isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make all match functions return ALLOW/DENY not true/false.

Browse Source
This commit is contained in:
Todd C. Miller
2023-09-09 14:07:06 -06:00
parent 7873f8334c
commit 2ef90231a1
9 changed files with 222 additions and 204 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
plugins/sudoers/ldap.c
View File

@@ -331,7 +331,7 @@ sudo_ldap_check_non_unix_group(struct sudoers_context *ctx,
if (*val == '+') {
if (netgr_matches(nss, val,
def_netgroup_tuple ? ctx->runas.host : NULL,
def_netgroup_tuple ? ctx->runas.shost : NULL, pw->pw_name))
def_netgroup_tuple ? ctx->runas.shost : NULL, pw->pw_name) == ALLOW)
ret = true;
DPRINTF2("ldap sudoUser netgroup '%s%s' ... %s",
negated ? "!" : "", val, ret ? "MATCH!" : "not");

17
plugins/sudoers/lookup.c
View File

@@ -43,7 +43,7 @@ runas_matches_pw(struct sudoers_parse_tree *parse_tree,
if (cs->runasgrouplist == NULL) {
/* No explicit runas user or group, use default. */
if (userpw_matches(def_runas_default, pw->pw_name, pw))
if (userpw_matches(def_runas_default, pw->pw_name, pw) == ALLOW)
debug_return_int(ALLOW);
}
debug_return_int(UNSPEC);
@@ -97,8 +97,8 @@ sudoers_lookup_pseudo(struct sudo_nss_list *snl, struct sudoers_context *ctx,
* to support the "pwcheck == all" case.
*/
TAILQ_FOREACH(us, &nss->parse_tree->userspecs, entries) {
int user_match = userlist_matches(nss->parse_tree, ctx->user.pw,
&us->users);
const int user_match = userlist_matches(nss->parse_tree,
ctx->user.pw, &us->users);
if (user_match != ALLOW) {
if (callback != NULL && user_match == DENY) {
callback(nss->parse_tree, us, user_match, NULL, UNSPEC,
@@ -108,8 +108,8 @@ sudoers_lookup_pseudo(struct sudo_nss_list *snl, struct sudoers_context *ctx,
}
TAILQ_FOREACH(priv, &us->privileges, entries) {
int priv_nopass = UNSPEC;
int host_match = hostlist_matches(nss->parse_tree, ctx->user.pw,
&priv->hostlist);
const int host_match = hostlist_matches(nss->parse_tree,
ctx->user.pw, &priv->hostlist);
if (host_match != ALLOW) {
if (callback != NULL) {
callback(nss->parse_tree, us, user_match, priv,
@@ -243,7 +243,8 @@ sudoers_lookup_check(struct sudo_nss *nss, struct sudoers_context *ctx,
init_cmnd_info(ctx, info);
TAILQ_FOREACH_REVERSE(us, &nss->parse_tree->userspecs, userspec_list, entries) {
int user_match = userlist_matches(nss->parse_tree, ctx->user.pw, &us->users);
const int user_match = userlist_matches(nss->parse_tree, ctx->user.pw,
&us->users);
if (user_match != ALLOW) {
if (callback != NULL && user_match == DENY) {
callback(nss->parse_tree, us, user_match, NULL, UNSPEC, NULL,
@@ -253,8 +254,8 @@ sudoers_lookup_check(struct sudo_nss *nss, struct sudoers_context *ctx,
}
CLR(*validated, FLAG_NO_USER);
TAILQ_FOREACH_REVERSE(priv, &us->privileges, privilege_list, entries) {
int host_match = hostlist_matches(nss->parse_tree, ctx->user.pw,
&priv->hostlist);
const int host_match = hostlist_matches(nss->parse_tree,
ctx->user.pw, &priv->hostlist);
if (host_match == ALLOW) {
CLR(*validated, FLAG_NO_HOST);
} else {

152
plugins/sudoers/match.c
View File

@@ -80,11 +80,11 @@ user_matches(const struct sudoers_parse_tree *parse_tree,
case NETGROUP:
if (netgr_matches(parse_tree->nss, m->name,
def_netgroup_tuple ? lhost : NULL,
def_netgroup_tuple ? shost : NULL, pw->pw_name))
def_netgroup_tuple ? shost : NULL, pw->pw_name) == ALLOW)
matched = m->negated ? DENY : ALLOW;
break;
case USERGROUP:
if (usergr_matches(m->name, pw->pw_name, pw))
if (usergr_matches(m->name, pw->pw_name, pw) == ALLOW)
matched = m->negated ? DENY : ALLOW;
break;
case ALIAS:
@@ -103,7 +103,7 @@ user_matches(const struct sudoers_parse_tree *parse_tree,
}
FALLTHROUGH;
case WORD:
if (userpw_matches(m->name, pw->pw_name, pw))
if (userpw_matches(m->name, pw->pw_name, pw) == ALLOW)
matched = m->negated ? DENY : ALLOW;
break;
}
@@ -173,11 +173,11 @@ runas_userlist_matches(const struct sudoers_parse_tree *parse_tree,
if (netgr_matches(parse_tree->nss, m->name,
def_netgroup_tuple ? lhost : NULL,
def_netgroup_tuple ? shost : NULL,
ctx->runas.pw->pw_name))
ctx->runas.pw->pw_name) == ALLOW)
user_matched = m->negated ? DENY : ALLOW;
break;
case USERGROUP:
if (usergr_matches(m->name, ctx->runas.pw->pw_name, ctx->runas.pw))
if (usergr_matches(m->name, ctx->runas.pw->pw_name, ctx->runas.pw) == ALLOW)
user_matched = m->negated ? DENY : ALLOW;
break;
case ALIAS:
@@ -197,7 +197,7 @@ runas_userlist_matches(const struct sudoers_parse_tree *parse_tree,
}
FALLTHROUGH;
case WORD:
if (userpw_matches(m->name, ctx->runas.pw->pw_name, ctx->runas.pw))
if (userpw_matches(m->name, ctx->runas.pw->pw_name, ctx->runas.pw) == ALLOW)
user_matched = m->negated ? DENY : ALLOW;
break;
case MYSELF:
@@ -259,7 +259,7 @@ runas_grouplist_matches(const struct sudoers_parse_tree *parse_tree,
}
FALLTHROUGH;
case WORD:
if (group_matches(m->name, ctx->runas.gr))
if (group_matches(m->name, ctx->runas.gr) == ALLOW)
group_matched = m->negated ? DENY : ALLOW;
break;
}
@@ -381,21 +381,21 @@ host_matches(const struct sudoers_parse_tree *parse_tree,
const struct member *m)
{
struct alias *a;
int matched = UNSPEC;
int ret = UNSPEC;
debug_decl(host_matches, SUDOERS_DEBUG_MATCH);
switch (m->type) {
case ALL:
matched = m->negated ? DENY : ALLOW;
ret = m->negated ? DENY : ALLOW;
break;
case NETGROUP:
if (netgr_matches(parse_tree->nss, m->name, lhost, shost,
def_netgroup_tuple ? pw->pw_name : NULL))
matched = m->negated ? DENY : ALLOW;
def_netgroup_tuple ? pw->pw_name : NULL) == ALLOW)
ret = m->negated ? DENY : ALLOW;
break;
case NTWKADDR:
if (addr_matches(m->name))
matched = m->negated ? DENY : ALLOW;
if (addr_matches(m->name) == ALLOW)
ret = m->negated ? DENY : ALLOW;
break;
case ALIAS:
a = alias_get(parse_tree, m->name, HOSTALIAS);
@@ -405,9 +405,9 @@ host_matches(const struct sudoers_parse_tree *parse_tree,
shost, &a->members);
if (SPECIFIED(rc)) {
if (m->negated) {
matched = rc == ALLOW ? DENY : ALLOW;
ret = rc == ALLOW ? DENY : ALLOW;
} else {
matched = rc;
ret = rc;
}
}
alias_put(a);
@@ -415,15 +415,15 @@ host_matches(const struct sudoers_parse_tree *parse_tree,
}
FALLTHROUGH;
case WORD:
if (hostname_matches(shost, lhost, m->name))
matched = m->negated ? DENY : ALLOW;
if (hostname_matches(shost, lhost, m->name) == ALLOW)
ret = m->negated ? DENY : ALLOW;
break;
}
sudo_debug_printf(SUDO_DEBUG_DEBUG,
"host %s (%s) matches sudoers host %s%s: %s", lhost, shost,
m->negated ? "!" : "", m->name ? m->name : "ALL",
matched == true ? "true" : "false");
debug_return_int(matched);
ret == ALLOW ? "ALLOW" : "DENY");
debug_return_int(ret);
}
/*
@@ -436,15 +436,15 @@ cmndlist_matches(const struct sudoers_parse_tree *parse_tree,
struct cmnd_info *info)
{
struct member *m;
int matched = UNSPEC;
int matched;
debug_decl(cmndlist_matches, SUDOERS_DEBUG_MATCH);
TAILQ_FOREACH_REVERSE(m, list, member_list, entries) {
matched = cmnd_matches(parse_tree, m, runchroot, info);
if (SPECIFIED(matched))
break;
}
debug_return_int(matched);
}
debug_return_int(UNSPEC);
}
/*
@@ -465,7 +465,7 @@ cmnd_matches(const struct sudoers_parse_tree *parse_tree,
case COMMAND:
c = (struct sudo_command *)m->name;
if (command_matches(parse_tree->ctx, c->cmnd, c->args, runchroot,
info, &c->digests))
info, &c->digests) == ALLOW)
matched = m->negated ? DENY : ALLOW;
break;
case ALIAS:
@@ -504,7 +504,7 @@ cmnd_matches_all(const struct sudoers_parse_tree *parse_tree,
case ALL:
c = (struct sudo_command *)m->name;
if (command_matches(parse_tree->ctx, c->cmnd, c->args, runchroot,
info, &c->digests))
info, &c->digests) == ALLOW)
matched = negated ? DENY : ALLOW;
break;
case ALIAS:
@@ -526,93 +526,102 @@ cmnd_matches_all(const struct sudoers_parse_tree *parse_tree,
}
/*
* Returns true if the hostname matches the pattern, else false
* Returns ALLOW if the hostname matches the pattern, else DENY
*/
bool
int
hostname_matches(const char *shost, const char *lhost, const char *pattern)
{
const char *host;
bool rc;
int ret;
debug_decl(hostname_matches, SUDOERS_DEBUG_MATCH);
host = strchr(pattern, '.') != NULL ? lhost : shost;
ret = DENY;
if (has_meta(pattern)) {
rc = !fnmatch(pattern, host, FNM_CASEFOLD);
if (fnmatch(pattern, host, FNM_CASEFOLD) == 0)
ret = ALLOW;
} else {
rc = !strcasecmp(host, pattern);
if (strcasecmp(host, pattern) == 0)
ret = ALLOW;
}
debug_return_bool(rc);
debug_return_int(ret);
}
/*
* Returns true if the user/uid from sudoers matches the specified user/uid,
* else returns false.
* Returns ALLOW if the user/uid from sudoers matches the specified user/uid,
* else returns DENY.
*/
bool
int
userpw_matches(const char *sudoers_user, const char *user, const struct passwd *pw)
{
const char *errstr;
int ret = DENY;
uid_t uid;
bool rc;
debug_decl(userpw_matches, SUDOERS_DEBUG_MATCH);
if (pw != NULL && *sudoers_user == '#') {
uid = (uid_t) sudo_strtoid(sudoers_user + 1, &errstr);
if (errstr == NULL && uid == pw->pw_uid) {
rc = true;
ret = ALLOW;
goto done;
}
}
if (def_case_insensitive_user)
rc = strcasecmp(sudoers_user, user) == 0;
else
rc = strcmp(sudoers_user, user) == 0;
if (def_case_insensitive_user) {
if (strcasecmp(sudoers_user, user) == 0)
ret = ALLOW;
} else {
if (strcmp(sudoers_user, user) == 0)
ret = ALLOW;
}
done:
sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
"user %s matches sudoers user %s: %s",
user, sudoers_user, rc ? "true" : "false");
debug_return_bool(rc);
user, sudoers_user, ret == ALLOW ? "ALLOW" : "DENY");
debug_return_int(ret);
}
/*
* Returns true if the group/gid from sudoers matches the specified group/gid,
* else returns false.
* Returns ALLOW if the group/gid from sudoers matches the specified group/gid,
* else returns DENY.
*/
bool
int
group_matches(const char *sudoers_group, const struct group *gr)
{
const char *errstr;
int ret = DENY;
gid_t gid;
bool rc;
debug_decl(group_matches, SUDOERS_DEBUG_MATCH);
if (*sudoers_group == '#') {
gid = (gid_t) sudo_strtoid(sudoers_group + 1, &errstr);
if (errstr == NULL && gid == gr->gr_gid) {
rc = true;
ret = ALLOW;
goto done;
}
}
if (def_case_insensitive_group)
rc = strcasecmp(sudoers_group, gr->gr_name) == 0;
else
rc = strcmp(sudoers_group, gr->gr_name) == 0;
if (def_case_insensitive_group) {
if (strcasecmp(sudoers_group, gr->gr_name) == 0)
ret = ALLOW;
} else {
if (strcmp(sudoers_group, gr->gr_name) == 0)
ret = ALLOW;
}
done:
sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
"group %s matches sudoers group %s: %s",
gr->gr_name, sudoers_group, rc ? "true" : "false");
debug_return_bool(rc);
gr->gr_name, sudoers_group, ret == ALLOW ? "ALLOW" : "DENY");
debug_return_int(ret);
}
/*
* Returns true if the given user belongs to the named group,
* else returns false.
*/
bool
int
usergr_matches(const char *group, const char *user, const struct passwd *pw)
{
bool matched = false;
struct passwd *pw0 = NULL;
int ret = DENY;
debug_decl(usergr_matches, SUDOERS_DEBUG_MATCH);
/* Make sure we have a valid usergroup, sudo style */
@@ -625,7 +634,7 @@ usergr_matches(const char *group, const char *user, const struct passwd *pw)
/* Query group plugin for %:name groups. */
if (*group == ':' && def_group_plugin) {
if (group_plugin_query(user, group + 1, pw) == true)
matched = true;
ret = ALLOW;
goto done;
}
@@ -640,14 +649,14 @@ usergr_matches(const char *group, const char *user, const struct passwd *pw)
}
if (user_in_group(pw, group)) {
matched = true;
ret = ALLOW;
goto done;
}
/* Query the group plugin for Unix groups too? */
if (def_group_plugin && def_always_query_group_plugin) {
if (group_plugin_query(user, group, pw) == true) {
matched = true;
ret = ALLOW;
goto done;
}
}
@@ -657,8 +666,9 @@ done:
sudo_pw_delref(pw0);
sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
"user %s matches group %s: %s", user, group, matched ? "true" : "false");
debug_return_bool(matched);
"user %s matches group %s: %s", user, group,
ret == ALLOW ? "ALLOW" : "DENY");
debug_return_int(ret);
}
#if defined(HAVE_GETDOMAINNAME) || defined(SI_SRPC_DOMAIN)
@@ -734,28 +744,28 @@ sudo_getdomainname(void)
#endif /* HAVE_GETDOMAINNAME || SI_SRPC_DOMAIN */
/*
* Returns true if "host" and "user" belong to the netgroup "netgr",
* else return false. Either of "lhost", "shost" or "user" may be NULL
* Returns ALLOW if "host" and "user" belong to the netgroup "netgr",
* else return DENY. Either of "lhost", "shost" or "user" may be NULL
* in which case that argument is not checked...
*/
bool
int
netgr_matches(const struct sudo_nss *nss, const char *netgr,
const char *lhost, const char *shost, const char *user)
{
const char *domain;
bool rc = false;
int ret = DENY;
debug_decl(netgr_matches, SUDOERS_DEBUG_MATCH);
if (!def_use_netgroups) {
sudo_debug_printf(SUDO_DEBUG_INFO, "netgroups are disabled");
debug_return_bool(false);
debug_return_int(DENY);
}
/* make sure we have a valid netgroup, sudo style */
if (*netgr++ != '+') {
sudo_debug_printf(SUDO_DEBUG_DIAG, "netgroup %s has no leading '+'",
netgr);
debug_return_bool(false);
debug_return_int(DENY);
}
/* get the domain name (if any) */
@@ -767,11 +777,11 @@ netgr_matches(const struct sudo_nss *nss, const char *netgr,
case 0:
if (lhost != shost) {
if (nss->innetgr(nss, netgr, shost, user, domain) == 1)
rc = true;
ret = ALLOW;
}
goto done;
case 1:
rc = true;
ret = ALLOW;
goto done;
default:
/* Not supported, use system innetgr(3). */
@@ -782,10 +792,10 @@ netgr_matches(const struct sudo_nss *nss, const char *netgr,
#ifdef HAVE_INNETGR
/* Use system innetgr() function. */
if (innetgr(netgr, lhost, user, domain) == 1) {
rc = true;
ret = ALLOW;
} else if (lhost != shost) {
if (innetgr(netgr, shost, user, domain) == 1)
rc = true;
ret = ALLOW;
}
#else
sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
@@ -796,7 +806,7 @@ done:
sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
"netgroup %s matches (%s|%s, %s, %s): %s", netgr, lhost ? lhost : "",
shost ? shost : "", user ? user : "", domain ? domain : "",
rc ? "true" : "false");
ret == ALLOW ? "ALLOW" : "DENY");
debug_return_bool(rc);
debug_return_int(ret);
}

45
plugins/sudoers/match_addr.c
View File

@@ -44,7 +44,7 @@
#include "sudoers.h"
#include "interfaces.h"
static bool
static int
addr_matches_if(const char *n)
{
union sudo_in_addr_un addr;
@@ -63,7 +63,7 @@ addr_matches_if(const char *n)
if (inet_pton(AF_INET, n, &addr.ip4) == 1) {
family = AF_INET;
} else {
debug_return_bool(false);
debug_return_int(DENY);
}
SLIST_FOREACH(ifp, get_interfaces(), entries) {
@@ -74,28 +74,28 @@ addr_matches_if(const char *n)
if (ifp->addr.ip4.s_addr == addr.ip4.s_addr ||
(ifp->addr.ip4.s_addr & ifp->netmask.ip4.s_addr)
== addr.ip4.s_addr)
debug_return_bool(true);
debug_return_int(ALLOW);
break;
#ifdef HAVE_STRUCT_IN6_ADDR
case AF_INET6:
if (memcmp(ifp->addr.ip6.s6_addr, addr.ip6.s6_addr,
sizeof(addr.ip6.s6_addr)) == 0)
debug_return_bool(true);
debug_return_int(ALLOW);
for (j = 0; j < sizeof(addr.ip6.s6_addr); j++) {
if ((ifp->addr.ip6.s6_addr[j] & ifp->netmask.ip6.s6_addr[j]) != addr.ip6.s6_addr[j])
break;
}
if (j == sizeof(addr.ip6.s6_addr))
debug_return_bool(true);
debug_return_int(ALLOW);
break;
#endif /* HAVE_STRUCT_IN6_ADDR */
}
}
debug_return_bool(false);
debug_return_int(DENY);
}
static bool
static int
addr_matches_if_netmask(const char *n, const char *m)
{
size_t i;
@@ -116,7 +116,7 @@ addr_matches_if_netmask(const char *n, const char *m)
if (inet_pton(AF_INET, n, &addr.ip4) == 1) {
family = AF_INET;
} else {
debug_return_bool(false);
debug_return_int(DENY);
}
if (family == AF_INET) {
@@ -124,14 +124,14 @@ addr_matches_if_netmask(const char *n, const char *m)
if (inet_pton(AF_INET, m, &mask.ip4) != 1) {
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
"IPv4 netmask %s: %s", m, "invalid value");
debug_return_bool(false);
debug_return_int(DENY);
}
} else {
i = (size_t)sudo_strtonum(m, 1, 32, &errstr);
if (errstr != NULL) {
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
"IPv4 netmask %s: %s", m, errstr);
debug_return_bool(false);
debug_return_int(DENY);
}
mask.ip4.s_addr = htonl(0xffffffffU << (32 - i));
}
@@ -144,7 +144,7 @@ addr_matches_if_netmask(const char *n, const char *m)
if (errstr != NULL) {
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
"IPv6 netmask %s: %s", m, errstr);
debug_return_bool(false);
debug_return_int(DENY);
}
for (i = 0; i < sizeof(addr.ip6.s6_addr); i++) {
if (j < i * 8)
@@ -165,7 +165,7 @@ addr_matches_if_netmask(const char *n, const char *m)
switch (family) {
case AF_INET:
if ((ifp->addr.ip4.s_addr & mask.ip4.s_addr) == addr.ip4.s_addr)
debug_return_bool(true);
debug_return_int(ALLOW);
break;
#ifdef HAVE_STRUCT_IN6_ADDR
case AF_INET6:
@@ -174,35 +174,36 @@ addr_matches_if_netmask(const char *n, const char *m)
break;
}
if (j == sizeof(addr.ip6.s6_addr))
debug_return_bool(true);
debug_return_int(ALLOW);
break;
#endif /* HAVE_STRUCT_IN6_ADDR */
}
}
debug_return_bool(false);
debug_return_int(DENY);
}
/*
* Returns true if "n" is one of our ip addresses or if
* "n" is a network that we are on, else returns false.
* Returns ALLOW if "n" is one of our ip addresses or if
* "n" is a network that we are on, else returns DENY.
*/
bool
int
addr_matches(char *n)
{
char *m;
bool rc;
int ret;
debug_decl(addr_matches, SUDOERS_DEBUG_MATCH);
/* If there's an explicit netmask, use it. */
if ((m = strchr(n, '/'))) {
*m++ = '\0';
rc = addr_matches_if_netmask(n, m);
ret = addr_matches_if_netmask(n, m);
*(m - 1) = '/';
} else
rc = addr_matches_if(n);
ret = addr_matches_if(n);
sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
"IP address %s matches local host: %s", n, rc ? "true" : "false");
debug_return_bool(rc);
"IP address %s matches local host: %s", n,
ret == ALLOW ? "ALLOW" : "DENY");
debug_return_int(ret);
}

176
plugins/sudoers/match_command.c
View File

@@ -57,28 +57,31 @@
# define O_EXEC O_PATH
#endif
static bool
static int
regex_matches(const char *pattern, const char *str)
{
const char *errstr;
int errcode;
regex_t re;
int ret;
debug_decl(regex_matches, SUDOERS_DEBUG_MATCH);
if (!sudo_regex_compile(&re, pattern, &errstr)) {
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
"unable to compile regular expression \"%s\": %s",
pattern, errstr);
debug_return_bool(false);
debug_return_int(DENY);
}
errcode = regexec(&re, str, 0, NULL, 0);
if (regexec(&re, str, 0, NULL, 0) == 0)
ret = ALLOW;
else
ret = DENY;
regfree(&re);
debug_return_bool(errcode == 0);
debug_return_int(ret);
}
static bool
static int
command_args_match(struct sudoers_context *ctx, const char *sudoers_cmnd,
const char *sudoers_args)
{
@@ -91,9 +94,9 @@ command_args_match(struct sudoers_context *ctx, const char *sudoers_cmnd,
* If the empty string is specified in sudoers, no user args are allowed.
*/
if (sudoers_args == NULL)
debug_return_bool(true);
debug_return_int(ALLOW);
if (strcmp("\"\"", sudoers_args) == 0)
debug_return_bool(ctx->user.cmnd_args ? false : true);
debug_return_int(ctx->user.cmnd_args ? DENY : ALLOW);
/*
* If args are specified in sudoers, they must match the user args.
@@ -102,13 +105,15 @@ command_args_match(struct sudoers_context *ctx, const char *sudoers_cmnd,
if (sudoers_args[0] == '^') {
size_t len = strlen(sudoers_args);
if (len > 0 && sudoers_args[len - 1] == '$')
debug_return_bool(regex_matches(sudoers_args, args));
debug_return_int(regex_matches(sudoers_args, args));
}
/* If running as sudoedit, all args are assumed to be paths. */
if (strcmp(sudoers_cmnd, "sudoedit") == 0)
flags = FNM_PATHNAME;
debug_return_bool(fnmatch(sudoers_args, args, flags) == 0);
if (fnmatch(sudoers_args, args, flags) == 0)
debug_return_int(ALLOW);
debug_return_int(DENY);
}
#ifndef SUDOERS_NAME_MATCH
@@ -250,14 +255,14 @@ set_cmnd_fd(struct sudoers_context *ctx, int fd, int rootfd)
/*
* Return true if ctx->user.cmnd names one of the inodes in dir, else false.
*/
static bool
static int
command_matches_dir(struct sudoers_context *ctx, const char *sudoers_dir,
size_t dlen, int rootfd, bool intercepted, const struct command_digest_list *digests)
{
struct stat sudoers_stat;
char path[PATH_MAX];
int len, fd = -1;
bool ret = false;
int ret = DENY;
debug_decl(command_matches_dir, SUDOERS_DEBUG_MATCH);
/* Compare the canonicalized directories, if possible. */
@@ -288,26 +293,28 @@ command_matches_dir(struct sudoers_context *ctx, const char *sudoers_dir,
if (ctx->user.cmnd_stat == NULL ||
(ctx->user.cmnd_stat->st_dev == sudoers_stat.st_dev &&
ctx->user.cmnd_stat->st_ino == sudoers_stat.st_ino)) {
if (!digest_matches(fd, path, digests))
if (digest_matches(fd, path, digests) != ALLOW)
goto done;
free(ctx->runas.cmnd);
if ((ctx->runas.cmnd = strdup(path)) == NULL) {
sudo_warnx(U_("%s: %s"), __func__,
U_("unable to allocate memory"));
}
ret = true;
ret = ALLOW;
goto done;
}
ret = DENY;
done:
if (fd != -1)
close(fd);
debug_return_bool(ret);
debug_return_int(ret);
}
#else /* SUDOERS_NAME_MATCH */
/*
* Return true if ctx->user.cmnd names one of the inodes in dir, else false.
*/
static bool
static int
command_matches_dir(struct sudoers_context *ctx, const char *sudoers_dir,
size_t dlen, int rootfd, bool intercepted,
const struct command_digest_list *digests)
@@ -326,19 +333,19 @@ command_matches_dir(struct sudoers_context *ctx, const char *sudoers_dir,
/* Open the file for fdexec or for digest matching. */
if (!open_cmnd(ctx->user.cmnd, digests, &fd))
goto bad;
if (!digest_matches(fd, ctx->user.cmnd, digests))
if (digest_matches(fd, ctx->user.cmnd, digests) != ALLOW)
goto bad;
set_cmnd_fd(ctx, fd, rootfd);
debug_return_bool(true);
debug_return_int(ALLOW);
bad:
if (fd != -1)
close(fd);
debug_return_bool(false);
debug_return_int(DENY);
}
#endif /* SUDOERS_NAME_MATCH */
static bool
static int
command_matches_all(struct sudoers_context *ctx, int rootfd, bool intercepted,
const struct command_digest_list *digests)
{
@@ -369,19 +376,19 @@ command_matches_all(struct sudoers_context *ctx, int rootfd, bool intercepted,
}
/* Check digest of ctx->user.cmnd since we have no sudoers_cmnd for ALL. */
if (!digest_matches(fd, ctx->user.cmnd, digests))
if (digest_matches(fd, ctx->user.cmnd, digests) != ALLOW)
goto bad;
set_cmnd_fd(ctx, fd, rootfd);
/* No need to set ctx->runas.cmnd for ALL. */
debug_return_bool(true);
debug_return_int(ALLOW);
bad:
if (fd != -1)
close(fd);
debug_return_bool(false);
debug_return_int(DENY);
}
static bool
static int
command_matches_fnmatch(struct sudoers_context *ctx, const char *sudoers_cmnd,
const char *sudoers_args, int rootfd, bool intercepted,
const struct command_digest_list *digests)
@@ -397,25 +404,25 @@ command_matches_fnmatch(struct sudoers_context *ctx, const char *sudoers_cmnd,
/* A relative ctx->user.cmnd will not match, try canonicalized version. */
if (ctx->user.cmnd[0] != '/') {
if (ctx->user.cmnd_dir == NULL)
debug_return_bool(false);
debug_return_int(DENY);
len = snprintf(buf, sizeof(buf), "%s/%s", ctx->user.cmnd_dir,
ctx->user.cmnd_base);
if (len < 0 || len >= ssizeof(buf))
debug_return_bool(false);
debug_return_int(DENY);
cmnd = buf;
}
/*
* Return true if fnmatch(3) succeeds AND
* Return ALLOW if fnmatch(3) succeeds AND
* a) there are no args in sudoers OR
* b) there are no args on command line and none required by sudoers OR
* c) there are args in sudoers and on command line and they match
* else return false.
* else return DENY.
*/
if (fnmatch(sudoers_cmnd, cmnd, FNM_PATHNAME) != 0)
debug_return_bool(false);
debug_return_int(DENY);
if (command_args_match(ctx, sudoers_cmnd, sudoers_args)) {
if (command_args_match(ctx, sudoers_cmnd, sudoers_args) == ALLOW) {
/* Open the file for fdexec or for digest matching. */
if (!open_cmnd(cmnd, digests, &fd))
goto bad;
@@ -426,21 +433,20 @@ command_matches_fnmatch(struct sudoers_context *ctx, const char *sudoers_cmnd,
goto bad;
#endif
/* Check digest of cmnd since sudoers_cmnd is a pattern. */
if (!digest_matches(fd, cmnd, digests))
if (digest_matches(fd, cmnd, digests) != ALLOW)
goto bad;
set_cmnd_fd(ctx, fd, rootfd);
/* No need to set ctx->runas.cmnd since cmnd matches sudoers_cmnd */
debug_return_bool(true);
debug_return_int(ALLOW);
bad:
if (fd != -1)
close(fd);
debug_return_bool(false);
}
debug_return_bool(false);
debug_return_int(DENY);
}
static bool
static int
command_matches_regex(struct sudoers_context *ctx, const char *sudoers_cmnd,
const char *sudoers_args, int rootfd, bool intercepted,
const struct command_digest_list *digests)
@@ -456,25 +462,25 @@ command_matches_regex(struct sudoers_context *ctx, const char *sudoers_cmnd,
/* A relative ctx->user.cmnd will not match, try canonicalized version. */
if (ctx->user.cmnd[0] != '/') {
if (ctx->user.cmnd_dir == NULL)
debug_return_bool(false);
debug_return_int(DENY);
len = snprintf(buf, sizeof(buf), "%s/%s", ctx->user.cmnd_dir,
ctx->user.cmnd_base);
if (len < 0 || len >= ssizeof(buf))
debug_return_bool(false);
debug_return_int(DENY);
cmnd = buf;
}
/*
* Return true if sudoers_cmnd regex matches cmnd AND
* Return ALLOW if sudoers_cmnd regex matches cmnd AND
* a) there are no args in sudoers OR
* b) there are no args on command line and none required by sudoers OR
* c) there are args in sudoers and on command line and they match
* else return false.
* else return DENY.
*/
if (!regex_matches(sudoers_cmnd, cmnd))
debug_return_bool(false);
if (regex_matches(sudoers_cmnd, cmnd) != ALLOW)
debug_return_int(DENY);
if (command_args_match(ctx, sudoers_cmnd, sudoers_args)) {
if (command_args_match(ctx, sudoers_cmnd, sudoers_args) == ALLOW) {
/* Open the file for fdexec or for digest matching. */
if (!open_cmnd(cmnd, digests, &fd))
goto bad;
@@ -485,22 +491,21 @@ command_matches_regex(struct sudoers_context *ctx, const char *sudoers_cmnd,
goto bad;
#endif
/* Check digest of cmnd since sudoers_cmnd is a pattern. */
if (!digest_matches(fd, cmnd, digests))
if (digest_matches(fd, cmnd, digests) != ALLOW)
goto bad;
set_cmnd_fd(ctx, fd, rootfd);
/* No need to set ctx->runas.cmnd since cmnd matches sudoers_cmnd */
debug_return_bool(true);
debug_return_int(ALLOW);
bad:
if (fd != -1)
close(fd);
debug_return_bool(false);
}
debug_return_bool(false);
debug_return_int(DENY);
}
#ifndef SUDOERS_NAME_MATCH
static bool
static int
command_matches_glob(struct sudoers_context *ctx, const char *sudoers_cmnd,
const char *sudoers_args, int rootfd, bool intercepted,
const struct command_digest_list *digests)
@@ -522,19 +527,19 @@ command_matches_glob(struct sudoers_context *ctx, const char *sudoers_cmnd,
if (sudoers_cmnd[dlen - 1] != '/') {
base = sudo_basename(sudoers_cmnd);
if (!has_meta(base) && strcmp(ctx->user.cmnd_base, base) != 0)
debug_return_bool(false);
debug_return_int(DENY);
}
/*
* Return true if we find a match in the glob(3) results AND
* Return ALLOW if we find a match in the glob(3) results AND
* a) there are no args in sudoers OR
* b) there are no args on command line and none required by sudoers OR
* c) there are args in sudoers and on command line and they match
* else return false.
* else return DENY.
*/
if (glob(sudoers_cmnd, GLOB_NOSORT, NULL, &gl) != 0 || gl.gl_pathc == 0) {
globfree(&gl);
debug_return_bool(false);
debug_return_int(DENY);
}
/* If ctx->user.cmnd is fully-qualified, check for an exact match. */
@@ -558,7 +563,7 @@ command_matches_glob(struct sudoers_context *ctx, const char *sudoers_cmnd,
(ctx->user.cmnd_stat->st_dev == sudoers_stat.st_dev &&
ctx->user.cmnd_stat->st_ino == sudoers_stat.st_ino)) {
/* There could be multiple matches, check digest early. */
if (!digest_matches(fd, cp, digests)) {
if (digest_matches(fd, cp, digests) != ALLOW) {
bad_digest = true;
continue;
}
@@ -587,9 +592,9 @@ command_matches_glob(struct sudoers_context *ctx, const char *sudoers_cmnd,
dlen = strlen(cp);
if (cp[dlen - 1] == '/') {
if (command_matches_dir(ctx, cp, dlen, rootfd, intercepted,
digests)) {
digests) == ALLOW) {
globfree(&gl);
debug_return_bool(true);
debug_return_int(ALLOW);
}
continue;
}
@@ -627,7 +632,7 @@ command_matches_glob(struct sudoers_context *ctx, const char *sudoers_cmnd,
if (ctx->user.cmnd_stat == NULL ||
(ctx->user.cmnd_stat->st_dev == sudoers_stat.st_dev &&
ctx->user.cmnd_stat->st_ino == sudoers_stat.st_ino)) {
if (!digest_matches(fd, cp, digests))
if (digest_matches(fd, cp, digests) != ALLOW)
continue;
free(ctx->runas.cmnd);
if ((ctx->runas.cmnd = strdup(cp)) == NULL) {
@@ -642,18 +647,18 @@ command_matches_glob(struct sudoers_context *ctx, const char *sudoers_cmnd,
done:
globfree(&gl);
if (cp != NULL) {
if (command_args_match(ctx, sudoers_cmnd, sudoers_args)) {
if (command_args_match(ctx, sudoers_cmnd, sudoers_args) == ALLOW) {
/* ctx->runas.cmnd was set above. */
set_cmnd_fd(ctx, fd, rootfd);
debug_return_bool(true);
debug_return_int(ALLOW);
}
}
if (fd != -1)
close(fd);
debug_return_bool(false);
debug_return_int(DENY);
}
static bool
static int
command_matches_normal(struct sudoers_context *ctx, const char *sudoers_cmnd,
const char *sudoers_args, int rootfd, bool intercepted,
const struct command_digest_list *digests)
@@ -667,14 +672,14 @@ command_matches_normal(struct sudoers_context *ctx, const char *sudoers_cmnd,
/* If it ends in '/' it is a directory spec. */
dlen = strlen(sudoers_cmnd);
if (sudoers_cmnd[dlen - 1] == '/') {
debug_return_bool(command_matches_dir(ctx, sudoers_cmnd, dlen, rootfd,
debug_return_int(command_matches_dir(ctx, sudoers_cmnd, dlen, rootfd,
intercepted, digests));
}
/* Only proceed if ctx->user.cmnd_base and basename(sudoers_cmnd) match */
base = sudo_basename(sudoers_cmnd);
if (strcmp(ctx->user.cmnd_base, base) != 0)
debug_return_bool(false);
debug_return_int(DENY);
/* Compare the canonicalized parent directories, if possible. */
if (ctx->user.cmnd_dir != NULL) {
@@ -720,9 +725,9 @@ command_matches_normal(struct sudoers_context *ctx, const char *sudoers_cmnd,
if (strcmp(ctx->user.cmnd, sudoers_cmnd) != 0)
goto bad;
}
if (!command_args_match(ctx, sudoers_cmnd, sudoers_args))
if (command_args_match(ctx, sudoers_cmnd, sudoers_args) != ALLOW)
goto bad;
if (!digest_matches(fd, sudoers_cmnd, digests)) {
if (digest_matches(fd, sudoers_cmnd, digests) != ALLOW) {
/* XXX - log functions not available but we should log very loudly */
goto bad;
}
@@ -732,14 +737,14 @@ command_matches_normal(struct sudoers_context *ctx, const char *sudoers_cmnd,
goto bad;
}
set_cmnd_fd(ctx, fd, rootfd);
debug_return_bool(true);
debug_return_int(ALLOW);
bad:
if (fd != -1)
close(fd);
debug_return_bool(false);
debug_return_int(DENY);
}
#else /* SUDOERS_NAME_MATCH */
static bool
static int
command_matches_glob(struct sudoers_context *ctx, const char *sudoers_cmnd,
const char *sudoers_args, int rootfd, bool intercepted,
const struct command_digest_list *digests)
@@ -748,7 +753,7 @@ command_matches_glob(struct sudoers_context *ctx, const char *sudoers_cmnd,
intercepted, digests);
}
static bool
static int
command_matches_normal(struct sudoers_context *ctx, const char *sudoers_cmnd,
const char *sudoers_args, int rootfd, bool intercepted,
const struct command_digest_list *digests)
@@ -760,16 +765,16 @@ command_matches_normal(struct sudoers_context *ctx, const char *sudoers_cmnd,
/* If it ends in '/' it is a directory spec. */
dlen = strlen(sudoers_cmnd);
if (sudoers_cmnd[dlen - 1] == '/') {
debug_return_bool(command_matches_dir(ctx, sudoers_cmnd, dlen, rootfd,
debug_return_int(command_matches_dir(ctx, sudoers_cmnd, dlen, rootfd,
intercepted, digests));
}
if (strcmp(ctx->user.cmnd, sudoers_cmnd) == 0) {
if (command_args_match(ctx, sudoers_cmnd, sudoers_args)) {
if (command_args_match(ctx, sudoers_cmnd, sudoers_args) == ALLOW) {
/* Open the file for fdexec or for digest matching. */
if (!open_cmnd(ctx->user.cmnd, digests, &fd))
goto bad;
if (!digest_matches(fd, ctx->user.cmnd, digests))
if (digest_matches(fd, ctx->user.cmnd, digests) != ALLOW)
goto bad;
/* Successful match. */
@@ -780,21 +785,22 @@ command_matches_normal(struct sudoers_context *ctx, const char *sudoers_cmnd,
goto bad;
}
set_cmnd_fd(ctx, fd, rootfd);
debug_return_bool(true);
debug_return_int(ALLOW);
}
}
bad:
if (fd != -1)
close(fd);
debug_return_bool(false);
debug_return_int(DENY);
}
#endif /* SUDOERS_NAME_MATCH */
/*
* If path doesn't end in /, return true iff cmnd & path name the same inode;
* otherwise, return true if ctx->user.cmnd names one of the inodes in path.
* If path doesn't end in /, return ALLOW iff cmnd & path name the same inode;
* otherwise, return ALLOW if ctx->user.cmnd names one of the inodes in path.
* Returns DENY on failure.
*/
bool
int
command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
const char *sudoers_args, const char *runchroot, struct cmnd_info *info,
const struct command_digest_list *digests)
@@ -804,7 +810,7 @@ command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
char *saved_user_cmnd = NULL;
struct stat saved_user_stat;
bool reset_cmnd = false;
bool rc = false;
int ret = DENY;
debug_decl(command_matches, SUDOERS_DEBUG_MATCH);
if (ctx->runas.chroot != NULL) {
@@ -850,13 +856,13 @@ command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
if (sudoers_cmnd == NULL) {
sudoers_cmnd = "ALL";
rc = command_matches_all(ctx, pivot_fds[0], intercepted, digests);
ret = command_matches_all(ctx, pivot_fds[0], intercepted, digests);
goto done;
}
/* Check for regular expressions first. */
if (sudoers_cmnd[0] == '^') {
rc = command_matches_regex(ctx, sudoers_cmnd, sudoers_args,
ret = command_matches_regex(ctx, sudoers_cmnd, sudoers_args,
pivot_fds[0], intercepted, digests);
goto done;
}
@@ -872,9 +878,9 @@ command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
if (strcmp(sudoers_cmnd, "list") == 0 ||
strcmp(sudoers_cmnd, "sudoedit") == 0) {
if (strcmp(ctx->user.cmnd, sudoers_cmnd) == 0 &&
command_args_match(ctx, sudoers_cmnd, sudoers_args)) {
command_args_match(ctx, sudoers_cmnd, sudoers_args) == ALLOW) {
/* No need to set ctx->user.cmnd since cmnd == sudoers_cmnd */
rc = true;
ret = ALLOW;
}
}
goto done;
@@ -886,14 +892,14 @@ command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
* use glob(3) and/or fnmatch(3) to do the matching.
*/
if (def_fast_glob) {
rc = command_matches_fnmatch(ctx, sudoers_cmnd, sudoers_args,
ret = command_matches_fnmatch(ctx, sudoers_cmnd, sudoers_args,
pivot_fds[0], intercepted, digests);
} else {
rc = command_matches_glob(ctx, sudoers_cmnd, sudoers_args,
ret = command_matches_glob(ctx, sudoers_cmnd, sudoers_args,
pivot_fds[0], intercepted, digests);
}
} else {
rc = command_matches_normal(ctx, sudoers_cmnd, sudoers_args,
ret = command_matches_normal(ctx, sudoers_cmnd, sudoers_args,
pivot_fds[0], intercepted, digests);
}
done:
@@ -921,6 +927,6 @@ done:
ctx->user.cmnd_args ? ctx->user.cmnd_args : "", sudoers_cmnd,
sudoers_args ? " " : "", sudoers_args ? sudoers_args : "",
runchroot ? ", chroot " : "", runchroot ? runchroot : "",
rc ? "true" : "false");
debug_return_bool(rc);
ret == ALLOW ? "ALLOW" : "DENY");
debug_return_int(ret);
}

10
plugins/sudoers/match_digest.c
View File

@@ -38,7 +38,7 @@
#include "sudo_digest.h"
#include <gram.h>
bool
int
digest_matches(int fd, const char *path,
const struct command_digest_list *digests)
{
@@ -47,12 +47,12 @@ digest_matches(int fd, const char *path,
unsigned char *sudoers_digest = NULL;
struct command_digest *digest;
size_t digest_len = (size_t)-1;
bool matched = false;
int matched = DENY;
debug_decl(digest_matches, SUDOERS_DEBUG_MATCH);
if (TAILQ_EMPTY(digests)) {
/* No digest, no problem. */
debug_return_bool(true);
debug_return_int(ALLOW);
}
if (fd == -1) {
@@ -104,7 +104,7 @@ digest_matches(int fd, const char *path,
}
}
if (memcmp(file_digest, sudoers_digest, digest_len) == 0) {
matched = true;
matched = ALLOW;
break;
}
@@ -122,5 +122,5 @@ bad_format:
done:
free(sudoers_digest);
free(file_digest);
debug_return_bool(matched);
debug_return_int(matched);
}

16
plugins/sudoers/parse.h
View File

@@ -425,22 +425,22 @@ bool sudoers_error_recovery(void);
bool sudoers_strict(void);
/* match_addr.c */
bool addr_matches(char *n);
int addr_matches(char *n);
/* match_command.c */
bool command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd, const char *sudoers_args, const char *runchroot, struct cmnd_info *info, const struct command_digest_list *digests);
int command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd, const char *sudoers_args, const char *runchroot, struct cmnd_info *info, const struct command_digest_list *digests);
/* match_digest.c */
bool digest_matches(int fd, const char *path, const struct command_digest_list *digests);
int digest_matches(int fd, const char *path, const struct command_digest_list *digests);
/* match.c */
struct group;
struct passwd;
bool group_matches(const char *sudoers_group, const struct group *gr);
bool hostname_matches(const char *shost, const char *lhost, const char *pattern);
bool netgr_matches(const struct sudo_nss *nss, const char *netgr, const char *lhost, const char *shost, const char *user);
bool usergr_matches(const char *group, const char *user, const struct passwd *pw);
bool userpw_matches(const char *sudoers_user, const char *user, const struct passwd *pw);
int group_matches(const char *sudoers_group, const struct group *gr);
int hostname_matches(const char *shost, const char *lhost, const char *pattern);
int netgr_matches(const struct sudo_nss *nss, const char *netgr, const char *lhost, const char *shost, const char *user);
int usergr_matches(const char *group, const char *user, const struct passwd *pw);
int userpw_matches(const char *sudoers_user, const char *user, const struct passwd *pw);
int cmnd_matches(const struct sudoers_parse_tree *parse_tree, const struct member *m, const char *runchroot, struct cmnd_info *info);
int cmnd_matches_all(const struct sudoers_parse_tree *parse_tree, const struct member *m, const char *runchroot, struct cmnd_info *info);
int cmndlist_matches(const struct sudoers_parse_tree *parse_tree, const struct member_list *list, const char *runchroot, struct cmnd_info *info);

2
plugins/sudoers/regress/parser/check_addr.c
View File

@@ -57,7 +57,7 @@ check_addr(char *input)
sudo_fatalx("expecting 0 or 1, got %s", cp);
input[len] = '\0';
matched = addr_matches(input);
matched = addr_matches(input) == ALLOW;
if (matched != expected) {
sudo_warnx("%s %smatched: FAIL", input, matched ? "" : "not ");
return 1;

6
plugins/sudoers/sssd.c
View File

@@ -205,20 +205,20 @@ sudo_sss_check_user(struct sudoers_context *ctx, struct sudo_sss_handle *handle,
case '+':
/* Netgroup spec found, check membership. */
if (netgr_matches(NULL, val, def_netgroup_tuple ? host : NULL,
def_netgroup_tuple ? shost : NULL, handle->pw->pw_name)) {
def_netgroup_tuple ? shost : NULL, handle->pw->pw_name) == ALLOW) {
ret = true;
}
break;
case '%':
/* User group found, check membership. */
if (usergr_matches(val, handle->pw->pw_name, handle->pw)) {
if (usergr_matches(val, handle->pw->pw_name, handle->pw) == ALLOW) {
ret = true;
}
break;
default:
/* Not a netgroup or user group. */
if (strcmp(val, "ALL") == 0 ||
userpw_matches(val, handle->pw->pw_name, handle->pw)) {
userpw_matches(val, handle->pw->pw_name, handle->pw) == ALLOW) {
ret = true;
}
break;