When matching a RunasAlias for a runas group, pass the alias in as

the group_list, not the user_list.  From Daniel Kopecek.

diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c
index 269180011e6f7ef5b599196ed9326fcdbbcbf97b..618c70ad060e6b1855287a5ff84d96225718314f 100644 (file)
--- a/plugins/sudoers/match.c
+++ b/plugins/sudoers/match.c
@@ -211,7 +211,7 @@ _runaslist_matches(struct member_list *user_list, struct member_list *group_list
                    break;
                case ALIAS:
                    if ((a = alias_find(m->name, RUNASALIAS)) != NULL) {
-                       rval = _runaslist_matches(&a->members, &empty);
+                       rval = _runaslist_matches(&empty, &a->members);
                        if (rval != UNSPEC)
                            group_matched = m->negated ? !rval : rval;
                        break;