sudo-rs 0.2.13

A memory safe implementation of sudo and su.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

use super::super::cli::SudoEditOptions;
use crate::common::{Context, DisplayOsStr, Error};
use crate::log::{user_error, user_info};
use crate::sudoers::Authorization;
use crate::system::audit;

pub fn run_edit(edit_opts: SudoEditOptions) -> Result<(), Error> {
    let policy = super::read_sudoers()?;

    let context = Context::from_edit_opts(edit_opts)?;

    let policy = super::judge(policy, &context)?;

    let Authorization::Allowed(auth, _controls) = policy.authorization() else {
        return Err(Error::Authorization(context.current_user.name.to_string()));
    };

    let mut pam_context = super::auth_and_update_record_file(&context, auth)?;

    let mut opened_files = Vec::with_capacity(context.files_to_edit.len());
    for (path, arg) in context.files_to_edit.iter().zip(&context.command.arguments) {
        if let Some(path) = path {
            match audit::secure_open_for_sudoedit(
                path,
                &context.current_user,
                &context.target_user,
                &context.target_group,
            ) {
                Ok(file) => opened_files.push((path, file)),
                // ErrorKind::FilesystemLoop was only stabilized in 1.83
                Err(error) if error.raw_os_error() == Some(libc::ELOOP) => {
                    user_error!(
                        "{path}: editing symbolic links is not permitted",
                        path = DisplayOsStr(arg),
                    )
                }
                Err(error) => {
                    user_error!(
                        "error opening {path}: {error}",
                        path = DisplayOsStr(arg),
                        error = error,
                    )
                }
            }
        } else {
            user_error!("invalid path: {path}", path = DisplayOsStr(arg));
        }
    }

    if opened_files.len() != context.files_to_edit.len() {
        user_info!("please address the problems and try again");
        return Err(Error::Silent);
    }

    // run command and return corresponding exit code
    let command_exit_reason = {
        super::log_command_execution(&context);

        let editor = policy.preferred_editor();

        crate::sudo::edit::edit_files(editor, opened_files)
    };

    pam_context.close_session();

    match command_exit_reason?.exit_process()? {}
}