Don't escape double quotes (") in a command when printing it.

Previously, cvtsudoers and "sudo -l" would escape double quotes in
a command or command line argument, which is not valid sudoers syntax.
This commit is contained in:
Todd C. Miller
2022-02-08 15:44:18 -07:00
parent 8adad85b4b
commit 10ad934b77
8 changed files with 43 additions and 3 deletions

View File

@@ -68,11 +68,11 @@ sudoers_format_member_int(struct sudo_lbuf *lbuf,
} }
if (negated) if (negated)
sudo_lbuf_append(lbuf, "!"); sudo_lbuf_append(lbuf, "!");
sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED" \t", "%s", sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED_CMD, "%s",
c->cmnd ? c->cmnd : "ALL"); c->cmnd ? c->cmnd : "ALL");
if (c->args) { if (c->args) {
sudo_lbuf_append(lbuf, " "); sudo_lbuf_append(lbuf, " ");
sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED, "%s", c->args); sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED_ARG, "%s", c->args);
} }
break; break;
case USERGROUP: case USERGROUP:

View File

@@ -25,6 +25,8 @@
/* Characters that must be quoted in sudoers. */ /* Characters that must be quoted in sudoers. */
#define SUDOERS_QUOTED ":\\,=#\"" #define SUDOERS_QUOTED ":\\,=#\""
#define SUDOERS_QUOTED_CMD ":\\,= \t#"
#define SUDOERS_QUOTED_ARG ":\\,=#"
/* Returns true if string 's' contains meta characters. */ /* Returns true if string 's' contains meta characters. */
#define has_meta(s) (strpbrk(s, "\\?*[]") != NULL) #define has_meta(s) (strpbrk(s, "\\?*[]") != NULL)

View File

@@ -58,3 +58,6 @@ Defaults>"some one" set_home
"%:C/non_UNIX_0 c" "hostf" = ("root") ALL "%:C/non_UNIX_0 c" "hostf" = ("root") ALL
"%:C/non\'UNIX_3 c" "hostg" = ("root") ALL "%:C/non\'UNIX_3 c" "hostg" = ("root") ALL
"+netgr" "hosth" = ("root") ALL "+netgr" "hosth" = ("root") ALL
# Check that quotes don't need escaping in command and args
user ALL = /bin/ls "", /bin/echo " ", /bin/foo"bar ""

View File

@@ -398,6 +398,23 @@
] ]
} }
] ]
},
{
"User_List": [
{ "username": "user" }
],
"Host_List": [
{ "hostname": "ALL" }
],
"Cmnd_Specs": [
{
"Commands": [
{ "command": "/bin/ls \"\"" },
{ "command": "/bin/echo \" \"" },
{ "command": "/bin/foo\"bar \"\"" }
]
}
]
} }
] ]
} }

View File

@@ -155,3 +155,14 @@ sudoRunAsUser: root
sudoCommand: ALL sudoCommand: ALL
sudoOrder: 13 sudoOrder: 13
dn: cn=user,ou=SUDOers,dc=sudo,dc=ws
objectClass: top
objectClass: sudoRole
cn: user
sudoUser: user
sudoHost: ALL
sudoCommand: /bin/ls ""
sudoCommand: /bin/echo " "
sudoCommand: /bin/foo"bar ""
sudoOrder: 14

View File

@@ -36,3 +36,6 @@ foo\:bar\" hoste = (root) ALL
# sudoRole +netgr # sudoRole +netgr
+netgr hosth = (root) ALL +netgr hosth = (root) ALL
# sudoRole user
user ALL = /bin/ls "", /bin/echo " ", /bin/foo"bar ""

View File

@@ -40,3 +40,4 @@ foo\:bar\" hoste = (root) ALL
"%:C/non_UNIX_0 c" hostf = (root) ALL "%:C/non_UNIX_0 c" hostf = (root) ALL
"%:C/non\'UNIX_3 c" hostg = (root) ALL "%:C/non\'UNIX_3 c" hostg = (root) ALL
+netgr hosth = (root) ALL +netgr hosth = (root) ALL
user ALL = /bin/ls "", /bin/echo " ", /bin/foo"bar ""

View File

@@ -58,3 +58,6 @@ BEGINSTR STRBODY ENDSTR USERGROUP BEGINSTR STRBODY ENDSTR WORD(4) = ( BEGINSTR S
BEGINSTR STRBODY ENDSTR USERGROUP BEGINSTR STRBODY ENDSTR WORD(4) = ( BEGINSTR STRBODY ENDSTR WORD(4) ) ALL BEGINSTR STRBODY ENDSTR USERGROUP BEGINSTR STRBODY ENDSTR WORD(4) = ( BEGINSTR STRBODY ENDSTR WORD(4) ) ALL
BEGINSTR STRBODY BACKSLASH STRBODY ENDSTR USERGROUP BEGINSTR STRBODY ENDSTR WORD(4) = ( BEGINSTR STRBODY ENDSTR WORD(4) ) ALL BEGINSTR STRBODY BACKSLASH STRBODY ENDSTR USERGROUP BEGINSTR STRBODY ENDSTR WORD(4) = ( BEGINSTR STRBODY ENDSTR WORD(4) ) ALL
BEGINSTR STRBODY ENDSTR NETGROUP BEGINSTR STRBODY ENDSTR WORD(4) = ( BEGINSTR STRBODY ENDSTR WORD(4) ) ALL BEGINSTR STRBODY ENDSTR NETGROUP BEGINSTR STRBODY ENDSTR WORD(4) = ( BEGINSTR STRBODY ENDSTR WORD(4) ) ALL
#
WORD(6) ALL = COMMAND ARG , COMMAND ARG ARG , COMMAND ARG