Repository navigation
sudo_ldap_role_to_priv: treat an invalid sudoNotAfter as expired - #580
Merged
Merged
Conversation
parse_gentime() returns -1 on error, which is also the value of UNSPEC, so a sudoNotBefore or sudoNotAfter value that cannot be parsed made the sudoRole unrestricted instead of time-limited. parse_gentime() only accepted one fraction digit, so a valid GeneralizedTime such as 20200101000000.00Z took this path and an expired role kept working. The sudoers grammar already rejects an invalid NOTBEFORE/NOTAFTER value. Treat a role with an unparseable time as expired, warning when warnings are enabled, and let parse_gentime() skip any number of fraction digits. Add check_gentime cases and a testsudoers regression test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
sudo_ldap_role_to_priv() stores parse_gentime() for sudoNotBefore/sudoNotAfter without checking it, and the -1 error value is the same as UNSPEC, which sudoers_lookup() reads as "no time restriction". parse_gentime() also only accepted one fraction digit, so a valid GeneralizedTime like
sudoNotAfter: 20200101000000.00Zfails to parse and the expired role keeps granting the command. With SSSD (sudo_timed defaults to false) or LDAP with SUDOERS_TIMED off, sudo is the only thing enforcing the limit;testsudoers -i ldifprints "Command allowed" for such a role, while the sudoers grammar rejects the same value.An unparseable time now makes the role expired (NOTAFTER at the epoch) with a warning when warnings are on, which matches what the sudoers parser does by refusing the rule. parse_gentime() now skips the remaining fraction digits so valid directory values work. check_gentime gets multi-digit fraction cases and testsudoers test34 covers the LDIF path; it fails before the change and
make checkin plugins/sudoers passes after.