Hello community, here is the log from the commit of package sudo.11987 for openSUSE:Leap:15.1:Update checked in at 2020-02-25 10:29:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Leap:15.1:Update/sudo.11987 (Old) and /work/SRC/openSUSE:Leap:15.1:Update/.sudo.11987.new.26092 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sudo.11987" Tue Feb 25 10:29:06 2020 rev:1 rq:776281 version:1.8.22 Changes: -------- New Changes file: --- /dev/null 2019-12-19 10:12:34.003146842 +0100 +++ /work/SRC/openSUSE:Leap:15.1:Update/.sudo.11987.new.26092/sudo.changes 2020-02-25 10:29:09.056152241 +0100 @@ -0,0 +1,2162 @@ +------------------------------------------------------------------- +Thu Feb 6 15:24:27 UTC 2020 - Kristyna Streitova <[email protected]> + +- add sudo-1.8.22-CVE-2019-18634.patch to fix a buffer overflow + when pwfeedback is enabled and input is a not a tty [bsc#1162202] + [CVE-2019-18634] +- add sudo-1.8.22-fix_listpw.patch to fix listpw=never option in + sudoers [bsc#1162675] + +------------------------------------------------------------------- +Fri Oct 11 13:55:11 UTC 2019 - Vítězslav Čížek <[email protected]> + +- Fix CVE-2019-14287 (bsc#1153674) + * A user with sudo privileges that allowed them to run commands + with an arbitrary uid, could run commands as root, despite being + forbidden to do that in sudoers + * add sudo-CVE-2019-14287.patch + +------------------------------------------------------------------- +Thu Sep 20 10:11:52 UTC 2018 - [email protected] + +- fix permissions for /var/lib/sudo and /var/lib/sudo/ts + [bsc#1097643] + +------------------------------------------------------------------- +Mon Apr 16 15:18:12 UTC 2018 - [email protected] + +- integrate pam_keyinit pam module [bsc#1081947] + * add sudo-i.pamd PAM configuration file and install it as + /etc/pam.d/sudo-i + * add "session optional pam_keyinit.so revoke" to sudo.pamd and + "session optional pam_keyinit.so force revoke" to sudo-i.pamd + * add "--with-pam-login" build option to enable specific PAM + session for "sudo -i" +- make pam configuration files (noreplace) +- reorganize Sources + +------------------------------------------------------------------- +Wed Apr 4 11:47:35 CEST 2018 - [email protected] + +- Use %license instead of %doc [bsc#1082318] + +------------------------------------------------------------------- +Mon Feb 19 08:08:02 UTC 2018 - [email protected] + +- Fix sudo prompt: escape %p into %%p to ensure 'p' is not wrapped + and interpreted as being an rpm variable (boo#1081470). + +------------------------------------------------------------------- +Tue Feb 13 11:33:04 UTC 2018 - [email protected] + +- The sudo distribution files are now signed with a new pgp key. + Refresh sudo.keyring + +------------------------------------------------------------------- +Wed Jan 24 00:44:24 UTC 2018 - [email protected] + +- Update to 1.8.22 [bsc#1080793] + * Commands run in the background from a script run via sudo will + no longer receive SIGHUP when the parent exits and I/O logging + is enabled + * A particularly offensive insult is now disabled by default + * The description of sudo -i now correctly documents that the + env_keep and env_check sudoers options are applied to the + environment + * Fixed a crash when the system's host name is not set + * The sudoers2ldif script now handles #include and #includedir + directives. + * Fixed a bug where sudo would silently exit when the command + was not allowed by sudoers and the passwd_tries sudoers option + was set to a value less than one. + * Fixed a bug with the listpw and verifypw sudoers options and + multiple sudoers sources. If the option is set to all a + password should be required unless none of a user's sudoers + entries from any source require authentication. + * Fixed a bug with the listpw and verifypw sudoers options in + the LDAP and SSSD back-ends. If the option is set to any and + the entry contained multiple rules, only the first matching + rule was checked. If an entry contained more than one matching + rule and the first rule required authentication but a + subsequent rule did not, sudo would prompt for a password when + it should not have. + * When running a command as the invoking user (not root), sudo + would execute the command with the same group vector it was + started with. Sudo now executes the command with a new group + vector based on the group database which is consistent with how + su(1) operates. + * Fixed a double free in the SSSD back-end that could occur when + ipa_hostname is present in sssd.conf and is set to an unqualified + host name. + * When I/O logging is enabled, sudo will now write to the terminal + even when it is a background process. Previously, sudo would only + write to the tty when it was the foreground process when I/O + logging was enabled. If the TOSTOP terminal flag is set, sudo + will suspend the command (and then itself) with the SIGTTOU signal. + * A new authfail_message sudoers option that overrides the default + N incorrect password attempt(s). + * An empty sudoRunAsUser attribute in the LDAP and SSSD backends + will now match the invoking user. This is more consistent with + how an empty runas user in the sudoers file is treated. + * Documented that in check mode, visudo does not check the owner / + mode on files specified with the -f flag + * It is now an error to specify the runas user as an empty string + on the command line. Previously, an empty runas user was treated + the same as an unspecified runas user + * When timestamp_type option is set to tty and a terminal is + present, the time stamp record will now include the start time + of the session leader. When the timestamp_type option is set + to ppid or when no terminal is available, the start time of the + parent process is used instead. This significantly reduces the + likelihood of a time stamp record being re-used when a user logs + out and back in again. + * The sudoers time stamp file format is now documented in the new + sudoers_timestamp manual. + * Visudo will now use the SUDO_EDITOR environment variable (if + present) in addition to VISUAL and EDITOR. +- rebase sudoers2ldif-env.patch +- cleanup with spec-cleaner + +------------------------------------------------------------------- +Mon Dec 11 13:38:25 UTC 2017 - [email protected] + +- remove sudoers.dist that is not needed [bsc#1071379] + +------------------------------------------------------------------- +Wed Sep 13 14:19:27 UTC 2017 - [email protected] + +- remove "--with-insults" and disable insults by default. Now + insults sets are included but user must enable it in the sudoers + file [bsc#1053911] + +------------------------------------------------------------------- +Fri Sep 8 09:17:50 UTC 2017 - [email protected] + +- update to 1.8.21p2 + +Major changes between sudo 1.8.21p2 and 1.8.21p1: + * Fixed a bug introduced in version 1.8.21 which prevented sudo + from using the PAM-supplied prompt. Bug #799 + * Fixed a bug introduced in version 1.8.21 which could result in + sudo hanging when running commands that exit quickly. Bug #800 + * Fixed a bug introduced in version 1.8.21 which prevented the + command from being run when the password was read via an external + program using the askpass interface. Bug #801 + +Major changes between sudo 1.8.21p1 and 1.8.21: + * On systems that support both PAM and SIGINFO, the main sudo + process will no longer forward SIGINFO to the command if the + signal was generated from the keyboard. The command will have + already received SIGINFO since it is part of the same process + group so there's no need for sudo to forward it. This is + consistent with the handling of SIGINT, SIGQUIT and SIGTSTP. + Bug #796 + * If SUDOERS_SEARCH_FILTER in ldap.conf does not specify a value, + the LDAP search expression used when looking up netgroups and + non-Unix groups had a syntax error if a group plugin was not + specified. + * "sudo -U otheruser -l" will now have an exit value of 0 even + if "otheruser" has no sudo privileges. The exit value when a + user attempts to lists their own privileges or when a command + is specified is unchanged. + * Fixed a regression introduced in sudo 1.8.21 where sudoreplay + playback would hang for I/O logs that contain terminal input. + * Sudo 1.8.18 contained an incomplete fix for the matching of + entries in the LDAP and SSSD backends when a sudoRunAsGroup is + specified but no sudoRunAsUser is present in the sudoRole. + +Major changes between sudo 1.8.21 and 1.8.20p2: + * The path that sudo uses to search for terminal devices can now + be configured via the new "devsearch" Path setting in sudo.conf. + * It is now possible to preserve bash shell functions in the + environment when the "env_reset" sudoers setting is disabled by + removing the "*=()*" pattern from the env_delete list. + * A change made in sudo 1.8.15 inadvertantly caused sudoedit to + send itself SIGHUP instead of exiting when the editor returns + an error or the file was not modified. + * Sudoedit now uses an exit code of zero if the file was not + actually modified. Previously, sudoedit treated a lack of + modifications as an error. + * When running a command in a pseudo-tty (pty), sudo now copies a + subset of the terminal flags to the new pty. Previously, all + flags were copied, even those not appropriate for a pty. + * Fixed a problem with debug logging in the sudoers I/O logging + plugin. + * Window size change events are now logged to the policy plugin. + On xterm and compatible terminals, sudoreplay is now capable of + resizing the terminal to match the size of the terminal the + command was run on. The new -R option can be used to disable + terminal resizing. + * Fixed a bug in visudo where a newly added file was not checked + for syntax errors. Bug #791. + * Fixed a bug in visudo where if a syntax error in an include + directory (like /etc/sudoers.d) was detected, the edited version + was left as a temporary file instead of being installed. + * On PAM systems, sudo will now treat "username's Password:" as + a standard password prompt. As a result, the SUDO_PROMPT + environment variable will now override "username's Password:" ++++ 1965 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:Leap:15.1:Update/.sudo.11987.new.26092/sudo.changes New: ---- README.SUSE README_313276.test fate_313276_test.sh sudo-1.8.22-CVE-2019-18634.patch sudo-1.8.22-fix_listpw.patch sudo-1.8.22.tar.gz sudo-1.8.22.tar.gz.sig sudo-CVE-2019-14287.patch sudo-i.pamd sudo-sudoers.patch sudo.changes sudo.keyring sudo.pamd sudo.spec sudoers2ldif-env.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sudo.spec ++++++ # # spec file for package sudo # # Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # Name: sudo Version: 1.8.22 Release: 0 Summary: Execute some commands as root License: ISC Group: System/Base Url: https://www.sudo.ws/ Source0: https://sudo.ws/sudo/dist/%{name}-%{version}.tar.gz Source1: https://sudo.ws/sudo/dist/%{name}-%{version}.tar.gz.sig Source2: %{name}.keyring Source3: sudo.pamd Source4: sudo-i.pamd Source5: README.SUSE Source6: fate_313276_test.sh Source7: README_313276.test Patch0: sudoers2ldif-env.patch # PATCH-OPENSUSE: the "SUSE" branding of the default sudo config Patch1: sudo-sudoers.patch Patch2: sudo-CVE-2019-14287.patch Patch3: sudo-1.8.22-CVE-2019-18634.patch Patch4: sudo-1.8.22-fix_listpw.patch BuildRequires: audit-devel BuildRequires: cyrus-sasl-devel BuildRequires: groff BuildRequires: libselinux-devel BuildRequires: openldap2-devel BuildRequires: pam-devel BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel Requires(pre): coreutils Requires(pre): permissions %description Sudo is a command that allows users to execute some commands as root. The %{_sysconfdir}/sudoers file (edited with 'visudo') specifies which users have access to sudo and which commands they can run. Sudo logs all its activities to syslogd, so the system administrator can keep an eye on things. Sudo asks for the password for initializing a check period of a given time N (where N is defined at installation and is set to 5 minutes by default). %package devel Summary: Header files needed for sudo plugin development Group: Development/Libraries/C and C++ Requires: %{name} = %{version} %description devel These header files are needed for building of sudo plugins. %package test Summary: Tests for the package Group: Development/Tools/Other Requires: %{name} = %{version} %description test Tests for fate#313276 %prep %setup -q %autopatch -p1 %build %ifarch s390 s390x %{sparc} F_PIE=-fPIE %else F_PIE=-fpie %endif export CFLAGS="%{optflags} -Wall $F_PIE -DLDAP_DEPRECATED" export LDFLAGS="-pie" %configure \ --libexecdir=%{_libexecdir}/sudo \ --docdir=%{_docdir}/%{name} \ --with-noexec=%{_libexecdir}/sudo/sudo_noexec.so \ --enable-tmpfiles.d=%{_tmpfilesdir} \ --with-pam \ --with-pam-login \ --with-ldap \ --with-selinux \ --with-linux-audit \ --with-logfac=auth \ --with-all-insults \ --with-ignore-dot \ --with-tty-tickets \ --enable-shell-sets-home \ --enable-warnings \ --with-sendmail=%{_sbindir}/sendmail \ --with-sudoers-mode=0440 \ --with-env-editor \ --without-secure-path \ --with-passprompt="[sudo] password for %%p: " \ --with-rundir=%{_localstatedir}/lib/sudo \ --with-sssd make %{?_smp_mflags} %install %make_install install_uid=`id -u` install_gid=`id -g` install -d -m 755 %{buildroot}%{_sysconfdir}/pam.d install -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/pam.d/sudo install -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/pam.d/sudo-i mv %{buildroot}%{_docdir}/%{name}/sudoers2ldif %{buildroot}%{_sbindir} rm -f %{buildroot}%{_bindir}/sudoedit ln -sf %{_bindir}/sudo %{buildroot}%{_bindir}/sudoedit install -d -m 755 %{buildroot}%{_sysconfdir}/openldap/schema install -m 644 doc/schema.OpenLDAP %{buildroot}%{_sysconfdir}/openldap/schema/sudo.schema install -m 644 %{SOURCE5} %{buildroot}%{_docdir}/%{name}/ rm -f %{buildroot}%{_docdir}/%{name}/sample.pam rm -f %{buildroot}%{_docdir}/%{name}/sample.syslog.conf rm -f %{buildroot}%{_docdir}/%{name}/schema.OpenLDAP rm -f %{buildroot}%{_sysconfdir}/sudoers.dist %find_lang %{name} %find_lang sudoers cat sudoers.lang >> %{name}.lang # tests install -d -m 755 %{buildroot}%{_localstatedir}/lib/tests/sudo install -m 755 %{SOURCE6} %{buildroot}%{_localstatedir}/lib/tests/sudo install -m 755 %{SOURCE7} %{buildroot}%{_localstatedir}/lib/tests/sudo install -d %{buildroot}%{_docdir}/%{name}-test install -m 644 %{buildroot}%{_docdir}/%{name}/LICENSE %{buildroot}%{_docdir}/%{name}-test/LICENSE rm -fv %{buildroot}%{_docdir}/%{name}/LICENSE %post chmod 0440 %{_sysconfdir}/sudoers %if 0%{?suse_version} <= 1130 %run_permissions %else %set_permissions %{_bindir}/sudo %endif %tmpfiles_create %{_tmpfilesdir}/sudo.conf %verifyscript %verify_permissions -e %{_bindir}/sudo %files -f %{name}.lang %license doc/LICENSE %doc %{_docdir}/%{name} %{_mandir}/man5/sudoers.5%{ext_man} %{_mandir}/man5/sudo.conf.5%{ext_man} %{_mandir}/man5/sudoers.ldap.5%{ext_man} %{_mandir}/man5/sudoers_timestamp.5%{ext_man} %{_mandir}/man8/sudo.8%{ext_man} %{_mandir}/man8/sudoedit.8%{ext_man} %{_mandir}/man8/sudoreplay.8%{ext_man} %{_mandir}/man8/visudo.8%{ext_man} %config(noreplace) %attr(0440,root,root) %{_sysconfdir}/sudoers %dir %{_sysconfdir}/sudoers.d %config(noreplace) %{_sysconfdir}/pam.d/sudo %config(noreplace) %{_sysconfdir}/pam.d/sudo-i %attr(4755,root,root) %{_bindir}/sudo %dir %{_sysconfdir}/openldap %dir %{_sysconfdir}/openldap/schema %attr(0444,root,root) %config %{_sysconfdir}/openldap/schema/sudo.schema %{_bindir}/sudoedit %{_bindir}/sudoreplay %{_sbindir}/visudo %attr(0755,root,root) %{_sbindir}/sudoers2ldif %dir %{_libexecdir}/%{name} %{_libexecdir}/%{name}/sesh %{_libexecdir}/%{name}/sudo_noexec.so %{_libexecdir}/%{name}/sudoers.so %{_libexecdir}/%{name}/group_file.so %{_libexecdir}/%{name}/system_group.so %{_libexecdir}/%{name}/libsudo_util.so.* %attr(0711,root,root) %dir %ghost %{_localstatedir}/lib/%{name} %attr(0700,root,root) %dir %ghost %{_localstatedir}/lib/%{name}/ts %dir %{_tmpfilesdir} %{_tmpfilesdir}/sudo.conf %files devel %doc plugins/sample/sample_plugin.c %{_includedir}/sudo_plugin.h %{_mandir}/man8/sudo_plugin.8* %attr(0644,root,root) %{_libexecdir}/%{name}/libsudo_util.so %{_libexecdir}/%{name}/*.la %files test %{_localstatedir}/lib/tests %{_docdir}/%{name}-test/ %changelog ++++++ README.SUSE ++++++ In the default (ie unconfigured) configuration sudo asks for root password. This allows to use an ordinary user account for administration of a freshly installed system. When configuring sudo, please make sure to delete the two following lines: Defaults targetpw # ask for the password of the target user i.e. root %users ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'! ++++++ README_313276.test ++++++ To verify that sudo works with SSSD, there's has to be a working LDAP server where the sudoers file will be saved, local running SSSD and sudo configured to use the SSSD plugin. The sudoers file has to be stored in LDAP. A [sudo] service has to be configured in /etc/sssd/sssd.conf Sudo needs to be instructed to use SSSD, this is done in /etc/nsswitch.conf, by adding a line "sudoers: files sss" Related material: /usr/share/doc/packages/sudo/README.LDAP provides a guide how to make sudo work with LDAP. man sudoers.ldap(5) describes the LDAP-based sudoers file man sssd-ldap(5) describes the LDAP sudo options. ++++++ fate_313276_test.sh ++++++ #!/bin/sh if [ $(id -u) -ne 0 ]; then printf "Please run the test as root.\n" exit 1 fi if sudo -V | grep -q -- --with-sssd; then printf "OK: Sudo has support for SSSD compiled in.\n" exit 0 fi printf "Error: SSSD support isn't compiled in.\n" exit 1 ++++++ sudo-1.8.22-CVE-2019-18634.patch ++++++ >From fa8ffeb17523494f0e8bb49a25e53635f4509078 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" <[email protected]> Date: Wed, 29 Jan 2020 20:15:21 -0700 Subject: [PATCH] Fix a buffer overflow when pwfeedback is enabled and input is a not a tty. In getln() if the user enters ^U (erase line) and the write(2) fails, the remaining buffer size is reset but the current pointer is not. While here, fix an incorrect break for erase when write(2) fails. Also disable pwfeedback when input is not a tty as it cannot work. CVE-2019-18634 Credit: Joe Vennix from Apple Information Security. --- src/tgetpass.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) Index: sudo-1.8.22/src/tgetpass.c =================================================================== --- sudo-1.8.22.orig/src/tgetpass.c +++ sudo-1.8.22/src/tgetpass.c @@ -48,7 +48,7 @@ static volatile sig_atomic_t signo[NSIG] static bool tty_present(void); static void tgetpass_handler(int); -static char *getln(int, char *, size_t, int); +static char *getln(int, char *, size_t, bool); static char *sudo_askpass(const char *, const char *); static int @@ -90,6 +90,7 @@ tgetpass(const char *prompt, int timeout static const char *askpass; static char buf[SUDO_CONV_REPL_MAX + 1]; int i, input, output, save_errno, neednl = 0, need_restart; + bool feedback = ISSET(flags, TGP_MASK); debug_decl(tgetpass, SUDO_DEBUG_CONV) (void) fflush(stdout); @@ -136,7 +137,7 @@ restart: */ if (!ISSET(flags, TGP_ECHO)) { for (;;) { - if (ISSET(flags, TGP_MASK)) + if (feedback) neednl = sudo_term_cbreak(input); else neednl = sudo_term_noecho(input); @@ -150,6 +151,9 @@ restart: } } } + /* Only use feedback mode when we can disable echo. */ + if (!neednl) + feedback = false; /* * Catch signals that would otherwise cause the user to end @@ -175,7 +179,7 @@ restart: if (timeout > 0) alarm(timeout); - pass = getln(input, buf, sizeof(buf), ISSET(flags, TGP_MASK)); + pass = getln(input, buf, sizeof(buf), feedback); alarm(0); save_errno = errno; @@ -305,7 +309,7 @@ sudo_askpass(const char *askpass, const extern int sudo_term_erase, sudo_term_kill; static char * -getln(int fd, char *buf, size_t bufsiz, int feedback) +getln(int fd, char *buf, size_t bufsiz, bool feedback) { size_t left = bufsiz; ssize_t nr = -1; @@ -327,15 +331,15 @@ getln(int fd, char *buf, size_t bufsiz, while (cp > buf) { if (write(fd, "\b \b", 3) == -1) break; - --cp; + cp--; } + cp = buf; left = bufsiz; continue; } else if (c == sudo_term_erase) { if (cp > buf) { - if (write(fd, "\b \b", 3) == -1) - break; - --cp; + ignore_result(write(fd, "\b \b", 3)); + cp--; left++; } continue; ++++++ sudo-1.8.22-fix_listpw.patch ++++++ >From ecc9c366e469988c736629cbe88348c40dcfa31a Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" <[email protected]> Date: Tue, 22 Jan 2019 06:41:16 -0700 Subject: [PATCH] Fix listpw=never and verifypw=never. Bug #869 --- plugins/sudoers/parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: sudo-1.8.22/plugins/sudoers/parse.c =================================================================== --- sudo-1.8.22.orig/plugins/sudoers/parse.c +++ sudo-1.8.22/plugins/sudoers/parse.c @@ -168,7 +168,7 @@ sudo_file_lookup(struct sudo_nss *nss, i enum def_tuple pwcheck; pwcheck = (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple; - nopass = (pwcheck == all) ? true : false; + nopass = (pwcheck == never) ? true : false; if (list_pw == NULL) SET(validated, FLAG_NO_CHECK); ++++++ sudo-CVE-2019-14287.patch ++++++ Treat an ID of -1 as invalid since that means "no change". Fixes CVE-2019-14287. Found by Joe Vennix from Apple Information Security. Index: sudo-1.8.22/lib/util/strtoid.c =================================================================== --- sudo-1.8.22.orig/lib/util/strtoid.c 2019-10-11 15:07:53.098048354 +0200 +++ sudo-1.8.22/lib/util/strtoid.c 2019-10-11 15:07:54.334055463 +0200 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2016 Todd C. Miller <[email protected]> + * Copyright (c) 2013-2019 Todd C. Miller <[email protected]> * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -42,6 +42,27 @@ #include "sudo_util.h" /* + * Make sure that the ID ends with a valid separator char. + */ +static bool +valid_separator(const char *p, const char *ep, const char *sep) +{ + bool valid = false; + debug_decl(valid_separator, SUDO_DEBUG_UTIL) + + if (ep != p) { + /* check for valid separator (including '\0') */ + if (sep == NULL) + sep = ""; + do { + if (*ep == *sep) + valid = true; + } while (*sep++ != '\0'); + } + debug_return_bool(valid); +} + +/* * Parse a uid/gid in string form. * If sep is non-NULL, it contains valid separator characters (e.g. comma, space) * If endp is non-NULL it is set to the next char after the ID. @@ -55,36 +76,33 @@ sudo_strtoid_v1(const char *p, const cha char *ep; id_t ret = 0; long long llval; - bool valid = false; debug_decl(sudo_strtoid, SUDO_DEBUG_UTIL) /* skip leading space so we can pick up the sign, if any */ while (isspace((unsigned char)*p)) p++; - if (sep == NULL) - sep = ""; + + /* While id_t may be 64-bit signed, uid_t and gid_t are 32-bit unsigned. */ errno = 0; llval = strtoll(p, &ep, 10); - if (ep != p) { - /* check for valid separator (including '\0') */ - do { - if (*ep == *sep) - valid = true; - } while (*sep++ != '\0'); + if ((errno == ERANGE && llval == LLONG_MAX) || llval > (id_t)UINT_MAX) { + errno = ERANGE; + if (errstr != NULL) + *errstr = N_("value too large"); + goto done; } - if (!valid) { + if ((errno == ERANGE && llval == LLONG_MIN) || llval < INT_MIN) { + errno = ERANGE; if (errstr != NULL) - *errstr = N_("invalid value"); - errno = EINVAL; + *errstr = N_("value too small"); goto done; } - if (errno == ERANGE) { - if (errstr != NULL) { - if (llval == LLONG_MAX) - *errstr = N_("value too large"); - else - *errstr = N_("value too small"); - } + + /* Disallow id -1, which means "no change". */ + if (!valid_separator(p, ep, sep) || llval == -1 || llval == (id_t)UINT_MAX) { + if (errstr != NULL) + *errstr = N_("invalid value"); + errno = EINVAL; goto done; } ret = (id_t)llval; @@ -101,30 +119,15 @@ sudo_strtoid_v1(const char *p, const cha { char *ep; id_t ret = 0; - bool valid = false; debug_decl(sudo_strtoid, SUDO_DEBUG_UTIL) /* skip leading space so we can pick up the sign, if any */ while (isspace((unsigned char)*p)) p++; - if (sep == NULL) - sep = ""; + errno = 0; if (*p == '-') { long lval = strtol(p, &ep, 10); - if (ep != p) { - /* check for valid separator (including '\0') */ - do { - if (*ep == *sep) - valid = true; - } while (*sep++ != '\0'); - } - if (!valid) { - if (errstr != NULL) - *errstr = N_("invalid value"); - errno = EINVAL; - goto done; - } if ((errno == ERANGE && lval == LONG_MAX) || lval > INT_MAX) { errno = ERANGE; if (errstr != NULL) @@ -137,28 +140,31 @@ sudo_strtoid_v1(const char *p, const cha *errstr = N_("value too small"); goto done; } - ret = (id_t)lval; - } else { - unsigned long ulval = strtoul(p, &ep, 10); - if (ep != p) { - /* check for valid separator (including '\0') */ - do { - if (*ep == *sep) - valid = true; - } while (*sep++ != '\0'); - } - if (!valid) { + + /* Disallow id -1, which means "no change". */ + if (!valid_separator(p, ep, sep) || lval == -1) { if (errstr != NULL) *errstr = N_("invalid value"); errno = EINVAL; goto done; } + ret = (id_t)lval; + } else { + unsigned long ulval = strtoul(p, &ep, 10); if ((errno == ERANGE && ulval == ULONG_MAX) || ulval > UINT_MAX) { errno = ERANGE; if (errstr != NULL) *errstr = N_("value too large"); goto done; } + + /* Disallow id -1, which means "no change". */ + if (!valid_separator(p, ep, sep) || ulval == UINT_MAX) { + if (errstr != NULL) + *errstr = N_("invalid value"); + errno = EINVAL; + goto done; + } ret = (id_t)ulval; } if (errstr != NULL) Index: sudo-1.8.22/lib/util/regress/atofoo/atofoo_test.c =================================================================== --- sudo-1.8.22.orig/lib/util/regress/atofoo/atofoo_test.c 2019-10-11 15:07:53.098048354 +0200 +++ sudo-1.8.22/lib/util/regress/atofoo/atofoo_test.c 2019-10-11 15:09:14.862518700 +0200 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014 Todd C. Miller <[email protected]> + * Copyright (c) 2014-2019 Todd C. Miller <[email protected]> * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -24,6 +24,7 @@ #else # include "compat/stdbool.h" #endif +#include <errno.h> #include "sudo_compat.h" #include "sudo_util.h" @@ -78,15 +79,20 @@ static struct strtoid_data { id_t id; const char *sep; const char *ep; + int errnum; } strtoid_data[] = { - { "0,1", 0, ",", "," }, - { "10", 10, NULL, NULL }, - { "-2", -2, NULL, NULL }, + { "0,1", 0, ",", ",", 0 }, + { "10", 10, NULL, NULL, 0 }, + { "-1", 0, NULL, NULL, EINVAL }, + { "4294967295", 0, NULL, NULL, EINVAL }, + { "4294967296", 0, NULL, NULL, ERANGE }, + { "-2147483649", 0, NULL, NULL, ERANGE }, + { "-2", -2, NULL, NULL, 0 }, #if SIZEOF_ID_T != SIZEOF_LONG_LONG - { "-2", 4294967294U, NULL, NULL }, + { "-2", (id_t)4294967294U, NULL, NULL, 0 }, #endif - { "4294967294", 4294967294U, NULL, NULL }, - { NULL, 0, NULL, NULL } + { "4294967294", (id_t)4294967294U, NULL, NULL, 0 }, + { NULL, 0, NULL, NULL, 0 } }; static int @@ -102,11 +108,23 @@ test_strtoid(int *ntests) (*ntests)++; errstr = "some error"; value = sudo_strtoid(d->idstr, d->sep, &ep, &errstr); - if (errstr != NULL) { - if (d->id != (id_t)-1) { - sudo_warnx_nodebug("FAIL: %s: %s", d->idstr, errstr); + if (d->errnum != 0) { + if (errstr == NULL) { + sudo_warnx_nodebug("FAIL: %s: missing errstr for errno %d", + d->idstr, d->errnum); + errors++; + } else if (value != 0) { + sudo_warnx_nodebug("FAIL: %s should return 0 on error", + d->idstr); + errors++; + } else if (errno != d->errnum) { + sudo_warnx_nodebug("FAIL: %s: errno mismatch, %d != %d", + d->idstr, errno, d->errnum); errors++; } + } else if (errstr != NULL) { + sudo_warnx_nodebug("FAIL: %s: %s", d->idstr, errstr); + errors++; } else if (value != d->id) { sudo_warnx_nodebug("FAIL: %s != %u", d->idstr, (unsigned int)d->id); errors++; Index: sudo-1.8.22/plugins/sudoers/regress/testsudoers/test5.out.ok =================================================================== --- sudo-1.8.22.orig/plugins/sudoers/regress/testsudoers/test5.out.ok 2019-10-11 15:07:53.102048378 +0200 +++ sudo-1.8.22/plugins/sudoers/regress/testsudoers/test5.out.ok 2019-10-11 15:07:54.334055463 +0200 @@ -4,7 +4,7 @@ Parse error in sudoers near line 1. Entries for user root: Command unmatched -testsudoers: test5.inc should be owned by gid 4294967295 +testsudoers: test5.inc should be owned by gid 4294967294 Parse error in sudoers near line 1. Entries for user root: Index: sudo-1.8.22/plugins/sudoers/regress/testsudoers/test5.sh =================================================================== --- sudo-1.8.22.orig/plugins/sudoers/regress/testsudoers/test5.sh 2019-10-11 15:07:53.134048562 +0200 +++ sudo-1.8.22/plugins/sudoers/regress/testsudoers/test5.sh 2019-10-11 15:07:54.334055463 +0200 @@ -24,7 +24,7 @@ EOF # Test group writable chmod 664 $TESTFILE -./testsudoers -U $MYUID -G -1 root id <<EOF +./testsudoers -U $MYUID -G -2 root id <<EOF #include $TESTFILE EOF ++++++ sudo-i.pamd ++++++ #%PAM-1.0 auth include common-auth account include common-account password include common-password session optional pam_keyinit.so force revoke session include common-session # session optional pam_xauth.so ++++++ sudo-sudoers.patch ++++++ Index: sudo-1.8.14p3/plugins/sudoers/sudoers.in =================================================================== --- sudo-1.8.14p3.orig/plugins/sudoers/sudoers.in +++ sudo-1.8.14p3/plugins/sudoers/sudoers.in @@ -32,30 +32,23 @@ ## ## Defaults specification ## -## You may wish to keep some of the following environment variables -## when running commands via sudo. -## -## Locale settings -# Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET" -## -## Run X applications through sudo; HOME is used to find the -## .Xauthority file. Note that other programs use HOME to find -## configuration files and this may lead to privilege escalation! -# Defaults env_keep += "HOME" -## -## X11 resource path settings -# Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH" -## -## Desktop path settings -# Defaults env_keep += "QTDIR KDEDIR" -## -## Allow sudo-run commands to inherit the callers' ConsoleKit session -# Defaults env_keep += "XDG_SESSION_COOKIE" -## -## Uncomment to enable special input methods. Care should be taken as -## this may allow users to subvert the command being run via sudo. -# Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER" -## +## Prevent environment variables from influencing programs in an +## unexpected or harmful way (CVE-2005-2959, CVE-2005-4158, CVE-2006-0151) +Defaults always_set_home +## Path that will be used for every command run from sudo +Defaults secure_path="/usr/sbin:/usr/bin:/sbin:/bin" +Defaults env_reset +## Change env_reset to !env_reset in previous line to keep all environment variables +## Following list will no longer be nevessary after this change +Defaults env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_ATIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE" +## Comment out the preceding line and uncomment the following one if you need +## to use special input methods. This may allow users to compromise the root +## account if they are allowed to run commands without authentication. +#Defaults env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_ATIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE" + +## Do not insult users when they enter an incorrect password. +Defaults !insults + ## Uncomment to use a hard-coded PATH instead of the user's to find commands # Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ## @@ -66,9 +59,15 @@ ## sudoreplay and reboot. Use sudoreplay to play back logged sessions. # Defaults log_output # Defaults!/usr/bin/sudoreplay !log_output -# Defaults!/usr/local/bin/sudoreplay !log_output # Defaults!REBOOT !log_output +## In the default (unconfigured) configuration, sudo asks for the root password. +## This allows use of an ordinary user account for administration of a freshly +## installed system. When configuring sudo, delete the two +## following lines: +Defaults targetpw # ask for the password of the target user i.e. root +ALL ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'! + ## ## Runas alias specification ## @@ -84,14 +83,6 @@ root ALL=(ALL) ALL ## Same thing without a password # %wheel ALL=(ALL) NOPASSWD: ALL -## Uncomment to allow members of group sudo to execute any command -# %sudo ALL=(ALL) ALL - -## Uncomment to allow any user to run sudo if they know the password -## of the user they are running the command as (root by default). -# Defaults targetpw # Ask for the password of the target user -# ALL ALL=(ALL) ALL # WARNING: only use this together with 'Defaults targetpw' - ## Read drop-in files from @sysconfdir@/sudoers.d ## (the '#' here does not indicate a comment) #includedir @sysconfdir@/sudoers.d Index: sudo-1.8.14p3/doc/sudoers.mdoc.in =================================================================== --- sudo-1.8.14p3.orig/doc/sudoers.mdoc.in +++ sudo-1.8.14p3/doc/sudoers.mdoc.in @@ -1711,7 +1711,7 @@ is present in the .Em env_keep list. This flag is -.Em off +.Em on by default. .It authenticate If set, users must authenticate themselves via a password (or other @@ -2027,7 +2027,7 @@ If set, .Nm sudo will insult users when they enter an incorrect password. This flag is -.Em @insults@ +.Em off by default. .It log_host If set, the host name will be logged in the (non-syslog) @@ -2508,7 +2508,7 @@ database as an argument to the .Fl u option. This flag is -.Em off +.Em on by default. .It tty_tickets If set, users must authenticate on a per-tty basis. ++++++ sudo.keyring ++++++ pub 1024D/0x5A89DFA27EE470C4 2002-10-02 uid [ unknown] Todd C. Miller <[email protected]> sub 1024g/0x4ACA1697D017E72F 2002-10-02 pub 4096R/0xA9F4C021CEA470FB 2017-12-03 uid [ unknown] Todd C. Miller <[email protected]> sub 4096R/0x8BBF1A6CF4565623 2017-12-03 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2 mQGiBD2bdiURBACyoSsYq9t8jiLnhABRZcgDP2vaoJoGJD3eb9HNsv2+0IrcHaut s1QR1AY88AGTMnQTFWjH1vIXz/YCKnvgqklfbVCMehvkOUKvGv2eP7IkmWvVPIQb kayHCtChOKW86hqxZXyT8sbBJqHGHq7xBbg71uZ/CSaTY3ATencRX+UndwCg6ujz FFQhKoVwnPdYPkYA10kp2UsD/2Act3O9UJabaln5MLqLQrxo1Cqa3+ht4liAAOr3 psMPcieyIULQ4yE19Jvb90s2sao88BUPVeDxBHV/nhcNQxlH4Boc+kWtU36XSxU3 yrUhZDQIvrM4o1yCSgNSwUM88+qYm6ETAT0sZAiFT9biMjsT4Bw13KihyYtE2L36 LdXOA/9MEH8zWRqUjQMt4X1yKTjwmIotAd9xetVNj+4lfTgmsnlZoex7T94Id0+B FDDSj4gpQ7GpFa0qOQgTyaUo5HgoPFw4F9TjebWiyey2SznIw4960KoAwfSTdSOG GoD96xuBsmQGCfdIFW43SJngXKiOpF/3VHoUxGYhTefOSGHAvLQqVG9kZCBDLiBN aWxsZXIgPFRvZGQuTWlsbGVyQGNvdXJ0ZXNhbi5jb20+iFkEExECABkFAj2bdiUE CwcDAgMVAgMDFgIBAh4BAheAAAoJEFqJ36J+5HDEQigAoLdD+y5EQzvogb6oybhC pBBmefqYAKDGlnXX7JNBJYBv/r5TBg4+zLOOL7kBDQQ9m3YnEAQAzhN0fOfOz3+z m0rHJ+hCW06ME9W1UWTgPdkh6izMO29j5tsq7MDOEoiBA8fGNV9+1nqXS3PWsYpP qnm+Yx/8zHPsepiOWe3UaJruBfFT8BlGSzN6p9aO1liQOnv57XouRab5tUFZPDM7 ADHGAlruyvZjzywj/v6FWNoY6DLiqosAAwUEAKSap7csw/skFED0lF/lsllvmRa7 4kd/lEYGPB62Cyau/4nucrnZrBNP7wSIdpCLzQxq6l/j/vP5aUV8qN2W6+DY1CZA rodtZKPUNGHCdop9ZcskEx6eOG2ivYpgn0z6scoXUJ4g5kCSshzPedG4DOLHFMtE hVDWxnHdtn0UFCntiEYEGBECAAYFAj2bdicACgkQWonfon7kcMTOeACgmCPD1Is5 KhRmc+7kY4ILfdUX5OUAn2mdSBk/pObAfpdPzasJT7QxIQFLmQINBFokaiQBEADM mTjkUBpTgLLiv85lz0UGmgVj39si2Gd3RC2/qz3UmHhS0qnL4x3LejZQOifaevT3 wIgOjU+YtyHleW2lZp0a/ndtFgXHeVJTQ12Ej5NbOHBFECWkWyXj1Rv/vBopI7Ox ERjAjoUQLSu6nsksclYoO0pZywm+K17os1i5Qbi0djdYjHT5Asiqnef5g02a8DJz QCq37VM046gFRhnp/unJoi4iexpjH/HL4tlRO7/3pDwV6MFVWDhNcrlP6AnmSzYb Fv8Nt4MsbWU0oYa1TtRmuqxn5R/Lb9i4Uj793qZz3I/cDqv78kd3lRJ5TbjXR1D2 alhGVP6+0KWOKd5rpDSwYNojwKdVI6faJUOjRRSHGmZiNYFWp5UXDQUeFXmzEFWa XgIXbmH0SqpVkKvwhH/sn0G3ryLXnPizjM3RSmoxSzpJNTHBFGPBLd9eJ724IvF5 Qigo8IdpPTZUv7EHmK2va97nH+AK7HDAPWTsOpM49CZXy1xz9N8Be3I8ayUgMO6a VuAKpQFGEpuNGq+DCvyUOyVa5jeEf50wWHXBMPlVjdZK/46aNKmg9YyGDmZn1YIG eAc6mhW0yM/+vvz9Wof5+RHHOBbVmAI7e7Mm7gR6xLZ0zty9FdPtEvxPnzzPIBjS tPxvFr3j/9maW7iJNX1c/FTqXY+VAfUy7mpvrEZrGQARAQABtCRUb2RkIEMuIE1p bGxlciA8VG9kZC5NaWxsZXJAc3Vkby53cz6JAk4EEwEIADgWIQRZ0enMuis3ZwT9 01up9MAhzqRw+wUCWiRqJAIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCp 9MAhzqRw+5TmEACtyNWwMIfo/0okILNHryc61nA96XznSsQS9u5AaRN06l6dp+1i x7FrSlXvCq1Oq7kajsF8Nnq9y2r7Os9ZsZSwGF1JGTt/qBT8N+Y+pEIe7igTSxv3 UJINuY2uQvR6y7GOmvMVHvLUAR48WXhS3w4UVlBfDx4UEuLFocurDsNgqYBEv3QY ORUNCVMZlJg6/d8X3KpAK+Og3V13L8NjqZ546sRZub42FjJhxNh1mKLU+Q1Y+9Jm B3EMBBOTY+OAnwQJiLcW3l1RdA8d2wTQ3+CnwywJrcUm3yKwMGgPxs8+ywol9B2G 5DtXYO82Flzfzb8kHQ6JRKBFVa3dz2NZt82VIIovfEl90zvBaEJVlNH/XH5qsVLY LHB/NZUwxxz573HSMW4YCQgZZWaZ0byjb27KYd6S7Tj/DV5uQvVmGcRQ7sAcJoKV G3XVlm+n5XnCWXddySOtt3XZbByIAyC5iu8LuLjCauO0sUX0L4yKnc0e4bqCglIm JGZuuOL5tLYOL7Bd/RWj2uC+dpPaol6VAefGDUv8GqKa+Y28FRXKVvxcQwLYLm4D A6hYV9f/0RjjPT/8VDk/dfytydhpaDnNu1nieAa5lx3/BPYPiuLgWg4DXpfW4IIG IMaEULDOfN7xOELfbTnIru89aWc+kqdzfrMPhLwxClHg2JWrjuE+BPzMXrkCDQRa JGokARAAxGZu+BKBt8rY8lF/7wQBfrqx2nlUTvdMlmUELT3e8Gw/z7+qArjYn+Xm 7TTh490KMaATKFnDol0vfvlMXre4hyCC1/+B2qjEKiUCvVhwmKQFNV3pmbugTlbd EnHuf5sbzU32HWb2x2L4jMcrN97CQq6qx65S05uo7TS7DM7xPUCrGZKeXvlQVmJv 0gH3symIy2ZQoLtTYyMoaDfifKLHbQfR2WSxPy7cb6mjX1jMOD8dGGazLDGohCDp Lhs4MbFTjwh1PBhFETBbAh5/ElNefpfT25w7RkPaMLiXmxTSQu/uugldjAsz5uQ8 D39TueoeFymBOUH76dM1VewNzHxZTp0GpnOfvhtleKg/870tNhLphf811g1HxeNM +W9oU5kY/dcFo71SHwuVzMSGU3QOuJmLso3epFsMfs5mDML8UT+gXZgI2gfu0VPj a4ashJ6Pd+OUpH7awFNLa7CoGILpBTIN1xxUCyzk1DNkscWYCgMUobdSEi/W59iC PlrDW5tPCfIzTA06F6WhjFKoYaM9oqBM113J9j+t4FK7gkrao9ksF6eKaohNEiGJ WRFJUwHf1jiHWafwZTAm1ZE9yuUksBbWrcEYdoak4CRcc1BaZWNd4PKn9IFoFSjb e8WAGoRLcv0sNujmN+UiQ+LesIUw3QA0YWXsN9sijUxroC/ClZMAEQEAAYkCNgQY AQgAIBYhBFnR6cy6KzdnBP3TW6n0wCHOpHD7BQJaJGokAhsMAAoJEKn0wCHOpHD7 ok0QAJSNCcZAUTmQRlhncToRg6lLqwgIDx/GLYq6F/WDYn6Me2QalyUskpFX12qm JBlaMFHAus7bhbtyQBcEmPW9MY+HhItvRYXpKMbgEdxnMvD5uY+zDHiScRECH8gt Zy8Uld0HiCy2aWgwt3LtVRuLu/wt5KsLq1s9zpEHQ0P9AHnz+EWFArCHCC8FatWE 47zZLDLOuMSLeS7HBSheloyTwezfdzbKnyD3JVwoTID0LP2Wo5FspqwYkIN93zRy TrlC6lmPR+TMzMsAeAh2kHpoV03z6isTO59jIqj1Nrai8fhd4DyfnRBBjkoXJTPe TM+MFa1gdU2B8VJfoqG7Ti780Tg83Z4/H9EEdD/pHzI8ay6xX5ABJhDnPHTPz3fK PaxwrfOJGyCvAr8qbCVql1Dp8b3sTAlWbG/Cqz7q3NhF298o4A1EDu5IADWKOhek djF/dutRHMCbvJKA0q4XiZu9YVYv7yysRPTicwvN9W5z7a5oIJLCXXtetNtoFZFo UDDZjmaCA6pcbFX9FZ96b9jLNa/BKvtlCTsosJHxf9XNiSx5dW9wHuojr60wvLxV K/N2anvjEfYuVxlfcKjOHpJuOX7xAcOAVAWnNvY/vSZCvAo2azMB5NOxu2Iz3pyq ARpClI6b14giASYMfWkb2Bfx2Sc44SHXcm5MxiTt51tB8i+d =bkRz -----END PGP PUBLIC KEY BLOCK----- ++++++ sudo.pamd ++++++ #%PAM-1.0 auth include common-auth account include common-account password include common-password session optional pam_keyinit.so revoke session include common-session # session optional pam_xauth.so ++++++ sudoers2ldif-env.patch ++++++ Index: b/plugins/sudoers/sudoers2ldif =================================================================== --- a/plugins/sudoers/sudoers2ldif +++ b/plugins/sudoers/sudoers2ldif @@ -1,4 +1,4 @@ -#!/usr/bin/env perl +#!/usr/bin/perl # # Copyright (c) 2007, 2010-2011, 2013 Todd C. Miller <[email protected]> #
