isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,065 Commits 1 Branch 0 Tags
8275ab873f8174d55b83eeebadf7e0dcac733fce
Commit Graph

9065 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Todd C. Miller
8275ab873f Fix use of uninitialized variable (conf) if sudoers_debug_register() 
happens to fail.
 2018-03-01 10:18:48 -07:00
Todd C. Miller
73b5f961ee Split conversion code out of parse_ldif() and into ldif_to_sudoers(). 2018-02-28 16:21:09 -07:00
Todd C. Miller
8da213c8be Quiet a clang analyzer warning. 2018-02-28 14:44:54 -07:00
Todd C. Miller
120bb6de7f rename ldap_common.c -> ldap_util.c 2018-02-28 14:24:33 -07:00
Todd C. Miller
3a2ae844ec When converting from ldif to sudoers, sudoRole objects with the 
same user if possible.  If both user and host are the same, merge
into a single privilege.  This makes it possible to convert a
sudoers entry like:

    aaron shanty = NOEXEC: /usr/bin/vi, /usr/bin/more, EXEC: /bin/sh

to ldif and then back to sudoers as a single line.  Currently, the
ldif entries to be merged must have the same or adjacent sudoOrder
attributes.
 2018-02-28 14:02:50 -07:00
Todd C. Miller
56bdde1339 plug memory leaks 2018-02-28 14:02:11 -07:00
Todd C. Miller
4b29e0bd70 Restore line to set MODE_PRESERVE_ENV in flags when the -E command 
line option is used.  The caller doesn't check MODE_PRESERVE_ENV
these days but parse_args uses it to detect usage errors when -E
is used along with a mutually excusive option.  Problem found by
Yuriy Vostrikov.
 2018-02-28 07:05:36 -07:00
Todd C. Miller
12affcd5ef Add missing close parenthesis in "Including other files from within 
sudoers" section.  Bug #824
 2018-02-26 17:59:58 -07:00
Todd C. Miller
7919b9ad2e When converting from LDAP to sudoers, put negated hosts and commands 
at the end of the list.  Since LDAP doesn't guarantee attribute order
we need to make sure negated entries always override non-negated ones.
 2018-02-25 06:30:32 -07:00
Todd C. Miller
6f097eb023 We may need the hostname to resolve %h escapes in include files. 2018-02-24 18:46:00 -07:00
Todd C. Miller
b3a0c3272b Setting a sudoOrder start point of 0 will disable creation of 
sudoOrder attributes in the resulting LDIF output.
 2018-02-24 14:35:38 -07:00
Todd C. Miller
111d79b53c Don't need to fill in struct sudo_user since we don't do matching. 2018-02-24 09:28:01 -07:00
Todd C. Miller
5999cfb906 Add support for setting default options in a config file. In 
addition to expand_aliases, input_format and output_format, both
the initial sudoOrder and the increment when updating sudoOrder for
subsequent sudoRole objects can be specified.  Command line options
have also been added for the start order and increment.
 2018-02-24 09:23:14 -07:00
Todd C. Miller
fc82a16655 cvtsudoers can now read LDIF 2018-02-22 13:17:55 -07:00
Todd C. Miller
bb06233247 Fix a typo. 2018-02-22 13:17:37 -07:00
Todd C. Miller
19502307aa Deal with user_name not being set in cvtsudoers. 2018-02-22 10:43:47 -07:00
Todd C. Miller
ceea24b965 Initial support for parsing sudoers LDIF files in cvtsudoers. 
This makes it possible to convert from LDAP sudoers to a traditional
sudoers file.  Semantic differences between file sudoers and LDAP
sudoers mean that LDIF -> sudoers is not completely equivalent.
 2018-02-22 09:53:12 -07:00
Todd C. Miller
8b22ed7837 Fix LDIF conversion of commands with an associated digest. 2018-02-21 21:24:53 -07:00
Todd C. Miller
91f97d2f23 In array_to_member_list() use the correct type for netgroups and 
user groups.
 2018-02-21 21:09:57 -07:00
Todd C. Miller
337ace6441 Prepend digest to command if present. 
Fix printing of group IDs and non-unix groups.
 2018-02-21 21:08:37 -07:00
Todd C. Miller
c13557b6cb Fix gcc false positive for uninitialized variable 2018-02-21 21:02:36 -07:00
Todd C. Miller
03f94d62f9 Update Polypkg to the latest version from git. 2018-02-20 21:08:31 -07:00
Todd C. Miller
faa5baac9b Use setpassent() and setgroupent() on systems that support it to 
keep the passwd and group database open.  Sudo does a lot of passwd
and group lookups so it can be beneficial to just leave the file
open.
 2018-02-20 13:22:59 -07:00
Todd C. Miller
4f9296928c Add option to cvtsudoers to expand aliases in the output. 2018-02-19 15:32:56 -07:00
Todd C. Miller
3f204c5eb8 Fix conversion of "ALL" in the JSON output format, which was being 
printed as an alias.
 2018-02-19 13:39:11 -07:00
Todd C. Miller
e48cbfc10c Clarify that --with-rundir and --with-vardir take sudo-specific directory, 
e.g. /var/run/sudo and not just /var/run.  Bug #823
 2018-02-19 11:27:30 -07:00
Todd C. Miller
d5d170252a In pty_cleanup() we need to call sudo_term_restore() even if no I/O 
plugins are present as long as /dev/tty exists.  Fixes the use_pty
case with no I/O plugins.
 2018-02-19 11:00:12 -07:00
Todd C. Miller
42fe0409f6 Add sudo_ev_dispatch(), a wrapper for ev_loop() with no flags. 
Similar the dispatch function in libevent.
 2018-02-19 11:00:10 -07:00
Todd C. Miller
525c6a3d94 Use /run in preference to /var/run if it exists. 
Bug #822
 2018-02-19 10:59:12 -07:00
Todd C. Miller
59086e9c8a mention common sudoers formatting changes 2018-02-14 11:30:49 -07:00
Todd C. Miller
43a3a23fed Move LDAP configuration bits into ldap_conf.c 2018-02-11 07:36:08 -07:00
Todd C. Miller
0c08de88cd No longer need to include stddef.h 2018-02-10 13:37:59 -07:00
Todd C. Miller
e2213dc1e3 Remove dead store, found by cppcheck. 2018-02-10 09:44:34 -07:00
Todd C. Miller
34820c6b15 simplify iterator 2018-02-10 04:29:43 -07:00
Todd C. Miller
6e2a267060 Silence a false positive from cppcheck. 2018-02-10 04:08:42 -07:00
Todd C. Miller
d0d413d077 Cast version to int when printing. Avoids a cppcheck warning. 2018-02-10 04:00:17 -07:00
Todd C. Miller
4459ee42ed Use an iterator instead of fragile pointer arithmetic to iterate 
over value arrays in sudo_ldap_role_to_priv().
 2018-02-09 22:06:56 -07:00
Todd C. Miller
64e99328e3 Move sudoers formatting code into fmtsudoers. 2018-02-09 18:22:04 -07:00
Todd C. Miller
dda1d6cef7 Clean up some XXX in parse.c 2018-02-09 18:22:03 -07:00
Todd C. Miller
2522229e86 Rename sudo_file_append_default() -> sudo_lbuf_append_default() and 
use it for ldap and sssd too.
 2018-02-09 18:22:02 -07:00
Todd C. Miller
3226f7e28b Move common bits of ldap to sudoers conversion into ldap_common.c 
and use it in sssd.c.
 2018-02-09 18:21:40 -07:00
Todd C. Miller
4e2402a8e4 Convert ldap results into a sudoers userspec so we can use the "sudo 
-l" output functions in parse.c.
 2018-02-09 18:21:01 -07:00
Todd C. Miller
787717755b Don't mark sudoers.dist volatile, it only gets used on systems that 
don't have the concept of volatile files.
 2018-02-08 09:14:12 -07:00
Todd C. Miller
5cca4b6906 Refactor member freeing code into free_member(). 
Refactor userspec freeing code into free_userspec().
 2018-02-05 13:33:29 -07:00
Todd C. Miller
9d49592f14 Fix compilation with glibc where stdout is not constant. 2018-02-05 06:23:33 -07:00
Todd C. Miller
57e7b4b49e For "sudo -l", if a word includes spaces, print it in double quotes. 
Also escape spaces in the command path.  This matches the sudoers
quoting rules.
 2018-02-04 12:53:32 -07:00
Todd C. Miller
3189de5bb9 Display sudoNotBefore and sudoNotAfter in "sudo -l" 2018-02-03 14:56:00 -07:00
Todd C. Miller
105ced47b8 For "sudo -l", if a word includes spaces, print it in double quotes. 
Also escape spaces in the command path.  This matches the sudoers
quoting rules.
 2018-02-03 06:59:37 -07:00
Todd C. Miller
40c200af18 Add back printing of negation operator ('!') when printing a word 
with spaces in it.
 2018-02-03 06:57:12 -07:00
Todd C. Miller
1aca11c788 Use visudo to validate "cvtsudoers -f sudoers" output. 2018-02-03 06:46:56 -07:00