Do not include GLOB_MARK in the flags we pass to glob(3). Fixes a

bug where a pattern like "/usr/*" include /usr/bin/ in the results,
which would be incorrectly be interpreted as if the sudoers file
had specified a directory.  From Vitezslav Cizek.

diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c
index 47e16763648e5b7cd4a3e5d3dabcd50a7790a5d6..cf842217c7651356a32e6467a5bca114eb481e08 100644 (file)
--- a/plugins/sudoers/match.c
+++ b/plugins/sudoers/match.c
@@ -477,7 +477,7 @@ command_matches_glob(char *sudoers_cmnd, char *sudoers_args)
      *  c) there are args in sudoers and on command line and they match
      * else return false.
      */
-#define GLOB_FLAGS     (GLOB_NOSORT | GLOB_MARK | GLOB_BRACE | GLOB_TILDE)
+#define GLOB_FLAGS     (GLOB_NOSORT | GLOB_BRACE | GLOB_TILDE)
     if (glob(sudoers_cmnd, GLOB_FLAGS, NULL, &gl) != 0 || gl.gl_pathc == 0) {
        globfree(&gl);
        debug_return_bool(false);