isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

o BSD-style copyright

Browse Source 
o Use "struct sudo_user" instead of old globals.
o some cometic cleanup
This commit is contained in:
Todd C. Miller
1999-07-22 12:57:47 +00:00
parent 5fbc12d529
commit 4dc01cc916
2 changed files with 106 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files

129
testsudoers.c
View File

@@ -1,28 +1,31 @@
/* /*
* CU sudo version 1.6 * Copyright (c) 1996, 1998, 1999 Todd C. Miller <Todd.Miller@courtesan.com>
* Copyright (c) 1996, 1998, 1999 Todd C. Miller <Todd.Miller@courtesan.com> * All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This code is derived from software contributed by Chris Jepeway
* it under the terms of the GNU General Public License as published by * <jepeway@cs.utk.edu>.
* the Free Software Foundation; either version 1, or (at your option)
* any later version.
* *
* This program is distributed in the hope that it will be useful, * Redistribution and use in source and binary forms, with or without
* but WITHOUT ANY WARRANTY; without even the implied warranty of * modification, are permitted provided that the following conditions
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * are met:
* GNU General Public License for more details. * 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
* *
* You should have received a copy of the GNU General Public License * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* along with this program; if not, write to the Free Software * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
* * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* Please send bugs, changes, problems to sudo-bugs@courtesan.com * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
******************************************************************* * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
* * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* testsudoers.c -- frontend for parser testing and development. * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
* * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
* Chris Jepeway <jepeway@cs.utk.edu>
*/ */
#include "config.h" #include "config.h"
@@ -63,6 +66,7 @@
#include <dirent.h> #include <dirent.h>
#include "sudo.h" #include "sudo.h"
#include "parse.h"
#include "interfaces.h" #include "interfaces.h"
#ifndef lint #ifndef lint
@@ -72,22 +76,13 @@ static const char rcsid[] = "$Sudo$";
/* /*
* Globals * Globals
*/ */
int parse_error = FALSE;
struct interface *interfaces;
int num_interfaces;
extern int clearaliases;
char *cmnd = NULL;
char *cmnd_args = NULL;
char *cmnd_safe = NULL;
char *runas_user = RUNAS_DEFAULT;
char host[MAXHOSTNAMELEN];
char *shost;
char cwd[MAXPATHLEN];
struct passwd *user_pw_ent;
char **Argv, **NewArgv; char **Argv, **NewArgv;
int Argc, NewArgc; int Argc, NewArgc;
uid_t uid; int parse_error = FALSE;
int num_interfaces;
struct interface *interfaces;
struct sudo_user sudo_user;
extern int clearaliases;
/* /*
* Prototypes for external functions * Prototypes for external functions
@@ -112,15 +107,14 @@ has_meta(s)
return(FALSE); return(FALSE);
} }
/* /*
* return TRUE if cmnd matches, in the sudo sense, * Returns TRUE if cmnd matches, in the sudo sense,
* the pathname in path; otherwise, return FALSE * the pathname in path; otherwise, return FALSE
*/ */
int int
command_matches(cmnd, user_args, path, sudoers_args) command_matches(cmnd, cmnd_args, path, sudoers_args)
char *cmnd; char *cmnd;
char *user_args; char *cmnd_args;
char *path; char *path;
char *sudoers_args; char *sudoers_args;
{ {
@@ -138,10 +132,10 @@ command_matches(cmnd, user_args, path, sudoers_args)
return(FALSE); return(FALSE);
if (!sudoers_args) if (!sudoers_args)
return(TRUE); return(TRUE);
else if (!user_args && sudoers_args && !strcmp("\"\"", sudoers_args)) else if (!cmnd_args && sudoers_args && !strcmp("\"\"", sudoers_args))
return(TRUE); return(TRUE);
else if (sudoers_args) else if (sudoers_args)
return((fnmatch(sudoers_args, user_args ? user_args : "", 0) == 0)); return((fnmatch(sudoers_args, cmnd_args ? cmnd_args : "", 0) == 0));
else else
return(FALSE); return(FALSE);
} else { } else {
@@ -151,10 +145,10 @@ command_matches(cmnd, user_args, path, sudoers_args)
return(FALSE); return(FALSE);
if (!sudoers_args) if (!sudoers_args)
return(TRUE); return(TRUE);
else if (!user_args && sudoers_args && !strcmp("\"\"", sudoers_args)) else if (!cmnd_args && sudoers_args && !strcmp("\"\"", sudoers_args))
return(TRUE); return(TRUE);
else if (sudoers_args) else if (sudoers_args)
return((fnmatch(sudoers_args, user_args ? user_args : "", 0) == 0)); return((fnmatch(sudoers_args, cmnd_args ? cmnd_args : "", 0) == 0));
else else
return(FALSE); return(FALSE);
} }
@@ -174,7 +168,6 @@ command_matches(cmnd, user_args, path, sudoers_args)
} }
} }
int int
addr_matches(n) addr_matches(n)
char *n; char *n;
@@ -206,7 +199,6 @@ addr_matches(n)
return(FALSE); return(FALSE);
} }
int int
usergr_matches(group, user) usergr_matches(group, user)
char *group; char *group;
@@ -215,7 +207,7 @@ usergr_matches(group, user)
struct group *grp; struct group *grp;
char **cur; char **cur;
/* make sure we have a valid usergroup, sudo style */ /* Make sure we have a valid usergroup, sudo style. */
if (*group++ != '%') if (*group++ != '%')
return(FALSE); return(FALSE);
@@ -236,7 +228,6 @@ usergr_matches(group, user)
return(FALSE); return(FALSE);
} }
int int
netgr_matches(netgr, host, user) netgr_matches(netgr, host, user)
char *netgr; char *netgr;
@@ -249,12 +240,12 @@ netgr_matches(netgr, host, user)
static char *domain = NULL; static char *domain = NULL;
#endif /* HAVE_GETDOMAINNAME */ #endif /* HAVE_GETDOMAINNAME */
/* make sure we have a valid netgroup, sudo style */ /* Make sure we have a valid netgroup, sudo style. */
if (*netgr++ != '+') if (*netgr++ != '+')
return(FALSE); return(FALSE);
#ifdef HAVE_GETDOMAINNAME #ifdef HAVE_GETDOMAINNAME
/* get the domain name (if any) */ /* Get the domain name (if any). */
if (domain == (char *) -1) { if (domain == (char *) -1) {
domain = (char *) emalloc(MAXHOSTNAMELEN); domain = (char *) emalloc(MAXHOSTNAMELEN);
@@ -272,7 +263,6 @@ netgr_matches(netgr, host, user)
#endif /* HAVE_INNETGR */ #endif /* HAVE_INNETGR */
} }
void void
set_perms(i, j) set_perms(i, j)
int i, j; int i, j;
@@ -280,7 +270,6 @@ set_perms(i, j)
return; return;
} }
int int
main(argc, argv) main(argc, argv)
int argc; int argc;
@@ -296,58 +285,60 @@ main(argc, argv)
Argv = argv; Argv = argv;
Argc = argc; Argc = argc;
user_runas = RUNAS_DEFAULT;
if (Argc >= 6 && strcmp(Argv[1], "-u") == 0) { if (Argc >= 6 && strcmp(Argv[1], "-u") == 0) {
runas_user = Argv[2]; user_runas = Argv[2];
pw.pw_name = Argv[3]; pw.pw_name = Argv[3];
strcpy(host, Argv[4]); user_host = Argv[4];
cmnd = Argv[5]; user_cmnd = Argv[5];
NewArgv = &Argv[5]; NewArgv = &Argv[5];
NewArgc = Argc - 5; NewArgc = Argc - 5;
} else if (Argc >= 4) { } else if (Argc >= 4) {
pw.pw_name = Argv[1]; pw.pw_name = Argv[1];
strcpy(host, Argv[2]); user_host = Argv[2];
cmnd = Argv[3]; user_cmnd = Argv[3];
NewArgv = &Argv[3]; NewArgv = &Argv[3];
NewArgc = Argc - 3; NewArgc = Argc - 3;
} else { } else {
(void) fprintf(stderr, "usage: %s [-u user] <user> <host> <command> [args]\n", Argv[0]); (void) fprintf(stderr,
"usage: %s [-u user] <user> <host> <command> [args]\n", Argv[0]);
exit(1); exit(1);
} }
user_pw_ent = &pw; /* need user_pw_ent->pw_name defined */ sudo_user.pw = &pw; /* user_name needs to be defined */
if ((p = strchr(host, '.'))) { if ((p = strchr(user_host, '.'))) {
*p = '\0'; *p = '\0';
shost = estrdup(host); user_shost = estrdup(user_host);
*p = '.'; *p = '.';
} else { } else {
shost = &host[0]; user_shost = user_host;
} }
/* fill in cmnd_args from NewArgv */ /* Fill in cmnd_args from NewArgv. */
if (NewArgc > 1) { if (NewArgc > 1) {
size_t size; size_t size;
char *to, **from; char *to, **from;
size = (size_t) NewArgv[NewArgc-1] + strlen(NewArgv[NewArgc-1]) - size = (size_t) NewArgv[NewArgc-1] + strlen(NewArgv[NewArgc-1]) -
(size_t) NewArgv[1] + 1; (size_t) NewArgv[1] + 1;
cmnd_args = (char *) emalloc(size); user_args = (char *) emalloc(size);
for (to = cmnd_args, from = &NewArgv[1]; *from; from++) { for (to = user_args, from = &NewArgv[1]; *from; from++) {
*to++ = ' '; *to++ = ' ';
(void) strcpy(to, *from); (void) strcpy(to, *from);
to += strlen(*from); to += strlen(*from);
} }
} }
/* need to keep aliases around for dumpaliases() */ /* Need to keep aliases around for dumpaliases(). */
clearaliases = 0; clearaliases = 0;
/* load ip addr/mask for each interface */ /* Load ip addr/mask for each interface. */
load_interfaces(); load_interfaces();
/* allocate space for data structures in the parser */ /* Allocate space for data structures in the parser. */
init_parser(); init_parser();
if (yyparse() || parse_error) { if (yyparse() || parse_error) {
@@ -363,12 +354,12 @@ main(argc, argv)
(void) printf("cmnd_match : %d\n", cmnd_matches); (void) printf("cmnd_match : %d\n", cmnd_matches);
(void) printf("no_passwd : %d\n", no_passwd); (void) printf("no_passwd : %d\n", no_passwd);
(void) printf("runas_match: %d\n", runas_matches); (void) printf("runas_match: %d\n", runas_matches);
(void) printf("runas : %s\n", runas_user); (void) printf("runas : %s\n", user_runas);
top--; top--;
} }
} }
/* dump aliases */ /* Dump aliases. */
(void) printf("Matching Aliases --\n"); (void) printf("Matching Aliases --\n");
dumpaliases(); dumpaliases();

102
visudo.c
View File

@@ -1,27 +1,32 @@
/* /*
* CU sudo version 1.6
* Copyright (c) 1996, 1998, 1999 Todd C. Miller <Todd.Miller@courtesan.com> * Copyright (c) 1996, 1998, 1999 Todd C. Miller <Todd.Miller@courtesan.com>
* All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * Redistribution and use in source and binary forms, with or without
* it under the terms of the GNU General Public License as published by * modification, are permitted provided that the following conditions
* the Free Software Foundation; either version 1, or (at your option) * are met:
* any later version. * 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
* *
* This program is distributed in the hope that it will be useful, * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* but WITHOUT ANY WARRANTY; without even the implied warranty of * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
* GNU General Public License for more details. * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* You should have received a copy of the GNU General Public License * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
* along with this program; if not, write to the Free Software * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
* Please send bugs, changes, problems to sudo-bugs@courtesan.com * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
* */
*******************************************************************
* /*
* visudo.c -- locks the sudoers file for safe editing (ala vipw) * Lock the sudoers file for safe editing (ala vipw) and check for parse errors.
* and checks for parse errors.
*/ */
#include "config.h" #include "config.h"
@@ -88,7 +93,7 @@ void init_parser __P((void));
* External globals exported by the parser * External globals exported by the parser
*/ */
extern FILE *yyin, *yyout; extern FILE *yyin, *yyout;
extern int errorlineno, sudolineno; extern int errorlineno;
/* /*
* Globals * Globals
@@ -98,17 +103,7 @@ char **NewArgv = NULL;
int NewArgc = 0; int NewArgc = 0;
char *sudoers = _PATH_SUDO_SUDOERS; char *sudoers = _PATH_SUDO_SUDOERS;
char *stmp = _PATH_SUDO_STMP; char *stmp = _PATH_SUDO_STMP;
struct sudo_user sudo_user;
/*
* Globals required by the parsing routines
*/
char host[] = "";
char *shost = "";
char *cmnd = "";
char *cmnd_safe = NULL;
char *cmnd_args = NULL;
struct passwd *user_pw_ent;
char *runas_user = RUNAS_DEFAULT;
int parse_error = FALSE; int parse_error = FALSE;
@@ -144,11 +139,12 @@ main(argc, argv)
usage(); usage();
} }
/* user_pw_ent needs to point to something real */ /* Mock up a fake sudo_user struct. */
if ((user_pw_ent = getpwuid(getuid())) == NULL) { user_runas = RUNAS_DEFAULT;
(void) fprintf(stderr, "%s: Can't find you in the passwd database: ", user_host = user_shost = user_cmnd = "";
if ((sudo_user.pw = getpwuid(getuid())) == NULL) {
(void) fprintf(stderr, "%s: Can't find you in the passwd database.\n",
Argv[0]); Argv[0]);
perror(stmp);
exit(1); exit(1);
} }
@@ -172,8 +168,7 @@ main(argc, argv)
Argv[0]); Argv[0]);
exit(1); exit(1);
} }
(void) fprintf(stderr, "%s: ", Argv[0]); (void) fprintf(stderr, "%s: %s\n", Argv[0], strerror(errno));
perror(stmp);
Exit(-1); Exit(-1);
} }
@@ -182,8 +177,7 @@ main(argc, argv)
sudoers_fd = open(sudoers, O_RDONLY); sudoers_fd = open(sudoers, O_RDONLY);
if (sudoers_fd < 0 && errno != ENOENT) { if (sudoers_fd < 0 && errno != ENOENT) {
(void) fprintf(stderr, "%s: ", Argv[0]); (void) fprintf(stderr, "%s: %s\n", Argv[0], strerror(errno));
perror(sudoers);
Exit(-1); Exit(-1);
} }
@@ -191,8 +185,8 @@ main(argc, argv)
if (sudoers_fd >= 0) { if (sudoers_fd >= 0) {
while ((n = read(sudoers_fd, buf, sizeof(buf))) > 0) while ((n = read(sudoers_fd, buf, sizeof(buf))) > 0)
if (write(stmp_fd, buf, n) != n) { if (write(stmp_fd, buf, n) != n) {
(void) fprintf(stderr, "%s: Write failed: ", Argv[0]); (void) fprintf(stderr, "%s: Write failed: %s\n", Argv[0],
perror(""); strerror(errno));
Exit(-1); Exit(-1);
} }
@@ -290,16 +284,14 @@ main(argc, argv)
*/ */
if (chown(stmp, SUDOERS_UID, SUDOERS_GID)) { if (chown(stmp, SUDOERS_UID, SUDOERS_GID)) {
(void) fprintf(stderr, (void) fprintf(stderr,
"%s: Unable to set (uid, gid) of %s to (%d, %d): ", "%s: Unable to set (uid, gid) of %s to (%d, %d): %s\n",
Argv[0], stmp, SUDOERS_UID, SUDOERS_GID); Argv[0], stmp, SUDOERS_UID, SUDOERS_GID, strerror(errno));
perror("");
Exit(-1); Exit(-1);
} }
if (chmod(stmp, SUDOERS_MODE)) { if (chmod(stmp, SUDOERS_MODE)) {
(void) fprintf(stderr, (void) fprintf(stderr,
"%s: Unable to change mode of %s to %o: ", "%s: Unable to change mode of %s to %o: %s\n",
Argv[0], stmp, SUDOERS_MODE); Argv[0], stmp, SUDOERS_MODE, strerror(errno));
perror("");
Exit(-1); Exit(-1);
} }
@@ -321,9 +313,8 @@ main(argc, argv)
strlen(sudoers) + 4); strlen(sudoers) + 4);
if ((tmpbuf = (char *) malloc(n)) == NULL) { if ((tmpbuf = (char *) malloc(n)) == NULL) {
(void) fprintf(stderr, (void) fprintf(stderr,
"%s: Cannot alocate memory, %s unchanged: ", "%s: Cannot alocate memory, %s unchanged: %s\n",
Argv[0], sudoers); Argv[0], sudoers, strerror(errno));
perror("");
Exit(-1); Exit(-1);
} }
@@ -337,9 +328,8 @@ main(argc, argv)
} }
free(tmpbuf); free(tmpbuf);
} else { } else {
(void) fprintf(stderr, "%s: Error renaming %s, %s unchanged: ", (void) fprintf(stderr, "%s: Error renaming %s, %s unchanged: %s\n",
Argv[0], stmp, sudoers); Argv[0], stmp, sudoers, strerror(errno));
perror("");
Exit(-1); Exit(-1);
} }
} }
@@ -352,9 +342,9 @@ main(argc, argv)
* These exist to allow us to use the same parser as sudo(8). * These exist to allow us to use the same parser as sudo(8).
*/ */
int int
command_matches(cmnd, user_args, path, sudoers_args) command_matches(cmnd, cmnd_args, path, sudoers_args)
char *cmnd; char *cmnd;
char *user_args; char *cmnd_args;
char *path; char *path;
char *sudoers_args; char *sudoers_args;
{ {