isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,255 Commits 1 Branch 0 Tags
8049e4e32f81424b01ac9c83eacefc3de3640ef5
Commit Graph

12255 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Todd C. Miller
8a5e9ffb43 Plug memory leak. 2022-12-29 10:35:09 -07:00
Todd C. Miller
47a211f194 Update fuzz_policy keywords to match current policy settings. 2022-12-28 16:02:25 -07:00
Todd C. Miller
a7c1b78c67 Add example users and groups to the dictionary. 2022-12-28 16:02:10 -07:00
Todd C. Miller
8eabbf8fdd parse_args: an environment variable may not start with '='. 
Also check VAR=val format in validate_env_vars() and add an error
message if insert_env_vars() fails.
 2022-12-28 14:07:43 -07:00
Todd C. Miller
c820599893 rebuild_env: avoid a potential NULL dereference in fuzz_policy 2022-12-28 11:05:17 -07:00
Todd C. Miller
b69ffd3479 sudoers_policy_main: plug memory leak of iolog_path on error. 2022-12-28 10:50:51 -07:00
Todd C. Miller
8e8a22b8e5 rebuild_env: avoid a potential NULL dereference in fuzz_policy 2022-12-28 09:45:01 -07:00
Todd C. Miller
bca945f074 The contents of the env_add array should not include the leading "env=" prefix. 
The previous fix for this was incomplete.
 2022-12-28 09:25:41 -07:00
Todd C. Miller
9c4271f737 validate_env_vars: more efficient errbuf handling 
Also avoid appending to errbuf if it is already full.
 2022-12-28 09:24:22 -07:00
Todd C. Miller
95a6c04598 Document that -k does not interfere with sudo on other terminals. 
This should help clarify the difference between "sudo -k" and "sudo -K".
 2022-12-27 20:18:56 -07:00
Todd C. Miller
ee5b43280b Check for bound values larger than 255 and reject them. 
This is to prevent the fuzzers from running out of memory.
 2022-12-27 13:22:29 -07:00
Todd C. Miller
adf2a432af Use the POSIX shell "command -v" instead of "which" to find programs. 
Fix false detection of init.d/service status.
 2022-12-27 12:28:53 -07:00
Todd C. Miller
519a005802 Fix example dir mode on RedHat/Fedora. 2022-12-27 12:27:29 -07:00
Todd C. Miller
e0fa2ec85c Use sed instead of ed to modify the packaged sudoers file. 
Some Linux distros do not include /bin/ed by default.
 2022-12-27 09:18:26 -07:00
Todd C. Miller
048b843e6d Use @intercept_file@ and @noexec_file@ like the example file. 2022-12-26 15:32:36 -07:00
Todd C. Miller
772fc914a8 There is a @pam_login_service@ substitution but no @pam_service@. 
Just use sudo instead of @pam_service@.
 2022-12-26 15:26:13 -07:00
Todd C. Miller
0354ec6a1d Use @sudoers_plugin@ instead of @sudoers_module@. 2022-12-26 14:28:28 -07:00
Todd C. Miller
eeea67e70b Use @sudoers_plugin@ instead of @sudoers_module@. 2022-12-26 13:56:43 -07:00
Todd C. Miller
f6e0e87ba9 sudo 1.9.13 
Document the changes to AIX plugins in docs/UPGRADE.md and regenerate
configure using the latest autoconf from git.
 2022-12-26 10:47:51 -07:00
Todd C. Miller
702f21f7f6 Remove anything after whitespace in MANIFEST when building tarball. 
This is consistent with how sudo's Makefile builds the tarball.
 2022-12-26 08:13:43 -07:00
Todd C. Miller
4baa6e103b Zap trailing whitespace. 2022-12-26 08:10:45 -07:00
Todd C. Miller
50958a05da Remove developer mode from sudo.conf, it is no longer used. 2022-12-26 07:43:55 -07:00
Todd C. Miller
fa1b86fca6 Remove the Python plugin import blocker code. 
The sudo.conf file is considered a trusted source of information
and these checks suffer from TOCTOU issues anyway.
 2022-12-26 07:43:55 -07:00
Todd C. Miller
73abff2d05 Remove the owner and mode checks when loading a sudo plugin. 
The sudo.conf file is considered a trusted source of information
and these checks suffer from TOCTOU issues anyway.  The checks
complicate loading of shared objects since we need to perform
fallback processing twice.
 2022-12-26 07:43:55 -07:00
Todd C. Miller
97fb4eae72 sudo_dso_load: add AIX fallback path from shlib.so to shlib.a(shlib.so). 
If the .so file is missing but the .a file exists, try to dlopen()
the AIX .a file using the .so name as the member.  We need to avoid
breaking existing configurations if the type of AIX shared library
changes when sudo is upgraded.
 2022-12-26 07:43:55 -07:00
Todd C. Miller
206700c3f0 Use AIX-style shared libraries on AIX by default instead of SVR4-style. 
This removes the need to use the -brtl linker flag which can cause
problems when there are both a .so and .a version of the same library
but with different versions.  This was particularly problematic
when using the AIX freeware version of OpenSSL.  The --with-aix-soname=svr4
option can be used to build SVR4-style shared libs instead.
 2022-12-26 07:43:55 -07:00
Todd C. Miller
5165fb9b22 Bump SUDOERS_GRAMMAR_VERSION to 50 for the new list pseudo-command. 2022-12-26 07:41:53 -07:00
Todd C. Miller
11aa808ef7 Use ".Sy root" instead of ".Em root" when talking about the root user. 
Replace MANDOCPROG with "mandoc" now that MANDOCPROG has been removed.
 2022-12-25 10:53:40 -07:00
Todd C. Miller
49f2d67070 Fix support for AIX-style path(module) syntax in sudo.conf Plugin lines. 2022-12-22 16:45:13 -07:00
Todd C. Miller
27aff55ac8 Merge pull request #226 from rtczza/main 
debug_return_int use error
 2022-12-22 19:59:02 -07:00
wanglujun
5c495b5fef debug_return_int use error 2022-12-23 10:52:01 +08:00
Todd C. Miller
3040bf54c9 Mention the "list" privilege in the description of the -U option. 2022-12-20 09:18:46 -07:00
Todd C. Miller
eada918bbb Add [arg ...] after command in SYNOPSIS and usage output. 
Use Ar markup when referring to the command and args.
 2022-12-20 09:09:25 -07:00
Todd C. Miller
9d5ed2f9ef fmtstr: call va_arg() for %c when computing length. 
Even though we don't need to read the actual char to know its length,
we do need to consume it to get the correct value for the next format.
 2022-12-17 18:55:16 -07:00
Todd C. Miller
e647997236 SUDO_CHECK_SANITIZER: quote "$3" in awk script so m4 doesn't eat it. 2022-12-17 16:46:26 -07:00
Todd C. Miller
d7b3673933 Add missing sudo_json_free(). 2022-12-17 16:37:29 -07:00
Todd C. Miller
0614c1f626 check_pattern: check bounds as a repetition operator too. 
Add regess to verify check_pattern() via sudo_regex_compile().
 2022-12-17 15:09:30 -07:00
Todd C. Miller
f0530b66d3 Instead of collapsing duplicate repetition characters, reject them. 
This is implementation-specific behavior--some regcomp(3) will
reject duplicate repetition characters (BSD), others will try to
support them (Glibc) but may allocate excessive amounts of memory.
 2022-12-17 11:32:24 -07:00
Todd C. Miller
2f32b45d59 New Albanian translation from translationproject.org 2022-12-17 11:11:31 -07:00
Todd C. Miller
797cc917a8 Add basic regress for JSON functions. 
Fix a bug in escaped control character handling.
Roll back changes to buffer if sudo_json_add_value() fails.
 2022-12-15 19:49:11 -07:00
Todd C. Miller
0e6482e827 Add missing memory allocation failure checks. 
Inspired by GitHub PR #221
 2022-12-15 09:30:49 -07:00
Todd C. Miller
e706204f5f Escape control characters in strings. 2022-12-14 19:08:38 -07:00
Todd C. Miller
c184a241a2 Mention the audit plugin in the "Process model" section. 
Remove extraneous information describing how sudo may exec the
command directly, this is already included in the non-pty section.
 2022-12-12 16:35:00 -07:00
Todd C. Miller
62dd5734a2 Plug a memory leak of list_cmnd in the fuzzers. 2022-12-11 14:29:14 -07:00
Todd C. Miller
25c709c4d8 Suppress PVS Studio watning about reassigning a variable the same value. 
Working around the warning would result in more fragile code.
 2022-12-11 13:46:06 -07:00
Todd C. Miller
f26a2e7626 Fix some dead stores noted by PVS Studio. 
Since rc is initialized to SUDO_RC_ERROR there is no need to set
it to SUDO_RC_ERROR again on failure if rc has not been changed
since initialization.
 2022-12-11 13:46:04 -07:00
Todd C. Miller
a04557c3d4 Fix memory leak in multiarch_test to quiet leak sanitizer. 2022-12-11 13:46:04 -07:00
Todd C. Miller
a514a6eed5 Add "list" pseudo-command to allow a user to list another user's 
privs.  Previously, only root or a user with the ability to run any
command as either root or the target user on the current host could
use the -U option.  For "sudo -l [-U otheruser] command", NewArgv[0]
is now set to "list" (just like "sudo -l") and the actual command
to be checked starts with NewArgv[1].
 2022-12-11 13:46:00 -07:00
Todd C. Miller
8c16c8faf6 Adjust a line to quiet codespell warning. 2022-12-09 19:23:48 -07:00
Todd C. Miller
934a8793b2 Only build ChangeLog from a repo checkout, not a release tarball. 
The CODEOWNERS file is not present in the release tarball so we can
use that when determining what is (or is not) a repo checkout.
 2022-12-08 14:03:18 -07:00