mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-31 14:25:15 +00:00
Code Issues Releases Wiki Activity

Add match_group_by_gid Defaults option to allow sites with slow

Browse Source 
group lookups and a small number of groups in sudoers to match
groups by group ID instead of by group name.
This commit is contained in:
Todd C. Miller
2016-08-30 13:42:42 -06:00
parent 12ab1383a4
commit 9cfd556853
4 changed files with 43 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
plugins/sudoers/pwutil.c
View File

@@ -973,23 +973,48 @@ user_in_group(const struct passwd *pw, const char *group)
}
/*
* Next check the supplementary group vector.
* On BSD it includes the password db group too.
* Next match the group name. By default, sudoers resolves all the user's
* group IDs to names and matches by name. If match_group_by_gid is
* set, each group is sudoers is resolved and matching is by group ID.
*/
if ((grlist = sudo_get_grlist(pw)) != NULL) {
if (def_match_group_by_gid) {
gid_t gid;
/* Look up the ID of the group in sudoers. */
if ((grp = sudo_getgrnam(group)) == NULL)
goto done;
gid = grp->gr_gid;
/* Check against user's primary (passwd file) group ID. */
if (gid == pw->pw_gid) {
matched = true;
goto done;
}
/* Check the supplementary group vector. */
if (gidlist == NULL && (gidlist = sudo_get_gidlist(pw)) != NULL) {
for (i = 0; i < gidlist->ngids; i++) {
if (gid == gidlist->gids[i]) {
matched = true;
goto done;
}
}
}
} else if ((grlist = sudo_get_grlist(pw)) != NULL) {
/* Check the supplementary group vector. */
for (i = 0; i < grlist->ngroups; i++) {
if (strcasecmp(group, grlist->groups[i]) == 0) {
matched = true;
goto done;
}
}
}
/* Finally check against user's primary (passwd file) group. */
if ((grp = sudo_getgrgid(pw->pw_gid)) != NULL) {
if (strcasecmp(group, grp->gr_name) == 0) {
matched = true;
goto done;
/* Check against user's primary (passwd file) group. */
if ((grp = sudo_getgrgid(pw->pw_gid)) != NULL) {
if (strcasecmp(group, grp->gr_name) == 0) {
matched = true;
goto done;
}
}
}