isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Call the approval plugin after the policy plugin accepts a command.

Browse Source 
Previously, for intercepted commands we only called the policy plugin.
This commit is contained in:
Todd C. Miller
2021-08-09 15:50:25 -06:00
parent 4ff3f7604d
commit 42598735d0
3 changed files with 14 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/exec.c
View File

@@ -582,8 +582,6 @@ intercept_check_policy(PolicyCheckRequest *req,
switch (ok) {
case 1:
/* TODO: call approval plugin too */
/* Extract command path from command_info[] */
if (command_info != NULL) {
for (n = 0; command_info[n] != NULL; n++) {
@@ -640,11 +638,16 @@ intercept_check_policy(PolicyCheckRequest *req,
}
closure->run_envp[n] = NULL;
/* Audit the event twice: once for the plugin, once for sudo. */
audit_accept(policy_plugin.name, SUDO_POLICY_PLUGIN, command_info,
closure->run_argv, closure->run_envp);
audit_accept("sudo", SUDO_FRONT_END, command_info,
closure->run_argv, closure->run_envp);
/* Call approval plugins and audit the result. */
if (!approval_check(command_info, closure->run_argv, closure->run_envp))
debug_return_int(0);
/* Audit the event again for the sudo front-end. */
audit_accept("sudo", SUDO_FRONT_END, command_info, closure->run_argv,
closure->run_envp);
debug_return_int(1);
case 0:
if (*errstr == NULL)
@@ -743,8 +746,7 @@ intercept_read(int fd, struct intercept_closure *closure)
ret = true;
done:
// XXX
//intercept_message__free_unpacked(msg, NULL);
intercept_message__free_unpacked(msg, NULL);
free(buf);
debug_return_bool(ret);
}