isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove most uses of the deprecated Li macro which has no effect.

Browse Source 
Also fix some other incorrect markup.
This commit is contained in:
Todd C. Miller
2022-09-13 19:56:45 -06:00
parent a326411903
commit c341608072
26 changed files with 1398 additions and 1466 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
docs/cvtsudoers.man.in
View File

@@ -16,7 +16,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.TH "CVTSUDOERS" "1" "September 2, 2022" "Sudo @PACKAGE_VERSION@" "General Commands Manual" .TH "CVTSUDOERS" "1" "September 13, 2022" "Sudo @PACKAGE_VERSION@" "General Commands Manual"
.nh .nh
.if n .ad l .if n .ad l
.SH "NAME" .SH "NAME"
@@ -67,9 +67,8 @@ The options are as follows:
The base DN (distinguished name) that will be used when performing The base DN (distinguished name) that will be used when performing
LDAP queries. LDAP queries.
Typically this is of the form Typically this is of the form
\fRou=SUDOers,dc=my-domain,dc=com\fR \(lqou=SUDOers,dc=my-domain,dc=com\(rq
for the domain for the domain my-domain.com.
\fRmy-domain.com\fR.
If this option is not specified, the value of the If this option is not specified, the value of the
\fRSUDOERS_BASE\fR \fRSUDOERS_BASE\fR
environment variable will be used instead. environment variable will be used instead.
@@ -82,10 +81,10 @@ Defaults to
.TP 12n .TP 12n
\fB\-d\fR \fIdeftypes\fR, \fB\--defaults\fR=\fIdeftypes\fR \fB\-d\fR \fIdeftypes\fR, \fB\--defaults\fR=\fIdeftypes\fR
Only convert Only convert
\fRDefaults\fR \fIDefaults\fR
entries of the specified types. entries of the specified types.
One or more One or more
\fRDefaults\fR \fIDefaults\fR
types may be specified, separated by a comma types may be specified, separated by a comma
(\(oq\&,\(cq). (\(oq\&,\(cq).
The supported types are: The supported types are:
@@ -122,7 +121,7 @@ for more information.
If the If the
\fB\-d\fR \fB\-d\fR
option is not specified, all option is not specified, all
\fRDefaults\fR \fIDefaults\fR
entries will be converted. entries will be converted.
.RE .RE
.TP 12n .TP 12n
@@ -265,10 +264,10 @@ For example,
or or
\fBhost\fR = \fIwww\fR. \fBhost\fR = \fIwww\fR.
An upper-case An upper-case
\fRCmnd_Alias\fR, \fICmnd_Alias\fR,
\fRHost_alias\fR, \fIHost_alias\fR,
or or
\fRUser_Alias\fR \fIUser_Alias\fR
may be specified as the may be specified as the
\(lqcmnd\(rq, \(lqcmnd\(rq,
\(lqhost\(rq, \(lqhost\(rq,
@@ -441,7 +440,7 @@ Per-user rules are merged and duplicates are removed.
If a host name is specified with the input file, If a host name is specified with the input file,
\fBcvtsudoers\fR \fBcvtsudoers\fR
will change rules that specify a host name of will change rules that specify a host name of
\fRALL\fR \fBALL\fR
to the host name associated with the policy file being merged. to the host name associated with the policy file being merged.
The merging of rules is currently fairly simplistic but will be The merging of rules is currently fairly simplistic but will be
improved in a later release. improved in a later release.
@@ -676,7 +675,7 @@ and
Host_Aliases Host_Aliases
A JSON object containing one or more A JSON object containing one or more
\fIsudoers\fR \fIsudoers\fR
\fRHost_Alias\fR \fIHost_Alias\fR
entries where each named alias has as its value an array entries where each named alias has as its value an array
containing one or more objects. containing one or more objects.
Each object contains a Each object contains a
@@ -711,7 +710,7 @@ For example:
Cmnd_Aliases Cmnd_Aliases
A JSON object containing one or more A JSON object containing one or more
\fIsudoers\fR \fIsudoers\fR
\fRCmnd_Alias\fR \fICmnd_Alias\fR
entries where each named alias has as its value an array entries where each named alias has as its value an array
containing one or more objects. containing one or more objects.
Each object contains a Each object contains a
@@ -1006,20 +1005,20 @@ defaults_type
The type of The type of
\fIDefaults\fR \fIDefaults\fR
setting; one of setting; one of
\fRdefaults\fR, \fIdefaults\fR,
\fRdefaults_command\fR, \fIdefaults_command\fR,
\fRdefaults_host\fR, \fIdefaults_host\fR,
\fRdefaults_runas\fR, \fIdefaults_runas\fR,
or or
\fRdefaults_user\fR. \fIdefaults_user\fR.
.TP 10n .TP 10n
binding binding
For For
\fRdefaults_command\fR, \fIdefaults_command\fR,
\fRdefaults_host\fR, \fIdefaults_host\fR,
\fRdefaults_runas\fR, \fIdefaults_runas\fR,
and and
\fRdefaults_user\fR \fIdefaults_user\fR
this is the value that must match for the setting to be applied. this is the value that must match for the setting to be applied.
.TP 10n .TP 10n
name name
@@ -1051,11 +1050,11 @@ or
.TP 6n .TP 6n
aliases aliases
This section includes any This section includes any
\fRCmnd_Alias\fR \fICmnd_Alias\fR
\fRHost_Alias\fR, \fIHost_Alias\fR,
\fRRunas_Alias\fR, \fIRunas_Alias\fR,
or or
\fRUser_Alias\fR, \fIUser_Alias\fR,
entries from entries from
\fIsudoers\fR. \fIsudoers\fR.
The The
@@ -1073,11 +1072,11 @@ The fields are as follows:
.TP 10n .TP 10n
alias_type alias_type
The type of alias; one of The type of alias; one of
\fRCmnd_Alias\fR, \fICmnd_Alias\fR,
\fRHost_Alias\fR, \fIHost_Alias\fR,
\fRRunas_Alias\fR, \fIRunas_Alias\fR,
or or
\fRUser_Alias\fR. \fIUser_Alias\fR.
.TP 10n .TP 10n
alias_name alias_name
The name of the alias; a string starting with an upper-case letter that The name of the alias; a string starting with an upper-case letter that
@@ -1127,7 +1126,7 @@ or a netgroup (preceded by a
\(oq+\(cq \(oq+\(cq
character) character)
or a or a
\fRUser_Alias\fR. \fIUser_Alias\fR.
If set to the special value If set to the special value
\fBALL\fR, \fBALL\fR,
it will match any user. it will match any user.
@@ -1138,14 +1137,14 @@ This may also be a netgroup (preceded by a
\(oq+\(cq \(oq+\(cq
character) character)
or a or a
\fRHost_Alias\fR. \fIHost_Alias\fR.
If set to the special value If set to the special value
\fBALL\fR, \fBALL\fR,
it will match any host. it will match any host.
.TP 10n .TP 10n
runusers runusers
An optional comma-separated list of users (or An optional comma-separated list of users (or
\fRRunas_Alias\fRes) \fIRunas_Alias\fRes)
the command may be run as. the command may be run as.
If it contains more than one member, the value is surrounded by If it contains more than one member, the value is surrounded by
double quotes. double quotes.
@@ -1157,7 +1156,7 @@ If empty, the root user is assumed.
rungroups rungroups
.br .br
An optional comma-separated list of groups (or An optional comma-separated list of groups (or
\fRRunas_Alias\fRes) \fIRunas_Alias\fRes)
the command may be run as. the command may be run as.
If it contains more than one member, the value is surrounded by If it contains more than one member, the value is surrounded by
double quotes. double quotes.

71
docs/cvtsudoers.mdoc.in
View File

@@ -15,7 +15,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.Dd September 2, 2022 .Dd September 13, 2022
.Dt CVTSUDOERS 1 .Dt CVTSUDOERS 1
.Os Sudo @PACKAGE_VERSION@ .Os Sudo @PACKAGE_VERSION@
.Sh NAME .Sh NAME
@@ -65,9 +65,8 @@ The options are as follows:
The base DN (distinguished name) that will be used when performing The base DN (distinguished name) that will be used when performing
LDAP queries. LDAP queries.
Typically this is of the form Typically this is of the form
.Li ou=SUDOers,dc=my-domain,dc=com .Dq ou=SUDOers,dc=my-domain,dc=com
for the domain for the domain my-domain.com.
.Li my-domain.com .
If this option is not specified, the value of the If this option is not specified, the value of the
.Ev SUDOERS_BASE .Ev SUDOERS_BASE
environment variable will be used instead. environment variable will be used instead.
@@ -78,10 +77,10 @@ Defaults to
.Pa @sysconfdir@/cvtsudoers.conf . .Pa @sysconfdir@/cvtsudoers.conf .
.It Fl d Ar deftypes , Fl -defaults Ns = Ns Ar deftypes .It Fl d Ar deftypes , Fl -defaults Ns = Ns Ar deftypes
Only convert Only convert
.Li Defaults .Em Defaults
entries of the specified types. entries of the specified types.
One or more One or more
.Li Defaults .Em Defaults
types may be specified, separated by a comma types may be specified, separated by a comma
.Pq Ql \&, . .Pq Ql \&, .
The supported types are: The supported types are:
@@ -110,7 +109,7 @@ for more information.
If the If the
.Fl d .Fl d
option is not specified, all option is not specified, all
.Li Defaults .Em Defaults
entries will be converted. entries will be converted.
.It Fl e , Fl -expand-aliases .It Fl e , Fl -expand-aliases
Expand aliases in Expand aliases in
@@ -218,10 +217,10 @@ For example,
or or
.Sy host No = Ar www . .Sy host No = Ar www .
An upper-case An upper-case
.Li Cmnd_Alias , .Em Cmnd_Alias ,
.Li Host_alias , .Em Host_alias ,
or or
.Li User_Alias .Em User_Alias
may be specified as the may be specified as the
.Dq cmnd , .Dq cmnd ,
.Dq host , .Dq host ,
@@ -365,9 +364,9 @@ subsequent aliases of the same name are renamed with a numeric suffix
separated with a underscore separated with a underscore
.Pq Ql _ . .Pq Ql _ .
For example, if there are two different aliases named For example, if there are two different aliases named
.Li SERVERS , .Dv SERVERS ,
the first will be left as-is and the second will be renamed the first will be left as-is and the second will be renamed
.Li SERVERS_1 . .Dv SERVERS_1 .
References to the renamed alias are also updated in the policy file. References to the renamed alias are also updated in the policy file.
Duplicate aliases (those with identical contents) are pruned. Duplicate aliases (those with identical contents) are pruned.
.It .It
@@ -384,7 +383,7 @@ Per-user rules are merged and duplicates are removed.
If a host name is specified with the input file, If a host name is specified with the input file,
.Nm .Nm
will change rules that specify a host name of will change rules that specify a host name of
.Li ALL .Sy ALL
to the host name associated with the policy file being merged. to the host name associated with the policy file being merged.
The merging of rules is currently fairly simplistic but will be The merging of rules is currently fairly simplistic but will be
improved in a later release. improved in a later release.
@@ -589,7 +588,7 @@ and
.It Host_Aliases .It Host_Aliases
A JSON object containing one or more A JSON object containing one or more
.Em sudoers .Em sudoers
.Li Host_Alias .Em Host_Alias
entries where each named alias has as its value an array entries where each named alias has as its value an array
containing one or more objects. containing one or more objects.
Each object contains a Each object contains a
@@ -620,7 +619,7 @@ For example:
.It Cmnd_Aliases .It Cmnd_Aliases
A JSON object containing one or more A JSON object containing one or more
.Em sudoers .Em sudoers
.Li Cmnd_Alias .Em Cmnd_Alias
entries where each named alias has as its value an array entries where each named alias has as its value an array
containing one or more objects. containing one or more objects.
Each object contains a Each object contains a
@@ -893,19 +892,19 @@ The fields are as follows:
The type of The type of
.Em Defaults .Em Defaults
setting; one of setting; one of
.Li defaults , .Em defaults ,
.Li defaults_command , .Em defaults_command ,
.Li defaults_host , .Em defaults_host ,
.Li defaults_runas , .Em defaults_runas ,
or or
.Li defaults_user . .Em defaults_user .
.It binding .It binding
For For
.Li defaults_command , .Em defaults_command ,
.Li defaults_host , .Em defaults_host ,
.Li defaults_runas , .Em defaults_runas ,
and and
.Li defaults_user .Em defaults_user
this is the value that must match for the setting to be applied. this is the value that must match for the setting to be applied.
.It name .It name
The name of the The name of the
@@ -930,11 +929,11 @@ or
.El .El
.It aliases .It aliases
This section includes any This section includes any
.Li Cmnd_Alias .Em Cmnd_Alias
.Li Host_Alias , .Em Host_Alias ,
.Li Runas_Alias , .Em Runas_Alias ,
or or
.Li User_Alias , .Em User_Alias ,
entries from entries from
.Em sudoers . .Em sudoers .
The The
@@ -948,11 +947,11 @@ The fields are as follows:
.Bl -tag -width 8n .Bl -tag -width 8n
.It alias_type .It alias_type
The type of alias; one of The type of alias; one of
.Li Cmnd_Alias , .Em Cmnd_Alias ,
.Li Host_Alias , .Em Host_Alias ,
.Li Runas_Alias , .Em Runas_Alias ,
or or
.Li User_Alias . .Em User_Alias .
.It alias_name .It alias_name
The name of the alias; a string starting with an upper-case letter that The name of the alias; a string starting with an upper-case letter that
consists of upper-case letters, digits, or underscores. consists of upper-case letters, digits, or underscores.
@@ -990,7 +989,7 @@ or a netgroup (preceded by a
.Ql + .Ql +
character) character)
or a or a
.Li User_Alias . .Em User_Alias .
If set to the special value If set to the special value
.Sy ALL , .Sy ALL ,
it will match any user. it will match any user.
@@ -1000,13 +999,13 @@ This may also be a netgroup (preceded by a
.Ql + .Ql +
character) character)
or a or a
.Li Host_Alias . .Em Host_Alias .
If set to the special value If set to the special value
.Sy ALL , .Sy ALL ,
it will match any host. it will match any host.
.It runusers .It runusers
An optional comma-separated list of users (or An optional comma-separated list of users (or
.Li Runas_Alias Ns No es ) .Em Runas_Alias Ns No es )
the command may be run as. the command may be run as.
If it contains more than one member, the value is surrounded by If it contains more than one member, the value is surrounded by
double quotes. double quotes.
@@ -1016,7 +1015,7 @@ it will match any user.
If empty, the root user is assumed. If empty, the root user is assumed.
.It rungroups .It rungroups
An optional comma-separated list of groups (or An optional comma-separated list of groups (or
.Li Runas_Alias Ns No es ) .Em Runas_Alias Ns No es )
the command may be run as. the command may be run as.
If it contains more than one member, the value is surrounded by If it contains more than one member, the value is surrounded by
double quotes. double quotes.

100
docs/sudo.conf.man.in
View File

@@ -70,17 +70,17 @@ Leading white space is removed from the beginning of lines
even when a continuation character is used. even when a continuation character is used.
.PP .PP
Non-comment lines that don't begin with Non-comment lines that don't begin with
\fRPlugin\fR, \fIPlugin\fR,
\fRPath\fR, \fIPath\fR,
\fRDebug\fR, \fIDebug\fR,
or or
\fRSet\fR \fISet\fR
are silently ignored. are silently ignored.
.PP .PP
The The
\fBsudo.conf\fR \fBsudo.conf\fR
file is always parsed in the file is always parsed in the
\(lq\fRC\fR\(rq \(oqC\(cq
locale. locale.
.SS "Plugin configuration" .SS "Plugin configuration"
\fBsudo\fR \fBsudo\fR
@@ -94,9 +94,9 @@ Plugins are dynamically loaded based on the contents of
\fBsudo.conf\fR. \fBsudo.conf\fR.
.PP .PP
A A
\fRPlugin\fR \fIPlugin\fR
line consists of the line consists of the
\fRPlugin\fR \fIPlugin\fR
keyword, followed by the keyword, followed by the
\fIsymbol_name\fR \fIsymbol_name\fR
and the and the
@@ -105,14 +105,14 @@ to the dynamic shared object that contains the plugin.
The The
\fIsymbol_name\fR \fIsymbol_name\fR
is the name of the is the name of the
\fRapproval_plugin\fR, \fIstruct approval_plugin\fR,
\fRaudit_plugin\fR, \fIstruct audit_plugin\fR,
\fRio_plugin\fR, \fIstruct io_plugin\fR,
or or
\fRpolicy_plugin\fR \fIstruct policy_plugin\fR
struct contained in the plugin. defined by the plugin.
If a plugin implements multiple plugin types, there must be a If a plugin implements multiple plugin types, there must be a
\fRPlugin\fR \fIPlugin\fR
line for each unique symbol name. line for each unique symbol name.
The The
\fIpath\fR \fIpath\fR
@@ -120,7 +120,7 @@ may be fully qualified or relative.
If not fully qualified, it is relative to the directory If not fully qualified, it is relative to the directory
specified by the specified by the
\fIplugin_dir\fR \fIplugin_dir\fR
\fRPath\fR \fIPath\fR
setting, which defaults to setting, which defaults to
\fI@plugindir@\fR. \fI@plugindir@\fR.
In other words: In other words:
@@ -182,7 +182,7 @@ This limitation does not apply to I/O plugins.
If no If no
\fBsudo.conf\fR \fBsudo.conf\fR
file is present, or if it contains no file is present, or if it contains no
\fRPlugin\fR \fIPlugin\fR
lines, the lines, the
\fBsudoers\fR \fBsudoers\fR
plugin will be used as the default security policy, for I/O logging plugin will be used as the default security policy, for I/O logging
@@ -221,9 +221,9 @@ sudo_plugin(@mansectform@)
manual. manual.
.SS "Path settings" .SS "Path settings"
A A
\fRPath\fR \fIPath\fR
line consists of the line consists of the
\fRPath\fR \fIPath\fR
keyword, followed by the name of the path to set and its value. keyword, followed by the name of the path to set and its value.
For example: For example:
.nf .nf
@@ -238,7 +238,7 @@ Path askpass /usr/X11R6/bin/ssh-askpass
If no path name is specified, features relying on the specified If no path name is specified, features relying on the specified
setting will be disabled. setting will be disabled.
Disabling Disabling
\fRPath\fR \fIPath\fR
settings is only supported in settings is only supported in
\fBsudo\fR \fBsudo\fR
version 1.8.16 and higher. version 1.8.16 and higher.
@@ -277,7 +277,7 @@ If terminal devices may be located in a sub-directory of
that path must be explicitly listed in that path must be explicitly listed in
\fIdevsearch\fR. \fIdevsearch\fR.
The default value is The default value is
\fR/dev/pts:/dev/vt:/dev/term:/dev/zcons:/dev/pty:/dev\fR \fI/dev/pts:/dev/vt:/dev/term:/dev/zcons:/dev/pty:/dev\fR
.sp .sp
This option is ignored on systems that support either the This option is ignored on systems that support either the
\fBdevname\fR() \fBdevname\fR()
@@ -290,15 +290,15 @@ macOS and Solaris.
intercept intercept
.br .br
The fully-qualified path to a shared library containing a wrappers for the The fully-qualified path to a shared library containing a wrappers for the
\fBexecl\fR(), execve(2),
\fBexecle\fR(), execl(3),
\fBexeclp\fR(), execle(3),
\fBexecv\fR(), execlp(3),
\fBexecve\fR(), execv(3),
\fBexecvp\fR(), execvp(3),
\fBexecvpe\fR(), execvpe(3),
and and
\fBsystem\fR() system(3)
library functions that intercepts attempts to run further commands and library functions that intercepts attempts to run further commands and
performs a policy check before allowing them to be executed. performs a policy check before allowing them to be executed.
This is used to implement the This is used to implement the
@@ -312,23 +312,23 @@ The default value is
noexec noexec
The fully-qualified path to a shared library containing wrappers The fully-qualified path to a shared library containing wrappers
for the for the
\fBexecl\fR(), execve(2),
\fBexecle\fR(), execl(3),
\fBexeclp\fR(), execle(3),
\fBexect\fR(), execlp(3),
\fBexecv\fR(), exect(3),
\fBexecve\fR(), execv(3),
\fBexecveat\fR(), execveat(3),
\fBexecvP\fR(), execvP(3),
\fBexecvp\fR(), execvp(3),
\fBexecvpe\fR(), execvpe(3),
\fBfexecve\fR(), fexecve(3),
\fBpopen\fR(), popen(3),
\fBposix_spawn\fR(), posix_spawn(3),
\fBposix_spawnp\fR(), posix_spawnp(3),
\fBsystem\fR(), system(3),
and and
\fBwordexp\fR() wordexp(3)
library functions that prevent the execution of further commands. library functions that prevent the execution of further commands.
This is used to implement the This is used to implement the
\fInoexec\fR \fInoexec\fR
@@ -569,9 +569,9 @@ that can log what
is doing internally if there is a problem. is doing internally if there is a problem.
.PP .PP
A A
\fRDebug\fR \fIDebug\fR
line consists of the line consists of the
\fRDebug\fR \fIDebug\fR
keyword, followed by the name of the program, plugin, or shared object keyword, followed by the name of the program, plugin, or shared object
to debug, the debug file name, and a comma-separated list of debug flags. to debug, the debug file name, and a comma-separated list of debug flags.
The debug flag syntax used by The debug flag syntax used by
@@ -613,25 +613,25 @@ intercept functionality on some systems.
As of As of
\fBsudo\fR \fBsudo\fR
1.8.12, multiple 1.8.12, multiple
\fRDebug\fR \fIDebug\fR
entries may be specified per program. entries may be specified per program.
Older versions of Older versions of
\fBsudo\fR \fBsudo\fR
only support a single only support a single
\fRDebug\fR \fIDebug\fR
entry per program. entry per program.
Plugin-specific Plugin-specific
\fRDebug\fR \fIDebug\fR
entries are also supported starting with entries are also supported starting with
\fBsudo\fR \fBsudo\fR
1.8.12 and are matched by either the base name of the plugin that was loaded 1.8.12 and are matched by either the base name of the plugin that was loaded
(for example (for example
\fRsudoers.so\fR) \fIsudoers.so\fR)
or by the plugin's fully-qualified path name. or by the plugin's fully-qualified path name.
Previously, the Previously, the
\fBsudoers\fR \fBsudoers\fR
plugin shared the same plugin shared the same
\fRDebug\fR \fIDebug\fR
entry as the entry as the
\fBsudo\fR \fBsudo\fR
front-end and could not be configured separately. front-end and could not be configured separately.

100
docs/sudo.conf.mdoc.in
View File

@@ -67,17 +67,17 @@ Leading white space is removed from the beginning of lines
even when a continuation character is used. even when a continuation character is used.
.Pp .Pp
Non-comment lines that don't begin with Non-comment lines that don't begin with
.Li Plugin , .Em Plugin ,
.Li Path , .Em Path ,
.Li Debug , .Em Debug ,
or or
.Li Set .Em Set
are silently ignored. are silently ignored.
.Pp .Pp
The The
.Nm .Nm
file is always parsed in the file is always parsed in the
.Dq Li C .Ql C
locale. locale.
.Ss Plugin configuration .Ss Plugin configuration
.Nm sudo .Nm sudo
@@ -91,9 +91,9 @@ Plugins are dynamically loaded based on the contents of
.Nm . .Nm .
.Pp .Pp
A A
.Li Plugin .Em Plugin
line consists of the line consists of the
.Li Plugin .Em Plugin
keyword, followed by the keyword, followed by the
.Em symbol_name .Em symbol_name
and the and the
@@ -102,14 +102,14 @@ to the dynamic shared object that contains the plugin.
The The
.Em symbol_name .Em symbol_name
is the name of the is the name of the
.Li approval_plugin , .Vt struct approval_plugin ,
.Li audit_plugin , .Vt struct audit_plugin ,
.Li io_plugin , .Vt struct io_plugin ,
or or
.Li policy_plugin .Vt struct policy_plugin
struct contained in the plugin. defined by the plugin.
If a plugin implements multiple plugin types, there must be a If a plugin implements multiple plugin types, there must be a
.Li Plugin .Em Plugin
line for each unique symbol name. line for each unique symbol name.
The The
.Em path .Em path
@@ -117,7 +117,7 @@ may be fully qualified or relative.
If not fully qualified, it is relative to the directory If not fully qualified, it is relative to the directory
specified by the specified by the
.Em plugin_dir .Em plugin_dir
.Li Path .Em Path
setting, which defaults to setting, which defaults to
.Pa @plugindir@ . .Pa @plugindir@ .
In other words: In other words:
@@ -167,7 +167,7 @@ This limitation does not apply to I/O plugins.
If no If no
.Nm .Nm
file is present, or if it contains no file is present, or if it contains no
.Li Plugin .Em Plugin
lines, the lines, the
.Nm sudoers .Nm sudoers
plugin will be used as the default security policy, for I/O logging plugin will be used as the default security policy, for I/O logging
@@ -203,9 +203,9 @@ plugin architecture, see the
manual. manual.
.Ss Path settings .Ss Path settings
A A
.Li Path .Em Path
line consists of the line consists of the
.Li Path .Em Path
keyword, followed by the name of the path to set and its value. keyword, followed by the name of the path to set and its value.
For example: For example:
.Bd -literal -offset 4n .Bd -literal -offset 4n
@@ -217,7 +217,7 @@ Path askpass /usr/X11R6/bin/ssh-askpass
If no path name is specified, features relying on the specified If no path name is specified, features relying on the specified
setting will be disabled. setting will be disabled.
Disabling Disabling
.Li Path .Em Path
settings is only supported in settings is only supported in
.Nm sudo .Nm sudo
version 1.8.16 and higher. version 1.8.16 and higher.
@@ -254,7 +254,7 @@ If terminal devices may be located in a sub-directory of
that path must be explicitly listed in that path must be explicitly listed in
.Em devsearch . .Em devsearch .
The default value is The default value is
.Li /dev/pts:/dev/vt:/dev/term:/dev/zcons:/dev/pty:/dev .Pa /dev/pts:/dev/vt:/dev/term:/dev/zcons:/dev/pty:/dev
.Pp .Pp
This option is ignored on systems that support either the This option is ignored on systems that support either the
.Fn devname .Fn devname
@@ -265,15 +265,15 @@ functions, for example
macOS and Solaris. macOS and Solaris.
.It intercept .It intercept
The fully-qualified path to a shared library containing a wrappers for the The fully-qualified path to a shared library containing a wrappers for the
.Fn execl , .Xr execve 2 ,
.Fn execle , .Xr execl 3 ,
.Fn execlp , .Xr execle 3 ,
.Fn execv , .Xr execlp 3 ,
.Fn execve , .Xr execv 3 ,
.Fn execvp , .Xr execvp 3 ,
.Fn execvpe , .Xr execvpe 3 ,
and and
.Fn system .Xr system 3
library functions that intercepts attempts to run further commands and library functions that intercepts attempts to run further commands and
performs a policy check before allowing them to be executed. performs a policy check before allowing them to be executed.
This is used to implement the This is used to implement the
@@ -286,23 +286,23 @@ The default value is
.It noexec .It noexec
The fully-qualified path to a shared library containing wrappers The fully-qualified path to a shared library containing wrappers
for the for the
.Fn execl , .Xr execve 2 ,
.Fn execle , .Xr execl 3 ,
.Fn execlp , .Xr execle 3 ,
.Fn exect , .Xr execlp 3 ,
.Fn execv , .Xr exect 3 ,
.Fn execve , .Xr execv 3 ,
.Fn execveat , .Xr execveat 3 ,
.Fn execvP , .Xr execvP 3 ,
.Fn execvp , .Xr execvp 3 ,
.Fn execvpe , .Xr execvpe 3 ,
.Fn fexecve , .Xr fexecve 3 ,
.Fn popen , .Xr popen 3 ,
.Fn posix_spawn , .Xr posix_spawn 3 ,
.Fn posix_spawnp , .Xr posix_spawnp 3 ,
.Fn system , .Xr system 3 ,
and and
.Fn wordexp .Xr wordexp 3
library functions that prevent the execution of further commands. library functions that prevent the execution of further commands.
This is used to implement the This is used to implement the
.Em noexec .Em noexec
@@ -519,9 +519,9 @@ that can log what
is doing internally if there is a problem. is doing internally if there is a problem.
.Pp .Pp
A A
.Li Debug .Em Debug
line consists of the line consists of the
.Li Debug .Em Debug
keyword, followed by the name of the program, plugin, or shared object keyword, followed by the name of the program, plugin, or shared object
to debug, the debug file name, and a comma-separated list of debug flags. to debug, the debug file name, and a comma-separated list of debug flags.
The debug flag syntax used by The debug flag syntax used by
@@ -557,25 +557,25 @@ intercept functionality on some systems.
As of As of
.Nm sudo .Nm sudo
1.8.12, multiple 1.8.12, multiple
.Li Debug .Em Debug
entries may be specified per program. entries may be specified per program.
Older versions of Older versions of
.Nm sudo .Nm sudo
only support a single only support a single
.Li Debug .Em Debug
entry per program. entry per program.
Plugin-specific Plugin-specific
.Li Debug .Em Debug
entries are also supported starting with entries are also supported starting with
.Nm sudo .Nm sudo
1.8.12 and are matched by either the base name of the plugin that was loaded 1.8.12 and are matched by either the base name of the plugin that was loaded
(for example (for example
.Li sudoers.so ) .Pa sudoers.so )
or by the plugin's fully-qualified path name. or by the plugin's fully-qualified path name.
Previously, the Previously, the
.Nm sudoers .Nm sudoers
plugin shared the same plugin shared the same
.Li Debug .Em Debug
entry as the entry as the
.Nm sudo .Nm sudo
front-end and could not be configured separately. front-end and could not be configured separately.

49
docs/sudo.man.in
View File

@@ -25,7 +25,7 @@
.nr BA @BAMAN@ .nr BA @BAMAN@
.nr LC @LCMAN@ .nr LC @LCMAN@
.nr PS @PSMAN@ .nr PS @PSMAN@
.TH "SUDO" "@mansectsu@" "August 2, 2022" "Sudo @PACKAGE_VERSION@" "System Manager's Manual" .TH "SUDO" "@mansectsu@" "September 13, 2022" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
.nh .nh
.if n .ad l .if n .ad l
.SH "NAME" .SH "NAME"
@@ -135,9 +135,7 @@ time limit.
This limit is policy-specific; the default password prompt timeout This limit is policy-specific; the default password prompt timeout
for the for the
\fIsudoers\fR \fIsudoers\fR
security policy is security policy is @password_timeout@ minutes.
\fR@password_timeout@\fR
minutes.
.PP .PP
Security policies may support credential caching to allow the user Security policies may support credential caching to allow the user
to run to run
@@ -145,9 +143,7 @@ to run
again for a period of time without requiring authentication. again for a period of time without requiring authentication.
By default, the By default, the
\fIsudoers\fR \fIsudoers\fR
policy caches credentials on a per-terminal basis for policy caches credentials on a per-terminal basis for @timeout@ minutes.
\fR@timeout@\fR
minutes.
See the See the
\fItimestamp_type\fR \fItimestamp_type\fR
and and
@@ -399,7 +395,7 @@ may be either a group name or a numeric group-ID
prefixed with the prefixed with the
\(oq#\(cq \(oq#\(cq
character (e.g., character (e.g.,
\fR#0\fR \(oq#0\(cq
for GID 0). for GID 0).
When running a command as a GID, many shells require that the When running a command as a GID, many shells require that the
\(oq#\(cq \(oq#\(cq
@@ -574,7 +570,7 @@ policy:
.RS 12n .RS 12n
.PD 0 .PD 0
.TP 4n .TP 4n
\fR%H\fR %H
expanded to the host name including the domain name (only if the expanded to the host name including the domain name (only if the
machine's host name is fully qualified or the machine's host name is fully qualified or the
\fIfqdn\fR \fIfqdn\fR
@@ -582,10 +578,10 @@ option is set in
sudoers(@mansectform@)) sudoers(@mansectform@))
.PD .PD
.TP 4n .TP 4n
\fR%h\fR %h
expanded to the local host name without the domain name expanded to the local host name without the domain name
.TP 4n .TP 4n
\fR%p\fR %p
expanded to the name of the user whose password is being requested expanded to the name of the user whose password is being requested
(respects the (respects the
\fIrootpw\fR, \fIrootpw\fR,
@@ -595,16 +591,16 @@ and
flags in flags in
sudoers(@mansectform@)) sudoers(@mansectform@))
.TP 4n .TP 4n
\fR\&%U\fR \&%U
expanded to the login name of the user the command will be run as expanded to the login name of the user the command will be run as
(defaults to root unless the (defaults to root unless the
\fB\-u\fR \fB\-u\fR
option is also specified) option is also specified)
.TP 4n .TP 4n
\fR%u\fR %u
expanded to the invoking user's login name expanded to the invoking user's login name
.TP 4n .TP 4n
\fR%%\fR %%
two consecutive two consecutive
\(oq%\(cq \(oq%\(cq
characters are collapsed into a single characters are collapsed into a single
@@ -707,7 +703,7 @@ may be either a user name or a numeric user-ID
prefixed with the prefixed with the
\(oq#\(cq \(oq#\(cq
character (e.g., character (e.g.,
\fR#0\fR \(oq#0\(cq
for UID 0). for UID 0).
When running commands as a UID, many shells require that the When running commands as a UID, many shells require that the
\(oq#\(cq \(oq#\(cq
@@ -740,9 +736,7 @@ For the
\fIsudoers\fR \fIsudoers\fR
plugin, this extends the plugin, this extends the
\fBsudo\fR \fBsudo\fR
timeout for another timeout for another @timeout@ minutes by default, but does not run a command.
\fR@timeout@\fR
minutes by default, but does not run a command.
Not all security policies support cached credentials. Not all security policies support cached credentials.
.TP 12n .TP 12n
\fB\--\fR \fB\--\fR
@@ -778,7 +772,7 @@ option is set in
the command to be run has the the command to be run has the
\fRSETENV\fR \fRSETENV\fR
tag set or the command matched is tag set or the command matched is
\fRALL\fR, \fBALL\fR,
the user may set variables that would otherwise be forbidden. the user may set variables that would otherwise be forbidden.
See See
sudoers(@mansectform@) sudoers(@mansectform@)
@@ -986,7 +980,7 @@ run in a new pty,
may execute the command directly instead of running it as a child process. may execute the command directly instead of running it as a child process.
.SS "Plugins" .SS "Plugins"
Plugins may be specified via Plugins may be specified via
\fRPlugin\fR \fIPlugin\fR
directives in the directives in the
sudo.conf(@mansectform@) sudo.conf(@mansectform@)
file. file.
@@ -997,7 +991,7 @@ binary.
If no If no
sudo.conf(@mansectform@) sudo.conf(@mansectform@)
file is present, or if it doesn't contain any file is present, or if it doesn't contain any
\fRPlugin\fR \fIPlugin\fR
lines, lines,
\fBsudo\fR \fBsudo\fR
will use will use
@@ -1086,9 +1080,9 @@ By default,
\fBsudo\fR \fBsudo\fR
will only log the command it explicitly runs. will only log the command it explicitly runs.
If a user runs a command such as If a user runs a command such as
\fRsudo su\fR \(oqsudo su\(cq
or or
\fRsudo sh\fR, \(oqsudo sh\(cq,
subsequent commands run from that shell are not subject to subsequent commands run from that shell are not subject to
\fBsudo\fR's \fBsudo\fR's
security policy. security policy.
@@ -1176,7 +1170,7 @@ or when
is enabled in is enabled in
\fIsudoers\fR \fIsudoers\fR
and and
\fIHOME\fR \fRHOME\fR
is not present in the is not present in the
\fIenv_keep\fR \fIenv_keep\fR
list. list.
@@ -1226,8 +1220,7 @@ Default editor to use in
Set to the group-ID of the user who invoked sudo. Set to the group-ID of the user who invoked sudo.
.TP 17n .TP 17n
\fRSUDO_PROMPT\fR \fRSUDO_PROMPT\fR
Used as the default password prompt unless Used as the default password prompt unless the
the
\fB\-p\fR \fB\-p\fR
option was specified. option was specified.
.TP 17n .TP 17n
@@ -1315,7 +1308,7 @@ $ sudo shutdown -r +15 "quick reboot"
.PP .PP
To make a usage listing of the directories in the /home partition. To make a usage listing of the directories in the /home partition.
The commands are run in a sub-shell to allow the The commands are run in a sub-shell to allow the
\fRcd\fR \(oqcd\(cq
command and file redirection to work. command and file redirection to work.
.nf .nf
.sp .sp
@@ -1500,7 +1493,7 @@ plugin's
functionality. functionality.
.PP .PP
It is not meaningful to run the It is not meaningful to run the
\fRcd\fR \(oqcd\(cq
command directly via sudo, e.g., command directly via sudo, e.g.,
.nf .nf
.sp .sp

51
docs/sudo.mdoc.in
View File

@@ -24,7 +24,7 @@
.nr BA @BAMAN@ .nr BA @BAMAN@
.nr LC @LCMAN@ .nr LC @LCMAN@
.nr PS @PSMAN@ .nr PS @PSMAN@
.Dd August 2, 2022 .Dd September 13, 2022
.Dt SUDO @mansectsu@ .Dt SUDO @mansectsu@
.Os Sudo @PACKAGE_VERSION@ .Os Sudo @PACKAGE_VERSION@
.Sh NAME .Sh NAME
@@ -139,9 +139,7 @@ time limit.
This limit is policy-specific; the default password prompt timeout This limit is policy-specific; the default password prompt timeout
for the for the
.Em sudoers .Em sudoers
security policy is security policy is @password_timeout@ minutes.
.Li @password_timeout@
minutes.
.Pp .Pp
Security policies may support credential caching to allow the user Security policies may support credential caching to allow the user
to run to run
@@ -149,9 +147,7 @@ to run
again for a period of time without requiring authentication. again for a period of time without requiring authentication.
By default, the By default, the
.Em sudoers .Em sudoers
policy caches credentials on a per-terminal basis for policy caches credentials on a per-terminal basis for @timeout@ minutes.
.Li @timeout@
minutes.
See the See the
.Em timestamp_type .Em timestamp_type
and and
@@ -380,7 +376,7 @@ may be either a group name or a numeric group-ID
prefixed with the prefixed with the
.Ql # .Ql #
character (e.g., character (e.g.,
.Li #0 .Ql #0
for GID 0). for GID 0).
When running a command as a GID, many shells require that the When running a command as a GID, many shells require that the
.Ql # .Ql #
@@ -537,15 +533,15 @@ escape sequences are supported by the
.Em sudoers .Em sudoers
policy: policy:
.Bl -tag -width 2n .Bl -tag -width 2n
.It Li %H .It %H
expanded to the host name including the domain name (only if the expanded to the host name including the domain name (only if the
machine's host name is fully qualified or the machine's host name is fully qualified or the
.Em fqdn .Em fqdn
option is set in option is set in
.Xr sudoers @mansectform@ ) .Xr sudoers @mansectform@ )
.It Li %h .It %h
expanded to the local host name without the domain name expanded to the local host name without the domain name
.It Li %p .It %p
expanded to the name of the user whose password is being requested expanded to the name of the user whose password is being requested
(respects the (respects the
.Em rootpw , .Em rootpw ,
@@ -554,14 +550,14 @@ and
.Em runaspw .Em runaspw
flags in flags in
.Xr sudoers @mansectform@ ) .Xr sudoers @mansectform@ )
.It Li \&%U .It \&%U
expanded to the login name of the user the command will be run as expanded to the login name of the user the command will be run as
(defaults to root unless the (defaults to root unless the
.Fl u .Fl u
option is also specified) option is also specified)
.It Li %u .It %u
expanded to the invoking user's login name expanded to the invoking user's login name
.It Li %% .It %%
two consecutive two consecutive
.Ql % .Ql %
characters are collapsed into a single characters are collapsed into a single
@@ -656,7 +652,7 @@ may be either a user name or a numeric user-ID
prefixed with the prefixed with the
.Ql # .Ql #
character (e.g., character (e.g.,
.Li #0 .Ql #0
for UID 0). for UID 0).
When running commands as a UID, many shells require that the When running commands as a UID, many shells require that the
.Ql # .Ql #
@@ -687,9 +683,7 @@ For the
.Em sudoers .Em sudoers
plugin, this extends the plugin, this extends the
.Nm .Nm
timeout for another timeout for another @timeout@ minutes by default, but does not run a command.
.Li @timeout@
minutes by default, but does not run a command.
Not all security policies support cached credentials. Not all security policies support cached credentials.
.It Fl - .It Fl -
The The
@@ -723,9 +717,9 @@ If the
option is set in option is set in
.Em sudoers , .Em sudoers ,
the command to be run has the the command to be run has the
.Li SETENV .Dv SETENV
tag set or the command matched is tag set or the command matched is
.Li ALL , .Sy ALL ,
the user may set variables that would otherwise be forbidden. the user may set variables that would otherwise be forbidden.
See See
.Xr sudoers @mansectform@ .Xr sudoers @mansectform@
@@ -922,7 +916,7 @@ run in a new pty,
may execute the command directly instead of running it as a child process. may execute the command directly instead of running it as a child process.
.Ss Plugins .Ss Plugins
Plugins may be specified via Plugins may be specified via
.Li Plugin .Em Plugin
directives in the directives in the
.Xr sudo.conf @mansectform@ .Xr sudo.conf @mansectform@
file. file.
@@ -933,7 +927,7 @@ binary.
If no If no
.Xr sudo.conf @mansectform@ .Xr sudo.conf @mansectform@
file is present, or if it doesn't contain any file is present, or if it doesn't contain any
.Li Plugin .Em Plugin
lines, lines,
.Nm .Nm
will use will use
@@ -1022,9 +1016,9 @@ By default,
.Nm .Nm
will only log the command it explicitly runs. will only log the command it explicitly runs.
If a user runs a command such as If a user runs a command such as
.Li sudo su .Ql sudo su
or or
.Li sudo sh , .Ql sudo sh ,
subsequent commands run from that shell are not subject to subsequent commands run from that shell are not subject to
.Nm sudo Ns 's .Nm sudo Ns 's
security policy. security policy.
@@ -1107,7 +1101,7 @@ or when
is enabled in is enabled in
.Em sudoers .Em sudoers
and and
.Em HOME .Ev HOME
is not present in the is not present in the
.Em env_keep .Em env_keep
list. list.
@@ -1149,8 +1143,7 @@ Default editor to use in
.It Ev SUDO_GID .It Ev SUDO_GID
Set to the group-ID of the user who invoked sudo. Set to the group-ID of the user who invoked sudo.
.It Ev SUDO_PROMPT .It Ev SUDO_PROMPT
Used as the default password prompt unless Used as the default password prompt unless the
the
.Fl p .Fl p
option was specified. option was specified.
.It Ev SUDO_PS1 .It Ev SUDO_PS1
@@ -1217,7 +1210,7 @@ $ sudo shutdown -r +15 "quick reboot"
.Pp .Pp
To make a usage listing of the directories in the /home partition. To make a usage listing of the directories in the /home partition.
The commands are run in a sub-shell to allow the The commands are run in a sub-shell to allow the
.Li cd .Ql cd
command and file redirection to work. command and file redirection to work.
.Bd -literal -offset 4n .Bd -literal -offset 4n
$ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE" $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
@@ -1385,7 +1378,7 @@ plugin's
functionality. functionality.
.Pp .Pp
It is not meaningful to run the It is not meaningful to run the
.Li cd .Ql cd
command directly via sudo, e.g., command directly via sudo, e.g.,
.Bd -literal -offset 4n .Bd -literal -offset 4n
$ sudo cd /usr/local/protected $ sudo cd /usr/local/protected

4
docs/sudo_logsrv.proto.man.in
View File

@@ -16,7 +16,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.TH "SUDO_LOGSRV.PROTO" "@mansectform@" "February 16, 2022" "Sudo @PACKAGE_VERSION@" "File Formats Manual" .TH "SUDO_LOGSRV.PROTO" "@mansectform@" "September 13, 2022" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.nh .nh
.if n .ad l .if n .ad l
.SH "NAME" .SH "NAME"
@@ -93,7 +93,7 @@ message TimeSpec {
A A
\fITimeSpec\fR \fITimeSpec\fR
is the equivalent of a POSIX is the equivalent of a POSIX
\fRstruct timespec\fR, \fIstruct timespec\fR,
containing seconds and nanoseconds members. containing seconds and nanoseconds members.
The The
\fItv_sec\fR \fItv_sec\fR

18
docs/sudo_logsrv.proto.mdoc.in
View File

@@ -15,7 +15,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.Dd February 16, 2022 .Dd September 13, 2022
.Dt SUDO_LOGSRV.PROTO @mansectform@ .Dt SUDO_LOGSRV.PROTO @mansectform@
.Os Sudo @PACKAGE_VERSION@ .Os Sudo @PACKAGE_VERSION@
.Sh NAME .Sh NAME
@@ -87,7 +87,7 @@ message TimeSpec {
A A
.Em TimeSpec .Em TimeSpec
is the equivalent of a POSIX is the equivalent of a POSIX
.Li struct timespec , .Vt struct timespec ,
containing seconds and nanoseconds members. containing seconds and nanoseconds members.
The The
.Em tv_sec .Em tv_sec
@@ -237,10 +237,10 @@ If the command was terminated by a signal, this is set to the
name of the signal without the leading name of the signal without the leading
.Dq SIG . .Dq SIG .
For example, For example,
.Li INT , .Dv INT ,
.Li TERM , .Dv TERM ,
.Li KILL , .Dv KILL ,
.Li SEGV . .Dv SEGV .
.It error .It error
A message from the client indicating that the command was terminated A message from the client indicating that the command was terminated
unexpectedly due to an error. unexpectedly due to an error.
@@ -397,9 +397,9 @@ should be calculated using a monotonic clock where possible.
The signal name without the leading The signal name without the leading
.Dq SIG . .Dq SIG .
For example, For example,
.Li STOP , .Dv STOP ,
.Li TSTP , .Dv TSTP ,
.Li CONT . .Dv CONT .
.El .El
.Sh Server Messages .Sh Server Messages
A A

85
docs/sudo_logsrvd.conf.man.in
View File

@@ -16,7 +16,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.TH "SUDO_LOGSRVD.CONF" "@mansectform@" "February 16, 2022" "Sudo @PACKAGE_VERSION@" "File Formats Manual" .TH "SUDO_LOGSRVD.CONF" "@mansectform@" "September 13, 2022" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.nh .nh
.if n .ad l .if n .ad l
.SH "NAME" .SH "NAME"
@@ -168,14 +168,16 @@ will enable the TCP keepalive socket option on the client connection.
This enables the periodic transmission of keepalive messages to the client. This enables the periodic transmission of keepalive messages to the client.
If the client does not respond to a message in time, the connection will If the client does not respond to a message in time, the connection will
be closed. be closed.
Defaults to true. Defaults to
\fItrue\fR.
.TP 10n .TP 10n
timeout = number timeout = number
The amount of time, in seconds, The amount of time, in seconds,
\fBsudo_logsrvd\fR \fBsudo_logsrvd\fR
will wait for the client to respond. will wait for the client to respond.
A value of 0 will disable the timeout. A value of 0 will disable the timeout.
The default value is 30. The default value is
\fI30\fR.
.TP 10n .TP 10n
tls_cacert = path tls_cacert = path
The path to a certificate authority bundle file, in PEM format, The path to a certificate authority bundle file, in PEM format,
@@ -202,7 +204,7 @@ authority, the
setting must be set to a CA bundle that contains the CA certificate setting must be set to a CA bundle that contains the CA certificate
used to generate the client certificate. used to generate the client certificate.
The default value is The default value is
\fRfalse\fR. \fIfalse\fR.
.TP 10n .TP 10n
tls_ciphers_v12 = string tls_ciphers_v12 = string
A list of ciphers to use for connections secured by TLS version 1.2 only, A list of ciphers to use for connections secured by TLS version 1.2 only,
@@ -214,7 +216,7 @@ section in
openssl-ciphers(1) openssl-ciphers(1)
for full details. for full details.
The default value is The default value is
\fRHIGH:!aNULL\fR \(lqHIGH:!aNULL\(rq
which consists of encryption cipher suites with key lengths larger than which consists of encryption cipher suites with key lengths larger than
128 bits, and some cipher suites with 128-bit keys. 128 bits, and some cipher suites with 128-bit keys.
Cipher suites that offer no authentication are excluded. Cipher suites that offer no authentication are excluded.
@@ -241,7 +243,8 @@ TLS_AES_128_CCM_8_SHA256
.RE .RE
.RS 10n .RS 10n
.sp .sp
The default cipher suite is TLS_AES_256_GCM_SHA384. The default cipher suite is
\(lqTLS_AES_256_GCM_SHA384\(rq.
.RE .RE
.PD .PD
.TP 10n .TP 10n
@@ -274,7 +277,8 @@ configuration is changed.
If false, no verification is performed of the server certificate. If false, no verification is performed of the server certificate.
When using self-signed certificates without a certificate authority, When using self-signed certificates without a certificate authority,
this setting should be set to false. this setting should be set to false.
The default value is true. The default value is
\fItrue\fR.
.SS "relay" .SS "relay"
The The
\fIrelay\fR \fIrelay\fR
@@ -301,7 +305,8 @@ setting controls the amount of time
\fBsudo_logsrvd\fR \fBsudo_logsrvd\fR
will wait for the relay to respond. will wait for the relay to respond.
A value of 0 will disable the timeout. A value of 0 will disable the timeout.
The default value is 30. The default value is
\fI30\fR.
.TP 10n .TP 10n
relay_dir = path relay_dir = path
The directory in which log messages are temporarily stored before they The directory in which log messages are temporarily stored before they
@@ -339,7 +344,8 @@ lines are specified, the first available relay host will be used.
retry_interval = number retry_interval = number
The number of seconds to wait after a connection error before making The number of seconds to wait after a connection error before making
a new attempt to forward a message to a relay host. a new attempt to forward a message to a relay host.
The default value is 30 seconds. The default value is
\fI30\fR.
.TP 10n .TP 10n
store_first = boolean store_first = boolean
If true, If true,
@@ -365,7 +371,8 @@ The amount of time, in seconds,
\fBsudo_logsrvd\fR \fBsudo_logsrvd\fR
will wait for the relay server to respond after a connection has succeeded. will wait for the relay server to respond after a connection has succeeded.
A value of 0 will disable the timeout. A value of 0 will disable the timeout.
The default value is 30. The default value is
\fI30\fR.
.TP 10n .TP 10n
tls_cacert = path tls_cacert = path
The path to a certificate authority bundle file, in PEM format, The path to a certificate authority bundle file, in PEM format,
@@ -455,7 +462,7 @@ If set, I/O logs will be compressed using
Enabling compression can make it harder to view the logs in real-time as Enabling compression can make it harder to view the logs in real-time as
the program is executing due to buffering. the program is executing due to buffering.
The default value is The default value is
\fRfalse\fR. \fIfalse\fR.
.TP 10n .TP 10n
iolog_dir = path iolog_dir = path
The top-level directory to use when constructing the path The top-level directory to use when constructing the path
@@ -471,30 +478,30 @@ escape sequences are supported:
.RS 10n .RS 10n
.PD 0 .PD 0
.TP 6n .TP 6n
\fR%{seq}\fR %{seq}
expanded to a monotonically increasing base-36 sequence number, such as 0100A5, expanded to a monotonically increasing base-36 sequence number, such as 0100A5,
where every two digits are used to form a new directory, e.g., where every two digits are used to form a new directory, e.g.,
\fI01/00/A5\fR \fI01/00/A5\fR
.PD .PD
.TP 6n .TP 6n
\fR%{user}\fR %{user}
expanded to the invoking user's login name expanded to the invoking user's login name
.TP 6n .TP 6n
\fR%{group}\fR %{group}
expanded to the name of the invoking user's real group-ID expanded to the name of the invoking user's real group-ID
.TP 6n .TP 6n
\fR%{runas_user}\fR %{runas_user}
expanded to the login name of the user the command will expanded to the login name of the user the command will
be run as (e.g., root) be run as (e.g., root)
.TP 6n .TP 6n
\fR%{runas_group}\fR %{runas_group}
expanded to the group name of the user the command will expanded to the group name of the user the command will
be run as (e.g., wheel) be run as (e.g., wheel)
.TP 6n .TP 6n
\fR%{hostname}\fR %{hostname}
expanded to the local host name without the domain name expanded to the local host name without the domain name
.TP 6n .TP 6n
\fR%{command}\fR %{command}
expanded to the base name of the command being run expanded to the base name of the command being run
.PP .PP
In addition, any escape sequences supported by the system's In addition, any escape sequences supported by the system's
@@ -516,7 +523,7 @@ It is possible for
\fIiolog_file\fR \fIiolog_file\fR
to contain directory components. to contain directory components.
The default value is The default value is
\fR%{seq}\fR. \(lq%{seq}\(rq.
.sp .sp
See the See the
\fIiolog_dir\fR \fIiolog_dir\fR
@@ -526,9 +533,9 @@ escape sequences.
.sp .sp
In addition to the escape sequences, path names that end in six or In addition to the escape sequences, path names that end in six or
more more
\fRX\fRs \fIX\fRs
will have the will have the
\fRX\fRs \fIX\fRs
replaced with a unique combination of digits and letters, similar to the replaced with a unique combination of digits and letters, similar to the
mktemp(3) mktemp(3)
function. function.
@@ -542,7 +549,7 @@ overwritten unless
\fIiolog_file\fR \fIiolog_file\fR
ends in six or ends in six or
more more
\fRX\fRs. \fIX\fRs.
.TP 10n .TP 10n
iolog_flush = boolean iolog_flush = boolean
If set, I/O log data is flushed to disk after each write instead of If set, I/O log data is flushed to disk after each write instead of
@@ -553,7 +560,7 @@ of I/O log compression.
I/O logs are always flushed before sending a commit point to the client I/O logs are always flushed before sending a commit point to the client
regardless of this setting. regardless of this setting.
The default value is The default value is
\fRtrue\fR. \fItrue\fR.
.TP 10n .TP 10n
iolog_group = name iolog_group = name
The group name to look up when setting the group-ID on new I/O log The group name to look up when setting the group-ID on new I/O log
@@ -579,7 +586,7 @@ When creating I/O log directories, search (execute) bits are added
to match the read and write bits specified by to match the read and write bits specified by
\fIiolog_mode\fR. \fIiolog_mode\fR.
The default value is The default value is
\fR0600\fR. \fI0600\fR.
.TP 10n .TP 10n
iolog_user = name iolog_user = name
The user name to look up when setting the owner of new The user name to look up when setting the owner of new
@@ -599,7 +606,7 @@ the password will still be present in the I/O log.
If If
\fIlog_passwords\fR \fIlog_passwords\fR
is set to is set to
\fRfalse\fR, \fIfalse\fR,
\fBsudo_logsrvd\fR \fBsudo_logsrvd\fR
will attempt to prevent passwords from being logged. will attempt to prevent passwords from being logged.
It does this by using the regular expressions in It does this by using the regular expressions in
@@ -617,16 +624,16 @@ when the
option is set), only the option is set), only the
first character of the password will be replaced in the I/O log. first character of the password will be replaced in the I/O log.
The default value is The default value is
\fRtrue\fR. \fItrue\fR.
.TP 10n .TP 10n
maxseq = number maxseq = number
The maximum sequence number that will be substituted for the The maximum sequence number that will be substituted for the
\(lq\fR%{seq}\fR\(rq \(lq%{seq}\(rq
escape in the I/O log file (see the escape in the I/O log file (see the
\fIiolog_dir\fR \fIiolog_dir\fR
description above for more information). description above for more information).
While the value substituted for While the value substituted for
\(lq\fR%{seq}\fR\(rq \(lq%{seq}\(rq
is in base 36, is in base 36,
\fImaxseq\fR \fImaxseq\fR
itself should be expressed in decimal. itself should be expressed in decimal.
@@ -634,7 +641,8 @@ Values larger than 2176782336 (which corresponds to the
base 36 sequence number base 36 sequence number
\(lqZZZZZZ\(rq) \(lqZZZZZZ\(rq)
will be silently truncated to 2176782336. will be silently truncated to 2176782336.
The default value is 2176782336. The default value is
\fI2176782336\fR.
.TP 10n .TP 10n
passprompt_regex = string passprompt_regex = string
One or more POSIX extended regular expressions used to One or more POSIX extended regular expressions used to
@@ -669,7 +677,8 @@ log_exit = boolean
If true, If true,
\fBsudo_logsrvd\fR \fBsudo_logsrvd\fR
will log an event when a command exits or is terminated by a signal. will log an event when a command exits or is terminated by a signal.
Defaults to false. Defaults to
\fIfalse\fR.
.TP 6n .TP 6n
log_format = string log_format = string
The event log format. The event log format.
@@ -691,7 +700,7 @@ syslog(3).
facility = string facility = string
Syslog facility if syslog is being used for logging. Syslog facility if syslog is being used for logging.
Defaults to Defaults to
\fR@logfac@\fR. \fI@logfac@\fR.
.sp .sp
The following syslog facilities are supported: The following syslog facilities are supported:
\fBauthpriv\fR \fBauthpriv\fR
@@ -714,7 +723,7 @@ accept_priority = string
Syslog priority to use when the user is allowed to run a command and Syslog priority to use when the user is allowed to run a command and
authentication is successful. authentication is successful.
Defaults to Defaults to
\fR@goodpri@\fR. \fI@goodpri@\fR.
.sp .sp
The following syslog priorities are supported: The following syslog priorities are supported:
\fBalert\fR, \fBalert\fR,
@@ -735,7 +744,7 @@ reject_priority = string
Syslog priority to use when the user is not allowed to run a command or Syslog priority to use when the user is not allowed to run a command or
when authentication is unsuccessful. when authentication is unsuccessful.
Defaults to Defaults to
\fR@badpri@\fR. \fI@badpri@\fR.
.sp .sp
See See
\fIaccept_priority\fR \fIaccept_priority\fR
@@ -744,7 +753,7 @@ for the list of supported syslog priorities.
alert_priority = string alert_priority = string
Syslog priority to use for event log alert messages received from the client. Syslog priority to use for event log alert messages received from the client.
Defaults to Defaults to
\fR@badpri@\fR. \fI@badpri@\fR.
.sp .sp
See See
\fIaccept_priority\fR \fIaccept_priority\fR
@@ -779,7 +788,7 @@ server_facility = string
Syslog facility if syslog is being used for server warning messages. Syslog facility if syslog is being used for server warning messages.
See above for a list of supported facilities. See above for a list of supported facilities.
Defaults to Defaults to
\fRdaemon\fR \fIdaemon\fR
.SS "logfile" .SS "logfile"
The The
\fIlogfile\fR \fIlogfile\fR
@@ -800,10 +809,12 @@ Formatting is performed via the system's
strftime(3) strftime(3)
function so any escape sequences supported by that function will be expanded. function so any escape sequences supported by that function will be expanded.
The default value is The default value is
\(lq\fR%h %e %T\fR\(rq \(lq%h %e %T\(rq
which produces dates like which produces dates like
\(lqOct 3 07:15:24\(rq \(lqOct 3 07:15:24\(rq
in the C locale. in the
\(oqC\(cq
locale.
.SH "FILES" .SH "FILES"
.TP 26n .TP 26n
\fI@sysconfdir@/sudo_logsrvd.conf\fR \fI@sysconfdir@/sudo_logsrvd.conf\fR

85
docs/sudo_logsrvd.conf.mdoc.in
View File

@@ -15,7 +15,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.Dd February 16, 2022 .Dd September 13, 2022
.Dt SUDO_LOGSRVD.CONF @mansectform@ .Dt SUDO_LOGSRVD.CONF @mansectform@
.Os Sudo @PACKAGE_VERSION@ .Os Sudo @PACKAGE_VERSION@
.Sh NAME .Sh NAME
@@ -152,13 +152,15 @@ will enable the TCP keepalive socket option on the client connection.
This enables the periodic transmission of keepalive messages to the client. This enables the periodic transmission of keepalive messages to the client.
If the client does not respond to a message in time, the connection will If the client does not respond to a message in time, the connection will
be closed. be closed.
Defaults to true. Defaults to
.Em true .
.It timeout = number .It timeout = number
The amount of time, in seconds, The amount of time, in seconds,
.Nm sudo_logsrvd .Nm sudo_logsrvd
will wait for the client to respond. will wait for the client to respond.
A value of 0 will disable the timeout. A value of 0 will disable the timeout.
The default value is 30. The default value is
.Em 30 .
.It tls_cacert = path .It tls_cacert = path
The path to a certificate authority bundle file, in PEM format, The path to a certificate authority bundle file, in PEM format,
to use instead of the system's default certificate authority database to use instead of the system's default certificate authority database
@@ -182,7 +184,7 @@ authority, the
setting must be set to a CA bundle that contains the CA certificate setting must be set to a CA bundle that contains the CA certificate
used to generate the client certificate. used to generate the client certificate.
The default value is The default value is
.Li false . .Em false .
.It tls_ciphers_v12 = string .It tls_ciphers_v12 = string
A list of ciphers to use for connections secured by TLS version 1.2 only, A list of ciphers to use for connections secured by TLS version 1.2 only,
separated by a colon separated by a colon
@@ -193,7 +195,7 @@ section in
.Xr openssl-ciphers 1 .Xr openssl-ciphers 1
for full details. for full details.
The default value is The default value is
.Li HIGH:!aNULL .Dq HIGH:!aNULL
which consists of encryption cipher suites with key lengths larger than which consists of encryption cipher suites with key lengths larger than
128 bits, and some cipher suites with 128-bit keys. 128 bits, and some cipher suites with 128-bit keys.
Cipher suites that offer no authentication are excluded. Cipher suites that offer no authentication are excluded.
@@ -212,7 +214,8 @@ but should include the following:
.It TLS_AES_128_CCM_8_SHA256 .It TLS_AES_128_CCM_8_SHA256
.El .El
.Pp .Pp
The default cipher suite is TLS_AES_256_GCM_SHA384. The default cipher suite is
.Dq TLS_AES_256_GCM_SHA384 .
.It tls_dhparams = path .It tls_dhparams = path
The path to a file containing custom Diffie-Hellman parameters in PEM format. The path to a file containing custom Diffie-Hellman parameters in PEM format.
This file can be created with the following command: This file can be created with the following command:
@@ -235,7 +238,8 @@ configuration is changed.
If false, no verification is performed of the server certificate. If false, no verification is performed of the server certificate.
When using self-signed certificates without a certificate authority, When using self-signed certificates without a certificate authority,
this setting should be set to false. this setting should be set to false.
The default value is true. The default value is
.Em true .
.El .El
.Ss relay .Ss relay
The The
@@ -263,7 +267,8 @@ setting controls the amount of time
.Nm sudo_logsrvd .Nm sudo_logsrvd
will wait for the relay to respond. will wait for the relay to respond.
A value of 0 will disable the timeout. A value of 0 will disable the timeout.
The default value is 30. The default value is
.Em 30 .
.It relay_dir = path .It relay_dir = path
The directory in which log messages are temporarily stored before they The directory in which log messages are temporarily stored before they
are sent to the relay host. are sent to the relay host.
@@ -298,7 +303,8 @@ lines are specified, the first available relay host will be used.
.It retry_interval = number .It retry_interval = number
The number of seconds to wait after a connection error before making The number of seconds to wait after a connection error before making
a new attempt to forward a message to a relay host. a new attempt to forward a message to a relay host.
The default value is 30 seconds. The default value is
.Em 30 .
.It store_first = boolean .It store_first = boolean
If true, If true,
.Nm sudo_logsrvd .Nm sudo_logsrvd
@@ -321,7 +327,8 @@ The amount of time, in seconds,
.Nm sudo_logsrvd .Nm sudo_logsrvd
will wait for the relay server to respond after a connection has succeeded. will wait for the relay server to respond after a connection has succeeded.
A value of 0 will disable the timeout. A value of 0 will disable the timeout.
The default value is 30. The default value is
.Em 30 .
.It tls_cacert = path .It tls_cacert = path
The path to a certificate authority bundle file, in PEM format, The path to a certificate authority bundle file, in PEM format,
to use instead of the system's default certificate authority database to use instead of the system's default certificate authority database
@@ -404,7 +411,7 @@ If set, I/O logs will be compressed using
Enabling compression can make it harder to view the logs in real-time as Enabling compression can make it harder to view the logs in real-time as
the program is executing due to buffering. the program is executing due to buffering.
The default value is The default value is
.Li false . .Em false .
.It iolog_dir = path .It iolog_dir = path
The top-level directory to use when constructing the path The top-level directory to use when constructing the path
name for the I/O log directory. name for the I/O log directory.
@@ -416,23 +423,23 @@ The following percent
.Pq Ql % .Pq Ql %
escape sequences are supported: escape sequences are supported:
.Bl -tag -width 4n .Bl -tag -width 4n
.It Li %{seq} .It %{seq}
expanded to a monotonically increasing base-36 sequence number, such as 0100A5, expanded to a monotonically increasing base-36 sequence number, such as 0100A5,
where every two digits are used to form a new directory, e.g., where every two digits are used to form a new directory, e.g.,
.Pa 01/00/A5 .Pa 01/00/A5
.It Li %{user} .It %{user}
expanded to the invoking user's login name expanded to the invoking user's login name
.It Li %{group} .It %{group}
expanded to the name of the invoking user's real group-ID expanded to the name of the invoking user's real group-ID
.It Li %{runas_user} .It %{runas_user}
expanded to the login name of the user the command will expanded to the login name of the user the command will
be run as (e.g., root) be run as (e.g., root)
.It Li %{runas_group} .It %{runas_group}
expanded to the group name of the user the command will expanded to the group name of the user the command will
be run as (e.g., wheel) be run as (e.g., wheel)
.It Li %{hostname} .It %{hostname}
expanded to the local host name without the domain name expanded to the local host name without the domain name
.It Li %{command} .It %{command}
expanded to the base name of the command being run expanded to the base name of the command being run
.El .El
.Pp .Pp
@@ -453,7 +460,7 @@ It is possible for
.Em iolog_file .Em iolog_file
to contain directory components. to contain directory components.
The default value is The default value is
.Li %{seq} . .Dq %{seq} .
.Pp .Pp
See the See the
.Em iolog_dir .Em iolog_dir
@@ -463,9 +470,9 @@ escape sequences.
.Pp .Pp
In addition to the escape sequences, path names that end in six or In addition to the escape sequences, path names that end in six or
more more
.Li X Ns s .Em X Ns s
will have the will have the
.Li X Ns s .Em X Ns s
replaced with a unique combination of digits and letters, similar to the replaced with a unique combination of digits and letters, similar to the
.Xr mktemp 3 .Xr mktemp 3
function. function.
@@ -479,7 +486,7 @@ overwritten unless
.Em iolog_file .Em iolog_file
ends in six or ends in six or
more more
.Li X Ns s . .Em X Ns s .
.It iolog_flush = boolean .It iolog_flush = boolean
If set, I/O log data is flushed to disk after each write instead of If set, I/O log data is flushed to disk after each write instead of
buffering it. buffering it.
@@ -489,7 +496,7 @@ of I/O log compression.
I/O logs are always flushed before sending a commit point to the client I/O logs are always flushed before sending a commit point to the client
regardless of this setting. regardless of this setting.
The default value is The default value is
.Li true . .Em true .
.It iolog_group = name .It iolog_group = name
The group name to look up when setting the group-ID on new I/O log The group name to look up when setting the group-ID on new I/O log
files and directories. files and directories.
@@ -513,7 +520,7 @@ When creating I/O log directories, search (execute) bits are added
to match the read and write bits specified by to match the read and write bits specified by
.Em iolog_mode . .Em iolog_mode .
The default value is The default value is
.Li 0600 . .Em 0600 .
.It iolog_user = name .It iolog_user = name
The user name to look up when setting the owner of new The user name to look up when setting the owner of new
I/O log files and directories. I/O log files and directories.
@@ -531,7 +538,7 @@ the password will still be present in the I/O log.
If If
.Em log_passwords .Em log_passwords
is set to is set to
.Li false , .Em false ,
.Nm sudo_logsrvd .Nm sudo_logsrvd
will attempt to prevent passwords from being logged. will attempt to prevent passwords from being logged.
It does this by using the regular expressions in It does this by using the regular expressions in
@@ -549,15 +556,15 @@ when the
option is set), only the option is set), only the
first character of the password will be replaced in the I/O log. first character of the password will be replaced in the I/O log.
The default value is The default value is
.Li true . .Em true .
.It maxseq = number .It maxseq = number
The maximum sequence number that will be substituted for the The maximum sequence number that will be substituted for the
.Dq Li %{seq} .Dq %{seq}
escape in the I/O log file (see the escape in the I/O log file (see the
.Em iolog_dir .Em iolog_dir
description above for more information). description above for more information).
While the value substituted for While the value substituted for
.Dq Li %{seq} .Dq %{seq}
is in base 36, is in base 36,
.Em maxseq .Em maxseq
itself should be expressed in decimal. itself should be expressed in decimal.
@@ -565,7 +572,8 @@ Values larger than 2176782336 (which corresponds to the
base 36 sequence number base 36 sequence number
.Dq ZZZZZZ ) .Dq ZZZZZZ )
will be silently truncated to 2176782336. will be silently truncated to 2176782336.
The default value is 2176782336. The default value is
.Em 2176782336 .
.It passprompt_regex = string .It passprompt_regex = string
One or more POSIX extended regular expressions used to One or more POSIX extended regular expressions used to
match password prompts in the terminal output when match password prompts in the terminal output when
@@ -599,7 +607,8 @@ The default value is
If true, If true,
.Nm sudo_logsrvd .Nm sudo_logsrvd
will log an event when a command exits or is terminated by a signal. will log an event when a command exits or is terminated by a signal.
Defaults to false. Defaults to
.Em false .
.It log_format = string .It log_format = string
The event log format. The event log format.
Supported log formats are Supported log formats are
@@ -621,7 +630,7 @@ section configures how events are logged via
.It facility = string .It facility = string
Syslog facility if syslog is being used for logging. Syslog facility if syslog is being used for logging.
Defaults to Defaults to
.Li @logfac@ . .Em @logfac@ .
.Pp .Pp
The following syslog facilities are supported: The following syslog facilities are supported:
.Sy authpriv .Sy authpriv
@@ -643,7 +652,7 @@ and
Syslog priority to use when the user is allowed to run a command and Syslog priority to use when the user is allowed to run a command and
authentication is successful. authentication is successful.
Defaults to Defaults to
.Li @goodpri@ . .Em @goodpri@ .
.Pp .Pp
The following syslog priorities are supported: The following syslog priorities are supported:
.Sy alert , .Sy alert ,
@@ -663,7 +672,7 @@ will disable logging of successful commands.
Syslog priority to use when the user is not allowed to run a command or Syslog priority to use when the user is not allowed to run a command or
when authentication is unsuccessful. when authentication is unsuccessful.
Defaults to Defaults to
.Li @badpri@ . .Em @badpri@ .
.Pp .Pp
See See
.Em accept_priority .Em accept_priority
@@ -671,7 +680,7 @@ for the list of supported syslog priorities.
.It alert_priority = string .It alert_priority = string
Syslog priority to use for event log alert messages received from the client. Syslog priority to use for event log alert messages received from the client.
Defaults to Defaults to
.Li @badpri@ . .Em @badpri@ .
.Pp .Pp
See See
.Em accept_priority .Em accept_priority
@@ -704,7 +713,7 @@ JSON-format log entries are never split and are not affected by
Syslog facility if syslog is being used for server warning messages. Syslog facility if syslog is being used for server warning messages.
See above for a list of supported facilities. See above for a list of supported facilities.
Defaults to Defaults to
.Li daemon .Em daemon
.El .El
.Ss logfile .Ss logfile
The The
@@ -725,10 +734,12 @@ Formatting is performed via the system's
.Xr strftime 3 .Xr strftime 3
function so any escape sequences supported by that function will be expanded. function so any escape sequences supported by that function will be expanded.
The default value is The default value is
.Dq Li "%h %e %T" .Dq "%h %e %T"
which produces dates like which produces dates like
.Dq Oct 3 07:15:24 .Dq Oct 3 07:15:24
in the C locale. in the
.Ql C
locale.
.El .El
.Sh FILES .Sh FILES
.Bl -tag -width 24n .Bl -tag -width 24n

2
docs/sudo_logsrvd.man.in
View File

@@ -117,7 +117,7 @@ section.
.SS "Debugging sudo_logsrvd" .SS "Debugging sudo_logsrvd"
\fBsudo_logsrvd\fR \fBsudo_logsrvd\fR
supports a flexible debugging framework that is configured via supports a flexible debugging framework that is configured via
\fRDebug\fR \fIDebug\fR
lines in the lines in the
sudo.conf(@mansectform@) sudo.conf(@mansectform@)
file. file.

2
docs/sudo_logsrvd.mdoc.in
View File

@@ -112,7 +112,7 @@ section.
.Ss Debugging sudo_logsrvd .Ss Debugging sudo_logsrvd
.Nm .Nm
supports a flexible debugging framework that is configured via supports a flexible debugging framework that is configured via
.Li Debug .Em Debug
lines in the lines in the
.Xr sudo.conf @mansectform@ .Xr sudo.conf @mansectform@
file. file.

10
docs/sudo_plugin.man.in
View File

@@ -236,7 +236,7 @@ Only available starting with API version 1.16.
debug_flags=string debug_flags=string
A debug file path name followed by a space and a comma-separated A debug file path name followed by a space and a comma-separated
list of debug flags that correspond to the plugin's list of debug flags that correspond to the plugin's
\fRDebug\fR \fIDebug\fR
entry in entry in
sudo.conf(@mansectform@), sudo.conf(@mansectform@),
if there is one. if there is one.
@@ -265,7 +265,7 @@ will only pass
if if
sudo.conf(@mansectform@) sudo.conf(@mansectform@)
contains a plugin-specific contains a plugin-specific
\fRDebug\fR \fIDebug\fR
entry. entry.
.TP 6n .TP 6n
ignore_ticket=bool ignore_ticket=bool
@@ -677,7 +677,7 @@ tty=string
The path to the user's terminal device. The path to the user's terminal device.
If the user has no terminal device associated with the session, If the user has no terminal device associated with the session,
the value will be empty, as in the value will be empty, as in
\(lq\fRtty=\fR\(rq. \(oqtty=\(cq.
.TP 6n .TP 6n
uid=uid_t uid=uid_t
The real user-ID of the user invoking The real user-ID of the user invoking
@@ -921,10 +921,10 @@ into
\fIargv_out\fR, \fIargv_out\fR,
separated from the separated from the
editor and its arguments by a editor and its arguments by a
\(lq\fR--\fR\(rq \(oq--\(cq
element. element.
The The
\(lq\fR--\fR\(rq \(oq--\(cq
will be removed by will be removed by
\fBsudo\fR \fBsudo\fR
before the editor is executed. before the editor is executed.

10
docs/sudo_plugin.mdoc.in
View File

@@ -216,7 +216,7 @@ Only available starting with API version 1.16.
.It debug_flags=string .It debug_flags=string
A debug file path name followed by a space and a comma-separated A debug file path name followed by a space and a comma-separated
list of debug flags that correspond to the plugin's list of debug flags that correspond to the plugin's
.Li Debug .Em Debug
entry in entry in
.Xr sudo.conf @mansectform@ , .Xr sudo.conf @mansectform@ ,
if there is one. if there is one.
@@ -245,7 +245,7 @@ will only pass
if if
.Xr sudo.conf @mansectform@ .Xr sudo.conf @mansectform@
contains a plugin-specific contains a plugin-specific
.Li Debug .Em Debug
entry. entry.
.It ignore_ticket=bool .It ignore_ticket=bool
Set to true if the user specified the Set to true if the user specified the
@@ -603,7 +603,7 @@ Only available starting with API version 1.2.
The path to the user's terminal device. The path to the user's terminal device.
If the user has no terminal device associated with the session, If the user has no terminal device associated with the session,
the value will be empty, as in the value will be empty, as in
.Dq Li tty= . .Ql tty= .
.It uid=uid_t .It uid=uid_t
The real user-ID of the user invoking The real user-ID of the user invoking
.Nm sudo . .Nm sudo .
@@ -819,10 +819,10 @@ into
.Fa argv_out , .Fa argv_out ,
separated from the separated from the
editor and its arguments by a editor and its arguments by a
.Dq Li -- .Ql --
element. element.
The The
.Dq Li -- .Ql --
will be removed by will be removed by
.Nm sudo .Nm sudo
before the editor is executed. before the editor is executed.

2
docs/sudo_sendlog.man.in
View File

@@ -154,7 +154,7 @@ version and exit.
.SS "Debugging sendlog" .SS "Debugging sendlog"
\fBsudo_sendlog\fR \fBsudo_sendlog\fR
supports a flexible debugging framework that is configured via supports a flexible debugging framework that is configured via
\fRDebug\fR \fIDebug\fR
lines in the lines in the
sudo.conf(@mansectform@) sudo.conf(@mansectform@)
file. file.

2
docs/sudo_sendlog.mdoc.in
View File

@@ -139,7 +139,7 @@ version and exit.
.Ss Debugging sendlog .Ss Debugging sendlog
.Nm .Nm
supports a flexible debugging framework that is configured via supports a flexible debugging framework that is configured via
.Li Debug .Em Debug
lines in the lines in the
.Xr sudo.conf @mansectform@ .Xr sudo.conf @mansectform@
file. file.

232
docs/sudoers.ldap.man.in
View File

@@ -16,7 +16,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.TH "SUDOERS.LDAP" "@mansectform@" "July 25, 2022" "Sudo @PACKAGE_VERSION@" "File Formats Manual" .TH "SUDOERS.LDAP" "@mansectform@" "September 13, 2022" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.nh .nh
.if n .ad l .if n .ad l
.SH "NAME" .SH "NAME"
@@ -69,16 +69,16 @@ is no need for a specialized tool to check syntax.
The The
\fIsudoers\fR \fIsudoers\fR
configuration is contained in the configuration is contained in the
\fRou=SUDOers\fR \(oqou=SUDOers\(cq
LDAP container. LDAP container.
.PP .PP
Sudo first looks for the Sudo first looks for the
\fRcn=defaults\fR \(oqcn=defaults\(cq
entry in the SUDOers container. entry in the SUDOers container.
If found, the multi-valued If found, the multi-valued
\fRsudoOption\fR \fIsudoOption\fR
attribute is parsed in the same manner as a global attribute is parsed in the same manner as a global
\fRDefaults\fR \fIDefaults\fR
line in line in
\fI@sysconfdir@/sudoers\fR. \fI@sysconfdir@/sudoers\fR.
In the following example, the In the following example, the
@@ -97,7 +97,7 @@ sudoOption: env_keep+=SSH_AUTH_SOCK
.fi .fi
.PP .PP
The equivalent of a sudoer in LDAP is a The equivalent of a sudoer in LDAP is a
\fRsudoRole\fR. \fIsudoRole\fR.
It consists of the following attributes: It consists of the following attributes:
.TP 6n .TP 6n
\fBsudoUser\fR \fBsudoUser\fR
@@ -120,36 +120,36 @@ Non-Unix group support is only available when an appropriate
\fIgroup_plugin\fR \fIgroup_plugin\fR
is defined in the global is defined in the global
\fIdefaults\fR \fIdefaults\fR
\fRsudoRole\fR \fIsudoRole\fR
object. object.
If a If a
\fRsudoUser\fR \fIsudoUser\fR
entry is preceded by an exclamation point, entry is preceded by an exclamation point,
\(oq\&!\(cq, \(oq\&!\(cq,
and the entry matches, the and the entry matches, the
\fRsudoRole\fR \fIsudoRole\fR
in which it resides will be ignored. in which it resides will be ignored.
Negated Negated
\fRsudoUser\fR \fIsudoUser\fR
entries are only supported by version 1.9.9 or higher. entries are only supported by version 1.9.9 or higher.
.TP 6n .TP 6n
\fBsudoHost\fR \fBsudoHost\fR
A host name, IP address, IP network, or host netgroup (prefixed with a A host name, IP address, IP network, or host netgroup (prefixed with a
\(oq+\(cq). \(oq+\(cq).
The special value The special value
\fRALL\fR \fBALL\fR
will match any host. will match any host.
Host netgroups are matched using the host (both qualified and unqualified) Host netgroups are matched using the host (both qualified and unqualified)
and domain members only; the user member is not used when matching. and domain members only; the user member is not used when matching.
If a If a
\fRsudoHost\fR \fIsudoHost\fR
entry is preceded by an exclamation point, entry is preceded by an exclamation point,
\(oq\&!\(cq, \(oq\&!\(cq,
and the entry matches, the and the entry matches, the
\fRsudoRole\fR \fIsudoRole\fR
in which it resides will be ignored. in which it resides will be ignored.
Negated Negated
\fRsudoHost\fR \fIsudoHost\fR
entries are only supported by version 1.8.18 or higher. entries are only supported by version 1.8.18 or higher.
.TP 6n .TP 6n
\fBsudoCommand\fR \fBsudoCommand\fR
@@ -160,7 +160,7 @@ If a command name is preceded by an exclamation point,
the user will be prohibited from running that command. the user will be prohibited from running that command.
.sp .sp
The built-in command The built-in command
\(lq\fRsudoedit\fR\(rq \(lqsudoedit\(rq
is used to permit a user to run is used to permit a user to run
\fBsudo\fR \fBsudo\fR
with the with the
@@ -169,13 +169,13 @@ option (or as
\fBsudoedit\fR). \fBsudoedit\fR).
It may take command line arguments just as a normal command does. It may take command line arguments just as a normal command does.
Unlike other commands, Unlike other commands,
\(lq\fRsudoedit\fR\(rq \(lqsudoedit\(rq
is a built into is a built into
\fBsudo\fR \fBsudo\fR
itself and must be specified in without a leading path. itself and must be specified in without a leading path.
.sp .sp
The special value The special value
\fRALL\fR \fBALL\fR
will match any command. will match any command.
.sp .sp
If a command name is prefixed with a SHA-2 digest, it will If a command name is prefixed with a SHA-2 digest, it will
@@ -205,7 +205,7 @@ Command digests are only supported by version 1.8.7 or higher.
\fBsudoOption\fR \fBsudoOption\fR
Identical in function to the global options described above, but Identical in function to the global options described above, but
specific to the specific to the
\fRsudoRole\fR \fIsudoRole\fR
in which it resides. in which it resides.
.TP 6n .TP 6n
\fBsudoRunAsUser\fR \fBsudoRunAsUser\fR
@@ -217,30 +217,29 @@ or user netgroup (prefixed with a
\(oq+\(cq) \(oq+\(cq)
that contains a list of users that commands may be run as. that contains a list of users that commands may be run as.
The special value The special value
\fRALL\fR \fBALL\fR
will match any user. will match any user.
If a If a
\fRsudoRunAsUser\fR \fIsudoRunAsUser\fR
entry is preceded by an exclamation point, entry is preceded by an exclamation point,
\(oq\&!\(cq, \(oq\&!\(cq,
and the entry matches, the and the entry matches, the
\fRsudoRole\fR \fIsudoRole\fR
in which it resides will be ignored. in which it resides will be ignored.
If If
\fRsudoRunAsUser\fR \fIsudoRunAsUser\fR
is specified but empty, it will match the invoking user. is specified but empty, it will match the invoking user.
If neither If neither
\fRsudoRunAsUser\fR \fIsudoRunAsUser\fR
nor nor
\fRsudoRunAsGroup\fR \fIsudoRunAsGroup\fR
are present, the value of the are present, the value of the
\fIrunas_default\fR \fIrunas_default\fR
\fRsudoOption\fR \fIsudoOption\fR
is used (defaults to is used (defaults to @runas_default@).
\fR@runas_default@\fR).
.sp .sp
The The
\fRsudoRunAsUser\fR \fIsudoRunAsUser\fR
attribute is only available in attribute is only available in
\fBsudo\fR \fBsudo\fR
versions versions
@@ -248,10 +247,10 @@ versions
Older versions of Older versions of
\fBsudo\fR \fBsudo\fR
use the use the
\fRsudoRunAs\fR \fIsudoRunAs\fR
attribute instead. attribute instead.
Negated Negated
\fRsudoRunAsUser\fR \fIsudoRunAsUser\fR
entries are only supported by version 1.8.26 or higher. entries are only supported by version 1.8.26 or higher.
.TP 6n .TP 6n
\fBsudoRunAsGroup\fR \fBsudoRunAsGroup\fR
@@ -259,34 +258,34 @@ A Unix group or group-ID (prefixed with
\(oq#\(cq) \(oq#\(cq)
that commands may be run as. that commands may be run as.
The special value The special value
\fRALL\fR \fBALL\fR
will match any group. will match any group.
If a If a
\fRsudoRunAsGroup\fR \fIsudoRunAsGroup\fR
entry is preceded by an exclamation point, entry is preceded by an exclamation point,
\(oq\&!\(cq, \(oq\&!\(cq,
and the entry matches, the and the entry matches, the
\fRsudoRole\fR \fIsudoRole\fR
in which it resides will be ignored. in which it resides will be ignored.
.sp .sp
The The
\fRsudoRunAsGroup\fR \fIsudoRunAsGroup\fR
attribute is only available in attribute is only available in
\fBsudo\fR \fBsudo\fR
versions versions
1.7.0 and higher. 1.7.0 and higher.
Negated Negated
\fRsudoRunAsGroup\fR \fIsudoRunAsGroup\fR
entries are only supported by version 1.8.26 or higher. entries are only supported by version 1.8.26 or higher.
.TP 6n .TP 6n
\fBsudoNotBefore\fR \fBsudoNotBefore\fR
A timestamp in the form A timestamp in the form
\fRyyyymmddHHMMSSZ\fR \(oqyyyymmddHHMMSSZ\(cq
that can be used to provide a start date/time for when the that can be used to provide a start date/time for when the
\fRsudoRole\fR \fIsudoRole\fR
will be valid. will be valid.
If multiple If multiple
\fRsudoNotBefore\fR \fIsudoNotBefore\fR
entries are present, the earliest is used. entries are present, the earliest is used.
Timestamps must be in Coordinated Universal Time (UTC), Timestamps must be in Coordinated Universal Time (UTC),
not the local timezone. not the local timezone.
@@ -294,7 +293,7 @@ The minute and seconds portions are optional, but some LDAP servers
require that they be present (contrary to the RFC). require that they be present (contrary to the RFC).
.sp .sp
The The
\fRsudoNotBefore\fR \fIsudoNotBefore\fR
attribute is only available in attribute is only available in
\fBsudo\fR \fBsudo\fR
versions 1.7.5 and higher and must be explicitly enabled via the versions 1.7.5 and higher and must be explicitly enabled via the
@@ -304,12 +303,12 @@ option in
.TP 6n .TP 6n
\fBsudoNotAfter\fR \fBsudoNotAfter\fR
A timestamp in the form A timestamp in the form
\fRyyyymmddHHMMSSZ\fR \(oqyyyymmddHHMMSSZ\(cq
that indicates an expiration date/time, after which the that indicates an expiration date/time, after which the
\fRsudoRole\fR \fIsudoRole\fR
will no longer be valid. will no longer be valid.
If multiple If multiple
\fRsudoNotAfter\fR \fIsudoNotAfter\fR
entries are present, the last one is used. entries are present, the last one is used.
Timestamps must be in Coordinated Universal Time (UTC), Timestamps must be in Coordinated Universal Time (UTC),
not the local timezone. not the local timezone.
@@ -317,7 +316,7 @@ The minute and seconds portions are optional, but some LDAP servers
require that they be present (contrary to the RFC). require that they be present (contrary to the RFC).
.sp .sp
The The
\fRsudoNotAfter\fR \fIsudoNotAfter\fR
attribute is only available in attribute is only available in
\fBsudo\fR \fBsudo\fR
versions versions
@@ -328,26 +327,26 @@ option in
.TP 6n .TP 6n
\fBsudoOrder\fR \fBsudoOrder\fR
The The
\fRsudoRole\fR \fIsudoRole\fR
entries retrieved from the LDAP directory have no inherent order. entries retrieved from the LDAP directory have no inherent order.
The The
\fRsudoOrder\fR \fIsudoOrder\fR
attribute is an integer (or floating point value for LDAP servers attribute is an integer (or floating point value for LDAP servers
that support it) that is used to sort the matching entries. that support it) that is used to sort the matching entries.
This allows LDAP-based sudoers entries to more closely mimic the behavior This allows LDAP-based sudoers entries to more closely mimic the behavior
of the sudoers file, where the order of the entries influences the result. of the sudoers file, where the order of the entries influences the result.
If multiple entries match, the entry with the highest If multiple entries match, the entry with the highest
\fRsudoOrder\fR \fIsudoOrder\fR
attribute is chosen. attribute is chosen.
This corresponds to the This corresponds to the
\(lqlast match\(rq \(lqlast match\(rq
behavior of the sudoers file. behavior of the sudoers file.
If the If the
\fRsudoOrder\fR \fIsudoOrder\fR
attribute is not present, a value of 0 is assumed. attribute is not present, a value of 0 is assumed.
.sp .sp
The The
\fRsudoOrder\fR \fIsudoOrder\fR
attribute is only available in attribute is only available in
\fBsudo\fR \fBsudo\fR
versions 1.7.5 and higher. versions 1.7.5 and higher.
@@ -355,12 +354,12 @@ versions 1.7.5 and higher.
Each attribute listed above should contain a single value, but there Each attribute listed above should contain a single value, but there
may be multiple instances of each attribute type. may be multiple instances of each attribute type.
A A
\fRsudoRole\fR \fIsudoRole\fR
must contain at least one must contain at least one
\fRsudoUser\fR, \fIsudoUser\fR,
\fRsudoHost\fR, \fIsudoHost\fR,
and and
\fRsudoCommand\fR. \fIsudoCommand\fR.
.PP .PP
The following example allows users in group wheel to run any command The following example allows users in group wheel to run any command
on any host via on any host via
@@ -384,7 +383,7 @@ The first query is to parse the global options.
The second is to match against the user's name and the groups that The second is to match against the user's name and the groups that
the user belongs to. the user belongs to.
(The special (The special
\fRALL\fR \fBALL\fR
tag is matched in this query too.) tag is matched in this query too.)
If no match is returned for the user's name and groups, a third If no match is returned for the user's name and groups, a third
query returns all entries containing user netgroups and other query returns all entries containing user netgroups and other
@@ -411,12 +410,12 @@ are as follows:
.TP 5n .TP 5n
1.\& 1.\&
Match all Match all
\fRnisNetgroup\fR \fInisNetgroup\fR
records with a records with a
\fRnisNetgroupTriple\fR \fInisNetgroupTriple\fR
containing the user, host, and NIS domain. containing the user, host, and NIS domain.
The query will match The query will match
\fRnisNetgroupTriple\fR \fInisNetgroupTriple\fR
entries with either the short or long form of the host name or entries with either the short or long form of the host name or
no host name specified in the tuple. no host name specified in the tuple.
If the NIS domain is set, the query will match only match entries If the NIS domain is set, the query will match only match entries
@@ -425,13 +424,13 @@ If the NIS domain is
\fInot\fR \fInot\fR
set, a wildcard is used to match any domain name but be aware that the set, a wildcard is used to match any domain name but be aware that the
NIS schema used by some LDAP servers may not support wild cards for NIS schema used by some LDAP servers may not support wild cards for
\fRnisNetgroupTriple\fR. \fInisNetgroupTriple\fR.
.TP 5n .TP 5n
2.\& 2.\&
Repeated queries are performed to find any nested Repeated queries are performed to find any nested
\fRnisNetgroup\fR \fInisNetgroup\fR
records with a records with a
\fRmemberNisNetgroup\fR \fImemberNisNetgroup\fR
entry that refers to an already-matched record. entry that refers to an already-matched record.
.PP .PP
For sites with a large number of netgroups, using For sites with a large number of netgroups, using
@@ -465,7 +464,7 @@ returned in any specific order.
.PP .PP
The order in which different entries are applied can be controlled The order in which different entries are applied can be controlled
using the using the
\fRsudoOrder\fR \fIsudoOrder\fR
attribute, but there is no way to guarantee the order of attributes attribute, but there is no way to guarantee the order of attributes
within a specific entry. within a specific entry.
If there are conflicting command rules in an entry, the negative If there are conflicting command rules in an entry, the negative
@@ -519,18 +518,18 @@ These cannot be converted automatically.
For example, a Cmnd_Alias in a For example, a Cmnd_Alias in a
\fIsudoers\fR \fIsudoers\fR
file may be converted to a file may be converted to a
\fRsudoRole\fR \fIsudoRole\fR
that contains multiple commands. that contains multiple commands.
Multiple users and/or groups may be assigned to the Multiple users and/or groups may be assigned to the
\fRsudoRole\fR. \fIsudoRole\fR.
.PP .PP
Also, host, user, runas, and command-based Also, host, user, runas, and command-based
\fRDefaults\fR \fIDefaults\fR
entries are not supported. entries are not supported.
However, a However, a
\fRsudoRole\fR \fIsudoRole\fR
may contain one or more may contain one or more
\fRsudoOption\fR \fIsudoOption\fR
attributes which can often serve the same purpose. attributes which can often serve the same purpose.
.PP .PP
Consider the following Consider the following
@@ -590,7 +589,7 @@ Using a Unix group or netgroup in PAGERS rather than listing each
user would make this easier to maintain. user would make this easier to maintain.
.PP .PP
Per-user Per-user
\fRDefaults\fR \fIDefaults\fR
entries can be emulated by using one or more sudoOption attributes entries can be emulated by using one or more sudoOption attributes
in a sudoRole. in a sudoRole.
Consider the following Consider the following
@@ -637,7 +636,7 @@ LDAP support, the
schema must be schema must be
installed on your LDAP server. installed on your LDAP server.
In addition, be sure to index the In addition, be sure to index the
\fRsudoUser\fR \fIsudoUser\fR
attribute. attribute.
.PP .PP
The The
@@ -797,31 +796,30 @@ The default value is protocol version 3.
\fBNETGROUP_BASE\fR \fIbase\fR \fBNETGROUP_BASE\fR \fIbase\fR
The base DN to use when performing LDAP netgroup queries. The base DN to use when performing LDAP netgroup queries.
Typically this is of the form Typically this is of the form
\fRou=netgroup,dc=my-domain,dc=com\fR \(oqou=netgroup,dc=my-domain,dc=com\(cq
for the domain for the domain my-domain.com.
\fRmy-domain.com\fR.
Multiple Multiple
\fBNETGROUP_BASE\fR \fBNETGROUP_BASE\fR
lines may be specified, in which case they are queried in the order specified. lines may be specified, in which case they are queried in the order specified.
.sp .sp
This option can be used to query a user's netgroups directly via LDAP This option can be used to query a user's netgroups directly via LDAP
which is usually faster than fetching every which is usually faster than fetching every
\fRsudoRole\fR \fIsudoRole\fR
object containing a object containing a
\fRsudoUser\fR \fIsudoUser\fR
that begins with a that begins with a
\(oq+\(cq \(oq+\(cq
prefix. prefix.
The NIS schema used by some LDAP servers need a modification to The NIS schema used by some LDAP servers need a modification to
support querying the support querying the
\fRnisNetgroup\fR \fInisNetgroup\fR
object by its object by its
\fRnisNetgroupTriple\fR \fInisNetgroupTriple\fR
member. member.
OpenLDAP's OpenLDAP's
\fBslapd\fR \fBslapd\fR
requires the following change to the requires the following change to the
\fRnisNetgroupTriple\fR \fInisNetgroupTriple\fR
attribute: attribute:
.nf .nf
.sp .sp
@@ -837,13 +835,12 @@ attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple'
\fBNETGROUP_SEARCH_FILTER\fR \fIldap_filter\fR \fBNETGROUP_SEARCH_FILTER\fR \fIldap_filter\fR
An LDAP filter which is used to restrict the set of records returned An LDAP filter which is used to restrict the set of records returned
when performing an LDAP netgroup query. when performing an LDAP netgroup query.
Typically, this is of the Typically, this is of the form
form \(oqattribute=value\(cq
\fRattribute=value\fR
or or
\fR(&(attribute=value)(attribute2=value2))\fR. \(oq(&(attribute=value)(attribute2=value2))\(cq.
The default search filter is: The default search filter is:
\fRobjectClass=nisNetgroup\fR. \(oqobjectClass=nisNetgroup\(cq.
If If
\fIldap_filter\fR \fIldap_filter\fR
is omitted, no search filter will be used. is omitted, no search filter will be used.
@@ -928,10 +925,10 @@ This option is only relevant when using SASL authentication.
If the If the
\fBSSL\fR \fBSSL\fR
parameter is set to parameter is set to
\fRon\fR, \fIon\fR,
\fRtrue\fR, \fItrue\fR,
or or
\fRyes\fR \fIyes\fR
TLS (SSL) encryption is always used when communicating with the LDAP server. TLS (SSL) encryption is always used when communicating with the LDAP server.
Typically, this involves connecting to the server on port 636 (ldaps). Typically, this involves connecting to the server on port 636 (ldaps).
.TP 6n .TP 6n
@@ -939,7 +936,7 @@ Typically, this involves connecting to the server on port 636 (ldaps).
If the If the
\fBSSL\fR \fBSSL\fR
parameter is set to parameter is set to
\fRstart_tls\fR, \fIstart_tls\fR,
the LDAP server connection is initiated normally and TLS encryption is the LDAP server connection is initiated normally and TLS encryption is
begun before the bind credentials are sent. begun before the bind credentials are sent.
This has the advantage of not requiring a dedicated port for encrypted This has the advantage of not requiring a dedicated port for encrypted
@@ -953,9 +950,8 @@ The base DN to use when performing
\fBsudo\fR \fBsudo\fR
LDAP queries. LDAP queries.
Typically this is of the form Typically this is of the form
\fRou=SUDOers,dc=my-domain,dc=com\fR \(oqou=SUDOers,dc=my-domain,dc=com\(cq
for the domain for the domain my-domain.com.
\fRmy-domain.com\fR.
Multiple Multiple
\fBSUDOERS_BASE\fR \fBSUDOERS_BASE\fR
lines may be specified, in which case they are queried in the order specified. lines may be specified, in which case they are queried in the order specified.
@@ -997,20 +993,20 @@ when performing a
LDAP query. LDAP query.
Typically, this is of the Typically, this is of the
form form
\fRattribute=value\fR \(oqattribute=value\(cq
or or
\fR(&(attribute=value)(attribute2=value2))\fR. \(oq(&(attribute=value)(attribute2=value2))\(cq.
The default search filter is: The default search filter is:
\fRobjectClass=sudoRole\fR. \(oqobjectClass=sudoRole\(cq.
If If
\fIldap_filter\fR \fIldap_filter\fR
is omitted, no search filter will be used. is omitted, no search filter will be used.
.TP 6n .TP 6n
\fBSUDOERS_TIMED\fR \fIon/true/yes/off/false/no\fR \fBSUDOERS_TIMED\fR \fIon/true/yes/off/false/no\fR
Whether or not to evaluate the Whether or not to evaluate the
\fRsudoNotBefore\fR \fIsudoNotBefore\fR
and and
\fRsudoNotAfter\fR \fIsudoNotAfter\fR
attributes that implement time-dependent sudoers entries. attributes that implement time-dependent sudoers entries.
.TP 6n .TP 6n
\fBTIMELIMIT\fR \fIseconds\fR \fBTIMELIMIT\fR \fIseconds\fR
@@ -1062,11 +1058,11 @@ The certificate type depends on the LDAP libraries used.
.PD 0 .PD 0
.TP 6n .TP 6n
OpenLDAP: OpenLDAP:
\fRtls_cert /etc/ssl/client_cert.pem\fR \(oqtls_cert /etc/ssl/client_cert.pem\(cq
.PD .PD
.TP 6n .TP 6n
Netscape-derived: Netscape-derived:
\fRtls_cert /var/ldap/cert7.db\fR \(oqtls_cert /var/ldap/cert7.db\(cq
.TP 6n .TP 6n
IBM LDAP: IBM LDAP:
Unused, the key database specified by Unused, the key database specified by
@@ -1106,14 +1102,14 @@ The key type depends on the LDAP libraries used.
.PD 0 .PD 0
.TP 6n .TP 6n
OpenLDAP: OpenLDAP:
\fRtls_key /etc/ssl/client_key.pem\fR \(oqtls_key /etc/ssl/client_key.pem\(cq
.PD .PD
.TP 6n .TP 6n
Netscape-derived: Netscape-derived:
\fRtls_key /var/ldap/key3.db\fR \(oqtls_key /var/ldap/key3.db\(cq
.TP 6n .TP 6n
IBM LDAP: IBM LDAP:
\fRtls_key /usr/ldap/ldapkey.kdb\fR \(oqtls_key /usr/ldap/ldapkey.kdb\(cq
.PP .PP
When using IBM LDAP libraries, this file may also contain When using IBM LDAP libraries, this file may also contain
Certificate Authority and client certificates and may be encrypted. Certificate Authority and client certificates and may be encrypted.
@@ -1171,15 +1167,15 @@ The
must have the same path as the file specified by must have the same path as the file specified by
\fBTLS_KEY\fR, \fBTLS_KEY\fR,
but use a but use a
\fR.sth\fR \(oq.sth\(cq
file extension instead of file extension instead of
\fR.kdb\fR, \(oq.kdb\(cq,
e.g., for example
\fRldapkey.sth\fR. \(oqldapkey.sth\(cq.
The default The default
\fRldapkey.kdb\fR \(oqldapkey.kdb\(cq
that ships with the IBM Tivoli Directory Server is encrypted with the password that ships with the IBM Tivoli Directory Server is encrypted with the password
\fRssl_password\fR. \(oqssl_password\(cq.
The The
\fIgsk8capicmd\fR \fIgsk8capicmd\fR
utility can be used to manage the key database and create a utility can be used to manage the key database and create a
@@ -1251,9 +1247,9 @@ the latter being for servers that support TLS (SSL) encryption.
If no If no
\fIport\fR \fIport\fR
is specified, the default is port 389 for is specified, the default is port 389 for
\fRldap://\fR \(oqldap://\(cq
or port 636 for or port 636 for
\fRldaps://\fR. \(oqldaps://\(cq.
If no If no
\fIhostname\fR \fIhostname\fR
is specified, is specified,
@@ -1266,9 +1262,9 @@ lines are treated identically to a
\fBURI\fR \fBURI\fR
line containing multiple entries. line containing multiple entries.
Only systems using the OpenSSL libraries support the mixing of Only systems using the OpenSSL libraries support the mixing of
\fRldap://\fR \(oqldap://\(cq
and and
\fRldaps://\fR \(oqldaps://\(cq
URIs. URIs.
Both the Netscape-derived and IBM LDAP libraries used on most commercial Both the Netscape-derived and IBM LDAP libraries used on most commercial
versions of Unix are only capable of supporting one or the other. versions of Unix are only capable of supporting one or the other.
@@ -1297,13 +1293,13 @@ to specify the
\fIsudoers\fR \fIsudoers\fR
search order. search order.
Sudo looks for a line beginning with Sudo looks for a line beginning with
\fRsudoers\fR: \fIsudoers\fR:
and uses this to determine the search order. and uses this to determine the search order.
By default, By default,
\fBsudo\fR \fBsudo\fR
does not stop searching after the first match and later matches take does not stop searching after the first match and later matches take
precedence over earlier ones (unless precedence over earlier ones (unless
\fR[SUCCESS=return]\fR \(oq[SUCCESS=return]\(cq
is used, see below). is used, see below).
The following sources are recognized: The following sources are recognized:
.PP .PP
@@ -1322,14 +1318,14 @@ read sudoers from LDAP
In addition, a subset of In addition, a subset of
\fInsswitch.conf\fR-style \fInsswitch.conf\fR-style
action statements is supported, specifically action statements is supported, specifically
\fR[SUCCESS=return]\fR \(oq[SUCCESS=return]\(cq
and and
\fR[NOTFOUND=return]\fR. \(oq[NOTFOUND=return]\(cq.
These will unconditionally terminate the search if the user was either These will unconditionally terminate the search if the user was either
found found
(\fR[SUCCESS=return]\fR) \(oq[SUCCESS=return]\(cq
or not found or not found
(\fR[NOTFOUND=return]\fR) \(oq[NOTFOUND=return]\(cq
in the immediately preceding source. in the immediately preceding source.
Other action statements tokens are not supported, nor is test Other action statements tokens are not supported, nor is test
negation with negation with
@@ -1420,11 +1416,11 @@ sudoers = ldap = auth, files
.fi .fi
.PP .PP
In the above example, the In the above example, the
\fRauth\fR \fIauth\fR
qualifier only affects user lookups; both LDAP and qualifier only affects user lookups; both LDAP and
\fIsudoers\fR \fIsudoers\fR
will be queried for will be queried for
\fRDefaults\fR \fIDefaults\fR
entries. entries.
.PP .PP
If the If the
@@ -1449,9 +1445,9 @@ rules.
To use SSSD as the To use SSSD as the
\fIsudoers\fR \fIsudoers\fR
source, you should use source, you should use
\fRsss\fR \fIsss\fR
instead of instead of
\fRldap\fR \fIldap\fR
for the sudoers entry in for the sudoers entry in
\fI@nsswitch_conf@\fR. \fI@nsswitch_conf@\fR.
The The
@@ -1595,7 +1591,7 @@ Simply copy
it to the schema directory (e.g., it to the schema directory (e.g.,
\fI/etc/openldap/schema\fR), \fI/etc/openldap/schema\fR),
add the proper add the proper
\fRinclude\fR \fIinclude\fR
line in line in
\fIslapd.conf\fR \fIslapd.conf\fR
and restart and restart

232
docs/sudoers.ldap.mdoc.in
View File

@@ -15,7 +15,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.Dd July 25, 2022 .Dd September 13, 2022
.Dt SUDOERS.LDAP @mansectform@ .Dt SUDOERS.LDAP @mansectform@
.Os Sudo @PACKAGE_VERSION@ .Os Sudo @PACKAGE_VERSION@
.Sh NAME .Sh NAME
@@ -67,16 +67,16 @@ is no need for a specialized tool to check syntax.
The The
.Em sudoers .Em sudoers
configuration is contained in the configuration is contained in the
.Li ou=SUDOers .Ql ou=SUDOers
LDAP container. LDAP container.
.Pp .Pp
Sudo first looks for the Sudo first looks for the
.Li cn=defaults .Ql cn=defaults
entry in the SUDOers container. entry in the SUDOers container.
If found, the multi-valued If found, the multi-valued
.Li sudoOption .Em sudoOption
attribute is parsed in the same manner as a global attribute is parsed in the same manner as a global
.Li Defaults .Em Defaults
line in line in
.Pa @sysconfdir@/sudoers . .Pa @sysconfdir@/sudoers .
In the following example, the In the following example, the
@@ -92,7 +92,7 @@ sudoOption: env_keep+=SSH_AUTH_SOCK
.Ed .Ed
.Pp .Pp
The equivalent of a sudoer in LDAP is a The equivalent of a sudoer in LDAP is a
.Li sudoRole . .Em sudoRole .
It consists of the following attributes: It consists of the following attributes:
.Bl -tag -width 4n .Bl -tag -width 4n
.It Sy sudoUser .It Sy sudoUser
@@ -115,35 +115,35 @@ Non-Unix group support is only available when an appropriate
.Em group_plugin .Em group_plugin
is defined in the global is defined in the global
.Em defaults .Em defaults
.Li sudoRole .Em sudoRole
object. object.
If a If a
.Li sudoUser .Em sudoUser
entry is preceded by an exclamation point, entry is preceded by an exclamation point,
.Ql \&! , .Ql \&! ,
and the entry matches, the and the entry matches, the
.Li sudoRole .Em sudoRole
in which it resides will be ignored. in which it resides will be ignored.
Negated Negated
.Li sudoUser .Em sudoUser
entries are only supported by version 1.9.9 or higher. entries are only supported by version 1.9.9 or higher.
.It Sy sudoHost .It Sy sudoHost
A host name, IP address, IP network, or host netgroup (prefixed with a A host name, IP address, IP network, or host netgroup (prefixed with a
.Ql + ) . .Ql + ) .
The special value The special value
.Li ALL .Sy ALL
will match any host. will match any host.
Host netgroups are matched using the host (both qualified and unqualified) Host netgroups are matched using the host (both qualified and unqualified)
and domain members only; the user member is not used when matching. and domain members only; the user member is not used when matching.
If a If a
.Li sudoHost .Em sudoHost
entry is preceded by an exclamation point, entry is preceded by an exclamation point,
.Ql \&! , .Ql \&! ,
and the entry matches, the and the entry matches, the
.Li sudoRole .Em sudoRole
in which it resides will be ignored. in which it resides will be ignored.
Negated Negated
.Li sudoHost .Em sudoHost
entries are only supported by version 1.8.18 or higher. entries are only supported by version 1.8.18 or higher.
.It Sy sudoCommand .It Sy sudoCommand
A fully-qualified Unix command name with optional command line arguments, A fully-qualified Unix command name with optional command line arguments,
@@ -153,7 +153,7 @@ If a command name is preceded by an exclamation point,
the user will be prohibited from running that command. the user will be prohibited from running that command.
.Pp .Pp
The built-in command The built-in command
.Dq Li sudoedit .Dq sudoedit
is used to permit a user to run is used to permit a user to run
.Nm sudo .Nm sudo
with the with the
@@ -162,13 +162,13 @@ option (or as
.Nm sudoedit ) . .Nm sudoedit ) .
It may take command line arguments just as a normal command does. It may take command line arguments just as a normal command does.
Unlike other commands, Unlike other commands,
.Dq Li sudoedit .Dq sudoedit
is a built into is a built into
.Nm sudo .Nm sudo
itself and must be specified in without a leading path. itself and must be specified in without a leading path.
.Pp .Pp
The special value The special value
.Li ALL .Sy ALL
will match any command. will match any command.
.Pp .Pp
If a command name is prefixed with a SHA-2 digest, it will If a command name is prefixed with a SHA-2 digest, it will
@@ -192,7 +192,7 @@ Command digests are only supported by version 1.8.7 or higher.
.It Sy sudoOption .It Sy sudoOption
Identical in function to the global options described above, but Identical in function to the global options described above, but
specific to the specific to the
.Li sudoRole .Em sudoRole
in which it resides. in which it resides.
.It Sy sudoRunAsUser .It Sy sudoRunAsUser
A user name or user-ID (prefixed with A user name or user-ID (prefixed with
@@ -203,30 +203,29 @@ or user netgroup (prefixed with a
.Ql + ) .Ql + )
that contains a list of users that commands may be run as. that contains a list of users that commands may be run as.
The special value The special value
.Li ALL .Sy ALL
will match any user. will match any user.
If a If a
.Li sudoRunAsUser .Em sudoRunAsUser
entry is preceded by an exclamation point, entry is preceded by an exclamation point,
.Ql \&! , .Ql \&! ,
and the entry matches, the and the entry matches, the
.Li sudoRole .Em sudoRole
in which it resides will be ignored. in which it resides will be ignored.
If If
.Li sudoRunAsUser .Em sudoRunAsUser
is specified but empty, it will match the invoking user. is specified but empty, it will match the invoking user.
If neither If neither
.Li sudoRunAsUser .Em sudoRunAsUser
nor nor
.Li sudoRunAsGroup .Em sudoRunAsGroup
are present, the value of the are present, the value of the
.Em runas_default .Em runas_default
.Li sudoOption .Em sudoOption
is used (defaults to is used (defaults to @runas_default@).
.Li @runas_default@ ) .
.Pp .Pp
The The
.Li sudoRunAsUser .Em sudoRunAsUser
attribute is only available in attribute is only available in
.Nm sudo .Nm sudo
versions versions
@@ -234,43 +233,43 @@ versions
Older versions of Older versions of
.Nm sudo .Nm sudo
use the use the
.Li sudoRunAs .Em sudoRunAs
attribute instead. attribute instead.
Negated Negated
.Li sudoRunAsUser .Em sudoRunAsUser
entries are only supported by version 1.8.26 or higher. entries are only supported by version 1.8.26 or higher.
.It Sy sudoRunAsGroup .It Sy sudoRunAsGroup
A Unix group or group-ID (prefixed with A Unix group or group-ID (prefixed with
.Ql # ) .Ql # )
that commands may be run as. that commands may be run as.
The special value The special value
.Li ALL .Sy ALL
will match any group. will match any group.
If a If a
.Li sudoRunAsGroup .Em sudoRunAsGroup
entry is preceded by an exclamation point, entry is preceded by an exclamation point,
.Ql \&! , .Ql \&! ,
and the entry matches, the and the entry matches, the
.Li sudoRole .Em sudoRole
in which it resides will be ignored. in which it resides will be ignored.
.Pp .Pp
The The
.Li sudoRunAsGroup .Em sudoRunAsGroup
attribute is only available in attribute is only available in
.Nm sudo .Nm sudo
versions versions
1.7.0 and higher. 1.7.0 and higher.
Negated Negated
.Li sudoRunAsGroup .Em sudoRunAsGroup
entries are only supported by version 1.8.26 or higher. entries are only supported by version 1.8.26 or higher.
.It Sy sudoNotBefore .It Sy sudoNotBefore
A timestamp in the form A timestamp in the form
.Li yyyymmddHHMMSSZ .Ql yyyymmddHHMMSSZ
that can be used to provide a start date/time for when the that can be used to provide a start date/time for when the
.Li sudoRole .Em sudoRole
will be valid. will be valid.
If multiple If multiple
.Li sudoNotBefore .Em sudoNotBefore
entries are present, the earliest is used. entries are present, the earliest is used.
Timestamps must be in Coordinated Universal Time (UTC), Timestamps must be in Coordinated Universal Time (UTC),
not the local timezone. not the local timezone.
@@ -278,7 +277,7 @@ The minute and seconds portions are optional, but some LDAP servers
require that they be present (contrary to the RFC). require that they be present (contrary to the RFC).
.Pp .Pp
The The
.Li sudoNotBefore .Em sudoNotBefore
attribute is only available in attribute is only available in
.Nm sudo .Nm sudo
versions 1.7.5 and higher and must be explicitly enabled via the versions 1.7.5 and higher and must be explicitly enabled via the
@@ -287,12 +286,12 @@ option in
.Pa @ldap_conf@ . .Pa @ldap_conf@ .
.It Sy sudoNotAfter .It Sy sudoNotAfter
A timestamp in the form A timestamp in the form
.Li yyyymmddHHMMSSZ .Ql yyyymmddHHMMSSZ
that indicates an expiration date/time, after which the that indicates an expiration date/time, after which the
.Li sudoRole .Em sudoRole
will no longer be valid. will no longer be valid.
If multiple If multiple
.Li sudoNotAfter .Em sudoNotAfter
entries are present, the last one is used. entries are present, the last one is used.
Timestamps must be in Coordinated Universal Time (UTC), Timestamps must be in Coordinated Universal Time (UTC),
not the local timezone. not the local timezone.
@@ -300,7 +299,7 @@ The minute and seconds portions are optional, but some LDAP servers
require that they be present (contrary to the RFC). require that they be present (contrary to the RFC).
.Pp .Pp
The The
.Li sudoNotAfter .Em sudoNotAfter
attribute is only available in attribute is only available in
.Nm sudo .Nm sudo
versions versions
@@ -310,26 +309,26 @@ option in
.Pa @ldap_conf@ . .Pa @ldap_conf@ .
.It Sy sudoOrder .It Sy sudoOrder
The The
.Li sudoRole .Em sudoRole
entries retrieved from the LDAP directory have no inherent order. entries retrieved from the LDAP directory have no inherent order.
The The
.Li sudoOrder .Em sudoOrder
attribute is an integer (or floating point value for LDAP servers attribute is an integer (or floating point value for LDAP servers
that support it) that is used to sort the matching entries. that support it) that is used to sort the matching entries.
This allows LDAP-based sudoers entries to more closely mimic the behavior This allows LDAP-based sudoers entries to more closely mimic the behavior
of the sudoers file, where the order of the entries influences the result. of the sudoers file, where the order of the entries influences the result.
If multiple entries match, the entry with the highest If multiple entries match, the entry with the highest
.Li sudoOrder .Em sudoOrder
attribute is chosen. attribute is chosen.
This corresponds to the This corresponds to the
.Dq last match .Dq last match
behavior of the sudoers file. behavior of the sudoers file.
If the If the
.Li sudoOrder .Em sudoOrder
attribute is not present, a value of 0 is assumed. attribute is not present, a value of 0 is assumed.
.Pp .Pp
The The
.Li sudoOrder .Em sudoOrder
attribute is only available in attribute is only available in
.Nm sudo .Nm sudo
versions 1.7.5 and higher. versions 1.7.5 and higher.
@@ -338,12 +337,12 @@ versions 1.7.5 and higher.
Each attribute listed above should contain a single value, but there Each attribute listed above should contain a single value, but there
may be multiple instances of each attribute type. may be multiple instances of each attribute type.
A A
.Li sudoRole .Em sudoRole
must contain at least one must contain at least one
.Li sudoUser , .Em sudoUser ,
.Li sudoHost , .Em sudoHost ,
and and
.Li sudoCommand . .Em sudoCommand .
.Pp .Pp
The following example allows users in group wheel to run any command The following example allows users in group wheel to run any command
on any host via on any host via
@@ -364,7 +363,7 @@ The first query is to parse the global options.
The second is to match against the user's name and the groups that The second is to match against the user's name and the groups that
the user belongs to. the user belongs to.
(The special (The special
.Li ALL .Sy ALL
tag is matched in this query too.) tag is matched in this query too.)
If no match is returned for the user's name and groups, a third If no match is returned for the user's name and groups, a third
query returns all entries containing user netgroups and other query returns all entries containing user netgroups and other
@@ -391,12 +390,12 @@ are as follows:
.Bl -enum .Bl -enum
.It .It
Match all Match all
.Li nisNetgroup .Em nisNetgroup
records with a records with a
.Li nisNetgroupTriple .Em nisNetgroupTriple
containing the user, host, and NIS domain. containing the user, host, and NIS domain.
The query will match The query will match
.Li nisNetgroupTriple .Em nisNetgroupTriple
entries with either the short or long form of the host name or entries with either the short or long form of the host name or
no host name specified in the tuple. no host name specified in the tuple.
If the NIS domain is set, the query will match only match entries If the NIS domain is set, the query will match only match entries
@@ -405,12 +404,12 @@ If the NIS domain is
.Em not .Em not
set, a wildcard is used to match any domain name but be aware that the set, a wildcard is used to match any domain name but be aware that the
NIS schema used by some LDAP servers may not support wild cards for NIS schema used by some LDAP servers may not support wild cards for
.Li nisNetgroupTriple . .Em nisNetgroupTriple .
.It .It
Repeated queries are performed to find any nested Repeated queries are performed to find any nested
.Li nisNetgroup .Em nisNetgroup
records with a records with a
.Li memberNisNetgroup .Em memberNisNetgroup
entry that refers to an already-matched record. entry that refers to an already-matched record.
.El .El
.Pp .Pp
@@ -445,7 +444,7 @@ returned in any specific order.
.Pp .Pp
The order in which different entries are applied can be controlled The order in which different entries are applied can be controlled
using the using the
.Li sudoOrder .Em sudoOrder
attribute, but there is no way to guarantee the order of attributes attribute, but there is no way to guarantee the order of attributes
within a specific entry. within a specific entry.
If there are conflicting command rules in an entry, the negative If there are conflicting command rules in an entry, the negative
@@ -496,18 +495,18 @@ These cannot be converted automatically.
For example, a Cmnd_Alias in a For example, a Cmnd_Alias in a
.Em sudoers .Em sudoers
file may be converted to a file may be converted to a
.Li sudoRole .Em sudoRole
that contains multiple commands. that contains multiple commands.
Multiple users and/or groups may be assigned to the Multiple users and/or groups may be assigned to the
.Li sudoRole . .Em sudoRole .
.Pp .Pp
Also, host, user, runas, and command-based Also, host, user, runas, and command-based
.Li Defaults .Em Defaults
entries are not supported. entries are not supported.
However, a However, a
.Li sudoRole .Em sudoRole
may contain one or more may contain one or more
.Li sudoOption .Em sudoOption
attributes which can often serve the same purpose. attributes which can often serve the same purpose.
.Pp .Pp
Consider the following Consider the following
@@ -561,7 +560,7 @@ Using a Unix group or netgroup in PAGERS rather than listing each
user would make this easier to maintain. user would make this easier to maintain.
.Pp .Pp
Per-user Per-user
.Li Defaults .Em Defaults
entries can be emulated by using one or more sudoOption attributes entries can be emulated by using one or more sudoOption attributes
in a sudoRole. in a sudoRole.
Consider the following Consider the following
@@ -602,7 +601,7 @@ LDAP support, the
schema must be schema must be
installed on your LDAP server. installed on your LDAP server.
In addition, be sure to index the In addition, be sure to index the
.Li sudoUser .Em sudoUser
attribute. attribute.
.Pp .Pp
The The
@@ -748,31 +747,30 @@ The default value is protocol version 3.
.It Sy NETGROUP_BASE Ar base .It Sy NETGROUP_BASE Ar base
The base DN to use when performing LDAP netgroup queries. The base DN to use when performing LDAP netgroup queries.
Typically this is of the form Typically this is of the form
.Li ou=netgroup,dc=my-domain,dc=com .Ql ou=netgroup,dc=my-domain,dc=com
for the domain for the domain my-domain.com.
.Li my-domain.com .
Multiple Multiple
.Sy NETGROUP_BASE .Sy NETGROUP_BASE
lines may be specified, in which case they are queried in the order specified. lines may be specified, in which case they are queried in the order specified.
.Pp .Pp
This option can be used to query a user's netgroups directly via LDAP This option can be used to query a user's netgroups directly via LDAP
which is usually faster than fetching every which is usually faster than fetching every
.Li sudoRole .Em sudoRole
object containing a object containing a
.Li sudoUser .Em sudoUser
that begins with a that begins with a
.Ql + .Ql +
prefix. prefix.
The NIS schema used by some LDAP servers need a modification to The NIS schema used by some LDAP servers need a modification to
support querying the support querying the
.Li nisNetgroup .Em nisNetgroup
object by its object by its
.Li nisNetgroupTriple .Em nisNetgroupTriple
member. member.
OpenLDAP's OpenLDAP's
.Sy slapd .Sy slapd
requires the following change to the requires the following change to the
.Li nisNetgroupTriple .Em nisNetgroupTriple
attribute: attribute:
.Bd -literal -offset 4n .Bd -literal -offset 4n
attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple'
@@ -784,13 +782,12 @@ attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple'
.It Sy NETGROUP_SEARCH_FILTER Ar ldap_filter .It Sy NETGROUP_SEARCH_FILTER Ar ldap_filter
An LDAP filter which is used to restrict the set of records returned An LDAP filter which is used to restrict the set of records returned
when performing an LDAP netgroup query. when performing an LDAP netgroup query.
Typically, this is of the Typically, this is of the form
form .Ql attribute=value
.Li attribute=value
or or
.Li (&(attribute=value)(attribute2=value2)) . .Ql (&(attribute=value)(attribute2=value2)) .
The default search filter is: The default search filter is:
.Li objectClass=nisNetgroup . .Ql objectClass=nisNetgroup .
If If
.Ar ldap_filter .Ar ldap_filter
is omitted, no search filter will be used. is omitted, no search filter will be used.
@@ -867,17 +864,17 @@ This option is only relevant when using SASL authentication.
If the If the
.Sy SSL .Sy SSL
parameter is set to parameter is set to
.Li on , .Em on ,
.Li true , .Em true ,
or or
.Li yes .Em yes
TLS (SSL) encryption is always used when communicating with the LDAP server. TLS (SSL) encryption is always used when communicating with the LDAP server.
Typically, this involves connecting to the server on port 636 (ldaps). Typically, this involves connecting to the server on port 636 (ldaps).
.It Sy SSL Ar start_tls .It Sy SSL Ar start_tls
If the If the
.Sy SSL .Sy SSL
parameter is set to parameter is set to
.Li start_tls , .Em start_tls ,
the LDAP server connection is initiated normally and TLS encryption is the LDAP server connection is initiated normally and TLS encryption is
begun before the bind credentials are sent. begun before the bind credentials are sent.
This has the advantage of not requiring a dedicated port for encrypted This has the advantage of not requiring a dedicated port for encrypted
@@ -890,9 +887,8 @@ The base DN to use when performing
.Nm sudo .Nm sudo
LDAP queries. LDAP queries.
Typically this is of the form Typically this is of the form
.Li ou=SUDOers,dc=my-domain,dc=com .Ql ou=SUDOers,dc=my-domain,dc=com
for the domain for the domain my-domain.com.
.Li my-domain.com .
Multiple Multiple
.Sy SUDOERS_BASE .Sy SUDOERS_BASE
lines may be specified, in which case they are queried in the order specified. lines may be specified, in which case they are queried in the order specified.
@@ -932,19 +928,19 @@ when performing a
LDAP query. LDAP query.
Typically, this is of the Typically, this is of the
form form
.Li attribute=value .Ql attribute=value
or or
.Li (&(attribute=value)(attribute2=value2)) . .Ql (&(attribute=value)(attribute2=value2)) .
The default search filter is: The default search filter is:
.Li objectClass=sudoRole . .Ql objectClass=sudoRole .
If If
.Ar ldap_filter .Ar ldap_filter
is omitted, no search filter will be used. is omitted, no search filter will be used.
.It Sy SUDOERS_TIMED Ar on/true/yes/off/false/no .It Sy SUDOERS_TIMED Ar on/true/yes/off/false/no
Whether or not to evaluate the Whether or not to evaluate the
.Li sudoNotBefore .Em sudoNotBefore
and and
.Li sudoNotAfter .Em sudoNotAfter
attributes that implement time-dependent sudoers entries. attributes that implement time-dependent sudoers entries.
.It Sy TIMELIMIT Ar seconds .It Sy TIMELIMIT Ar seconds
The The
@@ -987,9 +983,9 @@ be used to authenticate the client to the LDAP server.
The certificate type depends on the LDAP libraries used. The certificate type depends on the LDAP libraries used.
.Bl -tag -width 4n .Bl -tag -width 4n
.It OpenLDAP: .It OpenLDAP:
.Li tls_cert /etc/ssl/client_cert.pem .Ql tls_cert /etc/ssl/client_cert.pem
.It Netscape-derived: .It Netscape-derived:
.Li tls_cert /var/ldap/cert7.db .Ql tls_cert /var/ldap/cert7.db
.It IBM LDAP: .It IBM LDAP:
Unused, the key database specified by Unused, the key database specified by
.Sy TLS_KEY .Sy TLS_KEY
@@ -1023,11 +1019,11 @@ The private key must not be password-protected.
The key type depends on the LDAP libraries used. The key type depends on the LDAP libraries used.
.Bl -tag -width 4n .Bl -tag -width 4n
.It OpenLDAP: .It OpenLDAP:
.Li tls_key /etc/ssl/client_key.pem .Ql tls_key /etc/ssl/client_key.pem
.It Netscape-derived: .It Netscape-derived:
.Li tls_key /var/ldap/key3.db .Ql tls_key /var/ldap/key3.db
.It IBM LDAP: .It IBM LDAP:
.Li tls_key /usr/ldap/ldapkey.kdb .Ql tls_key /usr/ldap/ldapkey.kdb
.El .El
.Pp .Pp
When using IBM LDAP libraries, this file may also contain When using IBM LDAP libraries, this file may also contain
@@ -1079,15 +1075,15 @@ The
must have the same path as the file specified by must have the same path as the file specified by
.Sy TLS_KEY , .Sy TLS_KEY ,
but use a but use a
.Li .sth .Ql .sth
file extension instead of file extension instead of
.Li .kdb , .Ql .kdb ,
e.g., for example
.Li ldapkey.sth . .Ql ldapkey.sth .
The default The default
.Li ldapkey.kdb .Ql ldapkey.kdb
that ships with the IBM Tivoli Directory Server is encrypted with the password that ships with the IBM Tivoli Directory Server is encrypted with the password
.Li ssl_password . .Ql ssl_password .
The The
.Em gsk8capicmd .Em gsk8capicmd
utility can be used to manage the key database and create a utility can be used to manage the key database and create a
@@ -1149,9 +1145,9 @@ the latter being for servers that support TLS (SSL) encryption.
If no If no
.Em port .Em port
is specified, the default is port 389 for is specified, the default is port 389 for
.Li ldap:// .Ql ldap://
or port 636 for or port 636 for
.Li ldaps:// . .Ql ldaps:// .
If no If no
.Em hostname .Em hostname
is specified, is specified,
@@ -1164,9 +1160,9 @@ lines are treated identically to a
.Sy URI .Sy URI
line containing multiple entries. line containing multiple entries.
Only systems using the OpenSSL libraries support the mixing of Only systems using the OpenSSL libraries support the mixing of
.Li ldap:// .Ql ldap://
and and
.Li ldaps:// .Ql ldaps://
URIs. URIs.
Both the Netscape-derived and IBM LDAP libraries used on most commercial Both the Netscape-derived and IBM LDAP libraries used on most commercial
versions of Unix are only capable of supporting one or the other. versions of Unix are only capable of supporting one or the other.
@@ -1194,13 +1190,13 @@ to specify the
.Em sudoers .Em sudoers
search order. search order.
Sudo looks for a line beginning with Sudo looks for a line beginning with
.Li sudoers : .Em sudoers :
and uses this to determine the search order. and uses this to determine the search order.
By default, By default,
.Nm sudo .Nm sudo
does not stop searching after the first match and later matches take does not stop searching after the first match and later matches take
precedence over earlier ones (unless precedence over earlier ones (unless
.Li [SUCCESS=return] .Ql [SUCCESS=return]
is used, see below). is used, see below).
The following sources are recognized: The following sources are recognized:
.Pp .Pp
@@ -1215,14 +1211,14 @@ read sudoers from LDAP
In addition, a subset of In addition, a subset of
.Pa nsswitch.conf Ns -style .Pa nsswitch.conf Ns -style
action statements is supported, specifically action statements is supported, specifically
.Li [SUCCESS=return] .Ql [SUCCESS=return]
and and
.Li [NOTFOUND=return] . .Ql [NOTFOUND=return] .
These will unconditionally terminate the search if the user was either These will unconditionally terminate the search if the user was either
found found
.Pq Li [SUCCESS=return] .Ql [SUCCESS=return]
or not found or not found
.Pq Li [NOTFOUND=return] .Ql [NOTFOUND=return]
in the immediately preceding source. in the immediately preceding source.
Other action statements tokens are not supported, nor is test Other action statements tokens are not supported, nor is test
negation with negation with
@@ -1292,11 +1288,11 @@ sudoers = ldap = auth, files
.Ed .Ed
.Pp .Pp
In the above example, the In the above example, the
.Li auth .Em auth
qualifier only affects user lookups; both LDAP and qualifier only affects user lookups; both LDAP and
.Em sudoers .Em sudoers
will be queried for will be queried for
.Li Defaults .Em Defaults
entries. entries.
.Pp .Pp
If the If the
@@ -1318,9 +1314,9 @@ rules.
To use SSSD as the To use SSSD as the
.Em sudoers .Em sudoers
source, you should use source, you should use
.Li sss .Em sss
instead of instead of
.Li ldap .Em ldap
for the sudoers entry in for the sudoers entry in
.Pa @nsswitch_conf@ . .Pa @nsswitch_conf@ .
The The
@@ -1461,7 +1457,7 @@ Simply copy
it to the schema directory (e.g., it to the schema directory (e.g.,
.Pa /etc/openldap/schema ) , .Pa /etc/openldap/schema ) ,
add the proper add the proper
.Li include .Em include
line in line in
.Pa slapd.conf .Pa slapd.conf
and restart and restart

761
docs/sudoers.man.in
View File

File diff suppressed because it is too large Load Diff

911
docs/sudoers.mdoc.in
View File

File diff suppressed because it is too large Load Diff

4
docs/sudoers_timestamp.man.in
View File

@@ -16,7 +16,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.TH "SUDOERS_TIMESTAMP" "@mansectform@" "February 16, 2022" "Sudo @PACKAGE_VERSION@" "File Formats Manual" .TH "SUDOERS_TIMESTAMP" "@mansectform@" "September 13, 2022" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.nh .nh
.if n .ad l .if n .ad l
.SH "NAME" .SH "NAME"
@@ -29,7 +29,7 @@ plugin uses per-user time stamp files for credential caching.
Once a user has been authenticated, they may use Once a user has been authenticated, they may use
\fBsudo\fR \fBsudo\fR
without a password for a short period of time without a password for a short period of time
(\fR@timeout@\fR (\fI@timeout@\fR
minutes unless overridden by the minutes unless overridden by the
\fItimestamp_timeout\fR \fItimestamp_timeout\fR
option) option)

30
docs/sudoers_timestamp.mdoc.in
View File

@@ -15,7 +15,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.Dd February 16, 2022 .Dd September 13, 2022
.Dt SUDOERS_TIMESTAMP @mansectform@ .Dt SUDOERS_TIMESTAMP @mansectform@
.Os Sudo @PACKAGE_VERSION@ .Os Sudo @PACKAGE_VERSION@
.Sh NAME .Sh NAME
@@ -29,7 +29,7 @@ Once a user has been authenticated, they may use
.Nm sudo .Nm sudo
without a password for a short period of time without a password for a short period of time
.Po .Po
.Li @timeout@ .Em @timeout@
minutes unless overridden by the minutes unless overridden by the
.Em timestamp_timeout .Em timestamp_timeout
option option
@@ -94,19 +94,19 @@ same file but are not inter-operable.
The size of the record in bytes. The size of the record in bytes.
.It type .It type
The record type, currently The record type, currently
.Li TS_GLOBAL , .Dv TS_GLOBAL ,
.Li TS_TTY , .Dv TS_TTY ,
or or
.Li TS_PPID . .Dv TS_PPID .
.It flags .It flags
Zero or more record flags which can be bit-wise ORed together. Zero or more record flags which can be bit-wise ORed together.
Supported flags are Supported flags are
.Li TS_DISABLED , .Dv TS_DISABLED ,
for records disabled via for records disabled via
.Nm sudo .Nm sudo
.Fl k .Fl k
and and
.Li TS_ANYUID , .Dv TS_ANYUID ,
which is used only when matching records. which is used only when matching records.
.It auth_uid .It auth_uid
The user-ID that was used for authentication. The user-ID that was used for authentication.
@@ -120,12 +120,12 @@ the default runas user or the target user.
.It sid .It sid
The ID of the user's terminal session, if present. The ID of the user's terminal session, if present.
The session ID is only used when matching records of type The session ID is only used when matching records of type
.Li TS_TTY . .Dv TS_TTY .
.It start_time .It start_time
The start time of the session leader for records of type The start time of the session leader for records of type
.Li TS_TTY .Dv TS_TTY
or of the parent process for records of type or of the parent process for records of type
.Li TS_PPID . .Dv TS_PPID .
The The
.Em start_time .Em start_time
is used to help prevent re-use of a time stamp record after a is used to help prevent re-use of a time stamp record after a
@@ -157,10 +157,10 @@ option, no password is required.
.It u.ttydev .It u.ttydev
The device number of the terminal associated with the session for The device number of the terminal associated with the session for
records of type records of type
.Li TS_TTY . .Dv TS_TTY .
.It u.ppid .It u.ppid
The ID of the parent process for records of type The ID of the parent process for records of type
.Li TS_PPID . .Dv TS_PPID .
.El .El
.Sh LOCKING .Sh LOCKING
In In
@@ -174,7 +174,7 @@ of the entire file and the lock is held for a longer period of time.
This scheme is described below. This scheme is described below.
.Pp .Pp
The first record in the time stamp file is of type The first record in the time stamp file is of type
.Li TS_LOCKEXCL .Dv TS_LOCKEXCL
and is used as a and is used as a
.Em lock .Em lock
record to prevent more than one record to prevent more than one
@@ -182,7 +182,7 @@ record to prevent more than one
process from adding a new record at the same time. process from adding a new record at the same time.
Once the desired time stamp record has been located or created (and Once the desired time stamp record has been located or created (and
locked), the locked), the
.Li TS_LOCKEXCL .Dv TS_LOCKEXCL
record is unlocked. record is unlocked.
The lock on the individual time stamp record, however, is held until The lock on the individual time stamp record, however, is held until
authentication is complete. authentication is complete.
@@ -192,7 +192,7 @@ to avoid prompting for a password multiple times when it
is used more than once in a pipeline. is used more than once in a pipeline.
.Pp .Pp
Records of type Records of type
.Li TS_GLOBAL .Dv TS_GLOBAL
cannot be locked for a long period of time since doing so would cannot be locked for a long period of time since doing so would
interfere with other interfere with other
.Nm sudo .Nm sudo

12
docs/sudoreplay.man.in
View File

@@ -16,7 +16,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.TH "SUDOREPLAY" "@mansectsu@" "February 16, 2022" "Sudo @PACKAGE_VERSION@" "System Manager's Manual" .TH "SUDOREPLAY" "@mansectsu@" "September 13, 2022" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
.nh .nh
.if n .ad l .if n .ad l
.SH "NAME" .SH "NAME"
@@ -50,7 +50,7 @@ The
\fIID\fR \fIID\fR
should either be a six character sequence of digits and should either be a six character sequence of digits and
upper case letters, e.g., upper case letters, e.g.,
\fR0100A5\fR \(lq0100A5\(rq
or a path name. or a path name.
The The
\fIID\fR \fIID\fR
@@ -76,8 +76,10 @@ with
enabled in the enabled in the
\fIsudoers\fR \fIsudoers\fR
file, a file, a
\fRTSID=ID\fR \(lqTSID=ID\(rq
string is logged via syslog or to the string is logged via
syslog(3)
or to the
\fBsudo\fR \fBsudo\fR
log file. log file.
The The
@@ -400,7 +402,7 @@ This will be addressed in a future version of
\fBsudoreplay\fR \fBsudoreplay\fR
versions 1.8.4 and higher support a flexible debugging framework versions 1.8.4 and higher support a flexible debugging framework
that is configured via that is configured via
\fRDebug\fR \fIDebug\fR
lines in the lines in the
sudo.conf(@mansectform@) sudo.conf(@mansectform@)
file. file.

12
docs/sudoreplay.mdoc.in
View File

@@ -15,7 +15,7 @@
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" .\"
.Dd February 16, 2022 .Dd September 13, 2022
.Dt SUDOREPLAY @mansectsu@ .Dt SUDOREPLAY @mansectsu@
.Os Sudo @PACKAGE_VERSION@ .Os Sudo @PACKAGE_VERSION@
.Sh NAME .Sh NAME
@@ -48,7 +48,7 @@ The
.Em ID .Em ID
should either be a six character sequence of digits and should either be a six character sequence of digits and
upper case letters, e.g., upper case letters, e.g.,
.Li 0100A5 .Dq 0100A5
or a path name. or a path name.
The The
.Em ID .Em ID
@@ -74,8 +74,10 @@ with
enabled in the enabled in the
.Em sudoers .Em sudoers
file, a file, a
.Li TSID=ID .Dq TSID=ID
string is logged via syslog or to the string is logged via
.Xr syslog 3
or to the
.Nm sudo .Nm sudo
log file. log file.
The The
@@ -363,7 +365,7 @@ This will be addressed in a future version of
.Nm .Nm
versions 1.8.4 and higher support a flexible debugging framework versions 1.8.4 and higher support a flexible debugging framework
that is configured via that is configured via
.Li Debug .Em Debug
lines in the lines in the
.Xr sudo.conf @mansectform@ .Xr sudo.conf @mansectform@
file. file.

6
docs/visudo.man.in
View File

@@ -21,7 +21,7 @@
.\" Agency (DARPA) and Air Force Research Laboratory, Air Force .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512. .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
.\" .\"
.TH "VISUDO" "@mansectsu@" "April 23, 2022" "Sudo @PACKAGE_VERSION@" "System Manager's Manual" .TH "VISUDO" "@mansectsu@" "September 13, 2022" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
.nh .nh
.if n .ad l .if n .ad l
.SH "NAME" .SH "NAME"
@@ -289,7 +289,7 @@ include file for syntax errors.
\fBvisudo\fR \fBvisudo\fR
versions 1.8.4 and higher support a flexible debugging framework versions 1.8.4 and higher support a flexible debugging framework
that is configured via that is configured via
\fRDebug\fR \fIDebug\fR
lines in the lines in the
sudo.conf(@mansectform@) sudo.conf(@mansectform@)
file. file.
@@ -450,7 +450,7 @@ file.
The The
\fIsudoers\fR \fIsudoers\fR
file contains a file contains a
\fRDefaults\fR \fIDefaults\fR
setting not recognized by setting not recognized by
\fBvisudo\fR. \fBvisudo\fR.
.SH "SEE ALSO" .SH "SEE ALSO"

6
docs/visudo.mdoc.in
View File

@@ -20,7 +20,7 @@
.\" Agency (DARPA) and Air Force Research Laboratory, Air Force .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512. .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
.\" .\"
.Dd April 23, 2022 .Dd September 13, 2022
.Dt VISUDO @mansectsu@ .Dt VISUDO @mansectsu@
.Os Sudo @PACKAGE_VERSION@ .Os Sudo @PACKAGE_VERSION@
.Sh NAME .Sh NAME
@@ -281,7 +281,7 @@ include file for syntax errors.
.Nm .Nm
versions 1.8.4 and higher support a flexible debugging framework versions 1.8.4 and higher support a flexible debugging framework
that is configured via that is configured via
.Li Debug .Em Debug
lines in the lines in the
.Xr sudo.conf @mansectform@ .Xr sudo.conf @mansectform@
file. file.
@@ -430,7 +430,7 @@ file.
The The
.Em sudoers .Em sudoers
file contains a file contains a
.Li Defaults .Em Defaults
setting not recognized by setting not recognized by
.Nm . .Nm .
.El .El