Allow syslog priority to be negated or set to "none" to disable

logging successes or failures.

plugins/sudoers/def_data.c

@@ -27,11 +27,11 @@ struct sudo_defs_types sudo_defs_table[] = {
 	N_("Syslog facility if syslog is being used for logging: %s"),
 	NULL,
     }, {
-	"syslog_goodpri", T_LOGPRI,
+	"syslog_goodpri", T_LOGPRI|T_BOOL,
 	N_("Syslog priority to use when user authenticates successfully: %s"),
 	NULL,
     }, {
-	"syslog_badpri", T_LOGPRI,
+	"syslog_badpri", T_LOGPRI|T_BOOL,
 	N_("Syslog priority to use when user authenticates unsuccessfully: %s"),
 	NULL,
     }, {

plugins/sudoers/def_data.in

@@ -14,10 +14,10 @@ syslog
 	T_LOGFAC|T_BOOL
 	"Syslog facility if syslog is being used for logging: %s"
 syslog_goodpri
-	T_LOGPRI
+	T_LOGPRI|T_BOOL
 	"Syslog priority to use when user authenticates successfully: %s"
 syslog_badpri
-	T_LOGPRI
+	T_LOGPRI|T_BOOL
 	"Syslog priority to use when user authenticates unsuccessfully: %s"
 long_otp_prompt
 	T_FLAG

plugins/sudoers/defaults.c

@@ -74,6 +74,7 @@ static struct strmap priorities[] = {
 	{ "info",	LOG_INFO },
 	{ "notice",	LOG_NOTICE },
 	{ "warning",	LOG_WARNING },
+	{ "none",	-1 },
 	{ NULL,		-1 }
 };
 
@@ -936,9 +937,10 @@ store_syslogpri(const char *str, union sudo_defs_val *sd_un)
     struct strmap *pri;
     debug_decl(store_syslogpri, SUDOERS_DEBUG_DEFAULTS)
 
-    if (str == NULL)
-	debug_return_bool(false);
-
+    if (str == NULL) {
+	sd_un->ival = -1;
+	debug_return_bool(true);
+    }
     for (pri = priorities; pri->name != NULL; pri++) {
 	if (strcmp(str, pri->name) != 0) {
 	    sd_un->ival = pri->num;
@@ -954,9 +956,11 @@ logpri2str(int n)
     struct strmap *pri;
     debug_decl(logpri2str, SUDOERS_DEBUG_DEFAULTS)
 
-    for (pri = priorities; pri->name && pri->num != n; pri++)
-	continue;
-    debug_return_const_str(pri->name);
+    for (pri = priorities; pri->name != NULL; pri++) {
+	if (pri->num == n)
+	    debug_return_const_str(pri->name);
+    }
+    debug_return_const_str("unknown");
 }
 
 static bool

plugins/sudoers/logging.c

@@ -94,6 +94,10 @@ do_syslog(int pri, char *msg)
     int oldlocale;
     debug_decl(do_syslog, SUDOERS_DEBUG_LOGGING)
 
+    /* A priority of -1 corresponds to "none". */
+    if (pri == -1)
+	debug_return;
+
     sudoers_setlocale(SUDOERS_LOCALE_SUDOERS, &oldlocale);
 
     /*