-1.8.0a1 May 24, 2010 1
+1.8.0a1 May 27, 2010 1
const char *list_user);
int (*validate)(void);
void (*invalidate)(int remove);
+ int (*init_session)(struct passwd *pwd);
};
The policy_plugin struct has the following fields:
A pointer to the conversation function that can be used by the
plugin to interact with the user (see below).
- plugin_printf
- A pointer to a printf-style function that may be used to
-1.8.0a1 May 24, 2010 2
+
+1.8.0a1 May 27, 2010 2
SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+ plugin_printf
+ A pointer to a printf-style function that may be used to
display informational or error messages (see below).
settings
from the check_policy function, which will cause s\bsu\bud\bdo\bo to
print a usage message and exit.
- preserve_groups=bool
- Set to true if the user specified the -P flag, indicating
- that the user wishes to preserve the group vector instead
-1.8.0a1 May 24, 2010 3
+
+1.8.0a1 May 27, 2010 3
SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+ preserve_groups=bool
+ Set to true if the user specified the -P flag, indicating
+ that the user wishes to preserve the group vector instead
of setting it based on the runas user.
ignore_ticket=bool
user_info
A vector of information about the user running the command in
- the form of "name=value" strings. The vector is terminated by
- a NULL pointer.
-
-1.8.0a1 May 24, 2010 4
+1.8.0a1 May 27, 2010 4
SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+ the form of "name=value" strings. The vector is terminated by
+ a NULL pointer.
+
When parsing _\bu_\bs_\be_\br_\b__\bi_\bn_\bf_\bo, the plugin should split on the f\bfi\bir\brs\bst\bt
equal sign ('=') since the _\bn_\ba_\bm_\be field will never include one
itself but the _\bv_\ba_\bl_\bu_\be might.
void (*close)(int exit_status, int error);
The close function is called when the command being run by s\bsu\bud\bdo\bo
- finishes.
-
- The function arguments are as follows:
-1.8.0a1 May 24, 2010 5
+1.8.0a1 May 27, 2010 5
SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+ finishes.
+
+ The function arguments are as follows:
+
exit_status
The command's exit status, as returned by the _\bw_\ba_\bi_\bt(2) system
call. The value of exit_status is undefined if error is non-
s\bsu\bud\bdo\boe\bed\bdi\bit\bt was specified but is unsupported by the plugin. In the
latter case, s\bsu\bud\bdo\bo will print a usage message before it exits. If
an error occurs, the plugin may optionally call the conversation or
- plugin_printf function with SUDO_CONF_ERROR_MSG to present
- additional error information to the user.
-
- The function arguments are as follows:
-1.8.0a1 May 24, 2010 6
+1.8.0a1 May 27, 2010 6
SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+ plugin_printf function with SUDO_CONF_ERROR_MSG to present
+ additional error information to the user.
+
+ The function arguments are as follows:
+
argc
The number of elements in _\ba_\br_\bg_\bv, not counting the final NULL
pointer.
the form of a comma-separated list of group IDs. If
_\bp_\br_\be_\bs_\be_\br_\bv_\be_\b__\bg_\br_\bo_\bu_\bp_\bs is set, this option is ignored.
- login_class=login_class
- BSD login class to use when setting resource limits and
- nice value (optional). This option is only set on systems
- that support login classes.
-
-1.8.0a1 May 24, 2010 7
+1.8.0a1 May 27, 2010 7
SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+ login_class=login_class
+ BSD login class to use when setting resource limits and
+ nice value (optional). This option is only set on systems
+ that support login classes.
+
preserve_groups=bool
If set, s\bsu\bud\bdo\bo will preserve the user's group vector instead
of initializing the group vector based on runas_user.
system call when executing the command. The plugin is
responsible for allocating and populating the vector.
- user_env_out
- The NULL-terminated environment vector to use when executing
- the command. The plugin is responsible for allocating and
- populating the vector.
-
-1.8.0a1 May 24, 2010 8
+1.8.0a1 May 27, 2010 8
SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+ user_env_out
+ The NULL-terminated environment vector to use when executing
+ the command. The plugin is responsible for allocating and
+ populating the vector.
+
list
int (*list)(int verbose, const char *list_user,
int argc, char * const argv[]);
function with SUDO_CONF_ERROR_MSG to present additional error
information to the user.
- invalidate
- void (*invalidate)(int remove);
- The invalidate function is called when s\bsu\bud\bdo\bo is called with the -k
- or -K flag. For policy plugins such as _\bs_\bu_\bd_\bo_\be_\br_\bs that cache
- authentication credentials, this function will invalidate the
-1.8.0a1 May 24, 2010 9
+1.8.0a1 May 27, 2010 9
SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+ invalidate
+ void (*invalidate)(int remove);
+
+ The invalidate function is called when s\bsu\bud\bdo\bo is called with the -k
+ or -K flag. For policy plugins such as _\bs_\bu_\bd_\bo_\be_\br_\bs that cache
+ authentication credentials, this function will invalidate the
credentials. If the _\br_\be_\bm_\bo_\bv_\be flag is set, the plugin may remove the
credentials instead of simply invalidating them.
The invalidate function should be NULL if the plugin does not
support credential caching.
+ init_session
+ int (*init_session)(struct passwd *pwd);
+
+ The init_session function is called when s\bsu\bud\bdo\bo sets up the execution
+ environment for the command, immediately before the contents of the
+ _\bc_\bo_\bm_\bm_\ba_\bn_\bd_\b__\bi_\bn_\bf_\bo list are applied (before the uid changes). This can
+ be used to do session setup that is not supported by _\bc_\bo_\bm_\bm_\ba_\bn_\bd_\b__\bi_\bn_\bf_\bo,
+ such as opening the PAM session.
+
+ The _\bp_\bw_\bd argument points to a passwd struct for the user the command
+ will be run as if the uid the command will run as was found in the
+ password database, otherwise it will be NULL.
+
+ Returns 1 on success, 0 on failure and -1 on error. On error, the
+ plugin may optionally call the conversation or plugin_printf
+ function with SUDO_CONF_ERROR_MSG to present additional error
+ information to the user.
+
_\bC_\bo_\bn_\bv_\be_\br_\bs_\ba_\bt_\bi_\bo_\bn _\bA_\bP_\bI
If the plugin needs to interact with the user, it may do so via the
struct sudo_conv_reply {
char *reply;
+
+
+
+1.8.0a1 May 27, 2010 10
+
+
+
+
+
+SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+
+
};
typedef int (*sudo_conv_t)(int num_msgs,
needed and supports standard _\bp_\br_\bi_\bn_\bt_\bf_\b(_\b) escape sequences.
See the sample plugin for an example of the conversation function
-
-
-
-1.8.0a1 May 24, 2010 10
-
-
-
-
-
-SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
-
-
usage.
I\bI/\b/O\bO P\bPl\blu\bug\bgi\bin\bn A\bAP\bPI\bI
device (note that this will include input even when echo is disabled,
such as when a password is read). The log_ttyout function receives
output from the pseudo-tty that is suitable for replaying the user's
+
+
+
+1.8.0a1 May 27, 2010 11
+
+
+
+
+
+SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+
+
session at a later time. The log_stdin, log_stdout and log_stderr
functions are only called if the standard input, standard output or
standard error respectively correspond to something other than a tty.
char * const user_info[], int argc, char * const argv[],
char * const user_env[]);
-
-
-1.8.0a1 May 24, 2010 11
-
-
-
-
-
-SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
-
-
The _\bo_\bp_\be_\bn function is run before the _\bl_\bo_\bg_\b__\bi_\bn_\bp_\bu_\bt, _\bl_\bo_\bg_\b__\bo_\bu_\bt_\bp_\bu_\bt or
_\bs_\bh_\bo_\bw_\b__\bv_\be_\br_\bs_\bi_\bo_\bn functions are called. It is only called if the
version is being requested or the _\bc_\bh_\be_\bc_\bk_\b__\bp_\bo_\bl_\bi_\bc_\by function has
show_version below). The plugin_printf function may also be
used to display additional error message to the user.
+
+
+
+1.8.0a1 May 27, 2010 12
+
+
+
+
+
+SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+
+
settings
A vector of user-supplied s\bsu\bud\bdo\bo settings in the form of
"name=value" strings. The vector is terminated by a NULL
See the "Policy Plugin API" section for a list of all possible
strings.
-
-
-1.8.0a1 May 24, 2010 12
-
-
-
-
-
-SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
-
-
argc
The number of elements in _\ba_\br_\bg_\bv, not counting the final NULL
pointer.
exit_status
The command's exit status, as returned by the _\bw_\ba_\bi_\bt(2) system
call. The value of exit_status is undefined if error is non-
+
+
+
+1.8.0a1 May 27, 2010 13
+
+
+
+
+
+SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+
+
zero.
error
passed to the command, 0 if the data is rejected (which will
terminate the command) or -1 if an error occurred.
-
-
-
-1.8.0a1 May 24, 2010 13
-
-
-
-
-
-SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
-
-
The function arguments are as follows:
buf The buffer containing user input.
The _\bl_\bo_\bg_\b__\bs_\bt_\bd_\bi_\bn function is only used if the standard input does not
correspond to a tty device. It is called whenever data can be read
from the standard input but before it is passed to the running
+
+
+
+1.8.0a1 May 27, 2010 14
+
+
+
+
+
+SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+
+
command. This allows the plugin to reject data if it chooses to
(for instance if the input contains banned content). Returns 1 if
the data should be passed to the command, 0 if the data is rejected
buf The buffer containing command output.
-
-
-
-1.8.0a1 May 24, 2010 14
-
-
-
-
-
-SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
-
-
len The length of _\bb_\bu_\bf in bytes.
log_stderr
S\bSu\bud\bdo\bo i\bim\bmp\bpl\ble\bem\bme\ben\bnt\bta\bat\bti\bio\bon\bn d\bde\bet\bta\bai\bil\bls\bs
Version macros:
+
+
+
+
+
+1.8.0a1 May 27, 2010 15
+
+
+
+
+
+SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m)
+
+
#define SUDO_API_VERSION_GET_MAJOR(v) ((v) >> 16)
#define SUDO_API_VERSION_GET_MINOR(v) ((v) & 0xffff)
#define SUDO_API_VERSION_SET_MAJOR(vp, n) do { \
struct io_plugin io;
};
-P\bPO\bOD\bD E\bER\bRR\bRO\bOR\bRS\bS
- Hey! T\bTh\bhe\be a\bab\bbo\bov\bve\be d\bdo\boc\bcu\bum\bme\ben\bnt\bt h\bha\bad\bd s\bso\bom\bme\be c\bco\bod\bdi\bin\bng\bg e\ber\brr\bro\bor\brs\bs,\b, w\bwh\bhi\bic\bch\bh a\bar\bre\be e\bex\bxp\bpl\bla\bai\bin\bne\bed\bd
- b\bbe\bel\blo\bow\bw:\b:
- Around line 609:
- You forgot a '=back' before '=head3'
-1.8.0a1 May 24, 2010 15
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1.8.0a1 May 27, 2010 16
.\" ========================================================================
.\"
.IX Title "SUDO_PLUGIN @mansectsu@"
-.TH SUDO_PLUGIN @mansectsu@ "May 24, 2010" "1.8.0a1" "MAINTENANCE COMMANDS"
+.TH SUDO_PLUGIN @mansectsu@ "May 27, 2010" "1.8.0a1" "MAINTENANCE COMMANDS"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
\& const char *list_user);
\& int (*validate)(void);
\& void (*invalidate)(int remove);
+\& int (*init_session)(struct passwd *pwd);
\& };
.Ve
.PP
.Sp
The \f(CW\*(C`invalidate\*(C'\fR function should be \f(CW\*(C`NULL\*(C'\fR if the plugin does not
support credential caching.
+.IP "init_session" 4
+.IX Item "init_session"
+.Vb 1
+\& int (*init_session)(struct passwd *pwd);
+.Ve
+.Sp
+The \f(CW\*(C`init_session\*(C'\fR function is called when \fBsudo\fR sets up the
+execution environment for the command, immediately before the
+contents of the \fIcommand_info\fR list are applied (before the uid
+changes). This can be used to do session setup that is not supported
+by \fIcommand_info\fR, such as opening the \s-1PAM\s0 session.
+.Sp
+The \fIpwd\fR argument points to a passwd struct for the user the
+command will be run as if the uid the command will run as was found
+in the password database, otherwise it will be \s-1NULL\s0.
+.Sp
+Returns 1 on success, 0 on failure and \-1 on error.
+On error, the plugin may optionally call the conversation or plugin_printf
+function with \f(CW\*(C`SUDO_CONF_ERROR_MSG\*(C'\fR to present additional
+error information to the user.
.PP
\fIConversation \s-1API\s0\fR
.IX Subsection "Conversation API"
\& struct io_plugin io;
\& };
.Ve
-.SH "POD ERRORS"
-.IX Header "POD ERRORS"
-Hey! \fBThe above document had some coding errors, which are explained below:\fR
-.IP "Around line 609:" 4
-.IX Item "Around line 609:"
-You forgot a '=back' before '=head3'
projects / sudo / commitdiff