Return to sudoers2ldif CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers

1.8.7

    1: #!/usr/bin/env perl
    2: #
    3: # Copyright (c) 2007, 2010-2011, 2013 Todd C. Miller <Todd.Miller@courtesan.com>
    4: #
    5: # Permission to use, copy, modify, and distribute this software for any
    6: # purpose with or without fee is hereby granted, provided that the above
    7: # copyright notice and this permission notice appear in all copies.
    8: #
    9: # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   10: # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   11: # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
   12: # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
   13: # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   14: # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   15: # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   16: #
   17: 
   18: use strict;
   19: 
   20: #
   21: # Converts a sudoers file to LDIF format in prepration for loading into
   22: # the LDAP server.
   23: #
   24: 
   25: # BUGS:
   26: #   Does not yet handle multiple lines with : in them
   27: #   Does not yet remove quotation marks from options
   28: #   Does not yet escape + at the beginning of a dn
   29: #   Does not yet handle line wraps correctly
   30: #   Does not yet handle multiple roles with same name (needs tiebreaker)
   31: #
   32: # CAVEATS:
   33: #   Sudoers entries can have multiple RunAs entries that override former ones,
   34: #	with LDAP sudoRunAs{Group,User} applies to all commands in a sudoRole
   35: 
   36: my %RA;
   37: my %UA;
   38: my %HA;
   39: my %CA;
   40: my $base=$ENV{SUDOERS_BASE} or die "$0: Container SUDOERS_BASE undefined\n";
   41: my @options=();
   42: 
   43: my $did_defaults=0;
   44: my $order = 0;
   45: 
   46: # parse sudoers one line at a time
   47: while (<>){
   48: 
   49:   # remove comment
   50:   s/#.*//;
   51: 
   52:   # line continuation
   53:   $_.=<> while s/\\\s*$//s;
   54: 
   55:   # cleanup newline
   56:   chomp;
   57: 
   58:   # ignore blank lines
   59:   next if /^\s*$/;
   60: 
   61:   if (/^Defaults\s+/i) {
   62:     my $opt=$';
   63:     $opt=~s/\s+$//; # remove trailing whitespace
   64:     push @options,$opt;
   65:   } elsif (/^(\S+)\s+([^=]+)=\s*(.*)/) {
   66: 
   67:     # Aliases or Definitions
   68:     my ($p1,$p2,$p3)=($1,$2,$3);
   69:     $p2=~s/\s+$//; # remove trailing whitespace
   70:     $p3=~s/\s+$//; # remove trailing whitespace
   71: 
   72:     if ($p1 eq "User_Alias") {
   73:       $UA{$p2}=$p3;
   74:     } elsif ($p1 eq "Runas_Alias") {
   75:       $RA{$p2}=$p3;
   76:     } elsif ($p1 eq "Host_Alias") {
   77:       $HA{$p2}=$p3;
   78:     } elsif ($p1 eq "Cmnd_Alias") {
   79:       $CA{$p2}=$p3;
   80:     } else {
   81:       if (!$did_defaults++){
   82:         # do this once
   83:         print "dn: cn=defaults,$base\n";
   84:         print "objectClass: top\n";
   85:         print "objectClass: sudoRole\n";
   86:         print "cn: defaults\n";
   87:         print "description: Default sudoOption's go here\n";
   88:         print "sudoOption: $_\n" foreach @options;
   89:         printf "sudoOrder: %d\n", ++$order;
   90:         print "\n";
   91:       }
   92:       # Definition
   93:       my @users=split /\s*,\s*/,$p1;
   94:       my @hosts=split /\s*,\s*/,$p2;
   95:       my @cmds= split /\s*,\s*/,$p3;
   96:       @options=();
   97:       print "dn: cn=$users[0],$base\n";
   98:       print "objectClass: top\n";
   99:       print "objectClass: sudoRole\n";
  100:       print "cn: $users[0]\n";
  101:       # will clobber options
  102:       print "sudoUser: $_\n"   foreach expand(\%UA,@users);
  103:       print "sudoHost: $_\n"   foreach expand(\%HA,@hosts);
  104:       foreach (@cmds) {
  105: 	if (s/^\(([^\)]+)\)\s*//) {
  106: 	  my @runas = split(/:\s*/, $1);
  107: 	  if (defined($runas[0])) {
  108: 	    print "sudoRunAsUser: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[0]));
  109: 	  }
  110: 	  if (defined($runas[1])) {
  111: 	    print "sudoRunAsGroup: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[1]));
  112: 	  }
  113: 	}
  114:       }
  115:       print "sudoCommand: $_\n" foreach expand(\%CA,@cmds);
  116:       print "sudoOption: $_\n" foreach @options;
  117:       printf "sudoOrder: %d\n", ++$order;
  118:       print "\n";
  119:     }
  120: 
  121:   } else {
  122:     print "parse error: $_\n";
  123:   }
  124: 
  125: }
  126: 
  127: #
  128: # recursively expand hash elements
  129: sub expand{
  130:   my $ref=shift;
  131:   my @a=();
  132: 
  133:   # preen the line a little
  134:   foreach (@_){
  135:     # if NOPASSWD: directive found, mark entire entry as not requiring
  136:     s/NOPASSWD:\s*// && push @options,"!authenticate";
  137:     s/PASSWD:\s*// && push @options,"authenticate";
  138:     s/NOEXEC:\s*// && push @options,"noexec";
  139:     s/EXEC:\s*// && push @options,"!noexec";
  140:     s/SETENV:\s*// && push @options,"setenv";
  141:     s/NOSETENV:\s*// && push @options,"!setenv";
  142:     s/LOG_INPUT:\s*// && push @options,"log_input";
  143:     s/NOLOG_INPUT:\s*// && push @options,"!log_input";
  144:     s/LOG_OUTPUT:\s*// && push @options,"log_output";
  145:     s/NOLOG_OUTPUT:\s*// && push @options,"!log_output";
  146:     s/[[:upper:]]+://; # silently remove other tags
  147:     s/\s+$//; # right trim
  148:   }
  149: 
  150:   # do the expanding
  151:   push @a,$ref->{$_} ? expand($ref,split /\s*,\s*/,$ref->{$_}):$_ foreach @_;
  152:   @a;
  153: }
  154: 
  155: