mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-31 06:15:37 +00:00
Code Issues Releases Wiki Activity

Add restricted_env_file which is like env_file but subject to the

Browse Source 
same restrictions as the user's own environment.
This commit is contained in:
Todd C. Miller
2017-03-22 13:39:25 -06:00
parent 4621e43676
commit b3af85ddc8
9 changed files with 202 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
plugins/sudoers/env.c
View File

@@ -900,7 +900,7 @@ rebuild_env(void)
#endif /* HAVE_LOGIN_CAP_H */
#if defined(_AIX) || (defined(__linux__) && !defined(HAVE_PAM))
/* Insert system-wide environment variables. */
read_env_file(_PATH_ENVIRONMENT, true);
read_env_file(_PATH_ENVIRONMENT, true, false);
#endif
for (ep = env.envp; *ep; ep++)
env_update_didvar(*ep, &didvar);
@@ -1171,7 +1171,7 @@ validate_env_vars(char * const env_vars[])
* character are skipped.
*/
bool
read_env_file(const char *path, int overwrite)
read_env_file(const char *path, bool overwrite, bool restricted)
{
FILE *fp;
bool ret = true;
@@ -1206,6 +1206,15 @@ read_env_file(const char *path, int overwrite)
var_len = (size_t)(val - var);
val_len = strlen(++val);
/*
* If the env file is restricted, apply env_check and env_keep
* when env_reset is set or env_delete when it is not.
*/
if (restricted) {
if (def_env_reset ? !env_should_keep(var) : env_should_delete(var))
continue;
}
/* Strip leading and trailing single/double quotes */
if ((val[0] == '\'' || val[0] == '\"') && val[0] == val[val_len - 1]) {
val[val_len - 1] = '\0';