mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-29 05:17:54 +00:00
Code Issues Releases Wiki Activity

Pass command_info[] to audit plugin on I/O log plugin reject or error.

Browse Source 
The audit plugin should cope with a NULL command_info but there's no
reason not to pass the info when we have it.
This commit is contained in:
Todd C. Miller 2020-11-17 13:15:15 -07:00
parent 27615b5582
commit 24d812d037
3 changed files with 26 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
src/exec_pty.c
View File

@ -213,11 +213,12 @@ log_ttyin(const char *buf, unsigned int n, struct io_buffer *iob)
/* Error: disable plugin's I/O function. */ /* Error: disable plugin's I/O function. */
plugin->u.io->log_ttyin = NULL; plugin->u.io->log_ttyin = NULL;
audit_error(plugin->name, SUDO_IO_PLUGIN, audit_error(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("I/O plugin error"), NULL); errstr ? errstr : _("I/O plugin error"),
iob->ec->details->info);
} else { } else {
audit_reject(plugin->name, SUDO_IO_PLUGIN, audit_reject(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("command rejected by I/O plugin"), errstr ? errstr : _("command rejected by I/O plugin"),
NULL); iob->ec->details->info);
} }
ret = false; ret = false;
break; break;
@ -252,11 +253,12 @@ log_stdin(const char *buf, unsigned int n, struct io_buffer *iob)
/* Error: disable plugin's I/O function. */ /* Error: disable plugin's I/O function. */
plugin->u.io->log_stdin = NULL; plugin->u.io->log_stdin = NULL;
audit_error(plugin->name, SUDO_IO_PLUGIN, audit_error(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("I/O plugin error"), NULL); errstr ? errstr : _("I/O plugin error"),
iob->ec->details->info);
} else { } else {
audit_reject(plugin->name, SUDO_IO_PLUGIN, audit_reject(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("command rejected by I/O plugin"), errstr ? errstr : _("command rejected by I/O plugin"),
NULL); iob->ec->details->info);
} }
ret = false; ret = false;
break; break;
@ -291,11 +293,12 @@ log_ttyout(const char *buf, unsigned int n, struct io_buffer *iob)
/* Error: disable plugin's I/O function. */ /* Error: disable plugin's I/O function. */
plugin->u.io->log_ttyout = NULL; plugin->u.io->log_ttyout = NULL;
audit_error(plugin->name, SUDO_IO_PLUGIN, audit_error(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("I/O plugin error"), NULL); errstr ? errstr : _("I/O plugin error"),
iob->ec->details->info);
} else { } else {
audit_reject(plugin->name, SUDO_IO_PLUGIN, audit_reject(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("command rejected by I/O plugin"), errstr ? errstr : _("command rejected by I/O plugin"),
NULL); iob->ec->details->info);
} }
ret = false; ret = false;
break; break;
@ -341,11 +344,12 @@ log_stdout(const char *buf, unsigned int n, struct io_buffer *iob)
/* Error: disable plugin's I/O function. */ /* Error: disable plugin's I/O function. */
plugin->u.io->log_stdout = NULL; plugin->u.io->log_stdout = NULL;
audit_error(plugin->name, SUDO_IO_PLUGIN, audit_error(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("I/O plugin error"), NULL); errstr ? errstr : _("I/O plugin error"),
iob->ec->details->info);
} else { } else {
audit_reject(plugin->name, SUDO_IO_PLUGIN, audit_reject(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("command rejected by I/O plugin"), errstr ? errstr : _("command rejected by I/O plugin"),
NULL); iob->ec->details->info);
} }
ret = false; ret = false;
break; break;
@ -391,11 +395,12 @@ log_stderr(const char *buf, unsigned int n, struct io_buffer *iob)
/* Error: disable plugin's I/O function. */ /* Error: disable plugin's I/O function. */
plugin->u.io->log_stderr = NULL; plugin->u.io->log_stderr = NULL;
audit_error(plugin->name, SUDO_IO_PLUGIN, audit_error(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("I/O plugin error"), NULL); errstr ? errstr : _("I/O plugin error"),
iob->ec->details->info);
} else { } else {
audit_reject(plugin->name, SUDO_IO_PLUGIN, audit_reject(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("command rejected by I/O plugin"), errstr ? errstr : _("command rejected by I/O plugin"),
NULL); iob->ec->details->info);
} }
ret = false; ret = false;
break; break;
@ -421,7 +426,7 @@ log_stderr(const char *buf, unsigned int n, struct io_buffer *iob)
/* Call I/O plugin suspend log method. */ /* Call I/O plugin suspend log method. */
static void static void
log_suspend(int signo) log_suspend(struct exec_closure_pty *ec, int signo)
{ {
struct plugin_container *plugin; struct plugin_container *plugin;
const char *errstr = NULL; const char *errstr = NULL;
@ -441,7 +446,8 @@ log_suspend(int signo)
/* Error: disable plugin's I/O function. */ /* Error: disable plugin's I/O function. */
plugin->u.io->log_suspend = NULL; plugin->u.io->log_suspend = NULL;
audit_error(plugin->name, SUDO_IO_PLUGIN, audit_error(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("error logging suspend"), NULL); errstr ? errstr : _("error logging suspend"),
ec->details->info);
break; break;
} }
} }
@ -454,7 +460,7 @@ log_suspend(int signo)
/* Call I/O plugin window change log method. */ /* Call I/O plugin window change log method. */
static void static void
log_winchange(unsigned int rows, unsigned int cols) log_winchange(struct exec_closure_pty *ec, unsigned int rows, unsigned int cols)
{ {
struct plugin_container *plugin; struct plugin_container *plugin;
const char *errstr = NULL; const char *errstr = NULL;
@ -474,7 +480,8 @@ log_winchange(unsigned int rows, unsigned int cols)
/* Error: disable plugin's I/O function. */ /* Error: disable plugin's I/O function. */
plugin->u.io->change_winsize = NULL; plugin->u.io->change_winsize = NULL;
audit_error(plugin->name, SUDO_IO_PLUGIN, audit_error(plugin->name, SUDO_IO_PLUGIN,
errstr ? errstr : _("error changing window size"), NULL); errstr ? errstr : _("error changing window size"),
ec->details->info);
break; break;
} }
} }
@ -553,7 +560,7 @@ suspend_sudo(struct exec_closure_pty *ec, int signo)
sudo_term_restore(io_fds[SFD_USERTTY], false); sudo_term_restore(io_fds[SFD_USERTTY], false);
/* Log the suspend event. */ /* Log the suspend event. */
log_suspend(signo); log_suspend(ec, signo);
if (sig2str(signo, signame) == -1) if (sig2str(signo, signame) == -1)
(void)snprintf(signame, sizeof(signame), "%d", signo); (void)snprintf(signame, sizeof(signame), "%d", signo);
@ -572,7 +579,7 @@ suspend_sudo(struct exec_closure_pty *ec, int signo)
sudo_warn("killpg(%d, SIG%s)", (int)ec->ppgrp, signame); sudo_warn("killpg(%d, SIG%s)", (int)ec->ppgrp, signame);
/* Log the resume event. */ /* Log the resume event. */
log_suspend(SIGCONT); log_suspend(ec, SIGCONT);
/* Check foreground/background status on resume. */ /* Check foreground/background status on resume. */
if (check_foreground(ec) == -1) { if (check_foreground(ec) == -1) {
@ -1821,7 +1828,7 @@ sync_ttysize(struct exec_closure_pty *ec)
((wsize.ws_col & 0xffff) << 16); ((wsize.ws_col & 0xffff) << 16);
/* Log window change event. */ /* Log window change event. */
log_winchange(wsize.ws_row, wsize.ws_col); log_winchange(ec, wsize.ws_row, wsize.ws_col);
/* Send window change event to monitor process. */ /* Send window change event to monitor process. */
send_command_status(ec, CMD_TTYWINCH, wsize_packed); send_command_status(ec, CMD_TTYWINCH, wsize_packed);

1
src/sudo.c
View File

@ -646,6 +646,7 @@ command_info_to_details(char * const info[], struct command_details *details)
debug_decl(command_info_to_details, SUDO_DEBUG_PCOMM); debug_decl(command_info_to_details, SUDO_DEBUG_PCOMM);
memset(details, 0, sizeof(*details)); memset(details, 0, sizeof(*details));
details->info = info;
details->closefrom = -1; details->closefrom = -1;
details->execfd = -1; details->execfd = -1;
details->flags = CD_SUDOEDIT_CHECKDIR | CD_SET_GROUPS; details->flags = CD_SUDOEDIT_CHECKDIR | CD_SET_GROUPS;

1
src/sudo.h
View File

@ -174,6 +174,7 @@ struct command_details {
priv_set_t *privs; priv_set_t *privs;
priv_set_t *limitprivs; priv_set_t *limitprivs;
#endif #endif
char * const *info;
}; };
/* Status passed between parent and child via socketpair */ /* Status passed between parent and child via socketpair */