2404 lines
39 KiB
HTML
2404 lines
39 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of SUDO</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>SUDO</H1>
|
|
Section: Maintenance Commands (8)<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
<BR>BSD mandoc<BR>
|
|
Sudo 1.8.31
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
<B>sudo</B>
|
|
|
|
|
|
<B>sudoedit</B>
|
|
|
|
- execute a command as another user
|
|
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>sudo</B>
|
|
|
|
-<B>h | K | k | V</B>
|
|
|
|
<BR><B>sudo</B>
|
|
|
|
-<B>v</B>
|
|
|
|
[-<B>ABknS</B>
|
|
|
|
]
|
|
|
|
|
|
[-<B>g </B><I>group</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>h </B><I>host</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>p </B><I>prompt</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>u </B><I>user</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
<BR><B>sudo</B>
|
|
|
|
-<B>l</B>
|
|
|
|
[-<B>ABknS</B>
|
|
|
|
]
|
|
|
|
|
|
[-<B>g </B><I>group</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>h </B><I>host</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>p </B><I>prompt</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>U </B><I>user</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>u </B><I>user</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[<I>command</I>
|
|
|
|
]
|
|
|
|
<BR><B>sudo</B>
|
|
|
|
[-<B>ABbEHnPS</B>
|
|
|
|
]
|
|
|
|
|
|
[-<B>C </B><I>num</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
[-<B>g </B><I>group</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>h </B><I>host</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>p </B><I>prompt</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>r </B><I>role</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
[-<B>t </B><I>type</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[-<B>T </B><I>timeout</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>u </B><I>user</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[<I>VAR </I><B>= </B><I>value</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>i | s</B>
|
|
|
|
]
|
|
|
|
[<I>command</I>
|
|
|
|
]
|
|
|
|
<BR><B>sudoedit</B>
|
|
|
|
[-<B>ABknS</B>
|
|
|
|
]
|
|
|
|
|
|
[-<B>C </B><I>num</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
[-<B>g </B><I>group</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>h </B><I>host</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>p </B><I>prompt</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>T </B><I>timeout</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>u </B><I>user</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
<I>file ...</I>
|
|
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>sudo</B>
|
|
|
|
|
|
allows a permitted user to execute a
|
|
<I>command</I>
|
|
|
|
as the superuser or another user, as specified by the security
|
|
policy.
|
|
The invoking user's real
|
|
(<I>not </I><B>effective</B>
|
|
|
|
|
|
|
|
)
|
|
|
|
user-ID is used to determine the user name with which
|
|
to query the security policy.
|
|
<P>
|
|
|
|
<B>sudo</B>
|
|
|
|
|
|
supports a plugin architecture for security policies and input/output
|
|
logging.
|
|
Third parties can develop and distribute their own policy and I/O
|
|
logging plugins to work seamlessly with the
|
|
<B>sudo</B>
|
|
|
|
|
|
front end.
|
|
The default security policy is
|
|
<I>sudoers</I>
|
|
|
|
|
|
which is configured via the file
|
|
/etc/sudoers
|
|
|
|
|
|
or via LDAP.
|
|
See the
|
|
Sx Plugins
|
|
|
|
section for more information.
|
|
<P>
|
|
|
|
The security policy determines what privileges, if any, a user has
|
|
to run
|
|
<B>.</B>
|
|
|
|
The policy may require that users authenticate themselves with a
|
|
password or another authentication mechanism.
|
|
If authentication is required,
|
|
<B>sudo</B>
|
|
|
|
|
|
will exit if the user's password is not entered within a configurable
|
|
time limit.
|
|
This limit is policy-specific; the default password prompt timeout
|
|
for the
|
|
<I>sudoers</I>
|
|
|
|
security policy is
|
|
<B>0</B>
|
|
|
|
minutes.
|
|
<P>
|
|
|
|
Security policies may support credential caching to allow the user
|
|
to run
|
|
<B>sudo</B>
|
|
|
|
|
|
again for a period of time without requiring authentication.
|
|
By default, the
|
|
<I>sudoers</I>
|
|
|
|
policy caches credentials on a per-terminal basis for
|
|
<B>15</B>
|
|
|
|
minutes.
|
|
See the
|
|
<I>timestamp_type</I>
|
|
|
|
and
|
|
<I>timestamp_timeout</I>
|
|
|
|
options in
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5)
|
|
|
|
|
|
for more information.
|
|
By running
|
|
<B>sudo</B>
|
|
|
|
|
|
with the
|
|
-<B>v</B>
|
|
|
|
option, a user can update the cached credentials without running a
|
|
<I>command</I>
|
|
|
|
|
|
<P>
|
|
|
|
When invoked as
|
|
<B>sudoedit</B>
|
|
|
|
|
|
the
|
|
-<B>e</B>
|
|
|
|
option (described below), is implied.
|
|
<P>
|
|
|
|
Security policies may log successful and failed attempts to use
|
|
<B>.</B>
|
|
|
|
If an I/O plugin is configured, the running command's input and
|
|
output may be logged as well.
|
|
<P>
|
|
|
|
The options are as follows:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="1"><B>-A , -askpass</B>
|
|
|
|
|
|
<DD>
|
|
Normally, if
|
|
<B>sudo</B>
|
|
|
|
|
|
requires a password, it will read it from the user's terminal.
|
|
If the
|
|
-<B>A (</B><I>askpass</I>
|
|
|
|
)
|
|
|
|
|
|
|
|
option is specified, a (possibly graphical) helper program is
|
|
executed to read the user's password and output the password to the
|
|
standard output.
|
|
If the
|
|
<B>SUDO_ASKPASS</B>
|
|
|
|
environment variable is set, it specifies the path to the helper
|
|
program.
|
|
Otherwise, if
|
|
sudo.conf5
|
|
|
|
|
|
contains a line specifying the askpass program, that value will be
|
|
used.
|
|
For example:
|
|
|
|
<PRE>
|
|
# Path to askpass helper program
|
|
Path askpass /usr/X11R6/bin/ssh-askpass
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
If no askpass program is available,
|
|
<B>sudo</B>
|
|
|
|
|
|
will exit with an error.
|
|
|
|
<DT id="2"><B>-B , -bell</B>
|
|
|
|
|
|
<DD>
|
|
Ring the bell as part of the password promp when a terminal is present.
|
|
This option has no effect if an askpass program is used.
|
|
<DT id="3"><B>-b , -background</B>
|
|
|
|
|
|
<DD>
|
|
Run the given command in the background.
|
|
Note that it is not possible to use shell job control to manipulate
|
|
background processes started by
|
|
<B>.</B>
|
|
|
|
Most interactive commands will fail to work properly in background
|
|
mode.
|
|
<DT id="4"><B>-C </B><I>num , -</I><B>-close-from = </B><I>num</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Close all file descriptors greater than or equal to
|
|
<I>num</I>
|
|
|
|
before executing a command.
|
|
Values less than three are not permitted.
|
|
By default,
|
|
<B>sudo</B>
|
|
|
|
|
|
will close all open file descriptors other than standard input,
|
|
standard output and standard error when executing a command.
|
|
The security policy may restrict the user's ability to use this option.
|
|
The
|
|
<I>sudoers</I>
|
|
|
|
policy only permits use of the
|
|
-<B>C</B>
|
|
|
|
option when the administrator has enabled the
|
|
<I>closefrom_override</I>
|
|
|
|
option.
|
|
|
|
<DT id="5"><B>-E , -preserve-env</B>
|
|
|
|
|
|
<DD>
|
|
Indicates to the security policy that the user wishes to
|
|
preserve their existing environment variables.
|
|
The security policy may return an error if the user does not have
|
|
permission to preserve the environment.
|
|
<DT id="6"><B>--preserve-env=list</B>
|
|
|
|
|
|
<DD>
|
|
Indicates to the security policy that the user wishes to add the
|
|
comma-separated list of environment variables to those preserved
|
|
from the user's environment.
|
|
The security policy may return an error if the user does not have
|
|
permission to preserve the environment.
|
|
<DT id="7"><B>-e , -edit</B>
|
|
|
|
|
|
<DD>
|
|
Edit one or more files instead of running a command.
|
|
In lieu of a path name, the string "sudoedit" is used when consulting
|
|
the security policy.
|
|
If the user is authorized by the policy, the following steps are
|
|
taken:
|
|
<OL><P>
|
|
|
|
<LI>
|
|
|
|
Temporary copies are made of the files to be edited with the owner
|
|
set to the invoking user.
|
|
<LI>
|
|
|
|
The editor specified by the policy is run to edit the temporary
|
|
files.
|
|
The
|
|
<I>sudoers</I>
|
|
|
|
policy uses the
|
|
<B>SUDO_EDITOR</B>
|
|
|
|
|
|
<B>VISUAL</B>
|
|
|
|
and
|
|
<B>EDITOR</B>
|
|
|
|
environment variables (in that order).
|
|
If none of
|
|
<B>SUDO_EDITOR</B>
|
|
|
|
|
|
<B>VISUAL</B>
|
|
|
|
or
|
|
<B>EDITOR</B>
|
|
|
|
are set, the first program listed in the
|
|
<I>editor</I>
|
|
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5)
|
|
|
|
|
|
option is used.
|
|
<LI>
|
|
|
|
If they have been modified, the temporary files are copied back to
|
|
their original location and the temporary versions are removed.
|
|
</OL><P>
|
|
|
|
<P>
|
|
|
|
To help prevent the editing of unauthorized files, the following
|
|
restrictions are enforced unless explicitly allowed by the security policy:
|
|
<UL><P>
|
|
|
|
<LI>
|
|
|
|
Symbolic links may not be edited (version 1.8.15 and higher).
|
|
<LI>
|
|
|
|
Symbolic links along the path to be edited are not followed when the
|
|
parent directory is writable by the invoking user unless that user
|
|
is root (version 1.8.16 and higher).
|
|
<LI>
|
|
|
|
Files located in a directory that is writable by the invoking user may
|
|
not be edited unless that user is root (version 1.8.16 and higher).
|
|
</UL><P>
|
|
|
|
<P>
|
|
|
|
Users are never allowed to edit device special files.
|
|
<P>
|
|
|
|
If the specified file does not exist, it will be created.
|
|
Note that unlike most commands run by
|
|
<I>sudo</I>
|
|
|
|
|
|
the editor is run with the invoking user's environment unmodified.
|
|
If, for some reason,
|
|
<B>sudo</B>
|
|
|
|
|
|
is unable to update a file with its edited version, the user will
|
|
receive a warning and the edited copy will remain in a temporary
|
|
file.
|
|
<DT id="8"><B>-g </B><I>group , -</I><B>-group = </B><I>group</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Run the command with the primary group set to
|
|
<I>group</I>
|
|
|
|
instead of the primary group specified by the target
|
|
user's password database entry.
|
|
The
|
|
<I>group</I>
|
|
|
|
may be either a group name or a numeric group-ID
|
|
(GID)
|
|
|
|
prefixed with the
|
|
`#'
|
|
|
|
character (e.g.,
|
|
<B>#0</B>
|
|
|
|
for GID 0).
|
|
When running a command as a GID, many shells require that the
|
|
`#'
|
|
|
|
be escaped with a backslash
|
|
(`\'
|
|
|
|
)
|
|
|
|
|
|
If no
|
|
-<B>u</B>
|
|
|
|
option is specified, the command will be run as the invoking user.
|
|
In either case, the primary group will be set to
|
|
<I>group</I>
|
|
|
|
|
|
The
|
|
<I>sudoers</I>
|
|
|
|
policy permits any of the target user's groups to be specified via
|
|
the
|
|
-<B>g</B>
|
|
|
|
option as long as the
|
|
-<B>P</B>
|
|
|
|
option is not in use.
|
|
<DT id="9"><B>-H , -set-home</B>
|
|
|
|
|
|
<DD>
|
|
Request that the security policy set the
|
|
<B>HOME</B>
|
|
|
|
environment variable to the home directory specified by the target
|
|
user's password database entry.
|
|
Depending on the policy, this may be the default behavior.
|
|
<DT id="10"><B>-h , -help</B>
|
|
|
|
|
|
<DD>
|
|
Display a short help message to the standard output and exit.
|
|
<DT id="11"><B>-h </B><I>host , -</I><B>-host = </B><I>host</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Run the command on the specified
|
|
<I>host</I>
|
|
|
|
if the security policy plugin supports remote commands.
|
|
Note that the
|
|
<I>sudoers</I>
|
|
|
|
plugin does not currently support running remote commands.
|
|
This may also be used in conjunction with the
|
|
-<B>l</B>
|
|
|
|
option to list a user's privileges for the remote host.
|
|
<DT id="12"><B>-i , -login</B>
|
|
|
|
|
|
<DD>
|
|
Run the shell specified by the target user's password database entry
|
|
as a login shell.
|
|
This means that login-specific resource files such as
|
|
.profile
|
|
|
|
|
|
.bash_profile
|
|
|
|
or
|
|
.login
|
|
|
|
will be read by the shell.
|
|
If a command is specified, it is passed to the shell for execution
|
|
via the shell's
|
|
-<B>c</B>
|
|
|
|
option.
|
|
If no command is specified, an interactive shell is executed.
|
|
<B>sudo</B>
|
|
|
|
|
|
attempts to change to that user's home directory before running the
|
|
shell.
|
|
The command is run with an environment similar to the one
|
|
a user would receive at log in.
|
|
Note that most shells behave differently when a command is specified
|
|
as compared to an interactive session; consult the shell's manual
|
|
for details.
|
|
The
|
|
<I>Command environment</I>
|
|
|
|
section in the
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5)
|
|
|
|
|
|
manual documents how the
|
|
-<B>i</B>
|
|
|
|
option affects the environment in which a command is run when the
|
|
<I>sudoers</I>
|
|
|
|
policy is in use.
|
|
<DT id="13"><B>-K , -remove-timestamp</B>
|
|
|
|
|
|
<DD>
|
|
Similar to the
|
|
-<B>k</B>
|
|
|
|
option, except that it removes the user's cached credentials entirely
|
|
and may not be used in conjunction with a command or other option.
|
|
This option does not require a password.
|
|
Not all security policies support credential caching.
|
|
<DT id="14"><B>-k , -reset-timestamp</B>
|
|
|
|
|
|
<DD>
|
|
When used without a command, invalidates the user's cached credentials.
|
|
In other words, the next time
|
|
<B>sudo</B>
|
|
|
|
|
|
is run a password will be required.
|
|
This option does not require a password and was added to allow a
|
|
user to revoke
|
|
<B>sudo</B>
|
|
|
|
|
|
permissions from a
|
|
.logout
|
|
|
|
file.
|
|
<P>
|
|
|
|
When used in conjunction with a command or an option that may require
|
|
a password, this option will cause
|
|
<B>sudo</B>
|
|
|
|
|
|
to ignore the user's cached credentials.
|
|
As a result,
|
|
<B>sudo</B>
|
|
|
|
|
|
will prompt for a password (if one is required by the security
|
|
policy) and will not update the user's cached credentials.
|
|
<P>
|
|
|
|
Not all security policies support credential caching.
|
|
<DT id="15"><B>-l , --list</B>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
If no
|
|
<I>command</I>
|
|
|
|
is specified,
|
|
list the allowed (and forbidden) commands for the
|
|
invoking user (or the user specified by the
|
|
-<B>U</B>
|
|
|
|
option) on the current host.
|
|
A longer list format is used if this option is specified multiple times
|
|
and the security policy supports a verbose output format.
|
|
<P>
|
|
|
|
If a
|
|
<I>command</I>
|
|
|
|
is specified and is permitted by the security policy, the fully-qualified
|
|
path to the command is displayed along with any command line
|
|
arguments.
|
|
If a
|
|
<I>command</I>
|
|
|
|
is specified but not allowed by the policy,
|
|
<B>sudo</B>
|
|
|
|
|
|
will exit with a status value of 1.
|
|
<DT id="16"><B>-n , -non-interactive</B>
|
|
|
|
|
|
<DD>
|
|
Avoid prompting the user for input of any kind.
|
|
If a password is required for the command to run,
|
|
<B>sudo</B>
|
|
|
|
|
|
will display an error message and exit.
|
|
<DT id="17"><B>-P , -preserve-groups</B>
|
|
|
|
|
|
<DD>
|
|
Preserve the invoking user's group vector unaltered.
|
|
By default, the
|
|
<I>sudoers</I>
|
|
|
|
policy will initialize the group vector to the list of groups the
|
|
target user is a member of.
|
|
The real and effective group-IDs, however, are still set to match
|
|
the target user.
|
|
<DT id="18"><B>-p </B><I>prompt , -</I><B>-prompt = </B><I>prompt</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Use a custom password prompt with optional escape sequences.
|
|
The following percent
|
|
(`%'
|
|
|
|
)
|
|
|
|
escape sequences are supported by the
|
|
<I>sudoers</I>
|
|
|
|
policy:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="19"><B>%H</B>
|
|
|
|
|
|
<DD>
|
|
expanded to the host name including the domain name (on if the
|
|
machine's host name is fully qualified or the
|
|
<I>fqdn</I>
|
|
|
|
option is set in
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5))
|
|
|
|
|
|
<DT id="20"><B>%h</B>
|
|
|
|
|
|
<DD>
|
|
expanded to the local host name without the domain name
|
|
<DT id="21"><B>%p</B>
|
|
|
|
|
|
<DD>
|
|
expanded to the name of the user whose password is being requested
|
|
(respects the
|
|
<I>rootpw</I>
|
|
|
|
|
|
<I>targetpw</I>
|
|
|
|
|
|
and
|
|
<I>runaspw</I>
|
|
|
|
flags in
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5))
|
|
|
|
|
|
<DT id="22"><B>%U</B>
|
|
|
|
|
|
<DD>
|
|
expanded to the login name of the user the command will be run as
|
|
(defaults to root unless the
|
|
-<B>u</B>
|
|
|
|
option is also specified)
|
|
<DT id="23"><B>%u</B>
|
|
|
|
|
|
<DD>
|
|
expanded to the invoking user's login name
|
|
<DT id="24"><B>%%</B>
|
|
|
|
|
|
<DD>
|
|
two consecutive
|
|
`%'
|
|
|
|
characters are collapsed into a single
|
|
`%'
|
|
|
|
character
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
The custom prompt will override the default prompt specified by either
|
|
the security policy or the
|
|
<B>SUDO_PROMPT</B>
|
|
|
|
environment variable.
|
|
On systems that use PAM, the custom prompt will also override the prompt
|
|
specified by a PAM module unless the
|
|
<I>passprompt_override</I>
|
|
|
|
flag is disabled in
|
|
<I>sudoers</I>
|
|
|
|
|
|
<DT id="25"><B>-r </B><I>role , -</I><B>-role = </B><I>role</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
|
|
Run the command with an SELinux security context that includes
|
|
the specified
|
|
<I>role</I>
|
|
|
|
|
|
|
|
|
|
<DT id="26"><B>-S , -stdin</B>
|
|
|
|
|
|
<DD>
|
|
Write the prompt to the standard error and read the password from the
|
|
standard input instead of using the terminal device.
|
|
<DT id="27"><B>-s , -shell</B>
|
|
|
|
|
|
<DD>
|
|
Run the shell specified by the
|
|
<B>SHELL</B>
|
|
|
|
environment variable if it is set or the shell specified by the
|
|
invoking user's password database entry.
|
|
If a command is specified, it is passed to the shell for execution
|
|
via the shell's
|
|
-<B>c</B>
|
|
|
|
option.
|
|
If no command is specified, an interactive shell is executed.
|
|
Note that most shells behave differently when a command is specified
|
|
as compared to an interactive session; consult the shell's manual
|
|
for details.
|
|
<DT id="28"><B>-t </B><I>type , -</I><B>-type = </B><I>type</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
|
|
Run the command with an SELinux security context that includes
|
|
the specified
|
|
<I>type</I>
|
|
|
|
|
|
If no
|
|
<I>type</I>
|
|
|
|
|
|
is specified, the default type is derived from the role.
|
|
|
|
|
|
<DT id="29"><B>-U </B><I>user , -</I><B>-other-user = </B><I>user</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Used in conjunction with the
|
|
-<B>l</B>
|
|
|
|
option to list the privileges for
|
|
<I>user</I>
|
|
|
|
instead of for the invoking user.
|
|
The security policy may restrict listing other users' privileges.
|
|
The
|
|
<I>sudoers</I>
|
|
|
|
policy only allows root or a user with the
|
|
<B>ALL</B>
|
|
|
|
privilege on the current host to use this option.
|
|
<DT id="30"><B>-T </B><I>timeout , -</I><B>-command-timeout = </B><I>timeout</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Used to set a timeout for the command.
|
|
If the timeout expires before the command has exited, the
|
|
command will be terminated.
|
|
The security policy may restrict the ability to set command timeouts.
|
|
The
|
|
<I>sudoers</I>
|
|
|
|
policy requires that user-specified timeouts be explicitly enabled.
|
|
<DT id="31"><B>-u </B><I>user , -</I><B>-user = </B><I>user</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Run the command as a user other than the default target user
|
|
(usually
|
|
<I>root )</I>
|
|
|
|
|
|
The
|
|
<I>user</I>
|
|
|
|
may be either a user name or a numeric user-ID
|
|
(UID)
|
|
|
|
prefixed with the
|
|
`#'
|
|
|
|
character (e.g.,
|
|
<B>#0</B>
|
|
|
|
for UID 0).
|
|
When running commands as a UID, many shells require that the
|
|
`#'
|
|
|
|
be escaped with a backslash
|
|
(`\'
|
|
|
|
)
|
|
|
|
|
|
Some security policies may restrict UIDs
|
|
to those listed in the password database.
|
|
The
|
|
<I>sudoers</I>
|
|
|
|
policy allows UIDs that are not in the password database as long as the
|
|
<I>targetpw</I>
|
|
|
|
option is not set.
|
|
Other security policies may not support this.
|
|
<DT id="32"><B>-V , -version</B>
|
|
|
|
|
|
<DD>
|
|
Print the
|
|
<B>sudo</B>
|
|
|
|
|
|
version string as well as the version string of the security
|
|
policy plugin and any I/O plugins.
|
|
If the invoking user is already root the
|
|
-<B>V</B>
|
|
|
|
option will display the arguments passed to configure when
|
|
<B>sudo</B>
|
|
|
|
|
|
was built and plugins may display more verbose information such as
|
|
default options.
|
|
<DT id="33"><B>-v , -validate</B>
|
|
|
|
|
|
<DD>
|
|
Update the user's cached credentials, authenticating the user
|
|
if necessary.
|
|
For the
|
|
<I>sudoers</I>
|
|
|
|
plugin, this extends the
|
|
<B>sudo</B>
|
|
|
|
|
|
timeout for another
|
|
<B>15</B>
|
|
|
|
minutes by default, but does not run a command.
|
|
Not all security policies support cached credentials.
|
|
<DT id="34"><B>-
|
|
|
|
</B>
|
|
<DD>
|
|
|
|
The
|
|
-<B>-</B>
|
|
|
|
option indicates that
|
|
<B>sudo</B>
|
|
|
|
|
|
should stop processing command line arguments.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
Environment variables to be set for the command may also be passed
|
|
on the command line in the form of
|
|
<I>VAR </I><B>= </B><I>value</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
e.g.,
|
|
<B>LD_LIBRARY_PATH = /usr/local/pkg/lib
|
|
|
|
</B>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Variables passed on the command line are subject to restrictions
|
|
imposed by the security policy plugin.
|
|
The
|
|
<I>sudoers</I>
|
|
|
|
policy subjects variables passed on the command line to the same
|
|
restrictions as normal environment variables with one important
|
|
exception.
|
|
If the
|
|
<I>setenv</I>
|
|
|
|
option is set in
|
|
<I>sudoers</I>
|
|
|
|
|
|
the command to be run has the
|
|
<B>SETENV</B>
|
|
|
|
tag set or the command matched is
|
|
<B>ALL</B>
|
|
|
|
|
|
the user may set variables that would otherwise be forbidden.
|
|
See
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5)
|
|
|
|
|
|
for more information.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>COMMAND EXECUTION</H2>
|
|
|
|
When
|
|
<B>sudo</B>
|
|
|
|
|
|
executes a command, the security policy specifies the execution
|
|
environment for the command.
|
|
Typically, the real and effective user and group and IDs are set to
|
|
match those of the target user, as specified in the password database,
|
|
and the group vector is initialized based on the group database
|
|
(unless the
|
|
-<B>P</B>
|
|
|
|
option was specified).
|
|
<P>
|
|
|
|
The following parameters may be specified by security policy:
|
|
<UL><P>
|
|
|
|
<LI>
|
|
|
|
real and effective user-ID
|
|
<LI>
|
|
|
|
real and effective group-ID
|
|
<LI>
|
|
|
|
supplementary group-IDs
|
|
<LI>
|
|
|
|
the environment list
|
|
<LI>
|
|
|
|
current working directory
|
|
<LI>
|
|
|
|
file creation mode mask (umask)
|
|
<LI>
|
|
|
|
|
|
SELinux role and type
|
|
|
|
|
|
|
|
|
|
<LI>
|
|
|
|
scheduling priority (aka nice value)
|
|
</UL><P>
|
|
|
|
<A NAME="lbAF"> </A>
|
|
<H3>Process model</H3>
|
|
|
|
There are two distinct ways
|
|
<B>sudo</B>
|
|
|
|
|
|
can run a command.
|
|
<P>
|
|
|
|
If an I/O logging plugin is configured or if the security policy
|
|
explicitly requests it, a new pseudo-terminal
|
|
(``pty''
|
|
|
|
)
|
|
|
|
is allocated and
|
|
<A HREF="/cgi-bin/man/man2html?2+fork">fork</A>(2)
|
|
|
|
|
|
is used to create a second
|
|
<B>sudo</B>
|
|
|
|
|
|
process, referred to as the
|
|
<I>monitor</I>
|
|
|
|
|
|
The
|
|
<I>monitor</I>
|
|
|
|
creates a new terminal session with itself as the leader and the pty as its
|
|
controlling terminal, calls
|
|
<A HREF="/cgi-bin/man/man2html?2+fork">fork</A>(2),
|
|
|
|
|
|
sets up the execution environment as described above, and then uses the
|
|
<A HREF="/cgi-bin/man/man2html?2+execve">execve</A>(2)
|
|
|
|
|
|
system call to run the command in the child process.
|
|
The
|
|
<I>monitor</I>
|
|
|
|
exists to relay job control signals between the user's
|
|
existing terminal and the pty the command is being run in.
|
|
This makes it possible to suspend and resume the command.
|
|
Without the monitor, the command would be in what POSIX terms an
|
|
``orphaned process group''
|
|
|
|
and it would not receive any job control signals from the kernel.
|
|
When the command exits or is terminated by a signal, the
|
|
<I>monitor</I>
|
|
|
|
passes the command's exit status to the main
|
|
<B>sudo</B>
|
|
|
|
|
|
process and exits.
|
|
After receiving the command's exit status, the main
|
|
<B>sudo</B>
|
|
|
|
|
|
passes the command's exit status to the security policy's close function
|
|
and exits.
|
|
<P>
|
|
|
|
If no pty is used,
|
|
<B>sudo</B>
|
|
|
|
|
|
calls
|
|
<A HREF="/cgi-bin/man/man2html?2+fork">fork</A>(2),
|
|
|
|
|
|
sets up the execution environment as described above, and uses the
|
|
<A HREF="/cgi-bin/man/man2html?2+execve">execve</A>(2)
|
|
|
|
|
|
system call to run the command in the child process.
|
|
The main
|
|
<B>sudo</B>
|
|
|
|
|
|
process waits until the command has completed, then passes the
|
|
command's exit status to the security policy's close function and exits.
|
|
As a special case, if the policy plugin does not define a close
|
|
function,
|
|
<B>sudo</B>
|
|
|
|
|
|
will execute the command directly instead of calling
|
|
<A HREF="/cgi-bin/man/man2html?2+fork">fork</A>(2)
|
|
|
|
|
|
first.
|
|
The
|
|
<I>sudoers</I>
|
|
|
|
policy plugin will only define a close function when I/O logging
|
|
is enabled, a pty is required, or the
|
|
<I>pam_session</I>
|
|
|
|
or
|
|
<I>pam_setcred</I>
|
|
|
|
options are enabled.
|
|
Note that
|
|
<I>pam_session</I>
|
|
|
|
and
|
|
<I>pam_setcred</I>
|
|
|
|
are enabled by default on systems using PAM.
|
|
<A NAME="lbAG"> </A>
|
|
<H3>Signal handling</H3>
|
|
|
|
When the command is run as a child of the
|
|
<B>sudo</B>
|
|
|
|
|
|
process,
|
|
<B>sudo</B>
|
|
|
|
|
|
will relay signals it receives to the command.
|
|
The
|
|
<B>SIGINT</B>
|
|
|
|
and
|
|
<B>SIGQUIT</B>
|
|
|
|
signals are only relayed when the command is being run in a new pty
|
|
or when the signal was sent by a user process, not the kernel.
|
|
This prevents the command from receiving
|
|
<B>SIGINT</B>
|
|
|
|
twice each time the user enters control-C.
|
|
Some signals, such as
|
|
<B>SIGSTOP</B>
|
|
|
|
and
|
|
<B>SIGKILL</B>
|
|
|
|
|
|
cannot be caught and thus will not be relayed to the command.
|
|
As a general rule,
|
|
<B>SIGTSTP</B>
|
|
|
|
should be used instead of
|
|
<B>SIGSTOP</B>
|
|
|
|
when you wish to suspend a command being run by
|
|
<B>.</B>
|
|
|
|
<P>
|
|
|
|
As a special case,
|
|
<B>sudo</B>
|
|
|
|
|
|
will not relay signals that were sent by the command it is running.
|
|
This prevents the command from accidentally killing itself.
|
|
On some systems, the
|
|
<A HREF="/cgi-bin/man/man2html?8+reboot">reboot</A>(8)
|
|
|
|
|
|
command sends
|
|
<B>SIGTERM</B>
|
|
|
|
to all non-system processes other than itself before rebooting
|
|
the system.
|
|
This prevents
|
|
<B>sudo</B>
|
|
|
|
|
|
from relaying the
|
|
<B>SIGTERM</B>
|
|
|
|
signal it received back to
|
|
<A HREF="/cgi-bin/man/man2html?8+reboot">reboot</A>(8),
|
|
|
|
|
|
which might then exit before the system was actually rebooted,
|
|
leaving it in a half-dead state similar to single user mode.
|
|
Note, however, that this check only applies to the command run by
|
|
<B>sudo</B>
|
|
|
|
|
|
and not any other processes that the command may create.
|
|
As a result, running a script that calls
|
|
<A HREF="/cgi-bin/man/man2html?8+reboot">reboot</A>(8)
|
|
|
|
|
|
or
|
|
<A HREF="/cgi-bin/man/man2html?8+shutdown">shutdown</A>(8)
|
|
|
|
|
|
via
|
|
<B>sudo</B>
|
|
|
|
|
|
may cause the system to end up in this undefined state unless the
|
|
<A HREF="/cgi-bin/man/man2html?8+reboot">reboot</A>(8)
|
|
|
|
|
|
or
|
|
<A HREF="/cgi-bin/man/man2html?8+shutdown">shutdown</A>(8)
|
|
|
|
|
|
are run using the
|
|
Fn exec
|
|
|
|
family of functions instead of
|
|
Fn system
|
|
|
|
(which interposes a shell between the command and the calling process).
|
|
<P>
|
|
|
|
If no I/O logging plugins are loaded and the policy plugin has not
|
|
defined a
|
|
Fn close
|
|
|
|
function, set a command timeout or required that the command be
|
|
run in a new pty,
|
|
<B>sudo</B>
|
|
|
|
|
|
may execute the command directly instead of running it as a child process.
|
|
<A NAME="lbAH"> </A>
|
|
<H3>Plugins</H3>
|
|
|
|
Plugins may be specified via
|
|
<B>Plugin</B>
|
|
|
|
directives in the
|
|
sudo.conf5
|
|
|
|
|
|
file.
|
|
They may be loaded as dynamic shared objects (on systems that support them),
|
|
or compiled directly into the
|
|
<B>sudo</B>
|
|
|
|
|
|
binary.
|
|
If no
|
|
sudo.conf5
|
|
|
|
|
|
file is present, or it contains no
|
|
<B>Plugin</B>
|
|
|
|
lines,
|
|
<B>sudo</B>
|
|
|
|
|
|
will use the traditional
|
|
<I>sudoers</I>
|
|
|
|
security policy and I/O logging.
|
|
See the
|
|
sudo.conf5
|
|
|
|
|
|
manual for details of the
|
|
/etc/sudo.conf
|
|
|
|
file and the
|
|
sudo_plugin5
|
|
|
|
|
|
manual for more information about the
|
|
<B>sudo</B>
|
|
|
|
|
|
plugin architecture.
|
|
<A NAME="lbAI"> </A>
|
|
<H2>EXIT VALUE</H2>
|
|
|
|
Upon successful execution of a command, the exit status from
|
|
<B>sudo</B>
|
|
|
|
|
|
will be the exit status of the program that was executed.
|
|
If the command terminated due to receipt of a signal,
|
|
<B>sudo</B>
|
|
|
|
|
|
will send itself the same signal that terminated the command.
|
|
<P>
|
|
|
|
If the
|
|
-<B>l</B>
|
|
|
|
option was specified without a command,
|
|
<B>sudo</B>
|
|
|
|
|
|
will exit with a value of 0 if the user is allowed to run
|
|
<B>sudo</B>
|
|
|
|
|
|
and they authenticated successfully (as required by the security policy).
|
|
If a command is specified with the
|
|
-<B>l</B>
|
|
|
|
option, the exit value will only be 0 if the command is permitted by the
|
|
security policy, otherwise it will be 1.
|
|
<P>
|
|
|
|
If there is an authentication failure, a configuration/permission
|
|
problem or if the given command cannot be executed,
|
|
<B>sudo</B>
|
|
|
|
|
|
exits with a value of 1.
|
|
In the latter case, the error string is printed to the standard error.
|
|
If
|
|
<B>sudo</B>
|
|
|
|
|
|
cannot
|
|
<A HREF="/cgi-bin/man/man2html?2+stat">stat</A>(2)
|
|
|
|
|
|
one or more entries in the user's
|
|
<B>PATH</B>
|
|
|
|
|
|
an error is printed to the standard error.
|
|
(If the directory does not exist or if it is not really a directory,
|
|
the entry is ignored and no error is printed.)
|
|
This should not happen under normal circumstances.
|
|
The most common reason for
|
|
<A HREF="/cgi-bin/man/man2html?2+stat">stat</A>(2)
|
|
|
|
|
|
to return
|
|
``permission denied''
|
|
|
|
is if you are running an automounter and one of the directories in
|
|
your
|
|
<B>PATH</B>
|
|
|
|
is on a machine that is currently unreachable.
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>SECURITY NOTES</H2>
|
|
|
|
<B>sudo</B>
|
|
|
|
|
|
tries to be safe when executing external commands.
|
|
<P>
|
|
|
|
To prevent command spoofing,
|
|
<B>sudo</B>
|
|
|
|
|
|
checks "." and "" (both denoting current directory) last when
|
|
searching for a command in the user's
|
|
<B>PATH</B>
|
|
|
|
(if one or both are in the
|
|
<B>PATH )</B>
|
|
|
|
|
|
Note, however, that the actual
|
|
<B>PATH</B>
|
|
|
|
environment variable is
|
|
<I>not</I>
|
|
|
|
modified and is passed unchanged to the program that
|
|
<B>sudo</B>
|
|
|
|
|
|
executes.
|
|
<P>
|
|
|
|
Users should
|
|
<I>never</I>
|
|
|
|
be granted
|
|
<B>sudo</B>
|
|
|
|
|
|
privileges to execute files that are writable by the user or
|
|
that reside in a directory that is writable by the user.
|
|
If the user can modify or replace the command there is no way
|
|
to limit what additional commands they can run.
|
|
<P>
|
|
|
|
Please note that
|
|
<B>sudo</B>
|
|
|
|
|
|
will normally only log the command it explicitly runs.
|
|
If a user runs a command such as
|
|
<B>sudo su</B>
|
|
|
|
or
|
|
<B>sudo sh</B>
|
|
|
|
|
|
subsequent commands run from that shell are not subject to
|
|
<B>sudo 's</B>
|
|
|
|
|
|
|
|
security policy.
|
|
The same is true for commands that offer shell escapes (including
|
|
most editors).
|
|
If I/O logging is enabled, subsequent commands will have their input and/or
|
|
output logged, but there will not be traditional logs for those commands.
|
|
Because of this, care must be taken when giving users access to commands via
|
|
<B>sudo</B>
|
|
|
|
|
|
to verify that the command does not inadvertently give the user an
|
|
effective root shell.
|
|
For more information, please see the
|
|
<I>Preventing shell escapes</I>
|
|
|
|
section in
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5).
|
|
|
|
|
|
<P>
|
|
|
|
To prevent the disclosure of potentially sensitive information,
|
|
<B>sudo</B>
|
|
|
|
|
|
disables core dumps by default while it is executing (they are
|
|
re-enabled for the command that is run).
|
|
This historical practice dates from a time when most operating
|
|
systems allowed set-user-ID processes to dump core by default.
|
|
To aid in debugging
|
|
<B>sudo</B>
|
|
|
|
|
|
crashes, you may wish to re-enable core dumps by setting
|
|
``disable_coredump''
|
|
|
|
to false in the
|
|
sudo.conf5
|
|
|
|
|
|
file as follows:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
Set disable_coredump false
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
See the
|
|
sudo.conf5
|
|
|
|
|
|
manual for more information.
|
|
<A NAME="lbAK"> </A>
|
|
<H2>ENVIRONMENT</H2>
|
|
|
|
<B>sudo</B>
|
|
|
|
|
|
utilizes the following environment variables.
|
|
The security policy has control over the actual content of the command's
|
|
environment.
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="35"><B>EDITOR</B>
|
|
|
|
|
|
<DD>
|
|
Default editor to use in
|
|
-<B>e</B>
|
|
|
|
(sudoedit) mode if neither
|
|
<B>SUDO_EDITOR</B>
|
|
|
|
nor
|
|
<B>VISUAL</B>
|
|
|
|
is set.
|
|
<DT id="36"><B>MAIL</B>
|
|
|
|
|
|
<DD>
|
|
Set to the mail spool of the target user when the
|
|
-<B>i</B>
|
|
|
|
option is specified or when
|
|
<I>env_reset</I>
|
|
|
|
is enabled in
|
|
<I>sudoers</I>
|
|
|
|
(unless
|
|
<B>MAIL</B>
|
|
|
|
is present in the
|
|
<I>env_keep</I>
|
|
|
|
list).
|
|
<DT id="37"><B>HOME</B>
|
|
|
|
|
|
<DD>
|
|
Set to the home directory of the target user when the
|
|
-<B>i</B>
|
|
|
|
or
|
|
-<B>H</B>
|
|
|
|
options are specified, when the
|
|
-<B>s</B>
|
|
|
|
option is specified and
|
|
<I>set_home</I>
|
|
|
|
is set in
|
|
<I>sudoers</I>
|
|
|
|
|
|
when
|
|
<I>always_set_home</I>
|
|
|
|
is enabled in
|
|
<I>sudoers</I>
|
|
|
|
|
|
or when
|
|
<I>env_reset</I>
|
|
|
|
is enabled in
|
|
<I>sudoers</I>
|
|
|
|
and
|
|
<I>HOME</I>
|
|
|
|
is not present in the
|
|
<I>env_keep</I>
|
|
|
|
list.
|
|
<DT id="38"><B>LOGNAME</B>
|
|
|
|
|
|
<DD>
|
|
Set to the login name of the target user when the
|
|
-<B>i</B>
|
|
|
|
option is specified, when the
|
|
<I>set_logname</I>
|
|
|
|
option is enabled in
|
|
<I>sudoers</I>
|
|
|
|
or when the
|
|
<I>env_reset</I>
|
|
|
|
option is enabled in
|
|
<I>sudoers</I>
|
|
|
|
(unless
|
|
<B>LOGNAME</B>
|
|
|
|
is present in the
|
|
<I>env_keep</I>
|
|
|
|
list).
|
|
<DT id="39"><B>PATH</B>
|
|
|
|
|
|
<DD>
|
|
May be overridden by the security policy.
|
|
<DT id="40"><B>SHELL</B>
|
|
|
|
|
|
<DD>
|
|
Used to determine shell to run with
|
|
-<B>s</B>
|
|
|
|
option.
|
|
<DT id="41"><B>SUDO_ASKPASS</B>
|
|
|
|
|
|
<DD>
|
|
Specifies the path to a helper program used to read the password
|
|
if no terminal is available or if the
|
|
-<B>A</B>
|
|
|
|
option is specified.
|
|
<DT id="42"><B>SUDO_COMMAND</B>
|
|
|
|
|
|
<DD>
|
|
Set to the command run by sudo.
|
|
<DT id="43"><B>SUDO_EDITOR</B>
|
|
|
|
|
|
<DD>
|
|
Default editor to use in
|
|
-<B>e</B>
|
|
|
|
(sudoedit) mode.
|
|
<DT id="44"><B>SUDO_GID</B>
|
|
|
|
|
|
<DD>
|
|
Set to the group-ID of the user who invoked sudo.
|
|
<DT id="45"><B>SUDO_PROMPT</B>
|
|
|
|
|
|
<DD>
|
|
Used as the default password prompt unless
|
|
the
|
|
-<B>p</B>
|
|
|
|
option was specified.
|
|
<DT id="46"><B>SUDO_PS1</B>
|
|
|
|
|
|
<DD>
|
|
If set,
|
|
<B>PS1</B>
|
|
|
|
will be set to its value for the program being run.
|
|
<DT id="47"><B>SUDO_UID</B>
|
|
|
|
|
|
<DD>
|
|
Set to the user-ID of the user who invoked sudo.
|
|
<DT id="48"><B>SUDO_USER</B>
|
|
|
|
|
|
<DD>
|
|
Set to the login name of the user who invoked sudo.
|
|
<DT id="49"><B>USER</B>
|
|
|
|
|
|
<DD>
|
|
Set to the same value as
|
|
<B>LOGNAME</B>
|
|
|
|
|
|
described above.
|
|
<DT id="50"><B>VISUAL</B>
|
|
|
|
|
|
<DD>
|
|
Default editor to use in
|
|
-<B>e</B>
|
|
|
|
(sudoedit) mode if
|
|
<B>SUDO_EDITOR</B>
|
|
|
|
is not set.
|
|
</DL>
|
|
<P>
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H2>FILES</H2>
|
|
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="51"><B>/etc/sudo.conf
|
|
|
|
</B>
|
|
<DD>
|
|
<B>sudo</B>
|
|
|
|
|
|
front end configuration
|
|
</DL>
|
|
<P>
|
|
|
|
<A NAME="lbAM"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
Note: the following examples assume a properly configured security
|
|
policy.
|
|
<P>
|
|
|
|
To get a file listing of an unreadable directory:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ sudo ls /usr/local/protected
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
To list the home directory of user yaz on a machine where the file
|
|
system holding ~yaz is not exported as root:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ sudo -u yaz ls ~yaz
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
To edit the
|
|
index.html
|
|
|
|
file as user www:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ sudoedit -u www ~www/htdocs/index.html
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
To view system logs only accessible to root and users in the adm
|
|
group:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ sudo -g adm more /var/log/syslog
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
To run an editor as jim with a different primary group:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ sudoedit -u jim -g audio ~jim/sound.txt
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
To shut down a machine:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ sudo shutdown -r +15 "quick reboot"
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
To make a usage listing of the directories in the /home partition.
|
|
Note that this runs the commands in a sub-shell to make the
|
|
<B>cd</B>
|
|
|
|
and file redirection work.
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<A NAME="lbAN"> </A>
|
|
<H2>DIAGNOSTICS</H2>
|
|
|
|
Error messages produced by
|
|
<B>sudo</B>
|
|
|
|
|
|
include:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="52"><B>editing files in a writable directory is not permitted</B>
|
|
|
|
|
|
<DD>
|
|
By default,
|
|
<B>sudoedit</B>
|
|
|
|
does not permit editing a file when any of the parent directories are writable
|
|
by the invoking user.
|
|
This avoids a race condition that could allow the user to overwrite
|
|
an arbitrary file.
|
|
See the
|
|
<I>sudoedit_checkdir</I>
|
|
|
|
option in
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5)
|
|
|
|
|
|
for more information.
|
|
<DT id="53"><B>editing symbolic links is not permitted</B>
|
|
|
|
|
|
<DD>
|
|
By default,
|
|
<B>sudoedit</B>
|
|
|
|
does not follow symbolic links when opening files.
|
|
See the
|
|
<I>sudoedit_follow</I>
|
|
|
|
option in
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5)
|
|
|
|
|
|
for more information.
|
|
<DT id="54"><B>effective uid is not 0, is sudo installed setuid root?</B>
|
|
|
|
|
|
<DD>
|
|
<B>sudo</B>
|
|
|
|
|
|
was not run with root privileges.
|
|
The
|
|
<B>sudo</B>
|
|
|
|
|
|
binary must be owned by the root user and have the set-user-ID bit set.
|
|
Also, it must not be located on a file system mounted with the
|
|
`nosuid'
|
|
|
|
option or on an NFS file system that maps uid 0 to an unprivileged uid.
|
|
<DT id="55"><B>effective uid is not 0, is sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?</B>
|
|
|
|
|
|
<DD>
|
|
<B>sudo</B>
|
|
|
|
|
|
was not run with root privileges.
|
|
The
|
|
<B>sudo</B>
|
|
|
|
|
|
binary has the proper owner and permissions but it still did not run
|
|
with root privileges.
|
|
The most common reason for this is that the file system the
|
|
<B>sudo</B>
|
|
|
|
|
|
binary is located on is mounted with the
|
|
`nosuid'
|
|
|
|
option or it is an NFS file system that maps uid 0 to an unprivileged uid.
|
|
<DT id="56"><B>fatal error, unable to load plugins</B>
|
|
|
|
|
|
<DD>
|
|
An error occurred while loading or initializing the plugins specified in
|
|
sudo.conf5.
|
|
|
|
|
|
<DT id="57"><B>invalid environment variable name</B>
|
|
|
|
|
|
<DD>
|
|
One or more environment variable names specified via the
|
|
-<B>E</B>
|
|
|
|
option contained an equal sign
|
|
(`='
|
|
|
|
)
|
|
|
|
|
|
The arguments to the
|
|
-<B>E</B>
|
|
|
|
option should be environment variable names without an associated value.
|
|
<DT id="58"><B>no password was provided</B>
|
|
|
|
|
|
<DD>
|
|
When
|
|
<B>sudo</B>
|
|
|
|
|
|
tried to read the password, it did not receive any characters.
|
|
This may happen if no terminal is available (or the
|
|
-<B>S</B>
|
|
|
|
option is specified) and the standard input has been redirected from
|
|
/dev/null
|
|
|
|
|
|
<DT id="59"><B>a terminal is required to read the password</B>
|
|
|
|
|
|
<DD>
|
|
<B>sudo</B>
|
|
|
|
|
|
needs to read the password but there is no mechanism available for it
|
|
to do so.
|
|
A terminal is not present to read the password from,
|
|
<B>sudo</B>
|
|
|
|
|
|
has not been configured to read from the standard input,
|
|
the
|
|
-<B>S</B>
|
|
|
|
option was not used, and no askpass helper has been specified either via the
|
|
sudo.conf5
|
|
|
|
|
|
file or the
|
|
<B>SUDO_ASKPASS</B>
|
|
|
|
environment variable.
|
|
<DT id="60"><B>no writable temporary directory found</B>
|
|
|
|
|
|
<DD>
|
|
<B>sudoedit</B>
|
|
|
|
was unable to find a usable temporary directory in which to store its
|
|
intermediate files.
|
|
<DT id="61"><B>sudo must be owned by uid 0 and have the setuid bit set</B>
|
|
|
|
|
|
<DD>
|
|
<B>sudo</B>
|
|
|
|
|
|
was not run with root privileges.
|
|
The
|
|
<B>sudo</B>
|
|
|
|
|
|
binary does not have the correct owner or permissions.
|
|
It must be owned by the root user and have the set-user-ID bit set.
|
|
<DT id="62"><B>sudoedit is not supported on this platform</B>
|
|
|
|
|
|
<DD>
|
|
It is only possible to run
|
|
<B>sudoedit</B>
|
|
|
|
on systems that support setting the effective user-ID.
|
|
<DT id="63"><B>timed out reading password</B>
|
|
|
|
|
|
<DD>
|
|
The user did not enter a password before the password timeout
|
|
(5 minutes by default) expired.
|
|
<DT id="64"><B>you do not exist in the passwd database</B>
|
|
|
|
|
|
<DD>
|
|
Your user-ID does not appear in the system passwd database.
|
|
<DT id="65"><B>you may not specify environment variables in edit mode</B>
|
|
|
|
|
|
<DD>
|
|
It is only possible to specify environment variables when running
|
|
a command.
|
|
When editing a file, the editor is run with the user's environment unmodified.
|
|
</DL>
|
|
<P>
|
|
|
|
<A NAME="lbAO"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+su">su</A>(1),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?2+stat">stat</A>(2),
|
|
|
|
|
|
login_cap3,
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?5+passwd">passwd</A>(5),
|
|
|
|
|
|
sudo.conf5,
|
|
|
|
|
|
sudo_plugin5,
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5),
|
|
|
|
|
|
sudoers_timestamp5,
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?8+sudoreplay">sudoreplay</A>(8),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?8+visudo">visudo</A>(8)
|
|
|
|
|
|
<A NAME="lbAP"> </A>
|
|
<H2>HISTORY</H2>
|
|
|
|
See the HISTORY file in the
|
|
<B>sudo</B>
|
|
|
|
|
|
distribution (<A HREF="https://www.sudo.ws/history.html)">https://www.sudo.ws/history.html)</A> for a brief
|
|
history of sudo.
|
|
<A NAME="lbAQ"> </A>
|
|
<H2>AUTHORS</H2>
|
|
|
|
Many people have worked on
|
|
<B>sudo</B>
|
|
|
|
|
|
over the years; this version consists of code written primarily by:
|
|
|
|
<BLOCKQUOTE>
|
|
|
|
An Todd C. Miller
|
|
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
See the CONTRIBUTORS file in the
|
|
<B>sudo</B>
|
|
|
|
|
|
distribution (<A HREF="https://www.sudo.ws/contributors.html)">https://www.sudo.ws/contributors.html)</A> for an
|
|
exhaustive list of people who have contributed to
|
|
<B>.</B>
|
|
|
|
<A NAME="lbAR"> </A>
|
|
<H2>CAVEATS</H2>
|
|
|
|
There is no easy way to prevent a user from gaining a root shell
|
|
if that user is allowed to run arbitrary commands via
|
|
<B>.</B>
|
|
|
|
Also, many programs (such as editors) allow the user to run commands
|
|
via shell escapes, thus avoiding
|
|
<B>sudo 's</B>
|
|
|
|
|
|
|
|
checks.
|
|
However, on most systems it is possible to prevent shell escapes with the
|
|
<A HREF="/cgi-bin/man/man2html?5+sudoers">sudoers</A>(5)
|
|
|
|
|
|
plugin's
|
|
<I>noexec</I>
|
|
|
|
functionality.
|
|
<P>
|
|
|
|
It is not meaningful to run the
|
|
<B>cd</B>
|
|
|
|
command directly via sudo, e.g.,
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ sudo cd /usr/local/protected
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
since when the command exits the parent process (your shell) will
|
|
still be the same.
|
|
Please see the
|
|
Sx EXAMPLES
|
|
|
|
section for more information.
|
|
<P>
|
|
|
|
Running shell scripts via
|
|
<B>sudo</B>
|
|
|
|
|
|
can expose the same kernel bugs that make set-user-ID shell scripts
|
|
unsafe on some operating systems (if your OS has a /dev/fd/ directory,
|
|
set-user-ID shell scripts are generally safe).
|
|
<A NAME="lbAS"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
If you feel you have found a bug in
|
|
<B>,</B>
|
|
|
|
please submit a bug report at <A HREF="https://bugzilla.sudo.ws/">https://bugzilla.sudo.ws/</A>
|
|
<A NAME="lbAT"> </A>
|
|
<H2>SUPPORT</H2>
|
|
|
|
Limited free support is available via the sudo-users mailing list,
|
|
see <A HREF="https://www.sudo.ws/mailman/listinfo/sudo-users">https://www.sudo.ws/mailman/listinfo/sudo-users</A> to subscribe or
|
|
search the archives.
|
|
<A NAME="lbAU"> </A>
|
|
<H2>DISCLAIMER</H2>
|
|
|
|
<B>sudo</B>
|
|
|
|
|
|
is provided
|
|
``AS IS''
|
|
|
|
and any express or implied warranties, including, but not limited
|
|
to, the implied warranties of merchantability and fitness for a
|
|
particular purpose are disclaimed.
|
|
See the LICENSE file distributed with
|
|
<B>sudo</B>
|
|
|
|
|
|
or <A HREF="https://www.sudo.ws/license.html">https://www.sudo.ws/license.html</A> for complete details.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="66"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="67"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="68"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="69"><A HREF="#lbAE">COMMAND EXECUTION</A><DD>
|
|
<DL>
|
|
<DT id="70"><A HREF="#lbAF">Process model</A><DD>
|
|
<DT id="71"><A HREF="#lbAG">Signal handling</A><DD>
|
|
<DT id="72"><A HREF="#lbAH">Plugins</A><DD>
|
|
</DL>
|
|
<DT id="73"><A HREF="#lbAI">EXIT VALUE</A><DD>
|
|
<DT id="74"><A HREF="#lbAJ">SECURITY NOTES</A><DD>
|
|
<DT id="75"><A HREF="#lbAK">ENVIRONMENT</A><DD>
|
|
<DT id="76"><A HREF="#lbAL">FILES</A><DD>
|
|
<DT id="77"><A HREF="#lbAM">EXAMPLES</A><DD>
|
|
<DT id="78"><A HREF="#lbAN">DIAGNOSTICS</A><DD>
|
|
<DT id="79"><A HREF="#lbAO">SEE ALSO</A><DD>
|
|
<DT id="80"><A HREF="#lbAP">HISTORY</A><DD>
|
|
<DT id="81"><A HREF="#lbAQ">AUTHORS</A><DD>
|
|
<DT id="82"><A HREF="#lbAR">CAVEATS</A><DD>
|
|
<DT id="83"><A HREF="#lbAS">BUGS</A><DD>
|
|
<DT id="84"><A HREF="#lbAT">SUPPORT</A><DD>
|
|
<DT id="85"><A HREF="#lbAU">DISCLAIMER</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:16 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|