Annotation of embedaddon/sudo/plugins/sudoers/visudo_json.c, revision 1.1.1.1
1.1 misho 1: /*
2: * Copyright (c) 2013 Todd C. Miller <Todd.Miller@courtesan.com>
3: *
4: * Permission to use, copy, modify, and distribute this software for any
5: * purpose with or without fee is hereby granted, provided that the above
6: * copyright notice and this permission notice appear in all copies.
7: *
8: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15: */
16:
17: #include <config.h>
18:
19: #include <sys/types.h>
20: #include <stdio.h>
21: #ifdef STDC_HEADERS
22: # include <stdlib.h>
23: # include <stddef.h>
24: #else
25: # ifdef HAVE_STDLIB_H
26: # include <stdlib.h>
27: # endif
28: #endif /* STDC_HEADERS */
29: #ifdef HAVE_STRING_H
30: # include <string.h>
31: #endif /* HAVE_STRING_H */
32: #ifdef HAVE_STRINGS_H
33: # include <strings.h>
34: #endif /* HAVE_STRINGS_H */
35: #ifdef HAVE_UNISTD_H
36: #include <unistd.h>
37: #endif /* HAVE_UNISTD_H */
38: #include <stdarg.h>
39: #include <ctype.h>
40:
41: #include "sudoers.h"
42: #include "parse.h"
43: #include <gram.h>
44:
45: /*
46: * JSON values may be of the following types.
47: */
48: enum json_value_type {
49: JSON_STRING,
50: JSON_ID,
51: JSON_NUMBER,
52: JSON_OBJECT,
53: JSON_ARRAY,
54: JSON_BOOL,
55: JSON_NULL
56: };
57:
58: /*
59: * JSON value suitable for printing.
60: * Note: this does not support object or array values.
61: */
62: struct json_value {
63: enum json_value_type type;
64: union {
65: char *string;
66: int number;
67: id_t id;
68: bool boolean;
69: } u;
70: };
71:
72: /*
73: * Closure used to store state when iterating over all aliases.
74: */
75: struct json_alias_closure {
76: FILE *fp;
77: const char *title;
78: unsigned int count;
79: int alias_type;
80: int indent;
81: bool need_comma;
82: };
83:
84: /*
85: * Type values used to disambiguate the generic WORD and ALIAS types.
86: */
87: enum word_type {
88: TYPE_COMMAND,
89: TYPE_HOSTNAME,
90: TYPE_RUNASGROUP,
91: TYPE_RUNASUSER,
92: TYPE_USERNAME
93: };
94:
95: /*
96: * Print "indent" number of blank characters.
97: */
98: static void
99: print_indent(FILE *fp, int indent)
100: {
101: while (indent--)
102: putc(' ', fp);
103: }
104:
105: /*
106: * Print a JSON string, escaping special characters.
107: * Does not support unicode escapes.
108: */
109: static void
110: print_string_json_unquoted(FILE *fp, const char *str)
111: {
112: char ch;
113:
114: while ((ch = *str++) != '\0') {
115: switch (ch) {
116: case '"':
117: case '\\':
118: case '/':
119: putc('\\', fp);
120: break;
121: case '\b':
122: ch = 'b';
123: putc('\\', fp);
124: break;
125: case '\f':
126: ch = 'f';
127: putc('\\', fp);
128: break;
129: case '\n':
130: ch = 'n';
131: putc('\\', fp);
132: break;
133: case '\r':
134: ch = 'r';
135: putc('\\', fp);
136: break;
137: case '\t':
138: ch = 't';
139: putc('\\', fp);
140: break;
141: }
142: putc(ch, fp);
143: }
144: }
145:
146: /*
147: * Print a quoted JSON string, escaping special characters.
148: * Does not support unicode escapes.
149: */
150: static void
151: print_string_json(FILE *fp, const char *str)
152: {
153: putc('\"', fp);
154: print_string_json_unquoted(fp, str);
155: putc('\"', fp);
156: }
157:
158: /*
159: * Print a JSON name: value pair with proper quoting and escaping.
160: */
161: static void
162: print_pair_json(FILE *fp, const char *pre, const char *name,
163: const struct json_value *value, const char *post, int indent)
164: {
165: debug_decl(print_pair_json, SUDO_DEBUG_UTIL)
166:
167: print_indent(fp, indent);
168:
169: /* prefix */
170: if (pre != NULL)
171: fputs(pre, fp);
172:
173: /* name */
174: print_string_json(fp, name);
175: putc(':', fp);
176: putc(' ', fp);
177:
178: /* value */
179: switch (value->type) {
180: case JSON_STRING:
181: print_string_json(fp, value->u.string);
182: break;
183: case JSON_ID:
184: fprintf(fp, "%u", (unsigned int)value->u.id);
185: break;
186: case JSON_NUMBER:
187: fprintf(fp, "%d", value->u.number);
188: break;
189: case JSON_NULL:
190: fputs("null", fp);
191: break;
192: case JSON_BOOL:
193: fputs(value->u.boolean ? "true" : "false", fp);
194: break;
195: case JSON_OBJECT:
196: fatalx("internal error: can't print JSON_OBJECT");
197: break;
198: case JSON_ARRAY:
199: fatalx("internal error: can't print JSON_ARRAY");
200: break;
201: }
202:
203: /* postfix */
204: if (post != NULL)
205: fputs(post, fp);
206:
207: debug_return;
208: }
209:
210: /*
211: * Print a JSON string with optional prefix and postfix to fp.
212: * Strings are not quoted but are escaped as per the JSON spec.
213: */
214: static void
215: printstr_json(FILE *fp, const char *pre, const char *str, const char *post,
216: int indent)
217: {
218: debug_decl(printstr_json, SUDO_DEBUG_UTIL)
219:
220: print_indent(fp, indent);
221: if (pre != NULL)
222: fputs(pre, fp);
223: if (str != NULL) {
224: print_string_json_unquoted(fp, str);
225: }
226: if (post != NULL)
227: fputs(post, fp);
228: debug_return;
229: }
230:
231: /*
232: * Print sudo command member in JSON format, with specified indentation.
233: * If last_one is false, a comma will be printed before the newline
234: * that closes the object.
235: */
236: static void
237: print_command_json(FILE *fp, struct member *m, int indent, bool last_one)
238: {
239: struct sudo_command *c = (struct sudo_command *)m->name;
240: struct json_value value;
241: const char *digest_name;
242: debug_decl(print_command_json, SUDO_DEBUG_UTIL)
243:
244: printstr_json(fp, "{", NULL, NULL, indent);
245: if (m->negated || c->digest != NULL) {
246: putc('\n', fp);
247: indent += 4;
248: } else {
249: putc(' ', fp);
250: indent = 0;
251: }
252:
253: /* Print command with optional command line args. */
254: if (c->args != NULL) {
255: printstr_json(fp, "\"", "command", "\": ", indent);
256: printstr_json(fp, "\"", c->cmnd, " ", 0);
257: printstr_json(fp, NULL, c->args, "\"", 0);
258: } else {
259: value.type = JSON_STRING;
260: value.u.string = c->cmnd;
261: print_pair_json(fp, NULL, "command", &value, NULL, indent);
262: }
263:
264: /* Optional digest. */
265: if (c->digest != NULL) {
266: fputs(",\n", fp);
267: switch (c->digest->digest_type) {
268: case SUDO_DIGEST_SHA224:
269: digest_name = "sha224";
270: break;
271: case SUDO_DIGEST_SHA256:
272: digest_name = "sha256";
273: break;
274: case SUDO_DIGEST_SHA384:
275: digest_name = "sha384";
276: break;
277: case SUDO_DIGEST_SHA512:
278: digest_name = "sha512";
279: break;
280: default:
281: digest_name = "invalid digest";
282: break;
283: }
284: value.type = JSON_STRING;
285: value.u.string = c->digest->digest_str;
286: print_pair_json(fp, NULL, digest_name, &value, NULL, indent);
287: }
288:
289: /* Command may be negated. */
290: if (m->negated) {
291: fputs(",\n", fp);
292: value.type = JSON_BOOL;
293: value.u.boolean = true;
294: print_pair_json(fp, NULL, "negated", &value, NULL, indent);
295: }
296:
297: if (indent != 0) {
298: indent -= 4;
299: putc('\n', fp);
300: print_indent(fp, indent);
301: } else {
302: putc(' ', fp);
303: }
304: putc('}', fp);
305: if (!last_one)
306: putc(',', fp);
307: putc('\n', fp);
308:
309: debug_return;
310: }
311:
312: /*
313: * Map an alias type to enum word_type.
314: */
315: static enum word_type
316: alias_to_word_type(int alias_type)
317: {
318: switch (alias_type) {
319: case CMNDALIAS:
320: return TYPE_COMMAND;
321: case HOSTALIAS:
322: return TYPE_HOSTNAME;
323: case RUNASALIAS:
324: return TYPE_RUNASUSER;
325: case USERALIAS:
326: return TYPE_USERNAME;
327: default:
328: fatalx_nodebug("unexpected alias type %d", alias_type);
329: }
330: }
331:
332: /*
333: * Map a Defaults type to enum word_type.
334: */
335: static enum word_type
336: defaults_to_word_type(int defaults_type)
337: {
338: switch (defaults_type) {
339: case DEFAULTS_CMND:
340: return TYPE_COMMAND;
341: case DEFAULTS_HOST:
342: return TYPE_HOSTNAME;
343: case DEFAULTS_RUNAS:
344: return TYPE_RUNASUSER;
345: case DEFAULTS_USER:
346: return TYPE_USERNAME;
347: default:
348: fatalx_nodebug("unexpected defaults type %d", defaults_type);
349: }
350: }
351:
352: /*
353: * Print struct member in JSON format, with specified indentation.
354: * If last_one is false, a comma will be printed before the newline
355: * that closes the object.
356: */
357: static void
358: print_member_json(FILE *fp, struct member *m, enum word_type word_type,
359: bool last_one, int indent)
360: {
361: struct json_value value;
362: const char *typestr;
363: const char *errstr;
364: id_t id;
365: debug_decl(print_member_json, SUDO_DEBUG_UTIL)
366:
367: /* Most of the time we print a string. */
368: value.type = JSON_STRING;
369: value.u.string = m->name;
370:
371: switch (m->type) {
372: case USERGROUP:
373: value.u.string++; /* skip leading '%' */
374: if (*value.u.string == ':') {
375: value.u.string++;
376: typestr = "nonunixgroup";
377: if (*value.u.string == '#') {
378: id = atoid(m->name + 3, NULL, NULL, &errstr);
379: if (errstr != NULL) {
380: warningx("internal error: non-Unix group ID %s: \"%s\"",
381: errstr, m->name);
382: } else {
383: value.type = JSON_ID;
384: value.u.id = id;
385: typestr = "nonunixgid";
386: }
387: }
388: } else {
389: typestr = "usergroup";
390: if (*value.u.string == '#') {
391: id = atoid(m->name + 2, NULL, NULL, &errstr);
392: if (errstr != NULL) {
393: warningx("internal error: group ID %s: \"%s\"",
394: errstr, m->name);
395: } else {
396: value.type = JSON_ID;
397: value.u.id = id;
398: typestr = "usergid";
399: }
400: }
401: }
402: break;
403: case NETGROUP:
404: typestr = "netgroup";
405: value.u.string++; /* skip leading '+' */
406: break;
407: case NTWKADDR:
408: typestr = "networkaddr";
409: break;
410: case COMMAND:
411: print_command_json(fp, m, indent, last_one);
412: debug_return;
413: case WORD:
414: switch (word_type) {
415: case TYPE_HOSTNAME:
416: typestr = "hostname";
417: break;
418: case TYPE_RUNASGROUP:
419: typestr = "usergroup";
420: break;
421: case TYPE_RUNASUSER:
422: case TYPE_USERNAME:
423: typestr = "username";
424: if (*value.u.string == '#') {
425: id = atoid(m->name + 1, NULL, NULL, &errstr);
426: if (errstr != NULL) {
427: warningx("internal error: user ID %s: \"%s\"",
428: errstr, m->name);
429: } else {
430: value.type = JSON_ID;
431: value.u.id = id;
432: typestr = "userid";
433: }
434: }
435: break;
436: default:
437: fatalx("unexpected word type %d", word_type);
438: }
439: break;
440: case ALL:
441: value.u.string = "ALL";
442: /* FALLTHROUGH */
443: case ALIAS:
444: switch (word_type) {
445: case TYPE_COMMAND:
446: typestr = "cmndalias";
447: break;
448: case TYPE_HOSTNAME:
449: typestr = "hostalias";
450: break;
451: case TYPE_RUNASGROUP:
452: case TYPE_RUNASUSER:
453: typestr = "runasalias";
454: break;
455: case TYPE_USERNAME:
456: typestr = "useralias";
457: break;
458: default:
459: fatalx("unexpected word type %d", word_type);
460: }
461: break;
462: default:
463: fatalx("unexpected member type %d", m->type);
464: }
465:
466: if (m->negated) {
467: print_indent(fp, indent);
468: fputs("{\n", fp);
469: indent += 4;
470: print_pair_json(fp, NULL, typestr, &value, ",\n", indent);
471: value.type = JSON_BOOL;
472: value.u.boolean = true;
473: print_pair_json(fp, NULL, "negated", &value, "\n", indent);
474: indent -= 4;
475: print_indent(fp, indent);
476: putc('}', fp);
477: } else {
478: print_pair_json(fp, "{ ", typestr, &value, " }", indent);
479: }
480: if (!last_one)
481: putc(',', fp);
482: putc('\n', fp);
483:
484: debug_return;
485: }
486:
487: /*
488: * Callback for alias_apply() to print an alias entry if it matches
489: * the type specified in the closure.
490: */
491: int
492: print_alias_json(void *v1, void *v2)
493: {
494: struct alias *a = v1;
495: struct json_alias_closure *closure = v2;
496: struct member *m;
497: debug_decl(print_alias_json, SUDO_DEBUG_UTIL)
498:
499: if (a->type != closure->alias_type)
500: debug_return_int(0);
501:
502: /* Open the aliases object or close the last entry, then open new one. */
503: if (closure->count++ == 0) {
504: fprintf(closure->fp, "%s\n%*s\"%s\": {\n",
505: closure->need_comma ? "," : "", closure->indent, "",
506: closure->title);
507: closure->indent += 4;
508: } else {
509: fprintf(closure->fp, "%*s],\n", closure->indent, "");
510: }
511: printstr_json(closure->fp, "\"", a->name, "\": [\n", closure->indent);
512:
513: closure->indent += 4;
514: TAILQ_FOREACH(m, &a->members, entries) {
515: print_member_json(closure->fp, m,
516: alias_to_word_type(closure->alias_type),
517: TAILQ_NEXT(m, entries) == NULL, closure->indent);
518: }
519: closure->indent -= 4;
520: debug_return_int(0);
521: }
522:
523: /*
524: * Print the binding for a Defaults entry of the specified type.
525: */
526: static void
527: print_binding_json(FILE *fp, struct member_list *binding, int type, int indent)
528: {
529: struct member *m;
530: debug_decl(print_binding_json, SUDO_DEBUG_UTIL)
531:
532: if (TAILQ_EMPTY(binding))
533: debug_return;
534:
535: fprintf(fp, "%*s\"Binding\": [\n", indent, "");
536: indent += 4;
537:
538: /* Print each member object in binding. */
539: TAILQ_FOREACH(m, binding, entries) {
540: print_member_json(fp, m, defaults_to_word_type(type),
541: TAILQ_NEXT(m, entries) == NULL, indent);
542: }
543:
544: indent -= 4;
545: fprintf(fp, "%*s],\n", indent, "");
546:
547: debug_return;
548: }
549:
550: /*
551: * Print a Defaults list JSON format.
552: */
553: static void
554: print_defaults_list_json(FILE *fp, struct defaults *def, int indent)
555: {
556: char savech, *start, *end = def->val;
557: struct json_value value;
558: debug_decl(print_defaults_list_json, SUDO_DEBUG_UTIL)
559:
560: fprintf(fp, "%*s{\n", indent, "");
561: indent += 4;
562: value.type = JSON_STRING;
563: switch (def->op) {
564: case '+':
565: value.u.string = "list_add";
566: break;
567: case '-':
568: value.u.string = "list_remove";
569: break;
570: case true:
571: value.u.string = "list_assign";
572: break;
573: default:
574: warningx("internal error: unexpected list op %d", def->op);
575: value.u.string = "unsupported";
576: break;
577: }
578: print_pair_json(fp, NULL, "operation", &value, ",\n", indent);
579: printstr_json(fp, "\"", def->var, "\": [\n", indent);
580: indent += 4;
581: print_indent(fp, indent);
582: /* Split value into multiple space-separated words. */
583: do {
584: /* Remove leading blanks, must have a non-empty string. */
585: for (start = end; isblank((unsigned char)*start); start++)
586: ;
587: if (*start == '\0')
588: break;
589:
590: /* Find the end and print it. */
591: for (end = start; *end && !isblank((unsigned char)*end); end++)
592: ;
593: savech = *end;
594: *end = '\0';
595: print_string_json(fp, start);
596: if (savech != '\0')
597: putc(',', fp);
598: *end = savech;
599: } while (*end++ != '\0');
600: putc('\n', fp);
601: indent -= 4;
602: fprintf(fp, "%*s]\n", indent, "");
603: indent -= 4;
604: fprintf(fp, "%*s}", indent, "");
605:
606: debug_return;
607: }
608:
609: static int
610: get_defaults_type(struct defaults *def)
611: {
612: struct sudo_defs_types *cur;
613:
614: /* Look up def in table to find its type. */
615: for (cur = sudo_defs_table; cur->name; cur++) {
616: if (strcmp(def->var, cur->name) == 0)
617: return cur->type;
618: }
619: return -1;
620: }
621:
622: /*
623: * Export all Defaults in JSON format.
624: */
625: static bool
626: print_defaults_json(FILE *fp, int indent, bool need_comma)
627: {
628: struct json_value value;
629: struct defaults *def, *next;
630: int type;
631: debug_decl(print_defaults_json, SUDO_DEBUG_UTIL)
632:
633: if (TAILQ_EMPTY(&defaults))
634: debug_return_bool(need_comma);
635:
636: fprintf(fp, "%s\n%*s\"Defaults\": [\n", need_comma ? "," : "", indent, "");
637: indent += 4;
638:
639: TAILQ_FOREACH_SAFE(def, &defaults, entries, next) {
640: type = get_defaults_type(def);
641: if (type == -1) {
642: warningx(U_("unknown defaults entry `%s'"), def->var);
643: /* XXX - just pass it through as a string anyway? */
644: continue;
645: }
646:
647: /* Found it, print object container and binding (if any). */
648: fprintf(fp, "%*s{\n", indent, "");
649: indent += 4;
650: print_binding_json(fp, def->binding, def->type, indent);
651:
652: /* Validation checks. */
653: /* XXX - validate values in addition to names? */
654:
655: /* Print options, merging ones with the same binding. */
656: fprintf(fp, "%*s\"Options\": [\n", indent, "");
657: indent += 4;
658: for (;;) {
659: next = TAILQ_NEXT(def, entries);
660: /* XXX - need to update cur too */
661: if ((type & T_MASK) == T_FLAG || def->val == NULL) {
662: value.type = JSON_BOOL;
663: value.u.boolean = def->op;
664: print_pair_json(fp, "{ ", def->var, &value, " }", indent);
665: } else if ((type & T_MASK) == T_LIST) {
666: print_defaults_list_json(fp, def, indent);
667: } else {
668: value.type = JSON_STRING;
669: value.u.string = def->val;
670: print_pair_json(fp, "{ ", def->var, &value, " }", indent);
671: }
672: if (next == NULL || def->binding != next->binding)
673: break;
674: def = next;
675: type = get_defaults_type(def);
676: if (type == -1) {
677: warningx(U_("unknown defaults entry `%s'"), def->var);
678: /* XXX - just pass it through as a string anyway? */
679: break;;
680: }
681: fputs(",\n", fp);
682: }
683: putc('\n', fp);
684: indent -= 4;
685: print_indent(fp, indent);
686: fputs("]\n", fp);
687: indent -= 4;
688: print_indent(fp, indent);
689: fprintf(fp, "}%s\n", next != NULL ? "," : "");
690: }
691:
692: /* Close Defaults array; comma (if any) & newline will be printer later. */
693: indent -= 4;
694: print_indent(fp, indent);
695: fputs("]", fp);
696:
697: debug_return_bool(true);
698: }
699:
700: /*
701: * Export all aliases of the specified type in JSON format.
702: * Iterates through the entire aliases tree.
703: */
704: static bool
705: print_aliases_by_type_json(FILE *fp, int alias_type, const char *title,
706: int indent, bool need_comma)
707: {
708: struct json_alias_closure closure;
709: debug_decl(print_aliases_by_type_json, SUDO_DEBUG_UTIL)
710:
711: closure.fp = fp;
712: closure.indent = indent;
713: closure.count = 0;
714: closure.alias_type = alias_type;
715: closure.title = title;
716: closure.need_comma = need_comma;
717: alias_apply(print_alias_json, &closure);
718: if (closure.count != 0) {
719: print_indent(fp, closure.indent);
720: fputs("]\n", fp);
721: closure.indent -= 4;
722: print_indent(fp, closure.indent);
723: putc('}', fp);
724: need_comma = true;
725: }
726:
727: debug_return_bool(need_comma);
728: }
729:
730: /*
731: * Export all aliases in JSON format.
732: */
733: static bool
734: print_aliases_json(FILE *fp, int indent, bool need_comma)
735: {
736: debug_decl(print_aliases_json, SUDO_DEBUG_UTIL)
737:
738: need_comma = print_aliases_by_type_json(fp, USERALIAS, "User_Aliases",
739: indent, need_comma);
740: need_comma = print_aliases_by_type_json(fp, RUNASALIAS, "Runas_Aliases",
741: indent, need_comma);
742: need_comma = print_aliases_by_type_json(fp, HOSTALIAS, "Host_Aliases",
743: indent, need_comma);
744: need_comma = print_aliases_by_type_json(fp, CMNDALIAS, "Command_Aliases",
745: indent, need_comma);
746:
747: debug_return_bool(need_comma);
748: }
749:
750: /* XXX these are all duplicated w/ parse.c */
751: #define RUNAS_CHANGED(cs1, cs2) \
752: (cs1 == NULL || cs2 == NULL || \
753: cs1->runasuserlist != cs2->runasuserlist || \
754: cs1->runasgrouplist != cs2->runasgrouplist)
755:
756: #define TAG_SET(tt) \
757: ((tt) != UNSPEC && (tt) != IMPLIED)
758:
759: #define TAGS_CHANGED(ot, nt) \
760: ((TAG_SET((nt).setenv) && (nt).setenv != (ot).setenv) || \
761: (TAG_SET((nt).noexec) && (nt).noexec != (ot).noexec) || \
762: (TAG_SET((nt).nopasswd) && (nt).nopasswd != (ot).nopasswd) || \
763: (TAG_SET((nt).log_input) && (nt).log_input != (ot).log_input) || \
764: (TAG_SET((nt).log_output) && (nt).log_output != (ot).log_output))
765:
766: /*
767: * Print a Cmnd_Spec in JSON format at the specified indent level.
768: * A pointer to the next Cmnd_Spec is passed in to make it possible to
769: * merge adjacent entries that are identical in all but the command.
770: */
771: static void
772: print_cmndspec_json(FILE *fp, struct cmndspec *cs, struct cmndspec **nextp,
773: int indent)
774: {
775: struct cmndspec *next = *nextp;
776: struct json_value value;
777: struct member *m;
778: bool last_one;
779: debug_decl(print_cmndspec_json, SUDO_DEBUG_UTIL)
780:
781: /* Open Cmnd_Spec object. */
782: fprintf(fp, "%*s{\n", indent, "");
783: indent += 4;
784:
785: /* Print runasuserlist */
786: if (cs->runasuserlist != NULL) {
787: fprintf(fp, "%*s\"runasusers\": [\n", indent, "");
788: indent += 4;
789: TAILQ_FOREACH(m, cs->runasuserlist, entries) {
790: print_member_json(fp, m, TYPE_RUNASUSER,
791: TAILQ_NEXT(m, entries) == NULL, indent);
792: }
793: indent -= 4;
794: fprintf(fp, "%*s],\n", indent, "");
795: }
796:
797: /* Print runasgrouplist */
798: if (cs->runasgrouplist != NULL) {
799: fprintf(fp, "%*s\"runasgroups\": [\n", indent, "");
800: indent += 4;
801: TAILQ_FOREACH(m, cs->runasgrouplist, entries) {
802: print_member_json(fp, m, TYPE_RUNASGROUP,
803: TAILQ_NEXT(m, entries) == NULL, indent);
804: }
805: indent -= 4;
806: fprintf(fp, "%*s],\n", indent, "");
807: }
808:
809: /* Print tags */
810: if (cs->tags.nopasswd != UNSPEC || cs->tags.noexec != UNSPEC ||
811: cs->tags.setenv != UNSPEC || cs->tags.log_input != UNSPEC ||
812: cs->tags.log_output != UNSPEC) {
813: fprintf(fp, "%*s\"Options\": [\n", indent, "");
814: indent += 4;
815: if (cs->tags.nopasswd != UNSPEC) {
816: value.type = JSON_BOOL;
817: value.u.boolean = !cs->tags.nopasswd;
818: last_one = cs->tags.noexec == UNSPEC &&
819: cs->tags.setenv == UNSPEC && cs->tags.log_input == UNSPEC &&
820: cs->tags.log_output == UNSPEC;
821: print_pair_json(fp, "{ ", "authenticate", &value,
822: last_one ? " }\n" : " },\n", indent);
823: }
824: if (cs->tags.noexec != UNSPEC) {
825: value.type = JSON_BOOL;
826: value.u.boolean = cs->tags.noexec;
827: last_one = cs->tags.setenv == UNSPEC &&
828: cs->tags.log_input == UNSPEC && cs->tags.log_output == UNSPEC;
829: print_pair_json(fp, "{ ", "noexec", &value,
830: last_one ? " }\n" : " },\n", indent);
831: }
832: if (cs->tags.setenv != UNSPEC) {
833: value.type = JSON_BOOL;
834: value.u.boolean = cs->tags.setenv;
835: last_one = cs->tags.log_input == UNSPEC &&
836: cs->tags.log_output == UNSPEC;
837: print_pair_json(fp, "{ ", "setenv", &value,
838: last_one ? " }\n" : " },\n", indent);
839: }
840: if (cs->tags.log_input != UNSPEC) {
841: value.type = JSON_BOOL;
842: value.u.boolean = cs->tags.log_input;
843: last_one = cs->tags.log_output == UNSPEC;
844: print_pair_json(fp, "{ ", "log_input", &value,
845: last_one ? " }\n" : " },\n", indent);
846: }
847: if (cs->tags.log_output != UNSPEC) {
848: value.type = JSON_BOOL;
849: value.u.boolean = cs->tags.log_output;
850: print_pair_json(fp, "{ ", "log_output", &value, " }\n", indent);
851: }
852: indent -= 4;
853: fprintf(fp, "%*s],\n", indent, "");
854: }
855:
856: #ifdef HAVE_SELINUX
857: /* Print SELinux role/type */
858: if (cs->role != NULL && cs->type != NULL) {
859: fprintf(fp, "%*s\"SELinux_Spec\": [\n", indent, "");
860: indent += 4;
861: value.type = JSON_STRING;
862: value.u.string = cs->role;
863: print_pair_json(fp, NULL, "role", &value, ",\n", indent);
864: value.u.string = cs->type;
865: print_pair_json(fp, NULL, "type", &value, "\n", indent);
866: indent -= 4;
867: fprintf(fp, "%*s],\n", indent, "");
868: }
869: #endif /* HAVE_SELINUX */
870:
871: #ifdef HAVE_PRIV_SET
872: /* Print Solaris privs/limitprivs */
873: if (cs->privs != NULL || cs->limitprivs != NULL) {
874: fprintf(fp, "%*s\"Solaris_Priv_Spec\": [\n", indent, "");
875: indent += 4;
876: value.type = JSON_STRING;
877: if (cs->privs != NULL) {
878: value.u.string = cs->privs;
879: print_pair_json(fp, NULL, "privs", &value,
880: cs->limitprivs != NULL ? ",\n" : "\n", indent);
881: }
882: if (cs->limitprivs != NULL) {
883: value.u.string = cs->limitprivs;
884: print_pair_json(fp, NULL, "limitprivs", &value, "\n", indent);
885: }
886: indent -= 4;
887: fprintf(fp, "%*s],\n", indent, "");
888: }
889: #endif /* HAVE_PRIV_SET */
890:
891: /*
892: * Merge adjacent commands with matching tags, runas, SELinux
893: * role/type and Solaris priv settings.
894: */
895: fprintf(fp, "%*s\"Commands\": [\n", indent, "");
896: indent += 4;
897: for (;;) {
898: /* Does the next entry differ only in the command itself? */
899: /* XXX - move into a function that returns bool */
900: last_one = next == NULL ||
901: RUNAS_CHANGED(cs, next) || TAGS_CHANGED(cs->tags, next->tags)
902: #ifdef HAVE_PRIV_SET
903: || cs->privs != next->privs || cs->limitprivs != next->limitprivs
904: #endif /* HAVE_PRIV_SET */
905: #ifdef HAVE_SELINUX
906: || cs->role != next->role || cs->type != next->type
907: #endif /* HAVE_SELINUX */
908: ;
909:
910: print_member_json(fp, cs->cmnd, TYPE_COMMAND, last_one, indent);
911: if (last_one)
912: break;
913: cs = next;
914: next = TAILQ_NEXT(cs, entries);
915: }
916: indent -= 4;
917: fprintf(fp, "%*s]\n", indent, "");
918:
919: /* Close Cmnd_Spec object. */
920: indent -= 4;
921: fprintf(fp, "%*s}%s\n", indent, "", TAILQ_NEXT(cs, entries) != NULL ? "," : "");
922:
923: *nextp = next;
924:
925: debug_return;
926: }
927:
928: /*
929: * Print a User_Spec in JSON format at the specified indent level.
930: */
931: static void
932: print_userspec_json(FILE *fp, struct userspec *us, int indent)
933: {
934: struct privilege *priv;
935: struct member *m;
936: struct cmndspec *cs, *next;
937: debug_decl(print_userspec_json, SUDO_DEBUG_UTIL)
938:
939: /*
940: * Each userspec struct may contain multiple privileges for
941: * a user. We export each privilege as a separate User_Spec
942: * object for simplicity's sake.
943: */
944: TAILQ_FOREACH(priv, &us->privileges, entries) {
945: /* Open User_Spec object. */
946: fprintf(fp, "%*s{\n", indent, "");
947: indent += 4;
948:
949: /* Print users list. */
950: fprintf(fp, "%*s\"User_List\": [\n", indent, "");
951: indent += 4;
952: TAILQ_FOREACH(m, &us->users, entries) {
953: print_member_json(fp, m, TYPE_USERNAME,
954: TAILQ_NEXT(m, entries) == NULL, indent);
955: }
956: indent -= 4;
957: fprintf(fp, "%*s],\n", indent, "");
958:
959: /* Print hosts list. */
960: fprintf(fp, "%*s\"Host_List\": [\n", indent, "");
961: indent += 4;
962: TAILQ_FOREACH(m, &priv->hostlist, entries) {
963: print_member_json(fp, m, TYPE_HOSTNAME,
964: TAILQ_NEXT(m, entries) == NULL, indent);
965: }
966: indent -= 4;
967: fprintf(fp, "%*s],\n", indent, "");
968:
969: /* Print commands. */
970: fprintf(fp, "%*s\"Cmnd_Specs\": [\n", indent, "");
971: indent += 4;
972: TAILQ_FOREACH_SAFE(cs, &priv->cmndlist, entries, next) {
973: print_cmndspec_json(fp, cs, &next, indent);
974: }
975: indent -= 4;
976: fprintf(fp, "%*s]\n", indent, "");
977:
978: /* Close User_Spec object. */
979: indent -= 4;
980: fprintf(fp, "%*s}%s\n", indent, "", TAILQ_NEXT(priv, entries) != NULL ||
981: TAILQ_NEXT(us, entries) != NULL ? "," : "");
982: }
983:
984: debug_return;
985: }
986:
987: static bool
988: print_userspecs_json(FILE *fp, int indent, bool need_comma)
989: {
990: struct userspec *us;
991: debug_decl(print_userspecs_json, SUDO_DEBUG_UTIL)
992:
993: if (TAILQ_EMPTY(&userspecs))
994: debug_return_bool(need_comma);
995:
996: fprintf(fp, "%s\n%*s\"User_Specs\": [\n", need_comma ? "," : "", indent, "");
997: indent += 4;
998: TAILQ_FOREACH(us, &userspecs, entries) {
999: print_userspec_json(fp, us, indent);
1000: }
1001: indent -= 4;
1002: fprintf(fp, "%*s]", indent, "");
1003:
1004: debug_return_bool(true);
1005: }
1006:
1007: /*
1008: * Export the parsed sudoers file in JSON format.
1009: * XXX - ignores strict flag and doesn't pass through quiet flag
1010: */
1011: bool
1012: export_sudoers(const char *sudoers_path, const char *export_path,
1013: bool quiet, bool strict)
1014: {
1015: bool ok = false, need_comma = false;
1016: const int indent = 4;
1017: FILE *export_fp = stdout;
1018: debug_decl(export_sudoers, SUDO_DEBUG_UTIL)
1019:
1020: if (strcmp(sudoers_path, "-") == 0) {
1021: sudoersin = stdin;
1022: sudoers_path = "stdin";
1023: } else if ((sudoersin = fopen(sudoers_path, "r")) == NULL) {
1024: if (!quiet)
1025: warning(U_("unable to open %s"), sudoers_path);
1026: goto done;
1027: }
1028: if (strcmp(export_path, "-") != 0) {
1029: if ((export_fp = fopen(export_path, "w")) == NULL) {
1030: if (!quiet)
1031: warning(U_("unable to open %s"), export_path);
1032: goto done;
1033: }
1034: }
1035: init_parser(sudoers_path, quiet);
1036: if (sudoersparse() && !parse_error) {
1037: if (!quiet)
1038: warningx(U_("failed to parse %s file, unknown error"), sudoers_path);
1039: parse_error = true;
1040: errorfile = sudoers_path;
1041: }
1042: ok = !parse_error;
1043:
1044: if (parse_error) {
1045: if (!quiet) {
1046: if (errorlineno != -1)
1047: warningx(_("parse error in %s near line %d\n"),
1048: errorfile, errorlineno);
1049: else if (errorfile != NULL)
1050: warningx(_("parse error in %s\n"), errorfile);
1051: }
1052: goto done;
1053: }
1054:
1055: /* Open JSON output. */
1056: putc('{', export_fp);
1057:
1058: /* Dump Defaults in JSON format. */
1059: need_comma = print_defaults_json(export_fp, indent, need_comma);
1060:
1061: /* Dump Aliases in JSON format. */
1062: need_comma = print_aliases_json(export_fp, indent, need_comma);
1063:
1064: /* Dump User_Specs in JSON format. */
1065: print_userspecs_json(export_fp, indent, need_comma);
1066:
1067: /* Close JSON output. */
1068: fputs("\n}\n", export_fp);
1069:
1070: done:
1071: if (export_fp != stdout)
1072: fclose(export_fp);
1073: debug_return_bool(ok);
1074: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to visudo_json.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers