isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow the -k flag to be specified in conjunction with a command or

Browse Source 
another option that may require authentication.
This commit is contained in:
Todd C. Miller
2009-02-24 13:04:39 +00:00
parent e7ee38d62c
commit 15975b83ce
4 changed files with 80 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
sudo.c
View File

@@ -95,8 +95,8 @@
# include <selinux/selinux.h>
#endif
#include <sudo_usage.h>
#include "sudo.h"
#include "sudo_usage.h"
#include "lbuf.h"
#include "interfaces.h"
#include "version.h"
@@ -231,7 +231,7 @@ main(argc, argv, envp)
user_cmnd = "shell";
else if (ISSET(sudo_mode, MODE_EDIT))
user_cmnd = "sudoedit";
else
else {
switch (sudo_mode) {
case MODE_VERSION:
show_version();
@@ -240,11 +240,12 @@ main(argc, argv, envp)
usage(0);
break;
case MODE_VALIDATE:
case MODE_VALIDATE|MODE_INVALIDATE:
user_cmnd = "validate";
pwflag = I_VERIFYPW;
break;
case MODE_KILL:
case MODE_INVALIDATE:
case MODE_KILL:
user_cmnd = "kill";
pwflag = -1;
break;
@@ -253,13 +254,16 @@ main(argc, argv, envp)
exit(0);
break;
case MODE_LIST:
case MODE_LIST|MODE_INVALIDATE:
user_cmnd = "list";
pwflag = I_LISTPW;
break;
case MODE_CHECK:
case MODE_CHECK|MODE_INVALIDATE:
pwflag = I_LISTPW;
break;
}
}
/* Must have a command to run... */
if (user_cmnd == NULL && NewArgc == 0)
@@ -405,7 +409,7 @@ main(argc, argv, envp)
/* Require a password if sudoers says so. */
if (def_authenticate)
check_user(validated, !ISSET(sudo_mode, MODE_NONINTERACTIVE));
check_user(validated, sudo_mode);
/* If run as root with SUDO_USER set, set sudo_user.pw to that user. */
/* XXX - causes confusion when root is not listed in sudoers */
@@ -438,9 +442,9 @@ main(argc, argv, envp)
}
log_allowed(validated);
if (sudo_mode == MODE_CHECK)
if (ISSET(sudo_mode, MODE_CHECK))
rc = display_cmnd(snl, list_pw ? list_pw : sudo_user.pw);
else if (sudo_mode == MODE_LIST)
else if (ISSET(sudo_mode, MODE_LIST))
display_privs(snl, list_pw ? list_pw : sudo_user.pw);
/* Cleanup sudoers sources */
@@ -448,8 +452,7 @@ main(argc, argv, envp)
nss->close(nss);
/* Deferred exit due to sudo_ldap_close() */
if (sudo_mode == MODE_VALIDATE || sudo_mode == MODE_CHECK ||
sudo_mode == MODE_LIST)
if (ISSET(sudo_mode, (MODE_VALIDATE|MODE_CHECK|MODE_LIST)))
exit(rc);
/*
@@ -835,7 +838,7 @@ parse_args(argc, argv)
{
int mode = 0; /* what mode is sudo to be run in? */
int flags = 0; /* mode flags */
int ch;
int allowed_flags, ch;
/* First, check to see if we were invoked as "sudoedit". */
if (strcmp(getprogname(), "sudoedit") == 0)
@@ -849,6 +852,10 @@ parse_args(argc, argv)
#define is_envar (optind < argc && argv[optind][0] != '/' && \
strchr(argv[optind], '=') != NULL)
/* Flags allowed when running a command */
allowed_flags = MODE_BACKGROUND|MODE_PRESERVE_ENV|MODE_RESET_HOME|
MODE_LOGIN_SHELL|MODE_INVALIDATE|MODE_NONINTERACTIVE|
MODE_PRESERVE_GROUPS|MODE_SHELL;
for (;;) {
/*
* We disable arg permutation for GNU getopt().
@@ -887,6 +894,7 @@ parse_args(argc, argv)
if (mode && mode != MODE_EDIT)
usage_excl(1);
mode = MODE_EDIT;
allowed_flags = MODE_INVALIDATE|MODE_NONINTERACTIVE;
break;
case 'g':
runas_group = optarg;
@@ -898,25 +906,26 @@ parse_args(argc, argv)
if (mode && mode != MODE_HELP)
usage_excl(1);
mode = MODE_HELP;
allowed_flags = 0;
break;
case 'i':
SET(flags, MODE_LOGIN_SHELL);
def_env_reset = TRUE;
break;
case 'k':
if (mode && mode != MODE_INVALIDATE)
usage_excl(1);
mode = MODE_INVALIDATE;
SET(flags, MODE_INVALIDATE);
break;
case 'K':
if (mode && mode != MODE_KILL)
usage_excl(1);
mode = MODE_KILL;
allowed_flags = 0;
break;
case 'L':
if (mode && mode != MODE_LISTDEFS)
usage_excl(1);
mode = MODE_LISTDEFS;
allowed_flags = MODE_INVALIDATE|MODE_NONINTERACTIVE;
break;
case 'l':
if (mode) {
@@ -926,6 +935,7 @@ parse_args(argc, argv)
usage_excl(1);
}
mode = MODE_LIST;
allowed_flags = MODE_INVALIDATE|MODE_NONINTERACTIVE;
break;
case 'n':
SET(flags, MODE_NONINTERACTIVE);
@@ -962,11 +972,13 @@ parse_args(argc, argv)
if (mode && mode != MODE_VALIDATE)
usage_excl(1);
mode = MODE_VALIDATE;
allowed_flags = MODE_INVALIDATE|MODE_NONINTERACTIVE;
break;
case 'V':
if (mode && mode != MODE_VERSION)
usage_excl(1);
mode = MODE_VERSION;
allowed_flags = 0;
break;
default:
usage(1);
@@ -991,8 +1003,15 @@ parse_args(argc, argv)
NewArgc = argc - optind;
NewArgv = argv + optind;
if (!mode)
mode = MODE_RUN;
if (!mode) {
/* Defer -k mode setting until we know whether it is a flag or not */
if (ISSET(flags, MODE_INVALIDATE) && NewArgc == 0) {
mode = MODE_INVALIDATE; /* -k by itself */
allowed_flags = 0;
} else {
mode = MODE_RUN; /* running a command */
}
}
if (NewArgc > 0 && mode == MODE_LIST)
mode = MODE_CHECK;
@@ -1008,6 +1027,8 @@ parse_args(argc, argv)
}
SET(flags, MODE_SHELL);
}
if ((flags & allowed_flags) != flags)
usage(1);
if (mode == MODE_EDIT &&
(ISSET(flags, MODE_PRESERVE_ENV) || sudo_user.env_vars != NULL)) {
if (ISSET(mode, MODE_PRESERVE_ENV))
@@ -1431,7 +1452,7 @@ static void
usage_excl(exit_val)
int exit_val;
{
warningx("Only one of the -e, -h, -i, -k, -K, -l, -s, -v or -V options may be specified");
warningx("Only one of the -e, -h, -i, -K, -l, -s, -v or -V options may be specified");
usage(exit_val);
}
@@ -1444,21 +1465,22 @@ usage(exit_val)
int exit_val;
{
struct lbuf lbuf;
char *uvec[5];
char *uvec[6];
int i, ulen;
/*
* Use usage vectors appropriate to the progname.
*/
if (strcmp(getprogname(), "sudoedit") == 0) {
uvec[0] = SUDO_USAGE4 + 3;
uvec[0] = SUDO_USAGE5 + 3;
uvec[1] = NULL;
} else {
uvec[0] = SUDO_USAGE1;
uvec[1] = SUDO_USAGE2;
uvec[2] = SUDO_USAGE3;
uvec[3] = SUDO_USAGE4;
uvec[4] = NULL;
uvec[4] = SUDO_USAGE5;
uvec[5] = NULL;
}
/*