4 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
7 N
\bN
\bN
\bNA
\bA
\bA
\bAM
\bM
\bM
\bME
\bE
\bE
\bE
8 sudoers - list of which users may execute what
10 D
\bD
\bD
\bDE
\bE
\bE
\bES
\bS
\bS
\bSC
\bC
\bC
\bCR
\bR
\bR
\bRI
\bI
\bI
\bIP
\bP
\bP
\bPT
\bT
\bT
\bTI
\bI
\bI
\bIO
\bO
\bO
\bON
\bN
\bN
\bN
11 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is composed of two types of entries:
12 aliases (basically variables) and user specifications
13 (which specify who may run what). The grammar of _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
14 will be described below in Extended Backus-Naur Form
15 (EBNF). Don't despair if you don't know what EBNF is; it
16 is fairly simple, and the definitions below are annotated.
18 Q
\bQ
\bQ
\bQu
\bu
\bu
\bui
\bi
\bi
\bic
\bc
\bc
\bck
\bk
\bk
\bk g
\bg
\bg
\bgu
\bu
\bu
\bui
\bi
\bi
\bid
\bd
\bd
\bde
\be
\be
\be t
\bt
\bt
\bto
\bo
\bo
\bo E
\bE
\bE
\bEB
\bB
\bB
\bBN
\bN
\bN
\bNF
\bF
\bF
\bF
20 EBNF is a concise and exact way of describing the grammar
21 of a language. Each EBNF definition is made up of _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\b
22 _
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be_
\bs. E.g.,
24 symbol ::= definition | alternate1 | alternate2 ...
26 Each _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be references others and thus makes up a
27 grammar for the language. EBNF also contains the follow
28 ing operators, which many readers will recognize from reg
29 ular expressions. Do not, however, confuse them with
30 "wildcard" characters, which have different meanings.
32 ? Means that the preceding symbol (or group of sym
33 bols) is optional. That is, it may appear once or
36 * Means that the preceding symbol (or group of sym
37 bols) may appear zero or more times.
39 + Means that the preceding symbol (or group of sym
40 bols) may appear one or more times.
42 Parentheses may be used to group symbols together. For
43 clarity, we will use single quotes ('') to designate what
44 is a verbatim character string (as opposed to a symbol
47 A
\bA
\bA
\bAl
\bl
\bl
\bli
\bi
\bi
\bia
\ba
\ba
\bas
\bs
\bs
\bse
\be
\be
\bes
\bs
\bs
\bs
49 There are four kinds of aliases: User_Alias, Runas_Alias,
50 Host_Alias and Cmnd_Alias.
52 Alias ::= 'User_Alias' User_Alias (':' User_Alias)* |
53 'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
54 'Host_Alias' Host_Alias (':' Host_Alias)* |
55 'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)*
57 User_Alias ::= NAME '=' User_List
59 Runas_Alias ::= NAME '=' Runas_List
64 April 25, 2002 1.6.6 1
70 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
73 Host_Alias ::= NAME '=' Host_List
75 Cmnd_Alias ::= NAME '=' Cmnd_List
77 NAME ::= [A-Z]([A-Z][0-9]_)*
79 Each _
\ba_
\bl_
\bi_
\ba_
\bs definition is of the form
81 Alias_Type NAME = item1, item2, ...
83 where _
\bA_
\bl_
\bi_
\ba_
\bs_
\b__
\bT_
\by_
\bp_
\be is one of User_Alias, Runas_Alias,
84 Host_Alias, or Cmnd_Alias. A NAME is a string of upper
85 case letters, numbers, and the underscore characters
86 ('_'). A NAME m
\bm
\bm
\bmu
\bu
\bu
\bus
\bs
\bs
\bst
\bt
\bt
\bt start with an uppercase letter. It is
87 possible to put several alias definitions of the same type
88 on a single line, joined by a colon (':'). E.g.,
90 Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
92 The definitions of what constitutes a valid _
\ba_
\bl_
\bi_
\ba_
\bs member
98 User ::= '!'* username |
103 A User_List is made up of one or more usernames, uids
104 (prefixed with '#'), System groups (prefixed with '%'),
105 netgroups (prefixed with '+') and other aliases. Each
106 list item may be prefixed with one or more '!' operators.
107 An odd number of '!' operators negate the value of the
108 item; an even number just cancel each other out.
110 Runas_List ::= Runas_User |
111 Runas_User ',' Runas_List
113 Runas_User ::= '!'* username |
119 A Runas_List is similar to a User_List except that it can
120 also contain uids (prefixed with '#') and instead of
121 User_Aliases it can contain Runas_Aliases.
130 April 25, 2002 1.6.6 2
136 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
139 Host ::= '!'* hostname |
141 '!'* network(/netmask)? |
145 A Host_List is made up of one or more hostnames, IP
146 addresses, network numbers, netgroups (prefixed with '+')
147 and other aliases. Again, the value of an item may be
148 negated with the '!' operator. If you do not specify a
149 netmask with a network number, the netmask of the host's
150 ethernet _
\bi_
\bn_
\bt_
\be_
\br_
\bf_
\ba_
\bc_
\be(s) will be used when matching. The
151 netmask may be specified either in dotted quad notation
152 (e.g. 255.255.255.0) or CIDR notation (number of bits,
153 e.g. 24). A hostname may include shell-style wildcards
154 (see `Wildcards' section below), but unless the hostname
155 command on your machine returns the fully qualified host
156 name, you'll need to use the _
\bf_
\bq_
\bd_
\bn option for wildcards to
162 commandname ::= filename |
166 Cmnd ::= '!'* commandname |
170 A Cmnd_List is a list of one or more commandnames, direc
171 tories, and other aliases. A commandname is a fully qual
172 ified filename which may include shell-style wildcards
173 (see `Wildcards' section below). A simple filename allows
174 the user to run the command with any arguments he/she
175 wishes. However, you may also specify command line argu
176 ments (including wildcards). Alternately, you can specify
177 "" to indicate that the command may only be run w
\bw
\bw
\bwi
\bi
\bi
\bit
\bt
\bt
\bth
\bh
\bh
\bho
\bo
\bo
\bou
\bu
\bu
\but
\bt
\bt
\bt
178 command line arguments. A directory is a fully qualified
179 pathname ending in a '/'. When you specify a directory in
180 a Cmnd_List, the user will be able to run any file within
181 that directory (but not in any subdirectories therein).
183 If a Cmnd has associated command line arguments, then the
184 arguments in the Cmnd must match exactly those given by
185 the user on the command line (or match the wildcards if
186 there are any). Note that the following characters must
187 be escaped with a '\' if they are used in command argu
188 ments: ',', ':', '=', '\'.
196 April 25, 2002 1.6.6 3
202 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
205 D
\bD
\bD
\bDe
\be
\be
\bef
\bf
\bf
\bfa
\ba
\ba
\bau
\bu
\bu
\bul
\bl
\bl
\blt
\bt
\bt
\bts
\bs
\bs
\bs
207 Certain configuration options may be changed from their
208 default values at runtime via one or more Default_Entry
209 lines. These may affect all users on any host, all users
210 on a specific host, or just a specific user. When multi
211 ple entries match, they are applied in order. Where there
212 are conflicting values, the last value on a matching line
215 Default_Type ::= 'Defaults' ||
216 'Defaults' ':' User ||
219 Default_Entry ::= Default_Type Parameter_List
221 Parameter ::= Parameter '=' Value ||
222 Parameter '+=' Value ||
223 Parameter '-=' Value ||
226 Parameters may be f
\bf
\bf
\bfl
\bl
\bl
\bla
\ba
\ba
\bag
\bg
\bg
\bgs
\bs
\bs
\bs, i
\bi
\bi
\bin
\bn
\bn
\bnt
\bt
\bt
\bte
\be
\be
\beg
\bg
\bg
\bge
\be
\be
\ber
\br
\br
\br values, s
\bs
\bs
\bst
\bt
\bt
\btr
\br
\br
\bri
\bi
\bi
\bin
\bn
\bn
\bng
\bg
\bg
\bgs
\bs
\bs
\bs, or
227 l
\bl
\bl
\bli
\bi
\bi
\bis
\bs
\bs
\bst
\bt
\bt
\bts
\bs
\bs
\bs. Flags are implicitly boolean and can be turned off
228 via the '!' operator. Some integer, string and list
229 parameters may also be used in a boolean context to dis
230 able them. Values may be enclosed in double quotes (")
231 when they contain multiple words. Special characters may
232 be escaped with a backslash (\).
234 Lists have two additional assignment operators, += and -=.
235 These operators are used to add to and delete from a list
236 respectively. It is not an error to use the -= operator
237 to remove an element that does not exist in a list.
239 Note that since the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is parsed in order the
240 best place to put the Defaults section is after the Host,
241 User, and Cmnd aliases but before the user specifications.
243 F
\bF
\bF
\bFl
\bl
\bl
\bla
\ba
\ba
\bag
\bg
\bg
\bgs
\bs
\bs
\bs:
246 When validating with a One Time Password
247 scheme (S
\bS
\bS
\bS/
\b/
\b/
\b/K
\bK
\bK
\bKe
\be
\be
\bey
\by
\by
\by or O
\bO
\bO
\bOP
\bP
\bP
\bPI
\bI
\bI
\bIE
\bE
\bE
\bE), a two-line prompt is
248 used to make it easier to cut and paste the
249 challenge to a local window. It's not as
250 pretty as the default but some people find it
251 more convenient. This flag is _
\bo_
\bf_
\bf by default.
253 ignore_dot If set, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will ignore '.' or '' (current
254 dir) in the PATH environment variable; the
255 PATH itself is not modified. This flag is _
\bo_
\bf_
\bf
262 April 25, 2002 1.6.6 4
268 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
271 mail_always Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user every time a
272 users runs s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo. This flag is _
\bo_
\bf_
\bf by default.
275 Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user if the user run
276 ning sudo does not enter the correct password.
277 This flag is _
\bo_
\bf_
\bf by default.
280 If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user
281 if the invoking user is not in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
282 file. This flag is _
\bo_
\bn by default.
285 If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user
286 if the invoking user exists in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
287 file, but is not allowed to run commands on
288 the current host. This flag is _
\bo_
\bf_
\bf by
292 If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user
293 if the invoking user allowed to use s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo but
294 the command they are trying is not listed in
295 their _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file entry. This flag is _
\bo_
\bf_
\bf by
298 tty_tickets If set, users must authenticate on a per-tty
299 basis. Normally, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo uses a directory in the
300 ticket dir with the same name as the user run
301 ning it. With this flag enabled, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will
302 use a file named for the tty the user is
303 logged in on in that directory. This flag is
304 _
\bo_
\bf_
\bf by default.
306 lecture If set, a user will receive a short lecture
307 the first time he/she runs s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo. This flag is
311 If set, users must authenticate themselves via
312 a password (or other means of authentication)
313 before they may run commands. This default
314 may be overridden via the PASSWD and NOPASSWD
315 tags. This flag is _
\bo_
\bn by default.
317 root_sudo If set, root is allowed to run s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo too. Dis
318 abling this prevents users from "chaining"
319 s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo commands to get a root shell by doing
320 something like "sudo sudo /bin/sh". This flag
321 is _
\bo_
\bn by default.
323 log_host If set, the hostname will be logged in the
324 (non-syslog) s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo log file. This flag is _
\bo_
\bf_
\bf
328 April 25, 2002 1.6.6 5
334 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
339 log_year If set, the four-digit year will be logged in
340 the (non-syslog) s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo log file. This flag is
341 _
\bo_
\bf_
\bf by default.
344 If set and s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo is invoked with no arguments
345 it acts as if the -
\b-
\b-
\b-s
\bs
\bs
\bs flag had been given.
346 That is, it runs a shell as root (the shell is
347 determined by the SHELL environment variable
348 if it is set, falling back on the shell listed
349 in the invoking user's /etc/passwd entry if
350 not). This flag is _
\bo_
\bf_
\bf by default.
352 set_home If set and s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo is invoked with the -
\b-
\b-
\b-s
\bs
\bs
\bs flag
353 the HOME environment variable will be set to
354 the home directory of the target user (which
355 is root unless the -
\b-
\b-
\b-u
\bu
\bu
\bu option is used). This
356 effectively makes the -
\b-
\b-
\b-s
\bs
\bs
\bs flag imply -
\b-
\b-
\b-H
\bH
\bH
\bH. This
357 flag is _
\bo_
\bf_
\bf by default.
360 If set, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will set the HOME environment
361 variable to the home directory of the target
362 user (which is root unless the -
\b-
\b-
\b-u
\bu
\bu
\bu option is
363 used). This effectively means that the -
\b-
\b-
\b-H
\bH
\bH
\bH
364 flag is always implied. This flag is _
\bo_
\bf_
\bf by
367 path_info Normally, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will tell the user when a com
368 mand could not be found in their PATH environ
369 ment variable. Some sites may wish to disable
370 this as it could be used to gather information
371 on the location of executables that the normal
372 user does not have access to. The disadvan
373 tage is that if the executable is simply not
374 in the user's PATH, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will tell the user
375 that they are not allowed to run it, which can
376 be confusing. This flag is _
\bo_
\bf_
\bf by default.
379 By default s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will initialize the group vec
380 tor to the list of groups the target user is
381 in. When _
\bp_
\br_
\be_
\bs_
\be_
\br_
\bv_
\be_
\b__
\bg_
\br_
\bo_
\bu_
\bp_
\bs is set, the user's
382 existing group vector is left unaltered. The
383 real and effective group IDs, however, are
384 still set to match the target user. This flag
385 is _
\bo_
\bf_
\bf by default.
387 fqdn Set this flag if you want to put fully quali
388 fied hostnames in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file. I.e.:
389 instead of myhost you would use myhost.mydo
390 main.edu. You may still use the short form if
394 April 25, 2002 1.6.6 6
400 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
403 you wish (and even mix the two). Beware that
404 turning on _
\bf_
\bq_
\bd_
\bn requires s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo to make DNS
405 lookups which may make s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo unusable if DNS
406 stops working (for example if the machine is
407 not plugged into the network). Also note that
408 you must use the host's official name as DNS
409 knows it. That is, you may not use a host
410 alias (CNAME entry) due to performance issues
411 and the fact that there is no way to get all
412 aliases from DNS. If your machine's hostname
413 (as returned by the hostname command) is
414 already fully qualified you shouldn't need to
415 set _
\bf_
\bq_
\bd_
\bn. This flag is _
\bo_
\bf_
\bf by default.
417 insults If set, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will insult users when they enter
418 an incorrect password. This flag is _
\bo_
\bf_
\bf by
421 requiretty If set, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will only run when the user is
422 logged in to a real tty. This will disallow
423 things like "rsh somehost sudo ls" since
424 _
\br_
\bs_
\bh(1) does not allocate a tty. Because it is
425 not possible to turn of echo when there is no
426 tty present, some sites may with to set this
427 flag to prevent a user from entering a visible
428 password. This flag is _
\bo_
\bf_
\bf by default.
430 env_editor If set, v
\bv
\bv
\bvi
\bi
\bi
\bis
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will use the value of the EDI
431 TOR or VISUAL environment variables before
432 falling back on the default editor list. Note
433 that this may create a security hole as it
434 allows the user to run any arbitrary command
435 as root without logging. A safer alternative
436 is to place a colon-separated list of editors
437 in the editor variable. v
\bv
\bv
\bvi
\bi
\bi
\bis
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will then only
438 use the EDITOR or VISUAL if they match a value
439 specified in editor. This flag is off by
442 rootpw If set, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will prompt for the root password
443 instead of the password of the invoking user.
444 This flag is _
\bo_
\bf_
\bf by default.
446 runaspw If set, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will prompt for the password of
447 the user defined by the _
\br_
\bu_
\bn_
\ba_
\bs_
\b__
\bd_
\be_
\bf_
\ba_
\bu_
\bl_
\bt option
448 (defaults to root) instead of the password of
449 the invoking user. This flag is _
\bo_
\bf_
\bf by
452 targetpw If set, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will prompt for the password of
453 the user specified by the -
\b-
\b-
\b-u
\bu
\bu
\bu flag (defaults to
454 root) instead of the password of the invoking
455 user. This flag is _
\bo_
\bf_
\bf by default.
460 April 25, 2002 1.6.6 7
466 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
469 set_logname Normally, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will set the LOGNAME and USER
470 environment variables to the name of the tar
471 get user (usually root unless the -
\b-
\b-
\b-u
\bu
\bu
\bu flag is
472 given). However, since some programs (includ
473 ing the RCS revision control system) use LOG
474 NAME to determine the real identity of the
475 user, it may be desirable to change this
476 behavior. This can be done by negating the
479 stay_setuid Normally, when s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo executes a command the
480 real and effective UIDs are set to the target
481 user (root by default). This option changes
482 that behavior such that the real UID is left
483 as the invoking user's UID. In other words,
484 this makes s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo act as a setuid wrapper. This
485 can be useful on systems that disable some
486 potentially dangerous functionality when a
487 program is run setuid. Note, however, that
488 this means that sudo will run with the real
489 uid of the invoking user which may allow that
490 user to kill s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo before it can log a failure,
491 depending on how your OS defines the interac
492 tion between signals and setuid processes.
494 env_reset If set, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will reset the environment to
495 only contain the following variables: HOME,
496 LOGNAME, PATH, SHELL, TERM, and USER (in addi
497 tion to the SUDO_* variables). Of these, only
498 TERM is copied unaltered from the old environ
499 ment. The other variables are set to default
500 values (possibly modified by the value of the
501 _
\bs_
\be_
\bt_
\b__
\bl_
\bo_
\bg_
\bn_
\ba_
\bm_
\be option). If s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo was compiled
502 with the SECURE_PATH option, its value will be
503 used for the PATH environment variable. Other
504 variables may be preserved with the _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp
508 If set, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will apply the defaults specified
509 for the target user's login class if one
510 exists. Only available if s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo is configured
511 with the --with-logincap option. This flag is
512 _
\bo_
\bf_
\bf by default.
514 I
\bI
\bI
\bIn
\bn
\bn
\bnt
\bt
\bt
\bte
\be
\be
\beg
\bg
\bg
\bge
\be
\be
\ber
\br
\br
\brs
\bs
\bs
\bs:
517 The number of tries a user gets to enter
518 his/her password before s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo logs the failure
519 and exits. The default is 3.
521 I
\bI
\bI
\bIn
\bn
\bn
\bnt
\bt
\bt
\bte
\be
\be
\beg
\bg
\bg
\bge
\be
\be
\ber
\br
\br
\brs
\bs
\bs
\bs t
\bt
\bt
\bth
\bh
\bh
\bha
\ba
\ba
\bat
\bt
\bt
\bt c
\bc
\bc
\bca
\ba
\ba
\ban
\bn
\bn
\bn b
\bb
\bb
\bbe
\be
\be
\be u
\bu
\bu
\bus
\bs
\bs
\bse
\be
\be
\bed
\bd
\bd
\bd i
\bi
\bi
\bin
\bn
\bn
\bn a
\ba
\ba
\ba b
\bb
\bb
\bbo
\bo
\bo
\boo
\bo
\bo
\bol
\bl
\bl
\ble
\be
\be
\bea
\ba
\ba
\ban
\bn
\bn
\bn c
\bc
\bc
\bco
\bo
\bo
\bon
\bn
\bn
\bnt
\bt
\bt
\bte
\be
\be
\bex
\bx
\bx
\bxt
\bt
\bt
\bt:
526 April 25, 2002 1.6.6 8
532 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
535 loglinelen Number of characters per line for the file
536 log. This value is used to decide when to
537 wrap lines for nicer log files. This has no
538 effect on the syslog log file, only the file
539 log. The default is 80 (use 0 or negate the
540 option to disable word wrap).
543 Number of minutes that can elapse before s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo
544 will ask for a passwd again. The default is
545 5. Set this to 0 to always prompt for a pass
546 word. If set to a value less than 0 the
547 user's timestamp will never expire. This can
548 be used to allow users to create or delete
549 their own timestamps via sudo -v and sudo -k
553 Number of minutes before the s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo password
554 prompt times out. The default is 5, set this
555 to 0 for no password timeout.
557 umask Umask to use when running the command. Negate
558 this option or set it to 0777 to preserve the
559 user's umask. The default is 0022.
561 S
\bS
\bS
\bSt
\bt
\bt
\btr
\br
\br
\bri
\bi
\bi
\bin
\bn
\bn
\bng
\bg
\bg
\bgs
\bs
\bs
\bs:
563 mailsub Subject of the mail sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user.
564 The escape %h will expand to the hostname of
565 the machine. Default is *** SECURITY informa
569 Message that is displayed if a user enters an
570 incorrect password. The default is Sorry, try
571 again. unless insults are enabled.
574 The directory in which s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo stores its times
575 tamp files. The default is _
\b/_
\bv_
\ba_
\br_
\b/_
\br_
\bu_
\bn_
\b/_
\bs_
\bu_
\bd_
\bo.
577 passprompt The default prompt to use when asking for a
578 password; can be overridden via the -
\b-
\b-
\b-p
\bp
\bp
\bp option
579 or the SUDO_PROMPT environment variable. Sup
580 ports two escapes: "%u" expands to the user's
581 login name and "%h" expands to the local host
582 name. The default value is Password:.
585 The default user to run commands as if the -
\b-
\b-
\b-u
\bu
\bu
\bu
586 flag is not specified on the command line.
587 This defaults to root.
592 April 25, 2002 1.6.6 9
598 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
602 Syslog priority to use when user authenticates
603 successfully. Defaults to notice.
606 Syslog priority to use when user authenticates
607 unsuccessfully. Defaults to alert.
609 editor A colon (':') separated list of editors
610 allowed to be used with v
\bv
\bv
\bvi
\bi
\bi
\bis
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo. v
\bv
\bv
\bvi
\bi
\bi
\bis
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will
611 choose the editor that matches the user's USER
612 environment variable if possible, or the first
613 editor in the list that exists and is exe
614 cutable. The default is the path to vi on
617 S
\bS
\bS
\bSt
\bt
\bt
\btr
\br
\br
\bri
\bi
\bi
\bin
\bn
\bn
\bng
\bg
\bg
\bgs
\bs
\bs
\bs t
\bt
\bt
\bth
\bh
\bh
\bha
\ba
\ba
\bat
\bt
\bt
\bt c
\bc
\bc
\bca
\ba
\ba
\ban
\bn
\bn
\bn b
\bb
\bb
\bbe
\be
\be
\be u
\bu
\bu
\bus
\bs
\bs
\bse
\be
\be
\bed
\bd
\bd
\bd i
\bi
\bi
\bin
\bn
\bn
\bn a
\ba
\ba
\ba b
\bb
\bb
\bbo
\bo
\bo
\boo
\bo
\bo
\bol
\bl
\bl
\ble
\be
\be
\bea
\ba
\ba
\ban
\bn
\bn
\bn c
\bc
\bc
\bco
\bo
\bo
\bon
\bn
\bn
\bnt
\bt
\bt
\bte
\be
\be
\bex
\bx
\bx
\bxt
\bt
\bt
\bt:
619 logfile Path to the s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo log file (not the syslog log
620 file). Setting a path turns on logging to a
621 file; negating this option turns it off.
623 syslog Syslog facility if syslog is being used for
624 logging (negate to disable syslog logging).
627 mailerpath Path to mail program used to send warning
628 mail. Defaults to the path to sendmail found
631 mailerflags Flags to use when invoking mailer. Defaults to
632 -
\b-
\b-
\b-t
\bt
\bt
\bt.
634 mailto Address to send warning and error mail to.
635 The address should be enclosed in double
636 quotes (") to protect against sudo interpret
637 ing the @ sign. Defaults to root.
640 Users in this group are exempt from password
641 and PATH requirements. This is not set by
644 verifypw This option controls when a password will be
645 required when a user runs s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo with the -
\b-
\b-
\b-v
\bv
\bv
\bv
646 flag. It has the following possible values:
648 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
649 current host must have the NOPASSWD
650 flag set to avoid entering a password.
652 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
653 entries for the current host must have
654 the NOPASSWD flag set to avoid
658 April 25, 2002 1.6.6 10
664 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
669 never The user need never enter a password
670 to use the -
\b-
\b-
\b-v
\bv
\bv
\bv flag.
672 always The user must always enter a password
673 to use the -
\b-
\b-
\b-v
\bv
\bv
\bv flag.
675 The default value is `all'.
677 listpw This option controls when a password will be
678 required when a user runs s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo with the -
\b-
\b-
\b-l
\bl
\bl
\bl.
679 It has the following possible values:
681 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
682 current host must have the NOPASSWD
683 flag set to avoid entering a password.
685 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
686 entries for the current host must have
687 the NOPASSWD flag set to avoid enter
690 never The user need never enter a password
691 to use the -
\b-
\b-
\b-l
\bl
\bl
\bl flag.
693 always The user must always enter a password
694 to use the -
\b-
\b-
\b-l
\bl
\bl
\bl flag.
696 The default value is `any'.
698 L
\bL
\bL
\bLi
\bi
\bi
\bis
\bs
\bs
\bst
\bt
\bt
\bts
\bs
\bs
\bs t
\bt
\bt
\bth
\bh
\bh
\bha
\ba
\ba
\bat
\bt
\bt
\bt c
\bc
\bc
\bca
\ba
\ba
\ban
\bn
\bn
\bn b
\bb
\bb
\bbe
\be
\be
\be u
\bu
\bu
\bus
\bs
\bs
\bse
\be
\be
\bed
\bd
\bd
\bd i
\bi
\bi
\bin
\bn
\bn
\bn a
\ba
\ba
\ba b
\bb
\bb
\bbo
\bo
\bo
\boo
\bo
\bo
\bol
\bl
\bl
\ble
\be
\be
\bea
\ba
\ba
\ban
\bn
\bn
\bn c
\bc
\bc
\bco
\bo
\bo
\bon
\bn
\bn
\bnt
\bt
\bt
\bte
\be
\be
\bex
\bx
\bx
\bxt
\bt
\bt
\bt:
700 env_check Environment variables to be removed from the
701 user's environment if the variable's value
702 contains % or / characters. This can be used
703 to guard against printf-style format vulnera
704 bilties in poorly-written programs. The argu
705 ment may be a double-quoted, space-separated
706 list or a single value without double-quotes.
707 The list can be replaced, added to, deleted
708 from, or disabled by using the =, +=, -=, and
709 ! operators respectively. The default list of
710 environment variable to check is printed when
711 s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo is run by root with the _
\b-_
\bV option.
713 env_delete Environment variables to be removed from the
714 user's environment. The argument may be a
715 double-quoted, space-separated list or a sin
716 gle value without double-quotes. The list can
717 be replaced, added to, deleted from, or dis
718 abled by using the =, +=, -=, and ! operators
719 respectively. The default list of environment
720 variable to remove is printed when s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo is run
724 April 25, 2002 1.6.6 11
730 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
733 by root with the _
\b-_
\bV option.
735 env_keep Environment variables to be preserved in the
736 user's environment when the _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt option
737 is in effect. This allows fine-grained con
738 trol over the environment s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo-spawned pro
739 cesses will receive. The argument may be a
740 double-quoted, space-separated list or a sin
741 gle value without double-quotes. The list can
742 be replaced, added to, deleted from, or dis
743 abled by using the =, +=, -=, and ! operators
744 respectively. This list has no default mem
747 When logging via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3), s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo accepts the following
748 values for the syslog facility (the value of the s
\bs
\bs
\bsy
\by
\by
\bys
\bs
\bs
\bsl
\bl
\bl
\blo
\bo
\bo
\bog
\bg
\bg
\bg
749 Parameter): a
\ba
\ba
\bau
\bu
\bu
\but
\bt
\bt
\bth
\bh
\bh
\bhp
\bp
\bp
\bpr
\br
\br
\bri
\bi
\bi
\biv
\bv
\bv
\bv (if your OS supports it), a
\ba
\ba
\bau
\bu
\bu
\but
\bt
\bt
\bth
\bh
\bh
\bh, d
\bd
\bd
\bda
\ba
\ba
\bae
\be
\be
\be
\b
\b
\b
750 m
\bm
\bm
\bmo
\bo
\bo
\bon
\bn
\bn
\bn, u
\bu
\bu
\bus
\bs
\bs
\bse
\be
\be
\ber
\br
\br
\br, l
\bl
\bl
\blo
\bo
\bo
\boc
\bc
\bc
\bca
\ba
\ba
\bal
\bl
\bl
\bl0
\b0
\b0
\b0, l
\bl
\bl
\blo
\bo
\bo
\boc
\bc
\bc
\bca
\ba
\ba
\bal
\bl
\bl
\bl1
\b1
\b1
\b1, l
\bl
\bl
\blo
\bo
\bo
\boc
\bc
\bc
\bca
\ba
\ba
\bal
\bl
\bl
\bl2
\b2
\b2
\b2, l
\bl
\bl
\blo
\bo
\bo
\boc
\bc
\bc
\bca
\ba
\ba
\bal
\bl
\bl
\bl3
\b3
\b3
\b3, l
\bl
\bl
\blo
\bo
\bo
\boc
\bc
\bc
\bca
\ba
\ba
\bal
\bl
\bl
\bl4
\b4
\b4
\b4, l
\bl
\bl
\blo
\bo
\bo
\boc
\bc
\bc
\bca
\ba
\ba
\bal
\bl
\bl
\bl5
\b5
\b5
\b5,
751 l
\bl
\bl
\blo
\bo
\bo
\boc
\bc
\bc
\bca
\ba
\ba
\bal
\bl
\bl
\bl6
\b6
\b6
\b6, and l
\bl
\bl
\blo
\bo
\bo
\boc
\bc
\bc
\bca
\ba
\ba
\bal
\bl
\bl
\bl7
\b7
\b7
\b7. The following syslog priorities are
752 supported: a
\ba
\ba
\bal
\bl
\bl
\ble
\be
\be
\ber
\br
\br
\brt
\bt
\bt
\bt, c
\bc
\bc
\bcr
\br
\br
\bri
\bi
\bi
\bit
\bt
\bt
\bt, d
\bd
\bd
\bde
\be
\be
\beb
\bb
\bb
\bbu
\bu
\bu
\bug
\bg
\bg
\bg, e
\be
\be
\bem
\bm
\bm
\bme
\be
\be
\ber
\br
\br
\brg
\bg
\bg
\bg, e
\be
\be
\ber
\br
\br
\brr
\br
\br
\br, i
\bi
\bi
\bin
\bn
\bn
\bnf
\bf
\bf
\bfo
\bo
\bo
\bo, n
\bn
\bn
\bno
\bo
\bo
\bot
\bt
\bt
\bti
\bi
\bi
\bic
\bc
\bc
\bce
\be
\be
\be,
753 and w
\bw
\bw
\bwa
\ba
\ba
\bar
\br
\br
\brn
\bn
\bn
\bni
\bi
\bi
\bin
\bn
\bn
\bng
\bg
\bg
\bg.
755 U
\bU
\bU
\bUs
\bs
\bs
\bse
\be
\be
\ber
\br
\br
\br S
\bS
\bS
\bSp
\bp
\bp
\bpe
\be
\be
\bec
\bc
\bc
\bci
\bi
\bi
\bif
\bf
\bf
\bfi
\bi
\bi
\bic
\bc
\bc
\bca
\ba
\ba
\bat
\bt
\bt
\bti
\bi
\bi
\bio
\bo
\bo
\bon
\bn
\bn
\bn
757 User_Spec ::= User_list Host_List '=' Cmnd_Spec_List \
760 Cmnd_Spec_List ::= Cmnd_Spec |
761 Cmnd_Spec ',' Cmnd_Spec_List
763 Cmnd_Spec ::= Runas_Spec? ('NOPASSWD:' | 'PASSWD:')? Cmnd
765 Runas_Spec ::= '(' Runas_List ')'
767 A u
\bu
\bu
\bus
\bs
\bs
\bse
\be
\be
\ber
\br
\br
\br s
\bs
\bs
\bsp
\bp
\bp
\bpe
\be
\be
\bec
\bc
\bc
\bci
\bi
\bi
\bif
\bf
\bf
\bfi
\bi
\bi
\bic
\bc
\bc
\bca
\ba
\ba
\bat
\bt
\bt
\bti
\bi
\bi
\bio
\bo
\bo
\bon
\bn
\bn
\bn determines which commands a user may
768 run (and as what user) on specified hosts. By default,
769 commands are run as r
\br
\br
\bro
\bo
\bo
\boo
\bo
\bo
\bot
\bt
\bt
\bt, but this can be changed on a
772 Let's break that down into its constituent parts:
774 R
\bR
\bR
\bRu
\bu
\bu
\bun
\bn
\bn
\bna
\ba
\ba
\bas
\bs
\bs
\bs_
\b_
\b_
\b_S
\bS
\bS
\bSp
\bp
\bp
\bpe
\be
\be
\bec
\bc
\bc
\bc
776 A Runas_Spec is simply a Runas_List (as defined above)
777 enclosed in a set of parentheses. If you do not specify a
778 Runas_Spec in the user specification, a default Runas_Spec
779 of r
\br
\br
\bro
\bo
\bo
\boo
\bo
\bo
\bot
\bt
\bt
\bt will be used. A Runas_Spec sets the default for
780 commands that follow it. What this means is that for the
783 dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/who
785 The user d
\bd
\bd
\bdg
\bg
\bg
\bgb
\bb
\bb
\bb may run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm
786 -- but only as o
\bo
\bo
\bop
\bp
\bp
\bpe
\be
\be
\ber
\br
\br
\bra
\ba
\ba
\bat
\bt
\bt
\bto
\bo
\bo
\bor
\br
\br
\br. E.g.,
790 April 25, 2002 1.6.6 12
796 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
799 sudo -u operator /bin/ls.
801 It is also possible to override a Runas_Spec later on in
802 an entry. If we modify the entry like so:
804 dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
806 Then user d
\bd
\bd
\bdg
\bg
\bg
\bgb
\bb
\bb
\bb is now allowed to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs as o
\bo
\bo
\bop
\bp
\bp
\bpe
\be
\be
\ber
\br
\br
\bra
\ba
\ba
\bat
\bt
\bt
\bto
\bo
\bo
\bor
\br
\br
\br,
807 but _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as r
\br
\br
\bro
\bo
\bo
\boo
\bo
\bo
\bot
\bt
\bt
\bt.
809 N
\bN
\bN
\bNO
\bO
\bO
\bOP
\bP
\bP
\bPA
\bA
\bA
\bAS
\bS
\bS
\bSS
\bS
\bS
\bSW
\bW
\bW
\bWD
\bD
\bD
\bD a
\ba
\ba
\ban
\bn
\bn
\bnd
\bd
\bd
\bd P
\bP
\bP
\bPA
\bA
\bA
\bAS
\bS
\bS
\bSS
\bS
\bS
\bSW
\bW
\bW
\bWD
\bD
\bD
\bD
811 By default, s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo requires that a user authenticate him or
812 herself before running a command. This behavior can be
813 modified via the NOPASSWD tag. Like a Runas_Spec, the
814 NOPASSWD tag sets a default for the commands that follow
815 it in the Cmnd_Spec_List. Conversely, the PASSWD tag can
816 be used to reverse things. For example:
818 ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
820 would allow the user r
\br
\br
\bra
\ba
\ba
\bay
\by
\by
\by to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, and
821 _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as root on the machine rushmore as r
\br
\br
\bro
\bo
\bo
\boo
\bo
\bo
\bot
\bt
\bt
\bt
822 without authenticating himself. If we only want r
\br
\br
\bra
\ba
\ba
\bay
\by
\by
\by to be
823 able to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl without a password the entry would
826 ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
828 Note, however, that the PASSWD tag has no effect on users
829 who are in the group specified by the exempt_group option.
831 By default, if the NOPASSWD tag is applied to any of the
832 entries for a user on the current host, he or she will be
833 able to run sudo -l without a password. Additionally, a
834 user may only run sudo -v without a password if the
835 NOPASSWD tag is present for all a user's entries that per
836 tain to the current host. This behavior may be overridden
837 via the verifypw and listpw options.
839 W
\bW
\bW
\bWi
\bi
\bi
\bil
\bl
\bl
\bld
\bd
\bd
\bdc
\bc
\bc
\bca
\ba
\ba
\bar
\br
\br
\brd
\bd
\bd
\bds
\bs
\bs
\bs (
\b(
\b(
\b(a
\ba
\ba
\bak
\bk
\bk
\bka
\ba
\ba
\ba m
\bm
\bm
\bme
\be
\be
\bet
\bt
\bt
\bta
\ba
\ba
\ba c
\bc
\bc
\bch
\bh
\bh
\bha
\ba
\ba
\bar
\br
\br
\bra
\ba
\ba
\bac
\bc
\bc
\bct
\bt
\bt
\bte
\be
\be
\ber
\br
\br
\brs
\bs
\bs
\bs)
\b)
\b)
\b):
\b:
\b:
\b:
841 s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo allows shell-style _
\bw_
\bi_
\bl_
\bd_
\bc_
\ba_
\br_
\bd_
\bs to be used in pathnames
842 as well as command line arguments in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file.
843 Wildcard matching is done via the P
\bP
\bP
\bPO
\bO
\bO
\bOS
\bS
\bS
\bSI
\bI
\bI
\bIX
\bX
\bX
\bX fnmatch(3) rou
844 tine. Note that these are _
\bn_
\bo_
\bt regular expressions.
846 * Matches any set of zero or more characters.
848 ? Matches any single character.
850 [...] Matches any character in the specified range.
856 April 25, 2002 1.6.6 13
862 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
865 [!...] Matches any character n
\bn
\bn
\bno
\bo
\bo
\bot
\bt
\bt
\bt in the specified range.
867 \x For any character "x", evaluates to "x". This is
868 used to escape special characters such as: "*",
871 Note that a forward slash ('/') will n
\bn
\bn
\bno
\bo
\bo
\bot
\bt
\bt
\bt be matched by
872 wildcards used in the pathname. When matching the command
873 line arguments, however, as slash d
\bd
\bd
\bdo
\bo
\bo
\boe
\be
\be
\bes
\bs
\bs
\bs get matched by
874 wildcards. This is to make a path like:
878 match /usr/bin/who but not /usr/bin/X11/xterm.
880 E
\bE
\bE
\bEx
\bx
\bx
\bxc
\bc
\bc
\bce
\be
\be
\bep
\bp
\bp
\bpt
\bt
\bt
\bti
\bi
\bi
\bio
\bo
\bo
\bon
\bn
\bn
\bns
\bs
\bs
\bs t
\bt
\bt
\bto
\bo
\bo
\bo w
\bw
\bw
\bwi
\bi
\bi
\bil
\bl
\bl
\bld
\bd
\bd
\bdc
\bc
\bc
\bca
\ba
\ba
\bar
\br
\br
\brd
\bd
\bd
\bd r
\br
\br
\bru
\bu
\bu
\bul
\bl
\bl
\ble
\be
\be
\bes
\bs
\bs
\bs:
\b:
\b:
\b:
882 The following exceptions apply to the above rules:
884 """" If the empty string "" is the only command line
885 argument in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entry it means that com
886 mand is not allowed to be run with a
\ba
\ba
\ban
\bn
\bn
\bny
\by
\by
\by arguments.
888 O
\bO
\bO
\bOt
\bt
\bt
\bth
\bh
\bh
\bhe
\be
\be
\ber
\br
\br
\br s
\bs
\bs
\bsp
\bp
\bp
\bpe
\be
\be
\bec
\bc
\bc
\bci
\bi
\bi
\bia
\ba
\ba
\bal
\bl
\bl
\bl c
\bc
\bc
\bch
\bh
\bh
\bha
\ba
\ba
\bar
\br
\br
\bra
\ba
\ba
\bac
\bc
\bc
\bct
\bt
\bt
\bte
\be
\be
\ber
\br
\br
\brs
\bs
\bs
\bs a
\ba
\ba
\ban
\bn
\bn
\bnd
\bd
\bd
\bd r
\br
\br
\bre
\be
\be
\bes
\bs
\bs
\bse
\be
\be
\ber
\br
\br
\brv
\bv
\bv
\bve
\be
\be
\bed
\bd
\bd
\bd w
\bw
\bw
\bwo
\bo
\bo
\bor
\br
\br
\brd
\bd
\bd
\bds
\bs
\bs
\bs:
\b:
\b:
\b:
890 The pound sign ('#') is used to indicate a comment (unless
891 it occurs in the context of a user name and is followed by
892 one or more digits, in which case it is treated as a uid).
893 Both the comment character and any text after it, up to
894 the end of the line, are ignored.
896 The reserved word A
\bA
\bA
\bAL
\bL
\bL
\bLL
\bL
\bL
\bL is a built in _
\ba_
\bl_
\bi_
\ba_
\bs that always
897 causes a match to succeed. It can be used wherever one
898 might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias,
899 or Host_Alias. You should not try to define your own
900 _
\ba_
\bl_
\bi_
\ba_
\bs called A
\bA
\bA
\bAL
\bL
\bL
\bLL
\bL
\bL
\bL as the built in alias will be used in
901 preference to your own. Please note that using A
\bA
\bA
\bAL
\bL
\bL
\bLL
\bL
\bL
\bL can be
902 dangerous since in a command context, it allows the user
903 to run a
\ba
\ba
\ban
\bn
\bn
\bny
\by
\by
\by command on the system.
905 An exclamation point ('!') can be used as a logical _
\bn_
\bo_
\bt
906 operator both in an _
\ba_
\bl_
\bi_
\ba_
\bs and in front of a Cmnd. This
907 allows one to exclude certain values. Note, however, that
908 using a ! in conjunction with the built in ALL alias to
909 allow a user to run "all but a few" commands rarely works
910 as intended (see SECURITY NOTES below).
912 Long lines can be continued with a backslash ('\') as the
913 last character on the line.
915 Whitespace between elements in a list as well as special
916 syntactic characters in a _
\bU_
\bs_
\be_
\br _
\bS_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn ('=', ':',
917 '(', ')') is optional.
922 April 25, 2002 1.6.6 14
928 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
931 The following characters must be escaped with a backslash
932 ('\') when used as part of a word (e.g. a username or
933 hostname): '@', '!', '=', ':', ',', '(', ')', '\'.
935 E
\bE
\bE
\bEX
\bX
\bX
\bXA
\bA
\bA
\bAM
\bM
\bM
\bMP
\bP
\bP
\bPL
\bL
\bL
\bLE
\bE
\bE
\bES
\bS
\bS
\bS
936 Below are example _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries. Admittedly, some of
937 these are a bit contrived. First, we define our _
\ba_
\bl_
\bi_
\ba_
\bs_
\be_
\bs:
939 # User alias specification
940 User_Alias FULLTIMERS = millert, mikef, dowdy
941 User_Alias PARTTIMERS = bostley, jwfox, crawl
942 User_Alias WEBMASTERS = will, wendy, wim
944 # Runas alias specification
945 Runas_Alias OP = root, operator
946 Runas_Alias DB = oracle, sybase
948 # Host alias specification
949 Host_Alias SPARC = bigtime, eclipse, moet, anchor :\
950 SGI = grolsch, dandelion, black :\
951 ALPHA = widget, thalamus, foobar :\
952 HPPA = boa, nag, python
953 Host_Alias CUNETS = 128.138.0.0/255.255.0.0
954 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
955 Host_Alias SERVERS = master, mail, www, ns
956 Host_Alias CDROM = orion, perseus, hercules
958 # Cmnd alias specification
959 Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
960 /usr/sbin/restore, /usr/sbin/rrestore
961 Cmnd_Alias KILL = /usr/bin/kill
962 Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
963 Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
964 Cmnd_Alias HALT = /usr/sbin/halt, /usr/sbin/fasthalt
965 Cmnd_Alias REBOOT = /usr/sbin/reboot, /usr/sbin/fastboot
966 Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
967 /usr/local/bin/tcsh, /usr/bin/rsh, \
969 Cmnd_Alias SU = /usr/bin/su
971 Here we override some of the compiled in default values.
972 We want s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo to log via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3) using the _
\ba_
\bu_
\bt_
\bh facility
973 in all cases. We don't want to subject the full time
974 staff to the s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo lecture, and user m
\bm
\bm
\bmi
\bi
\bi
\bil
\bl
\bl
\bll
\bl
\bl
\ble
\be
\be
\ber
\br
\br
\brt
\bt
\bt
\bt need not give
975 a password. In addition, on the machines in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS
976 Host_Alias, we keep an additional local log file and make
977 sure we log the year in each log line since the log
978 entries will be kept around for several years.
980 # Override built in defaults
982 Defaults:FULLTIMERS !lecture
983 Defaults:millert !authenticate
984 Defaults@SERVERS log_year, logfile=/var/log/sudo.log
988 April 25, 2002 1.6.6 15
994 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
997 The _
\bU_
\bs_
\be_
\br _
\bs_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn is the part that actually deter
998 mines who may run what.
1000 root ALL = (ALL) ALL
1001 %wheel ALL = (ALL) ALL
1003 We let r
\br
\br
\bro
\bo
\bo
\boo
\bo
\bo
\bot
\bt
\bt
\bt and any user in group w
\bw
\bw
\bwh
\bh
\bh
\bhe
\be
\be
\bee
\be
\be
\bel
\bl
\bl
\bl run any command on
1004 any host as any user.
1006 FULLTIMERS ALL = NOPASSWD: ALL
1008 Full time sysadmins (m
\bm
\bm
\bmi
\bi
\bi
\bil
\bl
\bl
\bll
\bl
\bl
\ble
\be
\be
\ber
\br
\br
\brt
\bt
\bt
\bt, m
\bm
\bm
\bmi
\bi
\bi
\bik
\bk
\bk
\bke
\be
\be
\bef
\bf
\bf
\bf, and d
\bd
\bd
\bdo
\bo
\bo
\bow
\bw
\bw
\bwd
\bd
\bd
\bdy
\by
\by
\by) may run
1009 any command on any host without authenticating themselves.
1011 PARTTIMERS ALL = ALL
1013 Part time sysadmins (b
\bb
\bb
\bbo
\bo
\bo
\bos
\bs
\bs
\bst
\bt
\bt
\btl
\bl
\bl
\ble
\be
\be
\bey
\by
\by
\by, j
\bj
\bj
\bjw
\bw
\bw
\bwf
\bf
\bf
\bfo
\bo
\bo
\box
\bx
\bx
\bx, and c
\bc
\bc
\bcr
\br
\br
\bra
\ba
\ba
\baw
\bw
\bw
\bwl
\bl
\bl
\bl) may run
1014 any command on any host but they must authenticate them
1015 selves first (since the entry lacks the NOPASSWD tag).
1019 The user j
\bj
\bj
\bja
\ba
\ba
\bac
\bc
\bc
\bck
\bk
\bk
\bk may run any command on the machines in the
1020 _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS alias (the networks 128.138.243.0, 128.138.204.0,
1021 and 128.138.242.0). Of those networks, only 128.138.204.0
1022 has an explicit netmask (in CIDR notation) indicating it
1023 is a class C network. For the other networks in _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS,
1024 the local machine's netmask will be used during matching.
1028 The user l
\bl
\bl
\bli
\bi
\bi
\bis
\bs
\bs
\bsa
\ba
\ba
\ba may run any command on any host in the
1029 _
\bC_
\bU_
\bN_
\bE_
\bT_
\bS alias (the class B network 128.138.0.0).
1031 operator ALL = DUMPS, KILL, PRINTING, SHUTDOWN, HALT, REBOOT,\
1034 The o
\bo
\bo
\bop
\bp
\bp
\bpe
\be
\be
\ber
\br
\br
\bra
\ba
\ba
\bat
\bt
\bt
\bto
\bo
\bo
\bor
\br
\br
\br user may run commands limited to simple main
1035 tenance. Here, those are commands related to backups,
1036 killing processes, the printing system, shutting down the
1037 system, and any commands in the directory _
\b/_
\bu_
\bs_
\br_
\b/_
\bo_
\bp_
\be_
\br_
\b/_
\bb_
\bi_
\bn_
\b/.
1039 joe ALL = /usr/bin/su operator
1041 The user j
\bj
\bj
\bjo
\bo
\bo
\boe
\be
\be
\be may only _
\bs_
\bu(1) to operator.
1043 pete HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root
1045 The user p
\bp
\bp
\bpe
\be
\be
\bet
\bt
\bt
\bte
\be
\be
\be is allowed to change anyone's password
1046 except for root on the _
\bH_
\bP_
\bP_
\bA machines. Note that this
1047 assumes _
\bp_
\ba_
\bs_
\bs_
\bw_
\bd(1) does not take multiple usernames on the
1050 bob SPARC = (OP) ALL : SGI = (OP) ALL
1054 April 25, 2002 1.6.6 16
1060 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
1063 The user b
\bb
\bb
\bbo
\bo
\bo
\bob
\bb
\bb
\bb may run anything on the _
\bS_
\bP_
\bA_
\bR_
\bC and _
\bS_
\bG_
\bI
1064 machines as any user listed in the _
\bO_
\bP Runas_Alias (r
\br
\br
\bro
\bo
\bo
\boo
\bo
\bo
\bot
\bt
\bt
\bt
1065 and o
\bo
\bo
\bop
\bp
\bp
\bpe
\be
\be
\ber
\br
\br
\bra
\ba
\ba
\bat
\bt
\bt
\bto
\bo
\bo
\bor
\br
\br
\br).
1069 The user j
\bj
\bj
\bji
\bi
\bi
\bim
\bm
\bm
\bm may run any command on machines in the _
\bb_
\bi_
\bg_
\bl_
\ba_
\bb
1070 netgroup. S
\bS
\bS
\bSu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo knows that "biglab" is a netgroup due to
1073 +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
1075 Users in the s
\bs
\bs
\bse
\be
\be
\bec
\bc
\bc
\bcr
\br
\br
\bre
\be
\be
\bet
\bt
\bt
\bta
\ba
\ba
\bar
\br
\br
\bri
\bi
\bi
\bie
\be
\be
\bes
\bs
\bs
\bs netgroup need to help manage the
1076 printers as well as add and remove users, so they are
1077 allowed to run those commands on all machines.
1079 fred ALL = (DB) NOPASSWD: ALL
1081 The user f
\bf
\bf
\bfr
\br
\br
\bre
\be
\be
\bed
\bd
\bd
\bd can run commands as any user in the _
\bD_
\bB
1082 Runas_Alias (o
\bo
\bo
\bor
\br
\br
\bra
\ba
\ba
\bac
\bc
\bc
\bcl
\bl
\bl
\ble
\be
\be
\be or s
\bs
\bs
\bsy
\by
\by
\byb
\bb
\bb
\bba
\ba
\ba
\bas
\bs
\bs
\bse
\be
\be
\be) without giving a password.
1084 john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
1086 On the _
\bA_
\bL_
\bP_
\bH_
\bA machines, user j
\bj
\bj
\bjo
\bo
\bo
\boh
\bh
\bh
\bhn
\bn
\bn
\bn may su to anyone except
1087 root but he is not allowed to give _
\bs_
\bu(1) any flags.
1089 jen ALL, !SERVERS = ALL
1091 The user j
\bj
\bj
\bje
\be
\be
\ben
\bn
\bn
\bn may run any command on any machine except for
1092 those in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias (master, mail, www and
1095 jill SERVERS = /usr/bin/, !SU, !SHELLS
1097 For any machine in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias, j
\bj
\bj
\bji
\bi
\bi
\bil
\bl
\bl
\bll
\bl
\bl
\bl may run
1098 any commands in the directory /usr/bin/ except for those
1099 commands belonging to the _
\bS_
\bU and _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS Cmnd_Aliases.
1101 steve CSNETS = (operator) /usr/local/op_commands/
1103 The user s
\bs
\bs
\bst
\bt
\bt
\bte
\be
\be
\bev
\bv
\bv
\bve
\be
\be
\be may run any command in the directory
1104 /usr/local/op_commands/ but only as user operator.
1106 matt valkyrie = KILL
1108 On his personal workstation, valkyrie, m
\bm
\bm
\bma
\ba
\ba
\bat
\bt
\bt
\btt
\bt
\bt
\bt needs to be
1109 able to kill hung processes.
1111 WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
1113 On the host www, any user in the _
\bW_
\bE_
\bB_
\bM_
\bA_
\bS_
\bT_
\bE_
\bR_
\bS User_Alias
1114 (will, wendy, and wim), may run any command as user www
1115 (which owns the web pages) or simply _
\bs_
\bu(1) to www.
1120 April 25, 2002 1.6.6 17
1126 sudoers(4) MAINTENANCE COMMANDS sudoers(4)
1129 ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\
1130 /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
1132 Any user may mount or unmount a CD-ROM on the machines in
1133 the CDROM Host_Alias (orion, perseus, hercules) without
1134 entering a password. This is a bit tedious for users to
1135 type, so it is a prime candidate for encapsulating in a
1138 S
\bS
\bS
\bSE
\bE
\bE
\bEC
\bC
\bC
\bCU
\bU
\bU
\bUR
\bR
\bR
\bRI
\bI
\bI
\bIT
\bT
\bT
\bTY
\bY
\bY
\bY N
\bN
\bN
\bNO
\bO
\bO
\bOT
\bT
\bT
\bTE
\bE
\bE
\bES
\bS
\bS
\bS
1139 It is generally not effective to "subtract" commands from
1140 ALL using the '!' operator. A user can trivially circum
1141 vent this by copying the desired command to a different
1142 name and then executing that. For example:
1144 bill ALL = ALL, !SU, !SHELLS
1146 Doesn't really prevent b
\bb
\bb
\bbi
\bi
\bi
\bil
\bl
\bl
\bll
\bl
\bl
\bl from running the commands
1147 listed in _
\bS_
\bU or _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS since he can simply copy those com
1148 mands to a different name, or use a shell escape from an
1149 editor or other program. Therefore, these kind of
1150 restrictions should be considered advisory at best (and
1151 reinforced by policy).
1153 C
\bC
\bC
\bCA
\bA
\bA
\bAV
\bV
\bV
\bVE
\bE
\bE
\bEA
\bA
\bA
\bAT
\bT
\bT
\bTS
\bS
\bS
\bS
1154 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file should a
\ba
\ba
\bal
\bl
\bl
\blw
\bw
\bw
\bwa
\ba
\ba
\bay
\by
\by
\bys
\bs
\bs
\bs be edited by the v
\bv
\bv
\bvi
\bi
\bi
\bis
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo
1155 command which locks the file and does grammatical check
1156 ing. It is imperative that _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs be free of syntax
1157 errors since s
\bs
\bs
\bsu
\bu
\bu
\bud
\bd
\bd
\bdo
\bo
\bo
\bo will not run with a syntactically incor
1158 rect _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file.
1160 When using netgroups of machines (as opposed to users), if
1161 you store fully qualified hostnames in the netgroup (as is
1162 usually the case), you either need to have the machine's
1163 hostname be fully qualified as returned by the hostname
1164 command or use the _
\bf_
\bq_
\bd_
\bn option in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs.
1166 F
\bF
\bF
\bFI
\bI
\bI
\bIL
\bL
\bL
\bLE
\bE
\bE
\bES
\bS
\bS
\bS
1167 /etc/sudoers List of who can run what
1168 /etc/group Local groups file
1169 /etc/netgroup List of network groups
1172 S
\bS
\bS
\bSE
\bE
\bE
\bEE
\bE
\bE
\bE A
\bA
\bA
\bAL
\bL
\bL
\bLS
\bS
\bS
\bSO
\bO
\bO
\bO
1173 _
\br_
\bs_
\bh(1), _
\bs_
\bu_
\bd_
\bo(1m), _
\bv_
\bi_
\bs_
\bu_
\bd_
\bo(8), _
\bs_
\bu(1), _
\bf_
\bn_
\bm_
\ba_
\bt_
\bc_
\bh(3).
1186 April 25, 2002 1.6.6 18