Commit Graph

105 Commits

Author SHA1 Message Date
Todd C. Miller
b1de1bce33 term_restore() now restarts itself so we don't need to do it ourselves. 2014-02-03 20:36:48 -07:00
Todd C. Miller
1adeda54ef Add support for preventing fds from getting clobbered by closefrom(). 2013-12-20 11:14:32 -07:00
Todd C. Miller
96eb2c4f8f Add warning_gettext() wrapper function that changes to the user locale,
then calls gettext().
Add U_ macro that calls warning_gettext() instead of gettext().
Rename warning2()/error2() back to warning_nodebug()/error_nodebug().
2013-11-18 08:59:57 -07:00
Todd C. Miller
99b7351de0 Fix some #if vs. #ifdef and remove an extraneous semicolon.
Bug #624; from Daniel Richard G.
2013-11-17 16:15:36 -07:00
Todd C. Miller
fd88ed42c8 Use MSG_WAITALL when receiving struct command_status over the Unix
domain socket since we no longer use datagrams.  This should avoid
the need to handle incomplete reads, though in theory it is still
possible.
2013-10-29 15:26:32 -06:00
Todd C. Miller
8861e01d16 Add support for libevent-style timed events. Adding a timed event
is currently O(n).  The only consumer of timed events is sudoreplay
which only used a singled one so O(n) == O(1) for now.  This also
allows us to remove the nanosleep compat function as we now use a
timeout event instead.
2013-10-28 10:00:09 -06:00
Todd C. Miller
d8b368b503 Now that sudo_ev_base_free() removes all events before freeing we
don't need to do this by hand.
2013-10-26 07:52:59 -06:00
Todd C. Miller
60d20f1e6e mon_handler() should be static 2013-10-25 13:55:21 -06:00
Todd C. Miller
07e0a068dc Add missing else when the connection from the monitor to the parent
sudo process is broken (due to the parent dying).  Prevents a
spurious "unexpected reply type on backchannel" warning.
2013-10-24 10:40:51 -06:00
Todd C. Miller
a090d0678c When flushing output we don't care whether we are the foreground
process or not, we still need to flush to /dev/tty.  If we are in
the background, it is OK to get SIGTTOU.
2013-10-24 10:19:36 -06:00
Todd C. Miller
d825a58943 Avoid a double free introduced when plugging a memory leak in
safe_close().  A new ev_free_by_fd() function is used to remove and
free any events sharing the specified fd.  This can be used after
safe_close() to make sure we don't try to select() on a closed fd.
2013-10-22 15:54:41 -06:00
Todd C. Miller
f85106ea67 Use SLIST and STAILQ macros instead of doing headless singly linked
lists manually.  As a bonus we now use a tail queue for ldap.c and
sudoreplay.c.
2013-10-22 09:08:09 -06:00
Todd C. Miller
923edabe6c Convert sudo to use BSD TAILQ macros instead of home ground tail
queue functions.  This includes a private queue.h header derived
from FreeBSD.  It is simpler to just use our own header rather than
try to deal with macros that may or may not be present in various
queue.h incarnations.
2013-10-22 09:00:37 -06:00
Todd C. Miller
04588f6136 Fix memory leak of I/O buffer events in safe_close(). 2013-10-18 16:28:49 -06:00
Todd C. Miller
b985948e72 Convert the monitor process to the event subsystem. 2013-10-12 05:57:42 -06:00
Todd C. Miller
83d2d25c4c Convert the main sudo event loop to use the event subsystem.
Read events for I/O buffers are added before the loop starts.
Write events are added on demand as the buffers are filled.
2013-10-12 05:53:52 -06:00
Todd C. Miller
79acd5db49 Simple event subsystem that uses poll() or select(). Basically a
simplied subset of libevent2.  Currently only fd events are supported
(since that's all we need).  The poll() backend is used by default,
except on Mac OS X where poll() is broken for devices (including
/dev/tty and ptys).
2013-10-12 05:53:43 -06:00
Todd C. Miller
ff18c65862 Use SOCK_STREAM for socketpair, not SOCK_DGRAM so we get consistent
semantics when the other end closes.  This should make the conversion
to poll() less problematic.
2013-10-12 05:39:02 -06:00
Todd C. Miller
368a6558ca Change some error/errorx -> fatal/fatalx in comments and xgettext
flags.
2013-04-26 16:06:05 -04:00
Todd C. Miller
39acd2fcba Rename error/errorx -> fatal/fatalx and remove the exit value as
it was always 1.
2013-04-18 14:07:59 -04:00
Todd C. Miller
5cda642eb9 Bump I/O buffer size 32K 2013-03-15 11:31:58 -04:00
Todd C. Miller
19f37400d6 When running the command in a pty, defer the call to exec_setup()
until just before we exec the command.  This is consistent with the
non-pty path.  As a side effect, the monitor process runs as root
and not the runas user.
2013-03-05 06:56:57 -05:00
Todd C. Miller
5cb928c512 If the policy plugin does not provide a close function, there is
no command timeout and no pty is required, skip the event loop and
just exec the command directly.
2013-02-23 14:19:07 -05:00
Todd C. Miller
e764604485 Remove extra flag to sudo_sigaction(). We want to trap the signal
regardless of whether or not it is ignored by the underlying command
since there's no way to know what signal handlers the command will
install.  Now we just use sudo_sigaction() to set a flag in
saved_signals[] to indicate whether a signal needs to be restored
before exec.
2013-01-19 15:10:01 -05:00
Todd C. Miller
855a11af2b Move signal code into its own source file and add sudo_sigaction()
wrapper that has an extra flag to check the saved_signals list to
only install the handler if the signal is not already ignored.
Bump plugin API version for the new front-end signal behavior.
2013-01-17 13:29:46 -05:00
Todd C. Miller
541315212e Rename handle_signals() to dispatch_signals().
Block other signals in handler() so we don't have to worry about
the write() being interrupted.
2013-01-17 09:17:54 -05:00
Todd C. Miller
9479bb623b Add exec_background option in plugin command info and a sudoers
option to match.  When set, commands are started in the background
and automatically foregrounded as needed.  There are issues with
some ill-mannered programs (like Linux su) so this is not the
default.
2013-01-11 14:34:09 -05:00
Todd C. Miller
8b3edcc4a8 Always resume the command in the foreground if sudo itself is the
foreground process.  This helps work around poorly behaved programs
that catch SIGTTOU/SIGTTIN but suspend themselves with SIGSTOP.  At
worst, sudo will go into the background but upon resume the command
will be runnable.  Otherwise, we can get into a situation where the
command will immediately suspend itself.
2013-01-11 10:09:06 -05:00
Todd C. Miller
782da0aa81 No need to restore default signal handler for SIGSTOP as it is not
catchable.  Attempting to do so is harmless but sigaction() will
fail and set errno to EINVAL which makes it looks like there is an
error.
2012-12-28 11:03:23 -05:00
Todd C. Miller
1d7072fe09 Don't include <sys/param.h>. We only needed it for MAXPATHLEN,
MAXHOSTNAMELEN and the MIN/MAX macros.  We now use PATH_MAX and
HOST_NAME_MAX throughout without falling back on MAXPATHLEN or
MAXHOSTNAMELEN and define our own MIN/MAX macros as needed.
2012-12-04 10:40:47 -05:00
Todd C. Miller
2632ec7e69 Move warn/error into common and make static builds work. 2012-11-25 09:34:40 -05:00
Todd C. Miller
7b3d268687 Call gettext() on parameters for warning()/warningx() instead of
having warning() do it for us.
2012-11-25 09:34:04 -05:00
Todd C. Miller
595d3b2651 Display warning/error messages in the user's locale. 2012-11-08 15:37:44 -05:00
Todd C. Miller
592f6fefb0 Start commands in the background when I/O logging is enabled. We
can't do this on Mac OS X due to a kernel bug in tc[gs]etattr(2)
which returns EINTR on signal instead of restarting automatically.
2012-09-25 13:49:51 -04:00
Todd C. Miller
616d713e9b Handle SIGCONT_FG and SIGCONT_BG when converting signal number to
string in deliver_signal().
2012-09-25 13:31:20 -04:00
Todd C. Miller
0e94e8ca91 Fix running commands that need the terminal in the background when
I/O logging is enabled.  E.g. "sudo vi &".  When the command is
foregrounded, it will now resume properly.
2012-09-24 15:06:14 -04:00
Todd C. Miller
ab7dda035a Replace strsigname() with sig2str(), emulating it as needed. 2012-08-29 14:25:09 -04:00
Todd C. Miller
537dc94b9e Use strsigname() to print signal names in the debug output.
If the system has no strsigname(), use our own.
2012-08-26 20:12:51 -04:00
Todd C. Miller
0655deab57 Fix a comment, update a variable name in a prototype; all cosmetic. 2012-08-07 14:47:58 -04:00
Todd C. Miller
dc08cf3c99 If we receive a signal from the command we executed, do not forward
it back to the command.  This fixes a problem with BSD-derived
versions of the reboot command which send SIGTERM to all other
processes, including the sudo process.  Sudo would then deliver
SIGTERM to reboot which would die before calling the reboot() system
call, effectively leaving the system in single user mode.
2012-08-06 14:38:35 -04:00
Todd C. Miller
23b7a1fa5c Call the policy's init_session() function before we fork the child.
That way, the session is created and destroyed in the same process,
which is needed by some modules, such as  pam_mount.
2012-04-23 16:38:16 -04:00
Todd C. Miller
ce9863358a Add missing initialization of a sigaction structure when I/O logging.
Fixes a potential problem when suspending the command.
2012-04-23 14:56:31 -04:00
Todd C. Miller
eb8274bdcc Treat a tty read failure like EOF as it usually means the pty has
gone away.  Handle write() on the tty returning EIO.
2012-04-10 10:18:59 -04:00
Todd C. Miller
df04ccb207 Linux select() may return ENOMEM if there is a kernel resource
shortage.  Older Solaris select() may return EIO instead of EBADF
when the tty goes away.  If we get an unhandled select() failure,
kill the child and exit cleanly.
2012-04-10 10:18:39 -04:00
Todd C. Miller
c8ce3a0a85 Log the process id in the debug file output. Since we don't want
to keep calling getpid(), stash the value at init time and when we
fork().
2012-04-06 15:20:16 -04:00
Todd C. Miller
bb898cd5df Ignore SIGTTIN and SIGTTOU in main sudo process when I/O logging.
It is better to receive EIO from read()/write() than to be suspended
when we don't expect it.  Fixes a problem when our terminal is
revoked which can happen when, e.g. our sshd is killed unceremoniously.
Also, only change the value of "alive" from true to false, never
from false to true.  It is possible for us to receive notification
of the child having stopped after it is already dead.  This does
not mean it has risen from the grave.
2012-04-06 12:45:30 -04:00
Todd C. Miller
b4acbc9fe0 Distinguish between signals we received from the parent vs. those
delivered explicitly to the monitor process in debugging info.
2012-04-06 12:40:13 -04:00
Todd C. Miller
2311fed457 Make this compile after last change. 2012-04-05 12:59:26 -04:00
Todd C. Miller
c0a75ce9d9 Don't try to restore the terminal if we are not the foreground
process.  Otherwise, we may be stopped by SIGTTOU when we try to
update the terminal settings when cleaning up.
2012-04-05 12:40:51 -04:00
Todd C. Miller
7e6d00ed12 Don't need zero_bytes() after ecalloc() 2012-03-30 14:59:27 -04:00