From 38d884a62d618140ffefd3dfa2370dfc06c344b5 Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
Date: Wed, 1 Sep 2021 13:35:47 -0600
Subject: [PATCH] Do not compile intercept code if --disable-intercept is
 specified.

---
 configure            | 11 +----------
 configure.ac         |  5 +----
 lib/util/sudo_conf.c |  7 +++++++
 scripts/mkdep.pl     |  2 +-
 src/Makefile.in      |  6 +++---
 src/exec_common.c    | 16 ++++++++--------
 src/exec_intercept.c | 20 +++++++++++++++++---
 7 files changed, 38 insertions(+), 29 deletions(-)

diff --git a/configure b/configure
index b254cc6bf..3bd3cbaed 100755
--- a/configure
+++ b/configure
@@ -30884,6 +30884,7 @@ done
 exec_prefix="$oexec_prefix"
 
 if test X"$enable_intercept" != X"no"; then
+    SUDO_OBJS="${SUDO_OBJS} intercept.pb-c.lo"
     PROGS="${PROGS} sudo_intercept.la"
     INSTALL_INTERCEPT="install-intercept"
 
@@ -30896,11 +30897,6 @@ if test X"$enable_intercept" != X"no"; then
 #define _PATH_SUDO_INTERCEPT "$intercept_file"
 EOF
 
-else
-    cat >>confdefs.h <<EOF
-#define _PATH_SUDO_INTERCEPT NULL
-EOF
-
 fi
 if test X"$with_noexec" != X"no"; then
     PROGS="${PROGS} sudo_noexec.la"
@@ -30910,11 +30906,6 @@ if test X"$with_noexec" != X"no"; then
 #define _PATH_SUDO_NOEXEC "$noexec_file"
 EOF
 
-else
-    cat >>confdefs.h <<EOF
-#define _PATH_SUDO_NOEXEC NULL
-EOF
-
 fi
 if test X"$with_selinux" != X"no"; then
     cat >>confdefs.h <<EOF
diff --git a/configure.ac b/configure.ac
index daf06431e..24f654e0d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4813,6 +4813,7 @@ dnl
 dnl Defer setting _PATH_SUDO_NOEXEC, etc until after exec_prefix is set
 dnl
 if test X"$enable_intercept" != X"no"; then
+    SUDO_OBJS="${SUDO_OBJS} intercept.pb-c.lo"
     PROGS="${PROGS} sudo_intercept.la"
     INSTALL_INTERCEPT="install-intercept"
 
@@ -4822,16 +4823,12 @@ if test X"$enable_intercept" != X"no"; then
     fi
 
     SUDO_DEFINE_UNQUOTED(_PATH_SUDO_INTERCEPT, "$intercept_file", [The fully qualified pathname of sudo_intercept.so])
-else
-    SUDO_DEFINE_UNQUOTED(_PATH_SUDO_INTERCEPT, NULL)
 fi
 if test X"$with_noexec" != X"no"; then
     PROGS="${PROGS} sudo_noexec.la"
     INSTALL_NOEXEC="install-noexec"
 
     SUDO_DEFINE_UNQUOTED(_PATH_SUDO_NOEXEC, "$noexec_file", [The fully qualified pathname of sudo_noexec.so])
-else
-    SUDO_DEFINE_UNQUOTED(_PATH_SUDO_NOEXEC, NULL)
 fi
 if test X"$with_selinux" != X"no"; then
     SUDO_DEFINE_UNQUOTED(_PATH_SUDO_SESH, "$sesh_file")
diff --git a/lib/util/sudo_conf.c b/lib/util/sudo_conf.c
index c35a45c59..29518d4d9 100644
--- a/lib/util/sudo_conf.c
+++ b/lib/util/sudo_conf.c
@@ -51,6 +51,13 @@
 #include "sudo_util.h"
 #include "pathnames.h"
 
+#ifndef _PATH_SUDO_INTERCEPT
+# define _PATH_SUDO_INTERCEPT NULL
+#endif
+#ifndef _PATH_SUDO_NOEXEC
+# define _PATH_SUDO_NOEXEC NULL
+#endif
+
 struct sudo_conf_table {
     const char *name;
     unsigned int namelen;
diff --git a/scripts/mkdep.pl b/scripts/mkdep.pl
index 7530768d4..abbc4a474 100755
--- a/scripts/mkdep.pl
+++ b/scripts/mkdep.pl
@@ -111,7 +111,7 @@ sub mkdep {
     # Expand some configure bits
     $makefile =~ s:\@DEV\@::g;
     $makefile =~ s:\@COMMON_OBJS\@:aix.lo event_poll.lo event_select.lo:;
-    $makefile =~ s:\@SUDO_OBJS\@:openbsd.o preload.o selinux.o sesh.o solaris.o:;
+    $makefile =~ s:\@SUDO_OBJS\@:intercept.pb-c.lo openbsd.o preload.o selinux.o sesh.o solaris.o:;
     $makefile =~ s:\@SUDOERS_OBJS\@:bsm_audit.lo linux_audit.lo ldap.lo ldap_util.lo ldap_conf.lo solaris_audit.lo sssd.lo:;
     # XXX - fill in AUTH_OBJS from contents of the auth dir instead
     $makefile =~ s:\@AUTH_OBJS\@:afs.lo aix_auth.lo bsdauth.lo dce.lo fwtk.lo getspwuid.lo kerb5.lo pam.lo passwd.lo rfc1938.lo secureware.lo securid5.lo sia.lo:;
diff --git a/src/Makefile.in b/src/Makefile.in
index 1b2ac8eb6..a4042ef4f 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -141,9 +141,9 @@ PROGS = @PROGS@
 
 OBJS = conversation.o copy_file.o edit_open.o env_hooks.o exec.o exec_common.o \
        exec_intercept.o exec_monitor.o exec_nopty.o exec_preload.lo exec_pty.o \
-       get_pty.o hooks.o intercept.pb-c.lo limits.o load_plugins.o net_ifs.o \
-       parse_args.o preserve_fds.o signal.o sudo.o sudo_edit.o \
-       tcsetpgrp_nobg.o tgetpass.o ttyname.o utmp.o @SUDO_OBJS@
+       get_pty.o hooks.o limits.o load_plugins.o net_ifs.o parse_args.o \
+       preserve_fds.o signal.o sudo.o sudo_edit.o tcsetpgrp_nobg.o tgetpass.o \
+       ttyname.o utmp.o @SUDO_OBJS@
 
 IOBJS = $(OBJS:.o=.i) sesh.i
 
diff --git a/src/exec_common.c b/src/exec_common.c
index 5ce27c68b..35288f9e1 100644
--- a/src/exec_common.c
+++ b/src/exec_common.c
@@ -73,18 +73,18 @@ enable_intercept(char *envp[], const char *dso, int intercept_fd)
 {
     debug_decl(enable_intercept, SUDO_DEBUG_UTIL);
 
+    if (dso != NULL) {
 #ifdef RTLD_PRELOAD_VAR
-    if (dso == NULL)
-	sudo_fatalx("%s: missing DSO", __func__);
-    if (intercept_fd == -1)
-	sudo_fatalx("%s: no intercept fd", __func__);
+	if (intercept_fd == -1)
+	    sudo_fatalx("%s: no intercept fd", __func__);
 
-    envp = sudo_preload_dso(envp, dso, intercept_fd);
+	envp = sudo_preload_dso(envp, dso, intercept_fd);
 #else
-    /* Intercept not supported, envp unchanged. */
-    if (intercept_fd != -1)
-	close(intercept_fd);
+	/* Intercept not supported, envp unchanged. */
+	if (intercept_fd != -1)
+	    close(intercept_fd);
 #endif /* RTLD_PRELOAD_VAR */
+    }
 
     debug_return_ptr(envp);
 }
diff --git a/src/exec_intercept.c b/src/exec_intercept.c
index e08e99970..e07bb9774 100644
--- a/src/exec_intercept.c
+++ b/src/exec_intercept.c
@@ -45,10 +45,12 @@
 #include "sudo_rand.h"
 #include "intercept.pb-c.h"
 
+#ifdef _PATH_SUDO_INTERCEPT
+
 /* TCSASOFT is a BSD extension that ignores control flags and speed. */
-#ifndef TCSASOFT
-# define TCSASOFT	0
-#endif
+# ifndef TCSASOFT
+#  define TCSASOFT	0
+# endif
 
 enum intercept_state {
     RECV_HELLO_INITIAL,
@@ -938,3 +940,15 @@ bad:
 	close(client_sock);
     debug_return;
 }
+#else /* _PATH_SUDO_INTERCEPT */
+bool
+intercept_setup(int fd, struct sudo_event_base *evbase,
+    struct command_details *details)
+{
+    debug_decl(intercept_setup, SUDO_DEBUG_EXEC);
+
+    /* Intercept support not compiled in. */
+
+    debug_return_bool(false);
+}
+#endif /* _PATH_SUDO_INTERCEPT */