From 5a59ce159e0c17fb35474c9c516d97703b338027 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Thu, 7 Jul 2022 20:11:44 -0600 Subject: [PATCH] Fix a NOPASSWD issue with a non-existent command when fdexec=always In command_matches_all(), if the command is fully-qualified and open_cmnd() return false, only treat it as an error if we are able to stat(2) the command. For "sudo ALL" a non-existent command is not an error. Reference: https://github.com/sudo-project/sudo/commit/5a59ce159e0c17fb35474c9c516d97703b338027 Conflict: match_command.c --- plugins/sudoers/match_command.c | 4 +++++-- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/plugins/sudoers/match_command.c b/plugins/sudoers/match_command.c index 6d8b3a6..e020e81 100644 --- a/plugins/sudoers/match_command.c +++ b/plugins/sudoers/match_command.c @@ -353,11 +353,15 @@ command_matches_all(const char *runchroot, if (user_cmnd[0] == '/') { /* Open the file for fdexec or for digest matching. */ - if (!open_cmnd(user_cmnd, runchroot, digests, &fd)) - goto bad; + bool open_error = !open_cmnd(user_cmnd, runchroot, digests, &fd); #ifndef SUDOERS_NAME_MATCH - if (!do_stat(fd, user_cmnd, runchroot, intercepted, NULL)) - goto bad; + /* A non-existent file is not an error for "sudo ALL". */ + if (do_stat(fd, user_cmnd, runchroot, intercepted, NULL)) { + if (open_error) { + /* File exists but we couldn't open it above? */ + goto bad; + } + } #endif } -- 2.33.0