![[BACK]](/icons/back.gif){kind=icon}
Return to parse.yacc CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / sudo|
Return to parse.yacc CVS log | Up to [local] / src / usr.bin / sudo |
1.1 millert 1: %{
2: /*
1.12 millert 3: * Copyright (c) 1996, 1998-2004, 2007
4: * Todd C. Miller <Todd.Miller@courtesan.com>
1.1 millert 5: *
1.10 millert 6: * Permission to use, copy, modify, and distribute this software for any
7: * purpose with or without fee is hereby granted, provided that the above
8: * copyright notice and this permission notice appear in all copies.
1.1 millert 9: *
1.10 millert 10: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1.1 millert 17: * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
18: * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.9 millert 19: *
20: * Sponsored in part by the Defense Advanced Research Projects
21: * Agency (DARPA) and Air Force Research Laboratory, Air Force
22: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
1.1 millert 23: */
24:
25: /*
26: * XXX - the whole opFOO naming thing is somewhat bogus.
27: *
28: * XXX - the way things are stored for printmatches is stupid,
29: * they should be stored as elements in an array and then
30: * list_matches() can format things the way it wants.
31: */
32:
1.12 millert 33: #include <config.h>
1.6 millert 34:
35: #include <sys/types.h>
36: #include <sys/param.h>
1.1 millert 37: #include <stdio.h>
38: #ifdef STDC_HEADERS
1.6 millert 39: # include <stdlib.h>
40: # include <stddef.h>
41: #else
42: # ifdef HAVE_STDLIB_H
43: # include <stdlib.h>
44: # endif
1.1 millert 45: #endif /* STDC_HEADERS */
1.6 millert 46: #ifdef HAVE_STRING_H
47: # include <string.h>
48: #else
49: # ifdef HAVE_STRINGS_H
50: # include <strings.h>
51: # endif
52: #endif /* HAVE_STRING_H */
1.1 millert 53: #ifdef HAVE_UNISTD_H
1.6 millert 54: # include <unistd.h>
1.1 millert 55: #endif /* HAVE_UNISTD_H */
56: #include <pwd.h>
57: #if defined(YYBISON) && defined(HAVE_ALLOCA_H) && !defined(__GNUC__)
1.6 millert 58: # include <alloca.h>
1.1 millert 59: #endif /* YYBISON && HAVE_ALLOCA_H && !__GNUC__ */
60: #ifdef HAVE_LSEARCH
1.6 millert 61: # include <search.h>
1.1 millert 62: #endif /* HAVE_LSEARCH */
63:
64: #include "sudo.h"
65: #include "parse.h"
66:
67: #ifndef HAVE_LSEARCH
68: #include "emul/search.h"
69: #endif /* HAVE_LSEARCH */
70:
71: #ifndef lint
1.19 ! millert 72: __unused static const char rcsid[] = "$Sudo: parse.yacc,v 1.204.2.9 2007/11/21 18:15:49 millert Exp $";
1.1 millert 73: #endif /* lint */
74:
75: /*
76: * Globals
77: */
78: extern int sudolineno, parse_error;
79: int errorlineno = -1;
80: int clearaliases = TRUE;
81: int printmatches = FALSE;
82: int pedantic = FALSE;
1.3 millert 83: int keepall = FALSE;
1.6 millert 84: int quiet = FALSE;
1.10 millert 85: int used_runas = FALSE;
1.1 millert 86:
87: /*
88: * Alias types
89: */
90: #define HOST_ALIAS 1
91: #define CMND_ALIAS 2
92: #define USER_ALIAS 3
93: #define RUNAS_ALIAS 4
94:
1.10 millert 95: #define SETMATCH(_var, _val) do { \
96: if ((_var) == UNSPEC || (_val) != NOMATCH) \
97: (_var) = (_val); \
98: } while (0)
99:
100: #define SETNMATCH(_var, _val) do { \
101: if ((_val) != NOMATCH) \
102: (_var) = ! (_val); \
103: else if ((_var) == UNSPEC) \
104: (_var) = NOMATCH; \
105: } while (0)
106:
1.19 ! millert 107: #define SETENV_RESET \
! 108: if (setenv_ok == IMPLIED) setenv_ok = def_setenv ? TRUE : UNSPEC
! 109:
1.1 millert 110: /*
111: * The matching stack, initial space allocated in init_parser().
112: */
113: struct matchstack *match;
114: int top = 0, stacksize = 0;
115:
116: #define push \
117: do { \
118: if (top >= stacksize) { \
119: while ((stacksize += STACKINCREMENT) < top); \
1.8 millert 120: match = (struct matchstack *) erealloc3(match, stacksize, sizeof(struct matchstack)); \
1.1 millert 121: } \
1.10 millert 122: match[top].user = UNSPEC; \
123: match[top].cmnd = UNSPEC; \
124: match[top].host = UNSPEC; \
125: match[top].runas = UNSPEC; \
126: match[top].nopass = def_authenticate ? UNSPEC : TRUE; \
127: match[top].noexec = def_noexec ? TRUE : UNSPEC; \
1.12 millert 128: match[top].setenv = def_setenv ? TRUE : UNSPEC; \
1.1 millert 129: top++; \
130: } while (0)
131:
132: #define pushcp \
133: do { \
134: if (top >= stacksize) { \
135: while ((stacksize += STACKINCREMENT) < top); \
1.8 millert 136: match = (struct matchstack *) erealloc3(match, stacksize, sizeof(struct matchstack)); \
1.1 millert 137: } \
138: match[top].user = match[top-1].user; \
139: match[top].cmnd = match[top-1].cmnd; \
140: match[top].host = match[top-1].host; \
141: match[top].runas = match[top-1].runas; \
142: match[top].nopass = match[top-1].nopass; \
1.10 millert 143: match[top].noexec = match[top-1].noexec; \
1.12 millert 144: match[top].setenv = match[top-1].setenv; \
1.1 millert 145: top++; \
146: } while (0)
147:
148: #define pop \
1.10 millert 149: do { \
1.1 millert 150: if (top == 0) \
151: yyerror("matching stack underflow"); \
152: else \
153: top--; \
1.10 millert 154: } while (0)
155:
156:
157: /*
158: * For testing if foo_matches variable was set to TRUE or FALSE
159: */
160: #define MATCHED(_v) ((_v) >= 0)
1.1 millert 161:
162: /*
163: * Shortcuts for append()
164: */
165: #define append_cmnd(s, p) append(s, &cm_list[cm_list_len].cmnd, \
166: &cm_list[cm_list_len].cmnd_len, &cm_list[cm_list_len].cmnd_size, p)
167:
168: #define append_runas(s, p) append(s, &cm_list[cm_list_len].runas, \
169: &cm_list[cm_list_len].runas_len, &cm_list[cm_list_len].runas_size, p)
170:
171: #define append_entries(s, p) append(s, &ga_list[ga_list_len-1].entries, \
172: &ga_list[ga_list_len-1].entries_len, \
173: &ga_list[ga_list_len-1].entries_size, p)
174:
175: /*
176: * The stack for printmatches. A list of allowed commands for the user.
177: */
178: static struct command_match *cm_list = NULL;
179: static size_t cm_list_len = 0, cm_list_size = 0;
180:
181: /*
182: * List of Cmnd_Aliases and expansions for `sudo -l'
183: */
184: static int in_alias = FALSE;
185: static size_t ga_list_len = 0, ga_list_size = 0;
186: static struct generic_alias *ga_list = NULL;
187:
188: /*
189: * Does this Defaults list pertain to this user?
190: */
1.10 millert 191: static int defaults_matches = FALSE;
1.1 millert 192:
193: /*
194: * Local protoypes
195: */
196: static int add_alias __P((char *, int, int));
197: static void append __P((char *, char **, size_t *, size_t *, char *));
198: static void expand_ga_list __P((void));
199: static void expand_match_list __P((void));
200: static aliasinfo *find_alias __P((char *, int));
1.16 millert 201: static void more_aliases __P((void));
1.1 millert 202: void init_parser __P((void));
203: void yyerror __P((char *));
204:
205: void
206: yyerror(s)
207: char *s;
208: {
1.5 mpech 209: /* Save the line the first error occurred on. */
1.1 millert 210: if (errorlineno == -1)
211: errorlineno = sudolineno ? sudolineno - 1 : 0;
1.6 millert 212: if (s && !quiet) {
1.1 millert 213: #ifndef TRACELEXER
214: (void) fprintf(stderr, ">>> sudoers file: %s, line %d <<<\n", s,
215: sudolineno ? sudolineno - 1 : 0);
216: #else
217: (void) fprintf(stderr, "<*> ");
218: #endif
219: }
220: parse_error = TRUE;
221: }
222: %}
223:
224: %union {
225: char *string;
226: int BOOLEAN;
227: struct sudo_command command;
228: int tok;
229: }
230:
231: %start file /* special start symbol */
232: %token <command> COMMAND /* absolute pathname w/ optional args */
233: %token <string> ALIAS /* an UPPERCASE alias name */
1.6 millert 234: %token <string> DEFVAR /* a Defaults variable name */
1.13 millert 235: %token <string> NTWKADDR /* w.x.y.z or ipv6 address */
1.1 millert 236: %token <string> NETGROUP /* a netgroup (+NAME) */
237: %token <string> USERGROUP /* a usergroup (%NAME) */
238: %token <string> WORD /* a word */
239: %token <tok> DEFAULTS /* Defaults entry */
240: %token <tok> DEFAULTS_HOST /* Host-specific defaults entry */
241: %token <tok> DEFAULTS_USER /* User-specific defaults entry */
1.8 millert 242: %token <tok> DEFAULTS_RUNAS /* Runas-specific defaults entry */
1.1 millert 243: %token <tok> RUNAS /* ( runas_list ) */
244: %token <tok> NOPASSWD /* no passwd req for command */
245: %token <tok> PASSWD /* passwd req for command (default) */
1.10 millert 246: %token <tok> NOEXEC /* preload dummy execve() for cmnd */
247: %token <tok> EXEC /* don't preload dummy execve() */
1.12 millert 248: %token <tok> SETENV /* user may set environment for cmnd */
249: %token <tok> NOSETENV /* user may not set environment */
1.1 millert 250: %token <tok> ALL /* ALL keyword */
251: %token <tok> COMMENT /* comment and/or carriage return */
252: %token <tok> HOSTALIAS /* Host_Alias keyword */
253: %token <tok> CMNDALIAS /* Cmnd_Alias keyword */
254: %token <tok> USERALIAS /* User_Alias keyword */
255: %token <tok> RUNASALIAS /* Runas_Alias keyword */
1.6 millert 256: %token <tok> ':' '=' ',' '!' '+' '-' /* union member tokens */
1.1 millert 257: %token <tok> ERROR
258:
259: /*
1.10 millert 260: * NOTE: these are not true booleans as there are actually 4 possible values:
1.1 millert 261: * 1) TRUE (positive match)
262: * 0) FALSE (negative match due to a '!' somewhere)
1.10 millert 263: * -1) NOMATCH (don't change the value of *_matches)
264: * -2) UNSPEC (uninitialized value)
1.1 millert 265: */
266: %type <BOOLEAN> cmnd
267: %type <BOOLEAN> host
268: %type <BOOLEAN> runasuser
1.2 millert 269: %type <BOOLEAN> oprunasuser
270: %type <BOOLEAN> runaslist
1.1 millert 271: %type <BOOLEAN> user
272:
273: %%
274:
275: file : entry
276: | file entry
277: ;
278:
279: entry : COMMENT
280: { ; }
281: | error COMMENT
282: { yyerrok; }
283: | { push; } userlist privileges {
284: while (top && user_matches != TRUE)
285: pop;
286: }
287: | USERALIAS useraliases
288: { ; }
289: | HOSTALIAS hostaliases
290: { ; }
291: | CMNDALIAS cmndaliases
292: { ; }
293: | RUNASALIAS runasaliases
294: { ; }
295: | defaults_line
296: { ; }
297: ;
298:
299: defaults_line : defaults_type defaults_list
1.8 millert 300: ;
1.1 millert 301:
302: defaults_type : DEFAULTS {
303: defaults_matches = TRUE;
304: }
305: | DEFAULTS_USER { push; } userlist {
306: defaults_matches = user_matches;
307: pop;
308: }
1.8 millert 309: | DEFAULTS_RUNAS { push; } runaslist {
310: defaults_matches = $3 == TRUE;
311: pop;
312: }
1.1 millert 313: | DEFAULTS_HOST { push; } hostlist {
314: defaults_matches = host_matches;
315: pop;
316: }
317: ;
318:
319: defaults_list : defaults_entry
320: | defaults_entry ',' defaults_list
1.8 millert 321: ;
1.1 millert 322:
1.6 millert 323: defaults_entry : DEFVAR {
1.4 millert 324: if (defaults_matches == TRUE &&
1.6 millert 325: !set_default($1, NULL, TRUE)) {
1.1 millert 326: yyerror(NULL);
327: YYERROR;
328: }
1.12 millert 329: efree($1);
1.1 millert 330: }
1.6 millert 331: | '!' DEFVAR {
1.4 millert 332: if (defaults_matches == TRUE &&
1.6 millert 333: !set_default($2, NULL, FALSE)) {
1.1 millert 334: yyerror(NULL);
335: YYERROR;
336: }
1.12 millert 337: efree($2);
1.1 millert 338: }
1.6 millert 339: | DEFVAR '=' WORD {
340: if (defaults_matches == TRUE &&
341: !set_default($1, $3, TRUE)) {
342: yyerror(NULL);
343: YYERROR;
344: }
1.12 millert 345: efree($1);
346: efree($3);
1.6 millert 347: }
348: | DEFVAR '+' WORD {
349: if (defaults_matches == TRUE &&
350: !set_default($1, $3, '+')) {
351: yyerror(NULL);
352: YYERROR;
353: }
1.12 millert 354: efree($1);
355: efree($3);
1.6 millert 356: }
357: | DEFVAR '-' WORD {
1.4 millert 358: if (defaults_matches == TRUE &&
1.6 millert 359: !set_default($1, $3, '-')) {
1.1 millert 360: yyerror(NULL);
361: YYERROR;
362: }
1.12 millert 363: efree($1);
364: efree($3);
1.1 millert 365: }
1.8 millert 366: ;
1.1 millert 367:
368: privileges : privilege
369: | privileges ':' privilege
370: ;
371:
372: privilege : hostlist '=' cmndspeclist {
373: /*
374: * We already did a push if necessary in
375: * cmndspec so just reset some values so
376: * the next 'privilege' gets a clean slate.
377: */
1.10 millert 378: host_matches = UNSPEC;
379: runas_matches = UNSPEC;
380: no_passwd = def_authenticate ? UNSPEC : TRUE;
381: no_execve = def_noexec ? TRUE : UNSPEC;
1.12 millert 382: setenv_ok = def_setenv ? TRUE : UNSPEC;
1.1 millert 383: }
384: ;
385:
386: ophost : host {
1.10 millert 387: SETMATCH(host_matches, $1);
1.1 millert 388: }
389: | '!' host {
1.10 millert 390: SETNMATCH(host_matches, $2);
1.1 millert 391: }
1.8 millert 392: ;
1.1 millert 393:
394: host : ALL {
395: $$ = TRUE;
396: }
397: | NTWKADDR {
398: if (addr_matches($1))
399: $$ = TRUE;
400: else
1.10 millert 401: $$ = NOMATCH;
1.12 millert 402: efree($1);
1.1 millert 403: }
404: | NETGROUP {
1.3 millert 405: if (netgr_matches($1, user_host, user_shost, NULL))
1.1 millert 406: $$ = TRUE;
407: else
1.10 millert 408: $$ = NOMATCH;
1.12 millert 409: efree($1);
1.1 millert 410: }
411: | WORD {
1.4 millert 412: if (hostname_matches(user_shost, user_host, $1) == 0)
1.1 millert 413: $$ = TRUE;
414: else
1.10 millert 415: $$ = NOMATCH;
1.12 millert 416: efree($1);
1.1 millert 417: }
418: | ALIAS {
419: aliasinfo *aip = find_alias($1, HOST_ALIAS);
420:
421: /* could be an all-caps hostname */
422: if (aip)
423: $$ = aip->val;
424: else if (strcasecmp(user_shost, $1) == 0)
425: $$ = TRUE;
426: else {
427: if (pedantic) {
428: (void) fprintf(stderr,
429: "%s: undeclared Host_Alias `%s' referenced near line %d\n",
430: (pedantic == 1) ? "Warning" : "Error", $1, sudolineno);
431: if (pedantic > 1) {
432: yyerror(NULL);
433: YYERROR;
434: }
435: }
1.10 millert 436: $$ = NOMATCH;
1.1 millert 437: }
1.12 millert 438: efree($1);
1.1 millert 439: }
440: ;
441:
442: cmndspeclist : cmndspec
443: | cmndspeclist ',' cmndspec
444: ;
445:
1.19 ! millert 446: cmndspec : { SETENV_RESET; } runasspec cmndtag opcmnd {
1.1 millert 447: /*
448: * Push the entry onto the stack if it is worth
1.10 millert 449: * saving and reset cmnd_matches for next cmnd.
1.1 millert 450: *
451: * We need to save at least one entry on
452: * the stack so sudoers_lookup() can tell that
453: * the user was listed in sudoers. Also, we
454: * need to be able to tell whether or not a
455: * user was listed for this specific host.
1.3 millert 456: *
457: * If keepall is set and the user matches then
458: * we need to keep entries around too...
1.1 millert 459: */
1.10 millert 460: if (MATCHED(user_matches) &&
461: MATCHED(host_matches) &&
462: MATCHED(cmnd_matches) &&
463: MATCHED(runas_matches))
1.1 millert 464: pushcp;
1.10 millert 465: else if (MATCHED(user_matches) && (top == 1 ||
466: (top == 2 && MATCHED(host_matches) &&
467: !MATCHED(match[0].host))))
1.1 millert 468: pushcp;
1.3 millert 469: else if (user_matches == TRUE && keepall)
470: pushcp;
1.10 millert 471: cmnd_matches = UNSPEC;
1.1 millert 472: }
473: ;
474:
475: opcmnd : cmnd {
1.10 millert 476: SETMATCH(cmnd_matches, $1);
1.1 millert 477: }
478: | '!' {
479: if (printmatches == TRUE) {
480: if (in_alias == TRUE)
481: append_entries("!", ", ");
482: else if (host_matches == TRUE &&
483: user_matches == TRUE)
484: append_cmnd("!", NULL);
485: }
486: } cmnd {
1.10 millert 487: SETNMATCH(cmnd_matches, $3);
1.1 millert 488: }
489: ;
490:
491: runasspec : /* empty */ {
492: if (printmatches == TRUE && host_matches == TRUE &&
493: user_matches == TRUE) {
1.10 millert 494: if (runas_matches == UNSPEC) {
1.1 millert 495: cm_list[cm_list_len].runas_len = 0;
496: } else {
497: /* Inherit runas data. */
498: cm_list[cm_list_len].runas =
499: estrdup(cm_list[cm_list_len-1].runas);
500: cm_list[cm_list_len].runas_len =
501: cm_list[cm_list_len-1].runas_len;
502: cm_list[cm_list_len].runas_size =
503: cm_list[cm_list_len-1].runas_size;
504: }
505: }
506: /*
507: * If this is the first entry in a command list
508: * then check against default runas user.
509: */
1.10 millert 510: if (runas_matches == UNSPEC) {
1.18 millert 511: runas_matches = userpw_matches(def_runas_default,
512: *user_runas, runas_pw) ? TRUE : NOMATCH;
1.10 millert 513: }
1.1 millert 514: }
1.2 millert 515: | RUNAS runaslist {
1.10 millert 516: runas_matches = $2;
1.2 millert 517: }
1.1 millert 518: ;
519:
1.2 millert 520: runaslist : oprunasuser { ; }
521: | runaslist ',' oprunasuser {
522: /* Later entries override earlier ones. */
1.10 millert 523: if ($3 != NOMATCH)
1.2 millert 524: $$ = $3;
525: else
526: $$ = $1;
527: }
1.1 millert 528: ;
529:
1.2 millert 530: oprunasuser : runasuser { ; }
1.1 millert 531: | '!' {
532: if (printmatches == TRUE) {
533: if (in_alias == TRUE)
534: append_entries("!", ", ");
535: else if (host_matches == TRUE &&
536: user_matches == TRUE)
537: append_runas("!", ", ");
538: }
539: } runasuser {
1.2 millert 540: /* Set $$ to the negation of runasuser */
1.10 millert 541: $$ = ($3 == NOMATCH ? NOMATCH : ! $3);
1.1 millert 542: }
1.8 millert 543: ;
1.1 millert 544:
545: runasuser : WORD {
546: if (printmatches == TRUE) {
547: if (in_alias == TRUE)
548: append_entries($1, ", ");
549: else if (host_matches == TRUE &&
550: user_matches == TRUE)
551: append_runas($1, ", ");
552: }
1.10 millert 553: if (userpw_matches($1, *user_runas, runas_pw))
1.1 millert 554: $$ = TRUE;
555: else
1.10 millert 556: $$ = NOMATCH;
1.12 millert 557: efree($1);
1.10 millert 558: used_runas = TRUE;
1.1 millert 559: }
560: | USERGROUP {
561: if (printmatches == TRUE) {
562: if (in_alias == TRUE)
563: append_entries($1, ", ");
564: else if (host_matches == TRUE &&
565: user_matches == TRUE)
566: append_runas($1, ", ");
567: }
1.10 millert 568: if (usergr_matches($1, *user_runas, runas_pw))
1.1 millert 569: $$ = TRUE;
570: else
1.10 millert 571: $$ = NOMATCH;
1.12 millert 572: efree($1);
1.10 millert 573: used_runas = TRUE;
1.1 millert 574: }
575: | NETGROUP {
576: if (printmatches == TRUE) {
577: if (in_alias == TRUE)
578: append_entries($1, ", ");
579: else if (host_matches == TRUE &&
580: user_matches == TRUE)
581: append_runas($1, ", ");
582: }
1.3 millert 583: if (netgr_matches($1, NULL, NULL, *user_runas))
1.1 millert 584: $$ = TRUE;
585: else
1.10 millert 586: $$ = NOMATCH;
1.12 millert 587: efree($1);
1.10 millert 588: used_runas = TRUE;
1.1 millert 589: }
590: | ALIAS {
591: aliasinfo *aip = find_alias($1, RUNAS_ALIAS);
592:
593: if (printmatches == TRUE) {
594: if (in_alias == TRUE)
595: append_entries($1, ", ");
596: else if (host_matches == TRUE &&
597: user_matches == TRUE)
598: append_runas($1, ", ");
599: }
600: /* could be an all-caps username */
601: if (aip)
602: $$ = aip->val;
603: else if (strcmp($1, *user_runas) == 0)
604: $$ = TRUE;
605: else {
606: if (pedantic) {
607: (void) fprintf(stderr,
608: "%s: undeclared Runas_Alias `%s' referenced near line %d\n",
609: (pedantic == 1) ? "Warning" : "Error", $1, sudolineno);
610: if (pedantic > 1) {
611: yyerror(NULL);
612: YYERROR;
613: }
614: }
1.10 millert 615: $$ = NOMATCH;
1.1 millert 616: }
1.12 millert 617: efree($1);
1.10 millert 618: used_runas = TRUE;
1.1 millert 619: }
620: | ALL {
621: if (printmatches == TRUE) {
622: if (in_alias == TRUE)
623: append_entries("ALL", ", ");
624: else if (host_matches == TRUE &&
625: user_matches == TRUE)
626: append_runas("ALL", ", ");
627: }
628: $$ = TRUE;
629: }
630: ;
631:
1.10 millert 632: cmndtag : /* empty */ {
1.12 millert 633: /* Inherit {NO,}{PASSWD,EXEC,SETENV} status. */
1.1 millert 634: if (printmatches == TRUE && host_matches == TRUE &&
635: user_matches == TRUE) {
636: if (no_passwd == TRUE)
637: cm_list[cm_list_len].nopasswd = TRUE;
638: else
639: cm_list[cm_list_len].nopasswd = FALSE;
1.10 millert 640: if (no_execve == TRUE)
641: cm_list[cm_list_len].noexecve = TRUE;
642: else
643: cm_list[cm_list_len].noexecve = FALSE;
1.12 millert 644: if (setenv_ok == TRUE)
645: cm_list[cm_list_len].setenv = TRUE;
646: else
647: cm_list[cm_list_len].setenv = FALSE;
1.1 millert 648: }
649: }
1.10 millert 650: | cmndtag NOPASSWD {
1.1 millert 651: no_passwd = TRUE;
652: if (printmatches == TRUE && host_matches == TRUE &&
653: user_matches == TRUE)
654: cm_list[cm_list_len].nopasswd = TRUE;
655: }
1.10 millert 656: | cmndtag PASSWD {
1.1 millert 657: no_passwd = FALSE;
658: if (printmatches == TRUE && host_matches == TRUE &&
659: user_matches == TRUE)
660: cm_list[cm_list_len].nopasswd = FALSE;
661: }
1.10 millert 662: | cmndtag NOEXEC {
663: no_execve = TRUE;
664: if (printmatches == TRUE && host_matches == TRUE &&
665: user_matches == TRUE)
666: cm_list[cm_list_len].noexecve = TRUE;
667: }
668: | cmndtag EXEC {
669: no_execve = FALSE;
670: if (printmatches == TRUE && host_matches == TRUE &&
671: user_matches == TRUE)
672: cm_list[cm_list_len].noexecve = FALSE;
673: }
1.12 millert 674: | cmndtag SETENV {
675: setenv_ok = TRUE;
676: if (printmatches == TRUE && host_matches == TRUE &&
677: user_matches == TRUE)
678: cm_list[cm_list_len].setenv = TRUE;
679: }
680: | cmndtag NOSETENV {
681: setenv_ok = FALSE;
682: if (printmatches == TRUE && host_matches == TRUE &&
683: user_matches == TRUE)
684: cm_list[cm_list_len].setenv = FALSE;
685: }
1.1 millert 686: ;
687:
688: cmnd : ALL {
689: if (printmatches == TRUE) {
690: if (in_alias == TRUE)
691: append_entries("ALL", ", ");
692: else if (host_matches == TRUE &&
693: user_matches == TRUE) {
694: append_cmnd("ALL", NULL);
695: expand_match_list();
696: }
697: }
1.19 ! millert 698: /* sudo "ALL" implies the SETENV tag */
! 699: if (setenv_ok == UNSPEC)
! 700: setenv_ok = IMPLIED;
1.1 millert 701:
1.12 millert 702: efree(safe_cmnd);
703: safe_cmnd = NULL;
1.1 millert 704: $$ = TRUE;
705: }
706: | ALIAS {
707: aliasinfo *aip;
708:
709: if (printmatches == TRUE) {
710: if (in_alias == TRUE)
711: append_entries($1, ", ");
712: else if (host_matches == TRUE &&
713: user_matches == TRUE) {
714: append_cmnd($1, NULL);
715: expand_match_list();
716: }
717: }
718:
719: if ((aip = find_alias($1, CMND_ALIAS)))
720: $$ = aip->val;
721: else {
722: if (pedantic) {
723: (void) fprintf(stderr,
724: "%s: undeclared Cmnd_Alias `%s' referenced near line %d\n",
725: (pedantic == 1) ? "Warning" : "Error", $1, sudolineno);
726: if (pedantic > 1) {
727: yyerror(NULL);
728: YYERROR;
729: }
730: }
1.10 millert 731: $$ = NOMATCH;
1.1 millert 732: }
1.12 millert 733: efree($1);
1.1 millert 734: }
735: | COMMAND {
736: if (printmatches == TRUE) {
737: if (in_alias == TRUE) {
738: append_entries($1.cmnd, ", ");
739: if ($1.args)
740: append_entries($1.args, " ");
741: }
742: if (host_matches == TRUE &&
743: user_matches == TRUE) {
744: append_cmnd($1.cmnd, NULL);
745: if ($1.args)
746: append_cmnd($1.args, " ");
747: expand_match_list();
748: }
749: }
750:
1.10 millert 751: if (command_matches($1.cmnd, $1.args))
1.1 millert 752: $$ = TRUE;
753: else
1.10 millert 754: $$ = NOMATCH;
1.1 millert 755:
1.12 millert 756: efree($1.cmnd);
757: efree($1.args);
1.1 millert 758: }
759: ;
760:
761: hostaliases : hostalias
762: | hostaliases ':' hostalias
763: ;
764:
765: hostalias : ALIAS { push; } '=' hostlist {
1.10 millert 766: if ((MATCHED(host_matches) || pedantic) &&
1.8 millert 767: !add_alias($1, HOST_ALIAS, host_matches)) {
768: yyerror(NULL);
1.1 millert 769: YYERROR;
1.8 millert 770: }
1.1 millert 771: pop;
772: }
773: ;
774:
775: hostlist : ophost
776: | hostlist ',' ophost
777: ;
778:
779: cmndaliases : cmndalias
780: | cmndaliases ':' cmndalias
781: ;
782:
783: cmndalias : ALIAS {
784: push;
785: if (printmatches == TRUE) {
786: in_alias = TRUE;
787: /* Allocate space for ga_list if necessary. */
788: expand_ga_list();
789: ga_list[ga_list_len-1].type = CMND_ALIAS;
790: ga_list[ga_list_len-1].alias = estrdup($1);
791: }
792: } '=' cmndlist {
1.10 millert 793: if ((MATCHED(cmnd_matches) || pedantic) &&
1.8 millert 794: !add_alias($1, CMND_ALIAS, cmnd_matches)) {
795: yyerror(NULL);
1.1 millert 796: YYERROR;
1.8 millert 797: }
1.1 millert 798: pop;
1.12 millert 799: efree($1);
1.1 millert 800:
801: if (printmatches == TRUE)
802: in_alias = FALSE;
803: }
804: ;
805:
806: cmndlist : opcmnd { ; }
807: | cmndlist ',' opcmnd
808: ;
809:
810: runasaliases : runasalias
811: | runasaliases ':' runasalias
812: ;
813:
814: runasalias : ALIAS {
815: if (printmatches == TRUE) {
816: in_alias = TRUE;
817: /* Allocate space for ga_list if necessary. */
818: expand_ga_list();
819: ga_list[ga_list_len-1].type = RUNAS_ALIAS;
820: ga_list[ga_list_len-1].alias = estrdup($1);
821: }
822: } '=' runaslist {
1.10 millert 823: if (($4 != NOMATCH || pedantic) &&
1.8 millert 824: !add_alias($1, RUNAS_ALIAS, $4)) {
825: yyerror(NULL);
1.1 millert 826: YYERROR;
1.8 millert 827: }
1.12 millert 828: efree($1);
1.1 millert 829:
830: if (printmatches == TRUE)
831: in_alias = FALSE;
832: }
833: ;
834:
835: useraliases : useralias
836: | useraliases ':' useralias
837: ;
838:
839: useralias : ALIAS { push; } '=' userlist {
1.10 millert 840: if ((MATCHED(user_matches) || pedantic) &&
1.8 millert 841: !add_alias($1, USER_ALIAS, user_matches)) {
842: yyerror(NULL);
1.1 millert 843: YYERROR;
1.8 millert 844: }
1.1 millert 845: pop;
1.12 millert 846: efree($1);
1.1 millert 847: }
848: ;
849:
850: userlist : opuser
851: | userlist ',' opuser
852: ;
853:
854: opuser : user {
1.10 millert 855: SETMATCH(user_matches, $1);
1.1 millert 856: }
857: | '!' user {
1.10 millert 858: SETNMATCH(user_matches, $2);
1.1 millert 859: }
1.8 millert 860: ;
1.1 millert 861:
862: user : WORD {
1.10 millert 863: if (userpw_matches($1, user_name, sudo_user.pw))
1.1 millert 864: $$ = TRUE;
865: else
1.10 millert 866: $$ = NOMATCH;
1.12 millert 867: efree($1);
1.1 millert 868: }
869: | USERGROUP {
1.10 millert 870: if (usergr_matches($1, user_name, sudo_user.pw))
1.1 millert 871: $$ = TRUE;
872: else
1.10 millert 873: $$ = NOMATCH;
1.12 millert 874: efree($1);
1.1 millert 875: }
876: | NETGROUP {
1.3 millert 877: if (netgr_matches($1, NULL, NULL, user_name))
1.1 millert 878: $$ = TRUE;
879: else
1.10 millert 880: $$ = NOMATCH;
1.12 millert 881: efree($1);
1.1 millert 882: }
883: | ALIAS {
884: aliasinfo *aip = find_alias($1, USER_ALIAS);
885:
886: /* could be an all-caps username */
887: if (aip)
888: $$ = aip->val;
889: else if (strcmp($1, user_name) == 0)
890: $$ = TRUE;
891: else {
892: if (pedantic) {
893: (void) fprintf(stderr,
894: "%s: undeclared User_Alias `%s' referenced near line %d\n",
895: (pedantic == 1) ? "Warning" : "Error", $1, sudolineno);
1.8 millert 896: if (pedantic > 1) {
897: yyerror(NULL);
1.1 millert 898: YYERROR;
1.8 millert 899: }
1.1 millert 900: }
1.10 millert 901: $$ = NOMATCH;
1.1 millert 902: }
1.12 millert 903: efree($1);
1.1 millert 904: }
905: | ALL {
906: $$ = TRUE;
907: }
908: ;
909:
910: %%
911:
912: #define MOREALIASES (32)
913: aliasinfo *aliases = NULL;
914: size_t naliases = 0;
915: size_t nslots = 0;
916:
917:
918: /*
919: * Compare two aliasinfo structures, strcmp() style.
920: * Note that we do *not* compare their values.
921: */
922: static int
923: aliascmp(a1, a2)
924: const VOID *a1, *a2;
925: {
926: int r;
927: aliasinfo *ai1, *ai2;
928:
929: ai1 = (aliasinfo *) a1;
930: ai2 = (aliasinfo *) a2;
931: if ((r = strcmp(ai1->name, ai2->name)) == 0)
932: r = ai1->type - ai2->type;
933:
934: return(r);
935: }
936:
937: /*
938: * Compare two generic_alias structures, strcmp() style.
939: */
940: static int
941: genaliascmp(entry, key)
942: const VOID *entry, *key;
943: {
944: int r;
945: struct generic_alias *ga1, *ga2;
946:
947: ga1 = (struct generic_alias *) key;
948: ga2 = (struct generic_alias *) entry;
949: if ((r = strcmp(ga1->alias, ga2->alias)) == 0)
950: r = ga1->type - ga2->type;
951:
952: return(r);
953: }
954:
955:
956: /*
957: * Adds the named alias of the specified type to the aliases list.
958: */
959: static int
960: add_alias(alias, type, val)
961: char *alias;
962: int type;
963: int val;
964: {
965: aliasinfo ai, *aip;
966: size_t onaliases;
967: char s[512];
968:
1.16 millert 969: if (naliases >= nslots)
970: more_aliases();
1.1 millert 971:
972: ai.type = type;
973: ai.val = val;
974: ai.name = estrdup(alias);
975: onaliases = naliases;
976:
977: aip = (aliasinfo *) lsearch((VOID *)&ai, (VOID *)aliases, &naliases,
978: sizeof(ai), aliascmp);
979: if (aip == NULL) {
980: (void) snprintf(s, sizeof(s), "Aliases corrupted defining alias `%s'",
981: alias);
982: yyerror(s);
983: return(FALSE);
984: }
985: if (onaliases == naliases) {
986: (void) snprintf(s, sizeof(s), "Alias `%s' already defined", alias);
987: yyerror(s);
988: return(FALSE);
989: }
990:
991: return(TRUE);
992: }
993:
994: /*
995: * Searches for the named alias of the specified type.
996: */
997: static aliasinfo *
998: find_alias(alias, type)
999: char *alias;
1000: int type;
1001: {
1002: aliasinfo ai;
1003:
1004: ai.name = alias;
1005: ai.type = type;
1006:
1007: return((aliasinfo *) lfind((VOID *)&ai, (VOID *)aliases, &naliases,
1008: sizeof(ai), aliascmp));
1009: }
1010:
1011: /*
1012: * Allocates more space for the aliases list.
1013: */
1.16 millert 1014: static void
1.1 millert 1015: more_aliases()
1016: {
1017:
1018: nslots += MOREALIASES;
1.16 millert 1019: aliases = (aliasinfo *) erealloc3(aliases, nslots, sizeof(aliasinfo));
1.1 millert 1020: }
1021:
1022: /*
1023: * Lists the contents of the aliases list.
1024: */
1025: void
1026: dumpaliases()
1027: {
1028: size_t n;
1029:
1030: for (n = 0; n < naliases; n++) {
1031: if (aliases[n].val == -1)
1032: continue;
1033:
1034: switch (aliases[n].type) {
1035: case HOST_ALIAS:
1036: (void) puts("HOST_ALIAS");
1037: break;
1038:
1039: case CMND_ALIAS:
1040: (void) puts("CMND_ALIAS");
1041: break;
1042:
1043: case USER_ALIAS:
1044: (void) puts("USER_ALIAS");
1045: break;
1046:
1047: case RUNAS_ALIAS:
1048: (void) puts("RUNAS_ALIAS");
1049: break;
1050: }
1051: (void) printf("\t%s: %d\n", aliases[n].name, aliases[n].val);
1052: }
1053: }
1054:
1055: /*
1056: * Lists the contents of cm_list and ga_list for `sudo -l'.
1057: */
1058: void
1059: list_matches()
1060: {
1.10 millert 1061: size_t count;
1.1 millert 1062: char *p;
1063: struct generic_alias *ga, key;
1064:
1065: (void) printf("User %s may run the following commands on this host:\n",
1066: user_name);
1.8 millert 1067: for (count = 0; count < cm_list_len; count++) {
1.1 millert 1068:
1069: /* Print the runas list. */
1070: (void) fputs(" ", stdout);
1.8 millert 1071: if (cm_list[count].runas) {
1.1 millert 1072: (void) putchar('(');
1.8 millert 1073: p = strtok(cm_list[count].runas, ", ");
1.1 millert 1074: do {
1.8 millert 1075: if (p != cm_list[count].runas)
1.1 millert 1076: (void) fputs(", ", stdout);
1077:
1078: key.alias = p;
1079: key.type = RUNAS_ALIAS;
1080: if ((ga = (struct generic_alias *) lfind((VOID *) &key,
1081: (VOID *) &ga_list[0], &ga_list_len, sizeof(key), genaliascmp)))
1082: (void) fputs(ga->entries, stdout);
1083: else
1084: (void) fputs(p, stdout);
1085: } while ((p = strtok(NULL, ", ")));
1086: (void) fputs(") ", stdout);
1087: } else {
1.10 millert 1088: (void) printf("(%s) ", def_runas_default);
1.1 millert 1089: }
1090:
1.10 millert 1091: /* Is execve(2) disabled? */
1092: if (cm_list[count].noexecve == TRUE && !def_noexec)
1093: (void) fputs("NOEXEC: ", stdout);
1094: else if (cm_list[count].noexecve == FALSE && def_noexec)
1095: (void) fputs("EXEC: ", stdout);
1096:
1.1 millert 1097: /* Is a password required? */
1.10 millert 1098: if (cm_list[count].nopasswd == TRUE && def_authenticate)
1.1 millert 1099: (void) fputs("NOPASSWD: ", stdout);
1.10 millert 1100: else if (cm_list[count].nopasswd == FALSE && !def_authenticate)
1.1 millert 1101: (void) fputs("PASSWD: ", stdout);
1102:
1.12 millert 1103: /* Is setenv enabled? */
1104: if (cm_list[count].setenv == TRUE && !def_setenv)
1105: (void) fputs("SETENV: ", stdout);
1106: else if (cm_list[count].setenv == FALSE && def_setenv)
1107: (void) fputs("NOSETENV: ", stdout);
1108:
1.1 millert 1109: /* Print the actual command or expanded Cmnd_Alias. */
1.8 millert 1110: key.alias = cm_list[count].cmnd;
1.1 millert 1111: key.type = CMND_ALIAS;
1112: if ((ga = (struct generic_alias *) lfind((VOID *) &key,
1113: (VOID *) &ga_list[0], &ga_list_len, sizeof(key), genaliascmp)))
1114: (void) puts(ga->entries);
1115: else
1.8 millert 1116: (void) puts(cm_list[count].cmnd);
1.1 millert 1117: }
1118:
1119: /* Be nice and free up space now that we are done. */
1.8 millert 1120: for (count = 0; count < ga_list_len; count++) {
1.12 millert 1121: efree(ga_list[count].alias);
1122: efree(ga_list[count].entries);
1.1 millert 1123: }
1.12 millert 1124: efree(ga_list);
1.1 millert 1125: ga_list = NULL;
1126:
1.8 millert 1127: for (count = 0; count < cm_list_len; count++) {
1.12 millert 1128: efree(cm_list[count].runas);
1129: efree(cm_list[count].cmnd);
1.1 millert 1130: }
1.12 millert 1131: efree(cm_list);
1.1 millert 1132: cm_list = NULL;
1133: cm_list_len = 0;
1134: cm_list_size = 0;
1135: }
1136:
1137: /*
1138: * Appends a source string to the destination, optionally prefixing a separator.
1139: */
1140: static void
1141: append(src, dstp, dst_len, dst_size, separator)
1142: char *src, **dstp;
1143: size_t *dst_len, *dst_size;
1144: char *separator;
1145: {
1146: size_t src_len = strlen(src);
1147: char *dst = *dstp;
1148:
1149: /*
1150: * Only add the separator if there is something to separate from.
1151: * If the last char is a '!', don't apply the separator (XXX).
1152: */
1153: if (separator && dst && dst[*dst_len - 1] != '!')
1154: src_len += strlen(separator);
1155: else
1156: separator = NULL;
1157:
1158: /* Assumes dst will be NULL if not set. */
1159: if (dst == NULL) {
1160: dst = (char *) emalloc(BUFSIZ);
1.8 millert 1161: *dst = '\0';
1.1 millert 1162: *dst_size = BUFSIZ;
1163: *dst_len = 0;
1164: *dstp = dst;
1165: }
1166:
1167: /* Allocate more space if necessary. */
1168: if (*dst_size <= *dst_len + src_len) {
1169: while (*dst_size <= *dst_len + src_len)
1170: *dst_size += BUFSIZ;
1171:
1172: dst = (char *) erealloc(dst, *dst_size);
1173: *dstp = dst;
1174: }
1175:
1176: /* Copy src -> dst adding a separator if appropriate and adjust len. */
1.8 millert 1177: if (separator)
1178: (void) strlcat(dst, separator, *dst_size);
1179: (void) strlcat(dst, src, *dst_size);
1.1 millert 1180: *dst_len += src_len;
1181: }
1182:
1183: /*
1184: * Frees up space used by the aliases list and resets the associated counters.
1185: */
1186: void
1187: reset_aliases()
1188: {
1189: size_t n;
1190:
1191: if (aliases) {
1192: for (n = 0; n < naliases; n++)
1.12 millert 1193: efree(aliases[n].name);
1194: efree(aliases);
1.1 millert 1195: aliases = NULL;
1196: }
1197: naliases = nslots = 0;
1198: }
1199:
1200: /*
1201: * Increments ga_list_len, allocating more space as necessary.
1202: */
1203: static void
1204: expand_ga_list()
1205: {
1206:
1207: if (++ga_list_len >= ga_list_size) {
1208: while ((ga_list_size += STACKINCREMENT) < ga_list_len)
1209: ;
1210: ga_list = (struct generic_alias *)
1.8 millert 1211: erealloc3(ga_list, ga_list_size, sizeof(struct generic_alias));
1.1 millert 1212: }
1213:
1214: ga_list[ga_list_len - 1].entries = NULL;
1215: }
1216:
1217: /*
1218: * Increments cm_list_len, allocating more space as necessary.
1219: */
1220: static void
1221: expand_match_list()
1222: {
1223:
1224: if (++cm_list_len >= cm_list_size) {
1225: while ((cm_list_size += STACKINCREMENT) < cm_list_len)
1226: ;
1227: if (cm_list == NULL)
1228: cm_list_len = 0; /* start at 0 since it is a subscript */
1229: cm_list = (struct command_match *)
1.8 millert 1230: erealloc3(cm_list, cm_list_size, sizeof(struct command_match));
1.1 millert 1231: }
1232:
1233: cm_list[cm_list_len].runas = cm_list[cm_list_len].cmnd = NULL;
1234: cm_list[cm_list_len].nopasswd = FALSE;
1.10 millert 1235: cm_list[cm_list_len].noexecve = FALSE;
1.12 millert 1236: cm_list[cm_list_len].setenv = FALSE;
1.1 millert 1237: }
1238:
1239: /*
1240: * Frees up spaced used by a previous parser run and allocates new space
1241: * for various data structures.
1242: */
1243: void
1244: init_parser()
1245: {
1246:
1247: /* Free up old data structures if we run the parser more than once. */
1248: if (match) {
1.12 millert 1249: efree(match);
1.1 millert 1250: match = NULL;
1251: top = 0;
1252: parse_error = FALSE;
1.10 millert 1253: used_runas = FALSE;
1254: errorlineno = -1;
1255: sudolineno = 1;
1.1 millert 1256: }
1257:
1258: /* Allocate space for the matching stack. */
1259: stacksize = STACKINCREMENT;
1.8 millert 1260: match = (struct matchstack *) emalloc2(stacksize, sizeof(struct matchstack));
1.1 millert 1261:
1262: /* Allocate space for the match list (for `sudo -l'). */
1263: if (printmatches == TRUE)
1264: expand_match_list();
1265: }