isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,390 Commits 1 Branch 0 Tags
30f7ecca10c0f36cea91c58f30d4db2f22a754d9
Commit Graph

160 Commits

Author SHA1 Message Date
Todd C. Miller
05bfd66693 If the invoking user cannot be resolved by uid fake the struct 
passwd and store it in the cache so we can delref it on exit.
 2011-09-25 06:35:40 -04:00
Todd C. Miller
47af0fc2b8 Add configure test for missing errno declaration and only 
declare it ourselves if it is missing.
 2011-08-30 10:05:30 -04:00
Todd C. Miller
80138c88ba Remove fallback to per-group lookup when matching groups in sudoers. 
The sudo front-end will now use getgrouplist() to get the user's
list of groups if getgroups() fails or returns zero groups so we
always have a list of the user's groups.  For systems with
mbr_check_membership() which support more that NGROUPS_MAX groups
(Mac OS X), skip the call to getgroups() and use getgrouplist() so
we get all the groups.
 2011-07-25 09:17:18 -04:00
Todd C. Miller
3dde167cf6 user_group is no longer used, remove it 2011-07-22 09:29:49 -04:00
Todd C. Miller
022591f4bf Add a wrapper for setgroups() that trims off extra groups and retries 
if setgroups() fails.  Also add some missing addrefs for PERM_USER
and PERM_FULL_USER.
 2011-07-20 16:54:12 -04:00
Todd C. Miller
b124635b04 Instead of keeping separate groups and gids arrays, create struct 
group_info and use it to store both, along with a count for each.
Cache group info on a per-user basis using getgrouplist() to get
the groups.  We no longer need special to special case the user or
list user for user_in_group() and thus no longer need to reset the
groups list when listing another user.
 2011-07-20 11:58:45 -04:00
Todd C. Miller
56321ec778 Resolve the list of gids passed in from the sudo frontend (the 
result of getgroups()) to names and store both the group names and
ids in the sudo_user struct.  When matching groups in the sudoers
file, match based on the names in the groups list first and
only do a gid-based match when we absolutely have to.  By matching
on the group name (as it is listed in sudoers) instead of id
(which we would have to resolve) we save a lot of group lookups
for sudoers files with a lot of groups in them.
 2011-07-01 14:13:47 -04:00
Todd C. Miller
bf7e7b5752 Add gettext.h convenience header. This is similar to but distinct from 
the one included with the gettext package.
 2011-05-20 11:48:17 -04:00
Todd C. Miller
c3a259f5ee Add calls to bindtextdomain() and textdomain() 
Currently there are two domains, one for the sudo front-end and
one for the sudoers plugin and its associated utilities.
 2011-05-17 16:38:40 -04:00
Todd C. Miller
15bc74bd67 Include libint.h where needed. 2011-05-16 16:37:11 -04:00
Todd C. Miller
cde2cb00f0 Add "user_shell" boolean as a way to indicate to the plugin that 
the -s flag was given.
 2011-03-11 15:02:13 -05:00
Todd C. Miller
6e2778eb22 Move sessid out of sudo_user. 2011-03-11 14:07:26 -05:00
Todd C. Miller
383aef00b1 Log the TSID even if it is not a simple session ID. 2011-03-11 12:11:05 -05:00
Todd C. Miller
a092d2fdcf Move noexec handling to sudo front-end where it is documented as being. 2011-03-10 15:11:49 -05:00
Todd C. Miller
3c0672e2e3 Allow sudoers file name, mode, uid and gid to be specified in the 
settings list.  The sudo front end does not currently set these
but may in the future.
 2011-02-23 13:38:52 -05:00
Todd C. Miller
f7f8b6867e Update copyright year to 2011 2011-01-20 16:46:56 -05:00
Todd C. Miller
1bb3518b33 Add extra out parameter to expand_iolog_path() to allow the caller 
to split the path into dir and file components if needed.
 2010-12-31 09:55:40 -05:00
Todd C. Miller
25036d7a75 Pass a single I/O log file name in command_details instead of 
separate dir + file parameters.
 2010-12-30 17:09:01 -05:00
Todd C. Miller
97b7ae8892 If no iolog file is specified by the policy plugin, use io_nextid() 
to determine the next file in the sequence.
 2010-12-29 11:07:45 -05:00
Todd C. Miller
fba58fa3f7 Allow sudoers to specify the iolog file in addition to the iolog dir. 
Add escape sequence support to iolog file and dir: sequence number,
    user, group, runas_user, runas_group, hostname and command in
    addition to any escape sequence recognized by strftime(3).
 2010-12-27 12:18:32 -05:00
Todd C. Miller
26d71ded7b It is now plugin_cleanup(), not cleanup() 2010-11-12 13:03:28 -05:00
Todd C. Miller
0c38f1460d Make local includes consistent; use double quotes for local includes 
except for generated ones where we use angle brackets.
 2010-09-07 18:28:22 -04:00
Todd C. Miller
88f9fea400 g/c unused auth_pw extern definition 2010-08-21 10:02:50 -04:00
Todd C. Miller
f454727bb8 Merge compat.h and missing.h into missing.h 2010-08-16 14:05:44 -04:00
Todd C. Miller
6bcd9efc0c Use gettimeofday() directly instead of via the gettime() wrapper. 2010-08-10 13:50:40 -04:00
Todd C. Miller
0186018d3d Reference count cached passwd and group structs. The cache holds 
one reference itself and another is added by sudo_getgr{gid,nam}
and sudo_getpw{uid,nam}.  The final ref on the runas and user passwd
and group structs are persistent for now.
 2010-08-04 09:58:50 -04:00
Todd C. Miller
d9de7b5f8e Add support for a sudo-i pam.d file to be used for "sudo -i". 
Adapted from a RedHat patch.
 2010-07-12 17:57:53 -04:00
Todd C. Miller
e6b48d415c Replace built-in non-unix group support with a sudoers group plugin. 
Include a sample plugin that can read Unix-format group files.
 2010-07-02 11:11:25 -04:00
Todd C. Miller
30fe4a067c Set usrinfo for AIX 
Set adminstrative domain for the process when looking up user's
    password or group info and when preparing for execve().
Include strings.h even if string.h exists since they may define
    different things.  Fixes warnings on AIX and others.
 2010-06-29 13:08:05 -04:00
Todd C. Miller
9a16dc514d Add stub declarations for struct stat and struct timeval 2010-06-16 17:10:04 -04:00
Todd C. Miller
b72a530fd0 Update copyright year 2010-06-14 12:19:49 -04:00
Todd C. Miller
3430618c78 Make all functions in ldap.c static 2010-06-14 10:37:42 -04:00
Todd C. Miller
eec336115a Move askpass path specification from sudoers to sudo.conf. 2010-06-09 17:40:44 -04:00
Todd C. Miller
39e072c713 Make env_init() void as it never fails. 2010-06-08 10:23:35 -04:00
Todd C. Miller
b6f02f38c0 Make sudoers_io functions static to iolog.c 2010-05-29 10:43:34 -04:00
Todd C. Miller
7e6d1d1f7d Add init_session function to struct policy_plugin that gets called 
before the uid/gid/etc changes.  A struct passwd pointer is passed in,which may be NULL if the user does not exist in the passwd database.The sudoers module uses init_session to open the pam session as needed.
 2010-05-27 14:46:39 -04:00
Todd C. Miller
27be96c9cd Add open/close session to sudo auth, only used by PAM. 
This allows us to open (and close) the PAM session from sudoers.
 2010-05-26 17:57:47 -04:00
Todd C. Miller
0487aee6b4 Bring back closefrom settings. 2010-05-24 15:40:36 -04:00
Todd C. Miller
60e0e496ef If running a command or sudoedit in transcript mode, call io_nextid() 
before log_allowed() so the session id is logged.
 2010-05-24 14:30:54 -04:00
Todd C. Miller
55ef027d88 Add argc and argv to I/O logger open function. 2010-05-17 10:38:56 -04:00
Todd C. Miller
d5bfd148d6 Make find_path() a little more generic by not checking def_foo 
variables inside it.  Instead, pass in ignore_dot as a function
argument.
 2010-05-13 10:27:03 -04:00
Todd C. Miller
9fbec34fed Add pointer to a printf like function to plugin open functon. 
This can be used instead of the conversation function to display
info and error messages.
 2010-05-04 19:17:31 -04:00
Todd C. Miller
13966481c7 Add print_error() function that uses the conversation function to 
print a variable number of error strings and use it in log_error().
 2010-05-03 16:53:05 -04:00
Todd C. Miller
b041c91caf Re-enable environment files and setting environment variables on the 
command line.
 2010-04-26 17:14:11 -04:00
Todd C. Miller
4b04e875ed Move fileops.c defines and prototypes to filesops.h 2010-04-23 06:02:39 -04:00
Todd C. Miller
c17d3e061d Remove extraneous bits and classify by source file. 2010-04-22 17:40:01 -04:00
Todd C. Miller
6a27866c30 get_boottime() now fills in a timeval struct 2010-04-22 10:33:16 -04:00
Todd C. Miller
1bb9f62143 Convert perm setting to push/pop model; still needs some work 
Use the stashed runas groups instead of using getgrouplist()
Reset perms to the initial value on error
 2010-04-20 17:00:31 -04:00
Todd C. Miller
b4a26b7691 Use timeval directly instead of converting to timespec when dealing 
with file times and time of day.
 2010-04-20 16:44:02 -04:00
Todd C. Miller
257133328d Ansify env.c 2010-04-17 13:28:36 -04:00