isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix special handling of ipa_hostname that was lost in sudo 1.8.24.

Browse Source 
We now include the long and short hostname in sudo parser container.
This commit is contained in:
Todd C. Miller
2019-08-15 14:20:12 -06:00
parent b4bef30d31
commit e99082e05b
7 changed files with 140 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
plugins/sudoers/file.c
View File

@@ -85,7 +85,7 @@ sudo_file_open(struct sudo_nss *nss)
if (handle != NULL) { if (handle != NULL) {
handle->fp = open_sudoers(sudoers_file, false, NULL); handle->fp = open_sudoers(sudoers_file, false, NULL);
if (handle->fp != NULL) { if (handle->fp != NULL) {
init_parse_tree(&handle->parse_tree); init_parse_tree(&handle->parse_tree, NULL, NULL);
} else { } else {
free(handle); free(handle);
handle = NULL; handle = NULL;

215
plugins/sudoers/gram.c
View File

@@ -106,7 +106,9 @@ char *errorfile = NULL;
struct sudoers_parse_tree parsed_policy = { struct sudoers_parse_tree parsed_policy = {
TAILQ_HEAD_INITIALIZER(parsed_policy.userspecs), TAILQ_HEAD_INITIALIZER(parsed_policy.userspecs),
TAILQ_HEAD_INITIALIZER(parsed_policy.defaults), TAILQ_HEAD_INITIALIZER(parsed_policy.defaults),
NULL /* aliases */ NULL, /* aliases */
NULL, /* lhost */
NULL /* shost */
}; };
/* /*
@@ -118,7 +120,7 @@ static bool add_userspec(struct member *, struct privilege *);
static struct defaults *new_default(char *, char *, short); static struct defaults *new_default(char *, char *, short);
static struct member *new_member(char *, int); static struct member *new_member(char *, int);
static struct command_digest *new_digest(int, char *); static struct command_digest *new_digest(int, char *);
#line 80 "gram.y" #line 82 "gram.y"
#ifndef YYSTYPE_DEFINED #ifndef YYSTYPE_DEFINED
#define YYSTYPE_DEFINED #define YYSTYPE_DEFINED
typedef union { typedef union {
@@ -135,7 +137,7 @@ typedef union {
int tok; int tok;
} YYSTYPE; } YYSTYPE;
#endif /* YYSTYPE_DEFINED */ #endif /* YYSTYPE_DEFINED */
#line 133 "gram.c" #line 135 "gram.c"
#define COMMAND 257 #define COMMAND 257
#define ALIAS 258 #define ALIAS 258
#define DEFVAR 259 #define DEFVAR 259
@@ -675,7 +677,7 @@ short *yysslim;
YYSTYPE *yyvs; YYSTYPE *yyvs;
unsigned int yystacksize; unsigned int yystacksize;
int yyparse(void); int yyparse(void);
#line 906 "gram.y" #line 908 "gram.y"
void void
sudoerserror(const char *s) sudoerserror(const char *s)
{ {
@@ -1019,11 +1021,14 @@ free_userspec(struct userspec *us)
* Initialized a sudoers parse tree. * Initialized a sudoers parse tree.
*/ */
void void
init_parse_tree(struct sudoers_parse_tree *parse_tree) init_parse_tree(struct sudoers_parse_tree *parse_tree, const char *lhost,
const char *shost)
{ {
TAILQ_INIT(&parse_tree->userspecs); TAILQ_INIT(&parse_tree->userspecs);
TAILQ_INIT(&parse_tree->defaults); TAILQ_INIT(&parse_tree->defaults);
parse_tree->aliases = NULL; parse_tree->aliases = NULL;
parse_tree->shost = shost;
parse_tree->lhost = lhost;
} }
/* /*
@@ -1100,7 +1105,7 @@ init_options(struct command_options *opts)
opts->limitprivs = NULL; opts->limitprivs = NULL;
#endif #endif
} }
#line 1046 "gram.c" #line 1051 "gram.c"
/* allocate initial stack or double stack size, up to YYMAXDEPTH */ /* allocate initial stack or double stack size, up to YYMAXDEPTH */
#if defined(__cplusplus) || defined(__STDC__) #if defined(__cplusplus) || defined(__STDC__)
static int yygrowstack(void) static int yygrowstack(void)
@@ -1309,23 +1314,23 @@ yyreduce:
switch (yyn) switch (yyn)
{ {
case 1: case 1:
#line 178 "gram.y" #line 180 "gram.y"
{ ; } { ; }
break; break;
case 5: case 5:
#line 186 "gram.y" #line 188 "gram.y"
{ {
; ;
} }
break; break;
case 6: case 6:
#line 189 "gram.y" #line 191 "gram.y"
{ {
yyerrok; yyerrok;
} }
break; break;
case 7: case 7:
#line 192 "gram.y" #line 194 "gram.y"
{ {
if (!add_userspec(yyvsp[-1].member, yyvsp[0].privilege)) { if (!add_userspec(yyvsp[-1].member, yyvsp[0].privilege)) {
sudoerserror(N_("unable to allocate memory")); sudoerserror(N_("unable to allocate memory"));
@@ -1334,73 +1339,73 @@ case 7:
} }
break; break;
case 8: case 8:
#line 198 "gram.y" #line 200 "gram.y"
{ {
; ;
} }
break; break;
case 9: case 9:
#line 201 "gram.y" #line 203 "gram.y"
{ {
; ;
} }
break; break;
case 10: case 10:
#line 204 "gram.y" #line 206 "gram.y"
{ {
; ;
} }
break; break;
case 11: case 11:
#line 207 "gram.y" #line 209 "gram.y"
{ {
; ;
} }
break; break;
case 12: case 12:
#line 210 "gram.y" #line 212 "gram.y"
{ {
if (!add_defaults(DEFAULTS, NULL, yyvsp[0].defaults)) if (!add_defaults(DEFAULTS, NULL, yyvsp[0].defaults))
YYERROR; YYERROR;
} }
break; break;
case 13: case 13:
#line 214 "gram.y" #line 216 "gram.y"
{ {
if (!add_defaults(DEFAULTS_USER, yyvsp[-1].member, yyvsp[0].defaults)) if (!add_defaults(DEFAULTS_USER, yyvsp[-1].member, yyvsp[0].defaults))
YYERROR; YYERROR;
} }
break; break;
case 14: case 14:
#line 218 "gram.y" #line 220 "gram.y"
{ {
if (!add_defaults(DEFAULTS_RUNAS, yyvsp[-1].member, yyvsp[0].defaults)) if (!add_defaults(DEFAULTS_RUNAS, yyvsp[-1].member, yyvsp[0].defaults))
YYERROR; YYERROR;
} }
break; break;
case 15: case 15:
#line 222 "gram.y" #line 224 "gram.y"
{ {
if (!add_defaults(DEFAULTS_HOST, yyvsp[-1].member, yyvsp[0].defaults)) if (!add_defaults(DEFAULTS_HOST, yyvsp[-1].member, yyvsp[0].defaults))
YYERROR; YYERROR;
} }
break; break;
case 16: case 16:
#line 226 "gram.y" #line 228 "gram.y"
{ {
if (!add_defaults(DEFAULTS_CMND, yyvsp[-1].member, yyvsp[0].defaults)) if (!add_defaults(DEFAULTS_CMND, yyvsp[-1].member, yyvsp[0].defaults))
YYERROR; YYERROR;
} }
break; break;
case 18: case 18:
#line 233 "gram.y" #line 235 "gram.y"
{ {
HLTQ_CONCAT(yyvsp[-2].defaults, yyvsp[0].defaults, entries); HLTQ_CONCAT(yyvsp[-2].defaults, yyvsp[0].defaults, entries);
yyval.defaults = yyvsp[-2].defaults; yyval.defaults = yyvsp[-2].defaults;
} }
break; break;
case 19: case 19:
#line 239 "gram.y" #line 241 "gram.y"
{ {
yyval.defaults = new_default(yyvsp[0].string, NULL, true); yyval.defaults = new_default(yyvsp[0].string, NULL, true);
if (yyval.defaults == NULL) { if (yyval.defaults == NULL) {
@@ -1410,7 +1415,7 @@ case 19:
} }
break; break;
case 20: case 20:
#line 246 "gram.y" #line 248 "gram.y"
{ {
yyval.defaults = new_default(yyvsp[0].string, NULL, false); yyval.defaults = new_default(yyvsp[0].string, NULL, false);
if (yyval.defaults == NULL) { if (yyval.defaults == NULL) {
@@ -1420,7 +1425,7 @@ case 20:
} }
break; break;
case 21: case 21:
#line 253 "gram.y" #line 255 "gram.y"
{ {
yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, true); yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, true);
if (yyval.defaults == NULL) { if (yyval.defaults == NULL) {
@@ -1430,7 +1435,7 @@ case 21:
} }
break; break;
case 22: case 22:
#line 260 "gram.y" #line 262 "gram.y"
{ {
yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, '+'); yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, '+');
if (yyval.defaults == NULL) { if (yyval.defaults == NULL) {
@@ -1440,7 +1445,7 @@ case 22:
} }
break; break;
case 23: case 23:
#line 267 "gram.y" #line 269 "gram.y"
{ {
yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, '-'); yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, '-');
if (yyval.defaults == NULL) { if (yyval.defaults == NULL) {
@@ -1450,14 +1455,14 @@ case 23:
} }
break; break;
case 25: case 25:
#line 277 "gram.y" #line 279 "gram.y"
{ {
HLTQ_CONCAT(yyvsp[-2].privilege, yyvsp[0].privilege, entries); HLTQ_CONCAT(yyvsp[-2].privilege, yyvsp[0].privilege, entries);
yyval.privilege = yyvsp[-2].privilege; yyval.privilege = yyvsp[-2].privilege;
} }
break; break;
case 26: case 26:
#line 283 "gram.y" #line 285 "gram.y"
{ {
struct privilege *p = calloc(1, sizeof(*p)); struct privilege *p = calloc(1, sizeof(*p));
if (p == NULL) { if (p == NULL) {
@@ -1472,21 +1477,21 @@ case 26:
} }
break; break;
case 27: case 27:
#line 297 "gram.y" #line 299 "gram.y"
{ {
yyval.member = yyvsp[0].member; yyval.member = yyvsp[0].member;
yyval.member->negated = false; yyval.member->negated = false;
} }
break; break;
case 28: case 28:
#line 301 "gram.y" #line 303 "gram.y"
{ {
yyval.member = yyvsp[0].member; yyval.member = yyvsp[0].member;
yyval.member->negated = true; yyval.member->negated = true;
} }
break; break;
case 29: case 29:
#line 307 "gram.y" #line 309 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, ALIAS); yyval.member = new_member(yyvsp[0].string, ALIAS);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -1496,7 +1501,7 @@ case 29:
} }
break; break;
case 30: case 30:
#line 314 "gram.y" #line 316 "gram.y"
{ {
yyval.member = new_member(NULL, ALL); yyval.member = new_member(NULL, ALL);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -1506,7 +1511,7 @@ case 30:
} }
break; break;
case 31: case 31:
#line 321 "gram.y" #line 323 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, NETGROUP); yyval.member = new_member(yyvsp[0].string, NETGROUP);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -1516,7 +1521,7 @@ case 31:
} }
break; break;
case 32: case 32:
#line 328 "gram.y" #line 330 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, NTWKADDR); yyval.member = new_member(yyvsp[0].string, NTWKADDR);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -1526,7 +1531,7 @@ case 32:
} }
break; break;
case 33: case 33:
#line 335 "gram.y" #line 337 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, WORD); yyval.member = new_member(yyvsp[0].string, WORD);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -1536,7 +1541,7 @@ case 33:
} }
break; break;
case 35: case 35:
#line 345 "gram.y" #line 347 "gram.y"
{ {
struct cmndspec *prev; struct cmndspec *prev;
prev = HLTQ_LAST(yyvsp[-2].cmndspec, cmndspec, entries); prev = HLTQ_LAST(yyvsp[-2].cmndspec, cmndspec, entries);
@@ -1590,7 +1595,7 @@ case 35:
} }
break; break;
case 36: case 36:
#line 398 "gram.y" #line 400 "gram.y"
{ {
struct cmndspec *cs = calloc(1, sizeof(*cs)); struct cmndspec *cs = calloc(1, sizeof(*cs));
if (cs == NULL) { if (cs == NULL) {
@@ -1642,7 +1647,7 @@ case 36:
} }
break; break;
case 37: case 37:
#line 449 "gram.y" #line 451 "gram.y"
{ {
yyval.digest = new_digest(SUDO_DIGEST_SHA224, yyvsp[0].string); yyval.digest = new_digest(SUDO_DIGEST_SHA224, yyvsp[0].string);
if (yyval.digest == NULL) { if (yyval.digest == NULL) {
@@ -1652,7 +1657,7 @@ case 37:
} }
break; break;
case 38: case 38:
#line 456 "gram.y" #line 458 "gram.y"
{ {
yyval.digest = new_digest(SUDO_DIGEST_SHA256, yyvsp[0].string); yyval.digest = new_digest(SUDO_DIGEST_SHA256, yyvsp[0].string);
if (yyval.digest == NULL) { if (yyval.digest == NULL) {
@@ -1662,7 +1667,7 @@ case 38:
} }
break; break;
case 39: case 39:
#line 463 "gram.y" #line 465 "gram.y"
{ {
yyval.digest = new_digest(SUDO_DIGEST_SHA384, yyvsp[0].string); yyval.digest = new_digest(SUDO_DIGEST_SHA384, yyvsp[0].string);
if (yyval.digest == NULL) { if (yyval.digest == NULL) {
@@ -1672,7 +1677,7 @@ case 39:
} }
break; break;
case 40: case 40:
#line 470 "gram.y" #line 472 "gram.y"
{ {
yyval.digest = new_digest(SUDO_DIGEST_SHA512, yyvsp[0].string); yyval.digest = new_digest(SUDO_DIGEST_SHA512, yyvsp[0].string);
if (yyval.digest == NULL) { if (yyval.digest == NULL) {
@@ -1682,13 +1687,13 @@ case 40:
} }
break; break;
case 41: case 41:
#line 479 "gram.y" #line 481 "gram.y"
{ {
yyval.member = yyvsp[0].member; yyval.member = yyvsp[0].member;
} }
break; break;
case 42: case 42:
#line 482 "gram.y" #line 484 "gram.y"
{ {
if (yyvsp[0].member->type != COMMAND) { if (yyvsp[0].member->type != COMMAND) {
sudoerserror(N_("a digest requires a path name")); sudoerserror(N_("a digest requires a path name"));
@@ -1700,75 +1705,75 @@ case 42:
} }
break; break;
case 43: case 43:
#line 493 "gram.y" #line 495 "gram.y"
{ {
yyval.member = yyvsp[0].member; yyval.member = yyvsp[0].member;
yyval.member->negated = false; yyval.member->negated = false;
} }
break; break;
case 44: case 44:
#line 497 "gram.y" #line 499 "gram.y"
{ {
yyval.member = yyvsp[0].member; yyval.member = yyvsp[0].member;
yyval.member->negated = true; yyval.member->negated = true;
} }
break; break;
case 45: case 45:
#line 503 "gram.y" #line 505 "gram.y"
{ {
yyval.string = yyvsp[0].string; yyval.string = yyvsp[0].string;
} }
break; break;
case 46: case 46:
#line 508 "gram.y" #line 510 "gram.y"
{ {
yyval.string = yyvsp[0].string; yyval.string = yyvsp[0].string;
} }
break; break;
case 47: case 47:
#line 512 "gram.y" #line 514 "gram.y"
{ {
yyval.string = yyvsp[0].string; yyval.string = yyvsp[0].string;
} }
break; break;
case 48: case 48:
#line 517 "gram.y" #line 519 "gram.y"
{ {
yyval.string = yyvsp[0].string; yyval.string = yyvsp[0].string;
} }
break; break;
case 49: case 49:
#line 522 "gram.y" #line 524 "gram.y"
{ {
yyval.string = yyvsp[0].string; yyval.string = yyvsp[0].string;
} }
break; break;
case 50: case 50:
#line 527 "gram.y" #line 529 "gram.y"
{ {
yyval.string = yyvsp[0].string; yyval.string = yyvsp[0].string;
} }
break; break;
case 51: case 51:
#line 531 "gram.y" #line 533 "gram.y"
{ {
yyval.string = yyvsp[0].string; yyval.string = yyvsp[0].string;
} }
break; break;
case 52: case 52:
#line 536 "gram.y" #line 538 "gram.y"
{ {
yyval.runas = NULL; yyval.runas = NULL;
} }
break; break;
case 53: case 53:
#line 539 "gram.y" #line 541 "gram.y"
{ {
yyval.runas = yyvsp[-1].runas; yyval.runas = yyvsp[-1].runas;
} }
break; break;
case 54: case 54:
#line 544 "gram.y" #line 546 "gram.y"
{ {
yyval.runas = calloc(1, sizeof(struct runascontainer)); yyval.runas = calloc(1, sizeof(struct runascontainer));
if (yyval.runas != NULL) { if (yyval.runas != NULL) {
@@ -1786,7 +1791,7 @@ case 54:
} }
break; break;
case 55: case 55:
#line 559 "gram.y" #line 561 "gram.y"
{ {
yyval.runas = calloc(1, sizeof(struct runascontainer)); yyval.runas = calloc(1, sizeof(struct runascontainer));
if (yyval.runas == NULL) { if (yyval.runas == NULL) {
@@ -1798,7 +1803,7 @@ case 55:
} }
break; break;
case 56: case 56:
#line 568 "gram.y" #line 570 "gram.y"
{ {
yyval.runas = calloc(1, sizeof(struct runascontainer)); yyval.runas = calloc(1, sizeof(struct runascontainer));
if (yyval.runas == NULL) { if (yyval.runas == NULL) {
@@ -1810,7 +1815,7 @@ case 56:
} }
break; break;
case 57: case 57:
#line 577 "gram.y" #line 579 "gram.y"
{ {
yyval.runas = calloc(1, sizeof(struct runascontainer)); yyval.runas = calloc(1, sizeof(struct runascontainer));
if (yyval.runas == NULL) { if (yyval.runas == NULL) {
@@ -1822,7 +1827,7 @@ case 57:
} }
break; break;
case 58: case 58:
#line 586 "gram.y" #line 588 "gram.y"
{ {
yyval.runas = calloc(1, sizeof(struct runascontainer)); yyval.runas = calloc(1, sizeof(struct runascontainer));
if (yyval.runas != NULL) { if (yyval.runas != NULL) {
@@ -1840,13 +1845,13 @@ case 58:
} }
break; break;
case 59: case 59:
#line 603 "gram.y" #line 605 "gram.y"
{ {
init_options(&yyval.options); init_options(&yyval.options);
} }
break; break;
case 60: case 60:
#line 606 "gram.y" #line 608 "gram.y"
{ {
yyval.options.notbefore = parse_gentime(yyvsp[0].string); yyval.options.notbefore = parse_gentime(yyvsp[0].string);
free(yyvsp[0].string); free(yyvsp[0].string);
@@ -1857,7 +1862,7 @@ case 60:
} }
break; break;
case 61: case 61:
#line 614 "gram.y" #line 616 "gram.y"
{ {
yyval.options.notafter = parse_gentime(yyvsp[0].string); yyval.options.notafter = parse_gentime(yyvsp[0].string);
free(yyvsp[0].string); free(yyvsp[0].string);
@@ -1868,7 +1873,7 @@ case 61:
} }
break; break;
case 62: case 62:
#line 622 "gram.y" #line 624 "gram.y"
{ {
yyval.options.timeout = parse_timeout(yyvsp[0].string); yyval.options.timeout = parse_timeout(yyvsp[0].string);
free(yyvsp[0].string); free(yyvsp[0].string);
@@ -1882,7 +1887,7 @@ case 62:
} }
break; break;
case 63: case 63:
#line 633 "gram.y" #line 635 "gram.y"
{ {
#ifdef HAVE_SELINUX #ifdef HAVE_SELINUX
free(yyval.options.role); free(yyval.options.role);
@@ -1891,7 +1896,7 @@ case 63:
} }
break; break;
case 64: case 64:
#line 639 "gram.y" #line 641 "gram.y"
{ {
#ifdef HAVE_SELINUX #ifdef HAVE_SELINUX
free(yyval.options.type); free(yyval.options.type);
@@ -1900,7 +1905,7 @@ case 64:
} }
break; break;
case 65: case 65:
#line 645 "gram.y" #line 647 "gram.y"
{ {
#ifdef HAVE_PRIV_SET #ifdef HAVE_PRIV_SET
free(yyval.options.privs); free(yyval.options.privs);
@@ -1909,7 +1914,7 @@ case 65:
} }
break; break;
case 66: case 66:
#line 651 "gram.y" #line 653 "gram.y"
{ {
#ifdef HAVE_PRIV_SET #ifdef HAVE_PRIV_SET
free(yyval.options.limitprivs); free(yyval.options.limitprivs);
@@ -1918,97 +1923,97 @@ case 66:
} }
break; break;
case 67: case 67:
#line 659 "gram.y" #line 661 "gram.y"
{ {
TAGS_INIT(yyval.tag); TAGS_INIT(yyval.tag);
} }
break; break;
case 68: case 68:
#line 662 "gram.y" #line 664 "gram.y"
{ {
yyval.tag.nopasswd = true; yyval.tag.nopasswd = true;
} }
break; break;
case 69: case 69:
#line 665 "gram.y" #line 667 "gram.y"
{ {
yyval.tag.nopasswd = false; yyval.tag.nopasswd = false;
} }
break; break;
case 70: case 70:
#line 668 "gram.y" #line 670 "gram.y"
{ {
yyval.tag.noexec = true; yyval.tag.noexec = true;
} }
break; break;
case 71: case 71:
#line 671 "gram.y" #line 673 "gram.y"
{ {
yyval.tag.noexec = false; yyval.tag.noexec = false;
} }
break; break;
case 72: case 72:
#line 674 "gram.y" #line 676 "gram.y"
{ {
yyval.tag.setenv = true; yyval.tag.setenv = true;
} }
break; break;
case 73: case 73:
#line 677 "gram.y" #line 679 "gram.y"
{ {
yyval.tag.setenv = false; yyval.tag.setenv = false;
} }
break; break;
case 74: case 74:
#line 680 "gram.y" #line 682 "gram.y"
{ {
yyval.tag.log_input = true; yyval.tag.log_input = true;
} }
break; break;
case 75: case 75:
#line 683 "gram.y" #line 685 "gram.y"
{ {
yyval.tag.log_input = false; yyval.tag.log_input = false;
} }
break; break;
case 76: case 76:
#line 686 "gram.y" #line 688 "gram.y"
{ {
yyval.tag.log_output = true; yyval.tag.log_output = true;
} }
break; break;
case 77: case 77:
#line 689 "gram.y" #line 691 "gram.y"
{ {
yyval.tag.log_output = false; yyval.tag.log_output = false;
} }
break; break;
case 78: case 78:
#line 692 "gram.y" #line 694 "gram.y"
{ {
yyval.tag.follow = true; yyval.tag.follow = true;
} }
break; break;
case 79: case 79:
#line 695 "gram.y" #line 697 "gram.y"
{ {
yyval.tag.follow = false; yyval.tag.follow = false;
} }
break; break;
case 80: case 80:
#line 698 "gram.y" #line 700 "gram.y"
{ {
yyval.tag.send_mail = true; yyval.tag.send_mail = true;
} }
break; break;
case 81: case 81:
#line 701 "gram.y" #line 703 "gram.y"
{ {
yyval.tag.send_mail = false; yyval.tag.send_mail = false;
} }
break; break;
case 82: case 82:
#line 706 "gram.y" #line 708 "gram.y"
{ {
yyval.member = new_member(NULL, ALL); yyval.member = new_member(NULL, ALL);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2018,7 +2023,7 @@ case 82:
} }
break; break;
case 83: case 83:
#line 713 "gram.y" #line 715 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, ALIAS); yyval.member = new_member(yyvsp[0].string, ALIAS);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2028,7 +2033,7 @@ case 83:
} }
break; break;
case 84: case 84:
#line 720 "gram.y" #line 722 "gram.y"
{ {
struct sudo_command *c = calloc(1, sizeof(*c)); struct sudo_command *c = calloc(1, sizeof(*c));
if (c == NULL) { if (c == NULL) {
@@ -2046,7 +2051,7 @@ case 84:
} }
break; break;
case 87: case 87:
#line 741 "gram.y" #line 743 "gram.y"
{ {
const char *s; const char *s;
s = alias_add(&parsed_policy, yyvsp[-2].string, HOSTALIAS, s = alias_add(&parsed_policy, yyvsp[-2].string, HOSTALIAS,
@@ -2058,14 +2063,14 @@ case 87:
} }
break; break;
case 89: case 89:
#line 753 "gram.y" #line 755 "gram.y"
{ {
HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries); HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries);
yyval.member = yyvsp[-2].member; yyval.member = yyvsp[-2].member;
} }
break; break;
case 92: case 92:
#line 763 "gram.y" #line 765 "gram.y"
{ {
const char *s; const char *s;
s = alias_add(&parsed_policy, yyvsp[-2].string, CMNDALIAS, s = alias_add(&parsed_policy, yyvsp[-2].string, CMNDALIAS,
@@ -2077,14 +2082,14 @@ case 92:
} }
break; break;
case 94: case 94:
#line 775 "gram.y" #line 777 "gram.y"
{ {
HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries); HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries);
yyval.member = yyvsp[-2].member; yyval.member = yyvsp[-2].member;
} }
break; break;
case 97: case 97:
#line 785 "gram.y" #line 787 "gram.y"
{ {
const char *s; const char *s;
s = alias_add(&parsed_policy, yyvsp[-2].string, RUNASALIAS, s = alias_add(&parsed_policy, yyvsp[-2].string, RUNASALIAS,
@@ -2096,7 +2101,7 @@ case 97:
} }
break; break;
case 100: case 100:
#line 800 "gram.y" #line 802 "gram.y"
{ {
const char *s; const char *s;
s = alias_add(&parsed_policy, yyvsp[-2].string, USERALIAS, s = alias_add(&parsed_policy, yyvsp[-2].string, USERALIAS,
@@ -2108,28 +2113,28 @@ case 100:
} }
break; break;
case 102: case 102:
#line 812 "gram.y" #line 814 "gram.y"
{ {
HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries); HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries);
yyval.member = yyvsp[-2].member; yyval.member = yyvsp[-2].member;
} }
break; break;
case 103: case 103:
#line 818 "gram.y" #line 820 "gram.y"
{ {
yyval.member = yyvsp[0].member; yyval.member = yyvsp[0].member;
yyval.member->negated = false; yyval.member->negated = false;
} }
break; break;
case 104: case 104:
#line 822 "gram.y" #line 824 "gram.y"
{ {
yyval.member = yyvsp[0].member; yyval.member = yyvsp[0].member;
yyval.member->negated = true; yyval.member->negated = true;
} }
break; break;
case 105: case 105:
#line 828 "gram.y" #line 830 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, ALIAS); yyval.member = new_member(yyvsp[0].string, ALIAS);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2139,7 +2144,7 @@ case 105:
} }
break; break;
case 106: case 106:
#line 835 "gram.y" #line 837 "gram.y"
{ {
yyval.member = new_member(NULL, ALL); yyval.member = new_member(NULL, ALL);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2149,7 +2154,7 @@ case 106:
} }
break; break;
case 107: case 107:
#line 842 "gram.y" #line 844 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, NETGROUP); yyval.member = new_member(yyvsp[0].string, NETGROUP);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2159,7 +2164,7 @@ case 107:
} }
break; break;
case 108: case 108:
#line 849 "gram.y" #line 851 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, USERGROUP); yyval.member = new_member(yyvsp[0].string, USERGROUP);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2169,7 +2174,7 @@ case 108:
} }
break; break;
case 109: case 109:
#line 856 "gram.y" #line 858 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, WORD); yyval.member = new_member(yyvsp[0].string, WORD);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2179,28 +2184,28 @@ case 109:
} }
break; break;
case 111: case 111:
#line 866 "gram.y" #line 868 "gram.y"
{ {
HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries); HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries);
yyval.member = yyvsp[-2].member; yyval.member = yyvsp[-2].member;
} }
break; break;
case 112: case 112:
#line 872 "gram.y" #line 874 "gram.y"
{ {
yyval.member = yyvsp[0].member; yyval.member = yyvsp[0].member;
yyval.member->negated = false; yyval.member->negated = false;
} }
break; break;
case 113: case 113:
#line 876 "gram.y" #line 878 "gram.y"
{ {
yyval.member = yyvsp[0].member; yyval.member = yyvsp[0].member;
yyval.member->negated = true; yyval.member->negated = true;
} }
break; break;
case 114: case 114:
#line 882 "gram.y" #line 884 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, ALIAS); yyval.member = new_member(yyvsp[0].string, ALIAS);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2210,7 +2215,7 @@ case 114:
} }
break; break;
case 115: case 115:
#line 889 "gram.y" #line 891 "gram.y"
{ {
yyval.member = new_member(NULL, ALL); yyval.member = new_member(NULL, ALL);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2220,7 +2225,7 @@ case 115:
} }
break; break;
case 116: case 116:
#line 896 "gram.y" #line 898 "gram.y"
{ {
yyval.member = new_member(yyvsp[0].string, WORD); yyval.member = new_member(yyvsp[0].string, WORD);
if (yyval.member == NULL) { if (yyval.member == NULL) {
@@ -2229,7 +2234,7 @@ case 116:
} }
} }
break; break;
#line 2175 "gram.c" #line 2180 "gram.c"
} }
yyssp -= yym; yyssp -= yym;
yystate = *yyssp; yystate = *yyssp;

9
plugins/sudoers/gram.y
View File

@@ -63,7 +63,9 @@ char *errorfile = NULL;
struct sudoers_parse_tree parsed_policy = { struct sudoers_parse_tree parsed_policy = {
TAILQ_HEAD_INITIALIZER(parsed_policy.userspecs), TAILQ_HEAD_INITIALIZER(parsed_policy.userspecs),
TAILQ_HEAD_INITIALIZER(parsed_policy.defaults), TAILQ_HEAD_INITIALIZER(parsed_policy.defaults),
NULL /* aliases */ NULL, /* aliases */
NULL, /* lhost */
NULL /* shost */
}; };
/* /*
@@ -1246,11 +1248,14 @@ free_userspec(struct userspec *us)
* Initialized a sudoers parse tree. * Initialized a sudoers parse tree.
*/ */
void void
init_parse_tree(struct sudoers_parse_tree *parse_tree) init_parse_tree(struct sudoers_parse_tree *parse_tree, const char *lhost,
const char *shost)
{ {
TAILQ_INIT(&parse_tree->userspecs); TAILQ_INIT(&parse_tree->userspecs);
TAILQ_INIT(&parse_tree->defaults); TAILQ_INIT(&parse_tree->defaults);
parse_tree->aliases = NULL; parse_tree->aliases = NULL;
parse_tree->shost = shost;
parse_tree->lhost = lhost;
} }
/* /*

2
plugins/sudoers/ldap.c
View File

@@ -1665,7 +1665,7 @@ sudo_ldap_open(struct sudo_nss *nss)
} }
handle->ld = ld; handle->ld = ld;
/* handle->pw = NULL; */ /* handle->pw = NULL; */
init_parse_tree(&handle->parse_tree); init_parse_tree(&handle->parse_tree, NULL, NULL);
nss->handle = handle; nss->handle = handle;
done: done:

23
plugins/sudoers/match.c
View File

@@ -72,8 +72,10 @@ int
user_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, user_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw,
const struct member *m) const struct member *m)
{ {
struct alias *a; const char *lhost = parse_tree->lhost ? parse_tree->lhost : user_runhost;
const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost;
int matched = UNSPEC; int matched = UNSPEC;
struct alias *a;
debug_decl(user_matches, SUDOERS_DEBUG_MATCH) debug_decl(user_matches, SUDOERS_DEBUG_MATCH)
switch (m->type) { switch (m->type) {
@@ -82,8 +84,8 @@ user_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw,
break; break;
case NETGROUP: case NETGROUP:
if (netgr_matches(m->name, if (netgr_matches(m->name,
def_netgroup_tuple ? user_runhost : NULL, def_netgroup_tuple ? lhost : NULL,
def_netgroup_tuple ? user_srunhost : NULL, pw->pw_name)) def_netgroup_tuple ? shost : NULL, pw->pw_name))
matched = !m->negated; matched = !m->negated;
break; break;
case USERGROUP: case USERGROUP:
@@ -153,11 +155,13 @@ runaslist_matches(struct sudoers_parse_tree *parse_tree,
const struct member_list *user_list, const struct member_list *group_list, const struct member_list *user_list, const struct member_list *group_list,
struct member **matching_user, struct member **matching_group) struct member **matching_user, struct member **matching_group)
{ {
const char *lhost = parse_tree->lhost ? parse_tree->lhost : user_runhost;
const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost;
int user_matched = UNSPEC;
int group_matched = UNSPEC;
struct member *m; struct member *m;
struct alias *a; struct alias *a;
int rc; int rc;
int user_matched = UNSPEC;
int group_matched = UNSPEC;
debug_decl(runaslist_matches, SUDOERS_DEBUG_MATCH) debug_decl(runaslist_matches, SUDOERS_DEBUG_MATCH)
if (ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) || !ISSET(sudo_user.flags, RUNAS_GROUP_SPECIFIED)) { if (ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) || !ISSET(sudo_user.flags, RUNAS_GROUP_SPECIFIED)) {
@@ -175,8 +179,8 @@ runaslist_matches(struct sudoers_parse_tree *parse_tree,
break; break;
case NETGROUP: case NETGROUP:
if (netgr_matches(m->name, if (netgr_matches(m->name,
def_netgroup_tuple ? user_runhost : NULL, def_netgroup_tuple ? lhost : NULL,
def_netgroup_tuple ? user_srunhost : NULL, def_netgroup_tuple ? shost : NULL,
runas_pw->pw_name)) runas_pw->pw_name))
user_matched = !m->negated; user_matched = !m->negated;
break; break;
@@ -309,7 +313,10 @@ int
hostlist_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, hostlist_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw,
const struct member_list *list) const struct member_list *list)
{ {
return hostlist_matches_int(parse_tree, pw, user_runhost, user_srunhost, list); const char *lhost = parse_tree->lhost ? parse_tree->lhost : user_runhost;
const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost;
return hostlist_matches_int(parse_tree, pw, lhost, shost, list);
} }
/* /*

3
plugins/sudoers/parse.h
View File

@@ -272,6 +272,7 @@ struct sudoers_parse_tree {
struct userspec_list userspecs; struct userspec_list userspecs;
struct defaults_list defaults; struct defaults_list defaults;
struct rbtree *aliases; struct rbtree *aliases;
const char *shost, *lhost;
}; };
/* alias.c */ /* alias.c */
@@ -297,7 +298,7 @@ void free_userspec(struct userspec *us);
void free_userspecs(struct userspec_list *usl); void free_userspecs(struct userspec_list *usl);
void free_default(struct defaults *def, struct member_list **binding); void free_default(struct defaults *def, struct member_list **binding);
void free_defaults(struct defaults_list *defs); void free_defaults(struct defaults_list *defs);
void init_parse_tree(struct sudoers_parse_tree *parse_tree); void init_parse_tree(struct sudoers_parse_tree *parse_tree, const char *shost, const char *lhost);
void free_parse_tree(struct sudoers_parse_tree *parse_tree); void free_parse_tree(struct sudoers_parse_tree *parse_tree);
void reparent_parse_tree(struct sudoers_parse_tree *new_tree); void reparent_parse_tree(struct sudoers_parse_tree *new_tree);

7
plugins/sudoers/sssd.c
View File

@@ -554,7 +554,6 @@ sudo_sss_open(struct sudo_nss *nss)
sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory")); sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
debug_return_int(ENOMEM); debug_return_int(ENOMEM);
} }
init_parse_tree(&handle->parse_tree);
/* Load symbols */ /* Load symbols */
handle->ssslib = sudo_dso_load(path, SUDO_DSO_LAZY); handle->ssslib = sudo_dso_load(path, SUDO_DSO_LAZY);
@@ -612,8 +611,6 @@ sudo_sss_open(struct sudo_nss *nss)
debug_return_int(EFAULT); debug_return_int(EFAULT);
} }
nss->handle = handle;
/* /*
* If runhost is the same as the local host, check for ipa_hostname * If runhost is the same as the local host, check for ipa_hostname
* in sssd.conf and use it in preference to user_runhost. * in sssd.conf and use it in preference to user_runhost.
@@ -625,6 +622,10 @@ sudo_sss_open(struct sudo_nss *nss)
} }
} }
/* The "parse tree" contains userspecs, defaults, aliases and hostnames. */
init_parse_tree(&handle->parse_tree, handle->ipa_host, handle->ipa_shost);
nss->handle = handle;
sudo_debug_printf(SUDO_DEBUG_DEBUG, "handle=%p", handle); sudo_debug_printf(SUDO_DEBUG_DEBUG, "handle=%p", handle);
debug_return_int(0); debug_return_int(0);