Bug 439 - bsm auditing is not transparent when not avaible to sudo in solaris
bsm auditing is not transparent when not avaible to sudo in solaris
Status: RESOLVED FIXED
Product: Sudo
Classification: Unclassified
Component: Sudo
1.7.4
Sun Solaris 2.x
: low normal
Assigned To: Todd C. Miller
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-09-08 09:14 MDT by buggenhout.kris
Modified: 2011-01-15 12:21 MST (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description buggenhout.kris 2010-09-08 09:14:37 MDT
enabling bsm auditing in the build breaks sudo functionality when the auditing framework is not configured.
the function call bsm_audit_failure contains a check 

in bsm_audit.c

....
if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
       if (errno == ENOSYS)
            return;
       log_error (0, "Could not determine audit condition");
....

Solaris does not return the error ENOSYS but EINVALID when audit is disabled or not set up. 

in this case sudo refuses to allow the sudo to pass as it is in an error state not recognized.

adding EINVAL as possible error, maybe it would be more elegant to make it platform dependant but this is a quick fix.


.....
if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
       if (errno == ENOSYS  || errno == EINVAL)
            return;
       log_error (0, "Could not determine audit condition");

.....

with this small enhancement, sudo works transparantly wether auditing is enabled or not.

krgrds, Kris
Comment 1 Todd C. Miller 2010-09-08 09:48:26 MDT
Thanks for the report.  I've made a change to the source repo that should work with both Solaris BSM and OpenBSM.  It will be part of sudo 1.7.5.
Comment 2 Todd C. Miller 2010-11-03 13:34:25 MDT
The first beta rlease of sudo 1.7.5 is now available
http://www.sudo.ws/sudo/dist/beta/sudo-1.7.5b1.tar.gz
Comment 3 Todd C. Miller 2011-01-15 12:21:37 MST
Fixed in sudo 1.7.4p5