b9746389ce
get it if we are still running, else let init reap it for us. The extra time it takes to wait lets the user know that mail is being sent. Install SIGCHLD handler in main() and for POSIX signals, block everything *except* SIGCHLD.
1034 lines
26 KiB
C
1034 lines
26 KiB
C
/*
|
|
* Copyright (c) 1994-1996,1998-1999 Todd C. Miller <Todd.Miller@courtesan.com>
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
*
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* 3. The name of the author may not be used to endorse or promote products
|
|
* derived from this software without specific prior written permission.
|
|
*
|
|
* 4. Products derived from this software may not be called "Sudo" nor
|
|
* may "Sudo" appear in their names without specific prior written
|
|
* permission from the author.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
|
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
|
|
* THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
|
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
|
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
|
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
|
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
|
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*
|
|
* For a brief history of sudo, please see the HISTORY file included
|
|
* with this distribution.
|
|
*/
|
|
|
|
#define _SUDO_SUDO_C
|
|
|
|
#include "config.h"
|
|
|
|
#include <stdio.h>
|
|
#ifdef STDC_HEADERS
|
|
#include <stdlib.h>
|
|
#endif /* STDC_HEADERS */
|
|
#ifdef HAVE_UNISTD_H
|
|
#include <unistd.h>
|
|
#endif /* HAVE_UNISTD_H */
|
|
#ifdef HAVE_STRING_H
|
|
#include <string.h>
|
|
#endif /* HAVE_STRING_H */
|
|
#ifdef HAVE_STRINGS_H
|
|
#include <strings.h>
|
|
#endif /* HAVE_STRINGS_H */
|
|
#include <pwd.h>
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <signal.h>
|
|
#include <grp.h>
|
|
#include <time.h>
|
|
#include <sys/types.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/param.h>
|
|
#include <netinet/in.h>
|
|
#include <netdb.h>
|
|
#if defined(HAVE_GETPRPWNAM) && defined(HAVE_SET_AUTH_PARAMETERS)
|
|
#include <prot.h>
|
|
#endif /* HAVE_GETPRPWNAM && HAVE_SET_AUTH_PARAMETERS */
|
|
|
|
#include "sudo.h"
|
|
#include "interfaces.h"
|
|
|
|
#ifndef STDC_HEADERS
|
|
extern char *getenv __P((char *));
|
|
#endif /* STDC_HEADERS */
|
|
|
|
#ifndef lint
|
|
static const char rcsid[] = "$Sudo$";
|
|
#endif /* lint */
|
|
|
|
/*
|
|
* Local type declarations
|
|
*/
|
|
struct env_table {
|
|
char *name;
|
|
int len;
|
|
};
|
|
|
|
/*
|
|
* Prototypes
|
|
*/
|
|
static int parse_args __P((void));
|
|
static void usage __P((int));
|
|
static void usage_excl __P((int));
|
|
static void check_sudoers __P((void));
|
|
static int init_vars __P((int));
|
|
static void add_env __P((int));
|
|
static void clean_env __P((char **, struct env_table *));
|
|
extern int user_is_exempt __P((void));
|
|
extern struct passwd *sudo_getpwuid __P((uid_t));
|
|
extern void list_matches __P((void));
|
|
|
|
/*
|
|
* Globals
|
|
*/
|
|
int Argc;
|
|
char **Argv;
|
|
int NewArgc = 0;
|
|
char **NewArgv = NULL;
|
|
struct sudo_user sudo_user;
|
|
FILE *sudoers_fp = NULL;
|
|
static char *runas_homedir = NULL; /* XXX */
|
|
struct interface *interfaces;
|
|
int num_interfaces;
|
|
extern int errorlineno;
|
|
|
|
/*
|
|
* Table of "bad" envariables to remove and len for strncmp()
|
|
*/
|
|
static struct env_table badenv_table[] = {
|
|
{ "IFS=", 4 },
|
|
{ "LOCALDOMAIN=", 12 },
|
|
{ "RES_OPTIONS=", 12 },
|
|
{ "HOSTALIASES=", 12 },
|
|
{ "LD_", 3 },
|
|
{ "_RLD", 4 },
|
|
#ifdef __hpux
|
|
{ "SHLIB_PATH=", 11 },
|
|
#endif /* __hpux */
|
|
#ifdef _AIX
|
|
{ "LIBPATH=", 8 },
|
|
#endif /* _AIX */
|
|
#ifdef HAVE_KERB4
|
|
{ "KRB_CONF", 8 },
|
|
#endif /* HAVE_KERB4 */
|
|
#ifdef HAVE_KERB5
|
|
{ "KRB5_CONFIG", 11 },
|
|
#endif /* HAVE_KERB5 */
|
|
{ "ENV=", 4 },
|
|
{ "BASH_ENV=", 9 },
|
|
{ (char *) NULL, 0 }
|
|
};
|
|
|
|
|
|
int
|
|
main(argc, argv)
|
|
int argc;
|
|
char **argv;
|
|
{
|
|
int validated;
|
|
int fd;
|
|
int cmnd_status;
|
|
int sudo_mode;
|
|
#ifdef POSIX_SIGNALS
|
|
sigset_t set, oset;
|
|
struct sigaction sa;
|
|
#else
|
|
int omask;
|
|
#endif /* POSIX_SIGNALS */
|
|
extern char **environ;
|
|
extern int printmatches;
|
|
|
|
/* Must be done as the first thing... */
|
|
#if defined(HAVE_GETPRPWNAM) && defined(HAVE_SET_AUTH_PARAMETERS)
|
|
(void) set_auth_parameters(argc, argv);
|
|
# ifdef HAVE_INITPRIVS
|
|
initprivs();
|
|
# endif
|
|
#endif /* HAVE_GETPRPWNAM && HAVE_SET_AUTH_PARAMETERS */
|
|
|
|
Argv = argv;
|
|
Argc = argc;
|
|
|
|
if (geteuid() != 0) {
|
|
(void) fprintf(stderr, "Sorry, %s must be setuid root.\n", Argv[0]);
|
|
exit(1);
|
|
}
|
|
|
|
/* Initialize syslog(3) if we are using it. */
|
|
#if (LOGGING & SLOG_SYSLOG)
|
|
# ifdef LOG_NFACILITIES
|
|
openlog("sudo", 0, LOGFAC);
|
|
# else
|
|
openlog("sudo", 0);
|
|
# endif /* LOG_NFACILITIES */
|
|
#endif /* LOGGING & SLOG_SYSLOG */
|
|
|
|
/* Catch children as they die... */
|
|
#ifdef POSIX_SIGNALS
|
|
(void) memset((VOID *)&sa, 0, sizeof(sa));
|
|
sa.sa_handler = reapchild;
|
|
(void) sigaction(SIGCHLD, &sa, NULL);
|
|
#else
|
|
(void) signal(SIGCHLD, reapchild);
|
|
#endif /* POSIX_SIGNALS */
|
|
|
|
/*
|
|
* Block signals so the user cannot kill us at some point and
|
|
* avoid the logging.
|
|
*/
|
|
#ifdef POSIX_SIGNALS
|
|
(void) sigfillset(&set);
|
|
(void) sigdelset(&set, SIGCHLD);
|
|
(void) sigprocmask(SIG_BLOCK, &set, &oset);
|
|
#else
|
|
omask = sigblock(sigmask(SIGHUP)|sigmask(SIGINT)|sigmask(SIGQUIT)|sigmask(SIGILL)|sigmask(SIGTSTP));
|
|
#endif /* POSIX_SIGNALS */
|
|
|
|
/*
|
|
* Close any open fd's other than stdin, stdout and stderr.
|
|
*/
|
|
#ifdef HAVE_SYSCONF
|
|
for (fd = sysconf(_SC_OPEN_MAX) - 1; fd > 2; fd--)
|
|
(void) close(fd);
|
|
#else
|
|
for (fd = getdtablesize() - 1; fd > 2; fd--)
|
|
(void) close(fd);
|
|
#endif /* HAVE_SYSCONF */
|
|
|
|
/*
|
|
* Set the prompt based on $SUDO_PROMPT (can be overridden by `-p')
|
|
*/
|
|
if ((user_prompt = getenv("SUDO_PROMPT")) == NULL)
|
|
user_prompt = PASSPROMPT;
|
|
|
|
/* Parse our arguments. */
|
|
sudo_mode = parse_args();
|
|
|
|
switch (sudo_mode) {
|
|
case MODE_VERSION:
|
|
print_version();
|
|
exit(0);
|
|
break;
|
|
case MODE_HELP:
|
|
usage(0);
|
|
break;
|
|
case MODE_VALIDATE:
|
|
user_cmnd = "validate";
|
|
break;
|
|
case MODE_KILL:
|
|
case MODE_INVALIDATE:
|
|
user_cmnd = "kill";
|
|
break;
|
|
case MODE_SHELL:
|
|
user_cmnd = "shell";
|
|
break;
|
|
case MODE_LIST:
|
|
user_cmnd = "list";
|
|
printmatches = 1;
|
|
break;
|
|
}
|
|
|
|
/* Must have a command to run... */
|
|
if (user_cmnd == NULL && NewArgc == 0)
|
|
usage(1);
|
|
|
|
clean_env(environ, badenv_table);
|
|
|
|
cmnd_status = init_vars(sudo_mode);
|
|
|
|
set_perms(PERM_USER, sudo_mode);
|
|
|
|
check_sudoers(); /* check mode/owner on _PATH_SUDOERS */
|
|
|
|
if (sudo_mode == MODE_KILL || sudo_mode == MODE_INVALIDATE) {
|
|
remove_timestamp((sudo_mode == MODE_KILL));
|
|
exit(0);
|
|
}
|
|
|
|
add_env(!(sudo_mode & MODE_SHELL)); /* add in SUDO_* envariables */
|
|
|
|
/* Validate the user but don't search for pseudo-commands. */
|
|
validated =
|
|
sudoers_lookup((sudo_mode != MODE_VALIDATE && sudo_mode != MODE_LIST));
|
|
|
|
/* Require a password unless the NOPASS tag was set. */
|
|
if (!(validated & FLAG_NOPASS))
|
|
check_user();
|
|
|
|
if (validated & VALIDATE_ERROR)
|
|
log_error(0, "parse error in %s near line %d", _PATH_SUDOERS,
|
|
errorlineno);
|
|
else if (validated & VALIDATE_OK) {
|
|
/* Finally tell the user if the command did not exist. */
|
|
if (cmnd_status == NOT_FOUND_DOT) {
|
|
(void) fprintf(stderr, "%s: ignoring `%s' found in '.'\nUse `sudo ./%s' if this is the `%s' you wish to run.\n", Argv[0], user_cmnd, user_cmnd, user_cmnd);
|
|
exit(1);
|
|
} else if (cmnd_status == NOT_FOUND) {
|
|
(void) fprintf(stderr, "%s: %s: command not found\n", Argv[0],
|
|
user_cmnd);
|
|
exit(1);
|
|
}
|
|
|
|
log_auth(validated, 1);
|
|
if (sudo_mode == MODE_VALIDATE)
|
|
exit(0);
|
|
else if (sudo_mode == MODE_LIST) {
|
|
list_matches();
|
|
exit(0);
|
|
}
|
|
|
|
/* Become specified user or root. */
|
|
set_perms(PERM_RUNAS, sudo_mode);
|
|
|
|
/* Set $HOME for `sudo -H' */
|
|
if ((sudo_mode & MODE_RESET_HOME) && runas_homedir)
|
|
(void) sudo_setenv("HOME", runas_homedir);
|
|
|
|
/* This *must* have been set if we got a match but... */
|
|
if (safe_cmnd == NULL) {
|
|
log_error(MSG_ONLY,
|
|
"internal error, cmnd_safe never got set for %s; %s",
|
|
user_cmnd,
|
|
"please report this error to sudo-bugs@courtesan.com");
|
|
}
|
|
|
|
#if (LOGGING & SLOG_SYSLOG)
|
|
closelog();
|
|
#endif
|
|
|
|
/* Reset signal mask before we exec. */
|
|
#ifdef POSIX_SIGNALS
|
|
(void) sigprocmask(SIG_SETMASK, &oset, NULL);
|
|
#else
|
|
(void) sigsetmask(omask);
|
|
#endif /* POSIX_SIGNALS */
|
|
|
|
#ifndef PROFILING
|
|
if ((sudo_mode & MODE_BACKGROUND) && fork() > 0)
|
|
exit(0);
|
|
else
|
|
EXEC(safe_cmnd, NewArgv); /* run the command */
|
|
#else
|
|
exit(0);
|
|
#endif /* PROFILING */
|
|
/*
|
|
* If we got here then the exec() failed...
|
|
*/
|
|
(void) fprintf(stderr, "%s: unable to exec %s: %s\n",
|
|
Argv[0], safe_cmnd, strerror(errno));
|
|
exit(-1);
|
|
} else if ((validated & FLAG_NO_USER) || (validated & FLAG_NO_HOST)) {
|
|
log_auth(validated, 1);
|
|
exit(1);
|
|
} else if (validated & VALIDATE_NOT_OK) {
|
|
#ifndef DONT_LEAK_PATH_INFO
|
|
/*
|
|
* We'd like to not leak path info at all here, but that can
|
|
* *really* confuse the users. To really close the leak we'd
|
|
* have to say "not allowed to run foo" even when the problem
|
|
* is just "no foo in path" since the user can trivially set
|
|
* their path to just contain a single dir.
|
|
*/
|
|
log_auth(validated,
|
|
!(cmnd_status == NOT_FOUND_DOT || cmnd_status == NOT_FOUND));
|
|
if (cmnd_status == NOT_FOUND)
|
|
(void) fprintf(stderr, "%s: %s: command not found\n", Argv[0],
|
|
user_cmnd);
|
|
else if (cmnd_status == NOT_FOUND_DOT)
|
|
(void) fprintf(stderr, "%s: ignoring `%s' found in '.'\nUse `sudo ./%s' if this is the `%s' you wish to run.\n", Argv[0], user_cmnd, user_cmnd, user_cmnd);
|
|
#else
|
|
log_auth(validated, 1);
|
|
#endif /* DONT_LEAK_PATH_INFO */
|
|
exit(1);
|
|
} else {
|
|
/* should never get here */
|
|
log_auth(validated, 1);
|
|
exit(1);
|
|
}
|
|
exit(0); /* not reached */
|
|
}
|
|
|
|
/*
|
|
* Initialize timezone, set umask, fill in ``sudo_user'' struct and
|
|
* load the ``interfaces'' array.
|
|
*/
|
|
static int
|
|
init_vars(sudo_mode)
|
|
int sudo_mode;
|
|
{
|
|
char *p, thost[MAXHOSTNAMELEN];
|
|
#ifdef FQDN
|
|
struct hostent *hp;
|
|
#endif /* FQDN */
|
|
|
|
#ifdef NO_ROOT_SUDO
|
|
if (getuid() == 0) {
|
|
(void) fputs("You are already root, you don't need to use sudo.\n",
|
|
stderr);
|
|
exit(1);
|
|
}
|
|
#endif
|
|
|
|
/* Sanity check command from user. */
|
|
if (user_cmnd == NULL && strlen(NewArgv[0]) >= MAXPATHLEN) {
|
|
(void) fprintf(stderr, "%s: %s: Pathname too long\n", Argv[0],
|
|
NewArgv[0]);
|
|
exit(1);
|
|
}
|
|
|
|
#ifdef HAVE_TZSET
|
|
(void) tzset(); /* set the timezone if applicable */
|
|
#endif /* HAVE_TZSET */
|
|
|
|
#ifdef SECURE_PATH
|
|
/* Replace the PATH envariable with a secure one. */
|
|
if (!user_is_exempt() && sudo_setenv("PATH", SECURE_PATH)) {
|
|
(void) fprintf(stderr, "%s: cannot allocate memory!\n", Argv[0]);
|
|
exit(1);
|
|
}
|
|
#endif /* SECURE_PATH */
|
|
|
|
#ifdef SUDO_UMASK
|
|
(void) umask((mode_t)SUDO_UMASK);
|
|
#endif /* SUDO_UMASK */
|
|
|
|
/* Default values for runas and cmnd, overridden later. */
|
|
if (user_runas == NULL)
|
|
user_runas = RUNAS_DEFAULT;
|
|
if (user_cmnd == NULL)
|
|
user_cmnd = NewArgv[0];
|
|
(void) strcpy(user_cwd, "unknown");
|
|
|
|
/*
|
|
* We avoid gethostbyname() if possible since we don't want
|
|
* sudo to block if DNS or NIS is hosed.
|
|
* "host" is the (possibly fully-qualified) hostname and
|
|
* "shost" is the unqualified form of the hostname.
|
|
*/
|
|
if ((gethostname(thost, sizeof(thost)))) {
|
|
user_host = "localhost";
|
|
log_error(USE_ERRNO|MSG_ONLY, "can't get hostname");
|
|
} else
|
|
user_host = estrdup(thost);
|
|
#ifdef FQDN
|
|
if (!(hp = gethostbyname(user_host)))
|
|
log_error(USE_ERRNO|MSG_ONLY|NO_EXIT,
|
|
"unable to lookup %s via gethostbyname()", user_host);
|
|
else
|
|
user_host = estrdup(hp->h_name);
|
|
#endif /* FQDN */
|
|
if ((p = strchr(user_host, '.'))) {
|
|
*p = '\0';
|
|
user_shost = estrdup(user_host);
|
|
*p = '.';
|
|
} else {
|
|
user_shost = user_host;
|
|
}
|
|
|
|
if ((p = ttyname(STDIN_FILENO)) || (p = ttyname(STDOUT_FILENO))) {
|
|
if (strncmp(p, _PATH_DEV, sizeof(_PATH_DEV) - 1) == 0)
|
|
p += sizeof(_PATH_DEV) - 1;
|
|
user_tty = estrdup(p);
|
|
} else
|
|
user_tty = "unknown";
|
|
|
|
/*
|
|
* Get a local copy of the user's struct passwd with the shadow password
|
|
* if necessary. It is assumed that euid is 0 at this point so we
|
|
* can read the shadow passwd file if necessary.
|
|
*/
|
|
if ((sudo_user.pw = sudo_getpwuid(getuid())) == NULL) {
|
|
/* Need to make a fake struct passwd for logging to work. */
|
|
struct passwd pw;
|
|
char pw_name[MAX_UID_T_LEN + 1];
|
|
|
|
pw.pw_uid = getuid();
|
|
(void) sprintf(pw_name, "%ld", (long) pw.pw_uid);
|
|
pw.pw_name = pw_name;
|
|
sudo_user.pw = &pw;
|
|
|
|
log_error(0, "uid %ld does not exist in the passwd file!",
|
|
(long) pw.pw_uid);
|
|
}
|
|
|
|
/* It is now safe to use log_error() and set_perms() */
|
|
|
|
/*
|
|
* Get current working directory. Try as user, fall back to root.
|
|
*/
|
|
set_perms(PERM_USER, sudo_mode);
|
|
if (!getcwd(user_cwd, sizeof(user_cwd))) {
|
|
set_perms(PERM_ROOT, sudo_mode);
|
|
if (!getcwd(user_cwd, sizeof(user_cwd))) {
|
|
(void) fprintf(stderr, "%s: Can't get working directory!\n",
|
|
Argv[0]);
|
|
(void) strcpy(user_cwd, "unknown");
|
|
}
|
|
} else
|
|
set_perms(PERM_ROOT, sudo_mode);
|
|
|
|
/*
|
|
* Load the list of local ip addresses and netmasks into
|
|
* the interfaces array.
|
|
*/
|
|
load_interfaces();
|
|
|
|
/*
|
|
* If we were given the '-s' option (run shell) we need to redo
|
|
* NewArgv and NewArgc.
|
|
*/
|
|
if ((sudo_mode & MODE_SHELL)) {
|
|
char **dst, **src = NewArgv;
|
|
|
|
NewArgv = (char **) emalloc (sizeof(char *) * (++NewArgc + 1));
|
|
if (user_shell && *user_shell) {
|
|
NewArgv[0] = user_shell;
|
|
} else {
|
|
(void) fprintf(stderr, "%s: Unable to determine shell.", Argv[0]);
|
|
exit(1);
|
|
}
|
|
|
|
/* copy the args from Argv */
|
|
for (dst = NewArgv + 1; (*dst = *src) != NULL; ++src, ++dst)
|
|
;
|
|
}
|
|
|
|
/* Resolve the path and return. */
|
|
if ((sudo_mode & MODE_RUN))
|
|
return(find_path(NewArgv[0], &user_cmnd));
|
|
else
|
|
return(FOUND);
|
|
}
|
|
|
|
/*
|
|
* Command line argument parsing, can't use getopt(3).
|
|
*/
|
|
static int
|
|
parse_args()
|
|
{
|
|
int rval = MODE_RUN; /* what mode is suod to be run in? */
|
|
int excl = 0; /* exclusive arg, no others allowed */
|
|
#ifdef HAVE_KERB5
|
|
extern char *realm; /* kerb5 realm (may be user-specified */
|
|
#endif /* HAVE_KERB5 */
|
|
|
|
NewArgv = Argv + 1;
|
|
NewArgc = Argc - 1;
|
|
|
|
#ifdef SHELL_IF_NO_ARGS
|
|
if (Argc < 2) { /* no options and no command */
|
|
rval |= MODE_SHELL;
|
|
return(rval);
|
|
}
|
|
#else
|
|
if (Argc < 2) /* no options and no command */
|
|
usage(1);
|
|
#endif /* SHELL_IF_NO_ARGS */
|
|
|
|
while (NewArgc > 0 && NewArgv[0][0] == '-') {
|
|
if (NewArgv[0][1] != '\0' && NewArgv[0][2] != '\0') {
|
|
(void) fprintf(stderr, "%s: Please use single character options\n",
|
|
Argv[0]);
|
|
usage(1);
|
|
}
|
|
|
|
switch (NewArgv[0][1]) {
|
|
#ifdef HAVE_KERB5
|
|
case 'r':
|
|
/* Must have an associated realm. */
|
|
if (NewArgv[1] == NULL)
|
|
usage(1);
|
|
|
|
realm = NewArgv[1];
|
|
|
|
/* Shift Argv over and adjust Argc. */
|
|
NewArgc--;
|
|
NewArgv++;
|
|
break;
|
|
#endif /* HAVE_KERB5 */
|
|
case 'p':
|
|
/* Must have an associated prompt. */
|
|
if (NewArgv[1] == NULL)
|
|
usage(1);
|
|
|
|
user_prompt = NewArgv[1];
|
|
|
|
/* Shift Argv over and adjust Argc. */
|
|
NewArgc--;
|
|
NewArgv++;
|
|
break;
|
|
case 'u':
|
|
/* Must have an associated runas user. */
|
|
if (NewArgv[1] == NULL)
|
|
usage(1);
|
|
|
|
user_runas = NewArgv[1];
|
|
|
|
/* Shift Argv over and adjust Argc. */
|
|
NewArgc--;
|
|
NewArgv++;
|
|
break;
|
|
case 'b':
|
|
rval |= MODE_BACKGROUND;
|
|
break;
|
|
case 'v':
|
|
rval = MODE_VALIDATE;
|
|
if (excl && excl != 'v')
|
|
usage_excl(1);
|
|
excl = 'v';
|
|
break;
|
|
case 'k':
|
|
rval = MODE_INVALIDATE;
|
|
if (excl && excl != 'k')
|
|
usage_excl(1);
|
|
excl = 'k';
|
|
break;
|
|
case 'K':
|
|
rval = MODE_KILL;
|
|
if (excl && excl != 'K')
|
|
usage_excl(1);
|
|
excl = 'K';
|
|
break;
|
|
case 'l':
|
|
rval = MODE_LIST;
|
|
if (excl && excl != 'l')
|
|
usage_excl(1);
|
|
excl = 'l';
|
|
break;
|
|
case 'V':
|
|
rval = MODE_VERSION;
|
|
if (excl && excl != 'V')
|
|
usage_excl(1);
|
|
excl = 'V';
|
|
break;
|
|
case 'h':
|
|
rval = MODE_HELP;
|
|
if (excl && excl != 'h')
|
|
usage_excl(1);
|
|
excl = 'h';
|
|
break;
|
|
case 's':
|
|
rval |= MODE_SHELL;
|
|
#ifdef SHELL_SETS_HOME
|
|
rval |= MODE_RESET_HOME;
|
|
#endif /* SHELL_SETS_HOME */
|
|
break;
|
|
case 'H':
|
|
rval |= MODE_RESET_HOME;
|
|
break;
|
|
case '-':
|
|
NewArgc--;
|
|
NewArgv++;
|
|
#ifdef SHELL_IF_NO_ARGS
|
|
if (rval == MODE_RUN)
|
|
rval |= MODE_SHELL;
|
|
#endif /* SHELL_IF_NO_ARGS */
|
|
return(rval);
|
|
case '\0':
|
|
(void) fprintf(stderr, "%s: '-' requires an argument\n",
|
|
Argv[0]);
|
|
usage(1);
|
|
default:
|
|
(void) fprintf(stderr, "%s: Illegal option %s\n", Argv[0],
|
|
NewArgv[0]);
|
|
usage(1);
|
|
}
|
|
NewArgc--;
|
|
NewArgv++;
|
|
}
|
|
|
|
if (NewArgc > 0 && !(rval & MODE_RUN))
|
|
usage(1);
|
|
|
|
return(rval);
|
|
}
|
|
|
|
/*
|
|
* Add sudo-specific variables into the environment.
|
|
* Sets ``cmnd_args'' as a side effect.
|
|
*/
|
|
static void
|
|
add_env(contiguous)
|
|
int contiguous;
|
|
{
|
|
char idstr[MAX_UID_T_LEN + 1];
|
|
size_t size;
|
|
char *buf;
|
|
|
|
/* Add the SUDO_COMMAND envariable (cmnd + args). */
|
|
size = strlen(user_cmnd) + 1;
|
|
if (NewArgc > 1) {
|
|
char *to, **from;
|
|
|
|
if (contiguous) {
|
|
size += (size_t) (NewArgv[NewArgc-1] - NewArgv[1]) +
|
|
strlen(NewArgv[NewArgc-1]) + 1;
|
|
} else {
|
|
for (from = &NewArgv[1]; *from; from++)
|
|
size += strlen(*from) + 1;
|
|
}
|
|
|
|
buf = (char *) emalloc(size);
|
|
|
|
/*
|
|
* Copy the command and it's arguments info buf.
|
|
*/
|
|
(void) strcpy(buf, user_cmnd);
|
|
to = buf + strlen(user_cmnd);
|
|
for (from = &NewArgv[1]; *from; from++) {
|
|
*to++ = ' ';
|
|
(void) strcpy(to, *from);
|
|
to += strlen(*from);
|
|
}
|
|
} else {
|
|
buf = user_cmnd;
|
|
}
|
|
if (sudo_setenv("SUDO_COMMAND", buf)) {
|
|
(void) fprintf(stderr, "%s: cannot allocate memory!\n", Argv[0]);
|
|
exit(1);
|
|
}
|
|
if (NewArgc > 1)
|
|
free(buf);
|
|
|
|
/* Grab a pointer to the flat arg string from the environment. */
|
|
if (NewArgc > 1 && (user_args = getenv("SUDO_COMMAND"))) {
|
|
if ((user_args = strchr(user_args, ' ')))
|
|
user_args++;
|
|
else
|
|
user_args = NULL;
|
|
}
|
|
|
|
/* Add the SUDO_USER environment variable. */
|
|
if (sudo_setenv("SUDO_USER", user_name)) {
|
|
(void) fprintf(stderr, "%s: cannot allocate memory!\n", Argv[0]);
|
|
exit(1);
|
|
}
|
|
|
|
/* Add the SUDO_UID environment variable. */
|
|
(void) sprintf(idstr, "%ld", (long) user_uid);
|
|
if (sudo_setenv("SUDO_UID", idstr)) {
|
|
(void) fprintf(stderr, "%s: cannot allocate memory!\n", Argv[0]);
|
|
exit(1);
|
|
}
|
|
|
|
/* Add the SUDO_GID environment variable. */
|
|
(void) sprintf(idstr, "%ld", (long) user_gid);
|
|
if (sudo_setenv("SUDO_GID", idstr)) {
|
|
(void) fprintf(stderr, "%s: cannot allocate memory!\n", Argv[0]);
|
|
exit(1);
|
|
}
|
|
|
|
/* Set PS1 if SUDO_PS1 is set. */
|
|
if ((buf = getenv("SUDO_PS1")))
|
|
if (sudo_setenv("PS1", buf)) {
|
|
(void) fprintf(stderr, "%s: cannot allocate memory!\n", Argv[0]);
|
|
exit(1);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Sanity check sudoers mode/owner/type.
|
|
* Leaves a file pointer to the sudoers file open in ``fp''.
|
|
*/
|
|
static void
|
|
check_sudoers()
|
|
{
|
|
struct stat statbuf;
|
|
int rootstat, i;
|
|
char c;
|
|
|
|
/*
|
|
* Fix the mode and group on sudoers file from old default.
|
|
* Only works if filesystem is readable/writable by root.
|
|
*/
|
|
set_perms(PERM_ROOT, 0);
|
|
if ((rootstat = lstat(_PATH_SUDOERS, &statbuf)) == 0 &&
|
|
SUDOERS_UID == statbuf.st_uid && SUDOERS_MODE != 0400 &&
|
|
(statbuf.st_mode & 0007777) == 0400) {
|
|
|
|
if (chmod(_PATH_SUDOERS, SUDOERS_MODE) == 0) {
|
|
(void) fprintf(stderr, "%s: fixed mode on %s\n",
|
|
Argv[0], _PATH_SUDOERS);
|
|
if (statbuf.st_gid != SUDOERS_GID) {
|
|
if (!chown(_PATH_SUDOERS,(uid_t) -1,SUDOERS_GID)) {
|
|
(void) fprintf(stderr, "%s: set group on %s\n",
|
|
Argv[0], _PATH_SUDOERS);
|
|
statbuf.st_gid = SUDOERS_GID;
|
|
} else {
|
|
(void) fprintf(stderr,"%s: Unable to set group on %s: %s\n",
|
|
Argv[0], _PATH_SUDOERS, strerror(errno));
|
|
}
|
|
}
|
|
} else {
|
|
(void) fprintf(stderr, "%s: Unable to fix mode on %s: %s\n",
|
|
Argv[0], _PATH_SUDOERS, strerror(errno));
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Sanity checks on sudoers file. Must be done as sudoers
|
|
* file owner. We already did a stat as root, so use that
|
|
* data if we can't stat as sudoers file owner.
|
|
*/
|
|
set_perms(PERM_SUDOERS, 0);
|
|
|
|
if (rootstat != 0 && lstat(_PATH_SUDOERS, &statbuf) != 0)
|
|
log_error(USE_ERRNO, "can't stat %s", _PATH_SUDOERS);
|
|
else if (!S_ISREG(statbuf.st_mode))
|
|
log_error(0, "%s is not a regular file", _PATH_SUDOERS);
|
|
else if ((statbuf.st_mode & 07777) != SUDOERS_MODE)
|
|
log_error(0, "%s is mode 0%o, should be 0%o", _PATH_SUDOERS,
|
|
(statbuf.st_mode & 07777), SUDOERS_MODE);
|
|
else if (statbuf.st_uid != SUDOERS_UID)
|
|
log_error(0, "%s is owned by uid %ld, should be %d", _PATH_SUDOERS,
|
|
(long) statbuf.st_uid, SUDOERS_UID);
|
|
else if (statbuf.st_gid != SUDOERS_GID)
|
|
log_error(0, "%s is owned by gid %ld, should be %d", _PATH_SUDOERS,
|
|
(long) statbuf.st_gid, SUDOERS_GID);
|
|
else {
|
|
/* Solaris sometimes returns EAGAIN so try 10 times */
|
|
for (i = 0; i < 10 ; i++) {
|
|
errno = 0;
|
|
if ((sudoers_fp = fopen(_PATH_SUDOERS, "r")) == NULL ||
|
|
fread(&c, sizeof(c), 1, sudoers_fp) != 1) {
|
|
sudoers_fp = NULL;
|
|
if (errno != EAGAIN && errno != EWOULDBLOCK)
|
|
break;
|
|
} else
|
|
break;
|
|
sleep(1);
|
|
}
|
|
if (sudoers_fp == NULL)
|
|
log_error(USE_ERRNO, "can't open %s", _PATH_SUDOERS);
|
|
}
|
|
|
|
set_perms(PERM_ROOT, 0);
|
|
set_perms(PERM_USER, 0);
|
|
}
|
|
|
|
/*
|
|
* Remove environment variables that match the entries in badenv_table.
|
|
*/
|
|
static void
|
|
clean_env(envp, badenv_table)
|
|
char **envp;
|
|
struct env_table *badenv_table;
|
|
{
|
|
struct env_table *bad;
|
|
char **cur;
|
|
|
|
/*
|
|
* Remove any envars that match entries in badenv_table.
|
|
*/
|
|
for (cur = envp; *cur; cur++) {
|
|
for (bad = badenv_table; bad->name; bad++) {
|
|
if (strncmp(*cur, bad->name, bad->len) == 0) {
|
|
/* Got a match so remove it. */
|
|
char **move;
|
|
|
|
for (move = cur; *move; move++)
|
|
*move = *(move + 1);
|
|
|
|
cur--;
|
|
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Set real and effective uids and gids based on perm.
|
|
*/
|
|
void
|
|
set_perms(perm, sudo_mode)
|
|
int perm;
|
|
int sudo_mode;
|
|
{
|
|
struct passwd *pw;
|
|
|
|
switch (perm) {
|
|
case PERM_ROOT:
|
|
if (setuid(0)) {
|
|
perror("setuid(0)");
|
|
exit(1);
|
|
}
|
|
break;
|
|
|
|
case PERM_USER:
|
|
(void) setgid(user_gid);
|
|
|
|
if (geteuid() != user_uid && seteuid(user_uid)) {
|
|
perror("seteuid(user_uid)");
|
|
exit(1);
|
|
}
|
|
break;
|
|
|
|
case PERM_FULL_USER:
|
|
if (setuid(0)) {
|
|
perror("setuid(0)");
|
|
exit(1);
|
|
}
|
|
|
|
(void) setgid(user_gid);
|
|
|
|
if (setuid(user_uid)) {
|
|
perror("setuid(user_uid)");
|
|
exit(1);
|
|
}
|
|
|
|
break;
|
|
case PERM_RUNAS:
|
|
if (setuid(0)) {
|
|
perror("setuid(0)");
|
|
exit(1);
|
|
}
|
|
|
|
/* XXX - add group/gid support */
|
|
if (*user_runas == '#') {
|
|
if (setuid(atoi(user_runas + 1))) {
|
|
(void) fprintf(stderr,
|
|
"%s: cannot set uid to %s: %s\n",
|
|
Argv[0], user_runas, strerror(errno));
|
|
exit(1);
|
|
}
|
|
} else {
|
|
if (!(pw = getpwnam(user_runas))) {
|
|
(void) fprintf(stderr,
|
|
"%s: no passwd entry for %s!\n",
|
|
Argv[0], user_runas);
|
|
exit(1);
|
|
}
|
|
|
|
/* Set $USER and $LOGNAME to target user */
|
|
if (sudo_setenv("USER", pw->pw_name)) {
|
|
(void) fprintf(stderr,
|
|
"%s: cannot allocate memory!\n",
|
|
Argv[0]);
|
|
exit(1);
|
|
}
|
|
if (sudo_setenv("LOGNAME", pw->pw_name)) {
|
|
(void) fprintf(stderr,
|
|
"%s: cannot allocate memory!\n",
|
|
Argv[0]);
|
|
exit(1);
|
|
}
|
|
|
|
if (setgid(pw->pw_gid)) {
|
|
(void) fprintf(stderr,
|
|
"%s: cannot set gid to %ld: %s\n",
|
|
Argv[0], (long) pw->pw_gid,
|
|
strerror(errno));
|
|
exit(1);
|
|
}
|
|
|
|
/*
|
|
* Initialize group vector only if are
|
|
* going to run as a non-root user.
|
|
*/
|
|
if (strcmp(user_runas, "root") != 0 &&
|
|
initgroups(user_runas, pw->pw_gid)
|
|
== -1) {
|
|
(void) fprintf(stderr,
|
|
"%s: cannot set group vector: %s\n",
|
|
Argv[0], strerror(errno));
|
|
exit(1);
|
|
}
|
|
|
|
if (setuid(pw->pw_uid)) {
|
|
(void) fprintf(stderr,
|
|
"%s: cannot set uid to %ld: %s\n",
|
|
Argv[0], (long) pw->pw_uid,
|
|
strerror(errno));
|
|
exit(1);
|
|
}
|
|
if (sudo_mode & MODE_RESET_HOME)
|
|
runas_homedir = pw->pw_dir;
|
|
}
|
|
|
|
break;
|
|
case PERM_SUDOERS:
|
|
if (setuid(0)) {
|
|
perror("setuid(0)");
|
|
exit(1);
|
|
}
|
|
|
|
if (setgid(SUDOERS_GID)) {
|
|
perror("setgid(SUDOERS_GID)");
|
|
exit(1);
|
|
}
|
|
|
|
/*
|
|
* If SUDOERS_UID == 0 and SUDOERS_MODE
|
|
* is group readable we use a non-zero
|
|
* uid in order to avoid NFS lossage.
|
|
* Using uid 1 is a bit bogus but should
|
|
* work on all OS's.
|
|
*/
|
|
if (SUDOERS_UID == 0) {
|
|
if ((SUDOERS_MODE & 040) && seteuid(1)) {
|
|
perror("seteuid(1)");
|
|
exit(1);
|
|
}
|
|
} else {
|
|
if (seteuid(SUDOERS_UID)) {
|
|
perror("seteuid(SUDOERS_UID)");
|
|
exit(1);
|
|
}
|
|
}
|
|
|
|
break;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Tell which options are mutually exclusive and exit.
|
|
*/
|
|
static void
|
|
usage_excl(exit_val)
|
|
int exit_val;
|
|
{
|
|
(void) fprintf(stderr,
|
|
"Only one of the -v, -k, -K, -l, -V and -h options may be used\n");
|
|
usage(exit_val);
|
|
}
|
|
|
|
/*
|
|
* Give usage message and exit.
|
|
*/
|
|
static void
|
|
usage(exit_val)
|
|
int exit_val;
|
|
{
|
|
(void) fprintf(stderr,
|
|
"usage: %s -V | -h | -l | -v | -k | -K | -H | [-b] [-p prompt]\n%*s",
|
|
Argv[0], (int) strlen(Argv[0]) + 8, " ");
|
|
#ifdef HAVE_KERB5
|
|
(void) fprintf(stderr, "[-r realm] ");
|
|
#endif /* HAVE_KERB5 */
|
|
(void) fprintf(stderr, "[-u username/#uid] -s | <command>\n");
|
|
exit(exit_val);
|
|
}
|