Todd C. Miller
38d884a62d
Do not compile intercept code if --disable-intercept is specified.
2021-09-01 13:35:47 -06:00
Todd C. Miller
9a690a8984
Switch to a 128-bit token instead of a 64-bit secret.
...
Protobuf doesn't have a 128-bit type so use two u64s.
We now support partial reads of the token.
2021-09-01 10:17:26 -06:00
Todd C. Miller
9137909c7d
sudo_intercept.so: send the secret immediately after connecting.
...
Sending the secret out of band, before the message size is read,
should make it harder to mount a DoS attack.
2021-08-31 16:33:54 -06:00
Todd C. Miller
a078bc64bb
Make the sudo side of the intercept socket non-blocking.
2021-08-31 07:46:58 -06:00
Todd C. Miller
3c26b92a75
Handle partial read/write by dropping back into the event loop.
2021-08-31 07:36:54 -06:00
Todd C. Miller
33d1b26c6a
intercept_check_policy: Fix double free introduced in last commit
...
If the command is not accepted we don't rebuild command_info[] and
must not free it. It will be freed by the policy instead.
2021-08-31 05:50:52 -06:00
Todd C. Miller
168d5c47c9
Update runcwd in command_info[] before passing it to the audit plugin.
...
Since sudoers does rejected commands itself the runcwd will still
not be correct for those.
2021-08-27 15:58:19 -06:00
Todd C. Miller
75bac8dee9
intercept_check_policy: fix potential NUL dereference on the error path.
2021-08-26 17:29:30 -06:00
Todd C. Miller
3d8b327c60
Fix use-after-free on error.
...
Also remove useless free of a ptr that is always NULL on the error path.
2021-08-26 10:07:50 -06:00
Todd C. Miller
d6a71fe32e
Fix command name of sub-command in logs when log_children is set.
2021-08-26 09:46:26 -06:00
Todd C. Miller
438a0cf07e
Add a state variable to intercept_closure, replaces policy_result.
2021-08-25 14:24:36 -06:00
Todd C. Miller
c465d8971d
Change intercept IPC to use a localhost socket instead of inherited fd.
...
This allows intercept mode to work with shells that close all open
fds upon startup. The ctor in sudo_intercept.so requests the port
number and secret over the socket inherited from the parent then
closes it. For each policy request, a TCP connection is made to
the sudo parent process to perform the policy check. Child processes
re-use the TCP socket to request the port number and secret just like
the initial process started by sudo does.
2021-08-25 14:24:36 -06:00
Todd C. Miller
448536e0f7
Fold intercept_closure_reset() into intercept_close().
2021-08-24 13:00:52 -06:00
Todd C. Miller
5d3ab032f2
intercept_fd_cb: store the passed fd in newfd, not fd
...
only affects the old BSD-style fd passing code, not POSIX-style.
2021-08-19 13:10:44 -06:00
Todd C. Miller
340d753947
Fix memory leak when client requests secret.
...
Move closure allocation closer to where it is used.
2021-08-14 08:54:36 -06:00
Todd C. Miller
a55b54329e
Add missing stdint.h and sudo_rand.h includes.
...
Needed for arc4random() and uin64_t.
2021-08-13 09:25:01 -06:00
Todd C. Miller
eaf03a382b
Pass a secret value to sudo_intercept.so and verify after policy check.
...
The goal is to make it harder for someone to have a fake policy checker.
This will not stop a determined adversary since the secret is present
in the address space of the running process.
2021-08-13 09:10:44 -06:00
Todd C. Miller
c9d9225469
Split off intercept code into exec_intercept.c.
2021-08-11 16:00:47 -06:00
