summaryrefslogtreecommitdiff
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* iolog_gets: change size parameter to int to match fgets/gzgetsTodd C. Miller2023-05-051-1/+1
| | | | Return an error, setting errno to EINVAL, for negative sizes.
* Add adminconfdir and --enable-adminconf to set it.Todd C. Miller2023-05-021-1/+2
| | | | | | Configuration paths in sudo are now a colon-separated list of files with the adminconfdir instance first (if enabled), followed by a sysconfdir instance.
* Convert config file paths to colon-separated path list.Todd C. Miller2023-05-021-0/+4
| | | | | | This means that _PATH_SUDO_CONF, _PATH_SUDOERS, _PATH_SUDO_LOGSRVD_CONF, and _PATH_CVTSUDOERS_CONF can now specify multiple files. The first file that exists is used.
* Add an fd argument to sudo_get_ttysize() instead of always using stderr.Todd C. Miller2023-04-161-2/+3
| | | | | For sudoreplay we open /dev/tty, so use that instead of stderr when determining the terminal size.
* Remove portable getcwd.c, nothing uses it anymore.Todd C. Miller2023-03-161-5/+0
| | | | Any operating system supported by sudo already includes getcwd(3).
* Remove now-unused sudo_timeval* macros.Todd C. Miller2023-03-151-40/+8
|
* Move JSON log parsing from libsudo_iolog.la to libsudo_eventlog.laTodd C. Miller2023-03-131-1/+12
| | | | It will be used in the upcoming log output tests.
* Make the check for HAVE_DECL_NSIG consistent with other decl checks.Todd C. Miller2023-02-271-1/+1
|
* Run the editor in its own process group.Todd C. Miller2023-02-211-0/+4
| | | | | This fixes suspending the editor on GNU Hurd which doesn't seem to have proper process group signal handling.
* Add checks for realpath(3) and a version from NetBSD for those without it.Todd C. Miller2023-02-121-0/+13
|
* sudo_fatal: Fix build where compiler recognises [[noreturn]] attribute (C23)Sam James2023-02-151-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | If the compiler supports [[noreturn]] as a attribute as in C23, then we define sudo_noreturn to be it. When that's the case, we must place it at the beginning of the declaration, before any other *extension* attributes (__attribute(...)). A bug has been filed with GCC regarding rejecting/accepting mixed attribute styles. sudo_dso_public is always an extension attribute, while sudo_noreturn only might be, so put it first. This only shows up with GCC 13 so far (see the linked GCC bug for a bit more exploration). Clang 16 does support the attribute but doesn't let you use it for earlier language versions (need to pass explicit -std=c2x, unlike with GCC here). This is essentially a followup to e707ffe58b3ccfe5c72f54c38eac1d7069d5021e. Tested with GCC 13.0.1 20230212 (unreleased), GCC 12.2.1 20230211, Clang 16.0.0_rc2, and Clang 15.0.7. Bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108796 Closes: https://github.com/sudo-project/sudo/issues/239 Fixes: e707ffe58b3ccfe5c72f54c38eac1d7069d5021e Fixes: 16ae61dcd7d3cd8bf6eb10a22fa742d4505da4e9
* Add eventlog_mail() to send a log message via mail.Todd C. Miller2023-02-091-0/+1
| | | | | This is used by mail_parse_errors() to send multi-line messages. Previously, the newlines would be escaped as control characters.
* Add configure test for NSIG, _NSIG or __NSIG.Todd C. Miller2023-01-311-4/+4
| | | | | This is better than just defining NSIG in sudo_compat.h if it is not defined since signal.h may not have been included.
* Add eventlog_store_sudo() and use it in sudoreplay.Todd C. Miller2023-01-221-3/+6
| | | | This replaces the custom log formatting used by "sudoreplay -l".
* Pass back the number of files to edit when using sudoedit.Todd C. Miller2023-01-181-2/+2
| | | | | The sudo front-end can use this to determine where the list of files to edit begins.
* Escape control characters in log messages and "sudoreplay -l" output.Todd C. Miller2023-01-181-0/+7
| | | | | | | | | | | | | | | The log message contains user-controlled strings that could include things like terminal control characters. Space characters in the command path are now also escaped. Command line arguments that contain spaces are surrounded with single quotes and any literal single quote or backslash characters are escaped with a backslash. This makes it possible to distinguish multiple command line arguments from a single argument that contains spaces. Issue found by Matthieu Barjole and Victor Cutillas of Synacktiv (https://synacktiv.com).
* sudo_lbuf_expand: check for possible integer overflowTodd C. Miller2023-01-031-6/+6
| | | | | | The numeric fields in struct sudo_lbuf are now unsigned so that wraparound is defined, this make the overflow checks simpler. Problem deteced by oss-fuzz using the fuzz_sudoers fuzzer.
* Move hexchar() from the sudoers plugin to lib/util.Todd C. Miller2023-01-031-0/+4
|
* Don't send warn/fatal output to the debug file when fuzzing.Todd C. Miller2022-12-301-0/+5
|
* Add basic regress for JSON functions.Todd C. Miller2022-12-151-1/+3
| | | | | Fix a bug in escaped control character handling. Roll back changes to buffer if sudo_json_add_value() fails.
* Use C23 [[__fallthrough__]] and [[__noreturn__]] attributes if supported.Todd C. Miller2022-11-291-6/+0
| | | | | If the C23 attributes are not supported, use gcc-style attributes where possible.
* Remove CMSG_* compatibility macros, they are no longer used.Todd C. Miller2022-11-091-20/+0
|
* Move forward declaration of struct stat before its first use.Todd C. Miller2022-11-091-1/+3
|
* Only add trailing carriage return to messages if output is a raw tty.Todd C. Miller2022-10-201-0/+2
| | | | | | | | If output is being written to a terminal in "raw" mode, we need to add a carriage return after the newline to avoid "stair-step" output. However, we should not write the carriage return if the terminal is in "cooked" mode, output to a pipe, or output redirected to a file. Bug #1042.
* Avoid a -Wshadow warning on Solaris 9.Todd C. Miller2022-10-073-18/+19
|
* Apply multiarch rules when loading plugins too.Todd C. Miller2022-10-061-0/+4
|
* Use mkdtempat_np() and mkostempsat_np() on macOSTodd C. Miller2022-09-221-12/+19
|
* Convert remaining uses of sudo_mkdir_parents() to sudo_open_parent_dir().Todd C. Miller2022-09-211-1/+1
|
* Add fchownat() systems without it.Todd C. Miller2022-09-211-0/+5
|
* Add mkdtempat() and mkostempsat() for systems without them.Todd C. Miller2022-09-211-2/+11
|
* Use sudo_secure_open_file() instead of sudo_secure_file() where possible.Todd C. Miller2022-09-211-6/+6
| | | | | Both sudo_secure_open_file() and sudo_secure_open_dir() are now passed a struct stat pointer like sudo_secure_file() and sudo_secure_dir().
* Fix potential TOCTOU when creating time stamp directory and file.Todd C. Miller2022-09-211-1/+7
|
* Update to protobuf-c 1.4.1Todd C. Miller2022-09-201-3/+3
| | | | We already had all the relevant fixes so this is just cosmetic.
* Move gcc-style __attribute__ macros to config.h.inTodd C. Miller2022-09-075-73/+25
| | | | | | | | Renamed __malloc -> sudo_malloclike, __printflike -> sudo_printflike, __printf0like -> sudo_printf0like. Add sudo_noreturn instead of __attribute__((__noreturn__)). We do not use stdnoreturn.h since it has been deprecated in C23 in favor of the [[noreturn]] attribute.
* Bump the sudo plugin minor version.Todd C. Miller2022-08-021-1/+1
| | | | | The "update_ticket" entry was added to the settings list and the "intercept_verify" entry was added to the command_info list.
* Use gcc's malloc attribute for malloc-like allocation functions.Todd C. Miller2022-07-262-5/+14
|
* For preload DSO make copies of cmnd, argv, envp and map them read-only.Todd C. Miller2022-07-251-0/+2
|
* Add sudo_mmap_{alloc,allocarrary,strdup,free} functions.Todd C. Miller2022-07-251-0/+10
| | | | | | | | These allocate memory via mmap anonymous regions and store the mapped size immediately before the returned pointer as an unsigned long. They are intended to be used in cases where malloc(3) and free(3) are unsuitable due to concerns about corrupting global state in multi-threaded programs or signal handlers.
* Stop sending an InterceptResponse to a PolicyCheckRequest for log_subcmds.Todd C. Miller2022-06-302-1/+6
| | | | | There's no real reason for the command to wait for sudo send back a response that will always be a PolicyAcceptMessage.
* Make sudo pass -Wwrite-stringsTodd C. Miller2022-06-281-1/+1
|
* Make sudo pass -Wmissing-prototypesTodd C. Miller2022-06-272-1/+3
|
* Fix typo, we should define SSIZE_MAX if it is not defined.Todd C. Miller2022-06-101-1/+1
|
* Fix building with select (not poll) when fd_set is not defined in sys/types.h.Todd C. Miller2022-06-061-4/+4
| | | | | We can use a void * for the fd_set arrays and just add a cast when using the FD_SET macros.
* Update to protobuf-c 1.4.0Todd C. Miller2022-06-033-57/+61
|
* Newer compilers define __BYTE_ORDER__ and __ORDER_{BIG,LITTLE}_ENDIAN__Todd C. Miller2022-05-311-3/+9
| | | | Also add riscv the little endian list.
* Merge branch 'main' into apparmor_supportTodd C. Miller2022-05-271-2/+2
|\
| * Bump plugin minor version and document new intercept-related settings.Todd C. Miller2022-05-261-2/+2
| | | | | | | | | | There should have been a minor version bump for sudo 1.9.8 when intercept was originally implemented.
* | Add an apparmor_profile sudo settingkernelmethod2022-05-231-0/+1
|/ | | | | | | | Define a new sudo setting, `apparmor_profile`, that can be used to pass in an AppArmor profile that should be used to confine commands. If apparmor_profile is specified, sudo will execute the command using the new `apparmor_execve` function, which confines the command under the provided profile before exec'ing it.
* Stop using the WCONTINUED flag with waitpid(2).Todd C. Miller2022-04-291-7/+1
| | | | | We don't use it for anything other than a debug message and it will cause problems when intercept mode starts using ptrace(2).
* Adjust starttime test when run under Debian faketime.Todd C. Miller2022-03-151-0/+7
| | | | Bug #1026
View Lorry Controller Status