Rename log_warning flags and only send mail if SLOG_SEND_MAIL is

set instead of mailing by default like we used to.

diff --git a/plugins/sudoers/auth/bsdauth.c b/plugins/sudoers/auth/bsdauth.c
index efd4adfc3e3f63ce26384ed0f84070e17ad2c734..d734e1e4568e1ca0f521279733acf12b07f30458 100644 (file)
--- a/plugins/sudoers/auth/bsdauth.c
+++ b/plugins/sudoers/auth/bsdauth.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000-2005, 2007-2008, 2010-2013
+ * Copyright (c) 2000-2005, 2007-2008, 2010-2014
  *     Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -71,14 +71,13 @@ bsdauth_init(struct passwd *pw, sudo_auth *auth)
     else
        state.lc = login_getclass(pw->pw_uid ? LOGIN_DEFCLASS : LOGIN_DEFROOTCLASS);
     if (state.lc == NULL) {
-       log_warning(NO_MAIL,
+       log_warning(0,
            N_("unable to get login class for user %s"), pw->pw_name);
        debug_return_int(AUTH_FATAL);
     }
 
     if ((state.as = auth_open()) == NULL) {
-       log_warning(NO_MAIL,
-           N_("unable to begin bsd authentication"));
+       log_warning(0, N_("unable to begin bsd authentication"));
        login_close(state.lc);
        debug_return_int(AUTH_FATAL);
     }
@@ -86,7 +85,7 @@ bsdauth_init(struct passwd *pw, sudo_auth *auth)
     /* XXX - maybe sanity check the auth style earlier? */
     login_style = login_getstyle(state.lc, login_style, "auth-sudo");
     if (login_style == NULL) {
-       log_warningx(NO_MAIL, N_("invalid authentication type"));
+       log_warningx(0, N_("invalid authentication type"));
        auth_close(state.as);
        login_close(state.lc);
        debug_return_int(AUTH_FATAL);
@@ -95,7 +94,7 @@ bsdauth_init(struct passwd *pw, sudo_auth *auth)
      if (auth_setitem(state.as, AUTHV_STYLE, login_style) < 0 ||
        auth_setitem(state.as, AUTHV_NAME, pw->pw_name) < 0 ||
        auth_setitem(state.as, AUTHV_CLASS, login_class) < 0) {
-       log_warningx(NO_MAIL, N_("unable to initialize BSD authentication"));
+       log_warningx(0, N_("unable to initialize BSD authentication"));
        auth_close(state.as);
        login_close(state.lc);
        debug_return_int(AUTH_FATAL);
@@ -167,7 +166,7 @@ bsdauth_verify(struct passwd *pw, char *prompt, sudo_auth *auth)
        debug_return_int(AUTH_INTR);
 
     if ((s = auth_getvalue(as, "errormsg")) != NULL)
-       log_warningx(NO_MAIL, "%s", s);
+       log_warningx(0, "%s", s);
     debug_return_int(AUTH_FAILURE);
 }
 

diff --git a/plugins/sudoers/auth/kerb5.c b/plugins/sudoers/auth/kerb5.c
index 93352c534525bd84ca46132caee09dec09b7ed70..bac9e55265760d28df3996b631f113a214363980 100644 (file)
--- a/plugins/sudoers/auth/kerb5.c
+++ b/plugins/sudoers/auth/kerb5.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999-2005, 2007-2008, 2010-2013
+ * Copyright (c) 1999-2005, 2007-2008, 2010-2014
  *     Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -112,9 +112,9 @@ sudo_krb5_setup(struct passwd *pw, char **promptp, sudo_auth *auth)
         * API does not currently provide this unless the auth is standalone.
         */
        if ((error = krb5_unparse_name(sudo_context, princ, &pname))) {
-           log_warningx(NO_MAIL,
-                     N_("%s: unable to convert principal to string ('%s'): %s"),
-                     auth->name, pw->pw_name, error_message(error));
+           log_warningx(0,
+               N_("%s: unable to convert principal to string ('%s'): %s"),
+               auth->name, pw->pw_name, error_message(error));
            debug_return_int(AUTH_FAILURE);
        }
 
@@ -155,9 +155,8 @@ sudo_krb5_init(struct passwd *pw, sudo_auth *auth)
 
     error = krb5_parse_name(sudo_context, pname, &(sudo_krb5_data.princ));
     if (error) {
-       log_warningx(NO_MAIL,
-                 N_("%s: unable to parse '%s': %s"), auth->name, pname,
-                 error_message(error));
+       log_warningx(0, N_("%s: unable to parse '%s': %s"), auth->name, pname,
+           error_message(error));
        goto done;
     }
 
@@ -165,9 +164,8 @@ sudo_krb5_init(struct passwd *pw, sudo_auth *auth)
                    (long) getpid());
     if ((error = krb5_cc_resolve(sudo_context, cache_name,
        &(sudo_krb5_data.ccache)))) {
-       log_warningx(NO_MAIL,
-                 N_("%s: unable to resolve credential cache: %s"), auth->name,
-                 error_message(error));
+       log_warningx(0, N_("%s: unable to resolve credential cache: %s"),
+           auth->name, error_message(error));
        goto done;
     }
 
@@ -213,9 +211,8 @@ sudo_krb5_verify(struct passwd *pw, char *pass, sudo_auth *auth)
     /* Set default flags based on the local config file. */
     error = krb5_get_init_creds_opt_alloc(sudo_context, &opts);
     if (error) {
-       log_warningx(NO_MAIL,
-                 N_("%s: unable to allocate options: %s"), auth->name,
-                 error_message(error));
+       log_warningx(0, N_("%s: unable to allocate options: %s"), auth->name,
+           error_message(error));
        goto done;
     }
 #ifdef HAVE_HEIMDAL
@@ -228,10 +225,10 @@ sudo_krb5_verify(struct passwd *pw, char *pass, sudo_auth *auth)
                                             pass, krb5_prompter_posix,
                                             NULL, 0, NULL, opts))) {
        /* Don't print error if just a bad password */
-       if (error != KRB5KRB_AP_ERR_BAD_INTEGRITY)
-           log_warningx(NO_MAIL,
-                     N_("%s: unable to get credentials: %s"), auth->name,
-                     error_message(error));
+       if (error != KRB5KRB_AP_ERR_BAD_INTEGRITY) {
+           log_warningx(0, N_("%s: unable to get credentials: %s"),
+               auth->name, error_message(error));
+       }
        goto done;
     }
     creds = &credbuf;
@@ -242,13 +239,11 @@ sudo_krb5_verify(struct passwd *pw, char *pass, sudo_auth *auth)
 
     /* Store credential in cache. */
     if ((error = krb5_cc_initialize(sudo_context, ccache, princ))) {
-       log_warningx(NO_MAIL,
-                 N_("%s: unable to initialize credential cache: %s"),
-                 auth->name, error_message(error));
+       log_warningx(0, N_("%s: unable to initialize credential cache: %s"),
+           auth->name, error_message(error));
     } else if ((error = krb5_cc_store_cred(sudo_context, ccache, creds))) {
-       log_warningx(NO_MAIL,
-                 N_("%s: unable to store credential in cache: %s"),
-                 auth->name, error_message(error));
+       log_warningx(0, N_("%s: unable to store credential in cache: %s"),
+           auth->name, error_message(error));
     }
 
 done:
@@ -311,9 +306,8 @@ verify_krb_v5_tgt(krb5_context sudo_context, krb5_creds *cred, char *auth_name)
      */
     if ((error = krb5_sname_to_principal(sudo_context, NULL, NULL,
                                        KRB5_NT_SRV_HST, &server))) {
-       log_warningx(NO_MAIL,
-                 N_("%s: unable to get host principal: %s"), auth_name,
-                 error_message(error));
+       log_warningx(0, N_("%s: unable to get host principal: %s"), auth_name,
+           error_message(error));
        debug_return_int(-1);
     }
 
@@ -325,10 +319,10 @@ verify_krb_v5_tgt(krb5_context sudo_context, krb5_creds *cred, char *auth_name)
     error = krb5_verify_init_creds(sudo_context, cred, server, NULL,
                                   NULL, &vopt);
     krb5_free_principal(sudo_context, server);
-    if (error)
-       log_warningx(NO_MAIL,
-                 N_("%s: Cannot verify TGT! Possible attack!: %s"),
-                 auth_name, error_message(error));
+    if (error) {
+       log_warningx(0, N_("%s: Cannot verify TGT! Possible attack!: %s"),
+           auth_name, error_message(error));
+    }
     debug_return_int(error);
 }
 #endif

diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c
index b66c7a5cbb277ea56bb30ddbd533877ccf9ea494..ee27b4969bf8b5626aa98521c56e245080a258a0 100644 (file)
--- a/plugins/sudoers/auth/pam.c
+++ b/plugins/sudoers/auth/pam.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999-2005, 2007-2013 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 1999-2005, 2007-2014 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -95,7 +95,7 @@ sudo_pam_init(struct passwd *pw, sudo_auth *auth)
     pam_status = pam_start(ISSET(sudo_mode, MODE_LOGIN_SHELL) ?
        def_pam_login_service : def_pam_service, pw->pw_name, &pam_conv, &pamh);
     if (pam_status != PAM_SUCCESS) {
-       log_warning(NO_MAIL, N_("unable to initialize PAM"));
+       log_warning(0, N_("unable to initialize PAM"));
        debug_return_int(AUTH_FATAL);
     }
 
@@ -146,27 +146,27 @@ sudo_pam_verify(struct passwd *pw, char *prompt, sudo_auth *auth)
                case PAM_SUCCESS:
                    debug_return_int(AUTH_SUCCESS);
                case PAM_AUTH_ERR:
-                   log_warningx(NO_MAIL, N_("account validation failure, "
+                   log_warningx(0, N_("account validation failure, "
                        "is your account locked?"));
                    debug_return_int(AUTH_FATAL);
                case PAM_NEW_AUTHTOK_REQD:
-                   log_warningx(NO_MAIL, N_("Account or password is "
+                   log_warningx(0, N_("Account or password is "
                        "expired, reset your password and try again"));
                    *pam_status = pam_chauthtok(pamh,
                        PAM_CHANGE_EXPIRED_AUTHTOK);
                    if (*pam_status == PAM_SUCCESS)
                        debug_return_int(AUTH_SUCCESS);
                    if ((s = pam_strerror(pamh, *pam_status)) != NULL) {
-                       log_warningx(NO_MAIL,
+                       log_warningx(0,
                            N_("unable to change expired password: %s"), s);
                    }
                    debug_return_int(AUTH_FAILURE);
                case PAM_AUTHTOK_EXPIRED:
-                   log_warningx(NO_MAIL,
+                   log_warningx(0,
                        N_("Password expired, contact your system administrator"));
                    debug_return_int(AUTH_FATAL);
                case PAM_ACCT_EXPIRED:
-                   log_warningx(NO_MAIL,
+                   log_warningx(0,
                        N_("Account expired or PAM config lacks an \"account\" "
                        "section for sudo, contact your system administrator"));
                    debug_return_int(AUTH_FATAL);
@@ -184,7 +184,7 @@ sudo_pam_verify(struct passwd *pw, char *prompt, sudo_auth *auth)
            debug_return_int(AUTH_FAILURE);
        default:
            if ((s = pam_strerror(pamh, *pam_status)) != NULL)
-               log_warningx(NO_MAIL, N_("PAM authentication error: %s"), s);
+               log_warningx(0, N_("PAM authentication error: %s"), s);
            debug_return_int(AUTH_FATAL);
     }
 }

diff --git a/plugins/sudoers/auth/sia.c b/plugins/sudoers/auth/sia.c
index 5d45f7e570f43235c43d70686701efa84ceaa896..eec597104b787b2ece13fa5ae236f9e1dee5f835 100644 (file)
--- a/plugins/sudoers/auth/sia.c
+++ b/plugins/sudoers/auth/sia.c
@@ -104,8 +104,7 @@ sudo_sia_setup(struct passwd *pw, char **promptp, sudo_auth *auth)
 
     if (sia_ses_init(&siah, sudo_argc, sudo_argv, NULL, pw->pw_name, user_ttypath, 1, NULL) != SIASUCCESS) {
 
-       log_warning(NO_MAIL,
-           N_("unable to initialize SIA session"));
+       log_warning(0, N_("unable to initialize SIA session"));
        debug_return_int(AUTH_FATAL);
     }
 

diff --git a/plugins/sudoers/auth/sudo_auth.c b/plugins/sudoers/auth/sudo_auth.c
index 5e7f1782ce9acd2da564cd96d53b881a7b11762a..2d686f4ff04542f4a46be0c5c9ec28160347eea9 100644 (file)
--- a/plugins/sudoers/auth/sudo_auth.c
+++ b/plugins/sudoers/auth/sudo_auth.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999-2005, 2008-2013 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 1999-2005, 2008-2014 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -117,7 +117,8 @@ sudo_auth_init(struct passwd *pw)
     standalone = IS_STANDALONE(&auth_switch[0]);
     if (standalone && auth_switch[1].name != NULL) {
        audit_failure(NewArgv, N_("invalid authentication methods"));
-       log_warningx(0, N_("Invalid authentication methods compiled into sudo!  "
+       log_warningx(SLOG_SEND_MAIL,
+           N_("Invalid authentication methods compiled into sudo!  "
            "You may not mix standalone and non-standalone authentication."));
        debug_return_int(-1);
     }
@@ -187,7 +188,7 @@ verify_user(struct passwd *pw, char *prompt, int validated)
     /* XXX - check FLAG_DISABLED too */
     if (auth_switch[0].name == NULL) {
        audit_failure(NewArgv, N_("no authentication methods"));
-       log_warningx(0,
+       log_warningx(SLOG_SEND_MAIL,
            N_("There are no authentication methods compiled into sudo!  "
            "If you want to turn off authentication, use the "
            "--disable-authentication configure option."));

diff --git a/plugins/sudoers/check.c b/plugins/sudoers/check.c
index 1d0e6daa7a1b66cdc167647402578cb5c486264e..faf687a03fc9cdbc93c1f2f5de46abcca71dd2eb 100644 (file)
--- a/plugins/sudoers/check.c
+++ b/plugins/sudoers/check.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1993-1996,1998-2005, 2007-2013
+ * Copyright (c) 1993-1996,1998-2005, 2007-2014
  *     Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -236,15 +236,18 @@ get_authpw(int mode)
        pw = sudo_user.pw;
     } else {
        if (def_rootpw) {
-           if ((pw = sudo_getpwuid(ROOT_UID)) == NULL)
-               log_warningx(0, N_("unknown uid: %u"), ROOT_UID);
+           if ((pw = sudo_getpwuid(ROOT_UID)) == NULL) {
+               log_warningx(SLOG_SEND_MAIL, N_("unknown uid: %u"), ROOT_UID);
+           }
        } else if (def_runaspw) {
-           if ((pw = sudo_getpwnam(def_runas_default)) == NULL)
-               log_warningx(0, N_("unknown user: %s"), def_runas_default);
+           if ((pw = sudo_getpwnam(def_runas_default)) == NULL) {
+               log_warningx(SLOG_SEND_MAIL,
+                   N_("unknown user: %s"), def_runas_default);
+           }
        } else if (def_targetpw) {
            if (runas_pw->pw_name == NULL) {
                /* This should never be NULL as we fake up the passwd struct */
-               log_warningx(NO_MAIL|MSG_ONLY, N_("unknown uid: %u"),
+               log_warningx(SLOG_RAW_MSG, N_("unknown uid: %u"),
                    (unsigned int) runas_pw->pw_uid);
            } else {
                sudo_pw_addref(runas_pw);

diff --git a/plugins/sudoers/env.c b/plugins/sudoers/env.c
index 1965cc97bec9f477628e40b9afb01b43dc530339..ede375eaff1b72dada824fb82c4795acb32de244 100644 (file)
--- a/plugins/sudoers/env.c
+++ b/plugins/sudoers/env.c
@@ -1047,7 +1047,7 @@ validate_env_vars(char * const env_vars[])
     if (bad != NULL) {
        bad[blen - 2] = '\0';           /* remove trailing ", " */
        /* XXX - audit? */
-       log_warningx(NO_MAIL,
+       log_warningx(0,
            N_("sorry, you are not allowed to set the following environment variables: %s"), bad);
        efree(bad);
        rval = false;

diff --git a/plugins/sudoers/iolog.c b/plugins/sudoers/iolog.c
index 627d03014a76f383ca665a61383dffbb9b1646ac..50370644feeb6c2cb305e5ba54b277ffa42f4e9b 100644 (file)
--- a/plugins/sudoers/iolog.c
+++ b/plugins/sudoers/iolog.c
@@ -97,7 +97,8 @@ io_mkdirs(char *path, mode_t mode, bool is_temp)
     /* Fast path: not a temporary and already exists. */
     if (!is_temp && stat(path, &sb) == 0) {
        if (!S_ISDIR(sb.st_mode)) {
-           log_warningx(0, N_("%s exists but is not a directory (0%o)"),
+           log_warningx(SLOG_SEND_MAIL,
+               N_("%s exists but is not a directory (0%o)"),
                path, (unsigned int) sb.st_mode);
            ok = false;
        }
@@ -108,13 +109,14 @@ io_mkdirs(char *path, mode_t mode, bool is_temp)
        *slash = '\0';
        if (stat(path, &sb) != 0) {
            if (mkdir(path, mode) != 0) {
-               log_warning(0, N_("unable to mkdir %s"), path);
+               log_warning(SLOG_SEND_MAIL, N_("unable to mkdir %s"), path);
                ok = false;
                break;
            }
            ignore_result(chown(path, (uid_t)-1, parent_gid));
        } else if (!S_ISDIR(sb.st_mode)) {
-           log_warningx(0, N_("%s exists but is not a directory (0%o)"),
+           log_warningx(SLOG_SEND_MAIL,
+               N_("%s exists but is not a directory (0%o)"),
                path, (unsigned int) sb.st_mode);
            ok = false;
            break;
@@ -128,14 +130,14 @@ io_mkdirs(char *path, mode_t mode, bool is_temp)
        /* Create final path component. */
        if (is_temp) {
            if (mkdtemp(path) == NULL) {
-               log_warning(0, N_("unable to mkdir %s"), path);
+               log_warning(SLOG_SEND_MAIL, N_("unable to mkdir %s"), path);
                ok = false;
            } else {
                ignore_result(chown(path, (uid_t)-1, parent_gid));
            }
        } else {
            if (mkdir(path, mode) != 0 && errno != EEXIST) {
-               log_warning(0, N_("unable to mkdir %s"), path);
+               log_warning(SLOG_SEND_MAIL, N_("unable to mkdir %s"), path);
                ok = false;
            } else {
                ignore_result(chown(path, (uid_t)-1, parent_gid));
@@ -199,12 +201,12 @@ io_nextid(char *iolog_dir, char *iolog_dir_fallback, char sessid[7])
     len = snprintf(pathbuf, sizeof(pathbuf), "%s/seq", iolog_dir);
     if (len <= 0 || (size_t)len >= sizeof(pathbuf)) {
        errno = ENAMETOOLONG;
-       log_warning(0, "%s/seq", pathbuf);
+       log_warning(SLOG_SEND_MAIL, "%s/seq", pathbuf);
        debug_return_bool(false);
     }
     fd = open(pathbuf, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR);
     if (fd == -1) {
-       log_warning(0, N_("unable to open %s"), pathbuf);
+       log_warning(SLOG_SEND_MAIL, N_("unable to open %s"), pathbuf);
        debug_return_bool(false);
     }
     lock_file(fd, SUDO_LOCK);
@@ -245,7 +247,7 @@ io_nextid(char *iolog_dir, char *iolog_dir_fallback, char sessid[7])
        nread = read(fd, buf, sizeof(buf) - 1);
        if (nread != 0) {
            if (nread == -1) {
-               log_warning(0, N_("unable to read %s"), pathbuf);
+               log_warning(SLOG_SEND_MAIL, N_("unable to read %s"), pathbuf);
                debug_return_bool(false);
            }
            if (buf[nread - 1] == '\n')
@@ -277,7 +279,7 @@ io_nextid(char *iolog_dir, char *iolog_dir_fallback, char sessid[7])
 
     /* Rewind and overwrite old seq file, including the NUL byte. */
     if (lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1 || write(fd, buf, 7) != 7) {
-       log_warning(0, N_("unable to write to %s"), pathbuf);
+       log_warning(SLOG_SEND_MAIL, N_("unable to write to %s"), pathbuf);
        debug_return_bool(false);
     }
     close(fd);
@@ -300,7 +302,7 @@ mkdir_iopath(const char *iolog_path, char *pathbuf, size_t pathsize)
     len = strlcpy(pathbuf, iolog_path, pathsize);
     if (len >= pathsize) {
        errno = ENAMETOOLONG;
-       log_warning(0, "%s", iolog_path);
+       log_warning(SLOG_SEND_MAIL, "%s", iolog_path);
        debug_return_size_t((size_t)-1);
     }
 
@@ -342,7 +344,7 @@ open_io_fd(char *pathbuf, size_t len, struct io_log_file *iol, bool docompress)
                iol->fd.f = fdopen(fd, "w");
        }
        if (fd == -1 || iol->fd.v == NULL) {
-           log_warning(0, N_("unable to create %s"), pathbuf);
+           log_warning(SLOG_SEND_MAIL, N_("unable to create %s"), pathbuf);
            debug_return_bool(false);
        }
     } else {
@@ -540,7 +542,7 @@ write_info_log(char *pathbuf, size_t len, struct iolog_details *details,
     strlcat(pathbuf, "/log", PATH_MAX);
     fd = open(pathbuf, O_CREAT|O_TRUNC|O_WRONLY, S_IRUSR|S_IWUSR);
     if (fd == -1 || (fp = fdopen(fd, "w")) == NULL) {
-       log_warning(0, N_("unable to create %s"), pathbuf);
+       log_warning(SLOG_SEND_MAIL, N_("unable to create %s"), pathbuf);
        debug_return_bool(false);
     }
 

diff --git a/plugins/sudoers/logging.c b/plugins/sudoers/logging.c
index 865f02002ebf6a6af55822a2f449775d73ff500a..ec8c6eb472f3125278e12cc49163cc83f2caab4b 100644 (file)
--- a/plugins/sudoers/logging.c
+++ b/plugins/sudoers/logging.c
@@ -348,7 +348,7 @@ log_failure(int status, int flags)
 void
 log_auth_failure(int status, unsigned int tries)
 {
-    int flags = NO_MAIL;
+    int flags = 0;
     debug_decl(log_auth_failure, SUDO_DEBUG_LOGGING)
 
     /* Handle auditing first. */
@@ -363,13 +363,13 @@ log_auth_failure(int status, unsigned int tries)
     if (ISSET(status, VALIDATE_OK)) {
        /* Command allowed, auth failed; do we need to send mail? */
        if (def_mail_badpass || def_mail_always)
-           flags = 0;
+           SET(flags, SLOG_SEND_MAIL);
     } else {
        /* Command denied, auth failed; make sure we don't send mail twice. */
        if (def_mail_badpass && !should_mail(status))
-           flags = 0;
+           SET(flags, SLOG_SEND_MAIL);
        /* Don't log the bad password message, we'll log a denial instead. */
-       flags |= NO_LOG;
+       SET(flags, SLOG_NO_LOG);
     }
 
     /*
@@ -435,8 +435,8 @@ vlog_warning(int flags, const char *fmt, va_list ap)
     va_list ap2;
     debug_decl(vlog_error, SUDO_DEBUG_LOGGING)
 
-    /* Need extra copy of ap for warning() below. */
-    if (!ISSET(flags, NO_STDERR))
+    /* Need extra copy of ap for vwarning()/vwarningx() below. */
+    if (!ISSET(flags, SLOG_NO_STDERR))
        va_copy(ap2, ap);
 
     /* Log messages should be in the sudoers locale. */
@@ -452,7 +452,7 @@ vlog_warning(int flags, const char *fmt, va_list ap)
     }
 
     /* Log to debug file. */
-    if (USE_ERRNO) {
+    if (SLOG_USE_ERRNO) {
        sudo_debug_printf2(NULL, NULL, 0,
            SUDO_DEBUG_WARN|SUDO_DEBUG_ERRNO|sudo_debug_subsys, "%s", message);
     } else {
@@ -460,10 +460,10 @@ vlog_warning(int flags, const char *fmt, va_list ap)
            SUDO_DEBUG_WARN|sudo_debug_subsys, "%s", message);
     }
 
-    if (ISSET(flags, MSG_ONLY)) {
+    if (ISSET(flags, SLOG_RAW_MSG)) {
        logline = message;
     } else {
-       logline = new_logline(message, ISSET(flags, USE_ERRNO) ? serrno : 0);
+       logline = new_logline(message, ISSET(flags, SLOG_USE_ERRNO) ? serrno : 0);
         efree(message);
     }
 
@@ -473,13 +473,13 @@ vlog_warning(int flags, const char *fmt, va_list ap)
     /*
      * Send a copy of the error via mail.
      */
-    if (!ISSET(flags, NO_MAIL))
+    if (ISSET(flags, SLOG_SEND_MAIL))
        send_mail("%s", logline);
 
     /*
      * Log to syslog and/or a file.
      */
-    if (!ISSET(flags, NO_LOG)) {
+    if (!ISSET(flags, SLOG_NO_LOG)) {
        if (def_syslog)
            do_syslog(def_syslog_badpri, logline);
        if (def_logfile)
@@ -496,14 +496,14 @@ vlog_warning(int flags, const char *fmt, va_list ap)
     /*
      * Tell the user (in their locale).
      */
-    if (!ISSET(flags, NO_STDERR)) {
+    if (!ISSET(flags, SLOG_NO_STDERR)) {
        sudoers_setlocale(SUDOERS_LOCALE_USER, &oldlocale);
        if (fmt == INCORRECT_PASSWORD_ATTEMPT) {
            unsigned int tries = va_arg(ap2, unsigned int);
            warningx_nodebug(ngettext("%u incorrect password attempt",
                "%u incorrect password attempts", tries), tries);
        } else {
-           if (ISSET(flags, USE_ERRNO))
+           if (ISSET(flags, SLOG_USE_ERRNO))
                vwarning_nodebug(_(fmt), ap2);
            else
                vwarningx_nodebug(_(fmt), ap2);
@@ -523,7 +523,7 @@ log_warning(int flags, const char *fmt, ...)
 
     /* Log the error. */
     va_start(ap, fmt);
-    vlog_warning(flags|USE_ERRNO, fmt, ap);
+    vlog_warning(flags|SLOG_USE_ERRNO, fmt, ap);
     va_end(ap);
 
     debug_return;

diff --git a/plugins/sudoers/logging.h b/plugins/sudoers/logging.h
index e8f69a1d5d749210dcbb97d4e7f8c8ac1bfa2ab5..013062ee3c0134dfb3beaa58d9f4ef700855559e 100644 (file)
--- a/plugins/sudoers/logging.h
+++ b/plugins/sudoers/logging.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999-2005, 2009-2013
+ * Copyright (c) 1999-2005, 2009-2014
  *     Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -25,23 +25,23 @@
 # include <varargs.h>
 #endif
 
-/* Logging types */
-#define SLOG_SYSLOG            0x01
-#define SLOG_FILE              0x02
-#define SLOG_BOTH              0x03
-
 /*
  * Values for sudoers_setlocale()
  */
 #define SUDOERS_LOCALE_USER     0
 #define SUDOERS_LOCALE_SUDOERS  1
 
+/* Logging types */
+#define SLOG_SYSLOG            0x01
+#define SLOG_FILE              0x02
+#define SLOG_BOTH              0x03
+
 /* Flags for log_warning()/log_warningx() */
-#define MSG_ONLY               0x01
-#define USE_ERRNO              0x02    /* internal use only */
-#define NO_MAIL                        0x04
-#define NO_STDERR              0x08
-#define NO_LOG                 0x10
+#define SLOG_USE_ERRNO         0x01    /* internal use only */
+#define SLOG_RAW_MSG           0x02    /* do not format msg before logging */
+#define SLOG_SEND_MAIL         0x04    /* log via mail */
+#define SLOG_NO_STDERR         0x08    /* do not log via stderr */
+#define SLOG_NO_LOG            0x10    /* do not log via file or syslog */
 
 /*
  * Maximum number of characters to log per entry.  The syslogger

diff --git a/plugins/sudoers/parse.c b/plugins/sudoers/parse.c
index 5e6471dcaa187f52e8d07cd9e0bc2c2dbadf0725..d925231fa13f6375b06c90c901f4c2b7b87445a6 100644 (file)
--- a/plugins/sudoers/parse.c
+++ b/plugins/sudoers/parse.c
@@ -112,10 +112,10 @@ sudo_file_parse(struct sudo_nss *nss)
     sudoersin = nss->handle;
     if (sudoersparse() != 0 || parse_error) {
        if (errorlineno != -1) {
-           log_warningx(0, N_("parse error in %s near line %d"),
+           log_warningx(SLOG_SEND_MAIL, N_("parse error in %s near line %d"),
                errorfile, errorlineno);
        } else {
-           log_warningx(0, N_("parse error in %s"), errorfile);
+           log_warningx(SLOG_SEND_MAIL, N_("parse error in %s"), errorfile);
        }
        debug_return_int(-1);
     }

diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
index dba853c8420d35fea7f1337db6a5772e3e2cf9e7..10a52356f8ea9dadce108712d80612fc0dd44477 100644 (file)
--- a/plugins/sudoers/sudoers.c
+++ b/plugins/sudoers/sudoers.c
@@ -155,8 +155,10 @@ sudoers_policy_init(void *info, char * const envp[])
     TAILQ_FOREACH_SAFE(nss, snl, entries, nss_next) {
         if (nss->open(nss) == 0 && nss->parse(nss) == 0) {
             sources++;
-            if (nss->setdefs(nss) != 0)
-                log_warningx(NO_STDERR, N_("problem with defaults entries"));
+            if (nss->setdefs(nss) != 0) {
+                log_warningx(SLOG_SEND_MAIL|SLOG_NO_STDERR,
+                   N_("problem with defaults entries"));
+           }
         } else {
            TAILQ_REMOVE(snl, nss, entries);
         }
@@ -194,8 +196,10 @@ sudoers_policy_init(void *info, char * const envp[])
            goto cleanup;
     }
 
-    if (!update_defaults(SETDEF_RUNAS))
-       log_warningx(NO_STDERR, N_("problem with defaults entries"));
+    if (!update_defaults(SETDEF_RUNAS)) {
+       log_warningx(SLOG_SEND_MAIL|SLOG_NO_STDERR,
+           N_("problem with defaults entries"));
+    }
 
     if (def_fqdn)
        set_fqdn();     /* deferred until after sudoers is parsed */
@@ -335,8 +339,8 @@ sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
            timestamp_uid = pw->pw_uid;
            sudo_pw_delref(pw);
        } else {
-           log_warningx(0, N_("timestamp owner (%s): No such user"),
-               def_timestampowner);
+           log_warningx(SLOG_SEND_MAIL,
+               N_("timestamp owner (%s): No such user"), def_timestampowner);
            timestamp_uid = ROOT_UID;
        }
     }
@@ -625,7 +629,8 @@ init_vars(char * const envp[])
 
     /* It is now safe to use log_warningx() and set_perms() */
     if (unknown_user) {
-       log_warningx(0, N_("unknown uid: %u"), (unsigned int) user_uid);
+       log_warningx(SLOG_SEND_MAIL, N_("unknown uid: %u"),
+           (unsigned int) user_uid);
        debug_return_bool(false);
     }
     debug_return_bool(true);
@@ -671,7 +676,7 @@ set_cmnd(void)
            if (rval == NOT_FOUND_ERROR) {
                if (errno == ENAMETOOLONG)
                    audit_failure(NewArgv, N_("command too long"));
-               log_warning(NO_MAIL, "%s", NewArgv[0]);
+               log_warning(0, "%s", NewArgv[0]);
                debug_return_int(rval);
            }
        }
@@ -720,8 +725,10 @@ set_cmnd(void)
     else
        user_base = user_cmnd;
 
-    if (!update_defaults(SETDEF_CMND))
-       log_warningx(NO_STDERR, N_("problem with defaults entries"));
+    if (!update_defaults(SETDEF_CMND)) {
+       log_warningx(SLOG_SEND_MAIL|SLOG_NO_STDERR,
+           N_("problem with defaults entries"));
+    }
 
     debug_return_int(rval);
 }
@@ -758,10 +765,11 @@ open_sudoers(const char *sudoers, bool doedit, bool *keepopen)
             * the user with a reasonable error message (unlike the lexer).
             */
            if ((fp = fopen(sudoers, "r")) == NULL) {
-               log_warning(0, N_("unable to open %s"), sudoers);
+               log_warning(SLOG_SEND_MAIL, N_("unable to open %s"), sudoers);
            } else {
                if (sb.st_size != 0 && fgetc(fp) == EOF) {
-                   log_warning(0, N_("unable to read %s"), sudoers);
+                   log_warning(SLOG_SEND_MAIL,
+                       N_("unable to read %s"), sudoers);
                    fclose(fp);
                    fp = NULL;
                } else {
@@ -772,21 +780,24 @@ open_sudoers(const char *sudoers, bool doedit, bool *keepopen)
            }
            break;
        case SUDO_PATH_MISSING:
-           log_warning(0, N_("unable to stat %s"), sudoers);
+           log_warning(SLOG_SEND_MAIL, N_("unable to stat %s"), sudoers);
            break;
        case SUDO_PATH_BAD_TYPE:
-           log_warningx(0, N_("%s is not a regular file"), sudoers);
+           log_warningx(SLOG_SEND_MAIL,
+               N_("%s is not a regular file"), sudoers);
            break;
        case SUDO_PATH_WRONG_OWNER:
-           log_warningx(0, N_("%s is owned by uid %u, should be %u"),
-               sudoers, (unsigned int) sb.st_uid, (unsigned int) sudoers_uid);
+           log_warningx(SLOG_SEND_MAIL,
+               N_("%s is owned by uid %u, should be %u"), sudoers,
+               (unsigned int) sb.st_uid, (unsigned int) sudoers_uid);
            break;
        case SUDO_PATH_WORLD_WRITABLE:
-           log_warningx(0, N_("%s is world writable"), sudoers);
+           log_warningx(SLOG_SEND_MAIL, N_("%s is world writable"), sudoers);
            break;
        case SUDO_PATH_GROUP_WRITABLE:
-           log_warningx(0, N_("%s is owned by gid %u, should be %u"),
-               sudoers, (unsigned int) sb.st_gid, (unsigned int) sudoers_gid);
+           log_warningx(SLOG_SEND_MAIL,
+               N_("%s is owned by gid %u, should be %u"), sudoers,
+               (unsigned int) sb.st_gid, (unsigned int) sudoers_gid);
            break;
        default:
            /* NOTREACHED */
@@ -806,7 +817,7 @@ open_sudoers(const char *sudoers, bool doedit, bool *keepopen)
 static bool
 set_loginclass(struct passwd *pw)
 {
-    const int errflags = NO_MAIL|MSG_ONLY;
+    const int errflags = SLOG_RAW_MSG;
     login_cap_t *lc;
     bool rval = true;
     debug_decl(set_loginclass, SUDO_DEBUG_PLUGIN)
@@ -871,7 +882,8 @@ set_fqdn(void)
     hint.ai_family = PF_UNSPEC;
     hint.ai_flags = AI_FQDN;
     if (getaddrinfo(user_host, NULL, &hint, &res0) != 0) {
-       log_warningx(MSG_ONLY, N_("unable to resolve host %s"), user_host);
+       log_warningx(SLOG_SEND_MAIL|SLOG_RAW_MSG,
+           N_("unable to resolve host %s"), user_host);
     } else {
        if (user_shost != user_host)
            efree(user_shost);
@@ -907,7 +919,7 @@ set_runaspw(const char *user, bool quiet)
     if (pw == NULL) {
        if ((pw = sudo_getpwnam(user)) == NULL) {
            if (!quiet)
-               log_warningx(NO_MAIL|MSG_ONLY, N_("unknown user: %s"), user);
+               log_warningx(SLOG_RAW_MSG, N_("unknown user: %s"), user);
            debug_return_bool(false);
        }
     }
@@ -938,7 +950,7 @@ set_runasgr(const char *group, bool quiet)
     if (gr == NULL) {
        if ((gr = sudo_getgrnam(group)) == NULL) {
            if (!quiet)
-               log_warningx(NO_MAIL|MSG_ONLY, N_("unknown group: %s"), group);
+               log_warningx(SLOG_RAW_MSG, N_("unknown group: %s"), group);
            debug_return_bool(false);
        }
     }

diff --git a/plugins/sudoers/timestamp.c b/plugins/sudoers/timestamp.c
index b91b08b6671effcf6d1e48a514d4d76859ef28eb..8f75607ad57c8ad1eda005376a5029466fcf54a8 100644 (file)
--- a/plugins/sudoers/timestamp.c
+++ b/plugins/sudoers/timestamp.c
@@ -182,10 +182,13 @@ found_it:
     if ((size_t)nwritten == sizeof(struct timestamp_entry))
        debug_return_bool(true);
 
-    if (nwritten == -1)
-       log_warning(0, N_("unable to write to %s"), timestamp_file);
-    else
-       log_warningx(0, N_("unable to write to %s"), timestamp_file);
+    if (nwritten == -1) {
+       log_warning(SLOG_SEND_MAIL,
+           N_("unable to write to %s"), timestamp_file);
+    } else {
+       log_warningx(SLOG_SEND_MAIL,
+           N_("unable to write to %s"), timestamp_file);
+    }
 
     /* Truncate on partial write to be safe. */
     if (nwritten > 0 && old_eof != (off_t)-1) {
@@ -312,8 +315,8 @@ build_timestamp(struct passwd *pw)
     len = snprintf(timestamp_file, sizeof(timestamp_file), "%s/%s",
        def_timestampdir, user_name);
     if (len <= 0 || (size_t)len >= sizeof(timestamp_file)) {
-       log_warningx(0, N_("timestamp path too long: %s/%s"),
-           def_timestampdir, user_name);
+       log_warningx(SLOG_SEND_MAIL,
+           N_("timestamp path too long: %s/%s"), def_timestampdir, user_name);
        len = -1;
     }
 
@@ -352,7 +355,7 @@ update_timestamp(struct passwd *pw)
     if (uid_changed)
        (void) restore_perms();
     if (fd == -1) {
-       log_warning(0, N_("unable to open %s"), timestamp_file);
+       log_warning(SLOG_SEND_MAIL, N_("unable to open %s"), timestamp_file);
        goto done;
     }
 
@@ -492,7 +495,8 @@ timestamp_status(struct passwd *pw)
 #ifdef CLOCK_MONOTONIC
        /* A monotonic clock should never run backwards. */
        if (diff.tv_sec < 0) {
-           log_warningx(0, N_("ignoring time stamp from the future"));
+           log_warningx(SLOG_SEND_MAIL,
+               N_("ignoring time stamp from the future"));
            status = TS_OLD;
            SET(entry.flags, TS_DISABLED);
            ts_update_record(fd, &entry, timestamp_hint);
@@ -503,7 +507,7 @@ timestamp_status(struct passwd *pw)
        timeout.tv_sec *= 2;
        if (sudo_timespeccmp(&diff, &timeout, >)) {
            time_t tv_sec = (time_t)entry.ts.tv_sec;
-           log_warningx(0,
+           log_warningx(SLOG_SEND_MAIL,
                N_("time stamp too far in the future: %20.20s"),
                4 + ctime(&tv_sec));
            status = TS_OLD;
@@ -607,7 +611,7 @@ already_lectured(int unused)
        if (len > 0 && (size_t)len < sizeof(status_file)) {
            debug_return_bool(stat(status_file, &sb) == 0);
        }
-       log_warningx(0, N_("lecture status path too long: %s/%s"),
+       log_warningx(SLOG_SEND_MAIL, N_("lecture status path too long: %s/%s"),
            def_lecture_status_dir, user_name);
     }
     debug_return_bool(false);
@@ -628,7 +632,7 @@ set_lectured(void)
     len = snprintf(lecture_status, sizeof(lecture_status), "%s/%s",
        def_lecture_status_dir, user_name);
     if (len <= 0 || (size_t)len >= sizeof(lecture_status)) {
-       log_warningx(0, N_("lecture status path too long: %s/%s"),
+       log_warningx(SLOG_SEND_MAIL, N_("lecture status path too long: %s/%s"),
            def_lecture_status_dir, user_name);
        goto done;
     }