Small fix for line continuation characters

[XakV]

I can't take credit for this, a co-worker helped me solve it and suggested this fix.

Problem: Sometimes the line-continuance character \ is parsed as a sudoers command.

Given this line in a sudoers file...

neko ALL=(root) NOPASSWD: REPAIRDISK, /bin/mount, /bin/umount, /usr/bin/iotop, /usr/sbin/lsof, /usr/sbin/iotop, /bin/cat /var/log/messages, \
                          /some/path/to/a/command/somewhere/that/i_want_to_run.sh

The scan_sudoers.py plugin parses the entry as:

{
   "commands": [
      "REPAIRDISK",
      "/bin/mount",
      "/bin/umount",
      "/usr/bin/iotop",
      "/usr/sbin/lsof",
      "/usr/sbin/iotop",
      "/bin/cat /var/log/messages",
      "\\"
    ],
    "hosts": [
       "ALL"
    ],
    "operators": [
       "root"
    ],
    "tags": [
       "NOPASSWD"
    ],
    "users": [
       "neko"
    ]
},

Which completely skips the wrapped line.

The suggested fix we came up with is in the def get_config_lines(path, params): function.

Just before iterating through the all_lines read from the sudoers file ( ~ line 223 ) we suggest "unfolding" wrapped lines with re.sub like this...

    # "Unfold" lines with a continuance character '\' followed by 0 or more spaces or tabs
    # a newline '\' and again 0 or more spaces or tabs.
    unfolded_lines = re.sub(r'\\\s*\n\s*', '', all_lines)
    # Work on each line of sudoers file
    for sline in unfolded_lines.strip().split("\n"):
        line = sline.replace("\n", "").replace(
            "\t", "    "
        )  # cleaning up chars we don't want

[XakV]

Now the output looks like

{
   "commands": [
      "REPAIRDISK",
      "/bin/mount",
      "/bin/umount",
      "/usr/bin/iotop",
      "/usr/sbin/lsof",
      "/usr/sbin/iotop",
      "/bin/cat /var/log/messages",
      "/some/path/to/a/command/somewhere/that/i_want_to_run.sh"
    ],
    "hosts": [
       "ALL"
    ],
    "operators": [
       "root"
    ],
    "tags": [
       "NOPASSWD"
    ],
    "users": [
       "neko"
    ]
},

[richm]

@XakV #122

Note that my fix is a little different

all_lines = re.sub(r"(?<!\\)\\\n", "", all_lines)

The sudoers spec doesn't say anything about removing leading and trailing spaces. Also, I think if someone did something bizarre like ending a line in \\, we should not treat that as a continuation line, if I'm reading the spec correctly.

[richm]

@XakV please try #122

[richm]

@XakV also - how does this issue manifest in your workflow? Does the role issue an error? Are you using the scan_sudoers module directly?

[XakV]

Hi, thanks for your response. I'll be back in front of that work on Tuesday and will give that a shot.

From memory, I noticed the issue when running the scan_sudoers module independently or in the role. When running the role, it errored on validating the file, it also didn't parse the next line after the '\'.

I'm working in an enterprise environment that has kind of gone "wild west" with its rules. So I'm trying to scan for crazy stuff and organize it. The example I gave however, matches the entry that the scan_sudoers module seems to error on.

[richm]

Hi, thanks for your response. I'll be back in front of that work on Tuesday and will give that a shot.

Thanks!

From memory, I noticed the issue when running the scan_sudoers module independently or in the role. When running the role, it errored on validating the file, it also didn't parse the next line after the ''.

I'm working in an enterprise environment that has kind of gone "wild west" with its rules. So I'm trying to scan for crazy stuff and organize it.

We're here to help, and thanks for bringing this to our attention.

The example I gave however, matches the entry that the scan_sudoers module seems to error on.

I think the test I changed covers that case.

[XakV]

I tried your fix and it works. Thanks!

scan_sudoers module now reports the continued line, rather than the line wrap ( backslash ).

Given these lines in a sudoers file ->

neko ALL=(root) NOPASSWD: REPAIRDISK, /bin/mount, /bin/umount, /usr/bin/iotop, /usr/sbin/lsof, /usr/sbin/iotop, /bin/cat /var/log/messages, \
                          /some/path/to/a/command/somewhere/that/i_want_to_run.sh

Scan sudoers reports ->

{
   "commands": [
      "REPAIRDISK",
      "/bin/mount",
      "/bin/umount",
      "/usr/bin/iotop",
      "/usr/sbin/lsof",
      "/usr/sbin/iotop",
      "/bin/cat /var/log/messages",
      "/some/path/to/a/command/somewhere/that/i_want_to_run.sh"
    ],
    "hosts": [
       "ALL"
    ],
    "operators": [
       "root"
    ],
    "tags": [
       "NOPASSWD"
    ],
    "users": [
       "neko"
    ]
},