isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,579 Commits 1 Branch 0 Tags
c7157ce0b13b032e73e4ea70e95f45bba4afd813
Commit Graph

3711 Commits

Author SHA1 Message Date
Todd C. Miller
c7157ce0b1 Move a few fields from sudoers_user_contect to sudoers_context. 
They are not really specific to the user or user-specified.
 2023-08-21 15:30:12 -06:00
Todd C. Miller
9aaba80a04 Remove dead code dealing with unknown user and MODE_INVALIDATE. 
The timestamp unlink code does not need the user's struct passwd
pointer, just the user name (which we already have).  Found by
PVS-Studio.
 2023-08-21 13:21:51 -06:00
Todd C. Miller
49cd7463c5 Quiet a PVS-Studio false positive about possible NULL dereference. 
set_perms() is only called with a NULL ctx for PERM_ROOT, PERM_SUDOERS
and PERM_TIMESTAMP.
 2023-08-21 13:19:10 -06:00
Todd C. Miller
8161205447 MODE_KILL is never set in the sudoers plugin, remove it. 2023-08-21 12:52:21 -06:00
Todd C. Miller
c6987aa26e Cast int to size_t before adding instead of casting the result. 
Quiets PVS-Studio warning V1028.
 2023-08-21 12:50:31 -06:00
Todd C. Miller
9f05bfd298 Fix log_server_accept() definition for --disable-log-client builds. 2023-08-21 11:35:23 -06:00
Todd C. Miller
6fa4786534 Plug memory leak if journal_parse_error() fails. 
Found by the clang 15 analyzer.
 2023-08-21 10:47:32 -06:00
Todd C. Miller
46e6955ba6 Eliminate some clang analyzer false positives. 2023-08-21 10:47:32 -06:00
Todd C. Miller
ff5914d7f7 Move sudoedit_nfiles into struct sudoers_context. 2023-08-21 10:47:25 -06:00
Todd C. Miller
3473bf9360 Move sudo_mode into struct sudoers_context. 2023-08-21 10:47:23 -06:00
Todd C. Miller
837da1bef0 Move NewArgv, NewArgc and saved_argv into struct sudoers_context. 2023-08-21 09:22:24 -06:00
Todd C. Miller
87571dab0a Add struct sudoers_conf to struct sudoers_plugin_context. 
There's now no need to pass this directly to init_parser() since we
already pass in a pointer to a sudoers_context struct.
 2023-08-21 09:21:54 -06:00
Todd C. Miller
9e53d903ea Store policy paths in struct sudoers_context. 
This removes the need for the getters in policy.c.
 2023-08-21 09:21:53 -06:00
Todd C. Miller
bbaf293912 Add sudoers_ctx_free() and use it for freeing struct sudoers context. 
This replaces sudoers_user_ctx_free() and sudoers_runas_ctx_free().
 2023-08-21 09:21:52 -06:00
Todd C. Miller
2440174954 Make struct sudoers_context private to sudoers.c. 
We now pass a pointer to the context where necessary.  There are a
few cases where we need to request the context from sudoers via
sudoers_get_context() for the plugin API functions.  If the plugin
API was able to pass around a closure pointer this would not be
necessary.
 2023-08-21 09:21:49 -06:00
Todd C. Miller
2d2529a15e Add a sudoers_context struct that embeds the user and runas structs. 2023-08-20 16:27:08 -06:00
Todd C. Miller
1b9fb405a3 free_parse_tree: clear the nss pointer when freeing. 2023-08-18 12:24:00 -06:00
Todd C. Miller
a712af5a26 sudoers_parse_ldif: do not free parse_tree before using 
The user is expected to pass in an initialized and empty parse_tree
so there is no need to free it first.
 2023-08-18 12:22:43 -06:00
Todd C. Miller
cb01b90a5c We still need to clamp ngids if getgrouplist2() returns -1. 
Otherwise, we end up with ngids set to the number of gids the user
belongs to which may be larger than what the front-end specified.
Fixes a regression introduced in the last commit here.
 2023-08-15 08:52:02 -06:00
Todd C. Miller
f17aebe6aa No need to clear errno when using sudo_strtonum(). 2023-08-14 16:29:47 -06:00
Todd C. Miller
20baa39007 Move max_groups out of sudoers_user_context and into pwutil.c. 
It is only used by the local password pwutil implementation.
 2023-08-14 16:29:15 -06:00
Todd C. Miller
737354390c Pass in directory to check_user_runchroot() and check_user_runcwd(). 
This way we do not rely on the runas_ctx global.
 2023-08-14 13:25:13 -06:00
Todd C. Miller
2e8648ea0f check_exptilde: don't need runas_ctx here 2023-08-14 12:37:44 -06:00
Todd C. Miller
08afb5183f Move RUNAS_{USER,GROUP}_SPECIFIED flags into struct sudoers_runas_context. 2023-08-14 09:01:39 -06:00
Todd C. Miller
392f0d61cb Make path_plugin_dir private to policy.c and add getter. 2023-08-13 17:05:00 -06:00
Todd C. Miller
217b7b46f3 Move list_pw global into struct runas_context. 2023-08-13 09:34:57 -06:00
Todd C. Miller
a321e6cedf Add struct sudoers_runas_context and move runas-specific bits into it. 2023-08-12 14:20:30 -06:00
Todd C. Miller
d8b28dad97 Expand the user_* (and more) macros to user_ctx.foo. 2023-08-12 10:39:59 -06:00
Todd C. Miller
930ca00252 Pass explicit struct passwd * to create_admin_success_flag(). 2023-08-12 10:39:49 -06:00
Todd C. Miller
30c49288f7 Make sudoers_user_ctx_free() private to sudoers.c 2023-08-12 10:39:48 -06:00
Todd C. Miller
bd8cccb5dd Rename struct sudo_user -> struct sudo_user_context. 
Also rename the sudo_user global to user_ctx.
 2023-08-12 10:39:47 -06:00
Todd C. Miller
6f659e2deb Leave the I/O log callbacks in iolog.c 
Otherwise, check_iolog_plugin will not link.
 2023-08-10 16:20:18 -06:00
Todd C. Miller
603148e7f2 Move sudoers parser callbacks to callbacks.c. 2023-08-10 15:49:30 -06:00
Todd C. Miller
0f2e5dae90 Use const pointers where possible in the display code. 2023-08-09 11:19:17 -06:00
Todd C. Miller
60eef27e6d Add verbose version of "sudo -l command" by using an extra -l. 
The output of "sudo -ll command" consists of the matching sudoers
rule (in long form) with the addition of a "Matched" entry that
shows the fully-qualfied path along with any arguments.
 2023-08-09 10:16:10 -06:00
Todd C. Miller
f6291bf83e Move code to display a cmndspec in long form to display_cmndspec_long(). 2023-08-09 09:58:24 -06:00
Todd C. Miller
5a1a3ff74b sudo -ll: display the sudoers file the rule came from. 2023-08-09 08:50:56 -06:00
Todd C. Miller
e178b85821 Store the source of the matching rule and store in the event log. 
The JSON logs will store the matching rule source.
 2023-08-08 09:57:09 -06:00
Todd C. Miller
f6a9bb2e23 Use a single callback for sudoers_lookup() and add a closure pointer. 
The single callback now receives all the match info (or UNSPEC if
no match was attempted).  This makes it possible to use the callback
for more than just printing testsudoers output.
 2023-08-07 15:06:19 -06:00
Todd C. Miller
1e6c5f3e79 Fix checking of SSL_{read,write}_ex() return value. 
These have a boolean-style return value.  However, our emulated
versions can return -1 on error, which we need to preserve for older
versions of SSL_get_error() which expect it.
 2023-08-08 10:18:57 -06:00
Todd C. Miller
77f94f291a sudo_digest_getlen: return size_t, and 0 on error instead of -1 
This is an API change, sudo_digest_getlen_v1 remains for binary
compatibility.
 2023-08-07 08:43:13 -06:00
Todd C. Miller
184e03b4a9 ERR_get_error() returns unsigned long, not int. 2023-08-07 08:05:00 -06:00
Todd C. Miller
861ed2b7d4 We now must pass "err" SSL_get_error(), not "nread". 2023-08-07 07:59:58 -06:00
Todd C. Miller
d6d467b92e Add implementation of SSL_read_ex/SSL_write_ex for those without. 2023-08-05 10:38:02 -06:00
Todd C. Miller
e6d14c95b6 Use SSL_read_ex() and SSL_write_ex() instead of SSL_read() and SSL_write(). 2023-08-05 10:38:01 -06:00
Todd C. Miller
4f3786f70f visudo: do not create a new file if the user made no changes 
This prevents visudo from creating a new zero-length sudoers file
if the user exited the editor without making any changes.  Files
created via a @include directive are preserved, even if empty, to
avoid a parse error.  GitHub issue #294.
 2023-07-27 11:23:25 -06:00
Todd C. Miller
14f1a12e2d testsudoers: add -L, -l and -v tests 2023-07-26 13:59:33 -06:00
Todd C. Miller
d62d704e55 testsudoers: display when a password is required 2023-07-26 11:14:45 -06:00
Todd C. Miller
75256516bd testsudoers: add -L, -l and -v options. 
This makes it possible to test "sudo -l" and "sudo -v" using
testsudoers.
 2023-07-26 10:37:52 -06:00
Todd C. Miller
538be58ac0 sudoers_lookup_pseudo: sync with sudoers_lookup_check 
This makes sudoers_lookup_pseudo(), which is used for pseudo-command
like "list" and "validate" a bit more like sudoers_lookup_check().
Time of day checks are performed, and callbacks are supported.  We
cannot use the same code for regular commands and pseudo-commands
due to the "pwcheck == all" case.
 2023-07-25 15:57:20 -06:00