isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,193 Commits 1 Branch 0 Tags
2dd1e1907d1b19f4d08476c778bb6903eff08e6f
Commit Graph

164 Commits

Author SHA1 Message Date
Todd C. Miller
23b7a1fa5c Call the policy's init_session() function before we fork the child. 
That way, the session is created and destroyed in the same process,
which is needed by some modules, such as  pam_mount.
 2012-04-23 16:38:16 -04:00
Todd C. Miller
df04ccb207 Linux select() may return ENOMEM if there is a kernel resource 
shortage.  Older Solaris select() may return EIO instead of EBADF
when the tty goes away.  If we get an unhandled select() failure,
kill the child and exit cleanly.
 2012-04-10 10:18:39 -04:00
Todd C. Miller
c8ce3a0a85 Log the process id in the debug file output. Since we don't want 
to keep calling getpid(), stash the value at init time and when we
fork().
 2012-04-06 15:20:16 -04:00
Todd C. Miller
6f4afc6652 If select() return EBADF in the main event loop, one of the ttys 
must have gone away so perform any I/O we can and close the bad
fds.
 2012-04-05 12:39:46 -04:00
Todd C. Miller
aecb5206e2 Fix compiler warnings on some platforms and provide a better method 
of defeating gcc's warn_unused_result attribute.
 2012-03-29 10:33:40 -04:00
Todd C. Miller
55d1a1a79d Use ecalloc() when allocating structs. 2012-03-19 11:24:24 -04:00
Todd C. Miller
1877c455d1 The change in 818e82ecbbfc that caused to exit when the monitor 
dies created a race condition between the monitor exiting and the
status being read.  All we really want to do is make sure that
select() notifies us that there is a status change when the monitor
dies unexpectedly so shutdown the socketpair connected to the monitor
for writing when it dies.  That way we can still read the status
that is pending on the socket and select() on Linux will tell us
that the fd is ready.
 2012-01-25 16:29:08 -05:00
Todd C. Miller
d11e7febbc Refactor disable_execute() and my_execve() into exec_common.c for 
use by sesh.c.  This fixes NOEXEC when SELinux is used.  Instead
of disabling exec in exec_setup(), disable it immediately before
executing the command.  Adapted from a diff by Arno Schuring.
 2012-01-25 14:58:02 -05:00
Todd C. Miller
2fd77381a1 When not logging I/O, use a signal handler that only forwards SIGINT, 
SIGQUIT and SIGHUP when they are user-generated signals.  Fixes a
race in the non-I/O logging path where the command may receive two
keyboard-generated signals; one from the kernel and one from the
sudo process.
 2012-01-17 10:27:33 -05:00
Todd C. Miller
97cecaf6eb Back out change that put the command in its own pgrp when not logging 
I/O.  It causes problems with pipelines.
 2012-01-17 10:25:44 -05:00
Todd C. Miller
0771c981de Update copyright year. 2012-01-06 14:23:55 -05:00
Todd C. Miller
5bc0756406 When not logging I/O, put command in its own pgrp and make that the 
controlling pgrp if the command is in the foreground.  Fixes a race
in the non-I/O logging path where the command may receive two
keyboard-generated signals; one from the kernel and one from the
sudo process.
 2012-01-03 10:06:07 -05:00
Todd C. Miller
1f97735fbb Fix typo in visiblepw description; from Joel Pickett 2011-12-18 14:20:56 -05:00
Todd C. Miller
98c77b5b96 Handle different Unix domain socket (actually socketpair) semantics 
in BSD vs. Linux.  In BSD if one end of the socketpair goes away
select() returns the fd as readable and the read will fail with
ECONNRESET.  This doesn't appear to happen on Linux so if we notice
that the monitor process has died when I/O logging is enabled,
behave like the command has exited.  This means we log the wait
status of the monitor, not the command, but there is nothing else
we can do at that point.  This should only be an issue if SIGKILL
is sent to the monitor process.
 2011-12-08 11:18:38 -05:00
Todd C. Miller
0e26e43b99 Remove duplicate return statements. 2011-12-02 15:23:42 -05:00
Todd C. Miller
21a2f95821 Use stdbool.h instead of rolling our own TRUE/FALSE macros. 2011-12-02 11:27:33 -05:00
Todd C. Miller
a64f1eaea8 Do not close error pipe or debug fd via closefrom() as we need them 
to report an exec error should one occur.
 2011-11-29 19:51:24 -05:00
Todd C. Miller
3ee9cef0da Fold SUDO_DEBUG_PROGERR and SUDO_DEBUG_SYSERR into SUDO_DEBUG_ERROR 2011-11-07 16:33:49 -05:00
Todd C. Miller
ab75dd2e30 Get rid of done: label. If the child exits we still need to close 
the pty, update utmp and restore the SELinux tty context.
 2011-10-24 11:14:20 -04:00
Todd C. Miller
839919566e Add debug_decl/debug_return (almost) everywhere. 
Remove old sudo_debug() and convert users to sudo_debug_printf().
 2011-10-22 14:40:21 -04:00
Todd C. Miller
d81c14005f Silence compiler warnings on Solaris with gcc 3.4.3 2011-08-23 16:42:18 -04:00
Todd C. Miller
3c9e5f28fc Fix compressed io log corruption in background mode by using _exit() 
instead of exit() to avoid flushing buffers twice.

Improved background mode support.  When not allocating a pty, the
command is run in its own process group.  This prevents write access
to the tty.  When running in a pty, stdin is not hooked up and we
never read from /dev/tty, which results in similar behavior.
 2011-05-31 12:49:22 -04:00
Todd C. Miller
1b67009ca1 Always allocate a pty when running a command in the background but 
call setsid() after forking to make sure we don't end up with a
controlling tty.
 2011-05-27 15:20:20 -04:00
Todd C. Miller
7960bde2db Minor warning/error message cleanup 2011-05-18 13:04:24 -04:00
Todd C. Miller
fce0b906eb cannot -> "unable to" in warning/error messages 2011-05-18 12:41:06 -04:00
Todd C. Miller
917c8d48ad We don't want to translate debugging messages. 2011-05-17 18:37:18 -04:00
Todd C. Miller
c865a462cc Prepare sudo front end messages for translation. 2011-05-06 17:47:51 -04:00
Todd C. Miller
240642399b Save the controlling tty process group before suspending so we can 
restore it when we resume.  Fixes job control problems on Linux
caused by the previous attemp to fix resuming a shell when I/O
logging not enabled.
 2011-03-16 12:02:04 -04:00
Todd C. Miller
3506f01077 Add support for controlling whether utmp is updated and which user is 
listed in the entry.
 2011-03-15 15:53:49 -04:00
Todd C. Miller
53da5e8cdf Update copyright years. 2011-03-11 15:34:35 -05:00
Todd C. Miller
c7a7d31905 Add support for disabling exec via solaris privileges. 
Includes preparation for moving noexec support out of sudoers
and into front end as documented.
 2011-03-10 14:24:10 -05:00
Todd C. Miller
caefd1abdc In handle_signals(), restart the read() on EINTR to make sure we keep up 
with the signal pipe.  Don't return -1 on EAGAIN, it just means we have
emptied the pipe.
 2011-03-09 11:28:51 -05:00
Todd C. Miller
1496bfed6c Add support for adding a utmp entry when allocating a new pty. 
Requires the BSD login(3) or SYSV/POSIX getutent()/getutxent().
Currently only creates a new entry if the existing tty has
a utmp entry.
 2011-03-08 15:37:40 -05:00
Todd C. Miller
39d9feb438 The howmany macro lives in sys/sysmacros.h on SVR5 systems 
Closes Bug 470
 2011-02-19 08:23:46 -05:00
Todd C. Miller
a099aa7f2a SVR5 systems return non-zero for success on socketpair(), 
check for -1 instead.  Closes Bug 469
 2011-02-19 08:13:17 -05:00
Todd C. Miller
056cb8a5da Remove duplicate FD_SET of signal_pipe[0] 2011-02-06 16:55:21 -05:00
Todd C. Miller
5fc2f8f454 Pass SIGUSR1/SIGUSR2 through to the child. 2011-02-03 10:25:42 -05:00
Todd C. Miller
34a087acf6 Use pid_t not int and check the return value of kill() 2011-02-03 09:20:34 -05:00
Todd C. Miller
29f9e23c84 In non-pty mode before continuing the child, make it the foreground 
pgrp if possible.  Fixes resuming a shell.
 2011-02-02 14:19:23 -05:00
Todd C. Miller
c18468d1a5 Save signal state before changing handlers and restore before 
we execute the command.
 2011-02-02 12:44:35 -05:00
Todd C. Miller
c833ff02b6 Add use_pty command_info flag for policies to indicate that a 
pty should be allocated even if no I/O logging is performed.
 2010-12-20 16:27:46 -05:00
Todd C. Miller
a11e4c8d72 If perform_io() fails, kill the child before exiting so it doesn't 
complain about connection reset.  We can get an I/O error if, for
example, and we get EIO reading from stdin.
 2010-10-15 16:24:42 -04:00
Todd C. Miller
413b7b55d1 Add missing signal_pipe[0] to fdsr for the non-pty case. 2010-10-01 12:03:47 -04:00
Todd C. Miller
c04f48b4bf Quiet gcc warnings on glibc systems that use warn_unused_result for 
write(2).
 2010-09-11 09:26:09 -04:00
Todd C. Miller
66bea8c4c9 Read as many signals on the signal pipe as we can before returning. 2010-09-10 11:27:20 -04:00
Todd C. Miller
59399d55c3 Instead of using a array to store received signals, open a pipe and 
have the signal handler write the signal number to one end and
select() on the other end.  This makes it possible to handle signals
similar to I/O without race conditions.
 2010-09-10 11:20:32 -04:00
Todd C. Miller
2cef2bb5b0 When not logging I/O install a handler for SIGCONT and deliver it 
to the command upon resume.  Fixes bugzilla #431
 2010-08-24 08:42:47 -04:00
Todd C. Miller
e11e4efb8f Do I/O logging in the C locale so the floating point numbers in the 
timing file are not locale-dependent.
 2010-07-27 09:45:20 -04:00
Todd C. Miller
30fe4a067c Set usrinfo for AIX 
Set adminstrative domain for the process when looking up user's
    password or group info and when preparing for execve().
Include strings.h even if string.h exists since they may define
    different things.  Fixes warnings on AIX and others.
 2010-06-29 13:08:05 -04:00
Todd C. Miller
d018936b4e Move functions and symbols shared between exec.c and exec_pty.c 
into sudo_exec.h.
 2010-06-16 16:46:56 -04:00