4 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
8 sudoers - list of which users may execute what
10 D
\bDE
\bES
\bSC
\bCR
\bRI
\bIP
\bPT
\bTI
\bIO
\bON
\bN
11 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is composed of two types of entries:
12 aliases (basically variables) and user specifications
13 (which specify who may run what).
15 When multiple entries match for a user, they are applied
16 in order. Where there are multiple matches, the last
17 match is used (which is not necessarily the most specific
20 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs grammar will be described below in Extended
21 Backus-Naur Form (EBNF). Don't despair if you don't know
22 what EBNF is; it is fairly simple, and the definitions
25 Q
\bQu
\bui
\bic
\bck
\bk g
\bgu
\bui
\bid
\bde
\be t
\bto
\bo E
\bEB
\bBN
\bNF
\bF
27 EBNF is a concise and exact way of describing the grammar
28 of a language. Each EBNF definition is made up of _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\b
29 _
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be_
\bs. E.g.,
31 symbol ::= definition | alternate1 | alternate2 ...
33 Each _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be references others and thus makes up a
34 grammar for the language. EBNF also contains the follow
35 ing operators, which many readers will recognize from reg
36 ular expressions. Do not, however, confuse them with
37 "wildcard" characters, which have different meanings.
39 ? Means that the preceding symbol (or group of symbols)
40 is optional. That is, it may appear once or not at
43 * Means that the preceding symbol (or group of symbols)
44 may appear zero or more times.
46 + Means that the preceding symbol (or group of symbols)
47 may appear one or more times.
49 Parentheses may be used to group symbols together. For
50 clarity, we will use single quotes ('') to designate what
51 is a verbatim character string (as opposed to a symbol
54 A
\bAl
\bli
\bia
\bas
\bse
\bes
\bs
56 There are four kinds of aliases: User_Alias, Runas_Alias,
57 Host_Alias and Cmnd_Alias.
64 1.6.9p15 March 23, 2008 1
70 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
73 Alias ::= 'User_Alias' User_Alias (':' User_Alias)* |
74 'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
75 'Host_Alias' Host_Alias (':' Host_Alias)* |
76 'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)*
78 User_Alias ::= NAME '=' User_List
80 Runas_Alias ::= NAME '=' Runas_List
82 Host_Alias ::= NAME '=' Host_List
84 Cmnd_Alias ::= NAME '=' Cmnd_List
86 NAME ::= [A-Z]([A-Z][0-9]_)*
88 Each _
\ba_
\bl_
\bi_
\ba_
\bs definition is of the form
90 Alias_Type NAME = item1, item2, ...
92 where _
\bA_
\bl_
\bi_
\ba_
\bs_
\b__
\bT_
\by_
\bp_
\be is one of User_Alias, Runas_Alias,
93 Host_Alias, or Cmnd_Alias. A NAME is a string of upper
94 case letters, numbers, and underscore characters ('_'). A
95 NAME m
\bmu
\bus
\bst
\bt start with an uppercase letter. It is possible
96 to put several alias definitions of the same type on a
97 single line, joined by a colon (':'). E.g.,
99 Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
101 The definitions of what constitutes a valid _
\ba_
\bl_
\bi_
\ba_
\bs member
107 User ::= '!'* username |
112 A User_List is made up of one or more usernames, system
113 groups (prefixed with '%'), netgroups (prefixed with '+')
114 and other aliases. Each list item may be prefixed with
115 one or more '!' operators. An odd number of '!' operators
116 negate the value of the item; an even number just cancel
119 Runas_List ::= Runas_User |
120 Runas_User ',' Runas_List
122 Runas_User ::= '!'* username |
130 1.6.9p15 March 23, 2008 2
136 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
139 A Runas_List is similar to a User_List except that it can
140 also contain uids (prefixed with '#') and instead of
141 User_Aliases it can contain Runas_Aliases. Note that
142 usernames and groups are matched as strings. In other
143 words, two users (groups) with the same uid (gid) are con
144 sidered to be distinct. If you wish to match all user
145 names with the same uid (e.g. root and toor), you can use
146 a uid instead (#0 in the example given).
151 Host ::= '!'* hostname |
153 '!'* network(/netmask)? |
157 A Host_List is made up of one or more hostnames, IP
158 addresses, network numbers, netgroups (prefixed with '+')
159 and other aliases. Again, the value of an item may be
160 negated with the '!' operator. If you do not specify a
161 netmask along with the network number, s
\bsu
\bud
\bdo
\bo will query
162 each of the local host's network interfaces and, if the
163 network number corresponds to one of the hosts's network
164 interfaces, the corresponding netmask will be used. The
165 netmask may be specified either in standard IP address
166 notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or
167 CIDR notation (number of bits, e.g. 24 or 64). A hostname
168 may include shell-style wildcards (see the Wildcards sec
169 tion below), but unless the hostname command on your
170 machine returns the fully qualified hostname, you'll need
171 to use the _
\bf_
\bq_
\bd_
\bn option for wildcards to be useful.
176 commandname ::= filename |
180 Cmnd ::= '!'* commandname |
185 A Cmnd_List is a list of one or more commandnames, direc
186 tories, and other aliases. A commandname is a fully qual
187 ified filename which may include shell-style wildcards
188 (see the Wildcards section below). A simple filename
189 allows the user to run the command with any arguments
190 he/she wishes. However, you may also specify command line
191 arguments (including wildcards). Alternately, you can
192 specify "" to indicate that the command may only be run
196 1.6.9p15 March 23, 2008 3
202 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
205 w
\bwi
\bit
\bth
\bho
\bou
\but
\bt command line arguments. A directory is a fully
206 qualified pathname ending in a '/'. When you specify a
207 directory in a Cmnd_List, the user will be able to run any
208 file within that directory (but not in any subdirectories
211 If a Cmnd has associated command line arguments, then the
212 arguments in the Cmnd must match exactly those given by
213 the user on the command line (or match the wildcards if
214 there are any). Note that the following characters must
215 be escaped with a '\' if they are used in command argu
216 ments: ',', ':', '=', '\'. The special command "sudoedit"
217 is used to permit a user to run s
\bsu
\bud
\bdo
\bo with the -
\b-e
\be flag (or
218 as s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt). It may take command line arguments just as
219 a normal command does.
221 D
\bDe
\bef
\bfa
\bau
\bul
\blt
\bts
\bs
223 Certain configuration options may be changed from their
224 default values at runtime via one or more Default_Entry
225 lines. These may affect all users on any host, all users
226 on a specific host, a specific user, or commands being run
229 Default_Type ::= 'Defaults' |
230 'Defaults' '@' Host_List |
231 'Defaults' ':' User_List |
232 'Defaults' '>' Runas_List
234 Default_Entry ::= Default_Type Parameter_List
236 Parameter_List ::= Parameter |
237 Parameter ',' Parameter_List
239 Parameter ::= Parameter '=' Value |
240 Parameter '+=' Value |
241 Parameter '-=' Value |
244 Parameters may be f
\bfl
\bla
\bag
\bgs
\bs, i
\bin
\bnt
\bte
\beg
\bge
\ber
\br values, s
\bst
\btr
\bri
\bin
\bng
\bgs
\bs, or
245 l
\bli
\bis
\bst
\bts
\bs. Flags are implicitly boolean and can be turned off
246 via the '!' operator. Some integer, string and list
247 parameters may also be used in a boolean context to dis
248 able them. Values may be enclosed in double quotes (")
249 when they contain multiple words. Special characters may
250 be escaped with a backslash (\).
252 Lists have two additional assignment operators, += and -=.
253 These operators are used to add to and delete from a list
254 respectively. It is not an error to use the -= operator
255 to remove an element that does not exist in a list.
257 See "SUDOERS OPTIONS" for a list of supported Defaults
262 1.6.9p15 March 23, 2008 4
268 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
271 U
\bUs
\bse
\ber
\br S
\bSp
\bpe
\bec
\bci
\bif
\bfi
\bic
\bca
\bat
\bti
\bio
\bon
\bn
273 User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
274 (':' Host_List '=' Cmnd_Spec_List)*
276 Cmnd_Spec_List ::= Cmnd_Spec |
277 Cmnd_Spec ',' Cmnd_Spec_List
279 Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
281 Runas_Spec ::= '(' Runas_List ')'
283 Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
284 'SETENV:' | 'NOSETENV:')
286 A u
\bus
\bse
\ber
\br s
\bsp
\bpe
\bec
\bci
\bif
\bfi
\bic
\bca
\bat
\bti
\bio
\bon
\bn determines which commands a user may
287 run (and as what user) on specified hosts. By default,
288 commands are run as r
\bro
\boo
\bot
\bt, but this can be changed on a
291 Let's break that down into its constituent parts:
293 R
\bRu
\bun
\bna
\bas
\bs_
\b_S
\bSp
\bpe
\bec
\bc
295 A Runas_Spec is simply a Runas_List (as defined above)
296 enclosed in a set of parentheses. If you do not specify a
297 Runas_Spec in the user specification, a default Runas_Spec
298 of r
\bro
\boo
\bot
\bt will be used. A Runas_Spec sets the default for
299 commands that follow it. What this means is that for the
302 dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
304 The user d
\bdg
\bgb
\bb may run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm
305 -- but only as o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br. E.g.,
307 $ sudo -u operator /bin/ls.
309 It is also possible to override a Runas_Spec later on in
310 an entry. If we modify the entry like so:
312 dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
314 Then user d
\bdg
\bgb
\bb is now allowed to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs as o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br,
315 but _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as r
\bro
\boo
\bot
\bt.
317 T
\bTa
\bag
\bg_
\b_S
\bSp
\bpe
\bec
\bc
319 A command may have zero or more tags associated with it.
320 There are six possible tag values, NOPASSWD, PASSWD,
321 NOEXEC, EXEC, SETENV and NOSETENV. Once a tag is set on a
322 Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit the
323 tag unless it is overridden by the opposite tag (i.e.:
324 PASSWD overrides NOPASSWD and NOEXEC overrides EXEC).
328 1.6.9p15 March 23, 2008 5
334 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
337 _
\bN_
\bO_
\bP_
\bA_
\bS_
\bS_
\bW_
\bD _
\ba_
\bn_
\bd _
\bP_
\bA_
\bS_
\bS_
\bW_
\bD
339 By default, s
\bsu
\bud
\bdo
\bo requires that a user authenticate him or
340 herself before running a command. This behavior can be
341 modified via the NOPASSWD tag. Like a Runas_Spec, the
342 NOPASSWD tag sets a default for the commands that follow
343 it in the Cmnd_Spec_List. Conversely, the PASSWD tag can
344 be used to reverse things. For example:
346 ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
348 would allow the user r
\bra
\bay
\by to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, and
349 _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as root on the machine rushmore as r
\bro
\boo
\bot
\bt
350 without authenticating himself. If we only want r
\bra
\bay
\by to be
351 able to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl without a password the entry would
354 ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
356 Note, however, that the PASSWD tag has no effect on users
357 who are in the group specified by the _
\be_
\bx_
\be_
\bm_
\bp_
\bt_
\b__
\bg_
\br_
\bo_
\bu_
\bp option.
359 By default, if the NOPASSWD tag is applied to any of the
360 entries for a user on the current host, he or she will be
361 able to run sudo -l without a password. Additionally, a
362 user may only run sudo -v without a password if the
363 NOPASSWD tag is present for all a user's entries that per
364 tain to the current host. This behavior may be overridden
365 via the verifypw and listpw options.
367 _
\bN_
\bO_
\bE_
\bX_
\bE_
\bC _
\ba_
\bn_
\bd _
\bE_
\bX_
\bE_
\bC
369 If s
\bsu
\bud
\bdo
\bo has been compiled with _
\bn_
\bo_
\be_
\bx_
\be_
\bc support and the
370 underlying operating system supports it, the NOEXEC tag
371 can be used to prevent a dynamically-linked executable
372 from running further commands itself.
374 In the following example, user a
\baa
\bar
\bro
\bon
\bn may run _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be
375 and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bv_
\bi but shell escapes will be disabled.
377 aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
379 See the "PREVENTING SHELL ESCAPES" section below for more
380 details on how NOEXEC works and whether or not it will
383 _
\bS_
\bE_
\bT_
\bE_
\bN_
\bV _
\ba_
\bn_
\bd _
\bN_
\bO_
\bS_
\bE_
\bT_
\bE_
\bN_
\bV
385 These tags override the value of the _
\bs_
\be_
\bt_
\be_
\bn_
\bv option on a
386 per-command basis. Note that if SETENV has been set for a
387 command, any environment variables set on the command line
388 way are not subject to the restrictions imposed by
389 _
\be_
\bn_
\bv_
\b__
\bc_
\bh_
\be_
\bc_
\bk, _
\be_
\bn_
\bv_
\b__
\bd_
\be_
\bl_
\be_
\bt_
\be, or _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp. As such, only trusted
390 users should be allowed to set variables in this manner.
394 1.6.9p15 March 23, 2008 6
400 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
403 If the command matched is A
\bAL
\bLL
\bL, the SETENV tag is implied
404 for that command; this default may be overridden by use of
407 W
\bWi
\bil
\bld
\bdc
\bca
\bar
\brd
\bds
\bs
409 s
\bsu
\bud
\bdo
\bo allows shell-style _
\bw_
\bi_
\bl_
\bd_
\bc_
\ba_
\br_
\bd_
\bs (aka meta or glob char
410 acters) to be used in pathnames as well as command line
411 arguments in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file. Wildcard matching is done
412 via the P
\bPO
\bOS
\bSI
\bIX
\bX _
\bf_
\bn_
\bm_
\ba_
\bt_
\bc_
\bh(3) routine. Note that these are _
\bn_
\bo_
\bt
415 * Matches any set of zero or more characters.
417 ? Matches any single character.
419 [...] Matches any character in the specified range.
421 [!...] Matches any character n
\bno
\bot
\bt in the specified range.
423 \x For any character "x", evaluates to "x". This is
424 used to escape special characters such as: "*",
427 Note that a forward slash ('/') will n
\bno
\bot
\bt be matched by
428 wildcards used in the pathname. When matching the command
429 line arguments, however, a slash d
\bdo
\boe
\bes
\bs get matched by wild
430 cards. This is to make a path like:
434 match _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bw_
\bh_
\bo but not _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bX_
\b1_
\b1_
\b/_
\bx_
\bt_
\be_
\br_
\bm.
436 E
\bEx
\bxc
\bce
\bep
\bpt
\bti
\bio
\bon
\bns
\bs t
\bto
\bo w
\bwi
\bil
\bld
\bdc
\bca
\bar
\brd
\bd r
\bru
\bul
\ble
\bes
\bs
438 The following exceptions apply to the above rules:
440 "" If the empty string "" is the only command line
441 argument in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entry it means that com
442 mand is not allowed to be run with a
\ban
\bny
\by arguments.
444 O
\bOt
\bth
\bhe
\ber
\br s
\bsp
\bpe
\bec
\bci
\bia
\bal
\bl c
\bch
\bha
\bar
\bra
\bac
\bct
\bte
\ber
\brs
\bs a
\ban
\bnd
\bd r
\bre
\bes
\bse
\ber
\brv
\bve
\bed
\bd w
\bwo
\bor
\brd
\bds
\bs
446 The pound sign ('#') is used to indicate a comment (unless
447 it is part of a #include directive or unless it occurs in
448 the context of a user name and is followed by one or more
449 digits, in which case it is treated as a uid). Both the
450 comment character and any text after it, up to the end of
451 the line, are ignored.
453 The reserved word A
\bAL
\bLL
\bL is a built-in _
\ba_
\bl_
\bi_
\ba_
\bs that always
454 causes a match to succeed. It can be used wherever one
455 might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias,
456 or Host_Alias. You should not try to define your own
460 1.6.9p15 March 23, 2008 7
466 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
469 _
\ba_
\bl_
\bi_
\ba_
\bs called A
\bAL
\bLL
\bL as the built-in alias will be used in
470 preference to your own. Please note that using A
\bAL
\bLL
\bL can be
471 dangerous since in a command context, it allows the user
472 to run a
\ban
\bny
\by command on the system.
474 An exclamation point ('!') can be used as a logical _
\bn_
\bo_
\bt
475 operator both in an _
\ba_
\bl_
\bi_
\ba_
\bs and in front of a Cmnd. This
476 allows one to exclude certain values. Note, however, that
477 using a ! in conjunction with the built-in ALL alias to
478 allow a user to run "all but a few" commands rarely works
479 as intended (see SECURITY NOTES below).
481 Long lines can be continued with a backslash ('\') as the
482 last character on the line.
484 Whitespace between elements in a list as well as special
485 syntactic characters in a _
\bU_
\bs_
\be_
\br _
\bS_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn ('=', ':',
486 '(', ')') is optional.
488 The following characters must be escaped with a backslash
489 ('\') when used as part of a word (e.g. a username or
490 hostname): '@', '!', '=', ':', ',', '(', ')', '\'.
492 S
\bSU
\bUD
\bDO
\bOE
\bER
\bRS
\bS O
\bOP
\bPT
\bTI
\bIO
\bON
\bNS
\bS
493 s
\bsu
\bud
\bdo
\bo's behavior can be modified by Default_Entry lines, as
494 explained earlier. A list of all supported Defaults
495 parameters, grouped by type, are listed below.
497 F
\bFl
\bla
\bag
\bgs
\bs:
499 always_set_home If set, s
\bsu
\bud
\bdo
\bo will set the HOME environment
500 variable to the home directory of the tar
501 get user (which is root unless the -
\b-u
\bu
502 option is used). This effectively means
503 that the -
\b-H
\bH flag is always implied. This
504 flag is _
\bo_
\bf_
\bf by default.
506 authenticate If set, users must authenticate themselves
507 via a password (or other means of authen
508 tication) before they may run commands.
509 This default may be overridden via the
510 PASSWD and NOPASSWD tags. This flag is _
\bo_
\bn
513 env_editor If set, v
\bvi
\bis
\bsu
\bud
\bdo
\bo will use the value of the
514 EDITOR or VISUAL environment variables
515 before falling back on the default editor
516 list. Note that this may create a secu
517 rity hole as it allows the user to run any
518 arbitrary command as root without logging.
519 A safer alternative is to place a colon-
520 separated list of editors in the editor
521 variable. v
\bvi
\bis
\bsu
\bud
\bdo
\bo will then only use the
522 EDITOR or VISUAL if they match a value
526 1.6.9p15 March 23, 2008 8
532 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
535 specified in editor. This flag is _
\bo_
\bf_
\bf by
538 env_reset If set, s
\bsu
\bud
\bdo
\bo will reset the environment to
539 only contain the LOGNAME, SHELL, USER,
540 USERNAME and the SUDO_* variables. Any
541 variables in the caller's environment that
542 match the env_keep and env_check lists are
543 then added. The default contents of the
544 env_keep and env_check lists are displayed
545 when s
\bsu
\bud
\bdo
\bo is run by root with the _
\b-_
\bV
546 option. If s
\bsu
\bud
\bdo
\bo was compiled with the
547 SECURE_PATH option, its value will be used
548 for the PATH environment variable. This
549 flag is _
\bo_
\bn by default.
551 fqdn Set this flag if you want to put fully
552 qualified hostnames in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file.
553 I.e., instead of myhost you would use
554 myhost.mydomain.edu. You may still use
555 the short form if you wish (and even mix
556 the two). Beware that turning on _
\bf_
\bq_
\bd_
\bn
557 requires s
\bsu
\bud
\bdo
\bo to make DNS lookups which
558 may make s
\bsu
\bud
\bdo
\bo unusable if DNS stops work
559 ing (for example if the machine is not
560 plugged into the network). Also note that
561 you must use the host's official name as
562 DNS knows it. That is, you may not use a
563 host alias (CNAME entry) due to perfor
564 mance issues and the fact that there is no
565 way to get all aliases from DNS. If your
566 machine's hostname (as returned by the
567 hostname command) is already fully quali
568 fied you shouldn't need to set _
\bf_
\bq_
\bd_
\bn. This
569 flag is _
\bo_
\bf_
\bf by default.
571 ignore_dot If set, s
\bsu
\bud
\bdo
\bo will ignore '.' or '' (cur
572 rent dir) in the PATH environment vari
573 able; the PATH itself is not modified.
574 This flag is _
\bo_
\bf_
\bf by default. Currently,
575 while it is possible to set _
\bi_
\bg_
\bn_
\bo_
\br_
\be_
\b__
\bd_
\bo_
\bt in
576 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs, its value is not used. This
577 option should be considered read-only (it
578 will be fixed in a future version of
582 If set via LDAP, parsing of _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
583 will be skipped. This is intended for
584 Enterprises that wish to prevent the usage
585 of local sudoers files so that only LDAP
586 is used. This thwarts the efforts of
587 rogue operators who would attempt to add
588 roles to _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs. When this option
592 1.6.9p15 March 23, 2008 9
598 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
601 is present, _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs does not even
602 need to exist. Since this option tells
603 s
\bsu
\bud
\bdo
\bo how to behave when no specific LDAP
604 entries have been matched, this sudoOption
605 is only meaningful for the cn=defaults
606 section. This flag is _
\bo_
\bf_
\bf by default.
608 insults If set, s
\bsu
\bud
\bdo
\bo will insult users when they
609 enter an incorrect password. This flag is
610 _
\bo_
\bf_
\bf by default.
612 log_host If set, the hostname will be logged in the
613 (non-syslog) s
\bsu
\bud
\bdo
\bo log file. This flag is
614 _
\bo_
\bf_
\bf by default.
616 log_year If set, the four-digit year will be logged
617 in the (non-syslog) s
\bsu
\bud
\bdo
\bo log file. This
618 flag is _
\bo_
\bf_
\bf by default.
620 long_otp_prompt When validating with a One Time Password
621 (OPT) scheme such as S
\bS/
\b/K
\bKe
\bey
\by or O
\bOP
\bPI
\bIE
\bE, a two-
622 line prompt is used to make it easier to
623 cut and paste the challenge to a local
624 window. It's not as pretty as the default
625 but some people find it more convenient.
626 This flag is _
\bo_
\bf_
\bf by default.
628 mail_always Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user every time a
629 users runs s
\bsu
\bud
\bdo
\bo. This flag is _
\bo_
\bf_
\bf by
632 mail_badpass Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user if the user
633 running s
\bsu
\bud
\bdo
\bo does not enter the correct
634 password. This flag is _
\bo_
\bf_
\bf by default.
636 mail_no_host If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
637 user if the invoking user exists in the
638 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file, but is not allowed to run
639 commands on the current host. This flag
640 is _
\bo_
\bf_
\bf by default.
642 mail_no_perms If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
643 user if the invoking user is allowed to
644 use s
\bsu
\bud
\bdo
\bo but the command they are trying
645 is not listed in their _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file entry
646 or is explicitly denied. This flag is _
\bo_
\bf_
\bf
649 mail_no_user If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
650 user if the invoking user is not in the
651 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file. This flag is _
\bo_
\bn by default.
653 noexec If set, all commands run via s
\bsu
\bud
\bdo
\bo will
654 behave as if the NOEXEC tag has been set,
658 1.6.9p15 March 23, 2008 10
664 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
667 unless overridden by a EXEC tag. See the
668 description of _
\bN_
\bO_
\bE_
\bX_
\bE_
\bC _
\ba_
\bn_
\bd _
\bE_
\bX_
\bE_
\bC below as
669 well as the "PREVENTING SHELL ESCAPES"
670 section at the end of this manual. This
671 flag is _
\bo_
\bf_
\bf by default.
673 path_info Normally, s
\bsu
\bud
\bdo
\bo will tell the user when a
674 command could not be found in their PATH
675 environment variable. Some sites may wish
676 to disable this as it could be used to
677 gather information on the location of exe
678 cutables that the normal user does not
679 have access to. The disadvantage is that
680 if the executable is simply not in the
681 user's PATH, s
\bsu
\bud
\bdo
\bo will tell the user that
682 they are not allowed to run it, which can
683 be confusing. This flag is _
\bo_
\bn by default.
686 The password prompt specified by
687 _
\bp_
\ba_
\bs_
\bs_
\bp_
\br_
\bo_
\bm_
\bp_
\bt will normally only be used if
688 the passwod prompt provided by systems
689 such as PAM matches the string "Pass
690 word:". If _
\bp_
\ba_
\bs_
\bs_
\bp_
\br_
\bo_
\bm_
\bp_
\bt_
\b__
\bo_
\bv_
\be_
\br_
\br_
\bi_
\bd_
\be is set,
691 _
\bp_
\ba_
\bs_
\bs_
\bp_
\br_
\bo_
\bm_
\bp_
\bt will always be used. This flag
692 is _
\bo_
\bf_
\bf by default.
694 preserve_groups By default s
\bsu
\bud
\bdo
\bo will initialize the group
695 vector to the list of groups the target
696 user is in. When _
\bp_
\br_
\be_
\bs_
\be_
\br_
\bv_
\be_
\b__
\bg_
\br_
\bo_
\bu_
\bp_
\bs is set,
697 the user's existing group vector is left
698 unaltered. The real and effective group
699 IDs, however, are still set to match the
700 target user. This flag is _
\bo_
\bf_
\bf by default.
702 requiretty If set, s
\bsu
\bud
\bdo
\bo will only run when the user
703 is logged in to a real tty. This will
704 disallow things like "rsh somehost sudo
705 ls" since _
\br_
\bs_
\bh(1) does not allocate a tty.
706 Because it is not possible to turn off
707 echo when there is no tty present, some
708 sites may wish to set this flag to prevent
709 a user from entering a visible password.
710 This flag is _
\bo_
\bf_
\bf by default.
712 root_sudo If set, root is allowed to run s
\bsu
\bud
\bdo
\bo too.
713 Disabling this prevents users from "chain
714 ing" s
\bsu
\bud
\bdo
\bo commands to get a root shell by
715 doing something like "sudo sudo /bin/sh".
716 Note, however, that turning off _
\br_
\bo_
\bo_
\bt_
\b__
\bs_
\bu_
\bd_
\bo
717 will also prevent root and from running
718 s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt. Disabling _
\br_
\bo_
\bo_
\bt_
\b__
\bs_
\bu_
\bd_
\bo provides no
719 real additional security; it exists purely
720 for historical reasons. This flag is _
\bo_
\bn
724 1.6.9p15 March 23, 2008 11
730 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
735 rootpw If set, s
\bsu
\bud
\bdo
\bo will prompt for the root
736 password instead of the password of the
737 invoking user. This flag is _
\bo_
\bf_
\bf by
740 runaspw If set, s
\bsu
\bud
\bdo
\bo will prompt for the password
741 of the user defined by the _
\br_
\bu_
\bn_
\ba_
\bs_
\b__
\bd_
\be_
\bf_
\ba_
\bu_
\bl_
\bt
742 option (defaults to root) instead of the
743 password of the invoking user. This flag
744 is _
\bo_
\bf_
\bf by default.
746 set_home If set and s
\bsu
\bud
\bdo
\bo is invoked with the -
\b-s
\bs
747 flag the HOME environment variable will be
748 set to the home directory of the target
749 user (which is root unless the -
\b-u
\bu option
750 is used). This effectively makes the -
\b-s
\bs
751 flag imply -
\b-H
\bH. This flag is _
\bo_
\bf_
\bf by
754 set_logname Normally, s
\bsu
\bud
\bdo
\bo will set the LOGNAME, USER
755 and USERNAME environment variables to the
756 name of the target user (usually root
757 unless the -
\b-u
\bu flag is given). However,
758 since some programs (including the RCS
759 revision control system) use LOGNAME to
760 determine the real identity of the user,
761 it may be desirable to change this behav
762 ior. This can be done by negating the
763 set_logname option. Note that if the
764 _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt option has not been disabled,
765 entries in the _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp list will override
766 the value of _
\bs_
\be_
\bt_
\b__
\bl_
\bo_
\bg_
\bn_
\ba_
\bm_
\be. This flag is
767 _
\bo_
\bf_
\bf by default.
769 setenv Allow the user to disable the _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt
770 option from the command line. Addition
771 ally, environment variables set via the
772 command line are not subject to the
773 restrictions imposed by _
\be_
\bn_
\bv_
\b__
\bc_
\bh_
\be_
\bc_
\bk,
774 _
\be_
\bn_
\bv_
\b__
\bd_
\be_
\bl_
\be_
\bt_
\be, or _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp. As such, only
775 trusted users should be allowed to set
776 variables in this manner. This flag is
777 _
\bo_
\bf_
\bf by default.
779 shell_noargs If set and s
\bsu
\bud
\bdo
\bo is invoked with no argu
780 ments it acts as if the -
\b-s
\bs flag had been
781 given. That is, it runs a shell as root
782 (the shell is determined by the SHELL
783 environment variable if it is set, falling
784 back on the shell listed in the invoking
785 user's /etc/passwd entry if not). This
786 flag is _
\bo_
\bf_
\bf by default.
790 1.6.9p15 March 23, 2008 12
796 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
799 stay_setuid Normally, when s
\bsu
\bud
\bdo
\bo executes a command the
800 real and effective UIDs are set to the
801 target user (root by default). This
802 option changes that behavior such that the
803 real UID is left as the invoking user's
804 UID. In other words, this makes s
\bsu
\bud
\bdo
\bo act
805 as a setuid wrapper. This can be useful
806 on systems that disable some potentially
807 dangerous functionality when a program is
808 run setuid. This option is only effective
809 on systems with either the _
\bs_
\be_
\bt_
\br_
\be_
\bu_
\bi_
\bd_
\b(_
\b) or
810 _
\bs_
\be_
\bt_
\br_
\be_
\bs_
\bu_
\bi_
\bd_
\b(_
\b) function. This flag is _
\bo_
\bf_
\bf by
813 targetpw If set, s
\bsu
\bud
\bdo
\bo will prompt for the password
814 of the user specified by the -
\b-u
\bu flag
815 (defaults to root) instead of the password
816 of the invoking user. Note that this pre
817 cludes the use of a uid not listed in the
818 passwd database as an argument to the -
\b-u
\bu
819 flag. This flag is _
\bo_
\bf_
\bf by default.
821 tty_tickets If set, users must authenticate on a per-
822 tty basis. Normally, s
\bsu
\bud
\bdo
\bo uses a direc
823 tory in the ticket dir with the same name
824 as the user running it. With this flag
825 enabled, s
\bsu
\bud
\bdo
\bo will use a file named for
826 the tty the user is logged in on in that
827 directory. This flag is _
\bo_
\bf_
\bf by default.
829 use_loginclass If set, s
\bsu
\bud
\bdo
\bo will apply the defaults spec
830 ified for the target user's login class if
831 one exists. Only available if s
\bsu
\bud
\bdo
\bo is
832 configured with the --with-logincap
833 option. This flag is _
\bo_
\bf_
\bf by default.
835 I
\bIn
\bnt
\bte
\beg
\bge
\ber
\brs
\bs:
837 passwd_tries The number of tries a user gets to enter
838 his/her password before s
\bsu
\bud
\bdo
\bo logs the
839 failure and exits. The default is 3.
841 I
\bIn
\bnt
\bte
\beg
\bge
\ber
\brs
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
843 loglinelen Number of characters per line for the file
844 log. This value is used to decide when to
845 wrap lines for nicer log files. This has
846 no effect on the syslog log file, only the
847 file log. The default is 80 (use 0 or
848 negate the option to disable word wrap).
850 passwd_timeout Number of minutes before the s
\bsu
\bud
\bdo
\bo password
851 prompt times out. The default is 5; set
852 this to 0 for no password timeout.
856 1.6.9p15 March 23, 2008 13
862 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
866 Number of minutes that can elapse before
867 s
\bsu
\bud
\bdo
\bo will ask for a passwd again. The
868 default is 5. Set this to 0 to always
869 prompt for a password. If set to a value
870 less than 0 the user's timestamp will
871 never expire. This can be used to allow
872 users to create or delete their own times
873 tamps via sudo -v and sudo -k respec
876 umask Umask to use when running the command.
877 Negate this option or set it to 0777 to
878 preserve the user's umask. The default is
881 S
\bSt
\btr
\bri
\bin
\bng
\bgs
\bs:
883 badpass_message Message that is displayed if a user enters
884 an incorrect password. The default is
885 Sorry, try again. unless insults are
888 editor A colon (':') separated list of editors
889 allowed to be used with v
\bvi
\bis
\bsu
\bud
\bdo
\bo. v
\bvi
\bis
\bsu
\bud
\bdo
\bo
890 will choose the editor that matches the
891 user's EDITOR environment variable if pos
892 sible, or the first editor in the list
893 that exists and is executable. The
894 default is the path to vi on your system.
896 mailsub Subject of the mail sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
897 user. The escape %h will expand to the
898 hostname of the machine. Default is ***
899 SECURITY information for %h ***.
901 noexec_file Path to a shared library containing dummy
902 versions of the _
\be_
\bx_
\be_
\bc_
\bv_
\b(_
\b), _
\be_
\bx_
\be_
\bc_
\bv_
\be_
\b(_
\b) and _
\bf_
\be_
\bx_
\b
903 _
\be_
\bc_
\bv_
\be_
\b(_
\b) library functions that just return
904 an error. This is used to implement the
905 _
\bn_
\bo_
\be_
\bx_
\be_
\bc functionality on systems that sup
906 port LD_PRELOAD or its equivalent.
908 _
\b/_
\bu_
\bs_
\br_
\b/_
\bl_
\bo_
\bc_
\ba_
\bl_
\b/_
\bl_
\bi_
\bb_
\be_
\bx_
\be_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b__
\bn_
\bo_
\be_
\bx_
\be_
\bc_
\b._
\bs_
\bo.
910 passprompt The default prompt to use when asking for
911 a password; can be overridden via the -
\b-p
\bp
912 option or the SUDO_PROMPT environment
913 variable. The following percent (`%')
914 escapes are supported:
916 %H expanded to the local hostname includ
917 ing the domain name (on if the
918 machine's hostname is fully qualified
922 1.6.9p15 March 23, 2008 14
928 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
931 or the _
\bf_
\bq_
\bd_
\bn option is set)
933 %h expanded to the local hostname without
936 %p expanded to the user whose password is
937 being asked for (respects the _
\br_
\bo_
\bo_
\bt_
\bp_
\bw,
938 _
\bt_
\ba_
\br_
\bg_
\be_
\bt_
\bp_
\bw and _
\br_
\bu_
\bn_
\ba_
\bs_
\bp_
\bw flags in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs)
940 %U expanded to the login name of the user
941 the command will be run as (defaults
944 %u expanded to the invoking user's login
947 %% two consecutive % characters are col
948 lapsed into a single % character
950 The default value is Password:.
952 runas_default The default user to run commands as if the
953 -
\b-u
\bu flag is not specified on the command
954 line. This defaults to root. Note that
955 if _
\br_
\bu_
\bn_
\ba_
\bs_
\b__
\bd_
\be_
\bf_
\ba_
\bu_
\bl_
\bt is set it m
\bmu
\bus
\bst
\bt occur
956 before any Runas_Alias specifications.
958 syslog_badpri Syslog priority to use when user authenti
959 cates unsuccessfully. Defaults to alert.
961 syslog_goodpri Syslog priority to use when user authenti
962 cates successfully. Defaults to notice.
964 timestampdir The directory in which s
\bsu
\bud
\bdo
\bo stores its
965 timestamp files. The default is
966 _
\b/_
\bv_
\ba_
\br_
\b/_
\br_
\bu_
\bn_
\b/_
\bs_
\bu_
\bd_
\bo.
968 timestampowner The owner of the timestamp directory and
969 the timestamps stored therein. The
972 S
\bSt
\btr
\bri
\bin
\bng
\bgs
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
975 Users in this group are exempt from password
976 and PATH requirements. This is not set by
979 lecture This option controls when a short lecture will
980 be printed along with the password prompt. It
981 has the following possible values:
983 always Always lecture the user.
988 1.6.9p15 March 23, 2008 15
994 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
997 never Never lecture the user.
999 once Only lecture the user the first time
1000 they run s
\bsu
\bud
\bdo
\bo.
1002 If no value is specified, a value of _
\bo_
\bn_
\bc_
\be is
1003 implied. Negating the option results in a
1004 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
1005 is _
\bo_
\bn_
\bc_
\be.
1008 Path to a file containing an alternate s
\bsu
\bud
\bdo
\bo
1009 lecture that will be used in place of the
1010 standard lecture if the named file exists. By
1011 default, s
\bsu
\bud
\bdo
\bo uses a built-in lecture.
1013 listpw This option controls when a password will be
1014 required when a user runs s
\bsu
\bud
\bdo
\bo with the -
\b-l
\bl
1015 flag. It has the following possible values:
1017 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
1018 current host must have the NOPASSWD
1019 flag set to avoid entering a password.
1021 always The user must always enter a password
1022 to use the -
\b-l
\bl flag.
1024 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1025 entries for the current host must have
1026 the NOPASSWD flag set to avoid enter
1029 never The user need never enter a password
1030 to use the -
\b-l
\bl flag.
1032 If no value is specified, a value of _
\ba_
\bn_
\by is
1033 implied. Negating the option results in a
1034 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
1037 logfile Path to the s
\bsu
\bud
\bdo
\bo log file (not the syslog log
1038 file). Setting a path turns on logging to a
1039 file; negating this option turns it off. By
1040 default, s
\bsu
\bud
\bdo
\bo logs via syslog.
1042 mailerflags Flags to use when invoking mailer. Defaults to
1045 mailerpath Path to mail program used to send warning
1046 mail. Defaults to the path to sendmail found
1049 mailto Address to send warning and error mail to.
1050 The address should be enclosed in double
1054 1.6.9p15 March 23, 2008 16
1060 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1063 quotes (") to protect against s
\bsu
\bud
\bdo
\bo interpret
1064 ing the @ sign. Defaults to root.
1066 syslog Syslog facility if syslog is being used for
1067 logging (negate to disable syslog logging).
1070 verifypw This option controls when a password will be
1071 required when a user runs s
\bsu
\bud
\bdo
\bo with the -
\b-v
\bv
1072 flag. It has the following possible values:
1074 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
1075 current host must have the NOPASSWD
1076 flag set to avoid entering a password.
1078 always The user must always enter a password
1079 to use the -
\b-v
\bv flag.
1081 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1082 entries for the current host must have
1083 the NOPASSWD flag set to avoid enter
1086 never The user need never enter a password
1087 to use the -
\b-v
\bv flag.
1089 If no value is specified, a value of _
\ba_
\bl_
\bl is
1090 implied. Negating the option results in a
1091 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
1094 L
\bLi
\bis
\bst
\bts
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
1096 env_check Environment variables to be removed from
1097 the user's environment if the variable's
1098 value contains % or / characters. This
1099 can be used to guard against printf-style
1100 format vulnerabilities in poorly-written
1101 programs. The argument may be a dou
1102 ble-quoted, space-separated list or a sin
1103 gle value without double-quotes. The list
1104 can be replaced, added to, deleted from,
1105 or disabled by using the =, +=, -=, and !
1106 operators respectively. Regardless of
1107 whether the env_reset option is enabled or
1108 disabled, variables specified by env_check
1109 will be preserved in the environment if
1110 they pass the aforementioned check. The
1111 default list of environment variables to
1112 check is displayed when s
\bsu
\bud
\bdo
\bo is run by
1113 root with the _
\b-_
\bV option.
1115 env_delete Environment variables to be removed from
1116 the user's environment. The argument may
1120 1.6.9p15 March 23, 2008 17
1126 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1129 be a double-quoted, space-separated list
1130 or a single value without double-quotes.
1131 The list can be replaced, added to,
1132 deleted from, or disabled by using the =,
1133 +=, -=, and ! operators respectively. The
1134 default list of environment variables to
1135 remove is displayed when s
\bsu
\bud
\bdo
\bo is run by
1136 root with the _
\b-_
\bV option. Note that many
1137 operating systems will remove potentially
1138 dangerous variables from the environment
1139 of any setuid process (such as s
\bsu
\bud
\bdo
\bo).
1141 env_keep Environment variables to be preserved in
1142 the user's environment when the _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt
1143 option is in effect. This allows fine-
1144 grained control over the environment
1145 s
\bsu
\bud
\bdo
\bo-spawned processes will receive. The
1146 argument may be a double-quoted, space-
1147 separated list or a single value without
1148 double-quotes. The list can be replaced,
1149 added to, deleted from, or disabled by
1150 using the =, +=, -=, and ! operators
1151 respectively. The default list of vari
1152 ables to keep is displayed when s
\bsu
\bud
\bdo
\bo is
1153 run by root with the _
\b-_
\bV option.
1155 When logging via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3), s
\bsu
\bud
\bdo
\bo accepts the following
1156 values for the syslog facility (the value of the s
\bsy
\bys
\bsl
\blo
\bog
\bg
1157 Parameter): a
\bau
\but
\bth
\bhp
\bpr
\bri
\biv
\bv (if your OS supports it), a
\bau
\but
\bth
\bh, d
\bda
\bae
\be
\b
1158 m
\bmo
\bon
\bn, u
\bus
\bse
\ber
\br, l
\blo
\boc
\bca
\bal
\bl0
\b0, l
\blo
\boc
\bca
\bal
\bl1
\b1, l
\blo
\boc
\bca
\bal
\bl2
\b2, l
\blo
\boc
\bca
\bal
\bl3
\b3, l
\blo
\boc
\bca
\bal
\bl4
\b4, l
\blo
\boc
\bca
\bal
\bl5
\b5,
1159 l
\blo
\boc
\bca
\bal
\bl6
\b6, and l
\blo
\boc
\bca
\bal
\bl7
\b7. The following syslog priorities are
1160 supported: a
\bal
\ble
\ber
\brt
\bt, c
\bcr
\bri
\bit
\bt, d
\bde
\beb
\bbu
\bug
\bg, e
\bem
\bme
\ber
\brg
\bg, e
\ber
\brr
\br, i
\bin
\bnf
\bfo
\bo, n
\bno
\bot
\bti
\bic
\bce
\be,
1161 and w
\bwa
\bar
\brn
\bni
\bin
\bng
\bg.
1163 F
\bFI
\bIL
\bLE
\bES
\bS
1164 _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs List of who can run what
1166 _
\b/_
\be_
\bt_
\bc_
\b/_
\bg_
\br_
\bo_
\bu_
\bp Local groups file
1168 _
\b/_
\be_
\bt_
\bc_
\b/_
\bn_
\be_
\bt_
\bg_
\br_
\bo_
\bu_
\bp List of network groups
1170 E
\bEX
\bXA
\bAM
\bMP
\bPL
\bLE
\bES
\bS
1171 Since the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is parsed in a single pass, order
1172 is important. In general, you should structure _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1173 such that the Host_Alias, User_Alias, and Cmnd_Alias spec
1174 ifications come first, followed by any Default_Entry
1175 lines, and finally the Runas_Alias and user specifica
1176 tions. The basic rule of thumb is you cannot reference an
1177 Alias that has not already been defined.
1179 Below are example _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries. Admittedly, some of
1180 these are a bit contrived. First, we define our _
\ba_
\bl_
\bi_
\ba_
\bs_
\be_
\bs:
1186 1.6.9p15 March 23, 2008 18
1192 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1195 # User alias specification
1196 User_Alias FULLTIMERS = millert, mikef, dowdy
1197 User_Alias PARTTIMERS = bostley, jwfox, crawl
1198 User_Alias WEBMASTERS = will, wendy, wim
1200 # Runas alias specification
1201 Runas_Alias OP = root, operator
1202 Runas_Alias DB = oracle, sybase
1204 # Host alias specification
1205 Host_Alias SPARC = bigtime, eclipse, moet, anchor :\
1206 SGI = grolsch, dandelion, black :\
1207 ALPHA = widget, thalamus, foobar :\
1208 HPPA = boa, nag, python
1209 Host_Alias CUNETS = 128.138.0.0/255.255.0.0
1210 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
1211 Host_Alias SERVERS = master, mail, www, ns
1212 Host_Alias CDROM = orion, perseus, hercules
1214 # Cmnd alias specification
1215 Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
1216 /usr/sbin/restore, /usr/sbin/rrestore
1217 Cmnd_Alias KILL = /usr/bin/kill
1218 Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
1219 Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
1220 Cmnd_Alias HALT = /usr/sbin/halt
1221 Cmnd_Alias REBOOT = /usr/sbin/reboot
1222 Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
1223 /usr/local/bin/tcsh, /usr/bin/rsh, \
1225 Cmnd_Alias SU = /usr/bin/su
1226 Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
1228 Here we override some of the compiled in default values.
1229 We want s
\bsu
\bud
\bdo
\bo to log via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3) using the _
\ba_
\bu_
\bt_
\bh facility
1230 in all cases. We don't want to subject the full time
1231 staff to the s
\bsu
\bud
\bdo
\bo lecture, user m
\bmi
\bil
\bll
\ble
\ber
\brt
\bt need not give a
1232 password, and we don't want to reset the LOGNAME, USER or
1233 USERNAME environment variables when running commands as
1234 root. Additionally, on the machines in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS
1235 Host_Alias, we keep an additional local log file and make
1236 sure we log the year in each log line since the log
1237 entries will be kept around for several years. Lastly, we
1238 disable shell escapes for the commands in the PAGERS
1239 Cmnd_Alias (_
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be, _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bp_
\bg and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\be_
\bs_
\bs).
1241 # Override built-in defaults
1242 Defaults syslog=auth
1243 Defaults>root !set_logname
1244 Defaults:FULLTIMERS !lecture
1245 Defaults:millert !authenticate
1246 Defaults@SERVERS log_year, logfile=/var/log/sudo.log
1247 Defaults!PAGERS noexec
1252 1.6.9p15 March 23, 2008 19
1258 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1261 The _
\bU_
\bs_
\be_
\br _
\bs_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn is the part that actually deter
1262 mines who may run what.
1264 root ALL = (ALL) ALL
1265 %wheel ALL = (ALL) ALL
1267 We let r
\bro
\boo
\bot
\bt and any user in group w
\bwh
\bhe
\bee
\bel
\bl run any command on
1268 any host as any user.
1270 FULLTIMERS ALL = NOPASSWD: ALL
1272 Full time sysadmins (m
\bmi
\bil
\bll
\ble
\ber
\brt
\bt, m
\bmi
\bik
\bke
\bef
\bf, and d
\bdo
\bow
\bwd
\bdy
\by) may run
1273 any command on any host without authenticating themselves.
1275 PARTTIMERS ALL = ALL
1277 Part time sysadmins (b
\bbo
\bos
\bst
\btl
\ble
\bey
\by, j
\bjw
\bwf
\bfo
\box
\bx, and c
\bcr
\bra
\baw
\bwl
\bl) may run
1278 any command on any host but they must authenticate them
1279 selves first (since the entry lacks the NOPASSWD tag).
1283 The user j
\bja
\bac
\bck
\bk may run any command on the machines in the
1284 _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS alias (the networks 128.138.243.0, 128.138.204.0,
1285 and 128.138.242.0). Of those networks, only 128.138.204.0
1286 has an explicit netmask (in CIDR notation) indicating it
1287 is a class C network. For the other networks in _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS,
1288 the local machine's netmask will be used during matching.
1292 The user l
\bli
\bis
\bsa
\ba may run any command on any host in the
1293 _
\bC_
\bU_
\bN_
\bE_
\bT_
\bS alias (the class B network 128.138.0.0).
1295 operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
1296 sudoedit /etc/printcap, /usr/oper/bin/
1298 The o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br user may run commands limited to simple main
1299 tenance. Here, those are commands related to backups,
1300 killing processes, the printing system, shutting down the
1301 system, and any commands in the directory _
\b/_
\bu_
\bs_
\br_
\b/_
\bo_
\bp_
\be_
\br_
\b/_
\bb_
\bi_
\bn_
\b/.
1303 joe ALL = /usr/bin/su operator
1305 The user j
\bjo
\boe
\be may only _
\bs_
\bu(1) to operator.
1307 pete HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root
1309 The user p
\bpe
\bet
\bte
\be is allowed to change anyone's password
1310 except for root on the _
\bH_
\bP_
\bP_
\bA machines. Note that this
1311 assumes _
\bp_
\ba_
\bs_
\bs_
\bw_
\bd(1) does not take multiple usernames on the
1314 bob SPARC = (OP) ALL : SGI = (OP) ALL
1318 1.6.9p15 March 23, 2008 20
1324 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1327 The user b
\bbo
\bob
\bb may run anything on the _
\bS_
\bP_
\bA_
\bR_
\bC and _
\bS_
\bG_
\bI
1328 machines as any user listed in the _
\bO_
\bP Runas_Alias (r
\bro
\boo
\bot
\bt
1329 and o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br).
1333 The user j
\bji
\bim
\bm may run any command on machines in the _
\bb_
\bi_
\bg_
\bl_
\ba_
\bb
1334 netgroup. s
\bsu
\bud
\bdo
\bo knows that "biglab" is a netgroup due to
1337 +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
1339 Users in the s
\bse
\bec
\bcr
\bre
\bet
\bta
\bar
\bri
\bie
\bes
\bs netgroup need to help manage the
1340 printers as well as add and remove users, so they are
1341 allowed to run those commands on all machines.
1343 fred ALL = (DB) NOPASSWD: ALL
1345 The user f
\bfr
\bre
\bed
\bd can run commands as any user in the _
\bD_
\bB
1346 Runas_Alias (o
\bor
\bra
\bac
\bcl
\ble
\be or s
\bsy
\byb
\bba
\bas
\bse
\be) without giving a password.
1348 john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
1350 On the _
\bA_
\bL_
\bP_
\bH_
\bA machines, user j
\bjo
\boh
\bhn
\bn may su to anyone except
1351 root but he is not allowed to give _
\bs_
\bu(1) any flags.
1353 jen ALL, !SERVERS = ALL
1355 The user j
\bje
\ben
\bn may run any command on any machine except for
1356 those in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias (master, mail, www and
1359 jill SERVERS = /usr/bin/, !SU, !SHELLS
1361 For any machine in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias, j
\bji
\bil
\bll
\bl may run
1362 any commands in the directory _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/ except for those
1363 commands belonging to the _
\bS_
\bU and _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS Cmnd_Aliases.
1365 steve CSNETS = (operator) /usr/local/op_commands/
1367 The user s
\bst
\bte
\bev
\bve
\be may run any command in the directory
1368 /usr/local/op_commands/ but only as user operator.
1370 matt valkyrie = KILL
1372 On his personal workstation, valkyrie, m
\bma
\bat
\btt
\bt needs to be
1373 able to kill hung processes.
1375 WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
1377 On the host www, any user in the _
\bW_
\bE_
\bB_
\bM_
\bA_
\bS_
\bT_
\bE_
\bR_
\bS User_Alias
1378 (will, wendy, and wim), may run any command as user www
1379 (which owns the web pages) or simply _
\bs_
\bu(1) to www.
1384 1.6.9p15 March 23, 2008 21
1390 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1393 ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\
1394 /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
1396 Any user may mount or unmount a CD-ROM on the machines in
1397 the CDROM Host_Alias (orion, perseus, hercules) without
1398 entering a password. This is a bit tedious for users to
1399 type, so it is a prime candidate for encapsulating in a
1402 S
\bSE
\bEC
\bCU
\bUR
\bRI
\bIT
\bTY
\bY N
\bNO
\bOT
\bTE
\bES
\bS
1403 It is generally not effective to "subtract" commands from
1404 ALL using the '!' operator. A user can trivially circum
1405 vent this by copying the desired command to a different
1406 name and then executing that. For example:
1408 bill ALL = ALL, !SU, !SHELLS
1410 Doesn't really prevent b
\bbi
\bil
\bll
\bl from running the commands
1411 listed in _
\bS_
\bU or _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS since he can simply copy those com
1412 mands to a different name, or use a shell escape from an
1413 editor or other program. Therefore, these kind of
1414 restrictions should be considered advisory at best (and
1415 reinforced by policy).
1417 P
\bPR
\bRE
\bEV
\bVE
\bEN
\bNT
\bTI
\bIN
\bNG
\bG S
\bSH
\bHE
\bEL
\bLL
\bL E
\bES
\bSC
\bCA
\bAP
\bPE
\bES
\bS
1418 Once s
\bsu
\bud
\bdo
\bo executes a program, that program is free to do
1419 whatever it pleases, including run other programs. This
1420 can be a security issue since it is not uncommon for a
1421 program to allow shell escapes, which lets a user bypass
1422 s
\bsu
\bud
\bdo
\bo's access control and logging. Common programs that
1423 permit shell escapes include shells (obviously), editors,
1424 paginators, mail and terminal programs.
1426 There are two basic approaches to this problem:
1428 restrict Avoid giving users access to commands that allow
1429 the user to run arbitrary commands. Many edi
1430 tors have a restricted mode where shell escapes
1431 are disabled, though s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt is a better solu
1432 tion to running editors via s
\bsu
\bud
\bdo
\bo. Due to the
1433 large number of programs that offer shell
1434 escapes, restricting users to the set of pro
1435 grams that do not if often unworkable.
1437 noexec Many systems that support shared libraries have
1438 the ability to override default library func
1439 tions by pointing an environment variable (usu
1440 ally LD_PRELOAD) to an alternate shared library.
1441 On such systems, s
\bsu
\bud
\bdo
\bo's _
\bn_
\bo_
\be_
\bx_
\be_
\bc functionality can
1442 be used to prevent a program run by s
\bsu
\bud
\bdo
\bo from
1443 executing any other programs. Note, however,
1444 that this applies only to native dynamically-
1445 linked executables. Statically-linked executa
1446 bles and foreign executables running under
1450 1.6.9p15 March 23, 2008 22
1456 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1459 binary emulation are not affected.
1461 To tell whether or not s
\bsu
\bud
\bdo
\bo supports _
\bn_
\bo_
\be_
\bx_
\be_
\bc, you
1462 can run the following as root:
1464 sudo -V | grep "dummy exec"
1466 If the resulting output contains a line that
1469 File containing dummy exec functions:
1471 then s
\bsu
\bud
\bdo
\bo may be able to replace the exec family
1472 of functions in the standard library with its
1473 own that simply return an error. Unfortunately,
1474 there is no foolproof way to know whether or not
1475 _
\bn_
\bo_
\be_
\bx_
\be_
\bc will work at compile-time. _
\bn_
\bo_
\be_
\bx_
\be_
\bc should
1476 work on SunOS, Solaris, *BSD, Linux, IRIX, Tru64
1477 UNIX, MacOS X, and HP-UX 11.x. It is known n
\bno
\bot
\bt
1478 to work on AIX and UnixWare. _
\bn_
\bo_
\be_
\bx_
\be_
\bc is expected
1479 to work on most operating systems that support
1480 the LD_PRELOAD environment variable. Check your
1481 operating system's manual pages for the dynamic
1482 linker (usually ld.so, ld.so.1, dyld, dld.sl,
1483 rld, or loader) to see if LD_PRELOAD is sup
1486 To enable _
\bn_
\bo_
\be_
\bx_
\be_
\bc for a command, use the NOEXEC
1487 tag as documented in the User Specification sec
1488 tion above. Here is that example again:
1490 aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
1492 This allows user a
\baa
\bar
\bro
\bon
\bn to run _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be and
1493 _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bv_
\bi with _
\bn_
\bo_
\be_
\bx_
\be_
\bc enabled. This will pre
1494 vent those two commands from executing other
1495 commands (such as a shell). If you are unsure
1496 whether or not your system is capable of sup
1497 porting _
\bn_
\bo_
\be_
\bx_
\be_
\bc you can always just try it out
1498 and see if it works.
1500 Note that restricting shell escapes is not a panacea.
1501 Programs running as root are still capable of many poten
1502 tially hazardous operations (such as changing or overwrit
1503 ing files) that could lead to unintended privilege escala
1504 tion. In the specific case of an editor, a safer approach
1505 is to give the user permission to run s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt.
1507 S
\bSE
\bEE
\bE A
\bAL
\bLS
\bSO
\bO
1508 _
\br_
\bs_
\bh(1), _
\bs_
\bu(1), _
\bf_
\bn_
\bm_
\ba_
\bt_
\bc_
\bh(3), _
\bs_
\bu_
\bd_
\bo(1m), _
\bv_
\bi_
\bs_
\bu_
\bd_
\bo(8)
1510 C
\bCA
\bAV
\bVE
\bEA
\bAT
\bTS
\bS
1511 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file should a
\bal
\blw
\bwa
\bay
\bys
\bs be edited by the v
\bvi
\bis
\bsu
\bud
\bdo
\bo
1512 command which locks the file and does grammatical
1516 1.6.9p15 March 23, 2008 23
1522 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1525 checking. It is imperative that _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs be free of syntax
1526 errors since s
\bsu
\bud
\bdo
\bo will not run with a syntactically incor
1527 rect _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file.
1529 When using netgroups of machines (as opposed to users), if
1530 you store fully qualified hostnames in the netgroup (as is
1531 usually the case), you either need to have the machine's
1532 hostname be fully qualified as returned by the hostname
1533 command or use the _
\bf_
\bq_
\bd_
\bn option in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs.
1536 If you feel you have found a bug in s
\bsu
\bud
\bdo
\bo, please submit a
1537 bug report at http://www.sudo.ws/sudo/bugs/
1539 S
\bSU
\bUP
\bPP
\bPO
\bOR
\bRT
\bT
1540 Limited free support is available via the sudo-users mail
1541 ing list, see http://www.sudo.ws/mail
1542 man/listinfo/sudo-users to subscribe or search the
1545 D
\bDI
\bIS
\bSC
\bCL
\bLA
\bAI
\bIM
\bME
\bER
\bR
1546 s
\bsu
\bud
\bdo
\bo is provided ``AS IS'' and any express or implied war
1547 ranties, including, but not limited to, the implied war
1548 ranties of merchantability and fitness for a particular
1549 purpose are disclaimed. See the LICENSE file distributed
1550 with s
\bsu
\bud
\bdo
\bo or http://www.sudo.ws/sudo/license.html for com
1582 1.6.9p15 March 23, 2008 24