|
 |
a2b174 |
diff -up ./plugins/sudoers/cvtsudoers.c.legacy-processing ./plugins/sudoers/cvtsudoers.c
|
|
|
a2b174 |
--- ./plugins/sudoers/cvtsudoers.c.legacy-processing 2019-10-28 13:28:52.000000000 +0100
|
|
|
a2b174 |
+++ ./plugins/sudoers/cvtsudoers.c 2019-10-30 13:32:43.309480623 +0100
|
|
|
a2b174 |
@@ -347,6 +347,15 @@ main(int argc, char *argv[])
|
|
|
a2b174 |
sudo_fatalx("error: unhandled input %d", input_format);
|
|
|
a2b174 |
}
|
|
|
a2b174 |
|
|
|
a2b174 |
+ /*
|
|
|
a2b174 |
+ * cvtsudoers group filtering doesn't work if def_match_group_by_gid
|
|
|
a2b174 |
+ * is set to true by default (at compile-time). It cannot be set to false
|
|
|
a2b174 |
+ * because cvtsudoers doesn't apply the parsed Defaults.
|
|
|
a2b174 |
+ *
|
|
|
a2b174 |
+ * Related: sudo-1.8.23-legacy-group-processing.patch
|
|
|
a2b174 |
+ */
|
|
|
a2b174 |
+ def_match_group_by_gid = def_legacy_group_processing = false;
|
|
|
a2b174 |
+
|
|
|
a2b174 |
/* Apply filters. */
|
|
|
a2b174 |
filter_userspecs(&parsed_policy, conf);
|
|
|
a2b174 |
filter_defaults(&parsed_policy, conf);
|
|
|
a2b174 |
diff -up ./plugins/sudoers/defaults.c.legacy-processing ./plugins/sudoers/defaults.c
|
|
|
a2b174 |
--- ./plugins/sudoers/defaults.c.legacy-processing 2019-10-28 13:28:52.000000000 +0100
|
|
|
a2b174 |
+++ ./plugins/sudoers/defaults.c 2019-10-30 13:32:43.309480623 +0100
|
|
|
a2b174 |
@@ -93,6 +93,7 @@ static struct early_default early_defaul
|
|
|
a2b174 |
{ I_FQDN },
|
|
|
a2b174 |
#endif
|
|
|
a2b174 |
{ I_MATCH_GROUP_BY_GID },
|
|
|
a2b174 |
+ { I_LEGACY_GROUP_PROCESSING },
|
|
|
a2b174 |
{ I_GROUP_PLUGIN },
|
|
|
a2b174 |
{ I_RUNAS_DEFAULT },
|
|
|
a2b174 |
{ I_SUDOERS_LOCALE },
|
|
|
a2b174 |
@@ -494,6 +495,8 @@ init_defaults(void)
|
|
|
a2b174 |
}
|
|
|
a2b174 |
|
|
|
a2b174 |
/* First initialize the flags. */
|
|
|
a2b174 |
+ def_legacy_group_processing = true;
|
|
|
a2b174 |
+ def_match_group_by_gid = true;
|
|
|
a2b174 |
#ifdef LONG_OTP_PROMPT
|
|
|
a2b174 |
def_long_otp_prompt = true;
|
|
|
a2b174 |
#endif
|
|
|
a2b174 |
diff -up ./plugins/sudoers/def_data.c.legacy-processing ./plugins/sudoers/def_data.c
|
|
|
a2b174 |
--- ./plugins/sudoers/def_data.c.legacy-processing 2019-10-30 13:32:43.309480623 +0100
|
|
|
a2b174 |
+++ ./plugins/sudoers/def_data.c 2019-10-30 13:37:25.914602825 +0100
|
|
|
a2b174 |
@@ -506,6 +506,10 @@ struct sudo_defs_types sudo_defs_table[]
|
|
|
a2b174 |
N_("Log when a command is denied by sudoers"),
|
|
|
a2b174 |
NULL,
|
|
|
a2b174 |
}, {
|
|
|
a2b174 |
+ "legacy_group_processing", T_FLAG,
|
|
|
a2b174 |
+ N_("Don't pre-resolve all group names"),
|
|
|
a2b174 |
+ NULL,
|
|
|
a2b174 |
+ }, {
|
|
|
a2b174 |
NULL, 0, NULL
|
|
|
a2b174 |
}
|
|
|
a2b174 |
};
|
|
|
a2b174 |
diff -up ./plugins/sudoers/def_data.h.legacy-processing ./plugins/sudoers/def_data.h
|
|
|
a2b174 |
--- ./plugins/sudoers/def_data.h.legacy-processing 2019-10-30 13:32:43.310480638 +0100
|
|
|
a2b174 |
+++ ./plugins/sudoers/def_data.h 2019-10-30 13:40:59.651713757 +0100
|
|
|
a2b174 |
@@ -232,6 +232,8 @@
|
|
|
a2b174 |
#define def_log_allowed (sudo_defs_table[I_LOG_ALLOWED].sd_un.flag)
|
|
|
a2b174 |
#define I_LOG_DENIED 116
|
|
|
a2b174 |
#define def_log_denied (sudo_defs_table[I_LOG_DENIED].sd_un.flag)
|
|
|
a2b174 |
+#define I_LEGACY_GROUP_PROCESSING 117
|
|
|
a2b174 |
+#define def_legacy_group_processing (sudo_defs_table[I_LEGACY_GROUP_PROCESSING].sd_un.flag)
|
|
|
a2b174 |
|
|
|
a2b174 |
enum def_tuple {
|
|
|
a2b174 |
never,
|
|
|
a2b174 |
diff -up ./plugins/sudoers/def_data.in.legacy-processing ./plugins/sudoers/def_data.in
|
|
|
a2b174 |
--- ./plugins/sudoers/def_data.in.legacy-processing 2019-10-30 13:32:43.310480638 +0100
|
|
|
a2b174 |
+++ ./plugins/sudoers/def_data.in 2019-10-30 13:42:20.915896239 +0100
|
|
|
a2b174 |
@@ -366,3 +366,6 @@ log_allowed
|
|
|
a2b174 |
log_denied
|
|
|
a2b174 |
T_FLAG
|
|
|
a2b174 |
"Log when a command is denied by sudoers"
|
|
|
a2b174 |
+legacy_group_processing
|
|
|
a2b174 |
+ T_FLAG
|
|
|
a2b174 |
+ "Don't pre-resolve all group names"
|
|
|
a2b174 |
diff -up ./plugins/sudoers/sudoers.c.legacy-processing ./plugins/sudoers/sudoers.c
|
|
|
a2b174 |
--- ./plugins/sudoers/sudoers.c.legacy-processing 2019-10-28 13:28:53.000000000 +0100
|
|
|
a2b174 |
+++ ./plugins/sudoers/sudoers.c 2019-10-30 13:32:43.310480638 +0100
|
|
|
a2b174 |
@@ -221,6 +221,10 @@ sudoers_policy_init(void *info, char * c
|
|
|
a2b174 |
if (set_loginclass(runas_pw ? runas_pw : sudo_user.pw))
|
|
|
a2b174 |
ret = true;
|
|
|
a2b174 |
|
|
|
a2b174 |
+ if (!def_match_group_by_gid || !def_legacy_group_processing) {
|
|
|
a2b174 |
+ def_match_group_by_gid = false;
|
|
|
a2b174 |
+ def_legacy_group_processing = false;
|
|
|
a2b174 |
+ }
|
|
|
a2b174 |
cleanup:
|
|
|
a2b174 |
if (!restore_perms())
|
|
|
a2b174 |
ret = -1;
|