Annotation of src/usr.bin/sudo/visudo.8, Revision 1.9
1.5 millert 1: .\" Automatically generated by Pod::Man version 1.15
1.8 millert 2: .\" Thu Apr 25 09:34:54 2002
1.9 ! millert 3: .\"
! 4: .\" Copyright (c) 1996,1998-2002 Todd C. Miller <Todd.Miller@courtesan.com>
! 5: .\" All rights reserved.
! 6: .\"
! 7: .\" Redistribution and use in source and binary forms, with or without
! 8: .\" modification, are permitted provided that the following conditions
! 9: .\" are met:
! 10: .\"
! 11: .\" 1. Redistributions of source code must retain the above copyright
! 12: .\" notice, this list of conditions and the following disclaimer.
! 13: .\"
! 14: .\" 2. Redistributions in binary form must reproduce the above copyright
! 15: .\" notice, this list of conditions and the following disclaimer in the
! 16: .\" documentation and/or other materials provided with the distribution.
! 17: .\"
! 18: .\" 3. The name of the author may not be used to endorse or promote products
! 19: .\" derived from this software without specific prior written permission
! 20: .\" from the author.
! 21: .\"
! 22: .\" 4. Products derived from this software may not be called "Sudo" nor
! 23: .\" may "Sudo" appear in their names without specific prior written
! 24: .\" permission from the author.
! 25: .\"
! 26: .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
! 27: .\" INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
! 28: .\" AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
! 29: .\" THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
! 30: .\" EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
! 31: .\" PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
! 32: .\" OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
! 33: .\" WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
! 34: .\" OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
! 35: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.5 millert 36: .\"
37: .\" Standard preamble:
38: .\" ======================================================================
39: .de Sh \" Subsection heading
1.1 millert 40: .br
41: .if t .Sp
42: .ne 5
43: .PP
44: \fB\\$1\fR
45: .PP
46: ..
1.5 millert 47: .de Sp \" Vertical space (when we can't use .PP)
1.1 millert 48: .if t .sp .5v
49: .if n .sp
50: ..
1.5 millert 51: .de Ip \" List item
1.1 millert 52: .br
53: .ie \\n(.$>=3 .ne \\$3
54: .el .ne 3
55: .IP "\\$1" \\$2
56: ..
1.5 millert 57: .de Vb \" Begin verbatim text
1.1 millert 58: .ft CW
59: .nf
60: .ne \\$1
61: ..
1.5 millert 62: .de Ve \" End verbatim text
1.1 millert 63: .ft R
64:
65: .fi
66: ..
1.5 millert 67: .\" Set up some character translations and predefined strings. \*(-- will
68: .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
69: .\" double quote, and \*(R" will give a right double quote. | will give a
70: .\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used
71: .\" to do unbreakable dashes and therefore won't be available. \*(C` and
72: .\" \*(C' expand to `' in nroff, nothing in troff, for use with C<>
1.1 millert 73: .tr \(*W-|\(bv\*(Tr
1.5 millert 74: .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
1.1 millert 75: .ie n \{\
1.5 millert 76: . ds -- \(*W-
77: . ds PI pi
78: . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
79: . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
80: . ds L" ""
81: . ds R" ""
82: . ds C`
83: . ds C'
1.1 millert 84: 'br\}
85: .el\{\
1.5 millert 86: . ds -- \|\(em\|
87: . ds PI \(*p
88: . ds L" ``
89: . ds R" ''
1.1 millert 90: 'br\}
1.5 millert 91: .\"
92: .\" If the F register is turned on, we'll generate index entries on stderr
93: .\" for titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and
94: .\" index entries marked with X<> in POD. Of course, you'll have to process
95: .\" the output yourself in some meaningful fashion.
96: .if \nF \{\
97: . de IX
98: . tm Index:\\$1\t\\n%\t"\\$2"
1.1 millert 99: ..
1.5 millert 100: . nr % 0
101: . rr F
1.1 millert 102: .\}
1.5 millert 103: .\"
104: .\" For nroff, turn off justification. Always turn off hyphenation; it
105: .\" makes way too many mistakes in technical documents.
106: .hy 0
1.1 millert 107: .if n .na
1.5 millert 108: .\"
109: .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
110: .\" Fear. Run. Save yourself. No user-serviceable parts.
1.1 millert 111: .bd B 3
1.5 millert 112: . \" fudge factors for nroff and troff
1.1 millert 113: .if n \{\
1.5 millert 114: . ds #H 0
115: . ds #V .8m
116: . ds #F .3m
117: . ds #[ \f1
118: . ds #] \fP
1.1 millert 119: .\}
120: .if t \{\
1.5 millert 121: . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
122: . ds #V .6m
123: . ds #F 0
124: . ds #[ \&
125: . ds #] \&
1.1 millert 126: .\}
1.5 millert 127: . \" simple accents for nroff and troff
1.1 millert 128: .if n \{\
1.5 millert 129: . ds ' \&
130: . ds ` \&
131: . ds ^ \&
132: . ds , \&
133: . ds ~ ~
134: . ds /
1.1 millert 135: .\}
136: .if t \{\
1.5 millert 137: . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
138: . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
139: . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
140: . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
141: . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
142: . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
1.1 millert 143: .\}
1.5 millert 144: . \" troff and (daisy-wheel) nroff accents
1.1 millert 145: .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
146: .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
147: .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
148: .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
149: .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
150: .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
151: .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
152: .ds ae a\h'-(\w'a'u*4/10)'e
153: .ds Ae A\h'-(\w'A'u*4/10)'E
1.5 millert 154: . \" corrections for vroff
1.1 millert 155: .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
156: .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
1.5 millert 157: . \" for low resolution devices (crt and lpr)
1.1 millert 158: .if \n(.H>23 .if \n(.V>19 \
159: \{\
1.5 millert 160: . ds : e
161: . ds 8 ss
162: . ds o a
163: . ds d- d\h'-1'\(ga
164: . ds D- D\h'-1'\(hy
165: . ds th \o'bp'
166: . ds Th \o'LP'
167: . ds ae ae
168: . ds Ae AE
1.1 millert 169: .\}
170: .rm #[ #] #H #V #F C
1.5 millert 171: .\" ======================================================================
172: .\"
173: .IX Title "visudo 8"
1.8 millert 174: .TH visudo 8 "1.6.6" "April 25, 2002" "MAINTENANCE COMMANDS"
1.5 millert 175: .UC
1.1 millert 176: .SH "NAME"
177: visudo \- edit the sudoers file
178: .SH "SYNOPSIS"
1.5 millert 179: .IX Header "SYNOPSIS"
180: \&\fBvisudo\fR [ \fB\-c\fR ] [ \fB\-f\fR \fIsudoers\fR ] [ \fB\-q\fR ] [ \fB\-s\fR ] [ \fB\-V\fR ]
1.1 millert 181: .SH "DESCRIPTION"
1.5 millert 182: .IX Header "DESCRIPTION"
183: \&\fBvisudo\fR edits the \fIsudoers\fR file in a safe fashion, analogous to
184: \&\fIvipw\fR\|(8). \fBvisudo\fR locks the \fIsudoers\fR file against multiple
1.1 millert 185: simultaneous edits, provides basic sanity checks, and checks
186: for parse errors. If the \fIsudoers\fR file is currently being
1.5 millert 187: edited you will receive a message to try again later.
188: .PP
189: There is a hard-coded list of editors that \fBvisudo\fR will use set
190: at compile-time that may be overridden via the \fIeditor\fR \fIsudoers\fR
191: \&\f(CW\*(C`Default\*(C'\fR variable. This list defaults to the path to \fIvi\fR\|(1) on
192: your system, as determined by the \fIconfigure\fR script. Normally,
193: \&\fBvisudo\fR does not honor the \f(CW\*(C`EDITOR\*(C'\fR or \f(CW\*(C`VISUAL\*(C'\fR environment
194: variables unless they contain an editor in the aforementioned editors
195: list. However, if \fBvisudo\fR is configured with the \fI\*(--with-enveditor\fR
196: flag or the \fIenveditor\fR \f(CW\*(C`Default\*(C'\fR variable is set in \fIsudoers\fR,
197: \&\fBvisudo\fR will use any the editor defines by \f(CW\*(C`EDITOR\*(C'\fR or \f(CW\*(C`VISUAL\*(C'\fR.
198: Note that this can be a security hole since it allows the user to
199: execute any program they wish simply by setting \f(CW\*(C`EDITOR\*(C'\fR or \f(CW\*(C`VISUAL\*(C'\fR.
1.1 millert 200: .PP
1.5 millert 201: \&\fBvisudo\fR parses the \fIsudoers\fR file after the edit and will
1.1 millert 202: not save the changes if there is a syntax error. Upon finding
1.4 pjanzen 203: an error, \fBvisudo\fR will print a message stating the line \fInumber\fR\|(s)
1.5 millert 204: where the error occurred and the user will receive the
205: \&\*(L"What now?\*(R" prompt. At this point the user may enter \*(L"e\*(R"
1.4 pjanzen 206: to re-edit the \fIsudoers\fR file, \*(L"x\*(R" to exit without
1.1 millert 207: saving the changes, or \*(L"Q\*(R" to quit and save changes. The
1.5 millert 208: \&\*(L"Q\*(R" option should be used with extreme care because if \fBvisudo\fR
1.1 millert 209: believes there to be a parse error, so will \fBsudo\fR and no one
1.5 millert 210: will be able to \fBsudo\fR again until the error is fixed.
211: If \*(L"e\*(R" is typed to edit the \fIsudoers\fR file after a parse error
212: has been detected, the cursor will be placed on the line where the
213: error occurred (if the editor supports this feature).
1.1 millert 214: .SH "OPTIONS"
1.5 millert 215: .IX Header "OPTIONS"
216: \&\fBvisudo\fR accepts the following command line options:
217: .Ip "\-c" 4
218: .IX Item "-c"
219: Enable \fBcheck-only\fR mode. The existing \fIsudoers\fR file will be
220: checked for syntax and a message will be printed to the
221: standard output detailing the status of \fIsudoers\fR.
222: If the syntax check completes successfully, \fBvisudo\fR will
223: exit with a value of 0. If a syntax error is encountered,
224: \&\fBvisudo\fR will exit with a value of 1.
225: .Ip "\-f" 4
226: .IX Item "-f"
227: Specify and alternate \fIsudoers\fR file location. With this option
228: \&\fBvisudo\fR will edit (or check) the \fIsudoers\fR file of your choice,
229: instead of the default, \f(CW@sysconfdir\fR@/sudoers. The lock file used
230: is the specified \fIsudoers\fR file with \*(L".tmp\*(R" appended to it.
231: .Ip "\-q" 4
232: .IX Item "-q"
233: Enable \fBquiet\fR mode. In this mode details about syntax errors
234: are not printed. This option is only useful when combined with
235: the \fB\-c\fR flag.
236: .Ip "\-s" 4
237: .IX Item "-s"
1.1 millert 238: Enable \fBstrict\fR checking of the \fIsudoers\fR file. If an alias is
239: used before it is defined, \fBvisudo\fR will consider this a parse
240: error. Note that it is not possible to differentiate between an
1.5 millert 241: alias and a hostname or username that consists solely of uppercase
1.1 millert 242: letters, digits, and the underscore ('_') character.
1.5 millert 243: .Ip "\-V" 4
244: .IX Item "-V"
245: The \fB\-V\fR (version) option causes \fBvisudo\fR to print its version number
1.1 millert 246: and exit.
247: .SH "ERRORS"
1.5 millert 248: .IX Header "ERRORS"
1.1 millert 249: .Ip "sudoers file busy, try again later." 4
1.5 millert 250: .IX Item "sudoers file busy, try again later."
1.1 millert 251: Someone else is currently editing the \fIsudoers\fR file.
252: .Ip "/etc/sudoers.tmp: Permission denied" 4
1.5 millert 253: .IX Item "/etc/sudoers.tmp: Permission denied"
1.1 millert 254: You didn't run \fBvisudo\fR as root.
255: .Ip "Can't find you in the passwd database" 4
1.5 millert 256: .IX Item "Can't find you in the passwd database"
1.1 millert 257: Your userid does not appear in the system passwd file.
258: .Ip "Warning: undeclared Alias referenced near ..." 4
1.5 millert 259: .IX Item "Warning: undeclared Alias referenced near ..."
1.1 millert 260: Either you are using a {User,Runas,Host,Cmnd}_Alias before
261: defining it or you have a user or hostname listed that
1.5 millert 262: consists solely of uppercase letters, digits, and the
1.1 millert 263: underscore ('_') character. If the latter, you can ignore
264: the warnings (\fBsudo\fR will not complain). In \fB\-s\fR (strict)
1.4 pjanzen 265: mode these are errors, not warnings.
1.1 millert 266: .SH "ENVIRONMENT"
1.5 millert 267: .IX Header "ENVIRONMENT"
1.1 millert 268: The following environment variables are used only if \fBvisudo\fR
1.5 millert 269: was configured with the \fI\*(--with-env-editor\fR option:
1.2 millert 270: .PP
1.1 millert 271: .Vb 2
1.5 millert 272: \& EDITOR Invoked by visudo as the editor to use
273: \& VISUAL Used Invoked visudo if EDITOR is not set
1.1 millert 274: .Ve
275: .SH "FILES"
1.5 millert 276: .IX Header "FILES"
1.1 millert 277: .Vb 2
278: \& /etc/sudoers List of who can run what
279: \& /etc/sudoers.tmp Lock file for visudo
280: .Ve
281: .SH "AUTHOR"
1.5 millert 282: .IX Header "AUTHOR"
283: Many people have worked on \fIsudo\fR over the years; this version of
284: \&\fBvisudo\fR was written by:
1.2 millert 285: .PP
1.1 millert 286: .Vb 1
287: \& Todd Miller <Todd.Miller@courtesan.com>
288: .Ve
1.5 millert 289: See the \s-1HISTORY\s0 file in the sudo distribution or visit
1.6 millert 290: http://www.sudo.ws/sudo/history.html for more details.
1.1 millert 291: .SH "BUGS"
1.5 millert 292: .IX Header "BUGS"
1.1 millert 293: If you feel you have found a bug in sudo, please submit a bug report
1.6 millert 294: at http://www.sudo.ws/sudo/bugs/
1.1 millert 295: .SH "DISCLAIMER"
1.5 millert 296: .IX Header "DISCLAIMER"
297: \&\fBVisudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
1.1 millert 298: including, but not limited to, the implied warranties of merchantability
299: and fitness for a particular purpose are disclaimed.
1.5 millert 300: See the \s-1LICENSE\s0 file distributed with \fBsudo\fR for complete details.
1.1 millert 301: .SH "CAVEATS"
1.5 millert 302: .IX Header "CAVEATS"
1.1 millert 303: There is no easy way to prevent a user from gaining a root shell if
304: the editor used by \fBvisudo\fR allows shell escapes.
305: .SH "SEE ALSO"
306: .IX Header "SEE ALSO"
1.5 millert 307: \&\fIvi\fR\|(1), \fIsudo\fR\|(8), \fIvipw\fR\|(8).
![[BACK]](/icons/back.gif){kind=icon}
Return to visudo.8 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / sudo