Add pam_session sudoers option.

diff --git a/configure b/configure
index ae14729969cb634c1a4133753f45c979297ad62b..6ab9da29533adea243dace5e06976f1d215b3b40 100755 (executable)
--- a/configure
+++ b/configure
@@ -659,6 +659,7 @@ EXEEXT
 ac_ct_CC
 CC
 PLUGINDIR
+pam_session
 editor
 secure_path
 netsvc_conf
@@ -2922,6 +2923,7 @@ $as_echo "$as_me: Configuring Sudo version $PACKAGE_VERSION" >&6;}
 
 
 
+
 
 
 #
@@ -2963,6 +2965,7 @@ netsvc_conf=/etc/netsvc.conf
 noexec_file=/usr/local/libexec/sudo/sudo_noexec.so
 nsswitch_conf=/etc/nsswitch.conf
 secure_path="not set"
+pam_session=on
 PLUGINDIR=/usr/local/libexec/sudo
 #
 # End initial values for man page substitution
@@ -18771,16 +18774,17 @@ if test "${enable_pam_session+set}" = set; then :
                yes)    { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
                        ;;
-               no)             { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+               no)     { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-                           $as_echo "#define NO_PAM_SESSION 1" >>confdefs.h
+                       $as_echo "#define NO_PAM_SESSION 1" >>confdefs.h
 
-                           ;;
-               *)              { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+                       pam_session=off
+                       ;;
+               *)      { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-                           { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Ignoring unknown argument to --enable-pam-session: $enableval" >&5
+                       { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Ignoring unknown argument to --enable-pam-session: $enableval" >&5
 $as_echo "$as_me: WARNING: Ignoring unknown argument to --enable-pam-session: $enableval" >&2;}
-                           ;;
+                       ;;
            esac
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5

diff --git a/configure.in b/configure.in
index 510f5fa3e2c03e4065d31352fe287139269ad3e5..c5642b83ad84d1d9dd7440998d08e2abf0b53501 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -120,6 +120,7 @@ AC_SUBST([nsswitch_conf])
 AC_SUBST([netsvc_conf])
 AC_SUBST([secure_path])
 AC_SUBST([editor])
+AC_SUBST([pam_session])
 AC_SUBST([PLUGINDIR])
 #
 # Begin initial values for man page substitution
@@ -160,6 +161,7 @@ netsvc_conf=/etc/netsvc.conf
 noexec_file=/usr/local/libexec/sudo/sudo_noexec.so
 nsswitch_conf=/etc/nsswitch.conf
 secure_path="not set"
+pam_session=on
 PLUGINDIR=/usr/local/libexec/sudo
 #
 # End initial values for man page substitution
@@ -2773,12 +2775,13 @@ if test ${with_pam-"no"} != "no"; then
            [ case "$enableval" in
                yes)    AC_MSG_RESULT(yes)
                        ;;
-               no)             AC_MSG_RESULT(no)
-                           AC_DEFINE(NO_PAM_SESSION)
-                           ;;
-               *)              AC_MSG_RESULT(no)
-                           AC_MSG_WARN([Ignoring unknown argument to --enable-pam-session: $enableval])
-                           ;;
+               no)     AC_MSG_RESULT(no)
+                       AC_DEFINE(NO_PAM_SESSION)
+                       pam_session=off
+                       ;;
+               *)      AC_MSG_RESULT(no)
+                       AC_MSG_WARN([Ignoring unknown argument to --enable-pam-session: $enableval])
+                       ;;
            esac], AC_MSG_RESULT(yes))
     fi
 fi

diff --git a/doc/sudoers.cat b/doc/sudoers.cat
index f260e0bdaabb3f5f8e02b8d40e32edd8d5a2f72c..13bc3a3cfd6864411e0292b10abb8efcb7ce54e0 100644 (file)
--- a/doc/sudoers.cat
+++ b/doc/sudoers.cat
@@ -809,9 +809,9 @@ S\bSU\bUD\bDO\bOE\bER\bRS\bS O\bOP\bPT\bTI\bIO\bON\bNS\bS
                        will not be automatically foregrounded.  Some versions
                        of the linux su(1) command behave this way.
 
-                       This setting is only supported by s\bsu\bud\bdo\boe\ber\brs\bs plugin
-                       version 1.8.7 or higher.  It has no effect unless I/O
-                       logging is enabled or the _\bu_\bs_\be_\b__\bp_\bt_\by flag is enabled.
+                       This setting is only supported by version 1.8.7 or
+                       higher.  It has no effect unless I/O logging is enabled
+                       or the _\bu_\bs_\be_\b__\bp_\bt_\by flag is enabled.
 
      env_editor        If set, v\bvi\bis\bsu\bud\bdo\bo will use the value of the EDITOR or
                        VISUAL environment variables before falling back on the
@@ -1001,6 +1001,26 @@ S\bSU\bUD\bDO\bOE\bER\bRS\bS O\bOP\bPT\bTI\bIO\bON\bNS\bS
                        well as the _\bP_\br_\be_\bv_\be_\bn_\bt_\bi_\bn_\bg _\bs_\bh_\be_\bl_\bl _\be_\bs_\bc_\ba_\bp_\be_\bs section at the end
                        of this manual.  This flag is _\bo_\bf_\bf by default.
 
+     pam_session       On systems that use PAM for authentication, s\bsu\bud\bdo\bo will
+                       create a new PAM session for the command to be run in.
+                       Disabling _\bp_\ba_\bm_\b__\bs_\be_\bs_\bs_\bi_\bo_\bn may be needed on older PAM
+                       implementations or on operating systems where opening a
+                       PAM session changes the utmp or wtmp files.  If PAM
+                       session support is disabled, resource limits may not be
+                       updated for the command being run.  This flag is _\bo_\bn by
+                       default.
+
+                       This setting is only supported by version 1.8.7 or
+                       higher.
+
+     passprompt_override
+                       The password prompt specified by _\bp_\ba_\bs_\bs_\bp_\br_\bo_\bm_\bp_\bt will
+                       normally only be used if the password prompt provided
+                       by systems such as PAM matches the string
+                       ``Password:''.  If _\bp_\ba_\bs_\bs_\bp_\br_\bo_\bm_\bp_\bt_\b__\bo_\bv_\be_\br_\br_\bi_\bd_\be is set,
+                       _\bp_\ba_\bs_\bs_\bp_\br_\bo_\bm_\bp_\bt will always be used.  This flag is _\bo_\bf_\bf by
+                       default.
+
      path_info         Normally, s\bsu\bud\bdo\bo will tell the user when a command could
                        not be found in their PATH environment variable.  Some
                        sites may wish to disable this as it could be used to
@@ -1011,14 +1031,6 @@ S\bSU\bUD\bDO\bOE\bER\bRS\bS O\bOP\bPT\bTI\bIO\bON\bNS\bS
                        not allowed to run it, which can be confusing.  This
                        flag is _\bo_\bn by default.
 
-     passprompt_override
-                       The password prompt specified by _\bp_\ba_\bs_\bs_\bp_\br_\bo_\bm_\bp_\bt will
-                       normally only be used if the password prompt provided
-                       by systems such as PAM matches the string
-                       ``Password:''.  If _\bp_\ba_\bs_\bs_\bp_\br_\bo_\bm_\bp_\bt_\b__\bo_\bv_\be_\br_\br_\bi_\bd_\be is set,
-                       _\bp_\ba_\bs_\bs_\bp_\br_\bo_\bm_\bp_\bt will always be used.  This flag is _\bo_\bf_\bf by
-                       default.
-
      preserve_groups   By default, s\bsu\bud\bdo\bo will initialize the group vector to
                        the list of groups the target user is in.  When
                        _\bp_\br_\be_\bs_\be_\br_\bv_\be_\b__\bg_\br_\bo_\bu_\bp_\bs is set, the user's existing group
@@ -1305,8 +1317,8 @@ S\bSU\bUD\bDO\bOE\bER\bRS\bS O\bOP\bPT\bTI\bIO\bON\bNS\bS
                        truncated to 2176782336.  The default value is
                        2176782336.
 
-                       This setting is only supported by s\bsu\bud\bdo\boe\ber\brs\bs plugin
-                       version 1.8.7 or higher.
+                       This setting is only supported by version 1.8.7 or
+                       higher.
 
      noexec_file       As of s\bsu\bud\bdo\bo version 1.8.1 this option is no longer
                        supported.  The path to the noexec file should now be
@@ -2138,4 +2150,4 @@ D\bDI\bIS\bSC\bCL\bLA\bAI\bIM\bME\bER\bR
      file distributed with s\bsu\bud\bdo\bo or http://www.sudo.ws/sudo/license.html for
      complete details.
 
-Sudo 1.8.7                     February 20, 2013                    Sudo 1.8.7
+Sudo 1.8.7                     February 24, 2013                    Sudo 1.8.7

diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in
index 48ac73878cfff4c05a10421b4c93e0690c10948b..b0704190442d28a4ed1bd39088db75fe39886c32 100644 (file)
--- a/doc/sudoers.man.in
+++ b/doc/sudoers.man.in
@@ -21,7 +21,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.TH "SUDOERS" "@mansectsu@" "February 20, 2013" "Sudo @PACKAGE_VERSION@" "Programmer's Manual"
+.TH "SUDOERS" "@mansectsu@" "February 24, 2013" "Sudo @PACKAGE_VERSION@" "Programmer's Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -1767,9 +1767,7 @@ Some versions of the linux
 su(1)
 command behave this way.
 .sp
-This setting is only supported by
-\fBsudoers\fR
-plugin version 1.8.7 or higher.
+This setting is only supported by version 1.8.7 or higher.
 It has no effect unless I/O logging is enabled or the
 \fIuse_pty\fR
 flag is enabled.
@@ -2156,23 +2154,21 @@ This flag is
 \fIoff\fR
 by default.
 .TP 18n
-path_info
-Normally,
-\fBsudo\fR
-will tell the user when a command could not be
-found in their
-\fRPATH\fR
-environment variable.
-Some sites may wish to disable this as it could be used to gather
-information on the location of executables that the normal user does
-not have access to.
-The disadvantage is that if the executable is simply not in the user's
-\fRPATH\fR,
+pam_session
+On systems that use PAM for authentication,
 \fBsudo\fR
-will tell the user that they are not allowed to run it, which can be confusing.
+will create a new PAM session for the command to be run in.
+Disabling
+\fIpam_session\fR
+may be needed on older PAM implementations or on operating systems where
+opening a PAM session changes the utmp or wtmp files.
+If PAM session support is disabled, resource limits may not be updated
+for the command being run.
 This flag is
-\fI@path_info@\fR
+\fI@pam_session@\fR
 by default.
+.sp
+This setting is only supported by version 1.8.7 or higher.
 .TP 18n
 passprompt_override
 The password prompt specified by
@@ -2189,6 +2185,24 @@ This flag is
 \fIoff\fR
 by default.
 .TP 18n
+path_info
+Normally,
+\fBsudo\fR
+will tell the user when a command could not be
+found in their
+\fRPATH\fR
+environment variable.
+Some sites may wish to disable this as it could be used to gather
+information on the location of executables that the normal user does
+not have access to.
+The disadvantage is that if the executable is simply not in the user's
+\fRPATH\fR,
+\fBsudo\fR
+will tell the user that they are not allowed to run it, which can be confusing.
+This flag is
+\fI@path_info@\fR
+by default.
+.TP 18n
 preserve_groups
 By default,
 \fBsudo\fR
@@ -2743,9 +2757,7 @@ base 36 sequence number
 will be silently truncated to 2176782336.
 The default value is 2176782336.
 .sp
-This setting is only supported by
-\fBsudoers\fR
-plugin version 1.8.7 or higher.
+This setting is only supported by version 1.8.7 or higher.
 .TP 18n
 noexec_file
 As of

diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in
index 67b98f6392ff7a026d9d2dfa9cc7a654f15ed1f8..68efc84e440a3e9b1a2fa45be5c2905aa70ab752 100644 (file)
--- a/doc/sudoers.mdoc.in
+++ b/doc/sudoers.mdoc.in
@@ -19,7 +19,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.Dd February 20, 2013
+.Dd February 24, 2013
 .Dt SUDOERS @mansectform@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -1641,9 +1641,7 @@ Some versions of the linux
 .Xr su 1
 command behave this way.
 .Pp
-This setting is only supported by
-.Nm sudoers
-plugin version 1.8.7 or higher.
+This setting is only supported by version 1.8.7 or higher.
 It has no effect unless I/O logging is enabled or the
 .Em use_pty
 flag is enabled.
@@ -2015,23 +2013,21 @@ section at the end of this manual.
 This flag is
 .Em off
 by default.
-.It path_info
-Normally,
-.Nm sudo
-will tell the user when a command could not be
-found in their
-.Ev PATH
-environment variable.
-Some sites may wish to disable this as it could be used to gather
-information on the location of executables that the normal user does
-not have access to.
-The disadvantage is that if the executable is simply not in the user's
-.Ev PATH ,
+.It pam_session
+On systems that use PAM for authentication,
 .Nm sudo
-will tell the user that they are not allowed to run it, which can be confusing.
+will create a new PAM session for the command to be run in.
+Disabling
+.Em pam_session
+may be needed on older PAM implementations or on operating systems where
+opening a PAM session changes the utmp or wtmp files.
+If PAM session support is disabled, resource limits may not be updated
+for the command being run.
 This flag is
-.Em @path_info@
+.Em @pam_session@
 by default.
+.Pp
+This setting is only supported by version 1.8.7 or higher.
 .It passprompt_override
 The password prompt specified by
 .Em passprompt
@@ -2046,6 +2042,23 @@ will always be used.
 This flag is
 .Em off
 by default.
+.It path_info
+Normally,
+.Nm sudo
+will tell the user when a command could not be
+found in their
+.Ev PATH
+environment variable.
+Some sites may wish to disable this as it could be used to gather
+information on the location of executables that the normal user does
+not have access to.
+The disadvantage is that if the executable is simply not in the user's
+.Ev PATH ,
+.Nm sudo
+will tell the user that they are not allowed to run it, which can be confusing.
+This flag is
+.Em @path_info@
+by default.
 .It preserve_groups
 By default,
 .Nm sudo
@@ -2564,9 +2577,7 @@ base 36 sequence number
 will be silently truncated to 2176782336.
 The default value is 2176782336.
 .Pp
-This setting is only supported by
-.Nm sudoers
-plugin version 1.8.7 or higher.
+This setting is only supported by version 1.8.7 or higher.
 .It noexec_file
 As of
 .Nm sudo

diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c
index 5f0386492f9e6faf0d6d184af07c7ed917c98e24..0c1585ae0843f827d2c334da88b5ae306294772f 100644 (file)
--- a/plugins/sudoers/auth/pam.c
+++ b/plugins/sudoers/auth/pam.c
@@ -251,13 +251,13 @@ sudo_pam_begin_session(struct passwd *pw, char **user_envp[], sudo_auth *auth)
     }
 #endif /* HAVE_PAM_GETENVLIST */
 
-#ifndef NO_PAM_SESSION
-    status = pam_open_session(pamh, 0);
-    if (status != PAM_SUCCESS) {
-       (void) pam_end(pamh, status | PAM_DATA_SILENT);
-       pamh = NULL;
+    if (pam_session) {
+       status = pam_open_session(pamh, 0);
+       if (status != PAM_SUCCESS) {
+           (void) pam_end(pamh, status | PAM_DATA_SILENT);
+           pamh = NULL;
+       }
     }
-#endif
 
 done:
     debug_return_int(status == PAM_SUCCESS ? AUTH_SUCCESS : AUTH_FAILURE);
@@ -276,9 +276,8 @@ sudo_pam_end_session(struct passwd *pw, sudo_auth *auth)
         * XXX - still needed now that session init is in parent?
         */
        (void) pam_set_item(pamh, PAM_USER, pw->pw_name);
-#ifndef NO_PAM_SESSION
-       (void) pam_close_session(pamh, PAM_SILENT);
-#endif
+       if (pam_session)
+           (void) pam_close_session(pamh, PAM_SILENT);
        (void) pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
        status = pam_end(pamh, PAM_SUCCESS | PAM_DATA_SILENT);
        pamh = NULL;

diff --git a/plugins/sudoers/def_data.c b/plugins/sudoers/def_data.c
index b3001e7ed29400216e2a48d7f1039068696cab2b..c4a5dd103809c4e928deae04e9a6e5939dbe8fab 100644 (file)
--- a/plugins/sudoers/def_data.c
+++ b/plugins/sudoers/def_data.c
@@ -354,6 +354,10 @@ struct sudo_defs_types sudo_defs_table[] = {
        "exec_background", T_FLAG,
        N_("Run commands on a pty in the background"),
        NULL,
+    }, {
+       "pam_session", T_FLAG,
+       N_("Create a new PAM session for the command to run in"),
+       NULL,
     }, {
        "maxseq", T_UINT,
        N_("Maximum I/O log sequence number"),

diff --git a/plugins/sudoers/def_data.h b/plugins/sudoers/def_data.h
index 3b54fbba30f39765bd0b7669ca4d6ec6e4d884f9..36fba1b6139dc63a9da8fb977e2f58ad027de6f4 100644 (file)
--- a/plugins/sudoers/def_data.h
+++ b/plugins/sudoers/def_data.h
@@ -164,8 +164,10 @@
 #define I_LIMITPRIVS            81
 #define def_exec_background     (sudo_defs_table[82].sd_un.flag)
 #define I_EXEC_BACKGROUND       82
-#define def_maxseq              (sudo_defs_table[83].sd_un.ival)
-#define I_MAXSEQ                83
+#define def_pam_session         (sudo_defs_table[83].sd_un.flag)
+#define I_PAM_SESSION           83
+#define def_maxseq              (sudo_defs_table[84].sd_un.ival)
+#define I_MAXSEQ                84
 
 enum def_tuple {
        never,

diff --git a/plugins/sudoers/def_data.in b/plugins/sudoers/def_data.in
index 5842b292a6729f40ef5486c633fda7ce5fea3a48..9f8ffa088233dd99675c0babd8a6be9a9411e24d 100644 (file)
--- a/plugins/sudoers/def_data.in
+++ b/plugins/sudoers/def_data.in
@@ -262,6 +262,9 @@ limitprivs
 exec_background
        T_FLAG
        "Run commands on a pty in the background"
+pam_session
+       T_FLAG
+       "Create a new PAM session for the command to run in"
 maxseq
        T_UINT
        "Maximum I/O log sequence number"

diff --git a/plugins/sudoers/defaults.c b/plugins/sudoers/defaults.c
index 69ddeebc8c2658beeeaef234b008dc4de74a0ff6..7e3493757bdc08322bbd51326d25bdd2b5e76c1a 100644 (file)
--- a/plugins/sudoers/defaults.c
+++ b/plugins/sudoers/defaults.c
@@ -421,6 +421,11 @@ init_defaults(void)
     def_env_reset = ENV_RESET;
     def_set_logname = true;
     def_closefrom = STDERR_FILENO + 1;
+#ifdef NO_PAM_SESSION
+    def_pam_session = false;
+#else
+    def_pam_session = true;
+#endif
 
     /* Syslog options need special care since they both strings and ints */
 #if (LOGGING & SLOG_SYSLOG)