1PORTNAME=	sudo
2PORTVERSION=	1.9.17p2
3CATEGORIES=	security
4MASTER_SITES=	SUDO
5
6MAINTAINER=	ports@MidnightBSD.org
7COMMENT=	Allow others to run commands as root
8WWW=		https://www.sudo.ws/
9
10LICENSE=	sudo
11LICENSE_NAME=	Sudo license
12LICENSE_FILE=	${WRKSRC}/LICENSE.md
13LICENSE_PERMS=	dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
14
15USES=		cpe libtool
16CPE_VENDOR=	todd_miller
17USE_LDCONFIG=	yes
18GNU_CONFIGURE=	yes
19LDFLAGS+=	-lgcc
20
21CONFIGURE_ARGS=	--sysconfdir=${TRUE_PREFIX}/etc \
22		--with-ignore-dot \
23		--with-tty-tickets \
24		--with-env-editor \
25		--with-logincap \
26		--with-long-otp-prompt \
27		--with-rundir=/var/run/sudo
28
29OPTIONS_DEFINE=	LDAP INSULTS DISABLE_ROOT_SUDO DISABLE_AUTH NOARGS_SHELL \
30		AUDIT OPIE PAM PYTHON NLS SSSD DOCS EXAMPLES
31OPTIONS_RADIO=	KERBEROS
32OPTIONS_DEFAULT=	AUDIT PAM
33OPTIONS_SUB=	yes
34
35INSULTS_DESC=	Enable insults on failures
36DISABLE_ROOT_SUDO_DESC=	Do not allow root to run sudo
37DISABLE_AUTH_DESC=	Do not require authentication by default
38NOARGS_SHELL_DESC=	Run a shell if no arguments are given
39AUDIT_DESC=	Enable BSM audit support
40KERBEROS_DESC=	Enable Kerberos 5 authentication (no PAM support)
41OPIE_DESC=	Enable one-time passwords (no PAM support)
42PYTHON_DESC=	Enable python plugin support
43SSSD_DESC=	Enable SSSD backend support.
44
45PAM_PREVENTS=	OPIE GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT
46PAM_PREVENTS_MSG=	PAM cannot be combined with any other authentication plugin
47
48LOGFAC?=	authpriv
49CONFIGURE_ARGS+=	--with-logfac=${LOGFAC}
50
51# This is intentionally not an option.
52# SUDO_SECURE_PATH is a PATH string that will override the user's PATH.
53# ex: make SUDO_SECURE_PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin"
54.if defined(SUDO_SECURE_PATH)
55CONFIGURE_ARGS+=	--with-secure-path="${SUDO_SECURE_PATH}"
56.endif
57
58NLS_USES=	gettext
59NLS_CONFIGURE_ENABLE=	nls
60NLS_LDFLAGS=	-L${LOCALBASE}/lib -lintl
61NLS_CFLAGS=	-I${LOCALBASE}/include
62
63INSULTS_CONFIGURE_ON=	--with-insults
64INSULTS_CONFIGURE_ON+=	--with-all-insults
65
66LDAP_USE=	OPENLDAP=yes
67LDAP_CONFIGURE_ON=	--with-ldap=${PREFIX}
68SUDO_LDAP_CONF?=	ldap.conf
69LDAP_CONFIGURE_ON+=	--with-ldap-conf-file=${PREFIX}/etc/${SUDO_LDAP_CONF}
70
71DISABLE_ROOT_SUDO_CONFIGURE_ON=	--disable-root-sudo
72DISABLE_AUTH_CONFIGURE_ON=	--disable-authentication
73NOARGS_SHELL_CONFIGURE_ENABLE=	noargs-shell
74AUDIT_CONFIGURE_WITH=	bsm-audit
75PAM_CONFIGURE_ON=	--with-pam
76OPIE_CONFIGURE_ON=	--with-opie
77PYTHON_USES=	python
78PYTHON_CONFIGURE_ENABLE=	python
79SSSD_CONFIGURE_ON=	--with-sssd
80SSSD_RUN_DEPENDS=	sssd:security/sssd
81
82OPTIONS_RADIO_KERBEROS=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT
83GSSAPI_BASE_USES=	gssapi
84GSSAPI_BASE_CONFIGURE_ON=	--with-kerb5=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
85GSSAPI_HEIMDAL_USES=	gssapi:heimdal
86GSSAPI_HEIMDAL_CONFIGURE_ON=	--with-kerb5=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
87GSSAPI_MIT_USES=	gssapi:mit
88GSSAPI_MIT_CONFIGURE_ON=	--with-kerb5=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
89# This is intentionally not an option.
90# SUDO_KERB5_INSTANCE is an optional instance string that will be appended to kerberos
91# principals when to perform authentication. Common choices are "admin" and "sudo".
92.if defined(SUDO_KERB5_INSTANCE)
93CONFIGURE_ARGS+=	--enable-kerb5-instance="${SUDO_KERB5_INSTANCE}"
94.endif
95
96.include <bsd.mport.options.mk>
97
98.if ${ARCH} == "arm"
99CONFIGURE_ARGS+=	--disable-pie
100.endif
101
102post-patch:
103	@${REINPLACE_CMD} -E '/install-(binaries|noexec):/,/^$$/ \
104		s/\$$\(INSTALL\)/& ${STRIP}/;s/-b\~/-b ~/' \
105		${WRKSRC}/src/Makefile.in
106	@${REINPLACE_CMD} -e 's,$$(srcdir)/sudoers2ldif $$(DESTDIR)$$(docdir),$$(srcdir)/sudoers2ldif $$(DESTDIR)$$(bindir),' \
107		${WRKSRC}/plugins/sudoers/Makefile.in
108
109post-install:
110	${INSTALL_DATA} ${FILESDIR}/pam.conf ${PREFIX}/etc/pam.d/sudo.default
111	${MV} ${PREFIX}/etc/sudo.conf ${PREFIX}/etc/sudo.conf.sample
112	${MV} ${PREFIX}/etc/sudo_logsrvd.conf ${PREFIX}/etc/sudo_logsrvd.conf.sample
113	${RM} ${PREFIX}/etc/sudoers
114	${STRIP_CMD} ${PREFIX}/bin/cvtsudoers
115	${STRIP_CMD} ${PREFIX}/bin/sudoreplay
116	${STRIP_CMD} ${PREFIX}/sbin/sudo_logsrvd
117	${STRIP_CMD} ${PREFIX}/sbin/sudo_sendlog
118	${STRIP_CMD} ${PREFIX}/sbin/visudo
119.for f in audit_json.so group_file.so libsudo_util.so sudoers.so system_group.so
120	${STRIP_CMD} ${PREFIX}/libexec/sudo/${f}
121.endfor
122
123post-install-PYTHON-on:
124	${STRIP_CMD} ${FAKE_DESTDIR}${PREFIX}/libexec/sudo/python_plugin.so
125
126.include <bsd.port.mk>
127