isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

If sudo.conf contains an I/O plugin but no policy plugin, use sudoers

Browse Source 
for the policy plugin.  If a policy plugin is specified without an
I/O plugin, only the policy plugin will be loaded.
This commit is contained in:
Todd C. Miller
2012-08-09 14:11:41 -04:00
parent 9ad4d48046
commit a7424cc002
2 changed files with 126 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
common/sudo_conf.c
View File

@@ -292,7 +292,6 @@ void
sudo_conf_read(void) sudo_conf_read(void)
{ {
struct sudo_conf_table *cur; struct sudo_conf_table *cur;
struct plugin_info *info;
struct stat sb; struct stat sb;
FILE *fp; FILE *fp;
char *cp; char *cp;
@@ -346,25 +345,6 @@ sudo_conf_read(void)
} }
} }
fclose(fp); fclose(fp);
done: done:
if (tq_empty(&sudo_conf_data.plugins)) { return;
/* Default policy plugin */
info = ecalloc(1, sizeof(*info));
info->symbol_name = "sudoers_policy";
info->path = SUDOERS_PLUGIN;
/* info->options = NULL; */
info->prev = info;
/* info->next = NULL; */
tq_append(&sudo_conf_data.plugins, info);
/* Default I/O plugin */
info = ecalloc(1, sizeof(*info));
info->symbol_name = "sudoers_io";
info->path = SUDOERS_PLUGIN;
/* info->options = NULL; */
info->prev = info;
/* info->next = NULL; */
tq_append(&sudo_conf_data.plugins, info);
}
} }

80
src/load_plugins.c
View File

@@ -55,25 +55,20 @@
#endif #endif
/* /*
* Load the plugins listed in sudo.conf. * Load the plugin specified by "info".
*/ */
bool static bool
sudo_load_plugins(struct plugin_container *policy_plugin, sudo_load_plugin(struct plugin_container *policy_plugin,
struct plugin_container_list *io_plugins) struct plugin_container_list *io_plugins, struct plugin_info *info)
{ {
struct plugin_info_list *plugins;
struct generic_plugin *plugin;
struct plugin_container *container; struct plugin_container *container;
struct plugin_info *info; struct generic_plugin *plugin;
struct stat sb; struct stat sb;
void *handle; void *handle;
char path[PATH_MAX]; char path[PATH_MAX];
bool rval = false; bool rval = false;
debug_decl(sudo_load_plugins, SUDO_DEBUG_PLUGIN) debug_decl(sudo_load_plugin, SUDO_DEBUG_PLUGIN)
/* Walk plugin list. */
plugins = sudo_conf_plugins();
tq_foreach_fwd(plugins, info) {
if (info->path[0] == '/') { if (info->path[0] == '/') {
if (strlcpy(path, info->path, sizeof(path)) >= sizeof(path)) { if (strlcpy(path, info->path, sizeof(path)) >= sizeof(path)) {
warningx(_("%s: %s"), info->path, strerror(ENAMETOOLONG)); warningx(_("%s: %s"), info->path, strerror(ENAMETOOLONG));
@@ -143,15 +138,68 @@ sudo_load_plugins(struct plugin_container *policy_plugin,
container->u.generic = plugin; container->u.generic = plugin;
tq_append(io_plugins, container); tq_append(io_plugins, container);
} }
}
if (policy_plugin->handle == NULL) { rval = true;
warningx(_("%s: at least one policy plugin must be specified"), done:
_PATH_SUDO_CONF); debug_return_bool(rval);
}
/*
* Load the plugins listed in sudo.conf.
*/
bool
sudo_load_plugins(struct plugin_container *policy_plugin,
struct plugin_container_list *io_plugins)
{
struct plugin_container *container;
struct plugin_info_list *plugins;
struct plugin_info *info;
bool rval = false;
debug_decl(sudo_load_plugins, SUDO_DEBUG_PLUGIN)
/* Walk the plugin list from sudo.conf, if any. */
plugins = sudo_conf_plugins();
tq_foreach_fwd(plugins, info) {
rval = sudo_load_plugin(policy_plugin, io_plugins, info);
if (!rval)
goto done; goto done;
} }
/*
* If no policy plugin, fall back to the default (sudoers).
* If there is also no I/O log plugin, sudoers for that too.
*/
if (policy_plugin->handle == NULL) {
/* Default policy plugin */
info = ecalloc(1, sizeof(*info));
info->symbol_name = "sudoers_policy";
info->path = SUDOERS_PLUGIN;
/* info->options = NULL; */
info->prev = info;
/* info->next = NULL; */
rval = sudo_load_plugin(policy_plugin, io_plugins, info);
efree(info);
if (!rval)
goto done;
/* Default I/O plugin */
if (tq_empty(io_plugins)) {
info = ecalloc(1, sizeof(*info));
info->symbol_name = "sudoers_io";
info->path = SUDOERS_PLUGIN;
/* info->options = NULL; */
info->prev = info;
/* info->next = NULL; */
rval = sudo_load_plugin(policy_plugin, io_plugins, info);
efree(info);
if (!rval)
goto done;
}
}
if (policy_plugin->u.policy->check_policy == NULL) { if (policy_plugin->u.policy->check_policy == NULL) {
warningx(_("policy plugin %s does not include a check_policy method"), warningx(_("policy plugin %s does not include a check_policy method"),
policy_plugin->name); policy_plugin->name);
rval = false;
goto done; goto done;
} }
@@ -165,8 +213,6 @@ sudo_load_plugins(struct plugin_container *policy_plugin,
} }
} }
rval = true;
done: done:
debug_return_bool(rval); debug_return_bool(rval);
} }