Skip to content

Commit ecdf0c8

Browse files
millertmillert
committed
Add pam_silent sudoers option.
Inspired by PR #368 GitHub issue #216
1 parent f0823c7 commit ecdf0c8

File tree

7 files changed

+109
-68
lines changed

7 files changed

+109
-68
lines changed

‎docs/sudoers.man.in

+17-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
.nr BA @BAMAN@
2626
.nr LC @LCMAN@
2727
.nr PS @PSMAN@
28-
.TH "SUDOERS" "@mansectform@" "March 9, 2024" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
28+
.TH "SUDOERS" "@mansectform@" "April 17, 2024" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
2929
.nh
3030
.if n .ad l
3131
.SH "NAME"
@@ -3824,6 +3824,22 @@ by default.
38243824
.sp
38253825
This setting is only supported by version 1.8.8 or higher.
38263826
.TP 18n
3827+
pam_silent
3828+
If set, PAM authentication will be performed in silent mode.
3829+
This prevents PAM authentication modules from generating output.
3830+
In some cases, this may suppress important information about why
3831+
authentication failed.
3832+
For example, PAM modules such as
3833+
\fIpam_faillock\fR
3834+
will only display a warning if
3835+
\fIpam_silent\fR
3836+
is disabled.
3837+
This flag is
3838+
\fIon\fR
3839+
by default.
3840+
.sp
3841+
This setting is only supported by version 1.8.16 or higher.
3842+
.TP 18n
38273843
passprompt_override
38283844
If set, the prompt specified by
38293845
\fIpassprompt\fR

‎docs/sudoers.mdoc.in

+16-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
.nr BA @BAMAN@
2626
.nr LC @LCMAN@
2727
.nr PS @PSMAN@
28-
.Dd March 9, 2024
28+
.Dd April 17, 2024
2929
.Dt SUDOERS @mansectform@
3030
.Os Sudo @PACKAGE_VERSION@
3131
.Sh NAME
@@ -3623,6 +3623,21 @@ This flag is
36233623
by default.
36243624
.Pp
36253625
This setting is only supported by version 1.8.8 or higher.
3626+
.It pam_silent
3627+
If set, PAM authentication will be performed in silent mode.
3628+
This prevents PAM authentication modules from generating output.
3629+
In some cases, this may suppress important information about why
3630+
authentication failed.
3631+
For example, PAM modules such as
3632+
.Em pam_faillock
3633+
will only display a warning if
3634+
.Em pam_silent
3635+
is disabled.
3636+
This flag is
3637+
.Em on
3638+
by default.
3639+
.Pp
3640+
This setting is only supported by version 1.8.16 or higher.
36263641
.It passprompt_override
36273642
If set, the prompt specified by
36283643
.Em passprompt

‎plugins/sudoers/auth/pam.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,7 @@ sudo_pam_verify(const struct sudoers_context *ctx, struct passwd *pw,
318318
}
319319

320320
/* PAM_SILENT prevents the authentication service from generating output. */
321-
*pam_status = pam_authenticate(pamh, PAM_SILENT);
321+
*pam_status = pam_authenticate(pamh, def_pam_silent ? PAM_SILENT : 0);
322322

323323
/* Restore def_prompt, the passed-in prompt may be freed later. */
324324
def_prompt = PASSPROMPT;

‎plugins/sudoers/def_data.c

+4
Original file line numberDiff line numberDiff line change
@@ -441,6 +441,10 @@ struct sudo_defs_types sudo_defs_table[] = {
441441
"pam_acct_mgmt", T_FLAG,
442442
N_("Perform PAM account validation management"),
443443
NULL,
444+
}, {
445+
"pam_silent", T_FLAG,
446+
N_("Do not allow PAM authentication modules to generate output"),
447+
NULL,
444448
}, {
445449
"maxseq", T_STR,
446450
N_("Maximum I/O log sequence number: %s"),

‎plugins/sudoers/def_data.h

+67-65
Original file line numberDiff line numberDiff line change
@@ -194,135 +194,137 @@
194194
#define def_pam_session (sudo_defs_table[I_PAM_SESSION].sd_un.flag)
195195
#define I_PAM_ACCT_MGMT 96
196196
#define def_pam_acct_mgmt (sudo_defs_table[I_PAM_ACCT_MGMT].sd_un.flag)
197-
#define I_MAXSEQ 97
197+
#define I_PAM_SILENT 97
198+
#define def_pam_silent (sudo_defs_table[I_PAM_SILENT].sd_un.flag)
199+
#define I_MAXSEQ 98
198200
#define def_maxseq (sudo_defs_table[I_MAXSEQ].sd_un.str)
199-
#define I_USE_NETGROUPS 98
201+
#define I_USE_NETGROUPS 99
200202
#define def_use_netgroups (sudo_defs_table[I_USE_NETGROUPS].sd_un.flag)
201-
#define I_SUDOEDIT_CHECKDIR 99
203+
#define I_SUDOEDIT_CHECKDIR 100
202204
#define def_sudoedit_checkdir (sudo_defs_table[I_SUDOEDIT_CHECKDIR].sd_un.flag)
203-
#define I_SUDOEDIT_FOLLOW 100
205+
#define I_SUDOEDIT_FOLLOW 101
204206
#define def_sudoedit_follow (sudo_defs_table[I_SUDOEDIT_FOLLOW].sd_un.flag)
205-
#define I_ALWAYS_QUERY_GROUP_PLUGIN 101
207+
#define I_ALWAYS_QUERY_GROUP_PLUGIN 102
206208
#define def_always_query_group_plugin (sudo_defs_table[I_ALWAYS_QUERY_GROUP_PLUGIN].sd_un.flag)
207-
#define I_NETGROUP_TUPLE 102
209+
#define I_NETGROUP_TUPLE 103
208210
#define def_netgroup_tuple (sudo_defs_table[I_NETGROUP_TUPLE].sd_un.flag)
209-
#define I_IGNORE_AUDIT_ERRORS 103
211+
#define I_IGNORE_AUDIT_ERRORS 104
210212
#define def_ignore_audit_errors (sudo_defs_table[I_IGNORE_AUDIT_ERRORS].sd_un.flag)
211-
#define I_IGNORE_IOLOG_ERRORS 104
213+
#define I_IGNORE_IOLOG_ERRORS 105
212214
#define def_ignore_iolog_errors (sudo_defs_table[I_IGNORE_IOLOG_ERRORS].sd_un.flag)
213-
#define I_IGNORE_LOGFILE_ERRORS 105
215+
#define I_IGNORE_LOGFILE_ERRORS 106
214216
#define def_ignore_logfile_errors (sudo_defs_table[I_IGNORE_LOGFILE_ERRORS].sd_un.flag)
215-
#define I_MATCH_GROUP_BY_GID 106
217+
#define I_MATCH_GROUP_BY_GID 107
216218
#define def_match_group_by_gid (sudo_defs_table[I_MATCH_GROUP_BY_GID].sd_un.flag)
217-
#define I_SYSLOG_MAXLEN 107
219+
#define I_SYSLOG_MAXLEN 108
218220
#define def_syslog_maxlen (sudo_defs_table[I_SYSLOG_MAXLEN].sd_un.uival)
219-
#define I_IOLOG_USER 108
221+
#define I_IOLOG_USER 109
220222
#define def_iolog_user (sudo_defs_table[I_IOLOG_USER].sd_un.str)
221-
#define I_IOLOG_GROUP 109
223+
#define I_IOLOG_GROUP 110
222224
#define def_iolog_group (sudo_defs_table[I_IOLOG_GROUP].sd_un.str)
223-
#define I_IOLOG_MODE 110
225+
#define I_IOLOG_MODE 111
224226
#define def_iolog_mode (sudo_defs_table[I_IOLOG_MODE].sd_un.mode)
225-
#define I_FDEXEC 111
227+
#define I_FDEXEC 112
226228
#define def_fdexec (sudo_defs_table[I_FDEXEC].sd_un.tuple)
227-
#define I_IGNORE_UNKNOWN_DEFAULTS 112
229+
#define I_IGNORE_UNKNOWN_DEFAULTS 113
228230
#define def_ignore_unknown_defaults (sudo_defs_table[I_IGNORE_UNKNOWN_DEFAULTS].sd_un.flag)
229-
#define I_COMMAND_TIMEOUT 113
231+
#define I_COMMAND_TIMEOUT 114
230232
#define def_command_timeout (sudo_defs_table[I_COMMAND_TIMEOUT].sd_un.ival)
231-
#define I_USER_COMMAND_TIMEOUTS 114
233+
#define I_USER_COMMAND_TIMEOUTS 115
232234
#define def_user_command_timeouts (sudo_defs_table[I_USER_COMMAND_TIMEOUTS].sd_un.flag)
233-
#define I_IOLOG_FLUSH 115
235+
#define I_IOLOG_FLUSH 116
234236
#define def_iolog_flush (sudo_defs_table[I_IOLOG_FLUSH].sd_un.flag)
235-
#define I_SYSLOG_PID 116
237+
#define I_SYSLOG_PID 117
236238
#define def_syslog_pid (sudo_defs_table[I_SYSLOG_PID].sd_un.flag)
237-
#define I_TIMESTAMP_TYPE 117
239+
#define I_TIMESTAMP_TYPE 118
238240
#define def_timestamp_type (sudo_defs_table[I_TIMESTAMP_TYPE].sd_un.tuple)
239-
#define I_AUTHFAIL_MESSAGE 118
241+
#define I_AUTHFAIL_MESSAGE 119
240242
#define def_authfail_message (sudo_defs_table[I_AUTHFAIL_MESSAGE].sd_un.str)
241-
#define I_CASE_INSENSITIVE_USER 119
243+
#define I_CASE_INSENSITIVE_USER 120
242244
#define def_case_insensitive_user (sudo_defs_table[I_CASE_INSENSITIVE_USER].sd_un.flag)
243-
#define I_CASE_INSENSITIVE_GROUP 120
245+
#define I_CASE_INSENSITIVE_GROUP 121
244246
#define def_case_insensitive_group (sudo_defs_table[I_CASE_INSENSITIVE_GROUP].sd_un.flag)
245-
#define I_LOG_ALLOWED 121
247+
#define I_LOG_ALLOWED 122
246248
#define def_log_allowed (sudo_defs_table[I_LOG_ALLOWED].sd_un.flag)
247-
#define I_LOG_DENIED 122
249+
#define I_LOG_DENIED 123
248250
#define def_log_denied (sudo_defs_table[I_LOG_DENIED].sd_un.flag)
249-
#define I_LOG_SERVERS 123
251+
#define I_LOG_SERVERS 124
250252
#define def_log_servers (sudo_defs_table[I_LOG_SERVERS].sd_un.list)
251-
#define I_LOG_SERVER_TIMEOUT 124
253+
#define I_LOG_SERVER_TIMEOUT 125
252254
#define def_log_server_timeout (sudo_defs_table[I_LOG_SERVER_TIMEOUT].sd_un.ival)
253-
#define I_LOG_SERVER_KEEPALIVE 125
255+
#define I_LOG_SERVER_KEEPALIVE 126
254256
#define def_log_server_keepalive (sudo_defs_table[I_LOG_SERVER_KEEPALIVE].sd_un.flag)
255-
#define I_LOG_SERVER_CABUNDLE 126
257+
#define I_LOG_SERVER_CABUNDLE 127
256258
#define def_log_server_cabundle (sudo_defs_table[I_LOG_SERVER_CABUNDLE].sd_un.str)
257-
#define I_LOG_SERVER_PEER_CERT 127
259+
#define I_LOG_SERVER_PEER_CERT 128
258260
#define def_log_server_peer_cert (sudo_defs_table[I_LOG_SERVER_PEER_CERT].sd_un.str)
259-
#define I_LOG_SERVER_PEER_KEY 128
261+
#define I_LOG_SERVER_PEER_KEY 129
260262
#define def_log_server_peer_key (sudo_defs_table[I_LOG_SERVER_PEER_KEY].sd_un.str)
261-
#define I_LOG_SERVER_VERIFY 129
263+
#define I_LOG_SERVER_VERIFY 130
262264
#define def_log_server_verify (sudo_defs_table[I_LOG_SERVER_VERIFY].sd_un.flag)
263-
#define I_RUNAS_ALLOW_UNKNOWN_ID 130
265+
#define I_RUNAS_ALLOW_UNKNOWN_ID 131
264266
#define def_runas_allow_unknown_id (sudo_defs_table[I_RUNAS_ALLOW_UNKNOWN_ID].sd_un.flag)
265-
#define I_RUNAS_CHECK_SHELL 131
267+
#define I_RUNAS_CHECK_SHELL 132
266268
#define def_runas_check_shell (sudo_defs_table[I_RUNAS_CHECK_SHELL].sd_un.flag)
267-
#define I_PAM_RUSER 132
269+
#define I_PAM_RUSER 133
268270
#define def_pam_ruser (sudo_defs_table[I_PAM_RUSER].sd_un.flag)
269-
#define I_PAM_RHOST 133
271+
#define I_PAM_RHOST 134
270272
#define def_pam_rhost (sudo_defs_table[I_PAM_RHOST].sd_un.flag)
271-
#define I_RUNCWD 134
273+
#define I_RUNCWD 135
272274
#define def_runcwd (sudo_defs_table[I_RUNCWD].sd_un.str)
273-
#define I_RUNCHROOT 135
275+
#define I_RUNCHROOT 136
274276
#define def_runchroot (sudo_defs_table[I_RUNCHROOT].sd_un.str)
275-
#define I_LOG_FORMAT 136
277+
#define I_LOG_FORMAT 137
276278
#define def_log_format (sudo_defs_table[I_LOG_FORMAT].sd_un.tuple)
277-
#define I_SELINUX 137
279+
#define I_SELINUX 138
278280
#define def_selinux (sudo_defs_table[I_SELINUX].sd_un.flag)
279-
#define I_ADMIN_FLAG 138
281+
#define I_ADMIN_FLAG 139
280282
#define def_admin_flag (sudo_defs_table[I_ADMIN_FLAG].sd_un.str)
281-
#define I_INTERCEPT 139
283+
#define I_INTERCEPT 140
282284
#define def_intercept (sudo_defs_table[I_INTERCEPT].sd_un.flag)
283-
#define I_LOG_SUBCMDS 140
285+
#define I_LOG_SUBCMDS 141
284286
#define def_log_subcmds (sudo_defs_table[I_LOG_SUBCMDS].sd_un.flag)
285-
#define I_LOG_EXIT_STATUS 141
287+
#define I_LOG_EXIT_STATUS 142
286288
#define def_log_exit_status (sudo_defs_table[I_LOG_EXIT_STATUS].sd_un.flag)
287-
#define I_INTERCEPT_AUTHENTICATE 142
289+
#define I_INTERCEPT_AUTHENTICATE 143
288290
#define def_intercept_authenticate (sudo_defs_table[I_INTERCEPT_AUTHENTICATE].sd_un.flag)
289-
#define I_INTERCEPT_ALLOW_SETID 143
291+
#define I_INTERCEPT_ALLOW_SETID 144
290292
#define def_intercept_allow_setid (sudo_defs_table[I_INTERCEPT_ALLOW_SETID].sd_un.flag)
291-
#define I_RLIMIT_AS 144
293+
#define I_RLIMIT_AS 145
292294
#define def_rlimit_as (sudo_defs_table[I_RLIMIT_AS].sd_un.str)
293-
#define I_RLIMIT_CORE 145
295+
#define I_RLIMIT_CORE 146
294296
#define def_rlimit_core (sudo_defs_table[I_RLIMIT_CORE].sd_un.str)
295-
#define I_RLIMIT_CPU 146
297+
#define I_RLIMIT_CPU 147
296298
#define def_rlimit_cpu (sudo_defs_table[I_RLIMIT_CPU].sd_un.str)
297-
#define I_RLIMIT_DATA 147
299+
#define I_RLIMIT_DATA 148
298300
#define def_rlimit_data (sudo_defs_table[I_RLIMIT_DATA].sd_un.str)
299-
#define I_RLIMIT_FSIZE 148
301+
#define I_RLIMIT_FSIZE 149
300302
#define def_rlimit_fsize (sudo_defs_table[I_RLIMIT_FSIZE].sd_un.str)
301-
#define I_RLIMIT_LOCKS 149
303+
#define I_RLIMIT_LOCKS 150
302304
#define def_rlimit_locks (sudo_defs_table[I_RLIMIT_LOCKS].sd_un.str)
303-
#define I_RLIMIT_MEMLOCK 150
305+
#define I_RLIMIT_MEMLOCK 151
304306
#define def_rlimit_memlock (sudo_defs_table[I_RLIMIT_MEMLOCK].sd_un.str)
305-
#define I_RLIMIT_NOFILE 151
307+
#define I_RLIMIT_NOFILE 152
306308
#define def_rlimit_nofile (sudo_defs_table[I_RLIMIT_NOFILE].sd_un.str)
307-
#define I_RLIMIT_NPROC 152
309+
#define I_RLIMIT_NPROC 153
308310
#define def_rlimit_nproc (sudo_defs_table[I_RLIMIT_NPROC].sd_un.str)
309-
#define I_RLIMIT_RSS 153
311+
#define I_RLIMIT_RSS 154
310312
#define def_rlimit_rss (sudo_defs_table[I_RLIMIT_RSS].sd_un.str)
311-
#define I_RLIMIT_STACK 154
313+
#define I_RLIMIT_STACK 155
312314
#define def_rlimit_stack (sudo_defs_table[I_RLIMIT_STACK].sd_un.str)
313-
#define I_NONINTERACTIVE_AUTH 155
315+
#define I_NONINTERACTIVE_AUTH 156
314316
#define def_noninteractive_auth (sudo_defs_table[I_NONINTERACTIVE_AUTH].sd_un.flag)
315-
#define I_LOG_PASSWORDS 156
317+
#define I_LOG_PASSWORDS 157
316318
#define def_log_passwords (sudo_defs_table[I_LOG_PASSWORDS].sd_un.flag)
317-
#define I_PASSPROMPT_REGEX 157
319+
#define I_PASSPROMPT_REGEX 158
318320
#define def_passprompt_regex (sudo_defs_table[I_PASSPROMPT_REGEX].sd_un.list)
319-
#define I_INTERCEPT_TYPE 158
321+
#define I_INTERCEPT_TYPE 159
320322
#define def_intercept_type (sudo_defs_table[I_INTERCEPT_TYPE].sd_un.tuple)
321-
#define I_INTERCEPT_VERIFY 159
323+
#define I_INTERCEPT_VERIFY 160
322324
#define def_intercept_verify (sudo_defs_table[I_INTERCEPT_VERIFY].sd_un.flag)
323-
#define I_APPARMOR_PROFILE 160
325+
#define I_APPARMOR_PROFILE 161
324326
#define def_apparmor_profile (sudo_defs_table[I_APPARMOR_PROFILE].sd_un.str)
325-
#define I_CMDDENIAL_MESSAGE 161
327+
#define I_CMDDENIAL_MESSAGE 162
326328
#define def_cmddenial_message (sudo_defs_table[I_CMDDENIAL_MESSAGE].sd_un.str)
327329

328330
enum def_tuple {

‎plugins/sudoers/def_data.in

+3
Original file line numberDiff line numberDiff line change
@@ -304,6 +304,9 @@ pam_session
304304
pam_acct_mgmt
305305
T_FLAG
306306
"Perform PAM account validation management"
307+
pam_silent
308+
T_FLAG
309+
"Do not allow PAM authentication modules to generate output"
307310
maxseq
308311
T_STR
309312
"Maximum I/O log sequence number: %s"

‎plugins/sudoers/defaults.c

+1
Original file line numberDiff line numberDiff line change
@@ -661,6 +661,7 @@ init_defaults(void)
661661
def_set_utmp = true;
662662
def_pam_acct_mgmt = true;
663663
def_pam_setcred = true;
664+
def_pam_silent = true;
664665
def_syslog_maxlen = MAXSYSLOGLEN;
665666
def_case_insensitive_user = true;
666667
def_case_insensitive_group = true;

0 commit comments

Comments
 (0)