From ae581a19fbe896a797450b9d9573fb66f2735227 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 16:37:38 +0200 Subject: Adding upstream version 1.9.13p3. Signed-off-by: Daniel Baumann --- plugins/python/python_plugin_audit.c | 281 +++++++++++++++++++++++++++++++++++ 1 file changed, 281 insertions(+) create mode 100644 plugins/python/python_plugin_audit.c (limited to 'plugins/python/python_plugin_audit.c') diff --git a/plugins/python/python_plugin_audit.c b/plugins/python/python_plugin_audit.c new file mode 100644 index 0000000..58d59f7 --- /dev/null +++ b/plugins/python/python_plugin_audit.c @@ -0,0 +1,281 @@ +/* + * SPDX-License-Identifier: ISC + * + * Copyright (c) 2020 Robert Manner + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* + * This is an open source non-commercial project. Dear PVS-Studio, please check it. + * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com + */ + +#include "python_plugin_common.h" + +struct AuditPluginContext +{ + struct PluginContext base_ctx; + struct audit_plugin *plugin; +}; + +#define BASE_CTX(audit_ctx) (&(audit_ctx->base_ctx)) + +#define PY_AUDIT_PLUGIN_VERSION SUDO_API_MKVERSION(1, 0) + +#define CALLBACK_PLUGINFUNC(func_name) audit_ctx->plugin->func_name + +// This also verifies compile time that the name matches the sudo plugin API. +#define CALLBACK_PYNAME(func_name) ((void)CALLBACK_PLUGINFUNC(func_name), #func_name) + +#define MARK_CALLBACK_OPTIONAL(function_name) \ + do { \ + python_plugin_mark_callback_optional(plugin_ctx, CALLBACK_PYNAME(function_name), \ + (void **)&CALLBACK_PLUGINFUNC(function_name)); \ + } while(0) + +sudo_dso_public struct audit_plugin *python_audit_clone(void); + +static int +_call_plugin_open(struct AuditPluginContext *audit_ctx, int submit_optind, char * const submit_argv[]) +{ + debug_decl(_call_plugin_open, PYTHON_DEBUG_CALLBACKS); + + struct PluginContext *plugin_ctx = BASE_CTX(audit_ctx); + if (!PyObject_HasAttrString(plugin_ctx->py_instance, CALLBACK_PYNAME(open))) { + debug_return_int(SUDO_RC_OK); + } + + int rc = SUDO_RC_ERROR; + PyObject *py_submit_argv = py_str_array_to_tuple(submit_argv); + + if (py_submit_argv != NULL) { + rc = python_plugin_api_rc_call(plugin_ctx, CALLBACK_PYNAME(open), + Py_BuildValue("(iO)", submit_optind, py_submit_argv)); + } + + Py_XDECREF(py_submit_argv); + debug_return_int(rc); +} + +static int +python_plugin_audit_open(struct AuditPluginContext *audit_ctx, + unsigned int version, sudo_conv_t conversation, + sudo_printf_t sudo_printf, char * const settings[], + char * const user_info[], int submit_optind, + char * const submit_argv[], char * const submit_envp[], + char * const plugin_options[], const char **errstr) +{ + debug_decl(python_plugin_audit_open, PYTHON_DEBUG_CALLBACKS); + (void) version; + + int rc = python_plugin_register_logging(conversation, sudo_printf, settings); + if (rc != SUDO_RC_OK) { + debug_return_int(rc); + } + + struct PluginContext *plugin_ctx = BASE_CTX(audit_ctx); + + rc = python_plugin_init(plugin_ctx, plugin_options, version); + if (rc != SUDO_RC_OK) { + debug_return_int(rc); + } + + rc = python_plugin_construct(plugin_ctx, PY_AUDIT_PLUGIN_VERSION, settings, + user_info, submit_envp, plugin_options); + CALLBACK_SET_ERROR(plugin_ctx, errstr); + if (rc != SUDO_RC_OK) { + debug_return_int(rc); + } + + // skip plugin callbacks which are not mandatory + MARK_CALLBACK_OPTIONAL(accept); + MARK_CALLBACK_OPTIONAL(reject); + MARK_CALLBACK_OPTIONAL(error); + + plugin_ctx->call_close = 1; + rc = _call_plugin_open(audit_ctx, submit_optind, submit_argv); + CALLBACK_SET_ERROR(plugin_ctx, errstr); + + if (PyErr_Occurred()) { + py_log_last_error("Error during calling audit open"); + } + + debug_return_int(rc); +} + +static void +python_plugin_audit_close(struct AuditPluginContext *audit_ctx, int status_type, int status) +{ + debug_decl(python_plugin_audit_close, PYTHON_DEBUG_CALLBACKS); + + python_plugin_close(BASE_CTX(audit_ctx), CALLBACK_PYNAME(close), + Py_BuildValue("(ii)", status_type, status)); + + debug_return; +} + +static int +python_plugin_audit_accept(struct AuditPluginContext *audit_ctx, + const char *plugin_name, unsigned int plugin_type, + char * const command_info[], char * const run_argv[], + char * const run_envp[], const char **errstr) +{ + debug_decl(python_plugin_audit_accept, PYTHON_DEBUG_CALLBACKS); + + struct PluginContext *plugin_ctx = BASE_CTX(audit_ctx); + PyThreadState_Swap(plugin_ctx->py_interpreter); + + PyObject *py_command_info = NULL, *py_run_argv = NULL, *py_run_envp = NULL; + int rc = SUDO_RC_ERROR; + + py_run_argv = py_str_array_to_tuple(run_argv); + if (py_run_argv == NULL) + goto cleanup; + + py_command_info = py_str_array_to_tuple(command_info); + if (py_command_info == NULL) + goto cleanup; + + py_run_envp = py_str_array_to_tuple(run_envp); + if (py_run_envp == NULL) + goto cleanup; + + PyObject *py_args = Py_BuildValue("(ziOOO)", plugin_name, plugin_type, py_command_info, py_run_argv, py_run_envp); + rc = python_plugin_api_rc_call(plugin_ctx, CALLBACK_PYNAME(accept), py_args); + CALLBACK_SET_ERROR(plugin_ctx, errstr); + +cleanup: + Py_CLEAR(py_command_info); + Py_CLEAR(py_run_argv); + Py_CLEAR(py_run_envp); + + debug_return_int(rc); +} + +static int +python_plugin_audit_reject(struct AuditPluginContext *audit_ctx, + const char *plugin_name, unsigned int plugin_type, + const char *audit_msg, char * const command_info[], const char **errstr) +{ + debug_decl(python_plugin_audit_reject, PYTHON_DEBUG_CALLBACKS); + + struct PluginContext *plugin_ctx = BASE_CTX(audit_ctx); + PyThreadState_Swap(plugin_ctx->py_interpreter); + + PyObject *py_command_info = NULL; + int rc = SUDO_RC_ERROR; + + py_command_info = py_str_array_to_tuple(command_info); + if (PyErr_Occurred()) + goto cleanup; + + PyObject *py_args = Py_BuildValue("(zizO)", plugin_name, plugin_type, audit_msg, py_command_info); + rc = python_plugin_api_rc_call(plugin_ctx, CALLBACK_PYNAME(reject), py_args); + + CALLBACK_SET_ERROR(plugin_ctx, errstr); + +cleanup: + Py_CLEAR(py_command_info); + if (PyErr_Occurred()) + py_log_last_error("Error during calling audit reject"); + + debug_return_int(rc); +} + +static int +python_plugin_audit_error(struct AuditPluginContext *audit_ctx, + const char *plugin_name, unsigned int plugin_type, + const char *audit_msg, char * const command_info[], const char **errstr) +{ + debug_decl(python_plugin_audit_error, PYTHON_DEBUG_CALLBACKS); + + struct PluginContext *plugin_ctx = BASE_CTX(audit_ctx); + PyThreadState_Swap(plugin_ctx->py_interpreter); + + PyObject *py_command_info = NULL; + int rc = SUDO_RC_ERROR; + + py_command_info = py_str_array_to_tuple(command_info); + if (PyErr_Occurred()) + goto cleanup; + + PyObject *py_args = Py_BuildValue("(zizO)", plugin_name, plugin_type, audit_msg, py_command_info); + rc = python_plugin_api_rc_call(plugin_ctx, CALLBACK_PYNAME(error), py_args); + CALLBACK_SET_ERROR(plugin_ctx, errstr); + +cleanup: + Py_CLEAR(py_command_info); + + debug_return_int(rc); +} + +static int +python_plugin_audit_show_version(struct AuditPluginContext *audit_ctx, int verbose) +{ + debug_decl(python_plugin_audit_show_version, PYTHON_DEBUG_CALLBACKS); + + struct PluginContext *plugin_ctx = BASE_CTX(audit_ctx); + PyThreadState_Swap(plugin_ctx->py_interpreter); + + debug_return_int(python_plugin_show_version(plugin_ctx, + CALLBACK_PYNAME(show_version), verbose, PY_AUDIT_PLUGIN_VERSION, "audit")); +} + +sudo_dso_public struct audit_plugin python_audit; + +// generate symbols for loading multiple audit plugins: +#define AUDIT_SYMBOL_NAME(symbol) symbol +#include "python_plugin_audit_multi.inc" +#define AUDIT_SYMBOL_NAME(symbol) symbol##1 +#include "python_plugin_audit_multi.inc" +#define AUDIT_SYMBOL_NAME(symbol) symbol##2 +#include "python_plugin_audit_multi.inc" +#define AUDIT_SYMBOL_NAME(symbol) symbol##3 +#include "python_plugin_audit_multi.inc" +#define AUDIT_SYMBOL_NAME(symbol) symbol##4 +#include "python_plugin_audit_multi.inc" +#define AUDIT_SYMBOL_NAME(symbol) symbol##5 +#include "python_plugin_audit_multi.inc" +#define AUDIT_SYMBOL_NAME(symbol) symbol##6 +#include "python_plugin_audit_multi.inc" +#define AUDIT_SYMBOL_NAME(symbol) symbol##7 +#include "python_plugin_audit_multi.inc" + +static struct audit_plugin *extra_audit_plugins[] = { + &python_audit1, + &python_audit2, + &python_audit3, + &python_audit4, + &python_audit5, + &python_audit6, + &python_audit7 +}; + +struct audit_plugin * +python_audit_clone(void) +{ + static size_t counter = 0; + struct audit_plugin *next_plugin = NULL; + + size_t max = sizeof(extra_audit_plugins) / sizeof(*extra_audit_plugins); + if (counter < max) { + next_plugin = extra_audit_plugins[counter]; + ++counter; + } else if (counter == max) { + ++counter; + py_sudo_log(SUDO_CONV_ERROR_MSG, "sudo: loading more than %d sudo python audit plugins is not supported\n", counter); + } + + return next_plugin; +} -- cgit v1.2.3