Re: [sudo-users] log_output and log_input destination directories and files ownership and permissions
Daniele Palumbo <[email protected]>
| Newsgroups | gmane.comp.tools.sudo.devel |
|---|---|
| Message-ID | <[email protected]> |
Il giorno 26/ott/2016, alle ore 21:15, Todd C. Miller <[email protected]> ha scritto: > The mode and owner for the I/O log files is not currently configurable. > There's no reason it can't be made configurable, there simply hasn't > been a demand for that before. > > Sudo doesn't explicitly set the group on I/O log files. For file > systems with BSD group semantics the group is inherited from the > parent directory. Otherwise, the files get the user's group. Since > the file mode doesn't allow group access this is not a big deal. > > I'll put this on the roadmap for sudo 1.8.19. Hey Todd, i am sure that this may be done in a better way, but here we may have the first working patch. it still include some useless code, and do not cover all of the options, but i wish to get a feedback on this. code cleanup has to be done. A brief on the concept: the new parameter iolog_perm can be set with one octal mode. Default value is 700, as now. The allowed range is 700 to 770, as now. Files will have the exec bit removed for UGO. Documentation is missing as now. Next step, if this is more or less ok, is to allow a user and group to be changed in a similar way, plus setting the default group to root. waiting for some feedback, Thanks, Daniele ____________________________________________________________ sudo-workers mailing list <[email protected]> For list information, options, or to unsubscribe, visit: https://www.sudo.ws/mailman/listinfo/sudo-workers
sudo-perm.diff
(application/octet-stream, 7.3 KB)
diff -r 86e6144dfdd7 plugins/sudoers/def_data.c
--- a/plugins/sudoers/def_data.c Fri Oct 21 10:06:14 2016 -0600
+++ b/plugins/sudoers/def_data.c Sat Oct 29 00:17:11 2016 +0000
@@ -423,6 +423,10 @@
N_("Log entries larger than this value will be split into multiple syslog messages"),
NULL,
}, {
+ "iolog_perm", T_MODE,
+ N_("Default persmission for input/output logs: 0%o"),
+ NULL,
+ }, {
NULL, 0, NULL
}
};
diff -r 86e6144dfdd7 plugins/sudoers/def_data.h
--- a/plugins/sudoers/def_data.h Fri Oct 21 10:06:14 2016 -0600
+++ b/plugins/sudoers/def_data.h Sat Oct 29 00:17:11 2016 +0000
@@ -198,6 +198,8 @@
#define def_match_group_by_gid (sudo_defs_table[I_MATCH_GROUP_BY_GID].sd_un.flag)
#define I_SYSLOG_MAXLEN 99
#define def_syslog_maxlen (sudo_defs_table[I_SYSLOG_MAXLEN].sd_un.uival)
+#define I_IOLOG_PERM 100
+#define def_iolog_perm (sudo_defs_table[I_IOLOG_PERM].sd_un.mode)
enum def_tuple {
never,
diff -r 86e6144dfdd7 plugins/sudoers/def_data.in
--- a/plugins/sudoers/def_data.in Fri Oct 21 10:06:14 2016 -0600
+++ b/plugins/sudoers/def_data.in Sat Oct 29 00:17:11 2016 +0000
@@ -283,6 +283,9 @@
maxseq
T_UINT
"Maximum I/O log sequence number: %u"
+iolog_perm
+ T_MODE
+ "Permission for I/O logs: 0%o"
use_netgroups
T_FLAG
"Enable sudoers netgroup support"
diff -r 86e6144dfdd7 plugins/sudoers/iolog.c
--- a/plugins/sudoers/iolog.c Fri Oct 21 10:06:14 2016 -0600
+++ b/plugins/sudoers/iolog.c Sat Oct 29 00:17:11 2016 +0000
@@ -71,6 +71,8 @@
static bool warned = false;
static struct timeval last_time;
static unsigned int sessid_max = SESSID_MAX;
+static mode_t iolog_perm = IOLOG_PERM_STD;
+static mode_t ugoexec = S_IXUSR + S_IXGRP + S_IXOTH;
/* sudoers_io is declared at the end of this file. */
extern __dso_public struct io_plugin sudoers_io;
@@ -192,6 +194,49 @@
}
/*
+ * Set max session ID (aka sequence number)
+ */
+static bool
+iolog_set_perm(const char *perm)
+{
+ const char *errstr;
+ unsigned int value;
+ debug_decl(iolog_set_perm, SUDOERS_DEBUG_UTIL)
+
+
+ value = strtonum(perm, IOLOG_PERM_MIN, IOLOG_PERM_MAX, &errstr);
+ // TODO to be reviewed
+ if (errstr != NULL) {
+ if (errno != ERANGE) {
+ sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+ "bad permission: %s: %s", perm, errstr);
+ debug_return_bool(false);
+ }
+ /* Out of range, clamp to IOLOG_PERM_MAX as documented. */
+ value = IOLOG_PERM_MIN;
+ }
+ iolog_perm = value;
+ debug_return_bool(true);
+}
+
+/*
+ * Sudoers callback for iolog permission Defaults setting.
+ */
+bool
+cb_iolog_perm(const union sudo_defs_val *sd_un)
+{
+ debug_decl(cb_iolog_perm, SUDOERS_DEBUG_UTIL)
+
+ /* Clamp value to SESSID_MIN as documented. */
+ // TODO have to get how to do the control. This is just a control.
+ //sessid_max = sd_un->uival < SESSID_MAX ? sd_un->uival : SESSID_MAX;
+ iolog_perm = sd_un->uival > IOLOG_PERM_MIN ? sd_un->uival : IOLOG_PERM_MIN;
+ sudo_debug_printf(SUDO_DEBUG_DEBUG, "default iolog permission set: 0%o", iolog_perm);
+ debug_return_bool(true);
+}
+
+
+/*
* Read the on-disk sequence number, set sessid to the next
* number, and update the on-disk copy.
* Uses file locking to avoid sequence number collisions.
@@ -212,7 +257,7 @@
/*
* Create I/O log directory if it doesn't already exist.
*/
- if (!io_mkdirs(iolog_dir, S_IRWXU, false))
+ if (!io_mkdirs(iolog_dir, iolog_perm, false))
goto done;
/*
@@ -224,7 +269,7 @@
log_warning(SLOG_SEND_MAIL, "%s/seq", pathbuf);
goto done;
}
- fd = open(pathbuf, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR);
+ fd = open(pathbuf, O_RDWR|O_CREAT, iolog_perm & ~ugoexec);
if (fd == -1) {
log_warning(SLOG_SEND_MAIL, N_("unable to open %s"), pathbuf);
goto done;
@@ -243,7 +288,7 @@
len = snprintf(fallback, sizeof(fallback), "%s/seq",
iolog_dir_fallback);
if (len > 0 && (size_t)len < sizeof(fallback)) {
- int fd2 = open(fallback, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR);
+ int fd2 = open(fallback, O_RDWR|O_CREAT, iolog_perm & ~ugoexec);
if (fd2 != -1) {
nread = read(fd2, buf, sizeof(buf) - 1);
if (nread > 0) {
@@ -340,7 +385,7 @@
*/
if (len >= 6 && strcmp(&pathbuf[len - 6], "XXXXXX") == 0)
is_temp = true;
- if (!io_mkdirs(pathbuf, S_IRWXU, is_temp))
+ if (!io_mkdirs(pathbuf, iolog_perm, is_temp))
len = (size_t)-1;
debug_return_size_t(len);
@@ -360,7 +405,7 @@
pathbuf[len] = '\0';
strlcat(pathbuf, iol->suffix, PATH_MAX);
if (iol->enabled) {
- int fd = open(pathbuf, O_CREAT|O_TRUNC|O_WRONLY, S_IRUSR|S_IWUSR);
+ int fd = open(pathbuf, O_CREAT|O_TRUNC|O_WRONLY, iolog_perm & ~ugoexec);
if (fd != -1) {
(void)fcntl(fd, F_SETFD, FD_CLOEXEC);
#ifdef HAVE_ZLIB_H
@@ -491,6 +536,10 @@
iolog_compress = true; /* must be global */
continue;
}
+ if (strncmp(*cur, "iolog_perm=", sizeof("iolog_perm=") - 1) == 0) {
+ iolog_set_perm(*cur + sizeof("iolog_perm=") - 1);
+ continue;
+ }
break;
case 'm':
if (strncmp(*cur, "maxseq=", sizeof("maxseq=") - 1) == 0) {
@@ -577,7 +626,7 @@
pathbuf[len] = '\0';
strlcat(pathbuf, "/log", PATH_MAX);
- fd = open(pathbuf, O_CREAT|O_TRUNC|O_WRONLY, S_IRUSR|S_IWUSR);
+ fd = open(pathbuf, O_CREAT|O_TRUNC|O_WRONLY, iolog_perm & ~ugoexec);
if (fd == -1 || (fp = fdopen(fd, "w")) == NULL) {
log_warning(SLOG_SEND_MAIL, N_("unable to create %s"), pathbuf);
debug_return_bool(false);
diff -r 86e6144dfdd7 plugins/sudoers/iolog.h
--- a/plugins/sudoers/iolog.h Fri Oct 21 10:06:14 2016 -0600
+++ b/plugins/sudoers/iolog.h Sat Oct 29 00:17:11 2016 +0000
@@ -31,6 +31,10 @@
/* Default maximum session ID */
#define SESSID_MAX 2176782336U
+/* Default maximum and standard permission mask for io logging */
+#define IOLOG_PERM_MAX 0770
+#define IOLOG_PERM_MIN 0700
+#define IOLOG_PERM_STD 0700
union io_fd {
FILE *f;
diff -r 86e6144dfdd7 plugins/sudoers/policy.c
--- a/plugins/sudoers/policy.c Fri Oct 21 10:06:14 2016 -0600
+++ b/plugins/sudoers/policy.c Sat Oct 29 00:17:11 2016 +0000
@@ -443,6 +443,10 @@
if (asprintf(&command_info[info_len++], "maxseq=%u", def_maxseq) == -1)
goto oom;
}
+ if (def_iolog_perm) {
+ if (asprintf(&command_info[info_len++], "iolog_perm=%u", def_iolog_perm) == -1)
+ goto oom;
+ }
}
if (ISSET(sudo_mode, MODE_EDIT)) {
if ((command_info[info_len++] = strdup("sudoedit=true")) == NULL)
diff -r 86e6144dfdd7 plugins/sudoers/sudoers.c
--- a/plugins/sudoers/sudoers.c Fri Oct 21 10:06:14 2016 -0600
+++ b/plugins/sudoers/sudoers.c Sat Oct 29 00:17:11 2016 +0000
@@ -723,6 +723,9 @@
/* Set maxseq callback. */
sudo_defs_table[I_MAXSEQ].callback = cb_maxseq;
+ /* Set iolog permission callback. */
+ sudo_defs_table[I_IOLOG_PERM].callback = cb_iolog_perm;
+
/* It is now safe to use log_warningx() and set_perms() */
if (unknown_user) {
log_warningx(SLOG_SEND_MAIL, N_("unknown uid: %u"),
diff -r 86e6144dfdd7 plugins/sudoers/sudoers.h
--- a/plugins/sudoers/sudoers.h Fri Oct 21 10:06:14 2016 -0600
+++ b/plugins/sudoers/sudoers.h Sat Oct 29 00:17:11 2016 +0000
@@ -328,6 +328,7 @@
/* iolog.c */
bool io_nextid(char *iolog_dir, char *iolog_dir_fallback, char sessid[7]);
bool cb_maxseq(const union sudo_defs_val *sd_un);
+bool cb_iolog_perm(const union sudo_defs_val *sd_un);
/* iolog_path.c */
char *expand_iolog_path(const char *prefix, const char *dir, const char *file,
signature.asc
(application/pgp-signature, 204 B)
-----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iEYEARECAAYFAlgT6+oACgkQ8Tj5mfSC1FQwRwCfcOTrVNLpiqpFav0e9Iz0nqOr lvcAoICgAWFRMlTMv8rGvAREYndD/gVm =SfBs -----END PGP SIGNATURE-----