isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Regen .man.in files with hacked mandoc to avoid issues with historic

Browse Source 
nroff.
This commit is contained in:
Todd C. Miller
2012-07-20 14:28:41 -04:00
parent 05e7cac89b
commit a06f7540f7
6 changed files with 304 additions and 251 deletions
Download Patch File Download Diff File Expand all files Collapse all files

250
doc/sudo.man.in
View File

@@ -22,6 +22,8 @@
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512. .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
.\" .\"
.TH "SUDO" "@mansectsu@" "July 10, 2012" "1.8.6" "System Manager's Manual" .TH "SUDO" "@mansectsu@" "July 10, 2012" "1.8.6" "System Manager's Manual"
.nh
.if n .ad l
.SH "NAME" .SH "NAME"
\fBsudo\fR, \fBsudo\fR,
\fBsudoedit\fR \fBsudoedit\fR
@@ -29,53 +31,54 @@
.SH "SYNOPSIS" .SH "SYNOPSIS"
.HP 5n .HP 5n
\fBsudo\fR \fBsudo\fR
\fB-h\fR | \fB-K\fR | \fB-k\fR | \fB-V\fR \fB\-h\fR | \fB\-K\fR | \fB\-k\fR | \fB\-V\fR
.sp -1v .PD 0
.HP 5n .HP 5n
\fBsudo\fR \fBsudo\fR
\fB-v\fR \fB\-v\fR
[\fB-AknS\fR] [\fB\-AknS\fR]
[\fB-a\fR\~\fIauth_type\fR] [\fB\-a\fR\ \fIauth_type\fR]
[\fB-g\fR\~\fIgroup\~name\fR\~|\~\fI#gid\fR] [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
[\fB-p\fR\~\fIprompt\fR] [\fB\-p\fR\ \fIprompt\fR]
[\fB-u\fR\~\fIuser\~name\fR\~|\~\fI#uid\fR] [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
.sp -1v .br
.HP 5n .HP 5n
\fBsudo\fR \fBsudo\fR
\fB-l\fR[\fIl\fR] \fB\-l\fR[\fIl\fR]
[\fB-AknS\fR] [\fB\-AknS\fR]
[\fB-a\fR\~\fIauth_type\fR] [\fB\-a\fR\ \fIauth_type\fR]
[\fB-g\fR\~\fIgroup\~name\fR\~|\~\fI#gid\fR] [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
[\fB-p\fR\~\fIprompt\fR] [\fB\-p\fR\ \fIprompt\fR]
[\fB-U\fR\~\fIuser\~name\fR] [\fB\-U\fR\ \fIuser\ name\fR]
[\fB-u\fR\~\fIuser\~name\fR\~|\~\fI#uid\fR] [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
[\fIcommand\fR] [\fIcommand\fR]
.sp -1v .br
.HP 5n .HP 5n
\fBsudo\fR \fBsudo\fR
[\fB-AbEHnPS\fR] [\fB\-AbEHnPS\fR]
[\fB-a\fR\~\fIauth_type\fR] [\fB\-a\fR\ \fIauth_type\fR]
[\fB-C\fR\~\fIfd\fR] [\fB\-C\fR\ \fIfd\fR]
[\fB-c\fR\~\fIclass\fR\~|\~\fI-\fR] [\fB\-c\fR\ \fIclass\fR\ |\ \fI-\fR]
[\fB-g\fR\~\fIgroup\~name\fR\~|\~\fI#gid\fR] [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
[\fB-p\fR\~\fIprompt\fR] [\fB\-p\fR\ \fIprompt\fR]
[\fB-r\fR\~\fIrole\fR] [\fB\-r\fR\ \fIrole\fR]
[\fB-t\fR\~\fItype\fR] [\fB\-t\fR\ \fItype\fR]
[\fB-u\fR\~\fIuser\~name\fR\~|\~\fI#uid\fR] [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
[\fBVAR\fR=\fIvalue\fR] [\fBVAR\fR=\fIvalue\fR]
\fB-i\fR\~|\~\fB-s\fR \fB\-i\fR\ |\ \fB\-s\fR
[\fIcommand\fR] [\fIcommand\fR]
.sp -1v .br
.HP 9n .HP 9n
\fBsudoedit\fR \fBsudoedit\fR
[\fB-AnS\fR] [\fB\-AnS\fR]
[\fB-a\fR\~\fIauth_type\fR] [\fB\-a\fR\ \fIauth_type\fR]
[\fB-C\fR\~\fIfd\fR] [\fB\-C\fR\ \fIfd\fR]
[\fB-c\fR\~\fIclass\fR\~|\~\fI-\fR] [\fB\-c\fR\ \fIclass\fR\ |\ \fI-\fR]
[\fB-g\fR\~\fIgroup\~name\fR\~|\~\fI#gid\fR] [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
[\fB-p\fR\~\fIprompt\fR] [\fB\-p\fR\ \fIprompt\fR]
[\fB-u\fR\~\fIuser\~name\fR\~|\~\fI#uid\fR] [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
file ... file ...
.PD
.SH "DESCRIPTION" .SH "DESCRIPTION"
\fBsudo\fR \fBsudo\fR
allows a permitted user to execute a allows a permitted user to execute a
@@ -85,7 +88,7 @@ policy.
The real and effective uid and gid are set to match those of the The real and effective uid and gid are set to match those of the
target user, as specified in the password database, and the group target user, as specified in the password database, and the group
vector is initialized based on the group database (unless the vector is initialized based on the group database (unless the
\fB-P\fR \fB\-P\fR
option was specified). option was specified).
.PP .PP
\fBsudo\fR \fBsudo\fR
@@ -133,14 +136,14 @@ sudoers(@mansectform@).
By running By running
\fBsudo\fR \fBsudo\fR
with the with the
\fB-v\fR \fB\-v\fR
option, a user can update the cached credentials without running a option, a user can update the cached credentials without running a
\fIcommand\fR. \fIcommand\fR.
.PP .PP
When invoked as When invoked as
\fBsudoedit\fR, \fBsudoedit\fR,
the the
\fB-e\fR \fB\-e\fR
option (described below), is implied. option (described below), is implied.
.PP .PP
Security policies may log successful and failed attempts to use Security policies may log successful and failed attempts to use
@@ -151,12 +154,12 @@ output may be logged as well.
\fBsudo\fR \fBsudo\fR
accepts the following command line options: accepts the following command line options:
.TP 12n .TP 12n
\fB-A\fR \fB\-A\fR
Normally, if Normally, if
\fBsudo\fR \fBsudo\fR
requires a password, it will read it from the user's terminal. requires a password, it will read it from the user's terminal.
If the If the
\fB-A\fR (\fIaskpass\fR) \fB\-A\fR (\fIaskpass\fR)
option is specified, a (possibly graphical) helper program is option is specified, a (possibly graphical) helper program is
executed to read the user's password and output the password to the executed to read the user's password and output the password to the
standard output. standard output.
@@ -183,11 +186,11 @@ If no askpass program is available,
will exit with an error. will exit with an error.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 12n .TP 12n
\fB-a\fR \fItype\fR \fB\-a\fR \fItype\fR
The The
\fB-a\fR (\fIauthentication type\fR) \fB\-a\fR (\fIauthentication type\fR)
option causes option causes
\fBsudo\fR \fBsudo\fR
to use the specified authentication type when validating the user, to use the specified authentication type when validating the user,
@@ -199,43 +202,44 @@ authentication methods by adding an
entry in entry in
\fI/etc/login.conf\fR. \fI/etc/login.conf\fR.
This option is only available on systems that support BSD authentication. This option is only available on systems that support BSD authentication.
.PD
.TP 12n .TP 12n
\fB-b\fR \fB\-b\fR
The The
\fB-b\fR (\fIbackground\fR) \fB\-b\fR (\fIbackground\fR)
option tells option tells
\fBsudo\fR \fBsudo\fR
to run the given command in the background. to run the given command in the background.
Note that if you use the Note that if you use the
\fB-b\fR \fB\-b\fR
option you cannot use shell job control to manipulate the process. option you cannot use shell job control to manipulate the process.
Most interactive commands will fail to work properly in background Most interactive commands will fail to work properly in background
mode. mode.
.TP 12n .TP 12n
\fB-C\fR \fIfd\fR \fB\-C\fR \fIfd\fR
Normally, Normally,
\fBsudo\fR \fBsudo\fR
will close all open file descriptors other than standard input, will close all open file descriptors other than standard input,
standard output and standard error. standard output and standard error.
The The
\fB-C\fR (\fIclose from\fR) \fB\-C\fR (\fIclose from\fR)
option allows the user to specify a starting point above the standard option allows the user to specify a starting point above the standard
error (file descriptor three). error (file descriptor three).
Values less than three are not permitted. Values less than three are not permitted.
The security policy may restrict the user's ability to use the The security policy may restrict the user's ability to use the
\fB-C\fR \fB\-C\fR
option. option.
The The
\fIsudoers\fR \fIsudoers\fR
policy only permits use of the policy only permits use of the
\fB-C\fR \fB\-C\fR
option when the administrator has enabled the option when the administrator has enabled the
\fIclosefrom_override\fR \fIclosefrom_override\fR
option. option.
.TP 12n .TP 12n
\fB-c\fR \fIclass\fR \fB\-c\fR \fIclass\fR
The The
\fB-c\fR (\fIclass\fR) \fB\-c\fR (\fIclass\fR)
option causes option causes
\fBsudo\fR \fBsudo\fR
to run the specified command with resources limited by the specified to run the specified command with resources limited by the specified
@@ -261,19 +265,19 @@ as root, or the
command must be run from a shell that is already root. command must be run from a shell that is already root.
This option is only available on systems with BSD login classes. This option is only available on systems with BSD login classes.
.TP 12n .TP 12n
\fB-E\fR \fB\-E\fR
The The
\fB-E\fR (\fIpreserve environment\fR) \fB\-E\fR (\fIpreserve environment\fR)
option indicates to the security policy that the user wishes to option indicates to the security policy that the user wishes to
preserve their existing environment variables. preserve their existing environment variables.
The security policy may return an error if the The security policy may return an error if the
\fB-E\fR \fB\-E\fR
option is specified and the user does not have permission to preserve option is specified and the user does not have permission to preserve
the environment. the environment.
.TP 12n .TP 12n
\fB-e\fR \fB\-e\fR
The The
\fB-e\fR (\fIedit\fR) \fB\-e\fR (\fIedit\fR)
option indicates that, instead of running a command, the user wishes option indicates that, instead of running a command, the user wishes
to edit one or more files. to edit one or more files.
In lieu of a command, the string "sudoedit" is used when consulting In lieu of a command, the string "sudoedit" is used when consulting
@@ -324,16 +328,16 @@ receive a warning and the edited copy will remain in a temporary
file. file.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 12n .TP 12n
\fB-g\fR \fIgroup\fR \fB\-g\fR \fIgroup\fR
Normally, Normally,
\fBsudo\fR \fBsudo\fR
runs a command with the primary group set to the one specified by runs a command with the primary group set to the one specified by
the password database for the user the command is being run as (by the password database for the user the command is being run as (by
default, root). default, root).
The The
\fB-g\fR (\fIgroup\fR) \fB\-g\fR (\fIgroup\fR)
option causes option causes
\fBsudo\fR \fBsudo\fR
to run the command with the primary group set to to run the command with the primary group set to
@@ -352,31 +356,32 @@ many shells require that the
be escaped with a backslash be escaped with a backslash
(`\e'). (`\e').
If no If no
\fB-u\fR \fB\-u\fR
option is specified, the command will be run as the invoking user option is specified, the command will be run as the invoking user
(not root). (not root).
In either case, the primary group will be set to In either case, the primary group will be set to
\fIgroup\fR. \fIgroup\fR.
.PD
.TP 12n .TP 12n
\fB-H\fR \fB\-H\fR
The The
\fB-H\fR (\fIHOME\fR) \fB\-H\fR (\fIHOME\fR)
option requests that the security policy set the option requests that the security policy set the
\fRHOME\fR \fRHOME\fR
environment variable to the home directory of the target user (root environment variable to the home directory of the target user (root
by default) as specified by the password database. by default) as specified by the password database.
Depending on the policy, this may be the default behavior. Depending on the policy, this may be the default behavior.
.TP 12n .TP 12n
\fB-h\fR \fB\-h\fR
The The
\fB-h\fR (\fIhelp\fR) \fB\-h\fR (\fIhelp\fR)
option causes option causes
\fBsudo\fR \fBsudo\fR
to print a short help message to the standard output and exit. to print a short help message to the standard output and exit.
.TP 12n .TP 12n
\fB-i\fR [\fIcommand\fR] \fB\-i\fR [\fIcommand\fR]
The The
\fB-i\fR (\fIsimulate initial login\fR) \fB\-i\fR (\fIsimulate initial login\fR)
option runs the shell specified by the password database entry of option runs the shell specified by the password database entry of
the target user as a login shell. the target user as a login shell.
This means that login-specific resource files such as This means that login-specific resource files such as
@@ -386,7 +391,7 @@ or
will be read by the shell. will be read by the shell.
If a command is specified, it is passed to the shell for execution If a command is specified, it is passed to the shell for execution
via the shell's via the shell's
\fB-c\fR \fB\-c\fR
option. option.
If no command is specified, an interactive shell is executed. If no command is specified, an interactive shell is executed.
\fBsudo\fR \fBsudo\fR
@@ -399,24 +404,24 @@ The
section in the section in the
sudoers(@mansectform@) sudoers(@mansectform@)
manual documents how the manual documents how the
\fB-i\fR \fB\-i\fR
option affects the environment in which a command is run when the option affects the environment in which a command is run when the
\fIsudoers\fR \fIsudoers\fR
policy is in use. policy is in use.
.TP 12n .TP 12n
\fB-K\fR \fB\-K\fR
The The
\fB-K\fR (sure \fIkill\fR) \fB\-K\fR (sure \fIkill\fR)
option is like option is like
\fB-k\fR \fB\-k\fR
except that it removes the user's cached credentials entirely and except that it removes the user's cached credentials entirely and
may not be used in conjunction with a command or other option. may not be used in conjunction with a command or other option.
This option does not require a password. This option does not require a password.
Not all security policies support credential caching. Not all security policies support credential caching.
.TP 12n .TP 12n
\fB-k\fR [\fIcommand\fR] \fB\-k\fR [\fIcommand\fR]
When used alone, the When used alone, the
\fB-k\fR (\fIkill\fR) \fB\-k\fR (\fIkill\fR)
option to option to
\fBsudo\fR \fBsudo\fR
invalidates the user's cached credentials. invalidates the user's cached credentials.
@@ -433,7 +438,7 @@ Not all security policies support credential caching.
.sp .sp
When used in conjunction with a command or an option that may require When used in conjunction with a command or an option that may require
a password, the a password, the
\fB-k\fR \fB\-k\fR
option will cause option will cause
\fBsudo\fR \fBsudo\fR
to ignore the user's cached credentials. to ignore the user's cached credentials.
@@ -442,14 +447,14 @@ As a result,
will prompt for a password (if one is required by the security will prompt for a password (if one is required by the security
policy) and will not update the user's cached credentials. policy) and will not update the user's cached credentials.
.TP 12n .TP 12n
\fB-l\fR[\fBl\fR] [\fIcommand\fR] \fB\-l\fR[\fBl\fR] [\fIcommand\fR]
If no If no
\fIcommand\fR \fIcommand\fR
is specified, the is specified, the
\fB-l\fR (\fIlist\fR) \fB\-l\fR (\fIlist\fR)
option will list the allowed (and forbidden) commands for the option will list the allowed (and forbidden) commands for the
invoking user (or the user specified by the invoking user (or the user specified by the
\fB-U\fR \fB\-U\fR
option) on the current host. option) on the current host.
If a If a
\fIcommand\fR \fIcommand\fR
@@ -462,18 +467,18 @@ is specified but not allowed,
\fBsudo\fR \fBsudo\fR
will exit with a status value of 1. will exit with a status value of 1.
If the If the
\fB-l\fR \fB\-l\fR
option is specified with an option is specified with an
\fIl\fR \fIl\fR
argument argument
(i.e.\& \fB-ll\fR), (i.e.\& \fB\-ll\fR),
or if or if
\fB-l\fR \fB\-l\fR
is specified multiple times, a longer list format is used. is specified multiple times, a longer list format is used.
.TP 12n .TP 12n
\fB-n\fR \fB\-n\fR
The The
\fB-n\fR (\fInon-interactive\fR) \fB\-n\fR (\fInon-interactive\fR)
option prevents option prevents
\fBsudo\fR \fBsudo\fR
from prompting the user for a password. from prompting the user for a password.
@@ -481,9 +486,9 @@ If a password is required for the command to run,
\fBsudo\fR \fBsudo\fR
will display an error message and exit. will display an error message and exit.
.TP 12n .TP 12n
\fB-P\fR \fB\-P\fR
The The
\fB-P\fR (\fIpreserve group vector\fR) \fB\-P\fR (\fIpreserve group vector\fR)
option causes option causes
\fBsudo\fR \fBsudo\fR
to preserve the invoking user's group vector unaltered. to preserve the invoking user's group vector unaltered.
@@ -494,9 +499,9 @@ target user is in.
The real and effective group IDs, however, are still set to match The real and effective group IDs, however, are still set to match
the target user. the target user.
.TP 12n .TP 12n
\fB-p\fR \fIprompt\fR \fB\-p\fR \fIprompt\fR
The The
\fB-p\fR (\fIprompt\fR) \fB\-p\fR (\fIprompt\fR)
option allows you to override the default password prompt and use option allows you to override the default password prompt and use
a custom one. a custom one.
The following percent The following percent
@@ -526,10 +531,10 @@ and
flags in flags in
sudoers(@mansectform@)) sudoers(@mansectform@))
.TP 4n .TP 4n
\fR%U\fR \fR\&%U\fR
expanded to the login name of the user the command will be run as expanded to the login name of the user the command will be run as
(defaults to root unless the (defaults to root unless the
\fB-u\fR \fB\-u\fR
option is also specified) option is also specified)
.TP 4n .TP 4n
\fR%u\fR \fR%u\fR
@@ -545,7 +550,7 @@ character
.RS .RS
.PP .PP
The prompt specified by the The prompt specified by the
\fB-p\fR \fB\-p\fR
option will override the system password prompt on systems that option will override the system password prompt on systems that
support PAM unless the support PAM unless the
\fIpassprompt_override\fR \fIpassprompt_override\fR
@@ -553,51 +558,52 @@ flag is disabled in
\fIsudoers\fR. \fIsudoers\fR.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 12n .TP 12n
\fB-r\fR \fIrole\fR \fB\-r\fR \fIrole\fR
The The
\fB-r\fR (\fIrole\fR) \fB\-r\fR (\fIrole\fR)
option causes the new (SELinux) security context to have the role option causes the new (SELinux) security context to have the role
specified by specified by
\fIrole\fR. \fIrole\fR.
.PD
.TP 12n .TP 12n
\fB-S\fR \fB\-S\fR
The The
\fB-S\fR (\fIstdin\fR) \fB\-S\fR (\fIstdin\fR)
option causes option causes
\fBsudo\fR \fBsudo\fR
to read the password from the standard input instead of the terminal to read the password from the standard input instead of the terminal
device. device.
The password must be followed by a newline character. The password must be followed by a newline character.
.TP 12n .TP 12n
\fB-s\fR [\fIcommand\fR] \fB\-s\fR [\fIcommand\fR]
The The
\fB-s\fR (\fIshell\fR) \fB\-s\fR (\fIshell\fR)
option runs the shell specified by the option runs the shell specified by the
\fRSHELL\fR \fRSHELL\fR
environment variable if it is set or the shell as specified in the environment variable if it is set or the shell as specified in the
password database. password database.
If a command is specified, it is passed to the shell for execution If a command is specified, it is passed to the shell for execution
via the shell's via the shell's
\fB-c\fR \fB\-c\fR
option. option.
If no command is specified, an interactive shell is executed. If no command is specified, an interactive shell is executed.
.TP 12n .TP 12n
\fB-t\fR \fItype\fR \fB\-t\fR \fItype\fR
The The
\fB-t\fR (\fItype\fR) \fB\-t\fR (\fItype\fR)
option causes the new (SELinux) security context to have the type option causes the new (SELinux) security context to have the type
specified by specified by
\fItype\fR. \fItype\fR.
If no type is specified, the default type is derived from the If no type is specified, the default type is derived from the
specified role. specified role.
.TP 12n .TP 12n
\fB-U\fR \fIuser\fR \fB\-U\fR \fIuser\fR
The The
\fB-U\fR (\fIother user\fR) \fB\-U\fR (\fIother user\fR)
option is used in conjunction with the option is used in conjunction with the
\fB-l\fR \fB\-l\fR
option to specify the user whose privileges should be listed. option to specify the user whose privileges should be listed.
The security policy may restrict listing other users' privileges. The security policy may restrict listing other users' privileges.
The The
@@ -606,9 +612,9 @@ policy only allows root or a user with the
\fRALL\fR \fRALL\fR
privilege on the current host to use this option. privilege on the current host to use this option.
.TP 12n .TP 12n
\fB-u\fR \fIuser\fR \fB\-u\fR \fIuser\fR
The The
\fB-u\fR (\fIuser\fR) \fB\-u\fR (\fIuser\fR)
option causes option causes
\fBsudo\fR \fBsudo\fR
to run the specified command as a user other than to run the specified command as a user other than
@@ -636,23 +642,23 @@ that are not in the password database as long as the
option is not set. option is not set.
Other security policies may not support this. Other security policies may not support this.
.TP 12n .TP 12n
\fB-V\fR \fB\-V\fR
The The
\fB-V\fR (\fIversion\fR) \fB\-V\fR (\fIversion\fR)
option causes option causes
\fBsudo\fR \fBsudo\fR
to print its version string and the version string of the security to print its version string and the version string of the security
policy plugin and any I/O plugins. policy plugin and any I/O plugins.
If the invoking user is already root the If the invoking user is already root the
\fB-V\fR \fB\-V\fR
option will display the arguments passed to configure when option will display the arguments passed to configure when
\fBsudo\fR \fBsudo\fR
was built and plugins may display more verbose information such as was built and plugins may display more verbose information such as
default options. default options.
.TP 12n .TP 12n
\fB-v\fR \fB\-v\fR
When given the When given the
\fB-v\fR (\fIvalidate\fR) \fB\-v\fR (\fIvalidate\fR)
option, option,
\fBsudo\fR \fBsudo\fR
will update the user's cached credentials, authenticating the user's will update the user's cached credentials, authenticating the user's
@@ -667,9 +673,9 @@ minutes (or whatever the timeout is set to by the security policy)
but does not run a command. but does not run a command.
Not all security policies support cached credentials. Not all security policies support cached credentials.
.TP 12n .TP 12n
\fB--\fR \fB\--\fR
The The
\fB--\fR \fB\--\fR
option indicates that option indicates that
\fBsudo\fR \fBsudo\fR
should stop processing command line arguments. should stop processing command line arguments.
@@ -1037,7 +1043,7 @@ environment.
.TP 17n .TP 17n
\fREDITOR\fR \fREDITOR\fR
Default editor to use in Default editor to use in
\fB-e\fR \fB\-e\fR
(sudoedit) mode if neither (sudoedit) mode if neither
\fRSUDO_EDITOR\fR \fRSUDO_EDITOR\fR
nor nor
@@ -1046,7 +1052,7 @@ is set.
.TP 17n .TP 17n
\fRMAIL\fR \fRMAIL\fR
In In
\fB-i\fR \fB\-i\fR
mode or when mode or when
\fIenv_reset\fR \fIenv_reset\fR
is enabled in is enabled in
@@ -1055,9 +1061,9 @@ set to the mail spool of the target user.
.TP 17n .TP 17n
\fRHOME\fR \fRHOME\fR
Set to the home directory of the target user if Set to the home directory of the target user if
\fB-i\fR \fB\-i\fR
or or
\fB-H\fR \fB\-H\fR
are specified, are specified,
\fIenv_reset\fR \fIenv_reset\fR
or or
@@ -1065,7 +1071,7 @@ or
are set in are set in
\fIsudoers\fR, \fIsudoers\fR,
or when the or when the
\fB-s\fR \fB\-s\fR
option is specified and option is specified and
\fIset_home\fR \fIset_home\fR
is set in is set in
@@ -1076,13 +1082,13 @@ May be overridden by the security policy.
.TP 17n .TP 17n
\fRSHELL\fR \fRSHELL\fR
Used to determine shell to run with Used to determine shell to run with
\fB-s\fR \fB\-s\fR
option. option.
.TP 17n .TP 17n
\fRSUDO_ASKPASS\fR \fRSUDO_ASKPASS\fR
Specifies the path to a helper program used to read the password Specifies the path to a helper program used to read the password
if no terminal is available or if the if no terminal is available or if the
\fB-A\fR \fB\-A\fR
option is specified. option is specified.
.TP 17n .TP 17n
\fRSUDO_COMMAND\fR \fRSUDO_COMMAND\fR
@@ -1090,7 +1096,7 @@ Set to the command run by sudo.
.TP 17n .TP 17n
\fRSUDO_EDITOR\fR \fRSUDO_EDITOR\fR
Default editor to use in Default editor to use in
\fB-e\fR \fB\-e\fR
(sudoedit) mode. (sudoedit) mode.
.TP 17n .TP 17n
\fRSUDO_GID\fR \fRSUDO_GID\fR
@@ -1112,12 +1118,12 @@ Set to the login name of the user who invoked sudo.
.TP 17n .TP 17n
\fRUSER\fR \fRUSER\fR
Set to the target user (root unless the Set to the target user (root unless the
\fB-u\fR \fB\-u\fR
option is specified). option is specified).
.TP 17n .TP 17n
\fRVISUAL\fR \fRVISUAL\fR
Default editor to use in Default editor to use in
\fB-e\fR \fB\-e\fR
(sudoedit) mode if (sudoedit) mode if
\fRSUDO_EDITOR\fR \fRSUDO_EDITOR\fR
is not set. is not set.

122
doc/sudo_plugin.man.in
View File

@@ -17,6 +17,8 @@
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.TH "SUDO_PLUGIN" "5" "July 16, 2012" "1.8.6" "OpenBSD Programmer's Manual" .TH "SUDO_PLUGIN" "5" "July 16, 2012" "1.8.6" "OpenBSD Programmer's Manual"
.nh
.if n .ad l
.SH "NAME" .SH "NAME"
\fBsudo_plugin\fR \fBsudo_plugin\fR
\- Sudo Plugin API \- Sudo Plugin API
@@ -204,7 +206,7 @@ The function arguments are as follows:
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
version version
The version passed in by The version passed in by
@@ -212,6 +214,7 @@ The version passed in by
allows the plugin to determine the allows the plugin to determine the
major and minor version number of the plugin API supported by major and minor version number of the plugin API supported by
\fBsudo\fR. \fBsudo\fR.
.PD
.TP 6n .TP 6n
conversation conversation
A pointer to the A pointer to the
@@ -330,24 +333,24 @@ This setting has been deprecated in favor of
.TP 6n .TP 6n
runas_user=string runas_user=string
The user name or uid to to run the command as, if specified via the The user name or uid to to run the command as, if specified via the
\fB-u\fR \fB\-u\fR
flag. flag.
.TP 6n .TP 6n
runas_group=string runas_group=string
The group name or gid to to run the command as, if specified via The group name or gid to to run the command as, if specified via
the the
\fB-g\fR \fB\-g\fR
flag. flag.
.TP 6n .TP 6n
prompt=string prompt=string
The prompt to use when requesting a password, if specified via The prompt to use when requesting a password, if specified via
the the
\fB-p\fR \fB\-p\fR
flag. flag.
.TP 6n .TP 6n
set_home=bool set_home=bool
Set to true if the user specified the Set to true if the user specified the
\fB-H\fR \fB\-H\fR
flag. flag.
If true, set the If true, set the
\fRHOME\fR \fRHOME\fR
@@ -355,19 +358,19 @@ environment variable to the target user's home directory.
.TP 6n .TP 6n
preserve_environment=bool preserve_environment=bool
Set to true if the user specified the Set to true if the user specified the
\fB-E\fR \fB\-E\fR
flag, indicating that flag, indicating that
the user wishes to preserve the environment. the user wishes to preserve the environment.
.TP 6n .TP 6n
run_shell=bool run_shell=bool
Set to true if the user specified the Set to true if the user specified the
\fB-s\fR \fB\-s\fR
flag, indicating that flag, indicating that
the user wishes to run a shell. the user wishes to run a shell.
.TP 6n .TP 6n
login_shell=bool login_shell=bool
Set to true if the user specified the Set to true if the user specified the
\fB-i\fR \fB\-i\fR
flag, indicating that flag, indicating that
the user wishes to run a login shell. the user wishes to run a login shell.
.TP 6n .TP 6n
@@ -392,21 +395,21 @@ exit.
.TP 6n .TP 6n
preserve_groups=bool preserve_groups=bool
Set to true if the user specified the Set to true if the user specified the
\fB-P\fR \fB\-P\fR
flag, indicating that flag, indicating that
the user wishes to preserve the group vector instead of setting it the user wishes to preserve the group vector instead of setting it
based on the runas user. based on the runas user.
.TP 6n .TP 6n
ignore_ticket=bool ignore_ticket=bool
Set to true if the user specified the Set to true if the user specified the
\fB-k\fR \fB\-k\fR
flag along with a flag along with a
command, indicating that the user wishes to ignore any cached command, indicating that the user wishes to ignore any cached
authentication credentials. authentication credentials.
.TP 6n .TP 6n
noninteractive=bool noninteractive=bool
Set to true if the user specified the Set to true if the user specified the
\fB-n\fR \fB\-n\fR
flag, indicating that flag, indicating that
\fBsudo\fR \fBsudo\fR
should operate in non-interactive mode. should operate in non-interactive mode.
@@ -416,24 +419,24 @@ interaction is required.
login_class=string login_class=string
BSD login class to use when setting resource limits and nice value, BSD login class to use when setting resource limits and nice value,
if specified by the if specified by the
\fB-c\fR \fB\-c\fR
flag. flag.
.TP 6n .TP 6n
selinux_role=string selinux_role=string
SELinux role to use when executing the command, if specified by SELinux role to use when executing the command, if specified by
the the
\fB-r\fR \fB\-r\fR
flag. flag.
.TP 6n .TP 6n
selinux_type=string selinux_type=string
SELinux type to use when executing the command, if specified by SELinux type to use when executing the command, if specified by
the the
\fB-t\fR \fB\-t\fR
flag. flag.
.TP 6n .TP 6n
bsdauth_type=string bsdauth_type=string
Authentication type, if specified by the Authentication type, if specified by the
\fB-a\fR \fB\-a\fR
flag, to use on flag, to use on
systems where BSD authentication is supported. systems where BSD authentication is supported.
.TP 6n .TP 6n
@@ -457,7 +460,7 @@ or
.TP 6n .TP 6n
sudoedit=bool sudoedit=bool
Set to true when the Set to true when the
\fB-e\fR \fB\-e\fR
flag is is specified or if invoked as flag is is specified or if invoked as
\fBsudoedit\fR. \fBsudoedit\fR.
The plugin shall substitute an editor into The plugin shall substitute an editor into
@@ -473,7 +476,7 @@ section.
.TP 6n .TP 6n
closefrom=number closefrom=number
If specified, the user has requested via the If specified, the user has requested via the
\fB-C\fR \fB\-C\fR
flag that flag that
\fBsudo\fR \fBsudo\fR
close all files descriptors with a value of close all files descriptors with a value of
@@ -489,7 +492,7 @@ Additional settings may be added in the future so the plugin should
silently ignore settings that it does not recognize. silently ignore settings that it does not recognize.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
user_info user_info
A vector of information about the user running the command in the form of A vector of information about the user running the command in the form of
@@ -512,6 +515,7 @@ itself but the
\fIvalue\fR \fIvalue\fR
might. might.
.RS .RS
.PD
.TP 6n .TP 6n
pid=int pid=int
The process ID of the running The process ID of the running
@@ -663,7 +667,7 @@ The function arguments are as follows:
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
exit_status exit_status
The command's exit status, as returned by the The command's exit status, as returned by the
@@ -674,6 +678,7 @@ The value of
is undefined if is undefined if
\fRerror\fR \fRerror\fR
is non-zero. is non-zero.
.PD
.TP 6n .TP 6n
error error
.br .br
@@ -706,7 +711,7 @@ function is called by
\fBsudo\fR \fBsudo\fR
when the user specifies when the user specifies
the the
\fB-V\fR \fB\-V\fR
option. option.
The plugin may display its version information to the user via the The plugin may display its version information to the user via the
\fBconversation\fR() \fBconversation\fR()
@@ -717,7 +722,7 @@ function using
If the user requests detailed version information, the verbose flag will be set. If the user requests detailed version information, the verbose flag will be set.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
check_policy check_policy
.nf .nf
@@ -804,9 +809,10 @@ to present additional error information to the user.
.sp .sp
The function arguments are as follows: The function arguments are as follows:
.RS .RS
.PD
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
argc argc
The number of elements in The number of elements in
@@ -814,6 +820,7 @@ The number of elements in
not counting the final not counting the final
\fRNULL\fR \fRNULL\fR
pointer. pointer.
.PD
.TP 6n .TP 6n
argv argv
The argument vector describing the command the user wishes to run, The argument vector describing the command the user wishes to run,
@@ -1022,7 +1029,7 @@ the invoking user's existing entry.
Unsupported values will be ignored. Unsupported values will be ignored.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
argv_out argv_out
The The
@@ -1031,6 +1038,7 @@ argument vector to pass to the
execve(2) execve(2)
system call when executing the command. system call when executing the command.
The plugin is responsible for allocating and populating the vector. The plugin is responsible for allocating and populating the vector.
.PD
.TP 6n .TP 6n
user_env_out user_env_out
The The
@@ -1068,10 +1076,11 @@ function using
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
verbose verbose
Flag indicating whether to list in verbose mode or not. Flag indicating whether to list in verbose mode or not.
.PD
.TP 6n .TP 6n
list_user list_user
The name of a different user to list privileges for if the policy The name of a different user to list privileges for if the policy
@@ -1112,7 +1121,7 @@ The
function is called when function is called when
\fBsudo\fR \fBsudo\fR
is run with the is run with the
\fB-v\fR \fB\-v\fR
flag. flag.
For policy plugins such as For policy plugins such as
\fIsudoers\fR \fIsudoers\fR
@@ -1137,7 +1146,7 @@ to present additional
error information to the user. error information to the user.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
invalidate invalidate
.nf .nf
@@ -1153,9 +1162,9 @@ function is called when
\fBsudo\fR \fBsudo\fR
is called with is called with
the the
\fB-k\fR \fB\-k\fR
or or
\fB-K\fR \fB\-K\fR
flag. flag.
For policy plugins such as For policy plugins such as
\fIsudoers\fR \fIsudoers\fR
@@ -1172,9 +1181,10 @@ The
function should be function should be
\fRNULL\fR \fRNULL\fR
if the plugin does not support credential caching. if the plugin does not support credential caching.
.PD
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
init_session init_session
.nf .nf
@@ -1251,9 +1261,10 @@ function with
\fRSUDO_CONF_ERROR_MSG\fR \fRSUDO_CONF_ERROR_MSG\fR
to present additional to present additional
error information to the user. error information to the user.
.PD
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
register_hooks register_hooks
.nf .nf
@@ -1305,9 +1316,10 @@ front end doesn't support API
version 1.2 or higher, version 1.2 or higher,
\fRregister_hooks\fR \fRregister_hooks\fR
will not be called. will not be called.
.PD
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
deregister_hooks deregister_hooks
.nf .nf
@@ -1361,6 +1373,7 @@ version 1.2 or higher,
\fRderegister_hooks\fR \fRderegister_hooks\fR
will not be called. will not be called.
.RE .RE
.PD
.PP .PP
\fIPolicy Plugin Version Macros\fR \fIPolicy Plugin Version Macros\fR
.nf .nf
@@ -1500,7 +1513,7 @@ The function arguments are as follows:
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
version version
The version passed in by The version passed in by
@@ -1508,6 +1521,7 @@ The version passed in by
allows the plugin to determine the allows the plugin to determine the
major and minor version number of the plugin API supported by major and minor version number of the plugin API supported by
\fBsudo\fR. \fBsudo\fR.
.PD
.TP 6n .TP 6n
conversation conversation
A pointer to the A pointer to the
@@ -1675,7 +1689,7 @@ The function arguments are as follows:
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
exit_status exit_status
The command's exit status, as returned by the The command's exit status, as returned by the
@@ -1686,6 +1700,7 @@ The value of
is undefined if is undefined if
\fRerror\fR \fRerror\fR
is non-zero. is non-zero.
.PD
.TP 6n .TP 6n
error error
.br .br
@@ -1713,7 +1728,7 @@ function is called by
\fBsudo\fR \fBsudo\fR
when the user specifies when the user specifies
the the
\fB-V\fR \fB\-V\fR
option. option.
The plugin may display its version information to the user via the The plugin may display its version information to the user via the
\fBconversation\fR() \fBconversation\fR()
@@ -1724,7 +1739,7 @@ function using
If the user requests detailed version information, the verbose flag will be set. If the user requests detailed version information, the verbose flag will be set.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
log_ttyin log_ttyin
.nf .nf
@@ -1745,12 +1760,14 @@ is rejected (which will terminate the command) or \-1 if an error occurred.
.sp .sp
The function arguments are as follows: The function arguments are as follows:
.RS .RS
.PD
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
buf buf
The buffer containing user input. The buffer containing user input.
.PD
.TP 6n .TP 6n
len len
The length of The length of
@@ -1779,10 +1796,11 @@ The function arguments are as follows:
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
buf buf
The buffer containing command output. The buffer containing command output.
.PD
.TP 6n .TP 6n
len len
The length of The length of
@@ -1813,10 +1831,11 @@ The function arguments are as follows:
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
buf buf
The buffer containing user input. The buffer containing user input.
.PD
.TP 6n .TP 6n
len len
The length of The length of
@@ -1847,10 +1866,11 @@ The function arguments are as follows:
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
buf buf
The buffer containing command output. The buffer containing command output.
.PD
.TP 6n .TP 6n
len len
The length of The length of
@@ -1881,10 +1901,11 @@ The function arguments are as follows:
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
buf buf
The buffer containing command output. The buffer containing command output.
.PD
.TP 6n .TP 6n
len len
The length of The length of
@@ -1980,7 +2001,7 @@ If the registered hook does not match the typedef the results are
unspecified. unspecified.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
\fRSUDO_HOOK_UNSETENV\fR \fRSUDO_HOOK_UNSETENV\fR
The C library The C library
@@ -1999,9 +2020,10 @@ typedef int (*sudo_hook_fn_unsetenv_t)(const char *name,
.RE .RE
.fi .fi
.RS .RS
.PD
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
\fRSUDO_HOOK_GETENV\fR \fRSUDO_HOOK_GETENV\fR
The C library The C library
@@ -2023,9 +2045,10 @@ typedef int (*sudo_hook_fn_getenv_t)(const char *name,
.sp .sp
If the registered hook does not match the typedef the results are If the registered hook does not match the typedef the results are
unspecified. unspecified.
.PD
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
\fRSUDO_HOOK_PUTENV\fR \fRSUDO_HOOK_PUTENV\fR
The C library The C library
@@ -2048,9 +2071,10 @@ typedef int (*sudo_hook_fn_putenv_t)(char *string,
If the registered hook does not match the typedef the results are If the registered hook does not match the typedef the results are
unspecified. unspecified.
.RE .RE
.PD
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
hook_fn hook_fn
sudo_hook_fn_t hook_fn; sudo_hook_fn_t hook_fn;
@@ -2072,6 +2096,7 @@ This can be used to pass arbitrary data to the plugin's hook implementation.
.sp .sp
The function return value may be one of the following: The function return value may be one of the following:
.RS .RS
.PD
.TP 6n .TP 6n
\fRSUDO_HOOK_RET_ERROR\fR \fRSUDO_HOOK_RET_ERROR\fR
The hook function encountered an error. The hook function encountered an error.
@@ -2329,7 +2354,7 @@ The function arguments are as follows:
.RS .RS
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
version version
The version passed in by The version passed in by
@@ -2337,6 +2362,7 @@ The version passed in by
allows the plugin to determine the allows the plugin to determine the
major and minor version number of the group plugin API supported by major and minor version number of the group plugin API supported by
\fIsudoers\fR. \fIsudoers\fR.
.PD
.TP 6n .TP 6n
plugin_printf plugin_printf
A pointer to a A pointer to a
@@ -2374,7 +2400,7 @@ group checks.
The plugin should free any memory it has allocated and close open file handles. The plugin should free any memory it has allocated and close open file handles.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
query query
.br .br
@@ -2395,12 +2421,14 @@ is a member of
.sp .sp
The function arguments are as follows: The function arguments are as follows:
.RS .RS
.PD
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
user user
The name of the user being looked up in the external group database. The name of the user being looked up in the external group database.
.PD
.TP 6n .TP 6n
group group
.br .br

11
doc/sudoers.ldap.man.in
View File

@@ -17,6 +17,8 @@
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.TH "SUDOERS.LDAP" "8" "July 12, 2012" "1.8.6" "OpenBSD System Manager's Manual" .TH "SUDOERS.LDAP" "8" "July 12, 2012" "1.8.6" "OpenBSD System Manager's Manual"
.nh
.if n .ad l
.SH "NAME" .SH "NAME"
\fBsudoers.ldap\fR \fBsudoers.ldap\fR
\- sudo LDAP configuration \- sudo LDAP configuration
@@ -727,14 +729,15 @@ Netscape-derived:
Tivoli Directory Server: Tivoli Directory Server:
\fRtls_cert /usr/ldap/ldapkey.kdb\fR \fRtls_cert /usr/ldap/ldapkey.kdb\fR
.RE .RE
.sp -1v
.RS .RS
.PD 0
.PP .PP
.PD
When using Tivoli LDAP libraries, this file may also contain When using Tivoli LDAP libraries, this file may also contain
Certificate Authority and client certificates and may be encrypted. Certificate Authority and client certificates and may be encrypted.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 6n .TP 6n
\fBTLS_KEYPW\fR \fIsecret\fR \fBTLS_KEYPW\fR \fIsecret\fR
The The
@@ -761,6 +764,7 @@ The default
that ships with Tivoli Directory Server is encrypted with the password that ships with Tivoli Directory Server is encrypted with the password
\fRssl_password\fR. \fRssl_password\fR.
This option is only supported by the Tivoli LDAP libraries. This option is only supported by the Tivoli LDAP libraries.
.PD
.TP 6n .TP 6n
\fBTLS_RANDFILE\fR \fIfile name\fR \fBTLS_RANDFILE\fR \fIfile name\fR
The The
@@ -847,10 +851,11 @@ The following sources are recognized:
files files
read sudoers from read sudoers from
\fI@sysconfdir@/sudoers\fR \fI@sysconfdir@/sudoers\fR
.sp -1v .PD 0
.TP 10n .TP 10n
ldap ldap
read sudoers from LDAP read sudoers from LDAP
.PD
.PP .PP
In addition, the entry In addition, the entry
\fR[NOTFOUND=return]\fR \fR[NOTFOUND=return]\fR

95
doc/sudoers.man.in
View File

@@ -22,6 +22,8 @@
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512. .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
.\" .\"
.TH "SUDOERS" "@mansectsu@" "July 16, 2012" "1.8.6" "Programmer's Manual" .TH "SUDOERS" "@mansectsu@" "July 16, 2012" "1.8.6" "Programmer's Manual"
.nh
.if n .ad l
.SH "NAME" .SH "NAME"
\fBsudoers\fR \fBsudoers\fR
\- default sudo security policy module \- default sudo security policy module
@@ -86,9 +88,9 @@ Note that mail will not be sent if an unauthorized user tries to
run run
\fBsudo\fR \fBsudo\fR
with the with the
\fB-l\fR \fB\-l\fR
or or
\fB-v\fR \fB\-v\fR
option. option.
This allows users to This allows users to
determine for themselves whether or not they are allowed to use determine for themselves whether or not they are allowed to use
@@ -107,7 +109,7 @@ This can be used by a user to log commands
through sudo even when a root shell has been invoked. through sudo even when a root shell has been invoked.
It also It also
allows the allows the
\fB-e\fR \fB\-e\fR
option to remain useful even when invoked via a option to remain useful even when invoked via a
sudo-run script or program. sudo-run script or program.
Note, however, that the Note, however, that the
@@ -266,7 +268,7 @@ to preserve them.
.PP .PP
As a special case, if As a special case, if
\fBsudo\fR's \fBsudo\fR's
\fB-i\fR \fB\-i\fR
option (initial login) is option (initial login) is
specified, specified,
\fIsudoers\fR \fIsudoers\fR
@@ -658,7 +660,7 @@ The special command
is used to permit a user to run is used to permit a user to run
\fBsudo\fR \fBsudo\fR
with the with the
\fB-e\fR \fB\-e\fR
option (or as option (or as
\fBsudoedit\fR). \fBsudoedit\fR).
It may take command line arguments just as a normal command does. It may take command line arguments just as a normal command does.
@@ -781,11 +783,11 @@ The first
indicates indicates
which users the command may be run as via which users the command may be run as via
\fBsudo\fR's \fBsudo\fR's
\fB-u\fR \fB\-u\fR
option. option.
The second defines a list of groups that can be specified via The second defines a list of groups that can be specified via
\fBsudo\fR's \fBsudo\fR's
\fB-g\fR \fB\-g\fR
option. option.
If both If both
\fRRunas_List\fRs \fRRunas_List\fRs
@@ -794,7 +796,7 @@ and groups listed in their respective
\fRRunas_List\fRs. \fRRunas_List\fRs.
If only the first is specified, the command may be run as any user If only the first is specified, the command may be run as any user
in the list but no in the list but no
\fB-g\fR \fB\-g\fR
option option
may be specified. may be specified.
If the first If the first
@@ -921,9 +923,9 @@ $ sudo -g dialer /usr/bin/cu
Multiple users and groups may be present in a Multiple users and groups may be present in a
\fRRunas_Spec\fR, \fRRunas_Spec\fR,
in which case the user may select any combination of users and groups via the in which case the user may select any combination of users and groups via the
\fB-u\fR \fB\-u\fR
and and
\fB-g\fR \fB\-g\fR
options. options.
In this example: In this example:
.nf .nf
@@ -1089,7 +1091,7 @@ Note that if
has been set for a command, the user may disable the has been set for a command, the user may disable the
\fIenv_reset\fR \fIenv_reset\fR
option from the command line via the option from the command line via the
\fB-E\fR \fB\-E\fR
option. option.
Additionally, environment variables set on the command Additionally, environment variables set on the command
line are not subject to the restrictions imposed by line are not subject to the restrictions imposed by
@@ -1357,7 +1359,7 @@ directory unless one of them contains a syntax error.
It is still possible to run It is still possible to run
\fBvisudo\fR \fBvisudo\fR
with the with the
\fB-f\fR \fB\-f\fR
flag to edit the files directly. flag to edit the files directly.
.SS "Other special characters and reserved words" .SS "Other special characters and reserved words"
The pound sign The pound sign
@@ -1449,10 +1451,10 @@ will set the
\fRHOME\fR \fRHOME\fR
environment variable to the home directory of the target user environment variable to the home directory of the target user
(which is root unless the (which is root unless the
\fB-u\fR \fB\-u\fR
option is used). option is used).
This effectively means that the This effectively means that the
\fB-H\fR \fB\-H\fR
option is always implied. option is always implied.
Note that Note that
\fRHOME\fR \fRHOME\fR
@@ -1486,7 +1488,7 @@ by default.
closefrom_override closefrom_override
If set, the user may use If set, the user may use
\fBsudo\fR's \fBsudo\fR's
\fB-C\fR \fB\-C\fR
option which overrides the default starting point at which option which overrides the default starting point at which
\fBsudo\fR \fBsudo\fR
begins closing open file descriptors. begins closing open file descriptors.
@@ -1565,7 +1567,7 @@ and
lists are displayed when lists are displayed when
\fBsudo\fR \fBsudo\fR
is run by root with the is run by root with the
\fB-V\fR \fB\-V\fR
option. option.
If the If the
\fIsecure_path\fR \fIsecure_path\fR
@@ -1968,17 +1970,17 @@ set_home
If enabled and If enabled and
\fBsudo\fR \fBsudo\fR
is invoked with the is invoked with the
\fB-s\fR \fB\-s\fR
option the option the
\fRHOME\fR \fRHOME\fR
environment variable will be set to the home directory of the target environment variable will be set to the home directory of the target
user (which is root unless the user (which is root unless the
\fB-u\fR \fB\-u\fR
option is used). option is used).
This effectively makes the This effectively makes the
\fB-s\fR \fB\-s\fR
option imply option imply
\fB-H\fR. \fB\-H\fR.
Note that Note that
\fRHOME\fR \fRHOME\fR
is already set when the the is already set when the the
@@ -2006,7 +2008,7 @@ will set the
and and
\fRUSERNAME\fR \fRUSERNAME\fR
environment variables to the name of the target user (usually root unless the environment variables to the name of the target user (usually root unless the
\fB-u\fR \fB\-u\fR
option is given). option is given).
However, since some programs (including the RCS revision control system) use However, since some programs (including the RCS revision control system) use
\fRLOGNAME\fR \fRLOGNAME\fR
@@ -2046,7 +2048,7 @@ setenv
Allow the user to disable the Allow the user to disable the
\fIenv_reset\fR \fIenv_reset\fR
option from the command line via the option from the command line via the
\fB-E\fR \fB\-E\fR
option. option.
Additionally, environment variables set via the command line are Additionally, environment variables set via the command line are
not subject to the restrictions imposed by not subject to the restrictions imposed by
@@ -2063,7 +2065,7 @@ shell_noargs
If set and If set and
\fBsudo\fR \fBsudo\fR
is invoked with no arguments it acts as if the is invoked with no arguments it acts as if the
\fB-s\fR \fB\-s\fR
option had been given. option had been given.
That is, it runs a shell as root (the shell is determined by the That is, it runs a shell as root (the shell is determined by the
\fRSHELL\fR \fRSHELL\fR
@@ -2099,14 +2101,14 @@ If set,
\fBsudo\fR \fBsudo\fR
will prompt for the password of the user specified will prompt for the password of the user specified
by the by the
\fB-u\fR \fB\-u\fR
option (defaults to option (defaults to
\fRroot\fR) \fRroot\fR)
instead of the password of the invoking user. instead of the password of the invoking user.
In addition, the timestamp file name will include the target user's name. In addition, the timestamp file name will include the target user's name.
Note that this flag precludes the use of a uid not listed in the passwd Note that this flag precludes the use of a uid not listed in the passwd
database as an argument to the database as an argument to the
\fB-u\fR \fB\-u\fR
option. option.
This flag is This flag is
\fIoff\fR \fIoff\fR
@@ -2362,7 +2364,7 @@ character, the string
should be used. should be used.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 18n .TP 18n
iolog_file iolog_file
The path name, relative to The path name, relative to
@@ -2396,6 +2398,7 @@ will have the
replaced with a unique combination of digits and letters, similar to the replaced with a unique combination of digits and letters, similar to the
mktemp(3) mktemp(3)
function. function.
.PD
.TP 18n .TP 18n
mailsub mailsub
Subject of the mail sent to the Subject of the mail sent to the
@@ -2415,7 +2418,7 @@ file.
.TP 18n .TP 18n
passprompt passprompt
The default prompt to use when asking for a password; can be overridden via the The default prompt to use when asking for a password; can be overridden via the
\fB-p\fR \fB\-p\fR
option or the option or the
\fRSUDO_PROMPT\fR \fRSUDO_PROMPT\fR
environment variable. environment variable.
@@ -2442,7 +2445,7 @@ and
flags in flags in
\fIsudoers\fR) \fIsudoers\fR)
.TP 6n .TP 6n
\fR%U\fR \fR\&%U\fR
expanded to the login name of the user the command will expanded to the login name of the user the command will
be run as (defaults to root) be run as (defaults to root)
.TP 6n .TP 6n
@@ -2462,7 +2465,7 @@ The default value is
``\fR@passprompt@\fR''. ``\fR@passprompt@\fR''.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 18n .TP 18n
role role
The default SELinux role to use when constructing a new security The default SELinux role to use when constructing a new security
@@ -2473,10 +2476,11 @@ or via command line options.
This option is only available whe This option is only available whe
\fBsudo\fR \fBsudo\fR
is built with SELinux support. is built with SELinux support.
.PD
.TP 18n .TP 18n
runas_default runas_default
The default user to run commands as if the The default user to run commands as if the
\fB-u\fR \fB\-u\fR
option is not specified on the command line. option is not specified on the command line.
This defaults to This defaults to
\fR@runas_default@\fR. \fR@runas_default@\fR.
@@ -2591,13 +2595,14 @@ For more information see
sudo_plugin(@mansectform@). sudo_plugin(@mansectform@).
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 14n .TP 14n
lecture lecture
This option controls when a short lecture will be printed along with This option controls when a short lecture will be printed along with
the password prompt. the password prompt.
It has the following possible values: It has the following possible values:
.RS .RS
.PD
.TP 8n .TP 8n
always always
Always lecture the user. Always lecture the user.
@@ -2621,7 +2626,7 @@ The default value is
\fI@lecture@\fR. \fI@lecture@\fR.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 14n .TP 14n
lecture_file lecture_file
Path to a file containing an alternate Path to a file containing an alternate
@@ -2631,12 +2636,13 @@ file exists.
By default, By default,
\fBsudo\fR \fBsudo\fR
uses a built-in lecture. uses a built-in lecture.
.PD
.TP 14n .TP 14n
listpw listpw
This option controls when a password will be required when a user runs This option controls when a password will be required when a user runs
\fBsudo\fR \fBsudo\fR
with the with the
\fB-l\fR \fB\-l\fR
option. option.
It has the following possible values: It has the following possible values:
.RS .RS
@@ -2651,7 +2657,7 @@ flag set to avoid entering a password.
.TP 10n .TP 10n
always always
The user must always enter a password to use the The user must always enter a password to use the
\fB-l\fR \fB\-l\fR
option. option.
.TP 10n .TP 10n
any any
@@ -2664,7 +2670,7 @@ flag set to avoid entering a password.
.TP 10n .TP 10n
never never
The user need never enter a password to use the The user need never enter a password to use the
\fB-l\fR \fB\-l\fR
option. option.
.RE .RE
.RS .RS
@@ -2679,7 +2685,7 @@ The default value is
\fIany\fR. \fIany\fR.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 14n .TP 14n
logfile logfile
Path to the Path to the
@@ -2690,10 +2696,11 @@ negating this option turns it off.
By default, By default,
\fBsudo\fR \fBsudo\fR
logs via syslog. logs via syslog.
.PD
.TP 14n .TP 14n
mailerflags mailerflags
Flags to use when invoking mailer. Defaults to Flags to use when invoking mailer. Defaults to
\fB-t\fR. \fB\-t\fR.
.TP 14n .TP 14n
mailerpath mailerpath
Path to mail program used to send warning mail. Path to mail program used to send warning mail.
@@ -2771,7 +2778,7 @@ verifypw
This option controls when a password will be required when a user runs This option controls when a password will be required when a user runs
\fBsudo\fR \fBsudo\fR
with the with the
\fB-v\fR \fB\-v\fR
option. option.
It has the following possible values: It has the following possible values:
.RS .RS
@@ -2785,7 +2792,7 @@ flag set to avoid entering a password.
.TP 8n .TP 8n
always always
The user must always enter a password to use the The user must always enter a password to use the
\fB-v\fR \fB\-v\fR
option. option.
.TP 8n .TP 8n
any any
@@ -2797,7 +2804,7 @@ flag set to avoid entering a password.
.TP 8n .TP 8n
never never
The user need never enter a password to use the The user need never enter a password to use the
\fB-v\fR \fB\-v\fR
option. option.
.RE .RE
.RS .RS
@@ -2842,7 +2849,7 @@ The default list of environment variables to check is displayed when
\fBsudo\fR \fBsudo\fR
is run by root with is run by root with
the the
\fB-V\fR \fB\-V\fR
option. option.
.TP 18n .TP 18n
env_delete env_delete
@@ -2861,7 +2868,7 @@ operators respectively.
The default list of environment variables to remove is displayed when The default list of environment variables to remove is displayed when
\fBsudo\fR \fBsudo\fR
is run by root with the is run by root with the
\fB-V\fR \fB\-V\fR
option. option.
Note that many operating systems will remove potentially dangerous Note that many operating systems will remove potentially dangerous
variables from the environment of any setuid process (such as variables from the environment of any setuid process (such as
@@ -2887,7 +2894,7 @@ The default list of variables to keep
is displayed when is displayed when
\fBsudo\fR \fBsudo\fR
is run by root with the is run by root with the
\fB-V\fR \fB\-V\fR
option. option.
.SH "SUDO.CONF" .SH "SUDO.CONF"
The The
@@ -3100,7 +3107,7 @@ security policy
.TP 26n .TP 26n
\fI/etc/environment\fR \fI/etc/environment\fR
Initial environment for Initial environment for
\fB-i\fR \fB\-i\fR
mode on AIX and Linux systems mode on AIX and Linux systems
.SH "EXAMPLES" .SH "EXAMPLES"
Below are example Below are example

44
doc/sudoreplay.man.in
View File

@@ -17,23 +17,25 @@
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.TH "SUDOREPLAY" "@mansectsu@" "July 12, 2012" "1.8.6" "System Manager's Manual" .TH "SUDOREPLAY" "@mansectsu@" "July 12, 2012" "1.8.6" "System Manager's Manual"
.nh
.if n .ad l
.SH "NAME" .SH "NAME"
\fBsudoreplay\fR \fBsudoreplay\fR
\- replay sudo session logs \- replay sudo session logs
.SH "SYNOPSIS" .SH "SYNOPSIS"
.HP 11n .HP 11n
\fBsudoreplay\fR \fBsudoreplay\fR
[\fB-h\fR] [\fB\-h\fR]
[\fB-d\fR\~\fIdirectory\fR] [\fB\-d\fR\ \fIdirectory\fR]
[\fB-f\fR\~\fIfilter\fR] [\fB\-f\fR\ \fIfilter\fR]
[\fB-m\fR\~\fImax_wait\fR] [\fB\-m\fR\ \fImax_wait\fR]
[\fB-s\fR\~\fIspeed_factor\fR] [\fB\-s\fR\ \fIspeed_factor\fR]
ID ID
.HP 11n .HP 11n
\fBsudoreplay\fR \fBsudoreplay\fR
[\fB-h\fR] [\fB\-h\fR]
[\fB-d\fR\~\fIdirectory\fR] [\fB\-d\fR\ \fIdirectory\fR]
\fB-l\fR \fB\-l\fR
[search expression] [search expression]
.SH "DESCRIPTION" .SH "DESCRIPTION"
\fBsudoreplay\fR \fBsudoreplay\fR
@@ -92,18 +94,19 @@ Double the playback speed.
\fBsudoreplay\fR \fBsudoreplay\fR
accepts the following command line options: accepts the following command line options:
.TP 14n .TP 14n
\fB-d\fR \fIdirectory\fR \fB\-d\fR \fIdirectory\fR
.br
Use Use
\fIdirectory\fR \fIdirectory\fR
to for the session logs instead of the default, to for the session logs instead of the default,
\fI@iolog_dir@\fR. \fI@iolog_dir@\fR.
.TP 14n .TP 14n
\fB-f\fR \fIfilter\fR \fB\-f\fR \fIfilter\fR
By default, By default,
\fBsudoreplay\fR \fBsudoreplay\fR
will play back the command's standard output, standard error and tty output. will play back the command's standard output, standard error and tty output.
The The
\fB-f\fR \fB\-f\fR
option can be used to select which of these to output. option can be used to select which of these to output.
The The
\fIfilter\fR \fIfilter\fR
@@ -113,14 +116,14 @@ argument is a comma-separated list, consisting of one or more of following:
and and
\fIttyout\fR. \fIttyout\fR.
.TP 14n .TP 14n
\fB-h\fR \fB\-h\fR
The The
\fB-h\fR (\fIhelp\fR) \fB\-h\fR (\fIhelp\fR)
option causes option causes
\fBsudoreplay\fR \fBsudoreplay\fR
to print a short help message to the standard output and exit. to print a short help message to the standard output and exit.
.TP 14n .TP 14n
\fB-l\fR [\fIsearch expression\fR] \fB\-l\fR [\fIsearch expression\fR]
Enable Enable
``list mode''. ``list mode''.
In this mode, In this mode,
@@ -216,16 +219,16 @@ unless separated by an
\fIor\fR. \fIor\fR.
.PP .PP
.RE .RE
.sp -1v .PD 0
.TP 14n .TP 14n
\fB-m\fR \fImax_wait\fR \fB\-m\fR \fImax_wait\fR
Specify an upper bound on how long to wait between key presses or output data. Specify an upper bound on how long to wait between key presses or output data.
By default, By default,
\fBsudoreplay\fR \fBsudoreplay\fR
will accurately reproduce the delays between key presses or program output. will accurately reproduce the delays between key presses or program output.
However, this can be tedious when the session includes long pauses. However, this can be tedious when the session includes long pauses.
When the When the
\fB-m\fR \fB\-m\fR
option is specified, option is specified,
\fBsudoreplay\fR \fBsudoreplay\fR
will limit these pauses to at most will limit these pauses to at most
@@ -233,8 +236,9 @@ will limit these pauses to at most
seconds. seconds.
The value may be specified as a floating point number, e.g.\& The value may be specified as a floating point number, e.g.\&
\fI2.5\fR. \fI2.5\fR.
.PD
.TP 14n .TP 14n
\fB-s\fR \fIspeed_factor\fR \fB\-s\fR \fIspeed_factor\fR
This option causes This option causes
\fBsudoreplay\fR \fBsudoreplay\fR
to adjust the number of seconds it will wait between key presses or to adjust the number of seconds it will wait between key presses or
@@ -250,9 +254,9 @@ of
\fI.5\fR \fI.5\fR
would make the output twice as slow. would make the output twice as slow.
.TP 14n .TP 14n
\fB-V\fR \fB\-V\fR
The The
\fB-V\fR (\fIversion\fR) \fB\-V\fR (\fIversion\fR)
option causes option causes
\fBsudoreplay\fR \fBsudoreplay\fR
to print its version number to print its version number

33
doc/visudo.man.in
View File

@@ -22,14 +22,16 @@
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512. .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
.\" .\"
.TH "VISUDO" "@mansectsu@" "July 12, 2012" "1.8.6" "System Manager's Manual" .TH "VISUDO" "@mansectsu@" "July 12, 2012" "1.8.6" "System Manager's Manual"
.nh
.if n .ad l
.SH "NAME" .SH "NAME"
\fBvisudo\fR \fBvisudo\fR
\- edit the sudoers file \- edit the sudoers file
.SH "SYNOPSIS" .SH "SYNOPSIS"
.HP 7n .HP 7n
\fBvisudo\fR \fBvisudo\fR
[\fB-chqsV\fR] [\fB\-chqsV\fR]
[\fB-f\fR\~\fIsudoers\fR] [\fB\-f\fR\ \fIsudoers\fR]
.SH "DESCRIPTION" .SH "DESCRIPTION"
\fBvisudo\fR \fBvisudo\fR
edits the edits the
@@ -123,7 +125,7 @@ the line where the error occurred (if the editor supports this feature).
accepts the following command line options: accepts the following command line options:
accepts the following command line options: accepts the following command line options:
.TP 12n .TP 12n
\fB-c\fR \fB\-c\fR
Enable Enable
\fIcheck-only\fR \fIcheck-only\fR
mode. mode.
@@ -134,7 +136,7 @@ checked for syntax errors, owner and mode.
A message will be printed to the standard output describing the status of A message will be printed to the standard output describing the status of
\fIsudoers\fR \fIsudoers\fR
unless the unless the
\fB-q\fR \fB\-q\fR
option was specified. option was specified.
If the check completes successfully, If the check completes successfully,
\fBvisudo\fR \fBvisudo\fR
@@ -143,7 +145,8 @@ If an error is encountered,
\fBvisudo\fR \fBvisudo\fR
will exit with a value of 1. will exit with a value of 1.
.TP 12n .TP 12n
\fB-f\fR \fIsudoers\fR \fB\-f\fR \fIsudoers\fR
.br
Specify and alternate Specify and alternate
\fIsudoers\fR \fIsudoers\fR
file location. file location.
@@ -162,32 +165,32 @@ appended to it.
In In
\fIcheck-only\fR \fIcheck-only\fR
mode only, the argument to mode only, the argument to
\fB-f\fR \fB\-f\fR
may be may be
`-', `-',
indicating that indicating that
\fIsudoers\fR \fIsudoers\fR
will be read from the standard input. will be read from the standard input.
.TP 12n .TP 12n
\fB-h\fR \fB\-h\fR
The The
\fB-h\fR (\fIhelp\fR) \fB\-h\fR (\fIhelp\fR)
option causes option causes
\fBvisudo\fR \fBvisudo\fR
to print a short help message to print a short help message
to the standard output and exit. to the standard output and exit.
.TP 12n .TP 12n
\fB-q\fR \fB\-q\fR
Enable Enable
\fIquiet\fR \fIquiet\fR
mode. mode.
In this mode details about syntax errors are not printed. In this mode details about syntax errors are not printed.
This option is only useful when combined with This option is only useful when combined with
the the
\fB-c\fR \fB\-c\fR
option. option.
.TP 12n .TP 12n
\fB-s\fR \fB\-s\fR
Enable Enable
\fIstrict\fR \fIstrict\fR
checking of the checking of the
@@ -202,9 +205,9 @@ letters, digits, and the underscore
(`_') (`_')
character. character.
.TP 12n .TP 12n
\fB-V\fR \fB\-V\fR
The The
\fB-V\fR (\fIversion\fR) \fB\-V\fR (\fIversion\fR)
option causes option causes
\fBvisudo\fR \fBvisudo\fR
to print its version number to print its version number
@@ -262,7 +265,7 @@ In the latter case, you can ignore the warnings
will not complain) will not complain)
\&. \&.
In In
\fB-s\fR \fB\-s\fR
(strict) mode these are errors, not warnings. (strict) mode these are errors, not warnings.
.TP 6n .TP 6n
\fRWarning: unused {User,Runas,Host,Cmnd}_Alias\fR \fRWarning: unused {User,Runas,Host,Cmnd}_Alias\fR
@@ -270,7 +273,7 @@ The specified {User,Runas,Host,Cmnd}_Alias was defined but never
used. used.
You may wish to comment out or remove the unused alias. You may wish to comment out or remove the unused alias.
In In
\fB-s\fR \fB\-s\fR
(strict) mode this is an error, not a warning. (strict) mode this is an error, not a warning.
.TP 6n .TP 6n
\fRWarning: cycle in {User,Runas,Host,Cmnd}_Alias\fR \fRWarning: cycle in {User,Runas,Host,Cmnd}_Alias\fR