1 SUDO(1m) System Manager's Manual SUDO(1m)
4 s
\bsu
\bud
\bdo
\bo, s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt - execute a command as another user
6 S
\bSY
\bYN
\bNO
\bOP
\bPS
\bSI
\bIS
\bS
7 s
\bsu
\bud
\bdo
\bo -
\b-h
\bh | -
\b-K
\bK | -
\b-k
\bk | -
\b-V
\bV
8 s
\bsu
\bud
\bdo
\bo -
\b-v
\bv [-
\b-A
\bAk
\bkn
\bnS
\bS] [-
\b-a
\ba _
\ba_
\bu_
\bt_
\bh_
\b__
\bt_
\by_
\bp_
\be] [-
\b-g
\bg _
\bg_
\br_
\bo_
\bu_
\bp _
\bn_
\ba_
\bm_
\be | _
\b#_
\bg_
\bi_
\bd] [-
\b-p
\bp _
\bp_
\br_
\bo_
\bm_
\bp_
\bt]
9 [-
\b-u
\bu _
\bu_
\bs_
\be_
\br _
\bn_
\ba_
\bm_
\be | _
\b#_
\bu_
\bi_
\bd]
10 s
\bsu
\bud
\bdo
\bo -
\b-l
\bl[_
\bl] [-
\b-A
\bAk
\bkn
\bnS
\bS] [-
\b-a
\ba _
\ba_
\bu_
\bt_
\bh_
\b__
\bt_
\by_
\bp_
\be] [-
\b-g
\bg _
\bg_
\br_
\bo_
\bu_
\bp _
\bn_
\ba_
\bm_
\be | _
\b#_
\bg_
\bi_
\bd] [-
\b-p
\bp _
\bp_
\br_
\bo_
\bm_
\bp_
\bt]
11 [-
\b-U
\bU _
\bu_
\bs_
\be_
\br _
\bn_
\ba_
\bm_
\be] [-
\b-u
\bu _
\bu_
\bs_
\be_
\br _
\bn_
\ba_
\bm_
\be | _
\b#_
\bu_
\bi_
\bd] [_
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd]
12 s
\bsu
\bud
\bdo
\bo [-
\b-A
\bAb
\bbE
\bEH
\bHn
\bnP
\bPS
\bS] [-
\b-a
\ba _
\ba_
\bu_
\bt_
\bh_
\b__
\bt_
\by_
\bp_
\be] [-
\b-C
\bC _
\bf_
\bd] [-
\b-c
\bc _
\bc_
\bl_
\ba_
\bs_
\bs | _
\b-]
13 [-
\b-g
\bg _
\bg_
\br_
\bo_
\bu_
\bp _
\bn_
\ba_
\bm_
\be | _
\b#_
\bg_
\bi_
\bd] [-
\b-p
\bp _
\bp_
\br_
\bo_
\bm_
\bp_
\bt] [-
\b-r
\br _
\br_
\bo_
\bl_
\be] [-
\b-t
\bt _
\bt_
\by_
\bp_
\be]
14 [-
\b-u
\bu _
\bu_
\bs_
\be_
\br _
\bn_
\ba_
\bm_
\be | _
\b#_
\bu_
\bi_
\bd] [V
\bVA
\bAR
\bR=_
\bv_
\ba_
\bl_
\bu_
\be] -
\b-i
\bi | -
\b-s
\bs [_
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd]
15 s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt [-
\b-A
\bAn
\bnS
\bS] [-
\b-a
\ba _
\ba_
\bu_
\bt_
\bh_
\b__
\bt_
\by_
\bp_
\be] [-
\b-C
\bC _
\bf_
\bd] [-
\b-c
\bc _
\bc_
\bl_
\ba_
\bs_
\bs | _
\b-]
16 [-
\b-g
\bg _
\bg_
\br_
\bo_
\bu_
\bp _
\bn_
\ba_
\bm_
\be | _
\b#_
\bg_
\bi_
\bd] [-
\b-p
\bp _
\bp_
\br_
\bo_
\bm_
\bp_
\bt] [-
\b-u
\bu _
\bu_
\bs_
\be_
\br _
\bn_
\ba_
\bm_
\be | _
\b#_
\bu_
\bi_
\bd] file
19 D
\bDE
\bES
\bSC
\bCR
\bRI
\bIP
\bPT
\bTI
\bIO
\bON
\bN
20 s
\bsu
\bud
\bdo
\bo allows a permitted user to execute a _
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd as the superuser or
21 another user, as specified by the security policy.
23 s
\bsu
\bud
\bdo
\bo supports a plugin architecture for security policies and
24 input/output logging. Third parties can develop and distribute their own
25 policy and I/O logging plugins to work seamlessly with the s
\bsu
\bud
\bdo
\bo front
26 end. The default security policy is _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs, which is configured via the
27 file _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs, or via LDAP. See the _
\bP_
\bL_
\bU_
\bG_
\bI_
\bN_
\bS section for more
30 The security policy determines what privileges, if any, a user has to run
31 s
\bsu
\bud
\bdo
\bo. The policy may require that users authenticate themselves with a
32 password or another authentication mechanism. If authentication is
33 required, s
\bsu
\bud
\bdo
\bo will exit if the user's password is not entered within a
34 configurable time limit. This limit is policy-specific; the default
35 password prompt timeout for the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs security policy is 5 minutes.
37 Security policies may support credential caching to allow the user to run
38 s
\bsu
\bud
\bdo
\bo again for a period of time without requiring authentication. The
39 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs policy caches credentials for 5 minutes, unless overridden in
40 sudoers(4). By running s
\bsu
\bud
\bdo
\bo with the -
\b-v
\bv option, a user can update the
41 cached credentials without running a _
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd.
43 When invoked as s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt, the -
\b-e
\be option (described below), is implied.
45 Security policies may log successful and failed attempts to use s
\bsu
\bud
\bdo
\bo. If
46 an I/O plugin is configured, the running command's input and output may
49 The options are as follows:
51 -
\b-A
\bA Normally, if s
\bsu
\bud
\bdo
\bo requires a password, it will read it from
52 the user's terminal. If the -
\b-A
\bA (_
\ba_
\bs_
\bk_
\bp_
\ba_
\bs_
\bs) option is
53 specified, a (possibly graphical) helper program is executed
54 to read the user's password and output the password to the
55 standard output. If the SUDO_ASKPASS environment variable is
56 set, it specifies the path to the helper program. Otherwise,
57 if _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b._
\bc_
\bo_
\bn_
\bf contains a line specifying the askpass
58 program, that value will be used. For example:
60 # Path to askpass helper program
61 Path askpass /usr/X11R6/bin/ssh-askpass
63 If no askpass program is available, s
\bsu
\bud
\bdo
\bo will exit with an
66 -
\b-a
\ba _
\bt_
\by_
\bp_
\be The -
\b-a
\ba (_
\ba_
\bu_
\bt_
\bh_
\be_
\bn_
\bt_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn _
\bt_
\by_
\bp_
\be) option causes s
\bsu
\bud
\bdo
\bo to use the
67 specified authentication type when validating the user, as
68 allowed by _
\b/_
\be_
\bt_
\bc_
\b/_
\bl_
\bo_
\bg_
\bi_
\bn_
\b._
\bc_
\bo_
\bn_
\bf. The system administrator may
69 specify a list of sudo-specific authentication methods by
70 adding an ``auth-sudo'' entry in _
\b/_
\be_
\bt_
\bc_
\b/_
\bl_
\bo_
\bg_
\bi_
\bn_
\b._
\bc_
\bo_
\bn_
\bf. This
71 option is only available on systems that support BSD
74 -
\b-b
\bb The -
\b-b
\bb (_
\bb_
\ba_
\bc_
\bk_
\bg_
\br_
\bo_
\bu_
\bn_
\bd) option tells s
\bsu
\bud
\bdo
\bo to run the given
75 command in the background. Note that if you use the -
\b-b
\bb
76 option you cannot use shell job control to manipulate the
77 process. Most interactive commands will fail to work
78 properly in background mode.
80 -
\b-C
\bC _
\bf_
\bd Normally, s
\bsu
\bud
\bdo
\bo will close all open file descriptors other
81 than standard input, standard output and standard error. The
82 -
\b-C
\bC (_
\bc_
\bl_
\bo_
\bs_
\be _
\bf_
\br_
\bo_
\bm) option allows the user to specify a starting
83 point above the standard error (file descriptor three).
84 Values less than three are not permitted. The security
85 policy may restrict the user's ability to use the -
\b-C
\bC option.
86 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs policy only permits use of the -
\b-C
\bC option when the
87 administrator has enabled the _
\bc_
\bl_
\bo_
\bs_
\be_
\bf_
\br_
\bo_
\bm_
\b__
\bo_
\bv_
\be_
\br_
\br_
\bi_
\bd_
\be option.
89 -
\b-c
\bc _
\bc_
\bl_
\ba_
\bs_
\bs The -
\b-c
\bc (_
\bc_
\bl_
\ba_
\bs_
\bs) option causes s
\bsu
\bud
\bdo
\bo to run the specified
90 command with resources limited by the specified login class.
91 The _
\bc_
\bl_
\ba_
\bs_
\bs argument can be either a class name as defined in
92 _
\b/_
\be_
\bt_
\bc_
\b/_
\bl_
\bo_
\bg_
\bi_
\bn_
\b._
\bc_
\bo_
\bn_
\bf, or a single `-' character. Specifying a
93 _
\bc_
\bl_
\ba_
\bs_
\bs of - indicates that the command should be run
94 restricted by the default login capabilities for the user the
95 command is run as. If the _
\bc_
\bl_
\ba_
\bs_
\bs argument specifies an
96 existing user class, the command must be run as root, or the
97 s
\bsu
\bud
\bdo
\bo command must be run from a shell that is already root.
98 This option is only available on systems with BSD login
101 -
\b-E
\bE The -
\b-E
\bE (_
\bp_
\br_
\be_
\bs_
\be_
\br_
\bv_
\be _
\be_
\bn_
\bv_
\bi_
\br_
\bo_
\bn_
\bm_
\be_
\bn_
\bt) option indicates to the
102 security policy that the user wishes to preserve their
103 existing environment variables. The security policy may
104 return an error if the -
\b-E
\bE option is specified and the user
105 does not have permission to preserve the environment.
107 -
\b-e
\be The -
\b-e
\be (_
\be_
\bd_
\bi_
\bt) option indicates that, instead of running a
108 command, the user wishes to edit one or more files. In lieu
109 of a command, the string "sudoedit" is used when consulting
110 the security policy. If the user is authorized by the
111 policy, the following steps are taken:
113 1. Temporary copies are made of the files to be edited
114 with the owner set to the invoking user.
116 2. The editor specified by the policy is run to edit the
117 temporary files. The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs policy uses the
118 SUDO_EDITOR, VISUAL and EDITOR environment variables
119 (in that order). If none of SUDO_EDITOR, VISUAL or
120 EDITOR are set, the first program listed in the _
\be_
\bd_
\bi_
\bt_
\bo_
\br
121 sudoers(4) option is used.
123 3. If they have been modified, the temporary files are
124 copied back to their original location and the
125 temporary versions are removed.
127 If the specified file does not exist, it will be created.
128 Note that unlike most commands run by _
\bs_
\bu_
\bd_
\bo, the editor is run
129 with the invoking user's environment unmodified. If, for
130 some reason, s
\bsu
\bud
\bdo
\bo is unable to update a file with its edited
131 version, the user will receive a warning and the edited copy
132 will remain in a temporary file.
134 -
\b-g
\bg _
\bg_
\br_
\bo_
\bu_
\bp Normally, s
\bsu
\bud
\bdo
\bo runs a command with the primary group set to
135 the one specified by the password database for the user the
136 command is being run as (by default, root). The -
\b-g
\bg (_
\bg_
\br_
\bo_
\bu_
\bp)
137 option causes s
\bsu
\bud
\bdo
\bo to run the command with the primary group
138 set to _
\bg_
\br_
\bo_
\bu_
\bp instead. To specify a _
\bg_
\bi_
\bd instead of a _
\bg_
\br_
\bo_
\bu_
\bp
139 _
\bn_
\ba_
\bm_
\be, use _
\b#_
\bg_
\bi_
\bd. When running commands as a _
\bg_
\bi_
\bd, many shells
140 require that the `#' be escaped with a backslash (`\'). If
141 no -
\b-u
\bu option is specified, the command will be run as the
142 invoking user (not root). In either case, the primary group
143 will be set to _
\bg_
\br_
\bo_
\bu_
\bp.
145 -
\b-H
\bH The -
\b-H
\bH (_
\bH_
\bO_
\bM_
\bE) option requests that the security policy set
146 the HOME environment variable to the home directory of the
147 target user (root by default) as specified by the password
148 database. Depending on the policy, this may be the default
151 -
\b-h
\bh The -
\b-h
\bh (_
\bh_
\be_
\bl_
\bp) option causes s
\bsu
\bud
\bdo
\bo to print a short help
152 message to the standard output and exit.
154 -
\b-i
\bi [_
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd]
155 The -
\b-i
\bi (_
\bs_
\bi_
\bm_
\bu_
\bl_
\ba_
\bt_
\be _
\bi_
\bn_
\bi_
\bt_
\bi_
\ba_
\bl _
\bl_
\bo_
\bg_
\bi_
\bn) option runs the shell
156 specified by the password database entry of the target user
157 as a login shell. This means that login-specific resource
158 files such as _
\b._
\bp_
\br_
\bo_
\bf_
\bi_
\bl_
\be or _
\b._
\bl_
\bo_
\bg_
\bi_
\bn will be read by the shell.
159 If a command is specified, it is passed to the shell for
160 execution via the shell's -
\b-c
\bc option. If no command is
161 specified, an interactive shell is executed. s
\bsu
\bud
\bdo
\bo attempts
162 to change to that user's home directory before running the
163 shell. The security policy shall initialize the environment
164 to a minimal set of variables, similar to what is present
165 when a user logs in. The _
\bC_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd _
\bE_
\bn_
\bv_
\bi_
\br_
\bo_
\bn_
\bm_
\be_
\bn_
\bt section in the
166 sudoers(4) manual documents how the -
\b-i
\bi option affects the
167 environment in which a command is run when the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs policy
170 -
\b-K
\bK The -
\b-K
\bK (sure _
\bk_
\bi_
\bl_
\bl) option is like -
\b-k
\bk except that it removes
171 the user's cached credentials entirely and may not be used in
172 conjunction with a command or other option. This option does
173 not require a password. Not all security policies support
176 -
\b-k
\bk [_
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd]
177 When used alone, the -
\b-k
\bk (_
\bk_
\bi_
\bl_
\bl) option to s
\bsu
\bud
\bdo
\bo invalidates the
178 user's cached credentials. The next time s
\bsu
\bud
\bdo
\bo is run a
179 password will be required. This option does not require a
180 password and was added to allow a user to revoke s
\bsu
\bud
\bdo
\bo
181 permissions from a _
\b._
\bl_
\bo_
\bg_
\bo_
\bu_
\bt file. Not all security policies
182 support credential caching.
184 When used in conjunction with a command or an option that may
185 require a password, the -
\b-k
\bk option will cause s
\bsu
\bud
\bdo
\bo to ignore
186 the user's cached credentials. As a result, s
\bsu
\bud
\bdo
\bo will prompt
187 for a password (if one is required by the security policy)
188 and will not update the user's cached credentials.
190 -
\b-l
\bl[l
\bl] [_
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd]
191 If no _
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd is specified, the -
\b-l
\bl (_
\bl_
\bi_
\bs_
\bt) option will list
192 the allowed (and forbidden) commands for the invoking user
193 (or the user specified by the -
\b-U
\bU option) on the current host.
194 If a _
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd is specified and is permitted by the security
195 policy, the fully-qualified path to the command is displayed
196 along with any command line arguments. If _
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd is
197 specified but not allowed, s
\bsu
\bud
\bdo
\bo will exit with a status value
198 of 1. If the -
\b-l
\bl option is specified with an _
\bl argument (i.e.
199 -
\b-l
\bll
\bl), or if -
\b-l
\bl is specified multiple times, a longer list
202 -
\b-n
\bn The -
\b-n
\bn (_
\bn_
\bo_
\bn_
\b-_
\bi_
\bn_
\bt_
\be_
\br_
\ba_
\bc_
\bt_
\bi_
\bv_
\be) option prevents s
\bsu
\bud
\bdo
\bo from prompting
203 the user for a password. If a password is required for the
204 command to run, s
\bsu
\bud
\bdo
\bo will display an error message and exit.
206 -
\b-P
\bP The -
\b-P
\bP (_
\bp_
\br_
\be_
\bs_
\be_
\br_
\bv_
\be _
\bg_
\br_
\bo_
\bu_
\bp _
\bv_
\be_
\bc_
\bt_
\bo_
\br) option causes s
\bsu
\bud
\bdo
\bo to preserve
207 the invoking user's group vector unaltered. By default, the
208 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs policy will initialize the group vector to the list
209 of groups the target user is in. The real and effective
210 group IDs, however, are still set to match the target user.
212 -
\b-p
\bp _
\bp_
\br_
\bo_
\bm_
\bp_
\bt The -
\b-p
\bp (_
\bp_
\br_
\bo_
\bm_
\bp_
\bt) option allows you to override the default
213 password prompt and use a custom one. The following percent
214 (`%') escapes are supported by the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs policy:
216 %H expanded to the host name including the domain name (on
217 if the machine's host name is fully qualified or the _
\bf_
\bq_
\bd_
\bn
218 option is set in sudoers(4))
220 %h expanded to the local host name without the domain name
222 %p expanded to the name of the user whose password is being
223 requested (respects the _
\br_
\bo_
\bo_
\bt_
\bp_
\bw, _
\bt_
\ba_
\br_
\bg_
\be_
\bt_
\bp_
\bw, and _
\br_
\bu_
\bn_
\ba_
\bs_
\bp_
\bw
226 %U expanded to the login name of the user the command will
227 be run as (defaults to root unless the -
\b-u
\bu option is also
230 %u expanded to the invoking user's login name
232 %% two consecutive `%' characters are collapsed into a
235 The prompt specified by the -
\b-p
\bp option will override the
236 system password prompt on systems that support PAM unless the
237 _
\bp_
\ba_
\bs_
\bs_
\bp_
\br_
\bo_
\bm_
\bp_
\bt_
\b__
\bo_
\bv_
\be_
\br_
\br_
\bi_
\bd_
\be flag is disabled in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs.
239 -
\b-r
\br _
\br_
\bo_
\bl_
\be The -
\b-r
\br (_
\br_
\bo_
\bl_
\be) option causes the new (SELinux) security
240 context to have the role specified by _
\br_
\bo_
\bl_
\be.
242 -
\b-S
\bS The -
\b-S
\bS (_
\bs_
\bt_
\bd_
\bi_
\bn) option causes s
\bsu
\bud
\bdo
\bo to read the password from
243 the standard input instead of the terminal device. The
244 password must be followed by a newline character.
246 -
\b-s
\bs [_
\bc_
\bo_
\bm_
\bm_
\ba_
\bn_
\bd]
247 The -
\b-s
\bs (_
\bs_
\bh_
\be_
\bl_
\bl) option runs the shell specified by the SHELL
248 environment variable if it is set or the shell as specified
249 in the password database. If a command is specified, it is
250 passed to the shell for execution via the shell's -
\b-c
\bc option.
251 If no command is specified, an interactive shell is executed.
253 -
\b-t
\bt _
\bt_
\by_
\bp_
\be The -
\b-t
\bt (_
\bt_
\by_
\bp_
\be) option causes the new (SELinux) security
254 context to have the type specified by _
\bt_
\by_
\bp_
\be. If no type is
255 specified, the default type is derived from the specified
258 -
\b-U
\bU _
\bu_
\bs_
\be_
\br The -
\b-U
\bU (_
\bo_
\bt_
\bh_
\be_
\br _
\bu_
\bs_
\be_
\br) option is used in conjunction with the -
\b-l
\bl
259 option to specify the user whose privileges should be listed.
260 The security policy may restrict listing other users'
261 privileges. The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs policy only allows root or a user
262 with the ALL privilege on the current host to use this
265 -
\b-u
\bu _
\bu_
\bs_
\be_
\br The -
\b-u
\bu (_
\bu_
\bs_
\be_
\br) option causes s
\bsu
\bud
\bdo
\bo to run the specified command
266 as a user other than _
\br_
\bo_
\bo_
\bt. To specify a _
\bu_
\bi_
\bd instead of a
267 _
\bu_
\bs_
\be_
\br _
\bn_
\ba_
\bm_
\be, _
\b#_
\bu_
\bi_
\bd. When running commands as a _
\bu_
\bi_
\bd, many shells
268 require that the `#' be escaped with a backslash (`\').
269 Security policies may restrict _
\bu_
\bi_
\bds to those listed in the
270 password database. The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs policy allows _
\bu_
\bi_
\bds that are
271 not in the password database as long as the _
\bt_
\ba_
\br_
\bg_
\be_
\bt_
\bp_
\bw option
272 is not set. Other security policies may not support this.
274 -
\b-V
\bV The -
\b-V
\bV (_
\bv_
\be_
\br_
\bs_
\bi_
\bo_
\bn) option causes s
\bsu
\bud
\bdo
\bo to print its version
275 string and the version string of the security policy plugin
276 and any I/O plugins. If the invoking user is already root
277 the -
\b-V
\bV option will display the arguments passed to configure
278 when s
\bsu
\bud
\bdo
\bo was built and plugins may display more verbose
279 information such as default options.
281 -
\b-v
\bv When given the -
\b-v
\bv (_
\bv_
\ba_
\bl_
\bi_
\bd_
\ba_
\bt_
\be) option, s
\bsu
\bud
\bdo
\bo will update the
282 user's cached credentials, authenticating the user's password
283 if necessary. For the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs plugin, this extends the s
\bsu
\bud
\bdo
\bo
284 timeout for another 5 minutes (or whatever the timeout is set
285 to by the security policy) but does not run a command. Not
286 all security policies support cached credentials.
288 -
\b--
\b- The -
\b--
\b- option indicates that s
\bsu
\bud
\bdo
\bo should stop processing
289 command line arguments.
291 Environment variables to be set for the command may also be passed on the
292 command line in the form of V
\bVA
\bAR
\bR=_
\bv_
\ba_
\bl_
\bu_
\be, e.g.
293 L
\bLD
\bD_
\b_L
\bLI
\bIB
\bBR
\bRA
\bAR
\bRY
\bY_
\b_P
\bPA
\bAT
\bTH
\bH=_
\b/_
\bu_
\bs_
\br_
\b/_
\bl_
\bo_
\bc_
\ba_
\bl_
\b/_
\bp_
\bk_
\bg_
\b/_
\bl_
\bi_
\bb. Variables passed on the command line
294 are subject to the same restrictions as normal environment variables with
295 one important exception. If the _
\bs_
\be_
\bt_
\be_
\bn_
\bv option is set in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs, the
296 command to be run has the SETENV tag set or the command matched is ALL,
297 the user may set variables that would otherwise be forbidden. See
298 sudoers(4) for more information.
300 C
\bCO
\bOM
\bMM
\bMA
\bAN
\bND
\bD E
\bEX
\bXE
\bEC
\bCU
\bUT
\bTI
\bIO
\bON
\bN
301 When s
\bsu
\bud
\bdo
\bo executes a command, the security policy specifies the execution
302 envionment for the command. Typically, the real and effective uid and
303 gid are set to match those of the target user, as specified in the
304 password database, and the group vector is initialized based on the group
305 database (unless the -
\b-P
\bP option was specified).
307 The following parameters may be specified by security policy:
309 o
\bo real and effective user ID
311 o
\bo real and effective group ID
313 o
\bo supplementary group IDs
315 o
\bo the environment list
317 o
\bo current working directory
319 o
\bo file creation mode mask (umask)
321 o
\bo SELinux role and type
325 o
\bo Solaris privileges
329 o
\bo scheduling priority (aka nice value)
331 P
\bPr
\bro
\boc
\bce
\bes
\bss
\bs m
\bmo
\bod
\bde
\bel
\bl
332 When s
\bsu
\bud
\bdo
\bo runs a command, it calls fork(2), sets up the execution
333 environment as described above, and calls the execve system call in the
334 child process. The main s
\bsu
\bud
\bdo
\bo process waits until the command has
335 completed, then passes the command's exit status to the security policy's
336 close method and exits. If an I/O logging plugin is configured, a new
337 pseudo-terminal (``pty'') is created and a second s
\bsu
\bud
\bdo
\bo process is used to
338 relay job control signals between the user's existing pty and the new pty
339 the command is being run in. This extra process makes it possible to,
340 for example, suspend and resume the command. Without it, the command
341 would be in what POSIX terms an ``orphaned process group'' and it would
342 not receive any job control signals.
344 S
\bSi
\big
\bgn
\bna
\bal
\bl h
\bha
\ban
\bnd
\bdl
\bli
\bin
\bng
\bg
345 Because the command is run as a child of the s
\bsu
\bud
\bdo
\bo process, s
\bsu
\bud
\bdo
\bo will
346 relay signals it receives to the command. Unless the command is being
347 run in a new pty, the SIGHUP, SIGINT and SIGQUIT signals are not relayed
348 unless they are sent by a user process, not the kernel. Otherwise, the
349 command would receive SIGINT twice every time the user entered control-C.
350 Some signals, such as SIGSTOP and SIGKILL, cannot be caught and thus will
351 not be relayed to the command. As a general rule, SIGTSTP should be used
352 instead of SIGSTOP when you wish to suspend a command being run by s
\bsu
\bud
\bdo
\bo.
354 As a special case, s
\bsu
\bud
\bdo
\bo will not relay signals that were sent by the
355 command it is running. This prevents the command from accidentally
356 killing itself. On some systems, the reboot(1m) command sends SIGTERM to
357 all non-system processes other than itself before rebooting the systyem.
358 This prevents s
\bsu
\bud
\bdo
\bo from relaying the SIGTERM signal it received back to
359 reboot(1m), which might then exit before the system was actually rebooted,
360 leaving it in a half-dead state similar to single user mode. Note,
361 however, that this check only applies to the command run by s
\bsu
\bud
\bdo
\bo and not
362 any other processes that the command may create. As a result, running a
363 script that calls reboot(1m) or shutdown(1m) via s
\bsu
\bud
\bdo
\bo may cause the system
364 to end up in this undefined state unless the reboot(1m) or shutdown(1m) are
365 run using the e
\bex
\bxe
\bec
\bc() family of functions instead of s
\bsy
\bys
\bst
\bte
\bem
\bm() (which
366 interposes a shell between the command and the calling process).
368 P
\bPL
\bLU
\bUG
\bGI
\bIN
\bNS
\bS
369 Plugins are dynamically loaded based on the contents of the
370 _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b._
\bc_
\bo_
\bn_
\bf file. If no _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b._
\bc_
\bo_
\bn_
\bf file is present, or it
371 contains no Plugin lines, s
\bsu
\bud
\bdo
\bo will use the traditional _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs security
372 policy and I/O logging, which corresponds to the following _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b._
\bc_
\bo_
\bn_
\bf
376 # Default /etc/sudo.conf file
379 # Plugin plugin_name plugin_path plugin_options ...
380 # Path askpass /path/to/askpass
381 # Path noexec /path/to/sudo_noexec.so
382 # Debug sudo /var/log/sudo_debug all@warn
383 # Set disable_coredump true
385 # The plugin_path is relative to /usr/local/libexec unless
387 # The plugin_name corresponds to a global symbol in the plugin
388 # that contains the plugin interface structure.
389 # The plugin_options are optional.
391 Plugin policy_plugin sudoers.so
392 Plugin io_plugin sudoers.so
394 A Plugin line consists of the Plugin keyword, followed by the _
\bs_
\by_
\bm_
\bb_
\bo_
\bl_
\b__
\bn_
\ba_
\bm_
\be
395 and the _
\bp_
\ba_
\bt_
\bh to the shared object containing the plugin. The _
\bs_
\by_
\bm_
\bb_
\bo_
\bl_
\b__
\bn_
\ba_
\bm_
\be
396 is the name of the struct policy_plugin or struct io_plugin in the plugin
397 shared object. The _
\bp_
\ba_
\bt_
\bh may be fully qualified or relative. If not
398 fully qualified it is relative to the _
\b/_
\bu_
\bs_
\br_
\b/_
\bl_
\bo_
\bc_
\ba_
\bl_
\b/_
\bl_
\bi_
\bb_
\be_
\bx_
\be_
\bc directory. Any
399 additional parameters after the _
\bp_
\ba_
\bt_
\bh are passed as arguments to the
400 plugin's _
\bo_
\bp_
\be_
\bn function. Lines that don't begin with Plugin, Path, Debug,
401 or Set are silently ignored.
403 For more information, see the sudo_plugin(1m) manual.
406 A Path line consists of the Path keyword, followed by the name of the
407 path to set and its value. E.g.
409 Path noexec /usr/local/libexec/sudo_noexec.so
410 Path askpass /usr/X11R6/bin/ssh-askpass
412 The following plugin-agnostic paths may be set in the _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b._
\bc_
\bo_
\bn_
\bf
415 askpass The fully qualified path to a helper program used to read the
416 user's password when no terminal is available. This may be the
417 case when s
\bsu
\bud
\bdo
\bo is executed from a graphical (as opposed to
418 text-based) application. The program specified by _
\ba_
\bs_
\bk_
\bp_
\ba_
\bs_
\bs
419 should display the argument passed to it as the prompt and
420 write the user's password to the standard output. The value of
421 _
\ba_
\bs_
\bk_
\bp_
\ba_
\bs_
\bs may be overridden by the SUDO_ASKPASS environment
424 noexec The fully-qualified path to a shared library containing dummy
425 versions of the e
\bex
\bxe
\bec
\bcv
\bv(), e
\bex
\bxe
\bec
\bcv
\bve
\be() and f
\bfe
\bex
\bxe
\bec
\bcv
\bve
\be() library
426 functions that just return an error. This is used to implement
427 the _
\bn_
\bo_
\be_
\bx_
\be_
\bc functionality on systems that support LD_PRELOAD or
428 its equivalent. Defaults to _
\b/_
\bu_
\bs_
\br_
\b/_
\bl_
\bo_
\bc_
\ba_
\bl_
\b/_
\bl_
\bi_
\bb_
\be_
\bx_
\be_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b__
\bn_
\bo_
\be_
\bx_
\be_
\bc_
\b._
\bs_
\bo.
430 D
\bDE
\bEB
\bBU
\bUG
\bG F
\bFL
\bLA
\bAG
\bGS
\bS
431 s
\bsu
\bud
\bdo
\bo versions 1.8.4 and higher support a flexible debugging framework
432 that can help track down what s
\bsu
\bud
\bdo
\bo is doing internally if there is a
435 A Debug line consists of the Debug keyword, followed by the name of the
436 program to debug (s
\bsu
\bud
\bdo
\bo, v
\bvi
\bis
\bsu
\bud
\bdo
\bo, s
\bsu
\bud
\bdo
\bor
\bre
\bep
\bpl
\bla
\bay
\by), the debug file name and a
437 comma-separated list of debug flags. The debug flag syntax used by s
\bsu
\bud
\bdo
\bo
438 and the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs plugin is _
\bs_
\bu_
\bb_
\bs_
\by_
\bs_
\bt_
\be_
\bm@_
\bp_
\br_
\bi_
\bo_
\br_
\bi_
\bt_
\by but the plugin is free to
439 use a different format so long as it does not include a comma (`,').
443 Debug sudo /var/log/sudo_debug all@warn,plugin@info
445 would log all debugging statements at the _
\bw_
\ba_
\br_
\bn level and higher in
446 addition to those at the _
\bi_
\bn_
\bf_
\bo level for the plugin subsystem.
448 Currently, only one Debug entry per program is supported. The s
\bsu
\bud
\bdo
\bo Debug
449 entry is shared by the s
\bsu
\bud
\bdo
\bo front end, s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt and the plugins. A
450 future release may add support for per-plugin Debug lines and/or support
451 for multiple debugging files for a single program.
453 The priorities used by the s
\bsu
\bud
\bdo
\bo front end, in order of decreasing
454 severity, are: _
\bc_
\br_
\bi_
\bt, _
\be_
\br_
\br, _
\bw_
\ba_
\br_
\bn, _
\bn_
\bo_
\bt_
\bi_
\bc_
\be, _
\bd_
\bi_
\ba_
\bg, _
\bi_
\bn_
\bf_
\bo, _
\bt_
\br_
\ba_
\bc_
\be and _
\bd_
\be_
\bb_
\bu_
\bg.
455 Each priority, when specified, also includes all priorities higher than
456 it. For example, a priority of _
\bn_
\bo_
\bt_
\bi_
\bc_
\be would include debug messages
457 logged at _
\bn_
\bo_
\bt_
\bi_
\bc_
\be and higher.
459 The following subsystems are used by the s
\bsu
\bud
\bdo
\bo front-end:
461 _
\ba_
\bl_
\bl matches every subsystem
463 _
\ba_
\br_
\bg_
\bs command line argument processing
465 _
\bc_
\bo_
\bn_
\bv user conversation
467 _
\be_
\bd_
\bi_
\bt sudoedit
469 _
\be_
\bx_
\be_
\bc command execution
471 _
\bm_
\ba_
\bi_
\bn s
\bsu
\bud
\bdo
\bo main function
473 _
\bn_
\be_
\bt_
\bi_
\bf network interface handling
475 _
\bp_
\bc_
\bo_
\bm_
\bm communication with the plugin
477 _
\bp_
\bl_
\bu_
\bg_
\bi_
\bn plugin configuration
479 _
\bp_
\bt_
\by pseudo-tty related code
481 _
\bs_
\be_
\bl_
\bi_
\bn_
\bu_
\bx SELinux-specific handling
483 _
\bu_
\bt_
\bi_
\bl utility functions
485 _
\bu_
\bt_
\bm_
\bp utmp handling
487 E
\bEX
\bXI
\bIT
\bT V
\bVA
\bAL
\bLU
\bUE
\bE
488 Upon successful execution of a program, the exit status from _
\bs_
\bu_
\bd_
\bo will
489 simply be the exit status of the program that was executed.
491 Otherwise, s
\bsu
\bud
\bdo
\bo exits with a value of 1 if there is a
492 configuration/permission problem or if s
\bsu
\bud
\bdo
\bo cannot execute the given
493 command. In the latter case the error string is printed to the standard
494 error. If s
\bsu
\bud
\bdo
\bo cannot stat(2) one or more entries in the user's PATH, an
495 error is printed on stderr. (If the directory does not exist or if it is
496 not really a directory, the entry is ignored and no error is printed.)
497 This should not happen under normal circumstances. The most common
498 reason for stat(2) to return ``permission denied'' is if you are running
499 an automounter and one of the directories in your PATH is on a machine
500 that is currently unreachable.
502 S
\bSE
\bEC
\bCU
\bUR
\bRI
\bIT
\bTY
\bY N
\bNO
\bOT
\bTE
\bES
\bS
503 s
\bsu
\bud
\bdo
\bo tries to be safe when executing external commands.
505 To prevent command spoofing, s
\bsu
\bud
\bdo
\bo checks "." and "" (both denoting
506 current directory) last when searching for a command in the user's PATH
507 (if one or both are in the PATH). Note, however, that the actual PATH
508 environment variable is _
\bn_
\bo_
\bt modified and is passed unchanged to the
509 program that s
\bsu
\bud
\bdo
\bo executes.
511 Please note that s
\bsu
\bud
\bdo
\bo will normally only log the command it explicitly
512 runs. If a user runs a command such as sudo su or sudo sh, subsequent
513 commands run from that shell are not subject to s
\bsu
\bud
\bdo
\bo's security policy.
514 The same is true for commands that offer shell escapes (including most
515 editors). If I/O logging is enabled, subsequent commands will have their
516 input and/or output logged, but there will not be traditional logs for
517 those commands. Because of this, care must be taken when giving users
518 access to commands via s
\bsu
\bud
\bdo
\bo to verify that the command does not
519 inadvertently give the user an effective root shell. For more
520 information, please see the _
\bP_
\bR_
\bE_
\bV_
\bE_
\bN_
\bT_
\bI_
\bN_
\bG _
\bS_
\bH_
\bE_
\bL_
\bL _
\bE_
\bS_
\bC_
\bA_
\bP_
\bE_
\bS section in
523 To prevent the disclosure of potentially sensitive information, s
\bsu
\bud
\bdo
\bo
524 disables core dumps by default while it is executing (they are re-enabled
525 for the command that is run). To aid in debugging s
\bsu
\bud
\bdo
\bo crashes, you may
526 wish to re-enable core dumps by setting ``disable_coredump'' to false in
527 the _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b._
\bc_
\bo_
\bn_
\bf file as follows:
529 Set disable_coredump false
531 Note that by default, most operating systems disable core dumps from
532 setuid programs, which includes s
\bsu
\bud
\bdo
\bo. To actually get a s
\bsu
\bud
\bdo
\bo core file
533 you may need to enable core dumps for setuid processes. On BSD and Linux
534 systems this is accomplished via the sysctl command, on Solaris the
535 coreadm command can be used.
537 E
\bEN
\bNV
\bVI
\bIR
\bRO
\bON
\bNM
\bME
\bEN
\bNT
\bT
538 s
\bsu
\bud
\bdo
\bo utilizes the following environment variables. The security policy
539 has control over the actual content of the command's environment.
541 EDITOR Default editor to use in -
\b-e
\be (sudoedit) mode if neither
542 SUDO_EDITOR nor VISUAL is set.
544 MAIL In -
\b-i
\bi mode or when _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt is enabled in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs, set
545 to the mail spool of the target user.
547 HOME Set to the home directory of the target user if -
\b-i
\bi or -
\b-H
\bH
548 are specified, _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt or _
\ba_
\bl_
\bw_
\ba_
\by_
\bs_
\b__
\bs_
\be_
\bt_
\b__
\bh_
\bo_
\bm_
\be are set in
549 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs, or when the -
\b-s
\bs option is specified and _
\bs_
\be_
\bt_
\b__
\bh_
\bo_
\bm_
\be
550 is set in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs.
552 PATH May be overridden by the security policy.
554 SHELL Used to determine shell to run with -
\b-s
\bs option.
556 SUDO_ASKPASS Specifies the path to a helper program used to read the
557 password if no terminal is available or if the -
\b-A
\bA option
560 SUDO_COMMAND Set to the command run by sudo.
562 SUDO_EDITOR Default editor to use in -
\b-e
\be (sudoedit) mode.
564 SUDO_GID Set to the group ID of the user who invoked sudo.
566 SUDO_PROMPT Used as the default password prompt.
568 SUDO_PS1 If set, PS1 will be set to its value for the program
571 SUDO_UID Set to the user ID of the user who invoked sudo.
573 SUDO_USER Set to the login name of the user who invoked sudo.
575 USER Set to the target user (root unless the -
\b-u
\bu option is
578 VISUAL Default editor to use in -
\b-e
\be (sudoedit) mode if
579 SUDO_EDITOR is not set.
582 _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b._
\bc_
\bo_
\bn_
\bf s
\bsu
\bud
\bdo
\bo front end configuration
584 E
\bEX
\bXA
\bAM
\bMP
\bPL
\bLE
\bES
\bS
585 Note: the following examples assume a properly configured security
588 To get a file listing of an unreadable directory:
590 $ sudo ls /usr/local/protected
592 To list the home directory of user yaz on a machine where the file system
593 holding ~yaz is not exported as root:
595 $ sudo -u yaz ls ~yaz
597 To edit the _
\bi_
\bn_
\bd_
\be_
\bx_
\b._
\bh_
\bt_
\bm_
\bl file as user www:
599 $ sudo -u www vi ~www/htdocs/index.html
601 To view system logs only accessible to root and users in the adm group:
603 $ sudo -g adm view /var/log/syslog
605 To run an editor as jim with a different primary group:
607 $ sudo -u jim -g audio vi ~jim/sound.txt
609 To shut down a machine:
611 $ sudo shutdown -r +15 "quick reboot"
613 To make a usage listing of the directories in the /home partition. Note
614 that this runs the commands in a sub-shell to make the cd and file
617 $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
619 S
\bSE
\bEE
\bE A
\bAL
\bLS
\bSO
\bO
620 grep(1), su(1), stat(2), login_cap(3), passwd(4), sudoers(4),
621 sudo_plugin(1m), sudoreplay(1m), visudo(1m)
623 H
\bHI
\bIS
\bST
\bTO
\bOR
\bRY
\bY
624 See the HISTORY file in the s
\bsu
\bud
\bdo
\bo distribution
625 (http://www.sudo.ws/sudo/history.html) for a brief history of sudo.
627 A
\bAU
\bUT
\bTH
\bHO
\bOR
\bRS
\bS
628 Many people have worked on s
\bsu
\bud
\bdo
\bo over the years; this version consists of
629 code written primarily by:
633 See the CONTRIBUTORS file in the s
\bsu
\bud
\bdo
\bo distribution
634 (http://www.sudo.ws/sudo/contributors.html) for an exhaustive list of
635 people who have contributed to s
\bsu
\bud
\bdo
\bo.
637 C
\bCA
\bAV
\bVE
\bEA
\bAT
\bTS
\bS
638 There is no easy way to prevent a user from gaining a root shell if that
639 user is allowed to run arbitrary commands via s
\bsu
\bud
\bdo
\bo. Also, many programs
640 (such as editors) allow the user to run commands via shell escapes, thus
641 avoiding s
\bsu
\bud
\bdo
\bo's checks. However, on most systems it is possible to
642 prevent shell escapes with the sudoers(4) plugin's _
\bn_
\bo_
\be_
\bx_
\be_
\bc functionality.
644 It is not meaningful to run the cd command directly via sudo, e.g.,
646 $ sudo cd /usr/local/protected
648 since when the command exits the parent process (your shell) will still
649 be the same. Please see the _
\bE_
\bX_
\bA_
\bM_
\bP_
\bL_
\bE_
\bS section for more information.
651 Running shell scripts via s
\bsu
\bud
\bdo
\bo can expose the same kernel bugs that make
652 setuid shell scripts unsafe on some operating systems (if your OS has a
653 /dev/fd/ directory, setuid shell scripts are generally safe).
656 If you feel you have found a bug in s
\bsu
\bud
\bdo
\bo, please submit a bug report at
657 http://www.sudo.ws/sudo/bugs/
659 S
\bSU
\bUP
\bPP
\bPO
\bOR
\bRT
\bT
660 Limited free support is available via the sudo-users mailing list, see
661 http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the
664 D
\bDI
\bIS
\bSC
\bCL
\bLA
\bAI
\bIM
\bME
\bER
\bR
665 s
\bsu
\bud
\bdo
\bo is provided ``AS IS'' and any express or implied warranties,
666 including, but not limited to, the implied warranties of merchantability
667 and fitness for a particular purpose are disclaimed. See the LICENSE
668 file distributed with s
\bsu
\bud
\bdo
\bo or http://www.sudo.ws/sudo/license.html for
671 Sudo 1.8.6 July 10, 2012 Sudo 1.8.6