A user can always list their own entries, even with -u.

Better error message when failing to list another user's entries.

diff --git a/logging.c b/logging.c
index 703582cfeffb49bfec15801f0a99b2013a115ede..4f6f53f3e0fa54ae346908e4366e0d4e1de54076 100644 (file)
--- a/logging.c
+++ b/logging.c
@@ -322,7 +322,8 @@ log_auth(status, inform_user)
            (void) fprintf(stderr,
                "Sorry, user %s is not allowed to execute '%s%s%s' as %s on %s.\n",
                user_name, user_cmnd, user_args ? " " : "",
-               user_args ? user_args : "", *user_runas, user_host);
+               user_args ? user_args : "",
+               list_pw ? list_pw->pw_name : *user_runas, user_host);
     }
 
     /*

diff --git a/parse.c b/parse.c
index e475c1fefec7fe6d86d87648e28b91661891e204..93c9cb1cdf7e9e910ab1f7f60718e59e349fe9b1 100644 (file)
--- a/parse.c
+++ b/parse.c
@@ -120,6 +120,7 @@ sudoers_lookup(pwflag)
                    for (cs = priv->cmndlist; cs != NULL; cs = cs->next) {
                        /* Only check the command when listing another user. */
                        if (user_uid == 0 || list_pw == NULL ||
+                           user_uid == list_pw->pw_uid ||
                            cmnd_matches(user_cmnd, user_args, cs->cmnd) == TRUE)
                                matched = TRUE;
                        if ((pwcheck == any && nopass != TRUE) ||