isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,105 Commits 1 Branch 0 Tags
14ee65c5255f7bfbe5917c6c27d3be2f66a8e2c0
Commit Graph

2211 Commits

Author SHA1 Message Date
Todd C. Miller
14ee65c525 Add -M option to cvtsudoers to force the use of the local passwd 
and group databases when matching.
 2018-03-22 13:24:41 -06:00
Todd C. Miller
8a237eb07d Add cvtsudoers command line option to suppress certain parts of the 
security policy.  Can be used to suppress displaying of Defaults
entries, aliases or privileges.
 2018-03-22 11:38:39 -06:00
Todd C. Miller
af6e1cd7c6 Silence a false positive from the clang static analyzer. 2018-03-21 15:03:17 -06:00
Todd C. Miller
821e8a07da Silence a false positive from the clang static analyzer. 2018-03-21 14:55:17 -06:00
Todd C. Miller
fbed17e1a4 Fix memory leak on error path. 2018-03-21 14:43:17 -06:00
Todd C. Miller
e9512df6b6 regen 2018-03-21 13:33:44 -06:00
Todd C. Miller
bbd3e558b1 Move cvtsudoers string functions into cvtsudoers.c 2018-03-21 13:29:47 -06:00
Todd C. Miller
9ab5dc5f76 regen 2018-03-21 13:29:18 -06:00
Todd C. Miller
ff79de8592 Initial support filtering by user, group and host in cvtsudoers. 
Currently forces alias expansion when a filter is applied and the
entire matching user or host list is printed, even the non-matching
entries.  This effectively allows you to grep sudoers by user, group
and host.
 2018-03-21 12:24:11 -06:00
Todd C. Miller
bc5e2d06a7 Add free_default() to free a struct defaults pointer so we have a 
single place where we free the defaults.  A pointer to the previous
Default's binding may be passed in to avoid freeing an already free
binding.
 2018-03-21 12:11:19 -06:00
Todd C. Miller
910f288948 fix compilation on Solaris 2018-03-10 20:16:20 -07:00
Todd C. Miller
1cb5ab8b9c Make "sudoreplay -m 0" skip the pauses entirely. 2018-03-08 07:53:29 -07:00
Todd C. Miller
24f8e62e75 Update copyright date, remove unneeded include and add a few comments. 2018-03-06 15:59:31 -07:00
Todd C. Miller
e6c0d80fa8 Use fmtsudoers functions in testsudoers. 2018-03-06 15:09:21 -07:00
Todd C. Miller
81a373677a Add test for empty runas user list. 2018-03-06 14:39:11 -07:00
Todd C. Miller
3e7db48284 Don't print an empty user list as ALL. 2018-03-06 14:38:17 -07:00
Todd C. Miller
bb31544fcc In sudoers_format_userspecs make the separator optional and silence 
a printf format warning.
 2018-03-06 13:42:56 -07:00
Todd C. Miller
f984de1ba9 Use correct defines when checking for sysctl kinfo_proc support. 2018-03-06 12:05:07 -07:00
Todd C. Miller
bdbd102c9c Fix crash when converting sudoers entry with a runas list that is 
present but empty.
 2018-03-06 12:00:37 -07:00
Todd C. Miller
217e0a9b4b Less confusing sysctl checks for kinfo_proc. 2018-03-05 17:35:02 -07:00
Todd C. Miller
e26ef96a65 Add case_insensitive_group and case_insensitive_user sudoers options, 
which are enabled by default.
 2018-03-05 10:42:02 -07:00
Todd C. Miller
6014b4075c Kill dead store found by clang-analyzer. 2018-03-04 11:59:45 -07:00
Todd C. Miller
4874068070 Add tests for round-tripping sudoers -> ldif -> sudoers 2018-03-02 11:30:19 -07:00
Todd C. Miller
5c36f9dec3 Initial support for adding comments that will be emitted when 
sudoers is formatted.  Currently adds a comment for the source
sudoRole when converting from ldif -> sudoers.
 2018-03-04 07:03:43 -07:00
Todd C. Miller
670d8e6d77 Special case comment lines in lbufs. 2018-03-04 07:03:41 -07:00
Todd C. Miller
c9b70940cf When formatting as sudoers, flush the lbuf after each userspec. 2018-03-03 07:42:10 -07:00
Todd C. Miller
843213d3de Handle escaped commas when skipping over the cn. 2018-03-04 07:03:38 -07:00
Todd C. Miller
72dd971ee1 Add missing sudoOrder support to parse_ldif(). 2018-03-02 11:27:01 -07:00
Todd C. Miller
8c7f3e791c Add missing support for converting LOG_INPUT/LOG_OUTPUT tags and 
expand support for NOMAIL tags.
 2018-03-02 11:12:14 -07:00
Todd C. Miller
44fc165e7c Don't emit an empty sudoRole for global defaults if there are none. 2018-03-02 10:59:19 -07:00
Todd C. Miller
e96398cac2 Avoid changing the order of non-negated hosts and commands. 
We still put negated hosts/commands at the end of the list.
 2018-03-02 10:58:50 -07:00
Todd C. Miller
e750bae75d Handle parsing boolean options that have no explicit value. 2018-03-02 10:44:33 -07:00
Todd C. Miller
9af4447c3d Refactor the code that actually converts the role to sudoers format 
into role_to_sudoers() now that it is more involved than just calling
sudo_ldap_role_to_priv().
 2018-03-02 09:27:27 -07:00
Todd C. Miller
9b20bb1493 When merging two privileges, use the runas lists of the previous 
privilege when possible.  Otherwise, the generated sudoers line
will include a runas list for commands that is not necessary.
 2018-03-02 06:42:29 -07:00
Todd C. Miller
fff4acc1f7 Use a case-insensitive comparison when matching user and group names 
in sudoers with the passwd or group database.  This can be necessary
when users and groups are stored in AD or LDAP.
 2018-03-01 20:31:01 -07:00
Todd C. Miller
88bc4ba865 Fix clean target for *.sudo regress files 2018-03-01 10:35:32 -07:00
Todd C. Miller
8275ab873f Fix use of uninitialized variable (conf) if sudoers_debug_register() 
happens to fail.
 2018-03-01 10:18:48 -07:00
Todd C. Miller
73b5f961ee Split conversion code out of parse_ldif() and into ldif_to_sudoers(). 2018-02-28 16:21:09 -07:00
Todd C. Miller
8da213c8be Quiet a clang analyzer warning. 2018-02-28 14:44:54 -07:00
Todd C. Miller
120bb6de7f rename ldap_common.c -> ldap_util.c 2018-02-28 14:24:33 -07:00
Todd C. Miller
3a2ae844ec When converting from ldif to sudoers, sudoRole objects with the 
same user if possible.  If both user and host are the same, merge
into a single privilege.  This makes it possible to convert a
sudoers entry like:

    aaron shanty = NOEXEC: /usr/bin/vi, /usr/bin/more, EXEC: /bin/sh

to ldif and then back to sudoers as a single line.  Currently, the
ldif entries to be merged must have the same or adjacent sudoOrder
attributes.
 2018-02-28 14:02:50 -07:00
Todd C. Miller
56bdde1339 plug memory leaks 2018-02-28 14:02:11 -07:00
Todd C. Miller
7919b9ad2e When converting from LDAP to sudoers, put negated hosts and commands 
at the end of the list.  Since LDAP doesn't guarantee attribute order
we need to make sure negated entries always override non-negated ones.
 2018-02-25 06:30:32 -07:00
Todd C. Miller
6f097eb023 We may need the hostname to resolve %h escapes in include files. 2018-02-24 18:46:00 -07:00
Todd C. Miller
b3a0c3272b Setting a sudoOrder start point of 0 will disable creation of 
sudoOrder attributes in the resulting LDIF output.
 2018-02-24 14:35:38 -07:00
Todd C. Miller
111d79b53c Don't need to fill in struct sudo_user since we don't do matching. 2018-02-24 09:28:01 -07:00
Todd C. Miller
5999cfb906 Add support for setting default options in a config file. In 
addition to expand_aliases, input_format and output_format, both
the initial sudoOrder and the increment when updating sudoOrder for
subsequent sudoRole objects can be specified.  Command line options
have also been added for the start order and increment.
 2018-02-24 09:23:14 -07:00
Todd C. Miller
19502307aa Deal with user_name not being set in cvtsudoers. 2018-02-22 10:43:47 -07:00
Todd C. Miller
ceea24b965 Initial support for parsing sudoers LDIF files in cvtsudoers. 
This makes it possible to convert from LDAP sudoers to a traditional
sudoers file.  Semantic differences between file sudoers and LDAP
sudoers mean that LDIF -> sudoers is not completely equivalent.
 2018-02-22 09:53:12 -07:00
Todd C. Miller
8b22ed7837 Fix LDIF conversion of commands with an associated digest. 2018-02-21 21:24:53 -07:00