Supporting sudoUser:!foo in sudo.ldap

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============0517663374494795469==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------y0HV60doGfGqlPkv9O0AM940"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------y0HV60doGfGqlPkv9O0AM940
Content-Type: multipart/mixed; boundary="------------X4d78kYMyi8LH6YaoZO86c4r";
 protected-headers="v1"
From: Simon Lees <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Supporting sudoUser:!foo in sudo.ldap

--------------X4d78kYMyi8LH6YaoZO86c4r
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi All,

Currently our usual sudo maintainers are busy on other projects so i've
been tasked with looking at the following feature request from a
customer, ideally we would like to upstream whatever we do so I thought
i'd discuss it here now that I have a decent idea of the issue and a
possible solution.

=46rom man sudo.ldap

Another difference is that it is not possible to use negation in a
sudoUser, sudoRunAsUser or sudoRunAsGroup attribute.  For example, the
following attributes do not behave

    the way one might expect.

         # does not match all but joe
         # rather, does not match anyone
         sudoUser: !joe

         # does not match all but joe
         # rather, matches everyone including Joe
         sudoUser: ALL
         sudoUser: !joe

We have customers that are after a way to do this (otherwise I probably
wouldn't be looking at it). Our in house ldap expert suggested that
introducing a global !joe option could potentially have some unintended
consequences but that implementing the second should be possible by
changing a query from

(&
    (|
        (sudoUser=3DNAME)
        (sudoUser=3DALL)
        (sudoUser=3D%GROUP_NAME)
    )
)

to

(&
    (|
        (sudoUser=3DNAME)
        (sudoUser=3DALL)
        (sudoUser=3D%GROUP_NAME)
    )
    (!
        (sudoUser=3D!NAME)
    )
)


I have a patch inline below that we have used to successfully test this
theory, which leaves us with the question of has this never been
implemented due to people not requesting it or due to other potential
issues that we have overlooked and secondly would this feature be
something that you are intestested in as an upstream.

This is our proof of concept patch, if the idea is suitable for upstream
then please let me know if there is a better place for me to submit it.

Thanks

Simon

Index: sudo-1.9.5p2/plugins/sudoers/ldap.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- sudo-1.9.5p2.orig/plugins/sudoers/ldap.c
+++ sudo-1.9.5p2/plugins/sudoers/ldap.c
@@ -986,6 +986,9 @@ sudo_ldap_build_pass1(LDAP *ld, struct p
     /* If timed, add space for time limits. */
     if (ldap_conf.timed)
 	sz +=3D TIMEFILTER_LENGTH;
+
+     /* Add space for ALL, !USER */
+     sz +=3D 15 + sudo_ldap_value_len(pw->pw_name);
     if ((buf =3D malloc(sz)) =3D=3D NULL)
 	goto bad;
     *buf =3D '\0';
@@ -1074,6 +1077,13 @@ sudo_ldap_build_pass1(LDAP *ld, struct p
     } else if (ldap_conf.search_filter) {
 	CHECK_STRLCAT(buf, ")", sz); /* closes the global OR */
     }
+
+    /* To support ALL, !USER now add a !check for sudoUser=3D!NAME */
+    /* Global ! + sudoUser=3D!user_name filter */
+    CHECK_STRLCAT(buf, "(!(sudoUser=3D!", sz);
+    CHECK_LDAP_VCAT(buf, pw->pw_name, sz);
+    CHECK_STRLCAT(buf, "))", sz);
+
     CHECK_STRLCAT(buf, ")", sz); /* closes the global OR or the global
AND */

     debug_return_str(buf);



--=20
Simon Lees (Simotek)                            http://simotek.net

Emergency Update Team                           keybase.io/simotek
SUSE Linux                           Adelaide Australia, UTC+10:30
GPG Fingerprint: 5B87 DB9D 88DC F606 E489 CEC5 0922 C246 02F0 014B

--------------X4d78kYMyi8LH6YaoZO86c4r--

--------------y0HV60doGfGqlPkv9O0AM940
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wsB5BAABCAAjFiEED0hBIYMo9ADHKtZgEdQumr4Y/JEFAmG2y1QFAwAAAAAACgkQEdQumr4Y/JGl
agf5AfOwvuICKyqiPOvXvk7lPlDf+lC38lycau27WBWjnD9or/GilOKt79lqu3VnocZXabNNe2AF
fg2x1A8stPIwkQrEYZ3Y4JHWGDba/BmdWrMQ0UiI/5FJtnTP24lrdxZ5KIUfiYcYD9dxEa8wik+G
DAPx5oTMe6k0bYwBt9SCwY1w1ZvFhfV9YIKH7OVdK/aY78kKq5+rTRCSlSprWw42eJ7QXPaBmEha
xFbNR8kBEaHfKz51mk1BTILhzc4w1iKV4hS/LEJWMuQUUzheyt7zX9ALhJ42mgI70jYSfB3AXcXs
kryMkiTAlXbTAH0chk9ivUqz8Z7DyaeqO97t4w3Exg==
=+mHn
-----END PGP SIGNATURE-----

--------------y0HV60doGfGqlPkv9O0AM940--

--===============0517663374494795469==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers

--===============0517663374494795469==--