Annotation of embedaddon/sudo/doc/sudo.conf.man.in, revision 1.1
1.1 ! misho 1: .\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
! 2: .\" IT IS GENERATED AUTOMATICALLY FROM sudo.conf.mdoc.in
! 3: .\"
! 4: .\" Copyright (c) 2010-2013 Todd C. Miller <Todd.Miller@courtesan.com>
! 5: .\"
! 6: .\" Permission to use, copy, modify, and distribute this software for any
! 7: .\" purpose with or without fee is hereby granted, provided that the above
! 8: .\" copyright notice and this permission notice appear in all copies.
! 9: .\"
! 10: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
! 11: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
! 12: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
! 13: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
! 14: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
! 15: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
! 16: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
! 17: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
! 18: .\"
! 19: .TH "SUDO" "5" "March 14, 2013" "Sudo @PACKAGE_VERSION@" "OpenBSD Programmer's Manual"
! 20: .nh
! 21: .if n .ad l
! 22: .SH "NAME"
! 23: \fBsudo.conf\fR
! 24: \- configuration for sudo front end
! 25: .SH "DESCRIPTION"
! 26: The
! 27: \fBsudo.conf\fR
! 28: file is used to configure the
! 29: \fBsudo\fR
! 30: front end.
! 31: It specifies the security policy and I/O logging plugins, debug flags
! 32: as well as plugin-agnostic path names and settings.
! 33: .PP
! 34: The
! 35: \fBsudo.conf\fR
! 36: file supports the following directives, described in detail below.
! 37: .TP 10n
! 38: Plugin
! 39: a security policy or I/O logging plugin
! 40: .TP 10n
! 41: Path
! 42: a plugin-agnostic path
! 43: .TP 10n
! 44: Set
! 45: a front end setting, such as
! 46: \fIdisable_coredump\fR
! 47: or
! 48: \fIgroup_source\fR
! 49: .TP 10n
! 50: Debug
! 51: debug flags to aid in debugging
! 52: \fBsudo\fR,
! 53: \fBsudoreplay\fR,
! 54: \fBvisudo\fR,
! 55: and the
! 56: \fBsudoers\fR
! 57: plugin.
! 58: .PP
! 59: The pound sign
! 60: (`#')
! 61: is used to indicate a comment.
! 62: Both the comment character and any text after it, up to the end of
! 63: the line, are ignored.
! 64: .PP
! 65: Long lines can be continued with a backslash
! 66: (`\e')
! 67: as the last character on the line.
! 68: Note that leading white space is removed from the beginning of lines
! 69: even when the continuation character is used.
! 70: .PP
! 71: Non-comment lines that don't begin with
! 72: \fRPlugin\fR,
! 73: \fRPath\fR,
! 74: \fRDebug\fR,
! 75: or
! 76: \fRSet\fR
! 77: are silently ignored.
! 78: .PP
! 79: The
! 80: \fBsudo.conf\fR
! 81: file is always parsed in the
! 82: ``\fRC\fR''
! 83: locale.
! 84: .SS "Plugin configuration"
! 85: \fBsudo\fR
! 86: supports a plugin architecture for security policies and input/output
! 87: logging.
! 88: Third parties can develop and distribute their own policy and I/O
! 89: logging plugins to work seamlessly with the
! 90: \fBsudo\fR
! 91: front end.
! 92: Plugins are dynamically loaded based on the contents of
! 93: \fBsudo.conf\fR.
! 94: .PP
! 95: A
! 96: \fRPlugin\fR
! 97: line consists of the
! 98: \fRPlugin\fR
! 99: keyword, followed by the
! 100: \fIsymbol_name\fR
! 101: and the
! 102: \fIpath\fR
! 103: to the shared object containing the plugin.
! 104: The
! 105: \fIsymbol_name\fR
! 106: is the name of the
! 107: \fRstruct policy_plugin\fR
! 108: or
! 109: \fRstruct io_plugin\fR
! 110: in the plugin shared object.
! 111: The
! 112: \fIpath\fR
! 113: may be fully qualified or relative.
! 114: If not fully qualified, it is relative to the
! 115: \fI@PLUGINDIR@\fR
! 116: directory.
! 117: In other words:
! 118: .nf
! 119: .sp
! 120: .RS 6n
! 121: Plugin sudoers_policy sudoers.so
! 122: .RE
! 123: .fi
! 124: .PP
! 125: is equivalent to:
! 126: .nf
! 127: .sp
! 128: .RS 6n
! 129: Plugin sudoers_policy @PLUGINDIR@/sudoers.so
! 130: .RE
! 131: .fi
! 132: .PP
! 133: Starting with
! 134: \fBsudo\fR
! 135: 1.8.5, any additional parameters after the
! 136: \fIpath\fR
! 137: are passed as arguments to the plugin's
! 138: \fIopen\fR
! 139: function.
! 140: For example, to override the compile-time default sudoers file mode:
! 141: .nf
! 142: .sp
! 143: .RS 6n
! 144: Plugin sudoers_policy sudoers.so sudoers_mode=0440
! 145: .RE
! 146: .fi
! 147: .PP
! 148: The same shared object may contain multiple plugins, each with a
! 149: different symbol name.
! 150: The shared object file must be owned by uid 0 and only writable by its owner.
! 151: Because of ambiguities that arise from composite policies, only a single
! 152: policy plugin may be specified.
! 153: This limitation does not apply to I/O plugins.
! 154: .PP
! 155: If no
! 156: \fBsudo.conf\fR
! 157: file is present, or if it contains no
! 158: \fRPlugin\fR
! 159: lines, the
! 160: \fBsudoers\fR
! 161: plugin will be used as the default security policy and for I/O logging
! 162: (if enabled by the policy).
! 163: This is equivalent to the following:
! 164: .nf
! 165: .sp
! 166: .RS 6n
! 167: Plugin sudoers_policy sudoers.so
! 168: Plugin sudoers_io sudoers.so
! 169: .RE
! 170: .fi
! 171: .PP
! 172: For more information on the
! 173: \fBsudo\fR
! 174: plugin architecture, see the
! 175: sudo_plugin(@mansectsu@)
! 176: manual.
! 177: .SS "Path settings"
! 178: A
! 179: \fRPath\fR
! 180: line consists of the
! 181: \fRPath\fR
! 182: keyword, followed by the name of the path to set and its value.
! 183: For example:
! 184: .nf
! 185: .sp
! 186: .RS 6n
! 187: Path noexec @noexec_file@
! 188: Path askpass /usr/X11R6/bin/ssh-askpass
! 189: .RE
! 190: .fi
! 191: .PP
! 192: The following plugin-agnostic paths may be set in the
! 193: \fI@sysconfdir@/sudo.conf\fR
! 194: file:
! 195: .TP 10n
! 196: askpass
! 197: The fully qualified path to a helper program used to read the user's
! 198: password when no terminal is available.
! 199: This may be the case when
! 200: \fBsudo\fR
! 201: is executed from a graphical (as opposed to text-based) application.
! 202: The program specified by
! 203: \fIaskpass\fR
! 204: should display the argument passed to it as the prompt and write
! 205: the user's password to the standard output.
! 206: The value of
! 207: \fIaskpass\fR
! 208: may be overridden by the
! 209: \fRSUDO_ASKPASS\fR
! 210: environment variable.
! 211: .TP 10n
! 212: noexec
! 213: The fully-qualified path to a shared library containing dummy
! 214: versions of the
! 215: \fBexecv\fR(),
! 216: \fBexecve\fR()
! 217: and
! 218: \fBfexecve\fR()
! 219: library functions that just return an error.
! 220: This is used to implement the
! 221: \fInoexec\fR
! 222: functionality on systems that support
! 223: \fRLD_PRELOAD\fR
! 224: or its equivalent.
! 225: The default value is:
! 226: \fI@noexec_file@\fR.
! 227: .TP 10n
! 228: sesh
! 229: The fully-qualified path to the
! 230: \fBsesh\fR
! 231: binary.
! 232: This setting is only used when
! 233: \fBsudo\fR
! 234: is built with SELinux support.
! 235: The default value is
! 236: \fI@sesh_file@\fR.
! 237: .SS "Other settings"
! 238: The
! 239: \fBsudo.conf\fR
! 240: file also supports the following front end settings:
! 241: .TP 10n
! 242: disable_coredump
! 243: Core dumps of
! 244: \fBsudo\fR
! 245: itself are disabled by default.
! 246: To aid in debugging
! 247: \fBsudo\fR
! 248: crashes, you may wish to re-enable core dumps by setting
! 249: ``disable_coredump''
! 250: to false in
! 251: \fBsudo.conf\fR
! 252: as follows:
! 253: .RS
! 254: .nf
! 255: .sp
! 256: .RS 6n
! 257: Set disable_coredump false
! 258: .RE
! 259: .fi
! 260: .sp
! 261: Note that most operating systems disable core dumps from setuid programs,
! 262: including
! 263: \fBsudo\fR.
! 264: To actually get a
! 265: \fBsudo\fR
! 266: core file you will likely need to enable core dumps for setuid processes.
! 267: On BSD and Linux systems this is accomplished in the
! 268: sysctl
! 269: command.
! 270: On Solaris, the
! 271: coreadm
! 272: command is used to configure core dump behavior.
! 273: .sp
! 274: This setting is only available in
! 275: \fBsudo\fR
! 276: version 1.8.4 and higher.
! 277: .PP
! 278: .RE
! 279: .PD 0
! 280: .TP 10n
! 281: group_source
! 282: \fBsudo\fR
! 283: passes the invoking user's group list to the policy and I/O plugins.
! 284: On most systems, there is an upper limit to the number of groups that
! 285: a user may belong to simultaneously (typically 16 for compatibility
! 286: with NFS).
! 287: On systems with the
! 288: getconf(1)
! 289: utility, running:
! 290: .RS 6n
! 291: getconf NGROUPS_MAX
! 292: .RE
! 293: will return the maximum number of groups.
! 294: .sp
! 295: However, it is still possible to be a member of a larger number of
! 296: groups--they simply won't be included in the group list returned
! 297: by the kernel for the user.
! 298: Starting with
! 299: \fBsudo\fR
! 300: version 1.8.7, if the user's kernel group list has the maximum number
! 301: of entries,
! 302: \fBsudo\fR
! 303: will consult the group database directly to determine the group list.
! 304: This makes it possible for the security policy to perform matching by group
! 305: name even when the user is a member of more than the maximum number of groups.
! 306: .sp
! 307: The
! 308: \fIgroup_source\fR
! 309: setting allows the administrator to change this default behavior.
! 310: Supported values for
! 311: \fIgroup_source\fR
! 312: are:
! 313: .RS
! 314: .PD
! 315: .TP 10n
! 316: static
! 317: Use the static group list that the kernel returns.
! 318: Retrieving the group list this way is very fast but it is subject
! 319: to an upper limit as described above.
! 320: It is
! 321: ``static''
! 322: in that it does not reflect changes to the group database made
! 323: after the user logs in.
! 324: This was the default behavior prior to
! 325: \fBsudo\fR
! 326: 1.8.7.
! 327: .TP 10n
! 328: dynamic
! 329: Always query the group database directly.
! 330: It is
! 331: ``dynamic''
! 332: in that changes made to the group database after the user logs in
! 333: will be reflected in the group list.
! 334: On some systems, querying the group database for all of a user's
! 335: groups can be time consuming when querying a network-based group
! 336: database.
! 337: Most operating systems provide an efficient method of performing
! 338: such queries.
! 339: Currently,
! 340: \fBsudo\fR
! 341: supports efficient group queries on AIX, BSD, HP-UX, Linux and
! 342: Solaris.
! 343: .TP 10n
! 344: adaptive
! 345: Only query the group database if the static group list returned
! 346: by the kernel has the maximum number of entries.
! 347: This is the default behavior in
! 348: \fBsudo\fR
! 349: 1.8.7 and higher.
! 350: .PP
! 351: For example, to cause
! 352: \fBsudo\fR
! 353: to only use the kernel's static list of groups for the user:
! 354: .nf
! 355: .sp
! 356: .RS 6n
! 357: Set group_source static
! 358: .RE
! 359: .fi
! 360: .sp
! 361: This setting is only available in
! 362: \fBsudo\fR
! 363: version 1.8.7 and higher.
! 364: .PP
! 365: .RE
! 366: .PD 0
! 367: .TP 10n
! 368: max_groups
! 369: The maximum number of user groups to retrieve from the group database.
! 370: This setting is only used when querying the group database directly.
! 371: It is intended to be used on systems where it is not possible to detect
! 372: when the array to be populated with group entries is not sufficiently large.
! 373: By default,
! 374: \fBsudo\fR
! 375: will allocate four times the system's maximum number of groups (see above)
! 376: and retry with double that number if the group database query fails.
! 377: However, some systems just return as many entries as will fit and
! 378: do not indicate an error when there is a lack of space.
! 379: .sp
! 380: This setting is only available in
! 381: \fBsudo\fR
! 382: version 1.8.7 and higher.
! 383: .PD
! 384: .SS "Debug flags"
! 385: \fBsudo\fR
! 386: versions 1.8.4 and higher support a flexible debugging framework
! 387: that can help track down what
! 388: \fBsudo\fR
! 389: is doing internally if there is a problem.
! 390: .PP
! 391: A
! 392: \fRDebug\fR
! 393: line consists of the
! 394: \fRDebug\fR
! 395: keyword, followed by the name of the program (or plugin) to debug
! 396: (\fBsudo\fR, \fBvisudo\fR, \fBsudoreplay\fR, \fBsudoers\fR),
! 397: the debug file name and a comma-separated list of debug flags. The
! 398: debug flag syntax used by
! 399: \fBsudo\fR
! 400: and the
! 401: \fBsudoers\fR
! 402: plugin is
! 403: \fIsubsystem\fR@\fIpriority\fR
! 404: but a plugin is free to use a different format so long as it does
! 405: not include a comma
! 406: (`\&,').
! 407: .PP
! 408: For example:
! 409: .nf
! 410: .sp
! 411: .RS 6n
! 412: Debug sudo /var/log/sudo_debug all@warn,plugin@info
! 413: .RE
! 414: .fi
! 415: .PP
! 416: would log all debugging statements at the
! 417: \fIwarn\fR
! 418: level and higher in addition to those at the
! 419: \fIinfo\fR
! 420: level for the plugin subsystem.
! 421: .PP
! 422: Currently, only one
! 423: \fRDebug\fR
! 424: entry per program is supported. The
! 425: \fBsudo\fR
! 426: \fRDebug\fR
! 427: entry is shared by the
! 428: \fBsudo\fR
! 429: front end,
! 430: \fBsudoedit\fR
! 431: and the plugins. A future release may add support for per-plugin
! 432: \fRDebug\fR
! 433: lines and/or support for multiple debugging files for a single
! 434: program.
! 435: .PP
! 436: The priorities used by the
! 437: \fBsudo\fR
! 438: front end, in order of decreasing severity, are:
! 439: \fIcrit\fR, \fIerr\fR, \fIwarn\fR, \fInotice\fR, \fIdiag\fR, \fIinfo\fR, \fItrace\fR
! 440: and
! 441: \fIdebug\fR.
! 442: Each priority, when specified, also includes all priorities higher
! 443: than it. For example, a priority of
! 444: \fInotice\fR
! 445: would include debug messages logged at
! 446: \fInotice\fR
! 447: and higher.
! 448: .PP
! 449: The following subsystems are used by the
! 450: \fBsudo\fR
! 451: front-end:
! 452: .TP 12n
! 453: \fIall\fR
! 454: matches every subsystem
! 455: .TP 12n
! 456: \fIargs\fR
! 457: command line argument processing
! 458: .TP 12n
! 459: \fIconv\fR
! 460: user conversation
! 461: .TP 12n
! 462: \fIedit\fR
! 463: sudoedit
! 464: .TP 12n
! 465: \fIexec\fR
! 466: command execution
! 467: .TP 12n
! 468: \fImain\fR
! 469: \fBsudo\fR
! 470: main function
! 471: .TP 12n
! 472: \fInetif\fR
! 473: network interface handling
! 474: .TP 12n
! 475: \fIpcomm\fR
! 476: communication with the plugin
! 477: .TP 12n
! 478: \fIplugin\fR
! 479: plugin configuration
! 480: .TP 12n
! 481: \fIpty\fR
! 482: pseudo-tty related code
! 483: .TP 12n
! 484: \fIselinux\fR
! 485: SELinux-specific handling
! 486: .TP 12n
! 487: \fIutil\fR
! 488: utility functions
! 489: .TP 12n
! 490: \fIutmp\fR
! 491: utmp handling
! 492: .PP
! 493: The
! 494: sudoers(@mansectform@)
! 495: plugin includes support for additional subsystems.
! 496: .SH "FILES"
! 497: .TP 26n
! 498: \fI@sysconfdir@/sudo.conf\fR
! 499: \fBsudo\fR
! 500: front end configuration
! 501: .SH "EXAMPLES"
! 502: .nf
! 503: .RS 0n
! 504: #
! 505: # Default @sysconfdir@/sudo.conf file
! 506: #
! 507: # Format:
! 508: # Plugin plugin_name plugin_path plugin_options ...
! 509: # Path askpass /path/to/askpass
! 510: # Path noexec /path/to/sudo_noexec.so
! 511: # Debug sudo /var/log/sudo_debug all@warn
! 512: # Set disable_coredump true
! 513: #
! 514: # The plugin_path is relative to @PLUGINDIR@ unless
! 515: # fully qualified.
! 516: # The plugin_name corresponds to a global symbol in the plugin
! 517: # that contains the plugin interface structure.
! 518: # The plugin_options are optional.
! 519: #
! 520: # The sudoers plugin is used by default if no Plugin lines are
! 521: # present.
! 522: Plugin sudoers_policy sudoers.so
! 523: Plugin sudoers_io sudoers.so
! 524:
! 525: #
! 526: # Sudo askpass:
! 527: #
! 528: # An askpass helper program may be specified to provide a graphical
! 529: # password prompt for "sudo -A" support. Sudo does not ship with
! 530: # its own askpass program but can use the OpenSSH askpass.
! 531: #
! 532: # Use the OpenSSH askpass
! 533: #Path askpass /usr/X11R6/bin/ssh-askpass
! 534: #
! 535: # Use the Gnome OpenSSH askpass
! 536: #Path askpass /usr/libexec/openssh/gnome-ssh-askpass
! 537:
! 538: #
! 539: # Sudo noexec:
! 540: #
! 541: # Path to a shared library containing dummy versions of the execv(),
! 542: # execve() and fexecve() library functions that just return an error.
! 543: # This is used to implement the "noexec" functionality on systems that
! 544: # support C<LD_PRELOAD> or its equivalent.
! 545: # The compiled-in value is usually sufficient and should only be
! 546: # changed if you rename or move the sudo_noexec.so file.
! 547: #
! 548: #Path noexec @noexec_file@
! 549:
! 550: #
! 551: # Core dumps:
! 552: #
! 553: # By default, sudo disables core dumps while it is executing
! 554: # (they are re-enabled for the command that is run).
! 555: # To aid in debugging sudo problems, you may wish to enable core
! 556: # dumps by setting "disable_coredump" to false.
! 557: #
! 558: #Set disable_coredump false
! 559:
! 560: #
! 561: # User groups:
! 562: #
! 563: # Sudo passes the user's group list to the policy plugin.
! 564: # If the user is a member of the maximum number of groups (usually 16),
! 565: # sudo will query the group database directly to be sure to include
! 566: # the full list of groups.
! 567: #
! 568: # On some systems, this can be expensive so the behavior is configurable.
! 569: # The "group_source" setting has three possible values:
! 570: # static - use the user's list of groups returned by the kernel.
! 571: # dynamic - query the group database to find the list of groups.
! 572: # adaptive - if user is in less than the maximum number of groups.
! 573: # use the kernel list, else query the group database.
! 574: #
! 575: #Set group_source static
! 576: .RE
! 577: .fi
! 578: .SH "SEE ALSO"
! 579: sudoers(@mansectform@),
! 580: sudo(@mansectsu@),
! 581: sudo_plugin(@mansectsu@)
! 582: .SH "HISTORY"
! 583: See the HISTORY file in the
! 584: \fBsudo\fR
! 585: distribution (http://www.sudo.ws/sudo/history.html) for a brief
! 586: history of sudo.
! 587: .SH "AUTHORS"
! 588: Many people have worked on
! 589: \fBsudo\fR
! 590: over the years; this version consists of code written primarily by:
! 591: .sp
! 592: .RS 6n
! 593: Todd C. Miller
! 594: .RE
! 595: .PP
! 596: See the CONTRIBUTORS file in the
! 597: \fBsudo\fR
! 598: distribution (http://www.sudo.ws/sudo/contributors.html) for an
! 599: exhaustive list of people who have contributed to
! 600: \fBsudo\fR.
! 601: .SH "BUGS"
! 602: If you feel you have found a bug in
! 603: \fBsudo\fR,
! 604: please submit a bug report at http://www.sudo.ws/sudo/bugs/
! 605: .SH "SUPPORT"
! 606: Limited free support is available via the sudo-users mailing list,
! 607: see http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
! 608: search the archives.
! 609: .SH "DISCLAIMER"
! 610: \fBsudo\fR
! 611: is provided
! 612: ``AS IS''
! 613: and any express or implied warranties, including, but not limited
! 614: to, the implied warranties of merchantability and fitness for a
! 615: particular purpose are disclaimed.
! 616: See the LICENSE file distributed with
! 617: \fBsudo\fR
! 618: or http://www.sudo.ws/sudo/license.html for complete details.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudo.conf.man.in CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc