From: Todd C. Miller Date: Fri, 7 Aug 2015 18:21:37 +0000 (-0600) Subject: Emphasize that wildcards in command line arguments are dangerous. X-Git-Tag: SUDO_1_8_15^2~91 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=329a8dee8aa52f53ea903456dc7c34b1b2a98fbe;p=sudo Emphasize that wildcards in command line arguments are dangerous. Document the failings of the passwd example on GNU systems. Bug #691 --- diff --git a/doc/sudoers.cat b/doc/sudoers.cat index 1abbd9b5c..4f5dabad3 100644 --- a/doc/sudoers.cat +++ b/doc/sudoers.cat @@ -698,7 +698,7 @@ SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT Would match any file name beginning with a letter. Note that a forward slash (`/') will nnoott be matched by wildcards used in - the path name. This is to make a path like: + the file name portion of the command. This is to make a path like: /usr/bin/* @@ -708,10 +708,10 @@ SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT matched by wildcards since command line arguments may contain arbitrary strings and not just path names. - Wildcards in command line arguments should be used with care. Because - command line arguments are matched as a single, concatenated string, a - wildcard such as `?' or `*' can match multiple words. For example, while - a sudoers entry like: + WWiillddccaarrddss iinn ccoommmmaanndd lliinnee aarrgguummeennttss sshhoouulldd bbee uusseedd wwiitthh ccaarree.. + Command line arguments are matched as a single, concatenated string. + This mean a wildcard such as `?' or `*' will match _m_u_l_t_i_p_l_e words. For + example, while a sudoers entry like: %operator ALL = /bin/cat /var/log/messages* @@ -2112,8 +2112,16 @@ EEXXAAMMPPLLEESS with any group in the _A_D_M_I_N_G_R_P Runas_Alias (the aaddmm and ooppeerr groups). The user ppeettee is allowed to change anyone's password except for root on - the _H_P_P_A machines. Note that this assumes passwd(1) does not take - multiple user names on the command line. + the _H_P_P_A machines. Because command line arguments are matched as a + single, concatenated string, the `*' wildcard will match _m_u_l_t_i_p_l_e words. + This example assumes that passwd(1) does not take multiple user names on + the command line. Note that on GNU systems, options to passwd(1) may be + specified after the user argument. As a result, this rule will also + allow: + + passwd username --expire + + which may not be desirable. bob SPARC = (OP) ALL : SGI = (OP) ALL diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in index 1da7ac75c..745310006 100644 --- a/doc/sudoers.man.in +++ b/doc/sudoers.man.in @@ -1519,7 +1519,7 @@ Note that a forward slash will \fBnot\fR be matched by -wildcards used in the path name. +wildcards used in the file name portion of the command. This is to make a path like: .nf .sp @@ -1538,13 +1538,16 @@ When matching the command line arguments, however, a slash get matched by wildcards since command line arguments may contain arbitrary strings and not just path names. .PP -Wildcards in command line arguments should be used with care. -Because command line arguments are matched as a single, concatenated -string, a wildcard such as +\fBWildcards in command line arguments should be used with care.\fR +.br +Command line arguments are matched as a single, concatenated string. +This mean a wildcard such as \(oq\&?\(cq or \(oq*\(cq -can match multiple words. +will match +\fImultiple\fR +words. For example, while a sudoers entry like: .nf .sp @@ -4304,9 +4307,27 @@ is allowed to change anyone's password except for root on the \fIHPPA\fR machines. -Note that this assumes +Because command line arguments are matched as a single, +concatenated string, the +\(oq*\(cq +wildcard will match +\fImultiple\fR +words. +This example assumes that passwd(1) does not take multiple user names on the command line. +Note that on GNU systems, options to +passwd(1) +may be specified after the user argument. +As a result, this rule will also allow: +.nf +.sp +.RS 4n +passwd username --expire +.RE +.fi +.PP +which may not be desirable. .nf .sp .RS 0n diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in index 132959d80..d1f1f9e34 100644 --- a/doc/sudoers.mdoc.in +++ b/doc/sudoers.mdoc.in @@ -1418,7 +1418,7 @@ Note that a forward slash will .Sy not be matched by -wildcards used in the path name. +wildcards used in the file name portion of the command. This is to make a path like: .Bd -literal -offset 4n /usr/bin/* @@ -1434,13 +1434,18 @@ When matching the command line arguments, however, a slash get matched by wildcards since command line arguments may contain arbitrary strings and not just path names. .Pp +.Bf -symbolic Wildcards in command line arguments should be used with care. -Because command line arguments are matched as a single, concatenated -string, a wildcard such as +.Ef +.br +Command line arguments are matched as a single, concatenated string. +This mean a wildcard such as .Ql \&? or .Ql * -can match multiple words. +will match +.Em multiple +words. For example, while a sudoers entry like: .Bd -literal -offset 4n %operator ALL = /bin/cat /var/log/messages* @@ -3981,9 +3986,24 @@ is allowed to change anyone's password except for root on the .Em HPPA machines. -Note that this assumes +Because command line arguments are matched as a single, +concatenated string, the +.Ql * +wildcard will match +.Em multiple +words. +This example assumes that .Xr passwd 1 does not take multiple user names on the command line. +Note that on GNU systems, options to +.Xr passwd 1 +may be specified after the user argument. +As a result, this rule will also allow: +.Bd -literal -offset 4n +passwd username --expire +.Ed +.Pp +which may not be desirable. .Bd -literal bob SPARC = (OP) ALL : SGI = (OP) ALL .Ed