1: SUDO(4) Programmer's Manual SUDO(4)
2:
3: NNAAMMEE
4: ssuuddoo..ccoonnff - configuration for sudo front end
5:
6: DDEESSCCRRIIPPTTIIOONN
7: The ssuuddoo..ccoonnff file is used to configure the ssuuddoo front end. It specifies
8: the security policy and I/O logging plugins, debug flags as well as
9: plugin-agnostic path names and settings.
10:
11: The ssuuddoo..ccoonnff file supports the following directives, described in detail
12: below.
13:
14: Plugin a security policy or I/O logging plugin
15:
16: Path a plugin-agnostic path
17:
18: Set a front end setting, such as _d_i_s_a_b_l_e___c_o_r_e_d_u_m_p or _g_r_o_u_p___s_o_u_r_c_e
19:
20: Debug debug flags to aid in debugging ssuuddoo, ssuuddoorreeppllaayy, vviissuuddoo, and
21: the ssuuddooeerrss plugin.
22:
23: The pound sign (`#') is used to indicate a comment. Both the comment
24: character and any text after it, up to the end of the line, are ignored.
25:
26: Long lines can be continued with a backslash (`\') as the last character
27: on the line. Note that leading white space is removed from the beginning
28: of lines even when the continuation character is used.
29:
30: Non-comment lines that don't begin with Plugin, Path, Debug, or Set are
31: silently ignored.
32:
33: The ssuuddoo..ccoonnff file is always parsed in the ``C'' locale.
34:
35: PPlluuggiinn ccoonnffiigguurraattiioonn
36: ssuuddoo supports a plugin architecture for security policies and
37: input/output logging. Third parties can develop and distribute their own
38: policy and I/O logging plugins to work seamlessly with the ssuuddoo front
39: end. Plugins are dynamically loaded based on the contents of ssuuddoo..ccoonnff.
40:
41: A Plugin line consists of the Plugin keyword, followed by the _s_y_m_b_o_l___n_a_m_e
42: and the _p_a_t_h to the dynamic shared object that contains the plugin. The
43: _s_y_m_b_o_l___n_a_m_e is the name of the struct policy_plugin or struct io_plugin
44: symbol contained in the plugin. The _p_a_t_h may be fully qualified or
45: relative. If not fully qualified, it is relative to the directory
46: specified by the _p_l_u_g_i_n___d_i_r Path setting, which defaults to
47: _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o. In other words:
48:
49: Plugin sudoers_policy sudoers.so
50:
51: is equivalent to:
52:
53: Plugin sudoers_policy /usr/local/libexec/sudo/sudoers.so
54:
55: If the plugin was compiled statically into the ssuuddoo binary instead of
56: being installed as a dynamic shared object, the _p_a_t_h should be specified
57: without a leading directory, as it does not actually exist in the file
58: system. For example:
59:
60: Plugin sudoers_policy sudoers.so
61:
62: Starting with ssuuddoo 1.8.5, any additional parameters after the _p_a_t_h are
63: passed as arguments to the plugin's _o_p_e_n function. For example, to
64: override the compile-time default sudoers file mode:
65:
66: Plugin sudoers_policy sudoers.so sudoers_mode=0440
67:
68: The same dynamic shared object may contain multiple plugins, each with a
69: different symbol name. The file must be owned by uid 0 and only writable
70: by its owner. Because of ambiguities that arise from composite policies,
71: only a single policy plugin may be specified. This limitation does not
72: apply to I/O plugins.
73:
74: If no ssuuddoo..ccoonnff file is present, or if it contains no Plugin lines, the
75: ssuuddooeerrss plugin will be used as the default security policy and for I/O
76: logging (if enabled by the policy). This is equivalent to the following:
77:
78: Plugin sudoers_policy sudoers.so
79: Plugin sudoers_io sudoers.so
80:
81: For more information on the ssuuddoo plugin architecture, see the
82: sudo_plugin(1m) manual.
83:
84: PPaatthh sseettttiinnggss
85: A Path line consists of the Path keyword, followed by the name of the
86: path to set and its value. For example:
87:
88: Path noexec /usr/local/libexec/sudo/sudo_noexec.so
89: Path askpass /usr/X11R6/bin/ssh-askpass
90:
91: The following plugin-agnostic paths may be set in the _/_e_t_c_/_s_u_d_o_._c_o_n_f
92: file:
93:
94: askpass The fully qualified path to a helper program used to read the
95: user's password when no terminal is available. This may be the
96: case when ssuuddoo is executed from a graphical (as opposed to
97: text-based) application. The program specified by _a_s_k_p_a_s_s
98: should display the argument passed to it as the prompt and
99: write the user's password to the standard output. The value of
100: _a_s_k_p_a_s_s may be overridden by the SUDO_ASKPASS environment
101: variable.
102:
103: noexec The fully-qualified path to a shared library containing dummy
104: versions of the eexxeeccvv(), eexxeeccvvee() and ffeexxeeccvvee() library
105: functions that just return an error. This is used to implement
106: the _n_o_e_x_e_c functionality on systems that support LD_PRELOAD or
107: its equivalent. The default value is:
108: _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o_/_s_u_d_o___n_o_e_x_e_c_._s_o.
109:
110: plugin_dir
111: The default directory to use when searching for plugins that
112: are specified without a fully qualified path name. The default
113: value is _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o.
114:
115: sesh The fully-qualified path to the sseesshh binary. This setting is
116: only used when ssuuddoo is built with SELinux support. The default
117: value is _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o_/_s_e_s_h.
118:
119: OOtthheerr sseettttiinnggss
120: The ssuuddoo..ccoonnff file also supports the following front end settings:
121:
122: disable_coredump
123: Core dumps of ssuuddoo itself are disabled by default. To aid in
124: debugging ssuuddoo crashes, you may wish to re-enable core dumps by
125: setting ``disable_coredump'' to false in ssuuddoo..ccoonnff as follows:
126:
127: Set disable_coredump false
128:
129: Note that most operating systems disable core dumps from setuid
130: programs, including ssuuddoo. To actually get a ssuuddoo core file you
131: will likely need to enable core dumps for setuid processes. On
132: BSD and Linux systems this is accomplished in the sysctl
133: command. On Solaris, the coreadm command is used to configure
134: core dump behavior.
135:
136: This setting is only available in ssuuddoo version 1.8.4 and
137: higher.
138:
139: group_source
140: ssuuddoo passes the invoking user's group list to the policy and
141: I/O plugins. On most systems, there is an upper limit to the
142: number of groups that a user may belong to simultaneously
143: (typically 16 for compatibility with NFS). On systems with the
144: getconf(1) utility, running:
145: getconf NGROUPS_MAX
146: will return the maximum number of groups.
147:
148: However, it is still possible to be a member of a larger number
149: of groups--they simply won't be included in the group list
150: returned by the kernel for the user. Starting with ssuuddoo
151: version 1.8.7, if the user's kernel group list has the maximum
152: number of entries, ssuuddoo will consult the group database
153: directly to determine the group list. This makes it possible
154: for the security policy to perform matching by group name even
155: when the user is a member of more than the maximum number of
156: groups.
157:
158: The _g_r_o_u_p___s_o_u_r_c_e setting allows the administrator to change
159: this default behavior. Supported values for _g_r_o_u_p___s_o_u_r_c_e are:
160:
161: static Use the static group list that the kernel returns.
162: Retrieving the group list this way is very fast but
163: it is subject to an upper limit as described above.
164: It is ``static'' in that it does not reflect changes
165: to the group database made after the user logs in.
166: This was the default behavior prior to ssuuddoo 1.8.7.
167:
168: dynamic Always query the group database directly. It is
169: ``dynamic'' in that changes made to the group
170: database after the user logs in will be reflected in
171: the group list. On some systems, querying the group
172: database for all of a user's groups can be time
173: consuming when querying a network-based group
174: database. Most operating systems provide an
175: efficient method of performing such queries.
176: Currently, ssuuddoo supports efficient group queries on
177: AIX, BSD, HP-UX, Linux and Solaris.
178:
179: adaptive Only query the group database if the static group
180: list returned by the kernel has the maximum number of
181: entries. This is the default behavior in ssuuddoo 1.8.7
182: and higher.
183:
184: For example, to cause ssuuddoo to only use the kernel's static list
185: of groups for the user:
186:
187: Set group_source static
188:
189: This setting is only available in ssuuddoo version 1.8.7 and
190: higher.
191:
192: max_groups
193: The maximum number of user groups to retrieve from the group
194: database. Values less than one will be ignored. This setting
195: is only used when querying the group database directly. It is
196: intended to be used on systems where it is not possible to
197: detect when the array to be populated with group entries is not
198: sufficiently large. By default, ssuuddoo will allocate four times
199: the system's maximum number of groups (see above) and retry
200: with double that number if the group database query fails.
201: However, some systems just return as many entries as will fit
202: and do not indicate an error when there is a lack of space.
203:
204: This setting is only available in ssuuddoo version 1.8.7 and
205: higher.
206:
207: probe_interfaces
208: By default, ssuuddoo will probe the system's network interfaces and
209: pass the IP address of each enabled interface to the policy
210: plugin. This makes it possible for the plugin to match rules
211: based on the IP address without having to query DNS. On Linux
212: systems with a large number of virtual interfaces, this may
213: take a non-negligible amount of time. If IP-based matching is
214: not required, network interface probing can be disabled as
215: follows:
216:
217: Set probe_interfaces false
218:
219: This setting is only available in ssuuddoo version 1.8.10 and
220: higher.
221:
222: DDeebbuugg ffllaaggss
223: ssuuddoo versions 1.8.4 and higher support a flexible debugging framework
224: that can help track down what ssuuddoo is doing internally if there is a
225: problem.
226:
227: A Debug line consists of the Debug keyword, followed by the name of the
228: program (or plugin) to debug (ssuuddoo, vviissuuddoo, ssuuddoorreeppllaayy, ssuuddooeerrss), the
229: debug file name and a comma-separated list of debug flags. The debug
230: flag syntax used by ssuuddoo and the ssuuddooeerrss plugin is _s_u_b_s_y_s_t_e_m@_p_r_i_o_r_i_t_y but
231: a plugin is free to use a different format so long as it does not include
232: a comma (`,').
233:
234: For example:
235:
236: Debug sudo /var/log/sudo_debug all@warn,plugin@info
237:
238: would log all debugging statements at the _w_a_r_n level and higher in
239: addition to those at the _i_n_f_o level for the plugin subsystem.
240:
241: Currently, only one Debug entry per program is supported. The ssuuddoo Debug
242: entry is shared by the ssuuddoo front end, ssuuddooeeddiitt and the plugins. A
243: future release may add support for per-plugin Debug lines and/or support
244: for multiple debugging files for a single program.
245:
246: The priorities used by the ssuuddoo front end, in order of decreasing
247: severity, are: _c_r_i_t, _e_r_r, _w_a_r_n, _n_o_t_i_c_e, _d_i_a_g, _i_n_f_o, _t_r_a_c_e and _d_e_b_u_g.
248: Each priority, when specified, also includes all priorities higher than
249: it. For example, a priority of _n_o_t_i_c_e would include debug messages
250: logged at _n_o_t_i_c_e and higher.
251:
252: The following subsystems are used by the ssuuddoo front-end:
253:
254: _a_l_l matches every subsystem
255:
256: _a_r_g_s command line argument processing
257:
258: _c_o_n_v user conversation
259:
260: _e_d_i_t sudoedit
261:
262: _e_v_e_n_t event subsystem
263:
264: _e_x_e_c command execution
265:
266: _m_a_i_n ssuuddoo main function
267:
268: _n_e_t_i_f network interface handling
269:
270: _p_c_o_m_m communication with the plugin
271:
272: _p_l_u_g_i_n plugin configuration
273:
274: _p_t_y pseudo-tty related code
275:
276: _s_e_l_i_n_u_x SELinux-specific handling
277:
278: _u_t_i_l utility functions
279:
280: _u_t_m_p utmp handling
281:
282: The sudoers(4) plugin includes support for additional subsystems.
283:
284: FFIILLEESS
285: _/_e_t_c_/_s_u_d_o_._c_o_n_f ssuuddoo front end configuration
286:
287: EEXXAAMMPPLLEESS
288: #
289: # Default /etc/sudo.conf file
290: #
291: # Format:
292: # Plugin plugin_name plugin_path plugin_options ...
293: # Path askpass /path/to/askpass
294: # Path noexec /path/to/sudo_noexec.so
295: # Debug sudo /var/log/sudo_debug all@warn
296: # Set disable_coredump true
297: #
298: # The plugin_path is relative to /usr/local/libexec/sudo unless
299: # fully qualified.
300: # The plugin_name corresponds to a global symbol in the plugin
301: # that contains the plugin interface structure.
302: # The plugin_options are optional.
303: #
304: # The sudoers plugin is used by default if no Plugin lines are
305: # present.
306: Plugin sudoers_policy sudoers.so
307: Plugin sudoers_io sudoers.so
308:
309: #
310: # Sudo askpass:
311: #
312: # An askpass helper program may be specified to provide a graphical
313: # password prompt for "sudo -A" support. Sudo does not ship with
314: # its own askpass program but can use the OpenSSH askpass.
315: #
316: # Use the OpenSSH askpass
317: #Path askpass /usr/X11R6/bin/ssh-askpass
318: #
319: # Use the Gnome OpenSSH askpass
320: #Path askpass /usr/libexec/openssh/gnome-ssh-askpass
321:
322: #
323: # Sudo noexec:
324: #
325: # Path to a shared library containing dummy versions of the execv(),
326: # execve() and fexecve() library functions that just return an error.
327: # This is used to implement the "noexec" functionality on systems that
328: # support C<LD_PRELOAD> or its equivalent.
329: # The compiled-in value is usually sufficient and should only be
330: # changed if you rename or move the sudo_noexec.so file.
331: #
332: #Path noexec /usr/local/libexec/sudo/sudo_noexec.so
333:
334: #
335: # Core dumps:
336: #
337: # By default, sudo disables core dumps while it is executing
338: # (they are re-enabled for the command that is run).
339: # To aid in debugging sudo problems, you may wish to enable core
340: # dumps by setting "disable_coredump" to false.
341: #
342: #Set disable_coredump false
343:
344: #
345: # User groups:
346: #
347: # Sudo passes the user's group list to the policy plugin.
348: # If the user is a member of the maximum number of groups (usually 16),
349: # sudo will query the group database directly to be sure to include
350: # the full list of groups.
351: #
352: # On some systems, this can be expensive so the behavior is configurable.
353: # The "group_source" setting has three possible values:
354: # static - use the user's list of groups returned by the kernel.
355: # dynamic - query the group database to find the list of groups.
356: # adaptive - if user is in less than the maximum number of groups.
357: # use the kernel list, else query the group database.
358: #
359: #Set group_source static
360:
361: SSEEEE AALLSSOO
362: sudoers(4), sudo(1m), sudo_plugin(1m)
363:
364: HHIISSTTOORRYY
365: See the HISTORY file in the ssuuddoo distribution
366: (http://www.sudo.ws/sudo/history.html) for a brief history of sudo.
367:
368: AAUUTTHHOORRSS
369: Many people have worked on ssuuddoo over the years; this version consists of
370: code written primarily by:
371:
372: Todd C. Miller
373:
374: See the CONTRIBUTORS file in the ssuuddoo distribution
375: (http://www.sudo.ws/sudo/contributors.html) for an exhaustive list of
376: people who have contributed to ssuuddoo.
377:
378: BBUUGGSS
379: If you feel you have found a bug in ssuuddoo, please submit a bug report at
380: http://www.sudo.ws/sudo/bugs/
381:
382: SSUUPPPPOORRTT
383: Limited free support is available via the sudo-users mailing list, see
384: http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the
385: archives.
386:
387: DDIISSCCLLAAIIMMEERR
388: ssuuddoo is provided ``AS IS'' and any express or implied warranties,
389: including, but not limited to, the implied warranties of merchantability
390: and fitness for a particular purpose are disclaimed. See the LICENSE
391: file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
392: complete details.
393:
394: Sudo 1.8.10 January 22, 2014 Sudo 1.8.10
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudo.conf.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc