Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix parsing issue when a backslash as the last character on sudoers file line #7440

Merged
merged 5 commits into from Feb 15, 2022
Merged

Fix parsing issue when a backslash as the last character on sudoers file line #7440

Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2fb0ab1
initial commit
iko1 Jan 8, 2022
ce6d484
improve backslash deletion from previous row
iko1 Jan 8, 2022
123e3ff
CR comments
iko1 Jan 12, 2022
355f409
CR comment
iko1 Jan 12, 2022
2155516
add unit test
iko1 Jan 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
20 changes: 20 additions & 0 deletions osquery/tables/system/posix/sudoers.cpp
View file
Open in desktop
Expand Up @@ -43,6 +43,7 @@ void genSudoersFile(const std::string& filename,
return;
}

bool isLongLine = false;
std::string contents;
if (!forensicReadFile(filename, contents).ok()) {
TLOG << "couldn't read sudoers file: " << filename;
Expand All @@ -61,6 +62,20 @@ void genSudoersFile(const std::string& filename,
continue;
}

// if last line contains a backslash as the last character,
// treat current line as part of previous line and
// append it to appropriate column.
if (isLongLine) {
mike-myers-tob marked this conversation as resolved.
Show resolved Hide resolved
isLongLine = (line.at(line.size() - 1) == '\\');
if (results.back()["rule_details"].empty()) {
results.back()["header"].pop_back();
} else {
results.back()["rule_details"].pop_back();
}
results.back()["rule_details"].append(line);
mike-myers-tob marked this conversation as resolved.
Show resolved Hide resolved
continue;
}

// Find the rule header
auto header_len = line.find_first_of(kSudoWhitespaceChars);
auto header = line.substr(0, header_len);
Expand All @@ -87,6 +102,11 @@ void genSudoersFile(const std::string& filename,
continue;
}

// Check if a blackslash is the last character on this line.
mike-myers-tob marked this conversation as resolved.
Show resolved Hide resolved
if (!is_include && !is_includedir && line.at(line.size() - 1) == '\\') {
mike-myers-tob marked this conversation as resolved.
Show resolved Hide resolved
isLongLine = true;
}

Row r;

r["header"] = header;
Expand Down