summaryrefslogtreecommitdiffstats
path: root/debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch')
-rw-r--r--debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch43
1 files changed, 43 insertions, 0 deletions
diff --git a/debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch b/debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch
new file mode 100644
index 0000000..0fd3071
--- /dev/null
+++ b/debian/patches/Add-sudoedit-flag-checks-in-plugin-that-are-consiste.patch
@@ -0,0 +1,43 @@
+From 9f8d2f158166512511aac5e32928dcf6c65005c3 Mon Sep 17 00:00:00 2001
+From: "Todd C. Miller" <Todd.Miller@sudo.ws>
+Date: Wed, 20 Jan 2021 09:03:17 +0100
+Subject: [PATCH 2/5] Add sudoedit flag checks in plugin that are consistent
+ with front-end.
+
+Don't assume the sudo front-end is sending reasonable mode flags.
+These checks need to be kept consistent between the sudo front-end
+and the sudoers plugin.
+
+[Salvatore Bonaccorso: Backport to 1.8.27: Context changes]
+---
+ plugins/sudoers/policy.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/plugins/sudoers/policy.c
++++ b/plugins/sudoers/policy.c
+@@ -98,10 +98,11 @@ parse_bool(const char *line, int varlen,
+ int
+ sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group)
+ {
++ const int edit_mask = MODE_EDIT|MODE_IGNORE_TICKET|MODE_NONINTERACTIVE;
+ struct sudoers_policy_open_info *info = v;
+- char * const *cur;
+ const char *p, *errstr, *groups = NULL;
+ const char *remhost = NULL;
++ char * const *cur;
+ bool uid_set = false, gid_set = false;
+ int flags = 0;
+ debug_decl(sudoers_policy_deserialize_info, SUDOERS_DEBUG_PLUGIN)
+@@ -331,6 +332,12 @@ sudoers_policy_deserialize_info(void *v,
+ #endif
+ }
+
++ /* Sudo front-end should restrict mode flags for sudoedit. */
++ if (ISSET(flags, MODE_EDIT) && (flags & edit_mask) != flags) {
++ sudo_warnx(U_("invalid mode flags from sudo front end: 0x%x"), flags);
++ goto bad;
++ }
++
+ user_umask = (mode_t)-1;
+ for (cur = info->user_info; *cur != NULL; cur++) {
+ if (MATCHES(*cur, "user=")) {