|
 |
ce887b |
From 1f37620953699fe71b09760fe01e33eb6ada771c Mon Sep 17 00:00:00 2001
|
|
 |
ce887b |
From: "Todd C. Miller" <Todd.Miller@courtesan.com>
|
|
 |
ce887b |
Date: Wed, 15 Nov 2017 12:27:39 -0700
|
|
 |
ce887b |
Subject: [PATCH] When checking the results for "sudo -l" and "sudo -v", keep
|
|
 |
ce887b |
checking even after we get a match since the value of doauth may depend on
|
|
 |
ce887b |
evaluating all the results. From Radovan Sroka of RedHat.
|
|
 |
ce887b |
|
|
 |
ce887b |
In list (-l) or verify (-v) mode, if we have a match but authentication
|
|
 |
ce887b |
is required, clear FLAG_NOPASSWD so that when listpw/verifypw is
|
|
 |
ce887b |
set to "all" and there are multiple sudoers sources a password will
|
|
 |
ce887b |
be required unless none of the entries in all sources require
|
|
 |
ce887b |
authentication. From Radovan Sroka of RedHat
|
|
 |
ce887b |
|
|
 |
ce887b |
Avoid calling cmnd_matches() in list/verify mode if we already have
|
|
 |
ce887b |
a match.
|
|
 |
ce887b |
---
|
|
 |
ce887b |
plugins/sudoers/ldap.c | 5 ++++-
|
|
 |
ce887b |
plugins/sudoers/parse.c | 10 +++++++---
|
|
 |
ce887b |
plugins/sudoers/sssd.c | 5 ++++-
|
|
 |
ce887b |
3 files changed, 15 insertions(+), 5 deletions(-)
|
|
 |
ce887b |
|
|
 |
ce887b |
diff --git a/plugins/sudoers/ldap.c b/plugins/sudoers/ldap.c
|
|
 |
ce887b |
index 46309cba..c5c18360 100644
|
|
 |
ce887b |
--- a/plugins/sudoers/ldap.c
|
|
 |
ce887b |
+++ b/plugins/sudoers/ldap.c
|
|
 |
ce887b |
@@ -3320,12 +3320,13 @@ sudo_ldap_lookup(struct sudo_nss *nss, int ret, int pwflag)
|
|
 |
ce887b |
(pwcheck == all && doauth != true)) {
|
|
 |
ce887b |
doauth = !!sudo_ldap_check_bool(ld, entry, "authenticate");
|
|
 |
ce887b |
}
|
|
 |
ce887b |
+ if (matched == true)
|
|
 |
ce887b |
+ continue;
|
|
 |
ce887b |
/* Only check the command when listing another user. */
|
|
 |
ce887b |
if (user_uid == 0 || list_pw == NULL ||
|
|
 |
ce887b |
user_uid == list_pw->pw_uid ||
|
|
 |
ce887b |
sudo_ldap_check_command(ld, entry, NULL) == true) {
|
|
 |
ce887b |
matched = true;
|
|
 |
ce887b |
- break;
|
|
 |
ce887b |
}
|
|
 |
ce887b |
}
|
|
 |
ce887b |
if (matched == true || user_uid == 0) {
|
|
 |
ce887b |
@@ -3339,6 +3340,8 @@ sudo_ldap_lookup(struct sudo_nss *nss, int ret, int pwflag)
|
|
 |
ce887b |
case any:
|
|
 |
ce887b |
if (doauth == false)
|
|
 |
ce887b |
SET(ret, FLAG_NOPASSWD);
|
|
 |
ce887b |
+ else
|
|
 |
ce887b |
+ CLR(ret, FLAG_NOPASSWD);
|
|
 |
ce887b |
break;
|
|
 |
ce887b |
default:
|
|
 |
ce887b |
break;
|
|
 |
ce887b |
diff --git a/plugins/sudoers/parse.c b/plugins/sudoers/parse.c
|
|
 |
ce887b |
index 749a3eb2..a12e88c5 100644
|
|
 |
ce887b |
--- a/plugins/sudoers/parse.c
|
|
 |
ce887b |
+++ b/plugins/sudoers/parse.c
|
|
 |
ce887b |
@@ -182,14 +182,16 @@ sudo_file_lookup(struct sudo_nss *nss, int validated, int pwflag)
|
|
 |
ce887b |
if (hostlist_matches(sudo_user.pw, &priv->hostlist) != ALLOW)
|
|
 |
ce887b |
continue;
|
|
 |
ce887b |
TAILQ_FOREACH(cs, &priv->cmndlist, entries) {
|
|
 |
ce887b |
+ if ((pwcheck == any && cs->tags.nopasswd == true) ||
|
|
 |
ce887b |
+ (pwcheck == all && cs->tags.nopasswd != true))
|
|
 |
ce887b |
+ nopass = cs->tags.nopasswd;
|
|
 |
ce887b |
+ if (match == ALLOW)
|
|
 |
ce887b |
+ continue;
|
|
 |
ce887b |
/* Only check the command when listing another user. */
|
|
 |
ce887b |
if (user_uid == 0 || list_pw == NULL ||
|
|
 |
ce887b |
user_uid == list_pw->pw_uid ||
|
|
 |
ce887b |
cmnd_matches(cs->cmnd) == ALLOW)
|
|
 |
ce887b |
match = ALLOW;
|
|
 |
ce887b |
- if ((pwcheck == any && cs->tags.nopasswd == true) ||
|
|
 |
ce887b |
- (pwcheck == all && cs->tags.nopasswd != true))
|
|
 |
ce887b |
- nopass = cs->tags.nopasswd;
|
|
 |
ce887b |
}
|
|
 |
ce887b |
}
|
|
 |
ce887b |
}
|
|
 |
ce887b |
@@ -202,6 +204,8 @@ sudo_file_lookup(struct sudo_nss *nss, int validated, int pwflag)
|
|
 |
ce887b |
SET(validated, FLAG_CHECK_USER);
|
|
 |
ce887b |
else if (nopass == true)
|
|
 |
ce887b |
SET(validated, FLAG_NOPASSWD);
|
|
 |
ce887b |
+ else
|
|
 |
ce887b |
+ CLR(validated, FLAG_NOPASSWD);
|
|
 |
ce887b |
debug_return_int(validated);
|
|
 |
ce887b |
}
|
|
 |
ce887b |
|
|
 |
ce887b |
diff --git a/plugins/sudoers/sssd.c b/plugins/sudoers/sssd.c
|
|
 |
ce887b |
index 65b4d875..09ca9fee 100644
|
|
 |
ce887b |
--- a/plugins/sudoers/sssd.c
|
|
 |
ce887b |
+++ b/plugins/sudoers/sssd.c
|
|
 |
ce887b |
@@ -1321,12 +1321,13 @@ sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag)
|
|
 |
ce887b |
(pwcheck == all && doauth != true)) {
|
|
 |
ce887b |
doauth = !!sudo_sss_check_bool(handle, rule, "authenticate");
|
|
 |
ce887b |
}
|
|
 |
ce887b |
+ if (matched == true)
|
|
 |
ce887b |
+ continue;
|
|
 |
ce887b |
/* Only check the command when listing another user. */
|
|
 |
ce887b |
if (user_uid == 0 || list_pw == NULL ||
|
|
 |
ce887b |
user_uid == list_pw->pw_uid ||
|
|
 |
ce887b |
sudo_sss_check_command(handle, rule, NULL) == true) {
|
|
 |
ce887b |
matched = true;
|
|
 |
ce887b |
- break;
|
|
 |
ce887b |
}
|
|
 |
ce887b |
}
|
|
 |
ce887b |
}
|
|
 |
ce887b |
@@ -1341,6 +1342,8 @@ sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag)
|
|
 |
ce887b |
case any:
|
|
 |
ce887b |
if (doauth == false)
|
|
 |
ce887b |
SET(ret, FLAG_NOPASSWD);
|
|
 |
ce887b |
+ else
|
|
 |
ce887b |
+ CLR(ret, FLAG_NOPASSWD);
|
|
 |
ce887b |
break;
|
|
 |
ce887b |
default:
|
|
 |
ce887b |
break;
|
|
 |
ce887b |
--
|
|
 |
ce887b |
2.14.3
|
|
 |
ce887b |
|