From 24a087709abb8375b79b17d45b6a4cbdb72bbeec Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Mon, 16 May 2011 12:19:07 -0400 Subject: [PATCH] Only check gid of sudoers file if it is group-readable. --- plugins/sudoers/sudoers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c index f533e591b..b0a3b86e8 100644 --- a/plugins/sudoers/sudoers.c +++ b/plugins/sudoers/sudoers.c @@ -930,7 +930,7 @@ open_sudoers(const char *sudoers, int doedit, int *keepopen) else if (statbuf.st_uid != sudoers_uid) log_error(NO_EXIT, "%s is owned by uid %u, should be %u", sudoers, (unsigned int) statbuf.st_uid, (unsigned int) sudoers_uid); - else if (statbuf.st_gid != sudoers_gid) + else if (ISSET(statbuf.st_mode, S_IRGRP) && statbuf.st_gid != sudoers_gid) log_error(NO_EXIT, "%s is owned by gid %u, should be %u", sudoers, (unsigned int) statbuf.st_gid, (unsigned int) sudoers_gid); else if ((fp = fopen(sudoers, "r")) == NULL)