|
 |
110381 |
From b1f3fcf8d6e9a8e5326771a12fac8e08ed81f766 Mon Sep 17 00:00:00 2001
|
|
|
110381 |
From: Tomas Sykora <tosykora@redhat.com>
|
|
|
110381 |
Date: Fri, 19 Aug 2016 10:21:27 +0200
|
|
|
110381 |
Subject: [PATCH] Sudo with ldap doesn't work with 'user id'
|
|
|
110381 |
|
|
|
110381 |
in sudoUser option.
|
|
|
110381 |
|
|
|
110381 |
Rebased from:
|
|
|
110381 |
Patch39: sudo-1.8.6p7-ldapsearchuidfix.patch
|
|
|
110381 |
|
|
|
110381 |
Resolves:
|
|
|
110381 |
rhbz#1135539
|
|
|
110381 |
---
|
|
|
110381 |
plugins/sudoers/def_data.c | 4 ++++
|
|
|
110381 |
plugins/sudoers/def_data.h | 2 ++
|
|
|
110381 |
plugins/sudoers/def_data.in | 3 +++
|
|
|
110381 |
plugins/sudoers/defaults.c | 2 ++
|
|
|
110381 |
plugins/sudoers/ldap.c | 10 ++++++++--
|
|
|
110381 |
plugins/sudoers/sudoers.c | 4 ++++
|
|
|
110381 |
6 files changed, 23 insertions(+), 2 deletions(-)
|
|
|
110381 |
|
|
|
110381 |
diff --git a/plugins/sudoers/def_data.c b/plugins/sudoers/def_data.c
|
|
|
110381 |
index d8b1ada..3926fed 100644
|
|
|
110381 |
--- a/plugins/sudoers/def_data.c
|
|
|
110381 |
+++ b/plugins/sudoers/def_data.c
|
|
|
110381 |
@@ -439,6 +439,10 @@ struct sudo_defs_types sudo_defs_table[] = {
|
|
|
110381 |
N_("Don't fork and wait for the command to finish, just exec it"),
|
|
|
110381 |
NULL,
|
|
|
110381 |
}, {
|
|
|
110381 |
+ "legacy_group_processing", T_FLAG,
|
|
|
110381 |
+ N_("Don't pre-resolve all group names"),
|
|
|
110381 |
+ NULL,
|
|
|
110381 |
+ }, {
|
|
|
110381 |
NULL, 0, NULL
|
|
|
110381 |
}
|
|
|
110381 |
};
|
|
|
110381 |
diff --git a/plugins/sudoers/def_data.h b/plugins/sudoers/def_data.h
|
|
|
110381 |
index 1b6be3d..5246e41 100644
|
|
|
110381 |
--- a/plugins/sudoers/def_data.h
|
|
|
110381 |
+++ b/plugins/sudoers/def_data.h
|
|
|
110381 |
@@ -206,6 +206,8 @@
|
|
|
110381 |
#define def_iolog_mode (sudo_defs_table[I_IOLOG_MODE].sd_un.mode)
|
|
|
110381 |
#define I_CMND_NO_WAIT 103
|
|
|
110381 |
#define def_cmnd_no_wait (sudo_defs_table[I_CMND_NO_WAIT].sd_un.flag)
|
|
|
110381 |
+#define I_LEGACY_GROUP_PROCESSING 104
|
|
|
110381 |
+#define def_legacy_group_processing (sudo_defs_table[I_LEGACY_GROUP_PROCESSING].sd_un.flag)
|
|
|
110381 |
|
|
|
110381 |
enum def_tuple {
|
|
|
110381 |
never,
|
|
|
110381 |
diff --git a/plugins/sudoers/def_data.in b/plugins/sudoers/def_data.in
|
|
|
110381 |
index 5200fe3..f1c9265 100644
|
|
|
110381 |
--- a/plugins/sudoers/def_data.in
|
|
|
110381 |
+++ b/plugins/sudoers/def_data.in
|
|
|
110381 |
@@ -325,3 +325,6 @@ iolog_mode
|
|
|
110381 |
cmnd_no_wait
|
|
|
110381 |
T_FLAG
|
|
|
110381 |
"Don't fork and wait for the command to finish, just exec it"
|
|
|
110381 |
+legacy_group_processing
|
|
|
110381 |
+ T_FLAG
|
|
|
110381 |
+ "Don't pre-resolve all group names"
|
|
|
110381 |
diff --git a/plugins/sudoers/defaults.c b/plugins/sudoers/defaults.c
|
|
|
110381 |
index 5eaf8ea..9e60d94 100644
|
|
|
110381 |
--- a/plugins/sudoers/defaults.c
|
|
|
110381 |
+++ b/plugins/sudoers/defaults.c
|
|
|
110381 |
@@ -450,6 +450,8 @@ init_defaults(void)
|
|
|
110381 |
}
|
|
|
110381 |
|
|
|
110381 |
/* First initialize the flags. */
|
|
|
110381 |
+ def_legacy_group_processing = true;
|
|
|
110381 |
+ def_match_group_by_gid = true;
|
|
|
110381 |
#ifdef LONG_OTP_PROMPT
|
|
|
110381 |
def_long_otp_prompt = true;
|
|
|
110381 |
#endif
|
|
|
110381 |
diff --git a/plugins/sudoers/ldap.c b/plugins/sudoers/ldap.c
|
|
|
110381 |
index 3fe27c7..96a0709 100644
|
|
|
110381 |
--- a/plugins/sudoers/ldap.c
|
|
|
110381 |
+++ b/plugins/sudoers/ldap.c
|
|
|
110381 |
@@ -1666,8 +1666,8 @@ sudo_ldap_build_pass1(LDAP *ld, struct passwd *pw)
|
|
|
110381 |
if (ldap_conf.search_filter)
|
|
|
110381 |
sz += strlen(ldap_conf.search_filter);
|
|
|
110381 |
|
|
|
110381 |
- /* Then add (|(sudoUser=USERNAME)(sudoUser=ALL)) + NUL */
|
|
|
110381 |
- sz += 29 + sudo_ldap_value_len(pw->pw_name);
|
|
|
110381 |
+ /* Then add (|(sudoUser=USERNAME)(sudoUser=#uid)(sudoUser=ALL)) + NUL */
|
|
|
110381 |
+ sz += 29 + (12 + MAX_UID_T_LEN) + sudo_ldap_value_len(pw->pw_name);
|
|
|
110381 |
|
|
|
110381 |
/* Add space for primary and supplementary groups and gids */
|
|
|
110381 |
if ((grp = sudo_getgrgid(pw->pw_gid)) != NULL) {
|
|
|
110381 |
@@ -1730,6 +1730,12 @@ sudo_ldap_build_pass1(LDAP *ld, struct passwd *pw)
|
|
|
110381 |
CHECK_LDAP_VCAT(buf, pw->pw_name, sz);
|
|
|
110381 |
CHECK_STRLCAT(buf, ")", sz);
|
|
|
110381 |
|
|
|
110381 |
+ /* Append user uid */
|
|
|
110381 |
+ (void) snprintf(gidbuf, sizeof(gidbuf), "%u", (unsigned int)pw->pw_uid);
|
|
|
110381 |
+ (void) strlcat(buf, "(sudoUser=#", sz);
|
|
|
110381 |
+ (void) strlcat(buf, gidbuf, sz);
|
|
|
110381 |
+ (void) strlcat(buf, ")", sz);
|
|
|
110381 |
+
|
|
|
110381 |
/* Append primary group and gid */
|
|
|
110381 |
if (grp != NULL) {
|
|
|
110381 |
CHECK_STRLCAT(buf, "(sudoUser=%", sz);
|
|
|
110381 |
diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
|
|
|
110381 |
index 539177a..673ee5d 100644
|
|
|
110381 |
--- a/plugins/sudoers/sudoers.c
|
|
|
110381 |
+++ b/plugins/sudoers/sudoers.c
|
|
|
110381 |
@@ -208,6 +208,10 @@ sudoers_policy_init(void *info, char * const envp[])
|
|
|
110381 |
if (set_loginclass(runas_pw ? runas_pw : sudo_user.pw))
|
|
|
110381 |
ret = true;
|
|
|
110381 |
|
|
|
110381 |
+ if (!def_match_group_by_gid || !def_legacy_group_processing) {
|
|
|
110381 |
+ def_match_group_by_gid = false;
|
|
|
110381 |
+ def_legacy_group_processing = false;
|
|
|
110381 |
+ }
|
|
|
110381 |
cleanup:
|
|
|
110381 |
if (!restore_perms())
|
|
|
110381 |
ret = -1;
|
|
|
110381 |
--
|
|
|
110381 |
2.7.4
|
|
|
110381 |
|