44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
From 5a59ce159e0c17fb35474c9c516d97703b338027 Mon Sep 17 00:00:00 2001
|
|
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
|
|
Date: Thu, 7 Jul 2022 20:11:44 -0600
|
|
Subject: [PATCH] Fix a NOPASSWD issue with a non-existent command when
|
|
fdexec=always In command_matches_all(), if the command is fully-qualified and
|
|
open_cmnd() return false, only treat it as an error if we are able to stat(2)
|
|
the command. For "sudo ALL" a non-existent command is not an error.
|
|
|
|
Reference: https://github.com/sudo-project/sudo/commit/5a59ce159e0c17fb35474c9c516d97703b338027
|
|
Conflict: match_command.c
|
|
---
|
|
plugins/sudoers/match_command.c | 4 +++++--
|
|
1 file changed, 8 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/plugins/sudoers/match_command.c b/plugins/sudoers/match_command.c
|
|
index 6d8b3a6..e020e81 100644
|
|
--- a/plugins/sudoers/match_command.c
|
|
+++ b/plugins/sudoers/match_command.c
|
|
@@ -353,11 +353,15 @@ command_matches_all(const char *runchroot,
|
|
|
|
if (user_cmnd[0] == '/') {
|
|
/* Open the file for fdexec or for digest matching. */
|
|
- if (!open_cmnd(user_cmnd, runchroot, digests, &fd))
|
|
- goto bad;
|
|
+ bool open_error = !open_cmnd(user_cmnd, runchroot, digests, &fd);
|
|
#ifndef SUDOERS_NAME_MATCH
|
|
- if (!do_stat(fd, user_cmnd, runchroot, intercepted, NULL))
|
|
- goto bad;
|
|
+ /* A non-existent file is not an error for "sudo ALL". */
|
|
+ if (do_stat(fd, user_cmnd, runchroot, intercepted, NULL)) {
|
|
+ if (open_error) {
|
|
+ /* File exists but we couldn't open it above? */
|
|
+ goto bad;
|
|
+ }
|
|
+ }
|
|
#endif
|
|
}
|
|
|
|
--
|
|
2.33.0
|
|
|
|
|
|
|