Mark E. Perkins wrote:
> Mark E. Perkins wrote:
>> Martin Costabel wrote:
> [...]
>>> Did you perhaps play with your /etc/sudoers file ("sudo visudo")? Maybe
>>> along the lines of Fink FAQ#5.10? The syntax has changed from Panther to
>>> Tiger. On 10.3 it was OK to have a line
>>>
>>> %admin ALL=NOPASSWD: ALL
>>>
>>> Now on 10.4 it must read
>>>
>>> %admin ALL=(ALL) NOPASSWD: ALL
>>>
>>> Otherwise you fail exactly these two tests, although with a different
>>> error message from yours.
>> The entire (useful) contents of my /etc/sudoers is:
>>
>> Defaults env_delete+="PERLLIB PERL5LIB PERL5OPT"
>>
>> # User privilege specification
>> root ALL=(ALL) ALL
>> %admin ALL=(ALL) NOPASSWD: ALL
>>
>> Now I'm wondering if that Defaults line is a problem.
Yes, I confirm that it is the problem.
> As I recall that's
>> an addition to circumvent some privilege escalation problem that came up a
>> couple of years ago (I'm hazy on the particulars at the moment, but
>> probably have some notes on it somewhere).
>
> If I comment out the 'Defaults' line noted above, then 'sudo make test' in
> the fink-0.8.1-full directory completes w/o error. Does the Fink
> installation script set PERL5LIB somewhere (e.g., to get
> Fink/Services.pm)?
>
> BTW, the security advisory against sudo that prompted this is summarized
> here:
>
> <http://www.courtesan.com/sudo/alerts/perl_env.html>
>
> My Tiger installation has sudo v1.6.8p9, which is vulnerable, so I will be
> re-enabling that Defaults line.
Well, maybe some more perl-savvy persons (dmacks?) can tell this with
more authority, but I am not sure whether fink is compatible with this
"security advisory". Fink is a perl script that is executed with su
privileges, and it needs the environment variable PERL5LIB.
With the idea explained in that advisory, anyone allowed to run fink on
your computer can indeed execute arbitrary perl code, but they can do
this anyway, having admin privileges. I don't quite understand why this
is called a bug and what is there to fix.
Of course, with my limited knowledge of perl I cannot exclude that it is
also possible that fink runs fine with this Defaults line in sudoers,
and that only these two test fail during bootstrapping, but I would not
bet on it.
--
Martin
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Fink-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fink-users
