mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-09-02 07:15:27 +00:00
Code Issues Releases Wiki Activity

Make login class support work on BSD/OS

Browse Source
This commit is contained in:
Todd C. Miller
2000-03-24 20:13:12 +00:00
parent 5b84f29486
commit f32e054fe5
3 changed files with 35 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
CHANGES
View File

@@ -1275,11 +1275,11 @@ Sudo 1.6.2 released.
402) Fixed a typo/thinko that broke secureware support for long passwords. 402) Fixed a typo/thinko that broke secureware support for long passwords.
403) Added a new command line switch '-c' to support FreeBSD style login 403) Added a new command line switch '-c' to support BSD login classes.
classes. The '-c' option can be used to sudo a command with specific The '-c' option can be used to sudo a command with specific resource
resource limits in the login.conf database. This feature is optionally limits in the login.conf database. This feature is optionally enabled
enabled via the --with-logincap configure switch. Based on a patch via the --with-logincap configure switch. Based on a patch from
from Michael D. Marchionna. Michael D. Marchionna.
404) Fixed a bug where sudo would hang around and consume CPU if we spawn 404) Fixed a bug where sudo would hang around and consume CPU if we spawn
a long-running process. a long-running process.

11
INSTALL
View File

@@ -187,11 +187,12 @@ Special features/options:
access DCE via PAM before using this option. access DCE via PAM before using this option.
--with-logincap --with-logincap
Enable support for BSD login classes on FreeBSD. This adds support Enable support for BSD login classes on FreeBSD and BSD/OS. This
for the login classes specified in /etc/login.conf. By default, adds support for the login classes specified in /etc/login.conf.
a login class is not applied unless the 'use_loginclass' option By default, a login class is not applied unless the 'use_loginclass'
is defined in sudoers or the user specifies a class on the command option is defined in sudoers or the user specifies a class on the
line. command line. It does *not*, however cause sudo to use BSD
authentication.
--disable-sia --disable-sia
Disable SIA support. This is the "Security Integration Architecture" Disable SIA support. This is the "Security Integration Architecture"

36
sudo.c
View File

@@ -78,6 +78,9 @@
#endif /* HAVE_GETPRPWNAM && HAVE_SET_AUTH_PARAMETERS */ #endif /* HAVE_GETPRPWNAM && HAVE_SET_AUTH_PARAMETERS */
#ifdef HAVE_LOGINCAP #ifdef HAVE_LOGINCAP
# include <login_cap.h> # include <login_cap.h>
# ifndef LOGIN_DEFROOTCLASS
# define LOGIN_DEFROOTCLASS "daemon"
# endif
#endif #endif
#include "sudo.h" #include "sudo.h"
@@ -1085,6 +1088,17 @@ set_loginclass(pw)
struct passwd *pw; struct passwd *pw;
{ {
login_cap_t *lc; login_cap_t *lc;
int errflags;
/*
* Don't make it a fatal error if the user didn't specify the login
* class themselves. We do this because if login.conf gets
* corrupted we want the admin to be able to use sudo to fix it.
*/
if (login_class)
errflags = NO_MAIL|MSG_ONLY;
else
errflags = NO_MAIL|MSG_ONLY|NO_EXIT;
if (login_class && strcmp(login_class, "-") != 0) { if (login_class && strcmp(login_class, "-") != 0) {
if (strcmp(*user_runas, "root") != 0 && user_uid != 0) { if (strcmp(*user_runas, "root") != 0 && user_uid != 0) {
@@ -1092,18 +1106,16 @@ set_loginclass(pw)
Argv[0], login_class); Argv[0], login_class);
exit(1); exit(1);
} }
} else {
login_class = pw->pw_class;
if (!login_class || !*login_class)
login_class =
(pw->pw_uid == 0) ? LOGIN_DEFROOTCLASS : LOGIN_DEFCLASS;
}
lc = login_getclass(login_class); lc = login_getclass(login_class);
if (!lc || !lc->lc_class || strcmp(lc->lc_class, login_class) != 0) if (!lc || !lc->lc_class || strcmp(lc->lc_class, login_class) != 0) {
log_error(NO_MAIL|MSG_ONLY, "unknown login class: %s", login_class); log_error(errflags, "unknown login class: %s", login_class);
} else if (!(lc = login_getpwclass(pw))) {
/*
* This is not a fatal error if the user didn't specify the login
* class themselves. We do this because if login.conf gets
* corrupted we want the admin to be able to use sudo to fix it.
*/
log_error(login_class ? NO_MAIL|MSG_ONLY : NO_MAIL|NO_EXIT|MSG_ONLY,
"can't get class for user: %s", user_runas);
return(0); return(0);
} }
@@ -1111,7 +1123,7 @@ set_loginclass(pw)
if (setusercontext(lc, pw, pw->pw_uid, if (setusercontext(lc, pw, pw->pw_uid,
LOGIN_SETUSER|LOGIN_SETGROUP|LOGIN_SETRESOURCES|LOGIN_SETPRIORITY) < 0) LOGIN_SETUSER|LOGIN_SETGROUP|LOGIN_SETRESOURCES|LOGIN_SETPRIORITY) < 0)
log_error(NO_MAIL|USE_ERRNO|MSG_ONLY, log_error(NO_MAIL|USE_ERRNO|MSG_ONLY,
"setusercontext() failed for login class %s", lc); "setusercontext() failed for login class %s", login_class);
login_close(lc); login_close(lc);
return(1); return(1);