isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change an occurence of user_matches() -> runas_matches() missed previously

Browse Source 
runas_matches(), host_matches() and cmnd_matches() only really need to pass in
a list of members.  user_matches() still needs to pass in a passwd struct
because of "sudo -l"
This commit is contained in:
Todd C. Miller
2004-11-19 20:03:33 +00:00
parent 2c3cff1704
commit 0cddfc3684
5 changed files with 26 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
defaults.c
View File

@@ -513,12 +513,12 @@ update_defaults()
return(FALSE); return(FALSE);
break; break;
case DEFAULTS_RUNAS: case DEFAULTS_RUNAS:
if (user_matches(runas_pw, def->binding) && if (runas_matches(def->binding) &&
!set_default(def->var, def->val, def->op)) !set_default(def->var, def->val, def->op))
return(FALSE); return(FALSE);
break; break;
case DEFAULTS_HOST: case DEFAULTS_HOST:
if (host_matches(user_shost, user_host, def->binding) && if (host_matches(def->binding) &&
!set_default(def->var, def->val, def->op)) !set_default(def->var, def->val, def->op))
return(FALSE); return(FALSE);
break; break;
@@ -527,7 +527,6 @@ update_defaults()
return(TRUE); return(TRUE);
} }
static int static int
store_int(val, def, op) store_int(val, def, op)
char *val; char *val;

27
match.c
View File

@@ -146,8 +146,7 @@ user_matches(pw, list)
* Returns ALLOW, DENY or UNSPEC. * Returns ALLOW, DENY or UNSPEC.
*/ */
int int
runas_matches(pw, list) runas_matches(list)
struct passwd *pw;
struct member *list; struct member *list;
{ {
struct member *m; struct member *m;
@@ -155,7 +154,7 @@ runas_matches(pw, list)
int rval, matched = UNSPEC; int rval, matched = UNSPEC;
if (list == NULL) if (list == NULL)
return(userpw_matches(def_runas_default, pw->pw_name, pw)); return(userpw_matches(def_runas_default, runas_pw->pw_name, runas_pw));
for (m = list; m != NULL; m = m->next) { for (m = list; m != NULL; m = m->next) {
switch (m->type) { switch (m->type) {
@@ -163,23 +162,23 @@ runas_matches(pw, list)
matched = !m->negated; matched = !m->negated;
break; break;
case NETGROUP: case NETGROUP:
if (netgr_matches(m->name, NULL, NULL, pw->pw_name)) if (netgr_matches(m->name, NULL, NULL, runas_pw->pw_name))
matched = !m->negated; matched = !m->negated;
break; break;
case USERGROUP: case USERGROUP:
if (usergr_matches(m->name, pw->pw_name, pw)) if (usergr_matches(m->name, runas_pw->pw_name, runas_pw))
matched = !m->negated; matched = !m->negated;
break; break;
case ALIAS: case ALIAS:
if ((a = find_alias(m->name, RUNASALIAS)) != NULL) { if ((a = find_alias(m->name, RUNASALIAS)) != NULL) {
rval = runas_matches(pw, a->first_member); rval = runas_matches(a->first_member);
if (rval != UNSPEC) if (rval != UNSPEC)
matched = m->negated ? !rval : rval; matched = m->negated ? !rval : rval;
break; break;
} }
/* FALLTHROUGH */ /* FALLTHROUGH */
case WORD: case WORD:
if (userpw_matches(m->name, pw->pw_name, pw)) if (userpw_matches(m->name, runas_pw->pw_name, runas_pw))
matched = !m->negated; matched = !m->negated;
break; break;
} }
@@ -192,8 +191,7 @@ runas_matches(pw, list)
* Returns ALLOW, DENY or UNSPEC. * Returns ALLOW, DENY or UNSPEC.
*/ */
int int
host_matches(shost, lhost, list) host_matches(list)
char *shost, *lhost;
struct member *list; struct member *list;
{ {
struct member *m; struct member *m;
@@ -206,7 +204,7 @@ host_matches(shost, lhost, list)
matched = !m->negated; matched = !m->negated;
break; break;
case NETGROUP: case NETGROUP:
if (netgr_matches(m->name, lhost, shost, NULL)) if (netgr_matches(m->name, user_host, user_shost, NULL))
matched = !m->negated; matched = !m->negated;
break; break;
case NTWKADDR: case NTWKADDR:
@@ -215,14 +213,14 @@ host_matches(shost, lhost, list)
break; break;
case ALIAS: case ALIAS:
if ((a = find_alias(m->name, HOSTALIAS)) != NULL) { if ((a = find_alias(m->name, HOSTALIAS)) != NULL) {
rval = host_matches(shost, lhost, a->first_member); rval = host_matches(a->first_member);
if (rval != UNSPEC) if (rval != UNSPEC)
matched = m->negated ? !rval : rval; matched = m->negated ? !rval : rval;
break; break;
} }
/* FALLTHROUGH */ /* FALLTHROUGH */
case WORD: case WORD:
if (hostname_matches(shost, lhost, m->name)) if (hostname_matches(user_shost, user_host, m->name))
matched = !m->negated; matched = !m->negated;
break; break;
} }
@@ -235,8 +233,7 @@ host_matches(shost, lhost, list)
* Returns ALLOW, DENY or UNSPEC. * Returns ALLOW, DENY or UNSPEC.
*/ */
int int
cmnd_matches(cmnd, args, list) cmnd_matches(list)
char *cmnd, *args;
struct member *list; struct member *list;
{ {
struct sudo_command *c; struct sudo_command *c;
@@ -251,7 +248,7 @@ cmnd_matches(cmnd, args, list)
break; break;
case ALIAS: case ALIAS:
if ((a = find_alias(m->name, CMNDALIAS)) != NULL) { if ((a = find_alias(m->name, CMNDALIAS)) != NULL) {
rval = cmnd_matches(cmnd, args, a->first_member); rval = cmnd_matches(a->first_member);
if (rval != UNSPEC) if (rval != UNSPEC)
matched = m->negated ? !rval : rval; matched = m->negated ? !rval : rval;
} }

12
parse.c
View File

@@ -121,12 +121,12 @@ sudoers_lookup(pwflag)
for (us = userspecs; us != NULL; us = us->next) { for (us = userspecs; us != NULL; us = us->next) {
if (user_matches(sudo_user.pw, us->user) == TRUE) { if (user_matches(sudo_user.pw, us->user) == TRUE) {
priv = us->privileges; priv = us->privileges;
if (host_matches(user_shost, user_host, priv->hostlist) == TRUE) { if (host_matches(priv->hostlist) == TRUE) {
for (cs = priv->cmndlist; cs != NULL; cs = cs->next) { for (cs = priv->cmndlist; cs != NULL; cs = cs->next) {
/* Only check the command when listing another user. */ /* Only check the command when listing another user. */
if (user_uid == 0 || list_pw == NULL || if (user_uid == 0 || list_pw == NULL ||
user_uid == list_pw->pw_uid || user_uid == list_pw->pw_uid ||
cmnd_matches(user_cmnd, user_args, cs->cmnd) == TRUE) cmnd_matches(cs->cmnd) == TRUE)
matched = TRUE; matched = TRUE;
if ((pwcheck == any && nopass != TRUE) || if ((pwcheck == any && nopass != TRUE) ||
(pwcheck == all && nopass == TRUE)) (pwcheck == all && nopass == TRUE))
@@ -155,11 +155,11 @@ sudoers_lookup(pwflag)
if (user_matches(sudo_user.pw, us->user) == TRUE) { if (user_matches(sudo_user.pw, us->user) == TRUE) {
CLR(validated, FLAG_NO_USER); CLR(validated, FLAG_NO_USER);
priv = us->privileges; priv = us->privileges;
if (host_matches(user_shost, user_host, priv->hostlist) == TRUE) { if (host_matches(priv->hostlist) == TRUE) {
CLR(validated, FLAG_NO_HOST); CLR(validated, FLAG_NO_HOST);
for (cs = priv->cmndlist; cs != NULL; cs = cs->next) { for (cs = priv->cmndlist; cs != NULL; cs = cs->next) {
if (runas_matches(runas_pw, cs->runaslist) == TRUE) { if (runas_matches(cs->runaslist) == TRUE) {
rval = cmnd_matches(user_cmnd, user_args, cs->cmnd); rval = cmnd_matches(cs->cmnd);
if (rval != UNSPEC) { if (rval != UNSPEC) {
matched = rval; matched = rval;
tags = &cs->tags; tags = &cs->tags;
@@ -205,7 +205,7 @@ display_privs(pw)
for (us = userspecs; us != NULL; us = us->next) { for (us = userspecs; us != NULL; us = us->next) {
if (user_matches(pw, us->user) != TRUE || if (user_matches(pw, us->user) != TRUE ||
host_matches(user_shost, user_host, us->privileges->hostlist) != TRUE) host_matches(us->privileges->hostlist) != TRUE)
continue; continue;
priv = us->privileges; priv = us->privileges;

6
parse.h
View File

@@ -158,13 +158,13 @@ struct defaults {
char *alias_add __P((char *, int, struct member *)); char *alias_add __P((char *, int, struct member *));
int addr_matches __P((char *)); int addr_matches __P((char *));
int alias_remove __P((char *, int)); int alias_remove __P((char *, int));
int cmnd_matches __P((char *, char *, struct member *)); int cmnd_matches __P((struct member *));
int command_matches __P((char *, char *)); int command_matches __P((char *, char *));
int host_matches __P((char *, char *, struct member *)); int host_matches __P((struct member *));
int hostname_matches __P((char *, char *, char *)); int hostname_matches __P((char *, char *, char *));
int netgr_matches __P((char *, char *, char *, char *)); int netgr_matches __P((char *, char *, char *, char *));
int no_aliases __P((void)); int no_aliases __P((void));
int runas_matches __P((struct passwd *, struct member *)); int runas_matches __P((struct member *));
int user_matches __P((struct passwd *, struct member *)); int user_matches __P((struct passwd *, struct member *));
int usergr_matches __P((char *, char *, struct passwd *)); int usergr_matches __P((char *, char *, struct passwd *));
int userpw_matches __P((char *, char *, struct passwd *)); int userpw_matches __P((char *, char *, struct passwd *));

6
testsudoers.c
View File

@@ -224,12 +224,12 @@ main(argc, argv)
putchar('\n'); putchar('\n');
print_privilege(priv); print_privilege(priv);
putchar('\n'); putchar('\n');
if (host_matches(user_shost, user_host, priv->hostlist) == TRUE) { if (host_matches(priv->hostlist) == TRUE) {
puts("\thost matched"); puts("\thost matched");
for (cs = priv->cmndlist; cs != NULL; cs = cs->next) { for (cs = priv->cmndlist; cs != NULL; cs = cs->next) {
if (runas_matches(runas_pw, cs->runaslist) == TRUE) { if (runas_matches(cs->runaslist) == TRUE) {
puts("\trunas matched"); puts("\trunas matched");
rval = cmnd_matches(user_cmnd, user_args, cs->cmnd); rval = cmnd_matches(cs->cmnd);
if (rval != UNSPEC) if (rval != UNSPEC)
matched = rval; matched = rval;
printf("\tcommand %s\n", rval == ALLOW ? "allowed" : printf("\tcommand %s\n", rval == ALLOW ? "allowed" :