isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Transparently handle the "sudo sudoedit" problem.

Browse Source 
Some admin are confused about how to give users sudoedit permission
and many users try to run sudoedit via sudo instead of directly.
If the user runs "sudo sudoedit" sudo will now treat it as plain
"sudoedit" after issuing a warning.  If the admin has specified a
fully-qualified path for sudoedit in sudoers, sudo will treat it
as just "sudoedit" and match accordingly.  In visudo (but not sudo),
a fully-qualified path for sudoedit is now treated as an error.
This commit is contained in:
Todd C. Miller
2019-11-05 15:18:34 -07:00
parent 73031bbb55
commit 635445d471
12 changed files with 167 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
plugins/sudoers/sudoers.c
View File

@@ -199,7 +199,7 @@ sudoers_policy_init(void *info, char * const envp[])
*/
sudoers_setlocale(SUDOERS_LOCALE_SUDOERS, &oldlocale);
sudo_warn_set_locale_func(sudoers_warn_setlocale);
init_parser(sudoers_file, false);
init_parser(sudoers_file, false, false);
TAILQ_FOREACH_SAFE(nss, snl, entries, nss_next) {
if (nss->open(nss) == -1 || (nss->parse_tree = nss->parse(nss)) == NULL) {
TAILQ_REMOVE(snl, nss, entries);
@@ -551,7 +551,7 @@ sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
}
if (def_group_plugin)
group_plugin_unload();
init_parser(NULL, false);
init_parser(NULL, false, false);
if (ISSET(sudo_mode, (MODE_VALIDATE|MODE_CHECK|MODE_LIST))) {
/* ret already set appropriately */
@@ -900,6 +900,14 @@ set_cmnd(void)
else
user_base = user_cmnd;
/* Convert "sudo sudoedit" -> "sudoedit" */
if (ISSET(sudo_mode, MODE_RUN) && strcmp(user_base, "sudoedit") == 0) {
CLR(sudo_mode, MODE_RUN);
SET(sudo_mode, MODE_EDIT);
sudo_warnx(U_("sudoedit doesn't need to be run via sudo"));
user_base = user_cmnd = "sudoedit";
}
TAILQ_FOREACH(nss, snl, entries) {
if (!update_defaults(nss->parse_tree, NULL, SETDEF_CMND, false)) {
log_warningx(SLOG_SEND_MAIL|SLOG_NO_STDERR,