2 * Copyright (c) 2009-2011 Todd C. Miller <Todd.Miller@courtesan.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #include <sys/types.h>
20 #include <sys/param.h>
30 #endif /* STDC_HEADERS */
34 # include "compat/stdbool.h"
38 #endif /* HAVE_STRING_H */
41 #endif /* HAVE_STRINGS_H */
44 #endif /* HAVE_UNISTD_H */
48 #define SUDO_ERROR_WRAP 0
54 #include "pathnames.h"
55 #include "sudo_plugin.h"
56 #include "sudo_conf.h"
57 #include "sudo_debug.h"
58 #include "secure_path.h"
62 # define ROOT_UID 65535
67 #ifndef _PATH_SUDO_ASKPASS
68 # define _PATH_SUDO_ASKPASS NULL
71 extern bool atobool(const char *str); /* atobool.c */
73 struct sudo_conf_table {
76 bool (*setter)(const char *entry);
79 struct sudo_conf_paths {
81 unsigned int pnamelen;
85 static bool set_debug(const char *entry);
86 static bool set_path(const char *entry);
87 static bool set_plugin(const char *entry);
88 static bool set_variable(const char *entry);
90 static struct sudo_conf_table sudo_conf_table[] = {
91 { "Debug", sizeof("Debug") - 1, set_debug },
92 { "Path", sizeof("Path") - 1, set_path },
93 { "Plugin", sizeof("Plugin") - 1, set_plugin },
94 { "Set", sizeof("Set") - 1, set_variable },
98 static struct sudo_conf_data {
99 bool disable_coredump;
100 const char *debug_flags;
101 struct sudo_conf_paths paths[3];
102 struct plugin_info_list plugins;
107 #define SUDO_CONF_ASKPASS_IDX 0
108 { "askpass", sizeof("askpass") - 1, _PATH_SUDO_ASKPASS },
109 #ifdef _PATH_SUDO_NOEXEC
110 #define SUDO_CONF_NOEXEC_IDX 1
111 { "noexec", sizeof("noexec") - 1, _PATH_SUDO_NOEXEC },
118 * "Set variable_name value"
121 set_variable(const char *entry)
124 #define DC_LEN (sizeof("disable_coredump") - 1)
125 /* Currently the only variable supported is "disable_coredump". */
126 if (strncmp(entry, "disable_coredump", DC_LEN) == 0 &&
127 isblank((unsigned char)entry[DC_LEN])) {
129 while (isblank((unsigned char)*entry))
131 sudo_conf_data.disable_coredump = atobool(entry);
138 * "Debug progname debug_file debug_flags"
141 set_debug(const char *entry)
143 size_t filelen, proglen;
144 const char *progname;
145 char *debug_file, *debug_flags;
147 /* Is this debug setting for me? */
148 progname = getprogname();
149 if (strcmp(progname, "sudoedit") == 0)
151 proglen = strlen(progname);
152 if (strncmp(entry, progname, proglen) != 0 ||
153 !isblank((unsigned char)entry[proglen]))
155 entry += proglen + 1;
156 while (isblank((unsigned char)*entry))
159 debug_flags = strpbrk(entry, " \t");
160 if (debug_flags == NULL)
162 filelen = (size_t)(debug_flags - entry);
163 while (isblank((unsigned char)*debug_flags))
166 /* Set debug file and parse the flags (init debug as soon as possible). */
167 debug_file = estrndup(entry, filelen);
168 debug_flags = estrdup(debug_flags);
169 sudo_debug_init(debug_file, debug_flags);
172 sudo_conf_data.debug_flags = debug_flags;
178 set_path(const char *entry)
180 const char *name, *path;
181 struct sudo_conf_paths *cur;
183 /* Parse Path line */
185 path = strpbrk(entry, " \t");
188 while (isblank((unsigned char)*path))
191 /* Match supported paths, ignore the rest. */
192 for (cur = sudo_conf_data.paths; cur->pname != NULL; cur++) {
193 if (strncasecmp(name, cur->pname, cur->pnamelen) == 0 &&
194 isblank((unsigned char)name[cur->pnamelen])) {
195 cur->pval = estrdup(path);
204 set_plugin(const char *entry)
206 struct plugin_info *info;
207 const char *name, *path, *cp, *ep;
208 char **options = NULL;
209 size_t namelen, pathlen;
212 /* Parse Plugin line */
214 path = strpbrk(entry, " \t");
217 namelen = (size_t)(path - name);
218 while (isblank((unsigned char)*path))
220 if ((cp = strpbrk(path, " \t")) != NULL) {
221 /* Convert any options to an array. */
222 pathlen = (size_t)(cp - path);
223 while (isblank((unsigned char)*cp))
225 /* Count number of options and allocate array. */
226 for (ep = cp, nopts = 1; (ep = strpbrk(ep, " \t")) != NULL; nopts++) {
227 while (isblank((unsigned char)*ep))
230 options = emalloc2(nopts + 1, sizeof(*options));
231 /* Fill in options array, there is at least one element. */
232 for (nopts = 0; (ep = strpbrk(cp, " \t")) != NULL; ) {
233 options[nopts++] = estrndup(cp, (size_t)(ep - cp));
234 while (isblank((unsigned char)*ep))
238 options[nopts++] = estrdup(cp);
239 options[nopts] = NULL;
241 /* No extra options. */
242 pathlen = strlen(path);
245 info = ecalloc(1, sizeof(*info));
246 info->symbol_name = estrndup(name, namelen);
247 info->path = estrndup(path, pathlen);
248 info->options = options;
250 /* info->next = NULL; */
251 tq_append(&sudo_conf_data.plugins, info);
257 sudo_conf_askpass_path(void)
259 return sudo_conf_data.paths[SUDO_CONF_ASKPASS_IDX].pval;
262 #ifdef _PATH_SUDO_NOEXEC
264 sudo_conf_noexec_path(void)
266 return sudo_conf_data.paths[SUDO_CONF_NOEXEC_IDX].pval;
271 sudo_conf_debug_flags(void)
273 return sudo_conf_data.debug_flags;
276 struct plugin_info_list *
277 sudo_conf_plugins(void)
279 return &sudo_conf_data.plugins;
283 sudo_conf_disable_coredump(void)
285 return sudo_conf_data.disable_coredump;
289 * Reads in /etc/sudo.conf and populates sudo_conf_data.
294 struct sudo_conf_table *cur;
299 switch (sudo_secure_file(_PATH_SUDO_CONF, ROOT_UID, -1, &sb)) {
300 case SUDO_PATH_SECURE:
302 case SUDO_PATH_MISSING:
303 /* Root should always be able to read sudo.conf. */
304 if (errno != ENOENT && geteuid() == ROOT_UID)
305 warning(_("unable to stat %s"), _PATH_SUDO_CONF);
307 case SUDO_PATH_BAD_TYPE:
308 warningx(_("%s is not a regular file"), _PATH_SUDO_CONF);
310 case SUDO_PATH_WRONG_OWNER:
311 warningx(_("%s is owned by uid %u, should be %u"),
312 _PATH_SUDO_CONF, (unsigned int) sb.st_uid, ROOT_UID);
314 case SUDO_PATH_WORLD_WRITABLE:
315 warningx(_("%s is world writable"), _PATH_SUDO_CONF);
317 case SUDO_PATH_GROUP_WRITABLE:
318 warningx(_("%s is group writable"), _PATH_SUDO_CONF);
325 if ((fp = fopen(_PATH_SUDO_CONF, "r")) == NULL) {
326 if (errno != ENOENT && geteuid() == ROOT_UID)
327 warning(_("unable to open %s"), _PATH_SUDO_CONF);
331 while ((cp = sudo_parseln(fp)) != NULL) {
332 /* Skip blank or comment lines */
336 for (cur = sudo_conf_table; cur->name != NULL; cur++) {
337 if (strncasecmp(cp, cur->name, cur->namelen) == 0 &&
338 isblank((unsigned char)cp[cur->namelen])) {
340 while (isblank((unsigned char)*cp))