Add support for matching the entire netgroup tuple (user, host, domain).

doc/sudoers.cat

@@ -890,14 +890,6 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
                        This flag is _o_n by default when ssuuddoo is compiled with
                        zzlliibb support.
 
-     use_netgroups     If set, netgroups (prefixed with `+'), may be used in
-                       place of a user or host.  For LDAP-based sudoers,
-                       netgroup support requires an expensive substring match
-                       on the server unless the NNEETTGGRROOUUPP__BBAASSEE directive is
-                       present in the _/_e_t_c_/_l_d_a_p_._c_o_n_f file.  If netgroups are
-                       not needed, this option can be disabled to reduce the
-                       load on the LDAP server.  This flag is _o_n by default.
-
      exec_background   By default, ssuuddoo runs a command as the foreground
                        process as long as ssuuddoo itself is running in the
                        foreground.  When the _e_x_e_c___b_a_c_k_g_r_o_u_n_d flag is enabled
@@ -1140,6 +1132,13 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
                        invoking user is not in the _s_u_d_o_e_r_s file.  This flag is
                        _o_n by default.
 
+     netgroup_tuple    If set, netgroup lookups will be performed using the
+                       full netgroup tuple: host name, user name and domain
+                       (if one is set).  Historically, ssuuddoo only matched the
+                       user name and domain for netgroups used in a User_List
+                       and only matched the host name and domain for netgroups
+                       used in a Host_List.  This flag is _o_f_f by default.
+
      noexec            If set, all commands run via ssuuddoo will behave as if the
                        NOEXEC tag has been set, unless overridden by an EXEC
                        tag.  See the description of _E_X_E_C _a_n_d _N_O_E_X_E_C above as
@@ -1337,6 +1336,14 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
                        available if ssuuddoo is configured with the
                        --with-logincap option.  This flag is _o_f_f by default.
 
+     use_netgroups     If set, netgroups (prefixed with `+'), may be used in
+                       place of a user or host.  For LDAP-based sudoers,
+                       netgroup support requires an expensive substring match
+                       on the server unless the NNEETTGGRROOUUPP__BBAASSEE directive is
+                       present in the _/_e_t_c_/_l_d_a_p_._c_o_n_f file.  If netgroups are
+                       not needed, this option can be disabled to reduce the
+                       load on the LDAP server.  This flag is _o_n by default.
+
      use_pty           If set, ssuuddoo will run the command in a pseudo-pty even
                        if no I/O logging is being gone.  A malicious program
                        run under ssuuddoo could conceivably fork a background
@@ -2498,4 +2505,4 @@ DDIISSCCLLAAIIMMEERR
      file distributed with ssuuddoo or https://www.sudo.ws/license.html for
      complete details.
 
-Sudo 1.8.16                     January 9, 2016                    Sudo 1.8.16
+Sudo 1.8.16                    January 12, 2016                    Sudo 1.8.16

doc/sudoers.man.in

@@ -21,7 +21,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.TH "SUDOERS" "5" "January 9, 2016" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
+.TH "SUDOERS" "5" "January 12, 2016" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -1926,22 +1926,6 @@ is compiled with
 \fBzlib\fR
 support.
 .TP 18n
-use_netgroups
-If set, netgroups (prefixed with
-\(oq+\(cq),
-may be used in place of a user or host.
-For LDAP-based sudoers, netgroup support requires an expensive
-substring match on the server unless the
-\fBNETGROUP_BASE\fR
-directive is present in the
-\fI@ldap_conf@\fR
-file.
-If netgroups are not needed, this option can be disabled to reduce the
-load on the LDAP server.
-This flag is
-\fIon\fR
-by default.
-.TP 18n
 exec_background
 By default,
 \fBsudo\fR
@@ -2424,6 +2408,19 @@ This flag is
 \fI@mail_no_user@\fR
 by default.
 .TP 18n
+netgroup_tuple
+If set, netgroup lookups will be performed using the full netgroup
+tuple: host name, user name and domain (if one is set).
+Historically,
+\fBsudo\fR
+only matched the user name and domain for netgroups used in a
+\fRUser_List\fR
+and only matched the host name and domain for netgroups used in a
+\fRHost_List\fR.
+This flag is
+\fIoff\fR
+by default.
+.TP 18n
 noexec
 If set, all commands run via
 \fBsudo\fR
@@ -2842,6 +2839,22 @@ This flag is
 \fIoff\fR
 by default.
 .TP 18n
+use_netgroups
+If set, netgroups (prefixed with
+\(oq+\(cq),
+may be used in place of a user or host.
+For LDAP-based sudoers, netgroup support requires an expensive
+substring match on the server unless the
+\fBNETGROUP_BASE\fR
+directive is present in the
+\fI@ldap_conf@\fR
+file.
+If netgroups are not needed, this option can be disabled to reduce the
+load on the LDAP server.
+This flag is
+\fIon\fR
+by default.
+.TP 18n
 use_pty
 If set,
 \fBsudo\fR

doc/sudoers.mdoc.in

@@ -19,7 +19,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.Dd January 9, 2016
+.Dd January 12, 2016
 .Dt SUDOERS @mansectform@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -1796,21 +1796,6 @@ by default when
 is compiled with
 .Sy zlib
 support.
-.It use_netgroups
-If set, netgroups (prefixed with
-.Ql + ) ,
-may be used in place of a user or host.
-For LDAP-based sudoers, netgroup support requires an expensive
-substring match on the server unless the
-.Sy NETGROUP_BASE
-directive is present in the
-.Pa @ldap_conf@
-file.
-If netgroups are not needed, this option can be disabled to reduce the
-load on the LDAP server.
-This flag is
-.Em on
-by default.
 .It exec_background
 By default,
 .Nm sudo
@@ -2276,6 +2261,18 @@ file.
 This flag is
 .Em @mail_no_user@
 by default.
+.It netgroup_tuple
+If set, netgroup lookups will be performed using the full netgroup
+tuple: host name, user name and domain (if one is set).
+Historically,
+.Nm sudo
+only matched the user name and domain for netgroups used in a
+.Li User_List
+and only matched the host name and domain for netgroups used in a
+.Li Host_List .
+This flag is
+.Em off
+by default.
 .It noexec
 If set, all commands run via
 .Nm sudo
@@ -2670,6 +2667,21 @@ option.
 This flag is
 .Em off
 by default.
+.It use_netgroups
+If set, netgroups (prefixed with
+.Ql + ) ,
+may be used in place of a user or host.
+For LDAP-based sudoers, netgroup support requires an expensive
+substring match on the server unless the
+.Sy NETGROUP_BASE
+directive is present in the
+.Pa @ldap_conf@
+file.
+If netgroups are not needed, this option can be disabled to reduce the
+load on the LDAP server.
+This flag is
+.Em on
+by default.
 .It use_pty
 If set,
 .Nm sudo

plugins/sudoers/def_data.c

@@ -398,6 +398,10 @@ struct sudo_defs_types sudo_defs_table[] = {
 	"always_query_group_plugin", T_FLAG,
 	N_("Query the group plugin for unknown system groups"),
 	NULL,
+    }, {
+	"netgroup_tuple", T_FLAG,
+	N_("Match netgroups based on the entire tuple: user, host and domain"),
+	NULL,
     }, {
 	NULL, 0, NULL
     }

plugins/sudoers/def_data.h

@@ -186,6 +186,8 @@
 #define I_SUDOEDIT_FOLLOW       92
 #define def_always_query_group_plugin (sudo_defs_table[93].sd_un.flag)
 #define I_ALWAYS_QUERY_GROUP_PLUGIN93
+#define def_netgroup_tuple      (sudo_defs_table[94].sd_un.flag)
+#define I_NETGROUP_TUPLE        94
 
 enum def_tuple {
 	never,

plugins/sudoers/def_data.in

@@ -295,3 +295,6 @@ sudoedit_follow
 always_query_group_plugin
 	T_FLAG
 	"Query the group plugin for unknown system groups"
+netgroup_tuple
+	T_FLAG
+	"Match netgroups based on the entire tuple: user, host and domain"

plugins/sudoers/defaults.c

@@ -439,6 +439,7 @@ init_defaults(void)
 #ifdef HAVE_INNETGR
     def_use_netgroups = true;
 #endif
+    def_netgroup_tuple = false;
 
     /* Syslog options need special care since they both strings and ints */
 #if (LOGGING & SLOG_SYSLOG)
@@ -549,7 +550,7 @@ update_defaults(int what)
 		break;
 	    case DEFAULTS_HOST:
 		if (ISSET(what, SETDEF_HOST) &&
-		    hostlist_matches(def->binding) == ALLOW &&
+		    hostlist_matches(sudo_user.pw, def->binding) == ALLOW &&
 		    !set_default(def->var, def->val, def->op))
 		    rc = false;
 		break;

plugins/sudoers/ldap.c

@@ -694,7 +694,8 @@ sudo_ldap_check_non_unix_group(LDAP *ld, LDAPMessage *entry, struct passwd *pw)
     for (p = bv; *p != NULL && !ret; p++) {
 	val = (*p)->bv_val;
 	if (*val == '+') {
-	    if (netgr_matches(val, NULL, NULL, pw->pw_name))
+	    if (netgr_matches(val, def_netgroup_tuple ? user_runhost : NULL,
+		def_netgroup_tuple ? user_srunhost : NULL, pw->pw_name))
 		ret = true;
 	    DPRINTF2("ldap sudoUser netgroup '%s' ... %s", val,
 		ret ? "MATCH!" : "not");
@@ -716,7 +717,7 @@ sudo_ldap_check_non_unix_group(LDAP *ld, LDAPMessage *entry, struct passwd *pw)
 * host match, else false.
 */
 static bool
-sudo_ldap_check_host(LDAP *ld, LDAPMessage *entry)
+sudo_ldap_check_host(LDAP *ld, LDAPMessage *entry, struct passwd *pw)
 {
     struct berval **bv, **p;
     char *val;
@@ -736,7 +737,8 @@ sudo_ldap_check_host(LDAP *ld, LDAPMessage *entry)
 	val = (*p)->bv_val;
 	/* match any or address or netgroup or hostname */
 	if (!strcmp(val, "ALL") || addr_matches(val) ||
-	    netgr_matches(val, user_runhost, user_srunhost, NULL) ||
+	    netgr_matches(val, user_runhost, user_srunhost,
+	    def_netgroup_tuple ? pw->pw_name : NULL) ||
 	    hostname_matches(user_srunhost, user_runhost, val))
 	    ret = true;
 	DPRINTF2("ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
@@ -792,7 +794,8 @@ sudo_ldap_check_runas_user(LDAP *ld, LDAPMessage *entry)
 	val = (*p)->bv_val;
 	switch (val[0]) {
 	case '+':
-	    if (netgr_matches(val, NULL, NULL, runas_pw->pw_name))
+	    if (netgr_matches(val, def_netgroup_tuple ? user_runhost : NULL,
+		def_netgroup_tuple ? user_srunhost : NULL, runas_pw->pw_name))
 		ret = true;
 	    break;
 	case '%':
@@ -1401,8 +1404,8 @@ sudo_netgroup_lookup(LDAP *ld, struct passwd *pw,
     struct timeval tv, *tvp = NULL;
     LDAPMessage *entry, *result = NULL;
     const char *domain;
-    char *escaped_domain, *escaped_host, *escaped_shost, *escaped_user;
+    char *escaped_domain = NULL, *escaped_user = NULL;
-    char *filt = NULL;
+    char *escaped_host = NULL, *escaped_shost = NULL, *filt = NULL;
     int filt_len, rc;
     debug_decl(sudo_netgroup_lookup, SUDOERS_DEBUG_LDAP);
 
@@ -1416,29 +1419,70 @@ sudo_netgroup_lookup(LDAP *ld, struct passwd *pw,
     domain = sudo_getdomainname();
 
     /* Escape the domain, host names, and user name per RFC 4515. */
-    escaped_domain = domain ? sudo_ldap_value_dup(domain) : NULL;
+    if (domain != NULL) {
-    escaped_host = sudo_ldap_value_dup(user_runhost);
+	if ((escaped_domain = sudo_ldap_value_dup(domain)) == NULL)
-    if (user_runhost == user_srunhost)
+	    goto oom;
-	escaped_shost = escaped_host;
+    }
-    else 
+    if ((escaped_user = sudo_ldap_value_dup(pw->pw_name)) == NULL)
-	escaped_shost = sudo_ldap_value_dup(user_srunhost);
+	    goto oom;
-    escaped_user = sudo_ldap_value_dup(pw->pw_name);
+    if (def_netgroup_tuple) {
-    if (escaped_domain == NULL || escaped_host == NULL ||
+	escaped_host = sudo_ldap_value_dup(user_runhost);
-	escaped_shost == NULL || escaped_user == NULL)
+	if (user_runhost == user_srunhost)
-	goto oom;
+	    escaped_shost = escaped_host;
+	else 
+	    escaped_shost = sudo_ldap_value_dup(user_srunhost);
+	if (escaped_host == NULL || escaped_shost == NULL)
+	    goto oom;
+    }
 
     /* Build query, using NIS domain if it is set. */
     if (domain != NULL) {
-	if (user_runhost != user_srunhost) {
+	if (escaped_host != escaped_shost) {
-	    filt_len = asprintf(&filt, "(&%s(|(nisNetgroupTriple=\\28,%s,%s\\29)(nisNetgroupTriple=\\28%s,%s,%s\\29)(nisNetgroupTriple=\\28%s,%s,%s\\29)(nisNetgroupTriple=\\28,%s,\\29)(nisNetgroupTriple=\\28%s,%s,\\29)(nisNetgroupTriple=\\28%s,%s,\\29)))", ldap_conf.netgroup_search_filter, escaped_user, escaped_domain, escaped_shost, escaped_user, escaped_domain, escaped_host, escaped_user, escaped_domain, escaped_user, escaped_shost, escaped_user, escaped_host, escaped_user);
+	    filt_len = asprintf(&filt, "(&%s(|"
+		"(nisNetgroupTriple=\\28,%s,%s\\29)"
+		"(nisNetgroupTriple=\\28%s,%s,%s\\29)"
+		"(nisNetgroupTriple=\\28%s,%s,%s\\29)"
+		"(nisNetgroupTriple=\\28,%s,\\29)"
+		"(nisNetgroupTriple=\\28%s,%s,\\29)"
+		"(nisNetgroupTriple=\\28%s,%s,\\29)))",
+		ldap_conf.netgroup_search_filter, escaped_user, escaped_domain,
+		escaped_shost, escaped_user, escaped_domain,
+		escaped_host, escaped_user, escaped_domain, escaped_user,
+		escaped_shost, escaped_user, escaped_host, escaped_user);
+	} else if (escaped_shost != NULL) {
+	    filt_len = asprintf(&filt, "(&%s(|"
+		"(nisNetgroupTriple=\\28,%s,%s\\29)"
+		"(nisNetgroupTriple=\\28%s,%s,%s\\29)"
+		"(nisNetgroupTriple=\\28,%s,\\29)"
+		"(nisNetgroupTriple=\\28%s,%s,\\29)))",
+		ldap_conf.netgroup_search_filter, escaped_user, escaped_domain,
+		escaped_shost, escaped_user, escaped_domain,
+		escaped_user, escaped_shost, escaped_user);
 	} else {
-	    filt_len = asprintf(&filt, "(&%s(|(nisNetgroupTriple=\\28,%s,%s\\29)(nisNetgroupTriple=\\28%s,%s,%s\\29)(nisNetgroupTriple=\\28,%s,\\29)(nisNetgroupTriple=\\28%s,%s,\\29)))", ldap_conf.netgroup_search_filter, escaped_user, escaped_domain, escaped_shost, escaped_user, escaped_domain, escaped_user, escaped_shost, escaped_user);
+	    filt_len = asprintf(&filt, "(&%s(|"
+		"(nisNetgroupTriple=\\28*,%s,%s\\29)"
+		"(nisNetgroupTriple=\\28*,%s,\\29)))",
+		ldap_conf.netgroup_search_filter, escaped_user, escaped_domain,
+		escaped_user);
 	}
     } else {
-	if (user_runhost != user_srunhost) {
+	if (escaped_host != escaped_shost) {
-	    filt_len = asprintf(&filt, "(&%s(|(nisNetgroupTriple=\\28,%s,*\\29)(nisNetgroupTriple=\\28%s,%s,*\\29)(nisNetgroupTriple=\\28%s,%s,*\\29)))", ldap_conf.netgroup_search_filter, escaped_user, escaped_shost, escaped_user, escaped_host, escaped_user);
+	    filt_len = asprintf(&filt, "(&%s(|"
+		"(nisNetgroupTriple=\\28,%s,*\\29)"
+		"(nisNetgroupTriple=\\28%s,%s,*\\29)"
+		"(nisNetgroupTriple=\\28%s,%s,*\\29)))",
+		ldap_conf.netgroup_search_filter, escaped_user,
+		escaped_shost, escaped_user, escaped_host, escaped_user);
+	} else if (escaped_shost != NULL) {
+	    filt_len = asprintf(&filt, "(&%s(|"
+		"(nisNetgroupTriple=\\28,%s,*\\29)"
+		"(nisNetgroupTriple=\\28%s,%s,*\\29)))",
+		ldap_conf.netgroup_search_filter, escaped_user,
+		escaped_shost, escaped_user);
 	} else {
-	    filt_len = asprintf(&filt, "(&%s(|(nisNetgroupTriple=\\28,%s,*\\29)(nisNetgroupTriple=\\28%s,%s,*\\29)))", ldap_conf.netgroup_search_filter, escaped_user, escaped_shost, escaped_user);
+	    filt_len = asprintf(&filt,
+		"(&%s(|(nisNetgroupTriple=\\28*,%s,*\\29)))",
+		ldap_conf.netgroup_search_filter, escaped_user);
 	}
     }
     if (filt_len == -1)
@@ -1497,10 +1541,10 @@ sudo_netgroup_lookup(LDAP *ld, struct passwd *pw,
 oom:
     sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
     free(escaped_domain);
+    free(escaped_user);
     free(escaped_host);
     if (escaped_host != escaped_shost)
 	free(escaped_shost);
-    free(escaped_user);
     free(filt);
     ldap_msgfree(result);
     debug_return_bool(false);
@@ -3399,7 +3443,7 @@ sudo_ldap_result_get(struct sudo_nss *nss, struct passwd *pw)
 			continue;
 		    lres->user_matches = true;
 		    /* Check host. */
-		    if (!sudo_ldap_check_host(ld, entry))
+		    if (!sudo_ldap_check_host(ld, entry, pw))
 			continue;
 		    lres->host_matches = true;
 		    if (sudo_ldap_result_add_entry(lres, entry) == NULL) {

plugins/sudoers/match.c

@@ -107,7 +107,9 @@ userlist_matches(const struct passwd *pw, const struct member_list *list)
 		matched = !m->negated;
 		break;
 	    case NETGROUP:
-		if (netgr_matches(m->name, NULL, NULL, pw->pw_name))
+		if (netgr_matches(m->name,
+		    def_netgroup_tuple ? user_runhost : NULL,
+		    def_netgroup_tuple ? user_srunhost : NULL, pw->pw_name))
 		    matched = !m->negated;
 		break;
 	    case USERGROUP:
@@ -163,7 +165,10 @@ runaslist_matches(const struct member_list *user_list,
 			user_matched = !m->negated;
 			break;
 		    case NETGROUP:
-			if (netgr_matches(m->name, NULL, NULL, runas_pw->pw_name))
+			if (netgr_matches(m->name,
+			    def_netgroup_tuple ? user_runhost : NULL,
+			    def_netgroup_tuple ? user_srunhost : NULL,
+			    runas_pw->pw_name))
 			    user_matched = !m->negated;
 			break;
 		    case USERGROUP:
@@ -250,7 +255,7 @@ runaslist_matches(const struct member_list *user_list,
  * Returns ALLOW, DENY or UNSPEC.
  */
 int
-hostlist_matches(const struct member_list *list)
+hostlist_matches(const struct passwd *pw, const struct member_list *list)
 {
     struct member *m;
     struct alias *a;
@@ -263,7 +268,8 @@ hostlist_matches(const struct member_list *list)
 		matched = !m->negated;
 		break;
 	    case NETGROUP:
-		if (netgr_matches(m->name, user_runhost, user_srunhost, NULL))
+		if (netgr_matches(m->name, user_runhost, user_srunhost,
+		    pw->pw_name))
 		    matched = !m->negated;
 		break;
 	    case NTWKADDR:
@@ -272,7 +278,7 @@ hostlist_matches(const struct member_list *list)
 		break;
 	    case ALIAS:
 		if ((a = alias_get(m->name, HOSTALIAS)) != NULL) {
-		    rval = hostlist_matches(&a->members);
+		    rval = hostlist_matches(pw, &a->members);
 		    if (rval != UNSPEC)
 			matched = m->negated ? !rval : rval;
 		    alias_put(a);

plugins/sudoers/parse.c

@@ -176,7 +176,7 @@ sudo_file_lookup(struct sudo_nss *nss, int validated, int pwflag)
 	    if (userlist_matches(sudo_user.pw, &us->users) != ALLOW)
 		continue;
 	    TAILQ_FOREACH(priv, &us->privileges, entries) {
-		if (hostlist_matches(&priv->hostlist) != ALLOW)
+		if (hostlist_matches(sudo_user.pw, &priv->hostlist) != ALLOW)
 		    continue;
 		TAILQ_FOREACH(cs, &priv->cmndlist, entries) {
 		    /* Only check the command when listing another user. */
@@ -212,7 +212,7 @@ sudo_file_lookup(struct sudo_nss *nss, int validated, int pwflag)
 	    continue;
 	CLR(validated, FLAG_NO_USER);
 	TAILQ_FOREACH_REVERSE(priv, &us->privileges, privilege_list, entries) {
-	    host_match = hostlist_matches(&priv->hostlist);
+	    host_match = hostlist_matches(sudo_user.pw, &priv->hostlist);
 	    if (host_match == ALLOW)
 		CLR(validated, FLAG_NO_HOST);
 	    else
@@ -415,7 +415,7 @@ sudo_file_display_priv_short(struct passwd *pw, struct userspec *us,
     /* gcc -Wuninitialized false positive */
     TAGS_INIT(tags);
     TAILQ_FOREACH(priv, &us->privileges, entries) {
-	if (hostlist_matches(&priv->hostlist) != ALLOW)
+	if (hostlist_matches(pw, &priv->hostlist) != ALLOW)
 	    continue;
 	prev_cs = NULL;
 	TAILQ_FOREACH(cs, &priv->cmndlist, entries) {
@@ -494,7 +494,7 @@ sudo_file_display_priv_long(struct passwd *pw, struct userspec *us,
     debug_decl(sudo_file_display_priv_long, SUDOERS_DEBUG_NSS)
 
     TAILQ_FOREACH(priv, &us->privileges, entries) {
-	if (hostlist_matches(&priv->hostlist) != ALLOW)
+	if (hostlist_matches(pw, &priv->hostlist) != ALLOW)
 	    continue;
 	prev_cs = NULL;
 	TAILQ_FOREACH(cs, &priv->cmndlist, entries) {
@@ -616,7 +616,7 @@ sudo_file_display_defaults(struct sudo_nss *nss, struct passwd *pw,
     TAILQ_FOREACH(d, &defaults, entries) {
 	switch (d->type) {
 	    case DEFAULTS_HOST:
-		if (hostlist_matches(d->binding) != ALLOW)
+		if (hostlist_matches(pw, d->binding) != ALLOW)
 		    continue;
 		break;
 	    case DEFAULTS_USER:
@@ -753,7 +753,7 @@ sudo_file_display_cmnd(struct sudo_nss *nss, struct passwd *pw)
 	    continue;
 
 	TAILQ_FOREACH_REVERSE(priv, &us->privileges, privilege_list, entries) {
-	    host_match = hostlist_matches(&priv->hostlist);
+	    host_match = hostlist_matches(pw, &priv->hostlist);
 	    if (host_match != ALLOW)
 		continue;
 	    TAILQ_FOREACH_REVERSE(cs, &priv->cmndlist, cmndspec_list, entries) {

plugins/sudoers/parse.h

@@ -258,7 +258,7 @@ bool usergr_matches(const char *group, const char *user, const struct passwd *pw
 bool userpw_matches(const char *sudoers_user, const char *user, const struct passwd *pw);
 int cmnd_matches(const struct member *m);
 int cmndlist_matches(const struct member_list *list);
-int hostlist_matches(const struct member_list *list);
+int hostlist_matches(const struct passwd *pw, const struct member_list *list);
 int runaslist_matches(const struct member_list *user_list, const struct member_list *group_list, struct member **matching_user, struct member **matching_group);
 int userlist_matches(const struct passwd *pw, const struct member_list *list);
 const char *sudo_getdomainname(void);

plugins/sudoers/sssd.c

@@ -544,7 +544,8 @@ sudo_sss_check_runas_user(struct sudo_sss_handle *handle, struct sss_sudo_rule *
 	switch (val[0]) {
 	case '+':
 	    sudo_debug_printf(SUDO_DEBUG_DEBUG, "netgr_");
-	    if (netgr_matches(val, NULL, NULL, runas_pw->pw_name)) {
+	    if (netgr_matches(val, def_netgroup_tuple ? user_runhost : NULL,
+		def_netgroup_tuple ? user_srunhost : NULL, runas_pw->pw_name)) {
 		sudo_debug_printf(SUDO_DEBUG_DEBUG, "=> match");
 		ret = true;
 	    }
@@ -655,8 +656,7 @@ sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
 	debug_return_bool(ret);
 
     /* get the values from the rule */
-    switch (handle->fn_get_values(rule, "sudoHost", &val_array))
+    switch (handle->fn_get_values(rule, "sudoHost", &val_array)) {
-    {
     case 0:
 	break;
     case ENOENT:
@@ -673,8 +673,8 @@ sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
 	sudo_debug_printf(SUDO_DEBUG_DEBUG, "val[%d]=%s", i, val);
 
 	/* match any or address or netgroup or hostname */
-	if (!strcmp(val, "ALL") || addr_matches(val) ||
+	if (!strcmp(val, "ALL") || addr_matches(val) || netgr_matches(val,
-	    netgr_matches(val, user_runhost, user_srunhost, NULL) ||
+	    user_runhost, user_srunhost, handle->pw->pw_name) ||
 	    hostname_matches(user_srunhost, user_runhost, val))
 	    ret = true;
 
@@ -724,7 +724,9 @@ sudo_sss_filter_user_netgroup(struct sudo_sss_handle *handle, struct sss_sudo_ru
 	    netgroup_spec_found = true;
 	}
 	sudo_debug_printf(SUDO_DEBUG_DEBUG, "val[%d]=%s", i, val);
-	if (strcmp(val, "ALL") == 0 || netgr_matches(val, NULL, NULL, handle->pw->pw_name)) {
+	if (strcmp(val, "ALL") == 0 || netgr_matches(val,
+	    def_netgroup_tuple ? user_runhost : NULL,
+	    def_netgroup_tuple ? user_srunhost : NULL, handle->pw->pw_name)) {
 	    ret = true;
 	    sudo_debug_printf(SUDO_DEBUG_DIAG,
 		"sssd/ldap sudoUser '%s' ... MATCH! (%s)",

plugins/sudoers/testsudoers.c

@@ -305,7 +305,7 @@ main(int argc, char *argv[])
 	    putchar('\n');
 	    print_privilege(priv);
 	    putchar('\n');
-	    host_match = hostlist_matches(&priv->hostlist);
+	    host_match = hostlist_matches(sudo_user.pw, &priv->hostlist);
 	    if (host_match == ALLOW) {
 		puts("\thost  matched");
 		TAILQ_FOREACH_REVERSE(cs, &priv->cmndlist, cmndspec_list, entries) {