Sudo Project commits | Ecosyste.ms: OpenCollective

Return NOT_FOUND from the set_cmnd_path() stub since we don't set user_cmnd.

The purpose of set_cmnd_path() is to reset user_cmnd based on a new
runchroot. For the stub vers...

github.com/sudo-project/sudo - 322e0b3693fa43d281ffe082a1e08e523e8dd17f authored over 3 years ago by Todd C. Miller <[email protected]>

Fix fuzz_sudoers output matching.

github.com/sudo-project/sudo - 5fc6b8c1776bbb35290b8851f2e4bc349c806f3c authored over 3 years ago by Todd C. Miller <[email protected]>

Print "running" and "executed" lines to stderr like libfuzzer does.

github.com/sudo-project/sudo - 4adc11e33562b2ae1074a1b3f79921ae43f1c193 authored over 3 years ago by Todd C. Miller <[email protected]>

Support passing sudo_make_gidlist_item() an array of gids.

The gids are formatted as strings, not gid_t.

github.com/sudo-project/sudo - 39db44b041b7e73a94c3d5326d8267f4da5ecf98 authored over 3 years ago by Todd C. Miller <[email protected]>

Prime user/group cached and set the interface list.

Also match parsed policy against multiple users.

github.com/sudo-project/sudo - f92080be621c3eae4b7ea0de64c0013ca298eaa1 authored over 3 years ago by Todd C. Miller <[email protected]>

Add sudo_mkgrent(), to be used to prime the group cache in tests/fuzzers.

github.com/sudo-project/sudo - 7463a1989f809badd5db896c3337ef77d20df411 authored over 3 years ago by Todd C. Miller <[email protected]>

Perform matching in fuzz_sudoers for inputs that parse correctly.

The fuzzer now exercised the normal match code as well as the
pseudo-command (list, validate, etc...

github.com/sudo-project/sudo - df42c0c1d252db7528ab0dbf6c7b1aeaf0e2a4c7 authored over 3 years ago by Todd C. Miller <[email protected]>

Add back SUDOERS_NAME_MATCH and enable it when fuzzing.

This avoids the test environment from influencing sudoers matching.

github.com/sudo-project/sudo - 921097cb67c6cc90eebb744d18a88987974e6095 authored over 3 years ago by Todd C. Miller <[email protected]>

Add missing globfree(3) in command_matches_glob() when matching a directory.

github.com/sudo-project/sudo - ecbe95589a2da44d20bb99730dc404bc161fdfc2 authored over 3 years ago by Todd C. Miller <[email protected]>

Add support on AIX for loading plugins that are .a (not .so) files.

It is possible to specify the member name in parens after the path,
e.g. sudoers.a(shr.o) for 32-...

github.com/sudo-project/sudo - 387169ac67af6f038041754ba71f39afa4576a2d authored over 3 years ago by Todd C. Miller <[email protected]>

Add clean rules to .PHONY target.

github.com/sudo-project/sudo - 14c71eaa86170314073df3bf6ed0472066b20ed3 authored over 3 years ago by Todd C. Miller <[email protected]>

Add install-fuzz Makefile target to install the fuzzers and seed corpus.

The FUZZ_DESTDIR make variable needs to be set in the environment
or on the command line.

github.com/sudo-project/sudo - 9f1e016cde3f8462881ab18c282811d7d5d5f33c authored over 3 years ago by Todd C. Miller <[email protected]>

Only display fuzz_policy output if the fuzzer exits with an error.

github.com/sudo-project/sudo - 5ea2acc4c2afcc0a56343a3fc32df4a1bedadc2a authored over 3 years ago by Todd C. Miller <[email protected]>

Call list, validate and invalidate entry points too.

We need a separate open/close for each one.

github.com/sudo-project/sudo - d02cc9c3acfb74e1b2266fc83f704a4f527ac4ef authored over 3 years ago by Todd C. Miller <[email protected]>

Add --disable-ssp configure option.

This allows for disabling -fstack-protector without turning off the
other hardening options.

github.com/sudo-project/sudo - 90534b5b27218dab76dd4b9b3e574c3fc34bbff3 authored over 3 years ago by Todd C. Miller <[email protected]>

Test the error case by closing the underlying fd.

Note that we don't use ferror() here since our getdelim() has no
way to set the error flag if the...

github.com/sudo-project/sudo - a7e2dd15e1291a8fbba25bf41bc536b6a17d4b77 authored over 3 years ago by Todd C. Miller <[email protected]>

Test the case where getdelim() must reallocate the buffer.

Reproduces Bug #960.

github.com/sudo-project/sudo - db70a70d07ecf8dbcb6951135ad9803d41fec915 authored over 3 years ago by Todd C. Miller <[email protected]>

When logging JSON to syslog, wrap the contents in a "sudo" object.

This makes it easier for log parsers to identify what is a sudo log entry.

github.com/sudo-project/sudo - e5c1778e7dd32ff3ed8cf969540404c9c0e6d5a1 authored over 3 years ago by Todd C. Miller <[email protected]>

Restore the check for sudoers_policy.close == NULL.

The fuzzers run as part of "make check" too in which case NO_LEAKS
won't be defined and the close...

github.com/sudo-project/sudo - f76c59fc8fb0f338975bce406c84524d0594bd75 authored over 3 years ago by Todd C. Miller <[email protected]>

Use %td when printing the difference of two pointers.

github.com/sudo-project/sudo - e047e99306d88effd25090580b413dd54383e3c4 authored over 3 years ago by Todd C. Miller <[email protected]>

Don't print a NULL as a string if role/type/privs/limitprivs is not set.

We can't rely on printf("%s", NULL) not crashing.

github.com/sudo-project/sudo - 5813358b2b875320491530e0471f52a0fc3cc087 authored over 3 years ago by Todd C. Miller <[email protected]>

Fix compilation error on Solaris introduced with sudo_user_free().

github.com/sudo-project/sudo - aaf3d5643bcd8814a6184f8f247229dfc4d6dcce authored over 3 years ago by Todd C. Miller <[email protected]>

Bug #960.

github.com/sudo-project/sudo - ac45fba8991369567789fb76e9c88e8f8de96c11 authored over 3 years ago by Todd C. Miller <[email protected]>

Distinguish between EOF and error using feof(3), not ferror(3).

Our getdelim(3) emulation won't set the error flag if the error is
due to an allocation failure. ...

github.com/sudo-project/sudo - 9937d08031b9c46852f9b39b153c05dcb1e99ae2 authored over 3 years ago by Todd C. Miller <[email protected]>

Reset end pointer when reallocing the line buffer in getdelim().

Fixes excessive memory allocations for long lines. Bug #960.

github.com/sudo-project/sudo - 75004b7059997bee1b898a3979591d9e16242f6f authored over 3 years ago by Todd C. Miller <[email protected]>

Remove duplicated MALLOC_OPTIONS and MALLOC_CONF env variables.

github.com/sudo-project/sudo - abdef93f723964974e6788a271bde50ba3a1aecd authored over 3 years ago by Todd C. Miller <[email protected]>

On parse error, display line and column instead of the offending line.

github.com/sudo-project/sudo - dc45ac5bc79f137197f716e7546a25085396d6fd authored over 3 years ago by Todd C. Miller <[email protected]>

regen

github.com/sudo-project/sudo - 79a18cb41911e74339214766807374727b181a67 authored over 3 years ago by Todd C. Miller <[email protected]>

Sudo 1.9.6

github.com/sudo-project/sudo - b736804cf090c89dc300ec858b7db436bda20575 authored over 3 years ago by Todd C. Miller <[email protected]>

Pass I/O log memory allocation errors up to the caller.

github.com/sudo-project/sudo - 4a279d5767def1becfcea743255ca499dea1dd00 authored over 3 years ago by Todd C. Miller <[email protected]>

Add admin_flag sudoers option and make --enable-admin-flag take a path.

It is now possible to disable the Ubuntu admin flag in sudoers
or change its location.
GitHub iss...

github.com/sudo-project/sudo - a5504148a55f7a6123d7c7b804e85a369d70638a authored over 3 years ago by Todd C. Miller <[email protected]>

Fix tilde expansion of paths with no user like ~/foo.

The '/' separator was missing in the resulting path.

github.com/sudo-project/sudo - 5ec59cddc20cbad707d3e3c8165c4623de56d1f3 authored over 3 years ago by Todd C. Miller <[email protected]>

Limit max_groups in sudo.conf to 1024.

The max_groups setting should no longer be needed anyway.

github.com/sudo-project/sudo - a18b2a9ddfbd8bde0aa251e797f9456e887bc64b authored over 3 years ago by Todd C. Miller <[email protected]>

In sudoers_policy_close() call sudoers_cleanup() instead of sudo_user_free().

If we didn't call sudoers_policy_main() due to an early error there
may be more things to clean up.

github.com/sudo-project/sudo - df91e15b82391ffa93763d55a662f6ac90c5f545 authored over 3 years ago by Todd C. Miller <[email protected]>

Check for invalid flag combinations from front-end for all cases.

The checks are now performed in the check_policy, list, validate
and invalidate functions instead...

github.com/sudo-project/sudo - ecdf732adc8d2d1b5638adc97dd74068fe1868a7 authored over 3 years ago by Todd C. Miller <[email protected]>

Always dynamically allocate user_cmnd, it is freed in sudo_user_free().

Instead of setting user_cmnd in the policy functions, always set argv.
Calling sudoers_policy_mai...

github.com/sudo-project/sudo - ae3a098d2f0988b63a780523a006a3db8e8b3872 authored over 3 years ago by Todd C. Miller <[email protected]>

No need for sudoers_cleanup() in sudoers_policy_invalidate().

The sudoers close() function is now called even for "sudo -k".
Also no need to set user_cmnd, it ...

github.com/sudo-project/sudo - c09169e812aac4f54801b6ca2b565fff52ecd518 authored over 3 years ago by Todd C. Miller <[email protected]>

Add simple fuzzer for sudo_logsrvd.conf parser.

github.com/sudo-project/sudo - d2350833420195c1d10d957699524f5b229da454 authored over 3 years ago by Todd C. Miller <[email protected]>

Fix unlinking of timing temp file.

github.com/sudo-project/sudo - d81d7e0cf2cad6fda48261914c5137bf4c7369c8 authored over 3 years ago by Todd C. Miller <[email protected]>

Set MALLOC_OPTIONS and MALLOC_CONF for all regress targets.

github.com/sudo-project/sudo - de2a47f2732e2fb244a152ee9d15a508e457d3c2 authored over 3 years ago by Todd C. Miller <[email protected]>

Add simple fuzzer for sudo.conf parser.

github.com/sudo-project/sudo - 25f50e2f07f0f49237cf652733474f07c33d2f8c authored over 3 years ago by Todd C. Miller <[email protected]>

Free struct sudo_user in sudoers_policy_close() and sudoers_cleanup().

Also, do not NULL out the close function if NO_LEAKS is defined.

github.com/sudo-project/sudo - 52e3fcc7950f0e5c25373a50d92711044fe87e43 authored over 3 years ago by Todd C. Miller <[email protected]>

For "make fuzz" only fuzz the seed corpus.

This way we avoid files generated by the fuzzer itself.

github.com/sudo-project/sudo - ea7a70e85df7c28148f0f56fa6486ef00ba12938 authored over 3 years ago by Todd C. Miller <[email protected]>

Fix sudoers garbage collection and run it in policy fuzzer.

github.com/sudo-project/sudo - 7f3c670a13cb584b04ba9c9dd4d7ae457460ebda authored over 3 years ago by Todd C. Miller <[email protected]>

Rename master -> main

github.com/sudo-project/sudo - 5ade1c25399060373497713347fcab412a0d4119 authored over 3 years ago by Todd C. Miller <[email protected]>

Do not include errno string for invalid params from front-end.

github.com/sudo-project/sudo - 7f0b2692380c86695f5d71a1b8f77194370496dd authored over 3 years ago by Todd C. Miller <[email protected]>

Always dynamically allocate user_role, user_type, user_privs, user_limitprivs

github.com/sudo-project/sudo - 561740cd5433a0c31c27800eadc8579dc3583d73 authored over 3 years ago by Todd C. Miller <[email protected]>

Remove dead code, front-end does not set runas_privs or runas_limitprivs

github.com/sudo-project/sudo - 5c0454495cfbaa9c80fed14d12a3f419412bc113 authored over 3 years ago by Todd C. Miller <[email protected]>

Plug memory leak if there are duplicate user_info or command_info entries.

github.com/sudo-project/sudo - d1969b4f0b2a15d62cbef70ad78080f967ea2b95 authored over 3 years ago by Todd C. Miller <[email protected]>

Add CIFuzz workflow to run fuzzers on push or PR.

https://google.github.io/oss-fuzz/getting-started/continuous-integration/

github.com/sudo-project/sudo - 96d1dc8ab78cc5313a36638ec218d3f2e3da9cfa authored over 3 years ago by Todd C. Miller <[email protected]>

Move create_admin_success_flag() to timestamp.c.

github.com/sudo-project/sudo - 776c57a81eaa273ac17a96e5cca73d84b038b3c1 authored over 3 years ago by Todd C. Miller <[email protected]>

Error out if fuzzer/sanitizer enabled but not supported by the compiler.

github.com/sudo-project/sudo - 440febff86be0b89ff340261b2b09cbf41effc8b authored over 3 years ago by Todd C. Miller <[email protected]>

The push() function was not updating the size after reallocating.

github.com/sudo-project/sudo - 651a225a4aa408c30580980dc93c22d2b8b03174 authored over 3 years ago by Todd C. Miller <[email protected]>

If sudo_getgrouplist2() returns -1, clamp ngroups based on max_groups.

The ngroups parameter is an out parameter that is filled in with
the actual number of groups, whi...

github.com/sudo-project/sudo - 41eae912066ac3a439151484391facec491c5433 authored over 3 years ago by Todd C. Miller <[email protected]>

Reset sudoers path, owner and mode before parsing plugin arguments.

This is only needed when calling sudoers_policy_deserialize_info()
more than once, which is true ...

github.com/sudo-project/sudo - e89a8133ace9ed10d2c327c3b27d9c4198ad28d5 authored over 3 years ago by Todd C. Miller <[email protected]>

Cleanup sudoers sources on denial and error too.

github.com/sudo-project/sudo - 197d6600fad3f956379037400a9fda48d67097db authored over 3 years ago by Todd C. Miller <[email protected]>

Fix sudo_getgrgid reference count bug when gid doesn't exist.

This one was missed when the other user/group lookup functions
were fixed.

github.com/sudo-project/sudo - 520db741b543d7b5f4d8e8925ec14e2ca7c17b6c authored over 3 years ago by Todd C. Miller <[email protected]>

Plug memory leak if there are duplicate user_info entries.

github.com/sudo-project/sudo - ed796276993ee77abff54b6f78bd17220de45a1d authored over 3 years ago by Todd C. Miller <[email protected]>

Fuzz sudoers policy module API.

Includes a test case to reproduce CVE-2021-3156.

github.com/sudo-project/sudo - df2931588aff9ee7a3ab16cd4e08e3bc72eb8d0f authored over 3 years ago by Todd C. Miller <[email protected]>

Make fuzz targets depend on fuzzer stub library.

We really want a dependency on $(LIB_FUZZING_ENGINE) but that could
be a flag like "-fsanitize=fu...

github.com/sudo-project/sudo - eedc72d7b98e0a84aa25e84cc93a1a0ac7d87d82 authored over 3 years ago by Todd C. Miller <[email protected]>

regen

github.com/sudo-project/sudo - a9f204aef8befbb20a44b04e9b27b770ad50a20b authored over 3 years ago by Todd C. Miller <[email protected]>

Move audit.c from libparsesudoers to the sudoers module itself.

Now that audit.c contains the audit module it doesn't belong in
libparsesudoers.

github.com/sudo-project/sudo - 1f97ef92b753dc80582a2d6f86f36483ee0a9281 authored over 3 years ago by Todd C. Miller <[email protected]>

Do not pass AX_APPEND_FLAG more than a single flag.

GitHub issue #92

github.com/sudo-project/sudo - 942b11149ca83cb1b29548d79287c4dad7ff0fcc authored over 3 years ago by Todd C. Miller <[email protected]>

Fix up some .la file library dependencies.

libsudo_iolog.la already depends on libsudo_util.la and libsudo_eventlog.la
so we don't need to l...

github.com/sudo-project/sudo - 53e3dca7a67f473cda9f530c1240d447c31325fd authored over 3 years ago by Todd C. Miller <[email protected]>

Use sudo_basename() instead of doing the equivalent manually.

github.com/sudo-project/sudo - 0663ffbc3f9329cd75588e00ca177950ae351ab8 authored over 3 years ago by Todd C. Miller <[email protected]>

Add a GNU-compatible version of basename(3).

Unlike POSIX basename(3), the GNU variant does not modify its argument.
Note that basename of a p...

github.com/sudo-project/sudo - 41fa461fe157d9977967dcb96d9f0803d8aebc5b authored over 3 years ago by Todd C. Miller <[email protected]>

feof(3) returns non-zero at EOF, not necessarily 1.

On Illumos at least it returns a value other than 1.

github.com/sudo-project/sudo - bbfd430cf96613308775370be147d825ed3ee453 authored over 3 years ago by Todd C. Miller <[email protected]>

Portable workaround for getdelim(3) implementations modify buf on EOF.

We should assume that the contents of buf are undefined when getdelim(3)
returns -1. We now peek...

github.com/sudo-project/sudo - cbf73e19bba0593531d2c5f568f7bb8591a21b28 authored over 3 years ago by Todd C. Miller <[email protected]>

Some getdelim(3) implementations write a NUL to the buffer on EOF.

AIX and Illumos appear to have this behavior. We now preserve the
first character of the buffer ...

github.com/sudo-project/sudo - cf180114660e5e5a632a8625f0c791716a9c6ecb authored over 3 years ago by Todd C. Miller <[email protected]>

Fuzz the example sudoers file, not the default one.

The default sudoers uses @includedir which can result in different
output, depending on the permi...

github.com/sudo-project/sudo - 1412695a4a2bbd153f14e642efde411b67e5c6d2 authored over 3 years ago by Todd C. Miller <[email protected]>

illumos has a broken fmemopen(3), don't use it.

github.com/sudo-project/sudo - a527c583dca00e9acf73532a00735718ccda0072 authored over 3 years ago by Todd C. Miller <[email protected]>

Add configure check for SSIZE_MAX

github.com/sudo-project/sudo - e392646ed4dd08765056089a7d1e0fbbb4d83c0b authored over 3 years ago by Todd C. Miller <[email protected]>

Suppress PVS Studio false positives.

github.com/sudo-project/sudo - 91351d57f48dbccd243a4b96f1882ece8b49e406 authored over 3 years ago by Todd C. Miller <[email protected]>

Silence a clang analyzer false positive.

github.com/sudo-project/sudo - 63d043fae244c1c5fa0f14d9a14a3288f0e2f201 authored over 3 years ago by Todd C. Miller <[email protected]>

Silence a clang analyzer false positive.

github.com/sudo-project/sudo - 3d55bca8ac4171aca725398e21255d232b74cb93 authored over 3 years ago by Todd C. Miller <[email protected]>

Fix CID 217123, size check always false on 64-bit systems.

github.com/sudo-project/sudo - 722759d0b98b08326fd89fb1d83270229176d385 authored over 3 years ago by Todd C. Miller <[email protected]>

Make open_sudoers() always return NULL like fuzz_sudoers.c

github.com/sudo-project/sudo - aae168c485c6cfcf83fb3d4b96779ddb0a293174 authored over 3 years ago by Todd C. Miller <[email protected]>

Update *.toke.ok now that lexer doesn't call sudoerserror() itself.

github.com/sudo-project/sudo - 19d8d4a549d018eb584de342e27645ce9e60be72 authored over 3 years ago by Todd C. Miller <[email protected]>

The lexer now sets an error string before returning ERROR.

The parser will use that when reporting on an ERROR state. This
prevents the lexer from reportin...

github.com/sudo-project/sudo - 04de04f544602317e9cbf63bf771c28afe23bd72 authored over 3 years ago by Todd C. Miller <[email protected]>

Go back to storing the last error file/line in sudoerserrorf().

This is still the best way to avoid displaying more than one error
per line.

github.com/sudo-project/sudo - 9325a342b57012ec059bb503a8e8940584ec77ce authored over 3 years ago by Todd C. Miller <[email protected]>

Add -fsanitize=fuzzer-no-link to ASAN_LDFLAGS too, not just ASAN_CFLAGS.

github.com/sudo-project/sudo - a046e3bbb02e124083bba66d780998f6b8982832 authored over 3 years ago by Todd C. Miller <[email protected]>

Add fuzz Makefile target and run fuzzer corpus in make check.

github.com/sudo-project/sudo - 63a3f625477194fc385c215f57e02990ea049871 authored over 3 years ago by Todd C. Miller <[email protected]>

Add stub library that just feeds files to the fuzzing target.

This will allow the fuzzers to be run as part of "make check".

github.com/sudo-project/sudo - 30d9497eb6c0802b51643bba96ffb5dc6b3f1a52 authored over 3 years ago by Todd C. Miller <[email protected]>

Append to CFLAGS and LDFLAGS instead of overriding them when adding -m64.

github.com/sudo-project/sudo - db4ee0a903c5d2419658ff40687c74eb4aff53c3 authored over 3 years ago by Todd C. Miller <[email protected]>

Fall back to a temp file if fmemopen() is not available().

github.com/sudo-project/sudo - a72d743ec8d95a6e30e6c692ae95d63a7160f0e3 authored over 3 years ago by Todd C. Miller <[email protected]>

Add missing return statement when NO_LEAKS is not defined.

github.com/sudo-project/sudo - c19cb388bc36e3dc9369f86bfb0b838167d1544d authored over 3 years ago by Todd C. Miller <[email protected]>

Remove remnants of liblogsrv.

github.com/sudo-project/sudo - c140b5942cb8fa4db4578c5016e0b8d43dddf765 authored over 3 years ago by Todd C. Miller <[email protected]>

Add --enable-fuzzer-linker and --enable-fuzzer-engine options.

These will allow the fuzzers to be built as part of oss-fuzz.

github.com/sudo-project/sudo - 55df5efdceb6dc2586aae1cedfb4033b99cd78d9 authored over 3 years ago by Todd C. Miller <[email protected]>

Sync ignore files.

github.com/sudo-project/sudo - 38f1e55cdc48245bf0b402011e34e2bbf087c73c authored over 3 years ago by Todd C. Miller <[email protected]>

Fix linking of sudoers fuzzers with static libsudo_util.

github.com/sudo-project/sudo - a3dae6f2c9dd1f4745badd7b88411de64bc5ea78 authored over 3 years ago by Todd C. Miller <[email protected]>

Add --enable-fuzzer option to use when building fuzzers

github.com/sudo-project/sudo - 6216fb3ccabb0cb43bb8e57de5731c03e42b9471 authored over 3 years ago by Todd C. Miller <[email protected]>

Replace --enable-asan with --enable-sanitizer

It is not possible to set the sanitizer flags at configure time.

github.com/sudo-project/sudo - 7a2a211dfc958e9f5ca328f8d9b25d5fcd7b6ccc authored over 3 years ago by Todd C. Miller <[email protected]>

Fix comment typo in src/copy_file.c

github.com/sudo-project/sudo - fecb68617d35a5f03c56437e80b7c0bb3ad4f989 authored over 3 years ago by Anton Bershanskiy <[email protected]>

Build (but don't run) fuzzers as part of "make check".

Uses a stub to make it possible to link w/o libfuzzer.
The goal is to ensure the fuzzers are alwa...

github.com/sudo-project/sudo - 4480e269728242b55f15c0a79ec4234688c6dcb3 authored over 3 years ago by Todd C. Miller <[email protected]>

Add libsudo_eventlog.la as a dependency of libsudo_iolog.la

No longer need to link against libsudo_eventlog.la in sudoers.

github.com/sudo-project/sudo - ecaa9cd08d25870ec89fec82cf17c6cdaa4c7912 authored over 3 years ago by Todd C. Miller <[email protected]>

Add more test files for fuzzers.

github.com/sudo-project/sudo - 1c02c14c35207d981240d7a517aabbe7b6ea4b16 authored over 3 years ago by Todd C. Miller <[email protected]>

Fix the typo in the mdoc

github.com/sudo-project/sudo - d51c49789e9bc38a826b65a628dacf27defc115a authored over 3 years ago by Daniel Milnes <[email protected]>

Fix a tiny typo in the Sudo manpage

github.com/sudo-project/sudo - 2b2e5d0c40069689c6c2e491116cc4f1d4c86c5b authored over 3 years ago by Daniel Milnes <[email protected]>

fuzzer for I/O log timing files

github.com/sudo-project/sudo - 5c2a21350d5d8581264d83edc597553f5a3bce3b authored over 3 years ago by Todd C. Miller <[email protected]>

In JSON, name/value pairs must be separated by a comma.

Previously we didn't require the comma to be there.

github.com/sudo-project/sudo - 47f08e986fe74e467f4769327290d6e468300a37 authored over 3 years ago by Todd C. Miller <[email protected]>