When matching a RunasAlias for a runas group, pass the alias in as

the group_list, not the user_list.  From Daniel Kopecek.

--HG--
branch : 1.7

diff --git a/NEWS b/NEWS
index b798fb0c6ef9d379dd0145612e8f96cab6af365e..d7436feea7894155fd794fcd9ffd76725d68f12a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,8 @@
+What's new in Sudo 1.7.8p1?
+
+ * Fixed matching of a Runas_Alias in the group section of a
+   Runas_Spec.
+
 What's new in Sudo 1.7.8?
 
  * Sudo will now use PAM by default on AIX 6 and higher.

diff --git a/match.c b/match.c
index 1a47e55c81498477510890254767f6a887233f93..184616e2ba83afe7c124416ab3558f7d36ed55a6 100644 (file)
--- a/match.c
+++ b/match.c
@@ -222,7 +222,7 @@ _runaslist_matches(user_list, group_list)
                    break;
                case ALIAS:
                    if ((a = alias_find(m->name, RUNASALIAS)) != NULL) {
-                       rval = _runaslist_matches(&a->members, &empty);
+                       rval = _runaslist_matches(&empty, &a->members);
                        if (rval != UNSPEC)
                            group_matched = m->negated ? !rval : rval;
                        break;