Annotation of src/usr.bin/sudo/visudo.8, Revision 1.10
1.10 ! millert 1: .\" Copyright (c) 1996,1998-2003 Todd C. Miller <Todd.Miller@courtesan.com>
1.9 millert 2: .\" All rights reserved.
3: .\"
4: .\" Redistribution and use in source and binary forms, with or without
5: .\" modification, are permitted provided that the following conditions
6: .\" are met:
7: .\"
8: .\" 1. Redistributions of source code must retain the above copyright
9: .\" notice, this list of conditions and the following disclaimer.
10: .\"
11: .\" 2. Redistributions in binary form must reproduce the above copyright
12: .\" notice, this list of conditions and the following disclaimer in the
13: .\" documentation and/or other materials provided with the distribution.
14: .\"
15: .\" 3. The name of the author may not be used to endorse or promote products
16: .\" derived from this software without specific prior written permission
17: .\" from the author.
18: .\"
19: .\" 4. Products derived from this software may not be called "Sudo" nor
20: .\" may "Sudo" appear in their names without specific prior written
21: .\" permission from the author.
22: .\"
23: .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
24: .\" INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
25: .\" AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
26: .\" THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
27: .\" EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28: .\" PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
29: .\" OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
30: .\" WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
31: .\" OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
32: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.10 ! millert 33: .\"
! 34: .\" $Sudo: visudo.man.in,v 1.14 2003/03/15 20:33:31 millert Exp $
! 35: .\" Automatically generated by Pod::Man v1.34, Pod::Parser v1.13
1.5 millert 36: .\"
37: .\" Standard preamble:
1.10 ! millert 38: .\" ========================================================================
1.5 millert 39: .de Sh \" Subsection heading
1.1 millert 40: .br
41: .if t .Sp
42: .ne 5
43: .PP
44: \fB\\$1\fR
45: .PP
46: ..
1.5 millert 47: .de Sp \" Vertical space (when we can't use .PP)
1.1 millert 48: .if t .sp .5v
49: .if n .sp
50: ..
1.5 millert 51: .de Vb \" Begin verbatim text
1.1 millert 52: .ft CW
53: .nf
54: .ne \\$1
55: ..
1.5 millert 56: .de Ve \" End verbatim text
1.1 millert 57: .ft R
58: .fi
59: ..
1.5 millert 60: .\" Set up some character translations and predefined strings. \*(-- will
61: .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
62: .\" double quote, and \*(R" will give a right double quote. | will give a
1.10 ! millert 63: .\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used to
! 64: .\" do unbreakable dashes and therefore won't be available. \*(C` and \*(C'
! 65: .\" expand to `' in nroff, nothing in troff, for use with C<>.
1.1 millert 66: .tr \(*W-|\(bv\*(Tr
1.5 millert 67: .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
1.1 millert 68: .ie n \{\
1.5 millert 69: . ds -- \(*W-
70: . ds PI pi
71: . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
72: . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
73: . ds L" ""
74: . ds R" ""
75: . ds C`
76: . ds C'
1.1 millert 77: 'br\}
78: .el\{\
1.5 millert 79: . ds -- \|\(em\|
80: . ds PI \(*p
81: . ds L" ``
82: . ds R" ''
1.1 millert 83: 'br\}
1.5 millert 84: .\"
1.10 ! millert 85: .\" If the F register is turned on, we'll generate index entries on stderr for
! 86: .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
! 87: .\" entries marked with X<> in POD. Of course, you'll have to process the
! 88: .\" output yourself in some meaningful fashion.
1.5 millert 89: .if \nF \{\
90: . de IX
91: . tm Index:\\$1\t\\n%\t"\\$2"
1.1 millert 92: ..
1.5 millert 93: . nr % 0
94: . rr F
1.1 millert 95: .\}
1.5 millert 96: .\"
1.10 ! millert 97: .\" For nroff, turn off justification. Always turn off hyphenation; it makes
! 98: .\" way too many mistakes in technical documents.
1.5 millert 99: .hy 0
1.1 millert 100: .if n .na
1.5 millert 101: .\"
102: .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
103: .\" Fear. Run. Save yourself. No user-serviceable parts.
104: . \" fudge factors for nroff and troff
1.1 millert 105: .if n \{\
1.5 millert 106: . ds #H 0
107: . ds #V .8m
108: . ds #F .3m
109: . ds #[ \f1
110: . ds #] \fP
1.1 millert 111: .\}
112: .if t \{\
1.5 millert 113: . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
114: . ds #V .6m
115: . ds #F 0
116: . ds #[ \&
117: . ds #] \&
1.1 millert 118: .\}
1.5 millert 119: . \" simple accents for nroff and troff
1.1 millert 120: .if n \{\
1.5 millert 121: . ds ' \&
122: . ds ` \&
123: . ds ^ \&
124: . ds , \&
125: . ds ~ ~
126: . ds /
1.1 millert 127: .\}
128: .if t \{\
1.5 millert 129: . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
130: . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
131: . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
132: . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
133: . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
134: . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
1.1 millert 135: .\}
1.5 millert 136: . \" troff and (daisy-wheel) nroff accents
1.1 millert 137: .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
138: .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
139: .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
140: .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
141: .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
142: .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
143: .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
144: .ds ae a\h'-(\w'a'u*4/10)'e
145: .ds Ae A\h'-(\w'A'u*4/10)'E
1.5 millert 146: . \" corrections for vroff
1.1 millert 147: .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
148: .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
1.5 millert 149: . \" for low resolution devices (crt and lpr)
1.1 millert 150: .if \n(.H>23 .if \n(.V>19 \
151: \{\
1.5 millert 152: . ds : e
153: . ds 8 ss
154: . ds o a
155: . ds d- d\h'-1'\(ga
156: . ds D- D\h'-1'\(hy
157: . ds th \o'bp'
158: . ds Th \o'LP'
159: . ds ae ae
160: . ds Ae AE
1.1 millert 161: .\}
162: .rm #[ #] #H #V #F C
1.10 ! millert 163: .\" ========================================================================
1.5 millert 164: .\"
1.10 ! millert 165: .IX Title "VISUDO 8"
! 166: .TH VISUDO 8 "March 13, 2003" "1.6.7" "MAINTENANCE COMMANDS"
1.1 millert 167: .SH "NAME"
168: visudo \- edit the sudoers file
169: .SH "SYNOPSIS"
1.5 millert 170: .IX Header "SYNOPSIS"
171: \&\fBvisudo\fR [ \fB\-c\fR ] [ \fB\-f\fR \fIsudoers\fR ] [ \fB\-q\fR ] [ \fB\-s\fR ] [ \fB\-V\fR ]
1.1 millert 172: .SH "DESCRIPTION"
1.5 millert 173: .IX Header "DESCRIPTION"
174: \&\fBvisudo\fR edits the \fIsudoers\fR file in a safe fashion, analogous to
175: \&\fIvipw\fR\|(8). \fBvisudo\fR locks the \fIsudoers\fR file against multiple
1.1 millert 176: simultaneous edits, provides basic sanity checks, and checks
177: for parse errors. If the \fIsudoers\fR file is currently being
1.5 millert 178: edited you will receive a message to try again later.
179: .PP
180: There is a hard-coded list of editors that \fBvisudo\fR will use set
181: at compile-time that may be overridden via the \fIeditor\fR \fIsudoers\fR
182: \&\f(CW\*(C`Default\*(C'\fR variable. This list defaults to the path to \fIvi\fR\|(1) on
183: your system, as determined by the \fIconfigure\fR script. Normally,
184: \&\fBvisudo\fR does not honor the \f(CW\*(C`EDITOR\*(C'\fR or \f(CW\*(C`VISUAL\*(C'\fR environment
185: variables unless they contain an editor in the aforementioned editors
1.10 ! millert 186: list. However, if \fBvisudo\fR is configured with the \fI\-\-with\-enveditor\fR
1.5 millert 187: flag or the \fIenveditor\fR \f(CW\*(C`Default\*(C'\fR variable is set in \fIsudoers\fR,
188: \&\fBvisudo\fR will use any the editor defines by \f(CW\*(C`EDITOR\*(C'\fR or \f(CW\*(C`VISUAL\*(C'\fR.
189: Note that this can be a security hole since it allows the user to
190: execute any program they wish simply by setting \f(CW\*(C`EDITOR\*(C'\fR or \f(CW\*(C`VISUAL\*(C'\fR.
1.1 millert 191: .PP
1.5 millert 192: \&\fBvisudo\fR parses the \fIsudoers\fR file after the edit and will
1.1 millert 193: not save the changes if there is a syntax error. Upon finding
1.10 ! millert 194: an error, \fBvisudo\fR will print a message stating the line number(s)
1.5 millert 195: where the error occurred and the user will receive the
196: \&\*(L"What now?\*(R" prompt. At this point the user may enter \*(L"e\*(R"
1.4 pjanzen 197: to re-edit the \fIsudoers\fR file, \*(L"x\*(R" to exit without
1.1 millert 198: saving the changes, or \*(L"Q\*(R" to quit and save changes. The
1.5 millert 199: \&\*(L"Q\*(R" option should be used with extreme care because if \fBvisudo\fR
1.1 millert 200: believes there to be a parse error, so will \fBsudo\fR and no one
1.5 millert 201: will be able to \fBsudo\fR again until the error is fixed.
202: If \*(L"e\*(R" is typed to edit the \fIsudoers\fR file after a parse error
203: has been detected, the cursor will be placed on the line where the
204: error occurred (if the editor supports this feature).
1.1 millert 205: .SH "OPTIONS"
1.5 millert 206: .IX Header "OPTIONS"
207: \&\fBvisudo\fR accepts the following command line options:
1.10 ! millert 208: .IP "\-c" 4
1.5 millert 209: .IX Item "-c"
210: Enable \fBcheck-only\fR mode. The existing \fIsudoers\fR file will be
211: checked for syntax and a message will be printed to the
212: standard output detailing the status of \fIsudoers\fR.
213: If the syntax check completes successfully, \fBvisudo\fR will
214: exit with a value of 0. If a syntax error is encountered,
215: \&\fBvisudo\fR will exit with a value of 1.
1.10 ! millert 216: .IP "\-f" 4
1.5 millert 217: .IX Item "-f"
218: Specify and alternate \fIsudoers\fR file location. With this option
219: \&\fBvisudo\fR will edit (or check) the \fIsudoers\fR file of your choice,
220: instead of the default, \f(CW@sysconfdir\fR@/sudoers. The lock file used
221: is the specified \fIsudoers\fR file with \*(L".tmp\*(R" appended to it.
1.10 ! millert 222: .IP "\-q" 4
1.5 millert 223: .IX Item "-q"
224: Enable \fBquiet\fR mode. In this mode details about syntax errors
225: are not printed. This option is only useful when combined with
226: the \fB\-c\fR flag.
1.10 ! millert 227: .IP "\-s" 4
1.5 millert 228: .IX Item "-s"
1.1 millert 229: Enable \fBstrict\fR checking of the \fIsudoers\fR file. If an alias is
230: used before it is defined, \fBvisudo\fR will consider this a parse
231: error. Note that it is not possible to differentiate between an
1.5 millert 232: alias and a hostname or username that consists solely of uppercase
1.1 millert 233: letters, digits, and the underscore ('_') character.
1.10 ! millert 234: .IP "\-V" 4
1.5 millert 235: .IX Item "-V"
236: The \fB\-V\fR (version) option causes \fBvisudo\fR to print its version number
1.1 millert 237: and exit.
238: .SH "ERRORS"
1.5 millert 239: .IX Header "ERRORS"
1.10 ! millert 240: .IP "sudoers file busy, try again later." 4
1.5 millert 241: .IX Item "sudoers file busy, try again later."
1.1 millert 242: Someone else is currently editing the \fIsudoers\fR file.
1.10 ! millert 243: .IP "/etc/sudoers.tmp: Permission denied" 4
1.5 millert 244: .IX Item "/etc/sudoers.tmp: Permission denied"
1.1 millert 245: You didn't run \fBvisudo\fR as root.
1.10 ! millert 246: .IP "Can't find you in the passwd database" 4
1.5 millert 247: .IX Item "Can't find you in the passwd database"
1.1 millert 248: Your userid does not appear in the system passwd file.
1.10 ! millert 249: .IP "Warning: undeclared Alias referenced near ..." 4
1.5 millert 250: .IX Item "Warning: undeclared Alias referenced near ..."
1.1 millert 251: Either you are using a {User,Runas,Host,Cmnd}_Alias before
252: defining it or you have a user or hostname listed that
1.5 millert 253: consists solely of uppercase letters, digits, and the
1.1 millert 254: underscore ('_') character. If the latter, you can ignore
255: the warnings (\fBsudo\fR will not complain). In \fB\-s\fR (strict)
1.4 pjanzen 256: mode these are errors, not warnings.
1.1 millert 257: .SH "ENVIRONMENT"
1.5 millert 258: .IX Header "ENVIRONMENT"
1.1 millert 259: The following environment variables are used only if \fBvisudo\fR
1.10 ! millert 260: was configured with the \fI\-\-with\-env\-editor\fR option:
1.2 millert 261: .PP
1.1 millert 262: .Vb 2
1.5 millert 263: \& EDITOR Invoked by visudo as the editor to use
264: \& VISUAL Used Invoked visudo if EDITOR is not set
1.1 millert 265: .Ve
266: .SH "FILES"
1.5 millert 267: .IX Header "FILES"
1.1 millert 268: .Vb 2
269: \& /etc/sudoers List of who can run what
270: \& /etc/sudoers.tmp Lock file for visudo
271: .Ve
272: .SH "AUTHOR"
1.5 millert 273: .IX Header "AUTHOR"
274: Many people have worked on \fIsudo\fR over the years; this version of
275: \&\fBvisudo\fR was written by:
1.2 millert 276: .PP
1.1 millert 277: .Vb 1
278: \& Todd Miller <Todd.Miller@courtesan.com>
279: .Ve
1.10 ! millert 280: .PP
1.5 millert 281: See the \s-1HISTORY\s0 file in the sudo distribution or visit
1.6 millert 282: http://www.sudo.ws/sudo/history.html for more details.
1.1 millert 283: .SH "BUGS"
1.5 millert 284: .IX Header "BUGS"
1.1 millert 285: If you feel you have found a bug in sudo, please submit a bug report
1.6 millert 286: at http://www.sudo.ws/sudo/bugs/
1.1 millert 287: .SH "DISCLAIMER"
1.5 millert 288: .IX Header "DISCLAIMER"
289: \&\fBVisudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
1.1 millert 290: including, but not limited to, the implied warranties of merchantability
291: and fitness for a particular purpose are disclaimed.
1.5 millert 292: See the \s-1LICENSE\s0 file distributed with \fBsudo\fR for complete details.
1.1 millert 293: .SH "CAVEATS"
1.5 millert 294: .IX Header "CAVEATS"
1.1 millert 295: There is no easy way to prevent a user from gaining a root shell if
296: the editor used by \fBvisudo\fR allows shell escapes.
297: .SH "SEE ALSO"
298: .IX Header "SEE ALSO"
1.10 ! millert 299: \&\fIvi\fR\|(1), \fIsudoers\fR\|(5), \fIsudo\fR\|(8), \fIvipw\fR\|(8)
![[BACK]](/icons/back.gif){kind=icon}
Return to visudo.8 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / sudo