isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,204 Commits 1 Branch 0 Tags
73c1b04306d5291abde9857b51e6aaee936e57c4
Commit Graph

10204 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Todd C. Miller
f6a264e719 Avoid calling sudoers_policy_exec_setup() on error. 
We only want to pass the execution environment back for commands
that are accepted or rejected.
Also avoid potentially freeing the wrong pointer when garbage
collection is enabled.
 2020-02-24 19:59:44 -07:00
Todd C. Miller
f40b4c2887 Open event log at config time instead of open/close for each entry. 
If logging via syslog, do the openlog() at config time instead.
We still lock the log file prior to writing to it but unlock
immediately after.
 2020-02-22 16:13:56 -07:00
Todd C. Miller
7e5641bc76 Fix unlocking of an entire file with lockf(). 
Since lockf() uses the files's current offset, we need to seek to
the start of the file to unlock the entire file.
 2020-02-22 16:09:59 -07:00
Todd C. Miller
1b930b585d Add sudo_json_free_v1 to symbol exports file too. 2020-02-20 12:21:09 -07:00
Todd C. Miller
4b4db9694a Regenerate dependencies to match the recent JSON changes. 2020-02-20 11:35:28 -07:00
Todd C. Miller
4d1454ebab Add missing check for calloc(3) failure. 2020-02-20 11:31:27 -07:00
Robert Manner
95dce8cbe6 doc/sudo_plugin_python: document approval plugin and PluginReject 2020-02-19 11:51:18 -07:00
Robert Manner
06b1f58e9f plugins/python/sudo_python_module.c: remove unused declaration 
We do not use structsequence any more.
 2020-02-19 11:48:16 -07:00
Robert Manner
3be61db35c plugins/python: restore the original python inittab after interpreter deinit 2020-02-19 11:48:16 -07:00
Robert Manner
27de7dd24d plugins/python: only deinit interpreters when sudo unlinks the plugin 
This only happens when sudo unloads the last python plugin.
The reason doing so is because there are some python modules which
does not support importing them again after destroying the interpreter
which has imported them previously.

Another solution would be to just leak the interpreters (let the kernel
free up), but then there might be some python resources like open files
would not get cleaned up correctly if the plugin is badly written.

Tests are meant to test the scenario sudo does, so I have modified them
to generally do not unlink but only a few times (~per plugin type) so it
does not use 48 interpreters (one gets started on every plugin->open) and
it is visible at least which type of plugin fails deinit if there is an
error.
 2020-02-19 11:48:16 -07:00
Robert Manner
8a9218d161 plugins/python/debug: adapt debug refcount solution of sudoers plugin 2020-02-19 11:48:16 -07:00
Todd C. Miller
a0c2de4cef Re-register listeners on SIGHUP. 
Previously, a config reload would refresh the listener address list
but the changes had no effect on the actual addresses being listened on.
 2020-02-18 13:13:03 -07:00
Todd C. Miller
adb3bdf6dd Fix compilation error when not built with OpenSSL support. 
Adds a missing #ifdef HAVE_OPENSSL and reorders code to avoid the
need for a static init_tls_server_context() prototype.
 2020-02-18 10:35:30 -07:00
Todd C. Miller
982c003b8d Add support for JSON structured logging using syslog. 
Note that depending on the system, the default syslog buffer
may not be large enough to store all the logging data.
 2020-02-17 16:25:18 -07:00
Todd C. Miller
5781a6a4cf Add support for JSON logging in sudo_logsrvd. 2020-02-17 16:10:56 -07:00
Todd C. Miller
8ef5b734c4 Rework the JSON API to write to a memory buffer, not a stdio stream. 2020-02-17 16:10:55 -07:00
Todd C. Miller
25542216fe Fix support for reloading the config in sudo_logsrvd. 
We need to re-initialize the TLS server context.
Also fix a memory leak of the TLS parameters on reload.
 2020-02-17 15:01:38 -07:00
Todd C. Miller
2e836cc571 The environment in the accept message is runenv not submitenv. 
The I/O logging plugin is passed the environment the command will
run with, not the user's original environment.
 2020-02-16 16:37:14 -07:00
Todd C. Miller
92e42ff548 Add compatibility define for fseeko(3). 
This is better than cluttering up the code with #ifdefs for obsolete
systems.
 2020-02-15 10:22:15 -07:00
Todd C. Miller
e7bd19bd1e Add test for #include directive without a trailing newline. 2020-02-14 14:13:55 -07:00
Todd C. Miller
d2314acae8 Don't require a newline at the end of include or includedir directives. 2020-02-14 14:06:45 -07:00
Robert Manner
8395a20a20 plugins/python/regress/testhelpers.c: replace fromisoformat 
fromisoformat is only supported from python >=3.7
 2020-02-14 09:25:37 -07:00
Robert Manner
efa97b5b97 plugins/python/python_plugin_approval: fix negative ref count 
The python_plugin_api_rc_call function already decrements the
refcount of py_args.
Python avoids the double free, but the error gets shown if using python
debug build.
 2020-02-14 09:25:37 -07:00
Robert Manner
a71828b385 plugins/python/python_plugin_common.c: release py_args in close 
even if the arguments are not used (eg. when there is no "close" call
in the plugin).

It was not really a memleak, because interpreter is deinitialized anyway,
which frees the object.
 2020-02-14 09:25:37 -07:00
Robert Manner
b2ae79c2be plugins/python: add missing annotations to help cpychecker 2020-02-14 09:25:37 -07:00
Robert Manner
43e256e34f plugins/python/regress: add tests for approval plugin 2020-02-12 11:16:00 -07:00
Robert Manner
80b3d86d6e plugins/python: add python approval plugin example 2020-02-12 11:16:00 -07:00
Robert Manner
23af39b005 plugins/python: add python approval plugin wrapper 2020-02-12 11:16:00 -07:00
Robert Manner
33e7fdcae0 plugins/python/regress: strengthen errstr verification 
Tests did not catch the issue where errstr was not set correctly, but
its pointer contained the expected data, because the memory allocator
reused the same space for storing the string.

Now it is either verified to be NULL, or reset to NULL.
 2020-02-12 11:16:00 -07:00
Robert Manner
9fa6500d6a plugins/python/regress: simplify plugin option creation 2020-02-12 11:16:00 -07:00
Robert Manner
b1d2ccecd0 plugins/python: make storing errstr more explicit 
The error is always stored in plugin_ctx, but it is only set into errstr
if the API version is enough. (Previously it worked the opposite:
we only stored the error if API level was enough.)
 2020-02-12 11:16:00 -07:00
Robert Manner
b165242035 plugins/python/sudo_module: let a reject also supply error message 
Same as sudo.PluginError exception, have a sudo.PluginReject exception
as well. Added common base exception as well.
 2020-02-12 11:16:00 -07:00
Robert Manner
d1f94c857c plugins/python/regress: still some memleak fix 2020-02-12 11:16:00 -07:00
Todd C. Miller
0e4c3c47d1 Move duplicated code to parse plugin debug flags to libsudo_util. 
There's no need for four copies of sudo_debug_parse_flags().
 2020-02-11 15:15:36 -07:00
Todd C. Miller
9e2e79b6fa Add regress test for parsing Defaults lists. 
Currently only env_check, env_delete, env_keep and log_servers are lists.
 2020-02-10 17:58:59 -07:00
Todd C. Miller
009788afae Clarify that approval close happens after auditing. 
Also fix a few typos.
 2020-02-10 15:43:25 -07:00
Todd C. Miller
01a53f2865 Add open and close functions to the approval plugin API. 
We need a close function to be able to to free memory allocated for
errstr.  Unlike the other plugins, the close function is called
immediately after the plugin's check or show_version function.
The plugin does not remain open until the command completes.
 2020-02-10 15:29:48 -07:00
Todd C. Miller
55b61b989f Use unique function names to avoid confusion with front-end functions. 
Also add a missing sudo_debug_enter() after debug registration.
 2020-02-10 14:37:43 -07:00
Todd C. Miller
3911e4f7bf Use Text::Wrap instead of perl's built-in format function. 
This still breaks log filename incorrectly but is a step in the
right direction.
 2020-02-10 09:11:30 -07:00
Todd C. Miller
c2f3f60583 Avoid changing directory when generating the ChangeLog file. 
Instead, pass the repo path to either hg or log2cl.pl
 2020-02-10 08:02:47 -07:00
Robert Manner
2781ec030b src/sudo.c: call audit plugin close when result is a wait status 2020-02-10 05:31:30 -07:00
Robert Manner
0202dc67cc Makefile.in: fix install target for out of source build 
The scriptdir contained a path relative to where the target was started.
The scripts are called like "$scriptdir/script_name" which is fine with
relative path as well, until the current directory is not changed.
But things like
  cd $srcdir && $scriptdir/script_name
fails (if building in separate build directory).
 2020-02-10 05:28:34 -07:00
Robert Manner
ecdaaffd57 doc/sudo_plugin_python: document python audit plugin support 2020-02-10 05:24:16 -07:00
Robert Manner
bd465b3087 doc/sudo_plugin_python: document returning error string 2020-02-10 05:24:16 -07:00
Robert Manner
8f79d5c1c7 doc/sudo_plugin_python: update python manual for constant -> enum changes 2020-02-10 05:24:16 -07:00
Robert Manner
1a1cb54975 plugins/python/regress/check_python_examples: add audit_plugin tests 2020-02-10 05:24:16 -07:00
Robert Manner
52d067b01f plugins/python: add example python audit plugin 2020-02-10 05:24:16 -07:00
Robert Manner
cbf60cff5d plugins/python: add python audit plugin wrapper 2020-02-10 05:24:16 -07:00
Robert Manner
bbbcb39334 plugins/python/example_*.py: document returning error string 2020-02-10 05:24:16 -07:00
Robert Manner
9c4f076f85 plugins/python/regress: add test for callback error msg return 2020-02-10 05:24:16 -07:00