Add padding option to cvtsudoers.

Bug #856

diff --git a/MANIFEST b/MANIFEST
index 6a3afa4004680a1cbe4fdadc4b594bff77de5873..8c15d0b0db536223ed4ed1ed049fd2fa730e267e 100644 (file)
--- a/MANIFEST
+++ b/MANIFEST
@@ -454,6 +454,11 @@ plugins/sudoers/regress/cvtsudoers/test3.out.ok
 plugins/sudoers/regress/cvtsudoers/test3.sh
 plugins/sudoers/regress/cvtsudoers/test30.out.ok
 plugins/sudoers/regress/cvtsudoers/test30.sh
+plugins/sudoers/regress/cvtsudoers/test31.conf
+plugins/sudoers/regress/cvtsudoers/test31.out.ok
+plugins/sudoers/regress/cvtsudoers/test31.sh
+plugins/sudoers/regress/cvtsudoers/test32.out.ok
+plugins/sudoers/regress/cvtsudoers/test32.sh
 plugins/sudoers/regress/cvtsudoers/test4.out.ok
 plugins/sudoers/regress/cvtsudoers/test4.sh
 plugins/sudoers/regress/cvtsudoers/test5.out.ok

diff --git a/doc/cvtsudoers.cat b/doc/cvtsudoers.cat
index d01a7e654e27efcaf9b84ea093aad3a95e8d3392..61bf3a28d9e5a013a6a7c47f8d2b993c1cf43295 100644 (file)
--- a/doc/cvtsudoers.cat
+++ b/doc/cvtsudoers.cat
@@ -160,6 +160,17 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
                  out non-matching users, groups and hosts from matching
                  entries.
 
+     -\b-P\bP _\bp_\ba_\bd_\bd_\bi_\bn_\bg, -\b--\b-p\bpa\bad\bdd\bdi\bin\bng\bg=_\bp_\ba_\bd_\bd_\bi_\bn_\bg
+                 When generating LDIF output, construct the initial sudoOrder
+                 value by concatenating _\bo_\br_\bd_\be_\br_\b__\bs_\bt_\ba_\br_\bt and _\bi_\bn_\bc_\br_\be_\bm_\be_\bn_\bt, padding the
+                 _\bi_\bn_\bc_\br_\be_\bm_\be_\bn_\bt with zeros until it consists of _\bp_\ba_\bd_\bd_\bi_\bn_\bg digits.
+                 For example, if _\bo_\br_\bd_\be_\br_\b__\bs_\bt_\ba_\br_\bt is 1027, _\bp_\ba_\bd_\bd_\bi_\bn_\bg is 3, and
+                 _\bi_\bn_\bc_\br_\be_\bm_\be_\bn_\bt is 1, the value of sudoOrder for the first entry
+                 will be 1027000, followed by 1027001, 1027002, etc.  If the
+                 number of sudoRole entries is larger than the padding would
+                 allow, c\bcv\bvt\bts\bsu\bud\bdo\boe\ber\brs\bs will exit with an error.  By default, no
+                 padding is performed.
+
      -\b-s\bs _\bs_\be_\bc_\bt_\bi_\bo_\bn_\bs, -\b--\b-s\bsu\bup\bpp\bpr\bre\bes\bss\bs=_\bs_\be_\bc_\bt_\bi_\bo_\bn_\bs
                  Suppress the output of specific _\bs_\be_\bc_\bt_\bi_\bo_\bn_\bs of the security
                  policy.  One or more section names may be specified,
@@ -265,4 +276,4 @@ D\bDI\bIS\bSC\bCL\bLA\bAI\bIM\bME\bER\bR
      file distributed with s\bsu\bud\bdo\bo or https://www.sudo.ws/license.html for
      complete details.
 
-Sudo 1.8.25                     April 14, 2018                     Sudo 1.8.25
+Sudo 1.8.26                    October 24, 2018                    Sudo 1.8.26

diff --git a/doc/cvtsudoers.man.in b/doc/cvtsudoers.man.in
index 74be920fd3f70b8ff42a2721855a1632f2241ef4..e920ea93e2ee37d589279857773a087ce5a0bdf6 100644 (file)
--- a/doc/cvtsudoers.man.in
+++ b/doc/cvtsudoers.man.in
@@ -15,7 +15,7 @@
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.TH "CVTSUDOERS" "1" "April 14, 2018" "Sudo @PACKAGE_VERSION@" "General Commands Manual"
+.TH "CVTSUDOERS" "1" "October 24, 2018" "Sudo @PACKAGE_VERSION@" "General Commands Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -299,6 +299,30 @@ option is also specified,
 will prune out non-matching users, groups and hosts from
 matching entries.
 .TP 12n
+\fB\-P\fR \fIpadding\fR, \fB\--padding\fR=\fIpadding\fR
+When generating LDIF output, construct the initial sudoOrder value by
+concatenating
+\fIorder_start\fR
+and
+\fIincrement\fR,
+padding the
+\fIincrement\fR
+with zeros until it consists of
+\fIpadding\fR
+digits.
+For example, if
+\fIorder_start\fR
+is 1027,
+\fIpadding\fR
+is 3, and
+\fIincrement\fR
+is 1, the value of sudoOrder for the first entry will be 1027000,
+followed by 1027001, 1027002, etc.
+If the number of sudoRole entries is larger than the padding would allow,
+\fBcvtsudoers\fR
+will exit with an error.
+By default, no padding is performed.
+.TP 12n
 \fB\-s\fR \fIsections\fR, \fB\--suppress\fR=\fIsections\fR
 Suppress the output of specific
 \fIsections\fR

diff --git a/doc/cvtsudoers.mdoc.in b/doc/cvtsudoers.mdoc.in
index 045c96089796d7449e11c0e3532734908a77c3b8..de59e9d78af76407bb9fddd1d44715d9c3650459 100644 (file)
--- a/doc/cvtsudoers.mdoc.in
+++ b/doc/cvtsudoers.mdoc.in
@@ -14,7 +14,7 @@
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd April 14, 2018
+.Dd October 24, 2018
 .Dt CVTSUDOERS 1
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -250,6 +250,29 @@ option is also specified,
 .Nm
 will prune out non-matching users, groups and hosts from
 matching entries.
+.It Fl P Ar padding , Fl -padding Ns = Ns Ar padding
+When generating LDIF output, construct the initial sudoOrder value by
+concatenating
+.Ar order_start
+and
+.Ar increment ,
+padding the
+.Ar increment
+with zeros until it consists of
+.Ar padding
+digits.
+For example, if
+.Ar order_start
+is 1027,
+.Ar padding
+is 3, and
+.Ar increment
+is 1, the value of sudoOrder for the first entry will be 1027000,
+followed by 1027001, 1027002, etc.
+If the number of sudoRole entries is larger than the padding would allow,
+.Nm
+will exit with an error.
+By default, no padding is performed.
 .It Fl s Ar sections , Fl -suppress Ns = Ns Ar sections
 Suppress the output of specific
 .Ar sections

diff --git a/plugins/sudoers/cvtsudoers.c b/plugins/sudoers/cvtsudoers.c
index 5037312b67d5517f7d2c088170d45bb1bb2c576c..c856e960963a6d50f1c2a720d20f1bb4bbb1fc8d 100644 (file)
--- a/plugins/sudoers/cvtsudoers.c
+++ b/plugins/sudoers/cvtsudoers.c
@@ -58,7 +58,7 @@
 struct cvtsudoers_filter *filters;
 struct sudo_user sudo_user;
 struct passwd *list_pw;
-static const char short_opts[] =  "b:c:d:ef:hi:I:m:Mo:O:ps:V";
+static const char short_opts[] =  "b:c:d:ef:hi:I:m:Mo:O:pP:s:V";
 static struct option long_opts[] = {
     { "base",          required_argument,      NULL,   'b' },
     { "config",                required_argument,      NULL,   'c' },
@@ -71,6 +71,7 @@ static struct option long_opts[] = {
     { "match",         required_argument,      NULL,   'm' },
     { "match-local",   no_argument,            NULL,   'M' },
     { "prune-matches", no_argument,            NULL,   'p' },
+    { "padding",       required_argument,      NULL,   'P' },
     { "order-start",   required_argument,      NULL,   'O' },
     { "output",                required_argument,      NULL,   'o' },
     { "suppress",      required_argument,      NULL,   's' },
@@ -215,6 +216,13 @@ main(int argc, char *argv[])
        case 'p':
            conf->prune_matches = true;
            break;
+       case 'P':
+           conf->order_padding = sudo_strtonum(optarg, 1, UINT_MAX, &errstr);
+           if (errstr != NULL ) {
+               sudo_warnx(U_("order padding: %s: %s"), optarg, U_(errstr));
+               usage(1);
+           }
+           break;
        case 's':
            conf->supstr = optarg;
            break;
@@ -273,6 +281,18 @@ main(int argc, char *argv[])
            usage(1);
     }
 
+    /* Apply padding to sudo_order if present. */
+    if (conf->sudo_order != 0 && conf->order_padding != 0) {
+       unsigned int multiplier = 1;
+
+       do {
+           multiplier *= 10;
+       } while (--conf->order_padding != 0);
+       conf->sudo_order *= multiplier;
+       conf->order_max = conf->sudo_order + (multiplier - 1);
+       conf->order_padding = multiplier;
+    }
+
     /* If no base DN specified, check SUDOERS_BASE. */
     if (conf->sudoers_base == NULL) {
        conf->sudoers_base = getenv("SUDOERS_BASE");
@@ -360,6 +380,7 @@ static struct cvtsudoers_config cvtsudoers_config = INITIAL_CONFIG;
 static struct cvtsudoers_conf_table cvtsudoers_conf_vars[] = {
     { "order_start", CONF_UINT, &cvtsudoers_config.sudo_order },
     { "order_increment", CONF_UINT, &cvtsudoers_config.order_increment },
+    { "order_padding", CONF_UINT, &cvtsudoers_config.order_padding },
     { "sudoers_base", CONF_STR, &cvtsudoers_config.sudoers_base },
     { "input_format", CONF_STR, &cvtsudoers_config.input_format },
     { "output_format", CONF_STR, &cvtsudoers_config.output_format },
@@ -1280,7 +1301,7 @@ usage(int fatal)
     (void) fprintf(fatal ? stderr : stdout, "usage: %s [-ehMpV] [-b dn] "
        "[-c conf_file ] [-d deftypes] [-f output_format] [-i input_format] "
        "[-I increment] [-m filter] [-o output_file] [-O start_point] "
-       "[-s sections] [input_file]\n", getprogname());
+       "[-P padding] [-s sections] [input_file]\n", getprogname());
     if (fatal)
        exit(1);
 }
@@ -1303,6 +1324,7 @@ help(void)
        "  -o, --output=output_file   write converted sudoers to output_file\n"
        "  -O, --order-start=num      starting point for first sudoOrder\n"
        "  -p, --prune-matches        prune non-matching users, groups and hosts\n"
+       "  -P, --padding=num          base padding for sudoOrder increment\n"
        "  -s, --suppress=sections    suppress output of certain sections\n"
        "  -V, --version              display version information and exit"));
     exit(0);

diff --git a/plugins/sudoers/cvtsudoers.h b/plugins/sudoers/cvtsudoers.h
index 562da5c965b99d445b1c5e12dd4603b4f1ee96a4..b93474b91ffb2cdeacf10ba831b68a17ab284445 100644 (file)
--- a/plugins/sudoers/cvtsudoers.h
+++ b/plugins/sudoers/cvtsudoers.h
@@ -43,6 +43,8 @@ enum sudoers_formats {
 struct cvtsudoers_config {
     unsigned int sudo_order;
     unsigned int order_increment;
+    unsigned int order_padding;
+    unsigned int order_max;
     short defaults;
     short suppress;
     bool expand_aliases;
@@ -57,7 +59,7 @@ struct cvtsudoers_config {
 };
 
 /* Initial config settings for above. */
-#define INITIAL_CONFIG { 1, 1, CVT_DEFAULTS_ALL, 0, false, true, false }
+#define INITIAL_CONFIG { 1, 1, 0, 0, CVT_DEFAULTS_ALL, 0, false, true, false }
 
 #define CONF_BOOL      0
 #define CONF_UINT      1

diff --git a/plugins/sudoers/cvtsudoers_ldif.c b/plugins/sudoers/cvtsudoers_ldif.c
index 53d1c29e6d5ebf1da5b7393b6ac1916bd94e185c..4f573be16e8b2da655cafa7d21ec34061176bc40 100644 (file)
--- a/plugins/sudoers/cvtsudoers_ldif.c
+++ b/plugins/sudoers/cvtsudoers_ldif.c
@@ -587,6 +587,10 @@ print_userspec_ldif(FILE *fp, struct sudoers_parse_tree *parse_tree,
 
            if (conf->sudo_order != 0) {
                char numbuf[(((sizeof(conf->sudo_order) * 8) + 2) / 3) + 2];
+               if (conf->order_max != 0 && conf->sudo_order > conf->order_max) {
+                   sudo_fatalx(U_("too many sudoers entries, maximum %u"),
+                       conf->order_padding);
+               }
                (void)snprintf(numbuf, sizeof(numbuf), "%u", conf->sudo_order);
                print_attribute_ldif(fp, "sudoOrder", numbuf);
                putc('\n', fp);

diff --git a/plugins/sudoers/regress/cvtsudoers/test31.conf b/plugins/sudoers/regress/cvtsudoers/test31.conf
new file mode 100644 (file)
index 0000000..345dbfc
--- /dev/null
+++ b/plugins/sudoers/regress/cvtsudoers/test31.conf
@@ -0,0 +1,9 @@
+defaults = all
+expand_aliases = no
+input_format = sudoers
+order_increment = 5
+order_padding = 2
+order_start = 1000
+output_format = ldif                                     
+sudoers_base = ou=SUDOers,dc=my-domain,dc=com
+suppress = defaults

diff --git a/plugins/sudoers/regress/cvtsudoers/test31.out.ok b/plugins/sudoers/regress/cvtsudoers/test31.out.ok
new file mode 100644 (file)
index 0000000..41ffd1b
--- /dev/null
+++ b/plugins/sudoers/regress/cvtsudoers/test31.out.ok
@@ -0,0 +1,24 @@
+dn: cn=ALL,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: ALL
+sudoUser: ALL
+sudoHost: ALL
+sudoRunAsUser:
+sudoOption: !authenticate
+sudoCommand: /usr/bin/id
+sudoOrder: 100000
+
+dn: cn=FULLTIMERS,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: FULLTIMERS
+sudoUser: user1
+sudoUser: user2
+sudoUser: user3
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 100005
+

diff --git a/plugins/sudoers/regress/cvtsudoers/test31.sh b/plugins/sudoers/regress/cvtsudoers/test31.sh
new file mode 100644 (file)
index 0000000..ad6537c
--- /dev/null
+++ b/plugins/sudoers/regress/cvtsudoers/test31.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+#
+# Test cvtsudoers.conf with padding
+#
+
+exec 2>&1
+./cvtsudoers -c $TESTDIR/test31.conf <<EOF
+Defaults authenticate, timestamp_timeout=0
+User_Alias FULLTIMERS = user1, user2, user3
+
+ALL ALL = (:) NOPASSWD:/usr/bin/id
+FULLTIMERS ALL = (ALL:ALL) ALL
+EOF

diff --git a/plugins/sudoers/regress/cvtsudoers/test32.out.ok b/plugins/sudoers/regress/cvtsudoers/test32.out.ok
new file mode 100644 (file)
index 0000000..436b877
--- /dev/null
+++ b/plugins/sudoers/regress/cvtsudoers/test32.out.ok
@@ -0,0 +1,120 @@
+cvtsudoers: too many sudoers entries, maximum 10
+dn: cn=user0,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user0
+sudoUser: user0
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10000
+
+dn: cn=user1,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user1
+sudoUser: user1
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10001
+
+dn: cn=user2,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user2
+sudoUser: user2
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10002
+
+dn: cn=user3,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user3
+sudoUser: user3
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10003
+
+dn: cn=user4,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user4
+sudoUser: user4
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10004
+
+dn: cn=user5,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user5
+sudoUser: user5
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10005
+
+dn: cn=user6,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user6
+sudoUser: user6
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10006
+
+dn: cn=user7,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user7
+sudoUser: user7
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10007
+
+dn: cn=user8,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user8
+sudoUser: user8
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10008
+
+dn: cn=user9,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user9
+sudoUser: user9
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL
+sudoOrder: 10009
+
+dn: cn=user10,ou=SUDOers,dc=my-domain,dc=com
+objectClass: top
+objectClass: sudoRole
+cn: user10
+sudoUser: user10
+sudoHost: ALL
+sudoRunAsUser: ALL
+sudoRunAsGroup: ALL
+sudoCommand: ALL

diff --git a/plugins/sudoers/regress/cvtsudoers/test32.sh b/plugins/sudoers/regress/cvtsudoers/test32.sh
new file mode 100644 (file)
index 0000000..fe9c065
--- /dev/null
+++ b/plugins/sudoers/regress/cvtsudoers/test32.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+#
+# Test cvtsudoers.conf with invalid padding
+#
+
+exec 2>&1
+./cvtsudoers -c "" -b "ou=SUDOers,dc=my-domain,dc=com" -O 1000 -P 1 <<EOF
+user0  ALL = (ALL:ALL) ALL
+user1  ALL = (ALL:ALL) ALL
+user2  ALL = (ALL:ALL) ALL
+user3  ALL = (ALL:ALL) ALL
+user4  ALL = (ALL:ALL) ALL
+user5  ALL = (ALL:ALL) ALL
+user6  ALL = (ALL:ALL) ALL
+user7  ALL = (ALL:ALL) ALL
+user8  ALL = (ALL:ALL) ALL
+user9  ALL = (ALL:ALL) ALL
+user10 ALL = (ALL:ALL) ALL
+EOF
+
+exit 0