequires: cyrus-sasl-devel" to enable SASL
  authentication [bnc#979531]</changelog>
<changelog author="egeorget@openmailbox.org" date="1464004800">- Changing password promp to make use of sudo localized prompts.</changelog>
<changelog author="michael@stroeder.com" date="1466337600">- removed obsolete patch sudo-1.8.16-pam_groups.patch
- update to 1.8.17:
  * On AIX, if /etc/security/login.cfg has auth_type set to PAM_AUTH
  but pam_start(3) fails, fall back to AIX authentication.
  Bug #740.
  * Sudo now takes all sudoers sources into account when determining
  whether or not "sudo -l" or "sudo -b" should prompt for a password.
  In other words, if both file and ldap sudoers sources are in
  specified in /etc/nsswitch.conf, "sudo -v" will now require that
  all entries in both sources be have NOPASSWD (file) or !authenticate
  (ldap) in the entries.
  * Sudo now ignores SIGPIPE until the command is executed.  Previously,
  SIGPIPE was only ignored in a few select places.  Bug #739.
  * Fixed a bug introduced in sudo 1.8.14 where (non-syslog) log
  file entries were missing the newline when loglinelen is set to
  a non-positive number.  Bug #742.
  * Unix groups are now set before the plugin session intialization
  code is run.  This makes it possible to use dynamic groups with
  the Linux-PAM pam_group module.
  * Fixed a bug where a debugging statement could dereference a NULL
  pointer when looking up a group that doesn't exist.  Bug #743.
  * Sudo has been run through the Coverity code scanner.  A number of
  minor bugs have been fixed as a result.  None were security issues.
  * SELinux support, which was broken in 1.8.16, has been repaired.
  * Fixed a bug when logging I/O where all output buffers might not
  get flushed at exit.
  * Forward slashes are no longer escaped in the JSON output of
  "visudo -x".  This was never required by the standard and not
  escaping them improves readability of the output.
  * Sudo no longer treats PAM_SESSION_ERR as a fatal error when
  opening the PAM session.  Other errors from pam_open_session()
  are still treated as fatal.  This avoids the "policy plugin
  failed session initialization" error message seen on some systems.
  * Korean translation for sudo and sudoers from translationproject.org.
  * Fixed a bug on AIX where the stack size hard resource limit was
  being set to 2GB instead of 4GB on 64-bit systems.
  * The SSSD backend now properly supports "sudo -U otheruser -l".
  * The SSSD backend now uses the value of "ipa_hostname"
  from sssd.conf, if specified, when matching the host name.
  * Fixed a hang on some systems when the command is being run in
  a pty and it failed to execute.
  * When performing a wildcard match in sudoers, check for an exact
  string match if the user command was fully-qualified (or resolved
  via the PATH).  This fixes an issue executing scripts on Linux
  when there are multiple wildcard matches with the same base name.
  Bug #746.</changelog>
<changelog author="michael@stroeder.com" date="1466596800">- update to 1.8.17p1:
  * Fixed a bug introduced in 1.8.17 where the user's groups were
    not set on systems that don't use PAM.  Bug #749.</changelog>
<changelog author="michael@stroeder.com" date="1474372800">- update to 1.8.18
  * The sudoers locale is now set before parsing the sudoers file.
  If sudoers_locale is set in sudoers, it is applied before
  evaluating other Defaults entries.  Previously, sudoers_locale
  was used when evaluating sudoers but not during the inital parse.
  Bug #748.
  * A missing or otherwise invalid #includedir is now ignored instead
  of causing a parse error.
  * During "make install", backup files are only used on HP-UX where
  it is not possible to unlink a shared object that is in use.
  This works around a bug in ldconfig on Linux which could create
  links to the backup shared library file instead of the current
  one.
  * Fixed a bug introduced in 1.8.17 where sudoers entries with long
  commands lines could be truncated, preventing a match.  Bug #752.
  * The fqdn, runas_default and sudoers_locale Defaults settings are
  now applied before any other Defaults settings since they can
  change how other Defaults settings are parsed.
  * On systems without the O_NOFOLLOW open(2) flag, when the NOFOLLOW
  flag is set, sudoedit now checks whether the file is a symbolic link
  before opening it as well as after the open.  Bug #753.
  * Sudo will now only resolve a user's group IDs to group names
  when sudoers includes group-based permissions.  Group lookups
  can be expensive on some systems where the group database is
  not local.
  * If the file system holding the sudo log file is full, allow
  the command to run unless the new ignore_logfile_errors Defaults
  option is disabled.  Bug #751.
  * The ignore_audit_errors and ignore_iolog_errors Defaults options
  have been added to control sudo's behavior when it is unable to
  write to the audit and I/O logs.
  * Fixed a bug introduced in 1.8.17 where the SIGPIPE signal handler
  was not being restored when sudo directly executes the command.
  * Fixed a bug where "sudo -l command" would indicate that a command
  was runnable even when denied by sudoers when using the LDAP or
  SSSD backends.
  * The match_group_by_gid Defaults option has been added to allow
  sites where group name resolution is slow and where sudoers only
  contains a small number of groups to match groups by group ID
  instead of by group name.
  * Fixed a bug on Linux where a 32-bit sudo binary could fail with
  an "unable to allocate memory" error when run on a 64-bit system.
  Bug #755
  * When parsing ldap.conf, sudo will now only treat a '#' character
  as the start of a comment when it is at the beginning of the
  line.
  * Fixed a potential crash when auditing is enabled and the audit
  function fails with an error.  Bug #756
  * Norwegian Nynorsk translation for sudo from translationproject.org.
  * Fixed a typo that broke short host name matching when the fqdn
  flag is enabled in sudoers.  Bug #757
  * Negated sudoHost attributes are now supported by the LDAP and
  SSSD backends.
  * Fixed matching entries in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.
  * Fixed "sudo -l" output in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.</changelog>
<changelog author="michael@stroeder.com" date="1477656000">- update to 1.8.18p1 with these major changes:
  * When sudo_noexec.so is used, the WRDE_NOCMD flag is now added
  if the wordexp() function is called.  This prevents commands
  from being run via wordexp() without disabling it entirely.
  * On Linux systems, sudo_noexec.so now uses a seccomp filter to
  disable execute access if the kernel supports seccomp.  This is
  more robust than the traditional method of using stub functions
  that return an error.</changelog>

</package>

<package pkgid="9281d8833f64742b9ee26e7feb94c3184e771b49e830d2ae6b9a5e37d18e08f8" name="sudo-debugsource" arch="x86_64">
    <version epoch="0" ver="1.8.18p1" rel="127.1"/>

<changelog author="vcizek@suse.com" date="1400155200">- update to 1.8.10p3
  * Fixed expansion of the %p escape in the prompt for "sudo -l"
    when rootpw, runaspw or targetpw is set. Bug #639.
  * Fixed matching of uids and gids which was broken in version 1.8.9
  * PAM credential initialization has been re-enabled. It was
    unintentionally disabled by default in version 1.8.8. The way
    credentials are initialized has also been fixed. Bug #642.
  * Fixed a descriptor leak on Linux when determing boot time. Sudo
    normally closes extra descriptors before running a command so
    the impact is limited. Bug #645.
  * Fixed flushing of the last buffer of data when I/O logging is
    enabled. This bug, introduced in version 1.8.9, could cause
    incomplete command output on some systems. Bug #646.
  * Fixed a hang introduced in sudo 1.8.10 when timestamp_timeout
    is set to zero. Bug #638.
- don't install test LICENSE with executable perms</changelog>
<changelog author="tabraham@suse.com" date="1413028800">- refresh sudo-sudoers.patch
- update to 1.8.11p1
  * Fixed a compilation problem on some systems when the
  - -disable-shared-libutil configure option was specified.
  * The user can no longer interrupt the sleep after an incorrect password on
    PAM systems using pam_unix. Bug #666.
  * Fixed a compilation problem on Linux systems that do not use PAM. Bug #667.
  * "make install" will now work with the stock GNU autotools install-sh
    script. Bug #669.
  * Fixed a crash with "sudo -i" when the current working directory does not
    exist. Bug #670.
  * Fixed a potential crash in the debug subsystem when logging a message
    larger that 1024 bytes.
  * Fixed a "make check" failure for ttyname when stdin is closed and stdout
    and stderr are redirected to a different tty. Bug #643.
  * Added BASH_FUNC_* to environment blacklist to match newer-style bash
    functions.
- changes from 1.8.11
  * The sudoers plugin no longer uses setjmp/longjmp to recover from fatal
    errors. All errors are now propagated to the caller via return codes.
  * When running a command in the background, sudo will now forward SIGINFO to
    the command (if supported).
  * Sudo will now use the system versions of the sha2 functions from libc or
    libmd if available.
  * Visudo now works correctly on GNU Hurd. Bug #647.
  * Fixed suspend and resume of curses programs on some system when the
    command is not being run in a pseudo-terminal. Bug #649.
  * Fixed a crash with LDAP-based sudoers on some systems when Kerberos was
    enabled.
  * Sudo now includes optional Solaris audit support.
  * Catalan translation for sudoers from translationproject.org.
  * Norwegian Bokmaal translation for sudo from translationproject.org.
  * Greek translation for sudoers from translationproject.org
  * The sudo source tree has been reorganized to more closely resemble that of
    other gettext-enabled packages.
  * Sudo and its associated programs now link against a shared version of
    libsudo_util. The --disable-shared-libutil configure option may be used to
    force static linking if the --enable-static-sudoers option is also
    specified.
  * The passwords in ldap.conf and ldap.secret may now be encoded in base64.
  * Audit updates. SELinux role changes are now audited. For sudoedit, we now
    audit the actual editor being run, instead of just the sudoedit command.
  * Fixed bugs in the man page post-processing that could cause portions of the
    manuals to be removed.
  * Fixed a crash in the system_group plugin. Bug #653.
  * Fixed sudoedit on platforms without a native version of the getprogname()
    function. Bug #654.
  * Fixed compilation problems with some pre-C99 compilers.
  * Fixed sudo's -C option which was broken in version 1.8.9.
  * It is now possible to match an environment variable's value as well as its
    name using env_keep and env_check. This can be used to preserve bash
    functions which would otherwise be removed from the environment.
  * New files created via sudoedit as a non-root user now have the proper
    group id. Bug #656.
  * Sudoedit now works correctly in conjunction with sudo's SELinux RBAC
    support. Temporary files are now created with the proper security context.
  * The sudo I/O logging plugin API has been updated. If a logging function
    returns an error, the command will be terminated and all of the plugin's
    logging functions will be disabled. If a logging function rejects the
    command's output it will no longer be displayed to the user's terminal.
  * Fixed a compilation error on systems that lack openpty(), _getpty() and
    grantpt(). Bug #660.
  * Fixed a hang when a sudoers source is listed more than once in a single
    sudoers nsswitch.conf entry.
  * On AIX, shell scripts without a #! magic number are now passed to
    /usr/bin/sh, not /usr/bin/bsh. This is consistent with what the execvp()
    function on AIX does and matches historic sudo behavior. Bug #661.
  * Fixed a cross-compilation problem building mksiglist and mksigname.
    Bug #662.</changelog>
<changelog author="fstrba@suse.com" date="1415275200">- update to 1.8.11p2
  * Fixed a bug where dynamic shared objects loaded from a plugin
    could use the hooked version of getenv() but not the hooked
    versions of putenv(), setenv() or unsetenv().  This can cause
    problems for PAM modules that use those functions.</changelog>
<changelog author="vcizek@suse.com" date="1418817600">- correctly parse /proc/stat for boottime (bnc#899252)
  * added sudo-parse_boottime_properly.patch from Debian</changelog>
<changelog author="vcizek@suse.com" date="1424606400">- update to 1.8.12 (fixes bnc#918953)
- changelog:
  * The embedded copy of zlib has been upgraded to version 1.2.8 and
    is now installed as a shared library where supported.
  * Debug settings for the sudo front end and sudoers plugin are now configured separately.
  * Multiple sudo.conf Debug entries may now be specified per program (or plugin).
  * The plugin API has been extended such that the path to the plugin
    that was loaded is now included in the settings array. This path
    can be used to register with the debugging subsystem. The debug_flags
    setting is now prefixed with a file name and may be specified multiple
    times if there is more than one matching Debug setting in sudo.conf.
  * The sudoers regression tests now run with the locale set to C since
    some of the tests compare output that includes locale-specific messages. Bug #672.
  * Fixed a bug where sudo would not run commands on Linux when compiled
    with audit support if audit is disabled. Bug #671.
  * The default password prompt now includes a trailing space after
    "Password:" for consistency with su(1) on most systems. Bug #663.
  * Visudo will now use the optional sudoers_file, sudoers_mode,
    sudoers_uid and sudoers_gid arguments if specified on the sudoers.so Plugin line in the sudo.conf file.
  * Fixed a problem introduced in sudo 1.8.8 that prevented the full
    host name from being used when the fqdn sudoers option is used. Bug #678.
  * Sudo now installs a handler for SIGCHLD signal handler immediately
    before stating the process that will execute the command (or start the monitor).
  * Removed a limit on the length of command line arguments expanded by
    a wild card using sudo's version of the fnmatch() function.
    This limit was introduced when sudo's version of fnmatch() was replaced in sudo 1.8.4.
  * LDAP-based sudoers can now query an LDAP server for a user's netgroups
    directly. This is often much faster than fetching every sudoRole object
    containing a sudoUser that begins with a `+' prefix and checking
    whether the user is a member of any of the returned netgroups.
  * The mail_always sudoers option no longer sends mail for
    sudo -l or sudo -v unless the user is unable to authenticate themselves.
  * Fixed a crash when sudo is run with an empty argument vector.
  * Fixed two potential crashes when sudo is run with very low resource limits.
  * The TZ environment variable is now checked for safety instead of simply
    being copied to the environment of the command. This fixes a potential security issue.</changelog>
<changelog author="vcizek@suse.com" date="1431604800">- update to 1.8.13
  * The examples directory is now a subdirectory of the doc dir to
  conform to Debian guidelines.  Bug #682.
  * Fixed a compilation error for siglist.c and signame.c on some
  systems.  Bug #686
  * Weak symbols are now used for sudo_warn_gettext() and
  sudo_warn_strerror() in libsudo_util to avoid link errors when
  - Wl,--no-undefined is used in LDFLAGS.  The --disable-weak-symbols
  configure option can be used to disable the user of weak symbols.
  * Fixed a bug in sudo's mkstemps() replacement function that
  prevented the file extension from being preserved in sudoedit.
  * A new mail_all_cmnds sudoers flag will send mail when a user runs
  a command (or tries to). The behavior of the mail_always flag has
  been restored to always send mail when sudo is run.
  * New "MAIL" and "NOMAIL" command tags have been added to toggle
  mail sending behavior on a per-command (or Cmnd_Alias) basis.
  * Fixed matching of empty passwords when sudo is configured to
  use passwd (or shadow) file authentication on systems where the
  crypt() function returns NULL for invalid salts.
  * The "all" setting for listpw and verifypw now works correctly
  with LDAP and sssd sudoers.
  * The sudo timestamp directory is now created at boot time on
  platforms that use systemd.
  * Sudo will now restore the value of the SIGPIPE handler before
  executing the command.
  * Sudo now uses "struct timespec" instead of "struct timeval" for
  time keeping when possible.  If supported, sudoedit and visudo
  now use nanosecond granularity time stamps.
  * Fixed a symbol name collision with systems that have their own
  SHA2 implementation.  This fixes a problem where PAM could use
  the wrong SHA2 implementation on Solaris 10 systems configured
  to use SHA512 for passwords.
  * The editor invoked by sudoedit once again uses an unmodified
  copy of the user's environment as per the documentation.  This
  was inadvertantly changed in sudo 1.8.0.  Bug #688.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1437566400">- BuildRequires zlib-devel, support zlib compressed I/O logs.</changelog>
<changelog author="kstreitova@suse.com" date="1437652800">- update to 1.8.14p3:
  * changes in 1.8.14p3
  * Fixed a bug introduced in sudo 1.8.14p2 that prevented sudo
    from working when no tty was present. Bug #706.
  * Fixed tty detection on newer AIX systems where dev_t is 64-bit.
  * changes in 1.8.14p2
  * Fixed a bug introduced in sudo 1.8.14 that prevented the
    lecture file from being created. Bug #704.
  * changes in 1.8.14p1
  * Fixed a bug introduced in sudo 1.8.14 that prevented the sssd
    backend from working. Bug #703.
  * changes in 1.8.14
  * Log messages on Mac OS X now respect sudoers_locale when sudo
    is build with NLS support.
  * The sudo manual pages now pass mandoc -Tlint with no warnings.
  * Fixed a compilation problem on systems with the sig2str()
    function that do not define SIG2STR_MAX in signal.h.
  * Worked around a compiler bug that resulted in unexpected
    behavior when returning an int from a function declared to
    return bool without an explicit cast.
  * Worked around a bug in Mac OS X 10.10 BSD auditing where the
    au_preselect() fails for AUE_sudo events but succeeds for
    AUE_DARWIN_sudo.
  * Fixed a hang on Linux systems with glibc when sudo is linked
    with jemalloc.
  * When the user runs a command as a user ID that is not present
    in the password database via the -u flag, the command is now
    run with the group ID of the invoking user instead of group ID 0.
  * Fixed a compilation problem on systems that don't pull in
    definitions of uid_t and gid_t without sys/types.h or unistd.h.
  * Fixed a compilation problem on newer AIX systems which use a
    struct st_timespec for time stamps in struct stat that differs
    from struct timespec. Bug #702.
  * The example directory is now configurable via --with-exampledir
    and defaults to DATAROOTDIR/examples/sudo on BSD systems.
  * The /usr/lib/tmpfiles.d/sudo.conf file is now installed as part
    of "make install" when systemd is in use.
  * Fixed a linker problem on some systems with libintl. Bug #690.
  * Fixed compilation with compilers that don't support __func__ or
    __FUNCTION__.
  * Sudo no longer needs to uses weak symbols to support localization
    in the warning functions. A registration function is used instead.
  * Fixed a setresuid() failure in sudoers on Linux kernels where
    uid changes take the nproc resource limit into account.
  * Fixed LDAP netgroup queries on AIX.
  * Sudo will now display the custom prompt on Linux systems with
    PAM even if the "Password: " prompt is not localized by the
    PAM module. Bug #701.
  * Double-quoted values in an LDAP sudoOption are now supported
    for consistency with file-based sudoers.
  * Fixed a bug that prevented the btime entry in /proc/stat from
    being parsed on Linux.
  * update sudo-sudoers.patch
  * remove sudo-parse_boottime_properly.patch (it's not longer needed)</changelog>
<changelog author="dimstar@opensuse.org" date="1439380800">- Pass --enable-tmpfiles.d=%{_tmpfilesdir} to configure: let's be
  specific about this feature, and not randomly rely on the
  presence/absence of /usr/lib/tmpfiles.d/systemd.conf.
- Add systemd-rpm-macros BuildRequires to ensure %_tmpfilesdir is
  defined.
- Add relevant %tmpfiles_create call to post scriptlet.</changelog>
<changelog author="jengelh@inai.de" date="1439380801">- No need to buildrequire an sssd plugin (libsss_sudo)</changelog>
<changelog author="kstreitova@suse.com" date="1446811200">- update to 1.8.15:
  * Fixed a bug that prevented sudo from building outside the source
    tree on some platforms. Bug #708.
  * Fixed the location of the sssd library in the RHEL/Centos packages.
    Bug #710.
  * Fixed a build problem on systems that don't implicitly include
    sys/types.h from other header files. Bug #711.
  * Fixed a problem on Linux using containers where sudo would ignore
    signals sent by a process in a different container.
  * Sudo now refuses to run a command if the PAM session module returns
    an error.
  * When editing files with sudoedit, symbolic links will no longer be
    followed by default. The old behavior can be restored by enabling
    the sudoedit_follow option in sudoers or on a per-command basis with
    the FOLLOW and NOFOLLOW tags. Bug #707.
  * Fixed a bug introduced in version 1.8.14 that caused the last valid
    editor in the sudoers "editor" list to be used by visudo and sudoedit
    instead of the first. Bug #714.
  * Fixed a bug in visudo that prevented the addition of a final newline
    to edited files without one.
  * Fixed a bug decoding certain base64 digests in sudoers when the
    intermediate format included a '=' character.
  * Individual records are now locked in the time stamp file instead of
    the entire file. This allows sudo to avoid prompting for a password
    multiple times on the same terminal when used in a pipeline.
    In other words, sudo cat foo | sudo grep bar now only prompts for
    the password once. Previously, both sudo processes would prompt for
    a password, often making it impossible to enter. Bug #705.
  * Fixed a bug where sudo would fail to run commands as a non-root user
    on systems that lack both setresuid() and setreuid(). Bug #713.
  * Fixed a bug introduced in sudo 1.8.14 that prevented visudo from
    re-editing the correct file when a syntax error was detected.
  * Fixed a bug where sudo would not relay a SIGHUP signal to the command
    when the terminal is closed and the command is not run in its own
    pseudo-tty. Bug #719.
  * If some, but not all, of the LOGNAME, USER or USERNAME environment
    variables have been preserved from the invoking user's environment,
    sudo will now use the preserved value to set the remaining variables
    instead of using the runas user. This ensures that if, for example,
    only LOGNAME is present in the env_keep list, that sudo will not set
    USER and USERNAME to the runas user.
  * When the command sudo is running dies due to a signal, sudo will now
    send itself that same signal with the default signal handler installed
    instead of exiting. The bash shell appears to ignore some signals,
    e.g. SIGINT, unless the command being run is killed by that signal.
    This makes the behavior of commands run under sudo the same as
    without sudo when bash is the shell. Bug #722.
  * Slovak translation for sudo from translationproject.org.
  * Hungarian and Slovak translations for sudoers from
    translationproject.org.
  * Previously, when env_reset was enabled (the default) and the
  - s option was not used, the SHELL environment variable was set to the
    shell of the invoking user. Now, when env_reset is enabled and the
  - s option is not used, SHELL is set based on the target user.
  * Fixed challenge/response style BSD authentication.
  * Added the sudoedit_checkdir Defaults option to prevent sudoedit from
    editing files located in a directory that is writable by the
    invoking user.
  * Added the always_query_group_plugin Defaults option to control
    whether groups not found in the system group database are passed to
    the group plugin. Previously, unknown system groups were always
    passed to the group plugin.
  * When creating a new file, sudoedit will now check that the file's
    parent directory exists before running the editor.
  * Fixed the compiler stack protector test in configure for compilers
    that support -fstack-protector but don't actually have the ssp
    library available.
- use spec-cleaner</changelog>
<changelog author="michael@stroeder.com" date="1458216000">- update to 1.8.16:
  * Fixed a compilation error on Solaris 10 with Stun Studio 12.
  Bug #727.
  * When preserving variables from the invoking user's environment, if
  there are duplicates sudo now only keeps the first instance.
  * Fixed a bug that could cause warning mail to be sent in list
  mode (sudo -l) for users without sudo privileges when the
  LDAP and sssd backends are used.
  * Fixed a bug that prevented the "mail_no_user" option from working
  properly with the LDAP backend.
  * In the LDAP and sssd backends, white space is now ignored between
  an operator (!, +, +=, -=) when parsing a sudoOption.
  * It is now possible to disable Path settings in sudo.conf
  by omitting the path name.
  * The sudoedit_checkdir Defaults option is now enabled by default
  and has been extended.  When editing files with sudoedit, each
  directory in the path to be edited is now checked.  If a directory
  is writable by the invoking user, symbolic links will not be
  followed.  If the parent directory of the file to be edited is
  writable, sudoedit will refuse to edit it.
  Bug #707.
  * The netgroup_tuple Defaults option has been added to enable matching
  of the entire netgroup tuple, not just the host or user portion.
  Bug #717.
  * When matching commands based on the SHA2 digest, sudo will now
  use fexecve(2) to execute the command if it is available.  This
  fixes a time of check versus time of use race condition when the
  directory holding the command is writable by the invoking user.
  * On AIX systems, sudo now caches the auth registry string along
  with password and group information.  This fixes a potential
  problem when a user or group of the same name exists in multiple
  auth registries.  For example, local and LDAP.
  * Fixed a crash in the SSSD backend when the invoking user is not
  found.  Bug #732.
  * Added the --enable-asan configure flag to enable address sanitizer
  support.  A few minor memory leaks have been plugged to quiet
  the ASAN leak detector.
  * The value of _PATH_SUDO_CONF may once again be overridden via
  the Makefile.  Bug #735.
  * The sudoers2ldif script now handles multiple roles with same name.
  * Fixed a compilation error on systems that have the posix_spawn()
  and posix_spawnp() functions but an unusable spawn.h header.
  Bug #730.
  * Fixed support for negating character classes in sudo's version
  of the fnmatch() function.
  * Fixed a bug in the LDAP and SSSD backends that could allow an
  unauthorized user to list another user's privileges.  Bug #738.
  * The PAM conversation function now works around an ambiguity in the
  PAM spec with respect to multiple messages.  Bug #726.</changelog>
<changelog author="mpluskal@suse.com" date="1458388800">- Add gpg signature
- Use valid category for tests</changelog>
<changelog author="kstreitova@suse.com" date="1461931200">- add sudo-1.8.16-pam_groups.patch to do group setup in
  policy_init_session() before calling out to the plugin. This makes
  it possible for the pam_group module to change the group in
  pam_setcred() [fate#318850]</changelog>
<changelog author="kstreitova@suse.com" date="1463659200">- add "BuildRequires: cyrus-sasl-devel" to enable SASL
  authentication [bnc#979531]</changelog>
<changelog author="egeorget@openmailbox.org" date="1464004800">- Changing password promp to make use of sudo localized prompts.</changelog>
<changelog author="michael@stroeder.com" date="1466337600">- removed obsolete patch sudo-1.8.16-pam_groups.patch
- update to 1.8.17:
  * On AIX, if /etc/security/login.cfg has auth_type set to PAM_AUTH
  but pam_start(3) fails, fall back to AIX authentication.
  Bug #740.
  * Sudo now takes all sudoers sources into account when determining
  whether or not "sudo -l" or "sudo -b" should prompt for a password.
  In other words, if both file and ldap sudoers sources are in
  specified in /etc/nsswitch.conf, "sudo -v" will now require that
  all entries in both sources be have NOPASSWD (file) or !authenticate
  (ldap) in the entries.
  * Sudo now ignores SIGPIPE until the command is executed.  Previously,
  SIGPIPE was only ignored in a few select places.  Bug #739.
  * Fixed a bug introduced in sudo 1.8.14 where (non-syslog) log
  file entries were missing the newline when loglinelen is set to
  a non-positive number.  Bug #742.
  * Unix groups are now set before the plugin session intialization
  code is run.  This makes it possible to use dynamic groups with
  the Linux-PAM pam_group module.
  * Fixed a bug where a debugging statement could dereference a NULL
  pointer when looking up a group that doesn't exist.  Bug #743.
  * Sudo has been run through the Coverity code scanner.  A number of
  minor bugs have been fixed as a result.  None were security issues.
  * SELinux support, which was broken in 1.8.16, has been repaired.
  * Fixed a bug when logging I/O where all output buffers might not
  get flushed at exit.
  * Forward slashes are no longer escaped in the JSON output of
  "visudo -x".  This was never required by the standard and not
  escaping them improves readability of the output.
  * Sudo no longer treats PAM_SESSION_ERR as a fatal error when
  opening the PAM session.  Other errors from pam_open_session()
  are still treated as fatal.  This avoids the "policy plugin
  failed session initialization" error message seen on some systems.
  * Korean translation for sudo and sudoers from translationproject.org.
  * Fixed a bug on AIX where the stack size hard resource limit was
  being set to 2GB instead of 4GB on 64-bit systems.
  * The SSSD backend now properly supports "sudo -U otheruser -l".
  * The SSSD backend now uses the value of "ipa_hostname"
  from sssd.conf, if specified, when matching the host name.
  * Fixed a hang on some systems when the command is being run in
  a pty and it failed to execute.
  * When performing a wildcard match in sudoers, check for an exact
  string match if the user command was fully-qualified (or resolved
  via the PATH).  This fixes an issue executing scripts on Linux
  when there are multiple wildcard matches with the same base name.
  Bug #746.</changelog>
<changelog author="michael@stroeder.com" date="1466596800">- update to 1.8.17p1:
  * Fixed a bug introduced in 1.8.17 where the user's groups were
    not set on systems that don't use PAM.  Bug #749.</changelog>
<changelog author="michael@stroeder.com" date="1474372800">- update to 1.8.18
  * The sudoers locale is now set before parsing the sudoers file.
  If sudoers_locale is set in sudoers, it is applied before
  evaluating other Defaults entries.  Previously, sudoers_locale
  was used when evaluating sudoers but not during the inital parse.
  Bug #748.
  * A missing or otherwise invalid #includedir is now ignored instead
  of causing a parse error.
  * During "make install", backup files are only used on HP-UX where
  it is not possible to unlink a shared object that is in use.
  This works around a bug in ldconfig on Linux which could create
  links to the backup shared library file instead of the current
  one.
  * Fixed a bug introduced in 1.8.17 where sudoers entries with long
  commands lines could be truncated, preventing a match.  Bug #752.
  * The fqdn, runas_default and sudoers_locale Defaults settings are
  now applied before any other Defaults settings since they can
  change how other Defaults settings are parsed.
  * On systems without the O_NOFOLLOW open(2) flag, when the NOFOLLOW
  flag is set, sudoedit now checks whether the file is a symbolic link
  before opening it as well as after the open.  Bug #753.
  * Sudo will now only resolve a user's group IDs to group names
  when sudoers includes group-based permissions.  Group lookups
  can be expensive on some systems where the group database is
  not local.
  * If the file system holding the sudo log file is full, allow
  the command to run unless the new ignore_logfile_errors Defaults
  option is disabled.  Bug #751.
  * The ignore_audit_errors and ignore_iolog_errors Defaults options
  have been added to control sudo's behavior when it is unable to
  write to the audit and I/O logs.
  * Fixed a bug introduced in 1.8.17 where the SIGPIPE signal handler
  was not being restored when sudo directly executes the command.
  * Fixed a bug where "sudo -l command" would indicate that a command
  was runnable even when denied by sudoers when using the LDAP or
  SSSD backends.
  * The match_group_by_gid Defaults option has been added to allow
  sites where group name resolution is slow and where sudoers only
  contains a small number of groups to match groups by group ID
  instead of by group name.
  * Fixed a bug on Linux where a 32-bit sudo binary could fail with
  an "unable to allocate memory" error when run on a 64-bit system.
  Bug #755
  * When parsing ldap.conf, sudo will now only treat a '#' character
  as the start of a comment when it is at the beginning of the
  line.
  * Fixed a potential crash when auditing is enabled and the audit
  function fails with an error.  Bug #756
  * Norwegian Nynorsk translation for sudo from translationproject.org.
  * Fixed a typo that broke short host name matching when the fqdn
  flag is enabled in sudoers.  Bug #757
  * Negated sudoHost attributes are now supported by the LDAP and
  SSSD backends.
  * Fixed matching entries in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.
  * Fixed "sudo -l" output in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.</changelog>
<changelog author="michael@stroeder.com" date="1477656000">- update to 1.8.18p1 with these major changes:
  * When sudo_noexec.so is used, the WRDE_NOCMD flag is now added
  if the wordexp() function is called.  This prevents commands
  from being run via wordexp() without disabling it entirely.
  * On Linux systems, sudo_noexec.so now uses a seccomp filter to
  disable execute access if the kernel supports seccomp.  This is
  more robust than the traditional method of using stub functions
  that return an error.</changelog>

</package>

<package pkgid="1a7052219bac84afc1c2df00328cac8d627b62ccd0a33ecb157550331a18a2eb" name="sudo-devel" arch="x86_64">
    <version epoch="0" ver="1.8.18p1" rel="127.1"/>

<changelog author="vcizek@suse.com" date="1400155200">- update to 1.8.10p3
  * Fixed expansion of the %p escape in the prompt for "sudo -l"
    when rootpw, runaspw or targetpw is set. Bug #639.
  * Fixed matching of uids and gids which was broken in version 1.8.9
  * PAM credential initialization has been re-enabled. It was
    unintentionally disabled by default in version 1.8.8. The way
    credentials are initialized has also been fixed. Bug #642.
  * Fixed a descriptor leak on Linux when determing boot time. Sudo
    normally closes extra descriptors before running a command so
    the impact is limited. Bug #645.
  * Fixed flushing of the last buffer of data when I/O logging is
    enabled. This bug, introduced in version 1.8.9, could cause
    incomplete command output on some systems. Bug #646.
  * Fixed a hang introduced in sudo 1.8.10 when timestamp_timeout
    is set to zero. Bug #638.
- don't install test LICENSE with executable perms</changelog>
<changelog author="tabraham@suse.com" date="1413028800">- refresh sudo-sudoers.patch
- update to 1.8.11p1
  * Fixed a compilation problem on some systems when the
  - -disable-shared-libutil configure option was specified.
  * The user can no longer interrupt the sleep after an incorrect password on
    PAM systems using pam_unix. Bug #666.
  * Fixed a compilation problem on Linux systems that do not use PAM. Bug #667.
  * "make install" will now work with the stock GNU autotools install-sh
    script. Bug #669.
  * Fixed a crash with "sudo -i" when the current working directory does not
    exist. Bug #670.
  * Fixed a potential crash in the debug subsystem when logging a message
    larger that 1024 bytes.
  * Fixed a "make check" failure for ttyname when stdin is closed and stdout
    and stderr are redirected to a different tty. Bug #643.
  * Added BASH_FUNC_* to environment blacklist to match newer-style bash
    functions.
- changes from 1.8.11
  * The sudoers plugin no longer uses setjmp/longjmp to recover from fatal
    errors. All errors are now propagated to the caller via return codes.
  * When running a command in the background, sudo will now forward SIGINFO to
    the command (if supported).
  * Sudo will now use the system versions of the sha2 functions from libc or
    libmd if available.
  * Visudo now works correctly on GNU Hurd. Bug #647.
  * Fixed suspend and resume of curses programs on some system when the
    command is not being run in a pseudo-terminal. Bug #649.
  * Fixed a crash with LDAP-based sudoers on some systems when Kerberos was
    enabled.
  * Sudo now includes optional Solaris audit support.
  * Catalan translation for sudoers from translationproject.org.
  * Norwegian Bokmaal translation for sudo from translationproject.org.
  * Greek translation for sudoers from translationproject.org
  * The sudo source tree has been reorganized to more closely resemble that of
    other gettext-enabled packages.
  * Sudo and its associated programs now link against a shared version of
    libsudo_util. The --disable-shared-libutil configure option may be used to
    force static linking if the --enable-static-sudoers option is also
    specified.
  * The passwords in ldap.conf and ldap.secret may now be encoded in base64.
  * Audit updates. SELinux role changes are now audited. For sudoedit, we now
    audit the actual editor being run, instead of just the sudoedit command.
  * Fixed bugs in the man page post-processing that could cause portions of the
    manuals to be removed.
  * Fixed a crash in the system_group plugin. Bug #653.
  * Fixed sudoedit on platforms without a native version of the getprogname()
    function. Bug #654.
  * Fixed compilation problems with some pre-C99 compilers.
  * Fixed sudo's -C option which was broken in version 1.8.9.
  * It is now possible to match an environment variable's value as well as its
    name using env_keep and env_check. This can be used to preserve bash
    functions which would otherwise be removed from the environment.
  * New files created via sudoedit as a non-root user now have the proper
    group id. Bug #656.
  * Sudoedit now works correctly in conjunction with sudo's SELinux RBAC
    support. Temporary files are now created with the proper security context.
  * The sudo I/O logging plugin API has been updated. If a logging function
    returns an error, the command will be terminated and all of the plugin's
    logging functions will be disabled. If a logging function rejects the
    command's output it will no longer be displayed to the user's terminal.
  * Fixed a compilation error on systems that lack openpty(), _getpty() and
    grantpt(). Bug #660.
  * Fixed a hang when a sudoers source is listed more than once in a single
    sudoers nsswitch.conf entry.
  * On AIX, shell scripts without a #! magic number are now passed to
    /usr/bin/sh, not /usr/bin/bsh. This is consistent with what the execvp()
    function on AIX does and matches historic sudo behavior. Bug #661.
  * Fixed a cross-compilation problem building mksiglist and mksigname.
    Bug #662.</changelog>
<changelog author="fstrba@suse.com" date="1415275200">- update to 1.8.11p2
  * Fixed a bug where dynamic shared objects loaded from a plugin
    could use the hooked version of getenv() but not the hooked
    versions of putenv(), setenv() or unsetenv().  This can cause
    problems for PAM modules that use those functions.</changelog>
<changelog author="vcizek@suse.com" date="1418817600">- correctly parse /proc/stat for boottime (bnc#899252)
  * added sudo-parse_boottime_properly.patch from Debian</changelog>
<changelog author="vcizek@suse.com" date="1424606400">- update to 1.8.12 (fixes bnc#918953)
- changelog:
  * The embedded copy of zlib has been upgraded to version 1.2.8 and
    is now installed as a shared library where supported.
  * Debug settings for the sudo front end and sudoers plugin are now configured separately.
  * Multiple sudo.conf Debug entries may now be specified per program (or plugin).
  * The plugin API has been extended such that the path to the plugin
    that was loaded is now included in the settings array. This path
    can be used to register with the debugging subsystem. The debug_flags
    setting is now prefixed with a file name and may be specified multiple
    times if there is more than one matching Debug setting in sudo.conf.
  * The sudoers regression tests now run with the locale set to C since
    some of the tests compare output that includes locale-specific messages. Bug #672.
  * Fixed a bug where sudo would not run commands on Linux when compiled
    with audit support if audit is disabled. Bug #671.
  * The default password prompt now includes a trailing space after
    "Password:" for consistency with su(1) on most systems. Bug #663.
  * Visudo will now use the optional sudoers_file, sudoers_mode,
    sudoers_uid and sudoers_gid arguments if specified on the sudoers.so Plugin line in the sudo.conf file.
  * Fixed a problem introduced in sudo 1.8.8 that prevented the full
    host name from being used when the fqdn sudoers option is used. Bug #678.
  * Sudo now installs a handler for SIGCHLD signal handler immediately
    before stating the process that will execute the command (or start the monitor).
  * Removed a limit on the length of command line arguments expanded by
    a wild card using sudo's version of the fnmatch() function.
    This limit was introduced when sudo's version of fnmatch() was replaced in sudo 1.8.4.
  * LDAP-based sudoers can now query an LDAP server for a user's netgroups
    directly. This is often much faster than fetching every sudoRole object
    containing a sudoUser that begins with a `+' prefix and checking
    whether the user is a member of any of the returned netgroups.
  * The mail_always sudoers option no longer sends mail for
    sudo -l or sudo -v unless the user is unable to authenticate themselves.
  * Fixed a crash when sudo is run with an empty argument vector.
  * Fixed two potential crashes when sudo is run with very low resource limits.
  * The TZ environment variable is now checked for safety instead of simply
    being copied to the environment of the command. This fixes a potential security issue.</changelog>
<changelog author="vcizek@suse.com" date="1431604800">- update to 1.8.13
  * The examples directory is now a subdirectory of the doc dir to
  conform to Debian guidelines.  Bug #682.
  * Fixed a compilation error for siglist.c and signame.c on some
  systems.  Bug #686
  * Weak symbols are now used for sudo_warn_gettext() and
  sudo_warn_strerror() in libsudo_util to avoid link errors when
  - Wl,--no-undefined is used in LDFLAGS.  The --disable-weak-symbols
  configure option can be used to disable the user of weak symbols.
  * Fixed a bug in sudo's mkstemps() replacement function that
  prevented the file extension from being preserved in sudoedit.
  * A new mail_all_cmnds sudoers flag will send mail when a user runs
  a command (or tries to). The behavior of the mail_always flag has
  been restored to always send mail when sudo is run.
  * New "MAIL" and "NOMAIL" command tags have been added to toggle
  mail sending behavior on a per-command (or Cmnd_Alias) basis.
  * Fixed matching of empty passwords when sudo is configured to
  use passwd (or shadow) file authentication on systems where the
  crypt() function returns NULL for invalid salts.
  * The "all" setting for listpw and verifypw now works correctly
  with LDAP and sssd sudoers.
  * The sudo timestamp directory is now created at boot time on
  platforms that use systemd.
  * Sudo will now restore the value of the SIGPIPE handler before
  executing the command.
  * Sudo now uses "struct timespec" instead of "struct timeval" for
  time keeping when possible.  If supported, sudoedit and visudo
  now use nanosecond granularity time stamps.
  * Fixed a symbol name collision with systems that have their own
  SHA2 implementation.  This fixes a problem where PAM could use
  the wrong SHA2 implementation on Solaris 10 systems configured
  to use SHA512 for passwords.
  * The editor invoked by sudoedit once again uses an unmodified
  copy of the user's environment as per the documentation.  This
  was inadvertantly changed in sudo 1.8.0.  Bug #688.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1437566400">- BuildRequires zlib-devel, support zlib compressed I/O logs.</changelog>
<changelog author="kstreitova@suse.com" date="1437652800">- update to 1.8.14p3:
  * changes in 1.8.14p3
  * Fixed a bug introduced in sudo 1.8.14p2 that prevented sudo
    from working when no tty was present. Bug #706.
  * Fixed tty detection on newer AIX systems where dev_t is 64-bit.
  * changes in 1.8.14p2
  * Fixed a bug introduced in sudo 1.8.14 that prevented the
    lecture file from being created. Bug #704.
  * changes in 1.8.14p1
  * Fixed a bug introduced in sudo 1.8.14 that prevented the sssd
    backend from working. Bug #703.
  * changes in 1.8.14
  * Log messages on Mac OS X now respect sudoers_locale when sudo
    is build with NLS support.
  * The sudo manual pages now pass mandoc -Tlint with no warnings.
  * Fixed a compilation problem on systems with the sig2str()
    function that do not define SIG2STR_MAX in signal.h.
  * Worked around a compiler bug that resulted in unexpected
    behavior when returning an int from a function declared to
    return bool without an explicit cast.
  * Worked around a bug in Mac OS X 10.10 BSD auditing where the
    au_preselect() fails for AUE_sudo events but succeeds for
    AUE_DARWIN_sudo.
  * Fixed a hang on Linux systems with glibc when sudo is linked
    with jemalloc.
  * When the user runs a command as a user ID that is not present
    in the password database via the -u flag, the command is now
    run with the group ID of the invoking user instead of group ID 0.
  * Fixed a compilation problem on systems that don't pull in
    definitions of uid_t and gid_t without sys/types.h or unistd.h.
  * Fixed a compilation problem on newer AIX systems which use a
    struct st_timespec for time stamps in struct stat that differs
    from struct timespec. Bug #702.
  * The example directory is now configurable via --with-exampledir
    and defaults to DATAROOTDIR/examples/sudo on BSD systems.
  * The /usr/lib/tmpfiles.d/sudo.conf file is now installed as part
    of "make install" when systemd is in use.
  * Fixed a linker problem on some systems with libintl. Bug #690.
  * Fixed compilation with compilers that don't support __func__ or
    __FUNCTION__.
  * Sudo no longer needs to uses weak symbols to support localization
    in the warning functions. A registration function is used instead.
  * Fixed a setresuid() failure in sudoers on Linux kernels where
    uid changes take the nproc resource limit into account.
  * Fixed LDAP netgroup queries on AIX.
  * Sudo will now display the custom prompt on Linux systems with
    PAM even if the "Password: " prompt is not localized by the
    PAM module. Bug #701.
  * Double-quoted values in an LDAP sudoOption are now supported
    for consistency with file-based sudoers.
  * Fixed a bug that prevented the btime entry in /proc/stat from
    being parsed on Linux.
  * update sudo-sudoers.patch
  * remove sudo-parse_boottime_properly.patch (it's not longer needed)</changelog>
<changelog author="dimstar@opensuse.org" date="1439380800">- Pass --enable-tmpfiles.d=%{_tmpfilesdir} to configure: let's be
  specific about this feature, and not randomly rely on the
  presence/absence of /usr/lib/tmpfiles.d/systemd.conf.
- Add systemd-rpm-macros BuildRequires to ensure %_tmpfilesdir is
  defined.
- Add relevant %tmpfiles_create call to post scriptlet.</changelog>
<changelog author="jengelh@inai.de" date="1439380801">- No need to buildrequire an sssd plugin (libsss_sudo)</changelog>
<changelog author="kstreitova@suse.com" date="1446811200">- update to 1.8.15:
  * Fixed a bug that prevented sudo from building outside the source
    tree on some platforms. Bug #708.
  * Fixed the location of the sssd library in the RHEL/Centos packages.
    Bug #710.
  * Fixed a build problem on systems that don't implicitly include
    sys/types.h from other header files. Bug #711.
  * Fixed a problem on Linux using containers where sudo would ignore
    signals sent by a process in a different container.
  * Sudo now refuses to run a command if the PAM session module returns
    an error.
  * When editing files with sudoedit, symbolic links will no longer be
    followed by default. The old behavior can be restored by enabling
    the sudoedit_follow option in sudoers or on a per-command basis with
    the FOLLOW and NOFOLLOW tags. Bug #707.
  * Fixed a bug introduced in version 1.8.14 that caused the last valid
    editor in the sudoers "editor" list to be used by visudo and sudoedit
    instead of the first. Bug #714.
  * Fixed a bug in visudo that prevented the addition of a final newline
    to edited files without one.
  * Fixed a bug decoding certain base64 digests in sudoers when the
    intermediate format included a '=' character.
  * Individual records are now locked in the time stamp file instead of
    the entire file. This allows sudo to avoid prompting for a password
    multiple times on the same terminal when used in a pipeline.
    In other words, sudo cat foo | sudo grep bar now only prompts for
    the password once. Previously, both sudo processes would prompt for
    a password, often making it impossible to enter. Bug #705.
  * Fixed a bug where sudo would fail to run commands as a non-root user
    on systems that lack both setresuid() and setreuid(). Bug #713.
  * Fixed a bug introduced in sudo 1.8.14 that prevented visudo from
    re-editing the correct file when a syntax error was detected.
  * Fixed a bug where sudo would not relay a SIGHUP signal to the command
    when the terminal is closed and the command is not run in its own
    pseudo-tty. Bug #719.
  * If some, but not all, of the LOGNAME, USER or USERNAME environment
    variables have been preserved from the invoking user's environment,
    sudo will now use the preserved value to set the remaining variables
    instead of using the runas user. This ensures that if, for example,
    only LOGNAME is present in the env_keep list, that sudo will not set
    USER and USERNAME to the runas user.
  * When the command sudo is running dies due to a signal, sudo will now
    send itself that same signal with the default signal handler installed
    instead of exiting. The bash shell appears to ignore some signals,
    e.g. SIGINT, unless the command being run is killed by that signal.
    This makes the behavior of commands run under sudo the same as
    without sudo when bash is the shell. Bug #722.
  * Slovak translation for sudo from translationproject.org.
  * Hungarian and Slovak translations for sudoers from
    translationproject.org.
  * Previously, when env_reset was enabled (the default) and the
  - s option was not used, the SHELL environment variable was set to the
    shell of the invoking user. Now, when env_reset is enabled and the
  - s option is not used, SHELL is set based on the target user.
  * Fixed challenge/response style BSD authentication.
  * Added the sudoedit_checkdir Defaults option to prevent sudoedit from
    editing files located in a directory that is writable by the
    invoking user.
  * Added the always_query_group_plugin Defaults option to control
    whether groups not found in the system group database are passed to
    the group plugin. Previously, unknown system groups were always
    passed to the group plugin.
  * When creating a new file, sudoedit will now check that the file's
    parent directory exists before running the editor.
  * Fixed the compiler stack protector test in configure for compilers
    that support -fstack-protector but don't actually have the ssp
    library available.
- use spec-cleaner</changelog>
<changelog author="michael@stroeder.com" date="1458216000">- update to 1.8.16:
  * Fixed a compilation error on Solaris 10 with Stun Studio 12.
  Bug #727.
  * When preserving variables from the invoking user's environment, if
  there are duplicates sudo now only keeps the first instance.
  * Fixed a bug that could cause warning mail to be sent in list
  mode (sudo -l) for users without sudo privileges when the
  LDAP and sssd backends are used.
  * Fixed a bug that prevented the "mail_no_user" option from working
  properly with the LDAP backend.
  * In the LDAP and sssd backends, white space is now ignored between
  an operator (!, +, +=, -=) when parsing a sudoOption.
  * It is now possible to disable Path settings in sudo.conf
  by omitting the path name.
  * The sudoedit_checkdir Defaults option is now enabled by default
  and has been extended.  When editing files with sudoedit, each
  directory in the path to be edited is now checked.  If a directory
  is writable by the invoking user, symbolic links will not be
  followed.  If the parent directory of the file to be edited is
  writable, sudoedit will refuse to edit it.
  Bug #707.
  * The netgroup_tuple Defaults option has been added to enable matching
  of the entire netgroup tuple, not just the host or user portion.
  Bug #717.
  * When matching commands based on the SHA2 digest, sudo will now
  use fexecve(2) to execute the command if it is available.  This
  fixes a time of check versus time of use race condition when the
  directory holding the command is writable by the invoking user.
  * On AIX systems, sudo now caches the auth registry string along
  with password and group information.  This fixes a potential
  problem when a user or group of the same name exists in multiple
  auth registries.  For example, local and LDAP.
  * Fixed a crash in the SSSD backend when the invoking user is not
  found.  Bug #732.
  * Added the --enable-asan configure flag to enable address sanitizer
  support.  A few minor memory leaks have been plugged to quiet
  the ASAN leak detector.
  * The value of _PATH_SUDO_CONF may once again be overridden via
  the Makefile.  Bug #735.
  * The sudoers2ldif script now handles multiple roles with same name.
  * Fixed a compilation error on systems that have the posix_spawn()
  and posix_spawnp() functions but an unusable spawn.h header.
  Bug #730.
  * Fixed support for negating character classes in sudo's version
  of the fnmatch() function.
  * Fixed a bug in the LDAP and SSSD backends that could allow an
  unauthorized user to list another user's privileges.  Bug #738.
  * The PAM conversation function now works around an ambiguity in the
  PAM spec with respect to multiple messages.  Bug #726.</changelog>
<changelog author="mpluskal@suse.com" date="1458388800">- Add gpg signature
- Use valid category for tests</changelog>
<changelog author="kstreitova@suse.com" date="1461931200">- add sudo-1.8.16-pam_groups.patch to do group setup in
  policy_init_session() before calling out to the plugin. This makes
  it possible for the pam_group module to change the group in
  pam_setcred() [fate#318850]</changelog>
<changelog author="kstreitova@suse.com" date="1463659200">- add "BuildRequires: cyrus-sasl-devel" to enable SASL
  authentication [bnc#979531]</changelog>
<changelog author="egeorget@openmailbox.org" date="1464004800">- Changing password promp to make use of sudo localized prompts.</changelog>
<changelog author="michael@stroeder.com" date="1466337600">- removed obsolete patch sudo-1.8.16-pam_groups.patch
- update to 1.8.17:
  * On AIX, if /etc/security/login.cfg has auth_type set to PAM_AUTH
  but pam_start(3) fails, fall back to AIX authentication.
  Bug #740.
  * Sudo now takes all sudoers sources into account when determining
  whether or not "sudo -l" or "sudo -b" should prompt for a password.
  In other words, if both file and ldap sudoers sources are in
  specified in /etc/nsswitch.conf, "sudo -v" will now require that
  all entries in both sources be have NOPASSWD (file) or !authenticate
  (ldap) in the entries.
  * Sudo now ignores SIGPIPE until the command is executed.  Previously,
  SIGPIPE was only ignored in a few select places.  Bug #739.
  * Fixed a bug introduced in sudo 1.8.14 where (non-syslog) log
  file entries were missing the newline when loglinelen is set to
  a non-positive number.  Bug #742.
  * Unix groups are now set before the plugin session intialization
  code is run.  This makes it possible to use dynamic groups with
  the Linux-PAM pam_group module.
  * Fixed a bug where a debugging statement could dereference a NULL
  pointer when looking up a group that doesn't exist.  Bug #743.
  * Sudo has been run through the Coverity code scanner.  A number of
  minor bugs have been fixed as a result.  None were security issues.
  * SELinux support, which was broken in 1.8.16, has been repaired.
  * Fixed a bug when logging I/O where all output buffers might not
  get flushed at exit.
  * Forward slashes are no longer escaped in the JSON output of
  "visudo -x".  This was never required by the standard and not
  escaping them improves readability of the output.
  * Sudo no longer treats PAM_SESSION_ERR as a fatal error when
  opening the PAM session.  Other errors from pam_open_session()
  are still treated as fatal.  This avoids the "policy plugin
  failed session initialization" error message seen on some systems.
  * Korean translation for sudo and sudoers from translationproject.org.
  * Fixed a bug on AIX where the stack size hard resource limit was
  being set to 2GB instead of 4GB on 64-bit systems.
  * The SSSD backend now properly supports "sudo -U otheruser -l".
  * The SSSD backend now uses the value of "ipa_hostname"
  from sssd.conf, if specified, when matching the host name.
  * Fixed a hang on some systems when the command is being run in
  a pty and it failed to execute.
  * When performing a wildcard match in sudoers, check for an exact
  string match if the user command was fully-qualified (or resolved
  via the PATH).  This fixes an issue executing scripts on Linux
  when there are multiple wildcard matches with the same base name.
  Bug #746.</changelog>
<changelog author="michael@stroeder.com" date="1466596800">- update to 1.8.17p1:
  * Fixed a bug introduced in 1.8.17 where the user's groups were
    not set on systems that don't use PAM.  Bug #749.</changelog>
<changelog author="michael@stroeder.com" date="1474372800">- update to 1.8.18
  * The sudoers locale is now set before parsing the sudoers file.
  If sudoers_locale is set in sudoers, it is applied before
  evaluating other Defaults entries.  Previously, sudoers_locale
  was used when evaluating sudoers but not during the inital parse.
  Bug #748.
  * A missing or otherwise invalid #includedir is now ignored instead
  of causing a parse error.
  * During "make install", backup files are only used on HP-UX where
  it is not possible to unlink a shared object that is in use.
  This works around a bug in ldconfig on Linux which could create
  links to the backup shared library file instead of the current
  one.
  * Fixed a bug introduced in 1.8.17 where sudoers entries with long
  commands lines could be truncated, preventing a match.  Bug #752.
  * The fqdn, runas_default and sudoers_locale Defaults settings are
  now applied before any other Defaults settings since they can
  change how other Defaults settings are parsed.
  * On systems without the O_NOFOLLOW open(2) flag, when the NOFOLLOW
  flag is set, sudoedit now checks whether the file is a symbolic link
  before opening it as well as after the open.  Bug #753.
  * Sudo will now only resolve a user's group IDs to group names
  when sudoers includes group-based permissions.  Group lookups
  can be expensive on some systems where the group database is
  not local.
  * If the file system holding the sudo log file is full, allow
  the command to run unless the new ignore_logfile_errors Defaults
  option is disabled.  Bug #751.
  * The ignore_audit_errors and ignore_iolog_errors Defaults options
  have been added to control sudo's behavior when it is unable to
  write to the audit and I/O logs.
  * Fixed a bug introduced in 1.8.17 where the SIGPIPE signal handler
  was not being restored when sudo directly executes the command.
  * Fixed a bug where "sudo -l command" would indicate that a command
  was runnable even when denied by sudoers when using the LDAP or
  SSSD backends.
  * The match_group_by_gid Defaults option has been added to allow
  sites where group name resolution is slow and where sudoers only
  contains a small number of groups to match groups by group ID
  instead of by group name.
  * Fixed a bug on Linux where a 32-bit sudo binary could fail with
  an "unable to allocate memory" error when run on a 64-bit system.
  Bug #755
  * When parsing ldap.conf, sudo will now only treat a '#' character
  as the start of a comment when it is at the beginning of the
  line.
  * Fixed a potential crash when auditing is enabled and the audit
  function fails with an error.  Bug #756
  * Norwegian Nynorsk translation for sudo from translationproject.org.
  * Fixed a typo that broke short host name matching when the fqdn
  flag is enabled in sudoers.  Bug #757
  * Negated sudoHost attributes are now supported by the LDAP and
  SSSD backends.
  * Fixed matching entries in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.
  * Fixed "sudo -l" output in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.</changelog>
<changelog author="michael@stroeder.com" date="1477656000">- update to 1.8.18p1 with these major changes:
  * When sudo_noexec.so is used, the WRDE_NOCMD flag is now added
  if the wordexp() function is called.  This prevents commands
  from being run via wordexp() without disabling it entirely.
  * On Linux systems, sudo_noexec.so now uses a seccomp filter to
  disable execute access if the kernel supports seccomp.  This is
  more robust than the traditional method of using stub functions
  that return an error.</changelog>

</package>

<package pkgid="d488e9984ca2b914f240dad7ace2ea8162186f5704df261bda3782ba8b3ccfc4" name="sudo-test" arch="x86_64">
    <version epoch="0" ver="1.8.18p1" rel="127.1"/>

<changelog author="vcizek@suse.com" date="1400155200">- update to 1.8.10p3
  * Fixed expansion of the %p escape in the prompt for "sudo -l"
    when rootpw, runaspw or targetpw is set. Bug #639.
  * Fixed matching of uids and gids which was broken in version 1.8.9
  * PAM credential initialization has been re-enabled. It was
    unintentionally disabled by default in version 1.8.8. The way
    credentials are initialized has also been fixed. Bug #642.
  * Fixed a descriptor leak on Linux when determing boot time. Sudo
    normally closes extra descriptors before running a command so
    the impact is limited. Bug #645.
  * Fixed flushing of the last buffer of data when I/O logging is
    enabled. This bug, introduced in version 1.8.9, could cause
    incomplete command output on some systems. Bug #646.
  * Fixed a hang introduced in sudo 1.8.10 when timestamp_timeout
    is set to zero. Bug #638.
- don't install test LICENSE with executable perms</changelog>
<changelog author="tabraham@suse.com" date="1413028800">- refresh sudo-sudoers.patch
- update to 1.8.11p1
  * Fixed a compilation problem on some systems when the
  - -disable-shared-libutil configure option was specified.
  * The user can no longer interrupt the sleep after an incorrect password on
    PAM systems using pam_unix. Bug #666.
  * Fixed a compilation problem on Linux systems that do not use PAM. Bug #667.
  * "make install" will now work with the stock GNU autotools install-sh
    script. Bug #669.
  * Fixed a crash with "sudo -i" when the current working directory does not
    exist. Bug #670.
  * Fixed a potential crash in the debug subsystem when logging a message
    larger that 1024 bytes.
  * Fixed a "make check" failure for ttyname when stdin is closed and stdout
    and stderr are redirected to a different tty. Bug #643.
  * Added BASH_FUNC_* to environment blacklist to match newer-style bash
    functions.
- changes from 1.8.11
  * The sudoers plugin no longer uses setjmp/longjmp to recover from fatal
    errors. All errors are now propagated to the caller via return codes.
  * When running a command in the background, sudo will now forward SIGINFO to
    the command (if supported).
  * Sudo will now use the system versions of the sha2 functions from libc or
    libmd if available.
  * Visudo now works correctly on GNU Hurd. Bug #647.
  * Fixed suspend and resume of curses programs on some system when the
    command is not being run in a pseudo-terminal. Bug #649.
  * Fixed a crash with LDAP-based sudoers on some systems when Kerberos was
    enabled.
  * Sudo now includes optional Solaris audit support.
  * Catalan translation for sudoers from translationproject.org.
  * Norwegian Bokmaal translation for sudo from translationproject.org.
  * Greek translation for sudoers from translationproject.org
  * The sudo source tree has been reorganized to more closely resemble that of
    other gettext-enabled packages.
  * Sudo and its associated programs now link against a shared version of
    libsudo_util. The --disable-shared-libutil configure option may be used to
    force static linking if the --enable-static-sudoers option is also
    specified.
  * The passwords in ldap.conf and ldap.secret may now be encoded in base64.
  * Audit updates. SELinux role changes are now audited. For sudoedit, we now
    audit the actual editor being run, instead of just the sudoedit command.
  * Fixed bugs in the man page post-processing that could cause portions of the
    manuals to be removed.
  * Fixed a crash in the system_group plugin. Bug #653.
  * Fixed sudoedit on platforms without a native version of the getprogname()
    function. Bug #654.
  * Fixed compilation problems with some pre-C99 compilers.
  * Fixed sudo's -C option which was broken in version 1.8.9.
  * It is now possible to match an environment variable's value as well as its
    name using env_keep and env_check. This can be used to preserve bash
    functions which would otherwise be removed from the environment.
  * New files created via sudoedit as a non-root user now have the proper
    group id. Bug #656.
  * Sudoedit now works correctly in conjunction with sudo's SELinux RBAC
    support. Temporary files are now created with the proper security context.
  * The sudo I/O logging plugin API has been updated. If a logging function
    returns an error, the command will be terminated and all of the plugin's
    logging functions will be disabled. If a logging function rejects the
    command's output it will no longer be displayed to the user's terminal.
  * Fixed a compilation error on systems that lack openpty(), _getpty() and
    grantpt(). Bug #660.
  * Fixed a hang when a sudoers source is listed more than once in a single
    sudoers nsswitch.conf entry.
  * On AIX, shell scripts without a #! magic number are now passed to
    /usr/bin/sh, not /usr/bin/bsh. This is consistent with what the execvp()
    function on AIX does and matches historic sudo behavior. Bug #661.
  * Fixed a cross-compilation problem building mksiglist and mksigname.
    Bug #662.</changelog>
<changelog author="fstrba@suse.com" date="1415275200">- update to 1.8.11p2
  * Fixed a bug where dynamic shared objects loaded from a plugin
    could use the hooked version of getenv() but not the hooked
    versions of putenv(), setenv() or unsetenv().  This can cause
    problems for PAM modules that use those functions.</changelog>
<changelog author="vcizek@suse.com" date="1418817600">- correctly parse /proc/stat for boottime (bnc#899252)
  * added sudo-parse_boottime_properly.patch from Debian</changelog>
<changelog author="vcizek@suse.com" date="1424606400">- update to 1.8.12 (fixes bnc#918953)
- changelog:
  * The embedded copy of zlib has been upgraded to version 1.2.8 and
    is now installed as a shared library where supported.
  * Debug settings for the sudo front end and sudoers plugin are now configured separately.
  * Multiple sudo.conf Debug entries may now be specified per program (or plugin).
  * The plugin API has been extended such that the path to the plugin
    that was loaded is now included in the settings array. This path
    can be used to register with the debugging subsystem. The debug_flags
    setting is now prefixed with a file name and may be specified multiple
    times if there is more than one matching Debug setting in sudo.conf.
  * The sudoers regression tests now run with the locale set to C since
    some of the tests compare output that includes locale-specific messages. Bug #672.
  * Fixed a bug where sudo would not run commands on Linux when compiled
    with audit support if audit is disabled. Bug #671.
  * The default password prompt now includes a trailing space after
    "Password:" for consistency with su(1) on most systems. Bug #663.
  * Visudo will now use the optional sudoers_file, sudoers_mode,
    sudoers_uid and sudoers_gid arguments if specified on the sudoers.so Plugin line in the sudo.conf file.
  * Fixed a problem introduced in sudo 1.8.8 that prevented the full
    host name from being used when the fqdn sudoers option is used. Bug #678.
  * Sudo now installs a handler for SIGCHLD signal handler immediately
    before stating the process that will execute the command (or start the monitor).
  * Removed a limit on the length of command line arguments expanded by
    a wild card using sudo's version of the fnmatch() function.
    This limit was introduced when sudo's version of fnmatch() was replaced in sudo 1.8.4.
  * LDAP-based sudoers can now query an LDAP server for a user's netgroups
    directly. This is often much faster than fetching every sudoRole object
    containing a sudoUser that begins with a `+' prefix and checking
    whether the user is a member of any of the returned netgroups.
  * The mail_always sudoers option no longer sends mail for
    sudo -l or sudo -v unless the user is unable to authenticate themselves.
  * Fixed a crash when sudo is run with an empty argument vector.
  * Fixed two potential crashes when sudo is run with very low resource limits.
  * The TZ environment variable is now checked for safety instead of simply
    being copied to the environment of the command. This fixes a potential security issue.</changelog>
<changelog author="vcizek@suse.com" date="1431604800">- update to 1.8.13
  * The examples directory is now a subdirectory of the doc dir to
  conform to Debian guidelines.  Bug #682.
  * Fixed a compilation error for siglist.c and signame.c on some
  systems.  Bug #686
  * Weak symbols are now used for sudo_warn_gettext() and
  sudo_warn_strerror() in libsudo_util to avoid link errors when
  - Wl,--no-undefined is used in LDFLAGS.  The --disable-weak-symbols
  configure option can be used to disable the user of weak symbols.
  * Fixed a bug in sudo's mkstemps() replacement function that
  prevented the file extension from being preserved in sudoedit.
  * A new mail_all_cmnds sudoers flag will send mail when a user runs
  a command (or tries to). The behavior of the mail_always flag has
  been restored to always send mail when sudo is run.
  * New "MAIL" and "NOMAIL" command tags have been added to toggle
  mail sending behavior on a per-command (or Cmnd_Alias) basis.
  * Fixed matching of empty passwords when sudo is configured to
  use passwd (or shadow) file authentication on systems where the
  crypt() function returns NULL for invalid salts.
  * The "all" setting for listpw and verifypw now works correctly
  with LDAP and sssd sudoers.
  * The sudo timestamp directory is now created at boot time on
  platforms that use systemd.
  * Sudo will now restore the value of the SIGPIPE handler before
  executing the command.
  * Sudo now uses "struct timespec" instead of "struct timeval" for
  time keeping when possible.  If supported, sudoedit and visudo
  now use nanosecond granularity time stamps.
  * Fixed a symbol name collision with systems that have their own
  SHA2 implementation.  This fixes a problem where PAM could use
  the wrong SHA2 implementation on Solaris 10 systems configured
  to use SHA512 for passwords.
  * The editor invoked by sudoedit once again uses an unmodified
  copy of the user's environment as per the documentation.  This
  was inadvertantly changed in sudo 1.8.0.  Bug #688.</changelog>
<changelog author="crrodriguez@opensuse.org" date="1437566400">- BuildRequires zlib-devel, support zlib compressed I/O logs.</changelog>
<changelog author="kstreitova@suse.com" date="1437652800">- update to 1.8.14p3:
  * changes in 1.8.14p3
  * Fixed a bug introduced in sudo 1.8.14p2 that prevented sudo
    from working when no tty was present. Bug #706.
  * Fixed tty detection on newer AIX systems where dev_t is 64-bit.
  * changes in 1.8.14p2
  * Fixed a bug introduced in sudo 1.8.14 that prevented the
    lecture file from being created. Bug #704.
  * changes in 1.8.14p1
  * Fixed a bug introduced in sudo 1.8.14 that prevented the sssd
    backend from working. Bug #703.
  * changes in 1.8.14
  * Log messages on Mac OS X now respect sudoers_locale when sudo
    is build with NLS support.
  * The sudo manual pages now pass mandoc -Tlint with no warnings.
  * Fixed a compilation problem on systems with the sig2str()
    function that do not define SIG2STR_MAX in signal.h.
  * Worked around a compiler bug that resulted in unexpected
    behavior when returning an int from a function declared to
    return bool without an explicit cast.
  * Worked around a bug in Mac OS X 10.10 BSD auditing where the
    au_preselect() fails for AUE_sudo events but succeeds for
    AUE_DARWIN_sudo.
  * Fixed a hang on Linux systems with glibc when sudo is linked
    with jemalloc.
  * When the user runs a command as a user ID that is not present
    in the password database via the -u flag, the command is now
    run with the group ID of the invoking user instead of group ID 0.
  * Fixed a compilation problem on systems that don't pull in
    definitions of uid_t and gid_t without sys/types.h or unistd.h.
  * Fixed a compilation problem on newer AIX systems which use a
    struct st_timespec for time stamps in struct stat that differs
    from struct timespec. Bug #702.
  * The example directory is now configurable via --with-exampledir
    and defaults to DATAROOTDIR/examples/sudo on BSD systems.
  * The /usr/lib/tmpfiles.d/sudo.conf file is now installed as part
    of "make install" when systemd is in use.
  * Fixed a linker problem on some systems with libintl. Bug #690.
  * Fixed compilation with compilers that don't support __func__ or
    __FUNCTION__.
  * Sudo no longer needs to uses weak symbols to support localization
    in the warning functions. A registration function is used instead.
  * Fixed a setresuid() failure in sudoers on Linux kernels where
    uid changes take the nproc resource limit into account.
  * Fixed LDAP netgroup queries on AIX.
  * Sudo will now display the custom prompt on Linux systems with
    PAM even if the "Password: " prompt is not localized by the
    PAM module. Bug #701.
  * Double-quoted values in an LDAP sudoOption are now supported
    for consistency with file-based sudoers.
  * Fixed a bug that prevented the btime entry in /proc/stat from
    being parsed on Linux.
  * update sudo-sudoers.patch
  * remove sudo-parse_boottime_properly.patch (it's not longer needed)</changelog>
<changelog author="dimstar@opensuse.org" date="1439380800">- Pass --enable-tmpfiles.d=%{_tmpfilesdir} to configure: let's be
  specific about this feature, and not randomly rely on the
  presence/absence of /usr/lib/tmpfiles.d/systemd.conf.
- Add systemd-rpm-macros BuildRequires to ensure %_tmpfilesdir is
  defined.
- Add relevant %tmpfiles_create call to post scriptlet.</changelog>
<changelog author="jengelh@inai.de" date="1439380801">- No need to buildrequire an sssd plugin (libsss_sudo)</changelog>
<changelog author="kstreitova@suse.com" date="1446811200">- update to 1.8.15:
  * Fixed a bug that prevented sudo from building outside the source
    tree on some platforms. Bug #708.
  * Fixed the location of the sssd library in the RHEL/Centos packages.
    Bug #710.
  * Fixed a build problem on systems that don't implicitly include
    sys/types.h from other header files. Bug #711.
  * Fixed a problem on Linux using containers where sudo would ignore
    signals sent by a process in a different container.
  * Sudo now refuses to run a command if the PAM session module returns
    an error.
  * When editing files with sudoedit, symbolic links will no longer be
    followed by default. The old behavior can be restored by enabling
    the sudoedit_follow option in sudoers or on a per-command basis with
    the FOLLOW and NOFOLLOW tags. Bug #707.
  * Fixed a bug introduced in version 1.8.14 that caused the last valid
    editor in the sudoers "editor" list to be used by visudo and sudoedit
    instead of the first. Bug #714.
  * Fixed a bug in visudo that prevented the addition of a final newline
    to edited files without one.
  * Fixed a bug decoding certain base64 digests in sudoers when the
    intermediate format included a '=' character.
  * Individual records are now locked in the time stamp file instead of
    the entire file. This allows sudo to avoid prompting for a password
    multiple times on the same terminal when used in a pipeline.
    In other words, sudo cat foo | sudo grep bar now only prompts for
    the password once. Previously, both sudo processes would prompt for
    a password, often making it impossible to enter. Bug #705.
  * Fixed a bug where sudo would fail to run commands as a non-root user
    on systems that lack both setresuid() and setreuid(). Bug #713.
  * Fixed a bug introduced in sudo 1.8.14 that prevented visudo from
    re-editing the correct file when a syntax error was detected.
  * Fixed a bug where sudo would not relay a SIGHUP signal to the command
    when the terminal is closed and the command is not run in its own
    pseudo-tty. Bug #719.
  * If some, but not all, of the LOGNAME, USER or USERNAME environment
    variables have been preserved from the invoking user's environment,
    sudo will now use the preserved value to set the remaining variables
    instead of using the runas user. This ensures that if, for example,
    only LOGNAME is present in the env_keep list, that sudo will not set
    USER and USERNAME to the runas user.
  * When the command sudo is running dies due to a signal, sudo will now
    send itself that same signal with the default signal handler installed
    instead of exiting. The bash shell appears to ignore some signals,
    e.g. SIGINT, unless the command being run is killed by that signal.
    This makes the behavior of commands run under sudo the same as
    without sudo when bash is the shell. Bug #722.
  * Slovak translation for sudo from translationproject.org.
  * Hungarian and Slovak translations for sudoers from
    translationproject.org.
  * Previously, when env_reset was enabled (the default) and the
  - s option was not used, the SHELL environment variable was set to the
    shell of the invoking user. Now, when env_reset is enabled and the
  - s option is not used, SHELL is set based on the target user.
  * Fixed challenge/response style BSD authentication.
  * Added the sudoedit_checkdir Defaults option to prevent sudoedit from
    editing files located in a directory that is writable by the
    invoking user.
  * Added the always_query_group_plugin Defaults option to control
    whether groups not found in the system group database are passed to
    the group plugin. Previously, unknown system groups were always
    passed to the group plugin.
  * When creating a new file, sudoedit will now check that the file's
    parent directory exists before running the editor.
  * Fixed the compiler stack protector test in configure for compilers
    that support -fstack-protector but don't actually have the ssp
    library available.
- use spec-cleaner</changelog>
<changelog author="michael@stroeder.com" date="1458216000">- update to 1.8.16:
  * Fixed a compilation error on Solaris 10 with Stun Studio 12.
  Bug #727.
  * When preserving variables from the invoking user's environment, if
  there are duplicates sudo now only keeps the first instance.
  * Fixed a bug that could cause warning mail to be sent in list
  mode (sudo -l) for users without sudo privileges when the
  LDAP and sssd backends are used.
  * Fixed a bug that prevented the "mail_no_user" option from working
  properly with the LDAP backend.
  * In the LDAP and sssd backends, white space is now ignored between
  an operator (!, +, +=, -=) when parsing a sudoOption.
  * It is now possible to disable Path settings in sudo.conf
  by omitting the path name.
  * The sudoedit_checkdir Defaults option is now enabled by default
  and has been extended.  When editing files with sudoedit, each
  directory in the path to be edited is now checked.  If a directory
  is writable by the invoking user, symbolic links will not be
  followed.  If the parent directory of the file to be edited is
  writable, sudoedit will refuse to edit it.
  Bug #707.
  * The netgroup_tuple Defaults option has been added to enable matching
  of the entire netgroup tuple, not just the host or user portion.
  Bug #717.
  * When matching commands based on the SHA2 digest, sudo will now
  use fexecve(2) to execute the command if it is available.  This
  fixes a time of check versus time of use race condition when the
  directory holding the command is writable by the invoking user.
  * On AIX systems, sudo now caches the auth registry string along
  with password and group information.  This fixes a potential
  problem when a user or group of the same name exists in multiple
  auth registries.  For example, local and LDAP.
  * Fixed a crash in the SSSD backend when the invoking user is not
  found.  Bug #732.
  * Added the --enable-asan configure flag to enable address sanitizer
  support.  A few minor memory leaks have been plugged to quiet
  the ASAN leak detector.
  * The value of _PATH_SUDO_CONF may once again be overridden via
  the Makefile.  Bug #735.
  * The sudoers2ldif script now handles multiple roles with same name.
  * Fixed a compilation error on systems that have the posix_spawn()
  and posix_spawnp() functions but an unusable spawn.h header.
  Bug #730.
  * Fixed support for negating character classes in sudo's version
  of the fnmatch() function.
  * Fixed a bug in the LDAP and SSSD backends that could allow an
  unauthorized user to list another user's privileges.  Bug #738.
  * The PAM conversation function now works around an ambiguity in the
  PAM spec with respect to multiple messages.  Bug #726.</changelog>
<changelog author="mpluskal@suse.com" date="1458388800">- Add gpg signature
- Use valid category for tests</changelog>
<changelog author="kstreitova@suse.com" date="1461931200">- add sudo-1.8.16-pam_groups.patch to do group setup in
  policy_init_session() before calling out to the plugin. This makes
  it possible for the pam_group module to change the group in
  pam_setcred() [fate#318850]</changelog>
<changelog author="kstreitova@suse.com" date="1463659200">- add "BuildRequires: cyrus-sasl-devel" to enable SASL
  authentication [bnc#979531]</changelog>
<changelog author="egeorget@openmailbox.org" date="1464004800">- Changing password promp to make use of sudo localized prompts.</changelog>
<changelog author="michael@stroeder.com" date="1466337600">- removed obsolete patch sudo-1.8.16-pam_groups.patch
- update to 1.8.17:
  * On AIX, if /etc/security/login.cfg has auth_type set to PAM_AUTH
  but pam_start(3) fails, fall back to AIX authentication.
  Bug #740.
  * Sudo now takes all sudoers sources into account when determining
  whether or not "sudo -l" or "sudo -b" should prompt for a password.
  In other words, if both file and ldap sudoers sources are in
  specified in /etc/nsswitch.conf, "sudo -v" will now require that
  all entries in both sources be have NOPASSWD (file) or !authenticate
  (ldap) in the entries.
  * Sudo now ignores SIGPIPE until the command is executed.  Previously,
  SIGPIPE was only ignored in a few select places.  Bug #739.
  * Fixed a bug introduced in sudo 1.8.14 where (non-syslog) log
  file entries were missing the newline when loglinelen is set to
  a non-positive number.  Bug #742.
  * Unix groups are now set before the plugin session intialization
  code is run.  This makes it possible to use dynamic groups with
  the Linux-PAM pam_group module.
  * Fixed a bug where a debugging statement could dereference a NULL
  pointer when looking up a group that doesn't exist.  Bug #743.
  * Sudo has been run through the Coverity code scanner.  A number of
  minor bugs have been fixed as a result.  None were security issues.
  * SELinux support, which was broken in 1.8.16, has been repaired.
  * Fixed a bug when logging I/O where all output buffers might not
  get flushed at exit.
  * Forward slashes are no longer escaped in the JSON output of
  "visudo -x".  This was never required by the standard and not
  escaping them improves readability of the output.
  * Sudo no longer treats PAM_SESSION_ERR as a fatal error when
  opening the PAM session.  Other errors from pam_open_session()
  are still treated as fatal.  This avoids the "policy plugin
  failed session initialization" error message seen on some systems.
  * Korean translation for sudo and sudoers from translationproject.org.
  * Fixed a bug on AIX where the stack size hard resource limit was
  being set to 2GB instead of 4GB on 64-bit systems.
  * The SSSD backend now properly supports "sudo -U otheruser -l".
  * The SSSD backend now uses the value of "ipa_hostname"
  from sssd.conf, if specified, when matching the host name.
  * Fixed a hang on some systems when the command is being run in
  a pty and it failed to execute.
  * When performing a wildcard match in sudoers, check for an exact
  string match if the user command was fully-qualified (or resolved
  via the PATH).  This fixes an issue executing scripts on Linux
  when there are multiple wildcard matches with the same base name.
  Bug #746.</changelog>
<changelog author="michael@stroeder.com" date="1466596800">- update to 1.8.17p1:
  * Fixed a bug introduced in 1.8.17 where the user's groups were
    not set on systems that don't use PAM.  Bug #749.</changelog>
<changelog author="michael@stroeder.com" date="1474372800">- update to 1.8.18
  * The sudoers locale is now set before parsing the sudoers file.
  If sudoers_locale is set in sudoers, it is applied before
  evaluating other Defaults entries.  Previously, sudoers_locale
  was used when evaluating sudoers but not during the inital parse.
  Bug #748.
  * A missing or otherwise invalid #includedir is now ignored instead
  of causing a parse error.
  * During "make install", backup files are only used on HP-UX where
  it is not possible to unlink a shared object that is in use.
  This works around a bug in ldconfig on Linux which could create
  links to the backup shared library file instead of the current
  one.
  * Fixed a bug introduced in 1.8.17 where sudoers entries with long
  commands lines could be truncated, preventing a match.  Bug #752.
  * The fqdn, runas_default and sudoers_locale Defaults settings are
  now applied before any other Defaults settings since they can
  change how other Defaults settings are parsed.
  * On systems without the O_NOFOLLOW open(2) flag, when the NOFOLLOW
  flag is set, sudoedit now checks whether the file is a symbolic link
  before opening it as well as after the open.  Bug #753.
  * Sudo will now only resolve a user's group IDs to group names
  when sudoers includes group-based permissions.  Group lookups
  can be expensive on some systems where the group database is
  not local.
  * If the file system holding the sudo log file is full, allow
  the command to run unless the new ignore_logfile_errors Defaults
  option is disabled.  Bug #751.
  * The ignore_audit_errors and ignore_iolog_errors Defaults options
  have been added to control sudo's behavior when it is unable to
  write to the audit and I/O logs.
  * Fixed a bug introduced in 1.8.17 where the SIGPIPE signal handler
  was not being restored when sudo directly executes the command.
  * Fixed a bug where "sudo -l command" would indicate that a command
  was runnable even when denied by sudoers when using the LDAP or
  SSSD backends.
  * The match_group_by_gid Defaults option has been added to allow
  sites where group name resolution is slow and where sudoers only
  contains a small number of groups to match groups by group ID
  instead of by group name.
  * Fixed a bug on Linux where a 32-bit sudo binary could fail with
  an "unable to allocate memory" error when run on a 64-bit system.
  Bug #755
  * When parsing ldap.conf, sudo will now only treat a '#' character
  as the start of a comment when it is at the beginning of the
  line.
  * Fixed a potential crash when auditing is enabled and the audit
  function fails with an error.  Bug #756
  * Norwegian Nynorsk translation for sudo from translationproject.org.
  * Fixed a typo that broke short host name matching when the fqdn
  flag is enabled in sudoers.  Bug #757
  * Negated sudoHost attributes are now supported by the LDAP and
  SSSD backends.
  * Fixed matching entries in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.
  * Fixed "sudo -l" output in the LDAP and SSSD backends when a
  RunAsGroup is specified but no RunAsUser is present.</changelog>
<changelog author="michael@stroeder.com" date="1477656000">- update to 1.8.18p1 with these major changes:
  * When sudo_noexec.so is used, the WRDE_NOCMD flag is now added
  if the wordexp() function is called.  This prevents commands
  from being run via wordexp() without disabling it entirely.
  * On Linux systems, sudo_noexec.so now uses a seccomp filter to
  disable execute access if the kernel supports seccomp.  This is
  more robust than the traditional method of using stub functions
  that return an error.</changelog>

</package>

</otherdata>