Annotation of src/usr.bin/sudo/visudo.8, Revision 1.15
1.10 millert 1: .\" Copyright (c) 1996,1998-2003 Todd C. Miller <Todd.Miller@courtesan.com>
1.9 millert 2: .\"
1.11 millert 3: .\" Permission to use, copy, modify, and distribute this software for any
4: .\" purpose with or without fee is hereby granted, provided that the above
5: .\" copyright notice and this permission notice appear in all copies.
1.9 millert 6: .\"
1.11 millert 7: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
10: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
13: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.9 millert 15: .\"
1.11 millert 16: .\" Sponsored in part by the Defense Advanced Research Projects
17: .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
18: .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
1.9 millert 19: .\"
1.11 millert 20: .\" $Sudo: visudo.man.in,v 1.21 2004/09/06 20:46:28 millert Exp $
21: .\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.14
1.5 millert 22: .\"
23: .\" Standard preamble:
1.10 millert 24: .\" ========================================================================
1.5 millert 25: .de Sh \" Subsection heading
1.1 millert 26: .br
27: .if t .Sp
28: .ne 5
29: .PP
30: \fB\\$1\fR
31: .PP
32: ..
1.5 millert 33: .de Sp \" Vertical space (when we can't use .PP)
1.1 millert 34: .if t .sp .5v
35: .if n .sp
36: ..
1.5 millert 37: .de Vb \" Begin verbatim text
1.1 millert 38: .ft CW
39: .nf
40: .ne \\$1
41: ..
1.5 millert 42: .de Ve \" End verbatim text
1.1 millert 43: .ft R
44: .fi
45: ..
1.5 millert 46: .\" Set up some character translations and predefined strings. \*(-- will
47: .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
48: .\" double quote, and \*(R" will give a right double quote. | will give a
1.10 millert 49: .\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used to
50: .\" do unbreakable dashes and therefore won't be available. \*(C` and \*(C'
51: .\" expand to `' in nroff, nothing in troff, for use with C<>.
1.1 millert 52: .tr \(*W-|\(bv\*(Tr
1.5 millert 53: .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
1.1 millert 54: .ie n \{\
1.5 millert 55: . ds -- \(*W-
56: . ds PI pi
57: . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
58: . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
59: . ds L" ""
60: . ds R" ""
61: . ds C`
62: . ds C'
1.1 millert 63: 'br\}
64: .el\{\
1.5 millert 65: . ds -- \|\(em\|
66: . ds PI \(*p
67: . ds L" ``
68: . ds R" ''
1.1 millert 69: 'br\}
1.5 millert 70: .\"
1.10 millert 71: .\" If the F register is turned on, we'll generate index entries on stderr for
72: .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
73: .\" entries marked with X<> in POD. Of course, you'll have to process the
74: .\" output yourself in some meaningful fashion.
1.5 millert 75: .if \nF \{\
76: . de IX
77: . tm Index:\\$1\t\\n%\t"\\$2"
1.1 millert 78: ..
1.5 millert 79: . nr % 0
80: . rr F
1.1 millert 81: .\}
1.5 millert 82: .\"
1.10 millert 83: .\" For nroff, turn off justification. Always turn off hyphenation; it makes
84: .\" way too many mistakes in technical documents.
1.5 millert 85: .hy 0
1.1 millert 86: .if n .na
1.5 millert 87: .\"
88: .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
89: .\" Fear. Run. Save yourself. No user-serviceable parts.
90: . \" fudge factors for nroff and troff
1.1 millert 91: .if n \{\
1.5 millert 92: . ds #H 0
93: . ds #V .8m
94: . ds #F .3m
95: . ds #[ \f1
96: . ds #] \fP
1.1 millert 97: .\}
98: .if t \{\
1.5 millert 99: . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
100: . ds #V .6m
101: . ds #F 0
102: . ds #[ \&
103: . ds #] \&
1.1 millert 104: .\}
1.5 millert 105: . \" simple accents for nroff and troff
1.1 millert 106: .if n \{\
1.5 millert 107: . ds ' \&
108: . ds ` \&
109: . ds ^ \&
110: . ds , \&
111: . ds ~ ~
112: . ds /
1.1 millert 113: .\}
114: .if t \{\
1.5 millert 115: . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
116: . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
117: . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
118: . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
119: . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
120: . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
1.1 millert 121: .\}
1.5 millert 122: . \" troff and (daisy-wheel) nroff accents
1.1 millert 123: .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
124: .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
125: .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
126: .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
127: .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
128: .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
129: .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
130: .ds ae a\h'-(\w'a'u*4/10)'e
131: .ds Ae A\h'-(\w'A'u*4/10)'E
1.5 millert 132: . \" corrections for vroff
1.1 millert 133: .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
134: .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
1.5 millert 135: . \" for low resolution devices (crt and lpr)
1.1 millert 136: .if \n(.H>23 .if \n(.V>19 \
137: \{\
1.5 millert 138: . ds : e
139: . ds 8 ss
140: . ds o a
141: . ds d- d\h'-1'\(ga
142: . ds D- D\h'-1'\(hy
143: . ds th \o'bp'
144: . ds Th \o'LP'
145: . ds ae ae
146: . ds Ae AE
1.1 millert 147: .\}
148: .rm #[ #] #H #V #F C
1.10 millert 149: .\" ========================================================================
1.5 millert 150: .\"
1.10 millert 151: .IX Title "VISUDO 8"
1.15 ! millert 152: .TH VISUDO 8 "February 5, 2005" "1.6.8p7" "MAINTENANCE COMMANDS"
1.1 millert 153: .SH "NAME"
154: visudo \- edit the sudoers file
155: .SH "SYNOPSIS"
1.5 millert 156: .IX Header "SYNOPSIS"
157: \&\fBvisudo\fR [ \fB\-c\fR ] [ \fB\-f\fR \fIsudoers\fR ] [ \fB\-q\fR ] [ \fB\-s\fR ] [ \fB\-V\fR ]
1.1 millert 158: .SH "DESCRIPTION"
1.5 millert 159: .IX Header "DESCRIPTION"
160: \&\fBvisudo\fR edits the \fIsudoers\fR file in a safe fashion, analogous to
1.11 millert 161: vipw(8). \fBvisudo\fR locks the \fIsudoers\fR file against multiple
1.1 millert 162: simultaneous edits, provides basic sanity checks, and checks
163: for parse errors. If the \fIsudoers\fR file is currently being
1.5 millert 164: edited you will receive a message to try again later.
165: .PP
166: There is a hard-coded list of editors that \fBvisudo\fR will use set
167: at compile-time that may be overridden via the \fIeditor\fR \fIsudoers\fR
168: \&\f(CW\*(C`Default\*(C'\fR variable. This list defaults to the path to \fIvi\fR\|(1) on
169: your system, as determined by the \fIconfigure\fR script. Normally,
1.11 millert 170: \&\fBvisudo\fR does not honor the \f(CW\*(C`VISUAL\*(C'\fR or \f(CW\*(C`EDITOR\*(C'\fR environment
1.5 millert 171: variables unless they contain an editor in the aforementioned editors
1.10 millert 172: list. However, if \fBvisudo\fR is configured with the \fI\-\-with\-enveditor\fR
1.5 millert 173: flag or the \fIenveditor\fR \f(CW\*(C`Default\*(C'\fR variable is set in \fIsudoers\fR,
1.11 millert 174: \&\fBvisudo\fR will use any the editor defines by \f(CW\*(C`VISUAL\*(C'\fR or \f(CW\*(C`EDITOR\*(C'\fR.
1.5 millert 175: Note that this can be a security hole since it allows the user to
1.11 millert 176: execute any program they wish simply by setting \f(CW\*(C`VISUAL\*(C'\fR or \f(CW\*(C`EDITOR\*(C'\fR.
1.1 millert 177: .PP
1.5 millert 178: \&\fBvisudo\fR parses the \fIsudoers\fR file after the edit and will
1.1 millert 179: not save the changes if there is a syntax error. Upon finding
1.10 millert 180: an error, \fBvisudo\fR will print a message stating the line number(s)
1.5 millert 181: where the error occurred and the user will receive the
182: \&\*(L"What now?\*(R" prompt. At this point the user may enter \*(L"e\*(R"
1.4 pjanzen 183: to re-edit the \fIsudoers\fR file, \*(L"x\*(R" to exit without
1.1 millert 184: saving the changes, or \*(L"Q\*(R" to quit and save changes. The
1.5 millert 185: \&\*(L"Q\*(R" option should be used with extreme care because if \fBvisudo\fR
1.1 millert 186: believes there to be a parse error, so will \fBsudo\fR and no one
1.5 millert 187: will be able to \fBsudo\fR again until the error is fixed.
188: If \*(L"e\*(R" is typed to edit the \fIsudoers\fR file after a parse error
189: has been detected, the cursor will be placed on the line where the
190: error occurred (if the editor supports this feature).
1.1 millert 191: .SH "OPTIONS"
1.5 millert 192: .IX Header "OPTIONS"
193: \&\fBvisudo\fR accepts the following command line options:
1.10 millert 194: .IP "\-c" 4
1.5 millert 195: .IX Item "-c"
196: Enable \fBcheck-only\fR mode. The existing \fIsudoers\fR file will be
197: checked for syntax and a message will be printed to the
198: standard output detailing the status of \fIsudoers\fR.
199: If the syntax check completes successfully, \fBvisudo\fR will
200: exit with a value of 0. If a syntax error is encountered,
201: \&\fBvisudo\fR will exit with a value of 1.
1.10 millert 202: .IP "\-f" 4
1.5 millert 203: .IX Item "-f"
204: Specify and alternate \fIsudoers\fR file location. With this option
205: \&\fBvisudo\fR will edit (or check) the \fIsudoers\fR file of your choice,
1.11 millert 206: instead of the default, \fI/etc/sudoers\fR. The lock file used
1.5 millert 207: is the specified \fIsudoers\fR file with \*(L".tmp\*(R" appended to it.
1.10 millert 208: .IP "\-q" 4
1.5 millert 209: .IX Item "-q"
210: Enable \fBquiet\fR mode. In this mode details about syntax errors
211: are not printed. This option is only useful when combined with
212: the \fB\-c\fR flag.
1.10 millert 213: .IP "\-s" 4
1.5 millert 214: .IX Item "-s"
1.1 millert 215: Enable \fBstrict\fR checking of the \fIsudoers\fR file. If an alias is
216: used before it is defined, \fBvisudo\fR will consider this a parse
217: error. Note that it is not possible to differentiate between an
1.5 millert 218: alias and a hostname or username that consists solely of uppercase
1.1 millert 219: letters, digits, and the underscore ('_') character.
1.10 millert 220: .IP "\-V" 4
1.5 millert 221: .IX Item "-V"
222: The \fB\-V\fR (version) option causes \fBvisudo\fR to print its version number
1.1 millert 223: and exit.
1.11 millert 224: .SH "ENVIRONMENT"
225: .IX Header "ENVIRONMENT"
226: The following environment variables are used only if \fBvisudo\fR
227: was configured with the \fI\-\-with\-env\-editor\fR option:
228: .PP
229: .Vb 2
230: \& VISUAL Invoked by visudo as the editor to use
231: \& EDITOR Used by visudo if VISUAL is not set
232: .Ve
233: .SH "FILES"
234: .IX Header "FILES"
235: .Vb 2
236: \& /etc/sudoers List of who can run what
237: \& /etc/sudoers.tmp Lock file for visudo
238: .Ve
239: .SH "DIAGNOSTICS"
240: .IX Header "DIAGNOSTICS"
1.10 millert 241: .IP "sudoers file busy, try again later." 4
1.5 millert 242: .IX Item "sudoers file busy, try again later."
1.1 millert 243: Someone else is currently editing the \fIsudoers\fR file.
1.10 millert 244: .IP "/etc/sudoers.tmp: Permission denied" 4
1.5 millert 245: .IX Item "/etc/sudoers.tmp: Permission denied"
1.1 millert 246: You didn't run \fBvisudo\fR as root.
1.10 millert 247: .IP "Can't find you in the passwd database" 4
1.5 millert 248: .IX Item "Can't find you in the passwd database"
1.1 millert 249: Your userid does not appear in the system passwd file.
1.10 millert 250: .IP "Warning: undeclared Alias referenced near ..." 4
1.5 millert 251: .IX Item "Warning: undeclared Alias referenced near ..."
1.1 millert 252: Either you are using a {User,Runas,Host,Cmnd}_Alias before
253: defining it or you have a user or hostname listed that
1.5 millert 254: consists solely of uppercase letters, digits, and the
1.1 millert 255: underscore ('_') character. If the latter, you can ignore
256: the warnings (\fBsudo\fR will not complain). In \fB\-s\fR (strict)
1.4 pjanzen 257: mode these are errors, not warnings.
1.11 millert 258: .IP "Warning: runas_default set after old value is in use ..." 4
259: .IX Item "Warning: runas_default set after old value is in use ..."
260: You have a \fIrunas_default\fR Defaults setting listed in the \fIsudoers\fR
261: file after its value has already been used. This means that entries
262: prior to the \fIrunas_default\fR setting will match based on the default
263: value of \fIrunas_default\fR (\f(CW\*(C`root\*(C'\fR) whereas entries
264: \&\fBafter\fR the \fIrunas_default\fR setting will match based on the new
265: value. This is usually unintentional and in most cases the
266: <runas_default> setting should be placed before any \f(CW\*(C`Runas_Alias\*(C'\fR
267: or User specifications. In \fB\-s\fR (strict) mode this is an error,
268: not a warning.
269: .SH "SEE ALSO"
270: .IX Header "SEE ALSO"
271: \&\fIvi\fR\|(1), sudoers(5), sudo(8), vipw(8)
1.1 millert 272: .SH "AUTHOR"
1.5 millert 273: .IX Header "AUTHOR"
274: Many people have worked on \fIsudo\fR over the years; this version of
275: \&\fBvisudo\fR was written by:
1.2 millert 276: .PP
1.1 millert 277: .Vb 1
1.11 millert 278: \& Todd Miller
1.1 millert 279: .Ve
1.10 millert 280: .PP
1.5 millert 281: See the \s-1HISTORY\s0 file in the sudo distribution or visit
1.6 millert 282: http://www.sudo.ws/sudo/history.html for more details.
1.11 millert 283: .SH "CAVEATS"
284: .IX Header "CAVEATS"
285: There is no easy way to prevent a user from gaining a root shell if
286: the editor used by \fBvisudo\fR allows shell escapes.
1.1 millert 287: .SH "BUGS"
1.5 millert 288: .IX Header "BUGS"
1.11 millert 289: If you feel you have found a bug in \fBvisudo\fR, please submit a bug report
1.6 millert 290: at http://www.sudo.ws/sudo/bugs/
1.11 millert 291: .SH "SUPPORT"
292: .IX Header "SUPPORT"
293: Commercial support is available for \fBsudo\fR, see
294: http://www.sudo.ws/sudo/support.html for details.
295: .PP
296: Limited free support is available via the sudo-users mailing list,
297: see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
298: search the archives.
1.1 millert 299: .SH "DISCLAIMER"
1.5 millert 300: .IX Header "DISCLAIMER"
301: \&\fBVisudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
1.1 millert 302: including, but not limited to, the implied warranties of merchantability
1.11 millert 303: and fitness for a particular purpose are disclaimed. See the \s-1LICENSE\s0
304: file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
305: for complete details.
![[BACK]](/icons/back.gif){kind=icon}
Return to visudo.8 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / sudo