1283 lines
29 KiB
Groff
1283 lines
29 KiB
Groff
.\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
|
|
.\" IT IS GENERATED AUTOMATICALLY FROM sudo.mdoc.in
|
|
.\"
|
|
.\" Copyright (c) 1994-1996, 1998-2005, 2007-2012
|
|
.\" Todd C. Miller <Todd.Miller@courtesan.com>
|
|
.\"
|
|
.\" Permission to use, copy, modify, and distribute this software for any
|
|
.\" purpose with or without fee is hereby granted, provided that the above
|
|
.\" copyright notice and this permission notice appear in all copies.
|
|
.\"
|
|
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
.\"
|
|
.\" Sponsored in part by the Defense Advanced Research Projects
|
|
.\" Agency (DARPA) and Air Force Research Laboratory, Air Force
|
|
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
|
|
.\"
|
|
.TH "SUDO" "@mansectsu@" "July 10, 2012" "1.8.6" "System Manager's Manual"
|
|
.nh
|
|
.if n .ad l
|
|
.SH "NAME"
|
|
\fBsudo\fR,
|
|
\fBsudoedit\fR
|
|
\- execute a command as another user
|
|
.SH "SYNOPSIS"
|
|
.HP 5n
|
|
\fBsudo\fR
|
|
\fB\-h\fR | \fB\-K\fR | \fB\-k\fR | \fB\-V\fR
|
|
.PD 0
|
|
.HP 5n
|
|
\fBsudo\fR
|
|
\fB\-v\fR
|
|
[\fB\-AknS\fR]
|
|
[\fB\-a\fR\ \fIauth_type\fR]
|
|
[\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
|
|
[\fB\-p\fR\ \fIprompt\fR]
|
|
[\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
|
|
.br
|
|
.HP 5n
|
|
\fBsudo\fR
|
|
\fB\-l\fR[\fIl\fR]
|
|
[\fB\-AknS\fR]
|
|
[\fB\-a\fR\ \fIauth_type\fR]
|
|
[\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
|
|
[\fB\-p\fR\ \fIprompt\fR]
|
|
[\fB\-U\fR\ \fIuser\ name\fR]
|
|
[\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
|
|
[\fIcommand\fR]
|
|
.br
|
|
.HP 5n
|
|
\fBsudo\fR
|
|
[\fB\-AbEHnPS\fR]
|
|
[\fB\-a\fR\ \fIauth_type\fR]
|
|
[\fB\-C\fR\ \fIfd\fR]
|
|
[\fB\-c\fR\ \fIclass\fR\ |\ \fI-\fR]
|
|
[\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
|
|
[\fB\-p\fR\ \fIprompt\fR]
|
|
[\fB\-r\fR\ \fIrole\fR]
|
|
[\fB\-t\fR\ \fItype\fR]
|
|
[\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
|
|
[\fBVAR\fR=\fIvalue\fR]
|
|
\fB\-i\fR\ |\ \fB\-s\fR
|
|
[\fIcommand\fR]
|
|
.br
|
|
.HP 9n
|
|
\fBsudoedit\fR
|
|
[\fB\-AnS\fR]
|
|
[\fB\-a\fR\ \fIauth_type\fR]
|
|
[\fB\-C\fR\ \fIfd\fR]
|
|
[\fB\-c\fR\ \fIclass\fR\ |\ \fI-\fR]
|
|
[\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
|
|
[\fB\-p\fR\ \fIprompt\fR]
|
|
[\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
|
|
file ...
|
|
.PD
|
|
.SH "DESCRIPTION"
|
|
\fBsudo\fR
|
|
allows a permitted user to execute a
|
|
\fIcommand\fR
|
|
as the superuser or another user, as specified by the security
|
|
policy.
|
|
The real and effective uid and gid are set to match those of the
|
|
target user, as specified in the password database, and the group
|
|
vector is initialized based on the group database (unless the
|
|
\fB\-P\fR
|
|
option was specified).
|
|
.PP
|
|
\fBsudo\fR
|
|
supports a plugin architecture for security policies and input/output
|
|
logging.
|
|
Third parties can develop and distribute their own policy and I/O
|
|
logging modules to work seamlessly with the
|
|
\fBsudo\fR
|
|
front end.
|
|
The default security policy is
|
|
\fIsudoers\fR,
|
|
which is configured via the file
|
|
\fI@sysconfdir@/sudoers\fR,
|
|
or via LDAP.
|
|
See the
|
|
\fIPLUGINS\fR
|
|
section for more information.
|
|
.PP
|
|
The security policy determines what privileges, if any, a user has
|
|
to run
|
|
\fBsudo\fR.
|
|
The policy may require that users authenticate themselves with a
|
|
password or another authentication mechanism.
|
|
If authentication is required,
|
|
\fBsudo\fR
|
|
will exit if the user's password is not entered within a configurable
|
|
time limit.
|
|
This limit is policy-specific; the default password prompt timeout
|
|
for the
|
|
\fIsudoers\fR
|
|
security policy is
|
|
\fR@password_timeout@\fR
|
|
minutes.
|
|
.PP
|
|
Security policies may support credential caching to allow the user
|
|
to run
|
|
\fBsudo\fR
|
|
again for a period of time without requiring authentication.
|
|
The
|
|
\fIsudoers\fR
|
|
policy caches credentials for
|
|
\fR@timeout@\fR
|
|
minutes, unless overridden in
|
|
sudoers(@mansectform@).
|
|
By running
|
|
\fBsudo\fR
|
|
with the
|
|
\fB\-v\fR
|
|
option, a user can update the cached credentials without running a
|
|
\fIcommand\fR.
|
|
.PP
|
|
When invoked as
|
|
\fBsudoedit\fR,
|
|
the
|
|
\fB\-e\fR
|
|
option (described below), is implied.
|
|
.PP
|
|
Security policies may log successful and failed attempts to use
|
|
\fBsudo\fR.
|
|
If an I/O plugin is configured, the running command's input and
|
|
output may be logged as well.
|
|
.SH "OPTIONS"
|
|
\fBsudo\fR
|
|
accepts the following command line options:
|
|
.TP 12n
|
|
\fB\-A\fR
|
|
Normally, if
|
|
\fBsudo\fR
|
|
requires a password, it will read it from the user's terminal.
|
|
If the
|
|
\fB\-A\fR (\fIaskpass\fR)
|
|
option is specified, a (possibly graphical) helper program is
|
|
executed to read the user's password and output the password to the
|
|
standard output.
|
|
If the
|
|
\fRSUDO_ASKPASS\fR
|
|
environment variable is set, it specifies the path to the helper
|
|
program.
|
|
Otherwise, if
|
|
\fI@sysconfdir@/sudo.conf\fR
|
|
contains a line specifying the askpass program, that value will be
|
|
used.
|
|
For example:
|
|
.nf
|
|
.sp
|
|
.RS 13n
|
|
# Path to askpass helper program
|
|
Path askpass /usr/X11R6/bin/ssh-askpass
|
|
.RE
|
|
.fi
|
|
.RS
|
|
.sp
|
|
If no askpass program is available,
|
|
\fBsudo\fR
|
|
will exit with an error.
|
|
.PP
|
|
.RE
|
|
.PD 0
|
|
.TP 12n
|
|
\fB\-a\fR \fItype\fR
|
|
The
|
|
\fB\-a\fR (\fIauthentication type\fR)
|
|
option causes
|
|
\fBsudo\fR
|
|
to use the specified authentication type when validating the user,
|
|
as allowed by
|
|
\fI/etc/login.conf\fR.
|
|
The system administrator may specify a list of sudo-specific
|
|
authentication methods by adding an
|
|
``auth-sudo''
|
|
entry in
|
|
\fI/etc/login.conf\fR.
|
|
This option is only available on systems that support BSD authentication.
|
|
.PD
|
|
.TP 12n
|
|
\fB\-b\fR
|
|
The
|
|
\fB\-b\fR (\fIbackground\fR)
|
|
option tells
|
|
\fBsudo\fR
|
|
to run the given command in the background.
|
|
Note that if you use the
|
|
\fB\-b\fR
|
|
option you cannot use shell job control to manipulate the process.
|
|
Most interactive commands will fail to work properly in background
|
|
mode.
|
|
.TP 12n
|
|
\fB\-C\fR \fIfd\fR
|
|
Normally,
|
|
\fBsudo\fR
|
|
will close all open file descriptors other than standard input,
|
|
standard output and standard error.
|
|
The
|
|
\fB\-C\fR (\fIclose from\fR)
|
|
option allows the user to specify a starting point above the standard
|
|
error (file descriptor three).
|
|
Values less than three are not permitted.
|
|
The security policy may restrict the user's ability to use the
|
|
\fB\-C\fR
|
|
option.
|
|
The
|
|
\fIsudoers\fR
|
|
policy only permits use of the
|
|
\fB\-C\fR
|
|
option when the administrator has enabled the
|
|
\fIclosefrom_override\fR
|
|
option.
|
|
.TP 12n
|
|
\fB\-c\fR \fIclass\fR
|
|
The
|
|
\fB\-c\fR (\fIclass\fR)
|
|
option causes
|
|
\fBsudo\fR
|
|
to run the specified command with resources limited by the specified
|
|
login class.
|
|
The
|
|
\fIclass\fR
|
|
argument can be either a class name as defined in
|
|
\fI/etc/login.conf\fR,
|
|
or a single
|
|
`\-'
|
|
character.
|
|
Specifying a
|
|
\fIclass\fR
|
|
of
|
|
\fR-\fR
|
|
indicates that the command should be run restricted by the default
|
|
login capabilities for the user the command is run as.
|
|
If the
|
|
\fIclass\fR
|
|
argument specifies an existing user class, the command must be run
|
|
as root, or the
|
|
\fBsudo\fR
|
|
command must be run from a shell that is already root.
|
|
This option is only available on systems with BSD login classes.
|
|
.TP 12n
|
|
\fB\-E\fR
|
|
The
|
|
\fB\-E\fR (\fIpreserve environment\fR)
|
|
option indicates to the security policy that the user wishes to
|
|
preserve their existing environment variables.
|
|
The security policy may return an error if the
|
|
\fB\-E\fR
|
|
option is specified and the user does not have permission to preserve
|
|
the environment.
|
|
.TP 12n
|
|
\fB\-e\fR
|
|
The
|
|
\fB\-e\fR (\fIedit\fR)
|
|
option indicates that, instead of running a command, the user wishes
|
|
to edit one or more files.
|
|
In lieu of a command, the string "sudoedit" is used when consulting
|
|
the security policy.
|
|
If the user is authorized by the policy, the following steps are
|
|
taken:
|
|
.RS
|
|
.TP 5n
|
|
1.
|
|
Temporary copies are made of the files to be edited with the owner
|
|
set to the invoking user.
|
|
.TP 5n
|
|
2.
|
|
The editor specified by the policy is run to edit the temporary
|
|
files.
|
|
The
|
|
\fIsudoers\fR
|
|
policy uses the
|
|
\fRSUDO_EDITOR\fR,
|
|
\fRVISUAL\fR
|
|
and
|
|
\fREDITOR\fR
|
|
environment variables (in that order).
|
|
If none of
|
|
\fRSUDO_EDITOR\fR,
|
|
\fRVISUAL\fR
|
|
or
|
|
\fREDITOR\fR
|
|
are set, the first program listed in the
|
|
\fIeditor\fR
|
|
sudoers(@mansectform@)
|
|
option is used.
|
|
.TP 5n
|
|
3.
|
|
If they have been modified, the temporary files are copied back to
|
|
their original location and the temporary versions are removed.
|
|
.RE
|
|
.RS
|
|
.PP
|
|
If the specified file does not exist, it will be created.
|
|
Note that unlike most commands run by
|
|
\fIsudo\fR,
|
|
the editor is run with the invoking user's environment unmodified.
|
|
If, for some reason,
|
|
\fBsudo\fR
|
|
is unable to update a file with its edited version, the user will
|
|
receive a warning and the edited copy will remain in a temporary
|
|
file.
|
|
.PP
|
|
.RE
|
|
.PD 0
|
|
.TP 12n
|
|
\fB\-g\fR \fIgroup\fR
|
|
Normally,
|
|
\fBsudo\fR
|
|
runs a command with the primary group set to the one specified by
|
|
the password database for the user the command is being run as (by
|
|
default, root).
|
|
The
|
|
\fB\-g\fR (\fIgroup\fR)
|
|
option causes
|
|
\fBsudo\fR
|
|
to run the command with the primary group set to
|
|
\fIgroup\fR
|
|
instead.
|
|
To specify a
|
|
\fIgid\fR
|
|
instead of a
|
|
\fIgroup name\fR,
|
|
use
|
|
\fI#gid\fR.
|
|
When running commands as a
|
|
\fIgid\fR,
|
|
many shells require that the
|
|
`#'
|
|
be escaped with a backslash
|
|
(`\e').
|
|
If no
|
|
\fB\-u\fR
|
|
option is specified, the command will be run as the invoking user
|
|
(not root).
|
|
In either case, the primary group will be set to
|
|
\fIgroup\fR.
|
|
.PD
|
|
.TP 12n
|
|
\fB\-H\fR
|
|
The
|
|
\fB\-H\fR (\fIHOME\fR)
|
|
option requests that the security policy set the
|
|
\fRHOME\fR
|
|
environment variable to the home directory of the target user (root
|
|
by default) as specified by the password database.
|
|
Depending on the policy, this may be the default behavior.
|
|
.TP 12n
|
|
\fB\-h\fR
|
|
The
|
|
\fB\-h\fR (\fIhelp\fR)
|
|
option causes
|
|
\fBsudo\fR
|
|
to print a short help message to the standard output and exit.
|
|
.TP 12n
|
|
\fB\-i\fR [\fIcommand\fR]
|
|
The
|
|
\fB\-i\fR (\fIsimulate initial login\fR)
|
|
option runs the shell specified by the password database entry of
|
|
the target user as a login shell.
|
|
This means that login-specific resource files such as
|
|
\fI.profile\fR
|
|
or
|
|
\fI.login\fR
|
|
will be read by the shell.
|
|
If a command is specified, it is passed to the shell for execution
|
|
via the shell's
|
|
\fB\-c\fR
|
|
option.
|
|
If no command is specified, an interactive shell is executed.
|
|
\fBsudo\fR
|
|
attempts to change to that user's home directory before running the
|
|
shell.
|
|
The security policy shall initialize the environment to a minimal
|
|
set of variables, similar to what is present when a user logs in.
|
|
The
|
|
\fICommand Environment\fR
|
|
section in the
|
|
sudoers(@mansectform@)
|
|
manual documents how the
|
|
\fB\-i\fR
|
|
option affects the environment in which a command is run when the
|
|
\fIsudoers\fR
|
|
policy is in use.
|
|
.TP 12n
|
|
\fB\-K\fR
|
|
The
|
|
\fB\-K\fR (sure \fIkill\fR)
|
|
option is like
|
|
\fB\-k\fR
|
|
except that it removes the user's cached credentials entirely and
|
|
may not be used in conjunction with a command or other option.
|
|
This option does not require a password.
|
|
Not all security policies support credential caching.
|
|
.TP 12n
|
|
\fB\-k\fR [\fIcommand\fR]
|
|
When used alone, the
|
|
\fB\-k\fR (\fIkill\fR)
|
|
option to
|
|
\fBsudo\fR
|
|
invalidates the user's cached credentials.
|
|
The next time
|
|
\fBsudo\fR
|
|
is run a password will be required.
|
|
This option does not require a password and was added to allow a
|
|
user to revoke
|
|
\fBsudo\fR
|
|
permissions from a
|
|
\fI.logout\fR
|
|
file.
|
|
Not all security policies support credential caching.
|
|
.sp
|
|
When used in conjunction with a command or an option that may require
|
|
a password, the
|
|
\fB\-k\fR
|
|
option will cause
|
|
\fBsudo\fR
|
|
to ignore the user's cached credentials.
|
|
As a result,
|
|
\fBsudo\fR
|
|
will prompt for a password (if one is required by the security
|
|
policy) and will not update the user's cached credentials.
|
|
.TP 12n
|
|
\fB\-l\fR[\fBl\fR] [\fIcommand\fR]
|
|
If no
|
|
\fIcommand\fR
|
|
is specified, the
|
|
\fB\-l\fR (\fIlist\fR)
|
|
option will list the allowed (and forbidden) commands for the
|
|
invoking user (or the user specified by the
|
|
\fB\-U\fR
|
|
option) on the current host.
|
|
If a
|
|
\fIcommand\fR
|
|
is specified and is permitted by the security policy, the fully-qualified
|
|
path to the command is displayed along with any command line
|
|
arguments.
|
|
If
|
|
\fIcommand\fR
|
|
is specified but not allowed,
|
|
\fBsudo\fR
|
|
will exit with a status value of 1.
|
|
If the
|
|
\fB\-l\fR
|
|
option is specified with an
|
|
\fIl\fR
|
|
argument
|
|
(i.e.\& \fB\-ll\fR),
|
|
or if
|
|
\fB\-l\fR
|
|
is specified multiple times, a longer list format is used.
|
|
.TP 12n
|
|
\fB\-n\fR
|
|
The
|
|
\fB\-n\fR (\fInon-interactive\fR)
|
|
option prevents
|
|
\fBsudo\fR
|
|
from prompting the user for a password.
|
|
If a password is required for the command to run,
|
|
\fBsudo\fR
|
|
will display an error message and exit.
|
|
.TP 12n
|
|
\fB\-P\fR
|
|
The
|
|
\fB\-P\fR (\fIpreserve group vector\fR)
|
|
option causes
|
|
\fBsudo\fR
|
|
to preserve the invoking user's group vector unaltered.
|
|
By default, the
|
|
\fIsudoers\fR
|
|
policy will initialize the group vector to the list of groups the
|
|
target user is in.
|
|
The real and effective group IDs, however, are still set to match
|
|
the target user.
|
|
.TP 12n
|
|
\fB\-p\fR \fIprompt\fR
|
|
The
|
|
\fB\-p\fR (\fIprompt\fR)
|
|
option allows you to override the default password prompt and use
|
|
a custom one.
|
|
The following percent
|
|
(`%')
|
|
escapes are supported by the
|
|
\fIsudoers\fR
|
|
policy:
|
|
.RS
|
|
.TP 4n
|
|
\fR%H\fR
|
|
expanded to the host name including the domain name (on if the
|
|
machine's host name is fully qualified or the
|
|
\fIfqdn\fR
|
|
option is set in
|
|
sudoers(@mansectform@))
|
|
.TP 4n
|
|
\fR%h\fR
|
|
expanded to the local host name without the domain name
|
|
.TP 4n
|
|
\fR%p\fR
|
|
expanded to the name of the user whose password is being requested
|
|
(respects the
|
|
\fIrootpw\fR,
|
|
\fItargetpw\fR,
|
|
and
|
|
\fIrunaspw\fR
|
|
flags in
|
|
sudoers(@mansectform@))
|
|
.TP 4n
|
|
\fR\&%U\fR
|
|
expanded to the login name of the user the command will be run as
|
|
(defaults to root unless the
|
|
\fB\-u\fR
|
|
option is also specified)
|
|
.TP 4n
|
|
\fR%u\fR
|
|
expanded to the invoking user's login name
|
|
.TP 4n
|
|
\fR%%\fR
|
|
two consecutive
|
|
\fR%\fR
|
|
characters are collapsed into a single
|
|
\fR%\fR
|
|
character
|
|
.RE
|
|
.RS
|
|
.PP
|
|
The prompt specified by the
|
|
\fB\-p\fR
|
|
option will override the system password prompt on systems that
|
|
support PAM unless the
|
|
\fIpassprompt_override\fR
|
|
flag is disabled in
|
|
\fIsudoers\fR.
|
|
.PP
|
|
.RE
|
|
.PD 0
|
|
.TP 12n
|
|
\fB\-r\fR \fIrole\fR
|
|
The
|
|
\fB\-r\fR (\fIrole\fR)
|
|
option causes the new (SELinux) security context to have the role
|
|
specified by
|
|
\fIrole\fR.
|
|
.PD
|
|
.TP 12n
|
|
\fB\-S\fR
|
|
The
|
|
\fB\-S\fR (\fIstdin\fR)
|
|
option causes
|
|
\fBsudo\fR
|
|
to read the password from the standard input instead of the terminal
|
|
device.
|
|
The password must be followed by a newline character.
|
|
.TP 12n
|
|
\fB\-s\fR [\fIcommand\fR]
|
|
The
|
|
\fB\-s\fR (\fIshell\fR)
|
|
option runs the shell specified by the
|
|
\fRSHELL\fR
|
|
environment variable if it is set or the shell as specified in the
|
|
password database.
|
|
If a command is specified, it is passed to the shell for execution
|
|
via the shell's
|
|
\fB\-c\fR
|
|
option.
|
|
If no command is specified, an interactive shell is executed.
|
|
.TP 12n
|
|
\fB\-t\fR \fItype\fR
|
|
The
|
|
\fB\-t\fR (\fItype\fR)
|
|
option causes the new (SELinux) security context to have the type
|
|
specified by
|
|
\fItype\fR.
|
|
If no type is specified, the default type is derived from the
|
|
specified role.
|
|
.TP 12n
|
|
\fB\-U\fR \fIuser\fR
|
|
The
|
|
\fB\-U\fR (\fIother user\fR)
|
|
option is used in conjunction with the
|
|
\fB\-l\fR
|
|
option to specify the user whose privileges should be listed.
|
|
The security policy may restrict listing other users' privileges.
|
|
The
|
|
\fIsudoers\fR
|
|
policy only allows root or a user with the
|
|
\fRALL\fR
|
|
privilege on the current host to use this option.
|
|
.TP 12n
|
|
\fB\-u\fR \fIuser\fR
|
|
The
|
|
\fB\-u\fR (\fIuser\fR)
|
|
option causes
|
|
\fBsudo\fR
|
|
to run the specified command as a user other than
|
|
\fIroot\fR.
|
|
To specify a
|
|
\fIuid\fR
|
|
instead of a
|
|
\fIuser name\fR,
|
|
\fI#uid\fR.
|
|
When running commands as a
|
|
\fIuid\fR,
|
|
many shells require that the
|
|
`#'
|
|
be escaped with a backslash
|
|
(`\e').
|
|
Security policies may restrict
|
|
\fIuid\fRs
|
|
to those listed in the password database.
|
|
The
|
|
\fIsudoers\fR
|
|
policy allows
|
|
\fIuid\fRs
|
|
that are not in the password database as long as the
|
|
\fItargetpw\fR
|
|
option is not set.
|
|
Other security policies may not support this.
|
|
.TP 12n
|
|
\fB\-V\fR
|
|
The
|
|
\fB\-V\fR (\fIversion\fR)
|
|
option causes
|
|
\fBsudo\fR
|
|
to print its version string and the version string of the security
|
|
policy plugin and any I/O plugins.
|
|
If the invoking user is already root the
|
|
\fB\-V\fR
|
|
option will display the arguments passed to configure when
|
|
\fBsudo\fR
|
|
was built and plugins may display more verbose information such as
|
|
default options.
|
|
.TP 12n
|
|
\fB\-v\fR
|
|
When given the
|
|
\fB\-v\fR (\fIvalidate\fR)
|
|
option,
|
|
\fBsudo\fR
|
|
will update the user's cached credentials, authenticating the user's
|
|
password if necessary.
|
|
For the
|
|
\fIsudoers\fR
|
|
plugin, this extends the
|
|
\fBsudo\fR
|
|
timeout for another
|
|
\fR@timeout@\fR
|
|
minutes (or whatever the timeout is set to by the security policy)
|
|
but does not run a command.
|
|
Not all security policies support cached credentials.
|
|
.TP 12n
|
|
\fB\--\fR
|
|
The
|
|
\fB\--\fR
|
|
option indicates that
|
|
\fBsudo\fR
|
|
should stop processing command line arguments.
|
|
.PP
|
|
Environment variables to be set for the command may also be passed
|
|
on the command line in the form of
|
|
\fBVAR\fR=\fIvalue\fR,
|
|
e.g.\&
|
|
\fBLD_LIBRARY_PATH\fR=\fI/usr/local/pkg/lib\fR.
|
|
Variables passed on the command line are subject to the same
|
|
restrictions as normal environment variables with one important
|
|
exception.
|
|
If the
|
|
\fIsetenv\fR
|
|
option is set in
|
|
\fIsudoers\fR,
|
|
the command to be run has the
|
|
\fRSETENV\fR
|
|
tag set or the command matched is
|
|
\fRALL\fR,
|
|
the user may set variables that would otherwise be forbidden.
|
|
See
|
|
sudoers(@mansectform@)
|
|
for more information.
|
|
.SH "PLUGINS"
|
|
Plugins are dynamically loaded based on the contents of the
|
|
\fI@sysconfdir@/sudo.conf\fR
|
|
file.
|
|
If no
|
|
\fI@sysconfdir@/sudo.conf\fR
|
|
file is present, or it contains no
|
|
\fRPlugin\fR
|
|
lines,
|
|
\fBsudo\fR
|
|
will use the traditional
|
|
\fIsudoers\fR
|
|
security policy and I/O logging, which corresponds to the following
|
|
\fI@sysconfdir@/sudo.conf\fR
|
|
file.
|
|
.nf
|
|
.sp
|
|
.RS 0n
|
|
#
|
|
# Default @sysconfdir@/sudo.conf file
|
|
#
|
|
# Format:
|
|
# Plugin plugin_name plugin_path plugin_options ...
|
|
# Path askpass /path/to/askpass
|
|
# Path noexec /path/to/sudo_noexec.so
|
|
# Debug sudo /var/log/sudo_debug all@warn
|
|
# Set disable_coredump true
|
|
#
|
|
# The plugin_path is relative to @prefix@/libexec unless
|
|
# fully qualified.
|
|
# The plugin_name corresponds to a global symbol in the plugin
|
|
# that contains the plugin interface structure.
|
|
# The plugin_options are optional.
|
|
#
|
|
Plugin policy_plugin sudoers.so
|
|
Plugin io_plugin sudoers.so
|
|
.RE
|
|
.fi
|
|
.PP
|
|
A
|
|
\fRPlugin\fR
|
|
line consists of the
|
|
\fRPlugin\fR
|
|
keyword, followed by the
|
|
\fIsymbol_name\fR
|
|
and the
|
|
\fIpath\fR
|
|
to the shared object containing the plugin.
|
|
The
|
|
\fIsymbol_name\fR
|
|
is the name of the
|
|
\fRstruct policy_plugin\fR
|
|
or
|
|
\fRstruct io_plugin\fR
|
|
in the plugin shared object.
|
|
The
|
|
\fIpath\fR
|
|
may be fully qualified or relative.
|
|
If not fully qualified it is relative to the
|
|
\fI@prefix@/libexec\fR
|
|
directory.
|
|
Any additional parameters after the
|
|
\fIpath\fR
|
|
are passed as arguments to the plugin's
|
|
\fIopen\fR
|
|
function.
|
|
Lines that don't begin with
|
|
\fRPlugin\fR,
|
|
\fRPath\fR,
|
|
\fRDebug\fR,
|
|
or
|
|
\fRSet\fR
|
|
are silently ignored.
|
|
.PP
|
|
For more information, see the
|
|
sudo_plugin(@mansectsu@)
|
|
manual.
|
|
.SH "PATHS"
|
|
A
|
|
\fRPath\fR
|
|
line consists of the
|
|
\fRPath\fR
|
|
keyword, followed by the name of the path to set and its value.
|
|
E.g.
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
Path noexec @noexec_file@
|
|
Path askpass /usr/X11R6/bin/ssh-askpass
|
|
.RE
|
|
.fi
|
|
.PP
|
|
The following plugin-agnostic paths may be set in the
|
|
\fI@sysconfdir@/sudo.conf\fR
|
|
file:
|
|
.TP 10n
|
|
askpass
|
|
The fully qualified path to a helper program used to read the user's
|
|
password when no terminal is available.
|
|
This may be the case when
|
|
\fBsudo\fR
|
|
is executed from a graphical (as opposed to text-based) application.
|
|
The program specified by
|
|
\fIaskpass\fR
|
|
should display the argument passed to it as the prompt and write
|
|
the user's password to the standard output.
|
|
The value of
|
|
\fIaskpass\fR
|
|
may be overridden by the
|
|
\fRSUDO_ASKPASS\fR
|
|
environment variable.
|
|
.TP 10n
|
|
noexec
|
|
The fully-qualified path to a shared library containing dummy
|
|
versions of the
|
|
\fBexecv\fR(),
|
|
\fBexecve\fR()
|
|
and
|
|
\fBfexecve\fR()
|
|
library functions that just return an error.
|
|
This is used to implement the
|
|
\fInoexec\fR
|
|
functionality on systems that support
|
|
\fRLD_PRELOAD\fR
|
|
or its equivalent.
|
|
Defaults to
|
|
\fI@noexec_file@\fR.
|
|
.SH "DEBUG FLAGS"
|
|
\fBsudo\fR
|
|
versions 1.8.4 and higher support a flexible debugging framework
|
|
that can help track down what
|
|
\fBsudo\fR
|
|
is doing internally if there is a problem.
|
|
.PP
|
|
A
|
|
\fRDebug\fR
|
|
line consists of the
|
|
\fRDebug\fR
|
|
keyword, followed by the name of the program to debug
|
|
(\fBsudo\fR, \fBvisudo\fR, \fBsudoreplay\fR),
|
|
the debug file name and a comma-separated list of debug flags.
|
|
The debug flag syntax used by
|
|
\fBsudo\fR
|
|
and the
|
|
\fIsudoers\fR
|
|
plugin is
|
|
\fIsubsystem\fR@\fIpriority\fR
|
|
but the plugin is free to use a different format so long as it does
|
|
not include a comma
|
|
(`\&,').
|
|
.PP
|
|
For instance:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
Debug sudo /var/log/sudo_debug all@warn,plugin@info
|
|
.RE
|
|
.fi
|
|
.PP
|
|
would log all debugging statements at the
|
|
\fIwarn\fR
|
|
level and higher in addition to those at the
|
|
\fIinfo\fR
|
|
level for the plugin subsystem.
|
|
.PP
|
|
Currently, only one
|
|
\fRDebug\fR
|
|
entry per program is supported.
|
|
The
|
|
\fBsudo\fR
|
|
\fRDebug\fR
|
|
entry is shared by the
|
|
\fBsudo\fR
|
|
front end,
|
|
\fBsudoedit\fR
|
|
and the plugins.
|
|
A future release may add support for per-plugin
|
|
\fRDebug\fR
|
|
lines and/or support for multiple debugging files for a single
|
|
program.
|
|
.PP
|
|
The priorities used by the
|
|
\fBsudo\fR
|
|
front end, in order of decreasing severity, are:
|
|
\fIcrit\fR, \fIerr\fR, \fIwarn\fR, \fInotice\fR, \fIdiag\fR, \fIinfo\fR, \fItrace\fR
|
|
and
|
|
\fIdebug\fR.
|
|
Each priority, when specified, also includes all priorities higher
|
|
than it.
|
|
For example, a priority of
|
|
\fInotice\fR
|
|
would include debug messages logged at
|
|
\fInotice\fR
|
|
and higher.
|
|
.PP
|
|
The following subsystems are used by the
|
|
\fBsudo\fR
|
|
front-end:
|
|
.TP 12n
|
|
\fIall\fR
|
|
matches every subsystem
|
|
.TP 12n
|
|
\fIargs\fR
|
|
command line argument processing
|
|
.TP 12n
|
|
\fIconv\fR
|
|
user conversation
|
|
.TP 12n
|
|
\fIedit\fR
|
|
sudoedit
|
|
.TP 12n
|
|
\fIexec\fR
|
|
command execution
|
|
.TP 12n
|
|
\fImain\fR
|
|
\fBsudo\fR
|
|
main function
|
|
.TP 12n
|
|
\fInetif\fR
|
|
network interface handling
|
|
.TP 12n
|
|
\fIpcomm\fR
|
|
communication with the plugin
|
|
.TP 12n
|
|
\fIplugin\fR
|
|
plugin configuration
|
|
.TP 12n
|
|
\fIpty\fR
|
|
pseudo-tty related code
|
|
.TP 12n
|
|
\fIselinux\fR
|
|
SELinux-specific handling
|
|
.TP 12n
|
|
\fIutil\fR
|
|
utility functions
|
|
.TP 12n
|
|
\fIutmp\fR
|
|
utmp handling
|
|
.SH "EXIT VALUE"
|
|
Upon successful execution of a program, the exit status from
|
|
\fIsudo\fR
|
|
will simply be the exit status of the program that was executed.
|
|
.PP
|
|
Otherwise,
|
|
\fBsudo\fR
|
|
exits with a value of 1 if there is a configuration/permission
|
|
problem or if
|
|
\fBsudo\fR
|
|
cannot execute the given command.
|
|
In the latter case the error string is printed to the standard error.
|
|
If
|
|
\fBsudo\fR
|
|
cannot
|
|
stat(2)
|
|
one or more entries in the user's
|
|
\fRPATH\fR,
|
|
an error is printed on stderr.
|
|
(If the directory does not exist or if it is not really a directory,
|
|
the entry is ignored and no error is printed.)
|
|
This should not happen under normal circumstances.
|
|
The most common reason for
|
|
stat(2)
|
|
to return
|
|
``permission denied''
|
|
is if you are running an automounter and one of the directories in
|
|
your
|
|
\fRPATH\fR
|
|
is on a machine that is currently unreachable.
|
|
.SH "SECURITY NOTES"
|
|
\fBsudo\fR
|
|
tries to be safe when executing external commands.
|
|
.PP
|
|
To prevent command spoofing,
|
|
\fBsudo\fR
|
|
checks "." and "" (both denoting current directory) last when
|
|
searching for a command in the user's
|
|
\fRPATH (if one or both are in the\fR
|
|
\fRPATH\fR).
|
|
Note, however, that the actual
|
|
\fRPATH\fR
|
|
environment variable is
|
|
\fInot\fR
|
|
modified and is passed unchanged to the program that
|
|
\fBsudo\fR
|
|
executes.
|
|
.PP
|
|
Please note that
|
|
\fBsudo\fR
|
|
will normally only log the command it explicitly runs.
|
|
If a user runs a command such as
|
|
\fRsudo su\fR
|
|
or
|
|
\fRsudo sh\fR,
|
|
subsequent commands run from that shell are not subject to
|
|
\fBsudo\fR's
|
|
security policy.
|
|
The same is true for commands that offer shell escapes (including
|
|
most editors).
|
|
If I/O logging is enabled, subsequent commands will have their input and/or
|
|
output logged, but there will not be traditional logs for those commands.
|
|
Because of this, care must be taken when giving users access to commands via
|
|
\fBsudo\fR
|
|
to verify that the command does not inadvertently give the user an
|
|
effective root shell.
|
|
For more information, please see the
|
|
\fIPREVENTING SHELL ESCAPES\fR
|
|
section in
|
|
sudoers(@mansectform@).
|
|
.PP
|
|
To prevent the disclosure of potentially sensitive information,
|
|
\fBsudo\fR
|
|
disables core dumps by default while it is executing (they are
|
|
re-enabled for the command that is run).
|
|
To aid in debugging
|
|
\fBsudo\fR
|
|
crashes, you may wish to re-enable core dumps by setting
|
|
``disable_coredump''
|
|
to false in the
|
|
\fI@sysconfdir@/sudo.conf\fR
|
|
file as follows:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
Set disable_coredump false
|
|
.RE
|
|
.fi
|
|
.PP
|
|
Note that by default, most operating systems disable core dumps
|
|
from setuid programs, which includes
|
|
\fBsudo\fR.
|
|
To actually get a
|
|
\fBsudo\fR
|
|
core file you may need to enable core dumps for setuid processes.
|
|
On BSD and Linux systems this is accomplished via the sysctl command,
|
|
on Solaris the coreadm command can be used.
|
|
.SH "ENVIRONMENT"
|
|
\fBsudo\fR
|
|
utilizes the following environment variables.
|
|
The security policy has control over the actual content of the command's
|
|
environment.
|
|
.TP 17n
|
|
\fREDITOR\fR
|
|
Default editor to use in
|
|
\fB\-e\fR
|
|
(sudoedit) mode if neither
|
|
\fRSUDO_EDITOR\fR
|
|
nor
|
|
\fRVISUAL\fR
|
|
is set.
|
|
.TP 17n
|
|
\fRMAIL\fR
|
|
In
|
|
\fB\-i\fR
|
|
mode or when
|
|
\fIenv_reset\fR
|
|
is enabled in
|
|
\fIsudoers\fR,
|
|
set to the mail spool of the target user.
|
|
.TP 17n
|
|
\fRHOME\fR
|
|
Set to the home directory of the target user if
|
|
\fB\-i\fR
|
|
or
|
|
\fB\-H\fR
|
|
are specified,
|
|
\fIenv_reset\fR
|
|
or
|
|
\fIalways_set_home\fR
|
|
are set in
|
|
\fIsudoers\fR,
|
|
or when the
|
|
\fB\-s\fR
|
|
option is specified and
|
|
\fIset_home\fR
|
|
is set in
|
|
\fIsudoers\fR.
|
|
.TP 17n
|
|
\fRPATH\fR
|
|
May be overridden by the security policy.
|
|
.TP 17n
|
|
\fRSHELL\fR
|
|
Used to determine shell to run with
|
|
\fB\-s\fR
|
|
option.
|
|
.TP 17n
|
|
\fRSUDO_ASKPASS\fR
|
|
Specifies the path to a helper program used to read the password
|
|
if no terminal is available or if the
|
|
\fB\-A\fR
|
|
option is specified.
|
|
.TP 17n
|
|
\fRSUDO_COMMAND\fR
|
|
Set to the command run by sudo.
|
|
.TP 17n
|
|
\fRSUDO_EDITOR\fR
|
|
Default editor to use in
|
|
\fB\-e\fR
|
|
(sudoedit) mode.
|
|
.TP 17n
|
|
\fRSUDO_GID\fR
|
|
Set to the group ID of the user who invoked sudo.
|
|
.TP 17n
|
|
\fRSUDO_PROMPT\fR
|
|
Used as the default password prompt.
|
|
.TP 17n
|
|
\fRSUDO_PS1\fR
|
|
If set,
|
|
\fRPS1\fR
|
|
will be set to its value for the program being run.
|
|
.TP 17n
|
|
\fRSUDO_UID\fR
|
|
Set to the user ID of the user who invoked sudo.
|
|
.TP 17n
|
|
\fRSUDO_USER\fR
|
|
Set to the login name of the user who invoked sudo.
|
|
.TP 17n
|
|
\fRUSER\fR
|
|
Set to the target user (root unless the
|
|
\fB\-u\fR
|
|
option is specified).
|
|
.TP 17n
|
|
\fRVISUAL\fR
|
|
Default editor to use in
|
|
\fB\-e\fR
|
|
(sudoedit) mode if
|
|
\fRSUDO_EDITOR\fR
|
|
is not set.
|
|
.SH "FILES"
|
|
.TP 26n
|
|
\fI@sysconfdir@/sudo.conf\fR
|
|
\fBsudo\fR
|
|
front end configuration
|
|
.SH "EXAMPLES"
|
|
Note: the following examples assume a properly configured security
|
|
policy.
|
|
.PP
|
|
To get a file listing of an unreadable directory:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
$ sudo ls /usr/local/protected
|
|
.RE
|
|
.fi
|
|
.PP
|
|
To list the home directory of user yaz on a machine where the file
|
|
system holding ~yaz is not exported as root:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
$ sudo -u yaz ls ~yaz
|
|
.RE
|
|
.fi
|
|
.PP
|
|
To edit the
|
|
\fIindex.html\fR
|
|
file as user www:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
$ sudo -u www vi ~www/htdocs/index.html
|
|
.RE
|
|
.fi
|
|
.PP
|
|
To view system logs only accessible to root and users in the adm
|
|
group:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
$ sudo -g adm view /var/log/syslog
|
|
.RE
|
|
.fi
|
|
.PP
|
|
To run an editor as jim with a different primary group:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
$ sudo -u jim -g audio vi ~jim/sound.txt
|
|
.RE
|
|
.fi
|
|
.PP
|
|
To shut down a machine:
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
$ sudo shutdown -r +15 "quick reboot"
|
|
.RE
|
|
.fi
|
|
.PP
|
|
To make a usage listing of the directories in the /home partition.
|
|
Note that this runs the commands in a sub-shell to make the
|
|
\fRcd\fR
|
|
and file redirection work.
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
$ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
|
|
.RE
|
|
.fi
|
|
.SH "SEE ALSO"
|
|
grep(1),
|
|
su(1),
|
|
stat(2),
|
|
login_cap(3),
|
|
passwd(@mansectform@),
|
|
sudoers(@mansectform@),
|
|
sudo_plugin(@mansectsu@),
|
|
sudoreplay(@mansectsu@),
|
|
visudo(@mansectsu@)
|
|
.SH "HISTORY"
|
|
See the HISTORY file in the
|
|
\fBsudo\fR
|
|
distribution (http://www.sudo.ws/sudo/history.html) for a brief
|
|
history of sudo.
|
|
.SH "AUTHORS"
|
|
Many people have worked on
|
|
\fBsudo\fR
|
|
over the years; this version consists of code written primarily by:
|
|
.sp
|
|
.RS 6n
|
|
Todd C. Miller
|
|
.RE
|
|
.PP
|
|
See the CONTRIBUTORS file in the
|
|
\fBsudo\fR
|
|
distribution (http://www.sudo.ws/sudo/contributors.html) for an
|
|
exhaustive list of people who have contributed to
|
|
\fBsudo\fR.
|
|
.SH "CAVEATS"
|
|
There is no easy way to prevent a user from gaining a root shell
|
|
if that user is allowed to run arbitrary commands via
|
|
\fBsudo\fR.
|
|
Also, many programs (such as editors) allow the user to run commands
|
|
via shell escapes, thus avoiding
|
|
\fBsudo\fR's
|
|
checks.
|
|
However, on most systems it is possible to prevent shell escapes with the
|
|
sudoers(@mansectform@)
|
|
module's
|
|
\fInoexec\fR
|
|
functionality.
|
|
.PP
|
|
It is not meaningful to run the
|
|
\fRcd\fR
|
|
command directly via sudo, e.g.,
|
|
.nf
|
|
.sp
|
|
.RS 6n
|
|
$ sudo cd /usr/local/protected
|
|
.RE
|
|
.fi
|
|
.PP
|
|
since when the command exits the parent process (your shell) will
|
|
still be the same.
|
|
Please see the
|
|
\fIEXAMPLES\fR
|
|
section for more information.
|
|
.PP
|
|
Running shell scripts via
|
|
\fBsudo\fR
|
|
can expose the same kernel bugs that make setuid shell scripts
|
|
unsafe on some operating systems (if your OS has a /dev/fd/ directory,
|
|
setuid shell scripts are generally safe).
|
|
.SH "BUGS"
|
|
If you feel you have found a bug in
|
|
\fBsudo\fR,
|
|
please submit a bug report at http://www.sudo.ws/sudo/bugs/
|
|
.SH "SUPPORT"
|
|
Limited free support is available via the sudo-users mailing list,
|
|
see http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
|
|
search the archives.
|
|
.SH "DISCLAIMER"
|
|
\fBsudo\fR
|
|
is provided
|
|
``AS IS''
|
|
and any express or implied warranties, including, but not limited
|
|
to, the implied warranties of merchantability and fitness for a
|
|
particular purpose are disclaimed.
|
|
See the LICENSE file distributed with
|
|
\fBsudo\fR
|
|
or http://www.sudo.ws/sudo/license.html for complete details.
|