Return to sudoers.cat CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc

sudo 1.8.5p1

    1: SUDOERS(4)                   MAINTENANCE COMMANDS                   SUDOERS(4)
    2: 
    3: 
    4: 
    5: NNAAMMEE
    6:        sudoers - default sudo security policy module
    7: 
    8: DDEESSCCRRIIPPTTIIOONN
    9:        The _s_u_d_o_e_r_s policy module determines a user's ssuuddoo privileges.  It is
   10:        the default ssuuddoo policy plugin.  The policy is driven by the
   11:        _/_e_t_c_/_s_u_d_o_e_r_s file or, optionally in LDAP.  The policy format is
   12:        described in detail in the "SUDOERS FILE FORMAT" section.  For
   13:        information on storing _s_u_d_o_e_r_s policy information in LDAP, please see
   14:        _s_u_d_o_e_r_s_._l_d_a_p(4).
   15: 
   16:    AAuutthheennttiiccaattiioonn aanndd LLooggggiinngg
   17:        The _s_u_d_o_e_r_s security policy requires that most users authenticate
   18:        themselves before they can use ssuuddoo.  A password is not required if the
   19:        invoking user is root, if the target user is the same as the invoking
   20:        user, or if the policy has disabled authentication for the user or
   21:        command.  Unlike _s_u(1), when _s_u_d_o_e_r_s requires authentication, it
   22:        validates the invoking user's credentials, not the target user's (or
   23:        root's) credentials.  This can be changed via the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and
   24:        _r_u_n_a_s_p_w flags, described later.
   25: 
   26:        If a user who is not listed in the policy tries to run a command via
   27:        ssuuddoo, mail is sent to the proper authorities.  The address used for
   28:        such mail is configurable via the _m_a_i_l_t_o Defaults entry (described
   29:        later) and defaults to root.
   30: 
   31:        Note that mail will not be sent if an unauthorized user tries to run
   32:        ssuuddoo with the --ll or --vv option.  This allows users to determine for
   33:        themselves whether or not they are allowed to use ssuuddoo.
   34: 
   35:        If ssuuddoo is run by root and the SUDO_USER environment variable is set,
   36:        the _s_u_d_o_e_r_s policy will use this value to determine who the actual user
   37:        is.  This can be used by a user to log commands through sudo even when
   38:        a root shell has been invoked.  It also allows the --ee option to remain
   39:        useful even when invoked via a sudo-run script or program.  Note,
   40:        however, that the _s_u_d_o_e_r_s lookup is still done for root, not the user
   41:        specified by SUDO_USER.
   42: 
   43:        _s_u_d_o_e_r_s uses time stamp files for credential caching.  Once a user has
   44:        been authenticated, a time stamp is updated and the user may then use
   45:        sudo without a password for a short period of time (5 minutes unless
   46:        overridden by the _t_i_m_e_o_u_t option.  By default, _s_u_d_o_e_r_s uses a tty-based
   47:        time stamp which means that there is a separate time stamp for each of
   48:        a user's login sessions.  The _t_t_y___t_i_c_k_e_t_s option can be disabled to
   49:        force the use of a single time stamp for all of a user's sessions.
   50: 
   51:        _s_u_d_o_e_r_s can log both successful and unsuccessful attempts (as well as
   52:        errors) to _s_y_s_l_o_g(3), a log file, or both.  By default, _s_u_d_o_e_r_s will
   53:        log via _s_y_s_l_o_g(3) but this is changeable via the _s_y_s_l_o_g and _l_o_g_f_i_l_e
   54:        Defaults settings.
   55: 
   56:        _s_u_d_o_e_r_s also supports logging a command's input and output streams.
   57:        I/O logging is not on by default but can be enabled using the _l_o_g___i_n_p_u_t
   58:        and _l_o_g___o_u_t_p_u_t Defaults flags as well as the LOG_INPUT and LOG_OUTPUT
   59:        command tags.
   60: 
   61:    CCoommmmaanndd EEnnvviirroonnmmeenntt
   62:        Since environment variables can influence program behavior, _s_u_d_o_e_r_s
   63:        provides a means to restrict which variables from the user's
   64:        environment are inherited by the command to be run.  There are two
   65:        distinct ways _s_u_d_o_e_r_s can deal with environment variables.
   66: 
   67:        By default, the _e_n_v___r_e_s_e_t option is enabled.  This causes commands to
   68:        be executed with a new, minimal environment.  On AIX (and Linux systems
   69:        without PAM), the environment is initialized with the contents of the
   70:        _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t file.  On BSD systems, if the _u_s_e___l_o_g_i_n_c_l_a_s_s option is
   71:        enabled, the environment is initialized based on the _p_a_t_h and _s_e_t_e_n_v
   72:        settings in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f.  The new environment contains the TERM,
   73:        PATH, HOME, MAIL, SHELL, LOGNAME, USER, USERNAME and SUDO_* variables
   74:        in addition to variables from the invoking process permitted by the
   75:        _e_n_v___c_h_e_c_k and _e_n_v___k_e_e_p options.  This is effectively a whitelist for
   76:        environment variables.
   77: 
   78:        If, however, the _e_n_v___r_e_s_e_t option is disabled, any variables not
   79:        explicitly denied by the _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e options are inherited
   80:        from the invoking process.  In this case, _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e
   81:        behave like a blacklist.  Since it is not possible to blacklist all
   82:        potentially dangerous environment variables, use of the default
   83:        _e_n_v___r_e_s_e_t behavior is encouraged.
   84: 
   85:        In all cases, environment variables with a value beginning with () are
   86:        removed as they could be interpreted as bbaasshh functions.  The list of
   87:        environment variables that ssuuddoo allows or denies is contained in the
   88:        output of sudo -V when run as root.
   89: 
   90:        Note that the dynamic linker on most operating systems will remove
   91:        variables that can control dynamic linking from the environment of
   92:        setuid executables, including ssuuddoo.  Depending on the operating system
   93:        this may include _RLD*, DYLD_*, LD_*, LDR_*, LIBPATH, SHLIB_PATH, and
   94:        others.  These type of variables are removed from the environment
   95:        before ssuuddoo even begins execution and, as such, it is not possible for
   96:        ssuuddoo to preserve them.
   97: 
   98:        As a special case, if ssuuddoo's --ii option (initial login) is specified,
   99:        _s_u_d_o_e_r_s will initialize the environment regardless of the value of
  100:        _e_n_v___r_e_s_e_t.  The _D_I_S_P_L_A_Y, _P_A_T_H and _T_E_R_M variables remain unchanged;
  101:        _H_O_M_E, _M_A_I_L, _S_H_E_L_L, _U_S_E_R, and _L_O_G_N_A_M_E are set based on the target user.
  102:        On AIX (and Linux systems without PAM), the contents of
  103:        _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t are also included.  On BSD systems, if the
  104:        _u_s_e___l_o_g_i_n_c_l_a_s_s option is enabled, the _p_a_t_h and _s_e_t_e_n_v variables in
  105:        _/_e_t_c_/_l_o_g_i_n_._c_o_n_f are also applied.  All other environment variables are
  106:        removed.
  107: 
  108:        Finally, if the _e_n_v___f_i_l_e option is defined, any variables present in
  109:        that file will be set to their specified values as long as they would
  110:        not conflict with an existing environment variable.
  111: 
  112: SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT
  113:        The _s_u_d_o_e_r_s file is composed of two types of entries: aliases
  114:        (basically variables) and user specifications (which specify who may
  115:        run what).
  116: 
  117:        When multiple entries match for a user, they are applied in order.
  118:        Where there are multiple matches, the last match is used (which is not
  119:        necessarily the most specific match).
  120: 
  121:        The _s_u_d_o_e_r_s grammar will be described below in Extended Backus-Naur
  122:        Form (EBNF).  Don't despair if you don't know what EBNF is; it is
  123:        fairly simple, and the definitions below are annotated.
  124: 
  125:    QQuuiicckk gguuiiddee ttoo EEBBNNFF
  126:        EBNF is a concise and exact way of describing the grammar of a
  127:        language.  Each EBNF definition is made up of _p_r_o_d_u_c_t_i_o_n _r_u_l_e_s.  E.g.,
  128: 
  129:         symbol ::= definition | alternate1 | alternate2 ...
  130: 
  131:        Each _p_r_o_d_u_c_t_i_o_n _r_u_l_e references others and thus makes up a grammar for
  132:        the language.  EBNF also contains the following operators, which many
  133:        readers will recognize from regular expressions.  Do not, however,
  134:        confuse them with "wildcard" characters, which have different meanings.
  135: 
  136:        ?   Means that the preceding symbol (or group of symbols) is optional.
  137:            That is, it may appear once or not at all.
  138: 
  139:        *   Means that the preceding symbol (or group of symbols) may appear
  140:            zero or more times.
  141: 
  142:        +   Means that the preceding symbol (or group of symbols) may appear
  143:            one or more times.
  144: 
  145:        Parentheses may be used to group symbols together.  For clarity, we
  146:        will use single quotes ('') to designate what is a verbatim character
  147:        string (as opposed to a symbol name).
  148: 
  149:    AAlliiaasseess
  150:        There are four kinds of aliases: User_Alias, Runas_Alias, Host_Alias
  151:        and Cmnd_Alias.
  152: 
  153:         Alias ::= 'User_Alias'  User_Alias (':' User_Alias)* |
  154:                   'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
  155:                   'Host_Alias'  Host_Alias (':' Host_Alias)* |
  156:                   'Cmnd_Alias'  Cmnd_Alias (':' Cmnd_Alias)*
  157: 
  158:         User_Alias ::= NAME '=' User_List
  159: 
  160:         Runas_Alias ::= NAME '=' Runas_List
  161: 
  162:         Host_Alias ::= NAME '=' Host_List
  163: 
  164:         Cmnd_Alias ::= NAME '=' Cmnd_List
  165: 
  166:         NAME ::= [A-Z]([A-Z][0-9]_)*
  167: 
  168:        Each _a_l_i_a_s definition is of the form
  169: 
  170:         Alias_Type NAME = item1, item2, ...
  171: 
  172:        where _A_l_i_a_s___T_y_p_e is one of User_Alias, Runas_Alias, Host_Alias, or
  173:        Cmnd_Alias.  A NAME is a string of uppercase letters, numbers, and
  174:        underscore characters ('_').  A NAME mmuusstt start with an uppercase
  175:        letter.  It is possible to put several alias definitions of the same
  176:        type on a single line, joined by a colon (':').  E.g.,
  177: 
  178:         Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
  179: 
  180:        The definitions of what constitutes a valid _a_l_i_a_s member follow.
  181: 
  182:         User_List ::= User |
  183:                       User ',' User_List
  184: 
  185:         User ::= '!'* user name |
  186:                  '!'* #uid |
  187:                  '!'* %group |
  188:                  '!'* %#gid |
  189:                  '!'* +netgroup |
  190:                  '!'* %:nonunix_group |
  191:                  '!'* %:#nonunix_gid |
  192:                  '!'* User_Alias
  193: 
  194:        A User_List is made up of one or more user names, user ids (prefixed
  195:        with '#'), system group names and ids (prefixed with '%' and '%#'
  196:        respectively), netgroups (prefixed with '+'), non-Unix group names and
  197:        IDs (prefixed with '%:' and '%:#' respectively) and User_Aliases.  Each
  198:        list item may be prefixed with zero or more '!' operators.  An odd
  199:        number of '!' operators negate the value of the item; an even number
  200:        just cancel each other out.
  201: 
  202:        A user name, uid, group, gid, netgroup, nonunix_group or nonunix_gid
  203:        may be enclosed in double quotes to avoid the need for escaping special
  204:        characters.  Alternately, special characters may be specified in
  205:        escaped hex mode, e.g. \x20 for space.  When using double quotes, any
  206:        prefix characters must be included inside the quotes.
  207: 
  208:        The actual nonunix_group and nonunix_gid syntax depends on the
  209:        underlying group provider plugin (see the _g_r_o_u_p___p_l_u_g_i_n description
  210:        below).  For instance, the QAS AD plugin supports the following
  211:        formats:
  212: 
  213:        o   Group in the same domain: "Group Name"
  214: 
  215:        o   Group in any domain: "Group Name@FULLY.QUALIFIED.DOMAIN"
  216: 
  217:        o   Group SID: "S-1-2-34-5678901234-5678901234-5678901234-567"
  218: 
  219:        Note that quotes around group names are optional.  Unquoted strings
  220:        must use a backslash (\) to escape spaces and special characters.  See
  221:        "Other special characters and reserved words" for a list of characters
  222:        that need to be escaped.
  223: 
  224:         Runas_List ::= Runas_Member |
  225:                        Runas_Member ',' Runas_List
  226: 
  227:         Runas_Member ::= '!'* user name |
  228:                          '!'* #uid |
  229:                          '!'* %group |
  230:                          '!'* %#gid |
  231:                          '!'* %:nonunix_group |
  232:                          '!'* %:#nonunix_gid |
  233:                          '!'* +netgroup |
  234:                          '!'* Runas_Alias
  235: 
  236:        A Runas_List is similar to a User_List except that instead of
  237:        User_Aliases it can contain Runas_Aliases.  Note that user names and
  238:        groups are matched as strings.  In other words, two users (groups) with
  239:        the same uid (gid) are considered to be distinct.  If you wish to match
  240:        all user names with the same uid (e.g. root and toor), you can use a
  241:        uid instead (#0 in the example given).
  242: 
  243:         Host_List ::= Host |
  244:                       Host ',' Host_List
  245: 
  246:         Host ::= '!'* host name |
  247:                  '!'* ip_addr |
  248:                  '!'* network(/netmask)? |
  249:                  '!'* +netgroup |
  250:                  '!'* Host_Alias
  251: 
  252:        A Host_List is made up of one or more host names, IP addresses, network
  253:        numbers, netgroups (prefixed with '+') and other aliases.  Again, the
  254:        value of an item may be negated with the '!' operator.  If you do not
  255:        specify a netmask along with the network number, ssuuddoo will query each
  256:        of the local host's network interfaces and, if the network number
  257:        corresponds to one of the hosts's network interfaces, the corresponding
  258:        netmask will be used.  The netmask may be specified either in standard
  259:        IP address notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or
  260:        CIDR notation (number of bits, e.g. 24 or 64).  A host name may include
  261:        shell-style wildcards (see the Wildcards section below), but unless the
  262:        host name command on your machine returns the fully qualified host
  263:        name, you'll need to use the _f_q_d_n option for wildcards to be useful.
  264:        Note ssuuddoo only inspects actual network interfaces; this means that IP
  265:        address 127.0.0.1 (localhost) will never match.  Also, the host name
  266:        "localhost" will only match if that is the actual host name, which is
  267:        usually only the case for non-networked systems.
  268: 
  269:         Cmnd_List ::= Cmnd |
  270:                       Cmnd ',' Cmnd_List
  271: 
  272:         commandname ::= file name |
  273:                         file name args |
  274:                         file name '""'
  275: 
  276:         Cmnd ::= '!'* commandname |
  277:                  '!'* directory |
  278:                  '!'* "sudoedit" |
  279:                  '!'* Cmnd_Alias
  280: 
  281:        A Cmnd_List is a list of one or more commandnames, directories, and
  282:        other aliases.  A commandname is a fully qualified file name which may
  283:        include shell-style wildcards (see the Wildcards section below).  A
  284:        simple file name allows the user to run the command with any arguments
  285:        he/she wishes.  However, you may also specify command line arguments
  286:        (including wildcards).  Alternately, you can specify "" to indicate
  287:        that the command may only be run wwiitthhoouutt command line arguments.  A
  288:        directory is a fully qualified path name ending in a '/'.  When you
  289:        specify a directory in a Cmnd_List, the user will be able to run any
  290:        file within that directory (but not in any subdirectories therein).
  291: 
  292:        If a Cmnd has associated command line arguments, then the arguments in
  293:        the Cmnd must match exactly those given by the user on the command line
  294:        (or match the wildcards if there are any).  Note that the following
  295:        characters must be escaped with a '\' if they are used in command
  296:        arguments: ',', ':', '=', '\'.  The special command "sudoedit" is used
  297:        to permit a user to run ssuuddoo with the --ee option (or as ssuuddooeeddiitt).  It
  298:        may take command line arguments just as a normal command does.
  299: 
  300:    DDeeffaauullttss
  301:        Certain configuration options may be changed from their default values
  302:        at runtime via one or more Default_Entry lines.  These may affect all
  303:        users on any host, all users on a specific host, a specific user, a
  304:        specific command, or commands being run as a specific user.  Note that
  305:        per-command entries may not include command line arguments.  If you
  306:        need to specify arguments, define a Cmnd_Alias and reference that
  307:        instead.
  308: 
  309:         Default_Type ::= 'Defaults' |
  310:                          'Defaults' '@' Host_List |
  311:                          'Defaults' ':' User_List |
  312:                          'Defaults' '!' Cmnd_List |
  313:                          'Defaults' '>' Runas_List
  314: 
  315:         Default_Entry ::= Default_Type Parameter_List
  316: 
  317:         Parameter_List ::= Parameter |
  318:                            Parameter ',' Parameter_List
  319: 
  320:         Parameter ::= Parameter '=' Value |
  321:                       Parameter '+=' Value |
  322:                       Parameter '-=' Value |
  323:                       '!'* Parameter
  324: 
  325:        Parameters may be ffllaaggss, iinntteeggeerr values, ssttrriinnggss, or lliissttss.  Flags are
  326:        implicitly boolean and can be turned off via the '!'  operator.  Some
  327:        integer, string and list parameters may also be used in a boolean
  328:        context to disable them.  Values may be enclosed in double quotes (")
  329:        when they contain multiple words.  Special characters may be escaped
  330:        with a backslash (\).
  331: 
  332:        Lists have two additional assignment operators, += and -=.  These
  333:        operators are used to add to and delete from a list respectively.  It
  334:        is not an error to use the -= operator to remove an element that does
  335:        not exist in a list.
  336: 
  337:        Defaults entries are parsed in the following order: generic, host and
  338:        user Defaults first, then runas Defaults and finally command defaults.
  339: 
  340:        See "SUDOERS OPTIONS" for a list of supported Defaults parameters.
  341: 
  342:    UUsseerr SSppeecciiffiiccaattiioonn
  343:         User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
  344:                       (':' Host_List '=' Cmnd_Spec_List)*
  345: 
  346:         Cmnd_Spec_List ::= Cmnd_Spec |
  347:                            Cmnd_Spec ',' Cmnd_Spec_List
  348: 
  349:         Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Tag_Spec* Cmnd
  350: 
  351:         Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'
  352: 
  353:         SELinux_Spec ::= ('ROLE=role' | 'TYPE=type')
  354: 
  355:         Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
  356:                       'SETENV:' | 'NOSETENV:' | 'LOG_INPUT:' | 'NOLOG_INPUT:' |
  357:                       'LOG_OUTPUT:' | 'NOLOG_OUTPUT:')
  358: 
  359:        A uusseerr ssppeecciiffiiccaattiioonn determines which commands a user may run (and as
  360:        what user) on specified hosts.  By default, commands are run as rroooott,
  361:        but this can be changed on a per-command basis.
  362: 
  363:        The basic structure of a user specification is `who where = (as_whom)
  364:        what'.  Let's break that down into its constituent parts:
  365: 
  366:    RRuunnaass__SSppeecc
  367:        A Runas_Spec determines the user and/or the group that a command may be
  368:        run as.  A fully-specified Runas_Spec consists of two Runas_Lists (as
  369:        defined above) separated by a colon (':') and enclosed in a set of
  370:        parentheses.  The first Runas_List indicates which users the command
  371:        may be run as via ssuuddoo's --uu option.  The second defines a list of
  372:        groups that can be specified via ssuuddoo's --gg option.  If both Runas_Lists
  373:        are specified, the command may be run with any combination of users and
  374:        groups listed in their respective Runas_Lists.  If only the first is
  375:        specified, the command may be run as any user in the list but no --gg
  376:        option may be specified.  If the first Runas_List is empty but the
  377:        second is specified, the command may be run as the invoking user with
  378:        the group set to any listed in the Runas_List.  If no Runas_Spec is
  379:        specified the command may be run as rroooott and no group may be specified.
  380: 
  381:        A Runas_Spec sets the default for the commands that follow it.  What
  382:        this means is that for the entry:
  383: 
  384:         dgb    boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
  385: 
  386:        The user ddggbb may run _/_b_i_n_/_l_s, _/_b_i_n_/_k_i_l_l, and _/_u_s_r_/_b_i_n_/_l_p_r_m -- but only
  387:        as ooppeerraattoorr.  E.g.,
  388: 
  389:         $ sudo -u operator /bin/ls
  390: 
  391:        It is also possible to override a Runas_Spec later on in an entry.  If
  392:        we modify the entry like so:
  393: 
  394:         dgb    boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
  395: 
  396:        Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but  _/_b_i_n_/_k_i_l_l
  397:        and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
  398: 
  399:        We can extend this to allow ddggbb to run /bin/ls with either the user or
  400:        group set to ooppeerraattoorr:
  401: 
  402:         dgb    boulder = (operator : operator) /bin/ls, (root) /bin/kill, \
  403:                /usr/bin/lprm
  404: 
  405:        Note that while the group portion of the Runas_Spec permits the user to
  406:        run as command with that group, it does not force the user to do so.
  407:        If no group is specified on the command line, the command will run with
  408:        the group listed in the target user's password database entry.  The
  409:        following would all be permitted by the sudoers entry above:
  410: 
  411:         $ sudo -u operator /bin/ls
  412:         $ sudo -u operator -g operator /bin/ls
  413:         $ sudo -g operator /bin/ls
  414: 
  415:        In the following example, user ttccmm may run commands that access a modem
  416:        device file with the dialer group.
  417: 
  418:         tcm    boulder = (:dialer) /usr/bin/tip, /usr/bin/cu, \
  419:                /usr/local/bin/minicom
  420: 
  421:        Note that in this example only the group will be set, the command still
  422:        runs as user ttccmm.  E.g.
  423: 
  424:         $ sudo -g dialer /usr/bin/cu
  425: 
  426:        Multiple users and groups may be present in a Runas_Spec, in which case
  427:        the user may select any combination of users and groups via the --uu and
  428:        --gg options.  In this example:
  429: 
  430:         alan   ALL = (root, bin : operator, system) ALL
  431: 
  432:        user aallaann may run any command as either user root or bin, optionally
  433:        setting the group to operator or system.
  434: 
  435:    SSEELLiinnuuxx__SSppeecc
  436:        On systems with SELinux support, _s_u_d_o_e_r_s entries may optionally have an
  437:        SELinux role and/or type associated with a command.  If a role or type
  438:        is specified with the command it will override any default values
  439:        specified in _s_u_d_o_e_r_s.  A role or type specified on the command line,
  440:        however, will supercede the values in _s_u_d_o_e_r_s.
  441: 
  442:    TTaagg__SSppeecc
  443:        A command may have zero or more tags associated with it.  There are
  444:        eight possible tag values, NOPASSWD, PASSWD, NOEXEC, EXEC, SETENV,
  445:        NOSETENV, LOG_INPUT, NOLOG_INPUT, LOG_OUTPUT and NOLOG_OUTPUT.  Once a
  446:        tag is set on a Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit
  447:        the tag unless it is overridden by the opposite tag (i.e.: PASSWD
  448:        overrides NOPASSWD and NOEXEC overrides EXEC).
  449: 
  450:        _N_O_P_A_S_S_W_D _a_n_d _P_A_S_S_W_D
  451: 
  452:        By default, ssuuddoo requires that a user authenticate him or herself
  453:        before running a command.  This behavior can be modified via the
  454:        NOPASSWD tag.  Like a Runas_Spec, the NOPASSWD tag sets a default for
  455:        the commands that follow it in the Cmnd_Spec_List.  Conversely, the
  456:        PASSWD tag can be used to reverse things.  For example:
  457: 
  458:         ray    rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
  459: 
  460:        would allow the user rraayy to run _/_b_i_n_/_k_i_l_l, _/_b_i_n_/_l_s, and _/_u_s_r_/_b_i_n_/_l_p_r_m
  461:        as rroooott on the machine rushmore without authenticating himself.  If we
  462:        only want rraayy to be able to run _/_b_i_n_/_k_i_l_l without a password the entry
  463:        would be:
  464: 
  465:         ray    rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
  466: 
  467:        Note, however, that the PASSWD tag has no effect on users who are in
  468:        the group specified by the _e_x_e_m_p_t___g_r_o_u_p option.
  469: 
  470:        By default, if the NOPASSWD tag is applied to any of the entries for a
  471:        user on the current host, he or she will be able to run sudo -l without
  472:        a password.  Additionally, a user may only run sudo -v without a
  473:        password if the NOPASSWD tag is present for all a user's entries that
  474:        pertain to the current host.  This behavior may be overridden via the
  475:        verifypw and listpw options.
  476: 
  477:        _N_O_E_X_E_C _a_n_d _E_X_E_C
  478: 
  479:        If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying
  480:        operating system supports it, the NOEXEC tag can be used to prevent a
  481:        dynamically-linked executable from running further commands itself.
  482: 
  483:        In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e and
  484:        _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled.
  485: 
  486:         aaron  shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
  487: 
  488:        See the "Preventing Shell Escapes" section below for more details on
  489:        how NOEXEC works and whether or not it will work on your system.
  490: 
  491:        _S_E_T_E_N_V _a_n_d _N_O_S_E_T_E_N_V
  492: 
  493:        These tags override the value of the _s_e_t_e_n_v option on a per-command
  494:        basis.  Note that if SETENV has been set for a command, the user may
  495:        disable the _e_n_v___r_e_s_e_t option from the command line via the --EE option.
  496:        Additionally, environment variables set on the command line are not
  497:        subject to the restrictions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or
  498:        _e_n_v___k_e_e_p.  As such, only trusted users should be allowed to set
  499:        variables in this manner.  If the command matched is AALLLL, the SETENV
  500:        tag is implied for that command; this default may be overridden by use
  501:        of the NOSETENV tag.
  502: 
  503:        _L_O_G___I_N_P_U_T _a_n_d _N_O_L_O_G___I_N_P_U_T
  504: 
  505:        These tags override the value of the _l_o_g___i_n_p_u_t option on a per-command
  506:        basis.  For more information, see the description of _l_o_g___i_n_p_u_t in the
  507:        "SUDOERS OPTIONS" section below.
  508: 
  509:        _L_O_G___O_U_T_P_U_T _a_n_d _N_O_L_O_G___O_U_T_P_U_T
  510: 
  511:        These tags override the value of the _l_o_g___o_u_t_p_u_t option on a per-command
  512:        basis.  For more information, see the description of _l_o_g___o_u_t_p_u_t in the
  513:        "SUDOERS OPTIONS" section below.
  514: 
  515:    WWiillddccaarrddss
  516:        ssuuddoo allows shell-style _w_i_l_d_c_a_r_d_s (aka meta or glob characters) to be
  517:        used in host names, path names and command line arguments in the
  518:        _s_u_d_o_e_r_s file.  Wildcard matching is done via the PPOOSSIIXX _g_l_o_b(3) and
  519:        _f_n_m_a_t_c_h(3) routines.  Note that these are _n_o_t regular expressions.
  520: 
  521:        *       Matches any set of zero or more characters.
  522: 
  523:        ?       Matches any single character.
  524: 
  525:        [...]   Matches any character in the specified range.
  526: 
  527:        [!...]  Matches any character nnoott in the specified range.
  528: 
  529:        \x      For any character "x", evaluates to "x".  This is used to
  530:                escape special characters such as: "*", "?", "[", and "}".
  531: 
  532:        POSIX character classes may also be used if your system's _g_l_o_b(3) and
  533:        _f_n_m_a_t_c_h(3) functions support them.  However, because the ':' character
  534:        has special meaning in _s_u_d_o_e_r_s, it must be escaped.  For example:
  535: 
  536:            /bin/ls [[\:alpha\:]]*
  537: 
  538:        Would match any file name beginning with a letter.
  539: 
  540:        Note that a forward slash ('/') will nnoott be matched by wildcards used
  541:        in the path name.  When matching the command line arguments, however, a
  542:        slash ddooeess get matched by wildcards.  This is to make a path like:
  543: 
  544:            /usr/bin/*
  545: 
  546:        match _/_u_s_r_/_b_i_n_/_w_h_o but not _/_u_s_r_/_b_i_n_/_X_1_1_/_x_t_e_r_m.
  547: 
  548:    EExxcceeppttiioonnss ttoo wwiillddccaarrdd rruulleess
  549:        The following exceptions apply to the above rules:
  550: 
  551:        ""      If the empty string "" is the only command line argument in the
  552:                _s_u_d_o_e_r_s entry it means that command is not allowed to be run
  553:                with aannyy arguments.
  554: 
  555:    IInncclluuddiinngg ootthheerr ffiilleess ffrroomm wwiitthhiinn ssuuddooeerrss
  556:        It is possible to include other _s_u_d_o_e_r_s files from within the _s_u_d_o_e_r_s
  557:        file currently being parsed using the #include and #includedir
  558:        directives.
  559: 
  560:        This can be used, for example, to keep a site-wide _s_u_d_o_e_r_s file in
  561:        addition to a local, per-machine file.  For the sake of this example
  562:        the site-wide _s_u_d_o_e_r_s will be _/_e_t_c_/_s_u_d_o_e_r_s and the per-machine one will
  563:        be _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l.  To include _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l from within
  564:        _/_e_t_c_/_s_u_d_o_e_r_s we would use the following line in _/_e_t_c_/_s_u_d_o_e_r_s:
  565: 
  566:            #include /etc/sudoers.local
  567: 
  568:        When ssuuddoo reaches this line it will suspend processing of the current
  569:        file (_/_e_t_c_/_s_u_d_o_e_r_s) and switch to _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l.  Upon reaching
  570:        the end of _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l, the rest of _/_e_t_c_/_s_u_d_o_e_r_s will be
  571:        processed.  Files that are included may themselves include other files.
  572:        A hard limit of 128 nested include files is enforced to prevent include
  573:        file loops.
  574: 
  575:        If the path to the include file is not fully-qualified (does not begin
  576:        with a _/), it must be located in the same directory as the sudoers file
  577:        it was included from.  For example, if _/_e_t_c_/_s_u_d_o_e_r_s contains the line:
  578: 
  579:            #include sudoers.local
  580: 
  581:        the file that will be included is _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l.
  582: 
  583:        The file name may also include the %h escape, signifying the short form
  584:        of the host name.  I.e., if the machine's host name is "xerxes", then
  585: 
  586:        #include /etc/sudoers.%h
  587: 
  588:        will cause ssuuddoo to include the file _/_e_t_c_/_s_u_d_o_e_r_s_._x_e_r_x_e_s.
  589: 
  590:        The #includedir directive can be used to create a _s_u_d_o_._d directory that
  591:        the system package manager can drop _s_u_d_o_e_r_s rules into as part of
  592:        package installation.  For example, given:
  593: 
  594:        #includedir /etc/sudoers.d
  595: 
  596:        ssuuddoo will read each file in _/_e_t_c_/_s_u_d_o_e_r_s_._d, skipping file names that
  597:        end in ~ or contain a . character to avoid causing problems with
  598:        package manager or editor temporary/backup files.  Files are parsed in
  599:        sorted lexical order.  That is, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_0_1___f_i_r_s_t will be parsed
  600:        before _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d.  Be aware that because the sorting is
  601:        lexical, not numeric, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1___w_h_o_o_p_s would be loaded aafftteerr
  602:        _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d.  Using a consistent number of leading zeroes
  603:        in the file names can be used to avoid such problems.
  604: 
  605:        Note that unlike files included via #include, vviissuuddoo will not edit the
  606:        files in a #includedir directory unless one of them contains a syntax
  607:        error.  It is still possible to run vviissuuddoo with the -f flag to edit the
  608:        files directly.
  609: 
  610:    OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss
  611:        The pound sign ('#') is used to indicate a comment (unless it is part
  612:        of a #include directive or unless it occurs in the context of a user
  613:        name and is followed by one or more digits, in which case it is treated
  614:        as a uid).  Both the comment character and any text after it, up to the
  615:        end of the line, are ignored.
  616: 
  617:        The reserved word AALLLL is a built-in _a_l_i_a_s that always causes a match to
  618:        succeed.  It can be used wherever one might otherwise use a Cmnd_Alias,
  619:        User_Alias, Runas_Alias, or Host_Alias.  You should not try to define
  620:        your own _a_l_i_a_s called AALLLL as the built-in alias will be used in
  621:        preference to your own.  Please note that using AALLLL can be dangerous
  622:        since in a command context, it allows the user to run aannyy command on
  623:        the system.
  624: 
  625:        An exclamation point ('!') can be used as a logical _n_o_t operator both
  626:        in an _a_l_i_a_s and in front of a Cmnd.  This allows one to exclude certain
  627:        values.  Note, however, that using a ! in conjunction with the built-in
  628:        ALL alias to allow a user to run "all but a few" commands rarely works
  629:        as intended (see SECURITY NOTES below).
  630: 
  631:        Long lines can be continued with a backslash ('\') as the last
  632:        character on the line.
  633: 
  634:        Whitespace between elements in a list as well as special syntactic
  635:        characters in a _U_s_e_r _S_p_e_c_i_f_i_c_a_t_i_o_n ('=', ':', '(', ')') is optional.
  636: 
  637:        The following characters must be escaped with a backslash ('\') when
  638:        used as part of a word (e.g. a user name or host name): '!', '=', ':',
  639:        ',', '(', ')', '\'.
  640: 
  641: SSUUDDOOEERRSS OOPPTTIIOONNSS
  642:        ssuuddoo's behavior can be modified by Default_Entry lines, as explained
  643:        earlier.  A list of all supported Defaults parameters, grouped by type,
  644:        are listed below.
  645: 
  646:        BBoooolleeaann FFllaaggss:
  647: 
  648:        always_set_home If enabled, ssuuddoo will set the HOME environment variable
  649:                        to the home directory of the target user (which is root
  650:                        unless the --uu option is used).  This effectively means
  651:                        that the --HH option is always implied.  Note that HOME
  652:                        is already set when the the _e_n_v___r_e_s_e_t option is
  653:                        enabled, so _a_l_w_a_y_s___s_e_t___h_o_m_e is only effective for
  654:                        configurations where either _e_n_v___r_e_s_e_t is disabled or
  655:                        HOME is present in the _e_n_v___k_e_e_p list.  This flag is _o_f_f
  656:                        by default.
  657: 
  658:        authenticate    If set, users must authenticate themselves via a
  659:                        password (or other means of authentication) before they
  660:                        may run commands.  This default may be overridden via
  661:                        the PASSWD and NOPASSWD tags.  This flag is _o_n by
  662:                        default.
  663: 
  664:        closefrom_override
  665:                        If set, the user may use ssuuddoo's --CC option which
  666:                        overrides the default starting point at which ssuuddoo
  667:                        begins closing open file descriptors.  This flag is _o_f_f
  668:                        by default.
  669: 
  670:        compress_io     If set, and ssuuddoo is configured to log a command's input
  671:                        or output, the I/O logs will be compressed using zzlliibb.
  672:                        This flag is _o_n by default when ssuuddoo is compiled with
  673:                        zzlliibb support.
  674: 
  675:        env_editor      If set, vviissuuddoo will use the value of the EDITOR or
  676:                        VISUAL environment variables before falling back on the
  677:                        default editor list.  Note that this may create a
  678:                        security hole as it allows the user to run any
  679:                        arbitrary command as root without logging.  A safer
  680:                        alternative is to place a colon-separated list of
  681:                        editors in the editor variable.  vviissuuddoo will then only
  682:                        use the EDITOR or VISUAL if they match a value
  683:                        specified in editor.  This flag is _o_f_f by default.
  684: 
  685:        env_reset       If set, ssuuddoo will run the command in a minimal
  686:                        environment containing the TERM, PATH, HOME, MAIL,
  687:                        SHELL, LOGNAME, USER, USERNAME and SUDO_* variables.
  688:                        Any variables in the caller's environment that match
  689:                        the env_keep and env_check lists are then added,
  690:                        followed by any variables present in the file specified
  691:                        by the _e_n_v___f_i_l_e option (if any).  The default contents
  692:                        of the env_keep and env_check lists are displayed when
  693:                        ssuuddoo is run by root with the _-_V option.  If the
  694:                        _s_e_c_u_r_e___p_a_t_h option is set, its value will be used for
  695:                        the PATH environment variable.  This flag is _o_n by
  696:                        default.
  697: 
  698:        fast_glob       Normally, ssuuddoo uses the _g_l_o_b(3) function to do shell-
  699:                        style globbing when matching path names.  However,
  700:                        since it accesses the file system, _g_l_o_b(3) can take a
  701:                        long time to complete for some patterns, especially
  702:                        when the pattern references a network file system that
  703:                        is mounted on demand (automounted).  The _f_a_s_t___g_l_o_b
  704:                        option causes ssuuddoo to use the _f_n_m_a_t_c_h(3) function,
  705:                        which does not access the file system to do its
  706:                        matching.  The disadvantage of _f_a_s_t___g_l_o_b is that it is
  707:                        unable to match relative path names such as _._/_l_s or
  708:                        _._._/_b_i_n_/_l_s.  This has security implications when path
  709:                        names that include globbing characters are used with
  710:                        the negation operator, '!', as such rules can be
  711:                        trivially bypassed.  As such, this option should not be
  712:                        used when _s_u_d_o_e_r_s contains rules that contain negated
  713:                        path names which include globbing characters.  This
  714:                        flag is _o_f_f by default.
  715: 
  716:        fqdn            Set this flag if you want to put fully qualified host
  717:                        names in the _s_u_d_o_e_r_s file.  I.e., instead of myhost you
  718:                        would use myhost.mydomain.edu.  You may still use the
  719:                        short form if you wish (and even mix the two).  Beware
  720:                        that turning on _f_q_d_n requires ssuuddoo to make DNS lookups
  721:                        which may make ssuuddoo unusable if DNS stops working (for
  722:                        example if the machine is not plugged into the
  723:                        network).  Also note that you must use the host's
  724:                        official name as DNS knows it.  That is, you may not
  725:                        use a host alias (CNAME entry) due to performance
  726:                        issues and the fact that there is no way to get all
  727:                        aliases from DNS.  If your machine's host name (as
  728:                        returned by the hostname command) is already fully
  729:                        qualified you shouldn't need to set _f_q_d_n.  This flag is
  730:                        _o_f_f by default.
  731: 
  732:        ignore_dot      If set, ssuuddoo will ignore '.' or '' (current dir) in the
  733:                        PATH environment variable; the PATH itself is not
  734:                        modified.  This flag is _o_f_f by default.
  735: 
  736:        ignore_local_sudoers
  737:                        If set via LDAP, parsing of _/_e_t_c_/_s_u_d_o_e_r_s will be
  738:                        skipped.  This is intended for Enterprises that wish to
  739:                        prevent the usage of local sudoers files so that only
  740:                        LDAP is used.  This thwarts the efforts of rogue
  741:                        operators who would attempt to add roles to
  742:                        _/_e_t_c_/_s_u_d_o_e_r_s.  When this option is present,
  743:                        _/_e_t_c_/_s_u_d_o_e_r_s does not even need to exist. Since this
  744:                        option tells ssuuddoo how to behave when no specific LDAP
  745:                        entries have been matched, this sudoOption is only
  746:                        meaningful for the cn=defaults section.  This flag is
  747:                        _o_f_f by default.
  748: 
  749:        insults         If set, ssuuddoo will insult users when they enter an
  750:                        incorrect password.  This flag is _o_f_f by default.
  751: 
  752:        log_host        If set, the host name will be logged in the (non-
  753:                        syslog) ssuuddoo log file.  This flag is _o_f_f by default.
  754: 
  755:        log_input       If set, ssuuddoo will run the command in a _p_s_e_u_d_o _t_t_y and
  756:                        log all user input.  If the standard input is not
  757:                        connected to the user's tty, due to I/O redirection or
  758:                        because the command is part of a pipeline, that input
  759:                        is also captured and stored in a separate log file.
  760: 
  761:                        Input is logged to the directory specified by the
  762:                        _i_o_l_o_g___d_i_r option (_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o by default) using a
  763:                        unique session ID that is included in the normal ssuuddoo
  764:                        log line, prefixed with _T_S_I_D_=.  The _i_o_l_o_g___f_i_l_e option
  765:                        may be used to control the format of the session ID.
  766: 
  767:                        Note that user input may contain sensitive information
  768:                        such as passwords (even if they are not echoed to the
  769:                        screen), which will be stored in the log file
  770:                        unencrypted.  In most cases, logging the command output
  771:                        via _l_o_g___o_u_t_p_u_t is all that is required.
  772: 
  773:        log_output      If set, ssuuddoo will run the command in a _p_s_e_u_d_o _t_t_y and
  774:                        log all output that is sent to the screen, similar to
  775:                        the _s_c_r_i_p_t(1) command.  If the standard output or
  776:                        standard error is not connected to the user's tty, due
  777:                        to I/O redirection or because the command is part of a
  778:                        pipeline, that output is also captured and stored in
  779:                        separate log files.
  780: 
  781:                        Output is logged to the directory specified by the
  782:                        _i_o_l_o_g___d_i_r option (_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o by default) using a
  783:                        unique session ID that is included in the normal ssuuddoo
  784:                        log line, prefixed with _T_S_I_D_=.  The _i_o_l_o_g___f_i_l_e option
  785:                        may be used to control the format of the session ID.
  786: 
  787:                        Output logs may be viewed with the _s_u_d_o_r_e_p_l_a_y(1m)
  788:                        utility, which can also be used to list or search the
  789:                        available logs.
  790: 
  791:        log_year        If set, the four-digit year will be logged in the (non-
  792:                        syslog) ssuuddoo log file.  This flag is _o_f_f by default.
  793: 
  794:        long_otp_prompt When validating with a One Time Password (OTP) scheme
  795:                        such as SS//KKeeyy or OOPPIIEE, a two-line prompt is used to
  796:                        make it easier to cut and paste the challenge to a
  797:                        local window.  It's not as pretty as the default but
  798:                        some people find it more convenient.  This flag is _o_f_f
  799:                        by default.
  800: 
  801:        mail_always     Send mail to the _m_a_i_l_t_o user every time a users runs
  802:                        ssuuddoo.  This flag is _o_f_f by default.
  803: 
  804:        mail_badpass    Send mail to the _m_a_i_l_t_o user if the user running ssuuddoo
  805:                        does not enter the correct password.  This flag is _o_f_f
  806:                        by default.
  807: 
  808:        mail_no_host    If set, mail will be sent to the _m_a_i_l_t_o user if the
  809:                        invoking user exists in the _s_u_d_o_e_r_s file, but is not
  810:                        allowed to run commands on the current host.  This flag
  811:                        is _o_f_f by default.
  812: 
  813:        mail_no_perms   If set, mail will be sent to the _m_a_i_l_t_o user if the
  814:                        invoking user is allowed to use ssuuddoo but the command
  815:                        they are trying is not listed in their _s_u_d_o_e_r_s file
  816:                        entry or is explicitly denied.  This flag is _o_f_f by
  817:                        default.
  818: 
  819:        mail_no_user    If set, mail will be sent to the _m_a_i_l_t_o user if the
  820:                        invoking user is not in the _s_u_d_o_e_r_s file.  This flag is
  821:                        _o_n by default.
  822: 
  823:        noexec          If set, all commands run via ssuuddoo will behave as if the
  824:                        NOEXEC tag has been set, unless overridden by a EXEC
  825:                        tag.  See the description of _N_O_E_X_E_C _a_n_d _E_X_E_C below as
  826:                        well as the "Preventing Shell Escapes" section at the
  827:                        end of this manual.  This flag is _o_f_f by default.
  828: 
  829:        path_info       Normally, ssuuddoo will tell the user when a command could
  830:                        not be found in their PATH environment variable.  Some
  831:                        sites may wish to disable this as it could be used to
  832:                        gather information on the location of executables that
  833:                        the normal user does not have access to.  The
  834:                        disadvantage is that if the executable is simply not in
  835:                        the user's PATH, ssuuddoo will tell the user that they are
  836:                        not allowed to run it, which can be confusing.  This
  837:                        flag is _o_n by default.
  838: 
  839:        passprompt_override
  840:                        The password prompt specified by _p_a_s_s_p_r_o_m_p_t will
  841:                        normally only be used if the password prompt provided
  842:                        by systems such as PAM matches the string "Password:".
  843:                        If _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e is set, _p_a_s_s_p_r_o_m_p_t will always
  844:                        be used.  This flag is _o_f_f by default.
  845: 
  846:        preserve_groups By default, ssuuddoo will initialize the group vector to
  847:                        the list of groups the target user is in.  When
  848:                        _p_r_e_s_e_r_v_e___g_r_o_u_p_s is set, the user's existing group
  849:                        vector is left unaltered.  The real and effective group
  850:                        IDs, however, are still set to match the target user.
  851:                        This flag is _o_f_f by default.
  852: 
  853:        pwfeedback      By default, ssuuddoo reads the password like most other
  854:                        Unix programs, by turning off echo until the user hits
  855:                        the return (or enter) key.  Some users become confused
  856:                        by this as it appears to them that ssuuddoo has hung at
  857:                        this point.  When _p_w_f_e_e_d_b_a_c_k is set, ssuuddoo will provide
  858:                        visual feedback when the user presses a key.  Note that
  859:                        this does have a security impact as an onlooker may be
  860:                        able to determine the length of the password being
  861:                        entered.  This flag is _o_f_f by default.
  862: 
  863:        requiretty      If set, ssuuddoo will only run when the user is logged in
  864:                        to a real tty.  When this flag is set, ssuuddoo can only be
  865:                        run from a login session and not via other means such
  866:                        as _c_r_o_n(1m) or cgi-bin scripts.  This flag is _o_f_f by
  867:                        default.
  868: 
  869:        root_sudo       If set, root is allowed to run ssuuddoo too.  Disabling
  870:                        this prevents users from "chaining" ssuuddoo commands to
  871:                        get a root shell by doing something like "sudo sudo
  872:                        /bin/sh".  Note, however, that turning off _r_o_o_t___s_u_d_o
  873:                        will also prevent root from running ssuuddooeeddiitt.
  874:                        Disabling _r_o_o_t___s_u_d_o provides no real additional
  875:                        security; it exists purely for historical reasons.
  876:                        This flag is _o_n by default.
  877: 
  878:        rootpw          If set, ssuuddoo will prompt for the root password instead
  879:                        of the password of the invoking user.  This flag is _o_f_f
  880:                        by default.
  881: 
  882:        runaspw         If set, ssuuddoo will prompt for the password of the user
  883:                        defined by the _r_u_n_a_s___d_e_f_a_u_l_t option (defaults to root)
  884:                        instead of the password of the invoking user.  This
  885:                        flag is _o_f_f by default.
  886: 
  887:        set_home        If enabled and ssuuddoo is invoked with the --ss option the
  888:                        HOME environment variable will be set to the home
  889:                        directory of the target user (which is root unless the
  890:                        --uu option is used).  This effectively makes the --ss
  891:                        option imply --HH.  Note that HOME is already set when
  892:                        the the _e_n_v___r_e_s_e_t option is enabled, so _s_e_t___h_o_m_e is
  893:                        only effective for configurations where either
  894:                        _e_n_v___r_e_s_e_t is disabled or HOME is present in the
  895:                        _e_n_v___k_e_e_p list.  This flag is _o_f_f by default.
  896: 
  897:        set_logname     Normally, ssuuddoo will set the LOGNAME, USER and USERNAME
  898:                        environment variables to the name of the target user
  899:                        (usually root unless the --uu option is given).  However,
  900:                        since some programs (including the RCS revision control
  901:                        system) use LOGNAME to determine the real identity of
  902:                        the user, it may be desirable to change this behavior.
  903:                        This can be done by negating the set_logname option.
  904:                        Note that if the _e_n_v___r_e_s_e_t option has not been
  905:                        disabled, entries in the _e_n_v___k_e_e_p list will override
  906:                        the value of _s_e_t___l_o_g_n_a_m_e.  This flag is _o_n by default.
  907: 
  908:        set_utmp        When enabled, ssuuddoo will create an entry in the utmp (or
  909:                        utmpx) file when a pseudo-tty is allocated.  A pseudo-
  910:                        tty is allocated by ssuuddoo when the _l_o_g___i_n_p_u_t, _l_o_g___o_u_t_p_u_t
  911:                        or _u_s_e___p_t_y flags are enabled.  By default, the new
  912:                        entry will be a copy of the user's existing utmp entry
  913:                        (if any), with the tty, time, type and pid fields
  914:                        updated.  This flag is _o_n by default.
  915: 
  916:        setenv          Allow the user to disable the _e_n_v___r_e_s_e_t option from the
  917:                        command line via the --EE option.  Additionally,
  918:                        environment variables set via the command line are not
  919:                        subject to the restrictions imposed by _e_n_v___c_h_e_c_k,
  920:                        _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p.  As such, only trusted users
  921:                        should be allowed to set variables in this manner.
  922:                        This flag is _o_f_f by default.
  923: 
  924:        shell_noargs    If set and ssuuddoo is invoked with no arguments it acts as
  925:                        if the --ss option had been given.  That is, it runs a
  926:                        shell as root (the shell is determined by the SHELL
  927:                        environment variable if it is set, falling back on the
  928:                        shell listed in the invoking user's /etc/passwd entry
  929:                        if not).  This flag is _o_f_f by default.
  930: 
  931:        stay_setuid     Normally, when ssuuddoo executes a command the real and
  932:                        effective UIDs are set to the target user (root by
  933:                        default).  This option changes that behavior such that
  934:                        the real UID is left as the invoking user's UID.  In
  935:                        other words, this makes ssuuddoo act as a setuid wrapper.
  936:                        This can be useful on systems that disable some
  937:                        potentially dangerous functionality when a program is
  938:                        run setuid.  This option is only effective on systems
  939:                        with either the _s_e_t_r_e_u_i_d_(_) or _s_e_t_r_e_s_u_i_d_(_) function.
  940:                        This flag is _o_f_f by default.
  941: 
  942:        targetpw        If set, ssuuddoo will prompt for the password of the user
  943:                        specified by the --uu option (defaults to root) instead
  944:                        of the password of the invoking user.  In addition, the
  945:                        timestamp file name will include the target user's
  946:                        name.  Note that this flag precludes the use of a uid
  947:                        not listed in the passwd database as an argument to the
  948:                        --uu option.  This flag is _o_f_f by default.
  949: 
  950:        tty_tickets     If set, users must authenticate on a per-tty basis.
  951:                        With this flag enabled, ssuuddoo will use a file named for
  952:                        the tty the user is logged in on in the user's time
  953:                        stamp directory.  If disabled, the time stamp of the
  954:                        directory is used instead.  This flag is _o_n by default.
  955: 
  956:        umask_override  If set, ssuuddoo will set the umask as specified by _s_u_d_o_e_r_s
  957:                        without modification.  This makes it possible to
  958:                        specify a more permissive umask in _s_u_d_o_e_r_s than the
  959:                        user's own umask and matches historical behavior.  If
  960:                        _u_m_a_s_k___o_v_e_r_r_i_d_e is not set, ssuuddoo will set the umask to
  961:                        be the union of the user's umask and what is specified
  962:                        in _s_u_d_o_e_r_s.  This flag is _o_f_f by default.
  963: 
  964:        use_loginclass  If set, ssuuddoo will apply the defaults specified for the
  965:                        target user's login class if one exists.  Only
  966:                        available if ssuuddoo is configured with the
  967:                        --with-logincap option.  This flag is _o_f_f by default.
  968: 
  969:        use_pty         If set, ssuuddoo will run the command in a pseudo-pty even
  970:                        if no I/O logging is being gone.  A malicious program
  971:                        run under ssuuddoo could conceivably fork a background
  972:                        process that retains to the user's terminal device
  973:                        after the main program has finished executing.  Use of
  974:                        this option will make that impossible.  This flag is
  975:                        _o_f_f by default.
  976: 
  977:        utmp_runas      If set, ssuuddoo will store the name of the runas user when
  978:                        updating the utmp (or utmpx) file.  By default, ssuuddoo
  979:                        stores the name of the invoking user.  This flag is _o_f_f
  980:                        by default.
  981: 
  982:        visiblepw       By default, ssuuddoo will refuse to run if the user must
  983:                        enter a password but it is not possible to disable echo
  984:                        on the terminal.  If the _v_i_s_i_b_l_e_p_w flag is set, ssuuddoo
  985:                        will prompt for a password even when it would be
  986:                        visible on the screen.  This makes it possible to run
  987:                        things like "rsh somehost sudo ls" since _r_s_h(1) does
  988:                        not allocate a tty.  This flag is _o_f_f by default.
  989: 
  990:        IInntteeggeerrss:
  991: 
  992:        closefrom       Before it executes a command, ssuuddoo will close all open
  993:                        file descriptors other than standard input, standard
  994:                        output and standard error (ie: file descriptors 0-2).
  995:                        The _c_l_o_s_e_f_r_o_m option can be used to specify a different
  996:                        file descriptor at which to start closing.  The default
  997:                        is 3.
  998: 
  999:        passwd_tries    The number of tries a user gets to enter his/her
 1000:                        password before ssuuddoo logs the failure and exits.  The
 1001:                        default is 3.
 1002: 
 1003:        IInntteeggeerrss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 1004: 
 1005:        loglinelen      Number of characters per line for the file log.  This
 1006:                        value is used to decide when to wrap lines for nicer
 1007:                        log files.  This has no effect on the syslog log file,
 1008:                        only the file log.  The default is 80 (use 0 or negate
 1009:                        the option to disable word wrap).
 1010: 
 1011:        passwd_timeout  Number of minutes before the ssuuddoo password prompt times
 1012:                        out, or 0 for no timeout.  The timeout may include a
 1013:                        fractional component if minute granularity is
 1014:                        insufficient, for example 2.5.  The default is 5.
 1015: 
 1016:        timestamp_timeout
 1017:                        Number of minutes that can elapse before ssuuddoo will ask
 1018:                        for a passwd again.  The timeout may include a
 1019:                        fractional component if minute granularity is
 1020:                        insufficient, for example 2.5.  The default is 5.  Set
 1021:                        this to 0 to always prompt for a password.  If set to a
 1022:                        value less than 0 the user's timestamp will never
 1023:                        expire.  This can be used to allow users to create or
 1024:                        delete their own timestamps via sudo -v and sudo -k
 1025:                        respectively.
 1026: 
 1027:        umask           Umask to use when running the command.  Negate this
 1028:                        option or set it to 0777 to preserve the user's umask.
 1029:                        The actual umask that is used will be the union of the
 1030:                        user's umask and the value of the _u_m_a_s_k option, which
 1031:                        defaults to 0022.  This guarantees that ssuuddoo never
 1032:                        lowers the umask when running a command.  Note on
 1033:                        systems that use PAM, the default PAM configuration may
 1034:                        specify its own umask which will override the value set
 1035:                        in _s_u_d_o_e_r_s.
 1036: 
 1037:        SSttrriinnggss:
 1038: 
 1039:        badpass_message Message that is displayed if a user enters an incorrect
 1040:                        password.  The default is Sorry, try again. unless
 1041:                        insults are enabled.
 1042: 
 1043:        editor          A colon (':') separated list of editors allowed to be
 1044:                        used with vviissuuddoo.  vviissuuddoo will choose the editor that
 1045:                        matches the user's EDITOR environment variable if
 1046:                        possible, or the first editor in the list that exists
 1047:                        and is executable.  The default is "vi".
 1048: 
 1049:        iolog_dir       The top-level directory to use when constructing the
 1050:                        path name for the input/output log directory.  Only
 1051:                        used if the _l_o_g___i_n_p_u_t or _l_o_g___o_u_t_p_u_t options are enabled
 1052:                        or when the LOG_INPUT or LOG_OUTPUT tags are present
 1053:                        for a command.  The session sequence number, if any, is
 1054:                        stored in the directory.  The default is
 1055:                        "/var/log/sudo-io".
 1056: 
 1057:                        The following percent (`%') escape sequences are
 1058:                        supported:
 1059: 
 1060:                        %{seq}
 1061:                            expanded to a monotonically increasing base-36
 1062:                            sequence number, such as 0100A5, where every two
 1063:                            digits are used to form a new directory, e.g.
 1064:                            _0_1_/_0_0_/_A_5
 1065: 
 1066:                        %{user}
 1067:                            expanded to the invoking user's login name
 1068: 
 1069:                        %{group}
 1070:                            expanded to the name of the invoking user's real
 1071:                            group ID
 1072: 
 1073:                        %{runas_user}
 1074:                            expanded to the login name of the user the command
 1075:                            will be run as (e.g. root)
 1076: 
 1077:                        %{runas_group}
 1078:                            expanded to the group name of the user the command
 1079:                            will be run as (e.g. wheel)
 1080: 
 1081:                        %{hostname}
 1082:                            expanded to the local host name without the domain
 1083:                            name
 1084: 
 1085:                        %{command}
 1086:                            expanded to the base name of the command being run
 1087: 
 1088:                        In addition, any escape sequences supported by the
 1089:                        system's _s_t_r_f_t_i_m_e_(_) function will be expanded.
 1090: 
 1091:                        To include a literal `%' character, the string `%%'
 1092:                        should be used.
 1093: 
 1094:        iolog_file      The path name, relative to _i_o_l_o_g___d_i_r, in which to store
 1095:                        input/output logs when the _l_o_g___i_n_p_u_t or _l_o_g___o_u_t_p_u_t
 1096:                        options are enabled or when the LOG_INPUT or LOG_OUTPUT
 1097:                        tags are present for a command.  Note that _i_o_l_o_g___f_i_l_e
 1098:                        may contain directory components.  The default is
 1099:                        "%{seq}".
 1100: 
 1101:                        See the _i_o_l_o_g___d_i_r option above for a list of supported
 1102:                        percent (`%') escape sequences.
 1103: 
 1104:                        In addition to the escape sequences, path names that
 1105:                        end in six or more Xs will have the Xs replaced with a
 1106:                        unique combination of digits and letters, similar to
 1107:                        the _m_k_t_e_m_p_(_) function.
 1108: 
 1109:        mailsub         Subject of the mail sent to the _m_a_i_l_t_o user. The escape
 1110:                        %h will expand to the host name of the machine.
 1111:                        Default is *** SECURITY information for %h ***.
 1112: 
 1113:        noexec_file     This option is no longer supported.  The path to the
 1114:                        noexec file should now be set in the _/_e_t_c_/_s_u_d_o_._c_o_n_f
 1115:                        file.
 1116: 
 1117:        passprompt      The default prompt to use when asking for a password;
 1118:                        can be overridden via the --pp option or the SUDO_PROMPT
 1119:                        environment variable.  The following percent (`%')
 1120:                        escape sequences are supported:
 1121: 
 1122:                        %H  expanded to the local host name including the
 1123:                            domain name (only if the machine's host name is
 1124:                            fully qualified or the _f_q_d_n option is set)
 1125: 
 1126:                        %h  expanded to the local host name without the domain
 1127:                            name
 1128: 
 1129:                        %p  expanded to the user whose password is being asked
 1130:                            for (respects the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and _r_u_n_a_s_p_w
 1131:                            flags in _s_u_d_o_e_r_s)
 1132: 
 1133:                        %U  expanded to the login name of the user the command
 1134:                            will be run as (defaults to root)
 1135: 
 1136:                        %u  expanded to the invoking user's login name
 1137: 
 1138:                        %%  two consecutive % characters are collapsed into a
 1139:                            single % character
 1140: 
 1141:                        The default value is Password:.
 1142: 
 1143:        role            The default SELinux role to use when constructing a new
 1144:                        security context to run the command.  The default role
 1145:                        may be overridden on a per-command basis in _s_u_d_o_e_r_s or
 1146:                        via command line options.  This option is only
 1147:                        available whe ssuuddoo is built with SELinux support.
 1148: 
 1149:        runas_default   The default user to run commands as if the --uu option is
 1150:                        not specified on the command line.  This defaults to
 1151:                        root.
 1152: 
 1153:        syslog_badpri   Syslog priority to use when user authenticates
 1154:                        unsuccessfully.  Defaults to alert.
 1155: 
 1156:                        The following syslog priorities are supported: aalleerrtt,
 1157:                        ccrriitt, ddeebbuugg, eemmeerrgg, eerrrr, iinnffoo, nnoottiiccee, and wwaarrnniinngg.
 1158: 
 1159:        syslog_goodpri  Syslog priority to use when user authenticates
 1160:                        successfully.  Defaults to notice.
 1161: 
 1162:                        See syslog_badpri for the list of supported syslog
 1163:                        priorities.
 1164: 
 1165:        sudoers_locale  Locale to use when parsing the sudoers file, logging
 1166:                        commands, and sending email.  Note that changing the
 1167:                        locale may affect how sudoers is interpreted.  Defaults
 1168:                        to "C".
 1169: 
 1170:        timestampdir    The directory in which ssuuddoo stores its timestamp files.
 1171:                        The default is _/_v_a_r_/_a_d_m_/_s_u_d_o.
 1172: 
 1173:        timestampowner  The owner of the timestamp directory and the timestamps
 1174:                        stored therein.  The default is root.
 1175: 
 1176:        type            The default SELinux type to use when constructing a new
 1177:                        security context to run the command.  The default type
 1178:                        may be overridden on a per-command basis in _s_u_d_o_e_r_s or
 1179:                        via command line options.  This option is only
 1180:                        available whe ssuuddoo is built with SELinux support.
 1181: 
 1182:        SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 1183: 
 1184:        env_file    The _e_n_v___f_i_l_e option specifies the fully qualified path to a
 1185:                    file containing variables to be set in the environment of
 1186:                    the program being run.  Entries in this file should either
 1187:                    be of the form VARIABLE=value or export VARIABLE=value.
 1188:                    The value may optionally be surrounded by single or double
 1189:                    quotes.  Variables in this file are subject to other ssuuddoo
 1190:                    environment settings such as _e_n_v___k_e_e_p and _e_n_v___c_h_e_c_k.
 1191: 
 1192:        exempt_group
 1193:                    Users in this group are exempt from password and PATH
 1194:                    requirements.  The group name specified should not include
 1195:                    a % prefix.  This is not set by default.
 1196: 
 1197:        group_plugin
 1198:                    A string containing a _s_u_d_o_e_r_s group plugin with optional
 1199:                    arguments.  This can be used to implement support for the
 1200:                    nonunix_group syntax described earlier.  The string should
 1201:                    consist of the plugin path, either fully-qualified or
 1202:                    relative to the _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c directory, followed by
 1203:                    any configuration arguments the plugin requires.  These
 1204:                    arguments (if any) will be passed to the plugin's
 1205:                    initialization function.  If arguments are present, the
 1206:                    string must be enclosed in double quotes (").
 1207: 
 1208:                    For example, given _/_e_t_c_/_s_u_d_o_-_g_r_o_u_p, a group file in Unix
 1209:                    group format, the sample group plugin can be used:
 1210: 
 1211:                        Defaults group_plugin="sample_group.so /etc/sudo-group"
 1212: 
 1213:                    For more information see _s_u_d_o___p_l_u_g_i_n(4).
 1214: 
 1215:        lecture     This option controls when a short lecture will be printed
 1216:                    along with the password prompt.  It has the following
 1217:                    possible values:
 1218: 
 1219:                    always  Always lecture the user.
 1220: 
 1221:                    never   Never lecture the user.
 1222: 
 1223:                    once    Only lecture the user the first time they run ssuuddoo.
 1224: 
 1225:                    If no value is specified, a value of _o_n_c_e is implied.
 1226:                    Negating the option results in a value of _n_e_v_e_r being used.
 1227:                    The default value is _o_n_c_e.
 1228: 
 1229:        lecture_file
 1230:                    Path to a file containing an alternate ssuuddoo lecture that
 1231:                    will be used in place of the standard lecture if the named
 1232:                    file exists.  By default, ssuuddoo uses a built-in lecture.
 1233: 
 1234:        listpw      This option controls when a password will be required when
 1235:                    a user runs ssuuddoo with the --ll option.  It has the following
 1236:                    possible values:
 1237: 
 1238:                    all     All the user's _s_u_d_o_e_r_s entries for the current host
 1239:                            must have the NOPASSWD flag set to avoid entering a
 1240:                            password.
 1241: 
 1242:                    always  The user must always enter a password to use the --ll
 1243:                            option.
 1244: 
 1245:                    any     At least one of the user's _s_u_d_o_e_r_s entries for the
 1246:                            current host must have the NOPASSWD flag set to
 1247:                            avoid entering a password.
 1248: 
 1249:                    never   The user need never enter a password to use the --ll
 1250:                            option.
 1251: 
 1252:                    If no value is specified, a value of _a_n_y is implied.
 1253:                    Negating the option results in a value of _n_e_v_e_r being used.
 1254:                    The default value is _a_n_y.
 1255: 
 1256:        logfile     Path to the ssuuddoo log file (not the syslog log file).
 1257:                    Setting a path turns on logging to a file; negating this
 1258:                    option turns it off.  By default, ssuuddoo logs via syslog.
 1259: 
 1260:        mailerflags Flags to use when invoking mailer. Defaults to --tt.
 1261: 
 1262:        mailerpath  Path to mail program used to send warning mail.  Defaults
 1263:                    to the path to sendmail found at configure time.
 1264: 
 1265:        mailfrom    Address to use for the "from" address when sending warning
 1266:                    and error mail.  The address should be enclosed in double
 1267:                    quotes (") to protect against ssuuddoo interpreting the @ sign.
 1268:                    Defaults to the name of the user running ssuuddoo.
 1269: 
 1270:        mailto      Address to send warning and error mail to.  The address
 1271:                    should be enclosed in double quotes (") to protect against
 1272:                    ssuuddoo interpreting the @ sign.  Defaults to root.
 1273: 
 1274:        secure_path Path used for every command run from ssuuddoo.  If you don't
 1275:                    trust the people running ssuuddoo to have a sane PATH
 1276:                    environment variable you may want to use this.  Another use
 1277:                    is if you want to have the "root path" be separate from the
 1278:                    "user path."  Users in the group specified by the
 1279:                    _e_x_e_m_p_t___g_r_o_u_p option are not affected by _s_e_c_u_r_e___p_a_t_h.  This
 1280:                    option is not set by default.
 1281: 
 1282:        syslog      Syslog facility if syslog is being used for logging (negate
 1283:                    to disable syslog logging).  Defaults to auth.
 1284: 
 1285:                    The following syslog facilities are supported: aauutthhpprriivv (if
 1286:                    your OS supports it), aauutthh, ddaaeemmoonn, uusseerr, llooccaall00, llooccaall11,
 1287:                    llooccaall22, llooccaall33, llooccaall44, llooccaall55, llooccaall66, and llooccaall77.
 1288: 
 1289:        verifypw    This option controls when a password will be required when
 1290:                    a user runs ssuuddoo with the --vv option.  It has the following
 1291:                    possible values:
 1292: 
 1293:                    all     All the user's _s_u_d_o_e_r_s entries for the current host
 1294:                            must have the NOPASSWD flag set to avoid entering a
 1295:                            password.
 1296: 
 1297:                    always  The user must always enter a password to use the --vv
 1298:                            option.
 1299: 
 1300:                    any     At least one of the user's _s_u_d_o_e_r_s entries for the
 1301:                            current host must have the NOPASSWD flag set to
 1302:                            avoid entering a password.
 1303: 
 1304:                    never   The user need never enter a password to use the --vv
 1305:                            option.
 1306: 
 1307:                    If no value is specified, a value of _a_l_l is implied.
 1308:                    Negating the option results in a value of _n_e_v_e_r being used.
 1309:                    The default value is _a_l_l.
 1310: 
 1311:        LLiissttss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 1312: 
 1313:        env_check       Environment variables to be removed from the user's
 1314:                        environment if the variable's value contains % or /
 1315:                        characters.  This can be used to guard against printf-
 1316:                        style format vulnerabilities in poorly-written
 1317:                        programs.  The argument may be a double-quoted, space-
 1318:                        separated list or a single value without double-quotes.
 1319:                        The list can be replaced, added to, deleted from, or
 1320:                        disabled by using the =, +=, -=, and ! operators
 1321:                        respectively.  Regardless of whether the env_reset
 1322:                        option is enabled or disabled, variables specified by
 1323:                        env_check will be preserved in the environment if they
 1324:                        pass the aforementioned check.  The default list of
 1325:                        environment variables to check is displayed when ssuuddoo
 1326:                        is run by root with the _-_V option.
 1327: 
 1328:        env_delete      Environment variables to be removed from the user's
 1329:                        environment when the _e_n_v___r_e_s_e_t option is not in effect.
 1330:                        The argument may be a double-quoted, space-separated
 1331:                        list or a single value without double-quotes.  The list
 1332:                        can be replaced, added to, deleted from, or disabled by
 1333:                        using the =, +=, -=, and ! operators respectively.  The
 1334:                        default list of environment variables to remove is
 1335:                        displayed when ssuuddoo is run by root with the _-_V option.
 1336:                        Note that many operating systems will remove
 1337:                        potentially dangerous variables from the environment of
 1338:                        any setuid process (such as ssuuddoo).
 1339: 
 1340:        env_keep        Environment variables to be preserved in the user's
 1341:                        environment when the _e_n_v___r_e_s_e_t option is in effect.
 1342:                        This allows fine-grained control over the environment
 1343:                        ssuuddoo-spawned processes will receive.  The argument may
 1344:                        be a double-quoted, space-separated list or a single
 1345:                        value without double-quotes.  The list can be replaced,
 1346:                        added to, deleted from, or disabled by using the =, +=,
 1347:                        -=, and ! operators respectively.  The default list of
 1348:                        variables to keep is displayed when ssuuddoo is run by root
 1349:                        with the _-_V option.
 1350: 
 1351: SSUUDDOO..CCOONNFF
 1352:        The _/_e_t_c_/_s_u_d_o_._c_o_n_f file determines which plugins the ssuuddoo front end
 1353:        will load.  If no _/_e_t_c_/_s_u_d_o_._c_o_n_f file is present, or it contains no
 1354:        Plugin lines, ssuuddoo will use the _s_u_d_o_e_r_s security policy and I/O
 1355:        logging, which corresponds to the following _/_e_t_c_/_s_u_d_o_._c_o_n_f file.
 1356: 
 1357:         #
 1358:         # Default /etc/sudo.conf file
 1359:         #
 1360:         # Format:
 1361:         #   Plugin plugin_name plugin_path plugin_options ...
 1362:         #   Path askpass /path/to/askpass
 1363:         #   Path noexec /path/to/sudo_noexec.so
 1364:         #   Debug sudo /var/log/sudo_debug all@warn
 1365:         #   Set disable_coredump true
 1366:         #
 1367:         # The plugin_path is relative to /usr/local/libexec unless
 1368:         #   fully qualified.
 1369:         # The plugin_name corresponds to a global symbol in the plugin
 1370:         #   that contains the plugin interface structure.
 1371:         # The plugin_options are optional.
 1372:         #
 1373:         Plugin policy_plugin sudoers.so
 1374:         Plugin io_plugin sudoers.so
 1375: 
 1376:    PPLLUUGGIINN OOPPTTIIOONNSS
 1377:        Starting with ssuuddoo 1.8.5 it is possible to pass options to the _s_u_d_o_e_r_s
 1378:        plugin.  Options may be listed after the path to the plugin (i.e. after
 1379:        _s_u_d_o_e_r_s_._s_o); multiple options should be space-separated.  For example:
 1380: 
 1381:         Plugin sudoers_policy sudoers.so sudoers_file=/etc/sudoers sudoers_uid=0 sudoers_gid=0 sudoers_mode=0440
 1382: 
 1383:        The following plugin options are supported:
 1384: 
 1385:        sudoers_file=pathname
 1386:                  The _s_u_d_o_e_r_s___f_i_l_e option can be used to override the default
 1387:                  path to the _s_u_d_o_e_r_s file.
 1388: 
 1389:        sudoers_uid=uid
 1390:                  The _s_u_d_o_e_r_s___u_i_d option can be used to override the default
 1391:                  owner of the sudoers file.  It should be specified as a
 1392:                  numeric user ID.
 1393: 
 1394:        sudoers_gid=gid
 1395:                  The _s_u_d_o_e_r_s___g_i_d option can be used to override the default
 1396:                  group of the sudoers file.  It should be specified as a
 1397:                  numeric group ID.
 1398: 
 1399:        sudoers_mode=mode
 1400:                  The _s_u_d_o_e_r_s___m_o_d_e option can be used to override the default
 1401:                  file mode for the sudoers file.  It should be specified as an
 1402:                  octal value.
 1403: 
 1404:    DDEEBBUUGG FFLLAAGGSS
 1405:        Versions 1.8.4 and higher of the _s_u_d_o_e_r_s plugin supports a debugging
 1406:        framework that can help track down what the plugin is doing internally
 1407:        if there is a problem.  This can be configured in the _/_e_t_c_/_s_u_d_o_._c_o_n_f
 1408:        file as described in _s_u_d_o(1m).
 1409: 
 1410:        The _s_u_d_o_e_r_s plugin uses the same debug flag format as ssuuddoo itself:
 1411:        _s_u_b_s_y_s_t_e_m@_p_r_i_o_r_i_t_y.
 1412: 
 1413:        The priorities used by _s_u_d_o_e_r_s, in order of decreasing severity, are:
 1414:        _c_r_i_t, _e_r_r, _w_a_r_n, _n_o_t_i_c_e, _d_i_a_g, _i_n_f_o, _t_r_a_c_e and _d_e_b_u_g.  Each priority,
 1415:        when specified, also includes all priorities higher than it.  For
 1416:        example, a priority of _n_o_t_i_c_e would include debug messages logged at
 1417:        _n_o_t_i_c_e and higher.
 1418: 
 1419:        The following subsystems are used by _s_u_d_o_e_r_s:
 1420: 
 1421:        _a_l_i_a_s     User_Alias, Runas_Alias, Host_Alias and Cmnd_Alias processing
 1422: 
 1423:        _a_l_l       matches every subsystem
 1424: 
 1425:        _a_u_d_i_t     BSM and Linux audit code
 1426: 
 1427:        _a_u_t_h      user authentication
 1428: 
 1429:        _d_e_f_a_u_l_t_s  _s_u_d_o_e_r_s _D_e_f_a_u_l_t_s settings
 1430: 
 1431:        _e_n_v       environment handling
 1432: 
 1433:        _l_d_a_p      LDAP-based sudoers
 1434: 
 1435:        _l_o_g_g_i_n_g   logging support
 1436: 
 1437:        _m_a_t_c_h     matching of users, groups, hosts and netgroups in _s_u_d_o_e_r_s
 1438: 
 1439:        _n_e_t_i_f     network interface handling
 1440: 
 1441:        _n_s_s       network service switch handling in _s_u_d_o_e_r_s
 1442: 
 1443:        _p_a_r_s_e_r    _s_u_d_o_e_r_s file parsing
 1444: 
 1445:        _p_e_r_m_s     permission setting
 1446: 
 1447:        _p_l_u_g_i_n    The equivalent of _m_a_i_n for the plugin.
 1448: 
 1449:        _p_t_y       pseudo-tty related code
 1450: 
 1451:        _r_b_t_r_e_e    redblack tree internals
 1452: 
 1453:        _u_t_i_l      utility functions
 1454: 
 1455: FFIILLEESS
 1456:        _/_e_t_c_/_s_u_d_o_._c_o_n_f          Sudo front end configuration
 1457: 
 1458:        _/_e_t_c_/_s_u_d_o_e_r_s            List of who can run what
 1459: 
 1460:        _/_e_t_c_/_g_r_o_u_p              Local groups file
 1461: 
 1462:        _/_e_t_c_/_n_e_t_g_r_o_u_p           List of network groups
 1463: 
 1464:        _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o        I/O log files
 1465: 
 1466:        _/_v_a_r_/_a_d_m_/_s_u_d_o           Directory containing time stamps for the
 1467:                                _s_u_d_o_e_r_s security policy
 1468: 
 1469:        _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t        Initial environment for --ii mode on AIX and
 1470:                                Linux systems
 1471: 
 1472: EEXXAAMMPPLLEESS
 1473:        Below are example _s_u_d_o_e_r_s entries.  Admittedly, some of these are a bit
 1474:        contrived.  First, we allow a few environment variables to pass and
 1475:        then define our _a_l_i_a_s_e_s:
 1476: 
 1477:         # Run X applications through sudo; HOME is used to find the
 1478:         # .Xauthority file.  Note that other programs use HOME to find
 1479:         # configuration files and this may lead to privilege escalation!
 1480:         Defaults env_keep += "DISPLAY HOME"
 1481: 
 1482:         # User alias specification
 1483:         User_Alias     FULLTIMERS = millert, mikef, dowdy
 1484:         User_Alias     PARTTIMERS = bostley, jwfox, crawl
 1485:         User_Alias     WEBMASTERS = will, wendy, wim
 1486: 
 1487:         # Runas alias specification
 1488:         Runas_Alias    OP = root, operator
 1489:         Runas_Alias    DB = oracle, sybase
 1490:         Runas_Alias    ADMINGRP = adm, oper
 1491: 
 1492:         # Host alias specification
 1493:         Host_Alias     SPARC = bigtime, eclipse, moet, anchor :\
 1494:                        SGI = grolsch, dandelion, black :\
 1495:                        ALPHA = widget, thalamus, foobar :\
 1496:                        HPPA = boa, nag, python
 1497:         Host_Alias     CUNETS = 128.138.0.0/255.255.0.0
 1498:         Host_Alias     CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
 1499:         Host_Alias     SERVERS = master, mail, www, ns
 1500:         Host_Alias     CDROM = orion, perseus, hercules
 1501: 
 1502:         # Cmnd alias specification
 1503:         Cmnd_Alias     DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
 1504:                                /usr/sbin/restore, /usr/sbin/rrestore
 1505:         Cmnd_Alias     KILL = /usr/bin/kill
 1506:         Cmnd_Alias     PRINTING = /usr/sbin/lpc, /usr/bin/lprm
 1507:         Cmnd_Alias     SHUTDOWN = /usr/sbin/shutdown
 1508:         Cmnd_Alias     HALT = /usr/sbin/halt
 1509:         Cmnd_Alias     REBOOT = /usr/sbin/reboot
 1510:         Cmnd_Alias     SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
 1511:                                 /usr/local/bin/tcsh, /usr/bin/rsh, \
 1512:                                 /usr/local/bin/zsh
 1513:         Cmnd_Alias     SU = /usr/bin/su
 1514:         Cmnd_Alias     PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
 1515: 
 1516:        Here we override some of the compiled in default values.  We want ssuuddoo
 1517:        to log via _s_y_s_l_o_g(3) using the _a_u_t_h facility in all cases.  We don't
 1518:        want to subject the full time staff to the ssuuddoo lecture, user mmiilllleerrtt
 1519:        need not give a password, and we don't want to reset the LOGNAME, USER
 1520:        or USERNAME environment variables when running commands as root.
 1521:        Additionally, on the machines in the _S_E_R_V_E_R_S Host_Alias, we keep an
 1522:        additional local log file and make sure we log the year in each log
 1523:        line since the log entries will be kept around for several years.
 1524:        Lastly, we disable shell escapes for the commands in the PAGERS
 1525:        Cmnd_Alias (_/_u_s_r_/_b_i_n_/_m_o_r_e, _/_u_s_r_/_b_i_n_/_p_g and _/_u_s_r_/_b_i_n_/_l_e_s_s).
 1526: 
 1527:         # Override built-in defaults
 1528:         Defaults               syslog=auth
 1529:         Defaults>root          !set_logname
 1530:         Defaults:FULLTIMERS    !lecture
 1531:         Defaults:millert       !authenticate
 1532:         Defaults@SERVERS       log_year, logfile=/var/log/sudo.log
 1533:         Defaults!PAGERS        noexec
 1534: 
 1535:        The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually determines who may run
 1536:        what.
 1537: 
 1538:         root           ALL = (ALL) ALL
 1539:         %wheel         ALL = (ALL) ALL
 1540: 
 1541:        We let rroooott and any user in group wwhheeeell run any command on any host as
 1542:        any user.
 1543: 
 1544:         FULLTIMERS     ALL = NOPASSWD: ALL
 1545: 
 1546:        Full time sysadmins (mmiilllleerrtt, mmiikkeeff, and ddoowwddyy) may run any command on
 1547:        any host without authenticating themselves.
 1548: 
 1549:         PARTTIMERS     ALL = ALL
 1550: 
 1551:        Part time sysadmins (bboossttlleeyy, jjwwffooxx, and ccrraawwll) may run any command on
 1552:        any host but they must authenticate themselves first (since the entry
 1553:        lacks the NOPASSWD tag).
 1554: 
 1555:         jack           CSNETS = ALL
 1556: 
 1557:        The user jjaacckk may run any command on the machines in the _C_S_N_E_T_S alias
 1558:        (the networks 128.138.243.0, 128.138.204.0, and 128.138.242.0).  Of
 1559:        those networks, only 128.138.204.0 has an explicit netmask (in CIDR
 1560:        notation) indicating it is a class C network.  For the other networks
 1561:        in _C_S_N_E_T_S, the local machine's netmask will be used during matching.
 1562: 
 1563:         lisa           CUNETS = ALL
 1564: 
 1565:        The user lliissaa may run any command on any host in the _C_U_N_E_T_S alias (the
 1566:        class B network 128.138.0.0).
 1567: 
 1568:         operator       ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
 1569:                        sudoedit /etc/printcap, /usr/oper/bin/
 1570: 
 1571:        The ooppeerraattoorr user may run commands limited to simple maintenance.
 1572:        Here, those are commands related to backups, killing processes, the
 1573:        printing system, shutting down the system, and any commands in the
 1574:        directory _/_u_s_r_/_o_p_e_r_/_b_i_n_/.
 1575: 
 1576:         joe            ALL = /usr/bin/su operator
 1577: 
 1578:        The user jjooee may only _s_u(1) to operator.
 1579: 
 1580:         pete           HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root
 1581: 
 1582:         %opers         ALL = (: ADMINGRP) /usr/sbin/
 1583: 
 1584:        Users in the ooppeerrss group may run commands in _/_u_s_r_/_s_b_i_n_/ as themselves
 1585:        with any group in the _A_D_M_I_N_G_R_P Runas_Alias (the aaddmm and ooppeerr groups).
 1586: 
 1587:        The user ppeettee is allowed to change anyone's password except for root on
 1588:        the _H_P_P_A machines.  Note that this assumes _p_a_s_s_w_d(1) does not take
 1589:        multiple user names on the command line.
 1590: 
 1591:         bob            SPARC = (OP) ALL : SGI = (OP) ALL
 1592: 
 1593:        The user bboobb may run anything on the _S_P_A_R_C and _S_G_I machines as any user
 1594:        listed in the _O_P Runas_Alias (rroooott and ooppeerraattoorr).
 1595: 
 1596:         jim            +biglab = ALL
 1597: 
 1598:        The user jjiimm may run any command on machines in the _b_i_g_l_a_b netgroup.
 1599:        ssuuddoo knows that "biglab" is a netgroup due to the '+' prefix.
 1600: 
 1601:         +secretaries   ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
 1602: 
 1603:        Users in the sseeccrreettaarriieess netgroup need to help manage the printers as
 1604:        well as add and remove users, so they are allowed to run those commands
 1605:        on all machines.
 1606: 
 1607:         fred           ALL = (DB) NOPASSWD: ALL
 1608: 
 1609:        The user ffrreedd can run commands as any user in the _D_B Runas_Alias
 1610:        (oorraaccllee or ssyybbaassee) without giving a password.
 1611: 
 1612:         john           ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
 1613: 
 1614:        On the _A_L_P_H_A machines, user jjoohhnn may su to anyone except root but he is
 1615:        not allowed to specify any options to the _s_u(1) command.
 1616: 
 1617:         jen            ALL, !SERVERS = ALL
 1618: 
 1619:        The user jjeenn may run any command on any machine except for those in the
 1620:        _S_E_R_V_E_R_S Host_Alias (master, mail, www and ns).
 1621: 
 1622:         jill           SERVERS = /usr/bin/, !SU, !SHELLS
 1623: 
 1624:        For any machine in the _S_E_R_V_E_R_S Host_Alias, jjiillll may run any commands in
 1625:        the directory _/_u_s_r_/_b_i_n_/ except for those commands belonging to the _S_U
 1626:        and _S_H_E_L_L_S Cmnd_Aliases.
 1627: 
 1628:         steve          CSNETS = (operator) /usr/local/op_commands/
 1629: 
 1630:        The user sstteevvee may run any command in the directory
 1631:        /usr/local/op_commands/ but only as user operator.
 1632: 
 1633:         matt           valkyrie = KILL
 1634: 
 1635:        On his personal workstation, valkyrie, mmaatttt needs to be able to kill
 1636:        hung processes.
 1637: 
 1638:         WEBMASTERS     www = (www) ALL, (root) /usr/bin/su www
 1639: 
 1640:        On the host www, any user in the _W_E_B_M_A_S_T_E_R_S User_Alias (will, wendy,
 1641:        and wim), may run any command as user www (which owns the web pages) or
 1642:        simply _s_u(1) to www.
 1643: 
 1644:         ALL            CDROM = NOPASSWD: /sbin/umount /CDROM,\
 1645:                        /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
 1646: 
 1647:        Any user may mount or unmount a CD-ROM on the machines in the CDROM
 1648:        Host_Alias (orion, perseus, hercules) without entering a password.
 1649:        This is a bit tedious for users to type, so it is a prime candidate for
 1650:        encapsulating in a shell script.
 1651: 
 1652: SSEECCUURRIITTYY NNOOTTEESS
 1653:    LLiimmiittaattiioonnss ooff tthhee ''!!'' ooppeerraattoorr
 1654:        It is generally not effective to "subtract" commands from ALL using the
 1655:        '!' operator.  A user can trivially circumvent this by copying the
 1656:        desired command to a different name and then executing that.  For
 1657:        example:
 1658: 
 1659:            bill        ALL = ALL, !SU, !SHELLS
 1660: 
 1661:        Doesn't really prevent bbiillll from running the commands listed in _S_U or
 1662:        _S_H_E_L_L_S since he can simply copy those commands to a different name, or
 1663:        use a shell escape from an editor or other program.  Therefore, these
 1664:        kind of restrictions should be considered advisory at best (and
 1665:        reinforced by policy).
 1666: 
 1667:        In general, if a user has sudo ALL there is nothing to prevent them
 1668:        from creating their own program that gives them a root shell (or making
 1669:        their own copy of a shell) regardless of any '!' elements in the user
 1670:        specification.
 1671: 
 1672:    SSeeccuurriittyy iimmpplliiccaattiioonnss ooff _f_a_s_t___g_l_o_b
 1673:        If the _f_a_s_t___g_l_o_b option is in use, it is not possible to reliably
 1674:        negate commands where the path name includes globbing (aka wildcard)
 1675:        characters.  This is because the C library's _f_n_m_a_t_c_h(3) function cannot
 1676:        resolve relative paths.  While this is typically only an inconvenience
 1677:        for rules that grant privileges, it can result in a security issue for
 1678:        rules that subtract or revoke privileges.
 1679: 
 1680:        For example, given the following _s_u_d_o_e_r_s entry:
 1681: 
 1682:         john   ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,
 1683:              /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
 1684: 
 1685:        User jjoohhnn can still run /usr/bin/passwd root if _f_a_s_t___g_l_o_b is enabled by
 1686:        changing to _/_u_s_r_/_b_i_n and running ./passwd root instead.
 1687: 
 1688:    PPrreevveennttiinngg SShheellll EEssccaappeess
 1689:        Once ssuuddoo executes a program, that program is free to do whatever it
 1690:        pleases, including run other programs.  This can be a security issue
 1691:        since it is not uncommon for a program to allow shell escapes, which
 1692:        lets a user bypass ssuuddoo's access control and logging.  Common programs
 1693:        that permit shell escapes include shells (obviously), editors,
 1694:        paginators, mail and terminal programs.
 1695: 
 1696:        There are two basic approaches to this problem:
 1697: 
 1698:        restrict  Avoid giving users access to commands that allow the user to
 1699:                  run arbitrary commands.  Many editors have a restricted mode
 1700:                  where shell escapes are disabled, though ssuuddooeeddiitt is a better
 1701:                  solution to running editors via ssuuddoo.  Due to the large
 1702:                  number of programs that offer shell escapes, restricting
 1703:                  users to the set of programs that do not is often unworkable.
 1704: 
 1705:        noexec    Many systems that support shared libraries have the ability
 1706:                  to override default library functions by pointing an
 1707:                  environment variable (usually LD_PRELOAD) to an alternate
 1708:                  shared library.  On such systems, ssuuddoo's _n_o_e_x_e_c functionality
 1709:                  can be used to prevent a program run by ssuuddoo from executing
 1710:                  any other programs.  Note, however, that this applies only to
 1711:                  native dynamically-linked executables.  Statically-linked
 1712:                  executables and foreign executables running under binary
 1713:                  emulation are not affected.
 1714: 
 1715:                  The _n_o_e_x_e_c feature is known to work on SunOS, Solaris, *BSD,
 1716:                  Linux, IRIX, Tru64 UNIX, MacOS X, HP-UX 11.x and AIX 5.3 and
 1717:                  above.  It should be supported on most operating systems that
 1718:                  support the LD_PRELOAD environment variable.  Check your
 1719:                  operating system's manual pages for the dynamic linker
 1720:                  (usually ld.so, ld.so.1, dyld, dld.sl, rld, or loader) to see
 1721:                  if LD_PRELOAD is supported.
 1722: 
 1723:                  On Solaris 10 and higher, _n_o_e_x_e_c uses Solaris privileges
 1724:                  instead of the LD_PRELOAD environment variable.
 1725: 
 1726:                  To enable _n_o_e_x_e_c for a command, use the NOEXEC tag as
 1727:                  documented in the User Specification section above.  Here is
 1728:                  that example again:
 1729: 
 1730:                   aaron  shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
 1731: 
 1732:                  This allows user aaaarroonn to run _/_u_s_r_/_b_i_n_/_m_o_r_e and _/_u_s_r_/_b_i_n_/_v_i
 1733:                  with _n_o_e_x_e_c enabled.  This will prevent those two commands
 1734:                  from executing other commands (such as a shell).  If you are
 1735:                  unsure whether or not your system is capable of supporting
 1736:                  _n_o_e_x_e_c you can always just try it out and check whether shell
 1737:                  escapes work when _n_o_e_x_e_c is enabled.
 1738: 
 1739:        Note that restricting shell escapes is not a panacea.  Programs running
 1740:        as root are still capable of many potentially hazardous operations
 1741:        (such as changing or overwriting files) that could lead to unintended
 1742:        privilege escalation.  In the specific case of an editor, a safer
 1743:        approach is to give the user permission to run ssuuddooeeddiitt.
 1744: 
 1745:    TTiimmee ssttaammpp ffiillee cchheecckkss
 1746:        _s_u_d_o_e_r_s will check the ownership of its time stamp directory
 1747:        (_/_v_a_r_/_a_d_m_/_s_u_d_o by default) and ignore the directory's contents if it is
 1748:        not owned by root or if it is writable by a user other than root.  On
 1749:        systems that allow non-root users to give away files via _c_h_o_w_n(2), if
 1750:        the time stamp directory is located in a world-writable directory
 1751:        (e.g., _/_t_m_p), it is possible for a user to create the time stamp
 1752:        directory before ssuuddoo is run.  However, because _s_u_d_o_e_r_s checks the
 1753:        ownership and mode of the directory and its contents, the only damage
 1754:        that can be done is to "hide" files by putting them in the time stamp
 1755:        dir.  This is unlikely to happen since once the time stamp dir is owned
 1756:        by root and inaccessible by any other user, the user placing files
 1757:        there would be unable to get them back out.
 1758: 
 1759:        _s_u_d_o_e_r_s will not honor time stamps set far in the future.  Time stamps
 1760:        with a date greater than current_time + 2 * TIMEOUT will be ignored and
 1761:        sudo will log and complain.  This is done to keep a user from creating
 1762:        his/her own time stamp with a bogus date on systems that allow users to
 1763:        give away files if the time stamp directory is located in a world-
 1764:        writable directory.
 1765: 
 1766:        On systems where the boot time is available, _s_u_d_o_e_r_s will ignore time
 1767:        stamps that date from before the machine booted.
 1768: 
 1769:        Since time stamp files live in the file system, they can outlive a
 1770:        user's login session.  As a result, a user may be able to login, run a
 1771:        command with ssuuddoo after authenticating, logout, login again, and run
 1772:        ssuuddoo without authenticating so long as the time stamp file's
 1773:        modification time is within 5 minutes (or whatever the timeout is set
 1774:        to in _s_u_d_o_e_r_s).  When the _t_t_y___t_i_c_k_e_t_s option is enabled, the time stamp
 1775:        has per-tty granularity but still may outlive the user's session.  On
 1776:        Linux systems where the devpts filesystem is used, Solaris systems with
 1777:        the devices filesystem, as well as other systems that utilize a devfs
 1778:        filesystem that monotonically increase the inode number of devices as
 1779:        they are created (such as Mac OS X), _s_u_d_o_e_r_s is able to determine when
 1780:        a tty-based time stamp file is stale and will ignore it.
 1781:        Administrators should not rely on this feature as it is not universally
 1782:        available.
 1783: 
 1784: SSEEEE AALLSSOO
 1785:        _r_s_h(1), _s_u(1), _f_n_m_a_t_c_h(3), _g_l_o_b(3), _m_k_t_e_m_p(3), _s_t_r_f_t_i_m_e(3),
 1786:        _s_u_d_o_e_r_s_._l_d_a_p(4), _s_u_d_o___p_l_u_g_i_n(1m), _s_u_d_o(1m), _v_i_s_u_d_o(1m)
 1787: 
 1788: CCAAVVEEAATTSS
 1789:        The _s_u_d_o_e_r_s file should aallwwaayyss be edited by the vviissuuddoo command which
 1790:        locks the file and does grammatical checking. It is imperative that
 1791:        _s_u_d_o_e_r_s be free of syntax errors since ssuuddoo will not run with a
 1792:        syntactically incorrect _s_u_d_o_e_r_s file.
 1793: 
 1794:        When using netgroups of machines (as opposed to users), if you store
 1795:        fully qualified host name in the netgroup (as is usually the case), you
 1796:        either need to have the machine's host name be fully qualified as
 1797:        returned by the hostname command or use the _f_q_d_n option in _s_u_d_o_e_r_s.
 1798: 
 1799: BBUUGGSS
 1800:        If you feel you have found a bug in ssuuddoo, please submit a bug report at
 1801:        http://www.sudo.ws/sudo/bugs/
 1802: 
 1803: SSUUPPPPOORRTT
 1804:        Limited free support is available via the sudo-users mailing list, see
 1805:        http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
 1806:        the archives.
 1807: 
 1808: DDIISSCCLLAAIIMMEERR
 1809:        ssuuddoo is provided ``AS IS'' and any express or implied warranties,
 1810:        including, but not limited to, the implied warranties of
 1811:        merchantability and fitness for a particular purpose are disclaimed.
 1812:        See the LICENSE file distributed with ssuuddoo or
 1813:        http://www.sudo.ws/sudo/license.html for complete details.
 1814: 
 1815: 
 1816: 
 1817: 1.8.5                           March 28, 2012                      SUDOERS(4)