isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,075 Commits 1 Branch 0 Tags
e5d98da014d502d2318bc1ac071a445a935a036c
Commit Graph

12075 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Todd C. Miller
e5d98da014 Move hexchar() from the sudoers plugin to lib/util. 2023-01-03 15:50:42 -07:00
Todd C. Miller
0cb3835111 sudo_open_parent_dir: adjust loop terminating condition 
Checking for ep < pathend should be a bit clearer than ep != '\0'
and has the advantage of working when pathend doesn't point to a
NUL byte.  No intended change in behavior.
 2023-01-03 15:22:29 -07:00
Todd C. Miller
311d8e82df iolog_mkdtemp: fix failure when the specified path contains subdirectories. 
This fixes a bug introduced in sudo 1.9.12.
 2023-01-03 14:30:48 -07:00
Todd C. Miller
bfd7d586b5 check_iolog_mkpath: fix exit value 2023-01-03 14:02:23 -07:00
Todd C. Miller
6f94854673 Merge pull request #227 from sohomdatta1/integer_underflow 
Prevent integer underflow due to environment variable
 2023-01-02 08:41:22 -07:00
Sohom
761ffb3bfe Prevent integer underflow due to environment variable 
Gaurd against replacing quotes when the environment variable
val_len is 1.
 2023-01-02 11:47:52 +05:30
Todd C. Miller
8b5037a211 glibc allows the ',' in {low,high} to be escaped with a backslash. 
Adjust bound parsing to match this.
 2023-01-01 10:12:09 -07:00
Todd C. Miller
acee3ea6ef Fix logic goof in 05781ba6f1f3, disable replacements when fuzzing. 
Not the other way around.
 2022-12-31 09:31:37 -07:00
Todd C. Miller
4b0dc2eecb Substitute python plugin file name in sudo_plugin_python documentation. 
Also use prefix for group plugin fallback path section in sudoers manual.
 2022-12-30 13:38:40 -07:00
Todd C. Miller
ad55f8ccee Use correct dictionary file format. 
Also use the new dictionaries in the Makefile fuzz target.
 2022-12-30 11:26:49 -07:00
Todd C. Miller
224a3b6470 Add some addition entries for the I/O log fuzzer seed corpus. 2022-12-30 11:10:40 -07:00
Todd C. Miller
148e5ad95b Add dictionaries for fuzz_iolog_legacy and fuzz_iolog_timing. 2022-12-30 10:52:54 -07:00
Todd C. Miller
774b3c6e68 Don't send warn/fatal output to the debug file when fuzzing. 2022-12-30 08:03:05 -07:00
Todd C. Miller
a9a3a8e37b Back out the genentropy.c portion of c648cfe9ff0f 
We don't need to special-case FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
now that we use the glibc arc4random() where available.
 2022-12-30 08:02:39 -07:00
Todd C. Miller
91d7592e8a Use initprogname(), not setprogname() in the fuzzers. 
This results in better coverage for progname.c.
 2022-12-29 15:52:21 -07:00
Todd C. Miller
206155e603 Add probe_interfaces and intercept_path. 2022-12-29 15:44:54 -07:00
Todd C. Miller
bd98868518 Exercise getter functions. 2022-12-29 15:44:33 -07:00
Todd C. Miller
3068ec000c Avoid using our function replacements when fuzzing (where possible). 
We don't want to fuzz the function replacements themselves as this
can skew the coverage reports.
 2022-12-29 13:22:29 -07:00
Todd C. Miller
3f095ff1b5 Disable sudo_debug tests when fuzzing. 
The debug code is disable when fuzzing is enabled to avoid coverage
issues.
 2022-12-29 12:38:00 -07:00
Todd C. Miller
2e9e1c80f5 Avoid compiling some code paths that are unreachable when fuzzing. 2022-12-29 10:40:48 -07:00
Todd C. Miller
8a5e9ffb43 Plug memory leak. 2022-12-29 10:35:09 -07:00
Todd C. Miller
47a211f194 Update fuzz_policy keywords to match current policy settings. 2022-12-28 16:02:25 -07:00
Todd C. Miller
a7c1b78c67 Add example users and groups to the dictionary. 2022-12-28 16:02:10 -07:00
Todd C. Miller
8eabbf8fdd parse_args: an environment variable may not start with '='. 
Also check VAR=val format in validate_env_vars() and add an error
message if insert_env_vars() fails.
 2022-12-28 14:07:43 -07:00
Todd C. Miller
c820599893 rebuild_env: avoid a potential NULL dereference in fuzz_policy 2022-12-28 11:05:17 -07:00
Todd C. Miller
b69ffd3479 sudoers_policy_main: plug memory leak of iolog_path on error. 2022-12-28 10:50:51 -07:00
Todd C. Miller
8e8a22b8e5 rebuild_env: avoid a potential NULL dereference in fuzz_policy 2022-12-28 09:45:01 -07:00
Todd C. Miller
bca945f074 The contents of the env_add array should not include the leading "env=" prefix. 
The previous fix for this was incomplete.
 2022-12-28 09:25:41 -07:00
Todd C. Miller
9c4271f737 validate_env_vars: more efficient errbuf handling 
Also avoid appending to errbuf if it is already full.
 2022-12-28 09:24:22 -07:00
Todd C. Miller
95a6c04598 Document that -k does not interfere with sudo on other terminals. 
This should help clarify the difference between "sudo -k" and "sudo -K".
 2022-12-27 20:18:56 -07:00
Todd C. Miller
ee5b43280b Check for bound values larger than 255 and reject them. 
This is to prevent the fuzzers from running out of memory.
 2022-12-27 13:22:29 -07:00
Todd C. Miller
adf2a432af Use the POSIX shell "command -v" instead of "which" to find programs. 
Fix false detection of init.d/service status.
 2022-12-27 12:28:53 -07:00
Todd C. Miller
519a005802 Fix example dir mode on RedHat/Fedora. 2022-12-27 12:27:29 -07:00
Todd C. Miller
e0fa2ec85c Use sed instead of ed to modify the packaged sudoers file. 
Some Linux distros do not include /bin/ed by default.
 2022-12-27 09:18:26 -07:00
Todd C. Miller
048b843e6d Use @intercept_file@ and @noexec_file@ like the example file. 2022-12-26 15:32:36 -07:00
Todd C. Miller
772fc914a8 There is a @pam_login_service@ substitution but no @pam_service@. 
Just use sudo instead of @pam_service@.
 2022-12-26 15:26:13 -07:00
Todd C. Miller
0354ec6a1d Use @sudoers_plugin@ instead of @sudoers_module@. 2022-12-26 14:28:28 -07:00
Todd C. Miller
eeea67e70b Use @sudoers_plugin@ instead of @sudoers_module@. 2022-12-26 13:56:43 -07:00
Todd C. Miller
f6e0e87ba9 sudo 1.9.13 
Document the changes to AIX plugins in docs/UPGRADE.md and regenerate
configure using the latest autoconf from git.
 2022-12-26 10:47:51 -07:00
Todd C. Miller
702f21f7f6 Remove anything after whitespace in MANIFEST when building tarball. 
This is consistent with how sudo's Makefile builds the tarball.
 2022-12-26 08:13:43 -07:00
Todd C. Miller
4baa6e103b Zap trailing whitespace. 2022-12-26 08:10:45 -07:00
Todd C. Miller
50958a05da Remove developer mode from sudo.conf, it is no longer used. 2022-12-26 07:43:55 -07:00
Todd C. Miller
fa1b86fca6 Remove the Python plugin import blocker code. 
The sudo.conf file is considered a trusted source of information
and these checks suffer from TOCTOU issues anyway.
 2022-12-26 07:43:55 -07:00
Todd C. Miller
73abff2d05 Remove the owner and mode checks when loading a sudo plugin. 
The sudo.conf file is considered a trusted source of information
and these checks suffer from TOCTOU issues anyway.  The checks
complicate loading of shared objects since we need to perform
fallback processing twice.
 2022-12-26 07:43:55 -07:00
Todd C. Miller
97fb4eae72 sudo_dso_load: add AIX fallback path from shlib.so to shlib.a(shlib.so). 
If the .so file is missing but the .a file exists, try to dlopen()
the AIX .a file using the .so name as the member.  We need to avoid
breaking existing configurations if the type of AIX shared library
changes when sudo is upgraded.
 2022-12-26 07:43:55 -07:00
Todd C. Miller
206700c3f0 Use AIX-style shared libraries on AIX by default instead of SVR4-style. 
This removes the need to use the -brtl linker flag which can cause
problems when there are both a .so and .a version of the same library
but with different versions.  This was particularly problematic
when using the AIX freeware version of OpenSSL.  The --with-aix-soname=svr4
option can be used to build SVR4-style shared libs instead.
 2022-12-26 07:43:55 -07:00
Todd C. Miller
5165fb9b22 Bump SUDOERS_GRAMMAR_VERSION to 50 for the new list pseudo-command. 2022-12-26 07:41:53 -07:00
Todd C. Miller
11aa808ef7 Use ".Sy root" instead of ".Em root" when talking about the root user. 
Replace MANDOCPROG with "mandoc" now that MANDOCPROG has been removed.
 2022-12-25 10:53:40 -07:00
Todd C. Miller
49f2d67070 Fix support for AIX-style path(module) syntax in sudo.conf Plugin lines. 2022-12-22 16:45:13 -07:00
Todd C. Miller
27aff55ac8 Merge pull request #226 from rtczza/main 
debug_return_int use error
 2022-12-22 19:59:02 -07:00