Don't allow max_groups to be set to zero, it just complicates things

needlessly.  Fixes an assertion in visudo when there is a group-based
Defaults entry.

diff --git a/MANIFEST b/MANIFEST
index e6eef4bdeea44894a264bdb08f0bd36a7f6c16b8..21402eda88e20e33c136d8d8742ba38d85e98cf6 100644 (file)
--- a/MANIFEST
+++ b/MANIFEST
@@ -27,6 +27,10 @@ common/regress/sudo_conf/test3.in
 common/regress/sudo_conf/test3.out.ok
 common/regress/sudo_conf/test4.in
 common/regress/sudo_conf/test4.out.ok
+common/regress/sudo_conf/test5.in
+common/regress/sudo_conf/test5.out.ok
+common/regress/sudo_conf/test6.in
+common/regress/sudo_conf/test6.out.ok
 common/regress/sudo_parseln/parseln_test.c
 common/regress/sudo_parseln/test1.in
 common/regress/sudo_parseln/test1.out.ok

diff --git a/common/regress/sudo_conf/test5.in b/common/regress/sudo_conf/test5.in
new file mode 100644 (file)
index 0000000..3a20495
--- /dev/null
+++ b/common/regress/sudo_conf/test5.in
@@ -0,0 +1 @@
+Set max_groups 0

diff --git a/common/regress/sudo_conf/test5.out.ok b/common/regress/sudo_conf/test5.out.ok
new file mode 100644 (file)
index 0000000..af42145
--- /dev/null
+++ b/common/regress/sudo_conf/test5.out.ok
@@ -0,0 +1,3 @@
+Set disable_coredump true
+Set group_source adaptive
+Set max_groups -1

diff --git a/common/regress/sudo_conf/test6.in b/common/regress/sudo_conf/test6.in
new file mode 100644 (file)
index 0000000..537fa57
--- /dev/null
+++ b/common/regress/sudo_conf/test6.in
@@ -0,0 +1 @@
+Set max_groups 16

diff --git a/common/regress/sudo_conf/test6.out.ok b/common/regress/sudo_conf/test6.out.ok
new file mode 100644 (file)
index 0000000..1f62f84
--- /dev/null
+++ b/common/regress/sudo_conf/test6.out.ok
@@ -0,0 +1,3 @@
+Set disable_coredump true
+Set group_source adaptive
+Set max_groups 16

diff --git a/common/sudo_conf.c b/common/sudo_conf.c
index fcbba6df51dcf47c59296bb7ab915d2097371291..c3dd23efdfd36edb0165d8e70bc72d58055726fd 100644 (file)
--- a/common/sudo_conf.c
+++ b/common/sudo_conf.c
@@ -181,7 +181,7 @@ set_var_max_groups(const char *entry, const char *conf_file)
     char *ep;
 
     lval = strtol(entry, &ep, 10);
-    if (*entry == '\0' || *ep != '\0' || lval < 0 || lval > INT_MAX ||
+    if (*entry == '\0' || *ep != '\0' || lval <= 0 || lval > INT_MAX ||
        (errno == ERANGE && lval == LONG_MAX)) {
        warningx(_("invalid max groups `%s' in %s, line %d"), entry,
                    conf_file, conf_lineno);

diff --git a/doc/sudo.conf.cat b/doc/sudo.conf.cat
index 607242b16abaa9b418f01d5eea57873d37799c6b..d28eedba1baf66371d3c6781e0c887ddeb099f9d 100644 (file)
--- a/doc/sudo.conf.cat
+++ b/doc/sudo.conf.cat
@@ -178,15 +178,15 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
 
      max_groups
                The maximum number of user groups to retrieve from the group
-               database.  This setting is only used when querying the group
-               database directly.  It is intended to be used on systems where
-               it is not possible to detect when the array to be populated
-               with group entries is not sufficiently large.  By default, s\bsu\bud\bdo\bo
-               will allocate four times the system's maximum number of groups
-               (see above) and retry with double that number if the group
-               database query fails.  However, some systems just return as
-               many entries as will fit and do not indicate an error when
-               there is a lack of space.
+               database.  Values less than one will be ignored.  This setting
+               is only used when querying the group database directly.  It is
+               intended to be used on systems where it is not possible to
+               detect when the array to be populated with group entries is not
+               sufficiently large.  By default, s\bsu\bud\bdo\bo will allocate four times
+               the system's maximum number of groups (see above) and retry
+               with double that number if the group database query fails.
+               However, some systems just return as many entries as will fit
+               and do not indicate an error when there is a lack of space.
 
                This setting is only available in s\bsu\bud\bdo\bo version 1.8.7 and
                higher.
@@ -361,4 +361,4 @@ D\bDI\bIS\bSC\bCL\bLA\bAI\bIM\bME\bER\bR
      file distributed with s\bsu\bud\bdo\bo or http://www.sudo.ws/sudo/license.html for
      complete details.
 
-Sudo 1.8.7                      March 14, 2013                      Sudo 1.8.7
+Sudo 1.8.8                      August 12, 2013                     Sudo 1.8.8

diff --git a/doc/sudo.conf.man.in b/doc/sudo.conf.man.in
index 3239c1b008bab8c36383eb1354a225b3eb27b20b..653c43dbe7b37272d4e6ee8a407526d2b3d13e9e 100644 (file)
--- a/doc/sudo.conf.man.in
+++ b/doc/sudo.conf.man.in
@@ -16,7 +16,7 @@
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.TH "SUDO" "5" "March 14, 2013" "Sudo @PACKAGE_VERSION@" "OpenBSD Programmer's Manual"
+.TH "SUDO" "5" "August 12, 2013" "Sudo @PACKAGE_VERSION@" "OpenBSD Programmer's Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -367,6 +367,7 @@ version 1.8.7 and higher.
 .TP 10n
 max_groups
 The maximum number of user groups to retrieve from the group database.
+Values less than one will be ignored.
 This setting is only used when querying the group database directly.
 It is intended to be used on systems where it is not possible to detect
 when the array to be populated with group entries is not sufficiently large.

diff --git a/doc/sudo.conf.mdoc.in b/doc/sudo.conf.mdoc.in
index 7efe311cd9369b0bee6aa46abf74d82ef0bf1a3d..3d8972c39e66960acca00522e87b36095f6b7b5b 100644 (file)
--- a/doc/sudo.conf.mdoc.in
+++ b/doc/sudo.conf.mdoc.in
@@ -14,7 +14,7 @@
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd March 14, 2013
+.Dd August 12, 2013
 .Dt SUDO @mansectform@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -327,6 +327,7 @@ This setting is only available in
 version 1.8.7 and higher.
 .It max_groups
 The maximum number of user groups to retrieve from the group database.
+Values less than one will be ignored.
 This setting is only used when querying the group database directly.
 It is intended to be used on systems where it is not possible to detect
 when the array to be populated with group entries is not sufficiently large.

diff --git a/plugins/sudoers/policy.c b/plugins/sudoers/policy.c
index 802ad94607e38108068248f28e382af630a9e53d..57c19e2461eb50f559ff94e9e168bb263b894951 100644 (file)
--- a/plugins/sudoers/policy.c
+++ b/plugins/sudoers/policy.c
@@ -134,7 +134,6 @@ sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group)
 
     /* Parse command line settings. */
     user_closefrom = -1;
-    sudo_user.max_groups = -1;
     for (cur = info->settings; *cur != NULL; cur++) {
        if (MATCHES(*cur, "closefrom=")) {
            user_closefrom = atoi(*cur + sizeof("closefrom=") - 1);

diff --git a/plugins/sudoers/pwutil_impl.c b/plugins/sudoers/pwutil_impl.c
index 0ea3e295983d750424badd5139505a7d2fe10596..8702b886ac1256242e89d6c1be558794330ecb7f 100644 (file)
--- a/plugins/sudoers/pwutil_impl.c
+++ b/plugins/sudoers/pwutil_impl.c
@@ -243,7 +243,7 @@ sudo_make_grlist_item(struct passwd *pw, char * const *unused1,
        user_gids = NULL;
        user_ngids = 0;
     } else {
-       if (sudo_user.max_groups != -1) {
+       if (sudo_user.max_groups > 0) {
            ngids = sudo_user.max_groups;
            gids = emalloc2(ngids, sizeof(GETGROUPS_T));
            (void)getgrouplist(pw->pw_name, pw->pw_gid, gids, &ngids);

diff --git a/src/sudo.c b/src/sudo.c
index f156d9a41f2747fbb156b6e00f2c7e36f2c6cdcd..9f14b473541a3f440914e6835410b488393cdd93 100644 (file)
--- a/src/sudo.c
+++ b/src/sudo.c
@@ -354,7 +354,7 @@ fill_group_list(struct user_details *ud, int system_maxgroups)
      * trying getgrouplist() until we have enough room in the array.
      */
     ud->ngroups = sudo_conf_max_groups();
-    if (ud->ngroups != -1) {
+    if (ud->ngroups > 0) {
        ud->groups = emalloc2(ud->ngroups, sizeof(GETGROUPS_T));
        /* No error on insufficient space if user specified max_groups. */
        (void)getgrouplist(ud->username, ud->gid, ud->groups, &ud->ngroups);