1------------------- 2What's new for version 3.30.3: 3 4 A. Corrected various Error() invocations. 5 6------------------- 7What's new for version 3.30.2: 8 9 A. Added helpful casts for some debug prints. 10 B. Now defining _DEFAULT_SOURCE as well as _BSD_SOURCE 11 C. Added a couple of (void) casts that didn't shut up an unwelcome warning. 12 13------------------- 14What's new for version 3.30.1: 15 16 A. Better pam test in configure. 17 18------------------- 19What's new for version 3.30.0: 20 21 A. Added '-t' option, to test if a command exists, and if 22 so if this user may execute it at this moment. 23 24------------------- 25What's new for version 3.28.0: 26 27 A. Added '-r requiredpath' option, to allow a program to insist 28 that the FullPath be the same program as the requiredpath, 29 else it's an error. 30 31------------------- 32What's new for version 3.27.0: 33 34 A. Modified 'super -c' to exit with non-zero exit code 35 if there is a syntax error. 36 Requested by Gordon Lack, gml4410@ggr.co.uk 37 38 B. Performance enchancement: store various user/group/host/pattern 39 data in a hash table, so as to avoid many repeated NIS calls 40 when working with a large super.tab file. "The result was that 41 I cut the number of NIS calls made when running through an 42 entire file's tests (super with no args) from 4230 to 177. 43 This has a *big* effect on the elapsed time too." 44 (From Gordon Lack, gml4410@ggr.co.uk) 45 46 C. Additional syntax checking: wherever super does 47 brace-globbing, it explicitly checks for balanced braces. 48 49------------------- 50What's new for version 3.26.3: 51 52 A. Fix for 'super -c' when SUPERDIR has been set to other 53 than /usr/local/lib. (From Gordon Lack, gml4410@ggr.co.uk) 54 55------------------- 56What's new for version 3.26.2: 57 58 A. Fix for HP-UX 11i in trusted mode, from 59 Mike Cross <Mike.D.Cross@gsk.com>. 60 61------------------- 62What's new for version 3.26.1: 63 64 A. Fix for super variable re-definition bug. 65 When changing the definition of a variable, 66 super deallocated a string that hsearch() tried to reference. 67 Bug discovery and fix by Michael Steffens <michael.steffens@hp.com>. 68 69------------------- 70What's new for version 3.26.0: 71 72 A. Cumulation of 3.25.x changes. 73 74------------------- 75What's new for version 3.25.3: 76 77 A. Fixed reference to get_pam() that shouldn't be present when 78 building w/o pam support. 79 Reported by Gabor Z. Papp (gzp@papp.hu) 80 81------------------- 82What's new for version 3.25.2: 83 84 A. Fixed bug in 3.25.1... 85 86------------------- 87What's new for version 3.25.1: 88 89 A. Fixed handling of argMMM-NNN options. 90 Problem reported by cmoulin@simplerezo.com. 91 92------------------- 93What's new for version 3.25.0: 94 95 A. Super tries to obtain the user's authentication data early (before 96 it yields setuid-root privileges), and it does this even before 97 reading the super.tab file. If super is unable to obtain this info, 98 it will no longer print error messages, unless the specific command 99 requires user authentication. 100 101 B. Super tries to record the time of the user's authentication, which 102 allows it to trust the same user for some additional time w/o 103 re-entering authentication data. If it's unable to record the 104 timestamp, it doesn't generate error messages unless this particular 105 command has the renewtime option set (typically this is done 106 as a global option). 107 108 C. Cleaned up some error messages / warnings. 109 110------------------- 111What's new for version 3.24.1: 112 113 A. BUGFIX for 3.24.0 / shell patterns syntax enhancement: 114 115 The last version used this goofy pattern: 116 :if $PATTERNS == shell :global arg1-99="[-/:+._a-zA-Z0-9]*" 117 Of course, this only restricts the first character to the desired one; 118 ordinary shell patterns can't express the desired restrictions at all! 119 120 In order to let shell patterns do the desired kind of matching, 121 I've added new syntax for shell patterns: when the pattern is 122 [[...]] -- that is, it begins with "[[" and ends with "]]" -- 123 then it's a special case that means each and every character in the 124 string must match the pattern [...]. The new rule in the super.tab 125 file can now be: 126 :if $PATTERNS == shell :global arg1-99="[[-/:+._a-zA-Z0-9]]" 127 :if $PATTERNS != shell :global arg1-99="^[-/:+._a-zA-Z0-9]*$$" 128 129 130------------------- 131What's new for version 3.24.0: 132 A. Changed option args and nargs to be global as well as local. 133 (Suggested by Henrik Strom <henrik@telenor.com>) 134 135 B. Added builtin variable PATTERNS to carry the value of the 136 global patterns option. 137 138 Combined with (A), your super.tab file can include these entries 139 for limiting what can be done without local settings: 140 141 # By default, allow only 0 or 1 argument 142 :global nargs=0-1 143 # By default, each argument must be a simple word with no 144 # characters that might be srecial to a shell: 145 :if $PATTERNS == shell :global arg1-99="[-/:+._a-zA-Z0-9]*" 146 :if $PATTERNS != shell :global arg1-99="^[-/:+._a-zA-Z0-9]*$$" 147 148 149------------------- 150What's new for version 3.23.0: 151 A. Fixed format string vulnerability. 152 (Incremented version number instead of patch number to emphasize 153 this change is important.) 154 (From Max Vozeler <max@hinterhof.net>, via Robert Luberda 155 <robert@debian.org>) 156 157------------------- 158What's new for version 3.22.2: 159 A. Better syslog handling. Instead of compile-time choice of 160 the rsyslog() vs syslog() routines, the program now makes the 161 selection at runtime. By default, the normal openlog() and 162 syslog() functions are used. However, if a loghost is named 163 (using global option rlog_host=xxxx) before any syslog message 164 is generated, the functions ropenlog() and rsyslog() are used instead. 165 166------------------- 167What's new for version 3.22.1: 168 A. Bugfix for new options euid and egid (added 3.21.0), in which one of 169 the id's would overwrite the other. 170 (From Robert Luberda <robert@debian.org>) 171 172 B. Bugfix for missing save/restore of errno, causing an incorrect 173 error message. 174 (From Robert Luberda <robert@debian.org>) 175 176 C. Bugfix: remove unwanted override of syslog facility and priority. 177 (From Robert Luberda <robert@debian.org>) 178 179 D. Bugfix: if your system didn't support sysinfo(SI_SYSNAME, ...), 180 there was a missing return statement in add_sysinfo_variables(). 181 (From Gordon Lack, gml4410@ggr.co.uk) 182 183 E. Bugfix: Linux pw lookup didn't have fallback if /etc/shadow was missing. 184 (From Gordon Lack, gml4410@ggr.co.uk) 185 186 F. Long series of minor edits to remove all compiler warnings 187 generated by gcc -Wall. 188 (From Robert Luberda <robert@debian.org>) 189 190------------------- 191What's new for version 3.22.0: 192 A. Added flexibility to syslog facility/level setting; e.g. auth.local1 193 is now legal, in addition to "LOG_AUTH|LOG_LOCAL1". 194 B. Fixed bug that disallowed whitespace in strings such as that in A. 195 196------------------- 197What's new for version 3.21.5: 198 A. Fixed a minor glitch in the configure script. 199 200------------------- 201What's new for version 3.21.4: 202 A. Fixed install of the "barebones.tab" file. 203 204------------------- 205What's new for version 3.21.2: 206 A. Generalized support for passwords: 207 a) all encrypted password beginning "$" are now handled correctly 208 (hence Linux, *BSD, Solaris 9, ...) 209 b) extended DES (encrypted password begins "_") now handled correctly. 210 211 B. Fixd approval checks for root. Root was being given permission 212 to execute commands that explicitly said !root. 213 214 C. Added some notes to man page. 215 216 D. Minor improvement to error messages. 217 218------------------- 219What's new for version 3.21.0: 220 A. Added options euid and egid to allow setting the effective 221 uid and gid separately from changing the real id's. A few very old 222 versions of Unix don't provide the setre[ug]id functions, and 223 attempting to use the e{u,g}id options will cause an error. 224 225 B. Fixed reading of passwd/shadow files so that the format $n$salt$passwd 226 is understood on Linux systems. 227 228 C. Added FreeBSD passwd handling, again to recognize fmt $n$salt$passwd. 229 230------------------- 231What's new for version 3.20.1: 232 A. ICANON is no longer disabled in getpass() -- otherwise, getpass() 233 hung for some os's. 234 (From Gordon Lack, gml4410@ggr.co.uk) 235 B. Fixed some missing return values. 236 (From Michael Steffens michael.steffens@hp.com) 237 238------------------- 239What's new for version 3.20.0: 240 A. Typo in utils.c would cause super to use syslog level LOG_NEWS 241 instead of LOG_RFS, if you tried to select the latter. 242 243------------------- 244What's new for version 3.19.0: 245 A. SECURITY FIX: Patched syslog use error. All previous versions 246 allow local root exploit when syslog() use is enabled. 247 Workaround for earlier versions: put "syslog=n" into :global 248 line of the super.tab file. 249 250------------------- 251What's new for version 3.18.0: 252 A. Per user request, added option to force passwords to be 253 read from stdin. 254 255------------------- 256What's new for version 3.17.2: 257 A. Minor man page improvements. 258 259------------------- 260What's new for version 3.17.1: 261 A. Double-checks on uid and gid, to make sure they were really 262 changed as they should have been. 263 264------------------- 265What's new for version 3.17.0: 266 267 A. argNNN matching now accepts brace-enclosed list 268 (from Boleslav Bobcik, xbobcik@informatics.muni.cz) 269 270 B. If your system-supplied regex is POSIX-compatible, then posix 271 regular expressions are now supported; use 272 :global patterns=posix 273 to enable them. The default is case-sensitive, basic regular 274 expressions. To get extended regular expressions (see your 275 POSIX regular expression man page), use 276 :global patterns=posix/extended 277 To add ignore-case, use 278 :global patterns=posix/extended/icase 279 280 281------------------- 282What's new for version 3.16.1: 283 284 A. pam.o was listed twice in the Makefile. 285 (from Boleslav Bobcik, xbobcik@informatics.muni.cz) 286 287 B. Missing comment delimiters around an #ifdef comment. 288 (from Boleslav Bobcik, xbobcik@informatics.muni.cz) 289 290------------------- 291What's new for version 3.16.0: 292 293 This is the stable culmination of the changes in the 3.15.x enhancements. 294 The previous stable version was 3.14.0. 295 The last version to have a known security problem was 3.12.0. 296 297 In brief, the changes include the following (the version number tells 298 when the capability was added; check that section for more info): 299 300 301 A. Added PAM support. (3.15.5, 3.15.6) 302 303 C. The use of password=y|n is deprecated; it's been replaced by the 304 more general auth=y|n and authtype=xxx mechanism. (3.15.5) 305 306 D. **** BEHAVIOR CHANGE FOR ROOT **** The new behavior is *usually* 307 the same as the old behavior, but give you more control. (3.15.4) 308 309 E. Added support for shadow passwords in Digital Unix 4.x. (3.15.3) 310 311 F. Fixes for HP-UX 11.0 with tcb enabled. (3.15.0, 3.15.7) 312 313 G. Fixed an error in printing a message when super is _not_ running 314 setuid-root. (Hence this is not a security fix.) (3.15.2) 315 316 H. Added option to let you specify the prompt for password (3.15.2) 317 318 I. Improved description of some envvars. (3.15.2) 319 320 J. Corrected processing of "die=message" option. (3.15.2) 321 322 K. Minor readability improvements. (3.15.0) 323 324 L. Trivial changes to the format of the -h and -H outputs. (3.15.6) 325 326------------------- 327What's new for version 3.15.7: 328 329 A. Modifications to support HP-UX 11.0 with tcb: it uses crypt() 330 instead of bigcrypt() [the latter is used by HP-UX 10.x. 331 332------------------- 333What's new for version 3.15.6: 334 335 A. Trivial changes to the format of the -h and -H outputs. 336 337 B. Added "--disable-pam" configure option to disable PAM support, 338 even if compile host has PAM. Useful if the executable is 339 going to be used on hosts that don't have the PAM shareable libraries. 340 341------------------- 342What's new for version 3.15.5: 343 344 A. Added Linux PAM support. 345 To support PAM, there are new options (global or local): 346 347 auth=y|n (default=n; replaces password=y|n) 348 349 authtype=password|pam (default=password) 350 351 authprompt="<some string>" 352 353 If you want to use the same authentication method for all 354 the commands that require user authentication, it's convenient to 355 put authtype=xxx on a :global option line, and then you only 356 need to add "auth=y" on the lines that require options. 357 358 B. The use of password=y|n is deprecated. 359 To maintain backwards-compatibility, the following expressions 360 are equivalent: 361 362 password=y <--> auth=y authtype=password 363 364 password=n <--> auth=n 365 366------------------- 367What's new for version 3.15.4: 368 369 A. **** BEHAVIOR CHANGE FOR ROOT **** The rule for 'root' using super 370 has been changed! The new behavior is *usually* the same as the 371 old behavior, but the new rules give you more control over 372 root. 373 374 New behavior: super acts as if the very first pattern to match 375 is "root", and then applies its ordinary pattern-matching rules. 376 The resul is a nice simplification & clarification of the rules: 377 root: default allow 378 others: default deny 379 380------------------- 381What's new for version 3.15.3: 382 383 A. Added support for shadow passwords in Digital Unix 4.x. 384 385------------------- 386What's new for version 3.15.2: 387 388 A. Fixed an error in printing a message when super is _not_ running 389 setuid-root. (Hence this is not a security fix.) 390 391 B. Added option authprompt="some string", to let you specify the 392 prompt for password. Variable substitution is done on the 393 message before printing. 394 395 C. Improved description of ORIG_USER, ORIG_LOGNAME, and ORIG_HOME, 396 to emphasize that these values are constructed by super and 397 hence safe to use. 398 399 D. Corrected processing so that a "die=message" option doesn't 400 stop processing when in give-help mode. 401 402 E. Modified the processing of "die=message" so that the message 403 is printed without any surrounding foo-fah-rah: just the super.tab 404 message and nothing else. Variable substitution is done on the 405 message before printing. 406 407------------------- 408What's new for version 3.15: 409 410 A. Minor readability improvements. 411 412 B. Fix for HP-UX 11.0 with tcb enabled: the argument list of the 413 (undocumented but essential) getpasswd() function has changed 414 between 10.20 and 11.0. 415 416------------------- 417What's new for version 3.14.0: 418 419 *** NOTE *** 420 Super has adopted the Linux version numbering convention. That is, the 421 odd-numbered minor versions are development versions, and even-numbered 422 minor versions are stable releases (super uses version numbers in the 423 format major.minor.patchlevel). 424 425 This is the stable culmination of the changes in the 3.13.x enhancements. 426 The previous stable version was 3.12.2. 427 The last version to have a known security problem was 3.12.0. 428 429 In brief, the changes include the following (the version number tells 430 when the capability was added; check that section for more info): 431 432 A. A new file, super.init, is now processed by super! (3.13.6) 433 434 B. New command-line option, `-o file', for symlinks to 435 per-user commands. (3.13.6) 436 437 C. Allow 'loginname:', in addition to 'loginname:cmd' (3.13.6) 438 439 D. Added CALLER and CALL_HOME builtin variables. (3.13.10) 440 441 E. Added new builtin variables: HOST, SUPER_OWNER, SUPER_HOME. (3.13.6) 442 443 F. Added new variable IS_USERTAB. (3.13.7) 444 445 G. New super.tab option, checkvar=xxx, to require user to enter 446 variables. (3.13.6) 447 448 H. New super.tab command, :getenv, to import environment 449 variables. (3.13.6) 450 451 I. Added owner=xxx and group=yyy options to the :include 452 command. (3.13.6) 453 454 J. Added new global command ":die" to force immediate exit. (3.13.6) 455 456 K. Moved get_encrypted_passwd() before super drops privs. (3.13.6) 457 458 L. Modifications to support HP-UX 10.20 running with tcb. (3.13.6) 459 460 M. Patched a dumb bug -- didn't initialize -o flag to null ptr. (3.13.9) 461 462 N. Patched dumb bug in the 3.13.6/3.13.7 code. (3.13.8) 463 464 O. A variety of bugfixes. (3.13.6) 465 466------------------- 467What's new for version 3.13.10: 468 469 A. Added two built-in variables that can be helpful super.tab files: 470 $CALLER is the login name of the of account invoking super, and 471 $CALLER_HOME is the home directory of $CALLER. Sample use: 472 473 474 sam /usr/sbin/sam group~operator uid=0 \ 475 env=DISPLAY \ 476 setenv=XAUTHORITY=$CALLER_HOME/.Xauthority 477 478 Here, the "operator" group can execute 'sam' as root, and the GUI 479 will display at the caller's display (due to env=DISPLAY). Since 480 the XAUTHORITY envvar is set to the caller's .Xauthority file, this 481 will give the caller access to the same displays to which s/he already 482 has access. 483 484------------------- 485What's new for version 3.13.9: 486 487 A. Patched another dumb bug -- didn't initialize -o flag to null ptr. 488 489------------------- 490What's new for version 3.13.8: 491 492 A. Patched dumb bug in the 3.13.6/3.13.7 code -- failed to check 493 for null pointer. 494 495------------------- 496What's new for version 3.13.7: 497 498 A. Added new variable IS_USERTAB. This has the value "yes" if 499 super is processing a `user:cmd'-type command, and "no" otherwise. 500 The allows the super.init to act differently depending on how it 501 is being invoked. 502 503------------------- 504What's new for version 3.13.6: 505 506 A. A new file, super.init, is now processed by super! 507 It is located in the same directory as super.tab, and must be owned 508 by root and be world-readable. If it doesn't exist, the usual 509 processing of super.tab and per-user .supertab files is done. 510 If super.init does exist, it is processed exactly as if each super.tab 511 and per-user .supertab file began with: 512 :include /etc/super.init owner=root 513 (except that "/etc" is replaced with the super.tab directory.) 514 This allows one to have a uniform configuration file applied 515 to every super-executed command. Note that the configuration file 516 should _only_ contain entries that are appropriate for both 517 root-executed super commands and per-user super commands. 518 It is not a good idea to include commands in the super.init file; 519 it should preferably contain only the builtin colon-commands 520 (:global, :define, :if, :die, etc). 521 522 B. New command-line option, `-o file', for symlinks to per-user commands. 523 The `-o file' makes it possible to create symlinks to per-user 524 commands, analogous to the manner in which super interprets 525 symlinks to itself. For instance, if "xyz" is a symlink to the 526 super command, then invoking "xyz" is a shorthand for "super xyz". 527 Similarly, the `-o file' option can be used to make the following 528 completely equivalent: 529 530 super joe:xyz [args] (1) 531 532 xyz [args] (2) 533 534 For this method to work, "xyz" must be a symlink to the desired 535 .supertab file (here, ~joe/.supertab), and the .supertab file must 536 be made executable and begin with the line 537 #! /usr/bin/super -o 538 (Of course you should replace /usr/bin/super with the actual path to 539 super.) If the "#!" line would be longer than the typical Unix limit 540 of 32 characters, you can instead start the .supertab file with: 541 542 #! /bin/sh 543 # Keep this backslash -> \ 544 exec /long/path/to/the/super/executable -o $0 ${1+"$@"} 545 ... 546 547 (This takes advantage of the fact that super allows comments to 548 be backslash-continued, but the shell doesn't.) 549 550 This works as follows: if /path/to/xyz is a symlink to some 551 user's .supertab file, and the .supertab file begins with 552 "#! /path/to/super -o", then the shell will invoke super with 553 arguments something like 554 super -o /path/to/xyz [args] 555 Super checks that /path/to/xyz is a link to a real .supertab file, 556 and then always turns the last part of the path (here "xyz") into 557 the command to execute. 558 ** Security Warning ** Note that the caller is trusting that the 559 .supertab file will actually begin `#! /path/to/super', and not 560 be changed to contain something like `rm *"! Of course, this 561 doesn't apply to the non-symlink form, `super joe:xyz'. 562 563 C. Allow 'loginname:', in addition to 'loginname:cmd' 564 A modification to the syntax for invoking per-user commands allows 565 you to invoke help listings for the per-user files. The original 566 syntax was restricted to something like this: 567 super joe:xyz 568 which executes command xyz from joe's .supertab file. 569 570 The new rule is that if the "xyz" part can be missing: 571 super joe: 572 or 573 super -H joe: 574 gets command listings for joe's .supertab just as plain "super" or 575 "super -H" gets command listings for the normal super.tab file. 576 577 578 D. New super.tab option, checkvar=xxx, to require user to enter variables. 579 The checkvar=xxx option tells super to prompt the user to enter 580 the value of one or more variables (here, the variable xxx). 581 For example, you might have a command `super shutdown' which halts 582 the computer. If you execute this on the wrong host there may 583 be some very annoyed users! The super.tab option checkvar=HOST 584 may be helpful here; it causes super to prompt 585 586 Super needs you to enter the HOST variable before proceeding. 587 Enter HOST (<Return> for reminder): 588 589 If you press <Return> or the wrong value, super re-prompts with: 590 591 Enter HOST (expecting `myhost'): 592 593 This allows you to ensure that the caller really knows the host on 594 which the command is executing -- a useful thing if the command will 595 shutdown the system! Any super.tab variable can be used in this 596 kind of check. Note that the value isn't anything like a secret; 597 it's simply intended to help avoid gross embarrassment (or worse) 598 by discouraging errors. 599 600 E. New super.tab command, :getenv, to import environment variables. 601 The :getenv command allows a super.tab file to import environment 602 variables into super.tab variable definitions. The environment 603 variables are not allowed unless the definition is restricted to 604 super's normal set of "safe" characters. This provides two advantages: 605 606 (a) it's a safe alternative to allowing users' environment variables 607 to be passed unchecked to programs, because you can do: 608 609 :getenv VAR1 VAR2 610 Cmd FullPath user~xyz setenv=VAR1=$VAR1,VAR2=$VAR2 611 612 ...and the program will receive VAR1 and VAR2 only if they 613 have "safe" values, of reasonable length. 614 615 (b) It allows interesting new constructs in super.tab files. 616 617 F. Added owner=xxx and group=yyy options to the :include command. 618 The use is 619 620 :include FileName [owner=xxx] [group=yyy] 621 622 This allows your per-user .supertab file to include files that 623 are owned by some user xxx (owner=xxx) and/or are writable by group 624 yyy (group=yyy). This can be useful for a collection of accounts 625 that are operated together as a single "project" -- a variety of 626 accounts can share .supertab files from the trusted user xxx or 627 group yyy. Note: (1) The regular root-owned super.tab file can 628 also use this construct, but it's not a good idea. Don't do it. 629 (2) Beware of the transitive nature of this trust: the file owned 630 by xxx can in turn include a file owned by yet another user. 631 632 G. Added new builtin variables. 633 The new variables are: 634 i) HOST, the unqualified form of HOSTNAME. (Note that HOST and 635 HOSTNAME will be the same if the system doesn't use qualified 636 names for HOSTNAME.) 637 ii) SUPER_OWNER, the owner of the top-level super.tab file. 638 This is root for the default super.tab file, or the owner 639 of the .supertab file in a per-user command. 640 iii) SUPER_HOME, the home directory of $SUPER_OWNER. 641 642 H. Added new global command ":die" to force immediate exit. 643 The use is 644 :die message 645 The purpose is to allow a super.tab file to force an exit without 646 resorting to syntactically clumsy methods. For example, you can 647 use a line like this: 648 649 :if $HOST != myhost :die "For use on myhost only; this is $HOST!" 650 651 Without the :die command, one would have to write 652 653 :global patterns=shell 654 :if $HOST != myhost * /dev/null user~* die="For use on myhost only!" 655 656 ...which is unnecessarily hard to read and write. 657 658 I. A variety of bugfixes. 659 These include: change to read password before super.tab uid=xxx 660 causes uid to change to non-root; propagate -1 error return after 661 canonicalize hostname failures; fixed generating of timestamp directory; 662 fixed segfault occurring when printing wildcard commands w/o any "info". 663 Patches from Rein Tollevik (Rein.Tollevik@si.sintef.no). 664 665 J. Moved get_encrypted_passwd() to happen before super drops privs. 666 This allows per-super .supertab files to use password-checking 667 (from Geoffrey A. Lowney, Geoffrey.A.Lowney@Boeing.com) 668 669 K. Modifications to handle HP-UX 10.20 running with tcb 670 (Trusted Computing Base). Patches based on code from Minh Tran 671 <mtran@tnl.com.au>. 672 673------------------- 674What's new for version 3.13.0 .. 3.13.5: 675 These versions were never formally released. 676 677------------------- 678What's new for version 3.12.2: 679 680 A. Fixed configure script for AIX. 681 Problem reported by Klaus Wacker (wacker@Physik.Uni-Dortmund.DE). 682 683 B. Fixed error interpreting the argv0 option, and an error implementing 684 it. The argv0 option was being incorrectly interpreted as an 685 invalid arg[MMM-]NNN option. 686 Problem reported by Hadmut Danisch (hadmut@danisch.de). 687 688 C. Slightly improved help info. 689 690 D. Slightly improved man page. 691 692 E. Modifications to handle shadowed passwords properly on HP-UX 10.x 693 and 11.x. 694 695 F. Modifications to handle shadowed passwords properly on Linux. 696 Problem report and bugfix from Edgar Nielsen <edgar@netearnings.com>. 697 698------------------- 699What's new for version 3.12.1: 700 701 A. Yet another buffer-overrun fix. 702 Problem reported by root@sekure.org (http://www.sekure.org, aka 703 the Brazilian Information Security Team). 704 705 Super now has very strict option-checking, as follows: 706 707 i) super now limits the length of each option passed to it (note that 708 this is not the same as limiting the length of arguments passed 709 to the commands invoked by super for the user); 710 711 ii) super now limits the total length of all options passed to it 712 (again, this is separate from limiting the length of arguments 713 passed to commands invoked by super); 714 715 iii) ensures that all its option characters are from a limited set. 716 717 Items (i) and (ii) ensure that users can't pass execessively long 718 strings. Item (iii) is just insurance :-) 719 720 B. When super is running in debug mode, it won't execute any commands, but 721 it will process user-supplied super.tab files. This makes potential 722 security holes, because it might be possible that nasty data can be 723 passed through a user-supplied super.tab file, just like there were 724 buffer-overruns from command-line arguments. Therefore, super will 725 no longer remain as root when checking a user-supplied super.tab file. 726 Instead, it reverts to the caller's real uid, and prints a large 727 explanatory message like the following: 728 729 ** Since you have supplied a super.tab file that isn't the default, 730 ** and your real uid isn't root, we're going to change back to your 731 ** real uid for this test. That protects us against attacks via 732 ** nasty constructions inside user-supplied super.tab files. 733 ** Not that we don't trust you... 734 735 ** Now using: ruid=545 euid=545 ** 736 737------------------- 738What's new for version 3.12.0: 739 740 A. This is supposed to be a nice and stable release, reflecting mainly 741 the accumulated set of changes across 3.11. Those changes include 742 not only patches but also enough new features that I changed the 743 minor number to indicate that this now differs noticeably from 3.11.0. 744 Changes from 3.11 include: 745 i) the crucial buffer overrun patches; 746 ii) various other bugfixes; 747 iii) modifications to configure properly under more operating systems; 748 iv) the following features, added since 3.11.0: 749 --disable-rsyslog ...compile time switch. 750 -U, -G, -M ...runtime switches for checking config files. 751 syslog_error ...runtime configuration option. 752 syslog_success ...runtime configuration option. 753 argv0 ...runtime configuration option. 754 755 B. Fix for a typo when checking the argument to the -U flag. 756 Problem and fix from Benoit Speckel (Benoit.Speckel@IReS.in2p3.fr). 757 758 C. Fix for insufficient setup when using the -U and -G options. 759 Problem and fix from Gordon Lack (gml4410@ggr.co.uk). 760 761------------------- 762What's new for version 3.11.9: 763 A. Super was failing on per-user super commands (using the 764 ~/.supertab file) because it tried to change supplementary 765 groups after dropping root privs. 766 Problem & fix from Gordon Lack (gml4410@ggr.co.uk). 767 768 B. The new compile-time switch --disable-rsyslog turns off the 769 use of the rsyslog() function, so that super only uses normal 770 syslog(). rsyslog() has been improved to use gethostname() 771 instead of "localhost" as a default. 772 773 C. Bugfix: additional, new envvar checking had a bug that led to 774 segfaults, because it passed a nil ptr to strlen(). 775 Reported by swift@alum.mit.edu via the Debian bug-tracking system. 776 777 D. New global options syslog_error and syslog_success for customizing 778 syslog() output levels. 779 By default, if logging to syslog is enabled, super logs errors 780 at LOG_ERR and successful executions at LOG_INFO. The options 781 syslog_error=xxx 782 syslog_success=yyy 783 set the error and success codes to xxx and yyy, respectively. 784 Here, xxx and yyy are any of the usual syslog() priority and/or 785 facility codes, e.g. 786 syslog_error=LOG_ERR 787 syslog_error=LOG_LOCAL2|LOG_ERR 788 syslog_success="LOG_LOCAL7 | LOG_INFO" 789 The LOG_xxx words can be separated by whitespace and/or "|". 790 Super doesn't know what are sensible codes -- it's up to the 791 super.tab writer to choose meaningful values. For instance, 792 if you used the following (please don't!) 793 syslog_success="LOG_LOCAL1 | LOG_LOCAL7 | LOG_INFO | LOG_ERR" 794 then you will get all those values or'd together and passed to syslog(). 795 796 E. Fixes for compiling under FreeBSD. The encryption buffer and salt 797 buffer were extended to 256 bytes each -- plenty long under any 798 current Unix, and hopefully for some time to come. 799 From David O'Brien <obrien@NUXI.com> 800 801 F. Patches for various glitches, such as using %ld instead of %d, 802 %ld% instead of %ld, etc. From David O'Brien <obrien@NUXI.com>. 803 804------------------- 805What's new for version 3.11.8: 806 A. Fixed segfault that arose when handling certain combinations of 807 globally- and locally-defined environment variables. 808 Problem reported by Gordon Lack (gml4410@ggr.co.uk). 809 810------------------- 811What's new for version 3.11.7: 812 A. CRITICAL SECURITY FIXES: two separate buffer overruns allowed local 813 root access. All versions between 3.9.6 and 3.11.6, inclusive, 814 are affected. Buffer overrun #1 was reported by Gordon Lack 815 (gml4410@ggr.co.uk); overrun #2 was reported by iss-xforce@iss.net. 816 817 B. Patches for BSD Net/2. Contributed by David O'Brien <obrien@NUXI.com>. 818 819 C. Related to (B), the prototyping macro __P() has been replaced by P__(), 820 so that it will be legitimate on all conforming standard C 821 implementations. 822 823 D. Patches for Solaris 2.6. (I have become convinced that Sun has an 824 engineer whose job title is something like Engineer in Charge of 825 Modifying Standard Include Files So As To Ensure That Configure 826 Scripts Will Break With Each Successive Solaris Release.) 827 828 E. A few more minor modifications to the documentation (trying to make 829 it easier to wade through). 830 831 F. Some fixes for the Makefile's install and clean rules, 832 from Martin Schulze (joey@Infodrom.North.DE) and 833 Dmitry A. Fedorov (D.A.Fedorov@inp.nsk.su). 834 835 G. Corrections to typo's in man pages, from Dmitry A. Fedorov 836 (D.A.Fedorov@inp.nsk.su). 837 838 H. Fix for the special per-user .supertab files: super was failing 839 to parse user:commands properly. Fix from Terje Eggestad 840 (Terje.Eggestad@novit.no). 841 842 I. Fixed super so that it won't create a core file -- this is useful 843 on systems w/ shadow passwords, to ensure that the shadow file 844 contents aren't put into a core file. 845 846 J. Added check for <sys/filio.h>. This is needed for some versions of 847 IRIX, which otherwise don't have FIOCLEX defined. 848 849 K. New local option argv0. 850 By default, super sets the first argument passed to a command 851 (ie argv[0]) to be the Cmd string, not the path to the command. 852 Thus "super doit" will set argv[0] to "doit", regardless of to the 853 path being invoked. This will cause problems for programs that 854 need a particular value of argv0. You can work around this by 855 placing such programs into wrapper scripts that are in turn called 856 from super, or you can use the local option argv0 to set the 857 value of argv[0]: 858 argv0=DesiredNameHere 859 As a special case, "<path>" means to use the fullpath by which super 860 is invoking the command. 861 862 For example, 863 doit /Path/To/My/Prog argv0=<path> 864 will execute /Path/To/My/Prog with argv[0] set to "/Path/To/My/Prog". 865 866------------------- 867What's new for version 3.11.6: 868 869 A. SECURITY FIX: super -c or super -F xxx would check any file, 870 e.g. /etc/shadow. This is now fixed by using access(2) to 871 verify that the original caller has the right to read the 872 specified file. Reported by Valentin Iliev <vale@aero.vmei.acad.bg>. 873 874 B. Bugfix: silly bugs in SAFE_PATH definition. 875 876 C. added -U, -G, and -M options to support additional testing 877 (-U uid means to act as if caller is user uid; -G gid 878 means to act as if caller is group gid; -M mach means to 879 act as if hostname==mach. Nothing is executed, but you can 880 see what would have happened.) 881 882 D. Added various patches from Martin Schulze (joey@infodrom.north.de), 883 including documentation changes, Linux shadow password support, 884 better hostname canonicalization. 885 886 E. Bit more documentation. 887 888------------------- 889What's new for version 3.11.5: 890 A. Modified configure script, hsearch.c, localsys.h, and setuid.c 891 so that super will auto-configure properly on AIX. 892 893------------------- 894What's new for version 3.11.4: 895 A. Fixed distribution: 3.11.3 didn't contain what it claimed. 896 897------------------- 898What's new for version 3.11.3: 899 A. Fixed configuration/compilation setup for Linux+glibc: 900 - doesn't declare signal(); 901 - defines _BSD_SOURCE. 902 903------------------- 904What's new for version 3.11.2: 905 A. Better debug information. Verbosity adjusted to make information 906 presentation a little better. 907 908------------------- 909What's new for version 3.11.1: 910 A. New global option "lang" / bugfix. 911 The "lang" global option lets you set the language used for 912 daynames in time expressions to any locale available on your host, 913 e.g. 914 :global lang=de 915 would typically cause super to use German names. 916 917 This was a bugfix: super purported to support localization, 918 but (a) it followed a non-POSIX implementation, and 919 (b) it let the regular user specify the locale! 920 921 B. Bugfix: super wasn't reporting enough information to users 922 about execution being denied or requested command not existing. 923 924------------------- 925What's new for version 3.11.0: 926 A. NOTE WELL: 927 The default locations for the super.tab and timestamps files have 928 CHANGED, so that installation would work more smoothly with 929 Gnu configure scripts: 930 (a) super installs into the directory specified by 931 configure --exec-prefix; the default is $PREFIX/bin. 932 (b) super.tab installs into the directory specified by 933 configure --sysconfdir; the default is $PREFIX/etc. 934 (c) the timestamp directory is installed in the directory 935 specified by configure --localstatedir; the default is $PREFIX/var; 936 (c) the man pages are installed in subdirectories of 937 configure --mandir; the default is $PREFIX/man. 938 For example, if you use 939 ./configure --prefix=/usr/local 940 ...then the super executable will be /usr/local/bin/super, 941 the super.tab file will be /usr/local/etc/super.tab, 942 the timestamp directory will be /usr/local/var/superstamps, 943 and the man pages into /usr/local/man/... 944 945 B. New debug option: 946 The option "-F path-to-superfile" is an extremely useful debug 947 option. It lets you specify the super.tab file. For security, 948 no command will ever be executed. If used with a commandname, 949 the matched command will be shown but not other debug info. 950 It lets you test an entry for a super.tab file without actually 951 installing the file: 952 953 super [-d | -D] -F my_new_super.tab some-command 954 955 C. New debug option: 956 The option "-T timeofday" is another useful debug option. 957 It tells super to act as if the time of execution is timeofday, 958 where timeofday has the format hh:mm/dayname (using the 959 same daynames as are accepted in the super.tab file). 960 For security, no command will ever be executed. 961 This lets you test if a time condition is properly limiting 962 execution of a command: 963 super -d -F my_new_super.tab -T hh:mm/day some-command 964 965 966 D. New builtin command: 967 :if aaa op bbb rest-of-line 968 provides limited conditional support. Here, aaa and bbb are strings 969 (can be variables), op is one of "==" (equals), "!=" (does not equal), 970 "~" (glob matches), "!~" (does not glob-match), and the 971 rest-of-line is evaluated if and only if the expression is true. 972 Examples: 973 :if $UNAME_MACHINE ~ sun4* :include MySunSpecificFile 974 ...includes MySunSpecificFile on Sun4-type machines only; 975 976 :if $UNAME_MACHINE ~ sun4* \ 977 :if $UNAME_MACHINE != sun4c :include MySunSpecificFile 978 ...includes MySunSpecificFile on Sun4-type machines only, excluding 979 Sun4c machines. 980 981 E. New builtin command: 982 :optinclude filename 983 is like the :include command, except that if filename is missing, 984 it's silently ignored. If you use this, be SURE not to write 985 later super.tab entries that depend on the presence of the file. 986 987 (I do _not_ recommend using :optinclude, because you won't be 988 informed if you make a sysadmin error, and delete one of the 989 include files.) 990 991 F. New builtin variables: 992 The following variables are automatically defined, so that you can 993 use them in :if lines (or anywhere else, of course). Examples: 994 995 :if $SI_ARCHITECTURE != alpha :include SomeFile 996 997 :include super.tab.$NIS_DOMAIN 998 999 Items that are unavailable on your system are set to "". 1000 (Items may be unavailable because your system doesn't offer 1001 the required function, or because your system's function doesn't 1002 support all the specific items super tries to get.) 1003 1004 (a) From gethostname() or sysinfo(): 1005 HOSTNAME system's hostname. Depending on super's 1006 configuration, the hostname returned by 1007 the function may be modified if super 1008 attempts to canonicalize the name. 1009 (Use super -b to print the names and 1010 values of all builtin variables.) 1011 1012 (b) From getdomainname(): 1013 NIS_DOMAIN The domain set for NIS purposes; it is not 1014 necessarily an Internet domain. 1015 1016 (c) From the sysinfo() function: 1017 SI_SYSNAME name of operating system 1018 SI_HOSTNAME name of node 1019 SI_RELEASE release of operating system 1020 SI_VERSION version field of utsname 1021 SI_MACHINE kind of machine 1022 SI_ARCHITECTURE instruction set arch 1023 SI_HW_SERIAL hardware serial number 1024 SI_HW_PROVIDER hardware manufacturer 1025 SI_SRPC_DOMAIN secure RPC domain 1026 1027 (d) From the uname() function: 1028 UNAME_SYSNAME Operating system name. 1029 UNAME_NODENAME The nodename. 1030 UNAME_RELEASE Operating system release. 1031 UNAME_VERSION Operating system version. 1032 UNAME_MACHINE Machine hardware name (class). 1033 1034 G. New command-line option: 1035 The -b option prints out the builtin variables, then exits. 1036 This makes it easy to see what variable values to check for 1037 in :if lines: 1038 % super -b 1039 Builtin variables: 1040 UNAME_SYSNAME: SunOS 1041 UNAME_VERSION: 2 1042 ... 1043 1044 H. Added -I. to Makefile so that compilation would succeed under 1045 VPATH. 1046 1047 I. Added env=... to be a global option as well as a local option. 1048 1049 J. Added maxenvlen=nnn to be a global or local option; gives the maximum 1050 allowed length of an envvar definition. 1051 Default=1000. Negative=no limit. 1052 1053 K. Pretty-printing: improved the formatting under super -d and super -H. 1054 1055 L. Added option maxlen=[mmm,]nnn (local or global). Arguments are 1056 restricted to be a maximum of mmm characters long individually 1057 (including trailing null), and nnn characters total. 1058 The default limits are 1000 and 10000, respectively. 1059 Values < 0 mean no limits; unlimited argument length can be 1060 configured using: 1061 :global maxlen=-1,-1 1062 1063 1064 M. Fixed missing initializations for some flags when super is invoked 1065 from a symlink. 1066 Reported by Jeff W. Stewart (jws@anaconda.cc.purdue.edu). 1067 1068 N. Fixed SAFE_PATH initialization. 1069 1070 Reported by Lawrence Lowe (lsl@hep.ph.bham.ac.uk) and 1071 Gordon Lack (gml4410@ggr.co.uk). 1072 1073 O. Bugfix: if the nice increment was set to a negative value, and the 1074 program was to be run non-setuid-root, the nice increment was changed 1075 to be applied _before_ the setuid/setgid operations. (Negative 1076 nice increments can't be except while running as root, of course.) 1077 1078 P. Bugfix: fixed envvar setting so that HOME, USER, and LOGNAME are set 1079 correctly when uid=NNN or u_g=NNN are numeric. For example, 1080 uid=0 had caused the USER envvar to be "0". 1081 1082 Q. Bugfix: super -D core dumped. Reason: super was passing an integer 1083 to a debug message, at a place where a string was expected. 1084 (Reported by swift@alum.mit.edu.) 1085 1086 R. Tried to make man pages, especially the super.1 page, more clear. 1087 1088 S. Changed the -h option to only give a usage listing. Thus 1089 super -h ...usage 1090 super (no args) ...list available commands, tersely. 1091 super -H ...list available commands, expansively. 1092 1093------------------- 1094What's new for version 3.10.0b6: 1095 A. Instead of closing descriptors >2 right away, the close-on-exec 1096 flag is instead used for machines with this feature. For IRIX 5 1097 (and others?), this is a bugfix, not just a general improvement: 1098 Gordon Lack wrote ``Irix NIS seems to "cache" a UDP connexion 1099 on a file-descriptor, and super closes this before execing''. 1100 1101 Bugfix/improvement courtesy of Gordon Lack (gml4410@ggr.co.uk). 1102 1103------------------- 1104What's new for version 3.10.0: 1105 1106 ** If you are familiar with super version <=3.7.2, but haven't used 1107 ** a more recent version, please read the changelist back through 3.8.0! 1108 ** There have been MANY enhancements since 3.7.2. 1109 1110 A. EASIER INSTALLATION: configuration is now handled by a configure 1111 script. This reduces the number of items you have to hand-adjust 1112 from 20 to none at all (if you like the defaults). 1113 1114 B. SECURITY FIX: Until version 3.9.7, super never did anything to 1115 change the supplementary groups list. This is not a security problem 1116 if you are adding privileges (such as switching to root), but it 1117 is a potential problem if you are switching to a different user and/or 1118 a different group. 1119 1120 Solution: this version of super adds the following new semantics: 1121 If you use u+g=foo, then the user is set to foo and the group is 1122 set to foo's login group (as in earlier versions), and the 1123 supplementary groups are set to foo's supplementary groups list 1124 (new feature). Otherwise, the supplementary groups list is deleted. 1125 1126 See also the new options groups=a,b,... and addgroups=a,b,... 1127 1128 The problem was reported and a workaround supplied by 1129 Morten Rolland (Morten.Rolland@si.sintef.no). 1130 1131 C. BUGFIX: Super had assumed that there would only be one ":global_option" 1132 line. If there were multiple :global_option instances, and logfile=xxx 1133 was used before the last :global_option instance, super would 1134 create multiple logging processes. Worse, interactions with password 1135 checking could lead to super's running a command without getting 1136 the user's password (when password=y). 1137 1138 The bug was reported by Richard Czech (Richard.Czech@gmd.de) 1139 1140 D. PER-USER SUPER.TAB FILES: 1141 1142 Super now allows ordinary users to supply their own super.tab files. 1143 This lets users give well-controlled setuid/setgid access to their 1144 programs: the user who offers the program gets the assurance of 1145 safe IFS settings, safe environment variable settings, etc; and the 1146 user who executes the program knows that it will execute under 1147 the uid of the offering user. 1148 1149 o The user-supplied super file is .supertab, in the home directory 1150 of the user, and must be owned and writable only by the owner. 1151 1152 o Joe user's supplied command "foo" is invoked by typing 1153 1154 super joe:foo 1155 1156 Super will act as follows: 1157 1158 i. immediately changes its uid, gid, and supplementary groups 1159 to be those of the owner of the super.tab file (joe); 1160 1161 ii. close all descriptors except for stdin, stdout, and stderr; 1162 1163 iii. follow its usual rules for processing super.tab files, 1164 except that any options that require setuid() or setgid() 1165 will fail since super is running as an ordinary user. 1166 1167 E. EASIER LISTS: in the past, super permitted csh-style 1168 brace-expansion for valid-user patterns. It has also allowed 1169 comma-separated lists for some options (e.g. fd=n1,n2,...). 1170 These forms have been synthesized into a single format: anywhere 1171 a list makes sense, either comma-separated or brace-expansion 1172 is permitted. (The implementation is easy: the list is wrapped 1173 in braces, and then brace-expansion is done.) 1174 1175 F. NEW OPTION 1176 groups=a,b,... supplementary group list is a,b,c 1177 groups= supplementary group list is empty 1178 1179 causes super to set the supplementary groups to the named list, 1180 before exec'ing the command. 1181 1182 G. NEW OPTION 1183 addgroups=a,b,... 1184 1185 causes super to add the named groups to the supplementary set 1186 before exec'ing the command. (Note: the supplementary set is 1187 intialized to be empty unless the option u+g=foo is used, so 1188 addgroups=a,b,... usually has the same affect as groups=a,b,... 1189 Alternatively, groups=<caller> addgroups=a,b,... will set the 1190 groups' to the caller's login groups, then add a,b,... to the list.) 1191 1192 H. NEW OPTION 1193 cd=SomePath 1194 causes super to change directory to SomePath before executing 1195 the command. This can be global or local; the local overrides 1196 the global setting. 1197 1198 I. NEW OPTION 1199 rlog_host=hostname 1200 tells super which host's syslog daemon is to receive log messages 1201 when option syslog=y is enabled. Default=localhost. 1202 1203 J. NEW OPTION 1204 gethostbyname=y|n 1205 tells super to enable/disable hostname lookup using gethostbyname(). 1206 Default: enabled (if you have gethostbyname()). 1207 1208 K. CHANGE TO NETGROUP HANDLING: hostnames beginning with ``+'' are 1209 _always_ treated as NIS netgroup names -- that is, @+xyz means 1210 that anyone at a host in netgroup xyz can execute the command. 1211 If your system doesn't have innetgr(), patterns beginning with ``+'' 1212 will not ever match any hostname. (Previously, interpreting 1213 ``+'' as a special character was enabled as compile-time option.) 1214 1215 L. CHANGE TO GETHOSTBYNAME() USAGE: if you have gethostbyname(), it 1216 gets compiled in and will be enabled by default; use global option 1217 gethostbyname=n to disable. (Previously, you had to define 1218 USE_GETHOSTBYNAME to compile it in, and there was no switch 1219 to turn it off.) 1220 1221 M. CHANGE TO SYSLOG() USAGE: we always compile the rsyslog() function 1222 from Jean-luc Szpyrka, so you can always send syslog output to either 1223 a remote or local host. The new option rlog_host=xxxxx specifies 1224 the host that receives the messages; the default is "localhost" -- 1225 i.e. same behavior as plain syslog(). (Previously, neither 1226 syslog() nor rsyslog() use was compiled in unless USE_SYSLOG 1227 was defined.) 1228 1229 N. SPECIAL NAMES: Two name have been added that you can use as an 1230 argument to any of the options owner=xxx, uid=xxx, gid=xxx, 1231 u+g=xxx, groups=xxx, addgroups=xxx, umask=xxx. 1232 These names are 1233 <owner> means owner of the file to be executed 1234 (or owner's group, whichever is appropriate 1235 in the context); 1236 <caller> means the owner or group of the user calling super. 1237 The angle brackets are literally part of the name. (Exception: 1238 umask=<owner> makes no sense and isn't defined.) 1239 1240 Example: 1241 gid=Foo uid=<caller> 1242 would change the group only, but leave the uid unchanged -- this is 1243 something you could not formerly do in super. 1244 1245 O. Updated man pages. 1246 1247 P. Security enhancement: the default umask is no longer inherited 1248 from the caller; instead it is set to 022. However, you can 1249 set it to the caller's umask by using the option 1250 umask=<caller> 1251 1252 Q. Dead code elimination: a branch of code made a call to the 1253 unsafe (on some systems) function getlogin(). This branch of 1254 code was never invoked, and has now been completely eliminated. 1255 1256------------------- 1257What's new for version 3.9.7: 1258 A. Super 3.9.6 installed the "setuid" program as setuid-root. 1259 This is a severe security hole. 1260 Version 3.9.7 removes the setuid-root entry from the Makefile. 1261 1262------------------- 1263What's new for version 3.9.6: 1264 1265 A. Important bugfix for version 3.9. Super had its internal structure 1266 overhauled for version 3.9. Unfortunately, one important error was 1267 introduced: the super.tab options 1268 uid=xxx 1269 group=xxx 1270 u_g=xxx 1271 were not properly reset from one entry to the next. This version 1272 fixes that error. 1273 1274 B. A new -c option: causes super to check the syntax of a super.tab 1275 file, but not actually execute anything. Its use: 1276 1277 super -c [superfile] 1278 1279 When you modify a super.tab file, you should use super -c to 1280 check the file's overall syntax, and also use super -d cmd 1281 for each modified command cmd, to verify that the details of 1282 the invoked command (args, uid, gid, umask, etc) are what 1283 you wanted to do. 1284 1285 C. A new -f option: this is a "just the facts, ma'm" help mode: 1286 it prints lines like: 1287 CmdPattern FullPath [leading args] 1288 CmdPattern FullPath [leading args] 1289 ... 1290 which allows scripts to make lists of commands the user may execute. 1291 1292 D. A new super.tab option has been added: 1293 print="msg" 1294 causes the message to be printed just before exec'ing the 1295 command. 1296 1297 E. Better man page information. 1298 1299 F. Replaced DIE=msg with die=msg. (Retaining DIE=msg as obsolete form.) 1300 1301------------------- 1302What's new for version 3.9.5: 1303 1304 A. Patches to 3.9 for Digital UNIX, 1305 from Stephen Carney (carney@gvc.dec.com). 1306 1307------------------- 1308What's new for version 3.9.4: 1309 1310 A. Bugfix for yet another silly error if invoked via symlink in 1311 version 3.9.2. Error pointed out and fixed by Rein Tollevik 1312 (Rein.Tollevik@si.sintef.no). 1313 1314 B. Syslog messages were always logged at priority SYSLOG_PRIORITY. 1315 Error found and fixed by Rein Tollevik (Rein.Tollevik@si.sintef.no). 1316 1317 C. If the preprocessor symbol SUNOS5 is defined, then the symbol SVR4 1318 is also defined (if not already done) in super.h. One ifdef'd 1319 section of code was changed to look at SVR4 instead of SUNOS5; 1320 hopefully this will be an improvement for other SVR4-based systems. 1321 1322------------------- 1323What's new for version 3.9.3: 1324 1325 A. Wrong processing if invoked without any arguments, or if invoked 1326 via symlink. Error pointed out and initial fix by Gerry Singleton 1327 (Gerry.Singleton@Canada.Sun.COM). 1328 1329------------------- 1330What's new for version 3.9.2: 1331 1332 A. Makefile entries and a few #includes needed for TI SYS V 3.3, 1333 from Oyvind Gjerstad (ogj@it.tollpost.no). 1334 1335------------------- 1336What's new for version 3.9.1: 1337 1338 A. Left some commas out of an #ifdef'd initialization array. 1339 Bugfix from Oyvind Gjerstad (ogj@it.tollpost.no). 1340 1341 B. Fixed: variable expansion happening inside comments, reported by 1342 Oyvind Gjerstad (ogj@it.tollpost.no). 1343 1344------------------- 1345What's new for version 3.9.0: 1346 1347 ** If you are familiar with super version <=3.7.2, make sure you ** 1348 ** read the changes in 3.8.0! There have been MANY enhancements ** 1349 ** made since 3.7.2. ** 1350 1351 This version consolidates all of the changes done in beta tests 1352 of 3.8, and added enough new items that I had to change the version 1353 number to 3.9 (without pausing for a non-beta version of 3.8). 1354 The improvements have come thick and fast, but that will now stop 1355 and only corrections will be done to v3.9 for some time to come. 1356 1357 The visible changes are: 1358 1359 A. The super.tab control line format has been generalized. 1360 The old syntax and semantics remain a valid subset -- old 1361 super.tab files will continue to work as expected. 1362 1363 Super now takes the following approach to selecting a command to 1364 execute. For each control line in the super.tab file, 1365 super requires that: 1366 1367 1. The user's typed command must match a control-line command; 1368 2. The user's name/group/host must match one of the user/group/host 1369 entries; 1370 3. The current time and day must match a time entry (if any are 1371 given); 1372 1373 Otherwise, super "falls through" and tries the next control line. 1374 The user/group/host and time entries are called _conditions_ 1375 that must be matched. 1376 1377 _Options_ on the control line are handled very differently from 1378 _conditions_. After conditions are met and a line is nominally 1379 selected for execution, all options must be satisfied, or super 1380 quits without executing the command and without trying further 1381 control lines in the super.tab file. 1382 1383 This distinction between conditions and options is easy to use 1384 in practice: basically, super searches for a line that matches 1385 a command, user and time of day. When the line is found, super 1386 will execute the command if the options -- such as a required 1387 password or restrictions on command arguments -- are satisfied; 1388 otherwise, it stops. 1389 1390 There are three important differences between conditions and options. 1391 1392 1. If conditions aren't matched, super will "fall through" and 1393 look at the next line. In contrast, when options are 1394 checked, super will quit if the options aren't satisfied. 1395 1396 2. Conditions can be "negated", that is, !condition~pattern 1397 means that if the pattern is matched, the user is 1398 _rejected_ from using this line. Options can't be negated. 1399 1400 3. Many similar conditions be applied, and the last-matching 1401 condition is used. For example, the list of user-conditions 1402 1403 :develop !joeblow 1404 1405 says that anybody in group "develop" can use the command, 1406 but then rejects joeblow, even if he is in the develop group. 1407 1408 If an option can appear more than once on a line, all 1409 instances of the option must be satisfied, not just the 1410 last-matching instance. 1411 1412 As part of the syntax generalization, user patterns may now begin 1413 with "user~": 1414 user~:develop !user~joeblow 1415 1416 Options and conditions can be interleaved. 1417 1418 B. time~pat is a new condition that has to be met before the line 1419 is accepted for execution. See next item for sample uses. 1420 All time patterns on a line must be matched or super will continue 1421 to the next control line. For example, 1422 1423 time~{8:00-12:00,13:00-17:00} !time~{sat,sun} 1424 or 1425 time~{8:00-12:00,13:00-17:00}/{mon,tue,wed,thu,fri} 1426 1427 restricts a command to being used during typical office hours 1428 on weekdays. 1429 1430 C. DIE=msg is a new option that can be used in a command line 1431 to force super to exit (and print msg) if the rest of the 1432 command line is successfully matched. Here are a few examples 1433 that also illustrate use of the new :define command. 1434 1435 :define RestrictedCommands ... 1436 :define weekdays {mon,tues,wed,thurs,fri} 1437 :define BadHours time~0-08:30/$weekdays \ 1438 time~17:30-24:00/$weekdays \ 1439 time~{sat,sun} 1440 1441 $RestrictedCommands $BadHours \ 1442 DIE="You can't use this command outside of office hours." 1443 1444 or 1445 1446 :define RestrictedCommands ... 1447 :define officeHours {8:30-12:30,1:30-17:30}/{mo,tu,we,th,fr} 1448 1449 $RestrictedCommands !time~$officeHours DIE="hahaha" 1450 1451 Without the DIE option, super will try to execute the restricted 1452 commands during the restricted hours. 1453 1454 1455 D. gethostbyname() is now called both with and without a trailing dot 1456 in the hostname. If both forms succeed, the longer returned name 1457 is kept, except that any trailing dot is deleted. 1458 1459 E. nice=nnn changes the ``nice'' level of the executed command 1460 by an amount nnn from the default level. (Positive increments 1461 reduce the command's priority; negative increments increase it.) 1462 1463 F. umask=nnn (local or global option) makes commands run with the 1464 specified umask. Useful if you want to help ensure that files 1465 are created with restricted access permissions. 1466 1467 G. :include filename allows a super.tab file to include other files. 1468 The filename must either be an absolute path or is interpreted 1469 relative to the directory containing the super.tab file, and the 1470 same restrictions are put on the file ownership and permissions 1471 as for the top-level super.tab file. The number of nested includes 1472 is limited only by the number of allowed open files. 1473 Use with caution! 1474 1475 H. The new local option argMMM-NNN=SSS or argNNN=SSS (where MMM and 1476 NNN are positive integers, and SSS is a string) means that the 1477 MMM-NNN'th user-entered arguments must match pattern SSS. 1478 The pattern SSS must be enclosed in quotes if it contains 1479 whitespace. Note that this doesn't _require_ MMM-NNN arguments; 1480 it only says what those arguments must look like, if entered. 1481 1482 I. Updated and corrected super.5 man page. 1483 1484 J. Fixed "mail" option. It can be used as either a global or local 1485 option. 1486 1487------------------- 1488What's new for version 3.8.0: 1489 1490 (The first 5 items are substantive visible changes/enhancements! 1491 Please read them!) 1492 1493 A. The rule for processing backslash-newline-whitespace (indicating 1494 continued lines) IS MODIFIED. THE NEW RULE IS: 1495 - if it follows a letter, digit, or underscore, replace the 1496 sequence with a single space. 1497 - otherwise, it is eliminated entirely. 1498 Therefore, you can type 1499 1500 Cmd File user1\ 1501 user2\ 1502 user3 1503 and it is equivalent to 1504 Cmd File user1 user2 user3 1505 1506 But typing 1507 Cmd File {user1,\ 1508 user2,\ 1509 user3} 1510 is equivalent to 1511 Cmd File {user1,user2,user3} 1512 1513 B. Variables are now supported! You can type 1514 1515 :define okusers {joe,jane,tom,sally} 1516 1517 The above could also have been written 1518 1519 :define okusers {joe,\ 1520 jane,\ 1521 tom,\ 1522 sally} 1523 1524 and then use 1525 1526 Cmd FullPath $okusers 1527 1528 with the obvious result. (The variable name may be enclosed 1529 in parentheses to insulate it from the characters which follow.) 1530 Read the man page super.5 before proceeding to use variables! 1531 1532 C. New global option syntax: 1533 1534 :global globaloptions... 1535 or 1536 :global_options globaloptions... 1537 1538 The old syntax: 1539 1540 / / globaloptions 1541 1542 is still supported, but its use is discouraged. 1543 1544 D. Multiple commands/filenames are now allowed on one line. Now you 1545 can type 1546 1547 Cmd1::FullPath1 Cmd2::FullPath2 [...] ok-user-pats 1548 1549 This can be useful for treating a group of commands as a unit: 1550 1551 :define Common_cmds Cmd1::FullPath1 \ 1552 Cmd2::FullPath2 \ 1553 Cmd3::FullPath3 1554 1555 :define okusers {\ 1556 :operators,\ 1557 joe,jane,tom,sally} 1558 1559 $Common_cmds $okusers 1560 1561 E. In general, a colon in a Cmd part of a line is now reserved 1562 to super, and must not be used as part of the Cmd name. 1563 This has been done to support the :define and :global commands, 1564 the Cmd::File syntax, and provide space for future development. 1565 1566 F. The super.tab file can now be owned by root or nobody. 1567 This change is to support networked accounts. 1568 1569 G. Substantial modifications to hostname matching to improve 1570 handling of netgroups. 1571 (From Steve Robbins -- steve@cim.mcgill.ca) 1572 1573 H. Added Makefile entry Max + header #ifdef's for SGI v5.3 1574 (from Max Buchheit, buchheit@ccrs.emr.ca). 1575 1576 I. Fixed comparison between char and NULL. 1577 Added Makefile adjustments for Solaris 2.4 (SunOS 5.4). 1578 1579 J. Fixed an error related to an appended dot on hostnames. 1580 (from Geoffrey A. Lowney, Geoffrey.A.Lowney@Boeing.com) 1581 1582 K. If compiled with __STDC__ defined, prototypes are used. 1583 1584 L. Disabled "mail" global option. Nobody was using it, and it wasn't 1585 implemented right anyway... maybe that's why nobody used it :-). 1586 1587 M. Disallowed relative pathnames unless global option relative_path 1588 is set. This is to prevent admins from accidentally making a 1589 stupid error. 1590 1591 N. Disallowed slash in groupnames unless global option group_slash 1592 is set. This lets us find formatting errors more easily -- namely, 1593 using Cmd:File instead of Cmd::File. 1594 1595------------------- 1596What's new for version 3.7.4: 1597 A. Added setenv=var=xxx option. This option defines environment 1598 variable var to have value xxx, and adds it to the environment 1599 variables that are kept when the command is executed. 1600 1601 Can be used multiple times to add definitions for multiple variables. 1602 1603 Note that "setenv=DISPLAY" is syntactically invalid (missing the 1604 `=' after the variable name), and that "setenv=DISPLAY=" 1605 sets DISPLAY to the null string. 1606 1607 (Recall that you can also use the option "env=var1,var2,..." 1608 to keep a list of user-defined environment variables.) 1609 1610 B. Improved error reporting. 1611 1612------------------- 1613What's new for version 3.7.3: 1614 1615 A. *** NOTE WELL *** Changed processing of FullPathNames with quoted 1616 arguments: the quotes are now stripped (it was an error that they 1617 weren't). For example, the super.tab entry 1618 1619 doit "/usr/bin/xxx -o1 -o2 -xrm 'a b c'" willie 1620 1621 allows user willie to type 1622 1623 super doit 1624 1625 and to execute /usr/bin/xxx with arglist 1626 argv[0]: doit 1627 argv[1]: -o1 1628 argv[2]: -o2 1629 argv[3]: -xrm 1630 argv[4]: a b c 1631 1632 Previous versions of super would pass argv[4] as 'a b c', including 1633 the single quotes. 1634 1635 1636 B. Added #ifdef to define LOG_USER and LOG_ERR if they aren't 1637 defined in <syslog.h>. 1638 1639 C. When logging successful super uses, added #ifdef so that the 1640 message priority isn't set unless USE_SYSLOG is defined. 1641 1642 D. Added Makefile entry for Ultrix 4.3 (from Christoph Geelen, 1643 geelen@rzulx1.mpie-duesseldorf.mpg.de). 1644 1645 E. Added Makefile entry for UnixWare 2.0 (from Pete Holsberg, 1646 pjh@tecoma.mccc.edu). 1647 1648 F. Added Makefile entry and super.c patches for Digital UNIX V3.2 1649 (formerly DEC OSF/1); from Stephen Carney, carney@gvc.dec.com. 1650 1651------------------- 1652What's new for version 3.7.2: 1653 1654 A. Added owner=xxx option so that super won't run a program 1655 unless it's owned by xxx. 1656 1657------------------- 1658What's new for version 3.7.1: 1659 1660 A. Modified error msg for clarity. 1661 1662 B. If super.tab isn't owned by root, then: 1663 + if real uid is root, bail out: don't run at all. 1664 + if real uid isn't root, run as real uid (can be useful 1665 for testing). 1666 1667------------------- 1668What's new for version 3.7.0: 1669 1670 A. Changed hostname comparisons to be case-insensitive. 1671 1672 (From Steve Robbins -- steve@cim.mcgill.ca) 1673 1674 B. New capability: wildcard commands. 1675 1676 In previous versions of super, entries in the super.tab file 1677 looked like: 1678 1679 CmdName FullPathName PermittedUsers 1680 1681 This is now supplanted by a new format, which is a superset 1682 of the previous one (note that all existing super.tab files 1683 remain valid): 1684 1685 CmdPattern FullPathName-with-optional-"*" PermittedUsers 1686 1687 There are two new features here: 1688 1689 1) The former CmdName string is now interpreted as a pattern 1690 (with csh-style brace expansion, so that it can 1691 actually stand for a variety of commands). 1692 1693 2) If there is an asterisk in FullPathName, it is replaced 1694 by the user's cmd. 1695 1696 In the usual situation, in which CmdPattern is still just a plain 1697 name without wildcards, the user (a) types "super cmd"; 1698 (b) the cmd is matched against CmdPattern; 1699 (c) the user checked to be a PermittedUser, etc; 1700 (d) FullPathName is then executed. As long as CmdPattern is 1701 just made up of letters, digits, and underscore, and 1702 FullPathName has no asterisk, the effect will be exactly 1703 as super has always acted. 1704 1705 If you put special pattern-matching characters into the CmdPattern, 1706 you simply give more ways a user can execute the same FullPathName. 1707 This isn't yet very exciting, and in fact isn't a good idea at 1708 all. The power of using patterns in the CmdPattern string comes 1709 when FullPathName includes an asterisk. In that case, the asterisk 1710 is replaced with the user's "cmd" string to form the actual 1711 command to exec. For instance, a SysV-based host might have 1712 an entry in the super.tab file that looks like: 1713 1714 /usr/bin/{lp,lpstat,disable,enable,cancel} * :operators 1715 1716 This would allow anybody in the "operators" group to have root access 1717 to the line printer commands. For instance, if the user typed: 1718 1719 super /usr/bin/disable some_printer 1720 1721 then the FullPathName == "*" would be replaced by /usr/bin/disable, 1722 and become the command to exec. 1723 1724 More conveniently, the super.tab file could have a line like: 1725 1726 {lp,lpstat,disable,enable,cancel} /usr/bin/* :operators 1727 1728 In this case, the user can type 1729 1730 super disable some_printer 1731 1732 The asterisk is replaced by "disable" to form the command 1733 /usr/bin/disable. 1734 1735 If you _completely_ trust some users, but want logging of all 1736 actions, you could use: 1737 1738 /* * ReallyReallyTrustedUsers 1739 1740 (if the global option patterns=shell has been set) or 1741 1742 /.* * ReallyReallyTrustedUsers 1743 1744 (the default case: patterns=regex). 1745 1746 The user can now execute any command. Note that the pattern 1747 begins with a slash, to ensure that the cmd must be an 1748 absolute path -- this helps avoid accidental execs of the 1749 wrong program. 1750 1751 Of course, if you were really going to give everything away as shown 1752 above, you'd probably want to exclude any public-area workstations, 1753 require the trusted users to periodically give their passwords, 1754 and set the real uid=root (instead of just the effective uid), 1755 so the entry might be modified to read: 1756 1757 /* * TrustedUsers !{PatternsOfPublicWorstations} \ 1758 password=y timeout=5 uid=0 1759 1760 (if the global option patterns=shell has been set). 1761 1762 (These changes were inspired by Aaron Schuman, schuman@sgi.com) 1763 1764------------------- 1765What's new for version 3.6.1: 1766 1767 A. Added support for shadow passwords on HP-UX 9.x. 1768 1769------------------- 1770What's new for version 3.6.0: 1771 1772 A. Changed super's logging to offer networked syslog messages: 1773 all syslog messages can be sent to a single host. 1774 1775 B. Provided bugfix with -V option (super could coredump otherwise). 1776 1777 (These changes provided by Jean-luc Szpyrka, jls@sophia.inria.fr) 1778 1779------------------- 1780What's new for version 3.5.2: 1781 1782 A. Bugfix: the full path of the executed command was inserted 1783 as argv[1] in the output arguments, when it didn't belong there 1784 at all. 1785 1786 B. Bugfix: log messages for _successful_ commands weren't 1787 being newline-terminated. 1788 1789 (These bugs reported by Olof Backing, obg@nada.kth.se) 1790 1791------------------- 1792What's new for version 3.5.1: 1793 1794 A. Added better copyright + licensing info. 1795 1796 B. Did some code cleanup (getting rid of unused variables, adding 1797 declaration of wait(), etc). 1798 1799 C. After logging a super call to the logfile, failed exec's might 1800 not be printed on the screen (although they were 1801 logged in the logfile). 1802 1803------------------- 1804What's new for version 3.5: 1805 1806 A. Added pattern negation to super.tab: 1807 !pat 1808 says to disallow a user who matches the pattern. 1809 Until now, you could only give permission to users that 1810 matched, not take it away. Patterns are scanned left-to-right, 1811 and the allow/disallow depends on the last pattern that matches. 1812 This lets you do things like 1813 1814 cmd /Full/Path :goodguys !jan 1815 1816 to mean allow anybody in group goodguys, but then disallows 1817 user jan, even if jan is in goodguys. 1818 1819 B. Added user/group/host patterns to the global settings: 1820 1821 / / [global opts] pat pat ... <> pat pat ... 1822 1823 User/group/host patterns to the left of "<>" are processed 1824 _before_ the per-command patterns; user/group/host patterns 1825 to the right of "<>" are processed _after_ the per-command 1826 patterns. If "<>" is missing, all patterns are processed after 1827 the user patterns. 1828 For example, 1829 1830 / / jan <> !@+badhosts 1831 1832 says that user jan can execute any command (unless a per-command 1833 pattern explicitly disallows jan from executing a particular 1834 command), but under no circumstances will a user on any host in 1835 netgroup ``badhosts'' be allowed to execute any command. 1836 (Thus jan can execute any command, but only from hosts _not_ 1837 in ``badhosts''.) 1838 1839 (These changes were inspired by Jean-luc Szpyrka, 1840 jls@sophia.inria.fr .) 1841 1842 C. Added special handling of hostnames: If a host is using 1843 DNS names, and the hostname isn't matched in the super.tab 1844 file, it's possible that the reason is simply that gethostname() 1845 returns a name with fewer or more components of the fully-qualified 1846 domain name (fqdn) than is in the hostname pattern in super.tab. 1847 For example, gethostname() might return "w.x.y.z", but the 1848 hostname pattern might be simply "w". Until now, super wouldn't 1849 consider this a successful match. 1850 1851 If you enable the new feature USE_GETHOSTBYNAME, then 1852 if the hostname doesn't match the pattern directly, super will 1853 determine the fqdn, and then compare ever-shorter parts against 1854 the pattern. For instance, given the hostname "ab.cd.ef.gh", 1855 super will test "ab.cd.ef.gh", then "ab.cd.ef", then "ab.cd", 1856 and finally "ab". Warning: using this option may reduce 1857 security a bit - your host may query a nameserver on another 1858 host to obtain the FQDN, and that nameserver could conceivably 1859 have been subverted and then return incorrect hostnames. 1860 1861 (Idea from Dave Curry, davy@ecn.purdue.edu). 1862 1863 1864 D. Fixed a bug in creating timestamp files. Basically, unless 1865 the global option timestampuid=0 was set, one frequently got 1866 a message "Timestamp creation failed" and then couldn't 1867 run a command requiring a password. 1868 1869 (Bug reported by Brian Huntley, 1870 bhuntley%tsegw.tse.com@spectre.uunet.ca) 1871 1872 E. Changed super's logging to include the arguments passed to 1873 the command. 1874 1875 (Patch from Dave Curry, davy@ecn.purdue.edu). 1876 1877 F. An error in the str_val() function allowed some typos in 1878 option names to pass unnoticed. Files with properly typed 1879 option names were not affected. 1880 1881 G. Modified some error messages that were not printing accurate 1882 information about why access was being denied. 1883 1884 H. Bugfix: comments in super.tab are supposed to only go up to 1885 newline, but instead they ran to the end of an input block. 1886 1887 I. Ported to SCO 3.2v4. 1888 1889 (Changes from Keith Menard, menard@gateway.wtc.com) 1890 1891 J. Fixed error in processing backslashes in super.tab lines 1892 (backslash-newline was being processed correctly; others left 1893 super in an infinite loop). 1894 1895 K. Stripped down the strqtok function that splits input lines 1896 of text. 1897 1898 1899------------------- 1900What's new for version 3.4.9: 1901 1902 A. Added #ifdef's and Makefile entries for 1903 Clix 3.1 r.7.1.3 (Intergraph) 1904 contributed by David Sandmann (das@ipro15.aaa.com). 1905 1906 B. Added #ifdef'd code to implement scripts that start with 1907 "#! interpreter" on OS's which don't support it directly. 1908 1909------------------- 1910What's new for version 3.4.8: 1911 1912Minor bugfixes: 1913 1914 A. _Successful_ executions of commands were not being logged by 1915 syslog unless they were also being logged to a (non-syslog) file. 1916 1917 B. There were formatting errors and other minor mistakes in 1918 the super.5 man page. 1919 1920 C. Changed the example in README and the super.1 man page regarding 1921 how a program can super itself, so that it will work on all 1922 Bourne shell variations (the argument to "test" had to be 1923 protected against empty strings.) 1924 1925------------------- 1926What's new for version 3.4.7: 1927 1928 A. Bugfix for patterns like 1929 uuu:ggg and uuu: 1930 ...valid user is denied access. Bug report & fix came from 1931 Karen L Dickerson (kld@mudshark.sunquest.com). 1932 1933------------------- 1934What's new for version 3.4.6: 1935 1936 A. Bugfix for sites that don't compile with USE_NETGROUP but 1937 do specify a hostname. Bug reported by 1938 Adam P. Harris (apharris@mcs.com). 1939 1940------------------- 1941What's new for version 3.4.5: 1942 1943 A. Improved parsing for arguments that super supplies to commands. 1944 Previously, only whitespace would separate arguments. Version 1945 3.4.5 parses the FullPathName with recognition of embedded 1946 quotes and backslashes. 1947 1948 For example, suppose the super.tab file contains a line like 1949 1950 cmd "FullPath -a -b 2\ 3 -xrm 'r s t \ 1951 u v w' ..." SuperOptions... validusers... 1952 1953 The "FullPath..." string (containing the arguments -a, -b, ...) 1954 ... is parsed using Bourne-shell-like rules for backslashes 1955 and quotes, and the line is parsed as 1956 argv[0] FullPath 1957 argv[1] -a 1958 argv[2] -b 1959 argv[3] 2 3 1960 argv[4] -xrm 1961 argv[5] r s t u v w 1962 1963 (Use "super -d cmd" to check that your args are being parsed 1964 as expected before you unleash a new command on your users.) 1965 1966------------------- 1967What's new for version 3.4.4: 1968 1969 A. The timestamp file of user@host.name.dom is now by default 1970 stored in 1971 TIMESTAMP_DIR/hostname/user 1972 with the old behavior (TIMESTAMP_DIR/user) being an option 1973 controlled with global option timestampbyhost=y|n. 1974 1975 The timestampuid=xxx option has been added to allow timestamp 1976 files to be created under a particular uid. 1977 This allows for a cross-mounted timestamp directory on hosts 1978 that map NFS root accesses to nobody, but still keeps the 1979 password entries distinct on different hosts. 1980 1981 B. TIMESTAMP_DIR is now documented in the Makefile, so that it 1982 is easily configured at compile time. 1983 1984------------------- 1985What's new for version 3.4.3: 1986 1987 A. Option -H has been added to give the long-winded help information 1988 that has been the only thing printed until now. 1989 1990 The -h option now prints a short help listing: 1991 1992 Command Comments 1993 ------- -------- 1994 cmd1 help info for cmd1 1995 cmd2 help info for cmd2 1996 ... 1997 1998------------------- 1999What's new for version 3.4.2: 2000 2001 A. If "xyz" is a symlink to super, then 2002 % xyz args... 2003 is treated by super just like 2004 % super xyz args... 2005 2006 Super detects such symlinks by the rule that argv[0] must 2007 match "*/super" or "super"; otherwise, it's assumed to be 2008 a symlink. Therefore, a symlink named "super" won't work -- 2009 super won't recognize it's being invoked via symlink. 2010 2011------------------- 2012What's new for version 3.4.1: 2013 2014 A. When printing debug info, there was misformatted output 2015 of any extra file descriptors being held open. (The 2016 problem only occurred in 3.4.0, not earlier versions.) 2017 2018------------------- 2019What's new for version 3.4: 2020 2021 A. Added nargs=[mmm-]nnn to limit user-entered args. 2022 2023------------------- 2024What's new for version 3.3.2: 2025 2026 A. Allow "@hostname", without any user or groupname part. 2027 2028------------------- 2029What's new for version 3.3.1: 2030 2031 A. Fixed SunOS 5.x to use "getspnam()" when looking up passwords. 2032 2033------------------- 2034What's new for version 3.3: 2035 2036 A. Added mail="....." global option. 2037 2038 B. Fixed goofy error in parsing password=n. 2039 2040 C. Added syslog=y|n option. 2041 2042------------------- 2043What's new for version 3.2: 2044 A. Added options password=y|n, timeout=n, renewtime=y|n to require 2045 passwords on specific commands (or all commands). 2046 2047 B. A bugfix: if the super.tab file tried to pass options to the 2048 executable command, the exec would fail. 2049 2050------------------- 2051What's new for version 3.1: 2052 A. Added global option loguid=xxx to allow the logfile to be opened 2053 under a uid other than root. This allows the logfile to be 2054 shared across a network over which root doesn't have write access. 2055 2056------------------- 2057What's new for version 3.0: 2058 2059 A. Command logging -- you can specify a file to receive a log 2060 of super uses and attempts. 2061 2062 B. More environment variables -- for each entry, the super.tab file 2063 can specify environment variables that should be passed to 2064 the command instead of discarded. You simply add entries like 2065 env=TZ,TAPE 2066 to the super.tab file, to keep TZ and TAPE in addition to 2067 the default list. Of course one has to use this with 2068 caution. 2069 2070 C. Set uid/gid -- for each entry, the super.tab file can specify 2071 the uid and/or gid (the default is to only change the effective 2072 uid to root). To use this, you add entries like 2073 uid=xxx gid=yyy 2074 to the super.tab file, or u+g=xxx to set the uid 2075 to xxx and the gid to xxx's login gid. 2076 2077 As a supplement to the setuid/setgid ability, super defines 2078 some extra environment variables so that the invoked command 2079 can know the username and home directory of the user who 2080 invoked the command, as well as that of the uid under which 2081 the command is executing. 2082 2083 D. Open file descriptors -- for each entry, the super.tab file 2084 can specify a list of file descriptors that should not be 2085 closed (in addition to the default 0,1,2). 2086 2087 E. Initial arguments -- for each entry, the super.tab file can 2088 specify a set of initial arguments that are put into argv[] 2089 ahead of the arguments the user typed on the command line. 2090 2091 F. super -h now only prints the commands that may be executed by the 2092 user; and the super.tab file can specify a line of explanatory 2093 text to be printed with each command. 2094 2095 G. A bugfix: The TERM environment variable can now contain "-+_.:/" 2096 in addition to [a-zA-Z0-9]. 2097 2098 H. The super.tab file can be configured with either Bourne-shell style 2099 or regex (ed-style) valid-user patterns; the default is regex. 2100 2101------------------- 2102What's new for version 2.0: 2103 A. A couple of bugfixes. (These fixes were first introduced 2104 in version 1.2.) 2105 2106 B. You can restrict commands to particular users on particular 2107 hosts. This allows one "super.tab" file to serve many hosts. 2108 2109 C. Entries in "super.tab" can now span multiple lines. Helpful 2110 when one file serves many users + hosts. 2111 2112 D. csh-style brace-expansion: super's pattern-matching previously 2113 was done with the BSD 4.x regex routines. This is now extended 2114 allow csh-style braces. For instance, to allow users 2115 pam and sammy, executing from hosts alpha and beta, you can 2116 use an entry like {pam,sammy}@{alpha,beta} 2117 2118