Annotation of embedaddon/sudo/doc/sudoers.cat, revision 1.1.1.1
1.1 misho 1: SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
2:
3:
4:
5: NNAAMMEE
6: sudoers - default sudo security policy module
7:
8: DDEESSCCRRIIPPTTIIOONN
9: The _s_u_d_o_e_r_s policy module determines a user's ssuuddoo privileges. It is
10: the default ssuuddoo policy plugin. The policy is driven by the
11: _/_e_t_c_/_s_u_d_o_e_r_s file or, optionally in LDAP. The policy format is
12: described in detail in the "SUDOERS FILE FORMAT" section. For
13: information on storing _s_u_d_o_e_r_s policy information in LDAP, please see
14: _s_u_d_o_e_r_s_._l_d_a_p(4).
15:
16: AAuutthheennttiiccaattiioonn aanndd LLooggggiinngg
17: The _s_u_d_o_e_r_s security policy requires that most users authenticate
18: themselves before they can use ssuuddoo. A password is not required if the
19: invoking user is root, if the target user is the same as the invoking
20: user, or if the policy has disabled authentication for the user or
21: command. Unlike _s_u(1), when _s_u_d_o_e_r_s requires authentication, it
22: validates the invoking user's credentials, not the target user's (or
23: root's) credentials. This can be changed via the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and
24: _r_u_n_a_s_p_w flags, described later.
25:
26: If a user who is not listed in the policy tries to run a command via
27: ssuuddoo, mail is sent to the proper authorities. The address used for
28: such mail is configurable via the _m_a_i_l_t_o Defaults entry (described
29: later) and defaults to root.
30:
31: Note that mail will not be sent if an unauthorized user tries to run
32: ssuuddoo with the --ll or --vv option. This allows users to determine for
33: themselves whether or not they are allowed to use ssuuddoo.
34:
35: If ssuuddoo is run by root and the SUDO_USER environment variable is set,
36: the _s_u_d_o_e_r_s policy will use this value to determine who the actual user
37: is. This can be used by a user to log commands through sudo even when
38: a root shell has been invoked. It also allows the --ee option to remain
39: useful even when invoked via a sudo-run script or program. Note,
40: however, that the _s_u_d_o_e_r_s lookup is still done for root, not the user
41: specified by SUDO_USER.
42:
43: _s_u_d_o_e_r_s uses time stamp files for credential caching. Once a user has
44: been authenticated, a time stamp is updated and the user may then use
45: sudo without a password for a short period of time (5 minutes unless
46: overridden by the _t_i_m_e_o_u_t option. By default, _s_u_d_o_e_r_s uses a tty-based
47: time stamp which means that there is a separate time stamp for each of
48: a user's login sessions. The _t_t_y___t_i_c_k_e_t_s option can be disabled to
49: force the use of a single time stamp for all of a user's sessions.
50:
51: _s_u_d_o_e_r_s can log both successful and unsuccessful attempts (as well as
52: errors) to _s_y_s_l_o_g(3), a log file, or both. By default, _s_u_d_o_e_r_s will
53: log via _s_y_s_l_o_g(3) but this is changeable via the _s_y_s_l_o_g and _l_o_g_f_i_l_e
54: Defaults settings.
55:
56: _s_u_d_o_e_r_s also supports logging a command's input and output streams.
57: I/O logging is not on by default but can be enabled using the _l_o_g___i_n_p_u_t
58: and _l_o_g___o_u_t_p_u_t Defaults flags as well as the LOG_INPUT and LOG_OUTPUT
59: command tags.
60:
61: CCoommmmaanndd EEnnvviirroonnmmeenntt
62: Since environment variables can influence program behavior, _s_u_d_o_e_r_s
63: provides a means to restrict which variables from the user's
64: environment are inherited by the command to be run. There are two
65: distinct ways _s_u_d_o_e_r_s can deal with environment variables.
66:
67: By default, the _e_n_v___r_e_s_e_t option is enabled. This causes commands to
68: be executed with a minimal environment containing TERM, PATH, HOME,
69: MAIL, SHELL, LOGNAME, USER and USERNAME in addition to variables from
70: the invoking process permitted by the _e_n_v___c_h_e_c_k and _e_n_v___k_e_e_p options.
71: This is effectively a whitelist for environment variables.
72:
73: If, however, the _e_n_v___r_e_s_e_t option is disabled, any variables not
74: explicitly denied by the _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e options are inherited
75: from the invoking process. In this case, _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e
76: behave like a blacklist. Since it is not possible to blacklist all
77: potentially dangerous environment variables, use of the default
78: _e_n_v___r_e_s_e_t behavior is encouraged.
79:
80: In all cases, environment variables with a value beginning with () are
81: removed as they could be interpreted as bbaasshh functions. The list of
82: environment variables that ssuuddoo allows or denies is contained in the
83: output of sudo -V when run as root.
84:
85: Note that the dynamic linker on most operating systems will remove
86: variables that can control dynamic linking from the environment of
87: setuid executables, including ssuuddoo. Depending on the operating system
88: this may include _RLD*, DYLD_*, LD_*, LDR_*, LIBPATH, SHLIB_PATH, and
89: others. These type of variables are removed from the environment
90: before ssuuddoo even begins execution and, as such, it is not possible for
91: ssuuddoo to preserve them.
92:
93: As a special case, if ssuuddoo's --ii option (initial login) is specified,
94: _s_u_d_o_e_r_s will initialize the environment regardless of the value of
95: _e_n_v___r_e_s_e_t. The _D_I_S_P_L_A_Y, _P_A_T_H and _T_E_R_M variables remain unchanged;
96: _H_O_M_E, _M_A_I_L, _S_H_E_L_L, _U_S_E_R, and _L_O_G_N_A_M_E are set based on the target user.
97: On Linux and AIX systems the contents of _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t are also
98: included. All other environment variables are removed.
99:
100: SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT
101: The _s_u_d_o_e_r_s file is composed of two types of entries: aliases
102: (basically variables) and user specifications (which specify who may
103: run what).
104:
105: When multiple entries match for a user, they are applied in order.
106: Where there are multiple matches, the last match is used (which is not
107: necessarily the most specific match).
108:
109: The _s_u_d_o_e_r_s grammar will be described below in Extended Backus-Naur
110: Form (EBNF). Don't despair if you don't know what EBNF is; it is
111: fairly simple, and the definitions below are annotated.
112:
113: QQuuiicckk gguuiiddee ttoo EEBBNNFF
114: EBNF is a concise and exact way of describing the grammar of a
115: language. Each EBNF definition is made up of _p_r_o_d_u_c_t_i_o_n _r_u_l_e_s. E.g.,
116:
117: symbol ::= definition | alternate1 | alternate2 ...
118:
119: Each _p_r_o_d_u_c_t_i_o_n _r_u_l_e references others and thus makes up a grammar for
120: the language. EBNF also contains the following operators, which many
121: readers will recognize from regular expressions. Do not, however,
122: confuse them with "wildcard" characters, which have different meanings.
123:
124: ? Means that the preceding symbol (or group of symbols) is optional.
125: That is, it may appear once or not at all.
126:
127: * Means that the preceding symbol (or group of symbols) may appear
128: zero or more times.
129:
130: + Means that the preceding symbol (or group of symbols) may appear
131: one or more times.
132:
133: Parentheses may be used to group symbols together. For clarity, we
134: will use single quotes ('') to designate what is a verbatim character
135: string (as opposed to a symbol name).
136:
137: AAlliiaasseess
138: There are four kinds of aliases: User_Alias, Runas_Alias, Host_Alias
139: and Cmnd_Alias.
140:
141: Alias ::= 'User_Alias' User_Alias (':' User_Alias)* |
142: 'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
143: 'Host_Alias' Host_Alias (':' Host_Alias)* |
144: 'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)*
145:
146: User_Alias ::= NAME '=' User_List
147:
148: Runas_Alias ::= NAME '=' Runas_List
149:
150: Host_Alias ::= NAME '=' Host_List
151:
152: Cmnd_Alias ::= NAME '=' Cmnd_List
153:
154: NAME ::= [A-Z]([A-Z][0-9]_)*
155:
156: Each _a_l_i_a_s definition is of the form
157:
158: Alias_Type NAME = item1, item2, ...
159:
160: where _A_l_i_a_s___T_y_p_e is one of User_Alias, Runas_Alias, Host_Alias, or
161: Cmnd_Alias. A NAME is a string of uppercase letters, numbers, and
162: underscore characters ('_'). A NAME mmuusstt start with an uppercase
163: letter. It is possible to put several alias definitions of the same
164: type on a single line, joined by a colon (':'). E.g.,
165:
166: Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
167:
168: The definitions of what constitutes a valid _a_l_i_a_s member follow.
169:
170: User_List ::= User |
171: User ',' User_List
172:
173: User ::= '!'* user name |
174: '!'* #uid |
175: '!'* %group |
176: '!'* %#gid |
177: '!'* +netgroup |
178: '!'* %:nonunix_group |
179: '!'* %:#nonunix_gid |
180: '!'* User_Alias
181:
182: A User_List is made up of one or more user names, user ids (prefixed
183: with '#'), system group names and ids (prefixed with '%' and '%#'
184: respectively), netgroups (prefixed with '+'), non-Unix group names and
185: IDs (prefixed with '%:' and '%:#' respectively) and User_Aliases. Each
186: list item may be prefixed with zero or more '!' operators. An odd
187: number of '!' operators negate the value of the item; an even number
188: just cancel each other out.
189:
190: A user name, uid, group, gid, netgroup, nonunix_group or nonunix_gid
191: may be enclosed in double quotes to avoid the need for escaping special
192: characters. Alternately, special characters may be specified in
193: escaped hex mode, e.g. \x20 for space. When using double quotes, any
194: prefix characters must be included inside the quotes.
195:
196: The actual nonunix_group and nonunix_gid syntax depends on the
197: underlying group provider plugin (see the _g_r_o_u_p___p_l_u_g_i_n description
198: below). For instance, the QAS AD plugin supports the following
199: formats:
200:
201: +o Group in the same domain: "Group Name"
202:
203: +o Group in any domain: "Group Name@FULLY.QUALIFIED.DOMAIN"
204:
205: +o Group SID: "S-1-2-34-5678901234-5678901234-5678901234-567"
206:
207: Note that quotes around group names are optional. Unquoted strings
208: must use a backslash (\) to escape spaces and special characters. See
209: "Other special characters and reserved words" for a list of characters
210: that need to be escaped.
211:
212: Runas_List ::= Runas_Member |
213: Runas_Member ',' Runas_List
214:
215: Runas_Member ::= '!'* user name |
216: '!'* #uid |
217: '!'* %group |
218: '!'* %#gid |
219: '!'* %:nonunix_group |
220: '!'* %:#nonunix_gid |
221: '!'* +netgroup |
222: '!'* Runas_Alias
223:
224: A Runas_List is similar to a User_List except that instead of
225: User_Aliases it can contain Runas_Aliases. Note that user names and
226: groups are matched as strings. In other words, two users (groups) with
227: the same uid (gid) are considered to be distinct. If you wish to match
228: all user names with the same uid (e.g. root and toor), you can use a
229: uid instead (#0 in the example given).
230:
231: Host_List ::= Host |
232: Host ',' Host_List
233:
234: Host ::= '!'* host name |
235: '!'* ip_addr |
236: '!'* network(/netmask)? |
237: '!'* +netgroup |
238: '!'* Host_Alias
239:
240: A Host_List is made up of one or more host names, IP addresses, network
241: numbers, netgroups (prefixed with '+') and other aliases. Again, the
242: value of an item may be negated with the '!' operator. If you do not
243: specify a netmask along with the network number, ssuuddoo will query each
244: of the local host's network interfaces and, if the network number
245: corresponds to one of the hosts's network interfaces, the corresponding
246: netmask will be used. The netmask may be specified either in standard
247: IP address notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or
248: CIDR notation (number of bits, e.g. 24 or 64). A host name may include
249: shell-style wildcards (see the Wildcards section below), but unless the
250: host name command on your machine returns the fully qualified host
251: name, you'll need to use the _f_q_d_n option for wildcards to be useful.
252: Note ssuuddoo only inspects actual network interfaces; this means that IP
253: address 127.0.0.1 (localhost) will never match. Also, the host name
254: "localhost" will only match if that is the actual host name, which is
255: usually only the case for non-networked systems.
256:
257: Cmnd_List ::= Cmnd |
258: Cmnd ',' Cmnd_List
259:
260: commandname ::= file name |
261: file name args |
262: file name '""'
263:
264: Cmnd ::= '!'* commandname |
265: '!'* directory |
266: '!'* "sudoedit" |
267: '!'* Cmnd_Alias
268:
269: A Cmnd_List is a list of one or more commandnames, directories, and
270: other aliases. A commandname is a fully qualified file name which may
271: include shell-style wildcards (see the Wildcards section below). A
272: simple file name allows the user to run the command with any arguments
273: he/she wishes. However, you may also specify command line arguments
274: (including wildcards). Alternately, you can specify "" to indicate
275: that the command may only be run wwiitthhoouutt command line arguments. A
276: directory is a fully qualified path name ending in a '/'. When you
277: specify a directory in a Cmnd_List, the user will be able to run any
278: file within that directory (but not in any subdirectories therein).
279:
280: If a Cmnd has associated command line arguments, then the arguments in
281: the Cmnd must match exactly those given by the user on the command line
282: (or match the wildcards if there are any). Note that the following
283: characters must be escaped with a '\' if they are used in command
284: arguments: ',', ':', '=', '\'. The special command "sudoedit" is used
285: to permit a user to run ssuuddoo with the --ee option (or as ssuuddooeeddiitt). It
286: may take command line arguments just as a normal command does.
287:
288: DDeeffaauullttss
289: Certain configuration options may be changed from their default values
290: at runtime via one or more Default_Entry lines. These may affect all
291: users on any host, all users on a specific host, a specific user, a
292: specific command, or commands being run as a specific user. Note that
293: per-command entries may not include command line arguments. If you
294: need to specify arguments, define a Cmnd_Alias and reference that
295: instead.
296:
297: Default_Type ::= 'Defaults' |
298: 'Defaults' '@' Host_List |
299: 'Defaults' ':' User_List |
300: 'Defaults' '!' Cmnd_List |
301: 'Defaults' '>' Runas_List
302:
303: Default_Entry ::= Default_Type Parameter_List
304:
305: Parameter_List ::= Parameter |
306: Parameter ',' Parameter_List
307:
308: Parameter ::= Parameter '=' Value |
309: Parameter '+=' Value |
310: Parameter '-=' Value |
311: '!'* Parameter
312:
313: Parameters may be ffllaaggss, iinntteeggeerr values, ssttrriinnggss, or lliissttss. Flags are
314: implicitly boolean and can be turned off via the '!' operator. Some
315: integer, string and list parameters may also be used in a boolean
316: context to disable them. Values may be enclosed in double quotes (")
317: when they contain multiple words. Special characters may be escaped
318: with a backslash (\).
319:
320: Lists have two additional assignment operators, += and -=. These
321: operators are used to add to and delete from a list respectively. It
322: is not an error to use the -= operator to remove an element that does
323: not exist in a list.
324:
325: Defaults entries are parsed in the following order: generic, host and
326: user Defaults first, then runas Defaults and finally command defaults.
327:
328: See "SUDOERS OPTIONS" for a list of supported Defaults parameters.
329:
330: UUsseerr SSppeecciiffiiccaattiioonn
331: User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
332: (':' Host_List '=' Cmnd_Spec_List)*
333:
334: Cmnd_Spec_List ::= Cmnd_Spec |
335: Cmnd_Spec ',' Cmnd_Spec_List
336:
337: Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Tag_Spec* Cmnd
338:
339: Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'
340:
341: SELinux_Spec ::= ('ROLE=role' | 'TYPE=type')
342:
343: Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
344: 'SETENV:' | 'NOSETENV:' | 'LOG_INPUT:' | 'NOLOG_INPUT:' |
345: 'LOG_OUTPUT:' | 'NOLOG_OUTPUT:')
346:
347: A uusseerr ssppeecciiffiiccaattiioonn determines which commands a user may run (and as
348: what user) on specified hosts. By default, commands are run as rroooott,
349: but this can be changed on a per-command basis.
350:
351: The basic structure of a user specification is `who where = (as_whom)
352: what'. Let's break that down into its constituent parts:
353:
354: RRuunnaass__SSppeecc
355: A Runas_Spec determines the user and/or the group that a command may be
356: run as. A fully-specified Runas_Spec consists of two Runas_Lists (as
357: defined above) separated by a colon (':') and enclosed in a set of
358: parentheses. The first Runas_List indicates which users the command
359: may be run as via ssuuddoo's --uu option. The second defines a list of
360: groups that can be specified via ssuuddoo's --gg option. If both Runas_Lists
361: are specified, the command may be run with any combination of users and
362: groups listed in their respective Runas_Lists. If only the first is
363: specified, the command may be run as any user in the list but no --gg
364: option may be specified. If the first Runas_List is empty but the
365: second is specified, the command may be run as the invoking user with
366: the group set to any listed in the Runas_List. If no Runas_Spec is
367: specified the command may be run as rroooott and no group may be specified.
368:
369: A Runas_Spec sets the default for the commands that follow it. What
370: this means is that for the entry:
371:
372: dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
373:
374: The user ddggbb may run _/_b_i_n_/_l_s, _/_b_i_n_/_k_i_l_l, and _/_u_s_r_/_b_i_n_/_l_p_r_m -- but only
375: as ooppeerraattoorr. E.g.,
376:
377: $ sudo -u operator /bin/ls
378:
379: It is also possible to override a Runas_Spec later on in an entry. If
380: we modify the entry like so:
381:
382: dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
383:
384: Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but _/_b_i_n_/_k_i_l_l
385: and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
386:
387: We can extend this to allow ddggbb to run /bin/ls with either the user or
388: group set to ooppeerraattoorr:
389:
390: dgb boulder = (operator : operator) /bin/ls, (root) /bin/kill, \
391: /usr/bin/lprm
392:
393: Note that while the group portion of the Runas_Spec permits the user to
394: run as command with that group, it does not force the user to do so.
395: If no group is specified on the command line, the command will run with
396: the group listed in the target user's password database entry. The
397: following would all be permitted by the sudoers entry above:
398:
399: $ sudo -u operator /bin/ls
400: $ sudo -u operator -g operator /bin/ls
401: $ sudo -g operator /bin/ls
402:
403: In the following example, user ttccmm may run commands that access a modem
404: device file with the dialer group.
405:
406: tcm boulder = (:dialer) /usr/bin/tip, /usr/bin/cu, \
407: /usr/local/bin/minicom
408:
409: Note that in this example only the group will be set, the command still
410: runs as user ttccmm. E.g.
411:
412: $ sudo -g dialer /usr/bin/cu
413:
414: Multiple users and groups may be present in a Runas_Spec, in which case
415: the user may select any combination of users and groups via the --uu and
416: --gg options. In this example:
417:
418: alan ALL = (root, bin : operator, system) ALL
419:
420: user aallaann may run any command as either user root or bin, optionally
421: setting the group to operator or system.
422:
423: SSEELLiinnuuxx__SSppeecc
424: On systems with SELinux support, _s_u_d_o_e_r_s entries may optionally have an
425: SELinux role and/or type associated with a command. If a role or type
426: is specified with the command it will override any default values
427: specified in _s_u_d_o_e_r_s. A role or type specified on the command line,
428: however, will supercede the values in _s_u_d_o_e_r_s.
429:
430: TTaagg__SSppeecc
431: A command may have zero or more tags associated with it. There are
432: eight possible tag values, NOPASSWD, PASSWD, NOEXEC, EXEC, SETENV,
433: NOSETENV, LOG_INPUT, NOLOG_INPUT, LOG_OUTPUT and NOLOG_OUTPUT. Once a
434: tag is set on a Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit
435: the tag unless it is overridden by the opposite tag (i.e.: PASSWD
436: overrides NOPASSWD and NOEXEC overrides EXEC).
437:
438: _N_O_P_A_S_S_W_D _a_n_d _P_A_S_S_W_D
439:
440: By default, ssuuddoo requires that a user authenticate him or herself
441: before running a command. This behavior can be modified via the
442: NOPASSWD tag. Like a Runas_Spec, the NOPASSWD tag sets a default for
443: the commands that follow it in the Cmnd_Spec_List. Conversely, the
444: PASSWD tag can be used to reverse things. For example:
445:
446: ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
447:
448: would allow the user rraayy to run _/_b_i_n_/_k_i_l_l, _/_b_i_n_/_l_s, and _/_u_s_r_/_b_i_n_/_l_p_r_m
449: as rroooott on the machine rushmore without authenticating himself. If we
450: only want rraayy to be able to run _/_b_i_n_/_k_i_l_l without a password the entry
451: would be:
452:
453: ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
454:
455: Note, however, that the PASSWD tag has no effect on users who are in
456: the group specified by the _e_x_e_m_p_t___g_r_o_u_p option.
457:
458: By default, if the NOPASSWD tag is applied to any of the entries for a
459: user on the current host, he or she will be able to run sudo -l without
460: a password. Additionally, a user may only run sudo -v without a
461: password if the NOPASSWD tag is present for all a user's entries that
462: pertain to the current host. This behavior may be overridden via the
463: verifypw and listpw options.
464:
465: _N_O_E_X_E_C _a_n_d _E_X_E_C
466:
467: If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying
468: operating system supports it, the NOEXEC tag can be used to prevent a
469: dynamically-linked executable from running further commands itself.
470:
471: In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e and
472: _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled.
473:
474: aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
475:
476: See the "PREVENTING SHELL ESCAPES" section below for more details on
477: how NOEXEC works and whether or not it will work on your system.
478:
479: _S_E_T_E_N_V _a_n_d _N_O_S_E_T_E_N_V
480:
481: These tags override the value of the _s_e_t_e_n_v option on a per-command
482: basis. Note that if SETENV has been set for a command, the user may
483: disable the _e_n_v___r_e_s_e_t option from the command line via the --EE option.
484: Additionally, environment variables set on the command line are not
485: subject to the restrictions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or
486: _e_n_v___k_e_e_p. As such, only trusted users should be allowed to set
487: variables in this manner. If the command matched is AALLLL, the SETENV
488: tag is implied for that command; this default may be overridden by use
489: of the NOSETENV tag.
490:
491: _L_O_G___I_N_P_U_T _a_n_d _N_O_L_O_G___I_N_P_U_T
492:
493: These tags override the value of the _l_o_g___i_n_p_u_t option on a per-command
494: basis. For more information, see the description of _l_o_g___i_n_p_u_t in the
495: "SUDOERS OPTIONS" section below.
496:
497: _L_O_G___O_U_T_P_U_T _a_n_d _N_O_L_O_G___O_U_T_P_U_T
498:
499: These tags override the value of the _l_o_g___o_u_t_p_u_t option on a per-command
500: basis. For more information, see the description of _l_o_g___o_u_t_p_u_t in the
501: "SUDOERS OPTIONS" section below.
502:
503: WWiillddccaarrddss
504: ssuuddoo allows shell-style _w_i_l_d_c_a_r_d_s (aka meta or glob characters) to be
505: used in host names, path names and command line arguments in the
506: _s_u_d_o_e_r_s file. Wildcard matching is done via the PPOOSSIIXX _g_l_o_b(3) and
507: _f_n_m_a_t_c_h(3) routines. Note that these are _n_o_t regular expressions.
508:
509: * Matches any set of zero or more characters.
510:
511: ? Matches any single character.
512:
513: [...] Matches any character in the specified range.
514:
515: [!...] Matches any character nnoott in the specified range.
516:
517: \x For any character "x", evaluates to "x". This is used to
518: escape special characters such as: "*", "?", "[", and "}".
519:
520: POSIX character classes may also be used if your system's _g_l_o_b(3) and
521: _f_n_m_a_t_c_h(3) functions support them. However, because the ':' character
522: has special meaning in _s_u_d_o_e_r_s, it must be escaped. For example:
523:
524: /bin/ls [[\:alpha\:]]*
525:
526: Would match any file name beginning with a letter.
527:
528: Note that a forward slash ('/') will nnoott be matched by wildcards used
529: in the path name. When matching the command line arguments, however, a
530: slash ddooeess get matched by wildcards. This is to make a path like:
531:
532: /usr/bin/*
533:
534: match _/_u_s_r_/_b_i_n_/_w_h_o but not _/_u_s_r_/_b_i_n_/_X_1_1_/_x_t_e_r_m.
535:
536: EExxcceeppttiioonnss ttoo wwiillddccaarrdd rruulleess
537: The following exceptions apply to the above rules:
538:
539: "" If the empty string "" is the only command line argument in the
540: _s_u_d_o_e_r_s entry it means that command is not allowed to be run
541: with aannyy arguments.
542:
543: IInncclluuddiinngg ootthheerr ffiilleess ffrroomm wwiitthhiinn ssuuddooeerrss
544: It is possible to include other _s_u_d_o_e_r_s files from within the _s_u_d_o_e_r_s
545: file currently being parsed using the #include and #includedir
546: directives.
547:
548: This can be used, for example, to keep a site-wide _s_u_d_o_e_r_s file in
549: addition to a local, per-machine file. For the sake of this example
550: the site-wide _s_u_d_o_e_r_s will be _/_e_t_c_/_s_u_d_o_e_r_s and the per-machine one will
551: be _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l. To include _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l from within
552: _/_e_t_c_/_s_u_d_o_e_r_s we would use the following line in _/_e_t_c_/_s_u_d_o_e_r_s:
553:
554: #include /etc/sudoers.local
555:
556: When ssuuddoo reaches this line it will suspend processing of the current
557: file (_/_e_t_c_/_s_u_d_o_e_r_s) and switch to _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l. Upon reaching
558: the end of _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l, the rest of _/_e_t_c_/_s_u_d_o_e_r_s will be
559: processed. Files that are included may themselves include other files.
560: A hard limit of 128 nested include files is enforced to prevent include
561: file loops.
562:
563: The file name may include the %h escape, signifying the short form of
564: the host name. I.e., if the machine's host name is "xerxes", then
565:
566: #include /etc/sudoers.%h
567:
568: will cause ssuuddoo to include the file _/_e_t_c_/_s_u_d_o_e_r_s_._x_e_r_x_e_s.
569:
570: The #includedir directive can be used to create a _s_u_d_o_._d directory that
571: the system package manager can drop _s_u_d_o_e_r_s rules into as part of
572: package installation. For example, given:
573:
574: #includedir /etc/sudoers.d
575:
576: ssuuddoo will read each file in _/_e_t_c_/_s_u_d_o_e_r_s_._d, skipping file names that
577: end in ~ or contain a . character to avoid causing problems with
578: package manager or editor temporary/backup files. Files are parsed in
579: sorted lexical order. That is, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_0_1___f_i_r_s_t will be parsed
580: before _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d. Be aware that because the sorting is
581: lexical, not numeric, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1___w_h_o_o_p_s would be loaded aafftteerr
582: _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d. Using a consistent number of leading zeroes
583: in the file names can be used to avoid such problems.
584:
585: Note that unlike files included via #include, vviissuuddoo will not edit the
586: files in a #includedir directory unless one of them contains a syntax
587: error. It is still possible to run vviissuuddoo with the -f flag to edit the
588: files directly.
589:
590: OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss
591: The pound sign ('#') is used to indicate a comment (unless it is part
592: of a #include directive or unless it occurs in the context of a user
593: name and is followed by one or more digits, in which case it is treated
594: as a uid). Both the comment character and any text after it, up to the
595: end of the line, are ignored.
596:
597: The reserved word AALLLL is a built-in _a_l_i_a_s that always causes a match to
598: succeed. It can be used wherever one might otherwise use a Cmnd_Alias,
599: User_Alias, Runas_Alias, or Host_Alias. You should not try to define
600: your own _a_l_i_a_s called AALLLL as the built-in alias will be used in
601: preference to your own. Please note that using AALLLL can be dangerous
602: since in a command context, it allows the user to run aannyy command on
603: the system.
604:
605: An exclamation point ('!') can be used as a logical _n_o_t operator both
606: in an _a_l_i_a_s and in front of a Cmnd. This allows one to exclude certain
607: values. Note, however, that using a ! in conjunction with the built-in
608: ALL alias to allow a user to run "all but a few" commands rarely works
609: as intended (see SECURITY NOTES below).
610:
611: Long lines can be continued with a backslash ('\') as the last
612: character on the line.
613:
614: Whitespace between elements in a list as well as special syntactic
615: characters in a _U_s_e_r _S_p_e_c_i_f_i_c_a_t_i_o_n ('=', ':', '(', ')') is optional.
616:
617: The following characters must be escaped with a backslash ('\') when
618: used as part of a word (e.g. a user name or host name): '!', '=', ':',
619: ',', '(', ')', '\'.
620:
621: SSUUDDOOEERRSS OOPPTTIIOONNSS
622: ssuuddoo's behavior can be modified by Default_Entry lines, as explained
623: earlier. A list of all supported Defaults parameters, grouped by type,
624: are listed below.
625:
626: BBoooolleeaann FFllaaggss:
627:
628: always_set_home If enabled, ssuuddoo will set the HOME environment variable
629: to the home directory of the target user (which is root
630: unless the --uu option is used). This effectively means
631: that the --HH option is always implied. Note that HOME
632: is already set when the the _e_n_v___r_e_s_e_t option is
633: enabled, so _a_l_w_a_y_s___s_e_t___h_o_m_e is only effective for
634: configurations where either _e_n_v___r_e_s_e_t is disabled or
635: HOME is present in the _e_n_v___k_e_e_p list. This flag is _o_f_f
636: by default.
637:
638: authenticate If set, users must authenticate themselves via a
639: password (or other means of authentication) before they
640: may run commands. This default may be overridden via
641: the PASSWD and NOPASSWD tags. This flag is _o_n by
642: default.
643:
644: closefrom_override
645: If set, the user may use ssuuddoo's --CC option which
646: overrides the default starting point at which ssuuddoo
647: begins closing open file descriptors. This flag is _o_f_f
648: by default.
649:
650: compress_io If set, and ssuuddoo is configured to log a command's input
651: or output, the I/O logs will be compressed using zzlliibb.
652: This flag is _o_n by default when ssuuddoo is compiled with
653: zzlliibb support.
654:
655: env_editor If set, vviissuuddoo will use the value of the EDITOR or
656: VISUAL environment variables before falling back on the
657: default editor list. Note that this may create a
658: security hole as it allows the user to run any
659: arbitrary command as root without logging. A safer
660: alternative is to place a colon-separated list of
661: editors in the editor variable. vviissuuddoo will then only
662: use the EDITOR or VISUAL if they match a value
663: specified in editor. This flag is _o_f_f by default.
664:
665: env_reset If set, ssuuddoo will reset the environment to only contain
666: the LOGNAME, MAIL, SHELL, USER, USERNAME and the SUDO_*
667: variables. Any variables in the caller's environment
668: that match the env_keep and env_check lists are then
669: added. The default contents of the env_keep and
670: env_check lists are displayed when ssuuddoo is run by root
671: with the _-_V option. If the _s_e_c_u_r_e___p_a_t_h option is set,
672: its value will be used for the PATH environment
673: variable. This flag is _o_n by default.
674:
675: fast_glob Normally, ssuuddoo uses the _g_l_o_b(3) function to do shell-
676: style globbing when matching path names. However,
677: since it accesses the file system, _g_l_o_b(3) can take a
678: long time to complete for some patterns, especially
679: when the pattern references a network file system that
680: is mounted on demand (automounted). The _f_a_s_t___g_l_o_b
681: option causes ssuuddoo to use the _f_n_m_a_t_c_h(3) function,
682: which does not access the file system to do its
683: matching. The disadvantage of _f_a_s_t___g_l_o_b is that it is
684: unable to match relative path names such as _._/_l_s or
685: _._._/_b_i_n_/_l_s. This has security implications when path
686: names that include globbing characters are used with
687: the negation operator, '!', as such rules can be
688: trivially bypassed. As such, this option should not be
689: used when _s_u_d_o_e_r_s contains rules that contain negated
690: path names which include globbing characters. This
691: flag is _o_f_f by default.
692:
693: fqdn Set this flag if you want to put fully qualified host
694: names in the _s_u_d_o_e_r_s file. I.e., instead of myhost you
695: would use myhost.mydomain.edu. You may still use the
696: short form if you wish (and even mix the two). Beware
697: that turning on _f_q_d_n requires ssuuddoo to make DNS lookups
698: which may make ssuuddoo unusable if DNS stops working (for
699: example if the machine is not plugged into the
700: network). Also note that you must use the host's
701: official name as DNS knows it. That is, you may not
702: use a host alias (CNAME entry) due to performance
703: issues and the fact that there is no way to get all
704: aliases from DNS. If your machine's host name (as
705: returned by the hostname command) is already fully
706: qualified you shouldn't need to set _f_q_d_n. This flag is
707: _o_f_f by default.
708:
709: ignore_dot If set, ssuuddoo will ignore '.' or '' (current dir) in the
710: PATH environment variable; the PATH itself is not
711: modified. This flag is _o_f_f by default.
712:
713: ignore_local_sudoers
714: If set via LDAP, parsing of _/_e_t_c_/_s_u_d_o_e_r_s will be
715: skipped. This is intended for Enterprises that wish to
716: prevent the usage of local sudoers files so that only
717: LDAP is used. This thwarts the efforts of rogue
718: operators who would attempt to add roles to
719: _/_e_t_c_/_s_u_d_o_e_r_s. When this option is present,
720: _/_e_t_c_/_s_u_d_o_e_r_s does not even need to exist. Since this
721: option tells ssuuddoo how to behave when no specific LDAP
722: entries have been matched, this sudoOption is only
723: meaningful for the cn=defaults section. This flag is
724: _o_f_f by default.
725:
726: insults If set, ssuuddoo will insult users when they enter an
727: incorrect password. This flag is _o_f_f by default.
728:
729: log_host If set, the host name will be logged in the (non-
730: syslog) ssuuddoo log file. This flag is _o_f_f by default.
731:
732: log_input If set, ssuuddoo will run the command in a _p_s_e_u_d_o _t_t_y and
733: log all user input. If the standard input is not
734: connected to the user's tty, due to I/O redirection or
735: because the command is part of a pipeline, that input
736: is also captured and stored in a separate log file.
737:
738: Input is logged to the directory specified by the
739: _i_o_l_o_g___d_i_r option (_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o by default) using a
740: unique session ID that is included in the normal ssuuddoo
741: log line, prefixed with _T_S_I_D_=. The _i_o_l_o_g___f_i_l_e option
742: may be used to control the format of the session ID.
743:
744: Note that user input may contain sensitive information
745: such as passwords (even if they are not echoed to the
746: screen), which will be stored in the log file
747: unencrypted. In most cases, logging the command output
748: via _l_o_g___o_u_t_p_u_t is all that is required.
749:
750: log_output If set, ssuuddoo will run the command in a _p_s_e_u_d_o _t_t_y and
751: log all output that is sent to the screen, similar to
752: the _s_c_r_i_p_t(1) command. If the standard output or
753: standard error is not connected to the user's tty, due
754: to I/O redirection or because the command is part of a
755: pipeline, that output is also captured and stored in
756: separate log files.
757:
758: Output is logged to the directory specified by the
759: _i_o_l_o_g___d_i_r option (_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o by default) using a
760: unique session ID that is included in the normal ssuuddoo
761: log line, prefixed with _T_S_I_D_=. The _i_o_l_o_g___f_i_l_e option
762: may be used to control the format of the session ID.
763:
764: Output logs may be viewed with the _s_u_d_o_r_e_p_l_a_y(1m)
765: utility, which can also be used to list or search the
766: available logs.
767:
768: log_year If set, the four-digit year will be logged in the (non-
769: syslog) ssuuddoo log file. This flag is _o_f_f by default.
770:
771: long_otp_prompt When validating with a One Time Password (OTP) scheme
772: such as SS//KKeeyy or OOPPIIEE, a two-line prompt is used to
773: make it easier to cut and paste the challenge to a
774: local window. It's not as pretty as the default but
775: some people find it more convenient. This flag is _o_f_f
776: by default.
777:
778: mail_always Send mail to the _m_a_i_l_t_o user every time a users runs
779: ssuuddoo. This flag is _o_f_f by default.
780:
781: mail_badpass Send mail to the _m_a_i_l_t_o user if the user running ssuuddoo
782: does not enter the correct password. This flag is _o_f_f
783: by default.
784:
785: mail_no_host If set, mail will be sent to the _m_a_i_l_t_o user if the
786: invoking user exists in the _s_u_d_o_e_r_s file, but is not
787: allowed to run commands on the current host. This flag
788: is _o_f_f by default.
789:
790: mail_no_perms If set, mail will be sent to the _m_a_i_l_t_o user if the
791: invoking user is allowed to use ssuuddoo but the command
792: they are trying is not listed in their _s_u_d_o_e_r_s file
793: entry or is explicitly denied. This flag is _o_f_f by
794: default.
795:
796: mail_no_user If set, mail will be sent to the _m_a_i_l_t_o user if the
797: invoking user is not in the _s_u_d_o_e_r_s file. This flag is
798: _o_n by default.
799:
800: noexec If set, all commands run via ssuuddoo will behave as if the
801: NOEXEC tag has been set, unless overridden by a EXEC
802: tag. See the description of _N_O_E_X_E_C _a_n_d _E_X_E_C below as
803: well as the "PREVENTING SHELL ESCAPES" section at the
804: end of this manual. This flag is _o_f_f by default.
805:
806: path_info Normally, ssuuddoo will tell the user when a command could
807: not be found in their PATH environment variable. Some
808: sites may wish to disable this as it could be used to
809: gather information on the location of executables that
810: the normal user does not have access to. The
811: disadvantage is that if the executable is simply not in
812: the user's PATH, ssuuddoo will tell the user that they are
813: not allowed to run it, which can be confusing. This
814: flag is _o_n by default.
815:
816: passprompt_override
817: The password prompt specified by _p_a_s_s_p_r_o_m_p_t will
818: normally only be used if the password prompt provided
819: by systems such as PAM matches the string "Password:".
820: If _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e is set, _p_a_s_s_p_r_o_m_p_t will always
821: be used. This flag is _o_f_f by default.
822:
823: preserve_groups By default, ssuuddoo will initialize the group vector to
824: the list of groups the target user is in. When
825: _p_r_e_s_e_r_v_e___g_r_o_u_p_s is set, the user's existing group
826: vector is left unaltered. The real and effective group
827: IDs, however, are still set to match the target user.
828: This flag is _o_f_f by default.
829:
830: pwfeedback By default, ssuuddoo reads the password like most other
831: Unix programs, by turning off echo until the user hits
832: the return (or enter) key. Some users become confused
833: by this as it appears to them that ssuuddoo has hung at
834: this point. When _p_w_f_e_e_d_b_a_c_k is set, ssuuddoo will provide
835: visual feedback when the user presses a key. Note that
836: this does have a security impact as an onlooker may be
837: able to determine the length of the password being
838: entered. This flag is _o_f_f by default.
839:
840: requiretty If set, ssuuddoo will only run when the user is logged in
841: to a real tty. When this flag is set, ssuuddoo can only be
842: run from a login session and not via other means such
843: as _c_r_o_n(1m) or cgi-bin scripts. This flag is _o_f_f by
844: default.
845:
846: root_sudo If set, root is allowed to run ssuuddoo too. Disabling
847: this prevents users from "chaining" ssuuddoo commands to
848: get a root shell by doing something like "sudo sudo
849: /bin/sh". Note, however, that turning off _r_o_o_t___s_u_d_o
850: will also prevent root from running ssuuddooeeddiitt.
851: Disabling _r_o_o_t___s_u_d_o provides no real additional
852: security; it exists purely for historical reasons.
853: This flag is _o_n by default.
854:
855: rootpw If set, ssuuddoo will prompt for the root password instead
856: of the password of the invoking user. This flag is _o_f_f
857: by default.
858:
859: runaspw If set, ssuuddoo will prompt for the password of the user
860: defined by the _r_u_n_a_s___d_e_f_a_u_l_t option (defaults to root)
861: instead of the password of the invoking user. This
862: flag is _o_f_f by default.
863:
864: set_home If enabled and ssuuddoo is invoked with the --ss option the
865: HOME environment variable will be set to the home
866: directory of the target user (which is root unless the
867: --uu option is used). This effectively makes the --ss
868: option imply --HH. Note that HOME is already set when
869: the the _e_n_v___r_e_s_e_t option is enabled, so _s_e_t___h_o_m_e is
870: only effective for configurations where either
871: _e_n_v___r_e_s_e_t is disabled or HOME is present in the
872: _e_n_v___k_e_e_p list. This flag is _o_f_f by default.
873:
874: set_logname Normally, ssuuddoo will set the LOGNAME, USER and USERNAME
875: environment variables to the name of the target user
876: (usually root unless the --uu option is given). However,
877: since some programs (including the RCS revision control
878: system) use LOGNAME to determine the real identity of
879: the user, it may be desirable to change this behavior.
880: This can be done by negating the set_logname option.
881: Note that if the _e_n_v___r_e_s_e_t option has not been
882: disabled, entries in the _e_n_v___k_e_e_p list will override
883: the value of _s_e_t___l_o_g_n_a_m_e. This flag is _o_n by default.
884:
885: set_utmp When enabled, ssuuddoo will create an entry in the utmp (or
886: utmpx) file when a pseudo-tty is allocated. A pseudo-
887: tty is allocated by ssuuddoo when the _l_o_g___i_n_p_u_t, _l_o_g___o_u_t_p_u_t
888: or _u_s_e___p_t_y flags are enabled. By default, the new
889: entry will be a copy of the user's existing utmp entry
890: (if any), with the tty, time, type and pid fields
891: updated. This flag is _o_n by default.
892:
893: setenv Allow the user to disable the _e_n_v___r_e_s_e_t option from the
894: command line via the --EE option. Additionally,
895: environment variables set via the command line are not
896: subject to the restrictions imposed by _e_n_v___c_h_e_c_k,
897: _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p. As such, only trusted users
898: should be allowed to set variables in this manner.
899: This flag is _o_f_f by default.
900:
901: shell_noargs If set and ssuuddoo is invoked with no arguments it acts as
902: if the --ss option had been given. That is, it runs a
903: shell as root (the shell is determined by the SHELL
904: environment variable if it is set, falling back on the
905: shell listed in the invoking user's /etc/passwd entry
906: if not). This flag is _o_f_f by default.
907:
908: stay_setuid Normally, when ssuuddoo executes a command the real and
909: effective UIDs are set to the target user (root by
910: default). This option changes that behavior such that
911: the real UID is left as the invoking user's UID. In
912: other words, this makes ssuuddoo act as a setuid wrapper.
913: This can be useful on systems that disable some
914: potentially dangerous functionality when a program is
915: run setuid. This option is only effective on systems
916: with either the _s_e_t_r_e_u_i_d_(_) or _s_e_t_r_e_s_u_i_d_(_) function.
917: This flag is _o_f_f by default.
918:
919: targetpw If set, ssuuddoo will prompt for the password of the user
920: specified by the --uu option (defaults to root) instead
921: of the password of the invoking user. In addition, the
922: timestamp file name will include the target user's
923: name. Note that this flag precludes the use of a uid
924: not listed in the passwd database as an argument to the
925: --uu option. This flag is _o_f_f by default.
926:
927: tty_tickets If set, users must authenticate on a per-tty basis.
928: With this flag enabled, ssuuddoo will use a file named for
929: the tty the user is logged in on in the user's time
930: stamp directory. If disabled, the time stamp of the
931: directory is used instead. This flag is _o_n by default.
932:
933: umask_override If set, ssuuddoo will set the umask as specified by _s_u_d_o_e_r_s
934: without modification. This makes it possible to
935: specify a more permissive umask in _s_u_d_o_e_r_s than the
936: user's own umask and matches historical behavior. If
937: _u_m_a_s_k___o_v_e_r_r_i_d_e is not set, ssuuddoo will set the umask to
938: be the union of the user's umask and what is specified
939: in _s_u_d_o_e_r_s. This flag is _o_f_f by default.
940:
941: use_loginclass If set, ssuuddoo will apply the defaults specified for the
942: target user's login class if one exists. Only
943: available if ssuuddoo is configured with the
944: --with-logincap option. This flag is _o_f_f by default.
945:
946: use_pty If set, ssuuddoo will run the command in a pseudo-pty even
947: if no I/O logging is being gone. A malicious program
948: run under ssuuddoo could conceivably fork a background
949: process that retains to the user's terminal device
950: after the main program has finished executing. Use of
951: this option will make that impossible. This flag is
952: _o_f_f by default.
953:
954: utmp_runas If set, ssuuddoo will store the name of the runas user when
955: updating the utmp (or utmpx) file. By default, ssuuddoo
956: stores the name of the invoking user. This flag is _o_f_f
957: by default.
958:
959: visiblepw By default, ssuuddoo will refuse to run if the user must
960: enter a password but it is not possible to disable echo
961: on the terminal. If the _v_i_s_i_b_l_e_p_w flag is set, ssuuddoo
962: will prompt for a password even when it would be
963: visible on the screen. This makes it possible to run
964: things like "rsh somehost sudo ls" since _r_s_h(1) does
965: not allocate a tty. This flag is _o_f_f by default.
966:
967: IInntteeggeerrss:
968:
969: closefrom Before it executes a command, ssuuddoo will close all open
970: file descriptors other than standard input, standard
971: output and standard error (ie: file descriptors 0-2).
972: The _c_l_o_s_e_f_r_o_m option can be used to specify a different
973: file descriptor at which to start closing. The default
974: is 3.
975:
976: passwd_tries The number of tries a user gets to enter his/her
977: password before ssuuddoo logs the failure and exits. The
978: default is 3.
979:
980: IInntteeggeerrss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
981:
982: loglinelen Number of characters per line for the file log. This
983: value is used to decide when to wrap lines for nicer
984: log files. This has no effect on the syslog log file,
985: only the file log. The default is 80 (use 0 or negate
986: the option to disable word wrap).
987:
988: passwd_timeout Number of minutes before the ssuuddoo password prompt times
989: out, or 0 for no timeout. The timeout may include a
990: fractional component if minute granularity is
991: insufficient, for example 2.5. The default is 5.
992:
993: timestamp_timeout
994: Number of minutes that can elapse before ssuuddoo will ask
995: for a passwd again. The timeout may include a
996: fractional component if minute granularity is
997: insufficient, for example 2.5. The default is 5. Set
998: this to 0 to always prompt for a password. If set to a
999: value less than 0 the user's timestamp will never
1000: expire. This can be used to allow users to create or
1001: delete their own timestamps via sudo -v and sudo -k
1002: respectively.
1003:
1004: umask Umask to use when running the command. Negate this
1005: option or set it to 0777 to preserve the user's umask.
1006: The actual umask that is used will be the union of the
1007: user's umask and the value of the _u_m_a_s_k option, which
1008: defaults to 0022. This guarantees that ssuuddoo never
1009: lowers the umask when running a command. Note on
1010: systems that use PAM, the default PAM configuration may
1011: specify its own umask which will override the value set
1012: in _s_u_d_o_e_r_s.
1013:
1014: SSttrriinnggss:
1015:
1016: badpass_message Message that is displayed if a user enters an incorrect
1017: password. The default is Sorry, try again. unless
1018: insults are enabled.
1019:
1020: editor A colon (':') separated list of editors allowed to be
1021: used with vviissuuddoo. vviissuuddoo will choose the editor that
1022: matches the user's EDITOR environment variable if
1023: possible, or the first editor in the list that exists
1024: and is executable. The default is "vi".
1025:
1026: iolog_dir The top-level directory to use when constructing the
1027: path name for the input/output log directory. Only
1028: used if the _l_o_g___i_n_p_u_t or _l_o_g___o_u_t_p_u_t options are enabled
1029: or when the LOG_INPUT or LOG_OUTPUT tags are present
1030: for a command. The session sequence number, if any, is
1031: stored in the directory. The default is
1032: "/var/log/sudo-io".
1033:
1034: The following percent (`%') escape sequences are
1035: supported:
1036:
1037: %{seq}
1038: expanded to a monotonically increasing base-36
1039: sequence number, such as 0100A5, where every two
1040: digits are used to form a new directory, e.g.
1041: _0_1_/_0_0_/_A_5
1042:
1043: %{user}
1044: expanded to the invoking user's login name
1045:
1046: %{group}
1047: expanded to the name of the invoking user's real
1048: group ID
1049:
1050: %{runas_user}
1051: expanded to the login name of the user the command
1052: will be run as (e.g. root)
1053:
1054: %{runas_group}
1055: expanded to the group name of the user the command
1056: will be run as (e.g. wheel)
1057:
1058: %{hostname}
1059: expanded to the local host name without the domain
1060: name
1061:
1062: %{command}
1063: expanded to the base name of the command being run
1064:
1065: In addition, any escape sequences supported by the
1066: system's _s_t_r_f_t_i_m_e_(_) function will be expanded.
1067:
1068: To include a literal `%' character, the string `%%'
1069: should be used.
1070:
1071: iolog_file The path name, relative to _i_o_l_o_g___d_i_r, in which to store
1072: input/output logs when the _l_o_g___i_n_p_u_t or _l_o_g___o_u_t_p_u_t
1073: options are enabled or when the LOG_INPUT or LOG_OUTPUT
1074: tags are present for a command. Note that _i_o_l_o_g___f_i_l_e
1075: may contain directory components. The default is
1076: "%{seq}".
1077:
1078: See the _i_o_l_o_g___d_i_r option above for a list of supported
1079: percent (`%') escape sequences.
1080:
1081: In addition to the escape sequences, path names that
1082: end in six or more Xs will have the Xs replaced with a
1083: unique combination of digits and letters, similar to
1084: the _m_k_t_e_m_p_(_) function.
1085:
1086: mailsub Subject of the mail sent to the _m_a_i_l_t_o user. The escape
1087: %h will expand to the host name of the machine.
1088: Default is *** SECURITY information for %h ***.
1089:
1090: noexec_file This option is deprecated and will be removed in a
1091: future release of ssuuddoo. The path to the noexec file
1092: should now be set in the _/_e_t_c_/_s_u_d_o_._c_o_n_f file.
1093:
1094: passprompt The default prompt to use when asking for a password;
1095: can be overridden via the --pp option or the SUDO_PROMPT
1096: environment variable. The following percent (`%')
1097: escape sequences are supported:
1098:
1099: %H expanded to the local host name including the
1100: domain name (only if the machine's host name is
1101: fully qualified or the _f_q_d_n option is set)
1102:
1103: %h expanded to the local host name without the domain
1104: name
1105:
1106: %p expanded to the user whose password is being asked
1107: for (respects the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and _r_u_n_a_s_p_w
1108: flags in _s_u_d_o_e_r_s)
1109:
1110: %U expanded to the login name of the user the command
1111: will be run as (defaults to root)
1112:
1113: %u expanded to the invoking user's login name
1114:
1115: %% two consecutive % characters are collapsed into a
1116: single % character
1117:
1118: The default value is Password:.
1119:
1120: role The default SELinux role to use when constructing a new
1121: security context to run the command. The default role
1122: may be overridden on a per-command basis in _s_u_d_o_e_r_s or
1123: via command line options. This option is only
1124: available whe ssuuddoo is built with SELinux support.
1125:
1126: runas_default The default user to run commands as if the --uu option is
1127: not specified on the command line. This defaults to
1128: root.
1129:
1130: syslog_badpri Syslog priority to use when user authenticates
1131: unsuccessfully. Defaults to alert.
1132:
1133: The following syslog priorities are supported: aalleerrtt,
1134: ccrriitt, ddeebbuugg, eemmeerrgg, eerrrr, iinnffoo, nnoottiiccee, and wwaarrnniinngg.
1135:
1136: syslog_goodpri Syslog priority to use when user authenticates
1137: successfully. Defaults to notice.
1138:
1139: See syslog_badpri for the list of supported syslog
1140: priorities.
1141:
1142: sudoers_locale Locale to use when parsing the sudoers file, logging
1143: commands, and sending email. Note that changing the
1144: locale may affect how sudoers is interpreted. Defaults
1145: to "C".
1146:
1147: timestampdir The directory in which ssuuddoo stores its timestamp files.
1148: The default is _/_v_a_r_/_a_d_m_/_s_u_d_o.
1149:
1150: timestampowner The owner of the timestamp directory and the timestamps
1151: stored therein. The default is root.
1152:
1153: type The default SELinux type to use when constructing a new
1154: security context to run the command. The default type
1155: may be overridden on a per-command basis in _s_u_d_o_e_r_s or
1156: via command line options. This option is only
1157: available whe ssuuddoo is built with SELinux support.
1158:
1159: SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
1160:
1161: env_file The _e_n_v___f_i_l_e options specifies the fully qualified path to
1162: a file containing variables to be set in the environment of
1163: the program being run. Entries in this file should either
1164: be of the form VARIABLE=value or export VARIABLE=value.
1165: The value may optionally be surrounded by single or double
1166: quotes. Variables in this file are subject to other ssuuddoo
1167: environment settings such as _e_n_v___k_e_e_p and _e_n_v___c_h_e_c_k.
1168:
1169: exempt_group
1170: Users in this group are exempt from password and PATH
1171: requirements. The group name specified should not include
1172: a % prefix. This is not set by default.
1173:
1174: group_plugin
1175: A string containing a _s_u_d_o_e_r_s group plugin with optional
1176: arguments. This can be used to implement support for the
1177: nonunix_group syntax described earlier. The string should
1178: consist of the plugin path, either fully-qualified or
1179: relative to the _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c directory, followed by
1180: any configuration arguments the plugin requires. These
1181: arguments (if any) will be passed to the plugin's
1182: initialization function. If arguments are present, the
1183: string must be enclosed in double quotes (").
1184:
1185: For example, given _/_e_t_c_/_s_u_d_o_-_g_r_o_u_p, a group file in Unix
1186: group format, the sample group plugin can be used:
1187:
1188: Defaults group_plugin="sample_group.so /etc/sudo-group"
1189:
1190: For more information see _s_u_d_o___p_l_u_g_i_n(4).
1191:
1192: lecture This option controls when a short lecture will be printed
1193: along with the password prompt. It has the following
1194: possible values:
1195:
1196: always Always lecture the user.
1197:
1198: never Never lecture the user.
1199:
1200: once Only lecture the user the first time they run ssuuddoo.
1201:
1202: If no value is specified, a value of _o_n_c_e is implied.
1203: Negating the option results in a value of _n_e_v_e_r being used.
1204: The default value is _o_n_c_e.
1205:
1206: lecture_file
1207: Path to a file containing an alternate ssuuddoo lecture that
1208: will be used in place of the standard lecture if the named
1209: file exists. By default, ssuuddoo uses a built-in lecture.
1210:
1211: listpw This option controls when a password will be required when
1212: a user runs ssuuddoo with the --ll option. It has the following
1213: possible values:
1214:
1215: all All the user's _s_u_d_o_e_r_s entries for the current host
1216: must have the NOPASSWD flag set to avoid entering a
1217: password.
1218:
1219: always The user must always enter a password to use the --ll
1220: option.
1221:
1222: any At least one of the user's _s_u_d_o_e_r_s entries for the
1223: current host must have the NOPASSWD flag set to
1224: avoid entering a password.
1225:
1226: never The user need never enter a password to use the --ll
1227: option.
1228:
1229: If no value is specified, a value of _a_n_y is implied.
1230: Negating the option results in a value of _n_e_v_e_r being used.
1231: The default value is _a_n_y.
1232:
1233: logfile Path to the ssuuddoo log file (not the syslog log file).
1234: Setting a path turns on logging to a file; negating this
1235: option turns it off. By default, ssuuddoo logs via syslog.
1236:
1237: mailerflags Flags to use when invoking mailer. Defaults to --tt.
1238:
1239: mailerpath Path to mail program used to send warning mail. Defaults
1240: to the path to sendmail found at configure time.
1241:
1242: mailfrom Address to use for the "from" address when sending warning
1243: and error mail. The address should be enclosed in double
1244: quotes (") to protect against ssuuddoo interpreting the @ sign.
1245: Defaults to the name of the user running ssuuddoo.
1246:
1247: mailto Address to send warning and error mail to. The address
1248: should be enclosed in double quotes (") to protect against
1249: ssuuddoo interpreting the @ sign. Defaults to root.
1250:
1251: secure_path Path used for every command run from ssuuddoo. If you don't
1252: trust the people running ssuuddoo to have a sane PATH
1253: environment variable you may want to use this. Another use
1254: is if you want to have the "root path" be separate from the
1255: "user path." Users in the group specified by the
1256: _e_x_e_m_p_t___g_r_o_u_p option are not affected by _s_e_c_u_r_e___p_a_t_h. This
1257: option is not set by default.
1258:
1259: syslog Syslog facility if syslog is being used for logging (negate
1260: to disable syslog logging). Defaults to auth.
1261:
1262: The following syslog facilities are supported: aauutthhpprriivv (if
1263: your OS supports it), aauutthh, ddaaeemmoonn, uusseerr, llooccaall00, llooccaall11,
1264: llooccaall22, llooccaall33, llooccaall44, llooccaall55, llooccaall66, and llooccaall77.
1265:
1266: verifypw This option controls when a password will be required when
1267: a user runs ssuuddoo with the --vv option. It has the following
1268: possible values:
1269:
1270: all All the user's _s_u_d_o_e_r_s entries for the current host
1271: must have the NOPASSWD flag set to avoid entering a
1272: password.
1273:
1274: always The user must always enter a password to use the --vv
1275: option.
1276:
1277: any At least one of the user's _s_u_d_o_e_r_s entries for the
1278: current host must have the NOPASSWD flag set to
1279: avoid entering a password.
1280:
1281: never The user need never enter a password to use the --vv
1282: option.
1283:
1284: If no value is specified, a value of _a_l_l is implied.
1285: Negating the option results in a value of _n_e_v_e_r being used.
1286: The default value is _a_l_l.
1287:
1288: LLiissttss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
1289:
1290: env_check Environment variables to be removed from the user's
1291: environment if the variable's value contains % or /
1292: characters. This can be used to guard against printf-
1293: style format vulnerabilities in poorly-written
1294: programs. The argument may be a double-quoted, space-
1295: separated list or a single value without double-quotes.
1296: The list can be replaced, added to, deleted from, or
1297: disabled by using the =, +=, -=, and ! operators
1298: respectively. Regardless of whether the env_reset
1299: option is enabled or disabled, variables specified by
1300: env_check will be preserved in the environment if they
1301: pass the aforementioned check. The default list of
1302: environment variables to check is displayed when ssuuddoo
1303: is run by root with the _-_V option.
1304:
1305: env_delete Environment variables to be removed from the user's
1306: environment when the _e_n_v___r_e_s_e_t option is not in effect.
1307: The argument may be a double-quoted, space-separated
1308: list or a single value without double-quotes. The list
1309: can be replaced, added to, deleted from, or disabled by
1310: using the =, +=, -=, and ! operators respectively. The
1311: default list of environment variables to remove is
1312: displayed when ssuuddoo is run by root with the _-_V option.
1313: Note that many operating systems will remove
1314: potentially dangerous variables from the environment of
1315: any setuid process (such as ssuuddoo).
1316:
1317: env_keep Environment variables to be preserved in the user's
1318: environment when the _e_n_v___r_e_s_e_t option is in effect.
1319: This allows fine-grained control over the environment
1320: ssuuddoo-spawned processes will receive. The argument may
1321: be a double-quoted, space-separated list or a single
1322: value without double-quotes. The list can be replaced,
1323: added to, deleted from, or disabled by using the =, +=,
1324: -=, and ! operators respectively. The default list of
1325: variables to keep is displayed when ssuuddoo is run by root
1326: with the _-_V option.
1327:
1328: FFIILLEESS
1329: _/_e_t_c_/_s_u_d_o_e_r_s List of who can run what
1330:
1331: _/_e_t_c_/_g_r_o_u_p Local groups file
1332:
1333: _/_e_t_c_/_n_e_t_g_r_o_u_p List of network groups
1334:
1335: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o I/O log files
1336:
1337: _/_v_a_r_/_a_d_m_/_s_u_d_o Directory containing time stamps for the
1338: _s_u_d_o_e_r_s security policy
1339:
1340: _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t Initial environment for --ii mode on Linux and
1341: AIX
1342:
1343: EEXXAAMMPPLLEESS
1344: Below are example _s_u_d_o_e_r_s entries. Admittedly, some of these are a bit
1345: contrived. First, we allow a few environment variables to pass and
1346: then define our _a_l_i_a_s_e_s:
1347:
1348: # Run X applications through sudo; HOME is used to find the
1349: # .Xauthority file. Note that other programs use HOME to find
1350: # configuration files and this may lead to privilege escalation!
1351: Defaults env_keep += "DISPLAY HOME"
1352:
1353: # User alias specification
1354: User_Alias FULLTIMERS = millert, mikef, dowdy
1355: User_Alias PARTTIMERS = bostley, jwfox, crawl
1356: User_Alias WEBMASTERS = will, wendy, wim
1357:
1358: # Runas alias specification
1359: Runas_Alias OP = root, operator
1360: Runas_Alias DB = oracle, sybase
1361: Runas_Alias ADMINGRP = adm, oper
1362:
1363: # Host alias specification
1364: Host_Alias SPARC = bigtime, eclipse, moet, anchor :\
1365: SGI = grolsch, dandelion, black :\
1366: ALPHA = widget, thalamus, foobar :\
1367: HPPA = boa, nag, python
1368: Host_Alias CUNETS = 128.138.0.0/255.255.0.0
1369: Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
1370: Host_Alias SERVERS = master, mail, www, ns
1371: Host_Alias CDROM = orion, perseus, hercules
1372:
1373: # Cmnd alias specification
1374: Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
1375: /usr/sbin/restore, /usr/sbin/rrestore
1376: Cmnd_Alias KILL = /usr/bin/kill
1377: Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
1378: Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
1379: Cmnd_Alias HALT = /usr/sbin/halt
1380: Cmnd_Alias REBOOT = /usr/sbin/reboot
1381: Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
1382: /usr/local/bin/tcsh, /usr/bin/rsh, \
1383: /usr/local/bin/zsh
1384: Cmnd_Alias SU = /usr/bin/su
1385: Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
1386:
1387: Here we override some of the compiled in default values. We want ssuuddoo
1388: to log via _s_y_s_l_o_g(3) using the _a_u_t_h facility in all cases. We don't
1389: want to subject the full time staff to the ssuuddoo lecture, user mmiilllleerrtt
1390: need not give a password, and we don't want to reset the LOGNAME, USER
1391: or USERNAME environment variables when running commands as root.
1392: Additionally, on the machines in the _S_E_R_V_E_R_S Host_Alias, we keep an
1393: additional local log file and make sure we log the year in each log
1394: line since the log entries will be kept around for several years.
1395: Lastly, we disable shell escapes for the commands in the PAGERS
1396: Cmnd_Alias (_/_u_s_r_/_b_i_n_/_m_o_r_e, _/_u_s_r_/_b_i_n_/_p_g and _/_u_s_r_/_b_i_n_/_l_e_s_s).
1397:
1398: # Override built-in defaults
1399: Defaults syslog=auth
1400: Defaults>root !set_logname
1401: Defaults:FULLTIMERS !lecture
1402: Defaults:millert !authenticate
1403: Defaults@SERVERS log_year, logfile=/var/log/sudo.log
1404: Defaults!PAGERS noexec
1405:
1406: The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually determines who may run
1407: what.
1408:
1409: root ALL = (ALL) ALL
1410: %wheel ALL = (ALL) ALL
1411:
1412: We let rroooott and any user in group wwhheeeell run any command on any host as
1413: any user.
1414:
1415: FULLTIMERS ALL = NOPASSWD: ALL
1416:
1417: Full time sysadmins (mmiilllleerrtt, mmiikkeeff, and ddoowwddyy) may run any command on
1418: any host without authenticating themselves.
1419:
1420: PARTTIMERS ALL = ALL
1421:
1422: Part time sysadmins (bboossttlleeyy, jjwwffooxx, and ccrraawwll) may run any command on
1423: any host but they must authenticate themselves first (since the entry
1424: lacks the NOPASSWD tag).
1425:
1426: jack CSNETS = ALL
1427:
1428: The user jjaacckk may run any command on the machines in the _C_S_N_E_T_S alias
1429: (the networks 128.138.243.0, 128.138.204.0, and 128.138.242.0). Of
1430: those networks, only 128.138.204.0 has an explicit netmask (in CIDR
1431: notation) indicating it is a class C network. For the other networks
1432: in _C_S_N_E_T_S, the local machine's netmask will be used during matching.
1433:
1434: lisa CUNETS = ALL
1435:
1436: The user lliissaa may run any command on any host in the _C_U_N_E_T_S alias (the
1437: class B network 128.138.0.0).
1438:
1439: operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
1440: sudoedit /etc/printcap, /usr/oper/bin/
1441:
1442: The ooppeerraattoorr user may run commands limited to simple maintenance.
1443: Here, those are commands related to backups, killing processes, the
1444: printing system, shutting down the system, and any commands in the
1445: directory _/_u_s_r_/_o_p_e_r_/_b_i_n_/.
1446:
1447: joe ALL = /usr/bin/su operator
1448:
1449: The user jjooee may only _s_u(1) to operator.
1450:
1451: pete HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root
1452:
1453: %opers ALL = (: ADMINGRP) /usr/sbin/
1454:
1455: Users in the ooppeerrss group may run commands in _/_u_s_r_/_s_b_i_n_/ as themselves
1456: with any group in the _A_D_M_I_N_G_R_P Runas_Alias (the aaddmm and ooppeerr groups).
1457:
1458: The user ppeettee is allowed to change anyone's password except for root on
1459: the _H_P_P_A machines. Note that this assumes _p_a_s_s_w_d(1) does not take
1460: multiple user names on the command line.
1461:
1462: bob SPARC = (OP) ALL : SGI = (OP) ALL
1463:
1464: The user bboobb may run anything on the _S_P_A_R_C and _S_G_I machines as any user
1465: listed in the _O_P Runas_Alias (rroooott and ooppeerraattoorr).
1466:
1467: jim +biglab = ALL
1468:
1469: The user jjiimm may run any command on machines in the _b_i_g_l_a_b netgroup.
1470: ssuuddoo knows that "biglab" is a netgroup due to the '+' prefix.
1471:
1472: +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
1473:
1474: Users in the sseeccrreettaarriieess netgroup need to help manage the printers as
1475: well as add and remove users, so they are allowed to run those commands
1476: on all machines.
1477:
1478: fred ALL = (DB) NOPASSWD: ALL
1479:
1480: The user ffrreedd can run commands as any user in the _D_B Runas_Alias
1481: (oorraaccllee or ssyybbaassee) without giving a password.
1482:
1483: john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
1484:
1485: On the _A_L_P_H_A machines, user jjoohhnn may su to anyone except root but he is
1486: not allowed to specify any options to the _s_u(1) command.
1487:
1488: jen ALL, !SERVERS = ALL
1489:
1490: The user jjeenn may run any command on any machine except for those in the
1491: _S_E_R_V_E_R_S Host_Alias (master, mail, www and ns).
1492:
1493: jill SERVERS = /usr/bin/, !SU, !SHELLS
1494:
1495: For any machine in the _S_E_R_V_E_R_S Host_Alias, jjiillll may run any commands in
1496: the directory _/_u_s_r_/_b_i_n_/ except for those commands belonging to the _S_U
1497: and _S_H_E_L_L_S Cmnd_Aliases.
1498:
1499: steve CSNETS = (operator) /usr/local/op_commands/
1500:
1501: The user sstteevvee may run any command in the directory
1502: /usr/local/op_commands/ but only as user operator.
1503:
1504: matt valkyrie = KILL
1505:
1506: On his personal workstation, valkyrie, mmaatttt needs to be able to kill
1507: hung processes.
1508:
1509: WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
1510:
1511: On the host www, any user in the _W_E_B_M_A_S_T_E_R_S User_Alias (will, wendy,
1512: and wim), may run any command as user www (which owns the web pages) or
1513: simply _s_u(1) to www.
1514:
1515: ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\
1516: /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
1517:
1518: Any user may mount or unmount a CD-ROM on the machines in the CDROM
1519: Host_Alias (orion, perseus, hercules) without entering a password.
1520: This is a bit tedious for users to type, so it is a prime candidate for
1521: encapsulating in a shell script.
1522:
1523: SSEECCUURRIITTYY NNOOTTEESS
1524: It is generally not effective to "subtract" commands from ALL using the
1525: '!' operator. A user can trivially circumvent this by copying the
1526: desired command to a different name and then executing that. For
1527: example:
1528:
1529: bill ALL = ALL, !SU, !SHELLS
1530:
1531: Doesn't really prevent bbiillll from running the commands listed in _S_U or
1532: _S_H_E_L_L_S since he can simply copy those commands to a different name, or
1533: use a shell escape from an editor or other program. Therefore, these
1534: kind of restrictions should be considered advisory at best (and
1535: reinforced by policy).
1536:
1537: Furthermore, if the _f_a_s_t___g_l_o_b option is in use, it is not possible to
1538: reliably negate commands where the path name includes globbing (aka
1539: wildcard) characters. This is because the C library's _f_n_m_a_t_c_h(3)
1540: function cannot resolve relative paths. While this is typically only
1541: an inconvenience for rules that grant privileges, it can result in a
1542: security issue for rules that subtract or revoke privileges.
1543:
1544: For example, given the following _s_u_d_o_e_r_s entry:
1545:
1546: john ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,
1547: /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
1548:
1549: User jjoohhnn can still run /usr/bin/passwd root if _f_a_s_t___g_l_o_b is enabled by
1550: changing to _/_u_s_r_/_b_i_n and running ./passwd root instead.
1551:
1552: PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS
1553: Once ssuuddoo executes a program, that program is free to do whatever it
1554: pleases, including run other programs. This can be a security issue
1555: since it is not uncommon for a program to allow shell escapes, which
1556: lets a user bypass ssuuddoo's access control and logging. Common programs
1557: that permit shell escapes include shells (obviously), editors,
1558: paginators, mail and terminal programs.
1559:
1560: There are two basic approaches to this problem:
1561:
1562: restrict Avoid giving users access to commands that allow the user to
1563: run arbitrary commands. Many editors have a restricted mode
1564: where shell escapes are disabled, though ssuuddooeeddiitt is a better
1565: solution to running editors via ssuuddoo. Due to the large
1566: number of programs that offer shell escapes, restricting
1567: users to the set of programs that do not is often unworkable.
1568:
1569: noexec Many systems that support shared libraries have the ability
1570: to override default library functions by pointing an
1571: environment variable (usually LD_PRELOAD) to an alternate
1572: shared library. On such systems, ssuuddoo's _n_o_e_x_e_c functionality
1573: can be used to prevent a program run by ssuuddoo from executing
1574: any other programs. Note, however, that this applies only to
1575: native dynamically-linked executables. Statically-linked
1576: executables and foreign executables running under binary
1577: emulation are not affected.
1578:
1579: The _n_o_e_x_e_c feature is known to work on SunOS, Solaris, *BSD,
1580: Linux, IRIX, Tru64 UNIX, MacOS X, HP-UX 11.x and AIX 5.3 and
1581: above. It should be supported on most operating systems that
1582: support the LD_PRELOAD environment variable. Check your
1583: operating system's manual pages for the dynamic linker
1584: (usually ld.so, ld.so.1, dyld, dld.sl, rld, or loader) to see
1585: if LD_PRELOAD is supported.
1586:
1587: On Solaris 10 and higher, _n_o_e_x_e_c uses Solaris privileges
1588: instead of the LD_PRELOAD environment variable.
1589:
1590: To enable _n_o_e_x_e_c for a command, use the NOEXEC tag as
1591: documented in the User Specification section above. Here is
1592: that example again:
1593:
1594: aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
1595:
1596: This allows user aaaarroonn to run _/_u_s_r_/_b_i_n_/_m_o_r_e and _/_u_s_r_/_b_i_n_/_v_i
1597: with _n_o_e_x_e_c enabled. This will prevent those two commands
1598: from executing other commands (such as a shell). If you are
1599: unsure whether or not your system is capable of supporting
1600: _n_o_e_x_e_c you can always just try it out and check whether shell
1601: escapes work when _n_o_e_x_e_c is enabled.
1602:
1603: Note that restricting shell escapes is not a panacea. Programs running
1604: as root are still capable of many potentially hazardous operations
1605: (such as changing or overwriting files) that could lead to unintended
1606: privilege escalation. In the specific case of an editor, a safer
1607: approach is to give the user permission to run ssuuddooeeddiitt.
1608:
1609: SSEECCUURRIITTYY NNOOTTEESS
1610: _s_u_d_o_e_r_s will check the ownership of its time stamp directory
1611: (_/_v_a_r_/_a_d_m_/_s_u_d_o by default) and ignore the directory's contents if it is
1612: not owned by root or if it is writable by a user other than root. On
1613: systems that allow non-root users to give away files via _c_h_o_w_n(2), if
1614: the time stamp directory is located in a world-writable directory
1615: (e.g., _/_t_m_p), it is possible for a user to create the time stamp
1616: directory before ssuuddoo is run. However, because _s_u_d_o_e_r_s checks the
1617: ownership and mode of the directory and its contents, the only damage
1618: that can be done is to "hide" files by putting them in the time stamp
1619: dir. This is unlikely to happen since once the time stamp dir is owned
1620: by root and inaccessible by any other user, the user placing files
1621: there would be unable to get them back out.
1622:
1623: _s_u_d_o_e_r_s will not honor time stamps set far in the future. Time stamps
1624: with a date greater than current_time + 2 * TIMEOUT will be ignored and
1625: sudo will log and complain. This is done to keep a user from creating
1626: his/her own time stamp with a bogus date on systems that allow users to
1627: give away files if the time stamp directory is located in a world-
1628: writable directory.
1629:
1630: On systems where the boot time is available, _s_u_d_o_e_r_s will ignore time
1631: stamps that date from before the machine booted.
1632:
1633: Since time stamp files live in the file system, they can outlive a
1634: user's login session. As a result, a user may be able to login, run a
1635: command with ssuuddoo after authenticating, logout, login again, and run
1636: ssuuddoo without authenticating so long as the time stamp file's
1637: modification time is within 5 minutes (or whatever the timeout is set
1638: to in _s_u_d_o_e_r_s). When the _t_t_y___t_i_c_k_e_t_s option is enabled, the time stamp
1639: has per-tty granularity but still may outlive the user's session. On
1640: Linux systems where the devpts filesystem is used, Solaris systems with
1641: the devices filesystem, as well as other systems that utilize a devfs
1642: filesystem that monotonically increase the inode number of devices as
1643: they are created (such as Mac OS X), _s_u_d_o_e_r_s is able to determine when
1644: a tty-based time stamp file is stale and will ignore it.
1645: Administrators should not rely on this feature as it is not universally
1646: available.
1647:
1648: If users have sudo ALL there is nothing to prevent them from creating
1649: their own program that gives them a root shell (or making their own
1650: copy of a shell) regardless of any '!' elements in the user
1651: specification.
1652:
1653: SSEEEE AALLSSOO
1654: _r_s_h(1), _s_u(1), _f_n_m_a_t_c_h(3), _g_l_o_b(3), _m_k_t_e_m_p(3), _s_t_r_f_t_i_m_e(3),
1655: _s_u_d_o_e_r_s_._l_d_a_p(4), _s_u_d_o___p_l_u_g_i_n(1m), _s_u_d_o(1m), _v_i_s_u_d_o(1m)
1656:
1657: CCAAVVEEAATTSS
1658: The _s_u_d_o_e_r_s file should aallwwaayyss be edited by the vviissuuddoo command which
1659: locks the file and does grammatical checking. It is imperative that
1660: _s_u_d_o_e_r_s be free of syntax errors since ssuuddoo will not run with a
1661: syntactically incorrect _s_u_d_o_e_r_s file.
1662:
1663: When using netgroups of machines (as opposed to users), if you store
1664: fully qualified host name in the netgroup (as is usually the case), you
1665: either need to have the machine's host name be fully qualified as
1666: returned by the hostname command or use the _f_q_d_n option in _s_u_d_o_e_r_s.
1667:
1668: BBUUGGSS
1669: If you feel you have found a bug in ssuuddoo, please submit a bug report at
1670: http://www.sudo.ws/sudo/bugs/
1671:
1672: SSUUPPPPOORRTT
1673: Limited free support is available via the sudo-users mailing list, see
1674: http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
1675: the archives.
1676:
1677: DDIISSCCLLAAIIMMEERR
1678: ssuuddoo is provided ``AS IS'' and any express or implied warranties,
1679: including, but not limited to, the implied warranties of
1680: merchantability and fitness for a particular purpose are disclaimed.
1681: See the LICENSE file distributed with ssuuddoo or
1682: http://www.sudo.ws/sudo/license.html for complete details.
1683:
1684:
1685:
1686: 1.8.3 September 16, 2011 SUDOERS(4)
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoers.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc