Fix a parser bug that was exposed when mixing different runas specs

and ! commands.  For example:
    millert        ALL=(daemon) /usr/bin/whoami,!/bin/ls
would allow millert to run whoami as root as well as daemon when it should
just allow daemon.  The problem was that comma-separated commands in
a list shared the same entry on the matching stack.  Now they get
their own entry iff there is a full match.  It may be better to just make
the runas spec persistent across all commands in a list like the user
and host entries of the matching stack.  However, since that is a
fairly major change it should gets its own minor rev increase.

diff --git a/CHANGES b/CHANGES
index 5347eecbf0097245a99c439474187f5b2006d851..86c72ee349adb054ea146a66f0f62c9d9c7662d9 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1030,3 +1030,6 @@ Sudo 1.5.8p2 released.
 
 323) Fixed a segv if HOST_IN_LOG defined and gethostbyname() fails.
      Reported by Gero Treuner <gero@faveve.uni-stuttgart.de>.
+
+324) Fixed a parse bug wrt the ! operator and runas specs.  Noted by
+     David A Beck <BKD@payserv.telekurs.com>.

diff --git a/INSTALL b/INSTALL
index 8ccf9a1cc795de184e6da73a7fcf3598c8cf8798..d29753eb9cf87884f00efce02b9c92f415ca9815 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -185,8 +185,7 @@ Special features/options:
        on the machine.
 
   --with-pam
-       Enable PAM support.  Tested on Redhat Linux 5.x but should work on
-       earlier versions too.  Does *not* work on Solaris.
+       Enable PAM support.  Tested on Redhat Linux 5.x and Solaris 2.6.
 
   --with-AFS
        Enable AFS support with kerberos authentication.  Should work under

diff --git a/parse.yacc b/parse.yacc
index 731274870fe43fc45ce319884fef76ab6734ce66..db58d7df168c02beabea5dca3b72919c01992b90 100644 (file)
--- a/parse.yacc
+++ b/parse.yacc
@@ -275,10 +275,15 @@ cmndspec  :       runasspec nopasswd opcmnd {
                                runas_matches = TRUE;
                                if ($2 == TRUE)
                                    no_passwd = TRUE;
+                               push;
                            } else if (printmatches == TRUE) {
                                cm_list[cm_list_len].runas_len = 0;
                                cm_list[cm_list_len].cmnd_len = 0;
                                cm_list[cm_list_len].nopasswd = FALSE;
+                           } else {
+                               cmnd_matches = -1;
+                               runas_matches = -1;
+                               no_passwd = -1;
                            }
                        }
                ;