isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

userspec_overridden: fix checks when there is more than one userspec

Browse Source
This commit is contained in:
Todd C. Miller
2022-01-03 16:40:32 -07:00
parent 835079fa3f
commit 296d876b76
7 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
plugins/sudoers/cvtsudoers_merge.c
View File

@@ -1014,7 +1014,7 @@ userspec_overridden(struct userspec *us1,
struct privilege *priv1, *priv2; struct privilege *priv1, *priv2;
if (!member_list_override(&us1->users, &us2->users, check_negated)) if (!member_list_override(&us1->users, &us2->users, check_negated))
break; continue;
/* XXX - order should not matter */ /* XXX - order should not matter */
priv1 = TAILQ_LAST(&us1->privileges, privilege_list); priv1 = TAILQ_LAST(&us1->privileges, privilege_list);
@@ -1031,8 +1031,10 @@ userspec_overridden(struct userspec *us1,
priv1 = TAILQ_PREV(priv1, privilege_list, entries); priv1 = TAILQ_PREV(priv1, privilege_list, entries);
priv2 = TAILQ_PREV(priv2, privilege_list, entries); priv2 = TAILQ_PREV(priv2, privilege_list, entries);
} }
if (priv1 != NULL || priv2 != NULL) if (priv1 != NULL || priv2 != NULL) {
break; /* mismatch */
continue;
}
/* /*
* If we have a match of everything except the host list, * If we have a match of everything except the host list,
@@ -1075,16 +1077,16 @@ userspec_check_conflict(struct userspec *us1,
struct sudoers_parse_tree *parse_tree0) struct sudoers_parse_tree *parse_tree0)
{ {
struct sudoers_parse_tree *parse_tree = parse_tree0; struct sudoers_parse_tree *parse_tree = parse_tree0;
enum cvtsudoers_conflict ret = CONFLICT_NONE;
debug_decl(userspec_check_conflict, SUDOERS_DEBUG_PARSER); debug_decl(userspec_check_conflict, SUDOERS_DEBUG_PARSER);
while ((parse_tree = TAILQ_NEXT(parse_tree, entries)) != NULL) { while ((parse_tree = TAILQ_NEXT(parse_tree, entries)) != NULL) {
ret = userspec_overridden(us1, parse_tree, false); enum cvtsudoers_conflict ret =
userspec_overridden(us1, parse_tree, false);
if (ret != CONFLICT_NONE) if (ret != CONFLICT_NONE)
debug_return_int(ret); debug_return_int(ret);
} }
debug_return_int(ret); debug_return_int(CONFLICT_NONE);
} }
/* /*

1
plugins/sudoers/regress/cvtsudoers/sudoers1
View File

@@ -77,6 +77,7 @@ Defaults!REBOOT !log_output
## User privilege specification ## User privilege specification
## ##
root ALL=(ALL) ALL root ALL=(ALL) ALL
ALL ALL=(ALL) /usr/bin/id
## Uncomment to allow members of group wheel to execute any command ## Uncomment to allow members of group wheel to execute any command
# %wheel ALL=(ALL) ALL # %wheel ALL=(ALL) ALL

1
plugins/sudoers/regress/cvtsudoers/sudoers2
View File

@@ -77,6 +77,7 @@ Defaults!REBOOT !log_output
## User privilege specification ## User privilege specification
## ##
root ALL=(ALL) ALL root ALL=(ALL) ALL
ALL ALL=(ALL) /usr/bin/id
## Uncomment to allow members of group wheel to execute any command ## Uncomment to allow members of group wheel to execute any command
# %wheel ALL=(ALL) ALL # %wheel ALL=(ALL) ALL

1
plugins/sudoers/regress/cvtsudoers/sudoers3
View File

@@ -77,6 +77,7 @@ Cmnd_Alias REBOOT = /sbin/halt, /sbin/reboot, /sbin/poweroff
## User privilege specification ## User privilege specification
## ##
root ALL=(ALL) ALL root ALL=(ALL) ALL
ALL ALL=(ALL) /usr/bin/id
## Uncomment to allow members of group wheel to execute any command ## Uncomment to allow members of group wheel to execute any command
# %wheel ALL=(ALL) ALL # %wheel ALL=(ALL) ALL

2
plugins/sudoers/regress/cvtsudoers/test34.out.ok
View File

@@ -12,3 +12,5 @@ Host_Alias WEBSERVERS_1 = www1, www2, www3, www5
Host_Alias WEBSERVERS_2 = www1, www2, www3, www4 Host_Alias WEBSERVERS_2 = www1, www2, www3, www4
root ALL = (ALL) ALL root ALL = (ALL) ALL
ALL ALL = (ALL) /usr/bin/id

2
plugins/sudoers/regress/cvtsudoers/test35.out.ok
View File

@@ -12,3 +12,5 @@ Host_Alias WEBSERVERS_1 = www1, www2, www3, www5
Host_Alias WEBSERVERS_2 = www1, www2, www3, www4 Host_Alias WEBSERVERS_2 = www1, www2, www3, www4
root ALL = (ALL) ALL root ALL = (ALL) ALL
ALL ALL = (ALL) /usr/bin/id

2
plugins/sudoers/regress/cvtsudoers/test36.out.ok
View File

@@ -11,3 +11,5 @@ Host_Alias WEBSERVERS = www1, www2, www3
Host_Alias WEBSERVERS_1 = www1, www2, www3, www4 Host_Alias WEBSERVERS_1 = www1, www2, www3, www4
root ALL = (ALL) ALL root ALL = (ALL) ALL
ALL ALL = (ALL) /usr/bin/id