Annotation of embedaddon/sudo/doc/sudo.man.in, revision 1.1.1.3
1.1.1.3 ! misho 1: .\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
! 2: .\" IT IS GENERATED AUTOMATICALLY FROM sudo.mdoc.in
! 3: .\"
1.1.1.2 misho 4: .\" Copyright (c) 1994-1996, 1998-2005, 2007-2012
1.1.1.3 ! misho 5: .\" Todd C. Miller <Todd.Miller@courtesan.com>
! 6: .\"
1.1 misho 7: .\" Permission to use, copy, modify, and distribute this software for any
8: .\" purpose with or without fee is hereby granted, provided that the above
9: .\" copyright notice and this permission notice appear in all copies.
1.1.1.3 ! misho 10: .\"
1.1 misho 11: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.1.1.3 ! misho 19: .\"
1.1 misho 20: .\" Sponsored in part by the Defense Advanced Research Projects
21: .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
22: .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
23: .\"
1.1.1.3 ! misho 24: .TH "SUDO" "@mansectsu@" "July 10, 2012" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
1.1 misho 25: .nh
1.1.1.3 ! misho 26: .if n .ad l
1.1 misho 27: .SH "NAME"
1.1.1.3 ! misho 28: \fBsudo\fR,
! 29: \fBsudoedit\fR
! 30: \- execute a command as another user
1.1 misho 31: .SH "SYNOPSIS"
1.1.1.3 ! misho 32: .HP 5n
! 33: \fBsudo\fR
! 34: \fB\-h\fR | \fB\-K\fR | \fB\-k\fR | \fB\-V\fR
! 35: .PD 0
! 36: .HP 5n
! 37: \fBsudo\fR
! 38: \fB\-v\fR
! 39: [\fB\-AknS\fR]
! 40: [\fB\-a\fR\ \fIauth_type\fR]
! 41: [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
! 42: [\fB\-p\fR\ \fIprompt\fR]
! 43: [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
! 44: .br
! 45: .HP 5n
! 46: \fBsudo\fR
! 47: \fB\-l\fR[\fIl\fR]
! 48: [\fB\-AknS\fR]
! 49: [\fB\-a\fR\ \fIauth_type\fR]
! 50: [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
! 51: [\fB\-p\fR\ \fIprompt\fR]
! 52: [\fB\-U\fR\ \fIuser\ name\fR]
! 53: [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
! 54: [\fIcommand\fR]
! 55: .br
! 56: .HP 5n
! 57: \fBsudo\fR
! 58: [\fB\-AbEHnPS\fR]
! 59: [\fB\-a\fR\ \fIauth_type\fR]
1.1 misho 60: [\fB\-C\fR\ \fIfd\fR]
1.1.1.3 ! misho 61: [\fB\-c\fR\ \fIclass\fR\ |\ \fI-\fR]
! 62: [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
! 63: [\fB\-p\fR\ \fIprompt\fR]
! 64: [\fB\-r\fR\ \fIrole\fR]
! 65: [\fB\-t\fR\ \fItype\fR]
! 66: [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
! 67: [\fBVAR\fR=\fIvalue\fR]
! 68: \fB\-i\fR\ |\ \fB\-s\fR
! 69: [\fIcommand\fR]
! 70: .br
! 71: .HP 9n
! 72: \fBsudoedit\fR
! 73: [\fB\-AnS\fR]
! 74: [\fB\-a\fR\ \fIauth_type\fR]
1.1 misho 75: [\fB\-C\fR\ \fIfd\fR]
1.1.1.3 ! misho 76: [\fB\-c\fR\ \fIclass\fR\ |\ \fI-\fR]
! 77: [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
! 78: [\fB\-p\fR\ \fIprompt\fR]
! 79: [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
! 80: file ...
! 81: .PD
1.1 misho 82: .SH "DESCRIPTION"
1.1.1.3 ! misho 83: \fBsudo\fR
! 84: allows a permitted user to execute a
! 85: \fIcommand\fR
! 86: as the superuser or another user, as specified by the security
! 87: policy.
! 88: .PP
! 89: \fBsudo\fR
! 90: supports a plugin architecture for security policies and input/output
! 91: logging.
! 92: Third parties can develop and distribute their own policy and I/O
! 93: logging plugins to work seamlessly with the
! 94: \fBsudo\fR
! 95: front end.
! 96: The default security policy is
! 97: \fIsudoers\fR,
! 98: which is configured via the file
! 99: \fI@sysconfdir@/sudoers\fR,
! 100: or via LDAP.
! 101: See the
! 102: \fIPLUGINS\fR
! 103: section for more information.
1.1 misho 104: .PP
105: The security policy determines what privileges, if any, a user has
1.1.1.3 ! misho 106: to run
! 107: \fBsudo\fR.
! 108: The policy may require that users authenticate themselves with a
! 109: password or another authentication mechanism.
! 110: If authentication is required,
! 111: \fBsudo\fR
! 112: will exit if the user's password is not entered within a configurable
! 113: time limit.
! 114: This limit is policy-specific; the default password prompt timeout
! 115: for the
! 116: \fIsudoers\fR
! 117: security policy is
! 118: \fR@password_timeout@\fR
! 119: minutes.
1.1 misho 120: .PP
121: Security policies may support credential caching to allow the user
1.1.1.3 ! misho 122: to run
! 123: \fBsudo\fR
! 124: again for a period of time without requiring authentication.
! 125: The
! 126: \fIsudoers\fR
! 127: policy caches credentials for
! 128: \fR@timeout@\fR
! 129: minutes, unless overridden in
! 130: sudoers(@mansectform@).
! 131: By running
! 132: \fBsudo\fR
! 133: with the
! 134: \fB\-v\fR
! 135: option, a user can update the cached credentials without running a
! 136: \fIcommand\fR.
! 137: .PP
! 138: When invoked as
! 139: \fBsudoedit\fR,
! 140: the
! 141: \fB\-e\fR
! 142: option (described below), is implied.
1.1 misho 143: .PP
144: Security policies may log successful and failed attempts to use
1.1.1.3 ! misho 145: \fBsudo\fR.
! 146: If an I/O plugin is configured, the running command's input and
! 147: output may be logged as well.
! 148: .PP
! 149: The options are as follows:
! 150: .TP 12n
! 151: \fB\-A\fR
! 152: Normally, if
! 153: \fBsudo\fR
! 154: requires a password, it will read it from the user's terminal.
! 155: If the
! 156: \fB\-A\fR (\fIaskpass\fR)
! 157: option is specified, a (possibly graphical) helper program is
! 158: executed to read the user's password and output the password to the
! 159: standard output.
! 160: If the
! 161: \fRSUDO_ASKPASS\fR
! 162: environment variable is set, it specifies the path to the helper
! 163: program.
! 164: Otherwise, if
! 165: \fI@sysconfdir@/sudo.conf\fR
1.1 misho 166: contains a line specifying the askpass program, that value will be
1.1.1.3 ! misho 167: used.
! 168: For example:
! 169: .RS
! 170: .nf
! 171: .sp
! 172: .RS 4n
! 173: # Path to askpass helper program
! 174: Path askpass /usr/X11R6/bin/ssh-askpass
! 175: .RE
! 176: .fi
! 177: .sp
! 178: If no askpass program is available,
! 179: \fBsudo\fR
! 180: will exit with an error.
! 181: .PP
! 182: .RE
! 183: .PD 0
! 184: .TP 12n
! 185: \fB\-a\fR \fItype\fR
! 186: The
! 187: \fB\-a\fR (\fIauthentication type\fR)
! 188: option causes
! 189: \fBsudo\fR
! 190: to use the specified authentication type when validating the user,
! 191: as allowed by
! 192: \fI/etc/login.conf\fR.
! 193: The system administrator may specify a list of sudo-specific
! 194: authentication methods by adding an
! 195: ``auth-sudo''
! 196: entry in
! 197: \fI/etc/login.conf\fR.
! 198: This option is only available on systems that support BSD authentication.
! 199: .PD
! 200: .TP 12n
! 201: \fB\-b\fR
! 202: The
! 203: \fB\-b\fR (\fIbackground\fR)
! 204: option tells
! 205: \fBsudo\fR
! 206: to run the given command in the background.
! 207: Note that if you use the
! 208: \fB\-b\fR
1.1 misho 209: option you cannot use shell job control to manipulate the process.
210: Most interactive commands will fail to work properly in background
211: mode.
1.1.1.3 ! misho 212: .TP 12n
! 213: \fB\-C\fR \fIfd\fR
! 214: Normally,
! 215: \fBsudo\fR
! 216: will close all open file descriptors other than standard input,
! 217: standard output and standard error.
! 218: The
! 219: \fB\-C\fR (\fIclose from\fR)
! 220: option allows the user to specify a starting point above the standard
! 221: error (file descriptor three).
! 222: Values less than three are not permitted.
! 223: The security policy may restrict the user's ability to use the
! 224: \fB\-C\fR
! 225: option.
! 226: The
! 227: \fIsudoers\fR
! 228: policy only permits use of the
! 229: \fB\-C\fR
! 230: option when the administrator has enabled the
! 231: \fIclosefrom_override\fR
! 232: option.
! 233: .TP 12n
! 234: \fB\-c\fR \fIclass\fR
! 235: The
! 236: \fB\-c\fR (\fIclass\fR)
! 237: option causes
! 238: \fBsudo\fR
! 239: to run the specified command with resources limited by the specified
! 240: login class.
! 241: The
! 242: \fIclass\fR
! 243: argument can be either a class name as defined in
! 244: \fI/etc/login.conf\fR,
! 245: or a single
! 246: `\-'
! 247: character.
! 248: Specifying a
! 249: \fIclass\fR
! 250: of
! 251: \fR-\fR
! 252: indicates that the command should be run restricted by the default
! 253: login capabilities for the user the command is run as.
! 254: If the
! 255: \fIclass\fR
1.1 misho 256: argument specifies an existing user class, the command must be run
1.1.1.3 ! misho 257: as root, or the
! 258: \fBsudo\fR
! 259: command must be run from a shell that is already root.
! 260: This option is only available on systems with BSD login classes.
! 261: .TP 12n
! 262: \fB\-E\fR
! 263: The
! 264: \fB\-E\fR (\fIpreserve environment\fR)
! 265: option indicates to the security policy that the user wishes to
! 266: preserve their existing environment variables.
! 267: The security policy may return an error if the
! 268: \fB\-E\fR
! 269: option is specified and the user does not have permission to preserve
! 270: the environment.
! 271: .TP 12n
! 272: \fB\-e\fR
! 273: The
! 274: \fB\-e\fR (\fIedit\fR)
! 275: option indicates that, instead of running a command, the user wishes
! 276: to edit one or more files.
! 277: In lieu of a command, the string "sudoedit" is used when consulting
! 278: the security policy.
! 279: If the user is authorized by the policy, the following steps are
! 280: taken:
! 281: .RS
! 282: .TP 5n
! 283: 1.
1.1 misho 284: Temporary copies are made of the files to be edited with the owner
285: set to the invoking user.
1.1.1.3 ! misho 286: .TP 5n
! 287: 2.
! 288: The editor specified by the policy is run to edit the temporary
! 289: files.
! 290: The
! 291: \fIsudoers\fR
! 292: policy uses the
! 293: \fRSUDO_EDITOR\fR,
! 294: \fRVISUAL\fR
! 295: and
! 296: \fREDITOR\fR
! 297: environment variables (in that order).
! 298: If none of
! 299: \fRSUDO_EDITOR\fR,
! 300: \fRVISUAL\fR
! 301: or
! 302: \fREDITOR\fR
! 303: are set, the first program listed in the
! 304: \fIeditor\fR
! 305: sudoers(@mansectform@)
! 306: option is used.
! 307: .TP 5n
! 308: 3.
1.1 misho 309: If they have been modified, the temporary files are copied back to
310: their original location and the temporary versions are removed.
1.1.1.3 ! misho 311: .PP
! 312: If the specified file does not exist, it will be created.
! 313: Note that unlike most commands run by
! 314: \fIsudo\fR,
! 315: the editor is run with the invoking user's environment unmodified.
! 316: If, for some reason,
! 317: \fBsudo\fR
! 318: is unable to update a file with its edited version, the user will
! 319: receive a warning and the edited copy will remain in a temporary
! 320: file.
! 321: .PP
1.1 misho 322: .RE
1.1.1.3 ! misho 323: .PD 0
! 324: .TP 12n
! 325: \fB\-g\fR \fIgroup\fR
! 326: Normally,
! 327: \fBsudo\fR
! 328: runs a command with the primary group set to the one specified by
! 329: the password database for the user the command is being run as (by
! 330: default, root).
! 331: The
! 332: \fB\-g\fR (\fIgroup\fR)
! 333: option causes
! 334: \fBsudo\fR
! 335: to run the command with the primary group set to
! 336: \fIgroup\fR
! 337: instead.
! 338: To specify a
! 339: \fIgid\fR
! 340: instead of a
! 341: \fIgroup name\fR,
! 342: use
! 343: \fI#gid\fR.
! 344: When running commands as a
! 345: \fIgid\fR,
! 346: many shells require that the
! 347: `#'
! 348: be escaped with a backslash
! 349: (`\e').
! 350: If no
! 351: \fB\-u\fR
! 352: option is specified, the command will be run as the invoking user
! 353: (not root).
! 354: In either case, the primary group will be set to
! 355: \fIgroup\fR.
! 356: .PD
! 357: .TP 12n
! 358: \fB\-H\fR
! 359: The
! 360: \fB\-H\fR (\fIHOME\fR)
! 361: option requests that the security policy set the
! 362: \fRHOME\fR
! 363: environment variable to the home directory of the target user (root
! 364: by default) as specified by the password database.
1.1 misho 365: Depending on the policy, this may be the default behavior.
1.1.1.3 ! misho 366: .TP 12n
! 367: \fB\-h\fR
! 368: The
! 369: \fB\-h\fR (\fIhelp\fR)
! 370: option causes
! 371: \fBsudo\fR
! 372: to print a short help message to the standard output and exit.
! 373: .TP 12n
! 374: \fB\-i\fR [\fIcommand\fR]
! 375: The
! 376: \fB\-i\fR (\fIsimulate initial login\fR)
! 377: option runs the shell specified by the password database entry of
! 378: the target user as a login shell.
! 379: This means that login-specific resource files such as
! 380: \fI.profile\fR
! 381: or
! 382: \fI.login\fR
! 383: will be read by the shell.
! 384: If a command is specified, it is passed to the shell for execution
! 385: via the shell's
! 386: \fB\-c\fR
! 387: option.
1.1 misho 388: If no command is specified, an interactive shell is executed.
1.1.1.3 ! misho 389: \fBsudo\fR
! 390: attempts to change to that user's home directory before running the
! 391: shell.
! 392: The security policy shall initialize the environment to a minimal
! 393: set of variables, similar to what is present when a user logs in.
! 394: The
! 395: \fICommand Environment\fR
! 396: section in the
! 397: sudoers(@mansectform@)
! 398: manual documents how the
! 399: \fB\-i\fR
! 400: option affects the environment in which a command is run when the
! 401: \fIsudoers\fR
! 402: policy is in use.
! 403: .TP 12n
! 404: \fB\-K\fR
! 405: The
! 406: \fB\-K\fR (sure \fIkill\fR)
! 407: option is like
! 408: \fB\-k\fR
! 409: except that it removes the user's cached credentials entirely and
! 410: may not be used in conjunction with a command or other option.
! 411: This option does not require a password.
! 412: Not all security policies support credential caching.
! 413: .TP 12n
! 414: \fB\-k\fR [\fIcommand\fR]
! 415: When used alone, the
! 416: \fB\-k\fR (\fIkill\fR)
! 417: option to
! 418: \fBsudo\fR
! 419: invalidates the user's cached credentials.
! 420: The next time
! 421: \fBsudo\fR
! 422: is run a password will be required.
! 423: This option does not require a password and was added to allow a
! 424: user to revoke
! 425: \fBsudo\fR
! 426: permissions from a
! 427: \fI.logout\fR
! 428: file.
! 429: Not all security policies support credential caching.
! 430: .sp
1.1 misho 431: When used in conjunction with a command or an option that may require
1.1.1.3 ! misho 432: a password, the
! 433: \fB\-k\fR
! 434: option will cause
! 435: \fBsudo\fR
! 436: to ignore the user's cached credentials.
! 437: As a result,
! 438: \fBsudo\fR
! 439: will prompt for a password (if one is required by the security
! 440: policy) and will not update the user's cached credentials.
! 441: .TP 12n
! 442: \fB\-l\fR[\fBl\fR] [\fIcommand\fR]
! 443: If no
! 444: \fIcommand\fR
! 445: is specified, the
! 446: \fB\-l\fR (\fIlist\fR)
! 447: option will list the allowed (and forbidden) commands for the
! 448: invoking user (or the user specified by the
! 449: \fB\-U\fR
! 450: option) on the current host.
! 451: If a
! 452: \fIcommand\fR
! 453: is specified and is permitted by the security policy, the fully-qualified
! 454: path to the command is displayed along with any command line
! 455: arguments.
! 456: If
! 457: \fIcommand\fR
! 458: is specified but not allowed,
! 459: \fBsudo\fR
! 460: will exit with a status value of 1.
! 461: If the
! 462: \fB\-l\fR
! 463: option is specified with an
! 464: \fIl\fR
! 465: argument
! 466: (i.e.\& \fB\-ll\fR),
! 467: or if
! 468: \fB\-l\fR
! 469: is specified multiple times, a longer list format is used.
! 470: .TP 12n
! 471: \fB\-n\fR
! 472: The
! 473: \fB\-n\fR (\fInon-interactive\fR)
! 474: option prevents
! 475: \fBsudo\fR
! 476: from prompting the user for a password.
! 477: If a password is required for the command to run,
! 478: \fBsudo\fR
! 479: will display an error message and exit.
! 480: .TP 12n
! 481: \fB\-P\fR
! 482: The
! 483: \fB\-P\fR (\fIpreserve group vector\fR)
! 484: option causes
! 485: \fBsudo\fR
! 486: to preserve the invoking user's group vector unaltered.
! 487: By default, the
! 488: \fIsudoers\fR
! 489: policy will initialize the group vector to the list of groups the
! 490: target user is in.
! 491: The real and effective group IDs, however, are still set to match
! 492: the target user.
! 493: .TP 12n
! 494: \fB\-p\fR \fIprompt\fR
! 495: The
! 496: \fB\-p\fR (\fIprompt\fR)
! 497: option allows you to override the default password prompt and use
! 498: a custom one.
! 499: The following percent
! 500: (`%')
! 501: escapes are supported by the
! 502: \fIsudoers\fR
! 503: policy:
! 504: .RS
! 505: .TP 4n
! 506: \fR%H\fR
! 507: expanded to the host name including the domain name (on if the
! 508: machine's host name is fully qualified or the
! 509: \fIfqdn\fR
! 510: option is set in
! 511: sudoers(@mansectform@))
! 512: .TP 4n
! 513: \fR%h\fR
1.1 misho 514: expanded to the local host name without the domain name
1.1.1.3 ! misho 515: .TP 4n
! 516: \fR%p\fR
1.1 misho 517: expanded to the name of the user whose password is being requested
1.1.1.3 ! misho 518: (respects the
! 519: \fIrootpw\fR,
! 520: \fItargetpw\fR,
! 521: and
! 522: \fIrunaspw\fR
! 523: flags in
! 524: sudoers(@mansectform@))
! 525: .TP 4n
! 526: \fR\&%U\fR
1.1 misho 527: expanded to the login name of the user the command will be run as
1.1.1.3 ! misho 528: (defaults to root unless the
! 529: \fB\-u\fR
! 530: option is also specified)
! 531: .TP 4n
! 532: \fR%u\fR
1.1 misho 533: expanded to the invoking user's login name
1.1.1.3 ! misho 534: .TP 4n
! 535: \fR%%\fR
! 536: two consecutive
! 537: `%'
! 538: characters are collapsed into a single
! 539: `%'
! 540: character
! 541: .PP
! 542: The prompt specified by the
! 543: \fB\-p\fR
! 544: option will override the system password prompt on systems that
! 545: support PAM unless the
! 546: \fIpassprompt_override\fR
! 547: flag is disabled in
! 548: \fIsudoers\fR.
! 549: .PP
! 550: .RE
! 551: .PD 0
! 552: .TP 12n
! 553: \fB\-r\fR \fIrole\fR
! 554: The
! 555: \fB\-r\fR (\fIrole\fR)
! 556: option causes the new (SELinux) security context to have the role
! 557: specified by
! 558: \fIrole\fR.
! 559: .PD
! 560: .TP 12n
! 561: \fB\-S\fR
! 562: The
! 563: \fB\-S\fR (\fIstdin\fR)
! 564: option causes
! 565: \fBsudo\fR
! 566: to read the password from the standard input instead of the terminal
! 567: device.
! 568: The password must be followed by a newline character.
! 569: .TP 12n
! 570: \fB\-s\fR [\fIcommand\fR]
! 571: The
! 572: \fB\-s\fR (\fIshell\fR)
! 573: option runs the shell specified by the
! 574: \fRSHELL\fR
1.1 misho 575: environment variable if it is set or the shell as specified in the
1.1.1.3 ! misho 576: password database.
! 577: If a command is specified, it is passed to the shell for execution
! 578: via the shell's
! 579: \fB\-c\fR
! 580: option.
! 581: If no command is specified, an interactive shell is executed.
! 582: .TP 12n
! 583: \fB\-t\fR \fItype\fR
! 584: The
! 585: \fB\-t\fR (\fItype\fR)
! 586: option causes the new (SELinux) security context to have the type
! 587: specified by
! 588: \fItype\fR.
! 589: If no type is specified, the default type is derived from the
! 590: specified role.
! 591: .TP 12n
! 592: \fB\-U\fR \fIuser\fR
! 593: The
! 594: \fB\-U\fR (\fIother user\fR)
! 595: option is used in conjunction with the
! 596: \fB\-l\fR
! 597: option to specify the user whose privileges should be listed.
1.1 misho 598: The security policy may restrict listing other users' privileges.
1.1.1.3 ! misho 599: The
! 600: \fIsudoers\fR
! 601: policy only allows root or a user with the
! 602: \fRALL\fR
1.1 misho 603: privilege on the current host to use this option.
1.1.1.3 ! misho 604: .TP 12n
! 605: \fB\-u\fR \fIuser\fR
! 606: The
! 607: \fB\-u\fR (\fIuser\fR)
! 608: option causes
! 609: \fBsudo\fR
! 610: to run the specified command as a user other than
! 611: \fIroot\fR.
! 612: To specify a
! 613: \fIuid\fR
! 614: instead of a
! 615: \fIuser name\fR,
! 616: \fI#uid\fR.
! 617: When running commands as a
! 618: \fIuid\fR,
! 619: many shells require that the
! 620: `#'
! 621: be escaped with a backslash
! 622: (`\e').
! 623: Security policies may restrict
! 624: \fIuid\fRs
! 625: to those listed in the password database.
! 626: The
! 627: \fIsudoers\fR
! 628: policy allows
! 629: \fIuid\fRs
! 630: that are not in the password database as long as the
! 631: \fItargetpw\fR
! 632: option is not set.
! 633: Other security policies may not support this.
! 634: .TP 12n
! 635: \fB\-V\fR
! 636: The
! 637: \fB\-V\fR (\fIversion\fR)
! 638: option causes
! 639: \fBsudo\fR
! 640: to print its version string and the version string of the security
! 641: policy plugin and any I/O plugins.
! 642: If the invoking user is already root the
! 643: \fB\-V\fR
! 644: option will display the arguments passed to configure when
! 645: \fBsudo\fR
! 646: was built and plugins may display more verbose information such as
1.1 misho 647: default options.
1.1.1.3 ! misho 648: .TP 12n
! 649: \fB\-v\fR
! 650: When given the
! 651: \fB\-v\fR (\fIvalidate\fR)
! 652: option,
! 653: \fBsudo\fR
! 654: will update the user's cached credentials, authenticating the user's
! 655: password if necessary.
! 656: For the
! 657: \fIsudoers\fR
! 658: plugin, this extends the
! 659: \fBsudo\fR
! 660: timeout for another
! 661: \fR@timeout@\fR
! 662: minutes (or whatever the timeout is set to by the security policy)
! 663: but does not run a command.
! 664: Not all security policies support cached credentials.
! 665: .TP 12n
! 666: \fB\--\fR
! 667: The
! 668: \fB\--\fR
! 669: option indicates that
! 670: \fBsudo\fR
! 671: should stop processing command line arguments.
1.1 misho 672: .PP
673: Environment variables to be set for the command may also be passed
1.1.1.3 ! misho 674: on the command line in the form of
! 675: \fBVAR\fR=\fIvalue\fR,
! 676: e.g.\&
! 677: \fBLD_LIBRARY_PATH\fR=\fI/usr/local/pkg/lib\fR.
! 678: Variables passed on the command line are subject to the same
! 679: restrictions as normal environment variables with one important
! 680: exception.
! 681: If the
! 682: \fIsetenv\fR
! 683: option is set in
! 684: \fIsudoers\fR,
! 685: the command to be run has the
! 686: \fRSETENV\fR
! 687: tag set or the command matched is
! 688: \fRALL\fR,
! 689: the user may set variables that would otherwise be forbidden.
! 690: See
! 691: sudoers(@mansectform@)
! 692: for more information.
! 693: .SH "COMMAND EXECUTION"
! 694: When
! 695: \fBsudo\fR
! 696: executes a command, the security policy specifies the execution
! 697: envionment for the command.
! 698: Typically, the real and effective uid and gid are set to
! 699: match those of the target user, as specified in the password database,
! 700: and the group vector is initialized based on the group database
! 701: (unless the
! 702: \fB\-P\fR
! 703: option was specified).
! 704: .PP
! 705: The following parameters may be specified by security policy:
! 706: .TP 4n
! 707: \fBo\fR
! 708: real and effective user ID
! 709: .TP 4n
! 710: \fBo\fR
! 711: real and effective group ID
! 712: .TP 4n
! 713: \fBo\fR
! 714: supplementary group IDs
! 715: .TP 4n
! 716: \fBo\fR
! 717: the environment list
! 718: .TP 4n
! 719: \fBo\fR
! 720: current working directory
! 721: .TP 4n
! 722: \fBo\fR
! 723: file creation mode mask (umask)
! 724: .TP 4n
! 725: \fBo\fR
! 726: SELinux role and type
! 727: .TP 4n
! 728: \fBo\fR
! 729: Solaris project
! 730: .TP 4n
! 731: \fBo\fR
! 732: Solaris privileges
! 733: .TP 4n
! 734: \fBo\fR
! 735: BSD login class
! 736: .TP 4n
! 737: \fBo\fR
! 738: scheduling priority (aka nice value)
! 739: .SS "Process model"
! 740: When
! 741: \fBsudo\fR
! 742: runs a command, it calls
! 743: fork(2),
! 744: sets up the execution environment as described above, and calls the
! 745: execve
! 746: system call in the child process.
! 747: The main
! 748: \fBsudo\fR
! 749: process waits until the command has completed, then passes the
! 750: command's exit status to the security policy's close method and exits.
! 751: If an I/O logging plugin is configured, a new pseudo-terminal
! 752: (``pty'')
! 753: is created and a second
! 754: \fBsudo\fR
! 755: process is used to relay job control signals between the user's
! 756: existing pty and the new pty the command is being run in.
! 757: This extra process makes it possible to, for example, suspend
! 758: and resume the command.
! 759: Without it, the command would be in what POSIX terms an
! 760: ``orphaned process group''
! 761: and it would not receive any job control signals.
! 762: .SS "Signal handling"
! 763: Because the command is run as a child of the
! 764: \fBsudo\fR
! 765: process,
! 766: \fBsudo\fR
! 767: will relay signals it receives to the command.
! 768: Unless the command is being run in a new pty, the
! 769: \fRSIGHUP\fR,
! 770: \fRSIGINT\fR
! 771: and
! 772: \fRSIGQUIT\fR
! 773: signals are not relayed unless they are sent by a user process,
! 774: not the kernel.
! 775: Otherwise, the command would receive
! 776: \fRSIGINT\fR
! 777: twice every time the user entered control-C.
! 778: Some signals, such as
! 779: \fRSIGSTOP\fR
! 780: and
! 781: \fRSIGKILL\fR,
! 782: cannot be caught and thus will not be relayed to the command.
! 783: As a general rule,
! 784: \fRSIGTSTP\fR
! 785: should be used instead of
! 786: \fRSIGSTOP\fR
! 787: when you wish to suspend a command being run by
! 788: \fBsudo\fR.
! 789: .PP
! 790: As a special case,
! 791: \fBsudo\fR
! 792: will not relay signals that were sent by the command it is running.
! 793: This prevents the command from accidentally killing itself.
! 794: On some systems, the
! 795: reboot(@mansectsu@)
! 796: command sends
! 797: \fRSIGTERM\fR
! 798: to all non-system processes other than itself before rebooting
! 799: the systyem.
! 800: This prevents
! 801: \fBsudo\fR
! 802: from relaying the
! 803: \fRSIGTERM\fR
! 804: signal it received back to
! 805: reboot(@mansectsu@),
! 806: which might then exit before the system was actually rebooted,
! 807: leaving it in a half-dead state similar to single user mode.
! 808: Note, however, that this check only applies to the command run by
! 809: \fBsudo\fR
! 810: and not any other processes that the command may create.
! 811: As a result, running a script that calls
! 812: reboot(@mansectsu@)
! 813: or
! 814: shutdown(@mansectsu@)
! 815: via
! 816: \fBsudo\fR
! 817: may cause the system to end up in this undefined state unless the
! 818: reboot(@mansectsu@)
! 819: or
! 820: shutdown(@mansectsu@)
! 821: are run using the
! 822: \fBexec\fR()
! 823: family of functions instead of
! 824: \fBsystem\fR()
! 825: (which interposes a shell between the command and the calling process).
1.1 misho 826: .SH "PLUGINS"
827: Plugins are dynamically loaded based on the contents of the
1.1.1.3 ! misho 828: \fI@sysconfdir@/sudo.conf\fR
! 829: file.
! 830: If no
! 831: \fI@sysconfdir@/sudo.conf\fR
! 832: file is present, or it contains no
! 833: \fRPlugin\fR
! 834: lines,
! 835: \fBsudo\fR
! 836: will use the traditional
! 837: \fIsudoers\fR
! 838: security policy and I/O logging, which corresponds to the following
! 839: \fI@sysconfdir@/sudo.conf\fR
! 840: file.
! 841: .nf
! 842: .sp
! 843: .RS 0n
! 844: #
! 845: # Default @sysconfdir@/sudo.conf file
! 846: #
! 847: # Format:
! 848: # Plugin plugin_name plugin_path plugin_options ...
! 849: # Path askpass /path/to/askpass
! 850: # Path noexec /path/to/sudo_noexec.so
! 851: # Debug sudo /var/log/sudo_debug all@warn
! 852: # Set disable_coredump true
! 853: #
! 854: # The plugin_path is relative to @prefix@/libexec unless
! 855: # fully qualified.
! 856: # The plugin_name corresponds to a global symbol in the plugin
! 857: # that contains the plugin interface structure.
! 858: # The plugin_options are optional.
! 859: #
! 860: Plugin policy_plugin sudoers.so
! 861: Plugin io_plugin sudoers.so
! 862: .RE
! 863: .fi
1.1 misho 864: .PP
1.1.1.3 ! misho 865: A
! 866: \fRPlugin\fR
! 867: line consists of the
! 868: \fRPlugin\fR
! 869: keyword, followed by the
! 870: \fIsymbol_name\fR
! 871: and the
! 872: \fIpath\fR
! 873: to the shared object containing the plugin.
! 874: The
! 875: \fIsymbol_name\fR
! 876: is the name of the
! 877: \fRstruct policy_plugin\fR
! 878: or
! 879: \fRstruct io_plugin\fR
! 880: in the plugin shared object.
! 881: The
! 882: \fIpath\fR
! 883: may be fully qualified or relative.
! 884: If not fully qualified it is relative to the
! 885: \fI@prefix@/libexec\fR
! 886: directory.
! 887: Any additional parameters after the
! 888: \fIpath\fR
! 889: are passed as arguments to the plugin's
! 890: \fIopen\fR
! 891: function.
! 892: Lines that don't begin with
! 893: \fRPlugin\fR,
! 894: \fRPath\fR,
! 895: \fRDebug\fR,
! 896: or
! 897: \fRSet\fR
! 898: are silently ignored.
! 899: .PP
! 900: For more information, see the
! 901: sudo_plugin(@mansectsu@)
! 902: manual.
1.1 misho 903: .SH "PATHS"
1.1.1.3 ! misho 904: A
! 905: \fRPath\fR
! 906: line consists of the
! 907: \fRPath\fR
! 908: keyword, followed by the name of the path to set and its value.
! 909: E.g.
! 910: .nf
! 911: .sp
! 912: .RS 6n
! 913: Path noexec @noexec_file@
! 914: Path askpass /usr/X11R6/bin/ssh-askpass
! 915: .RE
! 916: .fi
1.1 misho 917: .PP
918: The following plugin-agnostic paths may be set in the
1.1.1.3 ! misho 919: \fI@sysconfdir@/sudo.conf\fR
! 920: file:
! 921: .TP 10n
! 922: askpass
1.1 misho 923: The fully qualified path to a helper program used to read the user's
1.1.1.3 ! misho 924: password when no terminal is available.
! 925: This may be the case when
! 926: \fBsudo\fR
! 927: is executed from a graphical (as opposed to text-based) application.
! 928: The program specified by
! 929: \fIaskpass\fR
! 930: should display the argument passed to it as the prompt and write
! 931: the user's password to the standard output.
! 932: The value of
! 933: \fIaskpass\fR
! 934: may be overridden by the
! 935: \fRSUDO_ASKPASS\fR
! 936: environment variable.
! 937: .TP 10n
! 938: noexec
1.1 misho 939: The fully-qualified path to a shared library containing dummy
1.1.1.3 ! misho 940: versions of the
! 941: \fBexecv\fR(),
! 942: \fBexecve\fR()
! 943: and
! 944: \fBfexecve\fR()
! 945: library functions that just return an error.
! 946: This is used to implement the
! 947: \fInoexec\fR
! 948: functionality on systems that support
! 949: \fRLD_PRELOAD\fR
! 950: or its equivalent.
! 951: Defaults to
! 952: \fI@noexec_file@\fR.
1.1.1.2 misho 953: .SH "DEBUG FLAGS"
1.1.1.3 ! misho 954: \fBsudo\fR
! 955: versions 1.8.4 and higher support a flexible debugging framework
! 956: that can help track down what
! 957: \fBsudo\fR
! 958: is doing internally if there is a problem.
! 959: .PP
! 960: A
! 961: \fRDebug\fR
! 962: line consists of the
! 963: \fRDebug\fR
! 964: keyword, followed by the name of the program to debug
! 965: (\fBsudo\fR, \fBvisudo\fR, \fBsudoreplay\fR),
1.1.1.2 misho 966: the debug file name and a comma-separated list of debug flags.
1.1.1.3 ! misho 967: The debug flag syntax used by
! 968: \fBsudo\fR
! 969: and the
! 970: \fIsudoers\fR
! 971: plugin is
! 972: \fIsubsystem\fR@\fIpriority\fR
! 973: but the plugin is free to use a different format so long as it does
! 974: not include a comma
! 975: (`\&,').
1.1.1.2 misho 976: .PP
977: For instance:
1.1.1.3 ! misho 978: .nf
! 979: .sp
! 980: .RS 6n
! 981: Debug sudo /var/log/sudo_debug all@warn,plugin@info
! 982: .RE
! 983: .fi
1.1.1.2 misho 984: .PP
1.1.1.3 ! misho 985: would log all debugging statements at the
! 986: \fIwarn\fR
! 987: level and higher in addition to those at the
! 988: \fIinfo\fR
! 989: level for the plugin subsystem.
! 990: .PP
! 991: Currently, only one
! 992: \fRDebug\fR
! 993: entry per program is supported.
! 994: The
! 995: \fBsudo\fR
! 996: \fRDebug\fR
! 997: entry is shared by the
! 998: \fBsudo\fR
! 999: front end,
! 1000: \fBsudoedit\fR
! 1001: and the plugins.
! 1002: A future release may add support for per-plugin
! 1003: \fRDebug\fR
! 1004: lines and/or support for multiple debugging files for a single
! 1005: program.
! 1006: .PP
! 1007: The priorities used by the
! 1008: \fBsudo\fR
! 1009: front end, in order of decreasing severity, are:
! 1010: \fIcrit\fR, \fIerr\fR, \fIwarn\fR, \fInotice\fR, \fIdiag\fR, \fIinfo\fR, \fItrace\fR
! 1011: and
! 1012: \fIdebug\fR.
! 1013: Each priority, when specified, also includes all priorities higher
! 1014: than it.
! 1015: For example, a priority of
! 1016: \fInotice\fR
! 1017: would include debug messages logged at
! 1018: \fInotice\fR
! 1019: and higher.
! 1020: .PP
! 1021: The following subsystems are used by the
! 1022: \fBsudo\fR
! 1023: front-end:
! 1024: .TP 12n
! 1025: \fIall\fR
1.1.1.2 misho 1026: matches every subsystem
1.1.1.3 ! misho 1027: .TP 12n
! 1028: \fIargs\fR
1.1.1.2 misho 1029: command line argument processing
1.1.1.3 ! misho 1030: .TP 12n
! 1031: \fIconv\fR
1.1.1.2 misho 1032: user conversation
1.1.1.3 ! misho 1033: .TP 12n
! 1034: \fIedit\fR
1.1.1.2 misho 1035: sudoedit
1.1.1.3 ! misho 1036: .TP 12n
! 1037: \fIexec\fR
1.1.1.2 misho 1038: command execution
1.1.1.3 ! misho 1039: .TP 12n
! 1040: \fImain\fR
! 1041: \fBsudo\fR
! 1042: main function
! 1043: .TP 12n
! 1044: \fInetif\fR
1.1.1.2 misho 1045: network interface handling
1.1.1.3 ! misho 1046: .TP 12n
! 1047: \fIpcomm\fR
1.1.1.2 misho 1048: communication with the plugin
1.1.1.3 ! misho 1049: .TP 12n
! 1050: \fIplugin\fR
1.1.1.2 misho 1051: plugin configuration
1.1.1.3 ! misho 1052: .TP 12n
! 1053: \fIpty\fR
1.1.1.2 misho 1054: pseudo-tty related code
1.1.1.3 ! misho 1055: .TP 12n
! 1056: \fIselinux\fR
1.1.1.2 misho 1057: SELinux-specific handling
1.1.1.3 ! misho 1058: .TP 12n
! 1059: \fIutil\fR
1.1.1.2 misho 1060: utility functions
1.1.1.3 ! misho 1061: .TP 12n
! 1062: \fIutmp\fR
1.1.1.2 misho 1063: utmp handling
1.1.1.3 ! misho 1064: .SH "EXIT VALUE"
! 1065: Upon successful execution of a program, the exit status from
! 1066: \fIsudo\fR
1.1 misho 1067: will simply be the exit status of the program that was executed.
1068: .PP
1.1.1.3 ! misho 1069: Otherwise,
! 1070: \fBsudo\fR
! 1071: exits with a value of 1 if there is a configuration/permission
! 1072: problem or if
! 1073: \fBsudo\fR
! 1074: cannot execute the given command.
! 1075: In the latter case the error string is printed to the standard error.
! 1076: If
! 1077: \fBsudo\fR
! 1078: cannot
! 1079: stat(2)
! 1080: one or more entries in the user's
! 1081: \fRPATH\fR,
! 1082: an error is printed on stderr.
! 1083: (If the directory does not exist or if it is not really a directory,
! 1084: the entry is ignored and no error is printed.)
! 1085: This should not happen under normal circumstances.
! 1086: The most common reason for
! 1087: stat(2)
! 1088: to return
! 1089: ``permission denied''
! 1090: is if you are running an automounter and one of the directories in
! 1091: your
! 1092: \fRPATH\fR
! 1093: is on a machine that is currently unreachable.
1.1 misho 1094: .SH "SECURITY NOTES"
1.1.1.3 ! misho 1095: \fBsudo\fR
! 1096: tries to be safe when executing external commands.
1.1 misho 1097: .PP
1.1.1.3 ! misho 1098: To prevent command spoofing,
! 1099: \fBsudo\fR
! 1100: checks "." and "" (both denoting current directory) last when
! 1101: searching for a command in the user's
! 1102: \fRPATH\fR
! 1103: (if one or both are in the
! 1104: \fRPATH\fR).
! 1105: Note, however, that the actual
! 1106: \fRPATH\fR
! 1107: environment variable is
! 1108: \fInot\fR
! 1109: modified and is passed unchanged to the program that
! 1110: \fBsudo\fR
! 1111: executes.
! 1112: .PP
! 1113: Please note that
! 1114: \fBsudo\fR
! 1115: will normally only log the command it explicitly runs.
! 1116: If a user runs a command such as
! 1117: \fRsudo su\fR
! 1118: or
! 1119: \fRsudo sh\fR,
! 1120: subsequent commands run from that shell are not subject to
! 1121: \fBsudo\fR's
! 1122: security policy.
! 1123: The same is true for commands that offer shell escapes (including
! 1124: most editors).
! 1125: If I/O logging is enabled, subsequent commands will have their input and/or
! 1126: output logged, but there will not be traditional logs for those commands.
! 1127: Because of this, care must be taken when giving users access to commands via
! 1128: \fBsudo\fR
! 1129: to verify that the command does not inadvertently give the user an
! 1130: effective root shell.
! 1131: For more information, please see the
! 1132: \fIPREVENTING SHELL ESCAPES\fR
! 1133: section in
! 1134: sudoers(@mansectform@).
1.1.1.2 misho 1135: .PP
1136: To prevent the disclosure of potentially sensitive information,
1.1.1.3 ! misho 1137: \fBsudo\fR
! 1138: disables core dumps by default while it is executing (they are
! 1139: re-enabled for the command that is run).
! 1140: To aid in debugging
! 1141: \fBsudo\fR
! 1142: crashes, you may wish to re-enable core dumps by setting
! 1143: ``disable_coredump''
! 1144: to false in the
! 1145: \fI@sysconfdir@/sudo.conf\fR
! 1146: file as follows:
! 1147: .nf
! 1148: .sp
! 1149: .RS 6n
! 1150: Set disable_coredump false
! 1151: .RE
! 1152: .fi
1.1.1.2 misho 1153: .PP
1154: Note that by default, most operating systems disable core dumps
1.1.1.3 ! misho 1155: from setuid programs, which includes
! 1156: \fBsudo\fR.
! 1157: To actually get a
! 1158: \fBsudo\fR
! 1159: core file you may need to enable core dumps for setuid processes.
! 1160: On BSD and Linux systems this is accomplished via the sysctl command,
! 1161: on Solaris the coreadm command can be used.
1.1 misho 1162: .SH "ENVIRONMENT"
1.1.1.3 ! misho 1163: \fBsudo\fR
! 1164: utilizes the following environment variables.
! 1165: The security policy has control over the actual content of the command's
! 1166: environment.
! 1167: .TP 17n
! 1168: \fREDITOR\fR
! 1169: Default editor to use in
! 1170: \fB\-e\fR
! 1171: (sudoedit) mode if neither
! 1172: \fRSUDO_EDITOR\fR
! 1173: nor
! 1174: \fRVISUAL\fR
! 1175: is set.
! 1176: .TP 17n
! 1177: \fRMAIL\fR
! 1178: In
! 1179: \fB\-i\fR
! 1180: mode or when
! 1181: \fIenv_reset\fR
! 1182: is enabled in
! 1183: \fIsudoers\fR,
! 1184: set to the mail spool of the target user.
! 1185: .TP 17n
! 1186: \fRHOME\fR
! 1187: Set to the home directory of the target user if
! 1188: \fB\-i\fR
! 1189: or
! 1190: \fB\-H\fR
! 1191: are specified,
! 1192: \fIenv_reset\fR
! 1193: or
! 1194: \fIalways_set_home\fR
! 1195: are set in
! 1196: \fIsudoers\fR,
! 1197: or when the
! 1198: \fB\-s\fR
! 1199: option is specified and
! 1200: \fIset_home\fR
! 1201: is set in
! 1202: \fIsudoers\fR.
! 1203: .TP 17n
! 1204: \fRPATH\fR
1.1 misho 1205: May be overridden by the security policy.
1.1.1.3 ! misho 1206: .TP 17n
! 1207: \fRSHELL\fR
! 1208: Used to determine shell to run with
! 1209: \fB\-s\fR
! 1210: option.
! 1211: .TP 17n
! 1212: \fRSUDO_ASKPASS\fR
1.1 misho 1213: Specifies the path to a helper program used to read the password
1.1.1.3 ! misho 1214: if no terminal is available or if the
! 1215: \fB\-A\fR
! 1216: option is specified.
! 1217: .TP 17n
! 1218: \fRSUDO_COMMAND\fR
! 1219: Set to the command run by sudo.
! 1220: .TP 17n
! 1221: \fRSUDO_EDITOR\fR
! 1222: Default editor to use in
! 1223: \fB\-e\fR
! 1224: (sudoedit) mode.
! 1225: .TP 17n
! 1226: \fRSUDO_GID\fR
! 1227: Set to the group ID of the user who invoked sudo.
! 1228: .TP 17n
! 1229: \fRSUDO_PROMPT\fR
! 1230: Used as the default password prompt.
! 1231: .TP 17n
! 1232: \fRSUDO_PS1\fR
! 1233: If set,
! 1234: \fRPS1\fR
! 1235: will be set to its value for the program being run.
! 1236: .TP 17n
! 1237: \fRSUDO_UID\fR
! 1238: Set to the user ID of the user who invoked sudo.
! 1239: .TP 17n
! 1240: \fRSUDO_USER\fR
! 1241: Set to the login name of the user who invoked sudo.
! 1242: .TP 17n
! 1243: \fRUSER\fR
! 1244: Set to the target user (root unless the
! 1245: \fB\-u\fR
! 1246: option is specified).
! 1247: .TP 17n
! 1248: \fRVISUAL\fR
! 1249: Default editor to use in
! 1250: \fB\-e\fR
! 1251: (sudoedit) mode if
! 1252: \fRSUDO_EDITOR\fR
! 1253: is not set.
1.1 misho 1254: .SH "FILES"
1.1.1.3 ! misho 1255: .TP 26n
! 1256: \fI@sysconfdir@/sudo.conf\fR
! 1257: \fBsudo\fR
! 1258: front end configuration
1.1 misho 1259: .SH "EXAMPLES"
1.1.1.3 ! misho 1260: Note: the following examples assume a properly configured security
! 1261: policy.
1.1 misho 1262: .PP
1263: To get a file listing of an unreadable directory:
1.1.1.3 ! misho 1264: .nf
! 1265: .sp
! 1266: .RS 6n
! 1267: $ sudo ls /usr/local/protected
! 1268: .RE
! 1269: .fi
1.1 misho 1270: .PP
1.1.1.3 ! misho 1271: To list the home directory of user yaz on a machine where the file
! 1272: system holding ~yaz is not exported as root:
! 1273: .nf
! 1274: .sp
! 1275: .RS 6n
! 1276: $ sudo -u yaz ls ~yaz
! 1277: .RE
! 1278: .fi
1.1 misho 1279: .PP
1.1.1.3 ! misho 1280: To edit the
! 1281: \fIindex.html\fR
! 1282: file as user www:
! 1283: .nf
! 1284: .sp
! 1285: .RS 6n
! 1286: $ sudo -u www vi ~www/htdocs/index.html
! 1287: .RE
! 1288: .fi
1.1 misho 1289: .PP
1.1.1.3 ! misho 1290: To view system logs only accessible to root and users in the adm
! 1291: group:
! 1292: .nf
! 1293: .sp
! 1294: .RS 6n
! 1295: $ sudo -g adm view /var/log/syslog
! 1296: .RE
! 1297: .fi
1.1 misho 1298: .PP
1299: To run an editor as jim with a different primary group:
1.1.1.3 ! misho 1300: .nf
! 1301: .sp
! 1302: .RS 6n
! 1303: $ sudo -u jim -g audio vi ~jim/sound.txt
! 1304: .RE
! 1305: .fi
! 1306: .PP
! 1307: To shut down a machine:
! 1308: .nf
! 1309: .sp
! 1310: .RS 6n
! 1311: $ sudo shutdown -r +15 "quick reboot"
! 1312: .RE
! 1313: .fi
1.1 misho 1314: .PP
1.1.1.3 ! misho 1315: To make a usage listing of the directories in the /home partition.
! 1316: Note that this runs the commands in a sub-shell to make the
! 1317: \fRcd\fR
! 1318: and file redirection work.
! 1319: .nf
! 1320: .sp
! 1321: .RS 6n
! 1322: $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
! 1323: .RE
! 1324: .fi
1.1 misho 1325: .SH "SEE ALSO"
1.1.1.3 ! misho 1326: grep(1),
! 1327: su(1),
! 1328: stat(2),
! 1329: login_cap(3),
! 1330: passwd(@mansectform@),
! 1331: sudoers(@mansectform@),
! 1332: sudo_plugin(@mansectsu@),
! 1333: sudoreplay(@mansectsu@),
! 1334: visudo(@mansectsu@)
1.1.1.2 misho 1335: .SH "HISTORY"
1.1.1.3 ! misho 1336: See the HISTORY file in the
! 1337: \fBsudo\fR
! 1338: distribution (http://www.sudo.ws/sudo/history.html) for a brief
! 1339: history of sudo.
! 1340: .SH "AUTHORS"
! 1341: Many people have worked on
! 1342: \fBsudo\fR
! 1343: over the years; this version consists of code written primarily by:
! 1344: .sp
! 1345: .RS 6n
! 1346: Todd C. Miller
! 1347: .RE
! 1348: .PP
! 1349: See the CONTRIBUTORS file in the
! 1350: \fBsudo\fR
! 1351: distribution (http://www.sudo.ws/sudo/contributors.html) for an
! 1352: exhaustive list of people who have contributed to
! 1353: \fBsudo\fR.
1.1 misho 1354: .SH "CAVEATS"
1355: There is no easy way to prevent a user from gaining a root shell
1.1.1.3 ! misho 1356: if that user is allowed to run arbitrary commands via
! 1357: \fBsudo\fR.
1.1 misho 1358: Also, many programs (such as editors) allow the user to run commands
1.1.1.3 ! misho 1359: via shell escapes, thus avoiding
! 1360: \fBsudo\fR's
! 1361: checks.
! 1362: However, on most systems it is possible to prevent shell escapes with the
! 1363: sudoers(@mansectform@)
! 1364: plugin's
! 1365: \fInoexec\fR
! 1366: functionality.
! 1367: .PP
! 1368: It is not meaningful to run the
! 1369: \fRcd\fR
! 1370: command directly via sudo, e.g.,
! 1371: .nf
! 1372: .sp
! 1373: .RS 6n
! 1374: $ sudo cd /usr/local/protected
! 1375: .RE
! 1376: .fi
1.1 misho 1377: .PP
1378: since when the command exits the parent process (your shell) will
1.1.1.3 ! misho 1379: still be the same.
! 1380: Please see the
! 1381: \fIEXAMPLES\fR
! 1382: section for more information.
! 1383: .PP
! 1384: Running shell scripts via
! 1385: \fBsudo\fR
! 1386: can expose the same kernel bugs that make setuid shell scripts
! 1387: unsafe on some operating systems (if your OS has a /dev/fd/ directory,
! 1388: setuid shell scripts are generally safe).
1.1 misho 1389: .SH "BUGS"
1.1.1.3 ! misho 1390: If you feel you have found a bug in
! 1391: \fBsudo\fR,
! 1392: please submit a bug report at http://www.sudo.ws/sudo/bugs/
1.1 misho 1393: .SH "SUPPORT"
1394: Limited free support is available via the sudo-users mailing list,
1.1.1.3 ! misho 1395: see http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
1.1 misho 1396: search the archives.
1397: .SH "DISCLAIMER"
1.1.1.3 ! misho 1398: \fBsudo\fR
! 1399: is provided
! 1400: ``AS IS''
! 1401: and any express or implied warranties, including, but not limited
! 1402: to, the implied warranties of merchantability and fitness for a
! 1403: particular purpose are disclaimed.
! 1404: See the LICENSE file distributed with
! 1405: \fBsudo\fR
! 1406: or http://www.sudo.ws/sudo/license.html for complete details.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudo.man.in CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc