diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in index d91d06455..608e164f7 100644 --- a/doc/sudoers.man.in +++ b/doc/sudoers.man.in @@ -25,7 +25,7 @@ .nr BA @BAMAN@ .nr LC @LCMAN@ .nr PS @PSMAN@ -.TH "SUDOERS" "@mansectform@" "January 22, 2020" "Sudo @PACKAGE_VERSION@" "File Formats Manual" +.TH "SUDOERS" "@mansectform@" "March 1, 2020" "Sudo @PACKAGE_VERSION@" "File Formats Manual" .nh .if n .ad l .SH "NAME" @@ -2805,6 +2805,41 @@ by default. .sp This setting is only supported by version 1.8.28 or higher. .TP 18n +pam_rhost +On systems that use PAM for authentication, +\fBsudo\fR +will set the PAM remote host value to the name of the local host +when the +\fIpam_rhost\fR +flag is enabled. +On Linux systems, enabling +\fIpam_rhost\fR +may result in DNS lookups of the local host name when PAM is initialized. +On Solaris versions prior to Solaris 8, +\fIpam_rhost\fR +must be enabled if +\fIpam_ruser\fR +is also enabled to avoid a crash in the Solaris PAM implementation. +.sp +This flag is +\fIoff\fR +by default on systems other than Solaris. +.sp +This setting is only supported by version 1.9.0 or higher. +.TP 18n +pam_ruser +On systems that use PAM for authentication, +\fBsudo\fR +will set the PAM remote user value to the name of the user that invoked sudo +when the +\fIpam_ruser\fR +flag is enabled. +This flag is +\fIon\fR +by default. +.sp +This setting is only supported by version 1.9.0 or higher. +.TP 18n pam_session On systems that use PAM for authentication, \fBsudo\fR diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in index e3cc90013..9b474bf84 100644 --- a/doc/sudoers.mdoc.in +++ b/doc/sudoers.mdoc.in @@ -24,7 +24,7 @@ .nr BA @BAMAN@ .nr LC @LCMAN@ .nr PS @PSMAN@ -.Dd January 22, 2020 +.Dd March 1, 2020 .Dt SUDOERS @mansectform@ .Os Sudo @PACKAGE_VERSION@ .Sh NAME @@ -2639,6 +2639,39 @@ This flag is by default. .Pp This setting is only supported by version 1.8.28 or higher. +.It pam_rhost +On systems that use PAM for authentication, +.Nm sudo +will set the PAM remote host value to the name of the local host +when the +.Em pam_rhost +flag is enabled. +On Linux systems, enabling +.Em pam_rhost +may result in DNS lookups of the local host name when PAM is initialized. +On Solaris versions prior to Solaris 8, +.Em pam_rhost +must be enabled if +.Em pam_ruser +is also enabled to avoid a crash in the Solaris PAM implementation. +.Pp +This flag is +.Em off +by default on systems other than Solaris. +.Pp +This setting is only supported by version 1.9.0 or higher. +.It pam_ruser +On systems that use PAM for authentication, +.Nm sudo +will set the PAM remote user value to the name of the user that invoked sudo +when the +.Em pam_ruser +flag is enabled. +This flag is +.Em on +by default. +.Pp +This setting is only supported by version 1.9.0 or higher. .It pam_session On systems that use PAM for authentication, .Nm sudo diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c index 6361871c8..78a9c2988 100644 --- a/plugins/sudoers/auth/pam.c +++ b/plugins/sudoers/auth/pam.c @@ -1,7 +1,7 @@ /* * SPDX-License-Identifier: ISC * - * Copyright (c) 1999-2005, 2007-2019 Todd C. Miller + * Copyright (c) 1999-2005, 2007-2020 Todd C. Miller * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -229,22 +229,25 @@ sudo_pam_init2(struct passwd *pw, sudo_auth *auth, bool quiet) /* * Set PAM_RUSER to the invoking user (the "from" user). - * We set PAM_RHOST to avoid a bug in Solaris 7 and below. + * Solaris 7 and below require PAM_RHOST to be set if PAM_RUSER is. + * Note: PAM_RHOST may cause a DNS lookup on Linux in libaudit. */ - rc = pam_set_item(pamh, PAM_RUSER, user_name); - if (rc != PAM_SUCCESS) { - errstr = sudo_pam_strerror(pamh, rc); - sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, - "pam_set_item(pamh, PAM_RUSER, %s): %s", user_name, errstr); + if (def_pam_ruser) { + rc = pam_set_item(pamh, PAM_RUSER, user_name); + if (rc != PAM_SUCCESS) { + errstr = sudo_pam_strerror(pamh, rc); + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, + "pam_set_item(pamh, PAM_RUSER, %s): %s", user_name, errstr); + } } -#ifdef __sun__ - rc = pam_set_item(pamh, PAM_RHOST, user_host); - if (rc != PAM_SUCCESS) { - errstr = sudo_pam_strerror(pamh, rc); - sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, - "pam_set_item(pamh, PAM_RHOST, %s): %s", user_host, errstr); + if (def_pam_rhost) { + rc = pam_set_item(pamh, PAM_RHOST, user_host); + if (rc != PAM_SUCCESS) { + errstr = sudo_pam_strerror(pamh, rc); + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, + "pam_set_item(pamh, PAM_RHOST, %s): %s", user_host, errstr); + } } -#endif #if defined(__LINUX_PAM__) || defined(__sun__) /* diff --git a/plugins/sudoers/def_data.c b/plugins/sudoers/def_data.c index 1ea0a3bca..a9de91adf 100644 --- a/plugins/sudoers/def_data.c +++ b/plugins/sudoers/def_data.c @@ -537,6 +537,14 @@ struct sudo_defs_types sudo_defs_table[] = { "runas_check_shell", T_FLAG, N_("Only permit running commands as a user with a valid shell"), NULL, + }, { + "pam_ruser", T_FLAG, + N_("Set the pam remote user to the user running sudo"), + NULL, + }, { + "pam_rhost", T_FLAG, + N_("Set the pam remote host to the local host name"), + NULL, }, { NULL, 0, NULL } diff --git a/plugins/sudoers/def_data.h b/plugins/sudoers/def_data.h index f130e13ab..233bdec56 100644 --- a/plugins/sudoers/def_data.h +++ b/plugins/sudoers/def_data.h @@ -248,6 +248,10 @@ #define def_runas_allow_unknown_id (sudo_defs_table[I_RUNAS_ALLOW_UNKNOWN_ID].sd_un.flag) #define I_RUNAS_CHECK_SHELL 124 #define def_runas_check_shell (sudo_defs_table[I_RUNAS_CHECK_SHELL].sd_un.flag) +#define I_PAM_RUSER 125 +#define def_pam_ruser (sudo_defs_table[I_PAM_RUSER].sd_un.flag) +#define I_PAM_RHOST 126 +#define def_pam_rhost (sudo_defs_table[I_PAM_RHOST].sd_un.flag) enum def_tuple { never, diff --git a/plugins/sudoers/def_data.in b/plugins/sudoers/def_data.in index f6a1dd8d4..a2300e9d4 100644 --- a/plugins/sudoers/def_data.in +++ b/plugins/sudoers/def_data.in @@ -390,4 +390,9 @@ runas_allow_unknown_id runas_check_shell T_FLAG "Only permit running commands as a user with a valid shell" - +pam_ruser + T_FLAG + "Set the pam remote user to the user running sudo" +pam_rhost + T_FLAG + "Set the pam remote host to the local host name" diff --git a/plugins/sudoers/defaults.c b/plugins/sudoers/defaults.c index 5a3f5e37e..b51768c84 100644 --- a/plugins/sudoers/defaults.c +++ b/plugins/sudoers/defaults.c @@ -1,7 +1,7 @@ /* * SPDX-License-Identifier: ISC * - * Copyright (c) 1999-2005, 2007-2018 + * Copyright (c) 1999-2005, 2007-2020 * Todd C. Miller * * Permission to use, copy, modify, and distribute this software for any @@ -514,6 +514,10 @@ init_defaults(void) def_env_reset = ENV_RESET; def_set_logname = true; def_closefrom = STDERR_FILENO + 1; + def_pam_ruser = true; +#ifdef __sun__ + def_pam_rhost = true; +#endif if ((def_pam_service = strdup("sudo")) == NULL) goto oom; #ifdef HAVE_PAM_LOGIN