Add case_insensitive_group and case_insensitive_user sudoers options,

which are enabled by default.

diff --git a/doc/sudoers.cat b/doc/sudoers.cat
index 5c65888c0cad2ddb3a6fcdc0b7bbf0421e349247..026d61b4325b4416213bba15f0f35d8e7ea6d595 100644 (file)
--- a/doc/sudoers.cat
+++ b/doc/sudoers.cat
@@ -950,6 +950,18 @@ S\bSU\bUD\bDO\bOE\bER\bRS\bS O\bOP\bPT\bTI\bIO\bON\bNS\bS
                        the PASSWD and NOPASSWD tags.  This flag is _\bo_\bn by
                        default.
 
+     case_insensitive_group
+                       If enabled, group names in _\bs_\bu_\bd_\bo_\be_\br_\bs will be matched in a
+                       case insentive manner.  This may be necessary when
+                       users are stored in LDAP or AD.  This flag is _\bo_\bn by
+                       default.
+
+     case_insensitive_user
+                       If enabled, user names in _\bs_\bu_\bd_\bo_\be_\br_\bs will be matched in a
+                       case insentive manner.  This may be necessary when
+                       groups are stored in LDAP or AD.  This flag is _\bo_\bn by
+                       default.
+
      closefrom_override
                        If set, the user may use s\bsu\bud\bdo\bo's -\b-C\bC option which
                        overrides the default starting point at which s\bsu\bud\bdo\bo
@@ -2897,4 +2909,4 @@ D\bDI\bIS\bSC\bCL\bLA\bAI\bIM\bME\bER\bR
      file distributed with s\bsu\bud\bdo\bo or https://www.sudo.ws/license.html for
      complete details.
 
-Sudo 1.8.23                    February 26, 2018                   Sudo 1.8.23
+Sudo 1.8.23                      March 5, 2018                     Sudo 1.8.23

diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in
index 85d0806af6b94e9b9a9e24e09b1052d6ed0caf06..c131639e7223aeaedd43866ec265aabadba2358c 100644 (file)
--- a/doc/sudoers.man.in
+++ b/doc/sudoers.man.in
@@ -21,7 +21,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.TH "SUDOERS" "5" "February 26, 2018" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
+.TH "SUDOERS" "5" "March 5, 2018" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -2042,6 +2042,24 @@ This flag is
 \fIon\fR
 by default.
 .TP 18n
+case_insensitive_group
+If enabled, group names in
+\fIsudoers\fR
+will be matched in a case insentive manner.
+This may be necessary when users are stored in LDAP or AD.
+This flag is
+\fIon\fR
+by default.
+.TP 18n
+case_insensitive_user
+If enabled, user names in
+\fIsudoers\fR
+will be matched in a case insentive manner.
+This may be necessary when groups are stored in LDAP or AD.
+This flag is
+\fIon\fR
+by default.
+.TP 18n
 closefrom_override
 If set, the user may use
 \fBsudo\fR's

diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in
index 8a78855b66593c185a81d1c3f16182398e905857..9456e091629b529343a95bc22b88c90182acc434 100644 (file)
--- a/doc/sudoers.mdoc.in
+++ b/doc/sudoers.mdoc.in
@@ -19,7 +19,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.Dd February 26, 2018
+.Dd March 5, 2018
 .Dt SUDOERS @mansectform@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -1911,6 +1911,22 @@ tags.
 This flag is
 .Em on
 by default.
+.It case_insensitive_group
+If enabled, group names in
+.Em sudoers
+will be matched in a case insentive manner.
+This may be necessary when users are stored in LDAP or AD.
+This flag is
+.Em on
+by default.
+.It case_insensitive_user
+If enabled, user names in
+.Em sudoers
+will be matched in a case insentive manner.
+This may be necessary when groups are stored in LDAP or AD.
+This flag is
+.Em on
+by default.
 .It closefrom_override
 If set, the user may use
 .Nm sudo Ns 's

diff --git a/plugins/sudoers/def_data.c b/plugins/sudoers/def_data.c
index 73f18d8b29f0c67e56f038c4b7266595a72a2a40..07e343320c337ebaca407280c8d754f78035ffec 100644 (file)
--- a/plugins/sudoers/def_data.c
+++ b/plugins/sudoers/def_data.c
@@ -485,6 +485,14 @@ struct sudo_defs_types sudo_defs_table[] = {
        "authfail_message", T_STR,
        N_("Authentication failure message: %s"),
        NULL,
+    }, {
+       "case_insensitive_user", T_FLAG,
+       N_("Ignore case when matching user names"),
+       NULL,
+    }, {
+       "case_insensitive_group", T_FLAG,
+       N_("Ignore case when matching group names"),
+       NULL,
     }, {
        NULL, 0, NULL
     }

diff --git a/plugins/sudoers/def_data.h b/plugins/sudoers/def_data.h
index 67dc145da2667e485bcada8cf3a6f7647d385506..65f10c3555cfcbe365f5bc78d983c3e505071de5 100644 (file)
--- a/plugins/sudoers/def_data.h
+++ b/plugins/sudoers/def_data.h
@@ -222,6 +222,10 @@
 #define def_timestamp_type      (sudo_defs_table[I_TIMESTAMP_TYPE].sd_un.tuple)
 #define I_AUTHFAIL_MESSAGE      111
 #define def_authfail_message    (sudo_defs_table[I_AUTHFAIL_MESSAGE].sd_un.str)
+#define I_CASE_INSENSITIVE_USER 112
+#define def_case_insensitive_user (sudo_defs_table[I_CASE_INSENSITIVE_USER].sd_un.flag)
+#define I_CASE_INSENSITIVE_GROUP 113
+#define def_case_insensitive_group (sudo_defs_table[I_CASE_INSENSITIVE_GROUP].sd_un.flag)
 
 enum def_tuple {
        never,

diff --git a/plugins/sudoers/def_data.in b/plugins/sudoers/def_data.in
index 5bb8d31eec18977f6ad923356dec7550c59ae01f..99d4360082e122487c6f43290f516c2e87130a2d 100644 (file)
--- a/plugins/sudoers/def_data.in
+++ b/plugins/sudoers/def_data.in
@@ -351,3 +351,9 @@ timestamp_type
 authfail_message
        T_STR
        "Authentication failure message: %s"
+case_insensitive_user
+       T_FLAG
+       "Ignore case when matching user names"
+case_insensitive_group
+       T_FLAG
+       "Ignore case when matching group names"

diff --git a/plugins/sudoers/defaults.c b/plugins/sudoers/defaults.c
index cbee79d45fb960fe987373c97a7d7290a18f7862..69766a81d8916f2875633435b55878eb107ea05d 100644 (file)
--- a/plugins/sudoers/defaults.c
+++ b/plugins/sudoers/defaults.c
@@ -637,6 +637,8 @@ init_defaults(void)
     def_set_utmp = true;
     def_pam_setcred = true;
     def_syslog_maxlen = MAXSYSLOGLEN;
+    def_case_insensitive_user = true;
+    def_case_insensitive_group = true;
 
     /* Reset the locale. */
     if (!firsttime) {

diff --git a/plugins/sudoers/ldap.c b/plugins/sudoers/ldap.c
index 8857c0ce37cbbac54c760a6b6061c8402c3f5df1..d0a1c88085e64c993354677a77cdfbe4ad46841f 100644 (file)
--- a/plugins/sudoers/ldap.c
+++ b/plugins/sudoers/ldap.c
@@ -435,7 +435,7 @@ sudo_ldap_check_runas_user(LDAP *ld, LDAPMessage *entry, int *group_matched)
             * No runas user entries but have a matching runas group entry.
             * If trying to run as the invoking user, allow it.
             */
-           if (strcmp(user_name, runas_pw->pw_name) == 0)
+           if (userpw_matches(user_name, runas_pw->pw_name, runas_pw))
                ret = true;
            break;
        }
@@ -475,7 +475,7 @@ sudo_ldap_check_runas_user(LDAP *ld, LDAPMessage *entry, int *group_matched)
        case '\0':
            /* Empty RunAsUser means run as the invoking user. */
            if (ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) &&
-               strcmp(user_name, runas_pw->pw_name) == 0)
+               userpw_matches(user_name, runas_pw->pw_name, runas_pw))
                ret = true;
            break;
        case 'A':

diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c
index 318eec8dd74a617304c2a54473f04cc8041d1caa..e67809a533fa710acef5df0e58326364436d01e5 100644 (file)
--- a/plugins/sudoers/match.c
+++ b/plugins/sudoers/match.c
@@ -980,7 +980,10 @@ userpw_matches(const char *sudoers_user, const char *user, const struct passwd *
            goto done;
        }
     }
-    rc = strcasecmp(sudoers_user, user) == 0;
+    if (def_case_insensitive_user)
+       rc = strcasecmp(sudoers_user, user) == 0;
+    else
+       rc = strcmp(sudoers_user, user) == 0;
 done:
     sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
        "user %s matches sudoers user %s: %s",
@@ -1007,7 +1010,10 @@ group_matches(const char *sudoers_group, const struct group *gr)
            goto done;
        }
     }
-    rc = strcasecmp(sudoers_group, gr->gr_name) == 0;
+    if (def_case_insensitive_group)
+       rc = strcasecmp(sudoers_group, gr->gr_name) == 0;
+    else
+       rc = strcmp(sudoers_group, gr->gr_name) == 0;
 done:
     sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
        "group %s matches sudoers group %s: %s",

diff --git a/plugins/sudoers/pwutil.c b/plugins/sudoers/pwutil.c
index 1983311af4b37dd16d2392ffd1cf98d9437eb845..26235812a08b592a7a2cf1d40d4f7ea48a49afc2 100644 (file)
--- a/plugins/sudoers/pwutil.c
+++ b/plugins/sudoers/pwutil.c
@@ -1034,9 +1034,15 @@ user_in_group(const struct passwd *pw, const char *group)
            }
        }
     } else if ((grlist = sudo_get_grlist(pw)) != NULL) {
+       int (*compare)(const char *, const char *);
+       if (def_case_insensitive_group)
+           compare = strcasecmp;
+       else
+           compare = strcmp;
+
        /* Check the supplementary group vector. */
        for (i = 0; i < grlist->ngroups; i++) {
-           if (strcasecmp(group, grlist->groups[i]) == 0) {
+           if (compare(group, grlist->groups[i]) == 0) {
                matched = true;
                goto done;
            }
@@ -1044,7 +1050,7 @@ user_in_group(const struct passwd *pw, const char *group)
 
        /* Check against user's primary (passwd file) group. */
        if ((grp = sudo_getgrgid(pw->pw_gid)) != NULL) {
-           if (strcasecmp(group, grp->gr_name) == 0) {
+           if (compare(group, grp->gr_name) == 0) {
                matched = true;
                goto done;
            }

diff --git a/plugins/sudoers/sssd.c b/plugins/sudoers/sssd.c
index 1994f9c1c55d6b19897309a8c930099f9ad2ce36..b380125a4f1bd3200fb9a05da2b4df1c6c796090 100644 (file)
--- a/plugins/sudoers/sssd.c
+++ b/plugins/sudoers/sssd.c
@@ -455,7 +455,7 @@ sudo_sss_open(struct sudo_nss *nss)
      * If runhost is the same as the local host, check for ipa_hostname
      * in sssd.conf and use it in preference to user_runhost.
      */
-    if (strcmp(user_runhost, user_host) == 0) {
+    if (strcasecmp(user_runhost, user_host) == 0) {
        if (get_ipa_hostname(&handle->ipa_shost, &handle->ipa_host) == -1) {
            free(handle);
            debug_return_int(ENOMEM);
@@ -607,7 +607,7 @@ sudo_sss_check_runas_user(struct sudo_sss_handle *handle, struct sss_sudo_rule *
             * If trying to run as the invoking user, allow it.
             */
            sudo_debug_printf(SUDO_DEBUG_INFO, "Matching against user_name");
-           if (strcmp(user_name, runas_pw->pw_name) == 0)
+           if (userpw_matches(user_name, runas_pw->pw_name, runas_pw))
                ret = true;
            break;
        }
@@ -660,7 +660,7 @@ sudo_sss_check_runas_user(struct sudo_sss_handle *handle, struct sss_sudo_rule *
        case '\0':
            /* Empty RunAsUser means run as the invoking user. */
            if (ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) &&
-               strcmp(user_name, runas_pw->pw_name) == 0)
+               userpw_matches(user_name, runas_pw->pw_name, runas_pw))
                ret = true;
            break;
        case 'A':