1 From ce16b664df514c4d8b0e6b8733ae1dce3561a2a4 Mon Sep 17 00:00:00 2001
2 From: "Sar Ashki, Babak" <Babak.SarAshki@windriver.com>
3 Date: Wed, 11 Dec 2019 19:43:19 -0800
6 plugins/sudoers/cvtsudoers.c | 9 +++++++++
7 plugins/sudoers/def_data.c | 4 ++++
8 plugins/sudoers/def_data.h | 2 ++
9 plugins/sudoers/def_data.in | 3 +++
10 plugins/sudoers/defaults.c | 3 +++
11 plugins/sudoers/sudoers.c | 4 ++++
12 6 files changed, 25 insertions(+)
14 diff --git a/plugins/sudoers/cvtsudoers.c b/plugins/sudoers/cvtsudoers.c
15 index 0221314..9d21d2f 100644
16 --- a/plugins/sudoers/cvtsudoers.c
17 +++ b/plugins/sudoers/cvtsudoers.c
18 @@ -346,6 +346,15 @@ main(int argc, char *argv[])
19 sudo_fatalx("error: unhandled input %d", input_format);
23 + * cvtsudoers group filtering doesn't work if def_match_group_by_gid
24 + * is set to true by default (at compile-time). It cannot be set to false
25 + * because cvtsudoers doesn't apply the parsed Defaults.
27 + * Related: sudo-1.8.23-legacy-group-processing.patch
29 + def_match_group_by_gid = def_legacy_group_processing = false;
32 filter_userspecs(&parsed_policy, conf);
33 filter_defaults(&parsed_policy, conf);
34 diff --git a/plugins/sudoers/def_data.c b/plugins/sudoers/def_data.c
35 index 07e3433..5fa45bb 100644
36 --- a/plugins/sudoers/def_data.c
37 +++ b/plugins/sudoers/def_data.c
38 @@ -494,6 +494,10 @@ struct sudo_defs_types sudo_defs_table[] = {
39 N_("Ignore case when matching group names"),
42 + "legacy_group_processing", T_FLAG,
43 + N_("Don't pre-resolve all group names"),
49 diff --git a/plugins/sudoers/def_data.h b/plugins/sudoers/def_data.h
50 index 65f10c3..940fa8f 100644
51 --- a/plugins/sudoers/def_data.h
52 +++ b/plugins/sudoers/def_data.h
54 #define def_case_insensitive_user (sudo_defs_table[I_CASE_INSENSITIVE_USER].sd_un.flag)
55 #define I_CASE_INSENSITIVE_GROUP 113
56 #define def_case_insensitive_group (sudo_defs_table[I_CASE_INSENSITIVE_GROUP].sd_un.flag)
57 +#define I_LEGACY_GROUP_PROCESSING 114
58 +#define def_legacy_group_processing (sudo_defs_table[I_LEGACY_GROUP_PROCESSING].sd_un.flag)
62 diff --git a/plugins/sudoers/def_data.in b/plugins/sudoers/def_data.in
63 index 99d4360..571bc96 100644
64 --- a/plugins/sudoers/def_data.in
65 +++ b/plugins/sudoers/def_data.in
66 @@ -357,3 +357,6 @@ case_insensitive_user
67 case_insensitive_group
69 "Ignore case when matching group names"
70 +legacy_group_processing
72 + "Don't pre-resolve all group names"
73 diff --git a/plugins/sudoers/defaults.c b/plugins/sudoers/defaults.c
74 index 4c8c262..970755e 100644
75 --- a/plugins/sudoers/defaults.c
76 +++ b/plugins/sudoers/defaults.c
77 @@ -91,6 +91,7 @@ static struct early_default early_defaults[] = {
80 { I_MATCH_GROUP_BY_GID },
81 + { I_LEGACY_GROUP_PROCESSING },
85 @@ -492,6 +493,8 @@ init_defaults(void)
88 /* First initialize the flags. */
89 + def_legacy_group_processing = true;
90 + def_match_group_by_gid = true;
91 #ifdef LONG_OTP_PROMPT
92 def_long_otp_prompt = true;
94 diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
95 index 1267949..d8f4dd0 100644
96 --- a/plugins/sudoers/sudoers.c
97 +++ b/plugins/sudoers/sudoers.c
98 @@ -217,6 +217,10 @@ sudoers_policy_init(void *info, char * const envp[])
99 if (set_loginclass(runas_pw ? runas_pw : sudo_user.pw))
102 + if (!def_match_group_by_gid || !def_legacy_group_processing) {
103 + def_match_group_by_gid = false;
104 + def_legacy_group_processing = false;
107 if (!restore_perms())