1) Always save an entry on the stack if it is empty. This fixes the

-l and -v flags that were broken by earlier parser changes.

2) In a Runas list, don't negate FALSE -> TRUE since that would make !foo
match any time the user specified a runas user (via -u) other than foo.

diff --git a/parse.yacc b/parse.yacc
index 28a377758c1b035b8ca8d66a5cb07b6d06951341..da26874d3234bab6e610f6024efbf53baec72bd8 100644 (file)
--- a/parse.yacc
+++ b/parse.yacc
@@ -298,10 +298,12 @@ cmndspec  :       runasspec nopasswd opcmnd {
                            }
                            /*
                             * Push the entry onto the stack if it is worth
-                            * saving and clear match status.
+                            * saving (or if nothing else is on the stack)
+                            * and clear match status.
                             */
-                           if (user_matches == TRUE && host_matches == TRUE &&
-                               cmnd_matches != -1 && runas_matches == TRUE)
+                           if ((user_matches == TRUE && host_matches == TRUE &&
+                               cmnd_matches != -1 && runas_matches != -1) ||
+                               top == 1)
                                pushcp;
                            cmnd_matches = -1;
                        }
@@ -365,10 +367,13 @@ oprunasuser       :       runasuser {
                            }
                        } oprunasuser {
                            pop;
+                           /*
+                            * Don't negate FALSE -> TRUE since that would
+                            * make !foo match any time the user specified
+                            * a runas user (via -u) other than foo.
+                            */
                            if (runas_matched == TRUE)
                                runas_matches = FALSE;
-                           else if (runas_matched == FALSE)
-                               runas_matches = TRUE;
                        }
 
 runasuser      :       NAME {