sudo_sss_check_user: Fix evaluation of negative entries in sudoUser

millert · millert · commit 00c60751b8f3 · 2026-04-23T07:22:39.000-06:00
When support was added for negated entries in a sudoUser, the loop
invariant was not modified to continue checking event after a
positive match was found.
diff --git a/plugins/sudoers/sssd.c b/plugins/sudoers/sssd.c
@@ -1,7 +1,7 @@
 /*
  * SPDX-License-Identifier: ISC
  *
- * Copyright (c) 2003-2022 Todd C. Miller <Todd.Miller@sudo.ws>
+ * Copyright (c) 2003-2023, 2026 Todd C. Miller <Todd.Miller@sudo.ws>
  * Copyright (c) 2011 Daniel Kopecek <dkopecek@redhat.com>
  *
  * This code is derived from software contributed by Aaron Spangler.
@@ -187,7 +187,7 @@ sudo_sss_check_user(struct sudoers_context *ctx, struct sudo_sss_handle *handle,
     }
 
     /* Walk through sudoUser values.  */
-    for (i = 0; val_array[i] != NULL && !ret; ++i) {
+    for (i = 0; val_array[i] != NULL; ++i) {
 	const char *val = val_array[i];
 	bool negated = false;
 

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`/*`
`2`	`2`	`* SPDX-License-Identifier: ISC`
`3`	`3`	`*`
`4`		`- * Copyright (c) 2003-2022 Todd C. Miller <[email protected]>`
	`4`	`+ * Copyright (c) 2003-2023, 2026 Todd C. Miller <[email protected]>`
`5`	`5`	`* Copyright (c) 2011 Daniel Kopecek <[email protected]>`
`6`	`6`	`*`
`7`	`7`	`* This code is derived from software contributed by Aaron Spangler.`
`@@ -187,7 +187,7 @@ sudo_sss_check_user(struct sudoers_context ctx, struct sudo_sss_handle handle,`
`187`	`187`	`}`
`188`	`188`
`189`	`189`	`/* Walk through sudoUser values. */`
`190`		`- for (i = 0; val_array[i] != NULL && !ret; ++i) {`
	`190`	`+ for (i = 0; val_array[i] != NULL; ++i) {`
`191`	`191`	`const char *val = val_array[i];`
`192`	`192`	`bool negated = false;`
`193`	`193`