diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 14:37:38 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 14:37:38 +0000 |
commit | ae581a19fbe896a797450b9d9573fb66f2735227 (patch) | |
tree | 56c40be8518a29c9351364d13a9676aa83932dc0 /plugins/sudoers/match.c | |
parent | Initial commit. (diff) | |
download | sudo-upstream.tar.xz sudo-upstream.zip |
Adding upstream version 1.9.13p3.upstream/1.9.13p3upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | plugins/sudoers/match.c | 709 |
1 files changed, 709 insertions, 0 deletions
diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c new file mode 100644 index 0000000..445bdb2 --- /dev/null +++ b/plugins/sudoers/match.c @@ -0,0 +1,709 @@ +/* + * SPDX-License-Identifier: ISC + * + * Copyright (c) 1996, 1998-2005, 2007-2023 + * Todd C. Miller <Todd.Miller@sudo.ws> + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + * + * Sponsored in part by the Defense Advanced Research Projects + * Agency (DARPA) and Air Force Research Laboratory, Air Force + * Materiel Command, USAF, under agreement number F39502-99-1-0512. + */ + +/* + * This is an open source non-commercial project. Dear PVS-Studio, please check it. + * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com + */ + +#include <config.h> + +#include <sys/stat.h> +#ifdef HAVE_SYS_SYSTEMINFO_H +# include <sys/systeminfo.h> +#endif +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#ifdef HAVE_STRINGS_H +# include <strings.h> +#endif /* HAVE_STRINGS_H */ +#include <unistd.h> +#ifdef HAVE_NETGROUP_H +# include <netgroup.h> +#else +# include <netdb.h> +#endif /* HAVE_NETGROUP_H */ +#include <dirent.h> +#include <fcntl.h> +#include <pwd.h> +#include <grp.h> +#include <errno.h> +#ifdef HAVE_FNMATCH +# include <fnmatch.h> +#else +# include "compat/fnmatch.h" +#endif /* HAVE_FNMATCH */ + +#include "sudoers.h" +#include <gram.h> + +static struct member_list empty = TAILQ_HEAD_INITIALIZER(empty); + +/* + * Check whether user described by pw matches member. + * Returns ALLOW, DENY or UNSPEC. + */ +int +user_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, + const struct member *m) +{ + const char *lhost = parse_tree->lhost ? parse_tree->lhost : user_runhost; + const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost; + int matched = UNSPEC; + struct alias *a; + debug_decl(user_matches, SUDOERS_DEBUG_MATCH); + + switch (m->type) { + case ALL: + matched = !m->negated; + break; + case NETGROUP: + if (netgr_matches(m->name, + def_netgroup_tuple ? lhost : NULL, + def_netgroup_tuple ? shost : NULL, pw->pw_name)) + matched = !m->negated; + break; + case USERGROUP: + if (usergr_matches(m->name, pw->pw_name, pw)) + matched = !m->negated; + break; + case ALIAS: + if ((a = alias_get(parse_tree, m->name, USERALIAS)) != NULL) { + /* XXX */ + int rc = userlist_matches(parse_tree, pw, &a->members); + if (rc != UNSPEC) + matched = m->negated ? !rc : rc; + alias_put(a); + break; + } + FALLTHROUGH; + case WORD: + if (userpw_matches(m->name, pw->pw_name, pw)) + matched = !m->negated; + break; + } + debug_return_int(matched); +} + +/* + * Check for user described by pw in a list of members. + * Returns ALLOW, DENY or UNSPEC. + */ +int +userlist_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, + const struct member_list *list) +{ + struct member *m; + int matched = UNSPEC; + debug_decl(userlist_matches, SUDOERS_DEBUG_MATCH); + + TAILQ_FOREACH_REVERSE(m, list, member_list, entries) { + if ((matched = user_matches(parse_tree, pw, m)) != UNSPEC) + break; + } + debug_return_int(matched); +} + +struct gid_list * +runas_getgroups(void) +{ + const struct passwd *pw; + debug_decl(runas_getgroups, SUDOERS_DEBUG_MATCH); + + if (def_preserve_groups) { + sudo_gidlist_addref(user_gid_list); + debug_return_ptr(user_gid_list); + } + + /* Only use results from a group db query, not the front end. */ + pw = runas_pw ? runas_pw : sudo_user.pw; + debug_return_ptr(sudo_get_gidlist(pw, ENTRY_TYPE_QUERIED)); +} + +/* + * Check for user described by pw in a list of members. + * If both lists are empty compare against def_runas_default. + * Returns ALLOW, DENY or UNSPEC. + */ +int +runaslist_matches(struct sudoers_parse_tree *parse_tree, + const struct member_list *user_list, const struct member_list *group_list, + struct member **matching_user, struct member **matching_group) +{ + const char *lhost = parse_tree->lhost ? parse_tree->lhost : user_runhost; + const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost; + int user_matched = UNSPEC; + int group_matched = UNSPEC; + struct member *m; + struct alias *a; + int rc; + debug_decl(runaslist_matches, SUDOERS_DEBUG_MATCH); + + if (ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) || !ISSET(sudo_user.flags, RUNAS_GROUP_SPECIFIED)) { + /* If no runas user or runas group listed in sudoers, use default. */ + if (user_list == NULL && group_list == NULL) { + debug_return_int(userpw_matches(def_runas_default, + runas_pw->pw_name, runas_pw)); + } + + if (user_list != NULL) { + TAILQ_FOREACH_REVERSE(m, user_list, member_list, entries) { + switch (m->type) { + case ALL: + user_matched = !m->negated; + break; + case NETGROUP: + if (netgr_matches(m->name, + def_netgroup_tuple ? lhost : NULL, + def_netgroup_tuple ? shost : NULL, + runas_pw->pw_name)) + user_matched = !m->negated; + break; + case USERGROUP: + if (usergr_matches(m->name, runas_pw->pw_name, runas_pw)) + user_matched = !m->negated; + break; + case ALIAS: + a = alias_get(parse_tree, m->name, RUNASALIAS); + if (a != NULL) { + rc = runaslist_matches(parse_tree, &a->members, + &empty, matching_user, NULL); + if (rc != UNSPEC) + user_matched = m->negated ? !rc : rc; + alias_put(a); + break; + } + FALLTHROUGH; + case WORD: + if (userpw_matches(m->name, runas_pw->pw_name, runas_pw)) + user_matched = !m->negated; + break; + case MYSELF: + if (!ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) || + strcmp(user_name, runas_pw->pw_name) == 0) + user_matched = !m->negated; + break; + } + if (user_matched != UNSPEC) { + if (matching_user != NULL && m->type != ALIAS) + *matching_user = m; + break; + } + } + } + } + + /* + * Skip checking runas group if none was specified. + */ + if (ISSET(sudo_user.flags, RUNAS_GROUP_SPECIFIED)) { + if (user_matched == UNSPEC) { + if (strcmp(user_name, runas_pw->pw_name) == 0) + user_matched = ALLOW; /* only changing group */ + } + if (group_list != NULL) { + TAILQ_FOREACH_REVERSE(m, group_list, member_list, entries) { + switch (m->type) { + case ALL: + group_matched = !m->negated; + break; + case ALIAS: + a = alias_get(parse_tree, m->name, RUNASALIAS); + if (a != NULL) { + rc = runaslist_matches(parse_tree, &empty, + &a->members, NULL, matching_group); + if (rc != UNSPEC) + group_matched = m->negated ? !rc : rc; + alias_put(a); + break; + } + FALLTHROUGH; + case WORD: + if (group_matches(m->name, runas_gr)) + group_matched = !m->negated; + break; + } + if (group_matched != UNSPEC) { + if (matching_group != NULL && m->type != ALIAS) + *matching_group = m; + break; + } + } + } + if (group_matched == UNSPEC) { + struct gid_list *runas_groups; + /* + * The runas group was not explicitly allowed by sudoers. + * Check whether it is one of the target user's groups. + */ + if (runas_pw->pw_gid == runas_gr->gr_gid) { + group_matched = ALLOW; /* runas group matches passwd db */ + } else if ((runas_groups = runas_getgroups()) != NULL) { + int i; + + for (i = 0; i < runas_groups->ngids; i++) { + if (runas_groups->gids[i] == runas_gr->gr_gid) { + group_matched = ALLOW; /* matched aux group vector */ + break; + } + } + sudo_gidlist_delref(runas_groups); + } + } + } + + if (user_matched == DENY || group_matched == DENY) + debug_return_int(DENY); + if (user_matched == group_matched || runas_gr == NULL) + debug_return_int(user_matched); + debug_return_int(UNSPEC); +} + +/* + * Check for lhost and shost in a list of members. + * Returns ALLOW, DENY or UNSPEC. + */ +static int +hostlist_matches_int(struct sudoers_parse_tree *parse_tree, + const struct passwd *pw, const char *lhost, const char *shost, + const struct member_list *list) +{ + struct member *m; + int matched = UNSPEC; + debug_decl(hostlist_matches, SUDOERS_DEBUG_MATCH); + + TAILQ_FOREACH_REVERSE(m, list, member_list, entries) { + matched = host_matches(parse_tree, pw, lhost, shost, m); + if (matched != UNSPEC) + break; + } + debug_return_int(matched); +} + +/* + * Check for user_runhost and user_srunhost in a list of members. + * Returns ALLOW, DENY or UNSPEC. + */ +int +hostlist_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, + const struct member_list *list) +{ + const char *lhost = parse_tree->lhost ? parse_tree->lhost : user_runhost; + const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost; + + return hostlist_matches_int(parse_tree, pw, lhost, shost, list); +} + +/* + * Check whether host or shost matches member. + * Returns ALLOW, DENY or UNSPEC. + */ +int +host_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw, + const char *lhost, const char *shost, const struct member *m) +{ + struct alias *a; + int matched = UNSPEC; + debug_decl(host_matches, SUDOERS_DEBUG_MATCH); + + switch (m->type) { + case ALL: + matched = !m->negated; + break; + case NETGROUP: + if (netgr_matches(m->name, lhost, shost, + def_netgroup_tuple ? pw->pw_name : NULL)) + matched = !m->negated; + break; + case NTWKADDR: + if (addr_matches(m->name)) + matched = !m->negated; + break; + case ALIAS: + a = alias_get(parse_tree, m->name, HOSTALIAS); + if (a != NULL) { + /* XXX */ + int rc = hostlist_matches_int(parse_tree, pw, lhost, shost, + &a->members); + if (rc != UNSPEC) + matched = m->negated ? !rc : rc; + alias_put(a); + break; + } + FALLTHROUGH; + case WORD: + if (hostname_matches(shost, lhost, m->name)) + matched = !m->negated; + break; + } + sudo_debug_printf(SUDO_DEBUG_DEBUG, + "host %s (%s) matches sudoers host %s%s: %s", lhost, shost, + m->negated ? "!" : "", m->name ? m->name : "ALL", + matched == true ? "true" : "false"); + debug_return_int(matched); +} + +/* + * Check for cmnd and args in a list of members. + * Returns ALLOW, DENY or UNSPEC. + */ +int +cmndlist_matches(struct sudoers_parse_tree *parse_tree, + const struct member_list *list, const char *runchroot, + struct cmnd_info *info) +{ + struct member *m; + int matched = UNSPEC; + debug_decl(cmndlist_matches, SUDOERS_DEBUG_MATCH); + + TAILQ_FOREACH_REVERSE(m, list, member_list, entries) { + matched = cmnd_matches(parse_tree, m, runchroot, info); + if (matched != UNSPEC) + break; + } + debug_return_int(matched); +} + +/* + * Check cmnd and args. + * Returns ALLOW, DENY or UNSPEC. + */ +int +cmnd_matches(struct sudoers_parse_tree *parse_tree, const struct member *m, + const char *runchroot, struct cmnd_info *info) +{ + struct alias *a; + struct sudo_command *c; + int rc, matched = UNSPEC; + debug_decl(cmnd_matches, SUDOERS_DEBUG_MATCH); + + switch (m->type) { + case ALL: + case COMMAND: + c = (struct sudo_command *)m->name; + if (command_matches(c->cmnd, c->args, runchroot, info, &c->digests)) + matched = !m->negated; + break; + case ALIAS: + a = alias_get(parse_tree, m->name, CMNDALIAS); + if (a != NULL) { + rc = cmndlist_matches(parse_tree, &a->members, runchroot, info); + if (rc != UNSPEC) + matched = m->negated ? !rc : rc; + alias_put(a); + } + break; + } + debug_return_int(matched); +} + +/* + * Like cmnd_matches() but only matches against the ALL command. + * Returns ALLOW, DENY or UNSPEC. + */ +int +cmnd_matches_all(struct sudoers_parse_tree *parse_tree, const struct member *m, + const char *runchroot, struct cmnd_info *info) +{ + const bool negated = m->negated; + struct sudo_command *c; + int matched = UNSPEC; + struct alias *a; + debug_decl(cmnd_matches_all, SUDOERS_DEBUG_MATCH); + + switch (m->type) { + case ALL: + c = (struct sudo_command *)m->name; + if (command_matches(c->cmnd, c->args, runchroot, info, &c->digests)) + matched = !negated; + break; + case ALIAS: + a = alias_get(parse_tree, m->name, CMNDALIAS); + if (a != NULL) { + TAILQ_FOREACH_REVERSE(m, &a->members, member_list, entries) { + matched = cmnd_matches_all(parse_tree, m, runchroot, info); + if (matched != UNSPEC) { + if (negated) + matched = !matched; + break; + } + } + alias_put(a); + } + break; + } + debug_return_int(matched); +} + +/* + * Returns true if the hostname matches the pattern, else false + */ +bool +hostname_matches(const char *shost, const char *lhost, const char *pattern) +{ + const char *host; + bool rc; + debug_decl(hostname_matches, SUDOERS_DEBUG_MATCH); + + host = strchr(pattern, '.') != NULL ? lhost : shost; + if (has_meta(pattern)) { + rc = !fnmatch(pattern, host, FNM_CASEFOLD); + } else { + rc = !strcasecmp(host, pattern); + } + debug_return_bool(rc); +} + +/* + * Returns true if the user/uid from sudoers matches the specified user/uid, + * else returns false. + */ +bool +userpw_matches(const char *sudoers_user, const char *user, const struct passwd *pw) +{ + const char *errstr; + uid_t uid; + bool rc; + debug_decl(userpw_matches, SUDOERS_DEBUG_MATCH); + + if (pw != NULL && *sudoers_user == '#') { + uid = (uid_t) sudo_strtoid(sudoers_user + 1, &errstr); + if (errstr == NULL && uid == pw->pw_uid) { + rc = true; + goto done; + } + } + if (def_case_insensitive_user) + rc = strcasecmp(sudoers_user, user) == 0; + else + rc = strcmp(sudoers_user, user) == 0; +done: + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "user %s matches sudoers user %s: %s", + user, sudoers_user, rc ? "true" : "false"); + debug_return_bool(rc); +} + +/* + * Returns true if the group/gid from sudoers matches the specified group/gid, + * else returns false. + */ +bool +group_matches(const char *sudoers_group, const struct group *gr) +{ + const char *errstr; + gid_t gid; + bool rc; + debug_decl(group_matches, SUDOERS_DEBUG_MATCH); + + if (*sudoers_group == '#') { + gid = (gid_t) sudo_strtoid(sudoers_group + 1, &errstr); + if (errstr == NULL && gid == gr->gr_gid) { + rc = true; + goto done; + } + } + if (def_case_insensitive_group) + rc = strcasecmp(sudoers_group, gr->gr_name) == 0; + else + rc = strcmp(sudoers_group, gr->gr_name) == 0; +done: + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "group %s matches sudoers group %s: %s", + gr->gr_name, sudoers_group, rc ? "true" : "false"); + debug_return_bool(rc); +} + +/* + * Returns true if the given user belongs to the named group, + * else returns false. + */ +bool +usergr_matches(const char *group, const char *user, const struct passwd *pw) +{ + bool matched = false; + struct passwd *pw0 = NULL; + debug_decl(usergr_matches, SUDOERS_DEBUG_MATCH); + + /* Make sure we have a valid usergroup, sudo style */ + if (*group++ != '%') { + sudo_debug_printf(SUDO_DEBUG_DIAG, "user group %s has no leading '%%'", + group); + goto done; + } + + /* Query group plugin for %:name groups. */ + if (*group == ':' && def_group_plugin) { + if (group_plugin_query(user, group + 1, pw) == true) + matched = true; + goto done; + } + + /* Look up user's primary gid in the passwd file. */ + if (pw == NULL) { + if ((pw0 = sudo_getpwnam(user)) == NULL) { + sudo_debug_printf(SUDO_DEBUG_DIAG, "unable to find %s in passwd db", + user); + goto done; + } + pw = pw0; + } + + if (user_in_group(pw, group)) { + matched = true; + goto done; + } + + /* Query the group plugin for Unix groups too? */ + if (def_group_plugin && def_always_query_group_plugin) { + if (group_plugin_query(user, group, pw) == true) { + matched = true; + goto done; + } + } + +done: + if (pw0 != NULL) + sudo_pw_delref(pw0); + + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "user %s matches group %s: %s", user, group, matched ? "true" : "false"); + debug_return_bool(matched); +} + +#if defined(HAVE_GETDOMAINNAME) || defined(SI_SRPC_DOMAIN) +/* + * Check the domain for invalid characters. + * Linux getdomainname(2) returns (none) if no domain is set. + */ +static bool +valid_domain(const char *domain) +{ + const char *cp; + debug_decl(valid_domain, SUDOERS_DEBUG_MATCH); + + for (cp = domain; *cp != '\0'; cp++) { + /* Check for illegal characters, Linux may use "(none)". */ + if (*cp == '(' || *cp == ')' || *cp == ',' || *cp == ' ') + break; + } + if (cp == domain || *cp != '\0') + debug_return_bool(false); + debug_return_bool(true); +} + +/* + * Get NIS-style domain name and copy from static storage or NULL if none. + */ +const char * +sudo_getdomainname(void) +{ + static char *domain; + static bool initialized; + debug_decl(sudo_getdomainname, SUDOERS_DEBUG_MATCH); + + if (!initialized) { + size_t host_name_max; + int rc; + +# ifdef _SC_HOST_NAME_MAX + host_name_max = (size_t)sysconf(_SC_HOST_NAME_MAX); + if (host_name_max == (size_t)-1) +# endif + host_name_max = 255; /* POSIX and historic BSD */ + + domain = malloc(host_name_max + 1); + if (domain != NULL) { + domain[0] = '\0'; +# ifdef SI_SRPC_DOMAIN + rc = sysinfo(SI_SRPC_DOMAIN, domain, host_name_max + 1); +# else + rc = getdomainname(domain, host_name_max + 1); +# endif + if (rc == -1 || !valid_domain(domain)) { + /* Error or invalid domain name. */ + free(domain); + domain = NULL; + } + } else { + /* XXX - want to pass error back to caller */ + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, + "unable to allocate memory"); + } + initialized = true; + } + debug_return_str(domain); +} +#else +const char * +sudo_getdomainname(void) +{ + debug_decl(sudo_getdomainname, SUDOERS_DEBUG_MATCH); + debug_return_ptr(NULL); +} +#endif /* HAVE_GETDOMAINNAME || SI_SRPC_DOMAIN */ + +/* + * Returns true if "host" and "user" belong to the netgroup "netgr", + * else return false. Either of "lhost", "shost" or "user" may be NULL + * in which case that argument is not checked... + */ +bool +netgr_matches(const char *netgr, const char *lhost, const char *shost, const char *user) +{ +#ifdef HAVE_INNETGR + const char *domain; +#endif + bool rc = false; + debug_decl(netgr_matches, SUDOERS_DEBUG_MATCH); + + if (!def_use_netgroups) { + sudo_debug_printf(SUDO_DEBUG_INFO, "netgroups are disabled"); + debug_return_bool(false); + } + +#ifdef HAVE_INNETGR + /* make sure we have a valid netgroup, sudo style */ + if (*netgr++ != '+') { + sudo_debug_printf(SUDO_DEBUG_DIAG, "netgroup %s has no leading '+'", + netgr); + debug_return_bool(false); + } + + /* get the domain name (if any) */ + domain = sudo_getdomainname(); + + if (innetgr(netgr, lhost, user, domain)) + rc = true; + else if (lhost != shost && innetgr(netgr, shost, user, domain)) + rc = true; + + sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO, + "netgroup %s matches (%s|%s, %s, %s): %s", netgr, lhost ? lhost : "", + shost ? shost : "", user ? user : "", domain ? domain : "", + rc ? "true" : "false"); +#endif /* HAVE_INNETGR */ + + debug_return_bool(rc); +} |