Bugzilla – Bug 596
when compiled with HAVE_DOMAINNAME sudo should still check there *IS* a domainname
Last modified: 2013-06-16 05:05:23 MDT
In parse.c's netgr_match() function, if HAVE_DOMAINNAME is defined, sudo blindly gets the domainname from getdomainname (line 453). Apparently, on my RHEL6 box (and RHEL5), getdomainname returns the string literal "(none)". That makes it hard to match on a domainname. This stems from trying to be a little more careful in netgroup entries (so that a user entry of (user,,) doesn't accidentally cause everyone to have that permission. Using (-,user,) is awkward, so it would be nice to use (-,user,-), since we don't have a domainname to be used with netgroups (and, really, that was just kinda weird anyway, to be valid only in that domain. Now it makes some more sense, but at the same time, that information is really coded in the basedn of LDAP). I propose if getdomainname returns (none) that domain == NULL, which will emulate what happens with no domainname.
And I'm high on crack and looking at a revision from 12 years ago.
OK, it's changed (there's now indeed a check), but it's still a problem for us. Now, in plugins/sudoers/match.c line 749, the check is now made, but against NULL, not against the literal '(none)'. I suppose this is a Red Hat weirdness, but nonetheless, seems like a || strcmp(domain,"(NULL)") might help us out.
That is somewhat odd. I'll add a check for "(none)" for sudo 1.8.7.
So, I opened a ticket with Red Hat. Turns out they must be doing something to set the domain to "(none)" since we can set it to null with a little C program. . . I'll update this ticket if they give me any useful information. Still, any domain returned with a non-legal hostname character, like a paren or the like probably shouldn't be considered a domainname. :-) Sean
Hi. I just checked the upstream kernel bits after Red Hat got back to me. Turns out that there is this define in current stable on git.kernel.org: In root/include/linux/uts.h: #ifndef UTS_DOMAINNAME #define UTS_DOMAINNAME "(none)" /* set by setdomainname() */ #endif Thus, if "setdomainname()" is NEVER called, domainname will be set to "(none)". So, not a Red Hat-ism. Thanks for adding this to 1.8.7. Sean
Fixed in sudo 1.8.7.