From 73155601850cad91e2debfe42a1488e5023a0560 Mon Sep 17 00:00:00 2001
From: Armaan Sandhu <armaan.sandhu0504@gmail.com>
Date: Sun, 1 Nov 2026 19:35:03 -0500
Subject: [PATCH] cvtsudoers: fix CSV output of log tags, boolean options and
 aliases

the log_input and log_output tags were printed based on tag.follow instead of thier own values, so NOLOG_INPUT came out as log_input.

boolean options had their name printed twice, giving env_resetenv_reset and requiretty!requiretty.

print_aliases_csv() checked whether the defaults list was empty, so aliases were left out for a sudoers file with no Defaults, even tho the rules still refer to them.
---
 MANIFEST                                      |  2 ++
 plugins/sudoers/cvtsudoers_csv.c              |  8 +++---
 .../sudoers/regress/cvtsudoers/test44.out.ok  |  9 +++++++
 plugins/sudoers/regress/cvtsudoers/test44.sh  | 26 +++++++++++++++++++
 4 files changed, 41 insertions(+), 4 deletions(-)
 create mode 100644 plugins/sudoers/regress/cvtsudoers/test44.out.ok
 create mode 100644 plugins/sudoers/regress/cvtsudoers/test44.sh

diff --git a/MANIFEST b/MANIFEST
index 422b79af0b..4d00718762 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -870,6 +870,8 @@ plugins/sudoers/regress/cvtsudoers/test42.out.ok
 plugins/sudoers/regress/cvtsudoers/test42.sh
 plugins/sudoers/regress/cvtsudoers/test43.out.ok
 plugins/sudoers/regress/cvtsudoers/test43.sh
+plugins/sudoers/regress/cvtsudoers/test44.out.ok
+plugins/sudoers/regress/cvtsudoers/test44.sh
 plugins/sudoers/regress/cvtsudoers/test5.out.ok
 plugins/sudoers/regress/cvtsudoers/test5.sh
 plugins/sudoers/regress/cvtsudoers/test6.out.ok
diff --git a/plugins/sudoers/cvtsudoers_csv.c b/plugins/sudoers/cvtsudoers_csv.c
index a4455907b1..2bf1c955d2 100644
--- a/plugins/sudoers/cvtsudoers_csv.c
+++ b/plugins/sudoers/cvtsudoers_csv.c
@@ -49,7 +49,7 @@ print_options_csv(FILE *fp, struct defaults_list *options, bool need_comma)
 		opt->op == '+' ? "+=" : opt->op == '-' ? "-=" : "=", opt->val);
 	} else {
 	    /* Boolean flag. */
-	    fprintf(fp, "%s%s%s%s", need_comma ? "," : "", opt->var,
+	    fprintf(fp, "%s%s%s", need_comma ? "," : "",
 		opt->op == false ? "!" : "", opt->var);
 	}
 	need_comma = true;
@@ -420,7 +420,7 @@ print_aliases_csv(FILE *fp, const struct sudoers_parse_tree *parse_tree)
 {
     debug_decl(print_aliases_csv, SUDOERS_DEBUG_UTIL);
 
-    if (TAILQ_EMPTY(&parse_tree->defaults))
+    if (no_aliases(parse_tree))
 	debug_return_bool(true);
 
     /* Heading line. */
@@ -545,12 +545,12 @@ print_cmndspec_csv(FILE *fp, const struct sudoers_parse_tree *parse_tree,
 	}
 	if (tag.log_input != UNSPEC) {
 	    fprintf(fp, "%s%s", need_comma ? "," : "",
-		tag.follow ? "log_input" : "!log_input");
+		tag.log_input ? "log_input" : "!log_input");
 	    need_comma = true;
 	}
 	if (tag.log_output != UNSPEC) {
 	    fprintf(fp, "%s%s", need_comma ? "," : "",
-		tag.follow ? "log_output" : "!log_output");
+		tag.log_output ? "log_output" : "!log_output");
 	    need_comma = true;
 	}
     }
diff --git a/plugins/sudoers/regress/cvtsudoers/test44.out.ok b/plugins/sudoers/regress/cvtsudoers/test44.out.ok
new file mode 100644
index 0000000000..127008f883
--- /dev/null
+++ b/plugins/sudoers/regress/cvtsudoers/test44.out.ok
@@ -0,0 +1,9 @@
+alias_type,alias_name,members
+User_Alias,ADMINS,alice
+
+rule,user,host,runusers,rungroups,options,command
+rule,ADMINS,ALL,root,,"!log_input",/bin/ls
+rule,bob,ALL,root,,"!log_output",/bin/cat
+rule,carol,ALL,root,,"log_input",/bin/date
+rule,user,host,runusers,rungroups,options,command
+rule,alice,ALL,,,"env_reset,!requiretty",/bin/ls
diff --git a/plugins/sudoers/regress/cvtsudoers/test44.sh b/plugins/sudoers/regress/cvtsudoers/test44.sh
new file mode 100644
index 0000000000..2d5d07a017
--- /dev/null
+++ b/plugins/sudoers/regress/cvtsudoers/test44.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+#
+# Test CSV output of log tags, boolean options and aliases
+# when there are no Defaults settings.
+#
+
+: ${CVTSUDOERS=cvtsudoers}
+
+$CVTSUDOERS -c "" -f csv <<EOF
+User_Alias ADMINS = alice
+ADMINS ALL = (root) NOLOG_INPUT: /bin/ls
+bob ALL = (root) NOLOG_OUTPUT: /bin/cat
+carol ALL = (root) LOG_INPUT: /bin/date
+EOF
+
+$CVTSUDOERS -c "" -i ldif -b "ou=SUDOers,dc=sudo,dc=ws" -f csv <<EOF
+dn: cn=role1,ou=SUDOers,dc=sudo,dc=ws
+objectClass: sudoRole
+cn: role1
+sudoUser: alice
+sudoHost: ALL
+sudoCommand: /bin/ls
+sudoOption: env_reset
+sudoOption: !requiretty
+
+EOF