From 626e2cd209ceebb33c8cfda5b0eddbf43c59e202 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Mon, 5 Jan 2004 03:58:39 +0000 Subject: [PATCH] Add _PATH_SUDO_NOEXEC and corresponding --with-noexec configure option. The default value of noexec_file is set to this. --- configure | 37 +++++++++++++++++++++++++++++++++++++ configure.in | 28 ++++++++++++++++++++++++++++ defaults.c | 3 +++ env.c | 2 +- pathnames.h.in | 4 ++++ 5 files changed, 73 insertions(+), 1 deletion(-) diff --git a/configure b/configure index ea767bbf9..d5eb5677f 100755 --- a/configure +++ b/configure @@ -918,6 +918,7 @@ Optional Packages: --with-passwd-tries number of tries to enter password (default is 3) --with-timeout minutes before sudo asks for passwd again (def is 5 minutes) --with-password-timeout passwd prompt timeout in minutes (default is 5 minutes) + --with-noexec fully qualified pathname of sudo_noexec.so --with-execv use execv() instead of execvp() --with-tty-tickets use a different ticket file for each tty --with-insults insult the user for entering an incorrect password @@ -2718,6 +2719,24 @@ _ACEOF echo "$as_me:$LINENO: result: $password_timeout" >&5 echo "${ECHO_T}$password_timeout" >&6 +echo "$as_me:$LINENO: checking path to sudo_noexec.so" >&5 +echo $ECHO_N "checking path to sudo_noexec.so... $ECHO_C" >&6 + +# Check whether --with-noexec or --without-noexec was given. +if test "${with_noexec+set}" = set; then + withval="$with_noexec" + case $with_noexec in + yes) with_noexec="$libexecdir/sudo_noexec.so" + ;; + no) ;; + *) ;; +esac +else + with_noexec="$libexecdir/sudo_noexec.so" +fi; +echo "$as_me:$LINENO: result: $with_noexec" >&5 +echo "${ECHO_T}$with_noexec" >&6 + # Check whether --with-execv or --without-execv was given. if test "${with_execv+set}" = set; then @@ -14342,6 +14361,24 @@ fi test "$exec_prefix" = "NONE" && exec_prefix='$(prefix)' +if test "$with_noexec" != "no"; then + oexec_prefix="$exec_prefix" + if test "$exec_prefix" = '$(prefix)'; then + if test "$prefix" = "NONE"; then + exec_prefix="$ac_default_prefix" + else + exec_prefix="$prefix" + fi + fi + eval with_noexec="$with_noexec" + +cat >>confdefs.h <<_ACEOF +#define _PATH_SUDO_NOEXEC "$with_noexec" +_ACEOF + + exec_prefix="$oexec_prefix" +fi + ac_config_files="$ac_config_files Makefile sudo.man visudo.man sudoers.man" cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure diff --git a/configure.in b/configure.in index 4534de829..87dec20f7 100644 --- a/configure.in +++ b/configure.in @@ -804,6 +804,16 @@ esac]) AC_DEFINE_UNQUOTED(PASSWORD_TIMEOUT, $password_timeout, [The passwd prompt timeout (in minutes).]) AC_MSG_RESULT($password_timeout) +AC_MSG_CHECKING(path to sudo_noexec.so) +AC_ARG_WITH(noexec, [ --with-noexec fully qualified pathname of sudo_noexec.so], +[case $with_noexec in + yes) with_noexec="$libexecdir/sudo_noexec.so" + ;; + no) ;; + *) ;; +esac], [with_noexec="$libexecdir/sudo_noexec.so"]) +AC_MSG_RESULT($with_noexec) + AC_ARG_WITH(execv, [ --with-execv use execv() instead of execvp()], [case $with_execv in yes) AC_MSG_CHECKING(whether to use execvp or execv) @@ -2071,6 +2081,24 @@ dnl Set exec_prefix dnl test "$exec_prefix" = "NONE" && exec_prefix='$(prefix)' +dnl +dnl Defer setting _PATH_SUDO_NOEXEC until after exec_prefix is set +dnl XXX - this is gross! +dnl +if test "$with_noexec" != "no"; then + oexec_prefix="$exec_prefix" + if test "$exec_prefix" = '$(prefix)'; then + if test "$prefix" = "NONE"; then + exec_prefix="$ac_default_prefix" + else + exec_prefix="$prefix" + fi + fi + eval with_noexec="$with_noexec" + AC_DEFINE_UNQUOTED(_PATH_SUDO_NOEXEC, "$with_noexec", [The fully qualified pathname of sudo_noexec.so]) + exec_prefix="$oexec_prefix" +fi + dnl dnl Substitute into the Makefile and man pages dnl diff --git a/defaults.c b/defaults.c index fd57a3b13..073289a2e 100644 --- a/defaults.c +++ b/defaults.c @@ -502,6 +502,9 @@ init_defaults() def_exempt_group = estrdup(EXEMPTGROUP); #endif def_editor = estrdup(EDITOR); +#ifdef _PATH_SUDO_NOEXEC + def_noexec_file = estrdup(_PATH_SUDO_NOEXEC); +#endif /* Finally do the lists (currently just environment tables). */ init_envtables(); diff --git a/env.c b/env.c index 0c05e443a..ca4c86737 100644 --- a/env.c +++ b/env.c @@ -439,7 +439,7 @@ rebuild_env(envp, reset_home, noexec) /* Point LD_PRELOAD to noexec_file? */ /* XXX - what to use for HP-UX and AIX? */ - if (noexec) + if (noexec && def_noexec_file != NULL) insert_env(format_env("LD_PRELOAD", def_noexec_file), 1); /* Set PS1 if SUDO_PS1 is set. */ diff --git a/pathnames.h.in b/pathnames.h.in index b5b0209a4..ec8b1942b 100644 --- a/pathnames.h.in +++ b/pathnames.h.in @@ -98,6 +98,10 @@ #undef _PATH_SUDO_SENDMAIL #endif /* _PATH_SUDO_SENDMAIL */ +#ifndef _PATH_SUDO_NOEXEC +#undef _PATH_SUDO_NOEXEC +#endif /* _PATH_SUDO_NOEXEC */ + #ifndef _PATH_VI #undef _PATH_VI #endif /* _PATH_VI */ -- 2.40.0