summaryrefslogtreecommitdiffstats
path: root/plugins/sudoers/def_data.in
blob: 99d4360082e122487c6f43290f516c2e87130a2d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
#
# Format:
#
# var_name
#	TYPE
#	description (or NULL)
#	array of struct def_values if TYPE == T_TUPLE
#
# NOTE: for tuples that can be used in a boolean context the first
#	value corresponds to boolean FALSE and the second to TRUE.
#

syslog
	T_LOGFAC|T_BOOL
	"Syslog facility if syslog is being used for logging: %s"
syslog_goodpri
	T_LOGPRI|T_BOOL
	"Syslog priority to use when user authenticates successfully: %s"
syslog_badpri
	T_LOGPRI|T_BOOL
	"Syslog priority to use when user authenticates unsuccessfully: %s"
long_otp_prompt
	T_FLAG
	"Put OTP prompt on its own line"
ignore_dot
	T_FLAG
	"Ignore '.' in $PATH"
mail_always
	T_FLAG
	"Always send mail when sudo is run"
mail_badpass
	T_FLAG
	"Send mail if user authentication fails"
mail_no_user
	T_FLAG
	"Send mail if the user is not in sudoers"
mail_no_host
	T_FLAG
	"Send mail if the user is not in sudoers for this host"
mail_no_perms
	T_FLAG
	"Send mail if the user is not allowed to run a command"
mail_all_cmnds
	T_FLAG
	"Send mail if the user tries to run a command"
tty_tickets
	T_FLAG
	"Use a separate timestamp for each user/tty combo"
lecture
	T_TUPLE|T_BOOL
	"Lecture user the first time they run sudo"
	never once always
lecture_file
	T_STR|T_PATH|T_BOOL
	"File containing the sudo lecture: %s"
authenticate
	T_FLAG
	"Require users to authenticate by default"
root_sudo
	T_FLAG
	"Root may run sudo"
log_host
	T_FLAG
	"Log the hostname in the (non-syslog) log file"
log_year
	T_FLAG
	"Log the year in the (non-syslog) log file"
shell_noargs
	T_FLAG
	"If sudo is invoked with no arguments, start a shell"
set_home
	T_FLAG
	"Set $HOME to the target user when starting a shell with -s"
always_set_home
	T_FLAG
	"Always set $HOME to the target user's home directory"
path_info
	T_FLAG
	"Allow some information gathering to give useful error messages"
fqdn
	T_FLAG
	"Require fully-qualified hostnames in the sudoers file"
insults
	T_FLAG
	"Insult the user when they enter an incorrect password"
requiretty
	T_FLAG
	"Only allow the user to run sudo if they have a tty"
env_editor
	T_FLAG
	"Visudo will honor the EDITOR environment variable"
rootpw
	T_FLAG
	"Prompt for root's password, not the users's"
runaspw
	T_FLAG
	"Prompt for the runas_default user's password, not the users's"
targetpw
	T_FLAG
	"Prompt for the target user's password, not the users's"
use_loginclass
	T_FLAG
	"Apply defaults in the target user's login class if there is one"
set_logname
	T_FLAG
	"Set the LOGNAME and USER environment variables"
stay_setuid
	T_FLAG
	"Only set the effective uid to the target user, not the real uid"
preserve_groups
	T_FLAG
	"Don't initialize the group vector to that of the target user"
loglinelen
	T_UINT|T_BOOL
	"Length at which to wrap log file lines (0 for no wrap): %u"
timestamp_timeout
	T_TIMESPEC|T_BOOL
	"Authentication timestamp timeout: %.1f minutes"
passwd_timeout
	T_TIMESPEC|T_BOOL
	"Password prompt timeout: %.1f minutes"
passwd_tries
	T_UINT
	"Number of tries to enter a password: %u"
umask
	T_MODE|T_BOOL
	"Umask to use or 0777 to use user's: 0%o"
logfile
	T_STR|T_BOOL|T_PATH
	"Path to log file: %s"
mailerpath
	T_STR|T_BOOL|T_PATH
	"Path to mail program: %s"
mailerflags
	T_STR|T_BOOL
	"Flags for mail program: %s"
mailto
	T_STR|T_BOOL
	"Address to send mail to: %s"
mailfrom
	T_STR|T_BOOL
	"Address to send mail from: %s"
mailsub
	T_STR
	"Subject line for mail messages: %s"
badpass_message
	T_STR
	"Incorrect password message: %s"
lecture_status_dir
	T_STR|T_PATH
	"Path to lecture status dir: %s"
timestampdir
	T_STR|T_PATH
	"Path to authentication timestamp dir: %s"
timestampowner
	T_STR
	"Owner of the authentication timestamp dir: %s"
exempt_group
	T_STR|T_BOOL
	"Users in this group are exempt from password and PATH requirements: %s"
passprompt
	T_STR
	"Default password prompt: %s"
passprompt_override
	T_FLAG
	"If set, passprompt will override system prompt in all cases."
runas_default
	T_STR
	"Default user to run commands as: %s"
secure_path
	T_STR|T_BOOL
	"Value to override user's $PATH with: %s"
editor
	T_STR|T_PATH
	"Path to the editor for use by visudo: %s"
listpw
	T_TUPLE|T_BOOL
	"When to require a password for 'list' pseudocommand: %s"
	never any all always
verifypw
	T_TUPLE|T_BOOL
	"When to require a password for 'verify' pseudocommand: %s"
	never all any always
noexec
	T_FLAG
	"Preload the dummy exec functions contained in the sudo_noexec library"
ignore_local_sudoers
	T_FLAG
	"If LDAP directory is up, do we ignore local sudoers file"
closefrom
	T_INT
	"File descriptors >= %d will be closed before executing a command"
closefrom_override
	T_FLAG
	"If set, users may override the value of `closefrom' with the -C option"
setenv
	T_FLAG
	"Allow users to set arbitrary environment variables"
env_reset
	T_FLAG
	"Reset the environment to a default set of variables"
env_check
	T_LIST|T_BOOL
	"Environment variables to check for sanity:"
env_delete
	T_LIST|T_BOOL
	"Environment variables to remove:"
env_keep
	T_LIST|T_BOOL
	"Environment variables to preserve:"
role
	T_STR
	"SELinux role to use in the new security context: %s"
type
	T_STR
	"SELinux type to use in the new security context: %s"
env_file
	T_STR|T_PATH|T_BOOL
	"Path to the sudo-specific environment file: %s"
restricted_env_file
	T_STR|T_PATH|T_BOOL
	"Path to the restricted sudo-specific environment file: %s"
sudoers_locale
	T_STR
	"Locale to use while parsing sudoers: %s"
visiblepw
	T_FLAG
	"Allow sudo to prompt for a password even if it would be visible"
pwfeedback
	T_FLAG
	"Provide visual feedback at the password prompt when there is user input"
fast_glob
	T_FLAG
	"Use faster globbing that is less accurate but does not access the filesystem"
umask_override
	T_FLAG
	"The umask specified in sudoers will override the user's, even if it is more permissive"
log_input
	T_FLAG
	"Log user's input for the command being run"
log_output
	T_FLAG
	"Log the output of the command being run"
compress_io
	T_FLAG
	"Compress I/O logs using zlib"
use_pty
	T_FLAG
	"Always run commands in a pseudo-tty"
group_plugin
	T_STR
	"Plugin for non-Unix group support: %s"
iolog_dir
	T_STR|T_PATH
	"Directory in which to store input/output logs: %s"
iolog_file
	T_STR
	"File in which to store the input/output log: %s"
set_utmp
	T_FLAG
	"Add an entry to the utmp/utmpx file when allocating a pty"
utmp_runas
	T_FLAG
	"Set the user in utmp to the runas user, not the invoking user"
privs
	T_STR
	"Set of permitted privileges: %s"
limitprivs
	T_STR
	"Set of limit privileges: %s"
exec_background
	T_FLAG
	"Run commands on a pty in the background"
pam_service
	T_STR
	"PAM service name to use: %s"
pam_login_service
	T_STR
	"PAM service name to use for login shells: %s"
pam_setcred
	T_FLAG
	"Attempt to establish PAM credentials for the target user"
pam_session
	T_FLAG
	"Create a new PAM session for the command to run in"
maxseq
	T_UINT
	"Maximum I/O log sequence number: %u"
use_netgroups
	T_FLAG
	"Enable sudoers netgroup support"
sudoedit_checkdir
	T_FLAG
	"Check parent directories for writability when editing files with sudoedit"
sudoedit_follow
	T_FLAG
	"Follow symbolic links when editing files with sudoedit"
always_query_group_plugin
	T_FLAG
	"Query the group plugin for unknown system groups"
netgroup_tuple
	T_FLAG
	"Match netgroups based on the entire tuple: user, host and domain"
ignore_audit_errors
	T_FLAG
	"Allow commands to be run even if sudo cannot write to the audit log"
ignore_iolog_errors
	T_FLAG
	"Allow commands to be run even if sudo cannot write to the I/O log"
ignore_logfile_errors
	T_FLAG
	"Allow commands to be run even if sudo cannot write to the log file"
match_group_by_gid
	T_FLAG
	"Resolve groups in sudoers and match on the group ID, not the name"
syslog_maxlen
	T_UINT
	"Log entries larger than this value will be split into multiple syslog messages: %u"
iolog_user
	T_STR|T_BOOL
	"User that will own the I/O log files: %s"
iolog_group
	T_STR|T_BOOL
	"Group that will own the I/O log files: %s"
iolog_mode
	T_MODE
	"File mode to use for the I/O log files: 0%o"
fdexec
	T_TUPLE|T_BOOL
	"Execute commands by file descriptor instead of by path: %s"
	never digest_only always
ignore_unknown_defaults
	T_FLAG
	"Ignore unknown Defaults entries in sudoers instead of producing a warning"
command_timeout
	T_TIMEOUT|T_BOOL
	"Time in seconds after which the command will be terminated: %u"
user_command_timeouts
	T_FLAG
	"Allow the user to specify a timeout on the command line"
iolog_flush
	T_FLAG
	"Flush I/O log data to disk immediately instead of buffering it"
syslog_pid
	T_FLAG
	"Include the process ID when logging via syslog"
timestamp_type
	T_TUPLE
	"Type of authentication timestamp record: %s"
	global ppid tty kernel
authfail_message
	T_STR
	"Authentication failure message: %s"
case_insensitive_user
	T_FLAG
	"Ignore case when matching user names"
case_insensitive_group
	T_FLAG
	"Ignore case when matching group names"