isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix "sudo -l command args", broken in sudo 1.9.13.

Browse Source 
The value of user_args should not contain the command to be run in
"sudo -l command args", only the arguments of the command being checked.
This restores the pre-1.9.13 behavior.  GitHub issue #249
This commit is contained in:
Todd C. Miller
2023-03-03 11:12:18 -07:00
parent b013711e48
commit d9e9307d98
3 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
plugins/sudoers/logging.c
View File

@@ -322,9 +322,9 @@ log_denial(int status, bool inform_user)
"sudo on %s.\n"), user_name, user_srunhost); "sudo on %s.\n"), user_name, user_srunhost);
} else { } else {
sudo_printf(SUDO_CONV_ERROR_MSG, _("Sorry, user %s is not allowed " sudo_printf(SUDO_CONV_ERROR_MSG, _("Sorry, user %s is not allowed "
"to execute '%s%s%s' as %s%s%s on %s.\n"), "to execute '%s%s%s%s' as %s%s%s on %s.\n"),
user_name, user_cmnd, user_args ? " " : "", user_name, user_cmnd, list_cmnd ? list_cmnd : "",
user_args ? user_args : "", user_args ? " " : "", user_args ? user_args : "",
list_pw ? list_pw->pw_name : runas_pw ? list_pw ? list_pw->pw_name : runas_pw ?
runas_pw->pw_name : user_name, runas_gr ? ":" : "", runas_pw->pw_name : user_name, runas_gr ? ":" : "",
runas_gr ? runas_gr->gr_name : "", user_host); runas_gr ? runas_gr->gr_name : "", user_host);

4
plugins/sudoers/parse.c
View File

@@ -1067,8 +1067,8 @@ display_cmnd(struct sudo_nss_list *snl, struct passwd *pw)
break; break;
} }
if (match == ALLOW) { if (match == ALLOW) {
/* For "sudo -l cmd" user_args includes the command being checked. */ const int len = sudo_printf(SUDO_CONV_INFO_MSG, "%s%s%s\n",
const int len = sudo_printf(SUDO_CONV_INFO_MSG, "%s\n", user_args); list_cmnd, user_args ? " " : "", user_args ? user_args : "");
ret = len < 0 ? -1 : true; ret = len < 0 ? -1 : true;
} }
debug_return_int(ret); debug_return_int(ret);

9
plugins/sudoers/sudoers.c
View File

@@ -1104,7 +1104,14 @@ set_cmnd(void)
/* set user_args */ /* set user_args */
free(user_args); free(user_args);
user_args = NULL; user_args = NULL;
if (NewArgc > 1) { if (ISSET(sudo_mode, MODE_CHECK)) {
if (NewArgc > 2) {
/* Skip the command being listed in NewArgv[1]. */
user_args = strvec_join(NewArgv + 2, ' ', NULL);
if (user_args == NULL)
debug_return_int(NOT_FOUND_ERROR);
}
} else if (NewArgc > 1) {
if (ISSET(sudo_mode, MODE_SHELL|MODE_LOGIN_SHELL) && if (ISSET(sudo_mode, MODE_SHELL|MODE_LOGIN_SHELL) &&
ISSET(sudo_mode, MODE_RUN)) { ISSET(sudo_mode, MODE_RUN)) {
/* /*