mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-09-02 23:35:36 +00:00
Code Issues Releases Wiki Activity

Track whether the session was opened in sudoers.

Browse Source 
In sudoers_policy_close() only warn about being unable to run the
command if we actually opened the session (and thus passed all
approval plugins).
This commit is contained in:
Todd C. Miller
2020-06-04 13:34:20 -06:00
parent 1198dfc930
commit a5a7215936
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
plugins/sudoers/policy.c
View File

@@ -53,6 +53,7 @@ sudo_conv_t sudo_conv;
sudo_printf_t sudo_printf; sudo_printf_t sudo_printf;
const char *path_ldap_conf = _PATH_LDAP_CONF; const char *path_ldap_conf = _PATH_LDAP_CONF;
const char *path_ldap_secret = _PATH_LDAP_SECRET; const char *path_ldap_secret = _PATH_LDAP_SECRET;
static bool session_opened;
extern __dso_public struct policy_plugin sudoers_policy; extern __dso_public struct policy_plugin sudoers_policy;
@@ -885,16 +886,17 @@ sudoers_policy_close(int exit_status, int error_code)
{ {
debug_decl(sudoers_policy_close, SUDOERS_DEBUG_PLUGIN); debug_decl(sudoers_policy_close, SUDOERS_DEBUG_PLUGIN);
/* We do not currently log the exit status. */ if (session_opened) {
if (error_code) { /* Close the session we opened in sudoers_policy_init_session(). */
errno = error_code;
sudo_warn(U_("unable to execute %s"), safe_cmnd);
}
/* Close the session we opened in sudoers_policy_init_session(). */
if (ISSET(sudo_mode, MODE_RUN|MODE_EDIT))
(void)sudo_auth_end_session(runas_pw); (void)sudo_auth_end_session(runas_pw);
/* We do not currently log the exit status. */
if (error_code) {
errno = error_code;
sudo_warn(U_("unable to execute %s"), safe_cmnd);
}
}
/* Deregister the callback for sudo_fatal()/sudo_fatalx(). */ /* Deregister the callback for sudo_fatal()/sudo_fatalx(). */
sudo_fatal_callback_deregister(sudoers_cleanup); sudo_fatal_callback_deregister(sudoers_cleanup);
@@ -943,8 +945,10 @@ sudoers_policy_init_session(struct passwd *pwd, char **user_env[],
ret = sudo_auth_begin_session(pwd, user_env); ret = sudo_auth_begin_session(pwd, user_env);
/* The audit functions set audit_msg on failure. */ if (ret == 1) {
if (ret != 1 && audit_msg != NULL) { session_opened = true;
} else if (audit_msg != NULL) {
/* The audit functions set audit_msg on failure. */
if (sudo_version >= SUDO_API_MKVERSION(1, 15)) if (sudo_version >= SUDO_API_MKVERSION(1, 15))
*errstr = audit_msg; *errstr = audit_msg;
} }