sudoers parsing not honoring line continuation characters
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 23.6k
- Forks
- 2.6k
- Avg merge
- 6d 7h
- Merged PRs (30d)
- 14
Description
Bug report
What operating system and version are you using?
version = 12.0.1
build = 21A559
platform = darwin
What version of osquery are you using?
version = 5.0.1
What steps did you take to reproduce the issue?
Created a sudoers file with line continuation characters:
User_Alias OTHER_USERS=foo,\
bar,\
baz
User_Alias NUM_USERS=#501,#502
User_Alias ALL_USERS = NUM_USERS,\
OTHER_USERS
Cmnd_Alias CMDS_1=/usr/bin/cmd1 "a\,b", \
/usr/bin/cmd2
ALL_USERS ALL=(ALL)CMDS_1
(this as /etc/sudoers.d/eviltest is enough to validate the problem)
What did you expect to see?
The line continuation characters should be swallowed by the parsing and the rule details for the subsequent lines appear in the rule_details under the appropriate header.
What did you see instead?
The next lines appeared in the header field and the rule_details field was empty, indicating line continuation was not being done.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with the supplied sudoers content in /etc/sudoers.d/eviltest on macOS 12.0.1 using osquery 5.0.1. Inspect the parsed output, especially the header and rule_details fields, and trace the sudoers parser from that result. Done means continuation characters are swallowed and subsequent lines populate rule_details under the appropriate header.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100