Imported Upstream version 1.8.4p4

[debian/sudo] / plugins / sudoers / set_perms.c

diff --git a/plugins/sudoers/set_perms.c b/plugins/sudoers/set_perms.c
index 655ed298354899748ba82a87ddb3fe522bcaed92..0cadc88f01245c5d2a0f735207c45526ab476d34 100644 (file)
--- a/plugins/sudoers/set_perms.c
+++ b/plugins/sudoers/set_perms.c
@@ -82,9 +82,13 @@ static int perm_stack_depth = 0;
 void
 rewind_perms(void)
 {
+    debug_decl(rewind_perms, SUDO_DEBUG_PERMS)
+
     while (perm_stack_depth > 1)
        restore_perms();
     grlist_delref(perm_stack[0].grlist);
+
+    debug_return;
 }
 
 #ifdef HAVE_SETRESUID
@@ -101,6 +105,7 @@ set_perms(int perm)
     struct perm_state *state, *ostate = NULL;
     const char *errstr;
     int noexit;
+    debug_decl(set_perms, SUDO_DEBUG_PERMS)
 
     noexit = ISSET(perm, PERM_NOEXIT);
     CLR(perm, PERM_MASK);
@@ -279,13 +284,13 @@ set_perms(int perm)
 
 done:
     perm_stack_depth++;
-    return 1;
+    debug_return_bool(1);
 bad:
     /* XXX - better warnings inline */
     warningx("%s: %s", errstr,
        errno == EAGAIN ? _("too many processes") : strerror(errno));
     if (noexit)
-       return 0;
+       debug_return_bool(0);
     exit(1);
 }
 
@@ -293,9 +298,10 @@ void
 restore_perms(void)
 {
     struct perm_state *state, *ostate;
+    debug_decl(restore_perms, SUDO_DEBUG_PERMS)
 
     if (perm_stack_depth < 2)
-       return;
+       debug_return;
 
     state = &perm_stack[perm_stack_depth - 1];
     ostate = &perm_stack[perm_stack_depth - 2];
@@ -329,7 +335,7 @@ restore_perms(void)
        }
     }
     grlist_delref(state->grlist);
-    return;
+    debug_return;
 
 bad:
     exit(1);
@@ -350,6 +356,7 @@ set_perms(int perm)
     struct perm_state *state, *ostate = NULL;
     const char *errstr;
     int noexit;
+    debug_decl(set_perms, SUDO_DEBUG_PERMS)
 
     noexit = ISSET(perm, PERM_NOEXIT);
     CLR(perm, PERM_MASK);
@@ -385,19 +392,20 @@ set_perms(int perm)
 
     case PERM_ROOT:
        /*
-        * setreuid(0, 0) may fail on some systems
-        * when the euid is not already 0.
+        * setreuid(0, 0) may fail on some systems if euid is not already 0.
         */
-       if (setreuid(-1, ROOT_UID)) {
-           errstr = "setreuid(-1, ROOT_UID)";
-           goto bad;
+       if (ostate->euid != ROOT_UID) {
+           if (setreuid(-1, ROOT_UID)) {
+               errstr = "setreuid(-1, ROOT_UID)";
+               goto bad;
+           }
        }
-       if (setuid(ROOT_UID)) {
-           errstr = "setuid(ROOT_UID)";
+       state->euid = ROOT_UID;
+       if (setreuid(ID(ruid), -1)) {
+           errstr = "setreuid(ROOT_UID, -1)";
            goto bad;
        }
        state->ruid = ROOT_UID;
-       state->euid = ROOT_UID;
        state->rgid = -1;
        state->egid = -1;
        state->grlist = ostate->grlist;
@@ -509,13 +517,13 @@ set_perms(int perm)
 
 done:
     perm_stack_depth++;
-    return 1;
+    debug_return_bool(1);
 bad:
     /* XXX - better warnings inline */
     warningx("%s: %s", errstr,
        errno == EAGAIN ? _("too many processes") : strerror(errno));
     if (noexit)
-       return 0;
+       debug_return_bool(0);
     exit(1);
 }
 
@@ -523,9 +531,10 @@ void
 restore_perms(void)
 {
     struct perm_state *state, *ostate;
+    debug_decl(restore_perms, SUDO_DEBUG_PERMS)
 
     if (perm_stack_depth < 2)
-       return;
+       debug_return;
 
     state = &perm_stack[perm_stack_depth - 1];
     ostate = &perm_stack[perm_stack_depth - 2];
@@ -562,7 +571,7 @@ restore_perms(void)
        }
     }
     grlist_delref(state->grlist);
-    return;
+    debug_return;
 
 bad:
     exit(1);
@@ -583,6 +592,7 @@ set_perms(int perm)
     struct perm_state *state, *ostate = NULL;
     const char *errstr;
     int noexit;
+    debug_decl(set_perms, SUDO_DEBUG_PERMS)
 
     noexit = ISSET(perm, PERM_NOEXIT);
     CLR(perm, PERM_MASK);
@@ -747,13 +757,13 @@ set_perms(int perm)
 
 done:
     perm_stack_depth++;
-    return 1;
+    debug_return_bool(1);
 bad:
     /* XXX - better warnings inline */
     warningx("%s: %s", errstr,
        errno == EAGAIN ? _("too many processes") : strerror(errno));
     if (noexit)
-       return 0;
+       debug_return_bool(0);
     exit(1);
 }
 
@@ -761,9 +771,10 @@ void
 restore_perms(void)
 {
     struct perm_state *state, *ostate;
+    debug_decl(restore_perms, SUDO_DEBUG_PERMS)
 
     if (perm_stack_depth < 2)
-       return;
+       debug_return;
 
     state = &perm_stack[perm_stack_depth - 1];
     ostate = &perm_stack[perm_stack_depth - 2];
@@ -798,7 +809,7 @@ restore_perms(void)
        goto bad;
     }
     grlist_delref(state->grlist);
-    return;
+    debug_return;
 
 bad:
     exit(1);
@@ -817,6 +828,7 @@ set_perms(int perm)
     struct perm_state *state, *ostate = NULL;
     const char *errstr;
     int noexit;
+    debug_decl(set_perms, SUDO_DEBUG_PERMS)
 
     noexit = ISSET(perm, PERM_NOEXIT);
     CLR(perm, PERM_MASK);
@@ -887,13 +899,13 @@ set_perms(int perm)
 
 done:
     perm_stack_depth++;
-    return 1;
+    debug_return_bool(1);
 bad:
     /* XXX - better warnings inline */
     warningx("%s: %s", errstr,
        errno == EAGAIN ? _("too many processes") : strerror(errno));
     if (noexit)
-       return 0;
+       debug_return_bool(0);
     exit(1);
 }
 
@@ -901,9 +913,10 @@ void
 restore_perms(void)
 {
     struct perm_state *state, *ostate;
+    debug_decl(restore_perms, SUDO_DEBUG_PERMS)
 
     if (perm_stack_depth < 2)
-       return;
+       debug_return;
 
     state = &perm_stack[perm_stack_depth - 1];
     ostate = &perm_stack[perm_stack_depth - 2];
@@ -924,7 +937,7 @@ restore_perms(void)
        warning("setuid(%d)", (int)ostate->ruid);
        goto bad;
     }
-    return;
+    debug_return;
 
 bad:
     exit(1);
@@ -938,10 +951,11 @@ runas_setgroups(void)
 {
     struct passwd *pw;
     struct group_list *grlist;
+    debug_decl(runas_setgroups, SUDO_DEBUG_PERMS)
 
     if (def_preserve_groups) {
        grlist_addref(user_group_list);
-       return user_group_list;
+       debug_return_ptr(user_group_list);
     }
 
     pw = runas_pw ? runas_pw : sudo_user.pw;
@@ -954,5 +968,5 @@ runas_setgroups(void)
 #endif
     if (sudo_setgroups(grlist->ngids, grlist->gids) < 0)
        log_error(USE_ERRNO|MSG_ONLY, _("unable to set runas group vector"));
-    return grlist;
+    debug_return_ptr(grlist);
 }