* check arguments for NULL in converse PAM converse func, trim trailing newlines in user input
* Update session/pam/pam.c
Co-authored-by: Erik Tate <erik.tate@goteleport.com>
---------
Co-authored-by: Erik Tate <erik.tate@goteleport.com>
* ensure PAM retval is always valid when calling pam_end, prevent deadlock in PAM.free()
* don't call PAM.free in PAM.codeToError, require explicit cleanup to avoid confusion
* unregister handler if Open fails
* always return an error from codeToError
* return an error when an absolute path isn't specified in a moderated upload, or if the path is a dir
* don't show the filename to moderators
* revert change to comment
Teleport validates the contents of sudoers files by using visudo to
check the contents. The binary is invoked from disk using arguments
-c -f - which indicate to validate the content passed via stdin.
Ubuntu 25 and newer uses sudo-rs by default. This causes problems
because the version shipped in Ubuntu 25 does not contain the fix
for https://github.com/trifectatechfoundation/sudo-rs/issues/1358.
This causes visudo to attempt to read a file with the literal name
`-` instead of from stdin. As a result all Teleport sessions which
try to write a sudoers file entry get a file does not exist error
from visudo.
The sanest way to work around this issue without added burden to
end users is to stop using stdin with visudo. All sudoers entries
are first written to a temporary file on disk and that file is
provided to visudo.
* Capture reexec networking stderr and propagate it to the client.
* Move process closure higher in the callstack when waitReady fails.
* Add test for waitReady.
* Add t.Context() select case.
* Address comments.
* Resolve comments.
* Have callers provide context.
* Address comments.
* Fix merge conflicts.
* Fix typo.
* Fix test.
* Fix merge conflicts.
* Fix edge case with unbounded stderr.
* Fix lint.
* unset XAUTHORITY env var for the networking command
When Teleport passes almost all the environment variables to the child
processes that are born of a reexec. This is an issue when XAUTHORITY is
set as it will be passed to the networking process, causing `xauth` to
use a different file than the one that the SSH session process will use.
This is because the SSH session process only inherits a small subset of
the environment variables from the parent process, and XAUTHORITY is not
one of them. This causes X11 forwarding to fail.
* add Remove method to SafeEnv
All existing template usage was converted to make use of
github.com/DataDog/datadog-agent/pkg/template. The DataDog package
is a fork of the stdlib template packages with method calling
removed so that reflect.MethodByName does not prevent DCE.
There were a handful of method calls in our templates that were trivially
changed to use custom functions defined via FuncMaps or specifying the
calculated value to the template instead of calling a function in the template.
A future change will add linter rules to prevent new text/template or
html/imports from landing. They have not been included here so as
to not to break enterprise code while it is migrated.
* Split the approver map away from FileTransferRequest
* Move or copy files in session/reexec/sftputils and session/reexec/reexecsftp
* Split up copied files and clean up the new session packages
* Use custom types for SFTP audit log events
* Clean up imports and run sftp in RunAndExit
* Finish renaming types and functions
* Streamline reexec in main and tests
* Add test with the legacy SFTP event implementation
* Move the reexec parts of lib/srv to session/reexec
* Update references to the moved bits of lib/srv
* Avoid testutils in session/reexec
* Shuffle some constants around to avoid imports in session/reexec
* Vendor in the relevant parts of logutils in session/reexec
* Remove unnecessary symlink checks when opening files
* Inline the last two things from lib/utils in session/reexec
* Inline moved constants
* Deprecate group name consts and fix missed inlines
* Add missing session/reexec.TestMain with reexec check
* Reuse existing constants from the log constants package in session
* Fix broken godoc link
* Depguard rules for the session submodule
* Move lib/auditd to session/auditd
* Move lib/loginuid to session/loginuid
* Reduce dependencies of lib/utils/envutils
* Move lib/utils/envutils to session/envutils
* Split the SSH utilities of sshutils/x11 into sshutils/x11forward
* Move lib/sshutils/x11 to session/networking/x11
* Move lib/sshutils/networking to session/networking
* Move lib/shell to session/shell
* Move lib/utils/uds to session/uds
* Move lib/utils/host to session/host
* Move lib/pam to session/pam
* Avoid lib/utils/log in session/pam
* Move lib/service/servicecfg.PAMConfig to session/pam/pamcfg.PAMConfig
* Move lib/srv/uacc to session/uacc
* Avoid importing lib/utils in session/uacc
* Move lib/selinux to session/selinux
* Avoid lib/utils and lib/utils/log in session/selinux
* make go-mod-tidy-all
* Update oss-fuzz path for session/networking/x11
Andrew LeFevre