Return to sudoers2ldif CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers

Annotation of embedaddon/sudo/plugins/sudoers/sudoers2ldif, revision 1.1.1.1

1.1       misho       1: #!/usr/bin/env perl
                      2: use strict;
                      3: 
                      4: #
                      5: # Converts a sudoers file to LDIF format in prepration for loading into
                      6: # the LDAP server.
                      7: #
                      8: 
                      9: # BUGS:
                     10: #   Does not yet handle multiple lines with : in them
                     11: #   Does not yet remove quotation marks from options
                     12: #   Does not yet escape + at the beginning of a dn
                     13: #   Does not yet handle line wraps correctly
                     14: #   Does not yet handle multiple roles with same name (needs tiebreaker)
                     15: #
                     16: # CAVEATS:
                     17: #   Sudoers entries can have multiple RunAs entries that override former ones,
                     18: #      with LDAP sudoRunAs{Group,User} applies to all commands in a sudoRole
                     19: 
                     20: my %RA;
                     21: my %UA;
                     22: my %HA;
                     23: my %CA;
                     24: my $base=$ENV{SUDOERS_BASE} or die "$0: Container SUDOERS_BASE undefined\n";
                     25: my @options=();
                     26: 
                     27: my $did_defaults=0;
                     28: my $order = 0;
                     29: 
                     30: # parse sudoers one line at a time
                     31: while (<>){
                     32: 
                     33:   # remove comment
                     34:   s/#.*//;
                     35: 
                     36:   # line continuation
                     37:   $_.=<> while s/\\\s*$//s;
                     38: 
                     39:   # cleanup newline
                     40:   chomp;
                     41: 
                     42:   # ignore blank lines
                     43:   next if /^\s*$/;
                     44: 
                     45:   if (/^Defaults\s+/i) {
                     46:     my $opt=$';
                     47:     $opt=~s/\s+$//; # remove trailing whitespace
                     48:     push @options,$opt;
                     49:   } elsif (/^(\S+)\s+(.+)=\s*(.*)/) {
                     50: 
                     51:     # Aliases or Definitions
                     52:     my ($p1,$p2,$p3)=($1,$2,$3);
                     53:     $p2=~s/\s+$//; # remove trailing whitespace
                     54:     $p3=~s/\s+$//; # remove trailing whitespace
                     55: 
                     56:     if ($p1 eq "User_Alias") {
                     57:       $UA{$p2}=$p3;
                     58:     } elsif ($p1 eq "Runas_Alias") {
                     59:       $RA{$p2}=$p3;
                     60:     } elsif ($p1 eq "Host_Alias") {
                     61:       $HA{$p2}=$p3;
                     62:     } elsif ($p1 eq "Cmnd_Alias") {
                     63:       $CA{$p2}=$p3;
                     64:     } else {
                     65:       if (!$did_defaults++){
                     66:         # do this once
                     67:         print "dn: cn=defaults,$base\n";
                     68:         print "objectClass: top\n";
                     69:         print "objectClass: sudoRole\n";
                     70:         print "cn: defaults\n";
                     71:         print "description: Default sudoOption's go here\n";
                     72:         print "sudoOption: $_\n" foreach @options;
                     73:         printf "sudoOrder: %d\n", ++$order;
                     74:         print "\n";
                     75:       }
                     76:       # Definition
                     77:       my @users=split /\s*,\s*/,$p1;
                     78:       my @hosts=split /\s*,\s*/,$p2;
                     79:       my @cmds= split /\s*,\s*/,$p3;
                     80:       @options=();
                     81:       print "dn: cn=$users[0],$base\n";
                     82:       print "objectClass: top\n";
                     83:       print "objectClass: sudoRole\n";
                     84:       print "cn: $users[0]\n";
                     85:       # will clobber options
                     86:       print "sudoUser: $_\n"   foreach expand(\%UA,@users);
                     87:       print "sudoHost: $_\n"   foreach expand(\%HA,@hosts);
                     88:       foreach (@cmds) {
                     89:        if (s/^\(([^\)]+)\)\s*//) {
                     90:          my @runas = split(/:\s*/, $1);
                     91:          if (defined($runas[0])) {
                     92:            print "sudoRunAsUser: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[0]));
                     93:          }
                     94:          if (defined($runas[1])) {
                     95:            print "sudoRunAsGroup: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[1]));
                     96:          }
                     97:        }
                     98:       }
                     99:       print "sudoCommand: $_\n" foreach expand(\%CA,@cmds);
                    100:       print "sudoOption: $_\n" foreach @options;
                    101:       printf "sudoOrder: %d\n", ++$order;
                    102:       print "\n";
                    103:     }
                    104: 
                    105:   } else {
                    106:     print "parse error: $_\n";
                    107:   }
                    108: 
                    109: }
                    110: 
                    111: #
                    112: # recursively expand hash elements
                    113: sub expand{
                    114:   my $ref=shift;
                    115:   my @a=();
                    116: 
                    117:   # preen the line a little
                    118:   foreach (@_){
                    119:     # if NOPASSWD: directive found, mark entire entry as not requiring
                    120:     s/NOPASSWD:\s*// && push @options,"!authenticate";
                    121:     s/PASSWD:\s*// && push @options,"authenticate";
                    122:     s/NOEXEC:\s*// && push @options,"noexec";
                    123:     s/EXEC:\s*// && push @options,"!noexec";
                    124:     s/SETENV:\s*// && push @options,"setenv";
                    125:     s/NOSETENV:\s*// && push @options,"!setenv";
                    126:     s/LOG_INPUT:\s*// && push @options,"log_input";
                    127:     s/NOLOG_INPUT:\s*// && push @options,"!log_input";
                    128:     s/LOG_OUTPUT:\s*// && push @options,"log_output";
                    129:     s/NOLOG_OUTPUT:\s*// && push @options,"!log_output";
                    130:     s/\w+://; # silently remove other directives
                    131:     s/\s+$//; # right trim
                    132:   }
                    133: 
                    134:   # do the expanding
                    135:   push @a,$ref->{$_} ? expand($ref,split /\s*,\s*/,$ref->{$_}):$_ foreach @_;
                    136:   @a;
                    137: }
                    138: 
                    139: