Repository navigation
default_binding_matches: match Defaults>runas by runas user only - #587
Merged
Merged
Conversation
default_binding_matches() checked a Defaults>runas_list entry with runaslist_matches(), which also looks at the group given with -g. When the requested group is not one of the runas user's groups it returns UNSPEC, so "sudo -u root -g users cmd" skipped every Defaults>root setting (rootpw, timestamp_timeout, log_output, ...) even though the command still runs as root. A Defaults> entry is documented to apply to commands run as a specific user, so only match the runas user. Adds a testsudoers regression test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
default_binding_matches() decides whether a
Defaults>runas_listentry applies by callingrunaslist_matches()with no group list. That function also checks the group given with-g, and without a group list it only accepts the runas user's primary or supplementary groups, returning UNSPEC otherwise. With a rule like%admin ALL = (ALL:ALL) ALL,sudo -u root -g users cmdtherefore skips everyDefaults>rootsetting even though the command still runs as root: withrootpwthe user is asked for their own password instead of root's, andtimestamp_timeout=0orlog_outputare ignored. In testsudoers,Defaults:admin !authenticateplusDefaults>root authenticatereports "Password required" for-u rootbut not for-u root -g users.The manual and grammar define
Defaults>in terms of the runas user (Runas_User_List), so match the binding withrunas_userlist_matches(), the user half ofrunaslist_matches(), which is no longer static. Rule matching still goes throughrunaslist_matches()and is unchanged. The new testsudoers test35 covers both invocations, andmake checkpasses on Linux (--enable-warnings --enable-werror --enable-sanitizer) and macOS.