isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a new flag "allow_unknown_runas_id" to control matching of unknown IDs.

Browse Source 
Previous, sudo would always allow unknown user or group IDs if the
sudoers entry permitted it.  This included the "ALL" alias.
With this change, the admin must explicitly enable support for unknown IDs.
This commit is contained in:
Todd C. Miller
2019-12-09 17:14:06 -07:00
parent d7b4f88658
commit df8f06609c
7 changed files with 71 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
doc/sudoers.man.in
View File

@@ -25,7 +25,7 @@
.nr BA @BAMAN@
.nr LC @LCMAN@
.nr PS @PSMAN@
.TH "SUDOERS" "@mansectform@" "December 6, 2019" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.TH "SUDOERS" "@mansectform@" "December 8, 2019" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.nh
.if n .ad l
.SH "NAME"
@@ -2952,6 +2952,23 @@ This flag is
\fIoff\fR
by default.
.TP 18n
runas_allow_unknown_id
If enabled, allow matching of runas user and group IDs that are
not present in the password or group databases.
In addition to explicitly matching unknown user or group IDs in a
\fRRunas_List\fR,
this option also allows the
\fBALL\fR
alias to match unknown IDs.
This flag is
\fIoff\fR
by default.
.sp
This setting is only supported by version 1.8.30 or higher.
Older versions of
\fBsudo\fR
always allowed matching of unknown user and group IDs.
.TP 18n
runaspw
If set,
\fBsudo\fR

18
doc/sudoers.mdoc.in
View File

@@ -24,7 +24,7 @@
.nr BA @BAMAN@
.nr LC @LCMAN@
.nr PS @PSMAN@
.Dd December 6, 2019
.Dd December 8, 2019
.Dt SUDOERS @mansectform@
.Os Sudo @PACKAGE_VERSION@
.Sh NAME
@@ -2778,6 +2778,22 @@ when running a command or editing a file.
This flag is
.Em off
by default.
.It runas_allow_unknown_id
If enabled, allow matching of runas user and group IDs that are
not present in the password or group databases.
In addition to explicitly matching unknown user or group IDs in a
.Li Runas_List ,
this option also allows the
.Sy ALL
alias to match unknown IDs.
This flag is
.Em off
by default.
.Pp
This setting is only supported by version 1.8.30 or higher.
Older versions of
.Nm sudo
always allowed matching of unknown user and group IDs.
.It runaspw
If set,
.Nm sudo

4
plugins/sudoers/def_data.c
View File

@@ -525,6 +525,10 @@ struct sudo_defs_types sudo_defs_table[] = {
"log_server_peer_key", T_STR|T_BOOL|T_PATH,
N_("Path to the sudoers private key file: %s"),
NULL,
}, {
"runas_allow_unknown_id", T_FLAG,
N_("Allow the use of unknown runas user and/or group ID"),
NULL,
}, {
NULL, 0, NULL
}

2
plugins/sudoers/def_data.h
View File

@@ -242,6 +242,8 @@
#define def_log_server_peer_cert (sudo_defs_table[I_LOG_SERVER_PEER_CERT].sd_un.str)
#define I_LOG_SERVER_PEER_KEY 121
#define def_log_server_peer_key (sudo_defs_table[I_LOG_SERVER_PEER_KEY].sd_un.str)
#define I_RUNAS_ALLOW_UNKNOWN_ID 122
#define def_runas_allow_unknown_id (sudo_defs_table[I_RUNAS_ALLOW_UNKNOWN_ID].sd_un.flag)
enum def_tuple {
never,

3
plugins/sudoers/def_data.in
View File

@@ -381,3 +381,6 @@ log_server_peer_cert
log_server_peer_key
T_STR|T_BOOL|T_PATH
"Path to the sudoers private key file: %s"
runas_allow_unknown_id
T_FLAG
"Allow the use of unknown runas user and/or group ID"

1
plugins/sudoers/defaults.c
View File

@@ -537,6 +537,7 @@ init_defaults(void)
def_fdexec = digest_only;
def_log_allowed = true;
def_log_denied = true;
def_runas_allow_unknown_id = false;
/* Syslog options need special care since they both strings and ints */
#if (LOGGING & SLOG_SYSLOG)

28
plugins/sudoers/sudoers.c
View File

@@ -106,6 +106,8 @@ static char *prev_user;
static char *runas_user;
static char *runas_group;
static struct sudo_nss_list *snl;
static bool unknown_runas_uid;
static bool unknown_runas_gid;
#ifdef __linux__
static struct rlimit nproclimit;
@@ -376,6 +378,22 @@ sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
}
}
/* Defer uid/gid checks until after defaults have been updated. */
if (unknown_runas_uid && !def_runas_allow_unknown_id) {
audit_failure(NewArgc, NewArgv, N_("unknown user: %s"),
runas_pw->pw_name);
sudo_warnx(U_("unknown user: %s"), runas_pw->pw_name);
goto done;
}
if (runas_gr != NULL) {
if (unknown_runas_gid && !def_runas_allow_unknown_id) {
audit_failure(NewArgc, NewArgv, N_("unknown group: %s"),
runas_gr->gr_name);
sudo_warnx(U_("unknown group: %s"), runas_gr->gr_name);
goto done;
}
}
/*
* Look up the timestamp dir owner if one is specified.
*/
@@ -1192,14 +1210,17 @@ set_runaspw(const char *user, bool quiet)
struct passwd *pw = NULL;
debug_decl(set_runaspw, SUDOERS_DEBUG_PLUGIN)
unknown_runas_uid = false;
if (*user == '#') {
const char *errstr;
uid_t uid = sudo_strtoid(user + 1, &errstr);
if (errstr == NULL) {
if ((pw = sudo_getpwuid(uid)) == NULL)
if ((pw = sudo_getpwuid(uid)) == NULL) {
unknown_runas_uid = true;
pw = sudo_fakepwnam(user, user_gid);
}
}
}
if (pw == NULL) {
if ((pw = sudo_getpwnam(user)) == NULL) {
if (!quiet)
@@ -1223,14 +1244,17 @@ set_runasgr(const char *group, bool quiet)
struct group *gr = NULL;
debug_decl(set_runasgr, SUDOERS_DEBUG_PLUGIN)
unknown_runas_gid = false;
if (*group == '#') {
const char *errstr;
gid_t gid = sudo_strtoid(group + 1, &errstr);
if (errstr == NULL) {
if ((gr = sudo_getgrgid(gid)) == NULL)
if ((gr = sudo_getgrgid(gid)) == NULL) {
unknown_runas_gid = true;
gr = sudo_fakegrnam(group);
}
}
}
if (gr == NULL) {
if ((gr = sudo_getgrnam(group)) == NULL) {
if (!quiet)