Add "kernel" as a possible value of timestamp_type.
Currently only supported on OpenBSD.
This commit is contained in:
5
NEWS
5
NEWS
@@ -72,6 +72,11 @@ What's new in Sudo 1.8.22
|
|||||||
the likelihood of a time stamp record being re-used when a user
|
the likelihood of a time stamp record being re-used when a user
|
||||||
logs out and back in again. Bug #818.
|
logs out and back in again. Bug #818.
|
||||||
|
|
||||||
|
* The "timestamp_type" option now takes a "kernel" value on OpenBSD
|
||||||
|
systems. This causes the tty-based time stamp to be stored in
|
||||||
|
the kernel instead of on the file system. If no tty is present,
|
||||||
|
the time stamp is considered to be invalid.
|
||||||
|
|
||||||
What's new in Sudo 1.8.21p2
|
What's new in Sudo 1.8.21p2
|
||||||
|
|
||||||
* Fixed a bug introduced in version 1.8.21 which prevented sudo
|
* Fixed a bug introduced in version 1.8.21 which prevented sudo
|
||||||
|
@@ -1864,6 +1864,12 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
|
|||||||
will not require a password for
|
will not require a password for
|
||||||
_t_i_m_e_s_t_a_m_p___t_i_m_e_o_u_t minutes (5 by default).
|
_t_i_m_e_s_t_a_m_p___t_i_m_e_o_u_t minutes (5 by default).
|
||||||
|
|
||||||
|
kernel The time stamp is stored in the kernel as an
|
||||||
|
attribute of the terminal device. If no
|
||||||
|
terminal is present, the time stamp is
|
||||||
|
considered to be invalid. This is currently
|
||||||
|
only supported on OpenBSD.
|
||||||
|
|
||||||
The default value is _t_t_y.
|
The default value is _t_t_y.
|
||||||
|
|
||||||
This setting is only supported by version 1.8.21 or
|
This setting is only supported by version 1.8.21 or
|
||||||
|
@@ -3708,6 +3708,12 @@ minutes
|
|||||||
(\fR@timeout@\fR
|
(\fR@timeout@\fR
|
||||||
by default)
|
by default)
|
||||||
\&.
|
\&.
|
||||||
|
.TP 8n
|
||||||
|
kernel
|
||||||
|
The time stamp is stored in the kernel as an attribute of the terminal
|
||||||
|
device.
|
||||||
|
If no terminal is present, the time stamp is considered to be invalid.
|
||||||
|
This is currently only supported on OpenBSD.
|
||||||
.PP
|
.PP
|
||||||
The default value is
|
The default value is
|
||||||
\fI@timestamp_type@\fR.
|
\fI@timestamp_type@\fR.
|
||||||
|
@@ -3470,6 +3470,11 @@ minutes
|
|||||||
.Li @timeout@
|
.Li @timeout@
|
||||||
by default
|
by default
|
||||||
.Pc .
|
.Pc .
|
||||||
|
.It kernel
|
||||||
|
The time stamp is stored in the kernel as an attribute of the terminal
|
||||||
|
device.
|
||||||
|
If no terminal is present, the time stamp is considered to be invalid.
|
||||||
|
This is currently only supported on OpenBSD.
|
||||||
.El
|
.El
|
||||||
.Pp
|
.Pp
|
||||||
The default value is
|
The default value is
|
||||||
|
@@ -32,6 +32,7 @@ static struct def_values def_data_timestamp_type[] = {
|
|||||||
{ "global", global },
|
{ "global", global },
|
||||||
{ "ppid", ppid },
|
{ "ppid", ppid },
|
||||||
{ "tty", tty },
|
{ "tty", tty },
|
||||||
|
{ "kernel", kernel },
|
||||||
{ NULL, 0 },
|
{ NULL, 0 },
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@@ -232,5 +232,6 @@ enum def_tuple {
|
|||||||
digest_only,
|
digest_only,
|
||||||
global,
|
global,
|
||||||
ppid,
|
ppid,
|
||||||
tty
|
tty,
|
||||||
|
kernel
|
||||||
};
|
};
|
||||||
|
@@ -347,7 +347,7 @@ syslog_pid
|
|||||||
timestamp_type
|
timestamp_type
|
||||||
T_TUPLE
|
T_TUPLE
|
||||||
"Type of authentication timestamp record: %s"
|
"Type of authentication timestamp record: %s"
|
||||||
global ppid tty
|
global ppid tty kernel
|
||||||
authfail_message
|
authfail_message
|
||||||
T_STR
|
T_STR
|
||||||
"Authentication failure message: %s"
|
"Authentication failure message: %s"
|
||||||
|
@@ -19,6 +19,7 @@
|
|||||||
#include <sys/types.h>
|
#include <sys/types.h>
|
||||||
#include <sys/time.h>
|
#include <sys/time.h>
|
||||||
#include <sys/stat.h>
|
#include <sys/stat.h>
|
||||||
|
#include <sys/ioctl.h>
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
#include <stdlib.h>
|
#include <stdlib.h>
|
||||||
#if defined(HAVE_STDINT_H)
|
#if defined(HAVE_STDINT_H)
|
||||||
@@ -388,6 +389,13 @@ timestamp_open(const char *user, pid_t sid)
|
|||||||
goto bad;
|
goto bad;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (def_timestamp_type == kernel) {
|
||||||
|
fd = open(_PATH_TTY, O_RDWR);
|
||||||
|
if (fd == -1)
|
||||||
|
goto bad;
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
|
||||||
/* Sanity check timestamp dir and create if missing. */
|
/* Sanity check timestamp dir and create if missing. */
|
||||||
if (!ts_secure_dir(def_timestampdir, true, false))
|
if (!ts_secure_dir(def_timestampdir, true, false))
|
||||||
goto bad;
|
goto bad;
|
||||||
@@ -435,6 +443,7 @@ timestamp_open(const char *user, pid_t sid)
|
|||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
done:
|
||||||
/* Allocate and fill in cookie to store state. */
|
/* Allocate and fill in cookie to store state. */
|
||||||
cookie = malloc(sizeof(*cookie));
|
cookie = malloc(sizeof(*cookie));
|
||||||
if (cookie == NULL) {
|
if (cookie == NULL) {
|
||||||
@@ -590,6 +599,11 @@ timestamp_lock(void *vcookie, struct passwd *pw)
|
|||||||
debug_return_bool(false);
|
debug_return_bool(false);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (def_timestamp_type == kernel) {
|
||||||
|
cookie->pos = 0;
|
||||||
|
debug_return_bool(true);
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Take a lock on the "write" record (the first record in the file).
|
* Take a lock on the "write" record (the first record in the file).
|
||||||
* This will let us seek for the record or extend as needed
|
* This will let us seek for the record or extend as needed
|
||||||
@@ -732,6 +746,20 @@ timestamp_status(void *vcookie, struct passwd *pw)
|
|||||||
goto done;
|
goto done;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (def_timestamp_type == kernel) {
|
||||||
|
#ifdef TIOCCHKVERAUTH
|
||||||
|
int fd = open(_PATH_TTY, O_RDWR);
|
||||||
|
if (fd == -1)
|
||||||
|
goto done;
|
||||||
|
if (ioctl(fd, TIOCCHKVERAUTH) == 0)
|
||||||
|
status = TS_CURRENT;
|
||||||
|
else
|
||||||
|
status = TS_OLD;
|
||||||
|
close(fd);
|
||||||
|
#endif
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
|
||||||
/* Read the record at the correct position. */
|
/* Read the record at the correct position. */
|
||||||
if ((nread = ts_read(cookie, &entry)) != sizeof(entry))
|
if ((nread = ts_read(cookie, &entry)) != sizeof(entry))
|
||||||
goto done;
|
goto done;
|
||||||
@@ -833,6 +861,18 @@ timestamp_update(void *vcookie, struct passwd *pw)
|
|||||||
goto done;
|
goto done;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (def_timestamp_type == kernel) {
|
||||||
|
#ifdef TIOCSETVERAUTH
|
||||||
|
int fd = open(_PATH_TTY, O_RDWR);
|
||||||
|
if (fd != -1) {
|
||||||
|
int secs = 60 * def_timestamp_timeout;
|
||||||
|
ioctl(fd, TIOCSETVERAUTH, &secs);
|
||||||
|
close(fd);
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
|
||||||
/* Update timestamp in key and enable it. */
|
/* Update timestamp in key and enable it. */
|
||||||
CLR(cookie->key.flags, TS_DISABLED);
|
CLR(cookie->key.flags, TS_DISABLED);
|
||||||
if (sudo_gettime_mono(&cookie->key.ts) == -1) {
|
if (sudo_gettime_mono(&cookie->key.ts) == -1) {
|
||||||
@@ -864,6 +904,17 @@ timestamp_remove(bool unlink_it)
|
|||||||
char *fname = NULL;
|
char *fname = NULL;
|
||||||
debug_decl(timestamp_remove, SUDOERS_DEBUG_AUTH)
|
debug_decl(timestamp_remove, SUDOERS_DEBUG_AUTH)
|
||||||
|
|
||||||
|
if (def_timestamp_type == kernel) {
|
||||||
|
#ifdef TIOCCLRVERAUTH
|
||||||
|
fd = open(_PATH_TTY, O_RDWR);
|
||||||
|
if (fd == -1)
|
||||||
|
ret = -1;
|
||||||
|
else
|
||||||
|
ioctl(fd, TIOCCLRVERAUTH);
|
||||||
|
#endif
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
|
||||||
if (asprintf(&fname, "%s/%s", def_timestampdir, user_name) == -1) {
|
if (asprintf(&fname, "%s/%s", def_timestampdir, user_name) == -1) {
|
||||||
sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
|
sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
|
||||||
ret = -1;
|
ret = -1;
|
||||||
|
Reference in New Issue
Block a user