isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

When determining whether or not "sudo -l" or "sudo -b" should prompt

Browse Source 
for a password, take all sudoers sources into account.  In other
words, if both file and ldap sudoers sources are in use, "sudo -v"
will now require that all entries in both sources be have NOPASSWD
(file) or !authenticate (ldap) in the entries.
This commit is contained in:
Todd C. Miller
2016-04-19 10:08:51 -06:00
parent b2d1c457ce
commit 6717c32022
5 changed files with 56 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
plugins/sudoers/sudoers.c
View File

@@ -1,5 +1,5 @@
/*
* Copyright (c) 1993-1996, 1998-2015 Todd C. Miller <Todd.Miller@courtesan.com>
* Copyright (c) 1993-1996, 1998-2016 Todd C. Miller <Todd.Miller@courtesan.com>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -261,6 +261,7 @@ sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
char *iolog_path = NULL;
mode_t cmnd_umask = 0777;
struct sudo_nss *nss;
bool nopass = false;
int cmnd_status = -1, oldlocale, validated;
int rval = -1;
debug_decl(sudoers_policy_main, SUDOERS_DEBUG_PLUGIN)
@@ -343,6 +344,33 @@ sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
TAILQ_FOREACH(nss, snl, entries) {
validated = nss->lookup(nss, validated, pwflag);
/*
* The NOPASSWD tag needs special handling among all sources
* in -l or -v mode.
*/
if (pwflag) {
enum def_tuple pwcheck =
(pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
switch (pwcheck) {
case all:
if (!ISSET(validated, FLAG_NOPASSWD))
nopass = false;
break;
case any:
if (ISSET(validated, FLAG_NOPASSWD))
nopass = true;
break;
case never:
nopass = true;
break;
case always:
nopass = false;
break;
default:
break;
}
}
if (ISSET(validated, VALIDATE_ERROR)) {
/* The lookup function should have printed an error. */
goto done;
@@ -356,6 +384,8 @@ sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
break;
}
}
if (pwflag && nopass)
def_authenticate = false;
/* Restore user's locale. */
sudoers_setlocale(oldlocale, NULL);