Update to sudo 1.6.9p6

14 files changed, 180 insertions, 109 deletions

diff --git a/usr.bin/sudo/CHANGES b/usr.bin/sudo/CHANGES
index f735c15ad68..74810ac7611 100644
--- a/usr.bin/sudo/CHANGES
+++ b/usr.bin/sudo/CHANGES
@@ -1965,3 +1965,13 @@ Sudo 1.6.9p4 released.
 621) Groups and netgroups are now valid in an LDAP sudoRunas statement.
 
 Sudo 1.6.9p5 released.
+
+622) Worked around bugs in the session support of some PAM implementations.
+     The full tty path is now passed to PAM as well.
+
+623) Sudo now only prints the password prompt if the process is in the
+     foreground.
+
+624) inttypes.h is now included when appropriate if it is present.
+
+625) Simplified alias allocation in the parser.
diff --git a/usr.bin/sudo/INSTALL b/usr.bin/sudo/INSTALL
index c18fcf9dee3..b03d9e8ef39 100644
--- a/usr.bin/sudo/INSTALL
+++ b/usr.bin/sudo/INSTALL
@@ -252,6 +252,13 @@ Special features/options:
 	is to compile noexec support if libtool supports building
 	shared objects on your OS.
 
+  --disable-pam-session
+        Disable sudo's PAM session support.  This may be needed on
+        older PAM implementations or on operating systems where
+        opening a PAM session changes the utmp or wtmp files.  If
+        PAM session support is disabled, resource limits may not
+        be updatedin for command being run.
+
   --disable-root-mailer
 	By default sudo will run the mailer as root when tattling
 	on a user so as to prevent that user from killing the mailer.
diff --git a/usr.bin/sudo/Makefile.in b/usr.bin/sudo/Makefile.in
index c79da3320e5..3b47966bdce 100644
--- a/usr.bin/sudo/Makefile.in
+++ b/usr.bin/sudo/Makefile.in
@@ -20,7 +20,7 @@
 #
 # @configure_input@
 #
-# $Sudo: Makefile.in,v 1.246.2.15 2007/09/05 23:23:44 millert Exp $
+# $Sudo: Makefile.in,v 1.246.2.16 2007/10/09 13:29:20 millert Exp $
 #
 
 #### Start of system configuration section. ####
@@ -131,7 +131,7 @@ TESTOBJS = interfaces.o testsudoers.o $(PARSEOBJS)
 
 LIBOBJS = @LIBOBJS@ @ALLOCA@
 
-VERSION = 1.6.9p5
+VERSION = 1.6.9p6
 
 DISTFILES = $(SRCS) $(HDRS) BUGS CHANGES HISTORY INSTALL INSTALL.configure \
             LICENSE Makefile.in PORTING README README.LDAP \
diff --git a/usr.bin/sudo/alloc.c b/usr.bin/sudo/alloc.c
index ce511a53dd2..745c8ae66e1 100644
--- a/usr.bin/sudo/alloc.c
+++ b/usr.bin/sudo/alloc.c
@@ -46,11 +46,14 @@
 #else
 # include "emul/err.h"
 #endif /* HAVE_ERR_H */
+#ifdef HAVE_INTTYPES_H
+# include <inttypes.h>
+#endif
 
 #include "sudo.h"
 
 #ifndef lint
-__unused static const char rcsid[] = "$Sudo: alloc.c,v 1.23.2.3 2007/06/12 01:43:01 millert Exp $";
+__unused static const char rcsid[] = "$Sudo: alloc.c,v 1.23.2.4 2007/09/11 12:20:15 millert Exp $";
 #endif /* lint */
 
 /*
diff --git a/usr.bin/sudo/config.h.in b/usr.bin/sudo/config.h.in
index 765f6c53733..8e4af59f9fc 100644
--- a/usr.bin/sudo/config.h.in
+++ b/usr.bin/sudo/config.h.in
@@ -483,6 +483,9 @@
    sudo. */
 #undef NO_LECTURE
 
+/* Define to 1 if you don't want to use sudo's PAM session support. */
+#undef NO_PAM_SESSION
+
 /* Define to avoid runing the mailer as root. */
 #undef NO_ROOT_MAILER
 
diff --git a/usr.bin/sudo/configure b/usr.bin/sudo/configure
index 6dc4d81647a..b691ec4f9ae 100644
--- a/usr.bin/sudo/configure
+++ b/usr.bin/sudo/configure
@@ -1490,6 +1490,7 @@ Optional Features:
                           optimize for fast installation [default=yes]
   --disable-libtool-lock  avoid locking (might break parallel builds)
   --disable-sia           Disable SIA on Digital UNIX
+  --disable-pam-session   Disable PAM session support
 
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
@@ -6082,7 +6083,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 6085 "configure"' > conftest.$ac_ext
+  echo '#line 6086 "configure"' > conftest.$ac_ext
   if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -7626,11 +7627,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7629: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7630: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:7633: \$? = $ac_status" >&5
+   echo "$as_me:7634: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -7916,11 +7917,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7919: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7920: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:7923: \$? = $ac_status" >&5
+   echo "$as_me:7924: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -8020,11 +8021,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:8023: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:8024: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:8027: \$? = $ac_status" >&5
+   echo "$as_me:8028: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -10365,7 +10366,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 10368 "configure"
+#line 10369 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -10465,7 +10466,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 10468 "configure"
+#line 10469 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -19145,6 +19146,32 @@ _ACEOF
 
 	AUTH_OBJS="$AUTH_OBJS pam.o";
 	AUTH_EXCL=PAM
+	{ echo "$as_me:$LINENO: checking whether to use PAM session support" >&5
+echo $ECHO_N "checking whether to use PAM session support... $ECHO_C" >&6; }
+	# Check whether --enable-pam_session was given.
+if test "${enable_pam_session+set}" = set; then
+  enableval=$enable_pam_session;  case "$enableval" in
+		yes)	{ echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+			;;
+		no)		{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+			    cat >>confdefs.h <<\_ACEOF
+#define NO_PAM_SESSION 1
+_ACEOF
+
+			    ;;
+		*)		{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+			    { echo "$as_me:$LINENO: WARNING: Ignoring unknown argument to --enable-pam-session: $enableval" >&5
+echo "$as_me: WARNING: Ignoring unknown argument to --enable-pam-session: $enableval" >&2;}
+			    ;;
+	    esac
+else
+  { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+fi
+
     fi
 fi
 
diff --git a/usr.bin/sudo/configure.in b/usr.bin/sudo/configure.in
index 4d430c3e6a3..1ff46fadea4 100644
--- a/usr.bin/sudo/configure.in
+++ b/usr.bin/sudo/configure.in
@@ -1,6 +1,6 @@
 dnl
 dnl Process this file with GNU autoconf to produce a configure script.
-dnl $Sudo: configure.in,v 1.413.2.23 2007/09/06 16:19:57 millert Exp $
+dnl $Sudo: configure.in,v 1.413.2.24 2007/10/09 00:06:05 millert Exp $
 dnl
 dnl Copyright (c) 1994-1996,1998-2007 Todd C. Miller <Todd.Miller@courtesan.com>
 dnl
@@ -1815,6 +1815,19 @@ if test ${with_pam-"no"} != "no"; then
 	AC_DEFINE(HAVE_PAM)
 	AUTH_OBJS="$AUTH_OBJS pam.o";
 	AUTH_EXCL=PAM
+	AC_MSG_CHECKING(whether to use PAM session support)
+	AC_ARG_ENABLE(pam_session,
+	[  --disable-pam-session   Disable PAM session support],
+	    [ case "$enableval" in
+		yes)	AC_MSG_RESULT(yes)
+			;;
+		no)		AC_MSG_RESULT(no)
+			    AC_DEFINE(NO_PAM_SESSION)
+			    ;;
+		*)		AC_MSG_RESULT(no)
+			    AC_MSG_WARN([Ignoring unknown argument to --enable-pam-session: $enableval])
+			    ;;
+	    esac], AC_MSG_RESULT(yes))
     fi
 fi
 
diff --git a/usr.bin/sudo/def_data.c b/usr.bin/sudo/def_data.c
index 0a95b30fcff..b1bf17acf02 100644
--- a/usr.bin/sudo/def_data.c
+++ b/usr.bin/sudo/def_data.c
@@ -147,10 +147,6 @@ struct sudo_defs_types sudo_defs_table[] = {
 	"Only set the effective uid to the target user, not the real uid",
 	NULL,
     }, {
-	"env_reset", T_FLAG,
-	"Reset the environment to a default set of variables",
-	NULL,
-    }, {
 	"preserve_groups", T_FLAG,
 	"Don't initialize the group vector to that of the target user",
 	NULL,
@@ -240,6 +236,18 @@ struct sudo_defs_types sudo_defs_table[] = {
 	"File containing dummy exec functions: %s",
 	NULL,
     }, {
+	"ignore_local_sudoers", T_FLAG,
+	"If LDAP directory is up, do we ignore local sudoers file",
+	NULL,
+    }, {
+	"setenv", T_FLAG,
+	"Allow users to set arbitrary environment variables",
+	NULL,
+    }, {
+	"env_reset", T_FLAG,
+	"Reset the environment to a default set of variables",
+	NULL,
+    }, {
 	"env_check", T_LIST|T_BOOL,
 	"Environment variables to check for sanity:",
 	NULL,
@@ -252,14 +260,6 @@ struct sudo_defs_types sudo_defs_table[] = {
 	"Environment variables to preserve:",
 	NULL,
     }, {
-	"ignore_local_sudoers", T_FLAG,
-	"If LDAP directory is up, do we ignore local sudoers file",
-	NULL,
-    }, {
-	"setenv", T_FLAG,
-	"Allow users to set arbitrary environment variables",
-	NULL,
-    }, {
 	NULL, 0, NULL
     }
 };
diff --git a/usr.bin/sudo/def_data.h b/usr.bin/sudo/def_data.h
index 70030bb3da5..1cb00ff99f8 100644
--- a/usr.bin/sudo/def_data.h
+++ b/usr.bin/sudo/def_data.h
@@ -60,62 +60,62 @@
 #define I_SET_LOGNAME           29
 #define def_stay_setuid         (sudo_defs_table[30].sd_un.flag)
 #define I_STAY_SETUID           30
-#define def_env_reset           (sudo_defs_table[31].sd_un.flag)
-#define I_ENV_RESET             31
-#define def_preserve_groups     (sudo_defs_table[32].sd_un.flag)
-#define I_PRESERVE_GROUPS       32
-#define def_loglinelen          (sudo_defs_table[33].sd_un.ival)
-#define I_LOGLINELEN            33
-#define def_timestamp_timeout   (sudo_defs_table[34].sd_un.ival)
-#define I_TIMESTAMP_TIMEOUT     34
-#define def_passwd_timeout      (sudo_defs_table[35].sd_un.ival)
-#define I_PASSWD_TIMEOUT        35
-#define def_passwd_tries        (sudo_defs_table[36].sd_un.ival)
-#define I_PASSWD_TRIES          36
-#define def_umask               (sudo_defs_table[37].sd_un.mode)
-#define I_UMASK                 37
-#define def_logfile             (sudo_defs_table[38].sd_un.str)
-#define I_LOGFILE               38
-#define def_mailerpath          (sudo_defs_table[39].sd_un.str)
-#define I_MAILERPATH            39
-#define def_mailerflags         (sudo_defs_table[40].sd_un.str)
-#define I_MAILERFLAGS           40
-#define def_mailto              (sudo_defs_table[41].sd_un.str)
-#define I_MAILTO                41
-#define def_mailsub             (sudo_defs_table[42].sd_un.str)
-#define I_MAILSUB               42
-#define def_badpass_message     (sudo_defs_table[43].sd_un.str)
-#define I_BADPASS_MESSAGE       43
-#define def_timestampdir        (sudo_defs_table[44].sd_un.str)
-#define I_TIMESTAMPDIR          44
-#define def_timestampowner      (sudo_defs_table[45].sd_un.str)
-#define I_TIMESTAMPOWNER        45
-#define def_exempt_group        (sudo_defs_table[46].sd_un.str)
-#define I_EXEMPT_GROUP          46
-#define def_passprompt          (sudo_defs_table[47].sd_un.str)
-#define I_PASSPROMPT            47
-#define def_runas_default       (sudo_defs_table[48].sd_un.str)
-#define I_RUNAS_DEFAULT         48
-#define def_editor              (sudo_defs_table[49].sd_un.str)
-#define I_EDITOR                49
-#define def_listpw              (sudo_defs_table[50].sd_un.tuple)
-#define I_LISTPW                50
-#define def_verifypw            (sudo_defs_table[51].sd_un.tuple)
-#define I_VERIFYPW              51
-#define def_noexec              (sudo_defs_table[52].sd_un.flag)
-#define I_NOEXEC                52
-#define def_noexec_file         (sudo_defs_table[53].sd_un.str)
-#define I_NOEXEC_FILE           53
-#define def_env_check           (sudo_defs_table[54].sd_un.list)
-#define I_ENV_CHECK             54
-#define def_env_delete          (sudo_defs_table[55].sd_un.list)
-#define I_ENV_DELETE            55
-#define def_env_keep            (sudo_defs_table[56].sd_un.list)
-#define I_ENV_KEEP              56
-#define def_ignore_local_sudoers (sudo_defs_table[57].sd_un.flag)
-#define I_IGNORE_LOCAL_SUDOERS  57
-#define def_setenv              (sudo_defs_table[58].sd_un.flag)
-#define I_SETENV                58
+#define def_preserve_groups     (sudo_defs_table[31].sd_un.flag)
+#define I_PRESERVE_GROUPS       31
+#define def_loglinelen          (sudo_defs_table[32].sd_un.ival)
+#define I_LOGLINELEN            32
+#define def_timestamp_timeout   (sudo_defs_table[33].sd_un.ival)
+#define I_TIMESTAMP_TIMEOUT     33
+#define def_passwd_timeout      (sudo_defs_table[34].sd_un.ival)
+#define I_PASSWD_TIMEOUT        34
+#define def_passwd_tries        (sudo_defs_table[35].sd_un.ival)
+#define I_PASSWD_TRIES          35
+#define def_umask               (sudo_defs_table[36].sd_un.mode)
+#define I_UMASK                 36
+#define def_logfile             (sudo_defs_table[37].sd_un.str)
+#define I_LOGFILE               37
+#define def_mailerpath          (sudo_defs_table[38].sd_un.str)
+#define I_MAILERPATH            38
+#define def_mailerflags         (sudo_defs_table[39].sd_un.str)
+#define I_MAILERFLAGS           39
+#define def_mailto              (sudo_defs_table[40].sd_un.str)
+#define I_MAILTO                40
+#define def_mailsub             (sudo_defs_table[41].sd_un.str)
+#define I_MAILSUB               41
+#define def_badpass_message     (sudo_defs_table[42].sd_un.str)
+#define I_BADPASS_MESSAGE       42
+#define def_timestampdir        (sudo_defs_table[43].sd_un.str)
+#define I_TIMESTAMPDIR          43
+#define def_timestampowner      (sudo_defs_table[44].sd_un.str)
+#define I_TIMESTAMPOWNER        44
+#define def_exempt_group        (sudo_defs_table[45].sd_un.str)
+#define I_EXEMPT_GROUP          45
+#define def_passprompt          (sudo_defs_table[46].sd_un.str)
+#define I_PASSPROMPT            46
+#define def_runas_default       (sudo_defs_table[47].sd_un.str)
+#define I_RUNAS_DEFAULT         47
+#define def_editor              (sudo_defs_table[48].sd_un.str)
+#define I_EDITOR                48
+#define def_listpw              (sudo_defs_table[49].sd_un.tuple)
+#define I_LISTPW                49
+#define def_verifypw            (sudo_defs_table[50].sd_un.tuple)
+#define I_VERIFYPW              50
+#define def_noexec              (sudo_defs_table[51].sd_un.flag)
+#define I_NOEXEC                51
+#define def_noexec_file         (sudo_defs_table[52].sd_un.str)
+#define I_NOEXEC_FILE           52
+#define def_ignore_local_sudoers (sudo_defs_table[53].sd_un.flag)
+#define I_IGNORE_LOCAL_SUDOERS  53
+#define def_setenv              (sudo_defs_table[54].sd_un.flag)
+#define I_SETENV                54
+#define def_env_reset           (sudo_defs_table[55].sd_un.flag)
+#define I_ENV_RESET             55
+#define def_env_check           (sudo_defs_table[56].sd_un.list)
+#define I_ENV_CHECK             56
+#define def_env_delete          (sudo_defs_table[57].sd_un.list)
+#define I_ENV_DELETE            57
+#define def_env_keep            (sudo_defs_table[58].sd_un.list)
+#define I_ENV_KEEP              58
 
 enum def_tupple {
 	never,
diff --git a/usr.bin/sudo/def_data.in b/usr.bin/sudo/def_data.in
index a3633f0fe53..09500d4af6f 100644
--- a/usr.bin/sudo/def_data.in
+++ b/usr.bin/sudo/def_data.in
@@ -101,9 +101,6 @@ set_logname
 stay_setuid
 	T_FLAG
 	"Only set the effective uid to the target user, not the real uid"
-env_reset
-	T_FLAG
-	"Reset the environment to a default set of variables"
 preserve_groups
 	T_FLAG
 	"Don't initialize the group vector to that of the target user"
@@ -173,6 +170,15 @@ noexec
 noexec_file
 	T_STR|T_PATH
 	"File containing dummy exec functions: %s"
+ignore_local_sudoers
+	T_FLAG
+	"If LDAP directory is up, do we ignore local sudoers file"
+setenv
+	T_FLAG
+	"Allow users to set arbitrary environment variables"
+env_reset
+	T_FLAG
+	"Reset the environment to a default set of variables"
 env_check
 	T_LIST|T_BOOL
 	"Environment variables to check for sanity:"
@@ -182,9 +188,3 @@ env_delete
 env_keep
 	T_LIST|T_BOOL
 	"Environment variables to preserve:"
-ignore_local_sudoers
-	T_FLAG
-	"If LDAP directory is up, do we ignore local sudoers file"
-setenv
-	T_FLAG
-	"Allow users to set arbitrary environment variables"
diff --git a/usr.bin/sudo/sudo.c b/usr.bin/sudo/sudo.c
index 3e0f7a80b8a..4e201d11faf 100644
--- a/usr.bin/sudo/sudo.c
+++ b/usr.bin/sudo/sudo.c
@@ -102,7 +102,7 @@
 #include "version.h"
 
 #ifndef lint
-__unused __unused static const char rcsid[] = "$Sudo: sudo.c,v 1.369.2.30 2007/08/18 12:25:41 millert Exp $";
+__unused __unused static const char rcsid[] = "$Sudo: sudo.c,v 1.369.2.31 2007/09/13 23:06:51 millert Exp $";
 #endif /* lint */
 
 /*
@@ -540,9 +540,9 @@ init_vars(sudo_mode, envp)
     }
 
     if ((p = ttyname(STDIN_FILENO)) || (p = ttyname(STDOUT_FILENO))) {
-	if (strncmp(p, _PATH_DEV, sizeof(_PATH_DEV) - 1) == 0)
-	    p += sizeof(_PATH_DEV) - 1;
-	user_tty = estrdup(p);
+	user_tty = user_ttypath = estrdup(p);
+	if (strncmp(user_tty, _PATH_DEV, sizeof(_PATH_DEV) - 1) == 0)
+	    user_tty += sizeof(_PATH_DEV) - 1;
     } else
 	user_tty = "unknown";
 
diff --git a/usr.bin/sudo/sudo.h b/usr.bin/sudo/sudo.h
index 00b6c236790..35fbd167116 100644
--- a/usr.bin/sudo/sudo.h
+++ b/usr.bin/sudo/sudo.h
@@ -17,7 +17,7 @@
  * Agency (DARPA) and Air Force Research Laboratory, Air Force
  * Materiel Command, USAF, under agreement number F39502-99-1-0512.
  *
- * $Sudo: sudo.h,v 1.209.2.10 2007/07/06 14:14:34 millert Exp $
+ * $Sudo: sudo.h,v 1.209.2.11 2007/09/13 23:06:51 millert Exp $
  */
 
 #ifndef _SUDO_SUDO_H
@@ -39,6 +39,7 @@ struct sudo_user {
     char *path;
     char *shell;
     char *tty;
+    char *ttypath;
     char  cwd[PATH_MAX];
     char *host;
     char *shost;
@@ -132,6 +133,7 @@ struct sudo_user {
 #define user_ngroups		(sudo_user.ngroups)
 #define user_groups		(sudo_user.groups)
 #define user_tty		(sudo_user.tty)
+#define user_ttypath		(sudo_user.ttypath)
 #define user_cwd		(sudo_user.cwd)
 #define user_runas		(sudo_user.runas)
 #define user_cmnd		(sudo_user.cmnd)
diff --git a/usr.bin/sudo/tgetpass.c b/usr.bin/sudo/tgetpass.c
index 2fec0d819f9..6e356cd6d7a 100644
--- a/usr.bin/sudo/tgetpass.c
+++ b/usr.bin/sudo/tgetpass.c
@@ -70,7 +70,7 @@
 #include "sudo.h"
 
 #ifndef lint
-__unused static const char rcsid[] = "$Sudo: tgetpass.c,v 1.111.2.2 2007/06/12 01:26:35 millert Exp $";
+__unused static const char rcsid[] = "$Sudo: tgetpass.c,v 1.111.2.4 2007/10/08 16:01:10 millert Exp $";
 #endif /* lint */
 
 #ifndef TCSASOFT
@@ -135,6 +135,9 @@ tgetpass(prompt, timeout, flags)
 
     (void) fflush(stdout);
 restart:
+    signo = 0;
+    pass = NULL;
+    save_errno = 0;
     /* Open /dev/tty for reading/writing if possible else use stdin/stderr. */
     if (ISSET(flags, TGP_STDIN) ||
 	(input = output = open(_PATH_TTY, O_RDWR|O_NOCTTY)) == -1) {
@@ -172,17 +175,20 @@ restart:
 	memset(&oterm, 0, sizeof(oterm));
     }
 
-    if (prompt)
-	(void) write(output, prompt, strlen(prompt));
+    /* No output if we are already backgrounded. */
+    if (signo != SIGTTOU && signo != SIGTTIN) {
+	if (prompt)
+	    (void) write(output, prompt, strlen(prompt));
 
-    if (timeout > 0)
-	alarm(timeout);
-    pass = getln(input, buf, sizeof(buf));
-    alarm(0);
-    save_errno = errno;
+	if (timeout > 0)
+	    alarm(timeout);
+	pass = getln(input, buf, sizeof(buf));
+	alarm(0);
+	save_errno = errno;
 
-    if (!ISSET(term.tflags, ECHO))
-	(void) write(output, "\n", 1);
+	if (!ISSET(term.tflags, ECHO))
+	    (void) write(output, "\n", 1);
+    }
 
     /* Restore old tty settings and signals. */
     if (memcmp(&term, &oterm, sizeof(term)) != 0)
@@ -208,12 +214,12 @@ restart:
 	    case SIGTSTP:
 	    case SIGTTIN:
 	    case SIGTTOU:
-		signo = 0;
 		goto restart;
 	}
     }
 
-    errno = save_errno;
+    if (save_errno)
+	errno = save_errno;
     return(pass);
 }
 
diff --git a/usr.bin/sudo/version.h b/usr.bin/sudo/version.h
index 7a7933e2bdf..0d55e99f169 100644
--- a/usr.bin/sudo/version.h
+++ b/usr.bin/sudo/version.h
@@ -17,12 +17,12 @@
  * Agency (DARPA) and Air Force Research Laboratory, Air Force
  * Materiel Command, USAF, under agreement number F39502-99-1-0512.
  *
- * $Sudo: version.h,v 1.66.2.8 2007/09/05 23:21:50 millert Exp $
+ * $Sudo: version.h,v 1.66.2.9 2007/10/09 13:29:20 millert Exp $
  */
 
 #ifndef _SUDO_VERSION_H
 #define _SUDO_VERSION_H
 
-static const char version[] = "1.6.9p5";
+static const char version[] = "1.6.9p6";
 
 #endif /* _SUDO_VERSION_H */