From: Todd C. Miller <Todd.Miller@sudo.ws>
Date: Fri, 2 Mar 2018 17:58:50 +0000 (-0700)
Subject: Avoid changing the order of non-negated hosts and commands.
X-Git-Tag: SUDO_1_8_23^2~98
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e96398cac27336f941a3bbb705e3dd6029ed0011;p=sudo

Avoid changing the order of non-negated hosts and commands.
We still put negated hosts/commands at the end of the list.
---

diff --git a/plugins/sudoers/ldap_util.c b/plugins/sudoers/ldap_util.c
index 770de969a..196b0bff3 100644
--- a/plugins/sudoers/ldap_util.c
+++ b/plugins/sudoers/ldap_util.c
@@ -252,6 +252,8 @@ sudo_ldap_role_to_priv(const char *cn, void *hosts, void *runasusers,
     const char *notafter, bool warnings, bool store_options,
     sudo_ldap_iter_t iter)
 {
+    struct cmndspec_list negated_cmnds = TAILQ_HEAD_INITIALIZER(negated_cmnds);
+    struct member_list negated_hosts = TAILQ_HEAD_INITIALIZER(negated_hosts);
     struct cmndspec *cmndspec = NULL;
     struct cmndspec *prev_cmndspec = NULL;
     struct sudo_command *c;
@@ -281,12 +283,13 @@ sudo_ldap_role_to_priv(const char *cn, void *hosts, void *runasusers,
 	while ((host = iter(&hosts)) != NULL) {
 	    if ((m = host_to_member(host)) == NULL)
 		goto oom;
-	    /* Negated hosts have precedence so insert them at the end. */
 	    if (m->negated)
-		TAILQ_INSERT_TAIL(&priv->hostlist, m, entries);
+		TAILQ_INSERT_TAIL(&negated_hosts, m, entries);
 	    else
-		TAILQ_INSERT_HEAD(&priv->hostlist, m, entries);
+		TAILQ_INSERT_TAIL(&priv->hostlist, m, entries);
 	}
+	/* Negated hosts take precedence so we insert them at the end. */
+	TAILQ_CONCAT(&priv->hostlist, &negated_hosts, entries);
     }
 
     /*
@@ -310,9 +313,9 @@ sudo_ldap_role_to_priv(const char *cn, void *hosts, void *runasusers,
 
 	/* Negated commands have precedence so insert them at the end. */
 	if (negated)
-	    TAILQ_INSERT_TAIL(&priv->cmndlist, cmndspec, entries);
+	    TAILQ_INSERT_TAIL(&negated_cmnds, cmndspec, entries);
 	else
-	    TAILQ_INSERT_HEAD(&priv->cmndlist, cmndspec, entries);
+	    TAILQ_INSERT_TAIL(&priv->cmndlist, cmndspec, entries);
 
 	/* Initialize cmndspec */
 	TAGS_INIT(cmndspec->tags);
@@ -468,6 +471,9 @@ sudo_ldap_role_to_priv(const char *cn, void *hosts, void *runasusers,
 	    prev_cmndspec = cmndspec;
 	}
     }
+    /* Negated commands take precedence so we insert them at the end. */
+    TAILQ_CONCAT(&priv->cmndlist, &negated_cmnds, entries);
+
     debug_return_ptr(priv);
 
 oom: