1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
|
TODO list (most will be addressed in sudo 2.0)
01) Redo parsing to be more like op(8) with true command aliases where
can specify uid, gid(s) and part/all of the environment.
02) Add a SHELLS reserved word that checks against /etc/shells.
03) Make the sudoers file accessible via NIS, NIS+.
04) Add a -h (?) flag to sudo for a history mechanism.
05) Add Prog_Alias facility (Prog_Alias VI = /usr/secure/bin/vi +args).
06) Add support for "safe scripts" by checking for shell script
cookie (first two bytes are "#!") and execing the shell outselves
after doing the stat to guard against spoofing. This should avoid
the race condition caused by going through namei() twice...
07) Should be able to mix Cmnd_Alias's and command args. Ie:
pete ALL=PASSWD [A-z]*,!PASSWD root
where PASSWD was defined to be /usr/bin/passwd.
This requires the arg parsing to happen in the yacc grammer.
At the very least, commands and args have to become separate
tokens in the lexer.
08) Add a per-tty restriction? Ie: only can run foo from /dev/console.
09) Add test for how to read ether interfaces in configure script
10) Use strtol() and strtoul(), not atoi()
11) Implement date_format and log_format options.
12) Add support for: Default:user@host
13) Some people want to be able to specify a special password in sudoers
in addition or instead of the normal one. The best argument for
this so far is to be able to use separate passwords for the
target users that are not the passwd file ones.
14) Add support for trusted users. E.g. allow user to run a certain
command regardless of what dir it is in if it is owned by the
trusted user.
15) Add a flag similar to '-l' but that spits out sudo commands in
a format suitable for cut & paste into sudoers.
16) Someone wants a recursive version of the dir specifier. Ie:
SOME_MODIFIER:/usr/local/ to allow anything under /usr/local to be run.
17) Add an option (-D) to dump the defaults after the sudoers file
has been parsed. Should only be available to root and should
allow a -u user modifier. Maybe dump all of sudoers?
18) Allow /etc/sudoers to be a symlink but require the parent dir to
be root-owned and not writable by anything else. Should really
traverse the tree to the root doing this.
19) Improve interfaces.c STREAMS code (see ntpd's ntp_io.c for hints)
20) If root_sudo is off, still allow sudo -u to non-root users?
21) For AIX, use setpenv() and setpcred() if they exist
http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/libs/basetrf2/setpenv.htm
http://publib16.boulder.ibm.com/pseries/en_US/libs/basetrf2/setpcred.htm
22) Add an insult_path variable that is intialized to "builtin" but that
can point to other files containing an insult count as the first
line and that have a constant record length (sparse files) for
easy seeking.
23) Some way of using a new pty for the program run via sudo would prevent
access to the caller's /dev/tty (but probably makes job control tricky).
24) Maybe have a database of checksums that commands are verified against.
Basically replace the st_ino/st_dev check with a checksum lookup.
25) Look into testing writability of a file via sudoedit *before* doing
the edit; e.g., try opening with O_APPEND.
26) Add Makefile.in bits to autogenerate Solaris and Irix packages
28) Add substitution mechanism in sudoers to subst, e.g. editors for sudoedit
29) Move prototypes to extern.h?
30) Use AC_CHECK_DECLS for systems w/o proper prototypes? Maybe errno too?
31) Flesh out testsudoers and fix glob/opendir issues. Use custom netgroup
code too?
32) Think some more about giving admins a way to test commands for a user
on a specific host with a different sudoers file.
33) Refactor duplicated code in ldap.c into wrapper functions.
34) Return command from command_matches() instead of setting safe_cmnd directly.
35) Roll visudo into sudo ala sudoedit?
36) Add ticket file to ticket dir in non-tty tickets case so we
can mix tty and non-tty ticket schemes.
37) Add support for NOEXEC w/ 64-bit AIX executables.
http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.xlf91a.doc/xlfug/comp64.htm
Note that it is possible to create shared libs w/ both 32bit and 64bit
objects.
38) Revisit debian fqdn diffs.
39) Add gettext() support. Can borrow some translations from PAM.
40) Convert the other capitalized files into .pod so we can get decent html
form them? E.g. README, etc. E.g.
pod2text -l -i0 history.pod > HISTORY
pod2html --noindex history.pod > history.html
Partially done.
41) Use mkstemp() for visudo temp files? Also re-examine locking.
42) Consolidate line wrap code. Use lbuf for sudo log file?
43) How can we distinguish between a bare '\\' and one that is escaping
glob chars? Right now we convert \\ -> \ in the lexer which
causes the confusion.
44) For LDAP entries, should be able to parse the per-command options
since they may affect the outcome (e.g. default_runas).
45) Set usrinfo for AIX, see openssh.
46) Why does testsudoers give wrong line number for parse error?
47) Should send mail if sudoers does not parse
48) Add arg markup to indicate that an arg is a path and treat it specially
regarding cwd.
49) Should -k/-K clear *all* timestamps in tty_ticket mode?
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=306919
Perhaps change the meaning of -k vs. -K in 1.7.
50) Dan says Pam activity should probably be happening after
setkeycreatecon and setexeccon (which may use the keyring or
run external commands). However, this means sendmail
will be executed w/ the new context if user is denied.
51) Add report program (or mode) to print out all permissions on a
per-user basis. Would also be nice to have a diff facility given
two sudoers files.
52) Add rpm spec file that works on suse and redhat
53) Store configure args in sudo binary for -V
Make -V operate in verbose mode with -VV instead of as root?
54) Verify consumers of *list_matches do not treat UNSPEC as true
55) Add FOO=BAR env settings to sudoers. Also m/regexp/ where '/' can be
any char.
56) Consider a more fine-grained setenv option. Perhaps have setenv
and setenv_all where the latter lets you override the blacklist?
Maybe just make it clear that setenv allows the user to run
anything.
57) Merge in Linux audit support but use AUDIT_EXECVE instead of AUDIT_USER_CMD
58) Add setenv_all and SETENV_ALL?
59) Expand prompt early and set def_prompt in pam_init() so that
session modules that prompt can use it.
60) Should sudo remove KRB5CCNAME from the env?
It was added to the keep list for password lookups that use GSSAPI.
Probably best to remove it from the env before exec.
61) See http://iase.disa.mil/stigs/whitepaper/sudowhitepaper-042304.doc
62) in configure distinguish between CPPFLAGS and SUDOERS_CPPFLAGS
63) As part of "make dist" verify that generated files are up to date:
parser, man and cat docs, ChangeLog.
64) Should get_time() fill in tv_usec even if no timespec in stat?
Yes, but then mtime/ctime checks will fail if mtime only has seconds.
Could add mtime_cmp macro.
65) Fix dependencies in devel mode with build dir in doc
66) Factor out select code so we can optionally use poll.
67) bad siglist depedency on hp712?
68) split policy and logging in sample plugin
69) Use libltdl to emulate dlopen on systems without it?
70) In "csh -i" with no tty, any sudo command causes exit after done.
Works on some platforms, not on OpenBSD
71) Better askpass support that includes dialog/warnings
72) Add flag to sudoreplay to select which streams to replay
73) Can we read pending input before closing pty and replay?
74) Replace "sudoers" will "policy" in sudo.pod sensibly
75) Check for accessing closed fds w/ valgrind
|
