isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,041 Commits 1 Branch 0 Tags
048b843e6d37bc3ee9f9ab73ca91ae7477d5fb2e
Commit Graph

107 Commits

Author SHA1 Message Date
Todd C. Miller
048b843e6d Use @intercept_file@ and @noexec_file@ like the example file. 2022-12-26 15:32:36 -07:00
Todd C. Miller
772fc914a8 There is a @pam_login_service@ substitution but no @pam_service@. 
Just use sudo instead of @pam_service@.
 2022-12-26 15:26:13 -07:00
Todd C. Miller
eeea67e70b Use @sudoers_plugin@ instead of @sudoers_module@. 2022-12-26 13:56:43 -07:00
Todd C. Miller
f6e0e87ba9 sudo 1.9.13 
Document the changes to AIX plugins in docs/UPGRADE.md and regenerate
configure using the latest autoconf from git.
 2022-12-26 10:47:51 -07:00
Todd C. Miller
50958a05da Remove developer mode from sudo.conf, it is no longer used. 2022-12-26 07:43:55 -07:00
Todd C. Miller
206700c3f0 Use AIX-style shared libraries on AIX by default instead of SVR4-style. 
This removes the need to use the -brtl linker flag which can cause
problems when there are both a .so and .a version of the same library
but with different versions.  This was particularly problematic
when using the AIX freeware version of OpenSSL.  The --with-aix-soname=svr4
option can be used to build SVR4-style shared libs instead.
 2022-12-26 07:43:55 -07:00
Todd C. Miller
11aa808ef7 Use ".Sy root" instead of ".Em root" when talking about the root user. 
Replace MANDOCPROG with "mandoc" now that MANDOCPROG has been removed.
 2022-12-25 10:53:40 -07:00
Todd C. Miller
3040bf54c9 Mention the "list" privilege in the description of the -U option. 2022-12-20 09:18:46 -07:00
Todd C. Miller
eada918bbb Add [arg ...] after command in SYNOPSIS and usage output. 
Use Ar markup when referring to the command and args.
 2022-12-20 09:09:25 -07:00
Todd C. Miller
2f32b45d59 New Albanian translation from translationproject.org 2022-12-17 11:11:31 -07:00
Todd C. Miller
c184a241a2 Mention the audit plugin in the "Process model" section. 
Remove extraneous information describing how sudo may exec the
command directly, this is already included in the non-pty section.
 2022-12-12 16:35:00 -07:00
Todd C. Miller
a514a6eed5 Add "list" pseudo-command to allow a user to list another user's 
privs.  Previously, only root or a user with the ability to run any
command as either root or the target user on the current host could
use the -U option.  For "sudo -l [-U otheruser] command", NewArgv[0]
is now set to "list" (just like "sudo -l") and the actual command
to be checked starts with NewArgv[1].
 2022-12-11 13:46:00 -07:00
Todd C. Miller
95a6731ff1 Add CODEOWNERS file, currently all owned by @millert. 2022-12-08 14:00:29 -07:00
Todd C. Miller
d744271a63 Make it clear that runas_default sets the default user for Runas_Spec. 
Also use mention runas_default in other parts of the manual, use
@runas_default@ instead of root and add markup around user names.
GitHub issue #186.
 2022-10-20 08:08:48 -06:00
Todd C. Miller
57b5ff8e8c Avoid a -Wshadow warning on Solaris 9. 2022-10-07 11:00:17 -06:00
Todd C. Miller
fa952bfbb7 Add -I flag to disable editing include files unless there is an error. 
This can be used when you only want to edit a single sudoers file
unless there is a pre-existing syntax error.
 2022-10-04 16:11:45 -06:00
Todd C. Miller
6cd99d0b71 Improve the description of JSON output. 2022-09-29 10:52:32 -06:00
Todd C. Miller
87b7209ebb Add support for logging stdin/stdout/stderr in the non-pty exec path. 
If we are logging I/O but not terminal input/output (either because
no terminal is present or because that is what the plugin requested),
the non-pty exec path is now taken.
 2022-09-27 13:46:55 -06:00
Todd C. Miller
88ac5e09b6 Use sudo_secure_open_file() instead of sudo_secure_file() where possible. 
Both sudo_secure_open_file() and sudo_secure_open_dir() are now passed
a struct stat pointer like sudo_secure_file() and sudo_secure_dir().
 2022-09-21 19:08:10 -06:00
Todd C. Miller
ce387a6849 Split log_{input,output} into log_{stdin,ttyin} and log_{ttyout,stdout,stderr} 
If log_input is set, log_{stdin,ttyin} will be set as well.
If log_output is set, log_{stdout,stderr,ttyout} will be set as well.
This provides more fine-grained control over I/O logging and makes it
possible to disable logging piped or redirected intput or output.
 2022-09-20 14:35:12 -06:00
Todd C. Miller
c341608072 Remove most uses of the deprecated Li macro which has no effect. 
Also fix some other incorrect markup.
 2022-09-13 19:56:45 -06:00
Todd C. Miller
3194d16674 Document apparmor_profile, intercept_verify, and update_ticket. 2022-09-11 19:06:26 -06:00
Todd C. Miller
5bcec02442 Fix some of the markup to be more consistent with sudo_plugin.mdoc.in. 
Also reword a few awkward phrases.
 2022-09-11 19:06:25 -06:00
Todd C. Miller
a7b200d014 Use correct markup of function arguments and struct members. 
Also remove most uses of the deprecated Li macro which has no effect.
 2022-09-11 19:06:24 -06:00
Todd C. Miller
3f6ffead0b Move the init_session() errstr description to where it belongs. 2022-09-11 19:06:23 -06:00
Todd C. Miller
b85f95cb30 Fix a typo 2022-09-11 19:06:22 -06:00
Todd C. Miller
67be673856 Mention how to restore the historic core resource limit behavior. 2022-09-03 09:50:00 -06:00
Todd C. Miller
21b48a3034 Fix typo. 2022-09-02 15:22:40 -06:00
Todd C. Miller
159bdb1cb7 Document cvtsudoers CSV output format 2022-09-02 14:01:43 -06:00
Todd C. Miller
37ae66062d Document cvtsudoers JSON output format 2022-08-31 11:33:04 -06:00
Todd C. Miller
caa0408a8a intercept_verify is fast, but the policy check is (relatively) slow. 2022-08-29 14:10:49 -06:00
Todd C. Miller
922772c6cb Rework the intercept section in "Preventing shell escapes". 2022-08-25 19:01:59 -06:00
Todd C. Miller
966eae6bf3 intercept_verify also compares the environment. 
Also mention the overhead involved in checking things.
 2022-08-23 11:12:51 -06:00
Todd C. Miller
158facf6d5 Use multilib rules to look for a 64-bit group plugin on failure. 
If sudo_dso_load() fails on a 64-bit system, try to load a 64-bit
native version of the file using system-dependent multilib rules.
If we don't support multilib on the platform, check for a version
of the file that ends in "64" before the .so suffix.
 2022-08-11 19:34:50 -06:00
Todd C. Miller
68b26056f9 regen 2022-08-11 19:34:48 -06:00
Todd C. Miller
9c61d7e6e9 Bump the sudo plugin minor version. 
The "update_ticket" entry was added to the settings list and the
"intercept_verify" entry was added to the command_info list.
 2022-08-02 14:28:29 -06:00
Todd C. Miller
556dacf1ff Add a way to run a command without updating the cached credentials. 
This can also be used to test for whether or not the user's
credentials are currently cached.
 2022-08-02 14:28:28 -06:00
Todd C. Miller
4de5e12ddb Document the TOCTOU issue with intercept mode. 
Describe how intercept_verify attempts to reduce the risk.
 2022-07-29 20:18:55 -06:00
Todd C. Miller
3ce19efca9 Add intercept_verify sudoers option to control execve(2) argument checking. 2022-07-29 15:22:27 -06:00
Todd C. Miller
308a6c31d9 Sync with schema.OpenLDAP for user/group utf8 support. 2022-07-25 11:02:47 -06:00
William Brown
7f9ea23e74 Update sudoUser to be utf8 in ldap schemas 
In most unix-style LDAP servers, uid is a utf8 string defined by
OID 1.3.6.1.4.1.1466.115.121.1.15. However, sudoUser was defined
as an IA5 String (OID 1.3.6.1.4.1.1466.115.121.1.26) which meant
that sudoUser could only represent a subset of possible values.

In some cases when using sudoers.ldap, the uid from the machine
which was utf8 was fed back into sudo which would then issue a
search for sudoUsers. If this uid contained utf8 characters, the
ldap server would refuse to match into sudoUsers because these
were limited to IA5.

This is a safe-forward upgrade as IA5 is a subset of UTF8 meaning
that this change will not impact existing deployments and their
rules.
 2022-07-25 15:21:39 +10:00
Helio Machado
d60b6c618f Improve Tag_Spec EBNF documentation 2022-06-07 17:24:45 +02:00
Helio Machado
3405fac05e Add missing colon in Tag_Spec documentation 2022-06-07 16:28:14 +02:00
Todd C. Miller
fcb5867f1d Document how setting ModulePath affects the Python search path. 
Also advise the user to use a unique prefix to avoid name space
collisions with installed Python modules.  Bug #1031.
 2022-06-06 08:39:22 -06:00
Todd C. Miller
96c3c28194 Add EXAMPLES variables for use in the man pages for the examples directory. 2022-06-06 08:36:44 -06:00
Todd C. Miller
77a47affb4 Install the plugin man pages in section 5 (or 4 for System V). 
The manual had the correct section in the text but was installed
in the wrong directory.
 2022-06-01 10:02:34 -06:00
Todd C. Miller
f52342031d Add support for intercepting the system(3) function. 
This also means we can log system(3) with log_subcmds.
 2022-05-31 14:45:00 -06:00
Todd C. Miller
6eda28ef51 Fix typo 2022-05-27 13:08:01 -06:00
Todd C. Miller
789bc6ec8e Update contributors. 2022-05-27 12:42:40 -06:00
Todd C. Miller
f16754a1dd Merge branch 'main' into apparmor_support 2022-05-27 08:25:12 -06:00