isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,881 Commits 1 Branch 0 Tags
51a1a7d63fb0ac642b6686be150f825ebdea227b
Commit Graph

93 Commits

Author SHA1 Message Date
Todd C. Miller
57b5ff8e8c Avoid a -Wshadow warning on Solaris 9. 2022-10-07 11:00:17 -06:00
Todd C. Miller
fa952bfbb7 Add -I flag to disable editing include files unless there is an error. 
This can be used when you only want to edit a single sudoers file
unless there is a pre-existing syntax error.
 2022-10-04 16:11:45 -06:00
Todd C. Miller
6cd99d0b71 Improve the description of JSON output. 2022-09-29 10:52:32 -06:00
Todd C. Miller
87b7209ebb Add support for logging stdin/stdout/stderr in the non-pty exec path. 
If we are logging I/O but not terminal input/output (either because
no terminal is present or because that is what the plugin requested),
the non-pty exec path is now taken.
 2022-09-27 13:46:55 -06:00
Todd C. Miller
88ac5e09b6 Use sudo_secure_open_file() instead of sudo_secure_file() where possible. 
Both sudo_secure_open_file() and sudo_secure_open_dir() are now passed
a struct stat pointer like sudo_secure_file() and sudo_secure_dir().
 2022-09-21 19:08:10 -06:00
Todd C. Miller
ce387a6849 Split log_{input,output} into log_{stdin,ttyin} and log_{ttyout,stdout,stderr} 
If log_input is set, log_{stdin,ttyin} will be set as well.
If log_output is set, log_{stdout,stderr,ttyout} will be set as well.
This provides more fine-grained control over I/O logging and makes it
possible to disable logging piped or redirected intput or output.
 2022-09-20 14:35:12 -06:00
Todd C. Miller
c341608072 Remove most uses of the deprecated Li macro which has no effect. 
Also fix some other incorrect markup.
 2022-09-13 19:56:45 -06:00
Todd C. Miller
3194d16674 Document apparmor_profile, intercept_verify, and update_ticket. 2022-09-11 19:06:26 -06:00
Todd C. Miller
5bcec02442 Fix some of the markup to be more consistent with sudo_plugin.mdoc.in. 
Also reword a few awkward phrases.
 2022-09-11 19:06:25 -06:00
Todd C. Miller
a7b200d014 Use correct markup of function arguments and struct members. 
Also remove most uses of the deprecated Li macro which has no effect.
 2022-09-11 19:06:24 -06:00
Todd C. Miller
3f6ffead0b Move the init_session() errstr description to where it belongs. 2022-09-11 19:06:23 -06:00
Todd C. Miller
b85f95cb30 Fix a typo 2022-09-11 19:06:22 -06:00
Todd C. Miller
67be673856 Mention how to restore the historic core resource limit behavior. 2022-09-03 09:50:00 -06:00
Todd C. Miller
21b48a3034 Fix typo. 2022-09-02 15:22:40 -06:00
Todd C. Miller
159bdb1cb7 Document cvtsudoers CSV output format 2022-09-02 14:01:43 -06:00
Todd C. Miller
37ae66062d Document cvtsudoers JSON output format 2022-08-31 11:33:04 -06:00
Todd C. Miller
caa0408a8a intercept_verify is fast, but the policy check is (relatively) slow. 2022-08-29 14:10:49 -06:00
Todd C. Miller
922772c6cb Rework the intercept section in "Preventing shell escapes". 2022-08-25 19:01:59 -06:00
Todd C. Miller
966eae6bf3 intercept_verify also compares the environment. 
Also mention the overhead involved in checking things.
 2022-08-23 11:12:51 -06:00
Todd C. Miller
158facf6d5 Use multilib rules to look for a 64-bit group plugin on failure. 
If sudo_dso_load() fails on a 64-bit system, try to load a 64-bit
native version of the file using system-dependent multilib rules.
If we don't support multilib on the platform, check for a version
of the file that ends in "64" before the .so suffix.
 2022-08-11 19:34:50 -06:00
Todd C. Miller
68b26056f9 regen 2022-08-11 19:34:48 -06:00
Todd C. Miller
9c61d7e6e9 Bump the sudo plugin minor version. 
The "update_ticket" entry was added to the settings list and the
"intercept_verify" entry was added to the command_info list.
 2022-08-02 14:28:29 -06:00
Todd C. Miller
556dacf1ff Add a way to run a command without updating the cached credentials. 
This can also be used to test for whether or not the user's
credentials are currently cached.
 2022-08-02 14:28:28 -06:00
Todd C. Miller
4de5e12ddb Document the TOCTOU issue with intercept mode. 
Describe how intercept_verify attempts to reduce the risk.
 2022-07-29 20:18:55 -06:00
Todd C. Miller
3ce19efca9 Add intercept_verify sudoers option to control execve(2) argument checking. 2022-07-29 15:22:27 -06:00
Todd C. Miller
308a6c31d9 Sync with schema.OpenLDAP for user/group utf8 support. 2022-07-25 11:02:47 -06:00
William Brown
7f9ea23e74 Update sudoUser to be utf8 in ldap schemas 
In most unix-style LDAP servers, uid is a utf8 string defined by
OID 1.3.6.1.4.1.1466.115.121.1.15. However, sudoUser was defined
as an IA5 String (OID 1.3.6.1.4.1.1466.115.121.1.26) which meant
that sudoUser could only represent a subset of possible values.

In some cases when using sudoers.ldap, the uid from the machine
which was utf8 was fed back into sudo which would then issue a
search for sudoUsers. If this uid contained utf8 characters, the
ldap server would refuse to match into sudoUsers because these
were limited to IA5.

This is a safe-forward upgrade as IA5 is a subset of UTF8 meaning
that this change will not impact existing deployments and their
rules.
 2022-07-25 15:21:39 +10:00
Helio Machado
d60b6c618f Improve Tag_Spec EBNF documentation 2022-06-07 17:24:45 +02:00
Helio Machado
3405fac05e Add missing colon in Tag_Spec documentation 2022-06-07 16:28:14 +02:00
Todd C. Miller
fcb5867f1d Document how setting ModulePath affects the Python search path. 
Also advise the user to use a unique prefix to avoid name space
collisions with installed Python modules.  Bug #1031.
 2022-06-06 08:39:22 -06:00
Todd C. Miller
96c3c28194 Add EXAMPLES variables for use in the man pages for the examples directory. 2022-06-06 08:36:44 -06:00
Todd C. Miller
77a47affb4 Install the plugin man pages in section 5 (or 4 for System V). 
The manual had the correct section in the text but was installed
in the wrong directory.
 2022-06-01 10:02:34 -06:00
Todd C. Miller
f52342031d Add support for intercepting the system(3) function. 
This also means we can log system(3) with log_subcmds.
 2022-05-31 14:45:00 -06:00
Todd C. Miller
6eda28ef51 Fix typo 2022-05-27 13:08:01 -06:00
Todd C. Miller
789bc6ec8e Update contributors. 2022-05-27 12:42:40 -06:00
Todd C. Miller
f16754a1dd Merge branch 'main' into apparmor_support 2022-05-27 08:25:12 -06:00
Todd C. Miller
9ac42292d1 Bump plugin minor version and document new intercept-related settings. 
There should have been a minor version bump for sudo 1.9.8 when
intercept was originally implemented.
 2022-05-26 09:19:08 -06:00
Todd C. Miller
f053f174bc Add intercept_type sudoers option to set intercept/log_subcmds mechanism. 2022-05-24 13:39:28 -06:00
kernelmethod
d8184fdb6f Add documentation for AppArmor support 
- Document the AppArmor userspec option in the sudoers man pages.
- Add information about the --with-apparmor build configuration option
  to INSTALL.md.
 2022-05-23 13:41:56 -06:00
Todd C. Miller
0bcfe6184f OpenSSL 3.x requires the key usage extension be present in CA and certs. 
Certificates generated with a CA that doesn't set the key usage
extension will fail to validate if "tls_verify" is enabled.
 2022-05-17 12:22:07 -06:00
Todd C. Miller
4ab6a87b96 Initialize intercept_allow_setid to true if we use ptrace(2) and seccomp(2). 2022-05-04 13:32:28 -06:00
Todd C. Miller
77979932b1 New Georgian translation from translationproject.org 2022-04-29 13:32:29 -06:00
Todd C. Miller
052d3d1d91 Update intercept documentation. 2022-04-29 13:09:03 -06:00
Todd C. Miller
72794ecd75 Fix typo; GitHub issue #144 2022-04-23 07:21:08 -06:00
Todd C. Miller
c414a89eb3 Remove ABOUT-NLS file, it is no longer maintained as part of GNU gettext. 
Expand the Translations section in CONTRIBUTING.md.
 2022-04-20 12:58:11 -06:00
Todd C. Miller
c51b81fa53 Expand section about expired accounts to include /etc/shadow info. 
GitHub issue #143
 2022-04-20 15:47:42 -06:00
Todd C. Miller
cdee5d48da Add check-verbose Makefile target that runs tests in verbose mode. 2022-03-02 13:32:08 -07:00
Todd C. Miller
973a8f08f9 Document that negating mailto or mailerpath disables sending mail. 2022-02-21 13:50:49 -07:00
Todd C. Miller
9f5615e5b1 Avoid using "note that" and "note: " in documentation. 2022-02-16 16:38:44 -07:00
Todd C. Miller
9175954895 Remove "please" from the documentation, it is considered bad style. 2022-02-16 12:33:32 -07:00