diff options
Diffstat (limited to '')
| -rw-r--r-- | debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch b/debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch new file mode 100644 index 0000000..0fd3071 --- /dev/null +++ b/debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch @@ -0,0 +1,43 @@ +From 9f8d2f158166512511aac5e32928dcf6c65005c3 Mon Sep 17 00:00:00 2001 +From: "Todd C. Miller" <Todd.Miller@sudo.ws> +Date: Wed, 20 Jan 2021 09:03:17 +0100 +Subject: [PATCH 2/5] Add sudoedit flag checks in plugin that are consistent + with front-end. + +Don't assume the sudo front-end is sending reasonable mode flags. +These checks need to be kept consistent between the sudo front-end +and the sudoers plugin. + +[Salvatore Bonaccorso: Backport to 1.8.27: Context changes] +--- + plugins/sudoers/policy.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/plugins/sudoers/policy.c ++++ b/plugins/sudoers/policy.c +@@ -98,10 +98,11 @@ parse_bool(const char *line, int varlen, + int + sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group) + { ++ const int edit_mask = MODE_EDIT|MODE_IGNORE_TICKET|MODE_NONINTERACTIVE; + struct sudoers_policy_open_info *info = v; +- char * const *cur; + const char *p, *errstr, *groups = NULL; + const char *remhost = NULL; ++ char * const *cur; + bool uid_set = false, gid_set = false; + int flags = 0; + debug_decl(sudoers_policy_deserialize_info, SUDOERS_DEBUG_PLUGIN) +@@ -331,6 +332,12 @@ sudoers_policy_deserialize_info(void *v, + #endif + } + ++ /* Sudo front-end should restrict mode flags for sudoedit. */ ++ if (ISSET(flags, MODE_EDIT) && (flags & edit_mask) != flags) { ++ sudo_warnx(U_("invalid mode flags from sudo front end: 0x%x"), flags); ++ goto bad; ++ } ++ + user_umask = (mode_t)-1; + for (cur = info->user_info; *cur != NULL; cur++) { + if (MATCHES(*cur, "user=")) { |