Add support for #include and #includedir from Natale Vinto.
This commit is contained in:
Todd C. Miller
@@ -38,137 +38,212 @@ my %UA;
|
|||||||
my %HA;
|
my %HA;
|
||||||
my %CA;
|
my %CA;
|
||||||
my $base=$ENV{SUDOERS_BASE} or die "$0: Container SUDOERS_BASE undefined\n";
|
my $base=$ENV{SUDOERS_BASE} or die "$0: Container SUDOERS_BASE undefined\n";
|
||||||
my @options=();
|
my @options = ();
|
||||||
my $notBefore;
|
my $notBefore;
|
||||||
my $notAfter;
|
my $notAfter;
|
||||||
|
|
||||||
my $did_defaults=0;
|
my $did_defaults = 0;
|
||||||
my $order = 0;
|
my $order = 0;
|
||||||
my %seen_users;
|
my %seen_users;
|
||||||
|
my @sudoersdirs;
|
||||||
|
|
||||||
# parse sudoers one line at a time
|
# Parsing is now through callbacks reading @ARGV or STDIN
|
||||||
while (<>){
|
sub parse_sudoers_line {
|
||||||
|
my $line = shift;
|
||||||
|
|
||||||
# remove comment
|
# remove comment
|
||||||
s/#.*//;
|
$line =~ s/#.*//;
|
||||||
|
|
||||||
# line continuation
|
# cleanup newline
|
||||||
$_.=<> while s/\\\s*$//s;
|
chomp $line;
|
||||||
|
|
||||||
# cleanup newline
|
# ignore blank lines
|
||||||
chomp;
|
return if $line =~ /^\s*$/;
|
||||||
|
|
||||||
# ignore blank lines
|
if ($line =~ s/^Defaults\s+//) {
|
||||||
next if /^\s*$/;
|
$line =~ s/\s+$//; # remove trailing whitespace
|
||||||
|
# remove spaces between '!', '=', '+=' and '-='
|
||||||
|
$line =~ s/^(\S+)\s*([\+-]?=)\s*(\S.*)$/$1$2$3/ unless $line =~ s/^!\s*(\S.*)$/!$1/;
|
||||||
|
push @options, $line;
|
||||||
|
} elsif ($line =~ /^(\S+)\s+([^=]+)=\s*(.*)/) {
|
||||||
|
# Aliases or Definitions
|
||||||
|
my ($p1, $p2, $p3) = ($1, $2, $3);
|
||||||
|
$p2 =~ s/\s+$//; # remove trailing whitespace
|
||||||
|
$p3 =~ s/\s+$//; # remove trailing whitespace
|
||||||
|
|
||||||
if (s/^Defaults\s+//) {
|
if ($p1 eq "User_Alias") {
|
||||||
s/\s+$//; # remove trailing whitespace
|
$UA{$p2}=$p3;
|
||||||
# remove spaces between '!', '=', '+=' and '-='
|
} elsif ($p1 eq "Runas_Alias") {
|
||||||
s/^(\S+)\s*([\+-]?=)\s*(\S.*)$/$1$2$3/ unless s/^!\s*(\S.*)$/!$1/;
|
$RA{$p2}=$p3;
|
||||||
push @options, $_;
|
} elsif ($p1 eq "Host_Alias") {
|
||||||
} elsif (/^(\S+)\s+([^=]+)=\s*(.*)/) {
|
$HA{$p2}=$p3;
|
||||||
# Aliases or Definitions
|
} elsif ($p1 eq "Cmnd_Alias") {
|
||||||
my ($p1,$p2,$p3)=($1,$2,$3);
|
$CA{$p2}=$p3;
|
||||||
$p2=~s/\s+$//; # remove trailing whitespace
|
} else {
|
||||||
$p3=~s/\s+$//; # remove trailing whitespace
|
if (!$did_defaults++){
|
||||||
|
# do this once
|
||||||
if ($p1 eq "User_Alias") {
|
print "dn: cn=defaults,$base\n";
|
||||||
$UA{$p2}=$p3;
|
print "objectClass: top\n";
|
||||||
} elsif ($p1 eq "Runas_Alias") {
|
print "objectClass: sudoRole\n";
|
||||||
$RA{$p2}=$p3;
|
print "cn: defaults\n";
|
||||||
} elsif ($p1 eq "Host_Alias") {
|
print "description: Default sudoOption's go here\n";
|
||||||
$HA{$p2}=$p3;
|
print "sudoOption: $_\n" foreach @options;
|
||||||
} elsif ($p1 eq "Cmnd_Alias") {
|
printf "sudoOrder: %d\n", ++$order;
|
||||||
$CA{$p2}=$p3;
|
print "\n";
|
||||||
|
}
|
||||||
|
# Definition
|
||||||
|
my @users = split(/\s*,\s*/, $p1);
|
||||||
|
my $username = $users[0];
|
||||||
|
if ($seen_users{$username}) {
|
||||||
|
$seen_users{$username} += 1;
|
||||||
|
$username = sprintf("%s_%s", $username, $seen_users{$username});
|
||||||
|
} else {
|
||||||
|
$seen_users{$username} = 1;
|
||||||
|
}
|
||||||
|
my @hosts = split(/\s*,\s*/, $p2);
|
||||||
|
my @cmds = split(/\s*,\s*/, $p3);
|
||||||
|
@options=();
|
||||||
|
undef $notBefore;
|
||||||
|
undef $notAfter;
|
||||||
|
print "dn: cn=$username,$base\n";
|
||||||
|
print "objectClass: top\n";
|
||||||
|
print "objectClass: sudoRole\n";
|
||||||
|
print "cn: $username\n";
|
||||||
|
# will clobber options
|
||||||
|
print "sudoUser: $_\n" foreach expand(\%UA,@users);
|
||||||
|
print "sudoHost: $_\n" foreach expand(\%HA,@hosts);
|
||||||
|
foreach (@cmds) {
|
||||||
|
if (s/^\(([^\)]+)\)\s*//) {
|
||||||
|
my @runas = split(/:\s*/, $1);
|
||||||
|
if (defined($runas[0])) {
|
||||||
|
print "sudoRunAsUser: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[0]));
|
||||||
|
}
|
||||||
|
if (defined($runas[1])) {
|
||||||
|
print "sudoRunAsGroup: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[1]));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
print "sudoCommand: $_\n" foreach expand(\%CA,@cmds);
|
||||||
|
print "sudoNotBefore: $notBefore\n" if defined($notBefore);
|
||||||
|
print "sudoNotAfter: $notAfter\n" if defined($notAfter);
|
||||||
|
print "sudoOption: $_\n" foreach @options;
|
||||||
|
printf "sudoOrder: %d\n", ++$order;
|
||||||
|
print "\n";
|
||||||
|
}
|
||||||
} else {
|
} else {
|
||||||
if (!$did_defaults++){
|
warn "parse error: $line\n";
|
||||||
# do this once
|
|
||||||
print "dn: cn=defaults,$base\n";
|
|
||||||
print "objectClass: top\n";
|
|
||||||
print "objectClass: sudoRole\n";
|
|
||||||
print "cn: defaults\n";
|
|
||||||
print "description: Default sudoOption's go here\n";
|
|
||||||
print "sudoOption: $_\n" foreach @options;
|
|
||||||
printf "sudoOrder: %d\n", ++$order;
|
|
||||||
print "\n";
|
|
||||||
}
|
|
||||||
# Definition
|
|
||||||
my @users=split /\s*,\s*/,$p1;
|
|
||||||
my $username = $users[0];
|
|
||||||
if ($seen_users{$username}) {
|
|
||||||
$seen_users{$username} += 1;
|
|
||||||
$username = sprintf("%s_%s", $username, $seen_users{$username});
|
|
||||||
} else {
|
|
||||||
$seen_users{$username} = 1;
|
|
||||||
}
|
|
||||||
my @hosts=split /\s*,\s*/,$p2;
|
|
||||||
my @cmds= split /\s*,\s*/,$p3;
|
|
||||||
@options=();
|
|
||||||
undef $notBefore;
|
|
||||||
undef $notAfter;
|
|
||||||
print "dn: cn=$username,$base\n";
|
|
||||||
print "objectClass: top\n";
|
|
||||||
print "objectClass: sudoRole\n";
|
|
||||||
print "cn: $username\n";
|
|
||||||
# will clobber options
|
|
||||||
print "sudoUser: $_\n" foreach expand(\%UA,@users);
|
|
||||||
print "sudoHost: $_\n" foreach expand(\%HA,@hosts);
|
|
||||||
foreach (@cmds) {
|
|
||||||
if (s/^\(([^\)]+)\)\s*//) {
|
|
||||||
my @runas = split(/:\s*/, $1);
|
|
||||||
if (defined($runas[0])) {
|
|
||||||
print "sudoRunAsUser: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[0]));
|
|
||||||
}
|
|
||||||
if (defined($runas[1])) {
|
|
||||||
print "sudoRunAsGroup: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[1]));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
print "sudoCommand: $_\n" foreach expand(\%CA,@cmds);
|
|
||||||
print "sudoNotBefore: $notBefore\n" if defined($notBefore);
|
|
||||||
print "sudoNotAfter: $notAfter\n" if defined($notAfter);
|
|
||||||
print "sudoOption: $_\n" foreach @options;
|
|
||||||
printf "sudoOrder: %d\n", ++$order;
|
|
||||||
print "\n";
|
|
||||||
}
|
}
|
||||||
} else {
|
|
||||||
print "parse error: $_\n";
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
#
|
# Recursively expand hash elements
|
||||||
# recursively expand hash elements
|
sub expand {
|
||||||
sub expand{
|
my $ref=shift;
|
||||||
my $ref=shift;
|
my @a=();
|
||||||
my @a=();
|
|
||||||
|
|
||||||
# preen the line a little
|
# preen the line a little
|
||||||
foreach (@_){
|
foreach (@_) {
|
||||||
# Convert upper case command options
|
# Convert upper case command options
|
||||||
s/TIMEOUT=(\S+)\s*// && push @options,"timeout=$1";
|
s/TIMEOUT=(\S+)\s*// && push @options,"timeout=$1";
|
||||||
s/ROLE=(\S+)\s*// && push @options,"role=$1";
|
s/ROLE=(\S+)\s*// && push @options,"role=$1";
|
||||||
s/TYPE=(\S+)\s*// && push @options,"type=$1";
|
s/TYPE=(\S+)\s*// && push @options,"type=$1";
|
||||||
s/PRIVS=(\S+)\s*// && push @options,"privs=$1";
|
s/PRIVS=(\S+)\s*// && push @options,"privs=$1";
|
||||||
s/LIMITPRIVS=(\S+)\s*// && push @options,"limitprivs=$1";
|
s/LIMITPRIVS=(\S+)\s*// && push @options,"limitprivs=$1";
|
||||||
s/NOTBEFORE=(\S+)\s*// && do { $notBefore=$1 };
|
s/NOTBEFORE=(\S+)\s*// && do { $notBefore=$1 };
|
||||||
s/NOTAFTER=(\S+)\s*// && do { $notAfter=$1 };
|
s/NOTAFTER=(\S+)\s*// && do { $notAfter=$1 };
|
||||||
|
|
||||||
# Convert command tags to options
|
# Convert command tags to options
|
||||||
s/NOPASSWD:\s*// && push @options,"!authenticate";
|
s/NOPASSWD:\s*// && push @options,"!authenticate";
|
||||||
s/PASSWD:\s*// && push @options,"authenticate";
|
s/PASSWD:\s*// && push @options,"authenticate";
|
||||||
s/NOEXEC:\s*// && push @options,"noexec";
|
s/NOEXEC:\s*// && push @options,"noexec";
|
||||||
s/EXEC:\s*// && push @options,"!noexec";
|
s/EXEC:\s*// && push @options,"!noexec";
|
||||||
s/SETENV:\s*// && push @options,"setenv";
|
s/SETENV:\s*// && push @options,"setenv";
|
||||||
s/NOSETENV:\s*// && push @options,"!setenv";
|
s/NOSETENV:\s*// && push @options,"!setenv";
|
||||||
s/LOG_INPUT:\s*// && push @options,"log_input";
|
s/LOG_INPUT:\s*// && push @options,"log_input";
|
||||||
s/NOLOG_INPUT:\s*// && push @options,"!log_input";
|
s/NOLOG_INPUT:\s*// && push @options,"!log_input";
|
||||||
s/LOG_OUTPUT:\s*// && push @options,"log_output";
|
s/LOG_OUTPUT:\s*// && push @options,"log_output";
|
||||||
s/NOLOG_OUTPUT:\s*// && push @options,"!log_output";
|
s/NOLOG_OUTPUT:\s*// && push @options,"!log_output";
|
||||||
s/[[:upper:]]+://; # silently remove other tags
|
s/[[:upper:]]+://; # silently remove other tags
|
||||||
s/\s+$//; # right trim
|
s/\s+$//; # right trim
|
||||||
}
|
}
|
||||||
|
|
||||||
# do the expanding
|
# do the expanding
|
||||||
push @a,$ref->{$_} ? expand($ref,split /\s*,\s*/,$ref->{$_}):$_ foreach @_;
|
push @a,$ref->{$_} ? expand($ref,split /\s*,\s*/,$ref->{$_}):$_ foreach @_;
|
||||||
@a;
|
@a;
|
||||||
|
}
|
||||||
|
|
||||||
|
# Parse sudoers, expanding #include and #includedir directives
|
||||||
|
sub scan_sudoers_fh {
|
||||||
|
my ($filehandle, $callback) = @_;
|
||||||
|
|
||||||
|
while (<$filehandle>) {
|
||||||
|
if (/^#include\s+(.+?)\s*$/){
|
||||||
|
scan_sudoers_filename($1, 0, $callback);
|
||||||
|
} elsif (/^#includedir\s+(.+?)\s*$/){
|
||||||
|
scan_sudoers_dirname($1, $callback);
|
||||||
|
} else {
|
||||||
|
$callback->($_);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Read from #include file
|
||||||
|
sub scan_sudoers_filename {
|
||||||
|
my ($filename, $quiet, $callback) = @_;
|
||||||
|
|
||||||
|
# Keep track of the parent dir of sudoers for relative includes
|
||||||
|
if ($filename =~ m:^(/.*/):) {
|
||||||
|
push(@sudoersdirs, $1);
|
||||||
|
} elsif ($#sudoersdirs != -1) {
|
||||||
|
$filename = $sudoersdirs[$#sudoersdirs] . "/$filename";
|
||||||
|
push(@sudoersdirs, $sudoersdirs[$#sudoersdirs]);
|
||||||
|
}
|
||||||
|
if (open(my $fh, '<', $filename)) {
|
||||||
|
scan_sudoers_fh($fh, $callback);
|
||||||
|
} else {
|
||||||
|
warn "unable to open $filename: $!\n" unless $quiet;
|
||||||
|
}
|
||||||
|
pop(@sudoersdirs) unless $#sudoersdirs == -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
# Read from #includedir directory
|
||||||
|
sub scan_sudoers_dirname {
|
||||||
|
my ($dirname, $callback) = @_;
|
||||||
|
|
||||||
|
# Ignore a missing include dir
|
||||||
|
if (opendir(my $dh, $dirname)) {
|
||||||
|
while (readdir $dh) {
|
||||||
|
# Ignore files that end in '~' or have a '.' in them
|
||||||
|
next if /\./ || /~$/;
|
||||||
|
scan_sudoers_filename("$dirname/$_", 1, $callback);
|
||||||
|
}
|
||||||
|
closedir($dh);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Returns a sub that reads lines until continuations,
|
||||||
|
# then it invokes the callback to do the parsing
|
||||||
|
sub make_continuation_handler {
|
||||||
|
my ($callback) = @_;
|
||||||
|
|
||||||
|
my $buffer = '';
|
||||||
|
return sub {
|
||||||
|
my ($line) = @_;
|
||||||
|
|
||||||
|
if ($line =~ s/\\\s*$//) {
|
||||||
|
# line continuation
|
||||||
|
$buffer .= $line;
|
||||||
|
} else {
|
||||||
|
# parse buffer
|
||||||
|
$callback->($buffer . $line);
|
||||||
|
# empty buffer
|
||||||
|
$buffer='';
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
my $parser_cb = make_continuation_handler(\&parse_sudoers_line);
|
||||||
|
if (@ARGV) {
|
||||||
|
scan_sudoers_filename($_, 0, $parser_cb) for @ARGV;
|
||||||
|
} else {
|
||||||
|
scan_sudoers_fh(\*STDIN, $parser_cb);
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user