isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,078 Commits 1 Branch 0 Tags
670d8e6d77ce327cfbf1f53cc8764652b4cc47d0
Commit Graph

9078 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Todd C. Miller
670d8e6d77 Special case comment lines in lbufs. 2018-03-04 07:03:41 -07:00
Todd C. Miller
c9b70940cf When formatting as sudoers, flush the lbuf after each userspec. 2018-03-03 07:42:10 -07:00
Todd C. Miller
843213d3de Handle escaped commas when skipping over the cn. 2018-03-04 07:03:38 -07:00
Todd C. Miller
72dd971ee1 Add missing sudoOrder support to parse_ldif(). 2018-03-02 11:27:01 -07:00
Todd C. Miller
8c7f3e791c Add missing support for converting LOG_INPUT/LOG_OUTPUT tags and 
expand support for NOMAIL tags.
 2018-03-02 11:12:14 -07:00
Todd C. Miller
44fc165e7c Don't emit an empty sudoRole for global defaults if there are none. 2018-03-02 10:59:19 -07:00
Todd C. Miller
e96398cac2 Avoid changing the order of non-negated hosts and commands. 
We still put negated hosts/commands at the end of the list.
 2018-03-02 10:58:50 -07:00
Todd C. Miller
e750bae75d Handle parsing boolean options that have no explicit value. 2018-03-02 10:44:33 -07:00
Todd C. Miller
9af4447c3d Refactor the code that actually converts the role to sudoers format 
into role_to_sudoers() now that it is more involved than just calling
sudo_ldap_role_to_priv().
 2018-03-02 09:27:27 -07:00
Todd C. Miller
9b20bb1493 When merging two privileges, use the runas lists of the previous 
privilege when possible.  Otherwise, the generated sudoers line
will include a runas list for commands that is not necessary.
 2018-03-02 06:42:29 -07:00
Todd C. Miller
fff4acc1f7 Use a case-insensitive comparison when matching user and group names 
in sudoers with the passwd or group database.  This can be necessary
when users and groups are stored in AD or LDAP.
 2018-03-01 20:31:01 -07:00
Todd C. Miller
88bc4ba865 Fix clean target for *.sudo regress files 2018-03-01 10:35:32 -07:00
Todd C. Miller
0804cda64e ignore more binaries 2018-03-01 10:33:47 -07:00
Todd C. Miller
8275ab873f Fix use of uninitialized variable (conf) if sudoers_debug_register() 
happens to fail.
 2018-03-01 10:18:48 -07:00
Todd C. Miller
73b5f961ee Split conversion code out of parse_ldif() and into ldif_to_sudoers(). 2018-02-28 16:21:09 -07:00
Todd C. Miller
8da213c8be Quiet a clang analyzer warning. 2018-02-28 14:44:54 -07:00
Todd C. Miller
120bb6de7f rename ldap_common.c -> ldap_util.c 2018-02-28 14:24:33 -07:00
Todd C. Miller
3a2ae844ec When converting from ldif to sudoers, sudoRole objects with the 
same user if possible.  If both user and host are the same, merge
into a single privilege.  This makes it possible to convert a
sudoers entry like:

    aaron shanty = NOEXEC: /usr/bin/vi, /usr/bin/more, EXEC: /bin/sh

to ldif and then back to sudoers as a single line.  Currently, the
ldif entries to be merged must have the same or adjacent sudoOrder
attributes.
 2018-02-28 14:02:50 -07:00
Todd C. Miller
56bdde1339 plug memory leaks 2018-02-28 14:02:11 -07:00
Todd C. Miller
4b29e0bd70 Restore line to set MODE_PRESERVE_ENV in flags when the -E command 
line option is used.  The caller doesn't check MODE_PRESERVE_ENV
these days but parse_args uses it to detect usage errors when -E
is used along with a mutually excusive option.  Problem found by
Yuriy Vostrikov.
 2018-02-28 07:05:36 -07:00
Todd C. Miller
12affcd5ef Add missing close parenthesis in "Including other files from within 
sudoers" section.  Bug #824
 2018-02-26 17:59:58 -07:00
Todd C. Miller
7919b9ad2e When converting from LDAP to sudoers, put negated hosts and commands 
at the end of the list.  Since LDAP doesn't guarantee attribute order
we need to make sure negated entries always override non-negated ones.
 2018-02-25 06:30:32 -07:00
Todd C. Miller
6f097eb023 We may need the hostname to resolve %h escapes in include files. 2018-02-24 18:46:00 -07:00
Todd C. Miller
b3a0c3272b Setting a sudoOrder start point of 0 will disable creation of 
sudoOrder attributes in the resulting LDIF output.
 2018-02-24 14:35:38 -07:00
Todd C. Miller
111d79b53c Don't need to fill in struct sudo_user since we don't do matching. 2018-02-24 09:28:01 -07:00
Todd C. Miller
5999cfb906 Add support for setting default options in a config file. In 
addition to expand_aliases, input_format and output_format, both
the initial sudoOrder and the increment when updating sudoOrder for
subsequent sudoRole objects can be specified.  Command line options
have also been added for the start order and increment.
 2018-02-24 09:23:14 -07:00
Todd C. Miller
fc82a16655 cvtsudoers can now read LDIF 2018-02-22 13:17:55 -07:00
Todd C. Miller
bb06233247 Fix a typo. 2018-02-22 13:17:37 -07:00
Todd C. Miller
19502307aa Deal with user_name not being set in cvtsudoers. 2018-02-22 10:43:47 -07:00
Todd C. Miller
ceea24b965 Initial support for parsing sudoers LDIF files in cvtsudoers. 
This makes it possible to convert from LDAP sudoers to a traditional
sudoers file.  Semantic differences between file sudoers and LDAP
sudoers mean that LDIF -> sudoers is not completely equivalent.
 2018-02-22 09:53:12 -07:00
Todd C. Miller
8b22ed7837 Fix LDIF conversion of commands with an associated digest. 2018-02-21 21:24:53 -07:00
Todd C. Miller
91f97d2f23 In array_to_member_list() use the correct type for netgroups and 
user groups.
 2018-02-21 21:09:57 -07:00
Todd C. Miller
337ace6441 Prepend digest to command if present. 
Fix printing of group IDs and non-unix groups.
 2018-02-21 21:08:37 -07:00
Todd C. Miller
c13557b6cb Fix gcc false positive for uninitialized variable 2018-02-21 21:02:36 -07:00
Todd C. Miller
03f94d62f9 Update Polypkg to the latest version from git. 2018-02-20 21:08:31 -07:00
Todd C. Miller
faa5baac9b Use setpassent() and setgroupent() on systems that support it to 
keep the passwd and group database open.  Sudo does a lot of passwd
and group lookups so it can be beneficial to just leave the file
open.
 2018-02-20 13:22:59 -07:00
Todd C. Miller
4f9296928c Add option to cvtsudoers to expand aliases in the output. 2018-02-19 15:32:56 -07:00
Todd C. Miller
3f204c5eb8 Fix conversion of "ALL" in the JSON output format, which was being 
printed as an alias.
 2018-02-19 13:39:11 -07:00
Todd C. Miller
e48cbfc10c Clarify that --with-rundir and --with-vardir take sudo-specific directory, 
e.g. /var/run/sudo and not just /var/run.  Bug #823
 2018-02-19 11:27:30 -07:00
Todd C. Miller
d5d170252a In pty_cleanup() we need to call sudo_term_restore() even if no I/O 
plugins are present as long as /dev/tty exists.  Fixes the use_pty
case with no I/O plugins.
 2018-02-19 11:00:12 -07:00
Todd C. Miller
42fe0409f6 Add sudo_ev_dispatch(), a wrapper for ev_loop() with no flags. 
Similar the dispatch function in libevent.
 2018-02-19 11:00:10 -07:00
Todd C. Miller
525c6a3d94 Use /run in preference to /var/run if it exists. 
Bug #822
 2018-02-19 10:59:12 -07:00
Todd C. Miller
59086e9c8a mention common sudoers formatting changes 2018-02-14 11:30:49 -07:00
Todd C. Miller
43a3a23fed Move LDAP configuration bits into ldap_conf.c 2018-02-11 07:36:08 -07:00
Todd C. Miller
0c08de88cd No longer need to include stddef.h 2018-02-10 13:37:59 -07:00
Todd C. Miller
e2213dc1e3 Remove dead store, found by cppcheck. 2018-02-10 09:44:34 -07:00
Todd C. Miller
34820c6b15 simplify iterator 2018-02-10 04:29:43 -07:00
Todd C. Miller
6e2a267060 Silence a false positive from cppcheck. 2018-02-10 04:08:42 -07:00
Todd C. Miller
d0d413d077 Cast version to int when printing. Avoids a cppcheck warning. 2018-02-10 04:00:17 -07:00
Todd C. Miller
4459ee42ed Use an iterator instead of fragile pointer arithmetic to iterate 
over value arrays in sudo_ldap_role_to_priv().
 2018-02-09 22:06:56 -07:00