--- embedaddon/sudo/doc/sudo_plugin.cat 2013/07/22 10:46:12 1.1.1.4 +++ embedaddon/sudo/doc/sudo_plugin.cat 2013/10/14 07:56:34 1.1.1.5 @@ -193,16 +193,25 @@ DDEESSCCRRIIPPTTIIOONN The prompt to use when requesting a password, if specified via the --pp flag. + remote_host=string + The name of the remote host to run the command on, if + specified via the --hh option. Support for running the + command on a remote host is meant to be implemented via + a helper program that is executed in place of the user- + specified command. The ssuuddoo front end is only capable + of executing commands on the local host. Only + available starting with API version 1.4. + run_shell=bool Set to true if the user specified the --ss flag, indicating that the user wishes to run a shell. runas_group=string - The group name or gid to to run the command as, if + The group name or gid to run the command as, if specified via the --gg flag. runas_user=string - The user name or uid to to run the command as, if + The user name or uid to run the command as, if specified via the --uu flag. selinux_role=string @@ -271,11 +280,11 @@ DDEESSCCRRIIPPTTIIOONN pgid=int The ID of the process group that the running ssuuddoo process is a member of. Only available starting with - API version 1.2 + API version 1.2. pid=int The process ID of the running ssuuddoo process. Only - available starting with API version 1.2 + available starting with API version 1.2. plugin_options Any (non-comment) strings immediately after the plugin @@ -293,18 +302,18 @@ DDEESSCCRRIIPPTTIIOONN ppid=int The parent process ID of the running ssuuddoo process. - Only available starting with API version 1.2 + Only available starting with API version 1.2. sid=int The session ID of the running ssuuddoo process or 0 if ssuuddoo is not part of a POSIX job control session. Only - available starting with API version 1.2 + available starting with API version 1.2. tcpgid=int The ID of the foreground process group associated with the terminal device associated with the ssuuddoo process or -1 if there is no terminal present. Only available - starting with API version 1.2 + starting with API version 1.2. tty=string The path to the user's terminal device. If the user @@ -1196,6 +1205,28 @@ DDEESSCCRRIIPPTTIIOONN *(vp) = (*(vp) & 0xffff0000) | (n); \ } while(0) + RReemmoottee ccoommmmaanndd eexxeeccuuttiioonn + The ssuuddoo front end does not have native support for running remote + commands. However, starting with ssuuddoo 1.8.8, the --hh option may be used + to specify a remote host that is passed to the policy plugin. A plugin + may also accept a _r_u_n_a_s___u_s_e_r in the form of ``user@hostname'' which will + work with older versions of ssuuddoo. It is anticipated that remote commands + will be supported by executing a ``helper'' program. The policy plugin + should setup the execution environment such that the ssuuddoo front end will + run the helper which, in turn, will connect to the remote host and run + the command. + + For example, the policy plugin could utilize sssshh to perform remote + command execution. The helper program would be responsible for running + sssshh with the proper options to use a private key or certificate that the + remote host will accept and run a program on the remote host that would + setup the execution environment accordingly. + + Note that remote ssuuddooeeddiitt functionality must be handled by the policy + plugin, not ssuuddoo itself as the front end has no knowledge that a remote + command is being executed. This may be addressed in a future revision of + the plugin API. + CCoonnvveerrssaattiioonn AAPPII If the plugin needs to interact with the user, it may do so via the ccoonnvveerrssaattiioonn() function. A plugin should not attempt to read directly @@ -1220,6 +1251,8 @@ DDEESSCCRRIIPPTTIIOONN const char *msg; }; + #define SUDO_CONV_REPL_MAX 255 + struct sudo_conv_reply { char *reply; }; @@ -1237,7 +1270,12 @@ DDEESSCCRRIIPPTTIIOONN sudo_conv_message and sudo_conv_reply structures. There must be a struct sudo_conv_message and struct sudo_conv_reply for each message in the conversation. The plugin is responsible for freeing the reply buffer - filled in to the struct sudo_conv_reply, if any. + located in each struct sudo_conv_reply, if it is not NULL. + SUDO_CONV_REPL_MAX represents the maximum length of the reply buffer (not + including the trailing NUL character). In practical terms, this is the + longest password ssuuddoo will support. It is also useful as a maximum value + for the mmeemmsseett__ss() function when clearing passwords filled in by the + conversation function. The pprriinnttff()-style function uses the same underlying mechanism as the ccoonnvveerrssaattiioonn() function but only supports SUDO_CONV_INFO_MSG, @@ -1393,6 +1431,9 @@ PPLLUUGGIINN AAPPII CCHHAANNGGEELLOOG The ssuuddoo front end now installs default signal handlers to trap common signals while the plugin functions are run. + Version 1.4 (sudo 1.8.8) + The _r_e_m_o_t_e___h_o_s_t entry was added to the settings list. + SSEEEE AALLSSOO sudo.conf(4), sudoers(4), sudo(1m) @@ -1412,4 +1453,4 @@ DDIISSCCLLAAIIMMEERR file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for complete details. -Sudo 1.8.7 March 5, 2013 Sudo 1.8.7 +Sudo 1.8.8 August 16, 2013 Sudo 1.8.8