File sudo-1.8.27-ipa_hostname.patch of Package sudo

Overview Repositories Revisions Requests Users Attributes Meta

File sudo-1.8.27-ipa_hostname.patch of Package sudo (Revision c23b87af7568c3bb7c1d94244488c70b)

Currently displaying revision c23b87af7568c3bb7c1d94244488c70b , Show latest

From e99082e05b9f0dd0e0f47fa1d2e1b9d922ea8c4c Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
Date: Thu, 15 Aug 2019 14:20:12 -0600
Subject: [PATCH] Fix special handling of ipa_hostname that was lost in sudo
 1.8.24. We now include the long and short hostname in sudo parser container.

Index: sudo-1.8.27/plugins/sudoers/file.c
===================================================================
--- sudo-1.8.27.orig/plugins/sudoers/file.c
+++ sudo-1.8.27/plugins/sudoers/file.c
@@ -83,7 +83,7 @@ sudo_file_open(struct sudo_nss *nss)
     if (handle != NULL) {
 	handle->fp = open_sudoers(sudoers_file, false, NULL);
 	if (handle->fp != NULL) {
-	    init_parse_tree(&handle->parse_tree);
+	    init_parse_tree(&handle->parse_tree, NULL, NULL);
 	} else {
 	    free(handle);
 	    handle = NULL;
Index: sudo-1.8.27/plugins/sudoers/gram.c
===================================================================
--- sudo-1.8.27.orig/plugins/sudoers/gram.c
+++ sudo-1.8.27/plugins/sudoers/gram.c
@@ -104,7 +104,9 @@ char *errorfile = NULL;
 struct sudoers_parse_tree parsed_policy = {
     TAILQ_HEAD_INITIALIZER(parsed_policy.userspecs),
     TAILQ_HEAD_INITIALIZER(parsed_policy.defaults),
-    NULL /* aliases */
+    NULL, /* aliases */
+    NULL, /* lhost */
+    NULL /* shost */
 };
 
 /*
@@ -116,7 +118,7 @@ static bool add_userspec(struct member *
 static struct defaults *new_default(char *, char *, short);
 static struct member *new_member(char *, int);
 static struct command_digest *new_digest(int, char *);
-#line 78 "gram.y"
+#line 80 "gram.y"
 #ifndef YYSTYPE_DEFINED
 #define YYSTYPE_DEFINED
 typedef union {
@@ -133,7 +135,7 @@ typedef union {
     int tok;
 } YYSTYPE;
 #endif /* YYSTYPE_DEFINED */
-#line 131 "gram.c"
+#line 133 "gram.c"
 #define COMMAND 257
 #define ALIAS 258
 #define DEFVAR 259
@@ -673,7 +675,7 @@ short *yysslim;
 YYSTYPE *yyvs;
 unsigned int yystacksize;
 int yyparse(void);
-#line 904 "gram.y"
+#line 906 "gram.y"
 void
 sudoerserror(const char *s)
 {
@@ -1017,11 +1019,14 @@ free_userspec(struct userspec *us)
  * Initialized a sudoers parse tree.
  */
 void
-init_parse_tree(struct sudoers_parse_tree *parse_tree)
+init_parse_tree(struct sudoers_parse_tree *parse_tree, const char *lhost,
+    const char *shost)
 {
     TAILQ_INIT(&parse_tree->userspecs);
     TAILQ_INIT(&parse_tree->defaults);
     parse_tree->aliases = NULL;
+    parse_tree->shost = shost;
+    parse_tree->lhost = lhost;
 }
 
 /*
@@ -1098,7 +1103,7 @@ init_options(struct command_options *opt
     opts->limitprivs = NULL;
 #endif
 }
-#line 1044 "gram.c"
+#line 1049 "gram.c"
 /* allocate initial stack or double stack size, up to YYMAXDEPTH */
 #if defined(__cplusplus) || defined(__STDC__)
 static int yygrowstack(void)
@@ -1307,23 +1312,23 @@ yyreduce:
     switch (yyn)
     {
 case 1:
-#line 176 "gram.y"
+#line 178 "gram.y"
 { ; }
 break;
 case 5:
-#line 184 "gram.y"
+#line 186 "gram.y"
 {
 			    ;
 			}
 break;
 case 6:
-#line 187 "gram.y"
+#line 189 "gram.y"
 {
 			    yyerrok;
 			}
 break;
 case 7:
-#line 190 "gram.y"
+#line 192 "gram.y"
 {
 			    if (!add_userspec(yyvsp[-1].member, yyvsp[0].privilege)) {
 				sudoerserror(N_("unable to allocate memory"));
@@ -1332,73 +1337,73 @@ case 7:
 			}
 break;
 case 8:
-#line 196 "gram.y"
+#line 198 "gram.y"
 {
 			    ;
 			}
 break;
 case 9:
-#line 199 "gram.y"
+#line 201 "gram.y"
 {
 			    ;
 			}
 break;
 case 10:
-#line 202 "gram.y"
+#line 204 "gram.y"
 {
 			    ;
 			}
 break;
 case 11:
-#line 205 "gram.y"
+#line 207 "gram.y"
 {
 			    ;
 			}
 break;
 case 12:
-#line 208 "gram.y"
+#line 210 "gram.y"
 {
 			    if (!add_defaults(DEFAULTS, NULL, yyvsp[0].defaults))
 				YYERROR;
 			}
 break;
 case 13:
-#line 212 "gram.y"
+#line 214 "gram.y"
 {
 			    if (!add_defaults(DEFAULTS_USER, yyvsp[-1].member, yyvsp[0].defaults))
 				YYERROR;
 			}
 break;
 case 14:
-#line 216 "gram.y"
+#line 218 "gram.y"
 {
 			    if (!add_defaults(DEFAULTS_RUNAS, yyvsp[-1].member, yyvsp[0].defaults))
 				YYERROR;
 			}
 break;
 case 15:
-#line 220 "gram.y"
+#line 222 "gram.y"
 {
 			    if (!add_defaults(DEFAULTS_HOST, yyvsp[-1].member, yyvsp[0].defaults))
 				YYERROR;
 			}
 break;
 case 16:
-#line 224 "gram.y"
+#line 226 "gram.y"
 {
 			    if (!add_defaults(DEFAULTS_CMND, yyvsp[-1].member, yyvsp[0].defaults))
 				YYERROR;
 			}
 break;
 case 18:
-#line 231 "gram.y"
+#line 233 "gram.y"
 {
 			    HLTQ_CONCAT(yyvsp[-2].defaults, yyvsp[0].defaults, entries);
 			    yyval.defaults = yyvsp[-2].defaults;
 			}
 break;
 case 19:
-#line 237 "gram.y"
+#line 239 "gram.y"
 {
 			    yyval.defaults = new_default(yyvsp[0].string, NULL, true);
 			    if (yyval.defaults == NULL) {
@@ -1408,7 +1413,7 @@ case 19:
 			}
 break;
 case 20:
-#line 244 "gram.y"
+#line 246 "gram.y"
 {
 			    yyval.defaults = new_default(yyvsp[0].string, NULL, false);
 			    if (yyval.defaults == NULL) {
@@ -1418,7 +1423,7 @@ case 20:
 			}
 break;
 case 21:
-#line 251 "gram.y"
+#line 253 "gram.y"
 {
 			    yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, true);
 			    if (yyval.defaults == NULL) {
@@ -1428,7 +1433,7 @@ case 21:
 			}
 break;
 case 22:
-#line 258 "gram.y"
+#line 260 "gram.y"
 {
 			    yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, '+');
 			    if (yyval.defaults == NULL) {
@@ -1438,7 +1443,7 @@ case 22:
 			}
 break;
 case 23:
-#line 265 "gram.y"
+#line 267 "gram.y"
 {
 			    yyval.defaults = new_default(yyvsp[-2].string, yyvsp[0].string, '-');
 			    if (yyval.defaults == NULL) {
@@ -1448,14 +1453,14 @@ case 23:
 			}
 break;
 case 25:
-#line 275 "gram.y"
+#line 277 "gram.y"
 {
 			    HLTQ_CONCAT(yyvsp[-2].privilege, yyvsp[0].privilege, entries);
 			    yyval.privilege = yyvsp[-2].privilege;
 			}
 break;
 case 26:
-#line 281 "gram.y"
+#line 283 "gram.y"
 {
 			    struct privilege *p = calloc(1, sizeof(*p));
 			    if (p == NULL) {
@@ -1470,21 +1475,21 @@ case 26:
 			}
 break;
 case 27:
-#line 295 "gram.y"
+#line 297 "gram.y"
 {
 			    yyval.member = yyvsp[0].member;
 			    yyval.member->negated = false;
 			}
 break;
 case 28:
-#line 299 "gram.y"
+#line 301 "gram.y"
 {
 			    yyval.member = yyvsp[0].member;
 			    yyval.member->negated = true;
 			}
 break;
 case 29:
-#line 305 "gram.y"
+#line 307 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, ALIAS);
 			    if (yyval.member == NULL) {
@@ -1494,7 +1499,7 @@ case 29:
 			}
 break;
 case 30:
-#line 312 "gram.y"
+#line 314 "gram.y"
 {
 			    yyval.member = new_member(NULL, ALL);
 			    if (yyval.member == NULL) {
@@ -1504,7 +1509,7 @@ case 30:
 			}
 break;
 case 31:
-#line 319 "gram.y"
+#line 321 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, NETGROUP);
 			    if (yyval.member == NULL) {
@@ -1514,7 +1519,7 @@ case 31:
 			}
 break;
 case 32:
-#line 326 "gram.y"
+#line 328 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, NTWKADDR);
 			    if (yyval.member == NULL) {
@@ -1524,7 +1529,7 @@ case 32:
 			}
 break;
 case 33:
-#line 333 "gram.y"
+#line 335 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, WORD);
 			    if (yyval.member == NULL) {
@@ -1534,7 +1539,7 @@ case 33:
 			}
 break;
 case 35:
-#line 343 "gram.y"
+#line 345 "gram.y"
 {
 			    struct cmndspec *prev;
 			    prev = HLTQ_LAST(yyvsp[-2].cmndspec, cmndspec, entries);
@@ -1588,7 +1593,7 @@ case 35:
 			}
 break;
 case 36:
-#line 396 "gram.y"
+#line 398 "gram.y"
 {
 			    struct cmndspec *cs = calloc(1, sizeof(*cs));
 			    if (cs == NULL) {
@@ -1640,7 +1645,7 @@ case 36:
 			}
 break;
 case 37:
-#line 447 "gram.y"
+#line 449 "gram.y"
 {
 			    yyval.digest = new_digest(SUDO_DIGEST_SHA224, yyvsp[0].string);
 			    if (yyval.digest == NULL) {
@@ -1650,7 +1655,7 @@ case 37:
 			}
 break;
 case 38:
-#line 454 "gram.y"
+#line 456 "gram.y"
 {
 			    yyval.digest = new_digest(SUDO_DIGEST_SHA256, yyvsp[0].string);
 			    if (yyval.digest == NULL) {
@@ -1660,7 +1665,7 @@ case 38:
 			}
 break;
 case 39:
-#line 461 "gram.y"
+#line 463 "gram.y"
 {
 			    yyval.digest = new_digest(SUDO_DIGEST_SHA384, yyvsp[0].string);
 			    if (yyval.digest == NULL) {
@@ -1670,7 +1675,7 @@ case 39:
 			}
 break;
 case 40:
-#line 468 "gram.y"
+#line 470 "gram.y"
 {
 			    yyval.digest = new_digest(SUDO_DIGEST_SHA512, yyvsp[0].string);
 			    if (yyval.digest == NULL) {
@@ -1680,13 +1685,13 @@ case 40:
 			}
 break;
 case 41:
-#line 477 "gram.y"
+#line 479 "gram.y"
 {
 			    yyval.member = yyvsp[0].member;
 			}
 break;
 case 42:
-#line 480 "gram.y"
+#line 482 "gram.y"
 {
 			    if (yyvsp[0].member->type != COMMAND) {
 				sudoerserror(N_("a digest requires a path name"));
@@ -1698,75 +1703,75 @@ case 42:
 			}
 break;
 case 43:
-#line 491 "gram.y"
+#line 493 "gram.y"
 {
 			    yyval.member = yyvsp[0].member;
 			    yyval.member->negated = false;
 			}
 break;
 case 44:
-#line 495 "gram.y"
+#line 497 "gram.y"
 {
 			    yyval.member = yyvsp[0].member;
 			    yyval.member->negated = true;
 			}
 break;
 case 45:
-#line 501 "gram.y"
+#line 503 "gram.y"
 {
 			    yyval.string = yyvsp[0].string;
 			}
 break;
 case 46:
-#line 506 "gram.y"
+#line 508 "gram.y"
 {
 			    yyval.string = yyvsp[0].string;
 			}
 break;
 case 47:
-#line 510 "gram.y"
+#line 512 "gram.y"
 {
 			    yyval.string = yyvsp[0].string;
 			}
 break;
 case 48:
-#line 515 "gram.y"
+#line 517 "gram.y"
 {
 			    yyval.string = yyvsp[0].string;
 			}
 break;
 case 49:
-#line 520 "gram.y"
+#line 522 "gram.y"
 {
 			    yyval.string = yyvsp[0].string;
 			}
 break;
 case 50:
-#line 525 "gram.y"
+#line 527 "gram.y"
 {
 			    yyval.string = yyvsp[0].string;
 			}
 break;
 case 51:
-#line 529 "gram.y"
+#line 531 "gram.y"
 {
 			    yyval.string = yyvsp[0].string;
 			}
 break;
 case 52:
-#line 534 "gram.y"
+#line 536 "gram.y"
 {
 			    yyval.runas = NULL;
 			}
 break;
 case 53:
-#line 537 "gram.y"
+#line 539 "gram.y"
 {
 			    yyval.runas = yyvsp[-1].runas;
 			}
 break;
 case 54:
-#line 542 "gram.y"
+#line 544 "gram.y"
 {
 			    yyval.runas = calloc(1, sizeof(struct runascontainer));
 			    if (yyval.runas != NULL) {
@@ -1784,7 +1789,7 @@ case 54:
 			}
 break;
 case 55:
-#line 557 "gram.y"
+#line 559 "gram.y"
 {
 			    yyval.runas = calloc(1, sizeof(struct runascontainer));
 			    if (yyval.runas == NULL) {
@@ -1796,7 +1801,7 @@ case 55:
 			}
 break;
 case 56:
-#line 566 "gram.y"
+#line 568 "gram.y"
 {
 			    yyval.runas = calloc(1, sizeof(struct runascontainer));
 			    if (yyval.runas == NULL) {
@@ -1808,7 +1813,7 @@ case 56:
 			}
 break;
 case 57:
-#line 575 "gram.y"
+#line 577 "gram.y"
 {
 			    yyval.runas = calloc(1, sizeof(struct runascontainer));
 			    if (yyval.runas == NULL) {
@@ -1820,7 +1825,7 @@ case 57:
 			}
 break;
 case 58:
-#line 584 "gram.y"
+#line 586 "gram.y"
 {
 			    yyval.runas = calloc(1, sizeof(struct runascontainer));
 			    if (yyval.runas != NULL) {
@@ -1838,13 +1843,13 @@ case 58:
 			}
 break;
 case 59:
-#line 601 "gram.y"
+#line 603 "gram.y"
 {
 			    init_options(&yyval.options);
 			}
 break;
 case 60:
-#line 604 "gram.y"
+#line 606 "gram.y"
 {
 			    yyval.options.notbefore = parse_gentime(yyvsp[0].string);
 			    free(yyvsp[0].string);
@@ -1855,7 +1860,7 @@ case 60:
 			}
 break;
 case 61:
-#line 612 "gram.y"
+#line 614 "gram.y"
 {
 			    yyval.options.notafter = parse_gentime(yyvsp[0].string);
 			    free(yyvsp[0].string);
@@ -1866,7 +1871,7 @@ case 61:
 			}
 break;
 case 62:
-#line 620 "gram.y"
+#line 622 "gram.y"
 {
 			    yyval.options.timeout = parse_timeout(yyvsp[0].string);
 			    free(yyvsp[0].string);
@@ -1880,7 +1885,7 @@ case 62:
 			}
 break;
 case 63:
-#line 631 "gram.y"
+#line 633 "gram.y"
 {
 #ifdef HAVE_SELINUX
 			    free(yyval.options.role);
@@ -1889,7 +1894,7 @@ case 63:
 			}
 break;
 case 64:
-#line 637 "gram.y"
+#line 639 "gram.y"
 {
 #ifdef HAVE_SELINUX
 			    free(yyval.options.type);
@@ -1898,7 +1903,7 @@ case 64:
 			}
 break;
 case 65:
-#line 643 "gram.y"
+#line 645 "gram.y"
 {
 #ifdef HAVE_PRIV_SET
 			    free(yyval.options.privs);
@@ -1907,7 +1912,7 @@ case 65:
 			}
 break;
 case 66:
-#line 649 "gram.y"
+#line 651 "gram.y"
 {
 #ifdef HAVE_PRIV_SET
 			    free(yyval.options.limitprivs);
@@ -1916,97 +1921,97 @@ case 66:
 			}
 break;
 case 67:
-#line 657 "gram.y"
+#line 659 "gram.y"
 {
 			    TAGS_INIT(yyval.tag);
 			}
 break;
 case 68:
-#line 660 "gram.y"
+#line 662 "gram.y"
 {
 			    yyval.tag.nopasswd = true;
 			}
 break;
 case 69:
-#line 663 "gram.y"
+#line 665 "gram.y"
 {
 			    yyval.tag.nopasswd = false;
 			}
 break;
 case 70:
-#line 666 "gram.y"
+#line 668 "gram.y"
 {
 			    yyval.tag.noexec = true;
 			}
 break;
 case 71:
-#line 669 "gram.y"
+#line 671 "gram.y"
 {
 			    yyval.tag.noexec = false;
 			}
 break;
 case 72:
-#line 672 "gram.y"
+#line 674 "gram.y"
 {
 			    yyval.tag.setenv = true;
 			}
 break;
 case 73:
-#line 675 "gram.y"
+#line 677 "gram.y"
 {
 			    yyval.tag.setenv = false;
 			}
 break;
 case 74:
-#line 678 "gram.y"
+#line 680 "gram.y"
 {
 			    yyval.tag.log_input = true;
 			}
 break;
 case 75:
-#line 681 "gram.y"
+#line 683 "gram.y"
 {
 			    yyval.tag.log_input = false;
 			}
 break;
 case 76:
-#line 684 "gram.y"
+#line 686 "gram.y"
 {
 			    yyval.tag.log_output = true;
 			}
 break;
 case 77:
-#line 687 "gram.y"
+#line 689 "gram.y"
 {
 			    yyval.tag.log_output = false;
 			}
 break;
 case 78:
-#line 690 "gram.y"
+#line 692 "gram.y"
 {
 			    yyval.tag.follow = true;
 			}
 break;
 case 79:
-#line 693 "gram.y"
+#line 695 "gram.y"
 {
 			    yyval.tag.follow = false;
 			}
 break;
 case 80:
-#line 696 "gram.y"
+#line 698 "gram.y"
 {
 			    yyval.tag.send_mail = true;
 			}
 break;
 case 81:
-#line 699 "gram.y"
+#line 701 "gram.y"
 {
 			    yyval.tag.send_mail = false;
 			}
 break;
 case 82:
-#line 704 "gram.y"
+#line 706 "gram.y"
 {
 			    yyval.member = new_member(NULL, ALL);
 			    if (yyval.member == NULL) {
@@ -2016,7 +2021,7 @@ case 82:
 			}
 break;
 case 83:
-#line 711 "gram.y"
+#line 713 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, ALIAS);
 			    if (yyval.member == NULL) {
@@ -2026,7 +2031,7 @@ case 83:
 			}
 break;
 case 84:
-#line 718 "gram.y"
+#line 720 "gram.y"
 {
 			    struct sudo_command *c = calloc(1, sizeof(*c));
 			    if (c == NULL) {
@@ -2044,7 +2049,7 @@ case 84:
 			}
 break;
 case 87:
-#line 739 "gram.y"
+#line 741 "gram.y"
 {
 			    const char *s;
 			    s = alias_add(&parsed_policy, yyvsp[-2].string, HOSTALIAS,
@@ -2056,14 +2061,14 @@ case 87:
 			}
 break;
 case 89:
-#line 751 "gram.y"
+#line 753 "gram.y"
 {
 			    HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries);
 			    yyval.member = yyvsp[-2].member;
 			}
 break;
 case 92:
-#line 761 "gram.y"
+#line 763 "gram.y"
 {
 			    const char *s;
 			    s = alias_add(&parsed_policy, yyvsp[-2].string, CMNDALIAS,
@@ -2075,14 +2080,14 @@ case 92:
 			}
 break;
 case 94:
-#line 773 "gram.y"
+#line 775 "gram.y"
 {
 			    HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries);
 			    yyval.member = yyvsp[-2].member;
 			}
 break;
 case 97:
-#line 783 "gram.y"
+#line 785 "gram.y"
 {
 			    const char *s;
 			    s = alias_add(&parsed_policy, yyvsp[-2].string, RUNASALIAS,
@@ -2094,7 +2099,7 @@ case 97:
 			}
 break;
 case 100:
-#line 798 "gram.y"
+#line 800 "gram.y"
 {
 			    const char *s;
 			    s = alias_add(&parsed_policy, yyvsp[-2].string, USERALIAS,
@@ -2106,28 +2111,28 @@ case 100:
 			}
 break;
 case 102:
-#line 810 "gram.y"
+#line 812 "gram.y"
 {
 			    HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries);
 			    yyval.member = yyvsp[-2].member;
 			}
 break;
 case 103:
-#line 816 "gram.y"
+#line 818 "gram.y"
 {
 			    yyval.member = yyvsp[0].member;
 			    yyval.member->negated = false;
 			}
 break;
 case 104:
-#line 820 "gram.y"
+#line 822 "gram.y"
 {
 			    yyval.member = yyvsp[0].member;
 			    yyval.member->negated = true;
 			}
 break;
 case 105:
-#line 826 "gram.y"
+#line 828 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, ALIAS);
 			    if (yyval.member == NULL) {
@@ -2137,7 +2142,7 @@ case 105:
 			}
 break;
 case 106:
-#line 833 "gram.y"
+#line 835 "gram.y"
 {
 			    yyval.member = new_member(NULL, ALL);
 			    if (yyval.member == NULL) {
@@ -2147,7 +2152,7 @@ case 106:
 			}
 break;
 case 107:
-#line 840 "gram.y"
+#line 842 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, NETGROUP);
 			    if (yyval.member == NULL) {
@@ -2157,7 +2162,7 @@ case 107:
 			}
 break;
 case 108:
-#line 847 "gram.y"
+#line 849 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, USERGROUP);
 			    if (yyval.member == NULL) {
@@ -2167,7 +2172,7 @@ case 108:
 			}
 break;
 case 109:
-#line 854 "gram.y"
+#line 856 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, WORD);
 			    if (yyval.member == NULL) {
@@ -2177,28 +2182,28 @@ case 109:
 			}
 break;
 case 111:
-#line 864 "gram.y"
+#line 866 "gram.y"
 {
 			    HLTQ_CONCAT(yyvsp[-2].member, yyvsp[0].member, entries);
 			    yyval.member = yyvsp[-2].member;
 			}
 break;
 case 112:
-#line 870 "gram.y"
+#line 872 "gram.y"
 {
 			    yyval.member = yyvsp[0].member;
 			    yyval.member->negated = false;
 			}
 break;
 case 113:
-#line 874 "gram.y"
+#line 876 "gram.y"
 {
 			    yyval.member = yyvsp[0].member;
 			    yyval.member->negated = true;
 			}
 break;
 case 114:
-#line 880 "gram.y"
+#line 882 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, ALIAS);
 			    if (yyval.member == NULL) {
@@ -2208,7 +2213,7 @@ case 114:
 			}
 break;
 case 115:
-#line 887 "gram.y"
+#line 889 "gram.y"
 {
 			    yyval.member = new_member(NULL, ALL);
 			    if (yyval.member == NULL) {
@@ -2218,7 +2223,7 @@ case 115:
 			}
 break;
 case 116:
-#line 894 "gram.y"
+#line 896 "gram.y"
 {
 			    yyval.member = new_member(yyvsp[0].string, WORD);
 			    if (yyval.member == NULL) {
@@ -2227,7 +2232,7 @@ case 116:
 			    }
 			}
 break;
-#line 2173 "gram.c"
+#line 2178 "gram.c"
     }
     yyssp -= yym;
     yystate = *yyssp;
Index: sudo-1.8.27/plugins/sudoers/gram.y
===================================================================
--- sudo-1.8.27.orig/plugins/sudoers/gram.y
+++ sudo-1.8.27/plugins/sudoers/gram.y
@@ -61,7 +61,9 @@ char *errorfile = NULL;
 struct sudoers_parse_tree parsed_policy = {
     TAILQ_HEAD_INITIALIZER(parsed_policy.userspecs),
     TAILQ_HEAD_INITIALIZER(parsed_policy.defaults),
-    NULL /* aliases */
+    NULL, /* aliases */
+    NULL, /* lhost */
+    NULL /* shost */
 };
 
 /*
@@ -1244,11 +1246,14 @@ free_userspec(struct userspec *us)
  * Initialized a sudoers parse tree.
  */
 void
-init_parse_tree(struct sudoers_parse_tree *parse_tree)
+init_parse_tree(struct sudoers_parse_tree *parse_tree, const char *lhost,
+    const char *shost)
 {
     TAILQ_INIT(&parse_tree->userspecs);
     TAILQ_INIT(&parse_tree->defaults);
     parse_tree->aliases = NULL;
+    parse_tree->shost = shost;
+    parse_tree->lhost = lhost;
 }
 
 /*
Index: sudo-1.8.27/plugins/sudoers/ldap.c
===================================================================
--- sudo-1.8.27.orig/plugins/sudoers/ldap.c
+++ sudo-1.8.27/plugins/sudoers/ldap.c
@@ -1665,7 +1665,7 @@ sudo_ldap_open(struct sudo_nss *nss)
     }
     handle->ld = ld;
     /* handle->pw = NULL; */
-    init_parse_tree(&handle->parse_tree);
+    init_parse_tree(&handle->parse_tree, NULL, NULL);
     nss->handle = handle;
 
 done:
Index: sudo-1.8.27/plugins/sudoers/match.c
===================================================================
--- sudo-1.8.27.orig/plugins/sudoers/match.c
+++ sudo-1.8.27/plugins/sudoers/match.c
@@ -99,8 +99,10 @@ int
 user_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw,
     const struct member *m)
 {
-    struct alias *a;
+    const char *lhost = parse_tree->lhost ? parse_tree->lhost : user_runhost;
+    const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost;
     int matched = UNSPEC;
+    struct alias *a;
     debug_decl(user_matches, SUDOERS_DEBUG_MATCH)
 
     switch (m->type) {
@@ -109,8 +111,8 @@ user_matches(struct sudoers_parse_tree *
 	    break;
 	case NETGROUP:
 	    if (netgr_matches(m->name,
-		def_netgroup_tuple ? user_runhost : NULL,
-		def_netgroup_tuple ? user_srunhost : NULL, pw->pw_name))
+		def_netgroup_tuple ? lhost : NULL,
+		def_netgroup_tuple ? shost : NULL, pw->pw_name))
 		matched = !m->negated;
 	    break;
 	case USERGROUP:
@@ -180,11 +182,13 @@ runaslist_matches(struct sudoers_parse_t
     const struct member_list *user_list, const struct member_list *group_list,
     struct member **matching_user, struct member **matching_group)
 {
+    const char *lhost = parse_tree->lhost ? parse_tree->lhost : user_runhost;
+    const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost;
+    int user_matched = UNSPEC;
+    int group_matched = UNSPEC;
     struct member *m;
     struct alias *a;
     int rc;
-    int user_matched = UNSPEC;
-    int group_matched = UNSPEC;
     debug_decl(runaslist_matches, SUDOERS_DEBUG_MATCH)
 
     if (ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) || !ISSET(sudo_user.flags, RUNAS_GROUP_SPECIFIED)) {
@@ -202,8 +206,8 @@ runaslist_matches(struct sudoers_parse_t
 			break;
 		    case NETGROUP:
 			if (netgr_matches(m->name,
-			    def_netgroup_tuple ? user_runhost : NULL,
-			    def_netgroup_tuple ? user_srunhost : NULL,
+			    def_netgroup_tuple ? lhost : NULL,
+			    def_netgroup_tuple ? shost : NULL,
 			    runas_pw->pw_name))
 			    user_matched = !m->negated;
 			break;
@@ -336,7 +340,10 @@ int
 hostlist_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw,
     const struct member_list *list)
 {
-    return hostlist_matches_int(parse_tree, pw, user_runhost, user_srunhost, list);
+    const char *lhost = parse_tree->lhost ? parse_tree->lhost : user_runhost;
+    const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost;
+
+    return hostlist_matches_int(parse_tree, pw, lhost, shost, list);
 }
 
 /*
Index: sudo-1.8.27/plugins/sudoers/parse.h
===================================================================
--- sudo-1.8.27.orig/plugins/sudoers/parse.h
+++ sudo-1.8.27/plugins/sudoers/parse.h
@@ -265,6 +265,7 @@ struct sudoers_parse_tree {
     struct userspec_list userspecs;
     struct defaults_list defaults;
     struct rbtree *aliases;
+    const char *shost, *lhost;
 };
 
 /* alias.c */
@@ -290,7 +291,7 @@ void free_userspec(struct userspec *us);
 void free_userspecs(struct userspec_list *usl);
 void free_default(struct defaults *def, struct member_list **binding);
 void free_defaults(struct defaults_list *defs);
-void init_parse_tree(struct sudoers_parse_tree *parse_tree);
+void init_parse_tree(struct sudoers_parse_tree *parse_tree, const char *shost, const char *lhost);
 void free_parse_tree(struct sudoers_parse_tree *parse_tree);
 void reparent_parse_tree(struct sudoers_parse_tree *new_tree);
 
Index: sudo-1.8.27/plugins/sudoers/sssd.c
===================================================================
--- sudo-1.8.27.orig/plugins/sudoers/sssd.c
+++ sudo-1.8.27/plugins/sudoers/sssd.c
@@ -552,7 +552,6 @@ sudo_sss_open(struct sudo_nss *nss)
 	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
 	debug_return_int(ENOMEM);
     }
-    init_parse_tree(&handle->parse_tree);
 
     /* Load symbols */
     handle->ssslib = sudo_dso_load(path, SUDO_DSO_LAZY);
@@ -610,8 +609,6 @@ sudo_sss_open(struct sudo_nss *nss)
 	debug_return_int(EFAULT);
     }
 
-    nss->handle = handle;
-
     /*
      * If runhost is the same as the local host, check for ipa_hostname
      * in sssd.conf and use it in preference to user_runhost.
@@ -623,6 +620,10 @@ sudo_sss_open(struct sudo_nss *nss)
 	}
     }
 
+    /* The "parse tree" contains userspecs, defaults, aliases and hostnames. */
+    init_parse_tree(&handle->parse_tree, handle->ipa_host, handle->ipa_shost);
+    nss->handle = handle;
+
     sudo_debug_printf(SUDO_DEBUG_DEBUG, "handle=%p", handle);
 
     debug_return_int(0);

Places

File sudo-1.8.27-ipa_hostname.patch of Package sudo (Revision c23b87af7568c3bb7c1d94244488c70b)

Places