You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

143 lines
4.5 KiB

From 93cef1efac4e2b4930c23cdc35c0b916365ccabc Mon Sep 17 00:00:00 2001
From: Tomas Sykora <tosykora@redhat.com>
Date: Tue, 21 Feb 2017 14:56:24 +0100
Subject: [PATCH] Add ignore_unknown_defaults flag to ignore unknown Defaults
entries in sudoers instead of producing a warning.
Patch: sudo-1.8.19p2-ignore-unknown-defaults.patch
Resolves:
rhbz#1413160
---
doc/sudoers.cat | 6 ++++++
doc/sudoers.man.in | 11 +++++++++++
doc/sudoers.mdoc.in | 10 ++++++++++
plugins/sudoers/def_data.c | 4 ++++
plugins/sudoers/def_data.h | 2 ++
plugins/sudoers/def_data.in | 3 +++
plugins/sudoers/defaults.c | 3 ++-
7 files changed, 38 insertions(+), 1 deletion(-)
diff --git a/doc/sudoers.cat b/doc/sudoers.cat
index 76dbf28..50cf78a 100644
--- a/doc/sudoers.cat
+++ b/doc/sudoers.cat
@@ -1071,6 +1071,12 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
meaningful for the cn=defaults section. This flag is
_o_f_f by default.
+ ignore_unknown_defaults
+ If set, ssuuddoo will not produce a warning if it
+ encounters an unknown Defaults entry in the _^Hs_^Hu_^Hd_^Ho_^He_^Hr_^Hs
+ file or an unknown sudoOption in LDAP. This flag is
+ _o_f_f by default.
+
insults If set, ssuuddoo will insult users when they enter an
incorrect password. This flag is _o_f_f by default.
diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in
index 8673da0..4be3760 100644
--- a/doc/sudoers.man.in
+++ b/doc/sudoers.man.in
@@ -2266,6 +2266,17 @@ This flag is
\fIoff\fR
by default.
.TP 18n
+ignore_unknown_defaults
+If set,
+\fBsudo\fR
+will not produce a warning if it encounters an unknown Defaults entry
+in the
+\fIsudoers\fR
+file or an unknown sudoOption in LDAP.
+This flag is
+\fIoff\fR
+by default.
+.TP 18n
insults
If set,
\fBsudo\fR
diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in
index 74b6f01..f3fe5e6 100644
--- a/doc/sudoers.mdoc.in
+++ b/doc/sudoers.mdoc.in
@@ -2124,6 +2124,16 @@ section.
This flag is
.Em off
by default.
+.It ignore_unknown_defaults
+If set,
+.Nm sudo
+will not produce a warning if it encounters an unknown Defaults entry
+in the
+.Em sudoers
+file or an unknown sudoOption in LDAP.
+This flag is
+.Em off
+by default.
.It insults
If set,
.Nm sudo
diff --git a/plugins/sudoers/def_data.c b/plugins/sudoers/def_data.c
index 3926fed..3d787c2 100644
--- a/plugins/sudoers/def_data.c
+++ b/plugins/sudoers/def_data.c
@@ -443,6 +443,10 @@ struct sudo_defs_types sudo_defs_table[] = {
N_("Don't pre-resolve all group names"),
NULL,
}, {
+ "ignore_unknown_defaults", T_FLAG,
+ N_("Ignore unknown Defaults entries in sudoers instead of producing a warning"),
+ NULL,
+ }, {
NULL, 0, NULL
}
};
diff --git a/plugins/sudoers/def_data.h b/plugins/sudoers/def_data.h
index b5e61b4..f5773a3 100644
--- a/plugins/sudoers/def_data.h
+++ b/plugins/sudoers/def_data.h
@@ -208,6 +208,8 @@
#define def_cmnd_no_wait (sudo_defs_table[I_CMND_NO_WAIT].sd_un.flag)
#define I_LEGACY_GROUP_PROCESSING 104
#define def_legacy_group_processing (sudo_defs_table[I_LEGACY_GROUP_PROCESSING].sd_un.flag)
+#define I_IGNORE_UNKNOWN_DEFAULTS 105
+#define def_ignore_unknown_defaults (sudo_defs_table[I_IGNORE_UNKNOWN_DEFAULTS].sd_un.flag)
enum def_tuple {
never,
diff --git a/plugins/sudoers/def_data.in b/plugins/sudoers/def_data.in
index f1c9265..8f63d70 100644
--- a/plugins/sudoers/def_data.in
+++ b/plugins/sudoers/def_data.in
@@ -328,3 +328,6 @@ cmnd_no_wait
legacy_group_processing
T_FLAG
"Don't pre-resolve all group names"
+ignore_unknown_defaults
+ T_FLAG
+ "Ignore unknown Defaults entries in sudoers instead of producing a warning"
diff --git a/plugins/sudoers/defaults.c b/plugins/sudoers/defaults.c
index 9e60d94..5f93f80 100644
--- a/plugins/sudoers/defaults.c
+++ b/plugins/sudoers/defaults.c
@@ -79,6 +79,7 @@ static struct strmap priorities[] = {
};
static struct early_default early_defaults[] = {
+ { I_IGNORE_UNKNOWN_DEFAULTS },
#ifdef FQDN
{ I_FQDN, true },
#else
@@ -206,7 +207,7 @@ find_default(const char *name, const char *file, int lineno, bool quiet)
if (strcmp(name, sudo_defs_table[i].name) == 0)
debug_return_int(i);
}
- if (!quiet) {
+ if (!quiet && !def_ignore_unknown_defaults) {
if (lineno > 0) {
sudo_warnx(U_("%s:%d unknown defaults entry \"%s\""),
file, lineno, name);
--
2.7.4