Sudo Project commits | Ecosyste.ms: OpenCollective

Avoid calling sudoers_policy_exec_setup() on error.

We only want to pass the execution environment back for commands
that are accepted or rejected.
A...

github.com/sudo-project/sudo - f6a264e719f4f27739da96dae494df5af153f630 authored over 4 years ago by Todd C. Miller <[email protected]>

Open event log at config time instead of open/close for each entry.

If logging via syslog, do the openlog() at config time instead.
We still lock the log file prior ...

github.com/sudo-project/sudo - f40b4c2887f05e06c9cfd204b660b91b898bab4f authored over 4 years ago by Todd C. Miller <[email protected]>

Fix unlocking of an entire file with lockf().

Since lockf() uses the files's current offset, we need to seek to
the start of the file to unlock...

github.com/sudo-project/sudo - 7e5641bc767b9af5a3580000fdb679c55af55fcf authored over 4 years ago by Todd C. Miller <[email protected]>

Add sudo_json_free_v1 to symbol exports file too.

github.com/sudo-project/sudo - 1b930b585d8e07de334a0130227c9a420057568f authored over 4 years ago by Todd C. Miller <[email protected]>

Regenerate dependencies to match the recent JSON changes.

github.com/sudo-project/sudo - 4b4db9694a348de67617522f669efc0c29e67a1e authored over 4 years ago by Todd C. Miller <[email protected]>

Add missing check for calloc(3) failure.

github.com/sudo-project/sudo - 4d1454ebaba1f5d513169f32facaa3e255ccd3ed authored over 4 years ago by Todd C. Miller <[email protected]>

doc/sudo_plugin_python: document approval plugin and PluginReject

github.com/sudo-project/sudo - 95dce8cbe6da74f466847f51be5f02fccc228204 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: only deinit interpreters when sudo unlinks the plugin

This only happens when sudo unloads the last python plugin.
The reason doing so is because there...

github.com/sudo-project/sudo - 27de7dd24d0bd983b8254fe57b4a1aafb82c935c authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: restore the original python inittab after interpreter deinit

github.com/sudo-project/sudo - 3be61db35cff9baee6e997f993acdf4aa3e11e4f authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/sudo_python_module.c: remove unused declaration

We do not use structsequence any more.

github.com/sudo-project/sudo - 06b1f58e9f57f65abee692b6672258faaebead16 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/debug: adapt debug refcount solution of sudoers plugin

github.com/sudo-project/sudo - 8a9218d161c207efbb637518a311c15e6ecd16aa authored over 4 years ago by Robert Manner <[email protected]>

Re-register listeners on SIGHUP.

Previously, a config reload would refresh the listener address list
but the changes had no effect...

github.com/sudo-project/sudo - a0c2de4cef310dc7d685914adaac05a6c5c9ae66 authored over 4 years ago by Todd C. Miller <[email protected]>

Fix compilation error when not built with OpenSSL support.

Adds a missing #ifdef HAVE_OPENSSL and reorders code to avoid the
need for a static init_tls_serv...

github.com/sudo-project/sudo - adb3bdf6dd02e2eed2949eac7e27a4f74384cc04 authored over 4 years ago by Todd C. Miller <[email protected]>

Add support for JSON structured logging using syslog.

Note that depending on the system, the default syslog buffer
may not be large enough to store all...

github.com/sudo-project/sudo - 982c003b8dd80798bd53ad1ea35bc4d1b5f01da3 authored over 4 years ago by Todd C. Miller <[email protected]>

Add support for JSON logging in sudo_logsrvd.

github.com/sudo-project/sudo - 5781a6a4cf118dc174180bf6a4187ebef2b999c6 authored over 4 years ago by Todd C. Miller <[email protected]>

Rework the JSON API to write to a memory buffer, not a stdio stream.

github.com/sudo-project/sudo - 8ef5b734c4a50e329ba393980008abb6ae090d6b authored over 4 years ago by Todd C. Miller <[email protected]>

Fix support for reloading the config in sudo_logsrvd.

We need to re-initialize the TLS server context.
Also fix a memory leak of the TLS parameters on ...

github.com/sudo-project/sudo - 25542216feb6603ab13046613b66417d00712213 authored over 4 years ago by Todd C. Miller <[email protected]>

The environment in the accept message is runenv not submitenv.

The I/O logging plugin is passed the environment the command will
run with, not the user's origin...

github.com/sudo-project/sudo - 2e836cc571701ae24499857827797987649de605 authored over 4 years ago by Todd C. Miller <[email protected]>

Add compatibility define for fseeko(3).

This is better than cluttering up the code with #ifdefs for obsolete
systems.

github.com/sudo-project/sudo - 92e42ff548fe013ccb82196abd70cf1a82e3dc29 authored over 4 years ago by Todd C. Miller <[email protected]>

Add test for #include directive without a trailing newline.

github.com/sudo-project/sudo - e7bd19bd1e6de439891a7f2383445e4b0aa5cf78 authored over 4 years ago by Todd C. Miller <[email protected]>

Don't require a newline at the end of include or includedir directives.

github.com/sudo-project/sudo - d2314acae854bd127d531c399d0faf3e0534341c authored over 4 years ago by Todd C. Miller <[email protected]>

plugins/python/regress/testhelpers.c: replace fromisoformat

fromisoformat is only supported from python >=3.7

github.com/sudo-project/sudo - 8395a20a20ff1ff68f46770812b4bccc08c8cfce authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: add missing annotations to help cpychecker

github.com/sudo-project/sudo - b2ae79c2beff5bd40e8bbedba4a7c10d055ddb61 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/python_plugin_common.c: release py_args in close

even if the arguments are not used (eg. when there is no "close" call
in the plugin).

It was no...

github.com/sudo-project/sudo - a71828b385f3f9beece24aedd0cec584bbb876fc authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/python_plugin_approval: fix negative ref count

The python_plugin_api_rc_call function already decrements the
refcount of py_args.
Python avoids...

github.com/sudo-project/sudo - efa97b5b97e69b510d9e79738477ab3fe3a3bea2 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: make storing errstr more explicit

The error is always stored in plugin_ctx, but it is only set into errstr
if the API version is e...

github.com/sudo-project/sudo - b1d2ccecd0d7ca09d979f4ab8c0ed56cfd012315 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: add python approval plugin wrapper

github.com/sudo-project/sudo - 23af39b0058aadd296d350cef24a3b0354f8aef2 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/regress: still some memleak fix

github.com/sudo-project/sudo - d1f94c857c61958c6dd47215a9ce74c4eb1a13a9 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/sudo_module: let a reject also supply error message

Same as sudo.PluginError exception, have a sudo.PluginReject exception
as well. Added common bas...

github.com/sudo-project/sudo - b165242035cbf06eda283ab4acbababfae26deda authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: add python approval plugin example

github.com/sudo-project/sudo - 80b3d86d6eeed6119e7716099b2f19d18054d346 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/regress: simplify plugin option creation

github.com/sudo-project/sudo - 9fa6500d6a63f77cb67ea21e8ca8207fc49edce8 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/regress: strengthen errstr verification

Tests did not catch the issue where errstr was not set correctly, but
its pointer contained the ...

github.com/sudo-project/sudo - 33e7fdcae0218d132e2661d2f289635c32a3d504 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/regress: add tests for approval plugin

github.com/sudo-project/sudo - 43e256e34f85aa6032c741278a676a80fbe8cff9 authored over 4 years ago by Robert Manner <[email protected]>

Move duplicated code to parse plugin debug flags to libsudo_util.

There's no need for four copies of sudo_debug_parse_flags().

github.com/sudo-project/sudo - 0e4c3c47d112faf59bf189f560d217c500706462 authored over 4 years ago by Todd C. Miller <[email protected]>

Add regress test for parsing Defaults lists.

Currently only env_check, env_delete, env_keep and log_servers are lists.

github.com/sudo-project/sudo - 9e2e79b6fa3ca210cfda610667d70861f06b165d authored over 4 years ago by Todd C. Miller <[email protected]>

Clarify that approval close happens after auditing.

Also fix a few typos.

github.com/sudo-project/sudo - 009788afae4f70d692001b2ecfdcaf20652e3024 authored over 4 years ago by Todd C. Miller <[email protected]>

Add open and close functions to the approval plugin API.

We need a close function to be able to to free memory allocated for
errstr. Unlike the other plu...

github.com/sudo-project/sudo - 01a53f286506cdb49ea00d457524441d6dcc56fc authored over 4 years ago by Todd C. Miller <[email protected]>

Use unique function names to avoid confusion with front-end functions.

Also add a missing sudo_debug_enter() after debug registration.

github.com/sudo-project/sudo - 55b61b989f6daee1226660db745a43deeb361af5 authored over 4 years ago by Todd C. Miller <[email protected]>

Use Text::Wrap instead of perl's built-in format function.

This still breaks log filename incorrectly but is a step in the
right direction.

github.com/sudo-project/sudo - 3911e4f7bf2892c7db5d167ba1651ad0c5aadf51 authored over 4 years ago by Todd C. Miller <[email protected]>

Avoid changing directory when generating the ChangeLog file.

Instead, pass the repo path to either hg or log2cl.pl

github.com/sudo-project/sudo - c2f3f60583a1c276f8ac6e01d14b5ffb7e0bcc13 authored over 4 years ago by Todd C. Miller <[email protected]>

src/sudo.c: call audit plugin close when result is a wait status

github.com/sudo-project/sudo - 2781ec030bd3f9fd6a8d56c19d3cfe4b73f2376c authored over 4 years ago by Robert Manner <[email protected]>

Makefile.in: fix install target for out of source build

The scriptdir contained a path relative to where the target was started.
The scripts are called ...

github.com/sudo-project/sudo - 0202dc67ccbd4fcbc01084b2b3381322d6af3de1 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/pyhelpers: add helpers for attribute handling

to simplify code a bit.

github.com/sudo-project/sudo - 62524416eb091a0d8b96b14ce12b470bac74e36a authored over 4 years ago by Robert Manner <[email protected]>

doc/sudo_plugin_python: document python audit plugin support

github.com/sudo-project/sudo - ecdaaffd572469bb01312d5e0b6f435f89bad437 authored over 4 years ago by Robert Manner <[email protected]>

doc/sudo_plugin_python: document returning error string

github.com/sudo-project/sudo - bd465b30876def6eae6398b77b48d5d0472f7f95 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: memleak fixes in test

The main problem was that string array objects were constructed
differently:
- if constructed by...

github.com/sudo-project/sudo - a3a7630ff4318421ce47ac613c7223c6220cdd4e authored over 4 years ago by Robert Manner <[email protected]>

doc/sudo_plugin_python: update python manual for constant -> enum changes

github.com/sudo-project/sudo - 8f79d5c1c7f94da471d719dc2c59e45d70b58cb8 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/python_plugin_policy: add missing debug return

github.com/sudo-project/sudo - 67ab6fd5d6dc3b33640e3553b1679c0327197a92 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/sudo_python_module.c: use IntEnums instead of constants

It is a bit more code, but it is more "pythonic" and easier to debug
as the enum values also kno...

github.com/sudo-project/sudo - 21c02e17326d7487a438c0fd4cca7a7e510ca1ca authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/sudo_python_module.c: fix options_as_dict if no equal sign

The intented behaviour was that those get skipped, but the PyList_GetItem
sets the interpreter i...

github.com/sudo-project/sudo - 99f99e8a56dff9dac67a3d24dec5320fb594f33e authored over 4 years ago by Robert Manner <[email protected]>

plugins/python_plugin_io,policy: fix version display in verbose mode

Unfortunately the test did not catch this mistake, because it only
searches that "Python policy ...

github.com/sudo-project/sudo - a7eb9d34122c1d4f32f22d5bdae27cfa12193e2e authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/python_plugin_common: close can get custom arguments

For the audit plugin.
Ensure we do not fail if plugin_ctx->py_instance is NULL (because
plugin i...

github.com/sudo-project/sudo - 36694fce86b406616318ec0cc72e8496512f2bb5 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/regress: load/unload module for each testcase

so they can start from clean state. (My problem was optional argument
tests has destroyed the ca...

github.com/sudo-project/sudo - 0f3631cc082be3a78ff862330dd54e80037aa9fc authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/example*.py: pep8 fixes (mainly line too long)

github.com/sudo-project/sudo - 45d2638571bb2470a5082778f8beef8f215dde12 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/regress: add test for callback error msg return

github.com/sudo-project/sudo - 9c4f076f858be0301354d2cc57358dcc4e844f85 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: add support for callback errstr arguments

Plugins can raise a sudo.PluginError exception to add context message
for the failure.

The call...

github.com/sudo-project/sudo - 3dd5f37af7fc12ef5b97aeb0019299e6efac07ad authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: add python audit plugin wrapper

github.com/sudo-project/sudo - cbf60cff5d43c084fe7308bfd53d30e676ff8ba3 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/example_*.py: document returning error string

github.com/sudo-project/sudo - bbbcb393344c52e2b8df22c3b335ab7c47222883 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python: add example python audit plugin

github.com/sudo-project/sudo - 52d067b01f68d29101d996ca74bc058440045b15 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/regress/check_python_examples: add audit_plugin tests

github.com/sudo-project/sudo - 1a1cb54975d245216ae1e163e1115d51aff92b46 authored over 4 years ago by Robert Manner <[email protected]>

plugins/python/example_io_plugin: close the file at destroy

to avoid warning of debug python build.

github.com/sudo-project/sudo - 4110800c146e111b87d1071c36a094b9c59f5f66 authored over 4 years ago by Robert Manner <[email protected]>

Use EXIT_SUCCESS and EXIT_FAILURE more consistently.

github.com/sudo-project/sudo - ac61b5655d5b0437e3dec29c823ab4591db204e3 authored over 4 years ago by Todd C. Miller <[email protected]>

Mark main sudo usage() function __noreturn__.

This splits the usage printing out into display_usage().

github.com/sudo-project/sudo - c5afbf00fc60c754d3c8ce729f77183ebc8b92fe authored over 4 years ago by Todd C. Miller <[email protected]>

Use json functions from libsudo_util in cvtsudoers.

github.com/sudo-project/sudo - c92f39ed3d6e63714e1623c13fc55aa5c642253f authored over 4 years ago by Todd C. Miller <[email protected]>

Check localtime() return value; coverity CID 208156

github.com/sudo-project/sudo - d25ce46c56d352d6194955b874928bf3a2d2a4cb authored over 4 years ago by Todd C. Miller <[email protected]>

Check fseeko() return value; coverity CID 207993

github.com/sudo-project/sudo - a75992897c4a1077ed8aa624a78cac696dbc429d authored over 4 years ago by Todd C. Miller <[email protected]>

Make restart and elapsed members of the closure structs not pointers.

Fixes coverity CID 207992

github.com/sudo-project/sudo - 630fc9b17b992febef796b497817c81f3266cd04 authored over 4 years ago by Todd C. Miller <[email protected]>

Check return value of sudo_lock_file(); coverity CID 207991

github.com/sudo-project/sudo - 9d5f066180ef95aac2467b8ef0e577fa4adecaec authored over 4 years ago by Todd C. Miller <[email protected]>

Only keepalive if accept() succeeded; coverity CID 207990

github.com/sudo-project/sudo - 589adfee2d9c0de0b6d2f91f73abc7f8800d2ced authored over 4 years ago by Todd C. Miller <[email protected]>

Move some scripts from the top level src dir to a scripts dir.

github.com/sudo-project/sudo - 2fe127d1089bd1702f83af5aaca79a3f535b728d authored over 4 years ago by Todd C. Miller <[email protected]>

Add sample approval plugin that simply tests for "business hours"

github.com/sudo-project/sudo - aa1ca9c9ba54167f75f7bf2997f081de45838c03 authored over 4 years ago by Todd C. Miller <[email protected]>

Add sample approval plugin that simply tests for "business hours"

github.com/sudo-project/sudo - 7d5734a317e4eded3ad9b445e0139ae7464c15c5 authored over 4 years ago by Todd C. Miller <[email protected]>

Refactor code to alloc and insert a new plugin_container.

The only outlier is the policy plugin which is not part of a list
since there can only be a singl...

github.com/sudo-project/sudo - 0972dafb1f403448a061a61201787a26267b07e4 authored over 4 years ago by Todd C. Miller <[email protected]>

Tech audit_json about approval plugin accept/reject

github.com/sudo-project/sudo - ce21233fbe18dde0d89ad95411445212b7bb33eb authored over 4 years ago by Todd C. Miller <[email protected]>

Add an approval plugin type that runs after the policy plugin.

The basic idea is that the approval plugin adds an additional
layer of policy. There can be mult...

github.com/sudo-project/sudo - db17cadaf65c7fc85d54c9f1a126136f6a9297b0 authored over 4 years ago by Todd C. Miller <[email protected]>

plugin documentation fixes:

o whitespace cleanup
o show_version doesn't have an errstr argument
o document runas_user and ...

github.com/sudo-project/sudo - 084cad2120ea0a55f4a1a6469fe9237ad8ec63b7 authored over 4 years ago by Todd C. Miller <[email protected]>

Exported symbol is audit_json

github.com/sudo-project/sudo - 404b28c4d0c195a32dcf533ce03da3fcc3e1c55c authored over 4 years ago by Todd C. Miller <[email protected]>

Silence lint warning.

github.com/sudo-project/sudo - ea377e432b2e79eb036250e917fa62a0f3cb5840 authored over 4 years ago by Todd C. Miller <[email protected]>

Add runas_user and runas_group (if set) to command_info for audit plugin.

Otherwise, the audit plugin has to look up the runas name and group
by user or group ID.

github.com/sudo-project/sudo - c2faa9e6ef1d337911fbb8773ad1d38a1fcb508d authored over 4 years ago by Todd C. Miller <[email protected]>

Only enable pwfeedback when reading password from /dev/tty.

This effectively disables pwfeedback when the -S or -A options are used.

github.com/sudo-project/sudo - d219c6463542d0f534f8d2bc90e70d26d57a526c authored over 4 years ago by Todd C. Miller <[email protected]>

fixed compiler error when sudo is configured without --enable-openssl

github.com/sudo-project/sudo - 0ca2d1427b26b3fa9c83e17b0e759a5b0d830cdd authored over 4 years ago by Laszlo Orban <[email protected]>

Regenerate .man.in files from .mdoc.in

github.com/sudo-project/sudo - cec6b1708a086079997bb52eada45b75d02c9114 authored over 4 years ago by Todd C. Miller <[email protected]>

Update documentation for setbase when the given base is NULL.

github.com/sudo-project/sudo - b35cc96f0edd6b94cc453d150c33dc85b945fe41 authored over 4 years ago by Todd C. Miller <[email protected]>

For plugin events, set the sudo event base for setbase(NULL).

This makes it possible for a plugin to change the event base
to a local one and then reset it bac...

github.com/sudo-project/sudo - 658702b6d4620471f1eee48edf8682c70cdf285b authored over 4 years ago by Todd C. Miller <[email protected]>

Don't display "error in event loop" on loop break reading ServerHello.

We should already have displayed a more useful error message.
Otherwise, we can get two "error in...

github.com/sudo-project/sudo - 49e7e4ecd534a130bb015385c2d615f3d9494e15 authored over 4 years ago by Todd C. Miller <[email protected]>

Read ServerHello message synchronously before the command is executed.

Otherwise, the command could be run before the TLS handshake completes.

github.com/sudo-project/sudo - b9bea255926730828c6233fd9855aadfcb48a5b6 authored over 4 years ago by Todd C. Miller <[email protected]>

Refactor sudo_sendlog in order to be able to send one I/O log multiple times in parallel (for testing purposes)

github.com/sudo-project/sudo - 1e5562df9391cc3599ff6498d87b5ad016b908ba authored over 4 years ago by Laszlo Orban <[email protected]>

Document audit plugin in the sudo_plugin manual.

github.com/sudo-project/sudo - 790f8bb629866a6da74f05e7fa3c0cdd3c978cdf authored over 4 years ago by Todd C. Miller <[email protected]>

Change audit close arguments to a type and value.

That way we can distinguish between different error types.

github.com/sudo-project/sudo - 1b7dc82fee8766218770bd1dc1f14ff55fe3077b authored over 4 years ago by Todd C. Miller <[email protected]>

Example audit plugin that writes JSON output to a log file.

github.com/sudo-project/sudo - bf85ea2bf717c0d7486e496b4311ef704e75436b authored over 4 years ago by Todd C. Miller <[email protected]>

Adapt python plugin to new plugin API changes

github.com/sudo-project/sudo - a88a05c1eb88c2a958ef9f2e26a43c33cc71ca92 authored over 4 years ago by Todd C. Miller <[email protected]>

Pass back a failure or error string to the front end.

The audit_failure() function now stores the failure string.
This will allow an audit plugin to lo...

github.com/sudo-project/sudo - 45e589d443aed905a964c73548fdd793d314ac12 authored over 4 years ago by Todd C. Miller <[email protected]>

Define a new plugin type that receives accept and reject messages.

This can be used to implement logging-only plugins.
The plugin functions now take an errstr argum...

github.com/sudo-project/sudo - 22105009d86a5c252cc3d4d187fb54ac18a6ec0f authored over 4 years ago by Todd C. Miller <[email protected]>

Add a simple API for writing JSON records.

To be used by the upcoming JSON audit module.

github.com/sudo-project/sudo - 88f9f2ba9a55b3654c829bee69c6dcd7b5feef4d authored over 4 years ago by Todd C. Miller <[email protected]>

Add tests for arc4random_buf() and an implementation for those without.

github.com/sudo-project/sudo - dc45c4d4ea09452003e772d03e8d7a26975a05e9 authored over 4 years ago by Todd C. Miller <[email protected]>

Add code to generate universally unique identifiers.

We create type 4, variant 1 uuids (random).

github.com/sudo-project/sudo - ed294b828360aa47d400a4c77c132cddb71c334f authored over 4 years ago by Todd C. Miller <[email protected]>

Sudo 1.8.31 changes.

github.com/sudo-project/sudo - df2e3f7c7f6bfa78b6ca0cf8322dcad9b5b96e40 authored over 4 years ago by Todd C. Miller <[email protected]>

Fix a buffer overflow when pwfeedback is enabled and input is a not a tty.

In getln() if the user enters ^U (erase line) and the write(2) fails,
the remaining buffer size i...

github.com/sudo-project/sudo - fa8ffeb17523494f0e8bb49a25e53635f4509078 authored over 4 years ago by Todd C. Miller <[email protected]>

Fix warning about unresolved host name with "sudo -l -h hostname".

The resolve_host() function returns 0 on success, not bool.

github.com/sudo-project/sudo - 604945f93e6e59941aa02d241e528185c60982a3 authored over 4 years ago by Todd C. Miller <[email protected]>

Check for presence of fseeko() regardless of utmp type.

github.com/sudo-project/sudo - 0fcb6471609969b5911db0b2917ced16c913676f authored over 4 years ago by Todd C. Miller <[email protected]>