We also need to open the sudoers file as root if there is a GID

mismatch.

diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
index 08d901eec4881c3eb44d2b3caf17896802dc0c7f..79c1c76c2b38ccffc71fa69af22bbaf126a799a6 100644 (file)
--- a/plugins/sudoers/sudoers.c
+++ b/plugins/sudoers/sudoers.c
@@ -693,11 +693,12 @@ open_sudoers(const char *sudoers, bool doedit, bool *keepopen)
     switch (sudo_secure_file(sudoers, sudoers_uid, sudoers_gid, &sb)) {
        case SUDO_PATH_SECURE:
            /*
-            * If we are expecting sudoers to be group readable but
-            * it is not, we must open the file as root, not uid 1.
+            * If we are expecting sudoers to be group readable by
+            * SUDOERS_GID but it is not, we must open the file as root,
+            * not uid 1.
             */
-           if (sudoers_uid == ROOT_UID && (sudoers_mode & S_IRGRP)) {
-               if ((sb.st_mode & S_IRGRP) == 0) {
+           if (sudoers_uid == ROOT_UID && ISSET(sudoers_mode, S_IRGRP)) {
+               if (!ISSET(sb.st_mode, S_IRGRP) || sb.st_gid != SUDOERS_GID) {
                    restore_perms();
                    set_perms(PERM_ROOT);
                }