File feature-not-user-ldap.patch of Package sudo.27014
From e88087721be391ec851b3cad8a88a5476f03d317 Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
Date: Tue, 18 Jan 2022 11:20:22 -0700
Subject: [PATCH] Add support in the LDAP filter for negated users. Based on a
diff from Simon Lees
---
docs/sudoers.ldap.man.in | 31 ++++------
docs/sudoers.ldap.mdoc.in | 28 ++++-----
plugins/sudoers/ldap.c | 116 ++++++++++++++++++++++++++++----------
3 files changed, 109 insertions(+), 66 deletions(-)
Index: sudo-1.8.27/plugins/sudoers/ldap.c
===================================================================
--- sudo-1.8.27.orig/plugins/sudoers/ldap.c
+++ sudo-1.8.27/plugins/sudoers/ldap.c
@@ -314,18 +314,18 @@ sudo_ldap_get_values_len(LDAP *ld, LDAPM
/*
* Walk through search results and return true if we have a matching
* non-Unix group (including netgroups), else false.
+ * A matching entry that is negated will always return false.
*/
static int
sudo_ldap_check_non_unix_group(LDAP *ld, LDAPMessage *entry, struct passwd *pw)
{
struct berval **bv, **p;
bool ret = false;
- char *val;
int rc;
debug_decl(sudo_ldap_check_non_unix_group, SUDOERS_DEBUG_LDAP)
if (!entry)
- debug_return_bool(ret);
+ debug_return_bool(false);
/* get the values from the entry */
bv = sudo_ldap_get_values_len(ld, entry, "sudoUser", &rc);
@@ -337,18 +337,29 @@ sudo_ldap_check_non_unix_group(LDAP *ld,
/* walk through values */
for (p = bv; *p != NULL && !ret; p++) {
- val = (*p)->bv_val;
+ bool negated = false;
+ char *val = (*p)->bv_val;
+
+ if (*val == '!') {
+ val++;
+ negated = true;
+ }
if (*val == '+') {
if (netgr_matches(val, def_netgroup_tuple ? user_runhost : NULL,
def_netgroup_tuple ? user_srunhost : NULL, pw->pw_name))
ret = true;
- DPRINTF2("ldap sudoUser netgroup '%s' ... %s", val,
- ret ? "MATCH!" : "not");
+ DPRINTF2("ldap sudoUser netgroup '%s%s' ... %s",
+ negated ? "!" : "", val, ret ? "MATCH!" : "not");
} else {
if (group_plugin_query(pw->pw_name, val + 2, pw))
ret = true;
- DPRINTF2("ldap sudoUser non-Unix group '%s' ... %s", val,
- ret ? "MATCH!" : "not");
+ DPRINTF2("ldap sudoUser non-Unix group '%s%s' ... %s",
+ negated ? "!" : "", val, ret ? "MATCH!" : "not");
+ }
+ /* A negated match overrides all other entries. */
+ if (ret && negated) {
+ ret = false;
+ break;
}
}
@@ -900,7 +911,8 @@ done:
static char *
sudo_ldap_build_pass1(LDAP *ld, struct passwd *pw)
{
- char *buf, timebuffer[TIMEFILTER_LENGTH + 1], gidbuf[MAX_UID_T_LEN + 1];
+ char timebuffer[TIMEFILTER_LENGTH + 1], idbuf[MAX_UID_T_LEN + 1];
+ char *buf, *notbuf;
struct ldap_netgroup_list netgroups;
struct ldap_netgroup *ng = NULL;
struct gid_list *gidlist;
@@ -913,33 +925,44 @@ sudo_ldap_build_pass1(LDAP *ld, struct p
STAILQ_INIT(&netgroups);
/* If there is a filter, allocate space for the global AND. */
- if (ldap_conf.timed || ldap_conf.search_filter)
+ if (ldap_conf.timed || ldap_conf.search_filter) {
+ /* Allocate space for the global AND. */
sz += 3;
- /* Add LDAP search filter if present. */
- if (ldap_conf.search_filter)
- sz += strlen(ldap_conf.search_filter);
+ /* Add LDAP search filter if present. */
+ if (ldap_conf.search_filter)
+ sz += strlen(ldap_conf.search_filter);
+
+ /* If timed, add space for time limits. */
+ if (ldap_conf.timed)
+ sz += TIMEFILTER_LENGTH;
+ }
- /* Then add (|(sudoUser=USERNAME)(sudoUser=ALL)) + NUL */
- sz += 29 + sudo_ldap_value_len(pw->pw_name);
+ /* Add space for the global OR clause + (sudoUser=ALL) + NOT + NUL. */
+ sz += sizeof("(|(sudoUser=ALL)(!(|)))");
+
+ /* Add space for username and uid, including the negated versions. */
+ sz += ((sizeof("(sudoUser=)(sudoUser=#)") - 1 +
+ sudo_ldap_value_len(pw->pw_name) + MAX_UID_T_LEN) * 2) + 2;
/* Add space for primary and supplementary groups and gids */
if ((grp = sudo_getgrgid(pw->pw_gid)) != NULL) {
- sz += 12 + sudo_ldap_value_len(grp->gr_name);
+ sz += ((sizeof("(sudoUser=%)") - 1 +
+ sudo_ldap_value_len(grp->gr_name)) * 2) + 1;
}
- sz += 13 + MAX_UID_T_LEN;
+ sz += ((sizeof("(sudoUser=%#)") - 1 + MAX_UID_T_LEN) * 2) + 1;
if ((grlist = sudo_get_grlist(pw)) != NULL) {
for (i = 0; i < grlist->ngroups; i++) {
if (grp != NULL && strcasecmp(grlist->groups[i], grp->gr_name) == 0)
continue;
- sz += 12 + sudo_ldap_value_len(grlist->groups[i]);
- }
+ sz += ((sizeof("(sudoUser=%)") - 1 +
+ sudo_ldap_value_len(grlist->groups[i])) * 2) + 1; }
}
if ((gidlist = sudo_get_gidlist(pw, ENTRY_TYPE_ANY)) != NULL) {
for (i = 0; i < gidlist->ngids; i++) {
if (pw->pw_gid == gidlist->gids[i])
continue;
- sz += 13 + MAX_UID_T_LEN;
+ sz += ((sizeof("(sudoUser=%#)") - 1 + MAX_UID_T_LEN) * 2) + 1;
}
}
@@ -948,7 +971,7 @@ sudo_ldap_build_pass1(LDAP *ld, struct p
DPRINTF1("Looking up netgroups for %s", pw->pw_name);
if (sudo_netgroup_lookup(ld, pw, &netgroups)) {
STAILQ_FOREACH(ng, &netgroups, entries) {
- sz += 14 + strlen(ng->name);
+ sz += ((sizeof("(sudoUser=+)") - 1 + strlen(ng->name)) * 2) + 1;
}
} else {
/* sudo_netgroup_lookup() failed, clean up. */
@@ -960,12 +983,12 @@ sudo_ldap_build_pass1(LDAP *ld, struct p
}
}
- /* If timed, add space for time limits. */
- if (ldap_conf.timed)
- sz += TIMEFILTER_LENGTH;
- if ((buf = malloc(sz)) == NULL)
+ buf = malloc(sz);
+ notbuf = malloc(sz);
+ if (buf == NULL || notbuf == NULL)
goto bad;
*buf = '\0';
+ *notbuf = '\0';
/*
* If timed or using a search filter, start a global AND clause to
@@ -981,17 +1004,26 @@ sudo_ldap_build_pass1(LDAP *ld, struct p
CHECK_STRLCAT(buf, "(|(sudoUser=", sz);
CHECK_LDAP_VCAT(buf, pw->pw_name, sz);
CHECK_STRLCAT(buf, ")", sz);
+ CHECK_STRLCAT(notbuf, "(sudoUser=!", sz);
+ CHECK_LDAP_VCAT(notbuf, pw->pw_name, sz);
+ CHECK_STRLCAT(notbuf, ")", sz);
/* Append primary group and gid */
if (grp != NULL) {
CHECK_STRLCAT(buf, "(sudoUser=%", sz);
CHECK_LDAP_VCAT(buf, grp->gr_name, sz);
CHECK_STRLCAT(buf, ")", sz);
+ CHECK_STRLCAT(notbuf, "(sudoUser=!%", sz);
+ CHECK_LDAP_VCAT(notbuf, grp->gr_name, sz);
+ CHECK_STRLCAT(notbuf, ")", sz);
}
- (void) snprintf(gidbuf, sizeof(gidbuf), "%u", (unsigned int)pw->pw_gid);
+ (void) snprintf(idbuf, sizeof(idbuf), "%u", (unsigned int)pw->pw_gid);
CHECK_STRLCAT(buf, "(sudoUser=%#", sz);
- CHECK_STRLCAT(buf, gidbuf, sz);
+ CHECK_STRLCAT(buf, idbuf, sz);
CHECK_STRLCAT(buf, ")", sz);
+ CHECK_STRLCAT(notbuf, "(sudoUser=!#", sz);
+ CHECK_STRLCAT(notbuf, idbuf, sz);
+ CHECK_STRLCAT(notbuf, ")", sz);
/* Append supplementary groups and gids */
if (grlist != NULL) {
@@ -1001,17 +1033,23 @@ sudo_ldap_build_pass1(LDAP *ld, struct p
CHECK_STRLCAT(buf, "(sudoUser=%", sz);
CHECK_LDAP_VCAT(buf, grlist->groups[i], sz);
CHECK_STRLCAT(buf, ")", sz);
+ CHECK_STRLCAT(notbuf, "(sudoUser=!%", sz);
+ CHECK_LDAP_VCAT(notbuf, grlist->groups[i], sz);
+ CHECK_STRLCAT(notbuf, ")", sz);
}
}
if (gidlist != NULL) {
for (i = 0; i < gidlist->ngids; i++) {
if (pw->pw_gid == gidlist->gids[i])
continue;
- (void) snprintf(gidbuf, sizeof(gidbuf), "%u",
+ (void) snprintf(idbuf, sizeof(idbuf), "%u",
(unsigned int)gidlist->gids[i]);
CHECK_STRLCAT(buf, "(sudoUser=%#", sz);
- CHECK_STRLCAT(buf, gidbuf, sz);
+ CHECK_STRLCAT(buf, idbuf, sz);
CHECK_STRLCAT(buf, ")", sz);
+ CHECK_STRLCAT(notbuf, "(sudoUser=!%#", sz);
+ CHECK_STRLCAT(notbuf, idbuf, sz);
+ CHECK_STRLCAT(notbuf, ")", sz);
}
}
@@ -1029,12 +1067,20 @@ sudo_ldap_build_pass1(LDAP *ld, struct p
CHECK_STRLCAT(buf, "(sudoUser=+", sz);
CHECK_LDAP_VCAT(buf, ng->name, sz);
CHECK_STRLCAT(buf, ")", sz);
+ CHECK_STRLCAT(notbuf, "(sudoUser=!+", sz);
+ CHECK_LDAP_VCAT(notbuf, ng->name, sz);
+ CHECK_STRLCAT(notbuf, ")", sz);
free(ng->name);
free(ng);
}
- /* Add ALL to list and end the global OR. */
- CHECK_STRLCAT(buf, "(sudoUser=ALL)", sz);
+ /* Add ALL to list. */
+ CHECK_STRLCAT(buf, "(sudoUser=ALL))", sz);
+
+ /* Add filter for negated entries. */
+ CHECK_STRLCAT(buf, "(!(|", sz);
+ CHECK_STRLCAT(buf, notbuf, sz);
+ CHECK_STRLCAT(buf, ")", sz);
/* Add the time restriction, or simply end the global OR. */
if (ldap_conf.timed) {
@@ -1045,8 +1091,10 @@ sudo_ldap_build_pass1(LDAP *ld, struct p
} else if (ldap_conf.search_filter) {
CHECK_STRLCAT(buf, ")", sz); /* closes the global OR */
}
+
CHECK_STRLCAT(buf, ")", sz); /* closes the global OR or the global AND */
+ free(notbuf);
debug_return_str(buf);
overflow:
sudo_warnx(U_("internal error, %s overflow"), __func__);
@@ -1063,6 +1111,7 @@ bad:
free(ng);
}
free(buf);
+ free(notbuf);
debug_return_str(NULL);
}
@@ -1099,16 +1148,18 @@ sudo_ldap_build_pass2(void)
* those get ANDed in to the expression.
*/
if (query_netgroups && def_group_plugin) {
- len = asprintf(&filt, "%s%s(|(sudoUser=+*)(sudoUser=%%:*))%s%s",
+ len = asprintf(&filt, "%s%s(|(sudoUser=+*)(sudoUser=!+*)(sudoUser=%%:*)(sudoUser=!%%:*))%s%s",
(ldap_conf.timed || ldap_conf.search_filter) ? "(&" : "",
ldap_conf.search_filter ? ldap_conf.search_filter : "",
ldap_conf.timed ? timebuffer : "",
(ldap_conf.timed || ldap_conf.search_filter) ? ")" : "");
} else {
- len = asprintf(&filt, "(&%s(sudoUser=*)(sudoUser=%s*)%s)",
+ len = asprintf(&filt, "%s%s(|(sudoUser=%s*)(sudoUser=!%s*))%s%s",
+ (ldap_conf.timed || ldap_conf.search_filter) ? "(&" : "",
ldap_conf.search_filter ? ldap_conf.search_filter : "",
- query_netgroups ? "+" : "%:",
- ldap_conf.timed ? timebuffer : "");
+ query_netgroups ? "+" : "%:", query_netgroups ? "+" : "%:",
+ ldap_conf.timed ? timebuffer : "",
+ (ldap_conf.timed || ldap_conf.search_filter) ? ")" : "");
}
if (len == -1)
filt = NULL;
