Do not inform the user that the command was not permitted by the

policy if they do not successfully authenticate. This is a regression
introduced in sudo 1.7.10.

--HG--
branch : 1.7

diff --git a/logging.c b/logging.c
index 322a6d8b1feee684204ce62db4c0f37675927fa6..5811b3676691f82f0b84ec2c29df4c2ce2fa3c2b 100644 (file)
--- a/logging.c
+++ b/logging.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1994-1996, 1998-2010 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 1994-1996, 1998-2012 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -246,9 +246,9 @@ do_logfile(msg)
 }
 
 /*
- * Log and mail the denial message, optionally informing the user.
+ * Log, audit and mail the denial message, optionally informing the user.
  */
-static void
+void
 log_denial(status, inform_user)
     int status;
     int inform_user;
@@ -256,6 +256,12 @@ log_denial(status, inform_user)
     char *message;
     char *logline;
 
+    /* Handle auditing first. */
+    if (ISSET(status, FLAG_NO_USER | FLAG_NO_HOST))
+       audit_failure(NewArgv, "No user or host");
+    else
+       audit_failure(NewArgv, "validation failure");
+
     /* Set error message. */
     if (ISSET(status, FLAG_NO_USER))
        message = "user NOT in sudoers";
@@ -311,12 +317,6 @@ log_failure(status, flags)
 {
     int inform_user = TRUE;
 
-    /* Handle auditing first. */
-    if (ISSET(status, FLAG_NO_USER | FLAG_NO_HOST))
-       audit_failure(NewArgv, "No user or host");
-    else
-       audit_failure(NewArgv, "validation failure");
-
     /* The user doesn't always get to see the log message (path info). */
     if (!ISSET(status, FLAG_NO_USER | FLAG_NO_HOST) && def_path_info &&
        (flags == NOT_FOUND_DOT || flags == NOT_FOUND))

diff --git a/logging.h b/logging.h
index 9f7e58b49efcc08404c2dd0b4537352f72567152..bfa762aadc4ab6f547d6f6c08c71ca77decd1220 100644 (file)
--- a/logging.h
+++ b/logging.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999-2005, 2009
+ * Copyright (c) 1999-2005, 2009-2012
  *     Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -56,6 +56,7 @@ void audit_success            __P((char *[]));
 void audit_failure             __P((char *[], char const * const, ...));
 void log_allowed               __P((int));
 void log_auth_failure          __P((int, int));
+void log_denial                        __P((int, int));
 void log_failure               __P((int, int));
 void log_error                 __P((int flags, const char *fmt, ...))
                                    __printflike(2, 3);

diff --git a/sudo.c b/sudo.c
index 3e3af404ebab06d9d1c9ab07bf613b670c826e48..94385394684b6bf6ed09ff3a0a83fc40ce5b7c1b 100644 (file)
--- a/sudo.c
+++ b/sudo.c
@@ -443,7 +443,7 @@ main(argc, argv, envp)
     rval = check_user(validated, sudo_mode);
     if (rval != TRUE) {
        if (!ISSET(validated, VALIDATE_OK))
-           log_failure(validated, cmnd_status);
+           log_denial(validated, FALSE);
        goto done;
     }