Annotation of src/usr.bin/sudo/sudoers.mdoc.in, Revision 1.5
1.1 millert 1: .\"
2: .\" Copyright (c) 1994-1996, 1998-2005, 2007-2012
3: .\" Todd C. Miller <Todd.Miller@courtesan.com>
4: .\"
5: .\" Permission to use, copy, modify, and distribute this software for any
6: .\" purpose with or without fee is hereby granted, provided that the above
7: .\" copyright notice and this permission notice appear in all copies.
8: .\"
9: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
17: .\"
18: .\" Sponsored in part by the Defense Advanced Research Projects
19: .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
20: .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
21: .\"
1.5 ! millert 22: .Dd $Mdocdate: February 15 2014 $
1.1 millert 23: .Dt SUDOERS @mansectform@
24: .Os
25: .Sh NAME
26: .Nm sudoers
27: .Nd list of which users may execute what
28: .Sh DESCRIPTION
29: The
30: .Em sudoers
31: file is composed of two types of entries: aliases
32: (basically variables) and user specifications (which specify who
33: may run what).
34: .Pp
35: When multiple entries match for a user, they are applied in order.
36: Where there are multiple matches, the last match is used (which is
37: not necessarily the most specific match).
38: .Pp
39: The
40: .Em sudoers
41: grammar will be described below in Extended Backus-Naur
42: Form (EBNF).
43: Don't despair if you are unfamiliar with EBNF; it is fairly simple,
44: and the definitions below are annotated.
45: .Ss Quick guide to EBNF
46: EBNF is a concise and exact way of describing the grammar of a language.
47: Each EBNF definition is made up of
48: .Em production rules .
49: E.g.,
50: .Pp
51: .Li symbol ::= definition | alternate1 | alternate2 ...
52: .Pp
53: Each
54: .Em production rule
55: references others and thus makes up a
56: grammar for the language.
57: EBNF also contains the following
58: operators, which many readers will recognize from regular
59: expressions.
60: Do not, however, confuse them with
61: .Dq wildcard
62: characters, which have different meanings.
63: .Bl -tag -width 4n
64: .It Li \&?
65: Means that the preceding symbol (or group of symbols) is optional.
66: That is, it may appear once or not at all.
67: .It Li *
68: Means that the preceding symbol (or group of symbols) may appear
69: zero or more times.
70: .It Li +
71: Means that the preceding symbol (or group of symbols) may appear
72: one or more times.
73: .El
74: .Pp
75: Parentheses may be used to group symbols together.
76: For clarity,
77: we will use single quotes
78: .Pq ''
79: to designate what is a verbatim character string (as opposed to a symbol name).
80: .Ss Aliases
81: There are four kinds of aliases:
82: .Li User_Alias ,
83: .Li Runas_Alias ,
84: .Li Host_Alias
85: and
86: .Li Cmnd_Alias .
87: .Bd -literal
88: Alias ::= 'User_Alias' User_Alias (':' User_Alias)* |
89: 'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
90: 'Host_Alias' Host_Alias (':' Host_Alias)* |
91: 'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)*
92:
93: User_Alias ::= NAME '=' User_List
94:
95: Runas_Alias ::= NAME '=' Runas_List
96:
97: Host_Alias ::= NAME '=' Host_List
98:
99: Cmnd_Alias ::= NAME '=' Cmnd_List
100:
101: NAME ::= [A-Z]([A-Z][0-9]_)*
102: .Ed
103: .Pp
104: Each
105: .Em alias
106: definition is of the form
107: .Bd -literal
108: Alias_Type NAME = item1, item2, ...
109: .Ed
110: .Pp
111: where
112: .Em Alias_Type
113: is one of
114: .Li User_Alias ,
115: .Li Runas_Alias ,
116: .Li Host_Alias ,
117: or
118: .Li Cmnd_Alias .
119: A
120: .Li NAME
121: is a string of uppercase letters, numbers,
122: and underscore characters
123: .Pq Ql _ .
124: A
125: .Li NAME
126: .Sy must
127: start with an
128: uppercase letter.
129: It is possible to put several alias definitions
130: of the same type on a single line, joined by a colon
131: .Pq Ql :\& .
132: E.g.,
133: .Bd -literal
134: Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
135: .Ed
136: .Pp
137: The definitions of what constitutes a valid
138: .Em alias
139: member follow.
140: .Bd -literal
141: User_List ::= User |
142: User ',' User_List
143:
144: User ::= '!'* user name |
145: '!'* #uid |
146: '!'* %group |
147: '!'* %#gid |
148: '!'* +netgroup |
149: '!'* %:nonunix_group |
150: '!'* %:#nonunix_gid |
151: '!'* User_Alias
152: .Ed
153: .Pp
154: A
155: .Li User_List
156: is made up of one or more user names, user ids
157: (prefixed with
158: .Ql # ) ,
159: system group names and ids (prefixed with
160: .Ql %
161: and
162: .Ql %#
163: respectively), netgroups (prefixed with
164: .Ql + ) ,
165: non-Unix group names and IDs (prefixed with
166: .Ql %:
167: and
168: .Ql %:#
169: respectively) and
170: .Li User_Alias Ns No es.
171: Each list item may be prefixed with zero or more
172: .Ql \&!
173: operators.
174: An odd number of
175: .Ql \&!
176: operators negate the value of
177: the item; an even number just cancel each other out.
178: .Pp
179: A
180: .Li user name ,
181: .Li uid ,
182: .Li group ,
183: .Li gid ,
184: .Li netgroup ,
185: .Li nonunix_group
186: or
187: .Li nonunix_gid
188: may be enclosed in double quotes to avoid the
189: need for escaping special characters.
190: Alternately, special characters
191: may be specified in escaped hex mode, e.g.\& \ex20 for space.
192: When
193: using double quotes, any prefix characters must be included inside
194: the quotes.
195: .Pp
196: The actual
197: .Li nonunix_group
198: and
199: .Li nonunix_gid
200: syntax depends on
201: the underlying implementation.
202: For instance, the QAS AD backend supports the following formats:
203: .Bl -bullet -width 4n
204: .It
205: Group in the same domain: "%:Group Name"
206: .It
207: Group in any domain: "%:Group Name@FULLY.QUALIFIED.DOMAIN"
208: .It
209: Group SID: "%:S-1-2-34-5678901234-5678901234-5678901234-567"
210: .El
211: .Pp
212: Note that quotes around group names are optional.
213: Unquoted strings must use a backslash
214: .Pq Ql \e
215: to escape spaces and special characters.
216: See
217: .Sx Other special characters and reserved words
218: for a list of
219: characters that need to be escaped.
220: .Bd -literal
221: Runas_List ::= Runas_Member |
222: Runas_Member ',' Runas_List
223:
224: Runas_Member ::= '!'* user name |
225: '!'* #uid |
226: '!'* %group |
227: '!'* %#gid |
228: '!'* %:nonunix_group |
229: '!'* %:#nonunix_gid |
230: '!'* +netgroup |
231: '!'* Runas_Alias
232: .Ed
233: .Pp
234: A
235: .Li Runas_List
236: is similar to a
237: .Li User_List
238: except that instead
239: of
240: .Li User_Alias Ns No es
241: it can contain
242: .Li Runas_Alias Ns No es .
243: Note that
244: user names and groups are matched as strings.
245: In other words, two
246: users (groups) with the same uid (gid) are considered to be distinct.
247: If you wish to match all user names with the same uid (e.g.\&
248: root and toor), you can use a uid instead (#0 in the example given).
249: .Bd -literal
250: Host_List ::= Host |
251: Host ',' Host_List
252:
253: Host ::= '!'* host name |
254: '!'* ip_addr |
255: '!'* network(/netmask)? |
256: '!'* +netgroup |
257: '!'* Host_Alias
258: .Ed
259: .Pp
260: A
261: .Li Host_List
262: is made up of one or more host names, IP addresses,
263: network numbers, netgroups (prefixed with
264: .Ql + )
265: and other aliases.
266: Again, the value of an item may be negated with the
267: .Ql \&!
268: operator.
269: If you do not specify a netmask along with the network number,
270: .Nm sudo
271: will query each of the local host's network interfaces and,
272: if the network number corresponds to one of the hosts's network
273: interfaces, the corresponding netmask will be used.
274: The netmask
275: may be specified either in standard IP address notation
276: (e.g.\& 255.255.255.0 or ffff:ffff:ffff:ffff::),
277: or CIDR notation (number of bits, e.g.\& 24 or 64).
278: A host name may include shell-style wildcards (see the
279: .Sx Wildcards
280: section below),
281: but unless the
282: .Li host name
283: command on your machine returns the fully
284: qualified host name, you'll need to use the
285: .Em fqdn
286: option for wildcards to be useful.
287: Note that
288: .Nm sudo
289: only inspects actual network interfaces; this means that IP address
290: 127.0.0.1 (localhost) will never match.
291: Also, the host name
292: .Dq localhost
293: will only match if that is the actual host name, which is usually
294: only the case for non-networked systems.
295: .Bd -literal
296: Cmnd_List ::= Cmnd |
297: Cmnd ',' Cmnd_List
298:
299: command name ::= file name |
300: file name args |
301: file name '""'
302:
303: Cmnd ::= '!'* command name |
304: '!'* directory |
305: '!'* "sudoedit" |
306: '!'* Cmnd_Alias
307: .Ed
308: .Pp
309: A
310: .Li Cmnd_List
311: is a list of one or more command names, directories, and other aliases.
312: A command name is a fully qualified file name which may include
313: shell-style wildcards (see the
314: .Sx Wildcards
315: section below).
316: A simple file name allows the user to run the command with any
317: arguments he/she wishes.
318: However, you may also specify command line arguments (including
319: wildcards).
320: Alternately, you can specify
321: .Li \&""
322: to indicate that the command
323: may only be run
324: .Sy without
325: command line arguments.
326: A directory is a
327: fully qualified path name ending in a
328: .Ql / .
329: When you specify a directory in a
330: .Li Cmnd_List ,
331: the user will be able to run any file within that directory
332: (but not in any sub-directories therein).
333: .Pp
334: If a
335: .Li Cmnd
336: has associated command line arguments, then the arguments
337: in the
338: .Li Cmnd
339: must match exactly those given by the user on the command line
340: (or match the wildcards if there are any).
341: Note that the following characters must be escaped with a
342: .Ql \e
343: if they are used in command arguments:
344: .Ql ,\& ,
345: .Ql :\& ,
346: .Ql =\& ,
347: .Ql \e .
348: The special command
349: .Dq Li sudoedit
350: is used to permit a user to run
351: .Nm sudo
352: with the
353: .Fl e
354: option (or as
355: .Nm sudoedit ) .
356: It may take command line arguments just as a normal command does.
357: .Ss Defaults
358: Certain configuration options may be changed from their default
359: values at run-time via one or more
360: .Li Default_Entry
361: lines.
362: These may affect all users on any host, all users on a specific host, a
363: specific user, a specific command, or commands being run as a specific user.
364: Note that per-command entries may not include command line arguments.
365: If you need to specify arguments, define a
366: .Li Cmnd_Alias
367: and reference
368: that instead.
369: .Bd -literal
370: Default_Type ::= 'Defaults' |
371: 'Defaults' '@' Host_List |
372: 'Defaults' ':' User_List |
373: 'Defaults' '!' Cmnd_List |
374: 'Defaults' '>' Runas_List
375:
376: Default_Entry ::= Default_Type Parameter_List
377:
378: Parameter_List ::= Parameter |
379: Parameter ',' Parameter_List
380:
381: Parameter ::= Parameter '=' Value |
382: Parameter '+=' Value |
383: Parameter '-=' Value |
384: '!'* Parameter
385: .Ed
386: .Pp
387: Parameters may be
388: .Sy flags ,
389: .Sy integer
390: values,
391: .Sy strings ,
392: or
393: .Sy lists .
394: Flags are implicitly boolean and can be turned off via the
395: .Ql \&!
396: operator.
397: Some integer, string and list parameters may also be
398: used in a boolean context to disable them.
399: Values may be enclosed
400: in double quotes
401: .Pq \&""
402: when they contain multiple words.
403: Special characters may be escaped with a backslash
404: .Pq Ql \e .
405: .Pp
406: Lists have two additional assignment operators,
407: .Li +=
408: and
409: .Li -= .
410: These operators are used to add to and delete from a list respectively.
411: It is not an error to use the
412: .Li -=
413: operator to remove an element
414: that does not exist in a list.
415: .Pp
416: Defaults entries are parsed in the following order: generic, host
417: and user Defaults first, then runas Defaults and finally command
418: defaults.
419: .Pp
420: See
421: .Sx SUDOERS OPTIONS
422: for a list of supported Defaults parameters.
423: .Ss User Specification
424: .Bd -literal
425: User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \e
426: (':' Host_List '=' Cmnd_Spec_List)*
427:
428: Cmnd_Spec_List ::= Cmnd_Spec |
429: Cmnd_Spec ',' Cmnd_Spec_List
430:
431: Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
432:
433: Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'
434:
435: Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
436: 'SETENV:' | 'NOSETENV:')
437: .Ed
438: .Pp
439: A
440: .Sy user specification
441: determines which commands a user may run
442: (and as what user) on specified hosts.
443: By default, commands are
444: run as
445: .Sy root ,
446: but this can be changed on a per-command basis.
447: .Pp
448: The basic structure of a user specification is
449: .Dq who where = (as_whom) what .
450: Let's break that down into its constituent parts:
451: .Ss Runas_Spec
452: A
453: .Li Runas_Spec
454: determines the user and/or the group that a command
455: may be run as.
456: A fully-specified
457: .Li Runas_Spec
458: consists of two
459: .Li Runas_List Ns No s
460: (as defined above) separated by a colon
461: .Pq Ql :\&
462: and enclosed in a set of parentheses.
463: The first
464: .Li Runas_List
465: indicates
466: which users the command may be run as via
467: .Nm sudo Ns No 's
468: .Fl u
469: option.
470: The second defines a list of groups that can be specified via
471: .Nm sudo Ns No 's
472: .Fl g
473: option.
474: If both
475: .Li Runas_List Ns No s
476: are specified, the command may be run with any combination of users
477: and groups listed in their respective
478: .Li Runas_List Ns No s.
479: If only the first is specified, the command may be run as any user
480: in the list but no
481: .Fl g
482: option
483: may be specified.
484: If the first
485: .Li Runas_List
486: is empty but the
487: second is specified, the command may be run as the invoking user
488: with the group set to any listed in the
489: .Li Runas_List .
490: If no
491: .Li Runas_Spec
492: is specified the command may be run as
493: .Sy root
494: and
495: no group may be specified.
496: .Pp
497: A
498: .Li Runas_Spec
499: sets the default for the commands that follow it.
500: What this means is that for the entry:
501: .Bd -literal
502: dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
503: .Ed
504: .Pp
505: The user
506: .Sy dgb
507: may run
508: .Pa /bin/ls ,
509: .Pa /bin/kill ,
510: and
511: .Pa /usr/bin/lprm Ns No \(em Ns but
512: only as
513: .Sy operator .
514: E.g.,
515: .Bd -literal
516: $ sudo -u operator /bin/ls
517: .Ed
518: .Pp
519: It is also possible to override a
520: .Li Runas_Spec
521: later on in an entry.
522: If we modify the entry like so:
523: .Bd -literal
524: dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
525: .Ed
526: .Pp
527: Then user
528: .Sy dgb
529: is now allowed to run
530: .Pa /bin/ls
531: as
532: .Sy operator ,
533: but
534: .Pa /bin/kill
535: and
536: .Pa /usr/bin/lprm
537: as
538: .Sy root .
539: .Pp
540: We can extend this to allow
541: .Sy dgb
542: to run
543: .Li /bin/ls
544: with either
545: the user or group set to
546: .Sy operator :
547: .Bd -literal
548: dgb boulder = (operator : operator) /bin/ls, (root) /bin/kill,\e
549: /usr/bin/lprm
550: .Ed
551: .Pp
552: Note that while the group portion of the
553: .Li Runas_Spec
554: permits the
555: user to run as command with that group, it does not force the user
556: to do so.
557: If no group is specified on the command line, the command
558: will run with the group listed in the target user's password database
559: entry.
560: The following would all be permitted by the sudoers entry above:
561: .Bd -literal
562: $ sudo -u operator /bin/ls
563: $ sudo -u operator -g operator /bin/ls
564: $ sudo -g operator /bin/ls
565: .Ed
566: .Pp
567: In the following example, user
568: .Sy tcm
569: may run commands that access
570: a modem device file with the dialer group.
571: .Bd -literal
572: tcm boulder = (:dialer) /usr/bin/tip, /usr/bin/cu,\e
573: /usr/local/bin/minicom
574: .Ed
575: .Pp
576: Note that in this example only the group will be set, the command
577: still runs as user
578: .Sy tcm .
579: E.g.\&
580: .Bd -literal
581: $ sudo -g dialer /usr/bin/cu
582: .Ed
583: .Pp
584: Multiple users and groups may be present in a
585: .Li Runas_Spec ,
586: in which case the user may select any combination of users and groups via the
587: .Fl u
588: and
589: .Fl g
590: options.
591: In this example:
592: .Bd -literal
593: alan ALL = (root, bin : operator, system) ALL
594: .Ed
595: .Pp
596: user
597: .Sy alan
598: may run any command as either user root or bin,
599: optionally setting the group to operator or system.
600: .Ss Tag_Spec
601: A command may have zero or more tags associated with it.
602: There are
603: six possible tag values:
604: .Li NOPASSWD ,
605: .Li PASSWD ,
606: .Li NOEXEC ,
607: .Li EXEC ,
608: .Li SETENV ,
609: and
610: .Li NOSETENV .
611: Once a tag is set on a
612: .Li Cmnd ,
613: subsequent
614: .Li Cmnd Ns No s
615: in the
616: .Li Cmnd_Spec_List ,
617: inherit the tag unless it is overridden by the opposite tag (in other words,
618: .Li PASSWD
619: overrides
620: .Li NOPASSWD
621: and
622: .Li NOEXEC
623: overrides
624: .Li EXEC ) .
625: .Pp
626: .Em NOPASSWD and PASSWD
627: .Pp
628: By default,
629: .Nm sudo
630: requires that a user authenticate him or herself
631: before running a command.
632: This behavior can be modified via the
633: .Li NOPASSWD
634: tag.
635: Like a
636: .Li Runas_Spec ,
637: the
638: .Li NOPASSWD
639: tag sets
640: a default for the commands that follow it in the
641: .Li Cmnd_Spec_List .
642: Conversely, the
643: .Li PASSWD
644: tag can be used to reverse things.
645: For example:
646: .Bd -literal
647: ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
648: .Ed
649: .Pp
650: would allow the user
651: .Sy ray
652: to run
653: .Pa /bin/kill ,
654: .Pa /bin/ls ,
655: and
656: .Pa /usr/bin/lprm
657: as
658: .Sy root
659: on the machine rushmore without authenticating himself.
660: If we only want
661: .Sy ray
662: to be able to
663: run
664: .Pa /bin/kill
665: without a password the entry would be:
666: .Bd -literal
667: ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
668: .Ed
669: .Pp
670: Note, however, that the
671: .Li PASSWD
672: tag has no effect on users who are in the group specified by the
673: .Em exempt_group
674: option.
675: .Pp
676: By default, if the
677: .Li NOPASSWD
678: tag is applied to any of the entries for a user on the current host,
679: he or she will be able to run
680: .Dq Li sudo -l
681: without a password.
682: Additionally, a user may only run
683: .Dq Li sudo -v
684: without a password if the
685: .Li NOPASSWD
686: tag is present for all a user's entries that pertain to the current host.
687: This behavior may be overridden via the
688: .Em verifypw
689: and
690: .Em listpw
691: options.
692: .Pp
693: .Em NOEXEC and EXEC
694: .Pp
695: If
696: .Nm sudo
697: has been compiled with
698: .Em noexec
699: support and the underlying operating system supports it, the
700: .Li NOEXEC
701: tag can be used to prevent a dynamically-linked executable from
702: running further commands itself.
703: .Pp
704: In the following example, user
705: .Sy aaron
706: may run
707: .Pa /usr/bin/more
708: and
709: .Pa /usr/bin/vi
710: but shell escapes will be disabled.
711: .Bd -literal
712: aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
713: .Ed
714: .Pp
715: See the
716: .Sx Preventing Shell Escapes
717: section below for more details on how
718: .Li NOEXEC
719: works and whether or not it will work on your system.
720: .Pp
721: .Em SETENV and NOSETENV
722: .Pp
723: These tags override the value of the
724: .Em setenv
725: option on a per-command basis.
726: Note that if
727: .Li SETENV
728: has been set for a command, the user may disable the
729: .Em env_reset
730: option from the command line via the
731: .Fl E
732: option.
733: Additionally, environment variables set on the command
734: line are not subject to the restrictions imposed by
735: .Em env_check ,
736: .Em env_delete ,
737: or
738: .Em env_keep .
739: As such, only trusted users should be allowed to set variables in this manner.
740: If the command matched is
741: .Sy ALL ,
742: the
743: .Li SETENV
744: tag is implied for that command; this default may be overridden by use of the
745: .Li NOSETENV
746: tag.
747: .Ss Wildcards
748: .Nm sudo
749: allows shell-style
750: .Em wildcards
751: (aka meta or glob characters)
752: to be used in host names, path names and command line arguments in the
753: .Em sudoers
754: file.
755: Wildcard matching is done via the
756: .Sy POSIX
757: .Xr glob 3
758: and
759: .Xr fnmatch 3
760: routines.
761: Note that these are
762: .Em not
763: regular expressions.
764: .Bl -tag -width 8n
765: .It Li *
766: Matches any set of zero or more characters.
767: .It Li \&?
768: Matches any single character.
769: .It Li [...]
770: Matches any character in the specified range.
771: .It Li [!...]
772: Matches any character
773: .Sy not
774: in the specified range.
775: .It Li \ex
776: For any character
777: .Sq x ,
778: evaluates to
779: .Sq x .
780: This is used to escape special characters such as:
781: .Ql * ,
782: .Ql \&? ,
783: .Ql [\& ,
784: and
785: .Ql ]\& .
786: .El
787: .Pp
788: POSIX character classes may also be used if your system's
789: .Xr glob 3
790: and
791: .Xr fnmatch 3
792: functions support them.
793: However, because the
794: .Ql :\&
795: character has special meaning in
796: .Em sudoers ,
797: it must be
798: escaped.
799: For example:
800: .Bd -literal -offset 4n
1.4 millert 801: /bin/ls [[:\&alpha:\&]]*
1.1 millert 802: .Ed
803: .Pp
804: Would match any file name beginning with a letter.
805: .Pp
806: Note that a forward slash
807: .Pq Ql /
808: will
809: .Sy not
810: be matched by
811: wildcards used in the path name.
812: This is to make a path like:
813: .Bd -literal -offset 4n
814: /usr/bin/*
815: .Ed
816: .Pp
817: match
818: .Pa /usr/bin/who
819: but not
820: .Pa /usr/bin/X11/xterm .
821: .Pp
822: When matching the command line arguments, however, a slash
823: .Sy does
824: get matched by wildcards since command line arguments may contain
825: arbitrary strings and not just path names.
826: .Pp
827: Wildcards in command line arguments should be used with care.
828: Because command line arguments are matched as a single, concatenated
829: string, a wildcard such as
830: .Ql \&?
831: or
832: .Ql *
833: can match multiple words.
834: For example, while a sudoers entry like:
835: .Bd -literal -offset 4n
836: %operator ALL = /bin/cat /var/log/messages*
837: .Ed
838: .Pp
839: will allow command like:
840: .Bd -literal -offset 4n
841: $ sudo cat /var/log/messages.1
842: .Ed
843: .Pp
844: It will also allow:
845: .Bd -literal -offset 4n
846: $ sudo cat /var/log/messages /etc/shadow
847: .Ed
848: .Pp
849: which is probably not what was intended.
850: .Ss Exceptions to wildcard rules
851: The following exceptions apply to the above rules:
852: .Bl -tag -width 8n
853: .It Li \&""
854: If the empty string
855: .Li \&""
856: is the only command line argument in the
857: .Em sudoers
858: entry it means that command is not allowed to be run with
859: .Sy any
860: arguments.
861: .It sudoedit
862: Command line arguments to the
863: .Em sudoedit
864: built-in command should always be path names, so a forward slash
865: .Pq Ql /
866: will not be matched by a wildcard.
867: .El
868: .Ss Including other files from within sudoers
869: It is possible to include other
870: .Em sudoers
871: files from within the
872: .Em sudoers
873: file currently being parsed using the
874: .Li #include
875: and
876: .Li #includedir
877: directives.
878: .Pp
879: This can be used, for example, to keep a site-wide
880: .Em sudoers
881: file in addition to a local, per-machine file.
882: For the sake of this example the site-wide
883: .Em sudoers
884: will be
885: .Pa /etc/sudoers
886: and the per-machine one will be
887: .Pa /etc/sudoers.local .
888: To include
889: .Pa /etc/sudoers.local
890: from within
891: .Pa /etc/sudoers
892: we would use the
893: following line in
894: .Pa /etc/sudoers :
895: .Bd -literal -offset 4n
896: #include /etc/sudoers.local
897: .Ed
898: .Pp
899: When
900: .Nm sudo
901: reaches this line it will suspend processing of the current file
902: .Pq Pa /etc/sudoers
903: and switch to
904: .Pa /etc/sudoers.local .
905: Upon reaching the end of
906: .Pa /etc/sudoers.local ,
907: the rest of
908: .Pa /etc/sudoers
909: will be processed.
910: Files that are included may themselves include other files.
911: A hard limit of 128 nested include files is enforced to prevent include
912: file loops.
913: .Pp
914: If the path to the include file is not fully-qualified (does not
915: begin with a
916: .Ql / ,
917: it must be located in the same directory as the sudoers file it was
918: included from.
919: For example, if
920: .Pa /etc/sudoers
921: contains the line:
922: .Bd -literal -offset 4n
923: .Li #include sudoers.local
924: .Ed
925: .Pp
926: the file that will be included is
927: .Pa /etc/sudoers.local .
928: .Pp
929: The file name may also include the
930: .Li %h
931: escape, signifying the short form of the host name.
932: In other words, if the machine's host name is
933: .Dq xerxes ,
934: then
935: .Bd -literal -offset 4n
936: #include /etc/sudoers.%h
937: .Ed
938: .Pp
939: will cause
940: .Nm sudo
941: to include the file
942: .Pa /etc/sudoers.xerxes .
943: .Pp
944: The
945: .Li #includedir
946: directive can be used to create a
947: .Pa sudo.d
948: directory that the system package manager can drop
949: .Em sudoers
950: rules
951: into as part of package installation.
952: For example, given:
953: .Bd -literal -offset 4n
954: #includedir /etc/sudoers.d
955: .Ed
956: .Pp
957: .Nm sudo
958: will read each file in
959: .Pa /etc/sudoers.d ,
960: skipping file names that end in
961: .Ql ~
962: or contain a
963: .Ql .\&
964: character to avoid causing problems with package manager or editor
965: temporary/backup files.
966: Files are parsed in sorted lexical order.
967: That is,
968: .Pa /etc/sudoers.d/01_first
969: will be parsed before
970: .Pa /etc/sudoers.d/10_second .
971: Be aware that because the sorting is lexical, not numeric,
972: .Pa /etc/sudoers.d/1_whoops
973: would be loaded
974: .Sy after
975: .Pa /etc/sudoers.d/10_second .
976: Using a consistent number of leading zeroes in the file names can be used
977: to avoid such problems.
978: .Pp
979: Note that unlike files included via
980: .Li #include ,
981: .Nm visudo
982: will not edit the files in a
983: .Li #includedir
984: directory unless one of them contains a syntax error.
985: It is still possible to run
986: .Nm visudo
987: with the
988: .Fl f
989: flag to edit the files directly.
990: .Ss Other special characters and reserved words
991: The pound sign
992: .Pq Ql #
993: is used to indicate a comment (unless it is part of a #include
994: directive or unless it occurs in the context of a user name and is
995: followed by one or more digits, in which case it is treated as a
996: uid).
997: Both the comment character and any text after it, up to the end of
998: the line, are ignored.
999: .Pp
1000: The reserved word
1001: .Sy ALL
1002: is a built-in
1003: .Em alias
1004: that always causes a match to succeed.
1005: It can be used wherever one might otherwise use a
1006: .Li Cmnd_Alias ,
1007: .Li User_Alias ,
1008: .Li Runas_Alias ,
1009: or
1010: .Li Host_Alias .
1011: You should not try to define your own
1012: .Em alias
1013: called
1014: .Sy ALL
1015: as the built-in alias will be used in preference to your own.
1016: Please note that using
1017: .Sy ALL
1018: can be dangerous since in a command context, it allows the user to run
1019: .Sy any
1020: command on the system.
1021: .Pp
1022: An exclamation point
1023: .Pq Ql \&!
1024: can be used as a logical
1025: .Em not
1026: operator both in an
1027: .Em alias
1028: and in front of a
1029: .Li Cmnd .
1030: This allows one to exclude certain values.
1031: Note, however, that using a
1032: .Ql \&!
1033: in conjunction with the built-in
1034: .Sy ALL
1035: alias to allow a user to run
1036: .Dq all but a few
1037: commands rarely works as intended (see
1038: .Sx SECURITY NOTES
1039: below).
1040: .Pp
1041: Long lines can be continued with a backslash
1042: .Pq Ql \e
1043: as the last character on the line.
1044: .Pp
1045: White space between elements in a list as well as special syntactic
1046: characters in a
1047: .Em User Specification
1048: .Po
1049: .Ql =\& ,
1050: .Ql :\& ,
1051: .Ql (\& ,
1052: .Ql )\&
1053: .Pc
1054: is optional.
1055: .Pp
1056: The following characters must be escaped with a backslash
1057: .Pq Ql \e
1058: when used as part of a word (e.g.\& a user name or host name):
1059: .Ql \&! ,
1060: .Ql =\& ,
1061: .Ql :\& ,
1062: .Ql ,\& ,
1063: .Ql (\& ,
1064: .Ql )\& ,
1065: .Ql \e .
1066: .Sh SUDOERS OPTIONS
1067: .Nm sudo Ns No 's
1068: behavior can be modified by
1069: .Li Default_Entry
1070: lines, as explained earlier.
1071: A list of all supported Defaults parameters, grouped by type, are listed below.
1072: .Pp
1073: .Sy Boolean Flags :
1074: .Bl -tag -width 16n
1075: .It always_set_home
1076: If enabled,
1077: .Nm sudo
1078: will set the
1079: .Ev HOME
1080: environment variable to the home directory of the target user
1081: (which is root unless the
1082: .Fl u
1083: option is used).
1084: This effectively means that the
1085: .Fl H
1086: option is always implied.
1087: This flag is
1088: .Em off
1089: by default.
1090: .It authenticate
1091: If set, users must authenticate themselves via a password (or other
1092: means of authentication) before they may run commands.
1093: This default may be overridden via the
1094: .Li PASSWD
1095: and
1096: .Li NOPASSWD
1097: tags.
1098: This flag is
1099: .Em on
1100: by default.
1101: .It closefrom_override
1102: If set, the user may use
1103: .Nm sudo Ns No 's
1104: .Fl C
1105: option which overrides the default starting point at which
1106: .Nm sudo
1107: begins closing open file descriptors.
1108: This flag is
1109: .Em off
1110: by default.
1111: .It env_editor
1112: If set,
1113: .Nm visudo
1114: will use the value of the
1115: .Ev EDITOR
1116: or
1117: .Ev VISUAL
1118: environment variables before falling back on the default editor list.
1119: Note that this may create a security hole as it allows the user to
1120: run any arbitrary command as root without logging.
1121: A safer alternative is to place a colon-separated list of editors
1122: in the
1123: .Li editor
1124: variable.
1125: .Nm visudo
1126: will then only use the
1127: .Ev EDITOR
1128: or
1129: .Ev VISUAL
1130: if they match a value specified in
1131: .Li editor .
1132: This flag is
1133: .Em @env_editor@
1134: by
1135: default.
1136: .It env_reset
1137: If set,
1138: .Nm sudo
1139: will run the command in a minimal environment containing the
1140: .Ev TERM ,
1141: .Ev PATH ,
1142: .Ev HOME ,
1143: .Ev MAIL ,
1144: .Ev SHELL ,
1145: .Ev LOGNAME ,
1146: .Ev USER ,
1147: .Ev USERNAME
1148: and
1149: .Ev SUDO_*
1150: variables.
1151: Any
1152: variables in the caller's environment that match the
1153: .Li env_keep
1154: and
1155: .Li env_check
1156: lists are then added, followed by any variables present in the file
1157: specified by the
1158: .Em env_file
1159: option (if any).
1160: The default contents of the
1161: .Li env_keep
1162: and
1163: .Li env_check
1164: lists are displayed when
1165: .Nm sudo
1166: is run by root with the
1167: .Fl V
1168: option.
1169: If the
1170: .Em secure_path
1171: option is set, its value will be used for the
1172: .Ev PATH
1173: environment variable.
1174: This flag is
1175: .Em @env_reset@
1176: by default.
1177: .It fast_glob
1178: Normally,
1179: .Nm sudo
1180: uses the
1181: .Xr glob 3
1182: function to do shell-style globbing when matching path names.
1183: However, since it accesses the file system,
1184: .Xr glob 3
1185: can take a long time to complete for some patterns, especially
1186: when the pattern references a network file system that is mounted
1187: on demand (auto mounted).
1188: The
1189: .Em fast_glob
1190: option causes
1191: .Nm sudo
1192: to use the
1193: .Xr fnmatch 3
1194: function, which does not access the file system to do its matching.
1195: The disadvantage of
1196: .Em fast_glob
1197: is that it is unable to match relative path names such as
1198: .Pa ./ls
1199: or
1200: .Pa ../bin/ls .
1201: This has security implications when path names that include globbing
1202: characters are used with the negation operator,
1203: .Ql !\& ,
1204: as such rules can be trivially bypassed.
1205: As such, this option should not be used when
1206: .Em sudoers
1207: contains rules that contain negated path names which include globbing
1208: characters.
1209: This flag is
1210: .Em off
1211: by default.
1212: .It fqdn
1213: Set this flag if you want to put fully qualified host names in the
1214: .Em sudoers
1215: file when the local host name (as returned by the
1216: .Li hostname
1217: command) does not contain the domain name.
1218: In other words, instead of myhost you would use myhost.mydomain.edu.
1219: You may still use the short form if you wish (and even mix the two).
1220: This option is only effective when the
1221: .Dq canonical
1222: host name, as returned by the
1223: .Fn getaddrinfo
1224: or
1225: .Fn gethostbyname
1226: function, is a fully-qualified domain name.
1227: This is usually the case when the system is configured to use DNS
1228: for host name resolution.
1229: .Pp
1230: If the system is configured to use the
1231: .Pa /etc/hosts
1232: file in preference to DNS, the
1233: .Dq canonical
1234: host name may not be fully-qualified.
1235: The order that sources are queried for hosts name resolution
1236: is specified in the
1237: .Pa /etc/resolv.conf
1238: file.
1239: In the
1240: .Pa /etc/hosts
1241: file, the first host name of the entry is considered to be the
1242: .Dq canonical
1243: name; subsequent names are aliases that are not used by
1244: .Nm sudoers .
1245: For example, the following hosts file line for the machine
1246: .Dq xyzzy
1247: has the fully-qualified domain name as the
1248: .Dq canonical
1249: host name, and the short version as an alias.
1250: .sp
1251: .Dl 192.168.1.1 xyzzy.sudo.ws xyzzy
1252: .sp
1253: If the machine's hosts file entry is not formatted properly, the
1254: .Em fqdn
1255: option will not be effective if it is queried before DNS.
1256: .Pp
1257: Beware that when using DNS for host name resolution, turning on
1258: .Em fqdn
1259: requires
1260: .Nm sudoers
1261: to make DNS lookups which renders
1262: .Nm sudo
1263: unusable if DNS stops working (for example if the machine is disconnected
1264: from the network).
1265: Also note that just like with the hosts file, you must use the
1266: .Dq canonical
1267: name as DNS knows it.
1268: That is, you may not use a host alias
1269: .Po
1270: .Li CNAME
1271: entry
1272: .Pc
1273: due to performance issues and the fact that there is no way to get all
1274: aliases from DNS.
1275: .Pp
1276: This flag is
1277: .Em @fqdn@
1278: by default.
1279: .It ignore_dot
1280: If set,
1281: .Nm sudo
1282: will ignore "." or "" (both denoting current directory) in the
1283: .Ev PATH
1284: environment variable; the
1285: .Ev PATH
1286: itself is not modified.
1287: This flag is
1288: .Em @ignore_dot@
1289: by default.
1290: .It ignore_local_sudoers
1291: If set via LDAP, parsing of
1292: .Pa @sysconfdir@/sudoers
1293: will be skipped.
1294: This is intended for Enterprises that wish to prevent the usage of local
1295: sudoers files so that only LDAP is used.
1296: This thwarts the efforts of rogue operators who would attempt to add roles to
1297: .Pa @sysconfdir@/sudoers .
1298: When this option is present,
1299: .Pa @sysconfdir@/sudoers
1300: does not even need to exist.
1301: Since this option tells
1302: .Nm sudo
1303: how to behave when no specific LDAP entries have been matched, this
1304: sudoOption is only meaningful for the
1305: .Li cn=defaults
1306: section.
1307: This flag is
1308: .Em off
1309: by default.
1310: .It insults
1311: If set,
1312: .Nm sudo
1313: will insult users when they enter an incorrect password.
1314: This flag is
1315: .Em @insults@
1316: by default.
1317: .It log_host
1318: If set, the host name will be logged in the (non-syslog)
1319: .Nm sudo
1320: log file.
1321: This flag is
1322: .Em off
1323: by default.
1324: .It log_year
1325: If set, the four-digit year will be logged in the (non-syslog)
1326: .Nm sudo
1327: log file.
1328: This flag is
1329: .Em off
1330: by default.
1331: .It long_otp_prompt
1332: When validating with a One Time Password (OTP) scheme such as
1333: .Sy S/Key
1334: or
1335: .Sy OPIE ,
1336: a two-line prompt is used to make it easier
1337: to cut and paste the challenge to a local window.
1338: It's not as pretty as the default but some people find it more convenient.
1339: This flag is
1340: .Em @long_otp_prompt@
1341: by default.
1342: .It mail_always
1343: Send mail to the
1344: .Em mailto
1345: user every time a users runs
1346: .Nm sudo .
1347: This flag is
1348: .Em off
1349: by default.
1350: .It mail_badpass
1351: Send mail to the
1352: .Em mailto
1353: user if the user running
1354: .Nm sudo
1355: does not enter the correct password.
1356: If the command the user is attempting to run is not permitted by
1357: .Em sudoers
1358: and one of the
1359: .Em mail_always ,
1360: .Em mail_no_host ,
1361: .Em mail_no_perms
1362: or
1363: .Em mail_no_user
1364: flags are set, this flag will have no effect.
1365: This flag is
1366: .Em off
1367: by default.
1368: .It mail_no_host
1369: If set, mail will be sent to the
1370: .Em mailto
1371: user if the invoking user exists in the
1372: .Em sudoers
1373: file, but is not allowed to run commands on the current host.
1374: This flag is
1375: .Em @mail_no_host@
1376: by default.
1377: .It mail_no_perms
1378: If set, mail will be sent to the
1379: .Em mailto
1380: user if the invoking user is allowed to use
1381: .Nm sudo
1382: but the command they are trying is not listed in their
1383: .Em sudoers
1384: file entry or is explicitly denied.
1385: This flag is
1386: .Em @mail_no_perms@
1387: by default.
1388: .It mail_no_user
1389: If set, mail will be sent to the
1390: .Em mailto
1391: user if the invoking user is not in the
1392: .Em sudoers
1393: file.
1394: This flag is
1395: .Em @mail_no_user@
1396: by default.
1397: .It noexec
1398: If set, all commands run via
1399: .Nm sudo
1400: will behave as if the
1401: .Li NOEXEC
1402: tag has been set, unless overridden by a
1403: .Li EXEC
1404: tag.
1405: See the description of
1406: .Em NOEXEC and EXEC
1407: below as well as the
1408: .Sx Preventing Shell Escapes
1409: section at the end of this manual.
1410: This flag is
1411: .Em off
1412: by default.
1413: .It path_info
1414: Normally,
1415: .Nm sudo
1416: will tell the user when a command could not be
1417: found in their
1418: .Ev PATH
1419: environment variable.
1420: Some sites may wish to disable this as it could be used to gather
1421: information on the location of executables that the normal user does
1422: not have access to.
1423: The disadvantage is that if the executable is simply not in the user's
1424: .Ev PATH ,
1425: .Nm sudo
1426: will tell the user that they are not allowed to run it, which can be confusing.
1427: This flag is
1428: .Em @path_info@
1429: by default.
1430: .It passprompt_override
1431: The password prompt specified by
1432: .Em passprompt
1433: will normally only be used if the password prompt provided by systems
1434: such as PAM matches the string
1435: .Dq Password: .
1436: If
1437: .Em passprompt_override
1438: is set,
1439: .Em passprompt
1440: will always be used.
1441: This flag is
1442: .Em off
1443: by default.
1444: .It preserve_groups
1445: By default,
1446: .Nm sudo
1447: will initialize the group vector to the list of groups the target user is in.
1448: When
1449: .Em preserve_groups
1450: is set, the user's existing group vector is left unaltered.
1451: The real and effective group IDs, however, are still set to match the
1452: target user.
1453: This flag is
1454: .Em off
1455: by default.
1456: .It pwfeedback
1457: By default,
1458: .Nm sudo
1459: reads the password like most other Unix programs,
1460: by turning off echo until the user hits the return (or enter) key.
1461: Some users become confused by this as it appears to them that
1462: .Nm sudo
1463: has hung at this point.
1464: When
1465: .Em pwfeedback
1466: is set,
1467: .Nm sudo
1468: will provide visual feedback when the user presses a key.
1469: Note that this does have a security impact as an onlooker may be able to
1470: determine the length of the password being entered.
1471: This flag is
1472: .Em off
1473: by default.
1474: .It requiretty
1475: If set,
1476: .Nm sudo
1477: will only run when the user is logged in to a real tty.
1478: When this flag is set,
1479: .Nm sudo
1480: can only be run from a login session and not via other means such as
1481: .Xr cron @mansectsu@
1482: or cgi-bin scripts.
1483: This flag is
1484: .Em off
1485: by default.
1486: .It root_sudo
1487: If set, root is allowed to run
1488: .Nm sudo
1489: too.
1490: Disabling this prevents users from
1491: .Dq chaining
1492: .Nm sudo
1493: commands to get a root shell by doing something like
1494: .Dq Li sudo sudo /bin/sh .
1495: Note, however, that turning off
1496: .Em root_sudo
1497: will also prevent root from running
1498: .Nm sudoedit .
1499: Disabling
1500: .Em root_sudo
1501: provides no real additional security; it exists purely for historical reasons.
1502: This flag is
1503: .Em @root_sudo@
1504: by default.
1505: .It rootpw
1506: If set,
1507: .Nm sudo
1508: will prompt for the root password instead of the password of the invoking user.
1509: This flag is
1510: .Em off
1511: by default.
1512: .It runaspw
1513: If set,
1514: .Nm sudo
1515: will prompt for the password of the user defined by the
1516: .Em runas_default
1517: option (defaults to
1518: .Li @runas_default@ )
1519: instead of the password of the invoking user.
1520: This flag is
1521: .Em off
1522: by default.
1523: .It set_home
1524: If enabled and
1525: .Nm sudo
1526: is invoked with the
1527: .Fl s
1528: option the
1529: .Ev HOME
1530: environment variable will be set to the home directory of the target
1531: user (which is root unless the
1532: .Fl u
1533: option is used).
1534: This effectively makes the
1535: .Fl s
1536: option imply
1537: .Fl H .
1538: This flag is
1539: .Em off
1540: by default.
1541: .It set_logname
1542: Normally,
1543: .Nm sudo
1544: will set the
1545: .Ev LOGNAME ,
1546: .Ev USER
1547: and
1548: .Ev USERNAME
1549: environment variables to the name of the target user (usually root unless the
1550: .Fl u
1551: option is given).
1552: However, since some programs (including the RCS revision control system) use
1553: .Ev LOGNAME
1554: to determine the real identity of the user, it may be desirable to
1555: change this behavior.
1556: This can be done by negating the set_logname option.
1557: Note that if the
1558: .Em env_reset
1559: option has not been disabled, entries in the
1560: .Em env_keep
1561: list will override the value of
1562: .Em set_logname .
1563: This flag is
1564: .Em on
1565: by default.
1566: .It setenv
1567: Allow the user to disable the
1568: .Em env_reset
1569: option from the command line via the
1570: .Fl E
1571: option.
1572: Additionally, environment variables set via the command line are
1573: not subject to the restrictions imposed by
1574: .Em env_check ,
1575: .Em env_delete ,
1576: or
1577: .Em env_keep .
1578: As such, only trusted users should be allowed to set variables in this manner.
1579: This flag is
1580: .Em off
1581: by default.
1582: .It shell_noargs
1583: If set and
1584: .Nm sudo
1585: is invoked with no arguments it acts as if the
1586: .Fl s
1587: option had been given.
1588: That is, it runs a shell as root (the shell is determined by the
1589: .Ev SHELL
1590: environment variable if it is set, falling back on the shell listed
1591: in the invoking user's /etc/passwd entry if not).
1592: This flag is
1593: .Em off
1594: by default.
1595: .It stay_setuid
1596: Normally, when
1597: .Nm sudo
1598: executes a command the real and effective UIDs are set to the target
1599: user (root by default).
1600: This option changes that behavior such that the real UID is left
1601: as the invoking user's UID.
1602: In other words, this makes
1603: .Nm sudo
1604: act as a setuid wrapper.
1605: This can be useful on systems that disable some potentially
1606: dangerous functionality when a program is run setuid.
1607: This option is only effective on systems that support either the
1608: .Xr setreuid 2
1609: or
1610: .Xr setresuid 2
1611: system call.
1612: This flag is
1613: .Em off
1614: by default.
1615: .It targetpw
1616: If set,
1617: .Nm sudo
1618: will prompt for the password of the user specified
1619: by the
1620: .Fl u
1621: option (defaults to
1622: .Li root )
1623: instead of the password of the invoking user.
1624: In addition, the time stamp file name will include the target user's name.
1625: Note that this flag precludes the use of a uid not listed in the passwd
1626: database as an argument to the
1627: .Fl u
1628: option.
1629: This flag is
1630: .Em off
1631: by default.
1632: .It tty_tickets
1633: If set, users must authenticate on a per-tty basis.
1634: With this flag enabled,
1635: .Nm sudo
1636: will use a file named for the tty the user is
1637: logged in on in the user's time stamp directory.
1638: If disabled, the time stamp of the directory is used instead.
1639: This flag is
1640: .Em @tty_tickets@
1641: by default.
1642: .It umask_override
1643: If set,
1644: .Nm sudo
1645: will set the umask as specified by
1646: .Em sudoers
1647: without modification.
1648: This makes it possible to specify a more permissive umask in
1649: .Em sudoers
1650: than the user's own umask and matches historical behavior.
1651: If
1652: .Em umask_override
1653: is not set,
1654: .Nm sudo
1655: will set the umask to be the union of the user's umask and what is specified in
1656: .Em sudoers .
1657: This flag is
1658: .Em @umask_override@
1659: by default.
1660: .It use_loginclass
1661: If set,
1662: .Nm sudo
1663: will apply the defaults specified for the target user's login class
1664: if one exists.
1665: Only available if
1666: .Nm sudo
1667: is configured with the
1668: .Li --with-logincap
1669: option.
1670: This flag is
1671: .Em off
1672: by default.
1673: .It use_pty
1674: If set,
1675: .Nm sudo
1676: will run the command in a pseudo-pty even if no I/O logging is being gone.
1677: A malicious program run under
1678: .Nm sudo
1679: could conceivably fork a background process that retains to the user's
1680: terminal device after the main program has finished executing.
1681: Use of this option will make that impossible.
1682: This flag is
1683: .Em off
1684: by default.
1685: .It visiblepw
1686: By default,
1687: .Nm sudo
1688: will refuse to run if the user must enter a password but it is not
1689: possible to disable echo on the terminal.
1690: If the
1691: .Em visiblepw
1692: flag is set,
1693: .Nm sudo
1694: will prompt for a password even when it would be visible on the screen.
1695: This makes it possible to run things like
1696: .Dq Li ssh somehost sudo ls
1697: since by default,
1698: .Xr ssh 1
1699: does
1700: not allocate a tty when running a command.
1701: This flag is
1702: .Em off
1703: by default.
1704: .El
1705: .Pp
1706: .Sy Integers :
1707: .Bl -tag -width 16n
1708: .It closefrom
1709: Before it executes a command,
1710: .Nm sudo
1711: will close all open file descriptors other than standard input,
1712: standard output and standard error (ie: file descriptors 0-2).
1713: The
1714: .Em closefrom
1715: option can be used to specify a different file descriptor at which
1716: to start closing.
1717: The default is
1718: .Li 3 .
1719: .It passwd_tries
1720: The number of tries a user gets to enter his/her password before
1721: .Nm sudo
1722: logs the failure and exits.
1723: The default is
1724: .Li @passwd_tries@ .
1725: .El
1726: .Pp
1727: .Sy Integers that can be used in a boolean context :
1728: .Bl -tag -width 16n
1729: .It loglinelen
1730: Number of characters per line for the file log.
1731: This value is used to decide when to wrap lines for nicer log files.
1732: This has no effect on the syslog log file, only the file log.
1733: The default is
1734: .Li @loglen@
1735: (use 0 or negate the option to disable word wrap).
1736: .It passwd_timeout
1737: Number of minutes before the
1738: .Nm sudo
1739: password prompt times out, or
1740: .Li 0
1741: for no timeout.
1742: The timeout may include a fractional component
1743: if minute granularity is insufficient, for example
1744: .Li 2.5 .
1745: The
1746: default is
1747: .Li @password_timeout@ .
1748: .It timestamp_timeout
1749: Number of minutes that can elapse before
1750: .Nm sudo
1751: will ask for a passwd again.
1752: The timeout may include a fractional component if
1753: minute granularity is insufficient, for example
1754: .Li 2.5 .
1755: The default is
1756: .Li @timeout@ .
1757: Set this to
1758: .Li 0
1759: to always prompt for a password.
1760: If set to a value less than
1761: .Li 0
1762: the user's time stamp will never expire.
1763: This can be used to allow users to create or delete their own time stamps via
1764: .Dq Li sudo -v
1765: and
1766: .Dq Li sudo -k
1767: respectively.
1768: .It umask
1769: Umask to use when running the command.
1770: Negate this option or set it to 0777 to preserve the user's umask.
1771: The actual umask that is used will be the union of the user's umask
1772: and the value of the
1773: .Em umask
1774: option, which defaults to
1775: .Li @sudo_umask@ .
1776: This guarantees
1777: that
1778: .Nm sudo
1779: never lowers the umask when running a command.
1780: Note: on systems that use PAM, the default PAM configuration may specify
1781: its own umask which will override the value set in
1782: .Em sudoers .
1783: .El
1784: .Pp
1785: .Sy Strings :
1786: .Bl -tag -width 16n
1787: .It badpass_message
1788: Message that is displayed if a user enters an incorrect password.
1789: The default is
1790: .Li @badpass_message@
1791: unless insults are enabled.
1792: .It editor
1793: A colon
1794: .Pq Ql :\&
1795: separated list of editors allowed to be used with
1796: .Nm visudo .
1797: .Nm visudo
1798: will choose the editor that matches the user's
1799: .Ev EDITOR
1800: environment variable if possible, or the first editor in the
1801: list that exists and is executable.
1802: The default is
1803: .Pa @editor@ .
1804: .It mailsub
1805: Subject of the mail sent to the
1806: .Em mailto
1807: user.
1808: The escape
1809: .Li %h
1810: will expand to the host name of the machine.
1811: Default is
1812: .Dq Li @mailsub@ .
1813: .It noexec_file
1814: The
1815: .Em noexec
1816: option specifies the the fully-qualified path to a shared library
1817: containing dummy versions of the
1818: .Fn execv ,
1819: .Fn execve
1820: and
1821: .Fn fexecve
1822: library functions that just return an error.
1823: This is used to implement the
1824: .Em noexec
1825: functionality on systems that support
1826: .Ev LD_PRELOAD
1827: or its equivalent.
1828: Defaults to
1829: .Pa @noexec_file@ .
1830: .It passprompt
1831: The default prompt to use when asking for a password; can be overridden via the
1832: .Fl p
1833: option or the
1834: .Ev SUDO_PROMPT
1835: environment variable.
1836: The following percent
1837: .Pq Ql %
1838: escape sequences are supported:
1839: .Bl -tag -width 4n
1840: .It Li %H
1841: expanded to the local host name including the domain name
1842: (only if the machine's host name is fully qualified or the
1843: .Em fqdn
1844: option is set)
1845: .It Li %h
1846: expanded to the local host name without the domain name
1847: .It Li %p
1848: expanded to the user whose password is being asked for (respects the
1849: .Em rootpw ,
1850: .Em targetpw
1851: and
1852: .Em runaspw
1853: flags in
1854: .Em sudoers )
1855: .It Li \&%U
1856: expanded to the login name of the user the command will
1857: be run as (defaults to root)
1858: .It Li %u
1859: expanded to the invoking user's login name
1860: .It Li %%
1861: two consecutive
1862: .Li %
1863: characters are collapsed into a single
1864: .Li %
1865: character
1866: .El
1867: .Pp
1868: The default value is
1869: .Dq Li @passprompt@ .
1870: .It runas_default
1871: The default user to run commands as if the
1872: .Fl u
1873: option is not specified on the command line.
1874: This defaults to
1875: .Li @runas_default@ .
1876: .It syslog_badpri
1877: Syslog priority to use when user authenticates unsuccessfully.
1878: Defaults to
1879: .Li @badpri@ .
1880: .Pp
1881: The following syslog priorities are supported:
1882: .Sy alert ,
1883: .Sy crit ,
1884: .Sy debug ,
1885: .Sy emerg ,
1886: .Sy err ,
1887: .Sy info ,
1888: .Sy notice ,
1889: and
1890: .Sy warning .
1891: .It syslog_goodpri
1892: Syslog priority to use when user authenticates successfully.
1893: Defaults to
1894: .Li @goodpri@ .
1895: .Pp
1896: See
1897: .Sx syslog_badpri
1898: for the list of supported syslog priorities.
1899: .It sudoers_locale
1900: Locale to use when parsing the sudoers file, logging commands, and
1901: sending email.
1902: Note that changing the locale may affect how sudoers is interpreted.
1903: Defaults to
1904: .Dq Li C .
1905: .It timestampdir
1906: The directory in which
1907: .Nm sudo
1908: stores its time stamp files.
1909: The default is
1910: .Pa @timedir@ .
1911: .It timestampowner
1912: The owner of the time stamp directory and the time stamps stored therein.
1913: The default is
1914: .Li root .
1915: .It askpass
1916: The
1917: .Em askpass
1918: option specifies the fully qualified path to a helper program used
1919: to read the user's password when no terminal is available.
1920: This may be the case when
1921: .Nm sudo
1922: is executed from a graphical (as opposed to text-based) application.
1923: The program specified by
1924: .Em askpass
1925: should display the argument passed to it as the prompt and write
1926: the user's password to the standard output.
1927: The value of
1928: .Em askpass
1929: may be overridden by the
1930: .Ev SUDO_ASKPASS
1931: environment variable.
1932: .It env_file
1933: The
1934: .Em env_file
1935: option specifies the fully qualified path to a file containing variables
1936: to be set in the environment of the program being run.
1937: Entries in this file should either be of the form
1938: .Dq Li VARIABLE=value
1939: or
1940: .Dq Li export VARIABLE=value .
1941: The value may optionally be surrounded by single or double quotes.
1942: Variables in this file are subject to other
1943: .Nm sudo
1944: environment settings such as
1945: .Em env_keep
1946: and
1947: .Em env_check .
1948: .It exempt_group
1949: Users in this group are exempt from password and PATH requirements.
1950: The group name specified should not include a
1951: .Li %
1952: prefix.
1953: This is not set by default.
1954: .It lecture
1955: This option controls when a short lecture will be printed along with
1956: the password prompt.
1957: It has the following possible values:
1958: .Bl -tag -width 6n
1959: .It always
1960: Always lecture the user.
1961: .It never
1962: Never lecture the user.
1963: .It once
1964: Only lecture the user the first time they run
1965: .Nm sudo .
1966: .El
1967: .Pp
1968: If no value is specified, a value of
1969: .Em once
1970: is implied.
1971: Negating the option results in a value of
1972: .Em never
1973: being used.
1974: The default value is
1975: .Em @lecture@ .
1976: .It lecture_file
1977: Path to a file containing an alternate
1978: .Nm sudo
1979: lecture that will be used in place of the standard lecture if the named
1980: file exists.
1981: By default,
1982: .Nm sudo
1983: uses a built-in lecture.
1984: .It listpw
1985: This option controls when a password will be required when a user runs
1986: .Nm sudo
1987: with the
1988: .Fl l
1989: option.
1990: It has the following possible values:
1991: .Bl -tag -width 8n
1992: .It all
1993: All the user's
1994: .Em sudoers
1995: entries for the current host must have
1996: the
1997: .Li NOPASSWD
1998: flag set to avoid entering a password.
1999: .It always
2000: The user must always enter a password to use the
2001: .Fl l
2002: option.
2003: .It any
2004: At least one of the user's
2005: .Em sudoers
2006: entries for the current host
2007: must have the
2008: .Li NOPASSWD
2009: flag set to avoid entering a password.
2010: .It never
2011: The user need never enter a password to use the
2012: .Fl l
2013: option.
2014: .El
2015: .Pp
2016: If no value is specified, a value of
2017: .Em any
2018: is implied.
2019: Negating the option results in a value of
2020: .Em never
2021: being used.
2022: The default value is
2023: .Em any .
2024: .It logfile
2025: Path to the
2026: .Nm sudo
2027: log file (not the syslog log file).
2028: Setting a path turns on logging to a file;
2029: negating this option turns it off.
2030: By default,
2031: .Nm sudo
2032: logs via syslog.
2033: .It mailerflags
2034: Flags to use when invoking mailer. Defaults to
2035: .Fl t .
2036: .It mailerpath
2037: Path to mail program used to send warning mail.
2038: Defaults to the path to sendmail found at configure time.
2039: .It mailfrom
2040: Address to use for the
2041: .Dq from
2042: address when sending warning and error mail.
2043: The address should be enclosed in double quotes
2044: .Pq \&""
2045: to protect against
2046: .Nm sudo
2047: interpreting the
2048: .Li @
2049: sign.
2050: Defaults to the name of the user running
2051: .Nm sudo .
2052: .It mailto
2053: Address to send warning and error mail to.
2054: The address should be enclosed in double quotes
2055: .Pq \&""
2056: to protect against
2057: .Nm sudo
2058: interpreting the
2059: .Li @
2060: sign.
2061: Defaults to
2062: .Li @mailto@ .
2063: .It secure_path
2064: Path used for every command run from
2065: .Nm sudo .
2066: If you don't trust the
2067: people running
2068: .Nm sudo
2069: to have a sane
2070: .Ev PATH
2071: environment variable you may want to use this.
2072: Another use is if you want to have the
2073: .Dq root path
2074: be separate from the
2075: .Dq user path .
2076: Users in the group specified by the
2077: .Em exempt_group
2078: option are not affected by
2079: .Em secure_path .
2080: This option is @secure_path@ by default.
2081: .It syslog
2082: Syslog facility if syslog is being used for logging (negate to
2083: disable syslog logging).
2084: Defaults to
2085: .Li @logfac@ .
2086: .Pp
2087: The following syslog facilities are supported:
2088: .Sy authpriv
2089: (if your
2090: OS supports it),
2091: .Sy auth ,
2092: .Sy daemon ,
2093: .Sy user ,
2094: .Sy local0 ,
2095: .Sy local1 ,
2096: .Sy local2 ,
2097: .Sy local3 ,
2098: .Sy local4 ,
2099: .Sy local5 ,
2100: .Sy local6 ,
2101: and
2102: .Sy local7 .
2103: .It verifypw
2104: This option controls when a password will be required when a user runs
2105: .Nm sudo
2106: with the
2107: .Fl v
2108: option.
2109: It has the following possible values:
2110: .Bl -tag -width 6n
2111: .It all
2112: All the user's
2113: .Em sudoers
2114: entries for the current host must have the
2115: .Li NOPASSWD
2116: flag set to avoid entering a password.
2117: .It always
2118: The user must always enter a password to use the
2119: .Fl v
2120: option.
2121: .It any
2122: At least one of the user's
2123: .Em sudoers
2124: entries for the current host must have the
2125: .Li NOPASSWD
2126: flag set to avoid entering a password.
2127: .It never
2128: The user need never enter a password to use the
2129: .Fl v
2130: option.
2131: .El
2132: .Pp
2133: If no value is specified, a value of
2134: .Em all
2135: is implied.
2136: Negating the option results in a value of
2137: .Em never
2138: being used.
2139: The default value is
2140: .Em all .
2141: .El
2142: .Pp
2143: .Sy Lists that can be used in a boolean context :
2144: .Bl -tag -width 16n
2145: .It env_check
1.5 ! millert 2146: Environment variables to be removed from the user's environment
! 2147: unless they are considered
! 2148: .Dq safe .
! 2149: For all variables except
! 2150: Li TZ ,
! 2151: .Dq safe
! 2152: means that the variable's value does not contain any
1.1 millert 2153: the variable's value contains
2154: .Ql %
2155: or
2156: .Ql /
2157: characters.
2158: This can be used to guard against printf-style format vulnerabilities
2159: in poorly-written programs.
1.5 ! millert 2160: The
! 2161: .Li TZ
! 2162: variable is considerd unsafe if any of the following are true:
! 2163: .Bl -bullet
! 2164: .It
! 2165: It consists of a fully-qualified path name that does not match
! 2166: the location of the
! 2167: .Pa zoneinfo
! 2168: directory.
! 2169: .It
! 2170: It contains a
! 2171: .Pa ..
! 2172: path element.
! 2173: .It
! 2174: It contains white space or non-printable characters.
! 2175: .It
! 2176: It is longer than the value of
! 2177: .Li PATH_MAX .
! 2178: .El
! 2179: .Pp
1.1 millert 2180: The argument may be a double-quoted, space-separated list or a
2181: single value without double-quotes.
2182: The list can be replaced, added to, deleted from, or disabled by using
2183: the
2184: .Li = ,
2185: .Li += ,
2186: .Li -= ,
2187: and
2188: .Li \&!
2189: operators respectively.
2190: Regardless of whether the
2191: .Li env_reset
2192: option is enabled or disabled, variables specified by
2193: .Li env_check
2194: will be preserved in the environment if they pass the aforementioned check.
2195: The default list of environment variables to check is displayed when
2196: .Nm sudo
2197: is run by root with
2198: the
2199: .Fl V
2200: option.
2201: .It env_delete
2202: Environment variables to be removed from the user's environment when the
2203: .Em env_reset
2204: option is not in effect.
2205: The argument may be a double-quoted, space-separated list or a
2206: single value without double-quotes.
2207: The list can be replaced, added to, deleted from, or disabled by using the
2208: .Li = ,
2209: .Li += ,
2210: .Li -= ,
2211: and
2212: .Li \&!
2213: operators respectively.
2214: The default list of environment variables to remove is displayed when
2215: .Nm sudo
2216: is run by root with the
2217: .Fl V
2218: option.
2219: Note that many operating systems will remove potentially dangerous
2220: variables from the environment of any setuid process (such as
2221: .Nm sudo ) .
2222: .It env_keep
2223: Environment variables to be preserved in the user's environment when the
2224: .Em env_reset
2225: option is in effect.
2226: This allows fine-grained control over the environment
2227: .Nm sudo Ns No -spawned
2228: processes will receive.
2229: The argument may be a double-quoted, space-separated list or a
2230: single value without double-quotes.
2231: The list can be replaced, added to, deleted from, or disabled by using the
2232: .Li = ,
2233: .Li += ,
2234: .Li -= ,
2235: and
2236: .Li \&!
2237: operators respectively.
2238: The default list of variables to keep
2239: is displayed when
2240: .Nm sudo
2241: is run by root with the
2242: .Fl V
2243: option.
2244: .El
2245: .Sh FILES
2246: .Bl -tag -width 24n
2247: .It Pa @sysconfdir@/sudoers
2248: List of who can run what
2249: .It Pa /etc/group
2250: Local groups file
2251: .It Pa /etc/netgroup
2252: List of network groups
2253: .El
2254: .Sh EXAMPLES
2255: Below are example
2256: .Em sudoers
2257: entries.
2258: Admittedly, some of these are a bit contrived.
2259: First, we allow a few environment variables to pass and then define our
2260: .Em aliases :
2261: .Bd -literal
2262: # Run X applications through sudo; HOME is used to find the
2263: # .Xauthority file. Note that other programs use HOME to find
2264: # configuration files and this may lead to privilege escalation!
2265: Defaults env_keep += "DISPLAY HOME"
2266:
2267: # User alias specification
2268: User_Alias FULLTIMERS = millert, mikef, dowdy
2269: User_Alias PARTTIMERS = bostley, jwfox, crawl
2270: User_Alias WEBMASTERS = will, wendy, wim
2271:
2272: # Runas alias specification
2273: Runas_Alias OP = root, operator
2274: Runas_Alias DB = oracle, sybase
2275: Runas_Alias ADMINGRP = adm, oper
2276:
2277: # Host alias specification
2278: Host_Alias SPARC = bigtime, eclipse, moet, anchor :\e
2279: SGI = grolsch, dandelion, black :\e
2280: ALPHA = widget, thalamus, foobar :\e
2281: HPPA = boa, nag, python
2282: Host_Alias CUNETS = 128.138.0.0/255.255.0.0
2283: Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
2284: Host_Alias SERVERS = master, mail, www, ns
2285: Host_Alias CDROM = orion, perseus, hercules
2286:
2287: # Cmnd alias specification
2288: Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\e
2289: /usr/sbin/restore, /usr/sbin/rrestore
2290: Cmnd_Alias KILL = /usr/bin/kill
2291: Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
2292: Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
2293: Cmnd_Alias HALT = /usr/sbin/halt
2294: Cmnd_Alias REBOOT = /usr/sbin/reboot
2295: Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh,\e
2296: /usr/local/bin/tcsh, /usr/bin/rsh,\e
2297: /usr/local/bin/zsh
2298: Cmnd_Alias SU = /usr/bin/su
2299: Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
2300: .Ed
2301: .Pp
2302: Here we override some of the compiled in default values.
2303: We want
2304: .Nm sudo
2305: to log via
2306: .Xr syslog 3
2307: using the
2308: .Em auth
2309: facility in all cases.
2310: We don't want to subject the full time staff to the
2311: .Nm sudo
2312: lecture, user
2313: .Sy millert
2314: need not give a password, and we don't want to reset the
2315: .Ev LOGNAME ,
2316: .Ev USER
2317: or
2318: .Ev USERNAME
2319: environment variables when running commands as root.
2320: Additionally, on the machines in the
2321: .Em SERVERS
2322: .Li Host_Alias ,
2323: we keep an additional local log file and make sure we log the year
2324: in each log line since the log entries will be kept around for several years.
2325: Lastly, we disable shell escapes for the commands in the PAGERS
2326: .Li Cmnd_Alias
2327: .Po
2328: .Pa /usr/bin/more ,
2329: .Pa /usr/bin/pg
2330: and
2331: .Pa /usr/bin/less
2332: .Pc .
2333: .Bd -literal
2334: # Override built-in defaults
2335: Defaults syslog=auth
2336: Defaults>root !set_logname
2337: Defaults:FULLTIMERS !lecture
2338: Defaults:millert !authenticate
2339: Defaults@SERVERS log_year, logfile=/var/log/sudo.log
2340: Defaults!PAGERS noexec
2341: .Ed
2342: .Pp
2343: The
2344: .Em User specification
2345: is the part that actually determines who may run what.
2346: .Bd -literal
2347: root ALL = (ALL) ALL
2348: %wheel ALL = (ALL) ALL
2349: .Ed
2350: .Pp
2351: We let
2352: .Sy root
2353: and any user in group
2354: .Sy wheel
2355: run any command on any host as any user.
2356: .Bd -literal
2357: FULLTIMERS ALL = NOPASSWD: ALL
2358: .Ed
2359: .Pp
2360: Full time sysadmins
2361: .Po
2362: .Sy millert ,
2363: .Sy mikef ,
2364: and
2365: .Sy dowdy
2366: .Pc
2367: may run any command on any host without authenticating themselves.
2368: .Bd -literal
2369: PARTTIMERS ALL = ALL
2370: .Ed
2371: .Pp
2372: Part time sysadmins
2373: .Sy bostley ,
2374: .Sy jwfox ,
2375: and
2376: .Sy crawl )
2377: may run any command on any host but they must authenticate themselves
2378: first (since the entry lacks the
2379: .Li NOPASSWD
2380: tag).
2381: .Bd -literal
2382: jack CSNETS = ALL
2383: .Ed
2384: .Pp
2385: The user
2386: .Sy jack
2387: may run any command on the machines in the
2388: .Em CSNETS
2389: alias (the networks
2390: .Li 128.138.243.0 ,
2391: .Li 128.138.204.0 ,
2392: and
2393: .Li 128.138.242.0 ) .
2394: Of those networks, only
2395: .Li 128.138.204.0
2396: has an explicit netmask (in CIDR notation) indicating it is a class C network.
2397: For the other networks in
2398: .Em CSNETS ,
2399: the local machine's netmask will be used during matching.
2400: .Bd -literal
2401: lisa CUNETS = ALL
2402: .Ed
2403: .Pp
2404: The user
2405: .Sy lisa
2406: may run any command on any host in the
2407: .Em CUNETS
2408: alias (the class B network
2409: .Li 128.138.0.0 ) .
2410: .Bd -literal
2411: operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\e
2412: sudoedit /etc/printcap, /usr/oper/bin/
2413: .Ed
2414: .Pp
2415: The
2416: .Sy operator
2417: user may run commands limited to simple maintenance.
2418: Here, those are commands related to backups, killing processes, the
2419: printing system, shutting down the system, and any commands in the
2420: directory
2421: .Pa /usr/oper/bin/ .
2422: .Bd -literal
2423: joe ALL = /usr/bin/su operator
2424: .Ed
2425: .Pp
2426: The user
2427: .Sy joe
2428: may only
2429: .Xr su 1
2430: to operator.
2431: .Bd -literal
2432: pete HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root
2433:
2434: %opers ALL = (: ADMINGRP) /usr/sbin/
2435: .Ed
2436: .Pp
2437: Users in the
2438: .Sy opers
2439: group may run commands in
2440: .Pa /usr/sbin/
2441: as themselves
2442: with any group in the
2443: .Em ADMINGRP
2444: .Li Runas_Alias
2445: (the
2446: .Sy adm
2447: and
2448: .Sy oper
2449: groups).
2450: .Pp
2451: The user
2452: .Sy pete
2453: is allowed to change anyone's password except for
2454: root on the
2455: .Em HPPA
2456: machines.
2457: Note that this assumes
2458: .Xr passwd 1
2459: does not take multiple user names on the command line.
2460: .Bd -literal
2461: bob SPARC = (OP) ALL : SGI = (OP) ALL
2462: .Ed
2463: .Pp
2464: The user
2465: .Sy bob
2466: may run anything on the
2467: .Em SPARC
2468: and
2469: .Em SGI
2470: machines as any user listed in the
2471: .Em OP
2472: .Li Runas_Alias
2473: .Po
2474: .Sy root
2475: and
2476: .Sy operator .
2477: .Pc
2478: .Bd -literal
2479: jim +biglab = ALL
2480: .Ed
2481: .Pp
2482: The user
2483: .Sy jim
2484: may run any command on machines in the
2485: .Em biglab
2486: netgroup.
2487: .Nm sudo
2488: knows that
2489: .Dq biglab
2490: is a netgroup due to the
2491: .Ql +
2492: prefix.
2493: .Bd -literal
2494: +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
2495: .Ed
2496: .Pp
2497: Users in the
2498: .Sy secretaries
2499: netgroup need to help manage the printers as well as add and remove users,
2500: so they are allowed to run those commands on all machines.
2501: .Bd -literal
2502: fred ALL = (DB) NOPASSWD: ALL
2503: .Ed
2504: .Pp
2505: The user
2506: .Sy fred
2507: can run commands as any user in the
2508: .Em DB
2509: .Li Runas_Alias
2510: .Po
2511: .Sy oracle
2512: or
2513: .Sy sybase
2514: .Pc
2515: without giving a password.
2516: .Bd -literal
2517: john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
2518: .Ed
2519: .Pp
2520: On the
2521: .Em ALPHA
2522: machines, user
2523: .Sy john
2524: may su to anyone except root but he is not allowed to specify any options
2525: to the
2526: .Xr su 1
2527: command.
2528: .Bd -literal
2529: jen ALL, !SERVERS = ALL
2530: .Ed
2531: .Pp
2532: The user
2533: .Sy jen
2534: may run any command on any machine except for those in the
2535: .Em SERVERS
2536: .Li Host_Alias
2537: (master, mail, www and ns).
2538: .Bd -literal
2539: jill SERVERS = /usr/bin/, !SU, !SHELLS
2540: .Ed
2541: .Pp
2542: For any machine in the
2543: .Em SERVERS
2544: .Li Host_Alias ,
2545: .Sy jill
2546: may run
2547: any commands in the directory
2548: .Pa /usr/bin/
2549: except for those commands
2550: belonging to the
2551: .Em SU
2552: and
2553: .Em SHELLS
2554: .Li Cmnd_Aliases .
2555: .Bd -literal
2556: steve CSNETS = (operator) /usr/local/op_commands/
2557: .Ed
2558: .Pp
2559: The user
2560: .Sy steve
2561: may run any command in the directory /usr/local/op_commands/
2562: but only as user operator.
2563: .Bd -literal
2564: matt valkyrie = KILL
2565: .Ed
2566: .Pp
2567: On his personal workstation, valkyrie,
2568: .Sy matt
2569: needs to be able to kill hung processes.
2570: .Bd -literal
2571: WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
2572: .Ed
2573: .Pp
2574: On the host www, any user in the
2575: .Em WEBMASTERS
2576: .Li User_Alias
2577: (will, wendy, and wim), may run any command as user www (which owns the
2578: web pages) or simply
2579: .Xr su 1
2580: to www.
2581: .Bd -literal
2582: ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\e
1.3 ajacouto 2583: /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
1.1 millert 2584: .Ed
2585: .Pp
2586: Any user may mount or unmount a CD-ROM on the machines in the CDROM
2587: .Li Host_Alias
2588: (orion, perseus, hercules) without entering a password.
2589: This is a bit tedious for users to type, so it is a prime candidate
2590: for encapsulating in a shell script.
2591: .Sh SECURITY NOTES
2592: .Ss Limitations of the So !\& Sc operator
2593: It is generally not effective to
2594: .Dq subtract
2595: commands from
2596: .Sy ALL
2597: using the
2598: .Ql !\&
2599: operator.
2600: A user can trivially circumvent this by copying the desired command
2601: to a different name and then executing that.
2602: For example:
2603: .Bd -literal
2604: bill ALL = ALL, !SU, !SHELLS
2605: .Ed
2606: .Pp
2607: Doesn't really prevent
2608: .Sy bill
2609: from running the commands listed in
2610: .Em SU
2611: or
2612: .Em SHELLS
2613: since he can simply copy those commands to a different name, or use
2614: a shell escape from an editor or other program.
2615: Therefore, these kind of restrictions should be considered
2616: advisory at best (and reinforced by policy).
2617: .Pp
2618: In general, if a user has sudo
2619: .Sy ALL
2620: there is nothing to prevent them from creating their own program that gives
2621: them a root shell (or making their own copy of a shell) regardless of any
2622: .Ql !\&
2623: elements in the user specification.
2624: .Ss Security implications of Em fast_glob
2625: If the
2626: .Em fast_glob
2627: option is in use, it is not possible to reliably negate commands where the
2628: path name includes globbing (aka wildcard) characters.
2629: This is because the C library's
2630: .Xr fnmatch 3
2631: function cannot resolve relative paths.
2632: While this is typically only an inconvenience for rules that grant privileges,
2633: it can result in a security issue for rules that subtract or revoke privileges.
2634: .Pp
2635: For example, given the following
2636: .Em sudoers
2637: entry:
2638: .Bd -literal
2639: john ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,\e
2640: /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
2641: .Ed
2642: .Pp
2643: User
2644: .Sy john
2645: can still run
2646: .Li /usr/bin/passwd root
2647: if
2648: .Em fast_glob
2649: is enabled by changing to
2650: .Pa /usr/bin
2651: and running
2652: .Li ./passwd root
2653: instead.
2654: .Ss Preventing Shell Escapes
2655: Once
2656: .Nm sudo
2657: executes a program, that program is free to do whatever
2658: it pleases, including run other programs.
2659: This can be a security issue since it is not uncommon for a program to
2660: allow shell escapes, which lets a user bypass
2661: .Nm sudo Ns No 's
2662: access control and logging.
2663: Common programs that permit shell escapes include shells (obviously),
2664: editors, paginators, mail and terminal programs.
2665: .Pp
2666: There are two basic approaches to this problem:
2667: .Bl -tag -width 8n
2668: .It restrict
2669: Avoid giving users access to commands that allow the user to run
2670: arbitrary commands.
2671: Many editors have a restricted mode where shell
2672: escapes are disabled, though
2673: .Nm sudoedit
2674: is a better solution to
2675: running editors via
2676: .Nm sudo .
2677: Due to the large number of programs that
2678: offer shell escapes, restricting users to the set of programs that
2679: do not is often unworkable.
2680: .It noexec
2681: Many systems that support shared libraries have the ability to
2682: override default library functions by pointing an environment
2683: variable (usually
2684: .Ev LD_PRELOAD )
2685: to an alternate shared library.
2686: On such systems,
2687: .Nm sudo Ns No 's
2688: .Em noexec
2689: functionality can be used to prevent a program run by
2690: .Nm sudo
2691: from executing any other programs.
2692: Note, however, that this applies only to native dynamically-linked
2693: executables.
2694: Statically-linked executables and foreign executables
2695: running under binary emulation are not affected.
2696: .Pp
2697: The
2698: .Em noexec
2699: feature is known to work on SunOS, Solaris, *BSD,
2700: Linux, IRIX, Tru64 UNIX, MacOS X, HP-UX 11.x and AIX 5.3 and above.
2701: It should be supported on most operating systems that support the
2702: .Ev LD_PRELOAD
2703: environment variable.
2704: Check your operating system's manual pages for the dynamic linker
2705: (usually ld.so, ld.so.1, dyld, dld.sl, rld, or loader) to see if
2706: .Ev LD_PRELOAD
2707: is supported.
2708: .Pp
2709: To enable
2710: .Em noexec
2711: for a command, use the
2712: .Li NOEXEC
2713: tag as documented
2714: in the User Specification section above.
2715: Here is that example again:
2716: .Bd -literal
2717: aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
2718: .Ed
2719: .Pp
2720: This allows user
2721: .Sy aaron
2722: to run
2723: .Pa /usr/bin/more
2724: and
2725: .Pa /usr/bin/vi
2726: with
2727: .Em noexec
2728: enabled.
2729: This will prevent those two commands from
2730: executing other commands (such as a shell).
2731: If you are unsure whether or not your system is capable of supporting
2732: .Em noexec
2733: you can always just try it out and check whether shell escapes work when
2734: .Em noexec
2735: is enabled.
2736: .El
2737: .Pp
2738: Note that restricting shell escapes is not a panacea.
2739: Programs running as root are still capable of many potentially hazardous
2740: operations (such as changing or overwriting files) that could lead
2741: to unintended privilege escalation.
2742: In the specific case of an editor, a safer approach is to give the
2743: user permission to run
2744: .Nm sudoedit .
2745: .Sh SEE ALSO
2746: .Xr ssh 1 ,
2747: .Xr su 1 ,
2748: .Xr fnmatch 3 ,
2749: .Xr glob 3 ,
2750: .Xr mktemp 3 ,
2751: .Xr strftime 3 ,
2752: .Xr sudoers.ldap @mansectform@ ,
2753: .Xr sudo @mansectsu@ ,
2754: .Xr visudo @mansectsu@
2755: .Sh CAVEATS
2756: The
2757: .Em sudoers
2758: file should
2759: .Sy always
2760: be edited by the
2761: .Nm visudo
2762: command which locks the file and does grammatical checking.
2763: It is
2764: imperative that
2765: .Em sudoers
2766: be free of syntax errors since
2767: .Nm sudo
2768: will not run with a syntactically incorrect
2769: .Em sudoers
2770: file.
2771: .Pp
2772: When using netgroups of machines (as opposed to users), if you
2773: store fully qualified host name in the netgroup (as is usually the
2774: case), you either need to have the machine's host name be fully qualified
2775: as returned by the
2776: .Li hostname
2777: command or use the
2778: .Em fqdn
2779: option in
2780: .Em sudoers .
2781: .Sh BUGS
2782: If you feel you have found a bug in
2783: .Nm sudo ,
2784: please submit a bug report at http://www.sudo.ws/sudo/bugs/
2785: .Sh SUPPORT
2786: Limited free support is available via the sudo-users mailing list,
2787: see http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
2788: search the archives.
2789: .Sh DISCLAIMER
2790: .Nm sudo
2791: is provided
2792: .Dq AS IS
2793: and any express or implied warranties, including, but not limited
2794: to, the implied warranties of merchantability and fitness for a
2795: particular purpose are disclaimed.
2796: See the LICENSE file distributed with
2797: .Nm sudo
2798: or http://www.sudo.ws/sudo/license.html for complete details.
![[BACK]](/icons/back.gif){kind=icon}
Return to sudoers.mdoc.in CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / sudo