Store the session ID in the tty ticket file too. A tty may only

be in one session at a time so if the session ID doesn't match we
ignore the ticket.

diff --git a/plugins/sudoers/policy.c b/plugins/sudoers/policy.c
index e835a587183f6c29d3f35220c94a1b85670ebdd6..1fa112a8cb99ef466e5e1c0a01360df7c0b73909 100644 (file)
--- a/plugins/sudoers/policy.c
+++ b/plugins/sudoers/policy.c
@@ -270,6 +270,10 @@ sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group)
            sudo_user.cols = atoi(*cur + sizeof("cols=") - 1);
            continue;
        }
+       if (MATCHES(*cur, "sid=")) {
+           sudo_user.sid = atoi(*cur + sizeof("sid=") - 1);
+           continue;
+       }
     }
     if (user_cwd == NULL)
        user_cwd = "unknown";

diff --git a/plugins/sudoers/sudoers.h b/plugins/sudoers/sudoers.h
index 4a3f6e0b2ea418cd28f915dba099bb8c0f6469e0..30fed52719b421fa31601d0cf66a846a3bf95738 100644 (file)
--- a/plugins/sudoers/sudoers.h
+++ b/plugins/sudoers/sudoers.h
@@ -95,6 +95,7 @@ struct sudo_user {
     int   flags;
     uid_t uid;
     uid_t gid;
+    pid_t sid;
 };
 
 /*
@@ -171,8 +172,8 @@ struct sudo_user {
 #define user_name              (sudo_user.name)
 #define user_uid               (sudo_user.uid)
 #define user_gid               (sudo_user.gid)
+#define user_sid               (sudo_user.sid)
 #define user_passwd            (sudo_user.pw->pw_passwd)
-#define user_uuid              (sudo_user.uuid)
 #define user_dir               (sudo_user.pw->pw_dir)
 #define user_gids              (sudo_user.gids)
 #define user_ngids             (sudo_user.ngids)

diff --git a/plugins/sudoers/timestamp.c b/plugins/sudoers/timestamp.c
index 93fd94ee2b3da1fbb5230221cca1c35d479efb00..a21d3bc1f04ebaae634e3b48ce0ab0d4c3dc06ca 100644 (file)
--- a/plugins/sudoers/timestamp.c
+++ b/plugins/sudoers/timestamp.c
@@ -80,13 +80,14 @@ build_timestamp(void)
     int len;
     debug_decl(build_timestamp, SUDO_DEBUG_AUTH)
 
-    /* Stash the tty's ctime for tty ticket comparison. */
+    /* Stash the tty's device, session ID and ctime for ticket comparison. */
     if (def_tty_tickets && user_ttypath && stat(user_ttypath, &sb) == 0) {
        tty_info.dev = sb.st_dev;
        tty_info.ino = sb.st_ino;
        tty_info.rdev = sb.st_rdev;
        if (tty_is_devpts(user_ttypath))
            ctim_get(&sb, &tty_info.ctime);
+       tty_info.sid = user_sid;
     }
 
     dirparent = def_timestampdir;

diff --git a/plugins/sudoers/timestamp.h b/plugins/sudoers/timestamp.h
index 00679ec8a15f7e4d2ae14084d78bb03e0870458f..b7b73a62cb1993c32c8293d0c24762f0c0479cab 100644 (file)
--- a/plugins/sudoers/timestamp.h
+++ b/plugins/sudoers/timestamp.h
@@ -37,6 +37,7 @@ struct sudo_tty_info {
     dev_t rdev;                        /* tty device ID */
     ino_t ino;                 /* tty inode number */
     struct timeval ctime;      /* tty inode change time */
+    pid_t sid;                 /* ID of session with controlling tty */
 };
 
 bool  update_timestamp(void);