isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't pass an invalid session or process group ID to the plugin.

Browse Source 
Fixes a regression in 1.8.28 when there is no terminal session leader.
This commit is contained in:
Todd C. Miller
2019-10-23 12:47:44 -06:00
parent 0375eaca58
commit 271ead2fd3
3 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -21,6 +21,10 @@ What's new in Sudo 1.8.29
problems caused by insufficient resources, such as an inability to problems caused by insufficient resources, such as an inability to
allocate memory or open files and pipes. allocate memory or open files and pipes.
* Fixed a regression introduced in sudo 1.8.28 where sudo would refuse
to run if the parent process was not associated with a session.
This was due to sudo passing a session ID of -1 to the plugin.
What's new in Sudo 1.8.28p1 What's new in Sudo 1.8.28p1
* The fix for Bug #869 caused "sudo -v" to prompt for a password * The fix for Bug #869 caused "sudo -v" to prompt for a password

10
plugins/sudoers/policy.c
View File

@@ -104,7 +104,6 @@ sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group)
char * const *cur; char * const *cur;
const char *p, *errstr, *groups = NULL; const char *p, *errstr, *groups = NULL;
const char *remhost = NULL; const char *remhost = NULL;
bool uid_set = false, gid_set = false;
int flags = 0; int flags = 0;
debug_decl(sudoers_policy_deserialize_info, SUDOERS_DEBUG_PLUGIN) debug_decl(sudoers_policy_deserialize_info, SUDOERS_DEBUG_PLUGIN)
@@ -333,6 +332,9 @@ sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group)
#endif #endif
} }
user_gid = (gid_t)-1;
user_sid = (pid_t)-1;
user_uid = (gid_t)-1;
user_umask = (mode_t)-1; user_umask = (mode_t)-1;
for (cur = info->user_info; *cur != NULL; cur++) { for (cur = info->user_info; *cur != NULL; cur++) {
if (MATCHES(*cur, "user=")) { if (MATCHES(*cur, "user=")) {
@@ -348,7 +350,6 @@ sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group)
sudo_warnx(U_("%s: %s"), *cur, U_(errstr)); sudo_warnx(U_("%s: %s"), *cur, U_(errstr));
goto bad; goto bad;
} }
uid_set = true;
continue; continue;
} }
if (MATCHES(*cur, "gid=")) { if (MATCHES(*cur, "gid=")) {
@@ -358,7 +359,6 @@ sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group)
sudo_warnx(U_("%s: %s"), *cur, U_(errstr)); sudo_warnx(U_("%s: %s"), *cur, U_(errstr));
goto bad; goto bad;
} }
gid_set = true;
continue; continue;
} }
if (MATCHES(*cur, "groups=")) { if (MATCHES(*cur, "groups=")) {
@@ -439,11 +439,11 @@ sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group)
sudo_warnx(U_("user name not set by sudo front-end")); sudo_warnx(U_("user name not set by sudo front-end"));
goto bad; goto bad;
} }
if (!uid_set) { if (user_uid == (uid_t)-1) {
sudo_warnx(U_("user-ID not set by sudo front-end")); sudo_warnx(U_("user-ID not set by sudo front-end"));
goto bad; goto bad;
} }
if (!gid_set) { if (user_gid == (gid_t)-1) {
sudo_warnx(U_("group-ID not set by sudo front-end")); sudo_warnx(U_("group-ID not set by sudo front-end"));
goto bad; goto bad;
} }

18
src/sudo.c
View File

@@ -553,12 +553,18 @@ get_user_info(struct user_details *ud)
goto oom; goto oom;
if (asprintf(&user_info[++i], "ppid=%d", (int)ud->ppid) == -1) if (asprintf(&user_info[++i], "ppid=%d", (int)ud->ppid) == -1)
goto oom; goto oom;
if (asprintf(&user_info[++i], "pgid=%d", (int)ud->pgid) == -1) if (ud->pgid != -1) {
goto oom; if (asprintf(&user_info[++i], "pgid=%d", (int)ud->pgid) == -1)
if (asprintf(&user_info[++i], "tcpgid=%d", (int)ud->tcpgid) == -1) goto oom;
goto oom; }
if (asprintf(&user_info[++i], "sid=%d", (int)ud->sid) == -1) if (ud->tcpgid != -1) {
goto oom; if (asprintf(&user_info[++i], "tcpgid=%d", (int)ud->tcpgid) == -1)
goto oom;
}
if (ud->sid != -1) {
if (asprintf(&user_info[++i], "sid=%d", (int)ud->sid) == -1)
goto oom;
}
if (asprintf(&user_info[++i], "uid=%u", (unsigned int)ud->uid) == -1) if (asprintf(&user_info[++i], "uid=%u", (unsigned int)ud->uid) == -1)
goto oom; goto oom;
if (asprintf(&user_info[++i], "euid=%u", (unsigned int)ud->euid) == -1) if (asprintf(&user_info[++i], "euid=%u", (unsigned int)ud->euid) == -1)