isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use struct sudoers_pivot instead of defining sudoers_pivot_t.

Browse Source 
We want to pass around a pointer, not the struct itself.
This commit is contained in:
Todd C. Miller
2023-09-13 08:36:07 -06:00
parent 15b3d786d7
commit 34990c0e08
7 changed files with 51 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
plugins/sudoers/match_command.c
View File

@@ -806,7 +806,7 @@ command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
const struct command_digest_list *digests) const struct command_digest_list *digests)
{ {
const bool intercepted = info ? info->intercepted : false; const bool intercepted = info ? info->intercepted : false;
sudoers_pivot_t pivot_state = SUDOERS_PIVOT_INITIALIZER; struct sudoers_pivot pivot_state = SUDOERS_PIVOT_INITIALIZER;
char *saved_user_cmnd = NULL; char *saved_user_cmnd = NULL;
struct stat saved_user_stat; struct stat saved_user_stat;
bool reset_cmnd = false; bool reset_cmnd = false;
@@ -832,7 +832,7 @@ command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
/* Pivot root. */ /* Pivot root. */
if (runchroot != NULL) { if (runchroot != NULL) {
if (!pivot_root(runchroot, pivot_state)) if (!pivot_root(runchroot, &pivot_state))
goto done; goto done;
} }
@@ -856,7 +856,7 @@ command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
if (sudoers_cmnd == NULL) { if (sudoers_cmnd == NULL) {
sudoers_cmnd = "ALL"; sudoers_cmnd = "ALL";
ret = command_matches_all(ctx, pivot_get_root(pivot_state), ret = command_matches_all(ctx, pivot_get_root(&pivot_state),
intercepted, digests); intercepted, digests);
goto done; goto done;
} }
@@ -864,7 +864,7 @@ command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
/* Check for regular expressions first. */ /* Check for regular expressions first. */
if (sudoers_cmnd[0] == '^') { if (sudoers_cmnd[0] == '^') {
ret = command_matches_regex(ctx, sudoers_cmnd, sudoers_args, ret = command_matches_regex(ctx, sudoers_cmnd, sudoers_args,
pivot_get_root(pivot_state), intercepted, digests); pivot_get_root(&pivot_state), intercepted, digests);
goto done; goto done;
} }
@@ -894,19 +894,19 @@ command_matches(struct sudoers_context *ctx, const char *sudoers_cmnd,
*/ */
if (def_fast_glob) { if (def_fast_glob) {
ret = command_matches_fnmatch(ctx, sudoers_cmnd, sudoers_args, ret = command_matches_fnmatch(ctx, sudoers_cmnd, sudoers_args,
pivot_get_root(pivot_state), intercepted, digests); pivot_get_root(&pivot_state), intercepted, digests);
} else { } else {
ret = command_matches_glob(ctx, sudoers_cmnd, sudoers_args, ret = command_matches_glob(ctx, sudoers_cmnd, sudoers_args,
pivot_get_root(pivot_state), intercepted, digests); pivot_get_root(&pivot_state), intercepted, digests);
} }
} else { } else {
ret = command_matches_normal(ctx, sudoers_cmnd, sudoers_args, ret = command_matches_normal(ctx, sudoers_cmnd, sudoers_args,
pivot_get_root(pivot_state), intercepted, digests); pivot_get_root(&pivot_state), intercepted, digests);
} }
done: done:
/* Restore root. */ /* Restore root. */
if (runchroot != NULL) if (runchroot != NULL)
(void)unpivot_root(pivot_state); (void)unpivot_root(&pivot_state);
/* Restore ctx->user.cmnd and ctx->user.cmnd_stat. */ /* Restore ctx->user.cmnd and ctx->user.cmnd_stat. */
if (saved_user_cmnd != NULL) { if (saved_user_cmnd != NULL) {

46
plugins/sudoers/pivot.c
View File

@@ -35,20 +35,20 @@
* Returns true on success, else false. * Returns true on success, else false.
*/ */
bool bool
pivot_root(const char *new_root, sudoers_pivot_t state) pivot_root(const char *new_root, struct sudoers_pivot *state)
{ {
debug_decl(pivot_root, SUDOERS_DEBUG_UTIL); debug_decl(pivot_root, SUDOERS_DEBUG_UTIL);
state.saved_root = open("/", O_RDONLY); state->saved_root = open("/", O_RDONLY);
state.saved_cwd = open(".", O_RDONLY); state->saved_cwd = open(".", O_RDONLY);
if (state.saved_root == -1 || state.saved_cwd == -1 || chroot(new_root) == -1) { if (state->saved_root == -1 || state->saved_cwd == -1 || chroot(new_root) == -1) {
if (state.saved_root != -1) { if (state->saved_root != -1) {
close(state.saved_root); close(state->saved_root);
state.saved_root = -1; state->saved_root = -1;
} }
if (state.saved_cwd != -1) { if (state->saved_cwd != -1) {
close(state.saved_cwd); close(state->saved_cwd);
state.saved_cwd = -1; state->saved_cwd = -1;
} }
debug_return_bool(false); debug_return_bool(false);
} }
@@ -60,40 +60,40 @@ pivot_root(const char *new_root, sudoers_pivot_t state)
* Returns true on success, else false. * Returns true on success, else false.
*/ */
bool bool
unpivot_root(sudoers_pivot_t state) unpivot_root(struct sudoers_pivot *state)
{ {
bool ret = true; bool ret = true;
debug_decl(unpivot_root, SUDOERS_DEBUG_UTIL); debug_decl(unpivot_root, SUDOERS_DEBUG_UTIL);
/* Order is important: restore old root, *then* change cwd. */ /* Order is important: restore old root, *then* change cwd. */
if (state.saved_root != -1) { if (state->saved_root != -1) {
if (fchdir(state.saved_root) == -1 || chroot(".") == -1) { if (fchdir(state->saved_root) == -1 || chroot(".") == -1) {
sudo_warn("%s", U_("unable to restore root directory")); sudo_warn("%s", U_("unable to restore root directory"));
ret = false; ret = false;
} }
close(state.saved_root); close(state->saved_root);
state.saved_root = -1; state->saved_root = -1;
} }
if (state.saved_cwd != -1) { if (state->saved_cwd != -1) {
if (fchdir(state.saved_cwd) == -1) { if (fchdir(state->saved_cwd) == -1) {
sudo_warn("%s", U_("unable to restore current working directory")); sudo_warn("%s", U_("unable to restore current working directory"));
ret = false; ret = false;
} }
close(state.saved_cwd); close(state->saved_cwd);
state.saved_cwd = -1; state->saved_cwd = -1;
} }
debug_return_bool(ret); debug_return_bool(ret);
} }
int int
pivot_get_root(sudoers_pivot_t state) pivot_get_root(struct sudoers_pivot *state)
{ {
return state.saved_root; return state->saved_root;
} }
int int
pivot_get_cwd(sudoers_pivot_t state) pivot_get_cwd(struct sudoers_pivot *state)
{ {
return state.saved_cwd; return state->saved_cwd;
} }

9
plugins/sudoers/pivot.h
View File

@@ -25,11 +25,10 @@ struct sudoers_pivot {
int saved_root; int saved_root;
int saved_cwd; int saved_cwd;
}; };
typedef struct sudoers_pivot sudoers_pivot_t;
bool pivot_root(const char *new_root, sudoers_pivot_t cookie); bool pivot_root(const char *new_root, struct sudoers_pivot *state);
bool unpivot_root(sudoers_pivot_t cookie); bool unpivot_root(struct sudoers_pivot *state);
int pivot_get_root(sudoers_pivot_t cookie); int pivot_get_root(struct sudoers_pivot *state);
int pivot_get_cwd(sudoers_pivot_t cookie); int pivot_get_cwd(struct sudoers_pivot *state);
#endif /* SUDOERS_PIVOT_H */ #endif /* SUDOERS_PIVOT_H */

8
plugins/sudoers/regress/fuzz/fuzz_stubs.c
View File

@@ -58,25 +58,25 @@ init_eventlog_config(void)
} }
bool bool
pivot_root(const char *new_root, sudoers_pivot_t state) pivot_root(const char *new_root, struct sudoers_pivot *state)
{ {
return true; return true;
} }
bool bool
unpivot_root(sudoers_pivot_t state) unpivot_root(struct sudoers_pivot *state)
{ {
return true; return true;
} }
int int
pivot_get_root(sudoers_pivot_t state) pivot_get_root(struct sudoers_pivot *state)
{ {
return -1; return -1;
} }
int int
pivot_get_cwd(sudoers_pivot_t state) pivot_get_cwd(struct sudoers_pivot *state)
{ {
return -1; return -1;
} }

8
plugins/sudoers/stubs.c
View File

@@ -98,28 +98,28 @@ init_eventlog_config(void)
/* STUB */ /* STUB */
bool bool
pivot_root(const char *new_root, sudoers_pivot_t state) pivot_root(const char *new_root, struct sudoers_pivot *state)
{ {
return true; return true;
} }
/* STUB */ /* STUB */
bool bool
unpivot_root(sudoers_pivot_t state) unpivot_root(struct sudoers_pivot *state)
{ {
return true; return true;
} }
/* STUB */ /* STUB */
int int
pivot_get_root(sudoers_pivot_t state) pivot_get_root(struct sudoers_pivot *state)
{ {
return -1; return -1;
} }
/* STUB */ /* STUB */
int int
pivot_get_cwd(sudoers_pivot_t state) pivot_get_cwd(struct sudoers_pivot *state)
{ {
return -1; return -1;
} }

8
plugins/sudoers/sudoers.c
View File

@@ -1062,7 +1062,7 @@ init_vars(struct sudoers_context *ctx, char * const envp[])
int int
set_cmnd_path(struct sudoers_context *ctx, const char *runchroot) set_cmnd_path(struct sudoers_context *ctx, const char *runchroot)
{ {
sudoers_pivot_t pivot_state = SUDOERS_PIVOT_INITIALIZER; struct sudoers_pivot pivot_state = SUDOERS_PIVOT_INITIALIZER;
const char *cmnd_in; const char *cmnd_in;
char *cmnd_out = NULL; char *cmnd_out = NULL;
char *path = ctx->user.path; char *path = ctx->user.path;
@@ -1083,7 +1083,7 @@ set_cmnd_path(struct sudoers_context *ctx, const char *runchroot)
/* Pivot root. */ /* Pivot root. */
if (runchroot != NULL) { if (runchroot != NULL) {
if (!pivot_root(runchroot, pivot_state)) if (!pivot_root(runchroot, &pivot_state))
goto error; goto error;
} }
@@ -1121,12 +1121,12 @@ set_cmnd_path(struct sudoers_context *ctx, const char *runchroot)
/* Restore root. */ /* Restore root. */
if (runchroot != NULL) if (runchroot != NULL)
(void)unpivot_root(pivot_state); (void)unpivot_root(&pivot_state);
debug_return_int(ret); debug_return_int(ret);
error: error:
if (runchroot != NULL) if (runchroot != NULL)
(void)unpivot_root(pivot_state); (void)unpivot_root(&pivot_state);
free(cmnd_out); free(cmnd_out);
debug_return_int(NOT_FOUND_ERROR); debug_return_int(NOT_FOUND_ERROR);
} }

8
plugins/sudoers/testsudoers.c
View File

@@ -605,25 +605,25 @@ init_eventlog_config(void)
} }
bool bool
pivot_root(const char *new_root, sudoers_pivot_t state) pivot_root(const char *new_root, struct sudoers_pivot *state)
{ {
return true; return true;
} }
bool bool
unpivot_root(sudoers_pivot_t state) unpivot_root(struct sudoers_pivot *state)
{ {
return true; return true;
} }
int int
pivot_get_root(sudoers_pivot_t state) pivot_get_root(struct sudoers_pivot *state)
{ {
return -1; return -1;
} }
int int
pivot_get_cwd(sudoers_pivot_t state) pivot_get_cwd(struct sudoers_pivot *state)
{ {
return -1; return -1;
} }