diff --git a/osquery/tables/system/posix/sudoers.cpp b/osquery/tables/system/posix/sudoers.cpp index 20bfa46a294..59bbabaf37a 100644 --- a/osquery/tables/system/posix/sudoers.cpp +++ b/osquery/tables/system/posix/sudoers.cpp @@ -43,6 +43,7 @@ void genSudoersFile(const std::string& filename, return; } + bool isLongLine = false; std::string contents; if (!forensicReadFile(filename, contents).ok()) { TLOG << "couldn't read sudoers file: " << filename; @@ -61,6 +62,15 @@ void genSudoersFile(const std::string& filename, continue; } + // if last line contains a backslash as the last character, + // treat current line as part of long line. + if (isLongLine) { + isLongLine = (line.at(line.size() - 1) == '\\'); + results.back()["rule_details"].pop_back(); + results.back()["rule_details"].append(line); + continue; + } + // Find the rule header auto header_len = line.find_first_of(kSudoWhitespaceChars); auto header = line.substr(0, header_len); @@ -87,6 +97,11 @@ void genSudoersFile(const std::string& filename, continue; } + // Check if a blackslash is the last character on this line. + if (!is_include && !is_includedir && line.at(line.size() - 1) == '\\') { + isLongLine = true; + } + Row r; r["header"] = header;