From d26c23140798f13cd6cf157cf1b6e7a1d5a7d0d1 Mon Sep 17 00:00:00 2001 From: Armaan Sandhu Date: Sun, 1 Nov 2026 19:35:12 -0500 Subject: [PATCH] sudoreplay: don't reuse the previous result for a missing log field match_expr() only sets res for cwd, host, tty, group and similar terms when that field is in the log. if it is missing, res keeps the value from the previus term, so "user alice group wheel" lists alice's sessions that have no run group logged. reset res for each term so that a missing field doesn't match. --- plugins/sudoers/sudoreplay.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/plugins/sudoers/sudoreplay.c b/plugins/sudoers/sudoreplay.c index 24609dc97c..542aa627d6 100644 --- a/plugins/sudoers/sudoreplay.c +++ b/plugins/sudoers/sudoreplay.c @@ -1373,12 +1373,14 @@ static bool match_expr(struct search_node_list *head, struct eventlog *evlog, bool last_match) { struct search_node *sn; - bool res = false, matched = last_match; + bool res, matched = last_match; char *tofree; int rc; debug_decl(match_expr, SUDO_DEBUG_UTIL); STAILQ_FOREACH(sn, head, entries) { + /* A term on a field missing from the log does not match. */ + res = false; switch (sn->type) { case ST_EXPR: res = match_expr(&sn->u.expr, evlog, matched);