Blame SOURCES/sudo-1.8.23-legacy-group-processing.patch

e33993
diff -up sudo-1.8.23/plugins/sudoers/cvtsudoers.c.legacy-group-processing sudo-1.8.23/plugins/sudoers/cvtsudoers.c
e33993
--- sudo-1.8.23/plugins/sudoers/cvtsudoers.c.legacy-group-processing	2018-06-28 11:24:25.966475241 +0200
e33993
+++ sudo-1.8.23/plugins/sudoers/cvtsudoers.c	2018-06-28 11:26:40.215025493 +0200
e33993
@@ -321,6 +321,15 @@ main(int argc, char *argv[])
e33993
 	sudo_fatalx("error: unhandled input %d", input_format);
e33993
     }
e33993
 
e33993
+    /*
e33993
+     * cvtsudoers group filtering doesn't work if def_match_group_by_gid
e33993
+     * is set to true by default (at compile-time). It cannot be set to false
e33993
+     * because cvtsudoers doesn't apply the parsed Defaults.
e33993
+     *
e33993
+     * Related: sudo-1.8.23-legacy-group-processing.patch
e33993
+     */
e33993
+    def_match_group_by_gid = def_legacy_group_processing = false;
e33993
+
e33993
     /* Apply filters. */
e33993
     filter_userspecs(conf);
e33993
     filter_defaults(conf);
e33993
diff -up sudo-1.8.23/plugins/sudoers/defaults.c.legacy-group-processing sudo-1.8.23/plugins/sudoers/defaults.c
e33993
--- sudo-1.8.23/plugins/sudoers/defaults.c.legacy-group-processing	2018-04-29 21:59:31.000000000 +0200
e33993
+++ sudo-1.8.23/plugins/sudoers/defaults.c	2018-06-28 11:24:25.966475241 +0200
e33993
@@ -87,6 +87,7 @@ static struct early_default early_defaul
e33993
     { I_FQDN },
e33993
 #endif
e33993
     { I_MATCH_GROUP_BY_GID },
e33993
+    { I_LEGACY_GROUP_PROCESSING },
e33993
     { I_GROUP_PLUGIN },
e33993
     { I_RUNAS_DEFAULT },
e33993
     { I_SUDOERS_LOCALE },
e33993
@@ -488,6 +489,8 @@ init_defaults(void)
e33993
     }
e33993
 
e33993
     /* First initialize the flags. */
e33993
+    def_legacy_group_processing = true;
e33993
+    def_match_group_by_gid = true;
e33993
 #ifdef LONG_OTP_PROMPT
e33993
     def_long_otp_prompt = true;
e33993
 #endif
e33993
diff -up sudo-1.8.23/plugins/sudoers/def_data.c.legacy-group-processing sudo-1.8.23/plugins/sudoers/def_data.c
e33993
--- sudo-1.8.23/plugins/sudoers/def_data.c.legacy-group-processing	2018-04-29 21:59:31.000000000 +0200
e33993
+++ sudo-1.8.23/plugins/sudoers/def_data.c	2018-06-28 11:24:25.966475241 +0200
e33993
@@ -494,6 +494,10 @@ struct sudo_defs_types sudo_defs_table[]
e33993
 	N_("Ignore case when matching group names"),
e33993
 	NULL,
e33993
     }, {
e33993
+	"legacy_group_processing", T_FLAG,
e33993
+	N_("Don't pre-resolve all group names"),
e33993
+	NULL,
e33993
+    }, {
e33993
 	NULL, 0, NULL
e33993
     }
e33993
 };
e33993
diff -up sudo-1.8.23/plugins/sudoers/def_data.h.legacy-group-processing sudo-1.8.23/plugins/sudoers/def_data.h
e33993
--- sudo-1.8.23/plugins/sudoers/def_data.h.legacy-group-processing	2018-04-29 21:59:31.000000000 +0200
e33993
+++ sudo-1.8.23/plugins/sudoers/def_data.h	2018-06-28 11:24:25.967475238 +0200
e33993
@@ -226,6 +226,8 @@
e33993
 #define def_case_insensitive_user (sudo_defs_table[I_CASE_INSENSITIVE_USER].sd_un.flag)
e33993
 #define I_CASE_INSENSITIVE_GROUP 113
e33993
 #define def_case_insensitive_group (sudo_defs_table[I_CASE_INSENSITIVE_GROUP].sd_un.flag)
e33993
+#define I_LEGACY_GROUP_PROCESSING 114
e33993
+#define def_legacy_group_processing (sudo_defs_table[I_LEGACY_GROUP_PROCESSING].sd_un.flag)
e33993
 
e33993
 enum def_tuple {
e33993
 	never,
e33993
diff -up sudo-1.8.23/plugins/sudoers/def_data.in.legacy-group-processing sudo-1.8.23/plugins/sudoers/def_data.in
e33993
--- sudo-1.8.23/plugins/sudoers/def_data.in.legacy-group-processing	2018-04-29 21:59:31.000000000 +0200
e33993
+++ sudo-1.8.23/plugins/sudoers/def_data.in	2018-06-28 11:24:25.967475238 +0200
e33993
@@ -357,3 +357,6 @@ case_insensitive_user
e33993
 case_insensitive_group
e33993
 	T_FLAG
e33993
 	"Ignore case when matching group names"
e33993
+legacy_group_processing
e33993
+	T_FLAG
e33993
+	"Don't pre-resolve all group names"
e33993
diff -up sudo-1.8.23/plugins/sudoers/sudoers.c.legacy-group-processing sudo-1.8.23/plugins/sudoers/sudoers.c
e33993
--- sudo-1.8.23/plugins/sudoers/sudoers.c.legacy-group-processing	2018-04-29 21:59:31.000000000 +0200
e33993
+++ sudo-1.8.23/plugins/sudoers/sudoers.c	2018-06-28 11:24:25.967475238 +0200
e33993
@@ -209,6 +209,10 @@ sudoers_policy_init(void *info, char * c
e33993
     if (set_loginclass(runas_pw ? runas_pw : sudo_user.pw))
e33993
 	ret = true;
e33993
 
e33993
+    if (!def_match_group_by_gid || !def_legacy_group_processing) {
e33993
+        def_match_group_by_gid = false;
e33993
+	def_legacy_group_processing = false;
e33993
+    }
e33993
 cleanup:
e33993
     if (!restore_perms())
e33993
 	ret = -1;