Annotation of embedaddon/sudo/doc/sudoers.man.in, revision 1.1.1.1
1.1 misho 1: .\" Copyright (c) 1994-1996, 1998-2005, 2007-2011
2: .\" Todd C. Miller <Todd.Miller@courtesan.com>
3: .\"
4: .\" Permission to use, copy, modify, and distribute this software for any
5: .\" purpose with or without fee is hereby granted, provided that the above
6: .\" copyright notice and this permission notice appear in all copies.
7: .\"
8: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
16: .\"
17: .\" Sponsored in part by the Defense Advanced Research Projects
18: .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
19: .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
20: .\"
21: .nr SL @SEMAN@
22: .nr BA @BAMAN@
23: .nr LC @LCMAN@
24: .\"
25: .\" Automatically generated by Pod::Man 2.23 (Pod::Simple 3.14)
26: .\"
27: .\" Standard preamble:
28: .\" ========================================================================
29: .de Sp \" Vertical space (when we can't use .PP)
30: .if t .sp .5v
31: .if n .sp
32: ..
33: .de Vb \" Begin verbatim text
34: .ft CW
35: .nf
36: .ne \\$1
37: ..
38: .de Ve \" End verbatim text
39: .ft R
40: .fi
41: ..
42: .\" Set up some character translations and predefined strings. \*(-- will
43: .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
44: .\" double quote, and \*(R" will give a right double quote. \*(C+ will
45: .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
46: .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
47: .\" nothing in troff, for use with C<>.
48: .tr \(*W-
49: .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
50: .ie n \{\
51: . ds -- \(*W-
52: . ds PI pi
53: . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
54: . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
55: . ds L" ""
56: . ds R" ""
57: . ds C`
58: . ds C'
59: 'br\}
60: .el\{\
61: . ds -- \|\(em\|
62: . ds PI \(*p
63: . ds L" ``
64: . ds R" ''
65: 'br\}
66: .\"
67: .\" Escape single quotes in literal strings from groff's Unicode transform.
68: .ie \n(.g .ds Aq \(aq
69: .el .ds Aq '
70: .\"
71: .\" If the F register is turned on, we'll generate index entries on stderr for
72: .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
73: .\" entries marked with X<> in POD. Of course, you'll have to process the
74: .\" output yourself in some meaningful fashion.
75: .ie \nF \{\
76: . de IX
77: . tm Index:\\$1\t\\n%\t"\\$2"
78: ..
79: . nr % 0
80: . rr F
81: .\}
82: .el \{\
83: . de IX
84: ..
85: .\}
86: .\"
87: .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
88: .\" Fear. Run. Save yourself. No user-serviceable parts.
89: . \" fudge factors for nroff and troff
90: .if n \{\
91: . ds #H 0
92: . ds #V .8m
93: . ds #F .3m
94: . ds #[ \f1
95: . ds #] \fP
96: .\}
97: .if t \{\
98: . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
99: . ds #V .6m
100: . ds #F 0
101: . ds #[ \&
102: . ds #] \&
103: .\}
104: . \" simple accents for nroff and troff
105: .if n \{\
106: . ds ' \&
107: . ds ` \&
108: . ds ^ \&
109: . ds , \&
110: . ds ~ ~
111: . ds /
112: .\}
113: .if t \{\
114: . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
115: . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
116: . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
117: . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
118: . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
119: . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
120: .\}
121: . \" troff and (daisy-wheel) nroff accents
122: .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
123: .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
124: .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
125: .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
126: .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
127: .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
128: .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
129: .ds ae a\h'-(\w'a'u*4/10)'e
130: .ds Ae A\h'-(\w'A'u*4/10)'E
131: . \" corrections for vroff
132: .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
133: .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
134: . \" for low resolution devices (crt and lpr)
135: .if \n(.H>23 .if \n(.V>19 \
136: \{\
137: . ds : e
138: . ds 8 ss
139: . ds o a
140: . ds d- d\h'-1'\(ga
141: . ds D- D\h'-1'\(hy
142: . ds th \o'bp'
143: . ds Th \o'LP'
144: . ds ae ae
145: . ds Ae AE
146: .\}
147: .rm #[ #] #H #V #F C
148: .\" ========================================================================
149: .\"
150: .IX Title "SUDOERS @mansectform@"
151: .TH SUDOERS @mansectform@ "September 16, 2011" "1.8.3" "MAINTENANCE COMMANDS"
152: .\" For nroff, turn off justification. Always turn off hyphenation; it makes
153: .\" way too many mistakes in technical documents.
154: .if n .ad l
155: .nh
156: .SH "NAME"
157: sudoers \- default sudo security policy module
158: .SH "DESCRIPTION"
159: .IX Header "DESCRIPTION"
160: The \fIsudoers\fR policy module determines a user's \fBsudo\fR privileges.
161: It is the default \fBsudo\fR policy plugin. The policy is driven by
162: the \fI@sysconfdir@/sudoers\fR file or, optionally in \s-1LDAP\s0. The policy
163: format is described in detail in the \*(L"\s-1SUDOERS\s0 \s-1FILE\s0 \s-1FORMAT\s0\*(R"
164: section. For information on storing \fIsudoers\fR policy information
165: in \s-1LDAP\s0, please see \fIsudoers.ldap\fR\|(@mansectform@).
166: .SS "Authentication and Logging"
167: .IX Subsection "Authentication and Logging"
168: The \fIsudoers\fR security policy requires that most users authenticate
169: themselves before they can use \fBsudo\fR. A password is not required
170: if the invoking user is root, if the target user is the same as the
171: invoking user, or if the policy has disabled authentication for the
172: user or command. Unlike \fIsu\fR\|(1), when \fIsudoers\fR requires
173: authentication, it validates the invoking user's credentials, not
174: the target user's (or root's) credentials. This can be changed via
175: the \fIrootpw\fR, \fItargetpw\fR and \fIrunaspw\fR flags, described later.
176: .PP
177: If a user who is not listed in the policy tries to run a command
178: via \fBsudo\fR, mail is sent to the proper authorities. The address
179: used for such mail is configurable via the \fImailto\fR Defaults entry
180: (described later) and defaults to \f(CW\*(C`@mailto@\*(C'\fR.
181: .PP
182: Note that mail will not be sent if an unauthorized user tries to
183: run \fBsudo\fR with the \fB\-l\fR or \fB\-v\fR option. This allows users to
184: determine for themselves whether or not they are allowed to use
185: \&\fBsudo\fR.
186: .PP
187: If \fBsudo\fR is run by root and the \f(CW\*(C`SUDO_USER\*(C'\fR environment variable
188: is set, the \fIsudoers\fR policy will use this value to determine who
189: the actual user is. This can be used by a user to log commands
190: through sudo even when a root shell has been invoked. It also
191: allows the \fB\-e\fR option to remain useful even when invoked via a
192: sudo-run script or program. Note, however, that the \fIsudoers\fR
193: lookup is still done for root, not the user specified by \f(CW\*(C`SUDO_USER\*(C'\fR.
194: .PP
195: \&\fIsudoers\fR uses time stamp files for credential caching. Once a
196: user has been authenticated, a time stamp is updated and the user
197: may then use sudo without a password for a short period of time
198: (\f(CW\*(C`@timeout@\*(C'\fR minutes unless overridden by the \fItimeout\fR option.
199: By default, \fIsudoers\fR uses a tty-based time stamp which means that
200: there is a separate time stamp for each of a user's login sessions.
201: The \fItty_tickets\fR option can be disabled to force the use of a
202: single time stamp for all of a user's sessions.
203: .PP
204: \&\fIsudoers\fR can log both successful and unsuccessful attempts (as well
205: as errors) to \fIsyslog\fR\|(3), a log file, or both. By default, \fIsudoers\fR
206: will log via \fIsyslog\fR\|(3) but this is changeable via the \fIsyslog\fR
207: and \fIlogfile\fR Defaults settings.
208: .PP
209: \&\fIsudoers\fR also supports logging a command's input and output
210: streams. I/O logging is not on by default but can be enabled using
211: the \fIlog_input\fR and \fIlog_output\fR Defaults flags as well as the
212: \&\f(CW\*(C`LOG_INPUT\*(C'\fR and \f(CW\*(C`LOG_OUTPUT\*(C'\fR command tags.
213: .SS "Command Environment"
214: .IX Subsection "Command Environment"
215: Since environment variables can influence program behavior, \fIsudoers\fR
216: provides a means to restrict which variables from the user's
217: environment are inherited by the command to be run. There are two
218: distinct ways \fIsudoers\fR can deal with environment variables.
219: .PP
220: By default, the \fIenv_reset\fR option is enabled. This causes commands
221: to be executed with a minimal environment containing \f(CW\*(C`TERM\*(C'\fR,
222: \&\f(CW\*(C`PATH\*(C'\fR, \f(CW\*(C`HOME\*(C'\fR, \f(CW\*(C`MAIL\*(C'\fR, \f(CW\*(C`SHELL\*(C'\fR, \f(CW\*(C`LOGNAME\*(C'\fR, \f(CW\*(C`USER\*(C'\fR and \f(CW\*(C`USERNAME\*(C'\fR in
223: addition to variables from the invoking process permitted by the
224: \&\fIenv_check\fR and \fIenv_keep\fR options. This is effectively a whitelist
225: for environment variables.
226: .PP
227: If, however, the \fIenv_reset\fR option is disabled, any variables not
228: explicitly denied by the \fIenv_check\fR and \fIenv_delete\fR options are
229: inherited from the invoking process. In this case, \fIenv_check\fR
230: and \fIenv_delete\fR behave like a blacklist. Since it is not possible
231: to blacklist all potentially dangerous environment variables, use
232: of the default \fIenv_reset\fR behavior is encouraged.
233: .PP
234: In all cases, environment variables with a value beginning with
235: \&\f(CW\*(C`()\*(C'\fR are removed as they could be interpreted as \fBbash\fR functions.
236: The list of environment variables that \fBsudo\fR allows or denies is
237: contained in the output of \f(CW\*(C`sudo \-V\*(C'\fR when run as root.
238: .PP
239: Note that the dynamic linker on most operating systems will remove
240: variables that can control dynamic linking from the environment of
241: setuid executables, including \fBsudo\fR. Depending on the operating
242: system this may include \f(CW\*(C`_RLD*\*(C'\fR, \f(CW\*(C`DYLD_*\*(C'\fR, \f(CW\*(C`LD_*\*(C'\fR, \f(CW\*(C`LDR_*\*(C'\fR,
243: \&\f(CW\*(C`LIBPATH\*(C'\fR, \f(CW\*(C`SHLIB_PATH\*(C'\fR, and others. These type of variables are
244: removed from the environment before \fBsudo\fR even begins execution
245: and, as such, it is not possible for \fBsudo\fR to preserve them.
246: .PP
247: As a special case, if \fBsudo\fR's \fB\-i\fR option (initial login) is
248: specified, \fIsudoers\fR will initialize the environment regardless
249: of the value of \fIenv_reset\fR. The \fI\s-1DISPLAY\s0\fR, \fI\s-1PATH\s0\fR and \fI\s-1TERM\s0\fR
250: variables remain unchanged; \fI\s-1HOME\s0\fR, \fI\s-1MAIL\s0\fR, \fI\s-1SHELL\s0\fR, \fI\s-1USER\s0\fR,
251: and \fI\s-1LOGNAME\s0\fR are set based on the target user. On Linux and \s-1AIX\s0
252: systems the contents of \fI/etc/environment\fR are also included. All
253: other environment variables are removed.
254: .SH "SUDOERS FILE FORMAT"
255: .IX Header "SUDOERS FILE FORMAT"
256: The \fIsudoers\fR file is composed of two types of entries: aliases
257: (basically variables) and user specifications (which specify who
258: may run what).
259: .PP
260: When multiple entries match for a user, they are applied in order.
261: Where there are multiple matches, the last match is used (which is
262: not necessarily the most specific match).
263: .PP
264: The \fIsudoers\fR grammar will be described below in Extended Backus-Naur
265: Form (\s-1EBNF\s0). Don't despair if you don't know what \s-1EBNF\s0 is; it is
266: fairly simple, and the definitions below are annotated.
267: .SS "Quick guide to \s-1EBNF\s0"
268: .IX Subsection "Quick guide to EBNF"
269: \&\s-1EBNF\s0 is a concise and exact way of describing the grammar of a language.
270: Each \s-1EBNF\s0 definition is made up of \fIproduction rules\fR. E.g.,
271: .PP
272: .Vb 1
273: \& symbol ::= definition | alternate1 | alternate2 ...
274: .Ve
275: .PP
276: Each \fIproduction rule\fR references others and thus makes up a
277: grammar for the language. \s-1EBNF\s0 also contains the following
278: operators, which many readers will recognize from regular
279: expressions. Do not, however, confuse them with \*(L"wildcard\*(R"
280: characters, which have different meanings.
281: .ie n .IP "\*(C`?\*(C'" 4
282: .el .IP "\f(CW\*(C`?\*(C'\fR" 4
283: .IX Item "?"
284: Means that the preceding symbol (or group of symbols) is optional.
285: That is, it may appear once or not at all.
286: .ie n .IP "\*(C`*\*(C'" 4
287: .el .IP "\f(CW\*(C`*\*(C'\fR" 4
288: .IX Item "*"
289: Means that the preceding symbol (or group of symbols) may appear
290: zero or more times.
291: .ie n .IP "\*(C`+\*(C'" 4
292: .el .IP "\f(CW\*(C`+\*(C'\fR" 4
293: .IX Item "+"
294: Means that the preceding symbol (or group of symbols) may appear
295: one or more times.
296: .PP
297: Parentheses may be used to group symbols together. For clarity,
298: we will use single quotes ('') to designate what is a verbatim character
299: string (as opposed to a symbol name).
300: .SS "Aliases"
301: .IX Subsection "Aliases"
302: There are four kinds of aliases: \f(CW\*(C`User_Alias\*(C'\fR, \f(CW\*(C`Runas_Alias\*(C'\fR,
303: \&\f(CW\*(C`Host_Alias\*(C'\fR and \f(CW\*(C`Cmnd_Alias\*(C'\fR.
304: .PP
305: .Vb 4
306: \& Alias ::= \*(AqUser_Alias\*(Aq User_Alias (\*(Aq:\*(Aq User_Alias)* |
307: \& \*(AqRunas_Alias\*(Aq Runas_Alias (\*(Aq:\*(Aq Runas_Alias)* |
308: \& \*(AqHost_Alias\*(Aq Host_Alias (\*(Aq:\*(Aq Host_Alias)* |
309: \& \*(AqCmnd_Alias\*(Aq Cmnd_Alias (\*(Aq:\*(Aq Cmnd_Alias)*
310: \&
311: \& User_Alias ::= NAME \*(Aq=\*(Aq User_List
312: \&
313: \& Runas_Alias ::= NAME \*(Aq=\*(Aq Runas_List
314: \&
315: \& Host_Alias ::= NAME \*(Aq=\*(Aq Host_List
316: \&
317: \& Cmnd_Alias ::= NAME \*(Aq=\*(Aq Cmnd_List
318: \&
319: \& NAME ::= [A\-Z]([A\-Z][0\-9]_)*
320: .Ve
321: .PP
322: Each \fIalias\fR definition is of the form
323: .PP
324: .Vb 1
325: \& Alias_Type NAME = item1, item2, ...
326: .Ve
327: .PP
328: where \fIAlias_Type\fR is one of \f(CW\*(C`User_Alias\*(C'\fR, \f(CW\*(C`Runas_Alias\*(C'\fR, \f(CW\*(C`Host_Alias\*(C'\fR,
329: or \f(CW\*(C`Cmnd_Alias\*(C'\fR. A \f(CW\*(C`NAME\*(C'\fR is a string of uppercase letters, numbers,
330: and underscore characters ('_'). A \f(CW\*(C`NAME\*(C'\fR \fBmust\fR start with an
331: uppercase letter. It is possible to put several alias definitions
332: of the same type on a single line, joined by a colon (':'). E.g.,
333: .PP
334: .Vb 1
335: \& Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
336: .Ve
337: .PP
338: The definitions of what constitutes a valid \fIalias\fR member follow.
339: .PP
340: .Vb 2
341: \& User_List ::= User |
342: \& User \*(Aq,\*(Aq User_List
343: \&
344: \& User ::= \*(Aq!\*(Aq* user name |
345: \& \*(Aq!\*(Aq* #uid |
346: \& \*(Aq!\*(Aq* %group |
347: \& \*(Aq!\*(Aq* %#gid |
348: \& \*(Aq!\*(Aq* +netgroup |
349: \& \*(Aq!\*(Aq* %:nonunix_group |
350: \& \*(Aq!\*(Aq* %:#nonunix_gid |
351: \& \*(Aq!\*(Aq* User_Alias
352: .Ve
353: .PP
354: A \f(CW\*(C`User_List\*(C'\fR is made up of one or more user names, user ids
355: (prefixed with '#'), system group names and ids (prefixed with '%'
356: and '%#' respectively), netgroups (prefixed with '+'), non-Unix
357: group names and IDs (prefixed with '%:' and '%:#' respectively) and
358: \&\f(CW\*(C`User_Alias\*(C'\fRes. Each list item may be prefixed with zero or more
359: \&'!' operators. An odd number of '!' operators negate the value of
360: the item; an even number just cancel each other out.
361: .PP
362: A \f(CW\*(C`user name\*(C'\fR, \f(CW\*(C`uid\*(C'\fR, \f(CW\*(C`group\*(C'\fR, \f(CW\*(C`gid\*(C'\fR, \f(CW\*(C`netgroup\*(C'\fR, \f(CW\*(C`nonunix_group\*(C'\fR
363: or \f(CW\*(C`nonunix_gid\*(C'\fR may be enclosed in double quotes to avoid the
364: need for escaping special characters. Alternately, special characters
365: may be specified in escaped hex mode, e.g. \ex20 for space. When
366: using double quotes, any prefix characters must be included inside
367: the quotes.
368: .PP
369: The actual \f(CW\*(C`nonunix_group\*(C'\fR and \f(CW\*(C`nonunix_gid\*(C'\fR syntax depends on
370: the underlying group provider plugin (see the \fIgroup_plugin\fR
371: description below). For instance, the \s-1QAS\s0 \s-1AD\s0 plugin supports the
372: following formats:
373: .IP "\(bu" 4
374: Group in the same domain: \*(L"Group Name\*(R"
375: .IP "\(bu" 4
376: Group in any domain: \*(L"Group Name@FULLY.QUALIFIED.DOMAIN\*(R"
377: .IP "\(bu" 4
378: Group \s-1SID:\s0 \*(L"S\-1\-2\-34\-5678901234\-5678901234\-5678901234\-567\*(R"
379: .PP
380: Note that quotes around group names are optional. Unquoted strings
381: must use a backslash (\e) to escape spaces and special characters.
382: See \*(L"Other special characters and reserved words\*(R" for a list of
383: characters that need to be escaped.
384: .PP
385: .Vb 2
386: \& Runas_List ::= Runas_Member |
387: \& Runas_Member \*(Aq,\*(Aq Runas_List
388: \&
389: \& Runas_Member ::= \*(Aq!\*(Aq* user name |
390: \& \*(Aq!\*(Aq* #uid |
391: \& \*(Aq!\*(Aq* %group |
392: \& \*(Aq!\*(Aq* %#gid |
393: \& \*(Aq!\*(Aq* %:nonunix_group |
394: \& \*(Aq!\*(Aq* %:#nonunix_gid |
395: \& \*(Aq!\*(Aq* +netgroup |
396: \& \*(Aq!\*(Aq* Runas_Alias
397: .Ve
398: .PP
399: A \f(CW\*(C`Runas_List\*(C'\fR is similar to a \f(CW\*(C`User_List\*(C'\fR except that instead
400: of \f(CW\*(C`User_Alias\*(C'\fRes it can contain \f(CW\*(C`Runas_Alias\*(C'\fRes. Note that
401: user names and groups are matched as strings. In other words, two
402: users (groups) with the same uid (gid) are considered to be distinct.
403: If you wish to match all user names with the same uid (e.g.\ root
404: and toor), you can use a uid instead (#0 in the example given).
405: .PP
406: .Vb 2
407: \& Host_List ::= Host |
408: \& Host \*(Aq,\*(Aq Host_List
409: \&
410: \& Host ::= \*(Aq!\*(Aq* host name |
411: \& \*(Aq!\*(Aq* ip_addr |
412: \& \*(Aq!\*(Aq* network(/netmask)? |
413: \& \*(Aq!\*(Aq* +netgroup |
414: \& \*(Aq!\*(Aq* Host_Alias
415: .Ve
416: .PP
417: A \f(CW\*(C`Host_List\*(C'\fR is made up of one or more host names, \s-1IP\s0 addresses,
418: network numbers, netgroups (prefixed with '+') and other aliases.
419: Again, the value of an item may be negated with the '!' operator.
420: If you do not specify a netmask along with the network number,
421: \&\fBsudo\fR will query each of the local host's network interfaces and,
422: if the network number corresponds to one of the hosts's network
423: interfaces, the corresponding netmask will be used. The netmask
424: may be specified either in standard \s-1IP\s0 address notation
425: (e.g.\ 255.255.255.0 or ffff:ffff:ffff:ffff::),
426: or \s-1CIDR\s0 notation (number of bits, e.g.\ 24 or 64). A host name may
427: include shell-style wildcards (see the Wildcards section below),
428: but unless the \f(CW\*(C`host name\*(C'\fR command on your machine returns the fully
429: qualified host name, you'll need to use the \fIfqdn\fR option for
430: wildcards to be useful. Note \fBsudo\fR only inspects actual network
431: interfaces; this means that \s-1IP\s0 address 127.0.0.1 (localhost) will
432: never match. Also, the host name \*(L"localhost\*(R" will only match if
433: that is the actual host name, which is usually only the case for
434: non-networked systems.
435: .PP
436: .Vb 2
437: \& Cmnd_List ::= Cmnd |
438: \& Cmnd \*(Aq,\*(Aq Cmnd_List
439: \&
440: \& commandname ::= file name |
441: \& file name args |
442: \& file name \*(Aq""\*(Aq
443: \&
444: \& Cmnd ::= \*(Aq!\*(Aq* commandname |
445: \& \*(Aq!\*(Aq* directory |
446: \& \*(Aq!\*(Aq* "sudoedit" |
447: \& \*(Aq!\*(Aq* Cmnd_Alias
448: .Ve
449: .PP
450: A \f(CW\*(C`Cmnd_List\*(C'\fR is a list of one or more commandnames, directories, and other
451: aliases. A commandname is a fully qualified file name which may include
452: shell-style wildcards (see the Wildcards section below). A simple
453: file name allows the user to run the command with any arguments he/she
454: wishes. However, you may also specify command line arguments (including
455: wildcards). Alternately, you can specify \f(CW""\fR to indicate that the command
456: may only be run \fBwithout\fR command line arguments. A directory is a
457: fully qualified path name ending in a '/'. When you specify a directory
458: in a \f(CW\*(C`Cmnd_List\*(C'\fR, the user will be able to run any file within that directory
459: (but not in any subdirectories therein).
460: .PP
461: If a \f(CW\*(C`Cmnd\*(C'\fR has associated command line arguments, then the arguments
462: in the \f(CW\*(C`Cmnd\*(C'\fR must match exactly those given by the user on the command line
463: (or match the wildcards if there are any). Note that the following
464: characters must be escaped with a '\e' if they are used in command
465: arguments: ',', ':', '=', '\e'. The special command \f(CW"sudoedit"\fR
466: is used to permit a user to run \fBsudo\fR with the \fB\-e\fR option (or
467: as \fBsudoedit\fR). It may take command line arguments just as
468: a normal command does.
469: .SS "Defaults"
470: .IX Subsection "Defaults"
471: Certain configuration options may be changed from their default
472: values at runtime via one or more \f(CW\*(C`Default_Entry\*(C'\fR lines. These
473: may affect all users on any host, all users on a specific host, a
474: specific user, a specific command, or commands being run as a specific user.
475: Note that per-command entries may not include command line arguments.
476: If you need to specify arguments, define a \f(CW\*(C`Cmnd_Alias\*(C'\fR and reference
477: that instead.
478: .PP
479: .Vb 5
480: \& Default_Type ::= \*(AqDefaults\*(Aq |
481: \& \*(AqDefaults\*(Aq \*(Aq@\*(Aq Host_List |
482: \& \*(AqDefaults\*(Aq \*(Aq:\*(Aq User_List |
483: \& \*(AqDefaults\*(Aq \*(Aq!\*(Aq Cmnd_List |
484: \& \*(AqDefaults\*(Aq \*(Aq>\*(Aq Runas_List
485: \&
486: \& Default_Entry ::= Default_Type Parameter_List
487: \&
488: \& Parameter_List ::= Parameter |
489: \& Parameter \*(Aq,\*(Aq Parameter_List
490: \&
491: \& Parameter ::= Parameter \*(Aq=\*(Aq Value |
492: \& Parameter \*(Aq+=\*(Aq Value |
493: \& Parameter \*(Aq\-=\*(Aq Value |
494: \& \*(Aq!\*(Aq* Parameter
495: .Ve
496: .PP
497: Parameters may be \fBflags\fR, \fBinteger\fR values, \fBstrings\fR, or \fBlists\fR.
498: Flags are implicitly boolean and can be turned off via the '!'
499: operator. Some integer, string and list parameters may also be
500: used in a boolean context to disable them. Values may be enclosed
501: in double quotes (\f(CW\*(C`"\*(C'\fR) when they contain multiple words. Special
502: characters may be escaped with a backslash (\f(CW\*(C`\e\*(C'\fR).
503: .PP
504: Lists have two additional assignment operators, \f(CW\*(C`+=\*(C'\fR and \f(CW\*(C`\-=\*(C'\fR.
505: These operators are used to add to and delete from a list respectively.
506: It is not an error to use the \f(CW\*(C`\-=\*(C'\fR operator to remove an element
507: that does not exist in a list.
508: .PP
509: Defaults entries are parsed in the following order: generic, host
510: and user Defaults first, then runas Defaults and finally command
511: defaults.
512: .PP
513: See \*(L"\s-1SUDOERS\s0 \s-1OPTIONS\s0\*(R" for a list of supported Defaults parameters.
514: .SS "User Specification"
515: .IX Subsection "User Specification"
516: .Vb 2
517: \& User_Spec ::= User_List Host_List \*(Aq=\*(Aq Cmnd_Spec_List \e
518: \& (\*(Aq:\*(Aq Host_List \*(Aq=\*(Aq Cmnd_Spec_List)*
519: \&
520: \& Cmnd_Spec_List ::= Cmnd_Spec |
521: \& Cmnd_Spec \*(Aq,\*(Aq Cmnd_Spec_List
522: \&
523: .ie \n(SL \& Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Tag_Spec* Cmnd
524: .el \& Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
525: \&
526: \& Runas_Spec ::= \*(Aq(\*(Aq Runas_List? (\*(Aq:\*(Aq Runas_List)? \*(Aq)\*(Aq
527: \&
528: .if \n(SL \{\
529: \& SELinux_Spec ::= (\*(AqROLE=role\*(Aq | \*(AqTYPE=type\*(Aq)
530: \&
531: \}
532: \& Tag_Spec ::= (\*(AqNOPASSWD:\*(Aq | \*(AqPASSWD:\*(Aq | \*(AqNOEXEC:\*(Aq | \*(AqEXEC:\*(Aq |
533: \& \*(AqSETENV:\*(Aq | \*(AqNOSETENV:\*(Aq | \*(AqLOG_INPUT:\*(Aq | \*(AqNOLOG_INPUT:\*(Aq |
534: \& \*(AqLOG_OUTPUT:\*(Aq | \*(AqNOLOG_OUTPUT:\*(Aq)
535: .Ve
536: .PP
537: A \fBuser specification\fR determines which commands a user may run
538: (and as what user) on specified hosts. By default, commands are
539: run as \fBroot\fR, but this can be changed on a per-command basis.
540: .PP
541: The basic structure of a user specification is `who where = (as_whom)
542: what'. Let's break that down into its constituent parts:
543: .SS "Runas_Spec"
544: .IX Subsection "Runas_Spec"
545: A \f(CW\*(C`Runas_Spec\*(C'\fR determines the user and/or the group that a command
546: may be run as. A fully-specified \f(CW\*(C`Runas_Spec\*(C'\fR consists of two
547: \&\f(CW\*(C`Runas_List\*(C'\fRs (as defined above) separated by a colon (':') and
548: enclosed in a set of parentheses. The first \f(CW\*(C`Runas_List\*(C'\fR indicates
549: which users the command may be run as via \fBsudo\fR's \fB\-u\fR option.
550: The second defines a list of groups that can be specified via
551: \&\fBsudo\fR's \fB\-g\fR option. If both \f(CW\*(C`Runas_List\*(C'\fRs are specified, the
552: command may be run with any combination of users and groups listed
553: in their respective \f(CW\*(C`Runas_List\*(C'\fRs. If only the first is specified,
554: the command may be run as any user in the list but no \fB\-g\fR option
555: may be specified. If the first \f(CW\*(C`Runas_List\*(C'\fR is empty but the
556: second is specified, the command may be run as the invoking user
557: with the group set to any listed in the \f(CW\*(C`Runas_List\*(C'\fR. If no
558: \&\f(CW\*(C`Runas_Spec\*(C'\fR is specified the command may be run as \fBroot\fR and
559: no group may be specified.
560: .PP
561: A \f(CW\*(C`Runas_Spec\*(C'\fR sets the default for the commands that follow it.
562: What this means is that for the entry:
563: .PP
564: .Vb 1
565: \& dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
566: .Ve
567: .PP
568: The user \fBdgb\fR may run \fI/bin/ls\fR, \fI/bin/kill\fR, and
569: \&\fI/usr/bin/lprm\fR \*(-- but only as \fBoperator\fR. E.g.,
570: .PP
571: .Vb 1
572: \& $ sudo \-u operator /bin/ls
573: .Ve
574: .PP
575: It is also possible to override a \f(CW\*(C`Runas_Spec\*(C'\fR later on in an
576: entry. If we modify the entry like so:
577: .PP
578: .Vb 1
579: \& dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
580: .Ve
581: .PP
582: Then user \fBdgb\fR is now allowed to run \fI/bin/ls\fR as \fBoperator\fR,
583: but \fI/bin/kill\fR and \fI/usr/bin/lprm\fR as \fBroot\fR.
584: .PP
585: We can extend this to allow \fBdgb\fR to run \f(CW\*(C`/bin/ls\*(C'\fR with either
586: the user or group set to \fBoperator\fR:
587: .PP
588: .Vb 2
589: \& dgb boulder = (operator : operator) /bin/ls, (root) /bin/kill, \e
590: \& /usr/bin/lprm
591: .Ve
592: .PP
593: Note that while the group portion of the \f(CW\*(C`Runas_Spec\*(C'\fR permits the
594: user to run as command with that group, it does not force the user
595: to do so. If no group is specified on the command line, the command
596: will run with the group listed in the target user's password database
597: entry. The following would all be permitted by the sudoers entry above:
598: .PP
599: .Vb 3
600: \& $ sudo \-u operator /bin/ls
601: \& $ sudo \-u operator \-g operator /bin/ls
602: \& $ sudo \-g operator /bin/ls
603: .Ve
604: .PP
605: In the following example, user \fBtcm\fR may run commands that access
606: a modem device file with the dialer group.
607: .PP
608: .Vb 2
609: \& tcm boulder = (:dialer) /usr/bin/tip, /usr/bin/cu, \e
610: \& /usr/local/bin/minicom
611: .Ve
612: .PP
613: Note that in this example only the group will be set, the command
614: still runs as user \fBtcm\fR. E.g.
615: .PP
616: .Vb 1
617: \& $ sudo \-g dialer /usr/bin/cu
618: .Ve
619: .PP
620: Multiple users and groups may be present in a \f(CW\*(C`Runas_Spec\*(C'\fR, in
621: which case the user may select any combination of users and groups
622: via the \fB\-u\fR and \fB\-g\fR options. In this example:
623: .PP
624: .Vb 1
625: \& alan ALL = (root, bin : operator, system) ALL
626: .Ve
627: .PP
628: user \fBalan\fR may run any command as either user root or bin,
629: optionally setting the group to operator or system.
630: .if \n(SL \{\
631: .SS "SELinux_Spec"
632: .IX Subsection "SELinux_Spec"
633: On systems with SELinux support, \fIsudoers\fR entries may optionally have
634: an SELinux role and/or type associated with a command. If a role or
635: type is specified with the command it will override any default values
636: specified in \fIsudoers\fR. A role or type specified on the command line,
637: however, will supercede the values in \fIsudoers\fR.
638: \}
639: .SS "Tag_Spec"
640: .IX Subsection "Tag_Spec"
641: A command may have zero or more tags associated with it. There are
642: eight possible tag values, \f(CW\*(C`NOPASSWD\*(C'\fR, \f(CW\*(C`PASSWD\*(C'\fR, \f(CW\*(C`NOEXEC\*(C'\fR,
643: \&\f(CW\*(C`EXEC\*(C'\fR, \f(CW\*(C`SETENV\*(C'\fR, \f(CW\*(C`NOSETENV\*(C'\fR, \f(CW\*(C`LOG_INPUT\*(C'\fR, \f(CW\*(C`NOLOG_INPUT\*(C'\fR,
644: \&\f(CW\*(C`LOG_OUTPUT\*(C'\fR and \f(CW\*(C`NOLOG_OUTPUT\*(C'\fR. Once a tag is set on a \f(CW\*(C`Cmnd\*(C'\fR,
645: subsequent \f(CW\*(C`Cmnd\*(C'\fRs in the \f(CW\*(C`Cmnd_Spec_List\*(C'\fR, inherit the tag unless
646: it is overridden by the opposite tag (i.e.: \f(CW\*(C`PASSWD\*(C'\fR overrides
647: \&\f(CW\*(C`NOPASSWD\*(C'\fR and \f(CW\*(C`NOEXEC\*(C'\fR overrides \f(CW\*(C`EXEC\*(C'\fR).
648: .PP
649: \fI\s-1NOPASSWD\s0 and \s-1PASSWD\s0\fR
650: .IX Subsection "NOPASSWD and PASSWD"
651: .PP
652: By default, \fBsudo\fR requires that a user authenticate him or herself
653: before running a command. This behavior can be modified via the
654: \&\f(CW\*(C`NOPASSWD\*(C'\fR tag. Like a \f(CW\*(C`Runas_Spec\*(C'\fR, the \f(CW\*(C`NOPASSWD\*(C'\fR tag sets
655: a default for the commands that follow it in the \f(CW\*(C`Cmnd_Spec_List\*(C'\fR.
656: Conversely, the \f(CW\*(C`PASSWD\*(C'\fR tag can be used to reverse things.
657: For example:
658: .PP
659: .Vb 1
660: \& ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
661: .Ve
662: .PP
663: would allow the user \fBray\fR to run \fI/bin/kill\fR, \fI/bin/ls\fR, and
664: \&\fI/usr/bin/lprm\fR as \fBroot\fR on the machine rushmore without
665: authenticating himself. If we only want \fBray\fR to be able to
666: run \fI/bin/kill\fR without a password the entry would be:
667: .PP
668: .Vb 1
669: \& ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
670: .Ve
671: .PP
672: Note, however, that the \f(CW\*(C`PASSWD\*(C'\fR tag has no effect on users who are
673: in the group specified by the \fIexempt_group\fR option.
674: .PP
675: By default, if the \f(CW\*(C`NOPASSWD\*(C'\fR tag is applied to any of the entries
676: for a user on the current host, he or she will be able to run
677: \&\f(CW\*(C`sudo \-l\*(C'\fR without a password. Additionally, a user may only run
678: \&\f(CW\*(C`sudo \-v\*(C'\fR without a password if the \f(CW\*(C`NOPASSWD\*(C'\fR tag is present
679: for all a user's entries that pertain to the current host.
680: This behavior may be overridden via the verifypw and listpw options.
681: .PP
682: \fI\s-1NOEXEC\s0 and \s-1EXEC\s0\fR
683: .IX Subsection "NOEXEC and EXEC"
684: .PP
685: If \fBsudo\fR has been compiled with \fInoexec\fR support and the underlying
686: operating system supports it, the \f(CW\*(C`NOEXEC\*(C'\fR tag can be used to prevent
687: a dynamically-linked executable from running further commands itself.
688: .PP
689: In the following example, user \fBaaron\fR may run \fI/usr/bin/more\fR
690: and \fI/usr/bin/vi\fR but shell escapes will be disabled.
691: .PP
692: .Vb 1
693: \& aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
694: .Ve
695: .PP
696: See the \*(L"\s-1PREVENTING\s0 \s-1SHELL\s0 \s-1ESCAPES\s0\*(R" section below for more details
697: on how \f(CW\*(C`NOEXEC\*(C'\fR works and whether or not it will work on your system.
698: .PP
699: \fI\s-1SETENV\s0 and \s-1NOSETENV\s0\fR
700: .IX Subsection "SETENV and NOSETENV"
701: .PP
702: These tags override the value of the \fIsetenv\fR option on a per-command
703: basis. Note that if \f(CW\*(C`SETENV\*(C'\fR has been set for a command, the user
704: may disable the \fIenv_reset\fR option from the command line via the
705: \&\fB\-E\fR option. Additionally, environment variables set on the command
706: line are not subject to the restrictions imposed by \fIenv_check\fR,
707: \&\fIenv_delete\fR, or \fIenv_keep\fR. As such, only trusted users should
708: be allowed to set variables in this manner. If the command matched
709: is \fB\s-1ALL\s0\fR, the \f(CW\*(C`SETENV\*(C'\fR tag is implied for that command; this
710: default may be overridden by use of the \f(CW\*(C`NOSETENV\*(C'\fR tag.
711: .PP
712: \fI\s-1LOG_INPUT\s0 and \s-1NOLOG_INPUT\s0\fR
713: .IX Subsection "LOG_INPUT and NOLOG_INPUT"
714: .PP
715: These tags override the value of the \fIlog_input\fR option on a
716: per-command basis. For more information, see the description of
717: \&\fIlog_input\fR in the \*(L"\s-1SUDOERS\s0 \s-1OPTIONS\s0\*(R" section below.
718: .PP
719: \fI\s-1LOG_OUTPUT\s0 and \s-1NOLOG_OUTPUT\s0\fR
720: .IX Subsection "LOG_OUTPUT and NOLOG_OUTPUT"
721: .PP
722: These tags override the value of the \fIlog_output\fR option on a
723: per-command basis. For more information, see the description of
724: \&\fIlog_output\fR in the \*(L"\s-1SUDOERS\s0 \s-1OPTIONS\s0\*(R" section below.
725: .SS "Wildcards"
726: .IX Subsection "Wildcards"
727: \&\fBsudo\fR allows shell-style \fIwildcards\fR (aka meta or glob characters)
728: to be used in host names, path names and command line arguments in
729: the \fIsudoers\fR file. Wildcard matching is done via the \fB\s-1POSIX\s0\fR
730: \&\fIglob\fR\|(3) and \fIfnmatch\fR\|(3) routines. Note that these are \fInot\fR
731: regular expressions.
732: .ie n .IP "\*(C`*\*(C'" 8
733: .el .IP "\f(CW\*(C`*\*(C'\fR" 8
734: .IX Item "*"
735: Matches any set of zero or more characters.
736: .ie n .IP "\*(C`?\*(C'" 8
737: .el .IP "\f(CW\*(C`?\*(C'\fR" 8
738: .IX Item "?"
739: Matches any single character.
740: .ie n .IP "\*(C`[...]\*(C'" 8
741: .el .IP "\f(CW\*(C`[...]\*(C'\fR" 8
742: .IX Item "[...]"
743: Matches any character in the specified range.
744: .ie n .IP "\*(C`[!...]\*(C'" 8
745: .el .IP "\f(CW\*(C`[!...]\*(C'\fR" 8
746: .IX Item "[!...]"
747: Matches any character \fBnot\fR in the specified range.
748: .ie n .IP "\*(C`\ex\*(C'" 8
749: .el .IP "\f(CW\*(C`\ex\*(C'\fR" 8
750: .IX Item "x"
751: For any character \*(L"x\*(R", evaluates to \*(L"x\*(R". This is used to
752: escape special characters such as: \*(L"*\*(R", \*(L"?\*(R", \*(L"[\*(R", and \*(L"}\*(R".
753: .PP
754: \&\s-1POSIX\s0 character classes may also be used if your system's \fIglob\fR\|(3)
755: and \fIfnmatch\fR\|(3) functions support them. However, because the
756: \&\f(CW\*(Aq:\*(Aq\fR character has special meaning in \fIsudoers\fR, it must be
757: escaped. For example:
758: .PP
759: .Vb 1
760: \& /bin/ls [[\e:alpha\e:]]*
761: .Ve
762: .PP
763: Would match any file name beginning with a letter.
764: .PP
765: Note that a forward slash ('/') will \fBnot\fR be matched by
766: wildcards used in the path name. When matching the command
767: line arguments, however, a slash \fBdoes\fR get matched by
768: wildcards. This is to make a path like:
769: .PP
770: .Vb 1
771: \& /usr/bin/*
772: .Ve
773: .PP
774: match \fI/usr/bin/who\fR but not \fI/usr/bin/X11/xterm\fR.
775: .SS "Exceptions to wildcard rules"
776: .IX Subsection "Exceptions to wildcard rules"
777: The following exceptions apply to the above rules:
778: .ie n .IP """""" 8
779: .el .IP "\f(CW``''\fR" 8
780: .IX Item """"""
781: If the empty string \f(CW""\fR is the only command line argument in the
782: \&\fIsudoers\fR entry it means that command is not allowed to be run
783: with \fBany\fR arguments.
784: .SS "Including other files from within sudoers"
785: .IX Subsection "Including other files from within sudoers"
786: It is possible to include other \fIsudoers\fR files from within the
787: \&\fIsudoers\fR file currently being parsed using the \f(CW\*(C`#include\*(C'\fR and
788: \&\f(CW\*(C`#includedir\*(C'\fR directives.
789: .PP
790: This can be used, for example, to keep a site-wide \fIsudoers\fR file
791: in addition to a local, per-machine file. For the sake of this
792: example the site-wide \fIsudoers\fR will be \fI/etc/sudoers\fR and the
793: per-machine one will be \fI/etc/sudoers.local\fR. To include
794: \&\fI/etc/sudoers.local\fR from within \fI/etc/sudoers\fR we would use the
795: following line in \fI/etc/sudoers\fR:
796: .Sp
797: .RS 4
798: \&\f(CW\*(C`#include /etc/sudoers.local\*(C'\fR
799: .RE
800: .PP
801: When \fBsudo\fR reaches this line it will suspend processing of the
802: current file (\fI/etc/sudoers\fR) and switch to \fI/etc/sudoers.local\fR.
803: Upon reaching the end of \fI/etc/sudoers.local\fR, the rest of
804: \&\fI/etc/sudoers\fR will be processed. Files that are included may
805: themselves include other files. A hard limit of 128 nested include
806: files is enforced to prevent include file loops.
807: .PP
808: The file name may include the \f(CW%h\fR escape, signifying the short form
809: of the host name. I.e., if the machine's host name is \*(L"xerxes\*(R", then
810: .PP
811: \&\f(CW\*(C`#include /etc/sudoers.%h\*(C'\fR
812: .PP
813: will cause \fBsudo\fR to include the file \fI/etc/sudoers.xerxes\fR.
814: .PP
815: The \f(CW\*(C`#includedir\*(C'\fR directive can be used to create a \fIsudo.d\fR
816: directory that the system package manager can drop \fIsudoers\fR rules
817: into as part of package installation. For example, given:
818: .PP
819: \&\f(CW\*(C`#includedir /etc/sudoers.d\*(C'\fR
820: .PP
821: \&\fBsudo\fR will read each file in \fI/etc/sudoers.d\fR, skipping file
822: names that end in \f(CW\*(C`~\*(C'\fR or contain a \f(CW\*(C`.\*(C'\fR character to avoid causing
823: problems with package manager or editor temporary/backup files.
824: Files are parsed in sorted lexical order. That is,
825: \&\fI/etc/sudoers.d/01_first\fR will be parsed before
826: \&\fI/etc/sudoers.d/10_second\fR. Be aware that because the sorting is
827: lexical, not numeric, \fI/etc/sudoers.d/1_whoops\fR would be loaded
828: \&\fBafter\fR \fI/etc/sudoers.d/10_second\fR. Using a consistent number
829: of leading zeroes in the file names can be used to avoid such
830: problems.
831: .PP
832: Note that unlike files included via \f(CW\*(C`#include\*(C'\fR, \fBvisudo\fR will not
833: edit the files in a \f(CW\*(C`#includedir\*(C'\fR directory unless one of them
834: contains a syntax error. It is still possible to run \fBvisudo\fR
835: with the \f(CW\*(C`\-f\*(C'\fR flag to edit the files directly.
836: .SS "Other special characters and reserved words"
837: .IX Subsection "Other special characters and reserved words"
838: The pound sign ('#') is used to indicate a comment (unless it is
839: part of a #include directive or unless it occurs in the context of
840: a user name and is followed by one or more digits, in which case
841: it is treated as a uid). Both the comment character and any text
842: after it, up to the end of the line, are ignored.
843: .PP
844: The reserved word \fB\s-1ALL\s0\fR is a built-in \fIalias\fR that always causes
845: a match to succeed. It can be used wherever one might otherwise
846: use a \f(CW\*(C`Cmnd_Alias\*(C'\fR, \f(CW\*(C`User_Alias\*(C'\fR, \f(CW\*(C`Runas_Alias\*(C'\fR, or \f(CW\*(C`Host_Alias\*(C'\fR.
847: You should not try to define your own \fIalias\fR called \fB\s-1ALL\s0\fR as the
848: built-in alias will be used in preference to your own. Please note
849: that using \fB\s-1ALL\s0\fR can be dangerous since in a command context, it
850: allows the user to run \fBany\fR command on the system.
851: .PP
852: An exclamation point ('!') can be used as a logical \fInot\fR operator
853: both in an \fIalias\fR and in front of a \f(CW\*(C`Cmnd\*(C'\fR. This allows one to
854: exclude certain values. Note, however, that using a \f(CW\*(C`!\*(C'\fR in
855: conjunction with the built-in \f(CW\*(C`ALL\*(C'\fR alias to allow a user to
856: run \*(L"all but a few\*(R" commands rarely works as intended (see \s-1SECURITY\s0
857: \&\s-1NOTES\s0 below).
858: .PP
859: Long lines can be continued with a backslash ('\e') as the last
860: character on the line.
861: .PP
862: Whitespace between elements in a list as well as special syntactic
863: characters in a \fIUser Specification\fR ('=', ':', '(', ')') is optional.
864: .PP
865: The following characters must be escaped with a backslash ('\e') when
866: used as part of a word (e.g.\ a user name or host name):
867: \&'!', '=', ':', ',', '(', ')', '\e'.
868: .SH "SUDOERS OPTIONS"
869: .IX Header "SUDOERS OPTIONS"
870: \&\fBsudo\fR's behavior can be modified by \f(CW\*(C`Default_Entry\*(C'\fR lines, as
871: explained earlier. A list of all supported Defaults parameters,
872: grouped by type, are listed below.
873: .PP
874: \&\fBBoolean Flags\fR:
875: .IP "always_set_home" 16
876: .IX Item "always_set_home"
877: If enabled, \fBsudo\fR will set the \f(CW\*(C`HOME\*(C'\fR environment variable to the
878: home directory of the target user (which is root unless the \fB\-u\fR
879: option is used). This effectively means that the \fB\-H\fR option is
880: always implied. Note that \f(CW\*(C`HOME\*(C'\fR is already set when the the
881: \&\fIenv_reset\fR option is enabled, so \fIalways_set_home\fR is only
882: effective for configurations where either \fIenv_reset\fR is disabled
883: or \f(CW\*(C`HOME\*(C'\fR is present in the \fIenv_keep\fR list.
884: This flag is \fIoff\fR by default.
885: .IP "authenticate" 16
886: .IX Item "authenticate"
887: If set, users must authenticate themselves via a password (or other
888: means of authentication) before they may run commands. This default
889: may be overridden via the \f(CW\*(C`PASSWD\*(C'\fR and \f(CW\*(C`NOPASSWD\*(C'\fR tags.
890: This flag is \fIon\fR by default.
891: .IP "closefrom_override" 16
892: .IX Item "closefrom_override"
893: If set, the user may use \fBsudo\fR's \fB\-C\fR option which
894: overrides the default starting point at which \fBsudo\fR begins
895: closing open file descriptors. This flag is \fIoff\fR by default.
896: .IP "compress_io" 16
897: .IX Item "compress_io"
898: If set, and \fBsudo\fR is configured to log a command's input or output,
899: the I/O logs will be compressed using \fBzlib\fR. This flag is \fIon\fR
900: by default when \fBsudo\fR is compiled with \fBzlib\fR support.
901: .IP "env_editor" 16
902: .IX Item "env_editor"
903: If set, \fBvisudo\fR will use the value of the \s-1EDITOR\s0 or \s-1VISUAL\s0
904: environment variables before falling back on the default editor list.
905: Note that this may create a security hole as it allows the user to
906: run any arbitrary command as root without logging. A safer alternative
907: is to place a colon-separated list of editors in the \f(CW\*(C`editor\*(C'\fR
908: variable. \fBvisudo\fR will then only use the \s-1EDITOR\s0 or \s-1VISUAL\s0 if
909: they match a value specified in \f(CW\*(C`editor\*(C'\fR. This flag is \fI@env_editor@\fR by
910: default.
911: .IP "env_reset" 16
912: .IX Item "env_reset"
913: If set, \fBsudo\fR will reset the environment to only contain the
914: \&\s-1LOGNAME\s0, \s-1MAIL\s0, \s-1SHELL\s0, \s-1USER\s0, \s-1USERNAME\s0 and the \f(CW\*(C`SUDO_*\*(C'\fR variables. Any
915: variables in the caller's environment that match the \f(CW\*(C`env_keep\*(C'\fR
916: and \f(CW\*(C`env_check\*(C'\fR lists are then added. The default contents of the
917: \&\f(CW\*(C`env_keep\*(C'\fR and \f(CW\*(C`env_check\*(C'\fR lists are displayed when \fBsudo\fR is
918: run by root with the \fI\-V\fR option. If the \fIsecure_path\fR option
919: is set, its value will be used for the \f(CW\*(C`PATH\*(C'\fR environment variable.
920: This flag is \fI@env_reset@\fR by default.
921: .IP "fast_glob" 16
922: .IX Item "fast_glob"
923: Normally, \fBsudo\fR uses the \fIglob\fR\|(3) function to do shell-style
924: globbing when matching path names. However, since it accesses the
925: file system, \fIglob\fR\|(3) can take a long time to complete for some
926: patterns, especially when the pattern references a network file
927: system that is mounted on demand (automounted). The \fIfast_glob\fR
928: option causes \fBsudo\fR to use the \fIfnmatch\fR\|(3) function, which does
929: not access the file system to do its matching. The disadvantage
930: of \fIfast_glob\fR is that it is unable to match relative path names
931: such as \fI./ls\fR or \fI../bin/ls\fR. This has security implications
932: when path names that include globbing characters are used with the
933: negation operator, \f(CW\*(Aq!\*(Aq\fR, as such rules can be trivially bypassed.
934: As such, this option should not be used when \fIsudoers\fR contains rules
935: that contain negated path names which include globbing characters.
936: This flag is \fIoff\fR by default.
937: .IP "fqdn" 16
938: .IX Item "fqdn"
939: Set this flag if you want to put fully qualified host names in the
940: \&\fIsudoers\fR file. I.e., instead of myhost you would use myhost.mydomain.edu.
941: You may still use the short form if you wish (and even mix the two).
942: Beware that turning on \fIfqdn\fR requires \fBsudo\fR to make \s-1DNS\s0 lookups
943: which may make \fBsudo\fR unusable if \s-1DNS\s0 stops working (for example
944: if the machine is not plugged into the network). Also note that
945: you must use the host's official name as \s-1DNS\s0 knows it. That is,
946: you may not use a host alias (\f(CW\*(C`CNAME\*(C'\fR entry) due to performance
947: issues and the fact that there is no way to get all aliases from
948: \&\s-1DNS\s0. If your machine's host name (as returned by the \f(CW\*(C`hostname\*(C'\fR
949: command) is already fully qualified you shouldn't need to set
950: \&\fIfqdn\fR. This flag is \fI@fqdn@\fR by default.
951: .IP "ignore_dot" 16
952: .IX Item "ignore_dot"
953: If set, \fBsudo\fR will ignore '.' or '' (current dir) in the \f(CW\*(C`PATH\*(C'\fR
954: environment variable; the \f(CW\*(C`PATH\*(C'\fR itself is not modified. This
955: flag is \fI@ignore_dot@\fR by default.
956: .IP "ignore_local_sudoers" 16
957: .IX Item "ignore_local_sudoers"
958: If set via \s-1LDAP\s0, parsing of \fI@sysconfdir@/sudoers\fR will be skipped.
959: This is intended for Enterprises that wish to prevent the usage of local
960: sudoers files so that only \s-1LDAP\s0 is used. This thwarts the efforts of
961: rogue operators who would attempt to add roles to \fI@sysconfdir@/sudoers\fR.
962: When this option is present, \fI@sysconfdir@/sudoers\fR does not even need to
963: exist. Since this option tells \fBsudo\fR how to behave when no specific \s-1LDAP\s0
964: entries have been matched, this sudoOption is only meaningful for the
965: \&\f(CW\*(C`cn=defaults\*(C'\fR section. This flag is \fIoff\fR by default.
966: .IP "insults" 16
967: .IX Item "insults"
968: If set, \fBsudo\fR will insult users when they enter an incorrect
969: password. This flag is \fI@insults@\fR by default.
970: .IP "log_host" 16
971: .IX Item "log_host"
972: If set, the host name will be logged in the (non-syslog) \fBsudo\fR log file.
973: This flag is \fIoff\fR by default.
974: .IP "log_input" 16
975: .IX Item "log_input"
976: If set, \fBsudo\fR will run the command in a \fIpseudo tty\fR and log all
977: user input.
978: If the standard input is not connected to the user's tty, due to
979: I/O redirection or because the command is part of a pipeline, that
980: input is also captured and stored in a separate log file.
981: .Sp
982: Input is logged to the directory specified by the \fIiolog_dir\fR
983: option (\fI@iolog_dir@\fR by default) using a unique session \s-1ID\s0 that
984: is included in the normal \fBsudo\fR log line, prefixed with \fITSID=\fR.
985: The \fIiolog_file\fR option may be used to control the format of the
986: session \s-1ID\s0.
987: .Sp
988: Note that user input may contain sensitive information such as
989: passwords (even if they are not echoed to the screen), which will
990: be stored in the log file unencrypted. In most cases, logging the
991: command output via \fIlog_output\fR is all that is required.
992: .IP "log_output" 16
993: .IX Item "log_output"
994: If set, \fBsudo\fR will run the command in a \fIpseudo tty\fR and log all
995: output that is sent to the screen, similar to the \fIscript\fR\|(1) command.
996: If the standard output or standard error is not connected to the
997: user's tty, due to I/O redirection or because the command is part
998: of a pipeline, that output is also captured and stored in separate
999: log files.
1000: .Sp
1001: Output is logged to the directory specified by the \fIiolog_dir\fR
1002: option (\fI@iolog_dir@\fR by default) using a unique session \s-1ID\s0 that
1003: is included in the normal \fBsudo\fR log line, prefixed with \fITSID=\fR.
1004: The \fIiolog_file\fR option may be used to control the format of the
1005: session \s-1ID\s0.
1006: .Sp
1007: Output logs may be viewed with the \fIsudoreplay\fR\|(@mansectsu@) utility, which
1008: can also be used to list or search the available logs.
1009: .IP "log_year" 16
1010: .IX Item "log_year"
1011: If set, the four-digit year will be logged in the (non-syslog) \fBsudo\fR log file.
1012: This flag is \fIoff\fR by default.
1013: .IP "long_otp_prompt" 16
1014: .IX Item "long_otp_prompt"
1015: When validating with a One Time Password (\s-1OTP\s0) scheme such as
1016: \&\fBS/Key\fR or \fB\s-1OPIE\s0\fR, a two-line prompt is used to make it easier
1017: to cut and paste the challenge to a local window. It's not as
1018: pretty as the default but some people find it more convenient. This
1019: flag is \fI@long_otp_prompt@\fR by default.
1020: .IP "mail_always" 16
1021: .IX Item "mail_always"
1022: Send mail to the \fImailto\fR user every time a users runs \fBsudo\fR.
1023: This flag is \fIoff\fR by default.
1024: .IP "mail_badpass" 16
1025: .IX Item "mail_badpass"
1026: Send mail to the \fImailto\fR user if the user running \fBsudo\fR does not
1027: enter the correct password. This flag is \fIoff\fR by default.
1028: .IP "mail_no_host" 16
1029: .IX Item "mail_no_host"
1030: If set, mail will be sent to the \fImailto\fR user if the invoking
1031: user exists in the \fIsudoers\fR file, but is not allowed to run
1032: commands on the current host. This flag is \fI@mail_no_host@\fR by default.
1033: .IP "mail_no_perms" 16
1034: .IX Item "mail_no_perms"
1035: If set, mail will be sent to the \fImailto\fR user if the invoking
1036: user is allowed to use \fBsudo\fR but the command they are trying is not
1037: listed in their \fIsudoers\fR file entry or is explicitly denied.
1038: This flag is \fI@mail_no_perms@\fR by default.
1039: .IP "mail_no_user" 16
1040: .IX Item "mail_no_user"
1041: If set, mail will be sent to the \fImailto\fR user if the invoking
1042: user is not in the \fIsudoers\fR file. This flag is \fI@mail_no_user@\fR
1043: by default.
1044: .IP "noexec" 16
1045: .IX Item "noexec"
1046: If set, all commands run via \fBsudo\fR will behave as if the \f(CW\*(C`NOEXEC\*(C'\fR
1047: tag has been set, unless overridden by a \f(CW\*(C`EXEC\*(C'\fR tag. See the
1048: description of \fI\s-1NOEXEC\s0 and \s-1EXEC\s0\fR below as well as the \*(L"\s-1PREVENTING\s0 \s-1SHELL\s0
1049: \&\s-1ESCAPES\s0\*(R" section at the end of this manual. This flag is \fIoff\fR by default.
1050: .IP "path_info" 16
1051: .IX Item "path_info"
1052: Normally, \fBsudo\fR will tell the user when a command could not be
1053: found in their \f(CW\*(C`PATH\*(C'\fR environment variable. Some sites may wish
1054: to disable this as it could be used to gather information on the
1055: location of executables that the normal user does not have access
1056: to. The disadvantage is that if the executable is simply not in
1057: the user's \f(CW\*(C`PATH\*(C'\fR, \fBsudo\fR will tell the user that they are not
1058: allowed to run it, which can be confusing. This flag is \fI@path_info@\fR
1059: by default.
1060: .IP "passprompt_override" 16
1061: .IX Item "passprompt_override"
1062: The password prompt specified by \fIpassprompt\fR will normally only
1063: be used if the password prompt provided by systems such as \s-1PAM\s0 matches
1064: the string \*(L"Password:\*(R". If \fIpassprompt_override\fR is set, \fIpassprompt\fR
1065: will always be used. This flag is \fIoff\fR by default.
1066: .IP "preserve_groups" 16
1067: .IX Item "preserve_groups"
1068: By default, \fBsudo\fR will initialize the group vector to the list of
1069: groups the target user is in. When \fIpreserve_groups\fR is set, the
1070: user's existing group vector is left unaltered. The real and
1071: effective group IDs, however, are still set to match the target
1072: user. This flag is \fIoff\fR by default.
1073: .IP "pwfeedback" 16
1074: .IX Item "pwfeedback"
1075: By default, \fBsudo\fR reads the password like most other Unix programs,
1076: by turning off echo until the user hits the return (or enter) key.
1077: Some users become confused by this as it appears to them that \fBsudo\fR
1078: has hung at this point. When \fIpwfeedback\fR is set, \fBsudo\fR will
1079: provide visual feedback when the user presses a key. Note that
1080: this does have a security impact as an onlooker may be able to
1081: determine the length of the password being entered.
1082: This flag is \fIoff\fR by default.
1083: .IP "requiretty" 16
1084: .IX Item "requiretty"
1085: If set, \fBsudo\fR will only run when the user is logged in to a real
1086: tty. When this flag is set, \fBsudo\fR can only be run from a login
1087: session and not via other means such as \fIcron\fR\|(@mansectsu@) or cgi-bin scripts.
1088: This flag is \fIoff\fR by default.
1089: .IP "root_sudo" 16
1090: .IX Item "root_sudo"
1091: If set, root is allowed to run \fBsudo\fR too. Disabling this prevents users
1092: from \*(L"chaining\*(R" \fBsudo\fR commands to get a root shell by doing something
1093: like \f(CW"sudo sudo /bin/sh"\fR. Note, however, that turning off \fIroot_sudo\fR
1094: will also prevent root from running \fBsudoedit\fR.
1095: Disabling \fIroot_sudo\fR provides no real additional security; it
1096: exists purely for historical reasons.
1097: This flag is \fI@root_sudo@\fR by default.
1098: .IP "rootpw" 16
1099: .IX Item "rootpw"
1100: If set, \fBsudo\fR will prompt for the root password instead of the password
1101: of the invoking user. This flag is \fIoff\fR by default.
1102: .IP "runaspw" 16
1103: .IX Item "runaspw"
1104: If set, \fBsudo\fR will prompt for the password of the user defined by the
1105: \&\fIrunas_default\fR option (defaults to \f(CW\*(C`@runas_default@\*(C'\fR) instead of the
1106: password of the invoking user. This flag is \fIoff\fR by default.
1107: .IP "set_home" 16
1108: .IX Item "set_home"
1109: If enabled and \fBsudo\fR is invoked with the \fB\-s\fR option the \f(CW\*(C`HOME\*(C'\fR
1110: environment variable will be set to the home directory of the target
1111: user (which is root unless the \fB\-u\fR option is used). This effectively
1112: makes the \fB\-s\fR option imply \fB\-H\fR. Note that \f(CW\*(C`HOME\*(C'\fR is already
1113: set when the the \fIenv_reset\fR option is enabled, so \fIset_home\fR is
1114: only effective for configurations where either \fIenv_reset\fR is disabled
1115: or \f(CW\*(C`HOME\*(C'\fR is present in the \fIenv_keep\fR list.
1116: This flag is \fIoff\fR by default.
1117: .IP "set_logname" 16
1118: .IX Item "set_logname"
1119: Normally, \fBsudo\fR will set the \f(CW\*(C`LOGNAME\*(C'\fR, \f(CW\*(C`USER\*(C'\fR and \f(CW\*(C`USERNAME\*(C'\fR
1120: environment variables to the name of the target user (usually root
1121: unless the \fB\-u\fR option is given). However, since some programs
1122: (including the \s-1RCS\s0 revision control system) use \f(CW\*(C`LOGNAME\*(C'\fR to
1123: determine the real identity of the user, it may be desirable to
1124: change this behavior. This can be done by negating the set_logname
1125: option. Note that if the \fIenv_reset\fR option has not been disabled,
1126: entries in the \fIenv_keep\fR list will override the value of
1127: \&\fIset_logname\fR. This flag is \fIon\fR by default.
1128: .IP "set_utmp" 16
1129: .IX Item "set_utmp"
1130: When enabled, \fBsudo\fR will create an entry in the utmp (or utmpx)
1131: file when a pseudo-tty is allocated. A pseudo-tty is allocated by
1132: \&\fBsudo\fR when the \fIlog_input\fR, \fIlog_output\fR or \fIuse_pty\fR flags
1133: are enabled. By default, the new entry will be a copy of the user's
1134: existing utmp entry (if any), with the tty, time, type and pid
1135: fields updated. This flag is \fIon\fR by default.
1136: .IP "setenv" 16
1137: .IX Item "setenv"
1138: Allow the user to disable the \fIenv_reset\fR option from the command
1139: line via the \fB\-E\fR option. Additionally, environment variables set
1140: via the command line are not subject to the restrictions imposed
1141: by \fIenv_check\fR, \fIenv_delete\fR, or \fIenv_keep\fR. As such, only
1142: trusted users should be allowed to set variables in this manner.
1143: This flag is \fIoff\fR by default.
1144: .IP "shell_noargs" 16
1145: .IX Item "shell_noargs"
1146: If set and \fBsudo\fR is invoked with no arguments it acts as if the
1147: \&\fB\-s\fR option had been given. That is, it runs a shell as root (the
1148: shell is determined by the \f(CW\*(C`SHELL\*(C'\fR environment variable if it is
1149: set, falling back on the shell listed in the invoking user's
1150: /etc/passwd entry if not). This flag is \fIoff\fR by default.
1151: .IP "stay_setuid" 16
1152: .IX Item "stay_setuid"
1153: Normally, when \fBsudo\fR executes a command the real and effective
1154: UIDs are set to the target user (root by default). This option
1155: changes that behavior such that the real \s-1UID\s0 is left as the invoking
1156: user's \s-1UID\s0. In other words, this makes \fBsudo\fR act as a setuid
1157: wrapper. This can be useful on systems that disable some potentially
1158: dangerous functionality when a program is run setuid. This option
1159: is only effective on systems with either the \fIsetreuid()\fR or \fIsetresuid()\fR
1160: function. This flag is \fIoff\fR by default.
1161: .IP "targetpw" 16
1162: .IX Item "targetpw"
1163: If set, \fBsudo\fR will prompt for the password of the user specified
1164: by the \fB\-u\fR option (defaults to \f(CW\*(C`root\*(C'\fR) instead of the password
1165: of the invoking user. In addition, the timestamp file name will
1166: include the target user's name. Note that this flag precludes the
1167: use of a uid not listed in the passwd database as an argument to
1168: the \fB\-u\fR option. This flag is \fIoff\fR by default.
1169: .IP "tty_tickets" 16
1170: .IX Item "tty_tickets"
1171: If set, users must authenticate on a per-tty basis. With this flag
1172: enabled, \fBsudo\fR will use a file named for the tty the user is
1173: logged in on in the user's time stamp directory. If disabled, the
1174: time stamp of the directory is used instead. This flag is
1175: \&\fI@tty_tickets@\fR by default.
1176: .IP "umask_override" 16
1177: .IX Item "umask_override"
1178: If set, \fBsudo\fR will set the umask as specified by \fIsudoers\fR without
1179: modification. This makes it possible to specify a more permissive
1180: umask in \fIsudoers\fR than the user's own umask and matches historical
1181: behavior. If \fIumask_override\fR is not set, \fBsudo\fR will set the
1182: umask to be the union of the user's umask and what is specified in
1183: \&\fIsudoers\fR. This flag is \fI@umask_override@\fR by default.
1184: .if \n(LC \{\
1185: .IP "use_loginclass" 16
1186: .IX Item "use_loginclass"
1187: If set, \fBsudo\fR will apply the defaults specified for the target user's
1188: login class if one exists. Only available if \fBsudo\fR is configured with
1189: the \-\-with\-logincap option. This flag is \fIoff\fR by default.
1190: \}
1191: .IP "use_pty" 16
1192: .IX Item "use_pty"
1193: If set, \fBsudo\fR will run the command in a pseudo-pty even if no I/O
1194: logging is being gone. A malicious program run under \fBsudo\fR could
1195: conceivably fork a background process that retains to the user's
1196: terminal device after the main program has finished executing. Use
1197: of this option will make that impossible. This flag is \fIoff\fR by default.
1198: .IP "utmp_runas" 16
1199: .IX Item "utmp_runas"
1200: If set, \fBsudo\fR will store the name of the runas user when updating
1201: the utmp (or utmpx) file. By default, \fBsudo\fR stores the name of
1202: the invoking user. This flag is \fIoff\fR by default.
1203: .IP "visiblepw" 16
1204: .IX Item "visiblepw"
1205: By default, \fBsudo\fR will refuse to run if the user must enter a
1206: password but it is not possible to disable echo on the terminal.
1207: If the \fIvisiblepw\fR flag is set, \fBsudo\fR will prompt for a password
1208: even when it would be visible on the screen. This makes it possible
1209: to run things like \f(CW"rsh somehost sudo ls"\fR since \fIrsh\fR\|(1) does
1210: not allocate a tty. This flag is \fIoff\fR by default.
1211: .PP
1212: \&\fBIntegers\fR:
1213: .IP "closefrom" 16
1214: .IX Item "closefrom"
1215: Before it executes a command, \fBsudo\fR will close all open file
1216: descriptors other than standard input, standard output and standard
1217: error (ie: file descriptors 0\-2). The \fIclosefrom\fR option can be used
1218: to specify a different file descriptor at which to start closing.
1219: The default is \f(CW3\fR.
1220: .IP "passwd_tries" 16
1221: .IX Item "passwd_tries"
1222: The number of tries a user gets to enter his/her password before
1223: \&\fBsudo\fR logs the failure and exits. The default is \f(CW\*(C`@passwd_tries@\*(C'\fR.
1224: .PP
1225: \&\fBIntegers that can be used in a boolean context\fR:
1226: .IP "loglinelen" 16
1227: .IX Item "loglinelen"
1228: Number of characters per line for the file log. This value is used
1229: to decide when to wrap lines for nicer log files. This has no
1230: effect on the syslog log file, only the file log. The default is
1231: \&\f(CW\*(C`@loglen@\*(C'\fR (use 0 or negate the option to disable word wrap).
1232: .IP "passwd_timeout" 16
1233: .IX Item "passwd_timeout"
1234: Number of minutes before the \fBsudo\fR password prompt times out, or
1235: \&\f(CW0\fR for no timeout. The timeout may include a fractional component
1236: if minute granularity is insufficient, for example \f(CW2.5\fR. The
1237: default is \f(CW\*(C`@password_timeout@\*(C'\fR.
1238: .IP "timestamp_timeout" 16
1239: .IX Item "timestamp_timeout"
1240: Number of minutes that can elapse before \fBsudo\fR will ask for a
1241: passwd again. The timeout may include a fractional component if
1242: minute granularity is insufficient, for example \f(CW2.5\fR. The default
1243: is \f(CW\*(C`@timeout@\*(C'\fR. Set this to \f(CW0\fR to always prompt for a password.
1244: If set to a value less than \f(CW0\fR the user's timestamp will never
1245: expire. This can be used to allow users to create or delete their
1246: own timestamps via \f(CW\*(C`sudo \-v\*(C'\fR and \f(CW\*(C`sudo \-k\*(C'\fR respectively.
1247: .IP "umask" 16
1248: .IX Item "umask"
1249: Umask to use when running the command. Negate this option or set
1250: it to 0777 to preserve the user's umask. The actual umask that is
1251: used will be the union of the user's umask and the value of the
1252: \&\fIumask\fR option, which defaults to \f(CW\*(C`@sudo_umask@\*(C'\fR. This guarantees
1253: that \fBsudo\fR never lowers the umask when running a command. Note
1254: on systems that use \s-1PAM\s0, the default \s-1PAM\s0 configuration may specify
1255: its own umask which will override the value set in \fIsudoers\fR.
1256: .PP
1257: \&\fBStrings\fR:
1258: .IP "badpass_message" 16
1259: .IX Item "badpass_message"
1260: Message that is displayed if a user enters an incorrect password.
1261: The default is \f(CW\*(C`@badpass_message@\*(C'\fR unless insults are enabled.
1262: .IP "editor" 16
1263: .IX Item "editor"
1264: A colon (':') separated list of editors allowed to be used with
1265: \&\fBvisudo\fR. \fBvisudo\fR will choose the editor that matches the user's
1266: \&\s-1EDITOR\s0 environment variable if possible, or the first editor in the
1267: list that exists and is executable. The default is \f(CW"@editor@"\fR.
1268: .IP "iolog_dir" 16
1269: .IX Item "iolog_dir"
1270: The top-level directory to use when constructing the path name for
1271: the input/output log directory. Only used if the \fIlog_input\fR or
1272: \&\fIlog_output\fR options are enabled or when the \f(CW\*(C`LOG_INPUT\*(C'\fR or
1273: \&\f(CW\*(C`LOG_OUTPUT\*(C'\fR tags are present for a command. The session sequence
1274: number, if any, is stored in the directory.
1275: The default is \f(CW"@iolog_dir@"\fR.
1276: .Sp
1277: The following percent (`\f(CW\*(C`%\*(C'\fR') escape sequences are supported:
1278: .RS 16
1279: .ie n .IP "\*(C`%{seq}\*(C'" 4
1280: .el .IP "\f(CW\*(C`%{seq}\*(C'\fR" 4
1281: .IX Item "%{seq}"
1282: expanded to a monotonically increasing base\-36 sequence number, such as 0100A5,
1283: where every two digits are used to form a new directory, e.g. \fI01/00/A5\fR
1284: .ie n .IP "\*(C`%{user}\*(C'" 4
1285: .el .IP "\f(CW\*(C`%{user}\*(C'\fR" 4
1286: .IX Item "%{user}"
1287: expanded to the invoking user's login name
1288: .ie n .IP "\*(C`%{group}\*(C'" 4
1289: .el .IP "\f(CW\*(C`%{group}\*(C'\fR" 4
1290: .IX Item "%{group}"
1291: expanded to the name of the invoking user's real group \s-1ID\s0
1292: .ie n .IP "\*(C`%{runas_user}\*(C'" 4
1293: .el .IP "\f(CW\*(C`%{runas_user}\*(C'\fR" 4
1294: .IX Item "%{runas_user}"
1295: expanded to the login name of the user the command will
1296: be run as (e.g. root)
1297: .ie n .IP "\*(C`%{runas_group}\*(C'" 4
1298: .el .IP "\f(CW\*(C`%{runas_group}\*(C'\fR" 4
1299: .IX Item "%{runas_group}"
1300: expanded to the group name of the user the command will
1301: be run as (e.g. wheel)
1302: .ie n .IP "\*(C`%{hostname}\*(C'" 4
1303: .el .IP "\f(CW\*(C`%{hostname}\*(C'\fR" 4
1304: .IX Item "%{hostname}"
1305: expanded to the local host name without the domain name
1306: .ie n .IP "\*(C`%{command}\*(C'" 4
1307: .el .IP "\f(CW\*(C`%{command}\*(C'\fR" 4
1308: .IX Item "%{command}"
1309: expanded to the base name of the command being run
1310: .RE
1311: .RS 16
1312: .Sp
1313: In addition, any escape sequences supported by the system's \fIstrftime()\fR
1314: function will be expanded.
1315: .Sp
1316: To include a literal `\f(CW\*(C`%\*(C'\fR' character, the string `\f(CW\*(C`%%\*(C'\fR' should
1317: be used.
1318: .RE
1319: .IP "iolog_file" 16
1320: .IX Item "iolog_file"
1321: The path name, relative to \fIiolog_dir\fR, in which to store input/output
1322: logs when the \fIlog_input\fR or \fIlog_output\fR options are enabled or
1323: when the \f(CW\*(C`LOG_INPUT\*(C'\fR or \f(CW\*(C`LOG_OUTPUT\*(C'\fR tags are present for a command.
1324: Note that \fIiolog_file\fR may contain directory components.
1325: The default is \f(CW"%{seq}"\fR.
1326: .Sp
1327: See the \fIiolog_dir\fR option above for a list of supported percent
1328: (`\f(CW\*(C`%\*(C'\fR') escape sequences.
1329: .Sp
1330: In addition to the escape sequences, path names that end in six or
1331: more \f(CW\*(C`X\*(C'\fRs will have the \f(CW\*(C`X\*(C'\fRs replaced with a unique combination
1332: of digits and letters, similar to the \fImktemp()\fR function.
1333: .IP "mailsub" 16
1334: .IX Item "mailsub"
1335: Subject of the mail sent to the \fImailto\fR user. The escape \f(CW%h\fR
1336: will expand to the host name of the machine.
1337: Default is \f(CW\*(C`@mailsub@\*(C'\fR.
1338: .IP "noexec_file" 16
1339: .IX Item "noexec_file"
1340: This option is deprecated and will be removed in a future release
1341: of \fBsudo\fR. The path to the noexec file should now be set in the
1342: \&\fI@sysconfdir@/sudo.conf\fR file.
1343: .IP "passprompt" 16
1344: .IX Item "passprompt"
1345: The default prompt to use when asking for a password; can be overridden
1346: via the \fB\-p\fR option or the \f(CW\*(C`SUDO_PROMPT\*(C'\fR environment variable.
1347: The following percent (`\f(CW\*(C`%\*(C'\fR') escape sequences are supported:
1348: .RS 16
1349: .ie n .IP "%H" 4
1350: .el .IP "\f(CW%H\fR" 4
1351: .IX Item "%H"
1352: expanded to the local host name including the domain name
1353: (only if the machine's host name is fully qualified or the \fIfqdn\fR
1354: option is set)
1355: .ie n .IP "%h" 4
1356: .el .IP "\f(CW%h\fR" 4
1357: .IX Item "%h"
1358: expanded to the local host name without the domain name
1359: .ie n .IP "%p" 4
1360: .el .IP "\f(CW%p\fR" 4
1361: .IX Item "%p"
1362: expanded to the user whose password is being asked for (respects the
1363: \&\fIrootpw\fR, \fItargetpw\fR and \fIrunaspw\fR flags in \fIsudoers\fR)
1364: .ie n .IP "%U" 4
1365: .el .IP "\f(CW%U\fR" 4
1366: .IX Item "%U"
1367: expanded to the login name of the user the command will
1368: be run as (defaults to root)
1369: .ie n .IP "%u" 4
1370: .el .IP "\f(CW%u\fR" 4
1371: .IX Item "%u"
1372: expanded to the invoking user's login name
1373: .ie n .IP "\*(C`%%\*(C'" 4
1374: .el .IP "\f(CW\*(C`%%\*(C'\fR" 4
1375: .IX Item "%%"
1376: two consecutive \f(CW\*(C`%\*(C'\fR characters are collapsed into a single \f(CW\*(C`%\*(C'\fR character
1377: .RE
1378: .RS 16
1379: .Sp
1380: The default value is \f(CW\*(C`@passprompt@\*(C'\fR.
1381: .RE
1382: .if \n(SL \{\
1383: .IP "role" 16
1384: .IX Item "role"
1385: The default SELinux role to use when constructing a new security
1386: context to run the command. The default role may be overridden on
1387: a per-command basis in \fIsudoers\fR or via command line options.
1388: This option is only available whe \fBsudo\fR is built with SELinux support.
1389: \}
1390: .IP "runas_default" 16
1391: .IX Item "runas_default"
1392: The default user to run commands as if the \fB\-u\fR option is not specified
1393: on the command line. This defaults to \f(CW\*(C`@runas_default@\*(C'\fR.
1394: .IP "syslog_badpri" 16
1395: .IX Item "syslog_badpri"
1396: Syslog priority to use when user authenticates unsuccessfully.
1397: Defaults to \f(CW\*(C`@badpri@\*(C'\fR.
1398: .Sp
1399: The following syslog priorities are supported: \fBalert\fR, \fBcrit\fR,
1400: \&\fBdebug\fR, \fBemerg\fR, \fBerr\fR, \fBinfo\fR, \fBnotice\fR, and \fBwarning\fR.
1401: .IP "syslog_goodpri" 16
1402: .IX Item "syslog_goodpri"
1403: Syslog priority to use when user authenticates successfully.
1404: Defaults to \f(CW\*(C`@goodpri@\*(C'\fR.
1405: .Sp
1406: See syslog_badpri for the list of supported syslog priorities.
1407: .IP "sudoers_locale" 16
1408: .IX Item "sudoers_locale"
1409: Locale to use when parsing the sudoers file, logging commands, and
1410: sending email. Note that changing the locale may affect how sudoers
1411: is interpreted. Defaults to \f(CW"C"\fR.
1412: .IP "timestampdir" 16
1413: .IX Item "timestampdir"
1414: The directory in which \fBsudo\fR stores its timestamp files.
1415: The default is \fI@timedir@\fR.
1416: .IP "timestampowner" 16
1417: .IX Item "timestampowner"
1418: The owner of the timestamp directory and the timestamps stored therein.
1419: The default is \f(CW\*(C`root\*(C'\fR.
1420: .if \n(SL \{\
1421: .IP "type" 16
1422: .IX Item "type"
1423: The default SELinux type to use when constructing a new security
1424: context to run the command. The default type may be overridden on
1425: a per-command basis in \fIsudoers\fR or via command line options.
1426: This option is only available whe \fBsudo\fR is built with SELinux support.
1427: \}
1428: .PP
1429: \&\fBStrings that can be used in a boolean context\fR:
1430: .IP "env_file" 12
1431: .IX Item "env_file"
1432: The \fIenv_file\fR options specifies the fully qualified path to a
1433: file containing variables to be set in the environment of the program
1434: being run. Entries in this file should either be of the form
1435: \&\f(CW\*(C`VARIABLE=value\*(C'\fR or \f(CW\*(C`export VARIABLE=value\*(C'\fR. The value may
1436: optionally be surrounded by single or double quotes. Variables in
1437: this file are subject to other \fBsudo\fR environment settings such
1438: as \fIenv_keep\fR and \fIenv_check\fR.
1439: .IP "exempt_group" 12
1440: .IX Item "exempt_group"
1441: Users in this group are exempt from password and \s-1PATH\s0 requirements.
1442: The group name specified should not include a \f(CW\*(C`%\*(C'\fR prefix.
1443: This is not set by default.
1444: .IP "group_plugin" 12
1445: .IX Item "group_plugin"
1446: A string containing a \fIsudoers\fR group plugin with optional arguments.
1447: This can be used to implement support for the \f(CW\*(C`nonunix_group\*(C'\fR
1448: syntax described earlier. The string should consist of the plugin
1449: path, either fully-qualified or relative to the \fI@prefix@/libexec\fR
1450: directory, followed by any configuration arguments the plugin
1451: requires. These arguments (if any) will be passed to the plugin's
1452: initialization function. If arguments are present, the string must
1453: be enclosed in double quotes (\f(CW\*(C`"\*(C'\fR).
1454: .Sp
1455: For example, given \fI/etc/sudo\-group\fR, a group file in Unix group
1456: format, the sample group plugin can be used:
1457: .Sp
1458: .Vb 1
1459: \& Defaults group_plugin="sample_group.so /etc/sudo\-group"
1460: .Ve
1461: .Sp
1462: For more information see \fIsudo_plugin\fR\|(@mansectform@).
1463: .IP "lecture" 12
1464: .IX Item "lecture"
1465: This option controls when a short lecture will be printed along with
1466: the password prompt. It has the following possible values:
1467: .RS 12
1468: .IP "always" 8
1469: .IX Item "always"
1470: Always lecture the user.
1471: .IP "never" 8
1472: .IX Item "never"
1473: Never lecture the user.
1474: .IP "once" 8
1475: .IX Item "once"
1476: Only lecture the user the first time they run \fBsudo\fR.
1477: .RE
1478: .RS 12
1479: .Sp
1480: If no value is specified, a value of \fIonce\fR is implied.
1481: Negating the option results in a value of \fInever\fR being used.
1482: The default value is \fI@lecture@\fR.
1483: .RE
1484: .IP "lecture_file" 12
1485: .IX Item "lecture_file"
1486: Path to a file containing an alternate \fBsudo\fR lecture that will
1487: be used in place of the standard lecture if the named file exists.
1488: By default, \fBsudo\fR uses a built-in lecture.
1489: .IP "listpw" 12
1490: .IX Item "listpw"
1491: This option controls when a password will be required when a
1492: user runs \fBsudo\fR with the \fB\-l\fR option. It has the following possible values:
1493: .RS 12
1494: .IP "all" 8
1495: .IX Item "all"
1496: All the user's \fIsudoers\fR entries for the current host must have
1497: the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
1498: .IP "always" 8
1499: .IX Item "always"
1500: The user must always enter a password to use the \fB\-l\fR option.
1501: .IP "any" 8
1502: .IX Item "any"
1503: At least one of the user's \fIsudoers\fR entries for the current host
1504: must have the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
1505: .IP "never" 8
1506: .IX Item "never"
1507: The user need never enter a password to use the \fB\-l\fR option.
1508: .RE
1509: .RS 12
1510: .Sp
1511: If no value is specified, a value of \fIany\fR is implied.
1512: Negating the option results in a value of \fInever\fR being used.
1513: The default value is \fIany\fR.
1514: .RE
1515: .IP "logfile" 12
1516: .IX Item "logfile"
1517: Path to the \fBsudo\fR log file (not the syslog log file). Setting a path
1518: turns on logging to a file; negating this option turns it off.
1519: By default, \fBsudo\fR logs via syslog.
1520: .IP "mailerflags" 12
1521: .IX Item "mailerflags"
1522: Flags to use when invoking mailer. Defaults to \fB\-t\fR.
1523: .IP "mailerpath" 12
1524: .IX Item "mailerpath"
1525: Path to mail program used to send warning mail.
1526: Defaults to the path to sendmail found at configure time.
1527: .IP "mailfrom" 12
1528: .IX Item "mailfrom"
1529: Address to use for the \*(L"from\*(R" address when sending warning and error
1530: mail. The address should be enclosed in double quotes (\f(CW\*(C`"\*(C'\fR) to
1531: protect against \fBsudo\fR interpreting the \f(CW\*(C`@\*(C'\fR sign. Defaults to
1532: the name of the user running \fBsudo\fR.
1533: .IP "mailto" 12
1534: .IX Item "mailto"
1535: Address to send warning and error mail to. The address should
1536: be enclosed in double quotes (\f(CW\*(C`"\*(C'\fR) to protect against \fBsudo\fR
1537: interpreting the \f(CW\*(C`@\*(C'\fR sign. Defaults to \f(CW\*(C`@mailto@\*(C'\fR.
1538: .IP "secure_path" 12
1539: .IX Item "secure_path"
1540: Path used for every command run from \fBsudo\fR. If you don't trust the
1541: people running \fBsudo\fR to have a sane \f(CW\*(C`PATH\*(C'\fR environment variable you may
1542: want to use this. Another use is if you want to have the \*(L"root path\*(R"
1543: be separate from the \*(L"user path.\*(R" Users in the group specified by the
1544: \&\fIexempt_group\fR option are not affected by \fIsecure_path\fR.
1545: This option is @secure_path@ by default.
1546: .IP "syslog" 12
1547: .IX Item "syslog"
1548: Syslog facility if syslog is being used for logging (negate to
1549: disable syslog logging). Defaults to \f(CW\*(C`@logfac@\*(C'\fR.
1550: .Sp
1551: The following syslog facilities are supported: \fBauthpriv\fR (if your
1552: \&\s-1OS\s0 supports it), \fBauth\fR, \fBdaemon\fR, \fBuser\fR, \fBlocal0\fR, \fBlocal1\fR,
1553: \&\fBlocal2\fR, \fBlocal3\fR, \fBlocal4\fR, \fBlocal5\fR, \fBlocal6\fR, and \fBlocal7\fR.
1554: .IP "verifypw" 12
1555: .IX Item "verifypw"
1556: This option controls when a password will be required when a user runs
1557: \&\fBsudo\fR with the \fB\-v\fR option. It has the following possible values:
1558: .RS 12
1559: .IP "all" 8
1560: .IX Item "all"
1561: All the user's \fIsudoers\fR entries for the current host must have
1562: the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
1563: .IP "always" 8
1564: .IX Item "always"
1565: The user must always enter a password to use the \fB\-v\fR option.
1566: .IP "any" 8
1567: .IX Item "any"
1568: At least one of the user's \fIsudoers\fR entries for the current host
1569: must have the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
1570: .IP "never" 8
1571: .IX Item "never"
1572: The user need never enter a password to use the \fB\-v\fR option.
1573: .RE
1574: .RS 12
1575: .Sp
1576: If no value is specified, a value of \fIall\fR is implied.
1577: Negating the option results in a value of \fInever\fR being used.
1578: The default value is \fIall\fR.
1579: .RE
1580: .PP
1581: \&\fBLists that can be used in a boolean context\fR:
1582: .IP "env_check" 16
1583: .IX Item "env_check"
1584: Environment variables to be removed from the user's environment if
1585: the variable's value contains \f(CW\*(C`%\*(C'\fR or \f(CW\*(C`/\*(C'\fR characters. This can
1586: be used to guard against printf-style format vulnerabilities in
1587: poorly-written programs. The argument may be a double-quoted,
1588: space-separated list or a single value without double-quotes. The
1589: list can be replaced, added to, deleted from, or disabled by using
1590: the \f(CW\*(C`=\*(C'\fR, \f(CW\*(C`+=\*(C'\fR, \f(CW\*(C`\-=\*(C'\fR, and \f(CW\*(C`!\*(C'\fR operators respectively. Regardless
1591: of whether the \f(CW\*(C`env_reset\*(C'\fR option is enabled or disabled, variables
1592: specified by \f(CW\*(C`env_check\*(C'\fR will be preserved in the environment if
1593: they pass the aforementioned check. The default list of environment
1594: variables to check is displayed when \fBsudo\fR is run by root with
1595: the \fI\-V\fR option.
1596: .IP "env_delete" 16
1597: .IX Item "env_delete"
1598: Environment variables to be removed from the user's environment
1599: when the \fIenv_reset\fR option is not in effect. The argument may
1600: be a double-quoted, space-separated list or a single value without
1601: double-quotes. The list can be replaced, added to, deleted from,
1602: or disabled by using the \f(CW\*(C`=\*(C'\fR, \f(CW\*(C`+=\*(C'\fR, \f(CW\*(C`\-=\*(C'\fR, and \f(CW\*(C`!\*(C'\fR operators
1603: respectively. The default list of environment variables to remove
1604: is displayed when \fBsudo\fR is run by root with the \fI\-V\fR option.
1605: Note that many operating systems will remove potentially dangerous
1606: variables from the environment of any setuid process (such as
1607: \&\fBsudo\fR).
1608: .IP "env_keep" 16
1609: .IX Item "env_keep"
1610: Environment variables to be preserved in the user's environment
1611: when the \fIenv_reset\fR option is in effect. This allows fine-grained
1612: control over the environment \fBsudo\fR\-spawned processes will receive.
1613: The argument may be a double-quoted, space-separated list or a
1614: single value without double-quotes. The list can be replaced, added
1615: to, deleted from, or disabled by using the \f(CW\*(C`=\*(C'\fR, \f(CW\*(C`+=\*(C'\fR, \f(CW\*(C`\-=\*(C'\fR, and
1616: \&\f(CW\*(C`!\*(C'\fR operators respectively. The default list of variables to keep
1617: is displayed when \fBsudo\fR is run by root with the \fI\-V\fR option.
1618: .SH "FILES"
1619: .IX Header "FILES"
1620: .ie n .IP "\fI@sysconfdir@/sudoers\fR" 24
1621: .el .IP "\fI@sysconfdir@/sudoers\fR" 24
1622: .IX Item "@sysconfdir@/sudoers"
1623: List of who can run what
1624: .IP "\fI/etc/group\fR" 24
1625: .IX Item "/etc/group"
1626: Local groups file
1627: .IP "\fI/etc/netgroup\fR" 24
1628: .IX Item "/etc/netgroup"
1629: List of network groups
1630: .ie n .IP "\fI@iolog_dir@\fR" 24
1631: .el .IP "\fI@iolog_dir@\fR" 24
1632: .IX Item "@iolog_dir@"
1633: I/O log files
1634: .ie n .IP "\fI@timedir@\fR" 24
1635: .el .IP "\fI@timedir@\fR" 24
1636: .IX Item "@timedir@"
1637: Directory containing time stamps for the \fIsudoers\fR security policy
1638: .IP "\fI/etc/environment\fR" 24
1639: .IX Item "/etc/environment"
1640: Initial environment for \fB\-i\fR mode on Linux and \s-1AIX\s0
1641: .SH "EXAMPLES"
1642: .IX Header "EXAMPLES"
1643: Below are example \fIsudoers\fR entries. Admittedly, some of
1644: these are a bit contrived. First, we allow a few environment
1645: variables to pass and then define our \fIaliases\fR:
1646: .PP
1647: .Vb 4
1648: \& # Run X applications through sudo; HOME is used to find the
1649: \& # .Xauthority file. Note that other programs use HOME to find
1650: \& # configuration files and this may lead to privilege escalation!
1651: \& Defaults env_keep += "DISPLAY HOME"
1652: \&
1653: \& # User alias specification
1654: \& User_Alias FULLTIMERS = millert, mikef, dowdy
1655: \& User_Alias PARTTIMERS = bostley, jwfox, crawl
1656: \& User_Alias WEBMASTERS = will, wendy, wim
1657: \&
1658: \& # Runas alias specification
1659: \& Runas_Alias OP = root, operator
1660: \& Runas_Alias DB = oracle, sybase
1661: \& Runas_Alias ADMINGRP = adm, oper
1662: \&
1663: \& # Host alias specification
1664: \& Host_Alias SPARC = bigtime, eclipse, moet, anchor :\e
1665: \& SGI = grolsch, dandelion, black :\e
1666: \& ALPHA = widget, thalamus, foobar :\e
1667: \& HPPA = boa, nag, python
1668: \& Host_Alias CUNETS = 128.138.0.0/255.255.0.0
1669: \& Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
1670: \& Host_Alias SERVERS = master, mail, www, ns
1671: \& Host_Alias CDROM = orion, perseus, hercules
1672: \&
1673: \& # Cmnd alias specification
1674: \& Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\e
1675: \& /usr/sbin/restore, /usr/sbin/rrestore
1676: \& Cmnd_Alias KILL = /usr/bin/kill
1677: \& Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
1678: \& Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
1679: \& Cmnd_Alias HALT = /usr/sbin/halt
1680: \& Cmnd_Alias REBOOT = /usr/sbin/reboot
1681: \& Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \e
1682: \& /usr/local/bin/tcsh, /usr/bin/rsh, \e
1683: \& /usr/local/bin/zsh
1684: \& Cmnd_Alias SU = /usr/bin/su
1685: \& Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
1686: .Ve
1687: .PP
1688: Here we override some of the compiled in default values. We want
1689: \&\fBsudo\fR to log via \fIsyslog\fR\|(3) using the \fIauth\fR facility in all
1690: cases. We don't want to subject the full time staff to the \fBsudo\fR
1691: lecture, user \fBmillert\fR need not give a password, and we don't
1692: want to reset the \f(CW\*(C`LOGNAME\*(C'\fR, \f(CW\*(C`USER\*(C'\fR or \f(CW\*(C`USERNAME\*(C'\fR environment
1693: variables when running commands as root. Additionally, on the
1694: machines in the \fI\s-1SERVERS\s0\fR \f(CW\*(C`Host_Alias\*(C'\fR, we keep an additional
1695: local log file and make sure we log the year in each log line since
1696: the log entries will be kept around for several years. Lastly, we
1697: disable shell escapes for the commands in the \s-1PAGERS\s0 \f(CW\*(C`Cmnd_Alias\*(C'\fR
1698: (\fI/usr/bin/more\fR, \fI/usr/bin/pg\fR and \fI/usr/bin/less\fR).
1699: .PP
1700: .Vb 7
1701: \& # Override built\-in defaults
1702: \& Defaults syslog=auth
1703: \& Defaults>root !set_logname
1704: \& Defaults:FULLTIMERS !lecture
1705: \& Defaults:millert !authenticate
1706: \& Defaults@SERVERS log_year, logfile=/var/log/sudo.log
1707: \& Defaults!PAGERS noexec
1708: .Ve
1709: .PP
1710: The \fIUser specification\fR is the part that actually determines who may
1711: run what.
1712: .PP
1713: .Vb 2
1714: \& root ALL = (ALL) ALL
1715: \& %wheel ALL = (ALL) ALL
1716: .Ve
1717: .PP
1718: We let \fBroot\fR and any user in group \fBwheel\fR run any command on any
1719: host as any user.
1720: .PP
1721: .Vb 1
1722: \& FULLTIMERS ALL = NOPASSWD: ALL
1723: .Ve
1724: .PP
1725: Full time sysadmins (\fBmillert\fR, \fBmikef\fR, and \fBdowdy\fR) may run any
1726: command on any host without authenticating themselves.
1727: .PP
1728: .Vb 1
1729: \& PARTTIMERS ALL = ALL
1730: .Ve
1731: .PP
1732: Part time sysadmins (\fBbostley\fR, \fBjwfox\fR, and \fBcrawl\fR) may run any
1733: command on any host but they must authenticate themselves first
1734: (since the entry lacks the \f(CW\*(C`NOPASSWD\*(C'\fR tag).
1735: .PP
1736: .Vb 1
1737: \& jack CSNETS = ALL
1738: .Ve
1739: .PP
1740: The user \fBjack\fR may run any command on the machines in the \fI\s-1CSNETS\s0\fR alias
1741: (the networks \f(CW128.138.243.0\fR, \f(CW128.138.204.0\fR, and \f(CW128.138.242.0\fR).
1742: Of those networks, only \f(CW128.138.204.0\fR has an explicit netmask (in
1743: \&\s-1CIDR\s0 notation) indicating it is a class C network. For the other
1744: networks in \fI\s-1CSNETS\s0\fR, the local machine's netmask will be used
1745: during matching.
1746: .PP
1747: .Vb 1
1748: \& lisa CUNETS = ALL
1749: .Ve
1750: .PP
1751: The user \fBlisa\fR may run any command on any host in the \fI\s-1CUNETS\s0\fR alias
1752: (the class B network \f(CW128.138.0.0\fR).
1753: .PP
1754: .Vb 2
1755: \& operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\e
1756: \& sudoedit /etc/printcap, /usr/oper/bin/
1757: .Ve
1758: .PP
1759: The \fBoperator\fR user may run commands limited to simple maintenance.
1760: Here, those are commands related to backups, killing processes, the
1761: printing system, shutting down the system, and any commands in the
1762: directory \fI/usr/oper/bin/\fR.
1763: .PP
1764: .Vb 1
1765: \& joe ALL = /usr/bin/su operator
1766: .Ve
1767: .PP
1768: The user \fBjoe\fR may only \fIsu\fR\|(1) to operator.
1769: .PP
1770: .Vb 1
1771: \& pete HPPA = /usr/bin/passwd [A\-Za\-z]*, !/usr/bin/passwd root
1772: \&
1773: \& %opers ALL = (: ADMINGRP) /usr/sbin/
1774: .Ve
1775: .PP
1776: Users in the \fBopers\fR group may run commands in \fI/usr/sbin/\fR as themselves
1777: with any group in the \fI\s-1ADMINGRP\s0\fR \f(CW\*(C`Runas_Alias\*(C'\fR (the \fBadm\fR and \fBoper\fR
1778: groups).
1779: .PP
1780: The user \fBpete\fR is allowed to change anyone's password except for
1781: root on the \fI\s-1HPPA\s0\fR machines. Note that this assumes \fIpasswd\fR\|(1)
1782: does not take multiple user names on the command line.
1783: .PP
1784: .Vb 1
1785: \& bob SPARC = (OP) ALL : SGI = (OP) ALL
1786: .Ve
1787: .PP
1788: The user \fBbob\fR may run anything on the \fI\s-1SPARC\s0\fR and \fI\s-1SGI\s0\fR machines
1789: as any user listed in the \fI\s-1OP\s0\fR \f(CW\*(C`Runas_Alias\*(C'\fR (\fBroot\fR and \fBoperator\fR).
1790: .PP
1791: .Vb 1
1792: \& jim +biglab = ALL
1793: .Ve
1794: .PP
1795: The user \fBjim\fR may run any command on machines in the \fIbiglab\fR netgroup.
1796: \&\fBsudo\fR knows that \*(L"biglab\*(R" is a netgroup due to the '+' prefix.
1797: .PP
1798: .Vb 1
1799: \& +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
1800: .Ve
1801: .PP
1802: Users in the \fBsecretaries\fR netgroup need to help manage the printers
1803: as well as add and remove users, so they are allowed to run those
1804: commands on all machines.
1805: .PP
1806: .Vb 1
1807: \& fred ALL = (DB) NOPASSWD: ALL
1808: .Ve
1809: .PP
1810: The user \fBfred\fR can run commands as any user in the \fI\s-1DB\s0\fR \f(CW\*(C`Runas_Alias\*(C'\fR
1811: (\fBoracle\fR or \fBsybase\fR) without giving a password.
1812: .PP
1813: .Vb 1
1814: \& john ALPHA = /usr/bin/su [!\-]*, !/usr/bin/su *root*
1815: .Ve
1816: .PP
1817: On the \fI\s-1ALPHA\s0\fR machines, user \fBjohn\fR may su to anyone except root
1818: but he is not allowed to specify any options to the \fIsu\fR\|(1) command.
1819: .PP
1820: .Vb 1
1821: \& jen ALL, !SERVERS = ALL
1822: .Ve
1823: .PP
1824: The user \fBjen\fR may run any command on any machine except for those
1825: in the \fI\s-1SERVERS\s0\fR \f(CW\*(C`Host_Alias\*(C'\fR (master, mail, www and ns).
1826: .PP
1827: .Vb 1
1828: \& jill SERVERS = /usr/bin/, !SU, !SHELLS
1829: .Ve
1830: .PP
1831: For any machine in the \fI\s-1SERVERS\s0\fR \f(CW\*(C`Host_Alias\*(C'\fR, \fBjill\fR may run
1832: any commands in the directory \fI/usr/bin/\fR except for those commands
1833: belonging to the \fI\s-1SU\s0\fR and \fI\s-1SHELLS\s0\fR \f(CW\*(C`Cmnd_Aliases\*(C'\fR.
1834: .PP
1835: .Vb 1
1836: \& steve CSNETS = (operator) /usr/local/op_commands/
1837: .Ve
1838: .PP
1839: The user \fBsteve\fR may run any command in the directory /usr/local/op_commands/
1840: but only as user operator.
1841: .PP
1842: .Vb 1
1843: \& matt valkyrie = KILL
1844: .Ve
1845: .PP
1846: On his personal workstation, valkyrie, \fBmatt\fR needs to be able to
1847: kill hung processes.
1848: .PP
1849: .Vb 1
1850: \& WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
1851: .Ve
1852: .PP
1853: On the host www, any user in the \fI\s-1WEBMASTERS\s0\fR \f(CW\*(C`User_Alias\*(C'\fR (will,
1854: wendy, and wim), may run any command as user www (which owns the
1855: web pages) or simply \fIsu\fR\|(1) to www.
1856: .PP
1857: .Vb 2
1858: \& ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\e
1859: \& /sbin/mount \-o nosuid\e,nodev /dev/cd0a /CDROM
1860: .Ve
1861: .PP
1862: Any user may mount or unmount a CD-ROM on the machines in the \s-1CDROM\s0
1863: \&\f(CW\*(C`Host_Alias\*(C'\fR (orion, perseus, hercules) without entering a password.
1864: This is a bit tedious for users to type, so it is a prime candidate
1865: for encapsulating in a shell script.
1866: .SH "SECURITY NOTES"
1867: .IX Header "SECURITY NOTES"
1868: It is generally not effective to \*(L"subtract\*(R" commands from \f(CW\*(C`ALL\*(C'\fR
1869: using the '!' operator. A user can trivially circumvent this
1870: by copying the desired command to a different name and then
1871: executing that. For example:
1872: .PP
1873: .Vb 1
1874: \& bill ALL = ALL, !SU, !SHELLS
1875: .Ve
1876: .PP
1877: Doesn't really prevent \fBbill\fR from running the commands listed in
1878: \&\fI\s-1SU\s0\fR or \fI\s-1SHELLS\s0\fR since he can simply copy those commands to a
1879: different name, or use a shell escape from an editor or other
1880: program. Therefore, these kind of restrictions should be considered
1881: advisory at best (and reinforced by policy).
1882: .PP
1883: Furthermore, if the \fIfast_glob\fR option is in use, it is not possible
1884: to reliably negate commands where the path name includes globbing
1885: (aka wildcard) characters. This is because the C library's
1886: \&\fIfnmatch\fR\|(3) function cannot resolve relative paths. While this
1887: is typically only an inconvenience for rules that grant privileges,
1888: it can result in a security issue for rules that subtract or revoke
1889: privileges.
1890: .PP
1891: For example, given the following \fIsudoers\fR entry:
1892: .PP
1893: .Vb 2
1894: \& john ALL = /usr/bin/passwd [a\-zA\-Z0\-9]*, /usr/bin/chsh [a\-zA\-Z0\-9]*,
1895: \& /usr/bin/chfn [a\-zA\-Z0\-9]*, !/usr/bin/* root
1896: .Ve
1897: .PP
1898: User \fBjohn\fR can still run \f(CW\*(C`/usr/bin/passwd root\*(C'\fR if \fIfast_glob\fR is
1899: enabled by changing to \fI/usr/bin\fR and running \f(CW\*(C`./passwd root\*(C'\fR instead.
1900: .SH "PREVENTING SHELL ESCAPES"
1901: .IX Header "PREVENTING SHELL ESCAPES"
1902: Once \fBsudo\fR executes a program, that program is free to do whatever
1903: it pleases, including run other programs. This can be a security
1904: issue since it is not uncommon for a program to allow shell escapes,
1905: which lets a user bypass \fBsudo\fR's access control and logging.
1906: Common programs that permit shell escapes include shells (obviously),
1907: editors, paginators, mail and terminal programs.
1908: .PP
1909: There are two basic approaches to this problem:
1910: .IP "restrict" 10
1911: .IX Item "restrict"
1912: Avoid giving users access to commands that allow the user to run
1913: arbitrary commands. Many editors have a restricted mode where shell
1914: escapes are disabled, though \fBsudoedit\fR is a better solution to
1915: running editors via \fBsudo\fR. Due to the large number of programs that
1916: offer shell escapes, restricting users to the set of programs that
1917: do not is often unworkable.
1918: .IP "noexec" 10
1919: .IX Item "noexec"
1920: Many systems that support shared libraries have the ability to
1921: override default library functions by pointing an environment
1922: variable (usually \f(CW\*(C`LD_PRELOAD\*(C'\fR) to an alternate shared library.
1923: On such systems, \fBsudo\fR's \fInoexec\fR functionality can be used to
1924: prevent a program run by \fBsudo\fR from executing any other programs.
1925: Note, however, that this applies only to native dynamically-linked
1926: executables. Statically-linked executables and foreign executables
1927: running under binary emulation are not affected.
1928: .Sp
1929: The \fInoexec\fR feature is known to work on SunOS, Solaris, *BSD,
1930: Linux, \s-1IRIX\s0, Tru64 \s-1UNIX\s0, MacOS X, HP-UX 11.x and \s-1AIX\s0 5.3 and above.
1931: It should be supported on most operating systems that support the
1932: \&\f(CW\*(C`LD_PRELOAD\*(C'\fR environment variable. Check your operating system's
1933: manual pages for the dynamic linker (usually ld.so, ld.so.1, dyld,
1934: dld.sl, rld, or loader) to see if \f(CW\*(C`LD_PRELOAD\*(C'\fR is supported.
1935: .Sp
1936: On Solaris 10 and higher, \fInoexec\fR uses Solaris privileges instead
1937: of the \f(CW\*(C`LD_PRELOAD\*(C'\fR environment variable.
1938: .Sp
1939: To enable \fInoexec\fR for a command, use the \f(CW\*(C`NOEXEC\*(C'\fR tag as documented
1940: in the User Specification section above. Here is that example again:
1941: .Sp
1942: .Vb 1
1943: \& aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
1944: .Ve
1945: .Sp
1946: This allows user \fBaaron\fR to run \fI/usr/bin/more\fR and \fI/usr/bin/vi\fR
1947: with \fInoexec\fR enabled. This will prevent those two commands from
1948: executing other commands (such as a shell). If you are unsure
1949: whether or not your system is capable of supporting \fInoexec\fR you
1950: can always just try it out and check whether shell escapes work
1951: when \fInoexec\fR is enabled.
1952: .PP
1953: Note that restricting shell escapes is not a panacea. Programs
1954: running as root are still capable of many potentially hazardous
1955: operations (such as changing or overwriting files) that could lead
1956: to unintended privilege escalation. In the specific case of an
1957: editor, a safer approach is to give the user permission to run
1958: \&\fBsudoedit\fR.
1959: .SH "SECURITY NOTES"
1960: .IX Header "SECURITY NOTES"
1961: \&\fIsudoers\fR will check the ownership of its time stamp directory
1962: (\fI@timedir@\fR by default) and ignore the directory's contents if
1963: it is not owned by root or if it is writable by a user other than
1964: root. On systems that allow non-root users to give away files via
1965: \&\fIchown\fR\|(2), if the time stamp directory is located in a world-writable
1966: directory (e.g., \fI/tmp\fR), it is possible for a user to create the
1967: time stamp directory before \fBsudo\fR is run. However, because
1968: \&\fIsudoers\fR checks the ownership and mode of the directory and its
1969: contents, the only damage that can be done is to \*(L"hide\*(R" files by
1970: putting them in the time stamp dir. This is unlikely to happen
1971: since once the time stamp dir is owned by root and inaccessible by
1972: any other user, the user placing files there would be unable to get
1973: them back out.
1974: .PP
1975: \&\fIsudoers\fR will not honor time stamps set far in the future. Time
1976: stamps with a date greater than current_time + 2 * \f(CW\*(C`TIMEOUT\*(C'\fR will
1977: be ignored and sudo will log and complain. This is done to keep a
1978: user from creating his/her own time stamp with a bogus date on
1979: systems that allow users to give away files if the time stamp directory
1980: is located in a world-writable directory.
1981: .PP
1982: On systems where the boot time is available, \fIsudoers\fR will ignore
1983: time stamps that date from before the machine booted.
1984: .PP
1985: Since time stamp files live in the file system, they can outlive a
1986: user's login session. As a result, a user may be able to login,
1987: run a command with \fBsudo\fR after authenticating, logout, login
1988: again, and run \fBsudo\fR without authenticating so long as the time
1989: stamp file's modification time is within \f(CW\*(C`@timeout@\*(C'\fR minutes (or
1990: whatever the timeout is set to in \fIsudoers\fR). When the \fItty_tickets\fR
1991: option is enabled, the time stamp has per-tty granularity but still
1992: may outlive the user's session. On Linux systems where the devpts
1993: filesystem is used, Solaris systems with the devices filesystem,
1994: as well as other systems that utilize a devfs filesystem that
1995: monotonically increase the inode number of devices as they are
1996: created (such as Mac \s-1OS\s0 X), \fIsudoers\fR is able to determine when a
1997: tty-based time stamp file is stale and will ignore it. Administrators
1998: should not rely on this feature as it is not universally available.
1999: .PP
2000: If users have sudo \f(CW\*(C`ALL\*(C'\fR there is nothing to prevent them from
2001: creating their own program that gives them a root shell (or making
2002: their own copy of a shell) regardless of any '!' elements in the
2003: user specification.
2004: .SH "SEE ALSO"
2005: .IX Header "SEE ALSO"
2006: \&\fIrsh\fR\|(1), \fIsu\fR\|(1), \fIfnmatch\fR\|(3), \fIglob\fR\|(3), \fImktemp\fR\|(3), \fIstrftime\fR\|(3),
2007: \&\fIsudoers.ldap\fR\|(@mansectform@), \fIsudo_plugin\fR\|(@mansectsu@), \fIsudo\fR\|(@mansectsu@), \fIvisudo\fR\|(@mansectsu@)
2008: .SH "CAVEATS"
2009: .IX Header "CAVEATS"
2010: The \fIsudoers\fR file should \fBalways\fR be edited by the \fBvisudo\fR
2011: command which locks the file and does grammatical checking. It is
2012: imperative that \fIsudoers\fR be free of syntax errors since \fBsudo\fR
2013: will not run with a syntactically incorrect \fIsudoers\fR file.
2014: .PP
2015: When using netgroups of machines (as opposed to users), if you
2016: store fully qualified host name in the netgroup (as is usually the
2017: case), you either need to have the machine's host name be fully qualified
2018: as returned by the \f(CW\*(C`hostname\*(C'\fR command or use the \fIfqdn\fR option in
2019: \&\fIsudoers\fR.
2020: .SH "BUGS"
2021: .IX Header "BUGS"
2022: If you feel you have found a bug in \fBsudo\fR, please submit a bug report
2023: at http://www.sudo.ws/sudo/bugs/
2024: .SH "SUPPORT"
2025: .IX Header "SUPPORT"
2026: Limited free support is available via the sudo-users mailing list,
2027: see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
2028: search the archives.
2029: .SH "DISCLAIMER"
2030: .IX Header "DISCLAIMER"
2031: \&\fBsudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
2032: including, but not limited to, the implied warranties of merchantability
2033: and fitness for a particular purpose are disclaimed. See the \s-1LICENSE\s0
2034: file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
2035: for complete details.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoers.man.in CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc