sssd: a negative sudoUser entry clears a grant it did not match
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
阅读 plugins/sudoers/sssd.c 第186–230行，特别是第226行的负条目检查，并与 plugins/sudoers/ldap.c 第318–347行中逐条处理 match 的方式进行比较。使用启用了 SSSD 的构建复现列出的 sudoUser: alice, !bob 情况，并检查 sudo -l 的结果；完成标准是，无关的负条目不再清除 Alice 的授权，而匹配的负条目仍会拒绝该用户。
由索引模型根据 Issue 内容生成。
描述
Summary
sudo_sss_check_user() walks the sudoUser list and maintains a single boolean that it treats as "this entry matched" at the point where negative entries are evaluated. The boolean is not per-entry: it is set by any positive match and never reset for the following entries. A rule such as alice, !bob therefore rejects alice, because the unmatched !bob entry is evaluated against the grant that alice had already produced.
Affected code: plugins/sudoers/sssd.c:186–230, specifically the negative-entry test at line 226. Unchanged in current master 3595b1527db3122616dea2568e0c5f86a328f8eb.
Reachable rejection sequence
- sudo is built
--with-sssdandnsswitch.confcontainssudoers: files sss. - A sudoRole carries
sudoUser: alice, !bob, and the role grants at least one command. alicerunssudo -l.sudoers_lookup()reachessudo_nss_sss.query(), which parses the role and callssudo_sss_check_user().- The first entry matches
alice, soretbecomes true at line 210 and the loop continues because the entry is notSPECIFIED(user_matched). - The second entry is negative and does not match
alice. Line 226 testsret && negated—retis still true from step 4 — so the grant is cleared and the loop breaks. - The role is discarded.
sudo -lreports that alice is not allowed to run sudo.
Reordering the list to !bob, alice restores the intended result, which shows the outcome depends on list order rather than on membership.
The direction is fail-closed: the affected user loses privileges they were granted, and no user gains privileges they were not. It requires a role whose positive entries precede an unrelated negative entry, so a role using only positive entries, or only negative ones, is unaffected. plugins/sudoers/ldap.c:318–347 performs the same evaluation with a per-entry match variable and does not have this behaviour.
This commit range is relevant: 00c60751 ("Fix evaluation of negative entries in sudoUser", 2026-01-25) removed !ret from the loop condition at line 190 but did not introduce a per-entry flag, so before that commit the negative entries were never evaluated at all and after it they are evaluated against the wrong state.
Suggested fix
Track whether the current entry matched, locally, and use that for the negative test. The rest of the loop can keep using the cumulative flag for its existing purposes.
for (i = 0; val_array[i] != NULL; ++i) {
bool matched = false;
...
if (/* this entry matches */) {
matched = true;
ret = true;
...
}
if (matched && negated) { /* was: if (ret && negated) */
ret = false;
break;
}
}
- 主要语言
- C
- 星标
- 1.7k
- 派生
- 306
- 平均合并
- 1 天 8 小时
- 30 天内合并 PR
- 24
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
sudo-project/sudo 的其他 Issue
-
难度 4/5 3-5 天 新手友好度 42/100
sudo-project/sudo#583 ·
维护者通常 1 天内回复
-
Signal forwarded to the command is lost when it arrives between fork() and execve() of the command未关闭
难度 4/5 3-5 天 新手友好度 35/100
sudo-project/sudo#566 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 52/100
sudo-project/sudo#553 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 48/100
sudo-project/sudo#552 ·
维护者通常 1 天内回复
-
Documentation text overflows container instead of wrapping可能重新可做 @BittuBarnwal7479 于 131 天前认领，目前没有进行中的 PR。 未关闭
难度 2/5 1-3 小时 新手友好度 58/100
sudo-project/sudo#547 · 1 条评论 ·
维护者通常 1 天内回复
查看 sudo-project/sudo 的全部 Issue
相似的 Issue
-
vim.filetype.match() prefixes a URL buffer name with the cwd before passing it to filetype functions未关闭
难度 2/5 1-3 小时 新手友好度 73/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
COVESA/dlt-daemon#925 · 1 个 reaction ·
-
stream_curl: retry_count never resets after a successful reconnect, so long sequential streams die after 5 drops可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 70/100
mpv-player/mpv#18728 ·
维护者通常 1 天内回复
-
followup Prio 📌
难度 2/5 1-3 小时 新手友好度 66/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
cyrusimap/cyrus-imapd#6640 ·
维护者通常 2 天内回复