Adding upstream version 1.9.15p5.upstream/1.9.15p5upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 502 insertions, 0 deletions

diff --git a/plugins/sudoers/def_data.in b/plugins/sudoers/def_data.in
new file mode 100644
index 0000000..4d627e6
--- /dev/null
+++ b/plugins/sudoers/def_data.in
@@ -0,0 +1,502 @@
+#
+# Format:
+#
+# var_name
+#	TYPE
+#	description (or NULL)
+#	array of struct def_values if TYPE == T_TUPLE
+#
+# NOTE: for tuples that can be used in a boolean context the first
+#	value corresponds to boolean FALSE and the second to TRUE.
+#
+
+syslog
+	T_LOGFAC|T_BOOL
+	"Syslog facility if syslog is being used for logging: %s"
+syslog_goodpri
+	T_LOGPRI|T_BOOL
+	"Syslog priority to use when user authenticates successfully: %s"
+syslog_badpri
+	T_LOGPRI|T_BOOL
+	"Syslog priority to use when user authenticates unsuccessfully: %s"
+long_otp_prompt
+	T_FLAG
+	"Put OTP prompt on its own line"
+ignore_dot
+	T_FLAG
+	"Ignore '.' in $PATH"
+mail_always
+	T_FLAG
+	"Always send mail when sudo is run"
+mail_badpass
+	T_FLAG
+	"Send mail if user authentication fails"
+mail_no_user
+	T_FLAG
+	"Send mail if the user is not in sudoers"
+mail_no_host
+	T_FLAG
+	"Send mail if the user is not in sudoers for this host"
+mail_no_perms
+	T_FLAG
+	"Send mail if the user is not allowed to run a command"
+mail_all_cmnds
+	T_FLAG
+	"Send mail if the user tries to run a command"
+tty_tickets
+	T_FLAG
+	"Use a separate timestamp for each user/tty combo"
+lecture
+	T_TUPLE|T_BOOL
+	"Lecture user the first time they run sudo"
+	never once always
+lecture_file
+	T_STR|T_PATH|T_BOOL
+	"File containing the sudo lecture: %s"
+authenticate
+	T_FLAG
+	"Require users to authenticate by default"
+root_sudo
+	T_FLAG
+	"Root may run sudo"
+log_host
+	T_FLAG
+	"Log the hostname in the (non-syslog) log file"
+log_year
+	T_FLAG
+	"Log the year in the (non-syslog) log file"
+shell_noargs
+	T_FLAG
+	"If sudo is invoked with no arguments, start a shell"
+set_home
+	T_FLAG
+	"Set $HOME to the target user when starting a shell with -s"
+always_set_home
+	T_FLAG
+	"Always set $HOME to the target user's home directory"
+path_info
+	T_FLAG
+	"Allow some information gathering to give useful error messages"
+fqdn
+	T_FLAG
+	"Require fully-qualified hostnames in the sudoers file"
+insults
+	T_FLAG
+	"Insult the user when they enter an incorrect password"
+requiretty
+	T_FLAG
+	"Only allow the user to run sudo if they have a tty"
+env_editor
+	T_FLAG
+	"Visudo will honor the EDITOR environment variable"
+rootpw
+	T_FLAG
+	"Prompt for root's password, not the users's"
+runaspw
+	T_FLAG
+	"Prompt for the runas_default user's password, not the users's"
+targetpw
+	T_FLAG
+	"Prompt for the target user's password, not the users's"
+use_loginclass
+	T_FLAG
+	"Apply defaults in the target user's login class if there is one"
+set_logname
+	T_FLAG
+	"Set the LOGNAME and USER environment variables"
+stay_setuid
+	T_FLAG
+	"Only set the effective uid to the target user, not the real uid"
+preserve_groups
+	T_FLAG
+	"Don't initialize the group vector to that of the target user"
+loglinelen
+	T_UINT|T_BOOL
+	"Length at which to wrap log file lines (0 for no wrap): %u"
+timestamp_timeout
+	T_TIMESPEC|T_BOOL
+	"Authentication timestamp timeout: %.1f minutes"
+passwd_timeout
+	T_TIMESPEC|T_BOOL
+	"Password prompt timeout: %.1f minutes"
+passwd_tries
+	T_UINT
+	"Number of tries to enter a password: %u"
+umask
+	T_MODE|T_BOOL
+	"Umask to use or 0777 to use user's: 0%o"
+logfile
+	T_STR|T_BOOL|T_PATH
+	"Path to log file: %s"
+mailerpath
+	T_STR|T_BOOL|T_PATH
+	"Path to mail program: %s"
+mailerflags
+	T_STR|T_BOOL
+	"Flags for mail program: %s"
+mailto
+	T_STR|T_BOOL
+	"Address to send mail to: %s"
+mailfrom
+	T_STR|T_BOOL
+	"Address to send mail from: %s"
+mailsub
+	T_STR
+	"Subject line for mail messages: %s"
+badpass_message
+	T_STR
+	"Incorrect password message: %s"
+lecture_status_dir
+	T_STR|T_PATH
+	"Path to lecture status dir: %s"
+timestampdir
+	T_STR|T_PATH
+	"Path to authentication timestamp dir: %s"
+timestampowner
+	T_STR
+	"Owner of the authentication timestamp dir: %s"
+exempt_group
+	T_STR|T_BOOL
+	"Users in this group are exempt from password and PATH requirements: %s"
+passprompt
+	T_STR
+	"Default password prompt: %s"
+passprompt_override
+	T_FLAG
+	"If set, passprompt will override system prompt in all cases."
+runas_default
+	T_STR
+	"Default user to run commands as: %s"
+secure_path
+	T_STR|T_BOOL
+	"Value to override user's $PATH with: %s"
+editor
+	T_STR|T_PATH
+	"Path to the editor for use by visudo: %s"
+listpw
+	T_TUPLE|T_BOOL
+	"When to require a password for 'list' pseudocommand: %s"
+	never any all always
+verifypw
+	T_TUPLE|T_BOOL
+	"When to require a password for 'verify' pseudocommand: %s"
+	never all any always
+noexec
+	T_FLAG
+	"Preload the sudo_noexec library which replaces the exec functions"
+ignore_local_sudoers
+	T_FLAG
+	"If LDAP directory is up, do we ignore local sudoers file"
+closefrom
+	T_INT
+	"File descriptors >= %d will be closed before executing a command"
+closefrom_override
+	T_FLAG
+	"If set, users may override the value of "closefrom" with the -C option"
+setenv
+	T_FLAG
+	"Allow users to set arbitrary environment variables"
+env_reset
+	T_FLAG
+	"Reset the environment to a default set of variables"
+env_check
+	T_LIST|T_BOOL
+	"Environment variables to check for safety:"
+env_delete
+	T_LIST|T_BOOL
+	"Environment variables to remove:"
+env_keep
+	T_LIST|T_BOOL
+	"Environment variables to preserve:"
+role
+	T_STR
+	"SELinux role to use in the new security context: %s"
+type
+	T_STR
+	"SELinux type to use in the new security context: %s"
+env_file
+	T_STR|T_PATH|T_BOOL
+	"Path to the sudo-specific environment file: %s"
+restricted_env_file
+	T_STR|T_PATH|T_BOOL
+	"Path to the restricted sudo-specific environment file: %s"
+sudoers_locale
+	T_STR
+	"Locale to use while parsing sudoers: %s"
+visiblepw
+	T_FLAG
+	"Allow sudo to prompt for a password even if it would be visible"
+pwfeedback
+	T_FLAG
+	"Provide visual feedback at the password prompt when there is user input"
+fast_glob
+	T_FLAG
+	"Use faster globbing that is less accurate but does not access the filesystem"
+umask_override
+	T_FLAG
+	"The umask specified in sudoers will override the user's, even if it is more permissive"
+log_input
+	T_FLAG
+	"Log user's input for the command being run"
+log_stdin
+	T_FLAG
+	"Log the command's standard input if not connected to a terminal"
+log_ttyin
+	T_FLAG
+	"Log the user's terminal input for the command being run"
+log_output
+	T_FLAG
+	"Log the output of the command being run"
+log_stdout
+	T_FLAG
+	"Log the command's standard output if not connected to a terminal"
+log_stderr
+	T_FLAG
+	"Log the command's standard error if not connected to a terminal"
+log_ttyout
+	T_FLAG
+	"Log the terminal output of the command being run"
+compress_io
+	T_FLAG
+	"Compress I/O logs using zlib"
+use_pty
+	T_FLAG
+	"Always run commands in a pseudo-tty"
+group_plugin
+	T_STR
+	"Plugin for non-Unix group support: %s"
+iolog_dir
+	T_STR|T_PATH
+	"Directory in which to store input/output logs: %s"
+iolog_file
+	T_STR
+	"File in which to store the input/output log: %s"
+set_utmp
+	T_FLAG
+	"Add an entry to the utmp/utmpx file when allocating a pty"
+utmp_runas
+	T_FLAG
+	"Set the user in utmp to the runas user, not the invoking user"
+privs
+	T_STR
+	"Set of permitted privileges: %s"
+limitprivs
+	T_STR
+	"Set of limit privileges: %s"
+exec_background
+	T_FLAG
+	"Run commands on a pty in the background"
+pam_service
+	T_STR
+	"PAM service name to use: %s"
+pam_login_service
+	T_STR
+	"PAM service name to use for login shells: %s"
+pam_askpass_service
+	T_STR
+	"PAM service name to use when sudo is run with the -A option: %s"
+pam_setcred
+	T_FLAG
+	"Attempt to establish PAM credentials for the target user"
+pam_session
+	T_FLAG
+	"Create a new PAM session for the command to run in"
+pam_acct_mgmt
+	T_FLAG
+	"Perform PAM account validation management"
+maxseq
+	T_STR
+	"Maximum I/O log sequence number: %s"
+use_netgroups
+	T_FLAG
+	"Enable sudoers netgroup support"
+sudoedit_checkdir
+	T_FLAG
+	"Check parent directories for writability when editing files with sudoedit"
+sudoedit_follow
+	T_FLAG
+	"Follow symbolic links when editing files with sudoedit"
+always_query_group_plugin
+	T_FLAG
+	"Query the group plugin for unknown system groups"
+netgroup_tuple
+	T_FLAG
+	"Match netgroups based on the entire tuple: user, host and domain"
+ignore_audit_errors
+	T_FLAG
+	"Allow commands to be run even if sudo cannot write to the audit log"
+ignore_iolog_errors
+	T_FLAG
+	"Allow commands to be run even if sudo cannot write to the I/O log"
+ignore_logfile_errors
+	T_FLAG
+	"Allow commands to be run even if sudo cannot write to the log file"
+match_group_by_gid
+	T_FLAG
+	"Resolve groups in sudoers and match on the group ID, not the name"
+syslog_maxlen
+	T_UINT
+	"Log entries larger than this value will be split into multiple syslog messages: %u"
+iolog_user
+	T_STR|T_BOOL
+	"User that will own the I/O log files: %s"
+iolog_group
+	T_STR|T_BOOL
+	"Group that will own the I/O log files: %s"
+iolog_mode
+	T_MODE
+	"File mode to use for the I/O log files: 0%o"
+fdexec
+	T_TUPLE|T_BOOL
+	"Execute commands by file descriptor instead of by path: %s"
+	never digest_only always
+ignore_unknown_defaults
+	T_FLAG
+	"Ignore unknown Defaults entries in sudoers instead of producing a warning"
+command_timeout
+	T_TIMEOUT|T_BOOL
+	"Time in seconds after which the command will be terminated: %u"
+user_command_timeouts
+	T_FLAG
+	"Allow the user to specify a timeout on the command line"
+iolog_flush
+	T_FLAG
+	"Flush I/O log data to disk immediately instead of buffering it"
+syslog_pid
+	T_FLAG
+	"Include the process ID when logging via syslog"
+timestamp_type
+	T_TUPLE
+	"Type of authentication timestamp record: %s"
+	global ppid tty kernel
+authfail_message
+	T_STR
+	"Authentication failure message: %s"
+case_insensitive_user
+	T_FLAG
+	"Ignore case when matching user names"
+case_insensitive_group
+	T_FLAG
+	"Ignore case when matching group names"
+log_allowed
+	T_FLAG
+	"Log when a command is allowed by sudoers"
+log_denied
+	T_FLAG
+	"Log when a command is denied by sudoers"
+log_servers
+	T_LIST|T_BOOL
+	"Sudo log server(s) to connect to with optional port"
+log_server_timeout
+	T_TIMEOUT|T_BOOL
+	"Sudo log server timeout in seconds: %u"
+log_server_keepalive
+	T_FLAG
+	"Enable SO_KEEPALIVE socket option on the socket connected to the logserver"
+log_server_cabundle
+	T_STR|T_BOOL|T_PATH
+	"Path to the audit server's CA bundle file: %s"
+log_server_peer_cert
+	T_STR|T_BOOL|T_PATH
+	"Path to the sudoers certificate file: %s"
+log_server_peer_key
+	T_STR|T_BOOL|T_PATH
+	"Path to the sudoers private key file: %s"
+log_server_verify
+	T_FLAG
+	"Verify that the log server's certificate is valid"
+runas_allow_unknown_id
+	T_FLAG
+	"Allow the use of unknown runas user and/or group ID"
+runas_check_shell
+	T_FLAG
+	"Only permit running commands as a user with a valid shell"
+pam_ruser
+	T_FLAG
+	"Set the pam remote user to the user running sudo"
+pam_rhost
+	T_FLAG
+	"Set the pam remote host to the local host name"
+runcwd
+	T_STR|T_BOOL|T_CHPATH
+	"Working directory to change to before executing the command: %s"
+runchroot
+	T_STR|T_BOOL|T_CHPATH
+	"Root directory to change to before executing the command: %s"
+log_format
+	T_TUPLE
+	"The format of logs to produce: %s"
+	sudo json
+selinux
+	T_FLAG
+	"Enable SELinux RBAC support"
+admin_flag
+	T_STR|T_BOOL|T_CHPATH
+	"Path to the file that is created the first time sudo is run: %s"
+intercept
+	T_FLAG
+	"Intercept further commands and apply sudoers restrictions to them"
+log_subcmds
+	T_FLAG
+	"Log sub-commands run by the original command"
+log_exit_status
+	T_FLAG
+	"Log the exit status of commands"
+intercept_authenticate
+	T_FLAG
+	"Subsequent commands in an intercepted session must be authenticated"
+intercept_allow_setid
+	T_FLAG
+	"Allow an intercepted command to run set setuid or setgid programs"
+rlimit_as
+	T_RLIMIT|T_BOOL
+	"The maximum size to which the process's address space may grow (in bytes): %s"
+rlimit_core
+	T_RLIMIT|T_BOOL
+	"The largest size core dump file that may be created (in bytes): %s"
+rlimit_cpu
+	T_RLIMIT|T_BOOL
+	"The maximum amount of CPU time that the process may use (in seconds): %s"
+rlimit_data
+	T_RLIMIT|T_BOOL
+	"The maximum size of the data segment for the process (in bytes): %s"
+rlimit_fsize
+	T_RLIMIT|T_BOOL
+	"The largest size file that the process may create (in bytes): %s"
+rlimit_locks
+	T_RLIMIT|T_BOOL
+	"The maximum number of locks that the process may establish: %s"
+rlimit_memlock
+	T_RLIMIT|T_BOOL
+	"The maximum size that the process may lock in memory (in bytes): %s"
+rlimit_nofile
+	T_RLIMIT|T_BOOL
+	"The maximum number of files that the process may have open: %s"
+rlimit_nproc
+	T_RLIMIT|T_BOOL
+	"The maximum number of processes that the user may run simultaneously: %s"
+rlimit_rss
+	T_RLIMIT|T_BOOL
+	"The maximum size to which the process's resident set size may grow (in bytes): %s"
+rlimit_stack
+	T_RLIMIT|T_BOOL
+	"The maximum size to which the process's stack may grow (in bytes): %s"
+noninteractive_auth
+	T_FLAG
+	"Attempt authentication even when in non-interactive mode"
+log_passwords
+	T_FLAG
+	"Store plaintext passwords in I/O log input"
+passprompt_regex
+	T_LIST|T_SPACE|T_BOOL
+	"List of regular expressions to use when matching a password prompt"
+intercept_type
+	T_TUPLE
+	"The mechanism used by the intercept and log_subcmds options: %s"
+	dso trace
+intercept_verify
+	T_FLAG
+	"Attempt to verify the command and arguments after execution"
+apparmor_profile
+	T_STR
+	"AppArmor profile to use in the new security context: %s"