kov changed libgksu/trunk/libgksu/libgksu.c
Gustavo Noronha
kov at alioth.debian.org
Wed Jun 17 16:51:28 UTC 2009
Mensagem de log:
Make sudo also use forkpty, patch by Joshua Kwan <jkwan at vmware.com>
-----
Modified: libgksu/trunk/libgksu/libgksu.c
===================================================================
--- libgksu/trunk/libgksu/libgksu.c 2009-06-17 16:40:10 UTC (rev 862)
+++ libgksu/trunk/libgksu/libgksu.c 2009-06-17 16:51:28 UTC (rev 863)
@@ -2006,6 +2006,8 @@
for (i = 0 ; cmd[i] != NULL ; i++)
g_free (cmd[i]);
g_free(cmd);
+
+ _exit(1);
}
else if (pid == -1)
{
@@ -2466,6 +2468,12 @@
{
char **cmd;
char buffer[256] = {0};
+ char *child_stderr = NULL;
+ /* This command is used to gain a token */
+ char *const verifycmd[] =
+ {
+ "/usr/bin/sudo", "-p", "GNOME_SUDO_PASS", "-v", NULL
+ };
int argcount = 8;
int i, j;
@@ -2476,9 +2484,8 @@
pid_t pid;
int status;
- FILE *infile, *outfile;
- int parent_pipe[2]; /* For talking to the parent */
- int child_pipe[2]; /* For talking to the child */
+ FILE *fdfile = NULL;
+ int fdpty = -1;
context->sudo_mode = TRUE;
@@ -2553,6 +2560,10 @@
cmd[argcount] = g_strdup("-S");
argcount++;
+ /* Make sudo noninteractive (we should already have a token) */
+ cmd[argcount] = g_strdup("-n");
+ argcount++;
+
/* Make sudo use next arg as prompt */
cmd[argcount] = g_strdup("-p");
argcount++;
@@ -2631,26 +2642,21 @@
fprintf (stderr, "cmd[%d]: %s\n", i, cmd[i]);
}
- if ((pipe(parent_pipe)) == -1)
+ pid = forkpty(&fdpty, NULL, NULL, NULL);
+ if (pid == 0)
{
- g_set_error (error, gksu_quark, GKSU_ERROR_PIPE,
- _("Error creating pipe: %s"),
- strerror(errno));
- sudo_reset_xauth (context, xauth, xauth_env);
- return FALSE;
- }
+ // Child
+ setsid(); // make us session leader
- if ((pipe(child_pipe)) == -1)
- {
- g_set_error (error, gksu_quark, GKSU_ERROR_PIPE,
- _("Error creating pipe: %s"),
+ execv(verifycmd[0], verifycmd);
+
+ g_set_error (error, gksu_quark, GKSU_ERROR_EXEC,
+ _("Failed to exec new process: %s"),
strerror(errno));
sudo_reset_xauth (context, xauth, xauth_env);
return FALSE;
}
-
- pid = fork();
- if (pid == -1)
+ else if (pid == -1)
{
g_set_error (error, gksu_quark, GKSU_ERROR_FORK,
_("Failed to fork new process: %s"),
@@ -2658,57 +2664,27 @@
sudo_reset_xauth (context, xauth, xauth_env);
return FALSE;
}
- else if (pid == 0)
- {
- // Child
- setsid(); // make us session leader
- close(child_pipe[1]);
- dup2(child_pipe[0], STDIN_FILENO);
- dup2(parent_pipe[1], STDERR_FILENO);
- execv(cmd[0], cmd);
-
- g_set_error (error, gksu_quark, GKSU_ERROR_EXEC,
- _("Failed to exec new process: %s"),
- strerror(errno));
- sudo_reset_xauth (context, xauth, xauth_env);
- return FALSE;
- }
else
{
gint counter = 0;
gchar *cmdline = NULL;
+ struct termios tio;
// Parent
- close(parent_pipe[1]);
+ fdfile = fdopen(fdpty, "w+");
- infile = fdopen(parent_pipe[0], "r");
- if (!infile)
- {
- g_set_error (error, gksu_quark, GKSU_ERROR_PIPE,
- _("Error opening pipe: %s"),
- strerror(errno));
- sudo_reset_xauth (context, xauth, xauth_env);
- return FALSE;
- }
+ /* make sure we notice that ECHO is turned off, if it gets
+ turned off */
+ tcgetattr (fdpty, &tio);
+ for (counter = 0; (tio.c_lflag & ECHO) && counter < 15; counter++)
+ {
+ usleep (1000);
+ tcgetattr (fdpty, &tio);
+ }
- outfile = fdopen(child_pipe[1], "w");
- if (!outfile)
- {
- g_set_error (error, gksu_quark, GKSU_ERROR_PIPE,
- _("Error opening pipe: %s"),
- strerror(errno));
- sudo_reset_xauth (context, xauth, xauth_env);
- return FALSE;
- }
+ fcntl (fdpty, F_SETFL, O_NONBLOCK);
- /*
- we are expecting to receive a GNOME_SUDO_PASS
- if we don't there are two possibilities: an error
- or a password is not needed
- */
- fcntl (parent_pipe[0], F_SETFL, O_NONBLOCK);
-
{ /* no matter if we can read, since we're using
O_NONBLOCK; this is just to avoid the prompt
showing up after the read */
@@ -2716,11 +2692,11 @@
struct timeval tv;
FD_ZERO(&rfds);
- FD_SET(parent_pipe[0], &rfds);
+ FD_SET(fdpty, &rfds);
tv.tv_sec = 1;
tv.tv_usec = 0;
- select (parent_pipe[0] + 1, &rfds, NULL, NULL, &tv);
+ select (fdpty + 1, &rfds, NULL, NULL, &tv);
}
/* Try hard to find the prompt; it may happen that we're
@@ -2732,7 +2708,7 @@
if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0)
break;
- read_line (parent_pipe[0], buffer, 256);
+ read_line (fdpty, buffer, 256);
if (context->debug)
fprintf (stderr, "buffer: -%s-\n", buffer);
@@ -2766,18 +2742,17 @@
usleep (1000);
- fprintf (outfile, "%s\n", password);
- fclose (outfile);
+ write (fdpty, password, strlen(password) + 1);
+ write (fdpty, "\n", 1);
nullify_password (password);
- /* turn NONBLOCK off */
- fcntl(parent_pipe[0], F_SETFL, fcntl(parent_pipe[0], F_GETFL) & ~O_NONBLOCK);
+ fcntl(fdpty, F_SETFL, fcntl(fdpty, F_GETFL) & ~O_NONBLOCK);
/* ignore the first newline that comes right after sudo receives
the password */
- fgets (buffer, 255, infile);
- /* this is the status we are interessted in */
- fgets (buffer, 255, infile);
+ fgets (buffer, 255, fdfile);
+ /* this is the status we are interested in */
+ fgets (buffer, 255, fdfile);
}
else
{
@@ -2786,7 +2761,7 @@
fprintf (stderr, "No password prompt found; we'll assume we don't need a password.\n");
/* turn NONBLOCK off, also if have no prompt */
- fcntl(parent_pipe[0], F_SETFL, fcntl(parent_pipe[0], F_GETFL) & ~O_NONBLOCK);
+ fcntl(fdpty, F_SETFL, fcntl(fdpty, F_GETFL) & ~O_NONBLOCK);
should_display = gconf_client_get_bool (context->gconf_client,
BASE_PATH "display-no-pass-info", NULL);
@@ -2805,14 +2780,9 @@
fprintf (stderr, "%s", buffer);
}
- if (!strcmp (buffer, "Sorry, try again.\n"))
+ if (g_str_has_prefix (buffer, "Sorry, try again."))
g_set_error (error, gksu_quark, GKSU_ERROR_WRONGPASS,
_("Wrong password."));
- else if (!strncmp (buffer, "Sorry, user ", 12))
- g_set_error (error, gksu_quark, GKSU_ERROR_NOT_ALLOWED,
- _("The underlying authorization mechanism (sudo) "
- "does not allow you to run this program. Contact "
- "the system administrator."));
else
{
gchar *haystack = buffer;
@@ -2830,6 +2800,10 @@
}
}
+ /* If we have an error, let's just stop sudo right there. */
+ if (error)
+ close(fdpty);
+
cmdline = g_strdup("sudo");
/* wait for the child process to end or become something other
than sudo */
@@ -2846,17 +2820,23 @@
if (context->sn_context)
gksu_context_launch_complete (context);
- while (read (parent_pipe[0], buffer, 255) > 0)
- {
- fprintf (stderr, "%s", buffer);
- bzero(buffer, 256);
- }
-
/* if the process is still active waitpid() on it */
if (pid_exited != pid)
waitpid(pid, &status, 0);
sudo_reset_xauth (context, xauth, xauth_env);
+ /*
+ * Did token acquisition succeed? If so, spawn sudo in
+ * non-interactive mode. It should either succeed or die
+ * immediately if you're not allowed to run the command.
+ */
+ if (WEXITSTATUS(status) == 0)
+ {
+ g_spawn_sync(NULL, cmd, NULL, 0, NULL, NULL,
+ NULL, &child_stderr, &status,
+ error);
+ }
+
if (exit_status)
{
if (WIFEXITED(status)) {
@@ -2868,6 +2848,14 @@
if (WEXITSTATUS(status))
{
+ if (g_str_has_prefix(child_stderr, "Sorry, user "))
+ {
+ g_set_error (error, gksu_quark, GKSU_ERROR_NOT_ALLOWED,
+ _("The underlying authorization mechanism (sudo) "
+ "does not allow you to run this program. Contact "
+ "the system administrator."));
+ }
+ g_free(child_stderr);
if(cmdline)
{
/* sudo already exec()ed something else, don't report
@@ -2888,11 +2876,10 @@
}
}
- /* if error is set we have found an error condition */
- if (error)
- return FALSE;
+ g_free(child_stderr);
- return TRUE;
+ /* if error is set we have found an error condition */
+ return (error == NULL);
}
/**
More information about the gksu-commits
mailing list