Annotation of src/usr.bin/sudo/visudo.8, Revision 1.6
1.5 millert 1: .\" Automatically generated by Pod::Man version 1.15
1.6 ! millert 2: .\" Sat Jan 12 15:54:25 2002
1.5 millert 3: .\"
4: .\" Standard preamble:
5: .\" ======================================================================
6: .de Sh \" Subsection heading
1.1 millert 7: .br
8: .if t .Sp
9: .ne 5
10: .PP
11: \fB\\$1\fR
12: .PP
13: ..
1.5 millert 14: .de Sp \" Vertical space (when we can't use .PP)
1.1 millert 15: .if t .sp .5v
16: .if n .sp
17: ..
1.5 millert 18: .de Ip \" List item
1.1 millert 19: .br
20: .ie \\n(.$>=3 .ne \\$3
21: .el .ne 3
22: .IP "\\$1" \\$2
23: ..
1.5 millert 24: .de Vb \" Begin verbatim text
1.1 millert 25: .ft CW
26: .nf
27: .ne \\$1
28: ..
1.5 millert 29: .de Ve \" End verbatim text
1.1 millert 30: .ft R
31:
32: .fi
33: ..
1.5 millert 34: .\" Set up some character translations and predefined strings. \*(-- will
35: .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
36: .\" double quote, and \*(R" will give a right double quote. | will give a
37: .\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used
38: .\" to do unbreakable dashes and therefore won't be available. \*(C` and
39: .\" \*(C' expand to `' in nroff, nothing in troff, for use with C<>
1.1 millert 40: .tr \(*W-|\(bv\*(Tr
1.5 millert 41: .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
1.1 millert 42: .ie n \{\
1.5 millert 43: . ds -- \(*W-
44: . ds PI pi
45: . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
46: . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
47: . ds L" ""
48: . ds R" ""
49: . ds C`
50: . ds C'
1.1 millert 51: 'br\}
52: .el\{\
1.5 millert 53: . ds -- \|\(em\|
54: . ds PI \(*p
55: . ds L" ``
56: . ds R" ''
1.1 millert 57: 'br\}
1.5 millert 58: .\"
59: .\" If the F register is turned on, we'll generate index entries on stderr
60: .\" for titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and
61: .\" index entries marked with X<> in POD. Of course, you'll have to process
62: .\" the output yourself in some meaningful fashion.
63: .if \nF \{\
64: . de IX
65: . tm Index:\\$1\t\\n%\t"\\$2"
1.1 millert 66: ..
1.5 millert 67: . nr % 0
68: . rr F
1.1 millert 69: .\}
1.5 millert 70: .\"
71: .\" For nroff, turn off justification. Always turn off hyphenation; it
72: .\" makes way too many mistakes in technical documents.
73: .hy 0
1.1 millert 74: .if n .na
1.5 millert 75: .\"
76: .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
77: .\" Fear. Run. Save yourself. No user-serviceable parts.
1.1 millert 78: .bd B 3
1.5 millert 79: . \" fudge factors for nroff and troff
1.1 millert 80: .if n \{\
1.5 millert 81: . ds #H 0
82: . ds #V .8m
83: . ds #F .3m
84: . ds #[ \f1
85: . ds #] \fP
1.1 millert 86: .\}
87: .if t \{\
1.5 millert 88: . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
89: . ds #V .6m
90: . ds #F 0
91: . ds #[ \&
92: . ds #] \&
1.1 millert 93: .\}
1.5 millert 94: . \" simple accents for nroff and troff
1.1 millert 95: .if n \{\
1.5 millert 96: . ds ' \&
97: . ds ` \&
98: . ds ^ \&
99: . ds , \&
100: . ds ~ ~
101: . ds /
1.1 millert 102: .\}
103: .if t \{\
1.5 millert 104: . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
105: . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
106: . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
107: . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
108: . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
109: . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
1.1 millert 110: .\}
1.5 millert 111: . \" troff and (daisy-wheel) nroff accents
1.1 millert 112: .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
113: .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
114: .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
115: .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
116: .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
117: .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
118: .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
119: .ds ae a\h'-(\w'a'u*4/10)'e
120: .ds Ae A\h'-(\w'A'u*4/10)'E
1.5 millert 121: . \" corrections for vroff
1.1 millert 122: .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
123: .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
1.5 millert 124: . \" for low resolution devices (crt and lpr)
1.1 millert 125: .if \n(.H>23 .if \n(.V>19 \
126: \{\
1.5 millert 127: . ds : e
128: . ds 8 ss
129: . ds o a
130: . ds d- d\h'-1'\(ga
131: . ds D- D\h'-1'\(hy
132: . ds th \o'bp'
133: . ds Th \o'LP'
134: . ds ae ae
135: . ds Ae AE
1.1 millert 136: .\}
137: .rm #[ #] #H #V #F C
1.5 millert 138: .\" ======================================================================
139: .\"
140: .IX Title "visudo 8"
1.6 ! millert 141: .TH visudo 8 "1.6.4" "January 12, 2002" "MAINTENANCE COMMANDS"
1.5 millert 142: .UC
1.1 millert 143: .SH "NAME"
144: visudo \- edit the sudoers file
145: .SH "SYNOPSIS"
1.5 millert 146: .IX Header "SYNOPSIS"
147: \&\fBvisudo\fR [ \fB\-c\fR ] [ \fB\-f\fR \fIsudoers\fR ] [ \fB\-q\fR ] [ \fB\-s\fR ] [ \fB\-V\fR ]
1.1 millert 148: .SH "DESCRIPTION"
1.5 millert 149: .IX Header "DESCRIPTION"
150: \&\fBvisudo\fR edits the \fIsudoers\fR file in a safe fashion, analogous to
151: \&\fIvipw\fR\|(8). \fBvisudo\fR locks the \fIsudoers\fR file against multiple
1.1 millert 152: simultaneous edits, provides basic sanity checks, and checks
153: for parse errors. If the \fIsudoers\fR file is currently being
1.5 millert 154: edited you will receive a message to try again later.
155: .PP
156: There is a hard-coded list of editors that \fBvisudo\fR will use set
157: at compile-time that may be overridden via the \fIeditor\fR \fIsudoers\fR
158: \&\f(CW\*(C`Default\*(C'\fR variable. This list defaults to the path to \fIvi\fR\|(1) on
159: your system, as determined by the \fIconfigure\fR script. Normally,
160: \&\fBvisudo\fR does not honor the \f(CW\*(C`EDITOR\*(C'\fR or \f(CW\*(C`VISUAL\*(C'\fR environment
161: variables unless they contain an editor in the aforementioned editors
162: list. However, if \fBvisudo\fR is configured with the \fI\*(--with-enveditor\fR
163: flag or the \fIenveditor\fR \f(CW\*(C`Default\*(C'\fR variable is set in \fIsudoers\fR,
164: \&\fBvisudo\fR will use any the editor defines by \f(CW\*(C`EDITOR\*(C'\fR or \f(CW\*(C`VISUAL\*(C'\fR.
165: Note that this can be a security hole since it allows the user to
166: execute any program they wish simply by setting \f(CW\*(C`EDITOR\*(C'\fR or \f(CW\*(C`VISUAL\*(C'\fR.
1.1 millert 167: .PP
1.5 millert 168: \&\fBvisudo\fR parses the \fIsudoers\fR file after the edit and will
1.1 millert 169: not save the changes if there is a syntax error. Upon finding
1.4 pjanzen 170: an error, \fBvisudo\fR will print a message stating the line \fInumber\fR\|(s)
1.5 millert 171: where the error occurred and the user will receive the
172: \&\*(L"What now?\*(R" prompt. At this point the user may enter \*(L"e\*(R"
1.4 pjanzen 173: to re-edit the \fIsudoers\fR file, \*(L"x\*(R" to exit without
1.1 millert 174: saving the changes, or \*(L"Q\*(R" to quit and save changes. The
1.5 millert 175: \&\*(L"Q\*(R" option should be used with extreme care because if \fBvisudo\fR
1.1 millert 176: believes there to be a parse error, so will \fBsudo\fR and no one
1.5 millert 177: will be able to \fBsudo\fR again until the error is fixed.
178: If \*(L"e\*(R" is typed to edit the \fIsudoers\fR file after a parse error
179: has been detected, the cursor will be placed on the line where the
180: error occurred (if the editor supports this feature).
1.1 millert 181: .SH "OPTIONS"
1.5 millert 182: .IX Header "OPTIONS"
183: \&\fBvisudo\fR accepts the following command line options:
184: .Ip "\-c" 4
185: .IX Item "-c"
186: Enable \fBcheck-only\fR mode. The existing \fIsudoers\fR file will be
187: checked for syntax and a message will be printed to the
188: standard output detailing the status of \fIsudoers\fR.
189: If the syntax check completes successfully, \fBvisudo\fR will
190: exit with a value of 0. If a syntax error is encountered,
191: \&\fBvisudo\fR will exit with a value of 1.
192: .Ip "\-f" 4
193: .IX Item "-f"
194: Specify and alternate \fIsudoers\fR file location. With this option
195: \&\fBvisudo\fR will edit (or check) the \fIsudoers\fR file of your choice,
196: instead of the default, \f(CW@sysconfdir\fR@/sudoers. The lock file used
197: is the specified \fIsudoers\fR file with \*(L".tmp\*(R" appended to it.
198: .Ip "\-q" 4
199: .IX Item "-q"
200: Enable \fBquiet\fR mode. In this mode details about syntax errors
201: are not printed. This option is only useful when combined with
202: the \fB\-c\fR flag.
203: .Ip "\-s" 4
204: .IX Item "-s"
1.1 millert 205: Enable \fBstrict\fR checking of the \fIsudoers\fR file. If an alias is
206: used before it is defined, \fBvisudo\fR will consider this a parse
207: error. Note that it is not possible to differentiate between an
1.5 millert 208: alias and a hostname or username that consists solely of uppercase
1.1 millert 209: letters, digits, and the underscore ('_') character.
1.5 millert 210: .Ip "\-V" 4
211: .IX Item "-V"
212: The \fB\-V\fR (version) option causes \fBvisudo\fR to print its version number
1.1 millert 213: and exit.
214: .SH "ERRORS"
1.5 millert 215: .IX Header "ERRORS"
1.1 millert 216: .Ip "sudoers file busy, try again later." 4
1.5 millert 217: .IX Item "sudoers file busy, try again later."
1.1 millert 218: Someone else is currently editing the \fIsudoers\fR file.
219: .Ip "/etc/sudoers.tmp: Permission denied" 4
1.5 millert 220: .IX Item "/etc/sudoers.tmp: Permission denied"
1.1 millert 221: You didn't run \fBvisudo\fR as root.
222: .Ip "Can't find you in the passwd database" 4
1.5 millert 223: .IX Item "Can't find you in the passwd database"
1.1 millert 224: Your userid does not appear in the system passwd file.
225: .Ip "Warning: undeclared Alias referenced near ..." 4
1.5 millert 226: .IX Item "Warning: undeclared Alias referenced near ..."
1.1 millert 227: Either you are using a {User,Runas,Host,Cmnd}_Alias before
228: defining it or you have a user or hostname listed that
1.5 millert 229: consists solely of uppercase letters, digits, and the
1.1 millert 230: underscore ('_') character. If the latter, you can ignore
231: the warnings (\fBsudo\fR will not complain). In \fB\-s\fR (strict)
1.4 pjanzen 232: mode these are errors, not warnings.
1.1 millert 233: .SH "ENVIRONMENT"
1.5 millert 234: .IX Header "ENVIRONMENT"
1.1 millert 235: The following environment variables are used only if \fBvisudo\fR
1.5 millert 236: was configured with the \fI\*(--with-env-editor\fR option:
1.2 millert 237: .PP
1.1 millert 238: .Vb 2
1.5 millert 239: \& EDITOR Invoked by visudo as the editor to use
240: \& VISUAL Used Invoked visudo if EDITOR is not set
1.1 millert 241: .Ve
242: .SH "FILES"
1.5 millert 243: .IX Header "FILES"
1.1 millert 244: .Vb 2
245: \& /etc/sudoers List of who can run what
246: \& /etc/sudoers.tmp Lock file for visudo
247: .Ve
248: .SH "AUTHOR"
1.5 millert 249: .IX Header "AUTHOR"
250: Many people have worked on \fIsudo\fR over the years; this version of
251: \&\fBvisudo\fR was written by:
1.2 millert 252: .PP
1.1 millert 253: .Vb 1
254: \& Todd Miller <Todd.Miller@courtesan.com>
255: .Ve
1.5 millert 256: See the \s-1HISTORY\s0 file in the sudo distribution or visit
1.6 ! millert 257: http://www.sudo.ws/sudo/history.html for more details.
1.1 millert 258: .SH "BUGS"
1.5 millert 259: .IX Header "BUGS"
1.1 millert 260: If you feel you have found a bug in sudo, please submit a bug report
1.6 ! millert 261: at http://www.sudo.ws/sudo/bugs/
1.1 millert 262: .SH "DISCLAIMER"
1.5 millert 263: .IX Header "DISCLAIMER"
264: \&\fBVisudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
1.1 millert 265: including, but not limited to, the implied warranties of merchantability
266: and fitness for a particular purpose are disclaimed.
1.5 millert 267: See the \s-1LICENSE\s0 file distributed with \fBsudo\fR for complete details.
1.1 millert 268: .SH "CAVEATS"
1.5 millert 269: .IX Header "CAVEATS"
1.1 millert 270: There is no easy way to prevent a user from gaining a root shell if
271: the editor used by \fBvisudo\fR allows shell escapes.
272: .SH "SEE ALSO"
273: .IX Header "SEE ALSO"
1.5 millert 274: \&\fIvi\fR\|(1), \fIsudo\fR\|(8), \fIvipw\fR\|(8).