diff options
Diffstat (limited to 'plugins/sudoers/match.c')
| -rw-r--r-- | plugins/sudoers/match.c | 1281 |
1 files changed, 1281 insertions, 0 deletions
diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c new file mode 100644 index 0000000..7c8e9d8 --- /dev/null +++ b/plugins/sudoers/match.c @@ -0,0 +1,1281 @@ +/* + * Copyright (c) 1996, 1998-2005, 2007-2018 + * Todd C. Miller <Todd.Miller@sudo.ws> + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + * + * Sponsored in part by the Defense Advanced Research Projects + * Agency (DARPA) and Air Force Research Laboratory, Air Force + * Materiel Command, USAF, under agreement number F39502-99-1-0512. + */ + +/* + * This is an open source non-commercial project. Dear PVS-Studio, please check it. + * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com + */ + +#include <config.h> + +#include <sys/types.h> +#include <sys/stat.h> +#ifdef HAVE_SYS_SYSTEMINFO_H +# include <sys/systeminfo.h> +#endif +#include <stdio.h> +#include <stdlib.h> +#ifdef HAVE_STRING_H +# include <string.h> +#endif /* HAVE_STRING_H */ +#ifdef HAVE_STRINGS_H +# include <strings.h> +#endif /* HAVE_STRINGS_H */ +#if defined(HAVE_STDINT_H) +# include <stdint.h> +#elif defined(HAVE_INTTYPES_H) +# include <inttypes.h> +#endif +#include <unistd.h> +#ifndef SUDOERS_NAME_MATCH +# ifdef HAVE_GLOB +# include <glob.h> +# else +# include "compat/glob.h" +# endif /* HAVE_GLOB */ +#endif /* SUDOERS_NAME_MATCH */ +#ifdef HAVE_NETGROUP_H +# include <netgroup.h> +#else +# include <netdb.h> +#endif /* HAVE_NETGROUP_H */ +#include <dirent.h> +#include <fcntl.h> +#include <pwd.h> +#include <grp.h> +#include <errno.h> + +#include "sudoers.h" +#include <gram.h> + +#ifdef HAVE_FNMATCH +# include <fnmatch.h> +#else +# include "compat/fnmatch.h" +#endif /* HAVE_FNMATCH */ + +#if !defined(O_EXEC) && defined(O_PATH) +# define O_EXEC O_PATH +#endif + +static struct member_list empty = TAILQ_HEAD_INITIALIZER(empty); + +static bool command_matches_dir(const char *sudoers_dir, size_t dlen, const struct command_digest *digest); +#ifndef SUDOERS_NAME_MATCH +static bool command_matches_glob(const char *sudoers_cmnd, const char *sudoers_args, const struct command_digest *digest); +#endif +static bool command_matches_fnmatch(const char *sudoers_cmnd, const char *sudoers_args, const struct command_digest *digest); +static bool command_matches_normal(const char *sudoers_cmnd, const char *sudoers_args, const struct command_digest *digest); +static bool digest_matches(int fd, const char *file, const struct command_digest *digest); + +/* + * Returns true if string 's' contains meta characters. + */ +#define has_meta(s) (strpbrk(s, "\\?*[]") != NULL) + +/* + * Check whether user described by pw matches member. + * Returns ALLOW, DENY or UNSPEC. + */ +int +user_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, + const struct member *m) +{ + struct alias *a; + int matched = UNSPEC; + debug_decl(user_matches, SUDOERS_DEBUG_MATCH) + + switch (m->type) { + case ALL: + matched = !m->negated; + break; + case NETGROUP: + if (netgr_matches(m->name, + def_netgroup_tuple ? user_runhost : NULL, + def_netgroup_tuple ? user_srunhost : NULL, pw->pw_name)) + matched = !m->negated; + break; + case USERGROUP: + if (usergr_matches(m->name, pw->pw_name, pw)) + matched = !m->negated; + break; + case ALIAS: + if ((a = alias_get(parse_tree, m->name, USERALIAS)) != NULL) { + /* XXX */ + int rc = userlist_matches(parse_tree, pw, &a->members); + if (rc != UNSPEC) + matched = m->negated ? !rc : rc; + alias_put(a); + break; + } + /* FALLTHROUGH */ + case WORD: + if (userpw_matches(m->name, pw->pw_name, pw)) + matched = !m->negated; + break; + } + debug_return_int(matched); +} + +/* + * Check for user described by pw in a list of members. + * Returns ALLOW, DENY or UNSPEC. + */ +int +userlist_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, + const struct member_list *list) +{ + struct member *m; + int matched = UNSPEC; + debug_decl(userlist_matches, SUDOERS_DEBUG_MATCH) + + TAILQ_FOREACH_REVERSE(m, list, member_list, entries) { + if ((matched = user_matches(parse_tree, pw, m)) != UNSPEC) + break; + } + debug_return_int(matched); +} + +struct gid_list * +runas_getgroups(void) +{ + const struct passwd *pw; + debug_decl(runas_getgroups, SUDOERS_DEBUG_MATCH) + + if (def_preserve_groups) { + sudo_gidlist_addref(user_gid_list); + debug_return_ptr(user_gid_list); + } + + /* Only use results from a group db query, not the front end. */ + pw = runas_pw ? runas_pw : sudo_user.pw; + debug_return_ptr(sudo_get_gidlist(pw, ENTRY_TYPE_QUERIED)); +} + +/* + * Check for user described by pw in a list of members. + * If both lists are empty compare against def_runas_default. + * Returns ALLOW, DENY or UNSPEC. + */ +int +runaslist_matches(struct sudoers_parse_tree *parse_tree, + const struct member_list *user_list, const struct member_list *group_list, + struct member **matching_user, struct member **matching_group) +{ + struct member *m; + struct alias *a; + int rc; + int user_matched = UNSPEC; + int group_matched = UNSPEC; + debug_decl(runaslist_matches, SUDOERS_DEBUG_MATCH) + + if (ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) || !ISSET(sudo_user.flags, RUNAS_GROUP_SPECIFIED)) { + /* If no runas user or runas group listed in sudoers, use default. */ + if (user_list == NULL && group_list == NULL) { + debug_return_int(userpw_matches(def_runas_default, + runas_pw->pw_name, runas_pw)); + } + + if (user_list != NULL) { + TAILQ_FOREACH_REVERSE(m, user_list, member_list, entries) { + switch (m->type) { + case ALL: + user_matched = !m->negated; + break; + case NETGROUP: + if (netgr_matches(m->name, + def_netgroup_tuple ? user_runhost : NULL, + def_netgroup_tuple ? user_srunhost : NULL, + runas_pw->pw_name)) + user_matched = !m->negated; + break; + case USERGROUP: + if (usergr_matches(m->name, runas_pw->pw_name, runas_pw)) + user_matched = !m->negated; + break; + case ALIAS: + a = alias_get(parse_tree, m->name, RUNASALIAS); + if (a != NULL) { + rc = runaslist_matches(parse_tree, &a->members, + &empty, matching_user, NULL); + if (rc != UNSPEC) + user_matched = m->negated ? !rc : rc; + alias_put(a); + break; + } + /* FALLTHROUGH */ + case WORD: + if (userpw_matches(m->name, runas_pw->pw_name, runas_pw)) + user_matched = !m->negated; + break; + case MYSELF: + if (!ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) || + strcmp(user_name, runas_pw->pw_name) == 0) + user_matched = !m->negated; + break; + } + if (user_matched != UNSPEC) { + if (matching_user != NULL && m->type != ALIAS) + *matching_user = m; + break; + } + } + } + } + + /* + * Skip checking runas group if none was specified. + */ + if (ISSET(sudo_user.flags, RUNAS_GROUP_SPECIFIED)) { + if (user_matched == UNSPEC) { + if (strcmp(user_name, runas_pw->pw_name) == 0) + user_matched = ALLOW; /* only changing group */ + } + if (group_list != NULL) { + TAILQ_FOREACH_REVERSE(m, group_list, member_list, entries) { + switch (m->type) { + case ALL: + group_matched = !m->negated; + break; + case ALIAS: + a = alias_get(parse_tree, m->name, RUNASALIAS); + if (a != NULL) { + rc = runaslist_matches(parse_tree, &empty, + &a->members, NULL, matching_group); + if (rc != UNSPEC) + group_matched = m->negated ? !rc : rc; + alias_put(a); + break; + } + /* FALLTHROUGH */ + case WORD: + if (group_matches(m->name, runas_gr)) + group_matched = !m->negated; + break; + } + if (group_matched != UNSPEC) { + if (matching_group != NULL && m->type != ALIAS) + *matching_group = m; + break; + } + } + } + if (group_matched == UNSPEC) { + struct gid_list *runas_groups; + /* + * The runas group was not explicitly allowed by sudoers. + * Check whether it is one of the target user's groups. + */ + if (runas_pw->pw_gid == runas_gr->gr_gid) { + group_matched = ALLOW; /* runas group matches passwd db */ + } else if ((runas_groups = runas_getgroups()) != NULL) { + int i; + + for (i = 0; i < runas_groups->ngids; i++) { + if (runas_groups->gids[i] == runas_gr->gr_gid) { + group_matched = ALLOW; /* matched aux group vector */ + break; + } + } + sudo_gidlist_delref(runas_groups); + } + } + } + + if (user_matched == DENY || group_matched == DENY) + debug_return_int(DENY); + if (user_matched == group_matched || runas_gr == NULL) + debug_return_int(user_matched); + debug_return_int(UNSPEC); +} + +/* + * Check for lhost and shost in a list of members. + * Returns ALLOW, DENY or UNSPEC. + */ +static int +hostlist_matches_int(struct sudoers_parse_tree *parse_tree, + const struct passwd *pw, const char *lhost, const char *shost, + const struct member_list *list) +{ + struct member *m; + int matched = UNSPEC; + debug_decl(hostlist_matches, SUDOERS_DEBUG_MATCH) + + TAILQ_FOREACH_REVERSE(m, list, member_list, entries) { + matched = host_matches(parse_tree, pw, lhost, shost, m); + if (matched != UNSPEC) + break; + } + debug_return_int(matched); +} + +/* + * Check for user_runhost and user_srunhost in a list of members. + * Returns ALLOW, DENY or UNSPEC. + */ +int +hostlist_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, + const struct member_list *list) +{ + return hostlist_matches_int(parse_tree, pw, user_runhost, user_srunhost, list); +} + +/* + * Check whether host or shost matches member. + * Returns ALLOW, DENY or UNSPEC. + */ +int +host_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, + const char *lhost, const char *shost, const struct member *m) +{ + struct alias *a; + int matched = UNSPEC; + debug_decl(host_matches, SUDOERS_DEBUG_MATCH) + + switch (m->type) { + case ALL: + matched = !m->negated; + break; + case NETGROUP: + if (netgr_matches(m->name, lhost, shost, + def_netgroup_tuple ? pw->pw_name : NULL)) + matched = !m->negated; + break; + case NTWKADDR: + if (addr_matches(m->name)) + matched = !m->negated; + break; + case ALIAS: + a = alias_get(parse_tree, m->name, HOSTALIAS); + if (a != NULL) { + /* XXX */ + int rc = hostlist_matches_int(parse_tree, pw, lhost, shost, + &a->members); + if (rc != UNSPEC) + matched = m->negated ? !rc : rc; + alias_put(a); + break; + } + /* FALLTHROUGH */ + case WORD: + if (hostname_matches(shost, lhost, m->name)) + matched = !m->negated; + break; + } + debug_return_int(matched); +} + +/* + * Check for cmnd and args in a list of members. + * Returns ALLOW, DENY or UNSPEC. + */ +int +cmndlist_matches(struct sudoers_parse_tree *parse_tree, + const struct member_list *list) +{ + struct member *m; + int matched = UNSPEC; + debug_decl(cmndlist_matches, SUDOERS_DEBUG_MATCH) + + TAILQ_FOREACH_REVERSE(m, list, member_list, entries) { + matched = cmnd_matches(parse_tree, m); + if (matched != UNSPEC) + break; + } + debug_return_int(matched); +} + +/* + * Check cmnd and args. + * Returns ALLOW, DENY or UNSPEC. + */ +int +cmnd_matches(struct sudoers_parse_tree *parse_tree, const struct member *m) +{ + struct alias *a; + struct sudo_command *c; + int rc, matched = UNSPEC; + debug_decl(cmnd_matches, SUDOERS_DEBUG_MATCH) + + switch (m->type) { + case ALL: + matched = !m->negated; + break; + case ALIAS: + a = alias_get(parse_tree, m->name, CMNDALIAS); + if (a != NULL) { + rc = cmndlist_matches(parse_tree, &a->members); + if (rc != UNSPEC) + matched = m->negated ? !rc : rc; + alias_put(a); + } + break; + case COMMAND: + c = (struct sudo_command *)m->name; + if (command_matches(c->cmnd, c->args, c->digest)) + matched = !m->negated; + break; + } + debug_return_int(matched); +} + +static bool +command_args_match(const char *sudoers_cmnd, const char *sudoers_args) +{ + int flags = 0; + debug_decl(command_args_match, SUDOERS_DEBUG_MATCH) + + /* + * If no args specified in sudoers, any user args are allowed. + * If the empty string is specified in sudoers, no user args are allowed. + */ + if (!sudoers_args || (!user_args && !strcmp("\"\"", sudoers_args))) + debug_return_bool(true); + + /* + * If args are specified in sudoers, they must match the user args. + * If running as sudoedit, all args are assumed to be paths. + */ + if (strcmp(sudoers_cmnd, "sudoedit") == 0) + flags = FNM_PATHNAME; + if (fnmatch(sudoers_args, user_args ? user_args : "", flags) == 0) + debug_return_bool(true); + + debug_return_bool(false); +} + +/* + * If path doesn't end in /, return true iff cmnd & path name the same inode; + * otherwise, return true if user_cmnd names one of the inodes in path. + */ +bool +command_matches(const char *sudoers_cmnd, const char *sudoers_args, const struct command_digest *digest) +{ + bool rc = false; + debug_decl(command_matches, SUDOERS_DEBUG_MATCH) + + /* Check for pseudo-commands */ + if (sudoers_cmnd[0] != '/') { + /* + * Return true if both sudoers_cmnd and user_cmnd are "sudoedit" AND + * a) there are no args in sudoers OR + * b) there are no args on command line and none req by sudoers OR + * c) there are args in sudoers and on command line and they match + */ + if (strcmp(sudoers_cmnd, "sudoedit") == 0 && + strcmp(user_cmnd, "sudoedit") == 0 && + command_args_match(sudoers_cmnd, sudoers_args)) { + /* No need to set safe_cmnd since user_cmnd matches sudoers_cmnd */ + rc = true; + } + goto done; + } + + if (has_meta(sudoers_cmnd)) { + /* + * If sudoers_cmnd has meta characters in it, we need to + * use glob(3) and/or fnmatch(3) to do the matching. + */ +#ifdef SUDOERS_NAME_MATCH + rc = command_matches_fnmatch(sudoers_cmnd, sudoers_args, digest); +#else + if (def_fast_glob) + rc = command_matches_fnmatch(sudoers_cmnd, sudoers_args, digest); + else + rc = command_matches_glob(sudoers_cmnd, sudoers_args, digest); +#endif + } else { + rc = command_matches_normal(sudoers_cmnd, sudoers_args, digest); + } +done: + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "user command \"%s%s%s\" matches sudoers command \"%s%s%s\": %s", + user_cmnd, user_args ? " " : "", user_args ? user_args : "", + sudoers_cmnd, sudoers_args ? " " : "", sudoers_args ? sudoers_args : "", + rc ? "true" : "false"); + debug_return_bool(rc); +} + +/* + * Stat file by fd is possible, else by path. + * Returns true on success, else false. + */ +static bool +do_stat(int fd, const char *path, struct stat *sb) +{ + debug_decl(do_stat, SUDOERS_DEBUG_MATCH) + + if (fd != -1) + debug_return_bool(fstat(fd, sb) == 0); + debug_return_bool(stat(path, sb) == 0); +} + +/* + * Check whether the fd refers to a shell script with a "#!" shebang. + */ +static bool +is_script(int fd) +{ + bool ret = false; + char magic[2]; + debug_decl(is_script, SUDOERS_DEBUG_MATCH) + + if (read(fd, magic, 2) == 2) { + if (magic[0] == '#' && magic[1] == '!') + ret = true; + } + if (lseek(fd, (off_t)0, SEEK_SET) == -1) { + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO|SUDO_DEBUG_LINENO, + "unable to rewind script fd"); + } + debug_return_int(ret); +} + +/* + * Open path if fdexec is enabled or if a digest is present. + * Returns false on error, else true. + */ +static bool +open_cmnd(const char *path, const struct command_digest *digest, int *fdp) +{ + int fd = -1; + debug_decl(open_cmnd, SUDOERS_DEBUG_MATCH) + + /* Only open the file for fdexec or for digest matching. */ + if (def_fdexec != always && digest == NULL) + debug_return_bool(true); + + fd = open(path, O_RDONLY|O_NONBLOCK); +# ifdef O_EXEC + if (fd == -1 && errno == EACCES && digest == NULL) { + /* Try again with O_EXEC if no digest is specified. */ + const int saved_errno = errno; + if ((fd = open(path, O_EXEC)) == -1) + errno = saved_errno; + } +# endif + if (fd == -1) + debug_return_bool(false); + + (void)fcntl(fd, F_SETFD, FD_CLOEXEC); + *fdp = fd; + debug_return_bool(true); +} + +static void +set_cmnd_fd(int fd) +{ + debug_decl(set_cmnd_fd, SUDOERS_DEBUG_MATCH) + + if (cmnd_fd != -1) + close(cmnd_fd); + + if (fd != -1) { + if (def_fdexec == never) { + /* Never use fexedcve() */ + close(fd); + fd = -1; + } else if (is_script(fd)) { + char fdpath[PATH_MAX]; + struct stat sb; + int flags; + + /* We can only use fexecve() on a script if /dev/fd/N exists. */ + snprintf(fdpath, sizeof(fdpath), "/dev/fd/%d", fd); + if (stat(fdpath, &sb) != 0) { + /* Missing /dev/fd file, can't use fexecve(). */ + close(fd); + fd = -1; + } else { + /* + * Shell scripts go through namei twice so we can't have the + * close on exec flag set on the fd for fexecve(2). + */ + flags = fcntl(fd, F_GETFD) & ~FD_CLOEXEC; + (void)fcntl(fd, F_SETFD, flags); + } + } + } + + cmnd_fd = fd; + + debug_return; +} + +static bool +command_matches_fnmatch(const char *sudoers_cmnd, const char *sudoers_args, + const struct command_digest *digest) +{ + struct stat sb; /* XXX - unused */ + int fd = -1; + debug_decl(command_matches_fnmatch, SUDOERS_DEBUG_MATCH) + + /* + * Return true if fnmatch(3) succeeds AND + * a) there are no args in sudoers OR + * b) there are no args on command line and none required by sudoers OR + * c) there are args in sudoers and on command line and they match + * else return false. + */ + if (fnmatch(sudoers_cmnd, user_cmnd, FNM_PATHNAME) != 0) + debug_return_bool(false); + if (command_args_match(sudoers_cmnd, sudoers_args)) { + /* Open the file for fdexec or for digest matching. */ + if (!open_cmnd(user_cmnd, digest, &fd)) + goto bad; + if (!do_stat(fd, user_cmnd, &sb)) + goto bad; + /* Check digest of user_cmnd since sudoers_cmnd is a pattern. */ + if (digest != NULL && !digest_matches(fd, user_cmnd, digest)) + goto bad; + set_cmnd_fd(fd); + + /* No need to set safe_cmnd since user_cmnd matches sudoers_cmnd */ + debug_return_bool(true); +bad: + if (fd != -1) { + close(fd); + fd = -1; + } + debug_return_bool(false); + } + debug_return_bool(false); +} + +#ifndef SUDOERS_NAME_MATCH +static bool +command_matches_glob(const char *sudoers_cmnd, const char *sudoers_args, + const struct command_digest *digest) +{ + struct stat sudoers_stat; + bool bad_digest = false; + char **ap, *base, *cp; + int fd = -1; + size_t dlen; + glob_t gl; + debug_decl(command_matches_glob, SUDOERS_DEBUG_MATCH) + + /* + * First check to see if we can avoid the call to glob(3). + * Short circuit if there are no meta chars in the command itself + * and user_base and basename(sudoers_cmnd) don't match. + */ + dlen = strlen(sudoers_cmnd); + if (sudoers_cmnd[dlen - 1] != '/') { + if ((base = strrchr(sudoers_cmnd, '/')) != NULL) { + base++; + if (!has_meta(base) && strcmp(user_base, base) != 0) + debug_return_bool(false); + } + } + /* + * Return true if we find a match in the glob(3) results AND + * a) there are no args in sudoers OR + * b) there are no args on command line and none required by sudoers OR + * c) there are args in sudoers and on command line and they match + * else return false. + */ + if (glob(sudoers_cmnd, GLOB_NOSORT, NULL, &gl) != 0 || gl.gl_pathc == 0) { + globfree(&gl); + debug_return_bool(false); + } + /* If user_cmnd is fully-qualified, check for an exact match. */ + if (user_cmnd[0] == '/') { + for (ap = gl.gl_pathv; (cp = *ap) != NULL; ap++) { + if (fd != -1) { + close(fd); + fd = -1; + } + if (strcmp(cp, user_cmnd) != 0) + continue; + /* Open the file for fdexec or for digest matching. */ + if (!open_cmnd(cp, digest, &fd)) + continue; + if (!do_stat(fd, cp, &sudoers_stat)) + continue; + if (user_stat == NULL || + (user_stat->st_dev == sudoers_stat.st_dev && + user_stat->st_ino == sudoers_stat.st_ino)) { + /* There could be multiple matches, check digest early. */ + if (digest != NULL && !digest_matches(fd, cp, digest)) { + bad_digest = true; + continue; + } + free(safe_cmnd); + if ((safe_cmnd = strdup(cp)) == NULL) { + sudo_warnx(U_("%s: %s"), __func__, + U_("unable to allocate memory")); + cp = NULL; /* fail closed */ + } + } else { + /* Paths match, but st_dev and st_ino are different. */ + cp = NULL; /* fail closed */ + } + goto done; + } + } + /* No exact match, compare basename, st_dev and st_ino. */ + if (!bad_digest) { + for (ap = gl.gl_pathv; (cp = *ap) != NULL; ap++) { + if (fd != -1) { + close(fd); + fd = -1; + } + + /* If it ends in '/' it is a directory spec. */ + dlen = strlen(cp); + if (cp[dlen - 1] == '/') { + if (command_matches_dir(cp, dlen, digest)) + debug_return_bool(true); + continue; + } + + /* Only proceed if user_base and basename(cp) match */ + if ((base = strrchr(cp, '/')) != NULL) + base++; + else + base = cp; + if (strcmp(user_base, base) != 0) + continue; + + /* Open the file for fdexec or for digest matching. */ + if (!open_cmnd(cp, digest, &fd)) + continue; + if (!do_stat(fd, cp, &sudoers_stat)) + continue; + if (user_stat == NULL || + (user_stat->st_dev == sudoers_stat.st_dev && + user_stat->st_ino == sudoers_stat.st_ino)) { + if (digest != NULL && !digest_matches(fd, cp, digest)) + continue; + free(safe_cmnd); + if ((safe_cmnd = strdup(cp)) == NULL) { + sudo_warnx(U_("%s: %s"), __func__, + U_("unable to allocate memory")); + cp = NULL; /* fail closed */ + } + goto done; + } + } + } +done: + globfree(&gl); + if (cp != NULL) { + if (command_args_match(sudoers_cmnd, sudoers_args)) { + /* safe_cmnd was set above. */ + set_cmnd_fd(fd); + debug_return_bool(true); + } + } + if (fd != -1) + close(fd); + debug_return_bool(false); +} +#endif /* SUDOERS_NAME_MATCH */ + +#ifdef SUDOERS_NAME_MATCH +static bool +command_matches_normal(const char *sudoers_cmnd, const char *sudoers_args, const struct command_digest *digest) +{ + size_t dlen; + debug_decl(command_matches_normal, SUDOERS_DEBUG_MATCH) + + dlen = strlen(sudoers_cmnd); + + /* If it ends in '/' it is a directory spec. */ + if (sudoers_cmnd[dlen - 1] == '/') + debug_return_bool(command_matches_dir(sudoers_cmnd, dlen, digest)); + + if (strcmp(user_cmnd, sudoers_cmnd) == 0) { + if (command_args_match(sudoers_cmnd, sudoers_args)) { + /* XXX - check digest */ + free(safe_cmnd); + if ((safe_cmnd = strdup(sudoers_cmnd)) != NULL) + debug_return_bool(true); + sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory")); + } + } + debug_return_bool(false); +} +#else /* !SUDOERS_NAME_MATCH */ + +static bool +digest_matches(int fd, const char *file, const struct command_digest *digest) +{ + unsigned char *file_digest = NULL; + unsigned char *sudoers_digest = NULL; + bool matched = false; + size_t digest_len; + debug_decl(digest_matches, SUDOERS_DEBUG_MATCH) + + file_digest = sudo_filedigest(fd, file, digest->digest_type, &digest_len); + if (lseek(fd, (off_t)0, SEEK_SET) == -1) { + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO|SUDO_DEBUG_LINENO, + "unable to rewind digest fd"); + } + if (file_digest == NULL) { + /* Warning (if any) printed by sudo_filedigest() */ + goto done; + } + + /* Convert the command digest from ascii to binary. */ + if ((sudoers_digest = malloc(digest_len)) == NULL) { + sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory")); + goto done; + } + if (strlen(digest->digest_str) == digest_len * 2) { + /* Convert ascii hex to binary. */ + unsigned int i; + for (i = 0; i < digest_len; i++) { + const int h = hexchar(&digest->digest_str[i + i]); + if (h == -1) + goto bad_format; + sudoers_digest[i] = (unsigned char)h; + } + } else { + /* Convert base64 to binary. */ + size_t len = base64_decode(digest->digest_str, sudoers_digest, digest_len); + if (len != digest_len) { + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, + "incorrect length for digest, expected %zu, got %zu", + digest_len, len); + goto bad_format; + } + } + + if (memcmp(file_digest, sudoers_digest, digest_len) == 0) { + matched = true; + } else { + sudo_debug_printf(SUDO_DEBUG_DIAG|SUDO_DEBUG_LINENO, + "%s digest mismatch for %s, expecting %s", + digest_type_to_name(digest->digest_type), file, digest->digest_str); + } + goto done; + +bad_format: + sudo_warnx(U_("digest for %s (%s) is not in %s form"), file, + digest->digest_str, digest_type_to_name(digest->digest_type)); +done: + free(sudoers_digest); + free(file_digest); + debug_return_bool(matched); +} + +static bool +command_matches_normal(const char *sudoers_cmnd, const char *sudoers_args, const struct command_digest *digest) +{ + struct stat sudoers_stat; + const char *base; + size_t dlen; + int fd = -1; + debug_decl(command_matches_normal, SUDOERS_DEBUG_MATCH) + + /* If it ends in '/' it is a directory spec. */ + dlen = strlen(sudoers_cmnd); + if (sudoers_cmnd[dlen - 1] == '/') + debug_return_bool(command_matches_dir(sudoers_cmnd, dlen, digest)); + + /* Only proceed if user_base and basename(sudoers_cmnd) match */ + if ((base = strrchr(sudoers_cmnd, '/')) == NULL) + base = sudoers_cmnd; + else + base++; + if (strcmp(user_base, base) != 0) + debug_return_bool(false); + + /* Open the file for fdexec or for digest matching. */ + if (!open_cmnd(sudoers_cmnd, digest, &fd)) + goto bad; + if (!do_stat(fd, sudoers_cmnd, &sudoers_stat)) + goto bad; + + /* + * Return true if inode/device matches AND + * a) there are no args in sudoers OR + * b) there are no args on command line and none req by sudoers OR + * c) there are args in sudoers and on command line and they match + * d) there is a digest and it matches + */ + if (user_stat != NULL && + (user_stat->st_dev != sudoers_stat.st_dev || + user_stat->st_ino != sudoers_stat.st_ino)) + goto bad; + if (!command_args_match(sudoers_cmnd, sudoers_args)) + goto bad; + if (digest != NULL && !digest_matches(fd, sudoers_cmnd, digest)) { + /* XXX - log functions not available but we should log very loudly */ + goto bad; + } + free(safe_cmnd); + if ((safe_cmnd = strdup(sudoers_cmnd)) == NULL) { + sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory")); + goto bad; + } + set_cmnd_fd(fd); + debug_return_bool(true); +bad: + if (fd != -1) + close(fd); + debug_return_bool(false); +} +#endif /* SUDOERS_NAME_MATCH */ + +#ifdef SUDOERS_NAME_MATCH +/* + * Return true if user_cmnd begins with sudoers_dir, else false. + * Note that sudoers_dir include the trailing '/' + */ +static bool +command_matches_dir(const char *sudoers_dir, size_t dlen, + const struct command_digest *digest) +{ + debug_decl(command_matches_dir, SUDOERS_DEBUG_MATCH) + /* XXX - check digest */ + debug_return_bool(strncmp(user_cmnd, sudoers_dir, dlen) == 0); +} +#else /* !SUDOERS_NAME_MATCH */ +/* + * Return true if user_cmnd names one of the inodes in dir, else false. + */ +static bool +command_matches_dir(const char *sudoers_dir, size_t dlen, + const struct command_digest *digest) +{ + struct stat sudoers_stat; + struct dirent *dent; + char buf[PATH_MAX]; + int fd = -1; + DIR *dirp; + debug_decl(command_matches_dir, SUDOERS_DEBUG_MATCH) + + /* + * Grot through directory entries, looking for user_base. + */ + dirp = opendir(sudoers_dir); + if (dirp == NULL) + debug_return_bool(false); + + if (strlcpy(buf, sudoers_dir, sizeof(buf)) >= sizeof(buf)) { + closedir(dirp); + debug_return_bool(false); + } + while ((dent = readdir(dirp)) != NULL) { + if (fd != -1) { + close(fd); + fd = -1; + } + + /* ignore paths > PATH_MAX (XXX - log) */ + buf[dlen] = '\0'; + if (strlcat(buf, dent->d_name, sizeof(buf)) >= sizeof(buf)) + continue; + + /* only stat if basenames are the same */ + if (strcmp(user_base, dent->d_name) != 0) + continue; + + /* Open the file for fdexec or for digest matching. */ + if (!open_cmnd(buf, digest, &fd)) + continue; + if (!do_stat(fd, buf, &sudoers_stat)) + continue; + + if (user_stat == NULL || + (user_stat->st_dev == sudoers_stat.st_dev && + user_stat->st_ino == sudoers_stat.st_ino)) { + if (digest != NULL && !digest_matches(fd, buf, digest)) + continue; + free(safe_cmnd); + if ((safe_cmnd = strdup(buf)) == NULL) { + sudo_warnx(U_("%s: %s"), __func__, + U_("unable to allocate memory")); + dent = NULL; + } + break; + } + } + closedir(dirp); + + if (dent != NULL) { + set_cmnd_fd(fd); + debug_return_bool(true); + } + if (fd != -1) + close(fd); + debug_return_bool(false); +} +#endif /* SUDOERS_NAME_MATCH */ + +/* + * Returns true if the hostname matches the pattern, else false + */ +bool +hostname_matches(const char *shost, const char *lhost, const char *pattern) +{ + const char *host; + bool rc; + debug_decl(hostname_matches, SUDOERS_DEBUG_MATCH) + + host = strchr(pattern, '.') != NULL ? lhost : shost; + if (has_meta(pattern)) { + rc = !fnmatch(pattern, host, FNM_CASEFOLD); + } else { + rc = !strcasecmp(host, pattern); + } + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "host %s matches sudoers pattern %s: %s", + host, pattern, rc ? "true" : "false"); + debug_return_bool(rc); +} + +/* + * Returns true if the user/uid from sudoers matches the specified user/uid, + * else returns false. + */ +bool +userpw_matches(const char *sudoers_user, const char *user, const struct passwd *pw) +{ + const char *errstr; + uid_t uid; + bool rc; + debug_decl(userpw_matches, SUDOERS_DEBUG_MATCH) + + if (pw != NULL && *sudoers_user == '#') { + uid = (uid_t) sudo_strtoid(sudoers_user + 1, NULL, NULL, &errstr); + if (errstr == NULL && uid == pw->pw_uid) { + rc = true; + goto done; + } + } + if (def_case_insensitive_user) + rc = strcasecmp(sudoers_user, user) == 0; + else + rc = strcmp(sudoers_user, user) == 0; +done: + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "user %s matches sudoers user %s: %s", + user, sudoers_user, rc ? "true" : "false"); + debug_return_bool(rc); +} + +/* + * Returns true if the group/gid from sudoers matches the specified group/gid, + * else returns false. + */ +bool +group_matches(const char *sudoers_group, const struct group *gr) +{ + const char *errstr; + gid_t gid; + bool rc; + debug_decl(group_matches, SUDOERS_DEBUG_MATCH) + + if (*sudoers_group == '#') { + gid = (gid_t) sudo_strtoid(sudoers_group + 1, NULL, NULL, &errstr); + if (errstr == NULL && gid == gr->gr_gid) { + rc = true; + goto done; + } + } + if (def_case_insensitive_group) + rc = strcasecmp(sudoers_group, gr->gr_name) == 0; + else + rc = strcmp(sudoers_group, gr->gr_name) == 0; +done: + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "group %s matches sudoers group %s: %s", + gr->gr_name, sudoers_group, rc ? "true" : "false"); + debug_return_bool(rc); +} + +/* + * Returns true if the given user belongs to the named group, + * else returns false. + */ +bool +usergr_matches(const char *group, const char *user, const struct passwd *pw) +{ + bool matched = false; + struct passwd *pw0 = NULL; + debug_decl(usergr_matches, SUDOERS_DEBUG_MATCH) + + /* Make sure we have a valid usergroup, sudo style */ + if (*group++ != '%') { + sudo_debug_printf(SUDO_DEBUG_DIAG, "user group %s has no leading '%%'", + group); + goto done; + } + + /* Query group plugin for %:name groups. */ + if (*group == ':' && def_group_plugin) { + if (group_plugin_query(user, group + 1, pw) == true) + matched = true; + goto done; + } + + /* Look up user's primary gid in the passwd file. */ + if (pw == NULL) { + if ((pw0 = sudo_getpwnam(user)) == NULL) { + sudo_debug_printf(SUDO_DEBUG_DIAG, "unable to find %s in passwd db", + user); + goto done; + } + pw = pw0; + } + + if (user_in_group(pw, group)) { + matched = true; + goto done; + } + + /* Query the group plugin for Unix groups too? */ + if (def_group_plugin && def_always_query_group_plugin) { + if (group_plugin_query(user, group, pw) == true) { + matched = true; + goto done; + } + } + +done: + if (pw0 != NULL) + sudo_pw_delref(pw0); + + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "user %s matches group %s: %s", user, group, matched ? "true" : "false"); + debug_return_bool(matched); +} + +#if defined(HAVE_GETDOMAINNAME) || defined(SI_SRPC_DOMAIN) +/* + * Check the domain for invalid characters. + * Linux getdomainname(2) returns (none) if no domain is set. + */ +static bool +valid_domain(const char *domain) +{ + const char *cp; + debug_decl(valid_domain, SUDOERS_DEBUG_MATCH) + + for (cp = domain; *cp != '\0'; cp++) { + /* Check for illegal characters, Linux may use "(none)". */ + if (*cp == '(' || *cp == ')' || *cp == ',' || *cp == ' ') + break; + } + if (cp == domain || *cp != '\0') + debug_return_bool(false); + debug_return_bool(true); +} + +/* + * Get NIS-style domain name and copy from static storage or NULL if none. + */ +const char * +sudo_getdomainname(void) +{ + static char *domain; + static bool initialized; + debug_decl(sudo_getdomainname, SUDOERS_DEBUG_MATCH) + + if (!initialized) { + size_t host_name_max; + int rc; + +# ifdef _SC_HOST_NAME_MAX + host_name_max = (size_t)sysconf(_SC_HOST_NAME_MAX); + if (host_name_max == (size_t)-1) +# endif + host_name_max = 255; /* POSIX and historic BSD */ + + domain = malloc(host_name_max + 1); + if (domain != NULL) { + domain[0] = '\0'; +# ifdef SI_SRPC_DOMAIN + rc = sysinfo(SI_SRPC_DOMAIN, domain, host_name_max + 1); +# else + rc = getdomainname(domain, host_name_max + 1); +# endif + if (rc == -1 || !valid_domain(domain)) { + /* Error or invalid domain name. */ + free(domain); + domain = NULL; + } + } else { + /* XXX - want to pass error back to caller */ + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, + "unable to allocate memory"); + } + initialized = true; + } + debug_return_str(domain); +} +#else +const char * +sudo_getdomainname(void) +{ + debug_decl(sudo_getdomainname, SUDOERS_DEBUG_MATCH) + debug_return_ptr(NULL); +} +#endif /* HAVE_GETDOMAINNAME || SI_SRPC_DOMAIN */ + +/* + * Returns true if "host" and "user" belong to the netgroup "netgr", + * else return false. Either of "lhost", "shost" or "user" may be NULL + * in which case that argument is not checked... + */ +bool +netgr_matches(const char *netgr, const char *lhost, const char *shost, const char *user) +{ +#ifdef HAVE_INNETGR + const char *domain; +#endif + bool rc = false; + debug_decl(netgr_matches, SUDOERS_DEBUG_MATCH) + + if (!def_use_netgroups) { + sudo_debug_printf(SUDO_DEBUG_INFO, "netgroups are disabled"); + debug_return_bool(false); + } + +#ifdef HAVE_INNETGR + /* make sure we have a valid netgroup, sudo style */ + if (*netgr++ != '+') { + sudo_debug_printf(SUDO_DEBUG_DIAG, "netgroup %s has no leading '+'", + netgr); + debug_return_bool(false); + } + + /* get the domain name (if any) */ + domain = sudo_getdomainname(); + + if (innetgr(netgr, lhost, user, domain)) + rc = true; + else if (lhost != shost && innetgr(netgr, shost, user, domain)) + rc = true; + + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "netgroup %s matches (%s|%s, %s, %s): %s", netgr, lhost ? lhost : "", + shost ? shost : "", user ? user : "", domain ? domain : "", + rc ? "true" : "false"); +#endif /* HAVE_INNETGR */ + + debug_return_bool(rc); +} |