isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move log_denial() calls and logic to log_failure().

Browse Source 
Move authentication failure logging to log_auth_failure().
Both of these call audit_failure() for us.

This subtly changes logging for commands that are denied by sudoers
but where the user failed to enter the correct password.  Previously,
these would be logged as "N incorrect password attempts" but now
are logged as "command not allowed".  Fixes bug #563
This commit is contained in:
Todd C. Miller
2012-07-10 12:42:33 -04:00
parent 9c9cf9da41
commit 8b03f3e7d0
6 changed files with 147 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
plugins/sudoers/sudoers.h
View File

@@ -104,6 +104,9 @@ struct sudo_user {
#define FLAG_NO_USER 0x020
#define FLAG_NO_HOST 0x040
#define FLAG_NO_CHECK 0x080
#define FLAG_NON_INTERACTIVE 0x100
#define FLAG_BAD_PASSWORD 0x200
#define FLAG_AUTH_ERROR 0x400
/*
* find_path()/load_cmnd() return values
@@ -219,7 +222,7 @@ void remove_timestamp(bool);
bool user_is_exempt(void);
/* sudo_auth.c */
int verify_user(struct passwd *pw, char *prompt);
int verify_user(struct passwd *pw, char *prompt, int validated);
int sudo_auth_begin_session(struct passwd *pw, char **user_env[]);
int sudo_auth_end_session(struct passwd *pw);
int sudo_auth_init(struct passwd *pw);