1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
|
TODO list (most will be addressed in sudo 2.0)
01) Redo parsing to be more like op(8) with true command aliases where
can specify uid, gid(s) and part/all of the environment.
02) Add a SHELLS reserved word that checks against /etc/shells.
03) Make the sudoers file accessible via NIS, NIS+.
04) Add a -h (?) flag to sudo for a history mechanism.
05) Add Prog_Alias facility (Prog_Alias VI = /usr/secure/bin/vi +args).
06) Add generic STREAMS support for getting interfaces and netmasks.
07) Add support for "safe scripts" by checking for shell script
cookie (first two bytes are "#!") and execing the shell outselves
after doing the stat to guard against spoofing. This should avoid
the race condition caused by going through namei() twice...
08) Should be able to mix Cmnd_Alias's and command args. Ie:
pete ALL=PASSWD [A-z]*,!PASSWD root
where PASSWD was defined to be /usr/bin/passwd.
This requires the arg parsing to happen in the yacc grammer.
At the very least, commands and args have to become separate
tokens in the lexer.
09) Add a per-tty restriction? Ie: only can run foo from /dev/console.
10) Add test for how to read ether interfaces in configure script
11) Use strtol() and strtoul(), not atoi()
12) Implement date_format and log_format options.
13) Add support for: Default:user@host
14) Some people want to be able to specify a special password in sudoers
in addition or instead of the normal one. The best argument for
this so far is to be able to use separate passwords for the
target users that are not the passwd file ones.
15) Add support for trusted users. E.g. allow user to run a certain
command regardless of what dir it is in if it is owned by the
trusted user.
16) Add a flag similar to '-l' but that spits out sudo commands in
a format suitable for cut & paste into sudoers.
17) Someone wants a recursive version of the dir specifier. Ie:
SOME_MODIFIER:/usr/local/ to allow anything under /usr/local to be run.
18) An option to set the shell to the target user would make sense.
See other target user-related issues above.
19) Add an option (-D) to dump the defaults after the sudoers file
has been parsed. Should only be available to root and should
allow a -u user modifier. Maybe dump all of sudoers?
20) Allow /etc/sudoers to be a symlink but require the parent dir to
be root-owned and not writable by anything else. Should really
traverse the tree to the root doing this.
21) Improve interfaces.c STREAMS code (see ntpd's ntp_io.c for hints)
22) If root_sudo is off, still allow sudo -u to non-root users?
23) For AIX, use setpenv() and setpcred() if they exist
http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/libs/basetrf2/setpenv.htm
http://publib16.boulder.ibm.com/pseries/en_US/libs/basetrf2/setpcred.htm
24) Add an insult_path variable that is intialized to "builtin" but that
can point to other files containing an insult count as the first
line and that have a constant record length (sparse files) for
easy seeking.
25) Some way of using a new pty for the program run via sudo would prevent
access to the caller's /dev/tty (but probably makes job control tricky).
26) Maybe have a database of checksums that commands are verified against.
Basically replace the st_ino/st_dev check with a checksum lookup.
27) Look into testing writability of a file via sudoedit *before* doing
the edit; e.g., try opening with O_APPEND.
28) Add Makefile.in bits to autogenerate Solaris and Irix packages
29) Use pam_open_session() and pam_close_session() (requires a persistent
sudo process to call pam_close_session()). Maybe add xauth support for
the non-pam case?
30) Add substitution mechanism in sudoers to subst, e.g. editors for sudoedit
31) Move prototypes to extern.h?
32) Use AC_CHECK_DECLS for systems w/o proper prototypes? Maybe errno too?
33) Flesh out testsudoers and fix glob/opendir issues. Use custom netgroup
code too?
34) Think some more about giving admins a way to test commands for a user
on a specific host with a different sudoers file.
35) Refactor duplicated code in ldap.c into wrapper functions.
36) Return command from command_matches() instead of setting safe_cmnd directly.
37) Roll visudo into sudo ala sudoedit?
38) Add ticket file to ticket dir in non-tty tickets case so we
can mix tty and non-tty ticket schemes.
39) Add support for NOEXEC w/ 64-bit AIX executables.
http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.xlf91a.doc/xlfug/comp64.htm
Note that it is possible to create shared libs w/ both 32bit and 64bit
objects.
40) Revisit debian fqdn diffs.
41) Add gettext() support. Can borrow some translations from PAM.
42) Convert the other capitalized files into .pod so we can get decent html
form them? E.g. README, etc. E.g.
pod2text -l -i0 history.pod > HISTORY
pod2html --noindex history.pod > history.html
43) Use mkstemp() for visudo temp files? Also re-examine locking.
44) Consolidate line wrap code.
45) How can we distinguish between a bare '\\' and one that is escaping
glob chars? Right now we convert \\ -> \ in the lexer which
causes the confusion.
46) For LDAP entries, should be able to parse the per-command options
since they may affect the outcome (e.g. default_runas).
47) Set usrinfo for AIX, see openssh.
48) Consider adding -d (debug) flag for both LDAP and files sudoers lookups.
Is it safe to allow normal users to use it?
49) Why does testsudoers give wrong line number for parse error?
50) Should send mail if sudoers does not parse
51) Add arg markup to indicate that an arg is a path and treat it specially
regarding cwd.
52) Should -k/-K clear *all* timestamps in tty_ticket mode?
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=306919
Perhaps change the meaning of -k vs. -K in 1.7.
53) Dan says Pam activity should probably be happening after
setkeycreatecon and setexeccon (which may use the keyring or
run external commands). However, this means sendmail
will be executed w/ the new context if user is denied.
54) Add report program (or mode) to print out all permissions on a
per-user basis. Would also be nice to have a diff facility given
two sudoers files.
55) Add rpm spec file that works on suse and redhat
56) Store configure args in sudo binary for -V
Make -V operate in verbose mode with -VV instead of as root?
57) Verify consumers of *list_matches do not treat UNSPEC as true
58) Add FOO=BAR env settings to sudoers. Also m/regexp/ where '/' can be
any char.
59) Consider a more fine-grained setenv option. Perhaps have setenv
and setenv_all where the latter lets you override the blacklist?
Maybe just make it clear that setenv allows the user to run
anything.
60) Merge in Linux audit support but use AUDIT_EXECVE instead of AUDIT_USER_CMD
61) Add setenv_all and SETENV_ALL?
63) Expand prompt early and set def_prompt in pam_init() so that
session modules that prompt can use it.
64) Should sudo remove KRB5CCNAME from the env?
It was added to the keep list for password lookups that use GSSAPI.
Probably best to remove it from the env before exec.
65) See http://iase.disa.mil/stigs/whitepaper/sudowhitepaper-042304.doc
66) Add a session mode where sudo allocates a pty and logs everything
that occurs ala script(1). Logs should be replayable via
scriptreplay.pl. See linux script's -t option for timing info.
|
