isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

intercept_verify is fast, but the policy check is (relatively) slow.

Browse Source
This commit is contained in:
Todd C. Miller
2022-08-29 14:10:49 -06:00
parent 817f63b05d
commit caa0408a8a
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/sudoers.man.in
View File

@@ -2023,6 +2023,11 @@ and logged just like they would be if run through
directly.
This is useful in conjunction with commands that allow shell escapes
such as editors, shells, and paginators.
There is additional overhead due to the policy check that may add
latency when running commands such as shell scripts that execute a
large number of sub-commands.
For interactive commands, such as a shell or editor,
the overhead is not usually noticable.
.sp
In the following example, user
\fBchuck\fR
@@ -3428,10 +3433,6 @@ policy check.
The checks can only be performed if the
proc(@mansectform@)
file system is available.
The additional overhead from
\fIintercept_verify\fR
may add additional latency when running shell scripts that
execute a large number of commands.
This flag has no effect unless the
\fIintercept\fR
flag is enabled or the

9
docs/sudoers.mdoc.in
View File

@@ -1926,6 +1926,11 @@ and logged just like they would be if run through
directly.
This is useful in conjunction with commands that allow shell escapes
such as editors, shells, and paginators.
There is additional overhead due to the policy check that may add
latency when running commands such as shell scripts that execute a
large number of sub-commands.
For interactive commands, such as a shell or editor,
the overhead is not usually noticeable.
.Pp
In the following example, user
.Sy chuck
@@ -3249,10 +3254,6 @@ policy check.
The checks can only be performed if the
.Xr proc @mansectform@
file system is available.
The additional overhead from
.Em intercept_verify
may add additional latency when running shell scripts that
execute a large number of commands.
This flag has no effect unless the
.Em intercept
flag is enabled or the