isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

command_matches_regex: retry with canonicalized path if possible

Browse Source 
If ctx->user.cmnd doesn't match, use ctx->user.cmnd_dir (if present)
to construct a canonicalized path and match on that.
This commit is contained in:
Todd C. Miller
2023-12-06 10:27:57 -07:00
parent 44f0908e73
commit 0c2de39da3
1 changed files with 12 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
plugins/sudoers/match_command.c
View File

@@ -435,17 +435,6 @@ command_matches_regex(struct sudoers_context *ctx, const char *sudoers_cmnd,
#endif #endif
debug_decl(command_matches_regex, SUDOERS_DEBUG_MATCH); debug_decl(command_matches_regex, SUDOERS_DEBUG_MATCH);
/* A relative ctx->user.cmnd will not match, try canonicalized version. */
if (ctx->user.cmnd[0] != '/') {
if (ctx->user.cmnd_dir == NULL)
debug_return_int(DENY);
len = snprintf(buf, sizeof(buf), "%s/%s", ctx->user.cmnd_dir,
ctx->user.cmnd_base);
if (len < 0 || len >= ssizeof(buf))
debug_return_int(DENY);
cmnd = buf;
}
/* /*
* Return ALLOW if sudoers_cmnd regex matches cmnd AND * Return ALLOW if sudoers_cmnd regex matches cmnd AND
* a) there are no args in sudoers OR * a) there are no args in sudoers OR
@@ -453,8 +442,18 @@ command_matches_regex(struct sudoers_context *ctx, const char *sudoers_cmnd,
* c) there are args in sudoers and on command line and they match * c) there are args in sudoers and on command line and they match
* else return DENY. * else return DENY.
*/ */
if (regex_matches(sudoers_cmnd, cmnd) != ALLOW) if (cmnd[0] != '/' || regex_matches(sudoers_cmnd, cmnd) != ALLOW) {
debug_return_int(DENY); /* No match, retry using the canonicalized path (if possible). */
if (ctx->user.cmnd_dir == NULL)
debug_return_int(DENY);
len = snprintf(buf, sizeof(buf), "%s/%s", ctx->user.cmnd_dir,
ctx->user.cmnd_base);
if (len < 0 || len >= ssizeof(buf))
debug_return_int(DENY);
cmnd = buf;
if (regex_matches(sudoers_cmnd, cmnd) != ALLOW)
debug_return_int(DENY);
}
if (command_args_match(ctx, sudoers_cmnd, sudoers_args) == ALLOW) { if (command_args_match(ctx, sudoers_cmnd, sudoers_args) == ALLOW) {
/* Open the file for fdexec or for digest matching. */ /* Open the file for fdexec or for digest matching. */