mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-31 06:15:37 +00:00
Code Issues Releases Wiki Activity

Pass a secret value to sudo_intercept.so and verify after policy check.

Browse Source 
The goal is to make it harder for someone to have a fake policy checker.
This will not stop a determined adversary since the secret is present
in the address space of the running process.
This commit is contained in:
Todd C. Miller
2021-08-13 09:10:44 -06:00
parent c9d9225469
commit eaf03a382b
8 changed files with 57 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
include/intercept.pb-c.h
View File

@@ -118,6 +118,7 @@ typedef enum {
struct _PolicyCheckResult
{
ProtobufCMessage base;
uint64_t secret;
PolicyCheckResult__TypeCase type_case;
union {
PolicyAcceptMessage *accept_msg;
@@ -127,7 +128,7 @@ struct _PolicyCheckResult
};
#define POLICY_CHECK_RESULT__INIT \
{ PROTOBUF_C_MESSAGE_INIT (&policy_check_result__descriptor) \
, POLICY_CHECK_RESULT__TYPE__NOT_SET, {0} }
, 0, POLICY_CHECK_RESULT__TYPE__NOT_SET, {0} }
/* InterceptMessage methods */