Merge commit 'upstream/1.7.2p6'

[debian/sudo] / sudoers.pod

diff --git a/sudoers.pod b/sudoers.pod
index bbc2264d2bda249219b768ce2cf91f53909226fe..5dda7050d08a04539e9b1a875098c4411226eb50 100644 (file)
--- a/sudoers.pod
+++ b/sudoers.pod
@@ -1,4 +1,4 @@
-Copyright (c) 1994-1996, 1998-2005, 2007-2009
+Copyright (c) 1994-1996, 1998-2005, 2007-2010
        Todd C. Miller <Todd.Miller@courtesan.com>
 
 Permission to use, copy, modify, and distribute this software for any
@@ -18,7 +18,6 @@ Sponsored in part by the Defense Advanced Research Projects
 Agency (DARPA) and Air Force Research Laboratory, Air Force
 Materiel Command, USAF, under agreement number F39502-99-1-0512.
 
-$Sudo: sudoers.pod,v 1.173 2009/06/30 12:41:09 millert Exp $
 =pod
 
 =head1 NAME
@@ -809,7 +808,12 @@ system that is mounted on demand (automounted).  The I<fast_glob>
 option causes B<sudo> to use the L<fnmatch(3)> function, which does
 not access the file system to do its matching.  The disadvantage
 of I<fast_glob> is that it is unable to match relative pathnames
-such as F<./ls> or F<../bin/ls>.  This flag is I<off> by default.
+such as F<./ls> or F<../bin/ls>.  This has security implications
+when path names that include globbing characters are used with the
+negation operator, C<'!'>, as such rules can be trivially bypassed.
+As such, this option should not be used when I<sudoers> contains rules
+that contain negated path names which include globbing characters.
+This flag is I<off> by default.
 
 =item stay_setuid
 
@@ -1470,6 +1474,22 @@ different name, or use a shell escape from an editor or other
 program.  Therefore, these kind of restrictions should be considered
 advisory at best (and reinforced by policy).
 
+Furthermore, if the I<fast_glob> option is in use, it is not possible
+to reliably negate commands where the path name includes globbing
+(aka wildcard) characters.  This is because the C library's
+L<fnmatch(3)> function cannot resolve relative paths.  While this
+is typically only an inconvenience for rules that grant privileges,
+it can result in a security issue for rules that subtract or revoke
+privileges.
+
+For example, given the following I<sudoers> entry:
+
+ john  ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,
+      /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
+
+User B<john> can still run C</usr/bin/passwd root> if I<fast_glob> is
+enabled by changing to F</usr/bin> and running C<./passwd root> instead.
+
 =head1 PREVENTING SHELL ESCAPES
 
 Once B<sudo> executes a program, that program is free to do whatever