1 .\" Copyright (c) 1994-1996, 1998-2005, 2007-2010
2 .\" Todd C. Miller <Todd.Miller@courtesan.com>
4 .\" Permission to use, copy, modify, and distribute this software for any
5 .\" purpose with or without fee is hereby granted, provided that the above
6 .\" copyright notice and this permission notice appear in all copies.
8 .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
17 .\" Sponsored in part by the Defense Advanced Research Projects
18 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
19 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
24 .nr PT @password_timeout@
26 .\" Automatically generated by Pod::Man 2.23 (Pod::Simple 3.14)
28 .\" Standard preamble:
29 .\" ========================================================================
30 .de Sp \" Vertical space (when we can't use .PP)
34 .de Vb \" Begin verbatim text
39 .de Ve \" End verbatim text
43 .\" Set up some character translations and predefined strings. \*(-- will
44 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
45 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
46 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
47 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
48 .\" nothing in troff, for use with C<>.
50 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
54 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
55 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
68 .\" Escape single quotes in literal strings from groff's Unicode transform.
72 .\" If the F register is turned on, we'll generate index entries on stderr for
73 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
74 .\" entries marked with X<> in POD. Of course, you'll have to process the
75 .\" output yourself in some meaningful fashion.
78 . tm Index:\\$1\t\\n%\t"\\$2"
88 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
89 .\" Fear. Run. Save yourself. No user-serviceable parts.
90 . \" fudge factors for nroff and troff
99 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
105 . \" simple accents for nroff and troff
115 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
116 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
117 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
118 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
119 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
120 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
122 . \" troff and (daisy-wheel) nroff accents
123 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
124 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
125 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
126 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
127 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
128 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
129 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
130 .ds ae a\h'-(\w'a'u*4/10)'e
131 .ds Ae A\h'-(\w'A'u*4/10)'E
132 . \" corrections for vroff
133 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
134 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
135 . \" for low resolution devices (crt and lpr)
136 .if \n(.H>23 .if \n(.V>19 \
149 .\" ========================================================================
151 .IX Title "SUDO @mansectsu@"
152 .TH SUDO @mansectsu@ "April 9, 2011" "1.7.6" "MAINTENANCE COMMANDS"
153 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
154 .\" way too many mistakes in technical documents.
158 sudo, sudoedit \- execute a command as another user
160 .IX Header "SYNOPSIS"
161 \&\fBsudo\fR \fB\-h\fR | \fB\-K\fR | \fB\-k\fR | \fB\-L\fR | \fB\-V\fR
163 \&\fBsudo\fR \fB\-v\fR [\fB\-AknS\fR]
164 .if \n(BA [\fB\-a\fR\ \fIauth_type\fR]
165 [\fB\-g\fR\ \fIgroup\ name\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
166 [\fB\-u\fR\ \fIusername\fR|\fI#uid\fR]
168 \&\fBsudo\fR \fB\-l[l]\fR [\fB\-AknS\fR]
169 .if \n(BA [\fB\-a\fR\ \fIauth_type\fR]
170 [\fB\-g\fR\ \fIgroup\ name\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
171 [\fB\-U\fR\ \fIuser\ name\fR] [\fB\-u\fR\ \fIuser\ name\fR|\fI#uid\fR] [\fIcommand\fR]
173 \&\fBsudo\fR [\fB\-AbEHnPS\fR]
174 .if \n(BA [\fB\-a\fR\ \fIauth_type\fR]
175 [\fB\-C\fR\ \fIfd\fR]
176 .if \n(LC [\fB\-c\fR\ \fIclass\fR|\fI\-\fR]
177 [\fB\-g\fR\ \fIgroup\ name\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
178 .if \n(SL [\fB\-r\fR\ \fIrole\fR] [\fB\-t\fR\ \fItype\fR]
179 [\fB\-u\fR\ \fIuser\ name\fR|\fI#uid\fR]
180 [\fB\s-1VAR\s0\fR=\fIvalue\fR] [\fB\-i\fR\ |\ \fB\-s\fR] [\fIcommand\fR]
182 \&\fBsudoedit\fR [\fB\-AnS\fR]
183 .if \n(BA [\fB\-a\fR\ \fIauth_type\fR]
184 [\fB\-C\fR\ \fIfd\fR]
185 .if \n(LC [\fB\-c\fR\ \fIclass\fR|\fI\-\fR]
186 [\fB\-g\fR\ \fIgroup\ name\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
187 [\fB\-u\fR\ \fIuser\ name\fR|\fI#uid\fR] file ...
189 .IX Header "DESCRIPTION"
190 \&\fBsudo\fR allows a permitted user to execute a \fIcommand\fR as the
191 superuser or another user, as specified in the \fIsudoers\fR file.
192 The real and effective uid and gid are set to match those of the
193 target user as specified in the passwd file and the group vector
194 is initialized based on the group file (unless the \fB\-P\fR option was
195 specified). If the invoking user is root or if the target user is
196 the same as the invoking user, no password is required. Otherwise,
197 \&\fBsudo\fR requires that users authenticate themselves with a password
198 by default (\s-1NOTE:\s0 in the default configuration this is the user's
199 password, not the root password). Once a user has been authenticated,
200 a time stamp is updated and the user may then use sudo without a
201 password for a short period of time (\f(CW\*(C`@timeout@\*(C'\fR minutes unless
202 overridden in \fIsudoers\fR).
204 When invoked as \fBsudoedit\fR, the \fB\-e\fR option (described below),
207 \&\fBsudo\fR determines who is an authorized user by consulting the file
208 \&\fI@sysconfdir@/sudoers\fR. By running \fBsudo\fR with the \fB\-v\fR option,
209 a user can update the time stamp without running a \fIcommand\fR. If
210 a password is required, \fBsudo\fR will exit if the user's password
211 is not entered within a configurable time limit. The default
212 password prompt timeout is
213 .ie \n(PT \f(CW\*(C`@password_timeout@\*(C'\fR minutes.
216 If a user who is not listed in the \fIsudoers\fR file tries to run a
217 command via \fBsudo\fR, mail is sent to the proper authorities, as
218 defined at configure time or in the \fIsudoers\fR file (defaults to
219 \&\f(CW\*(C`@mailto@\*(C'\fR). Note that the mail will not be sent if an unauthorized
220 user tries to run sudo with the \fB\-l\fR or \fB\-v\fR option. This allows
221 users to determine for themselves whether or not they are allowed
224 If \fBsudo\fR is run by root and the \f(CW\*(C`SUDO_USER\*(C'\fR environment variable
225 is set, \fBsudo\fR will use this value to determine who the actual
226 user is. This can be used by a user to log commands through sudo
227 even when a root shell has been invoked. It also allows the \fB\-e\fR
228 option to remain useful even when being run via a sudo-run script or
229 program. Note however, that the sudoers lookup is still done for
230 root, not the user specified by \f(CW\*(C`SUDO_USER\*(C'\fR.
232 \&\fBsudo\fR can log both successful and unsuccessful attempts (as well
233 as errors) to \fIsyslog\fR\|(3), a log file, or both. By default \fBsudo\fR
234 will log via \fIsyslog\fR\|(3) but this is changeable at configure time
235 or via the \fIsudoers\fR file.
238 \&\fBsudo\fR accepts the following command line options:
241 Normally, if \fBsudo\fR requires a password, it will read it from the
242 current terminal. If the \fB\-A\fR (\fIaskpass\fR) option is specified,
243 a (possibly graphical) helper program is executed to read the
244 user's password and output the password to the standard output. If
245 the \f(CW\*(C`SUDO_ASKPASS\*(C'\fR environment variable is set, it specifies the
246 path to the helper program. Otherwise, the value specified by the
247 \&\fIaskpass\fR option in \fIsudoers\fR\|(@mansectform@) is used.
249 .IP "\-a \fItype\fR" 12
251 The \fB\-a\fR (\fIauthentication type\fR) option causes \fBsudo\fR to use the
252 specified authentication type when validating the user, as allowed
253 by \fI/etc/login.conf\fR. The system administrator may specify a list
254 of sudo-specific authentication methods by adding an \*(L"auth-sudo\*(R"
255 entry in \fI/etc/login.conf\fR. This option is only available on systems
256 that support \s-1BSD\s0 authentication.
260 The \fB\-b\fR (\fIbackground\fR) option tells \fBsudo\fR to run the given
261 command in the background. Note that if you use the \fB\-b\fR
262 option you cannot use shell job control to manipulate the process.
263 .IP "\-C \fIfd\fR" 12
265 Normally, \fBsudo\fR will close all open file descriptors other than
266 standard input, standard output and standard error. The \fB\-C\fR
267 (\fIclose from\fR) option allows the user to specify a starting point
268 above the standard error (file descriptor three). Values less than
269 three are not permitted. This option is only available if the
270 administrator has enabled the \fIclosefrom_override\fR option in
271 \&\fIsudoers\fR\|(@mansectform@).
273 .IP "\-c \fIclass\fR" 12
275 The \fB\-c\fR (\fIclass\fR) option causes \fBsudo\fR to run the specified command
276 with resources limited by the specified login class. The \fIclass\fR
277 argument can be either a class name as defined in \fI/etc/login.conf\fR,
278 or a single '\-' character. Specifying a \fIclass\fR of \f(CW\*(C`\-\*(C'\fR indicates
279 that the command should be run restricted by the default login
280 capabilities for the user the command is run as. If the \fIclass\fR
281 argument specifies an existing user class, the command must be run
282 as root, or the \fBsudo\fR command must be run from a shell that is already
283 root. This option is only available on systems with \s-1BSD\s0 login classes.
287 The \fB\-E\fR (\fIpreserve\fR \fIenvironment\fR) option will override the
288 \&\fIenv_reset\fR option in \fIsudoers\fR\|(@mansectform@)). It is only
289 available when either the matching command has the \f(CW\*(C`SETENV\*(C'\fR tag
290 or the \fIsetenv\fR option is set in \fIsudoers\fR\|(@mansectform@).
293 The \fB\-e\fR (\fIedit\fR) option indicates that, instead of running
294 a command, the user wishes to edit one or more files. In lieu
295 of a command, the string \*(L"sudoedit\*(R" is used when consulting
296 the \fIsudoers\fR file. If the user is authorized by \fIsudoers\fR
297 the following steps are taken:
300 Temporary copies are made of the files to be edited with the owner
301 set to the invoking user.
303 The editor specified by the \f(CW\*(C`SUDO_EDITOR\*(C'\fR, \f(CW\*(C`VISUAL\*(C'\fR or \f(CW\*(C`EDITOR\*(C'\fR
304 environment variables is run to edit the temporary files. If none
305 of \f(CW\*(C`SUDO_EDITOR\*(C'\fR, \f(CW\*(C`VISUAL\*(C'\fR or \f(CW\*(C`EDITOR\*(C'\fR are set, the first program
306 listed in the \fIeditor\fR \fIsudoers\fR variable is used.
308 If they have been modified, the temporary files are copied back to
309 their original location and the temporary versions are removed.
313 If the specified file does not exist, it will be created. Note
314 that unlike most commands run by \fBsudo\fR, the editor is run with
315 the invoking user's environment unmodified. If, for some reason,
316 \&\fBsudo\fR is unable to update a file with its edited version, the
317 user will receive a warning and the edited copy will remain in a
320 .IP "\-g \fIgroup\fR" 12
322 Normally, \fBsudo\fR sets the primary group to the one specified by
323 the passwd database for the user the command is being run as (by
324 default, root). The \fB\-g\fR (\fIgroup\fR) option causes \fBsudo\fR to run
325 the specified command with the primary group set to \fIgroup\fR. To
326 specify a \fIgid\fR instead of a \fIgroup name\fR, use \fI#gid\fR. When
327 running commands as a \fIgid\fR, many shells require that the '#' be
328 escaped with a backslash ('\e'). If no \fB\-u\fR option is specified,
329 the command will be run as the invoking user (not root). In either
330 case, the primary group will be set to \fIgroup\fR.
333 The \fB\-H\fR (\fI\s-1HOME\s0\fR) option sets the \f(CW\*(C`HOME\*(C'\fR environment variable
334 to the homedir of the target user (root by default) as specified
335 in \fIpasswd\fR\|(@mansectform@). The default handling of the \f(CW\*(C`HOME\*(C'\fR environment
336 variable depends on \fIsudoers\fR\|(@mansectform@) settings. By default, \fBsudo\fR
337 will set \f(CW\*(C`HOME\*(C'\fR if \fIenv_reset\fR or \fIalways_set_home\fR are set, or
338 if \fIset_home\fR is set and the \fB\-s\fR option is specified on the
342 The \fB\-h\fR (\fIhelp\fR) option causes \fBsudo\fR to print a short help message
343 to the standard output and exit.
344 .IP "\-i [command]" 12
345 .IX Item "-i [command]"
346 The \fB\-i\fR (\fIsimulate initial login\fR) option runs the shell specified
347 in the \fIpasswd\fR\|(@mansectform@) entry of the target user as a login shell. This
348 means that login-specific resource files such as \f(CW\*(C`.profile\*(C'\fR or
349 \&\f(CW\*(C`.login\*(C'\fR will be read by the shell. If a command is specified,
350 it is passed to the shell for execution. Otherwise, an interactive
351 shell is executed. \fBsudo\fR attempts to change to that user's home
352 directory before running the shell. It also initializes the
353 environment, leaving \fI\s-1DISPLAY\s0\fR and \fI\s-1TERM\s0\fR unchanged, setting
354 \&\fI\s-1HOME\s0\fR, \fI\s-1MAIL\s0\fR, \fI\s-1SHELL\s0\fR, \fI\s-1USER\s0\fR, \fI\s-1LOGNAME\s0\fR, and \fI\s-1PATH\s0\fR, as well as
355 the contents of \fI/etc/environment\fR on Linux and \s-1AIX\s0 systems.
356 All other environment variables are removed.
359 The \fB\-K\fR (sure \fIkill\fR) option is like \fB\-k\fR except that it removes
360 the user's time stamp entirely and may not be used in conjunction
361 with a command or other option. This option does not require a
365 When used by itself, the \fB\-k\fR (\fIkill\fR) option to \fBsudo\fR invalidates
366 the user's time stamp by setting the time on it to the Epoch. The
367 next time \fBsudo\fR is run a password will be required. This option
368 does not require a password and was added to allow a user to revoke
369 \&\fBsudo\fR permissions from a .logout file.
371 When used in conjunction with a command or an option that may require
372 a password, the \fB\-k\fR option will cause \fBsudo\fR to ignore the user's
373 time stamp file. As a result, \fBsudo\fR will prompt for a password
374 (if one is required by \fIsudoers\fR) and will not update the user's
378 The \fB\-L\fR (\fIlist\fR defaults) option will list the parameters that
379 may be set in a \fIDefaults\fR line along with a short description for
380 each. This option will be removed from a future version of \fBsudo\fR.
381 .IP "\-l[l] [\fIcommand\fR]" 12
382 .IX Item "-l[l] [command]"
383 If no \fIcommand\fR is specified, the \fB\-l\fR (\fIlist\fR) option will list
384 the allowed (and forbidden) commands for the invoking user (or the
385 user specified by the \fB\-U\fR option) on the current host. If a
386 \&\fIcommand\fR is specified and is permitted by \fIsudoers\fR, the
387 fully-qualified path to the command is displayed along with any
388 command line arguments. If \fIcommand\fR is specified but not allowed,
389 \&\fBsudo\fR will exit with a status value of 1. If the \fB\-l\fR option is
390 specified with an \fBl\fR argument (i.e. \fB\-ll\fR), or if \fB\-l\fR
391 is specified multiple times, a longer list format is used.
394 The \fB\-n\fR (\fInon-interactive\fR) option prevents \fBsudo\fR from prompting
395 the user for a password. If a password is required for the command
396 to run, \fBsudo\fR will display an error messages and exit.
399 The \fB\-P\fR (\fIpreserve\fR \fIgroup vector\fR) option causes \fBsudo\fR to
400 preserve the invoking user's group vector unaltered. By default,
401 \&\fBsudo\fR will initialize the group vector to the list of groups the
402 target user is in. The real and effective group IDs, however, are
403 still set to match the target user.
404 .IP "\-p \fIprompt\fR" 12
406 The \fB\-p\fR (\fIprompt\fR) option allows you to override the default
407 password prompt and use a custom one. The following percent (`\f(CW\*(C`%\*(C'\fR')
408 escapes are supported:
411 .el .IP "\f(CW%H\fR" 4
413 expanded to the local host name including the domain name
414 (on if the machine's host name is fully qualified or the \fIfqdn\fR
415 \&\fIsudoers\fR option is set)
417 .el .IP "\f(CW%h\fR" 4
419 expanded to the local host name without the domain name
421 .el .IP "\f(CW%p\fR" 4
423 expanded to the user whose password is being asked for (respects the
424 \&\fIrootpw\fR, \fItargetpw\fR and \fIrunaspw\fR flags in \fIsudoers\fR)
426 .el .IP "\f(CW%U\fR" 4
428 expanded to the login name of the user the command will
429 be run as (defaults to root)
431 .el .IP "\f(CW%u\fR" 4
433 expanded to the invoking user's login name
434 .ie n .IP "\*(C`%%\*(C'" 4
435 .el .IP "\f(CW\*(C`%%\*(C'\fR" 4
437 two consecutive \f(CW\*(C`%\*(C'\fR characters are collapsed into a single \f(CW\*(C`%\*(C'\fR character
441 The prompt specified by the \fB\-p\fR option will override the system
442 password prompt on systems that support \s-1PAM\s0 unless the
443 \&\fIpassprompt_override\fR flag is disabled in \fIsudoers\fR.
446 .IP "\-r \fIrole\fR" 12
448 The \fB\-r\fR (\fIrole\fR) option causes the new (SELinux) security context to
449 have the role specified by \fIrole\fR.
453 The \fB\-S\fR (\fIstdin\fR) option causes \fBsudo\fR to read the password from
454 the standard input instead of the terminal device. The password must
455 be followed by a newline character.
456 .IP "\-s [command]" 12
457 .IX Item "-s [command]"
458 The \fB\-s\fR (\fIshell\fR) option runs the shell specified by the \fI\s-1SHELL\s0\fR
459 environment variable if it is set or the shell as specified in
460 \&\fIpasswd\fR\|(@mansectform@). If a command is specified, it is passed to the shell
461 for execution. Otherwise, an interactive shell is executed.
463 .IP "\-t \fItype\fR" 12
465 The \fB\-t\fR (\fItype\fR) option causes the new (SELinux) security context to
466 have the type specified by \fItype\fR. If no type is specified, the default
467 type is derived from the specified role.
469 .IP "\-U \fIuser\fR" 12
471 The \fB\-U\fR (\fIother user\fR) option is used in conjunction with the \fB\-l\fR
472 option to specify the user whose privileges should be listed. Only
473 root or a user with \fBsudo\fR \f(CW\*(C`ALL\*(C'\fR on the current host may use this
475 .IP "\-u \fIuser\fR" 12
477 The \fB\-u\fR (\fIuser\fR) option causes \fBsudo\fR to run the specified
478 command as a user other than \fIroot\fR. To specify a \fIuid\fR instead
479 of a \fIuser name\fR, use \fI#uid\fR. When running commands as a \fIuid\fR,
480 many shells require that the '#' be escaped with a backslash ('\e').
481 Note that if the \fItargetpw\fR Defaults option is set (see \fIsudoers\fR\|(@mansectform@))
482 it is not possible to run commands with a uid not listed in the
486 The \fB\-V\fR (\fIversion\fR) option causes \fBsudo\fR to print the version
487 number and exit. If the invoking user is already root the \fB\-V\fR
488 option will print out a list of the defaults \fBsudo\fR was compiled
489 with as well as the machine's local network addresses.
492 If given the \fB\-v\fR (\fIvalidate\fR) option, \fBsudo\fR will update the
493 user's time stamp, prompting for the user's password if necessary.
494 This extends the \fBsudo\fR timeout for another \f(CW\*(C`@timeout@\*(C'\fR minutes
495 (or whatever the timeout is set to in \fIsudoers\fR) but does not run
498 The \fB\-\-\fR option indicates that \fBsudo\fR should stop processing command
501 Environment variables to be set for the command may also be passed
502 on the command line in the form of \fB\s-1VAR\s0\fR=\fIvalue\fR, e.g.
503 \&\fB\s-1LD_LIBRARY_PATH\s0\fR=\fI/usr/local/pkg/lib\fR. Variables passed on the
504 command line are subject to the same restrictions as normal environment
505 variables with one important exception. If the \fIsetenv\fR option
506 is set in \fIsudoers\fR, the command to be run has the \f(CW\*(C`SETENV\*(C'\fR tag
507 set or the command matched is \f(CW\*(C`ALL\*(C'\fR, the user may set variables
508 that would overwise be forbidden. See \fIsudoers\fR\|(@mansectform@) for more information.
510 .IX Header "RETURN VALUES"
511 Upon successful execution of a program, the exit status from \fBsudo\fR
512 will simply be the exit status of the program that was executed.
514 Otherwise, \fBsudo\fR quits with an exit value of 1 if there is a
515 configuration/permission problem or if \fBsudo\fR cannot execute the
516 given command. In the latter case the error string is printed to
517 stderr. If \fBsudo\fR cannot \fIstat\fR\|(2) one or more entries in the user's
518 \&\f(CW\*(C`PATH\*(C'\fR an error is printed on stderr. (If the directory does not
519 exist or if it is not really a directory, the entry is ignored and
520 no error is printed.) This should not happen under normal
521 circumstances. The most common reason for \fIstat\fR\|(2) to return
522 \&\*(L"permission denied\*(R" is if you are running an automounter and one
523 of the directories in your \f(CW\*(C`PATH\*(C'\fR is on a machine that is currently
526 .IX Header "SECURITY NOTES"
527 \&\fBsudo\fR tries to be safe when executing external commands.
529 There are two distinct ways to deal with environment variables.
530 By default, the \fIenv_reset\fR \fIsudoers\fR option is enabled.
531 This causes commands to be executed with a minimal environment
532 containing \f(CW\*(C`TERM\*(C'\fR, \f(CW\*(C`PATH\*(C'\fR, \f(CW\*(C`HOME\*(C'\fR, \f(CW\*(C`SHELL\*(C'\fR, \f(CW\*(C`LOGNAME\*(C'\fR, \f(CW\*(C`USER\*(C'\fR
533 and \f(CW\*(C`USERNAME\*(C'\fR in addition to variables from the invoking process
534 permitted by the \fIenv_check\fR and \fIenv_keep\fR \fIsudoers\fR options.
535 There is effectively a whitelist for environment variables.
537 If, however, the \fIenv_reset\fR option is disabled in \fIsudoers\fR, any
538 variables not explicitly denied by the \fIenv_check\fR and \fIenv_delete\fR
539 options are inherited from the invoking process. In this case,
540 \&\fIenv_check\fR and \fIenv_delete\fR behave like a blacklist. Since it
541 is not possible to blacklist all potentially dangerous environment
542 variables, use of the default \fIenv_reset\fR behavior is encouraged.
544 In all cases, environment variables with a value beginning with
545 \&\f(CW\*(C`()\*(C'\fR are removed as they could be interpreted as \fBbash\fR functions.
546 The list of environment variables that \fBsudo\fR allows or denies is
547 contained in the output of \f(CW\*(C`sudo \-V\*(C'\fR when run as root.
549 Note that the dynamic linker on most operating systems will remove
550 variables that can control dynamic linking from the environment of
551 setuid executables, including \fBsudo\fR. Depending on the operating
552 system this may include \f(CW\*(C`_RLD*\*(C'\fR, \f(CW\*(C`DYLD_*\*(C'\fR, \f(CW\*(C`LD_*\*(C'\fR, \f(CW\*(C`LDR_*\*(C'\fR,
553 \&\f(CW\*(C`LIBPATH\*(C'\fR, \f(CW\*(C`SHLIB_PATH\*(C'\fR, and others. These type of variables are
554 removed from the environment before \fBsudo\fR even begins execution
555 and, as such, it is not possible for \fBsudo\fR to preserve them.
557 To prevent command spoofing, \fBsudo\fR checks \*(L".\*(R" and "" (both denoting
558 current directory) last when searching for a command in the user's
559 \&\s-1PATH\s0 (if one or both are in the \s-1PATH\s0). Note, however, that the
560 actual \f(CW\*(C`PATH\*(C'\fR environment variable is \fInot\fR modified and is passed
561 unchanged to the program that \fBsudo\fR executes.
563 \&\fBsudo\fR will check the ownership of its time stamp directory
564 (\fI@timedir@\fR by default) and ignore the directory's contents if
565 it is not owned by root or if it is writable by a user other than
566 root. On systems that allow non-root users to give away files via
567 \&\fIchown\fR\|(2), if the time stamp directory is located in a directory
568 writable by anyone (e.g., \fI/tmp\fR), it is possible for a user to
569 create the time stamp directory before \fBsudo\fR is run. However,
570 because \fBsudo\fR checks the ownership and mode of the directory and
571 its contents, the only damage that can be done is to \*(L"hide\*(R" files
572 by putting them in the time stamp dir. This is unlikely to happen
573 since once the time stamp dir is owned by root and inaccessible by
574 any other user, the user placing files there would be unable to get
575 them back out. To get around this issue you can use a directory
576 that is not world-writable for the time stamps (\fI/var/adm/sudo\fR for
577 instance) or create \fI@timedir@\fR with the appropriate owner (root)
578 and permissions (0700) in the system startup files.
580 \&\fBsudo\fR will not honor time stamps set far in the future.
581 Timestamps with a date greater than current_time + 2 * \f(CW\*(C`TIMEOUT\*(C'\fR
582 will be ignored and sudo will log and complain. This is done to
583 keep a user from creating his/her own time stamp with a bogus
584 date on systems that allow users to give away files.
586 On systems where the boot time is available, \fBsudo\fR will also not
587 honor time stamps from before the machine booted.
589 Since time stamp files live in the file system, they can outlive a
590 user's login session. As a result, a user may be able to login,
591 run a command with \fBsudo\fR after authenticating, logout, login
592 again, and run \fBsudo\fR without authenticating so long as the time
593 stamp file's modification time is within \f(CW\*(C`@timeout@\*(C'\fR minutes (or
594 whatever the timeout is set to in \fIsudoers\fR). When the \fItty_tickets\fR
595 option is enabled in \fIsudoers\fR, the time stamp has per-tty granularity
596 but still may outlive the user's session. On Linux systems where
597 the devpts filesystem is used, Solaris systems with the devices
598 filesystem, as well as other systems that utilize a devfs filesystem
599 that monotonically increase the inode number of devices as they are
600 created (such as Mac \s-1OS\s0 X), \fBsudo\fR is able to determine when a
601 tty-based time stamp file is stale and will ignore it. Administrators
602 should not rely on this feature as it is not universally available.
604 Please note that \fBsudo\fR will normally only log the command it
605 explicitly runs. If a user runs a command such as \f(CW\*(C`sudo su\*(C'\fR or
606 \&\f(CW\*(C`sudo sh\*(C'\fR, subsequent commands run from that shell will \fInot\fR be
607 logged, nor will \fBsudo\fR's access control affect them. The same
608 is true for commands that offer shell escapes (including most
609 editors). Because of this, care must be taken when giving users
610 access to commands via \fBsudo\fR to verify that the command does not
611 inadvertently give the user an effective root shell. For more
612 information, please see the \f(CW\*(C`PREVENTING SHELL ESCAPES\*(C'\fR section in
613 \&\fIsudoers\fR\|(@mansectform@).
615 .IX Header "ENVIRONMENT"
616 \&\fBsudo\fR utilizes the following environment variables:
617 .ie n .IP "\*(C`EDITOR\*(C'" 16
618 .el .IP "\f(CW\*(C`EDITOR\*(C'\fR" 16
620 Default editor to use in \fB\-e\fR (sudoedit) mode if neither \f(CW\*(C`SUDO_EDITOR\*(C'\fR
621 nor \f(CW\*(C`VISUAL\*(C'\fR is set
622 .ie n .IP "\*(C`MAIL\*(C'" 16
623 .el .IP "\f(CW\*(C`MAIL\*(C'\fR" 16
625 In \fB\-i\fR mode or when \fIenv_reset\fR is enabled in \fIsudoers\fR, set
626 to the mail spool of the target user
627 .ie n .IP "\*(C`HOME\*(C'" 16
628 .el .IP "\f(CW\*(C`HOME\*(C'\fR" 16
630 Set to the home directory of the target user if \fB\-i\fR or \fB\-H\fR are
631 specified, \fIenv_reset\fR or \fIalways_set_home\fR are set in \fIsudoers\fR,
632 or when the \fB\-s\fR option is specified and \fIset_home\fR is set in
634 .ie n .IP "\*(C`PATH\*(C'" 16
635 .el .IP "\f(CW\*(C`PATH\*(C'\fR" 16
637 Set to a sane value if the \fIsecure_path\fR sudoers option is set.
638 .ie n .IP "\*(C`SHELL\*(C'" 16
639 .el .IP "\f(CW\*(C`SHELL\*(C'\fR" 16
641 Used to determine shell to run with \f(CW\*(C`\-s\*(C'\fR option
642 .ie n .IP "\*(C`SUDO_ASKPASS\*(C'" 16
643 .el .IP "\f(CW\*(C`SUDO_ASKPASS\*(C'\fR" 16
644 .IX Item "SUDO_ASKPASS"
645 Specifies the path to a helper program used to read the password
646 if no terminal is available or if the \f(CW\*(C`\-A\*(C'\fR option is specified.
647 .ie n .IP "\*(C`SUDO_COMMAND\*(C'" 16
648 .el .IP "\f(CW\*(C`SUDO_COMMAND\*(C'\fR" 16
649 .IX Item "SUDO_COMMAND"
650 Set to the command run by sudo
651 .ie n .IP "\*(C`SUDO_EDITOR\*(C'" 16
652 .el .IP "\f(CW\*(C`SUDO_EDITOR\*(C'\fR" 16
653 .IX Item "SUDO_EDITOR"
654 Default editor to use in \fB\-e\fR (sudoedit) mode
655 .ie n .IP "\*(C`SUDO_GID\*(C'" 16
656 .el .IP "\f(CW\*(C`SUDO_GID\*(C'\fR" 16
658 Set to the group \s-1ID\s0 of the user who invoked sudo
659 .ie n .IP "\*(C`SUDO_PROMPT\*(C'" 16
660 .el .IP "\f(CW\*(C`SUDO_PROMPT\*(C'\fR" 16
661 .IX Item "SUDO_PROMPT"
662 Used as the default password prompt
663 .ie n .IP "\*(C`SUDO_PS1\*(C'" 16
664 .el .IP "\f(CW\*(C`SUDO_PS1\*(C'\fR" 16
666 If set, \f(CW\*(C`PS1\*(C'\fR will be set to its value for the program being run
667 .ie n .IP "\*(C`SUDO_UID\*(C'" 16
668 .el .IP "\f(CW\*(C`SUDO_UID\*(C'\fR" 16
670 Set to the user \s-1ID\s0 of the user who invoked sudo
671 .ie n .IP "\*(C`SUDO_USER\*(C'" 16
672 .el .IP "\f(CW\*(C`SUDO_USER\*(C'\fR" 16
674 Set to the login of the user who invoked sudo
675 .ie n .IP "\*(C`USER\*(C'" 16
676 .el .IP "\f(CW\*(C`USER\*(C'\fR" 16
678 Set to the target user (root unless the \fB\-u\fR option is specified)
679 .ie n .IP "\*(C`VISUAL\*(C'" 16
680 .el .IP "\f(CW\*(C`VISUAL\*(C'\fR" 16
682 Default editor to use in \fB\-e\fR (sudoedit) mode if \f(CW\*(C`SUDO_EDITOR\*(C'\fR
686 .ie n .IP "\fI@sysconfdir@/sudoers\fR" 24
687 .el .IP "\fI@sysconfdir@/sudoers\fR" 24
688 .IX Item "@sysconfdir@/sudoers"
689 List of who can run what
690 .ie n .IP "\fI@timedir@\fR" 24
691 .el .IP "\fI@timedir@\fR" 24
693 Directory containing time stamps
694 .IP "\fI/etc/environment\fR" 24
695 .IX Item "/etc/environment"
696 Initial environment for \fB\-i\fR mode on Linux and \s-1AIX\s0
698 .IX Header "EXAMPLES"
699 Note: the following examples assume suitable \fIsudoers\fR\|(@mansectform@) entries.
701 To get a file listing of an unreadable directory:
704 \& $ sudo ls /usr/local/protected
707 To list the home directory of user yaz on a machine where the
708 file system holding ~yaz is not exported as root:
711 \& $ sudo \-u yaz ls ~yaz
714 To edit the \fIindex.html\fR file as user www:
717 \& $ sudo \-u www vi ~www/htdocs/index.html
720 To view system logs only accessible to root and users in the adm group:
723 \& $ sudo \-g adm view /var/log/syslog
726 To run an editor as jim with a different primary group:
729 \& $ sudo \-u jim \-g audio vi ~jim/sound.txt
732 To shutdown a machine:
735 \& $ sudo shutdown \-r +15 "quick reboot"
738 To make a usage listing of the directories in the /home
739 partition. Note that this runs the commands in a sub-shell
740 to make the \f(CW\*(C`cd\*(C'\fR and file redirection work.
743 \& $ sudo sh \-c "cd /home ; du \-s * | sort \-rn > USAGE"
746 .IX Header "SEE ALSO"
747 \&\fIgrep\fR\|(1), \fIsu\fR\|(1), \fIstat\fR\|(2),
748 .if \n(LC \&\fIlogin_cap\fR\|(3),
749 \&\fIpasswd\fR\|(@mansectform@), \fIsudoers\fR\|(5), \fIvisudo\fR\|(@mansectsu@)
752 Many people have worked on \fBsudo\fR over the years; this
753 version consists of code written primarily by:
759 See the \s-1HISTORY\s0 file in the \fBsudo\fR distribution or visit
760 http://www.sudo.ws/sudo/history.html for a short history
764 There is no easy way to prevent a user from gaining a root shell
765 if that user is allowed to run arbitrary commands via \fBsudo\fR.
766 Also, many programs (such as editors) allow the user to run commands
767 via shell escapes, thus avoiding \fBsudo\fR's checks. However, on
768 most systems it is possible to prevent shell escapes with \fBsudo\fR's
769 \&\fInoexec\fR functionality. See the \fIsudoers\fR\|(@mansectform@) manual
772 It is not meaningful to run the \f(CW\*(C`cd\*(C'\fR command directly via sudo, e.g.,
775 \& $ sudo cd /usr/local/protected
778 since when the command exits the parent process (your shell) will
779 still be the same. Please see the \s-1EXAMPLES\s0 section for more information.
781 If users have sudo \f(CW\*(C`ALL\*(C'\fR there is nothing to prevent them from
782 creating their own program that gives them a root shell regardless
783 of any '!' elements in the user specification.
785 Running shell scripts via \fBsudo\fR can expose the same kernel bugs that
786 make setuid shell scripts unsafe on some operating systems (if your \s-1OS\s0
787 has a /dev/fd/ directory, setuid shell scripts are generally safe).
790 If you feel you have found a bug in \fBsudo\fR, please submit a bug report
791 at http://www.sudo.ws/sudo/bugs/
794 Limited free support is available via the sudo-users mailing list,
795 see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
798 .IX Header "DISCLAIMER"
799 \&\fBsudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
800 including, but not limited to, the implied warranties of merchantability
801 and fitness for a particular purpose are disclaimed. See the \s-1LICENSE\s0
802 file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
803 for complete details.
projects / debian / sudo / blob