4 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
8 sudoers - list of which users may execute what
10 D
\bDE
\bES
\bSC
\bCR
\bRI
\bIP
\bPT
\bTI
\bIO
\bON
\bN
11 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is composed of two types of entries:
12 aliases (basically variables) and user specifications
13 (which specify who may run what).
15 When multiple entries match for a user, they are applied
16 in order. Where there are conflicting values, the last
17 match is used (which is not necessarily the most specific
20 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs grammar will be described below in Extended
21 Backus-Naur Form (EBNF). Don't despair if you don't know
22 what EBNF is; it is fairly simple, and the definitions
25 Q
\bQu
\bui
\bic
\bck
\bk g
\bgu
\bui
\bid
\bde
\be t
\bto
\bo E
\bEB
\bBN
\bNF
\bF
27 EBNF is a concise and exact way of describing the grammar
28 of a language. Each EBNF definition is made up of _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\b
29 _
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be_
\bs. E.g.,
31 symbol ::= definition | alternate1 | alternate2 ...
33 Each _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be references others and thus makes up a
34 grammar for the language. EBNF also contains the follow
35 ing operators, which many readers will recognize from reg
36 ular expressions. Do not, however, confuse them with
37 "wildcard" characters, which have different meanings.
39 ? Means that the preceding symbol (or group of sym
40 bols) is optional. That is, it may appear once or
43 * Means that the preceding symbol (or group of sym
44 bols) may appear zero or more times.
46 + Means that the preceding symbol (or group of sym
47 bols) may appear one or more times.
49 Parentheses may be used to group symbols together. For
50 clarity, we will use single quotes ('') to designate what
51 is a verbatim character string (as opposed to a symbol
54 A
\bAl
\bli
\bia
\bas
\bse
\bes
\bs
56 There are four kinds of aliases: User_Alias, Runas_Alias,
57 Host_Alias and Cmnd_Alias.
64 1.6.8p9 June, 20 2005 1
70 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
73 Alias ::= 'User_Alias' User_Alias (':' User_Alias)* |
74 'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
75 'Host_Alias' Host_Alias (':' Host_Alias)* |
76 'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)*
78 User_Alias ::= NAME '=' User_List
80 Runas_Alias ::= NAME '=' Runas_List
82 Host_Alias ::= NAME '=' Host_List
84 Cmnd_Alias ::= NAME '=' Cmnd_List
86 NAME ::= [A-Z]([A-Z][0-9]_)*
88 Each _
\ba_
\bl_
\bi_
\ba_
\bs definition is of the form
90 Alias_Type NAME = item1, item2, ...
92 where _
\bA_
\bl_
\bi_
\ba_
\bs_
\b__
\bT_
\by_
\bp_
\be is one of User_Alias, Runas_Alias,
93 Host_Alias, or Cmnd_Alias. A NAME is a string of upper
94 case letters, numbers, and underscore characters ('_'). A
95 NAME m
\bmu
\bus
\bst
\bt start with an uppercase letter. It is possible
96 to put several alias definitions of the same type on a
97 single line, joined by a colon (':'). E.g.,
99 Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
101 The definitions of what constitutes a valid _
\ba_
\bl_
\bi_
\ba_
\bs member
107 User ::= '!'* username |
112 A User_List is made up of one or more usernames, system
113 groups (prefixed with '%'), netgroups (prefixed with '+')
114 and other aliases. Each list item may be prefixed with
115 one or more '!' operators. An odd number of '!' operators
116 negate the value of the item; an even number just cancel
119 Runas_List ::= Runas_User |
120 Runas_User ',' Runas_List
122 Runas_User ::= '!'* username |
130 1.6.8p9 June, 20 2005 2
136 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
139 A Runas_List is similar to a User_List except that it can
140 also contain uids (prefixed with '#') and instead of
141 User_Aliases it can contain Runas_Aliases. Note that
142 usernames and groups are matched as strings. In other
143 words, two users (groups) with the same uid (gid) are con
144 sidered to be distinct. If you wish to match all user
145 names with the same uid (e.g. root and toor), you can use
146 a uid instead (#0 in the example given).
151 Host ::= '!'* hostname |
153 '!'* network(/netmask)? |
157 A Host_List is made up of one or more hostnames, IP
158 addresses, network numbers, netgroups (prefixed with '+')
159 and other aliases. Again, the value of an item may be
160 negated with the '!' operator. If you do not specify a
161 netmask with a network number, the netmask of the host's
162 ethernet interface(s) will be used when matching. The
163 netmask may be specified either in dotted quad notation
164 (e.g. 255.255.255.0) or CIDR notation (number of bits,
165 e.g. 24). A hostname may include shell-style wildcards
166 (see the Wildcards section below), but unless the hostname
167 command on your machine returns the fully qualified host
168 name, you'll need to use the _
\bf_
\bq_
\bd_
\bn option for wildcards to
174 commandname ::= filename |
178 Cmnd ::= '!'* commandname |
183 A Cmnd_List is a list of one or more commandnames, direc
184 tories, and other aliases. A commandname is a fully qual
185 ified filename which may include shell-style wildcards
186 (see the Wildcards section below). A simple filename
187 allows the user to run the command with any arguments
188 he/she wishes. However, you may also specify command line
189 arguments (including wildcards). Alternately, you can
190 specify "" to indicate that the command may only be run
191 w
\bwi
\bit
\bth
\bho
\bou
\but
\bt command line arguments. A directory is a fully
192 qualified pathname ending in a '/'. When you specify a
196 1.6.8p9 June, 20 2005 3
202 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
205 directory in a Cmnd_List, the user will be able to run any
206 file within that directory (but not in any subdirectories
209 If a Cmnd has associated command line arguments, then the
210 arguments in the Cmnd must match exactly those given by
211 the user on the command line (or match the wildcards if
212 there are any). Note that the following characters must
213 be escaped with a '\' if they are used in command argu
214 ments: ',', ':', '=', '\'. The special command "sudoedit"
215 is used to permit a user to run s
\bsu
\bud
\bdo
\bo with the -
\b-e
\be flag (or
216 as s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt). It may take command line arguments just as
217 a normal command does.
219 D
\bDe
\bef
\bfa
\bau
\bul
\blt
\bts
\bs
221 Certain configuration options may be changed from their
222 default values at runtime via one or more Default_Entry
223 lines. These may affect all users on any host, all users
224 on a specific host, a specific user, or commands being run
227 Default_Type ::= 'Defaults' |
228 'Defaults' '@' Host |
229 'Defaults' ':' User |
230 'Defaults' '>' RunasUser
232 Default_Entry ::= Default_Type Parameter_List
234 Parameter_List ::= Parameter |
235 Parameter ',' Parameter_List
237 Parameter ::= Parameter '=' Value |
238 Parameter '+=' Value |
239 Parameter '-=' Value |
242 Parameters may be f
\bfl
\bla
\bag
\bgs
\bs, i
\bin
\bnt
\bte
\beg
\bge
\ber
\br values, s
\bst
\btr
\bri
\bin
\bng
\bgs
\bs, or
243 l
\bli
\bis
\bst
\bts
\bs. Flags are implicitly boolean and can be turned off
244 via the '!' operator. Some integer, string and list
245 parameters may also be used in a boolean context to dis
246 able them. Values may be enclosed in double quotes (")
247 when they contain multiple words. Special characters may
248 be escaped with a backslash (\).
250 Lists have two additional assignment operators, += and -=.
251 These operators are used to add to and delete from a list
252 respectively. It is not an error to use the -= operator
253 to remove an element that does not exist in a list.
255 F
\bFl
\bla
\bag
\bgs
\bs:
258 When validating with a One Time Password
262 1.6.8p9 June, 20 2005 4
268 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
271 scheme (S
\bS/
\b/K
\bKe
\bey
\by or O
\bOP
\bPI
\bIE
\bE), a two-line prompt is
272 used to make it easier to cut and paste the
273 challenge to a local window. It's not as
274 pretty as the default but some people find it
275 more convenient. This flag is _
\bo_
\bf_
\bf by default.
277 ignore_dot If set, s
\bsu
\bud
\bdo
\bo will ignore '.' or '' (current
278 dir) in the PATH environment variable; the
279 PATH itself is not modified. This flag is _
\bo_
\bf_
\bf
280 by default. Currently, while it is possible
281 to set _
\bi_
\bg_
\bn_
\bo_
\br_
\be_
\b__
\bd_
\bo_
\bt in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs, its value is not
282 used. This option should be considered read-
283 only (it will be fixed in a future version of
286 mail_always Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user every time a
287 users runs s
\bsu
\bud
\bdo
\bo. This flag is _
\bo_
\bf_
\bf by default.
290 Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user if the user run
291 ning sudo does not enter the correct password.
292 This flag is _
\bo_
\bf_
\bf by default.
295 If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user
296 if the invoking user is not in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
297 file. This flag is _
\bo_
\bn by default.
300 If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user
301 if the invoking user exists in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
302 file, but is not allowed to run commands on
303 the current host. This flag is _
\bo_
\bf_
\bf by
307 If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user
308 if the invoking user is allowed to use s
\bsu
\bud
\bdo
\bo
309 but the command they are trying is not listed
310 in their _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file entry or is explicitly
311 denied. This flag is _
\bo_
\bf_
\bf by default.
313 tty_tickets If set, users must authenticate on a per-tty
314 basis. Normally, s
\bsu
\bud
\bdo
\bo uses a directory in the
315 ticket dir with the same name as the user run
316 ning it. With this flag enabled, s
\bsu
\bud
\bdo
\bo will
317 use a file named for the tty the user is
318 logged in on in that directory. This flag is
319 _
\bo_
\bf_
\bf by default.
322 If set, users must authenticate themselves via
323 a password (or other means of authentication)
324 before they may run commands. This default
328 1.6.8p9 June, 20 2005 5
334 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
337 may be overridden via the PASSWD and NOPASSWD
338 tags. This flag is _
\bo_
\bn by default.
340 root_sudo If set, root is allowed to run s
\bsu
\bud
\bdo
\bo too. Dis
341 abling this prevents users from "chaining"
342 s
\bsu
\bud
\bdo
\bo commands to get a root shell by doing
343 something like "sudo sudo /bin/sh". Note,
344 however, that turning off _
\br_
\bo_
\bo_
\bt_
\b__
\bs_
\bu_
\bd_
\bo will also
345 prevent root and from running s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt. Dis
346 abling _
\br_
\bo_
\bo_
\bt_
\b__
\bs_
\bu_
\bd_
\bo provides no real additional
347 security; it exists purely for historical rea
348 sons. This flag is _
\bo_
\bn by default.
350 log_host If set, the hostname will be logged in the
351 (non-syslog) s
\bsu
\bud
\bdo
\bo log file. This flag is _
\bo_
\bf_
\bf
354 log_year If set, the four-digit year will be logged in
355 the (non-syslog) s
\bsu
\bud
\bdo
\bo log file. This flag is
356 _
\bo_
\bf_
\bf by default.
359 If set and s
\bsu
\bud
\bdo
\bo is invoked with no arguments
360 it acts as if the -
\b-s
\bs flag had been given.
361 That is, it runs a shell as root (the shell is
362 determined by the SHELL environment variable
363 if it is set, falling back on the shell listed
364 in the invoking user's /etc/passwd entry if
365 not). This flag is _
\bo_
\bf_
\bf by default.
367 set_home If set and s
\bsu
\bud
\bdo
\bo is invoked with the -
\b-s
\bs flag
368 the HOME environment variable will be set to
369 the home directory of the target user (which
370 is root unless the -
\b-u
\bu option is used). This
371 effectively makes the -
\b-s
\bs flag imply -
\b-H
\bH. This
372 flag is _
\bo_
\bf_
\bf by default.
375 If set, s
\bsu
\bud
\bdo
\bo will set the HOME environment
376 variable to the home directory of the target
377 user (which is root unless the -
\b-u
\bu option is
378 used). This effectively means that the -
\b-H
\bH
379 flag is always implied. This flag is _
\bo_
\bf_
\bf by
382 path_info Normally, s
\bsu
\bud
\bdo
\bo will tell the user when a com
383 mand could not be found in their PATH environ
384 ment variable. Some sites may wish to disable
385 this as it could be used to gather information
386 on the location of executables that the normal
387 user does not have access to. The disadvan
388 tage is that if the executable is simply not
389 in the user's PATH, s
\bsu
\bud
\bdo
\bo will tell the user
390 that they are not allowed to run it, which can
394 1.6.8p9 June, 20 2005 6
400 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
403 be confusing. This flag is _
\bo_
\bf_
\bf by default.
406 By default s
\bsu
\bud
\bdo
\bo will initialize the group vec
407 tor to the list of groups the target user is
408 in. When _
\bp_
\br_
\be_
\bs_
\be_
\br_
\bv_
\be_
\b__
\bg_
\br_
\bo_
\bu_
\bp_
\bs is set, the user's
409 existing group vector is left unaltered. The
410 real and effective group IDs, however, are
411 still set to match the target user. This flag
412 is _
\bo_
\bf_
\bf by default.
414 fqdn Set this flag if you want to put fully quali
415 fied hostnames in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file. I.e.,
416 instead of myhost you would use myhost.mydo
417 main.edu. You may still use the short form if
418 you wish (and even mix the two). Beware that
419 turning on _
\bf_
\bq_
\bd_
\bn requires s
\bsu
\bud
\bdo
\bo to make DNS
420 lookups which may make s
\bsu
\bud
\bdo
\bo unusable if DNS
421 stops working (for example if the machine is
422 not plugged into the network). Also note that
423 you must use the host's official name as DNS
424 knows it. That is, you may not use a host
425 alias (CNAME entry) due to performance issues
426 and the fact that there is no way to get all
427 aliases from DNS. If your machine's hostname
428 (as returned by the hostname command) is
429 already fully qualified you shouldn't need to
430 set _
\bf_
\bq_
\bd_
\bn. This flag is _
\bo_
\bf_
\bf by default.
432 insults If set, s
\bsu
\bud
\bdo
\bo will insult users when they enter
433 an incorrect password. This flag is _
\bo_
\bf_
\bf by
436 requiretty If set, s
\bsu
\bud
\bdo
\bo will only run when the user is
437 logged in to a real tty. This will disallow
438 things like "rsh somehost sudo ls" since
439 _
\br_
\bs_
\bh(1) does not allocate a tty. Because it is
440 not possible to turn off echo when there is no
441 tty present, some sites may with to set this
442 flag to prevent a user from entering a visible
443 password. This flag is _
\bo_
\bf_
\bf by default.
445 env_editor If set, v
\bvi
\bis
\bsu
\bud
\bdo
\bo will use the value of the EDI
446 TOR or VISUAL environment variables before
447 falling back on the default editor list. Note
448 that this may create a security hole as it
449 allows the user to run any arbitrary command
450 as root without logging. A safer alternative
451 is to place a colon-separated list of editors
452 in the editor variable. v
\bvi
\bis
\bsu
\bud
\bdo
\bo will then only
453 use the EDITOR or VISUAL if they match a value
454 specified in editor. This flag is off by
460 1.6.8p9 June, 20 2005 7
466 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
469 rootpw If set, s
\bsu
\bud
\bdo
\bo will prompt for the root password
470 instead of the password of the invoking user.
471 This flag is _
\bo_
\bf_
\bf by default.
473 runaspw If set, s
\bsu
\bud
\bdo
\bo will prompt for the password of
474 the user defined by the _
\br_
\bu_
\bn_
\ba_
\bs_
\b__
\bd_
\be_
\bf_
\ba_
\bu_
\bl_
\bt option
475 (defaults to root) instead of the password of
476 the invoking user. This flag is _
\bo_
\bf_
\bf by
479 targetpw If set, s
\bsu
\bud
\bdo
\bo will prompt for the password of
480 the user specified by the -
\b-u
\bu flag (defaults to
481 root) instead of the password of the invoking
482 user. Note that this precludes the use of a
483 uid not listed in the passwd database as an
484 argument to the -
\b-u
\bu flag. This flag is _
\bo_
\bf_
\bf by
487 set_logname Normally, s
\bsu
\bud
\bdo
\bo will set the LOGNAME and USER
488 environment variables to the name of the tar
489 get user (usually root unless the -
\b-u
\bu flag is
490 given). However, since some programs (includ
491 ing the RCS revision control system) use LOG
492 NAME to determine the real identity of the
493 user, it may be desirable to change this
494 behavior. This can be done by negating the
497 stay_setuid Normally, when s
\bsu
\bud
\bdo
\bo executes a command the
498 real and effective UIDs are set to the target
499 user (root by default). This option changes
500 that behavior such that the real UID is left
501 as the invoking user's UID. In other words,
502 this makes s
\bsu
\bud
\bdo
\bo act as a setuid wrapper. This
503 can be useful on systems that disable some
504 potentially dangerous functionality when a
505 program is run setuid. Note, however, that
506 this means that sudo will run with the real
507 uid of the invoking user which may allow that
508 user to kill s
\bsu
\bud
\bdo
\bo before it can log a failure,
509 depending on how your OS defines the interac
510 tion between signals and setuid processes.
512 env_reset If set, s
\bsu
\bud
\bdo
\bo will reset the environment to
513 only contain the following variables: HOME,
514 LOGNAME, PATH, SHELL, TERM, and USER (in addi
515 tion to the SUDO_* variables). Of these, only
516 TERM is copied unaltered from the old environ
517 ment. The other variables are set to default
518 values (possibly modified by the value of the
519 _
\bs_
\be_
\bt_
\b__
\bl_
\bo_
\bg_
\bn_
\ba_
\bm_
\be option). If s
\bsu
\bud
\bdo
\bo was compiled
520 with the SECURE_PATH option, its value will be
521 used for the PATH environment variable. Other
522 variables may be preserved with the _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp
526 1.6.8p9 June, 20 2005 8
532 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
538 If set, s
\bsu
\bud
\bdo
\bo will apply the defaults specified
539 for the target user's login class if one
540 exists. Only available if s
\bsu
\bud
\bdo
\bo is configured
541 with the --with-logincap option. This flag is
542 _
\bo_
\bf_
\bf by default.
544 noexec If set, all commands run via sudo will behave
545 as if the NOEXEC tag has been set, unless
546 overridden by a EXEC tag. See the description
547 of _
\bN_
\bO_
\bE_
\bX_
\bE_
\bC _
\ba_
\bn_
\bd _
\bE_
\bX_
\bE_
\bC below as well as the "PRE
548 VENTING SHELL ESCAPES" section at the end of
549 this manual. This flag is _
\bo_
\bf_
\bf by default.
552 If set via LDAP, parsing of @sysconfdir@/sudo
553 ers will be skipped. This is intended for an
554 Enterprises that wish to prevent the usage of
555 local sudoers files so that only LDAP is used.
556 This thwarts the efforts of rogue operators
557 who would attempt to add roles to
558 @sysconfdir@/sudoers. When this option is
559 present, @sysconfdir@/sudoers does not even
560 need to exist. Since this options tells sudo
561 how to behave when no specific LDAP entries
562 have been matched, this sudoOption is only
563 meaningful for the cn=defaults section. This
564 flag is _
\bo_
\bf_
\bf by default.
566 I
\bIn
\bnt
\bte
\beg
\bge
\ber
\brs
\bs:
569 The number of tries a user gets to enter
570 his/her password before s
\bsu
\bud
\bdo
\bo logs the failure
571 and exits. The default is 3.
573 I
\bIn
\bnt
\bte
\beg
\bge
\ber
\brs
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
575 loglinelen Number of characters per line for the file
576 log. This value is used to decide when to
577 wrap lines for nicer log files. This has no
578 effect on the syslog log file, only the file
579 log. The default is 80 (use 0 or negate the
580 option to disable word wrap).
583 Number of minutes that can elapse before s
\bsu
\bud
\bdo
\bo
584 will ask for a passwd again. The default is
585 5. Set this to 0 to always prompt for a pass
586 word. If set to a value less than 0 the
587 user's timestamp will never expire. This can
588 be used to allow users to create or delete
592 1.6.8p9 June, 20 2005 9
598 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
601 their own timestamps via sudo -v and sudo -k
605 Number of minutes before the s
\bsu
\bud
\bdo
\bo password
606 prompt times out. The default is 5, set this
607 to 0 for no password timeout.
609 umask Umask to use when running the command. Negate
610 this option or set it to 0777 to preserve the
611 user's umask. The default is 0022.
613 S
\bSt
\btr
\bri
\bin
\bng
\bgs
\bs:
615 mailsub Subject of the mail sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user.
616 The escape %h will expand to the hostname of
617 the machine. Default is *** SECURITY informa
621 Message that is displayed if a user enters an
622 incorrect password. The default is Sorry, try
623 again. unless insults are enabled.
626 The directory in which s
\bsu
\bud
\bdo
\bo stores its times
627 tamp files. The default is _
\b/_
\bv_
\ba_
\br_
\b/_
\br_
\bu_
\bn_
\b/_
\bs_
\bu_
\bd_
\bo.
630 The owner of the timestamp directory and the
631 timestamps stored therein. The default is
634 passprompt The default prompt to use when asking for a
635 password; can be overridden via the -
\b-p
\bp option
636 or the SUDO_PROMPT environment variable. The
637 following percent (`%') escapes are supported:
639 %u expanded to the invoking user's login
642 %U expanded to the login name of the user
643 the command will be run as (defaults
646 %h expanded to the local hostname without
649 %H expanded to the local hostname includ
650 ing the domain name (on if the
651 machine's hostname is fully qualified
652 or the _
\bf_
\bq_
\bd_
\bn option is set)
654 %% two consecutive % characters are
658 1.6.8p9 June, 20 2005 10
664 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
667 collaped into a single % character
669 The default value is Password:.
672 The default user to run commands as if the -
\b-u
\bu
673 flag is not specified on the command line.
674 This defaults to root. Note that if
675 _
\br_
\bu_
\bn_
\ba_
\bs_
\b__
\bd_
\be_
\bf_
\ba_
\bu_
\bl_
\bt is set it m
\bmu
\bus
\bst
\bt occur before any
676 Runas_Alias specifications.
679 Syslog priority to use when user authenticates
680 successfully. Defaults to notice.
683 Syslog priority to use when user authenticates
684 unsuccessfully. Defaults to alert.
686 editor A colon (':') separated list of editors
687 allowed to be used with v
\bvi
\bis
\bsu
\bud
\bdo
\bo. v
\bvi
\bis
\bsu
\bud
\bdo
\bo will
688 choose the editor that matches the user's USER
689 environment variable if possible, or the first
690 editor in the list that exists and is exe
691 cutable. The default is the path to vi on
694 noexec_file Path to a shared library containing dummy ver
695 sions of the _
\be_
\bx_
\be_
\bc_
\bv_
\b(_
\b), _
\be_
\bx_
\be_
\bc_
\bv_
\be_
\b(_
\b) and _
\bf_
\be_
\bx_
\be_
\bc_
\bv_
\be_
\b(_
\b)
696 library functions that just return an error.
697 This is used to implement the _
\bn_
\bo_
\be_
\bx_
\be_
\bc function
698 ality on systems that support LD_PRELOAD or
699 its equivalent. Defaults to
700 _
\b/_
\bu_
\bs_
\br_
\b/_
\bl_
\bo_
\bc_
\ba_
\bl_
\b/_
\bl_
\bi_
\bb_
\be_
\bx_
\be_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b__
\bn_
\bo_
\be_
\bx_
\be_
\bc_
\b._
\bs_
\bo.
702 S
\bSt
\btr
\bri
\bin
\bng
\bgs
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
704 lecture This option controls when a short lecture will
705 be printed along with the password prompt. It
706 has the following possible values:
708 never Never lecture the user.
710 once Only lecture the user the first time
711 they run s
\bsu
\bud
\bdo
\bo.
713 always Always lecture the user.
715 If no value is specified, a value of _
\bo_
\bn_
\bc_
\be is
716 implied. Negating the option results in a
717 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
724 1.6.8p9 June, 20 2005 11
730 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
734 Path to a file containing an alternate sudo
735 lecture that will be used in place of the
736 standard lecture if the named file exists.
738 logfile Path to the s
\bsu
\bud
\bdo
\bo log file (not the syslog log
739 file). Setting a path turns on logging to a
740 file; negating this option turns it off.
742 syslog Syslog facility if syslog is being used for
743 logging (negate to disable syslog logging).
746 mailerpath Path to mail program used to send warning
747 mail. Defaults to the path to sendmail found
750 mailerflags Flags to use when invoking mailer. Defaults to
753 mailto Address to send warning and error mail to.
754 The address should be enclosed in double
755 quotes (") to protect against sudo interpret
756 ing the @ sign. Defaults to root.
759 Users in this group are exempt from password
760 and PATH requirements. This is not set by
763 verifypw This option controls when a password will be
764 required when a user runs s
\bsu
\bud
\bdo
\bo with the -
\b-v
\bv
765 flag. It has the following possible values:
767 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
768 current host must have the NOPASSWD
769 flag set to avoid entering a password.
771 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
772 entries for the current host must have
773 the NOPASSWD flag set to avoid enter
776 never The user need never enter a password
777 to use the -
\b-v
\bv flag.
779 always The user must always enter a password
780 to use the -
\b-v
\bv flag.
782 If no value is specified, a value of _
\ba_
\bl_
\bl is
783 implied. Negating the option results in a
784 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
790 1.6.8p9 June, 20 2005 12
796 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
799 listpw This option controls when a password will be
800 required when a user runs s
\bsu
\bud
\bdo
\bo with the -
\b-l
\bl
801 flag. It has the following possible values:
803 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
804 current host must have the NOPASSWD
805 flag set to avoid entering a password.
807 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
808 entries for the current host must have
809 the NOPASSWD flag set to avoid enter
812 never The user need never enter a password
813 to use the -
\b-l
\bl flag.
815 always The user must always enter a password
816 to use the -
\b-l
\bl flag.
818 If no value is specified, a value of _
\ba_
\bn_
\by is
819 implied. Negating the option results in a
820 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
823 L
\bLi
\bis
\bst
\bts
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
825 env_check Environment variables to be removed from the
826 user's environment if the variable's value
827 contains % or / characters. This can be used
828 to guard against printf-style format vulnera
829 bilities in poorly-written programs. The
830 argument may be a double-quoted, space-sepa
831 rated list or a single value without dou
832 ble-quotes. The list can be replaced, added
833 to, deleted from, or disabled by using the =,
834 +=, -=, and ! operators respectively. The
835 default list of environment variables to check
836 is printed when s
\bsu
\bud
\bdo
\bo is run by root with the
839 env_delete Environment variables to be removed from the
840 user's environment. The argument may be a
841 double-quoted, space-separated list or a sin
842 gle value without double-quotes. The list can
843 be replaced, added to, deleted from, or dis
844 abled by using the =, +=, -=, and ! operators
845 respectively. The default list of environment
846 variables to remove is printed when s
\bsu
\bud
\bdo
\bo is
847 run by root with the _
\b-_
\bV option. Note that
848 many operating systems will remove potentially
849 dangerous variables from the environment of
850 any setuid process (such as s
\bsu
\bud
\bdo
\bo).
852 env_keep Environment variables to be preserved in the
856 1.6.8p9 June, 20 2005 13
862 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
865 user's environment when the _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt option
866 is in effect. This allows fine-grained con
867 trol over the environment s
\bsu
\bud
\bdo
\bo-spawned pro
868 cesses will receive. The argument may be a
869 double-quoted, space-separated list or a sin
870 gle value without double-quotes. The list can
871 be replaced, added to, deleted from, or dis
872 abled by using the =, +=, -=, and ! operators
873 respectively. This list has no default mem
876 When logging via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3), s
\bsu
\bud
\bdo
\bo accepts the following
877 values for the syslog facility (the value of the s
\bsy
\bys
\bsl
\blo
\bog
\bg
878 Parameter): a
\bau
\but
\bth
\bhp
\bpr
\bri
\biv
\bv (if your OS supports it), a
\bau
\but
\bth
\bh, d
\bda
\bae
\be
\b
879 m
\bmo
\bon
\bn, u
\bus
\bse
\ber
\br, l
\blo
\boc
\bca
\bal
\bl0
\b0, l
\blo
\boc
\bca
\bal
\bl1
\b1, l
\blo
\boc
\bca
\bal
\bl2
\b2, l
\blo
\boc
\bca
\bal
\bl3
\b3, l
\blo
\boc
\bca
\bal
\bl4
\b4, l
\blo
\boc
\bca
\bal
\bl5
\b5,
880 l
\blo
\boc
\bca
\bal
\bl6
\b6, and l
\blo
\boc
\bca
\bal
\bl7
\b7. The following syslog priorities are
881 supported: a
\bal
\ble
\ber
\brt
\bt, c
\bcr
\bri
\bit
\bt, d
\bde
\beb
\bbu
\bug
\bg, e
\bem
\bme
\ber
\brg
\bg, e
\ber
\brr
\br, i
\bin
\bnf
\bfo
\bo, n
\bno
\bot
\bti
\bic
\bce
\be,
882 and w
\bwa
\bar
\brn
\bni
\bin
\bng
\bg.
884 U
\bUs
\bse
\ber
\br S
\bSp
\bpe
\bec
\bci
\bif
\bfi
\bic
\bca
\bat
\bti
\bio
\bon
\bn
886 User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
887 (':' Host_List '=' Cmnd_Spec_List)*
889 Cmnd_Spec_List ::= Cmnd_Spec |
890 Cmnd_Spec ',' Cmnd_Spec_List
892 Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
894 Runas_Spec ::= '(' Runas_List ')'
896 Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:')
898 A u
\bus
\bse
\ber
\br s
\bsp
\bpe
\bec
\bci
\bif
\bfi
\bic
\bca
\bat
\bti
\bio
\bon
\bn determines which commands a user may
899 run (and as what user) on specified hosts. By default,
900 commands are run as r
\bro
\boo
\bot
\bt, but this can be changed on a
903 Let's break that down into its constituent parts:
905 R
\bRu
\bun
\bna
\bas
\bs_
\b_S
\bSp
\bpe
\bec
\bc
907 A Runas_Spec is simply a Runas_List (as defined above)
908 enclosed in a set of parentheses. If you do not specify a
909 Runas_Spec in the user specification, a default Runas_Spec
910 of r
\bro
\boo
\bot
\bt will be used. A Runas_Spec sets the default for
911 commands that follow it. What this means is that for the
914 dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
916 The user d
\bdg
\bgb
\bb may run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm
917 -- but only as o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br. E.g.,
922 1.6.8p9 June, 20 2005 14
928 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
931 $ sudo -u operator /bin/ls.
933 It is also possible to override a Runas_Spec later on in
934 an entry. If we modify the entry like so:
936 dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
938 Then user d
\bdg
\bgb
\bb is now allowed to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs as o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br,
939 but _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as r
\bro
\boo
\bot
\bt.
941 T
\bTa
\bag
\bg_
\b_S
\bSp
\bpe
\bec
\bc
943 A command may have zero or more tags associated with it.
944 There are four possible tag values, NOPASSWD, PASSWD,
945 NOEXEC, EXEC. Once a tag is set on a Cmnd, subsequent
946 Cmnds in the Cmnd_Spec_List, inherit the tag unless it is
947 overridden by the opposite tag (ie: PASSWD overrides
948 NOPASSWD and EXEC overrides NOEXEC).
950 _
\bN_
\bO_
\bP_
\bA_
\bS_
\bS_
\bW_
\bD _
\ba_
\bn_
\bd _
\bP_
\bA_
\bS_
\bS_
\bW_
\bD
952 By default, s
\bsu
\bud
\bdo
\bo requires that a user authenticate him or
953 herself before running a command. This behavior can be
954 modified via the NOPASSWD tag. Like a Runas_Spec, the
955 NOPASSWD tag sets a default for the commands that follow
956 it in the Cmnd_Spec_List. Conversely, the PASSWD tag can
957 be used to reverse things. For example:
959 ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
961 would allow the user r
\bra
\bay
\by to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, and
962 _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as root on the machine rushmore as r
\bro
\boo
\bot
\bt
963 without authenticating himself. If we only want r
\bra
\bay
\by to be
964 able to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl without a password the entry would
967 ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
969 Note, however, that the PASSWD tag has no effect on users
970 who are in the group specified by the exempt_group option.
972 By default, if the NOPASSWD tag is applied to any of the
973 entries for a user on the current host, he or she will be
974 able to run sudo -l without a password. Additionally, a
975 user may only run sudo -v without a password if the
976 NOPASSWD tag is present for all a user's entries that per
977 tain to the current host. This behavior may be overridden
978 via the verifypw and listpw options.
980 _
\bN_
\bO_
\bE_
\bX_
\bE_
\bC _
\ba_
\bn_
\bd _
\bE_
\bX_
\bE_
\bC
982 If sudo has been compiled with _
\bn_
\bo_
\be_
\bx_
\be_
\bc support and the
983 underlying operating system support it, the NOEXEC tag can
984 be used to prevent a dynamically-linked executable from
988 1.6.8p9 June, 20 2005 15
994 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
997 running further commands itself.
999 In the following example, user a
\baa
\bar
\bro
\bon
\bn may run _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be
1000 and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bv_
\bi but shell escapes will be disabled.
1002 aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
1004 See the "PREVENTING SHELL ESCAPES" section below for more
1005 details on how _
\bn_
\bo_
\be_
\bx_
\be_
\bc works and whether or not it will
1006 work on your system.
1008 W
\bWi
\bil
\bld
\bdc
\bca
\bar
\brd
\bds
\bs
1010 s
\bsu
\bud
\bdo
\bo allows shell-style _
\bw_
\bi_
\bl_
\bd_
\bc_
\ba_
\br_
\bd_
\bs (aka meta or glob char
1011 acters) to be used in pathnames as well as command line
1012 arguments in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file. Wildcard matching is done
1013 via the P
\bPO
\bOS
\bSI
\bIX
\bX _
\bf_
\bn_
\bm_
\ba_
\bt_
\bc_
\bh(3) routine. Note that these are _
\bn_
\bo_
\bt
1014 regular expressions.
1016 * Matches any set of zero or more characters.
1018 ? Matches any single character.
1020 [...] Matches any character in the specified range.
1022 [!...] Matches any character n
\bno
\bot
\bt in the specified range.
1024 \x For any character "x", evaluates to "x". This is
1025 used to escape special characters such as: "*",
1028 Note that a forward slash ('/') will n
\bno
\bot
\bt be matched by
1029 wildcards used in the pathname. When matching the command
1030 line arguments, however, a slash d
\bdo
\boe
\bes
\bs get matched by wild
1031 cards. This is to make a path like:
1035 match _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bw_
\bh_
\bo but not _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bX_
\b1_
\b1_
\b/_
\bx_
\bt_
\be_
\br_
\bm.
1037 WARNING: a pathname with wildcards will n
\bno
\bot
\bt match a user
1038 command that consists of a relative path. In other words,
1039 given the following _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entry:
1041 billy workstation = /usr/bin/*
1043 user billy will be able to run any command in /usr/bin as
1044 root, such as _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bw. The following two command will
1045 be allowed (the first assumes that _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn is in the
1054 1.6.8p9 June, 20 2005 16
1060 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1063 However, this will not:
1068 For this reason you should only g
\bgr
\bra
\ban
\bnt
\bt access to commands
1069 using wildcards and never r
\bre
\bes
\bst
\btr
\bri
\bic
\bct
\bt access using them.
1070 This limitation will be removed in a future version of
1073 E
\bEx
\bxc
\bce
\bep
\bpt
\bti
\bio
\bon
\bns
\bs t
\bto
\bo w
\bwi
\bil
\bld
\bdc
\bca
\bar
\brd
\bd r
\bru
\bul
\ble
\bes
\bs
1075 The following exceptions apply to the above rules:
1077 "" If the empty string "" is the only command line
1078 argument in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entry it means that com
1079 mand is not allowed to be run with a
\ban
\bny
\by arguments.
1081 O
\bOt
\bth
\bhe
\ber
\br s
\bsp
\bpe
\bec
\bci
\bia
\bal
\bl c
\bch
\bha
\bar
\bra
\bac
\bct
\bte
\ber
\brs
\bs a
\ban
\bnd
\bd r
\bre
\bes
\bse
\ber
\brv
\bve
\bed
\bd w
\bwo
\bor
\brd
\bds
\bs
1083 The pound sign ('#') is used to indicate a comment (unless
1084 it occurs in the context of a user name and is followed by
1085 one or more digits, in which case it is treated as a uid).
1086 Both the comment character and any text after it, up to
1087 the end of the line, are ignored.
1089 The reserved word A
\bAL
\bLL
\bL is a built-in _
\ba_
\bl_
\bi_
\ba_
\bs that always
1090 causes a match to succeed. It can be used wherever one
1091 might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias,
1092 or Host_Alias. You should not try to define your own
1093 _
\ba_
\bl_
\bi_
\ba_
\bs called A
\bAL
\bLL
\bL as the built-in alias will be used in
1094 preference to your own. Please note that using A
\bAL
\bLL
\bL can be
1095 dangerous since in a command context, it allows the user
1096 to run a
\ban
\bny
\by command on the system.
1098 An exclamation point ('!') can be used as a logical _
\bn_
\bo_
\bt
1099 operator both in an _
\ba_
\bl_
\bi_
\ba_
\bs and in front of a Cmnd. This
1100 allows one to exclude certain values. Note, however, that
1101 using a ! in conjunction with the built-in ALL alias to
1102 allow a user to run "all but a few" commands rarely works
1103 as intended (see SECURITY NOTES below).
1105 Long lines can be continued with a backslash ('\') as the
1106 last character on the line.
1108 Whitespace between elements in a list as well as special
1109 syntactic characters in a _
\bU_
\bs_
\be_
\br _
\bS_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn ('=', ':',
1110 '(', ')') is optional.
1112 The following characters must be escaped with a backslash
1113 ('\') when used as part of a word (e.g. a username or
1114 hostname): '@', '!', '=', ':', ',', '(', ')', '\'.
1120 1.6.8p9 June, 20 2005 17
1126 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1129 F
\bFI
\bIL
\bLE
\bES
\bS
1130 /etc/sudoers List of who can run what
1131 /etc/group Local groups file
1132 /etc/netgroup List of network groups
1134 E
\bEX
\bXA
\bAM
\bMP
\bPL
\bLE
\bES
\bS
1135 Since the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is parsed in a single pass, order
1136 is important. In general, you should structure _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1137 such that the Host_Alias, User_Alias, and Cmnd_Alias spec
1138 ifications come first, followed by any Default_Entry
1139 lines, and finally the Runas_Alias and user specifica
1140 tions. The basic rule of thumb is you cannot reference an
1141 Alias that has not already been defined.
1143 Below are example _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries. Admittedly, some of
1144 these are a bit contrived. First, we define our _
\ba_
\bl_
\bi_
\ba_
\bs_
\be_
\bs:
1146 # User alias specification
1147 User_Alias FULLTIMERS = millert, mikef, dowdy
1148 User_Alias PARTTIMERS = bostley, jwfox, crawl
1149 User_Alias WEBMASTERS = will, wendy, wim
1151 # Runas alias specification
1152 Runas_Alias OP = root, operator
1153 Runas_Alias DB = oracle, sybase
1155 # Host alias specification
1156 Host_Alias SPARC = bigtime, eclipse, moet, anchor :\
1157 SGI = grolsch, dandelion, black :\
1158 ALPHA = widget, thalamus, foobar :\
1159 HPPA = boa, nag, python
1160 Host_Alias CUNETS = 128.138.0.0/255.255.0.0
1161 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
1162 Host_Alias SERVERS = master, mail, www, ns
1163 Host_Alias CDROM = orion, perseus, hercules
1165 # Cmnd alias specification
1166 Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
1167 /usr/sbin/restore, /usr/sbin/rrestore
1168 Cmnd_Alias KILL = /usr/bin/kill
1169 Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
1170 Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
1171 Cmnd_Alias HALT = /usr/sbin/halt
1172 Cmnd_Alias REBOOT = /usr/sbin/reboot
1173 Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
1174 /usr/local/bin/tcsh, /usr/bin/rsh, \
1176 Cmnd_Alias SU = /usr/bin/su
1178 Here we override some of the compiled in default values.
1179 We want s
\bsu
\bud
\bdo
\bo to log via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3) using the _
\ba_
\bu_
\bt_
\bh facility
1180 in all cases. We don't want to subject the full time
1181 staff to the s
\bsu
\bud
\bdo
\bo lecture, user m
\bmi
\bil
\bll
\ble
\ber
\brt
\bt need not give a
1182 password, and we don't want to reset the LOGNAME or USER
1186 1.6.8p9 June, 20 2005 18
1192 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1195 environment variables when running commands as root.
1196 Additionally, on the machines in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias,
1197 we keep an additional local log file and make sure we log
1198 the year in each log line since the log entries will be
1199 kept around for several years.
1201 # Override built-in defaults
1202 Defaults syslog=auth
1203 Defaults>root !set_logname
1204 Defaults:FULLTIMERS !lecture
1205 Defaults:millert !authenticate
1206 Defaults@SERVERS log_year, logfile=/var/log/sudo.log
1208 The _
\bU_
\bs_
\be_
\br _
\bs_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn is the part that actually deter
1209 mines who may run what.
1211 root ALL = (ALL) ALL
1212 %wheel ALL = (ALL) ALL
1214 We let r
\bro
\boo
\bot
\bt and any user in group w
\bwh
\bhe
\bee
\bel
\bl run any command on
1215 any host as any user.
1217 FULLTIMERS ALL = NOPASSWD: ALL
1219 Full time sysadmins (m
\bmi
\bil
\bll
\ble
\ber
\brt
\bt, m
\bmi
\bik
\bke
\bef
\bf, and d
\bdo
\bow
\bwd
\bdy
\by) may run
1220 any command on any host without authenticating themselves.
1222 PARTTIMERS ALL = ALL
1224 Part time sysadmins (b
\bbo
\bos
\bst
\btl
\ble
\bey
\by, j
\bjw
\bwf
\bfo
\box
\bx, and c
\bcr
\bra
\baw
\bwl
\bl) may run
1225 any command on any host but they must authenticate them
1226 selves first (since the entry lacks the NOPASSWD tag).
1230 The user j
\bja
\bac
\bck
\bk may run any command on the machines in the
1231 _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS alias (the networks 128.138.243.0, 128.138.204.0,
1232 and 128.138.242.0). Of those networks, only 128.138.204.0
1233 has an explicit netmask (in CIDR notation) indicating it
1234 is a class C network. For the other networks in _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS,
1235 the local machine's netmask will be used during matching.
1239 The user l
\bli
\bis
\bsa
\ba may run any command on any host in the
1240 _
\bC_
\bU_
\bN_
\bE_
\bT_
\bS alias (the class B network 128.138.0.0).
1242 operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
1243 sudoedit /etc/printcap, /usr/oper/bin/
1245 The o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br user may run commands limited to simple main
1246 tenance. Here, those are commands related to backups,
1247 killing processes, the printing system, shutting down the
1248 system, and any commands in the directory _
\b/_
\bu_
\bs_
\br_
\b/_
\bo_
\bp_
\be_
\br_
\b/_
\bb_
\bi_
\bn_
\b/.
1252 1.6.8p9 June, 20 2005 19
1258 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1261 joe ALL = /usr/bin/su operator
1263 The user j
\bjo
\boe
\be may only _
\bs_
\bu(1) to operator.
1265 pete HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root
1267 The user p
\bpe
\bet
\bte
\be is allowed to change anyone's password
1268 except for root on the _
\bH_
\bP_
\bP_
\bA machines. Note that this
1269 assumes _
\bp_
\ba_
\bs_
\bs_
\bw_
\bd(1) does not take multiple usernames on the
1272 bob SPARC = (OP) ALL : SGI = (OP) ALL
1274 The user b
\bbo
\bob
\bb may run anything on the _
\bS_
\bP_
\bA_
\bR_
\bC and _
\bS_
\bG_
\bI
1275 machines as any user listed in the _
\bO_
\bP Runas_Alias (r
\bro
\boo
\bot
\bt
1276 and o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br).
1280 The user j
\bji
\bim
\bm may run any command on machines in the _
\bb_
\bi_
\bg_
\bl_
\ba_
\bb
1281 netgroup. S
\bSu
\bud
\bdo
\bo knows that "biglab" is a netgroup due to
1284 +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
1286 Users in the s
\bse
\bec
\bcr
\bre
\bet
\bta
\bar
\bri
\bie
\bes
\bs netgroup need to help manage the
1287 printers as well as add and remove users, so they are
1288 allowed to run those commands on all machines.
1290 fred ALL = (DB) NOPASSWD: ALL
1292 The user f
\bfr
\bre
\bed
\bd can run commands as any user in the _
\bD_
\bB
1293 Runas_Alias (o
\bor
\bra
\bac
\bcl
\ble
\be or s
\bsy
\byb
\bba
\bas
\bse
\be) without giving a password.
1295 john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
1297 On the _
\bA_
\bL_
\bP_
\bH_
\bA machines, user j
\bjo
\boh
\bhn
\bn may su to anyone except
1298 root but he is not allowed to give _
\bs_
\bu(1) any flags.
1300 jen ALL, !SERVERS = ALL
1302 The user j
\bje
\ben
\bn may run any command on any machine except for
1303 those in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias (master, mail, www and
1306 jill SERVERS = /usr/bin/, !SU, !SHELLS
1308 For any machine in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias, j
\bji
\bil
\bll
\bl may run
1309 any commands in the directory /usr/bin/ except for those
1310 commands belonging to the _
\bS_
\bU and _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS Cmnd_Aliases.
1312 steve CSNETS = (operator) /usr/local/op_commands/
1314 The user s
\bst
\bte
\bev
\bve
\be may run any command in the directory
1318 1.6.8p9 June, 20 2005 20
1324 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1327 /usr/local/op_commands/ but only as user operator.
1329 matt valkyrie = KILL
1331 On his personal workstation, valkyrie, m
\bma
\bat
\btt
\bt needs to be
1332 able to kill hung processes.
1334 WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
1336 On the host www, any user in the _
\bW_
\bE_
\bB_
\bM_
\bA_
\bS_
\bT_
\bE_
\bR_
\bS User_Alias
1337 (will, wendy, and wim), may run any command as user www
1338 (which owns the web pages) or simply _
\bs_
\bu(1) to www.
1340 ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\
1341 /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
1343 Any user may mount or unmount a CD-ROM on the machines in
1344 the CDROM Host_Alias (orion, perseus, hercules) without
1345 entering a password. This is a bit tedious for users to
1346 type, so it is a prime candidate for encapsulating in a
1349 S
\bSE
\bEC
\bCU
\bUR
\bRI
\bIT
\bTY
\bY N
\bNO
\bOT
\bTE
\bES
\bS
1350 It is generally not effective to "subtract" commands from
1351 ALL using the '!' operator. A user can trivially circum
1352 vent this by copying the desired command to a different
1353 name and then executing that. For example:
1355 bill ALL = ALL, !SU, !SHELLS
1357 Doesn't really prevent b
\bbi
\bil
\bll
\bl from running the commands
1358 listed in _
\bS_
\bU or _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS since he can simply copy those com
1359 mands to a different name, or use a shell escape from an
1360 editor or other program. Therefore, these kind of
1361 restrictions should be considered advisory at best (and
1362 reinforced by policy).
1364 P
\bPR
\bRE
\bEV
\bVE
\bEN
\bNT
\bTI
\bIN
\bNG
\bG S
\bSH
\bHE
\bEL
\bLL
\bL E
\bES
\bSC
\bCA
\bAP
\bPE
\bES
\bS
1365 Once s
\bsu
\bud
\bdo
\bo executes a program, that program is free to do
1366 whatever it pleases, including run other programs. This
1367 can be a security issue since it is not uncommon for a
1368 program to allow shell escapes, which lets a user bypass
1369 s
\bsu
\bud
\bdo
\bo's restrictions. Common programs that permit shell
1370 escapes include shells (obviously), editors, paginators,
1371 mail and terminal programs.
1373 Many systems that support shared libraries have the abil
1374 ity to override default library functions by pointing an
1375 environment variable (usually LD_PRELOAD) to an alternate
1376 shared library. On such systems, s
\bsu
\bud
\bdo
\bo's _
\bn_
\bo_
\be_
\bx_
\be_
\bc function
1377 ality can be used to prevent a program run by sudo from
1378 executing any other programs. Note, however, that this
1379 applies only to native dynamically-linked executables.
1380 Statically-linked executables and foreign executables
1384 1.6.8p9 June, 20 2005 21
1390 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1393 running under binary emulation are not affected.
1395 To tell whether or not s
\bsu
\bud
\bdo
\bo supports _
\bn_
\bo_
\be_
\bx_
\be_
\bc, you can run
1396 the following as root:
1398 sudo -V | grep "dummy exec"
1400 If the resulting output contains a line that begins with:
1402 File containing dummy exec functions:
1404 then s
\bsu
\bud
\bdo
\bo may be able to replace the exec family of func
1405 tions in the standard library with its own that simply
1406 return an error. Unfortunately, there is no foolproof way
1407 to know whether or not _
\bn_
\bo_
\be_
\bx_
\be_
\bc will work at compile-time.
1408 _
\bN_
\bo_
\be_
\bx_
\be_
\bc should work on SunOS, Solaris, *BSD, Linux, IRIX,
1409 Tru64 UNIX, MacOS X, and HP-UX 11.x. It is known n
\bno
\bot
\bt to
1410 work on AIX and UnixWare. _
\bN_
\bo_
\be_
\bx_
\be_
\bc is expected to work on
1411 most operating systems that support the LD_PRELOAD envi
1412 ronment variable. Check your operating system's manual
1413 pages for the dynamic linker (usually ld.so, ld.so.1,
1414 dyld, dld.sl, rld, or loader) to see if LD_PRELOAD is sup
1417 To enable _
\bn_
\bo_
\be_
\bx_
\be_
\bc for a command, use the NOEXEC tag as doc
1418 umented in the User Specification section above. Here is
1421 aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
1423 This allows user a
\baa
\bar
\bro
\bon
\bn to run _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be and
1424 _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bv_
\bi with _
\bn_
\bo_
\be_
\bx_
\be_
\bc enabled. This will prevent those
1425 two commands from executing other commands (such as a
1426 shell). If you are unsure whether or not your system is
1427 capable of supporting _
\bn_
\bo_
\be_
\bx_
\be_
\bc you can always just try it
1428 out and see if it works.
1430 Note that disabling shell escapes is not a panacea. Pro
1431 grams running as root are still capable of many poten
1432 tially hazardous operations (such as changing or overwrit
1433 ing files) that could lead to unintended privilege escala
1434 tion. In the specific case of an editor, a safer approach
1435 is to give the user permission to run s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt.
1437 S
\bSE
\bEE
\bE A
\bAL
\bLS
\bSO
\bO
1438 _
\br_
\bs_
\bh(1), _
\bs_
\bu(1), _
\bf_
\bn_
\bm_
\ba_
\bt_
\bc_
\bh(3), sudo(1m), visudo(1m)
1440 C
\bCA
\bAV
\bVE
\bEA
\bAT
\bTS
\bS
1441 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file should a
\bal
\blw
\bwa
\bay
\bys
\bs be edited by the v
\bvi
\bis
\bsu
\bud
\bdo
\bo
1442 command which locks the file and does grammatical check
1443 ing. It is imperative that _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs be free of syntax
1444 errors since s
\bsu
\bud
\bdo
\bo will not run with a syntactically incor
1445 rect _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file.
1450 1.6.8p9 June, 20 2005 22
1456 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1459 When using netgroups of machines (as opposed to users), if
1460 you store fully qualified hostnames in the netgroup (as is
1461 usually the case), you either need to have the machine's
1462 hostname be fully qualified as returned by the hostname
1463 command or use the _
\bf_
\bq_
\bd_
\bn option in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs.
1466 If you feel you have found a bug in s
\bsu
\bud
\bdo
\bo, please submit a
1467 bug report at http://www.sudo.ws/sudo/bugs/
1469 S
\bSU
\bUP
\bPP
\bPO
\bOR
\bRT
\bT
1470 Commercial support is available for s
\bsu
\bud
\bdo
\bo, see
1471 http://www.sudo.ws/sudo/support.html for details.
1473 Limited free support is available via the sudo-users mail
1474 ing list, see http://www.sudo.ws/mail
1475 man/listinfo/sudo-users to subscribe or search the
1478 D
\bDI
\bIS
\bSC
\bCL
\bLA
\bAI
\bIM
\bME
\bER
\bR
1479 S
\bSu
\bud
\bdo
\bo is provided ``AS IS'' and any express or implied war
1480 ranties, including, but not limited to, the implied war
1481 ranties of merchantability and fitness for a particular
1482 purpose are disclaimed. See the LICENSE file distributed
1483 with s
\bsu
\bud
\bdo
\bo or http://www.sudo.ws/sudo/license.html for com
1516 1.6.8p9 June, 20 2005 23