From e99082e05b9f0dd0e0f47fa1d2e1b9d922ea8c4c Mon Sep 17 00:00:00 2001

From: "Todd C. Miller" <Todd.Miller@sudo.ws>

Date: Thu, 15 Aug 2019 14:20:12 -0600

Subject: [PATCH] Fix special handling of ipa_hostname that was lost in sudo

 1.8.24. We now include the long and short hostname in sudo parser container.

---

 plugins/sudoers/file.c  |   2 +-

 plugins/sudoers/gram.c  | 215 ++++++++++++++++++++--------------------

 plugins/sudoers/gram.y  |   9 +-

 plugins/sudoers/ldap.c  |   2 +-

 plugins/sudoers/match.c |  23 +++--

 plugins/sudoers/parse.h |   3 +-

 plugins/sudoers/sssd.c  |   7 +-

 7 files changed, 140 insertions(+), 121 deletions(-)

diff --git a/plugins/sudoers/file.c b/plugins/sudoers/file.c

index fff78a19..5028ce01 100644

--- a/plugins/sudoers/file.c

+++ b/plugins/sudoers/file.c

@@ -85,7 +85,7 @@ sudo_file_open(struct sudo_nss *nss)

     if (handle != NULL) {

 	handle->fp = open_sudoers(sudoers_file, false, NULL);

 	if (handle->fp != NULL) {

-	    init_parse_tree(&handle->parse_tree);

+	    init_parse_tree(&handle->parse_tree, NULL, NULL);

 	} else {

 	    free(handle);

 	    handle = NULL;

diff --git a/plugins/sudoers/gram.c b/plugins/sudoers/gram.c

index 343e4299..6545e129 100644

--- a/plugins/sudoers/gram.c

+++ b/plugins/sudoers/gram.c

@@ -106,7 +106,9 @@ char *errorfile = NULL;

 struct sudoers_parse_tree parsed_policy = {

     TAILQ_HEAD_INITIALIZER(parsed_policy.userspecs),

     TAILQ_HEAD_INITIALIZER(parsed_policy.defaults),

-    NULL /* aliases */

+    NULL, /* aliases */

+    NULL, /* lhost */

+    NULL /* shost */

 };

 /*

@@ -118,7 +120,7 @@ static bool add_userspec(struct member *, struct privilege *);

 static struct defaults *new_default(char *, char *, short);

 static struct member *new_member(char *, int);

 static struct command_digest *new_digest(int, char *);

-#line 80 "gram.y"

+#line 82 "gram.y"

 #ifndef YYSTYPE_DEFINED

 #define YYSTYPE_DEFINED

 typedef union {

@@ -135,7 +137,7 @@ typedef union {

     int tok;

 } YYSTYPE;

 #endif /* YYSTYPE_DEFINED */

-#line 133 "gram.c"

+#line 135 "gram.c"

 #define COMMAND 257

 #define ALIAS 258

 #define DEFVAR 259

@@ -675,7 +677,7 @@ short *yysslim;

 YYSTYPE *yyvs;

 unsigned int yystacksize;

 int yyparse(void);

-#line 906 "gram.y"

+#line 908 "gram.y"

 void

 sudoerserror(const char *s)

 {

@@ -1019,11 +1021,14 @@ free_userspec(struct userspec *us)

  * Initialized a sudoers parse tree.

  */

 void

-init_parse_tree(struct sudoers_parse_tree *parse_tree)

+init_parse_tree(struct sudoers_parse_tree *parse_tree, const char *lhost,

+    const char *shost)

 {

     TAILQ_INIT(&parse_tree->userspecs);

     TAILQ_INIT(&parse_tree->defaults);

     parse_tree->aliases = NULL;

+    parse_tree->shost = shost;

+    parse_tree->lhost = lhost;

 }

 /*

@@ -1100,7 +1105,7 @@ init_options(struct command_options *opts)

     opts->limitprivs = NULL;

 #endif

 }

-#line 1046 "gram.c"

+#line 1051 "gram.c"

 /* allocate initial stack or double stack size, up to YYMAXDEPTH */

 #if defined(__cplusplus) || defined(__STDC__)

 static int yygrowstack(void)

@@ -1309,23 +1314,23 @@ yyparse()

     switch (yyn)

     {

 case 1:

-#line 178 "gram.y"

+#line 180 "gram.y"

 { ; }

 break;

 case 5:

-#line 186 "gram.y"

+#line 188 "gram.y"

 {

 			    ;

 			}

 break;

 case 6:

-#line 189 "gram.y"

+#line 191 "gram.y"

 {

 			    yyerrok;

 			}

 break;

 case 7:

-#line 192 "gram.y"

+#line 194 "gram.y"

 {

 			    if (!add_userspec(yyvsp[-1].member, yyvsp[0].privilege)) {

 				sudoerserror(N_("unable to allocate memory"));

@@ -1334,73 +1339,73 @@ case 7:

 			}

 break;

 case 8:

-#line 198 "gram.y"

+#line 200 "gram.y"

 {

 			    ;

 			}

 break;

 case 9:

-#line 201 "gram.y"

+#line 203 "gram.y"

 {

 			    ;

 			}

 break;

 case 10:

-#line 204 "gram.y"

+#line 206 "gram.y"

 {

 			    ;

 			}

 break;

 case 11:

-#line 207 "gram.y"

+#line 209 "gram.y"

 {

 			    ;

 			}

 break;

 case 12:

-#line 210 "gram.y"

+#line 212 "gram.y"

 {

 			    if (!add_defaults(DEFAULTS, NULL, yyvsp[0].defaults))

 				YYERROR;

 			}

 break;

 case 13:

-#line 214 "gram.y"

+#line 216 "gram.y"

 {

 			    if (!add_defaults(DEFAULTS_USER, yyvsp[-1].member, yyvsp[0].defaults))

 				YYERROR;

 			}

 break;

 case 14:

-#line 218 "gram.y"

+#line 220 "gram.y"

 {

 			    if (!add_defaults(DEFAULTS_RUNAS, yyvsp[-1].member, yyvsp[0].defaults))

 				YYERROR;

 			}

 break;

 case 15:

-#line 222 "gram.y"

+#line 224 "gram.y"

 {

 			    if (!add_defaults(DEFAULTS_HOST, yyvsp[-1].member, yyvsp[0].defaults))

 				YYERROR;

 			}

 break;

 case 16:

-#line 226 "gram.y"

+#line 228 "gram.y"

 {

 			    if (!add_defaults(DEFAULTS_CMND, yyvsp[-1].member, yyvsp[0].defaults))

 				YYERROR;

 			}

 break;

 case 18:

-#line 233 "gram.y"

+#line 235 "gram.y"

 {

 			    HLTQ_CONCAT(yyvsp[-2].defaults, yyvsp[0].defaults, entries);

 			    yyval.defaults = yyvsp[-2].defaults;

 			}

 break;

 case 19:

-#line 239 "gram.y"

+#line 241 "gram.y"

 {

 			    yyval.defaults = new_default(yyvsp[0].string, NULL, true);

 			    if (yyval.defaults == NULL) {

@@ -1410,7 +1415,7 @@ case 19:

 			}

 break;

 case 20:

-#line 246 "gram.y"

+#line 248 "gram.y"

 {

 			    yyval.defaults = new_default(yyvsp[0].string, NULL, false);

 			    if (yyval.defaults == NULL) {

@@ -1420,7 +1425,7 @@ case 20:

 			}

 break;

 case 21:

-#line 253 "gram.y"

+#line 255 "gram.y"

 {

 			    yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, true);

 			    if (yyval.defaults == NULL) {

@@ -1430,7 +1435,7 @@ case 21:

 			}

 break;

 case 22:

-#line 260 "gram.y"

+#line 262 "gram.y"

 {

 			    yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, '+');

 			    if (yyval.defaults == NULL) {

@@ -1440,7 +1445,7 @@ case 22:

 			}

 break;

 case 23:

-#line 267 "gram.y"

+#line 269 "gram.y"

 {

 			    yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, '-');

 			    if (yyval.defaults == NULL) {

@@ -1450,14 +1455,14 @@ case 23:

 			}

 break;

 case 25:

-#line 277 "gram.y"

+#line 279 "gram.y"

 {

 			    HLTQ_CONCAT(yyvsp[-2].privilege, yyvsp[0].privilege, entries);

 			    yyval.privilege = yyvsp[-2].privilege;

 			}

 break;

 case 26:

-#line 283 "gram.y"

+#line 285 "gram.y"

 {

 			    struct privilege *p = calloc(1, sizeof(*p));

 			    if (p == NULL) {

@@ -1472,21 +1477,21 @@ case 26:

 			}

 break;

 case 27:

-#line 297 "gram.y"

+#line 299 "gram.y"

 {

 			    yyval.member = yyvsp[0].member;

 			    yyval.member->negated = false;

 			}

 break;

 case 28:

-#line 301 "gram.y"

+#line 303 "gram.y"

 {

 			    yyval.member = yyvsp[0].member;

 			    yyval.member->negated = true;

 			}

 break;

 case 29:

-#line 307 "gram.y"

+#line 309 "gram.y"

 {

 			    yyval.member = new_member(yyvsp[0].string, ALIAS);

 			    if (yyval.member == NULL) {

@@ -1496,7 +1501,7 @@ case 29:

 			}

 break;

 case 30:

-#line 314 "gram.y"

+#line 316 "gram.y"

 {

 			    yyval.member = new_member(NULL, ALL);

 			    if (yyval.member == NULL) {

@@ -1506,7 +1511,7 @@ case 30:

 			}

 break;

 case 31:

-#line 321 "gram.y"

+#line 323 "gram.y"

 {

 			    yyval.member = new_member(yyvsp[0].string, NETGROUP);

 			    if (yyval.member == NULL) {

@@ -1516,7 +1521,7 @@ case 31:

 			}

 break;

 case 32:

-#line 328 "gram.y"

+#line 330 "gram.y"

 {

 			    yyval.member = new_member(yyvsp[0].string, NTWKADDR);

 			    if (yyval.member == NULL) {

@@ -1526,7 +1531,7 @@ case 32:

 			}

 break;

 case 33:

-#line 335 "gram.y"

+#line 337 "gram.y"

 {

 			    yyval.member = new_member(yyvsp[0].string, WORD);

 			    if (yyval.member == NULL) {

@@ -1536,7 +1541,7 @@ case 33:

 			}

 break;

 case 35:

-#line 345 "gram.y"

+#line 347 "gram.y"

 {

 			    struct cmndspec *prev;

 			    prev = HLTQ_LAST(yyvsp[-2].cmndspec, cmndspec, entries);

@@ -1590,7 +1595,7 @@ case 35:

 			}

 break;

 case 36:

-#line 398 "gram.y"

+#line 400 "gram.y"

 {

 			    struct cmndspec *cs = calloc(1, sizeof(*cs));

 			    if (cs == NULL) {

@@ -1642,7 +1647,7 @@ case 36:

 			}

 break;

 case 37:

-#line 449 "gram.y"

+#line 451 "gram.y"

 {

 			    yyval.digest = new_digest(SUDO_DIGEST_SHA224, yyvsp[0].string);

 			    if (yyval.digest == NULL) {

@@ -1652,7 +1657,7 @@ case 37:

 			}

 break;

 case 38:

-#line 456 "gram.y"

+#line 458 "gram.y"

 {

 			    yyval.digest = new_digest(SUDO_DIGEST_SHA256, yyvsp[0].string);

 			    if (yyval.digest == NULL) {

@@ -1662,7 +1667,7 @@ case 38:

 			}

 break;

 case 39:

-#line 463 "gram.y"

+#line 465 "gram.y"

 {

 			    yyval.digest = new_digest(SUDO_DIGEST_SHA384, yyvsp[0].string);

 			    if (yyval.digest == NULL) {

@@ -1672,7 +1677,7 @@ case 39:

 			}

 break;

 case 40:

-#line 470 "gram.y"

+#line 472 "gram.y"

 {

 			    yyval.digest = new_digest(SUDO_DIGEST_SHA512, yyvsp[0].string);

 			    if (yyval.digest == NULL) {

@@ -1682,13 +1687,13 @@ case 40:

 			}

 break;

 case 41:

-#line 479 "gram.y"

+#line 481 "gram.y"

 {

 			    yyval.member = yyvsp[0].member;

 			}

 break;

 case 42:

-#line 482 "gram.y"

+#line 484 "gram.y"

 {

 			    if (yyvsp[0].member->type != COMMAND) {

 				sudoerserror(N_("a digest requires a path name"));

@@ -1700,75 +1705,75 @@ case 42:

 			}

 break;

 case 43:

-#line 493 "gram.y"

+#line 495 "gram.y"

 {

 			    yyval.member = yyvsp[0].member;

 			    yyval.member->negated = false;

 			}

 break;

 case 44:

-#line 497 "gram.y"

+#line 499 "gram.y"

 {

 			    yyval.member = yyvsp[0].member;

 			    yyval.member->negated = true;

 			}

 break;

 case 45:

-#line 503 "gram.y"

+#line 505 "gram.y"

 {

 			    yyval.string = yyvsp[0].string;

 			}

 break;

 case 46:

-#line 508 "gram.y"

+#line 510 "gram.y"

 {

 			    yyval.string = yyvsp[0].string;

 			}

 break;

 case 47:

-#line 512 "gram.y"

+#line 514 "gram.y"

 {

 			    yyval.string = yyvsp[0].string;

 			}

 break;

 case 48:

-#line 517 "gram.y"

+#line 519 "gram.y"

 {

 			    yyval.string = yyvsp[0].string;

 			}

 break;

 case 49:

-#line 522 "gram.y"

+#line 524 "gram.y"

 {

 			    yyval.string = yyvsp[0].string;

 			}

 break;

 case 50:

-#line 527 "gram.y"

+#line 529 "gram.y"

 {

 			    yyval.string = yyvsp[0].string;

 			}

 break;

 case 51:

-#line 531 "gram.y"

+#line 533 "gram.y"

 {

 			    yyval.string = yyvsp[0].string;

 			}

 break;

 case 52:

-#line 536 "gram.y"

+#line 538 "gram.y"

 {

 			    yyval.runas = NULL;

 			}

 break;

 case 53:

-#line 539 "gram.y"

+#line 541 "gram.y"

 {

 			    yyval.runas = yyvsp[-1].runas;

 			}

 break;

 case 54:

-#line 544 "gram.y"

+#line 546 "gram.y"

 {

 			    yyval.runas = calloc(1, sizeof(struct runascontainer));

 			    if (yyval.runas != NULL) {

@@ -1786,7 +1791,7 @@ case 54:

 			}

 break;

 case 55:

-#line 559 "gram.y"

+#line 561 "gram.y"

 {

 			    yyval.runas = calloc(1, sizeof(struct runascontainer));

 			    if (yyval.runas == NULL) {

@@ -1798,7 +1803,7 @@ case 55:

 			}

 break;

 case 56:

-#line 568 "gram.y"

+#line 570 "gram.y"

 {

 			    yyval.runas = calloc(1, sizeof(struct runascontainer));

 			    if (yyval.runas == NULL) {

@@ -1810,7 +1815,7 @@ case 56:

 			}

 break;

 case 57:

-#line 577 "gram.y"

+#line 579 "gram.y"

 {

 			    yyval.runas = calloc(1, sizeof(struct runascontainer));

 			    if (yyval.runas == NULL) {

@@ -1822,7 +1827,7 @@ case 57:

 			}

 break;

 case 58:

-#line 586 "gram.y"

+#line 588 "gram.y"

 {

 			    yyval.runas = calloc(1, sizeof(struct runascontainer));

 			    if (yyval.runas != NULL) {

@@ -1840,13 +1845,13 @@ case 58:

 			}

 break;

 case 59:

-#line 603 "gram.y"

+#line 605 "gram.y"

 {

 			    init_options(&yyval.options);

 			}

 break;

 case 60:

-#line 606 "gram.y"

+#line 608 "gram.y"

 {

 			    yyval.options.notbefore = parse_gentime(yyvsp[0].string);

 			    free(yyvsp[0].string);

@@ -1857,7 +1862,7 @@ case 60:

 			}

 break;

 case 61:

-#line 614 "gram.y"

+#line 616 "gram.y"

 {

 			    yyval.options.notafter = parse_gentime(yyvsp[0].string);

 			    free(yyvsp[0].string);

@@ -1868,7 +1873,7 @@ case 61:

 			}

 break;

 case 62:

-#line 622 "gram.y"

+#line 624 "gram.y"

 {

 			    yyval.options.timeout = parse_timeout(yyvsp[0].string);

 			    free(yyvsp[0].string);

@@ -1882,7 +1887,7 @@ case 62:

 			}

 break;

 case 63:

-#line 633 "gram.y"

+#line 635 "gram.y"

 {

 #ifdef HAVE_SELINUX

 			    free(yyval.options.role);

@@ -1891,7 +1896,7 @@ case 63:

 			}

 break;

 case 64:

-#line 639 "gram.y"

+#line 641 "gram.y"

 {

 #ifdef HAVE_SELINUX

 			    free(yyval.options.type);

@@ -1900,7 +1905,7 @@ case 64:

 			}

 break;

 case 65:

-#line 645 "gram.y"

+#line 647 "gram.y"

 {

 #ifdef HAVE_PRIV_SET

 			    free(yyval.options.privs);

@@ -1909,7 +1914,7 @@ case 65:

 			}

 break;

 case 66:

-#line 651 "gram.y"

+#line 653 "gram.y"

 {

 #ifdef HAVE_PRIV_SET

 			    free(yyval.options.limitprivs);

@@ -1918,97 +1923,97 @@ case 66:

 			}

 break;

 case 67:

-#line 659 "gram.y"

+#line 661 "gram.y"

 {

 			    TAGS_INIT(yyval.tag);

 			}

 break;

 case 68:

-#line 662 "gram.y"

+#line 664 "gram.y"

 {

 			    yyval.tag.nopasswd = true;

 			}

 break;

 case 69:

-#line 665 "gram.y"

+#line 667 "gram.y"

 {

 			    yyval.tag.nopasswd = false;

 			}

 break;

 case 70:

-#line 668 "gram.y"

+#line 670 "gram.y"

 {

 			    yyval.tag.noexec = true;

 			}

 break;

 case 71:

-#line 671 "gram.y"

+#line 673 "gram.y"

 {

 			    yyval.tag.noexec = false;

 			}

 break;

 case 72:

-#line 674 "gram.y"

+#line 676 "gram.y"

 {

 			    yyval.tag.setenv = true;

 			}

 break;

 case 73:

-#line 677 "gram.y"

+#line 679 "gram.y"

 {

 			    yyval.tag.setenv = false;

 			}

 break;

 case 74:

-#line 680 "gram.y"

+#line 682 "gram.y"

 {

 			    yyval.tag.log_input = true;

 			}

 break;

 case 75:

-#line 683 "gram.y"

+#line 685 "gram.y"

 {

 			    yyval.tag.log_input = false;

 			}

 break;

 case 76:

-#line 686 "gram.y"

+#line 688 "gram.y"

 {

 			    yyval.tag.log_output = true;

 			}

 break;

 case 77:

-#line 689 "gram.y"

+#line 691 "gram.y"

 {

 			    yyval.tag.log_output = false;

 			}

 break;

 case 78:

-#line 692 "gram.y"

+#line 694 "gram.y"

 {

 			    yyval.tag.follow = true;

 			}

 break;

 case 79:

-#line 695 "gram.y"

+#line 697 "gram.y"

 {

 			    yyval.tag.follow = false;

 			}

 break;

 case 80:

-#line 698 "gram.y"

+#line 700 "gram.y"

 {

 			    yyval.tag.send_mail = true;

 			}

 break;

 case 81:

-#line 701 "gram.y"

+#line 703 "gram.y"

 {

 			    yyval.tag.send_mail = false;

 			}

 break;

 case 82:

-#line 706 "gram.y"

+#line 708 "gram.y"

 {

 			    yyval.member = new_member(NULL, ALL);

 			    if (yyval.member == NULL) {

@@ -2018,7 +2023,7 @@ case 82:

 			}

 break;

 case 83:

-#line 713 "gram.y"

+#line 715 "gram.y"

 {

 			    yyval.member = new_member(yyvsp[0].string, ALIAS);

 			    if (yyval.member == NULL) {

@@ -2028,7 +2033,7 @@ case 83:

 			}

 break;

 case 84:

-#line 720 "gram.y"

+#line 722 "gram.y"

 {

 			    struct sudo_command *c = calloc(1, sizeof(*c));

 			    if (c == NULL) {