sudo_plugin.h 7.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198
  1. /*
  2. * Copyright (c) 2009-2016 Todd C. Miller <Todd.Miller@courtesan.com>
  3. *
  4. * Permission to use, copy, modify, and distribute this software for any
  5. * purpose with or without fee is hereby granted, provided that the above
  6. * copyright notice and this permission notice appear in all copies.
  7. *
  8. * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  9. * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10. * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11. * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12. * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13. * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14. * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15. */
  16. #ifndef SUDO_PLUGIN_H
  17. #define SUDO_PLUGIN_H
  18. /* API version major/minor */
  19. #define SUDO_API_VERSION_MAJOR 1
  20. #define SUDO_API_VERSION_MINOR 9
  21. #define SUDO_API_MKVERSION(x, y) (((x) << 16) | (y))
  22. #define SUDO_API_VERSION SUDO_API_MKVERSION(SUDO_API_VERSION_MAJOR, SUDO_API_VERSION_MINOR)
  23. /* Getters and setters for plugin API versions */
  24. #define SUDO_API_VERSION_GET_MAJOR(v) ((v) >> 16)
  25. #define SUDO_API_VERSION_GET_MINOR(v) ((v) & 0xffffU)
  26. #define SUDO_API_VERSION_SET_MAJOR(vp, n) do { \
  27. *(vp) = (*(vp) & 0x0000ffffU) | ((n) << 16); \
  28. } while(0)
  29. #define SUDO_API_VERSION_SET_MINOR(vp, n) do { \
  30. *(vp) = (*(vp) & 0xffff0000U) | (n); \
  31. } while(0)
  32. /* Conversation function types and defines */
  33. struct sudo_conv_message {
  34. #define SUDO_CONV_PROMPT_ECHO_OFF 0x0001 /* do not echo user input */
  35. #define SUDO_CONV_PROMPT_ECHO_ON 0x0002 /* echo user input */
  36. #define SUDO_CONV_ERROR_MSG 0x0003 /* error message */
  37. #define SUDO_CONV_INFO_MSG 0x0004 /* informational message */
  38. #define SUDO_CONV_PROMPT_MASK 0x0005 /* mask user input */
  39. #define SUDO_CONV_PROMPT_ECHO_OK 0x1000 /* flag: allow echo if no tty */
  40. int msg_type;
  41. int timeout;
  42. const char *msg;
  43. };
  44. /*
  45. * Maximum length of a reply (not including the trailing NUL) when
  46. * conversing with the user. In practical terms, this is the longest
  47. * password sudo will support. This means that a buffer of size
  48. * SUDO_CONV_REPL_MAX+1 is guaranteed to be able to hold any reply
  49. * from the conversation function. It is also useful as a max value
  50. * for memset_s() when clearing passwords returned by the conversation
  51. * function.
  52. */
  53. #define SUDO_CONV_REPL_MAX 255
  54. struct sudo_conv_reply {
  55. char *reply;
  56. };
  57. /* Conversation callback API version major/minor */
  58. #define SUDO_CONV_CALLBACK_VERSION_MAJOR 1
  59. #define SUDO_CONV_CALLBACK_VERSION_MINOR 0
  60. #define SUDO_CONV_CALLBACK_VERSION SUDO_API_MKVERSION(SUDO_CONV_CALLBACK_VERSION_MAJOR, SUDO_CONV_CALLBACK_VERSION_MINOR)
  61. /*
  62. * Callback struct to be passed to the conversation function.
  63. * Can be used to perform operations on suspend/resume such
  64. * as dropping/acquiring locks.
  65. */
  66. typedef int (*sudo_conv_callback_fn_t)(int signo, void *closure);
  67. struct sudo_conv_callback {
  68. unsigned int version;
  69. void *closure;
  70. sudo_conv_callback_fn_t on_suspend;
  71. sudo_conv_callback_fn_t on_resume;
  72. };
  73. typedef int (*sudo_conv_t)(int num_msgs, const struct sudo_conv_message msgs[],
  74. struct sudo_conv_reply replies[], struct sudo_conv_callback *callback);
  75. typedef int (*sudo_printf_t)(int msg_type, const char *fmt, ...);
  76. /*
  77. * Hooks allow a plugin to hook into specific sudo and/or libc functions.
  78. */
  79. /* Hook functions typedefs. */
  80. typedef int (*sudo_hook_fn_t)();
  81. typedef int (*sudo_hook_fn_setenv_t)(const char *name, const char *value, int overwrite, void *closure);
  82. typedef int (*sudo_hook_fn_putenv_t)(char *string, void *closure);
  83. typedef int (*sudo_hook_fn_getenv_t)(const char *name, char **value, void *closure);
  84. typedef int (*sudo_hook_fn_unsetenv_t)(const char *name, void *closure);
  85. /* Hook structure definition. */
  86. struct sudo_hook {
  87. unsigned int hook_version;
  88. unsigned int hook_type;
  89. sudo_hook_fn_t hook_fn;
  90. void *closure;
  91. };
  92. /* Hook API version major/minor */
  93. #define SUDO_HOOK_VERSION_MAJOR 1
  94. #define SUDO_HOOK_VERSION_MINOR 0
  95. #define SUDO_HOOK_VERSION SUDO_API_MKVERSION(SUDO_HOOK_VERSION_MAJOR, SUDO_HOOK_VERSION_MINOR)
  96. /*
  97. * Hook function return values.
  98. */
  99. #define SUDO_HOOK_RET_ERROR -1 /* error */
  100. #define SUDO_HOOK_RET_NEXT 0 /* go to the next hook in the list */
  101. #define SUDO_HOOK_RET_STOP 1 /* stop hook processing for this type */
  102. /*
  103. * Hooks for setenv/unsetenv/putenv/getenv.
  104. * This allows the plugin to be notified when a PAM module modifies
  105. * the environment so it can update the copy of the environment that
  106. * is passed to execve().
  107. */
  108. #define SUDO_HOOK_SETENV 1
  109. #define SUDO_HOOK_UNSETENV 2
  110. #define SUDO_HOOK_PUTENV 3
  111. #define SUDO_HOOK_GETENV 4
  112. /* Policy plugin type and defines */
  113. struct passwd;
  114. struct policy_plugin {
  115. #define SUDO_POLICY_PLUGIN 1
  116. unsigned int type; /* always SUDO_POLICY_PLUGIN */
  117. unsigned int version; /* always SUDO_API_VERSION */
  118. int (*open)(unsigned int version, sudo_conv_t conversation,
  119. sudo_printf_t sudo_printf, char * const settings[],
  120. char * const user_info[], char * const user_env[],
  121. char * const plugin_plugins[]);
  122. void (*close)(int exit_status, int error); /* wait status or error */
  123. int (*show_version)(int verbose);
  124. int (*check_policy)(int argc, char * const argv[],
  125. char *env_add[], char **command_info[],
  126. char **argv_out[], char **user_env_out[]);
  127. int (*list)(int argc, char * const argv[], int verbose,
  128. const char *list_user);
  129. int (*validate)(void);
  130. void (*invalidate)(int remove);
  131. int (*init_session)(struct passwd *pwd, char **user_env_out[]);
  132. void (*register_hooks)(int version, int (*register_hook)(struct sudo_hook *hook));
  133. void (*deregister_hooks)(int version, int (*deregister_hook)(struct sudo_hook *hook));
  134. };
  135. /* I/O plugin type and defines */
  136. struct io_plugin {
  137. #define SUDO_IO_PLUGIN 2
  138. unsigned int type; /* always SUDO_IO_PLUGIN */
  139. unsigned int version; /* always SUDO_API_VERSION */
  140. int (*open)(unsigned int version, sudo_conv_t conversation,
  141. sudo_printf_t sudo_printf, char * const settings[],
  142. char * const user_info[], char * const command_info[],
  143. int argc, char * const argv[], char * const user_env[],
  144. char * const plugin_plugins[]);
  145. void (*close)(int exit_status, int error); /* wait status or error */
  146. int (*show_version)(int verbose);
  147. int (*log_ttyin)(const char *buf, unsigned int len);
  148. int (*log_ttyout)(const char *buf, unsigned int len);
  149. int (*log_stdin)(const char *buf, unsigned int len);
  150. int (*log_stdout)(const char *buf, unsigned int len);
  151. int (*log_stderr)(const char *buf, unsigned int len);
  152. void (*register_hooks)(int version, int (*register_hook)(struct sudo_hook *hook));
  153. void (*deregister_hooks)(int version, int (*deregister_hook)(struct sudo_hook *hook));
  154. };
  155. /* Sudoers group plugin version major/minor */
  156. #define GROUP_API_VERSION_MAJOR 1
  157. #define GROUP_API_VERSION_MINOR 0
  158. #define GROUP_API_VERSION SUDO_API_MKVERSION(GROUP_API_VERSION_MAJOR, GROUP_API_VERSION_MINOR)
  159. /* Getters and setters for group version (for source compat only) */
  160. #define GROUP_API_VERSION_GET_MAJOR(v) SUDO_API_VERSION_GET_MAJOR(v)
  161. #define GROUP_API_VERSION_GET_MINOR(v) SUDO_API_VERSION_GET_MINOR(v)
  162. #define GROUP_API_VERSION_SET_MAJOR(vp, n) SUDO_API_VERSION_SET_MAJOR(vp, n)
  163. #define GROUP_API_VERSION_SET_MINOR(vp, n) SUDO_API_VERSION_SET_MINOR(vp, n)
  164. /*
  165. * version: for compatibility checking
  166. * group_init: return 1 on success, 0 if unconfigured, -1 on error.
  167. * group_cleanup: called to clean up resources used by provider
  168. * user_in_group: returns 1 if user is in group, 0 if not.
  169. * note that pwd may be NULL if the user is not in passwd.
  170. */
  171. struct sudoers_group_plugin {
  172. unsigned int version;
  173. int (*init)(int version, sudo_printf_t sudo_printf, char *const argv[]);
  174. void (*cleanup)(void);
  175. int (*query)(const char *user, const char *group, const struct passwd *pwd);
  176. };
  177. #endif /* SUDO_PLUGIN_H */