Skip to content

Commit 1709dc7

Browse files
millertmillert
committed
In the timestamp record, include the start time of the terminal
session leader for tty-based timestamps or the start time of the parent process for ppid-based timestamps. Idea from Duncan Overbruck.
1 parent 5cec573 commit 1709dc7

8 files changed

Lines changed: 379 additions & 68 deletions

File tree

‎MANIFEST‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -515,6 +515,7 @@ plugins/sudoers/set_perms.c
515515
plugins/sudoers/solaris_audit.c
516516
plugins/sudoers/solaris_audit.h
517517
plugins/sudoers/sssd.c
518+
plugins/sudoers/starttime.c
518519
plugins/sudoers/sudo_nss.c
519520
plugins/sudoers/sudo_nss.h
520521
plugins/sudoers/sudo_printf.c

‎doc/sudoers.cat‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2772,19 +2772,21 @@ SSEECCUURRIITTYY NNOOTTEESS
27722772
with a date greater than current_time + 2 * TIMEOUT will be ignored and
27732773
ssuuddooeerrss will log and complain.
27742774

2775-
Since time stamp files live in the file system, they can outlive a user's
2776-
login session. As a result, a user may be able to login, run a command
2777-
with ssuuddoo after authenticating, logout, login again, and run ssuuddoo without
2778-
authenticating so long as the record's time stamp is within 5 minutes (or
2779-
whatever value the timeout is set to in the _s_u_d_o_e_r_s file). When the
2780-
_t_t_y___t_i_c_k_e_t_s option is enabled, the time stamp record includes the device
2781-
number of the terminal the user authenticated with. This provides per-
2782-
tty granularity but time stamp records still may outlive the user's
2783-
session. The time stamp record also includes the session ID of the
2784-
process that last authenticated. This prevents processes in different
2785-
terminal sessions from using the same time stamp record. It also helps
2786-
reduce the chance that a user will be able to run ssuuddoo without entering a
2787-
password when logging out and back in again on the same terminal.
2775+
If the _t_i_m_e_s_t_a_m_p___t_y_p_e option is set to "tty", the time stamp record
2776+
includes the device number of the terminal the user authenticated with.
2777+
This provides per-terminal granularity but time stamp records may still
2778+
outlive the user's session.
2779+
2780+
Unless the _t_i_m_e_s_t_a_m_p___t_y_p_e option is set to "global", the time stamp
2781+
record also includes the session ID of the process that last
2782+
authenticated. This prevents processes in different terminal sessions
2783+
from using the same time stamp record. On systems where a process's
2784+
start time can be queried, the start time of the session leader is
2785+
recorded in the time stamp record. If no terminal is present or the
2786+
_t_i_m_e_s_t_a_m_p___t_y_p_e option is set to "ppid", the start time of the parent
2787+
process is used instead. In most cases this will prevent a time stamp
2788+
record from being re-used without the user entering a password when
2789+
logging out and back in again.
27882790

27892791
DDEEBBUUGGGGIINNGG
27902792
Versions 1.8.4 and higher of the ssuuddooeerrss plugin support a flexible
@@ -2886,4 +2888,4 @@ DDIISSCCLLAAIIMMEERR
28862888
file distributed with ssuuddoo or https://www.sudo.ws/license.html for
28872889
complete details.
28882890

2889-
Sudo 1.8.22 December 11, 2017 Sudo 1.8.22
2891+
Sudo 1.8.22 December 15, 2017 Sudo 1.8.22

‎doc/sudoers.man.in‎

Lines changed: 25 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
.\" Agency (DARPA) and Air Force Research Laboratory, Air Force
2222
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
2323
.\"
24-
.TH "SUDOERS" "5" "December 11, 2017" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
24+
.TH "SUDOERS" "5" "December 15, 2017" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
2525
.nh
2626
.if n .ad l
2727
.SH "NAME"
@@ -5497,31 +5497,33 @@ will be ignored and
54975497
\fBsudoers\fR
54985498
will log and complain.
54995499
.PP
5500-
Since time stamp files live in the file system, they can outlive a
5501-
user's login session.
5502-
As a result, a user may be able to login, run a command with
5503-
\fBsudo\fR
5504-
after authenticating, logout, login again, and run
5505-
\fBsudo\fR
5506-
without authenticating so long as the record's time stamp is within
5507-
\fR@timeout@\fR
5508-
minutes (or whatever value the timeout is set to in the
5509-
\fIsudoers\fR
5510-
file).
5511-
When the
5512-
\fItty_tickets\fR
5513-
option is enabled, the time stamp record includes the device
5514-
number of the terminal the user authenticated with.
5515-
This provides per-tty granularity but time stamp records still
5516-
may outlive the user's session.
5517-
The time stamp record also includes the session ID of the process
5500+
If the
5501+
\fItimestamp_type\fR
5502+
option is set to
5503+
\(Lqtty\(Rq,
5504+
the time stamp record includes the device number of the terminal
5505+
the user authenticated with.
5506+
This provides per-terminal granularity but time stamp records may still
5507+
outlive the user's session.
5508+
.PP
5509+
Unless the
5510+
\fItimestamp_type\fR
5511+
option is set to
5512+
\(Lqglobal\(Rq,
5513+
the time stamp record also includes the session ID of the process
55185514
that last authenticated.
55195515
This prevents processes in different terminal sessions from using
55205516
the same time stamp record.
5521-
It also helps reduce the chance that a user will be able to run
5522-
\fBsudo\fR
5523-
without entering a password when logging out and back in again
5524-
on the same terminal.
5517+
On systems where a process's start time can be queried,
5518+
the start time of the session leader
5519+
is recorded in the time stamp record.
5520+
If no terminal is present or the
5521+
\fItimestamp_type\fR
5522+
option is set to
5523+
\(Lqppid\(Rq,
5524+
the start time of the parent process is used instead.
5525+
In most cases this will prevent a time stamp record from being re-used
5526+
without the user entering a password when logging out and back in again.
55255527
.SH "DEBUGGING"
55265528
Versions 1.8.4 and higher of the
55275529
\fBsudoers\fR

‎doc/sudoers.mdoc.in‎

Lines changed: 25 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
.\" Agency (DARPA) and Air Force Research Laboratory, Air Force
2020
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
2121
.\"
22-
.Dd December 11, 2017
22+
.Dd December 15, 2017
2323
.Dt SUDOERS @mansectform@
2424
.Os Sudo @PACKAGE_VERSION@
2525
.Sh NAME
@@ -5089,31 +5089,33 @@ will be ignored and
50895089
.Nm sudoers
50905090
will log and complain.
50915091
.Pp
5092-
Since time stamp files live in the file system, they can outlive a
5093-
user's login session.
5094-
As a result, a user may be able to login, run a command with
5095-
.Nm sudo
5096-
after authenticating, logout, login again, and run
5097-
.Nm sudo
5098-
without authenticating so long as the record's time stamp is within
5099-
.Li @timeout@
5100-
minutes (or whatever value the timeout is set to in the
5101-
.Em sudoers
5102-
file).
5103-
When the
5104-
.Em tty_tickets
5105-
option is enabled, the time stamp record includes the device
5106-
number of the terminal the user authenticated with.
5107-
This provides per-tty granularity but time stamp records still
5108-
may outlive the user's session.
5109-
The time stamp record also includes the session ID of the process
5092+
If the
5093+
.Em timestamp_type
5094+
option is set to
5095+
.Dq tty ,
5096+
the time stamp record includes the device number of the terminal
5097+
the user authenticated with.
5098+
This provides per-terminal granularity but time stamp records may still
5099+
outlive the user's session.
5100+
.Pp
5101+
Unless the
5102+
.Em timestamp_type
5103+
option is set to
5104+
.Dq global ,
5105+
the time stamp record also includes the session ID of the process
51105106
that last authenticated.
51115107
This prevents processes in different terminal sessions from using
51125108
the same time stamp record.
5113-
It also helps reduce the chance that a user will be able to run
5114-
.Nm sudo
5115-
without entering a password when logging out and back in again
5116-
on the same terminal.
5109+
On systems where a process's start time can be queried,
5110+
the start time of the session leader
5111+
is recorded in the time stamp record.
5112+
If no terminal is present or the
5113+
.Em timestamp_type
5114+
option is set to
5115+
.Dq ppid ,
5116+
the start time of the parent process is used instead.
5117+
In most cases this will prevent a time stamp record from being re-used
5118+
without the user entering a password when logging out and back in again.
51175119
.Sh DEBUGGING
51185120
Versions 1.8.4 and higher of the
51195121
.Nm

‎plugins/sudoers/Makefile.in‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,8 @@ SUDOERS_OBJS = $(AUTH_OBJS) boottime.lo check.lo editor.lo env.lo \
161161
env_pattern.lo find_path.lo gc.lo goodpath.lo group_plugin.lo \
162162
interfaces.lo iolog.lo iolog_path.lo locale.lo logging.lo \
163163
logwrap.lo mkdir_parents.lo parse.lo policy.lo prompt.lo \
164-
set_perms.lo sudo_nss.lo sudoers.lo timestamp.lo @SUDOERS_OBJS@
164+
set_perms.lo starttime.lo sudo_nss.lo sudoers.lo \
165+
timestamp.lo @SUDOERS_OBJS@
165166

166167
VISUDO_OBJS = editor.o find_path.o goodpath.o locale.o sudo_printf.o visudo.o \
167168
visudo_json.o
@@ -607,12 +608,13 @@ check_addr.o: $(srcdir)/regress/parser/check_addr.c $(devdir)/def_data.h \
607608
$(top_builddir)/pathnames.h
608609
$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/regress/parser/check_addr.c
609610
check_base64.o: $(srcdir)/regress/parser/check_base64.c \
610-
$(incdir)/sudo_compat.h $(top_builddir)/config.h
611+
$(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
612+
$(incdir)/sudo_util.h $(top_builddir)/config.h
611613
$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/regress/parser/check_base64.c
612614
check_digest.o: $(srcdir)/regress/parser/check_digest.c \
613615
$(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
614616
$(incdir)/sudo_fatal.h $(incdir)/sudo_queue.h \
615-
$(srcdir)/parse.h $(top_builddir)/config.h
617+
$(incdir)/sudo_util.h $(srcdir)/parse.h $(top_builddir)/config.h
616618
$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/regress/parser/check_digest.c
617619
check_env_pattern.o: $(srcdir)/regress/env_match/check_env_pattern.c \
618620
$(devdir)/def_data.h $(incdir)/compat/stdbool.h \
@@ -634,11 +636,12 @@ check_fill.o: $(srcdir)/regress/parser/check_fill.c $(devdir)/gram.h \
634636
check_gentime.o: $(srcdir)/regress/parser/check_gentime.c \
635637
$(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
636638
$(incdir)/sudo_debug.h $(incdir)/sudo_queue.h \
637-
$(srcdir)/parse.h $(srcdir)/sudoers_debug.h \
638-
$(top_builddir)/config.h
639+
$(incdir)/sudo_util.h $(srcdir)/parse.h \
640+
$(srcdir)/sudoers_debug.h $(top_builddir)/config.h
639641
$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/regress/parser/check_gentime.c
640642
check_hexchar.o: $(srcdir)/regress/parser/check_hexchar.c \
641-
$(incdir)/sudo_compat.h $(top_builddir)/config.h
643+
$(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
644+
$(incdir)/sudo_util.h $(top_builddir)/config.h
642645
$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/regress/parser/check_hexchar.c
643646
check_iolog_path.o: $(srcdir)/regress/iolog_path/check_iolog_path.c \
644647
$(devdir)/def_data.c $(devdir)/def_data.h \
@@ -1111,6 +1114,16 @@ sssd.lo: $(srcdir)/sssd.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \
11111114
$(srcdir)/sudoers_debug.h $(top_builddir)/config.h \
11121115
$(top_builddir)/pathnames.h
11131116
$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/sssd.c
1117+
starttime.lo: $(srcdir)/starttime.c $(devdir)/def_data.h \
1118+
$(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
1119+
$(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
1120+
$(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
1121+
$(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
1122+
$(incdir)/sudo_util.h $(srcdir)/check.h $(srcdir)/defaults.h \
1123+
$(srcdir)/logging.h $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \
1124+
$(srcdir)/sudoers_debug.h $(top_builddir)/config.h \
1125+
$(top_builddir)/pathnames.h
1126+
$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/starttime.c
11141127
sudo_auth.lo: $(authdir)/sudo_auth.c $(devdir)/def_data.h \
11151128
$(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
11161129
$(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \

‎plugins/sudoers/check.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
* records. Each record starts with a 16-bit version number and a 16-bit
3535
* record size. Multiple record types can coexist in the same file.
3636
*/
37-
#define TS_VERSION 1
37+
#define TS_VERSION 2
3838

3939
/* Time stamp entry types */
4040
#define TS_GLOBAL 0x01
@@ -46,14 +46,14 @@
4646
#define TS_DISABLED 0x01 /* entry disabled */
4747
#define TS_ANYUID 0x02 /* ignore uid, only valid in the key */
4848

49-
/* XXX - may also want to store uid/gid of tty device */
5049
struct timestamp_entry {
5150
unsigned short version; /* version number */
5251
unsigned short size; /* entry size */
5352
unsigned short type; /* TS_GLOBAL, TS_TTY, TS_PPID */
5453
unsigned short flags; /* TS_DISABLED, TS_ANYUID */
5554
uid_t auth_uid; /* uid to authenticate as */
5655
pid_t sid; /* session ID associated with tty/ppid */
56+
struct timespec start_time; /* session/ppid start time */
5757
struct timespec ts; /* timestamp (CLOCK_MONOTONIC) */
5858
union {
5959
dev_t ttydev; /* tty device number */
@@ -66,6 +66,7 @@ void timestamp_close(void *vcookie);
6666
bool timestamp_lock(void *vcookie, struct passwd *pw);
6767
bool timestamp_update(void *vcookie, struct passwd *pw);
6868
int timestamp_status(void *vcookie, struct passwd *pw);
69+
int get_starttime(pid_t pid, struct timespec *starttime);
6970
bool already_lectured(int status);
7071
int set_lectured(void);
7172

0 commit comments

Comments
 (0)