This is a bug in visudo's unused alias check. It is not counting the runas groups when checking for unused entries. The fix is simple and will be in sudo 1.8.9. - todd