Add test for only changing the group (not the user).

A sudoers entry with a Runas_Spec that allows a command to
be run as a group should also grant permission to run the
command as the invoking user with only the group changed.

Author: millert

MANIFEST

@@ -1122,6 +1122,8 @@ plugins/sudoers/regress/testsudoers/test30.out.ok
 plugins/sudoers/regress/testsudoers/test30.sh
 plugins/sudoers/regress/testsudoers/test31.out.ok
 plugins/sudoers/regress/testsudoers/test31.sh
+plugins/sudoers/regress/testsudoers/test32.out.ok
+plugins/sudoers/regress/testsudoers/test32.sh
 plugins/sudoers/regress/testsudoers/test4.out.ok
 plugins/sudoers/regress/testsudoers/test4.sh
 plugins/sudoers/regress/testsudoers/test5.out.ok

plugins/sudoers/regress/testsudoers/test32.out.ok

@@ -0,0 +1,72 @@
+Parses OK
+
+Entries for user admin:
+
+ALL = (admin : staff) /bin/ls
+	host  allowed
+	runas allowed
+	cmnd  allowed
+
+Password required
+
+Command allowed
+Parses OK
+
+Entries for user admin:
+
+ALL = (admin : staff) /bin/ls
+	host  allowed
+	runas allowed
+	cmnd  allowed
+
+Password required
+
+Command allowed
+Parses OK
+
+Entries for user admin:
+
+ALL = (root : staff) /bin/ls
+	host  allowed
+	runas allowed
+	cmnd  allowed
+
+Password required
+
+Command allowed
+Parses OK
+
+Entries for user admin:
+
+ALL = (admin : staff) /bin/ls
+	host  allowed
+	runas allowed
+	cmnd  allowed
+
+Password required
+
+Command allowed
+Parses OK
+
+Entries for user admin:
+
+ALL = (admin : staff) /bin/ls
+	host  allowed
+	runas allowed
+	cmnd  allowed
+
+Password required
+
+Command allowed
+Parses OK
+
+Entries for user admin:
+
+ALL = (root : staff) /bin/ls
+	host  allowed
+	runas allowed
+	cmnd  allowed
+
+Password required
+
+Command allowed

plugins/sudoers/regress/testsudoers/test32.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+#
+# Verify that a user is allowed to run commands with only the group changed.
+#
+
+: ${TESTSUDOERS=testsudoers}
+
+exec 2>&1
+
+$TESTSUDOERS -u admin -g staff -p ${TESTDIR}/passwd -P ${TESTDIR}/group \
+    admin /bin/ls <<'EOF'
+admin ALL = (admin:staff) /bin/ls
+EOF
+
+$TESTSUDOERS -u admin -g staff -p ${TESTDIR}/passwd -P ${TESTDIR}/group \
+    admin /bin/ls <<'EOF'
+admin ALL = (:staff) /bin/ls
+EOF
+
+$TESTSUDOERS -u admin -g staff -p ${TESTDIR}/passwd -P ${TESTDIR}/group \
+    admin /bin/ls <<'EOF'
+admin ALL = (root:staff) /bin/ls
+EOF
+
+$TESTSUDOERS -g staff -p ${TESTDIR}/passwd -P ${TESTDIR}/group \
+    admin /bin/ls <<'EOF'
+admin ALL = (admin:staff) /bin/ls
+EOF
+
+$TESTSUDOERS -g staff -p ${TESTDIR}/passwd -P ${TESTDIR}/group \
+    admin /bin/ls <<'EOF'
+admin ALL = (:staff) /bin/ls
+EOF
+
+$TESTSUDOERS -g staff -p ${TESTDIR}/passwd -P ${TESTDIR}/group \
+    admin /bin/ls <<'EOF'
+admin ALL = (root:staff) /bin/ls
+EOF
+
+exit 0