isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Call log_allowed() even when "log_allowed" is disabled.

Browse Source 
Otherwise, sudo will not send mail if "mail_always" or "mail_all_cmnds"
is set.
This commit is contained in:
Todd C. Miller
2023-08-25 11:19:42 -06:00
parent 4cdee2e312
commit b42cab112f
1 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
plugins/sudoers/audit.c
View File

@@ -353,19 +353,30 @@ sudoers_audit_accept(const char *plugin_name, unsigned int plugin_type,
if (plugin_type != SUDO_FRONT_END) if (plugin_type != SUDO_FRONT_END)
debug_return_int(true); debug_return_int(true);
if (!def_log_allowed) /* Log sub-commands with the uuid of the original command. */
debug_return_int(true);
if (audit_success(ctx, run_argv) != 0 && !def_ignore_audit_errors)
ret = false;
if (!ISSET(ctx->mode, MODE_POLICY_INTERCEPTED)) if (!ISSET(ctx->mode, MODE_POLICY_INTERCEPTED))
uuid_str = ctx->uuid_str; uuid_str = ctx->uuid_str;
/*
* We must always call log_allowed() even if def_log_allowed is disabled
* since it will send mail if def_mail_always or def_mail_all_cmnds are
* set (it has its own checks for def_log_allowed).
*/
audit_to_eventlog(ctx, &evlog, command_info, run_argv, run_envp, uuid_str); audit_to_eventlog(ctx, &evlog, command_info, run_argv, run_envp, uuid_str);
if (!log_allowed(ctx, &evlog) && !def_ignore_logfile_errors) if (!log_allowed(ctx, &evlog) && !def_ignore_logfile_errors)
ret = false; ret = false;
/*
* Skip auditing and log server logging if "log_allowed" is disabled.
*/
if (!def_log_allowed)
goto done;
if (audit_success(ctx, run_argv) != 0) {
if (!def_ignore_logfile_errors)
ret = false;
}
if (!log_server_accept(ctx, &evlog)) { if (!log_server_accept(ctx, &evlog)) {
if (!def_ignore_logfile_errors) if (!def_ignore_logfile_errors)
ret = false; ret = false;
@@ -382,6 +393,7 @@ sudoers_audit_accept(const char *plugin_name, unsigned int plugin_type,
first = false; first = false;
} }
done:
debug_return_int(ret); debug_return_int(ret);
} }