Bug 886648 – Access granted with invalid sudoRunAsUser/sudoRunAsGroup

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 886648 - Access granted with invalid sudoRunAsUser/sudoRunAsGroup

Summary:	Access granted with invalid sudoRunAsUser/sudoRunAsGroup

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	sudo (Show other bugs)
Sub Component:
Version:	6.4
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Daniel Kopeček
QA Contact:	David Spurek
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:	947775 1006991 1026904
	Show dependency tree / graph

Reported:	2012-12-12 13:46 EST by Nikolai Kondrashov
Modified:	2015-03-02 00:27 EST (History)
CC List:	6 users (show)

See Also:
Fixed In Version:	sudo-1.8.6p3-8.el6
Doc Type:	Bug Fix
Doc Text:	No documentation needed.
Story Points:	---
Clone Of:
Clones:	1006991 1026904 (view as bug list)
Environment:
Last Closed:	2013-11-21 18:12:10 EST
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
proposed patch (1.74 KB, patch) 2013-08-08 10:33 EDT, Daniel Kopeček	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2013:1701	normal	SHIPPED_LIVE	Low: sudo security, bug fix and enhancement update	2013-11-20 16:52:06 EST

Groups: None (edit)

Description Nikolai Kondrashov 2012-12-12 13:46:07 EST

Description of problem:
Sudo still grants access when the matching sudo rule, accessed either with ldap or sssd sudoers plugin, has sudoRunAsUser or sudoRunAsGroup set to an invalid user or group ID in the form of #id#, e.g. #10002#.

Version-Release number of selected component (if applicable):
sssd-client-1.9.2-37.el6.x86_64
sssd-1.9.2-37.el6.x86_64
sudo-1.8.6p3-6.el6.x86_64
libsss_idmap-1.9.2-37.el6.x86_64
libsss_sudo-1.9.2-37.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. Create a sudo rule employing #id-format value in sudoRunAsUser or sudoRunAsGroup.
2. Verify that access is granted.
3. Append '#' character to the value.
4. Try getting access again.

Actual results:
access is granted

Expected results:
access is denied

Comment 2 RHEL Product and Program Management 2012-12-16 01:51:13 EST

This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Comment 3 Daniel Kopeček 2013-08-08 10:32:58 EDT

Sudo accepts the invalid strings because it uses atoi() to convert the string to an uid/gid. I've changed the code to use strtol and added checks that the whole string was accepted by it.

Comment 4 Daniel Kopeček 2013-08-08 10:33:56 EDT

Created attachment 784416 [details]
proposed patch

Comment 9 Nikolai Kondrashov 2013-09-11 13:26:56 EDT

Verified fixed with sudo-1.8.6p3-11.el6.x86_64.

Relevant sudo suite output:

:: [   PASS   ] :: attrs_runasuser_user_id_invalid (Expected 0, got 0)
:: [   PASS   ] :: attrs_runasgroup_id_invalid (Expected 0, got 0)

Comment 10 errata-xmlrpc 2013-11-21 18:12:10 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-1701.html

Note You need to log in before you can comment on or make changes to this bug.