From c0204785ec6f3b044e57b235cf5ea048cf7c9383 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Mon, 20 Jun 2022 19:14:50 +0530 Subject: [PATCH 1/3] app-admin/sudo: Sync with Gentoo upstream; updates to 1.9.10-r1 gentoo sync ref: https://github.com/gentoo/gentoo/commit/6e69c00ebc05d5ea82243c00f3a83d5ce9efb3ee Signed-off-by: Sayan Chowdhury --- .../coreos-overlay/app-admin/sudo/Manifest | 4 +- .../app-admin/sudo/metadata.xml | 7 +- .../app-admin/sudo/sudo-1.8.31.ebuild | 259 ------------------ ...-1.9.5_p2.ebuild => sudo-1.9.10-r1.ebuild} | 60 ++-- 4 files changed, 29 insertions(+), 301 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.8.31.ebuild rename sdk_container/src/third_party/coreos-overlay/app-admin/sudo/{sudo-1.9.5_p2.ebuild => sudo-1.9.10-r1.ebuild} (82%) diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/Manifest b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/Manifest index 98d0e91a1c..beb3713960 100644 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/Manifest @@ -1,2 +1,2 @@ -DIST sudo-1.8.31.tar.gz 3350674 BLAKE2B de5a968732fdd58933b4c513d13c43a08cb50075a00c3e0d338c9892570a416a2b3a8f19940c0893715f4eeab991e804831a87ef656ffd91e7f1ba047c119261 SHA512 b9e408a322938c7a712458e9012d8a5f648fba5b23a5057cf5d8372c7f931262595f1575c32c32b9cb1a04af670ff4611e7df48d197e5c4cc038d6b65439a28a -DIST sudo-1.9.5p2.tar.gz 4012277 BLAKE2B 41913887463e4f775564af8d614fb5ed762200aa777dc789ec333842d4f432323474fc952a531fe929b33607cdfbcd18d7fe7470a15d67139deaf855841ed11f SHA512 f0fe914963c31a6f8ab6c86847ff6cdd125bd5a839b27f46dcae03963f4fc413b3d4cca54c1979feb825c8479b44c7df0642c07345c941eecf6f9f1e03ea0e27 +DIST sudo-1.9.10.tar.gz 4516568 BLAKE2B 94d97379e31b41917616a829cbece3d3fce7dd6ab9d04791b928981c14249c306508298655c19dc59a054ccf7deed4e69e65367cbfe9f6d8b5aba8895cfa6064 SHA512 65cf92b67b64413cb807da8b9602fc90b75e5b30dd1402d682ca36f276a3d6209a8a59c14e463898abc9856bc56263e5ba4bb6d44774f56a2885a9eea4a35375 +DIST sudo-1.9.10.tar.gz.sig 566 BLAKE2B 808919c826faa4f63efc283461f9f2089fd745aaf7462bcc41c505e7f978e7d56307202f96548d95844c99236fec10cada8438b935a1e1b6ea3601ee857d6900 SHA512 4ea0b736783b8e7be47645f770d7684d99c31f901177d3527f1ff78f5126d41592a94d36c67762bf5cb941eed80b9f585637aaa81d7f4920576d31a83f447323 diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/metadata.xml b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/metadata.xml index 72faa0680c..045c53c4fa 100644 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/metadata.xml +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/metadata.xml @@ -1,5 +1,5 @@ - + base-system@gentoo.org @@ -13,15 +13,10 @@ Use message digest functions from dev-libs/libgcrypt instead of sudo's - Use message digest functions from dev-libs/libressl instead of sudo's Let sudo print insults when the user types the wrong password Allow sudo to send emails with sendmail Add System Security Services Daemon support Replace PATH variable with compile time secure paths - - Use message digest functions from dev-libs/libgcrypt, dev-libs/libressl - or dev-libs/openssl instead of sudo's internal SHA2 implementation - cpe:/a:todd_miller:sudo diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.8.31.ebuild b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.8.31.ebuild deleted file mode 100644 index 5c6a768ae8..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.8.31.ebuild +++ /dev/null @@ -1,259 +0,0 @@ -# Copyright 1999-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 - -inherit pam multilib libtool tmpfiles - -MY_P="${P/_/}" -MY_P="${MY_P/beta/b}" - -DESCRIPTION="Allows users or groups to run commands as other users" -HOMEPAGE="https://www.sudo.ws/" -if [[ ${PV} == "9999" ]] ; then - inherit mercurial - EHG_REPO_URI="https://www.sudo.ws/repos/sudo" -else - uri_prefix= - case ${P} in - *_beta*|*_rc*) uri_prefix=beta/ ;; - esac - - SRC_URI="https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz - ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz" - if [[ ${PV} != *_beta* ]] && [[ ${PV} != *_rc* ]] ; then - KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~sparc-solaris" - fi -fi - -# Basic license is ISC-style as-is, some files are released under -# 3-clause BSD license -LICENSE="ISC BSD" -SLOT="0" -IUSE="gcrypt ldap libressl nls offensive pam sasl +secure-path selinux +sendmail skey sssd system-digest" - -DEPEND=" - sys-libs/zlib:= - ldap? ( - >=net-nds/openldap-2.1.30-r1 - sasl? ( - dev-libs/cyrus-sasl - net-nds/openldap[sasl] - ) - ) - pam? ( sys-libs/pam ) - sasl? ( dev-libs/cyrus-sasl ) - skey? ( >=sys-auth/skey-1.1.5-r1 ) - sssd? ( sys-auth/sssd[sudo] ) - system-digest? ( - gcrypt? ( dev-libs/libgcrypt:= ) - !gcrypt? ( - !libressl? ( dev-libs/openssl:0= ) - libressl? ( dev-libs/libressl:0= ) - ) - ) -" -RDEPEND=" - ${DEPEND} - >=app-misc/editor-wrapper-3 - virtual/editor - pam? ( sys-auth/pambase ) - selinux? ( sec-policy/selinux-sudo ) - sendmail? ( virtual/mta ) -" -BDEPEND=" - sys-devel/bison -" - -S="${WORKDIR}/${MY_P}" - -REQUIRED_USE=" - pam? ( !skey ) - skey? ( !pam ) -" - -MAKEOPTS+=" SAMPLES=" - -src_prepare() { - default - elibtoolize -} - -set_secure_path() { - # FIXME: secure_path is a compile time setting. using PATH or - # ROOTPATH is not perfect, env-update may invalidate this, but until it - # is available as a sudoers setting this will have to do. - einfo "Setting secure_path ..." - - # first extract the default ROOTPATH from build env - SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; - echo "${ROOTPATH}") - case "${SECURE_PATH}" in - */usr/sbin*) ;; - *) SECURE_PATH=$(unset PATH; - . "${EPREFIX}"/etc/profile.env; echo "${PATH}") - ;; - esac - if [[ -z ${SECURE_PATH} ]] ; then - ewarn " Failed to detect SECURE_PATH, please report this" - fi - - # then remove duplicate path entries - cleanpath() { - local newpath thisp IFS=: - for thisp in $1 ; do - if [[ :${newpath}: != *:${thisp}:* ]] ; then - newpath+=:${thisp} - else - einfo " Duplicate entry ${thisp} removed..." - fi - done - SECURE_PATH=${newpath#:} - } - cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}} - - # finally, strip gcc paths #136027 - rmpath() { - local e newpath thisp IFS=: - for thisp in ${SECURE_PATH} ; do - for e ; do [[ ${thisp} == ${e} ]] && continue 2 ; done - newpath+=:${thisp} - done - SECURE_PATH=${newpath#:} - } - rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*' - - einfo "... done" -} - -src_configure() { - local SECURE_PATH - set_secure_path - - # audit: somebody got to explain me how I can test this before I - # enable it.. - Diego - # plugindir: autoconf code is crappy and does not delay evaluation - # until `make` time, so we have to use a full path here rather than - # basing off other values. - myeconfargs=( - --enable-zlib=system - --enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d - --with-editor="${EPREFIX}"/usr/libexec/editor - --with-env-editor - --with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo - --with-rundir="${EPREFIX}"/run/sudo - $(use_with secure-path secure-path "${SECURE_PATH}") - --with-vardir="${EPREFIX}"/var/db/sudo - --without-linux-audit - --without-opie - $(use_enable gcrypt) - $(use_enable nls) - $(use_enable sasl) - $(use_with offensive insults) - $(use_with offensive all-insults) - $(use_with ldap ldap_conf_file /etc/ldap.conf.sudo) - $(use_with ldap) - $(use_with pam) - $(use_with skey) - $(use_with sssd) - $(use_with selinux) - $(use_with sendmail) - ) - - if use system-digest && ! use gcrypt; then - myeconfargs+=("--enable-openssl") - else - myeconfargs+=("--disable-openssl") - fi - - econf "${myeconfargs[@]}" -} - -src_install() { - default - - if use ldap ; then - dodoc README.LDAP - - cat <<-EOF > "${T}"/ldap.conf.sudo - # See ldap.conf(5) and README.LDAP for details - # This file should only be readable by root - - # supported directives: host, port, ssl, ldap_version - # uri, binddn, bindpw, sudoers_base, sudoers_debug - # tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key} - EOF - - if use sasl ; then - cat <<-EOF >> "${T}"/ldap.conf.sudo - - # SASL directives: use_sasl, sasl_mech, sasl_auth_id - # sasl_secprops, rootuse_sasl, rootsasl_auth_id, krb5_ccname - EOF - fi - - insinto /etc - doins "${T}"/ldap.conf.sudo - fperms 0440 /etc/ldap.conf.sudo - fi - - pamd_mimic system-auth sudo auth account session - - keepdir /var/db/sudo/lectured - fperms 0700 /var/db/sudo/lectured - fperms 0711 /var/db/sudo #652958 - - # Don't install into /run as that is a tmpfs most of the time - # (bug #504854) - rm -rf "${ED}"/run - - find "${ED}" -type f -name "*.la" -delete || die #697812 -} - -pkg_postinst() { - tmpfiles_process sudo.conf - - #652958 - local sudo_db="${EROOT}/var/db/sudo" - if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then - chmod 711 "${sudo_db}" || die - fi - - if use ldap ; then - ewarn - ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration." - ewarn - if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then - ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly" - ewarn "configured in /etc/nsswitch.conf." - ewarn - ewarn "To make use of LDAP, add this line to your /etc/nsswitch.conf:" - ewarn " sudoers: ldap files" - ewarn - fi - fi - if use prefix ; then - ewarn - ewarn "To use sudo, you need to change file ownership and permissions" - ewarn "with root privileges, as follows:" - ewarn - ewarn " # chown root:root ${EPREFIX}/usr/bin/sudo" - ewarn " # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so" - ewarn " # chown root:root ${EPREFIX}/etc/sudoers" - ewarn " # chown root:root ${EPREFIX}/etc/sudoers.d" - ewarn " # chown root:root ${EPREFIX}/var/db/sudo" - ewarn " # chmod 4111 ${EPREFIX}/usr/bin/sudo" - ewarn - fi - - elog "To use the -A (askpass) option, you need to install a compatible" - elog "password program from the following list. Starred packages will" - elog "automatically register for the use with sudo (but will not force" - elog "the -A option):" - elog "" - elog " [*] net-misc/ssh-askpass-fullscreen" - elog " net-misc/x11-ssh-askpass" - elog "" - elog "You can override the choice by setting the SUDO_ASKPASS environmnent" - elog "variable to the program you want to use." -} diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.5_p2.ebuild b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.10-r1.ebuild similarity index 82% rename from sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.5_p2.ebuild rename to sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.10-r1.ebuild index 413bb5d9f1..2f7cd3f358 100644 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.5_p2.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.10-r1.ebuild @@ -1,9 +1,9 @@ -# Copyright 1999-2021 Gentoo Authors +# Copyright 1999-2022 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=7 -inherit pam multilib libtool systemd tmpfiles +inherit pam libtool tmpfiles toolchain-funcs MY_P="${P/_/}" MY_P="${MY_P/beta/b}" @@ -14,15 +14,23 @@ if [[ ${PV} == "9999" ]] ; then inherit mercurial EHG_REPO_URI="https://www.sudo.ws/repos/sudo" else + inherit verify-sig + VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/sudo.ws.asc + BDEPEND+="verify-sig? ( sec-keys/openpgp-keys-sudo )" + uri_prefix= case ${P} in *_beta*|*_rc*) uri_prefix=beta/ ;; esac SRC_URI="https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz - ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz" + ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz + verify-sig? ( + https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz.sig + ftp://ftp.sudo.ws/pub/sudo/${uri_prefix}${MY_P}.tar.gz.sig + )" if [[ ${PV} != *_beta* ]] && [[ ${PV} != *_rc* ]] ; then - KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 s390 sparc x86 ~sparc-solaris" + KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~sparc-solaris" fi fi @@ -30,40 +38,35 @@ fi # 3-clause BSD license LICENSE="ISC BSD" SLOT="0" -IUSE="gcrypt ldap libressl nls offensive pam sasl +secure-path selinux +sendmail skey ssl sssd" +IUSE="gcrypt ldap nls offensive pam sasl +secure-path selinux +sendmail skey ssl sssd" DEPEND=" sys-libs/zlib:= + virtual/libcrypt:= gcrypt? ( dev-libs/libgcrypt:= ) ldap? ( - >=net-nds/openldap-2.1.30-r1 + >=net-nds/openldap-2.1.30-r1:= sasl? ( dev-libs/cyrus-sasl - net-nds/openldap[sasl] + net-nds/openldap:=[sasl] ) ) pam? ( sys-libs/pam ) sasl? ( dev-libs/cyrus-sasl ) skey? ( >=sys-auth/skey-1.1.5-r1 ) - ssl? ( - !libressl? ( dev-libs/openssl:0= ) - libressl? ( dev-libs/libressl:0= ) - ) + ssl? ( dev-libs/openssl:0= ) sssd? ( sys-auth/sssd[sudo] ) " - -# Flatcar: remove perl runtime dependency -# ldap? ( dev-lang/perl ) - RDEPEND=" ${DEPEND} >=app-misc/editor-wrapper-3 virtual/editor + ldap? ( dev-lang/perl ) pam? ( sys-auth/pambase ) selinux? ( sec-policy/selinux-sudo ) sendmail? ( virtual/mta ) " -BDEPEND=" +BDEPEND+=" sys-devel/bison virtual/pkgconfig " @@ -83,11 +86,6 @@ src_prepare() { } set_secure_path() { - # FIXME: secure_path is a compile time setting. using PATH or - # ROOTPATH is not perfect, env-update may invalidate this, but until it - # is available as a sudoers setting this will have to do. - einfo "Setting secure_path ..." - # first extract the default ROOTPATH from build env SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}") @@ -113,7 +111,7 @@ set_secure_path() { done SECURE_PATH=${newpath#:} } - cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}} + cleanpath /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}} # finally, strip gcc paths #136027 rmpath() { @@ -125,13 +123,12 @@ set_secure_path() { SECURE_PATH=${newpath#:} } rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*' - - einfo "... done" } src_configure() { local SECURE_PATH set_secure_path + tc-export PKG_CONFIG #767712 # audit: somebody got to explain me how I can test this before I # enable it.. - Diego @@ -174,10 +171,10 @@ src_install() { default if use ldap ; then - dodoc README.LDAP + dodoc README.LDAP.md cat <<-EOF > "${T}"/ldap.conf.sudo - # See ldap.conf(5) and README.LDAP for details + # See ldap.conf(5) and README.LDAP.md for details # This file should only be readable by root # supported directives: host, port, ssl, ldap_version @@ -197,10 +194,10 @@ src_install() { doins "${T}"/ldap.conf.sudo fperms 0440 /etc/ldap.conf.sudo - # Flatcar: we don't ship openldap schemas - #insinto /etc/openldap/schema - #newins doc/schema.OpenLDAP sudo.schema + insinto /etc/openldap/schema + newins docs/schema.OpenLDAP sudo.schema fi + if use pam; then pamd_mimic system-auth sudo auth account session pamd_mimic system-auth sudo-i auth account session @@ -215,11 +212,6 @@ src_install() { rm -rf "${ED}"/run || die find "${ED}" -type f -name "*.la" -delete || die #697812 - - # Flatcar specific: - # - remove sudo.conf (shipped by baselayout) - rm "${ED}/etc/sudo.conf" - # Flatcar end } pkg_postinst() { From c0afb3e9823c29c2359249f16b75275306233925 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Mon, 20 Jun 2022 21:01:24 +0530 Subject: [PATCH 2/3] app-admin/sudo: Apply Flatcar patches - Remove Perl Runtime Dependency - Remove OpenLDAP schema files for sudo - Remove sudo.conf file as it is shipped via baselayout Signed-off-by: Sayan Chowdhury --- .../coreos-overlay/app-admin/sudo/README.md | 8 ++++++++ .../app-admin/sudo/sudo-1.9.10-r1.ebuild | 11 ++++++++--- 2 files changed, 16 insertions(+), 3 deletions(-) create mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/sudo/README.md diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/README.md b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/README.md new file mode 100644 index 0000000000..c90febe8b2 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/README.md @@ -0,0 +1,8 @@ +## Flatcar changes +- Remove Perl Runtime Dependency +- Remove OpenLDAP schema files for sudo +``` +insinto /etc/openldap/schema +newins doc/schema.OpenLDAP sudo.schema +``` +- Remove sudo.conf file as it is shipped via baselayout diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.10-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.10-r1.ebuild index 2f7cd3f358..85fe28fb89 100644 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.10-r1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/sudo/sudo-1.9.10-r1.ebuild @@ -57,11 +57,12 @@ DEPEND=" ssl? ( dev-libs/openssl:0= ) sssd? ( sys-auth/sssd[sudo] ) " +#Flatcar: Remove Perl runtime dependency +# ldap? ( dev-lang/perl ) RDEPEND=" ${DEPEND} >=app-misc/editor-wrapper-3 virtual/editor - ldap? ( dev-lang/perl ) pam? ( sys-auth/pambase ) selinux? ( sec-policy/selinux-sudo ) sendmail? ( virtual/mta ) @@ -194,8 +195,8 @@ src_install() { doins "${T}"/ldap.conf.sudo fperms 0440 /etc/ldap.conf.sudo - insinto /etc/openldap/schema - newins docs/schema.OpenLDAP sudo.schema + #Flatcar: we don't ship OpenLDAP schemas + fi if use pam; then @@ -212,6 +213,10 @@ src_install() { rm -rf "${ED}"/run || die find "${ED}" -type f -name "*.la" -delete || die #697812 + + # Flatcar: Remove sudo.conf as it is shipped via baselayout + rm "${ED}/etc/sudo.conf" || die + } pkg_postinst() { From c605e33d238f1a8120dab79d3405138c563c78ca Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Mon, 27 Jun 2022 17:53:00 +0530 Subject: [PATCH 3/3] app-admin/sudo: Add the changelog for sudo-1.9.10-r1 release Signed-off-by: Sayan Chowdhury --- .../changelog/updates/2022-06-27-sudo-1.9.10-r1.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-06-27-sudo-1.9.10-r1.md diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-06-27-sudo-1.9.10-r1.md b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-06-27-sudo-1.9.10-r1.md new file mode 100644 index 0000000000..10f583c330 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-06-27-sudo-1.9.10-r1.md @@ -0,0 +1 @@ +- sudo ([1.9.10](https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_10))