5295 lines
119 KiB
Groff
5295 lines
119 KiB
Groff
.\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
|
|
.\" IT IS GENERATED AUTOMATICALLY FROM sudoers.mdoc.in
|
|
.\"
|
|
.\" Copyright (c) 1994-1996, 1998-2005, 2007-2016
|
|
.\" Todd C. Miller <Todd.Miller@courtesan.com>
|
|
.\"
|
|
.\" Permission to use, copy, modify, and distribute this software for any
|
|
.\" purpose with or without fee is hereby granted, provided that the above
|
|
.\" copyright notice and this permission notice appear in all copies.
|
|
.\"
|
|
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
.\"
|
|
.\" Sponsored in part by the Defense Advanced Research Projects
|
|
.\" Agency (DARPA) and Air Force Research Laboratory, Air Force
|
|
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
|
|
.\"
|
|
.TH "SUDOERS" "5" "November 30, 2016" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
|
|
.nh
|
|
.if n .ad l
|
|
.SH "NAME"
|
|
\fBsudoers\fR
|
|
\- default sudo security policy plugin
|
|
.SH "DESCRIPTION"
|
|
The
|
|
\fBsudoers\fR
|
|
policy plugin determines a user's
|
|
\fBsudo\fR
|
|
privileges.
|
|
It is the default
|
|
\fBsudo\fR
|
|
policy plugin.
|
|
The policy is driven by
|
|
the
|
|
\fI@sysconfdir@/sudoers\fR
|
|
file or, optionally in LDAP.
|
|
The policy format is described in detail in the
|
|
\fISUDOERS FILE FORMAT\fR
|
|
section.
|
|
For information on storing
|
|
\fBsudoers\fR
|
|
policy information
|
|
in LDAP, please see
|
|
sudoers.ldap(@mansectform@).
|
|
.SS "Configuring sudo.conf for sudoers"
|
|
\fBsudo\fR
|
|
consults the
|
|
sudo.conf(@mansectform@)
|
|
file to determine which policy and and I/O logging plugins to load.
|
|
If no
|
|
sudo.conf(@mansectform@)
|
|
file is present, or if it contains no
|
|
\fRPlugin\fR
|
|
lines,
|
|
\fBsudoers\fR
|
|
will be used for policy decisions and I/O logging.
|
|
To explicitly configure
|
|
sudo.conf(@mansectform@)
|
|
to use the
|
|
\fBsudoers\fR
|
|
plugin, the following configuration can be used.
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
Plugin sudoers_policy sudoers.so
|
|
Plugin sudoers_io sudoers.so
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Starting with
|
|
\fBsudo\fR
|
|
1.8.5, it is possible to specify optional arguments to the
|
|
\fBsudoers\fR
|
|
plugin in the
|
|
sudo.conf(@mansectform@)
|
|
file.
|
|
These arguments, if present, should be listed after the path to the plugin
|
|
(i.e.\& after
|
|
\fIsudoers.so\fR).
|
|
Multiple arguments may be specified, separated by white space.
|
|
For example:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
Plugin sudoers_policy sudoers.so sudoers_mode=0400
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The following plugin arguments are supported:
|
|
.TP 10n
|
|
ldap_conf=pathname
|
|
The
|
|
\fIldap_conf\fR
|
|
argument can be used to override the default path to the
|
|
\fIldap.conf\fR
|
|
file.
|
|
.TP 10n
|
|
ldap_secret=pathname
|
|
The
|
|
\fIldap_secret\fR
|
|
argument can be used to override the default path to the
|
|
\fIldap.secret\fR
|
|
file.
|
|
.TP 10n
|
|
sudoers_file=pathname
|
|
The
|
|
\fIsudoers_file\fR
|
|
argument can be used to override the default path to the
|
|
\fIsudoers\fR
|
|
file.
|
|
.TP 10n
|
|
sudoers_uid=uid
|
|
The
|
|
\fIsudoers_uid\fR
|
|
argument can be used to override the default owner of the sudoers file.
|
|
It should be specified as a numeric user ID.
|
|
.TP 10n
|
|
sudoers_gid=gid
|
|
The
|
|
\fIsudoers_gid\fR
|
|
argument can be used to override the default group of the sudoers file.
|
|
It must be specified as a numeric group ID (not a group name).
|
|
.TP 10n
|
|
sudoers_mode=mode
|
|
The
|
|
\fIsudoers_mode\fR
|
|
argument can be used to override the default file mode for the sudoers file.
|
|
It should be specified as an octal value.
|
|
.PP
|
|
For more information on configuring
|
|
sudo.conf(@mansectform@),
|
|
please refer to its manual.
|
|
.SS "User Authentication"
|
|
The
|
|
\fBsudoers\fR
|
|
security policy requires that most users authenticate
|
|
themselves before they can use
|
|
\fBsudo\fR.
|
|
A password is not required
|
|
if the invoking user is root, if the target user is the same as the
|
|
invoking user, or if the policy has disabled authentication for the
|
|
user or command.
|
|
Unlike
|
|
su(1),
|
|
when
|
|
\fBsudoers\fR
|
|
requires
|
|
authentication, it validates the invoking user's credentials, not
|
|
the target user's (or root's) credentials.
|
|
This can be changed via
|
|
the
|
|
\fIrootpw\fR,
|
|
\fItargetpw\fR
|
|
and
|
|
\fIrunaspw\fR
|
|
flags, described later.
|
|
.PP
|
|
If a user who is not listed in the policy tries to run a command
|
|
via
|
|
\fBsudo\fR,
|
|
mail is sent to the proper authorities.
|
|
The address
|
|
used for such mail is configurable via the
|
|
\fImailto\fR
|
|
Defaults entry
|
|
(described later) and defaults to
|
|
\fR@mailto@\fR.
|
|
.PP
|
|
Note that no mail will be sent if an unauthorized user tries to run
|
|
\fBsudo\fR
|
|
with the
|
|
\fB\-l\fR
|
|
or
|
|
\fB\-v\fR
|
|
option unless there is an authentication error and
|
|
either the
|
|
\fImail_always\fR
|
|
or
|
|
\fImail_badpass\fR
|
|
flags are enabled.
|
|
This allows users to
|
|
determine for themselves whether or not they are allowed to use
|
|
\fBsudo\fR.
|
|
All attempts to run
|
|
\fBsudo\fR
|
|
(successful or not)
|
|
will be logged, regardless of whether or not mail is sent.
|
|
.PP
|
|
If
|
|
\fBsudo\fR
|
|
is run by root and the
|
|
\fRSUDO_USER\fR
|
|
environment variable
|
|
is set, the
|
|
\fBsudoers\fR
|
|
policy will use this value to determine who
|
|
the actual user is.
|
|
This can be used by a user to log commands
|
|
through sudo even when a root shell has been invoked.
|
|
It also
|
|
allows the
|
|
\fB\-e\fR
|
|
option to remain useful even when invoked via a
|
|
sudo-run script or program.
|
|
Note, however, that the
|
|
\fIsudoers\fR
|
|
file lookup is still done for root, not the user specified by
|
|
\fRSUDO_USER\fR.
|
|
.PP
|
|
\fBsudoers\fR
|
|
uses per-user time stamp files for credential caching.
|
|
Once a user has been authenticated, a record is written
|
|
containing the uid that was used to authenticate, the
|
|
terminal session ID, and a time stamp
|
|
(using a monotonic clock if one is available).
|
|
The user may then use
|
|
\fBsudo\fR
|
|
without a password for a short period of time
|
|
(\fR@timeout@\fR
|
|
minutes unless overridden by the
|
|
\fItimeout\fR
|
|
option)
|
|
\&.
|
|
By default,
|
|
\fBsudoers\fR
|
|
uses a separate record for each tty, which means that
|
|
a user's login sessions are authenticated separately.
|
|
The
|
|
\fItty_tickets\fR
|
|
option can be disabled to force the use of a
|
|
single time stamp for all of a user's sessions.
|
|
.SS "Logging"
|
|
\fBsudoers\fR
|
|
can log both successful and unsuccessful attempts (as well
|
|
as errors) to
|
|
syslog(3),
|
|
a log file, or both.
|
|
By default,
|
|
\fBsudoers\fR
|
|
will log via
|
|
syslog(3)
|
|
but this is changeable via the
|
|
\fIsyslog\fR
|
|
and
|
|
\fIlogfile\fR
|
|
Defaults settings.
|
|
See
|
|
\fILOG FORMAT\fR
|
|
for a description of the log file format.
|
|
.PP
|
|
\fBsudoers\fR
|
|
is also capable of running a command in a pseudo-tty and logging all
|
|
input and/or output.
|
|
The standard input, standard output and standard error can be logged
|
|
even when not associated with a terminal.
|
|
I/O logging is not on by default but can be enabled using
|
|
the
|
|
\fIlog_input\fR
|
|
and
|
|
\fIlog_output\fR
|
|
options as well as the
|
|
\fRLOG_INPUT\fR
|
|
and
|
|
\fRLOG_OUTPUT\fR
|
|
command tags.
|
|
See
|
|
\fII/O LOG FILES\fR
|
|
for details on how I/O log files are stored.
|
|
.SS "Command environment"
|
|
Since environment variables can influence program behavior,
|
|
\fBsudoers\fR
|
|
provides a means to restrict which variables from the user's
|
|
environment are inherited by the command to be run.
|
|
There are two
|
|
distinct ways
|
|
\fBsudoers\fR
|
|
can deal with environment variables.
|
|
.PP
|
|
By default, the
|
|
\fIenv_reset\fR
|
|
option is enabled.
|
|
This causes commands
|
|
to be executed with a new, minimal environment.
|
|
On AIX (and Linux
|
|
systems without PAM), the environment is initialized with the
|
|
contents of the
|
|
\fI/etc/environment\fR
|
|
file.
|
|
On BSD systems, if the
|
|
\fIuse_loginclass\fR
|
|
option is enabled, the environment is initialized
|
|
based on the
|
|
\fIpath\fR
|
|
and
|
|
\fIsetenv\fR
|
|
settings in
|
|
\fI/etc/login.conf\fR.
|
|
The new environment contains the
|
|
\fRTERM\fR,
|
|
\fRPATH\fR,
|
|
\fRHOME\fR,
|
|
\fRMAIL\fR,
|
|
\fRSHELL\fR,
|
|
\fRLOGNAME\fR,
|
|
\fRUSER\fR,
|
|
\fRUSERNAME\fR
|
|
and
|
|
\fRSUDO_*\fR
|
|
variables
|
|
in addition to variables from the invoking process permitted by the
|
|
\fIenv_check\fR
|
|
and
|
|
\fIenv_keep\fR
|
|
options.
|
|
This is effectively a whitelist
|
|
for environment variables.
|
|
Environment variables with a value beginning with
|
|
\fR()\fR
|
|
are removed unless both the name and value parts are matched by
|
|
\fIenv_keep\fR
|
|
or
|
|
\fIenv_check\fR,
|
|
as they will be interpreted as functions by older versions of the
|
|
\fBbash\fR
|
|
shell.
|
|
Prior to version 1.8.11, such variables were always removed.
|
|
.PP
|
|
If, however, the
|
|
\fIenv_reset\fR
|
|
option is disabled, any variables not
|
|
explicitly denied by the
|
|
\fIenv_check\fR
|
|
and
|
|
\fIenv_delete\fR
|
|
options are
|
|
inherited from the invoking process.
|
|
In this case,
|
|
\fIenv_check\fR
|
|
and
|
|
\fIenv_delete\fR
|
|
behave like a blacklist.
|
|
Environment variables with a value beginning with
|
|
\fR()\fR
|
|
are always removed, even if they do not match one of the blacklists.
|
|
Since it is not possible
|
|
to blacklist all potentially dangerous environment variables, use
|
|
of the default
|
|
\fIenv_reset\fR
|
|
behavior is encouraged.
|
|
.PP
|
|
By default, environment variables are matched by name.
|
|
However, if the pattern includes an equal sign
|
|
(\(oq=\&\(cq),
|
|
both the variables name and value must match.
|
|
For example, an old-style (pre-shellshock)
|
|
\fBbash\fR
|
|
shell function could be matched as follows:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
env_keep += "my_func=()*"
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Without the
|
|
\(Lq\fR=()*\fR\(Rq
|
|
suffix, this would not match, as old-style
|
|
\fBbash\fR
|
|
shell functions are not preserved by default.
|
|
.PP
|
|
The complete list of environment variables that
|
|
\fBsudo\fR
|
|
allows or denies is contained in the output of
|
|
\(Lq\fRsudo -V\fR\(Rq
|
|
when run as root.
|
|
Please note that this list varies based on the operating system
|
|
\fBsudo\fR
|
|
is running on.
|
|
.PP
|
|
On systems that support PAM where the
|
|
\fBpam_env\fR
|
|
module is enabled for
|
|
\fBsudo\fR,
|
|
variables in the PAM environment may be merged in to the environment.
|
|
If a variable in the PAM environment is already present in the
|
|
user's environment, the value will only be overridden if the variable
|
|
was not preserved by
|
|
\fBsudoers\fR.
|
|
When
|
|
\fIenv_reset\fR
|
|
is enabled, variables preserved from the invoking user's environment
|
|
by the
|
|
\fIenv_keep\fR
|
|
list take precedence over those in the PAM environment.
|
|
When
|
|
\fIenv_reset\fR
|
|
is disabled, variables present the invoking user's environment
|
|
take precedence over those in the PAM environment unless they
|
|
match a pattern in the
|
|
\fIenv_delete\fR
|
|
list.
|
|
.PP
|
|
Note that the dynamic linker on most operating systems will remove
|
|
variables that can control dynamic linking from the environment of
|
|
setuid executables, including
|
|
\fBsudo\fR.
|
|
Depending on the operating
|
|
system this may include
|
|
\fR_RLD*\fR,
|
|
\fRDYLD_*\fR,
|
|
\fRLD_*\fR,
|
|
\fRLDR_*\fR,
|
|
\fRLIBPATH\fR,
|
|
\fRSHLIB_PATH\fR,
|
|
and others.
|
|
These type of variables are
|
|
removed from the environment before
|
|
\fBsudo\fR
|
|
even begins execution
|
|
and, as such, it is not possible for
|
|
\fBsudo\fR
|
|
to preserve them.
|
|
.PP
|
|
As a special case, if
|
|
\fBsudo\fR's
|
|
\fB\-i\fR
|
|
option (initial login) is
|
|
specified,
|
|
\fBsudoers\fR
|
|
will initialize the environment regardless
|
|
of the value of
|
|
\fIenv_reset\fR.
|
|
The
|
|
\fRDISPLAY\fR,
|
|
\fRPATH\fR
|
|
and
|
|
\fRTERM\fR
|
|
variables remain unchanged;
|
|
\fRHOME\fR,
|
|
\fRMAIL\fR,
|
|
\fRSHELL\fR,
|
|
\fRUSER\fR,
|
|
and
|
|
\fRLOGNAME\fR
|
|
are set based on the target user.
|
|
On AIX (and Linux
|
|
systems without PAM), the contents of
|
|
\fI/etc/environment\fR
|
|
are also
|
|
included.
|
|
On BSD systems, if the
|
|
\fIuse_loginclass\fR
|
|
flag is
|
|
enabled, the
|
|
\fIpath\fR
|
|
and
|
|
\fIsetenv\fR
|
|
variables in
|
|
\fI/etc/login.conf\fR
|
|
are also applied.
|
|
All other environment variables are removed.
|
|
.PP
|
|
Finally, if the
|
|
\fIenv_file\fR
|
|
option is defined, any variables present
|
|
in that file will be set to their specified values as long as they
|
|
would not conflict with an existing environment variable.
|
|
.SH "SUDOERS FILE FORMAT"
|
|
The
|
|
\fIsudoers\fR
|
|
file is composed of two types of entries: aliases
|
|
(basically variables) and user specifications (which specify who
|
|
may run what).
|
|
.PP
|
|
When multiple entries match for a user, they are applied in order.
|
|
Where there are multiple matches, the last match is used (which is
|
|
not necessarily the most specific match).
|
|
.PP
|
|
The
|
|
\fIsudoers\fR
|
|
file grammar will be described below in Extended Backus-Naur
|
|
Form (EBNF).
|
|
Don't despair if you are unfamiliar with EBNF; it is fairly simple,
|
|
and the definitions below are annotated.
|
|
.SS "Quick guide to EBNF"
|
|
EBNF is a concise and exact way of describing the grammar of a language.
|
|
Each EBNF definition is made up of
|
|
\fIproduction rules\fR.
|
|
E.g.,
|
|
.PP
|
|
\fRsymbol ::= definition\fR | \fRalternate1\fR | \fRalternate2 ...\fR
|
|
.PP
|
|
Each
|
|
\fIproduction rule\fR
|
|
references others and thus makes up a
|
|
grammar for the language.
|
|
EBNF also contains the following
|
|
operators, which many readers will recognize from regular
|
|
expressions.
|
|
Do not, however, confuse them with
|
|
\(Lqwildcard\(Rq
|
|
characters, which have different meanings.
|
|
.TP 6n
|
|
\fR\&?\fR
|
|
Means that the preceding symbol (or group of symbols) is optional.
|
|
That is, it may appear once or not at all.
|
|
.TP 6n
|
|
\fR*\fR
|
|
Means that the preceding symbol (or group of symbols) may appear
|
|
zero or more times.
|
|
.TP 6n
|
|
\fR+\fR
|
|
Means that the preceding symbol (or group of symbols) may appear
|
|
one or more times.
|
|
.PP
|
|
Parentheses may be used to group symbols together.
|
|
For clarity,
|
|
we will use single quotes
|
|
('')
|
|
to designate what is a verbatim character string (as opposed to a symbol name).
|
|
.SS "Aliases"
|
|
There are four kinds of aliases:
|
|
\fRUser_Alias\fR,
|
|
\fRRunas_Alias\fR,
|
|
\fRHost_Alias\fR
|
|
and
|
|
\fRCmnd_Alias\fR.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
Alias ::= 'User_Alias' User_Alias (':' User_Alias)* |
|
|
'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
|
|
'Host_Alias' Host_Alias (':' Host_Alias)* |
|
|
'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)*
|
|
|
|
User_Alias ::= NAME '=' User_List
|
|
|
|
Runas_Alias ::= NAME '=' Runas_List
|
|
|
|
Host_Alias ::= NAME '=' Host_List
|
|
|
|
Cmnd_Alias ::= NAME '=' Cmnd_List
|
|
|
|
NAME ::= [A-Z]([A-Z][0-9]_)*
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Each
|
|
\fIalias\fR
|
|
definition is of the form
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
Alias_Type NAME = item1, item2, ...
|
|
.RE
|
|
.fi
|
|
.PP
|
|
where
|
|
\fIAlias_Type\fR
|
|
is one of
|
|
\fRUser_Alias\fR,
|
|
\fRRunas_Alias\fR,
|
|
\fRHost_Alias\fR,
|
|
or
|
|
\fRCmnd_Alias\fR.
|
|
A
|
|
\fRNAME\fR
|
|
is a string of uppercase letters, numbers,
|
|
and underscore characters
|
|
(\(oq_\(cq).
|
|
A
|
|
\fRNAME\fR
|
|
\fBmust\fR
|
|
start with an
|
|
uppercase letter.
|
|
It is possible to put several alias definitions
|
|
of the same type on a single line, joined by a colon
|
|
(\(oq:\&\(cq).
|
|
E.g.,
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
|
|
.RE
|
|
.fi
|
|
.PP
|
|
It is a syntax error to redefine an existing
|
|
\fIalias\fR.
|
|
It is possible to use the same name for
|
|
\fIaliases\fR
|
|
of different types, but this is not recommended.
|
|
.PP
|
|
The definitions of what constitutes a valid
|
|
\fIalias\fR
|
|
member follow.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
User_List ::= User |
|
|
User ',' User_List
|
|
|
|
User ::= '!'* user name |
|
|
'!'* #uid |
|
|
'!'* %group |
|
|
'!'* %#gid |
|
|
'!'* +netgroup |
|
|
'!'* %:nonunix_group |
|
|
'!'* %:#nonunix_gid |
|
|
'!'* User_Alias
|
|
.RE
|
|
.fi
|
|
.PP
|
|
A
|
|
\fRUser_List\fR
|
|
is made up of one or more user names, user IDs
|
|
(prefixed with
|
|
\(oq#\(cq),
|
|
system group names and IDs (prefixed with
|
|
\(oq%\(cq
|
|
and
|
|
\(oq%#\(cq
|
|
respectively), netgroups (prefixed with
|
|
\(oq+\(cq),
|
|
non-Unix group names and IDs (prefixed with
|
|
\(oq%:\(cq
|
|
and
|
|
\(oq%:#\(cq
|
|
respectively) and
|
|
\fRUser_Alias\fRes.
|
|
Each list item may be prefixed with zero or more
|
|
\(oq\&!\(cq
|
|
operators.
|
|
An odd number of
|
|
\(oq\&!\(cq
|
|
operators negate the value of
|
|
the item; an even number just cancel each other out.
|
|
User netgroups are matched using the user and domain members only;
|
|
the host member is not used when matching.
|
|
.PP
|
|
A
|
|
\fRuser name\fR,
|
|
\fRuid\fR,
|
|
\fRgroup\fR,
|
|
\fRgid\fR,
|
|
\fRnetgroup\fR,
|
|
\fRnonunix_group\fR
|
|
or
|
|
\fRnonunix_gid\fR
|
|
may be enclosed in double quotes to avoid the
|
|
need for escaping special characters.
|
|
Alternately, special characters
|
|
may be specified in escaped hex mode, e.g.\& \ex20 for space.
|
|
When
|
|
using double quotes, any prefix characters must be included inside
|
|
the quotes.
|
|
.PP
|
|
The actual
|
|
\fRnonunix_group\fR
|
|
and
|
|
\fRnonunix_gid\fR
|
|
syntax depends on
|
|
the underlying group provider plugin.
|
|
For instance, the QAS AD plugin supports the following formats:
|
|
.TP 6n
|
|
\fB\(bu\fR
|
|
Group in the same domain: "%:Group Name"
|
|
.TP 6n
|
|
\fB\(bu\fR
|
|
Group in any domain: "%:Group Name@FULLY.QUALIFIED.DOMAIN"
|
|
.TP 6n
|
|
\fB\(bu\fR
|
|
Group SID: "%:S-1-2-34-5678901234-5678901234-5678901234-567"
|
|
.PP
|
|
See
|
|
\fIGROUP PROVIDER PLUGINS\fR
|
|
for more information.
|
|
.PP
|
|
Note that quotes around group names are optional.
|
|
Unquoted strings must use a backslash
|
|
(\(oq\e\(cq)
|
|
to escape spaces and special characters.
|
|
See
|
|
\fIOther special characters and reserved words\fR
|
|
for a list of
|
|
characters that need to be escaped.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
Runas_List ::= Runas_Member |
|
|
Runas_Member ',' Runas_List
|
|
|
|
Runas_Member ::= '!'* user name |
|
|
'!'* #uid |
|
|
'!'* %group |
|
|
'!'* %#gid |
|
|
'!'* %:nonunix_group |
|
|
'!'* %:#nonunix_gid |
|
|
'!'* +netgroup |
|
|
'!'* Runas_Alias
|
|
.RE
|
|
.fi
|
|
.PP
|
|
A
|
|
\fRRunas_List\fR
|
|
is similar to a
|
|
\fRUser_List\fR
|
|
except that instead
|
|
of
|
|
\fRUser_Alias\fRes
|
|
it can contain
|
|
\fRRunas_Alias\fRes.
|
|
Note that
|
|
user names and groups are matched as strings.
|
|
In other words, two
|
|
users (groups) with the same uid (gid) are considered to be distinct.
|
|
If you wish to match all user names with the same uid (e.g.\&
|
|
root and toor), you can use a uid instead (#0 in the example given).
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
Host_List ::= Host |
|
|
Host ',' Host_List
|
|
|
|
Host ::= '!'* host name |
|
|
'!'* ip_addr |
|
|
'!'* network(/netmask)? |
|
|
'!'* +netgroup |
|
|
'!'* Host_Alias
|
|
.RE
|
|
.fi
|
|
.PP
|
|
A
|
|
\fRHost_List\fR
|
|
is made up of one or more host names, IP addresses,
|
|
network numbers, netgroups (prefixed with
|
|
\(oq+\(cq)
|
|
and other aliases.
|
|
Again, the value of an item may be negated with the
|
|
\(oq\&!\(cq
|
|
operator.
|
|
Host netgroups are matched using the host (both qualified and unqualified)
|
|
and domain members only; the user member is not used when matching.
|
|
If you specify a network number without a netmask,
|
|
\fBsudo\fR
|
|
will query each of the local host's network interfaces and,
|
|
if the network number corresponds to one of the hosts's network
|
|
interfaces, will use the netmask of that interface.
|
|
The netmask may be specified either in standard IP address notation
|
|
(e.g.\& 255.255.255.0 or ffff:ffff:ffff:ffff::),
|
|
or CIDR notation (number of bits, e.g.\& 24 or 64).
|
|
A host name may include shell-style wildcards (see the
|
|
\fIWildcards\fR
|
|
section below),
|
|
but unless the
|
|
\fRhost name\fR
|
|
command on your machine returns the fully
|
|
qualified host name, you'll need to use the
|
|
\fIfqdn\fR
|
|
option for wildcards to be useful.
|
|
Note that
|
|
\fBsudo\fR
|
|
only inspects actual network interfaces; this means that IP address
|
|
127.0.0.1 (localhost) will never match.
|
|
Also, the host name
|
|
\(Lqlocalhost\(Rq
|
|
will only match if that is the actual host name, which is usually
|
|
only the case for non-networked systems.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
digest ::= [A-Fa-f0-9]+ |
|
|
[[A-Za-z0-9\+/=]+
|
|
|
|
Digest_Spec ::= "sha224" ':' digest |
|
|
"sha256" ':' digest |
|
|
"sha384" ':' digest |
|
|
"sha512" ':' digest
|
|
|
|
Cmnd_List ::= Cmnd |
|
|
Cmnd ',' Cmnd_List
|
|
|
|
command name ::= file name |
|
|
file name args |
|
|
file name '""'
|
|
|
|
Cmnd ::= Digest_Spec? '!'* command name |
|
|
'!'* directory |
|
|
'!'* "sudoedit" |
|
|
'!'* Cmnd_Alias
|
|
.RE
|
|
.fi
|
|
.PP
|
|
A
|
|
\fRCmnd_List\fR
|
|
is a list of one or more command names, directories, and other aliases.
|
|
A command name is a fully qualified file name which may include
|
|
shell-style wildcards (see the
|
|
\fIWildcards\fR
|
|
section below).
|
|
A simple file name allows the user to run the command with any
|
|
arguments he/she wishes.
|
|
However, you may also specify command line arguments (including
|
|
wildcards).
|
|
Alternately, you can specify
|
|
\fR\&""\fR
|
|
to indicate that the command
|
|
may only be run
|
|
\fBwithout\fR
|
|
command line arguments.
|
|
A directory is a
|
|
fully qualified path name ending in a
|
|
\(oq/\(cq.
|
|
When you specify a directory in a
|
|
\fRCmnd_List\fR,
|
|
the user will be able to run any file within that directory
|
|
(but not in any sub-directories therein).
|
|
.PP
|
|
If a
|
|
\fRCmnd\fR
|
|
has associated command line arguments, then the arguments
|
|
in the
|
|
\fRCmnd\fR
|
|
must match exactly those given by the user on the command line
|
|
(or match the wildcards if there are any).
|
|
Note that the following characters must be escaped with a
|
|
\(oq\e\(cq
|
|
if they are used in command arguments:
|
|
\(oq,\&\(cq,
|
|
\(oq:\&\(cq,
|
|
\(oq=\&\(cq,
|
|
\(oq\e\(cq.
|
|
The built-in command
|
|
\(Lq\fRsudoedit\fR\(Rq
|
|
is used to permit a user to run
|
|
\fBsudo\fR
|
|
with the
|
|
\fB\-e\fR
|
|
option (or as
|
|
\fBsudoedit\fR).
|
|
It may take command line arguments just as a normal command does.
|
|
Note that
|
|
\(Lq\fRsudoedit\fR\(Rq
|
|
is a command built into
|
|
\fBsudo\fR
|
|
itself and must be specified in the
|
|
\fIsudoers\fR
|
|
file without a leading path.
|
|
.PP
|
|
If a
|
|
\fRcommand name\fR
|
|
is prefixed with a
|
|
\fRDigest_Spec\fR,
|
|
the command will only match successfully if it can be verified
|
|
using the specified SHA-2 digest.
|
|
The following digest formats are supported: sha224, sha256, sha384 and sha512.
|
|
The string may be specified in either hex or base64 format
|
|
(base64 is more compact).
|
|
There are several utilities capable of generating SHA-2 digests in hex
|
|
format such as openssl, shasum, sha224sum, sha256sum, sha384sum, sha512sum.
|
|
.PP
|
|
For example, using openssl:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
$ openssl dgst -sha224 /bin/ls
|
|
SHA224(/bin/ls)= 118187da8364d490b4a7debbf483004e8f3e053ec954309de2c41a25
|
|
.RE
|
|
.fi
|
|
.PP
|
|
It is also possible to use openssl to generate base64 output:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
$ openssl dgst -binary -sha224 /bin/ls | openssl base64
|
|
EYGH2oNk1JC0p9679IMATo8+BT7JVDCd4sQaJQ==
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Warning, if the user has write access to the command itself (directly or via a
|
|
\fBsudo\fR
|
|
command), it may be possible for the user to replace the command after the
|
|
digest check has been performed but before the command is executed.
|
|
A similar race condition exists on systems that lack the
|
|
fexecve(2)
|
|
system call when the directory in which the command is located
|
|
is writable by the user.
|
|
.PP
|
|
Command digests are only supported by version 1.8.7 or higher.
|
|
.SS "Defaults"
|
|
Certain configuration options may be changed from their default
|
|
values at run-time via one or more
|
|
\fRDefault_Entry\fR
|
|
lines.
|
|
These may affect all users on any host, all users on a specific host, a
|
|
specific user, a specific command, or commands being run as a specific user.
|
|
Note that per-command entries may not include command line arguments.
|
|
If you need to specify arguments, define a
|
|
\fRCmnd_Alias\fR
|
|
and reference
|
|
that instead.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
Default_Type ::= 'Defaults' |
|
|
'Defaults' '@' Host_List |
|
|
'Defaults' ':' User_List |
|
|
'Defaults' '!' Cmnd_List |
|
|
'Defaults' '>' Runas_List
|
|
|
|
Default_Entry ::= Default_Type Parameter_List
|
|
|
|
Parameter_List ::= Parameter |
|
|
Parameter ',' Parameter_List
|
|
|
|
Parameter ::= Parameter '=' Value |
|
|
Parameter '+=' Value |
|
|
Parameter '-=' Value |
|
|
'!'* Parameter
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Parameters may be
|
|
\fBflags\fR,
|
|
\fBinteger\fR
|
|
values,
|
|
\fBstrings\fR,
|
|
or
|
|
\fBlists\fR.
|
|
Flags are implicitly boolean and can be turned off via the
|
|
\(oq\&!\(cq
|
|
operator.
|
|
Some integer, string and list parameters may also be
|
|
used in a boolean context to disable them.
|
|
Values may be enclosed
|
|
in double quotes
|
|
(\&"")
|
|
when they contain multiple words.
|
|
Special characters may be escaped with a backslash
|
|
(\(oq\e\(cq).
|
|
.PP
|
|
Lists have two additional assignment operators,
|
|
\fR+=\fR
|
|
and
|
|
\fR-=\fR.
|
|
These operators are used to add to and delete from a list respectively.
|
|
It is not an error to use the
|
|
\fR-=\fR
|
|
operator to remove an element
|
|
that does not exist in a list.
|
|
.PP
|
|
Defaults entries are parsed in the following order: generic, host,
|
|
user and runas Defaults first, then command defaults.
|
|
If there are multiple Defaults settings of the same type, the last
|
|
matching setting is used.
|
|
The following Defaults settings are parsed before all others since
|
|
they may affect subsequent entries:
|
|
\fIfqdn\fR,
|
|
\fIgroup_plugin\fR,
|
|
\fIrunas_default\fR,
|
|
\fIsudoers_locale\fR.
|
|
.PP
|
|
See
|
|
\fISUDOERS OPTIONS\fR
|
|
for a list of supported Defaults parameters.
|
|
.SS "User specification"
|
|
.nf
|
|
.RS 0n
|
|
User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \e
|
|
(':' Host_List '=' Cmnd_Spec_List)*
|
|
|
|
Cmnd_Spec_List ::= Cmnd_Spec |
|
|
Cmnd_Spec ',' Cmnd_Spec_List
|
|
|
|
Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Solaris_Priv_Spec? Tag_Spec* Cmnd
|
|
|
|
Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'
|
|
|
|
SELinux_Spec ::= ('ROLE=role' | 'TYPE=type')
|
|
|
|
Solaris_Priv_Spec ::= ('PRIVS=privset' | 'LIMITPRIVS=privset')
|
|
|
|
Tag_Spec ::= ('EXEC:' | 'NOEXEC:' | 'FOLLOW:' | 'NOFOLLOW' |
|
|
'LOG_INPUT:' | 'NOLOG_INPUT:' | 'LOG_OUTPUT:' |
|
|
'NOLOG_OUTPUT:' | 'MAIL:' | 'NOMAIL:' | 'PASSWD:' |
|
|
'NOPASSWD:' | 'SETENV:' | 'NOSETENV:')
|
|
.RE
|
|
.fi
|
|
.PP
|
|
A
|
|
\fBuser specification\fR
|
|
determines which commands a user may run
|
|
(and as what user) on specified hosts.
|
|
By default, commands are
|
|
run as
|
|
\fBroot\fR,
|
|
but this can be changed on a per-command basis.
|
|
.PP
|
|
The basic structure of a user specification is
|
|
\(Lqwho where = (as_whom) what\(Rq.
|
|
Let's break that down into its constituent parts:
|
|
.SS "Runas_Spec"
|
|
A
|
|
\fRRunas_Spec\fR
|
|
determines the user and/or the group that a command
|
|
may be run as.
|
|
A fully-specified
|
|
\fRRunas_Spec\fR
|
|
consists of two
|
|
\fRRunas_List\fRs
|
|
(as defined above) separated by a colon
|
|
(\(oq:\&\(cq)
|
|
and enclosed in a set of parentheses.
|
|
The first
|
|
\fRRunas_List\fR
|
|
indicates
|
|
which users the command may be run as via
|
|
\fBsudo\fR's
|
|
\fB\-u\fR
|
|
option.
|
|
The second defines a list of groups that can be specified via
|
|
\fBsudo\fR's
|
|
\fB\-g\fR
|
|
option.
|
|
If both
|
|
\fRRunas_List\fRs
|
|
are specified, the command may be run with any combination of users
|
|
and groups listed in their respective
|
|
\fRRunas_List\fRs.
|
|
If only the first is specified, the command may be run as any user
|
|
in the list but no
|
|
\fB\-g\fR
|
|
option
|
|
may be specified.
|
|
If the first
|
|
\fRRunas_List\fR
|
|
is empty but the
|
|
second is specified, the command may be run as the invoking user
|
|
with the group set to any listed in the
|
|
\fRRunas_List\fR.
|
|
If both
|
|
\fRRunas_List\fRs
|
|
are empty, the command may only be run as the invoking user.
|
|
If no
|
|
\fRRunas_Spec\fR
|
|
is specified the command may be run as
|
|
\fBroot\fR
|
|
and
|
|
no group may be specified.
|
|
.PP
|
|
A
|
|
\fRRunas_Spec\fR
|
|
sets the default for the commands that follow it.
|
|
What this means is that for the entry:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The user
|
|
\fBdgb\fR
|
|
may run
|
|
\fI/bin/ls\fR,
|
|
\fI/bin/kill\fR,
|
|
and
|
|
\fI/usr/bin/lprm\fR\(embut
|
|
only as
|
|
\fBoperator\fR.
|
|
E.g.,
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
$ sudo -u operator /bin/ls
|
|
.RE
|
|
.fi
|
|
.PP
|
|
It is also possible to override a
|
|
\fRRunas_Spec\fR
|
|
later on in an entry.
|
|
If we modify the entry like so:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Then user
|
|
\fBdgb\fR
|
|
is now allowed to run
|
|
\fI/bin/ls\fR
|
|
as
|
|
\fBoperator\fR,
|
|
but
|
|
\fI/bin/kill\fR
|
|
and
|
|
\fI/usr/bin/lprm\fR
|
|
as
|
|
\fBroot\fR.
|
|
.PP
|
|
We can extend this to allow
|
|
\fBdgb\fR
|
|
to run
|
|
\fR/bin/ls\fR
|
|
with either
|
|
the user or group set to
|
|
\fBoperator\fR:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
dgb boulder = (operator : operator) /bin/ls, (root) /bin/kill,\e
|
|
/usr/bin/lprm
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Note that while the group portion of the
|
|
\fRRunas_Spec\fR
|
|
permits the
|
|
user to run as command with that group, it does not force the user
|
|
to do so.
|
|
If no group is specified on the command line, the command
|
|
will run with the group listed in the target user's password database
|
|
entry.
|
|
The following would all be permitted by the sudoers entry above:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
$ sudo -u operator /bin/ls
|
|
$ sudo -u operator -g operator /bin/ls
|
|
$ sudo -g operator /bin/ls
|
|
.RE
|
|
.fi
|
|
.PP
|
|
In the following example, user
|
|
\fBtcm\fR
|
|
may run commands that access
|
|
a modem device file with the dialer group.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
tcm boulder = (:dialer) /usr/bin/tip, /usr/bin/cu,\e
|
|
/usr/local/bin/minicom
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Note that in this example only the group will be set, the command
|
|
still runs as user
|
|
\fBtcm\fR.
|
|
E.g.\&
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
$ sudo -g dialer /usr/bin/cu
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Multiple users and groups may be present in a
|
|
\fRRunas_Spec\fR,
|
|
in which case the user may select any combination of users and groups via the
|
|
\fB\-u\fR
|
|
and
|
|
\fB\-g\fR
|
|
options.
|
|
In this example:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
alan ALL = (root, bin : operator, system) ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
user
|
|
\fBalan\fR
|
|
may run any command as either user root or bin,
|
|
optionally setting the group to operator or system.
|
|
.SS "SELinux_Spec"
|
|
On systems with SELinux support,
|
|
\fIsudoers\fR
|
|
file entries may optionally have an SELinux role and/or type associated
|
|
with a command.
|
|
If a role or
|
|
type is specified with the command it will override any default values
|
|
specified in
|
|
\fIsudoers\fR.
|
|
A role or type specified on the command line,
|
|
however, will supersede the values in
|
|
\fIsudoers\fR.
|
|
.SS "Solaris_Priv_Spec"
|
|
On Solaris systems,
|
|
\fIsudoers\fR
|
|
file entries may optionally specify Solaris privilege set and/or limit
|
|
privilege set associated with a command.
|
|
If privileges or limit privileges are specified with the command
|
|
it will override any default values specified in
|
|
\fIsudoers\fR.
|
|
.PP
|
|
A privilege set is a comma-separated list of privilege names.
|
|
The
|
|
ppriv(1)
|
|
command can be used to list all privileges known to the system.
|
|
For example:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
$ ppriv -l
|
|
.RE
|
|
.fi
|
|
.PP
|
|
In addition, there are several
|
|
\(Lqspecial\(Rq
|
|
privilege strings:
|
|
.TP 10n
|
|
none
|
|
the empty set
|
|
.TP 10n
|
|
all
|
|
the set of all privileges
|
|
.TP 10n
|
|
zone
|
|
the set of all privileges available in the current zone
|
|
.TP 10n
|
|
basic
|
|
the default set of privileges normal users are granted at login time
|
|
.PP
|
|
Privileges can be excluded from a set by prefixing the privilege
|
|
name with either an
|
|
\(oq\&!\(cq
|
|
or
|
|
\(oq\-\(cq
|
|
character.
|
|
.SS "Tag_Spec"
|
|
A command may have zero or more tags associated with it.
|
|
The following tag values are supported:
|
|
\fREXEC\fR,
|
|
\fRNOEXEC\fR,
|
|
\fRFOLLOW\fR,
|
|
\fRNOFOLLOW\fR,
|
|
\fRLOG_INPUT\fR,
|
|
\fRNOLOG_INPUT\fR,
|
|
\fRLOG_OUTPUT\fR,
|
|
\fRNOLOG_OUTPUT\fR,
|
|
\fRMAIL\fR,
|
|
\fRNOMAIL\fR,
|
|
\fRPASSWD\fR,
|
|
\fRNOPASSWD\fR,
|
|
\fRSETENV\fR,
|
|
and
|
|
\fRNOSETENV\fR.
|
|
Once a tag is set on a
|
|
\fRCmnd\fR,
|
|
subsequent
|
|
\fRCmnd\fRs
|
|
in the
|
|
\fRCmnd_Spec_List\fR,
|
|
inherit the tag unless it is overridden by the opposite tag (in other words,
|
|
\fRPASSWD\fR
|
|
overrides
|
|
\fRNOPASSWD\fR
|
|
and
|
|
\fRNOEXEC\fR
|
|
overrides
|
|
\fREXEC\fR).
|
|
.TP 2n
|
|
\fIEXEC\fR and \fINOEXEC\fR
|
|
.sp
|
|
If
|
|
\fBsudo\fR
|
|
has been compiled with
|
|
\fInoexec\fR
|
|
support and the underlying operating system supports it, the
|
|
\fRNOEXEC\fR
|
|
tag can be used to prevent a dynamically-linked executable from
|
|
running further commands itself.
|
|
.sp
|
|
In the following example, user
|
|
\fBaaron\fR
|
|
may run
|
|
\fI/usr/bin/more\fR
|
|
and
|
|
\fI/usr/bin/vi\fR
|
|
but shell escapes will be disabled.
|
|
.nf
|
|
.sp
|
|
.RS 2n
|
|
aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
|
|
.RE
|
|
.fi
|
|
.RS 2n
|
|
.sp
|
|
See the
|
|
\fIPreventing shell escapes\fR
|
|
section below for more details on how
|
|
\fRNOEXEC\fR
|
|
works and whether or not it will work on your system.
|
|
.RE
|
|
.TP 2n
|
|
\fIFOLLOW\fR and \fINOFOLLOW\fR
|
|
Starting with version 1.8.15,
|
|
\fBsudoedit\fR
|
|
will not open a file that is a symbolic link unless the
|
|
\fIsudoedit_follow\fR
|
|
option is enabled.
|
|
The
|
|
\fIFOLLOW\fR
|
|
and
|
|
\fINOFOLLOW\fR
|
|
tags override the value of
|
|
\fIsudoedit_follow\fR
|
|
and can be used to permit (or deny) the editing of symbolic links
|
|
on a per-command basis.
|
|
These tags are only effective for the
|
|
\fIsudoedit\fR
|
|
command and are ignored for all other commands.
|
|
.TP 2n
|
|
\fILOG_INPUT\fR and \fINOLOG_INPUT\fR
|
|
.sp
|
|
These tags override the value of the
|
|
\fIlog_input\fR
|
|
option on a per-command basis.
|
|
For more information, see the description of
|
|
\fIlog_input\fR
|
|
in the
|
|
\fISUDOERS OPTIONS\fR
|
|
section below.
|
|
.TP 2n
|
|
\fILOG_OUTPUT\fR and \fINOLOG_OUTPUT\fR
|
|
.sp
|
|
These tags override the value of the
|
|
\fIlog_output\fR
|
|
option on a per-command basis.
|
|
For more information, see the description of
|
|
\fIlog_output\fR
|
|
in the
|
|
\fISUDOERS OPTIONS\fR
|
|
section below.
|
|
.TP 2n
|
|
\fIMAIL\fR and \fINOMAIL\fR
|
|
.sp
|
|
These tags provide fine-grained control over whether
|
|
mail will be sent when a user runs a command by
|
|
overriding the value of the
|
|
\fImail_all_cmnds\fR
|
|
option on a per-command basis.
|
|
They have no effect when
|
|
\fBsudo\fR
|
|
is run with the
|
|
\fB\-l\fR
|
|
or
|
|
\fB\-v\fR
|
|
options.
|
|
A
|
|
\fINOMAIL\fR
|
|
tag will also override the
|
|
\fImail_always\fR
|
|
and
|
|
\fImail_no_perms\fR
|
|
options.
|
|
For more information, see the descriptions of
|
|
\fImail_all_cmnds\fR,
|
|
\fImail_always\fR,
|
|
and
|
|
\fImail_no_perms\fR
|
|
in the
|
|
\fISUDOERS OPTIONS\fR
|
|
section below.
|
|
.TP 2n
|
|
\fIPASSWD\fR and \fINOPASSWD\fR
|
|
.sp
|
|
By default,
|
|
\fBsudo\fR
|
|
requires that a user authenticate him or herself
|
|
before running a command.
|
|
This behavior can be modified via the
|
|
\fRNOPASSWD\fR
|
|
tag.
|
|
Like a
|
|
\fRRunas_Spec\fR,
|
|
the
|
|
\fRNOPASSWD\fR
|
|
tag sets
|
|
a default for the commands that follow it in the
|
|
\fRCmnd_Spec_List\fR.
|
|
Conversely, the
|
|
\fRPASSWD\fR
|
|
tag can be used to reverse things.
|
|
For example:
|
|
.nf
|
|
.sp
|
|
.RS 2n
|
|
ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
|
|
.RE
|
|
.fi
|
|
.RS 2n
|
|
.sp
|
|
would allow the user
|
|
\fBray\fR
|
|
to run
|
|
\fI/bin/kill\fR,
|
|
\fI/bin/ls\fR,
|
|
and
|
|
\fI/usr/bin/lprm\fR
|
|
as
|
|
\fBroot\fR
|
|
on the machine rushmore without authenticating himself.
|
|
If we only want
|
|
\fBray\fR
|
|
to be able to
|
|
run
|
|
\fI/bin/kill\fR
|
|
without a password the entry would be:
|
|
.nf
|
|
.sp
|
|
.RS 2n
|
|
ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
|
|
.RE
|
|
.fi
|
|
.sp
|
|
Note, however, that the
|
|
\fRPASSWD\fR
|
|
tag has no effect on users who are in the group specified by the
|
|
\fIexempt_group\fR
|
|
option.
|
|
.sp
|
|
By default, if the
|
|
\fRNOPASSWD\fR
|
|
tag is applied to any of the entries for a user on the current host,
|
|
he or she will be able to run
|
|
\(Lq\fRsudo -l\fR\(Rq
|
|
without a password.
|
|
Additionally, a user may only run
|
|
\(Lq\fRsudo -v\fR\(Rq
|
|
without a password if the
|
|
\fRNOPASSWD\fR
|
|
tag is present for all a user's entries that pertain to the current host.
|
|
This behavior may be overridden via the
|
|
\fIverifypw\fR
|
|
and
|
|
\fIlistpw\fR
|
|
options.
|
|
.RE
|
|
.TP 2n
|
|
\fISETENV\fR and \fINOSETENV\fR
|
|
.sp
|
|
These tags override the value of the
|
|
\fIsetenv\fR
|
|
option on a per-command basis.
|
|
Note that if
|
|
\fRSETENV\fR
|
|
has been set for a command, the user may disable the
|
|
\fIenv_reset\fR
|
|
option from the command line via the
|
|
\fB\-E\fR
|
|
option.
|
|
Additionally, environment variables set on the command
|
|
line are not subject to the restrictions imposed by
|
|
\fIenv_check\fR,
|
|
\fIenv_delete\fR,
|
|
or
|
|
\fIenv_keep\fR.
|
|
As such, only trusted users should be allowed to set variables in this manner.
|
|
If the command matched is
|
|
\fBALL\fR,
|
|
the
|
|
\fRSETENV\fR
|
|
tag is implied for that command; this default may be overridden by use of the
|
|
\fRNOSETENV\fR
|
|
tag.
|
|
.SS "Wildcards"
|
|
\fBsudo\fR
|
|
allows shell-style
|
|
\fIwildcards\fR
|
|
(aka meta or glob characters)
|
|
to be used in host names, path names and command line arguments in the
|
|
\fIsudoers\fR
|
|
file.
|
|
Wildcard matching is done via the
|
|
glob(3)
|
|
and
|
|
fnmatch(3)
|
|
functions as specified by
|
|
IEEE Std 1003.1 (\(LqPOSIX.1\(Rq).
|
|
.TP 10n
|
|
\fR*\fR
|
|
Matches any set of zero or more characters (including white space).
|
|
.TP 10n
|
|
\fR\&?\fR
|
|
Matches any single character (including white space).
|
|
.TP 10n
|
|
\fR[...]\fR
|
|
Matches any character in the specified range.
|
|
.TP 10n
|
|
\fR[!...]\fR
|
|
Matches any character
|
|
\fInot\fR
|
|
in the specified range.
|
|
.TP 10n
|
|
\fR\ex\fR
|
|
For any character
|
|
\(oqx\(cq,
|
|
evaluates to
|
|
\(oqx\(cq.
|
|
This is used to escape special characters such as:
|
|
\(oq*\(cq,
|
|
\(oq\&?\(cq,
|
|
\(oq[\&\(cq,
|
|
and
|
|
\(oq]\&\(cq.
|
|
.PP
|
|
\fBNote that these are not regular expressions.\fR
|
|
Unlike a regular expression there is no way to match one or more
|
|
characters within a range.
|
|
.PP
|
|
Character classes may be used if your system's
|
|
glob(3)
|
|
and
|
|
fnmatch(3)
|
|
functions support them.
|
|
However, because the
|
|
\(oq:\&\(cq
|
|
character has special meaning in
|
|
\fIsudoers\fR,
|
|
it must be
|
|
escaped.
|
|
For example:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
/bin/ls [[\e:\&alpha\e:\&]]*
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Would match any file name beginning with a letter.
|
|
.PP
|
|
Note that a forward slash
|
|
(\(oq/\(cq)
|
|
will
|
|
\fInot\fR
|
|
be matched by
|
|
wildcards used in the file name portion of the command.
|
|
This is to make a path like:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
/usr/bin/*
|
|
.RE
|
|
.fi
|
|
.PP
|
|
match
|
|
\fI/usr/bin/who\fR
|
|
but not
|
|
\fI/usr/bin/X11/xterm\fR.
|
|
.PP
|
|
When matching the command line arguments, however, a slash
|
|
\fIdoes\fR
|
|
get matched by wildcards since command line arguments may contain
|
|
arbitrary strings and not just path names.
|
|
.PP
|
|
\fBWildcards in command line arguments should be used with care.\fR
|
|
.br
|
|
Command line arguments are matched as a single, concatenated string.
|
|
This mean a wildcard character such as
|
|
\(oq\&?\(cq
|
|
or
|
|
\(oq*\(cq
|
|
will match across word boundaries, which may be unexpected.
|
|
For example, while a sudoers entry like:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
%operator ALL = /bin/cat /var/log/messages*
|
|
.RE
|
|
.fi
|
|
.PP
|
|
will allow command like:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
$ sudo cat /var/log/messages.1
|
|
.RE
|
|
.fi
|
|
.PP
|
|
It will also allow:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
$ sudo cat /var/log/messages /etc/shadow
|
|
.RE
|
|
.fi
|
|
.PP
|
|
which is probably not what was intended.
|
|
In most cases it is better to do command line processing
|
|
outside of the
|
|
\fIsudoers\fR
|
|
file in a scripting language.
|
|
.SS "Exceptions to wildcard rules"
|
|
The following exceptions apply to the above rules:
|
|
.TP 10n
|
|
\fR\&""\fR
|
|
If the empty string
|
|
\fR\&""\fR
|
|
is the only command line argument in the
|
|
\fIsudoers\fR
|
|
file entry it means that command is not allowed to be run with
|
|
\fIany\fR
|
|
arguments.
|
|
.TP 10n
|
|
sudoedit
|
|
Command line arguments to the
|
|
\fIsudoedit\fR
|
|
built-in command should always be path names, so a forward slash
|
|
(\(oq/\(cq)
|
|
will not be matched by a wildcard.
|
|
.SS "Including other files from within sudoers"
|
|
It is possible to include other
|
|
\fIsudoers\fR
|
|
files from within the
|
|
\fIsudoers\fR
|
|
file currently being parsed using the
|
|
\fR#include\fR
|
|
and
|
|
\fR#includedir\fR
|
|
directives.
|
|
.PP
|
|
This can be used, for example, to keep a site-wide
|
|
\fIsudoers\fR
|
|
file in addition to a local, per-machine file.
|
|
For the sake of this example the site-wide
|
|
\fIsudoers\fR
|
|
file will be
|
|
\fI/etc/sudoers\fR
|
|
and the per-machine one will be
|
|
\fI/etc/sudoers.local\fR.
|
|
To include
|
|
\fI/etc/sudoers.local\fR
|
|
from within
|
|
\fI/etc/sudoers\fR
|
|
we would use the
|
|
following line in
|
|
\fI/etc/sudoers\fR:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
#include /etc/sudoers.local
|
|
.RE
|
|
.fi
|
|
.PP
|
|
When
|
|
\fBsudo\fR
|
|
reaches this line it will suspend processing of the current file
|
|
(\fI/etc/sudoers\fR)
|
|
and switch to
|
|
\fI/etc/sudoers.local\fR.
|
|
Upon reaching the end of
|
|
\fI/etc/sudoers.local\fR,
|
|
the rest of
|
|
\fI/etc/sudoers\fR
|
|
will be processed.
|
|
Files that are included may themselves include other files.
|
|
A hard limit of 128 nested include files is enforced to prevent include
|
|
file loops.
|
|
.PP
|
|
If the path to the include file is not fully-qualified (does not
|
|
begin with a
|
|
\(oq/\(cq,
|
|
it must be located in the same directory as the sudoers file it was
|
|
included from.
|
|
For example, if
|
|
\fI/etc/sudoers\fR
|
|
contains the line:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
\fR#include sudoers.local\fR
|
|
.RE
|
|
.fi
|
|
.PP
|
|
the file that will be included is
|
|
\fI/etc/sudoers.local\fR.
|
|
.PP
|
|
The file name may also include the
|
|
\fR%h\fR
|
|
escape, signifying the short form of the host name.
|
|
In other words, if the machine's host name is
|
|
\(Lqxerxes\(Rq,
|
|
then
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
#include /etc/sudoers.%h
|
|
.RE
|
|
.fi
|
|
.PP
|
|
will cause
|
|
\fBsudo\fR
|
|
to include the file
|
|
\fI/etc/sudoers.xerxes\fR.
|
|
.PP
|
|
The
|
|
\fR#includedir\fR
|
|
directive can be used to create a
|
|
\fIsudoers.d\fR
|
|
directory that the system package manager can drop
|
|
\fIsudoers\fR
|
|
file rules into as part of package installation.
|
|
For example, given:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
#includedir /etc/sudoers.d
|
|
.RE
|
|
.fi
|
|
.PP
|
|
\fBsudo\fR
|
|
will read each file in
|
|
\fI/etc/sudoers.d\fR,
|
|
skipping file names that end in
|
|
\(oq~\(cq
|
|
or contain a
|
|
\(oq.\&\(cq
|
|
character to avoid causing problems with package manager or editor
|
|
temporary/backup files.
|
|
Files are parsed in sorted lexical order.
|
|
That is,
|
|
\fI/etc/sudoers.d/01_first\fR
|
|
will be parsed before
|
|
\fI/etc/sudoers.d/10_second\fR.
|
|
Be aware that because the sorting is lexical, not numeric,
|
|
\fI/etc/sudoers.d/1_whoops\fR
|
|
would be loaded
|
|
\fIafter\fR
|
|
\fI/etc/sudoers.d/10_second\fR.
|
|
Using a consistent number of leading zeroes in the file names can be used
|
|
to avoid such problems.
|
|
.PP
|
|
Note that unlike files included via
|
|
\fR#include\fR,
|
|
\fBvisudo\fR
|
|
will not edit the files in a
|
|
\fR#includedir\fR
|
|
directory unless one of them contains a syntax error.
|
|
It is still possible to run
|
|
\fBvisudo\fR
|
|
with the
|
|
\fB\-f\fR
|
|
flag to edit the files directly, but this will not catch the
|
|
redefinition of an
|
|
\fIalias\fR
|
|
that is also present in a different file.
|
|
.SS "Other special characters and reserved words"
|
|
The pound sign
|
|
(\(oq#\(cq)
|
|
is used to indicate a comment (unless it is part of a #include
|
|
directive or unless it occurs in the context of a user name and is
|
|
followed by one or more digits, in which case it is treated as a
|
|
uid).
|
|
Both the comment character and any text after it, up to the end of
|
|
the line, are ignored.
|
|
.PP
|
|
The reserved word
|
|
\fBALL\fR
|
|
is a built-in
|
|
\fIalias\fR
|
|
that always causes a match to succeed.
|
|
It can be used wherever one might otherwise use a
|
|
\fRCmnd_Alias\fR,
|
|
\fRUser_Alias\fR,
|
|
\fRRunas_Alias\fR,
|
|
or
|
|
\fRHost_Alias\fR.
|
|
You should not try to define your own
|
|
\fIalias\fR
|
|
called
|
|
\fBALL\fR
|
|
as the built-in alias will be used in preference to your own.
|
|
Please note that using
|
|
\fBALL\fR
|
|
can be dangerous since in a command context, it allows the user to run
|
|
\fIany\fR
|
|
command on the system.
|
|
.PP
|
|
An exclamation point
|
|
(\(oq\&!\(cq)
|
|
can be used as a logical
|
|
\fInot\fR
|
|
operator in a list or
|
|
\fIalias\fR
|
|
as well as in front of a
|
|
\fRCmnd\fR.
|
|
This allows one to exclude certain values.
|
|
For the
|
|
\(oq\&!\(cq
|
|
operator to be effective, there must be something for it to exclude.
|
|
For example, to match all users except for root one would use:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
ALL,!root
|
|
.RE
|
|
.fi
|
|
.PP
|
|
If the
|
|
\fBALL\fR,
|
|
is omitted, as in:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
!root
|
|
.RE
|
|
.fi
|
|
.PP
|
|
it would explicitly deny root but not match any other users.
|
|
This is different from a true
|
|
\(Lqnegation\(Rq
|
|
operator.
|
|
.PP
|
|
Note, however, that using a
|
|
\(oq\&!\(cq
|
|
in conjunction with the built-in
|
|
\fBALL\fR
|
|
alias to allow a user to run
|
|
\(Lqall but a few\(Rq
|
|
commands rarely works as intended (see
|
|
\fISECURITY NOTES\fR
|
|
below).
|
|
.PP
|
|
Long lines can be continued with a backslash
|
|
(\(oq\e\(cq)
|
|
as the last character on the line.
|
|
.PP
|
|
White space between elements in a list as well as special syntactic
|
|
characters in a
|
|
\fIUser Specification\fR
|
|
(\(oq=\&\(cq,
|
|
\(oq:\&\(cq,
|
|
\(oq(\&\(cq,
|
|
\(oq)\&\(cq)
|
|
is optional.
|
|
.PP
|
|
The following characters must be escaped with a backslash
|
|
(\(oq\e\(cq)
|
|
when used as part of a word (e.g.\& a user name or host name):
|
|
\(oq\&!\(cq,
|
|
\(oq=\&\(cq,
|
|
\(oq:\&\(cq,
|
|
\(oq,\&\(cq,
|
|
\(oq(\&\(cq,
|
|
\(oq)\&\(cq,
|
|
\(oq\e\(cq.
|
|
.SH "SUDOERS OPTIONS"
|
|
\fBsudo\fR's
|
|
behavior can be modified by
|
|
\fRDefault_Entry\fR
|
|
lines, as explained earlier.
|
|
A list of all supported Defaults parameters, grouped by type, are listed below.
|
|
.PP
|
|
\fBBoolean Flags\fR:
|
|
.TP 18n
|
|
always_query_group_plugin
|
|
If a
|
|
\fIgroup_plugin\fR
|
|
is configured, use it to resolve groups of the form %group as long
|
|
as there is not also a system group of the same name.
|
|
Normally, only groups of the form %:group are passed to the
|
|
\fIgroup_plugin\fR.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
always_set_home
|
|
If enabled,
|
|
\fBsudo\fR
|
|
will set the
|
|
\fRHOME\fR
|
|
environment variable to the home directory of the target user
|
|
(which is root unless the
|
|
\fB\-u\fR
|
|
option is used).
|
|
This effectively means that the
|
|
\fB\-H\fR
|
|
option is always implied.
|
|
Note that by default,
|
|
\fRHOME\fR
|
|
will be set to the home directory of the target user when the
|
|
\fIenv_reset\fR
|
|
option is enabled, so
|
|
\fIalways_set_home\fR
|
|
only has an effect for configurations where either
|
|
\fIenv_reset\fR
|
|
is disabled or
|
|
\fRHOME\fR
|
|
is present in the
|
|
\fIenv_keep\fR
|
|
list.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
authenticate
|
|
If set, users must authenticate themselves via a password (or other
|
|
means of authentication) before they may run commands.
|
|
This default may be overridden via the
|
|
\fRPASSWD\fR
|
|
and
|
|
\fRNOPASSWD\fR
|
|
tags.
|
|
This flag is
|
|
\fIon\fR
|
|
by default.
|
|
.TP 18n
|
|
closefrom_override
|
|
If set, the user may use
|
|
\fBsudo\fR's
|
|
\fB\-C\fR
|
|
option which overrides the default starting point at which
|
|
\fBsudo\fR
|
|
begins closing open file descriptors.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
compress_io
|
|
If set, and
|
|
\fBsudo\fR
|
|
is configured to log a command's input or output,
|
|
the I/O logs will be compressed using
|
|
\fBzlib\fR.
|
|
This flag is
|
|
\fIon\fR
|
|
by default when
|
|
\fBsudo\fR
|
|
is compiled with
|
|
\fBzlib\fR
|
|
support.
|
|
.TP 18n
|
|
exec_background
|
|
By default,
|
|
\fBsudo\fR
|
|
runs a command as the foreground process as long as
|
|
\fBsudo\fR
|
|
itself is running in the foreground.
|
|
When the
|
|
\fIexec_background\fR
|
|
flag is enabled and the command is being run in a pty (due to I/O logging
|
|
or the
|
|
\fIuse_pty\fR
|
|
flag), the command will be run as a background process.
|
|
Attempts to read from the controlling terminal (or to change terminal
|
|
settings) will result in the command being suspended with the
|
|
\fRSIGTTIN\fR
|
|
signal (or
|
|
\fRSIGTTOU\fR
|
|
in the case of terminal settings).
|
|
If this happens when
|
|
\fBsudo\fR
|
|
is a foreground process, the command will be granted the controlling terminal
|
|
and resumed in the foreground with no user intervention required.
|
|
The advantage of initially running the command in the background is that
|
|
\fBsudo\fR
|
|
need not read from the terminal unless the command explicitly requests it.
|
|
Otherwise, any terminal input must be passed to the command, whether it
|
|
has required it or not (the kernel buffers terminals so it is not possible
|
|
to tell whether the command really wants the input).
|
|
This is different from historic
|
|
\fIsudo\fR
|
|
behavior or when the command is not being run in a pty.
|
|
.sp
|
|
For this to work seamlessly, the operating system must support the
|
|
automatic restarting of system calls.
|
|
Unfortunately, not all operating systems do this by default,
|
|
and even those that do may have bugs.
|
|
For example, Mac OS X fails to restart the
|
|
\fBtcgetattr\fR()
|
|
and
|
|
\fBtcsetattr\fR()
|
|
system calls (this is a bug in Mac OS X).
|
|
Furthermore, because this behavior depends on the command stopping with the
|
|
\fRSIGTTIN\fR
|
|
or
|
|
\fRSIGTTOU\fR
|
|
signals, programs that catch these signals and suspend themselves
|
|
with a different signal (usually
|
|
\fRSIGTOP\fR)
|
|
will not be automatically foregrounded.
|
|
Some versions of the linux
|
|
su(1)
|
|
command behave this way.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.sp
|
|
This setting is only supported by version 1.8.7 or higher.
|
|
It has no effect unless I/O logging is enabled or the
|
|
\fIuse_pty\fR
|
|
flag is enabled.
|
|
.TP 18n
|
|
env_editor
|
|
If set,
|
|
\fBvisudo\fR
|
|
will use the value of the
|
|
\fREDITOR\fR
|
|
or
|
|
\fRVISUAL\fR
|
|
environment variables before falling back on the default editor list.
|
|
Note that this may create a security hole as it allows the user to
|
|
run any arbitrary command as root without logging.
|
|
A safer alternative is to place a colon-separated list of editors
|
|
in the
|
|
\fReditor\fR
|
|
variable.
|
|
\fBvisudo\fR
|
|
will then only use the
|
|
\fREDITOR\fR
|
|
or
|
|
\fRVISUAL\fR
|
|
if they match a value specified in
|
|
\fReditor\fR.
|
|
If the
|
|
\fIenv_reset\fR
|
|
flag is enabled, the
|
|
\fREDITOR\fR
|
|
and/or
|
|
\fRVISUAL\fR
|
|
environment variables must be present in the
|
|
\fIenv_keep\fR
|
|
list for the
|
|
\fIenv_editor\fR
|
|
flag to function when
|
|
\fBvisudo\fR
|
|
is invoked via
|
|
\fBsudo\fR.
|
|
This flag is
|
|
\fI@env_editor@\fR
|
|
by default.
|
|
.TP 18n
|
|
env_reset
|
|
If set,
|
|
\fBsudo\fR
|
|
will run the command in a minimal environment containing the
|
|
\fRTERM\fR,
|
|
\fRPATH\fR,
|
|
\fRHOME\fR,
|
|
\fRMAIL\fR,
|
|
\fRSHELL\fR,
|
|
\fRLOGNAME\fR,
|
|
\fRUSER\fR,
|
|
\fRUSERNAME\fR
|
|
and
|
|
\fRSUDO_*\fR
|
|
variables.
|
|
Any
|
|
variables in the caller's environment that match the
|
|
\fRenv_keep\fR
|
|
and
|
|
\fRenv_check\fR
|
|
lists are then added, followed by any variables present in the file
|
|
specified by the
|
|
\fIenv_file\fR
|
|
option (if any).
|
|
The contents of the
|
|
\fRenv_keep\fR
|
|
and
|
|
\fRenv_check\fR
|
|
lists, as modified by global Defaults parameters in
|
|
\fIsudoers\fR,
|
|
are displayed when
|
|
\fBsudo\fR
|
|
is run by root with the
|
|
\fB\-V\fR
|
|
option.
|
|
If the
|
|
\fIsecure_path\fR
|
|
option is set, its value will be used for the
|
|
\fRPATH\fR
|
|
environment variable.
|
|
This flag is
|
|
\fI@env_reset@\fR
|
|
by default.
|
|
.TP 18n
|
|
fast_glob
|
|
Normally,
|
|
\fBsudo\fR
|
|
uses the
|
|
glob(3)
|
|
function to do shell-style globbing when matching path names.
|
|
However, since it accesses the file system,
|
|
glob(3)
|
|
can take a long time to complete for some patterns, especially
|
|
when the pattern references a network file system that is mounted
|
|
on demand (auto mounted).
|
|
The
|
|
\fIfast_glob\fR
|
|
option causes
|
|
\fBsudo\fR
|
|
to use the
|
|
fnmatch(3)
|
|
function, which does not access the file system to do its matching.
|
|
The disadvantage of
|
|
\fIfast_glob\fR
|
|
is that it is unable to match relative path names such as
|
|
\fI./ls\fR
|
|
or
|
|
\fI../bin/ls\fR.
|
|
This has security implications when path names that include globbing
|
|
characters are used with the negation operator,
|
|
\(oq!\&\(cq,
|
|
as such rules can be trivially bypassed.
|
|
As such, this option should not be used when the
|
|
\fIsudoers\fR
|
|
file contains rules that contain negated path names which include globbing
|
|
characters.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
fqdn
|
|
Set this flag if you want to put fully qualified host names in the
|
|
\fIsudoers\fR
|
|
file when the local host name (as returned by the
|
|
\fRhostname\fR
|
|
command) does not contain the domain name.
|
|
In other words, instead of myhost you would use myhost.mydomain.edu.
|
|
You may still use the short form if you wish (and even mix the two).
|
|
This option is only effective when the
|
|
\(Lqcanonical\(Rq
|
|
host name, as returned by the
|
|
\fBgetaddrinfo\fR()
|
|
or
|
|
\fBgethostbyname\fR()
|
|
function, is a fully-qualified domain name.
|
|
This is usually the case when the system is configured to use DNS
|
|
for host name resolution.
|
|
.sp
|
|
If the system is configured to use the
|
|
\fI/etc/hosts\fR
|
|
file in preference to DNS, the
|
|
\(Lqcanonical\(Rq
|
|
host name may not be fully-qualified.
|
|
The order that sources are queried for host name resolution
|
|
is usually specified in the
|
|
\fI@nsswitch_conf@\fR,
|
|
\fI@netsvc_conf@\fR,
|
|
\fI/etc/host.conf\fR,
|
|
or, in some cases,
|
|
\fI/etc/resolv.conf\fR
|
|
file.
|
|
In the
|
|
\fI/etc/hosts\fR
|
|
file, the first host name of the entry is considered to be the
|
|
\(Lqcanonical\(Rq
|
|
name; subsequent names are aliases that are not used by
|
|
\fBsudoers\fR.
|
|
For example, the following hosts file line for the machine
|
|
\(Lqxyzzy\(Rq
|
|
has the fully-qualified domain name as the
|
|
\(Lqcanonical\(Rq
|
|
host name, and the short version as an alias.
|
|
.sp
|
|
.RS 24n
|
|
192.168.1.1 xyzzy.sudo.ws xyzzy
|
|
.RE
|
|
.RS 18n
|
|
.sp
|
|
If the machine's hosts file entry is not formatted properly, the
|
|
\fIfqdn\fR
|
|
option will not be effective if it is queried before DNS.
|
|
.sp
|
|
Beware that when using DNS for host name resolution, turning on
|
|
\fIfqdn\fR
|
|
requires
|
|
\fBsudoers\fR
|
|
to make DNS lookups which renders
|
|
\fBsudo\fR
|
|
unusable if DNS stops working (for example if the machine is disconnected
|
|
from the network).
|
|
Also note that just like with the hosts file, you must use the
|
|
\(Lqcanonical\(Rq
|
|
name as DNS knows it.
|
|
That is, you may not use a host alias
|
|
(\fRCNAME\fR
|
|
entry)
|
|
due to performance issues and the fact that there is no way to get all
|
|
aliases from DNS.
|
|
.sp
|
|
This flag is
|
|
\fI@fqdn@\fR
|
|
by default.
|
|
.RE
|
|
.TP 18n
|
|
ignore_audit_errors
|
|
Allow commands to be run even if
|
|
\fBsudoers\fR
|
|
cannot write to the audit log.
|
|
If enabled, an audit log write failure is not treated as a fatal error.
|
|
If disabled, a command may only be run after the audit event is successfully
|
|
written.
|
|
This flag is only effective on systems for which
|
|
\fBsudoers\fR
|
|
supports audit logging, including FreeBSD, Linux, Mac OS X and Solaris.
|
|
This flag is
|
|
\fIon\fR
|
|
by default.
|
|
.TP 18n
|
|
ignore_dot
|
|
If set,
|
|
\fBsudo\fR
|
|
will ignore "." or "" (both denoting current directory) in the
|
|
\fRPATH\fR
|
|
environment variable; the
|
|
\fRPATH\fR
|
|
itself is not modified.
|
|
This flag is
|
|
\fI@ignore_dot@\fR
|
|
by default.
|
|
.TP 18n
|
|
ignore_iolog_errors
|
|
Allow commands to be run even if
|
|
\fBsudoers\fR
|
|
cannot write to the I/O log.
|
|
If enabled, an I/O log write failure is not treated as a fatal error.
|
|
If disabled, the command will be terminated if the I/O log cannot be written to.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
ignore_logfile_errors
|
|
Allow commands to be run even if
|
|
\fBsudoers\fR
|
|
cannot write to the log file.
|
|
If enabled, a log file write failure is not treated as a fatal error.
|
|
If disabled, a command may only be run after the log file entry is successfully
|
|
written.
|
|
This flag only has an effect when
|
|
\fBsudoers\fR
|
|
is configured to use file-based logging via the
|
|
\fIlogfile\fR
|
|
option.
|
|
This flag is
|
|
\fIon\fR
|
|
by default.
|
|
.TP 18n
|
|
ignore_local_sudoers
|
|
If set via LDAP, parsing of
|
|
\fI@sysconfdir@/sudoers\fR
|
|
will be skipped.
|
|
This is intended for Enterprises that wish to prevent the usage of local
|
|
sudoers files so that only LDAP is used.
|
|
This thwarts the efforts of rogue operators who would attempt to add roles to
|
|
\fI@sysconfdir@/sudoers\fR.
|
|
When this option is present,
|
|
\fI@sysconfdir@/sudoers\fR
|
|
does not even need to exist.
|
|
Since this option tells
|
|
\fBsudo\fR
|
|
how to behave when no specific LDAP entries have been matched, this
|
|
sudoOption is only meaningful for the
|
|
\fRcn=defaults\fR
|
|
section.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
insults
|
|
If set,
|
|
\fBsudo\fR
|
|
will insult users when they enter an incorrect password.
|
|
This flag is
|
|
\fI@insults@\fR
|
|
by default.
|
|
.TP 18n
|
|
log_host
|
|
If set, the host name will be logged in the (non-syslog)
|
|
\fBsudo\fR
|
|
log file.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
log_input
|
|
If set,
|
|
\fBsudo\fR
|
|
will run the command in a pseudo-tty and log all user input.
|
|
If the standard input is not connected to the user's tty, due to
|
|
I/O redirection or because the command is part of a pipeline, that
|
|
input is also captured and stored in a separate log file.
|
|
For more information, see the
|
|
\fII/O LOG FILES\fR
|
|
section.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
log_output
|
|
If set,
|
|
\fBsudo\fR
|
|
will run the command in a pseudo-tty and log all output that is sent
|
|
to the screen, similar to the
|
|
script(1)
|
|
command.
|
|
For more information, see the
|
|
\fII/O LOG FILES\fR
|
|
section.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
log_year
|
|
If set, the four-digit year will be logged in the (non-syslog)
|
|
\fBsudo\fR
|
|
log file.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
long_otp_prompt
|
|
When validating with a One Time Password (OTP) scheme such as
|
|
\fBS/Key\fR
|
|
or
|
|
\fBOPIE\fR,
|
|
a two-line prompt is used to make it easier
|
|
to cut and paste the challenge to a local window.
|
|
It's not as pretty as the default but some people find it more convenient.
|
|
This flag is
|
|
\fI@long_otp_prompt@\fR
|
|
by default.
|
|
.TP 18n
|
|
mail_all_cmnds
|
|
Send mail to the
|
|
\fImailto\fR
|
|
user every time a user attempts to run a command via
|
|
\fBsudo\fR
|
|
(this includes
|
|
\fBsudoedit\fR).
|
|
No mail will be sent if the user runs
|
|
\fBsudo\fR
|
|
with the
|
|
\fB\-l\fR
|
|
or
|
|
\fB\-v\fR
|
|
option unless there is an authentication error and the
|
|
\fImail_badpass\fR
|
|
flag is also set.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
mail_always
|
|
Send mail to the
|
|
\fImailto\fR
|
|
user every time a user runs
|
|
\fBsudo\fR.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
mail_badpass
|
|
Send mail to the
|
|
\fImailto\fR
|
|
user if the user running
|
|
\fBsudo\fR
|
|
does not enter the correct password.
|
|
If the command the user is attempting to run is not permitted by
|
|
\fBsudoers\fR
|
|
and one of the
|
|
\fImail_all_cmnds\fR,
|
|
\fImail_always\fR,
|
|
\fImail_no_host\fR,
|
|
\fImail_no_perms\fR
|
|
or
|
|
\fImail_no_user\fR
|
|
flags are set, this flag will have no effect.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
mail_no_host
|
|
If set, mail will be sent to the
|
|
\fImailto\fR
|
|
user if the invoking user exists in the
|
|
\fIsudoers\fR
|
|
file, but is not allowed to run commands on the current host.
|
|
This flag is
|
|
\fI@mail_no_host@\fR
|
|
by default.
|
|
.TP 18n
|
|
mail_no_perms
|
|
If set, mail will be sent to the
|
|
\fImailto\fR
|
|
user if the invoking user is allowed to use
|
|
\fBsudo\fR
|
|
but the command they are trying is not listed in their
|
|
\fIsudoers\fR
|
|
file entry or is explicitly denied.
|
|
This flag is
|
|
\fI@mail_no_perms@\fR
|
|
by default.
|
|
.TP 18n
|
|
mail_no_user
|
|
If set, mail will be sent to the
|
|
\fImailto\fR
|
|
user if the invoking user is not in the
|
|
\fIsudoers\fR
|
|
file.
|
|
This flag is
|
|
\fI@mail_no_user@\fR
|
|
by default.
|
|
.TP 18n
|
|
match_group_by_gid
|
|
By default, when matching groups,
|
|
\fBsudoers\fR
|
|
will first resolve all the user's group IDs to group names and then
|
|
compare those group names to any group names listed in the
|
|
\fIsudoers\fR
|
|
file.
|
|
This works well on systems where the number of groups listed in the
|
|
\fIsudoers\fR
|
|
file is larger than the number of groups a typical user belongs to.
|
|
On systems where group lookups are slow, where users may belong
|
|
to a large number of groups, and where the number of groups listed
|
|
in the
|
|
\fIsudoers\fR
|
|
file is relatively small, it may be prohibitively expensive and
|
|
running commands via
|
|
\fBsudo\fR
|
|
may take longer than normal.
|
|
On such systems it may be faster to use the
|
|
\fImatch_group_by_gid\fR
|
|
flag to avoid resolving the user's group IDs to group names and
|
|
instead resolve all group names listed in the
|
|
\fIsudoers\fR
|
|
file, matching by group ID instead of by group name.
|
|
The
|
|
\fImatch_group_by_gid\fR
|
|
flag has no effect when
|
|
\fIsudoers\fR
|
|
data is stored in LDAP.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.sp
|
|
This setting is only supported by version 1.8.18 or higher.
|
|
.TP 18n
|
|
netgroup_tuple
|
|
If set, netgroup lookups will be performed using the full netgroup
|
|
tuple: host name, user name and domain (if one is set).
|
|
Historically,
|
|
\fBsudo\fR
|
|
only matched the user name and domain for netgroups used in a
|
|
\fRUser_List\fR
|
|
and only matched the host name and domain for netgroups used in a
|
|
\fRHost_List\fR.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
noexec
|
|
If set, all commands run via
|
|
\fBsudo\fR
|
|
will behave as if the
|
|
\fRNOEXEC\fR
|
|
tag has been set, unless overridden by an
|
|
\fREXEC\fR
|
|
tag.
|
|
See the description of
|
|
\fIEXEC and NOEXEC\fR
|
|
above as well as the
|
|
\fIPreventing shell escapes\fR
|
|
section at the end of this manual.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
pam_session
|
|
On systems that use PAM for authentication,
|
|
\fBsudo\fR
|
|
will create a new PAM session for the command to be run in.
|
|
Disabling
|
|
\fIpam_session\fR
|
|
may be needed on older PAM implementations or on operating systems where
|
|
opening a PAM session changes the utmp or wtmp files.
|
|
If PAM session support is disabled, resource limits may not be updated
|
|
for the command being run.
|
|
If
|
|
\fIpam_session\fR,
|
|
\fIpam_setcred\fR,
|
|
and
|
|
\fIuse_pty\fR
|
|
are disabled and I/O logging has not been configured,
|
|
\fBsudo\fR
|
|
will execute the command directly instead of running it as a child
|
|
process.
|
|
This flag is
|
|
\fI@pam_session@\fR
|
|
by default.
|
|
.sp
|
|
This setting is only supported by version 1.8.7 or higher.
|
|
.TP 18n
|
|
pam_setcred
|
|
On systems that use PAM for authentication,
|
|
\fBsudo\fR
|
|
will attempt to establish credentials for the target user by default,
|
|
if supported by the underlying authentication system.
|
|
One example of a credential is a Kerberos ticket.
|
|
If
|
|
\fIpam_session\fR,
|
|
\fIpam_setcred\fR,
|
|
and
|
|
\fIuse_pty\fR
|
|
are disabled and I/O logging has not been configured,
|
|
\fBsudo\fR
|
|
will execute the command directly instead of running it as a child
|
|
process.
|
|
This flag is
|
|
\fIon\fR
|
|
by default.
|
|
.sp
|
|
This setting is only supported by version 1.8.8 or higher.
|
|
.TP 18n
|
|
passprompt_override
|
|
The password prompt specified by
|
|
\fIpassprompt\fR
|
|
will normally only be used if the password prompt provided by systems
|
|
such as PAM matches the string
|
|
\(LqPassword:\(Rq.
|
|
If
|
|
\fIpassprompt_override\fR
|
|
is set,
|
|
\fIpassprompt\fR
|
|
will always be used.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
path_info
|
|
Normally,
|
|
\fBsudo\fR
|
|
will tell the user when a command could not be
|
|
found in their
|
|
\fRPATH\fR
|
|
environment variable.
|
|
Some sites may wish to disable this as it could be used to gather
|
|
information on the location of executables that the normal user does
|
|
not have access to.
|
|
The disadvantage is that if the executable is simply not in the user's
|
|
\fRPATH\fR,
|
|
\fBsudo\fR
|
|
will tell the user that they are not allowed to run it, which can be confusing.
|
|
This flag is
|
|
\fI@path_info@\fR
|
|
by default.
|
|
.TP 18n
|
|
preserve_groups
|
|
By default,
|
|
\fBsudo\fR
|
|
will initialize the group vector to the list of groups the target user is in.
|
|
When
|
|
\fIpreserve_groups\fR
|
|
is set, the user's existing group vector is left unaltered.
|
|
The real and effective group IDs, however, are still set to match the
|
|
target user.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
pwfeedback
|
|
By default,
|
|
\fBsudo\fR
|
|
reads the password like most other Unix programs,
|
|
by turning off echo until the user hits the return (or enter) key.
|
|
Some users become confused by this as it appears to them that
|
|
\fBsudo\fR
|
|
has hung at this point.
|
|
When
|
|
\fIpwfeedback\fR
|
|
is set,
|
|
\fBsudo\fR
|
|
will provide visual feedback when the user presses a key.
|
|
Note that this does have a security impact as an onlooker may be able to
|
|
determine the length of the password being entered.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
requiretty
|
|
If set,
|
|
\fBsudo\fR
|
|
will only run when the user is logged in to a real tty.
|
|
When this flag is set,
|
|
\fBsudo\fR
|
|
can only be run from a login session and not via other means such as
|
|
cron(@mansectsu@)
|
|
or cgi-bin scripts.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
root_sudo
|
|
If set, root is allowed to run
|
|
\fBsudo\fR
|
|
too.
|
|
Disabling this prevents users from
|
|
\(Lqchaining\(Rq
|
|
\fBsudo\fR
|
|
commands to get a root shell by doing something like
|
|
\(Lq\fRsudo sudo /bin/sh\fR\(Rq.
|
|
Note, however, that turning off
|
|
\fIroot_sudo\fR
|
|
will also prevent root from running
|
|
\fBsudoedit\fR.
|
|
Disabling
|
|
\fIroot_sudo\fR
|
|
provides no real additional security; it exists purely for historical reasons.
|
|
This flag is
|
|
\fI@root_sudo@\fR
|
|
by default.
|
|
.TP 18n
|
|
rootpw
|
|
If set,
|
|
\fBsudo\fR
|
|
will prompt for the root password instead of the password of the invoking user
|
|
when running a command or editing a file.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
runaspw
|
|
If set,
|
|
\fBsudo\fR
|
|
will prompt for the password of the user defined by the
|
|
\fIrunas_default\fR
|
|
option (defaults to
|
|
\fR@runas_default@\fR)
|
|
instead of the password of the invoking user
|
|
when running a command or editing a file.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
set_home
|
|
If enabled and
|
|
\fBsudo\fR
|
|
is invoked with the
|
|
\fB\-s\fR
|
|
option the
|
|
\fRHOME\fR
|
|
environment variable will be set to the home directory of the target
|
|
user (which is root unless the
|
|
\fB\-u\fR
|
|
option is used).
|
|
This effectively makes the
|
|
\fB\-s\fR
|
|
option imply
|
|
\fB\-H\fR.
|
|
Note that
|
|
\fRHOME\fR
|
|
is already set when the
|
|
\fIenv_reset\fR
|
|
option is enabled, so
|
|
\fIset_home\fR
|
|
is only effective for configurations where either
|
|
\fIenv_reset\fR
|
|
is disabled
|
|
or
|
|
\fRHOME\fR
|
|
is present in the
|
|
\fIenv_keep\fR
|
|
list.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
set_logname
|
|
Normally,
|
|
\fBsudo\fR
|
|
will set the
|
|
\fRLOGNAME\fR,
|
|
\fRUSER\fR
|
|
and
|
|
\fRUSERNAME\fR
|
|
environment variables to the name of the target user (usually root unless the
|
|
\fB\-u\fR
|
|
option is given).
|
|
However, since some programs (including the RCS revision control system) use
|
|
\fRLOGNAME\fR
|
|
to determine the real identity of the user, it may be desirable to
|
|
change this behavior.
|
|
This can be done by negating the set_logname option.
|
|
Note that
|
|
\fIset_logname\fR
|
|
will have no effect
|
|
if the
|
|
\fIenv_reset\fR
|
|
option has not been disabled and the
|
|
\fIenv_keep\fR
|
|
list contains
|
|
\fRLOGNAME\fR,
|
|
\fRUSER\fR
|
|
or
|
|
\fRUSERNAME\fR.
|
|
This flag is
|
|
\fIon\fR
|
|
by default.
|
|
.TP 18n
|
|
set_utmp
|
|
When enabled,
|
|
\fBsudo\fR
|
|
will create an entry in the utmp (or utmpx) file when a pseudo-tty
|
|
is allocated.
|
|
A pseudo-tty is allocated by
|
|
\fBsudo\fR
|
|
when the
|
|
\fIlog_input\fR,
|
|
\fIlog_output\fR
|
|
or
|
|
\fIuse_pty\fR
|
|
flags are enabled.
|
|
By default, the new entry will be a copy of the user's existing utmp
|
|
entry (if any), with the tty, time, type and pid fields updated.
|
|
This flag is
|
|
\fIon\fR
|
|
by default.
|
|
.TP 18n
|
|
setenv
|
|
Allow the user to disable the
|
|
\fIenv_reset\fR
|
|
option from the command line via the
|
|
\fB\-E\fR
|
|
option.
|
|
Additionally, environment variables set via the command line are
|
|
not subject to the restrictions imposed by
|
|
\fIenv_check\fR,
|
|
\fIenv_delete\fR,
|
|
or
|
|
\fIenv_keep\fR.
|
|
As such, only trusted users should be allowed to set variables in this manner.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
shell_noargs
|
|
If set and
|
|
\fBsudo\fR
|
|
is invoked with no arguments it acts as if the
|
|
\fB\-s\fR
|
|
option had been given.
|
|
That is, it runs a shell as root (the shell is determined by the
|
|
\fRSHELL\fR
|
|
environment variable if it is set, falling back on the shell listed
|
|
in the invoking user's /etc/passwd entry if not).
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
stay_setuid
|
|
Normally, when
|
|
\fBsudo\fR
|
|
executes a command the real and effective UIDs are set to the target
|
|
user (root by default).
|
|
This option changes that behavior such that the real UID is left
|
|
as the invoking user's UID.
|
|
In other words, this makes
|
|
\fBsudo\fR
|
|
act as a setuid wrapper.
|
|
This can be useful on systems that disable some potentially
|
|
dangerous functionality when a program is run setuid.
|
|
This option is only effective on systems that support either the
|
|
setreuid(2)
|
|
or
|
|
setresuid(2)
|
|
system call.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
sudoedit_checkdir
|
|
.br
|
|
If set,
|
|
\fBsudoedit\fR
|
|
will check all directory components of the path to be edited for writability
|
|
by the invoking user.
|
|
Symbolic links will not be followed in writable directories and
|
|
\fBsudoedit\fR
|
|
will refuse to edit a file located in a writable directory.
|
|
These restrictions are not enforced when
|
|
\fBsudoedit\fR
|
|
is run by root.
|
|
On some systems, if all directory components of the path to be edited
|
|
are not readable by the target user,
|
|
\fBsudoedit\fR
|
|
will be unable to edit the file.
|
|
This flag is
|
|
\fIon\fR
|
|
by default.
|
|
.sp
|
|
This setting was first introduced in version 1.8.15 but initially
|
|
suffered from a race condition.
|
|
The check for symbolic links in writable intermediate directories
|
|
was added in version 1.8.16.
|
|
.TP 18n
|
|
sudoedit_follow
|
|
By default,
|
|
\fBsudoedit\fR
|
|
will not follow symbolic links when opening files.
|
|
The
|
|
\fIsudoedit_follow\fR
|
|
option can be enabled to allow
|
|
\fBsudoedit\fR
|
|
to open symbolic links.
|
|
It may be overridden on a per-command basis by the
|
|
\fIFOLLOW\fR
|
|
and
|
|
\fINOFOLLOW\fR
|
|
tags.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.sp
|
|
This setting is only supported by version 1.8.15 or higher.
|
|
.TP 18n
|
|
targetpw
|
|
If set,
|
|
\fBsudo\fR
|
|
will prompt for the password of the user specified
|
|
by the
|
|
\fB\-u\fR
|
|
option (defaults to
|
|
\fRroot\fR)
|
|
instead of the password of the invoking user
|
|
when running a command or editing a file.
|
|
Note that this flag precludes the use of a uid not listed in the passwd
|
|
database as an argument to the
|
|
\fB\-u\fR
|
|
option.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
tty_tickets
|
|
If set, users must authenticate on a per-tty basis.
|
|
With this flag enabled,
|
|
\fBsudo\fR
|
|
will use a separate record in the time stamp file for each tty.
|
|
If disabled, a single record is used for all login sessions.
|
|
This flag is
|
|
\fI@tty_tickets@\fR
|
|
by default.
|
|
.TP 18n
|
|
umask_override
|
|
If set,
|
|
\fBsudo\fR
|
|
will set the umask as specified in the
|
|
\fIsudoers\fR
|
|
file without modification.
|
|
This makes it possible to specify a umask in the
|
|
\fIsudoers\fR
|
|
file that is more permissive than the user's own umask and matches
|
|
historical behavior.
|
|
If
|
|
\fIumask_override\fR
|
|
is not set,
|
|
\fBsudo\fR
|
|
will set the umask to be the union of the user's umask and what is specified in
|
|
\fIsudoers\fR.
|
|
This flag is
|
|
\fI@umask_override@\fR
|
|
by default.
|
|
.TP 18n
|
|
use_loginclass
|
|
If set,
|
|
\fBsudo\fR
|
|
will apply the defaults specified for the target user's login class
|
|
if one exists.
|
|
Only available if
|
|
\fBsudo\fR
|
|
is configured with the
|
|
\fR--with-logincap\fR
|
|
option.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
use_netgroups
|
|
If set, netgroups (prefixed with
|
|
\(oq+\(cq),
|
|
may be used in place of a user or host.
|
|
For LDAP-based sudoers, netgroup support requires an expensive
|
|
substring match on the server unless the
|
|
\fBNETGROUP_BASE\fR
|
|
directive is present in the
|
|
\fI@ldap_conf@\fR
|
|
file.
|
|
If netgroups are not needed, this option can be disabled to reduce the
|
|
load on the LDAP server.
|
|
This flag is
|
|
\fIon\fR
|
|
by default.
|
|
.TP 18n
|
|
use_pty
|
|
If set,
|
|
\fBsudo\fR
|
|
will run the command in a pseudo-pty even if no I/O logging is being gone.
|
|
A malicious program run under
|
|
\fBsudo\fR
|
|
could conceivably fork a background process that retains to the user's
|
|
terminal device after the main program has finished executing.
|
|
Use of this option will make that impossible.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
utmp_runas
|
|
If set,
|
|
\fBsudo\fR
|
|
will store the name of the runas user when updating the utmp (or utmpx) file.
|
|
By default,
|
|
\fBsudo\fR
|
|
stores the name of the invoking user.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.TP 18n
|
|
visiblepw
|
|
By default,
|
|
\fBsudo\fR
|
|
will refuse to run if the user must enter a password but it is not
|
|
possible to disable echo on the terminal.
|
|
If the
|
|
\fIvisiblepw\fR
|
|
flag is set,
|
|
\fBsudo\fR
|
|
will prompt for a password even when it would be visible on the screen.
|
|
This makes it possible to run things like
|
|
\(Lq\fRssh somehost sudo ls\fR\(Rq
|
|
since by default,
|
|
ssh(1)
|
|
does
|
|
not allocate a tty when running a command.
|
|
This flag is
|
|
\fIoff\fR
|
|
by default.
|
|
.PP
|
|
\fBIntegers\fR:
|
|
.TP 18n
|
|
closefrom
|
|
Before it executes a command,
|
|
\fBsudo\fR
|
|
will close all open file descriptors other than standard input,
|
|
standard output and standard error (ie: file descriptors 0-2).
|
|
The
|
|
\fIclosefrom\fR
|
|
option can be used to specify a different file descriptor at which
|
|
to start closing.
|
|
The default is
|
|
\fR3\fR.
|
|
.TP 18n
|
|
maxseq
|
|
The maximum sequence number that will be substituted for the
|
|
\(Lq\fR%{seq}\fR\(Rq
|
|
escape in the I/O log file (see the
|
|
\fIiolog_dir\fR
|
|
description above for more information).
|
|
While the value substituted for
|
|
\(Lq\fR%{seq}\fR\(Rq
|
|
is in base 36,
|
|
\fImaxseq\fR
|
|
itself should be expressed in decimal.
|
|
Values larger than 2176782336 (which corresponds to the
|
|
base 36 sequence number
|
|
\(LqZZZZZZ\(Rq)
|
|
will be silently truncated to 2176782336.
|
|
The default value is 2176782336.
|
|
.sp
|
|
Once the local sequence number reaches the value of
|
|
\fImaxseq\fR,
|
|
it will
|
|
\(Lqroll over\(Rq
|
|
to zero, after which
|
|
\fBsudoers\fR
|
|
will truncate and re-use any existing I/O log path names.
|
|
.sp
|
|
This setting is only supported by version 1.8.7 or higher.
|
|
.TP 18n
|
|
passwd_tries
|
|
The number of tries a user gets to enter his/her password before
|
|
\fBsudo\fR
|
|
logs the failure and exits.
|
|
The default is
|
|
\fR@passwd_tries@\fR.
|
|
.PP
|
|
\fBIntegers that can be used in a boolean context\fR:
|
|
.TP 18n
|
|
loglinelen
|
|
Number of characters per line for the file log.
|
|
This value is used to decide when to wrap lines for nicer log files.
|
|
This has no effect on the syslog log file, only the file log.
|
|
The default is
|
|
\fR@loglen@\fR
|
|
(use 0 or negate the option to disable word wrap).
|
|
.TP 18n
|
|
passwd_timeout
|
|
Number of minutes before the
|
|
\fBsudo\fR
|
|
password prompt times out, or
|
|
\fR0\fR
|
|
for no timeout.
|
|
The timeout may include a fractional component
|
|
if minute granularity is insufficient, for example
|
|
\fR2.5\fR.
|
|
The
|
|
default is
|
|
\fR@password_timeout@\fR.
|
|
.TP 18n
|
|
timestamp_timeout
|
|
.br
|
|
Number of minutes that can elapse before
|
|
\fBsudo\fR
|
|
will ask for a passwd again.
|
|
The timeout may include a fractional component if
|
|
minute granularity is insufficient, for example
|
|
\fR2.5\fR.
|
|
The default is
|
|
\fR@timeout@\fR.
|
|
Set this to
|
|
\fR0\fR
|
|
to always prompt for a password.
|
|
If set to a value less than
|
|
\fR0\fR
|
|
the user's time stamp will not expire until the system is rebooted.
|
|
This can be used to allow users to create or delete their own time stamps via
|
|
\(Lq\fRsudo -v\fR\(Rq
|
|
and
|
|
\(Lq\fRsudo -k\fR\(Rq
|
|
respectively.
|
|
.TP 18n
|
|
umask
|
|
Umask to use when running the command.
|
|
Negate this option or set it to 0777 to preserve the user's umask.
|
|
The actual umask that is used will be the union of the user's umask
|
|
and the value of the
|
|
\fIumask\fR
|
|
option, which defaults to
|
|
\fR@sudo_umask@\fR.
|
|
This guarantees
|
|
that
|
|
\fBsudo\fR
|
|
never lowers the umask when running a command.
|
|
Note: on systems that use PAM, the default PAM configuration may specify
|
|
its own umask which will override the value set in
|
|
\fIsudoers\fR.
|
|
.PP
|
|
\fBStrings\fR:
|
|
.TP 18n
|
|
badpass_message
|
|
Message that is displayed if a user enters an incorrect password.
|
|
The default is
|
|
\fR@badpass_message@\fR
|
|
unless insults are enabled.
|
|
.TP 18n
|
|
editor
|
|
A colon
|
|
(\(oq:\&\(cq)
|
|
separated list of editors allowed to be used with
|
|
\fBvisudo\fR.
|
|
\fBvisudo\fR
|
|
will choose the editor that matches the user's
|
|
\fREDITOR\fR
|
|
or
|
|
\fRVISUAL\fR
|
|
environment variable if possible, or the first editor in the
|
|
list that exists and is executable.
|
|
Note that the
|
|
\fREDITOR\fR
|
|
and
|
|
\fRVISUAL\fR
|
|
environment variables are not preserved by default when the
|
|
\fIenv_reset\fR
|
|
option is enabled.
|
|
The default is
|
|
\fI@editor@\fR.
|
|
.TP 18n
|
|
iolog_dir
|
|
The top-level directory to use when constructing the path name for
|
|
the input/output log directory.
|
|
Only used if the
|
|
\fIlog_input\fR
|
|
or
|
|
\fIlog_output\fR
|
|
options are enabled or when the
|
|
\fRLOG_INPUT\fR
|
|
or
|
|
\fRLOG_OUTPUT\fR
|
|
tags are present for a command.
|
|
The session sequence number, if any, is stored in the directory.
|
|
The default is
|
|
\fI@iolog_dir@\fR.
|
|
.sp
|
|
The following percent
|
|
(\(oq%\(cq)
|
|
escape sequences are supported:
|
|
.PP
|
|
.RS 18n
|
|
.PD 0
|
|
.TP 6n
|
|
\fR%{seq}\fR
|
|
expanded to a monotonically increasing base-36 sequence number, such as 0100A5,
|
|
where every two digits are used to form a new directory, e.g.\&
|
|
\fI01/00/A5\fR
|
|
.PD
|
|
.TP 6n
|
|
\fR%{user}\fR
|
|
expanded to the invoking user's login name
|
|
.TP 6n
|
|
\fR%{group}\fR
|
|
expanded to the name of the invoking user's real group ID
|
|
.TP 6n
|
|
\fR%{runas_user}\fR
|
|
expanded to the login name of the user the command will
|
|
be run as (e.g.\& root)
|
|
.TP 6n
|
|
\fR%{runas_group}\fR
|
|
expanded to the group name of the user the command will
|
|
be run as (e.g.\& wheel)
|
|
.TP 6n
|
|
\fR%{hostname}\fR
|
|
expanded to the local host name without the domain name
|
|
.TP 6n
|
|
\fR%{command}\fR
|
|
expanded to the base name of the command being run
|
|
.PP
|
|
In addition, any escape sequences supported by the system's
|
|
strftime(3)
|
|
function will be expanded.
|
|
.sp
|
|
To include a literal
|
|
\(oq%\(cq
|
|
character, the string
|
|
\(oq%%\(cq
|
|
should be used.
|
|
.RE
|
|
.TP 18n
|
|
iolog_file
|
|
The path name, relative to
|
|
\fIiolog_dir\fR,
|
|
in which to store input/output logs when the
|
|
\fIlog_input\fR
|
|
or
|
|
\fIlog_output\fR
|
|
options are enabled or when the
|
|
\fRLOG_INPUT\fR
|
|
or
|
|
\fRLOG_OUTPUT\fR
|
|
tags are present for a command.
|
|
Note that
|
|
\fIiolog_file\fR
|
|
may contain directory components.
|
|
The default is
|
|
\(Lq\fR%{seq}\fR\(Rq.
|
|
.sp
|
|
See the
|
|
\fIiolog_dir\fR
|
|
option above for a list of supported percent
|
|
(\(oq%\(cq)
|
|
escape sequences.
|
|
.sp
|
|
In addition to the escape sequences, path names that end in six or
|
|
more
|
|
\fRX\fRs
|
|
will have the
|
|
\fRX\fRs
|
|
replaced with a unique combination of digits and letters, similar to the
|
|
mktemp(3)
|
|
function.
|
|
.sp
|
|
If the path created by concatenating
|
|
\fIiolog_dir\fR
|
|
and
|
|
\fIiolog_file\fR
|
|
already exists, the existing I/O log file will be truncated and
|
|
overwritten unless
|
|
\fIiolog_file\fR
|
|
ends in six or
|
|
more
|
|
\fRX\fRs.
|
|
.TP 18n
|
|
iolog_group
|
|
The group name to look up when setting the group ID on new I/O log
|
|
files and directories.
|
|
By default, I/O log files and directories inherit the group ID of
|
|
the parent directory.
|
|
.sp
|
|
This setting is only supported by version 1.8.19 or higher.
|
|
.TP 18n
|
|
iolog_mode
|
|
The file permision mode to use when creating I/O log files,
|
|
mode bits other than 0666 are ignored.
|
|
When creating I/O log directories, search (execute) bits are added
|
|
to to match the read and write bits specified by
|
|
\fIiolog_mode\fR.
|
|
Defaults to 0600.
|
|
.sp
|
|
This setting is only supported by version 1.8.19 or higher.
|
|
.TP 18n
|
|
iolog_user
|
|
The user name to look up when setting the user ID on new I/O log
|
|
files and directories.
|
|
By default, I/O log files and directories are owned by the superuser
|
|
(user ID 0).
|
|
.sp
|
|
This setting is only supported by version 1.8.19 or higher.
|
|
.TP 18n
|
|
lecture_status_dir
|
|
The directory in which
|
|
\fBsudo\fR
|
|
stores per-user lecture status files.
|
|
Once a user has received the lecture, a zero-length file is
|
|
created in this directory so that
|
|
\fBsudo\fR
|
|
will not lecture the user again.
|
|
This directory should
|
|
\fInot\fR
|
|
be cleared when the system reboots.
|
|
The default is
|
|
\fI@vardir@/lectured\fR.
|
|
.TP 18n
|
|
limitprivs
|
|
The default Solaris limit privileges to use when constructing a new
|
|
privilege set for a command.
|
|
This bounds all privileges of the executing process.
|
|
The default limit privileges may be overridden on a per-command basis in
|
|
\fIsudoers\fR.
|
|
This option is only available if
|
|
\fBsudoers\fR
|
|
is built on Solaris 10 or higher.
|
|
.TP 18n
|
|
mailsub
|
|
Subject of the mail sent to the
|
|
\fImailto\fR
|
|
user.
|
|
The escape
|
|
\fR%h\fR
|
|
will expand to the host name of the machine.
|
|
Default is
|
|
\(Lq\fR@mailsub@\fR\(Rq.
|
|
.TP 18n
|
|
noexec_file
|
|
As of
|
|
\fBsudo\fR
|
|
version 1.8.1 this option is no longer supported.
|
|
The path to the noexec file should now be set in the
|
|
sudo.conf(@mansectform@)
|
|
file.
|
|
.TP 18n
|
|
pam_login_service
|
|
.br
|
|
On systems that use PAM for authentication, this is the service
|
|
name used when the
|
|
\fB\-i\fR
|
|
option is specified.
|
|
The default value is
|
|
\(Lq\fR@pam_login_service@\fR\(Rq.
|
|
See the description of
|
|
\fIpam_service\fR
|
|
for more information.
|
|
.sp
|
|
This setting is only supported by version 1.8.8 or higher.
|
|
.TP 18n
|
|
pam_service
|
|
On systems that use PAM for authentication, the service name
|
|
specifies the PAM policy to apply.
|
|
This usually corresponds to an entry in the
|
|
\fIpam.conf\fR
|
|
file or a file in the
|
|
\fI/etc/pam.d\fR
|
|
directory.
|
|
The default value is
|
|
\(Lq\fRsudo\fR\(Rq.
|
|
.sp
|
|
This setting is only supported by version 1.8.8 or higher.
|
|
.TP 18n
|
|
passprompt
|
|
The default prompt to use when asking for a password; can be overridden via the
|
|
\fB\-p\fR
|
|
option or the
|
|
\fRSUDO_PROMPT\fR
|
|
environment variable.
|
|
The following percent
|
|
(\(oq%\(cq)
|
|
escape sequences are supported:
|
|
.PP
|
|
.RS 18n
|
|
.PD 0
|
|
.TP 6n
|
|
\fR%H\fR
|
|
expanded to the local host name including the domain name
|
|
(only if the machine's host name is fully qualified or the
|
|
\fIfqdn\fR
|
|
option is set)
|
|
.PD
|
|
.TP 6n
|
|
\fR%h\fR
|
|
expanded to the local host name without the domain name
|
|
.TP 6n
|
|
\fR%p\fR
|
|
expanded to the user whose password is being asked for (respects the
|
|
\fIrootpw\fR,
|
|
\fItargetpw\fR
|
|
and
|
|
\fIrunaspw\fR
|
|
flags in
|
|
\fIsudoers\fR)
|
|
.TP 6n
|
|
\fR\&%U\fR
|
|
expanded to the login name of the user the command will
|
|
be run as (defaults to root)
|
|
.TP 6n
|
|
\fR%u\fR
|
|
expanded to the invoking user's login name
|
|
.TP 6n
|
|
\fR%%\fR
|
|
two consecutive
|
|
\fR%\fR
|
|
characters are collapsed into a single
|
|
\fR%\fR
|
|
character
|
|
.PP
|
|
The default value is
|
|
\(Lq\fR@passprompt@\fR\(Rq.
|
|
.RE
|
|
.TP 18n
|
|
privs
|
|
The default Solaris privileges to use when constructing a new
|
|
privilege set for a command.
|
|
This is passed to the executing process via the inherited privilege set,
|
|
but is bounded by the limit privileges.
|
|
If the
|
|
\fIprivs\fR
|
|
option is specified but the
|
|
\fIlimitprivs\fR
|
|
option is not, the limit privileges of the executing process is set to
|
|
\fIprivs\fR.
|
|
The default privileges may be overridden on a per-command basis in
|
|
\fIsudoers\fR.
|
|
This option is only available if
|
|
\fBsudoers\fR
|
|
is built on Solaris 10 or higher.
|
|
.TP 18n
|
|
role
|
|
The default SELinux role to use when constructing a new security
|
|
context to run the command.
|
|
The default role may be overridden on a per-command basis in the
|
|
\fIsudoers\fR
|
|
file or via command line options.
|
|
This option is only available when
|
|
\fBsudo\fR
|
|
is built with SELinux support.
|
|
.TP 18n
|
|
runas_default
|
|
The default user to run commands as if the
|
|
\fB\-u\fR
|
|
option is not specified on the command line.
|
|
This defaults to
|
|
\fR@runas_default@\fR.
|
|
.TP 18n
|
|
syslog_badpri
|
|
Syslog priority to use when the user is not allowed to run a command or
|
|
when authentication is unsuccessful.
|
|
Defaults to
|
|
\fR@badpri@\fR.
|
|
.sp
|
|
The following syslog priorities are supported:
|
|
\fBalert\fR,
|
|
\fBcrit\fR,
|
|
\fBdebug\fR,
|
|
\fBemerg\fR,
|
|
\fBerr\fR,
|
|
\fBinfo\fR,
|
|
\fBnotice\fR,
|
|
\fBwarning\fR,
|
|
and
|
|
\fBnone\fR.
|
|
Negating the option or setting it to a value of
|
|
\fBnone\fR
|
|
will disable logging of unsuccessful commands.
|
|
.TP 18n
|
|
syslog_goodpri
|
|
Syslog priority to use when the user is allowed to run a command and
|
|
authentication is successful.
|
|
Defaults to
|
|
\fR@goodpri@\fR.
|
|
.sp
|
|
See
|
|
\fIsyslog_badpri\fR
|
|
for the list of supported syslog priorities.
|
|
Negating the option or setting it to a value of
|
|
\fBnone\fR
|
|
will disable logging of successful commands.
|
|
.TP 18n
|
|
syslog_goodpri
|
|
.TP 18n
|
|
syslog_maxlen
|
|
On many systems,
|
|
syslog(3)
|
|
has a relatively small log buffer.
|
|
IETF RFC 5424 states that syslog servers must support messages of
|
|
at least 480 bytes and should support messages up to 2048 bytes.
|
|
By default,
|
|
\fBsudoers\fR
|
|
creates log messages up to 980 bytes which corresponds to the
|
|
historic BSD syslog implementation which used a 1024 byte buffer
|
|
to store the message, date, hostname and program name.
|
|
To prevent syslog messages from being truncated,
|
|
\fBsudoers\fR
|
|
will split up log messages that are larger than
|
|
\fIsyslog_maxlen\fR
|
|
bytes.
|
|
When a message is split, additional parts will include the string
|
|
\(Lq(command continued)\(Rq
|
|
after the user name and before the continued command line arguments.
|
|
.sp
|
|
This setting is only supported by version 1.8.19 or higher.
|
|
.TP 18n
|
|
sudoers_locale
|
|
Locale to use when parsing the sudoers file, logging commands, and
|
|
sending email.
|
|
Note that changing the locale may affect how sudoers is interpreted.
|
|
Defaults to
|
|
\(Lq\fRC\fR\(Rq.
|
|
.TP 18n
|
|
timestampdir
|
|
The directory in which
|
|
\fBsudo\fR
|
|
stores its time stamp files.
|
|
This directory should be cleared when the system reboots.
|
|
The default is
|
|
\fI@rundir@/ts\fR.
|
|
.TP 18n
|
|
timestampowner
|
|
The owner of the lecture status directory, time stamp directory and all
|
|
files stored therein.
|
|
The default is
|
|
\fRroot\fR.
|
|
.TP 18n
|
|
type
|
|
The default SELinux type to use when constructing a new security
|
|
context to run the command.
|
|
The default type may be overridden on a per-command basis in the
|
|
\fIsudoers\fR
|
|
file or via command line options.
|
|
This option is only available when
|
|
\fBsudo\fR
|
|
is built with SELinux support.
|
|
.PP
|
|
\fBStrings that can be used in a boolean context\fR:
|
|
.TP 14n
|
|
env_file
|
|
The
|
|
\fIenv_file\fR
|
|
option specifies the fully qualified path to a file containing variables
|
|
to be set in the environment of the program being run.
|
|
Entries in this file should either be of the form
|
|
\(Lq\fRVARIABLE=value\fR\(Rq
|
|
or
|
|
\(Lq\fRexport VARIABLE=value\fR\(Rq.
|
|
The value may optionally be surrounded by single or double quotes.
|
|
Variables in this file are subject to other
|
|
\fBsudo\fR
|
|
environment settings such as
|
|
\fIenv_keep\fR
|
|
and
|
|
\fIenv_check\fR.
|
|
.TP 14n
|
|
exempt_group
|
|
Users in this group are exempt from password and PATH requirements.
|
|
The group name specified should not include a
|
|
\fR%\fR
|
|
prefix.
|
|
This is not set by default.
|
|
.TP 14n
|
|
group_plugin
|
|
A string containing a
|
|
\fBsudoers\fR
|
|
group plugin with optional arguments.
|
|
The string should consist of the plugin
|
|
path, either fully-qualified or relative to the
|
|
\fI@PLUGINDIR@\fR
|
|
directory, followed by any configuration arguments the plugin requires.
|
|
These arguments (if any) will be passed to the plugin's initialization function.
|
|
If arguments are present, the string must be enclosed in double quotes
|
|
(\&"").
|
|
.sp
|
|
For more information see
|
|
GROUP PROVIDER PLUGINS.
|
|
.TP 14n
|
|
lecture
|
|
This option controls when a short lecture will be printed along with
|
|
the password prompt.
|
|
It has the following possible values:
|
|
.PP
|
|
.RS 14n
|
|
.PD 0
|
|
.TP 8n
|
|
always
|
|
Always lecture the user.
|
|
.PD
|
|
.TP 8n
|
|
never
|
|
Never lecture the user.
|
|
.TP 8n
|
|
once
|
|
Only lecture the user the first time they run
|
|
\fBsudo\fR.
|
|
.PP
|
|
If no value is specified, a value of
|
|
\fIonce\fR
|
|
is implied.
|
|
Negating the option results in a value of
|
|
\fInever\fR
|
|
being used.
|
|
The default value is
|
|
\fI@lecture@\fR.
|
|
.RE
|
|
.TP 14n
|
|
lecture_file
|
|
Path to a file containing an alternate
|
|
\fBsudo\fR
|
|
lecture that will be used in place of the standard lecture if the named
|
|
file exists.
|
|
By default,
|
|
\fBsudo\fR
|
|
uses a built-in lecture.
|
|
.TP 14n
|
|
listpw
|
|
This option controls when a password will be required when a user runs
|
|
\fBsudo\fR
|
|
with the
|
|
\fB\-l\fR
|
|
option.
|
|
It has the following possible values:
|
|
.PP
|
|
.RS 14n
|
|
.PD 0
|
|
.TP 10n
|
|
all
|
|
All the user's
|
|
\fIsudoers\fR
|
|
file entries for the current host must have
|
|
the
|
|
\fRNOPASSWD\fR
|
|
flag set to avoid entering a password.
|
|
.PD
|
|
.TP 10n
|
|
always
|
|
The user must always enter a password to use the
|
|
\fB\-l\fR
|
|
option.
|
|
.TP 10n
|
|
any
|
|
At least one of the user's
|
|
\fIsudoers\fR
|
|
file entries for the current host
|
|
must have the
|
|
\fRNOPASSWD\fR
|
|
flag set to avoid entering a password.
|
|
.TP 10n
|
|
never
|
|
The user need never enter a password to use the
|
|
\fB\-l\fR
|
|
option.
|
|
.PP
|
|
If no value is specified, a value of
|
|
\fIany\fR
|
|
is implied.
|
|
Negating the option results in a value of
|
|
\fInever\fR
|
|
being used.
|
|
The default value is
|
|
\fIany\fR.
|
|
.RE
|
|
.TP 14n
|
|
logfile
|
|
Path to the
|
|
\fBsudo\fR
|
|
log file (not the syslog log file).
|
|
Setting a path turns on logging to a file;
|
|
negating this option turns it off.
|
|
By default,
|
|
\fBsudo\fR
|
|
logs via syslog.
|
|
.TP 14n
|
|
mailerflags
|
|
Flags to use when invoking mailer. Defaults to
|
|
\fB\-t\fR.
|
|
.TP 14n
|
|
mailerpath
|
|
Path to mail program used to send warning mail.
|
|
Defaults to the path to sendmail found at configure time.
|
|
.TP 14n
|
|
mailfrom
|
|
Address to use for the
|
|
\(Lqfrom\(Rq
|
|
address when sending warning and error mail.
|
|
The address should be enclosed in double quotes
|
|
(\&"")
|
|
to protect against
|
|
\fBsudo\fR
|
|
interpreting the
|
|
\fR@\fR
|
|
sign.
|
|
Defaults to the name of the user running
|
|
\fBsudo\fR.
|
|
.TP 14n
|
|
mailto
|
|
Address to send warning and error mail to.
|
|
The address should be enclosed in double quotes
|
|
(\&"")
|
|
to protect against
|
|
\fBsudo\fR
|
|
interpreting the
|
|
\fR@\fR
|
|
sign.
|
|
Defaults to
|
|
\fR@mailto@\fR.
|
|
.TP 14n
|
|
secure_path
|
|
Path used for every command run from
|
|
\fBsudo\fR.
|
|
If you don't trust the
|
|
people running
|
|
\fBsudo\fR
|
|
to have a sane
|
|
\fRPATH\fR
|
|
environment variable you may want to use this.
|
|
Another use is if you want to have the
|
|
\(Lqroot path\(Rq
|
|
be separate from the
|
|
\(Lquser path\(Rq.
|
|
Users in the group specified by the
|
|
\fIexempt_group\fR
|
|
option are not affected by
|
|
\fIsecure_path\fR.
|
|
This option is @secure_path@ by default.
|
|
.TP 14n
|
|
syslog
|
|
Syslog facility if syslog is being used for logging (negate to
|
|
disable syslog logging).
|
|
Defaults to
|
|
\fR@logfac@\fR.
|
|
.sp
|
|
The following syslog facilities are supported:
|
|
\fBauthpriv\fR
|
|
(if your
|
|
OS supports it),
|
|
\fBauth\fR,
|
|
\fBdaemon\fR,
|
|
\fBuser\fR,
|
|
\fBlocal0\fR,
|
|
\fBlocal1\fR,
|
|
\fBlocal2\fR,
|
|
\fBlocal3\fR,
|
|
\fBlocal4\fR,
|
|
\fBlocal5\fR,
|
|
\fBlocal6\fR,
|
|
and
|
|
\fBlocal7\fR.
|
|
.TP 14n
|
|
verifypw
|
|
This option controls when a password will be required when a user runs
|
|
\fBsudo\fR
|
|
with the
|
|
\fB\-v\fR
|
|
option.
|
|
It has the following possible values:
|
|
.PP
|
|
.RS 14n
|
|
.PD 0
|
|
.TP 8n
|
|
all
|
|
All the user's
|
|
\fIsudoers\fR
|
|
file entries for the current host must have the
|
|
\fRNOPASSWD\fR
|
|
flag set to avoid entering a password.
|
|
.PD
|
|
.TP 8n
|
|
always
|
|
The user must always enter a password to use the
|
|
\fB\-v\fR
|
|
option.
|
|
.TP 8n
|
|
any
|
|
At least one of the user's
|
|
\fIsudoers\fR
|
|
file entries for the current host must have the
|
|
\fRNOPASSWD\fR
|
|
flag set to avoid entering a password.
|
|
.TP 8n
|
|
never
|
|
The user need never enter a password to use the
|
|
\fB\-v\fR
|
|
option.
|
|
.PP
|
|
If no value is specified, a value of
|
|
\fIall\fR
|
|
is implied.
|
|
Negating the option results in a value of
|
|
\fInever\fR
|
|
being used.
|
|
The default value is
|
|
\fIall\fR.
|
|
.RE
|
|
.PP
|
|
\fBLists that can be used in a boolean context\fR:
|
|
.TP 18n
|
|
env_check
|
|
Environment variables to be removed from the user's environment
|
|
unless they are considered
|
|
\(Lqsafe\(Rq.
|
|
For all variables except
|
|
\fRTZ\fR,
|
|
\(Lqsafe\(Rq
|
|
means that the variable's value does not contain any
|
|
\(oq%\(cq
|
|
or
|
|
\(oq/\(cq
|
|
characters.
|
|
This can be used to guard against printf-style format vulnerabilities
|
|
in poorly-written programs.
|
|
The
|
|
\fRTZ\fR
|
|
variable is considered unsafe if any of the following are true:
|
|
.PP
|
|
.RS 18n
|
|
.PD 0
|
|
.TP 4n
|
|
\fB\(bu\fR
|
|
It consists of a fully-qualified path name,
|
|
optionally prefixed with a colon
|
|
(\(oq:\&\(cq),
|
|
that does not match the location of the
|
|
\fIzoneinfo\fR
|
|
directory.
|
|
.PD
|
|
.TP 4n
|
|
\fB\(bu\fR
|
|
It contains a
|
|
\fI..\fR
|
|
path element.
|
|
.TP 4n
|
|
\fB\(bu\fR
|
|
It contains white space or non-printable characters.
|
|
.TP 4n
|
|
\fB\(bu\fR
|
|
It is longer than the value of
|
|
\fRPATH_MAX\fR.
|
|
.PP
|
|
The argument may be a double-quoted, space-separated list or a
|
|
single value without double-quotes.
|
|
The list can be replaced, added to, deleted from, or disabled by using
|
|
the
|
|
\fR=\fR,
|
|
\fR+=\fR,
|
|
\fR-=\fR,
|
|
and
|
|
\fR\&!\fR
|
|
operators respectively.
|
|
Regardless of whether the
|
|
\fRenv_reset\fR
|
|
option is enabled or disabled, variables specified by
|
|
\fRenv_check\fR
|
|
will be preserved in the environment if they pass the aforementioned check.
|
|
The global list of environment variables to check is displayed when
|
|
\fBsudo\fR
|
|
is run by root with
|
|
the
|
|
\fB\-V\fR
|
|
option.
|
|
.RE
|
|
.TP 18n
|
|
env_delete
|
|
Environment variables to be removed from the user's environment when the
|
|
\fIenv_reset\fR
|
|
option is not in effect.
|
|
The argument may be a double-quoted, space-separated list or a
|
|
single value without double-quotes.
|
|
The list can be replaced, added to, deleted from, or disabled by using the
|
|
\fR=\fR,
|
|
\fR+=\fR,
|
|
\fR-=\fR,
|
|
and
|
|
\fR\&!\fR
|
|
operators respectively.
|
|
The global list of environment variables to remove is displayed when
|
|
\fBsudo\fR
|
|
is run by root with the
|
|
\fB\-V\fR
|
|
option.
|
|
Note that many operating systems will remove potentially dangerous
|
|
variables from the environment of any setuid process (such as
|
|
\fBsudo\fR).
|
|
.TP 18n
|
|
env_keep
|
|
Environment variables to be preserved in the user's environment when the
|
|
\fIenv_reset\fR
|
|
option is in effect.
|
|
This allows fine-grained control over the environment
|
|
\fBsudo\fR-spawned
|
|
processes will receive.
|
|
The argument may be a double-quoted, space-separated list or a
|
|
single value without double-quotes.
|
|
The list can be replaced, added to, deleted from, or disabled by using the
|
|
\fR=\fR,
|
|
\fR+=\fR,
|
|
\fR-=\fR,
|
|
and
|
|
\fR\&!\fR
|
|
operators respectively.
|
|
The global list of variables to keep
|
|
is displayed when
|
|
\fBsudo\fR
|
|
is run by root with the
|
|
\fB\-V\fR
|
|
option.
|
|
.SH "GROUP PROVIDER PLUGINS"
|
|
The
|
|
\fBsudoers\fR
|
|
plugin supports its own plugin interface to allow non-Unix
|
|
group lookups which can query a group source other
|
|
than the standard Unix group database.
|
|
This can be used to implement support for the
|
|
\fRnonunix_group\fR
|
|
syntax described earlier.
|
|
.PP
|
|
Group provider plugins are specified via the
|
|
\fIgroup_plugin\fR
|
|
Defaults setting.
|
|
The argument to
|
|
\fIgroup_plugin\fR
|
|
should consist of the plugin path, either fully-qualified or relative to the
|
|
\fI@PLUGINDIR@\fR
|
|
directory, followed by any configuration options the plugin requires.
|
|
These options (if specified) will be passed to the plugin's initialization
|
|
function.
|
|
If options are present, the string must be enclosed in double quotes
|
|
(\&"").
|
|
.PP
|
|
The following group provider plugins are installed by default:
|
|
.TP 10n
|
|
group_file
|
|
The
|
|
\fIgroup_file\fR
|
|
plugin supports an alternate group file that uses the same syntax as the
|
|
\fI/etc/group\fR
|
|
file.
|
|
The path to the group file should be specified as an option
|
|
to the plugin.
|
|
For example, if the group file to be used is
|
|
\fI/etc/sudo-group\fR:
|
|
.nf
|
|
.sp
|
|
.RS 10n
|
|
Defaults group_plugin="group_file.so /etc/sudo-group"
|
|
.RE
|
|
.fi
|
|
.TP 10n
|
|
system_group
|
|
The
|
|
\fIsystem_group\fR
|
|
plugin supports group lookups via the standard C library functions
|
|
\fBgetgrnam\fR()
|
|
and
|
|
\fBgetgrid\fR().
|
|
This plugin can be used in instances where the user belongs to
|
|
groups not present in the user's supplemental group vector.
|
|
This plugin takes no options:
|
|
.nf
|
|
.sp
|
|
.RS 10n
|
|
Defaults group_plugin=system_group.so
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The group provider plugin API is described in detail in
|
|
sudo_plugin(@mansectsu@).
|
|
.SH "LOG FORMAT"
|
|
\fBsudoers\fR
|
|
can log events using either
|
|
syslog(3)
|
|
or a simple log file.
|
|
The log format is almost identical in both cases.
|
|
.SS "Accepted command log entries"
|
|
Commands that sudo runs are logged using the following format (split
|
|
into multiple lines for readability):
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
date hostname progname: username : TTY=ttyname ; PWD=cwd ; \e
|
|
USER=runasuser ; GROUP=runasgroup ; TSID=logid ; \e
|
|
ENV=env_vars COMMAND=command
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Where the fields are as follows:
|
|
.TP 14n
|
|
date
|
|
The date the command was run.
|
|
Typically, this is in the format
|
|
\(LqMMM, DD, HH:MM:SS\(Rq.
|
|
If logging via
|
|
syslog(3),
|
|
the actual date format is controlled by the syslog daemon.
|
|
If logging to a file and the
|
|
\fIlog_year\fR
|
|
option is enabled,
|
|
the date will also include the year.
|
|
.TP 14n
|
|
hostname
|
|
The name of the host
|
|
\fBsudo\fR
|
|
was run on.
|
|
This field is only present when logging via
|
|
syslog(3).
|
|
.TP 14n
|
|
progname
|
|
The name of the program, usually
|
|
\fIsudo\fR
|
|
or
|
|
\fIsudoedit\fR.
|
|
This field is only present when logging via
|
|
syslog(3).
|
|
.TP 14n
|
|
username
|
|
The login name of the user who ran
|
|
\fBsudo\fR.
|
|
.TP 14n
|
|
ttyname
|
|
The short name of the terminal (e.g.\&
|
|
\(Lqconsole\(Rq,
|
|
\(Lqtty01\(Rq,
|
|
or
|
|
\(Lqpts/0\(Rq)
|
|
\fBsudo\fR
|
|
was run on, or
|
|
\(Lqunknown\(Rq
|
|
if there was no terminal present.
|
|
.TP 14n
|
|
cwd
|
|
The current working directory that
|
|
\fBsudo\fR
|
|
was run in.
|
|
.TP 14n
|
|
runasuser
|
|
The user the command was run as.
|
|
.TP 14n
|
|
runasgroup
|
|
The group the command was run as if one was specified on the command line.
|
|
.TP 14n
|
|
logid
|
|
An I/O log identifier that can be used to replay the command's output.
|
|
This is only present when the
|
|
\fIlog_input\fR
|
|
or
|
|
\fIlog_output\fR
|
|
option is enabled.
|
|
.TP 14n
|
|
env_vars
|
|
A list of environment variables specified on the command line,
|
|
if specified.
|
|
.TP 14n
|
|
command
|
|
The actual command that was executed.
|
|
.PP
|
|
Messages are logged using the locale specified by
|
|
\fIsudoers_locale\fR,
|
|
which defaults to the
|
|
\(Lq\fRC\fR\(Rq
|
|
locale.
|
|
.SS "Denied command log entries"
|
|
If the user is not allowed to run the command, the reason for the denial
|
|
will follow the user name.
|
|
Possible reasons include:
|
|
.TP 3n
|
|
user NOT in sudoers
|
|
The user is not listed in the
|
|
\fIsudoers\fR
|
|
file.
|
|
.TP 3n
|
|
user NOT authorized on host
|
|
The user is listed in the
|
|
\fIsudoers\fR
|
|
file but is not allowed to run commands on the host.
|
|
.TP 3n
|
|
command not allowed
|
|
The user is listed in the
|
|
\fIsudoers\fR
|
|
file for the host but they are not allowed to run the specified command.
|
|
.TP 3n
|
|
3 incorrect password attempts
|
|
The user failed to enter their password after 3 tries.
|
|
The actual number of tries will vary based on the number of
|
|
failed attempts and the value of the
|
|
\fIpasswd_tries\fR
|
|
option.
|
|
.TP 3n
|
|
a password is required
|
|
\fBsudo\fR's
|
|
\fB\-n\fR
|
|
option was specified but a password was required.
|
|
.TP 3n
|
|
sorry, you are not allowed to set the following environment variables
|
|
The user specified environment variables on the command line that
|
|
were not allowed by
|
|
\fIsudoers\fR.
|
|
.SS "Error log entries"
|
|
If an error occurs,
|
|
\fBsudoers\fR
|
|
will log a message and, in most cases, send a message to the
|
|
administrator via email.
|
|
Possible errors include:
|
|
.TP 3n
|
|
parse error in @sysconfdir@/sudoers near line N
|
|
\fBsudoers\fR
|
|
encountered an error when parsing the specified file.
|
|
In some cases, the actual error may be one line above or below the
|
|
line number listed, depending on the type of error.
|
|
.TP 3n
|
|
problem with defaults entries
|
|
The
|
|
\fIsudoers\fR
|
|
file contains one or more unknown Defaults settings.
|
|
This does not prevent
|
|
\fBsudo\fR
|
|
from running, but the
|
|
\fIsudoers\fR
|
|
file should be checked using
|
|
\fBvisudo\fR.
|
|
.TP 3n
|
|
timestamp owner (username): \&No such user
|
|
The time stamp directory owner, as specified by the
|
|
\fItimestampowner\fR
|
|
setting, could not be found in the password database.
|
|
.TP 3n
|
|
unable to open/read @sysconfdir@/sudoers
|
|
The
|
|
\fIsudoers\fR
|
|
file could not be opened for reading.
|
|
This can happen when the
|
|
\fIsudoers\fR
|
|
file is located on a remote file system that maps user ID 0 to
|
|
a different value.
|
|
Normally,
|
|
\fBsudoers\fR
|
|
tries to open the
|
|
\fIsudoers\fR
|
|
file using group permissions to avoid this problem.
|
|
Consider either changing the ownership of
|
|
\fI@sysconfdir@/sudoers\fR
|
|
or adding an argument like
|
|
\(Lqsudoers_uid=N\(Rq
|
|
(where
|
|
\(oqN\(cq
|
|
is the user ID that owns the
|
|
\fIsudoers\fR
|
|
file) to the end of the
|
|
\fBsudoers\fR
|
|
\fRPlugin\fR
|
|
line in the
|
|
sudo.conf(@mansectform@)
|
|
file.
|
|
.TP 3n
|
|
unable to stat @sysconfdir@/sudoers
|
|
The
|
|
\fI@sysconfdir@/sudoers\fR
|
|
file is missing.
|
|
.TP 3n
|
|
@sysconfdir@/sudoers is not a regular file
|
|
The
|
|
\fI@sysconfdir@/sudoers\fR
|
|
file exists but is not a regular file or symbolic link.
|
|
.TP 3n
|
|
@sysconfdir@/sudoers is owned by uid N, should be 0
|
|
The
|
|
\fIsudoers\fR
|
|
file has the wrong owner.
|
|
If you wish to change the
|
|
\fIsudoers\fR
|
|
file owner, please add
|
|
\(Lqsudoers_uid=N\(Rq
|
|
(where
|
|
\(oqN\(cq
|
|
is the user ID that owns the
|
|
\fIsudoers\fR
|
|
file) to the
|
|
\fBsudoers\fR
|
|
\fRPlugin\fR
|
|
line in the
|
|
sudo.conf(@mansectform@)
|
|
file.
|
|
.TP 3n
|
|
@sysconfdir@/sudoers is world writable
|
|
The permissions on the
|
|
\fIsudoers\fR
|
|
file allow all users to write to it.
|
|
The
|
|
\fIsudoers\fR
|
|
file must not be world-writable, the default file mode
|
|
is 0440 (readable by owner and group, writable by none).
|
|
The default mode may be changed via the
|
|
\(Lqsudoers_mode\(Rq
|
|
option to the
|
|
\fBsudoers\fR
|
|
\fRPlugin\fR
|
|
line in the
|
|
sudo.conf(@mansectform@)
|
|
file.
|
|
.TP 3n
|
|
@sysconfdir@/sudoers is owned by gid N, should be 1
|
|
The
|
|
\fIsudoers\fR
|
|
file has the wrong group ownership.
|
|
If you wish to change the
|
|
\fIsudoers\fR
|
|
file group ownership, please add
|
|
\(Lqsudoers_gid=N\(Rq
|
|
(where
|
|
\(oqN\(cq
|
|
is the group ID that owns the
|
|
\fIsudoers\fR
|
|
file) to the
|
|
\fBsudoers\fR
|
|
\fRPlugin\fR
|
|
line in the
|
|
sudo.conf(@mansectform@)
|
|
file.
|
|
.TP 3n
|
|
unable to open @rundir@/ts/username
|
|
\fBsudoers\fR
|
|
was unable to read or create the user's time stamp file.
|
|
This can happen when
|
|
\fItimestampowner\fR
|
|
is set to a user other than root and the mode on
|
|
\fI@rundir@\fR
|
|
is not searchable by group or other.
|
|
The default mode for
|
|
\fI@rundir@\fR
|
|
is 0711.
|
|
.TP 3n
|
|
unable to write to @rundir@/ts/username
|
|
\fBsudoers\fR
|
|
was unable to write to the user's time stamp file.
|
|
.TP 3n
|
|
@rundir@/ts is owned by uid X, should be Y
|
|
The time stamp directory is owned by a user other than
|
|
\fItimestampowner\fR.
|
|
This can occur when the value of
|
|
\fItimestampowner\fR
|
|
has been changed.
|
|
\fBsudoers\fR
|
|
will ignore the time stamp directory until the owner is corrected.
|
|
.TP 3n
|
|
@rundir@/ts is group writable
|
|
The time stamp directory is group-writable; it should be writable only by
|
|
\fItimestampowner\fR.
|
|
The default mode for the time stamp directory is 0700.
|
|
\fBsudoers\fR
|
|
will ignore the time stamp directory until the mode is corrected.
|
|
.SS "Notes on logging via syslog"
|
|
By default,
|
|
\fBsudoers\fR
|
|
logs messages via
|
|
syslog(3).
|
|
The
|
|
\fIdate\fR,
|
|
\fIhostname\fR,
|
|
and
|
|
\fIprogname\fR
|
|
fields are added by the system's
|
|
\fBsyslog\fR()
|
|
function, not
|
|
\fBsudoers\fR
|
|
itself.
|
|
As such, they may vary in format on different systems.
|
|
.PP
|
|
The maximum size of syslog messages varies from system to system.
|
|
The
|
|
\fIsyslog_maxlen\fR
|
|
setting can be used to change the maximum syslog message size
|
|
from the default value of 980 bytes.
|
|
For more information, see the description of
|
|
\fIsyslog_maxlen\fR.
|
|
.SS "Notes on logging to a file"
|
|
If the
|
|
\fIlogfile\fR
|
|
option is set,
|
|
\fBsudoers\fR
|
|
will log to a local file, such as
|
|
\fI/var/log/sudo\fR.
|
|
When logging to a file,
|
|
\fBsudoers\fR
|
|
uses a format similar to
|
|
syslog(3),
|
|
with a few important differences:
|
|
.TP 5n
|
|
1.\&
|
|
The
|
|
\fIprogname\fR
|
|
and
|
|
\fIhostname\fR
|
|
fields are not present.
|
|
.TP 5n
|
|
2.\&
|
|
If the
|
|
\fIlog_year\fR
|
|
option is enabled,
|
|
the date will also include the year.
|
|
.TP 5n
|
|
3.\&
|
|
Lines that are longer than
|
|
\fIloglinelen\fR
|
|
characters (80 by default) are word-wrapped and continued on the
|
|
next line with a four character indent.
|
|
This makes entries easier to read for a human being, but makes it
|
|
more difficult to use
|
|
grep(1)
|
|
on the log files.
|
|
If the
|
|
\fIloglinelen\fR
|
|
option is set to 0 (or negated with a
|
|
\(oq\&!\(cq),
|
|
word wrap will be disabled.
|
|
.SH "I/O LOG FILES"
|
|
When I/O logging is enabled,
|
|
\fBsudo\fR
|
|
will run the command in a pseudo-tty and log all user input and/or output.
|
|
I/O is logged to the directory specified by the
|
|
\fIiolog_dir\fR
|
|
option
|
|
(\fI@iolog_dir@\fR
|
|
by default)
|
|
using a unique session ID that is included in the
|
|
\fBsudo\fR
|
|
log line, prefixed with
|
|
\(Lq\fRTSID=\fR\(Rq.
|
|
The
|
|
\fIiolog_file\fR
|
|
option may be used to control the format of the session ID.
|
|
.PP
|
|
Each I/O log is stored in a separate directory that contains the
|
|
following files:
|
|
.TP 10n
|
|
\fIlog\fR
|
|
a text file containing the time the command was run, the name of the user
|
|
who ran
|
|
\fBsudo\fR,
|
|
the name of the target user, the name of the target group (optional),
|
|
the terminal that
|
|
\fBsudo\fR
|
|
was run from, the number of rows and columns of the terminal,
|
|
the working directory the command was run from and the path name of
|
|
the command itself (with arguments if present)
|
|
.TP 10n
|
|
\fItiming\fR
|
|
a log of the amount of time between, and the number of bytes in, each
|
|
I/O log entry (used for session playback)
|
|
.TP 10n
|
|
\fIttyin\fR
|
|
input from the user's tty (what the user types)
|
|
.TP 10n
|
|
\fIstdin\fR
|
|
input from a pipe or file
|
|
.TP 10n
|
|
\fIttyout\fR
|
|
output from the pseudo-tty (what the command writes to the screen)
|
|
.TP 10n
|
|
\fIstdout\fR
|
|
standard output to a pipe or redirected to a file
|
|
.TP 10n
|
|
\fIstderr\fR
|
|
standard error to a pipe or redirected to a file
|
|
.PP
|
|
All files other than
|
|
\fIlog\fR
|
|
are compressed in gzip format unless the
|
|
\fIcompress_io\fR
|
|
option has been disabled.
|
|
Due to buffering, the I/O log data will not be complete until the
|
|
\fBsudo\fR
|
|
command has completed.
|
|
The output portion of an I/O log file can be viewed with the
|
|
sudoreplay(@mansectsu@)
|
|
utility, which can also be used to list or search the available logs.
|
|
.PP
|
|
Note that user input may contain sensitive information such as
|
|
passwords (even if they are not echoed to the screen), which will
|
|
be stored in the log file unencrypted.
|
|
In most cases, logging the command output via
|
|
\fIlog_output\fR
|
|
or
|
|
\fRLOG_OUTPUT\fR
|
|
is all that is required.
|
|
.PP
|
|
Since each session's I/O logs are stored in a separate directory,
|
|
traditional log rotation utilities cannot be used to limit the
|
|
number of I/O logs.
|
|
The simplest way to limit the number of I/O is by setting the
|
|
\fImaxseq\fR
|
|
option to the maximum number of logs you wish to store.
|
|
Once the I/O log sequence number reaches
|
|
\fImaxseq\fR,
|
|
it will be reset to zero and
|
|
\fBsudoers\fR
|
|
will truncate and re-use any existing I/O logs.
|
|
.SH "FILES"
|
|
.TP 26n
|
|
\fI@sysconfdir@/sudo.conf\fR
|
|
Sudo front end configuration
|
|
.TP 26n
|
|
\fI@sysconfdir@/sudoers\fR
|
|
List of who can run what
|
|
.TP 26n
|
|
\fI/etc/group\fR
|
|
Local groups file
|
|
.TP 26n
|
|
\fI/etc/netgroup\fR
|
|
List of network groups
|
|
.TP 26n
|
|
\fI@iolog_dir@\fR
|
|
I/O log files
|
|
.TP 26n
|
|
\fI@rundir@/ts\fR
|
|
Directory containing time stamps for the
|
|
\fBsudoers\fR
|
|
security policy
|
|
.TP 26n
|
|
\fI@vardir@/lectured\fR
|
|
Directory containing lecture status files for the
|
|
\fBsudoers\fR
|
|
security policy
|
|
.TP 26n
|
|
\fI/etc/environment\fR
|
|
Initial environment for
|
|
\fB\-i\fR
|
|
mode on AIX and Linux systems
|
|
.SH "EXAMPLES"
|
|
Below are example
|
|
\fIsudoers\fR
|
|
file entries.
|
|
Admittedly, some of these are a bit contrived.
|
|
First, we allow a few environment variables to pass and then define our
|
|
\fIaliases\fR:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
# Run X applications through sudo; HOME is used to find the
|
|
# .Xauthority file. Note that other programs use HOME to find
|
|
# configuration files and this may lead to privilege escalation!
|
|
Defaults env_keep += "DISPLAY HOME"
|
|
|
|
# User alias specification
|
|
User_Alias FULLTIMERS = millert, mikef, dowdy
|
|
User_Alias PARTTIMERS = bostley, jwfox, crawl
|
|
User_Alias WEBMASTERS = will, wendy, wim
|
|
|
|
# Runas alias specification
|
|
Runas_Alias OP = root, operator
|
|
Runas_Alias DB = oracle, sybase
|
|
Runas_Alias ADMINGRP = adm, oper
|
|
|
|
# Host alias specification
|
|
Host_Alias SPARC = bigtime, eclipse, moet, anchor :\e
|
|
SGI = grolsch, dandelion, black :\e
|
|
ALPHA = widget, thalamus, foobar :\e
|
|
HPPA = boa, nag, python
|
|
Host_Alias CUNETS = 128.138.0.0/255.255.0.0
|
|
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
|
|
Host_Alias SERVERS = master, mail, www, ns
|
|
Host_Alias CDROM = orion, perseus, hercules
|
|
|
|
# Cmnd alias specification
|
|
Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\e
|
|
/usr/sbin/restore, /usr/sbin/rrestore,\e
|
|
sha224:0GomF8mNN3wlDt1HD9XldjJ3SNgpFdbjO1+NsQ== \e
|
|
/home/operator/bin/start_backups
|
|
Cmnd_Alias KILL = /usr/bin/kill
|
|
Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
|
|
Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
|
|
Cmnd_Alias HALT = /usr/sbin/halt
|
|
Cmnd_Alias REBOOT = /usr/sbin/reboot
|
|
Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh,\e
|
|
/usr/local/bin/tcsh, /usr/bin/rsh,\e
|
|
/usr/local/bin/zsh
|
|
Cmnd_Alias SU = /usr/bin/su
|
|
Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Here we override some of the compiled in default values.
|
|
We want
|
|
\fBsudo\fR
|
|
to log via
|
|
syslog(3)
|
|
using the
|
|
\fIauth\fR
|
|
facility in all cases.
|
|
We don't want to subject the full time staff to the
|
|
\fBsudo\fR
|
|
lecture, user
|
|
\fBmillert\fR
|
|
need not give a password, and we don't want to reset the
|
|
\fRLOGNAME\fR,
|
|
\fRUSER\fR
|
|
or
|
|
\fRUSERNAME\fR
|
|
environment variables when running commands as root.
|
|
Additionally, on the machines in the
|
|
\fISERVERS\fR
|
|
\fRHost_Alias\fR,
|
|
we keep an additional local log file and make sure we log the year
|
|
in each log line since the log entries will be kept around for several years.
|
|
Lastly, we disable shell escapes for the commands in the PAGERS
|
|
\fRCmnd_Alias\fR
|
|
(\fI/usr/bin/more\fR,
|
|
\fI/usr/bin/pg\fR
|
|
and
|
|
\fI/usr/bin/less\fR)
|
|
\&.
|
|
Note that this will not effectively constrain users with
|
|
\fBsudo\fR
|
|
\fBALL\fR
|
|
privileges.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
# Override built-in defaults
|
|
Defaults syslog=auth
|
|
Defaults>root !set_logname
|
|
Defaults:FULLTIMERS !lecture
|
|
Defaults:millert !authenticate
|
|
Defaults@SERVERS log_year, logfile=/var/log/sudo.log
|
|
Defaults!PAGERS noexec
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The
|
|
\fIUser specification\fR
|
|
is the part that actually determines who may run what.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
root ALL = (ALL) ALL
|
|
%wheel ALL = (ALL) ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
We let
|
|
\fBroot\fR
|
|
and any user in group
|
|
\fBwheel\fR
|
|
run any command on any host as any user.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
FULLTIMERS ALL = NOPASSWD: ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Full time sysadmins
|
|
(\fBmillert\fR,
|
|
\fBmikef\fR,
|
|
and
|
|
\fBdowdy\fR)
|
|
may run any command on any host without authenticating themselves.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
PARTTIMERS ALL = ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Part time sysadmins
|
|
\fBbostley\fR,
|
|
\fBjwfox\fR,
|
|
and
|
|
\fBcrawl\fR)
|
|
may run any command on any host but they must authenticate themselves
|
|
first (since the entry lacks the
|
|
\fRNOPASSWD\fR
|
|
tag).
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
jack CSNETS = ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The user
|
|
\fBjack\fR
|
|
may run any command on the machines in the
|
|
\fICSNETS\fR
|
|
alias (the networks
|
|
\fR128.138.243.0\fR,
|
|
\fR128.138.204.0\fR,
|
|
and
|
|
\fR128.138.242.0\fR).
|
|
Of those networks, only
|
|
\fR128.138.204.0\fR
|
|
has an explicit netmask (in CIDR notation) indicating it is a class C network.
|
|
For the other networks in
|
|
\fICSNETS\fR,
|
|
the local machine's netmask will be used during matching.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
lisa CUNETS = ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The user
|
|
\fBlisa\fR
|
|
may run any command on any host in the
|
|
\fICUNETS\fR
|
|
alias (the class B network
|
|
\fR128.138.0.0\fR).
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\e
|
|
sudoedit /etc/printcap, /usr/oper/bin/
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The
|
|
\fBoperator\fR
|
|
user may run commands limited to simple maintenance.
|
|
Here, those are commands related to backups, killing processes, the
|
|
printing system, shutting down the system, and any commands in the
|
|
directory
|
|
\fI/usr/oper/bin/\fR.
|
|
Note that one command in the
|
|
\fRDUMPS\fR
|
|
Cmnd_Alias includes a sha224 digest,
|
|
\fI/home/operator/bin/start_backups\fR.
|
|
This is because the directory containing the script is writable by the
|
|
operator user.
|
|
If the script is modified (resulting in a digest mismatch) it will no longer
|
|
be possible to run it via
|
|
\fBsudo\fR.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
joe ALL = /usr/bin/su operator
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The user
|
|
\fBjoe\fR
|
|
may only
|
|
su(1)
|
|
to operator.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
pete HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root
|
|
|
|
%opers ALL = (: ADMINGRP) /usr/sbin/
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Users in the
|
|
\fBopers\fR
|
|
group may run commands in
|
|
\fI/usr/sbin/\fR
|
|
as themselves
|
|
with any group in the
|
|
\fIADMINGRP\fR
|
|
\fRRunas_Alias\fR
|
|
(the
|
|
\fBadm\fR
|
|
and
|
|
\fBoper\fR
|
|
groups).
|
|
.PP
|
|
The user
|
|
\fBpete\fR
|
|
is allowed to change anyone's password except for
|
|
root on the
|
|
\fIHPPA\fR
|
|
machines.
|
|
Because command line arguments are matched as a single,
|
|
concatenated string, the
|
|
\(oq*\(cq
|
|
wildcard will match
|
|
\fImultiple\fR
|
|
words.
|
|
This example assumes that
|
|
passwd(1)
|
|
does not take multiple user names on the command line.
|
|
Note that on GNU systems, options to
|
|
passwd(1)
|
|
may be specified after the user argument.
|
|
As a result, this rule will also allow:
|
|
.nf
|
|
.sp
|
|
.RS 4n
|
|
passwd username --expire
|
|
.RE
|
|
.fi
|
|
.PP
|
|
which may not be desirable.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
bob SPARC = (OP) ALL : SGI = (OP) ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The user
|
|
\fBbob\fR
|
|
may run anything on the
|
|
\fISPARC\fR
|
|
and
|
|
\fISGI\fR
|
|
machines as any user listed in the
|
|
\fIOP\fR
|
|
\fRRunas_Alias\fR
|
|
(\fBroot\fR
|
|
and
|
|
\fBoperator\fR.)
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
jim +biglab = ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The user
|
|
\fBjim\fR
|
|
may run any command on machines in the
|
|
\fIbiglab\fR
|
|
netgroup.
|
|
\fBsudo\fR
|
|
knows that
|
|
\(Lqbiglab\(Rq
|
|
is a netgroup due to the
|
|
\(oq+\(cq
|
|
prefix.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
+secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Users in the
|
|
\fBsecretaries\fR
|
|
netgroup need to help manage the printers as well as add and remove users,
|
|
so they are allowed to run those commands on all machines.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
fred ALL = (DB) NOPASSWD: ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The user
|
|
\fBfred\fR
|
|
can run commands as any user in the
|
|
\fIDB\fR
|
|
\fRRunas_Alias\fR
|
|
(\fBoracle\fR
|
|
or
|
|
\fBsybase\fR)
|
|
without giving a password.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
|
|
.RE
|
|
.fi
|
|
.PP
|
|
On the
|
|
\fIALPHA\fR
|
|
machines, user
|
|
\fBjohn\fR
|
|
may su to anyone except root but he is not allowed to specify any options
|
|
to the
|
|
su(1)
|
|
command.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
jen ALL, !SERVERS = ALL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The user
|
|
\fBjen\fR
|
|
may run any command on any machine except for those in the
|
|
\fISERVERS\fR
|
|
\fRHost_Alias\fR
|
|
(master, mail, www and ns).
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
jill SERVERS = /usr/bin/, !SU, !SHELLS
|
|
.RE
|
|
.fi
|
|
.PP
|
|
For any machine in the
|
|
\fISERVERS\fR
|
|
\fRHost_Alias\fR,
|
|
\fBjill\fR
|
|
may run
|
|
any commands in the directory
|
|
\fI/usr/bin/\fR
|
|
except for those commands
|
|
belonging to the
|
|
\fISU\fR
|
|
and
|
|
\fISHELLS\fR
|
|
\fRCmnd_Aliases\fR.
|
|
While not specifically mentioned in the rule, the commands in the
|
|
\fIPAGERS\fR
|
|
\fRCmnd_Alias\fR
|
|
all reside in
|
|
\fI/usr/bin\fR
|
|
and have the
|
|
\fInoexec\fR
|
|
option set.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
steve CSNETS = (operator) /usr/local/op_commands/
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The user
|
|
\fBsteve\fR
|
|
may run any command in the directory /usr/local/op_commands/
|
|
but only as user operator.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
matt valkyrie = KILL
|
|
.RE
|
|
.fi
|
|
.PP
|
|
On his personal workstation, valkyrie,
|
|
\fBmatt\fR
|
|
needs to be able to kill hung processes.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
|
|
.RE
|
|
.fi
|
|
.PP
|
|
On the host www, any user in the
|
|
\fIWEBMASTERS\fR
|
|
\fRUser_Alias\fR
|
|
(will, wendy, and wim), may run any command as user www (which owns the
|
|
web pages) or simply
|
|
su(1)
|
|
to www.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\e
|
|
/sbin/mount -o nosuid\e,nodev /dev/cd0a /CDROM
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Any user may mount or unmount a CD-ROM on the machines in the CDROM
|
|
\fRHost_Alias\fR
|
|
(orion, perseus, hercules) without entering a password.
|
|
This is a bit tedious for users to type, so it is a prime candidate
|
|
for encapsulating in a shell script.
|
|
.SH "SECURITY NOTES"
|
|
.SS "Limitations of the \(oq!\&\(cq operator"
|
|
It is generally not effective to
|
|
\(Lqsubtract\(Rq
|
|
commands from
|
|
\fBALL\fR
|
|
using the
|
|
\(oq!\&\(cq
|
|
operator.
|
|
A user can trivially circumvent this by copying the desired command
|
|
to a different name and then executing that.
|
|
For example:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
bill ALL = ALL, !SU, !SHELLS
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Doesn't really prevent
|
|
\fBbill\fR
|
|
from running the commands listed in
|
|
\fISU\fR
|
|
or
|
|
\fISHELLS\fR
|
|
since he can simply copy those commands to a different name, or use
|
|
a shell escape from an editor or other program.
|
|
Therefore, these kind of restrictions should be considered
|
|
advisory at best (and reinforced by policy).
|
|
.PP
|
|
In general, if a user has sudo
|
|
\fBALL\fR
|
|
there is nothing to prevent them from creating their own program that gives
|
|
them a root shell (or making their own copy of a shell) regardless of any
|
|
\(oq!\&\(cq
|
|
elements in the user specification.
|
|
.SS "Security implications of \fIfast_glob\fR"
|
|
If the
|
|
\fIfast_glob\fR
|
|
option is in use, it is not possible to reliably negate commands where the
|
|
path name includes globbing (aka wildcard) characters.
|
|
This is because the C library's
|
|
fnmatch(3)
|
|
function cannot resolve relative paths.
|
|
While this is typically only an inconvenience for rules that grant privileges,
|
|
it can result in a security issue for rules that subtract or revoke privileges.
|
|
.PP
|
|
For example, given the following
|
|
\fIsudoers\fR
|
|
file entry:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
john ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,\e
|
|
/usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
|
|
.RE
|
|
.fi
|
|
.PP
|
|
User
|
|
\fBjohn\fR
|
|
can still run
|
|
\fR/usr/bin/passwd root\fR
|
|
if
|
|
\fIfast_glob\fR
|
|
is enabled by changing to
|
|
\fI/usr/bin\fR
|
|
and running
|
|
\fR./passwd root\fR
|
|
instead.
|
|
.SS "Preventing shell escapes"
|
|
Once
|
|
\fBsudo\fR
|
|
executes a program, that program is free to do whatever
|
|
it pleases, including run other programs.
|
|
This can be a security issue since it is not uncommon for a program to
|
|
allow shell escapes, which lets a user bypass
|
|
\fBsudo\fR's
|
|
access control and logging.
|
|
Common programs that permit shell escapes include shells (obviously),
|
|
editors, paginators, mail and terminal programs.
|
|
.PP
|
|
There are two basic approaches to this problem:
|
|
.TP 10n
|
|
restrict
|
|
Avoid giving users access to commands that allow the user to run
|
|
arbitrary commands.
|
|
Many editors have a restricted mode where shell
|
|
escapes are disabled, though
|
|
\fBsudoedit\fR
|
|
is a better solution to
|
|
running editors via
|
|
\fBsudo\fR.
|
|
Due to the large number of programs that
|
|
offer shell escapes, restricting users to the set of programs that
|
|
do not is often unworkable.
|
|
.TP 10n
|
|
noexec
|
|
Many systems that support shared libraries have the ability to
|
|
override default library functions by pointing an environment
|
|
variable (usually
|
|
\fRLD_PRELOAD\fR)
|
|
to an alternate shared library.
|
|
On such systems,
|
|
\fBsudo\fR's
|
|
\fInoexec\fR
|
|
functionality can be used to prevent a program run by
|
|
\fBsudo\fR
|
|
from executing any other programs.
|
|
Note, however, that this applies only to native dynamically-linked
|
|
executables.
|
|
Statically-linked executables and foreign executables
|
|
running under binary emulation are not affected.
|
|
.sp
|
|
The
|
|
\fInoexec\fR
|
|
feature is known to work on SunOS, Solaris, *BSD,
|
|
Linux, IRIX, Tru64 UNIX, MacOS X, HP-UX 11.x and AIX 5.3 and above.
|
|
It should be supported on most operating systems that support the
|
|
\fRLD_PRELOAD\fR
|
|
environment variable.
|
|
Check your operating system's manual pages for the dynamic linker
|
|
(usually ld.so, ld.so.1, dyld, dld.sl, rld, or loader) to see if
|
|
\fRLD_PRELOAD\fR
|
|
is supported.
|
|
.sp
|
|
On Solaris 10 and higher,
|
|
\fInoexec\fR
|
|
uses Solaris privileges instead of the
|
|
\fRLD_PRELOAD\fR
|
|
environment variable.
|
|
.sp
|
|
To enable
|
|
\fInoexec\fR
|
|
for a command, use the
|
|
\fRNOEXEC\fR
|
|
tag as documented
|
|
in the User Specification section above.
|
|
Here is that example again:
|
|
.nf
|
|
.sp
|
|
.RS 10n
|
|
aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
|
|
.RE
|
|
.fi
|
|
.RS 10n
|
|
.sp
|
|
This allows user
|
|
\fBaaron\fR
|
|
to run
|
|
\fI/usr/bin/more\fR
|
|
and
|
|
\fI/usr/bin/vi\fR
|
|
with
|
|
\fInoexec\fR
|
|
enabled.
|
|
This will prevent those two commands from
|
|
executing other commands (such as a shell).
|
|
If you are unsure whether or not your system is capable of supporting
|
|
\fInoexec\fR
|
|
you can always just try it out and check whether shell escapes work when
|
|
\fInoexec\fR
|
|
is enabled.
|
|
.RE
|
|
.PP
|
|
Note that restricting shell escapes is not a panacea.
|
|
Programs running as root are still capable of many potentially hazardous
|
|
operations (such as changing or overwriting files) that could lead
|
|
to unintended privilege escalation.
|
|
In the specific case of an editor, a safer approach is to give the
|
|
user permission to run
|
|
\fBsudoedit\fR
|
|
(see below).
|
|
.SS "Secure editing"
|
|
The
|
|
\fBsudoers\fR
|
|
plugin includes
|
|
\fBsudoedit\fR
|
|
support which allows users to securely edit files with the editor
|
|
of their choice.
|
|
As
|
|
\fBsudoedit\fR
|
|
is a built-in command, it must be specified in the
|
|
\fIsudoers\fR
|
|
file without a leading path.
|
|
However, it may take command line arguments just as a normal command does.
|
|
Wildcards used in
|
|
\fIsudoedit\fR
|
|
command line arguments are expected to be path names, so a forward slash
|
|
(\(oq/\(cq)
|
|
will not be matched by a wildcard.
|
|
.PP
|
|
Unlike other
|
|
\fBsudo\fR
|
|
commands, the editor is run with the permissions of the invoking
|
|
user and with the environment unmodified.
|
|
More information may be found in the description of the
|
|
\fB\-e\fR
|
|
option in
|
|
sudo(@mansectsu@).
|
|
.PP
|
|
For example, to allow user operator to edit the
|
|
\(Lqmessage of the day\(Rq
|
|
file:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
operator sudoedit /etc/motd
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The operator user then runs
|
|
\fBsudoedit\fR
|
|
as follows:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
$ sudoedit /etc/motd
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The editor will run as the operator user, not root, on a temporary copy of
|
|
\fI/etc/motd\fR.
|
|
After the file has been edited,
|
|
\fI/etc/motd\fR
|
|
will be updated with the contents of the temporary copy.
|
|
.PP
|
|
Users should
|
|
\fInever\fR
|
|
be granted
|
|
\fBsudoedit\fR
|
|
permission to edit a file that resides in a directory the user
|
|
has write access to, either directly or via a wildcard.
|
|
If the user has write access to the directory it is possible to
|
|
replace the legitimate file with a link to another file,
|
|
allowing the editing of arbitrary files.
|
|
To prevent this, starting with version 1.8.16, symbolic links will
|
|
not be followed in writable directories and
|
|
\fBsudoedit\fR
|
|
will refuse to edit a file located in a writable directory
|
|
unless the
|
|
\fIsudoedit_checkdir\fR
|
|
option has been disabled or the invoking user is root.
|
|
Additionally, in version 1.8.15 and higher,
|
|
\fBsudoedit\fR
|
|
will refuse to open a symbolic link unless either the
|
|
\fIsudoedit_follow\fR
|
|
option is enabled or the
|
|
\fIsudoedit\fR
|
|
command is prefixed with the
|
|
\fRFOLLOW\fR
|
|
tag in the
|
|
\fIsudoers\fR
|
|
file.
|
|
.SS "Time stamp file checks"
|
|
\fBsudoers\fR
|
|
will check the ownership of its time stamp directory
|
|
(\fI@rundir@/ts\fR
|
|
by default)
|
|
and ignore the directory's contents if it is not owned by root or
|
|
if it is writable by a user other than root.
|
|
Older versions of
|
|
\fBsudo\fR
|
|
stored time stamp files in
|
|
\fI/tmp\fR;
|
|
this is no longer recommended as it may be possible for a user
|
|
to create the time stamp themselves on systems that allow
|
|
unprivileged users to change the ownership of files they create.
|
|
.PP
|
|
While the time stamp directory
|
|
\fIshould\fR
|
|
be cleared at reboot time, not all systems contain a
|
|
\fI/var/run\fR
|
|
directory.
|
|
To avoid potential problems,
|
|
\fBsudoers\fR
|
|
will ignore time stamp files that date from before the machine booted
|
|
on systems where the boot time is available.
|
|
.PP
|
|
Some systems with graphical desktop environments allow unprivileged
|
|
users to change the system clock.
|
|
Since
|
|
\fBsudoers\fR
|
|
relies on the system clock for time stamp validation, it may be
|
|
possible on such systems for a user to run
|
|
\fBsudo\fR
|
|
for longer than
|
|
\fItimestamp_timeout\fR
|
|
by setting the clock back.
|
|
To combat this,
|
|
\fBsudoers\fR
|
|
uses a monotonic clock (which never moves backwards) for its time stamps
|
|
if the system supports it.
|
|
.PP
|
|
\fBsudoers\fR
|
|
will not honor time stamps set far in the future.
|
|
Time stamps with a date greater than current_time + 2 *
|
|
\fRTIMEOUT\fR
|
|
will be ignored and
|
|
\fBsudoers\fR
|
|
will log and complain.
|
|
.PP
|
|
Since time stamp files live in the file system, they can outlive a
|
|
user's login session.
|
|
As a result, a user may be able to login, run a command with
|
|
\fBsudo\fR
|
|
after authenticating, logout, login again, and run
|
|
\fBsudo\fR
|
|
without authenticating so long as the record's time stamp is within
|
|
\fR@timeout@\fR
|
|
minutes (or whatever value the timeout is set to in the
|
|
\fIsudoers\fR
|
|
file).
|
|
When the
|
|
\fItty_tickets\fR
|
|
option is enabled, the time stamp record includes the device
|
|
number of the terminal the user authenticated with.
|
|
This provides per-tty granularity but time stamp records still
|
|
may outlive the user's session.
|
|
The time stamp record also includes the session ID of the process
|
|
that last authenticated.
|
|
This prevents processes in different terminal sessions from using
|
|
the same time stamp record.
|
|
It also helps reduce the chance that a user will be able to run
|
|
\fBsudo\fR
|
|
without entering a password when logging out and back in again
|
|
on the same terminal.
|
|
.SH "DEBUGGING"
|
|
Versions 1.8.4 and higher of the
|
|
\fBsudoers\fR
|
|
plugin support a flexible debugging framework that can help track
|
|
down what the plugin is doing internally if there is a problem.
|
|
This can be configured in the
|
|
sudo.conf(@mansectform@)
|
|
file.
|
|
.PP
|
|
The
|
|
\fBsudoers\fR
|
|
plugin uses the same debug flag format as the
|
|
\fBsudo\fR
|
|
front-end:
|
|
\fIsubsystem\fR@\fIpriority\fR.
|
|
.PP
|
|
The priorities used by
|
|
\fBsudoers\fR,
|
|
in order of decreasing severity,
|
|
are:
|
|
\fIcrit\fR, \fIerr\fR, \fIwarn\fR, \fInotice\fR, \fIdiag\fR, \fIinfo\fR, \fItrace\fR
|
|
and
|
|
\fIdebug\fR.
|
|
Each priority, when specified, also includes all priorities higher
|
|
than it.
|
|
For example, a priority of
|
|
\fInotice\fR
|
|
would include debug messages logged at
|
|
\fInotice\fR
|
|
and higher.
|
|
.PP
|
|
The following subsystems are used by the
|
|
\fBsudoers\fR
|
|
plugin:
|
|
.TP 10n
|
|
\fIalias\fR
|
|
\fRUser_Alias\fR,
|
|
\fRRunas_Alias\fR,
|
|
\fRHost_Alias\fR
|
|
and
|
|
\fRCmnd_Alias\fR
|
|
processing
|
|
.TP 10n
|
|
\fIall\fR
|
|
matches every subsystem
|
|
.TP 10n
|
|
\fIaudit\fR
|
|
BSM and Linux audit code
|
|
.TP 10n
|
|
\fIauth\fR
|
|
user authentication
|
|
.TP 10n
|
|
\fIdefaults\fR
|
|
\fIsudoers\fR
|
|
file
|
|
\fIDefaults\fR
|
|
settings
|
|
.TP 10n
|
|
\fIenv\fR
|
|
environment handling
|
|
.TP 10n
|
|
\fIldap\fR
|
|
LDAP-based sudoers
|
|
.TP 10n
|
|
\fIlogging\fR
|
|
logging support
|
|
.TP 10n
|
|
\fImatch\fR
|
|
matching of users, groups, hosts and netgroups in the
|
|
\fIsudoers\fR
|
|
file
|
|
.TP 10n
|
|
\fInetif\fR
|
|
network interface handling
|
|
.TP 10n
|
|
\fInss\fR
|
|
network service switch handling in
|
|
\fBsudoers\fR
|
|
.TP 10n
|
|
\fIparser\fR
|
|
\fIsudoers\fR
|
|
file parsing
|
|
.TP 10n
|
|
\fIperms\fR
|
|
permission setting
|
|
.TP 10n
|
|
\fIplugin\fR
|
|
The equivalent of
|
|
\fImain\fR
|
|
for the plugin.
|
|
.TP 10n
|
|
\fIpty\fR
|
|
pseudo-tty related code
|
|
.TP 10n
|
|
\fIrbtree\fR
|
|
redblack tree internals
|
|
.TP 10n
|
|
\fIsssd\fR
|
|
SSSD-based sudoers
|
|
.TP 10n
|
|
\fIutil\fR
|
|
utility functions
|
|
.PD 0
|
|
.PP
|
|
For example:
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
Debug sudo /var/log/sudo_debug match@info,nss@info
|
|
.RE
|
|
.fi
|
|
.PD
|
|
.PP
|
|
For more information, see the
|
|
sudo.conf(@mansectform@)
|
|
manual.
|
|
.SH "SEE ALSO"
|
|
ssh(1),
|
|
su(1),
|
|
fnmatch(3),
|
|
glob(3),
|
|
mktemp(3),
|
|
strftime(3),
|
|
sudo.conf(@mansectform@),
|
|
sudoers.ldap(@mansectform@),
|
|
sudo(@mansectsu@),
|
|
sudo_plugin(@mansectsu@),
|
|
visudo(@mansectsu@)
|
|
.SH "AUTHORS"
|
|
Many people have worked on
|
|
\fBsudo\fR
|
|
over the years; this version consists of code written primarily by:
|
|
.sp
|
|
.RS 6n
|
|
Todd C. Miller
|
|
.RE
|
|
.PP
|
|
See the CONTRIBUTORS file in the
|
|
\fBsudo\fR
|
|
distribution (https://www.sudo.ws/contributors.html) for an
|
|
exhaustive list of people who have contributed to
|
|
\fBsudo\fR.
|
|
.SH "CAVEATS"
|
|
The
|
|
\fIsudoers\fR
|
|
file should
|
|
\fBalways\fR
|
|
be edited by the
|
|
\fBvisudo\fR
|
|
command which locks the file and does grammatical checking.
|
|
It is
|
|
imperative that the
|
|
\fIsudoers\fR
|
|
file be free of syntax errors since
|
|
\fBsudo\fR
|
|
will not run with a syntactically incorrect
|
|
\fIsudoers\fR
|
|
file.
|
|
.PP
|
|
When using netgroups of machines (as opposed to users), if you
|
|
store fully qualified host name in the netgroup (as is usually the
|
|
case), you either need to have the machine's host name be fully qualified
|
|
as returned by the
|
|
\fRhostname\fR
|
|
command or use the
|
|
\fIfqdn\fR
|
|
option in
|
|
\fIsudoers\fR.
|
|
.SH "BUGS"
|
|
If you feel you have found a bug in
|
|
\fBsudo\fR,
|
|
please submit a bug report at https://bugzilla.sudo.ws/
|
|
.SH "SUPPORT"
|
|
Limited free support is available via the sudo-users mailing list,
|
|
see https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
|
|
search the archives.
|
|
.SH "DISCLAIMER"
|
|
\fBsudo\fR
|
|
is provided
|
|
\(LqAS IS\(Rq
|
|
and any express or implied warranties, including, but not limited
|
|
to, the implied warranties of merchantability and fitness for a
|
|
particular purpose are disclaimed.
|
|
See the LICENSE file distributed with
|
|
\fBsudo\fR
|
|
or https://www.sudo.ws/license.html for complete details.
|