isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

If sudo.conf contains an I/O plugin but no policy plugin, use sudoers

Browse Source 
for the policy plugin.  If a policy plugin is specified without an
I/O plugin, only the policy plugin will be loaded.
This commit is contained in:
Todd C. Miller
2012-08-09 14:11:41 -04:00
parent 9ad4d48046
commit a7424cc002
2 changed files with 126 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
common/sudo_conf.c
View File

@@ -292,7 +292,6 @@ void
sudo_conf_read(void) sudo_conf_read(void)
{ {
struct sudo_conf_table *cur; struct sudo_conf_table *cur;
struct plugin_info *info;
struct stat sb; struct stat sb;
FILE *fp; FILE *fp;
char *cp; char *cp;
@@ -346,25 +345,6 @@ sudo_conf_read(void)
} }
} }
fclose(fp); fclose(fp);
done: done:
if (tq_empty(&sudo_conf_data.plugins)) { return;
/* Default policy plugin */
info = ecalloc(1, sizeof(*info));
info->symbol_name = "sudoers_policy";
info->path = SUDOERS_PLUGIN;
/* info->options = NULL; */
info->prev = info;
/* info->next = NULL; */
tq_append(&sudo_conf_data.plugins, info);
/* Default I/O plugin */
info = ecalloc(1, sizeof(*info));
info->symbol_name = "sudoers_io";
info->path = SUDOERS_PLUGIN;
/* info->options = NULL; */
info->prev = info;
/* info->next = NULL; */
tq_append(&sudo_conf_data.plugins, info);
}
} }

204
src/load_plugins.c
View File

@@ -54,6 +54,96 @@
# define RTLD_GLOBAL 0 # define RTLD_GLOBAL 0
#endif #endif
/*
* Load the plugin specified by "info".
*/
static bool
sudo_load_plugin(struct plugin_container *policy_plugin,
struct plugin_container_list *io_plugins, struct plugin_info *info)
{
struct plugin_container *container;
struct generic_plugin *plugin;
struct stat sb;
void *handle;
char path[PATH_MAX];
bool rval = false;
debug_decl(sudo_load_plugin, SUDO_DEBUG_PLUGIN)
if (info->path[0] == '/') {
if (strlcpy(path, info->path, sizeof(path)) >= sizeof(path)) {
warningx(_("%s: %s"), info->path, strerror(ENAMETOOLONG));
goto done;
}
} else {
if (snprintf(path, sizeof(path), "%s%s", _PATH_SUDO_PLUGIN_DIR,
info->path) >= sizeof(path)) {
warningx(_("%s%s: %s"), _PATH_SUDO_PLUGIN_DIR, info->path,
strerror(ENAMETOOLONG));
goto done;
}
}
if (stat(path, &sb) != 0) {
warning("%s", path);
goto done;
}
if (sb.st_uid != ROOT_UID) {
warningx(_("%s must be owned by uid %d"), path, ROOT_UID);
goto done;
}
if ((sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
warningx(_("%s must be only be writable by owner"), path);
goto done;
}
/* Open plugin and map in symbol */
handle = dlopen(path, RTLD_LAZY|RTLD_GLOBAL);
if (!handle) {
warningx(_("unable to dlopen %s: %s"), path, dlerror());
goto done;
}
plugin = dlsym(handle, info->symbol_name);
if (!plugin) {
warningx(_("%s: unable to find symbol %s"), path,
info->symbol_name);
goto done;
}
if (plugin->type != SUDO_POLICY_PLUGIN && plugin->type != SUDO_IO_PLUGIN) {
warningx(_("%s: unknown policy type %d"), path, plugin->type);
goto done;
}
if (SUDO_API_VERSION_GET_MAJOR(plugin->version) != SUDO_API_VERSION_MAJOR) {
warningx(_("%s: incompatible policy major version %d, expected %d"),
path, SUDO_API_VERSION_GET_MAJOR(plugin->version),
SUDO_API_VERSION_MAJOR);
goto done;
}
if (plugin->type == SUDO_POLICY_PLUGIN) {
if (policy_plugin->handle) {
warningx(_("%s: only a single policy plugin may be loaded"),
_PATH_SUDO_CONF);
goto done;
}
policy_plugin->handle = handle;
policy_plugin->name = info->symbol_name;
policy_plugin->options = info->options;
policy_plugin->u.generic = plugin;
} else if (plugin->type == SUDO_IO_PLUGIN) {
container = ecalloc(1, sizeof(*container));
container->prev = container;
/* container->next = NULL; */
container->handle = handle;
container->name = info->symbol_name;
container->options = info->options;
container->u.generic = plugin;
tq_append(io_plugins, container);
}
rval = true;
done:
debug_return_bool(rval);
}
/* /*
* Load the plugins listed in sudo.conf. * Load the plugins listed in sudo.conf.
*/ */
@@ -61,97 +151,55 @@ bool
sudo_load_plugins(struct plugin_container *policy_plugin, sudo_load_plugins(struct plugin_container *policy_plugin,
struct plugin_container_list *io_plugins) struct plugin_container_list *io_plugins)
{ {
struct plugin_info_list *plugins;
struct generic_plugin *plugin;
struct plugin_container *container; struct plugin_container *container;
struct plugin_info_list *plugins;
struct plugin_info *info; struct plugin_info *info;
struct stat sb;
void *handle;
char path[PATH_MAX];
bool rval = false; bool rval = false;
debug_decl(sudo_load_plugins, SUDO_DEBUG_PLUGIN) debug_decl(sudo_load_plugins, SUDO_DEBUG_PLUGIN)
/* Walk plugin list. */ /* Walk the plugin list from sudo.conf, if any. */
plugins = sudo_conf_plugins(); plugins = sudo_conf_plugins();
tq_foreach_fwd(plugins, info) { tq_foreach_fwd(plugins, info) {
if (info->path[0] == '/') { rval = sudo_load_plugin(policy_plugin, io_plugins, info);
if (strlcpy(path, info->path, sizeof(path)) >= sizeof(path)) { if (!rval)
warningx(_("%s: %s"), info->path, strerror(ENAMETOOLONG));
goto done;
}
} else {
if (snprintf(path, sizeof(path), "%s%s", _PATH_SUDO_PLUGIN_DIR,
info->path) >= sizeof(path)) {
warningx(_("%s%s: %s"), _PATH_SUDO_PLUGIN_DIR, info->path,
strerror(ENAMETOOLONG));
goto done;
}
}
if (stat(path, &sb) != 0) {
warning("%s", path);
goto done; goto done;
}
if (sb.st_uid != ROOT_UID) {
warningx(_("%s must be owned by uid %d"), path, ROOT_UID);
goto done;
}
if ((sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
warningx(_("%s must be only be writable by owner"), path);
goto done;
}
/* Open plugin and map in symbol */
handle = dlopen(path, RTLD_LAZY|RTLD_GLOBAL);
if (!handle) {
warningx(_("unable to dlopen %s: %s"), path, dlerror());
goto done;
}
plugin = dlsym(handle, info->symbol_name);
if (!plugin) {
warningx(_("%s: unable to find symbol %s"), path,
info->symbol_name);
goto done;
}
if (plugin->type != SUDO_POLICY_PLUGIN && plugin->type != SUDO_IO_PLUGIN) {
warningx(_("%s: unknown policy type %d"), path, plugin->type);
goto done;
}
if (SUDO_API_VERSION_GET_MAJOR(plugin->version) != SUDO_API_VERSION_MAJOR) {
warningx(_("%s: incompatible policy major version %d, expected %d"),
path, SUDO_API_VERSION_GET_MAJOR(plugin->version),
SUDO_API_VERSION_MAJOR);
goto done;
}
if (plugin->type == SUDO_POLICY_PLUGIN) {
if (policy_plugin->handle) {
warningx(_("%s: only a single policy plugin may be loaded"),
_PATH_SUDO_CONF);
goto done;
}
policy_plugin->handle = handle;
policy_plugin->name = info->symbol_name;
policy_plugin->options = info->options;
policy_plugin->u.generic = plugin;
} else if (plugin->type == SUDO_IO_PLUGIN) {
container = ecalloc(1, sizeof(*container));
container->prev = container;
/* container->next = NULL; */
container->handle = handle;
container->name = info->symbol_name;
container->options = info->options;
container->u.generic = plugin;
tq_append(io_plugins, container);
}
} }
/*
* If no policy plugin, fall back to the default (sudoers).
* If there is also no I/O log plugin, sudoers for that too.
*/
if (policy_plugin->handle == NULL) { if (policy_plugin->handle == NULL) {
warningx(_("%s: at least one policy plugin must be specified"), /* Default policy plugin */
_PATH_SUDO_CONF); info = ecalloc(1, sizeof(*info));
goto done; info->symbol_name = "sudoers_policy";
info->path = SUDOERS_PLUGIN;
/* info->options = NULL; */
info->prev = info;
/* info->next = NULL; */
rval = sudo_load_plugin(policy_plugin, io_plugins, info);
efree(info);
if (!rval)
goto done;
/* Default I/O plugin */
if (tq_empty(io_plugins)) {
info = ecalloc(1, sizeof(*info));
info->symbol_name = "sudoers_io";
info->path = SUDOERS_PLUGIN;
/* info->options = NULL; */
info->prev = info;
/* info->next = NULL; */
rval = sudo_load_plugin(policy_plugin, io_plugins, info);
efree(info);
if (!rval)
goto done;
}
} }
if (policy_plugin->u.policy->check_policy == NULL) { if (policy_plugin->u.policy->check_policy == NULL) {
warningx(_("policy plugin %s does not include a check_policy method"), warningx(_("policy plugin %s does not include a check_policy method"),
policy_plugin->name); policy_plugin->name);
rval = false;
goto done; goto done;
} }
@@ -165,8 +213,6 @@ sudo_load_plugins(struct plugin_container *policy_plugin,
} }
} }
rval = true;
done: done:
debug_return_bool(rval); debug_return_bool(rval);
} }