initial commit

osquery/tables/system/posix/sudoers.cpp

@@ -43,6 +43,7 @@ void genSudoersFile(const std::string& filename,
     return;
   }
 
+  bool isLongLine = false;
   std::string contents;
   if (!forensicReadFile(filename, contents).ok()) {
     TLOG << "couldn't read sudoers file: " << filename;
@@ -61,6 +62,15 @@ void genSudoersFile(const std::string& filename,
       continue;
     }
 
+    // if last line contains a backslash as the last character,
+    // treat current line as part of long line.
+    if (isLongLine) {
+      isLongLine = (line.at(line.size() - 1) == '\\');
+      results.back()["rule_details"].pop_back();
+      results.back()["rule_details"].append(line);
+      continue;
+    }
+
     // Find the rule header
     auto header_len = line.find_first_of(kSudoWhitespaceChars);
     auto header = line.substr(0, header_len);
@@ -87,6 +97,11 @@ void genSudoersFile(const std::string& filename,
       continue;
     }
 
+    // Check if a blackslash is the last character on this line.
+    if (!is_include && !is_includedir && line.at(line.size() - 1) == '\\') {
+      isLongLine = true;
+    }
+
     Row r;
 
     r["header"] = header;