-------------------
What's new for version 3.7.2:

    A.  Added owner=xxx option so that super won't run a program
	unless it's owned by xxx.

-------------------
What's new for version 3.7.1:

    A.  Modified error msg for clarity.

    B.  Won't run setuid-root if super.tab isn't owned by root.
	If real uid is root, bail out: don't run at all.
	If real uid isn't root, run as real uid (can be useful
	for testing).

    C.  If super.tab file isn't owned by root, or if it is group- or
	world-writable, won't run setuid-root.  (If real uid is root,
	won't run at all; otherwise, euid reverts to real uid.)

-------------------
What's new for version 3.7.0:

    A.  Changed hostname comparisons to be case-insensitive.

	(From Steve Robbins -- steve@cim.mcgill.ca)

    B.  New capability: wildcard commands.

	In previous versions of super, entries in the super.tab file
	looked like:

		CmdName   FullPathName   PermittedUsers

	This is now supplanted by a new format, which is a superset
	of the previous one (note that all existing super.tab files
	remain valid):

		CmdPattern  FullPathName-with-optional-"*"  PermittedUsers

	There are two new features here:

	    1) The former CmdName string is now interpreted as a pattern
		(with csh-style brace expansion, so that it can
		actually stand for a variety of commands).

	    2) If there is an asterisk in FullPathName, it is replaced
		by the user's cmd.

	In the usual situation, in which CmdPattern is still just a plain
	name without wildcards, the user (a) types "super cmd";
	(b) the cmd is matched against CmdPattern;
	(c) the user checked to be a PermittedUser, etc;
	(d) FullPathName is then executed.  As long as CmdPattern is
	just made up of letters, digits, and underscore, and
	FullPathName has no asterisk, the effect will be exactly
	as super has always acted.
	
	If you put special pattern-matching characters into the CmdPattern,
	you simply give more ways a user can execute the same FullPathName.
	This isn't yet very exciting, and in fact isn't a good idea at
	all.  The power of using patterns in the CmdPattern string comes
	when FullPathName includes an asterisk.  In that case, the asterisk
	is replaced with the user's "cmd" string to form the actual
	command to exec.  For instance, a SysV-based host might have
	an entry in the super.tab file that looks like:

		/usr/bin/{lp,lpstat,disable,enable,cancel} * :operators

	This would allow anybody in the "operators" group to have root access
	to the line printer commands.  For instance, if the user typed:

		super /usr/bin/disable some_printer
	
	then the FullPathName == "*" would be replaced by /usr/bin/disable,
	and become the command to exec.

	More conveniently, the super.tab file could have a line like:

		{lp,lpstat,disable,enable,cancel} /usr/bin/* :operators

	In this case, the user can type

		super disable some_printer

	The asterisk is replaced by "disable" to form the command
	/usr/bin/disable.

	If you _completely_ trust some users, but want logging of all
	actions, you could use:

		/*	*	ReallyReallyTrustedUsers

	(if the global option patterns=shell has been set) or

		/.*	*	ReallyReallyTrustedUsers

	(the default case: patterns=regex).

	The user can now execute any command.  Note that the pattern
	begins with a slash, to ensure that the cmd must be an
	absolute path -- this helps avoid accidental execs of the
	wrong program.

	(These changes were inspired by Aaron Schuman, schuman@sgi.com)

-------------------
What's new for version 3.6.1:

    A.  Added support for shadow passwords on HP-UX 9.x.

-------------------
What's new for version 3.6.0:

    A.  Changed super's logging to offer networked syslog messages:
	all syslog messages can be sent to a single host.

    B.  Provided bugfix with -V option (super could coredump otherwise).

	(These changes provided by Jean-luc Szpyrka, jls@sophia.inria.fr)

-------------------
What's new for version 3.5.2:

    A.  Bugfix: the full path of the executed command was inserted
	as argv[1] in the output arguments, when it didn't belong there
	at all.

    B.  Bugfix: log messages for _successful_ commands weren't
	being newline-terminated.

	(These bugs reported by Olof Backing, obg@nada.kth.se)

-------------------
What's new for version 3.5.1:

    A.  Added better copyright + licensing info.

    B.  Did some code cleanup (getting rid of unused variables, adding
	declaration of wait(), etc).

    C.  After logging a super call to the logfile, failed exec's might
	not be printed on the screen (although they were
	logged in the logfile).

-------------------
What's new for version 3.5:

    A.  Added pattern negation to super.tab:
	    !pat
	says to disallow a user who matches the pattern.
	Until now, you could only give permission to users that
	matched, not take it away.  Patterns are scanned left-to-right,
	and the allow/disallow depends on the last pattern that matches.
	This lets you do things like

	    cmd	/Full/Path	:goodguys   !jan

	to mean allow anybody in group goodguys, but then disallows
	user jan, even if jan is in goodguys.

    B.  Added user/group/host patterns to the global settings:

	    /	/	[global opts]	pat pat ... <> pat pat ...

	User/group/host patterns to the left of "<>" are processed
	_before_ the per-command patterns; user/group/host patterns
	to the right of "<>" are processed _after_ the per-command
	patterns.  If "<>" is missing, all patterns are processed after
	the user patterns.
	For example,

	    /	/		jan <> !@+badhosts

	says that user jan can execute any command (unless a per-command
	pattern explicitly disallows jan from executing a particular
	command), but under no circumstances will a user on any host in
	netgroup ``badhosts'' be allowed to execute any command.
	(Thus jan can execute any command, but only from hosts _not_
	in ``badhosts''.)

	(These changes were inspired by Jean-luc Szpyrka,
	jls@sophia.inria.fr .)

    C.  Added special handling of hostnames:  If a host is using
	DNS names, and the hostname isn't matched in the super.tab
	file, it's possible that the reason is simply that gethostname()
	returns a name with fewer or more components of the fully-qualified
	domain name (fqdn) than is in the hostname pattern in super.tab.
	For example, gethostname() might return "w.x.y.z", but the
	hostname pattern might be simply "w".  Until now, super wouldn't
	consider this a successful match.
	
	If you enable the new feature USE_GETHOSTBYNAME, then
	if the hostname doesn't match the pattern directly, super will
	determine the fqdn, and then compare ever-shorter parts against
	the pattern.  For instance, given the hostname "ab.cd.ef.gh",
	super will test "ab.cd.ef.gh", then "ab.cd.ef", then "ab.cd",
	and finally "ab".   Warning: using this option may reduce
	security a bit - your host may query a nameserver on another
	host to obtain the FQDN, and that nameserver could conceivably
	have been subverted and then return incorrect hostnames.

	(Idea from Dave Curry, davy@ecn.purdue.edu).


    D.  Fixed a bug in creating timestamp files.  Basically, unless
	the global option timestampuid=0 was set, one frequently got
	a message "Timestamp creation failed" and then couldn't
	run a command requiring a password.

	(Bug reported by Brian Huntley,
	bhuntley%tsegw.tse.com@spectre.uunet.ca)

    E.  Changed super's logging to include the arguments passed to
	the command.
	
	(Patch from Dave Curry, davy@ecn.purdue.edu).

    F.  An error in the str_val() function allowed some typos in
	option names to pass unnoticed.  Files with properly typed
	option names were not affected.

    G.  Modified some error messages that were not printing accurate
	information about why access was being denied.

    H.  Bugfix: comments in super.tab are supposed to only go up to
	newline, but instead they ran to the end of an input block.

    I.  Ported to SCO 3.2v4.

	(Changes from Keith Menard, menard@gateway.wtc.com)

    J.  Fixed error in processing backslashes in super.tab lines
	(backslash-newline was being processed correctly; others left
	super in an infinite loop).

    K.  Stripped down the strqtok function that splits input lines
	of text.


-------------------
What's new for version 3.4.9:

    A.  Added #ifdef's and Makefile entries for 
	    Clix 3.1 r.7.1.3 (Intergraph)
	contributed by David Sandmann (das@ipro15.aaa.com).

    B.  Added #ifdef'd code to implement scripts that start with
	"#! interpreter" on OS's which don't support it directly.

-------------------
What's new for version 3.4.8:

Minor bugfixes:

    A.  _Successful_ executions of commands were not being logged by
	syslog unless they were also being logged to a (non-syslog) file.

    B.  There were formatting errors and other minor mistakes in
	the super.5 man page.

    C.  Changed the example in README and the super.1 man page regarding
	how a program can super itself, so that it will work on all
	Bourne shell variations (the argument to "test" had to be
	protected against empty strings.)

-------------------
What's new for version 3.4.7:

    A.  Bugfix for patterns like
		    uuu:ggg  and   uuu:
	...valid user is denied access.  Bug report & fix came from
	Karen L Dickerson (kld@mudshark.sunquest.com).

-------------------
What's new for version 3.4.6:

    A.  Bugfix for sites that don't compile with USE_NETGROUP but
	do specify a hostname.  Bug reported by
	Adam P. Harris (apharris@mcs.com).

-------------------
What's new for version 3.4.5:

    A.  Improved parsing for arguments that super supplies to commands.
	Previously, only whitespace would separate arguments.  Version
	3.4.5 parses the FullPathName with recognition of embedded
	quotes and backslashes.

	For example, suppose the super.tab file contains a line like

	    cmd	"FullPath -a -b 2\ 3 -xrm 'r s t \
		    u v w' ..."	SuperOptions...	validusers...

	The "FullPath..." string (containing the arguments -a, -b, ...)
	...  is parsed using Bourne-shell-like rules for backslashes
	and quotes, and the line is parsed as
	    argv[0] FullPath
	    argv[1] -a
	    argv[2] -b
	    argv[3] 2 3
	    argv[4] -xrm
	    argv[5] r s t u v w

	(Use "super -d cmd" to check that your args are being parsed
	as expected before you unleash a new command on your users.)

-------------------
What's new for version 3.4.4:

    A.  The timestamp file of user@host.name.dom is now by default
	stored in
		TIMESTAMP_DIR/hostname/user
	with the old behavior (TIMESTAMP_DIR/user) being an option
	controlled with global option timestampbyhost=y|n.

	The timestampuid=xxx option has been added to allow timestamp
	files to be created under a particular uid.
	This allows for a cross-mounted timestamp directory on hosts
	that map NFS root accesses to nobody, but still keeps the
	password entries distinct on different hosts.

    B.  TIMESTAMP_DIR is now documented in the Makefile, so that it
	is easily configured at compile time.

-------------------
What's new for version 3.4.3:

    A.  Option -H has been added to give the long-winded help information
	that has been the only thing printed until now.

	The -h option now prints a short help listing:

	    Command     Comments
	    -------     --------
	    cmd1        help info for cmd1
	    cmd2        help info for cmd2
	    ...

-------------------
What's new for version 3.4.2:

    A.  If "xyz" is a symlink to super, then
	    % xyz args...
	is treated by super just like
	    % super xyz args...

	Super detects such symlinks by the rule that argv[0] must
	match "*/super" or "super"; otherwise, it's assumed to be
	a symlink.  Therefore, a symlink named "super" won't work --
	super won't recognize it's being invoked via symlink.

-------------------
What's new for version 3.4.1:

    A.  When printing debug info, there was misformatted output
	of any extra file descriptors being held open.  (The
	problem only occurred in 3.4.0, not earlier versions.)

-------------------
What's new for version 3.4:

    A.  Added nargs=[mmm-]nnn to limit user-entered args.

-------------------
What's new for version 3.3.2:

    A.  Allow "@hostname", without any user or groupname part.

-------------------
What's new for version 3.3.1:

    A.  Fixed SunOS 5.x to use "getspnam()" when looking up passwords.

-------------------
What's new for version 3.3:

    A.  Added mail="....." global option.

    B.  Fixed goofy error in parsing password=n.
    
    C.  Added syslog=y|n option.

-------------------
What's new for version 3.2:
    A.  Added options password=y|n, timeout=n, renewtime=y|n to require
	passwords on specific commands (or all commands).

    B.  A bugfix:  if the super.tab file tried to pass options to the
	executable command, the exec would fail.

-------------------
What's new for version 3.1:
    A.  Added global option loguid=xxx to allow the logfile to be opened
	under a uid other than root.  This allows the logfile to be
	shared across a network over which root doesn't have write access.

-------------------
What's new for version 3.0:

    A.  Command logging -- you can specify a file to receive a log
	of super uses and attempts.

    B.  More environment variables -- for each entry, the super.tab file
	can specify environment variables that should be passed to
	the command instead of discarded.  You simply add entries like
	    env=TZ,TAPE
	to the super.tab file, to keep TZ and TAPE in addition to
	the default list.  Of course one has to use this with
	caution.

    C.  Set uid/gid -- for each entry, the super.tab file can specify
	the uid and/or gid (the default is to only change the effective
	uid to root).  To use this, you add entries like
	    uid=xxx   gid=yyy
	to the super.tab file, or  u+g=xxx  to set the uid
	to xxx and the gid to xxx's login gid.
	
	As a supplement to the setuid/setgid ability, super defines
	some extra environment variables so that the invoked command
	can know the username and home directory of the user who
	invoked the command, as well as that of the uid under which
	the command is executing.

    D.  Open file descriptors -- for each entry, the super.tab file
	can specify a list of file descriptors that should not be
	closed (in addition to the default 0,1,2).

    E.  Initial arguments -- for each entry, the super.tab file can
	specify a set of initial arguments that are put into argv[]
	ahead of the arguments the user typed on the command line.

    F.  super -h now only prints the commands that may be executed by the
	user; and the super.tab file can specify a line of explanatory
	text to be printed with each command.

    G.  A bugfix: The TERM environment variable can now contain "-+_.:/"
	in addition to [a-zA-Z0-9].

    H.  The super.tab file can be configured with either Bourne-shell style
	or regex (ed-style) valid-user patterns; the default is regex.

-------------------
What's new for version 2.0:
    A.  A couple of bugfixes.  (These fixes were first introduced
	in version 1.2.)

    B.  You can restrict commands to particular users on particular
	hosts.  This allows one "super.tab" file to serve many hosts.

    C.  Entries in "super.tab" can now span multiple lines.  Helpful
	when one file serves many users + hosts.

    D.  csh-style brace-expansion:  super's pattern-matching previously
	was done with the BSD 4.x regex routines.  This is now extended
	allow csh-style braces.  For instance, to allow users
	pam and sammy, executing from hosts alpha and beta, you can
	use an entry like {pam,sammy}@{alpha,beta}

