Add resolve_cmnd(), a wrapper around find_path().

This is a convenience function that sets PERM_RUNAS and calls
find_path().  If the command is not found it will retry with PERM_USER
instead.

MANIFEST

@@ -683,8 +683,8 @@ plugins/sudoers/match_command.c
 plugins/sudoers/match_digest.c
 plugins/sudoers/mkdefaults
 plugins/sudoers/parse.h
-plugins/sudoers/parser_warnx.c
 plugins/sudoers/parse_ldif.c
+plugins/sudoers/parser_warnx.c
 plugins/sudoers/pivot.c
 plugins/sudoers/pivot.h
 plugins/sudoers/po/README
@@ -1148,6 +1148,7 @@ plugins/sudoers/regress/visudo/test8.out.ok
 plugins/sudoers/regress/visudo/test8.sh
 plugins/sudoers/regress/visudo/test9.out.ok
 plugins/sudoers/regress/visudo/test9.sh
+plugins/sudoers/resolve_cmnd.c
 plugins/sudoers/serialize_list.c
 plugins/sudoers/set_perms.c
 plugins/sudoers/sethost.c

plugins/sudoers/Makefile.in

@@ -175,11 +175,12 @@ FUZZ_VERBOSE =
 AUTH_OBJS = sudo_auth.lo @AUTH_OBJS@
 
 LIBPARSESUDOERS_OBJS = alias.lo b64_decode.lo canon_path.lo defaults.lo \
-		       digestname.lo exptilde.lo filedigest.lo gentime.lo \
+                       digestname.lo exptilde.lo filedigest.lo \
-		       gram.lo match.lo match_addr.lo match_command.lo \
+                       gentime.lo gram.lo match.lo match_addr.lo \
-		       match_digest.lo parser_warnx.lo pwutil.lo \
+                       match_command.lo match_digest.lo parser_warnx.lo \
-		       pwutil_impl.lo redblack.lo strlist.lo sudoers_debug.lo \
+                       pwutil.lo pwutil_impl.lo redblack.lo \
-		       timeout.lo timestr.lo toke.lo toke_util.lo
+                       resolve_cmnd.lo strlist.lo sudoers_debug.lo \
+                       timeout.lo timestr.lo toke.lo toke_util.lo
 
 LIBPARSESUDOERS_IOBJS = $(LIBPARSESUDOERS_OBJS:.lo=.i) passwd.i
 
@@ -2695,6 +2696,30 @@ redblack.i: $(srcdir)/redblack.c $(devdir)/def_data.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 redblack.plog: redblack.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/redblack.c --i-file $< --output-file $@
+resolve_cmnd.lo: $(srcdir)/resolve_cmnd.c $(devdir)/def_data.h \
+                 $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
+                 $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
+                 $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
+                 $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \
+                 $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                 $(srcdir)/defaults.h $(srcdir)/logging.h $(srcdir)/parse.h \
+                 $(srcdir)/pivot.h $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \
+                 $(srcdir)/sudoers_debug.h $(top_builddir)/config.h \
+                 $(top_builddir)/pathnames.h
+	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/resolve_cmnd.c
+resolve_cmnd.i: $(srcdir)/resolve_cmnd.c $(devdir)/def_data.h \
+                 $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
+                 $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
+                 $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
+                 $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \
+                 $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                 $(srcdir)/defaults.h $(srcdir)/logging.h $(srcdir)/parse.h \
+                 $(srcdir)/pivot.h $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \
+                 $(srcdir)/sudoers_debug.h $(top_builddir)/config.h \
+                 $(top_builddir)/pathnames.h
+	$(CC) -E -o $@ $(CPPFLAGS) $<
+resolve_cmnd.plog: resolve_cmnd.i
+	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/resolve_cmnd.c --i-file $< --output-file $@
 rfc1938.lo: $(authdir)/rfc1938.c $(authdir)/sudo_auth.h $(devdir)/def_data.h \
             $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
             $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \

plugins/sudoers/find_path.c

@@ -78,11 +78,11 @@ cmnd_allowed(char *cmnd, size_t cmnd_size, struct stat *cmnd_sbp,
 }
 
 /*
- * This function finds the full pathname for a command and
+ * This function finds the full pathname for a command and stores it
- * stores it in a statically allocated array, filling in a pointer
+ * in a statically allocated array, filling in a pointer to the array.
- * to the array.  Returns FOUND if the command was found, NOT_FOUND
+ * Returns FOUND if the command was found, NOT_FOUND if it was not found,
- * if it was not found, or NOT_FOUND_DOT if it would have been found
+ * NOT_FOUND_DOT if it would have been found but it is in '.' and
- * but it is in '.' and IGNORE_DOT is set.
+ * ignore_dot is set or NOT_FOUND_ERROR if an error occurred.
  * The caller is responsible for freeing the output file.
  */
 int

plugins/sudoers/regress/fuzz/fuzz_policy.c

@@ -852,6 +852,14 @@ find_path(const char *infile, char **outfile, struct stat *sbp,
     }
 }
 
+/* STUB */
+int
+resolve_cmnd(struct sudoers_context *ctx, const char *infile, char **outfile,
+    const char *path)
+{
+    return find_path(infile, outfile, NULL, path, false, NULL);
+}
+
 /* STUB */
 bool
 expand_iolog_path(const char *inpath, char *path, size_t pathlen,

plugins/sudoers/resolve_cmnd.c

@@ -0,0 +1,59 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2023 Todd C. Miller <Todd.Miller@sudo.ws>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This is an open source non-commercial project. Dear PVS-Studio, please check it.
+ * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com
+ */
+
+#include <config.h>
+
+#include "sudoers.h"
+
+/*
+ * Calls find_path() first with PERM_RUNAS, falling back to PERM_USER.
+ * Returns FOUND if the command was found, NOT_FOUND if it was not found,
+ * NOT_FOUND_DOT if it would have been found but it is in '.' and
+ * def_ignore_dot is set or NOT_FOUND_ERROR if an error occurred.
+ * The caller is responsible for freeing the output file.
+ */
+int
+resolve_cmnd(struct sudoers_context *ctx, const char *infile,
+    char **outfile, const char *path)
+{
+    int ret = NOT_FOUND_ERROR;
+    debug_decl(resolve_cmnd, SUDOERS_DEBUG_UTIL);
+
+    if (!set_perms(ctx, PERM_RUNAS))
+        goto done;
+    ret = find_path(infile, outfile, ctx->user.cmnd_stat, path,
+        def_ignore_dot, NULL);
+    if (!restore_perms())
+        goto done;
+    if (ret == NOT_FOUND) {
+        /* Failed as runas user, try as invoking user. */
+        if (!set_perms(ctx, PERM_USER))
+            goto done;
+        ret = find_path(infile, outfile, ctx->user.cmnd_stat, path,
+            def_ignore_dot, NULL);
+        if (!restore_perms())
+            goto done;
+    }
+done:
+    debug_return_int(ret);
+}

plugins/sudoers/sudoers.c

@@ -1087,23 +1087,8 @@ set_cmnd_path(struct sudoers_context *ctx, const char *runchroot)
 	    goto error;
     }
 
-    if (!set_perms(ctx, PERM_RUNAS))
+    ret = resolve_cmnd(ctx, cmnd_in, &cmnd_out, path);
-	goto error;
+    if (ret == FOUND) {
-    ret = find_path(cmnd_in, &cmnd_out, ctx->user.cmnd_stat, path,
-	def_ignore_dot, NULL);
-    if (!restore_perms())
-	goto error;
-    if (ret == NOT_FOUND) {
-	/* Failed as root, try as invoking user. */
-	if (!set_perms(ctx, PERM_USER))
-	    goto error;
-	ret = find_path(cmnd_in, &cmnd_out, ctx->user.cmnd_stat, path,
-	    def_ignore_dot, NULL);
-	if (!restore_perms())
-	    goto error;
-    }
-
-    if (cmnd_out != NULL) {
 	char *slash = strrchr(cmnd_out, '/');
 	if (slash != NULL) {
 	    *slash = '\0';

plugins/sudoers/sudoers.h

@@ -321,6 +321,10 @@ bool sudo_goodpath(const char *path, struct stat *sbp);
 int find_path(const char *infile, char **outfile, struct stat *sbp,
     const char *path, bool ignore_dot, char * const *allowlist);
 
+/* resolve_cmnd.c */
+int resolve_cmnd(struct sudoers_context *ctx, const char *infile,
+    char **outfile, const char *path);
+
 /* check.c */
 int check_user(struct sudoers_context *ctx, unsigned int validated, unsigned int mode);
 bool user_is_exempt(const struct sudoers_context *ctx);