Add support for command-specific Defaults entries. E.g.

Defaults!/usr/bin/vi noexec

defaults.c

@@ -495,14 +495,18 @@ init_defaults()
 
 /*
  * Update the defaults based on what was set by sudoers.
+ * If skip_cmnd is 1, skip DEFAULTS_CMND, if it is 0, skip all others.
  * Returns TRUE on success and FALSE on failure.
  */
 int
-update_defaults()
+update_defaults(skip_cmnd)
+    int skip_cmnd;
 {
     struct defaults *def;
 
     for (def = defaults; def != NULL; def = def->next) {
+	if (skip_cmnd == (def->type == DEFAULTS_CMND))
+	    continue;
 	switch (def->type) {
 	    case DEFAULTS:
 		if (!set_default(def->var, def->val, def->op))
@@ -522,6 +526,10 @@ update_defaults()
 		    !set_default(def->var, def->val, def->op))
 		    return(FALSE);
 		break;
+	    case DEFAULTS_CMND:
+		if (cmnd_matches(def->binding) &&
+		    !set_default(def->var, def->val, def->op))
+		    return(FALSE);
 	}
     }
     return(TRUE);

defaults.h

@@ -90,13 +90,20 @@ struct sudo_defs_types {
 #undef T_PATH
 #define T_PATH		0x200
 
+/*
+ * Argument to update_defaults()
+ */
+#define	SKIP_CMND	1
+#define	ONLY_CMND	0
+#define	SET_ALL		-1
+
 /*
  * Prototypes
  */
 void dump_default	__P((void));
 int set_default		__P((char *, char *, int));
 void init_defaults	__P((void));
-int update_defaults	__P((void));
+int update_defaults	__P((int));
 void list_options	__P((void));
 
 extern struct sudo_defs_types sudo_defs_table[];

gram.h

@@ -9,20 +9,21 @@
 #define DEFAULTS_HOST 265
 #define DEFAULTS_USER 266
 #define DEFAULTS_RUNAS 267
-#define RUNAS 268
+#define DEFAULTS_CMND 268
-#define NOPASSWD 269
+#define RUNAS 269
-#define PASSWD 270
+#define NOPASSWD 270
-#define NOEXEC 271
+#define PASSWD 271
-#define EXEC 272
+#define NOEXEC 272
-#define MONITOR 273
+#define EXEC 273
-#define NOMONITOR 274
+#define MONITOR 274
-#define ALL 275
+#define NOMONITOR 275
-#define COMMENT 276
+#define ALL 276
-#define HOSTALIAS 277
+#define COMMENT 277
-#define CMNDALIAS 278
+#define HOSTALIAS 278
-#define USERALIAS 279
+#define CMNDALIAS 279
-#define RUNASALIAS 280
+#define USERALIAS 280
-#define ERROR 281
+#define RUNASALIAS 281
+#define ERROR 282
 #ifndef YYSTYPE_DEFINED
 #define YYSTYPE_DEFINED
 typedef union {

gram.y

@@ -120,6 +120,7 @@ yyerror(s)
 %token <tok>	 DEFAULTS_HOST		/* Host-specific defaults entry */
 %token <tok>	 DEFAULTS_USER		/* User-specific defaults entry */
 %token <tok>	 DEFAULTS_RUNAS		/* Runas-specific defaults entry */
+%token <tok>	 DEFAULTS_CMND		/* Command-specific defaults entry */
 %token <tok> 	 RUNAS			/* ( runas_list ) */
 %token <tok> 	 NOPASSWD		/* no passwd req for command */
 %token <tok> 	 PASSWD			/* passwd req for command (default) */
@@ -200,6 +201,9 @@ entry		:	COMMENT {
 		|	DEFAULTS_HOST hostlist defaults_list {
 			    add_defaults(DEFAULTS_HOST, $2, $3);
 			}
+		|	DEFAULTS_CMND cmndlist defaults_list {
+			    add_defaults(DEFAULTS_CMND, $2, $3);
+			}
 		;
 
 defaults_list	:	defaults_entry

mon_systrace.c

@@ -872,7 +872,7 @@ check_execv(fd, pid, seqnr, askp, cookie, policyp, errorp)
     if (!def_ignore_local_sudoers && !ISSET(validated, VALIDATE_OK))
 #endif
     {
-	(void) update_defaults();
+	(void) update_defaults(SET_ALL);
 	validated = sudoers_lookup(0);
     }
     if (ISSET(validated, VALIDATE_OK)) {

sudo.c

@@ -257,7 +257,7 @@ main(argc, argv, envp)
 	/* Parse sudoers and set any defaults listed in it. */
 	if (parse_sudoers(_PATH_SUDOERS) || parse_error)
 	    log_error(0, "parse error in %s near line %d", errorfile, errorlineno);
-	if (!update_defaults())
+	if (!update_defaults(SKIP_CMND))
 	    log_error(NO_STDERR|NO_EXIT, "problem with defaults entries");
     }
 
@@ -612,7 +612,8 @@ init_vars(sudo_mode)
 }
 
 /*
- * Fill in user_cmnd, user_args, user_base and user_stat variables.
+ * Fill in user_cmnd, user_args, user_base and user_stat variables
+ * and apply any command-specific defaults entries.
  */
 static int
 set_cmnd(sudo_mode)
@@ -667,6 +668,9 @@ set_cmnd(sudo_mode)
     else
 	user_base = user_cmnd;
 
+    if (!update_defaults(ONLY_CMND))
+	log_error(NO_STDERR|NO_EXIT, "problem with defaults entries");
+
     return(rval);
 }
 

testsudoers.c

@@ -204,7 +204,7 @@ main(argc, argv)
     else
 	(void) fputs("Parses OK", stdout);
 
-    if (!update_defaults())
+    if (!update_defaults(SET_ALL))
 	(void) fputs(" (problem with defaults entries)", stdout);
     puts(".");
 
@@ -350,14 +350,14 @@ print_defaults()
 	    case DEFAULTS_RUNAS:
 		putchar('>');
 		break;
+	    case DEFAULTS_CMND:
+		putchar('!');
+		break;
 	}
 	for (m = d->binding; m != NULL; m = m->next) {
-	    if (m->type == COMMAND)
+	    if (m != d->binding)
-		printf("%s\"%s %s\"", m != d->binding ? "," : "",
+		putchar(',');
-		    ((struct sudo_command *)m->name)->cmnd,
+	    print_member(m);
-		    ((struct sudo_command *)m->name)->args);
-	    else
-		printf("%s%s", m != d->binding ? "," : "", m->name);
 	}
 	printf("\t%s%s", d->op == FALSE ? "!" : "", d->var);
 	if (d->val != NULL) {

toke.l

@@ -87,6 +87,7 @@ OCTET			(1?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5])
 DOTTEDQUAD		{OCTET}(\.{OCTET}){3}
 HOSTNAME		[[:alnum:]_-]+
 WORD			([^#>!=:,\(\) \t\n\\]|\\[^\n])+
+PATH			\/(\\[\,:= \t#]|[^\,:=\\ \t\n#])+
 ENVAR			([^#!=, \t\n\\]|\\[^\n])([^#=, \t\n\\]|\\[^\n])*
 DEFVAR			[a-z_]+
 
@@ -195,7 +196,7 @@ DEFVAR			[a-z_]+
 			    return(COMMENT);
 			}
 
-<INITIAL>^Defaults([:@>]{WORD})? {
+<INITIAL>^Defaults([:@>\!]{WORD})? {
 			    BEGIN GOTDEFS;
 			    switch (yytext[8]) {
 				case ':':
@@ -210,6 +211,10 @@ DEFVAR			[a-z_]+
 				    yyless(9);
 				    LEXTRACE("DEFAULTS_HOST ");
 				    return(DEFAULTS_HOST);
+				case '!':
+				    yyless(9);
+				    LEXTRACE("DEFAULTS_CMND ");
+				    return(DEFAULTS_CMND);
 				default:
 				    LEXTRACE("DEFAULTS ");
 				    return(DEFAULTS);
@@ -335,7 +340,15 @@ sudoedit		{
 				yyterminate();
 			}			/* sudo -e */
 
-\/(\\[\,:= \t#]|[^\,:=\\ \t\n#])+	{
+<GOTDEFS>{PATH}		{
+			    /* no command args allowed for Defaults!/path */
+			    if (!fill_cmnd(yytext, yyleng))
+				yyterminate();
+			    LEXTRACE("COMMAND ");
+			    return(COMMAND);
+			}
+
+{PATH}			{
 			    /* directories can't have args... */
 			    if (yytext[yyleng - 1] == '/') {
 				LEXTRACE("COMMAND ");

visudo.c

@@ -203,7 +203,7 @@ main(argc, argv)
 	errorx(1, "%s busy, try again later", sudoers_path);
     init_parser(sudoers_path, 0);
     yyparse();
-    (void) update_defaults();
+    (void) update_defaults(SKIP_CMND);
 
     editor = get_editor(&args);