sudo/TODO

TODO list (most will be addressed in sudo 2.0)

01) Redo parsing to be more like op(8) with true command aliases where
    can specify uid, gid(s) and part/all of the environment.

02) Add a SHELLS reserved word that checks against /etc/shells.

03) Make the sudoers file accessible via NIS, NIS+.

04) Add a -h (?) flag to sudo for a history mechanism.

05) Add Prog_Alias facility (Prog_Alias VI = /usr/secure/bin/vi +args).

06) Add generic STREAMS support for getting interfaces and netmasks.

07) Add support for "safe scripts" by checking for shell script
    cookie (first two bytes are "#!") and execing the shell outselves
    after doing the stat to guard against spoofing.  This should avoid
    the race condition caused by going through namei() twice...

08) Should be able to mix Cmnd_Alias's and command args.  Ie:
	pete   ALL=PASSWD [A-z]*,!PASSWD root
    where PASSWD was defined to be /usr/bin/passwd.
    This requires the arg parsing to happen in the yacc grammer.
    At the very least, commands and args have to become separate
    tokens in the lexer.

09) Add a per-tty restriction?  Ie: only can run foo from /dev/console.

10) Add test for how to read ether interfaces in configure script

11) Use strtol() and strtoul(), not atoi()

12) Implement date_format and log_format options.

13) Add support for: Default:user@host

14) Some people want to be able to specify a special password in sudoers
    in addition or instead of the normal one.  The best argument for
    this so far is to be able to use separate passwords for the
    target users that are not the passwd file ones.

15) Add support for trusted users.  E.g. allow user to run a certain
    command regardless of what dir it is in if it is owned by the
    trusted user.

16) Add a flag similar to '-l' but that spits out sudo commands in
    a format suitable for cut & paste into sudoers.

17) Someone wants a recursive version of the dir specifier.  Ie:
    SOME_MODIFIER:/usr/local/ to allow anything under /usr/local to be run.

18) An option to set the shell to the target user would make sense.
    See other target user-related issues above.

19) Add an option (-D) to dump the defaults after the sudoers file
    has been parsed.  Should only be available to root and should
    allow a -u user modifier.  Maybe dump all of sudoers?

20) Allow /etc/sudoers to be a symlink but require the parent dir to
    be root-owned and not writable by anything else.  Should really
    traverse the tree to the root doing this.

21) Improve interfaces.c STREAMS code (see ntpd's ntp_io.c for hints)

22) Wildcard support for user and group names? (netgroup too?)

23) If root_sudo is off, still allow sudo -u to non-root users?

24) For AIX, use setpenv() and setpcred() if they exist
    http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/libs/basetrf2/setpenv.htm
    http://publib16.boulder.ibm.com/pseries/en_US/libs/basetrf2/setpcred.htm

25) Add an insult_path variable that is intialized to "builtin" but that
    can point to other files containing an insult count as the first
    line and that have a constant record length (sparse files) for
    easy seeking.

26) Some way of using a new pty for the program run via sudo would prevent
    access to the caller's /dev/tty (but probably makes job control tricky).

27) Maybe have a database of checksums that commands are verified against.
    Basically replace the st_ino/st_dev check with a checksum lookup.

28) Look into testing writability of a file via sudoedit *before* doing
    the edit; e.g., try opening with O_APPEND.

29) Add Makefile.in bits to autogenerate Solaris and Irix packages

30) Add a session mode where sudo allocates a pty and logs everything
    that occurs ala script(1).

31) Use pam_open_session() and pam_close_session() (requires a persistent
    sudo process to call pam_close_session()).  Maybe add xauth support for
    the non-pam case?

32) Add substitution mechanism in sudoers to subst, e.g. editors for sudoedit

33) Move prototypes to extern.h?

34) visudo -c should also sanity check aliases

35) Use AC_CHECK_DECLS for systems w/o proper prototypes?  Maybe errno too?

36) Flesh out testsudoers and fix glob/opendir issues.  Use custom netgroup
    code too?

37) Think some more about giving admins a way to test commands for a user
    on a specific host with a different sudoers file.

38) Refactor duplicated code in ldap.c into wrapper functions.

39) Return command from command_matches() instead of setting safe_cmnd directly.

40) Roll visudo into sudo ala sudoedit.

41) Add ticket file to ticket dir in non-tty tickets case so we
    can mix tty and non-tty ticket schemes.

42) Add support for NOEXEC w/ 64-bit AIX executables.
    http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.xlf91a.doc/xlfug/comp64.htm

43) Revisit debian fqdn diffs.

44) Add gettext() support.  Can borrow some translations from PAM.

45) Convert the other capitalized files into .pod so we can get decent html
    form them?  E.g. README, etc.  E.g.
	pod2text -l -i0 history.pod > HISTORY
	pod2html --noindex history.pod > history.html

46) Use mkstemp() for visudo temp files?  Also re-examine locking.

47) Run sudo through valgrind --tool=memcheck on Linux.  Need to
    add #ifdefs to free stuff on exit, e.g.  #ifdef PURIFY

48) Consolidate line wrap code.

49) How can we distinguish between a bare '\\' and one that is escaping
    glob chars?  Right now we convert \\ -> \ in the lexer which
    causes the confusion.

50) For LDAP entries, should be able to parse the per-command options
    since they may affect the outcome (e.g. default_runas).

51) Set usrinfo for AIX, see openssh.

52) Consider adding -d (debug) flag for both LDAP and files sudoers lookups.
    Is it safe to allow normal users to use it?

53) Why does testsudoers give wrong line number for parse error?

54) Add non-interactive flag that, if set, just fails if a password is req'd

55) Should send mail if sudoers does not parse

56) Add arg markup to indicate that an arg is a path and treat it specially
    regarding cwd.

57) Should -k/-K clear *all* timestamps in tty_ticket mode?
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=306919

58) Dan says Pam activity should probably be happening after
    setkeycreatecon and setexeccon (which may use the keyring or
    run external commands).  However, this means sendmail
    will be executed w/ the new context if user is denied.

59) Allow the -k flag to be used in conjunction with other flags
    so you can force a password check w/ a command.

60) Decide between option and flag in sudo and visudo man pages