351 lines
15 KiB
HTML
351 lines
15 KiB
HTML
<HTML>
|
|
<HEAD>
|
|
<TITLE>Sudo Manual</TITLE>
|
|
<LINK REV="made" HREF="mailto:root@localhost">
|
|
</HEAD>
|
|
|
|
<BODY>
|
|
|
|
<!-- INDEX BEGIN -->
|
|
|
|
<UL>
|
|
|
|
<LI><A HREF="#NAME">NAME</A>
|
|
<LI><A HREF="#SYNOPSIS">SYNOPSIS</A>
|
|
<LI><A HREF="#DESCRIPTION">DESCRIPTION</A>
|
|
<LI><A HREF="#OPTIONS">OPTIONS</A>
|
|
<LI><A HREF="#RETURN_VALUES">RETURN VALUES</A>
|
|
<LI><A HREF="#SECURITY_NOTES">SECURITY NOTES</A>
|
|
<LI><A HREF="#EXAMPLES">EXAMPLES</A>
|
|
<LI><A HREF="#ENVIRONMENT">ENVIRONMENT</A>
|
|
<LI><A HREF="#FILES">FILES</A>
|
|
<LI><A HREF="#FILES">FILES</A>
|
|
<LI><A HREF="#AUTHORS">AUTHORS</A>
|
|
<LI><A HREF="#BUGS">BUGS</A>
|
|
<LI><A HREF="#DISCLAIMER">DISCLAIMER</A>
|
|
<LI><A HREF="#CAVEATS">CAVEATS</A>
|
|
<LI><A HREF="#SEE_ALSO">SEE ALSO</A>
|
|
</UL>
|
|
<!-- INDEX END -->
|
|
|
|
<HR>
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="NAME">NAME</A></H1>
|
|
<P>
|
|
sudo - execute a command as another user
|
|
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="SYNOPSIS">SYNOPSIS</A></H1>
|
|
<P>
|
|
<STRONG>sudo</STRONG> <STRONG>-V</STRONG> | <STRONG>-h</STRONG> | <STRONG>-l</STRONG> | <STRONG>-L</STRONG> | <STRONG>-v</STRONG> | <STRONG>-k</STRONG> | <STRONG>-K</STRONG> | <STRONG>-s</STRONG> | <STRONG>-H</STRONG> | [ <STRONG>-b</STRONG> ] | [ <STRONG>-p</STRONG> prompt ] [ <STRONG>-u</STRONG> username/#uid] <EM>command</EM>
|
|
|
|
|
|
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="DESCRIPTION">DESCRIPTION</A></H1>
|
|
<P>
|
|
<STRONG>sudo</STRONG> allows a permitted user to execute a <EM>command</EM> as the superuser or another user, as specified in the sudoers file. The
|
|
real and effective uid and gid are set to match those of the target user as
|
|
specified in the passwd file (the group vector is also initialized when the
|
|
target user is not root). By default, <STRONG>sudo</STRONG>
|
|
requires that users authenticate themselves with a password (NOTE: this is
|
|
the user's password, not the root password). Once a user has been
|
|
authenticated, a timestamp is updated and the user may then use sudo
|
|
without a password for a short period of time (five minutes by default).
|
|
|
|
<P>
|
|
<STRONG>sudo</STRONG> determines who is an authorized user by consulting the file <EM>/etc/sudoers</EM>. By giving <STRONG>sudo</STRONG> the <CODE>-v</CODE> flag a user can update the time stamp without running a <EM>command.</EM>
|
|
The password prompt itself will also time out if the user's password is not
|
|
entered with N minutes (again, this is defined at configure time and
|
|
defaults to 5 minutes).
|
|
|
|
<P>
|
|
If a user that is not listed in the <EM>sudoers</EM> file tries to run a command via <STRONG>sudo</STRONG>, mail is sent to the proper authorities, as defined at configure time
|
|
(defaults to root). Note that the mail will not be sent if an unauthorized
|
|
user tries to run sudo with the <CODE>-l</CODE> or <CODE>-v</CODE> flags. This allows users to determine for themselves whether or not they
|
|
are allowed to use <STRONG>sudo</STRONG>.
|
|
|
|
<P>
|
|
<STRONG>sudo</STRONG> can log both successful an unsuccessful attempts (as well as errors) to
|
|
<CODE>syslog(3),</CODE> a log file, or both. By default <STRONG>sudo</STRONG>
|
|
will log via <CODE>syslog(3)</CODE> but this is changeable at configure
|
|
time.
|
|
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="OPTIONS">OPTIONS</A></H1>
|
|
<P>
|
|
<STRONG>sudo</STRONG> accepts the following command line options:
|
|
|
|
<DL>
|
|
<DT><STRONG><A NAME="item__V">-V</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-V</CODE> (<EM>version</EM>) option causes <STRONG>sudo</STRONG> to print the version number and exit.
|
|
|
|
<DT><STRONG><A NAME="item__l">-l</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-l</CODE> (<EM>list</EM>) option will list out the allowed (and forbidden) commands for the user on
|
|
the current host.
|
|
|
|
<DT><STRONG><A NAME="item__L">-L</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-L</CODE> (<EM>list</EM> defaults) option will list out the parameters that may be set in a <EM>Defaults</EM> line along with a short description for each. This option is useful in
|
|
conjunction with <CODE>grep(1).</CODE>
|
|
|
|
<DT><STRONG><A NAME="item__h">-h</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-h</CODE> (<EM>help</EM>) option causes <STRONG>sudo</STRONG> to print a usage message and exit.
|
|
|
|
<DT><STRONG><A NAME="item__v">-v</A></STRONG><DD>
|
|
<P>
|
|
If given the <CODE>-v</CODE> (<EM>validate</EM>) option, <STRONG>sudo</STRONG> will update the user's timestamp, prompting for the user's password if
|
|
necessary. This extends the <STRONG>sudo</STRONG> timeout to for another N minutes (where N is defined at installation time
|
|
and defaults to 5 minutes) but does not run a command.
|
|
|
|
<DT><STRONG><A NAME="item__k">-k</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-k</CODE> (<EM>kill</EM>) option to <STRONG>sudo</STRONG> invalidates the user's timestamp by setting the time on it to the epoch.
|
|
The next time <STRONG>sudo</STRONG> is run a password will be required. This option does not require a password
|
|
and was added to allow a user to revoke <STRONG>sudo</STRONG> permissions from a .logout file.
|
|
|
|
<DT><STRONG><A NAME="item__K">-K</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-K</CODE> (sure <EM>kill</EM>) option to <STRONG>sudo</STRONG> removes the user's timestamp entirely. This option does not require a
|
|
password.
|
|
|
|
<DT><STRONG><A NAME="item__b">-b</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-b</CODE> (<EM>background</EM>) option tells <STRONG>sudo</STRONG> to run the given command in the background. Note that if you use the <CODE>-b</CODE>
|
|
option you cannot use shell job control to manipulate the command.
|
|
|
|
<DT><STRONG><A NAME="item__p">-p</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-p</CODE> (<EM>prompt</EM>) option allows you to override the default password prompt and use a
|
|
custom one. If the password prompt contains the <CODE>%u</CODE> escape, <CODE>%u</CODE> will be replaced with the user's login name. Similarly, <CODE>%h</CODE> will be replaced with the local hostname.
|
|
|
|
<DT><STRONG><A NAME="item__u">-u</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-u</CODE> (<EM>user</EM>) option causes sudo to run the specified command as a user other than <EM>root</EM>. To specify a <EM>uid</EM> instead of a
|
|
<EM>username</EM>, use ``#uid''.
|
|
|
|
<DT><STRONG><A NAME="item__s">-s</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-s</CODE> (<EM>shell</EM>) option runs the shell specified by the <EM>SHELL</EM>
|
|
environment variable if it is set or the shell as specified in
|
|
<CODE>passwd(5).</CODE>
|
|
|
|
<DT><STRONG><A NAME="item__H">-H</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>-H</CODE> (<EM>HOME</EM>) option sets the <EM>HOME</EM> environment variable to the homedir of the target user (root by default) as
|
|
specified in <CODE>passwd(5).</CODE> By default, <STRONG>sudo</STRONG> does not modify <EM>HOME</EM>.
|
|
|
|
<DT><STRONG><A NAME="item__">--</A></STRONG><DD>
|
|
<P>
|
|
The <CODE>--</CODE> flag indicates that <STRONG>sudo</STRONG> should stop processing command line arguments. It is most useful in
|
|
conjunction with the <CODE>-s</CODE> flag.
|
|
|
|
</DL>
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="RETURN_VALUES">RETURN VALUES</A></H1>
|
|
<P>
|
|
<STRONG>sudo</STRONG> quits with an exit value of 1 if there is a configuration/permission
|
|
problem or if <STRONG>sudo</STRONG> cannot execute the given command. In the latter case the error string is
|
|
printed to stderr. If <STRONG>sudo</STRONG> cannot <CODE>stat(2)</CODE> one or more entries in the user's
|
|
<CODE>PATH</CODE> an error is printed on stderr. (If the directory does not exist or if it is
|
|
not really a directory, the entry is ignored and no error is printed.) This
|
|
should not happen under normal circumstances. The most common reason for
|
|
<CODE>stat(2)</CODE> to return ``permission denied'' is if you are running
|
|
an automounter and one of the directories in your <CODE>PATH</CODE> is on a machine that is currently unreachable.
|
|
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="SECURITY_NOTES">SECURITY NOTES</A></H1>
|
|
<P>
|
|
<STRONG>sudo</STRONG> tries to be safe when executing external commands. Variables that control
|
|
how dynamic loading and binding is done can be used to subvert the program
|
|
that <STRONG>sudo</STRONG> runs. To combat this the
|
|
<CODE>LD_*</CODE>, <CODE>_RLD_*</CODE>, <CODE>SHLIB_PATH</CODE> (HP-UX only), and <CODE>LIBPATH</CODE> (AIX only) environment variables are removed from the environment passed on
|
|
to all commands executed. <STRONG>sudo</STRONG> will also remove the <CODE>IFS</CODE>,
|
|
<CODE>ENV</CODE>, <CODE>BASH_ENV</CODE>, <CODE>KRB_CONF</CODE>, <CODE>KRB5_CONFIG</CODE>, <CODE>LOCALDOMAIN</CODE>,
|
|
<CODE>RES_OPTIONS</CODE> and <CODE>HOSTALIASES</CODE> variables as they too can pose a threat.
|
|
|
|
<P>
|
|
To prevent command spoofing, <STRONG>sudo</STRONG> checks ``.'' and ``'' (both denoting current directory) last when searching
|
|
for a command in the user's PATH (if one or both are in the PATH). Note,
|
|
however, that the actual <CODE>PATH</CODE> environment variable is <EM>not</EM> modified and is passed unchanged to the program that <STRONG>sudo</STRONG> executes.
|
|
|
|
<P>
|
|
For security reasons, if your OS supports shared libraries and does not
|
|
disable user-defined library search paths for setuid programs (most do),
|
|
you should either use a linker option that disables this behavior or link <STRONG>sudo</STRONG> statically.
|
|
|
|
<P>
|
|
<STRONG>sudo</STRONG> will check the ownership of its timestamp directory (<EM>/var/run/sudo</EM> or <EM>/tmp/.odus</EM> by default) and ignore the directory's contents if it is not owned by root
|
|
and only writable by root. On systems that allow non-root users to give
|
|
away files via <CODE>chown(2),</CODE> if the timestamp directory is located
|
|
in a directory writable by anyone (ie: <EM>/tmp</EM>), it is possible for a user to create the timestamp directory before <STRONG>sudo</STRONG> is run. However, because <STRONG>sudo</STRONG> checks the ownership and mode of the directory and its contents, the only
|
|
damage that can be done is to ``hide'' files by putting them in the
|
|
timestamp dir. This is unlikely to happen since once the timestamp dir is
|
|
owned by root and inaccessible by any other user the user placing files
|
|
there would be unable to get them back out. To get around this issue you
|
|
can use a directory that is not world-writable for the timestamps (<EM>/var/adm/sudo</EM> for instance) or create /tmp/.odus with the appropriate owner (root) and
|
|
permissions (0700) in the system startup files.
|
|
|
|
<P>
|
|
<STRONG>sudo</STRONG> will not honor timestamps set far in the future. Timestamps with a date
|
|
greater than current_time + 2 * <CODE>TIMEOUT</CODE>
|
|
will be ignored and sudo will log and complain. This is done to keep a user
|
|
from creating his/her own timestamp with a bogus date on system that allow
|
|
users to give away files.
|
|
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="EXAMPLES">EXAMPLES</A></H1>
|
|
<P>
|
|
Note: the following examples assume suitable <CODE>sudoers(5)</CODE>
|
|
entries.
|
|
|
|
<P>
|
|
To get a file listing of an unreadable directory:
|
|
|
|
<P>
|
|
<PRE> % sudo ls /usr/local/protected
|
|
</PRE>
|
|
<P>
|
|
To list the home directory of user yazza on a machine where the filesystem
|
|
holding ~yazza is not exported as root:
|
|
|
|
<P>
|
|
<PRE> % sudo -u yazza ls ~yazza
|
|
</PRE>
|
|
<P>
|
|
To edit the <EM>index.html</EM> file as user www:
|
|
|
|
<P>
|
|
<PRE> % sudo -u www vi ~www/htdocs/index.html
|
|
</PRE>
|
|
<P>
|
|
To shutdown a machine:
|
|
|
|
<P>
|
|
<PRE> % sudo shutdown -r +15 "quick reboot"
|
|
</PRE>
|
|
<P>
|
|
To make a usage listing of the directories in the /home partition. Note
|
|
that this runs the commands in a sub-shell to make the <CODE>cd</CODE> and file redirection work.
|
|
|
|
<P>
|
|
<PRE> % sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
|
|
</PRE>
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="ENVIRONMENT">ENVIRONMENT</A></H1>
|
|
<P>
|
|
<STRONG>sudo</STRONG> utilizes the following environment variables:
|
|
|
|
<P>
|
|
<PRE> PATH Set to a sane value if SECURE_PATH is set
|
|
SHELL Used to determine shell to run with -s option
|
|
USER Set to the target user (root unless the -u option
|
|
is specified)
|
|
HOME In -s or -H mode (or if sudo was configured with
|
|
the --enable-shell-sets-home option), set to
|
|
homedir of the target user.
|
|
SUDO_PROMPT Used as the default password prompt
|
|
SUDO_COMMAND Set to the command run by sudo
|
|
SUDO_USER Set to the login of the user who invoked sudo
|
|
SUDO_UID Set to the uid of the user who invoked sudo
|
|
SUDO_GID Set to the gid of the user who invoked sudo
|
|
SUDO_PS1 If set, PS1 will be set to its value
|
|
</PRE>
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="FILES">FILES</A></H1>
|
|
<P>
|
|
<PRE> /etc/sudoers List of who can run what
|
|
/var/run/sudo Directory containing timestamps
|
|
</PRE>
|
|
<P>
|
|
<STRONG>sudo</STRONG> utilizes the following environment variables:
|
|
|
|
<P>
|
|
<PRE> PATH Set to a sane value if SECURE_PATH is set
|
|
SHELL Used to determine shell to run with -s option
|
|
USER Set to the target user (root unless the -u option
|
|
is specified)
|
|
HOME In -s or -H mode (or if sudo was configured with
|
|
the --enable-shell-sets-home option), set to
|
|
homedir of the target user.
|
|
SUDO_PROMPT Used as the default password prompt
|
|
SUDO_COMMAND Set to the command run by sudo
|
|
SUDO_USER Set to the login of the user who invoked sudo
|
|
SUDO_UID Set to the uid of the user who invoked sudo
|
|
SUDO_GID Set to the gid of the user who invoked sudo
|
|
SUDO_PS1 If set, PS1 will be set to its value
|
|
</PRE>
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="FILES">FILES</A></H1>
|
|
<P>
|
|
<PRE> /etc/sudoers List of who can run what
|
|
/var/run/sudo Directory containing timestamps
|
|
/tmp/.odus Same as above if no /var/run exists
|
|
</PRE>
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="AUTHORS">AUTHORS</A></H1>
|
|
<P>
|
|
Many people have worked on <STRONG>sudo</STRONG> over the years, this version consists of code written primarily by:
|
|
|
|
<P>
|
|
<PRE> Todd Miller
|
|
Chris Jepeway
|
|
</PRE>
|
|
<P>
|
|
See the HISTORY file in the <STRONG>sudo</STRONG> distribution for a short history of <STRONG>sudo</STRONG>.
|
|
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="BUGS">BUGS</A></H1>
|
|
<P>
|
|
If you feel you have found a bug in sudo, please submit a bug report at <A
|
|
HREF="http://www.courtesan.com/sudo/bugs/.">http://www.courtesan.com/sudo/bugs/.</A>
|
|
|
|
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="DISCLAIMER">DISCLAIMER</A></H1>
|
|
<P>
|
|
<STRONG>Sudo</STRONG> is provided ``AS IS'' and any express or implied warranties, including, but
|
|
not limited to, the implied warranties of merchantability and fitness for a
|
|
particular purpose are disclaimed. See the LICENSE file distributed with <STRONG>sudo</STRONG> for complete details.
|
|
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="CAVEATS">CAVEATS</A></H1>
|
|
<P>
|
|
There is no easy way to prevent a user from gaining a root shell if that
|
|
user has access to commands allowing shell escapes.
|
|
|
|
<P>
|
|
If users have sudo <CODE>ALL</CODE> there is nothing to prevent them from creating their own program that gives
|
|
them a root shell regardless of any '!' elements in the user specification.
|
|
|
|
<P>
|
|
Running shell scripts via <STRONG>sudo</STRONG> can expose the same kernel bugs that make setuid shell scripts unsafe on
|
|
some operating systems (if your OS supports the /dev/fd/ directory, setuid
|
|
shell scripts are generally safe).
|
|
|
|
<P>
|
|
<HR>
|
|
<H1><A NAME="SEE_ALSO">SEE ALSO</A></H1>
|
|
<P>
|
|
<CODE><A HREF="sudoers.html">sudoers(5)</A>,</CODE> <CODE><A HREF="visudo.html">visudo(8)</A>,</CODE> <CODE>su(1).</CODE>
|
|
</BODY>
|
|
|
|
</HTML>
|