isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,409 Commits 1 Branch 0 Tags
cdd5bb32eb56b02dfc802a05ebad8051a644c360
Commit Graph

2344 Commits

Author SHA1 Message Date
Todd C. Miller
843213d3de Handle escaped commas when skipping over the cn. 2018-03-04 07:03:38 -07:00
Todd C. Miller
72dd971ee1 Add missing sudoOrder support to parse_ldif(). 2018-03-02 11:27:01 -07:00
Todd C. Miller
8c7f3e791c Add missing support for converting LOG_INPUT/LOG_OUTPUT tags and 
expand support for NOMAIL tags.
 2018-03-02 11:12:14 -07:00
Todd C. Miller
44fc165e7c Don't emit an empty sudoRole for global defaults if there are none. 2018-03-02 10:59:19 -07:00
Todd C. Miller
e96398cac2 Avoid changing the order of non-negated hosts and commands. 
We still put negated hosts/commands at the end of the list.
 2018-03-02 10:58:50 -07:00
Todd C. Miller
e750bae75d Handle parsing boolean options that have no explicit value. 2018-03-02 10:44:33 -07:00
Todd C. Miller
9af4447c3d Refactor the code that actually converts the role to sudoers format 
into role_to_sudoers() now that it is more involved than just calling
sudo_ldap_role_to_priv().
 2018-03-02 09:27:27 -07:00
Todd C. Miller
9b20bb1493 When merging two privileges, use the runas lists of the previous 
privilege when possible.  Otherwise, the generated sudoers line
will include a runas list for commands that is not necessary.
 2018-03-02 06:42:29 -07:00
Todd C. Miller
fff4acc1f7 Use a case-insensitive comparison when matching user and group names 
in sudoers with the passwd or group database.  This can be necessary
when users and groups are stored in AD or LDAP.
 2018-03-01 20:31:01 -07:00
Todd C. Miller
88bc4ba865 Fix clean target for *.sudo regress files 2018-03-01 10:35:32 -07:00
Todd C. Miller
8275ab873f Fix use of uninitialized variable (conf) if sudoers_debug_register() 
happens to fail.
 2018-03-01 10:18:48 -07:00
Todd C. Miller
73b5f961ee Split conversion code out of parse_ldif() and into ldif_to_sudoers(). 2018-02-28 16:21:09 -07:00
Todd C. Miller
8da213c8be Quiet a clang analyzer warning. 2018-02-28 14:44:54 -07:00
Todd C. Miller
120bb6de7f rename ldap_common.c -> ldap_util.c 2018-02-28 14:24:33 -07:00
Todd C. Miller
3a2ae844ec When converting from ldif to sudoers, sudoRole objects with the 
same user if possible.  If both user and host are the same, merge
into a single privilege.  This makes it possible to convert a
sudoers entry like:

    aaron shanty = NOEXEC: /usr/bin/vi, /usr/bin/more, EXEC: /bin/sh

to ldif and then back to sudoers as a single line.  Currently, the
ldif entries to be merged must have the same or adjacent sudoOrder
attributes.
 2018-02-28 14:02:50 -07:00
Todd C. Miller
56bdde1339 plug memory leaks 2018-02-28 14:02:11 -07:00
Todd C. Miller
7919b9ad2e When converting from LDAP to sudoers, put negated hosts and commands 
at the end of the list.  Since LDAP doesn't guarantee attribute order
we need to make sure negated entries always override non-negated ones.
 2018-02-25 06:30:32 -07:00
Todd C. Miller
6f097eb023 We may need the hostname to resolve %h escapes in include files. 2018-02-24 18:46:00 -07:00
Todd C. Miller
b3a0c3272b Setting a sudoOrder start point of 0 will disable creation of 
sudoOrder attributes in the resulting LDIF output.
 2018-02-24 14:35:38 -07:00
Todd C. Miller
111d79b53c Don't need to fill in struct sudo_user since we don't do matching. 2018-02-24 09:28:01 -07:00
Todd C. Miller
5999cfb906 Add support for setting default options in a config file. In 
addition to expand_aliases, input_format and output_format, both
the initial sudoOrder and the increment when updating sudoOrder for
subsequent sudoRole objects can be specified.  Command line options
have also been added for the start order and increment.
 2018-02-24 09:23:14 -07:00
Todd C. Miller
19502307aa Deal with user_name not being set in cvtsudoers. 2018-02-22 10:43:47 -07:00
Todd C. Miller
ceea24b965 Initial support for parsing sudoers LDIF files in cvtsudoers. 
This makes it possible to convert from LDAP sudoers to a traditional
sudoers file.  Semantic differences between file sudoers and LDAP
sudoers mean that LDIF -> sudoers is not completely equivalent.
 2018-02-22 09:53:12 -07:00
Todd C. Miller
8b22ed7837 Fix LDIF conversion of commands with an associated digest. 2018-02-21 21:24:53 -07:00
Todd C. Miller
91f97d2f23 In array_to_member_list() use the correct type for netgroups and 
user groups.
 2018-02-21 21:09:57 -07:00
Todd C. Miller
337ace6441 Prepend digest to command if present. 
Fix printing of group IDs and non-unix groups.
 2018-02-21 21:08:37 -07:00
Todd C. Miller
c13557b6cb Fix gcc false positive for uninitialized variable 2018-02-21 21:02:36 -07:00
Todd C. Miller
4f9296928c Add option to cvtsudoers to expand aliases in the output. 2018-02-19 15:32:56 -07:00
Todd C. Miller
3f204c5eb8 Fix conversion of "ALL" in the JSON output format, which was being 
printed as an alias.
 2018-02-19 13:39:11 -07:00
Todd C. Miller
42fe0409f6 Add sudo_ev_dispatch(), a wrapper for ev_loop() with no flags. 
Similar the dispatch function in libevent.
 2018-02-19 11:00:10 -07:00
Todd C. Miller
43a3a23fed Move LDAP configuration bits into ldap_conf.c 2018-02-11 07:36:08 -07:00
Todd C. Miller
0c08de88cd No longer need to include stddef.h 2018-02-10 13:37:59 -07:00
Todd C. Miller
e2213dc1e3 Remove dead store, found by cppcheck. 2018-02-10 09:44:34 -07:00
Todd C. Miller
34820c6b15 simplify iterator 2018-02-10 04:29:43 -07:00
Todd C. Miller
6e2a267060 Silence a false positive from cppcheck. 2018-02-10 04:08:42 -07:00
Todd C. Miller
d0d413d077 Cast version to int when printing. Avoids a cppcheck warning. 2018-02-10 04:00:17 -07:00
Todd C. Miller
4459ee42ed Use an iterator instead of fragile pointer arithmetic to iterate 
over value arrays in sudo_ldap_role_to_priv().
 2018-02-09 22:06:56 -07:00
Todd C. Miller
64e99328e3 Move sudoers formatting code into fmtsudoers. 2018-02-09 18:22:04 -07:00
Todd C. Miller
dda1d6cef7 Clean up some XXX in parse.c 2018-02-09 18:22:03 -07:00
Todd C. Miller
2522229e86 Rename sudo_file_append_default() -> sudo_lbuf_append_default() and 
use it for ldap and sssd too.
 2018-02-09 18:22:02 -07:00
Todd C. Miller
3226f7e28b Move common bits of ldap to sudoers conversion into ldap_common.c 
and use it in sssd.c.
 2018-02-09 18:21:40 -07:00
Todd C. Miller
4e2402a8e4 Convert ldap results into a sudoers userspec so we can use the "sudo 
-l" output functions in parse.c.
 2018-02-09 18:21:01 -07:00
Todd C. Miller
5cca4b6906 Refactor member freeing code into free_member(). 
Refactor userspec freeing code into free_userspec().
 2018-02-05 13:33:29 -07:00
Todd C. Miller
9d49592f14 Fix compilation with glibc where stdout is not constant. 2018-02-05 06:23:33 -07:00
Todd C. Miller
57e7b4b49e For "sudo -l", if a word includes spaces, print it in double quotes. 
Also escape spaces in the command path.  This matches the sudoers
quoting rules.
 2018-02-04 12:53:32 -07:00
Todd C. Miller
3189de5bb9 Display sudoNotBefore and sudoNotAfter in "sudo -l" 2018-02-03 14:56:00 -07:00
Todd C. Miller
105ced47b8 For "sudo -l", if a word includes spaces, print it in double quotes. 
Also escape spaces in the command path.  This matches the sudoers
quoting rules.
 2018-02-03 06:59:37 -07:00
Todd C. Miller
40c200af18 Add back printing of negation operator ('!') when printing a word 
with spaces in it.
 2018-02-03 06:57:12 -07:00
Todd C. Miller
1aca11c788 Use visudo to validate "cvtsudoers -f sudoers" output. 2018-02-03 06:46:56 -07:00
Todd C. Miller
f31ba6c22f Remove syslog_goodpri and syslog_badpri without a value that causes 
visudo to report an error.
 2018-02-03 06:45:39 -07:00