isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Define LDAPNOINIT before calling ldap_init(), etc. to disable user

Browse Source 
ldaprc and system defaults that could affect how LDAP works.
This commit is contained in:
Todd C. Miller
2008-01-01 19:01:42 +00:00
parent 6f2cd1b184
commit cd30e84743
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
env.c
View File

@@ -261,7 +261,7 @@ _sudo_setenv(var, val, dupcheck)
insert_env(estring, dupcheck, FALSE); insert_env(estring, dupcheck, FALSE);
} }
#if defined(HAVE_LDAP_SASL_INTERACTIVE_BIND_S) && !defined(HAVE_GSS_KRB5_CCACHE_NAME) #ifdef HAVE_LDAP
/* /*
* External version of sudo_setenv() that keeps things in sync with * External version of sudo_setenv() that keeps things in sync with
* the environ pointer. * the environ pointer.
@@ -318,7 +318,7 @@ sudo_unsetenv(var)
} }
} }
} }
#endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S && !HAVE_GSS_KRB5_CCACHE_NAME */ #endif /* HAVE_LDAP */
/* /*
* Insert str into env.envp, assumes str has an '=' in it. * Insert str into env.envp, assumes str has an '=' in it.

11
ldap.c
View File

@@ -1150,7 +1150,7 @@ sudo_ldap_open(nss)
{ {
LDAP *ld; LDAP *ld;
const char *old_ccname = user_ccname; const char *old_ccname = user_ccname;
int rc; int rc, ldapnoinit = FALSE;
#ifdef HAVE_GSS_KRB5_CCACHE_NAME #ifdef HAVE_GSS_KRB5_CCACHE_NAME
unsigned int status; unsigned int status;
#endif #endif
@@ -1158,6 +1158,12 @@ sudo_ldap_open(nss)
if (!sudo_ldap_read_config()) if (!sudo_ldap_read_config())
return(-1); return(-1);
/* Prevent reading of user ldaprc and system defaults. */
if (getenv("LDAPNOINIT") == NULL) {
ldapnoinit = TRUE;
sudo_setenv("LDAPNOINIT", "1", TRUE);
}
#ifdef HAVE_LDAPSSL_INIT #ifdef HAVE_LDAPSSL_INIT
if (ldap_conf.ssl_mode == SUDO_LDAP_SSL) { if (ldap_conf.ssl_mode == SUDO_LDAP_SSL) {
DPRINTF(("ldapssl_clientauth_init(%s, %s)", DPRINTF(("ldapssl_clientauth_init(%s, %s)",
@@ -1200,6 +1206,9 @@ sudo_ldap_open(nss)
} }
} }
if (ldapnoinit)
sudo_unsetenv("LDAPNOINIT");
/* Set LDAP options */ /* Set LDAP options */
if (sudo_ldap_set_options(ld) < 0) if (sudo_ldap_set_options(ld) < 0)
return(-1); return(-1);