sudo-rs

sudo-rs copied to clipboard

Cargo says libc::close_range doesn't exist... and looking at the libc crate docs it's only available on -linux-gnu 👀 Possibly related https://github.com/trifectatechfoundation/sudo-rs/issues/1068

theoparis

This has the advantage that the actual source location of the failing command is shown, which is especially useful when multiple a test runs multiple commands. In addition the panic...

bjorn3

Fixes https://github.com/trifectatechfoundation/sudo-rs/issues/1080

bjorn3

Fix the compliance tests on Ubuntu

2

See the individual commits what needed to be changed.

bjorn3

Verify that compliance tests work on Ubuntu

1

squell

Implement support for NOEXEC

9

This is using seccomp syscall filtering of the execve and execveat syscalls. Unlike the original sudo this does not depend on using LD_PRELOAD. Instead SECCOMP_RET_USER_NOTIF is used combined with a...

bjorn3

Several compliance tests have something like ``` assert_not_contains!(stdout, "[sudo] password for"); ``` And obviously sudo-rs output does not contain that. We should probably rewrite that or remove those asserts.

squell

Compliance test failure with og sudo 1.9.16p1

1

This is the sudo version that will be in Debian Trixie. ``` ---- sudo::pam::env::default_and_override_pam_env_vars_are_parentheses_checked_but_set_vars_are_not stdout ---- Error: "program failed with exit code 1. stderr:\nsudo: pam_open_session: Critical error - immediate abort\nsudo:...

bjorn3

FreeBSD doesn't support seccomp, so this will have to load a dylib using LD_PRELOAD that overrides all the various exec* symbols that exist on FreeBSD.

bjorn3

See PR #1073; this requires rust 1.77. At the time of writing we could only bump or MSRV to 1.75 since Ubuntu LTS is on that.

squell