diff options
Diffstat (limited to 'doc/sudoers.cat')
| -rw-r--r-- | doc/sudoers.cat | 2931 |
1 files changed, 2931 insertions, 0 deletions
diff --git a/doc/sudoers.cat b/doc/sudoers.cat new file mode 100644 index 0000000..9cc6a95 --- /dev/null +++ b/doc/sudoers.cat @@ -0,0 +1,2931 @@ +SUDOERS(4) File Formats Manual SUDOERS(4) + +NNAAMMEE + ssuuddooeerrss - default sudo security policy plugin + +DDEESSCCRRIIPPTTIIOONN + The ssuuddooeerrss policy plugin determines a user's ssuuddoo privileges. It is the + default ssuuddoo policy plugin. The policy is driven by the _/_e_t_c_/_s_u_d_o_e_r_s + file or, optionally in LDAP. The policy format is described in detail in + the _S_U_D_O_E_R_S _F_I_L_E _F_O_R_M_A_T section. For information on storing ssuuddooeerrss + policy information in LDAP, please see sudoers.ldap(4). + + CCoonnffiigguurriinngg ssuuddoo..ccoonnff ffoorr ssuuddooeerrss + ssuuddoo consults the sudo.conf(4) file to determine which policy and I/O + logging plugins to load. If no sudo.conf(4) file is present, or if it + contains no Plugin lines, ssuuddooeerrss will be used for policy decisions and + I/O logging. To explicitly configure sudo.conf(4) to use the ssuuddooeerrss + plugin, the following configuration can be used. + + Plugin sudoers_policy sudoers.so + Plugin sudoers_io sudoers.so + + Starting with ssuuddoo 1.8.5, it is possible to specify optional arguments to + the ssuuddooeerrss plugin in the sudo.conf(4) file. These arguments, if + present, should be listed after the path to the plugin (i.e., after + _s_u_d_o_e_r_s_._s_o). Multiple arguments may be specified, separated by white + space. For example: + + Plugin sudoers_policy sudoers.so sudoers_mode=0400 + + The following plugin arguments are supported: + + ldap_conf=pathname + The _l_d_a_p___c_o_n_f argument can be used to override the default path + to the _l_d_a_p_._c_o_n_f file. + + ldap_secret=pathname + The _l_d_a_p___s_e_c_r_e_t argument can be used to override the default + path to the _l_d_a_p_._s_e_c_r_e_t file. + + sudoers_file=pathname + The _s_u_d_o_e_r_s___f_i_l_e argument can be used to override the default + path to the _s_u_d_o_e_r_s file. + + sudoers_uid=uid + The _s_u_d_o_e_r_s___u_i_d argument can be used to override the default + owner of the sudoers file. It should be specified as a numeric + user ID. + + sudoers_gid=gid + The _s_u_d_o_e_r_s___g_i_d argument can be used to override the default + group of the sudoers file. It must be specified as a numeric + group ID (not a group name). + + sudoers_mode=mode + The _s_u_d_o_e_r_s___m_o_d_e argument can be used to override the default + file mode for the sudoers file. It should be specified as an + octal value. + + For more information on configuring sudo.conf(4), please refer to its + manual. + + UUsseerr AAuutthheennttiiccaattiioonn + The ssuuddooeerrss security policy requires that most users authenticate + themselves before they can use ssuuddoo. A password is not required if the + invoking user is root, if the target user is the same as the invoking + user, or if the policy has disabled authentication for the user or + command. Unlike su(1), when ssuuddooeerrss requires authentication, it + validates the invoking user's credentials, not the target user's (or + root's) credentials. This can be changed via the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and + _r_u_n_a_s_p_w flags, described later. + + If a user who is not listed in the policy tries to run a command via + ssuuddoo, mail is sent to the proper authorities. The address used for such + mail is configurable via the _m_a_i_l_t_o Defaults entry (described later) and + defaults to root. + + Note that no mail will be sent if an unauthorized user tries to run ssuuddoo + with the --ll or --vv option unless there is an authentication error and + either the _m_a_i_l___a_l_w_a_y_s or _m_a_i_l___b_a_d_p_a_s_s flags are enabled. This allows + users to determine for themselves whether or not they are allowed to use + ssuuddoo. All attempts to run ssuuddoo (successful or not) will be logged, + regardless of whether or not mail is sent. + + If ssuuddoo is run by root and the SUDO_USER environment variable is set, the + ssuuddooeerrss policy will use this value to determine who the actual user is. + This can be used by a user to log commands through sudo even when a root + shell has been invoked. It also allows the --ee option to remain useful + even when invoked via a sudo-run script or program. Note, however, that + the _s_u_d_o_e_r_s file lookup is still done for root, not the user specified by + SUDO_USER. + + ssuuddooeerrss uses per-user time stamp files for credential caching. Once a + user has been authenticated, a record is written containing the user ID + that was used to authenticate, the terminal session ID, the start time of + the session leader (or parent process) and a time stamp (using a + monotonic clock if one is available). The user may then use ssuuddoo without + a password for a short period of time (5 minutes unless overridden by the + _t_i_m_e_s_t_a_m_p___t_i_m_e_o_u_t option). By default, ssuuddooeerrss uses a separate record + for each terminal, which means that a user's login sessions are + authenticated separately. The _t_i_m_e_s_t_a_m_p___t_y_p_e option can be used to + select the type of time stamp record ssuuddooeerrss will use. + + LLooggggiinngg + ssuuddooeerrss can log both successful and unsuccessful attempts (as well as + errors) to syslog(3), a log file, or both. By default, ssuuddooeerrss will log + via syslog(3) but this is changeable via the _s_y_s_l_o_g and _l_o_g_f_i_l_e Defaults + settings. See _L_O_G _F_O_R_M_A_T for a description of the log file format. + + ssuuddooeerrss is also capable of running a command in a pseudo-tty and logging + all input and/or output. The standard input, standard output and + standard error can be logged even when not associated with a terminal. + I/O logging is not on by default but can be enabled using the _l_o_g___i_n_p_u_t + and _l_o_g___o_u_t_p_u_t options as well as the LOG_INPUT and LOG_OUTPUT command + tags. See _I_/_O _L_O_G _F_I_L_E_S for details on how I/O log files are stored. + + CCoommmmaanndd eennvviirroonnmmeenntt + Since environment variables can influence program behavior, ssuuddooeerrss + provides a means to restrict which variables from the user's environment + are inherited by the command to be run. There are two distinct ways + ssuuddooeerrss can deal with environment variables. + + By default, the _e_n_v___r_e_s_e_t option is enabled. This causes commands to be + executed with a new, minimal environment. On AIX (and Linux systems + without PAM), the environment is initialized with the contents of the + _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t file. On BSD systems, if the _u_s_e___l_o_g_i_n_c_l_a_s_s option is + enabled, the environment is initialized based on the _p_a_t_h and _s_e_t_e_n_v + settings in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f. The new environment contains the TERM, + PATH, HOME, MAIL, SHELL, LOGNAME, USER and SUDO_* variables in addition + to variables from the invoking process permitted by the _e_n_v___c_h_e_c_k and + _e_n_v___k_e_e_p options. This is effectively a whitelist for environment + variables. The environment variables LOGNAME and USER are treated + specially. If one of them is preserved (or removed) from user's + environment, the other will be as well. If LOGNAME and USER are to be + preserved but only one of them is present in the user's environment, the + other will be set to the same value. This avoids an inconsistent + environment where one of the variables describing the user name is set to + the invoking user and one is set to the target user. () are removed + unless both the name and value parts are matched by _e_n_v___k_e_e_p or + _e_n_v___c_h_e_c_k, as they may be interpreted as functions by the bbaasshh shell. + Prior to version 1.8.11, such variables were always removed. + + If, however, the _e_n_v___r_e_s_e_t option is disabled, any variables not + explicitly denied by the _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e options are inherited + from the invoking process. In this case, _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e behave + like a blacklist. Prior to version 1.8.21, environment variables with a + value beginning with () were always removed. Beginning with version + 1.8.21, a pattern in _e_n_v___d_e_l_e_t_e is used to match bbaasshh shell functions + instead. Since it is not possible to blacklist all potentially dangerous + environment variables, use of the default _e_n_v___r_e_s_e_t behavior is + encouraged. + + Environment variables specified by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p may + include one or more `*' characters which will match zero or more + characters. No other wildcard characters are supported. + + By default, environment variables are matched by name. However, if the + pattern includes an equal sign (`='), both the variables name and value + must match. For example, a bbaasshh shell function could be matched as + follows: + + env_keep += "BASH_FUNC_my_func%%=()*" + + Without the "=()*" suffix, this would not match, as bbaasshh shell functions + are not preserved by default. + + The complete list of environment variables that ssuuddoo allows or denies is + contained in the output of "sudo -V" when run as root. Please note that + this list varies based on the operating system ssuuddoo is running on. + + On systems that support PAM where the ppaamm__eennvv module is enabled for ssuuddoo, + variables in the PAM environment may be merged in to the environment. If + a variable in the PAM environment is already present in the user's + environment, the value will only be overridden if the variable was not + preserved by ssuuddooeerrss. When _e_n_v___r_e_s_e_t is enabled, variables preserved + from the invoking user's environment by the _e_n_v___k_e_e_p list take precedence + over those in the PAM environment. When _e_n_v___r_e_s_e_t is disabled, variables + present the invoking user's environment take precedence over those in the + PAM environment unless they match a pattern in the _e_n_v___d_e_l_e_t_e list. + + Note that the dynamic linker on most operating systems will remove + variables that can control dynamic linking from the environment of setuid + executables, including ssuuddoo. Depending on the operating system this may + include _RLD*, DYLD_*, LD_*, LDR_*, LIBPATH, SHLIB_PATH, and others. + These type of variables are removed from the environment before ssuuddoo even + begins execution and, as such, it is not possible for ssuuddoo to preserve + them. + + As a special case, if ssuuddoo's --ii option (initial login) is specified, + ssuuddooeerrss will initialize the environment regardless of the value of + _e_n_v___r_e_s_e_t. The DISPLAY, PATH and TERM variables remain unchanged; HOME, + MAIL, SHELL, USER, and LOGNAME are set based on the target user. On AIX + (and Linux systems without PAM), the contents of _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t are + also included. On BSD systems, if the _u_s_e___l_o_g_i_n_c_l_a_s_s flag is enabled, + the _p_a_t_h and _s_e_t_e_n_v variables in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f are also applied. All + other environment variables are removed unless permitted by _e_n_v___k_e_e_p or + _e_n_v___c_h_e_c_k, described above. + + Finally, the _r_e_s_t_r_i_c_t_e_d___e_n_v___f_i_l_e and _e_n_v___f_i_l_e files are applied, if + present. The variables in _r_e_s_t_r_i_c_t_e_d___e_n_v___f_i_l_e are applied first and are + subject to the same restrictions as the invoking user's environment, as + detailed above. The variables in _e_n_v___f_i_l_e are applied last and are not + subject to these restrictions. In both cases, variables present in the + files will only be set to their specified values if they would not + conflict with an existing environment variable. + +SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT + The _s_u_d_o_e_r_s file is composed of two types of entries: aliases (basically + variables) and user specifications (which specify who may run what). + + When multiple entries match for a user, they are applied in order. Where + there are multiple matches, the last match is used (which is not + necessarily the most specific match). + + The _s_u_d_o_e_r_s file grammar will be described below in Extended Backus-Naur + Form (EBNF). Don't despair if you are unfamiliar with EBNF; it is fairly + simple, and the definitions below are annotated. + + QQuuiicckk gguuiiddee ttoo EEBBNNFF + EBNF is a concise and exact way of describing the grammar of a language. + Each EBNF definition is made up of _p_r_o_d_u_c_t_i_o_n _r_u_l_e_s. E.g., + + symbol ::= definition | alternate1 | alternate2 ... + + Each _p_r_o_d_u_c_t_i_o_n _r_u_l_e references others and thus makes up a grammar for + the language. EBNF also contains the following operators, which many + readers will recognize from regular expressions. Do not, however, + confuse them with "wildcard" characters, which have different meanings. + + ? Means that the preceding symbol (or group of symbols) is optional. + That is, it may appear once or not at all. + + * Means that the preceding symbol (or group of symbols) may appear + zero or more times. + + + Means that the preceding symbol (or group of symbols) may appear + one or more times. + + Parentheses may be used to group symbols together. For clarity, we will + use single quotes ('') to designate what is a verbatim character string + (as opposed to a symbol name). + + AAlliiaasseess + There are four kinds of aliases: User_Alias, Runas_Alias, Host_Alias and + Cmnd_Alias. + + Alias ::= 'User_Alias' User_Alias_Spec (':' User_Alias_Spec)* | + 'Runas_Alias' Runas_Alias_Spec (':' Runas_Alias_Spec)* | + 'Host_Alias' Host_Alias_Spec (':' Host_Alias_Spec)* | + 'Cmnd_Alias' Cmnd_Alias_Spec (':' Cmnd_Alias_Spec)* + + User_Alias ::= NAME + + User_Alias_Spec ::= User_Alias '=' User_List + + Runas_Alias ::= NAME + + Runas_Alias_Spec ::= Runas_Alias '=' Runas_List + + Host_Alias ::= NAME + + Host_Alias_Spec ::= Host_Alias '=' Host_List + + Cmnd_Alias ::= NAME + + Cmnd_Alias_Spec ::= Cmnd_Alias '=' Cmnd_List + + NAME ::= [A-Z]([A-Z][0-9]_)* + + Each _a_l_i_a_s definition is of the form + + Alias_Type NAME = item1, item2, ... + + where _A_l_i_a_s___T_y_p_e is one of User_Alias, Runas_Alias, Host_Alias, or + Cmnd_Alias. A NAME is a string of uppercase letters, numbers, and + underscore characters (`_'). A NAME mmuusstt start with an uppercase letter. + It is possible to put several alias definitions of the same type on a + single line, joined by a colon (`:'). E.g., + + Alias_Type NAME = item1, item2, item3 : NAME = item4, item5 + + It is a syntax error to redefine an existing _a_l_i_a_s. It is possible to + use the same name for _a_l_i_a_s_e_s of different types, but this is not + recommended. + + The definitions of what constitutes a valid _a_l_i_a_s member follow. + + User_List ::= User | + User ',' User_List + + User ::= '!'* user name | + '!'* #uid | + '!'* %group | + '!'* %#gid | + '!'* +netgroup | + '!'* %:nonunix_group | + '!'* %:#nonunix_gid | + '!'* User_Alias + + A User_List is made up of one or more user names, user IDs (prefixed with + `#'), system group names and IDs (prefixed with `%' and `%#' + respectively), netgroups (prefixed with `+'), non-Unix group names and + IDs (prefixed with `%:' and `%:#' respectively) and User_Aliases. Each + list item may be prefixed with zero or more `!' operators. An odd number + of `!' operators negate the value of the item; an even number just cancel + each other out. User netgroups are matched using the user and domain + members only; the host member is not used when matching. + + A user name, uid, group, gid, netgroup, nonunix_group or nonunix_gid may + be enclosed in double quotes to avoid the need for escaping special + characters. Alternately, special characters may be specified in escaped + hex mode, e.g., \x20 for space. When using double quotes, any prefix + characters must be included inside the quotes. + + The actual nonunix_group and nonunix_gid syntax depends on the underlying + group provider plugin. For instance, the QAS AD plugin supports the + following formats: + + ++oo Group in the same domain: "%:Group Name" + + ++oo Group in any domain: "%:Group Name@FULLY.QUALIFIED.DOMAIN" + + ++oo Group SID: "%:S-1-2-34-5678901234-5678901234-5678901234-567" + + See _G_R_O_U_P _P_R_O_V_I_D_E_R _P_L_U_G_I_N_S for more information. + + Note that quotes around group names are optional. Unquoted strings must + use a backslash (`\') to escape spaces and special characters. See _O_t_h_e_r + _s_p_e_c_i_a_l _c_h_a_r_a_c_t_e_r_s _a_n_d _r_e_s_e_r_v_e_d _w_o_r_d_s for a list of characters that need + to be escaped. + + Runas_List ::= Runas_Member | + Runas_Member ',' Runas_List + + Runas_Member ::= '!'* user name | + '!'* #uid | + '!'* %group | + '!'* %#gid | + '!'* %:nonunix_group | + '!'* %:#nonunix_gid | + '!'* +netgroup | + '!'* Runas_Alias + + A Runas_List is similar to a User_List except that instead of + User_Aliases it can contain Runas_Aliases. Note that user names and + groups are matched as strings. In other words, two users (groups) with + the same uid (gid) are considered to be distinct. If you wish to match + all user names with the same uid (e.g., root and toor), you can use a uid + instead (#0 in the example given). + + Host_List ::= Host | + Host ',' Host_List + + Host ::= '!'* host name | + '!'* ip_addr | + '!'* network(/netmask)? | + '!'* +netgroup | + '!'* Host_Alias + + A Host_List is made up of one or more host names, IP addresses, network + numbers, netgroups (prefixed with `+') and other aliases. Again, the + value of an item may be negated with the `!' operator. Host netgroups + are matched using the host (both qualified and unqualified) and domain + members only; the user member is not used when matching. If you specify + a network number without a netmask, ssuuddoo will query each of the local + host's network interfaces and, if the network number corresponds to one + of the hosts's network interfaces, will use the netmask of that + interface. The netmask may be specified either in standard IP address + notation (e.g., 255.255.255.0 or ffff:ffff:ffff:ffff::), or CIDR notation + (number of bits, e.g., 24 or 64). A host name may include shell-style + wildcards (see the _W_i_l_d_c_a_r_d_s section below), but unless the host name + command on your machine returns the fully qualified host name, you'll + need to use the _f_q_d_n option for wildcards to be useful. Note that ssuuddoo + only inspects actual network interfaces; this means that IP address + 127.0.0.1 (localhost) will never match. Also, the host name "localhost" + will only match if that is the actual host name, which is usually only + the case for non-networked systems. + + digest ::= [A-Fa-f0-9]+ | + [[A-Za-z0-9+/=]+ + + Digest_Spec ::= "sha224" ':' digest | + "sha256" ':' digest | + "sha384" ':' digest | + "sha512" ':' digest + + Cmnd_List ::= Cmnd | + Cmnd ',' Cmnd_List + + command name ::= file name | + file name args | + file name '""' + + Cmnd ::= Digest_Spec? '!'* command name | + '!'* directory | + '!'* "sudoedit" | + '!'* Cmnd_Alias + + A Cmnd_List is a list of one or more command names, directories, and + other aliases. A command name is a fully qualified file name which may + include shell-style wildcards (see the _W_i_l_d_c_a_r_d_s section below). A + simple file name allows the user to run the command with any arguments + he/she wishes. However, you may also specify command line arguments + (including wildcards). Alternately, you can specify "" to indicate that + the command may only be run wwiitthhoouutt command line arguments. A directory + is a fully qualified path name ending in a `/'. When you specify a + directory in a Cmnd_List, the user will be able to run any file within + that directory (but not in any sub-directories therein). + + If a Cmnd has associated command line arguments, then the arguments in + the Cmnd must match exactly those given by the user on the command line + (or match the wildcards if there are any). Note that the following + characters must be escaped with a `\' if they are used in command + arguments: `,', `:', `=', `\'. The built-in command "sudoedit" is used + to permit a user to run ssuuddoo with the --ee option (or as ssuuddooeeddiitt). It may + take command line arguments just as a normal command does. Note that + "sudoedit" is a command built into ssuuddoo itself and must be specified in + the _s_u_d_o_e_r_s file without a leading path. + + If a command name is prefixed with a Digest_Spec, the command will only + match successfully if it can be verified using the specified SHA-2 + digest. The following digest formats are supported: sha224, sha256, + sha384 and sha512. The string may be specified in either hex or base64 + format (base64 is more compact). There are several utilities capable of + generating SHA-2 digests in hex format such as openssl, shasum, + sha224sum, sha256sum, sha384sum, sha512sum. + + For example, using openssl: + + $ openssl dgst -sha224 /bin/ls + SHA224(/bin/ls)= 118187da8364d490b4a7debbf483004e8f3e053ec954309de2c41a25 + + It is also possible to use openssl to generate base64 output: + + $ openssl dgst -binary -sha224 /bin/ls | openssl base64 + EYGH2oNk1JC0p9679IMATo8+BT7JVDCd4sQaJQ== + + Warning, if the user has write access to the command itself (directly or + via a ssuuddoo command), it may be possible for the user to replace the + command after the digest check has been performed but before the command + is executed. A similar race condition exists on systems that lack the + fexecve(2) system call when the directory in which the command is located + is writable by the user. See the description of the _f_d_e_x_e_c setting for + more information on how ssuuddoo executes commands that have an associated + digest. + + Command digests are only supported by version 1.8.7 or higher. + + DDeeffaauullttss + Certain configuration options may be changed from their default values at + run-time via one or more Default_Entry lines. These may affect all users + on any host, all users on a specific host, a specific user, a specific + command, or commands being run as a specific user. Note that per-command + entries may not include command line arguments. If you need to specify + arguments, define a Cmnd_Alias and reference that instead. + + Default_Type ::= 'Defaults' | + 'Defaults' '@' Host_List | + 'Defaults' ':' User_List | + 'Defaults' '!' Cmnd_List | + 'Defaults' '>' Runas_List + + Default_Entry ::= Default_Type Parameter_List + + Parameter_List ::= Parameter | + Parameter ',' Parameter_List + + Parameter ::= Parameter '=' Value | + Parameter '+=' Value | + Parameter '-=' Value | + '!'* Parameter + + Parameters may be ffllaaggss, iinntteeggeerr values, ssttrriinnggss, or lliissttss. Flags are + implicitly boolean and can be turned off via the `!' operator. Some + integer, string and list parameters may also be used in a boolean context + to disable them. Values may be enclosed in double quotes ("") when they + contain multiple words. Special characters may be escaped with a + backslash (`\'). + + Lists have two additional assignment operators, += and -=. These + operators are used to add to and delete from a list respectively. It is + not an error to use the -= operator to remove an element that does not + exist in a list. + + Defaults entries are parsed in the following order: generic, host, user + and runas Defaults first, then command defaults. If there are multiple + Defaults settings of the same type, the last matching setting is used. + The following Defaults settings are parsed before all others since they + may affect subsequent entries: _f_q_d_n, _g_r_o_u_p___p_l_u_g_i_n, _r_u_n_a_s___d_e_f_a_u_l_t, + _s_u_d_o_e_r_s___l_o_c_a_l_e. + + See _S_U_D_O_E_R_S _O_P_T_I_O_N_S for a list of supported Defaults parameters. + + UUsseerr ssppeecciiffiiccaattiioonn + User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \ + (':' Host_List '=' Cmnd_Spec_List)* + + Cmnd_Spec_List ::= Cmnd_Spec | + Cmnd_Spec ',' Cmnd_Spec_List + + Cmnd_Spec ::= Runas_Spec? Option_Spec* Tag_Spec* Cmnd + + Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')' + + Option_Spec ::= (SELinux_Spec | Solaris_Priv_Spec | Date_Spec | Timeout_Spec) + + SELinux_Spec ::= ('ROLE=role' | 'TYPE=type') + + Solaris_Priv_Spec ::= ('PRIVS=privset' | 'LIMITPRIVS=privset') + + Date_Spec ::= ('NOTBEFORE=timestamp' | 'NOTAFTER=timestamp') + + Timeout_Spec ::= 'TIMEOUT=timeout' + + Tag_Spec ::= ('EXEC:' | 'NOEXEC:' | 'FOLLOW:' | 'NOFOLLOW' | + 'LOG_INPUT:' | 'NOLOG_INPUT:' | 'LOG_OUTPUT:' | + 'NOLOG_OUTPUT:' | 'MAIL:' | 'NOMAIL:' | 'PASSWD:' | + 'NOPASSWD:' | 'SETENV:' | 'NOSETENV:') + + A uusseerr ssppeecciiffiiccaattiioonn determines which commands a user may run (and as + what user) on specified hosts. By default, commands are run as rroooott, but + this can be changed on a per-command basis. + + The basic structure of a user specification is "who where = (as_whom) + what". Let's break that down into its constituent parts: + + RRuunnaass__SSppeecc + A Runas_Spec determines the user and/or the group that a command may be + run as. A fully-specified Runas_Spec consists of two Runas_Lists (as + defined above) separated by a colon (`:') and enclosed in a set of + parentheses. The first Runas_List indicates which users the command may + be run as via ssuuddoo's --uu option. The second defines a list of groups that + can be specified via ssuuddoo's --gg option in addition to any of the target + user's groups. If both Runas_Lists are specified, the command may be run + with any combination of users and groups listed in their respective + Runas_Lists. If only the first is specified, the command may be run as + any user in the list but no --gg option may be specified. If the first + Runas_List is empty but the second is specified, the command may be run + as the invoking user with the group set to any listed in the Runas_List. + If both Runas_Lists are empty, the command may only be run as the + invoking user. If no Runas_Spec is specified the command may be run as + rroooott and no group may be specified. + + A Runas_Spec sets the default for the commands that follow it. What this + means is that for the entry: + + dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm + + The user ddggbb may run _/_b_i_n_/_l_s, _/_b_i_n_/_k_i_l_l, and _/_u_s_r_/_b_i_n_/_l_p_r_m on the host + boulder--but only as ooppeerraattoorr. E.g., + + $ sudo -u operator /bin/ls + + It is also possible to override a Runas_Spec later on in an entry. If we + modify the entry like so: + + dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm + + Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but _/_b_i_n_/_k_i_l_l + and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott. + + We can extend this to allow ddggbb to run /bin/ls with either the user or + group set to ooppeerraattoorr: + + dgb boulder = (operator : operator) /bin/ls, (root) /bin/kill,\ + /usr/bin/lprm + + Note that while the group portion of the Runas_Spec permits the user to + run as command with that group, it does not force the user to do so. If + no group is specified on the command line, the command will run with the + group listed in the target user's password database entry. The following + would all be permitted by the sudoers entry above: + + $ sudo -u operator /bin/ls + $ sudo -u operator -g operator /bin/ls + $ sudo -g operator /bin/ls + + In the following example, user ttccmm may run commands that access a modem + device file with the dialer group. + + tcm boulder = (:dialer) /usr/bin/tip, /usr/bin/cu,\ + /usr/local/bin/minicom + + Note that in this example only the group will be set, the command still + runs as user ttccmm. E.g. + + $ sudo -g dialer /usr/bin/cu + + Multiple users and groups may be present in a Runas_Spec, in which case + the user may select any combination of users and groups via the --uu and --gg + options. In this example: + + alan ALL = (root, bin : operator, system) ALL + + user aallaann may run any command as either user root or bin, optionally + setting the group to operator or system. + + OOppttiioonn__SSppeecc + A Cmnd may have zero or more options associated with it. Options may + consist of SELinux roles and/or types, Solaris privileges sets, start + and/or end dates and command timeouts. Once an option is set for a Cmnd, + subsequent Cmnds in the Cmnd_Spec_List, inherit that option unless it is + overridden by another option. + + SSEELLiinnuuxx__SSppeecc + On systems with SELinux support, _s_u_d_o_e_r_s file entries may optionally have + an SELinux role and/or type associated with a command. If a role or type + is specified with the command it will override any default values + specified in _s_u_d_o_e_r_s. A role or type specified on the command line, + however, will supersede the values in _s_u_d_o_e_r_s. + + SSoollaarriiss__PPrriivv__SSppeecc + On Solaris systems, _s_u_d_o_e_r_s file entries may optionally specify Solaris + privilege set and/or limit privilege set associated with a command. If + privileges or limit privileges are specified with the command it will + override any default values specified in _s_u_d_o_e_r_s. + + A privilege set is a comma-separated list of privilege names. The + ppriv(1) command can be used to list all privileges known to the system. + For example: + + $ ppriv -l + + In addition, there are several "special" privilege strings: + + none the empty set + + all the set of all privileges + + zone the set of all privileges available in the current zone + + basic the default set of privileges normal users are granted at login + time + + Privileges can be excluded from a set by prefixing the privilege name + with either an `!' or `-' character. + + DDaattee__SSppeecc + ssuuddooeerrss rules can be specified with a start and end date via the + NOTBEFORE and NOTAFTER settings. The time stamp must be specified in + _G_e_n_e_r_a_l_i_z_e_d _T_i_m_e as defined by RFC 4517. The format is effectively + yyyymmddHHMMSSZ where the minutes and seconds are optional. The `Z' + suffix indicates that the time stamp is in Coordinated Universal Time + (UTC). It is also possible to specify a timezone offset from UTC in + hours and minutes instead of a `Z'. For example, `-0500' would + correspond to Eastern Standard time in the US. As an extension, if no + `Z' or timezone offset is specified, local time will be used. + + The following are all valid time stamps: + + 20170214083000Z + 2017021408Z + 20160315220000-0500 + 20151201235900 + + TTiimmeeoouutt__SSppeecc + A command may have a timeout associated with it. If the timeout expires + before the command has exited, the command will be terminated. The + timeout may be specified in combinations of days, hours, minutes and + seconds with a single-letter case-insensitive suffix that indicates the + unit of time. For example, a timeout of 7 days, 8 hours, 30 minutes and + 10 seconds would be written as 7d8h30m10s. If a number is specified + without a unit, seconds are assumed. Any of the days, minutes, hours or + seconds may be omitted. The order must be from largest to smallest unit + and a unit may not be specified more than once. + + The following are all _v_a_l_i_d timeout values: 7d8h30m10s, 14d, 8h30m, 600s, + 3600. The following are _i_n_v_a_l_i_d timeout values: 12m2w1d, 30s10m4h, + 1d2d3h. + + This option is only supported by version 1.8.20 or higher. + + TTaagg__SSppeecc + A command may have zero or more tags associated with it. The following + tag values are supported: EXEC, NOEXEC, FOLLOW, NOFOLLOW, LOG_INPUT, + NOLOG_INPUT, LOG_OUTPUT, NOLOG_OUTPUT, MAIL, NOMAIL, PASSWD, NOPASSWD, + SETENV, and NOSETENV. Once a tag is set on a Cmnd, subsequent Cmnds in + the Cmnd_Spec_List, inherit the tag unless it is overridden by the + opposite tag (in other words, PASSWD overrides NOPASSWD and NOEXEC + overrides EXEC). + + _E_X_E_C and _N_O_E_X_E_C + + If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying + operating system supports it, the NOEXEC tag can be used to prevent a + dynamically-linked executable from running further commands itself. + + In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e and + _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled. + + aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi + + See the _P_r_e_v_e_n_t_i_n_g _s_h_e_l_l _e_s_c_a_p_e_s section below for more details on how + NOEXEC works and whether or not it will work on your system. + + _F_O_L_L_O_W and _N_O_F_O_L_L_O_W Starting with version 1.8.15, ssuuddooeeddiitt will not open + a file that is a symbolic link unless the _s_u_d_o_e_d_i_t___f_o_l_l_o_w option is + enabled. The _F_O_L_L_O_W and _N_O_F_O_L_L_O_W tags override the value of + _s_u_d_o_e_d_i_t___f_o_l_l_o_w and can be used to permit (or deny) the editing of + symbolic links on a per-command basis. These tags are only effective + for the _s_u_d_o_e_d_i_t command and are ignored for all other commands. + + _L_O_G___I_N_P_U_T and _N_O_L_O_G___I_N_P_U_T + + These tags override the value of the _l_o_g___i_n_p_u_t option on a per-command + basis. For more information, see the description of _l_o_g___i_n_p_u_t in the + _S_U_D_O_E_R_S _O_P_T_I_O_N_S section below. + + _L_O_G___O_U_T_P_U_T and _N_O_L_O_G___O_U_T_P_U_T + + These tags override the value of the _l_o_g___o_u_t_p_u_t option on a per-command + basis. For more information, see the description of _l_o_g___o_u_t_p_u_t in the + _S_U_D_O_E_R_S _O_P_T_I_O_N_S section below. + + _M_A_I_L and _N_O_M_A_I_L + + These tags provide fine-grained control over whether mail will be sent + when a user runs a command by overriding the value of the + _m_a_i_l___a_l_l___c_m_n_d_s option on a per-command basis. They have no effect when + ssuuddoo is run with the --ll or --vv options. A _N_O_M_A_I_L tag will also override + the _m_a_i_l___a_l_w_a_y_s and _m_a_i_l___n_o___p_e_r_m_s options. For more information, see + the descriptions of _m_a_i_l___a_l_l___c_m_n_d_s, _m_a_i_l___a_l_w_a_y_s, and _m_a_i_l___n_o___p_e_r_m_s in + the _S_U_D_O_E_R_S _O_P_T_I_O_N_S section below. + + _P_A_S_S_W_D and _N_O_P_A_S_S_W_D + + By default, ssuuddoo requires that a user authenticate him or herself + before running a command. This behavior can be modified via the + NOPASSWD tag. Like a Runas_Spec, the NOPASSWD tag sets a default for + the commands that follow it in the Cmnd_Spec_List. Conversely, the + PASSWD tag can be used to reverse things. For example: + + ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm + + would allow the user rraayy to run _/_b_i_n_/_k_i_l_l, _/_b_i_n_/_l_s, and _/_u_s_r_/_b_i_n_/_l_p_r_m + as rroooott on the machine rushmore without authenticating himself. If we + only want rraayy to be able to run _/_b_i_n_/_k_i_l_l without a password the entry + would be: + + ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm + + Note, however, that the PASSWD tag has no effect on users who are in + the group specified by the _e_x_e_m_p_t___g_r_o_u_p option. + + By default, if the NOPASSWD tag is applied to any of the entries for a + user on the current host, he or she will be able to run "sudo -l" + without a password. Additionally, a user may only run "sudo -v" + without a password if the NOPASSWD tag is present for all a user's + entries that pertain to the current host. This behavior may be + overridden via the _v_e_r_i_f_y_p_w and _l_i_s_t_p_w options. + + _S_E_T_E_N_V and _N_O_S_E_T_E_N_V + + These tags override the value of the _s_e_t_e_n_v option on a per-command + basis. Note that if SETENV has been set for a command, the user may + disable the _e_n_v___r_e_s_e_t option from the command line via the --EE option. + Additionally, environment variables set on the command line are not + subject to the restrictions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or + _e_n_v___k_e_e_p. As such, only trusted users should be allowed to set + variables in this manner. If the command matched is AALLLL, the SETENV + tag is implied for that command; this default may be overridden by use + of the NOSETENV tag. + + WWiillddccaarrddss + ssuuddoo allows shell-style _w_i_l_d_c_a_r_d_s (aka meta or glob characters) to be + used in host names, path names and command line arguments in the _s_u_d_o_e_r_s + file. Wildcard matching is done via the glob(3) and fnmatch(3) functions + as specified by IEEE Std 1003.1 ("POSIX.1"). + + * Matches any set of zero or more characters (including white + space). + + ? Matches any single character (including white space). + + [...] Matches any character in the specified range. + + [!...] Matches any character _n_o_t in the specified range. + + \x For any character `x', evaluates to `x'. This is used to + escape special characters such as: `*', `?', `[', and `]'. + + NNoottee tthhaatt tthheessee aarree nnoott rreegguullaarr eexxpprreessssiioonnss.. Unlike a regular expression + there is no way to match one or more characters within a range. + + Character classes may be used if your system's glob(3) and fnmatch(3) + functions support them. However, because the `:' character has special + meaning in _s_u_d_o_e_r_s, it must be escaped. For example: + + /bin/ls [[\:alpha\:]]* + + Would match any file name beginning with a letter. + + Note that a forward slash (`/') will _n_o_t be matched by wildcards used in + the file name portion of the command. This is to make a path like: + + /usr/bin/* + + match _/_u_s_r_/_b_i_n_/_w_h_o but not _/_u_s_r_/_b_i_n_/_X_1_1_/_x_t_e_r_m. + + When matching the command line arguments, however, a slash _d_o_e_s get + matched by wildcards since command line arguments may contain arbitrary + strings and not just path names. + + WWiillddccaarrddss iinn ccoommmmaanndd lliinnee aarrgguummeennttss sshhoouulldd bbee uusseedd wwiitthh ccaarree.. + Command line arguments are matched as a single, concatenated string. + This mean a wildcard character such as `?' or `*' will match across word + boundaries, which may be unexpected. For example, while a sudoers entry + like: + + %operator ALL = /bin/cat /var/log/messages* + + will allow command like: + + $ sudo cat /var/log/messages.1 + + It will also allow: + + $ sudo cat /var/log/messages /etc/shadow + + which is probably not what was intended. In most cases it is better to + do command line processing outside of the _s_u_d_o_e_r_s file in a scripting + language. + + EExxcceeppttiioonnss ttoo wwiillddccaarrdd rruulleess + The following exceptions apply to the above rules: + + "" If the empty string "" is the only command line argument in the + _s_u_d_o_e_r_s file entry it means that command is not allowed to be + run with _a_n_y arguments. + + sudoedit Command line arguments to the _s_u_d_o_e_d_i_t built-in command should + always be path names, so a forward slash (`/') will not be + matched by a wildcard. + + IInncclluuddiinngg ootthheerr ffiilleess ffrroomm wwiitthhiinn ssuuddooeerrss + It is possible to include other _s_u_d_o_e_r_s files from within the _s_u_d_o_e_r_s + file currently being parsed using the #include and #includedir + directives. + + This can be used, for example, to keep a site-wide _s_u_d_o_e_r_s file in + addition to a local, per-machine file. For the sake of this example the + site-wide _s_u_d_o_e_r_s file will be _/_e_t_c_/_s_u_d_o_e_r_s and the per-machine one will + be _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l. To include _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l from within + _/_e_t_c_/_s_u_d_o_e_r_s we would use the following line in _/_e_t_c_/_s_u_d_o_e_r_s: + + #include /etc/sudoers.local + + When ssuuddoo reaches this line it will suspend processing of the current + file (_/_e_t_c_/_s_u_d_o_e_r_s) and switch to _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l. Upon reaching the + end of _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l, the rest of _/_e_t_c_/_s_u_d_o_e_r_s will be processed. + Files that are included may themselves include other files. A hard limit + of 128 nested include files is enforced to prevent include file loops. + + If the path to the include file is not fully-qualified (does not begin + with a `/'), it must be located in the same directory as the sudoers file + it was included from. For example, if _/_e_t_c_/_s_u_d_o_e_r_s contains the line: + + #include sudoers.local + + the file that will be included is _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l. + + The file name may also include the %h escape, signifying the short form + of the host name. In other words, if the machine's host name is + "xerxes", then + + #include /etc/sudoers.%h + + will cause ssuuddoo to include the file _/_e_t_c_/_s_u_d_o_e_r_s_._x_e_r_x_e_s. + + The #includedir directive can be used to create a _s_u_d_o_e_r_s_._d directory + that the system package manager can drop _s_u_d_o_e_r_s file rules into as part + of package installation. For example, given: + + #includedir /etc/sudoers.d + + ssuuddoo will suspend processing of the current file and read each file in + _/_e_t_c_/_s_u_d_o_e_r_s_._d, skipping file names that end in `~' or contain a `.' + character to avoid causing problems with package manager or editor + temporary/backup files. Files are parsed in sorted lexical order. That + is, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_0_1___f_i_r_s_t will be parsed before + _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d. Be aware that because the sorting is lexical, + not numeric, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1___w_h_o_o_p_s would be loaded _a_f_t_e_r + _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d. Using a consistent number of leading zeroes in + the file names can be used to avoid such problems. After parsing the + files in the directory, control returns to the file that contained the + #includedir directive. + + Note that unlike files included via #include, vviissuuddoo will not edit the + files in a #includedir directory unless one of them contains a syntax + error. It is still possible to run vviissuuddoo with the --ff flag to edit the + files directly, but this will not catch the redefinition of an _a_l_i_a_s that + is also present in a different file. + + OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss + The pound sign (`#') is used to indicate a comment (unless it is part of + a #include directive or unless it occurs in the context of a user name + and is followed by one or more digits, in which case it is treated as a + uid). Both the comment character and any text after it, up to the end of + the line, are ignored. + + The reserved word AALLLL is a built-in _a_l_i_a_s that always causes a match to + succeed. It can be used wherever one might otherwise use a Cmnd_Alias, + User_Alias, Runas_Alias, or Host_Alias. You should not try to define + your own _a_l_i_a_s called AALLLL as the built-in alias will be used in + preference to your own. Please note that using AALLLL can be dangerous + since in a command context, it allows the user to run _a_n_y command on the + system. + + An exclamation point (`!') can be used as a logical _n_o_t operator in a + list or _a_l_i_a_s as well as in front of a Cmnd. This allows one to exclude + certain values. For the `!' operator to be effective, there must be + something for it to exclude. For example, to match all users except for + root one would use: + + ALL,!root + + If the AALLLL, is omitted, as in: + + !root + + it would explicitly deny root but not match any other users. This is + different from a true "negation" operator. + + Note, however, that using a `!' in conjunction with the built-in AALLLL + alias to allow a user to run "all but a few" commands rarely works as + intended (see _S_E_C_U_R_I_T_Y _N_O_T_E_S below). + + Long lines can be continued with a backslash (`\') as the last character + on the line. + + White space between elements in a list as well as special syntactic + characters in a _U_s_e_r _S_p_e_c_i_f_i_c_a_t_i_o_n (`=', `:', `(', `)') is optional. + + The following characters must be escaped with a backslash (`\') when used + as part of a word (e.g., a user name or host name): `!', `=', `:', `,', + `(', `)', `\'. + +SSUUDDOOEERRSS OOPPTTIIOONNSS + ssuuddoo's behavior can be modified by Default_Entry lines, as explained + earlier. A list of all supported Defaults parameters, grouped by type, + are listed below. + + BBoooolleeaann FFllaaggss: + + always_query_group_plugin + If a _g_r_o_u_p___p_l_u_g_i_n is configured, use it to resolve + groups of the form %group as long as there is not also + a system group of the same name. Normally, only groups + of the form %:group are passed to the _g_r_o_u_p___p_l_u_g_i_n. + This flag is _o_f_f by default. + + always_set_home If enabled, ssuuddoo will set the HOME environment variable + to the home directory of the target user (which is root + unless the --uu option is used). This effectively means + that the --HH option is always implied. Note that by + default, HOME will be set to the home directory of the + target user when the _e_n_v___r_e_s_e_t option is enabled, so + _a_l_w_a_y_s___s_e_t___h_o_m_e only has an effect for configurations + where either _e_n_v___r_e_s_e_t is disabled or HOME is present + in the _e_n_v___k_e_e_p list. This flag is _o_f_f by default. + + authenticate If set, users must authenticate themselves via a + password (or other means of authentication) before they + may run commands. This default may be overridden via + the PASSWD and NOPASSWD tags. This flag is _o_n by + default. + + case_insensitive_group + If enabled, group names in _s_u_d_o_e_r_s will be matched in a + case insensitive manner. This may be necessary when + users are stored in LDAP or AD. This flag is _o_n by + default. + + case_insensitive_user + If enabled, user names in _s_u_d_o_e_r_s will be matched in a + case insensitive manner. This may be necessary when + groups are stored in LDAP or AD. This flag is _o_n by + default. + + closefrom_override + If set, the user may use ssuuddoo's --CC option which + overrides the default starting point at which ssuuddoo + begins closing open file descriptors. This flag is _o_f_f + by default. + + compress_io If set, and ssuuddoo is configured to log a command's input + or output, the I/O logs will be compressed using zzlliibb. + This flag is _o_n by default when ssuuddoo is compiled with + zzlliibb support. + + exec_background By default, ssuuddoo runs a command as the foreground + process as long as ssuuddoo itself is running in the + foreground. When the _e_x_e_c___b_a_c_k_g_r_o_u_n_d flag is enabled + and the command is being run in a pty (due to I/O + logging or the _u_s_e___p_t_y flag), the command will be run + as a background process. Attempts to read from the + controlling terminal (or to change terminal settings) + will result in the command being suspended with the + SIGTTIN signal (or SIGTTOU in the case of terminal + settings). If this happens when ssuuddoo is a foreground + process, the command will be granted the controlling + terminal and resumed in the foreground with no user + intervention required. The advantage of initially + running the command in the background is that ssuuddoo need + not read from the terminal unless the command + explicitly requests it. Otherwise, any terminal input + must be passed to the command, whether it has required + it or not (the kernel buffers terminals so it is not + possible to tell whether the command really wants the + input). This is different from historic _s_u_d_o behavior + or when the command is not being run in a pty. + + For this to work seamlessly, the operating system must + support the automatic restarting of system calls. + Unfortunately, not all operating systems do this by + default, and even those that do may have bugs. For + example, macOS fails to restart the ttccggeettaattttrr() and + ttccsseettaattttrr() system calls (this is a bug in macOS). + Furthermore, because this behavior depends on the + command stopping with the SIGTTIN or SIGTTOU signals, + programs that catch these signals and suspend + themselves with a different signal (usually SIGTOP) + will not be automatically foregrounded. Some versions + of the linux su(1) command behave this way. This flag + is _o_f_f by default. + + This setting is only supported by version 1.8.7 or + higher. It has no effect unless I/O logging is enabled + or the _u_s_e___p_t_y flag is enabled. + + env_editor If set, vviissuuddoo will use the value of the SUDO_EDITOR, + VISUAL or EDITOR environment variables before falling + back on the default editor list. Note that this may + create a security hole as it allows the user to run any + arbitrary command as root without logging. A safer + alternative is to place a colon-separated list of + editors in the _e_d_i_t_o_r variable. vviissuuddoo will then only + use SUDO_EDITOR, VISUAL or EDITOR if they match a value + specified in _e_d_i_t_o_r. If the _e_n_v___r_e_s_e_t flag is enabled, + the SUDO_EDITOR, VISUAL and/or EDITOR environment + variables must be present in the _e_n_v___k_e_e_p list for the + _e_n_v___e_d_i_t_o_r flag to function when vviissuuddoo is invoked via + ssuuddoo. This flag is _o_f_f by default. + + env_reset If set, ssuuddoo will run the command in a minimal + environment containing the TERM, PATH, HOME, MAIL, + SHELL, LOGNAME, USER and SUDO_* variables. Any + variables in the caller's environment or in the file + specified by the _r_e_s_t_r_i_c_t_e_d___e_n_v___f_i_l_e option that match + the env_keep and env_check lists are then added, + followed by any variables present in the file specified + by the _e_n_v___f_i_l_e option (if any). The contents of the + env_keep and env_check lists, as modified by global + Defaults parameters in _s_u_d_o_e_r_s, are displayed when ssuuddoo + is run by root with the --VV option. If the _s_e_c_u_r_e___p_a_t_h + option is set, its value will be used for the PATH + environment variable. This flag is _o_n by default. + + fast_glob Normally, ssuuddoo uses the glob(3) function to do shell- + style globbing when matching path names. However, + since it accesses the file system, glob(3) can take a + long time to complete for some patterns, especially + when the pattern references a network file system that + is mounted on demand (auto mounted). The _f_a_s_t___g_l_o_b + option causes ssuuddoo to use the fnmatch(3) function, + which does not access the file system to do its + matching. The disadvantage of _f_a_s_t___g_l_o_b is that it is + unable to match relative path names such as _._/_l_s or + _._._/_b_i_n_/_l_s. This has security implications when path + names that include globbing characters are used with + the negation operator, `!', as such rules can be + trivially bypassed. As such, this option should not be + used when the _s_u_d_o_e_r_s file contains rules that contain + negated path names which include globbing characters. + This flag is _o_f_f by default. + + fqdn Set this flag if you want to put fully qualified host + names in the _s_u_d_o_e_r_s file when the local host name (as + returned by the hostname command) does not contain the + domain name. In other words, instead of myhost you + would use myhost.mydomain.edu. You may still use the + short form if you wish (and even mix the two). This + option is only effective when the "canonical" host + name, as returned by the ggeettaaddddrriinnffoo() or + ggeetthhoossttbbyynnaammee() function, is a fully-qualified domain + name. This is usually the case when the system is + configured to use DNS for host name resolution. + + If the system is configured to use the _/_e_t_c_/_h_o_s_t_s file + in preference to DNS, the "canonical" host name may not + be fully-qualified. The order that sources are queried + for host name resolution is usually specified in the + _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f, _/_e_t_c_/_n_e_t_s_v_c_._c_o_n_f, _/_e_t_c_/_h_o_s_t_._c_o_n_f, + or, in some cases, _/_e_t_c_/_r_e_s_o_l_v_._c_o_n_f file. In the + _/_e_t_c_/_h_o_s_t_s file, the first host name of the entry is + considered to be the "canonical" name; subsequent names + are aliases that are not used by ssuuddooeerrss. For example, + the following hosts file line for the machine "xyzzy" + has the fully-qualified domain name as the "canonical" + host name, and the short version as an alias. + + 192.168.1.1 xyzzy.sudo.ws xyzzy + + If the machine's hosts file entry is not formatted + properly, the _f_q_d_n option will not be effective if it + is queried before DNS. + + Beware that when using DNS for host name resolution, + turning on _f_q_d_n requires ssuuddooeerrss to make DNS lookups + which renders ssuuddoo unusable if DNS stops working (for + example if the machine is disconnected from the + network). Also note that just like with the hosts + file, you must use the "canonical" name as DNS knows + it. That is, you may not use a host alias (CNAME + entry) due to performance issues and the fact that + there is no way to get all aliases from DNS. + + This flag is _o_f_f by default. + + ignore_audit_errors + Allow commands to be run even if ssuuddooeerrss cannot write + to the audit log. If enabled, an audit log write + failure is not treated as a fatal error. If disabled, + a command may only be run after the audit event is + successfully written. This flag is only effective on + systems for which ssuuddooeerrss supports audit logging, + including FreeBSD, Linux, macOS and Solaris. This flag + is _o_n by default. + + ignore_dot If set, ssuuddoo will ignore "." or "" (both denoting + current directory) in the PATH environment variable; + the PATH itself is not modified. This flag is _o_f_f by + default. + + ignore_iolog_errors + Allow commands to be run even if ssuuddooeerrss cannot write + to the I/O log. If enabled, an I/O log write failure + is not treated as a fatal error. If disabled, the + command will be terminated if the I/O log cannot be + written to. This flag is _o_f_f by default. + + ignore_logfile_errors + Allow commands to be run even if ssuuddooeerrss cannot write + to the log file. If enabled, a log file write failure + is not treated as a fatal error. If disabled, a + command may only be run after the log file entry is + successfully written. This flag only has an effect + when ssuuddooeerrss is configured to use file-based logging + via the _l_o_g_f_i_l_e option. This flag is _o_n by default. + + ignore_local_sudoers + If set via LDAP, parsing of _/_e_t_c_/_s_u_d_o_e_r_s will be + skipped. This is intended for Enterprises that wish to + prevent the usage of local sudoers files so that only + LDAP is used. This thwarts the efforts of rogue + operators who would attempt to add roles to + _/_e_t_c_/_s_u_d_o_e_r_s. When this option is present, + _/_e_t_c_/_s_u_d_o_e_r_s does not even need to exist. Since this + option tells ssuuddoo how to behave when no specific LDAP + entries have been matched, this sudoOption is only + meaningful for the cn=defaults section. This flag is + _o_f_f by default. + + ignore_unknown_defaults + If set, ssuuddoo will not produce a warning if it + encounters an unknown Defaults entry in the _s_u_d_o_e_r_s + file or an unknown sudoOption in LDAP. This flag is + _o_f_f by default. + + insults If set, ssuuddoo will insult users when they enter an + incorrect password. This flag is _o_f_f by default. + + log_host If set, the host name will be logged in the (non- + syslog) ssuuddoo log file. This flag is _o_f_f by default. + + log_input If set, ssuuddoo will run the command in a pseudo-tty and + log all user input. If the standard input is not + connected to the user's tty, due to I/O redirection or + because the command is part of a pipeline, that input + is also captured and stored in a separate log file. + Anything sent to the standard input will be consumed, + regardless of whether or not the command run via ssuuddoo + is actually reading the standard input. This may have + unexpected results when using ssuuddoo in a shell script + that expects to process the standard input. For more + information about I/O logging, see the _I_/_O _L_O_G _F_I_L_E_S + section. This flag is _o_f_f by default. + + log_output If set, ssuuddoo will run the command in a pseudo-tty and + log all output that is sent to the screen, similar to + the script(1) command. For more information about I/O + logging, see the _I_/_O _L_O_G _F_I_L_E_S section. This flag is + _o_f_f by default. + + log_year If set, the four-digit year will be logged in the (non- + syslog) ssuuddoo log file. This flag is _o_f_f by default. + + long_otp_prompt When validating with a One Time Password (OTP) scheme + such as SS//KKeeyy or OOPPIIEE, a two-line prompt is used to + make it easier to cut and paste the challenge to a + local window. It's not as pretty as the default but + some people find it more convenient. This flag is _o_f_f + by default. + + mail_all_cmnds Send mail to the _m_a_i_l_t_o user every time a user attempts + to run a command via ssuuddoo (this includes ssuuddooeeddiitt). No + mail will be sent if the user runs ssuuddoo with the --ll or + --vv option unless there is an authentication error and + the _m_a_i_l___b_a_d_p_a_s_s flag is also set. This flag is _o_f_f by + default. + + mail_always Send mail to the _m_a_i_l_t_o user every time a user runs + ssuuddoo. This flag is _o_f_f by default. + + mail_badpass Send mail to the _m_a_i_l_t_o user if the user running ssuuddoo + does not enter the correct password. If the command + the user is attempting to run is not permitted by + ssuuddooeerrss and one of the _m_a_i_l___a_l_l___c_m_n_d_s, _m_a_i_l___a_l_w_a_y_s, + _m_a_i_l___n_o___h_o_s_t, _m_a_i_l___n_o___p_e_r_m_s or _m_a_i_l___n_o___u_s_e_r flags are + set, this flag will have no effect. This flag is _o_f_f + by default. + + mail_no_host If set, mail will be sent to the _m_a_i_l_t_o user if the + invoking user exists in the _s_u_d_o_e_r_s file, but is not + allowed to run commands on the current host. This flag + is _o_f_f by default. + + mail_no_perms If set, mail will be sent to the _m_a_i_l_t_o user if the + invoking user is allowed to use ssuuddoo but the command + they are trying is not listed in their _s_u_d_o_e_r_s file + entry or is explicitly denied. This flag is _o_f_f by + default. + + mail_no_user If set, mail will be sent to the _m_a_i_l_t_o user if the + invoking user is not in the _s_u_d_o_e_r_s file. This flag is + _o_n by default. + + match_group_by_gid + By default, ssuuddooeerrss will look up each group the user is + a member of by group ID to determine the group name + (this is only done once). The resulting list of the + user's group names is used when matching groups listed + in the _s_u_d_o_e_r_s file. This works well on systems where + the number of groups listed in the _s_u_d_o_e_r_s file is + larger than the number of groups a typical user belongs + to. On systems where group lookups are slow, where + users may belong to a large number of groups, and where + the number of groups listed in the _s_u_d_o_e_r_s file is + relatively small, it may be prohibitively expensive and + running commands via ssuuddoo may take longer than normal. + On such systems it may be faster to use the + _m_a_t_c_h___g_r_o_u_p___b_y___g_i_d flag to avoid resolving the user's + group IDs to group names. In this case, ssuuddooeerrss must + look up any group name listed in the _s_u_d_o_e_r_s file and + use the group ID instead of the group name when + determining whether the user is a member of the group. + + Note that if _m_a_t_c_h___g_r_o_u_p___b_y___g_i_d is enabled, group + database lookups performed by ssuuddooeerrss will be keyed by + group name as opposed to group ID. On systems where + there are multiple sources for the group database, it + is possible to have conflicting group names or group + IDs in the local _/_e_t_c_/_g_r_o_u_p file and the remote group + database. On such systems, enabling or disabling + _m_a_t_c_h___g_r_o_u_p___b_y___g_i_d can be used to choose whether group + database queries are performed by name (enabled) or ID + (disabled), which may aid in working around group entry + conflicts. + + The _m_a_t_c_h___g_r_o_u_p___b_y___g_i_d flag has no effect when _s_u_d_o_e_r_s + data is stored in LDAP. This flag is _o_f_f by default. + + This setting is only supported by version 1.8.18 or + higher. + + netgroup_tuple If set, netgroup lookups will be performed using the + full netgroup tuple: host name, user name and domain + (if one is set). Historically, ssuuddoo only matched the + user name and domain for netgroups used in a User_List + and only matched the host name and domain for netgroups + used in a Host_List. This flag is _o_f_f by default. + + noexec If set, all commands run via ssuuddoo will behave as if the + NOEXEC tag has been set, unless overridden by an EXEC + tag. See the description of _E_X_E_C _a_n_d _N_O_E_X_E_C above as + well as the _P_r_e_v_e_n_t_i_n_g _s_h_e_l_l _e_s_c_a_p_e_s section at the end + of this manual. This flag is _o_f_f by default. + + pam_session On systems that use PAM for authentication, ssuuddoo will + create a new PAM session for the command to be run in. + Disabling _p_a_m___s_e_s_s_i_o_n may be needed on older PAM + implementations or on operating systems where opening a + PAM session changes the utmp or wtmp files. If PAM + session support is disabled, resource limits may not be + updated for the command being run. If _p_a_m___s_e_s_s_i_o_n, + _p_a_m___s_e_t_c_r_e_d, and _u_s_e___p_t_y are disabled and I/O logging + has not been configured, ssuuddoo will execute the command + directly instead of running it as a child process. + This flag is _o_n by default. + + This setting is only supported by version 1.8.7 or + higher. + + pam_setcred On systems that use PAM for authentication, ssuuddoo will + attempt to establish credentials for the target user by + default, if supported by the underlying authentication + system. One example of a credential is a Kerberos + ticket. If _p_a_m___s_e_s_s_i_o_n, _p_a_m___s_e_t_c_r_e_d, and _u_s_e___p_t_y are + disabled and I/O logging has not been configured, ssuuddoo + will execute the command directly instead of running it + as a child process. This flag is _o_n by default. + + This setting is only supported by version 1.8.8 or + higher. + + passprompt_override + If set, the prompt specified by _p_a_s_s_p_r_o_m_p_t or the + SUDO_PROMPT environment variable will always be used + and will replace the prompt provided by a PAM module or + other authentication method. This flag is _o_f_f by + default. + + path_info Normally, ssuuddoo will tell the user when a command could + not be found in their PATH environment variable. Some + sites may wish to disable this as it could be used to + gather information on the location of executables that + the normal user does not have access to. The + disadvantage is that if the executable is simply not in + the user's PATH, ssuuddoo will tell the user that they are + not allowed to run it, which can be confusing. This + flag is _o_n by default. + + preserve_groups By default, ssuuddoo will initialize the group vector to + the list of groups the target user is in. When + _p_r_e_s_e_r_v_e___g_r_o_u_p_s is set, the user's existing group + vector is left unaltered. The real and effective group + IDs, however, are still set to match the target user. + This flag is _o_f_f by default. + + pwfeedback By default, ssuuddoo reads the password like most other + Unix programs, by turning off echo until the user hits + the return (or enter) key. Some users become confused + by this as it appears to them that ssuuddoo has hung at + this point. When _p_w_f_e_e_d_b_a_c_k is set, ssuuddoo will provide + visual feedback when the user presses a key. Note that + this does have a security impact as an onlooker may be + able to determine the length of the password being + entered. This flag is _o_f_f by default. + + requiretty If set, ssuuddoo will only run when the user is logged in + to a real tty. When this flag is set, ssuuddoo can only be + run from a login session and not via other means such + as cron(1m) or cgi-bin scripts. This flag is _o_f_f by + default. + + root_sudo If set, root is allowed to run ssuuddoo too. Disabling + this prevents users from "chaining" ssuuddoo commands to + get a root shell by doing something like "sudo sudo + /bin/sh". Note, however, that turning off _r_o_o_t___s_u_d_o + will also prevent root from running ssuuddooeeddiitt. + Disabling _r_o_o_t___s_u_d_o provides no real additional + security; it exists purely for historical reasons. + This flag is _o_n by default. + + rootpw If set, ssuuddoo will prompt for the root password instead + of the password of the invoking user when running a + command or editing a file. This flag is _o_f_f by + default. + + runaspw If set, ssuuddoo will prompt for the password of the user + defined by the _r_u_n_a_s___d_e_f_a_u_l_t option (defaults to root) + instead of the password of the invoking user when + running a command or editing a file. This flag is _o_f_f + by default. + + set_home If enabled and ssuuddoo is invoked with the --ss option the + HOME environment variable will be set to the home + directory of the target user (which is root unless the + --uu option is used). This effectively makes the --ss + option imply --HH. Note that HOME is already set when + the _e_n_v___r_e_s_e_t option is enabled, so _s_e_t___h_o_m_e is only + effective for configurations where either _e_n_v___r_e_s_e_t is + disabled or HOME is present in the _e_n_v___k_e_e_p list. This + flag is _o_f_f by default. + + set_logname Normally, ssuuddoo will set the LOGNAME and USER + environment variables to the name of the target user + (usually root unless the --uu option is given). However, + since some programs (including the RCS revision control + system) use LOGNAME to determine the real identity of + the user, it may be desirable to change this behavior. + This can be done by negating the set_logname option. + Note that _s_e_t___l_o_g_n_a_m_e will have no effect if the + _e_n_v___r_e_s_e_t option has not been disabled and the _e_n_v___k_e_e_p + list contains LOGNAME or USER. This flag is _o_n by + default. + + set_utmp When enabled, ssuuddoo will create an entry in the utmp (or + utmpx) file when a pseudo-tty is allocated. A pseudo- + tty is allocated by ssuuddoo when the _l_o_g___i_n_p_u_t, _l_o_g___o_u_t_p_u_t + or _u_s_e___p_t_y flags are enabled. By default, the new + entry will be a copy of the user's existing utmp entry + (if any), with the tty, time, type and pid fields + updated. This flag is _o_n by default. + + setenv Allow the user to disable the _e_n_v___r_e_s_e_t option from the + command line via the --EE option. Additionally, + environment variables set via the command line are not + subject to the restrictions imposed by _e_n_v___c_h_e_c_k, + _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p. As such, only trusted users + should be allowed to set variables in this manner. + This flag is _o_f_f by default. + + shell_noargs If set and ssuuddoo is invoked with no arguments it acts as + if the --ss option had been given. That is, it runs a + shell as root (the shell is determined by the SHELL + environment variable if it is set, falling back on the + shell listed in the invoking user's /etc/passwd entry + if not). This flag is _o_f_f by default. + + stay_setuid Normally, when ssuuddoo executes a command the real and + effective UIDs are set to the target user (root by + default). This option changes that behavior such that + the real UID is left as the invoking user's UID. In + other words, this makes ssuuddoo act as a setuid wrapper. + This can be useful on systems that disable some + potentially dangerous functionality when a program is + run setuid. This option is only effective on systems + that support either the setreuid(2) or setresuid(2) + system call. This flag is _o_f_f by default. + + sudoedit_checkdir + If set, ssuuddooeeddiitt will check all directory components of + the path to be edited for writability by the invoking + user. Symbolic links will not be followed in writable + directories and ssuuddooeeddiitt will refuse to edit a file + located in a writable directory. These restrictions + are not enforced when ssuuddooeeddiitt is run by root. On some + systems, if all directory components of the path to be + edited are not readable by the target user, ssuuddooeeddiitt + will be unable to edit the file. This flag is _o_n by + default. + + This setting was first introduced in version 1.8.15 but + initially suffered from a race condition. The check + for symbolic links in writable intermediate directories + was added in version 1.8.16. + + sudoedit_follow By default, ssuuddooeeddiitt will not follow symbolic links + when opening files. The _s_u_d_o_e_d_i_t___f_o_l_l_o_w option can be + enabled to allow ssuuddooeeddiitt to open symbolic links. It + may be overridden on a per-command basis by the _F_O_L_L_O_W + and _N_O_F_O_L_L_O_W tags. This flag is _o_f_f by default. + + This setting is only supported by version 1.8.15 or + higher. + + syslog_pid When logging via syslog(3), include the process ID in + the log entry. This flag is _o_f_f by default. + + This setting is only supported by version 1.8.21 or + higher. + + targetpw If set, ssuuddoo will prompt for the password of the user + specified by the --uu option (defaults to root) instead + of the password of the invoking user when running a + command or editing a file. Note that this flag + precludes the use of a uid not listed in the passwd + database as an argument to the --uu option. This flag is + _o_f_f by default. + + tty_tickets If set, users must authenticate on a per-tty basis. + With this flag enabled, ssuuddoo will use a separate record + in the time stamp file for each terminal. If disabled, + a single record is used for all login sessions. + + This option has been superseded by the _t_i_m_e_s_t_a_m_p___t_y_p_e + option. + + umask_override If set, ssuuddoo will set the umask as specified in the + _s_u_d_o_e_r_s file without modification. This makes it + possible to specify a umask in the _s_u_d_o_e_r_s file that is + more permissive than the user's own umask and matches + historical behavior. If _u_m_a_s_k___o_v_e_r_r_i_d_e is not set, + ssuuddoo will set the umask to be the union of the user's + umask and what is specified in _s_u_d_o_e_r_s. This flag is + _o_f_f by default. + + use_loginclass If set, ssuuddoo will apply the defaults specified for the + target user's login class if one exists. Only + available if ssuuddoo is configured with the + --with-logincap option. This flag is _o_f_f by default. + + use_netgroups If set, netgroups (prefixed with `+'), may be used in + place of a user or host. For LDAP-based sudoers, + netgroup support requires an expensive sub-string match + on the server unless the NNEETTGGRROOUUPP__BBAASSEE directive is + present in the _/_e_t_c_/_l_d_a_p_._c_o_n_f file. If netgroups are + not needed, this option can be disabled to reduce the + load on the LDAP server. This flag is _o_n by default. + + use_pty If set, and ssuuddoo is running in a terminal, the command + will be run in a pseudo-pty (even if no I/O logging is + being done). If the ssuuddoo process is not attached to a + terminal, _u_s_e___p_t_y has no effect. + + A malicious program run under ssuuddoo may be capable of + injecting commands into the user's terminal or running + a background process that retains access to the user's + terminal device even after the main program has + finished executing. By running the command in a + separate pseudo-pty, this attack is no longer possible. + This flag is _o_f_f by default. + + user_command_timeouts + If set, the user may specify a timeout on the command + line. If the timeout expires before the command has + exited, the command will be terminated. If a timeout + is specified both in the _s_u_d_o_e_r_s file and on the + command line, the smaller of the two timeouts will be + used. See the Timeout_Spec section for a description + of the timeout syntax. This flag is _o_f_f by default. + + This setting is only supported by version 1.8.20 or + higher. + + utmp_runas If set, ssuuddoo will store the name of the runas user when + updating the utmp (or utmpx) file. By default, ssuuddoo + stores the name of the invoking user. This flag is _o_f_f + by default. + + visiblepw By default, ssuuddoo will refuse to run if the user must + enter a password but it is not possible to disable echo + on the terminal. If the _v_i_s_i_b_l_e_p_w flag is set, ssuuddoo + will prompt for a password even when it would be + visible on the screen. This makes it possible to run + things like "ssh somehost sudo ls" since by default, + ssh(1) does not allocate a tty when running a command. + This flag is _o_f_f by default. + + IInntteeggeerrss: + + closefrom Before it executes a command, ssuuddoo will close all open + file descriptors other than standard input, standard + output and standard error (ie: file descriptors 0-2). + The _c_l_o_s_e_f_r_o_m option can be used to specify a different + file descriptor at which to start closing. The default + is 3. + + command_timeout The maximum amount of time a command is allowed to run + before it is terminated. See the Timeout_Spec section + for a description of the timeout syntax. + + This setting is only supported by version 1.8.20 or + higher. + + maxseq The maximum sequence number that will be substituted + for the "%{seq}" escape in the I/O log file (see the + _i_o_l_o_g___d_i_r description below for more information). + While the value substituted for "%{seq}" is in base 36, + _m_a_x_s_e_q itself should be expressed in decimal. Values + larger than 2176782336 (which corresponds to the base + 36 sequence number "ZZZZZZ") will be silently truncated + to 2176782336. The default value is 2176782336. + + Once the local sequence number reaches the value of + _m_a_x_s_e_q, it will "roll over" to zero, after which + ssuuddooeerrss will truncate and re-use any existing I/O log + path names. + + This setting is only supported by version 1.8.7 or + higher. + + passwd_tries The number of tries a user gets to enter his/her + password before ssuuddoo logs the failure and exits. The + default is 3. + + syslog_maxlen On many systems, syslog(3) has a relatively small log + buffer. IETF RFC 5424 states that syslog servers must + support messages of at least 480 bytes and should + support messages up to 2048 bytes. By default, ssuuddooeerrss + creates log messages up to 980 bytes which corresponds + to the historic BSD syslog implementation which used a + 1024 byte buffer to store the message, date, hostname + and program name. To prevent syslog messages from + being truncated, ssuuddooeerrss will split up log messages + that are larger than _s_y_s_l_o_g___m_a_x_l_e_n bytes. When a + message is split, additional parts will include the + string "(command continued)" after the user name and + before the continued command line arguments. + + This setting is only supported by version 1.8.19 or + higher. + + IInntteeggeerrss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt: + + loglinelen Number of characters per line for the file log. This + value is used to decide when to wrap lines for nicer + log files. This has no effect on the syslog log file, + only the file log. The default is 80 (use 0 or negate + the option to disable word wrap). + + passwd_timeout Number of minutes before the ssuuddoo password prompt times + out, or 0 for no timeout. The timeout may include a + fractional component if minute granularity is + insufficient, for example 2.5. The default is 5. + + timestamp_timeout + Number of minutes that can elapse before ssuuddoo will ask + for a passwd again. The timeout may include a + fractional component if minute granularity is + insufficient, for example 2.5. The default is 5. Set + this to 0 to always prompt for a password. If set to a + value less than 0 the user's time stamp will not expire + until the system is rebooted. This can be used to + allow users to create or delete their own time stamps + via "sudo -v" and "sudo -k" respectively. + + umask Umask to use when running the command. Negate this + option or set it to 0777 to preserve the user's umask. + The actual umask that is used will be the union of the + user's umask and the value of the _u_m_a_s_k option, which + defaults to 0022. This guarantees that ssuuddoo never + lowers the umask when running a command. Note: on + systems that use PAM, the default PAM configuration may + specify its own umask which will override the value set + in _s_u_d_o_e_r_s. + + SSttrriinnggss: + + authfail_message Message that is displayed after a user fails to + authenticate. The message may include the `%d' escape + which will expand to the number of failed password + attempts. If set, it overrides the default message, %d + incorrect password attempt(s). + + badpass_message Message that is displayed if a user enters an incorrect + password. The default is Sorry, try again. unless + insults are enabled. + + editor A colon (`:') separated list of editors path names used + by ssuuddooeeddiitt and vviissuuddoo. For ssuuddooeeddiitt, this list is + used to find an editor when none of the SUDO_EDITOR, + VISUAL or EDITOR environment variables are set to an + editor that exists and is executable. For vviissuuddoo, it + is used as a white list of allowed editors; vviissuuddoo will + choose the editor that matches the user's SUDO_EDITOR, + VISUAL or EDITOR environment variable if possible, or + the first editor in the list that exists and is + executable if not. Unless invoked as ssuuddooeeddiitt, ssuuddoo + does not preserve the SUDO_EDITOR, VISUAL and EDITOR + environment variables by default, even when the + _e_n_v___r_e_s_e_t option is enabled. The default is _v_i. + + iolog_dir The top-level directory to use when constructing the + path name for the input/output log directory. Only + used if the _l_o_g___i_n_p_u_t or _l_o_g___o_u_t_p_u_t options are enabled + or when the LOG_INPUT or LOG_OUTPUT tags are present + for a command. The session sequence number, if any, is + stored in the directory. The default is + _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o. + + The following percent (`%') escape sequences are + supported: + + %{seq} + expanded to a monotonically increasing base-36 + sequence number, such as 0100A5, where every two + digits are used to form a new directory, e.g., + _0_1_/_0_0_/_A_5 + + %{user} + expanded to the invoking user's login name + + %{group} + expanded to the name of the invoking user's real + group ID + + %{runas_user} + expanded to the login name of the user the + command will be run as (e.g., root) + + %{runas_group} + expanded to the group name of the user the + command will be run as (e.g., wheel) + + %{hostname} + expanded to the local host name without the + domain name + + %{command} + expanded to the base name of the command being + run + + In addition, any escape sequences supported by the + system's strftime(3) function will be expanded. + + To include a literal `%' character, the string `%%' + should be used. + + iolog_file The path name, relative to _i_o_l_o_g___d_i_r, in which to store + input/output logs when the _l_o_g___i_n_p_u_t or _l_o_g___o_u_t_p_u_t + options are enabled or when the LOG_INPUT or LOG_OUTPUT + tags are present for a command. Note that _i_o_l_o_g___f_i_l_e + may contain directory components. The default is + "%{seq}". + + See the _i_o_l_o_g___d_i_r option above for a list of supported + percent (`%') escape sequences. + + In addition to the escape sequences, path names that + end in six or more Xs will have the Xs replaced with a + unique combination of digits and letters, similar to + the mktemp(3) function. + + If the path created by concatenating _i_o_l_o_g___d_i_r and + _i_o_l_o_g___f_i_l_e already exists, the existing I/O log file + will be truncated and overwritten unless _i_o_l_o_g___f_i_l_e + ends in six or more Xs. + + iolog_flush If set, ssuuddoo will flush I/O log data to disk after each + write instead of buffering it. This makes it possible + to view the logs in real-time as the program is + executing but may significantly reduce the + effectiveness of I/O log compression. This flag is _o_f_f + by default. + + This setting is only supported by version 1.8.20 or + higher. + + iolog_group The group name to look up when setting the group ID on + new I/O log files and directories. If _i_o_l_o_g___g_r_o_u_p is + not set, the primary group ID of the user specified by + _i_o_l_o_g___u_s_e_r is used. If neither _i_o_l_o_g___g_r_o_u_p nor + _i_o_l_o_g___u_s_e_r are set, I/O log files and directories are + created with group ID 0. + + This setting is only supported by version 1.8.19 or + higher. + + iolog_mode The file mode to use when creating I/O log files. Mode + bits for read and write permissions for owner, group or + other are honored, everything else is ignored. The + file permissions will always include the owner read and + write bits, even if they are not present in the + specified mode. When creating I/O log directories, + search (execute) bits are added to match the read and + write bits specified by _i_o_l_o_g___m_o_d_e. Defaults to 0600 + (read and write by user only). + + This setting is only supported by version 1.8.19 or + higher. + + iolog_user The user name to look up when setting the user and + group IDs on new I/O log files and directories. If + _i_o_l_o_g___g_r_o_u_p is set, it will be used instead of the + user's primary group ID. By default, I/O log files and + directories are created with user and group ID 0. + + This setting can be useful when the I/O logs are stored + on a Network File System (NFS) share. Having a + dedicated user own the I/O log files means that ssuuddooeerrss + does not write to the log files as user ID 0, which is + usually not permitted by NFS. + + This setting is only supported by version 1.8.19 or + higher. + + lecture_status_dir + The directory in which ssuuddoo stores per-user lecture + status files. Once a user has received the lecture, a + zero-length file is created in this directory so that + ssuuddoo will not lecture the user again. This directory + should _n_o_t be cleared when the system reboots. The + default is _/_v_a_r_/_a_d_m_/_s_u_d_o_/_l_e_c_t_u_r_e_d. + + limitprivs The default Solaris limit privileges to use when + constructing a new privilege set for a command. This + bounds all privileges of the executing process. The + default limit privileges may be overridden on a per- + command basis in _s_u_d_o_e_r_s. This option is only + available if ssuuddooeerrss is built on Solaris 10 or higher. + + mailsub Subject of the mail sent to the _m_a_i_l_t_o user. The + escape %h will expand to the host name of the machine. + Default is "*** SECURITY information for %h ***". + + noexec_file As of ssuuddoo version 1.8.1 this option is no longer + supported. The path to the noexec file should now be + set in the sudo.conf(4) file. + + pam_login_service + On systems that use PAM for authentication, this is the + service name used when the --ii option is specified. The + default value is "sudo". See the description of + _p_a_m___s_e_r_v_i_c_e for more information. + + This setting is only supported by version 1.8.8 or + higher. + + pam_service On systems that use PAM for authentication, the service + name specifies the PAM policy to apply. This usually + corresponds to an entry in the _p_a_m_._c_o_n_f file or a file + in the _/_e_t_c_/_p_a_m_._d directory. The default value is + "sudo". + + This setting is only supported by version 1.8.8 or + higher. + + passprompt The default prompt to use when asking for a password; + can be overridden via the --pp option or the SUDO_PROMPT + environment variable. The following percent (`%') + escape sequences are supported: + + %H expanded to the local host name including the + domain name (only if the machine's host name is + fully qualified or the _f_q_d_n option is set) + + %h expanded to the local host name without the + domain name + + %p expanded to the user whose password is being + asked for (respects the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and + _r_u_n_a_s_p_w flags in _s_u_d_o_e_r_s) + + %U expanded to the login name of the user the + command will be run as (defaults to root) + + %u expanded to the invoking user's login name + + %% two consecutive % characters are collapsed into a + single % character + + On systems that use PAM for authentication, _p_a_s_s_p_r_o_m_p_t + will only be used if the prompt provided by the PAM + module matches the string "Password: " or "username's + Password: ". This ensures that the _p_a_s_s_p_r_o_m_p_t setting + does not interfere with challenge-response style + authentication. The _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e flag can be + used to change this behavior. + + The default value is "Password: ". + + privs The default Solaris privileges to use when constructing + a new privilege set for a command. This is passed to + the executing process via the inherited privilege set, + but is bounded by the limit privileges. If the _p_r_i_v_s + option is specified but the _l_i_m_i_t_p_r_i_v_s option is not, + the limit privileges of the executing process is set to + _p_r_i_v_s. The default privileges may be overridden on a + per-command basis in _s_u_d_o_e_r_s. This option is only + available if ssuuddooeerrss is built on Solaris 10 or higher. + + role The default SELinux role to use when constructing a new + security context to run the command. The default role + may be overridden on a per-command basis in the _s_u_d_o_e_r_s + file or via command line options. This option is only + available when ssuuddoo is built with SELinux support. + + runas_default The default user to run commands as if the --uu option is + not specified on the command line. This defaults to + root. + + sudoers_locale Locale to use when parsing the sudoers file, logging + commands, and sending email. Note that changing the + locale may affect how sudoers is interpreted. Defaults + to "C". + + timestamp_type ssuuddooeerrss uses per-user time stamp files for credential + caching. The _t_i_m_e_s_t_a_m_p___t_y_p_e option can be used to + specify the type of time stamp record used. It has the + following possible values: + + global A single time stamp record is used for all of a + user's login sessions, regardless of the + terminal or parent process ID. An additional + record is used to serialize password prompts + when ssuuddoo is used multiple times in a pipeline, + but this does not affect authentication. + + ppid A single time stamp record is used for all + processes with the same parent process ID + (usually the shell). Commands run from the + same shell (or other common parent process) + will not require a password for + _t_i_m_e_s_t_a_m_p___t_i_m_e_o_u_t minutes (5 by default). + Commands run via ssuuddoo with a different parent + process ID, for example from a shell script, + will be authenticated separately. + + tty One time stamp record is used for each + terminal, which means that a user's login + sessions are authenticated separately. If no + terminal is present, the behavior is the same + as _p_p_i_d. Commands run from the same terminal + will not require a password for + _t_i_m_e_s_t_a_m_p___t_i_m_e_o_u_t minutes (5 by default). + + kernel The time stamp is stored in the kernel as an + attribute of the terminal device. If no + terminal is present, the behavior is the same + as _p_p_i_d. Negative _t_i_m_e_s_t_a_m_p___t_i_m_e_o_u_t values are + not supported and positive values are limited + to a maximum of 60 minutes. This is currently + only supported on OpenBSD. + + The default value is _t_t_y. + + This setting is only supported by version 1.8.21 or + higher. + + timestampdir The directory in which ssuuddoo stores its time stamp + files. This directory should be cleared when the + system reboots. The default is _/_v_a_r_/_r_u_n_/_s_u_d_o_/_t_s. + + timestampowner The owner of the lecture status directory, time stamp + directory and all files stored therein. The default is + root. + + type The default SELinux type to use when constructing a new + security context to run the command. The default type + may be overridden on a per-command basis in the _s_u_d_o_e_r_s + file or via command line options. This option is only + available when ssuuddoo is built with SELinux support. + + SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt: + + env_file The _e_n_v___f_i_l_e option specifies the fully qualified path to a + file containing variables to be set in the environment of + the program being run. Entries in this file should either + be of the form "VARIABLE=value" or "export VARIABLE=value". + The value may optionally be surrounded by single or double + quotes. Variables in this file are only added if the + variable does not already exist in the environment. This + file is considered to be part of the security policy, its + contents are not subject to other ssuuddoo environment + restrictions such as _e_n_v___k_e_e_p and _e_n_v___c_h_e_c_k. + + exempt_group Users in this group are exempt from password and PATH + requirements. The group name specified should not include + a % prefix. This is not set by default. + + fdexec Determines whether ssuuddoo will execute a command by its path + or by an open file descriptor. It has the following + possible values: + + always Always execute by file descriptor. + + never Never execute by file descriptor. + + digest_only + Only execute by file descriptor if the command has + an associated digest in the _s_u_d_o_e_r_s file. + + The default value is _d_i_g_e_s_t___o_n_l_y. This avoids a time of + check versus time of use race condition when the command is + located in a directory writable by the invoking user. + + Note that _f_d_e_x_e_c will change the first element of the + argument vector for scripts ($0 in the shell) due to the + way the kernel runs script interpreters. Instead of being + a normal path, it will refer to a file descriptor. For + example, _/_d_e_v_/_f_d_/_4 on Solaris and _/_p_r_o_c_/_s_e_l_f_/_f_d_/_4 on Linux. + A workaround is to use the SUDO_COMMAND environment + variable instead. + + The _f_d_e_x_e_c setting is only used when the command is matched + by path name. It has no effect if the command is matched + by the built-in AALLLL alias. + + This setting is only supported by version 1.8.20 or higher. + If the operating system does not support the fexecve(2) + system call, this setting has no effect. + + group_plugin A string containing a ssuuddooeerrss group plugin with optional + arguments. The string should consist of the plugin path, + either fully-qualified or relative to the + _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o directory, followed by any + configuration arguments the plugin requires. These + arguments (if any) will be passed to the plugin's + initialization function. If arguments are present, the + string must be enclosed in double quotes (""). + + For more information see _G_R_O_U_P _P_R_O_V_I_D_E_R _P_L_U_G_I_N_S. + + lecture This option controls when a short lecture will be printed + along with the password prompt. It has the following + possible values: + + always Always lecture the user. + + never Never lecture the user. + + once Only lecture the user the first time they run ssuuddoo. + + If no value is specified, a value of _o_n_c_e is implied. + Negating the option results in a value of _n_e_v_e_r being used. + The default value is _o_n_c_e. + + lecture_file Path to a file containing an alternate ssuuddoo lecture that + will be used in place of the standard lecture if the named + file exists. By default, ssuuddoo uses a built-in lecture. + + listpw This option controls when a password will be required when + a user runs ssuuddoo with the --ll option. It has the following + possible values: + + all All the user's _s_u_d_o_e_r_s file entries for the + current host must have the NOPASSWD flag set to + avoid entering a password. + + always The user must always enter a password to use the + --ll option. + + any At least one of the user's _s_u_d_o_e_r_s file entries + for the current host must have the NOPASSWD flag + set to avoid entering a password. + + never The user need never enter a password to use the + --ll option. + + If no value is specified, a value of _a_n_y is implied. + Negating the option results in a value of _n_e_v_e_r being used. + The default value is _a_n_y. + + logfile Path to the ssuuddoo log file (not the syslog log file). + Setting a path turns on logging to a file; negating this + option turns it off. By default, ssuuddoo logs via syslog. + + mailerflags Flags to use when invoking mailer. Defaults to --tt. + + mailerpath Path to mail program used to send warning mail. Defaults + to the path to sendmail found at configure time. + + mailfrom Address to use for the "from" address when sending warning + and error mail. The address should be enclosed in double + quotes ("") to protect against ssuuddoo interpreting the @ + sign. Defaults to the name of the user running ssuuddoo. + + mailto Address to send warning and error mail to. The address + should be enclosed in double quotes ("") to protect against + ssuuddoo interpreting the @ sign. Defaults to root. + + restricted_env_file + The _r_e_s_t_r_i_c_t_e_d___e_n_v___f_i_l_e option specifies the fully + qualified path to a file containing variables to be set in + the environment of the program being run. Entries in this + file should either be of the form "VARIABLE=value" or + "export VARIABLE=value". The value may optionally be + surrounded by single or double quotes. Variables in this + file are only added if the variable does not already exist + in the environment. Unlike _e_n_v___f_i_l_e, the file's contents + are not trusted and are processed in a manner similar to + that of the invoking user's environment. If _e_n_v___r_e_s_e_t is + enabled, variables in the file will only be added if they + are matched by either the _e_n_v___c_h_e_c_k or _e_n_v___k_e_e_p list. If + _e_n_v___r_e_s_e_t is disabled, variables in the file are added as + long as they are not matched by the _e_n_v___d_e_l_e_t_e list. In + either case, the contents of _r_e_s_t_r_i_c_t_e_d___e_n_v___f_i_l_e are + processed before the contents of _e_n_v___f_i_l_e. + + secure_path Path used for every command run from ssuuddoo. If you don't + trust the people running ssuuddoo to have a sane PATH + environment variable you may want to use this. Another use + is if you want to have the "root path" be separate from the + "user path". Users in the group specified by the + _e_x_e_m_p_t___g_r_o_u_p option are not affected by _s_e_c_u_r_e___p_a_t_h. This + option is not set by default. + + syslog Syslog facility if syslog is being used for logging (negate + to disable syslog logging). Defaults to auth. + + The following syslog facilities are supported: aauutthhpprriivv (if + your OS supports it), aauutthh, ddaaeemmoonn, uusseerr, llooccaall00, llooccaall11, + llooccaall22, llooccaall33, llooccaall44, llooccaall55, llooccaall66, and llooccaall77. + + syslog_badpri + Syslog priority to use when the user is not allowed to run + a command or when authentication is unsuccessful. Defaults + to alert. + + The following syslog priorities are supported: aalleerrtt, ccrriitt, + ddeebbuugg, eemmeerrgg, eerrrr, iinnffoo, nnoottiiccee, wwaarrnniinngg, and nnoonnee. + Negating the option or setting it to a value of nnoonnee will + disable logging of unsuccessful commands. + + syslog_goodpri + Syslog priority to use when the user is allowed to run a + command and authentication is successful. Defaults to + notice. + + See _s_y_s_l_o_g___b_a_d_p_r_i for the list of supported syslog + priorities. Negating the option or setting it to a value + of nnoonnee will disable logging of successful commands. + + verifypw This option controls when a password will be required when + a user runs ssuuddoo with the --vv option. It has the following + possible values: + + all All the user's _s_u_d_o_e_r_s file entries for the current + host must have the NOPASSWD flag set to avoid + entering a password. + + always The user must always enter a password to use the --vv + option. + + any At least one of the user's _s_u_d_o_e_r_s file entries for + the current host must have the NOPASSWD flag set to + avoid entering a password. + + never The user need never enter a password to use the --vv + option. + + If no value is specified, a value of _a_l_l is implied. + Negating the option results in a value of _n_e_v_e_r being used. + The default value is _a_l_l. + + LLiissttss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt: + + env_check Environment variables to be removed from the user's + environment unless they are considered "safe". For all + variables except TZ, "safe" means that the variable's + value does not contain any `%' or `/' characters. This + can be used to guard against printf-style format + vulnerabilities in poorly-written programs. The TZ + variable is considered unsafe if any of the following + are true: + + ++oo It consists of a fully-qualified path name, + optionally prefixed with a colon (`:'), that does + not match the location of the _z_o_n_e_i_n_f_o directory. + + ++oo It contains a _._. path element. + + ++oo It contains white space or non-printable characters. + + ++oo It is longer than the value of PATH_MAX. + + The argument may be a double-quoted, space-separated + list or a single value without double-quotes. The list + can be replaced, added to, deleted from, or disabled by + using the =, +=, -=, and ! operators respectively. + Regardless of whether the env_reset option is enabled + or disabled, variables specified by env_check will be + preserved in the environment if they pass the + aforementioned check. The global list of environment + variables to check is displayed when ssuuddoo is run by + root with the --VV option. + + env_delete Environment variables to be removed from the user's + environment when the _e_n_v___r_e_s_e_t option is not in effect. + The argument may be a double-quoted, space-separated + list or a single value without double-quotes. The list + can be replaced, added to, deleted from, or disabled by + using the =, +=, -=, and ! operators respectively. The + global list of environment variables to remove is + displayed when ssuuddoo is run by root with the --VV option. + Note that many operating systems will remove + potentially dangerous variables from the environment of + any setuid process (such as ssuuddoo). + + env_keep Environment variables to be preserved in the user's + environment when the _e_n_v___r_e_s_e_t option is in effect. + This allows fine-grained control over the environment + ssuuddoo-spawned processes will receive. The argument may + be a double-quoted, space-separated list or a single + value without double-quotes. The list can be replaced, + added to, deleted from, or disabled by using the =, +=, + -=, and ! operators respectively. The global list of + variables to keep is displayed when ssuuddoo is run by root + with the --VV option. + +GGRROOUUPP PPRROOVVIIDDEERR PPLLUUGGIINNSS + The ssuuddooeerrss plugin supports its own plugin interface to allow non-Unix + group lookups which can query a group source other than the standard Unix + group database. This can be used to implement support for the + nonunix_group syntax described earlier. + + Group provider plugins are specified via the _g_r_o_u_p___p_l_u_g_i_n Defaults + setting. The argument to _g_r_o_u_p___p_l_u_g_i_n should consist of the plugin path, + either fully-qualified or relative to the _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o + directory, followed by any configuration options the plugin requires. + These options (if specified) will be passed to the plugin's + initialization function. If options are present, the string must be + enclosed in double quotes (""). + + The following group provider plugins are installed by default: + + group_file + The _g_r_o_u_p___f_i_l_e plugin supports an alternate group file that + uses the same syntax as the _/_e_t_c_/_g_r_o_u_p file. The path to the + group file should be specified as an option to the plugin. For + example, if the group file to be used is _/_e_t_c_/_s_u_d_o_-_g_r_o_u_p: + + Defaults group_plugin="group_file.so /etc/sudo-group" + + system_group + The _s_y_s_t_e_m___g_r_o_u_p plugin supports group lookups via the standard + C library functions ggeettggrrnnaamm() and ggeettggrriidd(). This plugin can + be used in instances where the user belongs to groups not + present in the user's supplemental group vector. This plugin + takes no options: + + Defaults group_plugin=system_group.so + + The group provider plugin API is described in detail in sudo_plugin(4). + +LLOOGG FFOORRMMAATT + ssuuddooeerrss can log events using either syslog(3) or a simple log file. The + log format is almost identical in both cases. + + AAcccceepptteedd ccoommmmaanndd lloogg eennttrriieess + Commands that sudo runs are logged using the following format (split into + multiple lines for readability): + + date hostname progname: username : TTY=ttyname ; PWD=cwd ; \ + USER=runasuser ; GROUP=runasgroup ; TSID=logid ; \ + ENV=env_vars COMMAND=command + + Where the fields are as follows: + + date The date the command was run. Typically, this is in the + format "MMM, DD, HH:MM:SS". If logging via syslog(3), the + actual date format is controlled by the syslog daemon. If + logging to a file and the _l_o_g___y_e_a_r option is enabled, the + date will also include the year. + + hostname The name of the host ssuuddoo was run on. This field is only + present when logging via syslog(3). + + progname The name of the program, usually _s_u_d_o or _s_u_d_o_e_d_i_t. This + field is only present when logging via syslog(3). + + username The login name of the user who ran ssuuddoo. + + ttyname The short name of the terminal (e.g., "console", "tty01", + or "pts/0") ssuuddoo was run on, or "unknown" if there was no + terminal present. + + cwd The current working directory that ssuuddoo was run in. + + runasuser The user the command was run as. + + runasgroup The group the command was run as if one was specified on + the command line. + + logid An I/O log identifier that can be used to replay the + command's output. This is only present when the _l_o_g___i_n_p_u_t + or _l_o_g___o_u_t_p_u_t option is enabled. + + env_vars A list of environment variables specified on the command + line, if specified. + + command The actual command that was executed. + + Messages are logged using the locale specified by _s_u_d_o_e_r_s___l_o_c_a_l_e, which + defaults to the "C" locale. + + DDeenniieedd ccoommmmaanndd lloogg eennttrriieess + If the user is not allowed to run the command, the reason for the denial + will follow the user name. Possible reasons include: + + user NOT in sudoers + The user is not listed in the _s_u_d_o_e_r_s file. + + user NOT authorized on host + The user is listed in the _s_u_d_o_e_r_s file but is not allowed to run + commands on the host. + + command not allowed + The user is listed in the _s_u_d_o_e_r_s file for the host but they are not + allowed to run the specified command. + + 3 incorrect password attempts + The user failed to enter their password after 3 tries. The actual + number of tries will vary based on the number of failed attempts and + the value of the _p_a_s_s_w_d___t_r_i_e_s option. + + a password is required + ssuuddoo's --nn option was specified but a password was required. + + sorry, you are not allowed to set the following environment variables + The user specified environment variables on the command line that were + not allowed by _s_u_d_o_e_r_s. + + EErrrroorr lloogg eennttrriieess + If an error occurs, ssuuddooeerrss will log a message and, in most cases, send a + message to the administrator via email. Possible errors include: + + parse error in /etc/sudoers near line N + ssuuddooeerrss encountered an error when parsing the specified file. In some + cases, the actual error may be one line above or below the line number + listed, depending on the type of error. + + problem with defaults entries + The _s_u_d_o_e_r_s file contains one or more unknown Defaults settings. This + does not prevent ssuuddoo from running, but the _s_u_d_o_e_r_s file should be + checked using vviissuuddoo. + + timestamp owner (username): No such user + The time stamp directory owner, as specified by the _t_i_m_e_s_t_a_m_p_o_w_n_e_r + setting, could not be found in the password database. + + unable to open/read /etc/sudoers + The _s_u_d_o_e_r_s file could not be opened for reading. This can happen + when the _s_u_d_o_e_r_s file is located on a remote file system that maps + user ID 0 to a different value. Normally, ssuuddooeerrss tries to open the + _s_u_d_o_e_r_s file using group permissions to avoid this problem. Consider + either changing the ownership of _/_e_t_c_/_s_u_d_o_e_r_s or adding an argument + like "sudoers_uid=N" (where `N' is the user ID that owns the _s_u_d_o_e_r_s + file) to the end of the ssuuddooeerrss Plugin line in the sudo.conf(4) file. + + unable to stat /etc/sudoers + The _/_e_t_c_/_s_u_d_o_e_r_s file is missing. + + /etc/sudoers is not a regular file + The _/_e_t_c_/_s_u_d_o_e_r_s file exists but is not a regular file or symbolic + link. + + /etc/sudoers is owned by uid N, should be 0 + The _s_u_d_o_e_r_s file has the wrong owner. If you wish to change the + _s_u_d_o_e_r_s file owner, please add "sudoers_uid=N" (where `N' is the user + ID that owns the _s_u_d_o_e_r_s file) to the ssuuddooeerrss Plugin line in the + sudo.conf(4) file. + + /etc/sudoers is world writable + The permissions on the _s_u_d_o_e_r_s file allow all users to write to it. + The _s_u_d_o_e_r_s file must not be world-writable, the default file mode is + 0440 (readable by owner and group, writable by none). The default + mode may be changed via the "sudoers_mode" option to the ssuuddooeerrss + Plugin line in the sudo.conf(4) file. + + /etc/sudoers is owned by gid N, should be 1 + The _s_u_d_o_e_r_s file has the wrong group ownership. If you wish to change + the _s_u_d_o_e_r_s file group ownership, please add "sudoers_gid=N" (where + `N' is the group ID that owns the _s_u_d_o_e_r_s file) to the ssuuddooeerrss Plugin + line in the sudo.conf(4) file. + + unable to open /var/run/sudo/ts/username + ssuuddooeerrss was unable to read or create the user's time stamp file. This + can happen when _t_i_m_e_s_t_a_m_p_o_w_n_e_r is set to a user other than root and + the mode on _/_v_a_r_/_r_u_n_/_s_u_d_o is not searchable by group or other. The + default mode for _/_v_a_r_/_r_u_n_/_s_u_d_o is 0711. + + unable to write to /var/run/sudo/ts/username + ssuuddooeerrss was unable to write to the user's time stamp file. + + /var/run/sudo/ts is owned by uid X, should be Y + The time stamp directory is owned by a user other than _t_i_m_e_s_t_a_m_p_o_w_n_e_r. + This can occur when the value of _t_i_m_e_s_t_a_m_p_o_w_n_e_r has been changed. + ssuuddooeerrss will ignore the time stamp directory until the owner is + corrected. + + /var/run/sudo/ts is group writable + The time stamp directory is group-writable; it should be writable only + by _t_i_m_e_s_t_a_m_p_o_w_n_e_r. The default mode for the time stamp directory is + 0700. ssuuddooeerrss will ignore the time stamp directory until the mode is + corrected. + + NNootteess oonn llooggggiinngg vviiaa ssyysslloogg + By default, ssuuddooeerrss logs messages via syslog(3). The _d_a_t_e, _h_o_s_t_n_a_m_e, and + _p_r_o_g_n_a_m_e fields are added by the system's ssyysslloogg() function, not ssuuddooeerrss + itself. As such, they may vary in format on different systems. + + The maximum size of syslog messages varies from system to system. The + _s_y_s_l_o_g___m_a_x_l_e_n setting can be used to change the maximum syslog message + size from the default value of 980 bytes. For more information, see the + description of _s_y_s_l_o_g___m_a_x_l_e_n. + + NNootteess oonn llooggggiinngg ttoo aa ffiillee + If the _l_o_g_f_i_l_e option is set, ssuuddooeerrss will log to a local file, such as + _/_v_a_r_/_l_o_g_/_s_u_d_o. When logging to a file, ssuuddooeerrss uses a format similar to + syslog(3), with a few important differences: + + 1. The _p_r_o_g_n_a_m_e and _h_o_s_t_n_a_m_e fields are not present. + + 2. If the _l_o_g___y_e_a_r option is enabled, the date will also include the + year. + + 3. Lines that are longer than _l_o_g_l_i_n_e_l_e_n characters (80 by default) are + word-wrapped and continued on the next line with a four character + indent. This makes entries easier to read for a human being, but + makes it more difficult to use grep(1) on the log files. If the + _l_o_g_l_i_n_e_l_e_n option is set to 0 (or negated with a `!'), word wrap + will be disabled. + +II//OO LLOOGG FFIILLEESS + When I/O logging is enabled, ssuuddoo will run the command in a pseudo-tty + and log all user input and/or output, depending on which options are + enabled. I/O is logged to the directory specified by the _i_o_l_o_g___d_i_r + option (_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o by default) using a unique session ID that is + included in the ssuuddoo log line, prefixed with "TSID=". The _i_o_l_o_g___f_i_l_e + option may be used to control the format of the session ID. + + Each I/O log is stored in a separate directory that contains the + following files: + + _l_o_g a text file containing the time the command was run, the name + of the user who ran ssuuddoo, the name of the target user, the name + of the target group (optional), the terminal that ssuuddoo was run + from, the number of rows and columns of the terminal, the + working directory the command was run from and the path name of + the command itself (with arguments if present) + + _t_i_m_i_n_g a log of the amount of time between, and the number of bytes + in, each I/O log entry (used for session playback) + + _t_t_y_i_n input from the user's tty (what the user types) + + _s_t_d_i_n input from a pipe or file + + _t_t_y_o_u_t output from the pseudo-tty (what the command writes to the + screen) + + _s_t_d_o_u_t standard output to a pipe or redirected to a file + + _s_t_d_e_r_r standard error to a pipe or redirected to a file + + All files other than _l_o_g are compressed in gzip format unless the + _c_o_m_p_r_e_s_s___i_o flag has been disabled. Due to buffering, it is not normally + possible to display the I/O logs in real-time as the program is executing + The I/O log data will not be complete until the program run by ssuuddoo has + exited or has been terminated by a signal. The _i_o_l_o_g___f_l_u_s_h flag can be + used to disable buffering, in which case I/O log data is written to disk + as soon as it is available. The output portion of an I/O log file can be + viewed with the sudoreplay(1m) utility, which can also be used to list or + search the available logs. + + Note that user input may contain sensitive information such as passwords + (even if they are not echoed to the screen), which will be stored in the + log file unencrypted. In most cases, logging the command output via + _l_o_g___o_u_t_p_u_t or LOG_OUTPUT is all that is required. + + Since each session's I/O logs are stored in a separate directory, + traditional log rotation utilities cannot be used to limit the number of + I/O logs. The simplest way to limit the number of I/O is by setting the + _m_a_x_s_e_q option to the maximum number of logs you wish to store. Once the + I/O log sequence number reaches _m_a_x_s_e_q, it will be reset to zero and + ssuuddooeerrss will truncate and re-use any existing I/O logs. + +FFIILLEESS + _/_e_t_c_/_s_u_d_o_._c_o_n_f Sudo front end configuration + + _/_e_t_c_/_s_u_d_o_e_r_s List of who can run what + + _/_e_t_c_/_g_r_o_u_p Local groups file + + _/_e_t_c_/_n_e_t_g_r_o_u_p List of network groups + + _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o I/O log files + + _/_v_a_r_/_r_u_n_/_s_u_d_o_/_t_s Directory containing time stamps for the + ssuuddooeerrss security policy + + _/_v_a_r_/_a_d_m_/_s_u_d_o_/_l_e_c_t_u_r_e_d Directory containing lecture status files for + the ssuuddooeerrss security policy + + _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t Initial environment for --ii mode on AIX and + Linux systems + +EEXXAAMMPPLLEESS + Below are example _s_u_d_o_e_r_s file entries. Admittedly, some of these are a + bit contrived. First, we allow a few environment variables to pass and + then define our _a_l_i_a_s_e_s: + + # Run X applications through sudo; HOME is used to find the + # .Xauthority file. Note that other programs use HOME to find + # configuration files and this may lead to privilege escalation! + Defaults env_keep += "DISPLAY HOME" + + # User alias specification + User_Alias FULLTIMERS = millert, mikef, dowdy + User_Alias PARTTIMERS = bostley, jwfox, crawl + User_Alias WEBMASTERS = will, wendy, wim + + # Runas alias specification + Runas_Alias OP = root, operator + Runas_Alias DB = oracle, sybase + Runas_Alias ADMINGRP = adm, oper + + # Host alias specification + Host_Alias SPARC = bigtime, eclipse, moet, anchor :\ + SGI = grolsch, dandelion, black :\ + ALPHA = widget, thalamus, foobar :\ + HPPA = boa, nag, python + Host_Alias CUNETS = 128.138.0.0/255.255.0.0 + Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0 + Host_Alias SERVERS = master, mail, www, ns + Host_Alias CDROM = orion, perseus, hercules + + # Cmnd alias specification + Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\ + /usr/sbin/restore, /usr/sbin/rrestore,\ + sha224:0GomF8mNN3wlDt1HD9XldjJ3SNgpFdbjO1+NsQ== \ + /home/operator/bin/start_backups + Cmnd_Alias KILL = /usr/bin/kill + Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm + Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown + Cmnd_Alias HALT = /usr/sbin/halt + Cmnd_Alias REBOOT = /usr/sbin/reboot + Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh,\ + /usr/local/bin/tcsh, /usr/bin/rsh,\ + /usr/local/bin/zsh + Cmnd_Alias SU = /usr/bin/su + Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less + + Here we override some of the compiled in default values. We want ssuuddoo to + log via syslog(3) using the _a_u_t_h facility in all cases. We don't want to + subject the full time staff to the ssuuddoo lecture, user mmiilllleerrtt need not + give a password, and we don't want to reset the LOGNAME or USER + environment variables when running commands as root. Additionally, on + the machines in the _S_E_R_V_E_R_S Host_Alias, we keep an additional local log + file and make sure we log the year in each log line since the log entries + will be kept around for several years. Lastly, we disable shell escapes + for the commands in the PAGERS Cmnd_Alias (_/_u_s_r_/_b_i_n_/_m_o_r_e, _/_u_s_r_/_b_i_n_/_p_g and + _/_u_s_r_/_b_i_n_/_l_e_s_s). Note that this will not effectively constrain users with + ssuuddoo AALLLL privileges. + + # Override built-in defaults + Defaults syslog=auth + Defaults>root !set_logname + Defaults:FULLTIMERS !lecture + Defaults:millert !authenticate + Defaults@SERVERS log_year, logfile=/var/log/sudo.log + Defaults!PAGERS noexec + + The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually determines who may run + what. + + root ALL = (ALL) ALL + %wheel ALL = (ALL) ALL + + We let rroooott and any user in group wwhheeeell run any command on any host as + any user. + + FULLTIMERS ALL = NOPASSWD: ALL + + Full time sysadmins (mmiilllleerrtt, mmiikkeeff, and ddoowwddyy) may run any command on + any host without authenticating themselves. + + PARTTIMERS ALL = ALL + + Part time sysadmins bboossttlleeyy, jjwwffooxx, and ccrraawwll) may run any command on any + host but they must authenticate themselves first (since the entry lacks + the NOPASSWD tag). + + jack CSNETS = ALL + + The user jjaacckk may run any command on the machines in the _C_S_N_E_T_S alias + (the networks 128.138.243.0, 128.138.204.0, and 128.138.242.0). Of those + networks, only 128.138.204.0 has an explicit netmask (in CIDR notation) + indicating it is a class C network. For the other networks in _C_S_N_E_T_S, + the local machine's netmask will be used during matching. + + lisa CUNETS = ALL + + The user lliissaa may run any command on any host in the _C_U_N_E_T_S alias (the + class B network 128.138.0.0). + + operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\ + sudoedit /etc/printcap, /usr/oper/bin/ + + The ooppeerraattoorr user may run commands limited to simple maintenance. Here, + those are commands related to backups, killing processes, the printing + system, shutting down the system, and any commands in the directory + _/_u_s_r_/_o_p_e_r_/_b_i_n_/. Note that one command in the DUMPS Cmnd_Alias includes a + sha224 digest, _/_h_o_m_e_/_o_p_e_r_a_t_o_r_/_b_i_n_/_s_t_a_r_t___b_a_c_k_u_p_s. This is because the + directory containing the script is writable by the operator user. If the + script is modified (resulting in a digest mismatch) it will no longer be + possible to run it via ssuuddoo. + + joe ALL = /usr/bin/su operator + + The user jjooee may only su(1) to operator. + + pete HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd *root* + + %opers ALL = (: ADMINGRP) /usr/sbin/ + + Users in the ooppeerrss group may run commands in _/_u_s_r_/_s_b_i_n_/ as themselves + with any group in the _A_D_M_I_N_G_R_P Runas_Alias (the aaddmm and ooppeerr groups). + + The user ppeettee is allowed to change anyone's password except for root on + the _H_P_P_A machines. Because command line arguments are matched as a + single, concatenated string, the `*' wildcard will match _m_u_l_t_i_p_l_e words. + This example assumes that passwd(1) does not take multiple user names on + the command line. Note that on GNU systems, options to passwd(1) may be + specified after the user argument. As a result, this rule will also + allow: + + passwd username --expire + + which may not be desirable. + + bob SPARC = (OP) ALL : SGI = (OP) ALL + + The user bboobb may run anything on the _S_P_A_R_C and _S_G_I machines as any user + listed in the _O_P Runas_Alias (rroooott and ooppeerraattoorr.) + + jim +biglab = ALL + + The user jjiimm may run any command on machines in the _b_i_g_l_a_b netgroup. + ssuuddoo knows that "biglab" is a netgroup due to the `+' prefix. + + +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser + + Users in the sseeccrreettaarriieess netgroup need to help manage the printers as + well as add and remove users, so they are allowed to run those commands + on all machines. + + fred ALL = (DB) NOPASSWD: ALL + + The user ffrreedd can run commands as any user in the _D_B Runas_Alias (oorraaccllee + or ssyybbaassee) without giving a password. + + john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root* + + On the _A_L_P_H_A machines, user jjoohhnn may su to anyone except root but he is + not allowed to specify any options to the su(1) command. + + jen ALL, !SERVERS = ALL + + The user jjeenn may run any command on any machine except for those in the + _S_E_R_V_E_R_S Host_Alias (master, mail, www and ns). + + jill SERVERS = /usr/bin/, !SU, !SHELLS + + For any machine in the _S_E_R_V_E_R_S Host_Alias, jjiillll may run any commands in + the directory _/_u_s_r_/_b_i_n_/ except for those commands belonging to the _S_U and + _S_H_E_L_L_S Cmnd_Aliases. While not specifically mentioned in the rule, the + commands in the _P_A_G_E_R_S Cmnd_Alias all reside in _/_u_s_r_/_b_i_n and have the + _n_o_e_x_e_c option set. + + steve CSNETS = (operator) /usr/local/op_commands/ + + The user sstteevvee may run any command in the directory + /usr/local/op_commands/ but only as user operator. + + matt valkyrie = KILL + + On his personal workstation, valkyrie, mmaatttt needs to be able to kill hung + processes. + + WEBMASTERS www = (www) ALL, (root) /usr/bin/su www + + On the host www, any user in the _W_E_B_M_A_S_T_E_R_S User_Alias (will, wendy, and + wim), may run any command as user www (which owns the web pages) or + simply su(1) to www. + + ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\ + /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM + + Any user may mount or unmount a CD-ROM on the machines in the CDROM + Host_Alias (orion, perseus, hercules) without entering a password. This + is a bit tedious for users to type, so it is a prime candidate for + encapsulating in a shell script. + +SSEECCUURRIITTYY NNOOTTEESS + LLiimmiittaattiioonnss ooff tthhee ``!!'' ooppeerraattoorr + It is generally not effective to "subtract" commands from AALLLL using the + `!' operator. A user can trivially circumvent this by copying the + desired command to a different name and then executing that. For + example: + + bill ALL = ALL, !SU, !SHELLS + + Doesn't really prevent bbiillll from running the commands listed in _S_U or + _S_H_E_L_L_S since he can simply copy those commands to a different name, or + use a shell escape from an editor or other program. Therefore, these + kind of restrictions should be considered advisory at best (and + reinforced by policy). + + In general, if a user has sudo AALLLL there is nothing to prevent them from + creating their own program that gives them a root shell (or making their + own copy of a shell) regardless of any `!' elements in the user + specification. + + SSeeccuurriittyy iimmpplliiccaattiioonnss ooff _f_a_s_t___g_l_o_b + If the _f_a_s_t___g_l_o_b option is in use, it is not possible to reliably negate + commands where the path name includes globbing (aka wildcard) characters. + This is because the C library's fnmatch(3) function cannot resolve + relative paths. While this is typically only an inconvenience for rules + that grant privileges, it can result in a security issue for rules that + subtract or revoke privileges. + + For example, given the following _s_u_d_o_e_r_s file entry: + + john ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,\ + /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root + + User jjoohhnn can still run /usr/bin/passwd root if _f_a_s_t___g_l_o_b is enabled by + changing to _/_u_s_r_/_b_i_n and running ./passwd root instead. + + PPrreevveennttiinngg sshheellll eessccaappeess + Once ssuuddoo executes a program, that program is free to do whatever it + pleases, including run other programs. This can be a security issue + since it is not uncommon for a program to allow shell escapes, which lets + a user bypass ssuuddoo's access control and logging. Common programs that + permit shell escapes include shells (obviously), editors, paginators, + mail and terminal programs. + + There are two basic approaches to this problem: + + restrict Avoid giving users access to commands that allow the user to + run arbitrary commands. Many editors have a restricted mode + where shell escapes are disabled, though ssuuddooeeddiitt is a better + solution to running editors via ssuuddoo. Due to the large number + of programs that offer shell escapes, restricting users to the + set of programs that do not is often unworkable. + + noexec Many systems that support shared libraries have the ability to + override default library functions by pointing an environment + variable (usually LD_PRELOAD) to an alternate shared library. + On such systems, ssuuddoo's _n_o_e_x_e_c functionality can be used to + prevent a program run by ssuuddoo from executing any other + programs. Note, however, that this applies only to native + dynamically-linked executables. Statically-linked executables + and foreign executables running under binary emulation are not + affected. + + The _n_o_e_x_e_c feature is known to work on SunOS, Solaris, *BSD, + Linux, IRIX, Tru64 UNIX, macOS, HP-UX 11.x and AIX 5.3 and + above. It should be supported on most operating systems that + support the LD_PRELOAD environment variable. Check your + operating system's manual pages for the dynamic linker (usually + ld.so, ld.so.1, dyld, dld.sl, rld, or loader) to see if + LD_PRELOAD is supported. + + On Solaris 10 and higher, _n_o_e_x_e_c uses Solaris privileges + instead of the LD_PRELOAD environment variable. + + To enable _n_o_e_x_e_c for a command, use the NOEXEC tag as + documented in the User Specification section above. Here is + that example again: + + aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi + + This allows user aaaarroonn to run _/_u_s_r_/_b_i_n_/_m_o_r_e and _/_u_s_r_/_b_i_n_/_v_i + with _n_o_e_x_e_c enabled. This will prevent those two commands from + executing other commands (such as a shell). If you are unsure + whether or not your system is capable of supporting _n_o_e_x_e_c you + can always just try it out and check whether shell escapes work + when _n_o_e_x_e_c is enabled. + + Note that restricting shell escapes is not a panacea. Programs running + as root are still capable of many potentially hazardous operations (such + as changing or overwriting files) that could lead to unintended privilege + escalation. In the specific case of an editor, a safer approach is to + give the user permission to run ssuuddooeeddiitt (see below). + + SSeeccuurree eeddiittiinngg + The ssuuddooeerrss plugin includes ssuuddooeeddiitt support which allows users to + securely edit files with the editor of their choice. As ssuuddooeeddiitt is a + built-in command, it must be specified in the _s_u_d_o_e_r_s file without a + leading path. However, it may take command line arguments just as a + normal command does. Wildcards used in _s_u_d_o_e_d_i_t command line arguments + are expected to be path names, so a forward slash (`/') will not be + matched by a wildcard. + + Unlike other ssuuddoo commands, the editor is run with the permissions of the + invoking user and with the environment unmodified. More information may + be found in the description of the --ee option in sudo(1m). + + For example, to allow user operator to edit the "message of the day" + file: + + operator sudoedit /etc/motd + + The operator user then runs ssuuddooeeddiitt as follows: + + $ sudoedit /etc/motd + + The editor will run as the operator user, not root, on a temporary copy + of _/_e_t_c_/_m_o_t_d. After the file has been edited, _/_e_t_c_/_m_o_t_d will be updated + with the contents of the temporary copy. + + Users should _n_e_v_e_r be granted ssuuddooeeddiitt permission to edit a file that + resides in a directory the user has write access to, either directly or + via a wildcard. If the user has write access to the directory it is + possible to replace the legitimate file with a link to another file, + allowing the editing of arbitrary files. To prevent this, starting with + version 1.8.16, symbolic links will not be followed in writable + directories and ssuuddooeeddiitt will refuse to edit a file located in a writable + directory unless the _s_u_d_o_e_d_i_t___c_h_e_c_k_d_i_r option has been disabled or the + invoking user is root. Additionally, in version 1.8.15 and higher, + ssuuddooeeddiitt will refuse to open a symbolic link unless either the + _s_u_d_o_e_d_i_t___f_o_l_l_o_w option is enabled or the _s_u_d_o_e_d_i_t command is prefixed + with the FOLLOW tag in the _s_u_d_o_e_r_s file. + + TTiimmee ssttaammpp ffiillee cchheecckkss + ssuuddooeerrss will check the ownership of its time stamp directory + (_/_v_a_r_/_r_u_n_/_s_u_d_o_/_t_s by default) and ignore the directory's contents if it + is not owned by root or if it is writable by a user other than root. + Older versions of ssuuddoo stored time stamp files in _/_t_m_p; this is no longer + recommended as it may be possible for a user to create the time stamp + themselves on systems that allow unprivileged users to change the + ownership of files they create. + + While the time stamp directory _s_h_o_u_l_d be cleared at reboot time, not all + systems contain a _/_r_u_n or _/_v_a_r_/_r_u_n directory. To avoid potential + problems, ssuuddooeerrss will ignore time stamp files that date from before the + machine booted on systems where the boot time is available. + + Some systems with graphical desktop environments allow unprivileged users + to change the system clock. Since ssuuddooeerrss relies on the system clock for + time stamp validation, it may be possible on such systems for a user to + run ssuuddoo for longer than _t_i_m_e_s_t_a_m_p___t_i_m_e_o_u_t by setting the clock back. To + combat this, ssuuddooeerrss uses a monotonic clock (which never moves backwards) + for its time stamps if the system supports it. + + ssuuddooeerrss will not honor time stamps set far in the future. Time stamps + with a date greater than current_time + 2 * TIMEOUT will be ignored and + ssuuddooeerrss will log and complain. + + If the _t_i_m_e_s_t_a_m_p___t_y_p_e option is set to "tty", the time stamp record + includes the device number of the terminal the user authenticated with. + This provides per-terminal granularity but time stamp records may still + outlive the user's session. + + Unless the _t_i_m_e_s_t_a_m_p___t_y_p_e option is set to "global", the time stamp + record also includes the session ID of the process that last + authenticated. This prevents processes in different terminal sessions + from using the same time stamp record. On systems where a process's + start time can be queried, the start time of the session leader is + recorded in the time stamp record. If no terminal is present or the + _t_i_m_e_s_t_a_m_p___t_y_p_e option is set to "ppid", the start time of the parent + process is used instead. In most cases this will prevent a time stamp + record from being re-used without the user entering a password when + logging out and back in again. + +DDEEBBUUGGGGIINNGG + Versions 1.8.4 and higher of the ssuuddooeerrss plugin support a flexible + debugging framework that can help track down what the plugin is doing + internally if there is a problem. This can be configured in the + sudo.conf(4) file. + + The ssuuddooeerrss plugin uses the same debug flag format as the ssuuddoo front-end: + _s_u_b_s_y_s_t_e_m@_p_r_i_o_r_i_t_y. + + The priorities used by ssuuddooeerrss, in order of decreasing severity, are: + _c_r_i_t, _e_r_r, _w_a_r_n, _n_o_t_i_c_e, _d_i_a_g, _i_n_f_o, _t_r_a_c_e and _d_e_b_u_g. Each priority, + when specified, also includes all priorities higher than it. For + example, a priority of _n_o_t_i_c_e would include debug messages logged at + _n_o_t_i_c_e and higher. + + The following subsystems are used by the ssuuddooeerrss plugin: + + _a_l_i_a_s User_Alias, Runas_Alias, Host_Alias and Cmnd_Alias processing + + _a_l_l matches every subsystem + + _a_u_d_i_t BSM and Linux audit code + + _a_u_t_h user authentication + + _d_e_f_a_u_l_t_s _s_u_d_o_e_r_s file _D_e_f_a_u_l_t_s settings + + _e_n_v environment handling + + _l_d_a_p LDAP-based sudoers + + _l_o_g_g_i_n_g logging support + + _m_a_t_c_h matching of users, groups, hosts and netgroups in the _s_u_d_o_e_r_s + file + + _n_e_t_i_f network interface handling + + _n_s_s network service switch handling in ssuuddooeerrss + + _p_a_r_s_e_r _s_u_d_o_e_r_s file parsing + + _p_e_r_m_s permission setting + + _p_l_u_g_i_n The equivalent of _m_a_i_n for the plugin. + + _p_t_y pseudo-tty related code + + _r_b_t_r_e_e redblack tree internals + + _s_s_s_d SSSD-based sudoers + + _u_t_i_l utility functions + For example: + + Debug sudo /var/log/sudo_debug match@info,nss@info + + For more information, see the sudo.conf(4) manual. + +SSEEEE AALLSSOO + ssh(1), su(1), fnmatch(3), glob(3), mktemp(3), strftime(3), sudo.conf(4), + sudo_plugin(4), sudoers.ldap(4), sudoers_timestamp(4), sudo(1m), visudo(1m) + +AAUUTTHHOORRSS + Many people have worked on ssuuddoo over the years; this version consists of + code written primarily by: + + Todd C. Miller + + See the CONTRIBUTORS file in the ssuuddoo distribution + (https://www.sudo.ws/contributors.html) for an exhaustive list of people + who have contributed to ssuuddoo. + +CCAAVVEEAATTSS + The _s_u_d_o_e_r_s file should aallwwaayyss be edited by the vviissuuddoo command which + locks the file and does grammatical checking. It is imperative that the + _s_u_d_o_e_r_s file be free of syntax errors since ssuuddoo will not run with a + syntactically incorrect _s_u_d_o_e_r_s file. + + When using netgroups of machines (as opposed to users), if you store + fully qualified host name in the netgroup (as is usually the case), you + either need to have the machine's host name be fully qualified as + returned by the hostname command or use the _f_q_d_n option in _s_u_d_o_e_r_s. + +BBUUGGSS + If you feel you have found a bug in ssuuddoo, please submit a bug report at + https://bugzilla.sudo.ws/ + +SSUUPPPPOORRTT + Limited free support is available via the sudo-users mailing list, see + https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search + the archives. + +DDIISSCCLLAAIIMMEERR + ssuuddoo is provided "AS IS" and any express or implied warranties, + including, but not limited to, the implied warranties of merchantability + and fitness for a particular purpose are disclaimed. See the LICENSE + file distributed with ssuuddoo or https://www.sudo.ws/license.html for + complete details. + +Sudo 1.8.26 December 20, 2018 Sudo 1.8.26 |