isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add sudoedit flag checks in plugin that are consistent with front-end.

Browse Source 
Don't assume the sudo front-end is sending reasonable mode flags.
These checks need to be kept consistent between the sudo front-end
and the sudoers plugin.
This commit is contained in:
Todd C. Miller
2021-01-23 08:43:59 -07:00
parent b301b46b79
commit c4d384082f
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
plugins/sudoers/policy.c
View File

@@ -88,10 +88,11 @@ parse_bool(const char *line, int varlen, int *flags, int fval)
int int
sudoers_policy_deserialize_info(void *v) sudoers_policy_deserialize_info(void *v)
{ {
const int edit_mask = MODE_EDIT|MODE_IGNORE_TICKET|MODE_NONINTERACTIVE;
struct sudoers_open_info *info = v; struct sudoers_open_info *info = v;
char * const *cur;
const char *p, *errstr, *groups = NULL; const char *p, *errstr, *groups = NULL;
const char *remhost = NULL; const char *remhost = NULL;
char * const *cur;
int flags = 0; int flags = 0;
debug_decl(sudoers_policy_deserialize_info, SUDOERS_DEBUG_PLUGIN); debug_decl(sudoers_policy_deserialize_info, SUDOERS_DEBUG_PLUGIN);
@@ -348,6 +349,12 @@ sudoers_policy_deserialize_info(void *v)
#endif #endif
} }
/* Sudo front-end should restrict mode flags for sudoedit. */
if (ISSET(flags, MODE_EDIT) && (flags & edit_mask) != flags) {
sudo_warnx(U_("invalid mode flags from sudo front end: 0x%x"), flags);
goto bad;
}
user_gid = (gid_t)-1; user_gid = (gid_t)-1;
user_sid = (pid_t)-1; user_sid = (pid_t)-1;
user_uid = (gid_t)-1; user_uid = (gid_t)-1;