queue functions. This includes a private queue.h header derived
from FreeBSD. It is simpler to just use our own header rather than
try to deal with macros that may or may not be present in various
queue.h incarnations.
resemble GNU usage wrt long options. Sync usage and man page
SYNOPSYS sections and improve long options in the manual pages.
Now that we have long options we don't need to give the mnemonic
for the single-character options in the description.
just save RLIMIT_NPROC in exec_setup() before the final setuid()
and restore it immediately after. We don't need to modify RLIMIT_NPROC
for simple euid changes, just for changing the real (and saved)
uids before we exec. This also means we no longer need to worry
about _SC_CHILD_MAX returning -1. Bug #565
how a user's groups are looked up. Legal values are static (just
the kernel list from getgroups), dynamic (whatever the group database
includes) and adaptive (only use group db if kernel group list is
full).
wrapper that has an extra flag to check the saved_signals list to
only install the handler if the signal is not already ignored.
Bump plugin API version for the new front-end signal behavior.
the command. If we get SIGINT or SIGQUIT, call the plugin close()
functions as if the command was interrupted. If we get SIGTSTP,
uninstall the handler and deliver SIGTSTP to ourselves.
option to match. When set, commands are started in the background
and automatically foregrounded as needed. There are issues with
some ill-mannered programs (like Linux su) so this is not the
default.
MAXHOSTNAMELEN and the MIN/MAX macros. We now use PATH_MAX and
HOST_NAME_MAX throughout without falling back on MAXPATHLEN or
MAXHOSTNAMELEN and define our own MIN/MAX macros as needed.
This causes problems when setting RLIMIT_NPROC to RLIM_INFINITY due
to a bug in bash where bash tries to honor the value of _SC_CHILD_MAX
but treats a value of -1 as an error, and uses a default value of
32 instead.
Previously, we just checked RLIMIT_NPROC and, if it was unlimited,
restored the previous value of RLIMIT_NPROC. However, that makes
it impossible to set nproc to unlimited. We now only restore the
nproc resource limit if sysconf(_SC_CHILD_MAX) is negative. In
most cases, pam_limits will set RLIMIT_NPROC for us.
function so session setup can modify the user environment as needed.
For PAM authentication, merge the PAM environment with the user
environment at init_session time. We no longer need to swap in the
user_env for environ during session init, nor do we need to disable
the env hooks at init_session time.
hooks for getenv, putenv, setenv and unsetenv. This makes it
possible for the plugin to trap changes to the environment made by
authentication methods such as PAM or BSD auth so that such changes
are reflected in the environment passed back to sudo for execve().
