Update for sudo 1.7.10p8

8 files changed, 53 insertions, 25 deletions

diff --git a/NEWS b/NEWS
index f5a9f681f..47c0630a0 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,31 @@
+What's new in Sudo 1.7.10p8?
+
+ * Sudo's exit code now indicates a failure if the user does not
+   successfully authenticate.
+
+ * On HP-UX systems, sudo will now use the pstat() function to
+   determine the tty instead of ttyname().
+
+ * Fixed compilation when --without-iologdir configure option is
+   specified.
+
+ * On systems with BSD login classes, if the user specified a group
+   (not a user) to run the command as, it was possible to specify
+   a different login class even when the command was not run as the
+   super user.
+
+ * The closefrom() emulation on Mac OS X now uses /dev/fd if possible.
+   It also now sets the close on exec flag instead of actually
+   closing the descriptors to avoid a crash in libdispatch.
+
+ * The sudoers plugin will now ignore invalid domain names when
+   checking netgroup membership.  Most Linux systems use the string
+   "(none)" for the NIS-style domain name instead of an empty string.
+
+ * Fixed the logic when checking environment variables on the
+   command line against the env_check and env_delete blacklists.
+   This is only a problem when env_reset is disabled in sudoers.
+
 What's new in Sudo 1.7.10p7?
 
  * A time stamp file with the date set to the epoch by "sudo -k" 
diff --git a/configure b/configure
index 4c1547222..d666b63bd 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.68 for sudo 1.7.10p7.
+# Generated by GNU Autoconf 2.68 for sudo 1.7.10p8.
 #
 # Report bugs to <http://www.sudo.ws/bugs/>.
 #
@@ -570,8 +570,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='sudo'
 PACKAGE_TARNAME='sudo'
-PACKAGE_VERSION='1.7.10p7'
-PACKAGE_STRING='sudo 1.7.10p7'
+PACKAGE_VERSION='1.7.10p8'
+PACKAGE_STRING='sudo 1.7.10p8'
 PACKAGE_BUGREPORT='http://www.sudo.ws/bugs/'
 PACKAGE_URL=''
 
@@ -1447,7 +1447,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures sudo 1.7.10p7 to adapt to many kinds of systems.
+\`configure' configures sudo 1.7.10p8 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1512,7 +1512,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of sudo 1.7.10p7:";;
+     short | recursive ) echo "Configuration of sudo 1.7.10p8:";;
    esac
   cat <<\_ACEOF
 
@@ -1737,7 +1737,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-sudo configure 1.7.10p7
+sudo configure 1.7.10p8
 generated by GNU Autoconf 2.68
 
 Copyright (C) 2010 Free Software Foundation, Inc.
@@ -2441,7 +2441,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by sudo $as_me 1.7.10p7, which was
+It was created by sudo $as_me 1.7.10p8, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   $ $0 $@
@@ -20846,7 +20846,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by sudo $as_me 1.7.10p7, which was
+This file was extended by sudo $as_me 1.7.10p8, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -20912,7 +20912,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-sudo config.status 1.7.10p7
+sudo config.status 1.7.10p8
 configured by $0, generated by GNU Autoconf 2.68,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.in b/configure.in
index d88721237..2df9f2ff3 100644
--- a/configure.in
+++ b/configure.in
@@ -1,9 +1,9 @@
 dnl
 dnl Process this file with GNU autoconf to produce a configure script.
 dnl
-dnl Copyright (c) 1994-1996,1998-2012 Todd C. Miller <Todd.Miller@courtesan.com>
+dnl Copyright (c) 1994-1996,1998-2014 Todd C. Miller <Todd.Miller@courtesan.com>
 dnl
-AC_INIT([sudo], [1.7.10p7], [http://www.sudo.ws/bugs/], [sudo])
+AC_INIT([sudo], [1.7.10p8], [http://www.sudo.ws/bugs/], [sudo])
 AC_CONFIG_HEADER(config.h pathnames.h zlib/zconf.h)
 dnl
 dnl Note: this must come after AC_INIT
diff --git a/sudo.cat b/sudo.cat
index ee9c075a4..11e6b680a 100644
--- a/sudo.cat
+++ b/sudo.cat
@@ -11,10 +11,10 @@ SSYYNNOOPPSSIISS
           [--UU _u_s_e_r _n_a_m_e] [--uu _u_s_e_r _n_a_m_e | _#_u_i_d] [_c_o_m_m_a_n_d]
      ssuuddoo [--AAbbEEHHnnPPSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s | _-]
           [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--pp _p_r_o_m_p_t] [--rr _r_o_l_e] [--tt _t_y_p_e]
-          [--uu _u_s_e_r _n_a_m_e | _#_u_i_d] [VVAARR=_v_a_l_u_e] --ii | --ss [_c_o_m_m_a_n_d]
+          [--uu _u_s_e_r _n_a_m_e | _#_u_i_d] [_V_A_R=_v_a_l_u_e] --ii | --ss [_c_o_m_m_a_n_d]
      ssuuddooeeddiitt [--AAnnSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s | _-]
-              [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r _n_a_m_e | _#_u_i_d] file
-              ...
+              [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r _n_a_m_e | _#_u_i_d]
+              _f_i_l_e _._._.
 
 DDEESSCCRRIIPPTTIIOONN
      ssuuddoo allows a permitted user to execute a _c_o_m_m_a_n_d as the superuser or
@@ -42,7 +42,7 @@ DDEESSCCRRIIPPTTIIOONN
                  used.  If no askpass program is available, ssuuddoo will exit
                  with an error.
 
-     --aa _t_y_p_e     The --aa (_a_u_t_h_e_n_t_i_c_a_t_i_o_n _t_y_p_e) option causes ssuuddoo to use the
+     --aa _t_y_p_e     The --aa (authentication type) option causes ssuuddoo to use the
                  specified authentication type when validating the user, as
                  allowed by _/_e_t_c_/_l_o_g_i_n_._c_o_n_f.  The system administrator may
                  specify a list of sudo-specific authentication methods by
@@ -68,7 +68,7 @@ DDEESSCCRRIIPPTTIIOONN
                  resource limits and scheduling priority of the specified
                  login _c_l_a_s_s.  The _c_l_a_s_s argument can be either a class name
                  as defined in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f, or a single `-' character.  If
-                 _c_l_a_s_s is -, the default login class of the target user will
+                 _c_l_a_s_s is --, the default login class of the target user will
                  be used.  Otherwise, the command must be run as the superuser
                  (user ID 0), or ssuuddoo must be run from a shell that is already
                  running as the superuser.  If the command is being run as a
@@ -267,8 +267,8 @@ DDEESSCCRRIIPPTTIIOONN
                  command line arguments.
 
      Environment variables to be set for the command may also be passed on the
-     command line in the form of VVAARR=_v_a_l_u_e, e.g.
-     LLDD__LLIIBBRRAARRYY__PPAATTHH=_/_u_s_r_/_l_o_c_a_l_/_p_k_g_/_l_i_b.  Variables passed on the command line
+     command line in the form of _V_A_R=_v_a_l_u_e, e.g.
+     LD_LIBRARY_PATH=_/_u_s_r_/_l_o_c_a_l_/_p_k_g_/_l_i_b.  Variables passed on the command line
      are subject to the same restrictions as normal environment variables with
      one important exception.  If the _s_e_t_e_n_v option is set in _s_u_d_o_e_r_s, the
      command to be run has the SETENV tag set or the command matched is ALL,
@@ -816,4 +816,4 @@ DDIISSCCLLAAIIMMEERR
      file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
      complete details.
 
-Sudo 1.7.10                    December 8, 2013                    Sudo 1.7.10
+Sudo 1.7.10                      March 1, 2014                     Sudo 1.7.10
diff --git a/sudoers.cat b/sudoers.cat
index 3caf601f1..7fe64114f 100644
--- a/sudoers.cat
+++ b/sudoers.cat
@@ -643,7 +643,7 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
                        If the system is configured to use the _/_e_t_c_/_h_o_s_t_s file
                        in preference to DNS, the ``canonical'' host name may
                        not be fully-qualified.  The order that sources are
-                       queried for hosts name resolution is usually specified
+                       queried for host name resolution is usually specified
                        in the _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f, _/_e_t_c_/_n_e_t_s_v_c_._c_o_n_f,
                        _/_e_t_c_/_h_o_s_t_._c_o_n_f, or, in some cases, _/_e_t_c_/_r_e_s_o_l_v_._c_o_n_f
                        file.  In the _/_e_t_c_/_h_o_s_t_s file, the first host name of
@@ -1535,4 +1535,4 @@ DDIISSCCLLAAIIMMEERR
      file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
      complete details.
 
-Sudo 1.7.10                      July 16, 2012                     Sudo 1.7.10
+Sudo 1.7.10                      March 1, 2014                     Sudo 1.7.10
diff --git a/sudoers.ldap.cat b/sudoers.ldap.cat
index ca37f205e..cd5aca9b1 100644
--- a/sudoers.ldap.cat
+++ b/sudoers.ldap.cat
@@ -762,4 +762,4 @@ DDIISSCCLLAAIIMMEERR
      file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
      complete details.
 
-Sudo 1.7.10                      July 12, 2012                     Sudo 1.7.10
+Sudo 1.7.10                      March 1, 2014                     Sudo 1.7.10
diff --git a/sudoreplay.cat b/sudoreplay.cat
index 997493b47..785baf060 100644
--- a/sudoreplay.cat
+++ b/sudoreplay.cat
@@ -253,4 +253,4 @@ DDIISSCCLLAAIIMMEERR
      file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
      complete details.
 
-Sudo 1.7.10                      July 12, 2012                     Sudo 1.7.10
+Sudo 1.7.10                      March 1, 2014                     Sudo 1.7.10
diff --git a/visudo.cat b/visudo.cat
index 7c7885e76..b79207fbb 100644
--- a/visudo.cat
+++ b/visudo.cat
@@ -26,7 +26,7 @@ DDEESSCCRRIIPPTTIIOONN
      vviissuuddoo parses the _s_u_d_o_e_r_s file after the edit and will not save the
      changes if there is a syntax error.  Upon finding an error, vviissuuddoo will
      print a message stating the line number(s) where the error occurred and
-     the user will receive the ``What now?''  prompt.  At this point the user
+     the user will receive the ``What now?'' prompt.  At this point the user
      may enter `e' to re-edit the _s_u_d_o_e_r_s file, `x' to exit without saving the
      changes, or `Q' to quit and save changes.  The `Q' option should be used
      with extreme care because if vviissuuddoo believes there to be a parse error,
@@ -144,4 +144,4 @@ DDIISSCCLLAAIIMMEERR
      file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
      complete details.
 
-Sudo 1.7.10                      July 12, 2012                     Sudo 1.7.10
+Sudo 1.7.10                      March 1, 2014                     Sudo 1.7.10