1: SUDOERS(4) Programmer's Manual SUDOERS(4)
2:
3: NNAAMMEE
4: ssuuddooeerrss - default sudo security policy module
5:
6: DDEESSCCRRIIPPTTIIOONN
7: The _s_u_d_o_e_r_s policy module determines a user's ssuuddoo privileges. It is the
8: default ssuuddoo policy plugin. The policy is driven by the _/_e_t_c_/_s_u_d_o_e_r_s
9: file or, optionally in LDAP. The policy format is described in detail in
10: the _S_U_D_O_E_R_S _F_I_L_E _F_O_R_M_A_T section. For information on storing _s_u_d_o_e_r_s
11: policy information in LDAP, please see sudoers.ldap(4).
12:
13: AAuutthheennttiiccaattiioonn aanndd llooggggiinngg
14: The _s_u_d_o_e_r_s security policy requires that most users authenticate
15: themselves before they can use ssuuddoo. A password is not required if the
16: invoking user is root, if the target user is the same as the invoking
17: user, or if the policy has disabled authentication for the user or
18: command. Unlike su(1), when _s_u_d_o_e_r_s requires authentication, it
19: validates the invoking user's credentials, not the target user's (or
20: root's) credentials. This can be changed via the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and
21: _r_u_n_a_s_p_w flags, described later.
22:
23: If a user who is not listed in the policy tries to run a command via
24: ssuuddoo, mail is sent to the proper authorities. The address used for such
25: mail is configurable via the _m_a_i_l_t_o Defaults entry (described later) and
26: defaults to root.
27:
28: Note that mail will not be sent if an unauthorized user tries to run ssuuddoo
29: with the --ll or --vv option. This allows users to determine for themselves
30: whether or not they are allowed to use ssuuddoo.
31:
32: If ssuuddoo is run by root and the SUDO_USER environment variable is set, the
33: _s_u_d_o_e_r_s policy will use this value to determine who the actual user is.
34: This can be used by a user to log commands through sudo even when a root
35: shell has been invoked. It also allows the --ee option to remain useful
36: even when invoked via a sudo-run script or program. Note, however, that
37: the _s_u_d_o_e_r_s lookup is still done for root, not the user specified by
38: SUDO_USER.
39:
40: _s_u_d_o_e_r_s uses time stamp files for credential caching. Once a user has
41: been authenticated, the time stamp is updated and the user may then use
42: sudo without a password for a short period of time (5 minutes unless
43: overridden by the _t_i_m_e_o_u_t option). By default, _s_u_d_o_e_r_s uses a tty-based
44: time stamp which means that there is a separate time stamp for each of a
45: user's login sessions. The _t_t_y___t_i_c_k_e_t_s option can be disabled to force
46: the use of a single time stamp for all of a user's sessions.
47:
48: _s_u_d_o_e_r_s can log both successful and unsuccessful attempts (as well as
49: errors) to syslog(3), a log file, or both. By default, _s_u_d_o_e_r_s will log
50: via syslog(3) but this is changeable via the _s_y_s_l_o_g and _l_o_g_f_i_l_e Defaults
51: settings.
52:
53: _s_u_d_o_e_r_s also supports logging a command's input and output streams. I/O
54: logging is not on by default but can be enabled using the _l_o_g___i_n_p_u_t and
55: _l_o_g___o_u_t_p_u_t Defaults flags as well as the LOG_INPUT and LOG_OUTPUT command
56: tags.
57:
58: CCoommmmaanndd eennvviirroonnmmeenntt
59: Since environment variables can influence program behavior, _s_u_d_o_e_r_s
60: provides a means to restrict which variables from the user's environment
61: are inherited by the command to be run. There are two distinct ways
62: _s_u_d_o_e_r_s can deal with environment variables.
63:
64: By default, the _e_n_v___r_e_s_e_t option is enabled. This causes commands to be
65: executed with a new, minimal environment. On AIX (and Linux systems
66: without PAM), the environment is initialized with the contents of the
67: _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t file. On BSD systems, if the _u_s_e___l_o_g_i_n_c_l_a_s_s option is
68: enabled, the environment is initialized based on the _p_a_t_h and _s_e_t_e_n_v
69: settings in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f. The new environment contains the TERM,
70: PATH, HOME, MAIL, SHELL, LOGNAME, USER, USERNAME and SUDO_* variables in
71: addition to variables from the invoking process permitted by the
72: _e_n_v___c_h_e_c_k and _e_n_v___k_e_e_p options. This is effectively a whitelist for
73: environment variables.
74:
75: If, however, the _e_n_v___r_e_s_e_t option is disabled, any variables not
76: explicitly denied by the _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e options are inherited
77: from the invoking process. In this case, _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e behave
78: like a blacklist. Since it is not possible to blacklist all potentially
79: dangerous environment variables, use of the default _e_n_v___r_e_s_e_t behavior is
80: encouraged.
81:
82: In all cases, environment variables with a value beginning with () are
83: removed as they could be interpreted as bbaasshh functions. The list of
84: environment variables that ssuuddoo allows or denies is contained in the
85: output of ``sudo -V'' when run as root.
86:
87: Note that the dynamic linker on most operating systems will remove
88: variables that can control dynamic linking from the environment of setuid
89: executables, including ssuuddoo. Depending on the operating system this may
90: include _RLD*, DYLD_*, LD_*, LDR_*, LIBPATH, SHLIB_PATH, and others.
91: These type of variables are removed from the environment before ssuuddoo even
92: begins execution and, as such, it is not possible for ssuuddoo to preserve
93: them.
94:
95: As a special case, if ssuuddoo's --ii option (initial login) is specified,
96: _s_u_d_o_e_r_s will initialize the environment regardless of the value of
97: _e_n_v___r_e_s_e_t. The DISPLAY, PATH and TERM variables remain unchanged; HOME,
98: MAIL, SHELL, USER, and LOGNAME are set based on the target user. On AIX
99: (and Linux systems without PAM), the contents of _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t are
100: also included. On BSD systems, if the _u_s_e___l_o_g_i_n_c_l_a_s_s option is enabled,
101: the _p_a_t_h and _s_e_t_e_n_v variables in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f are also applied. All
102: other environment variables are removed.
103:
104: Finally, if the _e_n_v___f_i_l_e option is defined, any variables present in that
105: file will be set to their specified values as long as they would not
106: conflict with an existing environment variable.
107:
108: SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT
109: The _s_u_d_o_e_r_s file is composed of two types of entries: aliases (basically
110: variables) and user specifications (which specify who may run what).
111:
112: When multiple entries match for a user, they are applied in order. Where
113: there are multiple matches, the last match is used (which is not
114: necessarily the most specific match).
115:
116: The _s_u_d_o_e_r_s grammar will be described below in Extended Backus-Naur Form
117: (EBNF). Don't despair if you are unfamiliar with EBNF; it is fairly
118: simple, and the definitions below are annotated.
119:
120: QQuuiicckk gguuiiddee ttoo EEBBNNFF
121: EBNF is a concise and exact way of describing the grammar of a language.
122: Each EBNF definition is made up of _p_r_o_d_u_c_t_i_o_n _r_u_l_e_s. E.g.,
123:
124: symbol ::= definition | alternate1 | alternate2 ...
125:
126: Each _p_r_o_d_u_c_t_i_o_n _r_u_l_e references others and thus makes up a grammar for
127: the language. EBNF also contains the following operators, which many
128: readers will recognize from regular expressions. Do not, however,
129: confuse them with ``wildcard'' characters, which have different meanings.
130:
131: ? Means that the preceding symbol (or group of symbols) is optional.
132: That is, it may appear once or not at all.
133:
134: * Means that the preceding symbol (or group of symbols) may appear
135: zero or more times.
136:
137: + Means that the preceding symbol (or group of symbols) may appear
138: one or more times.
139:
140: Parentheses may be used to group symbols together. For clarity, we will
141: use single quotes ('') to designate what is a verbatim character string
142: (as opposed to a symbol name).
143:
144: AAlliiaasseess
145: There are four kinds of aliases: User_Alias, Runas_Alias, Host_Alias and
146: Cmnd_Alias.
147:
148: Alias ::= 'User_Alias' User_Alias (':' User_Alias)* |
149: 'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
150: 'Host_Alias' Host_Alias (':' Host_Alias)* |
151: 'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)*
152:
153: User_Alias ::= NAME '=' User_List
154:
155: Runas_Alias ::= NAME '=' Runas_List
156:
157: Host_Alias ::= NAME '=' Host_List
158:
159: Cmnd_Alias ::= NAME '=' Cmnd_List
160:
161: NAME ::= [A-Z]([A-Z][0-9]_)*
162:
163: Each _a_l_i_a_s definition is of the form
164:
165: Alias_Type NAME = item1, item2, ...
166:
167: where _A_l_i_a_s___T_y_p_e is one of User_Alias, Runas_Alias, Host_Alias, or
168: Cmnd_Alias. A NAME is a string of uppercase letters, numbers, and
169: underscore characters (`_'). A NAME mmuusstt start with an uppercase letter.
170: It is possible to put several alias definitions of the same type on a
171: single line, joined by a colon (`:'). E.g.,
172:
173: Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
174:
175: The definitions of what constitutes a valid _a_l_i_a_s member follow.
176:
177: User_List ::= User |
178: User ',' User_List
179:
180: User ::= '!'* user name |
181: '!'* #uid |
182: '!'* %group |
183: '!'* %#gid |
184: '!'* +netgroup |
185: '!'* %:nonunix_group |
186: '!'* %:#nonunix_gid |
187: '!'* User_Alias
188:
189: A User_List is made up of one or more user names, user ids (prefixed with
190: `#'), system group names and ids (prefixed with `%' and `%#'
191: respectively), netgroups (prefixed with `+'), non-Unix group names and
192: IDs (prefixed with `%:' and `%:#' respectively) and User_Aliases. Each
193: list item may be prefixed with zero or more `!' operators. An odd number
194: of `!' operators negate the value of the item; an even number just cancel
195: each other out.
196:
197: A user name, uid, group, gid, netgroup, nonunix_group or nonunix_gid may
198: be enclosed in double quotes to avoid the need for escaping special
199: characters. Alternately, special characters may be specified in escaped
200: hex mode, e.g. \x20 for space. When using double quotes, any prefix
201: characters must be included inside the quotes.
202:
203: The actual nonunix_group and nonunix_gid syntax depends on the underlying
204: group provider plugin (see the _g_r_o_u_p___p_l_u_g_i_n description below). For
205: instance, the QAS AD plugin supports the following formats:
206:
207: oo Group in the same domain: "%:Group Name"
208:
209: oo Group in any domain: "%:Group Name@FULLY.QUALIFIED.DOMAIN"
210:
211: oo Group SID: "%:S-1-2-34-5678901234-5678901234-5678901234-567"
212:
213: Note that quotes around group names are optional. Unquoted strings must
214: use a backslash (`\') to escape spaces and special characters. See _O_t_h_e_r
215: _s_p_e_c_i_a_l _c_h_a_r_a_c_t_e_r_s _a_n_d _r_e_s_e_r_v_e_d _w_o_r_d_s for a list of characters that need
216: to be escaped.
217:
218: Runas_List ::= Runas_Member |
219: Runas_Member ',' Runas_List
220:
221: Runas_Member ::= '!'* user name |
222: '!'* #uid |
223: '!'* %group |
224: '!'* %#gid |
225: '!'* %:nonunix_group |
226: '!'* %:#nonunix_gid |
227: '!'* +netgroup |
228: '!'* Runas_Alias
229:
230: A Runas_List is similar to a User_List except that instead of
231: User_Aliases it can contain Runas_Aliases. Note that user names and
232: groups are matched as strings. In other words, two users (groups) with
233: the same uid (gid) are considered to be distinct. If you wish to match
234: all user names with the same uid (e.g. root and toor), you can use a uid
235: instead (#0 in the example given).
236:
237: Host_List ::= Host |
238: Host ',' Host_List
239:
240: Host ::= '!'* host name |
241: '!'* ip_addr |
242: '!'* network(/netmask)? |
243: '!'* +netgroup |
244: '!'* Host_Alias
245:
246: A Host_List is made up of one or more host names, IP addresses, network
247: numbers, netgroups (prefixed with `+') and other aliases. Again, the
248: value of an item may be negated with the `!' operator. If you do not
249: specify a netmask along with the network number, ssuuddoo will query each of
250: the local host's network interfaces and, if the network number
251: corresponds to one of the hosts's network interfaces, the corresponding
252: netmask will be used. The netmask may be specified either in standard IP
253: address notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or CIDR
254: notation (number of bits, e.g. 24 or 64). A host name may include shell-
255: style wildcards (see the _W_i_l_d_c_a_r_d_s section below), but unless the host
256: name command on your machine returns the fully qualified host name,
257: you'll need to use the _f_q_d_n option for wildcards to be useful. Note that
258: ssuuddoo only inspects actual network interfaces; this means that IP address
259: 127.0.0.1 (localhost) will never match. Also, the host name
260: ``localhost'' will only match if that is the actual host name, which is
261: usually only the case for non-networked systems.
262:
263: Cmnd_List ::= Cmnd |
264: Cmnd ',' Cmnd_List
265:
266: command name ::= file name |
267: file name args |
268: file name '""'
269:
270: Cmnd ::= '!'* command name |
271: '!'* directory |
272: '!'* "sudoedit" |
273: '!'* Cmnd_Alias
274:
275: A Cmnd_List is a list of one or more command names, directories, and
276: other aliases. A command name is a fully qualified file name which may
277: include shell-style wildcards (see the _W_i_l_d_c_a_r_d_s section below). A
278: simple file name allows the user to run the command with any arguments
279: he/she wishes. However, you may also specify command line arguments
280: (including wildcards). Alternately, you can specify "" to indicate that
281: the command may only be run wwiitthhoouutt command line arguments. A directory
282: is a fully qualified path name ending in a `/'. When you specify a
283: directory in a Cmnd_List, the user will be able to run any file within
284: that directory (but not in any sub-directories therein).
285:
286: If a Cmnd has associated command line arguments, then the arguments in
287: the Cmnd must match exactly those given by the user on the command line
288: (or match the wildcards if there are any). Note that the following
289: characters must be escaped with a `\' if they are used in command
290: arguments: `,', `:', `=', `\'. The special command ``sudoedit'' is used
291: to permit a user to run ssuuddoo with the --ee option (or as ssuuddooeeddiitt). It may
292: take command line arguments just as a normal command does.
293:
294: DDeeffaauullttss
295: Certain configuration options may be changed from their default values at
296: run-time via one or more Default_Entry lines. These may affect all users
297: on any host, all users on a specific host, a specific user, a specific
298: command, or commands being run as a specific user. Note that per-command
299: entries may not include command line arguments. If you need to specify
300: arguments, define a Cmnd_Alias and reference that instead.
301:
302: Default_Type ::= 'Defaults' |
303: 'Defaults' '@' Host_List |
304: 'Defaults' ':' User_List |
305: 'Defaults' '!' Cmnd_List |
306: 'Defaults' '>' Runas_List
307:
308: Default_Entry ::= Default_Type Parameter_List
309:
310: Parameter_List ::= Parameter |
311: Parameter ',' Parameter_List
312:
313: Parameter ::= Parameter '=' Value |
314: Parameter '+=' Value |
315: Parameter '-=' Value |
316: '!'* Parameter
317:
318: Parameters may be ffllaaggss, iinntteeggeerr values, ssttrriinnggss, or lliissttss. Flags are
319: implicitly boolean and can be turned off via the `!' operator. Some
320: integer, string and list parameters may also be used in a boolean context
321: to disable them. Values may be enclosed in double quotes ("") when they
322: contain multiple words. Special characters may be escaped with a
323: backslash (`\').
324:
325: Lists have two additional assignment operators, += and -=. These
326: operators are used to add to and delete from a list respectively. It is
327: not an error to use the -= operator to remove an element that does not
328: exist in a list.
329:
330: Defaults entries are parsed in the following order: generic, host and
331: user Defaults first, then runas Defaults and finally command defaults.
332:
333: See _S_U_D_O_E_R_S _O_P_T_I_O_N_S for a list of supported Defaults parameters.
334:
335: UUsseerr ssppeecciiffiiccaattiioonn
336: User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
337: (':' Host_List '=' Cmnd_Spec_List)*
338:
339: Cmnd_Spec_List ::= Cmnd_Spec |
340: Cmnd_Spec ',' Cmnd_Spec_List
341:
342: Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Solaris_Priv_Spec? Tag_Spec* Cmnd
343:
344: Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'
345:
346: SELinux_Spec ::= ('ROLE=role' | 'TYPE=type')
347:
348: Solaris_Priv_Spec ::= ('PRIVS=privset' | 'LIMITPRIVS=privset')
349:
350: Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
351: 'SETENV:' | 'NOSETENV:' | 'LOG_INPUT:' | 'NOLOG_INPUT:' |
352: 'LOG_OUTPUT:' | 'NOLOG_OUTPUT:')
353:
354: A uusseerr ssppeecciiffiiccaattiioonn determines which commands a user may run (and as
355: what user) on specified hosts. By default, commands are run as rroooott, but
356: this can be changed on a per-command basis.
357:
358: The basic structure of a user specification is ``who where = (as_whom)
359: what''. Let's break that down into its constituent parts:
360:
361: RRuunnaass__SSppeecc
362: A Runas_Spec determines the user and/or the group that a command may be
363: run as. A fully-specified Runas_Spec consists of two Runas_Lists (as
364: defined above) separated by a colon (`:') and enclosed in a set of
365: parentheses. The first Runas_List indicates which users the command may
366: be run as via ssuuddoo's --uu option. The second defines a list of groups that
367: can be specified via ssuuddoo's --gg option. If both Runas_Lists are
368: specified, the command may be run with any combination of users and
369: groups listed in their respective Runas_Lists. If only the first is
370: specified, the command may be run as any user in the list but no --gg
371: option may be specified. If the first Runas_List is empty but the second
372: is specified, the command may be run as the invoking user with the group
373: set to any listed in the Runas_List. If both Runas_Lists are empty, the
374: command may only be run as the invoking user. If no Runas_Spec is
375: specified the command may be run as rroooott and no group may be specified.
376:
377: A Runas_Spec sets the default for the commands that follow it. What this
378: means is that for the entry:
379:
380: dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
381:
382: The user ddggbb may run _/_b_i_n_/_l_s, _/_b_i_n_/_k_i_l_l, and _/_u_s_r_/_b_i_n_/_l_p_r_m--but only as
383: ooppeerraattoorr. E.g.,
384:
385: $ sudo -u operator /bin/ls
386:
387: It is also possible to override a Runas_Spec later on in an entry. If we
388: modify the entry like so:
389:
390: dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
391:
392: Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but _/_b_i_n_/_k_i_l_l
393: and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
394:
395: We can extend this to allow ddggbb to run /bin/ls with either the user or
396: group set to ooppeerraattoorr:
397:
398: dgb boulder = (operator : operator) /bin/ls, (root) /bin/kill,\
399: /usr/bin/lprm
400:
401: Note that while the group portion of the Runas_Spec permits the user to
402: run as command with that group, it does not force the user to do so. If
403: no group is specified on the command line, the command will run with the
404: group listed in the target user's password database entry. The following
405: would all be permitted by the sudoers entry above:
406:
407: $ sudo -u operator /bin/ls
408: $ sudo -u operator -g operator /bin/ls
409: $ sudo -g operator /bin/ls
410:
411: In the following example, user ttccmm may run commands that access a modem
412: device file with the dialer group.
413:
414: tcm boulder = (:dialer) /usr/bin/tip, /usr/bin/cu,\
415: /usr/local/bin/minicom
416:
417: Note that in this example only the group will be set, the command still
418: runs as user ttccmm. E.g.
419:
420: $ sudo -g dialer /usr/bin/cu
421:
422: Multiple users and groups may be present in a Runas_Spec, in which case
423: the user may select any combination of users and groups via the --uu and --gg
424: options. In this example:
425:
426: alan ALL = (root, bin : operator, system) ALL
427:
428: user aallaann may run any command as either user root or bin, optionally
429: setting the group to operator or system.
430:
431: SSEELLiinnuuxx__SSppeecc
432: On systems with SELinux support, _s_u_d_o_e_r_s entries may optionally have an
433: SELinux role and/or type associated with a command. If a role or type is
434: specified with the command it will override any default values specified
435: in _s_u_d_o_e_r_s. A role or type specified on the command line, however, will
436: supersede the values in _s_u_d_o_e_r_s.
437:
438: SSoollaarriiss__PPrriivv__SSppeecc
439: On Solaris systems, _s_u_d_o_e_r_s entries may optionally specify Solaris
440: privilege set and/or limit privilege set associated with a command. If
441: privileges or limit privileges are specified with the command it will
442: override any default values specified in _s_u_d_o_e_r_s.
443:
444: A privilege set is a comma-separated list of privilege names. The
445: ppriv(1) command can be used to list all privileges known to the system.
446: For example:
447:
448: $ ppriv -l
449:
450: In addition, there are several ``special'' privilege strings:
451:
452: none the empty set
453:
454: all the set of all privileges
455:
456: zone the set of all privileges available in the current zone
457:
458: basic the default set of privileges normal users are granted at login
459: time
460:
461: Privileges can be excluded from a set by prefixing the privilege name
462: with either an `!' or `-' character.
463:
464: TTaagg__SSppeecc
465: A command may have zero or more tags associated with it. There are ten
466: possible tag values: NOPASSWD, PASSWD, NOEXEC, EXEC, SETENV, NOSETENV,
467: LOG_INPUT, NOLOG_INPUT, LOG_OUTPUT and NOLOG_OUTPUT. Once a tag is set
468: on a Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit the tag unless
469: it is overridden by the opposite tag (in other words, PASSWD overrides
470: NOPASSWD and NOEXEC overrides EXEC).
471:
472: _N_O_P_A_S_S_W_D _a_n_d _P_A_S_S_W_D
473:
474: By default, ssuuddoo requires that a user authenticate him or herself before
475: running a command. This behavior can be modified via the NOPASSWD tag.
476: Like a Runas_Spec, the NOPASSWD tag sets a default for the commands that
477: follow it in the Cmnd_Spec_List. Conversely, the PASSWD tag can be used
478: to reverse things. For example:
479:
480: ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
481:
482: would allow the user rraayy to run _/_b_i_n_/_k_i_l_l, _/_b_i_n_/_l_s, and _/_u_s_r_/_b_i_n_/_l_p_r_m as
483: rroooott on the machine rushmore without authenticating himself. If we only
484: want rraayy to be able to run _/_b_i_n_/_k_i_l_l without a password the entry would
485: be:
486:
487: ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
488:
489: Note, however, that the PASSWD tag has no effect on users who are in the
490: group specified by the _e_x_e_m_p_t___g_r_o_u_p option.
491:
492: By default, if the NOPASSWD tag is applied to any of the entries for a
493: user on the current host, he or she will be able to run ``sudo -l''
494: without a password. Additionally, a user may only run ``sudo -v''
495: without a password if the NOPASSWD tag is present for all a user's
496: entries that pertain to the current host. This behavior may be
497: overridden via the _v_e_r_i_f_y_p_w and _l_i_s_t_p_w options.
498:
499: _N_O_E_X_E_C _a_n_d _E_X_E_C
500:
501: If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying
502: operating system supports it, the NOEXEC tag can be used to prevent a
503: dynamically-linked executable from running further commands itself.
504:
505: In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e and
506: _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled.
507:
508: aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
509:
510: See the _P_r_e_v_e_n_t_i_n_g _s_h_e_l_l _e_s_c_a_p_e_s section below for more details on how
511: NOEXEC works and whether or not it will work on your system.
512:
513: _S_E_T_E_N_V _a_n_d _N_O_S_E_T_E_N_V
514:
515: These tags override the value of the _s_e_t_e_n_v option on a per-command
516: basis. Note that if SETENV has been set for a command, the user may
517: disable the _e_n_v___r_e_s_e_t option from the command line via the --EE option.
518: Additionally, environment variables set on the command line are not
519: subject to the restrictions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or
520: _e_n_v___k_e_e_p. As such, only trusted users should be allowed to set variables
521: in this manner. If the command matched is AALLLL, the SETENV tag is implied
522: for that command; this default may be overridden by use of the NOSETENV
523: tag.
524:
525: _L_O_G___I_N_P_U_T _a_n_d _N_O_L_O_G___I_N_P_U_T
526:
527: These tags override the value of the _l_o_g___i_n_p_u_t option on a per-command
528: basis. For more information, see the description of _l_o_g___i_n_p_u_t in the
529: _S_U_D_O_E_R_S _O_P_T_I_O_N_S section below.
530:
531: _L_O_G___O_U_T_P_U_T _a_n_d _N_O_L_O_G___O_U_T_P_U_T
532:
533: These tags override the value of the _l_o_g___o_u_t_p_u_t option on a per-command
534: basis. For more information, see the description of _l_o_g___o_u_t_p_u_t in the
535: _S_U_D_O_E_R_S _O_P_T_I_O_N_S section below.
536:
537: WWiillddccaarrddss
538: ssuuddoo allows shell-style _w_i_l_d_c_a_r_d_s (aka meta or glob characters) to be
539: used in host names, path names and command line arguments in the _s_u_d_o_e_r_s
540: file. Wildcard matching is done via the PPOOSSIIXX glob(3) and fnmatch(3)
541: routines. Note that these are _n_o_t regular expressions.
542:
543: * Matches any set of zero or more characters.
544:
545: ? Matches any single character.
546:
547: [...] Matches any character in the specified range.
548:
549: [!...] Matches any character nnoott in the specified range.
550:
551: \x For any character `x', evaluates to `x'. This is used to
552: escape special characters such as: `*', `?', `[', and `]'.
553:
554: POSIX character classes may also be used if your system's glob(3) and
555: fnmatch(3) functions support them. However, because the `:' character
556: has special meaning in _s_u_d_o_e_r_s, it must be escaped. For example:
557:
558: /bin/ls [[:alpha:]]*
559:
560: Would match any file name beginning with a letter.
561:
562: Note that a forward slash (`/') will nnoott be matched by wildcards used in
563: the path name. This is to make a path like:
564:
565: /usr/bin/*
566:
567: match _/_u_s_r_/_b_i_n_/_w_h_o but not _/_u_s_r_/_b_i_n_/_X_1_1_/_x_t_e_r_m.
568:
569: When matching the command line arguments, however, a slash ddooeess get
570: matched by wildcards since command line arguments may contain arbitrary
571: strings and not just path names.
572:
573: Wildcards in command line arguments should be used with care. Because
574: command line arguments are matched as a single, concatenated string, a
575: wildcard such as `?' or `*' can match multiple words. For example, while
576: a sudoers entry like:
577:
578: %operator ALL = /bin/cat /var/log/messages*
579:
580: will allow command like:
581:
582: $ sudo cat /var/log/messages.1
583:
584: It will also allow:
585:
586: $ sudo cat /var/log/messages /etc/shadow
587:
588: which is probably not what was intended.
589:
590: EExxcceeppttiioonnss ttoo wwiillddccaarrdd rruulleess
591: The following exceptions apply to the above rules:
592:
593: "" If the empty string "" is the only command line argument in the
594: _s_u_d_o_e_r_s entry it means that command is not allowed to be run
595: with aannyy arguments.
596:
597: sudoedit Command line arguments to the _s_u_d_o_e_d_i_t built-in command should
598: always be path names, so a forward slash (`/') will not be
599: matched by a wildcard.
600:
601: IInncclluuddiinngg ootthheerr ffiilleess ffrroomm wwiitthhiinn ssuuddooeerrss
602: It is possible to include other _s_u_d_o_e_r_s files from within the _s_u_d_o_e_r_s
603: file currently being parsed using the #include and #includedir
604: directives.
605:
606: This can be used, for example, to keep a site-wide _s_u_d_o_e_r_s file in
607: addition to a local, per-machine file. For the sake of this example the
608: site-wide _s_u_d_o_e_r_s will be _/_e_t_c_/_s_u_d_o_e_r_s and the per-machine one will be
609: _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l. To include _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l from within
610: _/_e_t_c_/_s_u_d_o_e_r_s we would use the following line in _/_e_t_c_/_s_u_d_o_e_r_s:
611:
612: #include /etc/sudoers.local
613:
614: When ssuuddoo reaches this line it will suspend processing of the current
615: file (_/_e_t_c_/_s_u_d_o_e_r_s) and switch to _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l. Upon reaching the
616: end of _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l, the rest of _/_e_t_c_/_s_u_d_o_e_r_s will be processed.
617: Files that are included may themselves include other files. A hard limit
618: of 128 nested include files is enforced to prevent include file loops.
619:
620: If the path to the include file is not fully-qualified (does not begin
621: with a `/', it must be located in the same directory as the sudoers file
622: it was included from. For example, if _/_e_t_c_/_s_u_d_o_e_r_s contains the line:
623:
624: #include sudoers.local
625:
626: the file that will be included is _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l.
627:
628: The file name may also include the %h escape, signifying the short form
629: of the host name. In other words, if the machine's host name is
630: ``xerxes'', then
631:
632: #include /etc/sudoers.%h
633:
634: will cause ssuuddoo to include the file _/_e_t_c_/_s_u_d_o_e_r_s_._x_e_r_x_e_s.
635:
636: The #includedir directive can be used to create a _s_u_d_o_._d directory that
637: the system package manager can drop _s_u_d_o_e_r_s rules into as part of package
638: installation. For example, given:
639:
640: #includedir /etc/sudoers.d
641:
642: ssuuddoo will read each file in _/_e_t_c_/_s_u_d_o_e_r_s_._d, skipping file names that end
643: in `~' or contain a `.' character to avoid causing problems with package
644: manager or editor temporary/backup files. Files are parsed in sorted
645: lexical order. That is, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_0_1___f_i_r_s_t will be parsed before
646: _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d. Be aware that because the sorting is lexical,
647: not numeric, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1___w_h_o_o_p_s would be loaded aafftteerr
648: _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d. Using a consistent number of leading zeroes in
649: the file names can be used to avoid such problems.
650:
651: Note that unlike files included via #include, vviissuuddoo will not edit the
652: files in a #includedir directory unless one of them contains a syntax
653: error. It is still possible to run vviissuuddoo with the --ff flag to edit the
654: files directly.
655:
656: OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss
657: The pound sign (`#') is used to indicate a comment (unless it is part of
658: a #include directive or unless it occurs in the context of a user name
659: and is followed by one or more digits, in which case it is treated as a
660: uid). Both the comment character and any text after it, up to the end of
661: the line, are ignored.
662:
663: The reserved word AALLLL is a built-in _a_l_i_a_s that always causes a match to
664: succeed. It can be used wherever one might otherwise use a Cmnd_Alias,
665: User_Alias, Runas_Alias, or Host_Alias. You should not try to define
666: your own _a_l_i_a_s called AALLLL as the built-in alias will be used in
667: preference to your own. Please note that using AALLLL can be dangerous
668: since in a command context, it allows the user to run aannyy command on the
669: system.
670:
671: An exclamation point (`!') can be used as a logical _n_o_t operator both in
672: an _a_l_i_a_s and in front of a Cmnd. This allows one to exclude certain
673: values. Note, however, that using a `!' in conjunction with the built-in
674: AALLLL alias to allow a user to run ``all but a few'' commands rarely works
675: as intended (see _S_E_C_U_R_I_T_Y _N_O_T_E_S below).
676:
677: Long lines can be continued with a backslash (`\') as the last character
678: on the line.
679:
680: White space between elements in a list as well as special syntactic
681: characters in a _U_s_e_r _S_p_e_c_i_f_i_c_a_t_i_o_n (`=', `:', `(', `)') is optional.
682:
683: The following characters must be escaped with a backslash (`\') when used
684: as part of a word (e.g. a user name or host name): `!', `=', `:', `,',
685: `(', `)', `\'.
686:
687: SSUUDDOOEERRSS OOPPTTIIOONNSS
688: ssuuddoo's behavior can be modified by Default_Entry lines, as explained
689: earlier. A list of all supported Defaults parameters, grouped by type,
690: are listed below.
691:
692: BBoooolleeaann FFllaaggss:
693:
694: always_set_home If enabled, ssuuddoo will set the HOME environment variable
695: to the home directory of the target user (which is root
696: unless the --uu option is used). This effectively means
697: that the --HH option is always implied. Note that HOME
698: is already set when the the _e_n_v___r_e_s_e_t option is
699: enabled, so _a_l_w_a_y_s___s_e_t___h_o_m_e is only effective for
700: configurations where either _e_n_v___r_e_s_e_t is disabled or
701: HOME is present in the _e_n_v___k_e_e_p list. This flag is _o_f_f
702: by default.
703:
704: authenticate If set, users must authenticate themselves via a
705: password (or other means of authentication) before they
706: may run commands. This default may be overridden via
707: the PASSWD and NOPASSWD tags. This flag is _o_n by
708: default.
709:
710: closefrom_override
711: If set, the user may use ssuuddoo's --CC option which
712: overrides the default starting point at which ssuuddoo
713: begins closing open file descriptors. This flag is _o_f_f
714: by default.
715:
716: compress_io If set, and ssuuddoo is configured to log a command's input
717: or output, the I/O logs will be compressed using zzlliibb.
718: This flag is _o_n by default when ssuuddoo is compiled with
719: zzlliibb support.
720:
721: env_editor If set, vviissuuddoo will use the value of the EDITOR or
722: VISUAL environment variables before falling back on the
723: default editor list. Note that this may create a
724: security hole as it allows the user to run any
725: arbitrary command as root without logging. A safer
726: alternative is to place a colon-separated list of
727: editors in the editor variable. vviissuuddoo will then only
728: use the EDITOR or VISUAL if they match a value
729: specified in editor. This flag is _o_f_f by default.
730:
731: env_reset If set, ssuuddoo will run the command in a minimal
732: environment containing the TERM, PATH, HOME, MAIL,
733: SHELL, LOGNAME, USER, USERNAME and SUDO_* variables.
734: Any variables in the caller's environment that match
735: the env_keep and env_check lists are then added,
736: followed by any variables present in the file specified
737: by the _e_n_v___f_i_l_e option (if any). The default contents
738: of the env_keep and env_check lists are displayed when
739: ssuuddoo is run by root with the --VV option. If the
740: _s_e_c_u_r_e___p_a_t_h option is set, its value will be used for
741: the PATH environment variable. This flag is _o_n by
742: default.
743:
744: fast_glob Normally, ssuuddoo uses the glob(3) function to do shell-
745: style globbing when matching path names. However,
746: since it accesses the file system, glob(3) can take a
747: long time to complete for some patterns, especially
748: when the pattern references a network file system that
749: is mounted on demand (auto mounted). The _f_a_s_t___g_l_o_b
750: option causes ssuuddoo to use the fnmatch(3) function,
751: which does not access the file system to do its
752: matching. The disadvantage of _f_a_s_t___g_l_o_b is that it is
753: unable to match relative path names such as _._/_l_s or
754: _._._/_b_i_n_/_l_s. This has security implications when path
755: names that include globbing characters are used with
756: the negation operator, `!', as such rules can be
757: trivially bypassed. As such, this option should not be
758: used when _s_u_d_o_e_r_s contains rules that contain negated
759: path names which include globbing characters. This
760: flag is _o_f_f by default.
761:
762: fqdn Set this flag if you want to put fully qualified host
763: names in the _s_u_d_o_e_r_s file when the local host name (as
764: returned by the hostname command) does not contain the
765: domain name. In other words, instead of myhost you
766: would use myhost.mydomain.edu. You may still use the
767: short form if you wish (and even mix the two). This
768: option is only effective when the ``canonical'' host
769: name, as returned by the ggeettaaddddrriinnffoo() or
770: ggeetthhoossttbbyynnaammee() function, is a fully-qualified domain
771: name. This is usually the case when the system is
772: configured to use DNS for host name resolution.
773:
774: If the system is configured to use the _/_e_t_c_/_h_o_s_t_s file
775: in preference to DNS, the ``canonical'' host name may
776: not be fully-qualified. The order that sources are
777: queried for hosts name resolution is usually specified
778: in the _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f, _/_e_t_c_/_n_e_t_s_v_c_._c_o_n_f,
779: _/_e_t_c_/_h_o_s_t_._c_o_n_f, or, in some cases, _/_e_t_c_/_r_e_s_o_l_v_._c_o_n_f
780: file. In the _/_e_t_c_/_h_o_s_t_s file, the first host name of
781: the entry is considered to be the ``canonical'' name;
782: subsequent names are aliases that are not used by
783: ssuuddooeerrss. For example, the following hosts file line
784: for the machine ``xyzzy'' has the fully-qualified
785: domain name as the ``canonical'' host name, and the
786: short version as an alias.
787:
788: 192.168.1.1 xyzzy.sudo.ws xyzzy
789:
790: If the machine's hosts file entry is not formatted
791: properly, the _f_q_d_n option will not be effective if it
792: is queried before DNS.
793:
794: Beware that when using DNS for host name resolution,
795: turning on _f_q_d_n requires ssuuddooeerrss to make DNS lookups
796: which renders ssuuddoo unusable if DNS stops working (for
797: example if the machine is disconnected from the
798: network). Also note that just like with the hosts
799: file, you must use the ``canonical'' name as DNS knows
800: it. That is, you may not use a host alias (CNAME
801: entry) due to performance issues and the fact that
802: there is no way to get all aliases from DNS.
803:
804: This flag is _o_f_f by default.
805:
806: ignore_dot If set, ssuuddoo will ignore "." or "" (both denoting
807: current directory) in the PATH environment variable;
808: the PATH itself is not modified. This flag is _o_f_f by
809: default.
810:
811: ignore_local_sudoers
812: If set via LDAP, parsing of _/_e_t_c_/_s_u_d_o_e_r_s will be
813: skipped. This is intended for Enterprises that wish to
814: prevent the usage of local sudoers files so that only
815: LDAP is used. This thwarts the efforts of rogue
816: operators who would attempt to add roles to
817: _/_e_t_c_/_s_u_d_o_e_r_s. When this option is present,
818: _/_e_t_c_/_s_u_d_o_e_r_s does not even need to exist. Since this
819: option tells ssuuddoo how to behave when no specific LDAP
820: entries have been matched, this sudoOption is only
821: meaningful for the cn=defaults section. This flag is
822: _o_f_f by default.
823:
824: insults If set, ssuuddoo will insult users when they enter an
825: incorrect password. This flag is _o_f_f by default.
826:
827: log_host If set, the host name will be logged in the (non-
828: syslog) ssuuddoo log file. This flag is _o_f_f by default.
829:
830: log_input If set, ssuuddoo will run the command in a _p_s_e_u_d_o _t_t_y and
831: log all user input. If the standard input is not
832: connected to the user's tty, due to I/O redirection or
833: because the command is part of a pipeline, that input
834: is also captured and stored in a separate log file.
835:
836: Input is logged to the directory specified by the
837: _i_o_l_o_g___d_i_r option (_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o by default) using a
838: unique session ID that is included in the normal ssuuddoo
839: log line, prefixed with ``TSID=''. The _i_o_l_o_g___f_i_l_e
840: option may be used to control the format of the session
841: ID.
842:
843: Note that user input may contain sensitive information
844: such as passwords (even if they are not echoed to the
845: screen), which will be stored in the log file
846: unencrypted. In most cases, logging the command output
847: via _l_o_g___o_u_t_p_u_t is all that is required.
848:
849: log_output If set, ssuuddoo will run the command in a _p_s_e_u_d_o _t_t_y and
850: log all output that is sent to the screen, similar to
851: the script(1) command. If the standard output or
852: standard error is not connected to the user's tty, due
853: to I/O redirection or because the command is part of a
854: pipeline, that output is also captured and stored in
855: separate log files.
856:
857: Output is logged to the directory specified by the
858: _i_o_l_o_g___d_i_r option (_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o by default) using a
859: unique session ID that is included in the normal ssuuddoo
860: log line, prefixed with ``TSID=''. The _i_o_l_o_g___f_i_l_e
861: option may be used to control the format of the session
862: ID.
863:
864: Output logs may be viewed with the sudoreplay(1m)
865: utility, which can also be used to list or search the
866: available logs.
867:
868: log_year If set, the four-digit year will be logged in the (non-
869: syslog) ssuuddoo log file. This flag is _o_f_f by default.
870:
871: long_otp_prompt When validating with a One Time Password (OTP) scheme
872: such as SS//KKeeyy or OOPPIIEE, a two-line prompt is used to
873: make it easier to cut and paste the challenge to a
874: local window. It's not as pretty as the default but
875: some people find it more convenient. This flag is _o_f_f
876: by default.
877:
878: mail_always Send mail to the _m_a_i_l_t_o user every time a users runs
879: ssuuddoo. This flag is _o_f_f by default.
880:
881: mail_badpass Send mail to the _m_a_i_l_t_o user if the user running ssuuddoo
882: does not enter the correct password. If the command
883: the user is attempting to run is not permitted by
884: _s_u_d_o_e_r_s and one of the _m_a_i_l___a_l_w_a_y_s, _m_a_i_l___n_o___h_o_s_t,
885: _m_a_i_l___n_o___p_e_r_m_s or _m_a_i_l___n_o___u_s_e_r flags are set, this flag
886: will have no effect. This flag is _o_f_f by default.
887:
888: mail_no_host If set, mail will be sent to the _m_a_i_l_t_o user if the
889: invoking user exists in the _s_u_d_o_e_r_s file, but is not
890: allowed to run commands on the current host. This flag
891: is _o_f_f by default.
892:
893: mail_no_perms If set, mail will be sent to the _m_a_i_l_t_o user if the
894: invoking user is allowed to use ssuuddoo but the command
895: they are trying is not listed in their _s_u_d_o_e_r_s file
896: entry or is explicitly denied. This flag is _o_f_f by
897: default.
898:
899: mail_no_user If set, mail will be sent to the _m_a_i_l_t_o user if the
900: invoking user is not in the _s_u_d_o_e_r_s file. This flag is
901: _o_n by default.
902:
903: noexec If set, all commands run via ssuuddoo will behave as if the
904: NOEXEC tag has been set, unless overridden by a EXEC
905: tag. See the description of _N_O_E_X_E_C _a_n_d _E_X_E_C below as
906: well as the _P_r_e_v_e_n_t_i_n_g _s_h_e_l_l _e_s_c_a_p_e_s section at the end
907: of this manual. This flag is _o_f_f by default.
908:
909: path_info Normally, ssuuddoo will tell the user when a command could
910: not be found in their PATH environment variable. Some
911: sites may wish to disable this as it could be used to
912: gather information on the location of executables that
913: the normal user does not have access to. The
914: disadvantage is that if the executable is simply not in
915: the user's PATH, ssuuddoo will tell the user that they are
916: not allowed to run it, which can be confusing. This
917: flag is _o_n by default.
918:
919: passprompt_override
920: The password prompt specified by _p_a_s_s_p_r_o_m_p_t will
921: normally only be used if the password prompt provided
922: by systems such as PAM matches the string
923: ``Password:''. If _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e is set,
924: _p_a_s_s_p_r_o_m_p_t will always be used. This flag is _o_f_f by
925: default.
926:
927: preserve_groups By default, ssuuddoo will initialize the group vector to
928: the list of groups the target user is in. When
929: _p_r_e_s_e_r_v_e___g_r_o_u_p_s is set, the user's existing group
930: vector is left unaltered. The real and effective group
931: IDs, however, are still set to match the target user.
932: This flag is _o_f_f by default.
933:
934: pwfeedback By default, ssuuddoo reads the password like most other
935: Unix programs, by turning off echo until the user hits
936: the return (or enter) key. Some users become confused
937: by this as it appears to them that ssuuddoo has hung at
938: this point. When _p_w_f_e_e_d_b_a_c_k is set, ssuuddoo will provide
939: visual feedback when the user presses a key. Note that
940: this does have a security impact as an onlooker may be
941: able to determine the length of the password being
942: entered. This flag is _o_f_f by default.
943:
944: requiretty If set, ssuuddoo will only run when the user is logged in
945: to a real tty. When this flag is set, ssuuddoo can only be
946: run from a login session and not via other means such
947: as cron(1m) or cgi-bin scripts. This flag is _o_f_f by
948: default.
949:
950: root_sudo If set, root is allowed to run ssuuddoo too. Disabling
951: this prevents users from ``chaining'' ssuuddoo commands to
952: get a root shell by doing something like ``sudo sudo
953: /bin/sh''. Note, however, that turning off _r_o_o_t___s_u_d_o
954: will also prevent root from running ssuuddooeeddiitt.
955: Disabling _r_o_o_t___s_u_d_o provides no real additional
956: security; it exists purely for historical reasons.
957: This flag is _o_n by default.
958:
959: rootpw If set, ssuuddoo will prompt for the root password instead
960: of the password of the invoking user. This flag is _o_f_f
961: by default.
962:
963: runaspw If set, ssuuddoo will prompt for the password of the user
964: defined by the _r_u_n_a_s___d_e_f_a_u_l_t option (defaults to root)
965: instead of the password of the invoking user. This
966: flag is _o_f_f by default.
967:
968: set_home If enabled and ssuuddoo is invoked with the --ss option the
969: HOME environment variable will be set to the home
970: directory of the target user (which is root unless the
971: --uu option is used). This effectively makes the --ss
972: option imply --HH. Note that HOME is already set when
973: the the _e_n_v___r_e_s_e_t option is enabled, so _s_e_t___h_o_m_e is
974: only effective for configurations where either
975: _e_n_v___r_e_s_e_t is disabled or HOME is present in the
976: _e_n_v___k_e_e_p list. This flag is _o_f_f by default.
977:
978: set_logname Normally, ssuuddoo will set the LOGNAME, USER and USERNAME
979: environment variables to the name of the target user
980: (usually root unless the --uu option is given). However,
981: since some programs (including the RCS revision control
982: system) use LOGNAME to determine the real identity of
983: the user, it may be desirable to change this behavior.
984: This can be done by negating the set_logname option.
985: Note that if the _e_n_v___r_e_s_e_t option has not been
986: disabled, entries in the _e_n_v___k_e_e_p list will override
987: the value of _s_e_t___l_o_g_n_a_m_e. This flag is _o_n by default.
988:
989: set_utmp When enabled, ssuuddoo will create an entry in the utmp (or
990: utmpx) file when a pseudo-tty is allocated. A pseudo-
991: tty is allocated by ssuuddoo when the _l_o_g___i_n_p_u_t, _l_o_g___o_u_t_p_u_t
992: or _u_s_e___p_t_y flags are enabled. By default, the new
993: entry will be a copy of the user's existing utmp entry
994: (if any), with the tty, time, type and pid fields
995: updated. This flag is _o_n by default.
996:
997: setenv Allow the user to disable the _e_n_v___r_e_s_e_t option from the
998: command line via the --EE option. Additionally,
999: environment variables set via the command line are not
1000: subject to the restrictions imposed by _e_n_v___c_h_e_c_k,
1001: _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p. As such, only trusted users
1002: should be allowed to set variables in this manner.
1003: This flag is _o_f_f by default.
1004:
1005: shell_noargs If set and ssuuddoo is invoked with no arguments it acts as
1006: if the --ss option had been given. That is, it runs a
1007: shell as root (the shell is determined by the SHELL
1008: environment variable if it is set, falling back on the
1009: shell listed in the invoking user's /etc/passwd entry
1010: if not). This flag is _o_f_f by default.
1011:
1012: stay_setuid Normally, when ssuuddoo executes a command the real and
1013: effective UIDs are set to the target user (root by
1014: default). This option changes that behavior such that
1015: the real UID is left as the invoking user's UID. In
1016: other words, this makes ssuuddoo act as a setuid wrapper.
1017: This can be useful on systems that disable some
1018: potentially dangerous functionality when a program is
1019: run setuid. This option is only effective on systems
1020: that support either the setreuid(2) or setresuid(2)
1021: system call. This flag is _o_f_f by default.
1022:
1023: targetpw If set, ssuuddoo will prompt for the password of the user
1024: specified by the --uu option (defaults to root) instead
1025: of the password of the invoking user. In addition, the
1026: time stamp file name will include the target user's
1027: name. Note that this flag precludes the use of a uid
1028: not listed in the passwd database as an argument to the
1029: --uu option. This flag is _o_f_f by default.
1030:
1031: tty_tickets If set, users must authenticate on a per-tty basis.
1032: With this flag enabled, ssuuddoo will use a file named for
1033: the tty the user is logged in on in the user's time
1034: stamp directory. If disabled, the time stamp of the
1035: directory is used instead. This flag is _o_n by default.
1036:
1037: umask_override If set, ssuuddoo will set the umask as specified by _s_u_d_o_e_r_s
1038: without modification. This makes it possible to
1039: specify a more permissive umask in _s_u_d_o_e_r_s than the
1040: user's own umask and matches historical behavior. If
1041: _u_m_a_s_k___o_v_e_r_r_i_d_e is not set, ssuuddoo will set the umask to
1042: be the union of the user's umask and what is specified
1043: in _s_u_d_o_e_r_s. This flag is _o_f_f by default.
1044:
1045: use_loginclass If set, ssuuddoo will apply the defaults specified for the
1046: target user's login class if one exists. Only
1047: available if ssuuddoo is configured with the
1048: --with-logincap option. This flag is _o_f_f by default.
1049:
1050: use_pty If set, ssuuddoo will run the command in a pseudo-pty even
1051: if no I/O logging is being gone. A malicious program
1052: run under ssuuddoo could conceivably fork a background
1053: process that retains to the user's terminal device
1054: after the main program has finished executing. Use of
1055: this option will make that impossible. This flag is
1056: _o_f_f by default.
1057:
1058: utmp_runas If set, ssuuddoo will store the name of the runas user when
1059: updating the utmp (or utmpx) file. By default, ssuuddoo
1060: stores the name of the invoking user. This flag is _o_f_f
1061: by default.
1062:
1063: visiblepw By default, ssuuddoo will refuse to run if the user must
1064: enter a password but it is not possible to disable echo
1065: on the terminal. If the _v_i_s_i_b_l_e_p_w flag is set, ssuuddoo
1066: will prompt for a password even when it would be
1067: visible on the screen. This makes it possible to run
1068: things like ``ssh somehost sudo ls'' since by default,
1069: ssh(1) does not allocate a tty when running a command.
1070: This flag is _o_f_f by default.
1071:
1072: IInntteeggeerrss:
1073:
1074: closefrom Before it executes a command, ssuuddoo will close all open
1075: file descriptors other than standard input, standard
1076: output and standard error (ie: file descriptors 0-2).
1077: The _c_l_o_s_e_f_r_o_m option can be used to specify a different
1078: file descriptor at which to start closing. The default
1079: is 3.
1080:
1081: passwd_tries The number of tries a user gets to enter his/her
1082: password before ssuuddoo logs the failure and exits. The
1083: default is 3.
1084:
1085: IInntteeggeerrss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
1086:
1087: loglinelen Number of characters per line for the file log. This
1088: value is used to decide when to wrap lines for nicer
1089: log files. This has no effect on the syslog log file,
1090: only the file log. The default is 80 (use 0 or negate
1091: the option to disable word wrap).
1092:
1093: passwd_timeout Number of minutes before the ssuuddoo password prompt times
1094: out, or 0 for no timeout. The timeout may include a
1095: fractional component if minute granularity is
1096: insufficient, for example 2.5. The default is 5.
1097:
1098: timestamp_timeout
1099: Number of minutes that can elapse before ssuuddoo will ask
1100: for a passwd again. The timeout may include a
1101: fractional component if minute granularity is
1102: insufficient, for example 2.5. The default is 5. Set
1103: this to 0 to always prompt for a password. If set to a
1104: value less than 0 the user's time stamp will never
1105: expire. This can be used to allow users to create or
1106: delete their own time stamps via ``sudo -v'' and ``sudo
1107: -k'' respectively.
1108:
1109: umask Umask to use when running the command. Negate this
1110: option or set it to 0777 to preserve the user's umask.
1111: The actual umask that is used will be the union of the
1112: user's umask and the value of the _u_m_a_s_k option, which
1113: defaults to 0022. This guarantees that ssuuddoo never
1114: lowers the umask when running a command. Note: on
1115: systems that use PAM, the default PAM configuration may
1116: specify its own umask which will override the value set
1117: in _s_u_d_o_e_r_s.
1118:
1119: SSttrriinnggss:
1120:
1121: badpass_message Message that is displayed if a user enters an incorrect
1122: password. The default is Sorry, try again. unless
1123: insults are enabled.
1124:
1125: editor A colon (`:') separated list of editors allowed to be
1126: used with vviissuuddoo. vviissuuddoo will choose the editor that
1127: matches the user's EDITOR environment variable if
1128: possible, or the first editor in the list that exists
1129: and is executable. The default is _v_i.
1130:
1131: iolog_dir The top-level directory to use when constructing the
1132: path name for the input/output log directory. Only
1133: used if the _l_o_g___i_n_p_u_t or _l_o_g___o_u_t_p_u_t options are enabled
1134: or when the LOG_INPUT or LOG_OUTPUT tags are present
1135: for a command. The session sequence number, if any, is
1136: stored in the directory. The default is
1137: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o.
1138:
1139: The following percent (`%') escape sequences are
1140: supported:
1141:
1142: %{seq}
1143: expanded to a monotonically increasing base-36
1144: sequence number, such as 0100A5, where every two
1145: digits are used to form a new directory, e.g.
1146: _0_1_/_0_0_/_A_5
1147:
1148: %{user}
1149: expanded to the invoking user's login name
1150:
1151: %{group}
1152: expanded to the name of the invoking user's real
1153: group ID
1154:
1155: %{runas_user}
1156: expanded to the login name of the user the
1157: command will be run as (e.g. root)
1158:
1159: %{runas_group}
1160: expanded to the group name of the user the
1161: command will be run as (e.g. wheel)
1162:
1163: %{hostname}
1164: expanded to the local host name without the
1165: domain name
1166:
1167: %{command}
1168: expanded to the base name of the command being
1169: run
1170:
1171: In addition, any escape sequences supported by the
1172: system's strftime(3) function will be expanded.
1173:
1174: To include a literal `%' character, the string `%%'
1175: should be used.
1176:
1177: iolog_file The path name, relative to _i_o_l_o_g___d_i_r, in which to store
1178: input/output logs when the _l_o_g___i_n_p_u_t or _l_o_g___o_u_t_p_u_t
1179: options are enabled or when the LOG_INPUT or LOG_OUTPUT
1180: tags are present for a command. Note that _i_o_l_o_g___f_i_l_e
1181: may contain directory components. The default is
1182: ``%{seq}''.
1183:
1184: See the _i_o_l_o_g___d_i_r option above for a list of supported
1185: percent (`%') escape sequences.
1186:
1187: In addition to the escape sequences, path names that
1188: end in six or more Xs will have the Xs replaced with a
1189: unique combination of digits and letters, similar to
1190: the mktemp(3) function.
1191:
1192: limitprivs The default Solaris limit privileges to use when
1193: constructing a new privilege set for a command. This
1194: bounds all privileges of the executing process. The
1195: default limit privileges may be overridden on a per-
1196: command basis in _s_u_d_o_e_r_s. This option is only
1197: available if ssuuddooeerrss is built on Solaris 10 or higher.
1198:
1199: mailsub Subject of the mail sent to the _m_a_i_l_t_o user. The
1200: escape %h will expand to the host name of the machine.
1201: Default is ``*** SECURITY information for %h ***''.
1202:
1203: noexec_file This option is no longer supported. The path to the
1204: noexec file should now be set in the _/_e_t_c_/_s_u_d_o_._c_o_n_f
1205: file.
1206:
1207: passprompt The default prompt to use when asking for a password;
1208: can be overridden via the --pp option or the SUDO_PROMPT
1209: environment variable. The following percent (`%')
1210: escape sequences are supported:
1211:
1212: %H expanded to the local host name including the
1213: domain name (only if the machine's host name is
1214: fully qualified or the _f_q_d_n option is set)
1215:
1216: %h expanded to the local host name without the
1217: domain name
1218:
1219: %p expanded to the user whose password is being
1220: asked for (respects the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and
1221: _r_u_n_a_s_p_w flags in _s_u_d_o_e_r_s)
1222:
1223: %U expanded to the login name of the user the
1224: command will be run as (defaults to root)
1225:
1226: %u expanded to the invoking user's login name
1227:
1228: %% two consecutive % characters are collapsed into a
1229: single % character
1230:
1231: The default value is ``Password:''.
1232:
1233: privs The default Solaris privileges to use when constructing
1234: a new privilege set for a command. This is passed to
1235: the executing process via the inherited privilege set,
1236: but is bounded by the limit privileges. If the _p_r_i_v_s
1237: option is specified but the _l_i_m_i_t_p_r_i_v_s option is not,
1238: the limit privileges of the executing process is set to
1239: _p_r_i_v_s. The default privileges may be overridden on a
1240: per-command basis in _s_u_d_o_e_r_s. This option is only
1241: available if ssuuddooeerrss is built on Solaris 10 or higher.
1242:
1243: role The default SELinux role to use when constructing a new
1244: security context to run the command. The default role
1245: may be overridden on a per-command basis in _s_u_d_o_e_r_s or
1246: via command line options. This option is only
1247: available when ssuuddoo is built with SELinux support.
1248:
1249: runas_default The default user to run commands as if the --uu option is
1250: not specified on the command line. This defaults to
1251: root.
1252:
1253: syslog_badpri Syslog priority to use when user authenticates
1254: unsuccessfully. Defaults to alert.
1255:
1256: The following syslog priorities are supported: aalleerrtt,
1257: ccrriitt, ddeebbuugg, eemmeerrgg, eerrrr, iinnffoo, nnoottiiccee, and wwaarrnniinngg.
1258:
1259: syslog_goodpri Syslog priority to use when user authenticates
1260: successfully. Defaults to notice.
1261:
1262: See _s_y_s_l_o_g___b_a_d_p_r_i for the list of supported syslog
1263: priorities.
1264:
1265: sudoers_locale Locale to use when parsing the sudoers file, logging
1266: commands, and sending email. Note that changing the
1267: locale may affect how sudoers is interpreted. Defaults
1268: to ``C''.
1269:
1270: timestampdir The directory in which ssuuddoo stores its time stamp
1271: files. The default is _/_v_a_r_/_a_d_m_/_s_u_d_o.
1272:
1273: timestampowner The owner of the time stamp directory and the time
1274: stamps stored therein. The default is root.
1275:
1276: type The default SELinux type to use when constructing a new
1277: security context to run the command. The default type
1278: may be overridden on a per-command basis in _s_u_d_o_e_r_s or
1279: via command line options. This option is only
1280: available when ssuuddoo is built with SELinux support.
1281:
1282: SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
1283:
1284: env_file The _e_n_v___f_i_l_e option specifies the fully qualified path to a
1285: file containing variables to be set in the environment of
1286: the program being run. Entries in this file should either
1287: be of the form ``VARIABLE=value'' or ``export
1288: VARIABLE=value''. The value may optionally be surrounded
1289: by single or double quotes. Variables in this file are
1290: subject to other ssuuddoo environment settings such as _e_n_v___k_e_e_p
1291: and _e_n_v___c_h_e_c_k.
1292:
1293: exempt_group Users in this group are exempt from password and PATH
1294: requirements. The group name specified should not include
1295: a % prefix. This is not set by default.
1296:
1297: group_plugin A string containing a _s_u_d_o_e_r_s group plugin with optional
1298: arguments. This can be used to implement support for the
1299: nonunix_group syntax described earlier. The string should
1300: consist of the plugin path, either fully-qualified or
1301: relative to the _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c directory, followed by
1302: any configuration arguments the plugin requires. These
1303: arguments (if any) will be passed to the plugin's
1304: initialization function. If arguments are present, the
1305: string must be enclosed in double quotes ("").
1306:
1307: For example, given _/_e_t_c_/_s_u_d_o_-_g_r_o_u_p, a group file in Unix
1308: group format, the sample group plugin can be used:
1309:
1310: Defaults group_plugin="sample_group.so /etc/sudo-group"
1311:
1312: For more information see sudo_plugin(4).
1313:
1314: lecture This option controls when a short lecture will be printed
1315: along with the password prompt. It has the following
1316: possible values:
1317:
1318: always Always lecture the user.
1319:
1320: never Never lecture the user.
1321:
1322: once Only lecture the user the first time they run ssuuddoo.
1323:
1324: If no value is specified, a value of _o_n_c_e is implied.
1325: Negating the option results in a value of _n_e_v_e_r being used.
1326: The default value is _o_n_c_e.
1327:
1328: lecture_file Path to a file containing an alternate ssuuddoo lecture that
1329: will be used in place of the standard lecture if the named
1330: file exists. By default, ssuuddoo uses a built-in lecture.
1331:
1332: listpw This option controls when a password will be required when
1333: a user runs ssuuddoo with the --ll option. It has the following
1334: possible values:
1335:
1336: all All the user's _s_u_d_o_e_r_s entries for the current
1337: host must have the NOPASSWD flag set to avoid
1338: entering a password.
1339:
1340: always The user must always enter a password to use the
1341: --ll option.
1342:
1343: any At least one of the user's _s_u_d_o_e_r_s entries for
1344: the current host must have the NOPASSWD flag set
1345: to avoid entering a password.
1346:
1347: never The user need never enter a password to use the
1348: --ll option.
1349:
1350: If no value is specified, a value of _a_n_y is implied.
1351: Negating the option results in a value of _n_e_v_e_r being used.
1352: The default value is _a_n_y.
1353:
1354: logfile Path to the ssuuddoo log file (not the syslog log file).
1355: Setting a path turns on logging to a file; negating this
1356: option turns it off. By default, ssuuddoo logs via syslog.
1357:
1358: mailerflags Flags to use when invoking mailer. Defaults to --tt.
1359:
1360: mailerpath Path to mail program used to send warning mail. Defaults
1361: to the path to sendmail found at configure time.
1362:
1363: mailfrom Address to use for the ``from'' address when sending
1364: warning and error mail. The address should be enclosed in
1365: double quotes ("") to protect against ssuuddoo interpreting the
1366: @ sign. Defaults to the name of the user running ssuuddoo.
1367:
1368: mailto Address to send warning and error mail to. The address
1369: should be enclosed in double quotes ("") to protect against
1370: ssuuddoo interpreting the @ sign. Defaults to root.
1371:
1372: secure_path Path used for every command run from ssuuddoo. If you don't
1373: trust the people running ssuuddoo to have a sane PATH
1374: environment variable you may want to use this. Another use
1375: is if you want to have the ``root path'' be separate from
1376: the ``user path''. Users in the group specified by the
1377: _e_x_e_m_p_t___g_r_o_u_p option are not affected by _s_e_c_u_r_e___p_a_t_h. This
1378: option is not set by default.
1379:
1380: syslog Syslog facility if syslog is being used for logging (negate
1381: to disable syslog logging). Defaults to auth.
1382:
1383: The following syslog facilities are supported: aauutthhpprriivv (if
1384: your OS supports it), aauutthh, ddaaeemmoonn, uusseerr, llooccaall00, llooccaall11,
1385: llooccaall22, llooccaall33, llooccaall44, llooccaall55, llooccaall66, and llooccaall77.
1386:
1387: verifypw This option controls when a password will be required when
1388: a user runs ssuuddoo with the --vv option. It has the following
1389: possible values:
1390:
1391: all All the user's _s_u_d_o_e_r_s entries for the current host
1392: must have the NOPASSWD flag set to avoid entering a
1393: password.
1394:
1395: always The user must always enter a password to use the --vv
1396: option.
1397:
1398: any At least one of the user's _s_u_d_o_e_r_s entries for the
1399: current host must have the NOPASSWD flag set to
1400: avoid entering a password.
1401:
1402: never The user need never enter a password to use the --vv
1403: option.
1404:
1405: If no value is specified, a value of _a_l_l is implied.
1406: Negating the option results in a value of _n_e_v_e_r being used.
1407: The default value is _a_l_l.
1408:
1409: LLiissttss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
1410:
1411: env_check Environment variables to be removed from the user's
1412: environment if the variable's value contains `%' or `/'
1413: characters. This can be used to guard against printf-
1414: style format vulnerabilities in poorly-written
1415: programs. The argument may be a double-quoted, space-
1416: separated list or a single value without double-quotes.
1417: The list can be replaced, added to, deleted from, or
1418: disabled by using the =, +=, -=, and ! operators
1419: respectively. Regardless of whether the env_reset
1420: option is enabled or disabled, variables specified by
1421: env_check will be preserved in the environment if they
1422: pass the aforementioned check. The default list of
1423: environment variables to check is displayed when ssuuddoo
1424: is run by root with the --VV option.
1425:
1426: env_delete Environment variables to be removed from the user's
1427: environment when the _e_n_v___r_e_s_e_t option is not in effect.
1428: The argument may be a double-quoted, space-separated
1429: list or a single value without double-quotes. The list
1430: can be replaced, added to, deleted from, or disabled by
1431: using the =, +=, -=, and ! operators respectively. The
1432: default list of environment variables to remove is
1433: displayed when ssuuddoo is run by root with the --VV option.
1434: Note that many operating systems will remove
1435: potentially dangerous variables from the environment of
1436: any setuid process (such as ssuuddoo).
1437:
1438: env_keep Environment variables to be preserved in the user's
1439: environment when the _e_n_v___r_e_s_e_t option is in effect.
1440: This allows fine-grained control over the environment
1441: ssuuddoo-spawned processes will receive. The argument may
1442: be a double-quoted, space-separated list or a single
1443: value without double-quotes. The list can be replaced,
1444: added to, deleted from, or disabled by using the =, +=,
1445: -=, and ! operators respectively. The default list of
1446: variables to keep is displayed when ssuuddoo is run by root
1447: with the --VV option.
1448:
1449: LLOOGG FFOORRMMAATT
1450: ssuuddooeerrss can log events using either syslog(3) or a simple log file. In
1451: each case the log format is almost identical.
1452:
1453: AAcccceepptteedd ccoommmmaanndd lloogg eennttrriieess
1454: Commands that sudo runs are logged using the following format (split into
1455: multiple lines for readability):
1456:
1457: date hostname progname: username : TTY=ttyname ; PWD=cwd ; \
1458: USER=runasuser ; GROUP=runasgroup ; TSID=logid ; \
1459: ENV=env_vars COMMAND=command
1460:
1461: Where the fields are as follows:
1462:
1463: date The date the command was run. Typically, this is in the
1464: format ``MMM, DD, HH:MM:SS''. If logging via syslog(3),
1465: the actual date format is controlled by the syslog daemon.
1466: If logging to a file and the _l_o_g___y_e_a_r option is enabled,
1467: the date will also include the year.
1468:
1469: hostname The name of the host ssuuddoo was run on. This field is only
1470: present when logging via syslog(3).
1471:
1472: progname The name of the program, usually _s_u_d_o or _s_u_d_o_e_d_i_t. This
1473: field is only present when logging via syslog(3).
1474:
1475: username The login name of the user who ran ssuuddoo.
1476:
1477: ttyname The short name of the terminal (e.g. ``console'',
1478: ``tty01'', or ``pts/0'') ssuuddoo was run on, or ``unknown'' if
1479: there was no terminal present.
1480:
1481: cwd The current working directory that ssuuddoo was run in.
1482:
1483: runasuser The user the command was run as.
1484:
1485: runasgroup The group the command was run as if one was specified on
1486: the command line.
1487:
1488: logid An I/O log identifier that can be used to replay the
1489: command's output. This is only present when the _l_o_g___i_n_p_u_t
1490: or _l_o_g___o_u_t_p_u_t option is enabled.
1491:
1492: env_vars A list of environment variables specified on the command
1493: line, if specified.
1494:
1495: command The actual command that was executed.
1496:
1497: Messages are logged using the locale specified by _s_u_d_o_e_r_s___l_o_c_a_l_e, which
1498: defaults to the ``C'' locale.
1499:
1500: DDeenniieedd ccoommmmaanndd lloogg eennttrriieess
1501: If the user is not allowed to run the command, the reason for the denial
1502: will follow the user name. Possible reasons include:
1503:
1504: user NOT in sudoers
1505: The user is not listed in the _s_u_d_o_e_r_s file.
1506:
1507: user NOT authorized on host
1508: The user is listed in the _s_u_d_o_e_r_s file but is not allowed to run
1509: commands on the host.
1510:
1511: command not allowed
1512: The user is listed in the _s_u_d_o_e_r_s file for the host but they are not
1513: allowed to run the specified command.
1514:
1515: 3 incorrect password attempts
1516: The user failed to enter their password after 3 tries. The actual
1517: number of tries will vary based on the number of failed attempts and
1518: the value of the _p_a_s_s_w_d___t_r_i_e_s option.
1519:
1520: a password is required
1521: ssuuddoo's --nn option was specified but a password was required.
1522:
1523: sorry, you are not allowed to set the following environment variables
1524: The user specified environment variables on the command line that were
1525: not allowed by _s_u_d_o_e_r_s.
1526:
1527: EErrrroorr lloogg eennttrriieess
1528: If an error occurs, ssuuddooeerrss will log a message and, in most cases, send a
1529: message to the administrator via email. Possible errors include:
1530:
1531: parse error in /etc/sudoers near line N
1532: ssuuddooeerrss encountered an error when parsing the specified file. In some
1533: cases, the actual error may be one line above or below the line number
1534: listed, depending on the type of error.
1535:
1536: problem with defaults entries
1537: The _s_u_d_o_e_r_s file contains one or more unknown Defaults settings. This
1538: does not prevent ssuuddoo from running, but the _s_u_d_o_e_r_s file should be
1539: checked using vviissuuddoo.
1540:
1541: timestamp owner (username): No such user
1542: The time stamp directory owner, as specified by the _t_i_m_e_s_t_a_m_p_o_w_n_e_r
1543: setting, could not be found in the password database.
1544:
1545: unable to open/read /etc/sudoers
1546: The _s_u_d_o_e_r_s file could not be opened for reading. This can happen
1547: when the _s_u_d_o_e_r_s file is located on a remote file system that maps
1548: user ID 0 to a different value. Normally, ssuuddooeerrss tries to open
1549: _s_u_d_o_e_r_s using group permissions to avoid this problem. Consider
1550: changing the ownership of _/_e_t_c_/_s_u_d_o_e_r_s by adding an option like
1551: ``sudoers_uid=N'' (where `N' is the user ID that owns the _s_u_d_o_e_r_s
1552: file) to the ssuuddooeerrss plugin line in the _/_e_t_c_/_s_u_d_o_._c_o_n_f file.
1553:
1554: unable to stat /etc/sudoers
1555: The _/_e_t_c_/_s_u_d_o_e_r_s file is missing.
1556:
1557: /etc/sudoers is not a regular file
1558: The _/_e_t_c_/_s_u_d_o_e_r_s file exists but is not a regular file or symbolic
1559: link.
1560:
1561: /etc/sudoers is owned by uid N, should be 0
1562: The _s_u_d_o_e_r_s file has the wrong owner. If you wish to change the
1563: _s_u_d_o_e_r_s file owner, please add ``sudoers_uid=N'' (where `N' is the
1564: user ID that owns the _s_u_d_o_e_r_s file) to the ssuuddooeerrss plugin line in the
1565: _/_e_t_c_/_s_u_d_o_._c_o_n_f file.
1566:
1567: /etc/sudoers is world writable
1568: The permissions on the _s_u_d_o_e_r_s file allow all users to write to it.
1569: The _s_u_d_o_e_r_s file must not be world-writable, the default file mode is
1570: 0440 (readable by owner and group, writable by none). The default
1571: mode may be changed via the ``sudoers_mode'' option to the ssuuddooeerrss
1572: plugin line in the _/_e_t_c_/_s_u_d_o_._c_o_n_f file.
1573:
1574: /etc/sudoers is owned by gid N, should be 1
1575: The _s_u_d_o_e_r_s file has the wrong group ownership. If you wish to change
1576: the _s_u_d_o_e_r_s file group ownership, please add ``sudoers_gid=N'' (where
1577: `N' is the group ID that owns the _s_u_d_o_e_r_s file) to the ssuuddooeerrss plugin
1578: line in the _/_e_t_c_/_s_u_d_o_._c_o_n_f file.
1579:
1580: unable to open /var/adm/sudo/username/ttyname
1581: _s_u_d_o_e_r_s was unable to read or create the user's time stamp file.
1582:
1583: unable to write to /var/adm/sudo/username/ttyname
1584: _s_u_d_o_e_r_s was unable to write to the user's time stamp file.
1585:
1586: unable to mkdir to /var/adm/sudo/username
1587: _s_u_d_o_e_r_s was unable to create the user's time stamp directory.
1588:
1589: NNootteess oonn llooggggiinngg vviiaa ssyysslloogg
1590: By default, _s_u_d_o_e_r_s logs messages via syslog(3). The _d_a_t_e, _h_o_s_t_n_a_m_e, and
1591: _p_r_o_g_n_a_m_e fields are added by the syslog daemon, not _s_u_d_o_e_r_s itself. As
1592: such, they may vary in format on different systems.
1593:
1594: On most systems, syslog(3) has a relatively small log buffer. To prevent
1595: the command line arguments from being truncated, ssuuddooeerrss will split up
1596: log messages that are larger than 960 characters (not including the date,
1597: hostname, and the string ``sudo''). When a message is split, additional
1598: parts will include the string ``(command continued)'' after the user name
1599: and before the continued command line arguments.
1600:
1601: NNootteess oonn llooggggiinngg ttoo aa ffiillee
1602: If the _l_o_g_f_i_l_e option is set, _s_u_d_o_e_r_s will log to a local file, such as
1603: _/_v_a_r_/_l_o_g_/_s_u_d_o. When logging to a file, _s_u_d_o_e_r_s uses a format similar to
1604: syslog(3), with a few important differences:
1605:
1606: 1. The _p_r_o_g_n_a_m_e and _h_o_s_t_n_a_m_e fields are not present.
1607:
1608: 2. If the _l_o_g___y_e_a_r option is enabled, the date will also include the
1609: year.
1610:
1611: 3. Lines that are longer than _l_o_g_l_i_n_e_l_e_n characters (80 by default) are
1612: word-wrapped and continued on the next line with a four character
1613: indent. This makes entries easier to read for a human being, but
1614: makes it more difficult to use grep(1) on the log files. If the
1615: _l_o_g_l_i_n_e_l_e_n option is set to 0 (or negated with a `!'), word wrap
1616: will be disabled.
1617:
1618: SSUUDDOO..CCOONNFF
1619: The _/_e_t_c_/_s_u_d_o_._c_o_n_f file determines which plugins the ssuuddoo front end will
1620: load. If no _/_e_t_c_/_s_u_d_o_._c_o_n_f file is present, or it contains no Plugin
1621: lines, ssuuddoo will use the _s_u_d_o_e_r_s security policy and I/O logging, which
1622: corresponds to the following _/_e_t_c_/_s_u_d_o_._c_o_n_f file.
1623:
1624: #
1625: # Default /etc/sudo.conf file
1626: #
1627: # Format:
1628: # Plugin plugin_name plugin_path plugin_options ...
1629: # Path askpass /path/to/askpass
1630: # Path noexec /path/to/sudo_noexec.so
1631: # Debug sudo /var/log/sudo_debug all@warn
1632: # Set disable_coredump true
1633: #
1634: # The plugin_path is relative to /usr/local/libexec unless
1635: # fully qualified.
1636: # The plugin_name corresponds to a global symbol in the plugin
1637: # that contains the plugin interface structure.
1638: # The plugin_options are optional.
1639: #
1640: Plugin policy_plugin sudoers.so
1641: Plugin io_plugin sudoers.so
1642:
1643: PPlluuggiinn ooppttiioonnss
1644: Starting with ssuuddoo 1.8.5, it is possible to pass options to the _s_u_d_o_e_r_s
1645: plugin. Options may be listed after the path to the plugin (i.e. after
1646: _s_u_d_o_e_r_s_._s_o); multiple options should be space-separated. For example:
1647:
1648: Plugin sudoers_policy sudoers.so sudoers_file=/etc/sudoers sudoers_uid=0 sudoers_gid=0 sudoers_mode=0440
1649:
1650: The following plugin options are supported:
1651:
1652: sudoers_file=pathname
1653: The _s_u_d_o_e_r_s___f_i_l_e option can be used to override the default
1654: path to the _s_u_d_o_e_r_s file.
1655:
1656: sudoers_uid=uid
1657: The _s_u_d_o_e_r_s___u_i_d option can be used to override the default
1658: owner of the sudoers file. It should be specified as a numeric
1659: user ID.
1660:
1661: sudoers_gid=gid
1662: The _s_u_d_o_e_r_s___g_i_d option can be used to override the default
1663: group of the sudoers file. It should be specified as a numeric
1664: group ID.
1665:
1666: sudoers_mode=mode
1667: The _s_u_d_o_e_r_s___m_o_d_e option can be used to override the default
1668: file mode for the sudoers file. It should be specified as an
1669: octal value.
1670:
1671: DDeebbuugg ffllaaggss
1672: Versions 1.8.4 and higher of the _s_u_d_o_e_r_s plugin supports a debugging
1673: framework that can help track down what the plugin is doing internally if
1674: there is a problem. This can be configured in the _/_e_t_c_/_s_u_d_o_._c_o_n_f file as
1675: described in sudo(1m).
1676:
1677: The _s_u_d_o_e_r_s plugin uses the same debug flag format as the ssuuddoo front-end:
1678: _s_u_b_s_y_s_t_e_m@_p_r_i_o_r_i_t_y.
1679:
1680: The priorities used by _s_u_d_o_e_r_s, in order of decreasing severity, are:
1681: _c_r_i_t, _e_r_r, _w_a_r_n, _n_o_t_i_c_e, _d_i_a_g, _i_n_f_o, _t_r_a_c_e and _d_e_b_u_g. Each priority,
1682: when specified, also includes all priorities higher than it. For
1683: example, a priority of _n_o_t_i_c_e would include debug messages logged at
1684: _n_o_t_i_c_e and higher.
1685:
1686: The following subsystems are used by _s_u_d_o_e_r_s:
1687:
1688: _a_l_i_a_s User_Alias, Runas_Alias, Host_Alias and Cmnd_Alias processing
1689:
1690: _a_l_l matches every subsystem
1691:
1692: _a_u_d_i_t BSM and Linux audit code
1693:
1694: _a_u_t_h user authentication
1695:
1696: _d_e_f_a_u_l_t_s _s_u_d_o_e_r_s _D_e_f_a_u_l_t_s settings
1697:
1698: _e_n_v environment handling
1699:
1700: _l_d_a_p LDAP-based sudoers
1701:
1702: _l_o_g_g_i_n_g logging support
1703:
1704: _m_a_t_c_h matching of users, groups, hosts and netgroups in _s_u_d_o_e_r_s
1705:
1706: _n_e_t_i_f network interface handling
1707:
1708: _n_s_s network service switch handling in _s_u_d_o_e_r_s
1709:
1710: _p_a_r_s_e_r _s_u_d_o_e_r_s file parsing
1711:
1712: _p_e_r_m_s permission setting
1713:
1714: _p_l_u_g_i_n The equivalent of _m_a_i_n for the plugin.
1715:
1716: _p_t_y pseudo-tty related code
1717:
1718: _r_b_t_r_e_e redblack tree internals
1719:
1720: _u_t_i_l utility functions
1721:
1722: FFIILLEESS
1723: _/_e_t_c_/_s_u_d_o_._c_o_n_f Sudo front end configuration
1724:
1725: _/_e_t_c_/_s_u_d_o_e_r_s List of who can run what
1726:
1727: _/_e_t_c_/_g_r_o_u_p Local groups file
1728:
1729: _/_e_t_c_/_n_e_t_g_r_o_u_p List of network groups
1730:
1731: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o I/O log files
1732:
1733: _/_v_a_r_/_a_d_m_/_s_u_d_o Directory containing time stamps for the
1734: _s_u_d_o_e_r_s security policy
1735:
1736: _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t Initial environment for --ii mode on AIX and
1737: Linux systems
1738:
1739: EEXXAAMMPPLLEESS
1740: Below are example _s_u_d_o_e_r_s entries. Admittedly, some of these are a bit
1741: contrived. First, we allow a few environment variables to pass and then
1742: define our _a_l_i_a_s_e_s:
1743:
1744: # Run X applications through sudo; HOME is used to find the
1745: # .Xauthority file. Note that other programs use HOME to find
1746: # configuration files and this may lead to privilege escalation!
1747: Defaults env_keep += "DISPLAY HOME"
1748:
1749: # User alias specification
1750: User_Alias FULLTIMERS = millert, mikef, dowdy
1751: User_Alias PARTTIMERS = bostley, jwfox, crawl
1752: User_Alias WEBMASTERS = will, wendy, wim
1753:
1754: # Runas alias specification
1755: Runas_Alias OP = root, operator
1756: Runas_Alias DB = oracle, sybase
1757: Runas_Alias ADMINGRP = adm, oper
1758:
1759: # Host alias specification
1760: Host_Alias SPARC = bigtime, eclipse, moet, anchor :\
1761: SGI = grolsch, dandelion, black :\
1762: ALPHA = widget, thalamus, foobar :\
1763: HPPA = boa, nag, python
1764: Host_Alias CUNETS = 128.138.0.0/255.255.0.0
1765: Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
1766: Host_Alias SERVERS = master, mail, www, ns
1767: Host_Alias CDROM = orion, perseus, hercules
1768:
1769: # Cmnd alias specification
1770: Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
1771: /usr/sbin/restore, /usr/sbin/rrestore
1772: Cmnd_Alias KILL = /usr/bin/kill
1773: Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
1774: Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
1775: Cmnd_Alias HALT = /usr/sbin/halt
1776: Cmnd_Alias REBOOT = /usr/sbin/reboot
1777: Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh,\
1778: /usr/local/bin/tcsh, /usr/bin/rsh,\
1779: /usr/local/bin/zsh
1780: Cmnd_Alias SU = /usr/bin/su
1781: Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
1782:
1783: Here we override some of the compiled in default values. We want ssuuddoo to
1784: log via syslog(3) using the _a_u_t_h facility in all cases. We don't want to
1785: subject the full time staff to the ssuuddoo lecture, user mmiilllleerrtt need not
1786: give a password, and we don't want to reset the LOGNAME, USER or USERNAME
1787: environment variables when running commands as root. Additionally, on
1788: the machines in the _S_E_R_V_E_R_S Host_Alias, we keep an additional local log
1789: file and make sure we log the year in each log line since the log entries
1790: will be kept around for several years. Lastly, we disable shell escapes
1791: for the commands in the PAGERS Cmnd_Alias (_/_u_s_r_/_b_i_n_/_m_o_r_e, _/_u_s_r_/_b_i_n_/_p_g and
1792: _/_u_s_r_/_b_i_n_/_l_e_s_s).
1793:
1794: # Override built-in defaults
1795: Defaults syslog=auth
1796: Defaults>root !set_logname
1797: Defaults:FULLTIMERS !lecture
1798: Defaults:millert !authenticate
1799: Defaults@SERVERS log_year, logfile=/var/log/sudo.log
1800: Defaults!PAGERS noexec
1801:
1802: The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually determines who may run
1803: what.
1804:
1805: root ALL = (ALL) ALL
1806: %wheel ALL = (ALL) ALL
1807:
1808: We let rroooott and any user in group wwhheeeell run any command on any host as
1809: any user.
1810:
1811: FULLTIMERS ALL = NOPASSWD: ALL
1812:
1813: Full time sysadmins (mmiilllleerrtt, mmiikkeeff, and ddoowwddyy) may run any command on
1814: any host without authenticating themselves.
1815:
1816: PARTTIMERS ALL = ALL
1817:
1818: Part time sysadmins bboossttlleeyy, jjwwffooxx, and ccrraawwll) may run any command on any
1819: host but they must authenticate themselves first (since the entry lacks
1820: the NOPASSWD tag).
1821:
1822: jack CSNETS = ALL
1823:
1824: The user jjaacckk may run any command on the machines in the _C_S_N_E_T_S alias
1825: (the networks 128.138.243.0, 128.138.204.0, and 128.138.242.0). Of those
1826: networks, only 128.138.204.0 has an explicit netmask (in CIDR notation)
1827: indicating it is a class C network. For the other networks in _C_S_N_E_T_S,
1828: the local machine's netmask will be used during matching.
1829:
1830: lisa CUNETS = ALL
1831:
1832: The user lliissaa may run any command on any host in the _C_U_N_E_T_S alias (the
1833: class B network 128.138.0.0).
1834:
1835: operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
1836: sudoedit /etc/printcap, /usr/oper/bin/
1837:
1838: The ooppeerraattoorr user may run commands limited to simple maintenance. Here,
1839: those are commands related to backups, killing processes, the printing
1840: system, shutting down the system, and any commands in the directory
1841: _/_u_s_r_/_o_p_e_r_/_b_i_n_/.
1842:
1843: joe ALL = /usr/bin/su operator
1844:
1845: The user jjooee may only su(1) to operator.
1846:
1847: pete HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root
1848:
1849: %opers ALL = (: ADMINGRP) /usr/sbin/
1850:
1851: Users in the ooppeerrss group may run commands in _/_u_s_r_/_s_b_i_n_/ as themselves
1852: with any group in the _A_D_M_I_N_G_R_P Runas_Alias (the aaddmm and ooppeerr groups).
1853:
1854: The user ppeettee is allowed to change anyone's password except for root on
1855: the _H_P_P_A machines. Note that this assumes passwd(1) does not take
1856: multiple user names on the command line.
1857:
1858: bob SPARC = (OP) ALL : SGI = (OP) ALL
1859:
1860: The user bboobb may run anything on the _S_P_A_R_C and _S_G_I machines as any user
1861: listed in the _O_P Runas_Alias (rroooott and ooppeerraattoorr.)
1862:
1863: jim +biglab = ALL
1864:
1865: The user jjiimm may run any command on machines in the _b_i_g_l_a_b netgroup.
1866: ssuuddoo knows that ``biglab'' is a netgroup due to the `+' prefix.
1867:
1868: +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
1869:
1870: Users in the sseeccrreettaarriieess netgroup need to help manage the printers as
1871: well as add and remove users, so they are allowed to run those commands
1872: on all machines.
1873:
1874: fred ALL = (DB) NOPASSWD: ALL
1875:
1876: The user ffrreedd can run commands as any user in the _D_B Runas_Alias (oorraaccllee
1877: or ssyybbaassee) without giving a password.
1878:
1879: john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
1880:
1881: On the _A_L_P_H_A machines, user jjoohhnn may su to anyone except root but he is
1882: not allowed to specify any options to the su(1) command.
1883:
1884: jen ALL, !SERVERS = ALL
1885:
1886: The user jjeenn may run any command on any machine except for those in the
1887: _S_E_R_V_E_R_S Host_Alias (master, mail, www and ns).
1888:
1889: jill SERVERS = /usr/bin/, !SU, !SHELLS
1890:
1891: For any machine in the _S_E_R_V_E_R_S Host_Alias, jjiillll may run any commands in
1892: the directory _/_u_s_r_/_b_i_n_/ except for those commands belonging to the _S_U and
1893: _S_H_E_L_L_S Cmnd_Aliases.
1894:
1895: steve CSNETS = (operator) /usr/local/op_commands/
1896:
1897: The user sstteevvee may run any command in the directory
1898: /usr/local/op_commands/ but only as user operator.
1899:
1900: matt valkyrie = KILL
1901:
1902: On his personal workstation, valkyrie, mmaatttt needs to be able to kill hung
1903: processes.
1904:
1905: WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
1906:
1907: On the host www, any user in the _W_E_B_M_A_S_T_E_R_S User_Alias (will, wendy, and
1908: wim), may run any command as user www (which owns the web pages) or
1909: simply su(1) to www.
1910:
1911: ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\
1912: /sbin/mount -o nosuid,nodev /dev/cd0a /CDROM
1913:
1914: Any user may mount or unmount a CD-ROM on the machines in the CDROM
1915: Host_Alias (orion, perseus, hercules) without entering a password. This
1916: is a bit tedious for users to type, so it is a prime candidate for
1917: encapsulating in a shell script.
1918:
1919: SSEECCUURRIITTYY NNOOTTEESS
1920: LLiimmiittaattiioonnss ooff tthhee ``!!'' ooppeerraattoorr
1921: It is generally not effective to ``subtract'' commands from AALLLL using the
1922: `!' operator. A user can trivially circumvent this by copying the
1923: desired command to a different name and then executing that. For
1924: example:
1925:
1926: bill ALL = ALL, !SU, !SHELLS
1927:
1928: Doesn't really prevent bbiillll from running the commands listed in _S_U or
1929: _S_H_E_L_L_S since he can simply copy those commands to a different name, or
1930: use a shell escape from an editor or other program. Therefore, these
1931: kind of restrictions should be considered advisory at best (and
1932: reinforced by policy).
1933:
1934: In general, if a user has sudo AALLLL there is nothing to prevent them from
1935: creating their own program that gives them a root shell (or making their
1936: own copy of a shell) regardless of any `!' elements in the user
1937: specification.
1938:
1939: SSeeccuurriittyy iimmpplliiccaattiioonnss ooff _f_a_s_t___g_l_o_b
1940: If the _f_a_s_t___g_l_o_b option is in use, it is not possible to reliably negate
1941: commands where the path name includes globbing (aka wildcard) characters.
1942: This is because the C library's fnmatch(3) function cannot resolve
1943: relative paths. While this is typically only an inconvenience for rules
1944: that grant privileges, it can result in a security issue for rules that
1945: subtract or revoke privileges.
1946:
1947: For example, given the following _s_u_d_o_e_r_s entry:
1948:
1949: john ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,\
1950: /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
1951:
1952: User jjoohhnn can still run /usr/bin/passwd root if _f_a_s_t___g_l_o_b is enabled by
1953: changing to _/_u_s_r_/_b_i_n and running ./passwd root instead.
1954:
1955: PPrreevveennttiinngg sshheellll eessccaappeess
1956: Once ssuuddoo executes a program, that program is free to do whatever it
1957: pleases, including run other programs. This can be a security issue
1958: since it is not uncommon for a program to allow shell escapes, which lets
1959: a user bypass ssuuddoo's access control and logging. Common programs that
1960: permit shell escapes include shells (obviously), editors, paginators,
1961: mail and terminal programs.
1962:
1963: There are two basic approaches to this problem:
1964:
1965: restrict Avoid giving users access to commands that allow the user to
1966: run arbitrary commands. Many editors have a restricted mode
1967: where shell escapes are disabled, though ssuuddooeeddiitt is a better
1968: solution to running editors via ssuuddoo. Due to the large number
1969: of programs that offer shell escapes, restricting users to the
1970: set of programs that do not is often unworkable.
1971:
1972: noexec Many systems that support shared libraries have the ability to
1973: override default library functions by pointing an environment
1974: variable (usually LD_PRELOAD) to an alternate shared library.
1975: On such systems, ssuuddoo's _n_o_e_x_e_c functionality can be used to
1976: prevent a program run by ssuuddoo from executing any other
1977: programs. Note, however, that this applies only to native
1978: dynamically-linked executables. Statically-linked executables
1979: and foreign executables running under binary emulation are not
1980: affected.
1981:
1982: The _n_o_e_x_e_c feature is known to work on SunOS, Solaris, *BSD,
1983: Linux, IRIX, Tru64 UNIX, MacOS X, HP-UX 11.x and AIX 5.3 and
1984: above. It should be supported on most operating systems that
1985: support the LD_PRELOAD environment variable. Check your
1986: operating system's manual pages for the dynamic linker (usually
1987: ld.so, ld.so.1, dyld, dld.sl, rld, or loader) to see if
1988: LD_PRELOAD is supported.
1989:
1990: On Solaris 10 and higher, _n_o_e_x_e_c uses Solaris privileges
1991: instead of the LD_PRELOAD environment variable.
1992:
1993: To enable _n_o_e_x_e_c for a command, use the NOEXEC tag as
1994: documented in the User Specification section above. Here is
1995: that example again:
1996:
1997: aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
1998:
1999: This allows user aaaarroonn to run _/_u_s_r_/_b_i_n_/_m_o_r_e and _/_u_s_r_/_b_i_n_/_v_i
2000: with _n_o_e_x_e_c enabled. This will prevent those two commands from
2001: executing other commands (such as a shell). If you are unsure
2002: whether or not your system is capable of supporting _n_o_e_x_e_c you
2003: can always just try it out and check whether shell escapes work
2004: when _n_o_e_x_e_c is enabled.
2005:
2006: Note that restricting shell escapes is not a panacea. Programs running
2007: as root are still capable of many potentially hazardous operations (such
2008: as changing or overwriting files) that could lead to unintended privilege
2009: escalation. In the specific case of an editor, a safer approach is to
2010: give the user permission to run ssuuddooeeddiitt.
2011:
2012: TTiimmee ssttaammpp ffiillee cchheecckkss
2013: _s_u_d_o_e_r_s will check the ownership of its time stamp directory
2014: (_/_v_a_r_/_a_d_m_/_s_u_d_o by default) and ignore the directory's contents if it is
2015: not owned by root or if it is writable by a user other than root. On
2016: systems that allow non-root users to give away files via chown(2), if the
2017: time stamp directory is located in a world-writable directory (e.g.,
2018: _/_t_m_p), it is possible for a user to create the time stamp directory
2019: before ssuuddoo is run. However, because _s_u_d_o_e_r_s checks the ownership and
2020: mode of the directory and its contents, the only damage that can be done
2021: is to ``hide'' files by putting them in the time stamp dir. This is
2022: unlikely to happen since once the time stamp dir is owned by root and
2023: inaccessible by any other user, the user placing files there would be
2024: unable to get them back out.
2025:
2026: _s_u_d_o_e_r_s will not honor time stamps set far in the future. Time stamps
2027: with a date greater than current_time + 2 * TIMEOUT will be ignored and
2028: sudo will log and complain. This is done to keep a user from creating
2029: his/her own time stamp with a bogus date on systems that allow users to
2030: give away files if the time stamp directory is located in a world-
2031: writable directory.
2032:
2033: On systems where the boot time is available, _s_u_d_o_e_r_s will ignore time
2034: stamps that date from before the machine booted.
2035:
2036: Since time stamp files live in the file system, they can outlive a user's
2037: login session. As a result, a user may be able to login, run a command
2038: with ssuuddoo after authenticating, logout, login again, and run ssuuddoo without
2039: authenticating so long as the time stamp file's modification time is
2040: within 5 minutes (or whatever the timeout is set to in _s_u_d_o_e_r_s). When
2041: the _t_t_y___t_i_c_k_e_t_s option is enabled, the time stamp has per-tty granularity
2042: but still may outlive the user's session. On Linux systems where the
2043: devpts filesystem is used, Solaris systems with the devices filesystem,
2044: as well as other systems that utilize a devfs filesystem that
2045: monotonically increase the inode number of devices as they are created
2046: (such as Mac OS X), _s_u_d_o_e_r_s is able to determine when a tty-based time
2047: stamp file is stale and will ignore it. Administrators should not rely
2048: on this feature as it is not universally available.
2049:
2050: SSEEEE AALLSSOO
2051: ssh(1), su(1), fnmatch(3), glob(3), mktemp(3), strftime(3),
2052: sudoers.ldap(4), sudo_plugin(1m), sudo(1m), visudo(1m)
2053:
2054: CCAAVVEEAATTSS
2055: The _s_u_d_o_e_r_s file should aallwwaayyss be edited by the vviissuuddoo command which
2056: locks the file and does grammatical checking. It is imperative that
2057: _s_u_d_o_e_r_s be free of syntax errors since ssuuddoo will not run with a
2058: syntactically incorrect _s_u_d_o_e_r_s file.
2059:
2060: When using netgroups of machines (as opposed to users), if you store
2061: fully qualified host name in the netgroup (as is usually the case), you
2062: either need to have the machine's host name be fully qualified as
2063: returned by the hostname command or use the _f_q_d_n option in _s_u_d_o_e_r_s.
2064:
2065: BBUUGGSS
2066: If you feel you have found a bug in ssuuddoo, please submit a bug report at
2067: http://www.sudo.ws/sudo/bugs/
2068:
2069: SSUUPPPPOORRTT
2070: Limited free support is available via the sudo-users mailing list, see
2071: http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the
2072: archives.
2073:
2074: DDIISSCCLLAAIIMMEERR
2075: ssuuddoo is provided ``AS IS'' and any express or implied warranties,
2076: including, but not limited to, the implied warranties of merchantability
2077: and fitness for a particular purpose are disclaimed. See the LICENSE
2078: file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
2079: complete details.
2080:
2081: Sudo 1.8.6 July 16, 2012 Sudo 1.8.6
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoers.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc