4 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
8 sudoers - list of which users may execute what
10 D
\bDE
\bES
\bSC
\bCR
\bRI
\bIP
\bPT
\bTI
\bIO
\bON
\bN
11 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is composed of two types of entries:
12 aliases (basically variables) and user specifications
13 (which specify who may run what).
15 When multiple entries match for a user, they are applied
16 in order. Where there are multiple matches, the last
17 match is used (which is not necessarily the most specific
20 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs grammar will be described below in Extended
21 Backus-Naur Form (EBNF). Don't despair if you don't know
22 what EBNF is; it is fairly simple, and the definitions
25 Q
\bQu
\bui
\bic
\bck
\bk g
\bgu
\bui
\bid
\bde
\be t
\bto
\bo E
\bEB
\bBN
\bNF
\bF
27 EBNF is a concise and exact way of describing the grammar
28 of a language. Each EBNF definition is made up of _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\b
29 _
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be_
\bs. E.g.,
31 symbol ::= definition | alternate1 | alternate2 ...
33 Each _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be references others and thus makes up a
34 grammar for the language. EBNF also contains the follow
35 ing operators, which many readers will recognize from reg
36 ular expressions. Do not, however, confuse them with
37 "wildcard" characters, which have different meanings.
39 ? Means that the preceding symbol (or group of symbols)
40 is optional. That is, it may appear once or not at
43 * Means that the preceding symbol (or group of symbols)
44 may appear zero or more times.
46 + Means that the preceding symbol (or group of symbols)
47 may appear one or more times.
49 Parentheses may be used to group symbols together. For
50 clarity, we will use single quotes ('') to designate what
51 is a verbatim character string (as opposed to a symbol
54 A
\bAl
\bli
\bia
\bas
\bse
\bes
\bs
56 There are four kinds of aliases: User_Alias, Runas_Alias,
57 Host_Alias and Cmnd_Alias.
64 1.6.9p8 November 2, 2007 1
70 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
73 Alias ::= 'User_Alias' User_Alias (':' User_Alias)* |
74 'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
75 'Host_Alias' Host_Alias (':' Host_Alias)* |
76 'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)*
78 User_Alias ::= NAME '=' User_List
80 Runas_Alias ::= NAME '=' Runas_List
82 Host_Alias ::= NAME '=' Host_List
84 Cmnd_Alias ::= NAME '=' Cmnd_List
86 NAME ::= [A-Z]([A-Z][0-9]_)*
88 Each _
\ba_
\bl_
\bi_
\ba_
\bs definition is of the form
90 Alias_Type NAME = item1, item2, ...
92 where _
\bA_
\bl_
\bi_
\ba_
\bs_
\b__
\bT_
\by_
\bp_
\be is one of User_Alias, Runas_Alias,
93 Host_Alias, or Cmnd_Alias. A NAME is a string of upper
94 case letters, numbers, and underscore characters ('_'). A
95 NAME m
\bmu
\bus
\bst
\bt start with an uppercase letter. It is possible
96 to put several alias definitions of the same type on a
97 single line, joined by a colon (':'). E.g.,
99 Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
101 The definitions of what constitutes a valid _
\ba_
\bl_
\bi_
\ba_
\bs member
107 User ::= '!'* username |
112 A User_List is made up of one or more usernames, system
113 groups (prefixed with '%'), netgroups (prefixed with '+')
114 and other aliases. Each list item may be prefixed with
115 one or more '!' operators. An odd number of '!' operators
116 negate the value of the item; an even number just cancel
119 Runas_List ::= Runas_User |
120 Runas_User ',' Runas_List
122 Runas_User ::= '!'* username |
130 1.6.9p8 November 2, 2007 2
136 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
139 A Runas_List is similar to a User_List except that it can
140 also contain uids (prefixed with '#') and instead of
141 User_Aliases it can contain Runas_Aliases. Note that
142 usernames and groups are matched as strings. In other
143 words, two users (groups) with the same uid (gid) are con
144 sidered to be distinct. If you wish to match all user
145 names with the same uid (e.g. root and toor), you can use
146 a uid instead (#0 in the example given).
151 Host ::= '!'* hostname |
153 '!'* network(/netmask)? |
157 A Host_List is made up of one or more hostnames, IP
158 addresses, network numbers, netgroups (prefixed with '+')
159 and other aliases. Again, the value of an item may be
160 negated with the '!' operator. If you do not specify a
161 netmask along with the network number, s
\bsu
\bud
\bdo
\bo will query
162 each of the local host's network interfaces and, if the
163 network number corresponds to one of the hosts's network
164 interfaces, the corresponding netmask will be used. The
165 netmask may be specified either in standard IP address
166 notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or
167 CIDR notation (number of bits, e.g. 24 or 64). A hostname
168 may include shell-style wildcards (see the Wildcards sec
169 tion below), but unless the hostname command on your
170 machine returns the fully qualified hostname, you'll need
171 to use the _
\bf_
\bq_
\bd_
\bn option for wildcards to be useful.
176 commandname ::= filename |
180 Cmnd ::= '!'* commandname |
185 A Cmnd_List is a list of one or more commandnames, direc
186 tories, and other aliases. A commandname is a fully qual
187 ified filename which may include shell-style wildcards
188 (see the Wildcards section below). A simple filename
189 allows the user to run the command with any arguments
190 he/she wishes. However, you may also specify command line
191 arguments (including wildcards). Alternately, you can
192 specify "" to indicate that the command may only be run
196 1.6.9p8 November 2, 2007 3
202 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
205 w
\bwi
\bit
\bth
\bho
\bou
\but
\bt command line arguments. A directory is a fully
206 qualified pathname ending in a '/'. When you specify a
207 directory in a Cmnd_List, the user will be able to run any
208 file within that directory (but not in any subdirectories
211 If a Cmnd has associated command line arguments, then the
212 arguments in the Cmnd must match exactly those given by
213 the user on the command line (or match the wildcards if
214 there are any). Note that the following characters must
215 be escaped with a '\' if they are used in command argu
216 ments: ',', ':', '=', '\'. The special command "sudoedit"
217 is used to permit a user to run s
\bsu
\bud
\bdo
\bo with the -
\b-e
\be flag (or
218 as s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt). It may take command line arguments just as
219 a normal command does.
221 D
\bDe
\bef
\bfa
\bau
\bul
\blt
\bts
\bs
223 Certain configuration options may be changed from their
224 default values at runtime via one or more Default_Entry
225 lines. These may affect all users on any host, all users
226 on a specific host, a specific user, or commands being run
229 Default_Type ::= 'Defaults' |
230 'Defaults' '@' Host_List |
231 'Defaults' ':' User_List |
232 'Defaults' '>' Runas_List
234 Default_Entry ::= Default_Type Parameter_List
236 Parameter_List ::= Parameter |
237 Parameter ',' Parameter_List
239 Parameter ::= Parameter '=' Value |
240 Parameter '+=' Value |
241 Parameter '-=' Value |
244 Parameters may be f
\bfl
\bla
\bag
\bgs
\bs, i
\bin
\bnt
\bte
\beg
\bge
\ber
\br values, s
\bst
\btr
\bri
\bin
\bng
\bgs
\bs, or
245 l
\bli
\bis
\bst
\bts
\bs. Flags are implicitly boolean and can be turned off
246 via the '!' operator. Some integer, string and list
247 parameters may also be used in a boolean context to dis
248 able them. Values may be enclosed in double quotes (")
249 when they contain multiple words. Special characters may
250 be escaped with a backslash (\).
252 Lists have two additional assignment operators, += and -=.
253 These operators are used to add to and delete from a list
254 respectively. It is not an error to use the -= operator
255 to remove an element that does not exist in a list.
257 See "SUDOERS OPTIONS" for a list of supported Defaults
262 1.6.9p8 November 2, 2007 4
268 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
271 U
\bUs
\bse
\ber
\br S
\bSp
\bpe
\bec
\bci
\bif
\bfi
\bic
\bca
\bat
\bti
\bio
\bon
\bn
273 User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
274 (':' Host_List '=' Cmnd_Spec_List)*
276 Cmnd_Spec_List ::= Cmnd_Spec |
277 Cmnd_Spec ',' Cmnd_Spec_List
279 Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
281 Runas_Spec ::= '(' Runas_List ')'
283 Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
284 'SETENV:' | 'NOSETENV:')
286 A u
\bus
\bse
\ber
\br s
\bsp
\bpe
\bec
\bci
\bif
\bfi
\bic
\bca
\bat
\bti
\bio
\bon
\bn determines which commands a user may
287 run (and as what user) on specified hosts. By default,
288 commands are run as r
\bro
\boo
\bot
\bt, but this can be changed on a
291 Let's break that down into its constituent parts:
293 R
\bRu
\bun
\bna
\bas
\bs_
\b_S
\bSp
\bpe
\bec
\bc
295 A Runas_Spec is simply a Runas_List (as defined above)
296 enclosed in a set of parentheses. If you do not specify a
297 Runas_Spec in the user specification, a default Runas_Spec
298 of r
\bro
\boo
\bot
\bt will be used. A Runas_Spec sets the default for
299 commands that follow it. What this means is that for the
302 dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
304 The user d
\bdg
\bgb
\bb may run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm
305 -- but only as o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br. E.g.,
307 $ sudo -u operator /bin/ls.
309 It is also possible to override a Runas_Spec later on in
310 an entry. If we modify the entry like so:
312 dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
314 Then user d
\bdg
\bgb
\bb is now allowed to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs as o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br,
315 but _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as r
\bro
\boo
\bot
\bt.
317 T
\bTa
\bag
\bg_
\b_S
\bSp
\bpe
\bec
\bc
319 A command may have zero or more tags associated with it.
320 There are six possible tag values, NOPASSWD, PASSWD,
321 NOEXEC, EXEC, SETENV and NOSETENV. Once a tag is set on a
322 Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit the
323 tag unless it is overridden by the opposite tag (i.e.:
324 PASSWD overrides NOPASSWD and NOEXEC overrides EXEC).
328 1.6.9p8 November 2, 2007 5
334 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
337 _
\bN_
\bO_
\bP_
\bA_
\bS_
\bS_
\bW_
\bD _
\ba_
\bn_
\bd _
\bP_
\bA_
\bS_
\bS_
\bW_
\bD
339 By default, s
\bsu
\bud
\bdo
\bo requires that a user authenticate him or
340 herself before running a command. This behavior can be
341 modified via the NOPASSWD tag. Like a Runas_Spec, the
342 NOPASSWD tag sets a default for the commands that follow
343 it in the Cmnd_Spec_List. Conversely, the PASSWD tag can
344 be used to reverse things. For example:
346 ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
348 would allow the user r
\bra
\bay
\by to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, and
349 _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as root on the machine rushmore as r
\bro
\boo
\bot
\bt
350 without authenticating himself. If we only want r
\bra
\bay
\by to be
351 able to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl without a password the entry would
354 ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
356 Note, however, that the PASSWD tag has no effect on users
357 who are in the group specified by the _
\be_
\bx_
\be_
\bm_
\bp_
\bt_
\b__
\bg_
\br_
\bo_
\bu_
\bp option.
359 By default, if the NOPASSWD tag is applied to any of the
360 entries for a user on the current host, he or she will be
361 able to run sudo -l without a password. Additionally, a
362 user may only run sudo -v without a password if the
363 NOPASSWD tag is present for all a user's entries that per
364 tain to the current host. This behavior may be overridden
365 via the verifypw and listpw options.
367 _
\bN_
\bO_
\bE_
\bX_
\bE_
\bC _
\ba_
\bn_
\bd _
\bE_
\bX_
\bE_
\bC
369 If s
\bsu
\bud
\bdo
\bo has been compiled with _
\bn_
\bo_
\be_
\bx_
\be_
\bc support and the
370 underlying operating system supports it, the NOEXEC tag
371 can be used to prevent a dynamically-linked executable
372 from running further commands itself.
374 In the following example, user a
\baa
\bar
\bro
\bon
\bn may run _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be
375 and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bv_
\bi but shell escapes will be disabled.
377 aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
379 See the "PREVENTING SHELL ESCAPES" section below for more
380 details on how NOEXEC works and whether or not it will
383 _
\bS_
\bE_
\bT_
\bE_
\bN_
\bV _
\ba_
\bn_
\bd _
\bN_
\bO_
\bS_
\bE_
\bT_
\bE_
\bN_
\bV
385 These tags override the value of the _
\bs_
\be_
\bt_
\be_
\bn_
\bv option on a
386 per-command basis. Note that if SETENV has been set for a
387 command, any environment variables set on the command line
388 way are not subject to the restrictions imposed by
389 _
\be_
\bn_
\bv_
\b__
\bc_
\bh_
\be_
\bc_
\bk, _
\be_
\bn_
\bv_
\b__
\bd_
\be_
\bl_
\be_
\bt_
\be, or _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp. As such, only trusted
390 users should be allowed to set variables in this manner.
394 1.6.9p8 November 2, 2007 6
400 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
403 W
\bWi
\bil
\bld
\bdc
\bca
\bar
\brd
\bds
\bs
405 s
\bsu
\bud
\bdo
\bo allows shell-style _
\bw_
\bi_
\bl_
\bd_
\bc_
\ba_
\br_
\bd_
\bs (aka meta or glob char
406 acters) to be used in pathnames as well as command line
407 arguments in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file. Wildcard matching is done
408 via the P
\bPO
\bOS
\bSI
\bIX
\bX _
\bf_
\bn_
\bm_
\ba_
\bt_
\bc_
\bh(3) routine. Note that these are _
\bn_
\bo_
\bt
411 * Matches any set of zero or more characters.
413 ? Matches any single character.
415 [...] Matches any character in the specified range.
417 [!...] Matches any character n
\bno
\bot
\bt in the specified range.
419 \x For any character "x", evaluates to "x". This is
420 used to escape special characters such as: "*",
423 Note that a forward slash ('/') will n
\bno
\bot
\bt be matched by
424 wildcards used in the pathname. When matching the command
425 line arguments, however, a slash d
\bdo
\boe
\bes
\bs get matched by wild
426 cards. This is to make a path like:
430 match _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bw_
\bh_
\bo but not _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bX_
\b1_
\b1_
\b/_
\bx_
\bt_
\be_
\br_
\bm.
432 E
\bEx
\bxc
\bce
\bep
\bpt
\bti
\bio
\bon
\bns
\bs t
\bto
\bo w
\bwi
\bil
\bld
\bdc
\bca
\bar
\brd
\bd r
\bru
\bul
\ble
\bes
\bs
434 The following exceptions apply to the above rules:
436 "" If the empty string "" is the only command line
437 argument in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entry it means that com
438 mand is not allowed to be run with a
\ban
\bny
\by arguments.
440 O
\bOt
\bth
\bhe
\ber
\br s
\bsp
\bpe
\bec
\bci
\bia
\bal
\bl c
\bch
\bha
\bar
\bra
\bac
\bct
\bte
\ber
\brs
\bs a
\ban
\bnd
\bd r
\bre
\bes
\bse
\ber
\brv
\bve
\bed
\bd w
\bwo
\bor
\brd
\bds
\bs
442 The pound sign ('#') is used to indicate a comment (unless
443 it is part of a #include directive or unless it occurs in
444 the context of a user name and is followed by one or more
445 digits, in which case it is treated as a uid). Both the
446 comment character and any text after it, up to the end of
447 the line, are ignored.
449 The reserved word A
\bAL
\bLL
\bL is a built-in _
\ba_
\bl_
\bi_
\ba_
\bs that always
450 causes a match to succeed. It can be used wherever one
451 might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias,
452 or Host_Alias. You should not try to define your own
453 _
\ba_
\bl_
\bi_
\ba_
\bs called A
\bAL
\bLL
\bL as the built-in alias will be used in
454 preference to your own. Please note that using A
\bAL
\bLL
\bL can be
455 dangerous since in a command context, it allows the user
456 to run a
\ban
\bny
\by command on the system.
460 1.6.9p8 November 2, 2007 7
466 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
469 An exclamation point ('!') can be used as a logical _
\bn_
\bo_
\bt
470 operator both in an _
\ba_
\bl_
\bi_
\ba_
\bs and in front of a Cmnd. This
471 allows one to exclude certain values. Note, however, that
472 using a ! in conjunction with the built-in ALL alias to
473 allow a user to run "all but a few" commands rarely works
474 as intended (see SECURITY NOTES below).
476 Long lines can be continued with a backslash ('\') as the
477 last character on the line.
479 Whitespace between elements in a list as well as special
480 syntactic characters in a _
\bU_
\bs_
\be_
\br _
\bS_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn ('=', ':',
481 '(', ')') is optional.
483 The following characters must be escaped with a backslash
484 ('\') when used as part of a word (e.g. a username or
485 hostname): '@', '!', '=', ':', ',', '(', ')', '\'.
487 S
\bSU
\bUD
\bDO
\bOE
\bER
\bRS
\bS O
\bOP
\bPT
\bTI
\bIO
\bON
\bNS
\bS
488 s
\bsu
\bud
\bdo
\bo's behavior can be modified by Default_Entry lines, as
489 explained earlier. A list of all supported Defaults
490 parameters, grouped by type, are listed below.
492 F
\bFl
\bla
\bag
\bgs
\bs:
494 always_set_home If set, s
\bsu
\bud
\bdo
\bo will set the HOME environment
495 variable to the home directory of the tar
496 get user (which is root unless the -
\b-u
\bu
497 option is used). This effectively means
498 that the -
\b-H
\bH flag is always implied. This
499 flag is _
\bo_
\bf_
\bf by default.
501 authenticate If set, users must authenticate themselves
502 via a password (or other means of authen
503 tication) before they may run commands.
504 This default may be overridden via the
505 PASSWD and NOPASSWD tags. This flag is _
\bo_
\bn
508 env_editor If set, v
\bvi
\bis
\bsu
\bud
\bdo
\bo will use the value of the
509 EDITOR or VISUAL environment variables
510 before falling back on the default editor
511 list. Note that this may create a secu
512 rity hole as it allows the user to run any
513 arbitrary command as root without logging.
514 A safer alternative is to place a colon-
515 separated list of editors in the editor
516 variable. v
\bvi
\bis
\bsu
\bud
\bdo
\bo will then only use the
517 EDITOR or VISUAL if they match a value
518 specified in editor. This flag is _
\bo_
\bf_
\bf by
521 env_reset If set, s
\bsu
\bud
\bdo
\bo will reset the environment to
522 only contain the LOGNAME, SHELL, USER,
526 1.6.9p8 November 2, 2007 8
532 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
535 USERNAME and the SUDO_* variables. Any
536 variables in the caller's environment that
537 match the env_keep and env_check lists are
538 then added. The default contents of the
539 env_keep and env_check lists are displayed
540 when s
\bsu
\bud
\bdo
\bo is run by root with the _
\b-_
\bV
541 option. If s
\bsu
\bud
\bdo
\bo was compiled with the
542 SECURE_PATH option, its value will be used
543 for the PATH environment variable. This
544 flag is _
\bo_
\bn by default.
546 fqdn Set this flag if you want to put fully
547 qualified hostnames in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file.
548 I.e., instead of myhost you would use
549 myhost.mydomain.edu. You may still use
550 the short form if you wish (and even mix
551 the two). Beware that turning on _
\bf_
\bq_
\bd_
\bn
552 requires s
\bsu
\bud
\bdo
\bo to make DNS lookups which
553 may make s
\bsu
\bud
\bdo
\bo unusable if DNS stops work
554 ing (for example if the machine is not
555 plugged into the network). Also note that
556 you must use the host's official name as
557 DNS knows it. That is, you may not use a
558 host alias (CNAME entry) due to perfor
559 mance issues and the fact that there is no
560 way to get all aliases from DNS. If your
561 machine's hostname (as returned by the
562 hostname command) is already fully quali
563 fied you shouldn't need to set _
\bf_
\bq_
\bd_
\bn. This
564 flag is _
\bo_
\bf_
\bf by default.
566 ignore_dot If set, s
\bsu
\bud
\bdo
\bo will ignore '.' or '' (cur
567 rent dir) in the PATH environment vari
568 able; the PATH itself is not modified.
569 This flag is _
\bo_
\bf_
\bf by default. Currently,
570 while it is possible to set _
\bi_
\bg_
\bn_
\bo_
\br_
\be_
\b__
\bd_
\bo_
\bt in
571 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs, its value is not used. This
572 option should be considered read-only (it
573 will be fixed in a future version of
577 If set via LDAP, parsing of
578 @sysconfdir@/sudoers will be skipped.
579 This is intended for Enterprises that wish
580 to prevent the usage of local sudoers
581 files so that only LDAP is used. This
582 thwarts the efforts of rogue operators who
583 would attempt to add roles to
584 @sysconfdir@/sudoers. When this option is
585 present, @sysconfdir@/sudoers does not
586 even need to exist. Since this option
587 tells s
\bsu
\bud
\bdo
\bo how to behave when no specific
588 LDAP entries have been matched, this
592 1.6.9p8 November 2, 2007 9
598 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
601 sudoOption is only meaningful for the
602 cn=defaults section. This flag is _
\bo_
\bf_
\bf by
605 insults If set, s
\bsu
\bud
\bdo
\bo will insult users when they
606 enter an incorrect password. This flag is
607 _
\bo_
\bf_
\bf by default.
609 log_host If set, the hostname will be logged in the
610 (non-syslog) s
\bsu
\bud
\bdo
\bo log file. This flag is
611 _
\bo_
\bf_
\bf by default.
613 log_year If set, the four-digit year will be logged
614 in the (non-syslog) s
\bsu
\bud
\bdo
\bo log file. This
615 flag is _
\bo_
\bf_
\bf by default.
617 long_otp_prompt When validating with a One Time Password
618 (OPT) scheme such as S
\bS/
\b/K
\bKe
\bey
\by or O
\bOP
\bPI
\bIE
\bE, a two-
619 line prompt is used to make it easier to
620 cut and paste the challenge to a local
621 window. It's not as pretty as the default
622 but some people find it more convenient.
623 This flag is _
\bo_
\bf_
\bf by default.
625 mail_always Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user every time a
626 users runs s
\bsu
\bud
\bdo
\bo. This flag is _
\bo_
\bf_
\bf by
629 mail_badpass Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user if the user
630 running s
\bsu
\bud
\bdo
\bo does not enter the correct
631 password. This flag is _
\bo_
\bf_
\bf by default.
633 mail_no_host If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
634 user if the invoking user exists in the
635 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file, but is not allowed to run
636 commands on the current host. This flag
637 is _
\bo_
\bf_
\bf by default.
639 mail_no_perms If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
640 user if the invoking user is allowed to
641 use s
\bsu
\bud
\bdo
\bo but the command they are trying
642 is not listed in their _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file entry
643 or is explicitly denied. This flag is _
\bo_
\bf_
\bf
646 mail_no_user If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
647 user if the invoking user is not in the
648 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file. This flag is _
\bo_
\bn by default.
650 noexec If set, all commands run via s
\bsu
\bud
\bdo
\bo will
651 behave as if the NOEXEC tag has been set,
652 unless overridden by a EXEC tag. See the
653 description of _
\bN_
\bO_
\bE_
\bX_
\bE_
\bC _
\ba_
\bn_
\bd _
\bE_
\bX_
\bE_
\bC below as
654 well as the "PREVENTING SHELL ESCAPES"
658 1.6.9p8 November 2, 2007 10
664 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
667 section at the end of this manual. This
668 flag is _
\bo_
\bf_
\bf by default.
670 path_info Normally, s
\bsu
\bud
\bdo
\bo will tell the user when a
671 command could not be found in their PATH
672 environment variable. Some sites may wish
673 to disable this as it could be used to
674 gather information on the location of exe
675 cutables that the normal user does not
676 have access to. The disadvantage is that
677 if the executable is simply not in the
678 user's PATH, s
\bsu
\bud
\bdo
\bo will tell the user that
679 they are not allowed to run it, which can
680 be confusing. This flag is _
\bo_
\bn by default.
682 preserve_groups By default s
\bsu
\bud
\bdo
\bo will initialize the group
683 vector to the list of groups the target
684 user is in. When _
\bp_
\br_
\be_
\bs_
\be_
\br_
\bv_
\be_
\b__
\bg_
\br_
\bo_
\bu_
\bp_
\bs is set,
685 the user's existing group vector is left
686 unaltered. The real and effective group
687 IDs, however, are still set to match the
688 target user. This flag is _
\bo_
\bf_
\bf by default.
690 requiretty If set, s
\bsu
\bud
\bdo
\bo will only run when the user
691 is logged in to a real tty. This will
692 disallow things like "rsh somehost sudo
693 ls" since _
\br_
\bs_
\bh(1) does not allocate a tty.
694 Because it is not possible to turn off
695 echo when there is no tty present, some
696 sites may wish to set this flag to prevent
697 a user from entering a visible password.
698 This flag is _
\bo_
\bf_
\bf by default.
700 root_sudo If set, root is allowed to run s
\bsu
\bud
\bdo
\bo too.
701 Disabling this prevents users from "chain
702 ing" s
\bsu
\bud
\bdo
\bo commands to get a root shell by
703 doing something like "sudo sudo /bin/sh".
704 Note, however, that turning off _
\br_
\bo_
\bo_
\bt_
\b__
\bs_
\bu_
\bd_
\bo
705 will also prevent root and from running
706 s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt. Disabling _
\br_
\bo_
\bo_
\bt_
\b__
\bs_
\bu_
\bd_
\bo provides no
707 real additional security; it exists purely
708 for historical reasons. This flag is _
\bo_
\bn
711 rootpw If set, s
\bsu
\bud
\bdo
\bo will prompt for the root
712 password instead of the password of the
713 invoking user. This flag is _
\bo_
\bf_
\bf by
716 runaspw If set, s
\bsu
\bud
\bdo
\bo will prompt for the password
717 of the user defined by the _
\br_
\bu_
\bn_
\ba_
\bs_
\b__
\bd_
\be_
\bf_
\ba_
\bu_
\bl_
\bt
718 option (defaults to root) instead of the
719 password of the invoking user. This flag
720 is _
\bo_
\bf_
\bf by default.
724 1.6.9p8 November 2, 2007 11
730 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
733 set_home If set and s
\bsu
\bud
\bdo
\bo is invoked with the -
\b-s
\bs
734 flag the HOME environment variable will be
735 set to the home directory of the target
736 user (which is root unless the -
\b-u
\bu option
737 is used). This effectively makes the -
\b-s
\bs
738 flag imply -
\b-H
\bH. This flag is _
\bo_
\bf_
\bf by
741 set_logname Normally, s
\bsu
\bud
\bdo
\bo will set the LOGNAME, USER
742 and USERNAME environment variables to the
743 name of the target user (usually root
744 unless the -
\b-u
\bu flag is given). However,
745 since some programs (including the RCS
746 revision control system) use LOGNAME to
747 determine the real identity of the user,
748 it may be desirable to change this behav
749 ior. This can be done by negating the
750 set_logname option. Note that if the
751 _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt option has not been disabled,
752 entries in the _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp list will override
753 the value of _
\bs_
\be_
\bt_
\b__
\bl_
\bo_
\bg_
\bn_
\ba_
\bm_
\be. This flag is
754 _
\bo_
\bf_
\bf by default.
756 setenv Allow the user to disable the _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt
757 option from the command line. Addition
758 ally, environment variables set via the
759 command line are not subject to the
760 restrictions imposed by _
\be_
\bn_
\bv_
\b__
\bc_
\bh_
\be_
\bc_
\bk,
761 _
\be_
\bn_
\bv_
\b__
\bd_
\be_
\bl_
\be_
\bt_
\be, or _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp. As such, only
762 trusted users should be allowed to set
763 variables in this manner. This flag is
764 _
\bo_
\bf_
\bf by default.
766 shell_noargs If set and s
\bsu
\bud
\bdo
\bo is invoked with no argu
767 ments it acts as if the -
\b-s
\bs flag had been
768 given. That is, it runs a shell as root
769 (the shell is determined by the SHELL
770 environment variable if it is set, falling
771 back on the shell listed in the invoking
772 user's /etc/passwd entry if not). This
773 flag is _
\bo_
\bf_
\bf by default.
775 stay_setuid Normally, when s
\bsu
\bud
\bdo
\bo executes a command the
776 real and effective UIDs are set to the
777 target user (root by default). This
778 option changes that behavior such that the
779 real UID is left as the invoking user's
780 UID. In other words, this makes s
\bsu
\bud
\bdo
\bo act
781 as a setuid wrapper. This can be useful
782 on systems that disable some potentially
783 dangerous functionality when a program is
784 run setuid. This option is only effective
785 on systems with either the _
\bs_
\be_
\bt_
\br_
\be_
\bu_
\bi_
\bd_
\b(_
\b) or
786 _
\bs_
\be_
\bt_
\br_
\be_
\bs_
\bu_
\bi_
\bd_
\b(_
\b) function. This flag is _
\bo_
\bf_
\bf by
790 1.6.9p8 November 2, 2007 12
796 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
801 targetpw If set, s
\bsu
\bud
\bdo
\bo will prompt for the password
802 of the user specified by the -
\b-u
\bu flag
803 (defaults to root) instead of the password
804 of the invoking user. Note that this pre
805 cludes the use of a uid not listed in the
806 passwd database as an argument to the -
\b-u
\bu
807 flag. This flag is _
\bo_
\bf_
\bf by default.
809 tty_tickets If set, users must authenticate on a per-
810 tty basis. Normally, s
\bsu
\bud
\bdo
\bo uses a direc
811 tory in the ticket dir with the same name
812 as the user running it. With this flag
813 enabled, s
\bsu
\bud
\bdo
\bo will use a file named for
814 the tty the user is logged in on in that
815 directory. This flag is _
\bo_
\bf_
\bf by default.
817 use_loginclass If set, s
\bsu
\bud
\bdo
\bo will apply the defaults spec
818 ified for the target user's login class if
819 one exists. Only available if s
\bsu
\bud
\bdo
\bo is
820 configured with the --with-logincap
821 option. This flag is _
\bo_
\bf_
\bf by default.
823 I
\bIn
\bnt
\bte
\beg
\bge
\ber
\brs
\bs:
825 passwd_tries The number of tries a user gets to enter
826 his/her password before s
\bsu
\bud
\bdo
\bo logs the
827 failure and exits. The default is 3.
829 I
\bIn
\bnt
\bte
\beg
\bge
\ber
\brs
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
831 loglinelen Number of characters per line for the file
832 log. This value is used to decide when to
833 wrap lines for nicer log files. This has
834 no effect on the syslog log file, only the
835 file log. The default is 80 (use 0 or
836 negate the option to disable word wrap).
838 passwd_timeout Number of minutes before the s
\bsu
\bud
\bdo
\bo password
839 prompt times out. The default is 5; set
840 this to 0 for no password timeout.
843 Number of minutes that can elapse before
844 s
\bsu
\bud
\bdo
\bo will ask for a passwd again. The
845 default is 5. Set this to 0 to always
846 prompt for a password. If set to a value
847 less than 0 the user's timestamp will
848 never expire. This can be used to allow
849 users to create or delete their own times
850 tamps via sudo -v and sudo -k respec
856 1.6.9p8 November 2, 2007 13
862 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
865 umask Umask to use when running the command.
866 Negate this option or set it to 0777 to
867 preserve the user's umask. The default is
870 S
\bSt
\btr
\bri
\bin
\bng
\bgs
\bs:
872 badpass_message Message that is displayed if a user enters
873 an incorrect password. The default is
874 Sorry, try again. unless insults are
877 editor A colon (':') separated list of editors
878 allowed to be used with v
\bvi
\bis
\bsu
\bud
\bdo
\bo. v
\bvi
\bis
\bsu
\bud
\bdo
\bo
879 will choose the editor that matches the
880 user's EDITOR environment variable if pos
881 sible, or the first editor in the list
882 that exists and is executable. The
883 default is the path to vi on your system.
885 mailsub Subject of the mail sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
886 user. The escape %h will expand to the
887 hostname of the machine. Default is ***
888 SECURITY information for %h ***.
890 noexec_file Path to a shared library containing dummy
891 versions of the _
\be_
\bx_
\be_
\bc_
\bv_
\b(_
\b), _
\be_
\bx_
\be_
\bc_
\bv_
\be_
\b(_
\b) and _
\bf_
\be_
\bx_
\b
892 _
\be_
\bc_
\bv_
\be_
\b(_
\b) library functions that just return
893 an error. This is used to implement the
894 _
\bn_
\bo_
\be_
\bx_
\be_
\bc functionality on systems that sup
895 port LD_PRELOAD or its equivalent.
897 _
\b/_
\bu_
\bs_
\br_
\b/_
\bl_
\bo_
\bc_
\ba_
\bl_
\b/_
\bl_
\bi_
\bb_
\be_
\bx_
\be_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b__
\bn_
\bo_
\be_
\bx_
\be_
\bc_
\b._
\bs_
\bo.
899 passprompt The default prompt to use when asking for
900 a password; can be overridden via the -
\b-p
\bp
901 option or the SUDO_PROMPT environment
902 variable. The following percent (`%')
903 escapes are supported:
905 %H expanded to the local hostname includ
906 ing the domain name (on if the
907 machine's hostname is fully qualified
908 or the _
\bf_
\bq_
\bd_
\bn option is set)
910 %h expanded to the local hostname without
913 %U expanded to the login name of the user
914 the command will be run as (defaults
917 %u expanded to the invoking user's login
922 1.6.9p8 November 2, 2007 14
928 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
931 %% two consecutive % characters are col
932 lapsed into a single % character
934 The default value is Password:.
936 runas_default The default user to run commands as if the
937 -
\b-u
\bu flag is not specified on the command
938 line. This defaults to root. Note that
939 if _
\br_
\bu_
\bn_
\ba_
\bs_
\b__
\bd_
\be_
\bf_
\ba_
\bu_
\bl_
\bt is set it m
\bmu
\bus
\bst
\bt occur
940 before any Runas_Alias specifications.
942 syslog_badpri Syslog priority to use when user authenti
943 cates unsuccessfully. Defaults to alert.
945 syslog_goodpri Syslog priority to use when user authenti
946 cates successfully. Defaults to notice.
948 timestampdir The directory in which s
\bsu
\bud
\bdo
\bo stores its
949 timestamp files. The default is
950 _
\b/_
\bv_
\ba_
\br_
\b/_
\br_
\bu_
\bn_
\b/_
\bs_
\bu_
\bd_
\bo.
952 timestampowner The owner of the timestamp directory and
953 the timestamps stored therein. The
956 S
\bSt
\btr
\bri
\bin
\bng
\bgs
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
959 Users in this group are exempt from password
960 and PATH requirements. This is not set by
963 lecture This option controls when a short lecture will
964 be printed along with the password prompt. It
965 has the following possible values:
967 always Always lecture the user.
969 never Never lecture the user.
971 once Only lecture the user the first time
972 they run s
\bsu
\bud
\bdo
\bo.
974 If no value is specified, a value of _
\bo_
\bn_
\bc_
\be is
975 implied. Negating the option results in a
976 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
980 Path to a file containing an alternate s
\bsu
\bud
\bdo
\bo
981 lecture that will be used in place of the
982 standard lecture if the named file exists. By
983 default, s
\bsu
\bud
\bdo
\bo uses a built-in lecture.
988 1.6.9p8 November 2, 2007 15
994 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
997 listpw This option controls when a password will be
998 required when a user runs s
\bsu
\bud
\bdo
\bo with the -
\b-l
\bl
999 flag. It has the following possible values:
1001 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
1002 current host must have the NOPASSWD
1003 flag set to avoid entering a password.
1005 always The user must always enter a password
1006 to use the -
\b-l
\bl flag.
1008 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1009 entries for the current host must have
1010 the NOPASSWD flag set to avoid enter
1013 never The user need never enter a password
1014 to use the -
\b-l
\bl flag.
1016 If no value is specified, a value of _
\ba_
\bn_
\by is
1017 implied. Negating the option results in a
1018 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
1021 logfile Path to the s
\bsu
\bud
\bdo
\bo log file (not the syslog log
1022 file). Setting a path turns on logging to a
1023 file; negating this option turns it off. By
1024 default, s
\bsu
\bud
\bdo
\bo logs via syslog.
1026 mailerflags Flags to use when invoking mailer. Defaults to
1029 mailerpath Path to mail program used to send warning
1030 mail. Defaults to the path to sendmail found
1033 mailto Address to send warning and error mail to.
1034 The address should be enclosed in double
1035 quotes (") to protect against s
\bsu
\bud
\bdo
\bo interpret
1036 ing the @ sign. Defaults to root.
1038 syslog Syslog facility if syslog is being used for
1039 logging (negate to disable syslog logging).
1042 verifypw This option controls when a password will be
1043 required when a user runs s
\bsu
\bud
\bdo
\bo with the -
\b-v
\bv
1044 flag. It has the following possible values:
1046 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
1047 current host must have the NOPASSWD
1048 flag set to avoid entering a password.
1050 always The user must always enter a password
1054 1.6.9p8 November 2, 2007 16
1060 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1063 to use the -
\b-v
\bv flag.
1065 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1066 entries for the current host must have
1067 the NOPASSWD flag set to avoid enter
1070 never The user need never enter a password
1071 to use the -
\b-v
\bv flag.
1073 If no value is specified, a value of _
\ba_
\bl_
\bl is
1074 implied. Negating the option results in a
1075 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
1078 L
\bLi
\bis
\bst
\bts
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
1080 env_check Environment variables to be removed from
1081 the user's environment if the variable's
1082 value contains % or / characters. This
1083 can be used to guard against printf-style
1084 format vulnerabilities in poorly-written
1085 programs. The argument may be a dou
1086 ble-quoted, space-separated list or a sin
1087 gle value without double-quotes. The list
1088 can be replaced, added to, deleted from,
1089 or disabled by using the =, +=, -=, and !
1090 operators respectively. Regardless of
1091 whether the env_reset option is enabled or
1092 disabled, variables specified by env_check
1093 will be preserved in the environment if
1094 they pass the aforementioned check. The
1095 default list of environment variables to
1096 check is displayed when s
\bsu
\bud
\bdo
\bo is run by
1097 root with the _
\b-_
\bV option.
1099 env_delete Environment variables to be removed from
1100 the user's environment. The argument may
1101 be a double-quoted, space-separated list
1102 or a single value without double-quotes.
1103 The list can be replaced, added to,
1104 deleted from, or disabled by using the =,
1105 +=, -=, and ! operators respectively. The
1106 default list of environment variables to
1107 remove is displayed when s
\bsu
\bud
\bdo
\bo is run by
1108 root with the _
\b-_
\bV option. Note that many
1109 operating systems will remove potentially
1110 dangerous variables from the environment
1111 of any setuid process (such as s
\bsu
\bud
\bdo
\bo).
1113 env_keep Environment variables to be preserved in
1114 the user's environment when the _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt
1115 option is in effect. This allows fine-
1116 grained control over the environment
1120 1.6.9p8 November 2, 2007 17
1126 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1129 s
\bsu
\bud
\bdo
\bo-spawned processes will receive. The
1130 argument may be a double-quoted, space-
1131 separated list or a single value without
1132 double-quotes. The list can be replaced,
1133 added to, deleted from, or disabled by
1134 using the =, +=, -=, and ! operators
1135 respectively. The default list of vari
1136 ables to keep is displayed when s
\bsu
\bud
\bdo
\bo is
1137 run by root with the _
\b-_
\bV option.
1139 When logging via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3), s
\bsu
\bud
\bdo
\bo accepts the following
1140 values for the syslog facility (the value of the s
\bsy
\bys
\bsl
\blo
\bog
\bg
1141 Parameter): a
\bau
\but
\bth
\bhp
\bpr
\bri
\biv
\bv (if your OS supports it), a
\bau
\but
\bth
\bh, d
\bda
\bae
\be
\b
1142 m
\bmo
\bon
\bn, u
\bus
\bse
\ber
\br, l
\blo
\boc
\bca
\bal
\bl0
\b0, l
\blo
\boc
\bca
\bal
\bl1
\b1, l
\blo
\boc
\bca
\bal
\bl2
\b2, l
\blo
\boc
\bca
\bal
\bl3
\b3, l
\blo
\boc
\bca
\bal
\bl4
\b4, l
\blo
\boc
\bca
\bal
\bl5
\b5,
1143 l
\blo
\boc
\bca
\bal
\bl6
\b6, and l
\blo
\boc
\bca
\bal
\bl7
\b7. The following syslog priorities are
1144 supported: a
\bal
\ble
\ber
\brt
\bt, c
\bcr
\bri
\bit
\bt, d
\bde
\beb
\bbu
\bug
\bg, e
\bem
\bme
\ber
\brg
\bg, e
\ber
\brr
\br, i
\bin
\bnf
\bfo
\bo, n
\bno
\bot
\bti
\bic
\bce
\be,
1145 and w
\bwa
\bar
\brn
\bni
\bin
\bng
\bg.
1147 F
\bFI
\bIL
\bLE
\bES
\bS
1148 _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs List of who can run what
1149 _
\b/_
\be_
\bt_
\bc_
\b/_
\bg_
\br_
\bo_
\bu_
\bp Local groups file
1150 _
\b/_
\be_
\bt_
\bc_
\b/_
\bn_
\be_
\bt_
\bg_
\br_
\bo_
\bu_
\bp List of network groups
1152 E
\bEX
\bXA
\bAM
\bMP
\bPL
\bLE
\bES
\bS
1153 Since the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is parsed in a single pass, order
1154 is important. In general, you should structure _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1155 such that the Host_Alias, User_Alias, and Cmnd_Alias spec
1156 ifications come first, followed by any Default_Entry
1157 lines, and finally the Runas_Alias and user specifica
1158 tions. The basic rule of thumb is you cannot reference an
1159 Alias that has not already been defined.
1161 Below are example _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries. Admittedly, some of
1162 these are a bit contrived. First, we define our _
\ba_
\bl_
\bi_
\ba_
\bs_
\be_
\bs:
1164 # User alias specification
1165 User_Alias FULLTIMERS = millert, mikef, dowdy
1166 User_Alias PARTTIMERS = bostley, jwfox, crawl
1167 User_Alias WEBMASTERS = will, wendy, wim
1169 # Runas alias specification
1170 Runas_Alias OP = root, operator
1171 Runas_Alias DB = oracle, sybase
1173 # Host alias specification
1174 Host_Alias SPARC = bigtime, eclipse, moet, anchor :\
1175 SGI = grolsch, dandelion, black :\
1176 ALPHA = widget, thalamus, foobar :\
1177 HPPA = boa, nag, python
1178 Host_Alias CUNETS = 128.138.0.0/255.255.0.0
1179 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
1180 Host_Alias SERVERS = master, mail, www, ns
1181 Host_Alias CDROM = orion, perseus, hercules
1186 1.6.9p8 November 2, 2007 18
1192 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1195 # Cmnd alias specification
1196 Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
1197 /usr/sbin/restore, /usr/sbin/rrestore
1198 Cmnd_Alias KILL = /usr/bin/kill
1199 Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
1200 Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
1201 Cmnd_Alias HALT = /usr/sbin/halt
1202 Cmnd_Alias REBOOT = /usr/sbin/reboot
1203 Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
1204 /usr/local/bin/tcsh, /usr/bin/rsh, \
1206 Cmnd_Alias SU = /usr/bin/su
1207 Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
1209 Here we override some of the compiled in default values.
1210 We want s
\bsu
\bud
\bdo
\bo to log via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3) using the _
\ba_
\bu_
\bt_
\bh facility
1211 in all cases. We don't want to subject the full time
1212 staff to the s
\bsu
\bud
\bdo
\bo lecture, user m
\bmi
\bil
\bll
\ble
\ber
\brt
\bt need not give a
1213 password, and we don't want to reset the LOGNAME, USER or
1214 USERNAME environment variables when running commands as
1215 root. Additionally, on the machines in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS
1216 Host_Alias, we keep an additional local log file and make
1217 sure we log the year in each log line since the log
1218 entries will be kept around for several years. Lastly, we
1219 disable shell escapes for the commands in the PAGERS
1220 Cmnd_Alias (_
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be, _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bp_
\bg and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\be_
\bs_
\bs).
1222 # Override built-in defaults
1223 Defaults syslog=auth
1224 Defaults>root !set_logname
1225 Defaults:FULLTIMERS !lecture
1226 Defaults:millert !authenticate
1227 Defaults@SERVERS log_year, logfile=/var/log/sudo.log
1228 Defaults!PAGERS noexec
1230 The _
\bU_
\bs_
\be_
\br _
\bs_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn is the part that actually deter
1231 mines who may run what.
1233 root ALL = (ALL) ALL
1234 %wheel ALL = (ALL) ALL
1236 We let r
\bro
\boo
\bot
\bt and any user in group w
\bwh
\bhe
\bee
\bel
\bl run any command on
1237 any host as any user.
1239 FULLTIMERS ALL = NOPASSWD: ALL
1241 Full time sysadmins (m
\bmi
\bil
\bll
\ble
\ber
\brt
\bt, m
\bmi
\bik
\bke
\bef
\bf, and d
\bdo
\bow
\bwd
\bdy
\by) may run
1242 any command on any host without authenticating themselves.
1244 PARTTIMERS ALL = ALL
1246 Part time sysadmins (b
\bbo
\bos
\bst
\btl
\ble
\bey
\by, j
\bjw
\bwf
\bfo
\box
\bx, and c
\bcr
\bra
\baw
\bwl
\bl) may run
1247 any command on any host but they must authenticate them
1248 selves first (since the entry lacks the NOPASSWD tag).
1252 1.6.9p8 November 2, 2007 19
1258 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1263 The user j
\bja
\bac
\bck
\bk may run any command on the machines in the
1264 _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS alias (the networks 128.138.243.0, 128.138.204.0,
1265 and 128.138.242.0). Of those networks, only 128.138.204.0
1266 has an explicit netmask (in CIDR notation) indicating it
1267 is a class C network. For the other networks in _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS,
1268 the local machine's netmask will be used during matching.
1272 The user l
\bli
\bis
\bsa
\ba may run any command on any host in the
1273 _
\bC_
\bU_
\bN_
\bE_
\bT_
\bS alias (the class B network 128.138.0.0).
1275 operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
1276 sudoedit /etc/printcap, /usr/oper/bin/
1278 The o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br user may run commands limited to simple main
1279 tenance. Here, those are commands related to backups,
1280 killing processes, the printing system, shutting down the
1281 system, and any commands in the directory _
\b/_
\bu_
\bs_
\br_
\b/_
\bo_
\bp_
\be_
\br_
\b/_
\bb_
\bi_
\bn_
\b/.
1283 joe ALL = /usr/bin/su operator
1285 The user j
\bjo
\boe
\be may only _
\bs_
\bu(1) to operator.
1287 pete HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root
1289 The user p
\bpe
\bet
\bte
\be is allowed to change anyone's password
1290 except for root on the _
\bH_
\bP_
\bP_
\bA machines. Note that this
1291 assumes _
\bp_
\ba_
\bs_
\bs_
\bw_
\bd(1) does not take multiple usernames on the
1294 bob SPARC = (OP) ALL : SGI = (OP) ALL
1296 The user b
\bbo
\bob
\bb may run anything on the _
\bS_
\bP_
\bA_
\bR_
\bC and _
\bS_
\bG_
\bI
1297 machines as any user listed in the _
\bO_
\bP Runas_Alias (r
\bro
\boo
\bot
\bt
1298 and o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br).
1302 The user j
\bji
\bim
\bm may run any command on machines in the _
\bb_
\bi_
\bg_
\bl_
\ba_
\bb
1303 netgroup. s
\bsu
\bud
\bdo
\bo knows that "biglab" is a netgroup due to
1306 +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
1308 Users in the s
\bse
\bec
\bcr
\bre
\bet
\bta
\bar
\bri
\bie
\bes
\bs netgroup need to help manage the
1309 printers as well as add and remove users, so they are
1310 allowed to run those commands on all machines.
1312 fred ALL = (DB) NOPASSWD: ALL
1314 The user f
\bfr
\bre
\bed
\bd can run commands as any user in the _
\bD_
\bB
1318 1.6.9p8 November 2, 2007 20
1324 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1327 Runas_Alias (o
\bor
\bra
\bac
\bcl
\ble
\be or s
\bsy
\byb
\bba
\bas
\bse
\be) without giving a password.
1329 john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
1331 On the _
\bA_
\bL_
\bP_
\bH_
\bA machines, user j
\bjo
\boh
\bhn
\bn may su to anyone except
1332 root but he is not allowed to give _
\bs_
\bu(1) any flags.
1334 jen ALL, !SERVERS = ALL
1336 The user j
\bje
\ben
\bn may run any command on any machine except for
1337 those in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias (master, mail, www and
1340 jill SERVERS = /usr/bin/, !SU, !SHELLS
1342 For any machine in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias, j
\bji
\bil
\bll
\bl may run
1343 any commands in the directory _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/ except for those
1344 commands belonging to the _
\bS_
\bU and _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS Cmnd_Aliases.
1346 steve CSNETS = (operator) /usr/local/op_commands/
1348 The user s
\bst
\bte
\bev
\bve
\be may run any command in the directory
1349 /usr/local/op_commands/ but only as user operator.
1351 matt valkyrie = KILL
1353 On his personal workstation, valkyrie, m
\bma
\bat
\btt
\bt needs to be
1354 able to kill hung processes.
1356 WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
1358 On the host www, any user in the _
\bW_
\bE_
\bB_
\bM_
\bA_
\bS_
\bT_
\bE_
\bR_
\bS User_Alias
1359 (will, wendy, and wim), may run any command as user www
1360 (which owns the web pages) or simply _
\bs_
\bu(1) to www.
1362 ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\
1363 /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
1365 Any user may mount or unmount a CD-ROM on the machines in
1366 the CDROM Host_Alias (orion, perseus, hercules) without
1367 entering a password. This is a bit tedious for users to
1368 type, so it is a prime candidate for encapsulating in a
1371 S
\bSE
\bEC
\bCU
\bUR
\bRI
\bIT
\bTY
\bY N
\bNO
\bOT
\bTE
\bES
\bS
1372 It is generally not effective to "subtract" commands from
1373 ALL using the '!' operator. A user can trivially circum
1374 vent this by copying the desired command to a different
1375 name and then executing that. For example:
1377 bill ALL = ALL, !SU, !SHELLS
1379 Doesn't really prevent b
\bbi
\bil
\bll
\bl from running the commands
1380 listed in _
\bS_
\bU or _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS since he can simply copy those
1384 1.6.9p8 November 2, 2007 21
1390 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1393 commands to a different name, or use a shell escape from
1394 an editor or other program. Therefore, these kind of
1395 restrictions should be considered advisory at best (and
1396 reinforced by policy).
1398 P
\bPR
\bRE
\bEV
\bVE
\bEN
\bNT
\bTI
\bIN
\bNG
\bG S
\bSH
\bHE
\bEL
\bLL
\bL E
\bES
\bSC
\bCA
\bAP
\bPE
\bES
\bS
1399 Once s
\bsu
\bud
\bdo
\bo executes a program, that program is free to do
1400 whatever it pleases, including run other programs. This
1401 can be a security issue since it is not uncommon for a
1402 program to allow shell escapes, which lets a user bypass
1403 s
\bsu
\bud
\bdo
\bo's access control and logging. Common programs that
1404 permit shell escapes include shells (obviously), editors,
1405 paginators, mail and terminal programs.
1407 There are two basic approaches to this problem:
1409 restrict Avoid giving users access to commands that allow
1410 the user to run arbitrary commands. Many edi
1411 tors have a restricted mode where shell escapes
1412 are disabled, though s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt is a better solu
1413 tion to running editors via s
\bsu
\bud
\bdo
\bo. Due to the
1414 large number of programs that offer shell
1415 escapes, restricting users to the set of pro
1416 grams that do not if often unworkable.
1418 noexec Many systems that support shared libraries have
1419 the ability to override default library func
1420 tions by pointing an environment variable (usu
1421 ally LD_PRELOAD) to an alternate shared library.
1422 On such systems, s
\bsu
\bud
\bdo
\bo's _
\bn_
\bo_
\be_
\bx_
\be_
\bc functionality can
1423 be used to prevent a program run by s
\bsu
\bud
\bdo
\bo from
1424 executing any other programs. Note, however,
1425 that this applies only to native dynamically-
1426 linked executables. Statically-linked executa
1427 bles and foreign executables running under
1428 binary emulation are not affected.
1430 To tell whether or not s
\bsu
\bud
\bdo
\bo supports _
\bn_
\bo_
\be_
\bx_
\be_
\bc, you
1431 can run the following as root:
1433 sudo -V | grep "dummy exec"
1435 If the resulting output contains a line that
1438 File containing dummy exec functions:
1440 then s
\bsu
\bud
\bdo
\bo may be able to replace the exec family
1441 of functions in the standard library with its
1442 own that simply return an error. Unfortunately,
1443 there is no foolproof way to know whether or not
1444 _
\bn_
\bo_
\be_
\bx_
\be_
\bc will work at compile-time. _
\bn_
\bo_
\be_
\bx_
\be_
\bc should
1445 work on SunOS, Solaris, *BSD, Linux, IRIX, Tru64
1446 UNIX, MacOS X, and HP-UX 11.x. It is known n
\bno
\bot
\bt
1450 1.6.9p8 November 2, 2007 22
1456 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1459 to work on AIX and UnixWare. _
\bn_
\bo_
\be_
\bx_
\be_
\bc is expected
1460 to work on most operating systems that support
1461 the LD_PRELOAD environment variable. Check your
1462 operating system's manual pages for the dynamic
1463 linker (usually ld.so, ld.so.1, dyld, dld.sl,
1464 rld, or loader) to see if LD_PRELOAD is sup
1467 To enable _
\bn_
\bo_
\be_
\bx_
\be_
\bc for a command, use the NOEXEC
1468 tag as documented in the User Specification sec
1469 tion above. Here is that example again:
1471 aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
1473 This allows user a
\baa
\bar
\bro
\bon
\bn to run _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be and
1474 _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bv_
\bi with _
\bn_
\bo_
\be_
\bx_
\be_
\bc enabled. This will pre
1475 vent those two commands from executing other
1476 commands (such as a shell). If you are unsure
1477 whether or not your system is capable of sup
1478 porting _
\bn_
\bo_
\be_
\bx_
\be_
\bc you can always just try it out
1479 and see if it works.
1481 Note that restricting shell escapes is not a panacea.
1482 Programs running as root are still capable of many poten
1483 tially hazardous operations (such as changing or overwrit
1484 ing files) that could lead to unintended privilege escala
1485 tion. In the specific case of an editor, a safer approach
1486 is to give the user permission to run s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt.
1488 S
\bSE
\bEE
\bE A
\bAL
\bLS
\bSO
\bO
1489 _
\br_
\bs_
\bh(1), _
\bs_
\bu(1), _
\bf_
\bn_
\bm_
\ba_
\bt_
\bc_
\bh(3), _
\bs_
\bu_
\bd_
\bo(1m), _
\bv_
\bi_
\bs_
\bu_
\bd_
\bo(8)
1491 C
\bCA
\bAV
\bVE
\bEA
\bAT
\bTS
\bS
1492 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file should a
\bal
\blw
\bwa
\bay
\bys
\bs be edited by the v
\bvi
\bis
\bsu
\bud
\bdo
\bo
1493 command which locks the file and does grammatical check
1494 ing. It is imperative that _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs be free of syntax
1495 errors since s
\bsu
\bud
\bdo
\bo will not run with a syntactically incor
1496 rect _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file.
1498 When using netgroups of machines (as opposed to users), if
1499 you store fully qualified hostnames in the netgroup (as is
1500 usually the case), you either need to have the machine's
1501 hostname be fully qualified as returned by the hostname
1502 command or use the _
\bf_
\bq_
\bd_
\bn option in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs.
1505 If you feel you have found a bug in s
\bsu
\bud
\bdo
\bo, please submit a
1506 bug report at http://www.sudo.ws/sudo/bugs/
1508 S
\bSU
\bUP
\bPP
\bPO
\bOR
\bRT
\bT
1509 Limited free support is available via the sudo-users mail
1510 ing list, see http://www.sudo.ws/mail
1511 man/listinfo/sudo-users to subscribe or search the
1516 1.6.9p8 November 2, 2007 23
1522 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1525 D
\bDI
\bIS
\bSC
\bCL
\bLA
\bAI
\bIM
\bME
\bER
\bR
1526 s
\bsu
\bud
\bdo
\bo is provided ``AS IS'' and any express or implied war
1527 ranties, including, but not limited to, the implied war
1528 ranties of merchantability and fitness for a particular
1529 purpose are disclaimed. See the LICENSE file distributed
1530 with s
\bsu
\bud
\bdo
\bo or http://www.sudo.ws/sudo/license.html for com
1582 1.6.9p8 November 2, 2007 24