isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,039 Commits 1 Branch 0 Tags
d5d170252a1065a6b10c3e8d0a7df1aee13a33df
Commit Graph

9039 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Todd C. Miller
98c19a68c9 Use the built-in sudoers file location as the default sudoers file 
for cvtsudoers and move parse_sudoers_options() to stubs.c since
it is shared between visudo.c and cvtsudoers.c.
 2018-01-26 13:15:10 -07:00
Todd C. Miller
0f3030d502 Move common stub functions required by the parser out of visudo.c 
and cvtsudoers.c and into stubs.c.
 2018-01-26 12:51:24 -07:00
Todd C. Miller
02d917e602 Rename export_sudoers() to convert_sudoers_json() and move the 
check for the same input and output file to the front-end.
 2018-01-26 12:28:49 -07:00
Todd C. Miller
41bd9ae26f add cvtsudoers 2018-01-26 12:26:59 -07:00
Todd C. Miller
80cb1b5da9 Move sudoers JSON conversion to cvtsudoers which will eventually 
output to other formats too.
 2018-01-26 11:20:37 -07:00
Todd C. Miller
bcfb092a4e Convert from time in minutes to timespec directly instead of 
converting to double via strtod().  This makes it easier to catch
overflow.
 2018-01-26 10:17:47 -07:00
Todd C. Miller
eb8b5c7964 document that kernel tty timestamps don't support negative timeouts 2018-01-24 05:27:54 -07:00
Todd C. Miller
b3601253e6 Fall back to ppid time stamps if timestamp_type == kernel and no 
tty is present.  This is consistent with timestamp_type == tty.
 2018-01-23 11:18:18 -07:00
Todd C. Miller
52409b9c72 Do not call the TIOCSETVERAUTH ioctl with a negative number of seconds. 
Also cap the max number of seconds at 3600 to avoid getting EINVAL
from TIOCSETVERAUTH.
 2018-01-23 11:05:41 -07:00
Todd C. Miller
2e37959fec Better conversion from double to nanoseconds. 2018-01-22 17:27:25 -07:00
Todd C. Miller
4c0c225062 Store passwd_timeout and timestamp_timeout as a struct timespec 
instead of as a float.  Remove timeout argument to auth_getpass()
as it was never used.
 2018-01-22 12:18:48 -07:00
Todd C. Miller
44e4aac445 Don't rely on perl being installed in /usr/local/bin 2018-01-21 16:08:22 -07:00
Todd C. Miller
a885b952fb Remove use of AC_HEADER_TIME, only obsolete platforms actually 
need this.  Also stop removing sys/time.h unless the source file
uses struct timeval.
 2018-01-17 09:52:15 -07:00
Todd C. Miller
b161ebe62d Remove duplicate options %type 2018-01-17 09:52:09 -07:00
Todd C. Miller
594c2d4efd Add an approval function to the sudo auth API which is run after 
the user's password has been verified.  The approval function is
run even if no password is required.  This is currently only used
for PAM (use pam_acct_mgmt) and BSD auth (auth_approval).
 2018-01-16 10:27:58 -07:00
Todd C. Miller
f7896025ea treat uid as unsigned in error message 2018-01-15 10:29:38 -07:00
Todd C. Miller
aa516b0a51 Add missing plugins/sudoers/po/fur.mo file to repo. 2018-01-15 10:24:13 -07:00
Todd C. Miller
44fdb3228e Mention new sudoers_timestamp manual. 2018-01-15 10:12:40 -07:00
Todd C. Miller
b92a33ba3e ignore tsdump 2018-01-12 11:43:02 -07:00
Todd C. Miller
a47f47967c Convert from mono time to real time before displaying time stamps. 2018-01-12 11:03:22 -07:00
Todd C. Miller
da67a54906 Use PATH_MAX, not MAXPATHLEN. 2018-01-11 14:55:11 -07:00
Todd C. Miller
ff5ac3ef0e Add tsdump, a simple utility to dump a timestamp file. To build, 
run "make tsdump" in the plugins/sudoers directory (it is not built
by default).  In order to map the tty device number to a name,
sudo_ttyname_dev() has been moved into libsudo_util.
 2018-01-11 10:49:20 -07:00
Todd C. Miller
d5f4fdb814 sync with translationproject.org 2018-01-04 21:35:47 -07:00
Todd C. Miller
70f406d67f Welcome to 2018 2018-01-04 21:35:17 -07:00
Todd C. Miller
636bfad02d sync with translationproject.org 2017-12-28 08:09:53 -07:00
Todd C. Miller
f2fdda1aa7 Silence a clang analyzer false positive. 2017-12-22 13:27:08 -07:00
Todd C. Miller
83ad5d9dbc Remove extra $(srcdir)/sudoreplay.man.in target added by mistake. 2017-12-22 12:55:41 -07:00
Todd C. Miller
00016b17a5 sync with translationproject.org 2017-12-22 12:47:07 -07:00
Todd C. Miller
7f99af859a Use a tty lock even for kernel time stamps so we can avoid simultaneous 
password prompts.
 2017-12-22 11:10:22 -07:00
Todd C. Miller
c4534798dd visudo changes 2017-12-22 10:39:57 -07:00
Todd C. Miller
23ac62cfb5 Also honor SUDO_EDITOR in visudo. Previously is was only used 
by sudoedit.
 2017-12-22 10:22:33 -07:00
Todd C. Miller
fa2ab63da9 Stop looking for an editor as soon as we find one. 
A similar fix was made to visudo some time ago.
 2017-12-21 16:31:42 -07:00
Todd C. Miller
740a479806 The session ID was added in 1.8.6p7 to prevent a user in another 
session from re-using the time stamp file.
Other minor cleanups.
 2017-12-21 14:37:13 -07:00
Todd C. Miller
54158f6918 "time stamp" not "timestamp" 2017-12-21 14:21:48 -07:00
Todd C. Miller
feb48b8ebf Add "kernel" as a possible value of timestamp_type. 
Currently only supported on OpenBSD.
 2017-12-20 16:19:54 -07:00
Todd C. Miller
5f3797c754 Document the sudoers time stamp file format. 2017-12-20 13:01:06 -07:00
Todd C. Miller
ae8917a070 Verify start time of the current process, allowing for some clock 
drift.  For Linux, process start time is relative to boot time, not
wallclock time.
 2017-12-19 10:10:54 -07:00
Todd C. Miller
f41927488b sync 2017-12-18 11:34:59 -07:00
Todd C. Miller
e73a5574ce regen 2017-12-18 10:52:45 -07:00
Todd C. Miller
6ce85b1746 Trivial test for process start time. We don't try to check the 
resulting timespec as it differs by platform.  On most it is wallclock
time, on others it is relative to boot time (Linux).
 2017-12-18 10:35:37 -07:00
Todd C. Miller
d93559e9c0 regen 2017-12-18 09:39:06 -07:00
Todd C. Miller
de2f455d3e Support start time on macOS and 4.4BSD 2017-12-17 07:40:21 -07:00
Todd C. Miller
428a487e0b Include sys/types.h for mode_t used in sudoers.h. 2017-12-16 20:55:01 -07:00
Todd C. Miller
b78296197d Fix compilation error on FreeBSD 2017-12-16 20:46:58 -07:00
Todd C. Miller
79caf1e68d Fix debug_decl(), it should be SUDOERS_DEBUG_UTIL 
Add debugging for the successful case
For Linux, don't NUL out *ep before parsing with strtoull().
* * *
Add missing debug info for the System V /proc version.
 2017-12-16 14:50:14 -07:00
Todd C. Miller
1709dc7f77 In the timestamp record, include the start time of the terminal 
session leader for tty-based timestamps or the start time of the
parent process for ppid-based timestamps.  Idea from Duncan Overbruck.
 2017-12-16 05:53:05 -07:00
Todd C. Miller
5cec5734cc If the lock record doesn't match the expected record size we need 
to seek to the end of the record as we otherwise may have gone too
far (or not far enough).  Fixes interop problems when the time stamp
record changes size.
 2017-12-15 21:08:38 -07:00
Todd C. Miller
cd0b700543 No need for a loop around the recv() now that we don't have to worry 
about EINTR.  CID 180697
 2017-12-12 21:44:23 -07:00
Todd C. Miller
bda2f4c441 Try to be clearer about sudo's exit value when the -l option is used. 2017-12-12 15:42:21 -07:00
Todd C. Miller
3604ff5bb2 sync 2017-12-12 15:13:52 -07:00