isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Simpler change to retry sudo_secure_file() as root as needed.

Browse Source
This commit is contained in:
Todd C. Miller
2019-07-14 19:37:33 -06:00
parent cecf69ff3c
commit c49760e55d
1 changed files with 7 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
plugins/sudoers/sudoers.c
View File

@@ -879,19 +879,12 @@ open_sudoers(const char *sudoers, bool doedit, bool *keepopen)
{ {
struct stat sb; struct stat sb;
FILE *fp = NULL; FILE *fp = NULL;
bool asroot = true; bool perm_root = false;
debug_decl(open_sudoers, SUDOERS_DEBUG_PLUGIN) debug_decl(open_sudoers, SUDOERS_DEBUG_PLUGIN)
if (!set_perms(PERM_SUDOERS)) if (!set_perms(PERM_SUDOERS))
debug_return_ptr(NULL); debug_return_ptr(NULL);
/*
* If sudoers_uid == ROOT_UID and sudoers_mode is group readable
* set_perms() will use a non-zero uid in order to avoid NFS issues..
*/
if (sudoers_uid != ROOT_UID || ISSET(sudoers_mode, S_IRGRP))
asroot = false;
again: again:
switch (sudo_secure_file(sudoers, sudoers_uid, sudoers_gid, &sb)) { switch (sudo_secure_file(sudoers, sudoers_uid, sudoers_gid, &sb)) {
case SUDO_PATH_SECURE: case SUDO_PATH_SECURE:
@@ -902,8 +895,10 @@ again:
*/ */
if (sudoers_uid == ROOT_UID && ISSET(sudoers_mode, S_IRGRP)) { if (sudoers_uid == ROOT_UID && ISSET(sudoers_mode, S_IRGRP)) {
if (!ISSET(sb.st_mode, S_IRGRP) || sb.st_gid != SUDOERS_GID) { if (!ISSET(sb.st_mode, S_IRGRP) || sb.st_gid != SUDOERS_GID) {
if (!restore_perms() || !set_perms(PERM_ROOT)) if (!perm_root) {
debug_return_ptr(NULL); if (!restore_perms() || !set_perms(PERM_ROOT))
debug_return_ptr(NULL);
}
} }
} }
/* /*
@@ -930,12 +925,12 @@ again:
* If we tried to stat() sudoers as non-root but got EACCES, * If we tried to stat() sudoers as non-root but got EACCES,
* try again as root. * try again as root.
*/ */
if (errno == EACCES && !asroot) { if (errno == EACCES && geteuid() != ROOT_UID) {
int serrno = errno; int serrno = errno;
if (restore_perms()) { if (restore_perms()) {
if (!set_perms(PERM_ROOT)) if (!set_perms(PERM_ROOT))
debug_return_ptr(NULL); debug_return_ptr(NULL);
asroot = true; perm_root = true;
goto again; goto again;
} }
errno = serrno; errno = serrno;