isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move LOGIN_PATH and LOGIN_SETENV handling to plugin now that we

Browse Source 
hook setenv.
This commit is contained in:
Todd C. Miller
2012-03-07 16:38:57 -05:00
parent 37770ecf1e
commit d4a3a5d8b9
2 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
plugins/sudoers/sudoers.c
View File

@@ -70,6 +70,9 @@
# ifndef LOGIN_DEFROOTCLASS # ifndef LOGIN_DEFROOTCLASS
# define LOGIN_DEFROOTCLASS "daemon" # define LOGIN_DEFROOTCLASS "daemon"
# endif # endif
# ifndef LOGIN_SETENV
# define LOGIN_SETENV 0
# endif
#endif #endif
#ifdef HAVE_SELINUX #ifdef HAVE_SELINUX
# include <selinux/selinux.h> # include <selinux/selinux.h>
@@ -595,6 +598,16 @@ sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
/* Insert system-wide environment variables. */ /* Insert system-wide environment variables. */
read_env_file(_PATH_ENVIRONMENT, true); read_env_file(_PATH_ENVIRONMENT, true);
#endif #endif
#ifdef HAVE_LOGIN_CAP_H
/* Set environment based on login class. */
if (login_class) {
login_cap_t *lc = login_getclass(login_class);
if (lc != NULL) {
setusercontext(lc, runas_pw, runas_pw->pw_uid, LOGIN_SETPATH|LOGIN_SETENV);
login_close(lc);
}
}
#endif /* HAVE_LOGIN_CAP_H */
} }
/* Insert system-wide environment variables. */ /* Insert system-wide environment variables. */

8
src/sudo.c
View File

@@ -63,6 +63,9 @@
#endif #endif
#ifdef HAVE_LOGIN_CAP_H #ifdef HAVE_LOGIN_CAP_H
# include <login_cap.h> # include <login_cap.h>
# ifndef LOGIN_SETENV
# define LOGIN_SETENV 0
# endif
#endif #endif
#ifdef HAVE_PROJECT_H #ifdef HAVE_PROJECT_H
# include <project.h> # include <project.h>
@@ -846,8 +849,7 @@ exec_setup(struct command_details *details, const char *ptyname, int ptyfd)
/* /*
* Swap in the plugin-supplied environment in case session init * Swap in the plugin-supplied environment in case session init
* modifies the environment. Also needed for LOGIN_SETENV. * modifies the environment. This is kind of a hack.
* This is kind of a hack.
*/ */
environ = details->envp; environ = details->envp;
@@ -891,7 +893,7 @@ exec_setup(struct command_details *details, const char *ptyname, int ptyfd)
if (ISSET(sudo_mode, MODE_LOGIN_SHELL)) { if (ISSET(sudo_mode, MODE_LOGIN_SHELL)) {
/* Set everything except user, group and login name. */ /* Set everything except user, group and login name. */
flags = LOGIN_SETALL; flags = LOGIN_SETALL;
CLR(flags, LOGIN_SETGROUP|LOGIN_SETLOGIN|LOGIN_SETUSER); CLR(flags, LOGIN_SETGROUP|LOGIN_SETLOGIN|LOGIN_SETUSER|LOGIN_SETENV|LOGIN_SETPATH);
CLR(details->flags, CD_SET_UMASK); /* LOGIN_UMASK instead */ CLR(details->flags, CD_SET_UMASK); /* LOGIN_UMASK instead */
} else { } else {
flags = LOGIN_SETRESOURCES|LOGIN_SETPRIORITY; flags = LOGIN_SETRESOURCES|LOGIN_SETPRIORITY;