isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move max_groups out of sudoers_user_context and into pwutil.c.

Browse Source 
It is only used by the local password pwutil implementation.
This commit is contained in:
Todd C. Miller
2023-08-14 16:29:15 -06:00
parent 737354390c
commit 20baa39007
4 changed files with 26 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
plugins/sudoers/policy.c
View File

@@ -360,13 +360,15 @@ sudoers_policy_deserialize_info(void *v, struct defaults_list *defaults)
continue; continue;
} }
if (MATCHES(*cur, "max_groups=")) { if (MATCHES(*cur, "max_groups=")) {
int max_groups;
errno = 0; errno = 0;
p = *cur + sizeof("max_groups=") - 1; p = *cur + sizeof("max_groups=") - 1;
user_ctx.max_groups = (int)sudo_strtonum(p, 1, 1024, &errstr); max_groups = (int)sudo_strtonum(p, 1, 1024, &errstr);
if (user_ctx.max_groups == 0) { if (max_groups == 0) {
sudo_warnx(U_("%s: %s"), *cur, U_(errstr)); sudo_warnx(U_("%s: %s"), *cur, U_(errstr));
goto bad; goto bad;
} }
sudo_pwutil_set_max_groups(max_groups);
continue; continue;
} }
if (MATCHES(*cur, "remote_host=")) { if (MATCHES(*cur, "remote_host=")) {

16
plugins/sudoers/pwutil.c
View File

@@ -58,6 +58,8 @@ static int cmp_pwuid(const void *, const void *);
static int cmp_pwnam(const void *, const void *); static int cmp_pwnam(const void *, const void *);
static int cmp_grgid(const void *, const void *); static int cmp_grgid(const void *, const void *);
static int max_groups;
/* /*
* Default functions for building cache items. * Default functions for building cache items.
*/ */
@@ -102,6 +104,20 @@ sudo_pwutil_set_backend(sudo_make_pwitem_t pwitem, sudo_make_gritem_t gritem,
debug_return; debug_return;
} }
/* Get the max number of user groups if set, or 0 if not set. */
int
sudo_pwutil_get_max_groups(void)
{
return max_groups;
}
/* Set the max number of user groups (negative values ignored). */
void
sudo_pwutil_set_max_groups(int n)
{
max_groups = n > 0 ? n : 0;
}
/* /*
* Compare by user-ID. * Compare by user-ID.
* v1 is the key to find or data to insert, v2 is in-tree data. * v1 is the key to find or data to insert, v2 is in-tree data.

9
plugins/sudoers/pwutil_impl.c
View File

@@ -299,17 +299,16 @@ PREFIX(make_gidlist_item)(const struct passwd *pw, char * const *gidstrs,
type = ENTRY_TYPE_FRONTEND; type = ENTRY_TYPE_FRONTEND;
} else { } else {
type = ENTRY_TYPE_QUERIED; type = ENTRY_TYPE_QUERIED;
if (user_ctx.max_groups > 0) { ngids = sudo_pwutil_get_max_groups();
ngids = user_ctx.max_groups; if (ngids > 0) {
gids = reallocarray(NULL, (size_t)ngids, sizeof(GETGROUPS_T)); gids = reallocarray(NULL, (size_t)ngids, sizeof(GETGROUPS_T));
if (gids == NULL) { if (gids == NULL) {
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
"unable to allocate memory"); "unable to allocate memory");
debug_return_ptr(NULL); debug_return_ptr(NULL);
} }
/* Clamp to max_groups if insufficient space for all groups. */ /* getgrouplist2() returns failure if it can't store all groups. */
if (PREFIX(getgrouplist2)(pw->pw_name, pw->pw_gid, &gids, &ngids) == -1) (void)PREFIX(getgrouplist2)(pw->pw_name, pw->pw_gid, &gids, &ngids);
ngids = user_ctx.max_groups;
} else { } else {
gids = NULL; gids = NULL;
if (PREFIX(getgrouplist2)(pw->pw_name, pw->pw_gid, &gids, &ngids) == -1) { if (PREFIX(getgrouplist2)(pw->pw_name, pw->pw_gid, &gids, &ngids) == -1) {

3
plugins/sudoers/sudoers.h
View File

@@ -109,7 +109,6 @@ struct sudoers_user_context {
int closefrom; int closefrom;
int lines; int lines;
int cols; int cols;
int max_groups;
int timeout; int timeout;
mode_t umask; mode_t umask;
uid_t uid; uid_t uid;
@@ -324,6 +323,8 @@ void sudo_pw_addref(struct passwd *);
void sudo_pw_delref(struct passwd *); void sudo_pw_delref(struct passwd *);
int sudo_set_gidlist(struct passwd *pw, char * const *gids, unsigned int type); int sudo_set_gidlist(struct passwd *pw, char * const *gids, unsigned int type);
int sudo_set_grlist(struct passwd *pw, char * const *groups); int sudo_set_grlist(struct passwd *pw, char * const *groups);
int sudo_pwutil_get_max_groups(void);
void sudo_pwutil_set_max_groups(int);
void sudo_pwutil_set_backend(sudo_make_pwitem_t, sudo_make_gritem_t, sudo_make_gidlist_item_t, sudo_make_grlist_item_t); void sudo_pwutil_set_backend(sudo_make_pwitem_t, sudo_make_gritem_t, sudo_make_gidlist_item_t, sudo_make_grlist_item_t);
void sudo_setspent(void); void sudo_setspent(void);