Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
sudo.32785
sudo-fix_NULL_deref_RunAs.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File sudo-fix_NULL_deref_RunAs.patch of Package sudo.32785
From f4e169610f2955e400f45a024c918e179959332b Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" <Todd.Miller@sudo.ws> Date: Wed, 7 Dec 2022 10:25:00 -0700 Subject: [PATCH] Fix potential crash introduced in the fix for GitHub issue #134. If a user's sudoers entry did not have any RunAs user's set, running "sudo -U otheruser -l" would dereference a NULL pointer. We need to compare the default RunAs user if the sudoers entry does not specify one explicitly. Problem reported by Andreas Mueller who also suggested a different solution in PR #219. --HG-- branch : 1.9 --- plugins/sudoers/parse.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/plugins/sudoers/parse.c b/plugins/sudoers/parse.c index 3745efbe2..361bc0fd5 100644 --- a/plugins/sudoers/parse.c +++ b/plugins/sudoers/parse.c @@ -35,6 +35,23 @@ #include "sudo_lbuf.h" #include <gram.h> +static int +runas_matches_pw(struct sudoers_parse_tree *parse_tree, + const struct cmndspec *cs, const struct passwd *pw) +{ + debug_decl(runas_matches_pw, SUDOERS_DEBUG_PARSER); + + if (cs->runasuserlist != NULL) + debug_return_int(userlist_matches(parse_tree, pw, cs->runasuserlist)); + + if (cs->runasgrouplist == NULL) { + /* No explicit runas user or group, use default. */ + if (userpw_matches(def_runas_default, pw->pw_name, pw)) + debug_return_int(ALLOW); + } + debug_return_int(UNSPEC); +} + /* * Look up the user in the sudoers parse tree for pseudo-commands like * list, verify and kill. @@ -101,12 +118,10 @@ sudoers_lookup_pseudo(struct sudo_nss_list *snl, struct passwd *pw, continue; } /* Runas user must match list user or root. */ - if (userlist_matches(nss->parse_tree, list_pw, - cs->runasuserlist) == DENY) { + if (runas_matches_pw(nss->parse_tree, cs, list_pw) == DENY) continue; - } - if (root_pw == NULL || userlist_matches(nss->parse_tree, - root_pw, cs->runasuserlist) != ALLOW) { + if (root_pw == NULL || runas_matches_pw(nss->parse_tree, + cs, root_pw) != ALLOW) { continue; } if (cmnd_matches(nss->parse_tree, cs->cmnd, cs->runchroot,
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor