Document group lookup change and possible side effects.

--HG--
branch : 1.8

diff --git a/NEWS b/NEWS
index e1de2cc40ee43bf6cdc18dbeffe7633530b55411..6cee22c914b8044dfc0a072b2adaa83723f8bbe9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,11 @@ What's new in Sudo 1.8.2?
    Previously, the .bash_profile would not be sourced prior to
    running the command.
 
+ * When matching groups in the sudoers file, sudo will now match
+   based on the name of the group instead of the group ID. This can
+   substantially reduce the number of group lookups for sudoers
+   files that contain a large nummber of groups.
+
 What's new in Sudo 1.8.1p2?
 
  * Two-character CIDR-style IPv4 netmasks are now matched correctly

diff --git a/doc/UPGRADE b/doc/UPGRADE
index 35ca9a5e53228c140685e2223a5a2f740e045d3c..9ecab1227de552c856fff1a1adb25e7cb4932e2f 100644 (file)
--- a/doc/UPGRADE
+++ b/doc/UPGRADE
@@ -1,6 +1,30 @@
 Notes on upgrading from an older release
 ========================================
 
+o Upgrading from a version prior to 1.8.2:
+
+    When matching Unix groups in the sudoers file, sudo will now
+    match based on the name of the group as it appears in sudoers
+    instead of the group ID.  This can substantially reduce the
+    number of group lookups for sudoers files that contain a large
+    nummber of groups.  There are a few side effects of this change.
+
+    1) Unix groups with different names but the same group ID are
+       can no longer be used interchangably.  Sudo will look up all
+       of a user's groups by group ID and use the resulting group
+       names when matching sudoers entries.  If there are multiple
+       groups with the same ID, the group name returned by the
+       system getgrgid() library function is the name that will be
+       used when matching sudoers entries.
+
+    2) Unix group names specified in the sudoers file that are
+       longer than the system maximum will no longer match.  For
+       instance, if there is a Unix group "fireflie" on a system
+       where group names are limited to eight characters, "%fireflies"
+       in sudoers will no longer match "fireflie".  Previously, a
+       lookup by name of the group "fireflies" would have matched
+       the "fireflie" group on most systems.
+
 o Upgrading from a version prior to 1.8.1:
 
     Changes in the sudoers parser could result in parse errors for