123 lines
4.4 KiB
Diff
123 lines
4.4 KiB
Diff
diff -up ./plugins/sudoers/editor.c.cve ./plugins/sudoers/editor.c
|
|
--- ./plugins/sudoers/editor.c.cve 2023-01-16 17:52:37.074066664 +0100
|
|
+++ ./plugins/sudoers/editor.c 2023-01-16 17:58:06.603774304 +0100
|
|
@@ -132,7 +132,7 @@ resolve_editor(const char *ed, size_t ed
|
|
const char *cp, *ep, *tmp;
|
|
const char *edend = ed + edlen;
|
|
struct stat user_editor_sb;
|
|
- int nargc;
|
|
+ int nargc = 0;
|
|
debug_decl(resolve_editor, SUDOERS_DEBUG_UTIL)
|
|
|
|
/*
|
|
@@ -149,9 +149,7 @@ resolve_editor(const char *ed, size_t ed
|
|
|
|
/* If we can't find the editor in the user's PATH, give up. */
|
|
if (find_path(editor, &editor_path, &user_editor_sb, getenv("PATH"), 0, allowlist) != FOUND) {
|
|
- free(editor);
|
|
- errno = ENOENT;
|
|
- debug_return_str(NULL);
|
|
+ goto bad;
|
|
}
|
|
|
|
/* Count rest of arguments and allocate editor argv. */
|
|
@@ -171,7 +169,19 @@ resolve_editor(const char *ed, size_t ed
|
|
nargv[nargc] = copy_arg(cp, ep - cp);
|
|
if (nargv[nargc] == NULL)
|
|
goto oom;
|
|
+
|
|
+ /*
|
|
+ * We use "--" to separate the editor and arguments from the files
|
|
+ * to edit. The editor arguments themselves may not contain "--".
|
|
+ */
|
|
+ if (strcmp(nargv[nargc], "--") == 0) {
|
|
+ sudo_warnx(U_("ignoring editor: %.*s"), (int)edlen, ed);
|
|
+ sudo_warnx("%s", U_("editor arguments may not contain \"--\""));
|
|
+ errno = EINVAL;
|
|
+ goto bad;
|
|
+ }
|
|
}
|
|
+
|
|
if (nfiles != 0) {
|
|
nargv[nargc++] = "--";
|
|
while (nfiles--)
|
|
@@ -184,6 +194,7 @@ resolve_editor(const char *ed, size_t ed
|
|
debug_return_str(editor_path);
|
|
oom:
|
|
sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
|
|
+bad:
|
|
free(editor);
|
|
free(editor_path);
|
|
if (nargv != NULL) {
|
|
diff -up ./plugins/sudoers/sudoers.c.cve ./plugins/sudoers/sudoers.c
|
|
--- ./plugins/sudoers/sudoers.c.cve 2023-01-16 17:52:37.074066664 +0100
|
|
+++ ./plugins/sudoers/sudoers.c 2023-01-16 18:02:43.928307505 +0100
|
|
@@ -634,21 +634,32 @@ sudoers_policy_main(int argc, char * con
|
|
|
|
/* Note: must call audit before uid change. */
|
|
if (ISSET(sudo_mode, MODE_EDIT)) {
|
|
- int edit_argc;
|
|
- const char *env_editor;
|
|
+ const char *env_editor = NULL;
|
|
+ int edit_argc;
|
|
|
|
free(safe_cmnd);
|
|
safe_cmnd = find_editor(NewArgc - 1, NewArgv + 1, &edit_argc,
|
|
&edit_argv, NULL, &env_editor, false);
|
|
if (safe_cmnd == NULL) {
|
|
- if (errno != ENOENT)
|
|
- goto done;
|
|
- audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
|
|
- env_editor ? env_editor : def_editor);
|
|
- sudo_warnx(U_("%s: command not found"),
|
|
- env_editor ? env_editor : def_editor);
|
|
- goto bad;
|
|
- }
|
|
+ switch (errno) {
|
|
+ case ENOENT:
|
|
+ audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
|
|
+ env_editor ? env_editor : def_editor);
|
|
+ sudo_warnx(U_("%s: command not found"),
|
|
+ env_editor ? env_editor : def_editor);
|
|
+ goto bad;
|
|
+ case EINVAL:
|
|
+ if (def_env_editor && env_editor != NULL) {
|
|
+ /* User tried to do something funny with the editor. */
|
|
+ log_warningx(SLOG_NO_STDERR|SLOG_SEND_MAIL,
|
|
+ "invalid user-specified editor: %s", env_editor);
|
|
+ goto bad;
|
|
+ }
|
|
+ default:
|
|
+ goto done;
|
|
+ }
|
|
+ }
|
|
+
|
|
if (audit_success(edit_argc, edit_argv) != 0 && !def_ignore_audit_errors)
|
|
goto done;
|
|
|
|
diff -up ./plugins/sudoers/visudo.c.cve ./plugins/sudoers/visudo.c
|
|
--- ./plugins/sudoers/visudo.c.cve 2019-10-28 13:28:54.000000000 +0100
|
|
+++ ./plugins/sudoers/visudo.c 2023-01-16 18:03:48.713975354 +0100
|
|
@@ -308,7 +308,7 @@ static char *
|
|
get_editor(int *editor_argc, char ***editor_argv)
|
|
{
|
|
char *editor_path = NULL, **whitelist = NULL;
|
|
- const char *env_editor;
|
|
+ const char *env_editor = NULL;
|
|
static char *files[] = { "+1", "sudoers" };
|
|
unsigned int whitelist_len = 0;
|
|
debug_decl(get_editor, SUDOERS_DEBUG_UTIL)
|
|
@@ -342,7 +342,11 @@ get_editor(int *editor_argc, char ***edi
|
|
if (editor_path == NULL) {
|
|
if (def_env_editor && env_editor != NULL) {
|
|
/* We are honoring $EDITOR so this is a fatal error. */
|
|
- sudo_fatalx(U_("specified editor (%s) doesn't exist"), env_editor);
|
|
+ if (errno == ENOENT) {
|
|
+ sudo_warnx(U_("specified editor (%s) doesn't exist"),
|
|
+ env_editor);
|
|
+ }
|
|
+ exit(EXIT_FAILURE);
|
|
}
|
|
sudo_fatalx(U_("no editor found (editor path = %s)"), def_editor);
|
|
}
|