mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-22 18:08:23 +00:00
Code Issues Releases Wiki Activity

Fix the date written used by the exit record in sudo-format log files

Browse Source 
The change to always get the current time when building a struct
evlog in sudoers broke the data and time written for exit records.
This only affected file-based logs, not syslog.  GitHub issue #405.
This commit is contained in:
Todd C. Miller 2024-09-06 13:05:47 -06:00
parent f47c88065a
commit 22b320645c
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lib/eventlog/eventlog.c
View File

@ -1453,6 +1453,7 @@ eventlog_exit(const struct eventlog *evlog, int flags)
bool ret = true; bool ret = true;
debug_decl(eventlog_exit, SUDO_DEBUG_UTIL); debug_decl(eventlog_exit, SUDO_DEBUG_UTIL);
/* We expect evlog->event_time to be the command start time. */
if (sudo_timespecisset(&evlog->run_time)) { if (sudo_timespecisset(&evlog->run_time)) {
sudo_timespecadd(&evlog->event_time, &evlog->run_time, &exit_time); sudo_timespecadd(&evlog->event_time, &evlog->run_time, &exit_time);
args.event_time = &exit_time; args.event_time = &exit_time;

2
logsrvd/logsrvd_local.c
View File

@ -423,7 +423,7 @@ store_exit_local(ExitMessage *msg, uint8_t *buf, size_t len,
"command exited with %d", msg->exit_value); "command exited with %d", msg->exit_value);
} }
if (logsrvd_conf_log_exit()) { if (logsrvd_conf_log_exit()) {
if (!eventlog_exit(closure->evlog, flags)) { if (!eventlog_exit(evlog, flags)) {
closure->errstr = _("error logging exit event"); closure->errstr = _("error logging exit event");
debug_return_bool(false); debug_return_bool(false);
} }

5
plugins/sudoers/logging.c
View File

@ -655,6 +655,11 @@ log_exit_status(const struct sudoers_context *ctx, int status)
if (!def_log_exit_status) if (!def_log_exit_status)
SET(evl_flags, EVLOG_MAIL_ONLY); SET(evl_flags, EVLOG_MAIL_ONLY);
} }
/*
* eventlog_exit() expects event_time to be the command start time,
* not the current time as set by sudoers_to_eventlog().
*/
sudo_timespecsub(&evlog.event_time, &run_time, &evlog.event_time);
evlog.run_time = run_time; evlog.run_time = run_time;
evlog.exit_value = exit_value; evlog.exit_value = exit_value;
evlog.signal_name = signal_name; evlog.signal_name = signal_name;