github.com/sudo-project/sudo commits | Ecosyste.ms: OpenCollective

Add forward declaration of struct timeval for deprecated APIs.

c321b3e6099e623210ade75b0280c0b78e6cd0f1 authored almost 5 years ago by Todd C. Miller <[email protected]>

Fix compilation on systems with SIGRTMIN/SIGRTMAX but not _SC_RTSIG_MAX.

4347ed90d4d35418e3344919015a6a90cb8080e5 authored almost 5 years ago by Todd C. Miller <[email protected]>

Older systems may not support WCONTINUED.

291221c698748fed68498a4428046a61f859b19e authored almost 5 years ago by Todd C. Miller <[email protected]>

Support systems that have nl_langinfo(3) but not the CODESET define.

Fixes compilation on old NetBSD versions.

58d50f44cd482b1decef80bbeb6bb08f847c3673 authored almost 5 years ago by Todd C. Miller <[email protected]>

Fix a typo; HAVE_KINFO_PROC2_NETBSD not HAVE_KINFO_PROC2_NETBSD2

8b571c59a5e9a704d02b693c277ea3d02f32caae authored almost 5 years ago by Todd C. Miller <[email protected]>

Move init.d and sudo.pp to the etc dir.

c6f8f4b545838df172cbe707ae2de6fdec6b9eab authored almost 5 years ago by Todd C. Miller <[email protected]>

Add cfmakeraw() for systems without it.

4690d3ecf69d50910d2480b4df38249a88ed2f1a authored almost 5 years ago by Todd C. Miller <[email protected]>

Remove indent.pro from MANIFEST

1b10ac03eaca99e837050430eae465f4f2183eb4 authored almost 5 years ago by Todd C. Miller <[email protected]>

Add uncrustify.files to ignore file.

d089bd94e6376292aa4c5bf57f0f8add182961fd authored almost 5 years ago by Todd C. Miller <[email protected]>

Substitute @prefix@ in for the example paths.

We can't use @exampledir@ here since it contains Makefile variables.

79e52c7764e7191b3f45d64db755a414588e85cc authored almost 5 years ago by Todd C. Miller <[email protected]>

debug_decl and debug_decl_vars now require a semicolon at the end.

486ee2b71fe74ebec90131edb3cd161b4907a837 authored almost 5 years ago by Todd C. Miller <[email protected]>

Add sudo_plugin_python manual page.

Based on markdown docs from Robert Manner.

5dcc28180e3b6a5cd7a601c6792e189909fe742d authored almost 5 years ago by Todd C. Miller <[email protected]>

Output the name of the limit when warning about setrlimit or getrlimit.

From Kimmo Suominen.

4392b5726e6310bf1e6199d3036165e300cdaef1 authored almost 5 years ago by Todd C. Miller <[email protected]>

regen

96a03a0891e026a540ba2a2b2c26ca2b77233198 authored almost 5 years ago by Todd C. Miller <[email protected]>

Add python module files to MANIFEST

42732821fde1ac85da345633274fb1b52a1fce47 authored almost 5 years ago by Todd C. Miller <[email protected]>

plugins/python: a plugin which can load policy/io plugin written in python

babdcbd03166317e785c804eff9d161bc5f611fc authored almost 5 years ago by Robert Manner <[email protected]>

plugins/python: example plugin demonstrating conversation and debug API

4ad362dd8fbd1c0809444dc41f69bd4b5eddf17c authored almost 5 years ago by Robert Manner <[email protected]>

plugins/python: add example io python plugin

ee856cc4ba6b3a8cc0e4d5599d4020e1724ac4a6 authored almost 5 years ago by Robert Manner <[email protected]>

plugins/python: add example python policy plugin

d8432fca340e35454d3f46b2c784f1816f396f02 authored almost 5 years ago by Robert Manner <[email protected]>

plugins/python: add example python group plugin

523bcbedb6cef347ae54031b7ef7d2e180cdb1e4 authored almost 5 years ago by Robert Manner <[email protected]>

Makefile.in: fix calling log2cl when doing out of source build

If doing build out of source and not calling configure by absolute path,
$(top_srcdir) variable ...

80fa75f0e80a0569bcbee395ed24649fe55bab04 authored almost 5 years ago by Robert Manner <[email protected]>

src/load_plugins, plugins/sudoers: added developer_mode sudo.conf option

It can be used to disable the enforcement that a plugin (shared object or
an imported python mod...

c0d53d75eb9c738e9e241b0789a4d6d9345aee9a authored almost 5 years ago by Robert Manner <[email protected]>

lib/util/sudo_debug.c: add a function for querying if debugging is needed

for a level.
Rationale: this way we can avoid computing details for the log which will
not happe...

6710048c8dccadeb3f32fd0a047a964b70a2e0fe authored almost 5 years ago by Robert Manner <[email protected]>

plugins/python: add ImportBlocker which forbids loading unsafe python modules

If non root can alter any imported python modules, he is able to run
anything he would like to a...

a6bac23babe9f864d286e7f3a4c119b6b301e79d authored almost 5 years ago by Robert Manner <[email protected]>

plugins/python: add sudo debug helpers

311cf122e248eaf71251da0d552c55305f5c9d75 authored almost 5 years ago by Robert Manner <[email protected]>

plugins/python: add a sudo python module

9b49d44e84dd09e9ae94fed8aad826c95d30b843 authored almost 5 years ago by Robert Manner <[email protected]>

plugins/python: make group plugin able to debug

It does not get the debug settings, so it looks them up through
sudo_conf.

d888d4459487b0a4e8cc9c987d5f794a2cd04801 authored almost 5 years ago by Robert Manner <[email protected]>

Makefile.in, configure.ac: add python plugin build

91e6bf8ccd4847cf31c4b6d47a1f1c4dfcf54cc4 authored almost 5 years ago by Robert Manner <[email protected]>

Update SUDO_CONV_REPL_MAX in docs.

a441580540e7fe6ebcd4b2d09ccf879612f6697d authored almost 5 years ago by Todd C. Miller <[email protected]>

Remove uncrustify.files in clean target

9f4409c256b84e5d0577b72a43d46ac4343db65e authored almost 5 years ago by Todd C. Miller <[email protected]>

Add uncrustify config file for new sudo code style.

60328e5c7e5e7853d805e1cf286fed2608dd6c17 authored almost 5 years ago by Todd C. Miller <[email protected]>

Bump SUDO_CONV_REPL_MAX from 255 to 1023

3a0445af9c6a6588db2d1e3af9a7f2c4aa39876e authored almost 5 years ago by Todd C. Miller <[email protected]>

Minor style cleanups.

Remove extraneous break after return statement.
Convert two old K&R function declarations.

3ec23ad5e15fb9d2f2db4b992b6bf0a577f11bc1 authored almost 5 years ago by Todd C. Miller <[email protected]>

Save/restore the raw form of the file context in case mctrans is not available.

718e6997fcaae6ea065ce74d08dd4aae5917df5e authored almost 5 years ago by Todd C. Miller <[email protected]>

Add runas_check_shell flag to require a runas user to have a valid shell.

Not enabled by default.

b14d633ec61ee446fc27e186f97abd7efb6564ae authored almost 5 years ago by Todd C. Miller <[email protected]>

Add a new flag "allow_unknown_runas_id" to control matching of unknown IDs.

Previous, sudo would always allow unknown user or group IDs if the
sudoers entry permitted it. T...

df8f06609c2c7841a30f40fbb706c071240177a8 authored almost 5 years ago by Todd C. Miller <[email protected]>

Use cfmakeraw() in sudo_term_raw() instead of doing it manually.

d7b4f88658ad8afea426323ad7c0f28c680bec4b authored almost 5 years ago by Todd C. Miller <[email protected]>

Fix event loop called via I/O log close function.

We need to set events that were pending in the old base in the new one.
Fixes sending the final I...

9d737441f48405fb3003a149f706e5edee40a76f authored almost 5 years ago by Todd C. Miller <[email protected]>

Replace timeleft with pending in sudo plugin event API.

d0b80b404ca9f6a8ba5f37991e9ff7449ffcd08b authored almost 5 years ago by Todd C. Miller <[email protected]>

Use sudo_ev_pending() instead of the deprecated sudo_ev_timeleft().

bf3b93f080f679f402785dc5aadade5aa1e4a07a authored almost 5 years ago by Todd C. Miller <[email protected]>

Add sudo_ev_pending(), used to check whether an event is pending.

22ffffe12bedbd232ea744d29b31947cffe8f9c6 authored almost 5 years ago by Todd C. Miller <[email protected]>

Add TLS libs when linking check_iolog_plugin

931407284897afee64d8811add7a5998cf04dd89 authored almost 5 years ago by Todd C. Miller <[email protected]>

Remove extraneous newlines in some sudo_warnx() calls.

5711c1b49716e20852ae3c04cbce735140fca9fb authored almost 5 years ago by Todd C. Miller <[email protected]>

Document log_server_cabundle, log_server_peer_cert and log_server_peer_key

d98022177e424c7ba6873cb48e7127d9942821b9 authored almost 5 years ago by Todd C. Miller <[email protected]>

Merge pull request #16 from laczau/master

Proper handling of certificate chain file

03d02c4ac516232df226ee59a3f7f60d72b60119 authored almost 5 years ago by Todd C. Miller <[email protected]>

cert files can contain the full chain of trust, so load all certs in every case for verification

5e36cc655c474063133d5865a99ec98eee407424 authored almost 5 years ago by Laszlo Orban <[email protected]>

Sync init_session() prototype with sudo_plugin.h and fix a typo.

a1e61f5ac0108195de7a80f5ed3a0a02a80c5886 authored almost 5 years ago by Todd C. Miller <[email protected]>

Only update the time stamp entry after the approval function has succeeded.

Bug #910

4b6de608c25a6ffbdb507be958e12f814b43077c authored almost 5 years ago by Todd C. Miller <[email protected]>

Merge pull request #14 from sudo-project/tls-config-default-values

Audit Server - add default values for cert paths

049bbbfae1e7b4c5a8a71abe8e6d78ce327f26b6 authored almost 5 years ago by Todd C. Miller <[email protected]>

add default values for cert paths

1dceb8bbb859f6eb039c8536dd6b526530deb8ec authored almost 5 years ago by Laszlo Orban <[email protected]>

Add reference counting to debug register/deregister.

Fixes a potential problem when an instance is re-registered.

3ab29e29bbcf7d36c8c7fe34fb4e39730f374d28 authored almost 5 years ago by Todd C. Miller <[email protected]>

Only deregister the sudoers debug instance on last close.

Reference count calls to sudoers_debug_register and only deregister
sudoers_debug_instance when r...

7c782edf53d804f4defa09e05964fc1c17292cbe authored almost 5 years ago by Todd C. Miller <[email protected]>

process tls config options

a409d8f1fcd406350b69b8252fa173abebdbda39 authored almost 5 years ago by Laszlo Orban <[email protected]>

implement tls layer in iolog plugin

24cda2592afbcb3a85bd192d3c4fd9711c3b9fb8 authored almost 5 years ago by Laszlo Orban <[email protected]>

add audit server tls related configuration options to sudoers

3ce51d40ce40db634edca7b1a188405e52fecbda authored almost 5 years ago by Laszlo Orban <[email protected]>

optionally link sudoers with openssl libs

a9c2cf927274013b6fd92322710efc16fa27b3c5 authored almost 5 years ago by Laszlo Orban <[email protected]>

Merge pull request #11 from sudo-project/audit-server-tls-async

Sudo audit Server - TLS protocol update

f5e0e2a4bbca5626d63480afead70151302ab2ea authored almost 5 years ago by Laszlo Orban <[email protected]>

disable timeout for the reader after ServerHello message

06a0f897047facc326fae88a5231b3646d7aa76b authored almost 5 years ago by Laszlo Orban <[email protected]>

use event timeout instead of socket timeout

21e7fdfd559fd929939cdadc97c1602d14ce9da9 authored almost 5 years ago by Laszlo Orban <[email protected]>

adapt sudo sendlog (async communication, unencrypted ServerHello message)

f4bbce6708f6f623e3bc1fb5b5287965b094706a authored almost 5 years ago by Laszlo Orban <[email protected]>

Exit if the first call to logsrvd_conf_read() fails.

It is not fatal if subsequent calls fail (due to SIGHUP) since we
keep a copy of the old config b...

1747e50090f8af96293de4a36f2e1cc96fee1375 authored almost 5 years ago by Todd C. Miller <[email protected]>

Add some missing files to "make clean" and "make distclean"

333ea878e20b5ca287d3c1d0228044e6811ed78d authored almost 5 years ago by Todd C. Miller <[email protected]>

Update .hgignore and convert to .gitignore

42adbca7adcff5fac6786002122e7b399bd3fbe2 authored almost 5 years ago by Todd C. Miller <[email protected]>

ServerHello message is now unencrypted, TLS communication has been refactored to full async

f67d0d13cf5881cf4a71304fa199257e8333c585 authored almost 5 years ago by Laszlo Orban <[email protected]>

extend ServerHello message with two fields (tls, tls_checkpeer)

33f6a16764ce95820d749208080b6184408e6ca7 authored almost 5 years ago by Laszlo Orban <[email protected]>

For plugin API 1.15 and up, always call the plugin close function.

Previously, it was only called when a command was run (including
sudoedit). Now, plugin operatio...

f976a5d8662c332f336a1ee2f987c6bb5e53713d authored almost 5 years ago by Todd C. Miller <[email protected]>

Avoid NULL deref on an error path if calloc() fails.

Coverity CID 205873

2143746370e4366aa112173a3d64db752d4741e3 authored almost 5 years ago by Todd C. Miller <[email protected]>

Fix potential fd leak when converting trailing newline to cr + nl.

Coverity CID 205872

e0a4b2d68aacd4515de425ca76de35d2818fca59 authored almost 5 years ago by Todd C. Miller <[email protected]>

Document the process of creating self-signed certificates for sudo_logsrvd.

Based on a document from Laszlo Orban.

b31b8305189601785353b8cbaf8b50db56769d59 authored almost 5 years ago by Todd C. Miller <[email protected]>

Sync with argument handling in group_plugin.c

c7cac7c0e6b0d2892764f7afcbc91aa2ff538869 authored almost 5 years ago by Todd C. Miller <[email protected]>

If a group plugin has optional arguments, NULL terminate the vector.

Otherwise, the plugin cannot determine the end of arguments.
The behavior now matches the plugin ...

a3266edc27443104bb9193b6f074e1a2002e173e authored almost 5 years ago by Todd C. Miller <[email protected]>

If there is no session or terminal group ID, pass the plugin a value of 0.

This behavior already matches what is documented in the sudo_plugin
manual for "sid" but the "tcp...

368e12b0f9375320e7dc0e26c08afc62034f481e authored almost 5 years ago by Todd C. Miller <[email protected]>

Don't touch the local iolog sequence file if we are logging remotely

d10220162d0ca81e1322ce21162ca64db7168c06 authored almost 5 years ago by Todd C. Miller <[email protected]>

Plug a memory leak found by leak sanitizer

6c2821fe423157b1d98fe8b5a2ba5bec189ecf47 authored almost 5 years ago by Todd C. Miller <[email protected]>

Make a shallow copy of user_env in I/O plugin in case it is reallocated.

The policy plugin's session init function may reallocate the user
environment pointer. Fixes a u...

3241b82a7e16a50b1203ae3aaf227fc00e0612ac authored almost 5 years ago by Todd C. Miller <[email protected]>

Rename "log_server" in sudoers to "log_servers" to match I/O plugin.

f913249dd09589cea89b00a4cf69fe4a8d7108a1 authored almost 5 years ago by Todd C. Miller <[email protected]>

Check closure->ssl for non-NULL instead of logsrvd_conf_get_tls_opt().

It's a little more obvious this way and ssl is only non-NULL when the
tls option is enabled anyway.

810669c4f049baff08332022237661bf856d5302 authored almost 5 years ago by Todd C. Miller <[email protected]>

Init iolog_dir_fd and sock in connection_closure before adding to list.

Otherwise we could close the wrong fds in the error path.

5be951bd79f9216e1cb298d68dcd3fe0e1b55902 authored almost 5 years ago by Todd C. Miller <[email protected]>

Add Laszlo Orban

82fea739af1890c052e1a7c6dd8a189403e89ad8 authored almost 5 years ago by Todd C. Miller <[email protected]>

regen

4bb2b2f605854cb41969a097acab70c8b8264060 authored almost 5 years ago by Todd C. Miller <[email protected]>

Change TLS example file locations to be under /etc/ssl/sudo.

366a63ce58126cdbb0f0aa6795028077241098d6 authored almost 5 years ago by Todd C. Miller <[email protected]>

Document sudo_logsrvd TLS configuration.

49c09ee2d8ebad639751d2dbd8b18e998f0de008 authored almost 5 years ago by Todd C. Miller <[email protected]>

Include time.h for struct timespec.

dae0da2fe31621903068c73e8305b00cb8c72d53 authored almost 5 years ago by Todd C. Miller <[email protected]>

Add sudo_ev_set_v1 to the exports file.

20bc94635d5e1bad15faeffe8195cd17058810db authored almost 5 years ago by Todd C. Miller <[email protected]>

Document the log_server and log_server_timeout options

d8ccf11c5805ad72f9d60352d007c1fd094e32d3 authored almost 5 years ago by Todd C. Miller <[email protected]>

Add support for logging to the log server

82237194dd7372b3d74336b4de4ba430be35cfdb authored almost 5 years ago by Todd C. Miller <[email protected]>

Add a plugin interface to sudo main event loop.

5793023ffd3fecf3f817e275724af7c4b3aa3d3f authored almost 5 years ago by Todd C. Miller <[email protected]>

Move protobuf-c.c, log_server.proto, log_server.pb-c.[ch] to lib/logsrv

58cede6feeabcc53fe128c3665cfd7ad0108ff11 authored almost 5 years ago by Todd C. Miller <[email protected]>

When freeing an event base, reset ev->base to NULL for associated events.

f6acc134f42155c9124a49684ee618bf3a03d71f authored almost 5 years ago by Todd C. Miller <[email protected]>

Move cb_timeout() out from under the HAVE_OPENSSL ifdef.

3689839a0e8e12e15ecf56c445ba71a3b2b190ec authored almost 5 years ago by Todd C. Miller <[email protected]>

LibreSSL and older OpenSSL don't support SSL_CTX_set_ciphersuites().

Add a configure test and skip TLS 1.3 setup if it is missing.
We still accept the tls_ciphers13 c...

690f145d3f173538eff5447714efc685ee6a1949 authored almost 5 years ago by Todd C. Miller <[email protected]>

Minor style nits that I missed during review.

68480b09599041572964cf6a7698ec599422b38f authored almost 5 years ago by Todd C. Miller <[email protected]>

Avoid calling SSL_CTX_free() on an uninitialized pointer in an error path.

c9da8d408402c32c380cd7f77beb0691cec7876a authored almost 5 years ago by Todd C. Miller <[email protected]>

Merge pull request #9 from sudo-project/audit-server-tls-support

Audit server tls support

f08c98a6aa19e7a60aa3696b5f64003bf24da2e9 authored almost 5 years ago by Todd C. Miller <[email protected]>

make audit server openssl dependency optional; tls layer is compiled only if sudo is built with --enable-openssl feature switch

e201f104d4efe17bcd449cbadbf57da54638597f authored almost 5 years ago by Laszlo Orban <[email protected]>

set timeout value for the socket

b9641816d613311a9ee6d48455bbd05574829dec authored almost 5 years ago by Laszlo Orban <[email protected]>

update sudo_sendlog to support openssl tls

8c8023d212fd2e2ec7991853833a0336ac591844 authored almost 5 years ago by Laszlo Orban <[email protected]>

process tls config params in the audit server and establish TLS connection accordingly

361557648162a071cafde09a6dd8e14f83d8aab1 authored almost 5 years ago by Laszlo Orban <[email protected]>

fix copy-paste mistake

037fb9298e619f902c4fae2d46a371963bad0e72 authored almost 5 years ago by Laszlo Orban <[email protected]>

fixed segfault when connection_closure_free() tries to remove a non-existent connection object from the list

9df5e6c11dd48190e7ccd52ee4081db59a04b122 authored almost 5 years ago by Laszlo Orban <[email protected]>